diff --git a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-i2c3-rtc-nodes-and-rtc-aliases-t.patch b/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-i2c3-rtc-nodes-and-rtc-aliases-t.patch deleted file mode 100644 index 8da158ec39d6..000000000000 --- a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-i2c3-rtc-nodes-and-rtc-aliases-t.patch +++ /dev/null @@ -1,53 +0,0 @@ -From c7825747afd8bb975dc918f28e4afe8058a518f3 Mon Sep 17 00:00:00 2001 -Message-Id: -From: Christian Hewitt -Date: Mon, 11 Jan 2021 13:58:31 +0000 -Subject: [PATCH 1/9] arm64: dts: meson: add i2c3/rtc nodes and rtc aliases to - ODROID-N2 dtsi - -Enable the onboard pcf8563 rtc hardware on ODROID N2/N2+ boards via the -common dtsi. Also add aliases to ensure vrtc does not claim /dev/rtc0. - -Signed-off-by: Christian Hewitt -Reviewed-by: Neil Armstrong -Signed-off-by: Kevin Hilman -Link: https://lore.kernel.org/r/20210111135831.2218-1-christianshewitt@gmail.com ---- - .../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index 39a09661c5f6..b78be3e6974d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -13,6 +13,8 @@ / { - aliases { - serial0 = &uart_AO; - ethernet0 = ðmac; -+ rtc0 = &rtc; -+ rtc1 = &vrtc; - }; - - dioo2133: audio-amplifier-0 { -@@ -478,6 +480,18 @@ &ir { - linux,rc-map-name = "rc-odroid"; - }; - -+&i2c3 { -+ status = "okay"; -+ pinctrl-0 = <&i2c3_sda_a_pins>, <&i2c3_sck_a_pins>; -+ pinctrl-names = "default"; -+ -+ rtc: rtc@51 { -+ compatible = "nxp,pcf8563"; -+ reg = <0x51>; -+ wakeup-source; -+ }; -+}; -+ - &pwm_ab { - pinctrl-0 = <&pwm_a_e_pins>; - pinctrl-names = "default"; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-support-for-Radxa-Zero-2.patch b/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-support-for-Radxa-Zero-2.patch deleted file mode 100644 index f5918793b0d4..000000000000 --- a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-meson-add-support-for-Radxa-Zero-2.patch +++ /dev/null @@ -1,568 +0,0 @@ -From cd710051786a91ce85e5a635cfc419aefe44a93a Mon Sep 17 00:00:00 2001 -From: Yuntian Zhang -Date: Mon, 17 Jan 2022 12:08:13 +0800 -Subject: [PATCH] arm64: dts: meson: add support for Radxa Zero 2 - -Radxa Zero 2 is a small form factor SBC based on the Amlogic A311D -chipset that ships in a number of eMMC configurations: - -- Amlogic A311D (Quad A73 + Dual A53) CPU -- 4GB LPDDR4 RAM -- 32/64/128GB eMMC -- Mali G52-MP4 GPU -- HDMI 2.1 output (micro) -- BCM4345 WiFi (2.4/5GHz a/b/g/n/ac) and BT 5.0 -- 1x USB 2.0 port - Type C (OTG) -- 1x USB 3.0 port - Type C (Host) -- 1x micro SD Card slot -- 40 Pin GPIO header - -Signed-off-by: Yuntian Zhang -Signed-off-by: Christian Hewitt - -From c445a98d04da3daf3ab6ab0bab2486c46e19e6f7 Mon Sep 17 00:00:00 2001 -From: Yuntian Zhang -Date: Wed, 19 Jan 2022 15:22:25 +0800 -Subject: [PATCH] dt-bindings: arm: amlogic: add missing radxa,zero2 - -Signed-off-by: Yuntian Zhang ---- - arch/arm64/boot/dts/amlogic/Makefile | 1 + - .../dts/amlogic/meson-g12b-radxa-zero2.dts | 499 ++++++++++++++++++ - Documentation/devicetree/bindings/arm/amlogic.yaml | 1 + - 3 files changed, 501 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index d7b10fdebf4d..8e798c3789f9 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -10,6 +10,7 @@ dtb-$(CONFIG_ARCH_MESON) += meson-g12b-a311d-khadas-vim3.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-s922x-khadas-vim3.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2-plus.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-g12b-radxa-zero2.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-ugoos-am6.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxbb-kii-pro.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxbb-nanopi-k2.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts -new file mode 100644 -index 000000000000..32fb44d66a54 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-radxa-zero2.dts -@@ -0,0 +1,499 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2019 BayLibre, SAS -+ * Author: Neil Armstrong -+ * Copyright (c) 2019 Christian Hewitt -+ * Copyright (c) 2022 Radxa Limited -+ * Author: Yuntian Zhang -+ */ -+ -+/dts-v1/; -+ -+#include "meson-g12b-a311d.dtsi" -+#include -+#include -+#include -+#include -+ -+/ { -+ compatible = "radxa,zero2", "amlogic,a311d", "amlogic,g12b"; -+ model = "Radxa Zero2"; -+ -+ aliases { -+ serial0 = &uart_AO; -+ serial2 = &uart_A; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x80000000>; -+ }; -+ -+ gpio-keys-polled { -+ compatible = "gpio-keys-polled"; -+ poll-interval = <100>; -+ power-button { -+ label = "power"; -+ linux,code = ; -+ gpios = <&gpio_ao GPIOAO_3 (GPIO_ACTIVE_LOW | GPIO_PULL_UP)>; -+ }; -+ }; -+ -+ leds { -+ compatible = "gpio-leds"; -+ -+ led-green { -+ color = ; -+ function = LED_FUNCTION_STATUS; -+ gpios = <&gpio GPIOA_12 GPIO_ACTIVE_HIGH>; -+ linux,default-trigger = "heartbeat"; -+ }; -+ }; -+ -+ cvbs-connector { -+ status = "disabled"; -+ compatible = "composite-video-connector"; -+ -+ port { -+ cvbs_connector_in: endpoint { -+ remote-endpoint = <&cvbs_vdac_out>; -+ }; -+ }; -+ }; -+ -+ hdmi-connector { -+ compatible = "hdmi-connector"; -+ type = "a"; -+ -+ port { -+ hdmi_connector_in: endpoint { -+ remote-endpoint = <&hdmi_tx_tmds_out>; -+ }; -+ }; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_12 GPIO_ACTIVE_LOW>; -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>; -+ clocks = <&wifi32k>; -+ clock-names = "ext_clock"; -+ }; -+ -+ ao_5v: regulator-ao_5v { -+ compatible = "regulator-fixed"; -+ regulator-name = "AO_5V"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-always-on; -+ }; -+ -+ vcc_1v8: regulator-vcc_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vcc_3v3>; -+ regulator-always-on; -+ }; -+ -+ vcc_3v3: regulator-vcc_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ /* FIXME: actually controlled by VDDCPU_B_EN */ -+ }; -+ -+ vddao_1v8: regulator-vddao_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_AO1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&ao_5v>; -+ regulator-always-on; -+ }; -+ -+ vddcpu_a: regulator-vddcpu-a { -+ /* -+ * MP8756GD Regulator. -+ */ -+ compatible = "pwm-regulator"; -+ -+ regulator-name = "VDDCPU_A"; -+ regulator-min-microvolt = <730000>; -+ regulator-max-microvolt = <1010000>; -+ -+ pwm-supply = <&ao_5v>; -+ -+ pwms = <&pwm_ab 0 1250 0>; -+ pwm-dutycycle-range = <100 0>; -+ -+ regulator-boot-on; -+ regulator-always-on; -+ }; -+ -+ vddcpu_b: regulator-vddcpu-b { -+ /* -+ * Silergy SY8120B1ABC Regulator. -+ */ -+ compatible = "pwm-regulator"; -+ -+ regulator-name = "VDDCPU_B"; -+ regulator-min-microvolt = <730000>; -+ regulator-max-microvolt = <1010000>; -+ -+ pwm-supply = <&ao_5v>; -+ -+ pwms = <&pwm_AO_cd 1 1250 0>; -+ pwm-dutycycle-range = <100 0>; -+ -+ regulator-boot-on; -+ regulator-always-on; -+ }; -+ -+ sound { -+ compatible = "amlogic,axg-sound-card"; -+ model = "RADXA-ZERO2"; -+ audio-aux-devs = <&tdmout_b>; -+ audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1", -+ "TDMOUT_B IN 1", "FRDDR_B OUT 1", -+ "TDMOUT_B IN 2", "FRDDR_C OUT 1", -+ "TDM_B Playback", "TDMOUT_B OUT"; -+ -+ assigned-clocks = <&clkc CLKID_MPLL2>, -+ <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&frddr_a>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&frddr_b>; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&frddr_c>; -+ }; -+ -+ /* 8ch hdmi interface */ -+ dai-link-3 { -+ sound-dai = <&tdmif_b>; -+ dai-format = "i2s"; -+ dai-tdm-slot-tx-mask-0 = <1 1>; -+ dai-tdm-slot-tx-mask-1 = <1 1>; -+ dai-tdm-slot-tx-mask-2 = <1 1>; -+ dai-tdm-slot-tx-mask-3 = <1 1>; -+ mclk-fs = <256>; -+ -+ codec { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_IN_B>; -+ }; -+ }; -+ -+ /* hdmi glue */ -+ dai-link-4 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>; -+ -+ codec { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ }; -+ -+ wifi32k: wifi32k { -+ compatible = "pwm-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <32768>; -+ pwms = <&pwm_ef 0 30518 0>; /* PWM_E at 32.768KHz */ -+ }; -+}; -+ -+&arb { -+ status = "okay"; -+}; -+ -+&cec_AO { -+ pinctrl-0 = <&cec_ao_a_h_pins>; -+ pinctrl-names = "default"; -+ status = "disabled"; -+ hdmi-phandle = <&hdmi_tx>; -+}; -+ -+&cecb_AO { -+ pinctrl-0 = <&cec_ao_b_h_pins>; -+ pinctrl-names = "default"; -+ status = "okay"; -+ hdmi-phandle = <&hdmi_tx>; -+}; -+ -+&clkc_audio { -+ status = "okay"; -+}; -+ -+&cpu0 { -+ cpu-supply = <&vddcpu_b>; -+ operating-points-v2 = <&cpu_opp_table_0>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu1 { -+ cpu-supply = <&vddcpu_b>; -+ operating-points-v2 = <&cpu_opp_table_0>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu100 { -+ cpu-supply = <&vddcpu_a>; -+ operating-points-v2 = <&cpub_opp_table_1>; -+ clocks = <&clkc CLKID_CPUB_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu101 { -+ cpu-supply = <&vddcpu_a>; -+ operating-points-v2 = <&cpub_opp_table_1>; -+ clocks = <&clkc CLKID_CPUB_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu102 { -+ cpu-supply = <&vddcpu_a>; -+ operating-points-v2 = <&cpub_opp_table_1>; -+ clocks = <&clkc CLKID_CPUB_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu103 { -+ cpu-supply = <&vddcpu_a>; -+ operating-points-v2 = <&cpub_opp_table_1>; -+ clocks = <&clkc CLKID_CPUB_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cvbs_vdac_port { -+ cvbs_vdac_out: endpoint { -+ remote-endpoint = <&cvbs_connector_in>; -+ }; -+}; -+ -+&frddr_a { -+ status = "okay"; -+}; -+ -+&frddr_b { -+ status = "okay"; -+}; -+ -+&frddr_c { -+ status = "okay"; -+}; -+ -+&gpio { -+ gpio-line-names = -+ /* GPIOZ */ -+ "PIN_27", "PIN_28", "PIN_7", "PIN_11", "PIN_13", "PIN_15", "PIN_18", "PIN_40", -+ "", "", "", "", "", "", "", "", -+ /* GPIOH */ -+ "", "", "", "", "PIN_19", "PIN_21", "PIN_24", "PIN_23", -+ "", -+ /* BOOT */ -+ "", "", "", "", "", "", "", "", -+ "", "", "", "", "EMMC_PWRSEQ", "", "", "", -+ /* GPIOC */ -+ "", "", "", "", "", "", "SD_CD", "PIN_36", -+ /* GPIOA */ -+ "PIN_32", "PIN_12", "PIN_35", "", "", "PIN_38", "", "", -+ "", "", "", "", "LED_GREEN", "PIN_31", "PIN_3", "PIN_5", -+ /* GPIOX */ -+ "", "", "", "", "", "", "SDIO_PWRSEQ", "", -+ "", "", "", "", "", "", "", "", -+ "", "BT_SHUTDOWN", "", ""; -+}; -+ -+&gpio_ao { -+ gpio-line-names = -+ /* GPIOAO */ -+ "PIN_8", "PIN_10", "", "BTN_POWER", "", "", "", "PIN_29", -+ "PIN_33", "PIN_37", "FAN", "", -+ /* GPIOE */ -+ "", "", ""; -+}; -+ -+&hdmi_tx { -+ status = "okay"; -+ pinctrl-0 = <&hdmitx_hpd_pins>, <&hdmitx_ddc_pins>; -+ pinctrl-names = "default"; -+ hdmi-supply = <&ao_5v>; -+}; -+ -+&hdmi_tx_tmds_port { -+ hdmi_tx_tmds_out: endpoint { -+ remote-endpoint = <&hdmi_connector_in>; -+ }; -+}; -+ -+&ir { -+ status = "disabled"; -+ pinctrl-0 = <&remote_input_ao_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&pwm_ab { -+ pinctrl-0 = <&pwm_a_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin0"; -+ status = "okay"; -+}; -+ -+&pwm_ef { -+ pinctrl-0 = <&pwm_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin2"; -+ status = "okay"; -+}; -+ -+&pwm_AO_cd { -+ pinctrl-0 = <&pwm_ao_d_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin4"; -+ status = "okay"; -+}; -+ -+&saradc { -+ status = "okay"; -+ vref-supply = <&vddao_1v8>; -+}; -+ -+/* SDIO */ -+&sd_emmc_a { -+ status = "okay"; -+ pinctrl-0 = <&sdio_pins>; -+ pinctrl-1 = <&sdio_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <100000000>; -+ -+ non-removable; -+ disable-wp; -+ -+ /* WiFi firmware requires power to be kept while in suspend */ -+ keep-power-in-suspend; -+ -+ mmc-pwrseq = <&sdio_pwrseq>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddao_1v8>; -+ -+ brcmf: wifi@1 { -+ reg = <1>; -+ compatible = "brcm,bcm4329-fmac"; -+ }; -+}; -+ -+/* SD card */ -+&sd_emmc_b { -+ status = "okay"; -+ pinctrl-0 = <&sdcard_c_pins>; -+ pinctrl-1 = <&sdcard_clk_gate_c_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <50000000>; -+ disable-wp; -+ -+ cd-gpios = <&gpio GPIOC_6 GPIO_ACTIVE_LOW>; -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddao_3v3>; -+}; -+ -+/* eMMC */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_ctrl_pins>, <&emmc_data_8b_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ max-frequency = <200000000>; -+ disable-wp; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&vcc_1v8>; -+}; -+ -+&tdmif_b { -+ status = "okay"; -+}; -+ -+&tdmout_b { -+ status = "okay"; -+}; -+ -+&tohdmitx { -+ status = "okay"; -+}; -+ -+&uart_A { -+ status = "okay"; -+ pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+ -+ bluetooth { -+ compatible = "brcm,bcm43438-bt"; -+ shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; -+ max-speed = <2000000>; -+ clocks = <&wifi32k>; -+ clock-names = "lpo"; -+ }; -+}; -+ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&usb { -+ status = "okay"; -+}; -\ No newline at end of file -diff --git a/Documentation/devicetree/bindings/arm/amlogic.yaml b/Documentation/devicetree/bindings/arm/amlogic.yaml -index 6e6f523d5d91..131f13015eb0 100644 ---- a/Documentation/devicetree/bindings/arm/amlogic.yaml -+++ b/Documentation/devicetree/bindings/arm/amlogic.yaml -@@ -146,6 +146,7 @@ properties: - items: - - enum: - - khadas,vim3 -+ - radxa,zero2 - - const: amlogic,a311d - - const: amlogic,g12b - --- -2.34.1 - diff --git a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-rockchip-emmc-remove-mmc-hs400-enhanced-st.patch b/patch/kernel/archive/meson64-5.10/0001-arm64-dts-rockchip-emmc-remove-mmc-hs400-enhanced-st.patch deleted file mode 100644 index c50c11e62380..000000000000 --- a/patch/kernel/archive/meson64-5.10/0001-arm64-dts-rockchip-emmc-remove-mmc-hs400-enhanced-st.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 26e8623e687e30fa9195e9da22479ccdb6afc91b Mon Sep 17 00:00:00 2001 -From: Artem Lapkin -Date: Wed, 10 Nov 2021 13:22:16 +0800 -Subject: [PATCH] arm64: dts: rockchip: emmc remove mmc-hs400-enhanced-strobe - rk3399-khadas-edge - -Remove mmc-hs400-enhanced-strobe for rk3399-khadas-edge - -Not compitable for some eMMC chips ( BJTD4R 29.1 GiB ). And no -performance difference in our case from emmc-hs400-enhanced-strobe option -for other eMMC chips. - -Problem example ( eMMC chip BJTD4R 29.1 GiB ): - -[ 0.068282] platform ff770000.syscon:phy@f780: Fixing up cyclic dependency with fe330000.mmc -[ 7.001493] mmc2: CQHCI version 5.10 -[ 7.027971] mmc2: SDHCI controller on fe330000.mmc [fe330000.mmc] using ADMA -....... -[ 7.207086] mmc2: mmc_select_hs400es failed, error -110 -[ 7.207129] mmc2: error -110 whilst initialising MMC card -[ 7.308893] mmc2: mmc_select_hs400es failed, error -110 -[ 7.308921] mmc2: error -110 whilst initialising MMC card -[ 7.427524] mmc2: mmc_select_hs400es failed, error -110 -[ 7.427546] mmc2: error -110 whilst initialising MMC card -[ 7.590993] mmc2: mmc_select_hs400es failed, error -110 -[ 7.591012] mmc2: error -110 whilst initialising MMC card - -Workable example without mmc-hs400-enhanced-strobe: - -[ 6.960785] mmc2: CQHCI version 5.10 -[ 6.984672] mmc2: SDHCI controller on fe330000.mmc [fe330000.mmc] using ADMA -[ 7.175021] mmc2: Command Queue Engine enabled -[ 7.175053] mmc2: new HS400 MMC card at address 0001 -[ 7.175808] mmcblk2: mmc2:0001 BJTD4R 29.1 GiB -[ 7.176033] mmcblk2boot0: mmc2:0001 BJTD4R 4.00 MiB -[ 7.176245] mmcblk2boot1: mmc2:0001 BJTD4R 4.00 MiB -[ 7.176495] mmcblk2rpmb: mmc2:0001 BJTD4R 4.00 MiB, chardev (242:0) - -Performance note for mmc-hs400-enhanced-strobe usage: - -Other chips DUTA42 116 GiB works well with or without -mmc-hs400-enhanced-strobe! - -..... mmc-hs400-enhanced-strobe disabled - -786432000 bytes (786 MB, 750 MiB) copied, 3 s, 262 MB/s - -..... mmc-hs400-enhanced-strobe enabled - -[ 7.135880] mmc2: Command Queue Engine enabled -[ 7.135928] mmc2: new HS400 Enhanced strobe MMC card at address 0001 -[ 7.136992] mmcblk2: mmc2:0001 DUTA42 116 GiB - -1048576000 bytes (1.0 GB, 1000 MiB) copied, 4 s, 262 MB/s - -Signed-off-by: Artem Lapkin ---- - arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -index d5c7648c841d..f1fcc6b5b402 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi -@@ -705,7 +705,6 @@ &sdmmc { - &sdhci { - bus-width = <8>; - mmc-hs400-1_8v; -- mmc-hs400-enhanced-strobe; - non-removable; - status = "okay"; - }; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/0002-arm64-dts-meson-add-saradc-node-to-ODROID-N2-N2.patch b/patch/kernel/archive/meson64-5.10/0002-arm64-dts-meson-add-saradc-node-to-ODROID-N2-N2.patch deleted file mode 100644 index 8ee566b0537d..000000000000 --- a/patch/kernel/archive/meson64-5.10/0002-arm64-dts-meson-add-saradc-node-to-ODROID-N2-N2.patch +++ /dev/null @@ -1,37 +0,0 @@ -From ec3b1240b428c5652ccb7fdadad217a2ff8ab4db Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: -From: Hyeonki Hong -Date: Wed, 7 Apr 2021 04:26:08 +0000 -Subject: [PATCH 2/9] arm64: dts: meson: add saradc node to ODROID N2/N2+ - -Add the meson saradc node to the ODROID N2/N2+ common dtsi. - -Signed-off-by: Hyeonki Hong -Signed-off-by: Christian Hewitt -Signed-off-by: Kevin Hilman -Link: https://lore.kernel.org/r/20210407042609.9736-3-christianshewitt@gmail.com ---- - arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index b78be3e6974d..8a5e132c4b79 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -508,6 +508,11 @@ &pwm_AO_cd { - status = "okay"; - }; - -+&saradc { -+ status = "okay"; -+ vref-supply = <&vddao_1v8>; -+}; -+ - /* SD card */ - &sd_emmc_b { - status = "okay"; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0003-arm64-dts-meson-add-GPIO-line-names-to-ODROID-N2-N2.patch b/patch/kernel/archive/meson64-5.10/0003-arm64-dts-meson-add-GPIO-line-names-to-ODROID-N2-N2.patch deleted file mode 100644 index 1d32b68461d1..000000000000 --- a/patch/kernel/archive/meson64-5.10/0003-arm64-dts-meson-add-GPIO-line-names-to-ODROID-N2-N2.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 5ca49a58577f7e9e6f8e0b1cb7c97e756a0e921f Mon Sep 17 00:00:00 2001 -Message-Id: <5ca49a58577f7e9e6f8e0b1cb7c97e756a0e921f.1627311993.git.stefan@agner.ch> -In-Reply-To: -References: -From: Hyeonki Hong -Date: Wed, 7 Apr 2021 04:26:09 +0000 -Subject: [PATCH 3/9] arm64: dts: meson: add GPIO line names to ODROID N2/N2+ - -Add GPIO line-name identifiers to the ODROID N2/N2+ common dtsi. - -Signed-off-by: Hyeonki Hong -Signed-off-by: Christian Hewitt -Reviewed-by: Neil Armstrong -Signed-off-by: Kevin Hilman -Link: https://lore.kernel.org/r/20210407042609.9736-4-christianshewitt@gmail.com ---- - .../dts/amlogic/meson-g12b-odroid-n2.dtsi | 45 +++++++++++++++++++ - 1 file changed, 45 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index 8a5e132c4b79..41b2f9c96b5f 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -446,6 +446,51 @@ &frddr_c { - }; - - &gpio { -+ gpio-line-names = -+ /* GPIOZ */ -+ "", "", "", "", "", "", "", "", -+ "", "", "", "", "", "", "", "", -+ /* GPIOH */ -+ "", "", "", "", "", "", "", "", -+ "", -+ /* BOOT */ -+ "", "", "", "", "", "", "", "", -+ "", "", "", "", "", "", "", "", -+ /* GPIOC */ -+ "", "", "", "", "", "", "", "", -+ /* GPIOA */ -+ "PIN_44", /* GPIOA_0 */ -+ "PIN_46", /* GPIOA_1 */ -+ "PIN_45", /* GPIOA_2 */ -+ "PIN_47", /* GPIOA_3 */ -+ "PIN_26", /* GPIOA_4 */ -+ "", "", "", "", "", "", -+ "PIN_42", /* GPIOA_11 */ -+ "PIN_32", /* GPIOA_12 */ -+ "PIN_7", /* GPIOA_13 */ -+ "PIN_27", /* GPIOA_14 */ -+ "PIN_28", /* GPIOA_15 */ -+ /* GPIOX */ -+ "PIN_16", /* GPIOX_0 */ -+ "PIN_18", /* GPIOX_1 */ -+ "PIN_22", /* GPIOX_2 */ -+ "PIN_11", /* GPIOX_3 */ -+ "PIN_13", /* GPIOX_4 */ -+ "PIN_33", /* GPIOX_5 */ -+ "PIN_35", /* GPIOX_6 */ -+ "PIN_15", /* GPIOX_7 */ -+ "PIN_19", /* GPIOX_8 */ -+ "PIN_21", /* GPIOX_9 */ -+ "PIN_24", /* GPIOX_10 */ -+ "PIN_23", /* GPIOX_11 */ -+ "PIN_8", /* GPIOX_12 */ -+ "PIN_10", /* GPIOX_13 */ -+ "PIN_29", /* GPIOX_14 */ -+ "PIN_31", /* GPIOX_15 */ -+ "PIN_12", /* GPIOX_16 */ -+ "PIN_3", /* GPIOX_17 */ -+ "PIN_5", /* GPIOX_18 */ -+ "PIN_36"; /* GPIOX_19 */ - /* - * WARNING: The USB Hub on the Odroid-N2 needs a reset signal - * to be turned high in order to be detected by the USB Controller --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0004-arm64-dts-meson-g12b-add-power-button-support.patch b/patch/kernel/archive/meson64-5.10/0004-arm64-dts-meson-g12b-add-power-button-support.patch deleted file mode 100644 index 55ae4590f857..000000000000 --- a/patch/kernel/archive/meson64-5.10/0004-arm64-dts-meson-g12b-add-power-button-support.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 70e65f906389f7236fe9ad8e1c05dedac0d1988b Mon Sep 17 00:00:00 2001 -Message-Id: <70e65f906389f7236fe9ad8e1c05dedac0d1988b.1627311993.git.stefan@agner.ch> -In-Reply-To: -References: -From: Stefan Agner -Date: Mon, 11 Jan 2021 11:20:48 +0100 -Subject: [PATCH 4/9] arm64: dts: meson: g12b: add power button support - -Add power button support on J2 pin 11 (GPIOX_3 on the SoC side). The -GPIO is low active, e.g. when connecting with pin 9 (GND) a power -button press is triggered. - -Signed-off-by: Stefan Agner ---- - arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index 41b2f9c96b5f..4b6bb7e74e25 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -39,6 +39,17 @@ emmc_pwrseq: emmc-pwrseq { - reset-gpios = <&gpio BOOT_12 GPIO_ACTIVE_LOW>; - }; - -+ gpio-keys-polled { -+ compatible = "gpio-keys-polled"; -+ poll-interval = <100>; -+ -+ power-button { -+ label = "power"; -+ linux,code = ; -+ gpios = <&gpio GPIOX_3 GPIO_ACTIVE_LOW>; -+ }; -+ }; -+ - leds { - compatible = "gpio-leds"; - --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0005-arm64-dts-meson-g12b-add-GPIO-fan-support.patch b/patch/kernel/archive/meson64-5.10/0005-arm64-dts-meson-g12b-add-GPIO-fan-support.patch deleted file mode 100644 index dc8c5b71acbe..000000000000 --- a/patch/kernel/archive/meson64-5.10/0005-arm64-dts-meson-g12b-add-GPIO-fan-support.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 86d9151effff69d2a8fc2027a31dd60bd8c6eb05 Mon Sep 17 00:00:00 2001 -Message-Id: <86d9151effff69d2a8fc2027a31dd60bd8c6eb05.1627311993.git.stefan@agner.ch> -In-Reply-To: -References: -From: Stefan Agner -Date: Mon, 11 Jan 2021 11:38:54 +0100 -Subject: [PATCH 5/9] arm64: dts: meson: g12b: add GPIO fan support - -Add simple GPIO fan node to support a fan on GPIO J8. Unfortunately the -pad used to control the fan does not support real PWM, hence the RPM -cannot be modulated. - -Signed-off-by: Stefan Agner ---- - arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index 4b6bb7e74e25..e8a3ede698b5 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -39,6 +39,17 @@ emmc_pwrseq: emmc-pwrseq { - reset-gpios = <&gpio BOOT_12 GPIO_ACTIVE_LOW>; - }; - -+ /* -+ * 5V 80x80x10.8mm cooling fan from Hardkernel shop. -+ */ -+ fan0: gpio-fan { -+ #cooling-cells = <2>; -+ compatible = "gpio-fan"; -+ gpio-fan,speed-map = <0 0 1600 1>; -+ gpios = <&gpio_ao GPIOAO_10 GPIO_ACTIVE_HIGH>; -+ status = "okay"; -+ }; -+ - gpio-keys-polled { - compatible = "gpio-keys-polled"; - poll-interval = <100>; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0006-arm64-dts-meson-g12b-odroid-n2-add-fan-as-cooling-de.patch b/patch/kernel/archive/meson64-5.10/0006-arm64-dts-meson-g12b-odroid-n2-add-fan-as-cooling-de.patch deleted file mode 100644 index 1b07af63e037..000000000000 --- a/patch/kernel/archive/meson64-5.10/0006-arm64-dts-meson-g12b-odroid-n2-add-fan-as-cooling-de.patch +++ /dev/null @@ -1,73 +0,0 @@ -From f1120f132dbdf2e7f7acf328de55bbdce877d882 Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: -From: Stefan Agner -Date: Mon, 11 Jan 2021 15:53:55 +0100 -Subject: [PATCH 6/9] arm64: dts: meson: g12b: odroid-n2: add fan as cooling - device -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Add the GPIO fan as a cooling device for the CPU thermal zone. Since we -have only full fan speed available with this, set the tripping point to -30°C. - -Signed-off-by: Stefan Agner ---- - .../dts/amlogic/meson-g12b-odroid-n2.dtsi | 38 +++++++++++++++++++ - 1 file changed, 38 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index e8a3ede698b5..dd345c6aa4b5 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -388,6 +388,44 @@ &clkc_audio { - status = "okay"; - }; - -+&cpu_thermal { -+ trips { -+ cpu_warm: cpu_warm { -+ hysteresis = <5000>; -+ temperature = <30000>; -+ type = "active"; -+ }; -+ }; -+ -+ cooling-maps { -+ map0 { -+ cooling-device = -+ <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ trip = <&cpu_warm>; -+ }; -+ map1 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu100 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu101 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu102 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu103 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ map2 { -+ trip = <&cpu_hot>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu100 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu101 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu102 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu103 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; -+}; -+ - &cpu0 { - cpu-supply = <&vddcpu_b>; - operating-points-v2 = <&cpu_opp_table_0>; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0007-arm64-dts-meson-add-uart_A-node.patch b/patch/kernel/archive/meson64-5.10/0007-arm64-dts-meson-add-uart_A-node.patch deleted file mode 100644 index 1257c45c4da6..000000000000 --- a/patch/kernel/archive/meson64-5.10/0007-arm64-dts-meson-add-uart_A-node.patch +++ /dev/null @@ -1,44 +0,0 @@ -From dcaf2dc71dd62487eb37561682934414a5795e0e Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: -From: Hyeonki Hong -Date: Fri, 27 Mar 2020 17:05:22 +0900 -Subject: [PATCH 7/9] arm64: dts: meson: add uart_A node - -The UART_A is available through J3 pin 8/10 and documented to be -available as UART by default. - -Signed-off-by: Stefan Agner ---- - arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index dd345c6aa4b5..cec346178e3d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -12,6 +12,7 @@ - / { - aliases { - serial0 = &uart_AO; -+ serial1 = &uart_A; - ethernet0 = ðmac; - rtc0 = &rtc; - rtc1 = &vrtc; -@@ -728,6 +729,12 @@ &toddr_c { - status = "okay"; - }; - -+&uart_A { -+ status = "okay"; -+ pinctrl-0 = <&uart_a_pins>; -+ pinctrl-names = "default"; -+}; -+ - &uart_AO { - status = "okay"; - pinctrl-0 = <&uart_ao_a_pins>; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0008-arm64-dts-meson-add-i2c2-node-to-ODROID-N2-N2.patch b/patch/kernel/archive/meson64-5.10/0008-arm64-dts-meson-add-i2c2-node-to-ODROID-N2-N2.patch deleted file mode 100644 index 91a448507204..000000000000 --- a/patch/kernel/archive/meson64-5.10/0008-arm64-dts-meson-add-i2c2-node-to-ODROID-N2-N2.patch +++ /dev/null @@ -1,37 +0,0 @@ -From d5d2d8b9eb93eab85af12f1844975903a7c5a879 Mon Sep 17 00:00:00 2001 -Message-Id: -In-Reply-To: -References: -From: Stefan Agner -Date: Thu, 29 Apr 2021 21:32:43 +0200 -Subject: [PATCH 8/9] arm64: dts: meson: add i2c2 node to ODROID N2/N2+ - -The J2 connectors pinout documents "I2C.SDA0/SCL0" on pin 3 and 5, which -are connected to GPIOX_17/18. This GPIO allow to mux I2C to the second -I2C instance. Enable i2c2 and use the appropriate pinmux. - -Signed-off-by: Stefan Agner ---- - arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index cec346178e3d..f1c3356c78a0 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -586,6 +586,12 @@ &ir { - linux,rc-map-name = "rc-odroid"; - }; - -+&i2c2 { -+ status = "okay"; -+ pinctrl-0 = <&i2c2_sda_x_pins>, <&i2c2_sck_x_pins>; -+ pinctrl-names = "default"; -+}; -+ - &i2c3 { - status = "okay"; - pinctrl-0 = <&i2c3_sda_a_pins>, <&i2c3_sck_a_pins>; --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0009-Revert-of-fdt-Make-sure-no-map-does-not-remove-alrea.patch b/patch/kernel/archive/meson64-5.10/0009-Revert-of-fdt-Make-sure-no-map-does-not-remove-alrea.patch deleted file mode 100644 index 3335e951d83b..000000000000 --- a/patch/kernel/archive/meson64-5.10/0009-Revert-of-fdt-Make-sure-no-map-does-not-remove-alrea.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 19c34c0ceb6302b07e1017c426796c4cf7322d13 Mon Sep 17 00:00:00 2001 -Message-Id: <19c34c0ceb6302b07e1017c426796c4cf7322d13.1627311993.git.stefan@agner.ch> -In-Reply-To: -References: -From: Stefan Agner -Date: Mon, 26 Jul 2021 16:59:08 +0200 -Subject: [PATCH 9/9] Revert "of/fdt: Make sure no-map does not remove already - reserved regions" - -U-Boot on Hardkernel ODROID-N2 adds fdt "memreserve" entries alongside -the reserved-memory nodes present in upstream Linux. This causes -reserving memory with the no-map flag to fail: -[ 0.000000] OF: fdt: Reserved memory: failed to reserve memory for node 'secmon@5000000': base 0x0000000005000000, size 3 MiB - -This seems to cause kernel crashes such as: -[129988.642342] SError Interrupt on CPU4, code 0xbf000000 -- SError - -Restore the bahavior of Linux kernel 5.9 and older and don't fail -updating the mapping with no-map. - -This reverts commit 8a5a75e5e9e55de1cef5d83ca3589cb4899193ef. - -Signed-off-by: Stefan Agner ---- - drivers/of/fdt.c | 10 +--------- - 1 file changed, 1 insertion(+), 9 deletions(-) - -diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c -index 57ff31b6b1e4..7ef2246e0b1e 100644 ---- a/drivers/of/fdt.c -+++ b/drivers/of/fdt.c -@@ -1149,16 +1149,8 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size) - int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base, - phys_addr_t size, bool nomap) - { -- if (nomap) { -- /* -- * If the memory is already reserved (by another region), we -- * should not allow it to be marked nomap. -- */ -- if (memblock_is_region_reserved(base, size)) -- return -EBUSY; -- -+ if (nomap) - return memblock_mark_nomap(base, size); -- } - return memblock_reserve(base, size); - } - --- -2.32.0 - diff --git a/patch/kernel/archive/meson64-5.10/0014-WIP-mmc-meson-gx-mmc-set-core-clock-phase-to-270-deg.patch b/patch/kernel/archive/meson64-5.10/0014-WIP-mmc-meson-gx-mmc-set-core-clock-phase-to-270-deg.patch deleted file mode 100644 index 81a1826933ef..000000000000 --- a/patch/kernel/archive/meson64-5.10/0014-WIP-mmc-meson-gx-mmc-set-core-clock-phase-to-270-deg.patch +++ /dev/null @@ -1,59 +0,0 @@ -From ecf2bcae5fb4c7314f3c36842ae88a31c596d529 Mon Sep 17 00:00:00 2001 -From: Neil Armstrong -Date: Thu, 14 Jan 2021 17:43:02 +0100 -Subject: [PATCH 14/77] WIP: mmc: meson-gx-mmc: set core clock phase to 270 - degres for AXG compatible controllers - -Signed-off-by: Neil Armstrong ---- - drivers/mmc/host/meson-gx-mmc.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c -index 3f28eb4d17fe..c224b0832403 100644 ---- a/drivers/mmc/host/meson-gx-mmc.c -+++ b/drivers/mmc/host/meson-gx-mmc.c -@@ -38,6 +38,7 @@ - #define CLK_RX_PHASE_MASK GENMASK(13, 12) - #define CLK_PHASE_0 0 - #define CLK_PHASE_180 2 -+#define CLK_PHASE_270 3 - #define CLK_V2_TX_DELAY_MASK GENMASK(19, 16) - #define CLK_V2_RX_DELAY_MASK GENMASK(23, 20) - #define CLK_V2_ALWAYS_ON BIT(24) -@@ -136,6 +137,7 @@ struct meson_mmc_data { - unsigned int rx_delay_mask; - unsigned int always_on; - unsigned int adjust; -+ unsigned int clk_core_phase; - }; - - struct sd_emmc_desc { -@@ -426,7 +428,7 @@ static int meson_mmc_clk_init(struct meson_host *host) - /* init SD_EMMC_CLOCK to sane defaults w/min clock rate */ - clk_reg = CLK_ALWAYS_ON(host); - clk_reg |= CLK_DIV_MASK; -- clk_reg |= FIELD_PREP(CLK_CORE_PHASE_MASK, CLK_PHASE_180); -+ clk_reg |= FIELD_PREP(CLK_CORE_PHASE_MASK, host->data->clk_core_phase); - clk_reg |= FIELD_PREP(CLK_TX_PHASE_MASK, CLK_PHASE_0); - clk_reg |= FIELD_PREP(CLK_RX_PHASE_MASK, CLK_PHASE_0); - writel(clk_reg, host->regs + SD_EMMC_CLOCK); -@@ -1291,6 +1293,7 @@ static const struct meson_mmc_data meson_gx_data = { - .rx_delay_mask = CLK_V2_RX_DELAY_MASK, - .always_on = CLK_V2_ALWAYS_ON, - .adjust = SD_EMMC_ADJUST, -+ .clk_core_phase = CLK_PHASE_180, - }; - - static const struct meson_mmc_data meson_axg_data = { -@@ -1298,6 +1301,7 @@ static const struct meson_mmc_data meson_axg_data = { - .rx_delay_mask = CLK_V3_RX_DELAY_MASK, - .always_on = CLK_V3_ALWAYS_ON, - .adjust = SD_EMMC_V3_ADJUST, -+ .clk_core_phase = CLK_PHASE_270, - }; - - static const struct of_device_id meson_mmc_of_match[] = { --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/0051-WIP-arm64-dts-meson-add-audio-playback-to-s905x-p212.patch b/patch/kernel/archive/meson64-5.10/0051-WIP-arm64-dts-meson-add-audio-playback-to-s905x-p212.patch deleted file mode 100644 index ede1aef233bf..000000000000 --- a/patch/kernel/archive/meson64-5.10/0051-WIP-arm64-dts-meson-add-audio-playback-to-s905x-p212.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 86a08466dd986507bbd4d609d2d81d9bfc300999 Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Tue, 18 Feb 2020 03:54:58 +0000 -Subject: [PATCH 051/101] WIP: arm64: dts: meson: add audio playback to - s905x-p212 dtsi - -Signed-off-by: Christian Hewitt ---- - .../dts/amlogic/meson-gxl-s905x-p212.dtsi | 70 +++++++++++++++++++ - 1 file changed, 70 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi -index 43eb7d149e36..ba74f54c5b3f 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi -@@ -11,6 +11,7 @@ - /* Common DTSI for devices which are based on the P212 reference board. */ - - #include "meson-gxl-s905x.dtsi" -+#include - - / { - aliases { -@@ -23,6 +24,13 @@ - stdout-path = "serial0:115200n8"; - }; - -+ dio2133: analog-amplifier { -+ compatible = "simple-audio-amplifier"; -+ sound-name-prefix = "AU2"; -+ VCC-supply = <&hdmi_5v>; -+ enable-gpios = <&gpio GPIOH_5 GPIO_ACTIVE_HIGH>; -+ }; -+ - memory@0 { - device_type = "memory"; - reg = <0x0 0x0 0x0 0x80000000>; -@@ -86,6 +94,68 @@ - clocks = <&wifi32k>; - clock-names = "ext_clock"; - }; -+ -+ sound { -+ compatible = "amlogic,gx-sound-card"; -+ model = "GX-SOUND-CARD"; -+ audio-aux-devs = <&dio2133>; -+ audio-widgets = "Line", "Lineout"; -+ audio-routing = "AU2 INL", "ACODEC LOLN", -+ "AU2 INR", "ACODEC LORN", -+ "Lineout", "AU2 OUTL", -+ "Lineout", "AU2 OUTR"; -+ assigned-clocks = <&clkc CLKID_MPLL2>, -+ <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_FIFO>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_ENCODER>; -+ dai-format = "i2s"; -+ mclk-fs = <512>; -+ -+ codec-0 { -+ sound-dai = <&aiu AIU_HDMI CTRL_I2S>; -+ }; -+ -+ codec-1 { -+ sound-dai = <&aiu AIU_ACODEC CTRL_I2S>; -+ }; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&aiu AIU_HDMI CTRL_OUT>; -+ -+ codec-0 { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ -+ dai-link-3 { -+ sound-dai = <&aiu AIU_ACODEC CTRL_OUT>; -+ -+ codec-0 { -+ sound-dai = <&acodec>; -+ }; -+ }; -+ }; -+}; -+ -+&acodec { -+ AVDD-supply = <&vddio_ao18>; -+ status = "okay"; -+}; -+ -+&aiu { -+ status = "okay"; - }; - - ðmac { --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0055-HACK-media-cec-silence-CEC-timeout-message.patch b/patch/kernel/archive/meson64-5.10/0055-HACK-media-cec-silence-CEC-timeout-message.patch deleted file mode 100644 index cdca23ecb024..000000000000 --- a/patch/kernel/archive/meson64-5.10/0055-HACK-media-cec-silence-CEC-timeout-message.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 03bfb3f6a703d7671508b698c5a552d0a0e0197b Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Tue, 7 Jan 2020 07:12:47 +0000 -Subject: [PATCH 055/101] HACK: media: cec: silence CEC timeout message - -If testing with an AVR that does not pass-through CEC state the system -log fills with timeout messages. Silence this to stop the log rotation -and ensure other issues are visible. - -[ 42.718009] cec-meson_ao_cec: message ff 84 50 00 01 timed out -[ 45.021994] cec-meson_ao_cec: message ff 87 00 15 82 timed out -[ 47.325965] cec-meson_ao_cec: message 10 timed out -[ 49.630023] cec-meson_ao_cec: message 10 timed out -[ 51.933960] cec-meson_ao_cec: message 10 timed out - -Signed-off-by: Christian Hewitt ---- - drivers/media/cec/core/cec-adap.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c -index 6c95dc471d4c..8613cc93eb93 100644 ---- a/drivers/media/cec/core/cec-adap.c -+++ b/drivers/media/cec/core/cec-adap.c -@@ -510,9 +510,9 @@ int cec_thread_func(void *_adap) - * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s). - */ - if (adap->transmitting) { -- pr_warn("cec-%s: message %*ph timed out\n", adap->name, -- adap->transmitting->msg.len, -- adap->transmitting->msg.msg); -+ //pr_warn("cec-%s: message %*ph timed out\n", adap->name, -+ // adap->transmitting->msg.len, -+ // adap->transmitting->msg.msg); - /* Just give up on this. */ - cec_data_cancel(adap->transmitting, - CEC_TX_STATUS_TIMEOUT); --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0056-HACK-revert-mm-emit-tracepoint-when-RSS-changes.patch b/patch/kernel/archive/meson64-5.10/0056-HACK-revert-mm-emit-tracepoint-when-RSS-changes.patch deleted file mode 100644 index 71d4776988b8..000000000000 --- a/patch/kernel/archive/meson64-5.10/0056-HACK-revert-mm-emit-tracepoint-when-RSS-changes.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 4430c1295e48c617757c1293b1b3457928162ab9 Mon Sep 17 00:00:00 2001 -From: chewitt -Date: Thu, 12 Dec 2019 13:48:45 +0000 -Subject: [PATCH 056/101] HACK: revert mm: emit tracepoint when RSS changes - ---- - include/linux/mm.h | 14 +++----------- - include/trace/events/kmem.h | 28 ---------------------------- - mm/memory.c | 6 ------ - 3 files changed, 3 insertions(+), 45 deletions(-) - -diff --git a/include/linux/mm.h b/include/linux/mm.h -index c54fb96cb1e6..db55e0dea9a5 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1629,27 +1629,19 @@ static inline unsigned long get_mm_counter(struct mm_struct *mm, int member) - return (unsigned long)val; - } - --void mm_trace_rss_stat(struct mm_struct *mm, int member, long count); -- - static inline void add_mm_counter(struct mm_struct *mm, int member, long value) - { -- long count = atomic_long_add_return(value, &mm->rss_stat.count[member]); -- -- mm_trace_rss_stat(mm, member, count); -+ atomic_long_add(value, &mm->rss_stat.count[member]); - } - - static inline void inc_mm_counter(struct mm_struct *mm, int member) - { -- long count = atomic_long_inc_return(&mm->rss_stat.count[member]); -- -- mm_trace_rss_stat(mm, member, count); -+ atomic_long_inc(&mm->rss_stat.count[member]); - } - - static inline void dec_mm_counter(struct mm_struct *mm, int member) - { -- long count = atomic_long_dec_return(&mm->rss_stat.count[member]); -- -- mm_trace_rss_stat(mm, member, count); -+ atomic_long_dec(&mm->rss_stat.count[member]); - } - - /* Optimized variant when page is already known not to be PageAnon */ -diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h -index f65b1f6db22d..788e049f899c 100644 ---- a/include/trace/events/kmem.h -+++ b/include/trace/events/kmem.h -@@ -335,34 +335,6 @@ static unsigned int __maybe_unused mm_ptr_to_hash(const void *ptr) - #define __PTR_TO_HASHVAL - #endif - --TRACE_EVENT(rss_stat, -- -- TP_PROTO(struct mm_struct *mm, -- int member, -- long count), -- -- TP_ARGS(mm, member, count), -- -- TP_STRUCT__entry( -- __field(unsigned int, mm_id) -- __field(unsigned int, curr) -- __field(int, member) -- __field(long, size) -- ), -- -- TP_fast_assign( -- __entry->mm_id = mm_ptr_to_hash(mm); -- __entry->curr = !!(current->mm == mm); -- __entry->member = member; -- __entry->size = (count << PAGE_SHIFT); -- ), -- -- TP_printk("mm_id=%u curr=%d member=%d size=%ldB", -- __entry->mm_id, -- __entry->curr, -- __entry->member, -- __entry->size) -- ); - #endif /* _TRACE_KMEM_H */ - - /* This part must be outside protection */ -diff --git a/mm/memory.c b/mm/memory.c -index e8bfdf0d9d1d..889bfbb49e19 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -72,8 +72,6 @@ - #include - #include - --#include -- - #include - #include - #include -@@ -154,10 +152,6 @@ static int __init init_zero_pfn(void) - } - core_initcall(init_zero_pfn); - --void mm_trace_rss_stat(struct mm_struct *mm, int member, long count) --{ -- trace_rss_stat(mm, member, count); --} - - #if defined(SPLIT_RSS_COUNTING) - --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0060-HACK-set-meson-g12-cma-pool-to-896MB.patch b/patch/kernel/archive/meson64-5.10/0060-HACK-set-meson-g12-cma-pool-to-896MB.patch deleted file mode 100644 index c9145870b260..000000000000 --- a/patch/kernel/archive/meson64-5.10/0060-HACK-set-meson-g12-cma-pool-to-896MB.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 0190b87a051b588bd2a7845a858e455bc9ff1af5 Mon Sep 17 00:00:00 2001 -From: chewitt -Date: Wed, 14 Aug 2019 19:58:14 +0000 -Subject: [PATCH 060/101] HACK: set meson-g12 cma pool to 896MB - -This change sets the CMA pool to a larger 896MB! value for (WIP) vdec use - -Signed-off-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -index 4625bdd08c07..3deace05d345 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -@@ -71,7 +71,7 @@ - linux,cma { - compatible = "shared-dma-pool"; - reusable; -- size = <0x0 0x10000000>; -+ size = <0x0 0x38000000>; - alignment = <0x0 0x400000>; - linux,cma-default; - }; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0068-ODROID-COMMON-gpu-drm-add-new-display-resolution-256.patch b/patch/kernel/archive/meson64-5.10/0068-ODROID-COMMON-gpu-drm-add-new-display-resolution-256.patch deleted file mode 100644 index 182b46b806b2..000000000000 --- a/patch/kernel/archive/meson64-5.10/0068-ODROID-COMMON-gpu-drm-add-new-display-resolution-256.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 913a27622881566eeb70336f72f6d40e0598119b Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Thu, 10 Sep 2020 11:01:33 +0900 -Subject: [PATCH 68/75] ODROID-COMMON: gpu/drm: add new display resolution - 2560x1440 - -Signed-off-by: Joy Cho -Signed-off-by: Dongjin Kim ---- - drivers/gpu/drm/meson/meson_vclk.c | 18 ++++++++++++++++++ - drivers/gpu/drm/meson/meson_venc.c | 5 +++-- - 2 files changed, 21 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c -index 0eb86943a358..e734d1be553d 100644 ---- a/drivers/gpu/drm/meson/meson_vclk.c -+++ b/drivers/gpu/drm/meson/meson_vclk.c -@@ -357,6 +357,8 @@ enum { - MESON_VCLK_HDMI_594000, - /* 2970 /1 /1 /1 /5 /1 => /1 /2 */ - MESON_VCLK_HDMI_594000_YUV420, -+/* 4830 /2 /1 /2 /5 /1 => /1 /1 */ -+ MESON_VCLK_HDMI_241500, - }; - - struct meson_vclk_params { -@@ -467,6 +469,18 @@ struct meson_vclk_params { - .vid_pll_div = VID_PLL_DIV_5, - .vclk_div = 1, - }, -+ [MESON_VCLK_HDMI_241500] = { -+ .pll_freq = 4830000, -+ .phy_freq = 2415000, -+ .venc_freq = 241500, -+ .vclk_freq = 241500, -+ .pixel_freq = 241500, -+ .pll_od1 = 2, -+ .pll_od2 = 1, -+ .pll_od3 = 2, -+ .vid_pll_div = VID_PLL_DIV_5, -+ .vclk_div = 1, -+ }, - { /* sentinel */ }, - }; - -@@ -873,6 +887,10 @@ static void meson_vclk_set(struct meson_drm *priv, unsigned int pll_base_freq, - m = 0xf7; - frac = vic_alternate_clock ? 0x8148 : 0x10000; - break; -+ case 4830000: -+ m = 0xc9; -+ frac = 0xd560; -+ break; - } - - meson_hdmi_pll_set_params(priv, m, frac, od1, od2, od3); -diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c -index f93c725b6f02..ebe4f2a92fe0 100644 ---- a/drivers/gpu/drm/meson/meson_venc.c -+++ b/drivers/gpu/drm/meson/meson_venc.c -@@ -866,10 +866,11 @@ meson_venc_hdmi_supported_mode(const struct drm_display_mode *mode) - DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_NVSYNC)) - return MODE_BAD; - -- if (mode->hdisplay < 640 || mode->hdisplay > 1920) -+ /* support higher resolution than 1920x1080 */ -+ if (mode->hdisplay < 640 || mode->hdisplay > 2560) - return MODE_BAD_HVALUE; - -- if (mode->vdisplay < 480 || mode->vdisplay > 1200) -+ if (mode->vdisplay < 480 || mode->vdisplay > 1600) - return MODE_BAD_VVALUE; - - return MODE_OK; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/0068-PCI-DWC-meson-add-256-bytes-MRRS-quirk.patch b/patch/kernel/archive/meson64-5.10/0068-PCI-DWC-meson-add-256-bytes-MRRS-quirk.patch deleted file mode 100644 index b69a8968e876..000000000000 --- a/patch/kernel/archive/meson64-5.10/0068-PCI-DWC-meson-add-256-bytes-MRRS-quirk.patch +++ /dev/null @@ -1,74 +0,0 @@ -From b23c8fb3421984a72578a4235746653dcd2e82b7 Mon Sep 17 00:00:00 2001 -From: Artem Lapkin -Date: Tue, 13 Jul 2021 10:46:41 +0800 -Subject: [PATCH v2] PCI: DWC: meson: add 256 bytes MRRS quirk - -256 bytes maximum read request size. They can't handle -anything larger than this. So force this limit on -any devices attached under these ports. - -Come-from: https://lkml.org/lkml/2021/6/18/160 -Come-from: https://lkml.org/lkml/2021/6/19/19 - -It only affects PCIe in P2P, in non-P2P is will certainly affect -transfers on the internal SoC/Processor/Chip internal bus/fabric. - -These quirks are currently implemented in the -controller driver and only applies when the controller has been probed -and to each endpoint detected on this particular controller. - -Continue having separate quirks for each controller if the core -isn't the right place to handle MPS/MRRS. - ->> Neil - -Signed-off-by: Artem Lapkin ---- - drivers/pci/controller/dwc/pci-meson.c | 31 ++++++++++++++++++++++++++ - 1 file changed, 31 insertions(+) - -diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c -index 686ded034..1498950de 100644 ---- a/drivers/pci/controller/dwc/pci-meson.c -+++ b/drivers/pci/controller/dwc/pci-meson.c -@@ -466,6 +466,37 @@ static int meson_pcie_probe(struct platform_device *pdev) - return ret; - } - -+static void meson_mrrs_limit_quirk(struct pci_dev *dev) -+{ -+ struct pci_bus *bus = dev->bus; -+ int mrrs, mrrs_limit = 256; -+ static const struct pci_device_id bridge_devids[] = { -+ { PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3) }, -+ { 0, }, -+ }; -+ -+ /* look for the matching bridge */ -+ while (!pci_is_root_bus(bus)) { -+ /* -+ * 256 bytes maximum read request size. They can't handle -+ * anything larger than this. So force this limit on -+ * any devices attached under these ports. -+ */ -+ if (!pci_match_id(bridge_devids, bus->self)) { -+ bus = bus->parent; -+ continue; -+ } -+ -+ mrrs = pcie_get_readrq(dev); -+ if (mrrs > mrrs_limit) { -+ pci_info(dev, "limiting MRRS %d to %d\n", mrrs, mrrs_limit); -+ pcie_set_readrq(dev, mrrs_limit); -+ } -+ break; -+ } -+} -+DECLARE_PCI_FIXUP_ENABLE(PCI_ANY_ID, PCI_ANY_ID, meson_mrrs_limit_quirk); -+ - static const struct of_device_id meson_pcie_of_match[] = { - { - .compatible = "amlogic,axg-pcie", --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/0071-ODROID-HC4-Introduce-new-SBC-board-ODROID-HC4.patch b/patch/kernel/archive/meson64-5.10/0071-ODROID-HC4-Introduce-new-SBC-board-ODROID-HC4.patch deleted file mode 100644 index 5e1f37a2f74b..000000000000 --- a/patch/kernel/archive/meson64-5.10/0071-ODROID-HC4-Introduce-new-SBC-board-ODROID-HC4.patch +++ /dev/null @@ -1,88 +0,0 @@ -Add Odroid HC4 ---- - arch/arm64/boot/dts/amlogic/Makefile | 2 + - .../boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 59 +++++++++++++++++++ - .../boot/dts/amlogic/meson64_odroidhc4.dts | 28 +++++++++ - 3 files changed, 89 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts - create mode 100644 arch/arm64/boot/dts/amlogic/meson64_odroidhc4.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index 134389a09ba5..059e5187d223 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -47,5 +47,6 @@ dtb-$(CONFIG_ARCH_MESON) += meson-gxm-wetek-core2.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-sei610.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-khadas-vim3l.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-odroid-c4.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-sm1-odroid-hc4.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-a1-ad401.dtb - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -new file mode 100644 -index 000000000000..92987fece80e ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -@@ -0,0 +1,59 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2020 Dongjin Kim -+ */ -+ -+/dts-v1/; -+ -+#include "meson-sm1-odroid-c4.dts" -+ -+/ { -+ model = "Hardkernel ODROID-HC4"; -+ -+ fan0: pwm-fan { -+ compatible = "pwm-fan"; -+ #cooling-cells = <2>; -+ cooling-min-state = <0>; -+ cooling-max-state = <3>; -+ cooling-levels = <0 120 170 220>; -+ pwms = <&pwm_cd 1 40000 0>; -+ fan-supply = <&vcc_5v>; -+ interrupt-parent = <&gpio_intc>; -+ interrupts = <84 IRQ_TYPE_EDGE_FALLING>; -+ pulses-per-revolutions = <2>; -+ }; -+}; -+ -+&cpu_thermal { -+ cooling-maps { -+ map { -+ trip = <&cpu_passive>; -+ cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; -+}; -+ -+&gpio { -+ /delete-node/ usb-hub; -+}; -+ -+&hub_5v { -+ /delete-property/ gpio; -+ /delete-property/ enable-active-high; -+}; -+ -+&pcie { -+ reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>; -+ status = "okay"; -+}; -+ -+&pwm_cd { -+ status = "okay"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pwm_d_x6_pins>; -+}; -+ -+&usb { -+ phys = <&usb2_phy0>, <&usb2_phy1>; -+ phy-names = "usb2-phy0", "usb2-phy1"; -+}; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/0081-FROMLIST-arm64-dts-meson-gxl-s905x-khadas-vim-add-th.patch b/patch/kernel/archive/meson64-5.10/0081-FROMLIST-arm64-dts-meson-gxl-s905x-khadas-vim-add-th.patch deleted file mode 100644 index 5f7846eaacd1..000000000000 --- a/patch/kernel/archive/meson64-5.10/0081-FROMLIST-arm64-dts-meson-gxl-s905x-khadas-vim-add-th.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 8ab1155a0723c02a717267e34ae823f118f40e53 Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Fri, 21 Feb 2020 05:28:24 +0000 -Subject: [PATCH 081/101] FROMLIST: arm64: dts: meson: gxl-s905x-khadas-vim: - add thermal zones - -Add thermal zones to the VIM1 board so that a cooling fan can be driven -using the i2c interface. Zone config is copied from the VIM2. - -Suggested-by: Nick Xie -Signed-off-by: Christian Hewitt ---- - .../amlogic/meson-gxl-s905x-khadas-vim.dts | 50 +++++++++++++++++++ - 1 file changed, 50 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -index 440bc23c7342..2c198c4212b2 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -@@ -6,6 +6,7 @@ - /dts-v1/; - - #include -+#include - - #include "meson-gxl-s905x-p212.dtsi" - -@@ -63,6 +64,39 @@ - }; - }; - }; -+ -+ thermal-zones { -+ cpu-thermal { -+ polling-delay-passive = <250>; /* milliseconds */ -+ polling-delay = <1000>; /* milliseconds */ -+ -+ thermal-sensors = <&scpi_sensors 0>; -+ -+ trips { -+ cpu_alert0: cpu-alert0 { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "active"; -+ }; -+ -+ cpu_alert1: cpu-alert1 { -+ temperature = <80000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ }; -+ -+ cooling-maps { -+ map0 { -+ trip = <&cpu_alert1>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; -+ }; -+ }; - }; - - &cec_AO { -@@ -72,6 +106,22 @@ - hdmi-phandle = <&hdmi_tx>; - }; - -+&cpu0 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu1 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu2 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu3 { -+ #cooling-cells = <2>; -+}; -+ - &hdmi_tx { - status = "okay"; - pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0100-ETH-setup-mac-address-from-command-line.patch b/patch/kernel/archive/meson64-5.10/0100-ETH-setup-mac-address-from-command-line.patch deleted file mode 100644 index 0603ed3bc640..000000000000 --- a/patch/kernel/archive/meson64-5.10/0100-ETH-setup-mac-address-from-command-line.patch +++ /dev/null @@ -1,74 +0,0 @@ -From d714aa2f0b8cb6265beb0d15f99d4c87fb934c15 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Wed, 25 Dec 2019 13:41:52 +0800 -Subject: [PATCH 100/101] ETH: setup mac address from command line - -Signed-off-by: Nick Xie ---- - .../ethernet/stmicro/stmmac/stmmac_platform.c | 42 +++++++++++++++++++ - 1 file changed, 42 insertions(+) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -index 13fafd905db8..2b2dccd04cbf 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -@@ -21,6 +21,40 @@ - - #ifdef CONFIG_OF - -+#if defined (CONFIG_DWMAC_MESON) || defined (CONFIG_DWMAC_ROCKCHIP) -+static u8 DEFMAC[] = {0, 0, 0, 0, 0, 0}; -+static unsigned int g_mac_addr_setup; -+static unsigned char chartonum(char c) -+{ -+ if (c >= '0' && c <= '9') -+ return c - '0'; -+ if (c >= 'A' && c <= 'F') -+ return (c - 'A') + 10; -+ if (c >= 'a' && c <= 'f') -+ return (c - 'a') + 10; -+ -+ return 0; -+} -+ -+static int __init mac_addr_set(char *line) -+{ -+ unsigned char mac[6]; -+ int i = 0; -+ -+ for (i = 0; i < 6 && line[0] != '\0' && line[1] != '\0'; i++) { -+ mac[i] = chartonum(line[0]) << 4 | chartonum(line[1]); -+ line += 3; -+ } -+ memcpy(DEFMAC, mac, 6); -+ pr_info("uboot setup mac-addr: %02x:%02x:%02x:%02x:%02x:%02x\n", -+ DEFMAC[0], DEFMAC[1], DEFMAC[2], DEFMAC[3], DEFMAC[4], DEFMAC[5]); -+ g_mac_addr_setup++; -+ return 0; -+} -+__setup("mac=", mac_addr_set); -+#endif -+ -+ - /** - * dwmac1000_validate_mcast_bins - validates the number of Multicast filter bins - * @dev: struct device of the platform device -@@ -404,7 +438,15 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) - if (!plat) - return ERR_PTR(-ENOMEM); - -+#if defined (CONFIG_DWMAC_MESON) || defined (CONFIG_DWMAC_ROCKCHIP) -+ if (g_mac_addr_setup) /*so uboot mac= is first priority.*/ -+ *mac = DEFMAC; -+ else -+ *mac = of_get_mac_address(np); -+#else - *mac = of_get_mac_address(np); -+#endif -+ - if (IS_ERR(*mac)) { - if (PTR_ERR(*mac) == -EPROBE_DEFER) - return ERR_CAST(*mac); --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/0350-drm-dw-hdmi-call-hdmi_set_cts_n-after-clock-is-.patch b/patch/kernel/archive/meson64-5.10/0350-drm-dw-hdmi-call-hdmi_set_cts_n-after-clock-is-.patch deleted file mode 100644 index 07ee4d3fbfd1..000000000000 --- a/patch/kernel/archive/meson64-5.10/0350-drm-dw-hdmi-call-hdmi_set_cts_n-after-clock-is-.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 192ff185a6f85f2519cc4b97aa015a836f5a8fbb Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 9 Jul 2018 21:25:15 +0200 -Subject: [PATCH 10/84] TEMP: drm: dw-hdmi: call hdmi_set_cts_n after clock is - enabled - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 521d689..e4ab11a 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -688,6 +688,11 @@ static void hdmi_enable_audio_clk(struct dw_hdmi *hdmi, bool enable) - else - hdmi->mc_clkdis |= HDMI_MC_CLKDIS_AUDCLK_DISABLE; - hdmi_writeb(hdmi, hdmi->mc_clkdis, HDMI_MC_CLKDIS); -+ -+ if (enable) { -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, 0); -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+ } - } - - static void dw_hdmi_ahb_audio_enable(struct dw_hdmi *hdmi) --- -2.7.1 - diff --git a/patch/kernel/archive/meson64-5.10/9999-FROMLIST-v1-spi-nor-add-support-for-XT25F128B.patch b/patch/kernel/archive/meson64-5.10/9999-FROMLIST-v1-spi-nor-add-support-for-XT25F128B.patch deleted file mode 100644 index e8e6d946bcaa..000000000000 --- a/patch/kernel/archive/meson64-5.10/9999-FROMLIST-v1-spi-nor-add-support-for-XT25F128B.patch +++ /dev/null @@ -1,90 +0,0 @@ -From a5dc8bb92c6b67be7e48d442e821837b03fc129a Mon Sep 17 00:00:00 2001 -From: Andreas Rammhold -Date: Thu, 28 Jan 2021 09:43:36 +0000 -Subject: [PATCH 17/58] FROMLIST(v1): spi-nor: add support for XT25F128B - -This adds support for the XT25F128B as found on the RockPi4b SBC. - -Signed-off-by: Andreas Rammhold ---- - -This continues the efforts done in [1] & [2] that went stale. I've -tested this patch on my RockPi4b which only has the xt25f128b (and not -the xt25f32b as also propsed in [2]). I have tried to obtain a copy of -the datasheets but was unable to find them. Not sure whre you would get -them. - -While [1] was already for the new spi-nor layout it was missing the bits -in the core.{c,h} files. - -[1]: https://patchwork.ozlabs.org/project/linux-mtd/patch/CAMgqO2y9MYDj6antOaWLBRKU8vGEwqCB-Y1TkXTSWsmsed+W6A@mail.gmail.com/ -[2]: https://patchwork.ozlabs.org/project/linux-mtd/patch/20200206171941.GA2398@makrotopia.org/ ---- - drivers/mtd/spi-nor/Makefile | 1 + - drivers/mtd/spi-nor/core.c | 1 + - drivers/mtd/spi-nor/core.h | 1 + - drivers/mtd/spi-nor/xtx.c | 16 ++++++++++++++++ - 4 files changed, 19 insertions(+) - create mode 100644 drivers/mtd/spi-nor/xtx.c - -diff --git a/drivers/mtd/spi-nor/Makefile b/drivers/mtd/spi-nor/Makefile -index 653923896205..3f7a52d7fa0b 100644 ---- a/drivers/mtd/spi-nor/Makefile -+++ b/drivers/mtd/spi-nor/Makefile -@@ -17,6 +17,7 @@ spi-nor-objs += sst.o - spi-nor-objs += winbond.o - spi-nor-objs += xilinx.o - spi-nor-objs += xmc.o -+spi-nor-objs += xtx.o - obj-$(CONFIG_MTD_SPI_NOR) += spi-nor.o - - obj-$(CONFIG_MTD_SPI_NOR) += controllers/ -diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c -index 0522304f52fa..9a89ec473e4b 100644 ---- a/drivers/mtd/spi-nor/core.c -+++ b/drivers/mtd/spi-nor/core.c -@@ -2215,6 +2215,7 @@ static const struct spi_nor_manufacturer *manufacturers[] = { - &spi_nor_winbond, - &spi_nor_xilinx, - &spi_nor_xmc, -+ &spi_nor_xtx, - }; - - static const struct flash_info * -diff --git a/drivers/mtd/spi-nor/core.h b/drivers/mtd/spi-nor/core.h -index 4a3f7f150b5d..ee0e45eaffcd 100644 ---- a/drivers/mtd/spi-nor/core.h -+++ b/drivers/mtd/spi-nor/core.h -@@ -425,6 +425,7 @@ extern const struct spi_nor_manufacturer spi_nor_sst; - extern const struct spi_nor_manufacturer spi_nor_winbond; - extern const struct spi_nor_manufacturer spi_nor_xilinx; - extern const struct spi_nor_manufacturer spi_nor_xmc; -+extern const struct spi_nor_manufacturer spi_nor_xtx; - - void spi_nor_spimem_setup_op(const struct spi_nor *nor, - struct spi_mem_op *op, -diff --git a/drivers/mtd/spi-nor/xtx.c b/drivers/mtd/spi-nor/xtx.c -new file mode 100644 -index 000000000000..a10102d8b3e2 ---- /dev/null -+++ b/drivers/mtd/spi-nor/xtx.c -@@ -0,0 +1,16 @@ -+// SPDX-License-Identifier: GPL-2.0 -+ -+#include -+ -+#include "core.h" -+ -+static const struct flash_info xtx_parts[] = { -+ /* XTX (Shenzhen Xin Tian Xia Tech) */ -+ { "xt25f128b", INFO(0x0b4018, 0, 64 * 1024, 256, SECT_4K) }, -+}; -+ -+const struct spi_nor_manufacturer spi_nor_xtx = { -+ .name = "xtx", -+ .parts = xtx_parts, -+ .nparts = ARRAY_SIZE(xtx_parts), -+}; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/9999-HACK-Add_SPI_Flash_enabled_versions_of_N2_and_N2Plus_DTBs.patch b/patch/kernel/archive/meson64-5.10/9999-HACK-Add_SPI_Flash_enabled_versions_of_N2_and_N2Plus_DTBs.patch deleted file mode 100644 index 5f5be25f5364..000000000000 --- a/patch/kernel/archive/meson64-5.10/9999-HACK-Add_SPI_Flash_enabled_versions_of_N2_and_N2Plus_DTBs.patch +++ /dev/null @@ -1,83 +0,0 @@ -Index: arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-spi.dts -IDEA additional info: -Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP -<+>UTF-8 -=================================================================== -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-spi.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-spi.dts -new file mode 100644 ---- /dev/null (date 1630421486471) -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-spi.dts (date 1630421486471) -@@ -0,0 +1,11 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+ -+/dts-v1/; -+ -+#include "meson-g12b-odroid-n2.dts" -+ -+/ { -+ model = "Hardkernel ODROID-N2 with SPI"; -+}; -+ -+#include "meson-g12b-odroid-n2-enable-spi.dtsi" -Index: arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-plus-spi.dts -IDEA additional info: -Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP -<+>UTF-8 -=================================================================== -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-plus-spi.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-plus-spi.dts -new file mode 100644 ---- /dev/null (date 1630421477913) -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-plus-spi.dts (date 1630421477913) -@@ -0,0 +1,11 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+ -+/dts-v1/; -+ -+#include "meson-g12b-odroid-n2-plus.dts" -+ -+/ { -+ model = "Hardkernel ODROID-N2Plus with SPI"; -+}; -+ -+#include "meson-g12b-odroid-n2-enable-spi.dtsi" -Index: arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-enable-spi.dtsi -IDEA additional info: -Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP -<+>UTF-8 -=================================================================== -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-enable-spi.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-enable-spi.dtsi -new file mode 100644 ---- /dev/null (date 1630421525557) -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-enable-spi.dtsi (date 1630421525557) -@@ -0,0 +1,13 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+ -+/* -+ * Replace emmc_data_8b_pins to emmc_data_4b_pins from sd_emmc_c pinctrl-0, and change bus-width to 4 then spifc can be enabled. -+ */ -+&sd_emmc_c { -+ pinctrl-0 = <&emmc_ctrl_pins>, <&emmc_data_4b_pins>, <&emmc_ds_pins>; -+ bus-width = <4>; -+}; -+ -+&spifc { -+ status = "okay"; -+}; -Index: arch/arm64/boot/dts/amlogic/Makefile -IDEA additional info: -Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP -<+>UTF-8 -=================================================================== -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile ---- a/arch/arm64/boot/dts/amlogic/Makefile (revision b91db6a0b52e019b6bdabea3f1dbe36d85c7e52c) -+++ b/arch/arm64/boot/dts/amlogic/Makefile (date 1630421076946) -@@ -9,7 +9,9 @@ - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-a311d-khadas-vim3.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-s922x-khadas-vim3.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2-spi.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2-plus.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2-plus-spi.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12b-ugoos-am6.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxbb-kii-pro.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxbb-nanopi-k2.dtb diff --git a/patch/kernel/archive/meson64-5.10/9999-WIP-arm64-dts-meson-add-spifc-node-to-ODROID-HC4.patch b/patch/kernel/archive/meson64-5.10/9999-WIP-arm64-dts-meson-add-spifc-node-to-ODROID-HC4.patch deleted file mode 100644 index 7b03f8be0c95..000000000000 --- a/patch/kernel/archive/meson64-5.10/9999-WIP-arm64-dts-meson-add-spifc-node-to-ODROID-HC4.patch +++ /dev/null @@ -1,41 +0,0 @@ -From c56aba5bb32d03e1c8806363dfa50245175907b4 Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Thu, 28 Jan 2021 17:15:22 +0000 -Subject: [PATCH 27/58] WIP: arm64: dts: meson: add spifc node to ODROID-HC4 - -Add a node for the XT25F128B SPI-NOR flash to make it accessible -from Linux. - -Signed-off-by: Christian Hewitt ---- - .../boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -index bf15700c4b15..5268d064ba1b 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -@@ -90,6 +90,20 @@ &sd_emmc_c { - status = "disabled"; - }; - -+&spifc { -+ status = "okay"; -+ pinctrl-0 = <&nor_pins>; -+ pinctrl-names = "default"; -+ -+ xt25f128b: spi-flash@0 { -+ #address-cells = <1>; -+ #size-cells = <1>; -+ compatible = "jedec,spi-nor"; -+ reg = <0>; -+ spi-max-frequency = <104000000>; -+ }; -+}; -+ - &usb { - phys = <&usb2_phy0>, <&usb2_phy1>; - phy-names = "usb2-phy0", "usb2-phy1"; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/Add-support-of-CEC-wakeup-on-Amlogic-G12-and-SM1-SoCs.patch b/patch/kernel/archive/meson64-5.10/Add-support-of-CEC-wakeup-on-Amlogic-G12-and-SM1-SoCs.patch deleted file mode 100644 index f625738abf55..000000000000 --- a/patch/kernel/archive/meson64-5.10/Add-support-of-CEC-wakeup-on-Amlogic-G12-and-SM1-SoCs.patch +++ /dev/null @@ -1,89 +0,0 @@ - -add register configuration to activate wakeup feature in bl301 - -Tested-by: Kevin Hilman -Signed-off-by: Guillaume La Roque -Reviewed-by: Neil Armstrong ---- - drivers/media/platform/meson/ao-cec-g12a.c | 33 ++++++++++++++++++++++ - 1 file changed, 33 insertions(+) - -diff --git a/drivers/media/cec/platform/meson/ao-cec-g12a.c b/drivers/media/cec/platform/meson/ao-cec-g12a.c -index 891533060d49..85850b974126 100644 ---- a/drivers/media/cec/platform/meson/ao-cec-g12a.c -+++ b/drivers/media/cec/platform/meson/ao-cec-g12a.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - /* CEC Registers */ - -@@ -168,6 +169,18 @@ - - #define CECB_WAKEUPCTRL 0x31 - -+#define CECB_FUNC_CFG_REG 0xA0 -+#define CECB_FUNC_CFG_MASK GENMASK(6, 0) -+#define CECB_FUNC_CFG_CEC_ON 0x01 -+#define CECB_FUNC_CFG_OTP_ON 0x02 -+#define CECB_FUNC_CFG_AUTO_STANDBY 0x04 -+#define CECB_FUNC_CFG_AUTO_POWER_ON 0x08 -+#define CECB_FUNC_CFG_ALL 0x2f -+#define CECB_FUNC_CFG_NONE 0x0 -+ -+#define CECB_LOG_ADDR_REG 0xA4 -+#define CECB_LOG_ADDR_MASK GENMASK(22, 16) -+ - struct meson_ao_cec_g12a_data { - /* Setup the internal CECB_CTRL2 register */ - bool ctrl2_setup; -@@ -177,6 +190,7 @@ struct meson_ao_cec_g12a_device { - struct platform_device *pdev; - struct regmap *regmap; - struct regmap *regmap_cec; -+ struct regmap *regmap_ao_sysctrl; - spinlock_t cec_reg_lock; - struct cec_notifier *notify; - struct cec_adapter *adap; -@@ -518,6 +532,13 @@ meson_ao_cec_g12a_set_log_addr(struct cec_adapter *adap, u8 logical_addr) - BIT(logical_addr - 8)); - } - -+ if (ao_cec->regmap_ao_sysctrl) -+ ret |= regmap_update_bits(ao_cec->regmap_ao_sysctrl, -+ CECB_LOG_ADDR_REG, -+ CECB_LOG_ADDR_MASK, -+ FIELD_PREP(CECB_LOG_ADDR_MASK, -+ logical_addr)); -+ - /* Always set Broadcast/Unregistered 15 address */ - ret |= regmap_update_bits(ao_cec->regmap_cec, CECB_LADD_HIGH, - BIT(CEC_LOG_ADDR_UNREGISTERED - 8), -@@ -618,6 +639,13 @@ static int meson_ao_cec_g12a_adap_enable(struct cec_adapter *adap, bool enable) - regmap_write(ao_cec->regmap_cec, CECB_CTRL2, - FIELD_PREP(CECB_CTRL2_RISE_DEL_MAX, 2)); - -+ if (ao_cec->regmap_ao_sysctrl) { -+ regmap_update_bits(ao_cec->regmap_ao_sysctrl, -+ CECB_FUNC_CFG_REG, -+ CECB_FUNC_CFG_MASK, -+ CECB_FUNC_CFG_ALL); -+ } -+ - meson_ao_cec_g12a_irq_setup(ao_cec, true); - - return 0; -@@ -685,6 +713,11 @@ static int meson_ao_cec_g12a_probe(struct platform_device *pdev) - goto out_probe_adapter; - } - -+ ao_cec->regmap_ao_sysctrl = syscon_regmap_lookup_by_phandle -+ (pdev->dev.of_node, "amlogic,ao-sysctrl"); -+ if (IS_ERR(ao_cec->regmap_ao_sysctrl)) -+ dev_warn(&pdev->dev, "ao-sysctrl syscon regmap lookup failed.\n"); -+ - irq = platform_get_irq(pdev, 0); - ret = devm_request_threaded_irq(&pdev->dev, irq, - meson_ao_cec_g12a_irq, diff --git a/patch/kernel/archive/meson64-5.10/SOC-GXM-fix-cpu-scheduling.patch b/patch/kernel/archive/meson64-5.10/SOC-GXM-fix-cpu-scheduling.patch deleted file mode 100644 index b37d152249e3..000000000000 --- a/patch/kernel/archive/meson64-5.10/SOC-GXM-fix-cpu-scheduling.patch +++ /dev/null @@ -1,64 +0,0 @@ -[0] https://github.com/torvalds/linux/commit/6eeaf4d2452ec8b1ece58776812140734fc2e088 - -Signed-off-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/meson-gxm.dtsi | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi -index fe4145112295c..411cc312fc62b 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi -@@ -42,11 +42,28 @@ - }; - }; - -+ cpu0: cpu@0 { -+ capacity-dmips-mhz = <1024>; -+ }; -+ -+ cpu1: cpu@1 { -+ capacity-dmips-mhz = <1024>; -+ }; -+ -+ cpu2: cpu@2 { -+ capacity-dmips-mhz = <1024>; -+ }; -+ -+ cpu3: cpu@3 { -+ capacity-dmips-mhz = <1024>; -+ }; -+ - cpu4: cpu@100 { - device_type = "cpu"; - compatible = "arm,cortex-a53"; - reg = <0x0 0x100>; - enable-method = "psci"; -+ capacity-dmips-mhz = <1024>; - next-level-cache = <&l2>; - clocks = <&scpi_dvfs 1>; - #cooling-cells = <2>; -@@ -57,6 +74,7 @@ - compatible = "arm,cortex-a53"; - reg = <0x0 0x101>; - enable-method = "psci"; -+ capacity-dmips-mhz = <1024>; - next-level-cache = <&l2>; - clocks = <&scpi_dvfs 1>; - #cooling-cells = <2>; -@@ -67,6 +85,7 @@ - compatible = "arm,cortex-a53"; - reg = <0x0 0x102>; - enable-method = "psci"; -+ capacity-dmips-mhz = <1024>; - next-level-cache = <&l2>; - clocks = <&scpi_dvfs 1>; - #cooling-cells = <2>; -@@ -77,6 +96,7 @@ - compatible = "arm,cortex-a53"; - reg = <0x0 0x103>; - enable-method = "psci"; -+ capacity-dmips-mhz = <1024>; - next-level-cache = <&l2>; - clocks = <&scpi_dvfs 1>; - #cooling-cells = <2>; diff --git a/patch/kernel/archive/meson64-5.10/SOC-SM1-Add-higher-clocks.patch b/patch/kernel/archive/meson64-5.10/SOC-SM1-Add-higher-clocks.patch deleted file mode 100644 index d367bae1933f..000000000000 --- a/patch/kernel/archive/meson64-5.10/SOC-SM1-Add-higher-clocks.patch +++ /dev/null @@ -1,34 +0,0 @@ -From a11802ecb5686153614aa19a089900c22928988c Mon Sep 17 00:00:00 2001 -From: Igor Pecovnik -Date: Tue, 4 Aug 2020 22:51:56 +0200 -Subject: [PATCH] Add higher clocks for SM1 family - -Signed-off-by: Igor Pecovnik ---- - arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -index d4ec735fb..a35cad1d4 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -@@ -150,6 +150,16 @@ opp-1908000000 { - opp-hz = /bits/ 64 <1908000000>; - opp-microvolt = <950000>; - }; -+ -+ opp-2016000000 { -+ opp-hz = /bits/ 64 <2016000000>; -+ opp-microvolt = <1000000>; -+ }; -+ -+ opp-2100000000 { -+ opp-hz = /bits/ 64 <2100000000>; -+ opp-microvolt = <1022000>; -+ }; - }; - }; - --- -Created with Armbian build tools https://github.com/armbian/build - diff --git a/patch/kernel/archive/meson64-5.10/arm64-dts-amlogic-add-support-for-Radxa-Zero.patch b/patch/kernel/archive/meson64-5.10/arm64-dts-amlogic-add-support-for-Radxa-Zero.patch deleted file mode 100644 index ce02604166cb..000000000000 --- a/patch/kernel/archive/meson64-5.10/arm64-dts-amlogic-add-support-for-Radxa-Zero.patch +++ /dev/null @@ -1,590 +0,0 @@ -Radxa Zero is a small form-factor SBC with an Amlogic S905Y2 chip. - -Signed-off-by: Christian Hewitt ---- - Documentation/devicetree/bindings/arm/amlogic.yaml | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/Documentation/devicetree/bindings/arm/amlogic.yaml b/Documentation/devicetree/bindings/arm/amlogic.yaml -index 6423377710ee..67dccdd9a5a4 100644 ---- a/Documentation/devicetree/bindings/arm/amlogic.yaml -+++ b/Documentation/devicetree/bindings/arm/amlogic.yaml -@@ -141,6 +141,7 @@ properties: - - enum: - - amediatech,x96-max - - amlogic,u200 -+ - radxa,zero - - seirobotics,sei510 - - const: amlogic,g12a - - -From patchwork Mon Aug 9 13:10:47 2021 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -X-Patchwork-Submitter: Christian Hewitt -X-Patchwork-Id: 12426441 -Return-Path: - -X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on - aws-us-west-2-korg-lkml-1.web.codeaurora.org -X-Spam-Level: -X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, - DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN, - FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, - INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, - USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 -Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) - by smtp.lore.kernel.org (Postfix) with ESMTP id F3F8FC4338F - for ; - Mon, 9 Aug 2021 13:11:55 +0000 (UTC) -Received: from bombadil.infradead.org (bombadil.infradead.org - [198.137.202.133]) - (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) - (No client certificate requested) - by mail.kernel.org (Postfix) with ESMTPS id AECC660F93 - for ; - Mon, 9 Aug 2021 13:11:55 +0000 (UTC) -DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org AECC660F93 -Authentication-Results: mail.kernel.org; - dmarc=fail (p=none dis=none) header.from=gmail.com -Authentication-Results: mail.kernel.org; - spf=none smtp.mailfrom=lists.infradead.org -DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; - d=lists.infradead.org; s=bombadil.20210309; h=Sender: - Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: - List-Post:List-Archive:List-Unsubscribe:List-Id:References:In-Reply-To: - Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: - Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: - List-Owner; bh=UtJnQJv5YBh4UBWss0yz5LmywXBwOrPPIdXazFksFBI=; b=c0Myi64WNAi84D - gifpsVNc+yFpMtZF3AF4YNybnBchZeKImaQoBntIuKGadNwg/szcl+IyUsVlGPQIaq0AHFwykTNVj - VmAE12NkXHooA9hR3Ept1Kolilx577f1OGytWIvZDcr/DaKDndzoDzuOdLFZUKANmhykOCVfWvYw/ - C4gE6f9XMy0WTfyHF3y3ozYF8kqJg/pgRuhxr01LK8f9JCgyXslgcd80bOPfo8+/vgJvwq7cL07zf - EWOIDmF4J+yaZdpleTZ4B9yW1i1AbwWN9kHeCycNpmzvruJIkplBiOpLaM3oI3Z7nOZtnUVLDtMX8 - Ma30JD76VzaXo/NqlxaQ==; -Received: from localhost ([::1] helo=bombadil.infradead.org) - by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) - id 1mD54I-000hvm-Ht; Mon, 09 Aug 2021 13:11:50 +0000 -Received: from mail-wm1-x334.google.com ([2a00:1450:4864:20::334]) - by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) - id 1mD53R-000hZa-KA; Mon, 09 Aug 2021 13:11:00 +0000 -Received: by mail-wm1-x334.google.com with SMTP id u1so570524wmm.0; - Mon, 09 Aug 2021 06:10:56 -0700 (PDT) -DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; - h=from:to:cc:subject:date:message-id:in-reply-to:references; - bh=CKcEzNFYuGEeaz7jwPbq616RUx2Sy10QLeq/JBh4TSE=; - b=D97Ypv0xGLj/Bip4b6nNWS14lWO35lvjm5mLG1kkDO2ak0E3Ip1mON5go9Bh9gUhLt - kvfEhMi14849nF3zfsbHHC1FRzlo02ovFEAtdOp8LeA81mAB+R1IZ3HkgYLgWm1XVJJY - 336TJFNQa5NXy5KFMvFk3MSwAzi9plvwhn2WOb8emOnchHctwRBAg5ahE6qASEzqg7HL - Xr4I/29qBzxL8P7QTacsyA5wfMmW7n5A/AIOCpZfF8Snv2becFTjOF4lEpc+adpe8vaw - y3znl10ANzXD2iC40ufGS+HMZbGLaswl+aMkNeJycYWGIqyXWLrRVfnih8+Zt/OOYiua - JN1w== -X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; - d=1e100.net; s=20161025; - h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to - :references; - bh=CKcEzNFYuGEeaz7jwPbq616RUx2Sy10QLeq/JBh4TSE=; - b=YvVur2vFwsRmOZ3Ye3MijE2oixMlEOwDsnvYafLSmE0Sjg1Q7tqJYMKGqJO5rs3sDq - X6XnecZASB1ABEnbWOFa0s3lyyBto2SvazLeBegEP45s5ByHf3OrCzbuBLy+YzMHCGud - odajUzJXP+gUvKekNkj1HQlZqL95jox8ztKK2gpSet2NzBF6xopwTBA7K9QxALppXuBV - AtWyt46zZl/F1l09SnFZvbaQ81ZIwkNWhy9uhly+wqSQKUSCPcQB8D1Ays3peUdQlnmi - er4kv2HFMWPylcW3nmZwdGuCnGTcNFKA1qDd5iU2/5HpcAQVwxVOvMab3wOeWgwUsrTO - RPEw== -X-Gm-Message-State: AOAM530CvdmcjAwIGFaJZG/vW2jflM9YWzcz7veucK88XnSD0p9RES8p - +R7OAAkrKD/KCsa/xN0vkgE= -X-Google-Smtp-Source: - ABdhPJzf2AKNn1UlIpvSh4/ECgVSEIAJnIkg8qC3JqMmnclHQ6hwYs9eohMk51p+MZLaEyVYfBE6Vw== -X-Received: by 2002:a7b:c041:: with SMTP id u1mr16351531wmc.95.1628514655775; - Mon, 09 Aug 2021 06:10:55 -0700 (PDT) -Received: from localhost.localdomain ([87.200.95.144]) - by smtp.gmail.com with ESMTPSA id k12sm5276094wrd.75.2021.08.09.06.10.53 - (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); - Mon, 09 Aug 2021 06:10:55 -0700 (PDT) -From: Christian Hewitt -To: Rob Herring , Mark Rutland , - Kevin Hilman , devicetree@vger.kernel.org, - linux-arm-kernel@lists.infradead.org, linux-amlogic@lists.infradead.org, - linux-kernel@vger.kernel.org -Cc: Christian Hewitt -Subject: [PATCH 2/2] arm64: dts: amlogic: add support for Radxa Zero -Date: Mon, 9 Aug 2021 13:10:47 +0000 -Message-Id: <20210809131047.28047-3-christianshewitt@gmail.com> -X-Mailer: git-send-email 2.17.1 -In-Reply-To: <20210809131047.28047-1-christianshewitt@gmail.com> -References: <20210809131047.28047-1-christianshewitt@gmail.com> -X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 -X-CRM114-CacheID: sfid-20210809_061057_714410_07D0E152 -X-CRM114-Status: GOOD ( 17.79 ) -X-BeenThere: linux-amlogic@lists.infradead.org -X-Mailman-Version: 2.1.34 -Precedence: list -List-Id: -List-Unsubscribe: , - -List-Archive: -List-Post: -List-Help: -List-Subscribe: , - -MIME-Version: 1.0 -Sender: "linux-amlogic" -Errors-To: - linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org - -Radxa Zero is a small form factor SBC based on the Amlogic S905Y2 -chipset that ships in a number of RAM/eMMC configurations: - -Boards with 512MB/1GB LPDDR4 RAM have no eMMC storage and BCM43436 -wireless (2.4GHz b/g/n) while 2GB/4GB boards have 8/16/32/64/128GB -eMMC storage and BCM4345 wireless (2.4/5GHz a/b/g/n/ac). - -- Amlogic S905Y2 quad-core Cortex-A53 -- Mali G31-MP2 GPU -- HDMI 2.1 output (micro) -- 1x USB 2.0 port - Type C (OTG) -- 1x USB 3.0 port - Type C (Host) -- 1x micro SD Card slot -- 40 Pin GPIO header - -Signed-off-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/Makefile | 1 + - .../dts/amlogic/meson-g12a-radxa-zero.dts | 418 ++++++++++++++++++ - 2 files changed, 419 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index faa0a79a34f5..be308361e2f1 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -1,5 +1,6 @@ - # SPDX-License-Identifier: GPL-2.0 - dtb-$(CONFIG_ARCH_MESON) += meson-axg-s400.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-g12a-radxa-zero.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-sei510.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-u200.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-x96-max.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts -new file mode 100644 -index 000000000000..d44d3881d9b9 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts -@@ -0,0 +1,418 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2018 BayLibre SAS. All rights reserved. -+ */ -+ -+/dts-v1/; -+ -+#include "meson-g12a.dtsi" -+#include -+#include -+ -+/ { -+ compatible = "radxa,zero", "amlogic,g12a"; -+ model = "Radxa Zero"; -+ -+ aliases { -+ serial0 = &uart_AO; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x40000000>; -+ }; -+ -+ cvbs-connector { -+ status = "disabled"; -+ compatible = "composite-video-connector"; -+ -+ port { -+ cvbs_connector_in: endpoint { -+ remote-endpoint = <&cvbs_vdac_out>; -+ }; -+ }; -+ }; -+ -+ hdmi-connector { -+ compatible = "hdmi-connector"; -+ type = "a"; -+ -+ port { -+ hdmi_connector_in: endpoint { -+ remote-endpoint = <&hdmi_tx_tmds_out>; -+ }; -+ }; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_12 GPIO_ACTIVE_LOW>; -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>; -+ clocks = <&wifi32k>; -+ clock-names = "ext_clock"; -+ }; -+ -+ flash_1v8: regulator-flash_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "FLASH_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vcc_3v3>; -+ regulator-always-on; -+ }; -+ -+ dc_in: regulator-dc_in { -+ compatible = "regulator-fixed"; -+ regulator-name = "DC_IN"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-always-on; -+ }; -+ -+ vcc_1v8: regulator-vcc_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vcc_3v3>; -+ regulator-always-on; -+ }; -+ -+ vcc_3v3: regulator-vcc_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vcc_5v: regulator-vcc_5v { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_5V"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&dc_in>; -+ -+ gpio = <&gpio GPIOH_8 GPIO_OPEN_DRAIN>; -+ enable-active-low; -+ }; -+ -+ vddao_1v8: regulator-vddao_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&dc_in>; -+ regulator-always-on; -+ }; -+ -+ vddcpu: regulator-vddcpu { -+ compatible = "pwm-regulator"; -+ -+ regulator-name = "VDDCPU"; -+ regulator-min-microvolt = <721000>; -+ regulator-max-microvolt = <1022000>; -+ -+ vin-supply = <&dc_in>; -+ -+ pwms = <&pwm_AO_cd 1 1250 0>; -+ pwm-dutycycle-range = <100 0>; -+ -+ regulator-boot-on; -+ regulator-always-on; -+ }; -+ -+ sound { -+ compatible = "amlogic,axg-sound-card"; -+ model = "RADXA-ZERO"; -+ audio-aux-devs = <&tdmout_b>; -+ audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1", -+ "TDMOUT_B IN 1", "FRDDR_B OUT 1", -+ "TDMOUT_B IN 2", "FRDDR_C OUT 1", -+ "TDM_B Playback", "TDMOUT_B OUT"; -+ -+ assigned-clocks = <&clkc CLKID_MPLL2>, -+ <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&frddr_a>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&frddr_b>; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&frddr_c>; -+ }; -+ -+ /* 8ch hdmi interface */ -+ dai-link-3 { -+ sound-dai = <&tdmif_b>; -+ dai-format = "i2s"; -+ dai-tdm-slot-tx-mask-0 = <1 1>; -+ dai-tdm-slot-tx-mask-1 = <1 1>; -+ dai-tdm-slot-tx-mask-2 = <1 1>; -+ dai-tdm-slot-tx-mask-3 = <1 1>; -+ mclk-fs = <256>; -+ -+ codec { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_IN_B>; -+ }; -+ }; -+ -+ dai-link-4 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>; -+ -+ codec { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ }; -+ -+ wifi32k: wifi32k { -+ compatible = "pwm-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <32768>; -+ pwms = <&pwm_ef 0 30518 0>; /* PWM_E at 32.768KHz */ -+ }; -+}; -+ -+&arb { -+ status = "okay"; -+}; -+ -+&cec_AO { -+ pinctrl-0 = <&cec_ao_a_h_pins>; -+ pinctrl-names = "default"; -+ status = "disabled"; -+ hdmi-phandle = <&hdmi_tx>; -+}; -+ -+&cecb_AO { -+ pinctrl-0 = <&cec_ao_b_h_pins>; -+ pinctrl-names = "default"; -+ status = "okay"; -+ hdmi-phandle = <&hdmi_tx>; -+}; -+ -+&clkc_audio { -+ status = "okay"; -+}; -+ -+&cpu0 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu1 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu2 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu3 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cvbs_vdac_port { -+ cvbs_vdac_out: endpoint { -+ remote-endpoint = <&cvbs_connector_in>; -+ }; -+}; -+ -+&frddr_a { -+ status = "okay"; -+}; -+ -+&frddr_b { -+ status = "okay"; -+}; -+ -+&frddr_c { -+ status = "okay"; -+}; -+ -+&hdmi_tx { -+ status = "okay"; -+ pinctrl-0 = <&hdmitx_hpd_pins>, <&hdmitx_ddc_pins>; -+ pinctrl-names = "default"; -+ hdmi-supply = <&vcc_5v>; -+}; -+ -+&hdmi_tx_tmds_port { -+ hdmi_tx_tmds_out: endpoint { -+ remote-endpoint = <&hdmi_connector_in>; -+ }; -+}; -+ -+&ir { -+ status = "disabled"; -+ pinctrl-0 = <&remote_input_ao_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&pwm_AO_cd { -+ pinctrl-0 = <&pwm_ao_d_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin1"; -+ status = "okay"; -+}; -+ -+&pwm_ef { -+ status = "okay"; -+ pinctrl-0 = <&pwm_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin0"; -+}; -+ -+&saradc { -+ status = "okay"; -+ vref-supply = <&vddao_1v8>; -+}; -+ -+/* SDIO */ -+&sd_emmc_a { -+ status = "okay"; -+ pinctrl-0 = <&sdio_pins>; -+ pinctrl-1 = <&sdio_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ sd-uhs-sdr50; -+ max-frequency = <80000000>; -+ -+ non-removable; -+ disable-wp; -+ -+ /* WiFi firmware requires power to be kept while in suspend */ -+ keep-power-in-suspend; -+ -+ mmc-pwrseq = <&sdio_pwrseq>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddao_1v8>; -+ -+ brcmf: wifi@1 { -+ reg = <1>; -+ compatible = "brcm,bcm4329-fmac"; -+ interrupts = <&gpio GPIOX_7 GPIO_ACTIVE_HIGH>; -+ interrupt-names = "host-wake"; -+ }; -+}; -+ -+/* SD card */ -+&sd_emmc_b { -+ status = "okay"; -+ pinctrl-0 = <&sdcard_c_pins>; -+ pinctrl-1 = <&sdcard_clk_gate_c_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <100000000>; -+ disable-wp; -+ -+ cd-gpios = <&gpio GPIOC_6 GPIO_ACTIVE_LOW>; -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddao_3v3>; -+}; -+ -+/* eMMC */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_ctrl_pins>, <&emmc_data_8b_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ max-frequency = <200000000>; -+ disable-wp; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&flash_1v8>; -+}; -+ -+&tdmif_b { -+ status = "okay"; -+}; -+ -+&tdmout_b { -+ status = "okay"; -+}; -+ -+&tohdmitx { -+ status = "okay"; -+}; -+ -+&uart_A { -+ status = "okay"; -+ pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+ -+ bluetooth { -+ compatible = "brcm,bcm43438-bt"; -+ shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; -+ max-speed = <2000000>; -+ clocks = <&wifi32k>; -+ clock-names = "lpo"; -+ }; -+}; -+ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&usb { -+ status = "okay"; -+ dr_mode = "host"; -+}; diff --git a/patch/kernel/archive/meson64-5.10/board-VIM1-VIM2-change-freq-to-100MHz.patch b/patch/kernel/archive/meson64-5.10/board-VIM1-VIM2-change-freq-to-100MHz.patch deleted file mode 100644 index a58edbeed52c..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM1-VIM2-change-freq-to-100MHz.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2c590b18eee0a8cfe163ab2dc994f211f76853b8 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Wed, 1 Apr 2020 14:11:35 +0800 -Subject: [PATCH 095/101] arm64: dts: sdio: VIM1/VIM2: change freq to 100MHz - -Signed-off-by: Nick Xie ---- - arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 3 +++ - arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -index 8637e6a42bb8..0786ea55f839 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -@@ -230,6 +230,9 @@ - }; - - &sd_emmc_a { -+ -+ max-frequency = <100000000>; -+ - brcmf: wifi@1 { - reg = <1>; - compatible = "brcm,bcm4329-fmac"; -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -index 5ef329f10a06..8060e97d764f 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -@@ -397,7 +397,7 @@ - #size-cells = <0>; - - bus-width = <4>; -- max-frequency = <60000000>; -+ max-frequency = <100000000>; - - non-removable; - disable-wp; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM1-add-simple-MCU-driver-for-FAN.patch b/patch/kernel/archive/meson64-5.10/board-VIM1-add-simple-MCU-driver-for-FAN.patch deleted file mode 100644 index 80788668fa6c..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM1-add-simple-MCU-driver-for-FAN.patch +++ /dev/null @@ -1,923 +0,0 @@ -From 9d62f1b8abb852a12a437b94ddc67c3294dd0953 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Mon, 23 Dec 2019 22:51:19 +0800 -Subject: [PATCH 098/101] arm64: dts: VIMs: add simple MCU driver for FAN - -Signed-off-by: Nick Xie ---- - .../amlogic/meson-gxl-s905x-khadas-vim.dts | 10 + - .../dts/amlogic/meson-gxm-khadas-vim2.dts | 10 + - .../boot/dts/amlogic/meson-khadas-vim3.dtsi | 10 + - drivers/hwmon/scpi-hwmon.c | 18 + - drivers/misc/Kconfig | 5 + - drivers/misc/Makefile | 1 + - drivers/misc/khadas-mcu.c | 720 ++++++++++++++++++ - drivers/thermal/amlogic_thermal.c | 19 + - 8 files changed, 793 insertions(+) - create mode 100644 drivers/misc/khadas-mcu.c - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -index 0786ea55f839..02b6691768b3 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -@@ -155,6 +155,16 @@ - clock-frequency = <32768>; - clock-output-names = "xin32k"; - }; -+ -+ khadas-mcu@18 { -+ status = "okay"; -+ compatible = "khadas-mcu"; -+ reg = <0x18>; -+ fan,trig_temp_level0 = <50>; -+ fan,trig_temp_level1 = <60>; -+ fan,trig_temp_level2 = <70>; -+ hwver = "VIM1.V12"; /* Will be updated in uboot. */ -+ }; - }; - - &ir { -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -index 57de06faa841..f9ec3f3efbe1 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -@@ -363,6 +363,16 @@ - clock-frequency = <32768>; - clock-output-names = "xin32k"; - }; -+ -+ khadas-mcu@18 { -+ status = "okay"; -+ compatible = "khadas-mcu"; -+ reg = <0x18>; -+ fan,trig_temp_level0 = <50>; -+ fan,trig_temp_level1 = <60>; -+ fan,trig_temp_level2 = <70>; -+ hwver = "VIM2.V12"; /* Will be updated in uboot. */ -+ }; - }; - - &ir { -diff --git a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -index 6d0163f56b0d..f6b5de8328ac 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -@@ -242,6 +242,16 @@ - reg = <0x51>; - #clock-cells = <0>; - }; -+ -+ khadas-mcu@18 { -+ status = "okay"; -+ compatible = "khadas-mcu"; -+ reg = <0x18>; -+ fan,trig_temp_level0 = <50>; -+ fan,trig_temp_level1 = <60>; -+ fan,trig_temp_level2 = <70>; -+ hwver = "VIM3.V11"; /* Will be updated in uboot. */ -+ }; - }; - - &ir { -diff --git a/drivers/hwmon/scpi-hwmon.c b/drivers/hwmon/scpi-hwmon.c -index 25aac40f2764..3dd7af04c5bd 100644 ---- a/drivers/hwmon/scpi-hwmon.c -+++ b/drivers/hwmon/scpi-hwmon.c -@@ -54,6 +54,8 @@ static const u32 scpi_scale[] = { - [ENERGY] = 1000000, /* (microjoules) */ - }; - -+static struct scpi_thermal_zone *g_scpi_thermal_zone_ptr; -+ - static void scpi_scale_reading(u64 *value, struct sensor_data *sensor) - { - if (scpi_scale[sensor->info.class] != sensor->scale) { -@@ -81,6 +83,20 @@ static int scpi_read_temp(void *dev, int *temp) - return 0; - } - -+int meson_gx_get_temperature(void) -+{ -+ int temp; -+ int ret; -+ ret = scpi_read_temp(g_scpi_thermal_zone_ptr, &temp); -+ if (ret) { -+ printk("scpi_read_temp() failed!\n"); -+ return ret; -+ } -+ -+ return temp / 1000; -+} -+EXPORT_SYMBOL(meson_gx_get_temperature); -+ - /* hwmon callback functions */ - static ssize_t - scpi_show_sensor(struct device *dev, struct device_attribute *attr, char *buf) -@@ -266,6 +282,8 @@ static int scpi_hwmon_probe(struct platform_device *pdev) - if (!zone) - return -ENOMEM; - -+ g_scpi_thermal_zone_ptr = zone; -+ - zone->sensor_id = i; - zone->scpi_sensors = scpi_sensors; - z = devm_thermal_zone_of_sensor_register(dev, -diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig -index 7f0d48f406e3..fb0a3830fd87 100644 ---- a/drivers/misc/Kconfig -+++ b/drivers/misc/Kconfig -@@ -465,6 +465,11 @@ config PVPANIC - a paravirtualized device provided by QEMU; it lets a virtual machine - (guest) communicate panic events to the host. - -+config KHADAS_MCU -+ tristate "Khadas boards on-board MCU" -+ help -+ This driver provides support for Khadas boards on-board MCU. -+ - source "drivers/misc/c2port/Kconfig" - source "drivers/misc/eeprom/Kconfig" - source "drivers/misc/cb710/Kconfig" -diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile -index c1860d35dc7e..9bbf2a479405 100644 ---- a/drivers/misc/Makefile -+++ b/drivers/misc/Makefile -@@ -57,4 +57,5 @@ obj-y += cardreader/ - obj-$(CONFIG_HABANA_AI) += habanalabs/ - obj-$(CONFIG_UACCE) += uacce/ - obj-$(CONFIG_XILINX_SDFEC) += xilinx_sdfec.o -+obj-$(CONFIG_KHADAS_MCU) += khadas-mcu.o - obj-$(CONFIG_HISI_HIKEY_USB) += hisi_hikey_usb.o -diff --git a/drivers/misc/khadas-mcu.c b/drivers/misc/khadas-mcu.c -new file mode 100644 -index 000000000000..7c6f2903b7a5 ---- /dev/null -+++ b/drivers/misc/khadas-mcu.c -@@ -0,0 +1,720 @@ -+/* -+ * Khadas MCU control driver -+ * -+ * Written by: Nick -+ * -+ * Copyright (c) 2019 Shenzhen Wesion Technology Co., Ltd. -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License version 2 as -+ * published by the Free Software Foundation. -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+ -+/* Device registers */ -+#define MCU_BOOT_EN_WOL_REG 0x21 -+#define MCU_CMD_FAN_STATUS_CTRL_REG 0x88 -+#define MCU_USB_PCIE_SWITCH_REG 0x33 /* VIM3/VIM3L only */ -+#define MCU_PWR_OFF_CMD_REG 0x80 -+#define MCU_SHUTDOWN_NORMAL_REG 0x2c -+ -+#define MCU_FAN_TRIG_TEMP_LEVEL0 50 // 50 degree if not set -+#define MCU_FAN_TRIG_TEMP_LEVEL1 60 // 60 degree if not set -+#define MCU_FAN_TRIG_TEMP_LEVEL2 70 // 70 degree if not set -+#define MCU_FAN_TRIG_MAXTEMP 80 -+#define MCU_FAN_LOOP_SECS (30 * HZ) // 30 seconds -+#define MCU_FAN_TEST_LOOP_SECS (5 * HZ) // 5 seconds -+#define MCU_FAN_LOOP_NODELAY_SECS 0 -+#define MCU_FAN_SPEED_OFF 0 -+#define MCU_FAN_SPEED_LOW 1 -+#define MCU_FAN_SPEED_MID 2 -+#define MCU_FAN_SPEED_HIGH 3 -+ -+enum mcu_fan_mode { -+ MCU_FAN_MODE_MANUAL = 0, -+ MCU_FAN_MODE_AUTO, -+}; -+ -+enum mcu_fan_level { -+ MCU_FAN_LEVEL_0 = 0, -+ MCU_FAN_LEVEL_1, -+ MCU_FAN_LEVEL_2, -+ MCU_FAN_LEVEL_3, -+}; -+ -+enum mcu_fan_status { -+ MCU_FAN_STATUS_DISABLE = 0, -+ MCU_FAN_STATUS_ENABLE, -+}; -+ -+enum mcu_usb_pcie_switch_mode { -+ MCU_USB_PCIE_SWITCH_MODE_USB3 = 0, -+ MCU_USB_PCIE_SWITCH_MODE_PCIE -+}; -+ -+enum khadas_board_hwver { -+ KHADAS_BOARD_HWVER_NONE = 0, -+ KHADAS_BOARD_HWVER_V11, -+ KHADAS_BOARD_HWVER_V12, -+ KHADAS_BOARD_HWVER_V13, -+ KHADAS_BOARD_HWVER_V14 -+}; -+ -+enum khadas_board { -+ KHADAS_BOARD_NONE, -+ KHADAS_BOARD_VIM1, -+ KHADAS_BOARD_VIM2, -+ KHADAS_BOARD_VIM3 -+}; -+ -+struct mcu_fan_data { -+ struct platform_device *pdev; -+ struct class *fan_class; -+ struct delayed_work work; -+ struct delayed_work fan_test_work; -+ enum mcu_fan_status enable; -+ enum mcu_fan_mode mode; -+ enum mcu_fan_level level; -+ int trig_temp_level0; -+ int trig_temp_level1; -+ int trig_temp_level2; -+}; -+ -+struct mcu_data { -+ struct i2c_client *client; -+ struct class *usb_pcie_switch_class; -+ struct class *mcu_class; -+ u8 usb_pcie_switch_mode; -+ enum khadas_board board; -+ enum khadas_board_hwver hwver; -+ struct mcu_fan_data fan_data; -+}; -+ -+struct mcu_data *g_mcu_data; -+ -+static char * mcu_board_type_to_str(enum khadas_board board) -+{ -+ switch (board) { -+ case KHADAS_BOARD_NONE: -+ return "Unknown"; -+ case KHADAS_BOARD_VIM1: -+ return "VIM1"; -+ case KHADAS_BOARD_VIM2: -+ return "VIM2"; -+ case KHADAS_BOARD_VIM3: -+ return "VIM3"; -+ default: -+ return "Unknown"; -+ } -+} -+ -+static char * mcu_board_hardware_version_str(enum khadas_board_hwver hwver) -+{ -+ switch (hwver) { -+ case KHADAS_BOARD_HWVER_NONE: -+ return "Unknown"; -+ case KHADAS_BOARD_HWVER_V11: -+ return "V11"; -+ case KHADAS_BOARD_HWVER_V12: -+ return "V12"; -+ case KHADAS_BOARD_HWVER_V13: -+ return "V13"; -+ case KHADAS_BOARD_HWVER_V14: -+ return "V14"; -+ default: -+ return "Unknown"; -+ } -+} -+ -+static int i2c_master_reg8_send(const struct i2c_client *client, -+ const char reg, const char *buf, int count) -+{ -+ struct i2c_adapter *adap = client->adapter; -+ struct i2c_msg msg; -+ int ret; -+ char *tx_buf = kzalloc(count + 1, GFP_KERNEL); -+ if (!tx_buf) -+ return -ENOMEM; -+ tx_buf[0] = reg; -+ memcpy(tx_buf+1, buf, count); -+ -+ msg.addr = client->addr; -+ msg.flags = client->flags; -+ msg.len = count + 1; -+ msg.buf = (char *)tx_buf; -+ -+ ret = i2c_transfer(adap, &msg, 1); -+ kfree(tx_buf); -+ return (ret == 1) ? count : ret; -+} -+ -+static int i2c_master_reg8_recv(const struct i2c_client *client, -+ const char reg, char *buf, int count) -+{ -+ struct i2c_adapter *adap = client->adapter; -+ struct i2c_msg msgs[2]; -+ int ret; -+ char reg_buf = reg; -+ -+ msgs[0].addr = client->addr; -+ msgs[0].flags = client->flags; -+ msgs[0].len = 1; -+ msgs[0].buf = ®_buf; -+ -+ msgs[1].addr = client->addr; -+ msgs[1].flags = client->flags | I2C_M_RD; -+ msgs[1].len = count; -+ msgs[1].buf = (char *)buf; -+ -+ ret = i2c_transfer(adap, msgs, 2); -+ -+ return (ret == 2) ? count : ret; -+} -+ -+static int mcu_i2c_read_regs(struct i2c_client *client, -+ u8 reg, u8 buf[], unsigned len) -+{ -+ int ret; -+ ret = i2c_master_reg8_recv(client, reg, buf, len); -+ return ret; -+} -+ -+static int mcu_i2c_write_regs(struct i2c_client *client, -+ u8 reg, u8 const buf[], __u16 len) -+{ -+ int ret; -+ ret = i2c_master_reg8_send(client, reg, buf, (int)len); -+ return ret; -+} -+ -+static int is_mcu_fan_control_supported(void) -+{ -+ // MCU FAN control is supported for: -+ // 1. Khadas VIM1 V13 and later -+ // 2. Khadas VIM2 V13 and later -+ // 3. Khadas VIM3 V11 and later -+ if (KHADAS_BOARD_VIM1 == g_mcu_data->board) { -+ if (g_mcu_data->hwver >= KHADAS_BOARD_HWVER_V13) -+ return 1; -+ else -+ return 0; -+ } else if (KHADAS_BOARD_VIM2 == g_mcu_data->board) { -+ if (g_mcu_data->hwver > KHADAS_BOARD_HWVER_V12) -+ return 1; -+ else -+ return 0; -+ } else if (KHADAS_BOARD_VIM3 == g_mcu_data->board) { -+ if (g_mcu_data->hwver >= KHADAS_BOARD_HWVER_V11) -+ return 1; -+ else -+ return 0; -+ } else -+ return 0; -+} -+ -+static bool is_mcu_usb_pcie_switch_supported(void) -+{ -+ // MCU USB PCIe switch is supported for: -+ // 1. Khadas VIM3 -+ if (KHADAS_BOARD_VIM3 == g_mcu_data->board) -+ return 1; -+ else -+ return 0; -+} -+ -+static void mcu_fan_level_set(struct mcu_fan_data *fan_data, int level) -+{ -+ if (is_mcu_fan_control_supported()) { -+ int ret; -+ u8 data[2] = {0}; -+ -+ if(0 == level) { -+ data[0] = MCU_FAN_SPEED_OFF; -+ }else if(1 == level){ -+ data[0] = MCU_FAN_SPEED_LOW; -+ }else if(2 == level){ -+ data[0] = MCU_FAN_SPEED_MID; -+ }else if(3 == level){ -+ data[0] = MCU_FAN_SPEED_HIGH; -+ } -+ -+ g_mcu_data->fan_data.level = data[0]; -+ -+ ret = mcu_i2c_write_regs(g_mcu_data->client, MCU_CMD_FAN_STATUS_CTRL_REG, data, 1); -+ if (ret < 0) { -+ printk("write fan control err\n"); -+ return; -+ } -+ } -+} -+ -+extern int meson_gx_get_temperature(void); -+extern int meson_g12_get_temperature(void); -+static void fan_work_func(struct work_struct *_work) -+{ -+ if (is_mcu_fan_control_supported()) { -+ int temp = -EINVAL; -+ struct mcu_fan_data *fan_data = &g_mcu_data->fan_data; -+ -+ if ((KHADAS_BOARD_VIM1 == g_mcu_data->board) || -+ (KHADAS_BOARD_VIM2 == g_mcu_data->board)) -+ temp = meson_gx_get_temperature(); -+ else if (KHADAS_BOARD_VIM3 == g_mcu_data->board) -+ temp = meson_g12_get_temperature(); -+ -+ if(temp != -EINVAL){ -+ if(temp < fan_data->trig_temp_level0 ) { -+ mcu_fan_level_set(fan_data, 0); -+ }else if(temp < fan_data->trig_temp_level1 ) { -+ mcu_fan_level_set(fan_data, 1); -+ }else if(temp < fan_data->trig_temp_level2 ) { -+ mcu_fan_level_set(fan_data, 2); -+ }else{ -+ mcu_fan_level_set(fan_data, 3); -+ } -+ } -+ -+ schedule_delayed_work(&fan_data->work, MCU_FAN_LOOP_SECS); -+ } -+} -+ -+static void khadas_fan_set(struct mcu_fan_data *fan_data) -+{ -+ if (is_mcu_fan_control_supported()) { -+ -+ cancel_delayed_work(&fan_data->work); -+ -+ if (fan_data->enable == MCU_FAN_STATUS_DISABLE) { -+ mcu_fan_level_set(fan_data, 0); -+ return; -+ } -+ switch (fan_data->mode) { -+ case MCU_FAN_MODE_MANUAL: -+ switch(fan_data->level) { -+ case MCU_FAN_LEVEL_0: -+ mcu_fan_level_set(fan_data, 0); -+ break; -+ case MCU_FAN_LEVEL_1: -+ mcu_fan_level_set(fan_data, 1); -+ break; -+ case MCU_FAN_LEVEL_2: -+ mcu_fan_level_set(fan_data, 2); -+ break; -+ case MCU_FAN_LEVEL_3: -+ mcu_fan_level_set(fan_data, 3); -+ break; -+ default: -+ break; -+ } -+ break; -+ -+ case MCU_FAN_MODE_AUTO: -+ // FIXME: achieve with a better way -+ schedule_delayed_work(&fan_data->work, MCU_FAN_LOOP_NODELAY_SECS); -+ break; -+ -+ default: -+ break; -+ } -+ } -+} -+ -+static ssize_t show_fan_enable(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan enable: %d\n", g_mcu_data->fan_data.enable); -+} -+ -+static ssize_t store_fan_enable(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int enable; -+ -+ if (kstrtoint(buf, 0, &enable)) -+ return -EINVAL; -+ -+ // 0: manual, 1: auto -+ if( enable >= 0 && enable < 2 ){ -+ g_mcu_data->fan_data.enable = enable; -+ khadas_fan_set(&g_mcu_data->fan_data); -+ } -+ -+ return count; -+} -+ -+static ssize_t show_fan_mode(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan mode: %d\n", g_mcu_data->fan_data.mode); -+} -+ -+static ssize_t store_fan_mode(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int mode; -+ -+ if (kstrtoint(buf, 0, &mode)) -+ return -EINVAL; -+ -+ // 0: manual, 1: auto -+ if( mode >= 0 && mode < 2 ){ -+ g_mcu_data->fan_data.mode = mode; -+ khadas_fan_set(&g_mcu_data->fan_data); -+ } -+ -+ return count; -+} -+ -+static ssize_t show_fan_level(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan level: %d\n", g_mcu_data->fan_data.level); -+} -+ -+static ssize_t store_fan_level(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int level; -+ -+ if (kstrtoint(buf, 0, &level)) -+ return -EINVAL; -+ -+ if( level >= 0 && level < 4){ -+ g_mcu_data->fan_data.level = level; -+ khadas_fan_set(&g_mcu_data->fan_data); -+ } -+ -+ return count; -+} -+ -+static ssize_t show_fan_temp(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ int temp = -EINVAL; -+ -+ if ((KHADAS_BOARD_VIM1 == g_mcu_data->board) || -+ (KHADAS_BOARD_VIM2 == g_mcu_data->board)) -+ temp = meson_gx_get_temperature(); -+ else if (KHADAS_BOARD_VIM3 == g_mcu_data->board) -+ temp = meson_g12_get_temperature(); -+ -+ return sprintf(buf, "cpu_temp:%d\nFan trigger temperature: level0:%d level1:%d level2:%d\n", temp, g_mcu_data->fan_data.trig_temp_level0, g_mcu_data->fan_data.trig_temp_level1, g_mcu_data->fan_data.trig_temp_level2); -+} -+ -+static ssize_t store_usb_pcie_switch_mode(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int ret; -+ int mode; -+ -+ if (kstrtoint(buf, 0, &mode)) -+ return -EINVAL; -+ -+ if (0 != mode && 1 != mode) -+ return -EINVAL; -+ -+ if ((mode < MCU_USB_PCIE_SWITCH_MODE_USB3) || (mode > MCU_USB_PCIE_SWITCH_MODE_PCIE)) -+ return -EINVAL; -+ -+ g_mcu_data->usb_pcie_switch_mode = (u8)mode; -+ ret = mcu_i2c_write_regs(g_mcu_data->client, MCU_USB_PCIE_SWITCH_REG, &g_mcu_data->usb_pcie_switch_mode, 1); -+ if (ret < 0) { -+ printk("write USB PCIe switch error\n"); -+ -+ return ret; -+ } -+ -+ printk("Set USB PCIe Switch Mode: %s\n", g_mcu_data->usb_pcie_switch_mode ? "PCIe" : "USB3.0"); -+ -+ return count; -+} -+ -+static ssize_t show_usb_pcie_switch_mode(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ printk("USB PCIe Switch Mode: %s\n", g_mcu_data->usb_pcie_switch_mode ? "PCIe" : "USB3.0"); -+ return sprintf(buf, "%d\n", g_mcu_data->usb_pcie_switch_mode); -+} -+ -+static ssize_t store_mcu_poweroff(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int ret; -+ int val; -+ u8 reg; -+ -+ if (kstrtoint(buf, 0, &val)) -+ return -EINVAL; -+ -+ if (1 != val) -+ return -EINVAL; -+ -+ reg = (u8)val; -+ ret = mcu_i2c_write_regs(g_mcu_data->client, MCU_PWR_OFF_CMD_REG, ®, 1); -+ if (ret < 0) { -+ printk("write poweroff cmd error\n"); -+ -+ return ret; -+ } -+ -+ return count; -+} -+ -+static ssize_t store_mcu_rst(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ u8 reg[2]; -+ int ret; -+ int rst; -+ -+ if (kstrtoint(buf, 0, &rst)) -+ return -EINVAL; -+ -+ reg[0] = rst; -+ ret = mcu_i2c_write_regs(g_mcu_data->client, MCU_SHUTDOWN_NORMAL_REG, reg, 1); -+ if (ret < 0) -+ printk("rst mcu err\n"); -+ -+ return count; -+} -+ -+static struct class_attribute fan_class_attrs[] = { -+ __ATTR(enable, 0644, show_fan_enable, store_fan_enable), -+ __ATTR(mode, 0644, show_fan_mode, store_fan_mode), -+ __ATTR(level, 0644, show_fan_level, store_fan_level), -+ __ATTR(temp, 0644, show_fan_temp, NULL), -+}; -+ -+static struct class_attribute mcu_class_attrs[] = { -+ __ATTR(poweroff, 0644, NULL, store_mcu_poweroff), -+ __ATTR(usb_pcie_switch_mode, 0644, show_usb_pcie_switch_mode, store_usb_pcie_switch_mode), -+ __ATTR(rst, 0644, NULL, store_mcu_rst), -+}; -+ -+static void create_mcu_attrs(void) -+{ -+ int i; -+ printk("%s\n",__func__); -+ -+ g_mcu_data->mcu_class = class_create(THIS_MODULE, "mcu"); -+ if (IS_ERR(g_mcu_data->mcu_class)) { -+ pr_err("create mcu_class debug class fail\n"); -+ return; -+ } -+ -+ for (i = 0; i < ARRAY_SIZE(mcu_class_attrs); i++) { -+ if (strstr(mcu_class_attrs[i].attr.name, "usb_pcie_switch_mode")) { -+ if (!is_mcu_usb_pcie_switch_supported()) -+ continue; -+ } -+ if (class_create_file(g_mcu_data->mcu_class, &mcu_class_attrs[i])) -+ pr_err("create mcu attribute %s fail\n", mcu_class_attrs[i].attr.name); -+ } -+ -+ if (is_mcu_fan_control_supported()) { -+ g_mcu_data->fan_data.fan_class = class_create(THIS_MODULE, "fan"); -+ if (IS_ERR(g_mcu_data->fan_data.fan_class)) { -+ pr_err("create fan_class debug class fail\n"); -+ return; -+ } -+ -+ for (i=0; ifan_data.fan_class, &fan_class_attrs[i])) -+ pr_err("create fan attribute %s fail\n", fan_class_attrs[i].attr.name); -+ } -+ } -+} -+ -+static int mcu_parse_dt(struct device *dev) -+{ -+ int ret; -+ const char *hwver = NULL; -+ -+ if (NULL == dev) return -EINVAL; -+ -+ // Get hardwere version -+ ret = of_property_read_string(dev->of_node, "hwver", &hwver); -+ if (ret < 0) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V12; -+ g_mcu_data->board = KHADAS_BOARD_VIM2; -+ } else { -+ if (strstr(hwver, "VIM1")) -+ g_mcu_data->board = KHADAS_BOARD_VIM1; -+ else if (strstr(hwver, "VIM2")) -+ g_mcu_data->board = KHADAS_BOARD_VIM2; -+ else if (strstr(hwver, "VIM3")) -+ g_mcu_data->board = KHADAS_BOARD_VIM3; -+ else -+ g_mcu_data->board = KHADAS_BOARD_NONE; -+ -+ if (KHADAS_BOARD_VIM1 == g_mcu_data->board) { -+ if (0 == strcmp(hwver, "VIM1.V13")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V13; -+ } else if (0 == strcmp(hwver, "VIM1.V14")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V14; -+ } else { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_NONE; -+ } -+ } else if (KHADAS_BOARD_VIM2 == g_mcu_data->board) { -+ if (0 == strcmp(hwver, "VIM2.V12")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V12; -+ } else if (0 == strcmp(hwver, "VIM2.V13")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V13; -+ } else if (0 == strcmp(hwver, "VIM2.V14")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V14; -+ } else { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_NONE; -+ } -+ } else if (KHADAS_BOARD_VIM3 == g_mcu_data->board) { -+ if (0 == strcmp(hwver, "VIM3.V11")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V11; -+ } else if (0 == strcmp(hwver, "VIM3.V12")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V12; -+ } else if (0 == strcmp(hwver, "VIM3.V13")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V13; -+ } else if (0 == strcmp(hwver, "VIM3.V14")) { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_V14; -+ } else { -+ g_mcu_data->hwver = KHADAS_BOARD_HWVER_NONE; -+ } -+ } -+ } -+ -+ ret = of_property_read_u32(dev->of_node, "fan,trig_temp_level0", &g_mcu_data->fan_data.trig_temp_level0); -+ if (ret < 0) -+ g_mcu_data->fan_data.trig_temp_level0 = MCU_FAN_TRIG_TEMP_LEVEL0; -+ ret = of_property_read_u32(dev->of_node, "fan,trig_temp_level1", &g_mcu_data->fan_data.trig_temp_level1); -+ if (ret < 0) -+ g_mcu_data->fan_data.trig_temp_level1 = MCU_FAN_TRIG_TEMP_LEVEL1; -+ ret = of_property_read_u32(dev->of_node, "fan,trig_temp_level2", &g_mcu_data->fan_data.trig_temp_level2); -+ if (ret < 0) -+ g_mcu_data->fan_data.trig_temp_level2 = MCU_FAN_TRIG_TEMP_LEVEL2; -+ -+ return ret; -+} -+ -+static int mcu_probe(struct i2c_client *client, const struct i2c_device_id *id) -+{ -+ u8 reg[2]; -+ int ret; -+ -+ printk("%s\n", __func__); -+ -+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) -+ return -ENODEV; -+ -+ g_mcu_data = kzalloc(sizeof(struct mcu_data), GFP_KERNEL); -+ -+ if (g_mcu_data == NULL) -+ return -ENOMEM; -+ -+ mcu_parse_dt(&client->dev); -+ -+ printk("%s: board: %s (%d), hwver: %s (%d)\n", __func__, -+ mcu_board_type_to_str(g_mcu_data->board), -+ (int)g_mcu_data->board, -+ mcu_board_hardware_version_str(g_mcu_data->hwver), -+ (int)g_mcu_data->hwver); -+ -+ g_mcu_data->client = client; -+ -+ if (is_mcu_usb_pcie_switch_supported()) { -+ // Get USB PCIe Switch status -+ ret = mcu_i2c_read_regs(client, MCU_USB_PCIE_SWITCH_REG, reg, 1); -+ if (ret < 0) -+ goto exit; -+ g_mcu_data->usb_pcie_switch_mode = (u8)reg[0]; -+ } -+ -+ if (is_mcu_fan_control_supported()) { -+ g_mcu_data->fan_data.mode = MCU_FAN_MODE_AUTO; -+ g_mcu_data->fan_data.level = MCU_FAN_LEVEL_0; -+ g_mcu_data->fan_data.enable = MCU_FAN_STATUS_DISABLE; -+ -+ INIT_DELAYED_WORK(&g_mcu_data->fan_data.work, fan_work_func); -+ mcu_fan_level_set(&g_mcu_data->fan_data, 0); -+ } -+ create_mcu_attrs(); -+ -+ return 0; -+exit: -+ return ret; -+} -+ -+ -+static int mcu_remove(struct i2c_client *client) -+{ -+ return 0; -+} -+ -+static void khadas_fan_shutdown(struct i2c_client *client) -+{ -+ g_mcu_data->fan_data.enable = MCU_FAN_STATUS_DISABLE; -+ khadas_fan_set(&g_mcu_data->fan_data); -+} -+ -+#ifdef CONFIG_PM_SLEEP -+static int khadas_fan_suspend(struct device *dev) -+{ -+ cancel_delayed_work(&g_mcu_data->fan_data.work); -+ mcu_fan_level_set(&g_mcu_data->fan_data, 0); -+ -+ return 0; -+} -+ -+static int khadas_fan_resume(struct device *dev) -+{ -+ return 0; -+} -+ -+static const struct dev_pm_ops fan_dev_pm_ops = { -+ SET_SYSTEM_SLEEP_PM_OPS(khadas_fan_suspend, khadas_fan_resume) -+}; -+ -+#define FAN_PM_OPS (&(fan_dev_pm_ops)) -+ -+#endif -+ -+static const struct i2c_device_id mcu_id[] = { -+ { "khadas-mcu", 0 }, -+ { } -+}; -+MODULE_DEVICE_TABLE(i2c, mcu_id); -+ -+ -+static struct of_device_id mcu_dt_ids[] = { -+ { .compatible = "khadas-mcu" }, -+ {}, -+}; -+MODULE_DEVICE_TABLE(i2c, mcu_dt_ids); -+ -+struct i2c_driver mcu_driver = { -+ .driver = { -+ .name = "khadas-mcu", -+ .owner = THIS_MODULE, -+ .of_match_table = of_match_ptr(mcu_dt_ids), -+#ifdef CONFIG_PM_SLEEP -+ .pm = FAN_PM_OPS, -+#endif -+ }, -+ .probe = mcu_probe, -+ .remove = mcu_remove, -+ .shutdown = khadas_fan_shutdown, -+ .id_table = mcu_id, -+}; -+module_i2c_driver(mcu_driver); -+ -+MODULE_AUTHOR("Nick "); -+MODULE_DESCRIPTION("Khadas MCU control driver"); -+MODULE_LICENSE("GPL"); -diff --git a/drivers/thermal/amlogic_thermal.c b/drivers/thermal/amlogic_thermal.c -index ccb1fe18e993..3947f3c1f91f 100644 ---- a/drivers/thermal/amlogic_thermal.c -+++ b/drivers/thermal/amlogic_thermal.c -@@ -104,6 +104,8 @@ struct amlogic_thermal { - u32 trim_info; - }; - -+static struct amlogic_thermal *amlogic_thermal_data_ptr; -+ - /* - * Calculate a temperature value from a temperature code. - * The unit of the temperature is degree milliCelsius. -@@ -194,6 +196,21 @@ static int amlogic_thermal_get_temp(void *data, int *temp) - return 0; - } - -+int meson_g12_get_temperature(void) -+{ -+ int temp; -+ int ret; -+ -+ ret = amlogic_thermal_get_temp(amlogic_thermal_data_ptr, &temp); -+ if (ret) { -+ printk("amlogic_thermal_get_temp() failed!\n"); -+ return ret; -+ } -+ -+ return temp / 1000; -+} -+EXPORT_SYMBOL(meson_g12_get_temperature); -+ - static const struct thermal_zone_of_device_ops amlogic_thermal_ops = { - .get_temp = amlogic_thermal_get_temp, - }; -@@ -248,6 +265,8 @@ static int amlogic_thermal_probe(struct platform_device *pdev) - if (!pdata) - return -ENOMEM; - -+ amlogic_thermal_data_ptr = pdata; -+ - pdata->data = of_device_get_match_data(dev); - pdata->pdev = pdev; - platform_set_drvdata(pdev, pdata); --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM1-enable-RTC.patch b/patch/kernel/archive/meson64-5.10/board-VIM1-enable-RTC.patch deleted file mode 100644 index 4bd7aa40f4ad..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM1-enable-RTC.patch +++ /dev/null @@ -1,26 +0,0 @@ -From b7aad5252373bb1270a9bcc362fa6f869108f1eb Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Sat, 17 Aug 2019 15:29:46 +0800 -Subject: [PATCH 093/101] arm64: dts: VIM1: enable RTC - -Signed-off-by: Nick Xie ---- - arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -index 2c198c4212b2..8637e6a42bb8 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -@@ -148,7 +148,7 @@ - - rtc: rtc@51 { - /* has to be enabled manually when a battery is connected: */ -- status = "disabled"; -+ status = "okay"; - compatible = "haoyu,hym8563"; - reg = <0x51>; - #clock-cells = <0>; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM2-add-GPIO-FAN-driver-for-V12-version.patch b/patch/kernel/archive/meson64-5.10/board-VIM2-add-GPIO-FAN-driver-for-V12-version.patch deleted file mode 100644 index c658e808d6a2..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM2-add-GPIO-FAN-driver-for-V12-version.patch +++ /dev/null @@ -1,481 +0,0 @@ -From 037976f20acf9b7d0240fae01870b78580929c24 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Wed, 25 Dec 2019 11:32:49 +0800 -Subject: [PATCH 099/101] VIM2: add GPIO FAN driver for V12 version - -Signed-off-by: Nick Xie ---- - .../dts/amlogic/meson-gxm-khadas-vim2.dts | 12 + - drivers/misc/Kconfig | 6 + - drivers/misc/Makefile | 1 + - drivers/misc/khadas-fan.c | 407 ++++++++++++++++++ - 4 files changed, 426 insertions(+) - create mode 100644 drivers/misc/khadas-fan.c - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -index f9ec3f3efbe1..fc618b72d5b5 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -@@ -56,7 +56,19 @@ - reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>; - }; - -+ fan { -+ compatible = "fanctl"; -+ fan_ctl0 = <&gpio GPIODV_14 GPIO_ACTIVE_HIGH>; -+ fan_ctl1 = <&gpio GPIODV_15 GPIO_ACTIVE_HIGH>; -+ trig_temp_level0 = <50>; -+ trig_temp_level1 = <60>; -+ trig_temp_level2 = <70>; -+ hwver = "VIM2.V12"; /* Will be updated in uboot. */ -+ status = "okay"; -+ }; -+ - gpio_fan: gpio-fan { -+ status = "disabled"; - compatible = "gpio-fan"; - gpios = <&gpio GPIODV_14 GPIO_ACTIVE_HIGH - &gpio GPIODV_15 GPIO_ACTIVE_HIGH>; -diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig -index fb0a3830fd87..264e39ccc330 100644 ---- a/drivers/misc/Kconfig -+++ b/drivers/misc/Kconfig -@@ -465,6 +465,12 @@ config PVPANIC - a paravirtualized device provided by QEMU; it lets a virtual machine - (guest) communicate panic events to the host. - -+config KHADAS_FAN -+ tristate "Khadas FAN" -+ default y -+ help -+ This driver is for Khadas FAN. -+ - config KHADAS_MCU - tristate "Khadas boards on-board MCU" - help -diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile -index 9bbf2a479405..c24a29e12f1f 100644 ---- a/drivers/misc/Makefile -+++ b/drivers/misc/Makefile -@@ -57,4 +57,5 @@ obj-y += cardreader/ - obj-$(CONFIG_HABANA_AI) += habanalabs/ - obj-$(CONFIG_UACCE) += uacce/ - obj-$(CONFIG_XILINX_SDFEC) += xilinx_sdfec.o -+obj-$(CONFIG_KHADAS_FAN) += khadas-fan.o - obj-$(CONFIG_KHADAS_MCU) += khadas-mcu.o -diff --git a/drivers/misc/khadas-fan.c b/drivers/misc/khadas-fan.c -new file mode 100644 -index 000000000000..ee0fd42a9dae ---- /dev/null -+++ b/drivers/misc/khadas-fan.c -@@ -0,0 +1,407 @@ -+/* -+ * gpio-fan.c - driver for fans controlled by GPIO. -+ */ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#define KHADAS_FAN_TRIG_TEMP_LEVEL0 50 // 50 degree if not set -+#define KHADAS_FAN_TRIG_TEMP_LEVEL1 60 // 60 degree if not set -+#define KHADAS_FAN_TRIG_TEMP_LEVEL2 70 // 70 degree if not set -+#define KHADAS_FAN_TRIG_MAXTEMP 80 -+#define KHADAS_FAN_LOOP_SECS 30 * HZ // 30 seconds -+#define KHADAS_FAN_TEST_LOOP_SECS 5 * HZ // 5 seconds -+#define KHADAS_FAN_LOOP_NODELAY_SECS 0 -+#define KHADAS_FAN_GPIO_OFF 0 -+#define KHADAS_FAN_GPIO_ON 1 -+ -+enum khadas_fan_mode { -+ KHADAS_FAN_STATE_MANUAL = 0, -+ KHADAS_FAN_STATE_AUTO, -+}; -+ -+enum khadas_fan_level { -+ KHADAS_FAN_LEVEL_0 = 0, -+ KHADAS_FAN_LEVEL_1, -+ KHADAS_FAN_LEVEL_2, -+ KHADAS_FAN_LEVEL_3, -+}; -+ -+enum khadas_fan_enable { -+ KHADAS_FAN_DISABLE = 0, -+ KHADAS_FAN_ENABLE, -+}; -+ -+enum khadas_fan_hwver { -+ KHADAS_FAN_HWVER_NONE = 0, -+ KHADAS_FAN_HWVER_V12, -+ KHADAS_FAN_HWVER_V13, -+ KHADAS_FAN_HWVER_V14 -+}; -+ -+struct khadas_fan_data { -+ int initialized; -+ struct platform_device *pdev; -+ struct class *class; -+ struct delayed_work work; -+ struct delayed_work fan_test_work; -+ enum khadas_fan_enable enable; -+ enum khadas_fan_mode mode; -+ enum khadas_fan_level level; -+ int ctrl_gpio0; -+ int ctrl_gpio1; -+ int trig_temp_level0; -+ int trig_temp_level1; -+ int trig_temp_level2; -+ enum khadas_fan_hwver hwver; -+}; -+ -+struct khadas_fan_data *fan_data = NULL; -+ -+void khadas_fan_level_set(struct khadas_fan_data *fan_data, int level ) -+{ -+ if(0 == level){ -+ gpio_set_value(fan_data->ctrl_gpio0, KHADAS_FAN_GPIO_OFF); -+ gpio_set_value(fan_data->ctrl_gpio1, KHADAS_FAN_GPIO_OFF); -+ }else if(1 == level){ -+ gpio_set_value(fan_data->ctrl_gpio0, KHADAS_FAN_GPIO_ON); -+ gpio_set_value(fan_data->ctrl_gpio1, KHADAS_FAN_GPIO_OFF); -+ }else if(2 == level){ -+ gpio_set_value(fan_data->ctrl_gpio0, KHADAS_FAN_GPIO_OFF); -+ gpio_set_value(fan_data->ctrl_gpio1, KHADAS_FAN_GPIO_ON); -+ }else if(3 == level){ -+ gpio_set_value(fan_data->ctrl_gpio0, KHADAS_FAN_GPIO_ON); -+ gpio_set_value(fan_data->ctrl_gpio1, KHADAS_FAN_GPIO_ON); -+ } -+} -+ -+extern int meson_gx_get_temperature(void); -+static void fan_work_func(struct work_struct *_work) -+{ -+ int temp = -EINVAL; -+ struct khadas_fan_data *fan_data = container_of(_work, -+ struct khadas_fan_data, work.work); -+ -+ temp = meson_gx_get_temperature(); -+ -+ if(temp != -EINVAL){ -+ if(temp < fan_data->trig_temp_level0 ){ -+ khadas_fan_level_set(fan_data,0); -+ -+ }else if(temp < fan_data->trig_temp_level1 ){ -+ khadas_fan_level_set(fan_data,1); -+ -+ }else if(temp < fan_data->trig_temp_level2 ){ -+ khadas_fan_level_set(fan_data,2); -+ -+ }else{ -+ khadas_fan_level_set(fan_data,3); -+ } -+ } -+ -+ schedule_delayed_work(&fan_data->work, KHADAS_FAN_LOOP_SECS); -+} -+ -+//static void fan_test_work_func(struct work_struct *_work) -+//{ -+// struct khadas_fan_data *fan_data = container_of(_work, -+// struct khadas_fan_data, fan_test_work.work); -+// -+// -+// khadas_fan_level_set(fan_data,0); -+// -+//} -+ -+ -+static void khadas_fan_set(struct khadas_fan_data *fan_data) -+{ -+ -+ cancel_delayed_work(&fan_data->work); -+ -+ if (fan_data->enable == KHADAS_FAN_DISABLE) { -+ khadas_fan_level_set(fan_data,0); -+ return; -+ } -+ switch (fan_data->mode) { -+ case KHADAS_FAN_STATE_MANUAL: -+ switch(fan_data->level){ -+ case KHADAS_FAN_LEVEL_1: -+ khadas_fan_level_set(fan_data,1); -+ break; -+ case KHADAS_FAN_LEVEL_2: -+ khadas_fan_level_set(fan_data,2); -+ break; -+ case KHADAS_FAN_LEVEL_3: -+ khadas_fan_level_set(fan_data,3); -+ break; -+ default: -+ break; -+ } -+ break; -+ -+ case KHADAS_FAN_STATE_AUTO: -+ // FIXME: achieve with a better way -+ schedule_delayed_work(&fan_data->work, KHADAS_FAN_LOOP_NODELAY_SECS); -+ break; -+ -+ default: -+ break; -+ } -+} -+ -+static ssize_t fan_enable_show(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan enable: %d\n", fan_data->enable); -+} -+ -+static ssize_t fan_enable_store(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int enable; -+ -+ if (kstrtoint(buf, 0, &enable)) -+ return -EINVAL; -+ -+ // 0: manual, 1: auto -+ if( enable >= 0 && enable < 2 ){ -+ fan_data->enable = enable; -+ khadas_fan_set(fan_data); -+ } -+ -+ return count; -+} -+ -+static ssize_t fan_mode_show(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan mode: %d\n", fan_data->mode); -+} -+ -+static ssize_t fan_mode_store(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int mode; -+ -+ if (kstrtoint(buf, 0, &mode)) -+ return -EINVAL; -+ -+ // 0: manual, 1: auto -+ if( mode >= 0 && mode < 2 ){ -+ fan_data->mode = mode; -+ khadas_fan_set(fan_data); -+ } -+ -+ return count; -+} -+ -+static ssize_t fan_level_show(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Fan level: %d\n", fan_data->level); -+} -+ -+static ssize_t fan_level_store(struct class *cls, struct class_attribute *attr, -+ const char *buf, size_t count) -+{ -+ int level; -+ -+ if (kstrtoint(buf, 0, &level)) -+ return -EINVAL; -+ -+ if( level >= 0 && level < 4){ -+ fan_data->level = level; -+ khadas_fan_set(fan_data); -+ } -+ -+ return count; -+} -+ -+ -+static ssize_t fan_temp_show(struct class *cls, -+ struct class_attribute *attr, char *buf) -+{ -+ int temp = -EINVAL; -+ temp = meson_gx_get_temperature(); -+ -+ return sprintf(buf, "cpu_temp:%d\nFan trigger temperature: level0:%d level1:%d level2:%d\n", temp, fan_data->trig_temp_level0, fan_data->trig_temp_level1, fan_data->trig_temp_level2); -+} -+ -+#if 0 -+static ssize_t fan_temp_store(struct device *dev, struct device_attribute *attr, -+ const char *buf, size_t count) -+{ -+ struct khadas_fan_data *fan_data = dev_get_drvdata(dev); -+ int temp; -+ -+ if (kstrtoint(buf, 0, &temp)) -+ return -EINVAL; -+ -+ if (temp > KHADAS_FAN_TRIG_MAXTEMP) -+ temp = KHADAS_FAN_TRIG_MAXTEMP; -+ fan_data->trig_temp_level0 = temp; -+ -+ return count; -+} -+#endif -+ -+static struct class_attribute fan_class_attrs[] = { -+ __ATTR(enable, 0644, fan_enable_show, fan_enable_store), -+ __ATTR(mode, 0644, fan_mode_show, fan_mode_store), -+ __ATTR(level, 0644, fan_level_show, fan_level_store), -+ __ATTR(temp, 0644, fan_temp_show, NULL), -+}; -+ -+static int khadas_fan_probe(struct platform_device *pdev) -+{ -+ struct device *dev = &pdev->dev; -+ int ret; -+ int i; -+ const char *hwver = NULL; -+ -+ printk("khadas_fan_probe\n"); -+ -+ fan_data = devm_kzalloc(dev, sizeof(struct khadas_fan_data), GFP_KERNEL); -+ if (!fan_data) -+ return -ENOMEM; -+ -+ // Get hardwere version -+ ret = of_property_read_string(dev->of_node, "hwver", &hwver); -+ if (ret < 0) { -+ fan_data->hwver = KHADAS_FAN_HWVER_V12; -+ } else { -+ if (0 == strcmp(hwver, "VIM2.V12")) { -+ fan_data->hwver = KHADAS_FAN_HWVER_V12; -+ } else if (0 == strcmp(hwver, "VIM2.V13")) { -+ fan_data->hwver = KHADAS_FAN_HWVER_V13; -+ } else if (0 == strcmp(hwver, "VIM2.V14")) { -+ fan_data->hwver = KHADAS_FAN_HWVER_V14; -+ } -+ else { -+ fan_data->hwver = KHADAS_FAN_HWVER_NONE; -+ } -+ } -+ -+ if (KHADAS_FAN_HWVER_V12 != fan_data->hwver) { -+ // This driver is only for Khadas VIM2 V12 version. -+ printk("FAN: This driver is only for Khadas VIM2 V12 version.\n"); -+ return 0; -+ } -+ -+ ret = of_property_read_u32(dev->of_node, "trig_temp_level0", &fan_data->trig_temp_level0); -+ if (ret < 0) -+ fan_data->trig_temp_level0 = KHADAS_FAN_TRIG_TEMP_LEVEL0; -+ ret = of_property_read_u32(dev->of_node, "trig_temp_level1", &fan_data->trig_temp_level1); -+ if (ret < 0) -+ fan_data->trig_temp_level1 = KHADAS_FAN_TRIG_TEMP_LEVEL1; -+ ret = of_property_read_u32(dev->of_node, "trig_temp_level2", &fan_data->trig_temp_level2); -+ if (ret < 0) -+ fan_data->trig_temp_level2 = KHADAS_FAN_TRIG_TEMP_LEVEL2; -+ -+ fan_data->ctrl_gpio0 = of_get_named_gpio(dev->of_node, "fan_ctl0", 0); -+ fan_data->ctrl_gpio1 = of_get_named_gpio(dev->of_node, "fan_ctl1", 0); -+ if ((gpio_request(fan_data->ctrl_gpio0, "FAN") != 0)|| (gpio_request(fan_data->ctrl_gpio1, "FAN") != 0)) -+ return -EIO; -+ -+ gpio_direction_output(fan_data->ctrl_gpio0, KHADAS_FAN_GPIO_OFF); -+ gpio_direction_output(fan_data->ctrl_gpio1, KHADAS_FAN_GPIO_OFF); -+ fan_data->mode = KHADAS_FAN_STATE_AUTO; -+ fan_data->level = KHADAS_FAN_LEVEL_0; -+ fan_data->enable = KHADAS_FAN_DISABLE; -+ -+ INIT_DELAYED_WORK(&fan_data->work, fan_work_func); -+ khadas_fan_level_set(fan_data,0); -+// INIT_DELAYED_WORK(&fan_data->fan_test_work, fan_test_work_func); -+// schedule_delayed_work(&fan_data->fan_test_work, KHADAS_FAN_TEST_LOOP_SECS); -+ -+ fan_data->pdev = pdev; -+ platform_set_drvdata(pdev, fan_data); -+ -+ fan_data->class = class_create(THIS_MODULE, "fan"); -+ if (IS_ERR(fan_data->class)) { -+ return PTR_ERR(fan_data->class); -+ } -+ -+ for (i = 0; i < ARRAY_SIZE(fan_class_attrs); i++){ -+ ret = class_create_file(fan_data->class, &fan_class_attrs[i]); -+ if(0!=ret){ -+ printk("khadas_fan_probe,class_create_file%d failed \n", i); -+ } -+ } -+ dev_info(dev, "trigger temperature is level0:%d, level1:%d, level2:%d.\n", fan_data->trig_temp_level0, fan_data->trig_temp_level1, fan_data->trig_temp_level2); -+ -+ fan_data->initialized = 1; -+ -+ return 0; -+} -+ -+static int khadas_fan_remove(struct platform_device *pdev) -+{ -+ if (fan_data->initialized) { -+ fan_data->enable = KHADAS_FAN_DISABLE; -+ khadas_fan_set(fan_data); -+ } -+ -+ return 0; -+} -+ -+static void khadas_fan_shutdown(struct platform_device *pdev) -+{ -+ if (fan_data->initialized) { -+ fan_data->enable = KHADAS_FAN_DISABLE; -+ khadas_fan_set(fan_data); -+ } -+} -+ -+#ifdef CONFIG_PM -+static int khadas_fan_suspend(struct platform_device *pdev, pm_message_t state) -+{ -+ if (fan_data->initialized) { -+ cancel_delayed_work(&fan_data->work); -+ khadas_fan_level_set(fan_data, 0); -+ } -+ -+ return 0; -+} -+ -+static int khadas_fan_resume(struct platform_device *pdev) -+{ -+ if (fan_data->initialized) { -+ khadas_fan_set(fan_data); -+ } -+ -+ return 0; -+} -+#endif -+ -+static struct of_device_id of_khadas_fan_match[] = { -+ { .compatible = "fanctl", }, -+ {}, -+}; -+ -+static struct platform_driver khadas_fan_driver = { -+ .probe = khadas_fan_probe, -+#ifdef CONFIG_PM -+ .suspend = khadas_fan_suspend, -+ .resume = khadas_fan_resume, -+#endif -+ .remove = khadas_fan_remove, -+ .shutdown = khadas_fan_shutdown, -+ .driver = { -+ .name = "fanctl", -+ .owner = THIS_MODULE, -+ .of_match_table = of_match_ptr(of_khadas_fan_match), -+ }, -+}; -+ -+module_platform_driver(khadas_fan_driver); -+ -+MODULE_AUTHOR("kenny "); -+MODULE_DESCRIPTION("khadas GPIO Fan driver"); -+MODULE_LICENSE("GPL"); --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM2-enable-RTC.patch b/patch/kernel/archive/meson64-5.10/board-VIM2-enable-RTC.patch deleted file mode 100644 index f70758fd3486..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM2-enable-RTC.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 096db0ffef76a1fdfe20ff528f120de1e708758a Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Sat, 17 Aug 2019 15:44:24 +0800 -Subject: [PATCH 094/101] arm64: dts: VIM2: enable RTC - -Signed-off-by: Nick Xie ---- - arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -index dfa2abc55918..5ef329f10a06 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -@@ -356,7 +356,7 @@ - - rtc: rtc@51 { - /* has to be enabled manually when a battery is connected: */ -- status = "disabled"; -+ status = "okay"; - compatible = "haoyu,hym8563"; - reg = <0x51>; - #clock-cells = <0>; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM2-enable-cap-sd-highspeed.patch b/patch/kernel/archive/meson64-5.10/board-VIM2-enable-cap-sd-highspeed.patch deleted file mode 100644 index 08d883eb8434..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM2-enable-cap-sd-highspeed.patch +++ /dev/null @@ -1,25 +0,0 @@ -From d0a3e14dd72781bc6ff475fce5e8ea57fcc7a871 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Thu, 19 Dec 2019 21:36:14 +0800 -Subject: [PATCH 096/101] arm64: dts: SDIO: VIM2: enable 'cap-sd-highspeed' - -Signed-off-by: Nick Xie ---- - arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -index 8060e97d764f..57de06faa841 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts -@@ -397,6 +397,7 @@ - #size-cells = <0>; - - bus-width = <4>; -+ cap-sd-highspeed; - max-frequency = <100000000>; - - non-removable; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-VIM3-disable-sd-uhs-sdr50-to-fix-AP63.patch b/patch/kernel/archive/meson64-5.10/board-VIM3-disable-sd-uhs-sdr50-to-fix-AP63.patch deleted file mode 100644 index f1ac4e435844..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-VIM3-disable-sd-uhs-sdr50-to-fix-AP63.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 21c5b2840c068b8640e43ce61f9e26b67f48ecc9 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Thu, 19 Dec 2019 21:40:58 +0800 -Subject: [PATCH 097/101] arm64: dts: SDIO: VIM3: disable 'sd-uhs-sdr50' to fix - AP6398S - -Signed-off-by: Nick Xie ---- - arch/arm64/boot/dts/amlogic/meson-g12b-a311d-khadas-vim3.dts | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d-khadas-vim3.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d-khadas-vim3.dts -index 124a80901084..d855c79a8288 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d-khadas-vim3.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d-khadas-vim3.dts -@@ -15,6 +15,10 @@ - compatible = "khadas,vim3", "amlogic,a311d", "amlogic,g12b"; - }; - -+&sd_emmc_a { -+ /delete-property/ sd-uhs-sdr50; -+}; -+ - /* - * The VIM3 on-board MCU can mux the PCIe/USB3.0 shared differential - * lines using a FUSB340TMX USB 3.1 SuperSpeed Data Switch between --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-add-bananapi-m5.patch b/patch/kernel/archive/meson64-5.10/board-add-bananapi-m5.patch deleted file mode 100644 index ac1ccea236bf..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-add-bananapi-m5.patch +++ /dev/null @@ -1,699 +0,0 @@ -From 976e920183e406726637db925efdf8b407a2d03a Mon Sep 17 00:00:00 2001 -From: Neil Armstrong -Date: Fri, 14 May 2021 16:32:55 +0200 -Subject: arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts - -Banana Pi BPI-M5 is a credit card format SBC with the following features: -- Amlogic S905X3 quad core Cortex-A55 -- Mali-G31 GPU -- 4GB LPDDR4 -- 16GB eMMC flash -- 4 USB 3.0 -- 1 GbE ethernet -- HDMI output -- 2x LEDS -- SDCard -- 2.5mm Jack with Stereo Audio + CVBS -- Infrared Received -- ADC Button -- GPIO Button -- 40 pins header + 3pins debug header - -Signed-off-by: Neil Armstrong -Reviewed-by: Martin Blumenstingl -Link: https://lore.kernel.org/r/20210514143255.3352774-4-narmstrong@baylibre.com ---- - arch/arm64/boot/dts/amlogic/Makefile | 1 + - .../boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 646 +++++++++++++++++++++ - 2 files changed, 647 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts - -(limited to 'arch/arm64/boot/dts/amlogic') - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index a58ccecfcb551..faa0a79a34f54 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -48,6 +48,7 @@ dtb-$(CONFIG_ARCH_MESON) += meson-gxm-rbox-pro.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxm-vega-s96.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxm-wetek-core2.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-sei610.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-sm1-bananapi-m5.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-khadas-vim3l.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-odroid-c4.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-odroid-hc4.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts -new file mode 100644 -index 0000000000000..effaa138b5f98 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts -@@ -0,0 +1,646 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2021 BayLibre SAS -+ * Author: Neil Armstrong -+ */ -+ -+/dts-v1/; -+ -+#include "meson-sm1.dtsi" -+#include -+#include -+#include -+#include -+#include -+ -+/ { -+ compatible = "bananapi,bpi-m5", "amlogic,sm1"; -+ model = "Banana Pi BPI-M5"; -+ -+ adc_keys { -+ compatible = "adc-keys"; -+ io-channels = <&saradc 2>; -+ io-channel-names = "buttons"; -+ keyup-threshold-microvolt = <1800000>; -+ -+ key { -+ label = "SW3"; -+ linux,code = ; -+ press-threshold-microvolt = <1700000>; -+ }; -+ }; -+ -+ aliases { -+ serial0 = &uart_AO; -+ ethernet0 = ðmac; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ /* TOFIX: handle CVBS_DET on SARADC channel 0 */ -+ cvbs-connector { -+ compatible = "composite-video-connector"; -+ -+ port { -+ cvbs_connector_in: endpoint { -+ remote-endpoint = <&cvbs_vdac_out>; -+ }; -+ }; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_12 GPIO_ACTIVE_LOW>; -+ }; -+ -+ gpio-keys { -+ compatible = "gpio-keys"; -+ -+ key { -+ label = "SW1"; -+ linux,code = ; -+ gpios = <&gpio_ao GPIOAO_3 GPIO_ACTIVE_LOW>; -+ interrupt-parent = <&gpio_intc>; -+ interrupts = <3 IRQ_TYPE_EDGE_BOTH>; -+ }; -+ }; -+ -+ hdmi-connector { -+ compatible = "hdmi-connector"; -+ type = "a"; -+ -+ port { -+ hdmi_connector_in: endpoint { -+ remote-endpoint = <&hdmi_tx_tmds_out>; -+ }; -+ }; -+ }; -+ -+ leds { -+ compatible = "gpio-leds"; -+ -+ green { -+ color = ; -+ function = LED_FUNCTION_STATUS; -+ gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_LOW>; -+ }; -+ -+ blue { -+ color = ; -+ function = LED_FUNCTION_STATUS; -+ gpios = <&gpio_ao GPIOAO_11 GPIO_ACTIVE_LOW>; -+ linux,default-trigger = "heartbeat"; -+ }; -+ }; -+ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x40000000>; -+ }; -+ -+ emmc_1v8: regulator-emmc_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "EMMC_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ dc_in: regulator-dc_in { -+ compatible = "regulator-fixed"; -+ regulator-name = "DC_IN"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-always-on; -+ }; -+ -+ vddio_c: regulator-vddio_c { -+ compatible = "regulator-gpio"; -+ regulator-name = "VDDIO_C"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <3300000>; -+ -+ enable-gpio = <&gpio GPIOE_2 GPIO_ACTIVE_HIGH>; -+ enable-active-high; -+ regulator-always-on; -+ -+ gpios = <&gpio_ao GPIOAO_6 GPIO_OPEN_DRAIN>; -+ gpios-states = <1>; -+ -+ states = <1800000 0>, -+ <3300000 1>; -+ }; -+ -+ tflash_vdd: regulator-tflash_vdd { -+ compatible = "regulator-fixed"; -+ regulator-name = "TFLASH_VDD"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&dc_in>; -+ gpio = <&gpio GPIOH_8 GPIO_OPEN_DRAIN>; -+ enable-active-high; -+ regulator-always-on; -+ }; -+ -+ vddao_1v8: regulator-vddao_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&dc_in>; -+ regulator-always-on; -+ }; -+ -+ vddcpu: regulator-vddcpu { -+ /* -+ * SY8120B1ABC DC/DC Regulator. -+ */ -+ compatible = "pwm-regulator"; -+ -+ regulator-name = "VDDCPU"; -+ regulator-min-microvolt = <690000>; -+ regulator-max-microvolt = <1050000>; -+ -+ vin-supply = <&dc_in>; -+ -+ pwms = <&pwm_AO_cd 1 1250 0>; -+ pwm-dutycycle-range = <100 0>; -+ -+ regulator-boot-on; -+ regulator-always-on; -+ }; -+ -+ /* USB Hub Power Enable */ -+ vl_pwr_en: regulator-vl_pwr_en { -+ compatible = "regulator-fixed"; -+ regulator-name = "VL_PWR_EN"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&dc_in>; -+ -+ gpio = <&gpio GPIOH_6 GPIO_ACTIVE_HIGH>; -+ enable-active-high; -+ }; -+ -+ sound { -+ compatible = "amlogic,axg-sound-card"; -+ model = "BPI-M5"; -+ audio-widgets = "Line", "Lineout"; -+ audio-aux-devs = <&tdmout_b>, <&tdmout_c>, -+ <&tdmin_a>, <&tdmin_b>, <&tdmin_c>; -+ audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1", -+ "TDMOUT_B IN 1", "FRDDR_B OUT 1", -+ "TDMOUT_B IN 2", "FRDDR_C OUT 1", -+ "TDM_B Playback", "TDMOUT_B OUT", -+ "TDMOUT_C IN 0", "FRDDR_A OUT 2", -+ "TDMOUT_C IN 1", "FRDDR_B OUT 2", -+ "TDMOUT_C IN 2", "FRDDR_C OUT 2", -+ "TDM_C Playback", "TDMOUT_C OUT", -+ "TDMIN_A IN 4", "TDM_B Loopback", -+ "TDMIN_B IN 4", "TDM_B Loopback", -+ "TDMIN_C IN 4", "TDM_B Loopback", -+ "TDMIN_A IN 5", "TDM_C Loopback", -+ "TDMIN_B IN 5", "TDM_C Loopback", -+ "TDMIN_C IN 5", "TDM_C Loopback", -+ "TODDR_A IN 0", "TDMIN_A OUT", -+ "TODDR_B IN 0", "TDMIN_A OUT", -+ "TODDR_C IN 0", "TDMIN_A OUT", -+ "TODDR_A IN 1", "TDMIN_B OUT", -+ "TODDR_B IN 1", "TDMIN_B OUT", -+ "TODDR_C IN 1", "TDMIN_B OUT", -+ "TODDR_A IN 2", "TDMIN_C OUT", -+ "TODDR_B IN 2", "TDMIN_C OUT", -+ "TODDR_C IN 2", "TDMIN_C OUT", -+ "Lineout", "ACODEC LOLP", -+ "Lineout", "ACODEC LORP"; -+ -+ assigned-clocks = <&clkc CLKID_MPLL2>, -+ <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&frddr_a>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&frddr_b>; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&frddr_c>; -+ }; -+ -+ dai-link-3 { -+ sound-dai = <&toddr_a>; -+ }; -+ -+ dai-link-4 { -+ sound-dai = <&toddr_b>; -+ }; -+ -+ dai-link-5 { -+ sound-dai = <&toddr_c>; -+ }; -+ -+ /* 8ch hdmi interface */ -+ dai-link-6 { -+ sound-dai = <&tdmif_b>; -+ dai-format = "i2s"; -+ dai-tdm-slot-tx-mask-0 = <1 1>; -+ dai-tdm-slot-tx-mask-1 = <1 1>; -+ dai-tdm-slot-tx-mask-2 = <1 1>; -+ dai-tdm-slot-tx-mask-3 = <1 1>; -+ mclk-fs = <256>; -+ -+ codec-0 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_IN_B>; -+ }; -+ -+ codec-1 { -+ sound-dai = <&toacodec TOACODEC_IN_B>; -+ }; -+ }; -+ -+ /* i2s jack output interface */ -+ dai-link-7 { -+ sound-dai = <&tdmif_c>; -+ dai-format = "i2s"; -+ dai-tdm-slot-tx-mask-0 = <1 1>; -+ mclk-fs = <256>; -+ -+ codec-0 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_IN_C>; -+ }; -+ -+ codec-1 { -+ sound-dai = <&toacodec TOACODEC_IN_C>; -+ }; -+ }; -+ -+ /* hdmi glue */ -+ dai-link-8 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>; -+ -+ codec { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ -+ /* acodec glue */ -+ dai-link-9 { -+ sound-dai = <&toacodec TOACODEC_OUT>; -+ -+ codec { -+ sound-dai = <&acodec>; -+ }; -+ }; -+ }; -+}; -+ -+&acodec { -+ AVDD-supply = <&vddao_1v8>; -+ status = "okay"; -+}; -+ -+&arb { -+ status = "okay"; -+}; -+ -+&clkc_audio { -+ status = "okay"; -+}; -+ -+&cpu0 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu1 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU1_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu2 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU2_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cpu3 { -+ cpu-supply = <&vddcpu>; -+ operating-points-v2 = <&cpu_opp_table>; -+ clocks = <&clkc CLKID_CPU3_CLK>; -+ clock-latency = <50000>; -+}; -+ -+&cvbs_vdac_port { -+ cvbs_vdac_out: endpoint { -+ remote-endpoint = <&cvbs_connector_in>; -+ }; -+}; -+ -+&ext_mdio { -+ external_phy: ethernet-phy@0 { -+ /* Realtek RTL8211F (0x001cc916) */ -+ reg = <0>; -+ max-speed = <1000>; -+ -+ interrupt-parent = <&gpio_intc>; -+ /* MAC_INTR on GPIOZ_14 */ -+ interrupts = <26 IRQ_TYPE_LEVEL_LOW>; -+ }; -+}; -+ -+ðmac { -+ pinctrl-0 = <ð_pins>, <ð_rgmii_pins>; -+ pinctrl-names = "default"; -+ status = "okay"; -+ phy-mode = "rgmii-txid"; -+ phy-handle = <&external_phy>; -+}; -+ -+&frddr_a { -+ status = "okay"; -+}; -+ -+&frddr_b { -+ status = "okay"; -+}; -+ -+&frddr_c { -+ status = "okay"; -+}; -+ -+&gpio { -+ gpio-line-names = -+ /* GPIOZ */ -+ "ETH_MDIO", /* GPIOZ_0 */ -+ "ETH_MDC", /* GPIOZ_1 */ -+ "ETH_RXCLK", /* GPIOZ_2 */ -+ "ETH_RX_DV", /* GPIOZ_3 */ -+ "ETH_RXD0", /* GPIOZ_4 */ -+ "ETH_RXD1", /* GPIOZ_5 */ -+ "ETH_RXD2", /* GPIOZ_6 */ -+ "ETH_RXD3", /* GPIOZ_7 */ -+ "ETH_TXCLK", /* GPIOZ_8 */ -+ "ETH_TXEN", /* GPIOZ_9 */ -+ "ETH_TXD0", /* GPIOZ_10 */ -+ "ETH_TXD1", /* GPIOZ_11 */ -+ "ETH_TXD2", /* GPIOZ_12 */ -+ "ETH_TXD3", /* GPIOZ_13 */ -+ "ETH_INTR", /* GPIOZ_14 */ -+ "ETH_NRST", /* GPIOZ_15 */ -+ /* GPIOH */ -+ "HDMI_SDA", /* GPIOH_0 */ -+ "HDMI_SCL", /* GPIOH_1 */ -+ "HDMI_HPD", /* GPIOH_2 */ -+ "HDMI_CEC", /* GPIOH_3 */ -+ "VL-RST_N", /* GPIOH_4 */ -+ "CON1-P36", /* GPIOH_5 */ -+ "VL-PWREN", /* GPIOH_6 */ -+ "WiFi_3V3_1V8", /* GPIOH_7 */ -+ "TFLASH_VDD_EN", /* GPIOH_8 */ -+ /* BOOT */ -+ "eMMC_D0", /* BOOT_0 */ -+ "eMMC_D1", /* BOOT_1 */ -+ "eMMC_D2", /* BOOT_2 */ -+ "eMMC_D3", /* BOOT_3 */ -+ "eMMC_D4", /* BOOT_4 */ -+ "eMMC_D5", /* BOOT_5 */ -+ "eMMC_D6", /* BOOT_6 */ -+ "eMMC_D7", /* BOOT_7 */ -+ "eMMC_CLK", /* BOOT_8 */ -+ "", -+ "eMMC_CMD", /* BOOT_10 */ -+ "", -+ "eMMC_RST#", /* BOOT_12 */ -+ "eMMC_DS", /* BOOT_13 */ -+ /* GPIOC */ -+ "SD_D0_B", /* GPIOC_0 */ -+ "SD_D1_B", /* GPIOC_1 */ -+ "SD_D2_B", /* GPIOC_2 */ -+ "SD_D3_B", /* GPIOC_3 */ -+ "SD_CLK_B", /* GPIOC_4 */ -+ "SD_CMD_B", /* GPIOC_5 */ -+ "CARD_EN_DET", /* GPIOC_6 */ -+ "", -+ /* GPIOA */ -+ "", "", "", "", "", "", "", "", -+ "", "", "", "", "", "", -+ "CON1-P27", /* GPIOA_14 */ -+ "CON1-P28", /* GPIOA_15 */ -+ /* GPIOX */ -+ "CON1-P16", /* GPIOX_0 */ -+ "CON1-P18", /* GPIOX_1 */ -+ "CON1-P22", /* GPIOX_2 */ -+ "CON1-P11", /* GPIOX_3 */ -+ "CON1-P13", /* GPIOX_4 */ -+ "CON1-P07", /* GPIOX_5 */ -+ "CON1-P33", /* GPIOX_6 */ -+ "CON1-P15", /* GPIOX_7 */ -+ "CON1-P19", /* GPIOX_8 */ -+ "CON1-P21", /* GPIOX_9 */ -+ "CON1-P24", /* GPIOX_10 */ -+ "CON1-P23", /* GPIOX_11 */ -+ "CON1-P08", /* GPIOX_12 */ -+ "CON1-P10", /* GPIOX_13 */ -+ "CON1-P29", /* GPIOX_14 */ -+ "CON1-P31", /* GPIOX_15 */ -+ "CON1-P26", /* GPIOX_16 */ -+ "CON1-P03", /* GPIOX_17 */ -+ "CON1-P05", /* GPIOX_18 */ -+ "CON1-P32"; /* GPIOX_19 */ -+ -+ /* -+ * WARNING: The USB Hub on the BPI-M5 needs a reset signal -+ * to be turned high in order to be detected by the USB Controller -+ * This signal should be handled by a USB specific power sequence -+ * in order to reset the Hub when USB bus is powered down. -+ */ -+ usb-hub { -+ gpio-hog; -+ gpios = ; -+ output-high; -+ line-name = "usb-hub-reset"; -+ }; -+}; -+ -+&gpio_ao { -+ gpio-line-names = -+ /* GPIOAO */ -+ "DEBUG TX", /* GPIOAO_0 */ -+ "DEBUG RX", /* GPIOAO_1 */ -+ "SYS_LED2", /* GPIOAO_2 */ -+ "UPDATE_KEY", /* GPIOAO_3 */ -+ "CON1-P40", /* GPIOAO_4 */ -+ "IR_IN", /* GPIOAO_5 */ -+ "TF_3V3N_1V8_EN", /* GPIOAO_6 */ -+ "CON1-P35", /* GPIOAO_7 */ -+ "CON1-P12", /* GPIOAO_8 */ -+ "CON1-P37", /* GPIOAO_9 */ -+ "CON1-P38", /* GPIOAO_10 */ -+ "SYS_LED", /* GPIOAO_11 */ -+ /* GPIOE */ -+ "VDDEE_PWM", /* GPIOE_0 */ -+ "VDDCPU_PWM", /* GPIOE_1 */ -+ "TF_PWR_EN"; /* GPIOE_2 */ -+}; -+ -+&hdmi_tx { -+ status = "okay"; -+ pinctrl-0 = <&hdmitx_hpd_pins>, <&hdmitx_ddc_pins>; -+ pinctrl-names = "default"; -+ hdmi-supply = <&dc_in>; -+}; -+ -+&hdmi_tx_tmds_port { -+ hdmi_tx_tmds_out: endpoint { -+ remote-endpoint = <&hdmi_connector_in>; -+ }; -+}; -+ -+&ir { -+ status = "okay"; -+ pinctrl-0 = <&remote_input_ao_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&pwm_AO_cd { -+ pinctrl-0 = <&pwm_ao_d_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&xtal>; -+ clock-names = "clkin1"; -+ status = "okay"; -+}; -+ -+&saradc { -+ status = "okay"; -+ vref-supply = <&vddao_1v8>; -+}; -+ -+/* SD card */ -+&sd_emmc_b { -+ status = "okay"; -+ pinctrl-0 = <&sdcard_c_pins>; -+ pinctrl-1 = <&sdcard_clk_gate_c_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <50000000>; -+ disable-wp; -+ -+ /* TOFIX: SD card is barely usable in SDR modes */ -+ -+ cd-gpios = <&gpio GPIOC_6 GPIO_ACTIVE_LOW>; -+ vmmc-supply = <&tflash_vdd>; -+ vqmmc-supply = <&vddio_c>; -+}; -+ -+/* eMMC */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_ctrl_pins>, <&emmc_data_8b_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ max-frequency = <200000000>; -+ disable-wp; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&emmc_1v8>; -+}; -+ -+&tdmif_b { -+ status = "okay"; -+}; -+ -+&tdmif_c { -+ status = "okay"; -+}; -+ -+&tdmin_a { -+ status = "okay"; -+}; -+ -+&tdmin_b { -+ status = "okay"; -+}; -+ -+&tdmin_c { -+ status = "okay"; -+}; -+ -+&tdmout_b { -+ status = "okay"; -+}; -+ -+&tdmout_c { -+ status = "okay"; -+}; -+ -+&toacodec { -+ status = "okay"; -+}; -+ -+&tohdmitx { -+ status = "okay"; -+}; -+ -+&toddr_a { -+ status = "okay"; -+}; -+ -+&toddr_b { -+ status = "okay"; -+}; -+ -+&toddr_c { -+ status = "okay"; -+}; -+ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&usb { -+ status = "okay"; -+}; -+ -+&usb2_phy0 { -+ phy-supply = <&dc_in>; -+}; -+ -+&usb2_phy1 { -+ /* Enable the hub which is connected to this port */ -+ phy-supply = <&vl_pwr_en>; -+}; --- -cgit - diff --git a/patch/kernel/archive/meson64-5.10/board-khadas-vim3-change-LED-behaviour.patch b/patch/kernel/archive/meson64-5.10/board-khadas-vim3-change-LED-behaviour.patch deleted file mode 100644 index f77e63097a44..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-khadas-vim3-change-LED-behaviour.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 6bcac8270ce9c08d0a53423d4511f3d3fcb99644 Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Fri, 21 Feb 2020 03:40:31 +0000 -Subject: [PATCH 087/101] WIP: arm64: dts: meson: khadas-vim3: change LED - behaviours on VIM3/3L - -VIM3/3L have two LEDs (red/white) located 1mm apart on the board. In the -current configuration both are powered on creating a pink visual status -indication. The boards are also marketed as HTPC devices where heartbeat -pulses are distracting and undesirable. - -This change removes the heartbeat and sets the default state so that only -the white LED is on while the board is powered. - -Signed-off-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -index 6022805d2032..6d0163f56b0d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -@@ -40,14 +40,14 @@ - compatible = "gpio-leds"; - - led-white { -- label = "vim3:white:sys"; -- gpios = <&gpio_ao GPIOAO_4 GPIO_ACTIVE_HIGH>; -- linux,default-trigger = "heartbeat"; -+ label = "vim3:white:power"; -+ gpios = <&gpio_ao GPIOAO_4 GPIO_ACTIVE_HIGH>; -+ linux,default-trigger = "default-on"; - }; - - led-red { - label = "vim3:red"; -- gpios = <&gpio_expander 5 GPIO_ACTIVE_HIGH>; -+ gpios = <&gpio_expander 5 GPIO_ACTIVE_HIGH>; - }; - }; - --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-khadas-vim3-fix-missing-i2c3-nod.patch b/patch/kernel/archive/meson64-5.10/board-khadas-vim3-fix-missing-i2c3-nod.patch deleted file mode 100644 index dfbb768908c1..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-khadas-vim3-fix-missing-i2c3-nod.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 04ba78002ded0f9089b7fae6550a56ccd0669e65 Mon Sep 17 00:00:00 2001 -From: Christian Hewitt -Date: Fri, 21 Feb 2020 04:43:22 +0000 -Subject: [PATCH 086/101] WIP: arm64: dts: meson: khadas-vim3: fix missing i2c3 - node - -Fixes: c6d29c66e582 ("arm64: dts: meson-g12b-khadas-vim3: add initial device-tree") - -The i2c3 node was missed in the original device-tree and is required for the -optional Khadas 3705 fan to work. - -Suggested-by: Art Nikpal -Signed-off-by: Christian Hewittt ---- - arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -index 0ef60c7151cb..6022805d2032 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi -@@ -217,6 +217,13 @@ - }; - }; - -+&i2c3 { -+ clock-frequency = <100000>; -+ pinctrl-0 = <&i2c3_sda_a_pins>, <&i2c3_sck_a_pins>; -+ pinctrl-names = "default"; -+ status = "okay"; -+}; -+ - &i2c_AO { - status = "okay"; - pinctrl-0 = <&i2c_ao_sck_pins>, <&i2c_ao_sda_pins>; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-sound.patch b/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-sound.patch deleted file mode 100644 index 31852f24f778..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-sound.patch +++ /dev/null @@ -1,57 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index 7d33cacd0..85004e51c 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -7,6 +7,7 @@ - - #include "meson-gxbb.dtsi" - #include -+#include - - / { - compatible = "friendlyarm,nanopi-k2", "amlogic,meson-gxbb"; -@@ -131,6 +132,44 @@ - }; - }; - }; -+ sound { -+ compatible = "amlogic,gx-sound-card"; -+ model = "GX-SOUND-CARD"; -+ assigned-clocks = <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>, -+ <&clkc CLKID_MPLL2>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_FIFO>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_ENCODER>; -+ dai-format = "i2s"; -+ mclk-fs = <256>; -+ -+ codec-0 { -+ sound-dai = <&aiu AIU_HDMI CTRL_I2S>; -+ }; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&aiu AIU_HDMI CTRL_OUT>; -+ -+ codec-0 { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ }; -+}; -+ -+&aiu { -+ status = "okay"; - }; - - &cec_AO { diff --git a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-spidev.patch b/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-spidev.patch deleted file mode 100644 index fcde2aa99998..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-spidev.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index fa4d9f927..b498186a5 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -162,6 +162,32 @@ - }; - }; - }; -+ -+ spi-gpio { -+ compatible = "spi-gpio"; -+ #address-cells = <0x1>; -+ #size-cells = <0x0>; -+ ranges; -+ status = "ok"; -+ sck-gpios = <&gpio GPIOY_9 0>; -+ miso-gpios = <&gpio GPIOY_7 0>; -+ mosi-gpios = <&gpio GPIOY_5 0>; -+ cs-gpios = <&gpio GPIOY_8 0 -+ &gpio GPIOY_10 0>; -+ num-chipselects = <2>; -+ -+ /* clients */ -+ spidev0@0 { -+ compatible = "spidev"; -+ reg = <0>; -+ spi-max-frequency = <500000>; -+ }; -+ spidev0@1 { -+ compatible = "spidev"; -+ reg = <1>; -+ spi-max-frequency = <500000>; -+ }; -+ }; - }; - - &audio { - diff --git a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-uartC-alias.patch b/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-uartC-alias.patch deleted file mode 100644 index 1f634cdb38cb..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-add-uartC-alias.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index cbe99bd..80c87e0 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -13,6 +13,7 @@ - - aliases { - serial0 = &uart_AO; -+ serial2 = &uart_C; - ethernet0 = ðmac; - }; - diff --git a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-enable-emmc.patch b/patch/kernel/archive/meson64-5.10/board-nanopi-k2-enable-emmc.patch deleted file mode 100644 index f27399f82777..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-nanopi-k2-enable-emmc.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index 80c87e0bb..340559727 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -382,7 +382,7 @@ - - /* eMMC */ - &sd_emmc_c { -- status = "disabled"; -+ status = "okay"; - pinctrl-0 = <&emmc_pins>, <&emmc_ds_pins>; - pinctrl-1 = <&emmc_clk_gate_pins>; - pinctrl-names = "default", "clk-gate"; -@@ -392,8 +392,6 @@ - non-removable; - disable-wp; - cap-mmc-highspeed; -- mmc-ddr-1_8v; -- mmc-hs200-1_8v; - - mmc-pwrseq = <&emmc_pwrseq>; - vmmc-supply = <&vcc3v3>; diff --git a/patch/kernel/archive/meson64-5.10/board-odroid-C4-ethernet.patch b/patch/kernel/archive/meson64-5.10/board-odroid-C4-ethernet.patch deleted file mode 100644 index 22344cd4e64b..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroid-C4-ethernet.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 102c1ce21859266e526879428c9d7c5946b7477c Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Fri, 24 Apr 2020 14:44:06 +0200 -Subject: [PATCH 10/75] arm64: dts: meson-sm1: add support for Hardkernel - ODROID-C4 - -Add the board support for the Hardkernel Odroid-C4 single board computer. - -The Odroid-C4 is the Odroid-C2 successor with same form factor, but using -a modern Amlogic S905X3 (SM1) SoC and 4x USB3 ports. - -Signed-off-by: Dongjin Kim -Signed-off-by: Neil Armstrong -Tested-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index cf5a98f0e47c..e1fe6138b6c0 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -286,6 +286,10 @@ external_phy: ethernet-phy@0 { - reg = <0>; - max-speed = <1000>; - -+ reset-assert-us = <10000>; -+ reset-deassert-us = <30000>; -+ reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>; -+ - interrupt-parent = <&gpio_intc>; - /* MAC_INTR on GPIOZ_14 */ - interrupts = <26 IRQ_TYPE_LEVEL_LOW>; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/board-odroid-HC4_red_led_kernel_support.patch b/patch/kernel/archive/meson64-5.10/board-odroid-HC4_red_led_kernel_support.patch deleted file mode 100644 index 9928333174e0..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroid-HC4_red_led_kernel_support.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 7eec2f3bf6266eac5d1b4bb5b60c0ce470ec9a8a Mon Sep 17 00:00:00 2001 -From: Ricardo Pardini -Date: Sun, 17 Jan 2021 00:14:18 +0100 -Subject: [PATCH] ODROID-HC4 add red power led this is in addition to the blue - led in the C4. defaults to always-on, but can be changed, example: # echo - rc-feedback > /sys/class/leds/red:power/trigger - -Signed-off-by: Ricardo Pardini ---- - arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -index 92987fece80e0..28631fd2d9f18 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts -@@ -22,6 +22,16 @@ - interrupts = <84 IRQ_TYPE_EDGE_FALLING>; - pulses-per-revolutions = <2>; - }; -+ -+ leds { -+ compatible = "gpio-leds"; -+ led-red { -+ color = ; -+ function = LED_FUNCTION_POWER; -+ gpios = <&gpio_ao GPIOAO_7 GPIO_ACTIVE_HIGH>; -+ linux,default-trigger = "default-on"; -+ }; -+ }; - }; - - &cpu_thermal { diff --git a/patch/kernel/archive/meson64-5.10/board-odroid-N2+-Add-missing-CPU-opp-values.patch b/patch/kernel/archive/meson64-5.10/board-odroid-N2+-Add-missing-CPU-opp-values.patch deleted file mode 100644 index d9f30713136e..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroid-N2+-Add-missing-CPU-opp-values.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 712b399ed54f49e0ac7ae92c57ed775604eaaed9 Mon Sep 17 00:00:00 2001 -From: Igor Pecovnik -Date: Wed, 10 Feb 2021 18:07:08 +0100 -Subject: [PATCH] Add missing CPU opp values for clocking g12b / N2+ higher - -Signed-off-by: Igor Pecovnik ---- - .../arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -index d61f43052..75030d197 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi -@@ -65,6 +65,14 @@ opp-1800000000 { - opp-hz = /bits/ 64 <1800000000>; - opp-microvolt = <1001000>; - }; -+ opp-1908000000 { -+ opp-hz = /bits/ 64 <1908000000>; -+ opp-microvolt = <1030000>; -+ }; -+ opp-2016000000 { -+ opp-hz = /bits/ 64 <2016000000>; -+ opp-microvolt = <1040000>; -+ }; - }; - - cpub_opp_table_1: opp-table-1 { -@@ -145,5 +153,13 @@ opp-2208000000 { - opp-hz = /bits/ 64 <2208000000>; - opp-microvolt = <1011000>; - }; -+ opp-2304000000 { -+ opp-hz = /bits/ 64 <2304000000>; -+ opp-microvolt = <1030000>; -+ }; -+ opp-2400000000 { -+ opp-hz = /bits/ 64 <2400000000>; -+ opp-microvolt = <1040000>; -+ }; - }; - }; --- -Created with Armbian build tools https://github.com/armbian/build - diff --git a/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-SPI.patch b/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-SPI.patch deleted file mode 100644 index 62305f74e517..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-SPI.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index 0916dcb..cbc03df 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -116,6 +116,32 @@ - }; - }; - }; -+ -+ spi-gpio { -+ compatible = "spi-gpio"; -+ #address-cells = <0x1>; -+ #size-cells = <0x0>; -+ ranges; -+ status = "disabled"; -+ sck-gpios = <&gpio GPIOX_2 0>; -+ miso-gpios = <&gpio GPIOX_4 0>; -+ mosi-gpios = <&gpio GPIOX_7 0>; -+ cs-gpios = <&gpio GPIOX_3 0 -+ &gpio GPIOX_1 0>; -+ num-chipselects = <2>; -+ -+ /* clients */ -+ spidev0@0 { -+ compatible = "spidev"; -+ reg = <0>; -+ spi-max-frequency = <500000>; -+ }; -+ spidev0@1 { -+ compatible = "spidev"; -+ reg = <1>; -+ spi-max-frequency = <500000>; -+ }; -+ }; - - sound { - compatible = "simple-audio-card"; diff --git a/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-scpi-dvfs.patch b/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-scpi-dvfs.patch deleted file mode 100644 index dbe1e637f149..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroid-c2-enable-scpi-dvfs.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index d147c853a..dbde670ba 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -246,7 +246,8 @@ - }; - - &scpi_clocks { -- status = "disabled"; -+ /* Works only with new blobs that have limited DVFS table */ -+ status = "okay"; - }; - - /* SD */ diff --git a/patch/kernel/archive/meson64-5.10/board-odroidc2-add-sound.patch b/patch/kernel/archive/meson64-5.10/board-odroidc2-add-sound.patch deleted file mode 100644 index 829490a6bdb7..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroidc2-add-sound.patch +++ /dev/null @@ -1,58 +0,0 @@ -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index 0d0dd26ce..9e8384978 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -9,6 +9,7 @@ - - #include "meson-gxbb.dtsi" - #include -+#include - - / { - compatible = "hardkernel,odroid-c2", "amlogic,meson-gxbb"; -@@ -200,6 +201,44 @@ - }; - }; - }; -+ sound { -+ compatible = "amlogic,gx-sound-card"; -+ model = "GX-SOUND-CARD"; -+ assigned-clocks = <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>, -+ <&clkc CLKID_MPLL2>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_FIFO>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&aiu AIU_CPU CPU_I2S_ENCODER>; -+ dai-format = "i2s"; -+ mclk-fs = <256>; -+ -+ codec-0 { -+ sound-dai = <&aiu AIU_HDMI CTRL_I2S>; -+ }; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&aiu AIU_HDMI CTRL_OUT>; -+ -+ codec-0 { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ }; -+}; -+ -+&aiu { -+ status = "okay"; - }; - - &cec_AO { - diff --git a/patch/kernel/archive/meson64-5.10/board-odroidc2-add-uartA-uartC.patch b/patch/kernel/archive/meson64-5.10/board-odroidc2-add-uartA-uartC.patch deleted file mode 100644 index 9ed2e6f4eb9e..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-odroidc2-add-uartA-uartC.patch +++ /dev/null @@ -1,37 +0,0 @@ -From d5d2d8b9eb93eab85af12f1844975903a7c5a879 Mon Sep 17 00:00:00 2001 -From: Stefan Agner -Date: Thu, 29 Apr 2021 21:32:43 +0200 -Subject: [PATCH XXX] board-odroidc2-add-uartA-uartC - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index 1cc9dc6..9f48dff 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -16,6 +16,8 @@ - - aliases { - serial0 = &uart_AO; -+ serial1 = &uart_A; -+ serial2 = &uart_C; - ethernet0 = ðmac; - }; - -@@ -290,6 +355,18 @@ - pinctrl-names = "default"; - }; - -+&uart_A { -+ status = "disabled"; -+ pinctrl-0 = <&uart_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&uart_C { -+ status = "disabled"; -+ pinctrl-0 = <&uart_c_pins>; -+ pinctrl-names = "default"; -+}; -+ - &usb0_phy { - status = "okay"; - phy-supply = <&usb_otg_pwr>; diff --git a/patch/kernel/archive/meson64-5.10/board-tanix-tx3-add-thermal-zones.patch b/patch/kernel/archive/meson64-5.10/board-tanix-tx3-add-thermal-zones.patch deleted file mode 100644 index e7b7d8f3e3b7..000000000000 --- a/patch/kernel/archive/meson64-5.10/board-tanix-tx3-add-thermal-zones.patch +++ /dev/null @@ -1,64 +0,0 @@ -diff -Naur linux-5.3-rc8-old/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-tx3-mini.dts linux-5.3-rc8-new/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-tx3-mini.dts ---- linux-5.3-rc8-old/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-tx3-mini.dts 2019-09-10 13:18:29.000000007 +0200 -+++ linux-5.3-rc8-new/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-tx3-mini.dts 2019-09-10 11:51:15.700000008 +0200 -@@ -10,6 +10,7 @@ - - #include "meson-gxl-s905x.dtsi" - #include "meson-gx-p23x-q20x.dtsi" -+#include - - / { - compatible = "oranth,tx3-mini", "amlogic,s905w", "amlogic,meson-gxl"; -@@ -19,8 +20,49 @@ - device_type = "memory"; - reg = <0x0 0x0 0x0 0x40000000>; /* 1 GiB or 2 GiB */ - }; --}; - --&ir { -- linux,rc-map-name = "rc-tanix-tx3mini"; -+ thermal-zones { -+ cpu-thermal { -+ polling-delay-passive = <250>; /* milliseconds */ -+ polling-delay = <1000>; /* milliseconds */ -+ -+ thermal-sensors = <&scpi_sensors 0>; -+ -+ trips { -+ cpu_alert0: cpu-alert0 { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "active"; -+ }; -+ -+ cpu_alert1: cpu-alert1 { -+ temperature = <80000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ }; -+ -+ cooling-maps { -+ map0 { -+ trip = <&cpu_alert0>; -+ cooling-device = <&gpio_fan THERMAL_NO_LIMIT 1>; -+ }; -+ -+ map1 { -+ trip = <&cpu_alert1>; -+ cooling-device = <&gpio_fan THERMAL_NO_LIMIT 1>; -+ }; -+ }; -+ }; -+ }; -+ -+ gpio_fan: gpio-fan { -+ compatible = "gpio-fan"; -+ /* Dummy RPM values since fan is optional */ -+ gpio-fan,speed-map = <0 0 -+ 1 1 -+ 2 2 -+ 3 3>; -+ #cooling-cells = <2>; -+ }; - }; diff --git a/patch/kernel/archive/meson64-5.10/board_nanopi-k2_add_bluetooth.patch b/patch/kernel/archive/meson64-5.10/board_nanopi-k2_add_bluetooth.patch deleted file mode 100644 index 125d5a3945df..000000000000 --- a/patch/kernel/archive/meson64-5.10/board_nanopi-k2_add_bluetooth.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 34102b1e56e764f185c2852d7dae4832f541fc56 Mon Sep 17 00:00:00 2001 -From: tonymac32 -Date: Sun, 14 Nov 2021 18:43:37 -0500 -Subject: [PATCH] NanoPi K2 Enable Bluetooth - -Signed-off-by: tonymac32 ---- - .../arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index 19706c7d7..3b2a57544 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -409,9 +409,21 @@ &uart_AO { - - /* Bluetooth on AP6212 */ - &uart_A { -- status = "disabled"; -+ status = "okay"; - pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>; -+ uart-has-rtscts; - pinctrl-names = "default"; -+ -+ bluetooth { -+ compatible = "brcm,bcm43438-bt"; -+ clocks = <&wifi_32k>; -+ clock-names = "lpo"; -+ max-speed = <2000000>; -+ vbat-supply = <&vddio_ao3v3>; -+ vddio-supply = <&vddio_ao18>; -+ host-wakeup-gpios = <&gpio GPIOX_21 GPIO_ACTIVE_HIGH>; -+ shutdown-gpios = <&gpio GPIOX_20 GPIO_ACTIVE_HIGH>; -+ }; - }; - - /* 40-pin CON1 */ --- -Created with Armbian build tools https://github.com/armbian/build - diff --git a/patch/kernel/archive/meson64-5.10/driver-rc-drivers-should-produce-alternate-pulse-and-space-timing-events.patch b/patch/kernel/archive/meson64-5.10/driver-rc-drivers-should-produce-alternate-pulse-and-space-timing-events.patch deleted file mode 100644 index c341f3d7228d..000000000000 --- a/patch/kernel/archive/meson64-5.10/driver-rc-drivers-should-produce-alternate-pulse-and-space-timing-events.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff --git a/drivers/media/rc/meson-ir.c b/drivers/media/rc/meson-ir.c -index f449b35d25e7..9747426719b2 100644 ---- a/drivers/media/rc/meson-ir.c -+++ b/drivers/media/rc/meson-ir.c -@@ -97,7 +97,8 @@ static irqreturn_t meson_ir_irq(int irqno, void *dev_id) - status = readl_relaxed(ir->reg + IR_DEC_STATUS); - rawir.pulse = !!(status & STATUS_IR_DEC_IN); - -- ir_raw_event_store_with_timeout(ir->rc, &rawir); -+ if (ir_raw_event_store_with_filter(ir->rc, &rawir)) -+ ir_raw_event_handle(ir->rc); - - spin_unlock(&ir->lock); - diff --git a/patch/kernel/archive/meson64-5.10/dts-meson-add-watchdog-to-g12-common-dtsi.patch.txt.patch b/patch/kernel/archive/meson64-5.10/dts-meson-add-watchdog-to-g12-common-dtsi.patch.txt.patch deleted file mode 100644 index 8457d49eac13..000000000000 --- a/patch/kernel/archive/meson64-5.10/dts-meson-add-watchdog-to-g12-common-dtsi.patch.txt.patch +++ /dev/null @@ -1,30 +0,0 @@ -Subject: [PATCH] arm64: dts: meson: add watchdog to g12-common dtsi -Date: Fri, 30 Oct 2020 18:00:57 +0000 -Message-Id: <20201030180057.23886-1-christianshewitt@gmail.com> - -G12 vendor kernels show the watchdog on the same address as AXG -so add the node to meson-g12-common.dtsi. GX boards inherit the -same from meson-gx.dtsi. - -Signed-off-by: Christian Hewitt ---- - arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -index 1e83ec5b8c91..92afec3ffb2d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi -@@ -2179,6 +2179,12 @@ - amlogic,channel-interrupts = <64 65 66 67 68 69 70 71>; - }; - -+ watchdog: wdt@f0d0 { -+ compatible = "amlogic,meson-gxbb-wdt"; -+ reg = <0x0 0xf0d0 0x0 0x10>; -+ clocks = <&xtal>; -+ }; -+ - spicc0: spi@13000 { - compatible = "amlogic,meson-g12a-spicc"; - reg = <0x0 0x13000 0x0 0x44>; diff --git a/patch/kernel/archive/meson64-5.10/general-add-overlay-compilation-support.patch b/patch/kernel/archive/meson64-5.10/general-add-overlay-compilation-support.patch deleted file mode 100644 index 7dac0d6aaf7a..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-add-overlay-compilation-support.patch +++ /dev/null @@ -1,82 +0,0 @@ -diff --git a/arch/arm/boot/.gitignore b/arch/arm/boot/.gitignore -index 3c79f859..4e5c1d59 100644 ---- a/arch/arm/boot/.gitignore -+++ b/arch/arm/boot/.gitignore -@@ -3,3 +3,5 @@ zImage - xipImage - bootpImage - uImage -+*.dtb* -+*.scr -diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst -index 50d580d77..94bd15617 100644 ---- a/scripts/Makefile.dtbinst -+++ b/scripts/Makefile.dtbinst -@@ -18,9 +18,12 @@ include scripts/Kbuild.include - include $(src)/Makefile - - dtbs := $(addprefix $(dst)/, $(dtb-y) $(if $(CONFIG_OF_ALL_DTBS),$(dtb-))) -+dtbos := $(addprefix $(dst)/, $(dtbo-y)) -+scrs := $(addprefix $(dst)/, $(scr-y)) -+readmes := $(addprefix $(dst)/, $(dtbotxt-y)) - subdirs := $(addprefix $(obj)/, $(subdir-y) $(subdir-m)) - --__dtbs_install: $(dtbs) $(subdirs) -+__dtbs_install: $(dtbs) $(dtbos) $(scrs) $(readmes) $(subdirs) - @: - - quiet_cmd_dtb_install = INSTALL $@ -@@ -29,6 +32,15 @@ quiet_cmd_dtb_install = INSTALL $@ - $(dst)/%.dtb: $(obj)/%.dtb - $(call cmd,dtb_install) - -+$(dst)/%.dtbo: $(obj)/%.dtbo -+ $(call cmd,dtb_install) -+ -+$(dst)/%.scr: $(obj)/%.scr -+ $(call cmd,dtb_install) -+ -+$(dst)/README.meson-overlays: $(src)/README.meson-overlays -+ $(call cmd,dtb_install) -+ - PHONY += $(subdirs) - $(subdirs): - $(Q)$(MAKE) $(dtbinst)=$@ dst=$(patsubst $(obj)/%,$(dst)/%,$@) -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index 58c05e5d..2b95dda9 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -278,6 +278,9 @@ cmd_gzip = (cat $(filter-out FORCE,$^) | gzip -n -f -9 > $@) || \ - # --------------------------------------------------------------------------- - DTC ?= $(objtree)/scripts/dtc/dtc - -+# Overlay support -+DTC_FLAGS += -@ -Wno-unit_address_format -Wno-simple_bus_reg -+ - # Disable noisy checks by default - ifeq ($(KBUILD_ENABLE_EXTRA_GCC_CHECKS),) - DTC_FLAGS += -Wno-unit_address_vs_reg \ -@@ -324,6 +327,23 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \ - $(obj)/%.dtb: $(src)/%.dts FORCE - $(call if_changed_dep,dtc) - -+quiet_cmd_dtco = DTCO $@ -+cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ; \ -+ $(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \ -+ $(DTC) -O dtb -o $@ -b 0 \ -+ -i $(dir $<) $(DTC_FLAGS) \ -+ -d $(depfile).dtc.tmp $(dtc-tmp) ; \ -+ cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile) -+ -+$(obj)/%.dtbo: $(src)/%.dts FORCE -+ $(call if_changed_dep,dtco) -+ -+quiet_cmd_scr = MKIMAGE $@ -+cmd_scr = mkimage -C none -A $(ARCH) -T script -d $< $@ -+ -+$(obj)/%.scr: $(src)/%.scr-cmd FORCE -+ $(call if_changed,scr) -+ - dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp) - - # Bzip2 diff --git a/patch/kernel/archive/meson64-5.10/general-convert-to-devm_platform_ioremap_resource.patch b/patch/kernel/archive/meson64-5.10/general-convert-to-devm_platform_ioremap_resource.patch deleted file mode 100644 index 4cc1eb8d3767..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-convert-to-devm_platform_ioremap_resource.patch +++ /dev/null @@ -1,53 +0,0 @@ -Use devm_platform_ioremap_resource() to simplify code. - -Signed-off-by: Yangtao Li ---- - drivers/soc/amlogic/meson-canvas.c | 4 +--- - drivers/soc/amlogic/meson-clk-measure.c | 4 +--- - 2 files changed, 2 insertions(+), 6 deletions(-) - -diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c -index c655f5f92b12..561044063319 100644 ---- a/drivers/soc/amlogic/meson-canvas.c -+++ b/drivers/soc/amlogic/meson-canvas.c -@@ -166,7 +166,6 @@ EXPORT_SYMBOL_GPL(meson_canvas_free); - - static int meson_canvas_probe(struct platform_device *pdev) - { -- struct resource *res; - struct meson_canvas *canvas; - struct device *dev = &pdev->dev; - -@@ -174,8 +173,7 @@ static int meson_canvas_probe(struct platform_device *pdev) - if (!canvas) - return -ENOMEM; - -- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- canvas->reg_base = devm_ioremap_resource(dev, res); -+ canvas->reg_base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(canvas->reg_base)) - return PTR_ERR(canvas->reg_base); - -diff --git a/drivers/soc/amlogic/meson-clk-measure.c b/drivers/soc/amlogic/meson-clk-measure.c -index 0fa47d77577d..173baa53fce3 100644 ---- a/drivers/soc/amlogic/meson-clk-measure.c -+++ b/drivers/soc/amlogic/meson-clk-measure.c -@@ -605,7 +605,6 @@ static int meson_msr_probe(struct platform_device *pdev) - { - const struct meson_msr_id *match_data; - struct meson_msr *priv; -- struct resource *res; - struct dentry *root, *clks; - void __iomem *base; - int i; -@@ -623,8 +622,7 @@ static int meson_msr_probe(struct platform_device *pdev) - - memcpy(priv->msr_table, match_data, sizeof(priv->msr_table)); - -- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- base = devm_ioremap_resource(&pdev->dev, res); -+ base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(base)) { - dev_err(&pdev->dev, "io resource mapping failed\n"); - return PTR_ERR(base); - diff --git a/patch/kernel/archive/meson64-5.10/general-dwc2-partial-powerdown-fix.patch b/patch/kernel/archive/meson64-5.10/general-dwc2-partial-powerdown-fix.patch deleted file mode 100644 index ed57a28ac2a4..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-dwc2-partial-powerdown-fix.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c -index bf7052e03..93561a2df 100644 ---- a/drivers/usb/dwc2/params.c -+++ b/drivers/usb/dwc2/params.c -@@ -110,6 +110,7 @@ static void dwc2_set_amlogic_params(struct dwc2_hsotg *hsotg) - p->phy_type = DWC2_PHY_TYPE_PARAM_UTMI; - p->ahbcfg = GAHBCFG_HBSTLEN_INCR8 << - GAHBCFG_HBSTLEN_SHIFT; -+ p->power_down = false; - } - - static void dwc2_set_amcc_params(struct dwc2_hsotg *hsotg) diff --git a/patch/kernel/archive/meson64-5.10/general-kernel-odroidn2-current.patch b/patch/kernel/archive/meson64-5.10/general-kernel-odroidn2-current.patch deleted file mode 100644 index e5fa2a5a66e1..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-kernel-odroidn2-current.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff --git a/scripts/package/builddeb b/scripts/package/builddeb -index 3b80bd3f6..79bb8de6d 100755 ---- a/scripts/package/builddeb -+++ b/scripts/package/builddeb -@@ -285,6 +285,11 @@ if [ "$ARCH" != "um" ]; then - create_package "$dtb_packagename" "$dtb_dir" - fi - -+sed -e "s/exit 0//g" -i $tmpdir/DEBIAN/postinst -+cat >> $tmpdir/DEBIAN/postinst < /dev/null 2>&1 -+exit 0 -+EOT - create_package "$packagename" "$tmpdir" - - if [ -n "$BUILD_DEBUG" ] ; then diff --git a/patch/kernel/archive/meson64-5.10/general-meson-sm1_add_toacodec_node.patch b/patch/kernel/archive/meson64-5.10/general-meson-sm1_add_toacodec_node.patch deleted file mode 100644 index 1fd31e720151..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-meson-sm1_add_toacodec_node.patch +++ /dev/null @@ -1,39 +0,0 @@ -From ddbdaa4d596396e3aa0d60a0ab023d19822a3682 Mon Sep 17 00:00:00 2001 -From: Neil Armstrong -Date: Fri, 14 May 2021 16:32:53 +0200 -Subject: arm64: dts: meson-sm1: add toacodec node - -Add toacodec node for Amlogic SM1 SoCs. - -Signed-off-by: Neil Armstrong -Link: https://lore.kernel.org/r/20210514143255.3352774-2-narmstrong@baylibre.com ---- - arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -(limited to 'arch/arm64/boot/dts/amlogic') - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -index c309517abae32..3d8b1f4f2001b 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi -@@ -401,6 +401,16 @@ - status = "disabled"; - }; - -+ toacodec: audio-controller@740 { -+ compatible = "amlogic,sm1-toacodec", -+ "amlogic,g12a-toacodec"; -+ reg = <0x0 0x740 0x0 0x4>; -+ #sound-dai-cells = <1>; -+ sound-name-prefix = "TOACODEC"; -+ resets = <&clkc_audio AUD_RESET_TOACODEC>; -+ status = "disabled"; -+ }; -+ - tohdmitx: audio-controller@744 { - compatible = "amlogic,sm1-tohdmitx", - "amlogic,g12a-tohdmitx"; --- -cgit - diff --git a/patch/kernel/archive/meson64-5.10/general-meson64-i2cX-missing-pins.patch b/patch/kernel/archive/meson64-5.10/general-meson64-i2cX-missing-pins.patch deleted file mode 100644 index 0325e477da6b..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-meson64-i2cX-missing-pins.patch +++ /dev/null @@ -1,27 +0,0 @@ -From d5d2d8b9eb93eab85af12f1844975903a7c5a879 Mon Sep 17 00:00:00 2001 -From: Stefan Agner -Date: Thu, 29 Apr 2021 21:32:43 +0200 -Subject: [PATCH XXX] general-meson64-i2cX-missing-pins - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi -index 98cbba6..48ca119 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi -@@ -321,6 +322,8 @@ - - &i2c_A { - clocks = <&clkc CLKID_I2C>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c_a_pins>; - }; - - &i2c_AO { -@@ -329,6 +332,8 @@ - - &i2c_B { - clocks = <&clkc CLKID_I2C>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c_b_pins>; - }; - - &i2c_C { diff --git a/patch/kernel/archive/meson64-5.10/general-meson64-overlays.patch b/patch/kernel/archive/meson64-5.10/general-meson64-overlays.patch deleted file mode 100644 index c1f174480218..000000000000 --- a/patch/kernel/archive/meson64-5.10/general-meson64-overlays.patch +++ /dev/null @@ -1,262 +0,0 @@ -From 58c5526eb1798e61e4e76d37140cf10c8d325bc7 Mon Sep 17 00:00:00 2001 -From: Zhang Ning <832666+zhangn1985@users.noreply.github.com> -Date: Thu, 19 Sep 2019 16:20:31 +0800 -Subject: [PATCH] general: meson64 overlays - -Signed-off-by: Zhang Ning <832666+zhangn1985@users.noreply.github.com> ---- - arch/arm64/boot/dts/amlogic/Makefile | 2 ++ - arch/arm64/boot/dts/amlogic/overlay/Makefile | 20 ++++++++++++ - .../dts/amlogic/overlay/README.meson-overlays | 20 ++++++++++++ - .../dts/amlogic/overlay/meson-fixup.scr-cmd | 4 +++ - .../boot/dts/amlogic/overlay/meson-i2cA.dts | 17 ++++++++++ - .../boot/dts/amlogic/overlay/meson-i2cB.dts | 17 ++++++++++ - .../boot/dts/amlogic/overlay/meson-uartA.dts | 11 +++++++ - .../boot/dts/amlogic/overlay/meson-uartC.dts | 11 +++++++ - .../dts/amlogic/overlay/meson-w1-gpio.dts | 20 ++++++++++++ - .../dts/amlogic/overlay/meson-w1AB-gpio.dts | 32 +++++++++++++++++++ - scripts/Makefile.lib | 3 ++ - 12 files changed, 165 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/Makefile - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/README.meson-overlays - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-fixup.scr-cmd - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-i2cA.dts - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-i2cB.dts - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-uartA.dts - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-uartC.dts - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-w1-gpio.dts - create mode 100644 arch/arm64/boot/dts/amlogic/overlay/meson-w1AB-gpio.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index 07b861f..9d12b15 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -32,3 +32,5 @@ dtb-$(CONFIG_ARCH_MESON) += meson-gxm-q200.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-sei610.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-sm1-khadas-vim3l.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-a1-ad401.dtb -+ -+subdir-y := $(dts-dirs) overlay -diff --git a/arch/arm64/boot/dts/amlogic/overlay/Makefile b/arch/arm64/boot/dts/amlogic/overlay/Makefile -new file mode 100644 -index 000000000000..8630fd1a182d ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/Makefile -@@ -0,0 +1,20 @@ -+# SPDX-License-Identifier: GPL-2.0 -+dtbo-$(CONFIG_ARCH_MESON) += \ -+ meson-i2cA.dtbo \ -+ meson-i2cB.dtbo \ -+ meson-uartA.dtbo \ -+ meson-uartC.dtbo \ -+ meson-w1-gpio.dtbo \ -+ meson-w1AB-gpio.dtbo -+ -+scr-$(CONFIG_ARCH_MESON) += \ -+ meson-fixup.scr -+ -+dtbotxt-$(CONFIG_ARCH_MESON) += \ -+ README.meson-overlays -+ -+targets += $(dtbo-y) $(scr-y) $(dtbotxt-y) -+ -+always := $(dtbo-y) $(scr-y) $(dtbotxt-y) -+clean-files := *.dtbo *.scr -+ -diff --git a/arch/arm64/boot/dts/amlogic/overlay/README.meson-overlays b/arch/arm64/boot/dts/amlogic/overlay/README.meson-overlays -new file mode 100644 -index 000000000000..1b169a7a1525 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/README.meson-overlays -@@ -0,0 +1,20 @@ -+This document describes overlays provided in the kernel packages -+For generic Armbian overlays documentation please see -+https://docs.armbian.com/User-Guide_Allwinner_overlays/ -+ -+### Platform: -+ -+meson (Amlogic) -+ -+### Provided overlays: -+ -+- i2c8 -+ -+### Overlay details: -+ -+### i2c8 -+ -+Activates TWI/I2C bus 8 -+ -+I2C8 pins (SCL, SDA): GPIO1-C4, GPIO1-C5 -+ -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-fixup.scr-cmd b/arch/arm64/boot/dts/amlogic/overlay/meson-fixup.scr-cmd -new file mode 100644 -index 000000000000..d4c39e20a3a2 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-fixup.scr-cmd -@@ -0,0 +1,4 @@ -+# overlays fixup script -+# implements (or rather substitutes) overlay arguments functionality -+# using u-boot scripting, environment variables and "fdt" command -+ -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-i2cA.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-i2cA.dts -new file mode 100644 -index 000000000000..bfb72feb7e36 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-i2cA.dts -@@ -0,0 +1,17 @@ -+/dts-v1/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ fragment@0 { -+ target-path = "/aliases"; -+ __overlay__ { -+ i2cA = "/soc/bus@c1100000/i2c@8500"; -+ }; -+ }; -+ fragment@1 { -+ target-path = "/soc/bus@c1100000/i2c@8500"; -+ __overlay__ { -+ status = "okay"; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-i2cB.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-i2cB.dts -new file mode 100644 -index 000000000000..d75867bce99b ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-i2cB.dts -@@ -0,0 +1,17 @@ -+/dts-v1/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ fragment@0 { -+ target-path = "/aliases"; -+ __overlay__ { -+ i2cA = "/soc/bus@c1100000/i2c@87c0"; -+ }; -+ }; -+ fragment@1 { -+ target-path = "/soc/bus@c1100000/i2c@87c0"; -+ __overlay__ { -+ status = "okay"; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-uartA.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-uartA.dts -new file mode 100644 -index 000000000000..3aecd60aaf64 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-uartA.dts -@@ -0,0 +1,11 @@ -+/dts-v1/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ fragment@0 { -+ target-path = "/soc/bus@c1100000/serial@84c0"; -+ __overlay__ { -+ status = "okay"; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-uartC.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-uartC.dts -new file mode 100644 -index 000000000000..2b40ee4c02d3 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-uartC.dts -@@ -0,0 +1,11 @@ -+/dts-v1/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ fragment@0 { -+ target-path = "/soc/bus@c1100000/serial@8700"; -+ __overlay__ { -+ status = "okay"; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-w1-gpio.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-w1-gpio.dts -new file mode 100644 -index 000000000000..ac76a4f20ab7 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-w1-gpio.dts -@@ -0,0 +1,20 @@ -+// Definitions for w1-gpio module (without external pullup) -+/dts-v1/; -+/plugin/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ -+ fragment@0 { -+ target-path = "/"; -+ __overlay__ { -+ -+ w1: onewire@0 { -+ compatible = "w1-gpio"; -+ pinctrl-names = "default"; -+ gpios = <&gpio 91 6>; // GPIOY_16 -+ status = "okay"; -+ }; -+ }; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/overlay/meson-w1AB-gpio.dts b/arch/arm64/boot/dts/amlogic/overlay/meson-w1AB-gpio.dts -new file mode 100644 -index 000000000000..f6b0d7eff158 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/overlay/meson-w1AB-gpio.dts -@@ -0,0 +1,32 @@ -+// Definitions for w1-gpio module (without external pullup) -+/dts-v1/; -+/plugin/; -+ -+/ { -+ compatible = "amlogic,meson-gxbb"; -+ -+ fragment@0 { -+ target-path = "/"; -+ __overlay__ { -+ -+ w1a: onewire@0 { -+ compatible = "w1-gpio"; -+ pinctrl-names = "default"; -+ gpios = <&gpio 91 6>; // GPIOY_16 -+ status = "okay"; -+ }; -+ }; -+ }; -+ fragment@1 { -+ target-path = "/"; -+ __overlay__ { -+ -+ w1b: onewire@1 { -+ compatible = "w1-gpio"; -+ pinctrl-names = "default"; -+ gpios = <&gpio 90 6>; // GPIOY_15 -+ status = "okay"; -+ }; -+ }; -+ }; -+}; -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index 41c50f9461e5..387659d5b252 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -79,6 +79,9 @@ header-test-y += $(filter-out $(header-test-), \ - - extra-$(CONFIG_HEADER_TEST) += $(addsuffix .s, $(header-test-y) $(header-test-m)) - -+# Overlay targets -+extra-y += $(dtbo-y) $(scr-y) $(dtbotxt-y) -+ - # Add subdir path - - extra-y := $(addprefix $(obj)/,$(extra-y)) --- -2.20.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0013-C4-arm64-dts-add-uart_A-node.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0013-C4-arm64-dts-add-uart_A-node.patch deleted file mode 100644 index 62ca2d1c72c7..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0013-C4-arm64-dts-add-uart_A-node.patch +++ /dev/null @@ -1,41 +0,0 @@ -From ca89096189299862a7b2b3123d96fc8bfbe74ce3 Mon Sep 17 00:00:00 2001 -From: Hyeonki Hong -Date: Tue, 14 Apr 2020 14:15:25 +0900 -Subject: [PATCH 13/74] ODROID-C4: arm64/dts: add uart_A node - -Change-Id: Ib66a03da2fcf39fc459c20c9f98b1baca34dcf5b ---- - arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index 1b749bd340ce..e5d73598c131 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -14,8 +14,9 @@ / { - model = "Hardkernel ODROID-C4"; - - aliases { -- serial0 = &uart_AO; - ethernet0 = ðmac; -+ serial0 = &uart_AO; -+ serial1 = &uart_A; - }; - - chosen { -@@ -385,6 +386,12 @@ &sd_emmc_c { - vqmmc-supply = <&flash_1v8>; - }; - -+&uart_A { -+ status = "okay"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart_a_pins>; -+}; -+ - &uart_AO { - status = "okay"; - pinctrl-0 = <&uart_ao_a_pins>; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0015-COMMON-input-touchscreen-Add-D-WAV-Multitouch.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0015-COMMON-input-touchscreen-Add-D-WAV-Multitouch.patch deleted file mode 100644 index c28e485d2e57..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0015-COMMON-input-touchscreen-Add-D-WAV-Multitouch.patch +++ /dev/null @@ -1,637 +0,0 @@ -From 7466fab49314ed98f8b1512acf3e6ecb97c95315 Mon Sep 17 00:00:00 2001 -From: Hyeonki Hong -Date: Thu, 5 Mar 2020 19:01:43 +0900 -Subject: [PATCH 15/74] ODROID-COMMON: input/touchscreen: Add D-WAV Multitouch - driver. - -Change-Id: Ia1c8c29d3f69c6ba5d630279c4cc98119b68ab71 ---- - drivers/hid/hid-ids.h | 6 + - drivers/hid/hid-quirks.c | 3 + - drivers/input/touchscreen/Kconfig | 10 + - drivers/input/touchscreen/Makefile | 1 + - drivers/input/touchscreen/dwav-usb-mt.c | 554 ++++++++++++++++++++++++ - 5 files changed, 574 insertions(+) - create mode 100644 drivers/input/touchscreen/dwav-usb-mt.c - -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 6f370e020feb..5775322fb5d4 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -1294,4 +1294,10 @@ - #define USB_VENDOR_ID_SIGNOTEC 0x2133 - #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018 - -+#define USB_DEVICE_ID_DWAV_MULTITOUCH 0x0005 -+ -+#define USB_VENDOR_ID_ODROID 0x16b4 -+#define USB_DEVICE_ID_VU5 0x0704 -+#define USB_DEVICE_ID_VU7PLUS 0x0705 -+ - #endif -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index 934fc0a798d4..9cf96f48238e 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -845,6 +845,9 @@ static const struct hid_device_id hid_ignore_list[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, - #endif - { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, -+ -+ { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU5) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU7PLUS) }, - { } - }; - -diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig -index 35c867b2d9a7..01d680a5736b 100644 ---- a/drivers/input/touchscreen/Kconfig -+++ b/drivers/input/touchscreen/Kconfig -@@ -1322,4 +1322,14 @@ config TOUCHSCREEN_IQS5XX - To compile this driver as a module, choose M here: the - module will be called iqs5xx. - -+config TOUCHSCREEN_DWAV_USB_MT -+ tristate "D-WAV Scientific USB MultiTouch" -+ depends on USB_ARCH_HAS_HCD -+ select USB -+ help -+ Say Y here if you have a D-WAV Scientific USB(HID) based MultiTouch -+ controller. -+ -+ module will be called dwav-usb-mt. -+ - endif -diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile -index 30d1e1b42492..4585f02ad833 100644 ---- a/drivers/input/touchscreen/Makefile -+++ b/drivers/input/touchscreen/Makefile -@@ -111,3 +111,4 @@ obj-$(CONFIG_TOUCHSCREEN_COLIBRI_VF50) += colibri-vf50-ts.o - obj-$(CONFIG_TOUCHSCREEN_RASPBERRYPI_FW) += raspberrypi-ts.o - obj-$(CONFIG_TOUCHSCREEN_IQS5XX) += iqs5xx.o - obj-$(CONFIG_TOUCHSCREEN_ZINITIX) += zinitix.o -+obj-$(CONFIG_TOUCHSCREEN_DWAV_USB_MT) += dwav-usb-mt.o -diff --git a/drivers/input/touchscreen/dwav-usb-mt.c b/drivers/input/touchscreen/dwav-usb-mt.c -new file mode 100644 -index 000000000000..7ec8b6dd15fd ---- /dev/null -+++ b/drivers/input/touchscreen/dwav-usb-mt.c -@@ -0,0 +1,554 @@ -+// SPDX-License-Identifier: GPL-2.0+ -+/* -+ * D-WAV Scientific USB(HID) MultiTouch Screen Driver(Based on usbtouchscreen.c) -+ * -+ * Copyright (C) Hardkernel, 2015 -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+#define USB_VENDOR_ID_DWAV 0x0eef /* 800 x 480, 7" DWAV touch */ -+#define USB_DEVICE_ID_VU7 0x0005 -+ -+#define USB_VENDOR_ID_ODROID 0x16b4 -+#define USB_DEVICE_ID_VU5 0x0704 -+#define USB_DEVICE_ID_VU7PLUS 0x0705 -+ -+enum { -+ ODROID_VU7 = 0, /* 800 x 480, 7" Touch */ -+ ODROID_VU5, /* 800 x 480, 5" Touch */ -+ ODROID_VU7PLUS, /* 1024 x 600, 7" Touch */ -+}; -+ -+struct usbtouch_device_info { -+ char name[64]; -+ int max_x; -+ int max_y; -+ int max_press; -+ int max_finger; -+}; -+ -+const struct usbtouch_device_info DEV_INFO[] = { -+ [ODROID_VU7] = { -+ .name = "ODROID VU7 MultiTouch(800x480)", -+ .max_x = 800, -+ .max_y = 480, -+ .max_press = 255, -+ .max_finger = 5, -+ }, -+ [ODROID_VU5] = { -+ .name = "ODROID VU5 MultiTouch(800x480)", -+ .max_x = 800, -+ .max_y = 480, -+ .max_press = 255, -+ .max_finger = 5, -+ }, -+ [ODROID_VU7PLUS] = { -+ .name = "ODROID VU7 Plus MultiTouch(1024x600)", -+ .max_x = 1024, -+ .max_y = 600, -+ .max_press = 255, -+ .max_finger = 5, -+ }, -+}; -+ -+static const struct usb_device_id dwav_usb_mt_devices[] = { -+ {USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_VU7), -+ .driver_info = ODROID_VU7}, -+ {USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU5), -+ .driver_info = ODROID_VU5}, -+ {USB_DEVICE(USB_VENDOR_ID_ODROID, USB_DEVICE_ID_VU7PLUS), -+ .driver_info = ODROID_VU7PLUS}, -+ {} -+}; -+ -+struct dwav_raw { /* Total 25 bytes */ -+ unsigned char header; /* frame header 0xAA*/ -+ unsigned char press; -+ /* Touch flag (1:valid touch data, 0:touch finished) */ -+ unsigned short x1; /* 1st x */ -+ unsigned short y1; /* 1st y */ -+ unsigned char end; -+ /* 1st touch finish flags 0xBB, RPI only uses the first 7 bytes */ -+ unsigned char ids; /* touch ID(bit field) */ -+ unsigned short y2; -+ unsigned short x2; -+ unsigned short y3; -+ unsigned short x3; -+ unsigned short y4; -+ unsigned short x4; -+ unsigned short y5; -+ unsigned short x5; -+ unsigned char tail; /* frame end 0xCC */ -+}; -+ -+#define TS_EVENT_UNKNOWN 0x00 -+#define TS_EVENT_PRESS 0x01 -+#define TS_EVENT_RELEASE 0x02 -+ -+struct finger_t { -+ unsigned int status; /* ts event type */ -+ unsigned int x; /* ts data x */ -+ unsigned int y; /* ts data y */ -+} __packed; -+ -+struct dwav_usb_mt { -+ char name[128], phys[64]; -+ -+ int dev_id; -+ /* for URB Data DMA */ -+ dma_addr_t data_dma; -+ unsigned char *data; -+ int data_size; -+ -+ struct urb *irq; -+ struct usb_interface *interface; -+ struct input_dev *input; -+ -+ struct finger_t *finger; -+}; -+ -+static void dwav_usb_mt_report(struct dwav_usb_mt *dwav_usb_mt) -+{ -+ int id, max_x, max_y, max_press, max_finger; -+ -+ max_x = DEV_INFO[dwav_usb_mt->dev_id].max_x; -+ max_y = DEV_INFO[dwav_usb_mt->dev_id].max_y; -+ max_press = DEV_INFO[dwav_usb_mt->dev_id].max_press; -+ max_finger = DEV_INFO[dwav_usb_mt->dev_id].max_finger; -+ -+ for (id = 0; id < max_finger; id++) { -+ -+ if (dwav_usb_mt->finger[id].status == TS_EVENT_UNKNOWN) -+ continue; -+ -+ if (dwav_usb_mt->finger[id].x >= max_x || -+ dwav_usb_mt->finger[id].y >= max_y) -+ continue; -+ -+ input_mt_slot(dwav_usb_mt->input, id); -+ -+ if (dwav_usb_mt->finger[id].status != TS_EVENT_RELEASE) { -+ input_mt_report_slot_state(dwav_usb_mt->input, -+ MT_TOOL_FINGER, true); -+ input_report_abs(dwav_usb_mt->input, -+ ABS_MT_POSITION_X, -+ dwav_usb_mt->finger[id].x); -+ input_report_abs(dwav_usb_mt->input, -+ ABS_MT_POSITION_Y, -+ dwav_usb_mt->finger[id].y); -+ input_report_abs(dwav_usb_mt->input, -+ ABS_MT_PRESSURE, -+ max_press); -+ } else { -+ input_mt_report_slot_state(dwav_usb_mt->input, -+ MT_TOOL_FINGER, false); -+ dwav_usb_mt->finger[id].status = TS_EVENT_UNKNOWN; -+ } -+ input_mt_report_pointer_emulation(dwav_usb_mt->input, true); -+ input_sync(dwav_usb_mt->input); -+ } -+} -+ -+static void dwav_usb_mt_process(struct dwav_usb_mt *dwav_usb_mt, -+ unsigned char *pkt, int len) -+{ -+ struct dwav_raw *dwav_raw = (struct dwav_raw *)pkt; -+ unsigned char bit_mask, cnt; -+ -+ for (cnt = 0, bit_mask = 0x01; -+ cnt < DEV_INFO[dwav_usb_mt->dev_id].max_finger; -+ cnt++, bit_mask <<= 1) { -+ if ((dwav_raw->ids & bit_mask) && dwav_raw->press) { -+ dwav_usb_mt->finger[cnt].status = TS_EVENT_PRESS; -+ switch (cnt) { -+ case 0: -+ dwav_usb_mt->finger[cnt].x -+ = cpu_to_be16(dwav_raw->x1); -+ dwav_usb_mt->finger[cnt].y -+ = cpu_to_be16(dwav_raw->y1); -+ break; -+ case 1: -+ dwav_usb_mt->finger[cnt].x -+ = cpu_to_be16(dwav_raw->x2); -+ dwav_usb_mt->finger[cnt].y -+ = cpu_to_be16(dwav_raw->y2); -+ break; -+ case 2: -+ dwav_usb_mt->finger[cnt].x -+ = cpu_to_be16(dwav_raw->x3); -+ dwav_usb_mt->finger[cnt].y -+ = cpu_to_be16(dwav_raw->y3); -+ break; -+ case 3: -+ dwav_usb_mt->finger[cnt].x -+ = cpu_to_be16(dwav_raw->x4); -+ dwav_usb_mt->finger[cnt].y -+ = cpu_to_be16(dwav_raw->y4); -+ break; -+ case 4: -+ dwav_usb_mt->finger[cnt].x -+ = cpu_to_be16(dwav_raw->x5); -+ dwav_usb_mt->finger[cnt].y -+ = cpu_to_be16(dwav_raw->y5); -+ break; -+ default: -+ break; -+ } -+ } else { -+ if (dwav_usb_mt->finger[cnt].status == TS_EVENT_PRESS) -+ dwav_usb_mt->finger[cnt].status -+ = TS_EVENT_RELEASE; -+ else -+ dwav_usb_mt->finger[cnt].status -+ = TS_EVENT_UNKNOWN; -+ } -+ } -+ dwav_usb_mt_report(dwav_usb_mt); -+} -+ -+static void dwav_usb_mt_irq(struct urb *urb) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = urb->context; -+ struct device *dev = &dwav_usb_mt->interface->dev; -+ int retval; -+ -+ switch (urb->status) { -+ case 0: -+ /* success */ -+ break; -+ case -ETIME: -+ /* this urb is timing out */ -+ dev_dbg(dev, "%s - urb timed out - was the device unplugged?\n", -+ __func__); -+ return; -+ case -ECONNRESET: -+ case -ENOENT: -+ case -ESHUTDOWN: -+ case -EPIPE: -+ /* this urb is terminated, clean up */ -+ dev_dbg(dev, "%s - urb shutting down with status: %d\n", -+ __func__, urb->status); -+ return; -+ default: -+ dev_dbg(dev, "%s - nonzero urb status received: %d\n", -+ __func__, urb->status); -+ goto exit; -+ } -+ -+ dwav_usb_mt_process(dwav_usb_mt, dwav_usb_mt->data, urb->actual_length); -+ -+exit: -+ usb_mark_last_busy(interface_to_usbdev(dwav_usb_mt->interface)); -+ retval = usb_submit_urb(urb, GFP_ATOMIC); -+ if (retval) { -+ dev_err(dev, "%s - usb_submit_urb failed with result: %d\n", -+ __func__, retval); -+ } -+} -+ -+static int dwav_usb_mt_open(struct input_dev *input) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = input_get_drvdata(input); -+ int r; -+ -+ dwav_usb_mt->irq->dev = interface_to_usbdev(dwav_usb_mt->interface); -+ -+ r = usb_autopm_get_interface(dwav_usb_mt->interface) ? -EIO : 0; -+ if (r < 0) -+ goto out; -+ -+ if (usb_submit_urb(dwav_usb_mt->irq, GFP_KERNEL)) { -+ r = -EIO; -+ goto out_put; -+ } -+ -+ dwav_usb_mt->interface->needs_remote_wakeup = 1; -+out_put: -+ usb_autopm_put_interface(dwav_usb_mt->interface); -+out: -+ return r; -+} -+ -+static void dwav_usb_mt_close(struct input_dev *input) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = input_get_drvdata(input); -+ int r; -+ -+ usb_kill_urb(dwav_usb_mt->irq); -+ -+ r = usb_autopm_get_interface(dwav_usb_mt->interface); -+ -+ dwav_usb_mt->interface->needs_remote_wakeup = 0; -+ if (!r) -+ usb_autopm_put_interface(dwav_usb_mt->interface); -+} -+ -+static int dwav_usb_mt_suspend(struct usb_interface *intf, pm_message_t message) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = usb_get_intfdata(intf); -+ -+ usb_kill_urb(dwav_usb_mt->irq); -+ -+ return 0; -+} -+ -+static int dwav_usb_mt_resume(struct usb_interface *intf) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = usb_get_intfdata(intf); -+ struct input_dev *input = dwav_usb_mt->input; -+ int result = 0; -+ -+ mutex_lock(&input->mutex); -+ if (input->users) -+ result = usb_submit_urb(dwav_usb_mt->irq, GFP_NOIO); -+ mutex_unlock(&input->mutex); -+ -+ return result; -+} -+ -+static int dwav_usb_mt_reset_resume(struct usb_interface *intf) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = usb_get_intfdata(intf); -+ struct input_dev *input = dwav_usb_mt->input; -+ int err = 0; -+ -+ /* restart IO if needed */ -+ mutex_lock(&input->mutex); -+ if (input->users) -+ err = usb_submit_urb(dwav_usb_mt->irq, GFP_NOIO); -+ mutex_unlock(&input->mutex); -+ -+ return err; -+} -+ -+static void dwav_usb_mt_free_buffers(struct usb_device *udev, -+ struct dwav_usb_mt *dwav_usb_mt) -+{ -+ usb_free_coherent(udev, dwav_usb_mt->data_size, -+ dwav_usb_mt->data, dwav_usb_mt->data_dma); -+} -+ -+static struct usb_endpoint_descriptor *dwav_usb_mt_get_input_endpoint( -+ struct usb_host_interface *interface) -+{ -+ int i; -+ -+ for (i = 0; i < interface->desc.bNumEndpoints; i++) { -+ if (usb_endpoint_dir_in(&interface->endpoint[i].desc)) -+ return &interface->endpoint[i].desc; -+ } -+ -+ return NULL; -+} -+ -+static int dwav_usb_mt_init(struct dwav_usb_mt *dwav_usb_mt, void *dev) -+{ -+ int err; -+ struct input_dev *input_dev = (struct input_dev *)dev; -+ -+ input_dev->name = dwav_usb_mt->name; -+ input_dev->phys = dwav_usb_mt->phys; -+ -+ input_set_drvdata(input_dev, dwav_usb_mt); -+ -+ input_dev->open = dwav_usb_mt_open; -+ input_dev->close = dwav_usb_mt_close; -+ -+ input_dev->id.bustype = BUS_USB; -+ -+ /* single touch */ -+ input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS); -+ input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH); -+ -+ input_set_abs_params(input_dev, ABS_X, 0, -+ DEV_INFO[dwav_usb_mt->dev_id].max_x, 0, 0); -+ input_set_abs_params(input_dev, ABS_Y, 0, -+ DEV_INFO[dwav_usb_mt->dev_id].max_y, 0, 0); -+ -+ /* multi touch */ -+ input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, -+ DEV_INFO[dwav_usb_mt->dev_id].max_x, 0, 0); -+ input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, -+ DEV_INFO[dwav_usb_mt->dev_id].max_y, 0, 0); -+ input_mt_init_slots(input_dev, -+ DEV_INFO[dwav_usb_mt->dev_id].max_finger, 0); -+ -+ err = input_register_device(input_dev); -+ if (err) { -+ pr_err("%s - input_register_device failed, err: %d\n", -+ __func__, err); -+ return err; -+ } -+ -+ dwav_usb_mt->input = input_dev; -+ -+ return 0; -+} -+ -+static int dwav_usb_mt_probe(struct usb_interface *intf, -+ const struct usb_device_id *id) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = NULL; -+ struct input_dev *input_dev = NULL; -+ struct usb_endpoint_descriptor *endpoint; -+ struct usb_device *udev = interface_to_usbdev(intf); -+ -+ int err = 0; -+ -+ endpoint = dwav_usb_mt_get_input_endpoint(intf->cur_altsetting); -+ if (!endpoint) -+ return -ENXIO; -+ -+ dwav_usb_mt = kzalloc(sizeof(struct dwav_usb_mt), GFP_KERNEL); -+ if (!dwav_usb_mt) -+ return -ENOMEM; -+ -+ dwav_usb_mt->dev_id = id->driver_info; -+ -+ dwav_usb_mt->finger = kzalloc(sizeof(struct finger_t) * -+ DEV_INFO[dwav_usb_mt->dev_id].max_finger, -+ GFP_KERNEL); -+ -+ if (!dwav_usb_mt->finger) -+ goto err_free_mem; -+ -+ input_dev = input_allocate_device(); -+ if (!input_dev) -+ goto err_free_mem; -+ -+ dwav_usb_mt->data_size = sizeof(struct dwav_raw); -+ dwav_usb_mt->data = usb_alloc_coherent(udev, dwav_usb_mt->data_size, -+ GFP_KERNEL, &dwav_usb_mt->data_dma); -+ if (!dwav_usb_mt->data) -+ goto err_free_mem; -+ -+ dwav_usb_mt->irq = usb_alloc_urb(0, GFP_KERNEL); -+ if (!dwav_usb_mt->irq) { -+ dev_dbg(&intf->dev, -+ "%s - usb_alloc_urb failed: usbtouch->irq\n", -+ __func__); -+ goto err_free_buffers; -+ } -+ -+ if (usb_endpoint_type(endpoint) == USB_ENDPOINT_XFER_INT) { -+ usb_fill_int_urb(dwav_usb_mt->irq, udev, -+ usb_rcvintpipe(udev, endpoint->bEndpointAddress), -+ dwav_usb_mt->data, dwav_usb_mt->data_size, -+ dwav_usb_mt_irq, dwav_usb_mt, endpoint->bInterval); -+ } else { -+ usb_fill_bulk_urb(dwav_usb_mt->irq, udev, -+ usb_rcvbulkpipe(udev, endpoint->bEndpointAddress), -+ dwav_usb_mt->data, dwav_usb_mt->data_size, -+ dwav_usb_mt_irq, dwav_usb_mt); -+ } -+ -+ dwav_usb_mt->irq->dev = udev; -+ dwav_usb_mt->irq->transfer_dma = dwav_usb_mt->data_dma; -+ dwav_usb_mt->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; -+ -+ dwav_usb_mt->interface = intf; -+ -+ if (udev->manufacturer) -+ strlcpy(dwav_usb_mt->name, -+ udev->manufacturer, sizeof(dwav_usb_mt->name)); -+ -+ if (udev->product) { -+ if (udev->manufacturer) -+ strlcat(dwav_usb_mt->name, -+ " ", sizeof(dwav_usb_mt->name)); -+ -+ strlcat(dwav_usb_mt->name, -+ udev->product, sizeof(dwav_usb_mt->name)); -+ } -+ -+ if (!strlen(dwav_usb_mt->name)) { -+ snprintf(dwav_usb_mt->name, sizeof(dwav_usb_mt->name), -+ "D-WAV Scientific MultiTouch %04x:%04x", -+ le16_to_cpu(udev->descriptor.idVendor), -+ le16_to_cpu(udev->descriptor.idProduct)); -+ } -+ -+ usb_make_path(udev, dwav_usb_mt->phys, sizeof(dwav_usb_mt->phys)); -+ strlcat(dwav_usb_mt->phys, "/input0", sizeof(dwav_usb_mt->phys)); -+ -+ usb_to_input_id(udev, &input_dev->id); -+ -+ input_dev->dev.parent = &intf->dev; -+ -+ err = dwav_usb_mt_init(dwav_usb_mt, (void *)input_dev); -+ if (err) -+ goto err_free_urb; -+ -+ usb_set_intfdata(intf, dwav_usb_mt); -+ -+ dev_info(&intf->dev, "%s\n", DEV_INFO[dwav_usb_mt->dev_id].name); -+ -+ return 0; -+ -+err_free_urb: -+ usb_free_urb(dwav_usb_mt->irq); -+ -+err_free_buffers: -+ dwav_usb_mt_free_buffers(udev, dwav_usb_mt); -+ -+err_free_mem: -+ if (input_dev) -+ input_free_device(input_dev); -+ kfree(dwav_usb_mt); -+ -+ return err; -+} -+ -+static void dwav_usb_mt_disconnect(struct usb_interface *intf) -+{ -+ struct dwav_usb_mt *dwav_usb_mt = usb_get_intfdata(intf); -+ -+ if (!dwav_usb_mt) -+ return; -+ -+ dev_dbg(&intf->dev, -+ "%s - dwav_usb_mt is initialized, cleaning up\n", -+ __func__); -+ -+ usb_set_intfdata(intf, NULL); -+ -+ /* this will stop IO via close */ -+ input_unregister_device(dwav_usb_mt->input); -+ -+ usb_free_urb(dwav_usb_mt->irq); -+ -+ dwav_usb_mt_free_buffers(interface_to_usbdev(intf), dwav_usb_mt); -+ -+ kfree(dwav_usb_mt); -+} -+ -+MODULE_DEVICE_TABLE(usb, dwav_usb_mt_devices); -+ -+static struct usb_driver dwav_usb_mt_driver = { -+ .name = "dwav_usb_mt", -+ .probe = dwav_usb_mt_probe, -+ .disconnect = dwav_usb_mt_disconnect, -+ .suspend = dwav_usb_mt_suspend, -+ .resume = dwav_usb_mt_resume, -+ .reset_resume = dwav_usb_mt_reset_resume, -+ .id_table = dwav_usb_mt_devices, -+ .supports_autosuspend = 1, -+}; -+ -+module_usb_driver(dwav_usb_mt_driver); -+ -+MODULE_AUTHOR("Hardkernel Co.,Ltd"); -+MODULE_DESCRIPTION("D-WAV USB(HID) MultiTouch Driver"); -+MODULE_LICENSE("GPL"); -+ -+MODULE_ALIAS("dwav_usb_mt"); -\ No newline at end of file --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0017-C4-arm64-dts-meson-sm1-odroid-c4-add-sound-ca.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0017-C4-arm64-dts-meson-sm1-odroid-c4-add-sound-ca.patch deleted file mode 100644 index 65f87c66684a..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0017-C4-arm64-dts-meson-sm1-odroid-c4-add-sound-ca.patch +++ /dev/null @@ -1,146 +0,0 @@ -From 2ede00b489f3afa3bec5e587f53ef8dba2a69dfd Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Thu, 30 Apr 2020 23:51:12 +0900 -Subject: [PATCH 17/74] ODROID-C4: arm64: dts: meson-sm1-odroid-c4: add sound - card - -Add the sound card on Hardkernel ODROID-C4 and enable HDMI output with -the interface TDM-B. - -Tested commands: - amixer sset 'FRDDR_A SINK 1 SEL' 'OUT 1' - amixer sset 'FRDDR_A SRC 1 EN' 'on' - amixer sset 'TDMOUT_B SRC SEL' 'IN 0' - amixer sset 'TOHDMITX I2S SRC' 'I2S B' - amixer sset 'TOHDMITX' 'on' - alsactl store - -Change-Id: I7aa2d310fb97af7aa77fc54e3e56a09ee5b30b40 -Signed-off-by: Dongjin Kim ---- - .../boot/dts/amlogic/meson-sm1-odroid-c4.dts | 88 +++++++++++++++++++ - 1 file changed, 88 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index 807f88cd5280..4dbdf049c87c 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -7,6 +7,7 @@ - - #include "meson-sm1.dtsi" - #include -+#include - #include - - / { -@@ -187,6 +188,69 @@ hdmi_connector_in: endpoint { - }; - }; - }; -+ -+ sound { -+ compatible = "amlogic,axg-sound-card"; -+ model = "SM1-ODROID-C4"; -+ audio-aux-devs = <&tdmout_b>; -+ audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1", -+ "TDMOUT_B IN 1", "FRDDR_B OUT 1", -+ "TDMOUT_B IN 2", "FRDDR_C OUT 1", -+ "TDM_B Playback", "TDMOUT_B OUT"; -+ -+ assigned-clocks = <&clkc CLKID_MPLL2>, -+ <&clkc CLKID_MPLL0>, -+ <&clkc CLKID_MPLL1>; -+ assigned-clock-parents = <0>, <0>, <0>; -+ assigned-clock-rates = <294912000>, -+ <270950400>, -+ <393216000>; -+ status = "okay"; -+ -+ dai-link-0 { -+ sound-dai = <&frddr_a>; -+ }; -+ -+ dai-link-1 { -+ sound-dai = <&frddr_b>; -+ }; -+ -+ dai-link-2 { -+ sound-dai = <&frddr_c>; -+ }; -+ -+ /* 8ch hdmi interface */ -+ dai-link-3 { -+ sound-dai = <&tdmif_b>; -+ dai-format = "i2s"; -+ dai-tdm-slot-tx-mask-0 = <1 1>; -+ dai-tdm-slot-tx-mask-1 = <1 1>; -+ dai-tdm-slot-tx-mask-2 = <1 1>; -+ dai-tdm-slot-tx-mask-3 = <1 1>; -+ mclk-fs = <256>; -+ -+ codec { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_IN_B>; -+ }; -+ }; -+ -+ /* hdmi glue */ -+ dai-link-4 { -+ sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>; -+ -+ codec { -+ sound-dai = <&hdmi_tx>; -+ }; -+ }; -+ }; -+}; -+ -+&arb { -+ status = "okay"; -+}; -+ -+&clkc_audio { -+ status = "okay"; - }; - - &cpu0 { -@@ -242,6 +306,18 @@ ðmac { - amlogic,tx-delay-ns = <2>; - }; - -+&frddr_a { -+ status = "okay"; -+}; -+ -+&frddr_b { -+ status = "okay"; -+}; -+ -+&frddr_c { -+ status = "okay"; -+}; -+ - &gpio { - gpio-line-names = - /* GPIOZ */ -@@ -390,6 +466,18 @@ &sd_emmc_c { - vqmmc-supply = <&flash_1v8>; - }; - -+&tdmif_b { -+ status = "okay"; -+}; -+ -+&tdmout_b { -+ status = "okay"; -+}; -+ -+&tohdmitx { -+ status = "okay"; -+}; -+ - &uart_A { - status = "okay"; - pinctrl-names = "default"; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0019-C4-arm64-dts-add-spicc0-node.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0019-C4-arm64-dts-add-spicc0-node.patch deleted file mode 100644 index 1f5630fedd3f..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0019-C4-arm64-dts-add-spicc0-node.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 6ed323304dfb43ad2741f4e01a79299203c1d21d Mon Sep 17 00:00:00 2001 -From: Hyeonki Hong -Date: Tue, 14 Apr 2020 14:11:30 +0900 -Subject: [PATCH 19/74] ODROID-C4: arm64/dts: add spicc0 node - -Change-Id: I6ccc3714fce677b1eb104c10f657739320f3772f -(cherry picked from commit e50729e07786d6ee611e0bcfafbfd7b352c9e9ac) ---- - .../boot/dts/amlogic/meson-sm1-odroid-c4.dts | 28 +++++++++++++++++++ - 1 file changed, 28 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index 4dbdf049c87c..8d3523c163c5 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -18,6 +18,7 @@ aliases { - ethernet0 = ðmac; - serial0 = &uart_AO; - serial1 = &uart_A; -+ spi0 = &spicc0; - }; - - chosen { -@@ -466,6 +467,33 @@ &sd_emmc_c { - vqmmc-supply = <&flash_1v8>; - }; - -+&spicc0 { -+ status = "okay"; -+ -+ /* -+ * 40 Pin Header : MOSI(GPIOX.8->19 Pin), -+ * MISO(GPIOX.9->21 Pin), -+ * SPI0_CLK(GPIOX.11->23 Pin) -+ * SPI_CS0(GPIOX.10->24 Pin) -+ * SPI_CS1(GPIOH.6->26 Pin) -+ */ -+ pinctrl-names = "default","gpio_periphs"; -+ pinctrl-0 = <&spicc0_x_pins>; -+ pinctrl-1 = <&spicc0_ss0_x_pins>; -+ num_chipselect = <1>; -+ -+ cs-gpios = <&gpio GPIOX_10 GPIO_ACTIVE_LOW>; -+ -+ spidev@0 { -+ status = "okay"; -+ -+ compatible = "linux,spidev"; -+ /* spi default max clock 100Mhz */ -+ spi-max-frequency = <100000000>; -+ reg = <0>; -+ }; -+}; -+ - &tdmif_b { - status = "okay"; - }; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0020-N2-C4-arm64-dts-add-CPU-thermal-cooling-map.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0020-N2-C4-arm64-dts-add-CPU-thermal-cooling-map.patch deleted file mode 100644 index 06fce6ece90e..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0020-N2-C4-arm64-dts-add-CPU-thermal-cooling-map.patch +++ /dev/null @@ -1,146 +0,0 @@ -From ce866a9b68a21ecde72401bb1ccc82be5981d87f Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Wed, 6 May 2020 15:33:45 +0900 -Subject: [PATCH 20/74] ODROID-N2/C4: arm64/dts: add CPU thermal cooling map - -Change-Id: Idddee81e210daef5afb8ca059e8dced40c770cc8 -Signed-off-by: Dongjin Kim ---- - .../boot/dts/amlogic/meson-g12b-odroid-n2.dts | 30 +++++++++++++++++++ - .../boot/dts/amlogic/meson-sm1-odroid-c4.dts | 23 ++++++++++++++ - 2 files changed, 53 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -index 047e076df661..232f86c6c37d 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi -@@ -292,6 +292,7 @@ &cpu0 { - operating-points-v2 = <&cpu_opp_table_0>; - clocks = <&clkc CLKID_CPU_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu1 { -@@ -299,6 +300,7 @@ &cpu1 { - operating-points-v2 = <&cpu_opp_table_0>; - clocks = <&clkc CLKID_CPU_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu100 { -@@ -306,6 +308,7 @@ &cpu100 { - operating-points-v2 = <&cpub_opp_table_1>; - clocks = <&clkc CLKID_CPUB_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu101 { -@@ -313,6 +316,7 @@ &cpu101 { - operating-points-v2 = <&cpub_opp_table_1>; - clocks = <&clkc CLKID_CPUB_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu102 { -@@ -320,6 +324,7 @@ &cpu102 { - operating-points-v2 = <&cpub_opp_table_1>; - clocks = <&clkc CLKID_CPUB_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu103 { -@@ -327,6 +332,31 @@ &cpu103 { - operating-points-v2 = <&cpub_opp_table_1>; - clocks = <&clkc CLKID_CPUB_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; -+}; -+ -+&cpu_thermal { -+ trips { -+ cpu_passive: cpu-passive { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ }; -+ cooling-maps { -+ cpufreq_map0 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ cpufreq_map1 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu100 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu101 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu102 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu103 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; - }; - - &ext_mdio { -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index 8d3523c163c5..831053aa6dff 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -259,6 +259,7 @@ &cpu0 { - operating-points-v2 = <&cpu_opp_table>; - clocks = <&clkc CLKID_CPU_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu1 { -@@ -266,6 +267,7 @@ &cpu1 { - operating-points-v2 = <&cpu_opp_table>; - clocks = <&clkc CLKID_CPU1_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu2 { -@@ -273,6 +275,7 @@ &cpu2 { - operating-points-v2 = <&cpu_opp_table>; - clocks = <&clkc CLKID_CPU2_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; - }; - - &cpu3 { -@@ -280,6 +283,26 @@ &cpu3 { - operating-points-v2 = <&cpu_opp_table>; - clocks = <&clkc CLKID_CPU3_CLK>; - clock-latency = <50000>; -+ #cooling-cells = <2>; -+}; -+ -+&cpu_thermal { -+ trips { -+ cpu_passive: cpu-passive { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ }; -+ cooling-maps { -+ cpufreq_map0 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; - }; - - &ext_mdio { --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0021-C4-arm64-dts-add-i2c2-i2c3-node.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0021-C4-arm64-dts-add-i2c2-i2c3-node.patch deleted file mode 100644 index d092c7c7698b..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0021-C4-arm64-dts-add-i2c2-i2c3-node.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 400645dd70ae5a0efbbce35067c8674d380ed2a7 Mon Sep 17 00:00:00 2001 -From: Hyeonki Hong -Date: Wed, 13 May 2020 10:37:28 +0900 -Subject: [PATCH 21/74] ODROID-C4: arm64/dts: add i2c2, i2c3 node - -Change-Id: Id75f935111744ff6945791deefef20f897dc98ac -(cherry picked from commit 3f4b2ffd0905946175c478baa65361695e78e0de) ---- - .../boot/dts/amlogic/meson-sm1-odroid-c4.dts | 53 +++++++++++++++++++ - 1 file changed, 53 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -index 831053aa6dff..5988dc5f34d0 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-c4.dts -@@ -16,6 +16,8 @@ / { - - aliases { - ethernet0 = ðmac; -+ i2c0 = &i2c2; -+ i2c1 = &i2c3; - serial0 = &uart_AO; - serial1 = &uart_A; - spi0 = &spicc0; -@@ -434,6 +436,57 @@ &ir { - linux,rc-map-name = "rc-odroid"; - }; - -+&i2c2 { -+ status = "okay"; -+ -+ /* -+ * 40 Pin Header : SDA(GPIOX.17->3 Pin) -+ * SCL(GPIOX.18->5 Pin) -+ */ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c2_master_pins1>; -+ -+ /* default 400k */ -+ clock-frequency = <400000>; -+}; -+ -+&i2c3 { -+ /* default i2c clock-frequency is 100Khz */ -+ status = "okay"; -+ -+ /* -+ * 40 Pin Header : SDA(GPIOA.14->27 Pin) -+ * SCL(GPIOA.15->28 Pin) -+ */ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c3_master_pins2>; -+ -+ /* default 100k */ -+ clock-frequency = <100000>; -+}; -+ -+&periphs_pinctrl { -+ i2c2_master_pins1: i2c2-master-pins1 { -+ mux { -+ groups = "i2c2_sda_x", -+ "i2c2_sck_x"; -+ function = "i2c2"; -+ bias-pull-up; -+ drive-strength-microamp = <3000>; -+ }; -+ }; -+ -+ i2c3_master_pins2: i2c3-master-pins2 { -+ mux { -+ groups = "i2c3_sda_a", -+ "i2c3_sck_a"; -+ function = "i2c3"; -+ bias-pull-up; -+ drive-strength-microamp = <3000>; -+ }; -+ }; -+}; -+ - &pwm_AO_cd { - pinctrl-0 = <&pwm_ao_d_e_pins>; - pinctrl-names = "default"; --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0024-N2-sound-soc-remove-mono-channel-as-it-curren.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0024-N2-sound-soc-remove-mono-channel-as-it-curren.patch deleted file mode 100644 index e9074b850557..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0024-N2-sound-soc-remove-mono-channel-as-it-curren.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 803c6b7ac65e833864f34c0e7ece501f8f6a6706 Mon Sep 17 00:00:00 2001 -From: ckkim -Date: Thu, 20 Feb 2020 18:52:57 +0900 -Subject: [PATCH 24/74] ODROID-N2: sound/soc: remove mono channel as it - currently doesn't work hdmi output. - -Change-Id: I4d43b802815779687ade974f049f2b0517a411d1 -Signed-off-by: ckkim ---- - sound/soc/meson/axg-frddr.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/sound/soc/meson/axg-frddr.c b/sound/soc/meson/axg-frddr.c -index c3ae8ac30745..cfb9b12c2b56 100644 ---- a/sound/soc/meson/axg-frddr.c -+++ b/sound/soc/meson/axg-frddr.c -@@ -92,7 +92,7 @@ static struct snd_soc_dai_driver axg_frddr_dai_drv = { - .name = "FRDDR", - .playback = { - .stream_name = "Playback", -- .channels_min = 1, -+ .channels_min = 2, - .channels_max = AXG_FIFO_CH_MAX, - .rates = AXG_FIFO_RATES, - .formats = AXG_FIFO_FORMATS, -@@ -165,7 +165,7 @@ static struct snd_soc_dai_driver g12a_frddr_dai_drv = { - .name = "FRDDR", - .playback = { - .stream_name = "Playback", -- .channels_min = 1, -+ .channels_min = 2, - .channels_max = AXG_FIFO_CH_MAX, - .rates = AXG_FIFO_RATES, - .formats = AXG_FIFO_FORMATS, --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0025-N2-sound-soc-add-audio-module-for-g12a-g12b-s.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0025-N2-sound-soc-add-audio-module-for-g12a-g12b-s.patch deleted file mode 100644 index 8794be864eb8..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0025-N2-sound-soc-add-audio-module-for-g12a-g12b-s.patch +++ /dev/null @@ -1,29 +0,0 @@ -From c623de44981a195b471cf1c9bac8a1cd3f6279aa Mon Sep 17 00:00:00 2001 -From: ckkim -Date: Tue, 16 Jun 2020 16:16:30 +0900 -Subject: [PATCH 25/74] ODROID-N2: sound/soc: add audio module for g12a, g12b, - sm1 - -Signed-off-by: ckkim -Change-Id: I02b2b8d1ec756dfc361300082d94b3ef339cb0d6 ---- - sound/soc/meson/Kconfig | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig -index 8b6295283989..7b6ee708b74c 100644 ---- a/sound/soc/meson/Kconfig -+++ b/sound/soc/meson/Kconfig -@@ -69,6 +69,9 @@ config SND_MESON_AXG_SOUND_CARD - imply SND_MESON_AXG_SPDIFIN - imply SND_MESON_AXG_PDM - imply SND_MESON_G12A_TOHDMITX if DRM_MESON_DW_HDMI -+ imply SND_MESON_G12A_TOACODEC -+ imply SND_SOC_MESON_T9015 -+ imply SND_SOC_SIMPLE_AMPLIFIER - help - Select Y or M to add support for the AXG SoC sound card - --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/hardkernel-0032-N2-drm-meson-Add-YUV422-output-support.patch b/patch/kernel/archive/meson64-5.10/hardkernel-0032-N2-drm-meson-Add-YUV422-output-support.patch deleted file mode 100644 index ff0f2b76a8c6..000000000000 --- a/patch/kernel/archive/meson64-5.10/hardkernel-0032-N2-drm-meson-Add-YUV422-output-support.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 7c58b59ddefcfdc18dad2f938c2699c9113f969d Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Wed, 29 Jul 2020 04:05:03 +0900 -Subject: [PATCH 32/74] ODROID-N2: drm/meson: Add YUV422 output support - -This patch is to support YUV422 output from the Amlogic Meson SoC -VPU to the HDMI controller. - -Change-Id: I03952f0592c7341585e518c3038877926a694329 -Signed-off-by: Dongjin Kim ---- - drivers/gpu/drm/meson/meson_dw_hdmi.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c -index 24a12c453095..23a78996849c 100644 ---- a/drivers/gpu/drm/meson/meson_dw_hdmi.c -+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c -@@ -702,6 +702,7 @@ dw_hdmi_mode_valid(struct drm_connector *connector, - - static const u32 meson_dw_hdmi_out_bus_fmts[] = { - MEDIA_BUS_FMT_YUV8_1X24, -+ MEDIA_BUS_FMT_UYVY8_1X16, - MEDIA_BUS_FMT_UYYVYY8_0_5X24, - }; - -@@ -801,7 +802,8 @@ static void meson_venc_hdmi_encoder_mode_set(struct drm_bridge *bridge, - if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24) { - ycrcb_map = VPU_HDMI_OUTPUT_CRYCB; - yuv420_mode = true; -- } -+ } else if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYVY8_1X16) -+ ycrcb_map = VPU_HDMI_OUTPUT_CRYCB; - - /* VENC + VENC-DVI Mode setup */ - meson_venc_hdmi_mode_set(priv, vic, ycrcb_map, yuv420_mode, mode); -@@ -813,6 +815,10 @@ static void meson_venc_hdmi_encoder_mode_set(struct drm_bridge *bridge, - /* Setup YUV420 to HDMI-TX, no 10bit diphering */ - writel_relaxed(2 | (2 << 2), - priv->io_base + _REG(VPU_HDMI_FMT_CTRL)); -+ else if (dw_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYVY8_1X16) -+ /* Setup YUV422 to HDMI-TX, no 10bit diphering */ -+ writel_relaxed(1 | (2 << 2), -+ priv->io_base + _REG(VPU_HDMI_FMT_CTRL)); - else - /* Setup YUV444 to HDMI-TX, no 10bit diphering */ - writel_relaxed(0, priv->io_base + _REG(VPU_HDMI_FMT_CTRL)); --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0001-dt-bindings-arm-amlogic-add-bindings-for-Jethub-D1-H.patch b/patch/kernel/archive/meson64-5.10/jethome-0001-dt-bindings-arm-amlogic-add-bindings-for-Jethub-D1-H.patch deleted file mode 100644 index 7d1bbab3026e..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0001-dt-bindings-arm-amlogic-add-bindings-for-Jethub-D1-H.patch +++ /dev/null @@ -1,39 +0,0 @@ -From f871a01e6b10f3d16e4082fe345af7c5f56ab14d Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Sat, 4 Sep 2021 16:49:49 +0300 -Subject: [PATCH 01/10] dt-bindings: arm: amlogic: add bindings for Jethub - D1/H1 - -JetHome is a series of home automation controllers: -- Jethub D1 based on Amlogic A113X -- Jethub H1 based on AmLogic S905W - -Signed-off-by: Vyacheslav Bocharov -Acked-by: Rob Herring ---- - Documentation/devicetree/bindings/arm/amlogic.yaml | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/Documentation/devicetree/bindings/arm/amlogic.yaml b/Documentation/devicetree/bindings/arm/amlogic.yaml -index 131f13015eb0..0bd50f3072d2 100644 ---- a/Documentation/devicetree/bindings/arm/amlogic.yaml -+++ b/Documentation/devicetree/bindings/arm/amlogic.yaml -@@ -86,6 +86,7 @@ properties: - - enum: - - amlogic,p281 - - oranth,tx3-mini -+ - jethome,jethub-j80 - - const: amlogic,s905w - - const: amlogic,meson-gxl - -@@ -130,6 +131,7 @@ properties: - items: - - enum: - - amlogic,s400 -+ - jethome,jethub-j100 - - const: amlogic,a113d - - const: amlogic,meson-axg - --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0002-dt-bindings-vendor-prefixes-add-jethome-prefix.patch b/patch/kernel/archive/meson64-5.10/jethome-0002-dt-bindings-vendor-prefixes-add-jethome-prefix.patch deleted file mode 100644 index 96594ca21e83..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0002-dt-bindings-vendor-prefixes-add-jethome-prefix.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1b3b9cda85d6f98f64d5b992a292086ec47fcb62 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Sat, 4 Sep 2021 16:53:19 +0300 -Subject: [PATCH 02/10] dt-bindings: vendor-prefixes: add jethome prefix - -JetHome is trademark of IP Sokolov P.A., manufacturer of home automation -devices. - -Signed-off-by: Vyacheslav Bocharov ---- - Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml -index 2735be1a8470..379a8fd3a8be 100644 ---- a/Documentation/devicetree/bindings/vendor-prefixes.yaml -+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml -@@ -529,6 +529,8 @@ patternProperties: - description: JEDEC Solid State Technology Association - "^jesurun,.*": - description: Shenzhen Jesurun Electronics Business Dept. -+ "^jethome,.*": -+ description: JetHome (IP Sokolov P.A.) - "^jianda,.*": - description: Jiandangjing Technology Co., Ltd. - "^kam,.*": --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0003-arm64-dts-meson-gxl-add-support-for-JetHub-H1.patch b/patch/kernel/archive/meson64-5.10/jethome-0003-arm64-dts-meson-gxl-add-support-for-JetHub-H1.patch deleted file mode 100644 index e838c4fe6643..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0003-arm64-dts-meson-gxl-add-support-for-JetHub-H1.patch +++ /dev/null @@ -1,293 +0,0 @@ -From ba4c8a6c258e33e52ec863654605994d7bd5c05c Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Sat, 20 Mar 2021 14:13:29 +0300 -Subject: [PATCH 03/10] arm64: dts: meson-gxl: add support for JetHub H1 - -JetHome Jethub H1 (http://jethome.ru/jethub-h1) is a home automation -controller with the following features: - -- square plastic case -- Amlogic S905W (ARM Cortex-A53) quad-core up to 1.5GHz -- no video out -- 1GB LPDDR4 -- 8/16GB eMMC flash -- 2 x USB 2.0 -- 1 x 10/100Mbps ethernet -- WiFi / Bluetooth RTL8822CS IEEE 802.11a/b/g/n/ac, Bluetooth 5.0. -- TI CC2538 + CC2592 Zigbee Wireless Module with up to 20dBm output power - and Zigbee 3.0 support. -- MicroSD 2.x/3.x/4.x DS/HS cards. -- 1 x gpio LED -- ADC user Button -- DC source 5V microUSB - -Signed-off-by: Vyacheslav Bocharov -Reviewed-by: Neil Armstrong ---- - arch/arm64/boot/dts/amlogic/Makefile | 1 + - .../meson-gxl-s905w-jethome-jethub-j80.dts | 241 ++++++++++++++++++ - 2 files changed, 242 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index 6e2a63f49876..2cdc3006216d 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -38,6 +38,7 @@ dtb-$(CONFIG_ARCH_MESON) += meson-gxl-s805x-p241.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxl-s905w-p281.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxl-s905w-tx3-mini.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxl-s905d-libretech-pc.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-gxl-s905w-jethome-jethub-j80.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxm-khadas-vim2.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxm-nexbox-a1.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-gxm-q200.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts -new file mode 100644 -index 000000000000..6eafb908695f ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts -@@ -0,0 +1,241 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2021 Vyacheslav Bocharov -+ * Copyright (c) 2020 JetHome -+ * Author: Aleksandr Kazantsev -+ * Author: Alexey Shevelkin -+ * Author: Vyacheslav Bocharov -+ */ -+ -+/dts-v1/; -+ -+#include "meson-gxl.dtsi" -+ -+/ { -+ compatible = "jethome,jethub-j80", "amlogic,s905w", "amlogic,meson-gxl"; -+ model = "JetHome JetHub J80"; -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x40000000>; -+ }; -+ -+ reserved-memory { -+ linux,cma { -+ size = <0x0 0x1000000>; -+ }; -+ }; -+ -+ aliases { -+ serial0 = &uart_AO; /* Console */ -+ serial1 = &uart_A; /* Bluetooth */ -+ serial2 = &uart_AO_B; /* Wireless module 1 */ -+ serial3 = &uart_C; /* Wireless module 2 */ -+ ethernet0 = ðmac; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ vddio_ao18: regulator-vddio_ao18 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_AO18"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ }; -+ -+ vddio_boot: regulator-vddio_boot { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_BOOT"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ }; -+ -+ vcc_3v3: regulator-vcc_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>; -+ }; -+ -+ wifi32k: wifi32k { -+ compatible = "pwm-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <32768>; -+ pwms = <&pwm_ef 0 30518 0>; /* PWM_E at 32.768KHz */ -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>; -+ clocks = <&wifi32k>; -+ clock-names = "ext_clock"; -+ }; -+}; -+ -+&efuse { -+ bt_mac: bt_mac@6 { -+ reg = <0x6 0x6>; -+ }; -+ -+ wifi_mac: wifi_mac@C { -+ reg = <0xc 0x6>; -+ }; -+}; -+ -+&sn { -+ reg = <0x32 0x20>; -+}; -+ -+ð_mac { -+ reg = <0x0 0x6>; -+}; -+ -+&bid { -+ reg = <0x12 0x20>; -+}; -+ -+&usb { -+ status = "okay"; -+ dr_mode = "host"; -+}; -+ -+&pwm_ef { -+ status = "okay"; -+ pinctrl-0 = <&pwm_e_pins>; -+ pinctrl-names = "default"; -+ clocks = <&clkc CLKID_FCLK_DIV4>; -+ clock-names = "clkin0"; -+}; -+ -+&saradc { -+ status = "okay"; -+ vref-supply = <&vddio_ao18>; -+}; -+ -+/* Wireless SDIO Module */ -+&sd_emmc_a { -+ status = "okay"; -+ pinctrl-0 = <&sdio_pins>; -+ pinctrl-1 = <&sdio_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <50000000>; -+ -+ non-removable; -+ disable-wp; -+ -+ /* WiFi firmware requires power to be kept while in suspend */ -+ keep-power-in-suspend; -+ -+ mmc-pwrseq = <&sdio_pwrseq>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+}; -+ -+/* SD card */ -+&sd_emmc_b { -+ status = "okay"; -+ pinctrl-0 = <&sdcard_pins>; -+ pinctrl-1 = <&sdcard_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <50000000>; -+ disable-wp; -+ -+ cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+}; -+ -+/* eMMC */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ max-frequency = <200000000>; -+ non-removable; -+ disable-wp; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+}; -+ -+/* Console UART */ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+/* S905W only has access to its internal PHY */ -+ðmac { -+ status = "okay"; -+ phy-mode = "rmii"; -+ phy-handle = <&internal_phy>; -+}; -+ -+&internal_phy { -+ status = "okay"; -+ pinctrl-0 = <ð_link_led_pins>, <ð_act_led_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&uart_A { -+ status = "okay"; -+ pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+}; -+ -+&uart_C { -+ status = "okay"; -+ pinctrl-0 = <&uart_c_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&uart_AO_B { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_b_pins>, <&uart_ao_b_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+}; -+ -+&i2c_B { -+ status = "okay"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c_b_pins>; -+ -+ pcf8563: pcf8563@51 { -+ compatible = "nxp,pcf8563"; -+ reg = <0x51>; -+ status = "okay"; -+ }; -+}; --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0004-arm64-dts-meson-axg-add-support-for-JetHub-D1.patch b/patch/kernel/archive/meson64-5.10/jethome-0004-arm64-dts-meson-axg-add-support-for-JetHub-D1.patch deleted file mode 100644 index c0b7c638b240..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0004-arm64-dts-meson-axg-add-support-for-JetHub-D1.patch +++ /dev/null @@ -1,415 +0,0 @@ -From c917fa101b7c9319bdfd866b2975d930aac839e2 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Sat, 20 Mar 2021 14:23:36 +0300 -Subject: [PATCH 04/10] arm64: dts: meson-axg: add support for JetHub D1 - -JetHome Jethub D1 (http://jethome.ru/jethub-d1) is a home automation -controller with the following features: -- DIN Rail Mounting -- Amlogic A113X (ARM Cortex-A53) quad-core up to 1.5GHz -- no video out -- 512Mb/1GB LPDDR4 -- 8/16GB eMMC flash -- 1 x USB 2.0 -- 1 x 10/100Mbps ethernet -- WiFi / Bluetooth AMPAK AP6255 (Broadcom BCM43455) IEEE 802.11a/b/g/n/ac, - Bluetooth 4.2. -- TI CC2538 + CC2592 Zigbee Wireless Module with up to 20dBm output power - and Zigbee 3.0 support. -- 2 x gpio LEDS -- GPIO user Button -- 1 x 1-Wire -- 2 x RS-485 -- 4 x dry contact digital GPIO inputs -- 3 x relay GPIO outputs -- DC source with a voltage of 9 to 56 V / Passive POE - -Signed-off-by: Vyacheslav Bocharov -Reviewed-by: Neil Armstrong ---- - arch/arm64/boot/dts/amlogic/Makefile | 1 + - .../amlogic/meson-axg-jethome-jethub-j100.dts | 361 ++++++++++++++++++ - 2 files changed, 362 insertions(+) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index 2cdc3006216d..ac9f51beee66 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -1,5 +1,6 @@ - # SPDX-License-Identifier: GPL-2.0 - dtb-$(CONFIG_ARCH_MESON) += meson-axg-s400.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-axg-jethome-jethub-j100.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-radxa-zero.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-sei510.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-u200.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -new file mode 100644 -index 000000000000..c25b03a91e12 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -@@ -0,0 +1,361 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2021 Vyacheslav Bocharov -+ * Copyright (c) 2020 JetHome -+ * Author: Aleksandr Kazantsev -+ * Author: Alexey Shevelkin -+ * Author: Vyacheslav Bocharov -+ */ -+ -+/dts-v1/; -+ -+#include "meson-axg.dtsi" -+#include -+#include -+ -+/ { -+ compatible = "jethome,jethub-j100", "amlogic,a113d", "amlogic,meson-axg"; -+ model = "JetHome JetHub J100"; -+ aliases { -+ serial0 = &uart_AO; /* Console */ -+ serial1 = &uart_AO_B; /* External UART (Wireless Module) */ -+ ethernet0 = ðmac; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ /* 1024MB RAM */ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x40000000>; -+ }; -+ -+ reserved-memory { -+ linux,cma { -+ size = <0x0 0x400000>; -+ }; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>; -+ }; -+ -+ vcc_3v3: regulator-vcc_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vcc_5v: regulator-vcc_5v { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC5V"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-always-on; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vcc_5v>; -+ regulator-always-on; -+ }; -+ -+ vddio_ao18: regulator-vddio_ao18 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_AO18"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vddio_boot: regulator-vddio_boot { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_BOOT"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ usb_pwr: regulator-usb_pwr { -+ compatible = "regulator-fixed"; -+ regulator-name = "USB_PWR"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&vcc_5v>; -+ regulator-always-on; -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ reset-gpios = <&gpio GPIOX_7 GPIO_ACTIVE_LOW>; -+ clocks = <&wifi32k>; -+ clock-names = "ext_clock"; -+ }; -+ -+ wifi32k: wifi32k { -+ compatible = "pwm-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <32768>; -+ pwms = <&pwm_ab 0 30518 0>; /* PWM_A at 32.768KHz */ -+ }; -+ -+ thermal-zones { -+ cpu_thermal: cpu-thermal { -+ polling-delay-passive = <250>; -+ polling-delay = <1000>; -+ thermal-sensors = <&scpi_sensors 0>; -+ trips { -+ cpu_passive: cpu-passive { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ -+ cpu_hot: cpu-hot { -+ temperature = <80000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "hot"; -+ }; -+ -+ cpu_critical: cpu-critical { -+ temperature = <100000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "critical"; -+ }; -+ }; -+ }; -+ -+ cpu_cooling_maps: cooling-maps { -+ map0 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ -+ map1 { -+ trip = <&cpu_hot>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; -+ }; -+ onewire { -+ compatible = "w1-gpio"; -+ gpios = <&gpio GPIOA_14 GPIO_ACTIVE_HIGH>; -+ #gpio-cells = <1>; -+ }; -+}; -+ -+&efuse { -+ sn: sn@32 { -+ reg = <0x32 0x20>; -+ }; -+ -+ eth_mac: eth_mac@0 { -+ reg = <0x0 0x6>; -+ }; -+ -+ bt_mac: bt_mac@6 { -+ reg = <0x6 0x6>; -+ }; -+ -+ wifi_mac: wifi_mac@c { -+ reg = <0xc 0x6>; -+ }; -+ -+ bid: bid@12 { -+ reg = <0x12 0x20>; -+ }; -+}; -+ -+ðmac { -+ status = "okay"; -+ pinctrl-0 = <ð_rmii_x_pins>; -+ pinctrl-names = "default"; -+ phy-handle = <ð_phy0>; -+ phy-mode = "rmii"; -+ -+ mdio { -+ compatible = "snps,dwmac-mdio"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ /* ICPlus IP101A/G Ethernet PHY (vendor_id=0x0243, model_id=0x0c54) */ -+ eth_phy0: ethernet-phy@0 { -+ /* compatible = "ethernet-phy-id0243.0c54";*/ -+ max-speed = <100>; -+ reg = <0>; -+ -+ reset-assert-us = <10000>; -+ reset-deassert-us = <10000>; -+ reset-gpios = <&gpio GPIOZ_5 GPIO_ACTIVE_LOW>; -+ }; -+ }; -+}; -+ -+/* Internal I2C bus (on CPU module) */ -+&i2c1 { -+ status = "okay"; -+ pinctrl-0 = <&i2c1_z_pins>; -+ pinctrl-names = "default"; -+ -+ /* RTC */ -+ pcf8563: pcf8563@51 { -+ compatible = "nxp,pcf8563"; -+ reg = <0x51>; -+ status = "okay"; -+ }; -+}; -+ -+/* Peripheral I2C bus (on motherboard) */ -+&i2c_AO { -+ status = "okay"; -+ pinctrl-0 = <&i2c_ao_sck_10_pins>, <&i2c_ao_sda_11_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&pwm_ab { -+ status = "okay"; -+ pinctrl-0 = <&pwm_a_x20_pins>; -+ pinctrl-names = "default"; -+}; -+ -+/* wifi module */ -+&sd_emmc_b { -+ status = "okay"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ pinctrl-0 = <&sdio_pins>; -+ pinctrl-1 = <&sdio_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ sd-uhs-sdr104; -+ max-frequency = <200000000>; -+ non-removable; -+ disable-wp; -+ -+ mmc-pwrseq = <&sdio_pwrseq>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+ -+ brcmf: wifi@1 { -+ reg = <1>; -+ compatible = "brcm,bcm4329-fmac"; -+ }; -+}; -+ -+/* emmc storage */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ max-frequency = <200000000>; -+ non-removable; -+ disable-wp; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+}; -+ -+/* UART Bluetooth */ -+&uart_B { -+ status = "okay"; -+ pinctrl-0 = <&uart_b_z_pins>, <&uart_b_z_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+ -+ bluetooth { -+ compatible = "brcm,bcm43438-bt"; -+ shutdown-gpios = <&gpio GPIOZ_7 GPIO_ACTIVE_HIGH>; -+ }; -+}; -+ -+/* UART Console */ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+/* UART Wireless module */ -+&uart_AO_B { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_b_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&usb { -+ status = "okay"; -+ phy-supply = <&usb_pwr>; -+}; -+ -+&spicc1 { -+ status = "okay"; -+ pinctrl-0 = <&spi1_x_pins>, <&spi1_ss0_x_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&gpio { -+ gpio-line-names = -+ "", "", "", "", "", // 0 - 4 -+ "", "", "", "", "", // 5 - 9 -+ "UserButton", "", "", "", "", // 10 - 14 -+ "", "", "", "", "", // 15 - 19 -+ "", "", "", "", "", // 20 - 24 -+ "", "LedRed", "LedGreen", "Output3", "Output2", // 25 - 29 -+ "Output1", "", "", "", "", // 30 - 34 -+ "", "ZigBeeBOOT", "", "", "", // 35 - 39 -+ "1Wire", "ZigBeeRESET", "", "Input4", "Input3", // 40 - 44 -+ "Input2", "Input1", "", "", "", // 45 - 49 -+ "", "", "", "", "", // 50 - 54 -+ "", "", "", "", "", // 55 - 59 -+ "", "", "", "", "", // 60 - 64 -+ "", "", "", "", "", // 65 - 69 -+ "", "", "", "", "", // 70 - 74 -+ "", "", "", "", "", // 75 - 79 -+ "", "", "", "", "", // 80 - 84 -+ "", ""; // 85-86 -+}; -+ -+&cpu0 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu1 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu2 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu3 { -+ #cooling-cells = <2>; -+}; --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0005-Fix-meson64-add-gpio-irq-patch-from-https-lkml.org-l.patch b/patch/kernel/archive/meson64-5.10/jethome-0005-Fix-meson64-add-gpio-irq-patch-from-https-lkml.org-l.patch deleted file mode 100644 index bcc1d39d4179..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0005-Fix-meson64-add-gpio-irq-patch-from-https-lkml.org-l.patch +++ /dev/null @@ -1,100 +0,0 @@ -From da3c42b90664a707eecb15f40f68ecf1358b6085 Mon Sep 17 00:00:00 2001 -From: usera -Date: Mon, 12 Apr 2021 17:16:42 +0300 -Subject: [PATCH 05/10] Fix:meson64: add gpio irq (patch from - https://lkml.org/lkml/2020/11/27/8) - -Signed-off-by: Vyacheslav Bocharov ---- - drivers/pinctrl/meson/pinctrl-meson.c | 41 +++++++++++++++++++++++++++ - drivers/pinctrl/meson/pinctrl-meson.h | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c -index 20683cd072bb..5263fed788f1 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson.c -+++ b/drivers/pinctrl/meson/pinctrl-meson.c -@@ -51,6 +51,7 @@ - #include - #include - #include -+#include - - #include "../core.h" - #include "../pinctrl-utils.h" -@@ -598,6 +599,40 @@ static int meson_gpio_get(struct gpio_chip *chip, unsigned gpio) - return !!(val & BIT(bit)); - } - -+static int meson_gpio_to_irq(struct gpio_chip *chip, unsigned int gpio) -+{ -+ struct meson_pinctrl *pc = gpiochip_get_data(chip); -+ struct meson_bank *bank; -+ struct irq_fwspec fwspec; -+ int hwirq; -+ -+ if (meson_get_bank(pc, gpio, &bank)) -+ return -EINVAL; -+ -+ if (bank->irq_first < 0) { -+ dev_warn(pc->dev, "no support irq for pin[%d]\n", gpio); -+ return -EINVAL; -+ } -+ if (!pc->of_irq) { -+ dev_err(pc->dev, "invalid device node of gpio INTC\n"); -+ return -EINVAL; -+ } -+ -+ hwirq = gpio - bank->first + bank->irq_first; -+ printk("gpio irq setup: hwirq: 0x%X irqfirst: 0x%X irqlast: 0x%X pin[%d]\n", hwirq, bank->irq_first, bank->irq_last, gpio); -+ if (hwirq > bank->irq_last) -+ { -+ dev_warn(pc->dev, "no more irq for pin[%d]\n", gpio); -+ return -EINVAL; -+ } -+ fwspec.fwnode = of_node_to_fwnode(pc->of_irq); -+ fwspec.param_count = 2; -+ fwspec.param[0] = hwirq; -+ fwspec.param[1] = IRQ_TYPE_NONE; -+ -+ return irq_create_fwspec_mapping(&fwspec); -+} -+ - static int meson_gpiolib_register(struct meson_pinctrl *pc) - { - int ret; -@@ -612,6 +647,7 @@ static int meson_gpiolib_register(struct meson_pinctrl *pc) - pc->chip.direction_output = meson_gpio_direction_output; - pc->chip.get = meson_gpio_get; - pc->chip.set = meson_gpio_set; -+ pc->chip.to_irq = meson_gpio_to_irq; - pc->chip.base = -1; - pc->chip.ngpio = pc->data->num_pins; - pc->chip.can_sleep = false; -@@ -682,6 +718,11 @@ static int meson_pinctrl_parse_dt(struct meson_pinctrl *pc, - - pc->of_node = gpio_np; - -+ pc->of_irq = of_find_compatible_node(NULL, -+ NULL, "amlogic,meson-gpio-intc"); -+ if (!pc->of_irq) -+ pc->of_irq = of_find_compatible_node(NULL, -+ NULL, "amlogic,meson-gpio-intc-ext"); - pc->reg_mux = meson_map_resource(pc, gpio_np, "mux"); - if (IS_ERR_OR_NULL(pc->reg_mux)) { - dev_err(pc->dev, "mux registers not found\n"); -diff --git a/drivers/pinctrl/meson/pinctrl-meson.h b/drivers/pinctrl/meson/pinctrl-meson.h -index f8b0ff9d419a..0f808bbece4a 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson.h -+++ b/drivers/pinctrl/meson/pinctrl-meson.h -@@ -131,6 +131,7 @@ struct meson_pinctrl { - struct regmap *reg_ds; - struct gpio_chip chip; - struct device_node *of_node; -+ struct device_node *of_irq; - }; - - #define FUNCTION(fn) \ --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0006-Add-bluetooth-node-for-RTL8822CS-uart-port-https-mjm.patch b/patch/kernel/archive/meson64-5.10/jethome-0006-Add-bluetooth-node-for-RTL8822CS-uart-port-https-mjm.patch deleted file mode 100644 index 57b39fbd56a2..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0006-Add-bluetooth-node-for-RTL8822CS-uart-port-https-mjm.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 02b97bef23a283d9c891be2ccd2ed40bf54ab558 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Wed, 11 Aug 2021 13:07:46 +0300 -Subject: [PATCH 06/10] Add bluetooth node for RTL8822CS uart port - (https://mjmwired.net/kernel/Documentation/devicetree/bindings/net/realtek-bluetooth.yaml) - -Signed-off-by: Vyacheslav Bocharov ---- - .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts -index 6eafb908695f..a5ee7ed17efa 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts -@@ -213,6 +213,11 @@ &uart_A { - pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>; - pinctrl-names = "default"; - uart-has-rtscts; -+ bluetooth { -+ compatible = "realtek,rtl8822cs-bt"; -+ enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; -+ host-wake-gpios = <&gpio GPIOX_18 GPIO_ACTIVE_HIGH>; -+ }; - }; - - &uart_C { --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0007-arm64-meson-fix-dts-for-JetHub-D1.patch b/patch/kernel/archive/meson64-5.10/jethome-0007-arm64-meson-fix-dts-for-JetHub-D1.patch deleted file mode 100644 index 4d3202344c56..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0007-arm64-meson-fix-dts-for-JetHub-D1.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 971ae00f9b18ef9b919928c966e720501400f6b8 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Thu, 25 Nov 2021 16:02:47 +0300 -Subject: [PATCH 07/10] arm64: meson: fix dts for JetHub D1 - -Fix misplace of cpu_cooling_maps for JetHub D1, move it to right place. - -Fixes: 8e279fb29039 ("arm64: dts: meson-axg: add support for JetHub D1") -Signed-off-by: Vyacheslav Bocharov -Reviewed-by: Neil Armstrong -Signed-off-by: Neil Armstrong -Link: https://lore.kernel.org/r/20211125130246.1086627-1-adeep@lexina.in ---- - .../amlogic/meson-axg-jethome-jethub-j100.dts | 30 +++++++++---------- - 1 file changed, 15 insertions(+), 15 deletions(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -index c25b03a91e12..44ce67d3ef34 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -@@ -134,23 +134,23 @@ cpu_critical: cpu-critical { - type = "critical"; - }; - }; -- }; - -- cpu_cooling_maps: cooling-maps { -- map0 { -- trip = <&cpu_passive>; -- cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -- }; -+ cpu_cooling_maps: cooling-maps { -+ map0 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; - -- map1 { -- trip = <&cpu_hot>; -- cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ map1 { -+ trip = <&cpu_hot>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; - }; - }; - }; --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0008-arm64-meson-dts-update-dts-for-JetHub-D1-Change-zigb.patch b/patch/kernel/archive/meson64-5.10/jethome-0008-arm64-meson-dts-update-dts-for-JetHub-D1-Change-zigb.patch deleted file mode 100644 index a71b7729d1d3..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0008-arm64-meson-dts-update-dts-for-JetHub-D1-Change-zigb.patch +++ /dev/null @@ -1,26 +0,0 @@ -From cab3782bebd0a742df228f525a2bf42ea15498f5 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Mon, 13 Dec 2021 10:25:50 +0300 -Subject: [PATCH 08/10] arm64: meson: dts: update dts for JetHub D1 Change - zigbee serial alias to ttyAML2 for backward compatibility. - ---- - arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -index 44ce67d3ef34..ae603095038c 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -@@ -18,7 +18,7 @@ / { - model = "JetHome JetHub J100"; - aliases { - serial0 = &uart_AO; /* Console */ -- serial1 = &uart_AO_B; /* External UART (Wireless Module) */ -+ serial2 = &uart_AO_B; /* External UART (Wireless Module) */ - ethernet0 = ðmac; - }; - --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0009-arm64-meson-fix-sdio-in-dts-for-JetHub-D1.patch b/patch/kernel/archive/meson64-5.10/jethome-0009-arm64-meson-fix-sdio-in-dts-for-JetHub-D1.patch deleted file mode 100644 index 29b4bf2663bd..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0009-arm64-meson-fix-sdio-in-dts-for-JetHub-D1.patch +++ /dev/null @@ -1,68 +0,0 @@ -From a00a076fe1f3dcdd47c8f68cbc82c674dd1a3632 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Sun, 9 Jan 2022 12:32:21 +0300 -Subject: [PATCH 09/10] arm64: meson: fix sdio in dts for JetHub D1 - -Fix the dts to match board's reference design: -- update vddio_boot regulator to 3.3v (Wi-Fi SDIO module) -- add vccq_1v8 regulator with 1.8v for eMMC SDIO - -In the first revision of JetHub D1 the vccq_1v8 regulator was 3.3v. -All installed eMMC modules were tested to work in HS200 mode at 3.3v -supply voltage. In the next revisions of the board eMMC will be -powered with 1.8v according to the standard. - -Signed-off-by: Vyacheslav Bocharov ---- - .../dts/amlogic/meson-axg-jethome-jethub-j100.dts | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -index ae603095038c..d0b8845abb31 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -@@ -81,12 +81,22 @@ vddio_ao18: regulator-vddio_ao18 { - vddio_boot: regulator-vddio_boot { - compatible = "regulator-fixed"; - regulator-name = "VDDIO_BOOT"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vccq_1v8: regulator-vccq_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCCQ_1V8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - vin-supply = <&vddao_3v3>; - regulator-always-on; - }; - -+ - usb_pwr: regulator-usb_pwr { - compatible = "regulator-fixed"; - regulator-name = "USB_PWR"; -@@ -247,8 +257,7 @@ &sd_emmc_b { - - bus-width = <4>; - cap-sd-highspeed; -- sd-uhs-sdr104; -- max-frequency = <200000000>; -+ max-frequency = <50000000>; - non-removable; - disable-wp; - -@@ -281,7 +290,7 @@ &sd_emmc_c { - mmc-pwrseq = <&emmc_pwrseq>; - - vmmc-supply = <&vcc_3v3>; -- vqmmc-supply = <&vddio_boot>; -+ vqmmc-supply = <&vccq_1v8>; - }; - - /* UART Bluetooth */ --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/jethome-0010-Add-JetHub-D1p-support.patch b/patch/kernel/archive/meson64-5.10/jethome-0010-Add-JetHub-D1p-support.patch deleted file mode 100644 index 3ee057be1cf5..000000000000 --- a/patch/kernel/archive/meson64-5.10/jethome-0010-Add-JetHub-D1p-support.patch +++ /dev/null @@ -1,845 +0,0 @@ -From f4abf03616b36f4ece4f996e67fa562c2a6ff040 Mon Sep 17 00:00:00 2001 -From: Vyacheslav Bocharov -Date: Wed, 10 Aug 2022 17:57:39 +0300 -Subject: [PATCH 10/10] Add JetHub D1p support - -Signed-off-by: Vyacheslav Bocharov ---- - arch/arm64/boot/dts/amlogic/Makefile | 2 + - .../amlogic/meson-axg-jethome-jethub-j100.dts | 338 +---------------- - .../meson-axg-jethome-jethub-j110-rev-2.dts | 37 ++ - .../meson-axg-jethome-jethub-j110-rev-3.dts | 27 ++ - .../meson-axg-jethome-jethub-j1xx.dtsi | 351 ++++++++++++++++++ - 5 files changed, 421 insertions(+), 334 deletions(-) - create mode 100644 arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-2.dts - create mode 100644 arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-3.dts - create mode 100644 arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi - -diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile -index ac9f51beee66..97f028f3b8f7 100644 ---- a/arch/arm64/boot/dts/amlogic/Makefile -+++ b/arch/arm64/boot/dts/amlogic/Makefile -@@ -1,6 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0 - dtb-$(CONFIG_ARCH_MESON) += meson-axg-s400.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-axg-jethome-jethub-j100.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-axg-jethome-jethub-j110-rev-2.dtb -+dtb-$(CONFIG_ARCH_MESON) += meson-axg-jethome-jethub-j110-rev-3.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-radxa-zero.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-sei510.dtb - dtb-$(CONFIG_ARCH_MESON) += meson-g12a-u200.dtb -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -index d0b8845abb31..b2d6ba660914 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j100.dts -@@ -1,270 +1,29 @@ - // SPDX-License-Identifier: (GPL-2.0+ OR MIT) - /* -- * Copyright (c) 2021 Vyacheslav Bocharov -- * Copyright (c) 2020 JetHome -- * Author: Aleksandr Kazantsev -- * Author: Alexey Shevelkin -+ * Copyright (c) 2022 Vyacheslav Bocharov -+ * Copyright (c) 2022 JetHome - * Author: Vyacheslav Bocharov - */ - - /dts-v1/; - --#include "meson-axg.dtsi" --#include --#include -+#include "meson-axg-jethome-jethub-j1xx.dtsi" - - / { - compatible = "jethome,jethub-j100", "amlogic,a113d", "amlogic,meson-axg"; -- model = "JetHome JetHub J100"; -- aliases { -- serial0 = &uart_AO; /* Console */ -- serial2 = &uart_AO_B; /* External UART (Wireless Module) */ -- ethernet0 = ðmac; -- }; -- -- chosen { -- stdout-path = "serial0:115200n8"; -- }; -+ model = "JetHome JetHub D1 (J100)"; - - /* 1024MB RAM */ - memory@0 { - device_type = "memory"; - reg = <0x0 0x0 0x0 0x40000000>; - }; -- -- reserved-memory { -- linux,cma { -- size = <0x0 0x400000>; -- }; -- }; -- -- emmc_pwrseq: emmc-pwrseq { -- compatible = "mmc-pwrseq-emmc"; -- reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>; -- }; -- -- vcc_3v3: regulator-vcc_3v3 { -- compatible = "regulator-fixed"; -- regulator-name = "VCC_3V3"; -- regulator-min-microvolt = <3300000>; -- regulator-max-microvolt = <3300000>; -- vin-supply = <&vddao_3v3>; -- regulator-always-on; -- }; -- -- vcc_5v: regulator-vcc_5v { -- compatible = "regulator-fixed"; -- regulator-name = "VCC5V"; -- regulator-min-microvolt = <5000000>; -- regulator-max-microvolt = <5000000>; -- regulator-always-on; -- }; -- -- vddao_3v3: regulator-vddao_3v3 { -- compatible = "regulator-fixed"; -- regulator-name = "VDDAO_3V3"; -- regulator-min-microvolt = <3300000>; -- regulator-max-microvolt = <3300000>; -- vin-supply = <&vcc_5v>; -- regulator-always-on; -- }; -- -- vddio_ao18: regulator-vddio_ao18 { -- compatible = "regulator-fixed"; -- regulator-name = "VDDIO_AO18"; -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <1800000>; -- vin-supply = <&vddao_3v3>; -- regulator-always-on; -- }; -- -- vddio_boot: regulator-vddio_boot { -- compatible = "regulator-fixed"; -- regulator-name = "VDDIO_BOOT"; -- regulator-min-microvolt = <3300000>; -- regulator-max-microvolt = <3300000>; -- vin-supply = <&vddao_3v3>; -- regulator-always-on; -- }; -- -- vccq_1v8: regulator-vccq_1v8 { -- compatible = "regulator-fixed"; -- regulator-name = "VCCQ_1V8"; -- regulator-min-microvolt = <1800000>; -- regulator-max-microvolt = <1800000>; -- vin-supply = <&vddao_3v3>; -- regulator-always-on; -- }; -- -- -- usb_pwr: regulator-usb_pwr { -- compatible = "regulator-fixed"; -- regulator-name = "USB_PWR"; -- regulator-min-microvolt = <5000000>; -- regulator-max-microvolt = <5000000>; -- vin-supply = <&vcc_5v>; -- regulator-always-on; -- }; -- -- sdio_pwrseq: sdio-pwrseq { -- compatible = "mmc-pwrseq-simple"; -- reset-gpios = <&gpio GPIOX_7 GPIO_ACTIVE_LOW>; -- clocks = <&wifi32k>; -- clock-names = "ext_clock"; -- }; -- -- wifi32k: wifi32k { -- compatible = "pwm-clock"; -- #clock-cells = <0>; -- clock-frequency = <32768>; -- pwms = <&pwm_ab 0 30518 0>; /* PWM_A at 32.768KHz */ -- }; -- -- thermal-zones { -- cpu_thermal: cpu-thermal { -- polling-delay-passive = <250>; -- polling-delay = <1000>; -- thermal-sensors = <&scpi_sensors 0>; -- trips { -- cpu_passive: cpu-passive { -- temperature = <70000>; /* millicelsius */ -- hysteresis = <2000>; /* millicelsius */ -- type = "passive"; -- }; -- -- cpu_hot: cpu-hot { -- temperature = <80000>; /* millicelsius */ -- hysteresis = <2000>; /* millicelsius */ -- type = "hot"; -- }; -- -- cpu_critical: cpu-critical { -- temperature = <100000>; /* millicelsius */ -- hysteresis = <2000>; /* millicelsius */ -- type = "critical"; -- }; -- }; -- -- cpu_cooling_maps: cooling-maps { -- map0 { -- trip = <&cpu_passive>; -- cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -- }; -- -- map1 { -- trip = <&cpu_hot>; -- cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -- <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -- }; -- }; -- }; -- }; -- onewire { -- compatible = "w1-gpio"; -- gpios = <&gpio GPIOA_14 GPIO_ACTIVE_HIGH>; -- #gpio-cells = <1>; -- }; --}; -- --&efuse { -- sn: sn@32 { -- reg = <0x32 0x20>; -- }; -- -- eth_mac: eth_mac@0 { -- reg = <0x0 0x6>; -- }; -- -- bt_mac: bt_mac@6 { -- reg = <0x6 0x6>; -- }; -- -- wifi_mac: wifi_mac@c { -- reg = <0xc 0x6>; -- }; -- -- bid: bid@12 { -- reg = <0x12 0x20>; -- }; --}; -- --ðmac { -- status = "okay"; -- pinctrl-0 = <ð_rmii_x_pins>; -- pinctrl-names = "default"; -- phy-handle = <ð_phy0>; -- phy-mode = "rmii"; -- -- mdio { -- compatible = "snps,dwmac-mdio"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- /* ICPlus IP101A/G Ethernet PHY (vendor_id=0x0243, model_id=0x0c54) */ -- eth_phy0: ethernet-phy@0 { -- /* compatible = "ethernet-phy-id0243.0c54";*/ -- max-speed = <100>; -- reg = <0>; -- -- reset-assert-us = <10000>; -- reset-deassert-us = <10000>; -- reset-gpios = <&gpio GPIOZ_5 GPIO_ACTIVE_LOW>; -- }; -- }; --}; -- --/* Internal I2C bus (on CPU module) */ --&i2c1 { -- status = "okay"; -- pinctrl-0 = <&i2c1_z_pins>; -- pinctrl-names = "default"; -- -- /* RTC */ -- pcf8563: pcf8563@51 { -- compatible = "nxp,pcf8563"; -- reg = <0x51>; -- status = "okay"; -- }; - }; - --/* Peripheral I2C bus (on motherboard) */ --&i2c_AO { -- status = "okay"; -- pinctrl-0 = <&i2c_ao_sck_10_pins>, <&i2c_ao_sda_11_pins>; -- pinctrl-names = "default"; --}; -- --&pwm_ab { -- status = "okay"; -- pinctrl-0 = <&pwm_a_x20_pins>; -- pinctrl-names = "default"; --}; - - /* wifi module */ - &sd_emmc_b { -- status = "okay"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- pinctrl-0 = <&sdio_pins>; -- pinctrl-1 = <&sdio_clk_gate_pins>; -- pinctrl-names = "default", "clk-gate"; -- -- bus-width = <4>; -- cap-sd-highspeed; -- max-frequency = <50000000>; - non-removable; -- disable-wp; -- -- mmc-pwrseq = <&sdio_pwrseq>; -- -- vmmc-supply = <&vddao_3v3>; -- vqmmc-supply = <&vddio_boot>; - - brcmf: wifi@1 { - reg = <1>; -@@ -272,99 +31,10 @@ brcmf: wifi@1 { - }; - }; - --/* emmc storage */ --&sd_emmc_c { -- status = "okay"; -- pinctrl-0 = <&emmc_pins>, <&emmc_ds_pins>; -- pinctrl-1 = <&emmc_clk_gate_pins>; -- pinctrl-names = "default", "clk-gate"; -- -- bus-width = <8>; -- cap-mmc-highspeed; -- max-frequency = <200000000>; -- non-removable; -- disable-wp; -- mmc-ddr-1_8v; -- mmc-hs200-1_8v; -- -- mmc-pwrseq = <&emmc_pwrseq>; -- -- vmmc-supply = <&vcc_3v3>; -- vqmmc-supply = <&vccq_1v8>; --}; -- - /* UART Bluetooth */ - &uart_B { -- status = "okay"; -- pinctrl-0 = <&uart_b_z_pins>, <&uart_b_z_cts_rts_pins>; -- pinctrl-names = "default"; -- uart-has-rtscts; -- - bluetooth { - compatible = "brcm,bcm43438-bt"; - shutdown-gpios = <&gpio GPIOZ_7 GPIO_ACTIVE_HIGH>; - }; - }; -- --/* UART Console */ --&uart_AO { -- status = "okay"; -- pinctrl-0 = <&uart_ao_a_pins>; -- pinctrl-names = "default"; --}; -- --/* UART Wireless module */ --&uart_AO_B { -- status = "okay"; -- pinctrl-0 = <&uart_ao_b_pins>; -- pinctrl-names = "default"; --}; -- --&usb { -- status = "okay"; -- phy-supply = <&usb_pwr>; --}; -- --&spicc1 { -- status = "okay"; -- pinctrl-0 = <&spi1_x_pins>, <&spi1_ss0_x_pins>; -- pinctrl-names = "default"; --}; -- --&gpio { -- gpio-line-names = -- "", "", "", "", "", // 0 - 4 -- "", "", "", "", "", // 5 - 9 -- "UserButton", "", "", "", "", // 10 - 14 -- "", "", "", "", "", // 15 - 19 -- "", "", "", "", "", // 20 - 24 -- "", "LedRed", "LedGreen", "Output3", "Output2", // 25 - 29 -- "Output1", "", "", "", "", // 30 - 34 -- "", "ZigBeeBOOT", "", "", "", // 35 - 39 -- "1Wire", "ZigBeeRESET", "", "Input4", "Input3", // 40 - 44 -- "Input2", "Input1", "", "", "", // 45 - 49 -- "", "", "", "", "", // 50 - 54 -- "", "", "", "", "", // 55 - 59 -- "", "", "", "", "", // 60 - 64 -- "", "", "", "", "", // 65 - 69 -- "", "", "", "", "", // 70 - 74 -- "", "", "", "", "", // 75 - 79 -- "", "", "", "", "", // 80 - 84 -- "", ""; // 85-86 --}; -- --&cpu0 { -- #cooling-cells = <2>; --}; -- --&cpu1 { -- #cooling-cells = <2>; --}; -- --&cpu2 { -- #cooling-cells = <2>; --}; -- --&cpu3 { -- #cooling-cells = <2>; --}; -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-2.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-2.dts -new file mode 100644 -index 000000000000..0062667c4f65 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-2.dts -@@ -0,0 +1,37 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2022 Vyacheslav Bocharov -+ * Copyright (c) 2022 JetHome -+ * Author: Vyacheslav Bocharov -+ */ -+ -+/dts-v1/; -+ -+#include "meson-axg-jethome-jethub-j1xx.dtsi" -+ -+/ { -+ compatible = "jethome,jethub-j110", "amlogic,a113d", "amlogic,meson-axg"; -+ model = "JetHome JetHub D1p (J110) HW rev.2"; -+ -+ /* 2GiB or 4GiB RAM */ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x80000000>; -+ }; -+}; -+ -+ -+/* wifi module */ -+&sd_emmc_b { -+ broken-cd;/* cd-gpios = <&gpio_ao GPIOAO_3 GPIO_ACTIVE_LOW>;*/ -+}; -+ -+/* UART Bluetooth */ -+&uart_B { -+ bluetooth { -+ compatible = "realtek,rtl8822cs-bt"; -+ enable-gpios = <&gpio GPIOZ_7 GPIO_ACTIVE_HIGH>; -+ host-wake-gpios = <&gpio GPIOZ_8 GPIO_ACTIVE_HIGH>; -+ device-wake-gpios = <&gpio GPIOZ_6 GPIO_ACTIVE_HIGH>; -+ }; -+}; -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-3.dts b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-3.dts -new file mode 100644 -index 000000000000..c2d22b00c1cd ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j110-rev-3.dts -@@ -0,0 +1,27 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2022 Vyacheslav Bocharov -+ * Copyright (c) 2022 JetHome -+ * Author: Vyacheslav Bocharov -+ */ -+ -+/dts-v1/; -+ -+#include "meson-axg-jethome-jethub-j1xx.dtsi" -+ -+/ { -+ compatible = "jethome,jethub-j110", "amlogic,a113d", "amlogic,meson-axg"; -+ model = "JetHome JetHub D1p (J110) Hw rev.3"; -+ -+ /* 2GiB or 4GiB RAM */ -+ memory@0 { -+ device_type = "memory"; -+ reg = <0x0 0x0 0x0 0x80000000>; -+ }; -+}; -+ -+ -+/* wifi module */ -+&sd_emmc_b { -+ broken-cd;/* cd-gpios = <&gpio_ao GPIOAO_3 GPIO_ACTIVE_LOW>;*/ -+}; -diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi -new file mode 100644 -index 000000000000..5836b0030931 ---- /dev/null -+++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi -@@ -0,0 +1,351 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2022 Vyacheslav Bocharov -+ * Copyright (c) 2022 JetHome -+ * Author: Vyacheslav Bocharov -+ * Author: Aleksandr Kazantsev -+ * Author: Alexey Shevelkin -+ */ -+ -+/dts-v1/; -+ -+#include "meson-axg.dtsi" -+#include -+#include -+ -+/ { -+ aliases { -+ serial0 = &uart_AO; /* Console */ -+ serial2 = &uart_AO_B; /* External UART (Wireless Module) */ -+ ethernet0 = ðmac; -+ }; -+ -+ chosen { -+ stdout-path = "serial0:115200n8"; -+ }; -+ -+ reserved-memory { -+ linux,cma { -+ size = <0x0 0x400000>; -+ }; -+ }; -+ -+ emmc_pwrseq: emmc-pwrseq { -+ compatible = "mmc-pwrseq-emmc"; -+ reset-gpios = <&gpio BOOT_9 GPIO_ACTIVE_LOW>; -+ }; -+ -+ vcc_3v3: regulator-vcc_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vcc_5v: regulator-vcc_5v { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCC5V"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-always-on; -+ }; -+ -+ vddao_3v3: regulator-vddao_3v3 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDAO_3V3"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vcc_5v>; -+ regulator-always-on; -+ }; -+ -+ vddio_ao18: regulator-vddio_ao18 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_AO18"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vddio_boot: regulator-vddio_boot { -+ compatible = "regulator-fixed"; -+ regulator-name = "VDDIO_BOOT"; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ vccq_1v8: regulator-vccq_1v8 { -+ compatible = "regulator-fixed"; -+ regulator-name = "VCCQ_1V8"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ vin-supply = <&vddao_3v3>; -+ regulator-always-on; -+ }; -+ -+ usb_pwr: regulator-usb_pwr { -+ compatible = "regulator-fixed"; -+ regulator-name = "USB_PWR"; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ vin-supply = <&vcc_5v>; -+ regulator-always-on; -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ reset-gpios = <&gpio GPIOX_7 GPIO_ACTIVE_LOW>; -+ clocks = <&wifi32k>; -+ clock-names = "ext_clock"; -+ }; -+ -+ wifi32k: wifi32k { -+ compatible = "pwm-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <32768>; -+ pwms = <&pwm_ab 0 30518 0>; /* PWM_A at 32.768KHz */ -+ }; -+ -+ thermal-zones { -+ cpu_thermal: cpu-thermal { -+ polling-delay-passive = <250>; -+ polling-delay = <1000>; -+ thermal-sensors = <&scpi_sensors 0>; -+ trips { -+ cpu_passive: cpu-passive { -+ temperature = <70000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "passive"; -+ }; -+ -+ cpu_hot: cpu-hot { -+ temperature = <80000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "hot"; -+ }; -+ -+ cpu_critical: cpu-critical { -+ temperature = <100000>; /* millicelsius */ -+ hysteresis = <2000>; /* millicelsius */ -+ type = "critical"; -+ }; -+ }; -+ -+ cpu_cooling_maps: cooling-maps { -+ map0 { -+ trip = <&cpu_passive>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ -+ map1 { -+ trip = <&cpu_hot>; -+ cooling-device = <&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu2 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>, -+ <&cpu3 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; -+ }; -+ }; -+ }; -+ }; -+ -+ onewire { -+ compatible = "w1-gpio"; -+ gpios = <&gpio GPIOA_14 GPIO_ACTIVE_HIGH>; -+ #gpio-cells = <1>; -+ }; -+}; -+ -+&efuse { -+ sn: sn@32 { -+ reg = <0x32 0x20>; -+ }; -+ -+ eth_mac: eth_mac@0 { -+ reg = <0x0 0x6>; -+ }; -+ -+ bt_mac: bt_mac@6 { -+ reg = <0x6 0x6>; -+ }; -+ -+ wifi_mac: wifi_mac@c { -+ reg = <0xc 0x6>; -+ }; -+ -+ bid: bid@12 { -+ reg = <0x12 0x20>; -+ }; -+}; -+ -+ðmac { -+ status = "okay"; -+ pinctrl-0 = <ð_rmii_x_pins>; -+ pinctrl-names = "default"; -+ phy-handle = <ð_phy0>; -+ phy-mode = "rmii"; -+ -+ mdio { -+ compatible = "snps,dwmac-mdio"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ /* ICPlus IP101A/G Ethernet PHY (vendor_id=0x0243, model_id=0x0c54) */ -+ eth_phy0: ethernet-phy@0 { -+ /* compatible = "ethernet-phy-id0243.0c54";*/ -+ max-speed = <100>; -+ reg = <0>; -+ -+ reset-assert-us = <10000>; -+ reset-deassert-us = <10000>; -+ reset-gpios = <&gpio GPIOZ_5 GPIO_ACTIVE_LOW>; -+ }; -+ }; -+}; -+ -+/* Internal I2C bus (on CPU module) */ -+&i2c1 { -+ status = "okay"; -+ pinctrl-0 = <&i2c1_z_pins>; -+ pinctrl-names = "default"; -+ -+ /* RTC */ -+ pcf8563: pcf8563@51 { -+ compatible = "nxp,pcf8563"; -+ reg = <0x51>; -+ status = "okay"; -+ }; -+}; -+ -+/* Peripheral I2C bus (on motherboard) */ -+&i2c_AO { -+ status = "okay"; -+ pinctrl-0 = <&i2c_ao_sck_10_pins>, <&i2c_ao_sda_11_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&pwm_ab { -+ status = "okay"; -+ pinctrl-0 = <&pwm_a_x20_pins>; -+ pinctrl-names = "default"; -+}; -+ -+/* wifi module */ -+&sd_emmc_b { -+ status = "okay"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ pinctrl-0 = <&sdio_pins>; -+ pinctrl-1 = <&sdio_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <4>; -+ cap-sd-highspeed; -+ max-frequency = <50000000>; -+ disable-wp; -+ -+ mmc-pwrseq = <&sdio_pwrseq>; -+ -+ vmmc-supply = <&vddao_3v3>; -+ vqmmc-supply = <&vddio_boot>; -+}; -+ -+/* emmc storage */ -+&sd_emmc_c { -+ status = "okay"; -+ pinctrl-0 = <&emmc_pins>, <&emmc_ds_pins>; -+ pinctrl-1 = <&emmc_clk_gate_pins>; -+ pinctrl-names = "default", "clk-gate"; -+ -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ max-frequency = <200000000>; -+ non-removable; -+ disable-wp; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ -+ mmc-pwrseq = <&emmc_pwrseq>; -+ -+ vmmc-supply = <&vcc_3v3>; -+ vqmmc-supply = <&vccq_1v8>; -+}; -+ -+/* UART Bluetooth */ -+&uart_B { -+ status = "okay"; -+ pinctrl-0 = <&uart_b_z_pins>, <&uart_b_z_cts_rts_pins>; -+ pinctrl-names = "default"; -+ uart-has-rtscts; -+}; -+ -+/* UART Console */ -+&uart_AO { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_a_pins>; -+ pinctrl-names = "default"; -+}; -+ -+/* UART Wireless module */ -+&uart_AO_B { -+ status = "okay"; -+ pinctrl-0 = <&uart_ao_b_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&usb { -+ status = "okay"; -+ phy-supply = <&usb_pwr>; -+}; -+ -+&spicc1 { -+ status = "okay"; -+ pinctrl-0 = <&spi1_x_pins>, <&spi1_ss0_x_pins>; -+ pinctrl-names = "default"; -+}; -+ -+&gpio { -+ gpio-line-names = -+ "", "", "", "", "", // 0 - 4 -+ "", "", "", "", "", // 5 - 9 -+ "UserButton", "", "", "", "", // 10 - 14 -+ "", "", "", "", "", // 15 - 19 -+ "", "", "", "", "", // 20 - 24 -+ "", "LedRed", "LedGreen", "Output3", "Output2", // 25 - 29 -+ "Output1", "", "", "", "", // 30 - 34 -+ "", "ZigBeeBOOT", "", "", "", // 35 - 39 -+ "1Wire", "ZigBeeRESET", "", "Input4", "Input3", // 40 - 44 -+ "Input2", "Input1", "", "", "", // 45 - 49 -+ "", "", "", "", "", // 50 - 54 -+ "", "", "", "", "", // 55 - 59 -+ "", "", "", "", "", // 60 - 64 -+ "", "", "", "", "", // 65 - 69 -+ "", "", "", "", "", // 70 - 74 -+ "", "", "", "", "", // 75 - 79 -+ "", "", "", "", "", // 80 - 84 -+ "", ""; // 85-86 -+}; -+ -+&cpu0 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu1 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu2 { -+ #cooling-cells = <2>; -+}; -+ -+&cpu3 { -+ #cooling-cells = <2>; -+}; --- -2.30.2 - diff --git a/patch/kernel/archive/meson64-5.10/meson64_pwm_hwmon_control.patch b/patch/kernel/archive/meson64-5.10/meson64_pwm_hwmon_control.patch deleted file mode 100644 index b1b003085b57..000000000000 --- a/patch/kernel/archive/meson64-5.10/meson64_pwm_hwmon_control.patch +++ /dev/null @@ -1,124 +0,0 @@ -From 8a63de9e2aef4e073d91385c5992886e0ea6368e Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Wed, 25 Nov 2020 05:01:49 +0900 -Subject: [PATCH] hwmon: (pwm-fan) add fan pwm1_enable attribute - -This patch adds to new attribute 'pwm1_enable' to change the fan speed -control method as documented in 'Documentation/hwmon/sysfs-interface'. - -Signed-off-by: Dongjin Kim -Change-Id: I19094d60e928d6c3ce226d319e75a35ecbd3ae52 ---- - drivers/hwmon/pwm-fan.c | 52 ++++++++++++++++++++++++++++++++++++----- - 1 file changed, 46 insertions(+), 6 deletions(-) - -diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c -index 1f63807c0399e..834275309421d 100644 ---- a/drivers/hwmon/pwm-fan.c -+++ b/drivers/hwmon/pwm-fan.c -@@ -39,6 +39,7 @@ struct pwm_fan_ctx { - unsigned int pwm_fan_max_state; - unsigned int *pwm_fan_cooling_levels; - struct thermal_cooling_device *cdev; -+ int enable; - }; - - /* This handler assumes self resetting edge triggered interrupt. */ -@@ -76,6 +77,10 @@ static int __set_pwm(struct pwm_fan_ctx *ctx, unsigned long pwm) - struct pwm_state state = { }; - - mutex_lock(&ctx->lock); -+ -+ if (ctx->enable == 0) -+ pwm = MAX_PWM; -+ - if (ctx->pwm_value == pwm) - goto exit_set_pwm_err; - -@@ -137,11 +142,42 @@ static ssize_t rpm_show(struct device *dev, - return sprintf(buf, "%u\n", ctx->rpm); - } - -+static ssize_t enable_store(struct device *dev, -+ struct device_attribute *attr, -+ const char *buf, size_t count) -+{ -+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev); -+ int err; -+ unsigned long val; -+ -+ err = kstrtoul(buf, 10, &val); -+ if (err) -+ return err; -+ -+ mutex_lock(&ctx->lock); -+ ctx->enable = val; -+ mutex_unlock(&ctx->lock); -+ -+ err = __set_pwm(ctx, ctx->pwm_fan_cooling_levels[ctx->pwm_fan_state]); -+ -+ return err ? err : count; -+} -+ -+static ssize_t enable_show(struct device *dev, struct device_attribute *attr, -+ char *buf) -+{ -+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev); -+ -+ return sprintf(buf, "%u\n", ctx->enable); -+} -+ - static SENSOR_DEVICE_ATTR_RW(pwm1, pwm, 0); -+static SENSOR_DEVICE_ATTR_RW(pwm1_enable, enable, 0); - static SENSOR_DEVICE_ATTR_RO(fan1_input, rpm, 0); - - static struct attribute *pwm_fan_attrs[] = { - &sensor_dev_attr_pwm1.dev_attr.attr, -+ &sensor_dev_attr_pwm1_enable.dev_attr.attr, - &sensor_dev_attr_fan1_input.dev_attr.attr, - NULL, - }; -@@ -153,7 +189,7 @@ static umode_t pwm_fan_attrs_visible(struct kobject *kobj, struct attribute *a, - struct pwm_fan_ctx *ctx = dev_get_drvdata(dev); - - /* Hide fan_input in case no interrupt is available */ -- if (n == 1 && ctx->irq <= 0) -+ if (n == 2 && ctx->irq <= 0) - return 0; - - return a->mode; -@@ -200,7 +236,7 @@ static int - pwm_fan_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state) - { - struct pwm_fan_ctx *ctx = cdev->devdata; -- int ret; -+ int ret = 0; - - if (!ctx || (state > ctx->pwm_fan_max_state)) - return -EINVAL; -@@ -208,10 +244,12 @@ pwm_fan_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state) - if (state == ctx->pwm_fan_state) - return 0; - -- ret = __set_pwm(ctx, ctx->pwm_fan_cooling_levels[state]); -- if (ret) { -- dev_err(&cdev->device, "Cannot set pwm!\n"); -- return ret; -+ if (ctx->enable >= 2) { -+ ret = __set_pwm(ctx, ctx->pwm_fan_cooling_levels[state]); -+ if (ret) { -+ dev_err(&cdev->device, "Cannot set pwm!\n"); -+ return ret; -+ } - } - - ctx->pwm_fan_state = state; -@@ -298,6 +336,8 @@ static int pwm_fan_probe(struct platform_device *pdev) - if (IS_ERR(ctx->pwm)) - return dev_err_probe(dev, PTR_ERR(ctx->pwm), "Could not get PWM\n"); - -+ ctx->enable = 2; -+ - platform_set_drvdata(pdev, ctx); - - ctx->irq = platform_get_irq_optional(pdev, 0); diff --git a/patch/kernel/archive/meson64-5.10/meson64_remove_spidev_warning.patch b/patch/kernel/archive/meson64-5.10/meson64_remove_spidev_warning.patch deleted file mode 100644 index 924250c9778e..000000000000 --- a/patch/kernel/archive/meson64-5.10/meson64_remove_spidev_warning.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index b0c76e262..f8f91353f 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -725,9 +725,9 @@ static int spidev_probe(struct spi_device *spi) - * compatible string, it is a Linux implementation thing - * rather than a description of the hardware. - */ -- WARN(spi->dev.of_node && -- of_device_is_compatible(spi->dev.of_node, "spidev"), -- "%pOF: buggy DT: spidev listed directly in DT\n", spi->dev.of_node); -+ if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) { -+ dev_info(&spi->dev, "probing from DT"); -+ } - - spidev_probe_acpi(spi); - diff --git a/patch/kernel/archive/meson64-5.10/need_check/0084-WIP-arm64-dts-meson-g12b-khadas-vim3-add-the-Etherne.patch b/patch/kernel/archive/meson64-5.10/need_check/0084-WIP-arm64-dts-meson-g12b-khadas-vim3-add-the-Etherne.patch deleted file mode 100644 index 78ef066bf3b6..000000000000 --- a/patch/kernel/archive/meson64-5.10/need_check/0084-WIP-arm64-dts-meson-g12b-khadas-vim3-add-the-Etherne.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 49730246e686155ff656d9bd3574347fcd99c360 Mon Sep 17 00:00:00 2001 -From: chewitt -Date: Sun, 11 Aug 2019 10:01:25 +0000 -Subject: [PATCH 084/101] WIP: arm64: dts: meson-g12b-khadas-vim3: add the - Ethernet PHY interrupt line - -apply the same change as [0] to VIM3. - -[0] https://github.com/torvalds/linux/commit/98ba71c94eaff1c3af6170bce9fe63c93dd32f2f - -Signed-off-by: Christian Hewitt ---- - .../dts/amlogic/meson-g12b-khadas-vim3.dtsi | 25 +++++++++++++++++++ - 1 file changed, 25 insertions(+) - -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi -index c33e85fbdaba..8158a97a92cb 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi -@@ -154,6 +154,31 @@ - clock-latency = <50000>; - }; - -+&ext_mdio { -+ external_phy: ethernet-phy@0 { -+ /* Realtek RTL8211F (0x001cc916) */ -+ reg = <0>; -+ max-speed = <1000>; -+ -+ interrupt-parent = <&gpio_intc>; -+ /* MAC_INTR on GPIOZ_14 */ -+ interrupts = <26 IRQ_TYPE_LEVEL_LOW>; -+ }; -+}; -+ -+ðmac { -+ pinctrl-0 = <ð_pins>, <ð_rgmii_pins>; -+ pinctrl-names = "default"; -+ status = "okay"; -+ phy-mode = "rgmii"; -+ phy-handle = <&external_phy>; -+ amlogic,tx-delay-ns = <2>; -+}; -+ -+&frddr_a { -+ status = "okay"; -+}; -+ - &frddr_b { - status = "okay"; - }; --- -2.17.1 - diff --git a/patch/kernel/archive/meson64-5.10/need_check/0091-GX-update-TEXT_OFFSET-for-Amlogic-MESON-SoC.patch b/patch/kernel/archive/meson64-5.10/need_check/0091-GX-update-TEXT_OFFSET-for-Amlogic-MESON-SoC.patch deleted file mode 100644 index 4fef56edabe5..000000000000 --- a/patch/kernel/archive/meson64-5.10/need_check/0091-GX-update-TEXT_OFFSET-for-Amlogic-MESON-SoC.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 39727c90aad7a77d216092f55e3604792826c820 Mon Sep 17 00:00:00 2001 -From: Nick Xie -Date: Fri, 21 Aug 2020 14:59:07 +0800 -Subject: [PATCH 26/40] GX: update TEXT_OFFSET for Amlogic MESON SoC - -Signed-off-by: Nick Xie ---- - arch/arm64/Makefile | 4 ++++ - arch/arm64/kernel/head.S | 4 ++-- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 148362c285f8..e4cb0644f693 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -128,7 +128,11 @@ endif - head-y := arch/arm64/kernel/head.o - - # The byte offset of the kernel image in RAM from the start of RAM. -+ifeq ($(CONFIG_ARCH_MESON),y) -+TEXT_OFFSET := 0x01080000 -+else - TEXT_OFFSET := 0x0 -+endif - - ifeq ($(CONFIG_KASAN_SW_TAGS), y) - KASAN_SHADOW_SCALE_SHIFT := 4 -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 037421c66b14..18b37e2d2a00 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -42,8 +42,8 @@ - #error TEXT_OFFSET must be at least 4KB aligned - #elif (PAGE_OFFSET & 0x1fffff) != 0 - #error PAGE_OFFSET must be at least 2MB aligned --#elif TEXT_OFFSET > 0x1fffff --#error TEXT_OFFSET must be less than 2MB -+//#elif TEXT_OFFSET > 0x1fffff -+//#error TEXT_OFFSET must be less than 2MB - #endif - - /* --- -2.25.1 - diff --git a/patch/kernel/archive/meson64-5.10/need_check/board-odroidn2-eth0-disable-reset.patch b/patch/kernel/archive/meson64-5.10/need_check/board-odroidn2-eth0-disable-reset.patch deleted file mode 100644 index 53df69213bb3..000000000000 --- a/patch/kernel/archive/meson64-5.10/need_check/board-odroidn2-eth0-disable-reset.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts 2020/08/26 03:53:22 1.1 -+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts 2020/08/26 03:54:20 -@@ -403,7 +403,7 @@ - - reset-assert-us = <10000>; - reset-deassert-us = <30000>; -- reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>; -+ /* reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>; */ - - interrupt-parent = <&gpio_intc>; - /* MAC_INTR on GPIOZ_14 */ diff --git a/patch/kernel/archive/meson64-5.10/need_check/linux-5.5-net-smsc95xx-allow-mac-address-as-param.patch b/patch/kernel/archive/meson64-5.10/need_check/linux-5.5-net-smsc95xx-allow-mac-address-as-param.patch deleted file mode 100644 index 0e2c8ef1c57a..000000000000 --- a/patch/kernel/archive/meson64-5.10/need_check/linux-5.5-net-smsc95xx-allow-mac-address-as-param.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 8a928056900e2d1172f174c54965744755654612 Mon Sep 17 00:00:00 2001 -From: popcornmix -Date: Tue, 18 Feb 2014 01:43:50 -0300 -Subject: [PATCH 1/2] net/smsc95xx: Allow mac address to be set as a parameter - ---- - drivers/net/usb/smsc95xx.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 56 insertions(+) - -diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c -index 309b88acd3d0..7bc9feb891a1 100644 ---- a/drivers/net/usb/smsc95xx.c -+++ b/drivers/net/usb/smsc95xx.c -@@ -60,6 +60,7 @@ - #define SUSPEND_SUSPEND3 (0x08) - #define SUSPEND_ALLMODES (SUSPEND_SUSPEND0 | SUSPEND_SUSPEND1 | \ - SUSPEND_SUSPEND2 | SUSPEND_SUSPEND3) -+#define MAC_ADDR_LEN (6) - - #define CARRIER_CHECK_DELAY (2 * HZ) - -@@ -82,6 +83,10 @@ static bool turbo_mode = true; - module_param(turbo_mode, bool, 0644); - MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction"); - -+static char *macaddr = ":"; -+module_param(macaddr, charp, 0); -+MODULE_PARM_DESC(macaddr, "MAC address"); -+ - static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index, - u32 *data, int in_pm) - { -@@ -910,8 +915,59 @@ static int smsc95xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) - return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL); - } - -+/* Check the macaddr module parameter for a MAC address */ -+static int smsc95xx_is_macaddr_param(struct usbnet *dev, u8 *dev_mac) -+{ -+ int i, j, got_num, num; -+ u8 mtbl[MAC_ADDR_LEN]; -+ -+ if (macaddr[0] == ':') -+ return 0; -+ -+ i = 0; -+ j = 0; -+ num = 0; -+ got_num = 0; -+ while (j < MAC_ADDR_LEN) { -+ if (macaddr[i] && macaddr[i] != ':') { -+ got_num++; -+ if ('0' <= macaddr[i] && macaddr[i] <= '9') -+ num = num * 16 + macaddr[i] - '0'; -+ else if ('A' <= macaddr[i] && macaddr[i] <= 'F') -+ num = num * 16 + 10 + macaddr[i] - 'A'; -+ else if ('a' <= macaddr[i] && macaddr[i] <= 'f') -+ num = num * 16 + 10 + macaddr[i] - 'a'; -+ else -+ break; -+ i++; -+ } else if (got_num == 2) { -+ mtbl[j++] = (u8) num; -+ num = 0; -+ got_num = 0; -+ i++; -+ } else { -+ break; -+ } -+ } -+ -+ if (j == MAC_ADDR_LEN) { -+ netif_dbg(dev, ifup, dev->net, "Overriding MAC address with: " -+ "%02x:%02x:%02x:%02x:%02x:%02x\n", mtbl[0], mtbl[1], mtbl[2], -+ mtbl[3], mtbl[4], mtbl[5]); -+ for (i = 0; i < MAC_ADDR_LEN; i++) -+ dev_mac[i] = mtbl[i]; -+ return 1; -+ } else { -+ return 0; -+ } -+} -+ - static void smsc95xx_init_mac_address(struct usbnet *dev) - { -+ /* Check module parameters */ -+ if (smsc95xx_is_macaddr_param(dev, dev->net->dev_addr)) -+ return; -+ - const u8 *mac_addr; - - /* maybe the boot loader passed the MAC address in devicetree */ --- -2.15.0 diff --git a/patch/kernel/archive/meson64-5.10/thermal_amlogic_thermal_add_hwmon_support.patch b/patch/kernel/archive/meson64-5.10/thermal_amlogic_thermal_add_hwmon_support.patch deleted file mode 100644 index ec7a18bbd71b..000000000000 --- a/patch/kernel/archive/meson64-5.10/thermal_amlogic_thermal_add_hwmon_support.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 719854edeb7c2c85901031f3062e89fafa66ea1b Mon Sep 17 00:00:00 2001 -From: Dongjin Kim -Date: Wed, 25 Nov 2020 03:43:28 +0900 -Subject: [PATCH] thermal: amlogic_thermal: Add hwmon support - -Expose Amlogic thermal as HWMON devices. - - $ sensors - cpu_thermal-virtual-0 - Adapter: Virtual device - temp1: +32.2 C (crit = +110.0 C) - - ddr_thermal-virtual-0 - Adapter: Virtual device - temp1: +33.4 C (crit = +110.0 C) - -Signed-off-by: Dongjin Kim -Change-Id: Icb1bf7cd7e4462f9923af5bcd72fa7c0c8e14cc9 ---- - drivers/thermal/amlogic_thermal.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/thermal/amlogic_thermal.c b/drivers/thermal/amlogic_thermal.c -index ccb1fe18e9931..2fce96c32586f 100644 ---- a/drivers/thermal/amlogic_thermal.c -+++ b/drivers/thermal/amlogic_thermal.c -@@ -29,6 +29,7 @@ - #include - - #include "thermal_core.h" -+#include "thermal_hwmon.h" - - #define TSENSOR_CFG_REG1 0x4 - #define TSENSOR_CFG_REG1_RSET_VBG BIT(12) -@@ -291,6 +292,9 @@ static int amlogic_thermal_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ if (devm_thermal_add_hwmon_sysfs(pdata->tzd)) -+ dev_warn(&pdev->dev, "failed to add hwmon sysfs attributes\n"); -+ - ret = amlogic_thermal_enable(pdata); - - return ret; diff --git a/patch/kernel/archive/meson64-5.10/x-0147-si2168-fix-cmd-timeout.patch b/patch/kernel/archive/meson64-5.10/x-0147-si2168-fix-cmd-timeout.patch deleted file mode 100644 index 453b98a363f4..000000000000 --- a/patch/kernel/archive/meson64-5.10/x-0147-si2168-fix-cmd-timeout.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 2e01cc074cc426da4b390af025a736eda9aef80c Mon Sep 17 00:00:00 2001 -From: Koumes -Date: Sat, 1 Jun 2019 21:20:26 +0000 -Subject: [PATCH] si2168: fix cmd timeout - -Some demuxer si2168 commands may take 130-140 ms. -(DVB-T/T2 tuner MyGica T230C v2). -Details: https://github.com/CoreELEC/CoreELEC/pull/208 ---- - drivers/media/dvb-frontends/si2168.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c -index b05e6772c..ffaba6f81 100644 ---- a/drivers/media/dvb-frontends/si2168.c -+++ b/drivers/media/dvb-frontends/si2168.c -@@ -42,7 +42,7 @@ static int si2168_cmd_execute(struct i2c_client *client, struct si2168_cmd *cmd) - - if (cmd->rlen) { - /* wait cmd execution terminate */ -- #define TIMEOUT 70 -+ #define TIMEOUT 200 - timeout = jiffies + msecs_to_jiffies(TIMEOUT); - while (!time_after(jiffies, timeout)) { - ret = i2c_master_recv(client, cmd->args, cmd->rlen); --- -2.17.1 - diff --git a/patch/kernel/archive/rockchip-4.4/0001-fixing-dtc-error.patch b/patch/kernel/archive/rockchip-4.4/0001-fixing-dtc-error.patch deleted file mode 100644 index 76a474d1874a..000000000000 --- a/patch/kernel/archive/rockchip-4.4/0001-fixing-dtc-error.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 3a3274fe09d70fd25607eac945f5c17bd48d4e7b Mon Sep 17 00:00:00 2001 -From: Igor Pecovnik -Date: Mon, 8 Mar 2021 06:54:40 +0000 -Subject: [PATCH] fixing dtc error - -Signed-off-by: Igor Pecovnik ---- - scripts/dtc/dtc-lexer.lex.c_shipped | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/scripts/dtc/dtc-lexer.lex.c_shipped b/scripts/dtc/dtc-lexer.lex.c_shipped -index 011bb963..c3b63163 100644 ---- a/scripts/dtc/dtc-lexer.lex.c_shipped -+++ b/scripts/dtc/dtc-lexer.lex.c_shipped -@@ -631,7 +631,7 @@ char *yytext; - #include "srcpos.h" - #include "dtc-parser.tab.h" - --YYLTYPE yylloc; -+extern YYLTYPE yylloc; - extern bool treesource_error; - - /* CAUTION: this will stop working if we ever use yyless() or yyunput() */ --- -Created with Armbian build tools https://github.com/armbian/build - diff --git a/patch/kernel/archive/rockchip-4.4/00_cheatsheet.md b/patch/kernel/archive/rockchip-4.4/00_cheatsheet.md deleted file mode 100644 index e23c7d942feb..000000000000 --- a/patch/kernel/archive/rockchip-4.4/00_cheatsheet.md +++ /dev/null @@ -1,11 +0,0 @@ -#A small cheatsheet -rearange of the patching of the rk3288 patches - -| namig | meaning | -| ------------- |:-------------------:| -| 100 | opp related patches | -| 110 | 8723bs related | -| 120 | LED | -| 130 | boot&reboot | -| 190 | TinkerS eMMC | -| 260 | gpiomem driver | \ No newline at end of file diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0000-Revert-rk-add-gcc-wrapper.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0000-Revert-rk-add-gcc-wrapper.patch deleted file mode 100644 index b5d30ff740ff..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0000-Revert-rk-add-gcc-wrapper.patch +++ /dev/null @@ -1,27 +0,0 @@ -From a968000cae7b5d0c3c10b4e5a94fd187c891ee08 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Wed, 27 Dec 2017 22:01:06 +0100 -Subject: [PATCH] Revert "rk: add gcc-wrapper" - -This reverts part of commit 7a51384d24fe4da183fc15b2d17aa3c153b822e7. ---- - Makefile | 6 ------ - 1 file changed, 6 deletions(-) - -diff --git a/Makefile b/Makefile -index a785aeed4674..d34c20a89fb7 100644 ---- a/Makefile -+++ b/Makefile -@@ -372,12 +372,6 @@ PERL = perl - PYTHON = python - CHECK = sparse - --# Use the wrapper for the compiler. This wrapper scans for new --# warnings and causes the build to stop upon encountering them. --ifneq ($(wildcard $(srctree)/scripts/gcc-wrapper.py),) --CC = $(srctree)/scripts/gcc-wrapper.py $(CROSS_COMPILE)gcc --endif -- - CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \ - -Wbitwise -Wno-return-void $(CF) - CFLAGS_MODULE = diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip.patch deleted file mode 100644 index ee9531414452..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip.patch +++ /dev/null @@ -1,94 +0,0 @@ -diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi -index ee8ca48b..d5e11b69 100644 ---- a/arch/arm/boot/dts/rk3288.dtsi -+++ b/arch/arm/boot/dts/rk3288.dtsi -@@ -1064,7 +1064,7 @@ - <&cru PCLK_PERI>; - assigned-clock-rates = <594000000>, - <1250000000>, <300000000>, -- <150000000>, <75000000>, -+ <0>, <75000000>, - <300000000>, <150000000>, - <75000000>; - }; -@@ -1315,6 +1315,8 @@ - resets = <&cru SRST_LCDC0_AXI>, <&cru SRST_LCDC0_AHB>, <&cru SRST_LCDC0_DCLK>; - reset-names = "axi", "ahb", "dclk"; - iommus = <&vopb_mmu>; -+ assigned-clocks = <&cru DCLK_VOP0>; -+ assigned-clock-parents = <&cru PLL_NPLL>; - status = "disabled"; - - vopb_out: port { -diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c -index 0a9f31f2..183114d8 100644 ---- a/drivers/clk/rockchip/clk-pll.c -+++ b/drivers/clk/rockchip/clk-pll.c -@@ -364,6 +364,17 @@ static const struct rockchip_pll_rate_table *rockchip_get_pll_settings( - static long rockchip_pll_round_rate(struct clk_hw *hw, - unsigned long drate, unsigned long *prate) - { -+ struct rockchip_clk_pll *pll = to_rockchip_clk_pll(hw); -+ const struct rockchip_pll_rate_table *rate; -+ -+ /* Get required rate settings from table */ -+ rate = rockchip_get_pll_settings(pll, drate); -+ if (!rate) { -+ pr_debug("%s: Invalid rate : %lu for pll clk %s\n", __func__, -+ drate, __clk_get_name(hw->clk)); -+ return -EINVAL; -+ } -+ - return drate; - } - -diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c -index ca6c2ad3..f748a292 100644 ---- a/drivers/clk/rockchip/clk-rk3288.c -+++ b/drivers/clk/rockchip/clk-rk3288.c -@@ -105,6 +105,27 @@ static struct rockchip_pll_rate_table rk3288_pll_rates[] = { - { /* sentinel */ }, - }; - -+static struct rockchip_pll_rate_table rk3288_npll_rates[] = { -+ RK3066_PLL_RATE_NB(594000000, 1, 99, 4, 32), -+ RK3066_PLL_RATE_NB(585000000, 6, 585, 4, 32), -+ RK3066_PLL_RATE_NB(432000000, 3, 216, 4, 32), -+ RK3066_PLL_RATE_NB(426000000, 3, 213, 4, 32), -+ RK3066_PLL_RATE_NB(400000000, 1, 100, 6, 32), -+ RK3066_PLL_RATE_NB(342000000, 3, 171, 4, 32), -+ RK3066_PLL_RATE_NB(297000000, 2, 198, 8, 16), -+ RK3066_PLL_RATE_NB(270000000, 1, 135, 12, 32), -+ RK3066_PLL_RATE_NB(260000000, 1, 130, 12, 32), -+ RK3066_PLL_RATE_NB(148500000, 1, 99, 16, 32), -+ RK3066_PLL_RATE(148352000, 13, 1125, 14), -+ RK3066_PLL_RATE_NB(146250000, 6, 585, 16, 32), -+ RK3066_PLL_RATE_NB(108000000, 1, 54, 12, 32), -+ RK3066_PLL_RATE_NB(106500000, 4, 213, 12, 32), -+ RK3066_PLL_RATE_NB(85500000, 4, 171, 12, 32), -+ RK3066_PLL_RATE_NB(74250000, 4, 198, 16, 32), -+ RK3066_PLL_RATE(74176000, 26, 1125, 14), -+ { /* sentinel */ }, -+}; -+ - #define RK3288_DIV_ACLK_CORE_M0_MASK 0xf - #define RK3288_DIV_ACLK_CORE_M0_SHIFT 0 - #define RK3288_DIV_ACLK_CORE_MP_MASK 0xf -@@ -214,7 +235,7 @@ static struct rockchip_pll_clock rk3288_pll_clks[] __initdata = { - [gpll] = PLL(pll_rk3066, PLL_GPLL, "gpll", mux_pll_p, 0, RK3288_PLL_CON(12), - RK3288_MODE_CON, 12, 8, 0, rk3288_pll_rates), - [npll] = PLL(pll_rk3066, PLL_NPLL, "npll", mux_pll_p, 0, RK3288_PLL_CON(16), -- RK3288_MODE_CON, 14, 9, ROCKCHIP_PLL_SYNC_RATE, rk3288_pll_rates), -+ RK3288_MODE_CON, 14, 9, 0, rk3288_npll_rates), - }; - - static struct clk_div_table div_hclk_cpu_t[] = { -@@ -429,7 +450,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = { - RK3288_CLKSEL_CON(30), 14, 2, MFLAGS, 8, 5, DFLAGS, - RK3288_CLKGATE_CON(3), 4, GFLAGS), - -- COMPOSITE(DCLK_VOP0, "dclk_vop0", mux_pll_src_cpll_gpll_npll_p, 0, -+ COMPOSITE(DCLK_VOP0, "dclk_vop0", mux_pll_src_cpll_gpll_npll_p, CLK_SET_RATE_NO_REPARENT | CLK_SET_RATE_PARENT, - RK3288_CLKSEL_CON(27), 0, 2, MFLAGS, 8, 8, DFLAGS, - RK3288_CLKGATE_CON(3), 1, GFLAGS), - COMPOSITE(DCLK_VOP1, "dclk_vop1", mux_pll_src_cpll_gpll_npll_p, 0, diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip2.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip2.patch deleted file mode 100644 index 17922e272c2b..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0001-rockchip2.patch +++ /dev/null @@ -1,950 +0,0 @@ -From 00ddf696ea9a7e980ea8e6ff895defe392db0c11 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 17 Apr 2017 13:09:16 +0200 -Subject: [PATCH] sound/usb/quirks-table: add Realtek ALC4040 - ---- - sound/usb/quirks-table.h | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 69bf5cf1e91e..00672a818145 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3324,4 +3324,13 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - } - }, - -+{ -+ USB_DEVICE(0x0bda, 0x481a), -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .vendor_name = "Realtek", -+ .product_name = "ALC4040", -+ .ifnum = QUIRK_NO_INTERFACE -+ } -+}, -+ - #undef USB_DEVICE_VENDOR_SPEC - -From 55a67a2125f372eed3281cec9914ecd66283955b Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 28 May 2017 09:08:50 +0200 -Subject: [PATCH] gpu/arm/mali400: default to performance gpu governor - ---- - drivers/gpu/arm/mali400/mali/linux/mali_devfreq.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/arm/mali400/mali/linux/mali_devfreq.c b/drivers/gpu/arm/mali400/mali/linux/mali_devfreq.c -index c9b8652f100d..6c97c530a2ae 100644 ---- a/drivers/gpu/arm/mali400/mali/linux/mali_devfreq.c -+++ b/drivers/gpu/arm/mali400/mali/linux/mali_devfreq.c -@@ -259,7 +259,7 @@ int mali_devfreq_init(struct mali_device *mdev) - return -EFAULT; - - mdev->devfreq = devfreq_add_device(mdev->dev, dp, -- "simple_ondemand", NULL); -+ "performance", NULL); - if (IS_ERR(mdev->devfreq)) { - mali_devfreq_term_freq_table(mdev); - return PTR_ERR(mdev->devfreq); - -From 188e9f097216cd73fa78abf9545837464dd70231 Mon Sep 17 00:00:00 2001 -From: LongChair -Date: Fri, 21 Apr 2017 13:39:12 +0200 -Subject: [PATCH] drm/rockchip: remove unsupported 4K freqs - ---- - drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -index a58edabe600c..7273561fe6b1 100644 ---- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -@@ -510,9 +510,15 @@ dw_hdmi_rockchip_mode_valid(struct drm_connector *connector, - return MODE_BAD; - - hdmi = to_rockchip_hdmi(encoder); -- if (hdmi->dev_type == RK3368_HDMI && mode->clock > 340000 && -+ if ((hdmi->dev_type == RK3368_HDMI || hdmi->dev_type == RK3328_HDMI) && -+ mode->clock > 340000 && - !drm_mode_is_420(&connector->display_info, mode)) - return MODE_BAD; -+ -+ /* Skip bad clocks for RK3288 */ -+ if (hdmi->dev_type == RK3288_HDMI && (mode->clock < 27500 || mode->clock > 340000)) -+ return MODE_CLOCK_RANGE; -+ - /* - * ensure all drm display mode can work, if someone want support more - * resolutions, please limit the possible_crtc, only connect to - -From cde112e9f9e564806b49bbe317b783e78a6b5c3a Mon Sep 17 00:00:00 2001 -From: xuhuicong -Date: Fri, 23 Jun 2017 18:56:17 +0800 -Subject: [PATCH] drm/rockchip: hdmi: fix no sound some time - -Change-Id: Ic9f931d9a5b7bca954363293a20ca242eb0bfa6f -Signed-off-by: xuhuicong ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 7 +++---- - 1 file changed, 3 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index d57d999c50a5..ae498d097b61 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1991,10 +1991,6 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi, - HDMI_FC_INVIDCONF_IN_I_P_INTERLACED : - HDMI_FC_INVIDCONF_IN_I_P_PROGRESSIVE; - -- inv_val |= hdmi->sink_is_hdmi ? -- HDMI_FC_INVIDCONF_DVI_MODEZ_HDMI_MODE : -- HDMI_FC_INVIDCONF_DVI_MODEZ_DVI_MODE; -- - hdmi_writeb(hdmi, inv_val, HDMI_FC_INVIDCONF); - - hdisplay = mode->hdisplay; -@@ -2292,6 +2288,9 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - /* not for DVI mode */ - if (hdmi->sink_is_hdmi) { - dev_dbg(hdmi->dev, "%s HDMI mode\n", __func__); -+ hdmi_modb(hdmi, HDMI_FC_INVIDCONF_DVI_MODEZ_HDMI_MODE, -+ HDMI_FC_INVIDCONF_DVI_MODEZ_HDMI_MODE, -+ HDMI_FC_INVIDCONF); - - /* HDMI Initialization Step F - Configure AVI InfoFrame */ - hdmi_config_AVI(hdmi, mode); - -From e56478758d232f503414c1e004f6f52973aeb0c4 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 18 Nov 2017 11:09:39 +0100 -Subject: [PATCH] rockchip: vop: force skip lines if image too big - ---- - drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -index a2c1d85bba95..784e83537692 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -@@ -1649,6 +1649,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane, - int ymirror, xmirror; - uint32_t val; - bool rb_swap, global_alpha_en; -+ int skip_lines = 0; - - #if defined(CONFIG_ROCKCHIP_DRM_DEBUG) - bool AFBC_flag = false; -@@ -1685,8 +1686,14 @@ static void vop_plane_atomic_update(struct drm_plane *plane, - } - - mode = &crtc->state->adjusted_mode; -+ -+ /* -+ * force skip lines if image too big. -+ */ - actual_w = drm_rect_width(src) >> 16; -- actual_h = drm_rect_height(src) >> 16; -+ if (actual_w == 3840 && is_yuv_support(fb->pixel_format)) -+ skip_lines = 1; -+ actual_h = drm_rect_height(src) >> (16 + skip_lines); - act_info = (actual_h - 1) << 16 | ((actual_w - 1) & 0xffff); - - dsp_info = (drm_rect_height(dest) - 1) << 16; -@@ -1708,10 +1715,10 @@ static void vop_plane_atomic_update(struct drm_plane *plane, - VOP_WIN_SET(vop, win, xmirror, xmirror); - VOP_WIN_SET(vop, win, ymirror, ymirror); - VOP_WIN_SET(vop, win, format, vop_plane_state->format); -- VOP_WIN_SET(vop, win, yrgb_vir, fb->pitches[0] >> 2); -+ VOP_WIN_SET(vop, win, yrgb_vir, fb->pitches[0] >> (2 - skip_lines)); - VOP_WIN_SET(vop, win, yrgb_mst, vop_plane_state->yrgb_mst); - if (is_yuv_support(fb->pixel_format)) { -- VOP_WIN_SET(vop, win, uv_vir, fb->pitches[1] >> 2); -+ VOP_WIN_SET(vop, win, uv_vir, fb->pitches[1] >> (2 - skip_lines)); - VOP_WIN_SET(vop, win, uv_mst, vop_plane_state->uv_mst); - } - VOP_WIN_SET(vop, win, fmt_10, is_yuv_10bit(fb->pixel_format)); - -From d1cc2fb593abab7510948339db9cf4b9a59926c6 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 18 Nov 2017 23:17:24 +0100 -Subject: [PATCH] gpu/arm/midgard: default to performance gpu governor - ---- - drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c | 5 ++--- - drivers/gpu/arm/midgard/mali_kbase_config_defaults.h | 3 +-- - 2 files changed, 3 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c b/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c -index 1495f06cd9b9..a6d2e0121015 100644 ---- a/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c -+++ b/drivers/gpu/arm/midgard/backend/gpu/mali_kbase_devfreq.c -@@ -348,8 +348,7 @@ int kbase_devfreq_init(struct kbase_device *kbdev) - dp = &kbdev->devfreq_profile; - - dp->initial_freq = kbdev->current_freq; -- /* .KP : set devfreq_dvfs_interval_in_ms */ -- dp->polling_ms = 20; -+ dp->polling_ms = 100; - dp->target = kbase_devfreq_target; - dp->get_dev_status = kbase_devfreq_status; - dp->get_cur_freq = kbase_devfreq_cur_freq; -@@ -363,7 +362,7 @@ int kbase_devfreq_init(struct kbase_device *kbdev) - return err; - - kbdev->devfreq = devfreq_add_device(kbdev->dev, dp, -- "simple_ondemand", NULL); -+ "performance", NULL); - if (IS_ERR(kbdev->devfreq)) { - kbase_devfreq_term_freq_table(kbdev); - return PTR_ERR(kbdev->devfreq); -diff --git a/drivers/gpu/arm/midgard/mali_kbase_config_defaults.h b/drivers/gpu/arm/midgard/mali_kbase_config_defaults.h -index 1cf44b3500cf..a6a1a52f0463 100644 ---- a/drivers/gpu/arm/midgard/mali_kbase_config_defaults.h -+++ b/drivers/gpu/arm/midgard/mali_kbase_config_defaults.h -@@ -109,8 +109,7 @@ enum { - /* - * Default period for DVFS sampling - */ --// #define DEFAULT_PM_DVFS_PERIOD 100 /* 100ms */ --#define DEFAULT_PM_DVFS_PERIOD 20 /* 20 ms */ -+#define DEFAULT_PM_DVFS_PERIOD 100 /* 100ms */ - - /* - * Power Management poweroff tick granuality. This is in nanoseconds to - -From fd3c597dd56bca81fc642d918343ab2f9435628f Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 10 Dec 2017 14:16:09 +0100 -Subject: [PATCH] uapi: install rockchip_drm header - ---- - include/uapi/drm/Kbuild | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/uapi/drm/Kbuild b/include/uapi/drm/Kbuild -index 38d437096c35..b7ae9969d41e 100644 ---- a/include/uapi/drm/Kbuild -+++ b/include/uapi/drm/Kbuild -@@ -11,6 +11,7 @@ header-y += nouveau_drm.h - header-y += qxl_drm.h - header-y += r128_drm.h - header-y += radeon_drm.h -+header-y += rockchip_drm.h - header-y += savage_drm.h - header-y += sis_drm.h - header-y += tegra_drm.h - -From b5afb970037ac69a22f6d514c34175835f6078fc Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 10 Dec 2017 18:03:53 +0100 -Subject: [PATCH] phy: rockchip-inno-hdmi-phy: add vesa dmt pixel clocks - ---- - drivers/phy/rockchip/phy-rockchip-inno-hdmi-phy.c | 64 +++++++++++++++++++++++ - 1 file changed, 64 insertions(+) - -diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi-phy.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi-phy.c -index 0161f80ab964..6cf391405ad6 100644 ---- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi-phy.c -+++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi-phy.c -@@ -278,6 +278,70 @@ static const struct pre_pll_config pre_pll_cfg_table[] = { - {594000000, 371250000, 4, 495, 1, 2, 0, 1, 3, 1, 1, 1, 0}, - {593407000, 593407000, 1, 98, 0, 2, 0, 1, 0, 1, 1, 0, 0xE6AE6B}, - {594000000, 594000000, 1, 99, 0, 2, 0, 1, 0, 1, 1, 0, 0}, -+ { 25175000, 25175000, 30, 1007, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 31500000, 31500000, 1, 21, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ { 33750000, 33750000, 1, 45, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 35500000, 35500000, 3, 71, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ { 36000000, 36000000, 1, 12, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ { 49500000, 49500000, 1, 33, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ { 50000000, 50000000, 3, 50, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ { 56250000, 56250000, 1, 75, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 68250000, 68250000, 1, 91, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 72000000, 72000000, 1, 24, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ { 73250000, 73250000, 3, 293, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 75000000, 75000000, 1, 25, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ { 78750000, 78750000, 1, 105, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ { 79500000, 79500000, 1, 53, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ { 85500000, 85500000, 1, 57, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ { 94500000, 94500000, 1, 63, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {101000000, 101000000, 3, 101, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {102250000, 102250000, 3, 409, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {106500000, 106500000, 1, 71, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {115500000, 115500000, 1, 77, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {117500000, 117500000, 3, 235, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {121750000, 121750000, 3, 487, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {122500000, 122500000, 3, 245, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {135000000, 135000000, 1, 45, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {136750000, 136750000, 3, 547, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {140250000, 140250000, 1, 187, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {146250000, 146250000, 1, 195, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {148250000, 148250000, 3, 593, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {154000000, 154000000, 3, 154, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {156000000, 156000000, 1, 52, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {156750000, 156750000, 1, 209, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {157000000, 157000000, 3, 157, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {157500000, 157500000, 1, 105, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {175500000, 175500000, 1, 117, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {179500000, 179500000, 3, 359, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {182750000, 182750000, 3, 731, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {187000000, 187000000, 3, 187, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {187250000, 187250000, 3, 749, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {189000000, 189000000, 1, 63, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {193250000, 193250000, 3, 773, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {202500000, 202500000, 1, 135, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {204750000, 204750000, 1, 273, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {208000000, 208000000, 3, 208, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {214750000, 214750000, 3, 859, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {218250000, 218250000, 1, 291, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {229500000, 229500000, 1, 153, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {234000000, 234000000, 1, 78, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {241500000, 241500000, 1, 161, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {245250000, 245250000, 1, 327, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {245500000, 245500000, 3, 491, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {261000000, 261000000, 1, 87, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {268250000, 268250000, 3, 1073, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {268500000, 268500000, 1, 179, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {281250000, 281250000, 1, 375, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {288000000, 288000000, 1, 96, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {312250000, 312250000, 3, 1249, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {317000000, 317000000, 3, 317, 0, 1, 1, 1, 0, 2, 2, 0, 0}, -+ {333250000, 333250000, 3, 1333, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {348500000, 348500000, 3, 697, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {356500000, 356500000, 3, 713, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {380500000, 380500000, 3, 761, 1, 1, 1, 1, 2, 2, 2, 0, 0}, -+ {443250000, 443250000, 1, 591, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {505250000, 505250000, 3, 2021, 1, 2, 2, 1, 2, 3, 4, 0, 0}, -+ {552750000, 552750000, 1, 737, 1, 2, 2, 1, 2, 3, 4, 0, 0}, - { ~0UL, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} - }; - -From c4bc7e7f44f76a7f6f2374956fd68cab657f1eb3 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 21 Jan 2018 17:20:00 +0100 -Subject: [PATCH] drm: fix HDR metadata infoframe length - -HDR metadata infoframe length is 26 bytes (not 30) according to [1] -(CTA-861-G: 6.9 Dynamic Range and Mastering InfoFrame) - -Fixes activation of HDR mode on my LG OLED - -[1] https://standards.cta.tech/kwspub/published_docs/CTA-861-G_FINAL_revised_2017.pdf ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 +- - drivers/gpu/drm/drm_edid.c | 4 ++-- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index ae498d097b61..018bef374dc3 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1857,7 +1857,7 @@ static void hdmi_config_hdr_infoframe(struct dw_hdmi *hdmi) - return; - } - -- hdmi_writeb(hdmi, 1, HDMI_FC_DRM_HB0); -+ hdmi_writeb(hdmi, frame.version, HDMI_FC_DRM_HB0); - hdmi_writeb(hdmi, frame.length, HDMI_FC_DRM_HB1); - hdmi_writeb(hdmi, frame.eotf, HDMI_FC_DRM_PB0); - hdmi_writeb(hdmi, frame.metadata_type, HDMI_FC_DRM_PB1); -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index bfe671071d9f..e3a0f561e8f0 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -4735,10 +4735,10 @@ drm_hdmi_infoframe_set_hdr_metadata(struct hdmi_drm_infoframe *frame, - - hdr_source_metadata = (struct hdr_static_metadata *)hdr_metadata; - -- frame->length = sizeof(struct hdr_static_metadata); -+ frame->length = 26; - - frame->eotf = hdr_source_metadata->eotf; -- frame->type = hdr_source_metadata->type; -+ frame->metadata_type = hdr_source_metadata->type; - - for (i = 0; i < 3; i++) { - frame->display_primaries_x[i] = - -From 3b4e87792660182b9f0093e016d41a7be53fe59e Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 27 Jan 2018 09:39:09 +0100 -Subject: [PATCH] drm: add edid detection for Hybrid Log-Gamma EOTF - ---- - drivers/gpu/drm/drm_edid.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index e3a0f561e8f0..f7d41950614e 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -2740,7 +2740,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid, - #define TRADITIONAL_GAMMA_SDR (0x1 << 0) - #define TRADITIONAL_GAMMA_HDR (0x1 << 1) - #define SMPTE_ST2084 (0x1 << 2) --#define FUTURE_EOTF (0x1 << 3) -+#define HYBRID_LOG_GAMMA (0x1 << 3) - #define RESERVED_EOTF (0x3 << 4) - - #define STATIC_METADATA_TYPE1 (0x1 << 0) -@@ -3710,6 +3710,8 @@ static uint16_t eotf_supported(const u8 *edid_ext) - val |= TRADITIONAL_GAMMA_HDR; - if (edid_ext[2] & SMPTE_ST2084) - val |= SMPTE_ST2084; -+ if (edid_ext[2] & HYBRID_LOG_GAMMA) -+ val |= HYBRID_LOG_GAMMA; - - return val; - } - -From a11ad9338755a57859c7ca1b54b7719fb644a5ef Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 11 Feb 2018 19:21:41 +0100 -Subject: [PATCH] drm: bridge: dw-hdmi: default to underscan mode - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 018bef374dc3..d0866baa75fc 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1691,7 +1691,7 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - break; - } - -- frame.scan_mode = HDMI_SCAN_MODE_NONE; -+ frame.scan_mode = HDMI_SCAN_MODE_UNDERSCAN; - - /* - * The Designware IP uses a different byte format from standard - -From cb40442a2cd891541ac55381a2610f61f9d56fa9 Mon Sep 17 00:00:00 2001 -From: David Carrillo-Cisneros -Date: Tue, 18 Jul 2017 18:18:37 -0700 -Subject: [PATCH] UPSTREAM: perf tools: Add EXCLUDE_EXTLIBS and EXTRA_PERFLIBS - to makefile - -The goal is to allow users to override linking of libraries that -were automatically added to PERFLIBS. - -EXCLUDE_EXTLIBS contains linker flags to be removed from LIBS -while EXTRA_PERFLIBS contains linker flags to be added. - -My use case is to force certain library to be build statically, -e.g. for libelf: - - EXCLUDE_EXTLIBS=-lelf EXTRA_PERFLIBS=path/libelf.a - -Signed-off-by: David Carrillo-Cisneros -Acked-by: Jiri Olsa -Cc: Alexander Shishkin -Cc: Elena Reshetova -Cc: Kees Kook -Cc: Paul Turner -Cc: Stephane Eranian -Cc: Sudeep Holla -Cc: Wang Nan -Link: http://lkml.kernel.org/r/20170719011839.99399-3-davidcc@google.com -Signed-off-by: Arnaldo Carvalho de Melo -(cherry picked from commit cb281fea4b0a326d2a2104f8ffae2b6895c561fd) ---- - tools/perf/Makefile.perf | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index fb1c9ddc3478..9b3b9bd50d54 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -33,6 +33,11 @@ include config/utilities.mak - # - # Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds. - # -+# Define EXCLUDE_EXTLIBS=-lmylib to exclude libmylib from the auto-generated -+# EXTLIBS. -+# -+# Define EXTRA_PERFLIBS to pass extra libraries to PERFLIBS. -+# - # Define NO_DWARF if you do not want debug-info analysis feature at all. - # - # Define WERROR=0 to disable treating any warnings as errors. -@@ -289,7 +294,8 @@ ifdef ASCIIDOC8 - export ASCIIDOC8 - endif - --LIBS = -Wl,--whole-archive $(PERFLIBS) -Wl,--no-whole-archive -Wl,--start-group $(EXTLIBS) -Wl,--end-group -+EXTLIBS := $(call filter-out,$(EXCLUDE_EXTLIBS),$(EXTLIBS)) -+LIBS = -Wl,--whole-archive $(PERFLIBS) $(EXTRA_PERFLIBS) -Wl,--no-whole-archive -Wl,--start-group $(EXTLIBS) -Wl,--end-group - - export INSTALL SHELL_PATH - - -From 6f95e5cdd43756df0bc1caa983f0f326a38bb9ff Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Tue, 27 Feb 2018 20:49:00 +0100 -Subject: [PATCH] net: wireless: rockchip_wlan: rtl8723bs: do not accept all - sdio wlan id - ---- - drivers/net/wireless/rockchip_wlan/rtl8723bs/Makefile | 2 +- - drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/sdio_intf.c | 3 +++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/Makefile b/drivers/net/wireless/rockchip_wlan/rtl8723bs/Makefile -index 0ff707fd37eb..ca79c18b8eb8 100644 ---- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/Makefile -+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/Makefile -@@ -1347,7 +1347,7 @@ EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ANDROID -DCONFIG_PLATFO - EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT - EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE - # default setting for Power control --EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC -+#EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC - EXTRA_CFLAGS += -DRTW_SUPPORT_PLATFORM_SHUTDOWN - EXTRA_CFLAGS += -DCONFIG_RESUME_IN_WORKQUEUE - # default setting for Special function -diff --git a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/sdio_intf.c b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/sdio_intf.c -index b4654d229634..48b6cf61d436 100644 ---- a/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/sdio_intf.c -+++ b/drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/sdio_intf.c -@@ -45,6 +45,9 @@ static struct mmc_host *mmc_host = NULL; - - static const struct sdio_device_id sdio_ids[] = { - #ifdef CONFIG_RTL8723B -+ { SDIO_DEVICE(0x024c, 0x0523), .driver_data = RTL8723B}, -+ { SDIO_DEVICE(0x024c, 0x0623), .driver_data = RTL8723B}, -+ { SDIO_DEVICE(0x024c, 0x0626), .driver_data = RTL8723B}, - { SDIO_DEVICE(0x024c, 0xB723), .driver_data = RTL8723B}, - #endif - #ifdef CONFIG_RTL8188E - -From 157645ba1282857bf4440707620c9ca91d8f8913 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Fri, 2 Mar 2018 20:53:32 +0100 -Subject: [PATCH] net: wireless: rockchip_wlan: bcmdhd: detect broadcom sdio - device id - ---- - drivers/net/wireless/rockchip_wlan/rkwifi/bcmdhd/bcmsdh_sdmmc_linux.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/rockchip_wlan/rkwifi/bcmdhd/bcmsdh_sdmmc_linux.c b/drivers/net/wireless/rockchip_wlan/rkwifi/bcmdhd/bcmsdh_sdmmc_linux.c -index 8864582b1706..b5a388cc3cbe 100755 ---- a/drivers/net/wireless/rockchip_wlan/rkwifi/bcmdhd/bcmsdh_sdmmc_linux.c -+++ b/drivers/net/wireless/rockchip_wlan/rkwifi/bcmdhd/bcmsdh_sdmmc_linux.c -@@ -225,7 +225,7 @@ static const struct sdio_device_id bcmsdh_sdmmc_ids[] = { - { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334) }, - { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4324) }, - { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43239) }, -- { SDIO_DEVICE_CLASS(SDIO_CLASS_NONE) }, -+ { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_ANY_ID) }, - { 0, 0, 0, 0 /* end: all zeroes */ - }, - }; - -From 00c9d5749537dacbd745ce3456f1335cbe019d54 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 1 Jul 2018 23:17:47 +0200 -Subject: [PATCH] drm/rockchip: clip yuv - ---- - drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 ++ - drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 2 ++ - drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 3 +++ - 3 files changed, 7 insertions(+) - -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -index 784e83537692..7073ea91c349 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c -@@ -1712,6 +1712,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane, - - spin_lock(&vop->reg_lock); - -+ VOP_WIN_SET(vop, win, yuv_clip, 1); - VOP_WIN_SET(vop, win, xmirror, xmirror); - VOP_WIN_SET(vop, win, ymirror, ymirror); - VOP_WIN_SET(vop, win, format, vop_plane_state->format); -@@ -2512,6 +2513,7 @@ static void vop_update_csc(struct drm_crtc *crtc) - VOP_CTRL_SET(vop, dsp_data_swap, 0); - - VOP_CTRL_SET(vop, out_mode, s->output_mode); -+ VOP_CTRL_SET(vop, yuv_clip, 1); - - switch (s->bus_format) { - case MEDIA_BUS_FMT_RGB565_1X16: -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -index 5850572b40ff..b465c08876f8 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h -@@ -171,6 +171,7 @@ struct vop_ctrl { - struct vop_reg dsp_lut_en; - - struct vop_reg out_mode; -+ struct vop_reg yuv_clip; - - struct vop_reg xmirror; - struct vop_reg ymirror; -@@ -395,6 +396,7 @@ struct vop_win_phy { - struct vop_reg format; - struct vop_reg fmt_10; - struct vop_reg csc_mode; -+ struct vop_reg yuv_clip; - struct vop_reg xmirror; - struct vop_reg ymirror; - struct vop_reg rb_swap; -diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c -index 5f517e193cc8..f03009e304f8 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c -+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c -@@ -110,6 +110,7 @@ static const struct vop_win_phy rk3288_win01_data = { - .fmt_10 = VOP_REG(RK3288_WIN0_CTRL0, 0x7, 4), - .csc_mode = VOP_REG_VER(RK3288_WIN0_CTRL0, 0x3, 10, 3, 2, -1), - .rb_swap = VOP_REG(RK3288_WIN0_CTRL0, 0x1, 12), -+ .yuv_clip = VOP_REG(RK3288_WIN0_CTRL0, 0x1, 20), - .xmirror = VOP_REG_VER(RK3368_WIN0_CTRL0, 0x1, 21, 3, 2, -1), - .ymirror = VOP_REG_VER(RK3368_WIN0_CTRL0, 0x1, 22, 3, 2, -1), - .act_info = VOP_REG(RK3288_WIN0_ACT_INFO, 0x1fff1fff, 0), -@@ -277,6 +278,7 @@ static const struct vop_ctrl rk3288_ctrl_data = { - .bcsh_color_bar = VOP_REG(RK3288_BCSH_COLOR_BAR, 0xffffff, 8), - .bcsh_en = VOP_REG(RK3288_BCSH_COLOR_BAR, 0x1, 0), - -+ .yuv_clip = VOP_REG(RK3288_DSP_CTRL0, 0x1, 21), - .xmirror = VOP_REG(RK3288_DSP_CTRL0, 0x1, 22), - .ymirror = VOP_REG(RK3288_DSP_CTRL0, 0x1, 23), - -@@ -955,6 +957,7 @@ static const struct vop_ctrl rk3328_ctrl_data = { - .dsp_lut_en = VOP_REG(RK3328_DSP_CTRL1, 0x1, 0), - .out_mode = VOP_REG(RK3328_DSP_CTRL0, 0xf, 0), - -+ .yuv_clip = VOP_REG(RK3328_DSP_CTRL0, 0x1, 21), - .xmirror = VOP_REG(RK3328_DSP_CTRL0, 0x1, 22), - .ymirror = VOP_REG(RK3328_DSP_CTRL0, 0x1, 23), - - -From 93fb1cdc962e44ce72fec1191e0bf200c9aaf130 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 8 Jul 2018 12:38:00 +0200 -Subject: [PATCH] drm/atomic: use active_only flag for connector atomic - begin/flush - ---- - drivers/gpu/drm/drm_atomic_helper.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c -index f77d4aa1e58b..4da489b54dc5 100644 ---- a/drivers/gpu/drm/drm_atomic_helper.c -+++ b/drivers/gpu/drm/drm_atomic_helper.c -@@ -1563,15 +1563,15 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev, - for_each_connector_in_state(old_state, connector, old_conn_state, i) { - const struct drm_connector_helper_funcs *funcs; - -- if (!connector->state->crtc) -- continue; -+ funcs = connector->helper_private; - -- if (!connector->state->crtc->state->active) -+ if (!funcs || !funcs->atomic_begin) - continue; - -- funcs = connector->helper_private; -+ if (!connector->state->crtc) -+ continue; - -- if (!funcs || !funcs->atomic_begin) -+ if (active_only && !connector->state->crtc->state->active) - continue; - - DRM_DEBUG_ATOMIC("flush beginning [CONNECTOR:%d:%s]\n", -@@ -1645,15 +1645,15 @@ void drm_atomic_helper_commit_planes(struct drm_device *dev, - for_each_connector_in_state(old_state, connector, old_conn_state, i) { - const struct drm_connector_helper_funcs *funcs; - -- if (!connector->state->crtc) -- continue; -+ funcs = connector->helper_private; - -- if (!connector->state->crtc->state->active) -+ if (!funcs || !funcs->atomic_flush) - continue; - -- funcs = connector->helper_private; -+ if (!connector->state->crtc) -+ continue; - -- if (!funcs || !funcs->atomic_flush) -+ if (active_only && !connector->state->crtc->state->active) - continue; - - DRM_DEBUG_ATOMIC("flushing [CONNECTOR:%d:%s]\n", - -From d0f8100f82203017bac6617d3f0e30b524956d36 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 22 Jul 2018 14:51:58 +0200 -Subject: [PATCH] drm: rockchip: dw-hdmi: only force YCbCr422 when max tmds is - up to 340Mhz - ---- - drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -index 7273561fe6b1..e2aad6e2149b 100644 ---- a/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -+++ b/drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c -@@ -728,7 +728,9 @@ dw_hdmi_rockchip_select_output(struct drm_connector_state *conn_state, - /* BT2020 require color depth at lest 10bit */ - *color_depth = 10; - /* We prefer use YCbCr422 to send 10bit */ -- if (info->color_formats & DRM_COLOR_FORMAT_YCRCB422) -+ if (info->color_formats & DRM_COLOR_FORMAT_YCRCB422 && -+ info->max_tmds_clock <= 340000 && -+ hdmi->dev_type != RK3288_HDMI) - *color_format = DRM_HDMI_OUTPUT_YCBCR422; - } - - -From d093be3d79b5c781719298676282e44b7d7bb290 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 22 Jul 2018 15:09:16 +0200 -Subject: [PATCH] drm: bridge: dw-hdmi: signal full range for rgb output - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index d0866baa75fc..520f87b88130 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1693,6 +1693,14 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - - frame.scan_mode = HDMI_SCAN_MODE_UNDERSCAN; - -+ if (hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { -+ frame.quantization_range = HDMI_QUANTIZATION_RANGE_FULL; -+ frame.ycc_quantization_range = HDMI_YCC_QUANTIZATION_RANGE_FULL; -+ } else { -+ frame.quantization_range = HDMI_QUANTIZATION_RANGE_LIMITED; -+ frame.ycc_quantization_range = HDMI_YCC_QUANTIZATION_RANGE_LIMITED; -+ } -+ - /* - * The Designware IP uses a different byte format from standard - * AVI info frames, though generally the bits are in the correct - -From 623aaf53edd860816297c9230d39b5b96b0146f3 Mon Sep 17 00:00:00 2001 -From: Myy Miouyouyou -Date: Mon, 21 May 2018 22:32:59 +0200 -Subject: [PATCH] GPU: ARM: Midgard: Adapt to the new mmap call checks. - -Now, I don't know if this driver is just one of these "buggy" drivers -Linus is talking about, or if this is just standard GPU procedure. - -Anyway, this patch is due to this change by Linus Torvalds : -https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be83bbf806822b1b89e0a0f23cd87cddc409e429 - -And the fix is inspired by : -https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=76ef6b28ea4f81c3d511866a9b31392caa833126 - -Signed-off-by: Myy Miouyouyou ---- - drivers/gpu/arm/midgard/mali_kbase_core_linux.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/gpu/arm/midgard/mali_kbase_core_linux.c b/drivers/gpu/arm/midgard/mali_kbase_core_linux.c -index 3a6e5aae0bce..2b24e415dfa6 100644 ---- a/drivers/gpu/arm/midgard/mali_kbase_core_linux.c -+++ b/drivers/gpu/arm/midgard/mali_kbase_core_linux.c -@@ -1155,6 +1155,7 @@ static int kbase_open(struct inode *inode, struct file *filp) - - init_waitqueue_head(&kctx->event_queue); - filp->private_data = kctx; -+ filp->f_mode |= FMODE_UNSIGNED_OFFSET; - kctx->filp = filp; - - if (kbdev->infinite_cache_active_default) - -From d0e509162ace165ab24c8a005a2666c6c17e4d69 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 28 Jul 2018 10:41:40 +0200 -Subject: [PATCH] WIP: mm: dma-mapping: increase dma pool size - ---- - arch/arm/mm/dma-mapping.c | 2 +- - arch/arm64/mm/dma-mapping.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index d539dee3c78d..689961153d71 100644 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -301,7 +301,7 @@ static void __dma_free_remap(void *cpu_addr, size_t size) - VM_ARM_DMA_CONSISTENT | VM_USERMAP); - } - --#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_256K -+#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_2M - static struct gen_pool *atomic_pool; - - static size_t atomic_pool_size = DEFAULT_DMA_COHERENT_POOL_SIZE; -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index 2b05653e8156..2ad8515cd4da 100644 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -32,7 +32,7 @@ - - static struct gen_pool *atomic_pool; - --#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_256K -+#define DEFAULT_DMA_COHERENT_POOL_SIZE SZ_2M - static size_t atomic_pool_size __initdata = DEFAULT_DMA_COHERENT_POOL_SIZE; - - static int __init early_coherent_pool(char *p) - -From 9cfc544f5914ccf2a44da96e491195eea763d70f Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 4 Aug 2018 15:19:39 +0200 -Subject: [PATCH] drm: add picture_aspect_ratio to hdmi 1.4 4k modes - ---- - drivers/gpu/drm/drm_edid.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index f7d41950614e..69a1eb4ee382 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -1233,25 +1233,25 @@ static const struct drm_display_mode edid_4k_modes[] = { - 3840, 4016, 4104, 4400, 0, - 2160, 2168, 2178, 2250, 0, - DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), -- .vrefresh = 30, }, -+ .vrefresh = 30, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, - /* 2 - 3840x2160@25Hz */ - { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000, - 3840, 4896, 4984, 5280, 0, - 2160, 2168, 2178, 2250, 0, - DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), -- .vrefresh = 25, }, -+ .vrefresh = 25, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, - /* 3 - 3840x2160@24Hz */ - { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000, - 3840, 5116, 5204, 5500, 0, - 2160, 2168, 2178, 2250, 0, - DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), -- .vrefresh = 24, }, -+ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, }, - /* 4 - 4096x2160@24Hz (SMPTE) */ - { DRM_MODE("4096x2160", DRM_MODE_TYPE_DRIVER, 297000, - 4096, 5116, 5204, 5500, 0, - 2160, 2168, 2178, 2250, 0, - DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), -- .vrefresh = 24, }, -+ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_256_135, }, - }; - - /*** DDC fetch and block validation ***/ - -From 728a068901826027cf45d404f49b58f6cf02156a Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 4 Aug 2018 16:26:47 +0200 -Subject: [PATCH] drm: bridge: dw-hdmi: signal none colorimetry for rgb output - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 520f87b88130..c6ef3d43f997 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1694,6 +1694,8 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - frame.scan_mode = HDMI_SCAN_MODE_UNDERSCAN; - - if (hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { -+ frame.colorimetry = HDMI_COLORIMETRY_NONE; -+ frame.extended_colorimetry = 0; - frame.quantization_range = HDMI_QUANTIZATION_RANGE_FULL; - frame.ycc_quantization_range = HDMI_YCC_QUANTIZATION_RANGE_FULL; - } else { - -From bc7d29237337d1506fe63bbb421d64710e176537 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 4 Aug 2018 16:27:08 +0200 -Subject: [PATCH] drm: bridge: dw-hdmi: signal it content and content type - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index c6ef3d43f997..a0e25278232b 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1692,6 +1692,8 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - } - - frame.scan_mode = HDMI_SCAN_MODE_UNDERSCAN; -+ frame.content_type = HDMI_CONTENT_TYPE_GRAPHICS; -+ frame.itc = true; - - if (hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) { - frame.colorimetry = HDMI_COLORIMETRY_NONE; - -From d0b82f5649ddb897cbf92f5e06030244ffc4e9eb Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 4 Aug 2018 16:27:40 +0200 -Subject: [PATCH] drm: bridge: dw-hdmi: log infoframes - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index a0e25278232b..f56f3224a1c9 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -1705,6 +1705,8 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - frame.ycc_quantization_range = HDMI_YCC_QUANTIZATION_RANGE_LIMITED; - } - -+ hdmi_infoframe_log(KERN_INFO, hdmi->dev, &frame); -+ - /* - * The Designware IP uses a different byte format from standard - * AVI info frames, though generally the bits are in the correct -@@ -1798,6 +1800,8 @@ static void hdmi_config_vendor_specific_infoframe(struct dw_hdmi *hdmi, - return; - } - -+ hdmi_infoframe_log(KERN_INFO, hdmi->dev, &frame); -+ - /* Set the length of HDMI vendor specific InfoFrame payload */ - hdmi_writeb(hdmi, buffer[2], HDMI_FC_VSDSIZE); - -@@ -1838,7 +1842,7 @@ static void hdmi_config_hdr_infoframe(struct dw_hdmi *hdmi) - - /* Dynamic Range and Mastering Infoframe is introduced in v2.11a. */ - if (hdmi->version < 0x211a) { -- DRM_ERROR("Not support DRM Infoframe\n"); -+ DRM_DEBUG("Not support DRM Infoframe\n"); - return; - } - -@@ -1869,6 +1873,8 @@ static void hdmi_config_hdr_infoframe(struct dw_hdmi *hdmi) - return; - } - -+ hdmi_infoframe_log(KERN_INFO, hdmi->dev, &frame); -+ - hdmi_writeb(hdmi, frame.version, HDMI_FC_DRM_HB0); - hdmi_writeb(hdmi, frame.length, HDMI_FC_DRM_HB1); - hdmi_writeb(hdmi, frame.eotf, HDMI_FC_DRM_PB0); - diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0003-cec.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0003-cec.patch deleted file mode 100644 index a5510754e063..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0003-cec.patch +++ /dev/null @@ -1,4509 +0,0 @@ -From dbd999a2a4e11f420098860e84bfb3c9151b4622 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 4 Sep 2017 22:34:19 +0200 -Subject: [PATCH] BACKPORT: HDMI CEC support from v4.15 - -Skipped changes: -857313e51006ff51524579bcd8808b70f9a80812 "media: utilize new cdev_device_add helper function" -0f7499fddb153a333dff3c1dc4280c178b9b5a80 "[media] rc-main: assign driver type during allocation" ---- - Documentation/devicetree/bindings/media/cec.txt | 8 + - Documentation/media/kapi/cec-core.rst | 381 +++++++++++++++++++++ - Documentation/media/uapi/cec/cec-api.rst | 46 +++ - Documentation/media/uapi/cec/cec-func-close.rst | 47 +++ - Documentation/media/uapi/cec/cec-func-ioctl.rst | 66 ++++ - Documentation/media/uapi/cec/cec-func-open.rst | 78 +++++ - Documentation/media/uapi/cec/cec-func-poll.rst | 77 +++++ - Documentation/media/uapi/cec/cec-funcs.rst | 20 ++ - Documentation/media/uapi/cec/cec-header.rst | 10 + - Documentation/media/uapi/cec/cec-intro.rst | 40 +++ - .../media/uapi/cec/cec-ioc-adap-g-caps.rst | 139 ++++++++ - .../media/uapi/cec/cec-ioc-adap-g-log-addrs.rst | 371 ++++++++++++++++++++ - .../media/uapi/cec/cec-ioc-adap-g-phys-addr.rst | 93 +++++ - Documentation/media/uapi/cec/cec-ioc-dqevent.rst | 226 ++++++++++++ - Documentation/media/uapi/cec/cec-ioc-g-mode.rst | 293 ++++++++++++++++ - Documentation/media/uapi/cec/cec-ioc-receive.rst | 344 +++++++++++++++++++ - MAINTAINERS | 16 + - drivers/media/cec/cec-adap.c | 61 +++- - drivers/media/cec/cec-core.c | 15 +- - drivers/media/rc/keymaps/Makefile | 1 + - drivers/media/rc/keymaps/rc-cec.c | 182 ++++++++++ - drivers/media/rc/rc-main.c | 1 + - fs/compat_ioctl.c | 12 + - include/media/cec-notifier.h | 22 ++ - include/media/cec.h | 32 +- - include/media/rc-map.h | 5 +- - include/uapi/linux/cec-funcs.h | 1 + - include/uapi/linux/cec.h | 2 +- - include/uapi/linux/input-event-codes.h | 31 ++ - include/uapi/linux/input.h | 1 + - 30 files changed, 2606 insertions(+), 15 deletions(-) - create mode 100644 Documentation/devicetree/bindings/media/cec.txt - create mode 100644 Documentation/media/kapi/cec-core.rst - create mode 100644 Documentation/media/uapi/cec/cec-api.rst - create mode 100644 Documentation/media/uapi/cec/cec-func-close.rst - create mode 100644 Documentation/media/uapi/cec/cec-func-ioctl.rst - create mode 100644 Documentation/media/uapi/cec/cec-func-open.rst - create mode 100644 Documentation/media/uapi/cec/cec-func-poll.rst - create mode 100644 Documentation/media/uapi/cec/cec-funcs.rst - create mode 100644 Documentation/media/uapi/cec/cec-header.rst - create mode 100644 Documentation/media/uapi/cec/cec-intro.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-dqevent.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-g-mode.rst - create mode 100644 Documentation/media/uapi/cec/cec-ioc-receive.rst - create mode 100644 drivers/media/rc/keymaps/rc-cec.c - -diff --git a/Documentation/devicetree/bindings/media/cec.txt b/Documentation/devicetree/bindings/media/cec.txt -new file mode 100644 -index 000000000000..22d7aae3d3d7 ---- /dev/null -+++ b/Documentation/devicetree/bindings/media/cec.txt -@@ -0,0 +1,8 @@ -+Common bindings for HDMI CEC adapters -+ -+- hdmi-phandle: phandle to the HDMI controller. -+ -+- needs-hpd: if present the CEC support is only available when the HPD -+ is high. Some boards only let the CEC pin through if the HPD is high, -+ for example if there is a level converter that uses the HPD to power -+ up or down. -diff --git a/Documentation/media/kapi/cec-core.rst b/Documentation/media/kapi/cec-core.rst -new file mode 100644 -index 000000000000..d37e107f2fde ---- /dev/null -+++ b/Documentation/media/kapi/cec-core.rst -@@ -0,0 +1,381 @@ -+CEC Kernel Support -+================== -+ -+The CEC framework provides a unified kernel interface for use with HDMI CEC -+hardware. It is designed to handle a multiple types of hardware (receivers, -+transmitters, USB dongles). The framework also gives the option to decide -+what to do in the kernel driver and what should be handled by userspace -+applications. In addition it integrates the remote control passthrough -+feature into the kernel's remote control framework. -+ -+ -+The CEC Protocol -+---------------- -+ -+The CEC protocol enables consumer electronic devices to communicate with each -+other through the HDMI connection. The protocol uses logical addresses in the -+communication. The logical address is strictly connected with the functionality -+provided by the device. The TV acting as the communication hub is always -+assigned address 0. The physical address is determined by the physical -+connection between devices. -+ -+The CEC framework described here is up to date with the CEC 2.0 specification. -+It is documented in the HDMI 1.4 specification with the new 2.0 bits documented -+in the HDMI 2.0 specification. But for most of the features the freely available -+HDMI 1.3a specification is sufficient: -+ -+http://www.microprocessor.org/HDMISpecification13a.pdf -+ -+ -+CEC Adapter Interface -+--------------------- -+ -+The struct cec_adapter represents the CEC adapter hardware. It is created by -+calling cec_allocate_adapter() and deleted by calling cec_delete_adapter(): -+ -+.. c:function:: -+ struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops, void *priv, -+ const char *name, u32 caps, u8 available_las); -+ -+.. c:function:: -+ void cec_delete_adapter(struct cec_adapter *adap); -+ -+To create an adapter you need to pass the following information: -+ -+ops: -+ adapter operations which are called by the CEC framework and that you -+ have to implement. -+ -+priv: -+ will be stored in adap->priv and can be used by the adapter ops. -+ Use cec_get_drvdata(adap) to get the priv pointer. -+ -+name: -+ the name of the CEC adapter. Note: this name will be copied. -+ -+caps: -+ capabilities of the CEC adapter. These capabilities determine the -+ capabilities of the hardware and which parts are to be handled -+ by userspace and which parts are handled by kernelspace. The -+ capabilities are returned by CEC_ADAP_G_CAPS. -+ -+available_las: -+ the number of simultaneous logical addresses that this -+ adapter can handle. Must be 1 <= available_las <= CEC_MAX_LOG_ADDRS. -+ -+To obtain the priv pointer use this helper function: -+ -+.. c:function:: -+ void *cec_get_drvdata(const struct cec_adapter *adap); -+ -+To register the /dev/cecX device node and the remote control device (if -+CEC_CAP_RC is set) you call: -+ -+.. c:function:: -+ int cec_register_adapter(struct cec_adapter *adap, struct device *parent); -+ -+where parent is the parent device. -+ -+To unregister the devices call: -+ -+.. c:function:: -+ void cec_unregister_adapter(struct cec_adapter *adap); -+ -+Note: if cec_register_adapter() fails, then call cec_delete_adapter() to -+clean up. But if cec_register_adapter() succeeded, then only call -+cec_unregister_adapter() to clean up, never cec_delete_adapter(). The -+unregister function will delete the adapter automatically once the last user -+of that /dev/cecX device has closed its file handle. -+ -+ -+Implementing the Low-Level CEC Adapter -+-------------------------------------- -+ -+The following low-level adapter operations have to be implemented in -+your driver: -+ -+.. c:type:: struct cec_adap_ops -+ -+.. code-block:: none -+ -+ struct cec_adap_ops -+ { -+ /* Low-level callbacks */ -+ int (*adap_enable)(struct cec_adapter *adap, bool enable); -+ int (*adap_monitor_all_enable)(struct cec_adapter *adap, bool enable); -+ int (*adap_log_addr)(struct cec_adapter *adap, u8 logical_addr); -+ int (*adap_transmit)(struct cec_adapter *adap, u8 attempts, -+ u32 signal_free_time, struct cec_msg *msg); -+ void (*adap_status)(struct cec_adapter *adap, struct seq_file *file); -+ void (*adap_free)(struct cec_adapter *adap); -+ -+ /* High-level callbacks */ -+ ... -+ }; -+ -+The five low-level ops deal with various aspects of controlling the CEC adapter -+hardware: -+ -+ -+To enable/disable the hardware: -+ -+.. c:function:: -+ int (*adap_enable)(struct cec_adapter *adap, bool enable); -+ -+This callback enables or disables the CEC hardware. Enabling the CEC hardware -+means powering it up in a state where no logical addresses are claimed. This -+op assumes that the physical address (adap->phys_addr) is valid when enable is -+true and will not change while the CEC adapter remains enabled. The initial -+state of the CEC adapter after calling cec_allocate_adapter() is disabled. -+ -+Note that adap_enable must return 0 if enable is false. -+ -+ -+To enable/disable the 'monitor all' mode: -+ -+.. c:function:: -+ int (*adap_monitor_all_enable)(struct cec_adapter *adap, bool enable); -+ -+If enabled, then the adapter should be put in a mode to also monitor messages -+that not for us. Not all hardware supports this and this function is only -+called if the CEC_CAP_MONITOR_ALL capability is set. This callback is optional -+(some hardware may always be in 'monitor all' mode). -+ -+Note that adap_monitor_all_enable must return 0 if enable is false. -+ -+ -+To program a new logical address: -+ -+.. c:function:: -+ int (*adap_log_addr)(struct cec_adapter *adap, u8 logical_addr); -+ -+If logical_addr == CEC_LOG_ADDR_INVALID then all programmed logical addresses -+are to be erased. Otherwise the given logical address should be programmed. -+If the maximum number of available logical addresses is exceeded, then it -+should return -ENXIO. Once a logical address is programmed the CEC hardware -+can receive directed messages to that address. -+ -+Note that adap_log_addr must return 0 if logical_addr is CEC_LOG_ADDR_INVALID. -+ -+ -+To transmit a new message: -+ -+.. c:function:: -+ int (*adap_transmit)(struct cec_adapter *adap, u8 attempts, -+ u32 signal_free_time, struct cec_msg *msg); -+ -+This transmits a new message. The attempts argument is the suggested number of -+attempts for the transmit. -+ -+The signal_free_time is the number of data bit periods that the adapter should -+wait when the line is free before attempting to send a message. This value -+depends on whether this transmit is a retry, a message from a new initiator or -+a new message for the same initiator. Most hardware will handle this -+automatically, but in some cases this information is needed. -+ -+The CEC_FREE_TIME_TO_USEC macro can be used to convert signal_free_time to -+microseconds (one data bit period is 2.4 ms). -+ -+ -+To log the current CEC hardware status: -+ -+.. c:function:: -+ void (*adap_status)(struct cec_adapter *adap, struct seq_file *file); -+ -+This optional callback can be used to show the status of the CEC hardware. -+The status is available through debugfs: cat /sys/kernel/debug/cec/cecX/status -+ -+To free any resources when the adapter is deleted: -+ -+.. c:function:: -+ void (*adap_free)(struct cec_adapter *adap); -+ -+This optional callback can be used to free any resources that might have been -+allocated by the driver. It's called from cec_delete_adapter. -+ -+ -+Your adapter driver will also have to react to events (typically interrupt -+driven) by calling into the framework in the following situations: -+ -+When a transmit finished (successfully or otherwise): -+ -+.. c:function:: -+ void cec_transmit_done(struct cec_adapter *adap, u8 status, u8 arb_lost_cnt, -+ u8 nack_cnt, u8 low_drive_cnt, u8 error_cnt); -+ -+or: -+ -+.. c:function:: -+ void cec_transmit_attempt_done(struct cec_adapter *adap, u8 status); -+ -+The status can be one of: -+ -+CEC_TX_STATUS_OK: -+ the transmit was successful. -+ -+CEC_TX_STATUS_ARB_LOST: -+ arbitration was lost: another CEC initiator -+ took control of the CEC line and you lost the arbitration. -+ -+CEC_TX_STATUS_NACK: -+ the message was nacked (for a directed message) or -+ acked (for a broadcast message). A retransmission is needed. -+ -+CEC_TX_STATUS_LOW_DRIVE: -+ low drive was detected on the CEC bus. This indicates that -+ a follower detected an error on the bus and requested a -+ retransmission. -+ -+CEC_TX_STATUS_ERROR: -+ some unspecified error occurred: this can be one of ARB_LOST -+ or LOW_DRIVE if the hardware cannot differentiate or something -+ else entirely. -+ -+CEC_TX_STATUS_MAX_RETRIES: -+ could not transmit the message after trying multiple times. -+ Should only be set by the driver if it has hardware support for -+ retrying messages. If set, then the framework assumes that it -+ doesn't have to make another attempt to transmit the message -+ since the hardware did that already. -+ -+The hardware must be able to differentiate between OK, NACK and 'something -+else'. -+ -+The \*_cnt arguments are the number of error conditions that were seen. -+This may be 0 if no information is available. Drivers that do not support -+hardware retry can just set the counter corresponding to the transmit error -+to 1, if the hardware does support retry then either set these counters to -+0 if the hardware provides no feedback of which errors occurred and how many -+times, or fill in the correct values as reported by the hardware. -+ -+The cec_transmit_attempt_done() function is a helper for cases where the -+hardware never retries, so the transmit is always for just a single -+attempt. It will call cec_transmit_done() in turn, filling in 1 for the -+count argument corresponding to the status. Or all 0 if the status was OK. -+ -+When a CEC message was received: -+ -+.. c:function:: -+ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg); -+ -+Speaks for itself. -+ -+Implementing the interrupt handler -+---------------------------------- -+ -+Typically the CEC hardware provides interrupts that signal when a transmit -+finished and whether it was successful or not, and it provides and interrupt -+when a CEC message was received. -+ -+The CEC driver should always process the transmit interrupts first before -+handling the receive interrupt. The framework expects to see the cec_transmit_done -+call before the cec_received_msg call, otherwise it can get confused if the -+received message was in reply to the transmitted message. -+ -+Implementing the High-Level CEC Adapter -+--------------------------------------- -+ -+The low-level operations drive the hardware, the high-level operations are -+CEC protocol driven. The following high-level callbacks are available: -+ -+.. code-block:: none -+ -+ struct cec_adap_ops { -+ /* Low-level callbacks */ -+ ... -+ -+ /* High-level CEC message callback */ -+ int (*received)(struct cec_adapter *adap, struct cec_msg *msg); -+ }; -+ -+The received() callback allows the driver to optionally handle a newly -+received CEC message -+ -+.. c:function:: -+ int (*received)(struct cec_adapter *adap, struct cec_msg *msg); -+ -+If the driver wants to process a CEC message, then it can implement this -+callback. If it doesn't want to handle this message, then it should return -+-ENOMSG, otherwise the CEC framework assumes it processed this message and -+it will not do anything with it. -+ -+ -+CEC framework functions -+----------------------- -+ -+CEC Adapter drivers can call the following CEC framework functions: -+ -+.. c:function:: -+ int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg, -+ bool block); -+ -+Transmit a CEC message. If block is true, then wait until the message has been -+transmitted, otherwise just queue it and return. -+ -+.. c:function:: -+ void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, -+ bool block); -+ -+Change the physical address. This function will set adap->phys_addr and -+send an event if it has changed. If cec_s_log_addrs() has been called and -+the physical address has become valid, then the CEC framework will start -+claiming the logical addresses. If block is true, then this function won't -+return until this process has finished. -+ -+When the physical address is set to a valid value the CEC adapter will -+be enabled (see the adap_enable op). When it is set to CEC_PHYS_ADDR_INVALID, -+then the CEC adapter will be disabled. If you change a valid physical address -+to another valid physical address, then this function will first set the -+address to CEC_PHYS_ADDR_INVALID before enabling the new physical address. -+ -+.. c:function:: -+ void cec_s_phys_addr_from_edid(struct cec_adapter *adap, -+ const struct edid *edid); -+ -+A helper function that extracts the physical address from the edid struct -+and calls cec_s_phys_addr() with that address, or CEC_PHYS_ADDR_INVALID -+if the EDID did not contain a physical address or edid was a NULL pointer. -+ -+.. c:function:: -+ int cec_s_log_addrs(struct cec_adapter *adap, -+ struct cec_log_addrs *log_addrs, bool block); -+ -+Claim the CEC logical addresses. Should never be called if CEC_CAP_LOG_ADDRS -+is set. If block is true, then wait until the logical addresses have been -+claimed, otherwise just queue it and return. To unconfigure all logical -+addresses call this function with log_addrs set to NULL or with -+log_addrs->num_log_addrs set to 0. The block argument is ignored when -+unconfiguring. This function will just return if the physical address is -+invalid. Once the physical address becomes valid, then the framework will -+attempt to claim these logical addresses. -+ -+CEC Pin framework -+----------------- -+ -+Most CEC hardware operates on full CEC messages where the software provides -+the message and the hardware handles the low-level CEC protocol. But some -+hardware only drives the CEC pin and software has to handle the low-level -+CEC protocol. The CEC pin framework was created to handle such devices. -+ -+Note that due to the close-to-realtime requirements it can never be guaranteed -+to work 100%. This framework uses highres timers internally, but if a -+timer goes off too late by more than 300 microseconds wrong results can -+occur. In reality it appears to be fairly reliable. -+ -+One advantage of this low-level implementation is that it can be used as -+a cheap CEC analyser, especially if interrupts can be used to detect -+CEC pin transitions from low to high or vice versa. -+ -+.. kernel-doc:: include/media/cec-pin.h -+ -+CEC Notifier framework -+---------------------- -+ -+Most drm HDMI implementations have an integrated CEC implementation and no -+notifier support is needed. But some have independent CEC implementations -+that have their own driver. This could be an IP block for an SoC or a -+completely separate chip that deals with the CEC pin. For those cases a -+drm driver can install a notifier and use the notifier to inform the -+CEC driver about changes in the physical address. -+ -+.. kernel-doc:: include/media/cec-notifier.h -diff --git a/Documentation/media/uapi/cec/cec-api.rst b/Documentation/media/uapi/cec/cec-api.rst -new file mode 100644 -index 000000000000..b68ca9c1d2e0 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-api.rst -@@ -0,0 +1,46 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. include:: -+ -+.. _cec: -+ -+######################################### -+Part V - Consumer Electronics Control API -+######################################### -+ -+This part describes the CEC: Consumer Electronics Control -+ -+ -+.. only:: html -+ -+ .. class:: toc-title -+ -+ Table of Contents -+ -+.. toctree:: -+ :maxdepth: 5 -+ :numbered: -+ -+ cec-intro -+ cec-funcs -+ cec-header -+ -+ -+********************** -+Revision and Copyright -+********************** -+Authors: -+ -+- Verkuil, Hans -+ -+ - Initial version. -+ -+**Copyright** |copy| 2016 : Hans Verkuil -+ -+**************** -+Revision History -+**************** -+ -+:revision: 1.0.0 / 2016-03-17 (*hv*) -+ -+Initial revision -diff --git a/Documentation/media/uapi/cec/cec-func-close.rst b/Documentation/media/uapi/cec/cec-func-close.rst -new file mode 100644 -index 000000000000..334358dfa72e ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-func-close.rst -@@ -0,0 +1,47 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _cec-func-close: -+ -+*********** -+cec close() -+*********** -+ -+Name -+==== -+ -+cec-close - Close a cec device -+ -+ -+Synopsis -+======== -+ -+.. code-block:: c -+ -+ #include -+ -+ -+.. c:function:: int close( int fd ) -+ :name: cec-close -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+ -+Description -+=========== -+ -+Closes the cec device. Resources associated with the file descriptor are -+freed. The device configuration remain unchanged. -+ -+ -+Return Value -+============ -+ -+:c:func:`close() ` returns 0 on success. On error, -1 is returned, and -+``errno`` is set appropriately. Possible error codes are: -+ -+``EBADF`` -+ ``fd`` is not a valid open file descriptor. -diff --git a/Documentation/media/uapi/cec/cec-func-ioctl.rst b/Documentation/media/uapi/cec/cec-func-ioctl.rst -new file mode 100644 -index 000000000000..e2b6260b0086 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-func-ioctl.rst -@@ -0,0 +1,66 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _cec-func-ioctl: -+ -+*********** -+cec ioctl() -+*********** -+ -+Name -+==== -+ -+cec-ioctl - Control a cec device -+ -+Synopsis -+======== -+ -+.. code-block:: c -+ -+ #include -+ -+ -+.. c:function:: int ioctl( int fd, int request, void *argp ) -+ :name: cec-ioctl -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``request`` -+ CEC ioctl request code as defined in the cec.h header file, for -+ example :ref:`CEC_ADAP_G_CAPS `. -+ -+``argp`` -+ Pointer to a request-specific structure. -+ -+ -+Description -+=========== -+ -+The :c:func:`ioctl() ` function manipulates cec device parameters. The -+argument ``fd`` must be an open file descriptor. -+ -+The ioctl ``request`` code specifies the cec function to be called. It -+has encoded in it whether the argument is an input, output or read/write -+parameter, and the size of the argument ``argp`` in bytes. -+ -+Macros and structures definitions specifying cec ioctl requests and -+their parameters are located in the cec.h header file. All cec ioctl -+requests, their respective function and parameters are specified in -+:ref:`cec-user-func`. -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+Request-specific error codes are listed in the individual requests -+descriptions. -+ -+When an ioctl that takes an output or read/write parameter fails, the -+parameter remains unmodified. -diff --git a/Documentation/media/uapi/cec/cec-func-open.rst b/Documentation/media/uapi/cec/cec-func-open.rst -new file mode 100644 -index 000000000000..5d6663a649bd ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-func-open.rst -@@ -0,0 +1,78 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _cec-func-open: -+ -+********** -+cec open() -+********** -+ -+Name -+==== -+ -+cec-open - Open a cec device -+ -+Synopsis -+======== -+ -+.. code-block:: c -+ -+ #include -+ -+ -+.. c:function:: int open( const char *device_name, int flags ) -+ :name: cec-open -+ -+ -+Arguments -+========= -+ -+``device_name`` -+ Device to be opened. -+ -+``flags`` -+ Open flags. Access mode must be ``O_RDWR``. -+ -+ When the ``O_NONBLOCK`` flag is given, the -+ :ref:`CEC_RECEIVE ` and :ref:`CEC_DQEVENT ` ioctls -+ will return the ``EAGAIN`` error code when no message or event is available, and -+ ioctls :ref:`CEC_TRANSMIT `, -+ :ref:`CEC_ADAP_S_PHYS_ADDR ` and -+ :ref:`CEC_ADAP_S_LOG_ADDRS ` -+ all return 0. -+ -+ Other flags have no effect. -+ -+ -+Description -+=========== -+ -+To open a cec device applications call :c:func:`open() ` with the -+desired device name. The function has no side effects; the device -+configuration remain unchanged. -+ -+When the device is opened in read-only mode, attempts to modify its -+configuration will result in an error, and ``errno`` will be set to -+EBADF. -+ -+ -+Return Value -+============ -+ -+:c:func:`open() ` returns the new file descriptor on success. On error, -+-1 is returned, and ``errno`` is set appropriately. Possible error codes -+include: -+ -+``EACCES`` -+ The requested access to the file is not allowed. -+ -+``EMFILE`` -+ The process already has the maximum number of files open. -+ -+``ENFILE`` -+ The system limit on the total number of open files has been reached. -+ -+``ENOMEM`` -+ Insufficient kernel memory was available. -+ -+``ENXIO`` -+ No device corresponding to this device special file exists. -diff --git a/Documentation/media/uapi/cec/cec-func-poll.rst b/Documentation/media/uapi/cec/cec-func-poll.rst -new file mode 100644 -index 000000000000..d49f1ee0742d ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-func-poll.rst -@@ -0,0 +1,77 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _cec-func-poll: -+ -+********** -+cec poll() -+********** -+ -+Name -+==== -+ -+cec-poll - Wait for some event on a file descriptor -+ -+ -+Synopsis -+======== -+ -+.. code-block:: c -+ -+ #include -+ -+ -+.. c:function:: int poll( struct pollfd *ufds, unsigned int nfds, int timeout ) -+ :name: cec-poll -+ -+Arguments -+========= -+ -+``ufds`` -+ List of FD events to be watched -+ -+``nfds`` -+ Number of FD events at the \*ufds array -+ -+``timeout`` -+ Timeout to wait for events -+ -+ -+Description -+=========== -+ -+With the :c:func:`poll() ` function applications can wait for CEC -+events. -+ -+On success :c:func:`poll() ` returns the number of file descriptors -+that have been selected (that is, file descriptors for which the -+``revents`` field of the respective struct :c:type:`pollfd` -+is non-zero). CEC devices set the ``POLLIN`` and ``POLLRDNORM`` flags in -+the ``revents`` field if there are messages in the receive queue. If the -+transmit queue has room for new messages, the ``POLLOUT`` and -+``POLLWRNORM`` flags are set. If there are events in the event queue, -+then the ``POLLPRI`` flag is set. When the function times out it returns -+a value of zero, on failure it returns -1 and the ``errno`` variable is -+set appropriately. -+ -+For more details see the :c:func:`poll() ` manual page. -+ -+ -+Return Value -+============ -+ -+On success, :c:func:`poll() ` returns the number structures which have -+non-zero ``revents`` fields, or zero if the call timed out. On error -1 -+is returned, and the ``errno`` variable is set appropriately: -+ -+``EBADF`` -+ One or more of the ``ufds`` members specify an invalid file -+ descriptor. -+ -+``EFAULT`` -+ ``ufds`` references an inaccessible memory area. -+ -+``EINTR`` -+ The call was interrupted by a signal. -+ -+``EINVAL`` -+ The ``nfds`` argument is greater than ``OPEN_MAX``. -diff --git a/Documentation/media/uapi/cec/cec-funcs.rst b/Documentation/media/uapi/cec/cec-funcs.rst -new file mode 100644 -index 000000000000..6d696cead5cb ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-funcs.rst -@@ -0,0 +1,20 @@ -+.. _cec-user-func: -+ -+****************** -+Function Reference -+****************** -+ -+ -+.. toctree:: -+ :maxdepth: 1 -+ -+ cec-func-open -+ cec-func-close -+ cec-func-ioctl -+ cec-func-poll -+ cec-ioc-adap-g-caps -+ cec-ioc-adap-g-log-addrs -+ cec-ioc-adap-g-phys-addr -+ cec-ioc-dqevent -+ cec-ioc-g-mode -+ cec-ioc-receive -diff --git a/Documentation/media/uapi/cec/cec-header.rst b/Documentation/media/uapi/cec/cec-header.rst -new file mode 100644 -index 000000000000..d5a9a2828274 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-header.rst -@@ -0,0 +1,10 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _cec_header: -+ -+*************** -+CEC Header File -+*************** -+ -+.. kernel-include:: $BUILDDIR/cec.h.rst -+ -diff --git a/Documentation/media/uapi/cec/cec-intro.rst b/Documentation/media/uapi/cec/cec-intro.rst -new file mode 100644 -index 000000000000..07ee2b8f89d6 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-intro.rst -@@ -0,0 +1,40 @@ -+.. _cec-intro: -+ -+Introduction -+============ -+ -+HDMI connectors provide a single pin for use by the Consumer Electronics -+Control protocol. This protocol allows different devices connected by an -+HDMI cable to communicate. The protocol for CEC version 1.4 is defined -+in supplements 1 (CEC) and 2 (HEAC or HDMI Ethernet and Audio Return -+Channel) of the HDMI 1.4a (:ref:`hdmi`) specification and the -+extensions added to CEC version 2.0 are defined in chapter 11 of the -+HDMI 2.0 (:ref:`hdmi2`) specification. -+ -+The bitrate is very slow (effectively no more than 36 bytes per second) -+and is based on the ancient AV.link protocol used in old SCART -+connectors. The protocol closely resembles a crazy Rube Goldberg -+contraption and is an unholy mix of low and high level messages. Some -+messages, especially those part of the HEAC protocol layered on top of -+CEC, need to be handled by the kernel, others can be handled either by -+the kernel or by userspace. -+ -+In addition, CEC can be implemented in HDMI receivers, transmitters and -+in USB devices that have an HDMI input and an HDMI output and that -+control just the CEC pin. -+ -+Drivers that support CEC will create a CEC device node (/dev/cecX) to -+give userspace access to the CEC adapter. The -+:ref:`CEC_ADAP_G_CAPS` ioctl will tell userspace what it is allowed to do. -+ -+In order to check the support and test it, it is suggested to download -+the `v4l-utils `_ package. It -+provides three tools to handle CEC: -+ -+- cec-ctl: the Swiss army knife of CEC. Allows you to configure, transmit -+ and monitor CEC messages. -+ -+- cec-compliance: does a CEC compliance test of a remote CEC device to -+ determine how compliant the CEC implementation is. -+ -+- cec-follower: emulates a CEC follower. -diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst -new file mode 100644 -index 000000000000..6c1f6efb822e ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst -@@ -0,0 +1,139 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_ADAP_G_CAPS: -+ -+********************* -+ioctl CEC_ADAP_G_CAPS -+********************* -+ -+Name -+==== -+ -+CEC_ADAP_G_CAPS - Query device capabilities -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_ADAP_G_CAPS, struct cec_caps *argp ) -+ :name: CEC_ADAP_G_CAPS -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ -+ -+Description -+=========== -+ -+All cec devices must support :ref:`ioctl CEC_ADAP_G_CAPS `. To query -+device information, applications call the ioctl with a pointer to a -+struct :c:type:`cec_caps`. The driver fills the structure and -+returns the information to the application. The ioctl never fails. -+ -+.. tabularcolumns:: |p{1.2cm}|p{2.5cm}|p{13.8cm}| -+ -+.. c:type:: cec_caps -+ -+.. flat-table:: struct cec_caps -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 16 -+ -+ * - char -+ - ``driver[32]`` -+ - The name of the cec adapter driver. -+ * - char -+ - ``name[32]`` -+ - The name of this CEC adapter. The combination ``driver`` and -+ ``name`` must be unique. -+ * - __u32 -+ - ``capabilities`` -+ - The capabilities of the CEC adapter, see -+ :ref:`cec-capabilities`. -+ * - __u32 -+ - ``version`` -+ - CEC Framework API version, formatted with the ``KERNEL_VERSION()`` -+ macro. -+ -+ -+.. tabularcolumns:: |p{4.4cm}|p{2.5cm}|p{10.6cm}| -+ -+.. _cec-capabilities: -+ -+.. flat-table:: CEC Capabilities Flags -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 8 -+ -+ * .. _`CEC-CAP-PHYS-ADDR`: -+ -+ - ``CEC_CAP_PHYS_ADDR`` -+ - 0x00000001 -+ - Userspace has to configure the physical address by calling -+ :ref:`ioctl CEC_ADAP_S_PHYS_ADDR `. If -+ this capability isn't set, then setting the physical address is -+ handled by the kernel whenever the EDID is set (for an HDMI -+ receiver) or read (for an HDMI transmitter). -+ * .. _`CEC-CAP-LOG-ADDRS`: -+ -+ - ``CEC_CAP_LOG_ADDRS`` -+ - 0x00000002 -+ - Userspace has to configure the logical addresses by calling -+ :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `. If -+ this capability isn't set, then the kernel will have configured -+ this. -+ * .. _`CEC-CAP-TRANSMIT`: -+ -+ - ``CEC_CAP_TRANSMIT`` -+ - 0x00000004 -+ - Userspace can transmit CEC messages by calling -+ :ref:`ioctl CEC_TRANSMIT `. This implies that -+ userspace can be a follower as well, since being able to transmit -+ messages is a prerequisite of becoming a follower. If this -+ capability isn't set, then the kernel will handle all CEC -+ transmits and process all CEC messages it receives. -+ * .. _`CEC-CAP-PASSTHROUGH`: -+ -+ - ``CEC_CAP_PASSTHROUGH`` -+ - 0x00000008 -+ - Userspace can use the passthrough mode by calling -+ :ref:`ioctl CEC_S_MODE `. -+ * .. _`CEC-CAP-RC`: -+ -+ - ``CEC_CAP_RC`` -+ - 0x00000010 -+ - This adapter supports the remote control protocol. -+ * .. _`CEC-CAP-MONITOR-ALL`: -+ -+ - ``CEC_CAP_MONITOR_ALL`` -+ - 0x00000020 -+ - The CEC hardware can monitor all messages, not just directed and -+ broadcast messages. -+ * .. _`CEC-CAP-NEEDS-HPD`: -+ -+ - ``CEC_CAP_NEEDS_HPD`` -+ - 0x00000040 -+ - The CEC hardware is only active if the HDMI Hotplug Detect pin is -+ high. This makes it impossible to use CEC to wake up displays that -+ set the HPD pin low when in standby mode, but keep the CEC bus -+ alive. -+ * .. _`CEC-CAP-MONITOR-PIN`: -+ -+ - ``CEC_CAP_MONITOR_PIN`` -+ - 0x00000080 -+ - The CEC hardware can monitor CEC pin changes from low to high voltage -+ and vice versa. When in pin monitoring mode the application will -+ receive ``CEC_EVENT_PIN_CEC_LOW`` and ``CEC_EVENT_PIN_CEC_HIGH`` events. -+ -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst -new file mode 100644 -index 000000000000..84f431a022ad ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst -@@ -0,0 +1,371 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_ADAP_LOG_ADDRS: -+.. _CEC_ADAP_G_LOG_ADDRS: -+.. _CEC_ADAP_S_LOG_ADDRS: -+ -+**************************************************** -+ioctls CEC_ADAP_G_LOG_ADDRS and CEC_ADAP_S_LOG_ADDRS -+**************************************************** -+ -+Name -+==== -+ -+CEC_ADAP_G_LOG_ADDRS, CEC_ADAP_S_LOG_ADDRS - Get or set the logical addresses -+ -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_ADAP_G_LOG_ADDRS, struct cec_log_addrs *argp ) -+ :name: CEC_ADAP_G_LOG_ADDRS -+ -+.. c:function:: int ioctl( int fd, CEC_ADAP_S_LOG_ADDRS, struct cec_log_addrs *argp ) -+ :name: CEC_ADAP_S_LOG_ADDRS -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ Pointer to struct :c:type:`cec_log_addrs`. -+ -+Description -+=========== -+ -+To query the current CEC logical addresses, applications call -+:ref:`ioctl CEC_ADAP_G_LOG_ADDRS ` with a pointer to a -+struct :c:type:`cec_log_addrs` where the driver stores the logical addresses. -+ -+To set new logical addresses, applications fill in -+struct :c:type:`cec_log_addrs` and call :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` -+with a pointer to this struct. The :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` -+is only available if ``CEC_CAP_LOG_ADDRS`` is set (the ``ENOTTY`` error code is -+returned otherwise). The :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` -+can only be called by a file descriptor in initiator mode (see :ref:`CEC_S_MODE`), if not -+the ``EBUSY`` error code will be returned. -+ -+To clear existing logical addresses set ``num_log_addrs`` to 0. All other fields -+will be ignored in that case. The adapter will go to the unconfigured state and the -+``cec_version``, ``vendor_id`` and ``osd_name`` fields are all reset to their default -+values (CEC version 2.0, no vendor ID and an empty OSD name). -+ -+If the physical address is valid (see :ref:`ioctl CEC_ADAP_S_PHYS_ADDR `), -+then this ioctl will block until all requested logical -+addresses have been claimed. If the file descriptor is in non-blocking mode then it will -+not wait for the logical addresses to be claimed, instead it just returns 0. -+ -+A :ref:`CEC_EVENT_STATE_CHANGE ` event is sent when the -+logical addresses are claimed or cleared. -+ -+Attempting to call :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` when -+logical address types are already defined will return with error ``EBUSY``. -+ -+.. c:type:: cec_log_addrs -+ -+.. tabularcolumns:: |p{1.0cm}|p{8.0cm}|p{7.5cm}| -+ -+.. cssclass:: longtable -+ -+.. flat-table:: struct cec_log_addrs -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 16 -+ -+ * - __u8 -+ - ``log_addr[CEC_MAX_LOG_ADDRS]`` -+ - The actual logical addresses that were claimed. This is set by the -+ driver. If no logical address could be claimed, then it is set to -+ ``CEC_LOG_ADDR_INVALID``. If this adapter is Unregistered, then -+ ``log_addr[0]`` is set to 0xf and all others to -+ ``CEC_LOG_ADDR_INVALID``. -+ * - __u16 -+ - ``log_addr_mask`` -+ - The bitmask of all logical addresses this adapter has claimed. If -+ this adapter is Unregistered then ``log_addr_mask`` sets bit 15 -+ and clears all other bits. If this adapter is not configured at -+ all, then ``log_addr_mask`` is set to 0. Set by the driver. -+ * - __u8 -+ - ``cec_version`` -+ - The CEC version that this adapter shall use. See -+ :ref:`cec-versions`. Used to implement the -+ ``CEC_MSG_CEC_VERSION`` and ``CEC_MSG_REPORT_FEATURES`` messages. -+ Note that :ref:`CEC_OP_CEC_VERSION_1_3A ` is not allowed by the CEC -+ framework. -+ * - __u8 -+ - ``num_log_addrs`` -+ - Number of logical addresses to set up. Must be ≤ -+ ``available_log_addrs`` as returned by -+ :ref:`CEC_ADAP_G_CAPS`. All arrays in -+ this structure are only filled up to index -+ ``available_log_addrs``-1. The remaining array elements will be -+ ignored. Note that the CEC 2.0 standard allows for a maximum of 2 -+ logical addresses, although some hardware has support for more. -+ ``CEC_MAX_LOG_ADDRS`` is 4. The driver will return the actual -+ number of logical addresses it could claim, which may be less than -+ what was requested. If this field is set to 0, then the CEC -+ adapter shall clear all claimed logical addresses and all other -+ fields will be ignored. -+ * - __u32 -+ - ``vendor_id`` -+ - The vendor ID is a 24-bit number that identifies the specific -+ vendor or entity. Based on this ID vendor specific commands may be -+ defined. If you do not want a vendor ID then set it to -+ ``CEC_VENDOR_ID_NONE``. -+ * - __u32 -+ - ``flags`` -+ - Flags. See :ref:`cec-log-addrs-flags` for a list of available flags. -+ * - char -+ - ``osd_name[15]`` -+ - The On-Screen Display name as is returned by the -+ ``CEC_MSG_SET_OSD_NAME`` message. -+ * - __u8 -+ - ``primary_device_type[CEC_MAX_LOG_ADDRS]`` -+ - Primary device type for each logical address. See -+ :ref:`cec-prim-dev-types` for possible types. -+ * - __u8 -+ - ``log_addr_type[CEC_MAX_LOG_ADDRS]`` -+ - Logical address types. See :ref:`cec-log-addr-types` for -+ possible types. The driver will update this with the actual -+ logical address type that it claimed (e.g. it may have to fallback -+ to :ref:`CEC_LOG_ADDR_TYPE_UNREGISTERED `). -+ * - __u8 -+ - ``all_device_types[CEC_MAX_LOG_ADDRS]`` -+ - CEC 2.0 specific: the bit mask of all device types. See -+ :ref:`cec-all-dev-types-flags`. It is used in the CEC 2.0 -+ ``CEC_MSG_REPORT_FEATURES`` message. For CEC 1.4 you can either leave -+ this field to 0, or fill it in according to the CEC 2.0 guidelines to -+ give the CEC framework more information about the device type, even -+ though the framework won't use it directly in the CEC message. -+ * - __u8 -+ - ``features[CEC_MAX_LOG_ADDRS][12]`` -+ - Features for each logical address. It is used in the CEC 2.0 -+ ``CEC_MSG_REPORT_FEATURES`` message. The 12 bytes include both the -+ RC Profile and the Device Features. For CEC 1.4 you can either leave -+ this field to all 0, or fill it in according to the CEC 2.0 guidelines to -+ give the CEC framework more information about the device type, even -+ though the framework won't use it directly in the CEC message. -+ -+ -+.. tabularcolumns:: |p{7.8cm}|p{1.0cm}|p{8.7cm}| -+ -+.. _cec-log-addrs-flags: -+ -+.. flat-table:: Flags for struct cec_log_addrs -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 4 -+ -+ * .. _`CEC-LOG-ADDRS-FL-ALLOW-UNREG-FALLBACK`: -+ -+ - ``CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK`` -+ - 1 -+ - By default if no logical address of the requested type can be claimed, then -+ it will go back to the unconfigured state. If this flag is set, then it will -+ fallback to the Unregistered logical address. Note that if the Unregistered -+ logical address was explicitly requested, then this flag has no effect. -+ * .. _`CEC-LOG-ADDRS-FL-ALLOW-RC-PASSTHRU`: -+ -+ - ``CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU`` -+ - 2 -+ - By default the ``CEC_MSG_USER_CONTROL_PRESSED`` and ``CEC_MSG_USER_CONTROL_RELEASED`` -+ messages are only passed on to the follower(s), if any. If this flag is set, -+ then these messages are also passed on to the remote control input subsystem -+ and will appear as keystrokes. This features needs to be enabled explicitly. -+ If CEC is used to enter e.g. passwords, then you may not want to enable this -+ to avoid trivial snooping of the keystrokes. -+ * .. _`CEC-LOG-ADDRS-FL-CDC-ONLY`: -+ -+ - ``CEC_LOG_ADDRS_FL_CDC_ONLY`` -+ - 4 -+ - If this flag is set, then the device is CDC-Only. CDC-Only CEC devices -+ are CEC devices that can only handle CDC messages. -+ -+ All other messages are ignored. -+ -+ -+.. tabularcolumns:: |p{7.8cm}|p{1.0cm}|p{8.7cm}| -+ -+.. _cec-versions: -+ -+.. flat-table:: CEC Versions -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 4 -+ -+ * .. _`CEC-OP-CEC-VERSION-1-3A`: -+ -+ - ``CEC_OP_CEC_VERSION_1_3A`` -+ - 4 -+ - CEC version according to the HDMI 1.3a standard. -+ * .. _`CEC-OP-CEC-VERSION-1-4B`: -+ -+ - ``CEC_OP_CEC_VERSION_1_4B`` -+ - 5 -+ - CEC version according to the HDMI 1.4b standard. -+ * .. _`CEC-OP-CEC-VERSION-2-0`: -+ -+ - ``CEC_OP_CEC_VERSION_2_0`` -+ - 6 -+ - CEC version according to the HDMI 2.0 standard. -+ -+ -+.. tabularcolumns:: |p{6.6cm}|p{2.2cm}|p{8.7cm}| -+ -+.. _cec-prim-dev-types: -+ -+.. flat-table:: CEC Primary Device Types -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 4 -+ -+ * .. _`CEC-OP-PRIM-DEVTYPE-TV`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_TV`` -+ - 0 -+ - Use for a TV. -+ * .. _`CEC-OP-PRIM-DEVTYPE-RECORD`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_RECORD`` -+ - 1 -+ - Use for a recording device. -+ * .. _`CEC-OP-PRIM-DEVTYPE-TUNER`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_TUNER`` -+ - 3 -+ - Use for a device with a tuner. -+ * .. _`CEC-OP-PRIM-DEVTYPE-PLAYBACK`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_PLAYBACK`` -+ - 4 -+ - Use for a playback device. -+ * .. _`CEC-OP-PRIM-DEVTYPE-AUDIOSYSTEM`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_AUDIOSYSTEM`` -+ - 5 -+ - Use for an audio system (e.g. an audio/video receiver). -+ * .. _`CEC-OP-PRIM-DEVTYPE-SWITCH`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_SWITCH`` -+ - 6 -+ - Use for a CEC switch. -+ * .. _`CEC-OP-PRIM-DEVTYPE-VIDEOPROC`: -+ -+ - ``CEC_OP_PRIM_DEVTYPE_VIDEOPROC`` -+ - 7 -+ - Use for a video processor device. -+ -+ -+.. tabularcolumns:: |p{6.6cm}|p{2.2cm}|p{8.7cm}| -+ -+.. _cec-log-addr-types: -+ -+.. flat-table:: CEC Logical Address Types -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-LOG-ADDR-TYPE-TV`: -+ -+ - ``CEC_LOG_ADDR_TYPE_TV`` -+ - 0 -+ - Use for a TV. -+ * .. _`CEC-LOG-ADDR-TYPE-RECORD`: -+ -+ - ``CEC_LOG_ADDR_TYPE_RECORD`` -+ - 1 -+ - Use for a recording device. -+ * .. _`CEC-LOG-ADDR-TYPE-TUNER`: -+ -+ - ``CEC_LOG_ADDR_TYPE_TUNER`` -+ - 2 -+ - Use for a tuner device. -+ * .. _`CEC-LOG-ADDR-TYPE-PLAYBACK`: -+ -+ - ``CEC_LOG_ADDR_TYPE_PLAYBACK`` -+ - 3 -+ - Use for a playback device. -+ * .. _`CEC-LOG-ADDR-TYPE-AUDIOSYSTEM`: -+ -+ - ``CEC_LOG_ADDR_TYPE_AUDIOSYSTEM`` -+ - 4 -+ - Use for an audio system device. -+ * .. _`CEC-LOG-ADDR-TYPE-SPECIFIC`: -+ -+ - ``CEC_LOG_ADDR_TYPE_SPECIFIC`` -+ - 5 -+ - Use for a second TV or for a video processor device. -+ * .. _`CEC-LOG-ADDR-TYPE-UNREGISTERED`: -+ -+ - ``CEC_LOG_ADDR_TYPE_UNREGISTERED`` -+ - 6 -+ - Use this if you just want to remain unregistered. Used for pure -+ CEC switches or CDC-only devices (CDC: Capability Discovery and -+ Control). -+ -+ -+ -+.. tabularcolumns:: |p{6.6cm}|p{2.2cm}|p{8.7cm}| -+ -+.. _cec-all-dev-types-flags: -+ -+.. flat-table:: CEC All Device Types Flags -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 4 -+ -+ * .. _`CEC-OP-ALL-DEVTYPE-TV`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_TV`` -+ - 0x80 -+ - This supports the TV type. -+ * .. _`CEC-OP-ALL-DEVTYPE-RECORD`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_RECORD`` -+ - 0x40 -+ - This supports the Recording type. -+ * .. _`CEC-OP-ALL-DEVTYPE-TUNER`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_TUNER`` -+ - 0x20 -+ - This supports the Tuner type. -+ * .. _`CEC-OP-ALL-DEVTYPE-PLAYBACK`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_PLAYBACK`` -+ - 0x10 -+ - This supports the Playback type. -+ * .. _`CEC-OP-ALL-DEVTYPE-AUDIOSYSTEM`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_AUDIOSYSTEM`` -+ - 0x08 -+ - This supports the Audio System type. -+ * .. _`CEC-OP-ALL-DEVTYPE-SWITCH`: -+ -+ - ``CEC_OP_ALL_DEVTYPE_SWITCH`` -+ - 0x04 -+ - This supports the CEC Switch or Video Processing type. -+ -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+The :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` can return the following -+error codes: -+ -+ENOTTY -+ The ``CEC_CAP_LOG_ADDRS`` capability wasn't set, so this ioctl is not supported. -+ -+EBUSY -+ The CEC adapter is currently configuring itself, or it is already configured and -+ ``num_log_addrs`` is non-zero, or another filehandle is in exclusive follower or -+ initiator mode, or the filehandle is in mode ``CEC_MODE_NO_INITIATOR``. -+ -+EINVAL -+ The contents of struct :c:type:`cec_log_addrs` is invalid. -diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst -new file mode 100644 -index 000000000000..9e49d4be35d5 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst -@@ -0,0 +1,93 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_ADAP_PHYS_ADDR: -+.. _CEC_ADAP_G_PHYS_ADDR: -+.. _CEC_ADAP_S_PHYS_ADDR: -+ -+**************************************************** -+ioctls CEC_ADAP_G_PHYS_ADDR and CEC_ADAP_S_PHYS_ADDR -+**************************************************** -+ -+Name -+==== -+ -+CEC_ADAP_G_PHYS_ADDR, CEC_ADAP_S_PHYS_ADDR - Get or set the physical address -+ -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_ADAP_G_PHYS_ADDR, __u16 *argp ) -+ :name: CEC_ADAP_G_PHYS_ADDR -+ -+.. c:function:: int ioctl( int fd, CEC_ADAP_S_PHYS_ADDR, __u16 *argp ) -+ :name: CEC_ADAP_S_PHYS_ADDR -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ Pointer to the CEC address. -+ -+Description -+=========== -+ -+To query the current physical address applications call -+:ref:`ioctl CEC_ADAP_G_PHYS_ADDR ` with a pointer to a __u16 where the -+driver stores the physical address. -+ -+To set a new physical address applications store the physical address in -+a __u16 and call :ref:`ioctl CEC_ADAP_S_PHYS_ADDR ` with a pointer to -+this integer. The :ref:`ioctl CEC_ADAP_S_PHYS_ADDR ` is only available if -+``CEC_CAP_PHYS_ADDR`` is set (the ``ENOTTY`` error code will be returned -+otherwise). The :ref:`ioctl CEC_ADAP_S_PHYS_ADDR ` can only be called -+by a file descriptor in initiator mode (see :ref:`CEC_S_MODE`), if not -+the ``EBUSY`` error code will be returned. -+ -+To clear an existing physical address use ``CEC_PHYS_ADDR_INVALID``. -+The adapter will go to the unconfigured state. -+ -+If logical address types have been defined (see :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `), -+then this ioctl will block until all -+requested logical addresses have been claimed. If the file descriptor is in non-blocking mode -+then it will not wait for the logical addresses to be claimed, instead it just returns 0. -+ -+A :ref:`CEC_EVENT_STATE_CHANGE ` event is sent when the physical address -+changes. -+ -+The physical address is a 16-bit number where each group of 4 bits -+represent a digit of the physical address a.b.c.d where the most -+significant 4 bits represent 'a'. The CEC root device (usually the TV) -+has address 0.0.0.0. Every device that is hooked up to an input of the -+TV has address a.0.0.0 (where 'a' is ≥ 1), devices hooked up to those in -+turn have addresses a.b.0.0, etc. So a topology of up to 5 devices deep -+is supported. The physical address a device shall use is stored in the -+EDID of the sink. -+ -+For example, the EDID for each HDMI input of the TV will have a -+different physical address of the form a.0.0.0 that the sources will -+read out and use as their physical address. -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+The :ref:`ioctl CEC_ADAP_S_PHYS_ADDR ` can return the following -+error codes: -+ -+ENOTTY -+ The ``CEC_CAP_PHYS_ADDR`` capability wasn't set, so this ioctl is not supported. -+ -+EBUSY -+ Another filehandle is in exclusive follower or initiator mode, or the filehandle -+ is in mode ``CEC_MODE_NO_INITIATOR``. -+ -+EINVAL -+ The physical address is malformed. -diff --git a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst -new file mode 100644 -index 000000000000..b6fd86424fbb ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst -@@ -0,0 +1,226 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_DQEVENT: -+ -+***************** -+ioctl CEC_DQEVENT -+***************** -+ -+Name -+==== -+ -+CEC_DQEVENT - Dequeue a CEC event -+ -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_DQEVENT, struct cec_event *argp ) -+ :name: CEC_DQEVENT -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ -+ -+Description -+=========== -+ -+CEC devices can send asynchronous events. These can be retrieved by -+calling :c:func:`CEC_DQEVENT`. If the file descriptor is in -+non-blocking mode and no event is pending, then it will return -1 and -+set errno to the ``EAGAIN`` error code. -+ -+The internal event queues are per-filehandle and per-event type. If -+there is no more room in a queue then the last event is overwritten with -+the new one. This means that intermediate results can be thrown away but -+that the latest event is always available. This also means that is it -+possible to read two successive events that have the same value (e.g. -+two :ref:`CEC_EVENT_STATE_CHANGE ` events with -+the same state). In that case the intermediate state changes were lost but -+it is guaranteed that the state did change in between the two events. -+ -+.. tabularcolumns:: |p{1.2cm}|p{2.9cm}|p{13.4cm}| -+ -+.. c:type:: cec_event_state_change -+ -+.. flat-table:: struct cec_event_state_change -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 8 -+ -+ * - __u16 -+ - ``phys_addr`` -+ - The current physical address. This is ``CEC_PHYS_ADDR_INVALID`` if no -+ valid physical address is set. -+ * - __u16 -+ - ``log_addr_mask`` -+ - The current set of claimed logical addresses. This is 0 if no logical -+ addresses are claimed or if ``phys_addr`` is ``CEC_PHYS_ADDR_INVALID``. -+ If bit 15 is set (``1 << CEC_LOG_ADDR_UNREGISTERED``) then this device -+ has the unregistered logical address. In that case all other bits are 0. -+ -+ -+.. c:type:: cec_event_lost_msgs -+ -+.. tabularcolumns:: |p{1.0cm}|p{2.0cm}|p{14.5cm}| -+ -+.. flat-table:: struct cec_event_lost_msgs -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 16 -+ -+ * - __u32 -+ - ``lost_msgs`` -+ - Set to the number of lost messages since the filehandle was opened -+ or since the last time this event was dequeued for this -+ filehandle. The messages lost are the oldest messages. So when a -+ new message arrives and there is no more room, then the oldest -+ message is discarded to make room for the new one. The internal -+ size of the message queue guarantees that all messages received in -+ the last two seconds will be stored. Since messages should be -+ replied to within a second according to the CEC specification, -+ this is more than enough. -+ -+ -+.. tabularcolumns:: |p{1.0cm}|p{4.4cm}|p{2.5cm}|p{9.6cm}| -+ -+.. c:type:: cec_event -+ -+.. flat-table:: struct cec_event -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 1 8 -+ -+ * - __u64 -+ - ``ts`` -+ - :cspan:`1`\ Timestamp of the event in ns. -+ -+ The timestamp has been taken from the ``CLOCK_MONOTONIC`` clock. -+ -+ To access the same clock from userspace use :c:func:`clock_gettime`. -+ * - __u32 -+ - ``event`` -+ - :cspan:`1` The CEC event type, see :ref:`cec-events`. -+ * - __u32 -+ - ``flags`` -+ - :cspan:`1` Event flags, see :ref:`cec-event-flags`. -+ * - union -+ - (anonymous) -+ - -+ - -+ * - -+ - struct cec_event_state_change -+ - ``state_change`` -+ - The new adapter state as sent by the :ref:`CEC_EVENT_STATE_CHANGE ` -+ event. -+ * - -+ - struct cec_event_lost_msgs -+ - ``lost_msgs`` -+ - The number of lost messages as sent by the :ref:`CEC_EVENT_LOST_MSGS ` -+ event. -+ -+ -+.. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}| -+ -+.. _cec-events: -+ -+.. flat-table:: CEC Events Types -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-EVENT-STATE-CHANGE`: -+ -+ - ``CEC_EVENT_STATE_CHANGE`` -+ - 1 -+ - Generated when the CEC Adapter's state changes. When open() is -+ called an initial event will be generated for that filehandle with -+ the CEC Adapter's state at that time. -+ * .. _`CEC-EVENT-LOST-MSGS`: -+ -+ - ``CEC_EVENT_LOST_MSGS`` -+ - 2 -+ - Generated if one or more CEC messages were lost because the -+ application didn't dequeue CEC messages fast enough. -+ * .. _`CEC-EVENT-PIN-CEC-LOW`: -+ -+ - ``CEC_EVENT_PIN_CEC_LOW`` -+ - 3 -+ - Generated if the CEC pin goes from a high voltage to a low voltage. -+ Only applies to adapters that have the ``CEC_CAP_MONITOR_PIN`` -+ capability set. -+ * .. _`CEC-EVENT-PIN-CEC-HIGH`: -+ -+ - ``CEC_EVENT_PIN_CEC_HIGH`` -+ - 4 -+ - Generated if the CEC pin goes from a low voltage to a high voltage. -+ Only applies to adapters that have the ``CEC_CAP_MONITOR_PIN`` -+ capability set. -+ * .. _`CEC-EVENT-PIN-HPD-LOW`: -+ -+ - ``CEC_EVENT_PIN_HPD_LOW`` -+ - 5 -+ - Generated if the HPD pin goes from a high voltage to a low voltage. -+ Only applies to adapters that have the ``CEC_CAP_MONITOR_PIN`` -+ capability set. When open() is called, the HPD pin can be read and -+ if the HPD is low, then an initial event will be generated for that -+ filehandle. -+ * .. _`CEC-EVENT-PIN-HPD-HIGH`: -+ -+ - ``CEC_EVENT_PIN_HPD_HIGH`` -+ - 6 -+ - Generated if the HPD pin goes from a low voltage to a high voltage. -+ Only applies to adapters that have the ``CEC_CAP_MONITOR_PIN`` -+ capability set. When open() is called, the HPD pin can be read and -+ if the HPD is high, then an initial event will be generated for that -+ filehandle. -+ -+ -+.. tabularcolumns:: |p{6.0cm}|p{0.6cm}|p{10.9cm}| -+ -+.. _cec-event-flags: -+ -+.. flat-table:: CEC Event Flags -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 8 -+ -+ * .. _`CEC-EVENT-FL-INITIAL-STATE`: -+ -+ - ``CEC_EVENT_FL_INITIAL_STATE`` -+ - 1 -+ - Set for the initial events that are generated when the device is -+ opened. See the table above for which events do this. This allows -+ applications to learn the initial state of the CEC adapter at -+ open() time. -+ * .. _`CEC-EVENT-FL-DROPPED-EVENTS`: -+ -+ - ``CEC_EVENT_FL_DROPPED_EVENTS`` -+ - 2 -+ - Set if one or more events of the given event type have been dropped. -+ This is an indication that the application cannot keep up. -+ -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+The :ref:`ioctl CEC_DQEVENT ` can return the following -+error codes: -+ -+EAGAIN -+ This is returned when the filehandle is in non-blocking mode and there -+ are no pending events. -+ -+ERESTARTSYS -+ An interrupt (e.g. Ctrl-C) arrived while in blocking mode waiting for -+ events to arrive. -diff --git a/Documentation/media/uapi/cec/cec-ioc-g-mode.rst b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst -new file mode 100644 -index 000000000000..508e2e325683 ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst -@@ -0,0 +1,293 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_MODE: -+.. _CEC_G_MODE: -+.. _CEC_S_MODE: -+ -+******************************** -+ioctls CEC_G_MODE and CEC_S_MODE -+******************************** -+ -+CEC_G_MODE, CEC_S_MODE - Get or set exclusive use of the CEC adapter -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_G_MODE, __u32 *argp ) -+ :name: CEC_G_MODE -+ -+.. c:function:: int ioctl( int fd, CEC_S_MODE, __u32 *argp ) -+ :name: CEC_S_MODE -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ Pointer to CEC mode. -+ -+Description -+=========== -+ -+By default any filehandle can use :ref:`CEC_TRANSMIT`, but in order to prevent -+applications from stepping on each others toes it must be possible to -+obtain exclusive access to the CEC adapter. This ioctl sets the -+filehandle to initiator and/or follower mode which can be exclusive -+depending on the chosen mode. The initiator is the filehandle that is -+used to initiate messages, i.e. it commands other CEC devices. The -+follower is the filehandle that receives messages sent to the CEC -+adapter and processes them. The same filehandle can be both initiator -+and follower, or this role can be taken by two different filehandles. -+ -+When a CEC message is received, then the CEC framework will decide how -+it will be processed. If the message is a reply to an earlier -+transmitted message, then the reply is sent back to the filehandle that -+is waiting for it. In addition the CEC framework will process it. -+ -+If the message is not a reply, then the CEC framework will process it -+first. If there is no follower, then the message is just discarded and a -+feature abort is sent back to the initiator if the framework couldn't -+process it. If there is a follower, then the message is passed on to the -+follower who will use :ref:`ioctl CEC_RECEIVE ` to dequeue -+the new message. The framework expects the follower to make the right -+decisions. -+ -+The CEC framework will process core messages unless requested otherwise -+by the follower. The follower can enable the passthrough mode. In that -+case, the CEC framework will pass on most core messages without -+processing them and the follower will have to implement those messages. -+There are some messages that the core will always process, regardless of -+the passthrough mode. See :ref:`cec-core-processing` for details. -+ -+If there is no initiator, then any CEC filehandle can use -+:ref:`ioctl CEC_TRANSMIT `. If there is an exclusive -+initiator then only that initiator can call -+:ref:`CEC_TRANSMIT`. The follower can of course -+always call :ref:`ioctl CEC_TRANSMIT `. -+ -+Available initiator modes are: -+ -+.. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}| -+ -+.. _cec-mode-initiator_e: -+ -+.. flat-table:: Initiator Modes -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-MODE-NO-INITIATOR`: -+ -+ - ``CEC_MODE_NO_INITIATOR`` -+ - 0x0 -+ - This is not an initiator, i.e. it cannot transmit CEC messages or -+ make any other changes to the CEC adapter. -+ * .. _`CEC-MODE-INITIATOR`: -+ -+ - ``CEC_MODE_INITIATOR`` -+ - 0x1 -+ - This is an initiator (the default when the device is opened) and -+ it can transmit CEC messages and make changes to the CEC adapter, -+ unless there is an exclusive initiator. -+ * .. _`CEC-MODE-EXCL-INITIATOR`: -+ -+ - ``CEC_MODE_EXCL_INITIATOR`` -+ - 0x2 -+ - This is an exclusive initiator and this file descriptor is the -+ only one that can transmit CEC messages and make changes to the -+ CEC adapter. If someone else is already the exclusive initiator -+ then an attempt to become one will return the ``EBUSY`` error code -+ error. -+ -+ -+Available follower modes are: -+ -+.. tabularcolumns:: |p{6.6cm}|p{0.9cm}|p{10.0cm}| -+ -+.. _cec-mode-follower_e: -+ -+.. cssclass:: longtable -+ -+.. flat-table:: Follower Modes -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-MODE-NO-FOLLOWER`: -+ -+ - ``CEC_MODE_NO_FOLLOWER`` -+ - 0x00 -+ - This is not a follower (the default when the device is opened). -+ * .. _`CEC-MODE-FOLLOWER`: -+ -+ - ``CEC_MODE_FOLLOWER`` -+ - 0x10 -+ - This is a follower and it will receive CEC messages unless there -+ is an exclusive follower. You cannot become a follower if -+ :ref:`CEC_CAP_TRANSMIT ` is not set or if :ref:`CEC_MODE_NO_INITIATOR ` -+ was specified, the ``EINVAL`` error code is returned in that case. -+ * .. _`CEC-MODE-EXCL-FOLLOWER`: -+ -+ - ``CEC_MODE_EXCL_FOLLOWER`` -+ - 0x20 -+ - This is an exclusive follower and only this file descriptor will -+ receive CEC messages for processing. If someone else is already -+ the exclusive follower then an attempt to become one will return -+ the ``EBUSY`` error code. You cannot become a follower if -+ :ref:`CEC_CAP_TRANSMIT ` is not set or if :ref:`CEC_MODE_NO_INITIATOR ` -+ was specified, the ``EINVAL`` error code is returned in that case. -+ * .. _`CEC-MODE-EXCL-FOLLOWER-PASSTHRU`: -+ -+ - ``CEC_MODE_EXCL_FOLLOWER_PASSTHRU`` -+ - 0x30 -+ - This is an exclusive follower and only this file descriptor will -+ receive CEC messages for processing. In addition it will put the -+ CEC device into passthrough mode, allowing the exclusive follower -+ to handle most core messages instead of relying on the CEC -+ framework for that. If someone else is already the exclusive -+ follower then an attempt to become one will return the ``EBUSY`` error -+ code. You cannot become a follower if :ref:`CEC_CAP_TRANSMIT ` -+ is not set or if :ref:`CEC_MODE_NO_INITIATOR ` was specified, -+ the ``EINVAL`` error code is returned in that case. -+ * .. _`CEC-MODE-MONITOR-PIN`: -+ -+ - ``CEC_MODE_MONITOR_PIN`` -+ - 0xd0 -+ - Put the file descriptor into pin monitoring mode. Can only be used in -+ combination with :ref:`CEC_MODE_NO_INITIATOR `, -+ otherwise the ``EINVAL`` error code will be returned. -+ This mode requires that the :ref:`CEC_CAP_MONITOR_PIN ` -+ capability is set, otherwise the ``EINVAL`` error code is returned. -+ While in pin monitoring mode this file descriptor can receive the -+ ``CEC_EVENT_PIN_CEC_LOW`` and ``CEC_EVENT_PIN_CEC_HIGH`` events to see the -+ low-level CEC pin transitions. This is very useful for debugging. -+ This mode is only allowed if the process has the ``CAP_NET_ADMIN`` -+ capability. If that is not set, then the ``EPERM`` error code is returned. -+ * .. _`CEC-MODE-MONITOR`: -+ -+ - ``CEC_MODE_MONITOR`` -+ - 0xe0 -+ - Put the file descriptor into monitor mode. Can only be used in -+ combination with :ref:`CEC_MODE_NO_INITIATOR `,i -+ otherwise the ``EINVAL`` error code will be returned. -+ In monitor mode all messages this CEC -+ device transmits and all messages it receives (both broadcast -+ messages and directed messages for one its logical addresses) will -+ be reported. This is very useful for debugging. This is only -+ allowed if the process has the ``CAP_NET_ADMIN`` capability. If -+ that is not set, then the ``EPERM`` error code is returned. -+ * .. _`CEC-MODE-MONITOR-ALL`: -+ -+ - ``CEC_MODE_MONITOR_ALL`` -+ - 0xf0 -+ - Put the file descriptor into 'monitor all' mode. Can only be used -+ in combination with :ref:`CEC_MODE_NO_INITIATOR `, otherwise -+ the ``EINVAL`` error code will be returned. In 'monitor all' mode all messages -+ this CEC device transmits and all messages it receives, including -+ directed messages for other CEC devices will be reported. This is -+ very useful for debugging, but not all devices support this. This -+ mode requires that the :ref:`CEC_CAP_MONITOR_ALL ` capability is set, -+ otherwise the ``EINVAL`` error code is returned. This is only allowed if -+ the process has the ``CAP_NET_ADMIN`` capability. If that is not -+ set, then the ``EPERM`` error code is returned. -+ -+ -+Core message processing details: -+ -+.. tabularcolumns:: |p{6.6cm}|p{10.9cm}| -+ -+.. _cec-core-processing: -+ -+.. flat-table:: Core Message Processing -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 8 -+ -+ * .. _`CEC-MSG-GET-CEC-VERSION`: -+ -+ - ``CEC_MSG_GET_CEC_VERSION`` -+ - The core will return the CEC version that was set with -+ :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `, -+ except when in passthrough mode. In passthrough mode the core -+ does nothing and this message has to be handled by a follower -+ instead. -+ * .. _`CEC-MSG-GIVE-DEVICE-VENDOR-ID`: -+ -+ - ``CEC_MSG_GIVE_DEVICE_VENDOR_ID`` -+ - The core will return the vendor ID that was set with -+ :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `, -+ except when in passthrough mode. In passthrough mode the core -+ does nothing and this message has to be handled by a follower -+ instead. -+ * .. _`CEC-MSG-ABORT`: -+ -+ - ``CEC_MSG_ABORT`` -+ - The core will return a Feature Abort message with reason -+ 'Feature Refused' as per the specification, except when in -+ passthrough mode. In passthrough mode the core does nothing -+ and this message has to be handled by a follower instead. -+ * .. _`CEC-MSG-GIVE-PHYSICAL-ADDR`: -+ -+ - ``CEC_MSG_GIVE_PHYSICAL_ADDR`` -+ - The core will report the current physical address, except when -+ in passthrough mode. In passthrough mode the core does nothing -+ and this message has to be handled by a follower instead. -+ * .. _`CEC-MSG-GIVE-OSD-NAME`: -+ -+ - ``CEC_MSG_GIVE_OSD_NAME`` -+ - The core will report the current OSD name that was set with -+ :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `, -+ except when in passthrough mode. In passthrough mode the core -+ does nothing and this message has to be handled by a follower -+ instead. -+ * .. _`CEC-MSG-GIVE-FEATURES`: -+ -+ - ``CEC_MSG_GIVE_FEATURES`` -+ - The core will do nothing if the CEC version is older than 2.0, -+ otherwise it will report the current features that were set with -+ :ref:`ioctl CEC_ADAP_S_LOG_ADDRS `, -+ except when in passthrough mode. In passthrough mode the core -+ does nothing (for any CEC version) and this message has to be handled -+ by a follower instead. -+ * .. _`CEC-MSG-USER-CONTROL-PRESSED`: -+ -+ - ``CEC_MSG_USER_CONTROL_PRESSED`` -+ - If :ref:`CEC_CAP_RC ` is set and if -+ :ref:`CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU ` -+ is set, then generate a remote control key -+ press. This message is always passed on to the follower(s). -+ * .. _`CEC-MSG-USER-CONTROL-RELEASED`: -+ -+ - ``CEC_MSG_USER_CONTROL_RELEASED`` -+ - If :ref:`CEC_CAP_RC ` is set and if -+ :ref:`CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU ` -+ is set, then generate a remote control key -+ release. This message is always passed on to the follower(s). -+ * .. _`CEC-MSG-REPORT-PHYSICAL-ADDR`: -+ -+ - ``CEC_MSG_REPORT_PHYSICAL_ADDR`` -+ - The CEC framework will make note of the reported physical address -+ and then just pass the message on to the follower(s). -+ -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+The :ref:`ioctl CEC_S_MODE ` can return the following -+error codes: -+ -+EINVAL -+ The requested mode is invalid. -+ -+EPERM -+ Monitor mode is requested without having root permissions -+ -+EBUSY -+ Someone else is already an exclusive follower or initiator. -diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst -new file mode 100644 -index 000000000000..bdad4b197bcd ---- /dev/null -+++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst -@@ -0,0 +1,344 @@ -+.. -*- coding: utf-8; mode: rst -*- -+ -+.. _CEC_TRANSMIT: -+.. _CEC_RECEIVE: -+ -+*********************************** -+ioctls CEC_RECEIVE and CEC_TRANSMIT -+*********************************** -+ -+Name -+==== -+ -+CEC_RECEIVE, CEC_TRANSMIT - Receive or transmit a CEC message -+ -+ -+Synopsis -+======== -+ -+.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg *argp ) -+ :name: CEC_RECEIVE -+ -+.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg *argp ) -+ :name: CEC_TRANSMIT -+ -+Arguments -+========= -+ -+``fd`` -+ File descriptor returned by :c:func:`open() `. -+ -+``argp`` -+ Pointer to struct cec_msg. -+ -+Description -+=========== -+ -+To receive a CEC message the application has to fill in the -+``timeout`` field of struct :c:type:`cec_msg` and pass it to -+:ref:`ioctl CEC_RECEIVE `. -+If the file descriptor is in non-blocking mode and there are no received -+messages pending, then it will return -1 and set errno to the ``EAGAIN`` -+error code. If the file descriptor is in blocking mode and ``timeout`` -+is non-zero and no message arrived within ``timeout`` milliseconds, then -+it will return -1 and set errno to the ``ETIMEDOUT`` error code. -+ -+A received message can be: -+ -+1. a message received from another CEC device (the ``sequence`` field will -+ be 0). -+2. the result of an earlier non-blocking transmit (the ``sequence`` field will -+ be non-zero). -+ -+To send a CEC message the application has to fill in the struct -+:c:type:`cec_msg` and pass it to :ref:`ioctl CEC_TRANSMIT `. -+The :ref:`ioctl CEC_TRANSMIT ` is only available if -+``CEC_CAP_TRANSMIT`` is set. If there is no more room in the transmit -+queue, then it will return -1 and set errno to the ``EBUSY`` error code. -+The transmit queue has enough room for 18 messages (about 1 second worth -+of 2-byte messages). Note that the CEC kernel framework will also reply -+to core messages (see :ref:`cec-core-processing`), so it is not a good -+idea to fully fill up the transmit queue. -+ -+If the file descriptor is in non-blocking mode then the transmit will -+return 0 and the result of the transmit will be available via -+:ref:`ioctl CEC_RECEIVE ` once the transmit has finished -+(including waiting for a reply, if requested). -+ -+The ``sequence`` field is filled in for every transmit and this can be -+checked against the received messages to find the corresponding transmit -+result. -+ -+Normally calling :ref:`ioctl CEC_TRANSMIT ` when the physical -+address is invalid (due to e.g. a disconnect) will return ``ENONET``. -+ -+However, the CEC specification allows sending messages from 'Unregistered' to -+'TV' when the physical address is invalid since some TVs pull the hotplug detect -+pin of the HDMI connector low when they go into standby, or when switching to -+another input. -+ -+When the hotplug detect pin goes low the EDID disappears, and thus the -+physical address, but the cable is still connected and CEC still works. -+In order to detect/wake up the device it is allowed to send poll and 'Image/Text -+View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV'). -+ -+.. tabularcolumns:: |p{1.0cm}|p{3.5cm}|p{13.0cm}| -+ -+.. c:type:: cec_msg -+ -+.. cssclass:: longtable -+ -+.. flat-table:: struct cec_msg -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 1 1 16 -+ -+ * - __u64 -+ - ``tx_ts`` -+ - Timestamp in ns of when the last byte of the message was transmitted. -+ The timestamp has been taken from the ``CLOCK_MONOTONIC`` clock. To access -+ the same clock from userspace use :c:func:`clock_gettime`. -+ * - __u64 -+ - ``rx_ts`` -+ - Timestamp in ns of when the last byte of the message was received. -+ The timestamp has been taken from the ``CLOCK_MONOTONIC`` clock. To access -+ the same clock from userspace use :c:func:`clock_gettime`. -+ * - __u32 -+ - ``len`` -+ - The length of the message. For :ref:`ioctl CEC_TRANSMIT ` this is filled in -+ by the application. The driver will fill this in for -+ :ref:`ioctl CEC_RECEIVE `. For :ref:`ioctl CEC_TRANSMIT ` it will be -+ filled in by the driver with the length of the reply message if ``reply`` was set. -+ * - __u32 -+ - ``timeout`` -+ - The timeout in milliseconds. This is the time the device will wait -+ for a message to be received before timing out. If it is set to 0, -+ then it will wait indefinitely when it is called by :ref:`ioctl CEC_RECEIVE `. -+ If it is 0 and it is called by :ref:`ioctl CEC_TRANSMIT `, -+ then it will be replaced by 1000 if the ``reply`` is non-zero or -+ ignored if ``reply`` is 0. -+ * - __u32 -+ - ``sequence`` -+ - A non-zero sequence number is automatically assigned by the CEC framework -+ for all transmitted messages. It is used by the CEC framework when it queues -+ the transmit result (when transmit was called in non-blocking mode). This -+ allows the application to associate the received message with the original -+ transmit. -+ * - __u32 -+ - ``flags`` -+ - Flags. See :ref:`cec-msg-flags` for a list of available flags. -+ * - __u8 -+ - ``tx_status`` -+ - The status bits of the transmitted message. See -+ :ref:`cec-tx-status` for the possible status values. It is 0 if -+ this message was received, not transmitted. -+ * - __u8 -+ - ``msg[16]`` -+ - The message payload. For :ref:`ioctl CEC_TRANSMIT ` this is filled in by the -+ application. The driver will fill this in for :ref:`ioctl CEC_RECEIVE `. -+ For :ref:`ioctl CEC_TRANSMIT ` it will be filled in by the driver with -+ the payload of the reply message if ``timeout`` was set. -+ * - __u8 -+ - ``reply`` -+ - Wait until this message is replied. If ``reply`` is 0 and the -+ ``timeout`` is 0, then don't wait for a reply but return after -+ transmitting the message. Ignored by :ref:`ioctl CEC_RECEIVE `. -+ The case where ``reply`` is 0 (this is the opcode for the Feature Abort -+ message) and ``timeout`` is non-zero is specifically allowed to make it -+ possible to send a message and wait up to ``timeout`` milliseconds for a -+ Feature Abort reply. In this case ``rx_status`` will either be set -+ to :ref:`CEC_RX_STATUS_TIMEOUT ` or -+ :ref:`CEC_RX_STATUS_FEATURE_ABORT `. -+ -+ If the transmitter message is ``CEC_MSG_INITIATE_ARC`` then the ``reply`` -+ values ``CEC_MSG_REPORT_ARC_INITIATED`` and ``CEC_MSG_REPORT_ARC_TERMINATED`` -+ are processed differently: either value will match both possible replies. -+ The reason is that the ``CEC_MSG_INITIATE_ARC`` message is the only CEC -+ message that has two possible replies other than Feature Abort. The -+ ``reply`` field will be updated with the actual reply so that it is -+ synchronized with the contents of the received message. -+ * - __u8 -+ - ``rx_status`` -+ - The status bits of the received message. See -+ :ref:`cec-rx-status` for the possible status values. It is 0 if -+ this message was transmitted, not received, unless this is the -+ reply to a transmitted message. In that case both ``rx_status`` -+ and ``tx_status`` are set. -+ * - __u8 -+ - ``tx_status`` -+ - The status bits of the transmitted message. See -+ :ref:`cec-tx-status` for the possible status values. It is 0 if -+ this message was received, not transmitted. -+ * - __u8 -+ - ``tx_arb_lost_cnt`` -+ - A counter of the number of transmit attempts that resulted in the -+ Arbitration Lost error. This is only set if the hardware supports -+ this, otherwise it is always 0. This counter is only valid if the -+ :ref:`CEC_TX_STATUS_ARB_LOST ` status bit is set. -+ * - __u8 -+ - ``tx_nack_cnt`` -+ - A counter of the number of transmit attempts that resulted in the -+ Not Acknowledged error. This is only set if the hardware supports -+ this, otherwise it is always 0. This counter is only valid if the -+ :ref:`CEC_TX_STATUS_NACK ` status bit is set. -+ * - __u8 -+ - ``tx_low_drive_cnt`` -+ - A counter of the number of transmit attempts that resulted in the -+ Arbitration Lost error. This is only set if the hardware supports -+ this, otherwise it is always 0. This counter is only valid if the -+ :ref:`CEC_TX_STATUS_LOW_DRIVE ` status bit is set. -+ * - __u8 -+ - ``tx_error_cnt`` -+ - A counter of the number of transmit errors other than Arbitration -+ Lost or Not Acknowledged. This is only set if the hardware -+ supports this, otherwise it is always 0. This counter is only -+ valid if the :ref:`CEC_TX_STATUS_ERROR ` status bit is set. -+ -+ -+.. tabularcolumns:: |p{6.2cm}|p{1.0cm}|p{10.3cm}| -+ -+.. _cec-msg-flags: -+ -+.. flat-table:: Flags for struct cec_msg -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 4 -+ -+ * .. _`CEC-MSG-FL-REPLY-TO-FOLLOWERS`: -+ -+ - ``CEC_MSG_FL_REPLY_TO_FOLLOWERS`` -+ - 1 -+ - If a CEC transmit expects a reply, then by default that reply is only sent to -+ the filehandle that called :ref:`ioctl CEC_TRANSMIT `. If this -+ flag is set, then the reply is also sent to all followers, if any. If the -+ filehandle that called :ref:`ioctl CEC_TRANSMIT ` is also a -+ follower, then that filehandle will receive the reply twice: once as the -+ result of the :ref:`ioctl CEC_TRANSMIT `, and once via -+ :ref:`ioctl CEC_RECEIVE `. -+ -+ -+.. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}| -+ -+.. _cec-tx-status: -+ -+.. flat-table:: CEC Transmit Status -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-TX-STATUS-OK`: -+ -+ - ``CEC_TX_STATUS_OK`` -+ - 0x01 -+ - The message was transmitted successfully. This is mutually -+ exclusive with :ref:`CEC_TX_STATUS_MAX_RETRIES `. Other bits can still -+ be set if earlier attempts met with failure before the transmit -+ was eventually successful. -+ * .. _`CEC-TX-STATUS-ARB-LOST`: -+ -+ - ``CEC_TX_STATUS_ARB_LOST`` -+ - 0x02 -+ - CEC line arbitration was lost. -+ * .. _`CEC-TX-STATUS-NACK`: -+ -+ - ``CEC_TX_STATUS_NACK`` -+ - 0x04 -+ - Message was not acknowledged. -+ * .. _`CEC-TX-STATUS-LOW-DRIVE`: -+ -+ - ``CEC_TX_STATUS_LOW_DRIVE`` -+ - 0x08 -+ - Low drive was detected on the CEC bus. This indicates that a -+ follower detected an error on the bus and requests a -+ retransmission. -+ * .. _`CEC-TX-STATUS-ERROR`: -+ -+ - ``CEC_TX_STATUS_ERROR`` -+ - 0x10 -+ - Some error occurred. This is used for any errors that do not fit -+ ``CEC_TX_STATUS_ARB_LOST`` or ``CEC_TX_STATUS_LOW_DRIVE``, either because -+ the hardware could not tell which error occurred, or because the hardware -+ tested for other conditions besides those two. -+ * .. _`CEC-TX-STATUS-MAX-RETRIES`: -+ -+ - ``CEC_TX_STATUS_MAX_RETRIES`` -+ - 0x20 -+ - The transmit failed after one or more retries. This status bit is -+ mutually exclusive with :ref:`CEC_TX_STATUS_OK `. Other bits can still -+ be set to explain which failures were seen. -+ -+ -+.. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}| -+ -+.. _cec-rx-status: -+ -+.. flat-table:: CEC Receive Status -+ :header-rows: 0 -+ :stub-columns: 0 -+ :widths: 3 1 16 -+ -+ * .. _`CEC-RX-STATUS-OK`: -+ -+ - ``CEC_RX_STATUS_OK`` -+ - 0x01 -+ - The message was received successfully. -+ * .. _`CEC-RX-STATUS-TIMEOUT`: -+ -+ - ``CEC_RX_STATUS_TIMEOUT`` -+ - 0x02 -+ - The reply to an earlier transmitted message timed out. -+ * .. _`CEC-RX-STATUS-FEATURE-ABORT`: -+ -+ - ``CEC_RX_STATUS_FEATURE_ABORT`` -+ - 0x04 -+ - The message was received successfully but the reply was -+ ``CEC_MSG_FEATURE_ABORT``. This status is only set if this message -+ was the reply to an earlier transmitted message. -+ -+ -+ -+Return Value -+============ -+ -+On success 0 is returned, on error -1 and the ``errno`` variable is set -+appropriately. The generic error codes are described at the -+:ref:`Generic Error Codes ` chapter. -+ -+The :ref:`ioctl CEC_RECEIVE ` can return the following -+error codes: -+ -+EAGAIN -+ No messages are in the receive queue, and the filehandle is in non-blocking mode. -+ -+ETIMEDOUT -+ The ``timeout`` was reached while waiting for a message. -+ -+ERESTARTSYS -+ The wait for a message was interrupted (e.g. by Ctrl-C). -+ -+The :ref:`ioctl CEC_TRANSMIT ` can return the following -+error codes: -+ -+ENOTTY -+ The ``CEC_CAP_TRANSMIT`` capability wasn't set, so this ioctl is not supported. -+ -+EPERM -+ The CEC adapter is not configured, i.e. :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` -+ has never been called. -+ -+ENONET -+ The CEC adapter is not configured, i.e. :ref:`ioctl CEC_ADAP_S_LOG_ADDRS ` -+ was called, but the physical address is invalid so no logical address was claimed. -+ An exception is made in this case for transmits from initiator 0xf ('Unregistered') -+ to destination 0 ('TV'). In that case the transmit will proceed as usual. -+ -+EBUSY -+ Another filehandle is in exclusive follower or initiator mode, or the filehandle -+ is in mode ``CEC_MODE_NO_INITIATOR``. This is also returned if the transmit -+ queue is full. -+ -+EINVAL -+ The contents of struct :c:type:`cec_msg` is invalid. -+ -+ERESTARTSYS -+ The wait for a successful transmit was interrupted (e.g. by Ctrl-C). -diff --git a/MAINTAINERS b/MAINTAINERS -index 443bc975b562..225ab2c1d35b 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -2674,6 +2674,22 @@ F: drivers/net/ieee802154/cc2520.c - F: include/linux/spi/cc2520.h - F: Documentation/devicetree/bindings/net/ieee802154/cc2520.txt - -+CEC FRAMEWORK -+M: Hans Verkuil -+L: linux-media@vger.kernel.org -+T: git git://linuxtv.org/media_tree.git -+W: http://linuxtv.org -+S: Supported -+F: Documentation/media/kapi/cec-core.rst -+F: Documentation/media/uapi/cec -+F: drivers/media/cec/ -+F: drivers/media/rc/keymaps/rc-cec.c -+F: include/media/cec.h -+F: include/media/cec-notifier.h -+F: include/uapi/linux/cec.h -+F: include/uapi/linux/cec-funcs.h -+F: Documentation/devicetree/bindings/media/cec.txt -+ - CELL BROADBAND ENGINE ARCHITECTURE - M: Arnd Bergmann - L: linuxppc-dev@lists.ozlabs.org -diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c -index 8c75a51333b2..4f5d382268f7 100644 ---- a/drivers/media/cec/cec-adap.c -+++ b/drivers/media/cec/cec-adap.c -@@ -202,7 +202,10 @@ static void cec_queue_msg_fh(struct cec_fh *fh, const struct cec_msg *msg) - { - static const struct cec_event ev_lost_msgs = { - .event = CEC_EVENT_LOST_MSGS, -- .lost_msgs.lost_msgs = 1, -+ .flags = 0, -+ { -+ .lost_msgs = { 1 }, -+ }, - }; - struct cec_msg_entry *entry; - -@@ -1793,6 +1796,9 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg, - int la_idx = cec_log_addr2idx(adap, dest_laddr); - bool from_unregistered = init_laddr == 0xf; - struct cec_msg tx_cec_msg = { }; -+#ifdef CONFIG_MEDIA_CEC_RC -+ int scancode; -+#endif - - dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg); - -@@ -1888,11 +1894,9 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg, - */ - case 0x60: - if (msg->len == 2) -- rc_keydown(adap->rc, RC_TYPE_CEC, -- msg->msg[2], 0); -+ scancode = msg->msg[2]; - else -- rc_keydown(adap->rc, RC_TYPE_CEC, -- msg->msg[2] << 8 | msg->msg[3], 0); -+ scancode = msg->msg[2] << 8 | msg->msg[3]; - break; - /* - * Other function messages that are not handled. -@@ -1905,11 +1909,54 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg, - */ - case 0x56: case 0x57: - case 0x67: case 0x68: case 0x69: case 0x6a: -+ scancode = -1; - break; - default: -- rc_keydown(adap->rc, RC_TYPE_CEC, msg->msg[2], 0); -+ scancode = msg->msg[2]; -+ break; -+ } -+ -+ /* Was repeating, but keypress timed out */ -+ if (adap->rc_repeating && !adap->rc->keypressed) { -+ adap->rc_repeating = false; -+ adap->rc_last_scancode = -1; -+ } -+ /* Different keypress from last time, ends repeat mode */ -+ if (adap->rc_last_scancode != scancode) { -+ rc_keyup(adap->rc); -+ adap->rc_repeating = false; -+ } -+ /* We can't handle this scancode */ -+ if (scancode < 0) { -+ adap->rc_last_scancode = scancode; -+ break; -+ } -+ -+ /* Send key press */ -+ rc_keydown(adap->rc, RC_TYPE_CEC, scancode, 0); -+ -+ /* When in repeating mode, we're done */ -+ if (adap->rc_repeating) -+ break; -+ -+ /* -+ * We are not repeating, but the new scancode is -+ * the same as the last one, and this second key press is -+ * within 550 ms (the 'Follower Safety Timeout') from the -+ * previous key press, so we now enable the repeating mode. -+ */ -+ if (adap->rc_last_scancode == scancode && -+ msg->rx_ts - adap->rc_last_keypress < 550 * NSEC_PER_MSEC) { -+ adap->rc_repeating = true; - break; - } -+ /* -+ * Not in repeating mode, so avoid triggering repeat mode -+ * by calling keyup. -+ */ -+ rc_keyup(adap->rc); -+ adap->rc_last_scancode = scancode; -+ adap->rc_last_keypress = msg->rx_ts; - #endif - break; - -@@ -1919,6 +1966,8 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg, - break; - #ifdef CONFIG_MEDIA_CEC_RC - rc_keyup(adap->rc); -+ adap->rc_repeating = false; -+ adap->rc_last_scancode = -1; - #endif - break; - -diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c -index 969f770acf77..65d763be4385 100644 ---- a/drivers/media/cec/cec-core.c -+++ b/drivers/media/cec/cec-core.c -@@ -263,7 +263,7 @@ struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops, - return adap; - - /* Prepare the RC input device */ -- adap->rc = rc_allocate_device(RC_DRIVER_SCANCODE); -+ adap->rc = rc_allocate_device(); - if (!adap->rc) { - pr_err("cec-%s: failed to allocate memory for rc_dev\n", - name); -@@ -283,11 +283,13 @@ struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops, - adap->rc->input_id.vendor = 0; - adap->rc->input_id.product = 0; - adap->rc->input_id.version = 1; -+ adap->rc->driver_type = RC_DRIVER_SCANCODE; - adap->rc->driver_name = CEC_NAME; - adap->rc->allowed_protocols = RC_BIT_CEC; - adap->rc->priv = adap; - adap->rc->map_name = RC_MAP_CEC; - adap->rc->timeout = MS_TO_NS(100); -+ adap->rc_last_scancode = -1; - #endif - return adap; - } -@@ -319,6 +321,17 @@ int cec_register_adapter(struct cec_adapter *adap, - adap->rc = NULL; - return res; - } -+ /* -+ * The REP_DELAY for CEC is really the time between the initial -+ * 'User Control Pressed' message and the second. The first -+ * keypress is always seen as non-repeating, the second -+ * (provided it has the same UI Command) will start the 'Press -+ * and Hold' (aka repeat) behavior. By setting REP_DELAY to the -+ * same value as REP_PERIOD the expected CEC behavior is -+ * reproduced. -+ */ -+ adap->rc->input_dev->rep[REP_DELAY] = -+ adap->rc->input_dev->rep[REP_PERIOD]; - } - #endif - -diff --git a/drivers/media/rc/keymaps/Makefile b/drivers/media/rc/keymaps/Makefile -index fbbd3bbcd252..9cffcc61fdca 100644 ---- a/drivers/media/rc/keymaps/Makefile -+++ b/drivers/media/rc/keymaps/Makefile -@@ -18,6 +18,7 @@ obj-$(CONFIG_RC_MAP) += rc-adstech-dvb-t-pci.o \ - rc-behold.o \ - rc-behold-columbus.o \ - rc-budget-ci-old.o \ -+ rc-cec.o \ - rc-cinergy-1400.o \ - rc-cinergy.o \ - rc-delock-61959.o \ -diff --git a/drivers/media/rc/keymaps/rc-cec.c b/drivers/media/rc/keymaps/rc-cec.c -new file mode 100644 -index 000000000000..354c8e724b8e ---- /dev/null -+++ b/drivers/media/rc/keymaps/rc-cec.c -@@ -0,0 +1,182 @@ -+/* Keytable for the CEC remote control -+ * -+ * Copyright (c) 2015 by Kamil Debski -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ */ -+ -+#include -+#include -+ -+/* -+ * CEC Spec "High-Definition Multimedia Interface Specification" can be obtained -+ * here: http://xtreamerdev.googlecode.com/files/CEC_Specs.pdf -+ * The list of control codes is listed in Table 27: User Control Codes p. 95 -+ */ -+ -+static struct rc_map_table cec[] = { -+ { 0x00, KEY_OK }, -+ { 0x01, KEY_UP }, -+ { 0x02, KEY_DOWN }, -+ { 0x03, KEY_LEFT }, -+ { 0x04, KEY_RIGHT }, -+ { 0x05, KEY_RIGHT_UP }, -+ { 0x06, KEY_RIGHT_DOWN }, -+ { 0x07, KEY_LEFT_UP }, -+ { 0x08, KEY_LEFT_DOWN }, -+ { 0x09, KEY_ROOT_MENU }, /* CEC Spec: Device Root Menu - see Note 2 */ -+ /* -+ * Note 2: This is the initial display that a device shows. It is -+ * device-dependent and can be, for example, a contents menu, setup -+ * menu, favorite menu or other menu. The actual menu displayed -+ * may also depend on the device's current state. -+ */ -+ { 0x0a, KEY_SETUP }, -+ { 0x0b, KEY_MENU }, /* CEC Spec: Contents Menu */ -+ { 0x0c, KEY_FAVORITES }, /* CEC Spec: Favorite Menu */ -+ { 0x0d, KEY_EXIT }, -+ /* 0x0e-0x0f: Reserved */ -+ { 0x10, KEY_MEDIA_TOP_MENU }, -+ { 0x11, KEY_CONTEXT_MENU }, -+ /* 0x12-0x1c: Reserved */ -+ { 0x1d, KEY_DIGITS }, /* CEC Spec: select/toggle a Number Entry Mode */ -+ { 0x1e, KEY_NUMERIC_11 }, -+ { 0x1f, KEY_NUMERIC_12 }, -+ /* 0x20-0x29: Keys 0 to 9 */ -+ { 0x20, KEY_NUMERIC_0 }, -+ { 0x21, KEY_NUMERIC_1 }, -+ { 0x22, KEY_NUMERIC_2 }, -+ { 0x23, KEY_NUMERIC_3 }, -+ { 0x24, KEY_NUMERIC_4 }, -+ { 0x25, KEY_NUMERIC_5 }, -+ { 0x26, KEY_NUMERIC_6 }, -+ { 0x27, KEY_NUMERIC_7 }, -+ { 0x28, KEY_NUMERIC_8 }, -+ { 0x29, KEY_NUMERIC_9 }, -+ { 0x2a, KEY_DOT }, -+ { 0x2b, KEY_ENTER }, -+ { 0x2c, KEY_CLEAR }, -+ /* 0x2d-0x2e: Reserved */ -+ { 0x2f, KEY_NEXT_FAVORITE }, /* CEC Spec: Next Favorite */ -+ { 0x30, KEY_CHANNELUP }, -+ { 0x31, KEY_CHANNELDOWN }, -+ { 0x32, KEY_PREVIOUS }, /* CEC Spec: Previous Channel */ -+ { 0x33, KEY_SOUND }, /* CEC Spec: Sound Select */ -+ { 0x34, KEY_VIDEO }, /* 0x34: CEC Spec: Input Select */ -+ { 0x35, KEY_INFO }, /* CEC Spec: Display Information */ -+ { 0x36, KEY_HELP }, -+ { 0x37, KEY_PAGEUP }, -+ { 0x38, KEY_PAGEDOWN }, -+ /* 0x39-0x3f: Reserved */ -+ { 0x40, KEY_POWER }, -+ { 0x41, KEY_VOLUMEUP }, -+ { 0x42, KEY_VOLUMEDOWN }, -+ { 0x43, KEY_MUTE }, -+ { 0x44, KEY_PLAYCD }, -+ { 0x45, KEY_STOPCD }, -+ { 0x46, KEY_PAUSECD }, -+ { 0x47, KEY_RECORD }, -+ { 0x48, KEY_REWIND }, -+ { 0x49, KEY_FASTFORWARD }, -+ { 0x4a, KEY_EJECTCD }, /* CEC Spec: Eject */ -+ { 0x4b, KEY_FORWARD }, -+ { 0x4c, KEY_BACK }, -+ { 0x4d, KEY_STOP_RECORD }, /* CEC Spec: Stop-Record */ -+ { 0x4e, KEY_PAUSE_RECORD }, /* CEC Spec: Pause-Record */ -+ /* 0x4f: Reserved */ -+ { 0x50, KEY_ANGLE }, -+ { 0x51, KEY_TV2 }, -+ { 0x52, KEY_VOD }, /* CEC Spec: Video on Demand */ -+ { 0x53, KEY_EPG }, -+ { 0x54, KEY_TIME }, /* CEC Spec: Timer */ -+ { 0x55, KEY_CONFIG }, -+ /* -+ * The following codes are hard to implement at this moment, as they -+ * carry an additional additional argument. Most likely changes to RC -+ * framework are necessary. -+ * For now they are interpreted by the CEC framework as non keycodes -+ * and are passed as messages enabling user application to parse them. -+ */ -+ /* 0x56: CEC Spec: Select Broadcast Type */ -+ /* 0x57: CEC Spec: Select Sound presentation */ -+ { 0x58, KEY_AUDIO_DESC }, /* CEC 2.0 and up */ -+ { 0x59, KEY_WWW }, /* CEC 2.0 and up */ -+ { 0x5a, KEY_3D_MODE }, /* CEC 2.0 and up */ -+ /* 0x5b-0x5f: Reserved */ -+ { 0x60, KEY_PLAYCD }, /* CEC Spec: Play Function */ -+ { 0x6005, KEY_FASTFORWARD }, -+ { 0x6006, KEY_FASTFORWARD }, -+ { 0x6007, KEY_FASTFORWARD }, -+ { 0x6015, KEY_SLOW }, -+ { 0x6016, KEY_SLOW }, -+ { 0x6017, KEY_SLOW }, -+ { 0x6009, KEY_FASTREVERSE }, -+ { 0x600a, KEY_FASTREVERSE }, -+ { 0x600b, KEY_FASTREVERSE }, -+ { 0x6019, KEY_SLOWREVERSE }, -+ { 0x601a, KEY_SLOWREVERSE }, -+ { 0x601b, KEY_SLOWREVERSE }, -+ { 0x6020, KEY_REWIND }, -+ { 0x6024, KEY_PLAYCD }, -+ { 0x6025, KEY_PAUSECD }, -+ { 0x61, KEY_PLAYPAUSE }, /* CEC Spec: Pause-Play Function */ -+ { 0x62, KEY_RECORD }, /* Spec: Record Function */ -+ { 0x63, KEY_PAUSE_RECORD }, /* CEC Spec: Pause-Record Function */ -+ { 0x64, KEY_STOPCD }, /* CEC Spec: Stop Function */ -+ { 0x65, KEY_MUTE }, /* CEC Spec: Mute Function */ -+ { 0x66, KEY_UNMUTE }, /* CEC Spec: Restore the volume */ -+ /* -+ * The following codes are hard to implement at this moment, as they -+ * carry an additional additional argument. Most likely changes to RC -+ * framework are necessary. -+ * For now they are interpreted by the CEC framework as non keycodes -+ * and are passed as messages enabling user application to parse them. -+ */ -+ /* 0x67: CEC Spec: Tune Function */ -+ /* 0x68: CEC Spec: Seleect Media Function */ -+ /* 0x69: CEC Spec: Select A/V Input Function */ -+ /* 0x6a: CEC Spec: Select Audio Input Function */ -+ { 0x6b, KEY_POWER }, /* CEC Spec: Power Toggle Function */ -+ { 0x6c, KEY_SLEEP }, /* CEC Spec: Power Off Function */ -+ { 0x6d, KEY_WAKEUP }, /* CEC Spec: Power On Function */ -+ /* 0x6e-0x70: Reserved */ -+ { 0x71, KEY_BLUE }, /* CEC Spec: F1 (Blue) */ -+ { 0x72, KEY_RED }, /* CEC Spec: F2 (Red) */ -+ { 0x73, KEY_GREEN }, /* CEC Spec: F3 (Green) */ -+ { 0x74, KEY_YELLOW }, /* CEC Spec: F4 (Yellow) */ -+ { 0x75, KEY_F5 }, -+ { 0x76, KEY_DATA }, /* CEC Spec: Data - see Note 3 */ -+ /* -+ * Note 3: This is used, for example, to enter or leave a digital TV -+ * data broadcast application. -+ */ -+ /* 0x77-0xff: Reserved */ -+}; -+ -+static struct rc_map_list cec_map = { -+ .map = { -+ .scan = cec, -+ .size = ARRAY_SIZE(cec), -+ .rc_type = RC_TYPE_CEC, -+ .name = RC_MAP_CEC, -+ } -+}; -+ -+static int __init init_rc_map_cec(void) -+{ -+ return rc_map_register(&cec_map); -+} -+ -+static void __exit exit_rc_map_cec(void) -+{ -+ rc_map_unregister(&cec_map); -+} -+ -+module_init(init_rc_map_cec); -+module_exit(exit_rc_map_cec); -+ -+MODULE_LICENSE("GPL"); -+MODULE_AUTHOR("Kamil Debski"); -diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c -index 3f0f71adabb4..a639ea653c7e 100644 ---- a/drivers/media/rc/rc-main.c -+++ b/drivers/media/rc/rc-main.c -@@ -801,6 +801,7 @@ static struct { - { RC_BIT_SHARP, "sharp" }, - { RC_BIT_MCE_KBD, "mce_kbd" }, - { RC_BIT_XMP, "xmp" }, -+ { RC_BIT_CEC, "cec" }, - }; - - /** -diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index a52ca5cba015..b0b96fc01da3 100644 ---- a/fs/compat_ioctl.c -+++ b/fs/compat_ioctl.c -@@ -57,6 +57,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1381,6 +1382,17 @@ COMPATIBLE_IOCTL(VIDEO_GET_NAVI) - COMPATIBLE_IOCTL(VIDEO_SET_ATTRIBUTES) - COMPATIBLE_IOCTL(VIDEO_GET_SIZE) - COMPATIBLE_IOCTL(VIDEO_GET_FRAME_RATE) -+/* cec */ -+COMPATIBLE_IOCTL(CEC_ADAP_G_CAPS) -+COMPATIBLE_IOCTL(CEC_ADAP_G_LOG_ADDRS) -+COMPATIBLE_IOCTL(CEC_ADAP_S_LOG_ADDRS) -+COMPATIBLE_IOCTL(CEC_ADAP_G_PHYS_ADDR) -+COMPATIBLE_IOCTL(CEC_ADAP_S_PHYS_ADDR) -+COMPATIBLE_IOCTL(CEC_G_MODE) -+COMPATIBLE_IOCTL(CEC_S_MODE) -+COMPATIBLE_IOCTL(CEC_TRANSMIT) -+COMPATIBLE_IOCTL(CEC_RECEIVE) -+COMPATIBLE_IOCTL(CEC_DQEVENT) - - /* joystick */ - COMPATIBLE_IOCTL(JSIOCGVERSION) -diff --git a/include/media/cec-notifier.h b/include/media/cec-notifier.h -index ca19a9305782..8bb169ac7afd 100644 ---- a/include/media/cec-notifier.h -+++ b/include/media/cec-notifier.h -@@ -91,6 +91,14 @@ void cec_notifier_register(struct cec_notifier *n, - */ - void cec_notifier_unregister(struct cec_notifier *n); - -+/** -+ * cec_register_cec_notifier - register the notifier with the cec adapter. -+ * @adap: the CEC adapter -+ * @notifier: the CEC notifier -+ */ -+void cec_register_cec_notifier(struct cec_adapter *adap, -+ struct cec_notifier *notifier); -+ - #else - static inline struct cec_notifier *cec_notifier_get(struct device *dev) - { -@@ -111,6 +119,20 @@ static inline void cec_notifier_set_phys_addr_from_edid(struct cec_notifier *n, - { - } - -+static inline void cec_notifier_register(struct cec_notifier *n, -+ struct cec_adapter *adap, -+ void (*callback)(struct cec_adapter *adap, u16 pa)) -+{ -+} -+ -+static inline void cec_notifier_unregister(struct cec_notifier *n) -+{ -+} -+ -+static inline void cec_register_cec_notifier(struct cec_adapter *adap, -+ struct cec_notifier *notifier) -+{ -+} - #endif - - /** -diff --git a/include/media/cec.h b/include/media/cec.h -index df3c94f05aa5..f64807a78064 100644 ---- a/include/media/cec.h -+++ b/include/media/cec.h -@@ -31,6 +31,9 @@ - #include - #include - -+#define CEC_CAP_DEFAULTS (CEC_CAP_LOG_ADDRS | CEC_CAP_TRANSMIT | \ -+ CEC_CAP_PASSTHROUGH | CEC_CAP_RC) -+ - /** - * struct cec_devnode - cec device node - * @dev: cec device -@@ -188,6 +191,11 @@ struct cec_adapter { - - u32 tx_timeouts; - -+#ifdef CONFIG_MEDIA_CEC_RC -+ bool rc_repeating; -+ int rc_last_scancode; -+ u64 rc_last_keypress; -+#endif - #ifdef CONFIG_CEC_NOTIFIER - struct cec_notifier *notifier; - #endif -@@ -226,7 +234,7 @@ static inline bool cec_is_sink(const struct cec_adapter *adap) - - struct edid; - --#if IS_ENABLED(CONFIG_CEC_CORE) -+#if IS_REACHABLE(CONFIG_CEC_CORE) - struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops, - void *priv, const char *name, u32 caps, u8 available_las); - int cec_register_adapter(struct cec_adapter *adap, struct device *parent); -@@ -373,11 +381,6 @@ u16 cec_phys_addr_for_input(u16 phys_addr, u8 input); - */ - int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port); - --#ifdef CONFIG_CEC_NOTIFIER --void cec_register_cec_notifier(struct cec_adapter *adap, -- struct cec_notifier *notifier); --#endif -- - #else - - static inline int cec_register_adapter(struct cec_adapter *adap, -@@ -424,9 +427,26 @@ static inline u16 cec_phys_addr_for_input(u16 phys_addr, u8 input) - - static inline int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port) - { -+ if (parent) -+ *parent = phys_addr; -+ if (port) -+ *port = 0; - return 0; - } - - #endif - -+/** -+ * cec_phys_addr_invalidate() - set the physical address to INVALID -+ * -+ * @adap: the CEC adapter -+ * -+ * This is a simple helper function to invalidate the physical -+ * address. -+ */ -+static inline void cec_phys_addr_invalidate(struct cec_adapter *adap) -+{ -+ cec_s_phys_addr(adap, CEC_PHYS_ADDR_INVALID, false); -+} -+ - #endif /* _MEDIA_CEC_H */ -diff --git a/include/media/rc-map.h b/include/media/rc-map.h -index 7c4bbc4dfab4..d9f87d5b4468 100644 ---- a/include/media/rc-map.h -+++ b/include/media/rc-map.h -@@ -31,6 +31,7 @@ enum rc_type { - RC_TYPE_RC6_MCE = 16, /* MCE (Philips RC6-6A-32 subtype) protocol */ - RC_TYPE_SHARP = 17, /* Sharp protocol */ - RC_TYPE_XMP = 18, /* XMP protocol */ -+ RC_TYPE_CEC = 19, /* CEC protocol */ - }; - - #define RC_BIT_NONE 0 -@@ -53,6 +54,7 @@ enum rc_type { - #define RC_BIT_RC6_MCE (1 << RC_TYPE_RC6_MCE) - #define RC_BIT_SHARP (1 << RC_TYPE_SHARP) - #define RC_BIT_XMP (1 << RC_TYPE_XMP) -+#define RC_BIT_CEC (1 << RC_TYPE_CEC) - - #define RC_BIT_ALL (RC_BIT_UNKNOWN | RC_BIT_OTHER | \ - RC_BIT_RC5 | RC_BIT_RC5X | RC_BIT_RC5_SZ | \ -@@ -61,7 +63,7 @@ enum rc_type { - RC_BIT_NEC | RC_BIT_SANYO | RC_BIT_MCE_KBD | \ - RC_BIT_RC6_0 | RC_BIT_RC6_6A_20 | RC_BIT_RC6_6A_24 | \ - RC_BIT_RC6_6A_32 | RC_BIT_RC6_MCE | RC_BIT_SHARP | \ -- RC_BIT_XMP) -+ RC_BIT_XMP | RC_BIT_CEC) - - - #define RC_SCANCODE_UNKNOWN(x) (x) -@@ -123,6 +125,7 @@ void rc_map_init(void); - #define RC_MAP_BEHOLD_COLUMBUS "rc-behold-columbus" - #define RC_MAP_BEHOLD "rc-behold" - #define RC_MAP_BUDGET_CI_OLD "rc-budget-ci-old" -+#define RC_MAP_CEC "rc-cec" - #define RC_MAP_CINERGY_1400 "rc-cinergy-1400" - #define RC_MAP_CINERGY "rc-cinergy" - #define RC_MAP_DELOCK_61959 "rc-delock-61959" -diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h -index c451eec42a83..270b251a3d9b 100644 ---- a/include/uapi/linux/cec-funcs.h -+++ b/include/uapi/linux/cec-funcs.h -@@ -895,6 +895,7 @@ static inline void cec_ops_report_features(const struct cec_msg *msg, - *cec_version = msg->msg[2]; - *all_device_types = msg->msg[3]; - *rc_profile = p; -+ *dev_features = NULL; - while (p < &msg->msg[14] && (*p & CEC_OP_FEAT_EXT)) - p++; - if (!(*p & CEC_OP_FEAT_EXT)) { -diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h -index af6682f5ea85..b9f8df3a0477 100644 ---- a/include/uapi/linux/cec.h -+++ b/include/uapi/linux/cec.h -@@ -223,7 +223,7 @@ static inline int cec_msg_status_is_ok(const struct cec_msg *msg) - #define CEC_LOG_ADDR_BACKUP_2 13 - #define CEC_LOG_ADDR_SPECIFIC 14 - #define CEC_LOG_ADDR_UNREGISTERED 15 /* as initiator address */ --#define CEC_LOG_ADDR_BROADCAST 15 /* ad destination address */ -+#define CEC_LOG_ADDR_BROADCAST 15 /* as destination address */ - - /* The logical address types that the CEC device wants to claim */ - #define CEC_LOG_ADDR_TYPE_TV 0 -diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h -index 87cf351bab03..b0c5c4888a4b 100644 ---- a/include/uapi/linux/input-event-codes.h -+++ b/include/uapi/linux/input-event-codes.h -@@ -611,6 +611,37 @@ - #define KEY_KBDINPUTASSIST_ACCEPT 0x264 - #define KEY_KBDINPUTASSIST_CANCEL 0x265 - -+/* Diagonal movement keys */ -+#define KEY_RIGHT_UP 0x266 -+#define KEY_RIGHT_DOWN 0x267 -+#define KEY_LEFT_UP 0x268 -+#define KEY_LEFT_DOWN 0x269 -+ -+#define KEY_ROOT_MENU 0x26a /* Show Device's Root Menu */ -+/* Show Top Menu of the Media (e.g. DVD) */ -+#define KEY_MEDIA_TOP_MENU 0x26b -+#define KEY_NUMERIC_11 0x26c -+#define KEY_NUMERIC_12 0x26d -+/* -+ * Toggle Audio Description: refers to an audio service that helps blind and -+ * visually impaired consumers understand the action in a program. Note: in -+ * some countries this is referred to as "Video Description". -+ */ -+#define KEY_AUDIO_DESC 0x26e -+#define KEY_3D_MODE 0x26f -+#define KEY_NEXT_FAVORITE 0x270 -+#define KEY_STOP_RECORD 0x271 -+#define KEY_PAUSE_RECORD 0x272 -+#define KEY_VOD 0x273 /* Video on Demand */ -+#define KEY_UNMUTE 0x274 -+#define KEY_FASTREVERSE 0x275 -+#define KEY_SLOWREVERSE 0x276 -+/* -+ * Control a data application associated with the currently viewed channel, -+ * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.) -+ */ -+#define KEY_DATA 0x277 -+ - #define BTN_TRIGGER_HAPPY 0x2c0 - #define BTN_TRIGGER_HAPPY1 0x2c0 - #define BTN_TRIGGER_HAPPY2 0x2c1 -diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h -index 2758687300b4..41e8dff588e1 100644 ---- a/include/uapi/linux/input.h -+++ b/include/uapi/linux/input.h -@@ -246,6 +246,7 @@ struct input_mask { - #define BUS_GSC 0x1A - #define BUS_ATARI 0x1B - #define BUS_SPI 0x1C -+#define BUS_CEC 0x1E - - /* - * MT_TOOL types - -From 48d7f1f5bd8f2a2252158e7eda0d83975d7b170b Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 4 Sep 2017 22:34:22 +0200 -Subject: [PATCH] BACKPORT: Pulse Eight HDMI CEC from v4.15 - ---- - MAINTAINERS | 7 + - drivers/input/serio/serport.c | 17 +- - drivers/media/usb/Kconfig | 5 + - drivers/media/usb/Makefile | 1 + - drivers/media/usb/pulse8-cec/Kconfig | 11 + - drivers/media/usb/pulse8-cec/Makefile | 1 + - drivers/media/usb/pulse8-cec/pulse8-cec.c | 757 ++++++++++++++++++++++++++++++ - include/uapi/linux/serio.h | 1 + - 8 files changed, 797 insertions(+), 3 deletions(-) - create mode 100644 drivers/media/usb/pulse8-cec/Kconfig - create mode 100644 drivers/media/usb/pulse8-cec/Makefile - create mode 100644 drivers/media/usb/pulse8-cec/pulse8-cec.c - -diff --git a/MAINTAINERS b/MAINTAINERS -index 225ab2c1d35b..0c1232c326a5 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -8673,6 +8673,13 @@ F: include/linux/tracehook.h - F: include/uapi/linux/ptrace.h - F: kernel/ptrace.c - -+PULSE8-CEC DRIVER -+M: Hans Verkuil -+L: linux-media@vger.kernel.org -+T: git git://linuxtv.org/media_tree.git -+S: Maintained -+F: drivers/media/usb/pulse8-cec/* -+ - PVRUSB2 VIDEO4LINUX DRIVER - M: Mike Isely - L: pvrusb2@isely.net (subscribers-only) -diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c -index 9c927d35c1f5..d189843f3727 100644 ---- a/drivers/input/serio/serport.c -+++ b/drivers/input/serio/serport.c -@@ -71,10 +71,7 @@ static void serport_serio_close(struct serio *serio) - - spin_lock_irqsave(&serport->lock, flags); - clear_bit(SERPORT_ACTIVE, &serport->flags); -- set_bit(SERPORT_DEAD, &serport->flags); - spin_unlock_irqrestore(&serport->lock, flags); -- -- wake_up_interruptible(&serport->wait); - } - - /* -@@ -248,6 +245,19 @@ static long serport_ldisc_compat_ioctl(struct tty_struct *tty, - } - #endif - -+static int serport_ldisc_hangup(struct tty_struct *tty) -+{ -+ struct serport *serport = (struct serport *) tty->disc_data; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&serport->lock, flags); -+ set_bit(SERPORT_DEAD, &serport->flags); -+ spin_unlock_irqrestore(&serport->lock, flags); -+ -+ wake_up_interruptible(&serport->wait); -+ return 0; -+} -+ - static void serport_ldisc_write_wakeup(struct tty_struct * tty) - { - struct serport *serport = (struct serport *) tty->disc_data; -@@ -274,6 +284,7 @@ static struct tty_ldisc_ops serport_ldisc = { - .compat_ioctl = serport_ldisc_compat_ioctl, - #endif - .receive_buf = serport_ldisc_receive, -+ .hangup = serport_ldisc_hangup, - .write_wakeup = serport_ldisc_write_wakeup - }; - -diff --git a/drivers/media/usb/Kconfig b/drivers/media/usb/Kconfig -index 7496f332f3f5..c9644b62f91a 100644 ---- a/drivers/media/usb/Kconfig -+++ b/drivers/media/usb/Kconfig -@@ -60,5 +60,10 @@ source "drivers/media/usb/hackrf/Kconfig" - source "drivers/media/usb/msi2500/Kconfig" - endif - -+if MEDIA_CEC_SUPPORT -+ comment "USB HDMI CEC adapters" -+source "drivers/media/usb/pulse8-cec/Kconfig" -+endif -+ - endif #MEDIA_USB_SUPPORT - endif #USB -diff --git a/drivers/media/usb/Makefile b/drivers/media/usb/Makefile -index 8874ba774a34..0f15e3351ddc 100644 ---- a/drivers/media/usb/Makefile -+++ b/drivers/media/usb/Makefile -@@ -24,3 +24,4 @@ obj-$(CONFIG_VIDEO_EM28XX) += em28xx/ - obj-$(CONFIG_VIDEO_USBTV) += usbtv/ - obj-$(CONFIG_VIDEO_GO7007) += go7007/ - obj-$(CONFIG_DVB_AS102) += as102/ -+obj-$(CONFIG_USB_PULSE8_CEC) += pulse8-cec/ -diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig -new file mode 100644 -index 000000000000..18ead44824ba ---- /dev/null -+++ b/drivers/media/usb/pulse8-cec/Kconfig -@@ -0,0 +1,11 @@ -+config USB_PULSE8_CEC -+ tristate "Pulse Eight HDMI CEC" -+ depends on USB_ACM -+ select CEC_CORE -+ select SERIO -+ select SERIO_SERPORT -+ ---help--- -+ This is a cec driver for the Pulse Eight HDMI CEC device. -+ -+ To compile this driver as a module, choose M here: the -+ module will be called pulse8-cec. -diff --git a/drivers/media/usb/pulse8-cec/Makefile b/drivers/media/usb/pulse8-cec/Makefile -new file mode 100644 -index 000000000000..9800690bc25a ---- /dev/null -+++ b/drivers/media/usb/pulse8-cec/Makefile -@@ -0,0 +1 @@ -+obj-$(CONFIG_USB_PULSE8_CEC) += pulse8-cec.o -diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c -new file mode 100644 -index 000000000000..50146f263d90 ---- /dev/null -+++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c -@@ -0,0 +1,757 @@ -+/* -+ * Pulse Eight HDMI CEC driver -+ * -+ * Copyright 2016 Hans Verkuil ["Power On"], ["Power] or ["Power Toggle"], or if it -+ * receives with its own physical address. It also does this -+ * if it receives [0x03 0x00] from an LG TV. -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+MODULE_AUTHOR("Hans Verkuil "); -+MODULE_DESCRIPTION("Pulse Eight HDMI CEC driver"); -+MODULE_LICENSE("GPL"); -+ -+static int debug; -+static int persistent_config; -+module_param(debug, int, 0644); -+module_param(persistent_config, int, 0644); -+MODULE_PARM_DESC(debug, "debug level (0-1)"); -+MODULE_PARM_DESC(persistent_config, "read config from persistent memory (0-1)"); -+ -+enum pulse8_msgcodes { -+ MSGCODE_NOTHING = 0, -+ MSGCODE_PING, -+ MSGCODE_TIMEOUT_ERROR, -+ MSGCODE_HIGH_ERROR, -+ MSGCODE_LOW_ERROR, -+ MSGCODE_FRAME_START, -+ MSGCODE_FRAME_DATA, -+ MSGCODE_RECEIVE_FAILED, -+ MSGCODE_COMMAND_ACCEPTED, /* 0x08 */ -+ MSGCODE_COMMAND_REJECTED, -+ MSGCODE_SET_ACK_MASK, -+ MSGCODE_TRANSMIT, -+ MSGCODE_TRANSMIT_EOM, -+ MSGCODE_TRANSMIT_IDLETIME, -+ MSGCODE_TRANSMIT_ACK_POLARITY, -+ MSGCODE_TRANSMIT_LINE_TIMEOUT, -+ MSGCODE_TRANSMIT_SUCCEEDED, /* 0x10 */ -+ MSGCODE_TRANSMIT_FAILED_LINE, -+ MSGCODE_TRANSMIT_FAILED_ACK, -+ MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA, -+ MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE, -+ MSGCODE_FIRMWARE_VERSION, -+ MSGCODE_START_BOOTLOADER, -+ MSGCODE_GET_BUILDDATE, -+ MSGCODE_SET_CONTROLLED, /* 0x18 */ -+ MSGCODE_GET_AUTO_ENABLED, -+ MSGCODE_SET_AUTO_ENABLED, -+ MSGCODE_GET_DEFAULT_LOGICAL_ADDRESS, -+ MSGCODE_SET_DEFAULT_LOGICAL_ADDRESS, -+ MSGCODE_GET_LOGICAL_ADDRESS_MASK, -+ MSGCODE_SET_LOGICAL_ADDRESS_MASK, -+ MSGCODE_GET_PHYSICAL_ADDRESS, -+ MSGCODE_SET_PHYSICAL_ADDRESS, /* 0x20 */ -+ MSGCODE_GET_DEVICE_TYPE, -+ MSGCODE_SET_DEVICE_TYPE, -+ MSGCODE_GET_HDMI_VERSION, -+ MSGCODE_SET_HDMI_VERSION, -+ MSGCODE_GET_OSD_NAME, -+ MSGCODE_SET_OSD_NAME, -+ MSGCODE_WRITE_EEPROM, -+ MSGCODE_GET_ADAPTER_TYPE, /* 0x28 */ -+ MSGCODE_SET_ACTIVE_SOURCE, -+ -+ MSGCODE_FRAME_EOM = 0x80, -+ MSGCODE_FRAME_ACK = 0x40, -+}; -+ -+#define MSGSTART 0xff -+#define MSGEND 0xfe -+#define MSGESC 0xfd -+#define MSGOFFSET 3 -+ -+#define DATA_SIZE 256 -+ -+#define PING_PERIOD (15 * HZ) -+ -+struct pulse8 { -+ struct device *dev; -+ struct serio *serio; -+ struct cec_adapter *adap; -+ unsigned int vers; -+ struct completion cmd_done; -+ struct work_struct work; -+ struct delayed_work ping_eeprom_work; -+ struct cec_msg rx_msg; -+ u8 data[DATA_SIZE]; -+ unsigned int len; -+ u8 buf[DATA_SIZE]; -+ unsigned int idx; -+ bool escape; -+ bool started; -+ struct mutex config_lock; -+ struct mutex write_lock; -+ bool config_pending; -+ bool restoring_config; -+ bool autonomous; -+}; -+ -+static void pulse8_ping_eeprom_work_handler(struct work_struct *work); -+ -+static void pulse8_irq_work_handler(struct work_struct *work) -+{ -+ struct pulse8 *pulse8 = -+ container_of(work, struct pulse8, work); -+ -+ switch (pulse8->data[0] & 0x3f) { -+ case MSGCODE_FRAME_DATA: -+ cec_received_msg(pulse8->adap, &pulse8->rx_msg); -+ break; -+ case MSGCODE_TRANSMIT_SUCCEEDED: -+ cec_transmit_attempt_done(pulse8->adap, CEC_TX_STATUS_OK); -+ break; -+ case MSGCODE_TRANSMIT_FAILED_ACK: -+ cec_transmit_attempt_done(pulse8->adap, CEC_TX_STATUS_NACK); -+ break; -+ case MSGCODE_TRANSMIT_FAILED_LINE: -+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: -+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: -+ cec_transmit_attempt_done(pulse8->adap, CEC_TX_STATUS_ERROR); -+ break; -+ } -+} -+ -+static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, -+ unsigned int flags) -+{ -+ struct pulse8 *pulse8 = serio_get_drvdata(serio); -+ -+ if (!pulse8->started && data != MSGSTART) -+ return IRQ_HANDLED; -+ if (data == MSGESC) { -+ pulse8->escape = true; -+ return IRQ_HANDLED; -+ } -+ if (pulse8->escape) { -+ data += MSGOFFSET; -+ pulse8->escape = false; -+ } else if (data == MSGEND) { -+ struct cec_msg *msg = &pulse8->rx_msg; -+ -+ if (debug) -+ dev_info(pulse8->dev, "received: %*ph\n", -+ pulse8->idx, pulse8->buf); -+ pulse8->data[0] = pulse8->buf[0]; -+ switch (pulse8->buf[0] & 0x3f) { -+ case MSGCODE_FRAME_START: -+ msg->len = 1; -+ msg->msg[0] = pulse8->buf[1]; -+ break; -+ case MSGCODE_FRAME_DATA: -+ if (msg->len == CEC_MAX_MSG_SIZE) -+ break; -+ msg->msg[msg->len++] = pulse8->buf[1]; -+ if (pulse8->buf[0] & MSGCODE_FRAME_EOM) -+ schedule_work(&pulse8->work); -+ break; -+ case MSGCODE_TRANSMIT_SUCCEEDED: -+ case MSGCODE_TRANSMIT_FAILED_LINE: -+ case MSGCODE_TRANSMIT_FAILED_ACK: -+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: -+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: -+ schedule_work(&pulse8->work); -+ break; -+ case MSGCODE_HIGH_ERROR: -+ case MSGCODE_LOW_ERROR: -+ case MSGCODE_RECEIVE_FAILED: -+ case MSGCODE_TIMEOUT_ERROR: -+ break; -+ case MSGCODE_COMMAND_ACCEPTED: -+ case MSGCODE_COMMAND_REJECTED: -+ default: -+ if (pulse8->idx == 0) -+ break; -+ memcpy(pulse8->data, pulse8->buf, pulse8->idx); -+ pulse8->len = pulse8->idx; -+ complete(&pulse8->cmd_done); -+ break; -+ } -+ pulse8->idx = 0; -+ pulse8->started = false; -+ return IRQ_HANDLED; -+ } else if (data == MSGSTART) { -+ pulse8->idx = 0; -+ pulse8->started = true; -+ return IRQ_HANDLED; -+ } -+ -+ if (pulse8->idx >= DATA_SIZE) { -+ dev_dbg(pulse8->dev, -+ "throwing away %d bytes of garbage\n", pulse8->idx); -+ pulse8->idx = 0; -+ } -+ pulse8->buf[pulse8->idx++] = data; -+ return IRQ_HANDLED; -+} -+ -+static void pulse8_disconnect(struct serio *serio) -+{ -+ struct pulse8 *pulse8 = serio_get_drvdata(serio); -+ -+ cec_unregister_adapter(pulse8->adap); -+ cancel_delayed_work_sync(&pulse8->ping_eeprom_work); -+ dev_info(&serio->dev, "disconnected\n"); -+ serio_close(serio); -+ serio_set_drvdata(serio, NULL); -+ kfree(pulse8); -+} -+ -+static int pulse8_send(struct serio *serio, const u8 *command, u8 cmd_len) -+{ -+ int err = 0; -+ -+ err = serio_write(serio, MSGSTART); -+ if (err) -+ return err; -+ for (; !err && cmd_len; command++, cmd_len--) { -+ if (*command >= MSGESC) { -+ err = serio_write(serio, MSGESC); -+ if (!err) -+ err = serio_write(serio, *command - MSGOFFSET); -+ } else { -+ err = serio_write(serio, *command); -+ } -+ } -+ if (!err) -+ err = serio_write(serio, MSGEND); -+ -+ return err; -+} -+ -+static int pulse8_send_and_wait_once(struct pulse8 *pulse8, -+ const u8 *cmd, u8 cmd_len, -+ u8 response, u8 size) -+{ -+ int err; -+ -+ /*dev_info(pulse8->dev, "transmit: %*ph\n", cmd_len, cmd);*/ -+ init_completion(&pulse8->cmd_done); -+ -+ err = pulse8_send(pulse8->serio, cmd, cmd_len); -+ if (err) -+ return err; -+ -+ if (!wait_for_completion_timeout(&pulse8->cmd_done, HZ)) -+ return -ETIMEDOUT; -+ if ((pulse8->data[0] & 0x3f) == MSGCODE_COMMAND_REJECTED && -+ cmd[0] != MSGCODE_SET_CONTROLLED && -+ cmd[0] != MSGCODE_SET_AUTO_ENABLED && -+ cmd[0] != MSGCODE_GET_BUILDDATE) -+ return -ENOTTY; -+ if (response && -+ ((pulse8->data[0] & 0x3f) != response || pulse8->len < size + 1)) { -+ dev_info(pulse8->dev, "transmit: failed %02x\n", -+ pulse8->data[0] & 0x3f); -+ return -EIO; -+ } -+ return 0; -+} -+ -+static int pulse8_send_and_wait(struct pulse8 *pulse8, -+ const u8 *cmd, u8 cmd_len, u8 response, u8 size) -+{ -+ u8 cmd_sc[2]; -+ int err; -+ -+ mutex_lock(&pulse8->write_lock); -+ err = pulse8_send_and_wait_once(pulse8, cmd, cmd_len, response, size); -+ -+ if (err == -ENOTTY) { -+ cmd_sc[0] = MSGCODE_SET_CONTROLLED; -+ cmd_sc[1] = 1; -+ err = pulse8_send_and_wait_once(pulse8, cmd_sc, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ if (err) -+ goto unlock; -+ err = pulse8_send_and_wait_once(pulse8, cmd, cmd_len, -+ response, size); -+ } -+ -+unlock: -+ mutex_unlock(&pulse8->write_lock); -+ return err == -ENOTTY ? -EIO : err; -+} -+ -+static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio, -+ struct cec_log_addrs *log_addrs, u16 *pa) -+{ -+ u8 *data = pulse8->data + 1; -+ u8 cmd[2]; -+ int err; -+ struct tm tm; -+ time_t date; -+ -+ pulse8->vers = 0; -+ -+ cmd[0] = MSGCODE_FIRMWARE_VERSION; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 2); -+ if (err) -+ return err; -+ pulse8->vers = (data[0] << 8) | data[1]; -+ dev_info(pulse8->dev, "Firmware version %04x\n", pulse8->vers); -+ if (pulse8->vers < 2) { -+ *pa = CEC_PHYS_ADDR_INVALID; -+ return 0; -+ } -+ -+ cmd[0] = MSGCODE_GET_BUILDDATE; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4); -+ if (err) -+ return err; -+ date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; -+ time_to_tm(date, 0, &tm); -+ dev_info(pulse8->dev, "Firmware build date %04ld.%02d.%02d %02d:%02d:%02d\n", -+ tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday, -+ tm.tm_hour, tm.tm_min, tm.tm_sec); -+ -+ dev_dbg(pulse8->dev, "Persistent config:\n"); -+ cmd[0] = MSGCODE_GET_AUTO_ENABLED; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 1); -+ if (err) -+ return err; -+ pulse8->autonomous = data[0]; -+ dev_dbg(pulse8->dev, "Autonomous mode: %s", -+ data[0] ? "on" : "off"); -+ -+ cmd[0] = MSGCODE_GET_DEVICE_TYPE; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 1); -+ if (err) -+ return err; -+ log_addrs->primary_device_type[0] = data[0]; -+ dev_dbg(pulse8->dev, "Primary device type: %d\n", data[0]); -+ switch (log_addrs->primary_device_type[0]) { -+ case CEC_OP_PRIM_DEVTYPE_TV: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_TV; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_TV; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_RECORD: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_RECORD; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_RECORD; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_TUNER: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_TUNER; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_TUNER; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_PLAYBACK: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_PLAYBACK; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_PLAYBACK; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_AUDIOSYSTEM: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_PLAYBACK; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_AUDIOSYSTEM; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_SWITCH: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_SWITCH; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_PROCESSOR: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_SPECIFIC; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_SWITCH; -+ break; -+ default: -+ log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED; -+ log_addrs->all_device_types[0] = CEC_OP_ALL_DEVTYPE_SWITCH; -+ dev_info(pulse8->dev, "Unknown Primary Device Type: %d\n", -+ log_addrs->primary_device_type[0]); -+ break; -+ } -+ -+ cmd[0] = MSGCODE_GET_LOGICAL_ADDRESS_MASK; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 2); -+ if (err) -+ return err; -+ log_addrs->log_addr_mask = (data[0] << 8) | data[1]; -+ dev_dbg(pulse8->dev, "Logical address ACK mask: %x\n", -+ log_addrs->log_addr_mask); -+ if (log_addrs->log_addr_mask) -+ log_addrs->num_log_addrs = 1; -+ -+ cmd[0] = MSGCODE_GET_PHYSICAL_ADDRESS; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 1); -+ if (err) -+ return err; -+ *pa = (data[0] << 8) | data[1]; -+ dev_dbg(pulse8->dev, "Physical address: %x.%x.%x.%x\n", -+ cec_phys_addr_exp(*pa)); -+ -+ cmd[0] = MSGCODE_GET_HDMI_VERSION; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 1); -+ if (err) -+ return err; -+ log_addrs->cec_version = data[0]; -+ dev_dbg(pulse8->dev, "CEC version: %d\n", log_addrs->cec_version); -+ -+ cmd[0] = MSGCODE_GET_OSD_NAME; -+ err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 0); -+ if (err) -+ return err; -+ strncpy(log_addrs->osd_name, data, 13); -+ dev_dbg(pulse8->dev, "OSD name: %s\n", log_addrs->osd_name); -+ -+ return 0; -+} -+ -+static int pulse8_apply_persistent_config(struct pulse8 *pulse8, -+ struct cec_log_addrs *log_addrs, -+ u16 pa) -+{ -+ int err; -+ -+ err = cec_s_log_addrs(pulse8->adap, log_addrs, false); -+ if (err) -+ return err; -+ -+ cec_s_phys_addr(pulse8->adap, pa, false); -+ -+ return 0; -+} -+ -+static int pulse8_cec_adap_enable(struct cec_adapter *adap, bool enable) -+{ -+ struct pulse8 *pulse8 = cec_get_drvdata(adap); -+ u8 cmd[16]; -+ int err; -+ -+ cmd[0] = MSGCODE_SET_CONTROLLED; -+ cmd[1] = enable; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ return enable ? err : 0; -+} -+ -+static int pulse8_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr) -+{ -+ struct pulse8 *pulse8 = cec_get_drvdata(adap); -+ u16 mask = 0; -+ u16 pa = adap->phys_addr; -+ u8 cmd[16]; -+ int err = 0; -+ -+ mutex_lock(&pulse8->config_lock); -+ if (log_addr != CEC_LOG_ADDR_INVALID) -+ mask = 1 << log_addr; -+ cmd[0] = MSGCODE_SET_ACK_MASK; -+ cmd[1] = mask >> 8; -+ cmd[2] = mask & 0xff; -+ err = pulse8_send_and_wait(pulse8, cmd, 3, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if ((err && mask != 0) || pulse8->restoring_config) -+ goto unlock; -+ -+ cmd[0] = MSGCODE_SET_AUTO_ENABLED; -+ cmd[1] = log_addr == CEC_LOG_ADDR_INVALID ? 0 : 1; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ pulse8->autonomous = cmd[1]; -+ if (log_addr == CEC_LOG_ADDR_INVALID) -+ goto unlock; -+ -+ cmd[0] = MSGCODE_SET_DEVICE_TYPE; -+ cmd[1] = adap->log_addrs.primary_device_type[0]; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ -+ switch (adap->log_addrs.primary_device_type[0]) { -+ case CEC_OP_PRIM_DEVTYPE_TV: -+ mask = CEC_LOG_ADDR_MASK_TV; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_RECORD: -+ mask = CEC_LOG_ADDR_MASK_RECORD; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_TUNER: -+ mask = CEC_LOG_ADDR_MASK_TUNER; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_PLAYBACK: -+ mask = CEC_LOG_ADDR_MASK_PLAYBACK; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_AUDIOSYSTEM: -+ mask = CEC_LOG_ADDR_MASK_AUDIOSYSTEM; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_SWITCH: -+ mask = CEC_LOG_ADDR_MASK_UNREGISTERED; -+ break; -+ case CEC_OP_PRIM_DEVTYPE_PROCESSOR: -+ mask = CEC_LOG_ADDR_MASK_SPECIFIC; -+ break; -+ default: -+ mask = 0; -+ break; -+ } -+ cmd[0] = MSGCODE_SET_LOGICAL_ADDRESS_MASK; -+ cmd[1] = mask >> 8; -+ cmd[2] = mask & 0xff; -+ err = pulse8_send_and_wait(pulse8, cmd, 3, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ -+ cmd[0] = MSGCODE_SET_DEFAULT_LOGICAL_ADDRESS; -+ cmd[1] = log_addr; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ -+ cmd[0] = MSGCODE_SET_PHYSICAL_ADDRESS; -+ cmd[1] = pa >> 8; -+ cmd[2] = pa & 0xff; -+ err = pulse8_send_and_wait(pulse8, cmd, 3, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ -+ cmd[0] = MSGCODE_SET_HDMI_VERSION; -+ cmd[1] = adap->log_addrs.cec_version; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ -+ if (adap->log_addrs.osd_name[0]) { -+ size_t osd_len = strlen(adap->log_addrs.osd_name); -+ char *osd_str = cmd + 1; -+ -+ cmd[0] = MSGCODE_SET_OSD_NAME; -+ strncpy(cmd + 1, adap->log_addrs.osd_name, 13); -+ if (osd_len < 4) { -+ memset(osd_str + osd_len, ' ', 4 - osd_len); -+ osd_len = 4; -+ osd_str[osd_len] = '\0'; -+ strcpy(adap->log_addrs.osd_name, osd_str); -+ } -+ err = pulse8_send_and_wait(pulse8, cmd, 1 + osd_len, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ if (err) -+ goto unlock; -+ } -+ -+unlock: -+ if (pulse8->restoring_config) -+ pulse8->restoring_config = false; -+ else -+ pulse8->config_pending = true; -+ mutex_unlock(&pulse8->config_lock); -+ return err; -+} -+ -+static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, -+ u32 signal_free_time, struct cec_msg *msg) -+{ -+ struct pulse8 *pulse8 = cec_get_drvdata(adap); -+ u8 cmd[2]; -+ unsigned int i; -+ int err; -+ -+ cmd[0] = MSGCODE_TRANSMIT_IDLETIME; -+ cmd[1] = signal_free_time; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ cmd[0] = MSGCODE_TRANSMIT_ACK_POLARITY; -+ cmd[1] = cec_msg_is_broadcast(msg); -+ if (!err) -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ cmd[0] = msg->len == 1 ? MSGCODE_TRANSMIT_EOM : MSGCODE_TRANSMIT; -+ cmd[1] = msg->msg[0]; -+ if (!err) -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ if (!err && msg->len > 1) { -+ cmd[0] = msg->len == 2 ? MSGCODE_TRANSMIT_EOM : -+ MSGCODE_TRANSMIT; -+ cmd[1] = msg->msg[1]; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ for (i = 0; !err && i + 2 < msg->len; i++) { -+ cmd[0] = (i + 2 == msg->len - 1) ? -+ MSGCODE_TRANSMIT_EOM : MSGCODE_TRANSMIT; -+ cmd[1] = msg->msg[i + 2]; -+ err = pulse8_send_and_wait(pulse8, cmd, 2, -+ MSGCODE_COMMAND_ACCEPTED, 1); -+ } -+ } -+ -+ return err; -+} -+ -+static int pulse8_received(struct cec_adapter *adap, struct cec_msg *msg) -+{ -+ return -ENOMSG; -+} -+ -+static const struct cec_adap_ops pulse8_cec_adap_ops = { -+ .adap_enable = pulse8_cec_adap_enable, -+ .adap_log_addr = pulse8_cec_adap_log_addr, -+ .adap_transmit = pulse8_cec_adap_transmit, -+ .received = pulse8_received, -+}; -+ -+static int pulse8_connect(struct serio *serio, struct serio_driver *drv) -+{ -+ u32 caps = CEC_CAP_DEFAULTS | CEC_CAP_PHYS_ADDR | CEC_CAP_MONITOR_ALL; -+ struct pulse8 *pulse8; -+ int err = -ENOMEM; -+ struct cec_log_addrs log_addrs = {}; -+ u16 pa = CEC_PHYS_ADDR_INVALID; -+ -+ pulse8 = kzalloc(sizeof(*pulse8), GFP_KERNEL); -+ -+ if (!pulse8) -+ return -ENOMEM; -+ -+ pulse8->serio = serio; -+ pulse8->adap = cec_allocate_adapter(&pulse8_cec_adap_ops, pulse8, -+ dev_name(&serio->dev), caps, 1); -+ err = PTR_ERR_OR_ZERO(pulse8->adap); -+ if (err < 0) -+ goto free_device; -+ -+ pulse8->dev = &serio->dev; -+ serio_set_drvdata(serio, pulse8); -+ INIT_WORK(&pulse8->work, pulse8_irq_work_handler); -+ mutex_init(&pulse8->write_lock); -+ mutex_init(&pulse8->config_lock); -+ pulse8->config_pending = false; -+ -+ err = serio_open(serio, drv); -+ if (err) -+ goto delete_adap; -+ -+ err = pulse8_setup(pulse8, serio, &log_addrs, &pa); -+ if (err) -+ goto close_serio; -+ -+ err = cec_register_adapter(pulse8->adap, &serio->dev); -+ if (err < 0) -+ goto close_serio; -+ -+ pulse8->dev = &pulse8->adap->devnode.dev; -+ -+ if (persistent_config && pulse8->autonomous) { -+ err = pulse8_apply_persistent_config(pulse8, &log_addrs, pa); -+ if (err) -+ goto close_serio; -+ pulse8->restoring_config = true; -+ } -+ -+ INIT_DELAYED_WORK(&pulse8->ping_eeprom_work, -+ pulse8_ping_eeprom_work_handler); -+ schedule_delayed_work(&pulse8->ping_eeprom_work, PING_PERIOD); -+ -+ return 0; -+ -+close_serio: -+ serio_close(serio); -+delete_adap: -+ cec_delete_adapter(pulse8->adap); -+ serio_set_drvdata(serio, NULL); -+free_device: -+ kfree(pulse8); -+ return err; -+} -+ -+static void pulse8_ping_eeprom_work_handler(struct work_struct *work) -+{ -+ struct pulse8 *pulse8 = -+ container_of(work, struct pulse8, ping_eeprom_work.work); -+ u8 cmd; -+ -+ schedule_delayed_work(&pulse8->ping_eeprom_work, PING_PERIOD); -+ cmd = MSGCODE_PING; -+ pulse8_send_and_wait(pulse8, &cmd, 1, -+ MSGCODE_COMMAND_ACCEPTED, 0); -+ -+ if (pulse8->vers < 2) -+ return; -+ -+ mutex_lock(&pulse8->config_lock); -+ if (pulse8->config_pending && persistent_config) { -+ dev_dbg(pulse8->dev, "writing pending config to EEPROM\n"); -+ cmd = MSGCODE_WRITE_EEPROM; -+ if (pulse8_send_and_wait(pulse8, &cmd, 1, -+ MSGCODE_COMMAND_ACCEPTED, 0)) -+ dev_info(pulse8->dev, "failed to write pending config to EEPROM\n"); -+ else -+ pulse8->config_pending = false; -+ } -+ mutex_unlock(&pulse8->config_lock); -+} -+ -+static const struct serio_device_id pulse8_serio_ids[] = { -+ { -+ .type = SERIO_RS232, -+ .proto = SERIO_PULSE8_CEC, -+ .id = SERIO_ANY, -+ .extra = SERIO_ANY, -+ }, -+ { 0 } -+}; -+ -+MODULE_DEVICE_TABLE(serio, pulse8_serio_ids); -+ -+static struct serio_driver pulse8_drv = { -+ .driver = { -+ .name = "pulse8-cec", -+ }, -+ .description = "Pulse Eight HDMI CEC driver", -+ .id_table = pulse8_serio_ids, -+ .interrupt = pulse8_interrupt, -+ .connect = pulse8_connect, -+ .disconnect = pulse8_disconnect, -+}; -+ -+module_serio_driver(pulse8_drv); -diff --git a/include/uapi/linux/serio.h b/include/uapi/linux/serio.h -index becdd78295cc..4588c66a8df0 100644 ---- a/include/uapi/linux/serio.h -+++ b/include/uapi/linux/serio.h -@@ -77,5 +77,6 @@ - #define SERIO_PS2MULT 0x3c - #define SERIO_TSC40 0x3d - #define SERIO_WACOM_IV 0x3e -+#define SERIO_PULSE8_CEC 0x40 - - #endif /* _UAPI_SERIO_H */ - -From c9a3bba3534d8673f07a233e5298d12979ada5b8 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 4 Sep 2017 22:34:24 +0200 -Subject: [PATCH] BACKPORT: RainShadow Tech HDMI CEC from v4.15 - ---- - MAINTAINERS | 7 + - drivers/media/usb/Kconfig | 1 + - drivers/media/usb/Makefile | 1 + - drivers/media/usb/rainshadow-cec/Kconfig | 11 + - drivers/media/usb/rainshadow-cec/Makefile | 1 + - drivers/media/usb/rainshadow-cec/rainshadow-cec.c | 384 ++++++++++++++++++++++ - include/uapi/linux/serio.h | 1 + - 7 files changed, 406 insertions(+) - create mode 100644 drivers/media/usb/rainshadow-cec/Kconfig - create mode 100644 drivers/media/usb/rainshadow-cec/Makefile - create mode 100644 drivers/media/usb/rainshadow-cec/rainshadow-cec.c - -diff --git a/MAINTAINERS b/MAINTAINERS -index 0c1232c326a5..551555a162c3 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -8912,6 +8912,13 @@ L: linux-fbdev@vger.kernel.org - S: Maintained - F: drivers/video/fbdev/aty/aty128fb.c - -+RAINSHADOW-CEC DRIVER -+M: Hans Verkuil -+L: linux-media@vger.kernel.org -+T: git git://linuxtv.org/media_tree.git -+S: Maintained -+F: drivers/media/usb/rainshadow-cec/* -+ - RALINK RT2X00 WIRELESS LAN DRIVER - P: rt2x00 project - M: Stanislaw Gruszka -diff --git a/drivers/media/usb/Kconfig b/drivers/media/usb/Kconfig -index c9644b62f91a..b24e753c4766 100644 ---- a/drivers/media/usb/Kconfig -+++ b/drivers/media/usb/Kconfig -@@ -63,6 +63,7 @@ endif - if MEDIA_CEC_SUPPORT - comment "USB HDMI CEC adapters" - source "drivers/media/usb/pulse8-cec/Kconfig" -+source "drivers/media/usb/rainshadow-cec/Kconfig" - endif - - endif #MEDIA_USB_SUPPORT -diff --git a/drivers/media/usb/Makefile b/drivers/media/usb/Makefile -index 0f15e3351ddc..738b993ec8b0 100644 ---- a/drivers/media/usb/Makefile -+++ b/drivers/media/usb/Makefile -@@ -25,3 +25,4 @@ obj-$(CONFIG_VIDEO_USBTV) += usbtv/ - obj-$(CONFIG_VIDEO_GO7007) += go7007/ - obj-$(CONFIG_DVB_AS102) += as102/ - obj-$(CONFIG_USB_PULSE8_CEC) += pulse8-cec/ -+obj-$(CONFIG_USB_RAINSHADOW_CEC) += rainshadow-cec/ -diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig -new file mode 100644 -index 000000000000..030ef01b1ff0 ---- /dev/null -+++ b/drivers/media/usb/rainshadow-cec/Kconfig -@@ -0,0 +1,11 @@ -+config USB_RAINSHADOW_CEC -+ tristate "RainShadow Tech HDMI CEC" -+ depends on USB_ACM -+ select CEC_CORE -+ select SERIO -+ select SERIO_SERPORT -+ ---help--- -+ This is a cec driver for the RainShadow Tech HDMI CEC device. -+ -+ To compile this driver as a module, choose M here: the -+ module will be called rainshadow-cec. -diff --git a/drivers/media/usb/rainshadow-cec/Makefile b/drivers/media/usb/rainshadow-cec/Makefile -new file mode 100644 -index 000000000000..a79fbc77e1f7 ---- /dev/null -+++ b/drivers/media/usb/rainshadow-cec/Makefile -@@ -0,0 +1 @@ -+obj-$(CONFIG_USB_RAINSHADOW_CEC) += rainshadow-cec.o -diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c -new file mode 100644 -index 000000000000..cecdcbcd400c ---- /dev/null -+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c -@@ -0,0 +1,384 @@ -+/* -+ * RainShadow Tech HDMI CEC driver -+ * -+ * Copyright 2016 Hans Verkuil -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+MODULE_AUTHOR("Hans Verkuil "); -+MODULE_DESCRIPTION("RainShadow Tech HDMI CEC driver"); -+MODULE_LICENSE("GPL"); -+ -+#define DATA_SIZE 256 -+ -+struct rain { -+ struct device *dev; -+ struct serio *serio; -+ struct cec_adapter *adap; -+ struct completion cmd_done; -+ struct work_struct work; -+ -+ /* Low-level ringbuffer, collecting incoming characters */ -+ char buf[DATA_SIZE]; -+ unsigned int buf_rd_idx; -+ unsigned int buf_wr_idx; -+ unsigned int buf_len; -+ spinlock_t buf_lock; -+ -+ /* command buffer */ -+ char cmd[DATA_SIZE]; -+ unsigned int cmd_idx; -+ bool cmd_started; -+ -+ /* reply to a command, only used to store the firmware version */ -+ char cmd_reply[DATA_SIZE]; -+ -+ struct mutex write_lock; -+}; -+ -+static void rain_process_msg(struct rain *rain) -+{ -+ struct cec_msg msg = {}; -+ const char *cmd = rain->cmd + 3; -+ int stat = -1; -+ -+ for (; *cmd; cmd++) { -+ if (!isxdigit(*cmd)) -+ continue; -+ if (isxdigit(cmd[0]) && isxdigit(cmd[1])) { -+ if (msg.len == CEC_MAX_MSG_SIZE) -+ break; -+ if (hex2bin(msg.msg + msg.len, cmd, 1)) -+ continue; -+ msg.len++; -+ cmd++; -+ continue; -+ } -+ if (!cmd[1]) -+ stat = hex_to_bin(cmd[0]); -+ break; -+ } -+ -+ if (rain->cmd[0] == 'R') { -+ if (stat == 1 || stat == 2) -+ cec_received_msg(rain->adap, &msg); -+ return; -+ } -+ -+ switch (stat) { -+ case 1: -+ cec_transmit_attempt_done(rain->adap, CEC_TX_STATUS_OK); -+ break; -+ case 2: -+ cec_transmit_attempt_done(rain->adap, CEC_TX_STATUS_NACK); -+ break; -+ default: -+ cec_transmit_attempt_done(rain->adap, CEC_TX_STATUS_LOW_DRIVE); -+ break; -+ } -+} -+ -+static void rain_irq_work_handler(struct work_struct *work) -+{ -+ struct rain *rain = -+ container_of(work, struct rain, work); -+ -+ while (true) { -+ unsigned long flags; -+ char data; -+ -+ spin_lock_irqsave(&rain->buf_lock, flags); -+ if (!rain->buf_len) { -+ spin_unlock_irqrestore(&rain->buf_lock, flags); -+ break; -+ } -+ -+ data = rain->buf[rain->buf_rd_idx]; -+ rain->buf_len--; -+ rain->buf_rd_idx = (rain->buf_rd_idx + 1) & 0xff; -+ -+ spin_unlock_irqrestore(&rain->buf_lock, flags); -+ -+ if (!rain->cmd_started && data != '?') -+ continue; -+ -+ switch (data) { -+ case '\r': -+ rain->cmd[rain->cmd_idx] = '\0'; -+ dev_dbg(rain->dev, "received: %s\n", rain->cmd); -+ if (!memcmp(rain->cmd, "REC", 3) || -+ !memcmp(rain->cmd, "STA", 3)) { -+ rain_process_msg(rain); -+ } else { -+ strcpy(rain->cmd_reply, rain->cmd); -+ complete(&rain->cmd_done); -+ } -+ rain->cmd_idx = 0; -+ rain->cmd_started = false; -+ break; -+ -+ case '\n': -+ rain->cmd_idx = 0; -+ rain->cmd_started = false; -+ break; -+ -+ case '?': -+ rain->cmd_idx = 0; -+ rain->cmd_started = true; -+ break; -+ -+ default: -+ if (rain->cmd_idx >= DATA_SIZE - 1) { -+ dev_dbg(rain->dev, -+ "throwing away %d bytes of garbage\n", rain->cmd_idx); -+ rain->cmd_idx = 0; -+ } -+ rain->cmd[rain->cmd_idx++] = data; -+ break; -+ } -+ } -+} -+ -+static irqreturn_t rain_interrupt(struct serio *serio, unsigned char data, -+ unsigned int flags) -+{ -+ struct rain *rain = serio_get_drvdata(serio); -+ -+ if (rain->buf_len == DATA_SIZE) { -+ dev_warn_once(rain->dev, "buffer overflow\n"); -+ return IRQ_HANDLED; -+ } -+ spin_lock(&rain->buf_lock); -+ rain->buf_len++; -+ rain->buf[rain->buf_wr_idx] = data; -+ rain->buf_wr_idx = (rain->buf_wr_idx + 1) & 0xff; -+ spin_unlock(&rain->buf_lock); -+ schedule_work(&rain->work); -+ return IRQ_HANDLED; -+} -+ -+static void rain_disconnect(struct serio *serio) -+{ -+ struct rain *rain = serio_get_drvdata(serio); -+ -+ cancel_work_sync(&rain->work); -+ cec_unregister_adapter(rain->adap); -+ dev_info(&serio->dev, "disconnected\n"); -+ serio_close(serio); -+ serio_set_drvdata(serio, NULL); -+ kfree(rain); -+} -+ -+static int rain_send(struct rain *rain, const char *command) -+{ -+ int err = serio_write(rain->serio, '!'); -+ -+ dev_dbg(rain->dev, "send: %s\n", command); -+ while (!err && *command) -+ err = serio_write(rain->serio, *command++); -+ if (!err) -+ err = serio_write(rain->serio, '~'); -+ -+ return err; -+} -+ -+static int rain_send_and_wait(struct rain *rain, -+ const char *cmd, const char *reply) -+{ -+ int err; -+ -+ init_completion(&rain->cmd_done); -+ -+ mutex_lock(&rain->write_lock); -+ err = rain_send(rain, cmd); -+ if (err) -+ goto err; -+ -+ if (!wait_for_completion_timeout(&rain->cmd_done, HZ)) { -+ err = -ETIMEDOUT; -+ goto err; -+ } -+ if (reply && strncmp(rain->cmd_reply, reply, strlen(reply))) { -+ dev_dbg(rain->dev, -+ "transmit of '%s': received '%s' instead of '%s'\n", -+ cmd, rain->cmd_reply, reply); -+ err = -EIO; -+ } -+err: -+ mutex_unlock(&rain->write_lock); -+ return err; -+} -+ -+static int rain_setup(struct rain *rain, struct serio *serio, -+ struct cec_log_addrs *log_addrs, u16 *pa) -+{ -+ int err; -+ -+ err = rain_send_and_wait(rain, "R", "REV"); -+ if (err) -+ return err; -+ dev_info(rain->dev, "Firmware version %s\n", rain->cmd_reply + 4); -+ -+ err = rain_send_and_wait(rain, "Q 1", "QTY"); -+ if (err) -+ return err; -+ err = rain_send_and_wait(rain, "c0000", "CFG"); -+ if (err) -+ return err; -+ return rain_send_and_wait(rain, "A F 0000", "ADR"); -+} -+ -+static int rain_cec_adap_enable(struct cec_adapter *adap, bool enable) -+{ -+ return 0; -+} -+ -+static int rain_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr) -+{ -+ struct rain *rain = cec_get_drvdata(adap); -+ u8 cmd[16]; -+ -+ if (log_addr == CEC_LOG_ADDR_INVALID) -+ log_addr = CEC_LOG_ADDR_UNREGISTERED; -+ snprintf(cmd, sizeof(cmd), "A %x", log_addr); -+ return rain_send_and_wait(rain, cmd, "ADR"); -+} -+ -+static int rain_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, -+ u32 signal_free_time, struct cec_msg *msg) -+{ -+ struct rain *rain = cec_get_drvdata(adap); -+ char cmd[2 * CEC_MAX_MSG_SIZE + 16]; -+ unsigned int i; -+ int err; -+ -+ if (msg->len == 1) { -+ snprintf(cmd, sizeof(cmd), "x%x", cec_msg_destination(msg)); -+ } else { -+ char hex[3]; -+ -+ snprintf(cmd, sizeof(cmd), "x%x %02x ", -+ cec_msg_destination(msg), msg->msg[1]); -+ for (i = 2; i < msg->len; i++) { -+ snprintf(hex, sizeof(hex), "%02x", msg->msg[i]); -+ strlcat(cmd, hex, sizeof(cmd)); -+ } -+ } -+ mutex_lock(&rain->write_lock); -+ err = rain_send(rain, cmd); -+ mutex_unlock(&rain->write_lock); -+ return err; -+} -+ -+static const struct cec_adap_ops rain_cec_adap_ops = { -+ .adap_enable = rain_cec_adap_enable, -+ .adap_log_addr = rain_cec_adap_log_addr, -+ .adap_transmit = rain_cec_adap_transmit, -+}; -+ -+static int rain_connect(struct serio *serio, struct serio_driver *drv) -+{ -+ u32 caps = CEC_CAP_DEFAULTS | CEC_CAP_PHYS_ADDR | CEC_CAP_MONITOR_ALL; -+ struct rain *rain; -+ int err = -ENOMEM; -+ struct cec_log_addrs log_addrs = {}; -+ u16 pa = CEC_PHYS_ADDR_INVALID; -+ -+ rain = kzalloc(sizeof(*rain), GFP_KERNEL); -+ -+ if (!rain) -+ return -ENOMEM; -+ -+ rain->serio = serio; -+ rain->adap = cec_allocate_adapter(&rain_cec_adap_ops, rain, -+ dev_name(&serio->dev), caps, 1); -+ err = PTR_ERR_OR_ZERO(rain->adap); -+ if (err < 0) -+ goto free_device; -+ -+ rain->dev = &serio->dev; -+ serio_set_drvdata(serio, rain); -+ INIT_WORK(&rain->work, rain_irq_work_handler); -+ mutex_init(&rain->write_lock); -+ spin_lock_init(&rain->buf_lock); -+ -+ err = serio_open(serio, drv); -+ if (err) -+ goto delete_adap; -+ -+ err = rain_setup(rain, serio, &log_addrs, &pa); -+ if (err) -+ goto close_serio; -+ -+ err = cec_register_adapter(rain->adap, &serio->dev); -+ if (err < 0) -+ goto close_serio; -+ -+ rain->dev = &rain->adap->devnode.dev; -+ return 0; -+ -+close_serio: -+ serio_close(serio); -+delete_adap: -+ cec_delete_adapter(rain->adap); -+ serio_set_drvdata(serio, NULL); -+free_device: -+ kfree(rain); -+ return err; -+} -+ -+static const struct serio_device_id rain_serio_ids[] = { -+ { -+ .type = SERIO_RS232, -+ .proto = SERIO_RAINSHADOW_CEC, -+ .id = SERIO_ANY, -+ .extra = SERIO_ANY, -+ }, -+ { 0 } -+}; -+ -+MODULE_DEVICE_TABLE(serio, rain_serio_ids); -+ -+static struct serio_driver rain_drv = { -+ .driver = { -+ .name = "rainshadow-cec", -+ }, -+ .description = "RainShadow Tech HDMI CEC driver", -+ .id_table = rain_serio_ids, -+ .interrupt = rain_interrupt, -+ .connect = rain_connect, -+ .disconnect = rain_disconnect, -+}; -+ -+module_serio_driver(rain_drv); -diff --git a/include/uapi/linux/serio.h b/include/uapi/linux/serio.h -index 4588c66a8df0..89b72003fb68 100644 ---- a/include/uapi/linux/serio.h -+++ b/include/uapi/linux/serio.h -@@ -78,5 +78,6 @@ - #define SERIO_TSC40 0x3d - #define SERIO_WACOM_IV 0x3e - #define SERIO_PULSE8_CEC 0x40 -+#define SERIO_RAINSHADOW_CEC 0x41 - - #endif /* _UAPI_SERIO_H */ - -From d7ef718f1c62b9f4e0b7042d5b4040a14335c369 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 2 Sep 2017 16:23:11 +0200 -Subject: [PATCH] [media] rc/keymaps: initialize rc-cec early - ---- - drivers/media/rc/keymaps/rc-cec.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/rc/keymaps/rc-cec.c b/drivers/media/rc/keymaps/rc-cec.c -index 354c8e724b8e..fb0c2b1f3814 100644 ---- a/drivers/media/rc/keymaps/rc-cec.c -+++ b/drivers/media/rc/keymaps/rc-cec.c -@@ -175,7 +175,7 @@ static void __exit exit_rc_map_cec(void) - rc_map_unregister(&cec_map); - } - --module_init(init_rc_map_cec); -+subsys_initcall(init_rc_map_cec); - module_exit(exit_rc_map_cec); - - MODULE_LICENSE("GPL"); - -From e583e082ee42c04d3458ee71521175d39b4daed5 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 2 Sep 2017 16:23:11 +0200 -Subject: [PATCH] drm/bridge: dw-hdmi: read edid on hpd event - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 23 +++++++++++++++++++---- - 1 file changed, 19 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index d57d999c50a5..4ae2735f59e4 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -2479,6 +2479,7 @@ static void dw_hdmi_bridge_nop(struct drm_bridge *bridge) - static enum drm_connector_status - dw_hdmi_connector_detect(struct drm_connector *connector, bool force) - { -+ enum drm_connector_status status; - struct dw_hdmi *hdmi = container_of(connector, struct dw_hdmi, - connector); - -@@ -2488,7 +2489,24 @@ dw_hdmi_connector_detect(struct drm_connector *connector, bool force) - dw_hdmi_update_phy_mask(hdmi); - mutex_unlock(&hdmi->mutex); - -- return hdmi->phy.ops->read_hpd(hdmi, hdmi->phy.data); -+ status = hdmi->phy.ops->read_hpd(hdmi, hdmi->phy.data); -+ -+ if (status == connector_status_connected && hdmi->ddc) { -+ struct edid *edid = drm_get_edid(connector, hdmi->ddc); -+ if (edid) { -+ dev_dbg(hdmi->dev, "got edid: width[%d] x height[%d]\n", -+ edid->width_cm, edid->height_cm); -+ -+ hdmi->sink_is_hdmi = drm_detect_hdmi_monitor(edid); -+ hdmi->sink_has_audio = drm_detect_monitor_audio(edid); -+ drm_mode_connector_update_edid_property(connector, edid); -+ cec_notifier_set_phys_addr_from_edid(hdmi->cec_notifier, edid); -+ drm_edid_to_eld(connector, edid); -+ kfree(edid); -+ } -+ } -+ -+ return status; - } - - static int dw_hdmi_connector_get_modes(struct drm_connector *connector) -@@ -2891,9 +2909,6 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id) - dw_hdmi_update_phy_mask(hdmi); - } - mutex_unlock(&hdmi->mutex); -- if (!(phy_stat & (HDMI_PHY_RX_SENSE | HDMI_PHY_HPD))) -- cec_notifier_set_phys_addr(hdmi->cec_notifier, -- CEC_PHYS_ADDR_INVALID); - } - - check_hdmi_irq(hdmi, intr_stat, phy_int_pol); diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0004-audio.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0004-audio.patch deleted file mode 100644 index 9c3608ae6f67..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0004-audio.patch +++ /dev/null @@ -1,1597 +0,0 @@ -From dabace918ba0543c5a12e03fb823886891cd82dc Mon Sep 17 00:00:00 2001 -From: Chris Zhong -Date: Mon, 18 Jul 2016 22:34:34 +0800 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: correct the spdif clk - -The spdif mclk should be 128 times of sample rate, and there is a -internal divider, the real rate of spdif mclk is mclk / (div + 1). -Hence, the original driver always get the good frequency for -48000/96000/44100/192000. But for 32000, the mclk is incorrect, -it should be 32000*128, but get 48000*128. Do not use the internal -divider here, just set all mclk to 128 * sample rate directly. - -Signed-off-by: Chris Zhong -Signed-off-by: Mark Brown -(cherry picked from commit 46dd2e28a90e48fbf1b7e253933fa3b7242e9b1b) ---- - sound/soc/rockchip/rockchip_spdif.c | 17 +---------------- - 1 file changed, 1 insertion(+), 16 deletions(-) - -diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c -index c211750b54ee..784941ca2408 100644 ---- a/sound/soc/rockchip/rockchip_spdif.c -+++ b/sound/soc/rockchip/rockchip_spdif.c -@@ -105,21 +105,7 @@ static int rk_spdif_hw_params(struct snd_pcm_substream *substream, - int ret; - - srate = params_rate(params); -- switch (srate) { -- case 32000: -- case 48000: -- case 96000: -- mclk = 96000 * 128; /* 12288000 hz */ -- break; -- case 44100: -- mclk = 44100 * 256; /* 11289600 hz */ -- break; -- case 192000: -- mclk = 192000 * 128; /* 24576000 hz */ -- break; -- default: -- return -EINVAL; -- } -+ mclk = srate * 128; - - switch (params_format(params)) { - case SNDRV_PCM_FORMAT_S16_LE: -@@ -143,7 +129,6 @@ static int rk_spdif_hw_params(struct snd_pcm_substream *substream, - return ret; - } - -- val |= SPDIF_CFGR_CLK_DIV(mclk/(srate * 256)); - ret = regmap_update_bits(spdif->regmap, SPDIF_CFGR, - SPDIF_CFGR_CLK_DIV_MASK | SPDIF_CFGR_HALFWORD_ENABLE | - SDPIF_CFGR_VDW_MASK, - -From 3069a5725338532939d13e3dc329f2b3d183b260 Mon Sep 17 00:00:00 2001 -From: Sugar Zhang -Date: Wed, 7 Sep 2016 14:30:21 +0800 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: spdif: restore register during - runtime_suspend/resume cycle - -when step into runtime_suspend, spdif pd will be disabled and loss state. -so need to restore register when runtime_resume. - -Signed-off-by: Sugar Zhang -Signed-off-by: Mark Brown -(cherry picked from commit 3628c6987fb45d719cd963805bbba9f15017290e) ---- - sound/soc/rockchip/rockchip_spdif.c | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c -index 784941ca2408..831e4caf29d3 100644 ---- a/sound/soc/rockchip/rockchip_spdif.c -+++ b/sound/soc/rockchip/rockchip_spdif.c -@@ -69,6 +69,7 @@ static int __maybe_unused rk_spdif_runtime_suspend(struct device *dev) - { - struct rk_spdif_dev *spdif = dev_get_drvdata(dev); - -+ regcache_cache_only(spdif->regmap, true); - clk_disable_unprepare(spdif->mclk); - clk_disable_unprepare(spdif->hclk); - -@@ -92,7 +93,16 @@ static int __maybe_unused rk_spdif_runtime_resume(struct device *dev) - return ret; - } - -- return 0; -+ regcache_cache_only(spdif->regmap, false); -+ regcache_mark_dirty(spdif->regmap); -+ -+ ret = regcache_sync(spdif->regmap); -+ if (ret) { -+ clk_disable_unprepare(spdif->mclk); -+ clk_disable_unprepare(spdif->hclk); -+ } -+ -+ return ret; - } - - static int rk_spdif_hw_params(struct snd_pcm_substream *substream, - -From d852c659ff563456480c55cfea53c578399c04ff Mon Sep 17 00:00:00 2001 -From: Arnaud Pouliquen -Date: Tue, 3 Jan 2017 16:52:50 +0100 -Subject: [PATCH] UPSTREAM: DRM: add help to get ELD speaker allocation - -Add helper to allow users to retrieve the speaker allocations without -knowledge of the ELD structure. - -Signed-off-by: Arnaud Pouliquen -Reviewed-by: Jani Nikula -Signed-off-by: Mark Brown -(cherry picked from commit c82dbe5c055e4d246bd07c4d7b24801c9445c241) ---- - include/drm/drm_edid.h | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h -index 85861b63e77a..55201e7e2ede 100644 ---- a/include/drm/drm_edid.h -+++ b/include/drm/drm_edid.h -@@ -254,6 +254,7 @@ struct detailed_timing { - # define DRM_ELD_AUD_SYNCH_DELAY_MAX 0xfa /* 500 ms */ - - #define DRM_ELD_SPEAKER 7 -+# define DRM_ELD_SPEAKER_MASK 0x7f - # define DRM_ELD_SPEAKER_RLRC (1 << 6) - # define DRM_ELD_SPEAKER_FLRC (1 << 5) - # define DRM_ELD_SPEAKER_RC (1 << 4) -@@ -417,6 +418,18 @@ static inline int drm_eld_size(const uint8_t *eld) - return DRM_ELD_HEADER_BLOCK_SIZE + eld[DRM_ELD_BASELINE_ELD_LEN] * 4; - } - -+/** -+ * drm_eld_get_spk_alloc - Get speaker allocation -+ * @eld: pointer to an ELD memory structure -+ * -+ * The returned value is the speakers mask. User has to use %DRM_ELD_SPEAKER -+ * field definitions to identify speakers. -+ */ -+static inline u8 drm_eld_get_spk_alloc(const uint8_t *eld) -+{ -+ return eld[DRM_ELD_SPEAKER] & DRM_ELD_SPEAKER_MASK; -+} -+ - struct edid *drm_do_get_edid(struct drm_connector *connector, - int (*get_edid_block)(void *data, u8 *buf, unsigned int block, - size_t len), - -From 4e08e72298c858a65950b98ca62613fb95cd0a35 Mon Sep 17 00:00:00 2001 -From: Arnaud Pouliquen -Date: Tue, 3 Jan 2017 16:52:51 +0100 -Subject: [PATCH] UPSTREAM: ASoC: core: add optional pcm_new callback for DAI - driver - -During probe, DAIs can need to perform some actions that requests -the knowledge of the pcm runtime handle. -The callback is called during DAIs linking, after PCM device creation. -For instance this can be used to add relationship between a DAI pcm -control and the pcm device. - -Signed-off-by: Arnaud Pouliquen -Signed-off-by: Mark Brown -(cherry picked from commit 25f7b701c20db3e9ae09e28dd652949bd977e5cd) ---- - include/sound/soc-dai.h | 3 +++ - sound/soc/soc-core.c | 28 ++++++++++++++++++++++++++++ - 2 files changed, 31 insertions(+) - -diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h -index 212eaaf172ed..345e4f8ee93f 100644 ---- a/include/sound/soc-dai.h -+++ b/include/sound/soc-dai.h -@@ -230,6 +230,9 @@ struct snd_soc_dai_driver { - int (*resume)(struct snd_soc_dai *dai); - /* compress dai */ - int (*compress_new)(struct snd_soc_pcm_runtime *rtd, int num); -+ /* Optional Callback used at pcm creation*/ -+ int (*pcm_new)(struct snd_soc_pcm_runtime *rtd, -+ struct snd_soc_dai *dai); - /* DAI is also used for the control bus */ - bool bus_control; - -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index 3c6713da3ad9..e46e80c0e07d 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -1289,6 +1289,27 @@ static int soc_probe_dai(struct snd_soc_dai *dai, int order) - return 0; - } - -+static int soc_link_dai_pcm_new(struct snd_soc_dai **dais, int num_dais, -+ struct snd_soc_pcm_runtime *rtd) -+{ -+ int i, ret = 0; -+ -+ for (i = 0; i < num_dais; ++i) { -+ struct snd_soc_dai_driver *drv = dais[i]->driver; -+ -+ if (!rtd->dai_link->no_pcm && drv->pcm_new) -+ ret = drv->pcm_new(rtd, dais[i]); -+ if (ret < 0) { -+ dev_err(dais[i]->dev, -+ "ASoC: Failed to bind %s with pcm device\n", -+ dais[i]->name); -+ return ret; -+ } -+ } -+ -+ return 0; -+} -+ - static int soc_link_dai_widgets(struct snd_soc_card *card, - struct snd_soc_dai_link *dai_link, - struct snd_soc_pcm_runtime *rtd) -@@ -1400,6 +1421,13 @@ static int soc_probe_link_dais(struct snd_soc_card *card, int num, int order) - dai_link->stream_name, ret); - return ret; - } -+ ret = soc_link_dai_pcm_new(&cpu_dai, 1, rtd); -+ if (ret < 0) -+ return ret; -+ ret = soc_link_dai_pcm_new(rtd->codec_dais, -+ rtd->num_codecs, rtd); -+ if (ret < 0) -+ return ret; - } else { - INIT_DELAYED_WORK(&rtd->delayed_work, - codec2codec_close_delayed_work); - -From 900f1d7bb2cddd1f445e0f3ef92fb0f7056a4c5a Mon Sep 17 00:00:00 2001 -From: Arnaud Pouliquen -Date: Tue, 3 Jan 2017 16:52:52 +0100 -Subject: [PATCH] UPSTREAM: ASoC: hdmi-codec: add channel mapping control - -Add user interface to provide channel mapping. -In a first step this control is read only. - -As TLV type, the control provides all configuration available for -HDMI sink(ELD), and provides current channel mapping selected by codec -based on ELD and number of channels specified by user on open. -When control is called before the number of the channel is specified -(i.e. hw_params is set), it returns all channels set to UNKNOWN. - -Signed-off-by: Arnaud Pouliquen -Signed-off-by: Mark Brown -(cherry picked from commit cd6111b26280a2f38a9fb8e6630c63a96477e4bf) ---- - sound/soc/codecs/hdmi-codec.c | 377 +++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 376 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c -index 028d60c196ae..cb78d8971b41 100644 ---- a/sound/soc/codecs/hdmi-codec.c -+++ b/sound/soc/codecs/hdmi-codec.c -@@ -21,12 +21,264 @@ - #include - #include - #include -+#include - #include - #include - #include - - #include /* This is only to get MAX_ELD_BYTES */ - -+#define HDMI_CODEC_CHMAP_IDX_UNKNOWN -1 -+ -+struct hdmi_codec_channel_map_table { -+ unsigned char map; /* ALSA API channel map position */ -+ unsigned long spk_mask; /* speaker position bit mask */ -+}; -+ -+/* -+ * CEA speaker placement for HDMI 1.4: -+ * -+ * FL FLC FC FRC FR FRW -+ * -+ * LFE -+ * -+ * RL RLC RC RRC RR -+ * -+ * Speaker placement has to be extended to support HDMI 2.0 -+ */ -+enum hdmi_codec_cea_spk_placement { -+ FL = BIT(0), /* Front Left */ -+ FC = BIT(1), /* Front Center */ -+ FR = BIT(2), /* Front Right */ -+ FLC = BIT(3), /* Front Left Center */ -+ FRC = BIT(4), /* Front Right Center */ -+ RL = BIT(5), /* Rear Left */ -+ RC = BIT(6), /* Rear Center */ -+ RR = BIT(7), /* Rear Right */ -+ RLC = BIT(8), /* Rear Left Center */ -+ RRC = BIT(9), /* Rear Right Center */ -+ LFE = BIT(10), /* Low Frequency Effect */ -+}; -+ -+/* -+ * cea Speaker allocation structure -+ */ -+struct hdmi_codec_cea_spk_alloc { -+ const int ca_id; -+ unsigned int n_ch; -+ unsigned long mask; -+}; -+ -+/* Channel maps stereo HDMI */ -+const struct snd_pcm_chmap_elem hdmi_codec_stereo_chmaps[] = { -+ { .channels = 2, -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR } }, -+ { } -+}; -+ -+/* Channel maps for multi-channel playbacks, up to 8 n_ch */ -+const struct snd_pcm_chmap_elem hdmi_codec_8ch_chmaps[] = { -+ { .channels = 2, /* CA_ID 0x00 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR } }, -+ { .channels = 4, /* CA_ID 0x01 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA } }, -+ { .channels = 4, /* CA_ID 0x02 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC } }, -+ { .channels = 4, /* CA_ID 0x03 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC } }, -+ { .channels = 6, /* CA_ID 0x04 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 6, /* CA_ID 0x05 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 6, /* CA_ID 0x06 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 6, /* CA_ID 0x07 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 6, /* CA_ID 0x08 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR } }, -+ { .channels = 6, /* CA_ID 0x09 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR } }, -+ { .channels = 6, /* CA_ID 0x0A */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR } }, -+ { .channels = 6, /* CA_ID 0x0B */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR } }, -+ { .channels = 8, /* CA_ID 0x0C */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 8, /* CA_ID 0x0D */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 8, /* CA_ID 0x0E */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 8, /* CA_ID 0x0F */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RC, SNDRV_CHMAP_NA } }, -+ { .channels = 8, /* CA_ID 0x10 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RLC, SNDRV_CHMAP_RRC } }, -+ { .channels = 8, /* CA_ID 0x11 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RLC, SNDRV_CHMAP_RRC } }, -+ { .channels = 8, /* CA_ID 0x12 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RLC, SNDRV_CHMAP_RRC } }, -+ { .channels = 8, /* CA_ID 0x13 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_RL, SNDRV_CHMAP_RR, -+ SNDRV_CHMAP_RLC, SNDRV_CHMAP_RRC } }, -+ { .channels = 8, /* CA_ID 0x14 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x15 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x16 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x17 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x18 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x19 */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1A */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1B */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1C */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1D */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1E */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { .channels = 8, /* CA_ID 0x1F */ -+ .map = { SNDRV_CHMAP_FL, SNDRV_CHMAP_FR, SNDRV_CHMAP_LFE, -+ SNDRV_CHMAP_FC, SNDRV_CHMAP_NA, SNDRV_CHMAP_NA, -+ SNDRV_CHMAP_FLC, SNDRV_CHMAP_FRC } }, -+ { } -+}; -+ -+/* -+ * hdmi_codec_channel_alloc: speaker configuration available for CEA -+ * -+ * This is an ordered list that must match with hdmi_codec_8ch_chmaps struct -+ * The preceding ones have better chances to be selected by -+ * hdmi_codec_get_ch_alloc_table_idx(). -+ */ -+static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = { -+ { .ca_id = 0x00, .n_ch = 2, -+ .mask = FL | FR}, -+ /* 2.1 */ -+ { .ca_id = 0x01, .n_ch = 4, -+ .mask = FL | FR | LFE}, -+ /* Dolby Surround */ -+ { .ca_id = 0x02, .n_ch = 4, -+ .mask = FL | FR | FC }, -+ /* surround51 */ -+ { .ca_id = 0x0b, .n_ch = 6, -+ .mask = FL | FR | LFE | FC | RL | RR}, -+ /* surround40 */ -+ { .ca_id = 0x08, .n_ch = 6, -+ .mask = FL | FR | RL | RR }, -+ /* surround41 */ -+ { .ca_id = 0x09, .n_ch = 6, -+ .mask = FL | FR | LFE | RL | RR }, -+ /* surround50 */ -+ { .ca_id = 0x0a, .n_ch = 6, -+ .mask = FL | FR | FC | RL | RR }, -+ /* 6.1 */ -+ { .ca_id = 0x0f, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RL | RR | RC }, -+ /* surround71 */ -+ { .ca_id = 0x13, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RL | RR | RLC | RRC }, -+ /* others */ -+ { .ca_id = 0x03, .n_ch = 8, -+ .mask = FL | FR | LFE | FC }, -+ { .ca_id = 0x04, .n_ch = 8, -+ .mask = FL | FR | RC}, -+ { .ca_id = 0x05, .n_ch = 8, -+ .mask = FL | FR | LFE | RC }, -+ { .ca_id = 0x06, .n_ch = 8, -+ .mask = FL | FR | FC | RC }, -+ { .ca_id = 0x07, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RC }, -+ { .ca_id = 0x0c, .n_ch = 8, -+ .mask = FL | FR | RC | RL | RR }, -+ { .ca_id = 0x0d, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | RC }, -+ { .ca_id = 0x0e, .n_ch = 8, -+ .mask = FL | FR | FC | RL | RR | RC }, -+ { .ca_id = 0x10, .n_ch = 8, -+ .mask = FL | FR | RL | RR | RLC | RRC }, -+ { .ca_id = 0x11, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | RLC | RRC }, -+ { .ca_id = 0x12, .n_ch = 8, -+ .mask = FL | FR | FC | RL | RR | RLC | RRC }, -+ { .ca_id = 0x14, .n_ch = 8, -+ .mask = FL | FR | FLC | FRC }, -+ { .ca_id = 0x15, .n_ch = 8, -+ .mask = FL | FR | LFE | FLC | FRC }, -+ { .ca_id = 0x16, .n_ch = 8, -+ .mask = FL | FR | FC | FLC | FRC }, -+ { .ca_id = 0x17, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | FLC | FRC }, -+ { .ca_id = 0x18, .n_ch = 8, -+ .mask = FL | FR | RC | FLC | FRC }, -+ { .ca_id = 0x19, .n_ch = 8, -+ .mask = FL | FR | LFE | RC | FLC | FRC }, -+ { .ca_id = 0x1a, .n_ch = 8, -+ .mask = FL | FR | RC | FC | FLC | FRC }, -+ { .ca_id = 0x1b, .n_ch = 8, -+ .mask = FL | FR | LFE | RC | FC | FLC | FRC }, -+ { .ca_id = 0x1c, .n_ch = 8, -+ .mask = FL | FR | RL | RR | FLC | FRC }, -+ { .ca_id = 0x1d, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | FLC | FRC }, -+ { .ca_id = 0x1e, .n_ch = 8, -+ .mask = FL | FR | FC | RL | RR | FLC | FRC }, -+ { .ca_id = 0x1f, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC }, -+}; -+ - struct hdmi_codec_priv { - struct hdmi_codec_pdata hcd; - struct snd_soc_dai_driver *daidrv; -@@ -41,6 +293,8 @@ struct hdmi_codec_priv { - struct notifier_block nb; - unsigned int jack_status; - unsigned int mode; -+ struct snd_pcm_chmap *chmap_info; -+ unsigned int chmap_idx; - }; - - static const struct snd_soc_dapm_widget hdmi_widgets[] = { -@@ -109,6 +363,83 @@ static int hdmi_audio_mode_put(struct snd_kcontrol *kcontrol, - return 0; - } - -+static unsigned long hdmi_codec_spk_mask_from_alloc(int spk_alloc) -+{ -+ int i; -+ const unsigned long hdmi_codec_eld_spk_alloc_bits[] = { -+ [0] = FL | FR, [1] = LFE, [2] = FC, [3] = RL | RR, -+ [4] = RC, [5] = FLC | FRC, [6] = RLC | RRC, -+ }; -+ unsigned long spk_mask = 0; -+ -+ for (i = 0; i < ARRAY_SIZE(hdmi_codec_eld_spk_alloc_bits); i++) { -+ if (spk_alloc & (1 << i)) -+ spk_mask |= hdmi_codec_eld_spk_alloc_bits[i]; -+ } -+ -+ return spk_mask; -+} -+ -+void hdmi_codec_eld_chmap(struct hdmi_codec_priv *hcp) -+{ -+ u8 spk_alloc; -+ unsigned long spk_mask; -+ -+ spk_alloc = drm_eld_get_spk_alloc(hcp->eld); -+ spk_mask = hdmi_codec_spk_mask_from_alloc(spk_alloc); -+ -+ /* Detect if only stereo supported, else return 8 channels mappings */ -+ if ((spk_mask & ~(FL | FR)) && hcp->chmap_info->max_channels > 2) -+ hcp->chmap_info->chmap = hdmi_codec_8ch_chmaps; -+ else -+ hcp->chmap_info->chmap = hdmi_codec_stereo_chmaps; -+} -+ -+static int hdmi_codec_get_ch_alloc_table_idx(struct hdmi_codec_priv *hcp, -+ unsigned char channels) -+{ -+ int i; -+ u8 spk_alloc; -+ unsigned long spk_mask; -+ const struct hdmi_codec_cea_spk_alloc *cap = hdmi_codec_channel_alloc; -+ -+ spk_alloc = drm_eld_get_spk_alloc(hcp->eld); -+ spk_mask = hdmi_codec_spk_mask_from_alloc(spk_alloc); -+ -+ for (i = 0; i < ARRAY_SIZE(hdmi_codec_channel_alloc); i++, cap++) { -+ /* If spk_alloc == 0, HDMI is unplugged return stereo config*/ -+ if (!spk_alloc && cap->ca_id == 0) -+ return i; -+ if (cap->n_ch != channels) -+ continue; -+ if (!(cap->mask == (spk_mask & cap->mask))) -+ continue; -+ return i; -+ } -+ -+ return -EINVAL; -+} -+static int hdmi_codec_chmap_ctl_get(struct snd_kcontrol *kcontrol, -+ struct snd_ctl_elem_value *ucontrol) -+{ -+ unsigned const char *map; -+ unsigned int i; -+ struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol); -+ struct hdmi_codec_priv *hcp = info->private_data; -+ -+ map = info->chmap[hcp->chmap_idx].map; -+ -+ for (i = 0; i < info->max_channels; i++) { -+ if (hcp->chmap_idx == HDMI_CODEC_CHMAP_IDX_UNKNOWN) -+ ucontrol->value.integer.value[i] = 0; -+ else -+ ucontrol->value.integer.value[i] = map[i]; -+ } -+ -+ return 0; -+} -+ -+ - static const struct snd_kcontrol_new hdmi_controls[] = { - { - .access = SNDRV_CTL_ELEM_ACCESS_READ | -@@ -184,6 +515,9 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream, - ret = snd_pcm_hw_constraint_eld(substream->runtime, - hcp->eld); - mutex_unlock(&hcp->eld_lock); -+ -+ /* Select chmap supported */ -+ hdmi_codec_eld_chmap(hcp); - } - return ret; - } -@@ -201,6 +535,7 @@ static void hdmi_codec_shutdown(struct snd_pcm_substream *substream, - - WARN_ON(hcp->current_stream != substream); - -+ hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN; - hcp->hcd.ops->audio_shutdown(dai->dev->parent, hcp->hcd.data); - - mutex_lock(&hcp->current_stream_lock); -@@ -221,7 +556,7 @@ static int hdmi_codec_hw_params(struct snd_pcm_substream *substream, - .dig_subframe = { 0 }, - } - }; -- int ret; -+ int ret, idx; - - dev_dbg(dai->dev, "%s() width %d rate %d channels %d\n", __func__, - params_width(params), params_rate(params), -@@ -248,6 +583,17 @@ static int hdmi_codec_hw_params(struct snd_pcm_substream *substream, - hp.cea.sample_size = HDMI_AUDIO_SAMPLE_SIZE_STREAM; - hp.cea.sample_frequency = HDMI_AUDIO_SAMPLE_FREQUENCY_STREAM; - -+ /* Select a channel allocation that matches with ELD and pcm channels */ -+ idx = hdmi_codec_get_ch_alloc_table_idx(hcp, hp.cea.channels); -+ if (idx < 0) { -+ dev_err(dai->dev, "Not able to map channels to speakers (%d)\n", -+ idx); -+ hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN; -+ return idx; -+ } -+ hp.cea.channel_allocation = hdmi_codec_channel_alloc[idx].ca_id; -+ hcp->chmap_idx = hdmi_codec_channel_alloc[idx].ca_id; -+ - hp.sample_width = params_width(params); - hp.sample_rate = params_rate(params); - hp.channels = params_channels(params); -@@ -377,6 +723,32 @@ static const struct snd_soc_dai_ops hdmi_dai_ops = { - SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S24_BE |\ - SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S32_BE) - -+static int hdmi_codec_pcm_new(struct snd_soc_pcm_runtime *rtd, -+ struct snd_soc_dai *dai) -+{ -+ struct snd_soc_dai_driver *drv = dai->driver; -+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); -+ int ret; -+ -+ dev_dbg(dai->dev, "%s()\n", __func__); -+ -+ ret = snd_pcm_add_chmap_ctls(rtd->pcm, SNDRV_PCM_STREAM_PLAYBACK, -+ NULL, drv->playback.channels_max, 0, -+ &hcp->chmap_info); -+ if (ret < 0) -+ return ret; -+ -+ /* override handlers */ -+ hcp->chmap_info->private_data = hcp; -+ hcp->chmap_info->kctl->get = hdmi_codec_chmap_ctl_get; -+ -+ /* default chmap supported is stereo */ -+ hcp->chmap_info->chmap = hdmi_codec_stereo_chmaps; -+ hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN; -+ -+ return 0; -+} -+ - static struct snd_soc_dai_driver hdmi_i2s_dai = { - .name = "i2s-hifi", - .id = DAI_ID_I2S, -@@ -389,6 +761,7 @@ static struct snd_soc_dai_driver hdmi_i2s_dai = { - .sig_bits = 24, - }, - .ops = &hdmi_dai_ops, -+ .pcm_new = hdmi_codec_pcm_new, - }; - - static const struct snd_soc_dai_driver hdmi_spdif_dai = { -@@ -402,6 +775,7 @@ static const struct snd_soc_dai_driver hdmi_spdif_dai = { - .formats = SPDIF_FORMATS, - }, - .ops = &hdmi_dai_ops, -+ .pcm_new = hdmi_codec_pcm_new, - }; - - static struct snd_soc_codec_driver hdmi_codec = { -@@ -534,6 +908,7 @@ static int hdmi_codec_remove(struct platform_device *pdev) - { - struct hdmi_codec_priv *hcp = platform_get_drvdata(pdev); - -+ kfree(hcp->chmap_info); - hdmi_unregister_notifier(&hcp->nb); - snd_soc_unregister_codec(&pdev->dev); - return 0; - -From 5ad6154eea74dec3635e2417f06ad12d3f0a36c4 Mon Sep 17 00:00:00 2001 -From: Christophe Jaillet -Date: Thu, 15 Jun 2017 07:53:11 +0200 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: Fix an error handling in - 'rockchip_i2s_probe' - -If this memory allocation fail, we must disable what has been enabled. -Do not return immediately but go thrue the error handling path instead. - -Also use 'devm_kmemdup' instead of 'devm_kzalloc+memcpy' to simplify code. - -Signed-off-by: Christophe JAILLET -Signed-off-by: Mark Brown -(cherry picked from commit c3a3d3c41b74b05267bab6173f2a8224a1443ba6) ---- - sound/soc/rockchip/rockchip_i2s.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index b359639c1038..02ff642499bf 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -658,12 +658,13 @@ static int rockchip_i2s_probe(struct platform_device *pdev) - goto err_pm_disable; - } - -- soc_dai = devm_kzalloc(&pdev->dev, -+ soc_dai = devm_kmemdup(&pdev->dev, &rockchip_i2s_dai, - sizeof(*soc_dai), GFP_KERNEL); -- if (!soc_dai) -- return -ENOMEM; -+ if (!soc_dai) { -+ ret = -ENOMEM; -+ goto err_pm_disable; -+ } - -- memcpy(soc_dai, &rockchip_i2s_dai, sizeof(*soc_dai)); - if (!of_property_read_u32(node, "rockchip,playback-channels", &val)) { - if (val >= 2 && val <= 8) - soc_dai->playback.channels_max = val; - -From 9aeca2222a8f8a700c446fc9a38235ab2e3a4efd Mon Sep 17 00:00:00 2001 -From: Markus Elfring -Date: Thu, 10 Aug 2017 18:38:09 +0200 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: Delete an error message for a - failed memory allocation in rockchip_i2s_probe() - -Omit an extra message for a memory allocation failure in this function. - -This issue was detected by using the Coccinelle software. - -Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf -Signed-off-by: Markus Elfring -Signed-off-by: Mark Brown -(cherry picked from commit b48b2710913d583ff93c365413532e1a7cd60d84) ---- - sound/soc/rockchip/rockchip_i2s.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index 02ff642499bf..16ff8d5e0033 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -594,10 +594,8 @@ static int rockchip_i2s_probe(struct platform_device *pdev) - int val; - - i2s = devm_kzalloc(&pdev->dev, sizeof(*i2s), GFP_KERNEL); -- if (!i2s) { -- dev_err(&pdev->dev, "Can't allocate rk_i2s_dev\n"); -+ if (!i2s) - return -ENOMEM; -- } - - i2s->dev = &pdev->dev; - - -From dad1bc0769692d7fd45701a4ab3fb55be012e01e Mon Sep 17 00:00:00 2001 -From: John Keeping -Date: Thu, 14 Sep 2017 16:58:55 +0100 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: i2s: fix unbalanced clk_disable - -mclk is enabled and disabled only in i2s_runtime_{resume,suspend}() and -we ensure that the device is runtime suspended before reaching this -clk_disable_unprepare() call, so it is wrong to call it again here. - -Signed-off-by: John Keeping -Signed-off-by: Mark Brown -(cherry picked from commit 32debfcd3ff0939c93238ddde03ffcc96cca5c60) ---- - sound/soc/rockchip/rockchip_i2s.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index 16ff8d5e0033..986ad2efc8e9 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -727,7 +727,6 @@ static int rockchip_i2s_remove(struct platform_device *pdev) - if (!pm_runtime_status_suspended(&pdev->dev)) - i2s_runtime_suspend(&pdev->dev); - -- clk_disable_unprepare(i2s->mclk); - clk_disable_unprepare(i2s->hclk); - - return 0; - -From 20b260f46771f7313ecd6e296ec6c08a43967eb4 Mon Sep 17 00:00:00 2001 -From: John Keeping -Date: Mon, 8 Jan 2018 16:01:04 +0000 -Subject: [PATCH] UPSTREAM: ASoC: rockchip: i2s: fix playback after runtime - resume - -When restoring registers during runtime resume, we must not write to -I2S_TXDR which is the transmit FIFO as this queues up a sample to be -output and pushes all of the output channels down by one. - -This can be demonstrated with the speaker-test utility: - - for i in a b c; do speaker-test -c 2 -s 1; done - -which should play a test through the left speaker three times but if the -I2S hardware starts runtime suspended the first sample will be played -through the right speaker. - -Fix this by marking I2S_TXDR as volatile (which also requires marking it -as readble, even though it technically isn't). This seems to be the -most robust fix, the alternative of giving I2S_TXDR a default value is -more fragile since it does not prevent regcache writing to the register -in all circumstances. - -While here, also fix the configuration of I2S_RXDR and I2S_FIFOLR; these -are not writable so they do not suffer from the same problem as I2S_TXDR -but reading from I2S_RXDR does suffer from a similar problem. - -Fixes: f0447f6cbb20 ("ASoC: rockchip: i2s: restore register during runtime_suspend/resume cycle", 2016-09-07) -Signed-off-by: John Keeping -(cherry picked from commit c66234cfedfc3e6e3b62563a5f2c1562be09a35d) ---- - sound/soc/rockchip/rockchip_i2s.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index 986ad2efc8e9..5297373fe6c4 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -514,6 +514,7 @@ static bool rockchip_i2s_rd_reg(struct device *dev, unsigned int reg) - case I2S_INTCR: - case I2S_XFER: - case I2S_CLR: -+ case I2S_TXDR: - case I2S_RXDR: - case I2S_FIFOLR: - case I2S_INTSR: -@@ -528,6 +529,9 @@ static bool rockchip_i2s_volatile_reg(struct device *dev, unsigned int reg) - switch (reg) { - case I2S_INTSR: - case I2S_CLR: -+ case I2S_FIFOLR: -+ case I2S_TXDR: -+ case I2S_RXDR: - return true; - default: - return false; -@@ -537,6 +541,8 @@ static bool rockchip_i2s_volatile_reg(struct device *dev, unsigned int reg) - static bool rockchip_i2s_precious_reg(struct device *dev, unsigned int reg) - { - switch (reg) { -+ case I2S_RXDR: -+ return true; - default: - return false; - } - -From fa8e48f2fd0abe00ee0f04128a2e9b4fed184c3f Mon Sep 17 00:00:00 2001 -From: Romain Perier -Date: Fri, 14 Apr 2017 10:31:12 +0200 -Subject: [PATCH] UPSTREAM: drm: dw-hdmi: add specific I2S and AHB functions - for stream handling - -Currently, CTS+N is forced to zero as a workaround of the IP block for -i.MX platforms. This is requested in the datasheet of the corresponding -IP for AHB mode only. However, we have seen that it introduces glitches -or delays when playing a sound on HDMI for I2S mode. This proves that we -cannot keep the current functions for handling audio stream as-is if -these contain workaround that are specific to a mode. - -This commit introduces two callbacks, one for each variant. -dw_hdmi_setup defines the right function depending on the detected -variant. Then, the exported functions dw_hdmi_audio_enable and -dw_hdmi_audio_disable calls the corresponding callbacks - -Reviewed-by: Neil Armstrong -Signed-off-by: Romain Perier -Signed-off-by: Archit Taneja -Link: http://patchwork.freedesktop.org/patch/msgid/20170414083113.4255-2-romain.perier@collabora.com -(cherry picked from commit a7d555d2f2bd675d641e742a202a5e4b37d4d019) ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 27 +++++++++++++++++++++++++-- - 1 file changed, 25 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index d57d999c50a5..0541d96be662 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -263,6 +263,9 @@ struct dw_hdmi { - u8 (*read)(struct dw_hdmi *hdmi, int offset); - - bool initialized; /* hdmi is enabled before bind */ -+ -+ void (*enable_audio)(struct dw_hdmi *hdmi); -+ void (*disable_audio)(struct dw_hdmi *hdmi); - }; - - #define HDMI_IH_PHY_STAT0_RX_SENSE \ -@@ -821,13 +824,29 @@ void dw_hdmi_set_sample_rate(struct dw_hdmi *hdmi, unsigned int rate) - } - EXPORT_SYMBOL_GPL(dw_hdmi_set_sample_rate); - -+static void dw_hdmi_ahb_audio_enable(struct dw_hdmi *hdmi) -+{ -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+} -+ -+static void dw_hdmi_ahb_audio_disable(struct dw_hdmi *hdmi) -+{ -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, 0); -+} -+ -+static void dw_hdmi_i2s_audio_enable(struct dw_hdmi *hdmi) -+{ -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+} -+ - void dw_hdmi_audio_enable(struct dw_hdmi *hdmi) - { - unsigned long flags; - - spin_lock_irqsave(&hdmi->audio_lock, flags); - hdmi->audio_enable = true; -- hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+ if (hdmi->enable_audio) -+ hdmi->enable_audio(hdmi); - spin_unlock_irqrestore(&hdmi->audio_lock, flags); - } - EXPORT_SYMBOL_GPL(dw_hdmi_audio_enable); -@@ -838,7 +857,8 @@ void dw_hdmi_audio_disable(struct dw_hdmi *hdmi) - - spin_lock_irqsave(&hdmi->audio_lock, flags); - hdmi->audio_enable = false; -- hdmi_set_cts_n(hdmi, hdmi->audio_cts, 0); -+ if (hdmi->disable_audio) -+ hdmi->disable_audio(hdmi); - spin_unlock_irqrestore(&hdmi->audio_lock, flags); - } - EXPORT_SYMBOL_GPL(dw_hdmi_audio_disable); -@@ -3706,6 +3726,8 @@ int dw_hdmi_bind(struct device *dev, struct device *master, - audio.irq = irq; - audio.hdmi = hdmi; - audio.eld = hdmi->connector.eld; -+ hdmi->enable_audio = dw_hdmi_ahb_audio_enable; -+ hdmi->disable_audio = dw_hdmi_ahb_audio_disable; - - pdevinfo.name = "dw-hdmi-ahb-audio"; - pdevinfo.data = &audio; -@@ -3719,6 +3741,7 @@ int dw_hdmi_bind(struct device *dev, struct device *master, - audio.write = hdmi_writeb; - audio.read = hdmi_readb; - audio.mod = hdmi_modb; -+ hdmi->enable_audio = dw_hdmi_i2s_audio_enable; - - pdevinfo.name = "dw-hdmi-i2s-audio"; - pdevinfo.data = &audio; - -From f856228e8933ba1e6375dbda53cc59da8d71647a Mon Sep 17 00:00:00 2001 -From: Romain Perier -Date: Thu, 20 Apr 2017 14:34:34 +0530 -Subject: [PATCH] UPSTREAM: drm: dw-hdmi: gate audio clock from the I2S - enablement callbacks - -Currently, the audio sampler clock is enabled from dw_hdmi_setup() at -step E. and is kept enabled for later use. This clock should be enabled -and disabled along with the actual audio stream and not always on (that -is bad for PM). Furthermore, as described by the datasheet, the I2S -variant needs to gate/ungate the clock when the stream is -enabled/disabled. - -This commit adds a parameter to hdmi_audio_enable_clk() that controls -when the audio sample clock must be enabled or disabled. Then, it adds -the call to this function from dw_hdmi_i2s_audio_enable() and -dw_hdmi_i2s_audio_disable(). - -Reviewed-by: Neil Armstrong -Signed-off-by: Romain Perier -Link: http://patchwork.freedesktop.org/patch/msgid/20170414083113.4255-3-romain.perier@collabora.com -Signed-off-by: Archit Taneja -(cherry picked from commit 57fbc05585a9c841c910677228f1e3f8a3a62801) ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 24 +++++++++++++++++------- - 1 file changed, 17 insertions(+), 7 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 0541d96be662..f3a2034a0883 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -824,6 +824,15 @@ void dw_hdmi_set_sample_rate(struct dw_hdmi *hdmi, unsigned int rate) - } - EXPORT_SYMBOL_GPL(dw_hdmi_set_sample_rate); - -+static void hdmi_enable_audio_clk(struct dw_hdmi *hdmi, bool enable) -+{ -+ if (enable) -+ hdmi->mc_clkdis &= ~HDMI_MC_CLKDIS_AUDCLK_DISABLE; -+ else -+ hdmi->mc_clkdis |= HDMI_MC_CLKDIS_AUDCLK_DISABLE; -+ hdmi_writeb(hdmi, hdmi->mc_clkdis, HDMI_MC_CLKDIS); -+} -+ - static void dw_hdmi_ahb_audio_enable(struct dw_hdmi *hdmi) - { - hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -@@ -837,6 +846,12 @@ static void dw_hdmi_ahb_audio_disable(struct dw_hdmi *hdmi) - static void dw_hdmi_i2s_audio_enable(struct dw_hdmi *hdmi) - { - hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+ hdmi_enable_audio_clk(hdmi, true); -+} -+ -+static void dw_hdmi_i2s_audio_disable(struct dw_hdmi *hdmi) -+{ -+ hdmi_enable_audio_clk(hdmi, false); - } - - void dw_hdmi_audio_enable(struct dw_hdmi *hdmi) -@@ -2149,12 +2164,6 @@ static void dw_hdmi_enable_video_path(struct dw_hdmi *hdmi) - HDMI_MC_FLOWCTRL); - } - --static void hdmi_enable_audio_clk(struct dw_hdmi *hdmi) --{ -- hdmi->mc_clkdis &= ~HDMI_MC_CLKDIS_AUDCLK_DISABLE; -- hdmi_writeb(hdmi, hdmi->mc_clkdis, HDMI_MC_CLKDIS); --} -- - /* Workaround to clear the overflow condition */ - static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi) - { -@@ -2306,7 +2315,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - - /* HDMI Initialization Step E - Configure audio */ - hdmi_clk_regenerator_update_pixel_clock(hdmi); -- hdmi_enable_audio_clk(hdmi); -+ hdmi_enable_audio_clk(hdmi, true); - } - - /* not for DVI mode */ -@@ -3742,6 +3751,7 @@ int dw_hdmi_bind(struct device *dev, struct device *master, - audio.read = hdmi_readb; - audio.mod = hdmi_modb; - hdmi->enable_audio = dw_hdmi_i2s_audio_enable; -+ hdmi->disable_audio = dw_hdmi_i2s_audio_disable; - - pdevinfo.name = "dw-hdmi-i2s-audio"; - pdevinfo.data = &audio; - -From 5736074e471dc5306e07581bf0958043cf434341 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 7 Aug 2017 22:24:15 +0200 -Subject: [PATCH] drm: dw-hdmi-i2s: sync with upstream - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h | 1 - - drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 20 +++++++++++++------- - 2 files changed, 13 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -index 3930ba04977b..af7f39c85ba4 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -@@ -14,7 +14,6 @@ struct dw_hdmi_audio_data { - - struct dw_hdmi_i2s_audio_data { - struct dw_hdmi *hdmi; -- struct platform_device *pdev; - - void (*write)(struct dw_hdmi *hdmi, u8 val, int offset); - u8 (*read)(struct dw_hdmi *hdmi, int offset); -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -index f1f62d8c1d16..5ff993a35ab6 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -@@ -16,7 +16,8 @@ - - #define DRIVER_NAME "dw-hdmi-i2s-audio" - --static inline void hdmi_write(struct dw_hdmi_i2s_audio_data *audio, u8 val, int offset) -+static inline void hdmi_write(struct dw_hdmi_i2s_audio_data *audio, -+ u8 val, int offset) - { - struct dw_hdmi *hdmi = audio->hdmi; - -@@ -220,6 +221,7 @@ static int snd_dw_hdmi_probe(struct platform_device *pdev) - struct dw_hdmi_i2s_audio_data *audio = pdev->dev.platform_data; - struct platform_device_info pdevinfo; - struct hdmi_codec_pdata pdata; -+ struct platform_device *platform; - - pdata.ops = &dw_hdmi_i2s_ops; - pdata.i2s = 1; -@@ -234,23 +236,27 @@ static int snd_dw_hdmi_probe(struct platform_device *pdev) - pdevinfo.size_data = sizeof(pdata); - pdevinfo.dma_mask = DMA_BIT_MASK(32); - -- audio->pdev = platform_device_register_full(&pdevinfo); -- return IS_ERR_OR_NULL(audio->pdev); -+ platform = platform_device_register_full(&pdevinfo); -+ if (IS_ERR(platform)) -+ return PTR_ERR(platform); -+ -+ dev_set_drvdata(&pdev->dev, platform); -+ -+ return 0; - } - - static int snd_dw_hdmi_remove(struct platform_device *pdev) - { -- struct dw_hdmi_i2s_audio_data *audio = pdev->dev.platform_data; -+ struct platform_device *platform = dev_get_drvdata(&pdev->dev); - -- if (!IS_ERR_OR_NULL(audio->pdev)) -- platform_device_unregister(audio->pdev); -+ platform_device_unregister(platform); - - return 0; - } - - static struct platform_driver snd_dw_hdmi_driver = { - .probe = snd_dw_hdmi_probe, -- .remove = snd_dw_hdmi_remove, -+ .remove = snd_dw_hdmi_remove, - .driver = { - .name = DRIVER_NAME, - .owner = THIS_MODULE, - -From d2f29756df76806c12fa12b668aeb8ac5f626bdd Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 2 Apr 2017 11:33:39 +0200 -Subject: [PATCH] drm: dw-hdmi-i2s: implement get_eld - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h | 1 + - drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 12 ++++++++++++ - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 1 + - 3 files changed, 14 insertions(+) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -index af7f39c85ba4..c5ace7808fdf 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h -@@ -14,6 +14,7 @@ struct dw_hdmi_audio_data { - - struct dw_hdmi_i2s_audio_data { - struct dw_hdmi *hdmi; -+ u8 *eld; - - void (*write)(struct dw_hdmi *hdmi, u8 val, int offset); - u8 (*read)(struct dw_hdmi *hdmi, int offset); -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -index 5ff993a35ab6..e7312571e2cb 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -@@ -11,6 +11,8 @@ - - #include - -+#include /* This is only to get MAX_ELD_BYTES */ -+ - #include "dw-hdmi.h" - #include "dw-hdmi-audio.h" - -@@ -211,9 +213,19 @@ static void dw_hdmi_i2s_audio_shutdown(struct device *dev, void *data) - hdmi_write(audio, HDMI_AUD_CONF0_SW_RESET, HDMI_AUD_CONF0); - } - -+static int dw_hdmi_i2s_get_eld(struct device *dev, void *data, u8 *buf, size_t len) -+{ -+ struct dw_hdmi_i2s_audio_data *audio = data; -+ -+ memcpy(buf, audio->eld, min(len, (size_t)MAX_ELD_BYTES)); -+ -+ return 0; -+} -+ - static struct hdmi_codec_ops dw_hdmi_i2s_ops = { - .hw_params = dw_hdmi_i2s_hw_params, - .audio_shutdown = dw_hdmi_i2s_audio_shutdown, -+ .get_eld = dw_hdmi_i2s_get_eld, - }; - - static int snd_dw_hdmi_probe(struct platform_device *pdev) -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index f3a2034a0883..c222b6455f03 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -3750,6 +3750,7 @@ int dw_hdmi_bind(struct device *dev, struct device *master, - audio.write = hdmi_writeb; - audio.read = hdmi_readb; - audio.mod = hdmi_modb; -+ audio.eld = hdmi->connector.eld; - hdmi->enable_audio = dw_hdmi_i2s_audio_enable; - hdmi->disable_audio = dw_hdmi_i2s_audio_disable; - - -From 18a9fcdb5cbde0462179d04336622cb4f97c2a7e Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 17 Apr 2017 13:09:16 +0200 -Subject: [PATCH] drm: dw-hdmi-i2s: configure channel allocation - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -index e7312571e2cb..1d4570e3fbed 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -@@ -188,7 +188,7 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, - hdmi_write(audio, 0x00, HDMI_FC_AUDICONF1); - - /* Set Channel Allocation */ -- hdmi_write(audio, 0x00, HDMI_FC_AUDICONF2); -+ hdmi_write(audio, hparms->cea.channel_allocation, HDMI_FC_AUDICONF2); - - /* Set LFEPBLDOWN-MIX INH and LSV */ - hdmi_write(audio, 0x00, HDMI_FC_AUDICONF3); - -From c19ba12d08a8c491d21a1daf305b1b58231ca362 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Mon, 14 Aug 2017 00:14:05 +0200 -Subject: [PATCH] ASoC: hdmi-codec: reorder channel map - ---- - sound/soc/codecs/hdmi-codec.c | 113 +++++++++++++++++++----------------------- - 1 file changed, 52 insertions(+), 61 deletions(-) - -diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c -index cb78d8971b41..b74659bc3bbc 100644 ---- a/sound/soc/codecs/hdmi-codec.c -+++ b/sound/soc/codecs/hdmi-codec.c -@@ -205,78 +205,69 @@ const struct snd_pcm_chmap_elem hdmi_codec_8ch_chmaps[] = { - */ - static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = { - { .ca_id = 0x00, .n_ch = 2, -- .mask = FL | FR}, -- /* 2.1 */ -- { .ca_id = 0x01, .n_ch = 4, -- .mask = FL | FR | LFE}, -- /* Dolby Surround */ -+ .mask = FL | FR }, -+ { .ca_id = 0x03, .n_ch = 4, -+ .mask = FL | FR | LFE | FC }, - { .ca_id = 0x02, .n_ch = 4, - .mask = FL | FR | FC }, -- /* surround51 */ -+ { .ca_id = 0x01, .n_ch = 4, -+ .mask = FL | FR | LFE }, - { .ca_id = 0x0b, .n_ch = 6, -- .mask = FL | FR | LFE | FC | RL | RR}, -- /* surround40 */ -- { .ca_id = 0x08, .n_ch = 6, -- .mask = FL | FR | RL | RR }, -- /* surround41 */ -- { .ca_id = 0x09, .n_ch = 6, -- .mask = FL | FR | LFE | RL | RR }, -- /* surround50 */ -+ .mask = FL | FR | LFE | FC | RL | RR }, - { .ca_id = 0x0a, .n_ch = 6, - .mask = FL | FR | FC | RL | RR }, -- /* 6.1 */ -- { .ca_id = 0x0f, .n_ch = 8, -- .mask = FL | FR | LFE | FC | RL | RR | RC }, -- /* surround71 */ -+ { .ca_id = 0x09, .n_ch = 6, -+ .mask = FL | FR | LFE | RL | RR }, -+ { .ca_id = 0x08, .n_ch = 6, -+ .mask = FL | FR | RL | RR }, -+ { .ca_id = 0x07, .n_ch = 6, -+ .mask = FL | FR | LFE | FC | RC }, -+ { .ca_id = 0x06, .n_ch = 6, -+ .mask = FL | FR | FC | RC }, -+ { .ca_id = 0x05, .n_ch = 6, -+ .mask = FL | FR | LFE | RC }, -+ { .ca_id = 0x04, .n_ch = 6, -+ .mask = FL | FR | RC }, - { .ca_id = 0x13, .n_ch = 8, - .mask = FL | FR | LFE | FC | RL | RR | RLC | RRC }, -- /* others */ -- { .ca_id = 0x03, .n_ch = 8, -- .mask = FL | FR | LFE | FC }, -- { .ca_id = 0x04, .n_ch = 8, -- .mask = FL | FR | RC}, -- { .ca_id = 0x05, .n_ch = 8, -- .mask = FL | FR | LFE | RC }, -- { .ca_id = 0x06, .n_ch = 8, -- .mask = FL | FR | FC | RC }, -- { .ca_id = 0x07, .n_ch = 8, -- .mask = FL | FR | LFE | FC | RC }, -- { .ca_id = 0x0c, .n_ch = 8, -- .mask = FL | FR | RC | RL | RR }, -- { .ca_id = 0x0d, .n_ch = 8, -- .mask = FL | FR | LFE | RL | RR | RC }, -- { .ca_id = 0x0e, .n_ch = 8, -- .mask = FL | FR | FC | RL | RR | RC }, -- { .ca_id = 0x10, .n_ch = 8, -- .mask = FL | FR | RL | RR | RLC | RRC }, -- { .ca_id = 0x11, .n_ch = 8, -- .mask = FL | FR | LFE | RL | RR | RLC | RRC }, -+ { .ca_id = 0x1f, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC }, - { .ca_id = 0x12, .n_ch = 8, - .mask = FL | FR | FC | RL | RR | RLC | RRC }, -- { .ca_id = 0x14, .n_ch = 8, -- .mask = FL | FR | FLC | FRC }, -- { .ca_id = 0x15, .n_ch = 8, -- .mask = FL | FR | LFE | FLC | FRC }, -- { .ca_id = 0x16, .n_ch = 8, -- .mask = FL | FR | FC | FLC | FRC }, -- { .ca_id = 0x17, .n_ch = 8, -- .mask = FL | FR | LFE | FC | FLC | FRC }, -- { .ca_id = 0x18, .n_ch = 8, -- .mask = FL | FR | RC | FLC | FRC }, -- { .ca_id = 0x19, .n_ch = 8, -- .mask = FL | FR | LFE | RC | FLC | FRC }, -- { .ca_id = 0x1a, .n_ch = 8, -- .mask = FL | FR | RC | FC | FLC | FRC }, -- { .ca_id = 0x1b, .n_ch = 8, -- .mask = FL | FR | LFE | RC | FC | FLC | FRC }, -- { .ca_id = 0x1c, .n_ch = 8, -- .mask = FL | FR | RL | RR | FLC | FRC }, -- { .ca_id = 0x1d, .n_ch = 8, -- .mask = FL | FR | LFE | RL | RR | FLC | FRC }, - { .ca_id = 0x1e, .n_ch = 8, - .mask = FL | FR | FC | RL | RR | FLC | FRC }, -- { .ca_id = 0x1f, .n_ch = 8, -- .mask = FL | FR | LFE | FC | RL | RR | FLC | FRC }, -+ { .ca_id = 0x11, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | RLC | RRC }, -+ { .ca_id = 0x1d, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | FLC | FRC }, -+ { .ca_id = 0x10, .n_ch = 8, -+ .mask = FL | FR | RL | RR | RLC | RRC }, -+ { .ca_id = 0x1c, .n_ch = 8, -+ .mask = FL | FR | RL | RR | FLC | FRC }, -+ { .ca_id = 0x0f, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | RL | RR | RC }, -+ { .ca_id = 0x1b, .n_ch = 8, -+ .mask = FL | FR | LFE | RC | FC | FLC | FRC }, -+ { .ca_id = 0x0e, .n_ch = 8, -+ .mask = FL | FR | FC | RL | RR | RC }, -+ { .ca_id = 0x1a, .n_ch = 8, -+ .mask = FL | FR | RC | FC | FLC | FRC }, -+ { .ca_id = 0x0d, .n_ch = 8, -+ .mask = FL | FR | LFE | RL | RR | RC }, -+ { .ca_id = 0x19, .n_ch = 8, -+ .mask = FL | FR | LFE | RC | FLC | FRC }, -+ { .ca_id = 0x0c, .n_ch = 8, -+ .mask = FL | FR | RC | RL | RR }, -+ { .ca_id = 0x18, .n_ch = 8, -+ .mask = FL | FR | RC | FLC | FRC }, -+ { .ca_id = 0x17, .n_ch = 8, -+ .mask = FL | FR | LFE | FC | FLC | FRC }, -+ { .ca_id = 0x16, .n_ch = 8, -+ .mask = FL | FR | FC | FLC | FRC }, -+ { .ca_id = 0x15, .n_ch = 8, -+ .mask = FL | FR | LFE | FLC | FRC }, -+ { .ca_id = 0x14, .n_ch = 8, -+ .mask = FL | FR | FLC | FRC }, - }; - - struct hdmi_codec_priv { - -From 0b22ce2a2766052fe28a3162623d19ba38adaef5 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 27 Aug 2017 23:32:40 +0200 -Subject: [PATCH] ASoC: codecs: rk3328: limit to working rates - ---- - sound/soc/codecs/rk3328_codec.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c -index af1b7429b6d4..d0b4578ffa0e 100644 ---- a/sound/soc/codecs/rk3328_codec.c -+++ b/sound/soc/codecs/rk3328_codec.c -@@ -354,7 +354,12 @@ static struct snd_soc_dai_driver rk3328_dai[] = { - .stream_name = "HIFI Playback", - .channels_min = 1, - .channels_max = 2, -- .rates = SNDRV_PCM_RATE_8000_96000, -+ .rates = (SNDRV_PCM_RATE_8000 | -+ SNDRV_PCM_RATE_16000 | -+ SNDRV_PCM_RATE_32000 | -+ SNDRV_PCM_RATE_48000 | -+ SNDRV_PCM_RATE_64000 | -+ SNDRV_PCM_RATE_96000), - .formats = (SNDRV_PCM_FMTBIT_S16_LE | - SNDRV_PCM_FMTBIT_S20_3LE | - SNDRV_PCM_FMTBIT_S24_LE | - -From f96be8cf25bfda88d5c492f42e1f6ca5951356f3 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 8 Jul 2018 12:34:43 +0200 -Subject: [PATCH] drm: dw-hdmi: change audio config - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 9 ++------- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 15 ++++++++++++--- - 2 files changed, 14 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -index 1d4570e3fbed..d0904f6b7a82 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c -@@ -110,8 +110,7 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, - HDMI_AUD_INT_FIFO_FULL_MSK, HDMI_AUD_INT); - hdmi_update_bits(audio, HDMI_AUD_CONF0_SW_RESET, - HDMI_AUD_CONF0_SW_RESET, HDMI_AUD_CONF0); -- hdmi_update_bits(audio, HDMI_MC_SWRSTZ_I2S_RESET_MSK, -- HDMI_MC_SWRSTZ_I2S_RESET_MSK, HDMI_MC_SWRSTZ); -+ hdmi_write(audio, (u8)~HDMI_MC_SWRSTZ_I2S_RESET_MSK, HDMI_MC_SWRSTZ); - - switch (hparms->mode) { - case NLPCM: -@@ -193,11 +192,6 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, - /* Set LFEPBLDOWN-MIX INH and LSV */ - hdmi_write(audio, 0x00, HDMI_FC_AUDICONF3); - -- hdmi_update_bits(audio, HDMI_AUD_CONF0_SW_RESET, -- HDMI_AUD_CONF0_SW_RESET, HDMI_AUD_CONF0); -- hdmi_update_bits(audio, HDMI_MC_SWRSTZ_I2S_RESET_MSK, -- HDMI_MC_SWRSTZ_I2S_RESET_MSK, HDMI_MC_SWRSTZ); -- - dw_hdmi_audio_enable(hdmi); - - return 0; -@@ -211,6 +205,7 @@ static void dw_hdmi_i2s_audio_shutdown(struct device *dev, void *data) - dw_hdmi_audio_disable(hdmi); - - hdmi_write(audio, HDMI_AUD_CONF0_SW_RESET, HDMI_AUD_CONF0); -+ hdmi_write(audio, (u8)~HDMI_MC_SWRSTZ_I2S_RESET_MSK, HDMI_MC_SWRSTZ); - } - - static int dw_hdmi_i2s_get_eld(struct device *dev, void *data, u8 *buf, size_t len) -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index c222b6455f03..065723179791 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -89,6 +89,7 @@ static const struct dw_hdmi_audio_tmds_n common_tmds_n_table[] = { - { .tmds = 71000000, .n_32k = 4096, .n_44k1 = 7056, .n_48k = 6144, }, - { .tmds = 72000000, .n_32k = 4096, .n_44k1 = 5635, .n_48k = 6144, }, - { .tmds = 73250000, .n_32k = 4096, .n_44k1 = 14112, .n_48k = 6144, }, -+ { .tmds = 74176000, .n_32k = 11648, .n_44k1 = 17836, .n_48k = 11648, }, - { .tmds = 74250000, .n_32k = 4096, .n_44k1 = 6272, .n_48k = 6144, }, - { .tmds = 75000000, .n_32k = 4096, .n_44k1 = 5880, .n_48k = 6144, }, - { .tmds = 78750000, .n_32k = 4096, .n_44k1 = 5600, .n_48k = 6144, }, -@@ -105,13 +106,16 @@ static const struct dw_hdmi_audio_tmds_n common_tmds_n_table[] = { - { .tmds = 119000000, .n_32k = 4096, .n_44k1 = 5544, .n_48k = 6144, }, - { .tmds = 135000000, .n_32k = 4096, .n_44k1 = 5488, .n_48k = 6144, }, - { .tmds = 146250000, .n_32k = 4096, .n_44k1 = 6272, .n_48k = 6144, }, -- { .tmds = 148500000, .n_32k = 4096, .n_44k1 = 5488, .n_48k = 6144, }, -+ { .tmds = 148352000, .n_32k = 11648, .n_44k1 = 8918, .n_48k = 5824, }, -+ { .tmds = 148500000, .n_32k = 4096, .n_44k1 = 6272, .n_48k = 6144, }, - { .tmds = 154000000, .n_32k = 4096, .n_44k1 = 5544, .n_48k = 6144, }, - { .tmds = 162000000, .n_32k = 4096, .n_44k1 = 5684, .n_48k = 6144, }, - - /* For 297 MHz+ HDMI spec have some other rule for setting N */ -- { .tmds = 297000000, .n_32k = 3073, .n_44k1 = 4704, .n_48k = 5120, }, -- { .tmds = 594000000, .n_32k = 3073, .n_44k1 = 9408, .n_48k = 10240, }, -+ { .tmds = 296703000, .n_32k = 5824, .n_44k1 = 4459, .n_48k = 5824, }, -+ { .tmds = 297000000, .n_32k = 3072, .n_44k1 = 4704, .n_48k = 5120, }, -+ { .tmds = 593407000, .n_32k = 5824, .n_44k1 = 8918, .n_48k = 5824, }, -+ { .tmds = 594000000, .n_32k = 3072, .n_44k1 = 9408, .n_48k = 6144, }, - - /* End of table */ - { .tmds = 0, .n_32k = 0, .n_44k1 = 0, .n_48k = 0, }, -@@ -831,6 +835,11 @@ static void hdmi_enable_audio_clk(struct dw_hdmi *hdmi, bool enable) - else - hdmi->mc_clkdis |= HDMI_MC_CLKDIS_AUDCLK_DISABLE; - hdmi_writeb(hdmi, hdmi->mc_clkdis, HDMI_MC_CLKDIS); -+ -+ if (enable) { -+ hdmi_set_cts_n(hdmi, 0, 0); -+ hdmi_set_cts_n(hdmi, hdmi->audio_cts, hdmi->audio_n); -+ } - } - - static void dw_hdmi_ahb_audio_enable(struct dw_hdmi *hdmi) - -From ed2e01d46f3bbf3eda4d37ce2a6e8874b15a478a Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 8 Jul 2018 12:56:51 +0200 -Subject: [PATCH] WIP: drm: dw-hdmi: use Auto CTS mode - ---- - drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 52 ++++++++++++++++++------------- - 1 file changed, 31 insertions(+), 21 deletions(-) - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 065723179791..841bdfcae3e0 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -643,14 +643,18 @@ static struct i2c_adapter *dw_hdmi_i2c_adapter(struct dw_hdmi *hdmi) - static void hdmi_set_cts_n(struct dw_hdmi *hdmi, unsigned int cts, - unsigned int n) - { -- /* Must be set/cleared first */ -- hdmi_modb(hdmi, 0, HDMI_AUD_CTS3_CTS_MANUAL, HDMI_AUD_CTS3); -- -- /* nshift factor = 0 */ -- hdmi_modb(hdmi, 0, HDMI_AUD_CTS3_N_SHIFT_MASK, HDMI_AUD_CTS3); -- -- hdmi_writeb(hdmi, ((cts >> 16) & HDMI_AUD_CTS3_AUDCTS19_16_MASK) | -- HDMI_AUD_CTS3_CTS_MANUAL, HDMI_AUD_CTS3); -+ /* Use Auto CTS mode with CTS is unknown */ -+ if (cts) { -+ /* Must be set/cleared first */ -+ hdmi_modb(hdmi, 0, HDMI_AUD_CTS3_CTS_MANUAL, HDMI_AUD_CTS3); -+ -+ /* nshift factor = 0 */ -+ hdmi_modb(hdmi, 0, HDMI_AUD_CTS3_N_SHIFT_MASK, HDMI_AUD_CTS3); -+ -+ hdmi_writeb(hdmi, ((cts >> 16) & HDMI_AUD_CTS3_AUDCTS19_16_MASK) | -+ HDMI_AUD_CTS3_CTS_MANUAL, HDMI_AUD_CTS3); -+ } else -+ hdmi_writeb(hdmi, 0, HDMI_AUD_CTS3); - hdmi_writeb(hdmi, (cts >> 8) & 0xff, HDMI_AUD_CTS2); - hdmi_writeb(hdmi, cts & 0xff, HDMI_AUD_CTS1); - -@@ -777,24 +781,30 @@ static void hdmi_set_clk_regenerator(struct dw_hdmi *hdmi, - { - unsigned long ftdms = pixel_clk; - unsigned int n, cts; -+ u8 config3; - u64 tmp; - - n = hdmi_find_n(hdmi, pixel_clk, sample_rate); - -- /* -- * Compute the CTS value from the N value. Note that CTS and N -- * can be up to 20 bits in total, so we need 64-bit math. Also -- * note that our TDMS clock is not fully accurate; it is accurate -- * to kHz. This can introduce an unnecessary remainder in the -- * calculation below, so we don't try to warn about that. -- */ -- tmp = (u64)ftdms * n; -- do_div(tmp, 128 * sample_rate); -- cts = tmp; -+ config3 = hdmi_readb(hdmi, HDMI_CONFIG3_ID); - -- dev_dbg(hdmi->dev, "%s: fs=%uHz ftdms=%lu.%03luMHz N=%d cts=%d\n", -- __func__, sample_rate, ftdms / 1000000, (ftdms / 1000) % 1000, -- n, cts); -+ if (config3 & HDMI_CONFIG3_AHBAUDDMA) { -+ /* -+ * Compute the CTS value from the N value. Note that CTS and N -+ * can be up to 20 bits in total, so we need 64-bit math. Also -+ * note that our TDMS clock is not fully accurate; it is accurate -+ * to kHz. This can introduce an unnecessary remainder in the -+ * calculation below, so we don't try to warn about that. -+ */ -+ tmp = (u64)ftdms * n; -+ do_div(tmp, 128 * sample_rate); -+ cts = tmp; -+ -+ dev_dbg(hdmi->dev, "%s: fs=%uHz ftdms=%lu.%03luMHz N=%d cts=%d\n", -+ __func__, sample_rate, ftdms / 1000000, (ftdms / 1000) % 1000, -+ n, cts); -+ } else -+ cts = 0; - - spin_lock_irq(&hdmi->audio_lock); - hdmi->audio_n = n; diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0005-dts.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0005-dts.patch deleted file mode 100644 index 2e26a580e56e..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0005-dts.patch +++ /dev/null @@ -1,470 +0,0 @@ -From cf1a1299ed4c29012b0cf0476d93f45d49629b18 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 1 Jul 2018 23:22:32 +0200 -Subject: [PATCH] arm: dts: rockchip: rk3288: update dtsi - ---- - arch/arm/boot/dts/rk3288.dtsi | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi -index 8e51132ef7e4..54b785278956 100644 ---- a/arch/arm/boot/dts/rk3288.dtsi -+++ b/arch/arm/boot/dts/rk3288.dtsi -@@ -352,49 +352,57 @@ - - sdmmc: dwmmc@ff0c0000 { - compatible = "rockchip,rk3288-dw-mshc"; -- clock-freq-min-max = <400000 150000000>; -+ max-frequency = <150000000>; - clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>, - <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>; - clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; - fifo-depth = <0x100>; - interrupts = ; - reg = <0x0 0xff0c0000 0x0 0x4000>; -+ resets = <&cru SRST_MMC0>; -+ reset-names = "reset"; - status = "disabled"; - }; - - sdio0: dwmmc@ff0d0000 { - compatible = "rockchip,rk3288-dw-mshc"; -- clock-freq-min-max = <400000 150000000>; -+ max-frequency = <150000000>; - clocks = <&cru HCLK_SDIO0>, <&cru SCLK_SDIO0>, - <&cru SCLK_SDIO0_DRV>, <&cru SCLK_SDIO0_SAMPLE>; - clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; - fifo-depth = <0x100>; - interrupts = ; - reg = <0x0 0xff0d0000 0x0 0x4000>; -+ resets = <&cru SRST_SDIO0>; -+ reset-names = "reset"; - status = "disabled"; - }; - - sdio1: dwmmc@ff0e0000 { - compatible = "rockchip,rk3288-dw-mshc"; -- clock-freq-min-max = <400000 150000000>; -+ max-frequency = <150000000>; - clocks = <&cru HCLK_SDIO1>, <&cru SCLK_SDIO1>, - <&cru SCLK_SDIO1_DRV>, <&cru SCLK_SDIO1_SAMPLE>; - clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; - fifo-depth = <0x100>; - interrupts = ; - reg = <0x0 0xff0e0000 0x0 0x4000>; -+ resets = <&cru SRST_SDIO1>; -+ reset-names = "reset"; - status = "disabled"; - }; - - emmc: dwmmc@ff0f0000 { - compatible = "rockchip,rk3288-dw-mshc"; -- clock-freq-min-max = <400000 150000000>; -+ max-frequency = <150000000>; - clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>, - <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>; - clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; - fifo-depth = <0x100>; - interrupts = ; - reg = <0x0 0xff0f0000 0x0 0x4000>; -+ resets = <&cru SRST_EMMC>; -+ reset-names = "reset"; - status = "disabled"; - supports-emmc; - }; -@@ -638,6 +646,7 @@ - compatible = "rockchip,rk3288-tsadc"; - reg = <0x0 0xff280000 0x0 0x100>; - interrupts = ; -+ rockchip,grf = <&grf>; - clocks = <&cru SCLK_TSADC>, <&cru PCLK_TSADC>; - clock-names = "tsadc", "apb_pclk"; - assigned-clocks = <&cru SCLK_TSADC>; -@@ -646,7 +655,7 @@ - reset-names = "tsadc-apb"; - pinctrl-names = "init", "default", "sleep"; - pinctrl-0 = <&otp_gpio>; -- pinctrl-1 = <&otp_gpio>; -+ pinctrl-1 = <&otp_out>; - pinctrl-2 = <&otp_gpio>; - #thermal-sensor-cells = <1>; - rockchip,hw-tshut-temp = <120000>; -@@ -1699,6 +1708,7 @@ - operating-points-v2 = <&gpu_opp_table>; - #cooling-cells = <2>; /* min followed by max */ - power-domains = <&power RK3288_PD_GPU>; -+ power-off-delay-ms = <200>; - status = "disabled"; - - upthreshold = <75>; - -From 25d521533a524ec201dd8b0e38a32989f8c00bfc Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 13 Aug 2017 10:24:19 +0200 -Subject: [PATCH] arm: dts: rk3288-miniarm: update dts - ---- - arch/arm/boot/dts/rk3288-miniarm.dts | 55 ++++++++++++++++++++++++++++-------- - 1 file changed, 44 insertions(+), 11 deletions(-) - -diff --git a/arch/arm/boot/dts/rk3288-miniarm.dts b/arch/arm/boot/dts/rk3288-miniarm.dts -index a5c5300797ab..7fc92c037dfd 100644 ---- a/arch/arm/boot/dts/rk3288-miniarm.dts -+++ b/arch/arm/boot/dts/rk3288-miniarm.dts -@@ -42,11 +42,22 @@ - #include - #include "rk3288.dtsi" - #include "rk3288-rkisp1.dtsi" --#include "rk3288-linux.dtsi" -+#include "rk3288cg-opp.dtsi" - - / { -+ model = "ASUS Tinker Board"; - compatible = "rockchip,rk3288-miniarm", "rockchip,rk3288"; - -+ chosen { -+ // bootargs = "earlyprintk=uart8250-32bit,0xff690000"; -+ }; -+ -+ cpuinfo { -+ compatible = "rockchip,cpuinfo"; -+ nvmem-cells = <&efuse_id>; -+ nvmem-cell-names = "id"; -+ }; -+ - memory { - device_type = "memory"; - reg = <0x0 0x0 0x0 0x80000000>; -@@ -67,7 +78,7 @@ - wireless-wlan { - compatible = "wlan-platdata"; - rockchip,grf = <&grf>; -- wifi_chip_type = "ap6212"; -+ wifi_chip_type = "rtl8723bs"; - sdio_vref = <1800>; - WIFI,host_wake_irq = <&gpio4 30 GPIO_ACTIVE_HIGH>; - status = "okay"; -@@ -129,16 +140,16 @@ - linux,default-trigger="mmc0"; - }; - -- led1-led { -+ heartbeat-led { - gpios=<&gpio1 25 GPIO_ACTIVE_HIGH>; -- linux,default-trigger="default-off"; -+ linux,default-trigger="heartbeat"; - }; - }; - - sound { - compatible = "simple-audio-card"; - simple-audio-card,format = "i2s"; -- simple-audio-card,name = "rockchip,miniarm-codec"; -+ simple-audio-card,name = "HDMI"; - simple-audio-card,mclk-fs = <512>; - simple-audio-card,cpu { - sound-dai = <&i2s>; -@@ -204,20 +215,33 @@ - cpu0-supply = <&vdd_cpu>; - }; - -+&emmc { -+ bus-width = <8>; -+ cap-mmc-highspeed; -+ disable-wp; -+ mmc-ddr-1_8v; -+ mmc-hs200-1_8v; -+ non-removable; -+ num-slots = <1>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_pwr &emmc_bus8>; -+ status = "okay"; -+}; -+ - &gmac { - phy-supply = <&vcc33_lan>; - phy-mode = "rgmii"; - clock_in_out = "input"; - snps,reset-gpio = <&gpio4 7 0>; - snps,reset-active-low; -- snps,reset-delays-us = <0 10000 1000000>; -+ snps,reset-delays-us = <0 10000 50000>; - assigned-clocks = <&cru SCLK_MAC>; - assigned-clock-parents = <&ext_gmac>; - pinctrl-names = "default"; - pinctrl-0 = <&rgmii_pins>; - tx_delay = <0x30>; - rx_delay = <0x10>; -- status = "ok"; -+ status = "okay"; - }; - - &dsi0 { -@@ -238,6 +262,11 @@ - #address-cells = <1>; - #size-cells = <0>; - #sound-dai-cells = <0>; -+ rockchip,phy-table = -+ <74250000 0x8009 0x0004 0x0272>, -+ <165000000 0x802b 0x0004 0x0209>, -+ <371250000 0x802d 0x0001 0x0149>, -+ <0 0x0000 0x0000 0x0000>; - status = "okay"; - /* Don't use vopl for HDMI */ - ports { -@@ -545,6 +574,7 @@ - - &i2s { - #sound-dai-cells = <0>; -+ rockchip,bclk-fs = <128>; - status = "okay"; - }; - -@@ -558,7 +588,7 @@ - &sdio0 { - status = "okay"; - clock-frequency = <50000000>; -- clock-freq-min-max = <200000 50000000>; -+ max-frequency = <50000000>; - bus-width = <4>; - cap-sd-highspeed; - cap-sdio-irq; -@@ -579,7 +609,7 @@ - - &saradc { - vref-supply = <&vcc18_ldo1>; -- status ="okay"; -+ status = "okay"; - }; - - &sdmmc { -@@ -604,7 +634,6 @@ - &tsadc { - rockchip,hw-tshut-mode = <1>; /* tshut mode 0:CRU 1:GPIO */ - rockchip,hw-tshut-polarity = <1>; /* tshut polarity 0:LOW 1:HIGH */ -- pinctrl-1 = <&otp_out>; - status = "okay"; - }; - -@@ -615,6 +644,8 @@ - }; - - &uart1 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart1_xfer>, <&uart1_cts>, <&uart1_rts>; - status = "okay"; - }; - -@@ -627,6 +658,8 @@ - }; - - &uart4 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart4_xfer>, <&uart4_cts>, <&uart4_rts>; - status = "okay"; - }; - -@@ -644,7 +677,7 @@ - }; - - &usb_otg { -- status= "okay"; -+ status = "okay"; - }; - - &vopb { - -From 6cf3332dd491b1898930ff53e3cdd3b9f2a4a190 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Thu, 2 Nov 2017 23:17:46 +0100 -Subject: [PATCH] arm: dts: rk3288-miqi: update dts - ---- - arch/arm/boot/dts/rk3288-miqi.dts | 69 ++++++++++++++++++++++++--------------- - 1 file changed, 43 insertions(+), 26 deletions(-) - -diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts -index a2862c6a17f1..18f2a9f96d71 100644 ---- a/arch/arm/boot/dts/rk3288-miqi.dts -+++ b/arch/arm/boot/dts/rk3288-miqi.dts -@@ -43,10 +43,21 @@ - /dts-v1/; - #include - #include "rk3288.dtsi" --#include "rk3288-linux.dtsi" -+#include "rk3288cg-opp.dtsi" - - / { -- compatible = "rockchip,rk3288-miqi", "rockchip,rk3288"; -+ model = "mqmaker MiQi"; -+ compatible = "rockchip,rk3288-miqi", "rockchip,rk3288w", "rockchip,rk3288"; -+ -+ chosen { -+ bootargs = "earlyprintk=uart8250-32bit,0xff690000"; -+ }; -+ -+ cpuinfo { -+ compatible = "rockchip,cpuinfo"; -+ nvmem-cells = <&efuse_id>; -+ nvmem-cell-names = "id"; -+ }; - - memory { - device_type = "memory"; -@@ -56,29 +67,14 @@ - sound { - compatible = "simple-audio-card"; - simple-audio-card,format = "i2s"; -- simple-audio-card,name = "DW-HDMI"; -+ simple-audio-card,name = "HDMI"; - simple-audio-card,mclk-fs = <512>; -- -- simple-audio-card,dai-link@0 { /* I2S - S/PDIF */ -- format = "i2s"; -- cpu { -- sound-dai = <&i2s>; -- }; -- codec { -- sound-dai = <&hdmi>; -- }; -+ simple-audio-card,cpu { -+ sound-dai = <&i2s>; -+ }; -+ simple-audio-card,codec { -+ sound-dai = <&hdmi>; - }; -- -- /* -- * If you want to support more cards, -- * you can add more dai-link node, -- * such as -- * -- * simple-audio-card,dai-link@1 { -- * ...... -- * } -- */ -- - }; - - ext_gmac: external-gmac-clock { -@@ -204,6 +200,12 @@ - #size-cells = <0>; - #sound-dai-cells = <0>; - status = "okay"; -+ /* Don't use vopl for HDMI */ -+ ports { -+ hdmi_in: port { -+ /delete-node/ endpoint@1; -+ }; -+ }; - }; - - &hevc_service { -@@ -235,14 +237,14 @@ - clock_in_out = "input"; - snps,reset-gpio = <&gpio4 7 0>; - snps,reset-active-low; -- snps,reset-delays-us = <0 10000 1000000>; -+ snps,reset-delays-us = <0 10000 50000>; - assigned-clocks = <&cru SCLK_MAC>; - assigned-clock-parents = <&ext_gmac>; - pinctrl-names = "default"; - pinctrl-0 = <&rgmii_pins>; - tx_delay = <0x30>; - rx_delay = <0x10>; -- status = "ok"; -+ status = "okay"; - }; - - /* ---------------------------------------------------------------------------------- -@@ -414,6 +416,7 @@ I2C - - &i2s { - #sound-dai-cells = <0>; -+ rockchip,bclk-fs = <128>; - status = "okay"; - }; - -@@ -439,6 +442,17 @@ I2C - status = "okay"; - }; - -+&saradc { -+ vref-supply = <&vcc_18>; -+ status = "okay"; -+}; -+ -+&tsadc { -+ rockchip,hw-tshut-mode = <0>; -+ rockchip,hw-tshut-polarity = <0>; -+ status = "okay"; -+}; -+ - /* - * Debug Serial Port - */ -@@ -472,6 +486,10 @@ I2C - - &vopl { - status = "okay"; -+ /* Don't use vopl for HDMI */ -+ vopl_out: port { -+ /delete-node/ endpoint@0; -+ }; - }; - - &vopl_mmu { -@@ -546,4 +564,3 @@ I2C - }; - - }; -- - -From 7134a982d5f5f6995cc06e5ea4c0ee452111bb91 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 28 Jan 2018 15:38:32 +0100 -Subject: [PATCH] arm: dts: rk3288: add cec clock and pinctrl - ---- - arch/arm/boot/dts/rk3288.dtsi | 16 +++++++++++++--- - 1 file changed, 13 insertions(+), 3 deletions(-) - -diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi -index 54b785278956..e3e3a58bb91e 100644 ---- a/arch/arm/boot/dts/rk3288.dtsi -+++ b/arch/arm/boot/dts/rk3288.dtsi -@@ -981,7 +981,8 @@ - <&cru PCLK_MIPI_DSI1>, - <&cru SCLK_EDP_24M>, - <&cru SCLK_EDP>, - <&cru SCLK_HDMI_CEC>, -+ <&cru SCLK_HDMI_HDCP>, - <&cru SCLK_ISP_JPE>, - <&cru SCLK_ISP>, - <&cru SCLK_RGA>; -@@ -1587,7 +1587,7 @@ - clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; - clock-names = "iahb", "isfr", "cec"; - pinctrl-names = "default", "sleep"; -- pinctrl-0 = <&hdmi_ddc>; -+ pinctrl-0 = <&hdmi_ddc>, <&hdmi_cec_c0>; - pinctrl-1 = <&hdmi_gpio>; - power-domains = <&power RK3288_PD_VIO>; - status = "disabled"; -@@ -1966,6 +1968,14 @@ - &pcfg_pull_none>; - }; - -+ hdmi_cec_c0: hdmi-cec-c0 { -+ rockchip,pins = <7 16 RK_FUNC_2 &pcfg_pull_none>; -+ }; -+ -+ hdmi_cec_c7: hdmi-cec-c7 { -+ rockchip,pins = <7 23 RK_FUNC_4 &pcfg_pull_none>; -+ }; -+ - hdmi_ddc: hdmi-ddc { - rockchip,pins = <7 19 RK_FUNC_2 &pcfg_pull_none>, - <7 20 RK_FUNC_2 &pcfg_pull_none>; - diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0006-rtl8211f.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0006-rtl8211f.patch deleted file mode 100644 index 5d497819ae56..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0006-rtl8211f.patch +++ /dev/null @@ -1,870 +0,0 @@ -From c5300de0fe982ae8a78e1b95ef7bf30b744e4ca1 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Fri, 25 Nov 2016 14:12:01 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: fix enabling of the TX-delay for - RTL8211F - -The old logic always enabled the TX-delay when the phy-mode was set to -PHY_INTERFACE_MODE_RGMII. There are dedicated phy-modes which tell the -PHY driver to enable the RX and/or TX delays: -- PHY_INTERFACE_MODE_RGMII should disable the RX and TX delay in the - PHY (if required, the MAC should add the delays in this case) -- PHY_INTERFACE_MODE_RGMII_ID should enable RX and TX delay in the PHY -- PHY_INTERFACE_MODE_RGMII_TXID should enable the TX delay in the PHY -- PHY_INTERFACE_MODE_RGMII_RXID should enable the RX delay in the PHY - (currently not supported by RTL8211F) - -With this patch we enable the TX delay for PHY_INTERFACE_MODE_RGMII_ID -and PHY_INTERFACE_MODE_RGMII_TXID. -Additionally we now explicity disable the TX-delay, which seems to be -enabled automatically after a hard-reset of the PHY (by triggering it's -reset pin) to get a consistent state (as defined by the phy-mode). - -This fixes a compatibility problem with some SoCs where the TX-delay was -also added by the MAC. With the TX-delay being applied twice the TX -clock was off and TX traffic was broken or very slow (<10Mbit/s) on -1000Mbit/s links. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Florian Fainelli -Signed-off-by: David S. Miller -(cherry picked from commit e3230494b57ece68750e3e32d3e53d6b00917058) ---- - drivers/net/phy/realtek.c | 20 ++++++++++++-------- - 1 file changed, 12 insertions(+), 8 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 43ab691362d4..686f3b259dc0 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -102,15 +102,19 @@ static int rtl8211f_config_init(struct phy_device *phydev) - if (ret < 0) - return ret; - -- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) { -- /* enable TXDLY */ -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08); -- reg = phy_read(phydev, 0x11); -+ phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08); -+ reg = phy_read(phydev, 0x11); -+ -+ /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */ -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) - reg |= RTL8211F_TX_DELAY; -- phy_write(phydev, 0x11, reg); -- /* restore to default page 0 */ -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0); -- } -+ else -+ reg &= ~RTL8211F_TX_DELAY; -+ -+ phy_write(phydev, 0x11, reg); -+ /* restore to default page 0 */ -+ phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0); - - return 0; - } - -From 647c38d9964680f7fbb24c5a889ef74b23b4cbd4 Mon Sep 17 00:00:00 2001 -From: Kunihiko Hayashi -Date: Tue, 12 Sep 2017 18:54:35 +0900 -Subject: [PATCH] UPSTREAM: net: phy: realtek: rename RTL8211F_PAGE_SELECT to - RTL821x_PAGE_SELECT - -This renames the definition of page select register from -RTL8211F_PAGE_SELECT to RTL821x_PAGE_SELECT to use it across models. - -Signed-off-by: Kunihiko Hayashi -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit 013955a6556766a76f9f2cc31e740fc6db6ecff4) ---- - drivers/net/phy/realtek.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 686f3b259dc0..d58cc8f518ac 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -22,11 +22,11 @@ - #define RTL821x_INER 0x12 - #define RTL821x_INER_INIT 0x6400 - #define RTL821x_INSR 0x13 -+#define RTL821x_PAGE_SELECT 0x1f - #define RTL8211E_INER_LINK_STATUS 0x400 - - #define RTL8211F_INER_LINK_STATUS 0x0010 - #define RTL8211F_INSR 0x1d --#define RTL8211F_PAGE_SELECT 0x1f - #define RTL8211F_TX_DELAY 0x100 - - MODULE_DESCRIPTION("Realtek PHY driver"); -@@ -46,10 +46,10 @@ static int rtl8211f_ack_interrupt(struct phy_device *phydev) - { - int err; - -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0xa43); -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0xa43); - err = phy_read(phydev, RTL8211F_INSR); - /* restore to default page 0 */ -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0); -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); - - return (err < 0) ? err : 0; - } -@@ -102,7 +102,7 @@ static int rtl8211f_config_init(struct phy_device *phydev) - if (ret < 0) - return ret; - -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08); -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0xd08); - reg = phy_read(phydev, 0x11); - - /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */ -@@ -114,7 +114,7 @@ static int rtl8211f_config_init(struct phy_device *phydev) - - phy_write(phydev, 0x11, reg); - /* restore to default page 0 */ -- phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0); -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); - - return 0; - } - -From 724532e7b4ad78722821763c639a73383a0f4418 Mon Sep 17 00:00:00 2001 -From: Jassi Brar -Date: Tue, 12 Sep 2017 18:54:36 +0900 -Subject: [PATCH] UPSTREAM: net: phy: realtek: add RTL8201F phy-id and - functions - -Add RTL8201F phy-id and the related functions to the driver. - -The original patch is as follows: -https://patchwork.kernel.org/patch/2538341/ - -Signed-off-by: Jongsung Kim -Signed-off-by: Jassi Brar -Signed-off-by: Kunihiko Hayashi -Reviewed-by: Andrew Lunn -Reviewed-by: Florian Fainelli -Signed-off-by: David S. Miller -(cherry picked from commit 513588dd44b09bb5fdd5066a4fbc1e7443b86d1c) ---- - drivers/net/phy/realtek.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 44 insertions(+) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index d58cc8f518ac..422cf1f6a60c 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -29,10 +29,22 @@ - #define RTL8211F_INSR 0x1d - #define RTL8211F_TX_DELAY 0x100 - -+#define RTL8201F_ISR 0x1e -+#define RTL8201F_IER 0x13 -+ - MODULE_DESCRIPTION("Realtek PHY driver"); - MODULE_AUTHOR("Johnson Leung"); - MODULE_LICENSE("GPL"); - -+static int rtl8201_ack_interrupt(struct phy_device *phydev) -+{ -+ int err; -+ -+ err = phy_read(phydev, RTL8201F_ISR); -+ -+ return (err < 0) ? err : 0; -+} -+ - static int rtl821x_ack_interrupt(struct phy_device *phydev) - { - int err; -@@ -54,6 +66,25 @@ static int rtl8211f_ack_interrupt(struct phy_device *phydev) - return (err < 0) ? err : 0; - } - -+static int rtl8201_config_intr(struct phy_device *phydev) -+{ -+ int err; -+ -+ /* switch to page 7 */ -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x7); -+ -+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) -+ err = phy_write(phydev, RTL8201F_IER, -+ BIT(13) | BIT(12) | BIT(11)); -+ else -+ err = phy_write(phydev, RTL8201F_IER, 0); -+ -+ /* restore to default page 0 */ -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -+ -+ return err; -+} -+ - static int rtl8211b_config_intr(struct phy_device *phydev) - { - int err; -@@ -129,6 +160,18 @@ static struct phy_driver realtek_drvs[] = { - .config_aneg = &genphy_config_aneg, - .read_status = &genphy_read_status, - .driver = { .owner = THIS_MODULE,}, -+ }, { -+ .phy_id = 0x001cc816, -+ .name = "RTL8201F 10/100Mbps Ethernet", -+ .phy_id_mask = 0x001fffff, -+ .features = PHY_BASIC_FEATURES, -+ .flags = PHY_HAS_INTERRUPT, -+ .config_aneg = &genphy_config_aneg, -+ .read_status = &genphy_read_status, -+ .ack_interrupt = &rtl8201_ack_interrupt, -+ .config_intr = &rtl8201_config_intr, -+ .suspend = genphy_suspend, -+ .resume = genphy_resume, - }, { - .phy_id = 0x001cc912, - .name = "RTL8211B Gigabit Ethernet", -@@ -186,6 +229,7 @@ static struct phy_driver realtek_drvs[] = { - module_phy_driver(realtek_drvs); - - static struct mdio_device_id __maybe_unused realtek_tbl[] = { -+ { 0x001cc816, 0x001fffff }, - { 0x001cc912, 0x001fffff }, - { 0x001cc914, 0x001fffff }, - { 0x001cc915, 0x001fffff }, - -From 933e1e195c40a941b6e5dec0c6a3a4bb7f804cf7 Mon Sep 17 00:00:00 2001 -From: Heiner Kallweit -Date: Sun, 12 Nov 2017 16:16:04 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: fix RTL8211F interrupt mode - -After commit b94d22d94ad22 "ARM64: dts: meson-gx: add external PHY -interrupt on some platforms" ethernet stopped working on my Odroid-C2 -which has a RTL8211F phy. - -It turned out that no interrupts were triggered. Further analysis -showed the register INER can't be altered on page 0. -Because register INSR needs to be accessed via page 0xa43 I assumed -that register INER needs to be accessed via some page too. -Some brute force check resulted in page 0xa42 being the right one. - -With this patch the phy is working properly in interrupt mode. - -Fixes: 3447cf2e9a11 ("net/phy: Add support for Realtek RTL8211F") -Signed-off-by: Heiner Kallweit -Tested-by: Jerome Brunet -Signed-off-by: David S. Miller -(cherry picked from commit 3697d058b08d5b874f0253de173ef72e5d648f9a) ---- - drivers/net/phy/realtek.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 422cf1f6a60c..a30d0c08c63b 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -115,11 +115,13 @@ static int rtl8211f_config_intr(struct phy_device *phydev) - { - int err; - -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0xa42); - if (phydev->interrupts == PHY_INTERRUPT_ENABLED) - err = phy_write(phydev, RTL821x_INER, - RTL8211F_INER_LINK_STATUS); - else - err = phy_write(phydev, RTL821x_INER, 0); -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0); - - return err; - } - -From 046a2dc318a05236e06b09d8c0ca3f1005cbceca Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 22:51:24 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: use the BIT and GENMASK macros - -This makes it easier to compare the #defines with the datasheets. -No functional changes. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit 8cc5baefbc0266b6d6c8e99cb8568f59be36a575) ---- - drivers/net/phy/realtek.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index a30d0c08c63b..f8dc29a75828 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -13,21 +13,22 @@ - * option) any later version. - * - */ -+#include - #include - #include - - #define RTL821x_PHYSR 0x11 --#define RTL821x_PHYSR_DUPLEX 0x2000 --#define RTL821x_PHYSR_SPEED 0xc000 -+#define RTL821x_PHYSR_DUPLEX BIT(13) -+#define RTL821x_PHYSR_SPEED GENMASK(15, 14) - #define RTL821x_INER 0x12 - #define RTL821x_INER_INIT 0x6400 - #define RTL821x_INSR 0x13 - #define RTL821x_PAGE_SELECT 0x1f --#define RTL8211E_INER_LINK_STATUS 0x400 -+#define RTL8211E_INER_LINK_STATUS BIT(10) - --#define RTL8211F_INER_LINK_STATUS 0x0010 -+#define RTL8211F_INER_LINK_STATUS BIT(4) - #define RTL8211F_INSR 0x1d --#define RTL8211F_TX_DELAY 0x100 -+#define RTL8211F_TX_DELAY BIT(8) - - #define RTL8201F_ISR 0x1e - #define RTL8201F_IER 0x13 - -From 7894b1cae69475242cdb1ca0fb639a5d70ac6316 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 22:51:25 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: rename RTL821x_INER_INIT to - RTL8211B_INER_INIT - -This macro is only used by the RTL8211B code. RTL8211E and RTL8211F both -use other bits to initialize the RTL821x_INER register. -No functional changes. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit 69021e32ec3ef02170482f6ed8130febaed27357) ---- - drivers/net/phy/realtek.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index f8dc29a75828..89308eac4088 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -21,7 +21,7 @@ - #define RTL821x_PHYSR_DUPLEX BIT(13) - #define RTL821x_PHYSR_SPEED GENMASK(15, 14) - #define RTL821x_INER 0x12 --#define RTL821x_INER_INIT 0x6400 -+#define RTL8211B_INER_INIT 0x6400 - #define RTL821x_INSR 0x13 - #define RTL821x_PAGE_SELECT 0x1f - #define RTL8211E_INER_LINK_STATUS BIT(10) -@@ -92,7 +92,7 @@ static int rtl8211b_config_intr(struct phy_device *phydev) - - if (phydev->interrupts == PHY_INTERRUPT_ENABLED) - err = phy_write(phydev, RTL821x_INER, -- RTL821x_INER_INIT); -+ RTL8211B_INER_INIT); - else - err = phy_write(phydev, RTL821x_INER, 0); - - -From f6e8b6c88c6b3d4925607575bc4387a289d49708 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 22:51:26 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: group all register bit #defines - for RTL821x_INER - -This simply moves all register bit #defines which describe the (PHY -specific) bits in the RTL821x_INER right below the RTL821x_INER register -definition. This makes it easier to spot which registers and bits belong -together. -No functional changes. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit a82f266d240d87e6111878bbfe287024fb6857c1) ---- - drivers/net/phy/realtek.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 89308eac4088..df97d903d2bf 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -20,13 +20,16 @@ - #define RTL821x_PHYSR 0x11 - #define RTL821x_PHYSR_DUPLEX BIT(13) - #define RTL821x_PHYSR_SPEED GENMASK(15, 14) -+ - #define RTL821x_INER 0x12 - #define RTL8211B_INER_INIT 0x6400 -+#define RTL8211E_INER_LINK_STATUS BIT(10) -+#define RTL8211F_INER_LINK_STATUS BIT(4) -+ - #define RTL821x_INSR 0x13 -+ - #define RTL821x_PAGE_SELECT 0x1f --#define RTL8211E_INER_LINK_STATUS BIT(10) - --#define RTL8211F_INER_LINK_STATUS BIT(4) - #define RTL8211F_INSR 0x1d - #define RTL8211F_TX_DELAY BIT(8) - - -From d5e2b112bb8e5707fc2fb727122ee5a8444ee462 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 22:51:27 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: use the same indentation for all - #defines - -This simply makes the code easier to read. No functional changes. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit f609ab0ed8e7bef2cd61d230bf9e83e1ec5b9ddb) ---- - drivers/net/phy/realtek.c | 27 ++++++++++++++------------- - 1 file changed, 14 insertions(+), 13 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index df97d903d2bf..701f34ad7d8d 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -17,24 +17,25 @@ - #include - #include - --#define RTL821x_PHYSR 0x11 --#define RTL821x_PHYSR_DUPLEX BIT(13) --#define RTL821x_PHYSR_SPEED GENMASK(15, 14) -+#define RTL821x_PHYSR 0x11 -+#define RTL821x_PHYSR_DUPLEX BIT(13) -+#define RTL821x_PHYSR_SPEED GENMASK(15, 14) - --#define RTL821x_INER 0x12 --#define RTL8211B_INER_INIT 0x6400 --#define RTL8211E_INER_LINK_STATUS BIT(10) --#define RTL8211F_INER_LINK_STATUS BIT(4) -+#define RTL821x_INER 0x12 -+#define RTL8211B_INER_INIT 0x6400 -+#define RTL8211E_INER_LINK_STATUS BIT(10) -+#define RTL8211F_INER_LINK_STATUS BIT(4) - --#define RTL821x_INSR 0x13 -+#define RTL821x_INSR 0x13 - --#define RTL821x_PAGE_SELECT 0x1f -+#define RTL821x_PAGE_SELECT 0x1f - --#define RTL8211F_INSR 0x1d --#define RTL8211F_TX_DELAY BIT(8) -+#define RTL8211F_INSR 0x1d - --#define RTL8201F_ISR 0x1e --#define RTL8201F_IER 0x13 -+#define RTL8211F_TX_DELAY BIT(8) -+ -+#define RTL8201F_ISR 0x1e -+#define RTL8201F_IER 0x13 - - MODULE_DESCRIPTION("Realtek PHY driver"); - MODULE_AUTHOR("Johnson Leung"); - -From 8c16425a3c99a1cca4458eb17bd6414d65074027 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 22:51:28 +0100 -Subject: [PATCH] UPSTREAM: net: phy: realtek: add utility functions to - read/write page addresses - -Realtek PHYs implement the concept of so-called "extension pages". The -reason for this is probably because these PHYs expose more registers -than available in the standard address range. -After all read/write operations on such a page are done the driver -should switch back to page 0 where the standard MII registers (such as -MII_BMCR) are available. - -When referring to such a register the datasheets of RTL8211E and -RTL8211F always specify: -- the page / "ext. page" which has to be written to RTL821x_PAGE_SELECT -- an address (sometimes also called reg) - -These new utility functions make the existing code easier to read since -it removes some duplication (switching back to page 0 is done within the -new helpers for example). - -No functional changes are intended. - -Signed-off-by: Martin Blumenstingl -Reviewed-by: Andrew Lunn -Signed-off-by: David S. Miller -(cherry picked from commit 136819a6e8df374e6b9b424586ff11c9e241a1cb) ---- - drivers/net/phy/realtek.c | 83 ++++++++++++++++++++++++++++++----------------- - 1 file changed, 53 insertions(+), 30 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 701f34ad7d8d..b1d52e61d91c 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -41,6 +41,39 @@ MODULE_DESCRIPTION("Realtek PHY driver"); - MODULE_AUTHOR("Johnson Leung"); - MODULE_LICENSE("GPL"); - -+static int rtl8211x_page_read(struct phy_device *phydev, u16 page, u16 address) -+{ -+ int ret; -+ -+ ret = phy_write(phydev, RTL821x_PAGE_SELECT, page); -+ if (ret) -+ return ret; -+ -+ ret = phy_read(phydev, address); -+ -+ /* restore to default page 0 */ -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -+ -+ return ret; -+} -+ -+static int rtl8211x_page_write(struct phy_device *phydev, u16 page, -+ u16 address, u16 val) -+{ -+ int ret; -+ -+ ret = phy_write(phydev, RTL821x_PAGE_SELECT, page); -+ if (ret) -+ return ret; -+ -+ ret = phy_write(phydev, address, val); -+ -+ /* restore to default page 0 */ -+ phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -+ -+ return ret; -+} -+ - static int rtl8201_ack_interrupt(struct phy_device *phydev) - { - int err; -@@ -63,31 +96,21 @@ static int rtl8211f_ack_interrupt(struct phy_device *phydev) - { - int err; - -- phy_write(phydev, RTL821x_PAGE_SELECT, 0xa43); -- err = phy_read(phydev, RTL8211F_INSR); -- /* restore to default page 0 */ -- phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -+ err = rtl8211x_page_read(phydev, 0xa43, RTL8211F_INSR); - - return (err < 0) ? err : 0; - } - - static int rtl8201_config_intr(struct phy_device *phydev) - { -- int err; -- -- /* switch to page 7 */ -- phy_write(phydev, RTL821x_PAGE_SELECT, 0x7); -+ u16 val; - - if (phydev->interrupts == PHY_INTERRUPT_ENABLED) -- err = phy_write(phydev, RTL8201F_IER, -- BIT(13) | BIT(12) | BIT(11)); -+ val = BIT(13) | BIT(12) | BIT(11); - else -- err = phy_write(phydev, RTL8201F_IER, 0); -+ val = 0; - -- /* restore to default page 0 */ -- phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -- -- return err; -+ return rtl8211x_page_write(phydev, 0x7, RTL8201F_IER, val); - } - - static int rtl8211b_config_intr(struct phy_device *phydev) -@@ -118,41 +141,41 @@ static int rtl8211e_config_intr(struct phy_device *phydev) - - static int rtl8211f_config_intr(struct phy_device *phydev) - { -- int err; -+ u16 val; - -- phy_write(phydev, RTL821x_PAGE_SELECT, 0xa42); - if (phydev->interrupts == PHY_INTERRUPT_ENABLED) -- err = phy_write(phydev, RTL821x_INER, -- RTL8211F_INER_LINK_STATUS); -+ val = RTL8211F_INER_LINK_STATUS; - else -- err = phy_write(phydev, RTL821x_INER, 0); -- phy_write(phydev, RTL821x_PAGE_SELECT, 0); -+ val = 0; - -- return err; -+ return rtl8211x_page_write(phydev, 0xa42, RTL821x_INER, val); - } - - static int rtl8211f_config_init(struct phy_device *phydev) - { - int ret; -- u16 reg; -+ u16 val; - - ret = genphy_config_init(phydev); - if (ret < 0) - return ret; - -- phy_write(phydev, RTL821x_PAGE_SELECT, 0xd08); -- reg = phy_read(phydev, 0x11); -+ ret = rtl8211x_page_read(phydev, 0xd08, 0x11); -+ if (ret < 0) -+ return ret; -+ -+ val = ret & 0xffff; - - /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */ - if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || - phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) -- reg |= RTL8211F_TX_DELAY; -+ val |= RTL8211F_TX_DELAY; - else -- reg &= ~RTL8211F_TX_DELAY; -+ val &= ~RTL8211F_TX_DELAY; - -- phy_write(phydev, 0x11, reg); -- /* restore to default page 0 */ -- phy_write(phydev, RTL821x_PAGE_SELECT, 0x0); -+ ret = rtl8211x_page_write(phydev, 0xd08, 0x11, val); -+ if (ret) -+ return ret; - - return 0; - } - -From 13e556c6d4ece3c890edc414f205cc26381e9826 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 23:06:48 +0100 -Subject: [PATCH] FROMLIST: net: phy: realtek: add support for configuring the - RX delay on RTL8211F - -On RTL8211F the RX delay can also be enabled/disabled. -The overall behavior of the RX delay is similar to the behavior of the -TX delay, which was already supported by the driver. - -The RX delay (similar to the TX delay) may be enabled using hardware pin -strapping. If the MAC already configures the RX delay (if required) then -the RX delay generated by the RTL8211F PHY has to be turned off. - -While here, update the comment regarding the TX delay why it has to be -enabled or disabled within the driver. -Also avoid code-duplication by extracting the code to mask/unmask bits -in a paged register into a new rtl8211x_page_mask_bits helper function. - -Signed-off-by: Martin Blumenstingl ---- - drivers/net/phy/realtek.c | 55 ++++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 45 insertions(+), 10 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index b1d52e61d91c..890ea9d18d27 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -32,7 +32,10 @@ - - #define RTL8211F_INSR 0x1d - --#define RTL8211F_TX_DELAY BIT(8) -+#define RTL8211F_RX_DELAY_REG 0x15 -+#define RTL8211F_RX_DELAY_EN BIT(3) -+#define RTL8211F_TX_DELAY_REG 0x11 -+#define RTL8211F_TX_DELAY_EN BIT(8) - - #define RTL8201F_ISR 0x1e - #define RTL8201F_IER 0x13 -@@ -74,6 +77,23 @@ static int rtl8211x_page_write(struct phy_device *phydev, u16 page, - return ret; - } - -+static int rtl8211x_page_mask_bits(struct phy_device *phydev, u16 page, -+ u16 address, u16 mask, u16 set) -+{ -+ int ret; -+ u16 val; -+ -+ ret = rtl8211x_page_read(phydev, page, address); -+ if (ret < 0) -+ return ret; -+ -+ val = ret & 0xffff; -+ val &= ~mask; -+ val |= (set & mask); -+ -+ return rtl8211x_page_write(phydev, page, address, val); -+} -+ - static int rtl8201_ack_interrupt(struct phy_device *phydev) - { - int err; -@@ -160,20 +180,35 @@ static int rtl8211f_config_init(struct phy_device *phydev) - if (ret < 0) - return ret; - -- ret = rtl8211x_page_read(phydev, 0xd08, 0x11); -- if (ret < 0) -- return ret; -+ /* -+ * enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it. -+ * this is needed because it can be enabled by pin strapping and -+ * conflict with the TX-delay configured by the MAC. -+ */ -+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) -+ val = RTL8211F_TX_DELAY_EN; -+ else -+ val = 0; - -- val = ret & 0xffff; -+ ret = rtl8211x_page_mask_bits(phydev, 0xd08, RTL8211F_TX_DELAY_REG, -+ RTL8211F_TX_DELAY_EN, val); -+ if (ret) -+ return ret; - -- /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */ -+ /* -+ * enable RX-delay for rgmii-id and rgmii-rxid, otherwise disable it. -+ * this is needed because it can be enabled by pin strapping and -+ * conflict with the RX-delay configured by the MAC. -+ */ - if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID || -- phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) -- val |= RTL8211F_TX_DELAY; -+ phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) -+ val = RTL8211F_RX_DELAY_EN; - else -- val &= ~RTL8211F_TX_DELAY; -+ val = 0; - -- ret = rtl8211x_page_write(phydev, 0xd08, 0x11, val); -+ ret = rtl8211x_page_mask_bits(phydev, 0xd08, RTL8211F_RX_DELAY_REG, -+ RTL8211F_RX_DELAY_EN, val); - if (ret) - return ret; - - -From e8fa4ce26460af84f028b7d215134caa33aa9ecb Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 23:06:49 +0100 -Subject: [PATCH] FROMLIST: net: phy: realtek: configure the INTB pin on - RTL8211F - -The interrupt pin on the RTL8211F PHY can be used in two different -modes: -INTB -- the default mode of the PHY -- interrupts can be configured through page 0xa42 register RTL821x_INER -- interrupts can be ACK'ed through RTL8211F_INSR -- it acts as a level-interrupt which is active low -- Wake-on-LAN "wakeup" status is available in RTL8211F_INSR bit 7 - -PMEB: -- special mode for Wake-on-LAN -- interrupts configured through page 0xa42 register RTL821x_INER are - disabled -- it supports a "pulse low" waveform for the interrupt - -For now we simply force the pin into INTB mode since the PHY driver does -not support Wake-on-LAN yet. - -Signed-off-by: Martin Blumenstingl ---- - drivers/net/phy/realtek.c | 27 +++++++++++++++++++++++++-- - 1 file changed, 25 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index 890ea9d18d27..f307d220b49a 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -40,6 +40,9 @@ - #define RTL8201F_ISR 0x1e - #define RTL8201F_IER 0x13 - -+#define RTL8211F_INTBCR 0x16 -+#define RTL8211F_INTBCR_INTB_PMEB BIT(5) -+ - MODULE_DESCRIPTION("Realtek PHY driver"); - MODULE_AUTHOR("Johnson Leung"); - MODULE_LICENSE("GPL"); -@@ -161,12 +164,32 @@ static int rtl8211e_config_intr(struct phy_device *phydev) - - static int rtl8211f_config_intr(struct phy_device *phydev) - { -+ int err; - u16 val; - -- if (phydev->interrupts == PHY_INTERRUPT_ENABLED) -+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) { -+ /* -+ * The interrupt pin has two functions: -+ * 0: INTB: it acts as interrupt pin which can be configured -+ * through RTL821x_INER and the status can be read through -+ * RTL8211F_INSR -+ * 1: PMEB: a special "Power Management Event" mode for -+ * Wake-on-LAN operation (with support for a "pulse low" -+ * wave format). Interrupts configured through RTL821x_INER -+ * will not work in this mode -+ * -+ * select INTB mode in the "INTB pin control" register to -+ * ensure that the interrupt pin is in the correct mode. -+ */ -+ err = rtl8211x_page_mask_bits(phydev, 0xd40, RTL8211F_INTBCR, -+ RTL8211F_INTBCR_INTB_PMEB, 0); -+ if (err) -+ return err; -+ - val = RTL8211F_INER_LINK_STATUS; -- else -+ } else { - val = 0; -+ } - - return rtl8211x_page_write(phydev, 0xa42, RTL821x_INER, val); - } - -From dd026c252cd898bca0b85eb14aa6479b415d2471 Mon Sep 17 00:00:00 2001 -From: Martin Blumenstingl -Date: Sat, 2 Dec 2017 23:06:50 +0100 -Subject: [PATCH] FROMLIST: net: phy: realtek: add more interrupt bits for - RTL8211E and RTL8211F - -This documents a few more bits in the RTL821x_INER register for RTL8211E -and RTL8211F. These are added only to document them (as no public -datasheets are available for these PHYs), they are currently not used. - -Signed-off-by: Martin Blumenstingl ---- - drivers/net/phy/realtek.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c -index f307d220b49a..15d342eefd6d 100644 ---- a/drivers/net/phy/realtek.c -+++ b/drivers/net/phy/realtek.c -@@ -24,7 +24,14 @@ - #define RTL821x_INER 0x12 - #define RTL8211B_INER_INIT 0x6400 - #define RTL8211E_INER_LINK_STATUS BIT(10) -+#define RTL8211E_INER_ANEG_COMPLETED BIT(11) -+#define RTL8211E_INER_PAGE_RECEIVED BIT(12) -+#define RTL8211E_INER_ANEG_ERROR BIT(15) - #define RTL8211F_INER_LINK_STATUS BIT(4) -+#define RTL8211F_INER_PHY_REGISTER_ACCESSIBLE BIT(5) -+#define RTL8211F_INER_WOL_PME BIT(7) -+#define RTL8211F_INER_ALDPS_STATE_CHANGE BIT(9) -+#define RTL8211F_INER_JABBER BIT(10) - - #define RTL821x_INSR 0x13 - diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0007-dtoverlay-configfs.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0007-dtoverlay-configfs.patch deleted file mode 100644 index ee3b0a1258e6..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0007-dtoverlay-configfs.patch +++ /dev/null @@ -1,1120 +0,0 @@ -From bb0e3fa6305fe3dead0aa670d7979d6ebcbaf47d Mon Sep 17 00:00:00 2001 -From: Pantelis Antoniou -Date: Thu, 22 Oct 2015 23:30:04 +0300 -Subject: [PATCH] UPSTREAM: configfs: implement binary attributes - -ConfigFS lacked binary attributes up until now. This patch -introduces support for binary attributes in a somewhat similar -manner of sysfs binary attributes albeit with changes that -fit the configfs usage model. - -Problems that configfs binary attributes fix are everything that -requires a binary blob as part of the configuration of a resource, -such as bitstream loading for FPGAs, DTBs for dynamically created -devices etc. - -Look at Documentation/filesystems/configfs/configfs.txt for internals -and howto use them. - -This patch is against linux-next as of today that contains -Christoph's configfs rework. - -Signed-off-by: Pantelis Antoniou -[hch: folded a fix from Geert Uytterhoeven ] -[hch: a few tiny updates based on review feedback] -Signed-off-by: Christoph Hellwig -(cherry picked from commit 03607ace807b414eab46323c794b6fb8fcc2d48c) ---- - Documentation/filesystems/configfs/configfs.txt | 57 +++++- - fs/configfs/configfs_internal.h | 14 +- - fs/configfs/dir.c | 18 +- - fs/configfs/file.c | 255 +++++++++++++++++++++++- - fs/configfs/inode.c | 2 +- - include/linux/configfs.h | 50 +++++ - 6 files changed, 374 insertions(+), 22 deletions(-) - -diff --git a/Documentation/filesystems/configfs/configfs.txt b/Documentation/filesystems/configfs/configfs.txt -index af68efdbbfad..e5fe521eea1d 100644 ---- a/Documentation/filesystems/configfs/configfs.txt -+++ b/Documentation/filesystems/configfs/configfs.txt -@@ -51,15 +51,27 @@ configfs tree is always there, whether mounted on /config or not. - An item is created via mkdir(2). The item's attributes will also - appear at this time. readdir(3) can determine what the attributes are, - read(2) can query their default values, and write(2) can store new --values. Like sysfs, attributes should be ASCII text files, preferably --with only one value per file. The same efficiency caveats from sysfs --apply. Don't mix more than one attribute in one attribute file. -- --Like sysfs, configfs expects write(2) to store the entire buffer at --once. When writing to configfs attributes, userspace processes should --first read the entire file, modify the portions they wish to change, and --then write the entire buffer back. Attribute files have a maximum size --of one page (PAGE_SIZE, 4096 on i386). -+values. Don't mix more than one attribute in one attribute file. -+ -+There are two types of configfs attributes: -+ -+* Normal attributes, which similar to sysfs attributes, are small ASCII text -+files, with a maximum size of one page (PAGE_SIZE, 4096 on i386). Preferably -+only one value per file should be used, and the same caveats from sysfs apply. -+Configfs expects write(2) to store the entire buffer at once. When writing to -+normal configfs attributes, userspace processes should first read the entire -+file, modify the portions they wish to change, and then write the entire -+buffer back. -+ -+* Binary attributes, which are somewhat similar to sysfs binary attributes, -+but with a few slight changes to semantics. The PAGE_SIZE limitation does not -+apply, but the whole binary item must fit in single kernel vmalloc'ed buffer. -+The write(2) calls from user space are buffered, and the attributes' -+write_bin_attribute method will be invoked on the final close, therefore it is -+imperative for user-space to check the return code of close(2) in order to -+verify that the operation finished successfully. -+To avoid a malicious user OOMing the kernel, there's a per-binary attribute -+maximum buffer value. - - When an item needs to be destroyed, remove it with rmdir(2). An - item cannot be destroyed if any other item has a link to it (via -@@ -171,6 +183,7 @@ among other things. For that, it needs a type. - struct configfs_item_operations *ct_item_ops; - struct configfs_group_operations *ct_group_ops; - struct configfs_attribute **ct_attrs; -+ struct configfs_bin_attribute **ct_bin_attrs; - }; - - The most basic function of a config_item_type is to define what -@@ -201,6 +214,32 @@ be called whenever userspace asks for a read(2) on the attribute. If an - attribute is writable and provides a ->store method, that method will be - be called whenever userspace asks for a write(2) on the attribute. - -+[struct configfs_bin_attribute] -+ -+ struct configfs_attribute { -+ struct configfs_attribute cb_attr; -+ void *cb_private; -+ size_t cb_max_size; -+ }; -+ -+The binary attribute is used when the one needs to use binary blob to -+appear as the contents of a file in the item's configfs directory. -+To do so add the binary attribute to the NULL-terminated array -+config_item_type->ct_bin_attrs, and the item appears in configfs, the -+attribute file will appear with the configfs_bin_attribute->cb_attr.ca_name -+filename. configfs_bin_attribute->cb_attr.ca_mode specifies the file -+permissions. -+The cb_private member is provided for use by the driver, while the -+cb_max_size member specifies the maximum amount of vmalloc buffer -+to be used. -+ -+If binary attribute is readable and the config_item provides a -+ct_item_ops->read_bin_attribute() method, that method will be called -+whenever userspace asks for a read(2) on the attribute. The converse -+will happen for write(2). The reads/writes are bufferred so only a -+single read/write will occur; the attributes' need not concern itself -+with it. -+ - [struct config_group] - - A config_item cannot live in a vacuum. The only way one can be created -diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h -index b65d1ef532d5..ccc31fa6f1a7 100644 ---- a/fs/configfs/configfs_internal.h -+++ b/fs/configfs/configfs_internal.h -@@ -53,13 +53,14 @@ struct configfs_dirent { - #define CONFIGFS_ROOT 0x0001 - #define CONFIGFS_DIR 0x0002 - #define CONFIGFS_ITEM_ATTR 0x0004 -+#define CONFIGFS_ITEM_BIN_ATTR 0x0008 - #define CONFIGFS_ITEM_LINK 0x0020 - #define CONFIGFS_USET_DIR 0x0040 - #define CONFIGFS_USET_DEFAULT 0x0080 - #define CONFIGFS_USET_DROPPING 0x0100 - #define CONFIGFS_USET_IN_MKDIR 0x0200 - #define CONFIGFS_USET_CREATING 0x0400 --#define CONFIGFS_NOT_PINNED (CONFIGFS_ITEM_ATTR) -+#define CONFIGFS_NOT_PINNED (CONFIGFS_ITEM_ATTR | CONFIGFS_ITEM_BIN_ATTR) - - extern struct mutex configfs_symlink_mutex; - extern spinlock_t configfs_dirent_lock; -@@ -72,6 +73,8 @@ extern struct inode * configfs_new_inode(umode_t mode, struct configfs_dirent *, - extern int configfs_create(struct dentry *, umode_t mode, void (*init)(struct inode *)); - - extern int configfs_create_file(struct config_item *, const struct configfs_attribute *); -+extern int configfs_create_bin_file(struct config_item *, -+ const struct configfs_bin_attribute *); - extern int configfs_make_dirent(struct configfs_dirent *, - struct dentry *, void *, umode_t, int); - extern int configfs_dirent_is_ready(struct configfs_dirent *); -@@ -88,7 +91,7 @@ extern void configfs_release_fs(void); - extern struct rw_semaphore configfs_rename_sem; - extern const struct file_operations configfs_dir_operations; - extern const struct file_operations configfs_file_operations; --extern const struct file_operations bin_fops; -+extern const struct file_operations configfs_bin_file_operations; - extern const struct inode_operations configfs_dir_inode_operations; - extern const struct inode_operations configfs_root_inode_operations; - extern const struct inode_operations configfs_symlink_inode_operations; -@@ -119,6 +122,13 @@ static inline struct configfs_attribute * to_attr(struct dentry * dentry) - return ((struct configfs_attribute *) sd->s_element); - } - -+static inline struct configfs_bin_attribute *to_bin_attr(struct dentry *dentry) -+{ -+ struct configfs_attribute *attr = to_attr(dentry); -+ -+ return container_of(attr, struct configfs_bin_attribute, cb_attr); -+} -+ - static inline struct config_item *configfs_get_config_item(struct dentry *dentry) - { - struct config_item * item = NULL; -diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c -index a7a1b218f308..7ae97e83f121 100644 ---- a/fs/configfs/dir.c -+++ b/fs/configfs/dir.c -@@ -255,6 +255,12 @@ static void configfs_init_file(struct inode * inode) - inode->i_fop = &configfs_file_operations; - } - -+static void configfs_init_bin_file(struct inode *inode) -+{ -+ inode->i_size = 0; -+ inode->i_fop = &configfs_bin_file_operations; -+} -+ - static void init_symlink(struct inode * inode) - { - inode->i_op = &configfs_symlink_inode_operations; -@@ -423,7 +429,9 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den - spin_unlock(&configfs_dirent_lock); - - error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG, -- configfs_init_file); -+ (sd->s_type & CONFIGFS_ITEM_BIN_ATTR) ? -+ configfs_init_bin_file : -+ configfs_init_file); - if (error) { - configfs_put(sd); - return error; -@@ -583,6 +591,7 @@ static int populate_attrs(struct config_item *item) - { - struct config_item_type *t = item->ci_type; - struct configfs_attribute *attr; -+ struct configfs_bin_attribute *bin_attr; - int error = 0; - int i; - -@@ -594,6 +603,13 @@ static int populate_attrs(struct config_item *item) - break; - } - } -+ if (t->ct_bin_attrs) { -+ for (i = 0; (bin_attr = t->ct_bin_attrs[i]) != NULL; i++) { -+ error = configfs_create_bin_file(item, bin_attr); -+ if (error) -+ break; -+ } -+ } - - if (error) - detach_attrs(item); -diff --git a/fs/configfs/file.c b/fs/configfs/file.c -index d39099ea7df7..3687187c8ea5 100644 ---- a/fs/configfs/file.c -+++ b/fs/configfs/file.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -48,6 +49,10 @@ struct configfs_buffer { - struct configfs_item_operations * ops; - struct mutex mutex; - int needs_read_fill; -+ bool read_in_progress; -+ bool write_in_progress; -+ char *bin_buffer; -+ int bin_buffer_size; - }; - - -@@ -123,6 +128,87 @@ out: - return retval; - } - -+/** -+ * configfs_read_bin_file - read a binary attribute. -+ * @file: file pointer. -+ * @buf: buffer to fill. -+ * @count: number of bytes to read. -+ * @ppos: starting offset in file. -+ * -+ * Userspace wants to read a binary attribute file. The attribute -+ * descriptor is in the file's ->d_fsdata. The target item is in the -+ * directory's ->d_fsdata. -+ * -+ * We check whether we need to refill the buffer. If so we will -+ * call the attributes' attr->read() twice. The first time we -+ * will pass a NULL as a buffer pointer, which the attributes' method -+ * will use to return the size of the buffer required. If no error -+ * occurs we will allocate the buffer using vmalloc and call -+ * attr->read() again passing that buffer as an argument. -+ * Then we just copy to user-space using simple_read_from_buffer. -+ */ -+ -+static ssize_t -+configfs_read_bin_file(struct file *file, char __user *buf, -+ size_t count, loff_t *ppos) -+{ -+ struct configfs_buffer *buffer = file->private_data; -+ struct dentry *dentry = file->f_path.dentry; -+ struct config_item *item = to_item(dentry->d_parent); -+ struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry); -+ ssize_t retval = 0; -+ ssize_t len = min_t(size_t, count, PAGE_SIZE); -+ -+ mutex_lock(&buffer->mutex); -+ -+ /* we don't support switching read/write modes */ -+ if (buffer->write_in_progress) { -+ retval = -ETXTBSY; -+ goto out; -+ } -+ buffer->read_in_progress = 1; -+ -+ if (buffer->needs_read_fill) { -+ /* perform first read with buf == NULL to get extent */ -+ len = bin_attr->read(item, NULL, 0); -+ if (len <= 0) { -+ retval = len; -+ goto out; -+ } -+ -+ /* do not exceed the maximum value */ -+ if (bin_attr->cb_max_size && len > bin_attr->cb_max_size) { -+ retval = -EFBIG; -+ goto out; -+ } -+ -+ buffer->bin_buffer = vmalloc(len); -+ if (buffer->bin_buffer == NULL) { -+ retval = -ENOMEM; -+ goto out; -+ } -+ buffer->bin_buffer_size = len; -+ -+ /* perform second read to fill buffer */ -+ len = bin_attr->read(item, buffer->bin_buffer, len); -+ if (len < 0) { -+ retval = len; -+ vfree(buffer->bin_buffer); -+ buffer->bin_buffer_size = 0; -+ buffer->bin_buffer = NULL; -+ goto out; -+ } -+ -+ buffer->needs_read_fill = 0; -+ } -+ -+ retval = simple_read_from_buffer(buf, count, ppos, buffer->bin_buffer, -+ buffer->bin_buffer_size); -+out: -+ mutex_unlock(&buffer->mutex); -+ return retval; -+} -+ - - /** - * fill_write_buffer - copy buffer from userspace. -@@ -209,10 +295,80 @@ configfs_write_file(struct file *file, const char __user *buf, size_t count, lof - return len; - } - --static int check_perm(struct inode * inode, struct file * file) -+/** -+ * configfs_write_bin_file - write a binary attribute. -+ * @file: file pointer -+ * @buf: data to write -+ * @count: number of bytes -+ * @ppos: starting offset -+ * -+ * Writing to a binary attribute file is similar to a normal read. -+ * We buffer the consecutive writes (binary attribute files do not -+ * support lseek) in a continuously growing buffer, but we don't -+ * commit until the close of the file. -+ */ -+ -+static ssize_t -+configfs_write_bin_file(struct file *file, const char __user *buf, -+ size_t count, loff_t *ppos) -+{ -+ struct configfs_buffer *buffer = file->private_data; -+ struct dentry *dentry = file->f_path.dentry; -+ struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry); -+ void *tbuf = NULL; -+ ssize_t len; -+ -+ mutex_lock(&buffer->mutex); -+ -+ /* we don't support switching read/write modes */ -+ if (buffer->read_in_progress) { -+ len = -ETXTBSY; -+ goto out; -+ } -+ buffer->write_in_progress = 1; -+ -+ /* buffer grows? */ -+ if (*ppos + count > buffer->bin_buffer_size) { -+ -+ if (bin_attr->cb_max_size && -+ *ppos + count > bin_attr->cb_max_size) { -+ len = -EFBIG; -+ } -+ -+ tbuf = vmalloc(*ppos + count); -+ if (tbuf == NULL) { -+ len = -ENOMEM; -+ goto out; -+ } -+ -+ /* copy old contents */ -+ if (buffer->bin_buffer) { -+ memcpy(tbuf, buffer->bin_buffer, -+ buffer->bin_buffer_size); -+ vfree(buffer->bin_buffer); -+ } -+ -+ /* clear the new area */ -+ memset(tbuf + buffer->bin_buffer_size, 0, -+ *ppos + count - buffer->bin_buffer_size); -+ buffer->bin_buffer = tbuf; -+ buffer->bin_buffer_size = *ppos + count; -+ } -+ -+ len = simple_write_to_buffer(buffer->bin_buffer, -+ buffer->bin_buffer_size, ppos, buf, count); -+ if (len > 0) -+ *ppos += len; -+out: -+ mutex_unlock(&buffer->mutex); -+ return len; -+} -+ -+static int check_perm(struct inode * inode, struct file * file, int type) - { - struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent); - struct configfs_attribute * attr = to_attr(file->f_path.dentry); -+ struct configfs_bin_attribute *bin_attr = NULL; - struct configfs_buffer * buffer; - struct configfs_item_operations * ops = NULL; - int error = 0; -@@ -220,6 +376,9 @@ static int check_perm(struct inode * inode, struct file * file) - if (!item || !attr) - goto Einval; - -+ if (type & CONFIGFS_ITEM_BIN_ATTR) -+ bin_attr = to_bin_attr(file->f_path.dentry); -+ - /* Grab the module reference for this attribute if we have one */ - if (!try_module_get(attr->ca_owner)) { - error = -ENODEV; -@@ -236,9 +395,14 @@ static int check_perm(struct inode * inode, struct file * file) - * and we must have a store method. - */ - if (file->f_mode & FMODE_WRITE) { -- if (!(inode->i_mode & S_IWUGO) || !attr->store) -+ if (!(inode->i_mode & S_IWUGO)) -+ goto Eaccess; -+ -+ if ((type & CONFIGFS_ITEM_ATTR) && !attr->store) - goto Eaccess; - -+ if ((type & CONFIGFS_ITEM_BIN_ATTR) && !bin_attr->write) -+ goto Eaccess; - } - - /* File needs read support. -@@ -246,7 +410,13 @@ static int check_perm(struct inode * inode, struct file * file) - * must be a show method for it. - */ - if (file->f_mode & FMODE_READ) { -- if (!(inode->i_mode & S_IRUGO) || !attr->show) -+ if (!(inode->i_mode & S_IRUGO)) -+ goto Eaccess; -+ -+ if ((type & CONFIGFS_ITEM_ATTR) && !attr->show) -+ goto Eaccess; -+ -+ if ((type & CONFIGFS_ITEM_BIN_ATTR) && !bin_attr->read) - goto Eaccess; - } - -@@ -260,6 +430,8 @@ static int check_perm(struct inode * inode, struct file * file) - } - mutex_init(&buffer->mutex); - buffer->needs_read_fill = 1; -+ buffer->read_in_progress = 0; -+ buffer->write_in_progress = 0; - buffer->ops = ops; - file->private_data = buffer; - goto Done; -@@ -277,12 +449,7 @@ static int check_perm(struct inode * inode, struct file * file) - return error; - } - --static int configfs_open_file(struct inode * inode, struct file * filp) --{ -- return check_perm(inode,filp); --} -- --static int configfs_release(struct inode * inode, struct file * filp) -+static int configfs_release(struct inode *inode, struct file *filp) - { - struct config_item * item = to_item(filp->f_path.dentry->d_parent); - struct configfs_attribute * attr = to_attr(filp->f_path.dentry); -@@ -303,6 +470,47 @@ static int configfs_release(struct inode * inode, struct file * filp) - return 0; - } - -+static int configfs_open_file(struct inode *inode, struct file *filp) -+{ -+ return check_perm(inode, filp, CONFIGFS_ITEM_ATTR); -+} -+ -+static int configfs_open_bin_file(struct inode *inode, struct file *filp) -+{ -+ return check_perm(inode, filp, CONFIGFS_ITEM_BIN_ATTR); -+} -+ -+static int configfs_release_bin_file(struct inode *inode, struct file *filp) -+{ -+ struct configfs_buffer *buffer = filp->private_data; -+ struct dentry *dentry = filp->f_path.dentry; -+ struct config_item *item = to_item(dentry->d_parent); -+ struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry); -+ ssize_t len = 0; -+ int ret; -+ -+ buffer->read_in_progress = 0; -+ -+ if (buffer->write_in_progress) { -+ buffer->write_in_progress = 0; -+ -+ len = bin_attr->write(item, buffer->bin_buffer, -+ buffer->bin_buffer_size); -+ -+ /* vfree on NULL is safe */ -+ vfree(buffer->bin_buffer); -+ buffer->bin_buffer = NULL; -+ buffer->bin_buffer_size = 0; -+ buffer->needs_read_fill = 1; -+ } -+ -+ ret = configfs_release(inode, filp); -+ if (len < 0) -+ return len; -+ return ret; -+} -+ -+ - const struct file_operations configfs_file_operations = { - .read = configfs_read_file, - .write = configfs_write_file, -@@ -311,6 +519,14 @@ const struct file_operations configfs_file_operations = { - .release = configfs_release, - }; - -+const struct file_operations configfs_bin_file_operations = { -+ .read = configfs_read_bin_file, -+ .write = configfs_write_bin_file, -+ .llseek = NULL, /* bin file is not seekable */ -+ .open = configfs_open_bin_file, -+ .release = configfs_release_bin_file, -+}; -+ - /** - * configfs_create_file - create an attribute file for an item. - * @item: item we're creating for. -@@ -332,3 +548,24 @@ int configfs_create_file(struct config_item * item, const struct configfs_attrib - return error; - } - -+/** -+ * configfs_create_bin_file - create a binary attribute file for an item. -+ * @item: item we're creating for. -+ * @attr: atrribute descriptor. -+ */ -+ -+int configfs_create_bin_file(struct config_item *item, -+ const struct configfs_bin_attribute *bin_attr) -+{ -+ struct dentry *dir = item->ci_dentry; -+ struct configfs_dirent *parent_sd = dir->d_fsdata; -+ umode_t mode = (bin_attr->cb_attr.ca_mode & S_IALLUGO) | S_IFREG; -+ int error = 0; -+ -+ mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_NORMAL); -+ error = configfs_make_dirent(parent_sd, NULL, (void *) bin_attr, mode, -+ CONFIGFS_ITEM_BIN_ATTR); -+ mutex_unlock(&dir->d_inode->i_mutex); -+ -+ return error; -+} -diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c -index eae87575e681..0cc810e9dccc 100644 ---- a/fs/configfs/inode.c -+++ b/fs/configfs/inode.c -@@ -218,7 +218,7 @@ const unsigned char * configfs_get_name(struct configfs_dirent *sd) - if (sd->s_type & (CONFIGFS_DIR | CONFIGFS_ITEM_LINK)) - return sd->s_dentry->d_name.name; - -- if (sd->s_type & CONFIGFS_ITEM_ATTR) { -+ if (sd->s_type & (CONFIGFS_ITEM_ATTR | CONFIGFS_ITEM_BIN_ATTR)) { - attr = sd->s_element; - return attr->ca_name; - } -diff --git a/include/linux/configfs.h b/include/linux/configfs.h -index 758a029011b1..f7300d023dbe 100644 ---- a/include/linux/configfs.h -+++ b/include/linux/configfs.h -@@ -51,6 +51,7 @@ struct module; - struct configfs_item_operations; - struct configfs_group_operations; - struct configfs_attribute; -+struct configfs_bin_attribute; - struct configfs_subsystem; - - struct config_item { -@@ -84,6 +85,7 @@ struct config_item_type { - struct configfs_item_operations *ct_item_ops; - struct configfs_group_operations *ct_group_ops; - struct configfs_attribute **ct_attrs; -+ struct configfs_bin_attribute **ct_bin_attrs; - }; - - /** -@@ -154,6 +156,54 @@ static struct configfs_attribute _pfx##attr_##_name = { \ - .store = _pfx##_name##_store, \ - } - -+struct file; -+struct vm_area_struct; -+ -+struct configfs_bin_attribute { -+ struct configfs_attribute cb_attr; /* std. attribute */ -+ void *cb_private; /* for user */ -+ size_t cb_max_size; /* max core size */ -+ ssize_t (*read)(struct config_item *, void *, size_t); -+ ssize_t (*write)(struct config_item *, const void *, size_t); -+}; -+ -+#define CONFIGFS_BIN_ATTR(_pfx, _name, _priv, _maxsz) \ -+static struct configfs_bin_attribute _pfx##attr_##_name = { \ -+ .cb_attr = { \ -+ .ca_name = __stringify(_name), \ -+ .ca_mode = S_IRUGO | S_IWUSR, \ -+ .ca_owner = THIS_MODULE, \ -+ }, \ -+ .cb_private = _priv, \ -+ .cb_max_size = _maxsz, \ -+ .read = _pfx##_name##_read, \ -+ .write = _pfx##_name##_write, \ -+} -+ -+#define CONFIGFS_BIN_ATTR_RO(_pfx, _name, _priv, _maxsz) \ -+static struct configfs_attribute _pfx##attr_##_name = { \ -+ .cb_attr = { \ -+ .ca_name = __stringify(_name), \ -+ .ca_mode = S_IRUGO, \ -+ .ca_owner = THIS_MODULE, \ -+ }, \ -+ .cb_private = _priv, \ -+ .cb_max_size = _maxsz, \ -+ .read = _pfx##_name##_read, \ -+} -+ -+#define CONFIGFS_BIN_ATTR_WO(_pfx, _name, _priv, _maxsz) \ -+static struct configfs_attribute _pfx##attr_##_name = { \ -+ .cb_attr = { \ -+ .ca_name = __stringify(_name), \ -+ .ca_mode = S_IWUSR, \ -+ .ca_owner = THIS_MODULE, \ -+ }, \ -+ .cb_private = _priv, \ -+ .cb_max_size = _maxsz, \ -+ .write = _pfx##_name##_write, \ -+} -+ - /* - * If allow_link() exists, the item can symlink(2) out to other - * items. If the item is a group, it may support mkdir(2). - -From 5bbcb67edd92f639228cbaf7d597af715442db16 Mon Sep 17 00:00:00 2001 -From: Octavian Purdila -Date: Wed, 23 Mar 2016 14:14:48 +0200 -Subject: [PATCH] UPSTREAM: configfs: fix CONFIGFS_BIN_ATTR_[RW]O definitions - -The type should be struct configfs_bin_attribute and not struct -configfs_attribute. - -Signed-off-by: Octavian Purdila -Signed-off-by: Christoph Hellwig -(cherry picked from commit 96c22a3293512ba684e73a981196430f524689da) ---- - include/linux/configfs.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/include/linux/configfs.h b/include/linux/configfs.h -index f7300d023dbe..658066d63180 100644 ---- a/include/linux/configfs.h -+++ b/include/linux/configfs.h -@@ -181,7 +181,7 @@ static struct configfs_bin_attribute _pfx##attr_##_name = { \ - } - - #define CONFIGFS_BIN_ATTR_RO(_pfx, _name, _priv, _maxsz) \ --static struct configfs_attribute _pfx##attr_##_name = { \ -+static struct configfs_bin_attribute _pfx##attr_##_name = { \ - .cb_attr = { \ - .ca_name = __stringify(_name), \ - .ca_mode = S_IRUGO, \ -@@ -193,7 +193,7 @@ static struct configfs_attribute _pfx##attr_##_name = { \ - } - - #define CONFIGFS_BIN_ATTR_WO(_pfx, _name, _priv, _maxsz) \ --static struct configfs_attribute _pfx##attr_##_name = { \ -+static struct configfs_bin_attribute _pfx##attr_##_name = { \ - .cb_attr = { \ - .ca_name = __stringify(_name), \ - .ca_mode = S_IWUSR, \ - -From 34d6438a4d2cedcd1b47f55a3cc63374252c6682 Mon Sep 17 00:00:00 2001 -From: Pantelis Antoniou -Date: Wed, 4 Dec 2013 19:32:00 +0200 -Subject: [PATCH] FROMLIST: OF: DT-Overlay configfs interface (v7) - -Add a runtime interface to using configfs for generic device tree overlay -usage. With it its possible to use device tree overlays without having -to use a per-platform overlay manager. - -Please see Documentation/devicetree/configfs-overlays.txt for more info. - -Changes since v6: -- Default groups properties API changed. - -Changes since v5: -- New style configfs. - -Changes since v4: -- Loading fix for multiple overlays as found out by - Geert Uytterhoeven - -Changes since v3: -- Fixed compilation on SPARC & Xtensa - -Changes since v2: -- Removed ifdef CONFIG_OF_OVERLAY (since for now it's required) -- Created a documentation entry -- Slight rewording in Kconfig - -Changes since v1: -- of_resolve() -> of_resolve_phandles(). - -Signed-off-by: Pantelis Antoniou -[geert: Use %zu to format size_t] -[geert: Let OF_CONFIGFS select OF_FLATTREE to fix sparc all*config] -Signed-off-by: Geert Uytterhoeven ---- - Documentation/devicetree/configfs-overlays.txt | 31 +++ - drivers/of/Kconfig | 8 + - drivers/of/Makefile | 1 + - drivers/of/configfs.c | 314 +++++++++++++++++++++++++ - 4 files changed, 354 insertions(+) - create mode 100644 Documentation/devicetree/configfs-overlays.txt - create mode 100644 drivers/of/configfs.c - -diff --git a/Documentation/devicetree/configfs-overlays.txt b/Documentation/devicetree/configfs-overlays.txt -new file mode 100644 -index 000000000000..5fa43e064307 ---- /dev/null -+++ b/Documentation/devicetree/configfs-overlays.txt -@@ -0,0 +1,31 @@ -+Howto use the configfs overlay interface. -+ -+A device-tree configfs entry is created in /config/device-tree/overlays -+and and it is manipulated using standard file system I/O. -+Note that this is a debug level interface, for use by developers and -+not necessarily something accessed by normal users due to the -+security implications of having direct access to the kernel's device tree. -+ -+* To create an overlay you mkdir the directory: -+ -+ # mkdir /config/device-tree/overlays/foo -+ -+* Either you echo the overlay firmware file to the path property file. -+ -+ # echo foo.dtbo >/config/device-tree/overlays/foo/path -+ -+* Or you cat the contents of the overlay to the dtbo file -+ -+ # cat foo.dtbo >/config/device-tree/overlays/foo/dtbo -+ -+The overlay file will be applied, and devices will be created/destroyed -+as required. -+ -+To remove it simply rmdir the directory. -+ -+ # rmdir /config/device-tree/overlays/foo -+ -+The rationalle of the dual interface (firmware & direct copy) is that each is -+better suited to different use patterns. The firmware interface is what's -+intended to be used by hardware managers in the kernel, while the copy interface -+make sense for developers (since it avoids problems with namespaces). -diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig -index e2a48415d969..c112c9f2ca6b 100644 ---- a/drivers/of/Kconfig -+++ b/drivers/of/Kconfig -@@ -112,4 +112,12 @@ config OF_OVERLAY - While this option is selected automatically when needed, you can - enable it manually to improve device tree unit test coverage. - -+config OF_CONFIGFS -+ bool "Device Tree Overlay ConfigFS interface" -+ select CONFIGFS_FS -+ select OF_FLATTREE -+ depends on OF_OVERLAY -+ help -+ Enable a simple user-space driven DT overlay interface. -+ - endif # OF -diff --git a/drivers/of/Makefile b/drivers/of/Makefile -index 478d4edcd763..732fa66b5263 100644 ---- a/drivers/of/Makefile -+++ b/drivers/of/Makefile -@@ -1,4 +1,5 @@ - obj-y = base.o device.o platform.o property.o -+obj-$(CONFIG_OF_CONFIGFS) += configfs.o - obj-$(CONFIG_OF_DYNAMIC) += dynamic.o - obj-$(CONFIG_OF_FLATTREE) += fdt.o - obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o -diff --git a/drivers/of/configfs.c b/drivers/of/configfs.c -new file mode 100644 -index 000000000000..908ce4960c30 ---- /dev/null -+++ b/drivers/of/configfs.c -@@ -0,0 +1,314 @@ -+/* -+ * Configfs entries for device-tree -+ * -+ * Copyright (C) 2013 - Pantelis Antoniou -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public License -+ * as published by the Free Software Foundation; either version -+ * 2 of the License, or (at your option) any later version. -+ */ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "of_private.h" -+ -+struct cfs_overlay_item { -+ struct config_item item; -+ -+ char path[PATH_MAX]; -+ -+ const struct firmware *fw; -+ struct device_node *overlay; -+ int ov_id; -+ -+ void *dtbo; -+ int dtbo_size; -+}; -+ -+static int create_overlay(struct cfs_overlay_item *overlay, void *blob) -+{ -+ int err; -+ -+ /* unflatten the tree */ -+ of_fdt_unflatten_tree(blob, &overlay->overlay); -+ if (overlay->overlay == NULL) { -+ pr_err("%s: failed to unflatten tree\n", __func__); -+ err = -EINVAL; -+ goto out_err; -+ } -+ pr_debug("%s: unflattened OK\n", __func__); -+ -+ /* mark it as detached */ -+ of_node_set_flag(overlay->overlay, OF_DETACHED); -+ -+ /* perform resolution */ -+ err = of_resolve_phandles(overlay->overlay); -+ if (err != 0) { -+ pr_err("%s: Failed to resolve tree\n", __func__); -+ goto out_err; -+ } -+ pr_debug("%s: resolved OK\n", __func__); -+ -+ err = of_overlay_create(overlay->overlay); -+ if (err < 0) { -+ pr_err("%s: Failed to create overlay (err=%d)\n", -+ __func__, err); -+ goto out_err; -+ } -+ overlay->ov_id = err; -+ -+out_err: -+ return err; -+} -+ -+static inline struct cfs_overlay_item *to_cfs_overlay_item( -+ struct config_item *item) -+{ -+ return item ? container_of(item, struct cfs_overlay_item, item) : NULL; -+} -+ -+static ssize_t cfs_overlay_item_path_show(struct config_item *item, -+ char *page) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ return sprintf(page, "%s\n", overlay->path); -+} -+ -+static ssize_t cfs_overlay_item_path_store(struct config_item *item, -+ const char *page, size_t count) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ const char *p = page; -+ char *s; -+ int err; -+ -+ /* if it's set do not allow changes */ -+ if (overlay->path[0] != '\0' || overlay->dtbo_size > 0) -+ return -EPERM; -+ -+ /* copy to path buffer (and make sure it's always zero terminated */ -+ count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p); -+ overlay->path[sizeof(overlay->path) - 1] = '\0'; -+ -+ /* strip trailing newlines */ -+ s = overlay->path + strlen(overlay->path); -+ while (s > overlay->path && *--s == '\n') -+ *s = '\0'; -+ -+ pr_debug("%s: path is '%s'\n", __func__, overlay->path); -+ -+ err = request_firmware(&overlay->fw, overlay->path, NULL); -+ if (err != 0) -+ goto out_err; -+ -+ err = create_overlay(overlay, (void *)overlay->fw->data); -+ if (err < 0) -+ goto out_err; -+ -+ return count; -+ -+out_err: -+ -+ release_firmware(overlay->fw); -+ overlay->fw = NULL; -+ -+ overlay->path[0] = '\0'; -+ return err; -+} -+ -+static ssize_t cfs_overlay_item_status_show(struct config_item *item, -+ char *page) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ -+ return sprintf(page, "%s\n", -+ overlay->ov_id >= 0 ? "applied" : "unapplied"); -+} -+ -+CONFIGFS_ATTR(cfs_overlay_item_, path); -+CONFIGFS_ATTR_RO(cfs_overlay_item_, status); -+ -+static struct configfs_attribute *cfs_overlay_attrs[] = { -+ &cfs_overlay_item_attr_path, -+ &cfs_overlay_item_attr_status, -+ NULL, -+}; -+ -+ssize_t cfs_overlay_item_dtbo_read(struct config_item *item, -+ void *buf, size_t max_count) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ -+ pr_debug("%s: buf=%p max_count=%zu\n", __func__, -+ buf, max_count); -+ -+ if (overlay->dtbo == NULL) -+ return 0; -+ -+ /* copy if buffer provided */ -+ if (buf != NULL) { -+ /* the buffer must be large enough */ -+ if (overlay->dtbo_size > max_count) -+ return -ENOSPC; -+ -+ memcpy(buf, overlay->dtbo, overlay->dtbo_size); -+ } -+ -+ return overlay->dtbo_size; -+} -+ -+ssize_t cfs_overlay_item_dtbo_write(struct config_item *item, -+ const void *buf, size_t count) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ int err; -+ -+ /* if it's set do not allow changes */ -+ if (overlay->path[0] != '\0' || overlay->dtbo_size > 0) -+ return -EPERM; -+ -+ /* copy the contents */ -+ overlay->dtbo = kmemdup(buf, count, GFP_KERNEL); -+ if (overlay->dtbo == NULL) -+ return -ENOMEM; -+ -+ overlay->dtbo_size = count; -+ -+ err = create_overlay(overlay, overlay->dtbo); -+ if (err < 0) -+ goto out_err; -+ -+ return count; -+ -+out_err: -+ kfree(overlay->dtbo); -+ overlay->dtbo = NULL; -+ overlay->dtbo_size = 0; -+ -+ return err; -+} -+ -+CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M); -+ -+static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = { -+ &cfs_overlay_item_attr_dtbo, -+ NULL, -+}; -+ -+static void cfs_overlay_release(struct config_item *item) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ -+ if (overlay->ov_id >= 0) -+ of_overlay_destroy(overlay->ov_id); -+ if (overlay->fw) -+ release_firmware(overlay->fw); -+ /* kfree with NULL is safe */ -+ kfree(overlay->dtbo); -+ kfree(overlay); -+} -+ -+static struct configfs_item_operations cfs_overlay_item_ops = { -+ .release = cfs_overlay_release, -+}; -+ -+static struct config_item_type cfs_overlay_type = { -+ .ct_item_ops = &cfs_overlay_item_ops, -+ .ct_attrs = cfs_overlay_attrs, -+ .ct_bin_attrs = cfs_overlay_bin_attrs, -+ .ct_owner = THIS_MODULE, -+}; -+ -+static struct config_item *cfs_overlay_group_make_item( -+ struct config_group *group, const char *name) -+{ -+ struct cfs_overlay_item *overlay; -+ -+ overlay = kzalloc(sizeof(*overlay), GFP_KERNEL); -+ if (!overlay) -+ return ERR_PTR(-ENOMEM); -+ overlay->ov_id = -1; -+ -+ config_item_init_type_name(&overlay->item, name, &cfs_overlay_type); -+ return &overlay->item; -+} -+ -+static void cfs_overlay_group_drop_item(struct config_group *group, -+ struct config_item *item) -+{ -+ struct cfs_overlay_item *overlay = to_cfs_overlay_item(item); -+ -+ config_item_put(&overlay->item); -+} -+ -+static struct configfs_group_operations overlays_ops = { -+ .make_item = cfs_overlay_group_make_item, -+ .drop_item = cfs_overlay_group_drop_item, -+}; -+ -+static struct config_item_type overlays_type = { -+ .ct_group_ops = &overlays_ops, -+ .ct_owner = THIS_MODULE, -+}; -+ -+static struct configfs_group_operations of_cfs_ops = { -+ /* empty - we don't allow anything to be created */ -+}; -+ -+static struct config_item_type of_cfs_type = { -+ .ct_group_ops = &of_cfs_ops, -+ .ct_owner = THIS_MODULE, -+}; -+ -+struct config_group of_cfs_overlay_group; -+ -+struct config_group *of_cfs_def_groups[] = { -+ &of_cfs_overlay_group, -+ NULL -+}; -+ -+static struct configfs_subsystem of_cfs_subsys = { -+ .su_group = { -+ .cg_item = { -+ .ci_namebuf = "device-tree", -+ .ci_type = &of_cfs_type, -+ }, -+ .default_groups = of_cfs_def_groups, -+ }, -+ .su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex), -+}; -+ -+static int __init of_cfs_init(void) -+{ -+ int ret; -+ -+ pr_info("%s\n", __func__); -+ -+ config_group_init(&of_cfs_subsys.su_group); -+ config_group_init_type_name(&of_cfs_overlay_group, "overlays", -+ &overlays_type); -+ -+ ret = configfs_register_subsystem(&of_cfs_subsys); -+ if (ret != 0) { -+ pr_err("%s: failed to register subsys\n", __func__); -+ goto out; -+ } -+ pr_info("%s: OK\n", __func__); -+out: -+ return ret; -+} -+late_initcall(of_cfs_init); diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0008-mmc-pwrseq.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0008-mmc-pwrseq.patch deleted file mode 100644 index 2eb189826fc7..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0008-mmc-pwrseq.patch +++ /dev/null @@ -1,949 +0,0 @@ -From 75bb99dc815464846a4add357494acf04212271d Mon Sep 17 00:00:00 2001 -From: Julia Lawall -Date: Sat, 14 Nov 2015 18:05:20 +0100 -Subject: [PATCH] UPSTREAM: mmc: pwrseq: constify mmc_pwrseq_ops structures - -The mmc_pwrseq_ops structures are never modified, so declare them as const. - -Done with the help of Coccinelle. - -Signed-off-by: Julia Lawall -Signed-off-by: Ulf Hansson -(cherry picked from commit ffedbd2210f2f4cba490a9205adc11fd1b89a852) ---- - drivers/mmc/core/pwrseq.h | 2 +- - drivers/mmc/core/pwrseq_emmc.c | 2 +- - drivers/mmc/core/pwrseq_simple.c | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/mmc/core/pwrseq.h b/drivers/mmc/core/pwrseq.h -index 096da48c6a7e..133de0426687 100644 ---- a/drivers/mmc/core/pwrseq.h -+++ b/drivers/mmc/core/pwrseq.h -@@ -16,7 +16,7 @@ struct mmc_pwrseq_ops { - }; - - struct mmc_pwrseq { -- struct mmc_pwrseq_ops *ops; -+ const struct mmc_pwrseq_ops *ops; - }; - - #ifdef CONFIG_OF -diff --git a/drivers/mmc/core/pwrseq_emmc.c b/drivers/mmc/core/pwrseq_emmc.c -index ad4f94ec7e8d..4a82bc77fe49 100644 ---- a/drivers/mmc/core/pwrseq_emmc.c -+++ b/drivers/mmc/core/pwrseq_emmc.c -@@ -51,7 +51,7 @@ static void mmc_pwrseq_emmc_free(struct mmc_host *host) - kfree(pwrseq); - } - --static struct mmc_pwrseq_ops mmc_pwrseq_emmc_ops = { -+static const struct mmc_pwrseq_ops mmc_pwrseq_emmc_ops = { - .post_power_on = mmc_pwrseq_emmc_reset, - .free = mmc_pwrseq_emmc_free, - }; -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index d10538bb5e07..2b16263458af 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -87,7 +87,7 @@ static void mmc_pwrseq_simple_free(struct mmc_host *host) - kfree(pwrseq); - } - --static struct mmc_pwrseq_ops mmc_pwrseq_simple_ops = { -+static const struct mmc_pwrseq_ops mmc_pwrseq_simple_ops = { - .pre_power_on = mmc_pwrseq_simple_pre_power_on, - .post_power_on = mmc_pwrseq_simple_post_power_on, - .power_off = mmc_pwrseq_simple_power_off, - -From 1977551c6ef29f55b398a02112e3075c9a38649d Mon Sep 17 00:00:00 2001 -From: Martin Fuzzey -Date: Wed, 20 Jan 2016 16:08:03 +0100 -Subject: [PATCH] UPSTREAM: mmc: pwrseq_simple: Make reset-gpios optional to - match doc - -The DT binding doc says reset-gpios is an optional property but the code -currently bails out if it is omitted. - -This is a regression since it breaks previously working device trees. -Fix it by restoring the original documented behaviour. - -Fixes: ce037275861e ("mmc: pwrseq_simple: use GPIO descriptors array API") -Tested-by: Tony Lindgren -Signed-off-by: Martin Fuzzey -Signed-off-by: Ulf Hansson -(cherry picked from commit 64a67d4762ce3ce4c9466eadd152d825fbf84967) ---- - drivers/mmc/core/pwrseq_simple.c | 22 ++++++++++++++-------- - 1 file changed, 14 insertions(+), 8 deletions(-) - -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index 2b16263458af..aba786daebca 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -29,15 +29,18 @@ struct mmc_pwrseq_simple { - static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple *pwrseq, - int value) - { -- int i; - struct gpio_descs *reset_gpios = pwrseq->reset_gpios; -- int values[reset_gpios->ndescs]; - -- for (i = 0; i < reset_gpios->ndescs; i++) -- values[i] = value; -+ if (!IS_ERR(reset_gpios)) { -+ int i; -+ int values[reset_gpios->ndescs]; - -- gpiod_set_array_value_cansleep(reset_gpios->ndescs, reset_gpios->desc, -- values); -+ for (i = 0; i < reset_gpios->ndescs; i++) -+ values[i] = value; -+ -+ gpiod_set_array_value_cansleep( -+ reset_gpios->ndescs, reset_gpios->desc, values); -+ } - } - - static void mmc_pwrseq_simple_pre_power_on(struct mmc_host *host) -@@ -79,7 +82,8 @@ static void mmc_pwrseq_simple_free(struct mmc_host *host) - struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq, - struct mmc_pwrseq_simple, pwrseq); - -- gpiod_put_array(pwrseq->reset_gpios); -+ if (!IS_ERR(pwrseq->reset_gpios)) -+ gpiod_put_array(pwrseq->reset_gpios); - - if (!IS_ERR(pwrseq->ext_clk)) - clk_put(pwrseq->ext_clk); -@@ -112,7 +116,9 @@ struct mmc_pwrseq *mmc_pwrseq_simple_alloc(struct mmc_host *host, - } - - pwrseq->reset_gpios = gpiod_get_array(dev, "reset", GPIOD_OUT_HIGH); -- if (IS_ERR(pwrseq->reset_gpios)) { -+ if (IS_ERR(pwrseq->reset_gpios) && -+ PTR_ERR(pwrseq->reset_gpios) != -ENOENT && -+ PTR_ERR(pwrseq->reset_gpios) != -ENOSYS) { - ret = PTR_ERR(pwrseq->reset_gpios); - goto clk_put; - } - -From e79ed0004dc68dc2f2189256bf00a1f579c78f1a Mon Sep 17 00:00:00 2001 -From: Peter Chen -Date: Wed, 6 Jan 2016 11:34:10 +0800 -Subject: [PATCH] UPSTREAM: mmc: core: pwrseq_simple: remove unused header file - -Signed-off-by: Peter Chen -Signed-off-by: Ulf Hansson -(cherry picked from commit 62c03ca3ffa1ddf55a66411be02f7e4678771fce) ---- - drivers/mmc/core/pwrseq_simple.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index aba786daebca..bc173e18b71c 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -12,7 +12,6 @@ - #include - #include - #include --#include - #include - - #include - -From 545d059f7a0a4c470acfdb0fff30397899597f09 Mon Sep 17 00:00:00 2001 -From: Srinivas Kandagatla -Date: Thu, 14 Apr 2016 14:02:14 +0100 -Subject: [PATCH] UPSTREAM: mmc: pwrseq_simple: add to_pwrseq_simple() macro - -This patch adds to_pwrseq_simple() macro to make the code more readable. - -Signed-off-by: Srinivas Kandagatla -Signed-off-by: Ulf Hansson -(cherry picked from commit 5b96fea730ab79bdf6f8071cadf8208296bf5e8d) ---- - drivers/mmc/core/pwrseq_simple.c | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index bc173e18b71c..f94271bb1f6b 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -25,6 +25,8 @@ struct mmc_pwrseq_simple { - struct gpio_descs *reset_gpios; - }; - -+#define to_pwrseq_simple(p) container_of(p, struct mmc_pwrseq_simple, pwrseq) -+ - static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple *pwrseq, - int value) - { -@@ -44,8 +46,7 @@ static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple *pwrseq, - - static void mmc_pwrseq_simple_pre_power_on(struct mmc_host *host) - { -- struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_simple, pwrseq); -+ struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); - - if (!IS_ERR(pwrseq->ext_clk) && !pwrseq->clk_enabled) { - clk_prepare_enable(pwrseq->ext_clk); -@@ -57,16 +58,14 @@ static void mmc_pwrseq_simple_pre_power_on(struct mmc_host *host) - - static void mmc_pwrseq_simple_post_power_on(struct mmc_host *host) - { -- struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_simple, pwrseq); -+ struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); - - mmc_pwrseq_simple_set_gpios_value(pwrseq, 0); - } - - static void mmc_pwrseq_simple_power_off(struct mmc_host *host) - { -- struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_simple, pwrseq); -+ struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); - - mmc_pwrseq_simple_set_gpios_value(pwrseq, 1); - -@@ -78,8 +77,7 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host) - - static void mmc_pwrseq_simple_free(struct mmc_host *host) - { -- struct mmc_pwrseq_simple *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_simple, pwrseq); -+ struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); - - if (!IS_ERR(pwrseq->reset_gpios)) - gpiod_put_array(pwrseq->reset_gpios); - -From e8c5f0b9383e6a528c8fc00d61755f8187e4c0b8 Mon Sep 17 00:00:00 2001 -From: Srinivas Kandagatla -Date: Thu, 14 Apr 2016 14:02:15 +0100 -Subject: [PATCH] UPSTREAM: mmc: pwrseq_emmc: add to_pwrseq_emmc() macro - -This patch adds to_pwrseq_emmc() macro to make the code more readable. - -Signed-off-by: Srinivas Kandagatla -Signed-off-by: Ulf Hansson -(cherry picked from commit f01b72d0fd53b61cafd25b16d15e18b1ef8ae065) ---- - drivers/mmc/core/pwrseq_emmc.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/drivers/mmc/core/pwrseq_emmc.c b/drivers/mmc/core/pwrseq_emmc.c -index 4a82bc77fe49..c2d732aa464c 100644 ---- a/drivers/mmc/core/pwrseq_emmc.c -+++ b/drivers/mmc/core/pwrseq_emmc.c -@@ -25,6 +25,8 @@ struct mmc_pwrseq_emmc { - struct gpio_desc *reset_gpio; - }; - -+#define to_pwrseq_emmc(p) container_of(p, struct mmc_pwrseq_emmc, pwrseq) -+ - static void __mmc_pwrseq_emmc_reset(struct mmc_pwrseq_emmc *pwrseq) - { - gpiod_set_value(pwrseq->reset_gpio, 1); -@@ -35,16 +37,14 @@ static void __mmc_pwrseq_emmc_reset(struct mmc_pwrseq_emmc *pwrseq) - - static void mmc_pwrseq_emmc_reset(struct mmc_host *host) - { -- struct mmc_pwrseq_emmc *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_emmc, pwrseq); -+ struct mmc_pwrseq_emmc *pwrseq = to_pwrseq_emmc(host->pwrseq); - - __mmc_pwrseq_emmc_reset(pwrseq); - } - - static void mmc_pwrseq_emmc_free(struct mmc_host *host) - { -- struct mmc_pwrseq_emmc *pwrseq = container_of(host->pwrseq, -- struct mmc_pwrseq_emmc, pwrseq); -+ struct mmc_pwrseq_emmc *pwrseq = to_pwrseq_emmc(host->pwrseq); - - unregister_restart_handler(&pwrseq->reset_nb); - gpiod_put(pwrseq->reset_gpio); - -From ef2f3c5b7375b930697a64c85f30f9109e631cb0 Mon Sep 17 00:00:00 2001 -From: Srinivas Kandagatla -Date: Thu, 14 Apr 2016 14:02:16 +0100 -Subject: [PATCH] UPSTREAM: mmc: pwrseq: convert to proper platform device - -simple-pwrseq and emmc-pwrseq drivers rely on platform_device -structure from of_find_device_by_node(), this works mostly. But, as there -is no driver associated with this devices, cases like default/init pinctrl -setup would never be performed by pwrseq. This becomes problem when the -gpios used in pwrseq require pinctrl setup. - -Currently most of the common pinctrl setup is done in -drivers/base/pinctrl.c by pinctrl_bind_pins(). - -There are two ways to solve this issue on either convert pwrseq drivers -to a proper platform drivers or copy the exact code from -pcintrl_bind_pins(). I prefer converting pwrseq to proper drivers so that -other cases like setting up clks/parents from dt would also be possible. - -Signed-off-by: Srinivas Kandagatla -Signed-off-by: Ulf Hansson -(cherry picked from commit d97a1e5d7cd2b5b0edc02a40fe6897b710c9e10f) ---- - drivers/mmc/core/Kconfig | 22 ++++++++ - drivers/mmc/core/Makefile | 4 +- - drivers/mmc/core/pwrseq.c | 108 ++++++++++++++++++--------------------- - drivers/mmc/core/pwrseq.h | 19 ++++--- - drivers/mmc/core/pwrseq_emmc.c | 75 +++++++++++++++++---------- - drivers/mmc/core/pwrseq_simple.c | 79 +++++++++++++++------------- - 6 files changed, 178 insertions(+), 129 deletions(-) - -diff --git a/drivers/mmc/core/Kconfig b/drivers/mmc/core/Kconfig -index 87cc07dedd9f..00dfaea06003 100644 ---- a/drivers/mmc/core/Kconfig -+++ b/drivers/mmc/core/Kconfig -@@ -16,3 +16,25 @@ config MMC_PARANOID_SD_INIT - about re-trying SD init requests. This can be a useful - work-around for buggy controllers and hardware. Enable - if you are experiencing issues with SD detection. -+ -+config PWRSEQ_EMMC -+ tristate "HW reset support for eMMC" -+ default y -+ depends on OF -+ help -+ This selects Hardware reset support aka pwrseq-emmc for eMMC -+ devices. By default this option is set to y. -+ -+ This driver can also be built as a module. If so, the module -+ will be called pwrseq_emmc. -+ -+config PWRSEQ_SIMPLE -+ tristate "Simple HW reset support for MMC" -+ default y -+ depends on OF -+ help -+ This selects simple hardware reset support aka pwrseq-simple for MMC -+ devices. By default this option is set to y. -+ -+ This driver can also be built as a module. If so, the module -+ will be called pwrseq_simple. -diff --git a/drivers/mmc/core/Makefile b/drivers/mmc/core/Makefile -index 2c25138f28b7..f007151dfdc6 100644 ---- a/drivers/mmc/core/Makefile -+++ b/drivers/mmc/core/Makefile -@@ -8,5 +8,7 @@ mmc_core-y := core.o bus.o host.o \ - sdio.o sdio_ops.o sdio_bus.o \ - sdio_cis.o sdio_io.o sdio_irq.o \ - quirks.o slot-gpio.o --mmc_core-$(CONFIG_OF) += pwrseq.o pwrseq_simple.o pwrseq_emmc.o -+mmc_core-$(CONFIG_OF) += pwrseq.o -+obj-$(CONFIG_PWRSEQ_SIMPLE) += pwrseq_simple.o -+obj-$(CONFIG_PWRSEQ_EMMC) += pwrseq_emmc.o - mmc_core-$(CONFIG_DEBUG_FS) += debugfs.o -diff --git a/drivers/mmc/core/pwrseq.c b/drivers/mmc/core/pwrseq.c -index 4c1d1757dbf9..9386c4771814 100644 ---- a/drivers/mmc/core/pwrseq.c -+++ b/drivers/mmc/core/pwrseq.c -@@ -8,88 +8,55 @@ - * MMC power sequence management - */ - #include --#include - #include -+#include - #include --#include - - #include - - #include "pwrseq.h" - --struct mmc_pwrseq_match { -- const char *compatible; -- struct mmc_pwrseq *(*alloc)(struct mmc_host *host, struct device *dev); --}; -- --static struct mmc_pwrseq_match pwrseq_match[] = { -- { -- .compatible = "mmc-pwrseq-simple", -- .alloc = mmc_pwrseq_simple_alloc, -- }, { -- .compatible = "mmc-pwrseq-emmc", -- .alloc = mmc_pwrseq_emmc_alloc, -- }, --}; -- --static struct mmc_pwrseq_match *mmc_pwrseq_find(struct device_node *np) --{ -- struct mmc_pwrseq_match *match = ERR_PTR(-ENODEV); -- int i; -- -- for (i = 0; i < ARRAY_SIZE(pwrseq_match); i++) { -- if (of_device_is_compatible(np, pwrseq_match[i].compatible)) { -- match = &pwrseq_match[i]; -- break; -- } -- } -- -- return match; --} -+static DEFINE_MUTEX(pwrseq_list_mutex); -+static LIST_HEAD(pwrseq_list); - - int mmc_pwrseq_alloc(struct mmc_host *host) - { -- struct platform_device *pdev; - struct device_node *np; -- struct mmc_pwrseq_match *match; -- struct mmc_pwrseq *pwrseq; -- int ret = 0; -+ struct mmc_pwrseq *p; - - np = of_parse_phandle(host->parent->of_node, "mmc-pwrseq", 0); - if (!np) - return 0; - -- pdev = of_find_device_by_node(np); -- if (!pdev) { -- ret = -ENODEV; -- goto err; -- } -+ mutex_lock(&pwrseq_list_mutex); -+ list_for_each_entry(p, &pwrseq_list, pwrseq_node) { -+ if (p->dev->of_node == np) { -+ if (!try_module_get(p->owner)) -+ dev_err(host->parent, -+ "increasing module refcount failed\n"); -+ else -+ host->pwrseq = p; - -- match = mmc_pwrseq_find(np); -- if (IS_ERR(match)) { -- ret = PTR_ERR(match); -- goto err; -+ break; -+ } - } - -- pwrseq = match->alloc(host, &pdev->dev); -- if (IS_ERR(pwrseq)) { -- ret = PTR_ERR(pwrseq); -- goto err; -- } -+ of_node_put(np); -+ mutex_unlock(&pwrseq_list_mutex); -+ -+ if (!host->pwrseq) -+ return -EPROBE_DEFER; - -- host->pwrseq = pwrseq; - dev_info(host->parent, "allocated mmc-pwrseq\n"); - --err: -- of_node_put(np); -- return ret; -+ return 0; - } - - void mmc_pwrseq_pre_power_on(struct mmc_host *host) - { - struct mmc_pwrseq *pwrseq = host->pwrseq; - -- if (pwrseq && pwrseq->ops && pwrseq->ops->pre_power_on) -+ if (pwrseq && pwrseq->ops->pre_power_on) - pwrseq->ops->pre_power_on(host); - } - -@@ -97,7 +64,7 @@ void mmc_pwrseq_post_power_on(struct mmc_host *host) - { - struct mmc_pwrseq *pwrseq = host->pwrseq; - -- if (pwrseq && pwrseq->ops && pwrseq->ops->post_power_on) -+ if (pwrseq && pwrseq->ops->post_power_on) - pwrseq->ops->post_power_on(host); - } - -@@ -105,7 +72,7 @@ void mmc_pwrseq_power_off(struct mmc_host *host) - { - struct mmc_pwrseq *pwrseq = host->pwrseq; - -- if (pwrseq && pwrseq->ops && pwrseq->ops->power_off) -+ if (pwrseq && pwrseq->ops->power_off) - pwrseq->ops->power_off(host); - } - -@@ -113,8 +80,31 @@ void mmc_pwrseq_free(struct mmc_host *host) - { - struct mmc_pwrseq *pwrseq = host->pwrseq; - -- if (pwrseq && pwrseq->ops && pwrseq->ops->free) -- pwrseq->ops->free(host); -+ if (pwrseq) { -+ module_put(pwrseq->owner); -+ host->pwrseq = NULL; -+ } -+} -+ -+int mmc_pwrseq_register(struct mmc_pwrseq *pwrseq) -+{ -+ if (!pwrseq || !pwrseq->ops || !pwrseq->dev) -+ return -EINVAL; - -- host->pwrseq = NULL; -+ mutex_lock(&pwrseq_list_mutex); -+ list_add(&pwrseq->pwrseq_node, &pwrseq_list); -+ mutex_unlock(&pwrseq_list_mutex); -+ -+ return 0; -+} -+EXPORT_SYMBOL_GPL(mmc_pwrseq_register); -+ -+void mmc_pwrseq_unregister(struct mmc_pwrseq *pwrseq) -+{ -+ if (pwrseq) { -+ mutex_lock(&pwrseq_list_mutex); -+ list_del(&pwrseq->pwrseq_node); -+ mutex_unlock(&pwrseq_list_mutex); -+ } - } -+EXPORT_SYMBOL_GPL(mmc_pwrseq_unregister); -diff --git a/drivers/mmc/core/pwrseq.h b/drivers/mmc/core/pwrseq.h -index 133de0426687..d69e751f148b 100644 ---- a/drivers/mmc/core/pwrseq.h -+++ b/drivers/mmc/core/pwrseq.h -@@ -8,32 +8,39 @@ - #ifndef _MMC_CORE_PWRSEQ_H - #define _MMC_CORE_PWRSEQ_H - -+#include -+ - struct mmc_pwrseq_ops { - void (*pre_power_on)(struct mmc_host *host); - void (*post_power_on)(struct mmc_host *host); - void (*power_off)(struct mmc_host *host); -- void (*free)(struct mmc_host *host); - }; - - struct mmc_pwrseq { - const struct mmc_pwrseq_ops *ops; -+ struct device *dev; -+ struct list_head pwrseq_node; -+ struct module *owner; - }; - - #ifdef CONFIG_OF - -+int mmc_pwrseq_register(struct mmc_pwrseq *pwrseq); -+void mmc_pwrseq_unregister(struct mmc_pwrseq *pwrseq); -+ - int mmc_pwrseq_alloc(struct mmc_host *host); - void mmc_pwrseq_pre_power_on(struct mmc_host *host); - void mmc_pwrseq_post_power_on(struct mmc_host *host); - void mmc_pwrseq_power_off(struct mmc_host *host); - void mmc_pwrseq_free(struct mmc_host *host); - --struct mmc_pwrseq *mmc_pwrseq_simple_alloc(struct mmc_host *host, -- struct device *dev); --struct mmc_pwrseq *mmc_pwrseq_emmc_alloc(struct mmc_host *host, -- struct device *dev); -- - #else - -+static inline int mmc_pwrseq_register(struct mmc_pwrseq *pwrseq) -+{ -+ return -ENOSYS; -+} -+static inline void mmc_pwrseq_unregister(struct mmc_pwrseq *pwrseq) {} - static inline int mmc_pwrseq_alloc(struct mmc_host *host) { return 0; } - static inline void mmc_pwrseq_pre_power_on(struct mmc_host *host) {} - static inline void mmc_pwrseq_post_power_on(struct mmc_host *host) {} -diff --git a/drivers/mmc/core/pwrseq_emmc.c b/drivers/mmc/core/pwrseq_emmc.c -index c2d732aa464c..adc9c0c614fb 100644 ---- a/drivers/mmc/core/pwrseq_emmc.c -+++ b/drivers/mmc/core/pwrseq_emmc.c -@@ -9,6 +9,9 @@ - */ - #include - #include -+#include -+#include -+#include - #include - #include - #include -@@ -42,20 +45,6 @@ static void mmc_pwrseq_emmc_reset(struct mmc_host *host) - __mmc_pwrseq_emmc_reset(pwrseq); - } - --static void mmc_pwrseq_emmc_free(struct mmc_host *host) --{ -- struct mmc_pwrseq_emmc *pwrseq = to_pwrseq_emmc(host->pwrseq); -- -- unregister_restart_handler(&pwrseq->reset_nb); -- gpiod_put(pwrseq->reset_gpio); -- kfree(pwrseq); --} -- --static const struct mmc_pwrseq_ops mmc_pwrseq_emmc_ops = { -- .post_power_on = mmc_pwrseq_emmc_reset, -- .free = mmc_pwrseq_emmc_free, --}; -- - static int mmc_pwrseq_emmc_reset_nb(struct notifier_block *this, - unsigned long mode, void *cmd) - { -@@ -66,21 +55,22 @@ static int mmc_pwrseq_emmc_reset_nb(struct notifier_block *this, - return NOTIFY_DONE; - } - --struct mmc_pwrseq *mmc_pwrseq_emmc_alloc(struct mmc_host *host, -- struct device *dev) -+static const struct mmc_pwrseq_ops mmc_pwrseq_emmc_ops = { -+ .post_power_on = mmc_pwrseq_emmc_reset, -+}; -+ -+static int mmc_pwrseq_emmc_probe(struct platform_device *pdev) - { - struct mmc_pwrseq_emmc *pwrseq; -- int ret = 0; -+ struct device *dev = &pdev->dev; - -- pwrseq = kzalloc(sizeof(struct mmc_pwrseq_emmc), GFP_KERNEL); -+ pwrseq = devm_kzalloc(dev, sizeof(*pwrseq), GFP_KERNEL); - if (!pwrseq) -- return ERR_PTR(-ENOMEM); -+ return -ENOMEM; - -- pwrseq->reset_gpio = gpiod_get(dev, "reset", GPIOD_OUT_LOW); -- if (IS_ERR(pwrseq->reset_gpio)) { -- ret = PTR_ERR(pwrseq->reset_gpio); -- goto free; -- } -+ pwrseq->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); -+ if (IS_ERR(pwrseq->reset_gpio)) -+ return PTR_ERR(pwrseq->reset_gpio); - - /* - * register reset handler to ensure emmc reset also from -@@ -92,9 +82,38 @@ struct mmc_pwrseq *mmc_pwrseq_emmc_alloc(struct mmc_host *host, - register_restart_handler(&pwrseq->reset_nb); - - pwrseq->pwrseq.ops = &mmc_pwrseq_emmc_ops; -+ pwrseq->pwrseq.dev = dev; -+ pwrseq->pwrseq.owner = THIS_MODULE; -+ platform_set_drvdata(pdev, pwrseq); -+ -+ return mmc_pwrseq_register(&pwrseq->pwrseq); -+} -+ -+static int mmc_pwrseq_emmc_remove(struct platform_device *pdev) -+{ -+ struct mmc_pwrseq_emmc *pwrseq = platform_get_drvdata(pdev); -+ -+ unregister_restart_handler(&pwrseq->reset_nb); -+ mmc_pwrseq_unregister(&pwrseq->pwrseq); - -- return &pwrseq->pwrseq; --free: -- kfree(pwrseq); -- return ERR_PTR(ret); -+ return 0; - } -+ -+static const struct of_device_id mmc_pwrseq_emmc_of_match[] = { -+ { .compatible = "mmc-pwrseq-emmc",}, -+ {/* sentinel */}, -+}; -+ -+MODULE_DEVICE_TABLE(of, mmc_pwrseq_emmc_of_match); -+ -+static struct platform_driver mmc_pwrseq_emmc_driver = { -+ .probe = mmc_pwrseq_emmc_probe, -+ .remove = mmc_pwrseq_emmc_remove, -+ .driver = { -+ .name = "pwrseq_emmc", -+ .of_match_table = mmc_pwrseq_emmc_of_match, -+ }, -+}; -+ -+module_platform_driver(mmc_pwrseq_emmc_driver); -+MODULE_LICENSE("GPL v2"); -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index f94271bb1f6b..450d907c6e6c 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -8,7 +8,10 @@ - * Simple MMC power sequence management - */ - #include -+#include - #include -+#include -+#include - #include - #include - #include -@@ -75,58 +78,64 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host) - } - } - --static void mmc_pwrseq_simple_free(struct mmc_host *host) --{ -- struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); -- -- if (!IS_ERR(pwrseq->reset_gpios)) -- gpiod_put_array(pwrseq->reset_gpios); -- -- if (!IS_ERR(pwrseq->ext_clk)) -- clk_put(pwrseq->ext_clk); -- -- kfree(pwrseq); --} -- - static const struct mmc_pwrseq_ops mmc_pwrseq_simple_ops = { - .pre_power_on = mmc_pwrseq_simple_pre_power_on, - .post_power_on = mmc_pwrseq_simple_post_power_on, - .power_off = mmc_pwrseq_simple_power_off, -- .free = mmc_pwrseq_simple_free, - }; - --struct mmc_pwrseq *mmc_pwrseq_simple_alloc(struct mmc_host *host, -- struct device *dev) -+static const struct of_device_id mmc_pwrseq_simple_of_match[] = { -+ { .compatible = "mmc-pwrseq-simple",}, -+ {/* sentinel */}, -+}; -+MODULE_DEVICE_TABLE(of, mmc_pwrseq_simple_of_match); -+ -+static int mmc_pwrseq_simple_probe(struct platform_device *pdev) - { - struct mmc_pwrseq_simple *pwrseq; -- int ret = 0; -+ struct device *dev = &pdev->dev; - -- pwrseq = kzalloc(sizeof(*pwrseq), GFP_KERNEL); -+ pwrseq = devm_kzalloc(dev, sizeof(*pwrseq), GFP_KERNEL); - if (!pwrseq) -- return ERR_PTR(-ENOMEM); -+ return -ENOMEM; - -- pwrseq->ext_clk = clk_get(dev, "ext_clock"); -- if (IS_ERR(pwrseq->ext_clk) && -- PTR_ERR(pwrseq->ext_clk) != -ENOENT) { -- ret = PTR_ERR(pwrseq->ext_clk); -- goto free; -- } -+ pwrseq->ext_clk = devm_clk_get(dev, "ext_clock"); -+ if (IS_ERR(pwrseq->ext_clk) && PTR_ERR(pwrseq->ext_clk) != -ENOENT) -+ return PTR_ERR(pwrseq->ext_clk); - -- pwrseq->reset_gpios = gpiod_get_array(dev, "reset", GPIOD_OUT_HIGH); -+ pwrseq->reset_gpios = devm_gpiod_get_array(dev, "reset", -+ GPIOD_OUT_HIGH); - if (IS_ERR(pwrseq->reset_gpios) && - PTR_ERR(pwrseq->reset_gpios) != -ENOENT && - PTR_ERR(pwrseq->reset_gpios) != -ENOSYS) { -- ret = PTR_ERR(pwrseq->reset_gpios); -- goto clk_put; -+ return PTR_ERR(pwrseq->reset_gpios); - } - -+ pwrseq->pwrseq.dev = dev; - pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops; -+ pwrseq->pwrseq.owner = THIS_MODULE; -+ platform_set_drvdata(pdev, pwrseq); - -- return &pwrseq->pwrseq; --clk_put: -- if (!IS_ERR(pwrseq->ext_clk)) -- clk_put(pwrseq->ext_clk); --free: -- kfree(pwrseq); -- return ERR_PTR(ret); -+ return mmc_pwrseq_register(&pwrseq->pwrseq); - } -+ -+static int mmc_pwrseq_simple_remove(struct platform_device *pdev) -+{ -+ struct mmc_pwrseq_simple *pwrseq = platform_get_drvdata(pdev); -+ -+ mmc_pwrseq_unregister(&pwrseq->pwrseq); -+ -+ return 0; -+} -+ -+static struct platform_driver mmc_pwrseq_simple_driver = { -+ .probe = mmc_pwrseq_simple_probe, -+ .remove = mmc_pwrseq_simple_remove, -+ .driver = { -+ .name = "pwrseq_simple", -+ .of_match_table = mmc_pwrseq_simple_of_match, -+ }, -+}; -+ -+module_platform_driver(mmc_pwrseq_simple_driver); -+MODULE_LICENSE("GPL v2"); - -From 42eb02ddb70002e4f72fa627037b6acbdd4cb7a1 Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Sun, 7 Aug 2016 21:02:38 +0200 -Subject: [PATCH] UPSTREAM: mmc: pwrseq-simple: Add an optional - post-power-on-delay - -Some devices need a while to boot their firmware after providing clks / -de-asserting resets before they are ready to receive sdio commands. - -This commits adds a post-power-on-delay-ms devicetree property to -mmc-pwrseq-simple for use with such devices. - -Signed-off-by: Hans de Goede -Acked-by: Rob Herring -Signed-off-by: Ulf Hansson -(cherry picked from commit 721e0497172f0fa661eed2d63367cddf479f35e8) ---- - Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt | 2 ++ - drivers/mmc/core/pwrseq_simple.c | 9 +++++++++ - 2 files changed, 11 insertions(+) - -diff --git a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -index ce0e76749671..e25436861867 100644 ---- a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -+++ b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -@@ -16,6 +16,8 @@ Optional properties: - See ../clocks/clock-bindings.txt for details. - - clock-names : Must include the following entry: - "ext_clock" (External clock provided to the card). -+- post-power-on-delay-ms : Delay in ms after powering the card and -+ de-asserting the reset-gpios (if any) - - Example: - -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index 450d907c6e6c..1304160de168 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -16,6 +16,8 @@ - #include - #include - #include -+#include -+#include - - #include - -@@ -24,6 +26,7 @@ - struct mmc_pwrseq_simple { - struct mmc_pwrseq pwrseq; - bool clk_enabled; -+ u32 post_power_on_delay_ms; - struct clk *ext_clk; - struct gpio_descs *reset_gpios; - }; -@@ -64,6 +67,9 @@ static void mmc_pwrseq_simple_post_power_on(struct mmc_host *host) - struct mmc_pwrseq_simple *pwrseq = to_pwrseq_simple(host->pwrseq); - - mmc_pwrseq_simple_set_gpios_value(pwrseq, 0); -+ -+ if (pwrseq->post_power_on_delay_ms) -+ msleep(pwrseq->post_power_on_delay_ms); - } - - static void mmc_pwrseq_simple_power_off(struct mmc_host *host) -@@ -111,6 +117,9 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev) - return PTR_ERR(pwrseq->reset_gpios); - } - -+ device_property_read_u32(dev, "post-power-on-delay-ms", -+ &pwrseq->post_power_on_delay_ms); -+ - pwrseq->pwrseq.dev = dev; - pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops; - pwrseq->pwrseq.owner = THIS_MODULE; - -From bf90ebd56d6f327f77bd7add55b3593679cd5c67 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Sat, 6 May 2017 11:41:30 +0200 -Subject: [PATCH] UPSTREAM: mmc: dt: pwrseq-simple: Invent power-off-delay-us - -During power off, after the GPIO pin has been asserted, some devices like -the Wifi chip from TI, Wl18xx, needs a delay before the host continues with -clock gating and turning off regulators as to follow a graceful shutdown -sequence. - -Therefore invent an optional power-off-delay-us DT binding for -mmc-pwrseq-simple, to allow us to support this constraint. - -Cc: devicetree@vger.kernel.org -Cc: Rob Herring -Cc: linux-mmc@vger.kernel.org -Signed-off-by: Ulf Hansson -Acked-by: Arnd Bergmann ---- - Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -index e25436861867..9029b45b8a22 100644 ---- a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -+++ b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt -@@ -18,6 +18,8 @@ Optional properties: - "ext_clock" (External clock provided to the card). - - post-power-on-delay-ms : Delay in ms after powering the card and - de-asserting the reset-gpios (if any) -+- power-off-delay-us : Delay in us after asserting the reset-gpios (if any) -+ during power off of the card. - - Example: - - -From bc79b1f8ca4d16d45b93c2888474bb3f11b10226 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Sat, 6 May 2017 11:43:05 +0200 -Subject: [PATCH] UPSTREAM: mmc: pwrseq_simple: Parse DTS for the - power-off-delay-us property - -If the optional power-off-delay-us property is found, insert the -corresponding delay after asserting the GPIO during power off. This enables -a graceful shutdown sequence for some devices. - -Cc: linux-mmc@vger.kernel.org -Signed-off-by: Ulf Hansson -Acked-by: Arnd Bergmann -(cherry picked from commit e9256e142f597edf90c68cec22db4c4aebaa27de) ---- - drivers/mmc/core/pwrseq_simple.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c -index 1304160de168..13ef162cf066 100644 ---- a/drivers/mmc/core/pwrseq_simple.c -+++ b/drivers/mmc/core/pwrseq_simple.c -@@ -27,6 +27,7 @@ struct mmc_pwrseq_simple { - struct mmc_pwrseq pwrseq; - bool clk_enabled; - u32 post_power_on_delay_ms; -+ u32 power_off_delay_us; - struct clk *ext_clk; - struct gpio_descs *reset_gpios; - }; -@@ -78,6 +79,10 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host) - - mmc_pwrseq_simple_set_gpios_value(pwrseq, 1); - -+ if (pwrseq->power_off_delay_us) -+ usleep_range(pwrseq->power_off_delay_us, -+ 2 * pwrseq->power_off_delay_us); -+ - if (!IS_ERR(pwrseq->ext_clk) && pwrseq->clk_enabled) { - clk_disable_unprepare(pwrseq->ext_clk); - pwrseq->clk_enabled = false; -@@ -119,6 +124,8 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev) - - device_property_read_u32(dev, "post-power-on-delay-ms", - &pwrseq->post_power_on_delay_ms); -+ device_property_read_u32(dev, "power-off-delay-us", -+ &pwrseq->power_off_delay_us); - - pwrseq->pwrseq.dev = dev; - pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops; diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0009-mmc.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0009-mmc.patch deleted file mode 100644 index d3a8ed9a1543..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0009-mmc.patch +++ /dev/null @@ -1,633 +0,0 @@ -From 38396ba52ab85ea1eabea3c92fd7532f8732f92e Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Tue, 24 Jul 2018 15:49:29 +0200 -Subject: [PATCH] mmc: core: use hs400es voltage flags - ---- - drivers/mmc/core/mmc.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index a814eb6882aa..1d950f0b3aa6 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1259,10 +1259,10 @@ static int mmc_select_hs400es(struct mmc_card *card) - goto out_err; - } - -- if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS200_1_2V) -+ if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_2V) - err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); - -- if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS200_1_8V) -+ if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_8V) - err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); - - /* If fails try again during next card power cycle */ - -From 92a57737adc14e15e80b6913932bb5d2d3478068 Mon Sep 17 00:00:00 2001 -From: Haibo Chen -Date: Tue, 8 Aug 2017 18:54:01 +0800 -Subject: [PATCH] UPSTREAM: mmc: mmc: correct the logic for setting HS400ES - signal voltage - -Change the default err value to -EINVAL, make sure the card only -has type EXT_CSD_CARD_TYPE_HS400_1_8V also do the signal voltage -setting when select hs400es mode. - -Fixes: commit 1720d3545b77 ("mmc: core: switch to 1V8 or 1V2 for hs400es mode") -Cc: -Signed-off-by: Haibo Chen -Reviewed-by: Shawn Lin -Signed-off-by: Ulf Hansson -(cherry picked from commit 92ddd95919466de5d34f3cb43635da9a7f9ab814) ---- - drivers/mmc/core/mmc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index 1d950f0b3aa6..70de514dd061 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1251,7 +1251,7 @@ out_err: - static int mmc_select_hs400es(struct mmc_card *card) - { - struct mmc_host *host = card->host; -- int err = 0; -+ int err = -EINVAL; - u8 val; - - if (!(host->caps & MMC_CAP_8_BIT_DATA)) { - -From 108a045df9dc1cee2127aec0bdd327ba7f2fdb81 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Wed, 25 Jan 2017 10:12:10 +0100 -Subject: [PATCH] UPSTREAM: mmc: core: Remove redundant code in - mmc_set_signal_voltage() - -The mmc_set_signal_voltage() function is used for SD/SDIO when switching to -1.8V for UHS mode. Therefore let's remove the redundant code dealing with -MMC_SIGNAL_VOLTAGE_330. - -Signed-off-by: Ulf Hansson -Reviewed-by: Shawn Lin -Tested-by: Jan Glauber -Tested-by: Stefan Wahren -(cherry picked from commit a44efa4796249c6d4341935e90e9105d6e1a5f15) ---- - drivers/mmc/core/core.c | 7 ------- - 1 file changed, 7 deletions(-) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 3e3c79feb07b..b69c96ad9486 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1598,13 +1598,6 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr) - - BUG_ON(!host); - -- /* -- * Send CMD11 only if the request is to switch the card to -- * 1.8V signalling. -- */ -- if (signal_voltage == MMC_SIGNAL_VOLTAGE_330) -- return __mmc_set_signal_voltage(host, signal_voltage); -- - /* - * If we cannot switch voltages, return failure so the caller - * can continue without UHS mode - -From d28c1bfff6556db2c4ce1093091293cf20542202 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Wed, 25 Jan 2017 10:25:01 +0100 -Subject: [PATCH] UPSTREAM: mmc: core: Clarify usage of - mmc_set_signal_voltage() - -The mmc_set_signal_voltage() function is used for SD/SDIO when switching to -1.8V for UHS mode. To clarify this let's do the following changes. - -- We are always providing MMC_SIGNAL_VOLTAGE_180 as the signal_voltage - parameter to the function. Then, let's just remove the parameter as it - serves no purpose. -- Rename the function to mmc_set_uhs_voltage(). - -Signed-off-by: Ulf Hansson -Reviewed-by: Shawn Lin -Tested-by: Jan Glauber -Tested-by: Stefan Wahren -(cherry picked from commit 2ed573b603f78289dd1435c94597aa25a97e2b76) ---- - drivers/mmc/core/core.c | 4 ++-- - drivers/mmc/core/core.h | 2 +- - drivers/mmc/core/sd.c | 3 +-- - drivers/mmc/core/sdio.c | 3 +-- - 4 files changed, 5 insertions(+), 7 deletions(-) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index b69c96ad9486..35d19d57d2c5 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1590,7 +1590,7 @@ int __mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage) - - } - --int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr) -+int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) - { - struct mmc_command cmd = {0}; - int err = 0; -@@ -1636,7 +1636,7 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr) - host->ios.clock = 0; - mmc_set_ios(host); - -- if (__mmc_set_signal_voltage(host, signal_voltage)) { -+ if (__mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) { - /* - * Voltages may not have been switched, but we've already - * sent CMD11, so a power cycle is required anyway -diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h -index ed7c3167763a..88ef50b2e0be 100644 ---- a/drivers/mmc/core/core.h -+++ b/drivers/mmc/core/core.h -@@ -43,7 +43,7 @@ void mmc_set_clock(struct mmc_host *host, unsigned int hz); - void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode); - void mmc_set_bus_width(struct mmc_host *host, unsigned int width); - u32 mmc_select_voltage(struct mmc_host *host, u32 ocr); --int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr); -+int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr); - int __mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage); - void mmc_set_timing(struct mmc_host *host, unsigned int timing); - void mmc_set_driver_type(struct mmc_host *host, unsigned int drv_type); -diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c -index cd437d6b1843..d9943d82db95 100644 ---- a/drivers/mmc/core/sd.c -+++ b/drivers/mmc/core/sd.c -@@ -742,8 +742,7 @@ try_again: - */ - if (!mmc_host_is_spi(host) && rocr && - ((*rocr & 0x41000000) == 0x41000000)) { -- err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180, -- pocr); -+ err = mmc_set_uhs_voltage(host, pocr); - if (err == -EAGAIN) { - retries--; - goto try_again; -diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c -index c586b11a40b5..f221418542e2 100644 ---- a/drivers/mmc/core/sdio.c -+++ b/drivers/mmc/core/sdio.c -@@ -648,8 +648,7 @@ try_again: - * to make sure which speed mode should work. - */ - if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) { -- err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180, -- ocr_card); -+ err = mmc_set_uhs_voltage(host, ocr_card); - if (err == -EAGAIN) { - mmc_sdio_resend_if_cond(host, card); - retries--; - -From 0f61c64862ed54163c5f88389170c95055a74f68 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Wed, 25 Jan 2017 11:12:34 +0100 -Subject: [PATCH] UPSTREAM: mmc: core: Rename __mmc_set_signal_voltage() to - mmc_set_signal_voltage() - -Earlier the mmc_set_signal_voltage() existed, but since it has been renamed -to mmc_set_uhs_voltage(), we can now use that name instead. - -Signed-off-by: Ulf Hansson -Reviewed-by: Shawn Lin -Tested-by: Jan Glauber -Tested-by: Stefan Wahren -(cherry picked from commit 4e74b6b3c6e9adfe6a8fdebfc56a6416a996d905) ---- - drivers/mmc/core/core.c | 10 +++++----- - drivers/mmc/core/core.h | 2 +- - drivers/mmc/core/mmc.c | 16 ++++++++-------- - 3 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 35d19d57d2c5..ba285431c2d0 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1574,7 +1574,7 @@ u32 mmc_select_voltage(struct mmc_host *host, u32 ocr) - return ocr; - } - --int __mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage) -+int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage) - { - int err = 0; - int old_signal_voltage = host->ios.signal_voltage; -@@ -1636,7 +1636,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) - host->ios.clock = 0; - mmc_set_ios(host); - -- if (__mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) { -+ if (mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) { - /* - * Voltages may not have been switched, but we've already - * sent CMD11, so a power cycle is required anyway -@@ -1745,11 +1745,11 @@ void mmc_power_up(struct mmc_host *host, u32 ocr) - mmc_set_initial_state(host); - - /* Try to set signal voltage to 3.3V but fall back to 1.8v or 1.2v */ -- if (__mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330) == 0) -+ if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330)) - dev_dbg(mmc_dev(host), "Initial signal voltage of 3.3v\n"); -- else if (__mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180) == 0) -+ else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) - dev_dbg(mmc_dev(host), "Initial signal voltage of 1.8v\n"); -- else if (__mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120) == 0) -+ else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120)) - dev_dbg(mmc_dev(host), "Initial signal voltage of 1.2v\n"); - - /* -diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h -index 88ef50b2e0be..0e4bc1c7a773 100644 ---- a/drivers/mmc/core/core.h -+++ b/drivers/mmc/core/core.h -@@ -44,7 +44,7 @@ void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode); - void mmc_set_bus_width(struct mmc_host *host, unsigned int width); - u32 mmc_select_voltage(struct mmc_host *host, u32 ocr); - int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr); --int __mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage); -+int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage); - void mmc_set_timing(struct mmc_host *host, unsigned int timing); - void mmc_set_driver_type(struct mmc_host *host, unsigned int drv_type); - int mmc_select_drive_strength(struct mmc_card *card, unsigned int max_dtr, -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index 70de514dd061..dd0040a10c0b 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1088,14 +1088,14 @@ static int mmc_select_hs_ddr(struct mmc_card *card) - */ - err = -EINVAL; - if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_DDR_1_2V) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); - - if (err && (card->mmc_avail_type & EXT_CSD_CARD_TYPE_DDR_1_8V)) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); - - /* make sure vccq is 3.3v after switching disaster */ - if (err) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330); - - if (!err) - mmc_set_timing(host, MMC_TIMING_MMC_DDR52); -@@ -1260,10 +1260,10 @@ static int mmc_select_hs400es(struct mmc_card *card) - } - - if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_2V) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); - - if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_8V) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); - - /* If fails try again during next card power cycle */ - if (err) -@@ -1362,10 +1362,10 @@ static int mmc_select_hs200(struct mmc_card *card) - - old_signal_voltage = host->ios.signal_voltage; - if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS200_1_2V) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120); - - if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS200_1_8V) -- err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); -+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180); - - /* If fails try again during next card power cycle */ - if (err) -@@ -1393,7 +1393,7 @@ static int mmc_select_hs200(struct mmc_card *card) - err: - if (err) { - /* fall back to the old signal voltage, if fails report error */ -- if (__mmc_set_signal_voltage(host, old_signal_voltage)) -+ if (mmc_set_signal_voltage(host, old_signal_voltage)) - err = -EIO; - - pr_err("%s: %s failed, error %d\n", mmc_hostname(card->host), - -From db9fd591980256d95de5675ebd84759b9cc9831c Mon Sep 17 00:00:00 2001 -From: Adrian Hunter -Date: Mon, 25 Sep 2017 11:29:03 +0300 -Subject: [PATCH] UPSTREAM: mmc: core: Factor out mmc_host_set_uhs_voltage() - -Factor out mmc_host_set_uhs_voltage() so it can be reused. - -Signed-off-by: Adrian Hunter -Signed-off-by: Ulf Hansson -(cherry picked from commit 3f496afb6fb361b282f37968ff7d3d80b0f1b5cb) ---- - drivers/mmc/core/core.c | 38 ++++++++++++++++++++++++-------------- - drivers/mmc/core/core.h | 1 + - 2 files changed, 25 insertions(+), 14 deletions(-) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index ba285431c2d0..dae82afcbc99 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1590,11 +1590,33 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage) - - } - -+int mmc_host_set_uhs_voltage(struct mmc_host *host) -+{ -+ u32 clock; -+ -+ /* -+ * During a signal voltage level switch, the clock must be gated -+ * for 5 ms according to the SD spec -+ */ -+ clock = host->ios.clock; -+ host->ios.clock = 0; -+ mmc_set_ios(host); -+ -+ if (mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) -+ return -EAGAIN; -+ -+ /* Keep clock gated for at least 10 ms, though spec only says 5 ms */ -+ mmc_delay(10); -+ host->ios.clock = clock; -+ mmc_set_ios(host); -+ -+ return 0; -+} -+ - int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) - { - struct mmc_command cmd = {0}; - int err = 0; -- u32 clock; - - BUG_ON(!host); - -@@ -1628,15 +1650,8 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) - err = -EAGAIN; - goto power_cycle; - } -- /* -- * During a signal voltage level switch, the clock must be gated -- * for 5 ms according to the SD spec -- */ -- clock = host->ios.clock; -- host->ios.clock = 0; -- mmc_set_ios(host); - -- if (mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) { -+ if (mmc_host_set_uhs_voltage(host)) { - /* - * Voltages may not have been switched, but we've already - * sent CMD11, so a power cycle is required anyway -@@ -1645,11 +1660,6 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr) - goto power_cycle; - } - -- /* Keep clock gated for at least 10 ms, though spec only says 5 ms */ -- mmc_delay(10); -- host->ios.clock = clock; -- mmc_set_ios(host); -- - /* Wait for at least 1 ms according to spec */ - mmc_delay(1); - -diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h -index 0e4bc1c7a773..11f3d2c22ecb 100644 ---- a/drivers/mmc/core/core.h -+++ b/drivers/mmc/core/core.h -@@ -44,6 +44,7 @@ void mmc_set_bus_mode(struct mmc_host *host, unsigned int mode); - void mmc_set_bus_width(struct mmc_host *host, unsigned int width); - u32 mmc_select_voltage(struct mmc_host *host, u32 ocr); - int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr); -+int mmc_host_set_uhs_voltage(struct mmc_host *host); - int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage); - void mmc_set_timing(struct mmc_host *host, unsigned int timing); - void mmc_set_driver_type(struct mmc_host *host, unsigned int drv_type); - -From 9c2d593200bd835b8e55eb6e0ba188e4dd9c744e Mon Sep 17 00:00:00 2001 -From: Adrian Hunter -Date: Mon, 25 Sep 2017 11:29:04 +0300 -Subject: [PATCH] UPSTREAM: mmc: sd: Fix signal voltage when there is no power - cycle - -Some boards have SD card connectors where the power rail cannot be switched -off by the driver. However there are various circumstances when a card -might be re-initialized, such as after system resume, warm re-boot, or -error handling. However, a UHS card will continue to use 1.8V signaling -unless it is power cycled. - -If the card has not been power cycled, it may still be using 1.8V -signaling. According to the SD spec., the Bus Speed Mode (function group 1) -bits 2 to 4 are zero if the card is initialized at 3.3V signal level. Thus -they can be used to determine if the card has already switched to 1.8V -signaling. Detect that situation and try to initialize a UHS-I (1.8V) -transfer mode. - -Tested with the following cards: - Transcend 4GB High Speed - Kingston 64GB SDR104 - Lexar by Micron HIGH-PERFORMANCE 300x 16GB DDR50 - SanDisk Ultra 8GB DDR50 - Transcend Ultimate 600x 16GB SDR104 - Transcend Premium 300x 64GB SDR104 - Lexar by Micron Professional 1000x 32GB UHS-II SDR104 - SanDisk Extreme Pro 16GB SDR104 - -Signed-off-by: Adrian Hunter -Tested-by: Zhoujie Wu -Reviewed-by: Shawn Lin -Signed-off-by: Ulf Hansson -(cherry picked from commit 6a11fc47f175c8d87018e89cb58e2d36c66534cb) ---- - drivers/mmc/core/sd.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 45 insertions(+), 2 deletions(-) - -diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c -index d9943d82db95..2808a281d094 100644 ---- a/drivers/mmc/core/sd.c -+++ b/drivers/mmc/core/sd.c -@@ -898,6 +898,18 @@ unsigned mmc_sd_get_max_clock(struct mmc_card *card) - return max_dtr; - } - -+static bool mmc_sd_card_using_v18(struct mmc_card *card) -+{ -+ /* -+ * According to the SD spec., the Bus Speed Mode (function group 1) bits -+ * 2 to 4 are zero if the card is initialized at 3.3V signal level. Thus -+ * they can be used to determine if the card has already switched to -+ * 1.8V signaling. -+ */ -+ return card->sw_caps.sd3_bus_mode & -+ (SD_MODE_UHS_SDR50 | SD_MODE_UHS_SDR104 | SD_MODE_UHS_DDR50); -+} -+ - /* - * Handle the detection and initialisation of a card. - * -@@ -911,10 +923,11 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr, - int err; - u32 cid[4]; - u32 rocr = 0; -+ bool v18_fixup_failed = false; - - BUG_ON(!host); - WARN_ON(!host->claimed); -- -+retry: - err = mmc_sd_get_cid(host, ocr, cid, &rocr); - if (err) - return err; -@@ -980,6 +993,36 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr, - if (err) - goto free_card; - -+ /* -+ * If the card has not been power cycled, it may still be using 1.8V -+ * signaling. Detect that situation and try to initialize a UHS-I (1.8V) -+ * transfer mode. -+ */ -+ if (!v18_fixup_failed && !mmc_host_is_spi(host) && mmc_host_uhs(host) && -+ mmc_sd_card_using_v18(card) && -+ host->ios.signal_voltage != MMC_SIGNAL_VOLTAGE_180) { -+ /* -+ * Re-read switch information in case it has changed since -+ * oldcard was initialized. -+ */ -+ if (oldcard) { -+ err = mmc_read_switch(card); -+ if (err) -+ goto free_card; -+ } -+ if (mmc_sd_card_using_v18(card)) { -+ if (mmc_host_set_uhs_voltage(host) || -+ mmc_sd_init_uhs_card(card)) { -+ v18_fixup_failed = true; -+ mmc_power_cycle(host, ocr); -+ if (!oldcard) -+ mmc_remove_card(card); -+ goto retry; -+ } -+ goto done; -+ } -+ } -+ - /* Initialization sequence for UHS-I cards */ - if (rocr & SD_ROCR_S18A && mmc_host_uhs(host)) { - err = mmc_sd_init_uhs_card(card); -@@ -1012,7 +1055,7 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr, - mmc_set_bus_width(host, MMC_BUS_WIDTH_4); - } - } -- -+done: - host->card = card; - return 0; - - -From 6ee3035196c307a77f95b1c1f3cc537e467fb838 Mon Sep 17 00:00:00 2001 -From: Ulf Hansson -Date: Thu, 5 Apr 2018 21:24:15 +0200 -Subject: [PATCH] UPSTREAM: mmc: core: Share internal function to set initial - signal voltage - -Move the corresponding code for setting the initial signal voltage, from -mmc_power_up() into a new function, mmc_set_initial_signal_voltage(). - -Make the function internally available to the mmc core, as to allow the -following changes to make use of it. - -Signed-off-by: Ulf Hansson -Tested-by: Quentin Schulz -Reviewed-by: Shawn Lin -(cherry picked from commit 508c9864ccede5dd4b8a7220b3fe6998763e4407) ---- - drivers/mmc/core/core.c | 19 ++++++++++++------- - drivers/mmc/core/core.h | 1 + - 2 files changed, 13 insertions(+), 7 deletions(-) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index dae82afcbc99..7aa83beea957 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1590,6 +1590,17 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage) - - } - -+void mmc_set_initial_signal_voltage(struct mmc_host *host) -+{ -+ /* Try to set signal voltage to 3.3V but fall back to 1.8v or 1.2v */ -+ if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330)) -+ dev_dbg(mmc_dev(host), "Initial signal voltage of 3.3v\n"); -+ else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) -+ dev_dbg(mmc_dev(host), "Initial signal voltage of 1.8v\n"); -+ else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120)) -+ dev_dbg(mmc_dev(host), "Initial signal voltage of 1.2v\n"); -+} -+ - int mmc_host_set_uhs_voltage(struct mmc_host *host) - { - u32 clock; -@@ -1754,13 +1765,7 @@ void mmc_power_up(struct mmc_host *host, u32 ocr) - /* Set initial state and call mmc_set_ios */ - mmc_set_initial_state(host); - -- /* Try to set signal voltage to 3.3V but fall back to 1.8v or 1.2v */ -- if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330)) -- dev_dbg(mmc_dev(host), "Initial signal voltage of 3.3v\n"); -- else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180)) -- dev_dbg(mmc_dev(host), "Initial signal voltage of 1.8v\n"); -- else if (!mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120)) -- dev_dbg(mmc_dev(host), "Initial signal voltage of 1.2v\n"); -+ mmc_set_initial_signal_voltage(host); - - /* - * This delay should be sufficient to allow the power supply -diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h -index 11f3d2c22ecb..2634722265ad 100644 ---- a/drivers/mmc/core/core.h -+++ b/drivers/mmc/core/core.h -@@ -46,6 +46,7 @@ u32 mmc_select_voltage(struct mmc_host *host, u32 ocr); - int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr); - int mmc_host_set_uhs_voltage(struct mmc_host *host); - int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage); -+void mmc_set_initial_signal_voltage(struct mmc_host *host); - void mmc_set_timing(struct mmc_host *host, unsigned int timing); - void mmc_set_driver_type(struct mmc_host *host, unsigned int drv_type); - int mmc_select_drive_strength(struct mmc_card *card, unsigned int max_dtr, - -From adadab9687a3e07be7557e4272fdf5a007b4c604 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Tue, 24 Jul 2018 15:50:06 +0200 -Subject: [PATCH] mmc: core: set initial signal voltage on power off - ---- - drivers/mmc/core/core.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c -index 7aa83beea957..d2c59b5e04ab 100644 ---- a/drivers/mmc/core/core.c -+++ b/drivers/mmc/core/core.c -@@ -1792,6 +1792,14 @@ void mmc_power_off(struct mmc_host *host) - if (host->ios.power_mode == MMC_POWER_OFF) - return; - -+ mmc_set_initial_signal_voltage(host); -+ -+ /* -+ * This delay should be sufficient to allow the power supply -+ * to reach the minimum voltage. -+ */ -+ mmc_delay(10); -+ - mmc_pwrseq_power_off(host); - - host->ios.clock = 0; diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-0010-dvb.patch b/patch/kernel/archive/rockchip-4.4/01-linux-0010-dvb.patch deleted file mode 100644 index d871851a6420..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-0010-dvb.patch +++ /dev/null @@ -1,376 +0,0 @@ -From ae39146426642d51de99ba3bdef54912c579991b Mon Sep 17 00:00:00 2001 -From: Jakub Kicinski -Date: Wed, 31 Aug 2016 12:46:44 +0100 -Subject: [PATCH] UPSTREAM: add basic register-field manipulation macros - -Common approach to accessing register fields is to define -structures or sets of macros containing mask and shift pair. -Operations on the register are then performed as follows: - - field = (reg >> shift) & mask; - - reg &= ~(mask << shift); - reg |= (field & mask) << shift; - -Defining shift and mask separately is tedious. Ivo van Doorn -came up with an idea of computing them at compilation time -based on a single shifted mask (later refined by Felix) which -can be used like this: - - #define REG_FIELD 0x000ff000 - - field = FIELD_GET(REG_FIELD, reg); - - reg &= ~REG_FIELD; - reg |= FIELD_PREP(REG_FIELD, field); - -FIELD_{GET,PREP} macros take care of finding out what the -appropriate shift is based on compilation time ffs operation. - -GENMASK can be used to define registers (which is usually -less error-prone and easier to match with datasheets). - -This approach is the most convenient I've seen so to limit code -multiplication let's move the macros to a global header file. -Attempts to use static inlines instead of macros failed due -to false positive triggering of BUILD_BUG_ON()s, especially with -GCC < 6.0. - -Signed-off-by: Jakub Kicinski -Reviewed-by: Dinan Gunawardena -Signed-off-by: Kalle Valo -(cherry picked from commit 3e9b3112ec74f192eaab976c3889e34255cae940) ---- - include/linux/bitfield.h | 93 ++++++++++++++++++++++++++++++++++++++++++++++++ - include/linux/bug.h | 3 ++ - 2 files changed, 96 insertions(+) - create mode 100644 include/linux/bitfield.h - -diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h -new file mode 100644 -index 000000000000..f6505d83069d ---- /dev/null -+++ b/include/linux/bitfield.h -@@ -0,0 +1,93 @@ -+/* -+ * Copyright (C) 2014 Felix Fietkau -+ * Copyright (C) 2004 - 2009 Ivo van Doorn -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License version 2 -+ * as published by the Free Software Foundation -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ */ -+ -+#ifndef _LINUX_BITFIELD_H -+#define _LINUX_BITFIELD_H -+ -+#include -+ -+/* -+ * Bitfield access macros -+ * -+ * FIELD_{GET,PREP} macros take as first parameter shifted mask -+ * from which they extract the base mask and shift amount. -+ * Mask must be a compilation time constant. -+ * -+ * Example: -+ * -+ * #define REG_FIELD_A GENMASK(6, 0) -+ * #define REG_FIELD_B BIT(7) -+ * #define REG_FIELD_C GENMASK(15, 8) -+ * #define REG_FIELD_D GENMASK(31, 16) -+ * -+ * Get: -+ * a = FIELD_GET(REG_FIELD_A, reg); -+ * b = FIELD_GET(REG_FIELD_B, reg); -+ * -+ * Set: -+ * reg = FIELD_PREP(REG_FIELD_A, 1) | -+ * FIELD_PREP(REG_FIELD_B, 0) | -+ * FIELD_PREP(REG_FIELD_C, c) | -+ * FIELD_PREP(REG_FIELD_D, 0x40); -+ * -+ * Modify: -+ * reg &= ~REG_FIELD_C; -+ * reg |= FIELD_PREP(REG_FIELD_C, c); -+ */ -+ -+#define __bf_shf(x) (__builtin_ffsll(x) - 1) -+ -+#define __BF_FIELD_CHECK(_mask, _reg, _val, _pfx) \ -+ ({ \ -+ BUILD_BUG_ON_MSG(!__builtin_constant_p(_mask), \ -+ _pfx "mask is not constant"); \ -+ BUILD_BUG_ON_MSG(!(_mask), _pfx "mask is zero"); \ -+ BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ -+ ~((_mask) >> __bf_shf(_mask)) & (_val) : 0, \ -+ _pfx "value too large for the field"); \ -+ BUILD_BUG_ON_MSG((_mask) > (typeof(_reg))~0ull, \ -+ _pfx "type of reg too small for mask"); \ -+ __BUILD_BUG_ON_NOT_POWER_OF_2((_mask) + \ -+ (1ULL << __bf_shf(_mask))); \ -+ }) -+ -+/** -+ * FIELD_PREP() - prepare a bitfield element -+ * @_mask: shifted mask defining the field's length and position -+ * @_val: value to put in the field -+ * -+ * FIELD_PREP() masks and shifts up the value. The result should -+ * be combined with other fields of the bitfield using logical OR. -+ */ -+#define FIELD_PREP(_mask, _val) \ -+ ({ \ -+ __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: "); \ -+ ((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask); \ -+ }) -+ -+/** -+ * FIELD_GET() - extract a bitfield element -+ * @_mask: shifted mask defining the field's length and position -+ * @_reg: 32bit value of entire bitfield -+ * -+ * FIELD_GET() extracts the field specified by @_mask from the -+ * bitfield passed in as @_reg by masking and shifting it down. -+ */ -+#define FIELD_GET(_mask, _reg) \ -+ ({ \ -+ __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ -+ (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ -+ }) -+ -+#endif -diff --git a/include/linux/bug.h b/include/linux/bug.h -index 7f4818673c41..edd3d8d3cd90 100644 ---- a/include/linux/bug.h -+++ b/include/linux/bug.h -@@ -13,6 +13,7 @@ enum bug_trap_type { - struct pt_regs; - - #ifdef __CHECKER__ -+#define __BUILD_BUG_ON_NOT_POWER_OF_2(n) (0) - #define BUILD_BUG_ON_NOT_POWER_OF_2(n) (0) - #define BUILD_BUG_ON_ZERO(e) (0) - #define BUILD_BUG_ON_NULL(e) ((void*)0) -@@ -23,6 +24,8 @@ struct pt_regs; - #else /* __CHECKER__ */ - - /* Force a compilation error if a constant expression is not a power of 2 */ -+#define __BUILD_BUG_ON_NOT_POWER_OF_2(n) \ -+ BUILD_BUG_ON(((n) & ((n) - 1)) != 0) - #define BUILD_BUG_ON_NOT_POWER_OF_2(n) \ - BUILD_BUG_ON((n) == 0 || (((n) & ((n) - 1)) != 0)) - - -From 8c11cf13e9f5c633bc2d1f3414d3b95c9cc82e4c Mon Sep 17 00:00:00 2001 -From: Jakub Kicinski -Date: Thu, 9 Feb 2017 09:17:27 -0800 -Subject: [PATCH] UPSTREAM: bitfield.h: add FIELD_FIT() helper - -Add a helper for checking at runtime that a value will fit inside -a specified field/mask. - -Signed-off-by: Jakub Kicinski -Signed-off-by: David S. Miller -(cherry picked from commit 1697599ee301a52cded6499a09bd609f7f63fd06) ---- - include/linux/bitfield.h | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h -index f6505d83069d..8b9d6fff002d 100644 ---- a/include/linux/bitfield.h -+++ b/include/linux/bitfield.h -@@ -62,6 +62,19 @@ - (1ULL << __bf_shf(_mask))); \ - }) - -+/** -+ * FIELD_FIT() - check if value fits in the field -+ * @_mask: shifted mask defining the field's length and position -+ * @_val: value to test against the field -+ * -+ * Return: true if @_val can fit inside @_mask, false if @_val is too big. -+ */ -+#define FIELD_FIT(_mask, _val) \ -+ ({ \ -+ __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ -+ !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ -+ }) -+ - /** - * FIELD_PREP() - prepare a bitfield element - * @_mask: shifted mask defining the field's length and position - -From 9b03f083c3ba2b3ca6dbcfdc76bf24edfe8b2947 Mon Sep 17 00:00:00 2001 -From: Laurent Defert -Date: Wed, 11 Oct 2017 08:46:52 +0200 -Subject: [PATCH] FROMLIST: compat_ioctl: add compat handler for - FE_SET_PROPERTY and FE_GET_PROPERTY - -https://patchwork.linuxtv.org/patch/8209/ ---- - fs/compat_ioctl.c | 138 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 138 insertions(+) - -diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index a52ca5cba015..438ce0c6851e 100644 ---- a/fs/compat_ioctl.c -+++ b/fs/compat_ioctl.c -@@ -223,6 +223,140 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, - return err; - } - -+struct compat_dtv_property { -+ __u32 cmd; -+ __u32 reserved[3]; -+ union { -+ __u32 data; -+ struct { -+ __u8 data[32]; -+ __u32 len; -+ __u32 reserved1[3]; -+ compat_uptr_t reserved2; -+ } buffer; -+ } u; -+ int result; -+}; -+ -+struct compat_dtv_properties { -+ __u32 num; -+ compat_uptr_t props; -+}; -+ -+#define FE_SET_PROPERTY32 _IOW('o', 82, struct compat_dtv_properties) -+#define FE_GET_PROPERTY32 _IOR('o', 83, struct compat_dtv_properties) -+ -+static int do_fe_set_property(unsigned int fd, unsigned int cmd, -+ struct compat_dtv_properties __user *dtv32) -+{ -+ struct dtv_properties __user *dtv; -+ struct dtv_property __user *properties; -+ struct compat_dtv_property __user *properties32; -+ compat_uptr_t data; -+ -+ int err; -+ int i; -+ __u32 num; -+ -+ err = get_user(num, &dtv32->num); -+ err |= get_user(data, &dtv32->props); -+ -+ if(err) -+ return -EFAULT; -+ -+ dtv = compat_alloc_user_space(sizeof(struct dtv_properties) + -+ sizeof(struct dtv_property) * num); -+ properties = (struct dtv_property*)((char*)dtv + -+ sizeof(struct dtv_properties)); -+ -+ err = put_user(properties, &dtv->props); -+ err |= put_user(num, &dtv->num); -+ -+ properties32 = compat_ptr(data); -+ -+ if(err) -+ return -EFAULT; -+ -+ for(i = 0; i < num; i++) { -+ compat_uptr_t reserved2; -+ -+ err |= copy_in_user(&properties[i], &properties32[i], -+ (8 * sizeof(__u32)) + (32 * sizeof(__u8))); -+ err |= get_user(reserved2, &properties32[i].u.buffer.reserved2); -+ err |= put_user(compat_ptr(reserved2), -+ &properties[i].u.buffer.reserved2); -+ } -+ -+ if(err) -+ return -EFAULT; -+ -+ err = sys_ioctl(fd, FE_SET_PROPERTY, (unsigned long) dtv); -+ -+ for(i = 0; i < num; i++) { -+ if(copy_in_user(&properties32[i].result, &properties[i].result, -+ sizeof(int))) -+ return -EFAULT; -+ } -+ -+ return err; -+} -+ -+static int do_fe_get_property(unsigned int fd, unsigned int cmd, -+ struct compat_dtv_properties __user *dtv32) -+{ -+ struct dtv_properties __user *dtv; -+ struct dtv_property __user *properties; -+ struct compat_dtv_property __user *properties32; -+ compat_uptr_t data; -+ -+ int err; -+ int i; -+ __u32 num; -+ -+ err = get_user(num, &dtv32->num); -+ err |= get_user(data, &dtv32->props); -+ -+ if(err) -+ return -EFAULT; -+ -+ dtv = compat_alloc_user_space(sizeof(struct dtv_properties) + -+ sizeof(struct dtv_property) * num); -+ properties = (struct dtv_property*)((char*)dtv + -+ sizeof(struct dtv_properties)); -+ -+ err = put_user(properties, &dtv->props); -+ err |= put_user(num, &dtv->num); -+ -+ properties32 = compat_ptr(data); -+ -+ if(err) -+ return -EFAULT; -+ -+ for(i = 0; i < num; i++) { -+ compat_uptr_t reserved2; -+ -+ err |= copy_in_user(&properties[i], &properties32[i], -+ (8 * sizeof(__u32)) + (32 * sizeof(__u8))); -+ err |= get_user(reserved2, &properties32[i].u.buffer.reserved2); -+ err |= put_user(compat_ptr(reserved2), -+ &properties[i].u.buffer.reserved2); -+ } -+ -+ if(err) -+ return -EFAULT; -+ -+ err = sys_ioctl(fd, FE_GET_PROPERTY, (unsigned long) dtv); -+ -+ for(i = 0; i < num; i++) { -+ -+ if(copy_in_user(&properties32[i], &properties[i], -+ sizeof(properties32[i]))) -+ return -EFAULT; -+ } -+ -+ return err; -+} -+ - #ifdef CONFIG_BLOCK - typedef struct sg_io_hdr32 { - compat_int_t interface_id; /* [i] 'S' for SCSI generic (required) */ -@@ -1483,6 +1617,10 @@ static long do_ioctl_trans(int fd, unsigned int cmd, - return do_video_stillpicture(fd, cmd, argp); - case VIDEO_SET_SPU_PALETTE: - return do_video_set_spu_palette(fd, cmd, argp); -+ case FE_SET_PROPERTY32: -+ return do_fe_set_property(fd, cmd, argp); -+ case FE_GET_PROPERTY32: -+ return do_fe_get_property(fd, cmd, argp); - } - - /* diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-1000-pl330.patch.disabled b/patch/kernel/archive/rockchip-4.4/01-linux-1000-pl330.patch.disabled deleted file mode 100644 index c25b5783b032..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-1000-pl330.patch.disabled +++ /dev/null @@ -1,2204 +0,0 @@ -From 0a3affb0d28223e6ffbdb3ccceeaae1ed7a35b21 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 3 Jun 2018 07:36:35 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: add support for interlace cyclic - xfer" - -This reverts commit 191583d95bae59c82b50f7437f2b738fcc5f8015. ---- - drivers/dma/pl330.c | 21 ++++++++++++--------- - 1 file changed, 12 insertions(+), 9 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 5893c11dd858..b4a0d48bafa4 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1398,9 +1398,7 @@ static inline int _loop_cyclic(struct pl330_dmac *pl330, unsigned dry_run, - off += _emit_LPEND(dry_run, &buf[off], &lpend); - } - -- if (pxs->desc->src_interlace_size == 0 && -- pxs->desc->dst_interlace_size == 0 && -- pl330->peripherals_req_type == BURST) { -+ if (pl330->peripherals_req_type == BURST) { - unsigned int ccr = pxs->ccr; - unsigned long c = 0; - -@@ -1501,12 +1499,6 @@ static inline int _setup_xfer_cyclic(struct pl330_dmac *pl330, unsigned dry_run, - unsigned long bursts = BYTE_TO_BURST(x->bytes, ccr); - int off = 0; - -- if (pxs->desc->rqtype == DMA_DEV_TO_MEM) -- bursts = x->bytes / (BRST_SIZE(ccr) * BRST_LEN(ccr) -- + pxs->desc->dst_interlace_size); -- else if (pxs->desc->rqtype == DMA_MEM_TO_DEV) -- bursts = x->bytes / (BRST_SIZE(ccr) * BRST_LEN(ccr) -- + pxs->desc->src_interlace_size); - /* Setup Loop(s) */ - off += _loop_cyclic(pl330, dry_run, &buf[off], bursts, pxs, ev); - -@@ -2729,6 +2721,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - struct dma_pl330_desc *desc = NULL; - struct dma_pl330_chan *pch = to_pchan(chan); - struct pl330_dmac *pl330 = pch->dmac; -+ unsigned int size = 0; - dma_addr_t dst; - dma_addr_t src; - -@@ -2754,12 +2747,14 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - desc->rqcfg.dst_inc = 0; - src = dma_addr; - dst = pch->fifo_addr; -+ size = pch->src_interlace_size; - break; - case DMA_DEV_TO_MEM: - desc->rqcfg.src_inc = 0; - desc->rqcfg.dst_inc = 1; - src = pch->fifo_addr; - dst = dma_addr; -+ size = pch->dst_interlace_size; - break; - default: - break; -@@ -2779,8 +2774,16 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - desc->cyclic = true; - desc->num_periods = len / period_len; - desc->txd.flags = flags; -+ - desc->src_interlace_size = pch->src_interlace_size; - desc->dst_interlace_size = pch->dst_interlace_size; -+ /* refine bytes_requested if interlace_size set */ -+ if (size) { -+ size += (pch->burst_len * (1 << pch->burst_sz)); -+ size *= desc->bytes_requested; -+ size /= (pch->burst_len * (1 << pch->burst_sz)); -+ desc->bytes_requested = size; -+ } - return &desc->txd; - } - - -From 16aaccef2d6178e8ce9bdb676526301fd071c3d6 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 3 Jun 2018 07:36:53 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: add support for interlace size - config" - -This reverts commit ddd2e87ad41e2c9e95322a1fb7d8ca65e578aa65. ---- - drivers/dma/pl330.c | 32 -------------------------------- - include/linux/dmaengine.h | 2 -- - 2 files changed, 34 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index b4a0d48bafa4..babaeace0a8a 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -447,10 +447,6 @@ struct dma_pl330_chan { - int burst_len; /* the number of burst */ - dma_addr_t fifo_addr; - -- /* interlace size */ -- unsigned int src_interlace_size; -- unsigned int dst_interlace_size; -- - /* for runtime pm tracking */ - bool active; - }; -@@ -540,9 +536,6 @@ struct dma_pl330_desc { - /* For cyclic capability */ - bool cyclic; - size_t num_periods; -- /* interlace size */ -- unsigned int src_interlace_size; -- unsigned int dst_interlace_size; - }; - - struct _xfer_spec { -@@ -1194,10 +1187,6 @@ static inline int _ldst_devtomem(struct pl330_dmac *pl330, unsigned dry_run, - if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) - off += _emit_FLUSHP(dry_run, &buf[off], - pxs->desc->peri); -- if (pxs->desc->dst_interlace_size) { -- off += _emit_ADDH(dry_run, &buf[off], DST, -- pxs->desc->dst_interlace_size); -- } - } - - return off; -@@ -1228,9 +1217,6 @@ static inline int _ldst_memtodev(struct pl330_dmac *pl330, - if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) - off += _emit_FLUSHP(dry_run, &buf[off], - pxs->desc->peri); -- if (pxs->desc->src_interlace_size) -- off += _emit_ADDH(dry_run, &buf[off], SRC, -- pxs->desc->src_interlace_size); - } - - return off; -@@ -2318,8 +2304,6 @@ static int pl330_config(struct dma_chan *chan, - pch->burst_sz = __ffs(slave_config->dst_addr_width); - if (slave_config->dst_maxburst) - pch->burst_len = slave_config->dst_maxburst; -- if (slave_config->src_interlace_size) -- pch->src_interlace_size = slave_config->src_interlace_size; - } else if (slave_config->direction == DMA_DEV_TO_MEM) { - if (slave_config->src_addr) - pch->fifo_addr = slave_config->src_addr; -@@ -2327,8 +2311,6 @@ static int pl330_config(struct dma_chan *chan, - pch->burst_sz = __ffs(slave_config->src_addr_width); - if (slave_config->src_maxburst) - pch->burst_len = slave_config->src_maxburst; -- if (slave_config->dst_interlace_size) -- pch->dst_interlace_size = slave_config->dst_interlace_size; - } - - return 0; -@@ -2721,7 +2703,6 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - struct dma_pl330_desc *desc = NULL; - struct dma_pl330_chan *pch = to_pchan(chan); - struct pl330_dmac *pl330 = pch->dmac; -- unsigned int size = 0; - dma_addr_t dst; - dma_addr_t src; - -@@ -2747,14 +2728,12 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - desc->rqcfg.dst_inc = 0; - src = dma_addr; - dst = pch->fifo_addr; -- size = pch->src_interlace_size; - break; - case DMA_DEV_TO_MEM: - desc->rqcfg.src_inc = 0; - desc->rqcfg.dst_inc = 1; - src = pch->fifo_addr; - dst = dma_addr; -- size = pch->dst_interlace_size; - break; - default: - break; -@@ -2775,15 +2754,6 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - desc->num_periods = len / period_len; - desc->txd.flags = flags; - -- desc->src_interlace_size = pch->src_interlace_size; -- desc->dst_interlace_size = pch->dst_interlace_size; -- /* refine bytes_requested if interlace_size set */ -- if (size) { -- size += (pch->burst_len * (1 << pch->burst_sz)); -- size *= desc->bytes_requested; -- size /= (pch->burst_len * (1 << pch->burst_sz)); -- desc->bytes_requested = size; -- } - return &desc->txd; - } - -@@ -2920,8 +2890,6 @@ pl330_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - - desc->rqtype = direction; - desc->bytes_requested = sg_dma_len(sg); -- desc->src_interlace_size = pch->src_interlace_size; -- desc->dst_interlace_size = pch->dst_interlace_size; - } - - /* Return the last desc in the chain */ -diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h -index 3050f88daf9e..948c17e409e9 100644 ---- a/include/linux/dmaengine.h -+++ b/include/linux/dmaengine.h -@@ -365,8 +365,6 @@ struct dma_slave_config { - u32 dst_maxburst; - bool device_fc; - unsigned int slave_id; -- unsigned int src_interlace_size; -- unsigned int dst_interlace_size; - }; - - /** - -From ef7bddfb9e1490a323aa322b3f1719f071720f3b Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 4 Feb 2018 10:47:28 +0100 -Subject: [PATCH] Revert "dmaengine: pl330: fix bug that chan descdone is null" - -This reverts commit 636c30b38ae6ec499735ce7621ba474944b4e9b7. ---- - drivers/dma/pl330.c | 17 ++++++++--------- - 1 file changed, 8 insertions(+), 9 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index babaeace0a8a..6e375d7ec09c 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1789,17 +1789,16 @@ static int pl330_update(struct pl330_dmac *pl330) - - /* Detach the req */ - descdone = thrd->req[active].desc; -- if (descdone) { -- if (!descdone->cyclic) { -- thrd->req[active].desc = NULL; -- thrd->req_running = -1; -- /* Get going again ASAP */ -- _start(thrd); -- } - -- /* For now, just make a list of callbacks to be done */ -- list_add_tail(&descdone->rqd, &pl330->req_done); -+ if (!descdone->cyclic) { -+ thrd->req[active].desc = NULL; -+ thrd->req_running = -1; -+ /* Get going again ASAP */ -+ _start(thrd); - } -+ -+ /* For now, just make a list of callbacks to be done */ -+ list_add_tail(&descdone->rqd, &pl330->req_done); - } - } - - -From 0e87104dd4138e358202bc6bad1f6ca2701fb711 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 4 Feb 2018 10:47:38 +0100 -Subject: [PATCH] Revert "dmaengine: pl330: flush before first loop" - -This reverts commit 34be2cf4679cadbf910de9651d54b46930166446. ---- - drivers/dma/pl330.c | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 6e375d7ec09c..9664f71dbab2 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1351,11 +1351,7 @@ static inline int _loop_cyclic(struct pl330_dmac *pl330, unsigned dry_run, - /* forever loop */ - off += _emit_MOV(dry_run, &buf[off], SAR, x->src_addr); - off += _emit_MOV(dry_run, &buf[off], DAR, x->dst_addr); --#ifdef CONFIG_ARCH_ROCKCHIP -- if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) -- off += _emit_FLUSHP(dry_run, &buf[off], -- pxs->desc->peri); --#endif -+ - /* loop0 */ - off += _emit_LP(dry_run, &buf[off], 0, lcnt0); - ljmp0 = off; -@@ -1431,11 +1427,7 @@ static inline int _setup_loops(struct pl330_dmac *pl330, - int num_dregs = (x->bytes - BURST_TO_BYTE(bursts, ccr)) / - BRST_SIZE(ccr); - int off = 0; --#ifdef CONFIG_ARCH_ROCKCHIP -- if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) -- off += _emit_FLUSHP(dry_run, &buf[off], -- pxs->desc->peri); --#endif -+ - while (bursts) { - c = bursts; - off += _loop(pl330, dry_run, &buf[off], &c, pxs); - -From 31a66caa86b6ed3bde555f70d7d6cb351ff60156 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 4 Feb 2018 10:47:51 +0100 -Subject: [PATCH] Revert "dmaengine: pl330: fix 2 bursts transfer when dma - flushes" - -This reverts commit 98753e172dc1d06cf4d61c48f5c3487df0247472. ---- - drivers/dma/pl330.c | 20 -------------------- - 1 file changed, 20 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 9664f71dbab2..9c3699ad2245 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1173,16 +1173,6 @@ static inline int _ldst_devtomem(struct pl330_dmac *pl330, unsigned dry_run, - off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); - off += _emit_LDP(dry_run, &buf[off], cond, pxs->desc->peri); - off += _emit_ST(dry_run, &buf[off], ALWAYS); --#ifdef CONFIG_ARCH_ROCKCHIP -- /* -- * Make suree dma has finish transmission, or later flush may -- * cause dma second transmission,and fifo is overrun. -- */ -- off += _emit_WMB(dry_run, &buf[off]); -- off += _emit_NOP(dry_run, &buf[off]); -- off += _emit_WMB(dry_run, &buf[off]); -- off += _emit_NOP(dry_run, &buf[off]); --#endif - - if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) - off += _emit_FLUSHP(dry_run, &buf[off], -@@ -1203,16 +1193,6 @@ static inline int _ldst_memtodev(struct pl330_dmac *pl330, - off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); - off += _emit_LD(dry_run, &buf[off], ALWAYS); - off += _emit_STP(dry_run, &buf[off], cond, pxs->desc->peri); --#ifdef CONFIG_ARCH_ROCKCHIP -- /* -- * Make suree dma has finish transmission, or later flush may -- * cause dma second transmission,and fifo is overrun. -- */ -- off += _emit_WMB(dry_run, &buf[off]); -- off += _emit_NOP(dry_run, &buf[off]); -- off += _emit_WMB(dry_run, &buf[off]); -- off += _emit_NOP(dry_run, &buf[off]); --#endif - - if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) - off += _emit_FLUSHP(dry_run, &buf[off], - -From 4429392f7f65d46bac1dd0dda3d8611663acce63 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 21 Oct 2017 19:49:27 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: _loop_cyclic fix cycles of last - loop" - -This reverts commit d7155171cbc65e45b5b0c8db03fd16fa57a181f2. ---- - drivers/dma/pl330.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 9c3699ad2245..be4ea6e089ae 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1370,7 +1370,7 @@ static inline int _loop_cyclic(struct pl330_dmac *pl330, unsigned dry_run, - ccr &= ~(0xf << CC_SRCBRSTLEN_SHFT); - ccr &= ~(0xf << CC_DSTBRSTLEN_SHFT); - off += _emit_MOV(dry_run, &buf[off], CCR, ccr); -- off += _emit_LP(dry_run, &buf[off], 1, c); -+ off += _emit_LP(dry_run, &buf[off], 1, c - 1); - ljmp1 = off; - off += _bursts(pl330, dry_run, &buf[off], pxs, 1); - lpend.cond = ALWAYS; - -From 4bd0efa160df1d9cdfd2fd213b96587cb7961c76 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 4 Feb 2018 11:05:44 +0100 -Subject: [PATCH] Revert "dmaengine: pl330: pl330_tasklet init power_down by - pch->active" - -This reverts commit 796b13f24a158f14d540bcf7316d843f72242c0d. ---- - drivers/dma/pl330.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index be4ea6e089ae..2ba795d599fb 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2169,7 +2169,7 @@ static void pl330_tasklet(unsigned long data) - spin_lock(&pch->thread->dmac->lock); - _stop(pch->thread); - spin_unlock(&pch->thread->dmac->lock); -- power_down = pch->active; -+ power_down = true; - pch->active = false; - } else { - /* Make sure the PL330 Channel thread is active */ - -From 2550b832a5aec4d0a2b584bed27a789cb76c2d35 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Fri, 16 Jun 2017 23:14:54 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: _loop_cyclic supports unaligned - size" - -This reverts commit 13dbe2cccd5851540af8158b12499c33801b6ef6. ---- - drivers/dma/pl330.c | 38 ++++++++++---------------------------- - 1 file changed, 10 insertions(+), 28 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 2ba795d599fb..e5b3893d441e 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1360,28 +1360,6 @@ static inline int _loop_cyclic(struct pl330_dmac *pl330, unsigned dry_run, - off += _emit_LPEND(dry_run, &buf[off], &lpend); - } - -- if (pl330->peripherals_req_type == BURST) { -- unsigned int ccr = pxs->ccr; -- unsigned long c = 0; -- -- c = BYTE_MOD_BURST_LEN(x->bytes, pxs->ccr); -- -- if (c) { -- ccr &= ~(0xf << CC_SRCBRSTLEN_SHFT); -- ccr &= ~(0xf << CC_DSTBRSTLEN_SHFT); -- off += _emit_MOV(dry_run, &buf[off], CCR, ccr); -- off += _emit_LP(dry_run, &buf[off], 1, c - 1); -- ljmp1 = off; -- off += _bursts(pl330, dry_run, &buf[off], pxs, 1); -- lpend.cond = ALWAYS; -- lpend.forever = false; -- lpend.loop = 1; -- lpend.bjump = off - ljmp1; -- off += _emit_LPEND(dry_run, &buf[off], &lpend); -- off += _emit_MOV(dry_run, &buf[off], CCR, pxs->ccr); -- } -- } -- - off += _emit_SEV(dry_run, &buf[off], ev); - - lpend.cond = ALWAYS; -@@ -1483,13 +1461,13 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - - x = &pxs->desc->px; - -- if (pl330->peripherals_req_type != BURST) { -- /* Error if xfer length is not aligned at burst size */ -- if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -- return -EINVAL; -- } -- - if (!pxs->desc->cyclic) { -+ if (pl330->peripherals_req_type != BURST) { -+ /* Error if xfer length is not aligned at burst size */ -+ if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -+ return -EINVAL; -+ } -+ - off += _setup_xfer(pl330, dry_run, &buf[off], pxs); - - /* DMASEV peripheral/event */ -@@ -1497,6 +1475,10 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - /* DMAEND */ - off += _emit_END(dry_run, &buf[off]); - } else { -+ /* Error if xfer length is not aligned at burst size */ -+ if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -+ return -EINVAL; -+ - off += _setup_xfer_cyclic(pl330, dry_run, &buf[off], - pxs, thrd->ev); - } - -From 8ad1819a2e61483c3840d09b9a27f669c7fcb8bc Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Fri, 16 Jun 2017 23:14:54 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: make transfer run infinitely - without CPU intervention" - -This reverts commit e8a6e5086cb82d59cae6ae029b1eb4432cc62288. ---- - drivers/dma/pl330.c | 199 +++++++++++++++++++++++++++------------------------- - 1 file changed, 105 insertions(+), 94 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 38c46f4e0408..ad9d616551f8 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -447,6 +447,9 @@ struct dma_pl330_chan { - int burst_len; /* the number of burst */ - dma_addr_t fifo_addr; - -+ /* for cyclic capability */ -+ bool cyclic; -+ - /* for runtime pm tracking */ - bool active; - }; -@@ -532,10 +535,6 @@ struct dma_pl330_desc { - unsigned peri:5; - /* Hook to attach to DMAC's list of reqs with due callback */ - struct list_head rqd; -- -- /* For cyclic capability */ -- bool cyclic; -- size_t num_periods; - }; - - struct _xfer_spec { -@@ -1326,19 +1325,16 @@ static inline int _setup_loops(struct pl330_dmac *pl330, - } - - static inline int _setup_xfer(struct pl330_dmac *pl330, -- unsigned dry_run, u8 buf[], u32 period, -+ unsigned dry_run, u8 buf[], - const struct _xfer_spec *pxs) - { - struct pl330_xfer *x = &pxs->desc->px; -- struct pl330_reqcfg *rqcfg = &pxs->desc->rqcfg; - int off = 0; - - /* DMAMOV SAR, x->src_addr */ -- off += _emit_MOV(dry_run, &buf[off], SAR, -- x->src_addr + rqcfg->src_inc * period * x->bytes); -+ off += _emit_MOV(dry_run, &buf[off], SAR, x->src_addr); - /* DMAMOV DAR, x->dst_addr */ -- off += _emit_MOV(dry_run, &buf[off], DAR, -- x->dst_addr + rqcfg->dst_inc * period * x->bytes); -+ off += _emit_MOV(dry_run, &buf[off], DAR, x->dst_addr); - - /* Setup Loop(s) */ - off += _setup_loops(pl330, dry_run, &buf[off], pxs); -@@ -1372,14 +1368,11 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - struct pl330_xfer *x; - u8 *buf = req->mc_cpu; - int off = 0; -- int period; -- int again_off; - - PL330_DBGMC_START(req->mc_bus); - - /* DMAMOV CCR, ccr */ - off += _emit_MOV(dry_run, &buf[off], CCR, pxs->ccr); -- again_off = off; - - x = &pxs->desc->px; - if (pl330->peripherals_req_type != BURST) { -@@ -1388,27 +1381,12 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - return -EINVAL; - } - -- for (period = 0; period < pxs->desc->num_periods; period++) { -- off += _setup_xfer(pl330, dry_run, &buf[off], period, pxs); -- -- /* DMASEV peripheral/event */ -- off += _emit_SEV(dry_run, &buf[off], thrd->ev); -- } -+ off += _setup_xfer(pl330, dry_run, &buf[off], pxs); - -- if (!pxs->desc->cyclic) { -- /* DMAEND */ -- off += _emit_END(dry_run, &buf[off]); -- } else { -- struct _arg_LPEND lpend; -- /* LP */ -- off += _emit_LP(dry_run, &buf[off], 0, 255); -- /* LPEND */ -- lpend.cond = ALWAYS; -- lpend.forever = false; -- lpend.loop = 0; -- lpend.bjump = off - again_off; -- off += _emit_LPEND(dry_run, &buf[off], &lpend); -- } -+ /* DMASEV peripheral/event */ -+ off += _emit_SEV(dry_run, &buf[off], thrd->ev); -+ /* DMAEND */ -+ off += _emit_END(dry_run, &buf[off]); - - return off; - } -@@ -1670,13 +1648,12 @@ static int pl330_update(struct pl330_dmac *pl330) - - /* Detach the req */ - descdone = thrd->req[active].desc; -+ thrd->req[active].desc = NULL; - -- if (!descdone->cyclic) { -- thrd->req[active].desc = NULL; -- thrd->req_running = -1; -- /* Get going again ASAP */ -- _start(thrd); -- } -+ thrd->req_running = -1; -+ -+ /* Get going again ASAP */ -+ _start(thrd); - - /* For now, just make a list of callbacks to be done */ - list_add_tail(&descdone->rqd, &pl330->req_done); -@@ -2049,27 +2026,12 @@ static void pl330_tasklet(unsigned long data) - spin_lock_irqsave(&pch->lock, flags); - - /* Pick up ripe tomatoes */ -- list_for_each_entry_safe(desc, _dt, &pch->work_list, node) { -+ list_for_each_entry_safe(desc, _dt, &pch->work_list, node) - if (desc->status == DONE) { -- if (!desc->cyclic) { -+ if (!pch->cyclic) - dma_cookie_complete(&desc->txd); -- list_move_tail(&desc->node, &pch->completed_list); -- } else { -- dma_async_tx_callback callback; -- void *callback_param; -- -- desc->status = BUSY; -- callback = desc->txd.callback; -- callback_param = desc->txd.callback_param; -- -- if (callback) { -- spin_unlock_irqrestore(&pch->lock, flags); -- callback(callback_param); -- spin_lock_irqsave(&pch->lock, flags); -- } -- } -+ list_move_tail(&desc->node, &pch->completed_list); - } -- } - - /* Try to submit a req imm. next to the last completed cookie */ - fill_queue(pch); -@@ -2097,8 +2059,20 @@ static void pl330_tasklet(unsigned long data) - callback = desc->txd.callback; - callback_param = desc->txd.callback_param; - -- desc->status = FREE; -- list_move_tail(&desc->node, &pch->dmac->desc_pool); -+ if (pch->cyclic) { -+ desc->status = PREP; -+ list_move_tail(&desc->node, &pch->work_list); -+ if (power_down) { -+ pch->active = true; -+ spin_lock(&pch->thread->dmac->lock); -+ _start(pch->thread); -+ spin_unlock(&pch->thread->dmac->lock); -+ power_down = false; -+ } -+ } else { -+ desc->status = FREE; -+ list_move_tail(&desc->node, &pch->dmac->desc_pool); -+ } - - dma_descriptor_unmap(&desc->txd); - -@@ -2158,6 +2132,7 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan) - spin_lock_irqsave(&pl330->lock, flags); - - dma_cookie_init(chan); -+ pch->cyclic = false; - - pch->thread = pl330_request_channel(pl330); - if (!pch->thread) { -@@ -2281,7 +2256,8 @@ static void pl330_free_chan_resources(struct dma_chan *chan) - pl330_release_channel(pch->thread); - pch->thread = NULL; - -- list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool); -+ if (pch->cyclic) -+ list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool); - - spin_unlock_irqrestore(&pl330->lock, flags); - pm_runtime_mark_last_busy(pch->dmac->ddma.dev); -@@ -2335,7 +2311,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - - /* Check in pending list */ - list_for_each_entry(desc, &pch->work_list, node) { -- if (desc->status == DONE && !desc->cyclic) -+ if (desc->status == DONE) - transferred = desc->bytes_requested; - else if (running && desc == running) - transferred = -@@ -2407,8 +2383,12 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx) - /* Assign cookies to all nodes */ - while (!list_empty(&last->node)) { - desc = list_entry(last->node.next, struct dma_pl330_desc, node); -- -+ if (pch->cyclic) { -+ desc->txd.callback = last->txd.callback; -+ desc->txd.callback_param = last->txd.callback_param; -+ } - desc->last = false; -+ - dma_cookie_assign(&desc->txd); - - list_move_tail(&desc->node, &pch->submitted_list); -@@ -2508,9 +2488,6 @@ static struct dma_pl330_desc *pl330_get_desc(struct dma_pl330_chan *pch) - desc->peri = peri_id ? pch->chan.chan_id : 0; - desc->rqcfg.pcfg = &pch->dmac->pcfg; - -- desc->cyclic = false; -- desc->num_periods = 1; -- - dma_async_tx_descriptor_init(&desc->txd, &pch->chan); - - return desc; -@@ -2580,8 +2557,10 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - size_t period_len, enum dma_transfer_direction direction, - unsigned long flags) - { -- struct dma_pl330_desc *desc = NULL; -+ struct dma_pl330_desc *desc = NULL, *first = NULL; - struct dma_pl330_chan *pch = to_pchan(chan); -+ struct pl330_dmac *pl330 = pch->dmac; -+ unsigned int i; - dma_addr_t dst; - dma_addr_t src; - -@@ -2594,38 +2573,70 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - return NULL; - } - -- desc = pl330_get_desc(pch); -- if (!desc) { -- dev_err(pch->dmac->ddma.dev, "%s:%d Unable to fetch desc\n", -- __func__, __LINE__); -- return NULL; -- } -+ for (i = 0; i < len / period_len; i++) { -+ desc = pl330_get_desc(pch); -+ if (!desc) { -+ dev_err(pch->dmac->ddma.dev, "%s:%d Unable to fetch desc\n", -+ __func__, __LINE__); - -- switch (direction) { -- case DMA_MEM_TO_DEV: -- desc->rqcfg.src_inc = 1; -- desc->rqcfg.dst_inc = 0; -- src = dma_addr; -- dst = pch->fifo_addr; -- break; -- case DMA_DEV_TO_MEM: -- desc->rqcfg.src_inc = 0; -- desc->rqcfg.dst_inc = 1; -- src = pch->fifo_addr; -- dst = dma_addr; -- break; -- default: -- break; -+ if (!first) -+ return NULL; -+ -+ spin_lock_irqsave(&pl330->pool_lock, flags); -+ -+ while (!list_empty(&first->node)) { -+ desc = list_entry(first->node.next, -+ struct dma_pl330_desc, node); -+ list_move_tail(&desc->node, &pl330->desc_pool); -+ } -+ -+ list_move_tail(&first->node, &pl330->desc_pool); -+ -+ spin_unlock_irqrestore(&pl330->pool_lock, flags); -+ -+ return NULL; -+ } -+ -+ switch (direction) { -+ case DMA_MEM_TO_DEV: -+ desc->rqcfg.src_inc = 1; -+ desc->rqcfg.dst_inc = 0; -+ src = dma_addr; -+ dst = pch->fifo_addr; -+ break; -+ case DMA_DEV_TO_MEM: -+ desc->rqcfg.src_inc = 0; -+ desc->rqcfg.dst_inc = 1; -+ src = pch->fifo_addr; -+ dst = dma_addr; -+ break; -+ default: -+ break; -+ } -+ -+ desc->rqtype = direction; -+ desc->rqcfg.brst_size = pch->burst_sz; -+ -+ if (pl330->peripherals_req_type == BURST) -+ desc->rqcfg.brst_len = pch->burst_len; -+ else -+ desc->rqcfg.brst_len = 1; -+ -+ desc->bytes_requested = period_len; -+ fill_px(&desc->px, dst, src, period_len); -+ -+ if (!first) -+ first = desc; -+ else -+ list_add_tail(&desc->node, &first->node); -+ -+ dma_addr += period_len; - } - -- desc->rqtype = direction; -- desc->rqcfg.brst_size = pch->burst_sz; -- desc->rqcfg.brst_len = pch->burst_len; -- desc->bytes_requested = len; -- fill_px(&desc->px, dst, src, period_len); -+ if (!desc) -+ return NULL; - -- desc->cyclic = true; -- desc->num_periods = len / period_len; -+ pch->cyclic = true; - desc->txd.flags = flags; - - return &desc->txd; - -From ef009783e673113536eb2c9809f3787f5aeef87a Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sun, 22 Jul 2018 16:07:46 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: fix error message to - dev_err_ratelimited" - -This reverts commit e25503f147cf665b6fc910983859d9f94eaf0d00. ---- - drivers/dma/pl330.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index ad9d616551f8..3d5d91084605 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1620,8 +1620,8 @@ static int pl330_update(struct pl330_dmac *pl330) - if (pl330->pcfg.num_events < 32 - && val & ~((1 << pl330->pcfg.num_events) - 1)) { - pl330->dmac_tbd.reset_dmac = true; -- dev_err_ratelimited(pl330->ddma.dev, "%s:%d Unexpected!\n", -- __func__, __LINE__); -+ dev_err(pl330->ddma.dev, "%s:%d Unexpected!\n", __func__, -+ __LINE__); - ret = 1; - goto updt_exit; - } - -From 45c38c611da7df545138bf436f43e78481a6fa1a Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Fri, 16 Jun 2017 23:14:55 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: support transfer that doesn't align - with (burst len * burst size)" - -This reverts commit c66ecf19b98ffac86177c29859e683de39f44e73. ---- - drivers/dma/pl330.c | 23 +++-------------------- - 1 file changed, 3 insertions(+), 20 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 3d5d91084605..2f5f8d40147c 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -240,7 +240,6 @@ enum pl330_byteswap { - - #define BYTE_TO_BURST(b, ccr) ((b) / BRST_SIZE(ccr) / BRST_LEN(ccr)) - #define BURST_TO_BYTE(c, ccr) ((c) * BRST_SIZE(ccr) * BRST_LEN(ccr)) --#define BYTE_MOD_BURST_LEN(b, ccr) (((b) / BRST_SIZE(ccr)) % BRST_LEN(ccr)) - - /* - * With 256 bytes, we can do more than 2.5MB and 5MB xfers per req -@@ -1339,20 +1338,6 @@ static inline int _setup_xfer(struct pl330_dmac *pl330, - /* Setup Loop(s) */ - off += _setup_loops(pl330, dry_run, &buf[off], pxs); - -- if (pl330->peripherals_req_type == BURST) { -- unsigned int ccr = pxs->ccr; -- unsigned long c = 0; -- -- c = BYTE_MOD_BURST_LEN(x->bytes, pxs->ccr); -- -- if (c) { -- ccr &= ~(0xf << CC_SRCBRSTLEN_SHFT); -- ccr &= ~(0xf << CC_DSTBRSTLEN_SHFT); -- off += _emit_MOV(dry_run, &buf[off], CCR, ccr); -- off += _loop(pl330, dry_run, &buf[off], &c, pxs); -- } -- } -- - return off; - } - -@@ -1375,11 +1360,9 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - off += _emit_MOV(dry_run, &buf[off], CCR, pxs->ccr); - - x = &pxs->desc->px; -- if (pl330->peripherals_req_type != BURST) { -- /* Error if xfer length is not aligned at burst size */ -- if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -- return -EINVAL; -- } -+ /* Error if xfer length is not aligned at burst size */ -+ if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -+ return -EINVAL; - - off += _setup_xfer(pl330, dry_run, &buf[off], pxs); - - -From 0be5f99a27515b375304a2dc85226a2fd3d560cd Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Fri, 16 Jun 2017 23:14:55 +0200 -Subject: [PATCH] Revert "dmaengine: pl330: add burst mode according to dts - config" - -This reverts commit 8e770f371cc27f8828cb9ceb0516adc23fe75995. ---- - drivers/dma/pl330.c | 36 ++++++++++++++---------------------- - 1 file changed, 14 insertions(+), 22 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 2f5f8d40147c..f7977979cbf5 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -494,8 +494,6 @@ struct pl330_dmac { - /* Peripheral channels connected to this DMAC */ - unsigned int num_peripherals; - struct dma_pl330_chan *peripherals; /* keep at end */ -- /* set peripherals request type according to soc config*/ -- enum pl330_cond peripherals_req_type; - int quirks; - }; - -@@ -1165,7 +1163,12 @@ static inline int _ldst_devtomem(struct pl330_dmac *pl330, unsigned dry_run, - int cyc) - { - int off = 0; -- enum pl330_cond cond = pl330->peripherals_req_type; -+ enum pl330_cond cond; -+ -+ if (pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) -+ cond = BURST; -+ else -+ cond = SINGLE; - - while (cyc--) { - off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); -@@ -1185,7 +1188,12 @@ static inline int _ldst_memtodev(struct pl330_dmac *pl330, - const struct _xfer_spec *pxs, int cyc) - { - int off = 0; -- enum pl330_cond cond = pl330->peripherals_req_type; -+ enum pl330_cond cond; -+ -+ if (pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) -+ cond = BURST; -+ else -+ cond = SINGLE; - - while (cyc--) { - off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); -@@ -2599,12 +2607,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - - desc->rqtype = direction; - desc->rqcfg.brst_size = pch->burst_sz; -- -- if (pl330->peripherals_req_type == BURST) -- desc->rqcfg.brst_len = pch->burst_len; -- else -- desc->rqcfg.brst_len = 1; -- -+ desc->rqcfg.brst_len = 1; - desc->bytes_requested = period_len; - fill_px(&desc->px, dst, src, period_len); - -@@ -2706,7 +2709,6 @@ pl330_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - { - struct dma_pl330_desc *first, *desc = NULL; - struct dma_pl330_chan *pch = to_pchan(chan); -- struct pl330_dmac *pl330 = pch->dmac; - struct scatterlist *sg; - int i; - dma_addr_t addr; -@@ -2750,12 +2752,7 @@ pl330_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - } - - desc->rqcfg.brst_size = pch->burst_sz; -- -- if (pl330->peripherals_req_type == BURST) -- desc->rqcfg.brst_len = pch->burst_len; -- else -- desc->rqcfg.brst_len = 1; -- -+ desc->rqcfg.brst_len = 1; - desc->rqtype = direction; - desc->bytes_requested = sg_dma_len(sg); - } -@@ -2851,11 +2848,6 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - - pl330->mcbufsz = pdat ? pdat->mcbuf_sz : 0; - -- if (of_find_property(np, "peripherals-req-type-burst", NULL)) -- pl330->peripherals_req_type = BURST; -- else -- pl330->peripherals_req_type = SINGLE; -- - /* get quirk */ - for (i = 0; i < ARRAY_SIZE(of_quirks); i++) - if (of_property_read_bool(np, of_quirks[i].quirk)) - -From a3456e55253a88214f07c72127744eee7e81ede1 Mon Sep 17 00:00:00 2001 -From: Vinod Koul -Date: Tue, 5 Jul 2016 10:02:16 +0530 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: explicitly freeup irq - -dmaengine device should explicitly call devm_free_irq() when using -devm_request_irq(). - -The irq is still ON when devices remove is executed and irq should be -quiesced before remove is completed. - -Signed-off-by: Vinod Koul -Cc: Jassi Brar -Cc: Linus Walleij -(cherry picked from commit 46cf94d6ab38420690d890d9922bfc61a7b3e2c5) ---- - drivers/dma/pl330.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index f7977979cbf5..b6793b0d53c9 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -3015,12 +3015,18 @@ static int pl330_remove(struct amba_device *adev) - { - struct pl330_dmac *pl330 = amba_get_drvdata(adev); - struct dma_pl330_chan *pch, *_p; -+ int i, irq; - - pm_runtime_get_noresume(pl330->ddma.dev); - - if (adev->dev.of_node) - of_dma_controller_free(adev->dev.of_node); - -+ for (i = 0; i < AMBA_NR_IRQS; i++) { -+ irq = adev->irq[i]; -+ devm_free_irq(&adev->dev, irq, pl330); -+ } -+ - dma_async_device_unregister(&pl330->ddma); - - /* Idle the DMAC */ - -From f1fd696d39b9ded57b30f79bbe23317262481a80 Mon Sep 17 00:00:00 2001 -From: Stephen Barber -Date: Thu, 18 Aug 2016 17:59:59 -0700 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: fix residual for non-running BUSY - descriptors - -Only one descriptor in the work list should be running at -any given time, but it's possible to have an enqueued BUSY -descriptor that has not yet transferred any data, or for -a BUSY descriptor to linger briefly before transitioning -to DONE. These cases should be handled to keep residual -calculations consistent even with the non-running BUSY -descriptors in the work list. - -Signed-off-by: Stephen Barber -Signed-off-by: Vinod Koul -(cherry picked from commit d64e9a2c750930272492952c16f3f2c95311a6c9) ---- - drivers/dma/pl330.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index b6793b0d53c9..7e05ef5ba37f 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2283,7 +2283,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - { - enum dma_status ret; - unsigned long flags; -- struct dma_pl330_desc *desc, *running = NULL; -+ struct dma_pl330_desc *desc, *running = NULL, *last_enq = NULL; - struct dma_pl330_chan *pch = to_pchan(chan); - unsigned int transferred, residual = 0; - -@@ -2300,6 +2300,8 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - if (pch->thread->req_running != -1) - running = pch->thread->req[pch->thread->req_running].desc; - -+ last_enq = pch->thread->req[pch->thread->lstenq].desc; -+ - /* Check in pending list */ - list_for_each_entry(desc, &pch->work_list, node) { - if (desc->status == DONE) -@@ -2307,6 +2309,15 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - else if (running && desc == running) - transferred = - pl330_get_current_xferred_count(pch, desc); -+ else if (desc->status == BUSY) -+ /* -+ * Busy but not running means either just enqueued, -+ * or finished and not yet marked done -+ */ -+ if (desc == last_enq) -+ transferred = 0; -+ else -+ transferred = desc->bytes_requested; - else - transferred = 0; - residual += desc->bytes_requested - transferred; - -From 5cb6529514e53ca8db016137788675be769a75b7 Mon Sep 17 00:00:00 2001 -From: Hsin-Yu Chao -Date: Tue, 23 Aug 2016 17:16:55 +0800 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: Acquire dmac's spinlock in - pl330_tx_status - -There is a racing when accessing dmac thread in pl330_tx_status that -the pl330_update is handling active request at the same time and -changing the status of descriptors. This could cause an invalid -transferred count from BUSY descriptor added up to the residual number. -Fix the bug by using the dmac's spinlock in pl330_tx_status to protect -thread resources from changing. -Note that the nested order of holding dmac's and dma_chan's spinlock is -consistent with the rest of the driver: dma_chan first and then dmac, -so it is safe from deadlock scenario. - -Signed-off-by: Hsin-Yu Chao -Reviewed-by: Guenter Roeck -Signed-off-by: Vinod Koul -(cherry picked from commit a40235a2278a315261ee007fc433ec1cfb31666f) ---- - drivers/dma/pl330.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 7e05ef5ba37f..93efdcc54f19 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2296,6 +2296,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - goto out; - - spin_lock_irqsave(&pch->lock, flags); -+ spin_lock(&pch->thread->dmac->lock); - - if (pch->thread->req_running != -1) - running = pch->thread->req[pch->thread->req_running].desc; -@@ -2338,6 +2339,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, - if (desc->last) - residual = 0; - } -+ spin_unlock(&pch->thread->dmac->lock); - spin_unlock_irqrestore(&pch->lock, flags); - - out: - -From cd1b3fa8ef7ec0a775321d44d2f5469ffbab7431 Mon Sep 17 00:00:00 2001 -From: Stephen Barber -Date: Tue, 1 Nov 2016 16:44:27 -0700 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: Handle xferred count if DMAMOV - hasn't finished - -After executing DMAGO it's possible that a request can come in for the -current xferred count, but if that happens too soon then DMAMOV SAR/DAR -may not have yet completed. If that happens, we should explicitly return 0 -since nothing has been transferred yet. - -Signed-off-by: Stephen Barber -Signed-off-by: Vinod Koul -(cherry picked from commit c44da03dd517c11c2b3525937b0a241fc1c69399) ---- - drivers/dma/pl330.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 93efdcc54f19..497cc048feaa 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2274,6 +2274,11 @@ static int pl330_get_current_xferred_count(struct dma_pl330_chan *pch, - } - pm_runtime_mark_last_busy(pch->dmac->ddma.dev); - pm_runtime_put_autosuspend(pl330->ddma.dev); -+ -+ /* If DMAMOV hasn't finished yet, SAR/DAR can be zero */ -+ if (!val) -+ return 0; -+ - return val - addr; - } - - -From 5f387aa530599beb607885a28a5bbf8f50d1dbb6 Mon Sep 17 00:00:00 2001 -From: Vladimir Murzin -Date: Wed, 7 Dec 2016 13:17:40 +0000 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: do not generate unaligned access - -When PL330 is used with !MMU the following fault is seen: - -Unhandled fault: alignment exception (0x801) at 0x8f26a002 -Internal error: : 801 [#1] ARM -Modules linked in: -CPU: 0 PID: 640 Comm: dma0chan0-copy0 Not tainted 4.8.0-6a82063-clean+ #1600 -Hardware name: ARM-Versatile Express -task: 8f1baa80 task.stack: 8e6fe000 -PC is at _setup_req+0x4c/0x350 -LR is at 0x8f2cbc00 -pc : [<801ea538>] lr : [<8f2cbc00>] psr: 60000093 -sp : 8e6ffdc0 ip : 00000000 fp : 00000000 -r10: 00000000 r9 : 8f2cba10 r8 : 8f2cbc00 -r7 : 80000013 r6 : 8f21a050 r5 : 8f21a000 r4 : 8f2ac800 -r3 : 8e6ffe18 r2 : 00944251 r1 : ffffffbc r0 : 8f26a000 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none -Control: 00c5387c -Process dma0chan0-copy0 (pid: 640, stack limit = 0x8e6fe210) -Stack: (0x8e6ffdc0 to 0x8e700000) -fdc0: 00000001 60000093 00000000 8f2cba10 8f26a000 00000004 8f0ae000 8f2cbc00 -fde0: 8f0ae000 8f2ac800 8f21a000 8f21a050 80000013 8f2cbc00 8f2cba10 00000000 -fe00: 60000093 801ebca0 8e6ffe18 000013ff 40000093 00000000 00944251 8f2ac800 -fe20: a0000013 8f2b1320 00001986 00000000 00000001 000013ff 8f1e4f00 8f2cba10 -fe40: 8e6fff6c 801e9044 00000003 00000000 fef98c80 002faf07 8e6ffe7c 00000000 -fe60: 00000002 00000000 00001986 8f1f158d 8f1e4f00 80568de4 00000002 00000000 -fe80: 00001986 8f1f53ff 40000001 80580500 8f1f158d 8001e00c 00000000 cfdfdfdf -fea0: fdae2a25 00000001 00000004 8e6fe000 00000008 00000010 00000000 00000005 -fec0: 8f2b1330 8f2b1334 8e6ffe80 8e6ffe8c 00001986 00000000 8f21a014 00000001 -fee0: 8e6ffe60 8e6ffe78 00000002 00000000 000013ff 00000001 80568de4 8f1e8018 -ff00: 0000158d 8055ec30 00000001 803f6b00 00001986 8f2cba10 fdae2a25 00000001 -ff20: 8f1baca8 8e6fff24 8e6fff24 00000000 8e6fff24 ac6f3037 00000000 00000000 -ff40: 00000000 8e6fe000 8f1e4f40 00000000 8f1e4f40 8f1e4f00 801e84ec 00000000 -ff60: 00000000 00000000 00000000 80031714 dfdfdfcf 00000000 dfdfdfcf 8f1e4f00 -ff80: 00000000 8e6fff84 8e6fff84 00000000 8e6fff90 8e6fff90 8e6fffac 8f1e4f40 -ffa0: 80031640 00000000 00000000 8000f548 00000000 00000000 00000000 00000000 -ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 -ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 dfdfdfcf cfdfdfdf -[<801ea538>] (_setup_req) from [<801ebca0>] (pl330_tasklet+0x41c/0x490) -[<801ebca0>] (pl330_tasklet) from [<801e9044>] (dmatest_func+0xb58/0x149c) -[<801e9044>] (dmatest_func) from [<80031714>] (kthread+0xd4/0xec) -[<80031714>] (kthread) from [<8000f548>] (ret_from_fork+0x14/0x2c) -Code: e3a03001 e3e01043 e5c03001 e59d3048 (e5802002) - -This happens because _emit_{ADDH,MOV,GO) accessing to unaligned data -while writing to buffer. Fix it with writing to buffer byte by byte. - -Reviewed-by: Robin Murphy -Tested-by: Robin Murphy -Signed-off-by: Vladimir Murzin -Signed-off-by: Vinod Koul -(cherry picked from commit d07c9e1e212c9687f9198bfeba582e86cae3f6f9) ---- - drivers/dma/pl330.c | 15 ++++++++++----- - 1 file changed, 10 insertions(+), 5 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 497cc048feaa..eb274eeda0aa 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -573,7 +573,8 @@ static inline u32 _emit_ADDH(unsigned dry_run, u8 buf[], - - buf[0] = CMD_DMAADDH; - buf[0] |= (da << 1); -- *((__le16 *)&buf[1]) = cpu_to_le16(val); -+ buf[1] = val; -+ buf[2] = val >> 8; - - PL330_DBGCMD_DUMP(SZ_DMAADDH, "\tDMAADDH %s %u\n", - da == 1 ? "DA" : "SA", val); -@@ -727,7 +728,10 @@ static inline u32 _emit_MOV(unsigned dry_run, u8 buf[], - - buf[0] = CMD_DMAMOV; - buf[1] = dst; -- *((__le32 *)&buf[2]) = cpu_to_le32(val); -+ buf[2] = val; -+ buf[3] = val >> 8; -+ buf[4] = val >> 16; -+ buf[5] = val >> 24; - - PL330_DBGCMD_DUMP(SZ_DMAMOV, "\tDMAMOV %s 0x%x\n", - dst == SAR ? "SAR" : (dst == DAR ? "DAR" : "CCR"), val); -@@ -902,10 +906,11 @@ static inline u32 _emit_GO(unsigned dry_run, u8 buf[], - - buf[0] = CMD_DMAGO; - buf[0] |= (ns << 1); -- - buf[1] = chan & 0x7; -- -- *((__le32 *)&buf[2]) = cpu_to_le32(addr); -+ buf[2] = addr; -+ buf[3] = addr >> 8; -+ buf[4] = addr >> 16; -+ buf[5] = addr >> 24; - - return SZ_DMAGO; - } - -From 90b0d473241a84db9a284123c7357231a0ffd7d2 Mon Sep 17 00:00:00 2001 -From: Vinod Koul -Date: Fri, 9 Dec 2016 15:24:12 +0530 -Subject: [PATCH] =?UTF-8?q?UPSTREAM:=20dmaengine:=20pl330:=20remove=20unus?= - =?UTF-8?q?ed=20=E2=80=98regs=E2=80=99?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -In pl330_add(), variable ‘regs’ is initialized but never used, which -leads to warning with W=1. - -drivers/dma/pl330.c: In function 'pl330_add': -drivers/dma/pl330.c:1891:16: warning: variable 'regs' set but not used [-Wunused-but-set-variable] - -So remove it. - -Cc: Linus Walleij -Signed-off-by: Vinod Koul -(cherry picked from commit 920e00d62ef9a818a4af7b2f9e1dbca23f846fc1) ---- - drivers/dma/pl330.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index eb274eeda0aa..14efb0e4a6a8 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1889,11 +1889,8 @@ static int dmac_alloc_resources(struct pl330_dmac *pl330) - - static int pl330_add(struct pl330_dmac *pl330) - { -- void __iomem *regs; - int i, ret; - -- regs = pl330->base; -- - /* Check if we can handle this DMAC */ - if ((pl330->pcfg.periph_id & 0xfffff) != PERIPH_ID_VAL) { - dev_err(pl330->ddma.dev, "PERIPH_ID 0x%x !\n", - -From 10abe915578c8bbd0e2621a255718beecc6a3425 Mon Sep 17 00:00:00 2001 -From: Marek Szyprowski -Date: Mon, 27 Mar 2017 07:31:03 +0200 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: remove pdata based initialization - -This driver is now used only on platforms which support device tree, so -it is safe to remove legacy platform data based initialization code. - -Signed-off-by: Marek Szyprowski -Reviewed-by: Ulf Hansson -Acked-by: Arnd Bergmann -For plat-samsung: -Acked-by: Krzysztof Kozlowski -Signed-off-by: Vinod Koul -(cherry picked from commit e8bb4673596ea28fab287dbc417e8100d798cd40) ---- - arch/arm/plat-samsung/devs.c | 1 - - drivers/dma/pl330.c | 42 ++++++++---------------------------------- - include/linux/amba/pl330.h | 35 ----------------------------------- - 3 files changed, 8 insertions(+), 70 deletions(-) - delete mode 100644 include/linux/amba/pl330.h - -diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c -index e212f9d804bd..2ef19ad5cb62 100644 ---- a/arch/arm/plat-samsung/devs.c -+++ b/arch/arm/plat-samsung/devs.c -@@ -10,7 +10,6 @@ - * published by the Free Software Foundation. - */ - --#include - #include - #include - #include -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 14efb0e4a6a8..8d6c483663dc 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -22,7 +22,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -2084,18 +2083,6 @@ static void pl330_tasklet(unsigned long data) - } - } - --bool pl330_filter(struct dma_chan *chan, void *param) --{ -- u8 *peri_id; -- -- if (chan->device->dev->driver != &pl330_driver.drv) -- return false; -- -- peri_id = chan->private; -- return *peri_id == (unsigned long)param; --} --EXPORT_SYMBOL(pl330_filter); -- - static struct dma_chan *of_dma_pl330_xlate(struct of_phandle_args *dma_spec, - struct of_dma *ofdma) - { -@@ -2840,7 +2827,6 @@ static SIMPLE_DEV_PM_OPS(pl330_pm, pl330_suspend, pl330_resume); - static int - pl330_probe(struct amba_device *adev, const struct amba_id *id) - { -- struct dma_pl330_platdata *pdat; - struct pl330_config *pcfg; - struct pl330_dmac *pl330; - struct dma_pl330_chan *pch, *_p; -@@ -2850,8 +2836,6 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - int num_chan; - struct device_node *np = adev->dev.of_node; - -- pdat = dev_get_platdata(&adev->dev); -- - ret = dma_set_mask_and_coherent(&adev->dev, DMA_BIT_MASK(32)); - if (ret) - return ret; -@@ -2866,7 +2850,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - pd = &pl330->ddma; - pd->dev = &adev->dev; - -- pl330->mcbufsz = pdat ? pdat->mcbuf_sz : 0; -+ pl330->mcbufsz = 0; - - /* get quirk */ - for (i = 0; i < ARRAY_SIZE(of_quirks); i++) -@@ -2910,10 +2894,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - INIT_LIST_HEAD(&pd->channels); - - /* Initialize channel parameters */ -- if (pdat) -- num_chan = max_t(int, pdat->nr_valid_peri, pcfg->num_chan); -- else -- num_chan = max_t(int, pcfg->num_peri, pcfg->num_chan); -+ num_chan = max_t(int, pcfg->num_peri, pcfg->num_chan); - - pl330->num_peripherals = num_chan; - -@@ -2926,11 +2907,8 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - - for (i = 0; i < num_chan; i++) { - pch = &pl330->peripherals[i]; -- if (!adev->dev.of_node) -- pch->chan.private = pdat ? &pdat->peri_id[i] : NULL; -- else -- pch->chan.private = adev->dev.of_node; - -+ pch->chan.private = adev->dev.of_node; - INIT_LIST_HEAD(&pch->submitted_list); - INIT_LIST_HEAD(&pch->work_list); - INIT_LIST_HEAD(&pch->completed_list); -@@ -2943,15 +2921,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - list_add_tail(&pch->chan.device_node, &pd->channels); - } - -- if (pdat) { -- pd->cap_mask = pdat->cap_mask; -- } else { -- dma_cap_set(DMA_MEMCPY, pd->cap_mask); -- if (pcfg->num_peri) { -- dma_cap_set(DMA_SLAVE, pd->cap_mask); -- dma_cap_set(DMA_CYCLIC, pd->cap_mask); -- dma_cap_set(DMA_PRIVATE, pd->cap_mask); -- } -+ dma_cap_set(DMA_MEMCPY, pd->cap_mask); -+ if (pcfg->num_peri) { -+ dma_cap_set(DMA_SLAVE, pd->cap_mask); -+ dma_cap_set(DMA_CYCLIC, pd->cap_mask); -+ dma_cap_set(DMA_PRIVATE, pd->cap_mask); - } - - pd->device_alloc_chan_resources = pl330_alloc_chan_resources; -diff --git a/include/linux/amba/pl330.h b/include/linux/amba/pl330.h -deleted file mode 100644 -index fe93758e8403..000000000000 ---- a/include/linux/amba/pl330.h -+++ /dev/null -@@ -1,35 +0,0 @@ --/* linux/include/linux/amba/pl330.h -- * -- * Copyright (C) 2010 Samsung Electronics Co. Ltd. -- * Jaswinder Singh -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License as published by -- * the Free Software Foundation; either version 2 of the License, or -- * (at your option) any later version. -- */ -- --#ifndef __AMBA_PL330_H_ --#define __AMBA_PL330_H_ -- --#include -- --struct dma_pl330_platdata { -- /* -- * Number of valid peripherals connected to DMAC. -- * This may be different from the value read from -- * CR0, as the PL330 implementation might have 'holes' -- * in the peri list or the peri could also be reached -- * from another DMAC which the platform prefers. -- */ -- u8 nr_valid_peri; -- /* Array of valid peripherals */ -- u8 *peri_id; -- /* Operational capabilities */ -- dma_cap_mask_t cap_mask; -- /* Bytes to allocate for MC buffer */ -- unsigned mcbuf_sz; --}; -- --extern bool pl330_filter(struct dma_chan *chan, void *param); --#endif /* __AMBA_PL330_H_ */ - -From 1ecb8e7abb5ba82380d83c7951621faeba06389e Mon Sep 17 00:00:00 2001 -From: Jean-Philippe Brucker -Date: Thu, 1 Jun 2017 19:22:01 +0100 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: fix warning in pl330_remove - -When removing a device with less than 9 IRQs (AMBA_NR_IRQS), we'll get a -big WARN_ON from devres.c because pl330_remove calls devm_free_irqs for -unallocated irqs. Similarly to pl330_probe, check that IRQ number is -present before calling devm_free_irq. - -Signed-off-by: Jean-Philippe Brucker -Signed-off-by: Vinod Koul -(cherry picked from commit ebcdaee4cebb3a8d0d702ab5e9392373672ec1de) ---- - drivers/dma/pl330.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 8d6c483663dc..f6a4a89ae8aa 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -3018,7 +3018,8 @@ static int pl330_remove(struct amba_device *adev) - - for (i = 0; i < AMBA_NR_IRQS; i++) { - irq = adev->irq[i]; -- devm_free_irq(&adev->dev, irq, pl330); -+ if (irq) -+ devm_free_irq(&adev->dev, irq, pl330); - } - - dma_async_device_unregister(&pl330->ddma); - -From 7d8694893a9e8d32c82b52fa589fe1e5660ec590 Mon Sep 17 00:00:00 2001 -From: Matthias Kaehlcke -Date: Thu, 15 Jun 2017 16:55:57 -0700 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: Delete unused functions - -The functions _queue_empty(), _emit_ADDH(), _emit_NOP(), _emit_STZ() -and _emit_WFE() are not used. Delete them. - -Signed-off-by: Matthias Kaehlcke -Signed-off-by: Vinod Koul -(cherry picked from commit d43674ecc002b49926f216cb414cff2d230ca3fb) ---- - drivers/dma/pl330.c | 67 ----------------------------------------------------- - 1 file changed, 67 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index f6a4a89ae8aa..bd4a0c3deaf6 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -538,11 +538,6 @@ struct _xfer_spec { - struct dma_pl330_desc *desc; - }; - --static inline bool _queue_empty(struct pl330_thread *thrd) --{ -- return thrd->req[0].desc == NULL && thrd->req[1].desc == NULL; --} -- - static inline bool _queue_full(struct pl330_thread *thrd) - { - return thrd->req[0].desc != NULL && thrd->req[1].desc != NULL; -@@ -564,23 +559,6 @@ static inline u32 get_revision(u32 periph_id) - return (periph_id >> PERIPH_REV_SHIFT) & PERIPH_REV_MASK; - } - --static inline u32 _emit_ADDH(unsigned dry_run, u8 buf[], -- enum pl330_dst da, u16 val) --{ -- if (dry_run) -- return SZ_DMAADDH; -- -- buf[0] = CMD_DMAADDH; -- buf[0] |= (da << 1); -- buf[1] = val; -- buf[2] = val >> 8; -- -- PL330_DBGCMD_DUMP(SZ_DMAADDH, "\tDMAADDH %s %u\n", -- da == 1 ? "DA" : "SA", val); -- -- return SZ_DMAADDH; --} -- - static inline u32 _emit_END(unsigned dry_run, u8 buf[]) - { - if (dry_run) -@@ -738,18 +716,6 @@ static inline u32 _emit_MOV(unsigned dry_run, u8 buf[], - return SZ_DMAMOV; - } - --static inline u32 _emit_NOP(unsigned dry_run, u8 buf[]) --{ -- if (dry_run) -- return SZ_DMANOP; -- -- buf[0] = CMD_DMANOP; -- -- PL330_DBGCMD_DUMP(SZ_DMANOP, "\tDMANOP\n"); -- -- return SZ_DMANOP; --} -- - static inline u32 _emit_RMB(unsigned dry_run, u8 buf[]) - { - if (dry_run) -@@ -817,39 +783,6 @@ static inline u32 _emit_STP(unsigned dry_run, u8 buf[], - return SZ_DMASTP; - } - --static inline u32 _emit_STZ(unsigned dry_run, u8 buf[]) --{ -- if (dry_run) -- return SZ_DMASTZ; -- -- buf[0] = CMD_DMASTZ; -- -- PL330_DBGCMD_DUMP(SZ_DMASTZ, "\tDMASTZ\n"); -- -- return SZ_DMASTZ; --} -- --static inline u32 _emit_WFE(unsigned dry_run, u8 buf[], u8 ev, -- unsigned invalidate) --{ -- if (dry_run) -- return SZ_DMAWFE; -- -- buf[0] = CMD_DMAWFE; -- -- ev &= 0x1f; -- ev <<= 3; -- buf[1] = ev; -- -- if (invalidate) -- buf[1] |= (1 << 1); -- -- PL330_DBGCMD_DUMP(SZ_DMAWFE, "\tDMAWFE %u%s\n", -- ev >> 3, invalidate ? ", I" : ""); -- -- return SZ_DMAWFE; --} -- - static inline u32 _emit_WFP(unsigned dry_run, u8 buf[], - enum pl330_cond cond, u8 peri) - { - -From 66625effb6e47117c803249fc0d843eff367f32b Mon Sep 17 00:00:00 2001 -From: Arvind Yadav -Date: Wed, 23 Aug 2017 21:57:31 +0530 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: constify amba_id - -amba_id are not supposed to change at runtime. All functions -working with const amba_id. So mark the non-const structs as const. - -Signed-off-by: Arvind Yadav -Signed-off-by: Vinod Koul -(cherry picked from commit b753351ec8f4c6a25c6d9b5c4eccce62e448a571) ---- - drivers/dma/pl330.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index bd4a0c3deaf6..63ffb8d1f885 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2976,7 +2976,7 @@ static int pl330_remove(struct amba_device *adev) - return 0; - } - --static struct amba_id pl330_ids[] = { -+static const struct amba_id pl330_ids[] = { - { - .id = 0x00041330, - .mask = 0x000fffff, - -From 32b006c4a5e5af627e8daa773a49da36a5deeced Mon Sep 17 00:00:00 2001 -From: Alexander Kochetkov -Date: Wed, 4 Oct 2017 14:37:23 +0300 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: fix descriptor allocation fail - -If two concurrent threads call pl330_get_desc() when DMAC descriptor -pool is empty it is possible that allocation for one of threads will fail -with message: - -kernel: dma-pl330 20078000.dma-controller: pl330_get_desc:2469 ALERT! - -Here how that can happen. Thread A calls pl330_get_desc() to get -descriptor. If DMAC descriptor pool is empty pl330_get_desc() allocates -new descriptor on shared pool using add_desc() and then get newly -allocated descriptor using pluck_desc(). At the same time thread B calls -pluck_desc() and take newly allocated descriptor. In that case descriptor -allocation for thread A will fail. - -Using on-stack pool for new descriptor allow avoid the issue described. -The patch modify pl330_get_desc() to use on-stack pool for allocation -new descriptors. - -Signed-off-by: Alexander Kochetkov -Tested-by: Marek Szyprowski -Signed-off-by: Vinod Koul -(cherry picked from commit e588710311ee5bece284871d613418831d56f2bd) ---- - drivers/dma/pl330.c | 39 ++++++++++++++++++++------------------- - 1 file changed, 20 insertions(+), 19 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 63ffb8d1f885..257492238cea 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2344,7 +2344,8 @@ static inline void _init_desc(struct dma_pl330_desc *desc) - } - - /* Returns the number of descriptors added to the DMAC pool */ --static int add_desc(struct pl330_dmac *pl330, gfp_t flg, int count) -+static int add_desc(struct list_head *pool, spinlock_t *lock, -+ gfp_t flg, int count) - { - struct dma_pl330_desc *desc; - unsigned long flags; -@@ -2354,27 +2355,28 @@ static int add_desc(struct pl330_dmac *pl330, gfp_t flg, int count) - if (!desc) - return 0; - -- spin_lock_irqsave(&pl330->pool_lock, flags); -+ spin_lock_irqsave(lock, flags); - - for (i = 0; i < count; i++) { - _init_desc(&desc[i]); -- list_add_tail(&desc[i].node, &pl330->desc_pool); -+ list_add_tail(&desc[i].node, pool); - } - -- spin_unlock_irqrestore(&pl330->pool_lock, flags); -+ spin_unlock_irqrestore(lock, flags); - - return count; - } - --static struct dma_pl330_desc *pluck_desc(struct pl330_dmac *pl330) -+static struct dma_pl330_desc *pluck_desc(struct list_head *pool, -+ spinlock_t *lock) - { - struct dma_pl330_desc *desc = NULL; - unsigned long flags; - -- spin_lock_irqsave(&pl330->pool_lock, flags); -+ spin_lock_irqsave(lock, flags); - -- if (!list_empty(&pl330->desc_pool)) { -- desc = list_entry(pl330->desc_pool.next, -+ if (!list_empty(pool)) { -+ desc = list_entry(pool->next, - struct dma_pl330_desc, node); - - list_del_init(&desc->node); -@@ -2383,7 +2385,7 @@ static struct dma_pl330_desc *pluck_desc(struct pl330_dmac *pl330) - desc->txd.callback = NULL; - } - -- spin_unlock_irqrestore(&pl330->pool_lock, flags); -+ spin_unlock_irqrestore(lock, flags); - - return desc; - } -@@ -2395,20 +2397,18 @@ static struct dma_pl330_desc *pl330_get_desc(struct dma_pl330_chan *pch) - struct dma_pl330_desc *desc; - - /* Pluck one desc from the pool of DMAC */ -- desc = pluck_desc(pl330); -+ desc = pluck_desc(&pl330->desc_pool, &pl330->pool_lock); - - /* If the DMAC pool is empty, alloc new */ - if (!desc) { -- if (!add_desc(pl330, GFP_ATOMIC, 1)) -- return NULL; -+ DEFINE_SPINLOCK(lock); -+ LIST_HEAD(pool); - -- /* Try again */ -- desc = pluck_desc(pl330); -- if (!desc) { -- dev_err(pch->dmac->ddma.dev, -- "%s:%d ALERT!\n", __func__, __LINE__); -+ if (!add_desc(&pool, &lock, GFP_ATOMIC, 1)) - return NULL; -- } -+ -+ desc = pluck_desc(&pool, &lock); -+ WARN_ON(!desc || !list_empty(&pool)); - } - - /* Initialize the descriptor */ -@@ -2821,7 +2821,8 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - spin_lock_init(&pl330->pool_lock); - - /* Create a descriptor pool of default size */ -- if (!add_desc(pl330, GFP_KERNEL, NR_DEFAULT_DESC)) -+ if (!add_desc(&pl330->desc_pool, &pl330->pool_lock, -+ GFP_KERNEL, NR_DEFAULT_DESC)) - dev_warn(&adev->dev, "unable to allocate desc\n"); - - INIT_LIST_HEAD(&pd->channels); - -From 60af02189c1e3cc3d8e957754ac0f97dc20655f5 Mon Sep 17 00:00:00 2001 -From: Frank Mori Hess -Date: Wed, 18 Apr 2018 20:31:06 -0400 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: flush before wait, and add dev - burst support. - -Do DMAFLUSHP _before_ the first DMAWFP to ensure controller -and peripheral are in agreement about dma request state before first -transfer. Add support for burst transfers to/from peripherals. In the new -scheme, the controller does as many burst transfers as it can then -transfers the remaining dregs with either single transfers for -peripherals, or with a reduced size burst for memory-to-memory transfers. - -Signed-off-by: Frank Mori Hess -Tested-by: Frank Mori Hess -Signed-off-by: Vinod Koul -(cherry picked from commit 1d48745b192a7a45bbdd3557b4c039609569ca41) ---- - drivers/dma/pl330.c | 209 +++++++++++++++++++++++++++++++++++++++------------- - 1 file changed, 159 insertions(+), 50 deletions(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 257492238cea..fd48c031ead8 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - #include "dmaengine.h" - #define PL330_MAX_CHAN 8 -@@ -1095,51 +1096,96 @@ static inline int _ldst_memtomem(unsigned dry_run, u8 buf[], - return off; - } - --static inline int _ldst_devtomem(struct pl330_dmac *pl330, unsigned dry_run, -- u8 buf[], const struct _xfer_spec *pxs, -- int cyc) -+static u32 _emit_load(unsigned int dry_run, u8 buf[], -+ enum pl330_cond cond, enum dma_transfer_direction direction, -+ u8 peri) - { - int off = 0; -- enum pl330_cond cond; - -- if (pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) -- cond = BURST; -- else -- cond = SINGLE; -+ switch (direction) { -+ case DMA_MEM_TO_MEM: -+ /* fall through */ -+ case DMA_MEM_TO_DEV: -+ off += _emit_LD(dry_run, &buf[off], cond); -+ break; - -- while (cyc--) { -- off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); -- off += _emit_LDP(dry_run, &buf[off], cond, pxs->desc->peri); -- off += _emit_ST(dry_run, &buf[off], ALWAYS); -+ case DMA_DEV_TO_MEM: -+ if (cond == ALWAYS) { -+ off += _emit_LDP(dry_run, &buf[off], SINGLE, -+ peri); -+ off += _emit_LDP(dry_run, &buf[off], BURST, -+ peri); -+ } else { -+ off += _emit_LDP(dry_run, &buf[off], cond, -+ peri); -+ } -+ break; - -- if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) -- off += _emit_FLUSHP(dry_run, &buf[off], -- pxs->desc->peri); -+ default: -+ /* this code should be unreachable */ -+ WARN_ON(1); -+ break; - } - - return off; - } - --static inline int _ldst_memtodev(struct pl330_dmac *pl330, -+static inline u32 _emit_store(unsigned int dry_run, u8 buf[], -+ enum pl330_cond cond, enum dma_transfer_direction direction, -+ u8 peri) -+{ -+ int off = 0; -+ -+ switch (direction) { -+ case DMA_MEM_TO_MEM: -+ /* fall through */ -+ case DMA_DEV_TO_MEM: -+ off += _emit_ST(dry_run, &buf[off], cond); -+ break; -+ -+ case DMA_MEM_TO_DEV: -+ if (cond == ALWAYS) { -+ off += _emit_STP(dry_run, &buf[off], SINGLE, -+ peri); -+ off += _emit_STP(dry_run, &buf[off], BURST, -+ peri); -+ } else { -+ off += _emit_STP(dry_run, &buf[off], cond, -+ peri); -+ } -+ break; -+ -+ default: -+ /* this code should be unreachable */ -+ WARN_ON(1); -+ break; -+ } -+ -+ return off; -+} -+ -+static inline int _ldst_peripheral(struct pl330_dmac *pl330, - unsigned dry_run, u8 buf[], -- const struct _xfer_spec *pxs, int cyc) -+ const struct _xfer_spec *pxs, int cyc, -+ enum pl330_cond cond) - { - int off = 0; -- enum pl330_cond cond; - - if (pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) - cond = BURST; -- else -- cond = SINGLE; - -+ /* -+ * do FLUSHP at beginning to clear any stale dma requests before the -+ * first WFP. -+ */ -+ if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) -+ off += _emit_FLUSHP(dry_run, &buf[off], pxs->desc->peri); - while (cyc--) { - off += _emit_WFP(dry_run, &buf[off], cond, pxs->desc->peri); -- off += _emit_LD(dry_run, &buf[off], ALWAYS); -- off += _emit_STP(dry_run, &buf[off], cond, pxs->desc->peri); -- -- if (!(pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP)) -- off += _emit_FLUSHP(dry_run, &buf[off], -- pxs->desc->peri); -+ off += _emit_load(dry_run, &buf[off], cond, pxs->desc->rqtype, -+ pxs->desc->peri); -+ off += _emit_store(dry_run, &buf[off], cond, pxs->desc->rqtype, -+ pxs->desc->peri); - } - - return off; -@@ -1149,19 +1195,65 @@ static int _bursts(struct pl330_dmac *pl330, unsigned dry_run, u8 buf[], - const struct _xfer_spec *pxs, int cyc) - { - int off = 0; -+ enum pl330_cond cond = BRST_LEN(pxs->ccr) > 1 ? BURST : SINGLE; - - switch (pxs->desc->rqtype) { - case DMA_MEM_TO_DEV: -- off += _ldst_memtodev(pl330, dry_run, &buf[off], pxs, cyc); -- break; -+ /* fall through */ - case DMA_DEV_TO_MEM: -- off += _ldst_devtomem(pl330, dry_run, &buf[off], pxs, cyc); -+ off += _ldst_peripheral(pl330, dry_run, &buf[off], pxs, cyc, -+ cond); - break; -+ - case DMA_MEM_TO_MEM: - off += _ldst_memtomem(dry_run, &buf[off], pxs, cyc); - break; -+ -+ default: -+ /* this code should be unreachable */ -+ WARN_ON(1); -+ break; -+ } -+ -+ return off; -+} -+ -+/* -+ * transfer dregs with single transfers to peripheral, or a reduced size burst -+ * for mem-to-mem. -+ */ -+static int _dregs(struct pl330_dmac *pl330, unsigned int dry_run, u8 buf[], -+ const struct _xfer_spec *pxs, int transfer_length) -+{ -+ int off = 0; -+ int dregs_ccr; -+ -+ if (transfer_length == 0) -+ return off; -+ -+ switch (pxs->desc->rqtype) { -+ case DMA_MEM_TO_DEV: -+ /* fall through */ -+ case DMA_DEV_TO_MEM: -+ off += _ldst_peripheral(pl330, dry_run, &buf[off], pxs, -+ transfer_length, SINGLE); -+ break; -+ -+ case DMA_MEM_TO_MEM: -+ dregs_ccr = pxs->ccr; -+ dregs_ccr &= ~((0xf << CC_SRCBRSTLEN_SHFT) | -+ (0xf << CC_DSTBRSTLEN_SHFT)); -+ dregs_ccr |= (((transfer_length - 1) & 0xf) << -+ CC_SRCBRSTLEN_SHFT); -+ dregs_ccr |= (((transfer_length - 1) & 0xf) << -+ CC_DSTBRSTLEN_SHFT); -+ off += _emit_MOV(dry_run, &buf[off], CCR, dregs_ccr); -+ off += _ldst_memtomem(dry_run, &buf[off], pxs, 1); -+ break; -+ - default: -- off += 0x40000000; /* Scare off the Client */ -+ /* this code should be unreachable */ -+ WARN_ON(1); - break; - } - -@@ -1257,6 +1349,8 @@ static inline int _setup_loops(struct pl330_dmac *pl330, - struct pl330_xfer *x = &pxs->desc->px; - u32 ccr = pxs->ccr; - unsigned long c, bursts = BYTE_TO_BURST(x->bytes, ccr); -+ int num_dregs = (x->bytes - BURST_TO_BYTE(bursts, ccr)) / -+ BRST_SIZE(ccr); - int off = 0; - - while (bursts) { -@@ -1264,6 +1358,7 @@ static inline int _setup_loops(struct pl330_dmac *pl330, - off += _loop(pl330, dry_run, &buf[off], &c, pxs); - bursts -= c; - } -+ off += _dregs(pl330, dry_run, &buf[off], pxs, num_dregs); - - return off; - } -@@ -1295,7 +1390,6 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - struct _xfer_spec *pxs) - { - struct _pl330_req *req = &thrd->req[index]; -- struct pl330_xfer *x; - u8 *buf = req->mc_cpu; - int off = 0; - -@@ -1304,11 +1398,6 @@ static int _setup_req(struct pl330_dmac *pl330, unsigned dry_run, - /* DMAMOV CCR, ccr */ - off += _emit_MOV(dry_run, &buf[off], CCR, pxs->ccr); - -- x = &pxs->desc->px; -- /* Error if xfer length is not aligned at burst size */ -- if (x->bytes % (BRST_SIZE(pxs->ccr) * BRST_LEN(pxs->ccr))) -- return -EINVAL; -- - off += _setup_xfer(pl330, dry_run, &buf[off], pxs); - - /* DMASEV peripheral/event */ -@@ -1366,6 +1455,20 @@ static int pl330_submit_req(struct pl330_thread *thrd, - u32 ccr; - int ret = 0; - -+ switch (desc->rqtype) { -+ case DMA_MEM_TO_DEV: -+ break; -+ -+ case DMA_DEV_TO_MEM: -+ break; -+ -+ case DMA_MEM_TO_MEM: -+ break; -+ -+ default: -+ return -ENOTSUPP; -+ } -+ - if (pl330->state == DYING - || pl330->dmac_tbd.reset_chan & (1 << thrd->id)) { - dev_info(thrd->dmac->ddma.dev, "%s:%d\n", -@@ -2060,6 +2163,18 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan) - return 1; - } - -+static int fixup_burst_len(int max_burst_len, int quirks) -+{ -+ if (quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) -+ return 1; -+ else if (max_burst_len > PL330_MAX_BURST) -+ return PL330_MAX_BURST; -+ else if (max_burst_len < 1) -+ return 1; -+ else -+ return max_burst_len; -+} -+ - static int pl330_config(struct dma_chan *chan, - struct dma_slave_config *slave_config) - { -@@ -2070,15 +2185,15 @@ static int pl330_config(struct dma_chan *chan, - pch->fifo_addr = slave_config->dst_addr; - if (slave_config->dst_addr_width) - pch->burst_sz = __ffs(slave_config->dst_addr_width); -- if (slave_config->dst_maxburst) -- pch->burst_len = slave_config->dst_maxburst; -+ pch->burst_len = fixup_burst_len(slave_config->dst_maxburst, -+ pch->dmac->quirks); - } else if (slave_config->direction == DMA_DEV_TO_MEM) { - if (slave_config->src_addr) - pch->fifo_addr = slave_config->src_addr; - if (slave_config->src_addr_width) - pch->burst_sz = __ffs(slave_config->src_addr_width); -- if (slave_config->src_maxburst) -- pch->burst_len = slave_config->src_maxburst; -+ pch->burst_len = fixup_burst_len(slave_config->src_maxburst, -+ pch->dmac->quirks); - } - - return 0; -@@ -2471,14 +2586,8 @@ static inline int get_burst_len(struct dma_pl330_desc *desc, size_t len) - burst_len >>= desc->rqcfg.brst_size; - - /* src/dst_burst_len can't be more than 16 */ -- if (burst_len > 16) -- burst_len = 16; -- -- while (burst_len > 1) { -- if (!(len % (burst_len << desc->rqcfg.brst_size))) -- break; -- burst_len--; -- } -+ if (burst_len > PL330_MAX_BURST) -+ burst_len = PL330_MAX_BURST; - - return burst_len; - } -@@ -2547,7 +2656,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic( - - desc->rqtype = direction; - desc->rqcfg.brst_size = pch->burst_sz; -- desc->rqcfg.brst_len = 1; -+ desc->rqcfg.brst_len = pch->burst_len; - desc->bytes_requested = period_len; - fill_px(&desc->px, dst, src, period_len); - -@@ -2692,7 +2801,7 @@ pl330_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - } - - desc->rqcfg.brst_size = pch->burst_sz; -- desc->rqcfg.brst_len = 1; -+ desc->rqcfg.brst_len = pch->burst_len; - desc->rqtype = direction; - desc->bytes_requested = sg_dma_len(sg); - } - -From b970d8fda69d56f0c9b59e436493bbbc6448ef10 Mon Sep 17 00:00:00 2001 -From: Marek Szyprowski -Date: Tue, 19 Jun 2018 15:20:50 +0200 -Subject: [PATCH] UPSTREAM: dmaengine: pl330: report BURST residue granularity - -The reported residue is already calculated in BURST unit granularity, so -advertise this capability properly to other devices in the system. - -Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function") -Signed-off-by: Marek Szyprowski -Signed-off-by: Vinod Koul -(cherry picked from commit e3f329c600033f011a978a8bc4ddb1e2e94c4f4d) ---- - drivers/dma/pl330.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index fd48c031ead8..029bd0444137 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2984,7 +2984,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) - pd->src_addr_widths = PL330_DMA_BUSWIDTHS; - pd->dst_addr_widths = PL330_DMA_BUSWIDTHS; - pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); -- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT; -+ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; - pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ? - 1 : PL330_MAX_BURST); - diff --git a/patch/kernel/archive/rockchip-4.4/01-linux-1000-vcodec.patch b/patch/kernel/archive/rockchip-4.4/01-linux-1000-vcodec.patch deleted file mode 100644 index 2de4f79a0dd1..000000000000 --- a/patch/kernel/archive/rockchip-4.4/01-linux-1000-vcodec.patch +++ /dev/null @@ -1,945 +0,0 @@ -From 499f15c3237602cca9ccebe902d31bd7404fb2db Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Thu, 5 Jul 2018 00:14:14 +0200 -Subject: [PATCH] Revert "drm/drm-prime: cache dma_buf import context" - -This reverts commit 5a90381e5acc2cf32be03099a14d05d4362b3348. ---- - drivers/gpu/drm/drm_prime.c | 46 ++--------------------------- - drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 1 + - 2 files changed, 3 insertions(+), 44 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 6f207d5946dc..6b7417a194a3 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -71,11 +71,6 @@ struct drm_prime_attachment { - enum dma_data_direction dir; - }; - --struct drm_prime_callback_data { -- struct drm_gem_object *obj; -- struct sg_table *sgt; --}; -- - static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, - struct dma_buf *dma_buf, uint32_t handle) - { -@@ -524,23 +519,6 @@ out_unlock: - } - EXPORT_SYMBOL(drm_gem_prime_handle_to_fd); - --static void drm_gem_prime_dmabuf_release_callback(void *data) --{ -- struct drm_prime_callback_data *cb_data = data; -- -- if (cb_data && cb_data->obj && cb_data->obj->import_attach) { -- struct dma_buf_attachment *attach = cb_data->obj->import_attach; -- struct sg_table *sgt = cb_data->sgt; -- -- if (sgt) -- dma_buf_unmap_attachment(attach, sgt, -- DMA_BIDIRECTIONAL); -- dma_buf_detach(attach->dmabuf, attach); -- drm_gem_object_unreference_unlocked(cb_data->obj); -- kfree(cb_data); -- } --} -- - /** - * drm_gem_prime_import - helper library implementation of the import callback - * @dev: drm_device to import into -@@ -555,7 +533,6 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, - struct dma_buf_attachment *attach; - struct sg_table *sgt; - struct drm_gem_object *obj; -- struct drm_prime_callback_data *cb_data; - int ret; - - if (dma_buf->ops == &drm_gem_prime_dmabuf_ops) { -@@ -570,13 +547,6 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, - } - } - -- cb_data = dma_buf_get_release_callback_data(dma_buf, -- drm_gem_prime_dmabuf_release_callback); -- if (cb_data && cb_data->obj && cb_data->obj->dev == dev) { -- drm_gem_object_reference(cb_data->obj); -- return cb_data->obj; -- } -- - if (!dev->driver->gem_prime_import_sg_table) - return ERR_PTR(-EINVAL); - -@@ -585,16 +555,11 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, - return ERR_CAST(attach); - - get_dma_buf(dma_buf); -- cb_data = kmalloc(sizeof(*cb_data), GFP_KERNEL); -- if (!cb_data) { -- ret = -ENOMEM; -- goto fail_detach; -- } - - sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); - if (IS_ERR(sgt)) { - ret = PTR_ERR(sgt); -- goto fail_free; -+ goto fail_detach; - } - - obj = dev->driver->gem_prime_import_sg_table(dev, attach, sgt); -@@ -602,20 +567,13 @@ struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, - ret = PTR_ERR(obj); - goto fail_unmap; - } -+ - obj->import_attach = attach; -- cb_data->obj = obj; -- cb_data->sgt = sgt; -- dma_buf_set_release_callback(dma_buf, -- drm_gem_prime_dmabuf_release_callback, cb_data); -- dma_buf_put(dma_buf); -- drm_gem_object_reference(obj); - - return obj; - - fail_unmap: - dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL); --fail_free: -- kfree(cb_data); - fail_detach: - dma_buf_detach(dma_buf, attach); - dma_buf_put(dma_buf); -diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c -index 273a52b5eb66..85bbd19c87b0 100644 ---- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c -+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c -@@ -649,6 +649,7 @@ void rockchip_gem_free_object(struct drm_gem_object *obj) - dma_unmap_sg(drm->dev, rk_obj->sgt->sgl, - rk_obj->sgt->nents, DMA_BIDIRECTIONAL); - } -+ drm_prime_gem_destroy(obj, rk_obj->sgt); - } else { - rockchip_gem_free_buf(rk_obj); - } - -From 3dd29985f5f1cec249c833b1b2ca33e131f79825 Mon Sep 17 00:00:00 2001 -From: Rob Clark -Date: Thu, 9 Jun 2016 15:29:19 -0400 -Subject: [PATCH] UPSTREAM: drm/prime: fix error path deadlock fail - -There were a couple messed up things about this fail path. -(1) it would drop object_name_lock twice -(2) drm_gem_handle_delete() (in drm_gem_remove_prime_handles()) - needs to grab prime_lock - -Reported-by: Alex Deucher -Signed-off-by: Rob Clark -Reviewed-by: Alex Deucher -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1465500559-17873-1-git-send-email-robdclark@gmail.com -(cherry picked from commit bd6e2732f0e2894ce792f344c41fc32591436fe3) ---- - drivers/gpu/drm/drm_prime.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 6b7417a194a3..d8d85286764d 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -628,7 +628,7 @@ int drm_gem_prime_fd_to_handle(struct drm_device *dev, - get_dma_buf(dma_buf); - } - -- /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ -+ /* _handle_create_tail unconditionally unlocks dev->object_name_lock. */ - ret = drm_gem_handle_create_tail(file_priv, obj, handle); - drm_gem_object_unreference_unlocked(obj); - if (ret) -@@ -636,11 +636,10 @@ int drm_gem_prime_fd_to_handle(struct drm_device *dev, - - ret = drm_prime_add_buf_handle(&file_priv->prime, - dma_buf, *handle); -+ mutex_unlock(&file_priv->prime.lock); - if (ret) - goto fail; - -- mutex_unlock(&file_priv->prime.lock); -- - dma_buf_put(dma_buf); - - return 0; -@@ -650,11 +649,14 @@ fail: - * to detach.. which seems ok.. - */ - drm_gem_handle_delete(file_priv, *handle); -+ dma_buf_put(dma_buf); -+ return ret; -+ - out_unlock: - mutex_unlock(&dev->object_name_lock); - out_put: -- dma_buf_put(dma_buf); - mutex_unlock(&file_priv->prime.lock); -+ dma_buf_put(dma_buf); - return ret; - } - EXPORT_SYMBOL(drm_gem_prime_fd_to_handle); - -From a689159fac372a8210d2c63ba63da3a097388b97 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Mon, 26 Sep 2016 21:44:14 +0100 -Subject: [PATCH] UPSTREAM: drm: Convert prime dma-buf <-> handle to rbtree - -Currently we use a linear walk to lookup a handle and return a dma-buf, -and vice versa. A long overdue TODO task is to convert that to a -hashtable. Since the initial implementation of dma-buf/prime, we now -have resizeable hashtables we can use (and now a future task is to RCU -enable the lookup!). However, this patch opts to use an rbtree instead -to provide O(lgN) lookups (and insertion, deletion). rbtrees were chosen -over using the RCU backed resizable hashtable to firstly avoid the -reallocations (rbtrees can be embedded entirely within the parent -struct) and to favour simpler code with predictable worst case -behaviour. In simple testing, the difference between using the constant -lookup and insertion of the rhashtable and the rbtree was less than 10% -of the wall time (igt/benchmarks/prime_lookup) - both are dramatic -improvements over the existing linear lists. - -v2: Favour rbtree over rhashtable - -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94631 -Signed-off-by: Chris Wilson -Cc: Sean Paul -Cc: David Herrmann -Reviewed-by: David Herrmann -Reviewed-by: Sean Paul -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/20160926204414.23222-1-chris@chris-wilson.co.uk -(cherry picked from commit 077675c1e8a193a6355d4a7c8c7bf63be310b472) ---- - drivers/gpu/drm/drm_prime.c | 85 +++++++++++++++++++++++++++++++++++++++------ - include/drm/drmP.h | 5 +-- - 2 files changed, 77 insertions(+), 13 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index d8d85286764d..4c49e736bc9c 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -28,6 +28,7 @@ - - #include - #include -+#include - #include - #include - -@@ -61,9 +62,11 @@ - */ - - struct drm_prime_member { -- struct list_head entry; - struct dma_buf *dma_buf; - uint32_t handle; -+ -+ struct rb_node dmabuf_rb; -+ struct rb_node handle_rb; - }; - - struct drm_prime_attachment { -@@ -75,6 +78,7 @@ static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, - struct dma_buf *dma_buf, uint32_t handle) - { - struct drm_prime_member *member; -+ struct rb_node **p, *rb; - - member = kmalloc(sizeof(*member), GFP_KERNEL); - if (!member) -@@ -83,18 +87,56 @@ static int drm_prime_add_buf_handle(struct drm_prime_file_private *prime_fpriv, - get_dma_buf(dma_buf); - member->dma_buf = dma_buf; - member->handle = handle; -- list_add(&member->entry, &prime_fpriv->head); -+ -+ rb = NULL; -+ p = &prime_fpriv->dmabufs.rb_node; -+ while (*p) { -+ struct drm_prime_member *pos; -+ -+ rb = *p; -+ pos = rb_entry(rb, struct drm_prime_member, dmabuf_rb); -+ if (dma_buf > pos->dma_buf) -+ p = &rb->rb_right; -+ else -+ p = &rb->rb_left; -+ } -+ rb_link_node(&member->dmabuf_rb, rb, p); -+ rb_insert_color(&member->dmabuf_rb, &prime_fpriv->dmabufs); -+ -+ rb = NULL; -+ p = &prime_fpriv->handles.rb_node; -+ while (*p) { -+ struct drm_prime_member *pos; -+ -+ rb = *p; -+ pos = rb_entry(rb, struct drm_prime_member, handle_rb); -+ if (handle > pos->handle) -+ p = &rb->rb_right; -+ else -+ p = &rb->rb_left; -+ } -+ rb_link_node(&member->handle_rb, rb, p); -+ rb_insert_color(&member->handle_rb, &prime_fpriv->handles); -+ - return 0; - } - - static struct dma_buf *drm_prime_lookup_buf_by_handle(struct drm_prime_file_private *prime_fpriv, - uint32_t handle) - { -- struct drm_prime_member *member; -+ struct rb_node *rb; -+ -+ rb = prime_fpriv->handles.rb_node; -+ while (rb) { -+ struct drm_prime_member *member; - -- list_for_each_entry(member, &prime_fpriv->head, entry) { -+ member = rb_entry(rb, struct drm_prime_member, handle_rb); - if (member->handle == handle) - return member->dma_buf; -+ else if (member->handle < handle) -+ rb = rb->rb_right; -+ else -+ rb = rb->rb_left; - } - - return NULL; -@@ -104,14 +146,23 @@ static int drm_prime_lookup_buf_handle(struct drm_prime_file_private *prime_fpri - struct dma_buf *dma_buf, - uint32_t *handle) - { -- struct drm_prime_member *member; -+ struct rb_node *rb; -+ -+ rb = prime_fpriv->dmabufs.rb_node; -+ while (rb) { -+ struct drm_prime_member *member; - -- list_for_each_entry(member, &prime_fpriv->head, entry) { -+ member = rb_entry(rb, struct drm_prime_member, dmabuf_rb); - if (member->dma_buf == dma_buf) { - *handle = member->handle; - return 0; -+ } else if (member->dma_buf < dma_buf) { -+ rb = rb->rb_right; -+ } else { -+ rb = rb->rb_left; - } - } -+ - return -ENOENT; - } - -@@ -166,13 +217,24 @@ static void drm_gem_map_detach(struct dma_buf *dma_buf, - void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv, - struct dma_buf *dma_buf) - { -- struct drm_prime_member *member, *safe; -+ struct rb_node *rb; - -- list_for_each_entry_safe(member, safe, &prime_fpriv->head, entry) { -+ rb = prime_fpriv->dmabufs.rb_node; -+ while (rb) { -+ struct drm_prime_member *member; -+ -+ member = rb_entry(rb, struct drm_prime_member, dmabuf_rb); - if (member->dma_buf == dma_buf) { -+ rb_erase(&member->handle_rb, &prime_fpriv->handles); -+ rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs); -+ - dma_buf_put(dma_buf); -- list_del(&member->entry); - kfree(member); -+ return; -+ } else if (member->dma_buf < dma_buf) { -+ rb = rb->rb_right; -+ } else { -+ rb = rb->rb_left; - } - } - } -@@ -794,12 +856,13 @@ EXPORT_SYMBOL(drm_prime_gem_destroy); - - void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpriv) - { -- INIT_LIST_HEAD(&prime_fpriv->head); - mutex_init(&prime_fpriv->lock); -+ prime_fpriv->dmabufs = RB_ROOT; -+ prime_fpriv->handles = RB_ROOT; - } - - void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_fpriv) - { - /* by now drm_gem_release should've made sure the list is empty */ -- WARN_ON(!list_empty(&prime_fpriv->head)); -+ WARN_ON(!RB_EMPTY_ROOT(&prime_fpriv->dmabufs)); - } -diff --git a/include/drm/drmP.h b/include/drm/drmP.h -index 04edcd32b409..93da65df2e7e 100644 ---- a/include/drm/drmP.h -+++ b/include/drm/drmP.h -@@ -51,6 +51,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -365,10 +366,10 @@ struct drm_pending_event { - void (*destroy)(struct drm_pending_event *event); - }; - --/* initial implementaton using a linked list - todo hashtab */ - struct drm_prime_file_private { -- struct list_head head; - struct mutex lock; -+ struct rb_root dmabufs; -+ struct rb_root handles; - }; - - /** File private data */ - -From f977098a9a02ac2df267eafe860370cb4c407d69 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Wed, 5 Oct 2016 13:21:44 +0100 -Subject: [PATCH] UPSTREAM: drm/prime: Take a ref on the drm_dev when exporting - a dma_buf -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -dma_buf may live a long time, longer than the last direct user of the -driver. We already hold a reference to the owner module (that prevents -the object code from disappearing), but there is no reference to the -drm_dev - so the pointers to the driver backend themselves may vanish. - -v2: Resist temptation to fix the bug in armada_gem.c not setting the -correct flags on the exported dma-buf (it should pass the flags through -and not be arbitrarily setting O_RDWR). - -Use a common wrapper for exporting the dmabuf and acquiring the -reference to the drm_device. - -Testcase: igt/vgem_basic/unload -Suggested-by: Daniel Vetter -Signed-off-by: Chris Wilson -Cc: Petri Latvala -Cc: Daniel Vetter -Cc: stable@vger.kernel.org -Tested-by: Petri Latvala -Reviewed-by: Christian König -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/20161005122145.1507-2-chris@chris-wilson.co.uk -(cherry picked from commit a4fce9cb782ad340ee5576a38e934e5e75832dc6) ---- - drivers/gpu/drm/armada/armada_gem.c | 2 +- - drivers/gpu/drm/drm_prime.c | 30 +++++++++++++++++++++++++++++- - drivers/gpu/drm/i915/i915_gem_dmabuf.c | 2 +- - drivers/gpu/drm/tegra/gem.c | 2 +- - drivers/gpu/drm/udl/udl_dmabuf.c | 2 +- - include/drm/drmP.h | 4 ++++ - 6 files changed, 37 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c -index 60a688ef81c7..cd5bb991f49a 100644 ---- a/drivers/gpu/drm/armada/armada_gem.c -+++ b/drivers/gpu/drm/armada/armada_gem.c -@@ -546,7 +546,7 @@ armada_gem_prime_export(struct drm_device *dev, struct drm_gem_object *obj, - exp_info.flags = O_RDWR; - exp_info.priv = obj; - -- return dma_buf_export(&exp_info); -+ return drm_gem_dmabuf_export(dev, &exp_info); - } - - struct drm_gem_object * -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 4c49e736bc9c..94b4872255c8 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -283,19 +283,47 @@ static void drm_gem_unmap_dma_buf(struct dma_buf_attachment *attach, - /* nothing to be done here */ - } - -+/** -+ * drm_gem_dmabuf_export - dma_buf export implementation for GEM -+ * @dma_buf: buffer to be exported -+ * -+ * This wraps dma_buf_export() for use by generic GEM drivers that are using -+ * drm_gem_dmabuf_release(). In addition to calling dma_buf_export(), we take -+ * a reference to the drm_device which is released by drm_gem_dmabuf_release(). -+ * -+ * Returns the new dmabuf. -+ */ -+struct dma_buf *drm_gem_dmabuf_export(struct drm_device *dev, -+ struct dma_buf_export_info *exp_info) -+{ -+ struct dma_buf *dma_buf; -+ -+ dma_buf = dma_buf_export(exp_info); -+ if (!IS_ERR(dma_buf)) -+ drm_dev_ref(dev); -+ -+ return dma_buf; -+} -+EXPORT_SYMBOL(drm_gem_dmabuf_export); -+ - /** - * drm_gem_dmabuf_release - dma_buf release implementation for GEM - * @dma_buf: buffer to be released - * - * Generic release function for dma_bufs exported as PRIME buffers. GEM drivers - * must use this in their dma_buf ops structure as the release callback. -+ * drm_gem_dmabuf_release() should be used in conjunction with -+ * drm_gem_dmabuf_export(). - */ - void drm_gem_dmabuf_release(struct dma_buf *dma_buf) - { - struct drm_gem_object *obj = dma_buf->priv; -+ struct drm_device *dev = obj->dev; - - /* drop the reference on the export fd holds */ - drm_gem_object_unreference_unlocked(obj); -+ -+ drm_dev_unref(dev); - } - EXPORT_SYMBOL(drm_gem_dmabuf_release); - -@@ -444,7 +472,7 @@ struct dma_buf *drm_gem_prime_export(struct drm_device *dev, - if (dev->driver->gem_prime_res_obj) - exp_info.resv = dev->driver->gem_prime_res_obj(obj); - -- return dma_buf_export(&exp_info); -+ return drm_gem_dmabuf_export(dev, &exp_info); - } - EXPORT_SYMBOL(drm_gem_prime_export); - -diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c -index e9c2bfd85b52..d4a021629bd6 100644 ---- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c -+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c -@@ -244,7 +244,7 @@ struct dma_buf *i915_gem_prime_export(struct drm_device *dev, - return ERR_PTR(ret); - } - -- return dma_buf_export(&exp_info); -+ return drm_gem_dmabuf_export(dev, &exp_info); - } - - static int i915_gem_object_get_pages_dmabuf(struct drm_i915_gem_object *obj) -diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c -index 01e16e146bfe..da06f1c1ee0f 100644 ---- a/drivers/gpu/drm/tegra/gem.c -+++ b/drivers/gpu/drm/tegra/gem.c -@@ -625,7 +625,7 @@ struct dma_buf *tegra_gem_prime_export(struct drm_device *drm, - exp_info.flags = flags; - exp_info.priv = gem; - -- return dma_buf_export(&exp_info); -+ return drm_gem_dmabuf_export(drm, &exp_info); - } - - struct drm_gem_object *tegra_gem_prime_import(struct drm_device *drm, -diff --git a/drivers/gpu/drm/udl/udl_dmabuf.c b/drivers/gpu/drm/udl/udl_dmabuf.c -index e2243edd1ce3..ac90ffdb5912 100644 ---- a/drivers/gpu/drm/udl/udl_dmabuf.c -+++ b/drivers/gpu/drm/udl/udl_dmabuf.c -@@ -209,7 +209,7 @@ struct dma_buf *udl_gem_prime_export(struct drm_device *dev, - exp_info.flags = flags; - exp_info.priv = obj; - -- return dma_buf_export(&exp_info); -+ return drm_gem_dmabuf_export(dev, &exp_info); - } - - static int udl_prime_create(struct drm_device *dev, -diff --git a/include/drm/drmP.h b/include/drm/drmP.h -index 93da65df2e7e..4aba6478d718 100644 ---- a/include/drm/drmP.h -+++ b/include/drm/drmP.h -@@ -1124,6 +1124,8 @@ static inline int drm_debugfs_remove_files(const struct drm_info_list *files, - } - #endif - -+struct dma_buf_export_info; -+ - extern struct dma_buf *drm_gem_prime_export(struct drm_device *dev, - struct drm_gem_object *obj, - int flags); -@@ -1134,6 +1136,8 @@ extern struct drm_gem_object *drm_gem_prime_import(struct drm_device *dev, - struct dma_buf *dma_buf); - extern int drm_gem_prime_fd_to_handle(struct drm_device *dev, - struct drm_file *file_priv, int prime_fd, uint32_t *handle); -+struct dma_buf *drm_gem_dmabuf_export(struct drm_device *dev, -+ struct dma_buf_export_info *exp_info); - extern void drm_gem_dmabuf_release(struct dma_buf *dma_buf); - - extern int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, - -From f30ee0d19425a6c21a9959513e482282ba08dd6a Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Wed, 7 Dec 2016 21:45:27 +0000 -Subject: [PATCH] UPSTREAM: drm: Take ownership of the dmabuf->obj when - exporting - -Currently the reference for the dmabuf->obj is incremented for the -dmabuf in drm_gem_prime_handle_to_fd() (at the high level userspace -interface), but is released in drm_gem_dmabuf_release() (the lowlevel -handler). Improve the symmetry of the dmabuf->obj ownership by acquiring -the reference in drm_gem_dmabuf_export(). This makes it easier to use -the prime functions directly. - -Signed-off-by: Chris Wilson -[danvet: Update kerneldoc.] -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/20161207214527.22533-1-chris@chris-wilson.co.uk -(cherry picked from commit 72a93e8dd52c9feea42f1258d555e6070680a347) ---- - drivers/gpu/drm/drm_prime.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 94b4872255c8..dbd34fa7f71c 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -289,7 +289,8 @@ static void drm_gem_unmap_dma_buf(struct dma_buf_attachment *attach, - * - * This wraps dma_buf_export() for use by generic GEM drivers that are using - * drm_gem_dmabuf_release(). In addition to calling dma_buf_export(), we take -- * a reference to the drm_device which is released by drm_gem_dmabuf_release(). -+ * a reference to the &drm_device and the exported &drm_gem_object (stored in -+ * exp_info->priv) which is released by drm_gem_dmabuf_release(). - * - * Returns the new dmabuf. - */ -@@ -299,8 +300,11 @@ struct dma_buf *drm_gem_dmabuf_export(struct drm_device *dev, - struct dma_buf *dma_buf; - - dma_buf = dma_buf_export(exp_info); -- if (!IS_ERR(dma_buf)) -- drm_dev_ref(dev); -+ if (IS_ERR(dma_buf)) -+ return dma_buf; -+ -+ drm_dev_ref(dev); -+ drm_gem_object_reference(exp_info->priv); - - return dma_buf; - } -@@ -503,8 +507,6 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev, - */ - obj->dma_buf = dmabuf; - get_dma_buf(obj->dma_buf); -- /* Grab a new ref since the callers is now used by the dma-buf */ -- drm_gem_object_reference(obj); - - return dmabuf; - } - -From a1fe1ad6076ec27f60555a9393f40959cea94bff Mon Sep 17 00:00:00 2001 -From: Lucas Stach -Date: Thu, 30 Nov 2017 18:34:28 +0100 -Subject: [PATCH] UPSTREAM: drm/prime: skip CPU sync in map/unmap dma_buf - -Dma-bufs should already be device coherent, as they are only pulled in the -CPU domain via the begin/end cpu_access calls. As we cache the mapping set -up by dma_map_sg a CPU sync at this point will not actually guarantee proper -coherency on non-coherent architectures, so we can as well stop pretending. - -This is an important performance fix for architectures which need explicit -cache synchronization and userspace doing lots of dma-buf imports. -Improves Weston on Etnaviv performance 5x, where before this patch > 90% -of Weston CPU time was spent synchronizing caches for buffers which are -already device coherent. - -Signed-off-by: Lucas Stach -Reviewed-by: Chris Wilson -Signed-off-by: Daniel Vetter -Link: https://patchwork.freedesktop.org/patch/msgid/20171130173428.8666-1-l.stach@pengutronix.de -(cherry picked from commit ca0e68e21aae10220eff71a297e7d794425add77) ---- - drivers/gpu/drm/drm_prime.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index dbd34fa7f71c..133362279591 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -203,9 +203,12 @@ static void drm_gem_map_detach(struct dma_buf *dma_buf, - - sgt = prime_attach->sgt; - if (sgt) { -+ DEFINE_DMA_ATTRS(attrs); -+ dma_set_attr(DMA_ATTR_SKIP_CPU_SYNC, &attrs); - if (prime_attach->dir != DMA_NONE) -- dma_unmap_sg(attach->dev, sgt->sgl, sgt->nents, -- prime_attach->dir); -+ dma_unmap_sg_attrs(attach->dev, sgt->sgl, sgt->nents, -+ prime_attach->dir, -+ &attrs); - sg_free_table(sgt); - } - -@@ -263,7 +266,9 @@ static struct sg_table *drm_gem_map_dma_buf(struct dma_buf_attachment *attach, - sgt = obj->dev->driver->gem_prime_get_sg_table(obj); - - if (!IS_ERR(sgt)) { -- if (!dma_map_sg(attach->dev, sgt->sgl, sgt->nents, dir)) { -+ DEFINE_DMA_ATTRS(attrs); -+ dma_set_attr(DMA_ATTR_SKIP_CPU_SYNC, &attrs); -+ if (!dma_map_sg_attrs(attach->dev, sgt->sgl, sgt->nents, dir, &attrs)) { - sg_free_table(sgt); - kfree(sgt); - sgt = ERR_PTR(-ENOMEM); - -From bdfc956545f8292cf462a7feee96d811f5d34414 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= -Date: Tue, 27 Feb 2018 12:49:56 +0100 -Subject: [PATCH] UPSTREAM: drm/prime: fix potential race in drm_gem_map_detach -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Unpin the GEM object only after freeing the sg table. - -Signed-off-by: Christian König -Reviewed-by: Daniel Vetter -Acked-by: Roger He -Signed-off-by: Alex Deucher -Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-1-christian.koenig@amd.com -(cherry picked from commit 681066ec1d41e4b299146bada52cef846b323c04) ---- - drivers/gpu/drm/drm_prime.c | 36 ++++++++++++++++++------------------ - 1 file changed, 18 insertions(+), 18 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 133362279591..95ecc69d03a0 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -193,28 +193,28 @@ static void drm_gem_map_detach(struct dma_buf *dma_buf, - struct drm_prime_attachment *prime_attach = attach->priv; - struct drm_gem_object *obj = dma_buf->priv; - struct drm_device *dev = obj->dev; -- struct sg_table *sgt; -- -- if (dev->driver->gem_prime_unpin) -- dev->driver->gem_prime_unpin(obj); - -- if (!prime_attach) -- return; -+ if (prime_attach) { -+ struct sg_table *sgt = prime_attach->sgt; -+ -+ if (sgt) { -+ DEFINE_DMA_ATTRS(attrs); -+ dma_set_attr(DMA_ATTR_SKIP_CPU_SYNC, &attrs); -+ if (prime_attach->dir != DMA_NONE) -+ dma_unmap_sg_attrs(attach->dev, sgt->sgl, -+ sgt->nents, -+ prime_attach->dir, -+ &attrs); -+ sg_free_table(sgt); -+ } - -- sgt = prime_attach->sgt; -- if (sgt) { -- DEFINE_DMA_ATTRS(attrs); -- dma_set_attr(DMA_ATTR_SKIP_CPU_SYNC, &attrs); -- if (prime_attach->dir != DMA_NONE) -- dma_unmap_sg_attrs(attach->dev, sgt->sgl, sgt->nents, -- prime_attach->dir, -- &attrs); -- sg_free_table(sgt); -+ kfree(sgt); -+ kfree(prime_attach); -+ attach->priv = NULL; - } - -- kfree(sgt); -- kfree(prime_attach); -- attach->priv = NULL; -+ if (dev->driver->gem_prime_unpin) -+ dev->driver->gem_prime_unpin(obj); - } - - void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *prime_fpriv, - -From 54f13f6370c654d59a9a5938e5953888a65c1980 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20K=C3=B6nig?= -Date: Tue, 27 Feb 2018 12:49:57 +0100 -Subject: [PATCH] UPSTREAM: drm/prime: make the pages array optional for - drm_prime_sg_to_page_addr_arrays -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Most of the time we only need the dma addresses. - -Signed-off-by: Christian König -Reviewed-by: Roger He -Signed-off-by: Alex Deucher -Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-2-christian.koenig@amd.com -Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-3-christian.koenig@amd.com -Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-4-christian.koenig@amd.com -Link: https://patchwork.freedesktop.org/patch/msgid/20180227115000.4105-5-christian.koenig@amd.com -Link: https://patchwork.freedesktop.org/patch/msgid/BN6PR12MB18262C0DE9B5F07B9A42EAE7F2C60@BN6PR12MB1826.namprd12.prod.outlook.com -(cherry picked from commit 186ca446aea19e49d2e1433dd170c6e1c211a52a) ---- - drivers/gpu/drm/drm_prime.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c -index 95ecc69d03a0..7ea65c4105c1 100644 ---- a/drivers/gpu/drm/drm_prime.c -+++ b/drivers/gpu/drm/drm_prime.c -@@ -827,40 +827,40 @@ EXPORT_SYMBOL(drm_prime_pages_to_sg); - /** - * drm_prime_sg_to_page_addr_arrays - convert an sg table into a page array - * @sgt: scatter-gather table to convert -- * @pages: array of page pointers to store the page array in -+ * @pages: optional array of page pointers to store the page array in - * @addrs: optional array to store the dma bus address of each page -- * @max_pages: size of both the passed-in arrays -+ * @max_entries: size of both the passed-in arrays - * - * Exports an sg table into an array of pages and addresses. This is currently - * required by the TTM driver in order to do correct fault handling. - */ - int drm_prime_sg_to_page_addr_arrays(struct sg_table *sgt, struct page **pages, -- dma_addr_t *addrs, int max_pages) -+ dma_addr_t *addrs, int max_entries) - { - unsigned count; - struct scatterlist *sg; - struct page *page; -- u32 len; -- int pg_index; -+ u32 len, index; - dma_addr_t addr; - -- pg_index = 0; -+ index = 0; - for_each_sg(sgt->sgl, sg, sgt->nents, count) { - len = sg->length; - page = sg_page(sg); - addr = sg_dma_address(sg); - - while (len > 0) { -- if (WARN_ON(pg_index >= max_pages)) -+ if (WARN_ON(index >= max_entries)) - return -1; -- pages[pg_index] = page; -+ if (pages) -+ pages[index] = page; - if (addrs) -- addrs[pg_index] = addr; -+ addrs[index] = addr; - - page++; - addr += PAGE_SIZE; - len -= PAGE_SIZE; -- pg_index++; -+ index++; - } - } - return 0; - -From c5e39a7e46511dffadabea97e3d74310561d1ba0 Mon Sep 17 00:00:00 2001 -From: Chris Wilson -Date: Sat, 19 Aug 2017 13:05:58 +0100 -Subject: [PATCH] UPSTREAM: drm: Release driver tracking before making the - object available again -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is the same bug as we fixed in commit f6cd7daecff5 ("drm: Release -driver references to handle before making it available again"), but now -the exposure is via the PRIME lookup tables. If we remove the -object/handle from the PRIME lut, then a new request for the same -object/fd will generate a new handle, thus for a short window that -object is known to userspace by two different handles. Fix this by -releasing the driver tracking before PRIME. - -Fixes: 0ff926c7d4f0 ("drm/prime: add exported buffers to current fprivs -imported buffer list (v2)") -Signed-off-by: Chris Wilson -Cc: David Airlie -Cc: Daniel Vetter -Cc: Rob Clark -Cc: Ville Syrjälä -Cc: Thierry Reding -Cc: stable@vger.kernel.org -Reviewed-by: Daniel Vetter -Signed-off-by: Joonas Lahtinen -Link: https://patchwork.freedesktop.org/patch/msgid/20170819120558.6465-1-chris@chris-wilson.co.uk -(cherry picked from commit d0a133f7f5bc3583e460ba6bb54474a50ada5201) ---- - drivers/gpu/drm/drm_gem.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index d7f39a03c2c9..966ea63581b1 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -255,13 +255,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) - struct drm_gem_object *obj = ptr; - struct drm_device *dev = obj->dev; - -+ if (dev->driver->gem_close_object) -+ dev->driver->gem_close_object(obj, file_priv); -+ - if (drm_core_check_feature(dev, DRIVER_PRIME)) - drm_gem_remove_prime_handles(obj, file_priv); - drm_vma_node_revoke(&obj->vma_node, file_priv->filp); - -- if (dev->driver->gem_close_object) -- dev->driver->gem_close_object(obj, file_priv); -- - drm_gem_object_handle_unreference_unlocked(obj); - - return 0; - -From 42f26aa9c8d429886b0af174b740f72741e571e2 Mon Sep 17 00:00:00 2001 -From: Jonas Karlman -Date: Sat, 17 Feb 2018 05:30:36 +0100 -Subject: [PATCH] vcodec: skip reduce freq - ---- - drivers/video/rockchip/vcodec/vcodec_service.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/video/rockchip/vcodec/vcodec_service.c b/drivers/video/rockchip/vcodec/vcodec_service.c -index 0f177d9ab4c2..903ea8554649 100644 ---- a/drivers/video/rockchip/vcodec/vcodec_service.c -+++ b/drivers/video/rockchip/vcodec/vcodec_service.c -@@ -1602,9 +1602,6 @@ static void try_set_reg(struct vpu_subdev_data *data) - reg_from_wait_to_run(pservice, reg); - reg_copy_to_hw(reg->data, reg); - } -- } else { -- if (pservice->hw_ops->reduce_freq) -- pservice->hw_ops->reduce_freq(pservice); - } - - mutex_unlock(&pservice->shutdown_lock); -@@ -2353,6 +2350,7 @@ static void vcodec_set_freq_rk3328(struct vpu_service_info *pservice, - if (curr == reg->freq) - return; - -+ atomic_set(&pservice->freq_status, reg->freq); - if (pservice->dev_id == VCODEC_DEVICE_ID_RKVDEC) { - if (reg->reg[1] & 0x00800000) { - if (rkv_dec_get_fmt(reg->reg) == FMT_H264D) diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.154-155.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.154-155.patch deleted file mode 100644 index 0e4fe2321283..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.154-155.patch +++ /dev/null @@ -1,1862 +0,0 @@ -diff --git a/Makefile b/Makefile -index b184286cf7e6..2d9f89ec8397 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 154 -+SUBLEVEL = 155 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c -index 63f06a2b1f7f..bbc7cb9faa01 100644 ---- a/arch/alpha/kernel/osf_sys.c -+++ b/arch/alpha/kernel/osf_sys.c -@@ -526,24 +526,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path, - SYSCALL_DEFINE1(osf_utsname, char __user *, name) - { - int error; -+ char tmp[5 * 32]; - - down_read(&uts_sem); -- error = -EFAULT; -- if (copy_to_user(name + 0, utsname()->sysname, 32)) -- goto out; -- if (copy_to_user(name + 32, utsname()->nodename, 32)) -- goto out; -- if (copy_to_user(name + 64, utsname()->release, 32)) -- goto out; -- if (copy_to_user(name + 96, utsname()->version, 32)) -- goto out; -- if (copy_to_user(name + 128, utsname()->machine, 32)) -- goto out; -+ memcpy(tmp + 0 * 32, utsname()->sysname, 32); -+ memcpy(tmp + 1 * 32, utsname()->nodename, 32); -+ memcpy(tmp + 2 * 32, utsname()->release, 32); -+ memcpy(tmp + 3 * 32, utsname()->version, 32); -+ memcpy(tmp + 4 * 32, utsname()->machine, 32); -+ up_read(&uts_sem); - -- error = 0; -- out: -- up_read(&uts_sem); -- return error; -+ if (copy_to_user(name, tmp, sizeof(tmp))) -+ return -EFAULT; -+ return 0; - } - - SYSCALL_DEFINE0(getpagesize) -@@ -561,24 +556,22 @@ SYSCALL_DEFINE0(getdtablesize) - */ - SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) - { -- unsigned len; -- int i; -+ int len, err = 0; -+ char *kname; -+ char tmp[32]; - -- if (!access_ok(VERIFY_WRITE, name, namelen)) -- return -EFAULT; -- -- len = namelen; -- if (len > 32) -- len = 32; -+ if (namelen < 0 || namelen > 32) -+ namelen = 32; - - down_read(&uts_sem); -- for (i = 0; i < len; ++i) { -- __put_user(utsname()->domainname[i], name + i); -- if (utsname()->domainname[i] == '\0') -- break; -- } -+ kname = utsname()->domainname; -+ len = strnlen(kname, namelen); -+ len = min(len + 1, namelen); -+ memcpy(tmp, kname, len); - up_read(&uts_sem); - -+ if (copy_to_user(name, tmp, len)) -+ return -EFAULT; - return 0; - } - -@@ -741,13 +734,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) - }; - unsigned long offset; - const char *res; -- long len, err = -EINVAL; -+ long len; -+ char tmp[__NEW_UTS_LEN + 1]; - - offset = command-1; - if (offset >= ARRAY_SIZE(sysinfo_table)) { - /* Digital UNIX has a few unpublished interfaces here */ - printk("sysinfo(%d)", command); -- goto out; -+ return -EINVAL; - } - - down_read(&uts_sem); -@@ -755,13 +749,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) - len = strlen(res)+1; - if ((unsigned long)len > (unsigned long)count) - len = count; -- if (copy_to_user(buf, res, len)) -- err = -EFAULT; -- else -- err = 0; -+ memcpy(tmp, res, len); - up_read(&uts_sem); -- out: -- return err; -+ if (copy_to_user(buf, tmp, len)) -+ return -EFAULT; -+ return 0; - } - - SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer, -diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi -index bb1ca158273c..1922e7a93e40 100644 ---- a/arch/arm/boot/dts/tegra30-cardhu.dtsi -+++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi -@@ -201,6 +201,7 @@ - #address-cells = <1>; - #size-cells = <0>; - reg = <0x70>; -+ reset-gpio = <&gpio TEGRA_GPIO(BB, 0) GPIO_ACTIVE_LOW>; - }; - }; - -diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h -index 493e72f64b35..5768ec3c1781 100644 ---- a/arch/powerpc/include/asm/fadump.h -+++ b/arch/powerpc/include/asm/fadump.h -@@ -194,9 +194,6 @@ struct fadump_crash_info_header { - struct cpumask cpu_online_mask; - }; - --/* Crash memory ranges */ --#define INIT_CRASHMEM_RANGES (INIT_MEMBLOCK_REGIONS + 2) -- - struct fad_crash_memory_ranges { - unsigned long long base; - unsigned long long size; -diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c -index 791d4c3329c3..c3c835290131 100644 ---- a/arch/powerpc/kernel/fadump.c -+++ b/arch/powerpc/kernel/fadump.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -48,8 +49,10 @@ static struct fadump_mem_struct fdm; - static const struct fadump_mem_struct *fdm_active; - - static DEFINE_MUTEX(fadump_mutex); --struct fad_crash_memory_ranges crash_memory_ranges[INIT_CRASHMEM_RANGES]; -+struct fad_crash_memory_ranges *crash_memory_ranges; -+int crash_memory_ranges_size; - int crash_mem_ranges; -+int max_crash_mem_ranges; - - /* Scan the Firmware Assisted dump configuration details. */ - int __init early_init_dt_scan_fw_dump(unsigned long node, -@@ -726,38 +729,88 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active) - return 0; - } - --static inline void fadump_add_crash_memory(unsigned long long base, -- unsigned long long end) -+static void free_crash_memory_ranges(void) -+{ -+ kfree(crash_memory_ranges); -+ crash_memory_ranges = NULL; -+ crash_memory_ranges_size = 0; -+ max_crash_mem_ranges = 0; -+} -+ -+/* -+ * Allocate or reallocate crash memory ranges array in incremental units -+ * of PAGE_SIZE. -+ */ -+static int allocate_crash_memory_ranges(void) -+{ -+ struct fad_crash_memory_ranges *new_array; -+ u64 new_size; -+ -+ new_size = crash_memory_ranges_size + PAGE_SIZE; -+ pr_debug("Allocating %llu bytes of memory for crash memory ranges\n", -+ new_size); -+ -+ new_array = krealloc(crash_memory_ranges, new_size, GFP_KERNEL); -+ if (new_array == NULL) { -+ pr_err("Insufficient memory for setting up crash memory ranges\n"); -+ free_crash_memory_ranges(); -+ return -ENOMEM; -+ } -+ -+ crash_memory_ranges = new_array; -+ crash_memory_ranges_size = new_size; -+ max_crash_mem_ranges = (new_size / -+ sizeof(struct fad_crash_memory_ranges)); -+ return 0; -+} -+ -+static inline int fadump_add_crash_memory(unsigned long long base, -+ unsigned long long end) - { - if (base == end) -- return; -+ return 0; -+ -+ if (crash_mem_ranges == max_crash_mem_ranges) { -+ int ret; -+ -+ ret = allocate_crash_memory_ranges(); -+ if (ret) -+ return ret; -+ } - - pr_debug("crash_memory_range[%d] [%#016llx-%#016llx], %#llx bytes\n", - crash_mem_ranges, base, end - 1, (end - base)); - crash_memory_ranges[crash_mem_ranges].base = base; - crash_memory_ranges[crash_mem_ranges].size = end - base; - crash_mem_ranges++; -+ return 0; - } - --static void fadump_exclude_reserved_area(unsigned long long start, -+static int fadump_exclude_reserved_area(unsigned long long start, - unsigned long long end) - { - unsigned long long ra_start, ra_end; -+ int ret = 0; - - ra_start = fw_dump.reserve_dump_area_start; - ra_end = ra_start + fw_dump.reserve_dump_area_size; - - if ((ra_start < end) && (ra_end > start)) { - if ((start < ra_start) && (end > ra_end)) { -- fadump_add_crash_memory(start, ra_start); -- fadump_add_crash_memory(ra_end, end); -+ ret = fadump_add_crash_memory(start, ra_start); -+ if (ret) -+ return ret; -+ -+ ret = fadump_add_crash_memory(ra_end, end); - } else if (start < ra_start) { -- fadump_add_crash_memory(start, ra_start); -+ ret = fadump_add_crash_memory(start, ra_start); - } else if (ra_end < end) { -- fadump_add_crash_memory(ra_end, end); -+ ret = fadump_add_crash_memory(ra_end, end); - } - } else -- fadump_add_crash_memory(start, end); -+ ret = fadump_add_crash_memory(start, end); -+ -+ return ret; - } - - static int fadump_init_elfcore_header(char *bufp) -@@ -793,10 +846,11 @@ static int fadump_init_elfcore_header(char *bufp) - * Traverse through memblock structure and setup crash memory ranges. These - * ranges will be used create PT_LOAD program headers in elfcore header. - */ --static void fadump_setup_crash_memory_ranges(void) -+static int fadump_setup_crash_memory_ranges(void) - { - struct memblock_region *reg; - unsigned long long start, end; -+ int ret; - - pr_debug("Setup crash memory ranges.\n"); - crash_mem_ranges = 0; -@@ -807,7 +861,9 @@ static void fadump_setup_crash_memory_ranges(void) - * specified during fadump registration. We need to create a separate - * program header for this chunk with the correct offset. - */ -- fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); -+ ret = fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); -+ if (ret) -+ return ret; - - for_each_memblock(memory, reg) { - start = (unsigned long long)reg->base; -@@ -816,8 +872,12 @@ static void fadump_setup_crash_memory_ranges(void) - start = fw_dump.boot_memory_size; - - /* add this range excluding the reserved dump area. */ -- fadump_exclude_reserved_area(start, end); -+ ret = fadump_exclude_reserved_area(start, end); -+ if (ret) -+ return ret; - } -+ -+ return 0; - } - - /* -@@ -941,6 +1001,7 @@ static void register_fadump(void) - { - unsigned long addr; - void *vaddr; -+ int ret; - - /* - * If no memory is reserved then we can not register for firmware- -@@ -949,7 +1010,9 @@ static void register_fadump(void) - if (!fw_dump.reserve_dump_area_size) - return; - -- fadump_setup_crash_memory_ranges(); -+ ret = fadump_setup_crash_memory_ranges(); -+ if (ret) -+ return ret; - - addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len); - /* Initialize fadump crash info header. */ -@@ -1028,6 +1091,7 @@ void fadump_cleanup(void) - } else if (fw_dump.dump_registered) { - /* Un-register Firmware-assisted dump if it was registered. */ - fadump_unregister_dump(&fdm); -+ free_crash_memory_ranges(); - } - } - -diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c -index 3b6647e574b6..f5313a78e5d6 100644 ---- a/arch/powerpc/platforms/pseries/ras.c -+++ b/arch/powerpc/platforms/pseries/ras.c -@@ -300,7 +300,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) - } - - savep = __va(regs->gpr[3]); -- regs->gpr[3] = savep[0]; /* restore original r3 */ -+ regs->gpr[3] = be64_to_cpu(savep[0]); /* restore original r3 */ - - /* If it isn't an extended log we can use the per cpu 64bit buffer */ - h = (struct rtas_error_log *)&savep[1]; -diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c -index 646988d4c1a3..740f43b9b541 100644 ---- a/arch/sparc/kernel/sys_sparc_32.c -+++ b/arch/sparc/kernel/sys_sparc_32.c -@@ -201,23 +201,27 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, - - asmlinkage long sys_getdomainname(char __user *name, int len) - { -- int nlen, err; -- -+ int nlen, err; -+ char tmp[__NEW_UTS_LEN + 1]; -+ - if (len < 0) - return -EINVAL; - -- down_read(&uts_sem); -- -+ down_read(&uts_sem); -+ - nlen = strlen(utsname()->domainname) + 1; - err = -EINVAL; - if (nlen > len) -- goto out; -+ goto out_unlock; -+ memcpy(tmp, utsname()->domainname, nlen); - -- err = -EFAULT; -- if (!copy_to_user(name, utsname()->domainname, nlen)) -- err = 0; -+ up_read(&uts_sem); - --out: -+ if (copy_to_user(name, tmp, nlen)) -+ return -EFAULT; -+ return 0; -+ -+out_unlock: - up_read(&uts_sem); - return err; - } -diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index 7f0f7c01b297..f63cd2ea8470 100644 ---- a/arch/sparc/kernel/sys_sparc_64.c -+++ b/arch/sparc/kernel/sys_sparc_64.c -@@ -524,23 +524,27 @@ extern void check_pending(int signum); - - SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) - { -- int nlen, err; -+ int nlen, err; -+ char tmp[__NEW_UTS_LEN + 1]; - - if (len < 0) - return -EINVAL; - -- down_read(&uts_sem); -- -+ down_read(&uts_sem); -+ - nlen = strlen(utsname()->domainname) + 1; - err = -EINVAL; - if (nlen > len) -- goto out; -+ goto out_unlock; -+ memcpy(tmp, utsname()->domainname, nlen); -+ -+ up_read(&uts_sem); - -- err = -EFAULT; -- if (!copy_to_user(name, utsname()->domainname, nlen)) -- err = 0; -+ if (copy_to_user(name, tmp, nlen)) -+ return -EFAULT; -+ return 0; - --out: -+out_unlock: - up_read(&uts_sem); - return err; - } -diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h -index 9016b4b70375..6c5020163db0 100644 ---- a/arch/x86/include/asm/io.h -+++ b/arch/x86/include/asm/io.h -@@ -351,4 +351,10 @@ extern void arch_phys_wc_del(int handle); - #define arch_phys_wc_add arch_phys_wc_add - #endif - -+#ifdef CONFIG_X86_PAT -+extern int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size); -+extern void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size); -+#define arch_io_reserve_memtype_wc arch_io_reserve_memtype_wc -+#endif -+ - #endif /* _ASM_X86_IO_H */ -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index 1007fa80f5a6..0e1dd7d47f05 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -1079,7 +1079,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, - * Map everything starting from the Gb boundary, possibly with 1G pages - */ - while (end - start >= PUD_SIZE) { -- set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn, -+ set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn >> PAGE_SHIFT, - canon_pgprot(pud_pgprot)))); - - start += PUD_SIZE; -diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c -index 3146b1da6d72..5ff0cb74de55 100644 ---- a/arch/x86/mm/pat.c -+++ b/arch/x86/mm/pat.c -@@ -726,6 +726,20 @@ void io_free_memtype(resource_size_t start, resource_size_t end) - free_memtype(start, end); - } - -+int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size) -+{ -+ enum page_cache_mode type = _PAGE_CACHE_MODE_WC; -+ -+ return io_reserve_memtype(start, start + size, &type); -+} -+EXPORT_SYMBOL(arch_io_reserve_memtype_wc); -+ -+void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size) -+{ -+ io_free_memtype(start, start + size); -+} -+EXPORT_SYMBOL(arch_io_free_memtype_wc); -+ - pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, - unsigned long size, pgprot_t vma_prot) - { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -index 73628c7599e7..3aca9a9011fb 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -492,6 +492,10 @@ void amdgpu_bo_force_delete(struct amdgpu_device *adev) - - int amdgpu_bo_init(struct amdgpu_device *adev) - { -+ /* reserve PAT memory space to WC for VRAM */ -+ arch_io_reserve_memtype_wc(adev->mc.aper_base, -+ adev->mc.aper_size); -+ - /* Add an MTRR for the VRAM */ - adev->mc.vram_mtrr = arch_phys_wc_add(adev->mc.aper_base, - adev->mc.aper_size); -@@ -507,6 +511,7 @@ void amdgpu_bo_fini(struct amdgpu_device *adev) - { - amdgpu_ttm_fini(adev); - arch_phys_wc_del(adev->mc.vram_mtrr); -+ arch_io_free_memtype_wc(adev->mc.aper_base, adev->mc.aper_size); - } - - int amdgpu_bo_fbdev_mmap(struct amdgpu_bo *bo, -diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c -index 08f82eae6939..ac12f74e6b32 100644 ---- a/drivers/gpu/drm/ast/ast_ttm.c -+++ b/drivers/gpu/drm/ast/ast_ttm.c -@@ -275,6 +275,8 @@ int ast_mm_init(struct ast_private *ast) - return ret; - } - -+ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); - ast->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), - pci_resource_len(dev->pdev, 0)); - -@@ -283,11 +285,15 @@ int ast_mm_init(struct ast_private *ast) - - void ast_mm_fini(struct ast_private *ast) - { -+ struct drm_device *dev = ast->dev; -+ - ttm_bo_device_release(&ast->ttm.bdev); - - ast_ttm_global_release(ast); - - arch_phys_wc_del(ast->fb_mtrr); -+ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); - } - - void ast_ttm_placement(struct ast_bo *bo, int domain) -diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c -index dfffd528517a..393967025043 100644 ---- a/drivers/gpu/drm/cirrus/cirrus_ttm.c -+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c -@@ -275,6 +275,9 @@ int cirrus_mm_init(struct cirrus_device *cirrus) - return ret; - } - -+ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); -+ - cirrus->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), - pci_resource_len(dev->pdev, 0)); - -@@ -284,6 +287,8 @@ int cirrus_mm_init(struct cirrus_device *cirrus) - - void cirrus_mm_fini(struct cirrus_device *cirrus) - { -+ struct drm_device *dev = cirrus->dev; -+ - if (!cirrus->mm_inited) - return; - -@@ -293,6 +298,8 @@ void cirrus_mm_fini(struct cirrus_device *cirrus) - - arch_phys_wc_del(cirrus->fb_mtrr); - cirrus->fb_mtrr = 0; -+ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); - } - - void cirrus_ttm_placement(struct cirrus_bo *bo, int domain) -diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c -index 19fb0bddc1cd..359fe2b8bb8a 100644 ---- a/drivers/gpu/drm/i915/i915_gem_userptr.c -+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c -@@ -842,6 +842,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev, void *data, struct drm_file *file - I915_USERPTR_UNSYNCHRONIZED)) - return -EINVAL; - -+ if (!args->user_size) -+ return -EINVAL; -+ - if (offset_in_page(args->user_ptr | args->user_size)) - return -EINVAL; - -diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c -index 05108b505fbf..d9df8d32fc35 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_ttm.c -+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c -@@ -274,6 +274,9 @@ int mgag200_mm_init(struct mga_device *mdev) - return ret; - } - -+ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); -+ - mdev->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), - pci_resource_len(dev->pdev, 0)); - -@@ -282,10 +285,14 @@ int mgag200_mm_init(struct mga_device *mdev) - - void mgag200_mm_fini(struct mga_device *mdev) - { -+ struct drm_device *dev = mdev->dev; -+ - ttm_bo_device_release(&mdev->ttm.bdev); - - mgag200_ttm_global_release(mdev); - -+ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), -+ pci_resource_len(dev->pdev, 0)); - arch_phys_wc_del(mdev->fb_mtrr); - mdev->fb_mtrr = 0; - } -diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c -index d2e7d209f651..9835327a3214 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_ttm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c -@@ -397,6 +397,9 @@ nouveau_ttm_init(struct nouveau_drm *drm) - /* VRAM init */ - drm->gem.vram_available = drm->device.info.ram_user; - -+ arch_io_reserve_memtype_wc(device->func->resource_addr(device, 1), -+ device->func->resource_size(device, 1)); -+ - ret = ttm_bo_init_mm(&drm->ttm.bdev, TTM_PL_VRAM, - drm->gem.vram_available >> PAGE_SHIFT); - if (ret) { -@@ -429,6 +432,8 @@ nouveau_ttm_init(struct nouveau_drm *drm) - void - nouveau_ttm_fini(struct nouveau_drm *drm) - { -+ struct nvkm_device *device = nvxx_device(&drm->device); -+ - ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_VRAM); - ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_TT); - -@@ -438,4 +443,7 @@ nouveau_ttm_fini(struct nouveau_drm *drm) - - arch_phys_wc_del(drm->ttm.mtrr); - drm->ttm.mtrr = 0; -+ arch_io_free_memtype_wc(device->func->resource_addr(device, 1), -+ device->func->resource_size(device, 1)); -+ - } -diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c -index 83aee9e814ba..18ec38d0d3f5 100644 ---- a/drivers/gpu/drm/radeon/radeon_object.c -+++ b/drivers/gpu/drm/radeon/radeon_object.c -@@ -447,6 +447,10 @@ void radeon_bo_force_delete(struct radeon_device *rdev) - - int radeon_bo_init(struct radeon_device *rdev) - { -+ /* reserve PAT memory space to WC for VRAM */ -+ arch_io_reserve_memtype_wc(rdev->mc.aper_base, -+ rdev->mc.aper_size); -+ - /* Add an MTRR for the VRAM */ - if (!rdev->fastfb_working) { - rdev->mc.vram_mtrr = arch_phys_wc_add(rdev->mc.aper_base, -@@ -464,6 +468,7 @@ void radeon_bo_fini(struct radeon_device *rdev) - { - radeon_ttm_fini(rdev); - arch_phys_wc_del(rdev->mc.vram_mtrr); -+ arch_io_free_memtype_wc(rdev->mc.aper_base, rdev->mc.aper_size); - } - - /* Returns how many bytes TTM can move per IB. -diff --git a/drivers/iio/frequency/ad9523.c b/drivers/iio/frequency/ad9523.c -index 44a30f286de1..57b1812a5a18 100644 ---- a/drivers/iio/frequency/ad9523.c -+++ b/drivers/iio/frequency/ad9523.c -@@ -507,7 +507,7 @@ static ssize_t ad9523_store(struct device *dev, - return ret; - - if (!state) -- return 0; -+ return len; - - mutex_lock(&indio_dev->mlock); - switch ((u32)this_attr->address) { -@@ -641,7 +641,7 @@ static int ad9523_read_raw(struct iio_dev *indio_dev, - code = (AD9523_CLK_DIST_DIV_PHASE_REV(ret) * 3141592) / - AD9523_CLK_DIST_DIV_REV(ret); - *val = code / 1000000; -- *val2 = (code % 1000000) * 10; -+ *val2 = code % 1000000; - return IIO_VAL_INT_PLUS_MICRO; - default: - return -EINVAL; -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index e913a930ac80..5a63e32a4a6b 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -1315,8 +1315,8 @@ void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, - qi_submit_sync(&desc, iommu); - } - --void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, -- u64 addr, unsigned mask) -+void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, -+ u16 qdep, u64 addr, unsigned mask) - { - struct qi_desc desc; - -@@ -1331,7 +1331,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, - qdep = 0; - - desc.low = QI_DEV_IOTLB_SID(sid) | QI_DEV_IOTLB_QDEP(qdep) | -- QI_DIOTLB_TYPE; -+ QI_DIOTLB_TYPE | QI_DEV_IOTLB_PFSID(pfsid); - - qi_submit_sync(&desc, iommu); - } -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 4efec2db4ee2..49b266433f4c 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -419,6 +419,7 @@ struct device_domain_info { - struct list_head global; /* link to global list */ - u8 bus; /* PCI bus number */ - u8 devfn; /* PCI devfn number */ -+ u16 pfsid; /* SRIOV physical function source ID */ - u8 pasid_supported:3; - u8 pasid_enabled:1; - u8 pri_supported:1; -@@ -1479,6 +1480,20 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info) - return; - - pdev = to_pci_dev(info->dev); -+ /* For IOMMU that supports device IOTLB throttling (DIT), we assign -+ * PFSID to the invalidation desc of a VF such that IOMMU HW can gauge -+ * queue depth at PF level. If DIT is not set, PFSID will be treated as -+ * reserved, which should be set to 0. -+ */ -+ if (!ecap_dit(info->iommu->ecap)) -+ info->pfsid = 0; -+ else { -+ struct pci_dev *pf_pdev; -+ -+ /* pdev will be returned if device is not a vf */ -+ pf_pdev = pci_physfn(pdev); -+ info->pfsid = PCI_DEVID(pf_pdev->bus->number, pf_pdev->devfn); -+ } - - #ifdef CONFIG_INTEL_IOMMU_SVM - /* The PCIe spec, in its wisdom, declares that the behaviour of -@@ -1537,7 +1552,8 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain, - - sid = info->bus << 8 | info->devfn; - qdep = info->ats_qdep; -- qi_flush_dev_iotlb(info->iommu, sid, qdep, addr, mask); -+ qi_flush_dev_iotlb(info->iommu, sid, info->pfsid, -+ qdep, addr, mask); - } - spin_unlock_irqrestore(&device_domain_lock, flags); - } -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index f2c0000de613..95a6ae053714 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -462,8 +462,10 @@ static int bch_writeback_thread(void *arg) - * data on cache. BCACHE_DEV_DETACHING flag is set in - * bch_cached_dev_detach(). - */ -- if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) -+ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { -+ up_write(&dc->writeback_lock); - break; -+ } - } - - up_write(&dc->writeback_lock); -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index d3c55d7754af..905badc6cb17 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -337,7 +337,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd) - disk_super->version = cpu_to_le32(MAX_CACHE_VERSION); - memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name)); - memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version)); -- disk_super->policy_hint_size = 0; -+ disk_super->policy_hint_size = cpu_to_le32(0); - - __copy_sm_root(cmd, disk_super); - -@@ -652,6 +652,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd, - disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]); - disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]); - disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]); -+ disk_super->policy_hint_size = cpu_to_le32(cmd->policy_hint_size); - - disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits); - disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses); -diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c -index 5e047bfc0cc4..518e2dec2aa2 100644 ---- a/drivers/misc/vmw_balloon.c -+++ b/drivers/misc/vmw_balloon.c -@@ -341,7 +341,13 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps) - success = false; - } - -- if (b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) -+ /* -+ * 2MB pages are only supported with batching. If batching is for some -+ * reason disabled, do not use 2MB pages, since otherwise the legacy -+ * mechanism is used with 2MB pages, causing a failure. -+ */ -+ if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) && -+ (b->capabilities & VMW_BALLOON_BATCHED_CMDS)) - b->supported_page_sizes = 2; - else - b->supported_page_sizes = 1; -@@ -450,7 +456,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, - - pfn32 = (u32)pfn; - if (pfn32 != pfn) -- return -1; -+ return -EINVAL; - - STATS_INC(b->stats.lock[false]); - -@@ -460,7 +466,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, - - pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status); - STATS_INC(b->stats.lock_fail[false]); -- return 1; -+ return -EIO; - } - - static int vmballoon_send_batched_lock(struct vmballoon *b, -@@ -597,11 +603,12 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, - - locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status, - target); -- if (locked > 0) { -+ if (locked) { - STATS_INC(b->stats.refused_alloc[false]); - -- if (hv_status == VMW_BALLOON_ERROR_RESET || -- hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED) { -+ if (locked == -EIO && -+ (hv_status == VMW_BALLOON_ERROR_RESET || -+ hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) { - vmballoon_free_page(page, false); - return -EIO; - } -@@ -617,7 +624,7 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, - } else { - vmballoon_free_page(page, false); - } -- return -EIO; -+ return locked; - } - - /* track allocated page */ -@@ -1029,29 +1036,30 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b) - */ - static int vmballoon_vmci_init(struct vmballoon *b) - { -- int error = 0; -+ unsigned long error, dummy; - -- if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) != 0) { -- error = vmci_doorbell_create(&b->vmci_doorbell, -- VMCI_FLAG_DELAYED_CB, -- VMCI_PRIVILEGE_FLAG_RESTRICTED, -- vmballoon_doorbell, b); -- -- if (error == VMCI_SUCCESS) { -- VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, -- b->vmci_doorbell.context, -- b->vmci_doorbell.resource, error); -- STATS_INC(b->stats.doorbell_set); -- } -- } -+ if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0) -+ return 0; - -- if (error != 0) { -- vmballoon_vmci_cleanup(b); -+ error = vmci_doorbell_create(&b->vmci_doorbell, VMCI_FLAG_DELAYED_CB, -+ VMCI_PRIVILEGE_FLAG_RESTRICTED, -+ vmballoon_doorbell, b); - -- return -EIO; -- } -+ if (error != VMCI_SUCCESS) -+ goto fail; -+ -+ error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context, -+ b->vmci_doorbell.resource, dummy); -+ -+ STATS_INC(b->stats.doorbell_set); -+ -+ if (error != VMW_BALLOON_SUCCESS) -+ goto fail; - - return 0; -+fail: -+ vmballoon_vmci_cleanup(b); -+ return -EIO; - } - - /* -@@ -1289,7 +1297,14 @@ static int __init vmballoon_init(void) - - return 0; - } --module_init(vmballoon_init); -+ -+/* -+ * Using late_initcall() instead of module_init() allows the balloon to use the -+ * VMCI doorbell even when the balloon is built into the kernel. Otherwise the -+ * VMCI is probed only after the balloon is initialized. If the balloon is used -+ * as a module, late_initcall() is equivalent to module_init(). -+ */ -+late_initcall(vmballoon_init); - - static void __exit vmballoon_exit(void) - { -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index acec4b565511..1aede726052c 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -902,6 +902,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) - - ret = lan78xx_update_flowcontrol(dev, ecmd.duplex, ladv, radv); - netif_carrier_on(dev->net); -+ -+ tasklet_schedule(&dev->bh); - } - - return ret; -@@ -1361,8 +1363,6 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) - netif_dbg(dev, ifup, dev->net, - "MAC address set to random addr"); - } -- -- tasklet_schedule(&dev->bh); - } - - ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); -diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c -index 6a41e66015b6..062dff1c902d 100644 ---- a/drivers/pwm/pwm-tiehrpwm.c -+++ b/drivers/pwm/pwm-tiehrpwm.c -@@ -384,6 +384,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) - aqcsfrc_mask = AQCSFRC_CSFA_MASK; - } - -+ /* Update shadow register first before modifying active register */ -+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); - /* - * Changes to immediate action on Action Qualifier. This puts - * Action Qualifier control on PWM output from next TBCLK -diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c -index c872a2e54c4b..2603bee2ce07 100644 ---- a/drivers/spi/spi-davinci.c -+++ b/drivers/spi/spi-davinci.c -@@ -220,7 +220,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value) - pdata = &dspi->pdata; - - /* program delay transfers if tx_delay is non zero */ -- if (spicfg->wdelay) -+ if (spicfg && spicfg->wdelay) - spidat1 |= SPIDAT1_WDEL; - - /* -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index 0705d8883ede..8a29ec5992fd 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -1687,12 +1687,12 @@ static int do_register_framebuffer(struct fb_info *fb_info) - return 0; - } - --static int do_unregister_framebuffer(struct fb_info *fb_info) -+static int unbind_console(struct fb_info *fb_info) - { - struct fb_event event; -- int i, ret = 0; -+ int ret; -+ int i = fb_info->node; - -- i = fb_info->node; - if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info) - return -EINVAL; - -@@ -1707,17 +1707,29 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) - unlock_fb_info(fb_info); - console_unlock(); - -+ return ret; -+} -+ -+static int __unlink_framebuffer(struct fb_info *fb_info); -+ -+static int do_unregister_framebuffer(struct fb_info *fb_info) -+{ -+ struct fb_event event; -+ int ret; -+ -+ ret = unbind_console(fb_info); -+ - if (ret) - return -EINVAL; - - pm_vt_switch_unregister(fb_info->dev); - -- unlink_framebuffer(fb_info); -+ __unlink_framebuffer(fb_info); - if (fb_info->pixmap.addr && - (fb_info->pixmap.flags & FB_PIXMAP_DEFAULT)) - kfree(fb_info->pixmap.addr); - fb_destroy_modelist(&fb_info->modelist); -- registered_fb[i] = NULL; -+ registered_fb[fb_info->node] = NULL; - num_registered_fb--; - fb_cleanup_device(fb_info); - event.info = fb_info; -@@ -1730,7 +1742,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) - return 0; - } - --int unlink_framebuffer(struct fb_info *fb_info) -+static int __unlink_framebuffer(struct fb_info *fb_info) - { - int i; - -@@ -1742,6 +1754,20 @@ int unlink_framebuffer(struct fb_info *fb_info) - device_destroy(fb_class, MKDEV(FB_MAJOR, i)); - fb_info->dev = NULL; - } -+ -+ return 0; -+} -+ -+int unlink_framebuffer(struct fb_info *fb_info) -+{ -+ int ret; -+ -+ ret = __unlink_framebuffer(fb_info); -+ if (ret) -+ return ret; -+ -+ unbind_console(fb_info); -+ - return 0; - } - EXPORT_SYMBOL(unlink_framebuffer); -diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c -index e3d026ac382e..f35168ce426b 100644 ---- a/fs/9p/xattr.c -+++ b/fs/9p/xattr.c -@@ -107,7 +107,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, - { - struct kvec kvec = {.iov_base = (void *)value, .iov_len = value_len}; - struct iov_iter from; -- int retval; -+ int retval, err; - - iov_iter_kvec(&from, WRITE | ITER_KVEC, &kvec, 1, value_len); - -@@ -128,7 +128,9 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, - retval); - else - p9_client_write(fid, 0, &from, &retval); -- p9_client_clunk(fid); -+ err = p9_client_clunk(fid); -+ if (!retval && err) -+ retval = err; - return retval; - } - -diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c -index a861bbdfe577..fa8b484d035d 100644 ---- a/fs/nfs/blocklayout/dev.c -+++ b/fs/nfs/blocklayout/dev.c -@@ -162,7 +162,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset, - chunk = div_u64(offset, dev->chunk_size); - div_u64_rem(chunk, dev->nr_children, &chunk_idx); - -- if (chunk_idx > dev->nr_children) { -+ if (chunk_idx >= dev->nr_children) { - dprintk("%s: invalid chunk idx %d (%lld/%lld)\n", - __func__, chunk_idx, offset, dev->chunk_size); - /* error, should not happen */ -diff --git a/fs/quota/quota.c b/fs/quota/quota.c -index 3746367098fd..bb0d643481c8 100644 ---- a/fs/quota/quota.c -+++ b/fs/quota/quota.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - static int check_quotactl_permission(struct super_block *sb, int type, int cmd, - qid_t id) -@@ -644,6 +645,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id, - - if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS)) - return -EINVAL; -+ type = array_index_nospec(type, MAXQUOTAS); - /* - * Quota not supported on this fs? Check this before s_quota_types - * since they needn't be set if quota is not supported at all. -diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c -index 22dba8837a86..539fa934ed93 100644 ---- a/fs/ubifs/journal.c -+++ b/fs/ubifs/journal.c -@@ -661,6 +661,11 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, - spin_lock(&ui->ui_lock); - ui->synced_i_size = ui->ui_size; - spin_unlock(&ui->ui_lock); -+ if (xent) { -+ spin_lock(&host_ui->ui_lock); -+ host_ui->synced_i_size = host_ui->ui_size; -+ spin_unlock(&host_ui->ui_lock); -+ } - mark_inode_clean(c, ui); - mark_inode_clean(c, host_ui); - return 0; -@@ -1107,7 +1112,7 @@ static int recomp_data_node(const struct ubifs_info *c, - int err, len, compr_type, out_len; - - out_len = le32_to_cpu(dn->size); -- buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS); -+ buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS); - if (!buf) - return -ENOMEM; - -@@ -1186,7 +1191,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, - else if (err) - goto out_free; - else { -- if (le32_to_cpu(dn->size) <= dlen) -+ int dn_len = le32_to_cpu(dn->size); -+ -+ if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { -+ ubifs_err(c, "bad data node (block %u, inode %lu)", -+ blk, inode->i_ino); -+ ubifs_dump_node(c, dn); -+ goto out_free; -+ } -+ -+ if (dn_len <= dlen) - dlen = 0; /* Nothing to do */ - else { - int compr_type = le16_to_cpu(dn->compr_type); -diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c -index a0011aa3a779..f43f162e36f4 100644 ---- a/fs/ubifs/lprops.c -+++ b/fs/ubifs/lprops.c -@@ -1091,10 +1091,6 @@ static int scan_check_cb(struct ubifs_info *c, - } - } - -- buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL); -- if (!buf) -- return -ENOMEM; -- - /* - * After an unclean unmount, empty and freeable LEBs - * may contain garbage - do not scan them. -@@ -1113,6 +1109,10 @@ static int scan_check_cb(struct ubifs_info *c, - return LPT_SCAN_CONTINUE; - } - -+ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ - sleb = ubifs_scan(c, lnum, 0, buf, 0); - if (IS_ERR(sleb)) { - ret = PTR_ERR(sleb); -diff --git a/fs/xattr.c b/fs/xattr.c -index 76f01bf4b048..09441c396798 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -453,7 +453,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, - if (error > 0) { - if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || - (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) -- posix_acl_fix_xattr_to_user(kvalue, size); -+ posix_acl_fix_xattr_to_user(kvalue, error); - if (size && copy_to_user(value, kvalue, error)) - error = -EFAULT; - } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) { -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index 23e129ef6726..e353f6600b0b 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -125,6 +125,7 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) - * Extended Capability Register - */ - -+#define ecap_dit(e) ((e >> 41) & 0x1) - #define ecap_pasid(e) ((e >> 40) & 0x1) - #define ecap_pss(e) ((e >> 35) & 0x1f) - #define ecap_eafs(e) ((e >> 34) & 0x1) -@@ -294,6 +295,7 @@ enum { - #define QI_DEV_IOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32) - #define QI_DEV_IOTLB_QDEP(qdep) (((qdep) & 0x1f) << 16) - #define QI_DEV_IOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK) -+#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52)) - #define QI_DEV_IOTLB_SIZE 1 - #define QI_DEV_IOTLB_MAX_INVS 32 - -@@ -318,6 +320,7 @@ enum { - #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) - #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) - #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) -+#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52)) - #define QI_DEV_EIOTLB_MAX_INVS 32 - - #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55) -@@ -463,9 +466,8 @@ extern void qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, - u8 fm, u64 type); - extern void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, - unsigned int size_order, u64 type); --extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, -- u64 addr, unsigned mask); -- -+extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, -+ u16 qdep, u64 addr, unsigned mask); - extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu); - - extern int dmar_ir_support(void); -diff --git a/include/linux/io.h b/include/linux/io.h -index de64c1e53612..8ab45611fc35 100644 ---- a/include/linux/io.h -+++ b/include/linux/io.h -@@ -154,4 +154,26 @@ enum { - void *memremap(resource_size_t offset, size_t size, unsigned long flags); - void memunmap(void *addr); - -+/* -+ * On x86 PAT systems we have memory tracking that keeps track of -+ * the allowed mappings on memory ranges. This tracking works for -+ * all the in-kernel mapping APIs (ioremap*), but where the user -+ * wishes to map a range from a physical device into user memory -+ * the tracking won't be updated. This API is to be used by -+ * drivers which remap physical device pages into userspace, -+ * and wants to make sure they are mapped WC and not UC. -+ */ -+#ifndef arch_io_reserve_memtype_wc -+static inline int arch_io_reserve_memtype_wc(resource_size_t base, -+ resource_size_t size) -+{ -+ return 0; -+} -+ -+static inline void arch_io_free_memtype_wc(resource_size_t base, -+ resource_size_t size) -+{ -+} -+#endif -+ - #endif /* _LINUX_IO_H */ -diff --git a/include/video/udlfb.h b/include/video/udlfb.h -index f9466fa54ba4..2ad9a6d37ff4 100644 ---- a/include/video/udlfb.h -+++ b/include/video/udlfb.h -@@ -87,7 +87,7 @@ struct dlfb_data { - #define MIN_RAW_PIX_BYTES 2 - #define MIN_RAW_CMD_BYTES (RAW_HEADER_BYTES + MIN_RAW_PIX_BYTES) - --#define DL_DEFIO_WRITE_DELAY 5 /* fb_deferred_io.delay in jiffies */ -+#define DL_DEFIO_WRITE_DELAY msecs_to_jiffies(HZ <= 300 ? 4 : 10) /* optimal value for 720p video */ - #define DL_DEFIO_WRITE_DISABLE (HZ*60) /* "disable" with long delay */ - - /* remove these once align.h patch is taken into kernel */ -diff --git a/kernel/kthread.c b/kernel/kthread.c -index 850b255649a2..ac6849ee3057 100644 ---- a/kernel/kthread.c -+++ b/kernel/kthread.c -@@ -313,10 +313,16 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data), - task = create->result; - if (!IS_ERR(task)) { - static const struct sched_param param = { .sched_priority = 0 }; -+ char name[TASK_COMM_LEN]; - va_list args; - - va_start(args, namefmt); -- vsnprintf(task->comm, sizeof(task->comm), namefmt, args); -+ /* -+ * task is already visible to other tasks, so updating -+ * COMM must be protected. -+ */ -+ vsnprintf(name, sizeof(name), namefmt, args); -+ set_task_comm(task, name); - va_end(args); - /* - * root may have changed our (kthreadd's) priority or CPU mask. -diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig -index 02e8dfaa1ce2..9d76184279fe 100644 ---- a/kernel/power/Kconfig -+++ b/kernel/power/Kconfig -@@ -105,6 +105,7 @@ config PM_SLEEP - def_bool y - depends on SUSPEND || HIBERNATE_CALLBACKS - select PM -+ select SRCU - - config PM_SLEEP_SMP - def_bool y -diff --git a/kernel/sys.c b/kernel/sys.c -index f718742e55e6..e2446ade79ba 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -1142,18 +1142,19 @@ static int override_release(char __user *release, size_t len) - - SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) - { -- int errno = 0; -+ struct new_utsname tmp; - - down_read(&uts_sem); -- if (copy_to_user(name, utsname(), sizeof *name)) -- errno = -EFAULT; -+ memcpy(&tmp, utsname(), sizeof(tmp)); - up_read(&uts_sem); -+ if (copy_to_user(name, &tmp, sizeof(tmp))) -+ return -EFAULT; - -- if (!errno && override_release(name->release, sizeof(name->release))) -- errno = -EFAULT; -- if (!errno && override_architecture(name)) -- errno = -EFAULT; -- return errno; -+ if (override_release(name->release, sizeof(name->release))) -+ return -EFAULT; -+ if (override_architecture(name)) -+ return -EFAULT; -+ return 0; - } - - #ifdef __ARCH_WANT_SYS_OLD_UNAME -@@ -1162,55 +1163,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) - */ - SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) - { -- int error = 0; -+ struct old_utsname tmp; - - if (!name) - return -EFAULT; - - down_read(&uts_sem); -- if (copy_to_user(name, utsname(), sizeof(*name))) -- error = -EFAULT; -+ memcpy(&tmp, utsname(), sizeof(tmp)); - up_read(&uts_sem); -+ if (copy_to_user(name, &tmp, sizeof(tmp))) -+ return -EFAULT; - -- if (!error && override_release(name->release, sizeof(name->release))) -- error = -EFAULT; -- if (!error && override_architecture(name)) -- error = -EFAULT; -- return error; -+ if (override_release(name->release, sizeof(name->release))) -+ return -EFAULT; -+ if (override_architecture(name)) -+ return -EFAULT; -+ return 0; - } - - SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) - { -- int error; -+ struct oldold_utsname tmp = {}; - - if (!name) - return -EFAULT; -- if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname))) -- return -EFAULT; - - down_read(&uts_sem); -- error = __copy_to_user(&name->sysname, &utsname()->sysname, -- __OLD_UTS_LEN); -- error |= __put_user(0, name->sysname + __OLD_UTS_LEN); -- error |= __copy_to_user(&name->nodename, &utsname()->nodename, -- __OLD_UTS_LEN); -- error |= __put_user(0, name->nodename + __OLD_UTS_LEN); -- error |= __copy_to_user(&name->release, &utsname()->release, -- __OLD_UTS_LEN); -- error |= __put_user(0, name->release + __OLD_UTS_LEN); -- error |= __copy_to_user(&name->version, &utsname()->version, -- __OLD_UTS_LEN); -- error |= __put_user(0, name->version + __OLD_UTS_LEN); -- error |= __copy_to_user(&name->machine, &utsname()->machine, -- __OLD_UTS_LEN); -- error |= __put_user(0, name->machine + __OLD_UTS_LEN); -+ memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN); -+ memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN); -+ memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN); -+ memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN); -+ memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN); - up_read(&uts_sem); -+ if (copy_to_user(name, &tmp, sizeof(tmp))) -+ return -EFAULT; - -- if (!error && override_architecture(name)) -- error = -EFAULT; -- if (!error && override_release(name->release, sizeof(name->release))) -- error = -EFAULT; -- return error ? -EFAULT : 0; -+ if (override_architecture(name)) -+ return -EFAULT; -+ if (override_release(name->release, sizeof(name->release))) -+ return -EFAULT; -+ return 0; - } - #endif - -@@ -1224,17 +1216,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) - - if (len < 0 || len > __NEW_UTS_LEN) - return -EINVAL; -- down_write(&uts_sem); - errno = -EFAULT; - if (!copy_from_user(tmp, name, len)) { -- struct new_utsname *u = utsname(); -+ struct new_utsname *u; - -+ down_write(&uts_sem); -+ u = utsname(); - memcpy(u->nodename, tmp, len); - memset(u->nodename + len, 0, sizeof(u->nodename) - len); - errno = 0; - uts_proc_notify(UTS_PROC_HOSTNAME); -+ up_write(&uts_sem); - } -- up_write(&uts_sem); - return errno; - } - -@@ -1242,8 +1235,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) - - SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) - { -- int i, errno; -+ int i; - struct new_utsname *u; -+ char tmp[__NEW_UTS_LEN + 1]; - - if (len < 0) - return -EINVAL; -@@ -1252,11 +1246,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) - i = 1 + strlen(u->nodename); - if (i > len) - i = len; -- errno = 0; -- if (copy_to_user(name, u->nodename, i)) -- errno = -EFAULT; -+ memcpy(tmp, u->nodename, i); - up_read(&uts_sem); -- return errno; -+ if (copy_to_user(name, tmp, i)) -+ return -EFAULT; -+ return 0; - } - - #endif -@@ -1275,17 +1269,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len) - if (len < 0 || len > __NEW_UTS_LEN) - return -EINVAL; - -- down_write(&uts_sem); - errno = -EFAULT; - if (!copy_from_user(tmp, name, len)) { -- struct new_utsname *u = utsname(); -+ struct new_utsname *u; - -+ down_write(&uts_sem); -+ u = utsname(); - memcpy(u->domainname, tmp, len); - memset(u->domainname + len, 0, sizeof(u->domainname) - len); - errno = 0; - uts_proc_notify(UTS_PROC_DOMAINNAME); -+ up_write(&uts_sem); - } -- up_write(&uts_sem); - return errno; - } - -diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c -index 7ab5eafea8b2..210b8e726a97 100644 ---- a/kernel/trace/blktrace.c -+++ b/kernel/trace/blktrace.c -@@ -1716,6 +1716,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev, - mutex_lock(&bdev->bd_mutex); - - if (attr == &dev_attr_enable) { -+ if (!!value == !!q->blk_trace) { -+ ret = 0; -+ goto out_unlock_bdev; -+ } - if (value) - ret = blk_trace_setup_queue(q, bdev); - else -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 11761b3dd7ba..e409ddce8754 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6496,7 +6496,9 @@ rb_simple_write(struct file *filp, const char __user *ubuf, - - if (buffer) { - mutex_lock(&trace_types_lock); -- if (val) { -+ if (!!val == tracer_tracing_is_on(tr)) { -+ val = 0; /* do nothing */ -+ } else if (val) { - tracer_tracing_on(tr); - if (tr->current_trace->start) - tr->current_trace->start(tr); -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index 68bb89ad9d28..1dc887bab085 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -969,7 +969,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file) - - list_del_rcu(&link->list); - /* synchronize with u{,ret}probe_trace_func */ -- synchronize_sched(); -+ synchronize_rcu(); - kfree(link); - - if (!list_empty(&tu->tp.files)) -diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index 88fefa68c516..a965df4b54f5 100644 ---- a/kernel/user_namespace.c -+++ b/kernel/user_namespace.c -@@ -602,9 +602,26 @@ static ssize_t map_write(struct file *file, const char __user *buf, - struct uid_gid_map new_map; - unsigned idx; - struct uid_gid_extent *extent = NULL; -- unsigned long page = 0; -+ unsigned long page; - char *kbuf, *pos, *next_line; -- ssize_t ret = -EINVAL; -+ ssize_t ret; -+ -+ /* Only allow < page size writes at the beginning of the file */ -+ if ((*ppos != 0) || (count >= PAGE_SIZE)) -+ return -EINVAL; -+ -+ /* Get a buffer */ -+ page = __get_free_page(GFP_TEMPORARY); -+ kbuf = (char *) page; -+ if (!page) -+ return -ENOMEM; -+ -+ /* Slurp in the user data */ -+ if (copy_from_user(kbuf, buf, count)) { -+ free_page(page); -+ return -EFAULT; -+ } -+ kbuf[count] = '\0'; - - /* - * The userns_state_mutex serializes all writes to any given map. -@@ -638,24 +655,6 @@ static ssize_t map_write(struct file *file, const char __user *buf, - if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN)) - goto out; - -- /* Get a buffer */ -- ret = -ENOMEM; -- page = __get_free_page(GFP_TEMPORARY); -- kbuf = (char *) page; -- if (!page) -- goto out; -- -- /* Only allow < page size writes at the beginning of the file */ -- ret = -EINVAL; -- if ((*ppos != 0) || (count >= PAGE_SIZE)) -- goto out; -- -- /* Slurp in the user data */ -- ret = -EFAULT; -- if (copy_from_user(kbuf, buf, count)) -- goto out; -- kbuf[count] = '\0'; -- - /* Parse the user data */ - ret = -EINVAL; - pos = kbuf; -diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c -index c8eac43267e9..d2b3b2973456 100644 ---- a/kernel/utsname_sysctl.c -+++ b/kernel/utsname_sysctl.c -@@ -17,7 +17,7 @@ - - #ifdef CONFIG_PROC_SYSCTL - --static void *get_uts(struct ctl_table *table, int write) -+static void *get_uts(struct ctl_table *table) - { - char *which = table->data; - struct uts_namespace *uts_ns; -@@ -25,21 +25,9 @@ static void *get_uts(struct ctl_table *table, int write) - uts_ns = current->nsproxy->uts_ns; - which = (which - (char *)&init_uts_ns) + (char *)uts_ns; - -- if (!write) -- down_read(&uts_sem); -- else -- down_write(&uts_sem); - return which; - } - --static void put_uts(struct ctl_table *table, int write, void *which) --{ -- if (!write) -- up_read(&uts_sem); -- else -- up_write(&uts_sem); --} -- - /* - * Special case of dostring for the UTS structure. This has locks - * to observe. Should this be in kernel/sys.c ???? -@@ -49,13 +37,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write, - { - struct ctl_table uts_table; - int r; -+ char tmp_data[__NEW_UTS_LEN + 1]; -+ - memcpy(&uts_table, table, sizeof(uts_table)); -- uts_table.data = get_uts(table, write); -+ uts_table.data = tmp_data; -+ -+ /* -+ * Buffer the value in tmp_data so that proc_dostring() can be called -+ * without holding any locks. -+ * We also need to read the original value in the write==1 case to -+ * support partial writes. -+ */ -+ down_read(&uts_sem); -+ memcpy(tmp_data, get_uts(table), sizeof(tmp_data)); -+ up_read(&uts_sem); - r = proc_dostring(&uts_table, write, buffer, lenp, ppos); -- put_uts(table, write, uts_table.data); - -- if (write) -+ if (write) { -+ /* -+ * Write back the new value. -+ * Note that, since we dropped uts_sem, the result can -+ * theoretically be incorrect if there are two parallel writes -+ * at non-zero offsets to the same sysctl. -+ */ -+ down_write(&uts_sem); -+ memcpy(get_uts(table), tmp_data, sizeof(tmp_data)); -+ up_write(&uts_sem); - proc_sys_poll_notify(table->poll); -+ } - - return r; - } -diff --git a/mm/memory.c b/mm/memory.c -index 42db644f5ec4..5aee9ec8b8c6 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -361,15 +361,6 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table) - { - struct mmu_table_batch **batch = &tlb->batch; - -- /* -- * When there's less then two users of this mm there cannot be a -- * concurrent page-table walk. -- */ -- if (atomic_read(&tlb->mm->mm_users) < 2) { -- __tlb_remove_table(table); -- return; -- } -- - if (*batch == NULL) { - *batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN); - if (*batch == NULL) { -diff --git a/net/9p/client.c b/net/9p/client.c -index 3ff26eb1ea20..ed8738c4dc09 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -931,7 +931,7 @@ static int p9_client_version(struct p9_client *c) - { - int err = 0; - struct p9_req_t *req; -- char *version; -+ char *version = NULL; - int msize; - - p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n", -diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c -index bced8c074c12..2f68ffda3715 100644 ---- a/net/9p/trans_fd.c -+++ b/net/9p/trans_fd.c -@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m) - spin_lock_irqsave(&p9_poll_lock, flags); - list_del_init(&m->poll_pending_link); - spin_unlock_irqrestore(&p9_poll_lock, flags); -+ -+ flush_work(&p9_poll_work); - } - - /** -@@ -933,7 +935,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args) - if (err < 0) - return err; - -- if (valid_ipaddr4(addr) < 0) -+ if (addr == NULL || valid_ipaddr4(addr) < 0) - return -EINVAL; - - csocket = NULL; -@@ -981,6 +983,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) - - csocket = NULL; - -+ if (addr == NULL) -+ return -EINVAL; -+ - if (strlen(addr) >= UNIX_PATH_MAX) { - pr_err("%s (%d): address too long: %s\n", - __func__, task_pid_nr(current), addr); -diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c -index 52b4a2f993f2..f42550dd3560 100644 ---- a/net/9p/trans_rdma.c -+++ b/net/9p/trans_rdma.c -@@ -644,6 +644,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args) - struct ib_qp_init_attr qp_attr; - struct ib_cq_init_attr cq_attr = {}; - -+ if (addr == NULL) -+ return -EINVAL; -+ - /* Parse the transport specific mount options */ - err = parse_opts(args, &opts); - if (err < 0) -diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c -index 2ddeecca5b12..6018a1c0dc28 100644 ---- a/net/9p/trans_virtio.c -+++ b/net/9p/trans_virtio.c -@@ -192,7 +192,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, - s = rest_of_page(data); - if (s > count) - s = count; -- BUG_ON(index > limit); -+ BUG_ON(index >= limit); - /* Make sure we don't terminate early. */ - sg_unmark_end(&sg[index]); - sg_set_buf(&sg[index++], data, s); -@@ -237,6 +237,7 @@ pack_sg_list_p(struct scatterlist *sg, int start, int limit, - s = PAGE_SIZE - data_off; - if (s > count) - s = count; -+ BUG_ON(index >= limit); - /* Make sure we don't terminate early. */ - sg_unmark_end(&sg[index]); - sg_set_page(&sg[index++], pdata[i++], s, data_off); -@@ -409,6 +410,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, - p9_debug(P9_DEBUG_TRANS, "virtio request\n"); - - if (uodata) { -+ __le32 sz; - int n = p9_get_mapped_pages(chan, &out_pages, uodata, - outlen, &offs, &need_drop); - if (n < 0) -@@ -419,6 +421,12 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, - memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4); - outlen = n; - } -+ /* The size field of the message must include the length of the -+ * header and the length of the data. We didn't actually know -+ * the length of the data until this point so add it in now. -+ */ -+ sz = cpu_to_le32(req->tc->size + outlen); -+ memcpy(&req->tc->sdata[0], &sz, sizeof(sz)); - } else if (uidata) { - int n = p9_get_mapped_pages(chan, &in_pages, uidata, - inlen, &offs, &need_drop); -@@ -646,6 +654,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args) - int ret = -ENOENT; - int found = 0; - -+ if (devname == NULL) -+ return -EINVAL; -+ - mutex_lock(&virtio_9p_lock); - list_for_each_entry(chan, &virtio_chan_list, chan_list) { - if (!strncmp(devname, chan->tag, chan->tag_len) && -diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c -index d4353faced35..a10db45b2e1e 100644 ---- a/net/ieee802154/6lowpan/tx.c -+++ b/net/ieee802154/6lowpan/tx.c -@@ -265,9 +265,24 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev) - /* We must take a copy of the skb before we modify/replace the ipv6 - * header as the header could be used elsewhere - */ -- skb = skb_unshare(skb, GFP_ATOMIC); -- if (!skb) -- return NET_XMIT_DROP; -+ if (unlikely(skb_headroom(skb) < ldev->needed_headroom || -+ skb_tailroom(skb) < ldev->needed_tailroom)) { -+ struct sk_buff *nskb; -+ -+ nskb = skb_copy_expand(skb, ldev->needed_headroom, -+ ldev->needed_tailroom, GFP_ATOMIC); -+ if (likely(nskb)) { -+ consume_skb(skb); -+ skb = nskb; -+ } else { -+ kfree_skb(skb); -+ return NET_XMIT_DROP; -+ } -+ } else { -+ skb = skb_unshare(skb, GFP_ATOMIC); -+ if (!skb) -+ return NET_XMIT_DROP; -+ } - - ret = lowpan_header(skb, ldev, &dgram_size, &dgram_offset); - if (ret < 0) { -diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c -index 3827f359b336..9e1ff9d4cf2d 100644 ---- a/net/mac802154/tx.c -+++ b/net/mac802154/tx.c -@@ -72,8 +72,21 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) - int ret; - - if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) { -- u16 crc = crc_ccitt(0, skb->data, skb->len); -+ struct sk_buff *nskb; -+ u16 crc; -+ -+ if (unlikely(skb_tailroom(skb) < IEEE802154_FCS_LEN)) { -+ nskb = skb_copy_expand(skb, 0, IEEE802154_FCS_LEN, -+ GFP_ATOMIC); -+ if (likely(nskb)) { -+ consume_skb(skb); -+ skb = nskb; -+ } else { -+ goto err_tx; -+ } -+ } - -+ crc = crc_ccitt(0, skb->data, skb->len); - put_unaligned_le16(crc, skb_put(skb, 2)); - } - -diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c -index 7f10430af39c..58426e7d320d 100644 ---- a/tools/perf/util/auxtrace.c -+++ b/tools/perf/util/auxtrace.c -@@ -186,6 +186,9 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues, - for (i = 0; i < queues->nr_queues; i++) { - list_splice_tail(&queues->queue_array[i].head, - &queue_array[i].head); -+ queue_array[i].tid = queues->queue_array[i].tid; -+ queue_array[i].cpu = queues->queue_array[i].cpu; -+ queue_array[i].set = queues->queue_array[i].set; - queue_array[i].priv = queues->queue_array[i].priv; - } - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.155-156.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.155-156.patch deleted file mode 100644 index 9615eee6650b..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.155-156.patch +++ /dev/null @@ -1,1864 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2d9f89ec8397..6dd5924a7ea5 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 155 -+SUBLEVEL = 156 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig -index b3490c1c49d1..4187f69f6630 100644 ---- a/arch/arm/configs/imx_v6_v7_defconfig -+++ b/arch/arm/configs/imx_v6_v7_defconfig -@@ -261,7 +261,6 @@ CONFIG_USB_STORAGE=y - CONFIG_USB_CHIPIDEA=y - CONFIG_USB_CHIPIDEA_UDC=y - CONFIG_USB_CHIPIDEA_HOST=y --CONFIG_USB_CHIPIDEA_ULPI=y - CONFIG_USB_SERIAL=m - CONFIG_USB_SERIAL_GENERIC=y - CONFIG_USB_SERIAL_FTDI_SIO=m -@@ -288,7 +287,6 @@ CONFIG_USB_G_NCM=m - CONFIG_USB_GADGETFS=m - CONFIG_USB_MASS_STORAGE=m - CONFIG_USB_G_SERIAL=m --CONFIG_USB_ULPI_BUS=y - CONFIG_MMC=y - CONFIG_MMC_SDHCI=y - CONFIG_MMC_SDHCI_PLTFM=y -diff --git a/arch/arm/include/asm/arch_gicv3.h b/arch/arm/include/asm/arch_gicv3.h -index 7da5503c0591..e08d15184056 100644 ---- a/arch/arm/include/asm/arch_gicv3.h -+++ b/arch/arm/include/asm/arch_gicv3.h -@@ -117,6 +117,7 @@ static inline u32 gic_read_iar(void) - u32 irqstat; - - asm volatile("mrc " __stringify(ICC_IAR1) : "=r" (irqstat)); -+ dsb(sy); - return irqstat; - } - -diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c -index f5313a78e5d6..9795e52bab3d 100644 ---- a/arch/powerpc/platforms/pseries/ras.c -+++ b/arch/powerpc/platforms/pseries/ras.c -@@ -311,7 +311,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) - int len, error_log_length; - - error_log_length = 8 + rtas_error_extended_log_length(h); -- len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX); -+ len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX); - memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX); - memcpy(global_mce_data_buf, h, len); - errhdr = (struct rtas_error_log *)global_mce_data_buf; -diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c -index 3f165d972a0e..994fe73c2ed0 100644 ---- a/arch/powerpc/sysdev/mpic_msgr.c -+++ b/arch/powerpc/sysdev/mpic_msgr.c -@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev) - - /* IO map the message register block. */ - of_address_to_resource(np, 0, &rsrc); -- msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start); -+ msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc)); - if (!msgr_block_addr) { - dev_err(&dev->dev, "Failed to iomap MPIC message registers"); - return -EFAULT; -diff --git a/arch/s390/lib/mem.S b/arch/s390/lib/mem.S -index 16c5998b9792..4254c477e8e0 100644 ---- a/arch/s390/lib/mem.S -+++ b/arch/s390/lib/mem.S -@@ -26,7 +26,7 @@ - */ - ENTRY(memset) - ltgr %r4,%r4 -- bzr %r14 -+ jz .Lmemset_exit - ltgr %r3,%r3 - jnz .Lmemset_fill - aghi %r4,-1 -@@ -41,12 +41,13 @@ ENTRY(memset) - .Lmemset_clear_rest: - larl %r3,.Lmemset_xc - ex %r4,0(%r3) -+.Lmemset_exit: - BR_EX %r14 - .Lmemset_fill: - stc %r3,0(%r2) - cghi %r4,1 - lgr %r1,%r2 -- ber %r14 -+ je .Lmemset_fill_exit - aghi %r4,-2 - srlg %r3,%r4,8 - ltgr %r3,%r3 -@@ -58,6 +59,7 @@ ENTRY(memset) - .Lmemset_fill_rest: - larl %r3,.Lmemset_mvc - ex %r4,0(%r3) -+.Lmemset_fill_exit: - BR_EX %r14 - .Lmemset_xc: - xc 0(1,%r1),0(%r1) -@@ -71,7 +73,7 @@ ENTRY(memset) - */ - ENTRY(memcpy) - ltgr %r4,%r4 -- bzr %r14 -+ jz .Lmemcpy_exit - aghi %r4,-1 - srlg %r5,%r4,8 - ltgr %r5,%r5 -@@ -80,6 +82,7 @@ ENTRY(memcpy) - .Lmemcpy_rest: - larl %r5,.Lmemcpy_mvc - ex %r4,0(%r5) -+.Lmemcpy_exit: - BR_EX %r14 - .Lmemcpy_loop: - mvc 0(256,%r1),0(%r3) -diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h -index 5c686382d84b..095dbc25122a 100644 ---- a/arch/x86/include/asm/pgtable-3level.h -+++ b/arch/x86/include/asm/pgtable-3level.h -@@ -1,6 +1,8 @@ - #ifndef _ASM_X86_PGTABLE_3LEVEL_H - #define _ASM_X86_PGTABLE_3LEVEL_H - -+#include -+ - /* - * Intel Physical Address Extension (PAE) Mode - three-level page - * tables on PPro+ CPUs. -@@ -142,10 +144,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep) - { - pte_t res; - -- /* xchg acts as a barrier before the setting of the high bits */ -- res.pte_low = xchg(&ptep->pte_low, 0); -- res.pte_high = ptep->pte_high; -- ptep->pte_high = 0; -+ res.pte = (pteval_t)atomic64_xchg((atomic64_t *)ptep, 0); - - return res; - } -diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h -index 68a55273ce0f..a67d7f210b7c 100644 ---- a/arch/x86/include/asm/pgtable.h -+++ b/arch/x86/include/asm/pgtable.h -@@ -385,7 +385,7 @@ static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot) - - static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot) - { -- phys_addr_t pfn = page_nr << PAGE_SHIFT; -+ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT; - pfn ^= protnone_mask(pgprot_val(pgprot)); - pfn &= PHYSICAL_PUD_PAGE_MASK; - return __pud(pfn | massage_pgprot(pgprot)); -diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c -index d7af88534971..6fb34bf0f352 100644 ---- a/drivers/irqchip/irq-bcm7038-l1.c -+++ b/drivers/irqchip/irq-bcm7038-l1.c -@@ -216,6 +216,7 @@ static int bcm7038_l1_set_affinity(struct irq_data *d, - return 0; - } - -+#ifdef CONFIG_SMP - static void bcm7038_l1_cpu_offline(struct irq_data *d) - { - struct cpumask *mask = irq_data_get_affinity_mask(d); -@@ -240,6 +241,7 @@ static void bcm7038_l1_cpu_offline(struct irq_data *d) - } - irq_set_affinity_locked(d, &new_affinity, false); - } -+#endif - - static int __init bcm7038_l1_init_one(struct device_node *dn, - unsigned int idx, -@@ -292,7 +294,9 @@ static struct irq_chip bcm7038_l1_irq_chip = { - .irq_mask = bcm7038_l1_mask, - .irq_unmask = bcm7038_l1_unmask, - .irq_set_affinity = bcm7038_l1_set_affinity, -+#ifdef CONFIG_SMP - .irq_cpu_offline = bcm7038_l1_cpu_offline, -+#endif - }; - - static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq, -diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c -index 82e00e3ad0e0..c3d7a1461043 100644 ---- a/drivers/irqchip/irq-gic-v3-its.c -+++ b/drivers/irqchip/irq-gic-v3-its.c -@@ -67,7 +67,10 @@ struct its_node { - unsigned long phys_base; - struct its_cmd_block *cmd_base; - struct its_cmd_block *cmd_write; -- void *tables[GITS_BASER_NR_REGS]; -+ struct { -+ void *base; -+ u32 order; -+ } tables[GITS_BASER_NR_REGS]; - struct its_collection *collections; - struct list_head its_device_list; - u64 flags; -@@ -77,6 +80,9 @@ struct its_node { - - #define ITS_ITT_ALIGN SZ_256 - -+/* Convert page order to size in bytes */ -+#define PAGE_ORDER_TO_SIZE(o) (PAGE_SIZE << (o)) -+ - struct event_lpi_map { - unsigned long *lpi_map; - u16 *col_map; -@@ -816,9 +822,10 @@ static void its_free_tables(struct its_node *its) - int i; - - for (i = 0; i < GITS_BASER_NR_REGS; i++) { -- if (its->tables[i]) { -- free_page((unsigned long)its->tables[i]); -- its->tables[i] = NULL; -+ if (its->tables[i].base) { -+ free_pages((unsigned long)its->tables[i].base, -+ its->tables[i].order); -+ its->tables[i].base = NULL; - } - } - } -@@ -851,7 +858,6 @@ static int its_alloc_tables(const char *node_name, struct its_node *its) - u64 type = GITS_BASER_TYPE(val); - u64 entry_size = GITS_BASER_ENTRY_SIZE(val); - int order = get_order(psz); -- int alloc_size; - int alloc_pages; - u64 tmp; - void *base; -@@ -883,8 +889,8 @@ static int its_alloc_tables(const char *node_name, struct its_node *its) - } - } - -- alloc_size = (1 << order) * PAGE_SIZE; -- alloc_pages = (alloc_size / psz); -+retry_alloc_baser: -+ alloc_pages = (PAGE_ORDER_TO_SIZE(order) / psz); - if (alloc_pages > GITS_BASER_PAGES_MAX) { - alloc_pages = GITS_BASER_PAGES_MAX; - order = get_order(GITS_BASER_PAGES_MAX * psz); -@@ -898,7 +904,8 @@ static int its_alloc_tables(const char *node_name, struct its_node *its) - goto out_free; - } - -- its->tables[i] = base; -+ its->tables[i].base = base; -+ its->tables[i].order = order; - - retry_baser: - val = (virt_to_phys(base) | -@@ -936,7 +943,7 @@ retry_baser: - shr = tmp & GITS_BASER_SHAREABILITY_MASK; - if (!shr) { - cache = GITS_BASER_nC; -- __flush_dcache_area(base, alloc_size); -+ __flush_dcache_area(base, PAGE_ORDER_TO_SIZE(order)); - } - goto retry_baser; - } -@@ -947,13 +954,16 @@ retry_baser: - * size and retry. If we reach 4K, then - * something is horribly wrong... - */ -+ free_pages((unsigned long)base, order); -+ its->tables[i].base = NULL; -+ - switch (psz) { - case SZ_16K: - psz = SZ_4K; -- goto retry_baser; -+ goto retry_alloc_baser; - case SZ_64K: - psz = SZ_16K; -- goto retry_baser; -+ goto retry_alloc_baser; - } - } - -@@ -966,7 +976,7 @@ retry_baser: - } - - pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n", -- (int)(alloc_size / entry_size), -+ (int)(PAGE_ORDER_TO_SIZE(order) / entry_size), - its_base_type_string[type], - (unsigned long)virt_to_phys(base), - psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c -index cebd8efe651a..5fe968a4338a 100644 ---- a/drivers/irqchip/irq-gic.c -+++ b/drivers/irqchip/irq-gic.c -@@ -336,7 +336,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) - irqstat = readl_relaxed(cpu_base + GIC_CPU_INTACK); - irqnr = irqstat & GICC_IAR_INT_ID_MASK; - -- if (likely(irqnr > 15 && irqnr < 1021)) { -+ if (likely(irqnr > 15 && irqnr < 1020)) { - if (static_key_true(&supports_deactivate)) - writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI); - handle_domain_irq(gic->domain, irqnr, regs); -diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c -index 1452ed9aacb4..54c308e6704f 100644 ---- a/drivers/md/dm-kcopyd.c -+++ b/drivers/md/dm-kcopyd.c -@@ -454,6 +454,8 @@ static int run_complete_job(struct kcopyd_job *job) - if (atomic_dec_and_test(&kc->nr_jobs)) - wake_up(&kc->destroyq); - -+ cond_resched(); -+ - return 0; - } - -diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c -index c646784c5a7d..fbec711c4195 100644 ---- a/drivers/mfd/sm501.c -+++ b/drivers/mfd/sm501.c -@@ -714,6 +714,7 @@ sm501_create_subdev(struct sm501_devdata *sm, char *name, - smdev->pdev.name = name; - smdev->pdev.id = sm->pdev_id; - smdev->pdev.dev.parent = sm->dev; -+ smdev->pdev.dev.coherent_dma_mask = 0xffffffff; - - if (res_count) { - smdev->pdev.resource = (struct resource *)(smdev+1); -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index adab5bbb642a..d5b84d68f988 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -230,8 +230,11 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!pci_dev_run_wake(pdev)) - mei_me_set_pm_domain(dev); - -- if (mei_pg_is_enabled(dev)) -+ if (mei_pg_is_enabled(dev)) { - pm_runtime_put_noidle(&pdev->dev); -+ if (hw->d0i3_supported) -+ pm_runtime_allow(&pdev->dev); -+ } - - dev_dbg(&pdev->dev, "initialization successful.\n"); - -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -index cef53f2d9854..ce20bc939b38 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -@@ -185,6 +185,9 @@ struct bcmgenet_mib_counters { - #define UMAC_MAC1 0x010 - #define UMAC_MAX_FRAME_LEN 0x014 - -+#define UMAC_MODE 0x44 -+#define MODE_LINK_STATUS (1 << 5) -+ - #define UMAC_EEE_CTRL 0x064 - #define EN_LPI_RX_PAUSE (1 << 0) - #define EN_LPI_TX_PFC (1 << 1) -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index e96d1f95bb47..4c73feca4842 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -167,8 +167,14 @@ void bcmgenet_mii_setup(struct net_device *dev) - static int bcmgenet_fixed_phy_link_update(struct net_device *dev, - struct fixed_phy_status *status) - { -- if (dev && dev->phydev && status) -- status->link = dev->phydev->link; -+ struct bcmgenet_priv *priv; -+ u32 reg; -+ -+ if (dev && dev->phydev && status) { -+ priv = netdev_priv(dev); -+ reg = bcmgenet_umac_readl(priv, UMAC_MODE); -+ status->link = !!(reg & MODE_LINK_STATUS); -+ } - - return 0; - } -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index b20bce2c7da1..0433fdebda25 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -2683,7 +2683,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - */ - - enic->port_mtu = enic->config.mtu; -- (void)enic_change_mtu(netdev, enic->port_mtu); - - err = enic_set_mac_addr(netdev, enic->mac_addr); - if (err) { -@@ -2732,6 +2731,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - netdev->features |= NETIF_F_HIGHDMA; - - netdev->priv_flags |= IFF_UNICAST_FLT; -+ netdev->mtu = enic->port_mtu; - - err = register_netdev(netdev); - if (err) { -diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -index b28e73ea2c25..f39ad0e66637 100644 ---- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c -+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c -@@ -2388,26 +2388,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev, - return status; - } - --static netdev_features_t qlge_fix_features(struct net_device *ndev, -- netdev_features_t features) --{ -- int err; -- -- /* Update the behavior of vlan accel in the adapter */ -- err = qlge_update_hw_vlan_features(ndev, features); -- if (err) -- return err; -- -- return features; --} -- - static int qlge_set_features(struct net_device *ndev, - netdev_features_t features) - { - netdev_features_t changed = ndev->features ^ features; -+ int err; -+ -+ if (changed & NETIF_F_HW_VLAN_CTAG_RX) { -+ /* Update the behavior of vlan accel in the adapter */ -+ err = qlge_update_hw_vlan_features(ndev, features); -+ if (err) -+ return err; - -- if (changed & NETIF_F_HW_VLAN_CTAG_RX) - qlge_vlan_mode(ndev, features); -+ } - - return 0; - } -@@ -4720,7 +4714,6 @@ static const struct net_device_ops qlge_netdev_ops = { - .ndo_set_mac_address = qlge_set_mac_address, - .ndo_validate_addr = eth_validate_addr, - .ndo_tx_timeout = qlge_tx_timeout, -- .ndo_fix_features = qlge_fix_features, - .ndo_set_features = qlge_set_features, - .ndo_vlan_rx_add_vid = qlge_vlan_rx_add_vid, - .ndo_vlan_rx_kill_vid = qlge_vlan_rx_kill_vid, -diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c -index 379d08f76146..d0a4652bb9ac 100644 ---- a/drivers/pci/host/pci-mvebu.c -+++ b/drivers/pci/host/pci-mvebu.c -@@ -1235,7 +1235,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev) - pcie->realio.start = PCIBIOS_MIN_IO; - pcie->realio.end = min_t(resource_size_t, - IO_SPACE_LIMIT, -- resource_size(&pcie->io)); -+ resource_size(&pcie->io) - 1); - } else - pcie->realio = pcie->io; - -diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c -index 0e0403e024c5..852d2de7f69f 100644 ---- a/drivers/platform/x86/asus-nb-wmi.c -+++ b/drivers/platform/x86/asus-nb-wmi.c -@@ -392,6 +392,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { - { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, - { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, - { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ -+ { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ - { KE_END, 0}, - }; - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 21d174e9ebdb..dac2f6883e28 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -2101,8 +2101,11 @@ static int dasd_eckd_basic_to_ready(struct dasd_device *device) - - static int dasd_eckd_online_to_ready(struct dasd_device *device) - { -- cancel_work_sync(&device->reload_device); -- cancel_work_sync(&device->kick_validate); -+ if (cancel_work_sync(&device->reload_device)) -+ dasd_put_device(device); -+ if (cancel_work_sync(&device->kick_validate)) -+ dasd_put_device(device); -+ - return 0; - }; - -diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c -index 662b2321d1b0..913ebb6d0d29 100644 ---- a/drivers/scsi/aic94xx/aic94xx_init.c -+++ b/drivers/scsi/aic94xx/aic94xx_init.c -@@ -1031,8 +1031,10 @@ static int __init aic94xx_init(void) - - aic94xx_transport_template = - sas_domain_attach_transport(&aic94xx_transport_functions); -- if (!aic94xx_transport_template) -+ if (!aic94xx_transport_template) { -+ err = -ENOMEM; - goto out_destroy_caches; -+ } - - err = pci_register_driver(&aic94xx_pci_driver); - if (err) -diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c -index 47cb163da9a0..4adb1138af09 100644 ---- a/drivers/staging/android/ion/ion.c -+++ b/drivers/staging/android/ion/ion.c -@@ -449,18 +449,6 @@ static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client, - return ERR_PTR(-EINVAL); - } - --struct ion_handle *ion_handle_get_by_id(struct ion_client *client, -- int id) --{ -- struct ion_handle *handle; -- -- mutex_lock(&client->lock); -- handle = ion_handle_get_by_id_nolock(client, id); -- mutex_unlock(&client->lock); -- -- return handle; --} -- - static bool ion_handle_validate(struct ion_client *client, - struct ion_handle *handle) - { -@@ -1138,24 +1126,28 @@ static struct dma_buf_ops dma_buf_ops = { - .kunmap = ion_dma_buf_kunmap, - }; - --struct dma_buf *ion_share_dma_buf(struct ion_client *client, -- struct ion_handle *handle) -+static struct dma_buf *__ion_share_dma_buf(struct ion_client *client, -+ struct ion_handle *handle, -+ bool lock_client) - { - DEFINE_DMA_BUF_EXPORT_INFO(exp_info); - struct ion_buffer *buffer; - struct dma_buf *dmabuf; - bool valid_handle; - -- mutex_lock(&client->lock); -+ if (lock_client) -+ mutex_lock(&client->lock); - valid_handle = ion_handle_validate(client, handle); - if (!valid_handle) { - WARN(1, "%s: invalid handle passed to share.\n", __func__); -- mutex_unlock(&client->lock); -+ if (lock_client) -+ mutex_unlock(&client->lock); - return ERR_PTR(-EINVAL); - } - buffer = handle->buffer; - ion_buffer_get(buffer); -- mutex_unlock(&client->lock); -+ if (lock_client) -+ mutex_unlock(&client->lock); - - exp_info.ops = &dma_buf_ops; - exp_info.size = buffer->size; -@@ -1170,14 +1162,21 @@ struct dma_buf *ion_share_dma_buf(struct ion_client *client, - - return dmabuf; - } -+ -+struct dma_buf *ion_share_dma_buf(struct ion_client *client, -+ struct ion_handle *handle) -+{ -+ return __ion_share_dma_buf(client, handle, true); -+} - EXPORT_SYMBOL(ion_share_dma_buf); - --int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle) -+static int __ion_share_dma_buf_fd(struct ion_client *client, -+ struct ion_handle *handle, bool lock_client) - { - struct dma_buf *dmabuf; - int fd; - -- dmabuf = ion_share_dma_buf(client, handle); -+ dmabuf = __ion_share_dma_buf(client, handle, lock_client); - if (IS_ERR(dmabuf)) - return PTR_ERR(dmabuf); - -@@ -1187,8 +1186,19 @@ int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle) - - return fd; - } -+ -+int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle) -+{ -+ return __ion_share_dma_buf_fd(client, handle, true); -+} - EXPORT_SYMBOL(ion_share_dma_buf_fd); - -+static int ion_share_dma_buf_fd_nolock(struct ion_client *client, -+ struct ion_handle *handle) -+{ -+ return __ion_share_dma_buf_fd(client, handle, false); -+} -+ - struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd) - { - struct dma_buf *dmabuf; -@@ -1335,11 +1345,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) - { - struct ion_handle *handle; - -- handle = ion_handle_get_by_id(client, data.handle.handle); -- if (IS_ERR(handle)) -+ mutex_lock(&client->lock); -+ handle = ion_handle_get_by_id_nolock(client, data.handle.handle); -+ if (IS_ERR(handle)) { -+ mutex_unlock(&client->lock); - return PTR_ERR(handle); -- data.fd.fd = ion_share_dma_buf_fd(client, handle); -- ion_handle_put(handle); -+ } -+ data.fd.fd = ion_share_dma_buf_fd_nolock(client, handle); -+ ion_handle_put_nolock(handle); -+ mutex_unlock(&client->lock); - if (data.fd.fd < 0) - ret = data.fd.fd; - break; -diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c -index 8f181caffca3..619c989c5f37 100644 ---- a/drivers/staging/comedi/drivers/ni_mio_common.c -+++ b/drivers/staging/comedi/drivers/ni_mio_common.c -@@ -5275,11 +5275,11 @@ static int ni_E_init(struct comedi_device *dev, - /* Digital I/O (PFI) subdevice */ - s = &dev->subdevices[NI_PFI_DIO_SUBDEV]; - s->type = COMEDI_SUBD_DIO; -- s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; - s->maxdata = 1; - if (devpriv->is_m_series) { - s->n_chan = 16; - s->insn_bits = ni_pfi_insn_bits; -+ s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; - - ni_writew(dev, s->state, NI_M_PFI_DO_REG); - for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) { -@@ -5288,6 +5288,7 @@ static int ni_E_init(struct comedi_device *dev, - } - } else { - s->n_chan = 10; -+ s->subdev_flags = SDF_INTERNAL; - } - s->insn_config = ni_pfi_insn_config; - -diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c -index 1e668fb7dd4c..176a27bc63aa 100644 ---- a/fs/btrfs/dev-replace.c -+++ b/fs/btrfs/dev-replace.c -@@ -573,6 +573,12 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, - - btrfs_rm_dev_replace_unblocked(fs_info); - -+ /* -+ * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will -+ * update on-disk dev stats value during commit transaction -+ */ -+ atomic_inc(&tgt_device->dev_stats_ccnt); -+ - /* - * this is again a consistent state where no dev_replace procedure - * is running, the target device is part of the filesystem, the -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index d106b981d86f..ae6e3a30e61e 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1011,8 +1011,9 @@ static int btree_writepages(struct address_space *mapping, - - fs_info = BTRFS_I(mapping->host)->root->fs_info; - /* this is a bit racy, but that's ok */ -- ret = percpu_counter_compare(&fs_info->dirty_metadata_bytes, -- BTRFS_DIRTY_METADATA_THRESH); -+ ret = __percpu_counter_compare(&fs_info->dirty_metadata_bytes, -+ BTRFS_DIRTY_METADATA_THRESH, -+ fs_info->dirty_metadata_batch); - if (ret < 0) - return 0; - } -@@ -3987,8 +3988,9 @@ static void __btrfs_btree_balance_dirty(struct btrfs_root *root, - if (flush_delayed) - btrfs_balance_delayed_items(root); - -- ret = percpu_counter_compare(&root->fs_info->dirty_metadata_bytes, -- BTRFS_DIRTY_METADATA_THRESH); -+ ret = __percpu_counter_compare(&root->fs_info->dirty_metadata_bytes, -+ BTRFS_DIRTY_METADATA_THRESH, -+ root->fs_info->dirty_metadata_batch); - if (ret > 0) { - balance_dirty_pages_ratelimited( - root->fs_info->btree_inode->i_mapping); -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 493c7354ec0b..a72f941ca750 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -10410,7 +10410,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info) - /* Don't want to race with allocators so take the groups_sem */ - down_write(&space_info->groups_sem); - spin_lock(&block_group->lock); -- if (block_group->reserved || -+ if (block_group->reserved || block_group->pinned || - btrfs_block_group_used(&block_group->item) || - block_group->ro || - list_is_singular(&block_group->list)) { -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 9ebe027cc4b7..cfe913d2d3df 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -1318,18 +1318,19 @@ static void __del_reloc_root(struct btrfs_root *root) - struct mapping_node *node = NULL; - struct reloc_control *rc = root->fs_info->reloc_ctl; - -- spin_lock(&rc->reloc_root_tree.lock); -- rb_node = tree_search(&rc->reloc_root_tree.rb_root, -- root->node->start); -- if (rb_node) { -- node = rb_entry(rb_node, struct mapping_node, rb_node); -- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); -+ if (rc) { -+ spin_lock(&rc->reloc_root_tree.lock); -+ rb_node = tree_search(&rc->reloc_root_tree.rb_root, -+ root->node->start); -+ if (rb_node) { -+ node = rb_entry(rb_node, struct mapping_node, rb_node); -+ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); -+ } -+ spin_unlock(&rc->reloc_root_tree.lock); -+ if (!node) -+ return; -+ BUG_ON((struct btrfs_root *)node->data != root); - } -- spin_unlock(&rc->reloc_root_tree.lock); -- -- if (!node) -- return; -- BUG_ON((struct btrfs_root *)node->data != root); - - spin_lock(&root->fs_info->trans_lock); - list_del_init(&root->root_list); -diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c -index bcbe42fb7e92..0e72a14228f8 100644 ---- a/fs/cifs/cifs_debug.c -+++ b/fs/cifs/cifs_debug.c -@@ -285,6 +285,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, - atomic_set(&totBufAllocCount, 0); - atomic_set(&totSmBufAllocCount, 0); - #endif /* CONFIG_CIFS_STATS2 */ -+ spin_lock(&GlobalMid_Lock); -+ GlobalMaxActiveXid = 0; -+ GlobalCurrentXid = 0; -+ spin_unlock(&GlobalMid_Lock); - spin_lock(&cifs_tcp_ses_lock); - list_for_each(tmp1, &cifs_tcp_ses_list) { - server = list_entry(tmp1, struct TCP_Server_Info, -@@ -297,6 +301,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, - struct cifs_tcon, - tcon_list); - atomic_set(&tcon->num_smbs_sent, 0); -+ spin_lock(&tcon->stat_lock); -+ tcon->bytes_read = 0; -+ tcon->bytes_written = 0; -+ spin_unlock(&tcon->stat_lock); - if (server->ops->clear_stats) - server->ops->clear_stats(tcon); - } -diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c -index 76ccf20fbfb7..0e62bf1ebbd7 100644 ---- a/fs/cifs/smb2misc.c -+++ b/fs/cifs/smb2misc.c -@@ -184,6 +184,13 @@ smb2_check_message(char *buf, unsigned int length) - if (clc_len == 4 + len + 1) - return 0; - -+ /* -+ * Some windows servers (win2016) will pad also the final -+ * PDU in a compound to 8 bytes. -+ */ -+ if (((clc_len + 7) & ~7) == len) -+ return 0; -+ - /* - * MacOS server pads after SMB2.1 write response with 3 bytes - * of junk. Other servers match RFC1001 len to actual -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 5f5ba807b414..52d79fb04115 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -315,7 +315,7 @@ small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon, - smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon); - - if (tcon != NULL) { --#ifdef CONFIG_CIFS_STATS2 -+#ifdef CONFIG_CIFS_STATS - uint16_t com_code = le16_to_cpu(smb2_command); - cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); - #endif -diff --git a/fs/dcache.c b/fs/dcache.c -index 807efaab838e..141651b0c766 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -278,7 +278,8 @@ void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry - spin_unlock(&dentry->d_lock); - name->name = p->name; - } else { -- memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN); -+ memcpy(name->inline_name, dentry->d_iname, -+ dentry->d_name.len + 1); - spin_unlock(&dentry->d_lock); - name->name = name->inline_name; - } -diff --git a/fs/fat/cache.c b/fs/fat/cache.c -index 93fc62232ec2..9ae2c4d7e921 100644 ---- a/fs/fat/cache.c -+++ b/fs/fat/cache.c -@@ -224,7 +224,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus) - int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) - { - struct super_block *sb = inode->i_sb; -- const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits; -+ struct msdos_sb_info *sbi = MSDOS_SB(sb); -+ const int limit = sb->s_maxbytes >> sbi->cluster_bits; - struct fat_entry fatent; - struct fat_cache_id cid; - int nr; -@@ -233,6 +234,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) - - *fclus = 0; - *dclus = MSDOS_I(inode)->i_start; -+ if (!fat_valid_entry(sbi, *dclus)) { -+ fat_fs_error_ratelimit(sb, -+ "%s: invalid start cluster (i_pos %lld, start %08x)", -+ __func__, MSDOS_I(inode)->i_pos, *dclus); -+ return -EIO; -+ } - if (cluster == 0) - return 0; - -@@ -249,9 +256,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) - /* prevent the infinite loop of cluster chain */ - if (*fclus > limit) { - fat_fs_error_ratelimit(sb, -- "%s: detected the cluster chain loop" -- " (i_pos %lld)", __func__, -- MSDOS_I(inode)->i_pos); -+ "%s: detected the cluster chain loop (i_pos %lld)", -+ __func__, MSDOS_I(inode)->i_pos); - nr = -EIO; - goto out; - } -@@ -261,9 +267,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) - goto out; - else if (nr == FAT_ENT_FREE) { - fat_fs_error_ratelimit(sb, -- "%s: invalid cluster chain (i_pos %lld)", -- __func__, -- MSDOS_I(inode)->i_pos); -+ "%s: invalid cluster chain (i_pos %lld)", -+ __func__, MSDOS_I(inode)->i_pos); - nr = -EIO; - goto out; - } else if (nr == FAT_ENT_EOF) { -diff --git a/fs/fat/fat.h b/fs/fat/fat.h -index be5e15323bab..1849b1adb6b9 100644 ---- a/fs/fat/fat.h -+++ b/fs/fat/fat.h -@@ -344,6 +344,11 @@ static inline void fatent_brelse(struct fat_entry *fatent) - fatent->fat_inode = NULL; - } - -+static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry) -+{ -+ return FAT_START_ENT <= entry && entry < sbi->max_cluster; -+} -+ - extern void fat_ent_access_init(struct super_block *sb); - extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent, - int entry); -diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c -index 8226557130a2..a70e37c47a78 100644 ---- a/fs/fat/fatent.c -+++ b/fs/fat/fatent.c -@@ -23,7 +23,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry, - { - struct msdos_sb_info *sbi = MSDOS_SB(sb); - int bytes = entry + (entry >> 1); -- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); -+ WARN_ON(!fat_valid_entry(sbi, entry)); - *offset = bytes & (sb->s_blocksize - 1); - *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); - } -@@ -33,7 +33,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry, - { - struct msdos_sb_info *sbi = MSDOS_SB(sb); - int bytes = (entry << sbi->fatent_shift); -- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); -+ WARN_ON(!fat_valid_entry(sbi, entry)); - *offset = bytes & (sb->s_blocksize - 1); - *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); - } -@@ -353,7 +353,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry) - int err, offset; - sector_t blocknr; - -- if (entry < FAT_START_ENT || sbi->max_cluster <= entry) { -+ if (!fat_valid_entry(sbi, entry)) { - fatent_brelse(fatent); - fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry); - return -EIO; -diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c -index 6fc766df0461..2a6f3c67cb3f 100644 ---- a/fs/hfs/brec.c -+++ b/fs/hfs/brec.c -@@ -74,9 +74,10 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len) - if (!fd->bnode) { - if (!tree->root) - hfs_btree_inc_height(tree); -- fd->bnode = hfs_bnode_find(tree, tree->leaf_head); -- if (IS_ERR(fd->bnode)) -- return PTR_ERR(fd->bnode); -+ node = hfs_bnode_find(tree, tree->leaf_head); -+ if (IS_ERR(node)) -+ return PTR_ERR(node); -+ fd->bnode = node; - fd->record = -1; - } - new_node = NULL; -diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c -index d0f39dcbb58e..2b6e2ad57bf9 100644 ---- a/fs/hfsplus/dir.c -+++ b/fs/hfsplus/dir.c -@@ -77,13 +77,13 @@ again: - cpu_to_be32(HFSP_HARDLINK_TYPE) && - entry.file.user_info.fdCreator == - cpu_to_be32(HFSP_HFSPLUS_CREATOR) && -+ HFSPLUS_SB(sb)->hidden_dir && - (entry.file.create_date == - HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)-> - create_date || - entry.file.create_date == - HFSPLUS_I(d_inode(sb->s_root))-> -- create_date) && -- HFSPLUS_SB(sb)->hidden_dir) { -+ create_date)) { - struct qstr str; - char name[32]; - -diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c -index fa40e756c501..422e00dc5f3b 100644 ---- a/fs/hfsplus/super.c -+++ b/fs/hfsplus/super.c -@@ -521,8 +521,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) - goto out_put_root; - if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { - hfs_find_exit(&fd); -- if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) -+ if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { -+ err = -EINVAL; - goto out_put_root; -+ } - inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id)); - if (IS_ERR(inode)) { - err = PTR_ERR(inode); -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index 63a0d0ba36de..64c5386d0c1b 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -317,7 +317,6 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, - struct dentry *upperdir; - struct dentry *upperdentry; - const struct cred *old_cred; -- struct cred *override_cred; - char *link = NULL; - - if (WARN_ON(!workdir)) -@@ -336,28 +335,7 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, - return PTR_ERR(link); - } - -- err = -ENOMEM; -- override_cred = prepare_creds(); -- if (!override_cred) -- goto out_free_link; -- -- override_cred->fsuid = stat->uid; -- override_cred->fsgid = stat->gid; -- /* -- * CAP_SYS_ADMIN for copying up extended attributes -- * CAP_DAC_OVERRIDE for create -- * CAP_FOWNER for chmod, timestamp update -- * CAP_FSETID for chmod -- * CAP_CHOWN for chown -- * CAP_MKNOD for mknod -- */ -- cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN); -- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); -- cap_raise(override_cred->cap_effective, CAP_FOWNER); -- cap_raise(override_cred->cap_effective, CAP_FSETID); -- cap_raise(override_cred->cap_effective, CAP_CHOWN); -- cap_raise(override_cred->cap_effective, CAP_MKNOD); -- old_cred = override_creds(override_cred); -+ old_cred = ovl_override_creds(dentry->d_sb); - - err = -EIO; - if (lock_rename(workdir, upperdir) != NULL) { -@@ -380,9 +358,7 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, - out_unlock: - unlock_rename(workdir, upperdir); - revert_creds(old_cred); -- put_cred(override_cred); - --out_free_link: - if (link) - free_page((unsigned long) link); - -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index 327177df03a5..f8aa54272121 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -408,28 +408,13 @@ static int ovl_create_or_link(struct dentry *dentry, int mode, dev_t rdev, - err = ovl_create_upper(dentry, inode, &stat, link, hardlink); - } else { - const struct cred *old_cred; -- struct cred *override_cred; - -- err = -ENOMEM; -- override_cred = prepare_creds(); -- if (!override_cred) -- goto out_iput; -- -- /* -- * CAP_SYS_ADMIN for setting opaque xattr -- * CAP_DAC_OVERRIDE for create in workdir, rename -- * CAP_FOWNER for removing whiteout from sticky dir -- */ -- cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN); -- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); -- cap_raise(override_cred->cap_effective, CAP_FOWNER); -- old_cred = override_creds(override_cred); -+ old_cred = ovl_override_creds(dentry->d_sb); - - err = ovl_create_over_whiteout(dentry, inode, &stat, link, - hardlink); - - revert_creds(old_cred); -- put_cred(override_cred); - } - - if (!err) -@@ -659,32 +644,11 @@ static int ovl_do_remove(struct dentry *dentry, bool is_dir) - if (OVL_TYPE_PURE_UPPER(type)) { - err = ovl_remove_upper(dentry, is_dir); - } else { -- const struct cred *old_cred; -- struct cred *override_cred; -- -- err = -ENOMEM; -- override_cred = prepare_creds(); -- if (!override_cred) -- goto out_drop_write; -- -- /* -- * CAP_SYS_ADMIN for setting xattr on whiteout, opaque dir -- * CAP_DAC_OVERRIDE for create in workdir, rename -- * CAP_FOWNER for removing whiteout from sticky dir -- * CAP_FSETID for chmod of opaque dir -- * CAP_CHOWN for chown of opaque dir -- */ -- cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN); -- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); -- cap_raise(override_cred->cap_effective, CAP_FOWNER); -- cap_raise(override_cred->cap_effective, CAP_FSETID); -- cap_raise(override_cred->cap_effective, CAP_CHOWN); -- old_cred = override_creds(override_cred); -+ const struct cred *old_cred = ovl_override_creds(dentry->d_sb); - - err = ovl_remove_and_whiteout(dentry, is_dir); - - revert_creds(old_cred); -- put_cred(override_cred); - } - out_drop_write: - ovl_drop_write(dentry); -@@ -723,7 +687,6 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, - bool new_is_dir = false; - struct dentry *opaquedir = NULL; - const struct cred *old_cred = NULL; -- struct cred *override_cred = NULL; - - err = -EINVAL; - if (flags & ~(RENAME_EXCHANGE | RENAME_NOREPLACE)) -@@ -792,26 +755,8 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, - old_opaque = !OVL_TYPE_PURE_UPPER(old_type); - new_opaque = !OVL_TYPE_PURE_UPPER(new_type); - -- if (old_opaque || new_opaque) { -- err = -ENOMEM; -- override_cred = prepare_creds(); -- if (!override_cred) -- goto out_drop_write; -- -- /* -- * CAP_SYS_ADMIN for setting xattr on whiteout, opaque dir -- * CAP_DAC_OVERRIDE for create in workdir -- * CAP_FOWNER for removing whiteout from sticky dir -- * CAP_FSETID for chmod of opaque dir -- * CAP_CHOWN for chown of opaque dir -- */ -- cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN); -- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); -- cap_raise(override_cred->cap_effective, CAP_FOWNER); -- cap_raise(override_cred->cap_effective, CAP_FSETID); -- cap_raise(override_cred->cap_effective, CAP_CHOWN); -- old_cred = override_creds(override_cred); -- } -+ if (old_opaque || new_opaque) -+ old_cred = ovl_override_creds(old->d_sb); - - if (overwrite && OVL_TYPE_MERGE_OR_LOWER(new_type) && new_is_dir) { - opaquedir = ovl_check_empty_and_clear(new); -@@ -942,10 +887,8 @@ out_dput_old: - out_unlock: - unlock_rename(new_upperdir, old_upperdir); - out_revert_creds: -- if (old_opaque || new_opaque) { -+ if (old_opaque || new_opaque) - revert_creds(old_cred); -- put_cred(override_cred); -- } - out_drop_write: - ovl_drop_write(old); - out: -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index 28316b292b8a..27a42975d7cd 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -150,6 +150,7 @@ void ovl_drop_write(struct dentry *dentry); - bool ovl_dentry_is_opaque(struct dentry *dentry); - void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque); - bool ovl_is_whiteout(struct dentry *dentry); -+const struct cred *ovl_override_creds(struct super_block *sb); - void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry); - struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry, - unsigned int flags); -@@ -164,6 +165,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list); - void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list); - void ovl_cache_free(struct list_head *list); - int ovl_check_d_type_supported(struct path *realpath); -+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, -+ struct dentry *dentry, int level); - - /* inode.c */ - int ovl_setattr(struct dentry *dentry, struct iattr *attr); -diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c -index 0c59955c4653..da999e73c97a 100644 ---- a/fs/overlayfs/readdir.c -+++ b/fs/overlayfs/readdir.c -@@ -36,7 +36,8 @@ struct ovl_dir_cache { - - struct ovl_readdir_data { - struct dir_context ctx; -- bool is_merge; -+ struct dentry *dentry; -+ bool is_lowest; - struct rb_root root; - struct list_head *list; - struct list_head middle; -@@ -140,9 +141,9 @@ static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd, - return 0; - } - --static int ovl_fill_lower(struct ovl_readdir_data *rdd, -- const char *name, int namelen, -- loff_t offset, u64 ino, unsigned int d_type) -+static int ovl_fill_lowest(struct ovl_readdir_data *rdd, -+ const char *name, int namelen, -+ loff_t offset, u64 ino, unsigned int d_type) - { - struct ovl_cache_entry *p; - -@@ -194,10 +195,10 @@ static int ovl_fill_merge(struct dir_context *ctx, const char *name, - container_of(ctx, struct ovl_readdir_data, ctx); - - rdd->count++; -- if (!rdd->is_merge) -+ if (!rdd->is_lowest) - return ovl_cache_entry_add_rb(rdd, name, namelen, ino, d_type); - else -- return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type); -+ return ovl_fill_lowest(rdd, name, namelen, offset, ino, d_type); - } - - static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd) -@@ -206,17 +207,8 @@ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd) - struct ovl_cache_entry *p; - struct dentry *dentry; - const struct cred *old_cred; -- struct cred *override_cred; -- -- override_cred = prepare_creds(); -- if (!override_cred) -- return -ENOMEM; - -- /* -- * CAP_DAC_OVERRIDE for lookup -- */ -- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE); -- old_cred = override_creds(override_cred); -+ old_cred = ovl_override_creds(rdd->dentry->d_sb); - - err = mutex_lock_killable(&dir->d_inode->i_mutex); - if (!err) { -@@ -232,7 +224,6 @@ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd) - mutex_unlock(&dir->d_inode->i_mutex); - } - revert_creds(old_cred); -- put_cred(override_cred); - - return err; - } -@@ -257,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath, - err = rdd->err; - } while (!err && rdd->count); - -- if (!err && rdd->first_maybe_whiteout) -+ if (!err && rdd->first_maybe_whiteout && rdd->dentry) - err = ovl_check_whiteouts(realpath->dentry, rdd); - - fput(realfile); -@@ -288,9 +279,10 @@ static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list) - struct path realpath; - struct ovl_readdir_data rdd = { - .ctx.actor = ovl_fill_merge, -+ .dentry = dentry, - .list = list, - .root = RB_ROOT, -- .is_merge = false, -+ .is_lowest = false, - }; - int idx, next; - -@@ -307,7 +299,7 @@ static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list) - * allows offsets to be reasonably constant - */ - list_add(&rdd.middle, rdd.list); -- rdd.is_merge = true; -+ rdd.is_lowest = true; - err = ovl_dir_read(&realpath, &rdd); - list_del(&rdd.middle); - } -@@ -618,3 +610,64 @@ int ovl_check_d_type_supported(struct path *realpath) - - return rdd.d_type_supported; - } -+ -+static void ovl_workdir_cleanup_recurse(struct path *path, int level) -+{ -+ int err; -+ struct inode *dir = path->dentry->d_inode; -+ LIST_HEAD(list); -+ struct ovl_cache_entry *p; -+ struct ovl_readdir_data rdd = { -+ .ctx.actor = ovl_fill_merge, -+ .dentry = NULL, -+ .list = &list, -+ .root = RB_ROOT, -+ .is_lowest = false, -+ }; -+ -+ err = ovl_dir_read(path, &rdd); -+ if (err) -+ goto out; -+ -+ inode_lock_nested(dir, I_MUTEX_PARENT); -+ list_for_each_entry(p, &list, l_node) { -+ struct dentry *dentry; -+ -+ if (p->name[0] == '.') { -+ if (p->len == 1) -+ continue; -+ if (p->len == 2 && p->name[1] == '.') -+ continue; -+ } -+ dentry = lookup_one_len(p->name, path->dentry, p->len); -+ if (IS_ERR(dentry)) -+ continue; -+ if (dentry->d_inode) -+ ovl_workdir_cleanup(dir, path->mnt, dentry, level); -+ dput(dentry); -+ } -+ inode_unlock(dir); -+out: -+ ovl_cache_free(&list); -+} -+ -+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, -+ struct dentry *dentry, int level) -+{ -+ int err; -+ -+ if (!d_is_dir(dentry) || level > 1) { -+ ovl_cleanup(dir, dentry); -+ return; -+ } -+ -+ err = ovl_do_rmdir(dir, dentry); -+ if (err) { -+ struct path path = { .mnt = mnt, .dentry = dentry }; -+ -+ inode_unlock(dir); -+ ovl_workdir_cleanup_recurse(&path, level + 1); -+ inode_lock_nested(dir, I_MUTEX_PARENT); -+ ovl_cleanup(dir, dentry); -+ } -+} -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 0035cb80ecd1..fa20c95bd456 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -42,6 +42,8 @@ struct ovl_fs { - long lower_namelen; - /* pathnames of lower and upper dirs, for show_options */ - struct ovl_config config; -+ /* creds of process who forced instantiation of super block */ -+ const struct cred *creator_cred; - }; - - struct ovl_dir_cache; -@@ -246,6 +248,13 @@ bool ovl_is_whiteout(struct dentry *dentry) - return inode && IS_WHITEOUT(inode); - } - -+const struct cred *ovl_override_creds(struct super_block *sb) -+{ -+ struct ovl_fs *ofs = sb->s_fs_info; -+ -+ return override_creds(ofs->creator_cred); -+} -+ - static bool ovl_is_opaquedir(struct dentry *dentry) - { - int res; -@@ -587,6 +596,7 @@ static void ovl_put_super(struct super_block *sb) - kfree(ufs->config.lowerdir); - kfree(ufs->config.upperdir); - kfree(ufs->config.workdir); -+ put_cred(ufs->creator_cred); - kfree(ufs); - } - -@@ -774,7 +784,7 @@ retry: - goto out_dput; - - retried = true; -- ovl_cleanup(dir, work); -+ ovl_workdir_cleanup(dir, mnt, work, 0); - dput(work); - goto retry; - } -@@ -1107,10 +1117,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) - else - sb->s_d_op = &ovl_dentry_operations; - -+ ufs->creator_cred = prepare_creds(); -+ if (!ufs->creator_cred) -+ goto out_put_lower_mnt; -+ - err = -ENOMEM; - oe = ovl_alloc_entry(numlower); - if (!oe) -- goto out_put_lower_mnt; -+ goto out_put_cred; - - root_dentry = d_make_root(ovl_new_inode(sb, S_IFDIR, oe)); - if (!root_dentry) -@@ -1143,6 +1157,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) - - out_free_oe: - kfree(oe); -+out_put_cred: -+ put_cred(ufs->creator_cred); - out_put_lower_mnt: - for (i = 0; i < ufs->numlower; i++) - mntput(ufs->lower_mnt[i]); -diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h -index 6ca00471afbf..d920a646b578 100644 ---- a/fs/reiserfs/reiserfs.h -+++ b/fs/reiserfs/reiserfs.h -@@ -270,7 +270,7 @@ struct reiserfs_journal_list { - - struct mutex j_commit_mutex; - unsigned int j_trans_id; -- time_t j_timestamp; -+ time64_t j_timestamp; /* write-only but useful for crash dump analysis */ - struct reiserfs_list_bitmap *j_list_bitmap; - struct buffer_head *j_commit_bh; /* commit buffer head */ - struct reiserfs_journal_cnode *j_realblock; -diff --git a/kernel/fork.c b/kernel/fork.c -index ac00f14208b7..37ec96fe739d 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1109,7 +1109,9 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) - return -ENOMEM; - - atomic_set(&sig->count, 1); -+ spin_lock_irq(¤t->sighand->siglock); - memcpy(sig->action, current->sighand->action, sizeof(sig->action)); -+ spin_unlock_irq(¤t->sighand->siglock); - return 0; - } - -diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c -index e4453d9f788c..3c74e13a95dc 100644 ---- a/kernel/irq/chip.c -+++ b/kernel/irq/chip.c -@@ -338,7 +338,6 @@ void handle_nested_irq(unsigned int irq) - raw_spin_lock_irq(&desc->lock); - - desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING); -- kstat_incr_irqs_this_cpu(desc); - - action = desc->action; - if (unlikely(!action || irqd_irq_disabled(&desc->irq_data))) { -@@ -346,6 +345,7 @@ void handle_nested_irq(unsigned int irq) - goto out_unlock; - } - -+ kstat_incr_irqs_this_cpu(desc); - irqd_set(&desc->irq_data, IRQD_IRQ_INPROGRESS); - raw_spin_unlock_irq(&desc->lock); - -@@ -412,13 +412,13 @@ void handle_simple_irq(struct irq_desc *desc) - goto out_unlock; - - desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING); -- kstat_incr_irqs_this_cpu(desc); - - if (unlikely(!desc->action || irqd_irq_disabled(&desc->irq_data))) { - desc->istate |= IRQS_PENDING; - goto out_unlock; - } - -+ kstat_incr_irqs_this_cpu(desc); - handle_irq_event(desc); - - out_unlock: -@@ -462,7 +462,6 @@ void handle_level_irq(struct irq_desc *desc) - goto out_unlock; - - desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING); -- kstat_incr_irqs_this_cpu(desc); - - /* - * If its disabled or no action available -@@ -473,6 +472,7 @@ void handle_level_irq(struct irq_desc *desc) - goto out_unlock; - } - -+ kstat_incr_irqs_this_cpu(desc); - handle_irq_event(desc); - - cond_unmask_irq(desc); -@@ -532,7 +532,6 @@ void handle_fasteoi_irq(struct irq_desc *desc) - goto out; - - desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING); -- kstat_incr_irqs_this_cpu(desc); - - /* - * If its disabled or no action available -@@ -544,6 +543,7 @@ void handle_fasteoi_irq(struct irq_desc *desc) - goto out; - } - -+ kstat_incr_irqs_this_cpu(desc); - if (desc->istate & IRQS_ONESHOT) - mask_irq(desc); - -diff --git a/lib/debugobjects.c b/lib/debugobjects.c -index 547f7f923dbc..a26328ec39f1 100644 ---- a/lib/debugobjects.c -+++ b/lib/debugobjects.c -@@ -295,9 +295,12 @@ static void debug_object_is_on_stack(void *addr, int onstack) - - limit++; - if (is_on_stack) -- pr_warn("object is on stack, but not annotated\n"); -+ pr_warn("object %p is on stack %p, but NOT annotated.\n", addr, -+ task_stack_page(current)); - else -- pr_warn("object is not on stack, but annotated\n"); -+ pr_warn("object %p is NOT on stack %p, but annotated.\n", addr, -+ task_stack_page(current)); -+ - WARN_ON(1); - } - -diff --git a/mm/fadvise.c b/mm/fadvise.c -index b8a5bc66b0c0..001877e32f0c 100644 ---- a/mm/fadvise.c -+++ b/mm/fadvise.c -@@ -68,8 +68,12 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice) - goto out; - } - -- /* Careful about overflows. Len == 0 means "as much as possible" */ -- endbyte = offset + len; -+ /* -+ * Careful about overflows. Len == 0 means "as much as possible". Use -+ * unsigned math because signed overflows are undefined and UBSan -+ * complains. -+ */ -+ endbyte = (u64)offset + (u64)len; - if (!len || endbyte < len) - endbyte = -1; - else -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 0127b788272f..c4ea57ee2fd1 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1393,12 +1393,12 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, - - /* Migration could have started since the pmd_trans_migrating check */ - if (!page_locked) { -+ page_nid = -1; - if (!get_page_unless_zero(page)) - goto out_unlock; - spin_unlock(ptl); - wait_on_page_locked(page); - put_page(page); -- page_nid = -1; - goto out; - } - -diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c -index 6018a1c0dc28..2a15b6aa9cdd 100644 ---- a/net/9p/trans_virtio.c -+++ b/net/9p/trans_virtio.c -@@ -574,7 +574,7 @@ static int p9_virtio_probe(struct virtio_device *vdev) - chan->vq = virtio_find_single_vq(vdev, req_done, "requests"); - if (IS_ERR(chan->vq)) { - err = PTR_ERR(chan->vq); -- goto out_free_vq; -+ goto out_free_chan; - } - chan->vq->vdev->priv = chan; - spin_lock_init(&chan->lock); -@@ -627,6 +627,7 @@ out_free_tag: - kfree(tag); - out_free_vq: - vdev->config->del_vqs(vdev); -+out_free_chan: - kfree(chan); - fail: - return err; -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 4c1c94fa8f08..d270870bf492 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -200,8 +200,9 @@ kill: - inet_twsk_deschedule_put(tw); - return TCP_TW_SUCCESS; - } -+ } else { -+ inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); - } -- inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); - - if (tmp_opt.saw_tstamp) { - tcptw->tw_ts_recent = tmp_opt.rcv_tsval; -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 6aca9a6b2303..60d4052d97a6 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -470,7 +470,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - } - - mtu = dst_mtu(dst); -- if (!skb->ignore_df && skb->len > mtu) { -+ if (skb->len > mtu) { - skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); - - if (skb->protocol == htons(ETH_P_IPV6)) { -diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c -index 4a116d766c15..7cc9db38e1b6 100644 ---- a/net/irda/af_irda.c -+++ b/net/irda/af_irda.c -@@ -774,6 +774,13 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - return -EINVAL; - - lock_sock(sk); -+ -+ /* Ensure that the socket is not already bound */ -+ if (self->ias_obj) { -+ err = -EINVAL; -+ goto out; -+ } -+ - #ifdef CONFIG_IRDA_ULTRA - /* Special care for Ultra sockets */ - if ((sk->sk_type == SOCK_DGRAM) && -@@ -2020,7 +2027,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, - err = -EINVAL; - goto out; - } -- irias_insert_object(ias_obj); -+ -+ /* Only insert newly allocated objects */ -+ if (free_ias) -+ irias_insert_object(ias_obj); -+ - kfree(ias_opt); - break; - case IRLMP_IAS_DEL: -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index dd1649caa2b2..ac212542a217 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -1809,13 +1809,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) { - /* the destination server is not available */ - -- if (sysctl_expire_nodest_conn(ipvs)) { -+ __u32 flags = cp->flags; -+ -+ /* when timer already started, silently drop the packet.*/ -+ if (timer_pending(&cp->timer)) -+ __ip_vs_conn_put(cp); -+ else -+ ip_vs_conn_put(cp); -+ -+ if (sysctl_expire_nodest_conn(ipvs) && -+ !(flags & IP_VS_CONN_F_ONE_PACKET)) { - /* try to expire the connection immediately */ - ip_vs_conn_expire_now(cp); - } -- /* don't restart its timer, and silently -- drop the packet. */ -- __ip_vs_conn_put(cp); -+ - return NF_DROP; - } - -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index 45d4b2f22f62..aff2a1b46f7f 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -501,6 +501,9 @@ static void hhf_destroy(struct Qdisc *sch) - hhf_free(q->hhf_valid_bits[i]); - } - -+ if (!q->hh_flows) -+ return; -+ - for (i = 0; i < HH_FLOWS_CNT; i++) { - struct hh_flow_state *flow, *next; - struct list_head *head = &q->hh_flows[i]; -diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c -index 87b02ed3d5f2..daa01d5604c2 100644 ---- a/net/sched/sch_htb.c -+++ b/net/sched/sch_htb.c -@@ -1025,6 +1025,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) - int err; - int i; - -+ qdisc_watchdog_init(&q->watchdog, sch); -+ INIT_WORK(&q->work, htb_work_func); -+ - if (!opt) - return -EINVAL; - -@@ -1045,8 +1048,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) - for (i = 0; i < TC_HTB_NUMPRIO; i++) - INIT_LIST_HEAD(q->drops + i); - -- qdisc_watchdog_init(&q->watchdog, sch); -- INIT_WORK(&q->work, htb_work_func); - __skb_queue_head_init(&q->direct_queue); - - if (tb[TCA_HTB_DIRECT_QLEN]) -diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c -index bcdd54bb101c..cef36ad691dd 100644 ---- a/net/sched/sch_multiq.c -+++ b/net/sched/sch_multiq.c -@@ -254,7 +254,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt) - static int multiq_init(struct Qdisc *sch, struct nlattr *opt) - { - struct multiq_sched_data *q = qdisc_priv(sch); -- int i, err; -+ int i; - - q->queues = NULL; - -@@ -269,12 +269,7 @@ static int multiq_init(struct Qdisc *sch, struct nlattr *opt) - for (i = 0; i < q->max_bands; i++) - q->queues[i] = &noop_qdisc; - -- err = multiq_tune(sch, opt); -- -- if (err) -- kfree(q->queues); -- -- return err; -+ return multiq_tune(sch, opt); - } - - static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb) -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index b7c29d5b6f04..743ff23885da 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -943,11 +943,11 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt) - struct netem_sched_data *q = qdisc_priv(sch); - int ret; - -+ qdisc_watchdog_init(&q->watchdog, sch); -+ - if (!opt) - return -EINVAL; - -- qdisc_watchdog_init(&q->watchdog, sch); -- - q->loss_model = CLG_RANDOM; - ret = netem_change(sch, opt); - if (ret) -diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c -index c2fbde742f37..a06c9d6bfc9c 100644 ---- a/net/sched/sch_tbf.c -+++ b/net/sched/sch_tbf.c -@@ -432,12 +432,13 @@ static int tbf_init(struct Qdisc *sch, struct nlattr *opt) - { - struct tbf_sched_data *q = qdisc_priv(sch); - -+ qdisc_watchdog_init(&q->watchdog, sch); -+ q->qdisc = &noop_qdisc; -+ - if (opt == NULL) - return -EINVAL; - - q->t_c = ktime_get_ns(); -- qdisc_watchdog_init(&q->watchdog, sch); -- q->qdisc = &noop_qdisc; - - return tbf_change(sch, opt); - } -diff --git a/scripts/depmod.sh b/scripts/depmod.sh -index ea1e96921e3b..baedaef53ca0 100755 ---- a/scripts/depmod.sh -+++ b/scripts/depmod.sh -@@ -15,9 +15,9 @@ if ! test -r System.map ; then - fi - - if [ -z $(command -v $DEPMOD) ]; then -- echo "'make modules_install' requires $DEPMOD. Please install it." >&2 -+ echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2 - echo "This is probably in the kmod package." >&2 -- exit 1 -+ exit 0 - fi - - # older versions of depmod don't support -P -diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index bd5151915e5a..064fbfbbb22c 100644 ---- a/scripts/mod/modpost.c -+++ b/scripts/mod/modpost.c -@@ -649,7 +649,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info, - if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER) - break; - if (symname[0] == '.') { -- char *munged = strdup(symname); -+ char *munged = NOFAIL(strdup(symname)); - munged[0] = '_'; - munged[1] = toupper(munged[1]); - symname = munged; -@@ -1311,7 +1311,7 @@ static Elf_Sym *find_elf_symbol2(struct elf_info *elf, Elf_Addr addr, - static char *sec2annotation(const char *s) - { - if (match(s, init_exit_sections)) { -- char *p = malloc(20); -+ char *p = NOFAIL(malloc(20)); - char *r = p; - - *p++ = '_'; -@@ -1331,7 +1331,7 @@ static char *sec2annotation(const char *s) - strcat(p, " "); - return r; - } else { -- return strdup(""); -+ return NOFAIL(strdup("")); - } - } - -@@ -2032,7 +2032,7 @@ void buf_write(struct buffer *buf, const char *s, int len) - { - if (buf->size - buf->pos < len) { - buf->size += len + SZ; -- buf->p = realloc(buf->p, buf->size); -+ buf->p = NOFAIL(realloc(buf->p, buf->size)); - } - strncpy(buf->p + buf->pos, s, len); - buf->pos += len; -diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c -index a18aecb49935..2b770d3f05d4 100644 ---- a/sound/soc/codecs/wm8994.c -+++ b/sound/soc/codecs/wm8994.c -@@ -2431,6 +2431,7 @@ static int wm8994_set_dai_sysclk(struct snd_soc_dai *dai, - snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_2, - WM8994_OPCLK_ENA, 0); - } -+ break; - - default: - return -EINVAL; -diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c -index f45cee80c58b..af2b1e66e35e 100644 ---- a/tools/testing/selftests/powerpc/harness.c -+++ b/tools/testing/selftests/powerpc/harness.c -@@ -85,13 +85,13 @@ wait: - return status; - } - --static void alarm_handler(int signum) -+static void sig_handler(int signum) - { -- /* Jut wake us up from waitpid */ -+ /* Just wake us up from waitpid */ - } - --static struct sigaction alarm_action = { -- .sa_handler = alarm_handler, -+static struct sigaction sig_action = { -+ .sa_handler = sig_handler, - }; - - int test_harness(int (test_function)(void), char *name) -@@ -101,8 +101,14 @@ int test_harness(int (test_function)(void), char *name) - test_start(name); - test_set_git_version(GIT_VERSION); - -- if (sigaction(SIGALRM, &alarm_action, NULL)) { -- perror("sigaction"); -+ if (sigaction(SIGINT, &sig_action, NULL)) { -+ perror("sigaction (sigint)"); -+ test_error(name); -+ return 1; -+ } -+ -+ if (sigaction(SIGALRM, &sig_action, NULL)) { -+ perror("sigaction (sigalrm)"); - test_error(name); - return 1; - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.156-157.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.156-157.patch deleted file mode 100644 index 2d28f1e48218..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.156-157.patch +++ /dev/null @@ -1,1652 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6dd5924a7ea5..2d55f88e6a08 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 156 -+SUBLEVEL = 157 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig -index f1ac9818b751..dbee1934dfc6 100644 ---- a/arch/arc/configs/axs101_defconfig -+++ b/arch/arc/configs/axs101_defconfig -@@ -1,6 +1,5 @@ - CONFIG_CROSS_COMPILE="arc-linux-" - CONFIG_DEFAULT_HOSTNAME="ARCLinux" --# CONFIG_SWAP is not set - CONFIG_SYSVIPC=y - CONFIG_POSIX_MQUEUE=y - # CONFIG_CROSS_MEMORY_ATTACH is not set -diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig -index 323486d6ee83..561eac854cc3 100644 ---- a/arch/arc/configs/axs103_defconfig -+++ b/arch/arc/configs/axs103_defconfig -@@ -1,6 +1,5 @@ - CONFIG_CROSS_COMPILE="arc-linux-" - CONFIG_DEFAULT_HOSTNAME="ARCLinux" --# CONFIG_SWAP is not set - CONFIG_SYSVIPC=y - CONFIG_POSIX_MQUEUE=y - # CONFIG_CROSS_MEMORY_ATTACH is not set -diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig -index 66191cd0447e..aa4f261b6508 100644 ---- a/arch/arc/configs/axs103_smp_defconfig -+++ b/arch/arc/configs/axs103_smp_defconfig -@@ -1,6 +1,5 @@ - CONFIG_CROSS_COMPILE="arc-linux-" - CONFIG_DEFAULT_HOSTNAME="ARCLinux" --# CONFIG_SWAP is not set - CONFIG_SYSVIPC=y - CONFIG_POSIX_MQUEUE=y - # CONFIG_CROSS_MEMORY_ATTACH is not set -diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c -index d113c8ded6e2..6df3a4ea77fc 100644 ---- a/arch/mips/cavium-octeon/octeon-platform.c -+++ b/arch/mips/cavium-octeon/octeon-platform.c -@@ -349,6 +349,7 @@ static int __init octeon_ehci_device_init(void) - return 0; - - pd = of_find_device_by_node(ehci_node); -+ of_node_put(ehci_node); - if (!pd) - return 0; - -@@ -411,6 +412,7 @@ static int __init octeon_ohci_device_init(void) - return 0; - - pd = of_find_device_by_node(ohci_node); -+ of_node_put(ohci_node); - if (!pd) - return 0; - -diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h -index 75fa296836fc..ab1df19b0957 100644 ---- a/arch/mips/include/asm/io.h -+++ b/arch/mips/include/asm/io.h -@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) - /* - * ISA I/O bus memory addresses are 1:1 with the physical address. - */ --static inline unsigned long isa_virt_to_bus(volatile void * address) -+static inline unsigned long isa_virt_to_bus(volatile void *address) - { -- return (unsigned long)address - PAGE_OFFSET; -+ return virt_to_phys(address); - } - --static inline void * isa_bus_to_virt(unsigned long address) -+static inline void *isa_bus_to_virt(unsigned long address) - { -- return (void *)(address + PAGE_OFFSET); -+ return phys_to_virt(address); - } - - #define isa_page_to_bus page_to_phys -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 354b99f56c1e..ed6cac4a4df0 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, - struct thread_info *ti = task_thread_info(p); - struct pt_regs *childregs, *regs = current_pt_regs(); - unsigned long childksp; -- p->set_child_tid = p->clear_child_tid = NULL; - - childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; - -diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c -index 5d3a25e1cfae..52e8c2026853 100644 ---- a/arch/mips/mm/c-r4k.c -+++ b/arch/mips/mm/c-r4k.c -@@ -712,7 +712,8 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end) - static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) - { - /* Catch bad driver code */ -- BUG_ON(size == 0); -+ if (WARN_ON(size == 0)) -+ return; - - preempt_disable(); - if (cpu_has_inclusive_pcaches) { -@@ -745,7 +746,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) - static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) - { - /* Catch bad driver code */ -- BUG_ON(size == 0); -+ if (WARN_ON(size == 0)) -+ return; - - preempt_disable(); - if (cpu_has_inclusive_pcaches) { -diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c -index 7095dfe7666b..962372143fda 100644 ---- a/arch/openrisc/kernel/process.c -+++ b/arch/openrisc/kernel/process.c -@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp, - - top_of_kernel_stack = sp; - -- p->set_child_tid = p->clear_child_tid = NULL; -- - /* Locate userspace context on stack... */ - sp -= STACK_FRAME_OVERHEAD; /* redzone */ - sp -= sizeof(struct pt_regs); -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 337c52192278..440a948c4feb 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -104,6 +104,8 @@ struct cpuinfo_x86 { - __u8 x86_phys_bits; - /* CPUID returned core id bits: */ - __u8 x86_coreid_bits; -+ -+ __u8 x86_cache_bits; - /* Max extended CPUID function supported: */ - __u32 extended_cpuid_level; - /* Maximum supported CPUID level, -1=no CPUID: */ -@@ -174,7 +176,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c); - - static inline unsigned long long l1tf_pfn_limit(void) - { -- return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); -+ return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT); - } - - extern void early_cpu_init(void); -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index b9e6b60df148..621bc6561189 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -634,6 +634,46 @@ void x86_spec_ctrl_setup_ap(void) - - #undef pr_fmt - #define pr_fmt(fmt) "L1TF: " fmt -+ -+/* -+ * These CPUs all support 44bits physical address space internally in the -+ * cache but CPUID can report a smaller number of physical address bits. -+ * -+ * The L1TF mitigation uses the top most address bit for the inversion of -+ * non present PTEs. When the installed memory reaches into the top most -+ * address bit due to memory holes, which has been observed on machines -+ * which report 36bits physical address bits and have 32G RAM installed, -+ * then the mitigation range check in l1tf_select_mitigation() triggers. -+ * This is a false positive because the mitigation is still possible due to -+ * the fact that the cache uses 44bit internally. Use the cache bits -+ * instead of the reported physical bits and adjust them on the affected -+ * machines to 44bit if the reported bits are less than 44. -+ */ -+static void override_cache_bits(struct cpuinfo_x86 *c) -+{ -+ if (c->x86 != 6) -+ return; -+ -+ switch (c->x86_model) { -+ case INTEL_FAM6_NEHALEM: -+ case INTEL_FAM6_WESTMERE: -+ case INTEL_FAM6_SANDYBRIDGE: -+ case INTEL_FAM6_IVYBRIDGE: -+ case INTEL_FAM6_HASWELL_CORE: -+ case INTEL_FAM6_HASWELL_ULT: -+ case INTEL_FAM6_HASWELL_GT3E: -+ case INTEL_FAM6_BROADWELL_CORE: -+ case INTEL_FAM6_BROADWELL_GT3E: -+ case INTEL_FAM6_SKYLAKE_MOBILE: -+ case INTEL_FAM6_SKYLAKE_DESKTOP: -+ case INTEL_FAM6_KABYLAKE_MOBILE: -+ case INTEL_FAM6_KABYLAKE_DESKTOP: -+ if (c->x86_cache_bits < 44) -+ c->x86_cache_bits = 44; -+ break; -+ } -+} -+ - static void __init l1tf_select_mitigation(void) - { - u64 half_pa; -@@ -641,16 +681,13 @@ static void __init l1tf_select_mitigation(void) - if (!boot_cpu_has_bug(X86_BUG_L1TF)) - return; - -+ override_cache_bits(&boot_cpu_data); -+ - #if CONFIG_PGTABLE_LEVELS == 2 - pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); - return; - #endif - -- /* -- * This is extremely unlikely to happen because almost all -- * systems have far more MAX_PA/2 than RAM can be fit into -- * DIMM slots. -- */ - half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; - if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { - pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 4d3fa79c0f09..b12c0287d6cf 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -798,6 +798,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c) - c->x86_phys_bits = 36; - #endif - -+ c->x86_cache_bits = c->x86_phys_bits; -+ - if (c->extended_cpuid_level >= 0x8000000a) - c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); - -diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index e0a34b0d381e..c4dffae5d939 100644 ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -273,8 +273,6 @@ static noinline int vmalloc_fault(unsigned long address) - if (!(address >= VMALLOC_START && address < VMALLOC_END)) - return -1; - -- WARN_ON_ONCE(in_nmi()); -- - /* - * Synchronize this task's top level page-table - * with the 'reference' page table. -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 46ba2402c8f9..987361113ecd 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, - } - - wb_congested = wb_congested_get_create(&q->backing_dev_info, -- blkcg->css.id, GFP_NOWAIT); -+ blkcg->css.id, -+ GFP_NOWAIT | __GFP_NOWARN); - if (!wb_congested) { - ret = -ENOMEM; - goto err_put_css; -@@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, - - /* allocate */ - if (!new_blkg) { -- new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT); -+ new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN); - if (unlikely(!new_blkg)) { - ret = -ENOMEM; - goto err_put_congested; -@@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) - } - - spin_lock_init(&blkcg->lock); -- INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT); -+ INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN); - INIT_HLIST_HEAD(&blkcg->blkg_list); - #ifdef CONFIG_CGROUP_WRITEBACK - INIT_LIST_HEAD(&blkcg->cgwb_list); -@@ -1238,7 +1239,7 @@ pd_prealloc: - if (blkg->pd[pol->plid]) - continue; - -- pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node); -+ pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node); - if (!pd) - swap(pd, pd_prealloc); - if (!pd) { -diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c -index e04a7b8492cf..4e1f49434bbe 100644 ---- a/block/cfq-iosched.c -+++ b/block/cfq-iosched.c -@@ -2905,7 +2905,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd) - * for devices that support queuing, otherwise we still have a problem - * with sync vs async workloads. - */ -- if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag) -+ if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag && -+ !cfqd->cfq_group_idle) - return; - - WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list)); -@@ -3810,7 +3811,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, - goto out; - } - -- cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO, -+ cfqq = kmem_cache_alloc_node(cfq_pool, -+ GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN, - cfqd->queue->node); - if (!cfqq) { - cfqq = &cfqd->oom_cfqq; -diff --git a/block/partitions/aix.c b/block/partitions/aix.c -index f3ed7b2d89bf..8e7d358e0226 100644 ---- a/block/partitions/aix.c -+++ b/block/partitions/aix.c -@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) - u32 vgda_sector = 0; - u32 vgda_len = 0; - int numlvs = 0; -- struct pvd *pvd; -+ struct pvd *pvd = NULL; - struct lv_info { - unsigned short pps_per_lv; - unsigned short pps_found; -@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) - if (lvip[i].pps_per_lv) - foundlvs += 1; - } -+ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ -+ pvd = alloc_pvd(state, vgda_sector + 17); - } - put_dev_sector(sect); - } -- pvd = alloc_pvd(state, vgda_sector + 17); - if (pvd) { - int numpps = be16_to_cpu(pvd->pp_count); - int psn_part1 = be32_to_cpu(pvd->psn_part1); -@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state) - next_lp_ix += 1; - } - for (i = 0; i < state->limit; i += 1) -- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) -+ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { -+ char tmp[sizeof(n[i].name) + 1]; // null char -+ -+ snprintf(tmp, sizeof(tmp), "%s", n[i].name); - pr_warn("partition %s (%u pp's found) is " - "not contiguous\n", -- n[i].name, lvip[i].pps_found); -+ tmp, lvip[i].pps_found); -+ } - kfree(pvd); - } - kfree(n); -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index 9628fa131757..8116cb2fef2d 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -2113,6 +2113,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) - deto = 20; - } - -+ /* Make dito, mdat, deto bits to 0s */ -+ devslp &= ~GENMASK_ULL(24, 2); - devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | - (mdat << PORT_DEVSLP_MDAT_OFFSET) | - (deto << PORT_DEVSLP_DETO_OFFSET) | -diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c -index 9506e8693c81..d8ef1147b344 100644 ---- a/drivers/crypto/vmx/aes_cbc.c -+++ b/drivers/crypto/vmx/aes_cbc.c -@@ -111,24 +111,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, - ret = crypto_blkcipher_encrypt(&fallback_desc, dst, src, - nbytes); - } else { -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_altivec(); -- enable_kernel_vsx(); -- - blkcipher_walk_init(&walk, dst, src, nbytes); - ret = blkcipher_walk_virt(desc, &walk); - while ((nbytes = walk.nbytes)) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_vsx(); -+ enable_kernel_altivec(); - aes_p8_cbc_encrypt(walk.src.virt.addr, - walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, - &ctx->enc_key, walk.iv, 1); -+ pagefault_enable(); -+ preempt_enable(); -+ - nbytes &= AES_BLOCK_SIZE - 1; - ret = blkcipher_walk_done(desc, &walk, nbytes); - } -- -- pagefault_enable(); -- preempt_enable(); - } - - return ret; -@@ -152,24 +151,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, - ret = crypto_blkcipher_decrypt(&fallback_desc, dst, src, - nbytes); - } else { -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_altivec(); -- enable_kernel_vsx(); -- - blkcipher_walk_init(&walk, dst, src, nbytes); - ret = blkcipher_walk_virt(desc, &walk); - while ((nbytes = walk.nbytes)) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_vsx(); -+ enable_kernel_altivec(); - aes_p8_cbc_encrypt(walk.src.virt.addr, - walk.dst.virt.addr, - nbytes & AES_BLOCK_MASK, - &ctx->dec_key, walk.iv, 0); -+ pagefault_enable(); -+ preempt_enable(); -+ - nbytes &= AES_BLOCK_SIZE - 1; - ret = blkcipher_walk_done(desc, &walk, nbytes); - } -- -- pagefault_enable(); -- preempt_enable(); - } - - return ret; -diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c -index 5536108aa9db..fe21734bbe5c 100644 ---- a/drivers/gpio/gpio-ml-ioh.c -+++ b/drivers/gpio/gpio-ml-ioh.c -@@ -495,9 +495,10 @@ err_irq_alloc_descs: - - chip = chip_save; - err_gpiochip_add: -+ chip = chip_save; - while (--i >= 0) { -- chip--; - gpiochip_remove(&chip->gpio); -+ chip++; - } - kfree(chip_save); - -diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c -index 896bf29776b0..fb2c1df4f588 100644 ---- a/drivers/gpio/gpio-tegra.c -+++ b/drivers/gpio/gpio-tegra.c -@@ -591,4 +591,4 @@ static int __init tegra_gpio_init(void) - { - return platform_driver_register(&tegra_gpio_driver); - } --postcore_initcall(tegra_gpio_init); -+subsys_initcall(tegra_gpio_init); -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index 85f39cc3e276..47581c32b1e1 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -128,6 +128,7 @@ - - #define SBREG_BAR 0x10 - #define SBREG_SMBCTRL 0xc6000c -+#define SBREG_SMBCTRL_DNV 0xcf000c - - /* Host status bits for SMBPCISTS */ - #define SMBPCISTS_INTS 0x08 -@@ -1251,7 +1252,11 @@ static void i801_add_tco(struct i801_priv *priv) - spin_unlock(&p2sb_spinlock); - - res = &tco_res[ICH_RES_MEM_OFF]; -- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; -+ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) -+ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; -+ else -+ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; -+ - res->end = res->start + 3; - res->flags = IORESOURCE_MEM; - -diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c -index 0b20449e48cf..da9acec1a029 100644 ---- a/drivers/i2c/busses/i2c-xiic.c -+++ b/drivers/i2c/busses/i2c-xiic.c -@@ -533,6 +533,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) - { - u8 rx_watermark; - struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; -+ unsigned long flags; - - /* Clear and enable Rx full interrupt. */ - xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); -@@ -548,6 +549,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) - rx_watermark = IIC_RX_FIFO_DEPTH; - xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); - -+ local_irq_save(flags); - if (!(msg->flags & I2C_M_NOSTART)) - /* write the address */ - xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, -@@ -558,6 +560,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) - - xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, - msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); -+ local_irq_restore(flags); -+ - if (i2c->nmsgs == 1) - /* very last, enable bus not busy as well */ - xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index d57a78ec7425..0f42411d6a79 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -1280,9 +1280,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, - (addr->src_addr.ss_family == AF_IB || - cma_protocol_roce_dev_port(id->device, port_num)); - -- return !addr->dev_addr.bound_dev_if || -- (net_eq(dev_net(net_dev), addr->dev_addr.net) && -- addr->dev_addr.bound_dev_if == net_dev->ifindex); -+ /* -+ * Net namespaces must match, and if the listner is listening -+ * on a specific netdevice than netdevice must match as well. -+ */ -+ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && -+ (!!addr->dev_addr.bound_dev_if == -+ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) -+ return true; -+ else -+ return false; - } - - static struct rdma_id_private *cma_find_listener( -diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c -index 88dfe3008cf4..be2f2521c1c5 100644 ---- a/drivers/input/touchscreen/atmel_mxt_ts.c -+++ b/drivers/input/touchscreen/atmel_mxt_ts.c -@@ -1593,10 +1593,11 @@ static int mxt_get_object_table(struct mxt_data *data) - break; - case MXT_TOUCH_MULTI_T9: - data->multitouch = MXT_TOUCH_MULTI_T9; -+ /* Only handle messages from first T9 instance */ - data->T9_reportid_min = min_id; -- data->T9_reportid_max = max_id; -- data->num_touchids = object->num_report_ids -- * mxt_obj_instances(object); -+ data->T9_reportid_max = min_id + -+ object->num_report_ids - 1; -+ data->num_touchids = object->num_report_ids; - break; - case MXT_SPT_MESSAGECOUNT_T44: - data->T44_address = object->start_address; -diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c -index dfb868e2d129..624e7ff76166 100644 ---- a/drivers/iommu/ipmmu-vmsa.c -+++ b/drivers/iommu/ipmmu-vmsa.c -@@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain { - struct io_pgtable_ops *iop; - - unsigned int context_id; -- spinlock_t lock; /* Protects mappings */ -+ struct mutex mutex; /* Protects mappings */ - }; - - struct ipmmu_vmsa_archdata { -@@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type) - if (!domain) - return NULL; - -- spin_lock_init(&domain->lock); -+ mutex_init(&domain->mutex); - - return &domain->io_domain; - } -@@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, - struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu; - struct ipmmu_vmsa_device *mmu = archdata->mmu; - struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); -- unsigned long flags; - unsigned int i; - int ret = 0; - -@@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, - return -ENXIO; - } - -- spin_lock_irqsave(&domain->lock, flags); -+ mutex_lock(&domain->mutex); - - if (!domain->mmu) { - /* The domain hasn't been used yet, initialize it. */ -@@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, - ret = -EINVAL; - } - -- spin_unlock_irqrestore(&domain->lock, flags); -+ mutex_unlock(&domain->mutex); - - if (ret < 0) - return ret; -diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c -index f9512bfa6c3c..0a41132ffba7 100644 ---- a/drivers/macintosh/via-pmu.c -+++ b/drivers/macintosh/via-pmu.c -@@ -530,8 +530,9 @@ init_pmu(void) - int timeout; - struct adb_request req; - -- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ -- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ -+ /* Negate TREQ. Set TACK to input and TREQ to output. */ -+ out_8(&via[B], in_8(&via[B]) | TREQ); -+ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); - - pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); - timeout = 100000; -@@ -1453,8 +1454,8 @@ pmu_sr_intr(void) - struct adb_request *req; - int bite = 0; - -- if (via[B] & TREQ) { -- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); -+ if (in_8(&via[B]) & TREQ) { -+ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); - out_8(&via[IFR], SR_INT); - return NULL; - } -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index d59b861764a1..0841d8f10a58 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -4190,6 +4190,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) - s->failed++; - if (rdev && !test_bit(Faulty, &rdev->flags)) - do_recovery = 1; -+ else if (!rdev) { -+ rdev = rcu_dereference( -+ conf->disks[i].replacement); -+ if (rdev && !test_bit(Faulty, &rdev->flags)) -+ do_recovery = 1; -+ } - } - } - if (test_bit(STRIPE_SYNCING, &sh->state)) { -diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c -index e4e4b22eebc9..4a0f076c91ba 100644 ---- a/drivers/mfd/ti_am335x_tscadc.c -+++ b/drivers/mfd/ti_am335x_tscadc.c -@@ -224,14 +224,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) - * The TSC_ADC_SS controller design assumes the OCP clock is - * at least 6x faster than the ADC clock. - */ -- clk = clk_get(&pdev->dev, "adc_tsc_fck"); -+ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); - if (IS_ERR(clk)) { - dev_err(&pdev->dev, "failed to get TSC fck\n"); - err = PTR_ERR(clk); - goto err_disable_clk; - } - clock_rate = clk_get_rate(clk); -- clk_put(clk); - tscadc->clk_div = clock_rate / ADC_CLK; - - /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ -diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c -index ddc9e4b08b5c..56efa9d18a9a 100644 ---- a/drivers/misc/mic/scif/scif_api.c -+++ b/drivers/misc/mic/scif/scif_api.c -@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) - goto scif_bind_exit; - } - } else { -- pn = scif_get_new_port(); -- if (!pn) { -- ret = -ENOSPC; -+ ret = scif_get_new_port(); -+ if (ret < 0) - goto scif_bind_exit; -- } -+ pn = ret; - } - - ep->state = SCIFEP_BOUND; -@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) - err = -EISCONN; - break; - case SCIFEP_UNBOUND: -- ep->port.port = scif_get_new_port(); -- if (!ep->port.port) { -- err = -ENOSPC; -- } else { -- ep->port.node = scif_info.nodeid; -- ep->conn_async_state = ASYNC_CONN_IDLE; -- } -+ err = scif_get_new_port(); -+ if (err < 0) -+ break; -+ ep->port.port = err; -+ ep->port.node = scif_info.nodeid; -+ ep->conn_async_state = ASYNC_CONN_IDLE; - /* Fall through */ - case SCIFEP_BOUND: - /* -diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c -index 71b64550b591..a1bca836e506 100644 ---- a/drivers/misc/ti-st/st_kim.c -+++ b/drivers/misc/ti-st/st_kim.c -@@ -757,14 +757,14 @@ static int kim_probe(struct platform_device *pdev) - err = gpio_request(kim_gdata->nshutdown, "kim"); - if (unlikely(err)) { - pr_err(" gpio %d request failed ", kim_gdata->nshutdown); -- return err; -+ goto err_sysfs_group; - } - - /* Configure nShutdown GPIO as output=0 */ - err = gpio_direction_output(kim_gdata->nshutdown, 0); - if (unlikely(err)) { - pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); -- return err; -+ goto err_sysfs_group; - } - /* get reference of pdev for request_firmware - */ -diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c -index 518e2dec2aa2..5e9122cd3898 100644 ---- a/drivers/misc/vmw_balloon.c -+++ b/drivers/misc/vmw_balloon.c -@@ -45,6 +45,7 @@ - #include - #include - #include -+#include - #include - - MODULE_AUTHOR("VMware, Inc."); -diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c -index b3c1b8106a68..f4b3ce2b2bc3 100644 ---- a/drivers/mtd/ubi/wl.c -+++ b/drivers/mtd/ubi/wl.c -@@ -1597,8 +1597,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) - cond_resched(); - - e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); -- if (!e) -+ if (!e) { -+ err = -ENOMEM; - goto out_free; -+ } - - e->pnum = aeb->pnum; - e->ec = aeb->ec; -@@ -1617,8 +1619,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) - cond_resched(); - - e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); -- if (!e) -+ if (!e) { -+ err = -ENOMEM; - goto out_free; -+ } - - e->pnum = aeb->pnum; - e->ec = aeb->ec; -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index ea693bbf56d8..1c300259d70a 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -2569,7 +2569,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) - } - - mvneta_start_dev(pp); -- mvneta_port_up(pp); - - netdev_update_features(dev); - -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index c69b0bdd891d..c2e110b2549b 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -371,7 +371,6 @@ struct cpsw_priv { - spinlock_t lock; - struct platform_device *pdev; - struct net_device *ndev; -- struct device_node *phy_node; - struct napi_struct napi_rx; - struct napi_struct napi_tx; - struct device *dev; -@@ -1165,8 +1164,8 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) - cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, - 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); - -- if (priv->phy_node) -- slave->phy = of_phy_connect(priv->ndev, priv->phy_node, -+ if (slave->data->phy_node) -+ slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, - &cpsw_adjust_link, 0, slave->data->phy_if); - else - slave->phy = phy_connect(priv->ndev, slave->data->phy_id, -@@ -1957,12 +1956,11 @@ static void cpsw_slave_init(struct cpsw_slave *slave, struct cpsw_priv *priv, - slave->port_vlan = data->dual_emac_res_vlan; - } - --static int cpsw_probe_dt(struct cpsw_priv *priv, -+static int cpsw_probe_dt(struct cpsw_platform_data *data, - struct platform_device *pdev) - { - struct device_node *node = pdev->dev.of_node; - struct device_node *slave_node; -- struct cpsw_platform_data *data = &priv->data; - int i = 0, ret; - u32 prop; - -@@ -2050,7 +2048,8 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, - if (strcmp(slave_node->name, "slave")) - continue; - -- priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0); -+ slave_data->phy_node = of_parse_phandle(slave_node, -+ "phy-handle", 0); - parp = of_get_property(slave_node, "phy_id", &lenp); - if (of_phy_is_fixed_link(slave_node)) { - struct device_node *phy_node; -@@ -2087,6 +2086,7 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, - } - snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), - PHY_ID_FMT, mdio->name, phyid); -+ put_device(&mdio->dev); - } else { - dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i); - goto no_phy_slave; -@@ -2291,7 +2291,7 @@ static int cpsw_probe(struct platform_device *pdev) - /* Select default pin state */ - pinctrl_pm_select_default_state(&pdev->dev); - -- if (cpsw_probe_dt(priv, pdev)) { -+ if (cpsw_probe_dt(&priv->data, pdev)) { - dev_err(&pdev->dev, "cpsw: platform data missing\n"); - ret = -ENODEV; - goto clean_runtime_disable_ret; -diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h -index 442a7038e660..e50afd1b2eda 100644 ---- a/drivers/net/ethernet/ti/cpsw.h -+++ b/drivers/net/ethernet/ti/cpsw.h -@@ -18,6 +18,7 @@ - #include - - struct cpsw_slave_data { -+ struct device_node *phy_node; - char phy_id[MII_BUS_ID_SIZE]; - int phy_if; - u8 mac_addr[ETH_ALEN]; -diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c -index 6be315303d61..8ecb24186b7f 100644 ---- a/drivers/net/ethernet/ti/davinci_emac.c -+++ b/drivers/net/ethernet/ti/davinci_emac.c -@@ -2108,6 +2108,7 @@ static int davinci_emac_remove(struct platform_device *pdev) - cpdma_ctlr_destroy(priv->dma); - - unregister_netdev(ndev); -+ of_node_put(priv->phy_node); - free_netdev(ndev); - - return 0; -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 916b9b12edd2..4644357d291a 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -2901,6 +2901,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) - passive = channel->flags & IEEE80211_CHAN_NO_IR; - ch->passive = passive; - -+ /* the firmware is ignoring the "radar" flag of the -+ * channel and is scanning actively using Probe Requests -+ * on "Radar detection"/DFS channels which are not -+ * marked as "available" -+ */ -+ ch->passive |= ch->chan_radar; -+ - ch->freq = channel->center_freq; - ch->band_center_freq1 = channel->center_freq; - ch->min_power = 0; -diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -index 02eea3c3b5d3..c72eb4464de9 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c -+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -@@ -1424,6 +1424,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) - cfg->keep_alive_pattern_size = __cpu_to_le32(0); - cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); - cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); -+ cfg->wmi_send_separate = __cpu_to_le32(0); -+ cfg->num_ocb_vdevs = __cpu_to_le32(0); -+ cfg->num_ocb_channels = __cpu_to_le32(0); -+ cfg->num_ocb_schedules = __cpu_to_le32(0); -+ cfg->host_capab = __cpu_to_le32(0); - - ath10k_wmi_put_host_mem_chunks(ar, chunks); - -diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h -index ad655c44afdb..f5031f3965c5 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h -+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h -@@ -1209,6 +1209,11 @@ struct wmi_tlv_resource_config { - __le32 keep_alive_pattern_size; - __le32 max_tdls_concurrent_sleep_sta; - __le32 max_tdls_concurrent_buffer_sta; -+ __le32 wmi_send_separate; -+ __le32 num_ocb_vdevs; -+ __le32 num_ocb_channels; -+ __le32 num_ocb_schedules; -+ __le32 host_capab; - } __packed; - - struct wmi_tlv_init_cmd { -diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c -index 5466246c69b4..b78a2f3745f2 100644 ---- a/drivers/scsi/3w-9xxx.c -+++ b/drivers/scsi/3w-9xxx.c -@@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - - if (twa_initialize_device_extension(tw_dev)) { - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); -+ retval = -ENOMEM; - goto out_free_device_extension; - } - -@@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - tw_dev->base_addr = ioremap(mem_addr, mem_len); - if (!tw_dev->base_addr) { - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); -+ retval = -ENOMEM; - goto out_release_mem_region; - } - -@@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - TW_DISABLE_INTERRUPTS(tw_dev); - - /* Initialize the card */ -- if (twa_reset_sequence(tw_dev, 0)) -+ if (twa_reset_sequence(tw_dev, 0)) { -+ retval = -ENOMEM; - goto out_iounmap; -+ } - - /* Set host specific parameters */ - if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || -diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c -index f8374850f714..f0a5536a9ff5 100644 ---- a/drivers/scsi/3w-sas.c -+++ b/drivers/scsi/3w-sas.c -@@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - - if (twl_initialize_device_extension(tw_dev)) { - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); -+ retval = -ENOMEM; - goto out_free_device_extension; - } - -@@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - tw_dev->base_addr = pci_iomap(pdev, 1, 0); - if (!tw_dev->base_addr) { - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); -+ retval = -ENOMEM; - goto out_release_mem_region; - } - -@@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - /* Initialize the card */ - if (twl_reset_sequence(tw_dev, 0)) { - TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); -+ retval = -ENOMEM; - goto out_iounmap; - } - -diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c -index 14af38036287..308a4206b636 100644 ---- a/drivers/scsi/3w-xxxx.c -+++ b/drivers/scsi/3w-xxxx.c -@@ -2278,6 +2278,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - - if (tw_initialize_device_extension(tw_dev)) { - printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); -+ retval = -ENOMEM; - goto out_free_device_extension; - } - -@@ -2292,6 +2293,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) - tw_dev->base_addr = pci_resource_start(pdev, 0); - if (!tw_dev->base_addr) { - printk(KERN_WARNING "3w-xxxx: Failed to get io address."); -+ retval = -ENOMEM; - goto out_release_mem_region; - } - -diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c -index 12a3893b98fd..ade29c4295b7 100644 ---- a/drivers/staging/rts5208/rtsx_scsi.c -+++ b/drivers/staging/rts5208/rtsx_scsi.c -@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) - - if (sendbytes > 8) { - memcpy(buf, inquiry_buf, 8); -- memcpy(buf + 8, inquiry_string, sendbytes - 8); -+ strncpy(buf + 8, inquiry_string, sendbytes - 8); - if (pro_formatter_flag) { - /* Additional Length */ - buf[4] = 0x33; -diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c -index 10fea7bb8f30..3db4a2570b19 100644 ---- a/drivers/staging/rts5208/xd.c -+++ b/drivers/staging/rts5208/xd.c -@@ -1252,7 +1252,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk, - reg = 0; - rtsx_read_register(chip, XD_CTL, ®); - if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) { -- wait_timeout(100); -+ mdelay(100); - - if (detect_card_cd(chip, - XD_CARD) != STATUS_SUCCESS) { -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 21f888ac550e..7199bac67333 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -306,6 +306,7 @@ void __transport_register_session( - { - const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; - unsigned char buf[PR_REG_ISID_LEN]; -+ unsigned long flags; - - se_sess->se_tpg = se_tpg; - se_sess->fabric_sess_ptr = fabric_sess_ptr; -@@ -342,7 +343,7 @@ void __transport_register_session( - se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); - } - -- spin_lock_irq(&se_nacl->nacl_sess_lock); -+ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); - /* - * The se_nacl->nacl_sess pointer will be set to the - * last active I_T Nexus for each struct se_node_acl. -@@ -351,7 +352,7 @@ void __transport_register_session( - - list_add_tail(&se_sess->sess_acl_list, - &se_nacl->acl_sess_list); -- spin_unlock_irq(&se_nacl->nacl_sess_lock); -+ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); - } - list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); - -diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c -index 802eac7e561b..2b8f2e0a4224 100644 ---- a/drivers/tty/rocket.c -+++ b/drivers/tty/rocket.c -@@ -1915,7 +1915,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) - ByteIO_t UPCIRingInd = 0; - - if (!dev || !pci_match_id(rocket_pci_ids, dev) || -- pci_enable_device(dev)) -+ pci_enable_device(dev) || i >= NUM_BOARDS) - return 0; - - rcktpt_io_addr[i] = pci_resource_start(dev, 0); -diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c -index bcc1fc027311..b9823eb9c195 100644 ---- a/drivers/uio/uio.c -+++ b/drivers/uio/uio.c -@@ -833,8 +833,6 @@ int __uio_register_device(struct module *owner, - if (ret) - goto err_uio_dev_add_attributes; - -- info->uio_dev = idev; -- - if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { - /* - * Note that we deliberately don't use devm_request_irq -@@ -850,6 +848,7 @@ int __uio_register_device(struct module *owner, - goto err_request_irq; - } - -+ info->uio_dev = idev; - return 0; - - err_request_irq: -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 128a3c0a9286..9dbf1583bd7a 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -3675,6 +3675,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) - } - - spin_lock_irqsave(&xhci->lock, flags); -+ -+ virt_dev->udev = NULL; -+ - /* Don't disable the slot if the host controller is dead. */ - state = readl(&xhci->op_regs->status); - if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || -diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h -index 502d3892d8a4..d71e7ad4d382 100644 ---- a/fs/autofs4/autofs_i.h -+++ b/fs/autofs4/autofs_i.h -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - - /* This is the range of ioctl() numbers we claim as ours */ - #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY -@@ -135,7 +136,8 @@ struct autofs_sb_info { - - static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) - { -- return (struct autofs_sb_info *)(sb->s_fs_info); -+ return sb->s_magic != AUTOFS_SUPER_MAGIC ? -+ NULL : (struct autofs_sb_info *)(sb->s_fs_info); - } - - static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) -diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c -index a3ae0b2aeb5a..1132fe71b312 100644 ---- a/fs/autofs4/inode.c -+++ b/fs/autofs4/inode.c -@@ -18,7 +18,6 @@ - #include - #include - #include --#include - #include "autofs_i.h" - #include - -diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h -index ee44d346ea44..bfa1d31f79aa 100644 ---- a/fs/f2fs/segment.h -+++ b/fs/f2fs/segment.h -@@ -381,6 +381,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, - if (test_and_clear_bit(segno, free_i->free_segmap)) { - free_i->free_segments++; - -+ if (IS_CURSEC(sbi, secno)) -+ goto skip_free; - next = find_next_bit(free_i->free_segmap, - start_segno + sbi->segs_per_sec, start_segno); - if (next >= start_segno + sbi->segs_per_sec) { -@@ -388,6 +390,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, - free_i->free_sections++; - } - } -+skip_free: - spin_unlock(&free_i->segmap_lock); - } - -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 6cc67e1bbb41..2ffc53d0c9c7 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1079,12 +1079,17 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) - struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); - struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); - unsigned int main_segs, blocks_per_seg; -+ unsigned int sit_segs, nat_segs; -+ unsigned int sit_bitmap_size, nat_bitmap_size; -+ unsigned int log_blocks_per_seg; - int i; - - total = le32_to_cpu(raw_super->segment_count); - fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); -- fsmeta += le32_to_cpu(raw_super->segment_count_sit); -- fsmeta += le32_to_cpu(raw_super->segment_count_nat); -+ sit_segs = le32_to_cpu(raw_super->segment_count_sit); -+ fsmeta += sit_segs; -+ nat_segs = le32_to_cpu(raw_super->segment_count_nat); -+ fsmeta += nat_segs; - fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); - fsmeta += le32_to_cpu(raw_super->segment_count_ssa); - -@@ -1105,6 +1110,18 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) - return 1; - } - -+ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); -+ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); -+ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); -+ -+ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || -+ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { -+ f2fs_msg(sbi->sb, KERN_ERR, -+ "Wrong bitmap size: sit: %u, nat:%u", -+ sit_bitmap_size, nat_bitmap_size); -+ return 1; -+ } -+ - if (unlikely(f2fs_cp_error(sbi))) { - f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); - return 1; -diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c -index e2e857affbf2..0647cb1ede56 100644 ---- a/fs/nfs/callback_xdr.c -+++ b/fs/nfs/callback_xdr.c -@@ -911,16 +911,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r - - if (hdr_arg.minorversion == 0) { - cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); -- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) -+ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { -+ if (cps.clp) -+ nfs_put_client(cps.clp); - goto out_invalidcred; -+ } - } - - cps.minorversion = hdr_arg.minorversion; - hdr_res.taglen = hdr_arg.taglen; - hdr_res.tag = hdr_arg.tag; -- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) -+ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { -+ if (cps.clp) -+ nfs_put_client(cps.clp); - return rpc_system_err; -- -+ } - while (status == 0 && nops != hdr_arg.nops) { - status = process_op(nops, rqstp, &xdr_in, - argp, &xdr_out, resp, &cps); -diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 36f4695aa604..ad2a081bac66 100644 ---- a/include/linux/mm_types.h -+++ b/include/linux/mm_types.h -@@ -392,7 +392,7 @@ struct kioctx_table; - struct mm_struct { - struct vm_area_struct *mmap; /* list of VMAs */ - struct rb_root mm_rb; -- u32 vmacache_seqnum; /* per-thread vmacache */ -+ u64 vmacache_seqnum; /* per-thread vmacache */ - #ifdef CONFIG_MMU - unsigned long (*get_unmapped_area) (struct file *filp, - unsigned long addr, unsigned long len, -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 725498cc5d30..b30540d6d125 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1454,7 +1454,7 @@ struct task_struct { - - struct mm_struct *mm, *active_mm; - /* per-thread vma caching */ -- u32 vmacache_seqnum; -+ u64 vmacache_seqnum; - struct vm_area_struct *vmacache[VMACACHE_SIZE]; - #if defined(SPLIT_RSS_COUNTING) - struct task_rss_stat rss_stat; -diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h -index 8ef3a61fdc74..fdac5800872d 100644 ---- a/include/linux/vm_event_item.h -+++ b/include/linux/vm_event_item.h -@@ -88,7 +88,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, - #ifdef CONFIG_DEBUG_VM_VMACACHE - VMACACHE_FIND_CALLS, - VMACACHE_FIND_HITS, -- VMACACHE_FULL_FLUSHES, - #endif - NR_VM_EVENT_ITEMS - }; -diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h -index c3fa0fd43949..4f58ff2dacd6 100644 ---- a/include/linux/vmacache.h -+++ b/include/linux/vmacache.h -@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk) - memset(tsk->vmacache, 0, sizeof(tsk->vmacache)); - } - --extern void vmacache_flush_all(struct mm_struct *mm); - extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); - extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, - unsigned long addr); -@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, - static inline void vmacache_invalidate(struct mm_struct *mm) - { - mm->vmacache_seqnum++; -- -- /* deal with overflows */ -- if (unlikely(mm->vmacache_seqnum == 0)) -- vmacache_flush_all(mm); - } - - #endif /* __LINUX_VMACACHE_H */ -diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h -index cd1629170103..08f47e0e9f8d 100644 ---- a/include/uapi/linux/ethtool.h -+++ b/include/uapi/linux/ethtool.h -@@ -819,13 +819,13 @@ struct ethtool_rx_flow_spec { - static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) - { - return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; --}; -+} - - static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) - { - return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> - ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; --}; -+} - - /** - * struct ethtool_rxnfc - command to get or set RX flow classification rules -diff --git a/kernel/fork.c b/kernel/fork.c -index 37ec96fe739d..dd2f79ac0771 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1337,6 +1337,18 @@ static struct task_struct *copy_process(unsigned long clone_flags, - if (!p) - goto fork_out; - -+ /* -+ * This _must_ happen before we call free_task(), i.e. before we jump -+ * to any of the bad_fork_* labels. This is to avoid freeing -+ * p->set_child_tid which is (ab)used as a kthread's data pointer for -+ * kernel threads (PF_KTHREAD). -+ */ -+ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; -+ /* -+ * Clear TID on mm_release()? -+ */ -+ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; -+ - ftrace_graph_init_task(p); - - rt_mutex_init_task(p); -@@ -1498,11 +1510,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, - } - } - -- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; -- /* -- * Clear TID on mm_release()? -- */ -- p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; - #ifdef CONFIG_BLOCK - p->plug = NULL; - #endif -diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c -index 05a37857ab55..8d7047ecef4e 100644 ---- a/kernel/locking/osq_lock.c -+++ b/kernel/locking/osq_lock.c -@@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock) - - prev = decode_cpu(old); - node->prev = prev; -+ -+ /* -+ * osq_lock() unqueue -+ * -+ * node->prev = prev osq_wait_next() -+ * WMB MB -+ * prev->next = node next->prev = prev // unqueue-C -+ * -+ * Here 'node->prev' and 'next->prev' are the same variable and we need -+ * to ensure these stores happen in-order to avoid corrupting the list. -+ */ -+ smp_wmb(); -+ - WRITE_ONCE(prev->next, node); - - /* -diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c -index a4d4de05b2d1..1be33caf157d 100644 ---- a/kernel/locking/rwsem-xadd.c -+++ b/kernel/locking/rwsem-xadd.c -@@ -510,6 +510,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem) - { - unsigned long flags; - -+ /* -+ * __rwsem_down_write_failed_common(sem) -+ * rwsem_optimistic_spin(sem) -+ * osq_unlock(sem->osq) -+ * ... -+ * atomic_long_add_return(&sem->count) -+ * -+ * - VS - -+ * -+ * __up_write() -+ * if (atomic_long_sub_return_release(&sem->count) < 0) -+ * rwsem_wake(sem) -+ * osq_is_locked(&sem->osq) -+ * -+ * And __up_write() must observe !osq_is_locked() when it observes the -+ * atomic_long_add_return() in order to not miss a wakeup. -+ * -+ * This boils down to: -+ * -+ * [S.rel] X = 1 [RmW] r0 = (Y += 0) -+ * MB RMB -+ * [RmW] Y += 1 [L] r1 = X -+ * -+ * exists (r0=1 /\ r1=0) -+ */ -+ smp_rmb(); -+ - /* - * If a spinner is present, it is not necessary to do the wakeup. - * Try to do wakeup only if the trylock succeeds to minimize -diff --git a/mm/debug.c b/mm/debug.c -index 668aa35191ca..689b6e911cae 100644 ---- a/mm/debug.c -+++ b/mm/debug.c -@@ -168,7 +168,7 @@ EXPORT_SYMBOL(dump_vma); - - void dump_mm(const struct mm_struct *mm) - { -- pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" -+ pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" - #ifdef CONFIG_MMU - "get_unmapped_area %p\n" - #endif -@@ -198,7 +198,7 @@ void dump_mm(const struct mm_struct *mm) - #endif - "%s", /* This is here to hold the comma */ - -- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, -+ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, - #ifdef CONFIG_MMU - mm->get_unmapped_area, - #endif -diff --git a/mm/vmacache.c b/mm/vmacache.c -index fd09dc9c6812..9c8ff3d4eda9 100644 ---- a/mm/vmacache.c -+++ b/mm/vmacache.c -@@ -5,44 +5,6 @@ - #include - #include - --/* -- * Flush vma caches for threads that share a given mm. -- * -- * The operation is safe because the caller holds the mmap_sem -- * exclusively and other threads accessing the vma cache will -- * have mmap_sem held at least for read, so no extra locking -- * is required to maintain the vma cache. -- */ --void vmacache_flush_all(struct mm_struct *mm) --{ -- struct task_struct *g, *p; -- -- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); -- -- /* -- * Single threaded tasks need not iterate the entire -- * list of process. We can avoid the flushing as well -- * since the mm's seqnum was increased and don't have -- * to worry about other threads' seqnum. Current's -- * flush will occur upon the next lookup. -- */ -- if (atomic_read(&mm->mm_users) == 1) -- return; -- -- rcu_read_lock(); -- for_each_process_thread(g, p) { -- /* -- * Only flush the vmacache pointers as the -- * mm seqnum is already set and curr's will -- * be set upon invalidation when the next -- * lookup is done. -- */ -- if (mm == p->mm) -- vmacache_flush(p); -- } -- rcu_read_unlock(); --} -- - /* - * This task may be accessing a foreign mm via (for example) - * get_user_pages()->find_vma(). The vmacache is task-local and this -diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c -index 1811f8e7ddf4..552e00b07196 100644 ---- a/net/bluetooth/hidp/core.c -+++ b/net/bluetooth/hidp/core.c -@@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session, - hid->version = req->version; - hid->country = req->country; - -- strncpy(hid->name, req->name, sizeof(req->name) - 1); -+ strncpy(hid->name, req->name, sizeof(hid->name)); - - snprintf(hid->phys, sizeof(hid->phys), "%pMR", - &l2cap_pi(session->ctrl_sock->sk)->chan->src); -diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c -index 4f6c1862dfd2..6fe2b615518c 100644 ---- a/net/dcb/dcbnl.c -+++ b/net/dcb/dcbnl.c -@@ -1763,7 +1763,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, - if (itr->app.selector == app->selector && - itr->app.protocol == app->protocol && - itr->ifindex == ifindex && -- (!prio || itr->app.priority == prio)) -+ ((prio == -1) || itr->app.priority == prio)) - return itr; - } - -@@ -1798,7 +1798,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) - u8 prio = 0; - - spin_lock_bh(&dcb_lock); -- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) -+ itr = dcb_app_lookup(app, dev->ifindex, -1); -+ if (itr) - prio = itr->app.priority; - spin_unlock_bh(&dcb_lock); - -@@ -1826,7 +1827,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) - - spin_lock_bh(&dcb_lock); - /* Search for existing match and replace */ -- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { -+ itr = dcb_app_lookup(new, dev->ifindex, -1); -+ if (itr) { - if (new->priority) - itr->app.priority = new->priority; - else { -@@ -1859,7 +1861,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) - u8 prio = 0; - - spin_lock_bh(&dcb_lock); -- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) -+ itr = dcb_app_lookup(app, dev->ifindex, -1); -+ if (itr) - prio |= 1 << itr->app.priority; - spin_unlock_bh(&dcb_lock); - -diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index 1f3c305df45d..b6e72af15237 100644 ---- a/net/netfilter/x_tables.c -+++ b/net/netfilter/x_tables.c -@@ -876,7 +876,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, - if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) - return ERR_PTR(-EFAULT); - -- strlcpy(info->name, compat_tmp.name, sizeof(info->name)); -+ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); - info->num_counters = compat_tmp.num_counters; - user += sizeof(compat_tmp); - } else -@@ -889,9 +889,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, - if (copy_from_user(info, user, sizeof(*info)) != 0) - return ERR_PTR(-EFAULT); - -- info->name[sizeof(info->name) - 1] = '\0'; - user += sizeof(*info); - } -+ info->name[sizeof(info->name) - 1] = '\0'; - - size = sizeof(struct xt_counters); - size *= info->num_counters; -diff --git a/security/selinux/avc.c b/security/selinux/avc.c -index e60c79de13e1..52f3c550abcc 100644 ---- a/security/selinux/avc.c -+++ b/security/selinux/avc.c -@@ -348,27 +348,26 @@ static struct avc_xperms_decision_node - struct avc_xperms_decision_node *xpd_node; - struct extended_perms_decision *xpd; - -- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, -- GFP_ATOMIC | __GFP_NOMEMALLOC); -+ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); - if (!xpd_node) - return NULL; - - xpd = &xpd_node->xpd; - if (which & XPERMS_ALLOWED) { - xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, -- GFP_ATOMIC | __GFP_NOMEMALLOC); -+ GFP_NOWAIT); - if (!xpd->allowed) - goto error; - } - if (which & XPERMS_AUDITALLOW) { - xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, -- GFP_ATOMIC | __GFP_NOMEMALLOC); -+ GFP_NOWAIT); - if (!xpd->auditallow) - goto error; - } - if (which & XPERMS_DONTAUDIT) { - xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, -- GFP_ATOMIC | __GFP_NOMEMALLOC); -+ GFP_NOWAIT); - if (!xpd->dontaudit) - goto error; - } -@@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) - { - struct avc_xperms_node *xp_node; - -- xp_node = kmem_cache_zalloc(avc_xperms_cachep, -- GFP_ATOMIC|__GFP_NOMEMALLOC); -+ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); - if (!xp_node) - return xp_node; - INIT_LIST_HEAD(&xp_node->xpd_head); -@@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void) - { - struct avc_node *node; - -- node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); -+ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); - if (!node) - goto out; - -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 3324f98c35f6..f6d4a1046e54 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -4019,7 +4019,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) - - list_for_each_codec(codec, bus) { - /* FIXME: maybe a better way needed for forced reset */ -- cancel_delayed_work_sync(&codec->jackpoll_work); -+ if (current_work() != &codec->jackpoll_work.work) -+ cancel_delayed_work_sync(&codec->jackpoll_work); - #ifdef CONFIG_PM - if (hda_codec_is_power_on(codec)) { - hda_call_codec_suspend(codec); -diff --git a/tools/perf/perf.h b/tools/perf/perf.h -index 90129accffbe..4341ed267d4e 100644 ---- a/tools/perf/perf.h -+++ b/tools/perf/perf.h -@@ -29,7 +29,9 @@ static inline unsigned long long rdclock(void) - return ts.tv_sec * 1000000000ULL + ts.tv_nsec; - } - -+#ifndef MAX_NR_CPUS - #define MAX_NR_CPUS 1024 -+#endif - - extern const char *input_name; - extern bool perf_host, perf_guest; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.157-158.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.157-158.patch deleted file mode 100644 index 67b7dbbf2e28..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.157-158.patch +++ /dev/null @@ -1,1693 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2d55f88e6a08..d07a6283b67e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 157 -+SUBLEVEL = 158 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c -index c169cc3049aa..e8adb428dddb 100644 ---- a/arch/arm/mach-exynos/suspend.c -+++ b/arch/arm/mach-exynos/suspend.c -@@ -260,6 +260,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, - NULL); - if (!domain) { - iounmap(pmu_base_addr); -+ pmu_base_addr = NULL; - return -ENOMEM; - } - -diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c -index a129aae72602..909bb2493781 100644 ---- a/arch/arm/mach-hisi/hotplug.c -+++ b/arch/arm/mach-hisi/hotplug.c -@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) - struct device_node *node; - - node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); -- if (node) { -- ctrl_base = of_iomap(node, 0); -- id = HI3620_CTRL; -- return 0; -+ if (!node) { -+ id = ERROR_CTRL; -+ return -ENOENT; - } -- id = ERROR_CTRL; -- return -ENOENT; -+ -+ ctrl_base = of_iomap(node, 0); -+ of_node_put(node); -+ if (!ctrl_base) { -+ id = ERROR_CTRL; -+ return -ENOMEM; -+ } -+ -+ id = HI3620_CTRL; -+ return 0; - } - - void hi3xxx_set_cpu(int cpu, bool enable) -@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) - struct device_node *np; - - np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); -- if (np) { -- ctrl_base = of_iomap(np, 0); -- return true; -- } -- return false; -+ if (!np) -+ return false; -+ -+ ctrl_base = of_iomap(np, 0); -+ of_node_put(np); -+ if (!ctrl_base) -+ return false; -+ -+ return true; - } - - void hix5hd2_set_cpu(int cpu, bool enable) -@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) - - if (!ctrl_base) { - np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); -- if (np) -- ctrl_base = of_iomap(np, 0); -- else -- BUG(); -+ BUG_ON(!np); -+ ctrl_base = of_iomap(np, 0); -+ of_node_put(np); -+ BUG_ON(!ctrl_base); - } - - if (enable) { -diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi -index 6b8abbe68746..3011c88bd2f3 100644 ---- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi -+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi -@@ -105,7 +105,7 @@ - led@6 { - label = "apq8016-sbc:blue:bt"; - gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; -- linux,default-trigger = "bt"; -+ linux,default-trigger = "bluetooth-power"; - default-state = "off"; - }; - }; -diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c -index 8755d618e116..961c393c0f55 100644 ---- a/arch/mips/ath79/setup.c -+++ b/arch/mips/ath79/setup.c -@@ -44,6 +44,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; - - static void ath79_restart(char *command) - { -+ local_irq_disable(); - ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); - for (;;) - if (cpu_wait) -diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h -index 4eee221b0cf0..d2be8e4f7a35 100644 ---- a/arch/mips/include/asm/mach-ath79/ath79.h -+++ b/arch/mips/include/asm/mach-ath79/ath79.h -@@ -133,6 +133,7 @@ static inline u32 ath79_pll_rr(unsigned reg) - static inline void ath79_reset_wr(unsigned reg, u32 val) - { - __raw_writel(val, ath79_reset_base + reg); -+ (void) __raw_readl(ath79_reset_base + reg); /* flush */ - } - - static inline u32 ath79_reset_rr(unsigned reg) -diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform -index 28448d358c10..a2a5a85ea1f9 100644 ---- a/arch/mips/jz4740/Platform -+++ b/arch/mips/jz4740/Platform -@@ -1,4 +1,4 @@ - platform-$(CONFIG_MACH_INGENIC) += jz4740/ - cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 - load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 --zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 -+zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 -diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c -index 5649a9e429e0..aca06b18c43e 100644 ---- a/arch/mips/kernel/vdso.c -+++ b/arch/mips/kernel/vdso.c -@@ -14,12 +14,14 @@ - #include - #include - #include -+#include - #include - #include - #include - #include - - #include -+#include - #include - - /* Kernel-provided data used by the VDSO. */ -@@ -118,12 +120,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) - vvar_size = gic_size + PAGE_SIZE; - size = vvar_size + image->size; - -+ /* -+ * Find a region that's large enough for us to perform the -+ * colour-matching alignment below. -+ */ -+ if (cpu_has_dc_aliases) -+ size += shm_align_mask + 1; -+ - base = get_unmapped_area(NULL, 0, size, 0, 0); - if (IS_ERR_VALUE(base)) { - ret = base; - goto out; - } - -+ /* -+ * If we suffer from dcache aliasing, ensure that the VDSO data page -+ * mapping is coloured the same as the kernel's mapping of that memory. -+ * This ensures that when the kernel updates the VDSO data userland -+ * will observe it without requiring cache invalidations. -+ */ -+ if (cpu_has_dc_aliases) { -+ base = __ALIGN_MASK(base, shm_align_mask); -+ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; -+ } -+ - data_addr = base + gic_size; - vdso_addr = data_addr + PAGE_SIZE; - -diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c -index f7c905e50dc4..92dc6bafc127 100644 ---- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c -+++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c -@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) - break; - case PCI_OHCI_INT_REG: - _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); -- if ((lo & 0x00000f00) == CS5536_USB_INTR) -+ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) - conf_data = 1; - break; - default: -diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c -index e48826aa314c..b40606051efe 100644 ---- a/arch/powerpc/platforms/powernv/opal.c -+++ b/arch/powerpc/platforms/powernv/opal.c -@@ -371,7 +371,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) - /* Closed or other error drop */ - if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && - rc != OPAL_BUSY_EVENT) { -- written = total_len; -+ written += total_len; - break; - } - if (rc == OPAL_SUCCESS) { -diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c -index 01718d05e952..9e8f0e255de2 100644 ---- a/drivers/clk/imx/clk-imx6ul.c -+++ b/drivers/clk/imx/clk-imx6ul.c -@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) - - np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); - base = of_iomap(np, 0); -+ of_node_put(np); - WARN_ON(!base); - - clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); -diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c -index f68c24a98277..dedfc96acc66 100644 ---- a/drivers/crypto/sahara.c -+++ b/drivers/crypto/sahara.c -@@ -1363,7 +1363,7 @@ err_sha_v4_algs: - - err_sha_v3_algs: - for (j = 0; j < k; j++) -- crypto_unregister_ahash(&sha_v4_algs[j]); -+ crypto_unregister_ahash(&sha_v3_algs[j]); - - err_aes_algs: - for (j = 0; j < i; j++) -@@ -1379,7 +1379,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) - for (i = 0; i < ARRAY_SIZE(aes_algs); i++) - crypto_unregister_alg(&aes_algs[i]); - -- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) -+ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) - crypto_unregister_ahash(&sha_v3_algs[i]); - - if (dev->version > SAHARA_VERSION_3) -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 8db791ef2027..95619ee33112 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2132,13 +2132,14 @@ static int pl330_terminate_all(struct dma_chan *chan) - - pm_runtime_get_sync(pl330->ddma.dev); - spin_lock_irqsave(&pch->lock, flags); -+ - spin_lock(&pl330->lock); - _stop(pch->thread); -- spin_unlock(&pl330->lock); -- - pch->thread->req[0].desc = NULL; - pch->thread->req[1].desc = NULL; - pch->thread->req_running = -1; -+ spin_unlock(&pl330->lock); -+ - power_down = pch->active; - pch->active = false; - -diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h -index 98ab08c0aa2d..07541c5670e6 100644 ---- a/drivers/gpio/gpiolib.h -+++ b/drivers/gpio/gpiolib.h -@@ -30,7 +30,7 @@ struct acpi_gpio_info { - }; - - /* gpio suffixes used for ACPI and device tree lookup */ --static const char * const gpio_suffixes[] = { "gpios", "gpio" }; -+static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; - - #ifdef CONFIG_ACPI - void acpi_gpiochip_add(struct gpio_chip *chip); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -index eb1da83c9902..8cdd505784ed 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c -@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) - return ERR_PTR(-EINVAL); - - process = find_process(thread); -+ if (!process) -+ return ERR_PTR(-EINVAL); - - return process; - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -index e7e581d6a8ff..1bfc4807ce5b 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c -@@ -23,6 +23,10 @@ - #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER - #include "priv.h" - -+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) -+#include -+#endif -+ - static int - nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) - { -@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) - unsigned long pgsize_bitmap; - int ret; - -+#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) -+ if (dev->archdata.mapping) { -+ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); -+ -+ arm_iommu_detach_device(dev); -+ arm_iommu_release_mapping(mapping); -+ } -+#endif -+ - if (!tdev->func->iommu_bit) - return; - -diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -index a188a3959f1a..6ad827b93ae1 100644 ---- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -+++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c -@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) - int ret, i; - - ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); -- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { -+ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { - dev_err(ctx->dev, "read id failed\n"); - ctx->error = -EIO; - return; -diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c -index 22e10b7d505d..fe3a2b19a5db 100644 ---- a/drivers/hwtracing/coresight/coresight-tpiu.c -+++ b/drivers/hwtracing/coresight/coresight-tpiu.c -@@ -46,8 +46,9 @@ - - /** register definition **/ - /* FFSR - 0x300 */ --#define FFSR_FT_STOPPED BIT(1) -+#define FFSR_FT_STOPPED_BIT 1 - /* FFCR - 0x304 */ -+#define FFCR_FON_MAN_BIT 6 - #define FFCR_FON_MAN BIT(6) - #define FFCR_STOP_FI BIT(12) - -@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) - /* Generate manual flush */ - writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); - /* Wait for flush to complete */ -- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); -+ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); - /* Wait for formatter to stop */ -- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); -+ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); - - CS_LOCK(drvdata->base); - } -diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c -index 93738dfbf631..902ee6efd09c 100644 ---- a/drivers/hwtracing/coresight/coresight.c -+++ b/drivers/hwtracing/coresight/coresight.c -@@ -86,7 +86,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev) - dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", - dev_name(&parent->dev), dev_name(&csdev->dev)); - -- return 0; -+ return -ENODEV; - } - - static int coresight_find_link_outport(struct coresight_device *csdev) -@@ -107,7 +107,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev) - dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", - dev_name(&csdev->dev), dev_name(&child->dev)); - -- return 0; -+ return -ENODEV; - } - - static int coresight_enable_sink(struct coresight_device *csdev) -@@ -155,6 +155,9 @@ static int coresight_enable_link(struct coresight_device *csdev) - else - refport = 0; - -+ if (refport < 0) -+ return refport; -+ - if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { - if (link_ops(csdev)->enable) { - ret = link_ops(csdev)->enable(csdev, inport, outport); -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 0f42411d6a79..1454290078de 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -544,6 +544,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) - dgid = (union ib_gid *) &addr->sib_addr; - pkey = ntohs(addr->sib_pkey); - -+ mutex_lock(&lock); - list_for_each_entry(cur_dev, &dev_list, list) { - for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { - if (!rdma_cap_af_ib(cur_dev->device, p)) -@@ -567,18 +568,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) - cma_dev = cur_dev; - sgid = gid; - id_priv->id.port_num = p; -+ goto found; - } - } - } - } -- -- if (!cma_dev) -- return -ENODEV; -+ mutex_unlock(&lock); -+ return -ENODEV; - - found: - cma_attach_to_dev(id_priv, cma_dev); -- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); -- memcpy(&addr->sib_addr, &sgid, sizeof sgid); -+ mutex_unlock(&lock); -+ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); -+ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); - cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); - return 0; - } -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -index f74b11542603..a338e60836ee 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -@@ -992,12 +992,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even - - skb_queue_head_init(&skqueue); - -+ netif_tx_lock_bh(p->dev); - spin_lock_irq(&priv->lock); - set_bit(IPOIB_FLAG_OPER_UP, &p->flags); - if (p->neigh) - while ((skb = __skb_dequeue(&p->neigh->queue))) - __skb_queue_tail(&skqueue, skb); - spin_unlock_irq(&priv->lock); -+ netif_tx_unlock_bh(p->dev); - - while ((skb = __skb_dequeue(&skqueue))) { - skb->dev = p->dev; -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index 347aaaa5a7ea..fc6eb752ab35 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -1219,6 +1219,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) - - /* Sync our overflow flag, as we believe we're up to speed */ - q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); -+ writel(q->cons, q->cons_reg); - return IRQ_HANDLED; - } - -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index 0c1a42bf27fd..1c37d5a78822 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -1366,6 +1366,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) - struct vb2_buffer *vb; - int ret; - -+ if (q->error) { -+ dprintk(1, "fatal error occurred on queue\n"); -+ return -EIO; -+ } -+ - vb = q->bufs[index]; - - switch (vb->state) { -diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c -index 90520d76633f..9cde4c5bfba4 100644 ---- a/drivers/misc/hmc6352.c -+++ b/drivers/misc/hmc6352.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - static DEFINE_MUTEX(compass_mutex); - -@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, - return ret; - if (val >= strlen(map)) - return -EINVAL; -+ val = array_index_nospec(val, strlen(map)); - mutex_lock(&compass_mutex); - ret = compass_command(c, map[val]); - mutex_unlock(&compass_mutex); -diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c -index bdc7fcd80eca..9dcdc6f41ceb 100644 ---- a/drivers/misc/mei/bus-fixup.c -+++ b/drivers/misc/mei/bus-fixup.c -@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, - - ret = 0; - bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); -- if (bytes_recv < if_version_length) { -+ if (bytes_recv < 0 || bytes_recv < if_version_length) { - dev_err(bus->dev, "Could not read IF version\n"); - ret = -EIO; - goto err; -diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c -index bb580bc16445..c07f21b20463 100644 ---- a/drivers/mtd/maps/solutionengine.c -+++ b/drivers/mtd/maps/solutionengine.c -@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) - return -ENXIO; - } - } -- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", -- soleng_flash_map.phys & 0x1fffffff, -- soleng_eprom_map.phys & 0x1fffffff); -+ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", -+ &soleng_flash_map.phys, -+ &soleng_eprom_map.phys); - flash_mtd->owner = THIS_MODULE; - - eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); -diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c -index 6d19835b80a9..0d244dac1ccb 100644 ---- a/drivers/mtd/mtdchar.c -+++ b/drivers/mtd/mtdchar.c -@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, - - pr_debug("MTD_read\n"); - -- if (*ppos + count > mtd->size) -- count = mtd->size - *ppos; -+ if (*ppos + count > mtd->size) { -+ if (*ppos < mtd->size) -+ count = mtd->size - *ppos; -+ else -+ count = 0; -+ } - - if (!count) - return 0; -@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c - - pr_debug("MTD_write\n"); - -- if (*ppos == mtd->size) -+ if (*ppos >= mtd->size) - return -ENOSPC; - - if (*ppos + count > mtd->size) -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index c2e110b2549b..c1217a87d535 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -1164,25 +1164,34 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) - cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, - 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); - -- if (slave->data->phy_node) -+ if (slave->data->phy_node) { - slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, - &cpsw_adjust_link, 0, slave->data->phy_if); -- else -+ if (!slave->phy) { -+ dev_err(priv->dev, "phy \"%s\" not found on slave %d\n", -+ slave->data->phy_node->full_name, -+ slave->slave_num); -+ return; -+ } -+ } else { - slave->phy = phy_connect(priv->ndev, slave->data->phy_id, - &cpsw_adjust_link, slave->data->phy_if); -- if (IS_ERR(slave->phy)) { -- dev_err(priv->dev, "phy %s not found on slave %d\n", -- slave->data->phy_id, slave->slave_num); -- slave->phy = NULL; -- } else { -- dev_info(priv->dev, "phy found : id is : 0x%x\n", -- slave->phy->phy_id); -- phy_start(slave->phy); -- -- /* Configure GMII_SEL register */ -- cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, -- slave->slave_num); -+ if (IS_ERR(slave->phy)) { -+ dev_err(priv->dev, -+ "phy \"%s\" not found on slave %d, err %ld\n", -+ slave->data->phy_id, slave->slave_num, -+ PTR_ERR(slave->phy)); -+ slave->phy = NULL; -+ return; -+ } - } -+ -+ dev_info(priv->dev, "phy found : id is : 0x%x\n", slave->phy->phy_id); -+ -+ phy_start(slave->phy); -+ -+ /* Configure GMII_SEL register */ -+ cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, slave->slave_num); - } - - static inline void cpsw_add_default_vlan(struct cpsw_priv *priv) -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 68d0a5c9d437..3270b4333668 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -86,8 +86,7 @@ struct netfront_cb { - /* IRQ name is queue name with "-tx" or "-rx" appended */ - #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) - --static DECLARE_WAIT_QUEUE_HEAD(module_load_q); --static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); -+static DECLARE_WAIT_QUEUE_HEAD(module_wq); - - struct netfront_stats { - u64 packets; -@@ -1336,11 +1335,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) - netif_carrier_off(netdev); - - xenbus_switch_state(dev, XenbusStateInitialising); -- wait_event(module_load_q, -- xenbus_read_driver_state(dev->otherend) != -- XenbusStateClosed && -- xenbus_read_driver_state(dev->otherend) != -- XenbusStateUnknown); -+ wait_event(module_wq, -+ xenbus_read_driver_state(dev->otherend) != -+ XenbusStateClosed && -+ xenbus_read_driver_state(dev->otherend) != -+ XenbusStateUnknown); - return netdev; - - exit: -@@ -1608,6 +1607,7 @@ static int xennet_init_queue(struct netfront_queue *queue) - { - unsigned short i; - int err = 0; -+ char *devid; - - spin_lock_init(&queue->tx_lock); - spin_lock_init(&queue->rx_lock); -@@ -1615,8 +1615,9 @@ static int xennet_init_queue(struct netfront_queue *queue) - setup_timer(&queue->rx_refill_timer, rx_refill_timeout, - (unsigned long)queue); - -- snprintf(queue->name, sizeof(queue->name), "%s-q%u", -- queue->info->netdev->name, queue->id); -+ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; -+ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", -+ devid, queue->id); - - /* Initialise tx_skbs as a free chain containing every entry. */ - queue->tx_skb_freelist = 0; -@@ -2023,15 +2024,14 @@ static void netback_changed(struct xenbus_device *dev, - - dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); - -+ wake_up_all(&module_wq); -+ - switch (backend_state) { - case XenbusStateInitialising: - case XenbusStateInitialised: - case XenbusStateReconfiguring: - case XenbusStateReconfigured: -- break; -- - case XenbusStateUnknown: -- wake_up_all(&module_unload_q); - break; - - case XenbusStateInitWait: -@@ -2047,12 +2047,10 @@ static void netback_changed(struct xenbus_device *dev, - break; - - case XenbusStateClosed: -- wake_up_all(&module_unload_q); - if (dev->state == XenbusStateClosed) - break; - /* Missed the backend's CLOSING state -- fallthrough */ - case XenbusStateClosing: -- wake_up_all(&module_unload_q); - xenbus_frontend_closed(dev); - break; - } -@@ -2160,14 +2158,14 @@ static int xennet_remove(struct xenbus_device *dev) - - if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { - xenbus_switch_state(dev, XenbusStateClosing); -- wait_event(module_unload_q, -+ wait_event(module_wq, - xenbus_read_driver_state(dev->otherend) == - XenbusStateClosing || - xenbus_read_driver_state(dev->otherend) == - XenbusStateUnknown); - - xenbus_switch_state(dev, XenbusStateClosed); -- wait_event(module_unload_q, -+ wait_event(module_wq, - xenbus_read_driver_state(dev->otherend) == - XenbusStateClosed || - xenbus_read_driver_state(dev->otherend) == -diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c -index 01cf1c1a841a..8de329546b82 100644 ---- a/drivers/parport/parport_sunbpp.c -+++ b/drivers/parport/parport_sunbpp.c -@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) - - ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), - GFP_KERNEL); -- if (!ops) -+ if (!ops) { -+ err = -ENOMEM; - goto out_unmap; -+ } - - dprintk(("register_port\n")); -- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) -+ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { -+ err = -ENOMEM; - goto out_free_ops; -+ } - - p->size = size; - p->dev = &op->dev; -diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c -index 6c42ca14d2fd..4ea810cafaac 100644 ---- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c -+++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c -@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, - - switch (param) { - case PIN_CONFIG_DRIVE_PUSH_PULL: -- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; -+ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_DRIVE_OPEN_DRAIN: -- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; -+ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_DRIVE_OPEN_SOURCE: -- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; -+ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_PULL_DOWN: -- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; -+ if (pad->pullup != PMIC_GPIO_PULL_DOWN) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_DISABLE: -- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; -+ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_PULL_UP: -- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; -+ if (pad->pullup != PMIC_GPIO_PULL_UP_30) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: -- arg = !pad->is_enabled; -+ if (pad->is_enabled) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_POWER_SOURCE: - arg = pad->power_source; - break; - case PIN_CONFIG_INPUT_ENABLE: -- arg = pad->input_enabled; -+ if (!pad->input_enabled) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_OUTPUT: - arg = pad->out_value; -diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c -index f774cb576ffa..1ff95b5a429d 100644 ---- a/drivers/platform/x86/toshiba_acpi.c -+++ b/drivers/platform/x86/toshiba_acpi.c -@@ -34,6 +34,7 @@ - #define TOSHIBA_ACPI_VERSION "0.23" - #define PROC_INTERFACE_VERSION 1 - -+#include - #include - #include - #include -@@ -1472,7 +1473,7 @@ static const struct file_operations keys_proc_fops = { - .write = keys_proc_write, - }; - --static int version_proc_show(struct seq_file *m, void *v) -+static int __maybe_unused version_proc_show(struct seq_file *m, void *v) - { - seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); - seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); -diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c -index bd170cb3361c..5747a54cbd42 100644 ---- a/drivers/rtc/rtc-bq4802.c -+++ b/drivers/rtc/rtc-bq4802.c -@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) - } else if (p->r->flags & IORESOURCE_MEM) { - p->regs = devm_ioremap(&pdev->dev, p->r->start, - resource_size(p->r)); -+ if (!p->regs){ -+ err = -ENOMEM; -+ goto out; -+ } - p->read = bq4802_read_mem; - p->write = bq4802_write_mem; - } else { -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index 95c631125a20..09ac56317f1b 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -3505,13 +3505,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, - qdio_flags = QDIO_FLAG_SYNC_OUTPUT; - if (atomic_read(&queue->set_pci_flags_count)) - qdio_flags |= QDIO_FLAG_PCI_OUT; -+ atomic_add(count, &queue->used_buffers); -+ - rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, - queue->queue_no, index, count); - if (queue->card->options.performance_stats) - queue->card->perf_stats.outbound_do_qdio_time += - qeth_get_micros() - - queue->card->perf_stats.outbound_do_qdio_start_time; -- atomic_add(count, &queue->used_buffers); - if (rc) { - queue->card->stats.tx_errors += count; - /* ignore temporary SIGA errors without busy condition */ -diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c -index fa844b0ff847..7bcf0dae3a65 100644 ---- a/drivers/s390/net/qeth_core_sys.c -+++ b/drivers/s390/net/qeth_core_sys.c -@@ -419,6 +419,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, - if (card->discipline) { - card->discipline->remove(card->gdev); - qeth_core_free_discipline(card); -+ card->options.layer2 = -1; - } - - rc = qeth_core_load_discipline(card, newdis); -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 61ea87917433..4380e4f600ab 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) - - set_bit(WDM_RESPONDING, &desc->flags); - spin_unlock_irq(&desc->iuspin); -- rv = usb_submit_urb(desc->response, GFP_KERNEL); -+ rv = usb_submit_urb(desc->response, GFP_ATOMIC); - spin_lock_irq(&desc->iuspin); - if (rv) { - dev_err(&desc->intf->dev, -diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c -index 40378487e023..a5e3e410db4e 100644 ---- a/drivers/usb/core/hcd-pci.c -+++ b/drivers/usb/core/hcd-pci.c -@@ -529,8 +529,6 @@ static int resume_common(struct device *dev, int event) - event == PM_EVENT_RESTORE); - if (retval) { - dev_err(dev, "PCI post-resume error %d!\n", retval); -- if (hcd->shared_hcd) -- usb_hc_died(hcd->shared_hcd); - usb_hc_died(hcd); - } - } -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index 29adabdb305f..08cba309eb78 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_device *dev, - * is submitted that needs that bandwidth. Some other operating systems - * allocate bandwidth early, when a configuration is chosen. - * -+ * xHCI reserves bandwidth and configures the alternate setting in -+ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting -+ * may be disabled. Drivers cannot rely on any particular alternate -+ * setting being in effect after a failure. -+ * - * This call is synchronous, and may not be used in an interrupt context. - * Also, drivers must not change altsettings while urbs are scheduled for - * endpoints in that interface; all such urbs must first be completed -@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) - alternate); - return -EINVAL; - } -+ /* -+ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, -+ * including freeing dropped endpoint ring buffers. -+ * Make sure the interface endpoints are flushed before that -+ */ -+ usb_disable_interface(dev, iface, false); - - /* Make sure we have enough bandwidth for this alternate interface. - * Remove the current alt setting and add the new alt setting. -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 99f67764765f..37a5e07b3488 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* CBM - Flash disk */ - { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ -+ { USB_DEVICE(0x0218, 0x0201), .driver_info = -+ USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* WORLDE easy key (easykey.25) MIDI controller */ - { USB_DEVICE(0x0218, 0x0401), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x2040, 0x7200), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, - -+ /* DJI CineSSD */ -+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* INTEL VALUE SSD */ - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c -index a47de8c31ce9..8efeadf30b4d 100644 ---- a/drivers/usb/gadget/udc/net2280.c -+++ b/drivers/usb/gadget/udc/net2280.c -@@ -1542,11 +1542,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) - writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); - } else { - writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); -- stop_activity(dev, dev->driver); -+ stop_activity(dev, NULL); - } - - spin_unlock_irqrestore(&dev->lock, flags); - -+ if (!is_on && dev->driver) -+ dev->driver->disconnect(&dev->gadget); -+ - return 0; - } - -@@ -2425,8 +2428,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) - nuke(&dev->ep[i]); - - /* report disconnect; the driver is already quiesced */ -- if (driver) -+ if (driver) { -+ spin_unlock(&dev->lock); - driver->disconnect(&dev->gadget); -+ spin_lock(&dev->lock); -+ } - - usb_reinit(dev); - } -@@ -3272,6 +3278,8 @@ next_endpoints: - BIT(PCI_RETRY_ABORT_INTERRUPT)) - - static void handle_stat1_irqs(struct net2280 *dev, u32 stat) -+__releases(dev->lock) -+__acquires(dev->lock) - { - struct net2280_ep *ep; - u32 tmp, num, mask, scratch; -@@ -3312,12 +3320,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) - if (disconnect || reset) { - stop_activity(dev, dev->driver); - ep0_start(dev); -+ spin_unlock(&dev->lock); - if (reset) - usb_gadget_udc_reset - (&dev->gadget, dev->driver); - else - (dev->driver->disconnect) - (&dev->gadget); -+ spin_lock(&dev->lock); - return; - } - } -@@ -3336,6 +3346,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) - tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); - if (stat & tmp) { - writel(tmp, &dev->regs->irqstat1); -+ spin_unlock(&dev->lock); - if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { - if (dev->driver->suspend) - dev->driver->suspend(&dev->gadget); -@@ -3346,6 +3357,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) - dev->driver->resume(&dev->gadget); - /* at high speed, note erratum 0133 */ - } -+ spin_lock(&dev->lock); - stat &= ~tmp; - } - -diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c -index 692ccc69345e..d5434e7a3b2e 100644 ---- a/drivers/usb/host/u132-hcd.c -+++ b/drivers/usb/host/u132-hcd.c -@@ -2565,7 +2565,7 @@ static int u132_get_frame(struct usb_hcd *hcd) - } else { - int frame = 0; - dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); -- msleep(100); -+ mdelay(100); - return frame; - } - } -diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c -index 442b6631162e..3d750671b85a 100644 ---- a/drivers/usb/misc/uss720.c -+++ b/drivers/usb/misc/uss720.c -@@ -388,7 +388,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch - mask &= 0x0f; - val &= 0x0f; - d = (priv->reg[1] & (~mask)) ^ val; -- if (set_1284_register(pp, 2, d, GFP_KERNEL)) -+ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) - return 0; - priv->reg[1] = d; - return d & 0xf; -@@ -398,7 +398,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) - { - unsigned char ret; - -- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) -+ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) - return 0; - return ret & 0xf8; - } -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index 512c84adcace..e8e8702d5adf 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -439,13 +439,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, - { - struct usb_yurex *dev; - int i, set = 0, retval = 0; -- char buffer[16]; -+ char buffer[16 + 1]; - char *data = buffer; - unsigned long long c, c2 = 0; - signed long timeout = 0; - DEFINE_WAIT(wait); - -- count = min(sizeof(buffer), count); -+ count = min(sizeof(buffer) - 1, count); - dev = file->private_data; - - /* verify that we actually have some data to write */ -@@ -464,6 +464,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, - retval = -EFAULT; - goto error; - } -+ buffer[count] = 0; - memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); - - switch (buffer[0]) { -diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h -index 1bd67b24f916..bc9ff5ebd67c 100644 ---- a/drivers/usb/serial/io_ti.h -+++ b/drivers/usb/serial/io_ti.h -@@ -178,7 +178,7 @@ struct ump_interrupt { - } __attribute__((packed)); - - --#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) -+#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) - #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) - #define TIUMP_INTERRUPT_CODE_LSR 0x03 - #define TIUMP_INTERRUPT_CODE_MSR 0x04 -diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h -index 98f35c656c02..0cd247f75b8b 100644 ---- a/drivers/usb/serial/ti_usb_3410_5052.h -+++ b/drivers/usb/serial/ti_usb_3410_5052.h -@@ -227,7 +227,7 @@ struct ti_interrupt { - } __attribute__((packed)); - - /* Interrupt codes */ --#define TI_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) -+#define TI_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) - #define TI_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) - #define TI_CODE_HARDWARE_ERROR 0xFF - #define TI_CODE_DATA_ERROR 0x03 -diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c -index dba51362d2e2..6c186b4df94a 100644 ---- a/drivers/usb/storage/scsiglue.c -+++ b/drivers/usb/storage/scsiglue.c -@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, - return 0; - } - -+ if ((us->fflags & US_FL_NO_ATA_1X) && -+ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { -+ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, -+ sizeof(usb_stor_sense_invalidCDB)); -+ srb->result = SAM_STAT_CHECK_CONDITION; -+ done(srb); -+ return 0; -+ } -+ - /* enqueue the command and wake up the control thread */ - srb->scsi_done = done; - us->srb = srb; -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 1a34d2a89de6..898215cad351 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2213,6 +2213,13 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, - "Micro Mini 1GB", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), - -+/* Reported-by: Tim Anderson */ -+UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, -+ "DJI", -+ "CineSSD", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* - * Nick Bowler - * SCSI stack spams (otherwise harmless) error messages. -diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c -index 2510fa728d77..de119f11b78f 100644 ---- a/drivers/video/fbdev/core/modedb.c -+++ b/drivers/video/fbdev/core/modedb.c -@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, - * - * Valid mode specifiers for @mode_option: - * -- * x[M][R][-][@][i][m] or -+ * x[M][R][-][@][i][p][m] or - * [-][@] - * - * with , , and decimal numbers and -@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, - * If 'M' is present after yres (and before refresh/bpp if present), - * the function will compute the timings using VESA(tm) Coordinated - * Video Timings (CVT). If 'R' is present after 'M', will compute with -- * reduced blanking (for flatpanels). If 'i' is present, compute -- * interlaced mode. If 'm' is present, add margins equal to 1.8% -- * of xres rounded down to 8 pixels, and 1.8% of yres. The char -- * 'i' and 'm' must be after 'M' and 'R'. Example: -+ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute -+ * interlaced or progressive mode. If 'm' is present, add margins equal -+ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars -+ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: - * - * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. - * -@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, - unsigned int namelen = strlen(name); - int res_specified = 0, bpp_specified = 0, refresh_specified = 0; - unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; -- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; -+ int yres_specified = 0, cvt = 0, rb = 0; -+ int interlace_specified = 0, interlace = 0; - int margins = 0; - u32 best, diff, tdiff; - -@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, - if (!cvt) - margins = 1; - break; -+ case 'p': -+ if (!cvt) { -+ interlace = 0; -+ interlace_specified = 1; -+ } -+ break; - case 'i': -- if (!cvt) -+ if (!cvt) { - interlace = 1; -+ interlace_specified = 1; -+ } - break; - default: - goto done; -@@ -819,11 +828,21 @@ done: - if ((name_matches(db[i], name, namelen) || - (res_specified && res_matches(db[i], xres, yres))) && - !fb_try_mode(var, info, &db[i], bpp)) { -- if (refresh_specified && db[i].refresh == refresh) -- return 1; -+ const int db_interlace = (db[i].vmode & -+ FB_VMODE_INTERLACED ? 1 : 0); -+ int score = abs(db[i].refresh - refresh); -+ -+ if (interlace_specified) -+ score += abs(db_interlace - interlace); -+ -+ if (!interlace_specified || -+ db_interlace == interlace) -+ if (refresh_specified && -+ db[i].refresh == refresh) -+ return 1; - -- if (abs(db[i].refresh - refresh) < diff) { -- diff = abs(db[i].refresh - refresh); -+ if (score < diff) { -+ diff = score; - best = i; - } - } -diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c -index 7f6c9e6cfc6c..14a93cb21310 100644 ---- a/drivers/video/fbdev/goldfishfb.c -+++ b/drivers/video/fbdev/goldfishfb.c -@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) - dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, - fb->fb.fix.smem_start); - iounmap(fb->reg_base); -+ kfree(fb); - return 0; - } - -diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c -index 393ae1bc07e8..a8a6f072fb78 100644 ---- a/drivers/video/fbdev/omap/omapfb_main.c -+++ b/drivers/video/fbdev/omap/omapfb_main.c -@@ -977,7 +977,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, - { - int r; - -- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) -+ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) - return -EINVAL; - - if (!notifier_inited) { -diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c -index badee04ef496..71b5dca95bdb 100644 ---- a/drivers/video/fbdev/via/viafbdev.c -+++ b/drivers/video/fbdev/via/viafbdev.c -@@ -19,6 +19,7 @@ - * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - */ - -+#include - #include - #include - #include -@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { - - #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ - --static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) -+static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) - { - via_odev_to_seq(m, supported_odev_map[ - viaparinfo->shared->chip_info.gfx_chip_name]); -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index f44e93d2650d..62bc72001fce 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, - const struct user_regset *regset = &view->regsets[i]; - do_thread_regset_writeback(t->task, regset); - if (regset->core_note_type && regset->get && -- (!regset->active || regset->active(t->task, regset))) { -+ (!regset->active || regset->active(t->task, regset) > 0)) { - int ret; - size_t size = regset->n * regset->size; - void *data = kmalloc(size, GFP_KERNEL); -diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c -index 97d1a15873c5..57b039ebfb1f 100644 ---- a/fs/cifs/readdir.c -+++ b/fs/cifs/readdir.c -@@ -373,8 +373,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) - - new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + - pfData->FileNameLength; -- } else -- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); -+ } else { -+ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); -+ -+ if (old_entry + next_offset < old_entry) { -+ cifs_dbg(VFS, "invalid offset %u\n", next_offset); -+ return NULL; -+ } -+ new_entry = old_entry + next_offset; -+ } - cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); - /* validate that new_entry is not past end of SMB */ - if (new_entry >= end_of_smb) { -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 52d79fb04115..f7111bb88ec1 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -2402,33 +2402,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) - int len; - unsigned int entrycount = 0; - unsigned int next_offset = 0; -- FILE_DIRECTORY_INFO *entryptr; -+ char *entryptr; -+ FILE_DIRECTORY_INFO *dir_info; - - if (bufstart == NULL) - return 0; - -- entryptr = (FILE_DIRECTORY_INFO *)bufstart; -+ entryptr = bufstart; - - while (1) { -- entryptr = (FILE_DIRECTORY_INFO *) -- ((char *)entryptr + next_offset); -- -- if ((char *)entryptr + size > end_of_buf) { -+ if (entryptr + next_offset < entryptr || -+ entryptr + next_offset > end_of_buf || -+ entryptr + next_offset + size > end_of_buf) { - cifs_dbg(VFS, "malformed search entry would overflow\n"); - break; - } - -- len = le32_to_cpu(entryptr->FileNameLength); -- if ((char *)entryptr + len + size > end_of_buf) { -+ entryptr = entryptr + next_offset; -+ dir_info = (FILE_DIRECTORY_INFO *)entryptr; -+ -+ len = le32_to_cpu(dir_info->FileNameLength); -+ if (entryptr + len < entryptr || -+ entryptr + len > end_of_buf || -+ entryptr + len + size > end_of_buf) { - cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", - end_of_buf); - break; - } - -- *lastentry = (char *)entryptr; -+ *lastentry = entryptr; - entrycount++; - -- next_offset = le32_to_cpu(entryptr->NextEntryOffset); -+ next_offset = le32_to_cpu(dir_info->NextEntryOffset); - if (!next_offset) - break; - } -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index 61296ecbd0e2..09476bb8f6cd 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, - end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; - lblock = offset >> shift; - lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; -- if (lblock_stop > end_of_file) -+ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) - return 1; - - size = (lblock_stop - lblock) << shift; -diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c -index 27300533c2dd..bd21795ce657 100644 ---- a/fs/pstore/ram_core.c -+++ b/fs/pstore/ram_core.c -@@ -378,7 +378,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, - vaddr = vmap(pages, page_count, VM_MAP, prot); - kfree(pages); - -- return vaddr; -+ /* -+ * Since vmap() uses page granularity, we must add the offset -+ * into the page here, to get the byte granularity address -+ * into the mapping to represent the actual "start" location. -+ */ -+ return vaddr + offset_in_page(start); - } - - static void *persistent_ram_iomap(phys_addr_t start, size_t size, -@@ -397,6 +402,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, - else - va = ioremap_wc(start, size); - -+ /* -+ * Since request_mem_region() and ioremap() are byte-granularity -+ * there is no need handle anything special like we do when the -+ * vmap() case in persistent_ram_vmap() above. -+ */ - return va; - } - -@@ -417,7 +427,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, - return -ENOMEM; - } - -- prz->buffer = prz->vaddr + offset_in_page(start); -+ prz->buffer = prz->vaddr; - prz->buffer_size = size - sizeof(struct persistent_ram_buffer); - - return 0; -@@ -464,7 +474,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) - - if (prz->vaddr) { - if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { -- vunmap(prz->vaddr); -+ /* We must vunmap() at page-granularity. */ -+ vunmap(prz->vaddr - offset_in_page(prz->paddr)); - } else { - iounmap(prz->vaddr); - release_mem_region(prz->paddr, prz->size); -diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c -index a162661c9d60..f45a9a5d3e47 100644 ---- a/kernel/audit_watch.c -+++ b/kernel/audit_watch.c -@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) - struct path parent_path; - int h, ret = 0; - -+ /* -+ * When we will be calling audit_add_to_parent, krule->watch might have -+ * been updated and watch might have been freed. -+ * So we need to keep a reference of watch. -+ */ -+ audit_get_watch(watch); -+ - mutex_unlock(&audit_filter_mutex); - - /* Avoid calling path_lookup under audit_filter_mutex. */ -@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) - /* caller expects mutex locked */ - mutex_lock(&audit_filter_mutex); - -- if (ret) -+ if (ret) { -+ audit_put_watch(watch); - return ret; -+ } - - /* either find an old parent or attach a new one */ - parent = audit_find_parent(d_backing_inode(parent_path.dentry)); -@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) - *list = &audit_inode_hash[h]; - error: - path_put(&parent_path); -+ audit_put_watch(watch); - return ret; - } - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 00a8cc572a22..1f930032253a 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -286,7 +286,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, - goto out_unlock; - } - -- ieee80211_key_free(key, true); -+ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); - - ret = 0; - out_unlock: -diff --git a/net/mac80211/key.c b/net/mac80211/key.c -index 4a72c0d1e56f..91a4e606edcd 100644 ---- a/net/mac80211/key.c -+++ b/net/mac80211/key.c -@@ -647,11 +647,15 @@ int ieee80211_key_link(struct ieee80211_key *key, - { - struct ieee80211_local *local = sdata->local; - struct ieee80211_key *old_key; -- int idx, ret; -- bool pairwise; -- -- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; -- idx = key->conf.keyidx; -+ int idx = key->conf.keyidx; -+ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; -+ /* -+ * We want to delay tailroom updates only for station - in that -+ * case it helps roaming speed, but in other cases it hurts and -+ * can cause warnings to appear. -+ */ -+ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; -+ int ret; - - mutex_lock(&sdata->local->key_mtx); - -@@ -679,14 +683,14 @@ int ieee80211_key_link(struct ieee80211_key *key, - increment_tailroom_need_count(sdata); - - ieee80211_key_replace(sdata, sta, pairwise, old_key, key); -- ieee80211_key_destroy(old_key, true); -+ ieee80211_key_destroy(old_key, delay_tailroom); - - ieee80211_debugfs_key_add(key); - - if (!local->wowlan) { - ret = ieee80211_key_enable_hw_accel(key); - if (ret) -- ieee80211_key_free(key, true); -+ ieee80211_key_free(key, delay_tailroom); - } else { - ret = 0; - } -@@ -874,7 +878,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, - ieee80211_key_replace(key->sdata, key->sta, - key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, - key, NULL); -- __ieee80211_key_destroy(key, true); -+ __ieee80211_key_destroy(key, key->sdata->vif.type == -+ NL80211_IFTYPE_STATION); - } - - for (i = 0; i < NUM_DEFAULT_KEYS; i++) { -@@ -884,7 +889,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, - ieee80211_key_replace(key->sdata, key->sta, - key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, - key, NULL); -- __ieee80211_key_destroy(key, true); -+ __ieee80211_key_destroy(key, key->sdata->vif.type == -+ NL80211_IFTYPE_STATION); - } - - mutex_unlock(&local->key_mtx); -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index e9eecf6f0bff..48080f89ed25 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1845,7 +1845,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, - /* Try to instantiate a bundle */ - err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); - if (err <= 0) { -- if (err != 0 && err != -EAGAIN) -+ if (err == 0) -+ return NULL; -+ -+ if (err != -EAGAIN) - XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); - return ERR_PTR(err); - } -diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include -index 31a981d6229d..5897fc3857a0 100644 ---- a/scripts/Kbuild.include -+++ b/scripts/Kbuild.include -@@ -359,3 +359,6 @@ endif - endef - # - ############################################################################### -+ -+# delete partially updated (i.e. corrupted) files on error -+.DELETE_ON_ERROR: -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 4c145d6bccd4..5bc7ddf8fc70 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); - - static int snd_interval_refine_first(struct snd_interval *i) - { -+ const unsigned int last_max = i->max; -+ - if (snd_BUG_ON(snd_interval_empty(i))) - return -EINVAL; - if (snd_interval_single(i)) - return 0; - i->max = i->min; -- i->openmax = i->openmin; -- if (i->openmax) -+ if (i->openmin) - i->max++; -+ /* only exclude max value if also excluded before refine */ -+ i->openmax = (i->openmax && i->max >= last_max); - return 1; - } - - static int snd_interval_refine_last(struct snd_interval *i) - { -+ const unsigned int last_min = i->min; -+ - if (snd_BUG_ON(snd_interval_empty(i))) - return -EINVAL; - if (snd_interval_single(i)) - return 0; - i->min = i->max; -- i->openmin = i->openmax; -- if (i->openmin) -+ if (i->openmax) - i->min--; -+ /* only exclude min value if also excluded before refine */ -+ i->openmin = (i->openmin && i->min <= last_min); - return 1; - } - -diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c -index a31ea6c22d19..2d7379dec1f0 100644 ---- a/sound/isa/msnd/msnd_pinnacle.c -+++ b/sound/isa/msnd/msnd_pinnacle.c -@@ -82,10 +82,10 @@ - - static void set_default_audio_parameters(struct snd_msnd *chip) - { -- chip->play_sample_size = DEFSAMPLESIZE; -+ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); - chip->play_sample_rate = DEFSAMPLERATE; - chip->play_channels = DEFCHANNELS; -- chip->capture_sample_size = DEFSAMPLESIZE; -+ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); - chip->capture_sample_rate = DEFSAMPLERATE; - chip->capture_channels = DEFCHANNELS; - } -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 69bf5cf1e91e..15cbe2565703 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), - */ - - #define AU0828_DEVICE(vid, pid, vname, pname) { \ -- USB_DEVICE_VENDOR_SPEC(vid, pid), \ -+ .idVendor = vid, \ -+ .idProduct = pid, \ - .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ - USB_DEVICE_ID_MATCH_INT_CLASS | \ - USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ -diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c -index 60a94b3e532e..177480066816 100644 ---- a/tools/hv/hv_kvp_daemon.c -+++ b/tools/hv/hv_kvp_daemon.c -@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) - * Found a match; just move the remaining - * entries up. - */ -- if (i == num_records) { -+ if (i == (num_records - 1)) { - kvp_file_info[pool].num_records--; - kvp_update_file(pool); - return 0; -diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c -index bd630c222e65..9a53f6e9ef43 100644 ---- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c -+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c -@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) - } - - /* -- * Check if return address is on the stack. -+ * Check if return address is on the stack. If return address -+ * is in a register (typically R0), it is yet to be saved on -+ * the stack. - */ -- if (nops != 0 || ops != NULL) -+ if ((nops != 0 || ops != NULL) && -+ !(nops == 1 && ops[0].atom == DW_OP_regx && -+ ops[0].number2 == 0 && ops[0].offset == 0)) - return 0; - - /* -@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) - if (!chain || chain->nr < 3) - return skip_slot; - -- ip = chain->ips[2]; -+ ip = chain->ips[1]; - - thread__find_addr_location(thread, PERF_RECORD_MISC_USER, - MAP__FUNCTION, ip, &al); -diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c -index 30906bfd9c1b..0ab937a17ebb 100644 ---- a/tools/testing/selftests/timers/raw_skew.c -+++ b/tools/testing/selftests/timers/raw_skew.c -@@ -146,6 +146,11 @@ int main(int argv, char **argc) - printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); - - if (llabs(eppm - ppm) > 1000) { -+ if (tx1.offset || tx2.offset || -+ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { -+ printf(" [SKIP]\n"); -+ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); -+ } - printf(" [FAILED]\n"); - return ksft_exit_fail(); - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.158-159.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.158-159.patch deleted file mode 100644 index 344789e55930..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.158-159.patch +++ /dev/null @@ -1,636 +0,0 @@ -diff --git a/Makefile b/Makefile -index d07a6283b67e..06d5c6a6a0f6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 158 -+SUBLEVEL = 159 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c -index 724a08740a04..9c7358110d32 100644 ---- a/arch/x86/xen/pmu.c -+++ b/arch/x86/xen/pmu.c -@@ -477,7 +477,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs, - irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) - { - int err, ret = IRQ_NONE; -- struct pt_regs regs; -+ struct pt_regs regs = {0}; - const struct xen_pmu_data *xenpmu_data = get_xenpmu_data(); - uint8_t xenpmu_flags = get_xenpmu_flags(); - -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c -index ababdaabe870..1855b475cc0b 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.c -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c -@@ -253,12 +253,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) - nv_connector->edid = NULL; - } - -- /* Outputs are only polled while runtime active, so acquiring a -- * runtime PM ref here is unnecessary (and would deadlock upon -- * runtime suspend because it waits for polling to finish). -+ /* Outputs are only polled while runtime active, so resuming the -+ * device here is unnecessary (and would deadlock upon runtime suspend -+ * because it waits for polling to finish). We do however, want to -+ * prevent the autosuspend timer from elapsing during this operation -+ * if possible. - */ -- if (!drm_kms_helper_is_poll_worker()) { -- ret = pm_runtime_get_sync(connector->dev->dev); -+ if (drm_kms_helper_is_poll_worker()) { -+ pm_runtime_get_noresume(dev->dev); -+ } else { -+ ret = pm_runtime_get_sync(dev->dev); - if (ret < 0 && ret != -EACCES) - return conn_status; - } -@@ -329,10 +333,8 @@ detect_analog: - - out: - -- if (!drm_kms_helper_is_poll_worker()) { -- pm_runtime_mark_last_busy(connector->dev->dev); -- pm_runtime_put_autosuspend(connector->dev->dev); -- } -+ pm_runtime_mark_last_busy(dev->dev); -+ pm_runtime_put_autosuspend(dev->dev); - - return conn_status; - } -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index e4541c6bf3d3..4564ecf71181 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -2011,6 +2011,9 @@ static const struct hid_device_id hid_have_special_driver[] = { - { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) }, - { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, - { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, -+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) }, -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 60e2c9faa95f..00d8366a614e 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -879,6 +879,8 @@ - #define USB_DEVICE_ID_SONY_PS3_BDREMOTE 0x0306 - #define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268 - #define USB_DEVICE_ID_SONY_PS4_CONTROLLER 0x05c4 -+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2 0x09cc -+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE 0x0ba0 - #define USB_DEVICE_ID_SONY_MOTION_CONTROLLER 0x03d5 - #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER 0x042f - #define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER 0x0002 -diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c -index 21febbb0d84e..6f3d47185bf0 100644 ---- a/drivers/hid/hid-sony.c -+++ b/drivers/hid/hid-sony.c -@@ -2460,6 +2460,12 @@ static const struct hid_device_id sony_devices[] = { - .driver_data = DUALSHOCK4_CONTROLLER_USB }, - { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER), - .driver_data = DUALSHOCK4_CONTROLLER_BT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), -+ .driver_data = DUALSHOCK4_CONTROLLER_USB }, -+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2), -+ .driver_data = DUALSHOCK4_CONTROLLER_BT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE), -+ .driver_data = DUALSHOCK4_CONTROLLER_USB }, - { } - }; - MODULE_DEVICE_TABLE(hid, sony_devices); -diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c -index 53aa7515f542..04206c600098 100644 ---- a/drivers/infiniband/hw/cxgb4/qp.c -+++ b/drivers/infiniband/hw/cxgb4/qp.c -@@ -1183,6 +1183,12 @@ static void flush_qp(struct c4iw_qp *qhp) - - t4_set_wq_in_error(&qhp->wq); - if (qhp->ibqp.uobject) { -+ -+ /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ -+ if (qhp->wq.flushed) -+ return; -+ -+ qhp->wq.flushed = 1; - t4_set_cq_in_error(&rchp->cq); - spin_lock_irqsave(&rchp->comp_handler_lock, flag); - (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context); -diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c -index 2e4649655181..4e98e5aff7c5 100644 ---- a/drivers/net/appletalk/ipddp.c -+++ b/drivers/net/appletalk/ipddp.c -@@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - case SIOCFINDIPDDPRT: - spin_lock_bh(&ipddp_route_lock); - rp = __ipddp_find_route(&rcp); -- if (rp) -- memcpy(&rcp2, rp, sizeof(rcp2)); -+ if (rp) { -+ memset(&rcp2, 0, sizeof(rcp2)); -+ rcp2.ip = rp->ip; -+ rcp2.at = rp->at; -+ rcp2.flags = rp->flags; -+ } - spin_unlock_bh(&ipddp_route_lock); - - if (rp) { -diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c -index 3daf2d4a7ca0..884aa809baac 100644 ---- a/drivers/net/ethernet/hp/hp100.c -+++ b/drivers/net/ethernet/hp/hp100.c -@@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) - /* Wait for link to drop */ - time = jiffies + (HZ / 10); - do { -- if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) -+ if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) - break; - if (!in_interrupt()) - schedule_timeout_interruptible(1); -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 3270b4333668..0a4bd73caae5 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -892,7 +892,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, - BUG_ON(pull_to <= skb_headlen(skb)); - __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); - } -- BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); -+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { -+ queue->rx.rsp_cons = ++cons; -+ kfree_skb(nskb); -+ return ~0U; -+ } - - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, - skb_frag_page(nfrag), -@@ -1029,6 +1033,8 @@ err: - skb->len += rx->status; - - i = xennet_fill_frags(queue, skb, &tmpq); -+ if (unlikely(i == ~0U)) -+ goto err; - - if (rx->flags & XEN_NETRXF_csum_blank) - skb->ip_summed = CHECKSUM_PARTIAL; -diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c -index 1e1e59423889..3df47c1b04ec 100644 ---- a/drivers/platform/x86/alienware-wmi.c -+++ b/drivers/platform/x86/alienware-wmi.c -@@ -463,6 +463,7 @@ static acpi_status alienware_hdmi_command(struct hdmi_args *in_args, - if (obj && obj->type == ACPI_TYPE_INTEGER) - *out_data = (u32) obj->integer.value; - } -+ kfree(output.pointer); - return status; - - } -diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c -index 47e249dccb5f..b380bc7ee10a 100644 ---- a/drivers/target/iscsi/iscsi_target_auth.c -+++ b/drivers/target/iscsi/iscsi_target_auth.c -@@ -26,18 +26,6 @@ - #include "iscsi_target_nego.h" - #include "iscsi_target_auth.h" - --static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len) --{ -- int j = DIV_ROUND_UP(len, 2), rc; -- -- rc = hex2bin(dst, src, j); -- if (rc < 0) -- pr_debug("CHAP string contains non hex digit symbols\n"); -- -- dst[j] = '\0'; -- return j; --} -- - static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) - { - int i; -@@ -241,9 +229,16 @@ static int chap_server_compute_md5( - pr_err("Could not find CHAP_R.\n"); - goto out; - } -+ if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) { -+ pr_err("Malformed CHAP_R\n"); -+ goto out; -+ } -+ if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) { -+ pr_err("Malformed CHAP_R\n"); -+ goto out; -+ } - - pr_debug("[server] Got CHAP_R=%s\n", chap_r); -- chap_string_to_hex(client_digest, chap_r, strlen(chap_r)); - - tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); - if (IS_ERR(tfm)) { -@@ -348,9 +343,7 @@ static int chap_server_compute_md5( - pr_err("Could not find CHAP_C.\n"); - goto out; - } -- pr_debug("[server] Got CHAP_C=%s\n", challenge); -- challenge_len = chap_string_to_hex(challenge_binhex, challenge, -- strlen(challenge)); -+ challenge_len = DIV_ROUND_UP(strlen(challenge), 2); - if (!challenge_len) { - pr_err("Unable to convert incoming challenge\n"); - goto out; -@@ -359,6 +352,11 @@ static int chap_server_compute_md5( - pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n"); - goto out; - } -+ if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) { -+ pr_err("Malformed CHAP_C\n"); -+ goto out; -+ } -+ pr_debug("[server] Got CHAP_C=%s\n", challenge); - /* - * During mutual authentication, the CHAP_C generated by the - * initiator must not match the original CHAP_C generated by -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index 97d5a74558a3..a86bc7afb3b2 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -31,6 +31,8 @@ - #include - #include - -+#include -+ - #include - #include - #include -@@ -703,6 +705,8 @@ int vt_ioctl(struct tty_struct *tty, - if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) - ret = -ENXIO; - else { -+ vsa.console = array_index_nospec(vsa.console, -+ MAX_NR_CONSOLES + 1); - vsa.console--; - console_lock(); - ret = vc_allocate(vsa.console); -diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c -index 6d17f31a31d7..8eb768bbf5b5 100644 ---- a/fs/ext4/dir.c -+++ b/fs/ext4/dir.c -@@ -74,7 +74,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, - else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len))) - error_msg = "rec_len is too small for name_len"; - else if (unlikely(((char *) de - buf) + rlen > size)) -- error_msg = "directory entry across range"; -+ error_msg = "directory entry overrun"; - else if (unlikely(le32_to_cpu(de->inode) > - le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) - error_msg = "inode out of bounds"; -@@ -83,18 +83,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, - - if (filp) - ext4_error_file(filp, function, line, bh->b_blocknr, -- "bad entry in directory: %s - offset=%u(%u), " -- "inode=%u, rec_len=%d, name_len=%d", -- error_msg, (unsigned) (offset % size), -- offset, le32_to_cpu(de->inode), -- rlen, de->name_len); -+ "bad entry in directory: %s - offset=%u, " -+ "inode=%u, rec_len=%d, name_len=%d, size=%d", -+ error_msg, offset, le32_to_cpu(de->inode), -+ rlen, de->name_len, size); - else - ext4_error_inode(dir, function, line, bh->b_blocknr, -- "bad entry in directory: %s - offset=%u(%u), " -- "inode=%u, rec_len=%d, name_len=%d", -- error_msg, (unsigned) (offset % size), -- offset, le32_to_cpu(de->inode), -- rlen, de->name_len); -+ "bad entry in directory: %s - offset=%u, " -+ "inode=%u, rec_len=%d, name_len=%d, size=%d", -+ error_msg, offset, le32_to_cpu(de->inode), -+ rlen, de->name_len, size); - - return 1; - } -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index c449bc089c94..1e7a9774119c 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1756,6 +1756,7 @@ int empty_inline_dir(struct inode *dir, int *has_inline_data) - { - int err, inline_size; - struct ext4_iloc iloc; -+ size_t inline_len; - void *inline_pos; - unsigned int offset; - struct ext4_dir_entry_2 *de; -@@ -1783,8 +1784,9 @@ int empty_inline_dir(struct inode *dir, int *has_inline_data) - goto out; - } - -+ inline_len = ext4_get_inline_size(dir); - offset = EXT4_INLINE_DOTDOT_SIZE; -- while (offset < dir->i_size) { -+ while (offset < inline_len) { - de = ext4_get_inline_entry(dir, &iloc, offset, - &inline_pos, &inline_size); - if (ext4_check_dir_entry(dir, NULL, de, -diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c -index 0a512aa81bf7..4c9d799955d1 100644 ---- a/fs/ext4/mmp.c -+++ b/fs/ext4/mmp.c -@@ -48,7 +48,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) - */ - sb_start_write(sb); - ext4_mmp_csum_set(sb, mmp); -- mark_buffer_dirty(bh); - lock_buffer(bh); - bh->b_end_io = end_buffer_write_sync; - get_bh(bh); -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index d2421fd38833..783280ebc2fe 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -18,6 +18,7 @@ - - int ext4_resize_begin(struct super_block *sb) - { -+ struct ext4_sb_info *sbi = EXT4_SB(sb); - int ret = 0; - - if (!capable(CAP_SYS_RESOURCE)) -@@ -28,7 +29,7 @@ int ext4_resize_begin(struct super_block *sb) - * because the user tools have no way of handling this. Probably a - * bad time to do it anyways. - */ -- if (EXT4_SB(sb)->s_sbh->b_blocknr != -+ if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) != - le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) { - ext4_warning(sb, "won't resize using backup superblock at %llu", - (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr); -@@ -1954,6 +1955,26 @@ retry: - } - } - -+ /* -+ * Make sure the last group has enough space so that it's -+ * guaranteed to have enough space for all metadata blocks -+ * that it might need to hold. (We might not need to store -+ * the inode table blocks in the last block group, but there -+ * will be cases where this might be needed.) -+ */ -+ if ((ext4_group_first_block_no(sb, n_group) + -+ ext4_group_overhead_blocks(sb, n_group) + 2 + -+ sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) { -+ n_blocks_count = ext4_group_first_block_no(sb, n_group); -+ n_group--; -+ n_blocks_count_retry = 0; -+ if (resize_inode) { -+ iput(resize_inode); -+ resize_inode = NULL; -+ } -+ goto retry; -+ } -+ - /* extend the last group */ - if (n_group == o_group) - add = n_blocks_count - o_blocks_count; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 8d18f6142da5..a3d905abbaa9 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -4024,11 +4024,13 @@ no_journal: - block = ext4_count_free_clusters(sb); - ext4_free_blocks_count_set(sbi->s_es, - EXT4_C2B(sbi, block)); -+ ext4_superblock_csum_set(sb); - err = percpu_counter_init(&sbi->s_freeclusters_counter, block, - GFP_KERNEL); - if (!err) { - unsigned long freei = ext4_count_free_inodes(sb); - sbi->s_es->s_free_inodes_count = cpu_to_le32(freei); -+ ext4_superblock_csum_set(sb); - err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, - GFP_KERNEL); - } -diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c -index fe50ded1b4ce..272269f1c310 100644 ---- a/fs/ocfs2/buffer_head_io.c -+++ b/fs/ocfs2/buffer_head_io.c -@@ -336,6 +336,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, - * for this bh as it's not marked locally - * uptodate. */ - status = -EIO; -+ clear_buffer_needs_validate(bh); - put_bh(bh); - bhs[i] = NULL; - continue; -diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h -index 316694dafa5b..008f466d1da7 100644 ---- a/include/net/nfc/hci.h -+++ b/include/net/nfc/hci.h -@@ -87,7 +87,7 @@ struct nfc_hci_pipe { - * According to specification 102 622 chapter 4.4 Pipes, - * the pipe identifier is 7 bits long. - */ --#define NFC_HCI_MAX_PIPES 127 -+#define NFC_HCI_MAX_PIPES 128 - struct nfc_hci_init_data { - u8 gate_count; - struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES]; -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index fdaa88f38aec..74b20e3ab8c6 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -1513,6 +1513,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) - tmp_iter_page = first_page; - - do { -+ cond_resched(); -+ - to_remove_page = tmp_iter_page; - rb_inc_page(cpu_buffer, &tmp_iter_page); - -diff --git a/mm/shmem.c b/mm/shmem.c -index 1b11ccc0a3b7..8e506a45a6ef 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -1464,6 +1464,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode - mpol_shared_policy_init(&info->policy, NULL); - break; - } -+ -+ lockdep_annotate_inode_mutex_key(inode); - } else - shmem_free_inode(sb); - return inode; -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index f60b93627876..78dc184072e8 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -1140,6 +1140,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, - lladdr = neigh->ha; - } - -+ /* Update confirmed timestamp for neighbour entry after we -+ * received ARP packet even if it doesn't change IP to MAC binding. -+ */ -+ if (new & NUD_CONNECTED) -+ neigh->confirmed = jiffies; -+ - /* If entry was valid and address is not changed, - do not change entry state, if new one is STALE. - */ -@@ -1163,15 +1169,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, - } - } - -- /* Update timestamps only once we know we will make a change to the -+ /* Update timestamp only once we know we will make a change to the - * neighbour entry. Otherwise we risk to move the locktime window with - * noop updates and ignore relevant ARP updates. - */ -- if (new != old || lladdr != neigh->ha) { -- if (new & NUD_CONNECTED) -- neigh->confirmed = jiffies; -+ if (new != old || lladdr != neigh->ha) - neigh->updated = jiffies; -- } - - if (new != old) { - neigh_del_timer(neigh); -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 967a47ff78a4..b12721ecb0b6 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1280,6 +1280,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, - if (encap) - skb_reset_inner_headers(skb); - skb->network_header = (u8 *)iph - skb->head; -+ skb_reset_mac_len(skb); - } while ((skb = skb->next)); - - out: -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 9e2ea4ae840d..244b9fec9d4d 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -118,6 +118,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff); - ipv6h->payload_len = htons(skb->len - nhoff - sizeof(*ipv6h)); - skb->network_header = (u8 *)ipv6h - skb->head; -+ skb_reset_mac_len(skb); - - if (udpfrag) { - int err = ip6_find_1stfragopt(skb, &prevhdr); -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 0feede45bd28..530b62fd6b64 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -193,12 +193,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, - kfree_skb(skb); - return -ENOBUFS; - } -+ if (skb->sk) -+ skb_set_owner_w(skb2, skb->sk); - consume_skb(skb); - skb = skb2; -- /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, -- * it is safe to call in our context (socket lock not held) -- */ -- skb_set_owner_w(skb, (struct sock *)sk); - } - if (opt->opt_flen) - ipv6_push_frag_opts(skb, opt, &proto); -diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c -index 07e5abdbceb5..0a576ccca3dc 100644 ---- a/sound/firewire/bebob/bebob_maudio.c -+++ b/sound/firewire/bebob/bebob_maudio.c -@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) - struct fw_device *device = fw_parent_device(unit); - int err, rcode; - u64 date; -- __le32 cues[3] = { -- cpu_to_le32(MAUDIO_BOOTLOADER_CUE1), -- cpu_to_le32(MAUDIO_BOOTLOADER_CUE2), -- cpu_to_le32(MAUDIO_BOOTLOADER_CUE3) -- }; -+ __le32 *cues; - - /* check date of software used to build */ - err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE, - &date, sizeof(u64)); - if (err < 0) -- goto end; -+ return err; - /* - * firmware version 5058 or later has date later than "20070401", but - * 'date' is not null-terminated. -@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) - if (date < 0x3230303730343031LL) { - dev_err(&unit->device, - "Use firmware version 5058 or later\n"); -- err = -ENOSYS; -- goto end; -+ return -ENXIO; - } - -+ cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL); -+ if (!cues) -+ return -ENOMEM; -+ -+ cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1); -+ cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2); -+ cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3); -+ - rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST, - device->node_id, device->generation, - device->max_speed, BEBOB_ADDR_REG_REQ, -- cues, sizeof(cues)); -+ cues, 3 * sizeof(*cues)); -+ kfree(cues); - if (rcode != RCODE_COMPLETE) { - dev_err(&unit->device, - "Failed to send a cue to load firmware\n"); - err = -EIO; - } --end: -+ - return err; - } - -diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c -index 56fc47bd6dba..50b216fc369f 100644 ---- a/sound/pci/emu10k1/emufx.c -+++ b/sound/pci/emu10k1/emufx.c -@@ -2520,7 +2520,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un - emu->support_tlv = 1; - return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp); - case SNDRV_EMU10K1_IOCTL_INFO: -- info = kmalloc(sizeof(*info), GFP_KERNEL); -+ info = kzalloc(sizeof(*info), GFP_KERNEL); - if (!info) - return -ENOMEM; - snd_emu10k1_fx8010_info(emu, info); -diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c -index 55db19ddc5ff..93b02be3a90e 100644 ---- a/sound/soc/codecs/cs4265.c -+++ b/sound/soc/codecs/cs4265.c -@@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { - SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, - 3, 1, 0), - SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), -- SOC_SINGLE("MMTLR Data Switch", 0, -- 1, 1, 0), -+ SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2, -+ 0, 1, 0), - SOC_ENUM("Mono Channel Select", spdif_mono_select_enum), - SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24), - }; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.159-160.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.159-160.patch deleted file mode 100644 index 61ba138a153b..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.159-160.patch +++ /dev/null @@ -1,3101 +0,0 @@ -diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx -index cfd31d94c872..f8bf14055c2f 100644 ---- a/Documentation/hwmon/ina2xx -+++ b/Documentation/hwmon/ina2xx -@@ -32,7 +32,7 @@ Supported chips: - Datasheet: Publicly available at the Texas Instruments website - http://www.ti.com/ - --Author: Lothar Felten -+Author: Lothar Felten - - Description - ----------- -diff --git a/Makefile b/Makefile -index 06d5c6a6a0f6..607394a56036 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 159 -+SUBLEVEL = 160 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi -index 02bd6312d1d9..e6a3a94bac69 100644 ---- a/arch/arm/boot/dts/dra7.dtsi -+++ b/arch/arm/boot/dts/dra7.dtsi -@@ -1549,7 +1549,7 @@ - }; - }; - -- dcan1: can@481cc000 { -+ dcan1: can@4ae3c000 { - compatible = "ti,dra7-d_can"; - ti,hwmods = "dcan1"; - reg = <0x4ae3c000 0x2000>; -@@ -1559,7 +1559,7 @@ - status = "disabled"; - }; - -- dcan2: can@481d0000 { -+ dcan2: can@48480000 { - compatible = "ti,dra7-d_can"; - ti,hwmods = "dcan2"; - reg = <0x48480000 0x2000>; -diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c -index ed8fda4cd055..45fd4b173dac 100644 ---- a/arch/arm/mach-mvebu/pmsu.c -+++ b/arch/arm/mach-mvebu/pmsu.c -@@ -117,8 +117,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr) - PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu)); - } - --extern unsigned char mvebu_boot_wa_start; --extern unsigned char mvebu_boot_wa_end; -+extern unsigned char mvebu_boot_wa_start[]; -+extern unsigned char mvebu_boot_wa_end[]; - - /* - * This function sets up the boot address workaround needed for SMP -@@ -131,7 +131,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target, - phys_addr_t resume_addr_reg) - { - void __iomem *sram_virt_base; -- u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start; -+ u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start; - - mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE); - mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute, -diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h -index 1b5e0e843c3a..7e2b3e360086 100644 ---- a/arch/arm64/include/asm/jump_label.h -+++ b/arch/arm64/include/asm/jump_label.h -@@ -28,7 +28,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm goto("1: nop\n\t" -+ asm_volatile_goto("1: nop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".align 3\n\t" - ".quad 1b, %l[l_yes], %c0\n\t" -@@ -42,7 +42,7 @@ l_yes: - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm goto("1: b %l[l_yes]\n\t" -+ asm_volatile_goto("1: b %l[l_yes]\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".align 3\n\t" - ".quad 1b, %l[l_yes], %c0\n\t" -diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h -index 25a40213bd9b..0729a2f94482 100644 ---- a/arch/arm64/include/asm/kvm_emulate.h -+++ b/arch/arm64/include/asm/kvm_emulate.h -@@ -41,6 +41,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); - void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); - void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); - -+static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu) -+{ -+ return !(vcpu->arch.hcr_el2 & HCR_RW); -+} -+ - static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) - { - vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; -diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h -index d48ab5b41f52..50150320f80d 100644 ---- a/arch/arm64/include/asm/sysreg.h -+++ b/arch/arm64/include/asm/sysreg.h -@@ -109,6 +109,7 @@ - #define ID_AA64PFR0_ASIMD_SUPPORTED 0x0 - #define ID_AA64PFR0_EL1_64BIT_ONLY 0x1 - #define ID_AA64PFR0_EL0_64BIT_ONLY 0x1 -+#define ID_AA64PFR0_EL0_32BIT_64BIT 0x2 - - /* id_aa64mmfr0 */ - #define ID_AA64MMFR0_TGRAN4_SHIFT 28 -diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h -index 5e4a59b3ec1b..2691a1857d20 100644 ---- a/arch/hexagon/include/asm/bitops.h -+++ b/arch/hexagon/include/asm/bitops.h -@@ -211,7 +211,7 @@ static inline long ffz(int x) - * This is defined the same way as ffs. - * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. - */ --static inline long fls(int x) -+static inline int fls(int x) - { - int r; - -@@ -232,7 +232,7 @@ static inline long fls(int x) - * the libc and compiler builtin ffs routines, therefore - * differs in spirit from the above ffz (man ffs). - */ --static inline long ffs(int x) -+static inline int ffs(int x) - { - int r; - -diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c -index 9e3ddf792bd3..2704e0b8de43 100644 ---- a/arch/hexagon/kernel/dma.c -+++ b/arch/hexagon/kernel/dma.c -@@ -68,7 +68,7 @@ static void *hexagon_dma_alloc_coherent(struct device *dev, size_t size, - panic("Can't create %s() memory pool!", __func__); - else - gen_pool_add(coherent_pool, -- pfn_to_virt(max_low_pfn), -+ (unsigned long)pfn_to_virt(max_low_pfn), - hexagon_coherent_pool_size, -1); - } - -diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c -index 015ae55c1868..8dff2b371219 100644 ---- a/arch/powerpc/kernel/machine_kexec.c -+++ b/arch/powerpc/kernel/machine_kexec.c -@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void) - (unsigned long)(crashk_res.start >> 20), - (unsigned long)(memblock_phys_mem_size() >> 20)); - -- memblock_reserve(crashk_res.start, crash_size); -+ if (!memblock_is_region_memory(crashk_res.start, crash_size) || -+ memblock_reserve(crashk_res.start, crash_size)) { -+ pr_err("Failed to reserve memory for crashkernel!\n"); -+ crashk_res.start = crashk_res.end = 0; -+ return; -+ } - } - - int overlaps_crashkernel(unsigned long start, unsigned long size) -diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c -index fb37290a57b4..366965ae37bd 100644 ---- a/arch/powerpc/kvm/book3s_64_mmu_hv.c -+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c -@@ -314,7 +314,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr, - unsigned long pp, key; - unsigned long v, gr; - __be64 *hptep; -- int index; -+ long int index; - int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR); - - /* Get SLB entry */ -diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c -index eac3b7cc78c6..ab7b2594e0f6 100644 ---- a/arch/powerpc/platforms/powernv/pci-ioda.c -+++ b/arch/powerpc/platforms/powernv/pci-ioda.c -@@ -2270,7 +2270,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, - level_shift = entries_shift + 3; - level_shift = max_t(unsigned, level_shift, PAGE_SHIFT); - -- if ((level_shift - 3) * levels + page_shift >= 60) -+ if ((level_shift - 3) * levels + page_shift >= 55) - return -EINVAL; - - /* Allocate TCE table */ -diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c -index 18fccc303db7..bfd75be6d415 100644 ---- a/arch/s390/mm/extmem.c -+++ b/arch/s390/mm/extmem.c -@@ -79,7 +79,7 @@ struct qin64 { - struct dcss_segment { - struct list_head list; - char dcss_name[8]; -- char res_name[15]; -+ char res_name[16]; - unsigned long start_addr; - unsigned long end; - atomic_t ref_count; -@@ -434,7 +434,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long - memcpy(&seg->res_name, seg->dcss_name, 8); - EBCASC(seg->res_name, 8); - seg->res_name[8] = '\0'; -- strncat(seg->res_name, " (DCSS)", 7); -+ strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); - seg->res->name = seg->res_name; - rc = seg->vm_segtype; - if (rc == SEG_TYPE_SC || -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 92b840c94f17..8be48b1d7596 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -90,7 +90,7 @@ ENDPROC(native_usergs_sysret64) - .endm - - .macro TRACE_IRQS_IRETQ_DEBUG -- bt $9, EFLAGS(%rsp) /* interrupts off? */ -+ btl $9, EFLAGS(%rsp) /* interrupts off? */ - jnc 1f - TRACE_IRQS_ON_DEBUG - 1: -@@ -620,7 +620,7 @@ retint_kernel: - #ifdef CONFIG_PREEMPT - /* Interrupts are off */ - /* Check if we need preemption */ -- bt $9, EFLAGS(%rsp) /* were interrupts off? */ -+ btl $9, EFLAGS(%rsp) /* were interrupts off? */ - jnc 1f - 0: cmpl $0, PER_CPU_VAR(__preempt_count) - jnz 1f -diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c -index 6aa0f4d9eea6..0e37e369b3a0 100644 ---- a/arch/x86/kernel/tsc_msr.c -+++ b/arch/x86/kernel/tsc_msr.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - - /* CPU reference clock frequency: in KHz */ - #define FREQ_83 83200 -diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c -index a8f90ce3dedf..dc6d99017f3f 100644 ---- a/arch/x86/mm/numa_emulation.c -+++ b/arch/x86/mm/numa_emulation.c -@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei, - eb->nid = nid; - - if (emu_nid_to_phys[nid] == NUMA_NO_NODE) -- emu_nid_to_phys[nid] = nid; -+ emu_nid_to_phys[nid] = pb->nid; - - pb->start += size; - if (pb->start >= pb->end) { -diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c -index 149e7a7f04fe..b524f702e658 100644 ---- a/crypto/ablkcipher.c -+++ b/crypto/ablkcipher.c -@@ -384,6 +384,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) - strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type)); - strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", - sizeof(rblkcipher.geniv)); -+ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; - - rblkcipher.blocksize = alg->cra_blocksize; - rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; -@@ -465,6 +466,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg) - strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type)); - strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", - sizeof(rblkcipher.geniv)); -+ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; - - rblkcipher.blocksize = alg->cra_blocksize; - rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; -diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c -index 2d08e59b3212..d524f838eb10 100644 ---- a/crypto/blkcipher.c -+++ b/crypto/blkcipher.c -@@ -515,6 +515,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) - strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type)); - strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "", - sizeof(rblkcipher.geniv)); -+ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; - - rblkcipher.blocksize = alg->cra_blocksize; - rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize; -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 331363e7de0f..2daa5b84abbc 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int - (struct floppy_struct **)&outparam); - if (ret) - return ret; -+ memcpy(&inparam.g, outparam, -+ offsetof(struct floppy_struct, name)); -+ outparam = &inparam.g; - break; - case FDMSGON: - UDP->flags |= FTD_MSG; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 4a899b41145e..b0a12e6dae43 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -340,6 +340,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, - - /* Additional Realtek 8723DE Bluetooth devices */ -+ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, - { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, - - /* Additional Realtek 8821AE Bluetooth devices */ -diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c -index 59ed54e464a9..fe8cfe24c518 100644 ---- a/drivers/crypto/mxs-dcp.c -+++ b/drivers/crypto/mxs-dcp.c -@@ -63,7 +63,7 @@ struct dcp { - struct dcp_coherent_block *coh; - - struct completion completion[DCP_MAX_CHANS]; -- struct mutex mutex[DCP_MAX_CHANS]; -+ spinlock_t lock[DCP_MAX_CHANS]; - struct task_struct *thread[DCP_MAX_CHANS]; - struct crypto_queue queue[DCP_MAX_CHANS]; - }; -@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data) - - int ret; - -- do { -- __set_current_state(TASK_INTERRUPTIBLE); -+ while (!kthread_should_stop()) { -+ set_current_state(TASK_INTERRUPTIBLE); - -- mutex_lock(&sdcp->mutex[chan]); -+ spin_lock(&sdcp->lock[chan]); - backlog = crypto_get_backlog(&sdcp->queue[chan]); - arq = crypto_dequeue_request(&sdcp->queue[chan]); -- mutex_unlock(&sdcp->mutex[chan]); -+ spin_unlock(&sdcp->lock[chan]); -+ -+ if (!backlog && !arq) { -+ schedule(); -+ continue; -+ } -+ -+ set_current_state(TASK_RUNNING); - - if (backlog) - backlog->complete(backlog, -EINPROGRESS); -@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data) - if (arq) { - ret = mxs_dcp_aes_block_crypt(arq); - arq->complete(arq, ret); -- continue; - } -- -- schedule(); -- } while (!kthread_should_stop()); -+ } - - return 0; - } -@@ -407,9 +411,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb) - rctx->ecb = ecb; - actx->chan = DCP_CHAN_CRYPTO; - -- mutex_lock(&sdcp->mutex[actx->chan]); -+ spin_lock(&sdcp->lock[actx->chan]); - ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); -- mutex_unlock(&sdcp->mutex[actx->chan]); -+ spin_unlock(&sdcp->lock[actx->chan]); - - wake_up_process(sdcp->thread[actx->chan]); - -@@ -645,13 +649,20 @@ static int dcp_chan_thread_sha(void *data) - struct ahash_request *req; - int ret, fini; - -- do { -- __set_current_state(TASK_INTERRUPTIBLE); -+ while (!kthread_should_stop()) { -+ set_current_state(TASK_INTERRUPTIBLE); - -- mutex_lock(&sdcp->mutex[chan]); -+ spin_lock(&sdcp->lock[chan]); - backlog = crypto_get_backlog(&sdcp->queue[chan]); - arq = crypto_dequeue_request(&sdcp->queue[chan]); -- mutex_unlock(&sdcp->mutex[chan]); -+ spin_unlock(&sdcp->lock[chan]); -+ -+ if (!backlog && !arq) { -+ schedule(); -+ continue; -+ } -+ -+ set_current_state(TASK_RUNNING); - - if (backlog) - backlog->complete(backlog, -EINPROGRESS); -@@ -663,12 +674,8 @@ static int dcp_chan_thread_sha(void *data) - ret = dcp_sha_req_to_buf(arq); - fini = rctx->fini; - arq->complete(arq, ret); -- if (!fini) -- continue; - } -- -- schedule(); -- } while (!kthread_should_stop()); -+ } - - return 0; - } -@@ -726,9 +733,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini) - rctx->init = 1; - } - -- mutex_lock(&sdcp->mutex[actx->chan]); -+ spin_lock(&sdcp->lock[actx->chan]); - ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); -- mutex_unlock(&sdcp->mutex[actx->chan]); -+ spin_unlock(&sdcp->lock[actx->chan]); - - wake_up_process(sdcp->thread[actx->chan]); - mutex_unlock(&actx->mutex); -@@ -984,7 +991,7 @@ static int mxs_dcp_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, sdcp); - - for (i = 0; i < DCP_MAX_CHANS; i++) { -- mutex_init(&sdcp->mutex[i]); -+ spin_lock_init(&sdcp->lock[i]); - init_completion(&sdcp->completion[i]); - crypto_init_queue(&sdcp->queue[i], 50); - } -diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c -index 792bdae2b91d..d14c8ffea910 100644 ---- a/drivers/edac/i7core_edac.c -+++ b/drivers/edac/i7core_edac.c -@@ -1187,15 +1187,14 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) - - rc = device_add(pvt->addrmatch_dev); - if (rc < 0) -- return rc; -+ goto err_put_addrmatch; - - if (!pvt->is_registered) { - pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev), - GFP_KERNEL); - if (!pvt->chancounts_dev) { -- put_device(pvt->addrmatch_dev); -- device_del(pvt->addrmatch_dev); -- return -ENOMEM; -+ rc = -ENOMEM; -+ goto err_del_addrmatch; - } - - pvt->chancounts_dev->type = &all_channel_counts_type; -@@ -1209,9 +1208,18 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) - - rc = device_add(pvt->chancounts_dev); - if (rc < 0) -- return rc; -+ goto err_put_chancounts; - } - return 0; -+ -+err_put_chancounts: -+ put_device(pvt->chancounts_dev); -+err_del_addrmatch: -+ device_del(pvt->addrmatch_dev); -+err_put_addrmatch: -+ put_device(pvt->addrmatch_dev); -+ -+ return rc; - } - - static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) -@@ -1221,11 +1229,11 @@ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) - edac_dbg(1, "\n"); - - if (!pvt->is_registered) { -- put_device(pvt->chancounts_dev); - device_del(pvt->chancounts_dev); -+ put_device(pvt->chancounts_dev); - } -- put_device(pvt->addrmatch_dev); - device_del(pvt->addrmatch_dev); -+ put_device(pvt->addrmatch_dev); - } - - /**************************************************************************** -diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c -index 984186ee58a0..f5f7b5368da6 100644 ---- a/drivers/gpio/gpio-adp5588.c -+++ b/drivers/gpio/gpio-adp5588.c -@@ -41,6 +41,8 @@ struct adp5588_gpio { - uint8_t int_en[3]; - uint8_t irq_mask[3]; - uint8_t irq_stat[3]; -+ uint8_t int_input_en[3]; -+ uint8_t int_lvl_cached[3]; - }; - - static int adp5588_gpio_read(struct i2c_client *client, u8 reg) -@@ -177,12 +179,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d) - struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d); - int i; - -- for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) -+ for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) { -+ if (dev->int_input_en[i]) { -+ mutex_lock(&dev->lock); -+ dev->dir[i] &= ~dev->int_input_en[i]; -+ dev->int_input_en[i] = 0; -+ adp5588_gpio_write(dev->client, GPIO_DIR1 + i, -+ dev->dir[i]); -+ mutex_unlock(&dev->lock); -+ } -+ -+ if (dev->int_lvl_cached[i] != dev->int_lvl[i]) { -+ dev->int_lvl_cached[i] = dev->int_lvl[i]; -+ adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i, -+ dev->int_lvl[i]); -+ } -+ - if (dev->int_en[i] ^ dev->irq_mask[i]) { - dev->int_en[i] = dev->irq_mask[i]; - adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i, - dev->int_en[i]); - } -+ } - - mutex_unlock(&dev->irq_lock); - } -@@ -225,9 +243,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type) - else - return -EINVAL; - -- adp5588_gpio_direction_input(&dev->gpio_chip, gpio); -- adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank, -- dev->int_lvl[bank]); -+ dev->int_input_en[bank] |= bit; - - return 0; - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c -index 2b9c3f11b7a8..ba42ed86148a 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c -@@ -161,7 +161,8 @@ gm204_devinit_post(struct nvkm_devinit *base, bool post) - } - - /* load and execute some other ucode image (bios therm?) */ -- return pmu_load(init, 0x01, post, NULL, NULL); -+ pmu_load(init, 0x01, post, NULL, NULL); -+ return 0; - } - - static const struct nvkm_devinit_func -diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c -index 756d1ef9bd99..6124fd6e04d1 100644 ---- a/drivers/hid/hid-ntrig.c -+++ b/drivers/hid/hid-ntrig.c -@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id) - - ret = sysfs_create_group(&hdev->dev.kobj, - &ntrig_attribute_group); -+ if (ret) -+ hid_err(hdev, "cannot create sysfs group\n"); - - return 0; - err_free: -diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c -index 3cefd1aeb24f..9c262d955331 100644 ---- a/drivers/hwmon/adt7475.c -+++ b/drivers/hwmon/adt7475.c -@@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn) - return clamp_val(reg, 0, 1023) & (0xff << 2); - } - --static u16 adt7475_read_word(struct i2c_client *client, int reg) -+static int adt7475_read_word(struct i2c_client *client, int reg) - { -- u16 val; -+ int val1, val2; - -- val = i2c_smbus_read_byte_data(client, reg); -- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8); -+ val1 = i2c_smbus_read_byte_data(client, reg); -+ if (val1 < 0) -+ return val1; -+ val2 = i2c_smbus_read_byte_data(client, reg + 1); -+ if (val2 < 0) -+ return val2; - -- return val; -+ return val1 | (val2 << 8); - } - - static void adt7475_write_word(struct i2c_client *client, int reg, u16 val) -diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c -index ac63e562071f..9ac6e1673375 100644 ---- a/drivers/hwmon/ina2xx.c -+++ b/drivers/hwmon/ina2xx.c -@@ -17,7 +17,7 @@ - * Bi-directional Current/Power Monitor with I2C Interface - * Datasheet: http://www.ti.com/product/ina230 - * -- * Copyright (C) 2012 Lothar Felten -+ * Copyright (C) 2012 Lothar Felten - * Thanks to Jan Volkering - * - * This program is free software; you can redistribute it and/or modify -@@ -328,6 +328,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val) - return 0; - } - -+static ssize_t ina2xx_show_shunt(struct device *dev, -+ struct device_attribute *da, -+ char *buf) -+{ -+ struct ina2xx_data *data = dev_get_drvdata(dev); -+ -+ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt); -+} -+ - static ssize_t ina2xx_store_shunt(struct device *dev, - struct device_attribute *da, - const char *buf, size_t count) -@@ -402,7 +411,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, - - /* shunt resistance */ - static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, -- ina2xx_show_value, ina2xx_store_shunt, -+ ina2xx_show_shunt, ina2xx_store_shunt, - INA2XX_CALIBRATION); - - /* update interval (ina226 only) */ -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index 47581c32b1e1..f78069cd8d53 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -1272,6 +1272,13 @@ static void i801_add_tco(struct i801_priv *priv) - } - - #ifdef CONFIG_ACPI -+static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv, -+ acpi_physical_address address) -+{ -+ return address >= priv->smba && -+ address <= pci_resource_end(priv->pci_dev, SMBBAR); -+} -+ - static acpi_status - i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, - u64 *value, void *handler_context, void *region_context) -@@ -1287,7 +1294,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, - */ - mutex_lock(&priv->acpi_lock); - -- if (!priv->acpi_reserved) { -+ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) { - priv->acpi_reserved = true; - - dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n"); -diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c -index e8d03bcfe3e0..3f6b43fe4d5d 100644 ---- a/drivers/i2c/busses/i2c-uniphier-f.c -+++ b/drivers/i2c/busses/i2c-uniphier-f.c -@@ -394,11 +394,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap, - return ret; - - for (msg = msgs; msg < emsg; msg++) { -- /* If next message is read, skip the stop condition */ -- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); -- /* but, force it if I2C_M_STOP is set */ -- if (msg->flags & I2C_M_STOP) -- stop = true; -+ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ -+ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); - - ret = uniphier_fi2c_master_xfer_one(adap, msg, stop); - if (ret) -diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c -index e3c3861c3325..ad5eb8bacc6d 100644 ---- a/drivers/i2c/busses/i2c-uniphier.c -+++ b/drivers/i2c/busses/i2c-uniphier.c -@@ -247,11 +247,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap, - return ret; - - for (msg = msgs; msg < emsg; msg++) { -- /* If next message is read, skip the stop condition */ -- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); -- /* but, force it if I2C_M_STOP is set */ -- if (msg->flags & I2C_M_STOP) -- stop = true; -+ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ -+ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); - - ret = uniphier_i2c_master_xfer_one(adap, msg, stop); - if (ret) -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 55aa8d3d752f..9712a63957e1 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -123,6 +123,8 @@ static DEFINE_MUTEX(mut); - static DEFINE_IDR(ctx_idr); - static DEFINE_IDR(multicast_idr); - -+static const struct file_operations ucma_fops; -+ - static inline struct ucma_context *_ucma_find_context(int id, - struct ucma_file *file) - { -@@ -1535,6 +1537,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, - f = fdget(cmd.fd); - if (!f.file) - return -ENOENT; -+ if (f.file->f_op != &ucma_fops) { -+ ret = -EINVAL; -+ goto file_put; -+ } - - /* Validate current fd and prevent destruction of id. */ - ctx = ucma_get_ctx(f.file->private_data, cmd.id); -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 4fd2892613dd..1897c4080346 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -2594,7 +2594,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) - { - struct srp_target_port *target = host_to_target(scmnd->device->host); - struct srp_rdma_ch *ch; -- int i; -+ int i, j; - u8 status; - - shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); -@@ -2608,8 +2608,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) - - for (i = 0; i < target->ch_count; i++) { - ch = &target->ch[i]; -- for (i = 0; i < target->req_ring_size; ++i) { -- struct srp_request *req = &ch->req_ring[i]; -+ for (j = 0; j < target->req_ring_size; ++j) { -+ struct srp_request *req = &ch->req_ring[j]; - - srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); - } -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 174bb52c578b..84aead19622c 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1180,6 +1180,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = { - static const char * const middle_button_pnp_ids[] = { - "LEN2131", /* ThinkPad P52 w/ NFC */ - "LEN2132", /* ThinkPad P52 */ -+ "LEN2133", /* ThinkPad P72 w/ NFC */ -+ "LEN2134", /* ThinkPad P72 */ - NULL - }; - -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index e339f4288e8f..2711aa965445 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -189,6 +189,12 @@ struct dm_pool_metadata { - unsigned long flags; - sector_t data_block_size; - -+ /* -+ * We reserve a section of the metadata for commit overhead. -+ * All reported space does *not* include this. -+ */ -+ dm_block_t metadata_reserve; -+ - /* - * Set if a transaction has to be aborted but the attempt to roll back - * to the previous (good) transaction failed. The only pool metadata -@@ -827,6 +833,20 @@ static int __commit_transaction(struct dm_pool_metadata *pmd) - return dm_tm_commit(pmd->tm, sblock); - } - -+static void __set_metadata_reserve(struct dm_pool_metadata *pmd) -+{ -+ int r; -+ dm_block_t total; -+ dm_block_t max_blocks = 4096; /* 16M */ -+ -+ r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total); -+ if (r) { -+ DMERR("could not get size of metadata device"); -+ pmd->metadata_reserve = max_blocks; -+ } else -+ pmd->metadata_reserve = min(max_blocks, div_u64(total, 10)); -+} -+ - struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, - sector_t data_block_size, - bool format_device) -@@ -860,6 +880,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, - return ERR_PTR(r); - } - -+ __set_metadata_reserve(pmd); -+ - return pmd; - } - -@@ -1763,6 +1785,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd, - down_read(&pmd->root_lock); - if (!pmd->fail_io) - r = dm_sm_get_nr_free(pmd->metadata_sm, result); -+ -+ if (!r) { -+ if (*result < pmd->metadata_reserve) -+ *result = 0; -+ else -+ *result -= pmd->metadata_reserve; -+ } - up_read(&pmd->root_lock); - - return r; -@@ -1875,8 +1904,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou - int r = -EINVAL; - - down_write(&pmd->root_lock); -- if (!pmd->fail_io) -+ if (!pmd->fail_io) { - r = __resize_space_map(pmd->metadata_sm, new_count); -+ if (!r) -+ __set_metadata_reserve(pmd); -+ } - up_write(&pmd->root_lock); - - return r; -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index 315767e8ae4d..bc4e6825ff62 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -200,7 +200,13 @@ struct dm_thin_new_mapping; - enum pool_mode { - PM_WRITE, /* metadata may be changed */ - PM_OUT_OF_DATA_SPACE, /* metadata may be changed, though data may not be allocated */ -+ -+ /* -+ * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY. -+ */ -+ PM_OUT_OF_METADATA_SPACE, - PM_READ_ONLY, /* metadata may not be changed */ -+ - PM_FAIL, /* all I/O fails */ - }; - -@@ -1301,7 +1307,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); - - static void requeue_bios(struct pool *pool); - --static void check_for_space(struct pool *pool) -+static bool is_read_only_pool_mode(enum pool_mode mode) -+{ -+ return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY); -+} -+ -+static bool is_read_only(struct pool *pool) -+{ -+ return is_read_only_pool_mode(get_pool_mode(pool)); -+} -+ -+static void check_for_metadata_space(struct pool *pool) -+{ -+ int r; -+ const char *ooms_reason = NULL; -+ dm_block_t nr_free; -+ -+ r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free); -+ if (r) -+ ooms_reason = "Could not get free metadata blocks"; -+ else if (!nr_free) -+ ooms_reason = "No free metadata blocks"; -+ -+ if (ooms_reason && !is_read_only(pool)) { -+ DMERR("%s", ooms_reason); -+ set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE); -+ } -+} -+ -+static void check_for_data_space(struct pool *pool) - { - int r; - dm_block_t nr_free; -@@ -1327,14 +1361,16 @@ static int commit(struct pool *pool) - { - int r; - -- if (get_pool_mode(pool) >= PM_READ_ONLY) -+ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) - return -EINVAL; - - r = dm_pool_commit_metadata(pool->pmd); - if (r) - metadata_operation_failed(pool, "dm_pool_commit_metadata", r); -- else -- check_for_space(pool); -+ else { -+ check_for_metadata_space(pool); -+ check_for_data_space(pool); -+ } - - return r; - } -@@ -1400,6 +1436,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result) - return r; - } - -+ r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks); -+ if (r) { -+ metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r); -+ return r; -+ } -+ -+ if (!free_blocks) { -+ /* Let's commit before we use up the metadata reserve. */ -+ r = commit(pool); -+ if (r) -+ return r; -+ } -+ - return 0; - } - -@@ -1431,6 +1480,7 @@ static int should_error_unserviceable_bio(struct pool *pool) - case PM_OUT_OF_DATA_SPACE: - return pool->pf.error_if_no_space ? -ENOSPC : 0; - -+ case PM_OUT_OF_METADATA_SPACE: - case PM_READ_ONLY: - case PM_FAIL: - return -EIO; -@@ -2401,8 +2451,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) - error_retry_list(pool); - break; - -+ case PM_OUT_OF_METADATA_SPACE: - case PM_READ_ONLY: -- if (old_mode != new_mode) -+ if (!is_read_only_pool_mode(old_mode)) - notify_of_pool_mode_change(pool, "read-only"); - dm_pool_metadata_read_only(pool->pmd); - pool->process_bio = process_bio_read_only; -@@ -3333,6 +3384,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit) - DMINFO("%s: growing the metadata device from %llu to %llu blocks", - dm_device_name(pool->pool_md), - sb_metadata_dev_size, metadata_dev_size); -+ -+ if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE) -+ set_pool_mode(pool, PM_WRITE); -+ - r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size); - if (r) { - metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r); -@@ -3636,7 +3691,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv) - struct pool_c *pt = ti->private; - struct pool *pool = pt->pool; - -- if (get_pool_mode(pool) >= PM_READ_ONLY) { -+ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) { - DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode", - dm_device_name(pool->pool_md)); - return -EOPNOTSUPP; -@@ -3710,6 +3765,7 @@ static void pool_status(struct dm_target *ti, status_type_t type, - dm_block_t nr_blocks_data; - dm_block_t nr_blocks_metadata; - dm_block_t held_root; -+ enum pool_mode mode; - char buf[BDEVNAME_SIZE]; - char buf2[BDEVNAME_SIZE]; - struct pool_c *pt = ti->private; -@@ -3780,9 +3836,10 @@ static void pool_status(struct dm_target *ti, status_type_t type, - else - DMEMIT("- "); - -- if (pool->pf.mode == PM_OUT_OF_DATA_SPACE) -+ mode = get_pool_mode(pool); -+ if (mode == PM_OUT_OF_DATA_SPACE) - DMEMIT("out_of_data_space "); -- else if (pool->pf.mode == PM_READ_ONLY) -+ else if (is_read_only_pool_mode(mode)) - DMEMIT("ro "); - else - DMEMIT("rw "); -diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c -index a7a561af05c9..617a0aefc1c4 100644 ---- a/drivers/md/md-cluster.c -+++ b/drivers/md/md-cluster.c -@@ -239,15 +239,6 @@ static void recover_bitmaps(struct md_thread *thread) - while (cinfo->recovery_map) { - slot = fls64((u64)cinfo->recovery_map) - 1; - -- /* Clear suspend_area associated with the bitmap */ -- spin_lock_irq(&cinfo->suspend_lock); -- list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) -- if (slot == s->slot) { -- list_del(&s->list); -- kfree(s); -- } -- spin_unlock_irq(&cinfo->suspend_lock); -- - snprintf(str, 64, "bitmap%04d", slot); - bm_lockres = lockres_init(mddev, str, NULL, 1); - if (!bm_lockres) { -@@ -266,6 +257,16 @@ static void recover_bitmaps(struct md_thread *thread) - pr_err("md-cluster: Could not copy data from bitmap %d\n", slot); - goto dlm_unlock; - } -+ -+ /* Clear suspend_area associated with the bitmap */ -+ spin_lock_irq(&cinfo->suspend_lock); -+ list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) -+ if (slot == s->slot) { -+ list_del(&s->list); -+ kfree(s); -+ } -+ spin_unlock_irq(&cinfo->suspend_lock); -+ - if (hi > 0) { - /* TODO:Wait for current resync to get over */ - set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 8a731bdd268e..89111d455b71 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -4336,11 +4336,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, - allow_barrier(conf); - } - -+ raise_barrier(conf, 0); - read_more: - /* Now schedule reads for blocks from sector_nr to last */ - r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO); - r10_bio->state = 0; -- raise_barrier(conf, sectors_done != 0); -+ raise_barrier(conf, 1); - atomic_set(&r10_bio->remaining, 0); - r10_bio->mddev = mddev; - r10_bio->sector = sector_nr; -@@ -4445,6 +4446,8 @@ bio_full: - if (sector_nr <= last) - goto read_more; - -+ lower_barrier(conf); -+ - /* Now that we have done the whole section we can - * update reshape_progress - */ -diff --git a/drivers/media/i2c/soc_camera/ov772x.c b/drivers/media/i2c/soc_camera/ov772x.c -index f150a8bd94dc..70f1a80d4e39 100644 ---- a/drivers/media/i2c/soc_camera/ov772x.c -+++ b/drivers/media/i2c/soc_camera/ov772x.c -@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov772x_priv *priv, - * set COM8 - */ - if (priv->band_filter) { -- ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1); -+ ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF); - if (!ret) - ret = ov772x_mask_set(client, BDBASE, - 0xff, 256 - priv->band_filter); -diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c -index 6e6648446f00..667d3720154a 100644 ---- a/drivers/media/platform/exynos4-is/fimc-isp-video.c -+++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c -@@ -391,12 +391,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp, - struct v4l2_pix_format_mplane *pixm, - const struct fimc_fmt **fmt) - { -- *fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); -+ const struct fimc_fmt *__fmt; -+ -+ __fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); -+ -+ if (fmt) -+ *fmt = __fmt; - - pixm->colorspace = V4L2_COLORSPACE_SRGB; - pixm->field = V4L2_FIELD_NONE; -- pixm->num_planes = (*fmt)->memplanes; -- pixm->pixelformat = (*fmt)->fourcc; -+ pixm->num_planes = __fmt->memplanes; -+ pixm->pixelformat = __fmt->fourcc; - /* - * TODO: double check with the docmentation these width/height - * constraints are correct. -diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c -index ae8c6b35a357..7f0ed5a26da9 100644 ---- a/drivers/media/platform/fsl-viu.c -+++ b/drivers/media/platform/fsl-viu.c -@@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op) - sizeof(struct viu_reg), DRV_NAME)) { - dev_err(&op->dev, "Error while requesting mem region\n"); - ret = -EBUSY; -- goto err; -+ goto err_irq; - } - - /* remap registers */ -@@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op) - if (!viu_regs) { - dev_err(&op->dev, "Can't map register set\n"); - ret = -ENOMEM; -- goto err; -+ goto err_irq; - } - - /* Prepare our private structure */ -@@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op) - if (!viu_dev) { - dev_err(&op->dev, "Can't allocate private structure\n"); - ret = -ENOMEM; -- goto err; -+ goto err_irq; - } - - viu_dev->vr = viu_regs; -@@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op) - ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev); - if (ret < 0) { - dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret); -- goto err; -+ goto err_irq; - } - - ad = i2c_get_adapter(0); -+ if (!ad) { -+ ret = -EFAULT; -+ dev_err(&op->dev, "couldn't get i2c adapter\n"); -+ goto err_v4l2; -+ } - - v4l2_ctrl_handler_init(&viu_dev->hdl, 5); - if (viu_dev->hdl.error) { - ret = viu_dev->hdl.error; - dev_err(&op->dev, "couldn't register control\n"); -- goto err_vdev; -+ goto err_i2c; - } - /* This control handler will inherit the control(s) from the - sub-device(s). */ -@@ -1476,7 +1481,7 @@ static int viu_of_probe(struct platform_device *op) - vdev = video_device_alloc(); - if (vdev == NULL) { - ret = -ENOMEM; -- goto err_vdev; -+ goto err_hdl; - } - - *vdev = viu_template; -@@ -1497,7 +1502,7 @@ static int viu_of_probe(struct platform_device *op) - ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1); - if (ret < 0) { - video_device_release(viu_dev->vdev); -- goto err_vdev; -+ goto err_unlock; - } - - /* enable VIU clock */ -@@ -1505,12 +1510,12 @@ static int viu_of_probe(struct platform_device *op) - if (IS_ERR(clk)) { - dev_err(&op->dev, "failed to lookup the clock!\n"); - ret = PTR_ERR(clk); -- goto err_clk; -+ goto err_vdev; - } - ret = clk_prepare_enable(clk); - if (ret) { - dev_err(&op->dev, "failed to enable the clock!\n"); -- goto err_clk; -+ goto err_vdev; - } - viu_dev->clk = clk; - -@@ -1521,7 +1526,7 @@ static int viu_of_probe(struct platform_device *op) - if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) { - dev_err(&op->dev, "Request VIU IRQ failed.\n"); - ret = -ENODEV; -- goto err_irq; -+ goto err_clk; - } - - mutex_unlock(&viu_dev->lock); -@@ -1529,16 +1534,19 @@ static int viu_of_probe(struct platform_device *op) - dev_info(&op->dev, "Freescale VIU Video Capture Board\n"); - return ret; - --err_irq: -- clk_disable_unprepare(viu_dev->clk); - err_clk: -- video_unregister_device(viu_dev->vdev); -+ clk_disable_unprepare(viu_dev->clk); - err_vdev: -- v4l2_ctrl_handler_free(&viu_dev->hdl); -+ video_unregister_device(viu_dev->vdev); -+err_unlock: - mutex_unlock(&viu_dev->lock); -+err_hdl: -+ v4l2_ctrl_handler_free(&viu_dev->hdl); -+err_i2c: - i2c_put_adapter(ad); -+err_v4l2: - v4l2_device_unregister(&viu_dev->v4l2_dev); --err: -+err_irq: - irq_dispose_mapping(viu_irq); - return ret; - } -diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c -index 91e02c1ff392..136ea1848701 100644 ---- a/drivers/media/platform/omap3isp/isp.c -+++ b/drivers/media/platform/omap3isp/isp.c -@@ -303,7 +303,7 @@ static struct clk *isp_xclk_src_get(struct of_phandle_args *clkspec, void *data) - static int isp_xclk_init(struct isp_device *isp) - { - struct device_node *np = isp->dev->of_node; -- struct clk_init_data init; -+ struct clk_init_data init = { 0 }; - unsigned int i; - - for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i) -diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c -index fa6af4a7dae1..f97f4bc22ced 100644 ---- a/drivers/media/platform/s3c-camif/camif-capture.c -+++ b/drivers/media/platform/s3c-camif/camif-capture.c -@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif_dev *camif, int on) - - if (camif->sensor.power_count == !on) - err = v4l2_subdev_call(sensor->sd, core, s_power, on); -+ if (err == -ENOIOCTLCMD) -+ err = 0; - if (!err) - sensor->power_count += on ? 1 : -1; - -diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c -index 095f5db1a790..4f317e2686e9 100644 ---- a/drivers/media/usb/tm6000/tm6000-dvb.c -+++ b/drivers/media/usb/tm6000/tm6000-dvb.c -@@ -275,6 +275,11 @@ static int register_dvb(struct tm6000_core *dev) - - ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T", - THIS_MODULE, &dev->udev->dev, adapter_nr); -+ if (ret < 0) { -+ pr_err("tm6000: couldn't register the adapter!\n"); -+ goto err; -+ } -+ - dvb->adapter.priv = dev; - - if (dvb->frontend) { -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index 2b276ab7764f..a4048a04d236 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, - } - } - -+static size_t uvc_video_ctrl_size(struct uvc_streaming *stream) -+{ -+ /* -+ * Return the size of the video probe and commit controls, which depends -+ * on the protocol version. -+ */ -+ if (stream->dev->uvc_version < 0x0110) -+ return 26; -+ else if (stream->dev->uvc_version < 0x0150) -+ return 34; -+ else -+ return 48; -+} -+ - static int uvc_get_video_ctrl(struct uvc_streaming *stream, - struct uvc_streaming_control *ctrl, int probe, __u8 query) - { -+ __u16 size = uvc_video_ctrl_size(stream); - __u8 *data; -- __u16 size; - int ret; - -- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; - if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) && - query == UVC_GET_DEF) - return -EIO; -@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream, - ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]); - ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]); - -- if (size == 34) { -+ if (size >= 34) { - ctrl->dwClockFrequency = get_unaligned_le32(&data[26]); - ctrl->bmFramingInfo = data[30]; - ctrl->bPreferedVersion = data[31]; -@@ -254,11 +267,10 @@ out: - static int uvc_set_video_ctrl(struct uvc_streaming *stream, - struct uvc_streaming_control *ctrl, int probe) - { -+ __u16 size = uvc_video_ctrl_size(stream); - __u8 *data; -- __u16 size; - int ret; - -- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; - data = kzalloc(size, GFP_KERNEL); - if (data == NULL) - return -ENOMEM; -@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream, - put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]); - put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]); - -- if (size == 34) { -+ if (size >= 34) { - put_unaligned_le32(ctrl->dwClockFrequency, &data[26]); - data[30] = ctrl->bmFramingInfo; - data[31] = ctrl->bPreferedVersion; -diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c -index 8d3171c6bee8..b47ac4e053d0 100644 ---- a/drivers/media/v4l2-core/v4l2-event.c -+++ b/drivers/media/v4l2-core/v4l2-event.c -@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e - if (sev == NULL) - return; - -- /* -- * If the event has been added to the fh->subscribed list, but its -- * add op has not completed yet elems will be 0, treat this as -- * not being subscribed. -- */ -- if (!sev->elems) -- return; -- - /* Increase event sequence number on fh. */ - fh->sequence++; - -@@ -212,6 +204,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, - struct v4l2_subscribed_event *sev, *found_ev; - unsigned long flags; - unsigned i; -+ int ret = 0; - - if (sub->type == V4L2_EVENT_ALL) - return -EINVAL; -@@ -229,31 +222,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, - sev->flags = sub->flags; - sev->fh = fh; - sev->ops = ops; -+ sev->elems = elems; -+ -+ mutex_lock(&fh->subscribe_lock); - - spin_lock_irqsave(&fh->vdev->fh_lock, flags); - found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); -- if (!found_ev) -- list_add(&sev->list, &fh->subscribed); - spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); - - if (found_ev) { -+ /* Already listening */ - kfree(sev); -- return 0; /* Already listening */ -+ goto out_unlock; - } - - if (sev->ops && sev->ops->add) { -- int ret = sev->ops->add(sev, elems); -+ ret = sev->ops->add(sev, elems); - if (ret) { -- sev->ops = NULL; -- v4l2_event_unsubscribe(fh, sub); -- return ret; -+ kfree(sev); -+ goto out_unlock; - } - } - -- /* Mark as ready for use */ -- sev->elems = elems; -+ spin_lock_irqsave(&fh->vdev->fh_lock, flags); -+ list_add(&sev->list, &fh->subscribed); -+ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); - -- return 0; -+out_unlock: -+ mutex_unlock(&fh->subscribe_lock); -+ -+ return ret; - } - EXPORT_SYMBOL_GPL(v4l2_event_subscribe); - -@@ -292,6 +290,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, - return 0; - } - -+ mutex_lock(&fh->subscribe_lock); -+ - spin_lock_irqsave(&fh->vdev->fh_lock, flags); - - sev = v4l2_event_subscribed(fh, sub->type, sub->id); -@@ -310,6 +310,7 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, - sev->ops->del(sev); - - kfree(sev); -+ mutex_unlock(&fh->subscribe_lock); - - return 0; - } -diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c -index c97067a25bd2..1d076deb05a9 100644 ---- a/drivers/media/v4l2-core/v4l2-fh.c -+++ b/drivers/media/v4l2-core/v4l2-fh.c -@@ -49,6 +49,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev) - INIT_LIST_HEAD(&fh->available); - INIT_LIST_HEAD(&fh->subscribed); - fh->sequence = -1; -+ mutex_init(&fh->subscribe_lock); - } - EXPORT_SYMBOL_GPL(v4l2_fh_init); - -@@ -93,6 +94,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh) - if (fh->vdev == NULL) - return; - v4l2_event_unsubscribe_all(fh); -+ mutex_destroy(&fh->subscribe_lock); - fh->vdev = NULL; - } - EXPORT_SYMBOL_GPL(v4l2_fh_exit); -diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c -index 87a13374fdc0..eb5761067310 100644 ---- a/drivers/misc/tsl2550.c -+++ b/drivers/misc/tsl2550.c -@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1) - } else - lux = 0; - else -- return -EAGAIN; -+ return 0; - - /* LUX range check */ - return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux; -diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c -index cc277f7849b0..3877f534fd3f 100644 ---- a/drivers/misc/vmw_vmci/vmci_queue_pair.c -+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c -@@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva, - retval = get_user_pages_fast((uintptr_t) produce_uva, - produce_q->kernel_if->num_pages, 1, - produce_q->kernel_if->u.h.header_page); -- if (retval < produce_q->kernel_if->num_pages) { -+ if (retval < (int)produce_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(produce) failed (retval=%d)", - retval); - qp_release_pages(produce_q->kernel_if->u.h.header_page, -@@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva, - retval = get_user_pages_fast((uintptr_t) consume_uva, - consume_q->kernel_if->num_pages, 1, - consume_q->kernel_if->u.h.header_page); -- if (retval < consume_q->kernel_if->num_pages) { -+ if (retval < (int)consume_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(consume) failed (retval=%d)", - retval); - qp_release_pages(consume_q->kernel_if->u.h.header_page, -diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c -index 8d54e7b41bbf..8c698d464716 100644 ---- a/drivers/net/ethernet/cadence/macb.c -+++ b/drivers/net/ethernet/cadence/macb.c -@@ -523,7 +523,7 @@ static int macb_halt_tx(struct macb *bp) - if (!(status & MACB_BIT(TGO))) - return 0; - -- usleep_range(10, 250); -+ udelay(250); - } while (time_before(halt_time, timeout)); - - return -ETIMEDOUT; -diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h -index cec95ac8687d..fe37fc7ec76e 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hnae.h -+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h -@@ -171,10 +171,10 @@ struct hnae_desc_cb { - - /* priv data for the desc, e.g. skb when use with ip stack*/ - void *priv; -- u16 page_offset; -- u16 reuse_flag; -+ u32 page_offset; -+ u32 length; /* length of the buffer */ - -- u16 length; /* length of the buffer */ -+ u16 reuse_flag; - - /* desc type, used by the ring user to mark the type of the priv data */ - u16 type; -diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -index 83e557c7f279..5ae8874bbf72 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -@@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev, - adapter->tx_ring = tx_old; - e1000_free_all_rx_resources(adapter); - e1000_free_all_tx_resources(adapter); -- kfree(tx_old); -- kfree(rx_old); - adapter->rx_ring = rxdr; - adapter->tx_ring = txdr; - err = e1000_up(adapter); - if (err) - goto err_setup; - } -+ kfree(tx_old); -+ kfree(rx_old); - - clear_bit(__E1000_RESETTING, &adapter->flags); - return 0; -@@ -665,7 +665,8 @@ err_setup_rx: - err_alloc_rx: - kfree(txdr); - err_alloc_tx: -- e1000_up(adapter); -+ if (netif_running(adapter->netdev)) -+ e1000_up(adapter); - err_setup: - clear_bit(__E1000_RESETTING, &adapter->flags); - return err; -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 8b4069ea52ce..c6782ebd35e1 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -759,7 +759,7 @@ struct rtl8169_tc_offsets { - }; - - enum rtl_flag { -- RTL_FLAG_TASK_ENABLED, -+ RTL_FLAG_TASK_ENABLED = 0, - RTL_FLAG_TASK_SLOW_PENDING, - RTL_FLAG_TASK_RESET_PENDING, - RTL_FLAG_TASK_PHY_PENDING, -@@ -7618,7 +7618,8 @@ static int rtl8169_close(struct net_device *dev) - rtl8169_update_counters(dev); - - rtl_lock_work(tp); -- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); -+ /* Clear all task flags */ -+ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); - - rtl8169_down(dev); - rtl_unlock_work(tp); -@@ -7795,7 +7796,9 @@ static void rtl8169_net_suspend(struct net_device *dev) - - rtl_lock_work(tp); - napi_disable(&tp->napi); -- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); -+ /* Clear all task flags */ -+ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); -+ - rtl_unlock_work(tp); - - rtl_pll_power_down(tp); -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index b32c47fe926d..a65b5d7f59f4 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -212,11 +212,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar) - spin_lock_bh(&htt->rx_ring.lock); - ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level - - htt->rx_ring.fill_cnt)); -- spin_unlock_bh(&htt->rx_ring.lock); - - if (ret) - ath10k_htt_rx_ring_free(htt); - -+ spin_unlock_bh(&htt->rx_ring.lock); -+ - return ret; - } - -@@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt) - skb_queue_purge(&htt->rx_compl_q); - skb_queue_purge(&htt->rx_in_ord_compl_q); - -+ spin_lock_bh(&htt->rx_ring.lock); - ath10k_htt_rx_ring_free(htt); -+ spin_unlock_bh(&htt->rx_ring.lock); - - dma_free_coherent(htt->ar->dev, - (htt->rx_ring.size * -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index e8b770a95f7a..c98cb962b454 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2453,9 +2453,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, - IEEE80211_VHT_CAP_SHORT_GI_80 | - IEEE80211_VHT_CAP_SHORT_GI_160 | - IEEE80211_VHT_CAP_TXSTBC | -- IEEE80211_VHT_CAP_RXSTBC_1 | -- IEEE80211_VHT_CAP_RXSTBC_2 | -- IEEE80211_VHT_CAP_RXSTBC_3 | - IEEE80211_VHT_CAP_RXSTBC_4 | - IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK; - sband->vht_cap.vht_mcs.rx_mcs_map = -diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c -index 259590013382..c76e0cfbb8b4 100644 ---- a/drivers/net/wireless/rndis_wlan.c -+++ b/drivers/net/wireless/rndis_wlan.c -@@ -2919,6 +2919,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev, - - while (buflen >= sizeof(*auth_req)) { - auth_req = (void *)buf; -+ if (buflen < le32_to_cpu(auth_req->length)) -+ return; - type = "unknown"; - flags = le32_to_cpu(auth_req->flags); - pairwise_error = false; -diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c -index f01d24baff7c..15dc7a398b90 100644 ---- a/drivers/net/wireless/ti/wlcore/cmd.c -+++ b/drivers/net/wireless/ti/wlcore/cmd.c -@@ -35,6 +35,7 @@ - #include "wl12xx_80211.h" - #include "cmd.h" - #include "event.h" -+#include "ps.h" - #include "tx.h" - #include "hw_ops.h" - -@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, - - timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT); - -+ ret = wl1271_ps_elp_wakeup(wl); -+ if (ret < 0) -+ return ret; -+ - do { - if (time_after(jiffies, timeout_time)) { - wl1271_debug(DEBUG_CMD, "timeout waiting for event %d", -@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, - } while (!event); - - out: -+ wl1271_ps_elp_sleep(wl); - kfree(events_vector); - return ret; - } -diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c -index 6a9bf7089373..ccb619632e46 100644 ---- a/drivers/power/reset/vexpress-poweroff.c -+++ b/drivers/power/reset/vexpress-poweroff.c -@@ -35,6 +35,7 @@ static void vexpress_reset_do(struct device *dev, const char *what) - } - - static struct device *vexpress_power_off_device; -+static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0); - - static void vexpress_power_off(void) - { -@@ -99,10 +100,13 @@ static int _vexpress_register_restart_handler(struct device *dev) - int err; - - vexpress_restart_device = dev; -- err = register_restart_handler(&vexpress_restart_nb); -- if (err) { -- dev_err(dev, "cannot register restart handler (err=%d)\n", err); -- return err; -+ if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) { -+ err = register_restart_handler(&vexpress_restart_nb); -+ if (err) { -+ dev_err(dev, "cannot register restart handler (err=%d)\n", err); -+ atomic_dec(&vexpress_restart_nb_refcnt); -+ return err; -+ } - } - device_create_file(dev, &dev_attr_active); - -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index acdb5ccb0ab9..34d3b7aff513 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -523,7 +523,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card, - default: - dev_kfree_skb_any(skb); - QETH_CARD_TEXT(card, 3, "inbunkno"); -- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); -+ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); - continue; - } - work_done++; -diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c -index bbdb3b6c54bb..2cc9bc1ef1e3 100644 ---- a/drivers/s390/net/qeth_l3_main.c -+++ b/drivers/s390/net/qeth_l3_main.c -@@ -1902,7 +1902,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card, - default: - dev_kfree_skb_any(skb); - QETH_CARD_TEXT(card, 3, "inbunkno"); -- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); -+ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); - continue; - } - work_done++; -diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c -index fb072cc5e9fd..dada9ce4e702 100644 ---- a/drivers/scsi/bnx2i/bnx2i_hwi.c -+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c -@@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep) - BNX2X_DOORBELL_PCI_BAR); - reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF); - ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4); -+ if (!ep->qp.ctx_base) -+ return -ENOMEM; - goto arm_cq; - } - -diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c -index adfef9db6f1e..e26747a1b35a 100644 ---- a/drivers/scsi/ibmvscsi/ibmvscsi.c -+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c -@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT; - static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2; - static int fast_fail = 1; - static int client_reserve = 1; --static char partition_name[97] = "UNKNOWN"; -+static char partition_name[96] = "UNKNOWN"; - static unsigned int partition_number = -1; - - static struct scsi_transport_template *ibmvscsi_transport_template; -@@ -261,7 +261,7 @@ static void gather_partition_info(void) - - ppartition_name = of_get_property(rootdn, "ibm,partition-name", NULL); - if (ppartition_name) -- strncpy(partition_name, ppartition_name, -+ strlcpy(partition_name, ppartition_name, - sizeof(partition_name)); - p_number_ptr = of_get_property(rootdn, "ibm,partition-no", NULL); - if (p_number_ptr) -diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c -index 818843336932..9882d93e7566 100644 ---- a/drivers/spi/spi-rspi.c -+++ b/drivers/spi/spi-rspi.c -@@ -587,11 +587,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx, - - ret = wait_event_interruptible_timeout(rspi->wait, - rspi->dma_callbacked, HZ); -- if (ret > 0 && rspi->dma_callbacked) -+ if (ret > 0 && rspi->dma_callbacked) { - ret = 0; -- else if (!ret) { -- dev_err(&rspi->master->dev, "DMA timeout\n"); -- ret = -ETIMEDOUT; -+ } else { -+ if (!ret) { -+ dev_err(&rspi->master->dev, "DMA timeout\n"); -+ ret = -ETIMEDOUT; -+ } - if (tx) - dmaengine_terminate_all(rspi->master->dma_tx); - if (rx) -@@ -1303,12 +1305,36 @@ static const struct platform_device_id spi_driver_ids[] = { - - MODULE_DEVICE_TABLE(platform, spi_driver_ids); - -+#ifdef CONFIG_PM_SLEEP -+static int rspi_suspend(struct device *dev) -+{ -+ struct platform_device *pdev = to_platform_device(dev); -+ struct rspi_data *rspi = platform_get_drvdata(pdev); -+ -+ return spi_master_suspend(rspi->master); -+} -+ -+static int rspi_resume(struct device *dev) -+{ -+ struct platform_device *pdev = to_platform_device(dev); -+ struct rspi_data *rspi = platform_get_drvdata(pdev); -+ -+ return spi_master_resume(rspi->master); -+} -+ -+static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume); -+#define DEV_PM_OPS &rspi_pm_ops -+#else -+#define DEV_PM_OPS NULL -+#endif /* CONFIG_PM_SLEEP */ -+ - static struct platform_driver rspi_driver = { - .probe = rspi_probe, - .remove = rspi_remove, - .id_table = spi_driver_ids, - .driver = { - .name = "renesas_spi", -+ .pm = DEV_PM_OPS, - .of_match_table = of_match_ptr(rspi_of_match), - }, - }; -diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c -index 3de39bd794b6..03b566848da6 100644 ---- a/drivers/spi/spi-sh-msiof.c -+++ b/drivers/spi/spi-sh-msiof.c -@@ -374,7 +374,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p, - - static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p) - { -- sh_msiof_write(p, STR, sh_msiof_read(p, STR)); -+ sh_msiof_write(p, STR, -+ sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ)); - } - - static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p, -@@ -1275,12 +1276,37 @@ static const struct platform_device_id spi_driver_ids[] = { - }; - MODULE_DEVICE_TABLE(platform, spi_driver_ids); - -+#ifdef CONFIG_PM_SLEEP -+static int sh_msiof_spi_suspend(struct device *dev) -+{ -+ struct platform_device *pdev = to_platform_device(dev); -+ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); -+ -+ return spi_master_suspend(p->master); -+} -+ -+static int sh_msiof_spi_resume(struct device *dev) -+{ -+ struct platform_device *pdev = to_platform_device(dev); -+ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); -+ -+ return spi_master_resume(p->master); -+} -+ -+static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend, -+ sh_msiof_spi_resume); -+#define DEV_PM_OPS &sh_msiof_spi_pm_ops -+#else -+#define DEV_PM_OPS NULL -+#endif /* CONFIG_PM_SLEEP */ -+ - static struct platform_driver sh_msiof_spi_drv = { - .probe = sh_msiof_spi_probe, - .remove = sh_msiof_spi_remove, - .id_table = spi_driver_ids, - .driver = { - .name = "spi_sh_msiof", -+ .pm = DEV_PM_OPS, - .of_match_table = of_match_ptr(sh_msiof_match), - }, - }; -diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c -index 85c91f58b42f..af2880d0c112 100644 ---- a/drivers/spi/spi-tegra20-slink.c -+++ b/drivers/spi/spi-tegra20-slink.c -@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev) - goto exit_free_master; - } - -+ /* disabled clock may cause interrupt storm upon request */ -+ tspi->clk = devm_clk_get(&pdev->dev, NULL); -+ if (IS_ERR(tspi->clk)) { -+ ret = PTR_ERR(tspi->clk); -+ dev_err(&pdev->dev, "Can not get clock %d\n", ret); -+ goto exit_free_master; -+ } -+ ret = clk_prepare(tspi->clk); -+ if (ret < 0) { -+ dev_err(&pdev->dev, "Clock prepare failed %d\n", ret); -+ goto exit_free_master; -+ } -+ ret = clk_enable(tspi->clk); -+ if (ret < 0) { -+ dev_err(&pdev->dev, "Clock enable failed %d\n", ret); -+ goto exit_free_master; -+ } -+ - spi_irq = platform_get_irq(pdev, 0); - tspi->irq = spi_irq; - ret = request_threaded_irq(tspi->irq, tegra_slink_isr, -@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev) - if (ret < 0) { - dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n", - tspi->irq); -- goto exit_free_master; -- } -- -- tspi->clk = devm_clk_get(&pdev->dev, NULL); -- if (IS_ERR(tspi->clk)) { -- dev_err(&pdev->dev, "can not get clock\n"); -- ret = PTR_ERR(tspi->clk); -- goto exit_free_irq; -+ goto exit_clk_disable; - } - - tspi->rst = devm_reset_control_get(&pdev->dev, "spi"); -@@ -1138,6 +1149,8 @@ exit_rx_dma_free: - tegra_slink_deinit_dma_param(tspi, true); - exit_free_irq: - free_irq(spi_irq, tspi); -+exit_clk_disable: -+ clk_disable(tspi->clk); - exit_free_master: - spi_master_put(master); - return ret; -@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev) - - free_irq(tspi->irq, tspi); - -+ clk_disable(tspi->clk); -+ - if (tspi->tx_dma_chan) - tegra_slink_deinit_dma_param(tspi, false); - -diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c -index 013b33760639..e9c74c41aece 100644 ---- a/drivers/staging/android/ashmem.c -+++ b/drivers/staging/android/ashmem.c -@@ -370,6 +370,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) - goto out; - } - -+ /* requested mapping size larger than object size */ -+ if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) { -+ ret = -EINVAL; -+ goto out; -+ } -+ - /* requested protection bits must match our allowed protection mask */ - if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) & - calc_vm_prot_bits(PROT_MASK))) { -diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c -index d6c498209b2c..9a876ce92dbd 100644 ---- a/drivers/staging/rts5208/sd.c -+++ b/drivers/staging/rts5208/sd.c -@@ -5031,7 +5031,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct rtsx_chip *chip) - goto SD_Execute_Write_Cmd_Failed; - } - -- rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); -+ retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); - if (retval != STATUS_SUCCESS) { - rtsx_trace(chip); - goto SD_Execute_Write_Cmd_Failed; -diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c -index b380bc7ee10a..3184e023a052 100644 ---- a/drivers/target/iscsi/iscsi_target_auth.c -+++ b/drivers/target/iscsi/iscsi_target_auth.c -@@ -26,15 +26,6 @@ - #include "iscsi_target_nego.h" - #include "iscsi_target_auth.h" - --static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) --{ -- int i; -- -- for (i = 0; i < src_len; i++) { -- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); -- } --} -- - static void chap_gen_challenge( - struct iscsi_conn *conn, - int caller, -@@ -47,7 +38,7 @@ static void chap_gen_challenge( - memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1); - - get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH); -- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, -+ bin2hex(challenge_asciihex, chap->challenge, - CHAP_CHALLENGE_LENGTH); - /* - * Set CHAP_C, and copy the generated challenge into c_str. -@@ -287,7 +278,7 @@ static int chap_server_compute_md5( - } - crypto_free_hash(tfm); - -- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); -+ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); - pr_debug("[server] MD5 Server Digest: %s\n", response); - - if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { -@@ -431,7 +422,7 @@ static int chap_server_compute_md5( - /* - * Convert response from binary hex to ascii hext. - */ -- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); -+ bin2hex(response, digest, MD5_SIGNATURE_SIZE); - *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", - response); - *nr_out_len += 1; -diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c -index 63e1dcc5914d..761b065a40bb 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.c -+++ b/drivers/target/iscsi/iscsi_target_tpg.c -@@ -637,8 +637,7 @@ int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication) - none = strstr(buf1, NONE); - if (none) - goto out; -- strncat(buf1, ",", strlen(",")); -- strncat(buf1, NONE, strlen(NONE)); -+ strlcat(buf1, "," NONE, sizeof(buf1)); - if (iscsi_update_param_value(param, buf1) < 0) - return -EINVAL; - } -diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c -index be4eedcb839a..236c4eb5cf78 100644 ---- a/drivers/thermal/of-thermal.c -+++ b/drivers/thermal/of-thermal.c -@@ -284,10 +284,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz, - - mutex_lock(&tz->lock); - -- if (mode == THERMAL_DEVICE_ENABLED) -+ if (mode == THERMAL_DEVICE_ENABLED) { - tz->polling_delay = data->polling_delay; -- else -+ tz->passive_delay = data->passive_delay; -+ } else { - tz->polling_delay = 0; -+ tz->passive_delay = 0; -+ } - - mutex_unlock(&tz->lock); - -diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c -index 4d180c9423ef..1a14948c86d6 100644 ---- a/drivers/tty/serial/8250/serial_cs.c -+++ b/drivers/tty/serial/8250/serial_cs.c -@@ -629,8 +629,10 @@ static int serial_config(struct pcmcia_device * link) - (link->has_func_id) && - (link->socket->pcmcia_pfc == 0) && - ((link->func_id == CISTPL_FUNCID_MULTI) || -- (link->func_id == CISTPL_FUNCID_SERIAL))) -- pcmcia_loop_config(link, serial_check_for_multi, info); -+ (link->func_id == CISTPL_FUNCID_SERIAL))) { -+ if (pcmcia_loop_config(link, serial_check_for_multi, info)) -+ goto failed; -+ } - - /* - * Apply any multi-port quirk. -diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c -index d3e3d42c0c12..0040c29f651a 100644 ---- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c -+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c -@@ -1068,8 +1068,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo) - /* Get the address of the host memory buffer. - */ - bdp = pinfo->rx_cur; -- while (bdp->cbd_sc & BD_SC_EMPTY) -- ; -+ if (bdp->cbd_sc & BD_SC_EMPTY) -+ return NO_POLL_CHAR; - - /* If the buffer address is in the CPM DPRAM, don't - * convert it. -@@ -1104,7 +1104,11 @@ static int cpm_get_poll_char(struct uart_port *port) - poll_chars = 0; - } - if (poll_chars <= 0) { -- poll_chars = poll_wait_key(poll_buf, pinfo); -+ int ret = poll_wait_key(poll_buf, pinfo); -+ -+ if (ret == NO_POLL_CHAR) -+ return ret; -+ poll_chars = ret; - pollp = poll_buf; - } - poll_chars--; -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 07ede982b472..f5f46c121ee3 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1997,6 +1997,14 @@ static int serial_imx_probe(struct platform_device *pdev) - dev_name(&pdev->dev), sport); - if (ret) - return ret; -+ -+ ret = devm_request_irq(&pdev->dev, rtsirq, imx_rtsint, 0, -+ dev_name(&pdev->dev), sport); -+ if (ret) { -+ dev_err(&pdev->dev, "failed to request rts irq: %d\n", -+ ret); -+ return ret; -+ } - } else { - ret = devm_request_irq(&pdev->dev, rxirq, imx_int, 0, - dev_name(&pdev->dev), sport); -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 4380e4f600ab..61ea87917433 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) - - set_bit(WDM_RESPONDING, &desc->flags); - spin_unlock_irq(&desc->iuspin); -- rv = usb_submit_urb(desc->response, GFP_ATOMIC); -+ rv = usb_submit_urb(desc->response, GFP_KERNEL); - spin_lock_irq(&desc->iuspin); - if (rv) { - dev_err(&desc->intf->dev, -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index ad2e6d235c30..5e0af15aebc4 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -1289,10 +1289,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - struct async *as = NULL; - struct usb_ctrlrequest *dr = NULL; - unsigned int u, totlen, isofrmlen; -- int i, ret, is_in, num_sgs = 0, ifnum = -1; -+ int i, ret, num_sgs = 0, ifnum = -1; - int number_of_packets = 0; - unsigned int stream_id = 0; - void *buf; -+ bool is_in; -+ bool allow_short = false; -+ bool allow_zero = false; - unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | - USBDEVFS_URB_BULK_CONTINUATION | - USBDEVFS_URB_NO_FSBR | -@@ -1326,6 +1329,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - u = 0; - switch (uurb->type) { - case USBDEVFS_URB_TYPE_CONTROL: -+ if (is_in) -+ allow_short = true; - if (!usb_endpoint_xfer_control(&ep->desc)) - return -EINVAL; - /* min 8 byte setup packet */ -@@ -1366,6 +1371,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - break; - - case USBDEVFS_URB_TYPE_BULK: -+ if (!is_in) -+ allow_zero = true; -+ else -+ allow_short = true; - switch (usb_endpoint_type(&ep->desc)) { - case USB_ENDPOINT_XFER_CONTROL: - case USB_ENDPOINT_XFER_ISOC: -@@ -1386,6 +1395,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - if (!usb_endpoint_xfer_int(&ep->desc)) - return -EINVAL; - interrupt_urb: -+ if (!is_in) -+ allow_zero = true; -+ else -+ allow_short = true; - break; - - case USBDEVFS_URB_TYPE_ISO: -@@ -1512,16 +1525,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - u = (is_in ? URB_DIR_IN : URB_DIR_OUT); - if (uurb->flags & USBDEVFS_URB_ISO_ASAP) - u |= URB_ISO_ASAP; -- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in) -+ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) - u |= URB_SHORT_NOT_OK; - if (uurb->flags & USBDEVFS_URB_NO_FSBR) - u |= URB_NO_FSBR; -- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET) -+ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) - u |= URB_ZERO_PACKET; - if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT) - u |= URB_NO_INTERRUPT; - as->urb->transfer_flags = u; - -+ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) -+ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n"); -+ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) -+ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n"); -+ - as->urb->transfer_buffer_length = uurb->buffer_length; - as->urb->setup_packet = (unsigned char *)dr; - dr = NULL; -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index 0bb380a9fcf7..e9d6cf146fcc 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, - struct device *dev; - struct usb_device *udev; - int retval = 0; -- int lpm_disable_error = -ENODEV; - - if (!iface) - return -ENODEV; -@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, - - iface->condition = USB_INTERFACE_BOUND; - -- /* See the comment about disabling LPM in usb_probe_interface(). */ -- if (driver->disable_hub_initiated_lpm) { -- lpm_disable_error = usb_unlocked_disable_lpm(udev); -- if (lpm_disable_error) { -- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", -- __func__, driver->name); -- return -ENOMEM; -- } -- } -- - /* Claimed interfaces are initially inactive (suspended) and - * runtime-PM-enabled, but only if the driver has autosuspend - * support. Otherwise they are marked active, to prevent the -@@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver, - if (device_is_registered(dev)) - retval = device_bind_driver(dev); - -- /* Attempt to re-enable USB3 LPM, if the disable was successful. */ -- if (!lpm_disable_error) -- usb_unlocked_enable_lpm(udev); -+ if (retval) { -+ dev->driver = NULL; -+ usb_set_intfdata(iface, NULL); -+ iface->needs_remote_wakeup = 0; -+ iface->condition = USB_INTERFACE_UNBOUND; -+ -+ /* -+ * Unbound interfaces are always runtime-PM-disabled -+ * and runtime-PM-suspended -+ */ -+ if (driver->supports_autosuspend) -+ pm_runtime_disable(dev); -+ pm_runtime_set_suspended(dev); -+ } - - return retval; - } -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index f8bbd0b6d9fe..ad308c8e9af5 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -95,6 +95,8 @@ struct usb_host_interface *usb_find_alt_setting( - struct usb_interface_cache *intf_cache = NULL; - int i; - -+ if (!config) -+ return NULL; - for (i = 0; i < config->desc.bNumInterfaces; i++) { - if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber - == iface_num) { -diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c -index 6ba122cc7490..95df2b3bb6a1 100644 ---- a/drivers/usb/gadget/udc/fotg210-udc.c -+++ b/drivers/usb/gadget/udc/fotg210-udc.c -@@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gadget_ops = { - static int fotg210_udc_remove(struct platform_device *pdev) - { - struct fotg210_udc *fotg210 = platform_get_drvdata(pdev); -+ int i; - - usb_del_gadget_udc(&fotg210->gadget); - iounmap(fotg210->reg); - free_irq(platform_get_irq(pdev, 0), fotg210); - - fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); -+ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) -+ kfree(fotg210->ep[i]); - kfree(fotg210); - - return 0; -@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) - /* initialize udc */ - fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); - if (fotg210 == NULL) -- goto err_alloc; -+ goto err; - - for (i = 0; i < FOTG210_MAX_NUM_EP; i++) { - _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); -@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) - fotg210->reg = ioremap(res->start, resource_size(res)); - if (fotg210->reg == NULL) { - pr_err("ioremap error.\n"); -- goto err_map; -+ goto err_alloc; - } - - spin_lock_init(&fotg210->lock); -@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) - fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep, - GFP_KERNEL); - if (fotg210->ep0_req == NULL) -- goto err_req; -+ goto err_map; - - fotg210_init(fotg210); - -@@ -1190,12 +1193,14 @@ err_req: - fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); - - err_map: -- if (fotg210->reg) -- iounmap(fotg210->reg); -+ iounmap(fotg210->reg); - - err_alloc: -+ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) -+ kfree(fotg210->ep[i]); - kfree(fotg210); - -+err: - return ret; - } - -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index e8e8702d5adf..5594a4a4a83f 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -431,6 +431,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, - spin_unlock_irqrestore(&dev->lock, flags); - mutex_unlock(&dev->io_mutex); - -+ if (WARN_ON_ONCE(len >= sizeof(in_buffer))) -+ return -EIO; -+ - return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); - } - -diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c -index 813035f51fe7..7d252678c55a 100644 ---- a/drivers/usb/serial/kobil_sct.c -+++ b/drivers/usb/serial/kobil_sct.c -@@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty) - transfer_buffer_length, - KOBIL_TIMEOUT); - -- dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n", -- __func__, result, transfer_buffer[0]); -+ dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n", -+ result); -+ if (result < 1) { -+ if (result >= 0) -+ result = -EIO; -+ goto out_free; -+ } -+ -+ dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]); - - result = 0; - if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0) - result = TIOCM_DSR; -+out_free: - kfree(transfer_buffer); - return result; - } -diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c -index b66faaf3e842..4019c11f24e2 100644 ---- a/drivers/usb/wusbcore/security.c -+++ b/drivers/usb/wusbcore/security.c -@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc, - - result = usb_get_descriptor(usb_dev, USB_DT_SECURITY, - 0, secd, sizeof(*secd)); -- if (result < sizeof(*secd)) { -+ if (result < (int)sizeof(*secd)) { - dev_err(dev, "Can't read security descriptor or " - "not enough data: %d\n", result); - goto out; -diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c -index 1212b4b3c5a9..e9ff710a3d12 100644 ---- a/drivers/uwb/hwa-rc.c -+++ b/drivers/uwb/hwa-rc.c -@@ -875,6 +875,7 @@ error_get_version: - error_rc_add: - usb_put_intf(iface); - usb_put_dev(hwarc->usb_dev); -+ kfree(hwarc); - error_alloc: - uwb_rc_put(uwb_rc); - error_rc_alloc: -diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c -index 5676aefdf2bc..f4e59c445964 100644 ---- a/drivers/xen/cpu_hotplug.c -+++ b/drivers/xen/cpu_hotplug.c -@@ -18,15 +18,16 @@ static void enable_hotplug_cpu(int cpu) - - static void disable_hotplug_cpu(int cpu) - { -- if (cpu_online(cpu)) { -- lock_device_hotplug(); -+ if (!cpu_is_hotpluggable(cpu)) -+ return; -+ lock_device_hotplug(); -+ if (cpu_online(cpu)) - device_offline(get_cpu_device(cpu)); -- unlock_device_hotplug(); -- } -- if (cpu_present(cpu)) -+ if (!cpu_online(cpu) && cpu_present(cpu)) { - xen_arch_unregister_cpu(cpu); -- -- set_cpu_present(cpu, false); -+ set_cpu_present(cpu, false); -+ } -+ unlock_device_hotplug(); - } - - static int vcpu_online(unsigned int cpu) -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 21d679f88dfa..878a40950a3a 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -139,7 +139,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) - clear_evtchn_to_irq_row(row); - } - -- evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq; -+ evtchn_to_irq[row][col] = irq; - return 0; - } - -diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c -index 2dd285827169..f494126aaecd 100644 ---- a/drivers/xen/manage.c -+++ b/drivers/xen/manage.c -@@ -280,9 +280,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char **vec, - /* - * The Xenstore watch fires directly after registering it and - * after a suspend/resume cycle. So ENOENT is no error but -- * might happen in those cases. -+ * might happen in those cases. ERANGE is observed when we get -+ * an empty value (''), this happens when we acknowledge the -+ * request by writing '\0' below. - */ -- if (err != -ENOENT) -+ if (err != -ENOENT && err != -ERANGE) - pr_err("Error %d reading sysrq code in control/sysrq\n", - err); - xenbus_transaction_end(xbt, 1); -diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c -index a0b3e7d1be48..211ac472cb9d 100644 ---- a/fs/cifs/cifs_unicode.c -+++ b/fs/cifs/cifs_unicode.c -@@ -101,9 +101,6 @@ convert_sfm_char(const __u16 src_char, char *target) - case SFM_LESSTHAN: - *target = '<'; - break; -- case SFM_SLASH: -- *target = '\\'; -- break; - case SFM_SPACE: - *target = ' '; - break; -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index 63aea21e6298..b9b8f19dce0e 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -577,10 +577,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) - } - - count = 0; -+ /* -+ * We know that all the name entries in the protocols array -+ * are short (< 16 bytes anyway) and are NUL terminated. -+ */ - for (i = 0; i < CIFS_NUM_PROT; i++) { -- strncpy(pSMB->DialectsArray+count, protocols[i].name, 16); -- count += strlen(protocols[i].name) + 1; -- /* null at end of source and target buffers anyway */ -+ size_t len = strlen(protocols[i].name) + 1; -+ -+ memcpy(pSMB->DialectsArray+count, protocols[i].name, len); -+ count += len; - } - inc_rfc1001_len(pSMB, count); - pSMB->ByteCount = cpu_to_le16(count); -diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c -index 0cc699d9b932..61a09ab2752e 100644 ---- a/fs/cifs/misc.c -+++ b/fs/cifs/misc.c -@@ -406,9 +406,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) - (struct smb_com_transaction_change_notify_rsp *)buf; - struct file_notify_information *pnotify; - __u32 data_offset = 0; -+ size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); -+ - if (get_bcc(buf) > sizeof(struct file_notify_information)) { - data_offset = le32_to_cpu(pSMBr->DataOffset); - -+ if (data_offset > -+ len - sizeof(struct file_notify_information)) { -+ cifs_dbg(FYI, "invalid data_offset %u\n", -+ data_offset); -+ return true; -+ } - pnotify = (struct file_notify_information *) - ((char *)&pSMBr->hdr.Protocol + data_offset); - cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index e6b1795fbf2a..2725085a3f9f 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -914,7 +914,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, - } - - srch_inf->entries_in_buffer = 0; -- srch_inf->index_of_last_entry = 0; -+ srch_inf->index_of_last_entry = 2; - - rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, - fid->volatile_fid, 0, srch_inf); -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 9fb2a751fce4..b51bb73b06a6 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1386,6 +1386,11 @@ retry: - /* Find the entry best suited to be pushed into EA block */ - entry = NULL; - for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { -+ /* never move system.data out of the inode */ -+ if ((last->e_name_len == 4) && -+ (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && -+ !memcmp(last->e_name, "data", 4)) -+ continue; - total_size = - EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + - EXT4_XATTR_LEN(last->e_name_len); -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index bfbee8ddf978..c67064d94096 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1632,6 +1632,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, - if (status) { - op = &args->ops[0]; - op->status = status; -+ resp->opcnt = 1; - goto encode_op; - } - -diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c -index 4e2162b355db..0cefb036a17e 100644 ---- a/fs/ocfs2/dlm/dlmmaster.c -+++ b/fs/ocfs2/dlm/dlmmaster.c -@@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm, - - res->last_used = 0; - -- spin_lock(&dlm->spinlock); -+ spin_lock(&dlm->track_lock); - list_add_tail(&res->tracking, &dlm->tracking_list); -- spin_unlock(&dlm->spinlock); -+ spin_unlock(&dlm->track_lock); - - memset(res->lvb, 0, DLM_LVB_LEN); - memset(res->refmap, 0, sizeof(res->refmap)); -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 5f9cec2db6c3..4beed301e224 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -471,6 +471,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns, - int err; - int i; - -+ /* -+ * The ability to racily run the kernel stack unwinder on a running task -+ * and then observe the unwinder output is scary; while it is useful for -+ * debugging kernel issues, it can also allow an attacker to leak kernel -+ * stack contents. -+ * Doing this in a manner that is at least safe from races would require -+ * some work to ensure that the remote task can not be scheduled; and -+ * even then, this would still expose the unwinder as local attack -+ * surface. -+ * Therefore, this interface is restricted to root. -+ */ -+ if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) -+ return -EACCES; -+ - entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL); - if (!entries) - return -ENOMEM; -diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h -index 9abc0ca7259b..9f0aa1b48c78 100644 ---- a/include/linux/platform_data/ina2xx.h -+++ b/include/linux/platform_data/ina2xx.h -@@ -1,7 +1,7 @@ - /* - * Driver for Texas Instruments INA219, INA226 power monitor chips - * -- * Copyright (C) 2012 Lothar Felten -+ * Copyright (C) 2012 Lothar Felten - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h -index 33885118523c..9b681f21c2a9 100644 ---- a/include/linux/slub_def.h -+++ b/include/linux/slub_def.h -@@ -67,7 +67,8 @@ struct kmem_cache { - int size; /* The size of an object including meta data */ - int object_size; /* The size of an object without meta data */ - int offset; /* Free pointer offset. */ -- int cpu_partial; /* Number of per cpu partial objects to keep around */ -+ /* Number of per cpu partial objects to keep around */ -+ unsigned int cpu_partial; - struct kmem_cache_order_objects oo; - - /* Allocation and freeing of slabs */ -diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h -index 803516775162..4fdcd0d807d7 100644 ---- a/include/media/v4l2-fh.h -+++ b/include/media/v4l2-fh.h -@@ -43,6 +43,7 @@ struct v4l2_fh { - wait_queue_head_t wait; - struct list_head subscribed; /* Subscribed events */ - struct list_head available; /* Dequeueable event */ -+ struct mutex subscribe_lock; - unsigned int navailable; - u32 sequence; - -diff --git a/kernel/module.c b/kernel/module.c -index aa81f41f2b19..bcc78f4c15e9 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -3860,7 +3860,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name) - - for (i = 0; i < kallsyms->num_symtab; i++) - if (strcmp(name, symname(kallsyms, i)) == 0 && -- kallsyms->symtab[i].st_info != 'U') -+ kallsyms->symtab[i].st_shndx != SHN_UNDEF) - return kallsyms->symtab[i].st_value; - return 0; - } -@@ -3906,6 +3906,10 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, - if (mod->state == MODULE_STATE_UNFORMED) - continue; - for (i = 0; i < kallsyms->num_symtab; i++) { -+ -+ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF) -+ continue; -+ - ret = fn(data, symname(kallsyms, i), - mod, kallsyms->symtab[i].st_value); - if (ret != 0) -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index 6fcc367ad531..e78480b81f8d 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -773,7 +773,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, - /* Convert (if necessary) to absolute time */ - if (flags != TIMER_ABSTIME) { - ktime_t now = alarm_bases[type].gettime(); -- exp = ktime_add(now, exp); -+ -+ exp = ktime_add_safe(now, exp); - } - - if (alarmtimer_do_nsleep(&alarm, exp)) -diff --git a/lib/klist.c b/lib/klist.c -index 0507fa5d84c5..f6b547812fe3 100644 ---- a/lib/klist.c -+++ b/lib/klist.c -@@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct klist_iter *i) - void (*put)(struct klist_node *) = i->i_klist->put; - struct klist_node *last = i->i_cur; - struct klist_node *prev; -+ unsigned long flags; - -- spin_lock(&i->i_klist->k_lock); -+ spin_lock_irqsave(&i->i_klist->k_lock, flags); - - if (last) { - prev = to_klist_node(last->n_node.prev); -@@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct klist_iter *i) - prev = to_klist_node(prev->n_node.prev); - } - -- spin_unlock(&i->i_klist->k_lock); -+ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); - - if (put && last) - put(last); -@@ -377,8 +378,9 @@ struct klist_node *klist_next(struct klist_iter *i) - void (*put)(struct klist_node *) = i->i_klist->put; - struct klist_node *last = i->i_cur; - struct klist_node *next; -+ unsigned long flags; - -- spin_lock(&i->i_klist->k_lock); -+ spin_lock_irqsave(&i->i_klist->k_lock, flags); - - if (last) { - next = to_klist_node(last->n_node.next); -@@ -397,7 +399,7 @@ struct klist_node *klist_next(struct klist_iter *i) - next = to_klist_node(next->n_node.next); - } - -- spin_unlock(&i->i_klist->k_lock); -+ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); - - if (put && last) - put(last); -diff --git a/mm/madvise.c b/mm/madvise.c -index 2a0f9a4504f1..f548c66154ee 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -76,7 +76,7 @@ static long madvise_behavior(struct vm_area_struct *vma, - new_flags |= VM_DONTDUMP; - break; - case MADV_DODUMP: -- if (new_flags & VM_SPECIAL) { -+ if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) { - error = -EINVAL; - goto out; - } -diff --git a/mm/slub.c b/mm/slub.c -index 2284c4333857..c33b0e13cca7 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -1661,7 +1661,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n, - { - struct page *page, *page2; - void *object = NULL; -- int available = 0; -+ unsigned int available = 0; - int objects; - - /* -@@ -4674,10 +4674,10 @@ static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf) - static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf, - size_t length) - { -- unsigned long objects; -+ unsigned int objects; - int err; - -- err = kstrtoul(buf, 10, &objects); -+ err = kstrtouint(buf, 10, &objects); - if (err) - return err; - if (objects && !kmem_cache_has_cpu_partial(s)) -diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c -index 346b5c1a9185..c40eb04dd856 100644 ---- a/net/6lowpan/iphc.c -+++ b/net/6lowpan/iphc.c -@@ -569,6 +569,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev, - hdr.hop_limit, &hdr.daddr); - - skb_push(skb, sizeof(hdr)); -+ skb_reset_mac_header(skb); - skb_reset_network_header(skb); - skb_copy_to_linear_data(skb, &hdr, sizeof(hdr)); - -diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c -index 24ba31601fc9..f2af19673b26 100644 ---- a/net/mac80211/ibss.c -+++ b/net/mac80211/ibss.c -@@ -948,8 +948,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata, - if (len < IEEE80211_DEAUTH_FRAME_LEN) - return; - -- ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n", -- mgmt->sa, mgmt->da, mgmt->bssid, reason); -+ ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); -+ ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason); - sta_info_destroy_addr(sdata, mgmt->sa); - } - -@@ -967,9 +967,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata, - auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg); - auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction); - -- ibss_dbg(sdata, -- "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n", -- mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction); -+ ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); -+ ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n", -+ mgmt->bssid, auth_transaction); - - if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) - return; -@@ -1174,10 +1174,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata, - rx_timestamp = drv_get_tsf(local, sdata); - } - -- ibss_dbg(sdata, -- "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n", -+ ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n", - mgmt->sa, mgmt->bssid, -- (unsigned long long)rx_timestamp, -+ (unsigned long long)rx_timestamp); -+ ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n", - (unsigned long long)beacon_timestamp, - (unsigned long long)(rx_timestamp - beacon_timestamp), - jiffies); -@@ -1536,9 +1536,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata, - - tx_last_beacon = drv_tx_last_beacon(local); - -- ibss_dbg(sdata, -- "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n", -- mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon); -+ ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); -+ ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n", -+ mgmt->bssid, tx_last_beacon); - - if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da)) - return; -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index 2ee53dc1ddf7..15d23aeea634 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -253,8 +253,27 @@ static void ieee80211_restart_work(struct work_struct *work) - "%s called with hardware scan in progress\n", __func__); - - rtnl_lock(); -- list_for_each_entry(sdata, &local->interfaces, list) -+ list_for_each_entry(sdata, &local->interfaces, list) { -+ /* -+ * XXX: there may be more work for other vif types and even -+ * for station mode: a good thing would be to run most of -+ * the iface type's dependent _stop (ieee80211_mg_stop, -+ * ieee80211_ibss_stop) etc... -+ * For now, fix only the specific bug that was seen: race -+ * between csa_connection_drop_work and us. -+ */ -+ if (sdata->vif.type == NL80211_IFTYPE_STATION) { -+ /* -+ * This worker is scheduled from the iface worker that -+ * runs on mac80211's workqueue, so we can't be -+ * scheduling this worker after the cancel right here. -+ * The exception is ieee80211_chswitch_done. -+ * Then we can have a race... -+ */ -+ cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work); -+ } - flush_delayed_work(&sdata->dec_tailroom_needed_wk); -+ } - ieee80211_scan_cancel(local); - ieee80211_reconfig(local); - rtnl_unlock(); -@@ -460,10 +479,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = { - cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC | - IEEE80211_VHT_CAP_SHORT_GI_80 | - IEEE80211_VHT_CAP_SHORT_GI_160 | -- IEEE80211_VHT_CAP_RXSTBC_1 | -- IEEE80211_VHT_CAP_RXSTBC_2 | -- IEEE80211_VHT_CAP_RXSTBC_3 | -- IEEE80211_VHT_CAP_RXSTBC_4 | -+ IEEE80211_VHT_CAP_RXSTBC_MASK | - IEEE80211_VHT_CAP_TXSTBC | - IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE | - IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE | -diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c -index e68a409fc351..33d5271a9e32 100644 ---- a/net/mac80211/mesh_hwmp.c -+++ b/net/mac80211/mesh_hwmp.c -@@ -552,6 +552,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, - forward = false; - reply = true; - target_metric = 0; -+ -+ if (SN_GT(target_sn, ifmsh->sn)) -+ ifmsh->sn = target_sn; -+ - if (time_after(jiffies, ifmsh->last_sn_update + - net_traversal_jiffies(sdata)) || - time_before(jiffies, ifmsh->last_sn_update)) { -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 005cd8796505..a5e11280f405 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -1021,6 +1021,10 @@ static void ieee80211_chswitch_work(struct work_struct *work) - */ - - if (sdata->reserved_chanctx) { -+ struct ieee80211_supported_band *sband = NULL; -+ struct sta_info *mgd_sta = NULL; -+ enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20; -+ - /* - * with multi-vif csa driver may call ieee80211_csa_finish() - * many times while waiting for other interfaces to use their -@@ -1029,6 +1033,48 @@ static void ieee80211_chswitch_work(struct work_struct *work) - if (sdata->reserved_ready) - goto out; - -+ if (sdata->vif.bss_conf.chandef.width != -+ sdata->csa_chandef.width) { -+ /* -+ * For managed interface, we need to also update the AP -+ * station bandwidth and align the rate scale algorithm -+ * on the bandwidth change. Here we only consider the -+ * bandwidth of the new channel definition (as channel -+ * switch flow does not have the full HT/VHT/HE -+ * information), assuming that if additional changes are -+ * required they would be done as part of the processing -+ * of the next beacon from the AP. -+ */ -+ switch (sdata->csa_chandef.width) { -+ case NL80211_CHAN_WIDTH_20_NOHT: -+ case NL80211_CHAN_WIDTH_20: -+ default: -+ bw = IEEE80211_STA_RX_BW_20; -+ break; -+ case NL80211_CHAN_WIDTH_40: -+ bw = IEEE80211_STA_RX_BW_40; -+ break; -+ case NL80211_CHAN_WIDTH_80: -+ bw = IEEE80211_STA_RX_BW_80; -+ break; -+ case NL80211_CHAN_WIDTH_80P80: -+ case NL80211_CHAN_WIDTH_160: -+ bw = IEEE80211_STA_RX_BW_160; -+ break; -+ } -+ -+ mgd_sta = sta_info_get(sdata, ifmgd->bssid); -+ sband = -+ local->hw.wiphy->bands[sdata->csa_chandef.chan->band]; -+ } -+ -+ if (sdata->vif.bss_conf.chandef.width > -+ sdata->csa_chandef.width) { -+ mgd_sta->sta.bandwidth = bw; -+ rate_control_rate_update(local, sband, mgd_sta, -+ IEEE80211_RC_BW_CHANGED); -+ } -+ - ret = ieee80211_vif_use_reserved_context(sdata); - if (ret) { - sdata_info(sdata, -@@ -1039,6 +1085,13 @@ static void ieee80211_chswitch_work(struct work_struct *work) - goto out; - } - -+ if (sdata->vif.bss_conf.chandef.width < -+ sdata->csa_chandef.width) { -+ mgd_sta->sta.bandwidth = bw; -+ rate_control_rate_update(local, sband, mgd_sta, -+ IEEE80211_RC_BW_CHANGED); -+ } -+ - goto out; - } - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index b07fd8b8b50c..642a78079ae1 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -10014,6 +10014,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) - return -EOPNOTSUPP; - - if (!info->attrs[NL80211_ATTR_MDID] || -+ !info->attrs[NL80211_ATTR_IE] || - !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) - return -EINVAL; - -diff --git a/net/wireless/util.c b/net/wireless/util.c -index baf7218cec15..1d239564baa3 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -1360,7 +1360,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef, - u8 *op_class) - { - u8 vht_opclass; -- u16 freq = chandef->center_freq1; -+ u32 freq = chandef->center_freq1; - - if (freq >= 2412 && freq <= 2472) { - if (chandef->width > NL80211_CHAN_WIDTH_40) -diff --git a/sound/aoa/core/gpio-feature.c b/sound/aoa/core/gpio-feature.c -index f34153962d07..585b594bd838 100644 ---- a/sound/aoa/core/gpio-feature.c -+++ b/sound/aoa/core/gpio-feature.c -@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char *name, - } - - reg = of_get_property(np, "reg", NULL); -- if (!reg) -+ if (!reg) { -+ of_node_put(np); - return NULL; -+ } - - *gpioptr = *reg; - -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index cabccb10210e..95a82e428f37 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2360,7 +2360,8 @@ static const struct pci_device_id azx_ids[] = { - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, - /* AMD Raven */ - { PCI_DEVICE(0x1022, 0x15e3), -- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, -+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | -+ AZX_DCAPS_PM_RUNTIME }, - /* ATI HDMI */ - { PCI_DEVICE(0x1002, 0x0002), - .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d706a416b587..0467e5ba82e0 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5642,6 +5642,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), - SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), -+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), - SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), - SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), - SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 9e784cc3e5d2..0aefed8ab0cf 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -3864,6 +3864,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card) - continue; - } - -+ /* let users know there is no DAI to link */ -+ if (!dai_w->priv) { -+ dev_dbg(card->dev, "dai widget %s has no DAI\n", -+ dai_w->name); -+ continue; -+ } -+ - dai = dai_w->priv; - - /* ...find all widgets with the same stream and link them */ -diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c -index bbc1a50768dd..873f19f1a771 100644 ---- a/tools/perf/arch/powerpc/util/sym-handling.c -+++ b/tools/perf/arch/powerpc/util/sym-handling.c -@@ -27,15 +27,16 @@ void arch__elf_sym_adjust(GElf_Sym *sym) - #endif - #endif - --#if !defined(_CALL_ELF) || _CALL_ELF != 2 - int arch__choose_best_symbol(struct symbol *syma, - struct symbol *symb __maybe_unused) - { - char *sym = syma->name; - -+#if !defined(_CALL_ELF) || _CALL_ELF != 2 - /* Skip over any initial dot */ - if (*sym == '.') - sym++; -+#endif - - /* Avoid "SyS" kernel syscall aliases */ - if (strlen(sym) >= 3 && !strncmp(sym, "SyS", 3)) -@@ -46,6 +47,7 @@ int arch__choose_best_symbol(struct symbol *syma, - return SYMBOL_A; - } - -+#if !defined(_CALL_ELF) || _CALL_ELF != 2 - /* Allow matching against dot variants */ - int arch__compare_symbol_names(const char *namea, const char *nameb) - { -diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c -index 5a6016224bb9..c7fcc84fc0c0 100644 ---- a/tools/vm/page-types.c -+++ b/tools/vm/page-types.c -@@ -150,12 +150,6 @@ static const char * const page_flag_names[] = { - }; - - --static const char * const debugfs_known_mountpoints[] = { -- "/sys/kernel/debug", -- "/debug", -- 0, --}; -- - /* - * data structures - */ -diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c -index 499b8819d4c6..5173a191cd03 100644 ---- a/tools/vm/slabinfo.c -+++ b/tools/vm/slabinfo.c -@@ -29,8 +29,8 @@ struct slabinfo { - int alias; - int refs; - int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu; -- int hwcache_align, object_size, objs_per_slab; -- int sanity_checks, slab_size, store_user, trace; -+ unsigned int hwcache_align, object_size, objs_per_slab; -+ unsigned int sanity_checks, slab_size, store_user, trace; - int order, poison, reclaim_account, red_zone; - unsigned long partial, objects, slabs, objects_partial, objects_total; - unsigned long alloc_fastpath, alloc_slowpath; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.160-161.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.160-161.patch deleted file mode 100644 index 4b0393795d9d..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.160-161.patch +++ /dev/null @@ -1,1458 +0,0 @@ -diff --git a/Makefile b/Makefile -index 607394a56036..57e4ff1a8b96 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 160 -+SUBLEVEL = 161 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c -index a3f750e76b68..8f40c6c5d77e 100644 ---- a/arch/arc/kernel/process.c -+++ b/arch/arc/kernel/process.c -@@ -153,6 +153,26 @@ int copy_thread(unsigned long clone_flags, - task_thread_info(current)->thr_ptr; - } - -+ -+ /* -+ * setup usermode thread pointer #1: -+ * when child is picked by scheduler, __switch_to() uses @c_callee to -+ * populate usermode callee regs: this works (despite being in a kernel -+ * function) since special return path for child @ret_from_fork() -+ * ensures those regs are not clobbered all the way to RTIE to usermode -+ */ -+ c_callee->r25 = task_thread_info(p)->thr_ptr; -+ -+#ifdef CONFIG_ARC_CURR_IN_REG -+ /* -+ * setup usermode thread pointer #2: -+ * however for this special use of r25 in kernel, __switch_to() sets -+ * r25 for kernel needs and only in the final return path is usermode -+ * r25 setup, from pt_regs->user_r25. So set that up as well -+ */ -+ c_regs->user_r25 = c_callee->r25; -+#endif -+ - return 0; - } - -diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c -index c3c835290131..ca3ad5ebcd41 100644 ---- a/arch/powerpc/kernel/fadump.c -+++ b/arch/powerpc/kernel/fadump.c -@@ -360,9 +360,9 @@ static int __init early_fadump_reserve_mem(char *p) - } - early_param("fadump_reserve_mem", early_fadump_reserve_mem); - --static void register_fw_dump(struct fadump_mem_struct *fdm) -+static int register_fw_dump(struct fadump_mem_struct *fdm) - { -- int rc; -+ int rc, err; - unsigned int wait_time; - - pr_debug("Registering for firmware-assisted kernel dump...\n"); -@@ -379,7 +379,11 @@ static void register_fw_dump(struct fadump_mem_struct *fdm) - - } while (wait_time); - -+ err = -EIO; - switch (rc) { -+ default: -+ pr_err("Failed to register. Unknown Error(%d).\n", rc); -+ break; - case -1: - printk(KERN_ERR "Failed to register firmware-assisted kernel" - " dump. Hardware Error(%d).\n", rc); -@@ -387,18 +391,22 @@ static void register_fw_dump(struct fadump_mem_struct *fdm) - case -3: - printk(KERN_ERR "Failed to register firmware-assisted kernel" - " dump. Parameter Error(%d).\n", rc); -+ err = -EINVAL; - break; - case -9: - printk(KERN_ERR "firmware-assisted kernel dump is already " - " registered."); - fw_dump.dump_registered = 1; -+ err = -EEXIST; - break; - case 0: - printk(KERN_INFO "firmware-assisted kernel dump registration" - " is successful\n"); - fw_dump.dump_registered = 1; -+ err = 0; - break; - } -+ return err; - } - - void crash_fadump(struct pt_regs *regs, const char *str) -@@ -997,7 +1005,7 @@ static unsigned long init_fadump_header(unsigned long addr) - return addr; - } - --static void register_fadump(void) -+static int register_fadump(void) - { - unsigned long addr; - void *vaddr; -@@ -1008,7 +1016,7 @@ static void register_fadump(void) - * assisted dump. - */ - if (!fw_dump.reserve_dump_area_size) -- return; -+ return -ENODEV; - - ret = fadump_setup_crash_memory_ranges(); - if (ret) -@@ -1023,7 +1031,7 @@ static void register_fadump(void) - fadump_create_elfcore_headers(vaddr); - - /* register the future kernel dump with firmware. */ -- register_fw_dump(&fdm); -+ return register_fw_dump(&fdm); - } - - static int fadump_unregister_dump(struct fadump_mem_struct *fdm) -@@ -1208,7 +1216,6 @@ static ssize_t fadump_register_store(struct kobject *kobj, - switch (buf[0]) { - case '0': - if (fw_dump.dump_registered == 0) { -- ret = -EINVAL; - goto unlock_out; - } - /* Un-register Firmware-assisted dump */ -@@ -1216,11 +1223,11 @@ static ssize_t fadump_register_store(struct kobject *kobj, - break; - case '1': - if (fw_dump.dump_registered == 1) { -- ret = -EINVAL; -+ ret = -EEXIST; - goto unlock_out; - } - /* Register Firmware-assisted dump */ -- register_fadump(); -+ ret = register_fadump(); - break; - default: - ret = -EINVAL; -diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c -index 5dd363d54348..049327ee8868 100644 ---- a/arch/x86/entry/vdso/vclock_gettime.c -+++ b/arch/x86/entry/vdso/vclock_gettime.c -@@ -51,8 +51,9 @@ extern u8 pvclock_page - notrace static long vdso_fallback_gettime(long clock, struct timespec *ts) - { - long ret; -- asm("syscall" : "=a" (ret) : -- "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory"); -+ asm ("syscall" : "=a" (ret), "=m" (*ts) : -+ "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : -+ "memory", "rcx", "r11"); - return ret; - } - -@@ -60,8 +61,9 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz) - { - long ret; - -- asm("syscall" : "=a" (ret) : -- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory"); -+ asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) : -+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : -+ "memory", "rcx", "r11"); - return ret; - } - -@@ -143,13 +145,13 @@ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts) - { - long ret; - -- asm( -+ asm ( - "mov %%ebx, %%edx \n" -- "mov %2, %%ebx \n" -+ "mov %[clock], %%ebx \n" - "call __kernel_vsyscall \n" - "mov %%edx, %%ebx \n" -- : "=a" (ret) -- : "0" (__NR_clock_gettime), "g" (clock), "c" (ts) -+ : "=a" (ret), "=m" (*ts) -+ : "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts) - : "memory", "edx"); - return ret; - } -@@ -158,13 +160,13 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz) - { - long ret; - -- asm( -+ asm ( - "mov %%ebx, %%edx \n" -- "mov %2, %%ebx \n" -+ "mov %[tv], %%ebx \n" - "call __kernel_vsyscall \n" - "mov %%edx, %%ebx \n" -- : "=a" (ret) -- : "0" (__NR_gettimeofday), "g" (tv), "c" (tz) -+ : "=a" (ret), "=m" (*tv), "=m" (*tz) -+ : "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz) - : "memory", "edx"); - return ret; - } -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 9712a63957e1..7525e9f6949e 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -1709,6 +1709,8 @@ static int ucma_close(struct inode *inode, struct file *filp) - mutex_lock(&mut); - if (!ctx->closing) { - mutex_unlock(&mut); -+ ucma_put_ctx(ctx); -+ wait_for_completion(&ctx->comp); - /* rdma_destroy_id ensures that no event handlers are - * inflight for that id before releasing it. - */ -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index b59615ddf6ba..531d6f3a786e 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -3391,8 +3391,13 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) - - static bool can_resize(struct cache *cache, dm_cblock_t new_size) - { -- if (from_cblock(new_size) > from_cblock(cache->cache_size)) -- return true; -+ if (from_cblock(new_size) > from_cblock(cache->cache_size)) { -+ if (cache->sized) { -+ DMERR("%s: unable to extend cache due to missing cache table reload", -+ cache_device_name(cache)); -+ return false; -+ } -+ } - - /* - * We can't drop a dirty block when shrinking the cache. -diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h -index 71bdb368813d..0194bebbdbf7 100644 ---- a/drivers/net/wireless/ath/ath10k/trace.h -+++ b/drivers/net/wireless/ath/ath10k/trace.h -@@ -152,10 +152,9 @@ TRACE_EVENT(ath10k_log_dbg_dump, - ); - - TRACE_EVENT(ath10k_wmi_cmd, -- TP_PROTO(struct ath10k *ar, int id, const void *buf, size_t buf_len, -- int ret), -+ TP_PROTO(struct ath10k *ar, int id, const void *buf, size_t buf_len), - -- TP_ARGS(ar, id, buf, buf_len, ret), -+ TP_ARGS(ar, id, buf, buf_len), - - TP_STRUCT__entry( - __string(device, dev_name(ar->dev)) -@@ -163,7 +162,6 @@ TRACE_EVENT(ath10k_wmi_cmd, - __field(unsigned int, id) - __field(size_t, buf_len) - __dynamic_array(u8, buf, buf_len) -- __field(int, ret) - ), - - TP_fast_assign( -@@ -171,17 +169,15 @@ TRACE_EVENT(ath10k_wmi_cmd, - __assign_str(driver, dev_driver_string(ar->dev)); - __entry->id = id; - __entry->buf_len = buf_len; -- __entry->ret = ret; - memcpy(__get_dynamic_array(buf), buf, buf_len); - ), - - TP_printk( -- "%s %s id %d len %zu ret %d", -+ "%s %s id %d len %zu", - __get_str(driver), - __get_str(device), - __entry->id, -- __entry->buf_len, -- __entry->ret -+ __entry->buf_len - ) - ); - -diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -index c72eb4464de9..c27fff39ddae 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c -+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -@@ -1459,10 +1459,10 @@ ath10k_wmi_tlv_op_gen_start_scan(struct ath10k *ar, - bssid_len = arg->n_bssids * sizeof(struct wmi_mac_addr); - ie_len = roundup(arg->ie_len, 4); - len = (sizeof(*tlv) + sizeof(*cmd)) + -- (arg->n_channels ? sizeof(*tlv) + chan_len : 0) + -- (arg->n_ssids ? sizeof(*tlv) + ssid_len : 0) + -- (arg->n_bssids ? sizeof(*tlv) + bssid_len : 0) + -- (arg->ie_len ? sizeof(*tlv) + ie_len : 0); -+ sizeof(*tlv) + chan_len + -+ sizeof(*tlv) + ssid_len + -+ sizeof(*tlv) + bssid_len + -+ sizeof(*tlv) + ie_len; - - skb = ath10k_wmi_alloc_skb(ar, len); - if (!skb) -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 7569db0f69b5..5bb1be478954 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -1642,8 +1642,8 @@ int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb, - cmd_hdr->cmd_id = __cpu_to_le32(cmd); - - memset(skb_cb, 0, sizeof(*skb_cb)); -+ trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len); - ret = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb); -- trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len, ret); - - if (ret) - goto err_pull; -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 2a547ca3d443..2eac3df7dd29 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -553,6 +553,9 @@ static void __init of_unittest_parse_interrupts(void) - struct of_phandle_args args; - int i, rc; - -+ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC) -+ return; -+ - np = of_find_node_by_path("/testcase-data/interrupts/interrupts0"); - if (!np) { - pr_err("missing testcase data\n"); -@@ -627,6 +630,9 @@ static void __init of_unittest_parse_interrupts_extended(void) - struct of_phandle_args args; - int i, rc; - -+ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC) -+ return; -+ - np = of_find_node_by_path("/testcase-data/interrupts/interrupts-extended0"); - if (!np) { - pr_err("missing testcase data\n"); -@@ -778,15 +784,19 @@ static void __init of_unittest_platform_populate(void) - pdev = of_find_device_by_node(np); - unittest(pdev, "device 1 creation failed\n"); - -- irq = platform_get_irq(pdev, 0); -- unittest(irq == -EPROBE_DEFER, "device deferred probe failed - %d\n", irq); -- -- /* Test that a parsing failure does not return -EPROBE_DEFER */ -- np = of_find_node_by_path("/testcase-data/testcase-device2"); -- pdev = of_find_device_by_node(np); -- unittest(pdev, "device 2 creation failed\n"); -- irq = platform_get_irq(pdev, 0); -- unittest(irq < 0 && irq != -EPROBE_DEFER, "device parsing error failed - %d\n", irq); -+ if (!(of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)) { -+ irq = platform_get_irq(pdev, 0); -+ unittest(irq == -EPROBE_DEFER, -+ "device deferred probe failed - %d\n", irq); -+ -+ /* Test that a parsing failure does not return -EPROBE_DEFER */ -+ np = of_find_node_by_path("/testcase-data/testcase-device2"); -+ pdev = of_find_device_by_node(np); -+ unittest(pdev, "device 2 creation failed\n"); -+ irq = platform_get_irq(pdev, 0); -+ unittest(irq < 0 && irq != -EPROBE_DEFER, -+ "device parsing error failed - %d\n", irq); -+ } - - np = of_find_node_by_path("/testcase-data/platform-tests"); - unittest(np, "No testcase data in device tree\n"); -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 295bf1472d02..5073ab023123 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1064,12 +1064,12 @@ int pci_save_state(struct pci_dev *dev) - EXPORT_SYMBOL(pci_save_state); - - static void pci_restore_config_dword(struct pci_dev *pdev, int offset, -- u32 saved_val, int retry) -+ u32 saved_val, int retry, bool force) - { - u32 val; - - pci_read_config_dword(pdev, offset, &val); -- if (val == saved_val) -+ if (!force && val == saved_val) - return; - - for (;;) { -@@ -1088,25 +1088,36 @@ static void pci_restore_config_dword(struct pci_dev *pdev, int offset, - } - - static void pci_restore_config_space_range(struct pci_dev *pdev, -- int start, int end, int retry) -+ int start, int end, int retry, -+ bool force) - { - int index; - - for (index = end; index >= start; index--) - pci_restore_config_dword(pdev, 4 * index, - pdev->saved_config_space[index], -- retry); -+ retry, force); - } - - static void pci_restore_config_space(struct pci_dev *pdev) - { - if (pdev->hdr_type == PCI_HEADER_TYPE_NORMAL) { -- pci_restore_config_space_range(pdev, 10, 15, 0); -+ pci_restore_config_space_range(pdev, 10, 15, 0, false); - /* Restore BARs before the command register. */ -- pci_restore_config_space_range(pdev, 4, 9, 10); -- pci_restore_config_space_range(pdev, 0, 3, 0); -+ pci_restore_config_space_range(pdev, 4, 9, 10, false); -+ pci_restore_config_space_range(pdev, 0, 3, 0, false); -+ } else if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE) { -+ pci_restore_config_space_range(pdev, 12, 15, 0, false); -+ -+ /* -+ * Force rewriting of prefetch registers to avoid S3 resume -+ * issues on Intel PCI bridges that occur when these -+ * registers are not explicitly written. -+ */ -+ pci_restore_config_space_range(pdev, 9, 11, 0, true); -+ pci_restore_config_space_range(pdev, 0, 8, 0, false); - } else { -- pci_restore_config_space_range(pdev, 0, 15, 0); -+ pci_restore_config_space_range(pdev, 0, 15, 0, false); - } - } - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index cbf3be66f89c..d6e2199bcfe5 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -174,6 +174,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) - xhci->quirks |= XHCI_MISSING_CAS; -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index 2674da40d9cd..6d6acf2c07c3 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -87,7 +87,8 @@ DEVICE(moto_modem, MOTO_IDS); - - /* Motorola Tetra driver */ - #define MOTOROLA_TETRA_IDS() \ -- { USB_DEVICE(0x0cad, 0x9011) } /* Motorola Solutions TETRA PEI */ -+ { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \ -+ { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */ - DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); - - /* Novatel Wireless GPS driver */ -diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -index 9ddfdd63b84c..34ab4f950f0a 100644 ---- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -@@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi, - if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) - return -EFAULT; - -+ if (mr->w > 4096 || mr->h > 4096) -+ return -EINVAL; -+ - if (mr->w * mr->h * 3 > mr->buffer_size) - return -EINVAL; - -@@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi, - mr->x, mr->y, mr->w, mr->h); - - if (r > 0) { -- if (copy_to_user(mr->buffer, buf, mr->buffer_size)) -+ if (copy_to_user(mr->buffer, buf, r)) - r = -EFAULT; - } - -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index b51bb73b06a6..d0aaf338fa9f 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -220,12 +220,12 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) - { - int error; - -- if (buffer_verified(bh)) -- return 0; -- - if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || - BHDR(bh)->h_blocks != cpu_to_le32(1)) - return -EFSCORRUPTED; -+ if (buffer_verified(bh)) -+ return 0; -+ - if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) - return -EFSBADCRC; - error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, -diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c -index 0bb6de356451..7968b7a5e787 100644 ---- a/fs/ubifs/super.c -+++ b/fs/ubifs/super.c -@@ -1918,6 +1918,9 @@ static struct ubi_volume_desc *open_ubi(const char *name, int mode) - int dev, vol; - char *endptr; - -+ if (!name || !*name) -+ return ERR_PTR(-EINVAL); -+ - /* First, try to open using the device node path method */ - ubi = ubi_open_volume_path(name, mode); - if (!IS_ERR(ubi)) -diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h -index 2ea517c7c6b9..bffd096fae3b 100644 ---- a/include/linux/netfilter_bridge/ebtables.h -+++ b/include/linux/netfilter_bridge/ebtables.h -@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb, - /* True if the target is not a standard target */ - #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0) - -+static inline bool ebt_invalid_target(int target) -+{ -+ return (target < -NUM_STANDARD_TARGETS || target >= 0); -+} -+ - #endif -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index c28bd8be290a..a490dd718654 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2273,6 +2273,8 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) - kfree_skb(skb); - } - -+void skb_rbtree_purge(struct rb_root *root); -+ - void *netdev_alloc_frag(unsigned int fragsz); - - struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int length, -@@ -2807,6 +2809,12 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) - return __pskb_trim(skb, len); - } - -+#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) -+#define skb_rb_first(root) rb_to_skb(rb_first(root)) -+#define skb_rb_last(root) rb_to_skb(rb_last(root)) -+#define skb_rb_next(skb) rb_to_skb(rb_next(&(skb)->rbnode)) -+#define skb_rb_prev(skb) rb_to_skb(rb_prev(&(skb)->rbnode)) -+ - #define skb_queue_walk(queue, skb) \ - for (skb = (queue)->next; \ - skb != (struct sk_buff *)(queue); \ -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index 5b6df1a8dc74..747404dbe506 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -279,10 +279,9 @@ struct tcp_sock { - struct sk_buff* lost_skb_hint; - struct sk_buff *retransmit_skb_hint; - -- /* OOO segments go in this list. Note that socket lock must be held, -- * as we do not use sk_buff_head lock. -- */ -- struct sk_buff_head out_of_order_queue; -+ /* OOO segments go in this rbtree. Socket lock must be held. */ -+ struct rb_root out_of_order_queue; -+ struct sk_buff *ooo_last_skb; /* cache rb_last(out_of_order_queue) */ - - /* SACKs data, these 2 need to be together (see tcp_options_write) */ - struct tcp_sack_block duplicate_sack[1]; /* D-SACK block */ -diff --git a/include/net/sock.h b/include/net/sock.h -index 3d5ff7436f41..577075713ad5 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -2139,6 +2139,13 @@ sock_skb_set_dropcount(const struct sock *sk, struct sk_buff *skb) - SOCK_SKB_CB(skb)->dropcount = atomic_read(&sk->sk_drops); - } - -+static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb) -+{ -+ int segs = max_t(u16, 1, skb_shinfo(skb)->gso_segs); -+ -+ atomic_add(segs, &sk->sk_drops); -+} -+ - void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, - struct sk_buff *skb); - void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk, -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 6c89238f192e..a99f75ef6a73 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -649,7 +649,7 @@ static inline void tcp_fast_path_check(struct sock *sk) - { - struct tcp_sock *tp = tcp_sk(sk); - -- if (skb_queue_empty(&tp->out_of_order_queue) && -+ if (RB_EMPTY_ROOT(&tp->out_of_order_queue) && - tp->rcv_wnd && - atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf && - !tp->urg_data) -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 4cb94b678e9f..5299618d6308 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -4083,7 +4083,11 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) - */ - do { - css_task_iter_start(&from->self, &it); -- task = css_task_iter_next(&it); -+ -+ do { -+ task = css_task_iter_next(&it); -+ } while (task && (task->flags & PF_EXITING)); -+ - if (task) - get_task_struct(task); - css_task_iter_end(&it); -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 5712cdaae964..8895eff2d735 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -858,6 +858,9 @@ const char * const vmstat_text[] = { - #ifdef CONFIG_SMP - "nr_tlb_remote_flush", - "nr_tlb_remote_flush_received", -+#else -+ "", /* nr_tlb_remote_flush */ -+ "", /* nr_tlb_remote_flush_received */ - #endif /* CONFIG_SMP */ - "nr_tlb_local_flush_all", - "nr_tlb_local_flush_one", -diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c -index 070cf134a22f..f2660c1b29e4 100644 ---- a/net/bridge/netfilter/ebt_arpreply.c -+++ b/net/bridge/netfilter/ebt_arpreply.c -@@ -67,6 +67,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par) - if (e->ethproto != htons(ETH_P_ARP) || - e->invflags & EBT_IPROTO) - return -EINVAL; -+ if (ebt_invalid_target(info->target)) -+ return -EINVAL; -+ - return 0; - } - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 55be076706e5..9703924ed071 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2377,6 +2377,25 @@ void skb_queue_purge(struct sk_buff_head *list) - } - EXPORT_SYMBOL(skb_queue_purge); - -+/** -+ * skb_rbtree_purge - empty a skb rbtree -+ * @root: root of the rbtree to empty -+ * -+ * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from -+ * the list and one reference dropped. This function does not take -+ * any lock. Synchronization should be handled by the caller (e.g., TCP -+ * out-of-order queue is protected by the socket lock). -+ */ -+void skb_rbtree_purge(struct rb_root *root) -+{ -+ struct sk_buff *skb, *next; -+ -+ rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) -+ kfree_skb(skb); -+ -+ *root = RB_ROOT; -+} -+ - /** - * skb_queue_head - queue a buffer at the list head - * @list: list to use -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 5e162b8ab184..b7492aabe710 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -382,7 +382,7 @@ void tcp_init_sock(struct sock *sk) - struct inet_connection_sock *icsk = inet_csk(sk); - struct tcp_sock *tp = tcp_sk(sk); - -- __skb_queue_head_init(&tp->out_of_order_queue); -+ tp->out_of_order_queue = RB_ROOT; - tcp_init_xmit_timers(sk); - tcp_prequeue_init(tp); - INIT_LIST_HEAD(&tp->tsq_node); -@@ -2240,7 +2240,7 @@ int tcp_disconnect(struct sock *sk, int flags) - tcp_clear_xmit_timers(sk); - __skb_queue_purge(&sk->sk_receive_queue); - tcp_write_queue_purge(sk); -- __skb_queue_purge(&tp->out_of_order_queue); -+ skb_rbtree_purge(&tp->out_of_order_queue); - - inet->inet_dport = 0; - -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 9c4c6cd0316e..1aff93d76f24 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4073,7 +4073,7 @@ static void tcp_fin(struct sock *sk) - /* It _is_ possible, that we have something out-of-order _after_ FIN. - * Probably, we should reset in this case. For now drop them. - */ -- __skb_queue_purge(&tp->out_of_order_queue); -+ skb_rbtree_purge(&tp->out_of_order_queue); - if (tcp_is_sack(tp)) - tcp_sack_reset(&tp->rx_opt); - sk_mem_reclaim(sk); -@@ -4233,7 +4233,7 @@ static void tcp_sack_remove(struct tcp_sock *tp) - int this_sack; - - /* Empty ofo queue, hence, all the SACKs are eaten. Clear. */ -- if (skb_queue_empty(&tp->out_of_order_queue)) { -+ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) { - tp->rx_opt.num_sacks = 0; - return; - } -@@ -4296,6 +4296,29 @@ static bool tcp_try_coalesce(struct sock *sk, - return true; - } - -+static bool tcp_ooo_try_coalesce(struct sock *sk, -+ struct sk_buff *to, -+ struct sk_buff *from, -+ bool *fragstolen) -+{ -+ bool res = tcp_try_coalesce(sk, to, from, fragstolen); -+ -+ /* In case tcp_drop() is called later, update to->gso_segs */ -+ if (res) { -+ u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) + -+ max_t(u16, 1, skb_shinfo(from)->gso_segs); -+ -+ skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF); -+ } -+ return res; -+} -+ -+static void tcp_drop(struct sock *sk, struct sk_buff *skb) -+{ -+ sk_drops_add(sk, skb); -+ __kfree_skb(skb); -+} -+ - /* This one checks to see if we can put data from the - * out_of_order queue into the receive_queue. - */ -@@ -4303,10 +4326,13 @@ static void tcp_ofo_queue(struct sock *sk) - { - struct tcp_sock *tp = tcp_sk(sk); - __u32 dsack_high = tp->rcv_nxt; -+ bool fin, fragstolen, eaten; - struct sk_buff *skb, *tail; -- bool fragstolen, eaten; -+ struct rb_node *p; - -- while ((skb = skb_peek(&tp->out_of_order_queue)) != NULL) { -+ p = rb_first(&tp->out_of_order_queue); -+ while (p) { -+ skb = rb_entry(p, struct sk_buff, rbnode); - if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) - break; - -@@ -4316,11 +4342,12 @@ static void tcp_ofo_queue(struct sock *sk) - dsack_high = TCP_SKB_CB(skb)->end_seq; - tcp_dsack_extend(sk, TCP_SKB_CB(skb)->seq, dsack); - } -+ p = rb_next(p); -+ rb_erase(&skb->rbnode, &tp->out_of_order_queue); - -- __skb_unlink(skb, &tp->out_of_order_queue); -- if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) { -+ if (unlikely(!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))) { - SOCK_DEBUG(sk, "ofo packet was already received\n"); -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - continue; - } - SOCK_DEBUG(sk, "ofo requeuing : rcv_next %X seq %X - %X\n", -@@ -4330,12 +4357,19 @@ static void tcp_ofo_queue(struct sock *sk) - tail = skb_peek_tail(&sk->sk_receive_queue); - eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen); - tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq); -+ fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN; - if (!eaten) - __skb_queue_tail(&sk->sk_receive_queue, skb); -- if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) -- tcp_fin(sk); -- if (eaten) -+ else - kfree_skb_partial(skb, fragstolen); -+ -+ if (unlikely(fin)) { -+ tcp_fin(sk); -+ /* tcp_fin() purges tp->out_of_order_queue, -+ * so we must end this loop right now. -+ */ -+ break; -+ } - } - } - -@@ -4365,14 +4399,16 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb, - static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) - { - struct tcp_sock *tp = tcp_sk(sk); -+ struct rb_node **p, *q, *parent; - struct sk_buff *skb1; - u32 seq, end_seq; -+ bool fragstolen; - - tcp_ecn_check_ce(sk, skb); - - if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFODROP); -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - return; - } - -@@ -4381,89 +4417,89 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) - inet_csk_schedule_ack(sk); - - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOQUEUE); -+ seq = TCP_SKB_CB(skb)->seq; -+ end_seq = TCP_SKB_CB(skb)->end_seq; - SOCK_DEBUG(sk, "out of order segment: rcv_next %X seq %X - %X\n", -- tp->rcv_nxt, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq); -+ tp->rcv_nxt, seq, end_seq); - -- skb1 = skb_peek_tail(&tp->out_of_order_queue); -- if (!skb1) { -+ p = &tp->out_of_order_queue.rb_node; -+ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) { - /* Initial out of order segment, build 1 SACK. */ - if (tcp_is_sack(tp)) { - tp->rx_opt.num_sacks = 1; -- tp->selective_acks[0].start_seq = TCP_SKB_CB(skb)->seq; -- tp->selective_acks[0].end_seq = -- TCP_SKB_CB(skb)->end_seq; -- } -- __skb_queue_head(&tp->out_of_order_queue, skb); -- goto end; -- } -- -- seq = TCP_SKB_CB(skb)->seq; -- end_seq = TCP_SKB_CB(skb)->end_seq; -- -- if (seq == TCP_SKB_CB(skb1)->end_seq) { -- bool fragstolen; -- -- if (!tcp_try_coalesce(sk, skb1, skb, &fragstolen)) { -- __skb_queue_after(&tp->out_of_order_queue, skb1, skb); -- } else { -- tcp_grow_window(sk, skb); -- kfree_skb_partial(skb, fragstolen); -- skb = NULL; -+ tp->selective_acks[0].start_seq = seq; -+ tp->selective_acks[0].end_seq = end_seq; - } -- -- if (!tp->rx_opt.num_sacks || -- tp->selective_acks[0].end_seq != seq) -- goto add_sack; -- -- /* Common case: data arrive in order after hole. */ -- tp->selective_acks[0].end_seq = end_seq; -+ rb_link_node(&skb->rbnode, NULL, p); -+ rb_insert_color(&skb->rbnode, &tp->out_of_order_queue); -+ tp->ooo_last_skb = skb; - goto end; - } - -- /* Find place to insert this segment. */ -- while (1) { -- if (!after(TCP_SKB_CB(skb1)->seq, seq)) -- break; -- if (skb_queue_is_first(&tp->out_of_order_queue, skb1)) { -- skb1 = NULL; -- break; -+ /* In the typical case, we are adding an skb to the end of the list. -+ * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup. -+ */ -+ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, -+ skb, &fragstolen)) { -+coalesce_done: -+ tcp_grow_window(sk, skb); -+ kfree_skb_partial(skb, fragstolen); -+ skb = NULL; -+ goto add_sack; -+ } -+ -+ /* Find place to insert this segment. Handle overlaps on the way. */ -+ parent = NULL; -+ while (*p) { -+ parent = *p; -+ skb1 = rb_entry(parent, struct sk_buff, rbnode); -+ if (before(seq, TCP_SKB_CB(skb1)->seq)) { -+ p = &parent->rb_left; -+ continue; - } -- skb1 = skb_queue_prev(&tp->out_of_order_queue, skb1); -- } - -- /* Do skb overlap to previous one? */ -- if (skb1 && before(seq, TCP_SKB_CB(skb1)->end_seq)) { -- if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) { -- /* All the bits are present. Drop. */ -- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOMERGE); -- __kfree_skb(skb); -- skb = NULL; -- tcp_dsack_set(sk, seq, end_seq); -- goto add_sack; -- } -- if (after(seq, TCP_SKB_CB(skb1)->seq)) { -- /* Partial overlap. */ -- tcp_dsack_set(sk, seq, -- TCP_SKB_CB(skb1)->end_seq); -- } else { -- if (skb_queue_is_first(&tp->out_of_order_queue, -- skb1)) -- skb1 = NULL; -- else -- skb1 = skb_queue_prev( -- &tp->out_of_order_queue, -- skb1); -+ if (before(seq, TCP_SKB_CB(skb1)->end_seq)) { -+ if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) { -+ /* All the bits are present. Drop. */ -+ NET_INC_STATS(sock_net(sk), -+ LINUX_MIB_TCPOFOMERGE); -+ tcp_drop(sk, skb); -+ skb = NULL; -+ tcp_dsack_set(sk, seq, end_seq); -+ goto add_sack; -+ } -+ if (after(seq, TCP_SKB_CB(skb1)->seq)) { -+ /* Partial overlap. */ -+ tcp_dsack_set(sk, seq, TCP_SKB_CB(skb1)->end_seq); -+ } else { -+ /* skb's seq == skb1's seq and skb covers skb1. -+ * Replace skb1 with skb. -+ */ -+ rb_replace_node(&skb1->rbnode, &skb->rbnode, -+ &tp->out_of_order_queue); -+ tcp_dsack_extend(sk, -+ TCP_SKB_CB(skb1)->seq, -+ TCP_SKB_CB(skb1)->end_seq); -+ NET_INC_STATS(sock_net(sk), -+ LINUX_MIB_TCPOFOMERGE); -+ tcp_drop(sk, skb1); -+ goto merge_right; -+ } -+ } else if (tcp_ooo_try_coalesce(sk, skb1, -+ skb, &fragstolen)) { -+ goto coalesce_done; - } -+ p = &parent->rb_right; - } -- if (!skb1) -- __skb_queue_head(&tp->out_of_order_queue, skb); -- else -- __skb_queue_after(&tp->out_of_order_queue, skb1, skb); - -- /* And clean segments covered by new one as whole. */ -- while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) { -- skb1 = skb_queue_next(&tp->out_of_order_queue, skb); -+ /* Insert segment into RB tree. */ -+ rb_link_node(&skb->rbnode, parent, p); -+ rb_insert_color(&skb->rbnode, &tp->out_of_order_queue); - -+merge_right: -+ /* Remove other segments covered by skb. */ -+ while ((q = rb_next(&skb->rbnode)) != NULL) { -+ skb1 = rb_entry(q, struct sk_buff, rbnode); - if (!after(end_seq, TCP_SKB_CB(skb1)->seq)) - break; - if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) { -@@ -4471,12 +4507,15 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) - end_seq); - break; - } -- __skb_unlink(skb1, &tp->out_of_order_queue); -+ rb_erase(&skb1->rbnode, &tp->out_of_order_queue); - tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq, - TCP_SKB_CB(skb1)->end_seq); - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOMERGE); -- __kfree_skb(skb1); -+ tcp_drop(sk, skb1); - } -+ /* If there is no skb after us, we are the last_skb ! */ -+ if (!q) -+ tp->ooo_last_skb = skb; - - add_sack: - if (tcp_is_sack(tp)) -@@ -4558,12 +4597,13 @@ err: - static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) - { - struct tcp_sock *tp = tcp_sk(sk); -- int eaten = -1; - bool fragstolen = false; -+ int eaten = -1; - -- if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) -- goto drop; -- -+ if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) { -+ __kfree_skb(skb); -+ return; -+ } - skb_dst_drop(skb); - __skb_pull(skb, tcp_hdr(skb)->doff * 4); - -@@ -4614,13 +4654,13 @@ queue_and_out: - if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) - tcp_fin(sk); - -- if (!skb_queue_empty(&tp->out_of_order_queue)) { -+ if (!RB_EMPTY_ROOT(&tp->out_of_order_queue)) { - tcp_ofo_queue(sk); - - /* RFC2581. 4.2. SHOULD send immediate ACK, when - * gap in queue is filled. - */ -- if (skb_queue_empty(&tp->out_of_order_queue)) -+ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) - inet_csk(sk)->icsk_ack.pingpong = 0; - } - -@@ -4645,7 +4685,7 @@ out_of_window: - tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); - inet_csk_schedule_ack(sk); - drop: -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - return; - } - -@@ -4672,48 +4712,76 @@ drop: - tcp_data_queue_ofo(sk, skb); - } - -+static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *list) -+{ -+ if (list) -+ return !skb_queue_is_last(list, skb) ? skb->next : NULL; -+ -+ return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode); -+} -+ - static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, -- struct sk_buff_head *list) -+ struct sk_buff_head *list, -+ struct rb_root *root) - { -- struct sk_buff *next = NULL; -+ struct sk_buff *next = tcp_skb_next(skb, list); - -- if (!skb_queue_is_last(list, skb)) -- next = skb_queue_next(list, skb); -+ if (list) -+ __skb_unlink(skb, list); -+ else -+ rb_erase(&skb->rbnode, root); - -- __skb_unlink(skb, list); - __kfree_skb(skb); - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOLLAPSED); - - return next; - } - -+/* Insert skb into rb tree, ordered by TCP_SKB_CB(skb)->seq */ -+static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb) -+{ -+ struct rb_node **p = &root->rb_node; -+ struct rb_node *parent = NULL; -+ struct sk_buff *skb1; -+ -+ while (*p) { -+ parent = *p; -+ skb1 = rb_entry(parent, struct sk_buff, rbnode); -+ if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq)) -+ p = &parent->rb_left; -+ else -+ p = &parent->rb_right; -+ } -+ rb_link_node(&skb->rbnode, parent, p); -+ rb_insert_color(&skb->rbnode, root); -+} -+ - /* Collapse contiguous sequence of skbs head..tail with - * sequence numbers start..end. - * -- * If tail is NULL, this means until the end of the list. -+ * If tail is NULL, this means until the end of the queue. - * - * Segments with FIN/SYN are not collapsed (only because this - * simplifies code) - */ - static void --tcp_collapse(struct sock *sk, struct sk_buff_head *list, -- struct sk_buff *head, struct sk_buff *tail, -- u32 start, u32 end) -+tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root, -+ struct sk_buff *head, struct sk_buff *tail, u32 start, u32 end) - { -- struct sk_buff *skb, *n; -+ struct sk_buff *skb = head, *n; -+ struct sk_buff_head tmp; - bool end_of_skbs; - - /* First, check that queue is collapsible and find -- * the point where collapsing can be useful. */ -- skb = head; -+ * the point where collapsing can be useful. -+ */ - restart: -- end_of_skbs = true; -- skb_queue_walk_from_safe(list, skb, n) { -- if (skb == tail) -- break; -+ for (end_of_skbs = true; skb != NULL && skb != tail; skb = n) { -+ n = tcp_skb_next(skb, list); -+ - /* No new bits? It is possible on ofo queue. */ - if (!before(start, TCP_SKB_CB(skb)->end_seq)) { -- skb = tcp_collapse_one(sk, skb, list); -+ skb = tcp_collapse_one(sk, skb, list, root); - if (!skb) - break; - goto restart; -@@ -4731,13 +4799,10 @@ restart: - break; - } - -- if (!skb_queue_is_last(list, skb)) { -- struct sk_buff *next = skb_queue_next(list, skb); -- if (next != tail && -- TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(next)->seq) { -- end_of_skbs = false; -- break; -- } -+ if (n && n != tail && -+ TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(n)->seq) { -+ end_of_skbs = false; -+ break; - } - - /* Decided to skip this, advance start seq. */ -@@ -4747,17 +4812,22 @@ restart: - (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN))) - return; - -+ __skb_queue_head_init(&tmp); -+ - while (before(start, end)) { - int copy = min_t(int, SKB_MAX_ORDER(0, 0), end - start); - struct sk_buff *nskb; - - nskb = alloc_skb(copy, GFP_ATOMIC); - if (!nskb) -- return; -+ break; - - memcpy(nskb->cb, skb->cb, sizeof(skb->cb)); - TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start; -- __skb_queue_before(list, skb, nskb); -+ if (list) -+ __skb_queue_before(list, skb, nskb); -+ else -+ __skb_queue_tail(&tmp, nskb); /* defer rbtree insertion */ - skb_set_owner_r(nskb, sk); - - /* Copy data, releasing collapsed skbs. */ -@@ -4775,14 +4845,17 @@ restart: - start += size; - } - if (!before(start, TCP_SKB_CB(skb)->end_seq)) { -- skb = tcp_collapse_one(sk, skb, list); -+ skb = tcp_collapse_one(sk, skb, list, root); - if (!skb || - skb == tail || - (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN))) -- return; -+ goto end; - } - } - } -+end: -+ skb_queue_walk_safe(&tmp, skb, n) -+ tcp_rbtree_insert(root, skb); - } - - /* Collapse ofo queue. Algorithm: select contiguous sequence of skbs -@@ -4792,34 +4865,39 @@ static void tcp_collapse_ofo_queue(struct sock *sk) - { - struct tcp_sock *tp = tcp_sk(sk); - u32 range_truesize, sum_tiny = 0; -- struct sk_buff *skb = skb_peek(&tp->out_of_order_queue); -- struct sk_buff *head; -+ struct sk_buff *skb, *head; -+ struct rb_node *p; - u32 start, end; - -- if (!skb) -+ p = rb_first(&tp->out_of_order_queue); -+ skb = rb_entry_safe(p, struct sk_buff, rbnode); -+new_range: -+ if (!skb) { -+ p = rb_last(&tp->out_of_order_queue); -+ /* Note: This is possible p is NULL here. We do not -+ * use rb_entry_safe(), as ooo_last_skb is valid only -+ * if rbtree is not empty. -+ */ -+ tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode); - return; -- -+ } - start = TCP_SKB_CB(skb)->seq; - end = TCP_SKB_CB(skb)->end_seq; - range_truesize = skb->truesize; -- head = skb; - -- for (;;) { -- struct sk_buff *next = NULL; -+ for (head = skb;;) { -+ skb = tcp_skb_next(skb, NULL); - -- if (!skb_queue_is_last(&tp->out_of_order_queue, skb)) -- next = skb_queue_next(&tp->out_of_order_queue, skb); -- skb = next; -- -- /* Segment is terminated when we see gap or when -- * we are at the end of all the queue. */ -+ /* Range is terminated when we see a gap or when -+ * we are at the queue end. -+ */ - if (!skb || - after(TCP_SKB_CB(skb)->seq, end) || - before(TCP_SKB_CB(skb)->end_seq, start)) { - /* Do not attempt collapsing tiny skbs */ - if (range_truesize != head->truesize || - end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) { -- tcp_collapse(sk, &tp->out_of_order_queue, -+ tcp_collapse(sk, NULL, &tp->out_of_order_queue, - head, skb, start, end); - } else { - sum_tiny += range_truesize; -@@ -4827,47 +4905,60 @@ static void tcp_collapse_ofo_queue(struct sock *sk) - return; - } - -- head = skb; -- if (!skb) -- break; -- /* Start new segment */ -+ goto new_range; -+ } -+ -+ range_truesize += skb->truesize; -+ if (unlikely(before(TCP_SKB_CB(skb)->seq, start))) - start = TCP_SKB_CB(skb)->seq; -+ if (after(TCP_SKB_CB(skb)->end_seq, end)) - end = TCP_SKB_CB(skb)->end_seq; -- range_truesize = skb->truesize; -- } else { -- range_truesize += skb->truesize; -- if (before(TCP_SKB_CB(skb)->seq, start)) -- start = TCP_SKB_CB(skb)->seq; -- if (after(TCP_SKB_CB(skb)->end_seq, end)) -- end = TCP_SKB_CB(skb)->end_seq; -- } - } - } - - /* - * Purge the out-of-order queue. -+ * Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks. - * Return true if queue was pruned. - */ - static bool tcp_prune_ofo_queue(struct sock *sk) - { - struct tcp_sock *tp = tcp_sk(sk); -- bool res = false; -+ struct rb_node *node, *prev; -+ int goal; - -- if (!skb_queue_empty(&tp->out_of_order_queue)) { -- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_OFOPRUNED); -- __skb_queue_purge(&tp->out_of_order_queue); -+ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) -+ return false; - -- /* Reset SACK state. A conforming SACK implementation will -- * do the same at a timeout based retransmit. When a connection -- * is in a sad state like this, we care only about integrity -- * of the connection not performance. -- */ -- if (tp->rx_opt.sack_ok) -- tcp_sack_reset(&tp->rx_opt); -- sk_mem_reclaim(sk); -- res = true; -- } -- return res; -+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_OFOPRUNED); -+ goal = sk->sk_rcvbuf >> 3; -+ node = &tp->ooo_last_skb->rbnode; -+ do { -+ prev = rb_prev(node); -+ rb_erase(node, &tp->out_of_order_queue); -+ goal -= rb_to_skb(node)->truesize; -+ __kfree_skb(rb_to_skb(node)); -+ if (!prev || goal <= 0) { -+ sk_mem_reclaim(sk); -+ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && -+ !tcp_under_memory_pressure(sk)) -+ break; -+ goal = sk->sk_rcvbuf >> 3; -+ } -+ -+ node = prev; -+ } while (node); -+ tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); -+ -+ /* Reset SACK state. A conforming SACK implementation will -+ * do the same at a timeout based retransmit. When a connection -+ * is in a sad state like this, we care only about integrity -+ * of the connection not performance. -+ */ -+ if (tp->rx_opt.sack_ok) -+ tcp_sack_reset(&tp->rx_opt); -+ -+ return true; - } - - /* Reduce allocated memory if we can, trying to get -@@ -4895,7 +4986,7 @@ static int tcp_prune_queue(struct sock *sk) - - tcp_collapse_ofo_queue(sk); - if (!skb_queue_empty(&sk->sk_receive_queue)) -- tcp_collapse(sk, &sk->sk_receive_queue, -+ tcp_collapse(sk, &sk->sk_receive_queue, NULL, - skb_peek(&sk->sk_receive_queue), - NULL, - tp->copied_seq, tp->rcv_nxt); -@@ -5000,7 +5091,7 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible) - /* We ACK each frame or... */ - tcp_in_quickack_mode(sk) || - /* We have out of order data. */ -- (ofo_possible && skb_peek(&tp->out_of_order_queue))) { -+ (ofo_possible && !RB_EMPTY_ROOT(&tp->out_of_order_queue))) { - /* Then ack it now */ - tcp_send_ack(sk); - } else { -@@ -5236,7 +5327,7 @@ syn_challenge: - return true; - - discard: -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - return false; - } - -@@ -5454,7 +5545,7 @@ csum_error: - TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS); - - discard: -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - } - EXPORT_SYMBOL(tcp_rcv_established); - -@@ -5684,7 +5775,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, - TCP_DELACK_MAX, TCP_RTO_MAX); - - discard: -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - return 0; - } else { - tcp_send_ack(sk); -@@ -6041,7 +6132,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) - - if (!queued) { - discard: -- __kfree_skb(skb); -+ tcp_drop(sk, skb); - } - return 0; - } -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index eeda67c3dd11..ee8399f11fd0 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1716,6 +1716,7 @@ discard_it: - return 0; - - discard_and_relse: -+ sk_drops_add(sk, skb); - sock_put(sk); - goto discard_it; - -@@ -1829,7 +1830,7 @@ void tcp_v4_destroy_sock(struct sock *sk) - tcp_write_queue_purge(sk); - - /* Cleans up our, hopefully empty, out_of_order_queue. */ -- __skb_queue_purge(&tp->out_of_order_queue); -+ skb_rbtree_purge(&tp->out_of_order_queue); - - #ifdef CONFIG_TCP_MD5SIG - /* Clean up the MD5 key list, if any */ -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index d270870bf492..a48846d81b41 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -496,7 +496,6 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, - newtp->snd_cwnd_cnt = 0; - - tcp_init_xmit_timers(newsk); -- __skb_queue_head_init(&newtp->out_of_order_queue); - newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1; - - newtp->rx_opt.saw_tstamp = 0; -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 90abe88e1b40..d6c191158e07 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1505,6 +1505,7 @@ discard_it: - return 0; - - discard_and_relse: -+ sk_drops_add(sk, skb); - sock_put(sk); - goto discard_it; - -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 1f930032253a..67348d8ac35d 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -219,7 +219,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, - case NL80211_IFTYPE_AP: - case NL80211_IFTYPE_AP_VLAN: - /* Keys without a station are used for TX only */ -- if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP)) -+ if (sta && test_sta_flag(sta, WLAN_STA_MFP)) - key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT; - break; - case NL80211_IFTYPE_ADHOC: diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.161-162.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.161-162.patch deleted file mode 100644 index d8efae3e333d..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.161-162.patch +++ /dev/null @@ -1,2111 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/net/macb.txt b/Documentation/devicetree/bindings/net/macb.txt -index b5d79761ac97..410c044166e2 100644 ---- a/Documentation/devicetree/bindings/net/macb.txt -+++ b/Documentation/devicetree/bindings/net/macb.txt -@@ -8,6 +8,7 @@ Required properties: - Use "cdns,pc302-gem" for Picochip picoXcell pc302 and later devices based on - the Cadence GEM, or the generic form: "cdns,gem". - Use "atmel,sama5d2-gem" for the GEM IP (10/100) available on Atmel sama5d2 SoCs. -+ Use "atmel,sama5d3-macb" for the 10/100Mbit IP available on Atmel sama5d3 SoCs. - Use "atmel,sama5d3-gem" for the Gigabit IP available on Atmel sama5d3 SoCs. - Use "atmel,sama5d4-gem" for the GEM IP (10/100) available on Atmel sama5d4 SoCs. - Use "cdns,zynqmp-gem" for Zynq Ultrascale+ MPSoC. -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 3fd53e193b7f..da515c535e62 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -961,11 +961,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - See Documentation/x86/intel_mpx.txt for more - information about the feature. - -- eagerfpu= [X86] -- on enable eager fpu restore -- off disable eager fpu restore -- auto selects the default scheme, which automatically -- enables eagerfpu restore for xsaveopt. - - module.async_probe [KNL] - Enable asynchronous probe on this module. -diff --git a/Makefile b/Makefile -index 57e4ff1a8b96..00ff2dd68ff1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 161 -+SUBLEVEL = 162 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/Makefile b/arch/arc/Makefile -index b9f7306412e5..9d64eacdd2aa 100644 ---- a/arch/arc/Makefile -+++ b/arch/arc/Makefile -@@ -18,20 +18,6 @@ cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ - cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 - cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs - --is_700 = $(shell $(CC) -dM -E - < /dev/null | grep -q "ARC700" && echo 1 || echo 0) -- --ifdef CONFIG_ISA_ARCOMPACT --ifeq ($(is_700), 0) -- $(error Toolchain not configured for ARCompact builds) --endif --endif -- --ifdef CONFIG_ISA_ARCV2 --ifeq ($(is_700), 1) -- $(error Toolchain not configured for ARCv2 builds) --endif --endif -- - ifdef CONFIG_ARC_CURR_IN_REG - # For a global register defintion, make sure it gets passed to every file - # We had a customer reported bug where some code built in kernel was NOT using -diff --git a/arch/arm/boot/dts/sama5d3_emac.dtsi b/arch/arm/boot/dts/sama5d3_emac.dtsi -index 7cb235ef0fb6..6e9e1c2f9def 100644 ---- a/arch/arm/boot/dts/sama5d3_emac.dtsi -+++ b/arch/arm/boot/dts/sama5d3_emac.dtsi -@@ -41,7 +41,7 @@ - }; - - macb1: ethernet@f802c000 { -- compatible = "cdns,at91sam9260-macb", "cdns,macb"; -+ compatible = "atmel,sama5d3-macb", "cdns,at91sam9260-macb", "cdns,macb"; - reg = <0xf802c000 0x100>; - interrupts = <35 IRQ_TYPE_LEVEL_HIGH 3>; - pinctrl-names = "default"; -diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S -index b7019b559ddb..2d2860711e07 100644 ---- a/arch/powerpc/kernel/tm.S -+++ b/arch/powerpc/kernel/tm.S -@@ -199,13 +199,27 @@ dont_backup_fp: - std r1, PACATMSCRATCH(r13) - ld r1, PACAR1(r13) - -- /* Store the PPR in r11 and reset to decent value */ - std r11, GPR11(r1) /* Temporary stash */ - -+ /* -+ * Move the saved user r1 to the kernel stack in case PACATMSCRATCH is -+ * clobbered by an exception once we turn on MSR_RI below. -+ */ -+ ld r11, PACATMSCRATCH(r13) -+ std r11, GPR1(r1) -+ -+ /* -+ * Store r13 away so we can free up the scratch SPR for the SLB fault -+ * handler (needed once we start accessing the thread_struct). -+ */ -+ GET_SCRATCH0(r11) -+ std r11, GPR13(r1) -+ - /* Reset MSR RI so we can take SLB faults again */ - li r11, MSR_RI - mtmsrd r11, 1 - -+ /* Store the PPR in r11 and reset to decent value */ - mfspr r11, SPRN_PPR - HMT_MEDIUM - -@@ -230,11 +244,11 @@ dont_backup_fp: - SAVE_GPR(8, r7) /* user r8 */ - SAVE_GPR(9, r7) /* user r9 */ - SAVE_GPR(10, r7) /* user r10 */ -- ld r3, PACATMSCRATCH(r13) /* user r1 */ -+ ld r3, GPR1(r1) /* user r1 */ - ld r4, GPR7(r1) /* user r7 */ - ld r5, GPR11(r1) /* user r11 */ - ld r6, GPR12(r1) /* user r12 */ -- GET_SCRATCH0(8) /* user r13 */ -+ ld r8, GPR13(r1) /* user r13 */ - std r3, GPR1(r7) - std r4, GPR7(r7) - std r5, GPR11(r7) -diff --git a/arch/x86/crypto/crc32c-intel_glue.c b/arch/x86/crypto/crc32c-intel_glue.c -index 715399b14ed7..c194d5717ae5 100644 ---- a/arch/x86/crypto/crc32c-intel_glue.c -+++ b/arch/x86/crypto/crc32c-intel_glue.c -@@ -48,21 +48,13 @@ - #ifdef CONFIG_X86_64 - /* - * use carryless multiply version of crc32c when buffer -- * size is >= 512 (when eager fpu is enabled) or -- * >= 1024 (when eager fpu is disabled) to account -+ * size is >= 512 to account - * for fpu state save/restore overhead. - */ --#define CRC32C_PCL_BREAKEVEN_EAGERFPU 512 --#define CRC32C_PCL_BREAKEVEN_NOEAGERFPU 1024 -+#define CRC32C_PCL_BREAKEVEN 512 - - asmlinkage unsigned int crc_pcl(const u8 *buffer, int len, - unsigned int crc_init); --static int crc32c_pcl_breakeven = CRC32C_PCL_BREAKEVEN_EAGERFPU; --#define set_pcl_breakeven_point() \ --do { \ -- if (!use_eager_fpu()) \ -- crc32c_pcl_breakeven = CRC32C_PCL_BREAKEVEN_NOEAGERFPU; \ --} while (0) - #endif /* CONFIG_X86_64 */ - - static u32 crc32c_intel_le_hw_byte(u32 crc, unsigned char const *data, size_t length) -@@ -185,7 +177,7 @@ static int crc32c_pcl_intel_update(struct shash_desc *desc, const u8 *data, - * use faster PCL version if datasize is large enough to - * overcome kernel fpu state save/restore overhead - */ -- if (len >= crc32c_pcl_breakeven && irq_fpu_usable()) { -+ if (len >= CRC32C_PCL_BREAKEVEN && irq_fpu_usable()) { - kernel_fpu_begin(); - *crcp = crc_pcl(data, len, *crcp); - kernel_fpu_end(); -@@ -197,7 +189,7 @@ static int crc32c_pcl_intel_update(struct shash_desc *desc, const u8 *data, - static int __crc32c_pcl_intel_finup(u32 *crcp, const u8 *data, unsigned int len, - u8 *out) - { -- if (len >= crc32c_pcl_breakeven && irq_fpu_usable()) { -+ if (len >= CRC32C_PCL_BREAKEVEN && irq_fpu_usable()) { - kernel_fpu_begin(); - *(__le32 *)out = ~cpu_to_le32(crc_pcl(data, len, *crcp)); - kernel_fpu_end(); -@@ -256,7 +248,6 @@ static int __init crc32c_intel_mod_init(void) - alg.update = crc32c_pcl_intel_update; - alg.finup = crc32c_pcl_intel_finup; - alg.digest = crc32c_pcl_intel_digest; -- set_pcl_breakeven_point(); - } - #endif - return crypto_register_shash(&alg); -diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h -index dd2269dcbc47..a5fa3195a230 100644 ---- a/arch/x86/include/asm/cpufeatures.h -+++ b/arch/x86/include/asm/cpufeatures.h -@@ -104,7 +104,6 @@ - #define X86_FEATURE_EXTD_APICID ( 3*32+26) /* has extended APICID (8 bits) */ - #define X86_FEATURE_AMD_DCM ( 3*32+27) /* multi-node processor */ - #define X86_FEATURE_APERFMPERF ( 3*32+28) /* APERFMPERF */ --/* free, was #define X86_FEATURE_EAGER_FPU ( 3*32+29) * "eagerfpu" Non lazy FPU restore */ - #define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ - - /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ -diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index ec2aedb6f92a..16825dda18dc 100644 ---- a/arch/x86/include/asm/fpu/internal.h -+++ b/arch/x86/include/asm/fpu/internal.h -@@ -57,11 +57,6 @@ extern u64 fpu__get_supported_xfeatures_mask(void); - /* - * FPU related CPU feature flag helper routines: - */ --static __always_inline __pure bool use_eager_fpu(void) --{ -- return true; --} -- - static __always_inline __pure bool use_xsaveopt(void) - { - return static_cpu_has(X86_FEATURE_XSAVEOPT); -@@ -498,24 +493,6 @@ static inline int fpu_want_lazy_restore(struct fpu *fpu, unsigned int cpu) - } - - --/* -- * Wrap lazy FPU TS handling in a 'hw fpregs activation/deactivation' -- * idiom, which is then paired with the sw-flag (fpregs_active) later on: -- */ -- --static inline void __fpregs_activate_hw(void) --{ -- if (!use_eager_fpu()) -- clts(); --} -- --static inline void __fpregs_deactivate_hw(void) --{ -- if (!use_eager_fpu()) -- stts(); --} -- --/* Must be paired with an 'stts' (fpregs_deactivate_hw()) after! */ - static inline void __fpregs_deactivate(struct fpu *fpu) - { - WARN_ON_FPU(!fpu->fpregs_active); -@@ -524,7 +501,6 @@ static inline void __fpregs_deactivate(struct fpu *fpu) - this_cpu_write(fpu_fpregs_owner_ctx, NULL); - } - --/* Must be paired with a 'clts' (fpregs_activate_hw()) before! */ - static inline void __fpregs_activate(struct fpu *fpu) - { - WARN_ON_FPU(fpu->fpregs_active); -@@ -549,22 +525,17 @@ static inline int fpregs_active(void) - } - - /* -- * Encapsulate the CR0.TS handling together with the -- * software flag. -- * - * These generally need preemption protection to work, - * do try to avoid using these on their own. - */ - static inline void fpregs_activate(struct fpu *fpu) - { -- __fpregs_activate_hw(); - __fpregs_activate(fpu); - } - - static inline void fpregs_deactivate(struct fpu *fpu) - { - __fpregs_deactivate(fpu); -- __fpregs_deactivate_hw(); - } - - /* -@@ -591,8 +562,7 @@ switch_fpu_prepare(struct fpu *old_fpu, struct fpu *new_fpu, int cpu) - * or if the past 5 consecutive context-switches used math. - */ - fpu.preload = static_cpu_has(X86_FEATURE_FPU) && -- new_fpu->fpstate_active && -- (use_eager_fpu() || new_fpu->counter > 5); -+ new_fpu->fpstate_active; - - if (old_fpu->fpregs_active) { - if (!copy_fpregs_to_fpstate(old_fpu)) -@@ -605,17 +575,12 @@ switch_fpu_prepare(struct fpu *old_fpu, struct fpu *new_fpu, int cpu) - - /* Don't change CR0.TS if we just switch! */ - if (fpu.preload) { -- new_fpu->counter++; - __fpregs_activate(new_fpu); - prefetch(&new_fpu->state); -- } else { -- __fpregs_deactivate_hw(); - } - } else { -- old_fpu->counter = 0; - old_fpu->last_cpu = -1; - if (fpu.preload) { -- new_fpu->counter++; - if (fpu_want_lazy_restore(new_fpu, cpu)) - fpu.preload = 0; - else -diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h -index 1c6f6ac52ad0..0d81c7d6fe96 100644 ---- a/arch/x86/include/asm/fpu/types.h -+++ b/arch/x86/include/asm/fpu/types.h -@@ -302,17 +302,6 @@ struct fpu { - */ - unsigned char fpregs_active; - -- /* -- * @counter: -- * -- * This counter contains the number of consecutive context switches -- * during which the FPU stays used. If this is over a threshold, the -- * lazy FPU restore logic becomes eager, to save the trap overhead. -- * This is an unsigned char so that after 256 iterations the counter -- * wraps and the context switch behavior turns lazy again; this is to -- * deal with bursty apps that only use the FPU for a short time: -- */ -- unsigned char counter; - /* - * @state: - * -@@ -321,29 +310,6 @@ struct fpu { - * the registers in the FPU are more recent than this state - * copy. If the task context-switches away then they get - * saved here and represent the FPU state. -- * -- * After context switches there may be a (short) time period -- * during which the in-FPU hardware registers are unchanged -- * and still perfectly match this state, if the tasks -- * scheduled afterwards are not using the FPU. -- * -- * This is the 'lazy restore' window of optimization, which -- * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'. -- * -- * We detect whether a subsequent task uses the FPU via setting -- * CR0::TS to 1, which causes any FPU use to raise a #NM fault. -- * -- * During this window, if the task gets scheduled again, we -- * might be able to skip having to do a restore from this -- * memory buffer to the hardware registers - at the cost of -- * incurring the overhead of #NM fault traps. -- * -- * Note that on modern CPUs that support the XSAVEOPT (or other -- * optimized XSAVE instructions), we don't use #NM traps anymore, -- * as the hardware can track whether FPU registers need saving -- * or not. On such CPUs we activate the non-lazy ('eagerfpu') -- * logic, which unconditionally saves/restores all FPU state -- * across context switches. (if FPU state exists.) - */ - union fpregs_state state; - /* -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 74fda1a453bd..3a37cdbdfbaa 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -439,7 +439,6 @@ struct kvm_vcpu_arch { - struct kvm_mmu_memory_cache mmu_page_header_cache; - - struct fpu guest_fpu; -- bool eager_fpu; - u64 xcr0; - u64 guest_supported_xcr0; - u32 guest_xstate_size; -diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c -index 6aa0b519c851..b322325424bc 100644 ---- a/arch/x86/kernel/fpu/core.c -+++ b/arch/x86/kernel/fpu/core.c -@@ -53,27 +53,9 @@ static bool kernel_fpu_disabled(void) - return this_cpu_read(in_kernel_fpu); - } - --/* -- * Were we in an interrupt that interrupted kernel mode? -- * -- * On others, we can do a kernel_fpu_begin/end() pair *ONLY* if that -- * pair does nothing at all: the thread must not have fpu (so -- * that we don't try to save the FPU state), and TS must -- * be set (so that the clts/stts pair does nothing that is -- * visible in the interrupted kernel thread). -- * -- * Except for the eagerfpu case when we return true; in the likely case -- * the thread has FPU but we are not going to set/clear TS. -- */ - static bool interrupted_kernel_fpu_idle(void) - { -- if (kernel_fpu_disabled()) -- return false; -- -- if (use_eager_fpu()) -- return true; -- -- return !current->thread.fpu.fpregs_active && (read_cr0() & X86_CR0_TS); -+ return !kernel_fpu_disabled(); - } - - /* -@@ -121,7 +103,6 @@ void __kernel_fpu_begin(void) - copy_fpregs_to_fpstate(fpu); - } else { - this_cpu_write(fpu_fpregs_owner_ctx, NULL); -- __fpregs_activate_hw(); - } - } - EXPORT_SYMBOL(__kernel_fpu_begin); -@@ -132,8 +113,6 @@ void __kernel_fpu_end(void) - - if (fpu->fpregs_active) - copy_kernel_to_fpregs(&fpu->state); -- else -- __fpregs_deactivate_hw(); - - kernel_fpu_enable(); - } -@@ -194,10 +173,7 @@ void fpu__save(struct fpu *fpu) - preempt_disable(); - if (fpu->fpregs_active) { - if (!copy_fpregs_to_fpstate(fpu)) { -- if (use_eager_fpu()) -- copy_kernel_to_fpregs(&fpu->state); -- else -- fpregs_deactivate(fpu); -+ copy_kernel_to_fpregs(&fpu->state); - } - } - preempt_enable(); -@@ -245,8 +221,7 @@ static void fpu_copy(struct fpu *dst_fpu, struct fpu *src_fpu) - * Don't let 'init optimized' areas of the XSAVE area - * leak into the child task: - */ -- if (use_eager_fpu()) -- memset(&dst_fpu->state.xsave, 0, xstate_size); -+ memset(&dst_fpu->state.xsave, 0, xstate_size); - - /* - * Save current FPU registers directly into the child -@@ -268,17 +243,13 @@ static void fpu_copy(struct fpu *dst_fpu, struct fpu *src_fpu) - if (!copy_fpregs_to_fpstate(dst_fpu)) { - memcpy(&src_fpu->state, &dst_fpu->state, xstate_size); - -- if (use_eager_fpu()) -- copy_kernel_to_fpregs(&src_fpu->state); -- else -- fpregs_deactivate(src_fpu); -+ copy_kernel_to_fpregs(&src_fpu->state); - } - preempt_enable(); - } - - int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu) - { -- dst_fpu->counter = 0; - dst_fpu->fpregs_active = 0; - dst_fpu->last_cpu = -1; - -@@ -381,7 +352,6 @@ void fpu__restore(struct fpu *fpu) - kernel_fpu_disable(); - fpregs_activate(fpu); - copy_kernel_to_fpregs(&fpu->state); -- fpu->counter++; - kernel_fpu_enable(); - } - EXPORT_SYMBOL_GPL(fpu__restore); -@@ -398,7 +368,6 @@ EXPORT_SYMBOL_GPL(fpu__restore); - void fpu__drop(struct fpu *fpu) - { - preempt_disable(); -- fpu->counter = 0; - - if (fpu->fpregs_active) { - /* Ignore delayed exceptions from user space */ -@@ -437,7 +406,7 @@ void fpu__clear(struct fpu *fpu) - { - WARN_ON_FPU(fpu != ¤t->thread.fpu); /* Almost certainly an anomaly */ - -- if (!use_eager_fpu() || !static_cpu_has(X86_FEATURE_FPU)) { -+ if (!static_cpu_has(X86_FEATURE_FPU)) { - /* FPU state will be reallocated lazily at the first use. */ - fpu__drop(fpu); - } else { -diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c -index 3de077116218..9be3e79eb629 100644 ---- a/arch/x86/kernel/fpu/signal.c -+++ b/arch/x86/kernel/fpu/signal.c -@@ -319,11 +319,9 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) - } - - fpu->fpstate_active = 1; -- if (use_eager_fpu()) { -- preempt_disable(); -- fpu__restore(fpu); -- preempt_enable(); -- } -+ preempt_disable(); -+ fpu__restore(fpu); -+ preempt_enable(); - - return err; - } else { -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 83d6369c45f5..338d13d4fd2f 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -16,7 +16,6 @@ - #include - #include - #include --#include /* For use_eager_fpu. Ugh! */ - #include - #include - #include "cpuid.h" -@@ -104,9 +103,7 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu) - if (best && (best->eax & (F(XSAVES) | F(XSAVEC)))) - best->ebx = xstate_required_size(vcpu->arch.xcr0, true); - -- vcpu->arch.eager_fpu = use_eager_fpu(); -- if (vcpu->arch.eager_fpu) -- kvm_x86_ops->fpu_activate(vcpu); -+ kvm_x86_ops->fpu_activate(vcpu); - - /* - * The existing code assumes virtual address is 48-bit in the canonical -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 53d43d22a84b..e6ab034f0bc7 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7319,16 +7319,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) - copy_fpregs_to_fpstate(&vcpu->arch.guest_fpu); - __kernel_fpu_end(); - ++vcpu->stat.fpu_reload; -- /* -- * If using eager FPU mode, or if the guest is a frequent user -- * of the FPU, just leave the FPU active for next time. -- * Every 255 times fpu_counter rolls over to 0; a guest that uses -- * the FPU in bursts will revert to loading it on demand. -- */ -- if (!vcpu->arch.eager_fpu) { -- if (++vcpu->fpu_counter < 5) -- kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); -- } - trace_kvm_fpu(0); - } - -diff --git a/drivers/clocksource/timer-ti-32k.c b/drivers/clocksource/timer-ti-32k.c -index 8518d9dfba5c..73c990867c01 100644 ---- a/drivers/clocksource/timer-ti-32k.c -+++ b/drivers/clocksource/timer-ti-32k.c -@@ -98,6 +98,9 @@ static void __init ti_32k_timer_init(struct device_node *np) - return; - } - -+ if (!of_machine_is_compatible("ti,am43")) -+ ti_32k_timer.cs.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP; -+ - ti_32k_timer.counter = ti_32k_timer.base; - - /* -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -index b233cf8436b0..2e1e84c98034 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -@@ -504,7 +504,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd, - - while (true) { - temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS); -- if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT) -+ if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK) - break; - if (timeout == 0) - return -ETIME; -diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c -index 12dcbd8226f2..2cce48d9e903 100644 ---- a/drivers/hv/hv_fcopy.c -+++ b/drivers/hv/hv_fcopy.c -@@ -256,7 +256,6 @@ void hv_fcopy_onchannelcallback(void *context) - */ - - fcopy_transaction.recv_len = recvlen; -- fcopy_transaction.recv_channel = channel; - fcopy_transaction.recv_req_id = requestid; - fcopy_transaction.fcopy_msg = fcopy_msg; - -@@ -323,6 +322,7 @@ static void fcopy_on_reset(void) - int hv_fcopy_init(struct hv_util_service *srv) - { - recv_buffer = srv->recv_buffer; -+ fcopy_transaction.recv_channel = srv->channel; - - init_completion(&release_event); - /* -diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c -index ce4d3a935491..1771a968c3f2 100644 ---- a/drivers/hv/hv_kvp.c -+++ b/drivers/hv/hv_kvp.c -@@ -78,9 +78,11 @@ static void kvp_send_key(struct work_struct *dummy); - - static void kvp_respond_to_host(struct hv_kvp_msg *msg, int error); - static void kvp_timeout_func(struct work_struct *dummy); -+static void kvp_host_handshake_func(struct work_struct *dummy); - static void kvp_register(int); - - static DECLARE_DELAYED_WORK(kvp_timeout_work, kvp_timeout_func); -+static DECLARE_DELAYED_WORK(kvp_host_handshake_work, kvp_host_handshake_func); - static DECLARE_WORK(kvp_sendkey_work, kvp_send_key); - - static const char kvp_devname[] = "vmbus/hv_kvp"; -@@ -131,6 +133,11 @@ static void kvp_timeout_func(struct work_struct *dummy) - hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); - } - -+static void kvp_host_handshake_func(struct work_struct *dummy) -+{ -+ hv_poll_channel(kvp_transaction.recv_channel, hv_kvp_onchannelcallback); -+} -+ - static int kvp_handle_handshake(struct hv_kvp_msg *msg) - { - switch (msg->kvp_hdr.operation) { -@@ -155,7 +162,13 @@ static int kvp_handle_handshake(struct hv_kvp_msg *msg) - pr_debug("KVP: userspace daemon ver. %d registered\n", - KVP_OP_REGISTER); - kvp_register(dm_reg_value); -- kvp_transaction.state = HVUTIL_READY; -+ -+ /* -+ * If we're still negotiating with the host cancel the timeout -+ * work to not poll the channel twice. -+ */ -+ cancel_delayed_work_sync(&kvp_host_handshake_work); -+ hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); - - return 0; - } -@@ -595,10 +608,26 @@ void hv_kvp_onchannelcallback(void *context) - struct icmsg_negotiate *negop = NULL; - int util_fw_version; - int kvp_srv_version; -+ static enum {NEGO_NOT_STARTED, -+ NEGO_IN_PROGRESS, -+ NEGO_FINISHED} host_negotiatied = NEGO_NOT_STARTED; - -+ if (kvp_transaction.state < HVUTIL_READY) { -+ /* -+ * If userspace daemon is not connected and host is asking -+ * us to negotiate we need to delay to not lose messages. -+ * This is important for Failover IP setting. -+ */ -+ if (host_negotiatied == NEGO_NOT_STARTED) { -+ host_negotiatied = NEGO_IN_PROGRESS; -+ schedule_delayed_work(&kvp_host_handshake_work, -+ HV_UTIL_NEGO_TIMEOUT * HZ); -+ } -+ return; -+ } - if (kvp_transaction.state > HVUTIL_READY) - return; -- -+recheck: - vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, - &requestid); - -@@ -640,7 +669,6 @@ void hv_kvp_onchannelcallback(void *context) - */ - - kvp_transaction.recv_len = recvlen; -- kvp_transaction.recv_channel = channel; - kvp_transaction.recv_req_id = requestid; - kvp_transaction.kvp_msg = kvp_msg; - -@@ -674,6 +702,10 @@ void hv_kvp_onchannelcallback(void *context) - vmbus_sendpacket(channel, recv_buffer, - recvlen, requestid, - VM_PKT_DATA_INBAND, 0); -+ -+ host_negotiatied = NEGO_FINISHED; -+ -+ goto recheck; - } - - } -@@ -690,6 +722,7 @@ int - hv_kvp_init(struct hv_util_service *srv) - { - recv_buffer = srv->recv_buffer; -+ kvp_transaction.recv_channel = srv->channel; - - init_completion(&release_event); - /* -@@ -711,6 +744,7 @@ hv_kvp_init(struct hv_util_service *srv) - void hv_kvp_deinit(void) - { - kvp_transaction.state = HVUTIL_DEVICE_DYING; -+ cancel_delayed_work_sync(&kvp_host_handshake_work); - cancel_delayed_work_sync(&kvp_timeout_work); - cancel_work_sync(&kvp_sendkey_work); - hvutil_transport_destroy(hvt); -diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c -index faad79ae318a..b0feddb17170 100644 ---- a/drivers/hv/hv_snapshot.c -+++ b/drivers/hv/hv_snapshot.c -@@ -114,7 +114,7 @@ static int vss_handle_handshake(struct hv_vss_msg *vss_msg) - default: - return -EINVAL; - } -- vss_transaction.state = HVUTIL_READY; -+ hv_poll_channel(vss_transaction.recv_channel, vss_poll_wrapper); - pr_debug("VSS: userspace daemon ver. %d registered\n", dm_reg_value); - return 0; - } -@@ -264,7 +264,6 @@ void hv_vss_onchannelcallback(void *context) - */ - - vss_transaction.recv_len = recvlen; -- vss_transaction.recv_channel = channel; - vss_transaction.recv_req_id = requestid; - vss_transaction.msg = (struct hv_vss_msg *)vss_msg; - -@@ -340,6 +339,7 @@ hv_vss_init(struct hv_util_service *srv) - return -ENOTSUPP; - } - recv_buffer = srv->recv_buffer; -+ vss_transaction.recv_channel = srv->channel; - - /* - * When this driver loads, the user level daemon that -diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c -index 41f5896224bd..9dc63725363d 100644 ---- a/drivers/hv/hv_util.c -+++ b/drivers/hv/hv_util.c -@@ -326,6 +326,7 @@ static int util_probe(struct hv_device *dev, - srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL); - if (!srv->recv_buffer) - return -ENOMEM; -+ srv->channel = dev->channel; - if (srv->util_init) { - ret = srv->util_init(srv); - if (ret) { -diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index 75e383e6d03d..15e06493c53a 100644 ---- a/drivers/hv/hyperv_vmbus.h -+++ b/drivers/hv/hyperv_vmbus.h -@@ -35,6 +35,11 @@ - */ - #define HV_UTIL_TIMEOUT 30 - -+/* -+ * Timeout for guest-host handshake for services. -+ */ -+#define HV_UTIL_NEGO_TIMEOUT 60 -+ - /* - * The below CPUID leaves are present if VersionAndFeatures.HypervisorPresent - * is set by CPUID(HVCPUID_VERSION_FEATURES). -diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c -index 7aa7b9cb6203..efefcfa24a4c 100644 ---- a/drivers/i2c/busses/i2c-scmi.c -+++ b/drivers/i2c/busses/i2c-scmi.c -@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, - mt_params[3].type = ACPI_TYPE_INTEGER; - mt_params[3].integer.value = len; - mt_params[4].type = ACPI_TYPE_BUFFER; -+ mt_params[4].buffer.length = len; - mt_params[4].buffer.pointer = data->block + 1; - } - break; -diff --git a/drivers/input/keyboard/atakbd.c b/drivers/input/keyboard/atakbd.c -index f1235831283d..fdeda0b0fbd6 100644 ---- a/drivers/input/keyboard/atakbd.c -+++ b/drivers/input/keyboard/atakbd.c -@@ -79,8 +79,7 @@ MODULE_LICENSE("GPL"); - */ - - --static unsigned char atakbd_keycode[0x72] = { /* American layout */ -- [0] = KEY_GRAVE, -+static unsigned char atakbd_keycode[0x73] = { /* American layout */ - [1] = KEY_ESC, - [2] = KEY_1, - [3] = KEY_2, -@@ -121,9 +120,9 @@ static unsigned char atakbd_keycode[0x72] = { /* American layout */ - [38] = KEY_L, - [39] = KEY_SEMICOLON, - [40] = KEY_APOSTROPHE, -- [41] = KEY_BACKSLASH, /* FIXME, '#' */ -+ [41] = KEY_GRAVE, - [42] = KEY_LEFTSHIFT, -- [43] = KEY_GRAVE, /* FIXME: '~' */ -+ [43] = KEY_BACKSLASH, - [44] = KEY_Z, - [45] = KEY_X, - [46] = KEY_C, -@@ -149,45 +148,34 @@ static unsigned char atakbd_keycode[0x72] = { /* American layout */ - [66] = KEY_F8, - [67] = KEY_F9, - [68] = KEY_F10, -- [69] = KEY_ESC, -- [70] = KEY_DELETE, -- [71] = KEY_KP7, -- [72] = KEY_KP8, -- [73] = KEY_KP9, -+ [71] = KEY_HOME, -+ [72] = KEY_UP, - [74] = KEY_KPMINUS, -- [75] = KEY_KP4, -- [76] = KEY_KP5, -- [77] = KEY_KP6, -+ [75] = KEY_LEFT, -+ [77] = KEY_RIGHT, - [78] = KEY_KPPLUS, -- [79] = KEY_KP1, -- [80] = KEY_KP2, -- [81] = KEY_KP3, -- [82] = KEY_KP0, -- [83] = KEY_KPDOT, -- [90] = KEY_KPLEFTPAREN, -- [91] = KEY_KPRIGHTPAREN, -- [92] = KEY_KPASTERISK, /* FIXME */ -- [93] = KEY_KPASTERISK, -- [94] = KEY_KPPLUS, -- [95] = KEY_HELP, -+ [80] = KEY_DOWN, -+ [82] = KEY_INSERT, -+ [83] = KEY_DELETE, - [96] = KEY_102ND, -- [97] = KEY_KPASTERISK, /* FIXME */ -- [98] = KEY_KPSLASH, -+ [97] = KEY_UNDO, -+ [98] = KEY_HELP, - [99] = KEY_KPLEFTPAREN, - [100] = KEY_KPRIGHTPAREN, - [101] = KEY_KPSLASH, - [102] = KEY_KPASTERISK, -- [103] = KEY_UP, -- [104] = KEY_KPASTERISK, /* FIXME */ -- [105] = KEY_LEFT, -- [106] = KEY_RIGHT, -- [107] = KEY_KPASTERISK, /* FIXME */ -- [108] = KEY_DOWN, -- [109] = KEY_KPASTERISK, /* FIXME */ -- [110] = KEY_KPASTERISK, /* FIXME */ -- [111] = KEY_KPASTERISK, /* FIXME */ -- [112] = KEY_KPASTERISK, /* FIXME */ -- [113] = KEY_KPASTERISK /* FIXME */ -+ [103] = KEY_KP7, -+ [104] = KEY_KP8, -+ [105] = KEY_KP9, -+ [106] = KEY_KP4, -+ [107] = KEY_KP5, -+ [108] = KEY_KP6, -+ [109] = KEY_KP1, -+ [110] = KEY_KP2, -+ [111] = KEY_KP3, -+ [112] = KEY_KP0, -+ [113] = KEY_KPDOT, -+ [114] = KEY_KPENTER, - }; - - static struct input_dev *atakbd_dev; -@@ -195,21 +183,15 @@ static struct input_dev *atakbd_dev; - static void atakbd_interrupt(unsigned char scancode, char down) - { - -- if (scancode < 0x72) { /* scancodes < 0xf2 are keys */ -+ if (scancode < 0x73) { /* scancodes < 0xf3 are keys */ - - // report raw events here? - - scancode = atakbd_keycode[scancode]; - -- if (scancode == KEY_CAPSLOCK) { /* CapsLock is a toggle switch key on Amiga */ -- input_report_key(atakbd_dev, scancode, 1); -- input_report_key(atakbd_dev, scancode, 0); -- input_sync(atakbd_dev); -- } else { -- input_report_key(atakbd_dev, scancode, down); -- input_sync(atakbd_dev); -- } -- } else /* scancodes >= 0xf2 are mouse data, most likely */ -+ input_report_key(atakbd_dev, scancode, down); -+ input_sync(atakbd_dev); -+ } else /* scancodes >= 0xf3 are mouse data, most likely */ - printk(KERN_INFO "atakbd: unhandled scancode %x\n", scancode); - - return; -diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c -index 6e02a15d39ce..abddb621d9e6 100644 ---- a/drivers/media/usb/dvb-usb-v2/af9035.c -+++ b/drivers/media/usb/dvb-usb-v2/af9035.c -@@ -389,8 +389,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, - msg[0].addr == (state->af9033_i2c_addr[1] >> 1)) - reg |= 0x100000; - -- ret = af9035_wr_regs(d, reg, &msg[0].buf[3], -- msg[0].len - 3); -+ ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg, -+ &msg[0].buf[3], -+ msg[0].len - 3) -+ : -EOPNOTSUPP; - } else { - /* I2C write */ - u8 buf[MAX_XFER_SIZE]; -diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c -index 1d924d1533c0..b9dc2fcd8f26 100644 ---- a/drivers/mfd/omap-usb-host.c -+++ b/drivers/mfd/omap-usb-host.c -@@ -548,8 +548,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev, - } - - static const struct of_device_id usbhs_child_match_table[] = { -- { .compatible = "ti,omap-ehci", }, -- { .compatible = "ti,omap-ohci", }, -+ { .compatible = "ti,ehci-omap", }, -+ { .compatible = "ti,ohci-omap3", }, - { } - }; - -@@ -875,6 +875,7 @@ static struct platform_driver usbhs_omap_driver = { - .pm = &usbhsomap_dev_pm_ops, - .of_match_table = usbhs_omap_dt_ids, - }, -+ .probe = usbhs_omap_probe, - .remove = usbhs_omap_remove, - }; - -@@ -884,9 +885,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME); - MODULE_LICENSE("GPL v2"); - MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI"); - --static int __init omap_usbhs_drvinit(void) -+static int omap_usbhs_drvinit(void) - { -- return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe); -+ return platform_driver_register(&usbhs_omap_driver); - } - - /* -@@ -898,7 +899,7 @@ static int __init omap_usbhs_drvinit(void) - */ - fs_initcall_sync(omap_usbhs_drvinit); - --static void __exit omap_usbhs_drvexit(void) -+static void omap_usbhs_drvexit(void) - { - platform_driver_unregister(&usbhs_omap_driver); - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 339118f3c718..78da1b7b4d86 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -216,6 +216,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, - static void bond_slave_arr_handler(struct work_struct *work); - static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act, - int mod); -+static void bond_netdev_notify_work(struct work_struct *work); - - /*---------------------------- General routines -----------------------------*/ - -@@ -1237,6 +1238,8 @@ static struct slave *bond_alloc_slave(struct bonding *bond) - return NULL; - } - } -+ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); -+ - return slave; - } - -@@ -1244,6 +1247,7 @@ static void bond_free_slave(struct slave *slave) - { - struct bonding *bond = bond_get_bond_by_slave(slave); - -+ cancel_delayed_work_sync(&slave->notify_work); - if (BOND_MODE(bond) == BOND_MODE_8023AD) - kfree(SLAVE_AD_INFO(slave)); - -@@ -1265,39 +1269,26 @@ static void bond_fill_ifslave(struct slave *slave, struct ifslave *info) - info->link_failure_count = slave->link_failure_count; - } - --static void bond_netdev_notify(struct net_device *dev, -- struct netdev_bonding_info *info) --{ -- rtnl_lock(); -- netdev_bonding_info_change(dev, info); -- rtnl_unlock(); --} -- - static void bond_netdev_notify_work(struct work_struct *_work) - { -- struct netdev_notify_work *w = -- container_of(_work, struct netdev_notify_work, work.work); -+ struct slave *slave = container_of(_work, struct slave, -+ notify_work.work); -+ -+ if (rtnl_trylock()) { -+ struct netdev_bonding_info binfo; - -- bond_netdev_notify(w->dev, &w->bonding_info); -- dev_put(w->dev); -- kfree(w); -+ bond_fill_ifslave(slave, &binfo.slave); -+ bond_fill_ifbond(slave->bond, &binfo.master); -+ netdev_bonding_info_change(slave->dev, &binfo); -+ rtnl_unlock(); -+ } else { -+ queue_delayed_work(slave->bond->wq, &slave->notify_work, 1); -+ } - } - - void bond_queue_slave_event(struct slave *slave) - { -- struct bonding *bond = slave->bond; -- struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC); -- -- if (!nnw) -- return; -- -- dev_hold(slave->dev); -- nnw->dev = slave->dev; -- bond_fill_ifslave(slave, &nnw->bonding_info.slave); -- bond_fill_ifbond(bond, &nnw->bonding_info.master); -- INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work); -- -- queue_delayed_work(slave->bond->wq, &nnw->work, 0); -+ queue_delayed_work(slave->bond->wq, &slave->notify_work, 0); - } - - /* enslave device to bond device */ -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index af9ec57bbebf..7a6dd5e5e498 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -850,14 +850,22 @@ static void bcm_sysport_resume_from_wol(struct bcm_sysport_priv *priv) - { - u32 reg; - -- /* Stop monitoring MPD interrupt */ -- intrl2_0_mask_set(priv, INTRL2_0_MPD); -- - /* Clear the MagicPacket detection logic */ - reg = umac_readl(priv, UMAC_MPD_CTRL); - reg &= ~MPD_EN; - umac_writel(priv, reg, UMAC_MPD_CTRL); - -+ reg = intrl2_0_readl(priv, INTRL2_CPU_STATUS); -+ if (reg & INTRL2_0_MPD) -+ netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n"); -+ -+ if (reg & INTRL2_0_BRCM_MATCH_TAG) { -+ reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) & -+ RXCHK_BRCM_TAG_MATCH_MASK; -+ netdev_info(priv->netdev, -+ "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg); -+ } -+ - netif_dbg(priv, wol, priv->netdev, "resumed from WOL\n"); - } - -@@ -890,11 +898,6 @@ static irqreturn_t bcm_sysport_rx_isr(int irq, void *dev_id) - if (priv->irq0_stat & INTRL2_0_TX_RING_FULL) - bcm_sysport_tx_reclaim_all(priv); - -- if (priv->irq0_stat & INTRL2_0_MPD) { -- netdev_info(priv->netdev, "Wake-on-LAN interrupt!\n"); -- bcm_sysport_resume_from_wol(priv); -- } -- - return IRQ_HANDLED; - } - -@@ -1915,9 +1918,6 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) - /* UniMAC receive needs to be turned on */ - umac_enable_set(priv, CMD_RX_EN, 1); - -- /* Enable the interrupt wake-up source */ -- intrl2_0_mask_clear(priv, INTRL2_0_MPD); -- - netif_dbg(priv, wol, ndev, "entered WOL mode\n"); - - return 0; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 4ffacafddacb..fea8116da06a 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -1343,8 +1343,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) - if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { - tx_pkts++; - /* return full budget so NAPI will complete. */ -- if (unlikely(tx_pkts > bp->tx_wake_thresh)) -+ if (unlikely(tx_pkts > bp->tx_wake_thresh)) { - rx_pkts = budget; -+ raw_cons = NEXT_RAW_CMP(raw_cons); -+ break; -+ } - } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { - rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &agg_event); - if (likely(rc >= 0)) -@@ -1362,7 +1365,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) - } - raw_cons = NEXT_RAW_CMP(raw_cons); - -- if (rx_pkts == budget) -+ if (rx_pkts && rx_pkts == budget) - break; - } - -@@ -1404,8 +1407,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget) - while (1) { - work_done += bnxt_poll_work(bp, bnapi, budget - work_done); - -- if (work_done >= budget) -+ if (work_done >= budget) { -+ if (!budget) -+ BNXT_CP_DB_REARM(cpr->cp_doorbell, -+ cpr->cp_raw_cons); - break; -+ } - - if (!bnxt_has_work(bp, cpr)) { - napi_complete(napi); -diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c -index 8c698d464716..085f77f273ba 100644 ---- a/drivers/net/ethernet/cadence/macb.c -+++ b/drivers/net/ethernet/cadence/macb.c -@@ -2743,6 +2743,13 @@ static const struct macb_config at91sam9260_config = { - .init = macb_init, - }; - -+static const struct macb_config sama5d3macb_config = { -+ .caps = MACB_CAPS_SG_DISABLED -+ | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, -+ .clk_init = macb_clk_init, -+ .init = macb_init, -+}; -+ - static const struct macb_config pc302gem_config = { - .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE, - .dma_burst_length = 16, -@@ -2801,6 +2808,7 @@ static const struct of_device_id macb_dt_ids[] = { - { .compatible = "cdns,gem", .data = &pc302gem_config }, - { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config }, - { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config }, -+ { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config }, - { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config }, - { .compatible = "cdns,at91rm9200-emac", .data = &emac_config }, - { .compatible = "cdns,emac", .data = &emac_config }, -diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c -index ac92685dd4e5..42305f3234ff 100644 ---- a/drivers/net/ethernet/marvell/mvpp2.c -+++ b/drivers/net/ethernet/marvell/mvpp2.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -4268,7 +4269,7 @@ static void mvpp2_txq_desc_put(struct mvpp2_tx_queue *txq) - } - - /* Set Tx descriptors fields relevant for CSUM calculation */ --static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto, -+static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto, - int ip_hdr_len, int l4_proto) - { - u32 command; -@@ -5032,14 +5033,15 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) - if (skb->ip_summed == CHECKSUM_PARTIAL) { - int ip_hdr_len = 0; - u8 l4_proto; -+ __be16 l3_proto = vlan_get_protocol(skb); - -- if (skb->protocol == htons(ETH_P_IP)) { -+ if (l3_proto == htons(ETH_P_IP)) { - struct iphdr *ip4h = ip_hdr(skb); - - /* Calculate IPv4 checksum and L4 checksum */ - ip_hdr_len = ip4h->ihl; - l4_proto = ip4h->protocol; -- } else if (skb->protocol == htons(ETH_P_IPV6)) { -+ } else if (l3_proto == htons(ETH_P_IPV6)) { - struct ipv6hdr *ip6h = ipv6_hdr(skb); - - /* Read l4_protocol from one of IPv6 extra headers */ -@@ -5051,7 +5053,7 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) - } - - return mvpp2_txq_desc_csum(skb_network_offset(skb), -- skb->protocol, ip_hdr_len, l4_proto); -+ l3_proto, ip_hdr_len, l4_proto); - } - - return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE; -diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c -index ff77b8b608bd..7417605c3cf6 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c -@@ -228,7 +228,8 @@ static void mlx4_set_eq_affinity_hint(struct mlx4_priv *priv, int vec) - struct mlx4_dev *dev = &priv->dev; - struct mlx4_eq *eq = &priv->eq_table.eq[vec]; - -- if (!eq->affinity_mask || cpumask_empty(eq->affinity_mask)) -+ if (!cpumask_available(eq->affinity_mask) || -+ cpumask_empty(eq->affinity_mask)) - return; - - hint_err = irq_set_affinity_hint(eq->irq, eq->affinity_mask); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -index 55007f1e6bbc..12cd8aef1881 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h -@@ -1802,7 +1802,8 @@ struct qlcnic_hardware_ops { - int (*config_loopback) (struct qlcnic_adapter *, u8); - int (*clear_loopback) (struct qlcnic_adapter *, u8); - int (*config_promisc_mode) (struct qlcnic_adapter *, u32); -- void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16); -+ void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr, -+ u16 vlan, struct qlcnic_host_tx_ring *tx_ring); - int (*get_board_info) (struct qlcnic_adapter *); - void (*set_mac_filter_count) (struct qlcnic_adapter *); - void (*free_mac_list) (struct qlcnic_adapter *); -@@ -2044,9 +2045,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, - } - - static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter, -- u64 *addr, u16 id) -+ u64 *addr, u16 vlan, -+ struct qlcnic_host_tx_ring *tx_ring) - { -- adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id); -+ adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring); - } - - static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter) -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -index b4f3cb55605e..7f7aea9758e7 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -@@ -2132,7 +2132,8 @@ out: - } - - void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, -- u16 vlan_id) -+ u16 vlan_id, -+ struct qlcnic_host_tx_ring *tx_ring) - { - u8 mac[ETH_ALEN]; - memcpy(&mac, addr, ETH_ALEN); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h -index 331ae2c20f40..c8e012b3f7e7 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h -@@ -550,7 +550,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32); - int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32); - int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int); - int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int); --void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16); -+void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, -+ u16 vlan, struct qlcnic_host_tx_ring *ring); - int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *); - int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *); - void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h -index 4bb33af8e2b3..56a3bd9e37dc 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h -@@ -173,7 +173,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter, - struct net_device *netdev); - void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *); - void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, -- u64 *uaddr, u16 vlan_id); -+ u64 *uaddr, u16 vlan_id, -+ struct qlcnic_host_tx_ring *tx_ring); - int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *, - struct ethtool_coalesce *); - int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -index d4b5085a21fa..98042a3701b5 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c -@@ -269,13 +269,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, - } - - void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, -- u16 vlan_id) -+ u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring) - { - struct cmd_desc_type0 *hwdesc; - struct qlcnic_nic_req *req; - struct qlcnic_mac_req *mac_req; - struct qlcnic_vlan_req *vlan_req; -- struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring; - u32 producer; - u64 word; - -@@ -302,7 +301,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, - - static void qlcnic_send_filter(struct qlcnic_adapter *adapter, - struct cmd_desc_type0 *first_desc, -- struct sk_buff *skb) -+ struct sk_buff *skb, -+ struct qlcnic_host_tx_ring *tx_ring) - { - struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data); - struct ethhdr *phdr = (struct ethhdr *)(skb->data); -@@ -336,7 +336,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, - tmp_fil->vlan_id == vlan_id) { - if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime)) - qlcnic_change_filter(adapter, &src_addr, -- vlan_id); -+ vlan_id, tx_ring); - tmp_fil->ftime = jiffies; - return; - } -@@ -351,7 +351,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, - if (!fil) - return; - -- qlcnic_change_filter(adapter, &src_addr, vlan_id); -+ qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring); - fil->ftime = jiffies; - fil->vlan_id = vlan_id; - memcpy(fil->faddr, &src_addr, ETH_ALEN); -@@ -767,7 +767,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) - } - - if (adapter->drv_mac_learn) -- qlcnic_send_filter(adapter, first_desc, skb); -+ qlcnic_send_filter(adapter, first_desc, skb, tx_ring); - - tx_ring->tx_stats.tx_bytes += skb->len; - tx_ring->tx_stats.xmit_called++; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -index d02691ba3d7f..20aa34f45f07 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c -@@ -71,7 +71,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins) - * Description: - * This function validates the number of Unicast address entries supported - * by a particular Synopsys 10/100/1000 controller. The Synopsys controller -- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter -+ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter - * logic. This function validates a valid, supported configuration is - * selected, and defaults to 1 Unicast address if an unsupported - * configuration is selected. -@@ -81,8 +81,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries) - int x = ucast_entries; - - switch (x) { -- case 1: -- case 32: -+ case 1 ... 32: - case 64: - case 128: - break; -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 49174837c2ba..33ffb573fd67 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -1142,6 +1142,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) - return -EBUSY; - } - -+ if (dev == port_dev) { -+ netdev_err(dev, "Cannot enslave team device to itself\n"); -+ return -EINVAL; -+ } -+ - if (port_dev->features & NETIF_F_VLAN_CHALLENGED && - vlan_uses_dev(dev)) { - netdev_err(dev, "Device %s is VLAN challenged and team device has VLAN set up\n", -diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c -index 478937418a33..8dbe086e0a96 100644 ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -1506,6 +1506,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) - { - struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); - if (pdata) { -+ cancel_work_sync(&pdata->set_multicast); - netif_dbg(dev, ifdown, dev->net, "free pdata\n"); - kfree(pdata); - pdata = NULL; -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index f7771d86ad6c..4ea44f7122ee 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _port) - } - - /* push data to (open) tty */ -- if (req->actual) { -+ if (req->actual && tty) { - char *packet = req->buf; - unsigned size = req->actual; - unsigned n; -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 9df00101bfe1..f788f80fe1aa 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -1048,17 +1048,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - temp = readl(port_array[wIndex]); - break; - } -- -- /* Software should not attempt to set -- * port link state above '3' (U3) and the port -- * must be enabled. -- */ -- if ((temp & PORT_PE) == 0 || -- (link_state > USB_SS_PORT_LS_U3)) { -- xhci_warn(xhci, "Cannot set link state.\n"); -+ /* Port must be enabled */ -+ if (!(temp & PORT_PE)) { -+ retval = -ENODEV; -+ break; -+ } -+ /* Can't set port link state above '3' (U3) */ -+ if (link_state > USB_SS_PORT_LS_U3) { -+ xhci_warn(xhci, "Cannot set port %d link state %d\n", -+ wIndex, link_state); - goto error; - } -- - if (link_state == USB_SS_PORT_LS_U3) { - slot_id = xhci_find_slot_id_by_port(hcd, xhci, - wIndex + 1); -diff --git a/drivers/video/fbdev/aty/atyfb.h b/drivers/video/fbdev/aty/atyfb.h -index 63c4842eb224..46e0e8b39b76 100644 ---- a/drivers/video/fbdev/aty/atyfb.h -+++ b/drivers/video/fbdev/aty/atyfb.h -@@ -332,6 +332,8 @@ extern const struct aty_pll_ops aty_pll_ct; /* Integrated */ - extern void aty_set_pll_ct(const struct fb_info *info, const union aty_pll *pll); - extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); - -+extern const u8 aty_postdividers[8]; -+ - - /* - * Hardware cursor support -@@ -358,7 +360,6 @@ static inline void wait_for_idle(struct atyfb_par *par) - - extern void aty_reset_engine(const struct atyfb_par *par); - extern void aty_init_engine(struct atyfb_par *par, struct fb_info *info); --extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); - - void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area); - void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect); -diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c -index 7f658fa4d22a..9755a0ec6591 100644 ---- a/drivers/video/fbdev/aty/atyfb_base.c -+++ b/drivers/video/fbdev/aty/atyfb_base.c -@@ -3093,17 +3093,18 @@ static int atyfb_setup_sparc(struct pci_dev *pdev, struct fb_info *info, - /* - * PLL Reference Divider M: - */ -- M = pll_regs[2]; -+ M = pll_regs[PLL_REF_DIV]; - - /* - * PLL Feedback Divider N (Dependent on CLOCK_CNTL): - */ -- N = pll_regs[7 + (clock_cntl & 3)]; -+ N = pll_regs[VCLK0_FB_DIV + (clock_cntl & 3)]; - - /* - * PLL Post Divider P (Dependent on CLOCK_CNTL): - */ -- P = 1 << (pll_regs[6] >> ((clock_cntl & 3) << 1)); -+ P = aty_postdividers[((pll_regs[VCLK_POST_DIV] >> ((clock_cntl & 3) << 1)) & 3) | -+ ((pll_regs[PLL_EXT_CNTL] >> (2 + (clock_cntl & 3))) & 4)]; - - /* - * PLL Divider Q: -diff --git a/drivers/video/fbdev/aty/mach64_ct.c b/drivers/video/fbdev/aty/mach64_ct.c -index 51f29d627ceb..af54256a20a1 100644 ---- a/drivers/video/fbdev/aty/mach64_ct.c -+++ b/drivers/video/fbdev/aty/mach64_ct.c -@@ -114,7 +114,7 @@ static void aty_st_pll_ct(int offset, u8 val, const struct atyfb_par *par) - */ - - #define Maximum_DSP_PRECISION 7 --static u8 postdividers[] = {1,2,4,8,3}; -+const u8 aty_postdividers[8] = {1,2,4,8,3,5,6,12}; - - static int aty_dsp_gt(const struct fb_info *info, u32 bpp, struct pll_ct *pll) - { -@@ -221,7 +221,7 @@ static int aty_valid_pll_ct(const struct fb_info *info, u32 vclk_per, struct pll - pll->vclk_post_div += (q < 64*8); - pll->vclk_post_div += (q < 32*8); - } -- pll->vclk_post_div_real = postdividers[pll->vclk_post_div]; -+ pll->vclk_post_div_real = aty_postdividers[pll->vclk_post_div]; - // pll->vclk_post_div <<= 6; - pll->vclk_fb_div = q * pll->vclk_post_div_real / 8; - pllvclk = (1000000 * 2 * pll->vclk_fb_div) / -@@ -512,7 +512,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) - u8 mclk_fb_div, pll_ext_cntl; - pll->ct.pll_ref_div = aty_ld_pll_ct(PLL_REF_DIV, par); - pll_ext_cntl = aty_ld_pll_ct(PLL_EXT_CNTL, par); -- pll->ct.xclk_post_div_real = postdividers[pll_ext_cntl & 0x07]; -+ pll->ct.xclk_post_div_real = aty_postdividers[pll_ext_cntl & 0x07]; - mclk_fb_div = aty_ld_pll_ct(MCLK_FB_DIV, par); - if (pll_ext_cntl & PLL_MFB_TIMES_4_2B) - mclk_fb_div <<= 1; -@@ -534,7 +534,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) - xpost_div += (q < 64*8); - xpost_div += (q < 32*8); - } -- pll->ct.xclk_post_div_real = postdividers[xpost_div]; -+ pll->ct.xclk_post_div_real = aty_postdividers[xpost_div]; - pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8; - - #ifdef CONFIG_PPC -@@ -583,7 +583,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) - mpost_div += (q < 64*8); - mpost_div += (q < 32*8); - } -- sclk_post_div_real = postdividers[mpost_div]; -+ sclk_post_div_real = aty_postdividers[mpost_div]; - pll->ct.sclk_fb_div = q * sclk_post_div_real / 8; - pll->ct.spll_cntl2 = mpost_div << 4; - #ifdef DEBUG -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index d0aaf338fa9f..d6bae37489af 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -638,14 +638,20 @@ static size_t ext4_xattr_free_space(struct ext4_xattr_entry *last, - } - - static int --ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s) -+ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s, -+ struct inode *inode) - { -- struct ext4_xattr_entry *last; -+ struct ext4_xattr_entry *last, *next; - size_t free, min_offs = s->end - s->base, name_len = strlen(i->name); - - /* Compute min_offs and last. */ - last = s->first; -- for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { -+ for (; !IS_LAST_ENTRY(last); last = next) { -+ next = EXT4_XATTR_NEXT(last); -+ if ((void *)next >= s->end) { -+ EXT4_ERROR_INODE(inode, "corrupted xattr entries"); -+ return -EFSCORRUPTED; -+ } - if (!last->e_value_block && last->e_value_size) { - size_t offs = le16_to_cpu(last->e_value_offs); - if (offs < min_offs) -@@ -825,7 +831,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, - ce = NULL; - } - ea_bdebug(bs->bh, "modifying in-place"); -- error = ext4_xattr_set_entry(i, s); -+ error = ext4_xattr_set_entry(i, s, inode); - if (!error) { - if (!IS_LAST_ENTRY(s->first)) - ext4_xattr_rehash(header(s->base), -@@ -875,7 +881,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, - s->end = s->base + sb->s_blocksize; - } - -- error = ext4_xattr_set_entry(i, s); -+ error = ext4_xattr_set_entry(i, s, inode); - if (error == -EFSCORRUPTED) - goto bad_block; - if (error) -@@ -1037,7 +1043,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, - - if (EXT4_I(inode)->i_extra_isize == 0) - return -ENOSPC; -- error = ext4_xattr_set_entry(i, s); -+ error = ext4_xattr_set_entry(i, s, inode); - if (error) { - if (error == -ENOSPC && - ext4_has_inline_data(inode)) { -@@ -1049,7 +1055,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, - error = ext4_xattr_ibody_find(inode, i, is); - if (error) - return error; -- error = ext4_xattr_set_entry(i, s); -+ error = ext4_xattr_set_entry(i, s, inode); - } - if (error) - return error; -@@ -1075,7 +1081,7 @@ static int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode, - - if (EXT4_I(inode)->i_extra_isize == 0) - return -ENOSPC; -- error = ext4_xattr_set_entry(i, s); -+ error = ext4_xattr_set_entry(i, s, inode); - if (error) - return error; - header = IHDR(inode, ext4_raw_inode(&is->iloc)); -diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c -index 4c2c03663533..8e1427762eeb 100644 ---- a/fs/jffs2/xattr.c -+++ b/fs/jffs2/xattr.c -@@ -1004,12 +1004,14 @@ ssize_t jffs2_listxattr(struct dentry *dentry, char *buffer, size_t size) - rc = xhandle->list(xhandle, dentry, buffer + len, - size - len, xd->xname, - xd->name_len); -+ if (rc > size - len) { -+ rc = -ERANGE; -+ goto out; -+ } - } else { - rc = xhandle->list(xhandle, dentry, NULL, 0, - xd->xname, xd->name_len); - } -- if (rc < 0) -- goto out; - len += rc; - } - rc = len; -diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h -index ae6a711dcd1d..281bb007f725 100644 ---- a/include/linux/hyperv.h -+++ b/include/linux/hyperv.h -@@ -1179,6 +1179,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, - - struct hv_util_service { - u8 *recv_buffer; -+ void *channel; - void (*util_cb)(void *); - int (*util_init)(struct hv_util_service *); - void (*util_deinit)(void); -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index fc54049e8286..0b211d482c96 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2168,6 +2168,13 @@ struct netdev_notifier_info { - struct net_device *dev; - }; - -+struct netdev_notifier_info_ext { -+ struct netdev_notifier_info info; /* must be first */ -+ union { -+ u32 mtu; -+ } ext; -+}; -+ - struct netdev_notifier_change_info { - struct netdev_notifier_info info; /* must be first */ - unsigned int flags_changed; -diff --git a/include/net/bonding.h b/include/net/bonding.h -index 93abe5f6188d..d5abd3a80896 100644 ---- a/include/net/bonding.h -+++ b/include/net/bonding.h -@@ -146,12 +146,6 @@ struct bond_parm_tbl { - int mode; - }; - --struct netdev_notify_work { -- struct delayed_work work; -- struct net_device *dev; -- struct netdev_bonding_info bonding_info; --}; -- - struct slave { - struct net_device *dev; /* first - useful for panic debug */ - struct bonding *bond; /* our master */ -@@ -177,6 +171,7 @@ struct slave { - #ifdef CONFIG_NET_POLL_CONTROLLER - struct netpoll *np; - #endif -+ struct delayed_work notify_work; - struct kobject kobj; - struct rtnl_link_stats64 slave_stats; - }; -diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h -index 3afb7c4c7098..2a25b53cd427 100644 ---- a/include/net/ip_fib.h -+++ b/include/net/ip_fib.h -@@ -322,6 +322,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev); - int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); - int fib_sync_down_addr(struct net *net, __be32 local); - int fib_sync_up(struct net_device *dev, unsigned int nh_flags); -+void fib_sync_mtu(struct net_device *dev, u32 orig_mtu); - - extern u32 fib_multipath_secret __read_mostly; - -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 8895eff2d735..a2d70ef74db7 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -869,7 +869,6 @@ const char * const vmstat_text[] = { - #ifdef CONFIG_DEBUG_VM_VMACACHE - "vmacache_find_calls", - "vmacache_find_hits", -- "vmacache_full_flushes", - #endif - #endif /* CONFIG_VM_EVENTS_COUNTERS */ - }; -diff --git a/net/core/dev.c b/net/core/dev.c -index 191cf880d805..7366feb8b5b3 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1660,6 +1660,28 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev) - } - EXPORT_SYMBOL(call_netdevice_notifiers); - -+/** -+ * call_netdevice_notifiers_mtu - call all network notifier blocks -+ * @val: value passed unmodified to notifier function -+ * @dev: net_device pointer passed unmodified to notifier function -+ * @arg: additional u32 argument passed to the notifier function -+ * -+ * Call all network notifier blocks. Parameters and return value -+ * are as for raw_notifier_call_chain(). -+ */ -+static int call_netdevice_notifiers_mtu(unsigned long val, -+ struct net_device *dev, u32 arg) -+{ -+ struct netdev_notifier_info_ext info = { -+ .info.dev = dev, -+ .ext.mtu = arg, -+ }; -+ -+ BUILD_BUG_ON(offsetof(struct netdev_notifier_info_ext, info) != 0); -+ -+ return call_netdevice_notifiers_info(val, dev, &info.info); -+} -+ - #ifdef CONFIG_NET_INGRESS - static struct static_key ingress_needed __read_mostly; - -@@ -6134,14 +6156,16 @@ int dev_set_mtu(struct net_device *dev, int new_mtu) - err = __dev_set_mtu(dev, new_mtu); - - if (!err) { -- err = call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); -+ err = call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, -+ orig_mtu); - err = notifier_to_errno(err); - if (err) { - /* setting mtu back and notifying everyone again, - * so that they have a chance to revert changes. - */ - __dev_set_mtu(dev, orig_mtu); -- call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); -+ call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, -+ new_mtu); - } - } - return err; -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 96c9c0f0905a..f1df04c7d395 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2116,6 +2116,12 @@ struct net_device *rtnl_create_link(struct net *net, - else if (ops->get_num_rx_queues) - num_rx_queues = ops->get_num_rx_queues(); - -+ if (num_tx_queues < 1 || num_tx_queues > 4096) -+ return ERR_PTR(-EINVAL); -+ -+ if (num_rx_queues < 1 || num_rx_queues > 4096) -+ return ERR_PTR(-EINVAL); -+ - err = -ENOMEM; - dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type, - ops->setup, num_tx_queues, num_rx_queues); -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 015c33712803..ce646572b912 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1170,7 +1170,8 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, - static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); -- struct netdev_notifier_changeupper_info *info; -+ struct netdev_notifier_changeupper_info *upper_info = ptr; -+ struct netdev_notifier_info_ext *info_ext = ptr; - struct in_device *in_dev; - struct net *net = dev_net(dev); - unsigned int flags; -@@ -1205,16 +1206,19 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo - fib_sync_up(dev, RTNH_F_LINKDOWN); - else - fib_sync_down_dev(dev, event, false); -- /* fall through */ -+ rt_cache_flush(net); -+ break; - case NETDEV_CHANGEMTU: -+ fib_sync_mtu(dev, info_ext->ext.mtu); - rt_cache_flush(net); - break; - case NETDEV_CHANGEUPPER: -- info = ptr; -+ upper_info = ptr; - /* flush all routes if dev is linked to or unlinked from - * an L3 master device (e.g., VRF) - */ -- if (info->upper_dev && netif_is_l3_master(info->upper_dev)) -+ if (upper_info->upper_dev && -+ netif_is_l3_master(upper_info->upper_dev)) - fib_disable_ip(dev, NETDEV_DOWN, true); - break; - } -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 03ebff3950d8..3109b9bb95d2 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -1373,6 +1373,56 @@ int fib_sync_down_addr(struct net *net, __be32 local) - return ret; - } - -+/* Update the PMTU of exceptions when: -+ * - the new MTU of the first hop becomes smaller than the PMTU -+ * - the old MTU was the same as the PMTU, and it limited discovery of -+ * larger MTUs on the path. With that limit raised, we can now -+ * discover larger MTUs -+ * A special case is locked exceptions, for which the PMTU is smaller -+ * than the minimal accepted PMTU: -+ * - if the new MTU is greater than the PMTU, don't make any change -+ * - otherwise, unlock and set PMTU -+ */ -+static void nh_update_mtu(struct fib_nh *nh, u32 new, u32 orig) -+{ -+ struct fnhe_hash_bucket *bucket; -+ int i; -+ -+ bucket = rcu_dereference_protected(nh->nh_exceptions, 1); -+ if (!bucket) -+ return; -+ -+ for (i = 0; i < FNHE_HASH_SIZE; i++) { -+ struct fib_nh_exception *fnhe; -+ -+ for (fnhe = rcu_dereference_protected(bucket[i].chain, 1); -+ fnhe; -+ fnhe = rcu_dereference_protected(fnhe->fnhe_next, 1)) { -+ if (fnhe->fnhe_mtu_locked) { -+ if (new <= fnhe->fnhe_pmtu) { -+ fnhe->fnhe_pmtu = new; -+ fnhe->fnhe_mtu_locked = false; -+ } -+ } else if (new < fnhe->fnhe_pmtu || -+ orig == fnhe->fnhe_pmtu) { -+ fnhe->fnhe_pmtu = new; -+ } -+ } -+ } -+} -+ -+void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) -+{ -+ unsigned int hash = fib_devindex_hashfn(dev->ifindex); -+ struct hlist_head *head = &fib_info_devhash[hash]; -+ struct fib_nh *nh; -+ -+ hlist_for_each_entry(nh, head, nh_hash) { -+ if (nh->nh_dev == dev) -+ nh_update_mtu(nh, dev->mtu, orig_mtu); -+ } -+} -+ - /* Event force Flags Description - * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host - * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 88426a6a7a85..3f8caf7d19b8 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -134,7 +134,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) - static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) - { - struct sockaddr_in sin; -- const struct iphdr *iph = ip_hdr(skb); - __be16 *ports; - int end; - -@@ -149,7 +148,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) - ports = (__be16 *)skb_transport_header(skb); - - sin.sin_family = AF_INET; -- sin.sin_addr.s_addr = iph->daddr; -+ sin.sin_addr.s_addr = ip_hdr(skb)->daddr; - sin.sin_port = ports[1]; - memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); - -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 3d62feb65932..9d3176b080a4 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -597,6 +597,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - const struct iphdr *tnl_params, u8 protocol) - { - struct ip_tunnel *tunnel = netdev_priv(dev); -+ unsigned int inner_nhdr_len = 0; - const struct iphdr *inner_iph; - struct flowi4 fl4; - u8 tos, ttl; -@@ -607,6 +608,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - int err; - bool connected; - -+ /* ensure we can access the inner net header, for several users below */ -+ if (skb->protocol == htons(ETH_P_IP)) -+ inner_nhdr_len = sizeof(struct iphdr); -+ else if (skb->protocol == htons(ETH_P_IPV6)) -+ inner_nhdr_len = sizeof(struct ipv6hdr); -+ if (unlikely(!pskb_may_pull(skb, inner_nhdr_len))) -+ goto tx_error; -+ - inner_iph = (const struct iphdr *)skb_inner_network_header(skb); - connected = (tunnel->parms.iph.daddr != 0); - -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 0613be57513e..582e757e5727 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3786,7 +3786,6 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos) - p++; - continue; - } -- state->offset++; - return ifa; - } - -@@ -3810,13 +3809,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq, - return ifa; - } - -+ state->offset = 0; - while (++state->bucket < IN6_ADDR_HSIZE) { -- state->offset = 0; - hlist_for_each_entry_rcu_bh(ifa, - &inet6_addr_lst[state->bucket], addr_lst) { - if (!net_eq(dev_net(ifa->idev->dev), net)) - continue; -- state->offset++; - return ifa; - } - } -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index e8f21dd520b2..7c7a74ea2b0d 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1096,7 +1096,7 @@ static inline int - ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct ip6_tnl *t = netdev_priv(dev); -- const struct iphdr *iph = ip_hdr(skb); -+ const struct iphdr *iph; - int encap_limit = -1; - struct flowi6 fl6; - __u8 dsfield; -@@ -1104,6 +1104,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) - u8 tproto; - int err; - -+ /* ensure we can access the full inner ip header */ -+ if (!pskb_may_pull(skb, sizeof(struct iphdr))) -+ return -1; -+ -+ iph = ip_hdr(skb); - memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); - - tproto = ACCESS_ONCE(t->parms.proto); -@@ -1140,7 +1145,7 @@ static inline int - ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct ip6_tnl *t = netdev_priv(dev); -- struct ipv6hdr *ipv6h = ipv6_hdr(skb); -+ struct ipv6hdr *ipv6h; - int encap_limit = -1; - __u16 offset; - struct flowi6 fl6; -@@ -1149,6 +1154,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) - u8 tproto; - int err; - -+ if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) -+ return -1; -+ -+ ipv6h = ipv6_hdr(skb); - tproto = ACCESS_ONCE(t->parms.proto); - if ((tproto != IPPROTO_IPV6 && tproto != 0) || - ip6_tnl_addr_conflict(t, ipv6h)) -diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c -index 3f33ec44bd28..9f4ec16abfcf 100644 ---- a/net/netlabel/netlabel_unlabeled.c -+++ b/net/netlabel/netlabel_unlabeled.c -@@ -787,7 +787,8 @@ static int netlbl_unlabel_addrinfo_get(struct genl_info *info, - { - u32 addr_len; - -- if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { -+ if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && -+ info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { - addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); - if (addr_len != sizeof(struct in_addr) && - addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) -diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c -index b5a17cb510a0..4727f5b80e76 100644 ---- a/sound/hda/hdac_controller.c -+++ b/sound/hda/hdac_controller.c -@@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus) - */ - void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus) - { -+ WARN_ON_ONCE(!bus->rb.area); -+ - spin_lock_irq(&bus->reg_lock); - /* CORB set up */ - bus->corb.addr = bus->rb.addr; -@@ -377,13 +379,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset) - /* reset controller */ - azx_reset(bus, full_reset); - -- /* initialize interrupts */ -+ /* clear interrupts */ - azx_int_clear(bus); -- azx_int_enable(bus); - - /* initialize the codec command I/O */ - snd_hdac_bus_init_cmd_io(bus); - -+ /* enable interrupts after CORB/RIRB buffers are initialized above */ -+ azx_int_enable(bus); -+ - /* program the position buffer */ - if (bus->use_posbuf && bus->posbuf.addr) { - snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr); -diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c -index d53680ac78e4..6df158669420 100644 ---- a/sound/soc/codecs/sigmadsp.c -+++ b/sound/soc/codecs/sigmadsp.c -@@ -117,8 +117,7 @@ static int sigmadsp_ctrl_write(struct sigmadsp *sigmadsp, - struct sigmadsp_control *ctrl, void *data) - { - /* safeload loads up to 20 bytes in a atomic operation */ -- if (ctrl->num_bytes > 4 && ctrl->num_bytes <= 20 && sigmadsp->ops && -- sigmadsp->ops->safeload) -+ if (ctrl->num_bytes <= 20 && sigmadsp->ops && sigmadsp->ops->safeload) - return sigmadsp->ops->safeload(sigmadsp, ctrl->addr, data, - ctrl->num_bytes); - else -diff --git a/sound/soc/codecs/wm8804-i2c.c b/sound/soc/codecs/wm8804-i2c.c -index f27464c2c5ba..79541960f45d 100644 ---- a/sound/soc/codecs/wm8804-i2c.c -+++ b/sound/soc/codecs/wm8804-i2c.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - #include "wm8804.h" - -@@ -40,17 +41,29 @@ static const struct i2c_device_id wm8804_i2c_id[] = { - }; - MODULE_DEVICE_TABLE(i2c, wm8804_i2c_id); - -+#if defined(CONFIG_OF) - static const struct of_device_id wm8804_of_match[] = { - { .compatible = "wlf,wm8804", }, - { } - }; - MODULE_DEVICE_TABLE(of, wm8804_of_match); -+#endif -+ -+#ifdef CONFIG_ACPI -+static const struct acpi_device_id wm8804_acpi_match[] = { -+ { "1AEC8804", 0 }, /* Wolfson PCI ID + part ID */ -+ { "10138804", 0 }, /* Cirrus Logic PCI ID + part ID */ -+ { }, -+}; -+MODULE_DEVICE_TABLE(acpi, wm8804_acpi_match); -+#endif - - static struct i2c_driver wm8804_i2c_driver = { - .driver = { - .name = "wm8804", - .pm = &wm8804_pm, -- .of_match_table = wm8804_of_match, -+ .of_match_table = of_match_ptr(wm8804_of_match), -+ .acpi_match_table = ACPI_PTR(wm8804_acpi_match), - }, - .probe = wm8804_i2c_probe, - .remove = wm8804_i2c_remove, -diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py -index 1b02cdc0cab6..84cb5913b05a 100644 ---- a/tools/perf/scripts/python/export-to-postgresql.py -+++ b/tools/perf/scripts/python/export-to-postgresql.py -@@ -205,14 +205,23 @@ from ctypes import * - libpq = CDLL("libpq.so.5") - PQconnectdb = libpq.PQconnectdb - PQconnectdb.restype = c_void_p -+PQconnectdb.argtypes = [ c_char_p ] - PQfinish = libpq.PQfinish -+PQfinish.argtypes = [ c_void_p ] - PQstatus = libpq.PQstatus -+PQstatus.restype = c_int -+PQstatus.argtypes = [ c_void_p ] - PQexec = libpq.PQexec - PQexec.restype = c_void_p -+PQexec.argtypes = [ c_void_p, c_char_p ] - PQresultStatus = libpq.PQresultStatus -+PQresultStatus.restype = c_int -+PQresultStatus.argtypes = [ c_void_p ] - PQputCopyData = libpq.PQputCopyData -+PQputCopyData.restype = c_int - PQputCopyData.argtypes = [ c_void_p, c_void_p, c_int ] - PQputCopyEnd = libpq.PQputCopyEnd -+PQputCopyEnd.restype = c_int - PQputCopyEnd.argtypes = [ c_void_p, c_void_p ] - - sys.path.append(os.environ['PERF_EXEC_PATH'] + \ -diff --git a/tools/testing/selftests/efivarfs/config b/tools/testing/selftests/efivarfs/config -new file mode 100644 -index 000000000000..4e151f1005b2 ---- /dev/null -+++ b/tools/testing/selftests/efivarfs/config -@@ -0,0 +1 @@ -+CONFIG_EFIVAR_FS=y diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.162-163.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.162-163.patch deleted file mode 100644 index f06f3b077da9..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.162-163.patch +++ /dev/null @@ -1,3286 +0,0 @@ -diff --git a/Makefile b/Makefile -index 00ff2dd68ff1..4e3179768eea 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 162 -+SUBLEVEL = 163 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi -index 53fd75c8ffcf..47894b41e4e2 100644 ---- a/arch/arm/boot/dts/imx53-qsb-common.dtsi -+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi -@@ -130,6 +130,17 @@ - }; - }; - -+&cpu0 { -+ /* CPU rated to 1GHz, not 1.2GHz as per the default settings */ -+ operating-points = < -+ /* kHz uV */ -+ 166666 850000 -+ 400000 900000 -+ 800000 1050000 -+ 1000000 1200000 -+ >; -+}; -+ - &esdhc1 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_esdhc1>; -diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi -index e00d50ef678f..3ff5ea16ebb3 100644 ---- a/arch/arm/boot/dts/qcom-apq8064.dtsi -+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi -@@ -577,7 +577,7 @@ - }; - - sata0: sata@29000000 { -- compatible = "generic-ahci"; -+ compatible = "qcom,apq8064-ahci", "generic-ahci"; - status = "disabled"; - reg = <0x29000000 0x180>; - interrupts = ; -@@ -599,6 +599,7 @@ - - phys = <&sata_phy0>; - phy-names = "sata-phy"; -+ ports-implemented = <0x1>; - }; - - /* Temporary fixed regulator */ -diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c -index 0c81056c1dd7..2a3feb73de0b 100644 ---- a/arch/arm/mm/ioremap.c -+++ b/arch/arm/mm/ioremap.c -@@ -460,7 +460,7 @@ void pci_ioremap_set_mem_type(int mem_type) - - int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr) - { -- BUG_ON(offset + SZ_64K > IO_SPACE_LIMIT); -+ BUG_ON(offset + SZ_64K - 1 > IO_SPACE_LIMIT); - - return ioremap_page_range(PCI_IO_VIRT_BASE + offset, - PCI_IO_VIRT_BASE + offset + SZ_64K, -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 86485415c5f0..be7f8416809f 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -107,26 +107,27 @@ int ptep_set_access_flags(struct vm_area_struct *vma, - /* only preserve the access flags and write permission */ - pte_val(entry) &= PTE_AF | PTE_WRITE | PTE_DIRTY; - -- /* -- * PTE_RDONLY is cleared by default in the asm below, so set it in -- * back if necessary (read-only or clean PTE). -- */ -+ /* set PTE_RDONLY if actual read-only or clean PTE */ - if (!pte_write(entry) || !pte_sw_dirty(entry)) - pte_val(entry) |= PTE_RDONLY; - - /* - * Setting the flags must be done atomically to avoid racing with the -- * hardware update of the access/dirty state. -+ * hardware update of the access/dirty state. The PTE_RDONLY bit must -+ * be set to the most permissive (lowest value) of *ptep and entry -+ * (calculated as: a & b == ~(~a | ~b)). - */ -+ pte_val(entry) ^= PTE_RDONLY; - asm volatile("// ptep_set_access_flags\n" - " prfm pstl1strm, %2\n" - "1: ldxr %0, %2\n" -- " and %0, %0, %3 // clear PTE_RDONLY\n" -+ " eor %0, %0, %3 // negate PTE_RDONLY in *ptep\n" - " orr %0, %0, %4 // set flags\n" -+ " eor %0, %0, %3 // negate final PTE_RDONLY\n" - " stxr %w1, %0, %2\n" - " cbnz %w1, 1b\n" - : "=&r" (old_pteval), "=&r" (tmp), "+Q" (pte_val(*ptep)) -- : "L" (~PTE_RDONLY), "r" (pte_val(entry))); -+ : "L" (PTE_RDONLY), "r" (pte_val(entry))); - - flush_tlb_fix_spurious_fault(vma, address); - return 1; -diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S -index 554d1da97743..21f4a9fe82fa 100644 ---- a/arch/mips/dec/int-handler.S -+++ b/arch/mips/dec/int-handler.S -@@ -147,23 +147,12 @@ - * Find irq with highest priority - */ - # open coded PTR_LA t1, cpu_mask_nr_tbl --#if (_MIPS_SZPTR == 32) -+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32) - # open coded la t1, cpu_mask_nr_tbl - lui t1, %hi(cpu_mask_nr_tbl) - addiu t1, %lo(cpu_mask_nr_tbl) -- --#endif --#if (_MIPS_SZPTR == 64) -- # open coded dla t1, cpu_mask_nr_tbl -- .set push -- .set noat -- lui t1, %highest(cpu_mask_nr_tbl) -- lui AT, %hi(cpu_mask_nr_tbl) -- daddiu t1, t1, %higher(cpu_mask_nr_tbl) -- daddiu AT, AT, %lo(cpu_mask_nr_tbl) -- dsll t1, 32 -- daddu t1, t1, AT -- .set pop -+#else -+#error GCC `-msym32' option required for 64-bit DECstation builds - #endif - 1: lw t2,(t1) - nop -@@ -214,23 +203,12 @@ - * Find irq with highest priority - */ - # open coded PTR_LA t1,asic_mask_nr_tbl --#if (_MIPS_SZPTR == 32) -+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32) - # open coded la t1, asic_mask_nr_tbl - lui t1, %hi(asic_mask_nr_tbl) - addiu t1, %lo(asic_mask_nr_tbl) -- --#endif --#if (_MIPS_SZPTR == 64) -- # open coded dla t1, asic_mask_nr_tbl -- .set push -- .set noat -- lui t1, %highest(asic_mask_nr_tbl) -- lui AT, %hi(asic_mask_nr_tbl) -- daddiu t1, t1, %higher(asic_mask_nr_tbl) -- daddiu AT, AT, %lo(asic_mask_nr_tbl) -- dsll t1, 32 -- daddu t1, t1, AT -- .set pop -+#else -+#error GCC `-msym32' option required for 64-bit DECstation builds - #endif - 2: lw t2,(t1) - nop -diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h -index 9b44d5a816fa..1b6f2f219298 100644 ---- a/arch/mips/include/uapi/asm/inst.h -+++ b/arch/mips/include/uapi/asm/inst.h -@@ -846,7 +846,7 @@ struct mm16_r3_format { /* Load from global pointer format */ - struct mm16_r5_format { /* Load/store from stack pointer format */ - __BITFIELD_FIELD(unsigned int opcode : 6, - __BITFIELD_FIELD(unsigned int rt : 5, -- __BITFIELD_FIELD(signed int simmediate : 5, -+ __BITFIELD_FIELD(unsigned int imm : 5, - __BITFIELD_FIELD(unsigned int : 16, /* Ignored */ - ;)))) - }; -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index ed6cac4a4df0..ebd8a715fe38 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -207,7 +207,7 @@ static inline int is_ra_save_ins(union mips_instruction *ip, int *poff) - if (ip->mm16_r5_format.rt != 31) - return 0; - -- *poff = ip->mm16_r5_format.simmediate; -+ *poff = ip->mm16_r5_format.imm; - *poff = (*poff << 2) / sizeof(ulong); - return 1; - -@@ -341,6 +341,7 @@ static int get_frame_info(struct mips_frame_info *info) - bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); - union mips_instruction insn, *ip, *ip_end; - const unsigned int max_insns = 128; -+ unsigned int last_insn_size = 0; - unsigned int i; - - info->pc_offset = -1; -@@ -352,15 +353,19 @@ static int get_frame_info(struct mips_frame_info *info) - - ip_end = (void *)ip + info->func_size; - -- for (i = 0; i < max_insns && ip < ip_end; i++, ip++) { -+ for (i = 0; i < max_insns && ip < ip_end; i++) { -+ ip = (void *)ip + last_insn_size; - if (is_mmips && mm_insn_16bit(ip->halfword[0])) { - insn.halfword[0] = 0; - insn.halfword[1] = ip->halfword[0]; -+ last_insn_size = 2; - } else if (is_mmips) { - insn.halfword[0] = ip->halfword[1]; - insn.halfword[1] = ip->halfword[0]; -+ last_insn_size = 4; - } else { - insn.word = ip->word; -+ last_insn_size = 4; - } - - if (is_jump_ins(&insn)) -@@ -382,8 +387,6 @@ static int get_frame_info(struct mips_frame_info *info) - tmp = (ip->halfword[0] >> 1); - info->frame_size = -(signed short)(tmp & 0xf); - } -- ip = (void *) &ip->halfword[1]; -- ip--; - } else - #endif - info->frame_size = - ip->i_format.simmediate; -diff --git a/arch/sparc/include/asm/page_64.h b/arch/sparc/include/asm/page_64.h -index 8c2a8c937540..c1263fc390db 100644 ---- a/arch/sparc/include/asm/page_64.h -+++ b/arch/sparc/include/asm/page_64.h -@@ -25,6 +25,7 @@ - #define HPAGE_MASK (~(HPAGE_SIZE - 1UL)) - #define HUGETLB_PAGE_ORDER (HPAGE_SHIFT - PAGE_SHIFT) - #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA -+#define REAL_HPAGE_PER_HPAGE (_AC(1,UL) << (HPAGE_SHIFT - REAL_HPAGE_SHIFT)) - #endif - - #ifndef __ASSEMBLY__ -diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c -index 9f9614df9e1e..c2b202d763a1 100644 ---- a/arch/sparc/kernel/pci.c -+++ b/arch/sparc/kernel/pci.c -@@ -245,6 +245,18 @@ static void pci_parse_of_addrs(struct platform_device *op, - } - } - -+static void pci_init_dev_archdata(struct dev_archdata *sd, void *iommu, -+ void *stc, void *host_controller, -+ struct platform_device *op, -+ int numa_node) -+{ -+ sd->iommu = iommu; -+ sd->stc = stc; -+ sd->host_controller = host_controller; -+ sd->op = op; -+ sd->numa_node = numa_node; -+} -+ - static struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm, - struct device_node *node, - struct pci_bus *bus, int devfn) -@@ -259,13 +271,10 @@ static struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm, - if (!dev) - return NULL; - -+ op = of_find_device_by_node(node); - sd = &dev->dev.archdata; -- sd->iommu = pbm->iommu; -- sd->stc = &pbm->stc; -- sd->host_controller = pbm; -- sd->op = op = of_find_device_by_node(node); -- sd->numa_node = pbm->numa_node; -- -+ pci_init_dev_archdata(sd, pbm->iommu, &pbm->stc, pbm, op, -+ pbm->numa_node); - sd = &op->dev.archdata; - sd->iommu = pbm->iommu; - sd->stc = &pbm->stc; -@@ -1003,9 +1012,13 @@ int pcibios_add_device(struct pci_dev *dev) - * Copy dev_archdata from PF to VF - */ - if (dev->is_virtfn) { -+ struct dev_archdata *psd; -+ - pdev = dev->physfn; -- memcpy(&dev->dev.archdata, &pdev->dev.archdata, -- sizeof(struct dev_archdata)); -+ psd = &pdev->dev.archdata; -+ pci_init_dev_archdata(&dev->dev.archdata, psd->iommu, -+ psd->stc, psd->host_controller, NULL, -+ psd->numa_node); - } - return 0; - } -diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S -index 54f98706b03b..5a8cb37f0a3b 100644 ---- a/arch/sparc/lib/U3memcpy.S -+++ b/arch/sparc/lib/U3memcpy.S -@@ -145,13 +145,13 @@ ENDPROC(U3_retl_o2_plus_GS_plus_0x08) - ENTRY(U3_retl_o2_and_7_plus_GS) - and %o2, 7, %o2 - retl -- add %o2, GLOBAL_SPARE, %o2 -+ add %o2, GLOBAL_SPARE, %o0 - ENDPROC(U3_retl_o2_and_7_plus_GS) - ENTRY(U3_retl_o2_and_7_plus_GS_plus_8) - add GLOBAL_SPARE, 8, GLOBAL_SPARE - and %o2, 7, %o2 - retl -- add %o2, GLOBAL_SPARE, %o2 -+ add %o2, GLOBAL_SPARE, %o0 - ENDPROC(U3_retl_o2_and_7_plus_GS_plus_8) - #endif - -diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c -index e15f33715103..b01ec72522cb 100644 ---- a/arch/sparc/mm/fault_64.c -+++ b/arch/sparc/mm/fault_64.c -@@ -487,6 +487,7 @@ good_area: - tsb_grow(mm, MM_TSB_BASE, mm_rss); - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) - mm_rss = mm->context.hugetlb_pte_count + mm->context.thp_pte_count; -+ mm_rss *= REAL_HPAGE_PER_HPAGE; - if (unlikely(mm_rss > - mm->context.tsb_block[MM_TSB_HUGE].tsb_rss_limit)) { - if (mm->context.tsb_block[MM_TSB_HUGE].tsb) -diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c -index 3659d37b4d81..c56a195c9071 100644 ---- a/arch/sparc/mm/tlb.c -+++ b/arch/sparc/mm/tlb.c -@@ -174,10 +174,25 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, - return; - - if ((pmd_val(pmd) ^ pmd_val(orig)) & _PAGE_PMD_HUGE) { -- if (pmd_val(pmd) & _PAGE_PMD_HUGE) -- mm->context.thp_pte_count++; -- else -- mm->context.thp_pte_count--; -+ /* -+ * Note that this routine only sets pmds for THP pages. -+ * Hugetlb pages are handled elsewhere. We need to check -+ * for huge zero page. Huge zero pages are like hugetlb -+ * pages in that there is no RSS, but there is the need -+ * for TSB entries. So, huge zero page counts go into -+ * hugetlb_pte_count. -+ */ -+ if (pmd_val(pmd) & _PAGE_PMD_HUGE) { -+ if (is_huge_zero_page(pmd_page(pmd))) -+ mm->context.hugetlb_pte_count++; -+ else -+ mm->context.thp_pte_count++; -+ } else { -+ if (is_huge_zero_page(pmd_page(orig))) -+ mm->context.hugetlb_pte_count--; -+ else -+ mm->context.thp_pte_count--; -+ } - - /* Do not try to allocate the TSB hash table if we - * don't have one already. We have various locks held -@@ -204,6 +219,9 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, - } - } - -+/* -+ * This routine is only called when splitting a THP -+ */ - void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, - pmd_t *pmdp) - { -@@ -213,6 +231,15 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, - - set_pmd_at(vma->vm_mm, address, pmdp, entry); - flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE); -+ -+ /* -+ * set_pmd_at() will not be called in a way to decrement -+ * thp_pte_count when splitting a THP, so do it now. -+ * Sanity check pmd before doing the actual decrement. -+ */ -+ if ((pmd_val(entry) & _PAGE_PMD_HUGE) && -+ !is_huge_zero_page(pmd_page(entry))) -+ (vma->vm_mm)->context.thp_pte_count--; - } - - void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, -diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c -index 266411291634..84cd593117a6 100644 ---- a/arch/sparc/mm/tsb.c -+++ b/arch/sparc/mm/tsb.c -@@ -489,8 +489,10 @@ retry_tsb_alloc: - - int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - { -+ unsigned long mm_rss = get_mm_rss(mm); - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- unsigned long total_huge_pte_count; -+ unsigned long saved_hugetlb_pte_count; -+ unsigned long saved_thp_pte_count; - #endif - unsigned int i; - -@@ -503,10 +505,12 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - * will re-increment the counters as the parent PTEs are - * copied into the child address space. - */ -- total_huge_pte_count = mm->context.hugetlb_pte_count + -- mm->context.thp_pte_count; -+ saved_hugetlb_pte_count = mm->context.hugetlb_pte_count; -+ saved_thp_pte_count = mm->context.thp_pte_count; - mm->context.hugetlb_pte_count = 0; - mm->context.thp_pte_count = 0; -+ -+ mm_rss -= saved_thp_pte_count * (HPAGE_SIZE / PAGE_SIZE); - #endif - - /* copy_mm() copies over the parent's mm_struct before calling -@@ -519,11 +523,13 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - /* If this is fork, inherit the parent's TSB size. We would - * grow it to that size on the first page fault anyways. - */ -- tsb_grow(mm, MM_TSB_BASE, get_mm_rss(mm)); -+ tsb_grow(mm, MM_TSB_BASE, mm_rss); - - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- if (unlikely(total_huge_pte_count)) -- tsb_grow(mm, MM_TSB_HUGE, total_huge_pte_count); -+ if (unlikely(saved_hugetlb_pte_count + saved_thp_pte_count)) -+ tsb_grow(mm, MM_TSB_HUGE, -+ (saved_hugetlb_pte_count + saved_thp_pte_count) * -+ REAL_HPAGE_PER_HPAGE); - #endif - - if (unlikely(!mm->context.tsb_block[MM_TSB_BASE].tsb)) -diff --git a/arch/um/Makefile b/arch/um/Makefile -index 9ccf462131c4..d9cd7ed27834 100644 ---- a/arch/um/Makefile -+++ b/arch/um/Makefile -@@ -59,10 +59,14 @@ KBUILD_CPPFLAGS += -I$(srctree)/$(HOST_DIR)/um - # Same things for in6addr_loopback and mktime - found in libc. For these two we - # only get link-time error, luckily. - # -+# -Dlongjmp=kernel_longjmp prevents anything from referencing the libpthread.a -+# embedded copy of longjmp, same thing for setjmp. -+# - # These apply to USER_CFLAGS to. - - KBUILD_CFLAGS += $(CFLAGS) $(CFLAGS-y) -D__arch_um__ \ - $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap \ -+ -Dlongjmp=kernel_longjmp -Dsetjmp=kernel_setjmp \ - -Din6addr_loopback=kernel_in6addr_loopback \ - -Din6addr_any=kernel_in6addr_any -Dstrrchr=kernel_strrchr - -diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h -index e0ba66ca68c6..f5e780bfa2b3 100644 ---- a/arch/x86/include/asm/percpu.h -+++ b/arch/x86/include/asm/percpu.h -@@ -184,22 +184,22 @@ do { \ - typeof(var) pfo_ret__; \ - switch (sizeof(var)) { \ - case 1: \ -- asm(op "b "__percpu_arg(1)",%0" \ -+ asm volatile(op "b "__percpu_arg(1)",%0"\ - : "=q" (pfo_ret__) \ - : "m" (var)); \ - break; \ - case 2: \ -- asm(op "w "__percpu_arg(1)",%0" \ -+ asm volatile(op "w "__percpu_arg(1)",%0"\ - : "=r" (pfo_ret__) \ - : "m" (var)); \ - break; \ - case 4: \ -- asm(op "l "__percpu_arg(1)",%0" \ -+ asm volatile(op "l "__percpu_arg(1)",%0"\ - : "=r" (pfo_ret__) \ - : "m" (var)); \ - break; \ - case 8: \ -- asm(op "q "__percpu_arg(1)",%0" \ -+ asm volatile(op "q "__percpu_arg(1)",%0"\ - : "=r" (pfo_ret__) \ - : "m" (var)); \ - break; \ -diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c -index d39c09119db6..590c8fd2ed9b 100644 ---- a/arch/x86/kernel/time.c -+++ b/arch/x86/kernel/time.c -@@ -23,7 +23,7 @@ - #include - - #ifdef CONFIG_X86_64 --__visible volatile unsigned long jiffies __cacheline_aligned = INITIAL_JIFFIES; -+__visible volatile unsigned long jiffies __cacheline_aligned_in_smp = INITIAL_JIFFIES; - #endif - - unsigned long profile_pc(struct pt_regs *regs) -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index 0e1dd7d47f05..26598e08666c 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -955,11 +955,11 @@ static void populate_pte(struct cpa_data *cpa, - } - } - --static int populate_pmd(struct cpa_data *cpa, -- unsigned long start, unsigned long end, -- unsigned num_pages, pud_t *pud, pgprot_t pgprot) -+static long populate_pmd(struct cpa_data *cpa, -+ unsigned long start, unsigned long end, -+ unsigned num_pages, pud_t *pud, pgprot_t pgprot) - { -- unsigned int cur_pages = 0; -+ long cur_pages = 0; - pmd_t *pmd; - pgprot_t pmd_pgprot; - -@@ -1029,12 +1029,12 @@ static int populate_pmd(struct cpa_data *cpa, - return num_pages; - } - --static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, -- pgprot_t pgprot) -+static long populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, -+ pgprot_t pgprot) - { - pud_t *pud; - unsigned long end; -- int cur_pages = 0; -+ long cur_pages = 0; - pgprot_t pud_pgprot; - - end = start + (cpa->numpages << PAGE_SHIFT); -@@ -1090,7 +1090,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, - - /* Map trailing leftover */ - if (start < end) { -- int tmp; -+ long tmp; - - pud = pud_offset(pgd, start); - if (pud_none(*pud)) -@@ -1116,7 +1116,7 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr) - pgprot_t pgprot = __pgprot(_KERNPG_TABLE); - pud_t *pud = NULL; /* shut up gcc */ - pgd_t *pgd_entry; -- int ret; -+ long ret; - - pgd_entry = cpa->pgd + pgd_index(addr); - -@@ -1351,7 +1351,8 @@ static int cpa_process_alias(struct cpa_data *cpa) - - static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias) - { -- int ret, numpages = cpa->numpages; -+ unsigned long numpages = cpa->numpages; -+ int ret; - - while (numpages) { - /* -diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c -index 0ae7e9fa348d..89f90549c6a8 100644 ---- a/arch/x86/pci/fixup.c -+++ b/arch/x86/pci/fixup.c -@@ -541,9 +541,16 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev) - } - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); - -+/* -+ * Broadwell EP Home Agent BARs erroneously return non-zero values when read. -+ * -+ * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html -+ * entry BDF2. -+ */ - static void pci_bdwep_bar(struct pci_dev *dev) - { - dev->non_compliant_bars = 1; - } -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar); -diff --git a/arch/x86/um/setjmp_32.S b/arch/x86/um/setjmp_32.S -index b766792c9933..39053192918d 100644 ---- a/arch/x86/um/setjmp_32.S -+++ b/arch/x86/um/setjmp_32.S -@@ -16,9 +16,9 @@ - - .text - .align 4 -- .globl setjmp -- .type setjmp, @function --setjmp: -+ .globl kernel_setjmp -+ .type kernel_setjmp, @function -+kernel_setjmp: - #ifdef _REGPARM - movl %eax,%edx - #else -@@ -35,13 +35,13 @@ setjmp: - movl %ecx,20(%edx) # Return address - ret - -- .size setjmp,.-setjmp -+ .size kernel_setjmp,.-kernel_setjmp - - .text - .align 4 -- .globl longjmp -- .type longjmp, @function --longjmp: -+ .globl kernel_longjmp -+ .type kernel_longjmp, @function -+kernel_longjmp: - #ifdef _REGPARM - xchgl %eax,%edx - #else -@@ -55,4 +55,4 @@ longjmp: - movl 16(%edx),%edi - jmp *20(%edx) - -- .size longjmp,.-longjmp -+ .size kernel_longjmp,.-kernel_longjmp -diff --git a/arch/x86/um/setjmp_64.S b/arch/x86/um/setjmp_64.S -index 45f547b4043e..c56942e1a38c 100644 ---- a/arch/x86/um/setjmp_64.S -+++ b/arch/x86/um/setjmp_64.S -@@ -18,9 +18,9 @@ - - .text - .align 4 -- .globl setjmp -- .type setjmp, @function --setjmp: -+ .globl kernel_setjmp -+ .type kernel_setjmp, @function -+kernel_setjmp: - pop %rsi # Return address, and adjust the stack - xorl %eax,%eax # Return value - movq %rbx,(%rdi) -@@ -34,13 +34,13 @@ setjmp: - movq %rsi,56(%rdi) # Return address - ret - -- .size setjmp,.-setjmp -+ .size kernel_setjmp,.-kernel_setjmp - - .text - .align 4 -- .globl longjmp -- .type longjmp, @function --longjmp: -+ .globl kernel_longjmp -+ .type kernel_longjmp, @function -+kernel_longjmp: - movl %esi,%eax # Return value (int) - movq (%rdi),%rbx - movq 8(%rdi),%rsp -@@ -51,4 +51,4 @@ longjmp: - movq 48(%rdi),%r15 - jmp *56(%rdi) - -- .size longjmp,.-longjmp -+ .size kernel_longjmp,.-kernel_longjmp -diff --git a/crypto/shash.c b/crypto/shash.c -index 5444b429e35d..4f89f78031e2 100644 ---- a/crypto/shash.c -+++ b/crypto/shash.c -@@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, - int err; - - absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1)); -- buffer = kmalloc(absize, GFP_KERNEL); -+ buffer = kmalloc(absize, GFP_ATOMIC); - if (!buffer) - return -ENOMEM; - -diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c -index 34fdaa6e99ba..5f1f049063dd 100644 ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -619,8 +619,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev, - static int ahci_pci_reset_controller(struct ata_host *host) - { - struct pci_dev *pdev = to_pci_dev(host->dev); -+ int rc; - -- ahci_reset_controller(host); -+ rc = ahci_reset_controller(host); -+ if (rc) -+ return rc; - - if (pdev->vendor == PCI_VENDOR_ID_INTEL) { - struct ahci_host_priv *hpriv = host->private_data; -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index e759100e41a7..28894878dcd5 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -230,7 +230,11 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - chip->cdev.owner = dev->driver->owner; - chip->cdev.kobj.parent = &chip->dev.kobj; - -- devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); -+ rc = devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); -+ if (rc) { -+ put_device(&chip->dev); -+ return ERR_PTR(rc); -+ } - - return chip; - } -diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c -index 848b93ee930f..64a2e02b87d7 100644 ---- a/drivers/devfreq/tegra-devfreq.c -+++ b/drivers/devfreq/tegra-devfreq.c -@@ -688,9 +688,9 @@ static int tegra_devfreq_probe(struct platform_device *pdev) - } - - irq = platform_get_irq(pdev, 0); -- if (irq <= 0) { -- dev_err(&pdev->dev, "Failed to get IRQ\n"); -- return -ENODEV; -+ if (irq < 0) { -+ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", irq); -+ return irq; - } - - platform_set_drvdata(pdev, tegra); -diff --git a/drivers/gpio/gpio-msic.c b/drivers/gpio/gpio-msic.c -index 22523aae8abe..3abf066f93d3 100644 ---- a/drivers/gpio/gpio-msic.c -+++ b/drivers/gpio/gpio-msic.c -@@ -266,8 +266,8 @@ static int platform_msic_gpio_probe(struct platform_device *pdev) - int i; - - if (irq < 0) { -- dev_err(dev, "no IRQ line\n"); -- return -EINVAL; -+ dev_err(dev, "no IRQ line: %d\n", irq); -+ return irq; - } - - if (!pdata || !pdata->gpio_base) { -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index e40a1b07a014..343476d15726 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -235,7 +235,7 @@ void - nouveau_fbcon_accel_save_disable(struct drm_device *dev) - { - struct nouveau_drm *drm = nouveau_drm(dev); -- if (drm->fbcon) { -+ if (drm->fbcon && drm->fbcon->helper.fbdev) { - drm->fbcon->saved_flags = drm->fbcon->helper.fbdev->flags; - drm->fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED; - } -@@ -245,7 +245,7 @@ void - nouveau_fbcon_accel_restore(struct drm_device *dev) - { - struct nouveau_drm *drm = nouveau_drm(dev); -- if (drm->fbcon) { -+ if (drm->fbcon && drm->fbcon->helper.fbdev) { - drm->fbcon->helper.fbdev->flags = drm->fbcon->saved_flags; - } - } -@@ -257,7 +257,8 @@ nouveau_fbcon_accel_fini(struct drm_device *dev) - struct nouveau_fbdev *fbcon = drm->fbcon; - if (fbcon && drm->channel) { - console_lock(); -- fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED; -+ if (fbcon->helper.fbdev) -+ fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED; - console_unlock(); - nouveau_channel_idle(drm->channel); - nvif_object_fini(&fbcon->twod); -diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c -index 53d3d1d45b48..ce1b10a2ae85 100644 ---- a/drivers/gpu/host1x/dev.c -+++ b/drivers/gpu/host1x/dev.c -@@ -116,8 +116,8 @@ static int host1x_probe(struct platform_device *pdev) - - syncpt_irq = platform_get_irq(pdev, 0); - if (syncpt_irq < 0) { -- dev_err(&pdev->dev, "failed to get IRQ\n"); -- return -ENXIO; -+ dev_err(&pdev->dev, "failed to get IRQ: %d\n", syncpt_irq); -+ return syncpt_irq; - } - - host = devm_kzalloc(&pdev->dev, sizeof(*host), GFP_KERNEL); -diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c -index 564adf3116e8..4b3a00855f52 100644 ---- a/drivers/infiniband/core/ucm.c -+++ b/drivers/infiniband/core/ucm.c -@@ -46,6 +46,8 @@ - #include - #include - -+#include -+ - #include - - #include -@@ -1115,6 +1117,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, - - if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) - return -EINVAL; -+ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucm_cmd_table)); - - if (hdr.in + sizeof(hdr) > len) - return -EINVAL; -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 7525e9f6949e..3e4d3d5560bf 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -44,6 +44,8 @@ - #include - #include - -+#include -+ - #include - #include - #include -@@ -1627,6 +1629,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, - - if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) - return -EINVAL; -+ hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucma_cmd_table)); - - if (hdr.in + sizeof(hdr) > len) - return -EINVAL; -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index a716482774db..b3119589a444 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1251,6 +1251,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0611", 0 }, - { "ELAN0612", 0 }, - { "ELAN0618", 0 }, -+ { "ELAN061C", 0 }, - { "ELAN061D", 0 }, - { "ELAN0622", 0 }, - { "ELAN1000", 0 }, -diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c -index 74bf1a17ae7c..b90776ef56ec 100644 ---- a/drivers/isdn/gigaset/ser-gigaset.c -+++ b/drivers/isdn/gigaset/ser-gigaset.c -@@ -373,13 +373,7 @@ static void gigaset_freecshw(struct cardstate *cs) - - static void gigaset_device_release(struct device *dev) - { -- struct cardstate *cs = dev_get_drvdata(dev); -- -- if (!cs) -- return; -- dev_set_drvdata(dev, NULL); -- kfree(cs->hw.ser); -- cs->hw.ser = NULL; -+ kfree(container_of(dev, struct ser_cardstate, dev.dev)); - } - - /* -@@ -408,7 +402,6 @@ static int gigaset_initcshw(struct cardstate *cs) - cs->hw.ser = NULL; - return rc; - } -- dev_set_drvdata(&cs->hw.ser->dev.dev, cs); - - tasklet_init(&cs->write_tasklet, - gigaset_modem_fill, (unsigned long) cs); -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index cafc34938a79..91d709efef7a 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1461,13 +1461,6 @@ static int usbvision_probe(struct usb_interface *intf, - printk(KERN_INFO "%s: %s found\n", __func__, - usbvision_device_data[model].model_string); - -- /* -- * this is a security check. -- * an exploit using an incorrect bInterfaceNumber is known -- */ -- if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) -- return -ENODEV; -- - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; - else if (ifnum < dev->actconfig->desc.bNumInterfaces) -diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c -index e6e4bacb09ee..12099b09a9a7 100644 ---- a/drivers/mfd/db8500-prcmu.c -+++ b/drivers/mfd/db8500-prcmu.c -@@ -2048,6 +2048,7 @@ int db8500_prcmu_config_hotmon(u8 low, u8 high) - - return 0; - } -+EXPORT_SYMBOL_GPL(db8500_prcmu_config_hotmon); - - static int config_hot_period(u16 val) - { -@@ -2074,11 +2075,13 @@ int db8500_prcmu_start_temp_sense(u16 cycles32k) - - return config_hot_period(cycles32k); - } -+EXPORT_SYMBOL_GPL(db8500_prcmu_start_temp_sense); - - int db8500_prcmu_stop_temp_sense(void) - { - return config_hot_period(0xFFFF); - } -+EXPORT_SYMBOL_GPL(db8500_prcmu_stop_temp_sense); - - static int prcmu_a9wdog(u8 cmd, u8 d0, u8 d1, u8 d2, u8 d3) - { -diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c -index 64d6f053c2a5..276998ea0267 100644 ---- a/drivers/mtd/spi-nor/spi-nor.c -+++ b/drivers/mtd/spi-nor/spi-nor.c -@@ -708,6 +708,12 @@ static const struct flash_info spi_nor_ids[] = { - - /* ISSI */ - { "is25cd512", INFO(0x7f9d20, 0, 32 * 1024, 2, SECT_4K) }, -+ { "is25wp032", INFO(0x9d7016, 0, 64 * 1024, 64, -+ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, -+ { "is25wp064", INFO(0x9d7017, 0, 64 * 1024, 128, -+ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, -+ { "is25wp128", INFO(0x9d7018, 0, 64 * 1024, 256, -+ SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ) }, - - /* Macronix */ - { "mx25l512e", INFO(0xc22010, 0, 64 * 1024, 1, SECT_4K) }, -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 78da1b7b4d86..a32dcb6718ca 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1107,11 +1107,11 @@ static void bond_compute_features(struct bonding *bond) - gso_max_size = min(gso_max_size, slave->dev->gso_max_size); - gso_max_segs = min(gso_max_segs, slave->dev->gso_max_segs); - } -+ bond_dev->hard_header_len = max_hard_header_len; - - done: - bond_dev->vlan_features = vlan_features; - bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL; -- bond_dev->hard_header_len = max_hard_header_len; - bond_dev->gso_max_segs = gso_max_segs; - netif_set_gso_max_size(bond_dev, gso_max_size); - -diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -index 7ae8374bff13..3dd4c39640dc 100644 ---- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -@@ -2147,6 +2147,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EPERM; - if (copy_from_user(&t, useraddr, sizeof(t))) - return -EFAULT; -+ if (t.cmd != CHELSIO_SET_QSET_PARAMS) -+ return -EINVAL; - if (t.qset_idx >= SGE_QSETS) - return -EINVAL; - if (!in_range(t.intr_lat, 0, M_NEWTIMER) || -@@ -2246,6 +2248,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - if (copy_from_user(&t, useraddr, sizeof(t))) - return -EFAULT; - -+ if (t.cmd != CHELSIO_GET_QSET_PARAMS) -+ return -EINVAL; -+ - /* Display qsets for all ports when offload enabled */ - if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) { - q1 = 0; -@@ -2291,6 +2296,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EBUSY; - if (copy_from_user(&edata, useraddr, sizeof(edata))) - return -EFAULT; -+ if (edata.cmd != CHELSIO_SET_QSET_NUM) -+ return -EINVAL; - if (edata.val < 1 || - (edata.val > 1 && !(adapter->flags & USING_MSIX))) - return -EINVAL; -@@ -2331,6 +2338,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EPERM; - if (copy_from_user(&t, useraddr, sizeof(t))) - return -EFAULT; -+ if (t.cmd != CHELSIO_LOAD_FW) -+ return -EINVAL; - /* Check t.len sanity ? */ - fw_data = memdup_user(useraddr + sizeof(t), t.len); - if (IS_ERR(fw_data)) -@@ -2354,6 +2363,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EBUSY; - if (copy_from_user(&m, useraddr, sizeof(m))) - return -EFAULT; -+ if (m.cmd != CHELSIO_SETMTUTAB) -+ return -EINVAL; - if (m.nmtus != NMTUS) - return -EINVAL; - if (m.mtus[0] < 81) /* accommodate SACK */ -@@ -2395,6 +2406,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EBUSY; - if (copy_from_user(&m, useraddr, sizeof(m))) - return -EFAULT; -+ if (m.cmd != CHELSIO_SET_PM) -+ return -EINVAL; - if (!is_power_of_2(m.rx_pg_sz) || - !is_power_of_2(m.tx_pg_sz)) - return -EINVAL; /* not power of 2 */ -@@ -2428,6 +2441,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EIO; /* need the memory controllers */ - if (copy_from_user(&t, useraddr, sizeof(t))) - return -EFAULT; -+ if (t.cmd != CHELSIO_GET_MEM) -+ return -EINVAL; - if ((t.addr & 7) || (t.len & 7)) - return -EINVAL; - if (t.mem_id == MEM_CM) -@@ -2480,6 +2495,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) - return -EAGAIN; - if (copy_from_user(&t, useraddr, sizeof(t))) - return -EFAULT; -+ if (t.cmd != CHELSIO_SET_TRACE_FILTER) -+ return -EINVAL; - - tp = (const struct trace_params *)&t.sip; - if (t.config_tx) -diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c -index f3f3b95d5512..97bf0c3d5c69 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_82575.c -+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c -@@ -223,17 +223,6 @@ static s32 igb_init_phy_params_82575(struct e1000_hw *hw) - hw->bus.func = (rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) >> - E1000_STATUS_FUNC_SHIFT; - -- /* Make sure the PHY is in a good state. Several people have reported -- * firmware leaving the PHY's page select register set to something -- * other than the default of zero, which causes the PHY ID read to -- * access something other than the intended register. -- */ -- ret_val = hw->phy.ops.reset(hw); -- if (ret_val) { -- hw_dbg("Error resetting the PHY.\n"); -- goto out; -- } -- - /* Set phy->phy_addr and phy->id. */ - ret_val = igb_get_phy_id_82575(hw); - if (ret_val) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h -index 1d2174526a4c..18e4e4a69262 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h -@@ -312,7 +312,7 @@ enum ixgbe_ring_f_enum { - }; - - #define IXGBE_MAX_RSS_INDICES 16 --#define IXGBE_MAX_RSS_INDICES_X550 64 -+#define IXGBE_MAX_RSS_INDICES_X550 63 - #define IXGBE_MAX_VMDQ_INDICES 64 - #define IXGBE_MAX_FDIR_INDICES 63 /* based on q_vector limit */ - #define IXGBE_MAX_FCOE_INDICES 8 -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -index 995f03107eac..04bc4df82fa7 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -@@ -3508,7 +3508,7 @@ struct ixgbe_info { - - #define IXGBE_FUSES0_GROUP(_i) (0x11158 + ((_i) * 4)) - #define IXGBE_FUSES0_300MHZ BIT(5) --#define IXGBE_FUSES0_REV1 BIT(6) -+#define IXGBE_FUSES0_REV_MASK (3 << 6) - - #define IXGBE_KRM_PORT_CAR_GEN_CTRL(P) ((P) ? 0x8010 : 0x4010) - #define IXGBE_KRM_LINK_CTRL_1(P) ((P) ? 0x820C : 0x420C) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index a75f2e3ce86f..ffd2e74e5638 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -1873,10 +1873,6 @@ static s32 ixgbe_enter_lplu_t_x550em(struct ixgbe_hw *hw) - u32 save_autoneg; - bool link_up; - -- /* SW LPLU not required on later HW revisions. */ -- if (IXGBE_FUSES0_REV1 & IXGBE_READ_REG(hw, IXGBE_FUSES0_GROUP(0))) -- return 0; -- - /* If blocked by MNG FW, then don't restart AN */ - if (ixgbe_check_reset_blocked(hw)) - return 0; -@@ -2030,8 +2026,9 @@ static s32 ixgbe_init_phy_ops_X550em(struct ixgbe_hw *hw) - } - - /* setup SW LPLU only for first revision */ -- if (!(IXGBE_FUSES0_REV1 & IXGBE_READ_REG(hw, -- IXGBE_FUSES0_GROUP(0)))) -+ if (hw->mac.type == ixgbe_mac_X550EM_x && -+ !(IXGBE_READ_REG(hw, IXGBE_FUSES0_GROUP(0)) & -+ IXGBE_FUSES0_REV_MASK)) - phy->ops.enter_lplu = ixgbe_enter_lplu_t_x550em; - - phy->ops.handle_lasi = ixgbe_handle_lasi_ext_t_x550em; -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index 50bbad37d640..723bda33472a 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -1014,6 +1014,8 @@ static int ixgbevf_poll(struct napi_struct *napi, int budget) - ixgbevf_for_each_ring(ring, q_vector->tx) - clean_complete &= ixgbevf_clean_tx_irq(q_vector, ring); - -+ if (budget <= 0) -+ return budget; - #ifdef CONFIG_NET_RX_BUSY_POLL - if (!ixgbevf_qv_lock_napi(q_vector)) - return budget; -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -index 4dccf7287f0f..52e4ed2f639d 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -@@ -251,8 +251,11 @@ static u32 freq_to_shift(u16 freq) - { - u32 freq_khz = freq * 1000; - u64 max_val_cycles = freq_khz * 1000 * MLX4_EN_WRAP_AROUND_SEC; -+ u64 tmp_rounded = -+ roundup_pow_of_two(max_val_cycles) > max_val_cycles ? -+ roundup_pow_of_two(max_val_cycles) - 1 : UINT_MAX; - u64 max_val_cycles_rounded = is_power_of_2(max_val_cycles + 1) ? -- max_val_cycles : roundup_pow_of_two(max_val_cycles) - 1; -+ max_val_cycles : tmp_rounded; - /* calculate max possible multiplier in order to fit in 64bit */ - u64 max_mul = div_u64(0xffffffffffffffffULL, max_val_cycles_rounded); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 22e72bf1ae48..7a716733d9ca 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -586,6 +586,8 @@ int mlx5e_redirect_rqt(struct mlx5e_priv *priv, enum mlx5e_rqt_ix rqt_ix); - - int mlx5e_open_locked(struct net_device *netdev); - int mlx5e_close_locked(struct net_device *netdev); -+void mlx5e_build_default_indir_rqt(u32 *indirection_rqt, int len, -+ int num_channels); - - static inline void mlx5e_tx_notify_hw(struct mlx5e_sq *sq, - struct mlx5e_tx_wqe *wqe, int bf_sz) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 7cc9df717323..7ee301310817 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -385,6 +385,8 @@ static int mlx5e_set_channels(struct net_device *dev, - mlx5e_close_locked(dev); - - priv->params.num_channels = count; -+ mlx5e_build_default_indir_rqt(priv->params.indirection_rqt, -+ MLX5E_INDIR_RQT_SIZE, count); - - if (was_opened) - err = mlx5e_open_locked(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 90e876ecc720..26d25ecdca7e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -1186,7 +1186,6 @@ static void mlx5e_fill_indir_rqt_rqns(struct mlx5e_priv *priv, void *rqtc) - ix = mlx5e_bits_invert(i, MLX5E_LOG_INDIR_RQT_SIZE); - - ix = priv->params.indirection_rqt[ix]; -- ix = ix % priv->params.num_channels; - MLX5_SET(rqtc, rqtc, rq_num[i], - test_bit(MLX5E_STATE_OPENED, &priv->state) ? - priv->channel[ix]->rq.rqn : -@@ -1304,7 +1303,7 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv) - lro_timer_supported_periods[2])); - } - --static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt) -+static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv) - { - struct mlx5_core_dev *mdev = priv->mdev; - -@@ -1312,6 +1311,7 @@ static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt) - void *tirc; - int inlen; - int err; -+ int tt; - - inlen = MLX5_ST_SZ_BYTES(modify_tir_in); - in = mlx5_vzalloc(inlen); -@@ -1323,7 +1323,11 @@ static int mlx5e_modify_tir_lro(struct mlx5e_priv *priv, int tt) - - mlx5e_build_tir_ctx_lro(tirc, priv); - -- err = mlx5_core_modify_tir(mdev, priv->tirn[tt], in, inlen); -+ for (tt = 0; tt < MLX5E_NUM_TT; tt++) { -+ err = mlx5_core_modify_tir(mdev, priv->tirn[tt], in, inlen); -+ if (err) -+ break; -+ } - - kvfree(in); - -@@ -1870,8 +1874,10 @@ static int mlx5e_set_features(struct net_device *netdev, - mlx5e_close_locked(priv->netdev); - - priv->params.lro_en = !!(features & NETIF_F_LRO); -- mlx5e_modify_tir_lro(priv, MLX5E_TT_IPV4_TCP); -- mlx5e_modify_tir_lro(priv, MLX5E_TT_IPV6_TCP); -+ err = mlx5e_modify_tirs_lro(priv); -+ if (err) -+ mlx5_core_warn(priv->mdev, "lro modify failed, %d\n", -+ err); - - if (was_opened) - err = mlx5e_open_locked(priv->netdev); -@@ -1976,12 +1982,20 @@ u16 mlx5e_get_max_inline_cap(struct mlx5_core_dev *mdev) - 2 /*sizeof(mlx5e_tx_wqe.inline_hdr_start)*/; - } - -+void mlx5e_build_default_indir_rqt(u32 *indirection_rqt, int len, -+ int num_channels) -+{ -+ int i; -+ -+ for (i = 0; i < len; i++) -+ indirection_rqt[i] = i % num_channels; -+} -+ - static void mlx5e_build_netdev_priv(struct mlx5_core_dev *mdev, - struct net_device *netdev, - int num_channels) - { - struct mlx5e_priv *priv = netdev_priv(netdev); -- int i; - - priv->params.log_sq_size = - MLX5E_PARAMS_DEFAULT_LOG_SQ_SIZE; -@@ -2005,8 +2019,8 @@ static void mlx5e_build_netdev_priv(struct mlx5_core_dev *mdev, - netdev_rss_key_fill(priv->params.toeplitz_hash_key, - sizeof(priv->params.toeplitz_hash_key)); - -- for (i = 0; i < MLX5E_INDIR_RQT_SIZE; i++) -- priv->params.indirection_rqt[i] = i % num_channels; -+ mlx5e_build_default_indir_rqt(priv->params.indirection_rqt, -+ MLX5E_INDIR_RQT_SIZE, num_channels); - - priv->params.lro_wqe_sz = - MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ; -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index c6782ebd35e1..93543e176829 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -7540,17 +7540,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget) - struct rtl8169_private *tp = container_of(napi, struct rtl8169_private, napi); - struct net_device *dev = tp->dev; - u16 enable_mask = RTL_EVENT_NAPI | tp->event_slow; -- int work_done= 0; -+ int work_done; - u16 status; - - status = rtl_get_events(tp); - rtl_ack_events(tp, status & ~tp->event_slow); - -- if (status & RTL_EVENT_NAPI_RX) -- work_done = rtl_rx(dev, tp, (u32) budget); -+ work_done = rtl_rx(dev, tp, (u32) budget); - -- if (status & RTL_EVENT_NAPI_TX) -- rtl_tx(dev, tp); -+ rtl_tx(dev, tp); - - if (status & tp->event_slow) { - enable_mask &= ~tp->event_slow; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -index bba670c42e37..90d95b3654f5 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -@@ -130,7 +130,7 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg, - */ - int stmmac_mdio_reset(struct mii_bus *bus) - { --#if defined(CONFIG_STMMAC_PLATFORM) -+#if IS_ENABLED(CONFIG_STMMAC_PLATFORM) - struct net_device *ndev = bus->priv; - struct stmmac_priv *priv = netdev_priv(ndev); - unsigned int mii_address = priv->hw->mii.addr; -diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c -index 7fbd8f044207..2092ef6431f2 100644 ---- a/drivers/net/usb/asix_common.c -+++ b/drivers/net/usb/asix_common.c -@@ -449,6 +449,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) - struct usbnet *dev = netdev_priv(net); - u8 opt = 0; - -+ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) -+ return -EINVAL; -+ - if (wolinfo->wolopts & WAKE_PHY) - opt |= AX_MONITOR_LINK; - if (wolinfo->wolopts & WAKE_MAGIC) -diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c -index e6338c16081a..e3f2e6098db4 100644 ---- a/drivers/net/usb/ax88179_178a.c -+++ b/drivers/net/usb/ax88179_178a.c -@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) - struct usbnet *dev = netdev_priv(net); - u8 opt = 0; - -+ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) -+ return -EINVAL; -+ - if (wolinfo->wolopts & WAKE_PHY) - opt |= AX_MONITOR_MODE_RWLC; - if (wolinfo->wolopts & WAKE_MAGIC) -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 1aede726052c..45a6a7cae4bf 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -1051,19 +1051,10 @@ static int lan78xx_set_wol(struct net_device *netdev, - if (ret < 0) - return ret; - -- pdata->wol = 0; -- if (wol->wolopts & WAKE_UCAST) -- pdata->wol |= WAKE_UCAST; -- if (wol->wolopts & WAKE_MCAST) -- pdata->wol |= WAKE_MCAST; -- if (wol->wolopts & WAKE_BCAST) -- pdata->wol |= WAKE_BCAST; -- if (wol->wolopts & WAKE_MAGIC) -- pdata->wol |= WAKE_MAGIC; -- if (wol->wolopts & WAKE_PHY) -- pdata->wol |= WAKE_PHY; -- if (wol->wolopts & WAKE_ARP) -- pdata->wol |= WAKE_ARP; -+ if (wol->wolopts & ~WAKE_ALL) -+ return -EINVAL; -+ -+ pdata->wol = wol->wolopts; - - device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts); - -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 2bb336cb13ee..2d83689374bb 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -3663,6 +3663,9 @@ static int rtl8152_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol) - if (!rtl_can_wakeup(tp)) - return -EOPNOTSUPP; - -+ if (wol->wolopts & ~WAKE_ANY) -+ return -EINVAL; -+ - ret = usb_autopm_get_interface(tp->intf); - if (ret < 0) - goto out_set_wol; -diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c -index 8dbe086e0a96..234febc6e1d9 100644 ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -728,6 +728,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net, - struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); - int ret; - -+ if (wolinfo->wolopts & ~SUPPORTED_WAKE) -+ return -EINVAL; -+ - pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; - - ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); -diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c -index 66b3ab9f614e..7cee7777d13f 100644 ---- a/drivers/net/usb/smsc95xx.c -+++ b/drivers/net/usb/smsc95xx.c -@@ -727,6 +727,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, - struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); - int ret; - -+ if (wolinfo->wolopts & ~SUPPORTED_WAKE) -+ return -EINVAL; -+ - pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; - - ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); -diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c -index a50df0d8fb9a..004c955c1fd1 100644 ---- a/drivers/net/usb/sr9800.c -+++ b/drivers/net/usb/sr9800.c -@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) - struct usbnet *dev = netdev_priv(net); - u8 opt = 0; - -+ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) -+ return -EINVAL; -+ - if (wolinfo->wolopts & WAKE_PHY) - opt |= SR_MONITOR_LINK; - if (wolinfo->wolopts & WAKE_MAGIC) -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c -index 91da67657f81..72e1796c8167 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c -@@ -705,7 +705,7 @@ done: - int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, - struct sk_buff_head *pktq, uint totlen) - { -- struct sk_buff *glom_skb; -+ struct sk_buff *glom_skb = NULL; - struct sk_buff *skb; - u32 addr = sdiodev->sbwad; - int err = 0; -@@ -726,10 +726,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, - return -ENOMEM; - err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, - glom_skb); -- if (err) { -- brcmu_pkt_buf_free_skb(glom_skb); -+ if (err) - goto done; -- } - - skb_queue_walk(pktq, skb) { - memcpy(skb->data, glom_skb->data, skb->len); -@@ -740,6 +738,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, - pktq); - - done: -+ brcmu_pkt_buf_free_skb(glom_skb); - return err; - } - -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index c98cb962b454..05413176a5d6 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2547,8 +2547,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, - list_add_tail(&data->list, &hwsim_radios); - spin_unlock_bh(&hwsim_radio_lock); - -- if (idx > 0) -- hwsim_mcast_new_radio(idx, info, param); -+ hwsim_mcast_new_radio(idx, info, param); - - return idx; - -diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c -index d877ff124365..4eb254a273f8 100644 ---- a/drivers/ptp/ptp_chardev.c -+++ b/drivers/ptp/ptp_chardev.c -@@ -23,6 +23,8 @@ - #include - #include - -+#include -+ - #include "ptp_private.h" - - static int ptp_disable_pinfunc(struct ptp_clock_info *ops, -@@ -224,6 +226,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) - err = -EINVAL; - break; - } -+ pin_index = array_index_nospec(pin_index, ops->n_pins); - if (mutex_lock_interruptible(&ptp->pincfg_mux)) - return -ERESTARTSYS; - pd = ops->pin_config[pin_index]; -@@ -242,6 +245,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) - err = -EINVAL; - break; - } -+ pin_index = array_index_nospec(pin_index, ops->n_pins); - if (mutex_lock_interruptible(&ptp->pincfg_mux)) - return -ERESTARTSYS; - err = ptp_set_pinfunc(ptp, pin_index, pd.func, pd.chan); -diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c -index 8da8b46da722..1c447405ebbf 100644 ---- a/drivers/scsi/aacraid/linit.c -+++ b/drivers/scsi/aacraid/linit.c -@@ -1416,8 +1416,8 @@ static int aac_acquire_resources(struct aac_dev *dev) - /* After EEH recovery or suspend resume, max_msix count - * may change, therfore updating in init as well. - */ -- aac_adapter_start(dev); - dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix); -+ aac_adapter_start(dev); - } - return 0; - -diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c -index e415e1c58eb5..cf3ac0654a3a 100644 ---- a/drivers/scsi/aacraid/src.c -+++ b/drivers/scsi/aacraid/src.c -@@ -444,7 +444,7 @@ err_out: - return -1; - - err_blink: -- return (status > 16) & 0xFF; -+ return (status >> 16) & 0xFF; - } - - /** -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 692445bcca6f..850ddc5fac04 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -381,11 +381,12 @@ static void scsi_target_reap_ref_release(struct kref *kref) - = container_of(kref, struct scsi_target, reap_ref); - - /* -- * if we get here and the target is still in the CREATED state that -+ * if we get here and the target is still in a CREATED state that - * means it was allocated but never made visible (because a scan - * turned up no LUNs), so don't call device_del() on it. - */ -- if (starget->state != STARGET_CREATED) { -+ if ((starget->state != STARGET_CREATED) && -+ (starget->state != STARGET_CREATED_REMOVE)) { - transport_remove_device(&starget->dev); - device_del(&starget->dev); - } -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 8db0c48943d6..085e470d1c49 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -1212,11 +1212,15 @@ restart: - spin_lock_irqsave(shost->host_lock, flags); - list_for_each_entry(starget, &shost->__targets, siblings) { - if (starget->state == STARGET_DEL || -- starget->state == STARGET_REMOVE) -+ starget->state == STARGET_REMOVE || -+ starget->state == STARGET_CREATED_REMOVE) - continue; - if (starget->dev.parent == dev || &starget->dev == dev) { - kref_get(&starget->reap_ref); -- starget->state = STARGET_REMOVE; -+ if (starget->state == STARGET_CREATED) -+ starget->state = STARGET_CREATED_REMOVE; -+ else -+ starget->state = STARGET_REMOVE; - spin_unlock_irqrestore(shost->host_lock, flags); - __scsi_remove_target(starget); - scsi_target_reap(starget); -diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c -index 55789f7cda92..645f428ad0a2 100644 ---- a/drivers/spi/spi-bcm63xx-hsspi.c -+++ b/drivers/spi/spi-bcm63xx-hsspi.c -@@ -336,8 +336,8 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(dev, "no irq\n"); -- return -ENXIO; -+ dev_err(dev, "no irq: %d\n", irq); -+ return irq; - } - - res_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c -index bf9a610e5b89..f14500910bc2 100644 ---- a/drivers/spi/spi-bcm63xx.c -+++ b/drivers/spi/spi-bcm63xx.c -@@ -496,8 +496,8 @@ static int bcm63xx_spi_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(dev, "no irq\n"); -- return -ENXIO; -+ dev_err(dev, "no irq: %d\n", irq); -+ return irq; - } - - clk = devm_clk_get(dev, "spi"); -diff --git a/drivers/spi/spi-xlp.c b/drivers/spi/spi-xlp.c -index 8f04feca6ee3..0ddb0adaa8aa 100644 ---- a/drivers/spi/spi-xlp.c -+++ b/drivers/spi/spi-xlp.c -@@ -392,8 +392,8 @@ static int xlp_spi_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(&pdev->dev, "no IRQ resource found\n"); -- return -EINVAL; -+ dev_err(&pdev->dev, "no IRQ resource found: %d\n", irq); -+ return irq; - } - err = devm_request_irq(&pdev->dev, irq, xlp_spi_interrupt, 0, - pdev->name, xspi); -diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig -index 4b660b5beb98..1def65d2f0b5 100644 ---- a/drivers/thermal/Kconfig -+++ b/drivers/thermal/Kconfig -@@ -195,7 +195,7 @@ config IMX_THERMAL - passive trip is crossed. - - config SPEAR_THERMAL -- bool "SPEAr thermal sensor driver" -+ tristate "SPEAr thermal sensor driver" - depends on PLAT_SPEAR || COMPILE_TEST - depends on OF - help -@@ -237,8 +237,8 @@ config DOVE_THERMAL - framework. - - config DB8500_THERMAL -- bool "DB8500 thermal management" -- depends on ARCH_U8500 -+ tristate "DB8500 thermal management" -+ depends on MFD_DB8500_PRCMU - default y - help - Adds DB8500 thermal management implementation according to the thermal -diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c -index 9dbae01d41ce..1e302caaa450 100644 ---- a/drivers/tty/serial/sprd_serial.c -+++ b/drivers/tty/serial/sprd_serial.c -@@ -731,8 +731,8 @@ static int sprd_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(&pdev->dev, "not provide irq resource\n"); -- return -ENODEV; -+ dev_err(&pdev->dev, "not provide irq resource: %d\n", irq); -+ return irq; - } - up->irq = irq; - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index a501f3ba6a3f..3cbf6aa10f2c 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -332,17 +332,17 @@ static void acm_ctrl_irq(struct urb *urb) - - if (difference & ACM_CTRL_DSR) - acm->iocount.dsr++; -- if (difference & ACM_CTRL_BRK) -- acm->iocount.brk++; -- if (difference & ACM_CTRL_RI) -- acm->iocount.rng++; - if (difference & ACM_CTRL_DCD) - acm->iocount.dcd++; -- if (difference & ACM_CTRL_FRAMING) -+ if (newctrl & ACM_CTRL_BRK) -+ acm->iocount.brk++; -+ if (newctrl & ACM_CTRL_RI) -+ acm->iocount.rng++; -+ if (newctrl & ACM_CTRL_FRAMING) - acm->iocount.frame++; -- if (difference & ACM_CTRL_PARITY) -+ if (newctrl & ACM_CTRL_PARITY) - acm->iocount.parity++; -- if (difference & ACM_CTRL_OVERRUN) -+ if (newctrl & ACM_CTRL_OVERRUN) - acm->iocount.overrun++; - spin_unlock(&acm->read_lock); - -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 5e0af15aebc4..7559d96695da 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -1329,8 +1329,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - u = 0; - switch (uurb->type) { - case USBDEVFS_URB_TYPE_CONTROL: -- if (is_in) -- allow_short = true; - if (!usb_endpoint_xfer_control(&ep->desc)) - return -EINVAL; - /* min 8 byte setup packet */ -@@ -1360,6 +1358,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - is_in = 0; - uurb->endpoint &= ~USB_DIR_IN; - } -+ if (is_in) -+ allow_short = true; - snoop(&ps->dev->dev, "control urb: bRequestType=%02x " - "bRequest=%02x wValue=%04x " - "wIndex=%04x wLength=%04x\n", -diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c -index 22e9606d8e08..9078af0ce06c 100644 ---- a/drivers/usb/dwc3/dwc3-omap.c -+++ b/drivers/usb/dwc3/dwc3-omap.c -@@ -469,8 +469,8 @@ static int dwc3_omap_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(dev, "missing IRQ resource\n"); -- return -EINVAL; -+ dev_err(dev, "missing IRQ resource: %d\n", irq); -+ return irq; - } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c -index 4dd3c7672247..25488c89308a 100644 ---- a/drivers/usb/gadget/function/f_mass_storage.c -+++ b/drivers/usb/gadget/function/f_mass_storage.c -@@ -220,6 +220,8 @@ - #include - #include - -+#include -+ - #include "configfs.h" - - -@@ -3260,6 +3262,7 @@ static struct config_group *fsg_lun_make(struct config_group *group, - fsg_opts = to_fsg_opts(&group->cg_item); - if (num >= FSG_MAX_LUNS) - return ERR_PTR(-ERANGE); -+ num = array_index_nospec(num, FSG_MAX_LUNS); - - mutex_lock(&fsg_opts->lock); - if (fsg_opts->refcnt || fsg_opts->common->luns[num]) { -diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c -index a24720beb39d..cccde8217f28 100644 ---- a/drivers/usb/host/ehci-omap.c -+++ b/drivers/usb/host/ehci-omap.c -@@ -130,8 +130,8 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(dev, "EHCI irq failed\n"); -- return -ENODEV; -+ dev_err(dev, "EHCI irq failed: %d\n", irq); -+ return irq; - } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c -index f542045dc2a6..e25d72e0527f 100644 ---- a/drivers/usb/host/imx21-hcd.c -+++ b/drivers/usb/host/imx21-hcd.c -@@ -1849,8 +1849,10 @@ static int imx21_probe(struct platform_device *pdev) - if (!res) - return -ENODEV; - irq = platform_get_irq(pdev, 0); -- if (irq < 0) -- return -ENXIO; -+ if (irq < 0) { -+ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", irq); -+ return irq; -+ } - - hcd = usb_create_hcd(&imx21_hc_driver, - &pdev->dev, dev_name(&pdev->dev)); -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 02f86dd1a340..90a7bffe3484 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -808,12 +808,24 @@ Retry_Sense: - if (result == USB_STOR_TRANSPORT_GOOD) { - srb->result = SAM_STAT_GOOD; - srb->sense_buffer[0] = 0x0; -+ } -+ -+ /* -+ * ATA-passthru commands use sense data to report -+ * the command completion status, and often devices -+ * return Check Condition status when nothing is -+ * wrong. -+ */ -+ else if (srb->cmnd[0] == ATA_16 || -+ srb->cmnd[0] == ATA_12) { -+ /* leave the data alone */ -+ } - - /* If there was a problem, report an unspecified - * hardware error to prevent the higher layers from - * entering an infinite retry loop. - */ -- } else { -+ else { - srb->result = DID_ERROR << 16; - if ((sshdr.response_code & 0x72) == 0x72) - srb->sense_buffer[1] = HARDWARE_ERROR; -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index 675819a1af37..c54d388310f0 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - #include "vhost.h" - -@@ -748,6 +749,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp) - if (idx >= d->nvqs) - return -ENOBUFS; - -+ idx = array_index_nospec(idx, d->nvqs); - vq = d->vqs[idx]; - - mutex_lock(&vq->mutex); -diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c -index efb57c059997..5190b1749e2a 100644 ---- a/drivers/video/fbdev/pxa168fb.c -+++ b/drivers/video/fbdev/pxa168fb.c -@@ -712,7 +712,7 @@ static int pxa168fb_probe(struct platform_device *pdev) - /* - * enable controller clock - */ -- clk_enable(fbi->clk); -+ clk_prepare_enable(fbi->clk); - - pxa168fb_set_par(info); - -@@ -767,7 +767,7 @@ static int pxa168fb_probe(struct platform_device *pdev) - failed_free_cmap: - fb_dealloc_cmap(&info->cmap); - failed_free_clk: -- clk_disable(fbi->clk); -+ clk_disable_unprepare(fbi->clk); - failed_free_fbmem: - dma_free_coherent(fbi->dev, info->fix.smem_len, - info->screen_base, fbi->fb_start_dma); -@@ -807,7 +807,7 @@ static int pxa168fb_remove(struct platform_device *pdev) - dma_free_writecombine(fbi->dev, PAGE_ALIGN(info->fix.smem_len), - info->screen_base, info->fix.smem_start); - -- clk_disable(fbi->clk); -+ clk_disable_unprepare(fbi->clk); - - framebuffer_release(info); - -diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c -index 50bce45e7f3d..933619da1a94 100644 ---- a/drivers/video/fbdev/pxa3xx-gcu.c -+++ b/drivers/video/fbdev/pxa3xx-gcu.c -@@ -626,8 +626,8 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) - /* request the IRQ */ - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- dev_err(dev, "no IRQ defined\n"); -- return -ENODEV; -+ dev_err(dev, "no IRQ defined: %d\n", irq); -+ return irq; - } - - ret = devm_request_irq(dev, irq, pxa3xx_gcu_handle_irq, -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index ae6e3a30e61e..8dbb00fbb00b 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1608,8 +1608,8 @@ fail: - return ret; - } - --static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -- u64 root_id) -+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -+ u64 root_id) - { - struct btrfs_root *root; - -diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h -index adeb31830b9c..3c9819403487 100644 ---- a/fs/btrfs/disk-io.h -+++ b/fs/btrfs/disk-io.h -@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info, - struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root, - struct btrfs_key *location); - int btrfs_init_fs_root(struct btrfs_root *root); -+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info, -+ u64 root_id); - int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info, - struct btrfs_root *root); - void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info); -diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c -index 2c849b08a91b..6a6efb26d52f 100644 ---- a/fs/btrfs/root-tree.c -+++ b/fs/btrfs/root-tree.c -@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root) - root_key.objectid = key.offset; - key.offset++; - -+ /* -+ * The root might have been inserted already, as before we look -+ * for orphan roots, log replay might have happened, which -+ * triggers a transaction commit and qgroup accounting, which -+ * in turn reads and inserts fs roots while doing backref -+ * walking. -+ */ -+ root = btrfs_lookup_fs_root(tree_root->fs_info, -+ root_key.objectid); -+ if (root) { -+ WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, -+ &root->state)); -+ if (btrfs_root_refs(&root->root_item) == 0) -+ btrfs_add_dead_root(root); -+ continue; -+ } -+ - root = btrfs_read_fs_root(tree_root, &root_key); - err = PTR_ERR_OR_ZERO(root); - if (err && err != -ENOENT) { -@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root) - set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state); - - err = btrfs_insert_fs_root(root->fs_info, root); -- /* -- * The root might have been inserted already, as before we look -- * for orphan roots, log replay might have happened, which -- * triggers a transaction commit and qgroup accounting, which -- * in turn reads and inserts fs roots while doing backref -- * walking. -- */ -- if (err == -EEXIST) -- err = 0; - if (err) { -+ BUG_ON(err == -EEXIST); - btrfs_free_fs_root(root); - break; - } -diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c -index c43b4b08546b..a5f59eed8287 100644 ---- a/fs/cachefiles/namei.c -+++ b/fs/cachefiles/namei.c -@@ -317,7 +317,7 @@ try_again: - trap = lock_rename(cache->graveyard, dir); - - /* do some checks before getting the grave dentry */ -- if (rep->d_parent != dir) { -+ if (rep->d_parent != dir || IS_DEADDIR(d_inode(rep))) { - /* the entry was probably culled when we dropped the parent dir - * lock */ - unlock_rename(cache->graveyard, dir); -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 077ad3a06c9a..1eeb4780c3ed 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -3674,6 +3674,9 @@ try_mount_again: - if (IS_ERR(tcon)) { - rc = PTR_ERR(tcon); - tcon = NULL; -+ if (rc == -EACCES) -+ goto mount_fail_check; -+ - goto remote_path_check; - } - -diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c -index a70e37c47a78..e3fc477728b3 100644 ---- a/fs/fat/fatent.c -+++ b/fs/fat/fatent.c -@@ -681,6 +681,7 @@ int fat_count_free_clusters(struct super_block *sb) - if (ops->ent_get(&fatent) == FAT_ENT_FREE) - free++; - } while (fat_ent_next(sbi, &fatent)); -+ cond_resched(); - } - sbi->free_clusters = free; - sbi->free_clus_valid = 1; -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 8577f3ba6dc6..7014318f6d18 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -625,7 +625,7 @@ static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req) - struct fuse_io_priv *io = req->io; - ssize_t pos = -1; - -- fuse_release_user_pages(req, !io->write); -+ fuse_release_user_pages(req, io->should_dirty); - - if (io->write) { - if (req->misc.write.in.size != req->misc.write.out.size) -@@ -1333,7 +1333,6 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, - loff_t *ppos, int flags) - { - int write = flags & FUSE_DIO_WRITE; -- bool should_dirty = !write && iter_is_iovec(iter); - int cuse = flags & FUSE_DIO_CUSE; - struct file *file = io->file; - struct inode *inode = file->f_mapping->host; -@@ -1362,6 +1361,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, - mutex_unlock(&inode->i_mutex); - } - -+ io->should_dirty = !write && iter_is_iovec(iter); - while (count) { - size_t nres; - fl_owner_t owner = current->files; -@@ -1378,7 +1378,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, - nres = fuse_send_read(req, io, pos, nbytes, owner); - - if (!io->async) -- fuse_release_user_pages(req, should_dirty); -+ fuse_release_user_pages(req, io->should_dirty); - if (req->out.h.error) { - if (!res) - res = req->out.h.error; -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index 7aafe9acc6c0..c6eb35a95fcc 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -252,6 +252,7 @@ struct fuse_io_priv { - size_t size; - __u64 offset; - bool write; -+ bool should_dirty; - int err; - struct kiocb *iocb; - struct file *file; -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 132585a7fbd8..bae3da5bcda0 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -177,7 +177,6 @@ void bpf_register_map_type(struct bpf_map_type_list *tl); - struct bpf_prog *bpf_prog_get(u32 ufd); - struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog); - void bpf_prog_put(struct bpf_prog *prog); --void bpf_prog_put_rcu(struct bpf_prog *prog); - - struct bpf_map *bpf_map_get_with_uref(u32 ufd); - struct bpf_map *__bpf_map_get(struct fd f); -@@ -208,10 +207,6 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd) - static inline void bpf_prog_put(struct bpf_prog *prog) - { - } -- --static inline void bpf_prog_put_rcu(struct bpf_prog *prog) --{ --} - #endif /* CONFIG_BPF_SYSCALL */ - - /* verifier prototypes for helper functions called from eBPF programs */ -diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h -index 786ad32631a6..07b83d32f66c 100644 ---- a/include/linux/cpuidle.h -+++ b/include/linux/cpuidle.h -@@ -152,6 +152,8 @@ extern void cpuidle_disable_device(struct cpuidle_device *dev); - extern int cpuidle_play_dead(void); - - extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev); -+static inline struct cpuidle_device *cpuidle_get_device(void) -+{return __this_cpu_read(cpuidle_devices); } - #else - static inline void disable_cpuidle(void) { } - static inline bool cpuidle_not_available(struct cpuidle_driver *drv, -@@ -187,6 +189,7 @@ static inline void cpuidle_disable_device(struct cpuidle_device *dev) { } - static inline int cpuidle_play_dead(void) {return -ENODEV; } - static inline struct cpuidle_driver *cpuidle_get_cpu_driver( - struct cpuidle_device *dev) {return NULL; } -+static inline struct cpuidle_device *cpuidle_get_device(void) {return NULL; } - #endif - - #if defined(CONFIG_CPU_IDLE) && defined(CONFIG_SUSPEND) -diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h -index 5d5174b59802..673dee29a9b9 100644 ---- a/include/linux/radix-tree.h -+++ b/include/linux/radix-tree.h -@@ -382,6 +382,7 @@ static inline __must_check - void **radix_tree_iter_retry(struct radix_tree_iter *iter) - { - iter->next_index = iter->index; -+ iter->tags = 0; - return NULL; - } - -diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h -index 0dc0a51da38f..dce2d586d9ce 100644 ---- a/include/net/inet_ecn.h -+++ b/include/net/inet_ecn.h -@@ -128,7 +128,8 @@ static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph) - to = from | htonl(INET_ECN_CE << 20); - *(__be32 *)iph = to; - if (skb->ip_summed == CHECKSUM_COMPLETE) -- skb->csum = csum_add(csum_sub(skb->csum, from), to); -+ skb->csum = csum_add(csum_sub(skb->csum, (__force __wsum)from), -+ (__force __wsum)to); - return 1; - } - -diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h -index 293b9a7f53bc..fb53a94a5e8b 100644 ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -240,6 +240,7 @@ enum scsi_target_state { - STARGET_CREATED = 1, - STARGET_RUNNING, - STARGET_REMOVE, -+ STARGET_CREATED_REMOVE, - STARGET_DEL, - }; - -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index 0eb11b4ac4c7..daa4e0782cf7 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -270,9 +270,7 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map, int fd) - - static void prog_fd_array_put_ptr(void *ptr) - { -- struct bpf_prog *prog = ptr; -- -- bpf_prog_put_rcu(prog); -+ bpf_prog_put(ptr); - } - - /* decrement refcnt of all bpf_progs that are stored in this map */ -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 4b9bbfe764e8..04fc1022ad9f 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -487,7 +487,7 @@ static void bpf_prog_uncharge_memlock(struct bpf_prog *prog) - free_uid(user); - } - --static void __prog_put_common(struct rcu_head *rcu) -+static void __bpf_prog_put_rcu(struct rcu_head *rcu) - { - struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu); - -@@ -496,17 +496,10 @@ static void __prog_put_common(struct rcu_head *rcu) - bpf_prog_free(aux->prog); - } - --/* version of bpf_prog_put() that is called after a grace period */ --void bpf_prog_put_rcu(struct bpf_prog *prog) --{ -- if (atomic_dec_and_test(&prog->aux->refcnt)) -- call_rcu(&prog->aux->rcu, __prog_put_common); --} -- - void bpf_prog_put(struct bpf_prog *prog) - { - if (atomic_dec_and_test(&prog->aux->refcnt)) -- __prog_put_common(&prog->aux->rcu); -+ call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu); - } - EXPORT_SYMBOL_GPL(bpf_prog_put); - -@@ -514,7 +507,7 @@ static int bpf_prog_release(struct inode *inode, struct file *filp) - { - struct bpf_prog *prog = filp->private_data; - -- bpf_prog_put_rcu(prog); -+ bpf_prog_put(prog); - return 0; - } - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 990ac41d8a5f..e53dfb5b826e 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -7018,6 +7018,8 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size, - goto unlock; - - list_for_each_entry_rcu(event, &ctx->event_list, event_entry) { -+ if (event->cpu != smp_processor_id()) -+ continue; - if (event->attr.type != PERF_TYPE_TRACEPOINT) - continue; - if (event->attr.config != entry->type) -@@ -7139,7 +7141,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) - prog = event->tp_event->prog; - if (prog && event->tp_event->bpf_prog_owner == event) { - event->tp_event->prog = NULL; -- bpf_prog_put_rcu(prog); -+ bpf_prog_put(prog); - } - } - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 65ed3501c2ca..4743e1f2a3d1 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -7817,11 +7817,9 @@ void sched_destroy_group(struct task_group *tg) - void sched_offline_group(struct task_group *tg) - { - unsigned long flags; -- int i; - - /* end participation in shares distribution */ -- for_each_possible_cpu(i) -- unregister_fair_sched_group(tg, i); -+ unregister_fair_sched_group(tg); - - spin_lock_irqsave(&task_group_lock, flags); - list_del_rcu(&tg->list); -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 3b136fb4422c..c2af250547bb 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -3624,9 +3624,13 @@ static void throttle_cfs_rq(struct cfs_rq *cfs_rq) - - /* - * Add to the _head_ of the list, so that an already-started -- * distribute_cfs_runtime will not see us -+ * distribute_cfs_runtime will not see us. If disribute_cfs_runtime is -+ * not running add to the tail so that later runqueues don't get starved. - */ -- list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); -+ if (cfs_b->distribute_running) -+ list_add_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); -+ else -+ list_add_tail_rcu(&cfs_rq->throttled_list, &cfs_b->throttled_cfs_rq); - - /* - * If we're the first throttled task, make sure the bandwidth -@@ -3769,14 +3773,16 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun) - * in us over-using our runtime if it is all used during this loop, but - * only by limited amounts in that extreme case. - */ -- while (throttled && cfs_b->runtime > 0) { -+ while (throttled && cfs_b->runtime > 0 && !cfs_b->distribute_running) { - runtime = cfs_b->runtime; -+ cfs_b->distribute_running = 1; - raw_spin_unlock(&cfs_b->lock); - /* we can't nest cfs_b->lock while distributing bandwidth */ - runtime = distribute_cfs_runtime(cfs_b, runtime, - runtime_expires); - raw_spin_lock(&cfs_b->lock); - -+ cfs_b->distribute_running = 0; - throttled = !list_empty(&cfs_b->throttled_cfs_rq); - - cfs_b->runtime -= min(runtime, cfs_b->runtime); -@@ -3887,6 +3893,11 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) - - /* confirm we're still not at a refresh boundary */ - raw_spin_lock(&cfs_b->lock); -+ if (cfs_b->distribute_running) { -+ raw_spin_unlock(&cfs_b->lock); -+ return; -+ } -+ - if (runtime_refresh_within(cfs_b, min_bandwidth_expiration)) { - raw_spin_unlock(&cfs_b->lock); - return; -@@ -3896,6 +3907,9 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) - runtime = cfs_b->runtime; - - expires = cfs_b->runtime_expires; -+ if (runtime) -+ cfs_b->distribute_running = 1; -+ - raw_spin_unlock(&cfs_b->lock); - - if (!runtime) -@@ -3906,6 +3920,7 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b) - raw_spin_lock(&cfs_b->lock); - if (expires == cfs_b->runtime_expires) - cfs_b->runtime -= min(runtime, cfs_b->runtime); -+ cfs_b->distribute_running = 0; - raw_spin_unlock(&cfs_b->lock); - } - -@@ -4017,6 +4032,7 @@ void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) - cfs_b->period_timer.function = sched_cfs_period_timer; - hrtimer_init(&cfs_b->slack_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); - cfs_b->slack_timer.function = sched_cfs_slack_timer; -+ cfs_b->distribute_running = 0; - } - - static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) -@@ -8154,11 +8170,8 @@ void free_fair_sched_group(struct task_group *tg) - for_each_possible_cpu(i) { - if (tg->cfs_rq) - kfree(tg->cfs_rq[i]); -- if (tg->se) { -- if (tg->se[i]) -- remove_entity_load_avg(tg->se[i]); -+ if (tg->se) - kfree(tg->se[i]); -- } - } - - kfree(tg->cfs_rq); -@@ -8206,21 +8219,29 @@ err: - return 0; - } - --void unregister_fair_sched_group(struct task_group *tg, int cpu) -+void unregister_fair_sched_group(struct task_group *tg) - { -- struct rq *rq = cpu_rq(cpu); - unsigned long flags; -+ struct rq *rq; -+ int cpu; - -- /* -- * Only empty task groups can be destroyed; so we can speculatively -- * check on_list without danger of it being re-added. -- */ -- if (!tg->cfs_rq[cpu]->on_list) -- return; -+ for_each_possible_cpu(cpu) { -+ if (tg->se[cpu]) -+ remove_entity_load_avg(tg->se[cpu]); - -- raw_spin_lock_irqsave(&rq->lock, flags); -- list_del_leaf_cfs_rq(tg->cfs_rq[cpu]); -- raw_spin_unlock_irqrestore(&rq->lock, flags); -+ /* -+ * Only empty task groups can be destroyed; so we can speculatively -+ * check on_list without danger of it being re-added. -+ */ -+ if (!tg->cfs_rq[cpu]->on_list) -+ continue; -+ -+ rq = cpu_rq(cpu); -+ -+ raw_spin_lock_irqsave(&rq->lock, flags); -+ list_del_leaf_cfs_rq(tg->cfs_rq[cpu]); -+ raw_spin_unlock_irqrestore(&rq->lock, flags); -+ } - } - - void init_tg_cfs_entry(struct task_group *tg, struct cfs_rq *cfs_rq, -@@ -8302,7 +8323,7 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) - return 1; - } - --void unregister_fair_sched_group(struct task_group *tg, int cpu) { } -+void unregister_fair_sched_group(struct task_group *tg) { } - - #endif /* CONFIG_FAIR_GROUP_SCHED */ - -diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c -index 4a2ef5a02fd3..bfd573122e0d 100644 ---- a/kernel/sched/idle.c -+++ b/kernel/sched/idle.c -@@ -132,7 +132,7 @@ static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev, - */ - static void cpuidle_idle_call(void) - { -- struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices); -+ struct cpuidle_device *dev = cpuidle_get_device(); - struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev); - int next_state, entered_state; - -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 0c9ebd82a684..6893ee31df4d 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -233,6 +233,8 @@ struct cfs_bandwidth { - /* statistics */ - int nr_periods, nr_throttled; - u64 throttled_time; -+ -+ bool distribute_running; - #endif - }; - -@@ -308,7 +310,7 @@ extern int tg_nop(struct task_group *tg, void *data); - - extern void free_fair_sched_group(struct task_group *tg); - extern int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent); --extern void unregister_fair_sched_group(struct task_group *tg, int cpu); -+extern void unregister_fair_sched_group(struct task_group *tg); - extern void init_tg_cfs_entry(struct task_group *tg, struct cfs_rq *cfs_rq, - struct sched_entity *se, int cpu, - struct sched_entity *parent); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index e409ddce8754..1a47a64d623f 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1757,7 +1757,17 @@ void trace_buffer_unlock_commit_regs(struct trace_array *tr, - { - __buffer_unlock_commit(buffer, event); - -- ftrace_trace_stack(tr, buffer, flags, 0, pc, regs); -+ /* -+ * If regs is not set, then skip the following callers: -+ * trace_buffer_unlock_commit_regs -+ * event_trigger_unlock_commit -+ * trace_event_buffer_commit -+ * trace_event_raw_event_sched_switch -+ * Note, we can still get here via blktrace, wakeup tracer -+ * and mmiotrace, but that's ok if they lose a function or -+ * two. They are that meaningful. -+ */ -+ ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs); - ftrace_trace_userstack(buffer, flags, pc); - } - EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit_regs); -@@ -1815,6 +1825,13 @@ static void __ftrace_trace_stack(struct ring_buffer *buffer, - trace.nr_entries = 0; - trace.skip = skip; - -+ /* -+ * Add two, for this function and the call to save_stack_trace() -+ * If regs is set, then these functions will not be in the way. -+ */ -+ if (!regs) -+ trace.skip += 2; -+ - /* - * Since events can happen in NMIs there's no safe way to - * use the per cpu ftrace_stacks. We reserve it and if an interrupt -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index c4ea57ee2fd1..465786cd6490 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1511,7 +1511,7 @@ int move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma, - spinlock_t *old_ptl, *new_ptl; - int ret = 0; - pmd_t pmd; -- -+ bool force_flush = false; - struct mm_struct *mm = vma->vm_mm; - - if ((old_addr & ~HPAGE_PMD_MASK) || -@@ -1539,6 +1539,8 @@ int move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma, - if (new_ptl != old_ptl) - spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); - pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd); -+ if (pmd_present(pmd)) -+ force_flush = true; - VM_BUG_ON(!pmd_none(*new_pmd)); - - if (pmd_move_must_withdraw(new_ptl, old_ptl)) { -@@ -1547,6 +1549,8 @@ int move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma, - pgtable_trans_huge_deposit(mm, new_pmd, pgtable); - } - set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd)); -+ if (force_flush) -+ flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE); - if (new_ptl != old_ptl) - spin_unlock(new_ptl); - spin_unlock(old_ptl); -diff --git a/mm/mremap.c b/mm/mremap.c -index fe7b7f65f4f4..450b306d473e 100644 ---- a/mm/mremap.c -+++ b/mm/mremap.c -@@ -96,6 +96,8 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, - struct mm_struct *mm = vma->vm_mm; - pte_t *old_pte, *new_pte, pte; - spinlock_t *old_ptl, *new_ptl; -+ bool force_flush = false; -+ unsigned long len = old_end - old_addr; - - /* - * When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma -@@ -143,12 +145,26 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, - if (pte_none(*old_pte)) - continue; - pte = ptep_get_and_clear(mm, old_addr, old_pte); -+ /* -+ * If we are remapping a valid PTE, make sure -+ * to flush TLB before we drop the PTL for the PTE. -+ * -+ * NOTE! Both old and new PTL matter: the old one -+ * for racing with page_mkclean(), the new one to -+ * make sure the physical page stays valid until -+ * the TLB entry for the old mapping has been -+ * flushed. -+ */ -+ if (pte_present(pte)) -+ force_flush = true; - pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr); - pte = move_soft_dirty_pte(pte); - set_pte_at(mm, new_addr, new_pte, pte); - } - - arch_leave_lazy_mmu_mode(); -+ if (force_flush) -+ flush_tlb_range(vma, old_end - len, old_end); - if (new_ptl != old_ptl) - spin_unlock(new_ptl); - pte_unmap(new_pte - 1); -@@ -168,7 +184,6 @@ unsigned long move_page_tables(struct vm_area_struct *vma, - { - unsigned long extent, next, old_end; - pmd_t *old_pmd, *new_pmd; -- bool need_flush = false; - unsigned long mmun_start; /* For mmu_notifiers */ - unsigned long mmun_end; /* For mmu_notifiers */ - -@@ -207,7 +222,6 @@ unsigned long move_page_tables(struct vm_area_struct *vma, - anon_vma_unlock_write(vma->anon_vma); - } - if (err > 0) { -- need_flush = true; - continue; - } else if (!err) { - split_huge_page_pmd(vma, old_addr, old_pmd); -@@ -224,10 +238,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma, - extent = LATENCY_LIMIT; - move_ptes(vma, old_pmd, old_addr, old_addr + extent, - new_vma, new_pmd, new_addr, need_rmap_locks); -- need_flush = true; - } -- if (likely(need_flush)) -- flush_tlb_range(vma, old_end-len, old_addr); - - mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end); - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index b1b0a1c0bd8d..ecc3da6a14a1 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -3083,9 +3083,8 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, - /* LE address type */ - addr_type = le_addr_type(cp->addr.type); - -- hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type); -- -- err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type); -+ /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ -+ err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); - if (err < 0) { - err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, - MGMT_STATUS_NOT_PAIRED, &rp, -@@ -3099,8 +3098,6 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, - goto done; - } - -- /* Abort any ongoing SMP pairing */ -- smp_cancel_pairing(conn); - - /* Defer clearing up the connection parameters until closing to - * give a chance of keeping them if a repairing happens. -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index 0dc27d2e8f18..bedfaef2c59e 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -2371,30 +2371,51 @@ unlock: - return ret; - } - --void smp_cancel_pairing(struct hci_conn *hcon) -+int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, -+ u8 addr_type) - { -- struct l2cap_conn *conn = hcon->l2cap_data; -+ struct hci_conn *hcon; -+ struct l2cap_conn *conn; - struct l2cap_chan *chan; - struct smp_chan *smp; -+ int err; -+ -+ err = hci_remove_ltk(hdev, bdaddr, addr_type); -+ hci_remove_irk(hdev, bdaddr, addr_type); -+ -+ hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type); -+ if (!hcon) -+ goto done; - -+ conn = hcon->l2cap_data; - if (!conn) -- return; -+ goto done; - - chan = conn->smp; - if (!chan) -- return; -+ goto done; - - l2cap_chan_lock(chan); - - smp = chan->data; - if (smp) { -+ /* Set keys to NULL to make sure smp_failure() does not try to -+ * remove and free already invalidated rcu list entries. */ -+ smp->ltk = NULL; -+ smp->slave_ltk = NULL; -+ smp->remote_irk = NULL; -+ - if (test_bit(SMP_FLAG_COMPLETE, &smp->flags)) - smp_failure(conn, 0); - else - smp_failure(conn, SMP_UNSPECIFIED); -+ err = 0; - } - - l2cap_chan_unlock(chan); -+ -+done: -+ return err; - } - - static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb) -diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h -index ffcc70b6b199..993cbd7bcfe7 100644 ---- a/net/bluetooth/smp.h -+++ b/net/bluetooth/smp.h -@@ -180,7 +180,8 @@ enum smp_key_pref { - }; - - /* SMP Commands */ --void smp_cancel_pairing(struct hci_conn *hcon); -+int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr, -+ u8 addr_type); - bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level, - enum smp_key_pref key_pref); - int smp_conn_security(struct hci_conn *hcon, __u8 sec_level); -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index d80c15d028fe..270d9c9a5331 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1261,7 +1261,14 @@ static void br_multicast_query_received(struct net_bridge *br, - return; - - br_multicast_update_query_timer(br, query, max_delay); -- br_multicast_mark_router(br, port); -+ -+ /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, -+ * the arrival port for IGMP Queries where the source address -+ * is 0.0.0.0 should not be added to router port list. -+ */ -+ if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) || -+ saddr->proto == htons(ETH_P_IPV6)) -+ br_multicast_mark_router(br, port); - } - - static int br_ip4_multicast_query(struct net_bridge *br, -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index f1df04c7d395..d2a46ffe6382 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2734,6 +2734,11 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh) - return -EINVAL; - } - -+ if (dev->type != ARPHRD_ETHER) { -+ pr_info("PF_BRIDGE: FDB add only supported for Ethernet devices"); -+ return -EINVAL; -+ } -+ - addr = nla_data(tb[NDA_LLADDR]); - - err = fdb_vid_parse(tb[NDA_VLAN], &vid); -@@ -2836,6 +2841,11 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh) - return -EINVAL; - } - -+ if (dev->type != ARPHRD_ETHER) { -+ pr_info("PF_BRIDGE: FDB delete only supported for Ethernet devices"); -+ return -EINVAL; -+ } -+ - addr = nla_data(tb[NDA_LLADDR]); - - err = fdb_vid_parse(tb[NDA_VLAN], &vid); -diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c -index 08d8ee124538..d83888bc33d3 100644 ---- a/net/ipv4/fou.c -+++ b/net/ipv4/fou.c -@@ -195,6 +195,14 @@ static struct sk_buff **fou_gro_receive(struct sk_buff **head, - u8 proto = NAPI_GRO_CB(skb)->proto; - const struct net_offload **offloads; - -+ /* We can clear the encap_mark for FOU as we are essentially doing -+ * one of two possible things. We are either adding an L4 tunnel -+ * header to the outer L3 tunnel header, or we are are simply -+ * treating the GRE tunnel header as though it is a UDP protocol -+ * specific header such as VXLAN or GENEVE. -+ */ -+ NAPI_GRO_CB(skb)->encap_mark = 0; -+ - rcu_read_lock(); - offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads; - ops = rcu_dereference(offloads[proto]); -@@ -354,6 +362,14 @@ static struct sk_buff **gue_gro_receive(struct sk_buff **head, - } - } - -+ /* We can clear the encap_mark for GUE as we are essentially doing -+ * one of two possible things. We are either adding an L4 tunnel -+ * header to the outer L3 tunnel header, or we are are simply -+ * treating the GRE tunnel header as though it is a UDP protocol -+ * specific header such as VXLAN or GENEVE. -+ */ -+ NAPI_GRO_CB(skb)->encap_mark = 0; -+ - rcu_read_lock(); - offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads; - ops = rcu_dereference(offloads[guehdr->proto_ctype]); -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 7057a1b09b5e..72915658a6b1 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -716,10 +716,14 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) - if (ip_is_fragment(&iph)) { - skb = skb_share_check(skb, GFP_ATOMIC); - if (skb) { -- if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) -- return skb; -- if (pskb_trim_rcsum(skb, netoff + len)) -- return skb; -+ if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) { -+ kfree_skb(skb); -+ return NULL; -+ } -+ if (pskb_trim_rcsum(skb, netoff + len)) { -+ kfree_skb(skb); -+ return NULL; -+ } - memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); - if (ip_defrag(net, skb, user)) - return NULL; -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 582e757e5727..4dde1e0e7d37 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -4439,8 +4439,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb, - - /* unicast address incl. temp addr */ - list_for_each_entry(ifa, &idev->addr_list, if_list) { -- if (++ip_idx < s_ip_idx) -- continue; -+ if (ip_idx < s_ip_idx) -+ goto next; - err = inet6_fill_ifaddr(skb, ifa, - NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, -@@ -4449,6 +4449,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb, - if (err < 0) - break; - nl_dump_check_consistent(cb, nlmsg_hdr(skb)); -+next: -+ ip_idx++; - } - break; - } -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 60d4052d97a6..51da5987952c 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -1140,6 +1140,33 @@ static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = { - .priority = 100, - }; - -+static bool is_vti6_tunnel(const struct net_device *dev) -+{ -+ return dev->netdev_ops == &vti6_netdev_ops; -+} -+ -+static int vti6_device_event(struct notifier_block *unused, -+ unsigned long event, void *ptr) -+{ -+ struct net_device *dev = netdev_notifier_info_to_dev(ptr); -+ struct ip6_tnl *t = netdev_priv(dev); -+ -+ if (!is_vti6_tunnel(dev)) -+ return NOTIFY_DONE; -+ -+ switch (event) { -+ case NETDEV_DOWN: -+ if (!net_eq(t->net, dev_net(dev))) -+ xfrm_garbage_collect(t->net); -+ break; -+ } -+ return NOTIFY_DONE; -+} -+ -+static struct notifier_block vti6_notifier_block __read_mostly = { -+ .notifier_call = vti6_device_event, -+}; -+ - /** - * vti6_tunnel_init - register protocol and reserve needed resources - * -@@ -1150,6 +1177,8 @@ static int __init vti6_tunnel_init(void) - const char *msg; - int err; - -+ register_netdevice_notifier(&vti6_notifier_block); -+ - msg = "tunnel device"; - err = register_pernet_device(&vti6_net_ops); - if (err < 0) -@@ -1182,6 +1211,7 @@ xfrm_proto_ah_failed: - xfrm_proto_esp_failed: - unregister_pernet_device(&vti6_net_ops); - pernet_dev_failed: -+ unregister_netdevice_notifier(&vti6_notifier_block); - pr_err("vti6 init: failed to register %s\n", msg); - return err; - } -@@ -1196,6 +1226,7 @@ static void __exit vti6_tunnel_cleanup(void) - xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH); - xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP); - unregister_pernet_device(&vti6_net_ops); -+ unregister_netdevice_notifier(&vti6_notifier_block); - } - - module_init(vti6_tunnel_init); -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index 091cee551cd9..a5ec9a0cbb80 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -2390,17 +2390,17 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml, - { - int err; - -- /* callers have the socket lock and rtnl lock -- * so no other readers or writers of iml or its sflist -- */ -+ write_lock_bh(&iml->sflock); - if (!iml->sflist) { - /* any-source empty exclude case */ -- return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); -+ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0); -+ } else { -+ err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, -+ iml->sflist->sl_count, iml->sflist->sl_addr, 0); -+ sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); -+ iml->sflist = NULL; - } -- err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, -- iml->sflist->sl_count, iml->sflist->sl_addr, 0); -- sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max)); -- iml->sflist = NULL; -+ write_unlock_bh(&iml->sflock); - return err; - } - -diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c -index 3db8d7d1a986..0bf375177a9a 100644 ---- a/net/ipv6/ndisc.c -+++ b/net/ipv6/ndisc.c -@@ -1649,10 +1649,9 @@ int ndisc_rcv(struct sk_buff *skb) - return 0; - } - -- memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); -- - switch (msg->icmph.icmp6_type) { - case NDISC_NEIGHBOUR_SOLICITATION: -+ memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); - ndisc_recv_ns(skb); - break; - -diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c -index 838b65a59a73..5a9ae56e7868 100644 ---- a/net/ipv6/netfilter/nf_conntrack_reasm.c -+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c -@@ -601,6 +601,7 @@ struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 use - hdr = ipv6_hdr(clone); - fhdr = (struct frag_hdr *)skb_transport_header(clone); - -+ skb_orphan(skb); - fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); - if (fq == NULL) { -diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c -index 4d09ce6fa90e..64862c5084ee 100644 ---- a/net/ipv6/xfrm6_output.c -+++ b/net/ipv6/xfrm6_output.c -@@ -165,9 +165,11 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) - - if (toobig && xfrm6_local_dontfrag(skb)) { - xfrm6_local_rxpmtu(skb, mtu); -+ kfree_skb(skb); - return -EMSGSIZE; - } else if (!skb->ignore_df && toobig && skb->sk) { - xfrm_local_error(skb, mtu); -+ kfree_skb(skb); - return -EMSGSIZE; - } - -diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c -index aeffb65181f5..5984cc35d508 100644 ---- a/net/iucv/af_iucv.c -+++ b/net/iucv/af_iucv.c -@@ -705,10 +705,8 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr, - char uid[9]; - - /* Verify the input sockaddr */ -- if (!addr || addr->sa_family != AF_IUCV) -- return -EINVAL; -- -- if (addr_len < sizeof(struct sockaddr_iucv)) -+ if (addr_len < sizeof(struct sockaddr_iucv) || -+ addr->sa_family != AF_IUCV) - return -EINVAL; - - lock_sock(sk); -@@ -852,7 +850,7 @@ static int iucv_sock_connect(struct socket *sock, struct sockaddr *addr, - struct iucv_sock *iucv = iucv_sk(sk); - int err; - -- if (addr->sa_family != AF_IUCV || alen < sizeof(struct sockaddr_iucv)) -+ if (alen < sizeof(struct sockaddr_iucv) || addr->sa_family != AF_IUCV) - return -EINVAL; - - if (sk->sk_state != IUCV_OPEN && sk->sk_state != IUCV_BOUND) -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index 48ab93842322..af74e3ba0f92 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -177,21 +177,23 @@ pass_up: - - tunnel_id = ntohl(*(__be32 *) &skb->data[4]); - tunnel = l2tp_tunnel_find(net, tunnel_id); -- if (tunnel != NULL) -+ if (tunnel) { - sk = tunnel->sock; -- else { -+ sock_hold(sk); -+ } else { - struct iphdr *iph = (struct iphdr *) skb_network_header(skb); - - read_lock_bh(&l2tp_ip_lock); - sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id); -+ if (!sk) { -+ read_unlock_bh(&l2tp_ip_lock); -+ goto discard; -+ } -+ -+ sock_hold(sk); - read_unlock_bh(&l2tp_ip_lock); - } - -- if (sk == NULL) -- goto discard; -- -- sock_hold(sk); -- - if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) - goto discard_put; - -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index bcdab1cba773..591d308bf63a 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -188,22 +188,24 @@ pass_up: - - tunnel_id = ntohl(*(__be32 *) &skb->data[4]); - tunnel = l2tp_tunnel_find(&init_net, tunnel_id); -- if (tunnel != NULL) -+ if (tunnel) { - sk = tunnel->sock; -- else { -+ sock_hold(sk); -+ } else { - struct ipv6hdr *iph = ipv6_hdr(skb); - - read_lock_bh(&l2tp_ip6_lock); - sk = __l2tp_ip6_bind_lookup(&init_net, &iph->daddr, - 0, tunnel_id); -+ if (!sk) { -+ read_unlock_bh(&l2tp_ip6_lock); -+ goto discard; -+ } -+ -+ sock_hold(sk); - read_unlock_bh(&l2tp_ip6_lock); - } - -- if (sk == NULL) -- goto discard; -- -- sock_hold(sk); -- - if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) - goto discard_put; - -diff --git a/net/mac80211/status.c b/net/mac80211/status.c -index 45fb1abdb265..2731cf5bf052 100644 ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -466,11 +466,6 @@ static void ieee80211_report_ack_skb(struct ieee80211_local *local, - if (!skb) - return; - -- if (dropped) { -- dev_kfree_skb_any(skb); -- return; -- } -- - if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) { - u64 cookie = IEEE80211_SKB_CB(skb)->ack.cookie; - struct ieee80211_sub_if_data *sdata; -@@ -491,6 +486,8 @@ static void ieee80211_report_ack_skb(struct ieee80211_local *local, - } - rcu_read_unlock(); - -+ dev_kfree_skb_any(skb); -+ } else if (dropped) { - dev_kfree_skb_any(skb); - } else { - /* consumes skb */ -diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c -index f9e8deeeac96..a5745cb2d014 100644 ---- a/net/sched/sch_gred.c -+++ b/net/sched/sch_gred.c -@@ -444,7 +444,7 @@ static int gred_change(struct Qdisc *sch, struct nlattr *opt) - if (tb[TCA_GRED_PARMS] == NULL && tb[TCA_GRED_STAB] == NULL) { - if (tb[TCA_GRED_LIMIT] != NULL) - sch->limit = nla_get_u32(tb[TCA_GRED_LIMIT]); -- return gred_change_table_def(sch, opt); -+ return gred_change_table_def(sch, tb[TCA_GRED_DPS]); - } - - if (tb[TCA_GRED_PARMS] == NULL || -diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c -index 0505b8408c8b..4bf2b599ef98 100644 ---- a/net/sched/sch_red.c -+++ b/net/sched/sch_red.c -@@ -97,6 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch) - - ret = qdisc_enqueue(skb, child); - if (likely(ret == NET_XMIT_SUCCESS)) { -+ qdisc_qstats_backlog_inc(sch, skb); - sch->q.qlen++; - } else if (net_xmit_drop_count(ret)) { - q->stats.pdrop++; -@@ -118,6 +119,7 @@ static struct sk_buff *red_dequeue(struct Qdisc *sch) - skb = child->dequeue(child); - if (skb) { - qdisc_bstats_update(sch, skb); -+ qdisc_qstats_backlog_dec(sch, skb); - sch->q.qlen--; - } else { - if (!red_is_idling(&q->vars)) -@@ -143,6 +145,7 @@ static unsigned int red_drop(struct Qdisc *sch) - if (child->ops->drop && (len = child->ops->drop(child)) > 0) { - q->stats.other++; - qdisc_qstats_drop(sch); -+ sch->qstats.backlog -= len; - sch->q.qlen--; - return len; - } -@@ -158,6 +161,7 @@ static void red_reset(struct Qdisc *sch) - struct red_sched_data *q = qdisc_priv(sch); - - qdisc_reset(q->qdisc); -+ sch->qstats.backlog = 0; - sch->q.qlen = 0; - red_restart(&q->vars); - } -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 13c7f42b7040..53f1b33bca4e 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -248,11 +248,10 @@ struct sctp_association *sctp_id2assoc(struct sock *sk, sctp_assoc_t id) - - spin_lock_bh(&sctp_assocs_id_lock); - asoc = (struct sctp_association *)idr_find(&sctp_assocs_id, (int)id); -+ if (asoc && (asoc->base.sk != sk || asoc->base.dead)) -+ asoc = NULL; - spin_unlock_bh(&sctp_assocs_id_lock); - -- if (!asoc || (asoc->base.sk != sk) || asoc->base.dead) -- return NULL; -- - return asoc; - } - -diff --git a/net/socket.c b/net/socket.c -index 0c544ae48eac..96133777d17c 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2760,9 +2760,14 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32) - copy_in_user(&rxnfc->fs.ring_cookie, - &compat_rxnfc->fs.ring_cookie, - (void __user *)(&rxnfc->fs.location + 1) - -- (void __user *)&rxnfc->fs.ring_cookie) || -- copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt, -- sizeof(rxnfc->rule_cnt))) -+ (void __user *)&rxnfc->fs.ring_cookie)) -+ return -EFAULT; -+ if (ethcmd == ETHTOOL_GRXCLSRLALL) { -+ if (put_user(rule_cnt, &rxnfc->rule_cnt)) -+ return -EFAULT; -+ } else if (copy_in_user(&rxnfc->rule_cnt, -+ &compat_rxnfc->rule_cnt, -+ sizeof(rxnfc->rule_cnt))) - return -EFAULT; - } - -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index e05ec54ac53f..c6b1eec94911 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1531,7 +1531,6 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - { - int i; - unsigned char max_level = 0; -- int unix_sock_count = 0; - - if (too_many_unix_fds(current)) - return -ETOOMANYREFS; -@@ -1539,11 +1538,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - for (i = scm->fp->count - 1; i >= 0; i--) { - struct sock *sk = unix_get_socket(scm->fp->fp[i]); - -- if (sk) { -- unix_sock_count++; -+ if (sk) - max_level = max(max_level, - unix_sk(sk)->recursion_level); -- } - } - if (unlikely(max_level > MAX_RECURSION_LEVEL)) - return -ETOOMANYREFS; -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 06d050da0d94..50dffd183cc6 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -2367,6 +2367,7 @@ static int regulatory_hint_core(const char *alpha2) - request->alpha2[0] = alpha2[0]; - request->alpha2[1] = alpha2[1]; - request->initiator = NL80211_REGDOM_SET_BY_CORE; -+ request->wiphy_idx = WIPHY_IDX_INVALID; - - queue_regulatory_request(request); - -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index a9b4491a3cc4..476f1fc6d655 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, - err = -EINVAL; - switch (p->family) { - case AF_INET: -+ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) -+ goto out; -+ - break; - - case AF_INET6: - #if IS_ENABLED(CONFIG_IPV6) -+ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) -+ goto out; -+ - break; - #else - err = -EAFNOSUPPORT; -@@ -1312,10 +1318,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) - - switch (p->sel.family) { - case AF_INET: -+ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) -+ return -EINVAL; -+ - break; - - case AF_INET6: - #if IS_ENABLED(CONFIG_IPV6) -+ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) -+ return -EINVAL; -+ - break; - #else - return -EAFNOSUPPORT; -@@ -1396,6 +1408,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) - (ut[i].family != prev_family)) - return -EINVAL; - -+ if (ut[i].mode >= XFRM_MODE_MAX) -+ return -EINVAL; -+ - prev_family = ut[i].family; - - switch (ut[i].family) { -diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index ac1d5b2b1626..a7095372701e 100644 ---- a/security/keys/process_keys.c -+++ b/security/keys/process_keys.c -@@ -808,15 +808,14 @@ long join_session_keyring(const char *name) - ret = PTR_ERR(keyring); - goto error2; - } else if (keyring == new->session_keyring) { -- key_put(keyring); - ret = 0; -- goto error2; -+ goto error3; - } - - /* we've got a keyring - now to install it */ - ret = install_session_keyring_to_cred(new, keyring); - if (ret < 0) -- goto error2; -+ goto error3; - - commit_creds(new); - mutex_unlock(&key_session_mutex); -@@ -826,6 +825,8 @@ long join_session_keyring(const char *name) - okay: - return ret; - -+error3: -+ key_put(keyring); - error2: - mutex_unlock(&key_session_mutex); - error: -diff --git a/sound/core/timer.c b/sound/core/timer.c -index ef850a99d64a..f989adb98a22 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -35,6 +35,9 @@ - #include - #include - -+/* internal flags */ -+#define SNDRV_TIMER_IFLG_PAUSED 0x00010000 -+ - #if IS_ENABLED(CONFIG_SND_HRTIMER) - #define DEFAULT_TIMER_LIMIT 4 - #elif IS_ENABLED(CONFIG_SND_RTCTIMER) -@@ -547,6 +550,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) - } - } - timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); -+ if (stop) -+ timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED; -+ else -+ timeri->flags |= SNDRV_TIMER_IFLG_PAUSED; - snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : - SNDRV_TIMER_EVENT_PAUSE); - unlock: -@@ -608,6 +615,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri) - */ - int snd_timer_continue(struct snd_timer_instance *timeri) - { -+ /* timer can continue only after pause */ -+ if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) -+ return -EINVAL; -+ - if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) - return snd_timer_start_slave(timeri, false); - else -@@ -1837,6 +1848,9 @@ static int snd_timer_user_continue(struct file *file) - tu = file->private_data; - if (!tu->timeri) - return -EBADFD; -+ /* start timer instead of continue if it's not used before */ -+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) -+ return snd_timer_user_start(file); - tu->timeri->lost = 0; - return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0; - } -diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c -index 07a266460ec3..b4b36cc92ffe 100644 ---- a/sound/soc/codecs/ak4613.c -+++ b/sound/soc/codecs/ak4613.c -@@ -143,6 +143,7 @@ static const struct regmap_config ak4613_regmap_cfg = { - .max_register = 0x16, - .reg_defaults = ak4613_reg, - .num_reg_defaults = ARRAY_SIZE(ak4613_reg), -+ .cache_type = REGCACHE_RBTREE, - }; - - static const struct of_device_id ak4613_of_match[] = { -diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c -index f6f9395ea38e..1c600819f768 100644 ---- a/sound/soc/codecs/wm8940.c -+++ b/sound/soc/codecs/wm8940.c -@@ -743,6 +743,7 @@ static const struct regmap_config wm8940_regmap = { - .max_register = WM8940_MONOMIX, - .reg_defaults = wm8940_reg_defaults, - .num_reg_defaults = ARRAY_SIZE(wm8940_reg_defaults), -+ .cache_type = REGCACHE_RBTREE, - - .readable_reg = wm8940_readable_register, - .volatile_reg = wm8940_volatile_register, -diff --git a/sound/soc/spear/spdif_in.c b/sound/soc/spear/spdif_in.c -index 977a078eb92f..7f32527fc3c8 100644 ---- a/sound/soc/spear/spdif_in.c -+++ b/sound/soc/spear/spdif_in.c -@@ -223,8 +223,10 @@ static int spdif_in_probe(struct platform_device *pdev) - - host->io_base = io_base; - host->irq = platform_get_irq(pdev, 0); -- if (host->irq < 0) -- return -EINVAL; -+ if (host->irq < 0) { -+ dev_warn(&pdev->dev, "failed to get IRQ: %d\n", host->irq); -+ return host->irq; -+ } - - host->clk = devm_clk_get(&pdev->dev, NULL); - if (IS_ERR(host->clk)) -diff --git a/tools/perf/Makefile b/tools/perf/Makefile -index dcd9a70c7193..55933b2eb932 100644 ---- a/tools/perf/Makefile -+++ b/tools/perf/Makefile -@@ -69,10 +69,10 @@ all tags TAGS: - $(make) - - # --# The clean target is not really parallel, don't print the jobs info: -+# Explicitly disable parallelism for the clean target. - # - clean: -- $(make) -+ $(make) -j1 - - # - # The build-test target is not really parallel, don't print the jobs info: diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.163-164.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.163-164.patch deleted file mode 100644 index 58fed01e6b54..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.163-164.patch +++ /dev/null @@ -1,4195 +0,0 @@ -diff --git a/Makefile b/Makefile -index 4e3179768eea..9382e7e4e750 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 163 -+SUBLEVEL = 164 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h -index 7fde0f88da88..51ed90be770a 100644 ---- a/arch/alpha/include/asm/termios.h -+++ b/arch/alpha/include/asm/termios.h -@@ -72,9 +72,15 @@ - }) - - #define user_termios_to_kernel_termios(k, u) \ -- copy_from_user(k, u, sizeof(struct termios)) -+ copy_from_user(k, u, sizeof(struct termios2)) - - #define kernel_termios_to_user_termios(u, k) \ -+ copy_to_user(u, k, sizeof(struct termios2)) -+ -+#define user_termios_to_kernel_termios_1(k, u) \ -+ copy_from_user(k, u, sizeof(struct termios)) -+ -+#define kernel_termios_to_user_termios_1(u, k) \ - copy_to_user(u, k, sizeof(struct termios)) - - #endif /* _ALPHA_TERMIOS_H */ -diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h -index f30c94ae1bdb..7ee8ab577e11 100644 ---- a/arch/alpha/include/uapi/asm/ioctls.h -+++ b/arch/alpha/include/uapi/asm/ioctls.h -@@ -31,6 +31,11 @@ - #define TCXONC _IO('t', 30) - #define TCFLSH _IO('t', 31) - -+#define TCGETS2 _IOR('T', 42, struct termios2) -+#define TCSETS2 _IOW('T', 43, struct termios2) -+#define TCSETSW2 _IOW('T', 44, struct termios2) -+#define TCSETSF2 _IOW('T', 45, struct termios2) -+ - #define TIOCSWINSZ _IOW('t', 103, struct winsize) - #define TIOCGWINSZ _IOR('t', 104, struct winsize) - #define TIOCSTART _IO('t', 110) /* start output, like ^Q */ -diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h -index 879dd3589921..483c7ec2a879 100644 ---- a/arch/alpha/include/uapi/asm/termbits.h -+++ b/arch/alpha/include/uapi/asm/termbits.h -@@ -25,6 +25,19 @@ struct termios { - speed_t c_ospeed; /* output speed */ - }; - -+/* Alpha has identical termios and termios2 */ -+ -+struct termios2 { -+ tcflag_t c_iflag; /* input mode flags */ -+ tcflag_t c_oflag; /* output mode flags */ -+ tcflag_t c_cflag; /* control mode flags */ -+ tcflag_t c_lflag; /* local mode flags */ -+ cc_t c_cc[NCCS]; /* control characters */ -+ cc_t c_line; /* line discipline (== c_cc[19]) */ -+ speed_t c_ispeed; /* input speed */ -+ speed_t c_ospeed; /* output speed */ -+}; -+ - /* Alpha has matching termios and ktermios */ - - struct ktermios { -@@ -147,6 +160,7 @@ struct ktermios { - #define B3000000 00034 - #define B3500000 00035 - #define B4000000 00036 -+#define BOTHER 00037 - - #define CSIZE 00001400 - #define CS5 00000000 -@@ -164,6 +178,9 @@ struct ktermios { - #define CMSPAR 010000000000 /* mark or space (stick) parity */ - #define CRTSCTS 020000000000 /* flow control */ - -+#define CIBAUD 07600000 -+#define IBSHIFT 16 -+ - /* c_lflag bits */ - #define ISIG 0x00000080 - #define ICANON 0x00000100 -diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi -index 445aa678f914..6a37101344aa 100644 ---- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi -+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi -@@ -249,7 +249,7 @@ - - sysmgr: sysmgr@ffd12000 { - compatible = "altr,sys-mgr", "syscon"; -- reg = <0xffd12000 0x1000>; -+ reg = <0xffd12000 0x228>; - }; - - /* Local timer */ -diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c -index 376701f41cc2..692bbc1c5b79 100644 ---- a/arch/mips/cavium-octeon/executive/cvmx-helper.c -+++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c -@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port, - void (*cvmx_override_ipd_port_setup) (int ipd_port); - - /* Port count per interface */ --static int interface_port_count[5]; -+static int interface_port_count[9]; - - /* Port last configured link info index by IPD/PKO port */ - static cvmx_helper_link_info_t -diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h -index d18c45c7c394..19ff9ce46c02 100644 ---- a/arch/mips/include/asm/mach-loongson64/irq.h -+++ b/arch/mips/include/asm/mach-loongson64/irq.h -@@ -9,7 +9,7 @@ - #define MIPS_CPU_IRQ_BASE 56 - - #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */ --#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */ -+#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */ - #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */ - - #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base -diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c -index 610f0f3bdb34..93c46c9cebb7 100644 ---- a/arch/mips/kernel/crash.c -+++ b/arch/mips/kernel/crash.c -@@ -34,6 +34,9 @@ static void crash_shutdown_secondary(void *passed_regs) - if (!cpu_online(cpu)) - return; - -+ /* We won't be sent IPIs any more. */ -+ set_cpu_online(cpu, false); -+ - local_irq_disable(); - if (!cpumask_test_cpu(cpu, &cpus_in_crash)) - crash_save_cpu(regs, cpu); -diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c -index 50980bf3983e..92bc066e47a3 100644 ---- a/arch/mips/kernel/machine_kexec.c -+++ b/arch/mips/kernel/machine_kexec.c -@@ -95,6 +95,9 @@ machine_kexec(struct kimage *image) - *ptr = (unsigned long) phys_to_virt(*ptr); - } - -+ /* Mark offline BEFORE disabling local irq. */ -+ set_cpu_online(smp_processor_id(), false); -+ - /* - * we do not want to be bothered. - */ -diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c -index 0f75b6b3d218..241cb88f9c03 100644 ---- a/arch/mips/loongson64/loongson-3/irq.c -+++ b/arch/mips/loongson64/loongson-3/irq.c -@@ -42,51 +42,8 @@ void mach_irq_dispatch(unsigned int pending) - } - } - --static struct irqaction cascade_irqaction = { -- .handler = no_action, -- .flags = IRQF_NO_SUSPEND, -- .name = "cascade", --}; -- --static inline void mask_loongson_irq(struct irq_data *d) --{ -- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); -- irq_disable_hazard(); -- -- /* Workaround: UART IRQ may deliver to any core */ -- if (d->irq == LOONGSON_UART_IRQ) { -- int cpu = smp_processor_id(); -- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; -- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; -- u64 intenclr_addr = smp_group[node_id] | -- (u64)(&LOONGSON_INT_ROUTER_INTENCLR); -- u64 introuter_lpc_addr = smp_group[node_id] | -- (u64)(&LOONGSON_INT_ROUTER_LPC); -- -- *(volatile u32 *)intenclr_addr = 1 << 10; -- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq == LOONGSON_UART_IRQ) { -- int cpu = smp_processor_id(); -- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; -- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; -- u64 intenset_addr = smp_group[node_id] | -- (u64)(&LOONGSON_INT_ROUTER_INTENSET); -- u64 introuter_lpc_addr = smp_group[node_id] | -- (u64)(&LOONGSON_INT_ROUTER_LPC); -- -- *(volatile u32 *)intenset_addr = 1 << 10; -- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq - MIPS_CPU_IRQ_BASE)); -- irq_enable_hazard(); --} -+static inline void mask_loongson_irq(struct irq_data *d) { } -+static inline void unmask_loongson_irq(struct irq_data *d) { } - - /* For MIPS IRQs which shared by all cores */ - static struct irq_chip loongson_irq_chip = { -@@ -124,12 +81,11 @@ void __init mach_init_irq(void) - mips_cpu_irq_init(); - init_i8259_irqs(); - irq_set_chip_and_handler(LOONGSON_UART_IRQ, -- &loongson_irq_chip, handle_level_irq); -- -- /* setup HT1 irq */ -- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); -+ &loongson_irq_chip, handle_percpu_irq); -+ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ, -+ &loongson_irq_chip, handle_percpu_irq); - -- set_c0_status(STATUSF_IP2 | STATUSF_IP6); -+ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6); - } - - #ifdef CONFIG_HOTPLUG_CPU -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index 13cb2461fef5..3b7b022384a0 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -185,7 +185,7 @@ - bv,n 0(%r3) - nop - .word 0 /* checksum (will be patched) */ -- .word PA(os_hpmc) /* address of handler */ -+ .word 0 /* address of handler */ - .word 0 /* length of handler */ - .endm - -diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c -index 77e2262c97f6..6f61a17e2485 100644 ---- a/arch/parisc/kernel/traps.c -+++ b/arch/parisc/kernel/traps.c -@@ -829,7 +829,8 @@ void __init initialize_ivt(const void *iva) - for (i = 0; i < 8; i++) - *ivap++ = 0; - -- /* Compute Checksum for HPMC handler */ -+ /* Setup IVA and compute checksum for HPMC handler */ -+ ivap[6] = (u32)__pa(os_hpmc); - length = os_hpmc_size; - ivap[7] = length; - -diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c -index 1b366c477687..63741f2e8d01 100644 ---- a/arch/parisc/mm/init.c -+++ b/arch/parisc/mm/init.c -@@ -491,12 +491,8 @@ static void __init map_pages(unsigned long start_vaddr, - pte = pte_mkhuge(pte); - } - -- if (address >= end_paddr) { -- if (force) -- break; -- else -- pte_val(pte) = 0; -- } -+ if (address >= end_paddr) -+ break; - - set_pte(pg_table, pte); - -diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S -index 12866ccb5694..5c2199857aa8 100644 ---- a/arch/powerpc/boot/crt0.S -+++ b/arch/powerpc/boot/crt0.S -@@ -47,8 +47,10 @@ p_end: .long _end - p_pstack: .long _platform_stack_top - #endif - -- .weak _zimage_start - .globl _zimage_start -+ /* Clang appears to require the .weak directive to be after the symbol -+ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ -+ .weak _zimage_start - _zimage_start: - .globl _zimage_start_lib - _zimage_start_lib: -diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h -index 98697611e7b3..705f4dc5073b 100644 ---- a/arch/powerpc/include/asm/mpic.h -+++ b/arch/powerpc/include/asm/mpic.h -@@ -392,7 +392,14 @@ extern struct bus_type mpic_subsys; - #define MPIC_REGSET_TSI108 MPIC_REGSET(1) /* Tsi108/109 PIC */ - - /* Get the version of primary MPIC */ -+#ifdef CONFIG_MPIC - extern u32 fsl_mpic_primary_get_version(void); -+#else -+static inline u32 fsl_mpic_primary_get_version(void) -+{ -+ return 0; -+} -+#endif - - /* Allocate the controller structure and setup the linux irq descs - * for the range if interrupts passed in. No HW initialization is -diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c -index bb04e4df3100..1b784b8fd8b4 100644 ---- a/arch/powerpc/mm/tlb_nohash.c -+++ b/arch/powerpc/mm/tlb_nohash.c -@@ -487,6 +487,9 @@ static void setup_page_sizes(void) - for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) { - struct mmu_psize_def *def = &mmu_psize_defs[psize]; - -+ if (!def->shift) -+ continue; -+ - if (tlb1ps & (1U << (def->shift - 10))) { - def->flags |= MMU_PAGE_SIZE_DIRECT; - -diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c -index 6596f66ce112..a5d0c2f08110 100644 ---- a/arch/sparc/kernel/perf_event.c -+++ b/arch/sparc/kernel/perf_event.c -@@ -926,6 +926,8 @@ static void read_in_all_counters(struct cpu_hw_events *cpuc) - sparc_perf_event_update(cp, &cp->hw, - cpuc->current_idx[i]); - cpuc->current_idx[i] = PIC_NO_INDEX; -+ if (cp->hw.state & PERF_HES_STOPPED) -+ cp->hw.state |= PERF_HES_ARCH; - } - } - } -@@ -958,10 +960,12 @@ static void calculate_single_pcr(struct cpu_hw_events *cpuc) - - enc = perf_event_get_enc(cpuc->events[i]); - cpuc->pcr[0] &= ~mask_for_index(idx); -- if (hwc->state & PERF_HES_STOPPED) -+ if (hwc->state & PERF_HES_ARCH) { - cpuc->pcr[0] |= nop_for_index(idx); -- else -+ } else { - cpuc->pcr[0] |= event_encoding(enc, idx); -+ hwc->state = 0; -+ } - } - out: - cpuc->pcr[0] |= cpuc->event[0]->hw.config_base; -@@ -987,6 +991,9 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc) - - cpuc->current_idx[i] = idx; - -+ if (cp->hw.state & PERF_HES_ARCH) -+ continue; -+ - sparc_pmu_start(cp, PERF_EF_RELOAD); - } - out: -@@ -1078,6 +1085,8 @@ static void sparc_pmu_start(struct perf_event *event, int flags) - event->hw.state = 0; - - sparc_pmu_enable_event(cpuc, &event->hw, idx); -+ -+ perf_event_update_userpage(event); - } - - static void sparc_pmu_stop(struct perf_event *event, int flags) -@@ -1370,9 +1379,9 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags) - cpuc->events[n0] = event->hw.event_base; - cpuc->current_idx[n0] = PIC_NO_INDEX; - -- event->hw.state = PERF_HES_UPTODATE; -+ event->hw.state = PERF_HES_UPTODATE | PERF_HES_STOPPED; - if (!(ef_flags & PERF_EF_START)) -- event->hw.state |= PERF_HES_STOPPED; -+ event->hw.state |= PERF_HES_ARCH; - - /* - * If group events scheduling transaction was started, -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index d9afe6d40550..9beee7f364ad 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -41,7 +41,6 @@ config X86 - select ARCH_USE_BUILTIN_BSWAP - select ARCH_USE_CMPXCHG_LOCKREF if X86_64 - select ARCH_USE_QUEUED_RWLOCKS -- select ARCH_USE_QUEUED_SPINLOCKS - select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH - select ARCH_WANTS_DYNAMIC_TASK_STRUCT - select ARCH_WANT_FRAME_POINTERS -diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c -index a7661c430cd9..523db6ce88dd 100644 ---- a/arch/x86/boot/tools/build.c -+++ b/arch/x86/boot/tools/build.c -@@ -391,6 +391,13 @@ int main(int argc, char ** argv) - die("Unable to mmap '%s': %m", argv[2]); - /* Number of 16-byte paragraphs, including space for a 4-byte CRC */ - sys_size = (sz + 15 + 4) / 16; -+#ifdef CONFIG_EFI_STUB -+ /* -+ * COFF requires minimum 32-byte alignment of sections, and -+ * adding a signature is problematic without that alignment. -+ */ -+ sys_size = (sys_size + 1) & ~1; -+#endif - - /* Patch the setup code with the appropriate size parameters */ - buf[0x1f1] = setup_sectors-1; -diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c -index 145863d4d343..a8b215865636 100644 ---- a/arch/x86/kernel/check.c -+++ b/arch/x86/kernel/check.c -@@ -30,6 +30,11 @@ static __init int set_corruption_check(char *arg) - ssize_t ret; - unsigned long val; - -+ if (!arg) { -+ pr_err("memory_corruption_check config string not provided\n"); -+ return -EINVAL; -+ } -+ - ret = kstrtoul(arg, 10, &val); - if (ret) - return ret; -@@ -44,6 +49,11 @@ static __init int set_corruption_check_period(char *arg) - ssize_t ret; - unsigned long val; - -+ if (!arg) { -+ pr_err("memory_corruption_check_period config string not provided\n"); -+ return -EINVAL; -+ } -+ - ret = kstrtoul(arg, 10, &val); - if (ret) - return ret; -@@ -58,6 +68,11 @@ static __init int set_corruption_check_size(char *arg) - char *end; - unsigned size; - -+ if (!arg) { -+ pr_err("memory_corruption_check_size config string not provided\n"); -+ return -EINVAL; -+ } -+ - size = memparse(arg, &end); - - if (*end == '\0') -diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c -index 9be3e79eb629..31fad2cbd734 100644 ---- a/arch/x86/kernel/fpu/signal.c -+++ b/arch/x86/kernel/fpu/signal.c -@@ -294,7 +294,6 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) - * thread's fpu state, reconstruct fxstate from the fsave - * header. Sanitize the copied state etc. - */ -- struct fpu *fpu = &tsk->thread.fpu; - struct user_i387_ia32_struct env; - int err = 0; - -diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c -index f42e78de1e10..85872a08994a 100644 ---- a/arch/x86/xen/spinlock.c -+++ b/arch/x86/xen/spinlock.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - - #include - -@@ -19,6 +20,7 @@ - - static DEFINE_PER_CPU(int, lock_kicker_irq) = -1; - static DEFINE_PER_CPU(char *, irq_name); -+static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest); - static bool xen_pvspin = true; - - #ifdef CONFIG_QUEUED_SPINLOCKS -@@ -42,33 +44,24 @@ static void xen_qlock_kick(int cpu) - static void xen_qlock_wait(u8 *byte, u8 val) - { - int irq = __this_cpu_read(lock_kicker_irq); -+ atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest); - - /* If kicker interrupts not initialized yet, just spin */ -- if (irq == -1) -+ if (irq == -1 || in_nmi()) - return; - -- /* clear pending */ -- xen_clear_irq_pending(irq); -- barrier(); -- -- /* -- * We check the byte value after clearing pending IRQ to make sure -- * that we won't miss a wakeup event because of the clearing. -- * -- * The sync_clear_bit() call in xen_clear_irq_pending() is atomic. -- * So it is effectively a memory barrier for x86. -- */ -- if (READ_ONCE(*byte) != val) -- return; -+ /* Detect reentry. */ -+ atomic_inc(nest_cnt); - -- /* -- * If an interrupt happens here, it will leave the wakeup irq -- * pending, which will cause xen_poll_irq() to return -- * immediately. -- */ -+ /* If irq pending already and no nested call clear it. */ -+ if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) { -+ xen_clear_irq_pending(irq); -+ } else if (READ_ONCE(*byte) == val) { -+ /* Block until irq becomes pending (or a spurious wakeup) */ -+ xen_poll_irq(irq); -+ } - -- /* Block until irq becomes pending (or perhaps a spurious wakeup) */ -- xen_poll_irq(irq); -+ atomic_dec(nest_cnt); - } - - #else /* CONFIG_QUEUED_SPINLOCKS */ -diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile -index ca20a892021b..6c6877d628ef 100644 ---- a/arch/xtensa/boot/Makefile -+++ b/arch/xtensa/boot/Makefile -@@ -31,7 +31,7 @@ $(bootdir-y): $(addprefix $(obj)/,$(subdir-y)) \ - $(addprefix $(obj)/,$(host-progs)) - $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS) - --OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary -+OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary - - vmlinux.bin: vmlinux FORCE - $(call if_changed,objcopy) -diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h -index 83e2e4bc01ba..d3ac00fcb15c 100644 ---- a/arch/xtensa/include/asm/processor.h -+++ b/arch/xtensa/include/asm/processor.h -@@ -24,7 +24,11 @@ - # error Linux requires the Xtensa Windowed Registers Option. - #endif - --#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH -+/* Xtensa ABI requires stack alignment to be at least 16 */ -+ -+#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16) -+ -+#define ARCH_SLAB_MINALIGN STACK_ALIGN - - /* - * User space process size: 1 GB. -diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S -index 05e1df943856..c7b3bedbfffe 100644 ---- a/arch/xtensa/kernel/head.S -+++ b/arch/xtensa/kernel/head.S -@@ -88,9 +88,12 @@ _SetupMMU: - initialize_mmu - #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY - rsr a2, excsave1 -- movi a3, 0x08000000 -+ movi a3, XCHAL_KSEG_PADDR -+ bltu a2, a3, 1f -+ sub a2, a2, a3 -+ movi a3, XCHAL_KSEG_SIZE - bgeu a2, a3, 1f -- movi a3, 0xd0000000 -+ movi a3, XCHAL_KSEG_CACHED_VADDR - add a2, a2, a3 - wsr a2, excsave1 - 1: -diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S -index c417cbe4ec87..bdfeda5a913c 100644 ---- a/arch/xtensa/kernel/vmlinux.lds.S -+++ b/arch/xtensa/kernel/vmlinux.lds.S -@@ -110,6 +110,7 @@ SECTIONS - .fixup : { *(.fixup) } - - EXCEPTION_TABLE(16) -+ NOTES - /* Data section */ - - _sdata = .; -diff --git a/crypto/lrw.c b/crypto/lrw.c -index 6f9908a7ebcb..d38a382b09eb 100644 ---- a/crypto/lrw.c -+++ b/crypto/lrw.c -@@ -132,7 +132,12 @@ static inline int get_index128(be128 *block) - return x + ffz(val); - } - -- return x; -+ /* -+ * If we get here, then x == 128 and we are incrementing the counter -+ * from all ones to all zeros. This means we must return index 127, i.e. -+ * the one corresponding to key2*{ 1,...,1 }. -+ */ -+ return 127; - } - - static int crypt(struct blkcipher_desc *d, -diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c -index 8a0f77fb5181..572755e557d6 100644 ---- a/drivers/acpi/acpi_lpss.c -+++ b/drivers/acpi/acpi_lpss.c -@@ -235,9 +235,11 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = { - { "INT33FC", }, - - /* Braswell LPSS devices */ -+ { "80862286", LPSS_ADDR(lpss_dma_desc) }, - { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) }, - { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) }, - { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) }, -+ { "808622C0", LPSS_ADDR(lpss_dma_desc) }, - { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) }, - - /* Broadwell LPSS devices */ -diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c -index 2104b1b4ccda..9ab759bcebd5 100644 ---- a/drivers/block/ataflop.c -+++ b/drivers/block/ataflop.c -@@ -1933,6 +1933,11 @@ static int __init atari_floppy_init (void) - unit[i].disk = alloc_disk(1); - if (!unit[i].disk) - goto Enomem; -+ -+ unit[i].disk->queue = blk_init_queue(do_fd_request, -+ &ataflop_lock); -+ if (!unit[i].disk->queue) -+ goto Enomem; - } - - if (UseTrackbuffer < 0) -@@ -1964,10 +1969,6 @@ static int __init atari_floppy_init (void) - sprintf(unit[i].disk->disk_name, "fd%d", i); - unit[i].disk->fops = &floppy_fops; - unit[i].disk->private_data = &unit[i]; -- unit[i].disk->queue = blk_init_queue(do_fd_request, -- &ataflop_lock); -- if (!unit[i].disk->queue) -- goto Enomem; - set_capacity(unit[i].disk, MAX_DISK_SIZE * 2); - add_disk(unit[i].disk); - } -@@ -1982,13 +1983,17 @@ static int __init atari_floppy_init (void) - - return 0; - Enomem: -- while (i--) { -- struct request_queue *q = unit[i].disk->queue; -+ do { -+ struct gendisk *disk = unit[i].disk; - -- put_disk(unit[i].disk); -- if (q) -- blk_cleanup_queue(q); -- } -+ if (disk) { -+ if (disk->queue) { -+ blk_cleanup_queue(disk->queue); -+ disk->queue = NULL; -+ } -+ put_disk(unit[i].disk); -+ } -+ } while (i--); - - unregister_blkdev(FLOPPY_MAJOR, "fd"); - return -ENOMEM; -diff --git a/drivers/block/swim.c b/drivers/block/swim.c -index b5afd495d482..eec6e393c124 100644 ---- a/drivers/block/swim.c -+++ b/drivers/block/swim.c -@@ -868,8 +868,17 @@ static int swim_floppy_init(struct swim_priv *swd) - - exit_put_disks: - unregister_blkdev(FLOPPY_MAJOR, "fd"); -- while (drive--) -- put_disk(swd->unit[drive].disk); -+ do { -+ struct gendisk *disk = swd->unit[drive].disk; -+ -+ if (disk) { -+ if (disk->queue) { -+ blk_cleanup_queue(disk->queue); -+ disk->queue = NULL; -+ } -+ put_disk(disk); -+ } -+ } while (drive--); - return err; - } - -diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c -index 0b697946e9bc..a08c6529271e 100644 ---- a/drivers/bluetooth/btbcm.c -+++ b/drivers/bluetooth/btbcm.c -@@ -270,6 +270,7 @@ static const struct { - { 0x4103, "BCM4330B1" }, /* 002.001.003 */ - { 0x410e, "BCM43341B0" }, /* 002.001.014 */ - { 0x4406, "BCM4324B3" }, /* 002.004.006 */ -+ { 0x6109, "BCM4335C0" }, /* 003.001.009 */ - { 0x610c, "BCM4354" }, /* 003.001.012 */ - { } - }; -diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c -index 1012b2cb6a16..d203940203b6 100644 ---- a/drivers/cdrom/cdrom.c -+++ b/drivers/cdrom/cdrom.c -@@ -2425,7 +2425,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi, - return -ENOSYS; - - if (arg != CDSL_CURRENT && arg != CDSL_NONE) { -- if ((int)arg >= cdi->capacity) -+ if (arg >= cdi->capacity) - return -EINVAL; - } - -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index d6d166fe49a3..7a2e23d6bfdd 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -613,8 +613,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - flags = ipmi_ssif_lock_cond(ssif_info, &oflags); - ssif_info->waiting_alert = true; - ssif_info->rtc_us_timer = SSIF_MSG_USEC; -- mod_timer(&ssif_info->retry_timer, -- jiffies + SSIF_MSG_JIFFIES); -+ if (!ssif_info->stopping) -+ mod_timer(&ssif_info->retry_timer, -+ jiffies + SSIF_MSG_JIFFIES); - ipmi_ssif_unlock_cond(ssif_info, flags); - return; - } -@@ -951,8 +952,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, - ssif_info->waiting_alert = true; - ssif_info->retries_left = SSIF_RECV_RETRIES; - ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC; -- mod_timer(&ssif_info->retry_timer, -- jiffies + SSIF_MSG_PART_JIFFIES); -+ if (!ssif_info->stopping) -+ mod_timer(&ssif_info->retry_timer, -+ jiffies + SSIF_MSG_PART_JIFFIES); - ipmi_ssif_unlock_cond(ssif_info, flags); - } - } -diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c -index 95a40ec854ad..e3f2915ca4be 100644 ---- a/drivers/char/tpm/tpm-interface.c -+++ b/drivers/char/tpm/tpm-interface.c -@@ -415,7 +415,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, - header = cmd; - - err = be32_to_cpu(header->return_code); -- if (err != 0 && desc) -+ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED -+ && desc) - dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err, - desc); - -diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c -index 849f2e29c243..0fb18765f982 100644 ---- a/drivers/char/tpm/xen-tpmfront.c -+++ b/drivers/char/tpm/xen-tpmfront.c -@@ -201,7 +201,7 @@ static int setup_ring(struct xenbus_device *dev, struct tpm_private *priv) - return -ENOMEM; - } - -- rv = xenbus_grant_ring(dev, &priv->shr, 1, &gref); -+ rv = xenbus_grant_ring(dev, priv->shr, 1, &gref); - if (rv < 0) - return rv; - -diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c -index d266299dfdb1..785864893f9a 100644 ---- a/drivers/clk/clk-s2mps11.c -+++ b/drivers/clk/clk-s2mps11.c -@@ -297,6 +297,36 @@ static const struct platform_device_id s2mps11_clk_id[] = { - }; - MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); - -+#ifdef CONFIG_OF -+/* -+ * Device is instantiated through parent MFD device and device matching is done -+ * through platform_device_id. -+ * -+ * However if device's DT node contains proper clock compatible and driver is -+ * built as a module, then the *module* matching will be done trough DT aliases. -+ * This requires of_device_id table. In the same time this will not change the -+ * actual *device* matching so do not add .of_match_table. -+ */ -+static const struct of_device_id s2mps11_dt_match[] = { -+ { -+ .compatible = "samsung,s2mps11-clk", -+ .data = (void *)S2MPS11X, -+ }, { -+ .compatible = "samsung,s2mps13-clk", -+ .data = (void *)S2MPS13X, -+ }, { -+ .compatible = "samsung,s2mps14-clk", -+ .data = (void *)S2MPS14X, -+ }, { -+ .compatible = "samsung,s5m8767-clk", -+ .data = (void *)S5M8767X, -+ }, { -+ /* Sentinel */ -+ }, -+}; -+MODULE_DEVICE_TABLE(of, s2mps11_dt_match); -+#endif -+ - static struct platform_driver s2mps11_clk_driver = { - .driver = { - .name = "s2mps11-clk", -diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c -index 0efd36e483ab..60c8a9bd562d 100644 ---- a/drivers/clocksource/i8253.c -+++ b/drivers/clocksource/i8253.c -@@ -19,6 +19,13 @@ - DEFINE_RAW_SPINLOCK(i8253_lock); - EXPORT_SYMBOL(i8253_lock); - -+/* -+ * Handle PIT quirk in pit_shutdown() where zeroing the counter register -+ * restarts the PIT, negating the shutdown. On platforms with the quirk, -+ * platform specific code can set this to false. -+ */ -+bool i8253_clear_counter_on_shutdown = true; -+ - #ifdef CONFIG_CLKSRC_I8253 - /* - * Since the PIT overflows every tick, its not very useful -@@ -108,8 +115,11 @@ static int pit_shutdown(struct clock_event_device *evt) - raw_spin_lock(&i8253_lock); - - outb_p(0x30, PIT_MODE); -- outb_p(0, PIT_CH0); -- outb_p(0, PIT_CH0); -+ -+ if (i8253_clear_counter_on_shutdown) { -+ outb_p(0, PIT_CH0); -+ outb_p(0, PIT_CH0); -+ } - - raw_spin_unlock(&i8253_lock); - return 0; -diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c -index dade7c47ff18..8344b7c91fe3 100644 ---- a/drivers/dma/dma-jz4780.c -+++ b/drivers/dma/dma-jz4780.c -@@ -750,6 +750,11 @@ static int jz4780_dma_probe(struct platform_device *pdev) - struct resource *res; - int i, ret; - -+ if (!dev->of_node) { -+ dev_err(dev, "This driver must be probed from devicetree\n"); -+ return -EINVAL; -+ } -+ - jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL); - if (!jzdma) - return -ENOMEM; -diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c -index ac8c28968422..106fa9b327d9 100644 ---- a/drivers/dma/ioat/init.c -+++ b/drivers/dma/ioat/init.c -@@ -1210,8 +1210,15 @@ static void ioat_shutdown(struct pci_dev *pdev) - - spin_lock_bh(&ioat_chan->prep_lock); - set_bit(IOAT_CHAN_DOWN, &ioat_chan->state); -- del_timer_sync(&ioat_chan->timer); - spin_unlock_bh(&ioat_chan->prep_lock); -+ /* -+ * Synchronization rule for del_timer_sync(): -+ * - The caller must not hold locks which would prevent -+ * completion of the timer's handler. -+ * So prep_lock cannot be held before calling it. -+ */ -+ del_timer_sync(&ioat_chan->timer); -+ - /* this should quiesce then reset */ - ioat_reset_hw(ioat_chan); - } -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 273e05a3c933..5a1bafb5ecbb 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -1225,6 +1225,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ - mutex_lock(&mgr->lock); - mstb = mgr->mst_primary; - -+ if (!mstb) -+ goto out; -+ - for (i = 0; i < lct - 1; i++) { - int shift = (i % 2) ? 0 : 4; - int port_num = (rad[i / 2] >> shift) & 0xf; -diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c -index 4dccd9b003a1..0d738d7870fd 100644 ---- a/drivers/gpu/drm/i915/intel_audio.c -+++ b/drivers/gpu/drm/i915/intel_audio.c -@@ -76,6 +76,9 @@ static const struct { - /* HDMI N/CTS table */ - #define TMDS_297M 297000 - #define TMDS_296M 296703 -+#define TMDS_594M 594000 -+#define TMDS_593M 593407 -+ - static const struct { - int sample_rate; - int clock; -@@ -96,6 +99,20 @@ static const struct { - { 176400, TMDS_297M, 18816, 247500 }, - { 192000, TMDS_296M, 23296, 281250 }, - { 192000, TMDS_297M, 20480, 247500 }, -+ { 44100, TMDS_593M, 8918, 937500 }, -+ { 44100, TMDS_594M, 9408, 990000 }, -+ { 48000, TMDS_593M, 5824, 562500 }, -+ { 48000, TMDS_594M, 6144, 594000 }, -+ { 32000, TMDS_593M, 5824, 843750 }, -+ { 32000, TMDS_594M, 3072, 445500 }, -+ { 88200, TMDS_593M, 17836, 937500 }, -+ { 88200, TMDS_594M, 18816, 990000 }, -+ { 96000, TMDS_593M, 11648, 562500 }, -+ { 96000, TMDS_594M, 12288, 594000 }, -+ { 176400, TMDS_593M, 35672, 937500 }, -+ { 176400, TMDS_594M, 37632, 990000 }, -+ { 192000, TMDS_593M, 23296, 562500 }, -+ { 192000, TMDS_594M, 24576, 594000 }, - }; - - /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */ -diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -index 083db3f5181f..8282ae0c4fc3 100644 ---- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -@@ -262,6 +262,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) - } - - txn->last_pat->next_pa = 0; -+ /* ensure that the written descriptors are visible to DMM */ -+ wmb(); -+ -+ /* -+ * NOTE: the wmb() above should be enough, but there seems to be a bug -+ * in OMAP's memory barrier implementation, which in some rare cases may -+ * cause the writes not to be observable after wmb(). -+ */ -+ -+ /* read back to ensure the data is in RAM */ -+ readl(&txn->last_pat->next_pa); - - /* write to PAT_DESCR to clear out any pending transaction */ - writel(0x0, dmm->base + reg[PAT_DESCR][engine->id]); -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index b59b15d4caa9..308d8432fea3 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -521,14 +521,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, - if (cmd == HIDIOCGCOLLECTIONINDEX) { - if (uref->usage_index >= field->maxusage) - goto inval; -+ uref->usage_index = -+ array_index_nospec(uref->usage_index, -+ field->maxusage); - } else if (uref->usage_index >= field->report_count) - goto inval; - } - -- if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && -- (uref_multi->num_values > HID_MAX_MULTI_USAGES || -- uref->usage_index + uref_multi->num_values > field->report_count)) -- goto inval; -+ if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) { -+ if (uref_multi->num_values > HID_MAX_MULTI_USAGES || -+ uref->usage_index + uref_multi->num_values > -+ field->report_count) -+ goto inval; -+ -+ uref->usage_index = -+ array_index_nospec(uref->usage_index, -+ field->report_count - -+ uref_multi->num_values); -+ } - - switch (cmd) { - case HIDIOCGUSAGE: -diff --git a/drivers/hwmon/pmbus/pmbus.c b/drivers/hwmon/pmbus/pmbus.c -index 0a74991a60f0..1b2b79f6ea3a 100644 ---- a/drivers/hwmon/pmbus/pmbus.c -+++ b/drivers/hwmon/pmbus/pmbus.c -@@ -117,6 +117,8 @@ static int pmbus_identify(struct i2c_client *client, - } else { - info->pages = 1; - } -+ -+ pmbus_clear_faults(client); - } - - if (pmbus_check_byte_register(client, 0, PMBUS_VOUT_MODE)) { -diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c -index d013acf3f83a..c00bad02761a 100644 ---- a/drivers/hwmon/pmbus/pmbus_core.c -+++ b/drivers/hwmon/pmbus/pmbus_core.c -@@ -1759,7 +1759,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data, - if (ret >= 0 && (ret & PB_CAPABILITY_ERROR_CHECK)) - client->flags |= I2C_CLIENT_PEC; - -- pmbus_clear_faults(client); -+ if (data->info->pages) -+ pmbus_clear_faults(client); -+ else -+ pmbus_clear_fault_page(client, -1); - - if (info->identify) { - ret = (*info->identify)(client, info); -diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c -index 93986f0590ef..d83e5b75a37b 100644 ---- a/drivers/iio/adc/at91_adc.c -+++ b/drivers/iio/adc/at91_adc.c -@@ -245,12 +245,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p) - struct iio_poll_func *pf = p; - struct iio_dev *idev = pf->indio_dev; - struct at91_adc_state *st = iio_priv(idev); -+ struct iio_chan_spec const *chan; - int i, j = 0; - - for (i = 0; i < idev->masklength; i++) { - if (!test_bit(i, idev->active_scan_mask)) - continue; -- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i)); -+ chan = idev->channels + i; -+ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel)); - j++; - } - -@@ -276,6 +278,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev) - iio_trigger_poll(idev->trig); - } else { - st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb)); -+ /* Needed to ACK the DRDY interruption */ -+ at91_adc_readl(st, AT91_ADC_LCDR); - st->done = true; - wake_up_interruptible(&st->wq_data_avail); - } -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 4ed621ad27e4..05aa3ac1381b 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -2372,7 +2372,7 @@ static int refill_keybuf_fn(struct btree_op *op, struct btree *b, - struct keybuf *buf = refill->buf; - int ret = MAP_CONTINUE; - -- if (bkey_cmp(k, refill->end) >= 0) { -+ if (bkey_cmp(k, refill->end) > 0) { - ret = MAP_DONE; - goto out; - } -diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c -index 6865b186f749..9371194677dc 100644 ---- a/drivers/md/dm-ioctl.c -+++ b/drivers/md/dm-ioctl.c -@@ -1685,8 +1685,7 @@ static void free_params(struct dm_ioctl *param, size_t param_size, int param_fla - } - - static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel, -- int ioctl_flags, -- struct dm_ioctl **param, int *param_flags) -+ int ioctl_flags, struct dm_ioctl **param, int *param_flags) - { - struct dm_ioctl *dmi; - int secure_data; -@@ -1734,18 +1733,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern - return -ENOMEM; - } - -- if (copy_from_user(dmi, user, param_kernel->data_size)) -- goto bad; -+ /* Copy from param_kernel (which was already copied from user) */ -+ memcpy(dmi, param_kernel, minimum_data_size); - --data_copied: -- /* -- * Abort if something changed the ioctl data while it was being copied. -- */ -- if (dmi->data_size != param_kernel->data_size) { -- DMERR("rejecting ioctl: data size modified while processing parameters"); -+ if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size, -+ param_kernel->data_size - minimum_data_size)) - goto bad; -- } -- -+data_copied: - /* Wipe the user buffer so we do not return it to userspace */ - if (secure_data && clear_user(user, param_kernel->data_size)) - goto bad; -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 89dcbf2fa846..82e284d2b202 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1605,6 +1605,7 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev) - */ - if (rdev->saved_raid_disk >= 0 && - rdev->saved_raid_disk >= first && -+ rdev->saved_raid_disk < conf->raid_disks && - conf->mirrors[rdev->saved_raid_disk].rdev == NULL) - first = last = rdev->saved_raid_disk; - -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 89111d455b71..8d613652d0e2 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1737,6 +1737,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev) - first = last = rdev->raid_disk; - - if (rdev->saved_raid_disk >= first && -+ rdev->saved_raid_disk < conf->geo.raid_disks && - conf->mirrors[rdev->saved_raid_disk].rdev == NULL) - mirror = rdev->saved_raid_disk; - else -diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c -index 3c5fb2509c47..118277d57c30 100644 ---- a/drivers/media/i2c/tvp5150.c -+++ b/drivers/media/i2c/tvp5150.c -@@ -870,9 +870,6 @@ static int tvp5150_s_crop(struct v4l2_subdev *sd, const struct v4l2_crop *a) - - /* tvp5150 has some special limits */ - rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT); -- rect.width = clamp_t(unsigned int, rect.width, -- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, -- TVP5150_H_MAX - rect.left); - rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP); - - /* Calculate height based on current standard */ -@@ -886,9 +883,16 @@ static int tvp5150_s_crop(struct v4l2_subdev *sd, const struct v4l2_crop *a) - else - hmax = TVP5150_V_MAX_OTHERS; - -- rect.height = clamp_t(unsigned int, rect.height, -+ /* -+ * alignments: -+ * - width = 2 due to UYVY colorspace -+ * - height, image = no special alignment -+ */ -+ v4l_bound_align_image(&rect.width, -+ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, -+ TVP5150_H_MAX - rect.left, 1, &rect.height, - hmax - TVP5150_MAX_CROP_TOP - rect.top, -- hmax - rect.top); -+ hmax - rect.top, 0, 0); - - tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top); - tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP, -diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c -index aaf4e46ff3e9..a0c1ff97f905 100644 ---- a/drivers/media/pci/cx23885/altera-ci.c -+++ b/drivers/media/pci/cx23885/altera-ci.c -@@ -660,6 +660,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr) - } - - temp_int = append_internal(inter); -+ if (!temp_int) { -+ ret = -ENOMEM; -+ goto err; -+ } - inter->filts_used = 1; - inter->dev = config->dev; - inter->fpga_rw = config->fpga_rw; -@@ -694,6 +698,7 @@ err: - __func__, ret); - - kfree(pid_filt); -+ kfree(inter); - - return ret; - } -@@ -728,6 +733,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr) - } - - temp_int = append_internal(inter); -+ if (!temp_int) { -+ ret = -ENOMEM; -+ goto err; -+ } - inter->cis_used = 1; - inter->dev = config->dev; - inter->fpga_rw = config->fpga_rw; -@@ -796,6 +805,7 @@ err: - ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret); - - kfree(state); -+ kfree(inter); - - return ret; - } -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index 394004607059..7c7dfaed9d15 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -2021,13 +2021,13 @@ struct em28xx_board em28xx_boards[] = { - .input = { { - .type = EM28XX_VMUX_COMPOSITE1, - .vmux = TVP5150_COMPOSITE1, -- .amux = EM28XX_AUDIO_SRC_LINE, -+ .amux = EM28XX_AMUX_LINE_IN, - .gpio = terratec_av350_unmute_gpio, - - }, { - .type = EM28XX_VMUX_SVIDEO, - .vmux = TVP5150_SVIDEO, -- .amux = EM28XX_AUDIO_SRC_LINE, -+ .amux = EM28XX_AMUX_LINE_IN, - .gpio = terratec_av350_unmute_gpio, - } }, - }, -diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c -index 6a3cf342e087..6cfcdcea27e0 100644 ---- a/drivers/media/usb/em28xx/em28xx-video.c -+++ b/drivers/media/usb/em28xx/em28xx-video.c -@@ -1149,6 +1149,8 @@ static void em28xx_ctrl_notify(struct v4l2_ctrl *ctrl, void *priv) - { - struct em28xx *dev = priv; - -+ dev->v4l2->field_count = 0; -+ - /* - * In the case of non-AC97 volume controls, we still need - * to do some setups at em28xx, in order to mute/unmute -@@ -1288,9 +1290,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv, - - fmt = format_by_fourcc(f->fmt.pix.pixelformat); - if (!fmt) { -- em28xx_videodbg("Fourcc format (%08x) invalid.\n", -- f->fmt.pix.pixelformat); -- return -EINVAL; -+ fmt = &format[0]; -+ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n", -+ f->fmt.pix.pixelformat, fmt->fourcc); - } - - if (dev->board.is_em2800) { -diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h -index cb851c14ca4b..159f35b2bd11 100644 ---- a/drivers/misc/genwqe/card_base.h -+++ b/drivers/misc/genwqe/card_base.h -@@ -404,7 +404,7 @@ struct genwqe_file { - struct file *filp; - - struct fasync_struct *async_queue; -- struct task_struct *owner; -+ struct pid *opener; - struct list_head list; /* entry in list of open files */ - - spinlock_t map_lock; /* lock for dma_mappings */ -diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c -index 7f1b282d7d96..c0012ca4229e 100644 ---- a/drivers/misc/genwqe/card_dev.c -+++ b/drivers/misc/genwqe/card_dev.c -@@ -52,7 +52,7 @@ static void genwqe_add_file(struct genwqe_dev *cd, struct genwqe_file *cfile) - { - unsigned long flags; - -- cfile->owner = current; -+ cfile->opener = get_pid(task_tgid(current)); - spin_lock_irqsave(&cd->file_lock, flags); - list_add(&cfile->list, &cd->file_list); - spin_unlock_irqrestore(&cd->file_lock, flags); -@@ -65,6 +65,7 @@ static int genwqe_del_file(struct genwqe_dev *cd, struct genwqe_file *cfile) - spin_lock_irqsave(&cd->file_lock, flags); - list_del(&cfile->list); - spin_unlock_irqrestore(&cd->file_lock, flags); -+ put_pid(cfile->opener); - - return 0; - } -@@ -275,7 +276,7 @@ static int genwqe_kill_fasync(struct genwqe_dev *cd, int sig) - return files; - } - --static int genwqe_force_sig(struct genwqe_dev *cd, int sig) -+static int genwqe_terminate(struct genwqe_dev *cd) - { - unsigned int files = 0; - unsigned long flags; -@@ -283,7 +284,7 @@ static int genwqe_force_sig(struct genwqe_dev *cd, int sig) - - spin_lock_irqsave(&cd->file_lock, flags); - list_for_each_entry(cfile, &cd->file_list, list) { -- force_sig(sig, cfile->owner); -+ kill_pid(cfile->opener, SIGKILL, 1); - files++; - } - spin_unlock_irqrestore(&cd->file_lock, flags); -@@ -1356,7 +1357,7 @@ static int genwqe_inform_and_stop_processes(struct genwqe_dev *cd) - dev_warn(&pci_dev->dev, - "[%s] send SIGKILL and wait ...\n", __func__); - -- rc = genwqe_force_sig(cd, SIGKILL); /* force terminate */ -+ rc = genwqe_terminate(cd); - if (rc) { - /* Give kill_timout more seconds to end processes */ - for (i = 0; (i < genwqe_kill_timeout) && -diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c -index d48f03104b5b..e417e4274d66 100644 ---- a/drivers/mmc/host/sdhci-pci-o2micro.c -+++ b/drivers/mmc/host/sdhci-pci-o2micro.c -@@ -334,6 +334,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip) - pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); - break; - case PCI_DEVICE_ID_O2_SEABIRD0: -+ if (chip->pdev->revision == 0x01) -+ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER; -+ /* fall through */ - case PCI_DEVICE_ID_O2_SEABIRD1: - /* UnLock WP */ - ret = pci_read_config_byte(chip->pdev, -diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig -index f73c41697a00..5ab9a46daf06 100644 ---- a/drivers/mtd/devices/Kconfig -+++ b/drivers/mtd/devices/Kconfig -@@ -208,7 +208,7 @@ comment "Disk-On-Chip Device Drivers" - config MTD_DOCG3 - tristate "M-Systems Disk-On-Chip G3" - select BCH -- select BCH_CONST_PARAMS -+ select BCH_CONST_PARAMS if !MTD_NAND_BCH - select BITREVERSE - ---help--- - This provides an MTD device driver for the M-Systems DiskOnChip -diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c -index 0e4fdc3dd729..18672ad773fb 100644 ---- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c -+++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c -@@ -556,8 +556,8 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string) - for (i = 0; i < BNAD_ETHTOOL_STATS_NUM; i++) { - BUG_ON(!(strlen(bnad_net_stats_strings[i]) < - ETH_GSTRING_LEN)); -- memcpy(string, bnad_net_stats_strings[i], -- ETH_GSTRING_LEN); -+ strncpy(string, bnad_net_stats_strings[i], -+ ETH_GSTRING_LEN); - string += ETH_GSTRING_LEN; - } - bmap = bna_tx_rid_mask(&bnad->bna); -diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -index 5ae8874bbf72..d70b2e5d5222 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -@@ -1826,11 +1826,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, - { - struct e1000_adapter *adapter = netdev_priv(netdev); - int i; -- char *p = NULL; - const struct e1000_stats *stat = e1000_gstrings_stats; - - e1000_update_stats(adapter); -- for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) { -+ for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) { -+ char *p; -+ - switch (stat->type) { - case NETDEV_STATS: - p = (char *)netdev + stat->stat_offset; -@@ -1841,15 +1842,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, - default: - WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n", - stat->type, i); -- break; -+ continue; - } - - if (stat->sizeof_stat == sizeof(u64)) - data[i] = *(u64 *)p; - else - data[i] = *(u32 *)p; -- -- stat++; - } - /* BUG_ON(i != E1000_STATS_LEN); */ - } -diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c -index 2a1d4a9d3c19..1f84f2fa459f 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_main.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c -@@ -521,8 +521,6 @@ void e1000_down(struct e1000_adapter *adapter) - struct net_device *netdev = adapter->netdev; - u32 rctl, tctl; - -- netif_carrier_off(netdev); -- - /* disable receives in the hardware */ - rctl = er32(RCTL); - ew32(RCTL, rctl & ~E1000_RCTL_EN); -@@ -538,6 +536,15 @@ void e1000_down(struct e1000_adapter *adapter) - E1000_WRITE_FLUSH(); - msleep(10); - -+ /* Set the carrier off after transmits have been disabled in the -+ * hardware, to avoid race conditions with e1000_watchdog() (which -+ * may be running concurrently to us, checking for the carrier -+ * bit to decide whether it should enable transmits again). Such -+ * a race condition would result into transmission being disabled -+ * in the hardware until the next IFF_DOWN+IFF_UP cycle. -+ */ -+ netif_carrier_off(netdev); -+ - napi_disable(&adapter->napi); - - e1000_irq_disable(adapter); -diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index b09a6b80d107..355c5fb802cd 100644 ---- a/drivers/net/ethernet/qlogic/qla3xxx.c -+++ b/drivers/net/ethernet/qlogic/qla3xxx.c -@@ -380,8 +380,6 @@ static void fm93c56a_select(struct ql3_adapter *qdev) - - qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1; - ql_write_nvram_reg(qdev, spir, ISP_NVRAM_MASK | qdev->eeprom_cmd_data); -- ql_write_nvram_reg(qdev, spir, -- ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data)); - } - - /* -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 50bfded6d7ef..5ac0b850d6b1 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1475,6 +1475,8 @@ static void tun_setup(struct net_device *dev) - */ - static int tun_validate(struct nlattr *tb[], struct nlattr *data[]) - { -+ if (!data) -+ return 0; - return -EINVAL; - } - -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 5bb1be478954..f201e50447d8 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -1749,6 +1749,12 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id) - if (ret) - dev_kfree_skb_any(skb); - -+ if (ret == -EAGAIN) { -+ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n", -+ cmd_id); -+ queue_work(ar->workqueue, &ar->restart_work); -+ } -+ - return ret; - } - -diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c -index a71187c783b7..273c7ecf4879 100644 ---- a/drivers/nvdimm/bus.c -+++ b/drivers/nvdimm/bus.c -@@ -158,6 +158,8 @@ static void nd_async_device_register(void *d, async_cookie_t cookie) - put_device(dev); - } - put_device(dev); -+ if (dev->parent) -+ put_device(dev->parent); - } - - static void nd_async_device_unregister(void *d, async_cookie_t cookie) -@@ -175,6 +177,8 @@ static void nd_async_device_unregister(void *d, async_cookie_t cookie) - void __nd_device_register(struct device *dev) - { - dev->bus = &nvdimm_bus_type; -+ if (dev->parent) -+ get_device(dev->parent); - get_device(dev); - async_schedule_domain(nd_async_device_register, dev, - &nd_async_domain); -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 5697b32819cb..84d501f5ff4e 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3061,7 +3061,11 @@ static void disable_igfx_irq(struct pci_dev *dev) - - pci_iounmap(dev, regs); - } -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0042, disable_igfx_irq); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0046, disable_igfx_irq); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x004a, disable_igfx_irq); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0106, disable_igfx_irq); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq); - -diff --git a/drivers/pcmcia/ricoh.h b/drivers/pcmcia/ricoh.h -index 01098c841f87..8ac7b138c094 100644 ---- a/drivers/pcmcia/ricoh.h -+++ b/drivers/pcmcia/ricoh.h -@@ -119,6 +119,10 @@ - #define RL5C4XX_MISC_CONTROL 0x2F /* 8 bit */ - #define RL5C4XX_ZV_ENABLE 0x08 - -+/* Misc Control 3 Register */ -+#define RL5C4XX_MISC3 0x00A2 /* 16 bit */ -+#define RL5C47X_MISC3_CB_CLKRUN_DIS BIT(1) -+ - #ifdef __YENTA_H - - #define rl_misc(socket) ((socket)->private[0]) -@@ -156,6 +160,35 @@ static void ricoh_set_zv(struct yenta_socket *socket) - } - } - -+static void ricoh_set_clkrun(struct yenta_socket *socket, bool quiet) -+{ -+ u16 misc3; -+ -+ /* -+ * RL5C475II likely has this setting, too, however no datasheet -+ * is publicly available for this chip -+ */ -+ if (socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C476 && -+ socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C478) -+ return; -+ -+ if (socket->dev->revision < 0x80) -+ return; -+ -+ misc3 = config_readw(socket, RL5C4XX_MISC3); -+ if (misc3 & RL5C47X_MISC3_CB_CLKRUN_DIS) { -+ if (!quiet) -+ dev_dbg(&socket->dev->dev, -+ "CLKRUN feature already disabled\n"); -+ } else if (disable_clkrun) { -+ if (!quiet) -+ dev_info(&socket->dev->dev, -+ "Disabling CLKRUN feature\n"); -+ misc3 |= RL5C47X_MISC3_CB_CLKRUN_DIS; -+ config_writew(socket, RL5C4XX_MISC3, misc3); -+ } -+} -+ - static void ricoh_save_state(struct yenta_socket *socket) - { - rl_misc(socket) = config_readw(socket, RL5C4XX_MISC); -@@ -172,6 +205,7 @@ static void ricoh_restore_state(struct yenta_socket *socket) - config_writew(socket, RL5C4XX_16BIT_IO_0, rl_io(socket)); - config_writew(socket, RL5C4XX_16BIT_MEM_0, rl_mem(socket)); - config_writew(socket, RL5C4XX_CONFIG, rl_config(socket)); -+ ricoh_set_clkrun(socket, true); - } - - -@@ -197,6 +231,7 @@ static int ricoh_override(struct yenta_socket *socket) - config_writew(socket, RL5C4XX_CONFIG, config); - - ricoh_set_zv(socket); -+ ricoh_set_clkrun(socket, false); - - return 0; - } -diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c -index 5d6d9b1549bc..5034422a1d96 100644 ---- a/drivers/pcmcia/yenta_socket.c -+++ b/drivers/pcmcia/yenta_socket.c -@@ -26,7 +26,8 @@ - - static bool disable_clkrun; - module_param(disable_clkrun, bool, 0444); --MODULE_PARM_DESC(disable_clkrun, "If PC card doesn't function properly, please try this option"); -+MODULE_PARM_DESC(disable_clkrun, -+ "If PC card doesn't function properly, please try this option (TI and Ricoh bridges only)"); - - static bool isa_probe = 1; - module_param(isa_probe, bool, 0444); -diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c -index 9ce0e30e33e8..5cd9a81a6060 100644 ---- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c -+++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c -@@ -321,6 +321,8 @@ static int pmic_mpp_set_mux(struct pinctrl_dev *pctldev, unsigned function, - pad->function = function; - - ret = pmic_mpp_write_mode_ctl(state, pad); -+ if (ret < 0) -+ return ret; - - val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT; - -@@ -345,13 +347,12 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev, - - switch (param) { - case PIN_CONFIG_BIAS_DISABLE: -- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN; -+ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_PULL_UP: - switch (pad->pullup) { -- case PMIC_MPP_PULL_UP_OPEN: -- arg = 0; -- break; - case PMIC_MPP_PULL_UP_0P6KOHM: - arg = 600; - break; -@@ -366,13 +367,17 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev, - } - break; - case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: -- arg = !pad->is_enabled; -+ if (pad->is_enabled) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_POWER_SOURCE: - arg = pad->power_source; - break; - case PIN_CONFIG_INPUT_ENABLE: -- arg = pad->input_enabled; -+ if (!pad->input_enabled) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_OUTPUT: - arg = pad->out_value; -@@ -384,7 +389,9 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev, - arg = pad->amux_input; - break; - case PMIC_MPP_CONF_PAIRED: -- arg = pad->paired; -+ if (!pad->paired) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_DRIVE_STRENGTH: - arg = pad->drive_strength; -@@ -457,7 +464,7 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin, - pad->dtest = arg; - break; - case PIN_CONFIG_DRIVE_STRENGTH: -- arg = pad->drive_strength; -+ pad->drive_strength = arg; - break; - case PMIC_MPP_CONF_AMUX_ROUTE: - if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4) -@@ -501,6 +508,10 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin, - if (ret < 0) - return ret; - -+ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength); -+ if (ret < 0) -+ return ret; -+ - val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT; - - return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val); -diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -index 19a3c3bc2f1f..b1e8a2d905ff 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -@@ -259,22 +259,32 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev, - - switch (param) { - case PIN_CONFIG_BIAS_DISABLE: -- arg = pin->bias == PM8XXX_GPIO_BIAS_NP; -+ if (pin->bias != PM8XXX_GPIO_BIAS_NP) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_PULL_DOWN: -- arg = pin->bias == PM8XXX_GPIO_BIAS_PD; -+ if (pin->bias != PM8XXX_GPIO_BIAS_PD) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_BIAS_PULL_UP: -- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30; -+ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30) -+ return -EINVAL; -+ arg = 1; - break; - case PM8XXX_QCOM_PULL_UP_STRENGTH: - arg = pin->pull_up_strength; - break; - case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: -- arg = pin->disable; -+ if (!pin->disable) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_INPUT_ENABLE: -- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT; -+ if (pin->mode != PM8XXX_GPIO_MODE_INPUT) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_OUTPUT: - if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT) -@@ -289,10 +299,14 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev, - arg = pin->output_strength; - break; - case PIN_CONFIG_DRIVE_PUSH_PULL: -- arg = !pin->open_drain; -+ if (pin->open_drain) -+ return -EINVAL; -+ arg = 1; - break; - case PIN_CONFIG_DRIVE_OPEN_DRAIN: -- arg = pin->open_drain; -+ if (!pin->open_drain) -+ return -EINVAL; -+ arg = 1; - break; - default: - return -EINVAL; -diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c -index e79f2a181ad2..b9ec4a16db1f 100644 ---- a/drivers/rtc/hctosys.c -+++ b/drivers/rtc/hctosys.c -@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void) - tv64.tv_sec = rtc_tm_to_time64(&tm); - - #if BITS_PER_LONG == 32 -- if (tv64.tv_sec > INT_MAX) -+ if (tv64.tv_sec > INT_MAX) { -+ err = -ERANGE; - goto err_read; -+ } - #endif - - err = do_settimeofday64(&tv64); -diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c -index 71cb05b1c3eb..60be0742e2c8 100644 ---- a/drivers/scsi/esp_scsi.c -+++ b/drivers/scsi/esp_scsi.c -@@ -1349,6 +1349,7 @@ static int esp_data_bytes_sent(struct esp *esp, struct esp_cmd_entry *ent, - - bytes_sent = esp->data_dma_len; - bytes_sent -= ecount; -+ bytes_sent -= esp->send_cmd_residual; - - /* - * The am53c974 has a DMA 'pecularity'. The doc states: -diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h -index 84dcbe4a6268..55be43fe7667 100644 ---- a/drivers/scsi/esp_scsi.h -+++ b/drivers/scsi/esp_scsi.h -@@ -540,6 +540,8 @@ struct esp { - - void *dma; - int dmarev; -+ -+ u32 send_cmd_residual; - }; - - /* A front-end driver for the ESP chip should do the following in -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 3406586b9201..ad4f16ab7f7a 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -3485,6 +3485,7 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba, - struct hbq_dmabuf *dmabuf; - struct lpfc_cq_event *cq_event; - unsigned long iflag; -+ int count = 0; - - spin_lock_irqsave(&phba->hbalock, iflag); - phba->hba_flag &= ~HBA_SP_QUEUE_EVT; -@@ -3506,16 +3507,22 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba, - if (irspiocbq) - lpfc_sli_sp_handle_rspiocb(phba, pring, - irspiocbq); -+ count++; - break; - case CQE_CODE_RECEIVE: - case CQE_CODE_RECEIVE_V1: - dmabuf = container_of(cq_event, struct hbq_dmabuf, - cq_event); - lpfc_sli4_handle_received_buffer(phba, dmabuf); -+ count++; - break; - default: - break; - } -+ -+ /* Limit the number of events to 64 to avoid soft lockups */ -+ if (count == 64) -+ break; - } - } - -diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c -index 26c67c42985c..1002124bd8bf 100644 ---- a/drivers/scsi/mac_esp.c -+++ b/drivers/scsi/mac_esp.c -@@ -426,6 +426,8 @@ static void mac_esp_send_pio_cmd(struct esp *esp, u32 addr, u32 esp_count, - scsi_esp_cmd(esp, ESP_CMD_TI); - } - } -+ -+ esp->send_cmd_residual = esp_count; - } - - static int mac_esp_irq_pending(struct esp *esp) -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 6835bae33ec4..ac7acd257c99 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -6510,6 +6510,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg) - get_user(user_sense_off, &cioc->sense_off)) - return -EFAULT; - -+ if (local_sense_off != user_sense_off) -+ return -EINVAL; -+ - if (local_sense_len) { - void __user **sense_ioc_ptr = - (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off); -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index cb11e04be568..87059a6786f4 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -3315,10 +3315,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id, - mcp->mb[0] = MBC_PORT_PARAMS; - mcp->mb[1] = loop_id; - mcp->mb[2] = BIT_0; -- if (IS_CNA_CAPABLE(vha->hw)) -- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); -- else -- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0); -+ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); - mcp->mb[9] = vha->vp_idx; - mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0; - mcp->in_mb = MBX_3|MBX_1|MBX_0; -diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c -index bc34cf7482fb..a4753644f4cf 100644 ---- a/drivers/soc/tegra/pmc.c -+++ b/drivers/soc/tegra/pmc.c -@@ -738,7 +738,7 @@ void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc) - if (!pmc->soc->has_tsense_reset) - return; - -- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip"); -+ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip"); - if (!np) { - dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled); - return; -diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c -index 3be9519654e5..cf3fad2cb871 100644 ---- a/drivers/tc/tc.c -+++ b/drivers/tc/tc.c -@@ -2,7 +2,7 @@ - * TURBOchannel bus services. - * - * Copyright (c) Harald Koerfgen, 1998 -- * Copyright (c) 2001, 2003, 2005, 2006 Maciej W. Rozycki -+ * Copyright (c) 2001, 2003, 2005, 2006, 2018 Maciej W. Rozycki - * Copyright (c) 2005 James Simmons - * - * This file is subject to the terms and conditions of the GNU -@@ -10,6 +10,7 @@ - * directory of this archive for more details. - */ - #include -+#include - #include - #include - #include -@@ -92,6 +93,11 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus) - tdev->dev.bus = &tc_bus_type; - tdev->slot = slot; - -+ /* TURBOchannel has 34-bit DMA addressing (16GiB space). */ -+ tdev->dma_mask = DMA_BIT_MASK(34); -+ tdev->dev.dma_mask = &tdev->dma_mask; -+ tdev->dev.coherent_dma_mask = DMA_BIT_MASK(34); -+ - for (i = 0; i < 8; i++) { - tdev->firmware[i] = - readb(module + offset + TC_FIRM_VER + 4 * i); -diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c -index a260cde743e2..2db68dfe497d 100644 ---- a/drivers/tty/serial/kgdboc.c -+++ b/drivers/tty/serial/kgdboc.c -@@ -133,6 +133,11 @@ static void kgdboc_unregister_kbd(void) - - static int kgdboc_option_setup(char *opt) - { -+ if (!opt) { -+ pr_err("kgdboc: config string not provided\n"); -+ return -EINVAL; -+ } -+ - if (strlen(opt) >= MAX_CONFIG_LEN) { - printk(KERN_ERR "kgdboc: config string too long\n"); - return -ENOSPC; -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 7d5ee8a13ac6..17a22073d226 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -648,7 +648,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port) - uart_write_wakeup(port); - } - --static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) -+static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - { - struct uart_port *port = &s->p[portno].port; - -@@ -657,7 +657,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - - iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); - if (iir & SC16IS7XX_IIR_NO_INT_BIT) -- break; -+ return false; - - iir &= SC16IS7XX_IIR_ID_MASK; - -@@ -685,16 +685,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) - port->line, iir); - break; - } -- } while (1); -+ } while (0); -+ return true; - } - - static void sc16is7xx_ist(struct kthread_work *ws) - { - struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); -- int i; - -- for (i = 0; i < s->devtype->nr_uart; ++i) -- sc16is7xx_port_irq(s, i); -+ while (1) { -+ bool keep_polling = false; -+ int i; -+ -+ for (i = 0; i < s->devtype->nr_uart; ++i) -+ keep_polling |= sc16is7xx_port_irq(s, i); -+ if (!keep_polling) -+ break; -+ } - } - - static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 198451fa9e5d..c1cff2b455ae 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -357,7 +357,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) - mutex_lock(&tty_mutex); - /* Search through the tty devices to look for a match */ - list_for_each_entry(p, &tty_drivers, tty_drivers) { -- if (strncmp(name, p->name, len) != 0) -+ if (!len || strncmp(name, p->name, len) != 0) - continue; - stp = str; - if (*stp == ',') -diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c -index 1445dd39aa62..bece7e39f512 100644 ---- a/drivers/tty/tty_ioctl.c -+++ b/drivers/tty/tty_ioctl.c -@@ -330,7 +330,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios) - else - cbaud += 15; - } -- return baud_table[cbaud]; -+ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; - } - EXPORT_SYMBOL(tty_termios_baud_rate); - -@@ -366,7 +366,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios) - else - cbaud += 15; - } -- return baud_table[cbaud]; -+ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; - #else - return tty_termios_baud_rate(termios); - #endif -diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c -index b9823eb9c195..0ab15d833d1b 100644 ---- a/drivers/uio/uio.c -+++ b/drivers/uio/uio.c -@@ -249,6 +249,8 @@ static struct class uio_class = { - .dev_groups = uio_groups, - }; - -+bool uio_class_registered; -+ - /* - * device functions - */ -@@ -772,6 +774,9 @@ static int init_uio_class(void) - printk(KERN_ERR "class_register failed for uio\n"); - goto err_class_register; - } -+ -+ uio_class_registered = true; -+ - return 0; - - err_class_register: -@@ -782,6 +787,7 @@ exit: - - static void release_uio_class(void) - { -+ uio_class_registered = false; - class_unregister(&uio_class); - uio_major_cleanup(); - } -@@ -801,6 +807,9 @@ int __uio_register_device(struct module *owner, - struct uio_device *idev; - int ret = 0; - -+ if (!uio_class_registered) -+ return -EPROBE_DEFER; -+ - if (!parent || !info || !info->name || !info->version) - return -EINVAL; - -diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h -index 9ecb598e48f0..a5557c70034a 100644 ---- a/drivers/usb/chipidea/otg.h -+++ b/drivers/usb/chipidea/otg.h -@@ -20,7 +20,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci); - static inline void ci_otg_queue_work(struct ci_hdrc *ci) - { - disable_irq_nosync(ci->irq); -- queue_work(ci->wq, &ci->work); -+ if (queue_work(ci->wq, &ci->work) == false) -+ enable_irq(ci->irq); - } - - #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */ -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index da6cc25baaef..8fc62a03637a 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -1009,7 +1009,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin); - } - /* -- * Set prot_iter to data_iter, and advance past any -+ * Set prot_iter to data_iter and truncate it to -+ * prot_bytes, and advance data_iter past any - * preceeding prot_bytes that may be present. - * - * Also fix up the exp_data_len to reflect only the -@@ -1018,6 +1019,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - if (prot_bytes) { - exp_data_len -= prot_bytes; - prot_iter = data_iter; -+ iov_iter_truncate(&prot_iter, prot_bytes); - iov_iter_advance(&data_iter, prot_bytes); - } - tag = vhost64_to_cpu(vq, v_req_pi.tag); -diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c -index 182bd680141f..e9dfe0e40b8b 100644 ---- a/drivers/video/fbdev/aty/mach64_accel.c -+++ b/drivers/video/fbdev/aty/mach64_accel.c -@@ -126,7 +126,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info) - - /* set host attributes */ - wait_for_fifo(13, par); -- aty_st_le32(HOST_CNTL, 0, par); -+ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); - - /* set pattern attributes */ - aty_st_le32(PAT_REG0, 0, par); -@@ -232,7 +232,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area) - rotation = rotation24bpp(dx, direction); - } - -- wait_for_fifo(4, par); -+ wait_for_fifo(5, par); -+ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); - aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par); - aty_st_le32(SRC_Y_X, (sx << 16) | sy, par); - aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par); -@@ -268,7 +269,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) - rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT); - } - -- wait_for_fifo(3, par); -+ wait_for_fifo(4, par); -+ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); - aty_st_le32(DP_FRGD_CLR, color, par); - aty_st_le32(DP_SRC, - BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE, -@@ -283,7 +285,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - { - struct atyfb_par *par = (struct atyfb_par *) info->par; - u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; -- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix; -+ u32 pix_width, rotation = 0, src, mix; - - if (par->asleep) - return; -@@ -295,8 +297,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - return; - } - -- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par); -- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN; -+ pix_width = par->crtc.dp_pix_width; - - switch (image->depth) { - case 1: -@@ -344,7 +345,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit - * this hwaccelerated triple has an issue with not aligned data - */ -- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0) -+ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0) - pix_width |= DP_HOST_TRIPLE_EN; - } - -@@ -369,19 +370,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D; - } - -- wait_for_fifo(6, par); -- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par); -+ wait_for_fifo(5, par); - aty_st_le32(DP_PIX_WIDTH, pix_width, par); - aty_st_le32(DP_MIX, mix, par); - aty_st_le32(DP_SRC, src, par); -- aty_st_le32(HOST_CNTL, host_cntl, par); -+ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); - aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par); - - draw_rect(dx, dy, width, image->height, par); - src_bytes = (((image->width * image->depth) + 7) / 8) * image->height; - - /* manual triple each pixel */ -- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { -+ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { - int inbit, outbit, mult24, byte_id_in_dword, width; - u8 *pbitmapin = (u8*)image->data, *pbitmapout; - u32 hostdword; -@@ -414,7 +414,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - } - } - wait_for_fifo(1, par); -- aty_st_le32(HOST_DATA0, hostdword, par); -+ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par); - } - } else { - u32 *pbitmap, dwords = (src_bytes + 3) / 4; -@@ -423,8 +423,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) - aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par); - } - } -- -- /* restore pix_width */ -- wait_for_fifo(1, par); -- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par); - } -diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c -index 0c427d6a12d1..4c5c6550809d 100644 ---- a/drivers/w1/masters/omap_hdq.c -+++ b/drivers/w1/masters/omap_hdq.c -@@ -785,6 +785,8 @@ static int omap_hdq_remove(struct platform_device *pdev) - /* remove module dependency */ - pm_runtime_disable(&pdev->dev); - -+ w1_remove_master_device(&omap_w1_master); -+ - return 0; - } - -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 1889e928a0da..a8a388382347 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -310,6 +310,9 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size, - */ - flags &= ~(__GFP_DMA | __GFP_HIGHMEM); - -+ /* Convert the size to actually allocated. */ -+ size = 1UL << (order + XEN_PAGE_SHIFT); -+ - /* On ARM this function returns an ioremap'ped virtual address for - * which virt_to_phys doesn't return the corresponding physical - * address. In fact on ARM virt_to_phys only works for kernel direct -@@ -359,6 +362,9 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, - * physical address */ - phys = xen_bus_to_phys(dev_addr); - -+ /* Convert the size to actually allocated. */ -+ size = 1UL << (order + XEN_PAGE_SHIFT); -+ - if (((dev_addr + size - 1 <= dma_mask)) || - range_straddles_page_boundary(phys, size)) - xen_destroy_contiguous_region(phys, order); -diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c -index 12ceaf52dae6..e7b3d2c4472d 100644 ---- a/fs/9p/vfs_file.c -+++ b/fs/9p/vfs_file.c -@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) - break; - if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0) - break; -+ /* -+ * p9_client_lock_dotl overwrites flock.client_id with the -+ * server message, free and reuse the client name -+ */ -+ if (flock.client_id != fid->clnt->name) { -+ kfree(flock.client_id); -+ flock.client_id = fid->clnt->name; -+ } - } - - /* map 9p status to VFS status */ -@@ -235,6 +243,8 @@ out_unlock: - locks_lock_file_wait(filp, fl); - fl->fl_type = fl_type; - } -+ if (flock.client_id != fid->clnt->name) -+ kfree(flock.client_id); - out: - return res; - } -@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) - - res = p9_client_getlock_dotl(fid, &glock); - if (res < 0) -- return res; -+ goto out; - /* map 9p lock type to os lock type */ - switch (glock.type) { - case P9_LOCK_TYPE_RDLCK: -@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) - fl->fl_end = glock.start + glock.length - 1; - fl->fl_pid = glock.proc_id; - } -- kfree(glock.client_id); -+out: -+ if (glock.client_id != fid->clnt->name) -+ kfree(glock.client_id); - return res; - } - -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 62bc72001fce..f010d6c8dd14 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -604,28 +604,30 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, - * Do the same thing for the memory mapping - between - * elf_bss and last_bss is the bss section. - */ -- k = load_addr + eppnt->p_memsz + eppnt->p_vaddr; -+ k = load_addr + eppnt->p_vaddr + eppnt->p_memsz; - if (k > last_bss) - last_bss = k; - } - } - -+ /* -+ * Now fill out the bss section: first pad the last page from -+ * the file up to the page boundary, and zero it from elf_bss -+ * up to the end of the page. -+ */ -+ if (padzero(elf_bss)) { -+ error = -EFAULT; -+ goto out; -+ } -+ /* -+ * Next, align both the file and mem bss up to the page size, -+ * since this is where elf_bss was just zeroed up to, and where -+ * last_bss will end after the vm_brk() below. -+ */ -+ elf_bss = ELF_PAGEALIGN(elf_bss); -+ last_bss = ELF_PAGEALIGN(last_bss); -+ /* Finally, if there is still more bss to allocate, do it. */ - if (last_bss > elf_bss) { -- /* -- * Now fill out the bss section. First pad the last page up -- * to the page boundary, and then perform a mmap to make sure -- * that there are zero-mapped pages up to and including the -- * last bss page. -- */ -- if (padzero(elf_bss)) { -- error = -EFAULT; -- goto out; -- } -- -- /* What we have mapped so far */ -- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1); -- -- /* Map the last of the bss segment */ - error = vm_brk(elf_bss, last_bss - elf_bss); - if (BAD_ADDR(error)) - goto out; -@@ -1212,11 +1214,13 @@ static int load_elf_library(struct file *file) - goto out_free_ph; - } - -- len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + -- ELF_MIN_ALIGN - 1); -- bss = eppnt->p_memsz + eppnt->p_vaddr; -- if (bss > len) -- vm_brk(len, bss - len); -+ len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); -+ bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); -+ if (bss > len) { -+ error = vm_brk(len, bss - len); -+ if (BAD_ADDR(error)) -+ goto out_free_ph; -+ } - error = 0; - - out_free_ph: -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index a72f941ca750..80cd28456f08 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -7835,6 +7835,20 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root, - buf = btrfs_find_create_tree_block(root, bytenr); - if (!buf) - return ERR_PTR(-ENOMEM); -+ -+ /* -+ * Extra safety check in case the extent tree is corrupted and extent -+ * allocator chooses to use a tree block which is already used and -+ * locked. -+ */ -+ if (buf->lock_owner == current->pid) { -+ btrfs_err_rl(root->fs_info, -+"tree block %llu owner %llu already locked by pid=%d, extent tree corruption detected", -+ buf->start, btrfs_header_owner(buf), current->pid); -+ free_extent_buffer(buf); -+ return ERR_PTR(-EUCLEAN); -+ } -+ - btrfs_set_header_generation(buf, trans->transid); - btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level); - btrfs_tree_lock(buf); -@@ -8704,15 +8718,14 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, - if (eb == root->node) { - if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) - parent = eb->start; -- else -- BUG_ON(root->root_key.objectid != -- btrfs_header_owner(eb)); -+ else if (root->root_key.objectid != btrfs_header_owner(eb)) -+ goto owner_mismatch; - } else { - if (wc->flags[level + 1] & BTRFS_BLOCK_FLAG_FULL_BACKREF) - parent = path->nodes[level + 1]->start; -- else -- BUG_ON(root->root_key.objectid != -- btrfs_header_owner(path->nodes[level + 1])); -+ else if (root->root_key.objectid != -+ btrfs_header_owner(path->nodes[level + 1])) -+ goto owner_mismatch; - } - - btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1); -@@ -8720,6 +8733,11 @@ out: - wc->refs[level] = 0; - wc->flags[level] = 0; - return 0; -+ -+owner_mismatch: -+ btrfs_err_rl(root->fs_info, "unexpected tree owner, have %llu expect %llu", -+ btrfs_header_owner(eb), root->root_key.objectid); -+ return -EUCLEAN; - } - - static noinline int walk_down_tree(struct btrfs_trans_handle *trans, -@@ -8773,6 +8791,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans, - ret = walk_up_proc(trans, root, path, wc); - if (ret > 0) - return 0; -+ if (ret < 0) -+ return ret; - - if (path->locks[level]) { - btrfs_tree_unlock_rw(path->nodes[level], -@@ -9501,6 +9521,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info) - - block_group = btrfs_lookup_first_block_group(info, last); - while (block_group) { -+ wait_block_group_cache_done(block_group); - spin_lock(&block_group->lock); - if (block_group->iref) - break; -@@ -9891,7 +9912,7 @@ error: - void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans, - struct btrfs_root *root) - { -- struct btrfs_block_group_cache *block_group, *tmp; -+ struct btrfs_block_group_cache *block_group; - struct btrfs_root *extent_root = root->fs_info->extent_root; - struct btrfs_block_group_item item; - struct btrfs_key key; -@@ -9899,7 +9920,10 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans, - bool can_flush_pending_bgs = trans->can_flush_pending_bgs; - - trans->can_flush_pending_bgs = false; -- list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) { -+ while (!list_empty(&trans->new_bgs)) { -+ block_group = list_first_entry(&trans->new_bgs, -+ struct btrfs_block_group_cache, -+ bg_list); - if (ret) - goto next; - -@@ -10609,6 +10633,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, - - *trimmed = 0; - -+ /* Discard not supported = nothing to do. */ -+ if (!blk_queue_discard(bdev_get_queue(device->bdev))) -+ return 0; -+ - /* Not writeable = nothing to do. */ - if (!device->writeable) - return 0; -@@ -10731,8 +10759,8 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) - } - - mutex_lock(&root->fs_info->fs_devices->device_list_mutex); -- devices = &root->fs_info->fs_devices->alloc_list; -- list_for_each_entry(device, devices, dev_alloc_list) { -+ devices = &root->fs_info->fs_devices->devices; -+ list_for_each_entry(device, devices, dev_list) { - ret = btrfs_trim_free_extents(device, range->minlen, - &group_trimmed); - if (ret) -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index 45934deacfd7..1aa897dd9ce3 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -1699,6 +1699,8 @@ static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl, - bitmap_clear(info->bitmap, start, count); - - info->bytes -= bytes; -+ if (info->max_extent_size > ctl->unit) -+ info->max_extent_size = 0; - } - - static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl, -@@ -1782,6 +1784,13 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl, - return -1; - } - -+static inline u64 get_max_extent_size(struct btrfs_free_space *entry) -+{ -+ if (entry->bitmap) -+ return entry->max_extent_size; -+ return entry->bytes; -+} -+ - /* Cache the size of the max extent in bytes */ - static struct btrfs_free_space * - find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes, -@@ -1803,8 +1812,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes, - for (node = &entry->offset_index; node; node = rb_next(node)) { - entry = rb_entry(node, struct btrfs_free_space, offset_index); - if (entry->bytes < *bytes) { -- if (entry->bytes > *max_extent_size) -- *max_extent_size = entry->bytes; -+ *max_extent_size = max(get_max_extent_size(entry), -+ *max_extent_size); - continue; - } - -@@ -1822,8 +1831,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes, - } - - if (entry->bytes < *bytes + align_off) { -- if (entry->bytes > *max_extent_size) -- *max_extent_size = entry->bytes; -+ *max_extent_size = max(get_max_extent_size(entry), -+ *max_extent_size); - continue; - } - -@@ -1835,8 +1844,10 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes, - *offset = tmp; - *bytes = size; - return entry; -- } else if (size > *max_extent_size) { -- *max_extent_size = size; -+ } else { -+ *max_extent_size = -+ max(get_max_extent_size(entry), -+ *max_extent_size); - } - continue; - } -@@ -2694,8 +2705,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group, - - err = search_bitmap(ctl, entry, &search_start, &search_bytes, true); - if (err) { -- if (search_bytes > *max_extent_size) -- *max_extent_size = search_bytes; -+ *max_extent_size = max(get_max_extent_size(entry), -+ *max_extent_size); - return 0; - } - -@@ -2732,8 +2743,9 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group, - - entry = rb_entry(node, struct btrfs_free_space, offset_index); - while (1) { -- if (entry->bytes < bytes && entry->bytes > *max_extent_size) -- *max_extent_size = entry->bytes; -+ if (entry->bytes < bytes) -+ *max_extent_size = max(get_max_extent_size(entry), -+ *max_extent_size); - - if (entry->bytes < bytes || - (!entry->bitmap && entry->offset < min_start)) { -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index b895be3d4311..383717ccecc7 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -481,6 +481,7 @@ again: - pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (!pages) { - /* just bail out to the uncompressed code */ -+ nr_pages = 0; - goto cont; - } - -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 6caeb946fc1d..150d3c891815 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -3950,9 +3950,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd, - goto out_unlock; - if (len == 0) - olen = len = src->i_size - off; -- /* if we extend to eof, continue to block boundary */ -- if (off + len == src->i_size) -+ /* -+ * If we extend to eof, continue to block boundary if and only if the -+ * destination end offset matches the destination file's size, otherwise -+ * we would be corrupting data by placing the eof block into the middle -+ * of a file. -+ */ -+ if (off + len == src->i_size) { -+ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size) -+ goto out_unlock; - len = ALIGN(src->i_size, bs) - off; -+ } - - if (len == 0) { - ret = 0; -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index a751937dded5..90e29d40aa82 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -2446,6 +2446,7 @@ qgroup_rescan_zero_tracking(struct btrfs_fs_info *fs_info) - qgroup->rfer_cmpr = 0; - qgroup->excl = 0; - qgroup->excl_cmpr = 0; -+ qgroup_dirty(fs_info, qgroup); - } - spin_unlock(&fs_info->qgroup_lock); - } -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index cfe913d2d3df..d6ccfb31aef0 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -1318,7 +1318,7 @@ static void __del_reloc_root(struct btrfs_root *root) - struct mapping_node *node = NULL; - struct reloc_control *rc = root->fs_info->reloc_ctl; - -- if (rc) { -+ if (rc && root->node) { - spin_lock(&rc->reloc_root_tree.lock); - rb_node = tree_search(&rc->reloc_root_tree.rb_root, - root->node->start); -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 2c7f9a5f8717..63f59f17c97e 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -5240,9 +5240,33 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, - - dir_inode = btrfs_iget(root->fs_info->sb, &inode_key, - root, NULL); -- /* If parent inode was deleted, skip it. */ -- if (IS_ERR(dir_inode)) -- continue; -+ /* -+ * If the parent inode was deleted, return an error to -+ * fallback to a transaction commit. This is to prevent -+ * getting an inode that was moved from one parent A to -+ * a parent B, got its former parent A deleted and then -+ * it got fsync'ed, from existing at both parents after -+ * a log replay (and the old parent still existing). -+ * Example: -+ * -+ * mkdir /mnt/A -+ * mkdir /mnt/B -+ * touch /mnt/B/bar -+ * sync -+ * mv /mnt/B/bar /mnt/A/bar -+ * mv -T /mnt/A /mnt/B -+ * fsync /mnt/B/bar -+ * -+ * -+ * If we ignore the old parent B which got deleted, -+ * after a log replay we would have file bar linked -+ * at both parents and the old parent B would still -+ * exist. -+ */ -+ if (IS_ERR(dir_inode)) { -+ ret = PTR_ERR(dir_inode); -+ goto out; -+ } - - ret = btrfs_log_inode(trans, root, dir_inode, - LOG_INODE_ALL, 0, LLONG_MAX, ctx); -diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c -index 0e72a14228f8..7bc6d27d47a4 100644 ---- a/fs/cifs/cifs_debug.c -+++ b/fs/cifs/cifs_debug.c -@@ -285,6 +285,9 @@ static ssize_t cifs_stats_proc_write(struct file *file, - atomic_set(&totBufAllocCount, 0); - atomic_set(&totSmBufAllocCount, 0); - #endif /* CONFIG_CIFS_STATS2 */ -+ atomic_set(&tcpSesReconnectCount, 0); -+ atomic_set(&tconInfoReconnectCount, 0); -+ - spin_lock(&GlobalMid_Lock); - GlobalMaxActiveXid = 0; - GlobalCurrentXid = 0; -diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c -index 6908080e9b6d..e3f2b7370bd8 100644 ---- a/fs/cifs/cifs_spnego.c -+++ b/fs/cifs/cifs_spnego.c -@@ -143,8 +143,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo) - sprintf(dp, ";sec=krb5"); - else if (server->sec_mskerberos) - sprintf(dp, ";sec=mskrb5"); -- else -- goto out; -+ else { -+ cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n"); -+ sprintf(dp, ";sec=krb5"); -+ } - - dp = description + strlen(description); - sprintf(dp, ";uid=0x%x", -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index 36c8594bb147..5c3187df9ab9 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -756,7 +756,15 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, - } else if (rc == -EREMOTE) { - cifs_create_dfs_fattr(&fattr, sb); - rc = 0; -- } else if (rc == -EACCES && backup_cred(cifs_sb)) { -+ } else if ((rc == -EACCES) && backup_cred(cifs_sb) && -+ (strcmp(server->vals->version_string, SMB1_VERSION_STRING) -+ == 0)) { -+ /* -+ * For SMB2 and later the backup intent flag is already -+ * sent if needed on open and there is no path based -+ * FindFirst operation to use to retry with -+ */ -+ - srchinf = kzalloc(sizeof(struct cifs_search_info), - GFP_KERNEL); - if (srchinf == NULL) { -diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c -index 0525ebc3aea2..66e8c5d58b21 100644 ---- a/fs/configfs/symlink.c -+++ b/fs/configfs/symlink.c -@@ -64,7 +64,7 @@ static void fill_item_path(struct config_item * item, char * buffer, int length) - - /* back up enough to print this bus id with '/' */ - length -= cur; -- strncpy(buffer + length,config_item_name(p),cur); -+ memcpy(buffer + length, config_item_name(p), cur); - *(buffer + --length) = '/'; - } - } -diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c -index 355c522f3585..a6c9c2d66af1 100644 ---- a/fs/cramfs/inode.c -+++ b/fs/cramfs/inode.c -@@ -185,7 +185,8 @@ static void *cramfs_read(struct super_block *sb, unsigned int offset, unsigned i - continue; - blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_CACHE_SHIFT; - blk_offset += offset; -- if (blk_offset + len > BUFFER_SIZE) -+ if (blk_offset > BUFFER_SIZE || -+ blk_offset + len > BUFFER_SIZE) - continue; - return read_buffers[i] + blk_offset; - } -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index f5d9f82b173a..b6e25d771eea 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -3039,9 +3039,6 @@ extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode, - extern int ext4_inline_data_fiemap(struct inode *inode, - struct fiemap_extent_info *fieinfo, - int *has_inline, __u64 start, __u64 len); --extern int ext4_try_to_evict_inline_data(handle_t *handle, -- struct inode *inode, -- int needed); - extern void ext4_inline_data_truncate(struct inode *inode, int *has_inline); - - extern int ext4_convert_inline_data(struct inode *inode); -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 1e7a9774119c..1aec46733ef8 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -859,7 +859,7 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping, - handle_t *handle; - struct page *page; - struct ext4_iloc iloc; -- int retries; -+ int retries = 0; - - ret = ext4_get_inode_loc(inode, &iloc); - if (ret) -@@ -888,11 +888,11 @@ retry_journal: - flags |= AOP_FLAG_NOFS; - - if (ret == -ENOSPC) { -+ ext4_journal_stop(handle); - ret = ext4_da_convert_inline_data_to_extent(mapping, - inode, - flags, - fsdata); -- ext4_journal_stop(handle); - if (ret == -ENOSPC && - ext4_should_retry_alloc(inode->i_sb, &retries)) - goto retry_journal; -@@ -1867,42 +1867,6 @@ out: - return (error < 0 ? error : 0); - } - --/* -- * Called during xattr set, and if we can sparse space 'needed', -- * just create the extent tree evict the data to the outer block. -- * -- * We use jbd2 instead of page cache to move data to the 1st block -- * so that the whole transaction can be committed as a whole and -- * the data isn't lost because of the delayed page cache write. -- */ --int ext4_try_to_evict_inline_data(handle_t *handle, -- struct inode *inode, -- int needed) --{ -- int error; -- struct ext4_xattr_entry *entry; -- struct ext4_inode *raw_inode; -- struct ext4_iloc iloc; -- -- error = ext4_get_inode_loc(inode, &iloc); -- if (error) -- return error; -- -- raw_inode = ext4_raw_inode(&iloc); -- entry = (struct ext4_xattr_entry *)((void *)raw_inode + -- EXT4_I(inode)->i_inline_off); -- if (EXT4_XATTR_LEN(entry->e_name_len) + -- EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)) < needed) { -- error = -ENOSPC; -- goto out; -- } -- -- error = ext4_convert_inline_data_nolock(handle, inode, &iloc); --out: -- brelse(iloc.bh); -- return error; --} -- - void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - { - handle_t *handle; -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 05048fcfd602..6b5e2eddd8d7 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -526,9 +526,13 @@ mext_check_arguments(struct inode *orig_inode, - orig_inode->i_ino, donor_inode->i_ino); - return -EINVAL; - } -- if (orig_eof < orig_start + *len - 1) -+ if (orig_eof <= orig_start) -+ *len = 0; -+ else if (orig_eof < orig_start + *len - 1) - *len = orig_eof - orig_start; -- if (donor_eof < donor_start + *len - 1) -+ if (donor_eof <= donor_start) -+ *len = 0; -+ else if (donor_eof < donor_start + *len - 1) - *len = donor_eof - donor_start; - if (!*len) { - ext4_debug("ext4 move extent: len should not be 0 " -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index a1f1e53d0e25..aa08e129149d 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -124,6 +124,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, - if (!is_dx_block && type == INDEX) { - ext4_error_inode(inode, func, line, block, - "directory leaf block found instead of index block"); -+ brelse(bh); - return ERR_PTR(-EFSCORRUPTED); - } - if (!ext4_has_metadata_csum(inode->i_sb) || -@@ -2830,7 +2831,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) - list_del_init(&EXT4_I(inode)->i_orphan); - mutex_unlock(&sbi->s_orphan_lock); - } -- } -+ } else -+ brelse(iloc.bh); -+ - jbd_debug(4, "superblock will point to %lu\n", inode->i_ino); - jbd_debug(4, "orphan inode %lu will point to %d\n", - inode->i_ino, NEXT_ORPHAN(inode)); -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 783280ebc2fe..bad13f049fb0 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -442,16 +442,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle, - - BUFFER_TRACE(bh, "get_write_access"); - err = ext4_journal_get_write_access(handle, bh); -- if (err) -+ if (err) { -+ brelse(bh); - return err; -+ } - ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n", block, - block - start, count2); - ext4_set_bits(bh->b_data, block - start, count2); - - err = ext4_handle_dirty_metadata(handle, NULL, bh); -+ brelse(bh); - if (unlikely(err)) - return err; -- brelse(bh); - } - - return 0; -@@ -588,7 +590,6 @@ handle_bb: - bh = bclean(handle, sb, block); - if (IS_ERR(bh)) { - err = PTR_ERR(bh); -- bh = NULL; - goto out; - } - overhead = ext4_group_overhead_blocks(sb, group); -@@ -600,9 +601,9 @@ handle_bb: - ext4_mark_bitmap_end(group_data[i].blocks_count, - sb->s_blocksize * 8, bh->b_data); - err = ext4_handle_dirty_metadata(handle, NULL, bh); -+ brelse(bh); - if (err) - goto out; -- brelse(bh); - - handle_ib: - if (bg_flags[i] & EXT4_BG_INODE_UNINIT) -@@ -617,18 +618,16 @@ handle_ib: - bh = bclean(handle, sb, block); - if (IS_ERR(bh)) { - err = PTR_ERR(bh); -- bh = NULL; - goto out; - } - - ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), - sb->s_blocksize * 8, bh->b_data); - err = ext4_handle_dirty_metadata(handle, NULL, bh); -+ brelse(bh); - if (err) - goto out; -- brelse(bh); - } -- bh = NULL; - - /* Mark group tables in block bitmap */ - for (j = 0; j < GROUP_TABLE_COUNT; j++) { -@@ -659,7 +658,6 @@ handle_ib: - } - - out: -- brelse(bh); - err2 = ext4_journal_stop(handle); - if (err2 && !err) - err = err2; -@@ -846,6 +844,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode, - err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh); - if (unlikely(err)) { - ext4_std_error(sb, err); -+ iloc.bh = NULL; - goto exit_inode; - } - brelse(dind); -@@ -897,6 +896,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb, - sizeof(struct buffer_head *), - GFP_NOFS); - if (!n_group_desc) { -+ brelse(gdb_bh); - err = -ENOMEM; - ext4_warning(sb, "not enough memory for %lu groups", - gdb_num + 1); -@@ -912,8 +912,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb, - kvfree(o_group_desc); - BUFFER_TRACE(gdb_bh, "get_write_access"); - err = ext4_journal_get_write_access(handle, gdb_bh); -- if (unlikely(err)) -- brelse(gdb_bh); - return err; - } - -@@ -1095,8 +1093,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data, - backup_block, backup_block - - ext4_group_first_block_no(sb, group)); - BUFFER_TRACE(bh, "get_write_access"); -- if ((err = ext4_journal_get_write_access(handle, bh))) -+ if ((err = ext4_journal_get_write_access(handle, bh))) { -+ brelse(bh); - break; -+ } - lock_buffer(bh); - memcpy(bh->b_data, data, size); - if (rest) -@@ -1991,7 +1991,7 @@ retry: - - err = ext4_alloc_flex_bg_array(sb, n_group + 1); - if (err) -- return err; -+ goto out; - - err = ext4_mb_alloc_groupinfo(sb, n_group + 1); - if (err) -@@ -2027,6 +2027,10 @@ retry: - n_blocks_count_retry = 0; - free_flex_gd(flex_gd); - flex_gd = NULL; -+ if (resize_inode) { -+ iput(resize_inode); -+ resize_inode = NULL; -+ } - goto retry; - } - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index a3d905abbaa9..cd9cd581fd92 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3731,6 +3731,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - sbi->s_groups_count = blocks_count; - sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count, - (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); -+ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != -+ le32_to_cpu(es->s_inodes_count)) { -+ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", -+ le32_to_cpu(es->s_inodes_count), -+ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); -+ ret = -EINVAL; -+ goto failed_mount; -+ } - db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / - EXT4_DESC_PER_BLOCK(sb); - if (ext4_has_feature_meta_bg(sb)) { -@@ -3750,14 +3758,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - ret = -ENOMEM; - goto failed_mount; - } -- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != -- le32_to_cpu(es->s_inodes_count)) { -- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", -- le32_to_cpu(es->s_inodes_count), -- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); -- ret = -EINVAL; -- goto failed_mount; -- } - - bgl_lock_init(sbi->s_blockgroup_lock); - -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index d6bae37489af..53679716baca 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1044,22 +1044,8 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, - if (EXT4_I(inode)->i_extra_isize == 0) - return -ENOSPC; - error = ext4_xattr_set_entry(i, s, inode); -- if (error) { -- if (error == -ENOSPC && -- ext4_has_inline_data(inode)) { -- error = ext4_try_to_evict_inline_data(handle, inode, -- EXT4_XATTR_LEN(strlen(i->name) + -- EXT4_XATTR_SIZE(i->value_len))); -- if (error) -- return error; -- error = ext4_xattr_ibody_find(inode, i, is); -- if (error) -- return error; -- error = ext4_xattr_set_entry(i, s, inode); -- } -- if (error) -- return error; -- } -+ if (error) -+ return error; - header = IHDR(inode, ext4_raw_inode(&is->iloc)); - if (!IS_LAST_ENTRY(s->first)) { - header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC); -@@ -1175,6 +1161,8 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, - error = ext4_xattr_block_set(handle, inode, &i, &bs); - } else if (error == -ENOSPC) { - if (EXT4_I(inode)->i_file_acl && !bs.s.base) { -+ brelse(bs.bh); -+ bs.bh = NULL; - error = ext4_xattr_block_find(inode, &i, &bs); - if (error) - goto cleanup; -@@ -1502,6 +1490,8 @@ cleanup: - kfree(buffer); - if (is) - brelse(is->iloc.bh); -+ if (bs) -+ brelse(bs->bh); - kfree(is); - kfree(bs); - brelse(bh); -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 2671e922c720..e566652ac922 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -402,12 +402,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) - if (test_bit(FR_BACKGROUND, &req->flags)) { - spin_lock(&fc->lock); - clear_bit(FR_BACKGROUND, &req->flags); -- if (fc->num_background == fc->max_background) -+ if (fc->num_background == fc->max_background) { - fc->blocked = 0; -- -- /* Wake up next waiter, if any */ -- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) - wake_up(&fc->blocked_waitq); -+ } else if (!fc->blocked) { -+ /* -+ * Wake up next waiter, if any. It's okay to use -+ * waitqueue_active(), as we've already synced up -+ * fc->blocked with waiters with the wake_up() call -+ * above. -+ */ -+ if (waitqueue_active(&fc->blocked_waitq)) -+ wake_up(&fc->blocked_waitq); -+ } - - if (fc->num_background == fc->congestion_threshold && - fc->connected && fc->bdi_initialized) { -@@ -1328,12 +1335,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, - goto out_end; - } - list_move_tail(&req->list, &fpq->processing); -- spin_unlock(&fpq->lock); -+ __fuse_get_request(req); - set_bit(FR_SENT, &req->flags); -+ spin_unlock(&fpq->lock); - /* matches barrier in request_wait_answer() */ - smp_mb__after_atomic(); - if (test_bit(FR_INTERRUPTED, &req->flags)) - queue_interrupt(fiq, req); -+ fuse_put_request(fc, req); - - return reqsize; - -@@ -1762,8 +1771,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, - req->in.args[1].size = total_len; - - err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); -- if (err) -+ if (err) { - fuse_retrieve_end(fc, req); -+ fuse_put_request(fc, req); -+ } - - return err; - } -@@ -1922,16 +1933,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, - - /* Is it an interrupt reply? */ - if (req->intr_unique == oh.unique) { -+ __fuse_get_request(req); - spin_unlock(&fpq->lock); - - err = -EINVAL; -- if (nbytes != sizeof(struct fuse_out_header)) -+ if (nbytes != sizeof(struct fuse_out_header)) { -+ fuse_put_request(fc, req); - goto err_finish; -+ } - - if (oh.error == -ENOSYS) - fc->no_interrupt = 1; - else if (oh.error == -EAGAIN) - queue_interrupt(&fc->iq, req); -+ fuse_put_request(fc, req); - - fuse_copy_finish(cs); - return nbytes; -diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c -index baab99b69d8a..d9178388cf48 100644 ---- a/fs/gfs2/ops_fstype.c -+++ b/fs/gfs2/ops_fstype.c -@@ -1353,6 +1353,9 @@ static struct dentry *gfs2_mount_meta(struct file_system_type *fs_type, - struct path path; - int error; - -+ if (!dev_name || !*dev_name) -+ return ERR_PTR(-EINVAL); -+ - error = kern_path(dev_name, LOOKUP_FOLLOW, &path); - if (error) { - pr_warn("path_lookup on %s returned error %d\n", -diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c -index 684996c8a3a4..4d5a5a4cc017 100644 ---- a/fs/jbd2/checkpoint.c -+++ b/fs/jbd2/checkpoint.c -@@ -254,8 +254,8 @@ restart: - bh = jh2bh(jh); - - if (buffer_locked(bh)) { -- spin_unlock(&journal->j_list_lock); - get_bh(bh); -+ spin_unlock(&journal->j_list_lock); - wait_on_buffer(bh); - /* the journal_head may have gone by now */ - BUFFER_TRACE(bh, "brelse"); -@@ -336,8 +336,8 @@ restart2: - jh = transaction->t_checkpoint_io_list; - bh = jh2bh(jh); - if (buffer_locked(bh)) { -- spin_unlock(&journal->j_list_lock); - get_bh(bh); -+ spin_unlock(&journal->j_list_lock); - wait_on_buffer(bh); - /* the journal_head may have gone by now */ - BUFFER_TRACE(bh, "brelse"); -diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c -index 600da1a4df29..1544f530ccd0 100644 ---- a/fs/jffs2/super.c -+++ b/fs/jffs2/super.c -@@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) - sb->s_fs_info = c; - - ret = jffs2_parse_options(c, data); -- if (ret) { -- kfree(c); -+ if (ret) - return -EINVAL; -- } - - /* Initialize JFFS2 superblock locks, the further initialization will - * be done later */ -diff --git a/fs/lockd/host.c b/fs/lockd/host.c -index d716c9993a26..c7eb47f2fb6c 100644 ---- a/fs/lockd/host.c -+++ b/fs/lockd/host.c -@@ -340,7 +340,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp, - }; - struct lockd_net *ln = net_generic(net, lockd_net_id); - -- dprintk("lockd: %s(host='%*s', vers=%u, proto=%s)\n", __func__, -+ dprintk("lockd: %s(host='%.*s', vers=%u, proto=%s)\n", __func__, - (int)hostname_len, hostname, rqstp->rq_vers, - (rqstp->rq_prot == IPPROTO_UDP ? "udp" : "tcp")); - -diff --git a/fs/namespace.c b/fs/namespace.c -index b56b50e3da11..88c5d5bddf74 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1584,8 +1584,13 @@ static int do_umount(struct mount *mnt, int flags) - - namespace_lock(); - lock_mount_hash(); -- event++; - -+ /* Recheck MNT_LOCKED with the locks held */ -+ retval = -EINVAL; -+ if (mnt->mnt.mnt_flags & MNT_LOCKED) -+ goto out; -+ -+ event++; - if (flags & MNT_DETACH) { - if (!list_empty(&mnt->mnt_list)) - umount_tree(mnt, UMOUNT_PROPAGATE); -@@ -1599,6 +1604,7 @@ static int do_umount(struct mount *mnt, int flags) - retval = 0; - } - } -+out: - unlock_mount_hash(); - namespace_unlock(); - return retval; -@@ -1681,7 +1687,7 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags) - goto dput_and_out; - if (!check_mnt(mnt)) - goto dput_and_out; -- if (mnt->mnt.mnt_flags & MNT_LOCKED) -+ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ - goto dput_and_out; - retval = -EPERM; - if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) -@@ -1759,8 +1765,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, - for (s = r; s; s = next_mnt(s, r)) { - if (!(flag & CL_COPY_UNBINDABLE) && - IS_MNT_UNBINDABLE(s)) { -- s = skip_mnt_tree(s); -- continue; -+ if (s->mnt.mnt_flags & MNT_LOCKED) { -+ /* Both unbindable and locked. */ -+ q = ERR_PTR(-EPERM); -+ goto out; -+ } else { -+ s = skip_mnt_tree(s); -+ continue; -+ } - } - if (!(flag & CL_COPY_MNT_NS_FILE) && - is_mnt_ns_file(s->mnt.mnt_root)) { -@@ -1813,7 +1825,7 @@ void drop_collected_mounts(struct vfsmount *mnt) - { - namespace_lock(); - lock_mount_hash(); -- umount_tree(real_mount(mnt), UMOUNT_SYNC); -+ umount_tree(real_mount(mnt), 0); - unlock_mount_hash(); - namespace_unlock(); - } -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index 63498e1a542a..ae91d1e450be 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -879,10 +879,10 @@ EXPORT_SYMBOL_GPL(nfs4_set_ds_client); - - /* - * Session has been established, and the client marked ready. -- * Set the mount rsize and wsize with negotiated fore channel -- * attributes which will be bound checked in nfs_server_set_fsinfo. -+ * Limit the mount rsize, wsize and dtsize using negotiated fore -+ * channel attributes. - */ --static void nfs4_session_set_rwsize(struct nfs_server *server) -+static void nfs4_session_limit_rwsize(struct nfs_server *server) - { - #ifdef CONFIG_NFS_V4_1 - struct nfs4_session *sess; -@@ -895,9 +895,11 @@ static void nfs4_session_set_rwsize(struct nfs_server *server) - server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead; - server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead; - -- if (!server->rsize || server->rsize > server_resp_sz) -+ if (server->dtsize > server_resp_sz) -+ server->dtsize = server_resp_sz; -+ if (server->rsize > server_resp_sz) - server->rsize = server_resp_sz; -- if (!server->wsize || server->wsize > server_rqst_sz) -+ if (server->wsize > server_rqst_sz) - server->wsize = server_rqst_sz; - #endif /* CONFIG_NFS_V4_1 */ - } -@@ -944,12 +946,12 @@ static int nfs4_server_common_setup(struct nfs_server *server, - (unsigned long long) server->fsid.minor); - nfs_display_fhandle(mntfh, "Pseudo-fs root FH"); - -- nfs4_session_set_rwsize(server); -- - error = nfs_probe_fsinfo(server, mntfh, fattr); - if (error < 0) - goto out; - -+ nfs4_session_limit_rwsize(server); -+ - if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN) - server->namelen = NFS4_MAXNAMLEN; - -diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c -index ffecf89c8c1c..49af618e410d 100644 ---- a/fs/ocfs2/dir.c -+++ b/fs/ocfs2/dir.c -@@ -1896,8 +1896,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, - /* On error, skip the f_pos to the - next block. */ - ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; -- brelse(bh); -- continue; -+ break; - } - if (le64_to_cpu(de->inode)) { - unsigned char d_type = DT_UNKNOWN; -diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h -index 3e3799cdc6e6..9b9fe0588008 100644 ---- a/include/linux/ceph/libceph.h -+++ b/include/linux/ceph/libceph.h -@@ -72,7 +72,13 @@ struct ceph_options { - - #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024) - #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) --#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) -+ -+/* -+ * Handle the largest possible rbd object in one message. -+ * There is no limit on the size of cephfs objects, but it has to obey -+ * rsize and wsize mount options anyway. -+ */ -+#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024) - - #define CEPH_AUTH_NAME_DEFAULT "guest" - -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index 685c262e0be8..3957d99e66ea 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -110,6 +110,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, - unsigned long addr, unsigned long sz); - pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr); - int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); -+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, -+ unsigned long *start, unsigned long *end); - struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, - int write); - struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address, -@@ -132,6 +134,18 @@ static inline unsigned long hugetlb_total_pages(void) - return 0; - } - -+static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, -+ pte_t *ptep) -+{ -+ return 0; -+} -+ -+static inline void adjust_range_if_pmd_sharing_possible( -+ struct vm_area_struct *vma, -+ unsigned long *start, unsigned long *end) -+{ -+} -+ - #define follow_hugetlb_page(m,v,p,vs,a,b,i,w) ({ BUG(); 0; }) - #define follow_huge_addr(mm, addr, write) ERR_PTR(-EINVAL) - #define copy_hugetlb_page_range(src, dst, vma) ({ BUG(); 0; }) -diff --git a/include/linux/i8253.h b/include/linux/i8253.h -index e6bb36a97519..8336b2f6f834 100644 ---- a/include/linux/i8253.h -+++ b/include/linux/i8253.h -@@ -21,6 +21,7 @@ - #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ) - - extern raw_spinlock_t i8253_lock; -+extern bool i8253_clear_counter_on_shutdown; - extern struct clock_event_device i8253_clockevent; - extern void clockevent_i8253_init(bool oneshot); - -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 1f4366567e7d..d4e8077fca96 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -2058,6 +2058,12 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, - return vma; - } - -+static inline bool range_in_vma(struct vm_area_struct *vma, -+ unsigned long start, unsigned long end) -+{ -+ return (vma && vma->vm_start <= start && end <= vma->vm_end); -+} -+ - #ifdef CONFIG_MMU - pgprot_t vm_get_page_prot(unsigned long vm_flags); - void vma_set_page_prot(struct vm_area_struct *vma); -diff --git a/include/linux/tc.h b/include/linux/tc.h -index f92511e57cdb..a60639f37963 100644 ---- a/include/linux/tc.h -+++ b/include/linux/tc.h -@@ -84,6 +84,7 @@ struct tc_dev { - device. */ - struct device dev; /* Generic device interface. */ - struct resource resource; /* Address space of this device. */ -+ u64 dma_mask; /* DMA addressable range. */ - char vendor[9]; - char name[9]; - char firmware[9]; -diff --git a/kernel/bounds.c b/kernel/bounds.c -index e1d1d1952bfa..c37f68d758db 100644 ---- a/kernel/bounds.c -+++ b/kernel/bounds.c -@@ -12,7 +12,7 @@ - #include - #include - --void foo(void) -+int main(void) - { - /* The enum constants to put into include/generated/bounds.h */ - DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS); -@@ -22,4 +22,6 @@ void foo(void) - #endif - DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t)); - /* End of constants */ -+ -+ return 0; - } -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 0df2b44dac7c..83cea913983c 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -864,6 +864,9 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action) - - local_bh_disable(); - ret = action->thread_fn(action->irq, action->dev_id); -+ if (ret == IRQ_HANDLED) -+ atomic_inc(&desc->threads_handled); -+ - irq_finalize_oneshot(desc, action); - local_bh_enable(); - return ret; -@@ -880,6 +883,9 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc, - irqreturn_t ret; - - ret = action->thread_fn(action->irq, action->dev_id); -+ if (ret == IRQ_HANDLED) -+ atomic_inc(&desc->threads_handled); -+ - irq_finalize_oneshot(desc, action); - return ret; - } -@@ -957,8 +963,6 @@ static int irq_thread(void *data) - irq_thread_check_affinity(desc, action); - - action_ret = handler_fn(desc, action); -- if (action_ret == IRQ_HANDLED) -- atomic_inc(&desc->threads_handled); - if (action_ret == IRQ_WAKE_THREAD) - irq_wake_secondary(desc, action); - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 388bcace62f8..d8daf6c55d2b 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -665,9 +665,10 @@ static void unoptimize_kprobe(struct kprobe *p, bool force) - } - - /* Cancel unoptimizing for reusing */ --static void reuse_unused_kprobe(struct kprobe *ap) -+static int reuse_unused_kprobe(struct kprobe *ap) - { - struct optimized_kprobe *op; -+ int ret; - - BUG_ON(!kprobe_unused(ap)); - /* -@@ -681,8 +682,12 @@ static void reuse_unused_kprobe(struct kprobe *ap) - /* Enable the probe again */ - ap->flags &= ~KPROBE_FLAG_DISABLED; - /* Optimize it again (remove from op->list) */ -- BUG_ON(!kprobe_optready(ap)); -+ ret = kprobe_optready(ap); -+ if (ret) -+ return ret; -+ - optimize_kprobe(ap); -+ return 0; - } - - /* Remove optimized instructions */ -@@ -894,11 +899,16 @@ static void __disarm_kprobe(struct kprobe *p, bool reopt) - #define kprobe_disarmed(p) kprobe_disabled(p) - #define wait_for_kprobe_optimizer() do {} while (0) - --/* There should be no unused kprobes can be reused without optimization */ --static void reuse_unused_kprobe(struct kprobe *ap) -+static int reuse_unused_kprobe(struct kprobe *ap) - { -+ /* -+ * If the optimized kprobe is NOT supported, the aggr kprobe is -+ * released at the same time that the last aggregated kprobe is -+ * unregistered. -+ * Thus there should be no chance to reuse unused kprobe. -+ */ - printk(KERN_ERR "Error: There should be no unused kprobe here.\n"); -- BUG_ON(kprobe_unused(ap)); -+ return -EINVAL; - } - - static void free_aggr_kprobe(struct kprobe *p) -@@ -1276,9 +1286,12 @@ static int register_aggr_kprobe(struct kprobe *orig_p, struct kprobe *p) - goto out; - } - init_aggr_kprobe(ap, orig_p); -- } else if (kprobe_unused(ap)) -+ } else if (kprobe_unused(ap)) { - /* This probe is going to die. Rescue it */ -- reuse_unused_kprobe(ap); -+ ret = reuse_unused_kprobe(ap); -+ if (ret) -+ goto out; -+ } - - if (kprobe_gone(ap)) { - /* -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 6e171b547a80..774ab79d3ec7 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3826,7 +3826,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip) - { - unsigned long flags; - -- if (unlikely(!lock_stat)) -+ if (unlikely(!lock_stat || !debug_locks)) - return; - - if (unlikely(current->lockdep_recursion)) -@@ -3846,7 +3846,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip) - { - unsigned long flags; - -- if (unlikely(!lock_stat)) -+ if (unlikely(!lock_stat || !debug_locks)) - return; - - if (unlikely(current->lockdep_recursion)) -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 0b5613554769..dd689ab22806 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -881,7 +881,12 @@ static void __init log_buf_len_update(unsigned size) - /* save requested log_buf_len since it's too early to process it */ - static int __init log_buf_len_setup(char *str) - { -- unsigned size = memparse(str, &str); -+ unsigned int size; -+ -+ if (!str) -+ return -EINVAL; -+ -+ size = memparse(str, &str); - - log_buf_len_update(size); - -diff --git a/kernel/signal.c b/kernel/signal.c -index 8bfbc47f0a23..5b1313309356 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -991,7 +991,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t, - - result = TRACE_SIGNAL_IGNORED; - if (!prepare_signal(sig, t, -- from_ancestor_ns || (info == SEND_SIG_FORCED))) -+ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED))) - goto ret; - - pending = group ? &t->signal->shared_pending : &t->pending; -diff --git a/lib/debug_locks.c b/lib/debug_locks.c -index 96c4c633d95e..124fdf238b3d 100644 ---- a/lib/debug_locks.c -+++ b/lib/debug_locks.c -@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent); - */ - int debug_locks_off(void) - { -- if (__debug_locks_off()) { -+ if (debug_locks && __debug_locks_off()) { - if (!debug_locks_silent) { - console_verbose(); - return 1; -diff --git a/mm/gup.c b/mm/gup.c -index b599526db9f7..018144c4b9ec 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -940,8 +940,6 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) - int locked = 0; - long ret = 0; - -- VM_BUG_ON(start & ~PAGE_MASK); -- VM_BUG_ON(len != PAGE_ALIGN(len)); - end = start + len; - - for (nstart = start; nstart < end; nstart = nend) { -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index a813b03021b7..6f99a0f906bb 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3103,7 +3103,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte) - int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, - struct vm_area_struct *vma) - { -- pte_t *src_pte, *dst_pte, entry; -+ pte_t *src_pte, *dst_pte, entry, dst_entry; - struct page *ptepage; - unsigned long addr; - int cow; -@@ -3131,15 +3131,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, - break; - } - -- /* If the pagetables are shared don't copy or take references */ -- if (dst_pte == src_pte) -+ /* -+ * If the pagetables are shared don't copy or take references. -+ * dst_pte == src_pte is the common case of src/dest sharing. -+ * -+ * However, src could have 'unshared' and dst shares with -+ * another vma. If dst_pte !none, this implies sharing. -+ * Check here before taking page table lock, and once again -+ * after taking the lock below. -+ */ -+ dst_entry = huge_ptep_get(dst_pte); -+ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) - continue; - - dst_ptl = huge_pte_lock(h, dst, dst_pte); - src_ptl = huge_pte_lockptr(h, src, src_pte); - spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); - entry = huge_ptep_get(src_pte); -- if (huge_pte_none(entry)) { /* skip none entry */ -+ dst_entry = huge_ptep_get(dst_pte); -+ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) { -+ /* -+ * Skip if src entry none. Also, skip in the -+ * unlikely case dst entry !none as this implies -+ * sharing with another vma. -+ */ - ; - } else if (unlikely(is_hugetlb_entry_migration(entry) || - is_hugetlb_entry_hwpoisoned(entry))) { -@@ -3537,6 +3552,12 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping, - return err; - ClearPagePrivate(page); - -+ /* -+ * set page dirty so that it will not be removed from cache/file -+ * by non-hugetlbfs specific code paths. -+ */ -+ set_page_dirty(page); -+ - spin_lock(&inode->i_lock); - inode->i_blocks += blocks_per_huge_page(h); - spin_unlock(&inode->i_lock); -@@ -4195,12 +4216,40 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) - /* - * check on proper vm_flags and page table alignment - */ -- if (vma->vm_flags & VM_MAYSHARE && -- vma->vm_start <= base && end <= vma->vm_end) -+ if (vma->vm_flags & VM_MAYSHARE && range_in_vma(vma, base, end)) - return true; - return false; - } - -+/* -+ * Determine if start,end range within vma could be mapped by shared pmd. -+ * If yes, adjust start and end to cover range associated with possible -+ * shared pmd mappings. -+ */ -+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, -+ unsigned long *start, unsigned long *end) -+{ -+ unsigned long check_addr = *start; -+ -+ if (!(vma->vm_flags & VM_MAYSHARE)) -+ return; -+ -+ for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) { -+ unsigned long a_start = check_addr & PUD_MASK; -+ unsigned long a_end = a_start + PUD_SIZE; -+ -+ /* -+ * If sharing is possible, adjust start/end if necessary. -+ */ -+ if (range_in_vma(vma, a_start, a_end)) { -+ if (a_start < *start) -+ *start = a_start; -+ if (a_end > *end) -+ *end = a_end; -+ } -+ } -+} -+ - /* - * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc() - * and returns the corresponding pte. While this is not necessary for the -@@ -4297,6 +4346,11 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) - { - return 0; - } -+ -+void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, -+ unsigned long *start, unsigned long *end) -+{ -+} - #define want_pmd_share() (0) - #endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */ - -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index b777590c3e13..be9840bf11d1 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -2010,8 +2010,36 @@ retry_cpuset: - nmask = policy_nodemask(gfp, pol); - if (!nmask || node_isset(hpage_node, *nmask)) { - mpol_cond_put(pol); -- page = __alloc_pages_node(hpage_node, -- gfp | __GFP_THISNODE, order); -+ /* -+ * We cannot invoke reclaim if __GFP_THISNODE -+ * is set. Invoking reclaim with -+ * __GFP_THISNODE set, would cause THP -+ * allocations to trigger heavy swapping -+ * despite there may be tons of free memory -+ * (including potentially plenty of THP -+ * already available in the buddy) on all the -+ * other NUMA nodes. -+ * -+ * At most we could invoke compaction when -+ * __GFP_THISNODE is set (but we would need to -+ * refrain from invoking reclaim even if -+ * compaction returned COMPACT_SKIPPED because -+ * there wasn't not enough memory to succeed -+ * compaction). For now just avoid -+ * __GFP_THISNODE instead of limiting the -+ * allocation path to a strict and single -+ * compaction invocation. -+ * -+ * Supposedly if direct reclaim was enabled by -+ * the caller, the app prefers THP regardless -+ * of the node it comes from so this would be -+ * more desiderable behavior than only -+ * providing THP originated from the local -+ * node in such case. -+ */ -+ if (!(gfp & __GFP_DIRECT_RECLAIM)) -+ gfp |= __GFP_THISNODE; -+ page = __alloc_pages_node(hpage_node, gfp, order); - goto out; - } - } -diff --git a/mm/mmap.c b/mm/mmap.c -index 39f5fbd07486..3074dbcd9621 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2817,10 +2817,6 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) - pgoff_t pgoff = addr >> PAGE_SHIFT; - int error; - -- len = PAGE_ALIGN(len); -- if (!len) -- return addr; -- - flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; - - error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED); -@@ -2888,12 +2884,19 @@ out: - return addr; - } - --unsigned long vm_brk(unsigned long addr, unsigned long len) -+unsigned long vm_brk(unsigned long addr, unsigned long request) - { - struct mm_struct *mm = current->mm; -+ unsigned long len; - unsigned long ret; - bool populate; - -+ len = PAGE_ALIGN(request); -+ if (len < request) -+ return -ENOMEM; -+ if (!len) -+ return addr; -+ - down_write(&mm->mmap_sem); - ret = do_brk(addr, len); - populate = ((mm->def_flags & VM_LOCKED) != 0); -diff --git a/mm/rmap.c b/mm/rmap.c -index 1bceb49aa214..488dda209431 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -1324,12 +1324,41 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma, - pte_t pteval; - spinlock_t *ptl; - int ret = SWAP_AGAIN; -+ unsigned long sh_address; -+ bool pmd_sharing_possible = false; -+ unsigned long spmd_start, spmd_end; - enum ttu_flags flags = (enum ttu_flags)arg; - - /* munlock has nothing to gain from examining un-locked vmas */ - if ((flags & TTU_MUNLOCK) && !(vma->vm_flags & VM_LOCKED)) - goto out; - -+ /* -+ * Only use the range_start/end mmu notifiers if huge pmd sharing -+ * is possible. In the normal case, mmu_notifier_invalidate_page -+ * is sufficient as we only unmap a page. However, if we unshare -+ * a pmd, we will unmap a PUD_SIZE range. -+ */ -+ if (PageHuge(page)) { -+ spmd_start = address; -+ spmd_end = spmd_start + vma_mmu_pagesize(vma); -+ -+ /* -+ * Check if pmd sharing is possible. If possible, we could -+ * unmap a PUD_SIZE range. spmd_start/spmd_end will be -+ * modified if sharing is possible. -+ */ -+ adjust_range_if_pmd_sharing_possible(vma, &spmd_start, -+ &spmd_end); -+ if (spmd_end - spmd_start != vma_mmu_pagesize(vma)) { -+ sh_address = address; -+ -+ pmd_sharing_possible = true; -+ mmu_notifier_invalidate_range_start(vma->vm_mm, -+ spmd_start, spmd_end); -+ } -+ } -+ - pte = page_check_address(page, mm, address, &ptl, 0); - if (!pte) - goto out; -@@ -1356,6 +1385,30 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma, - } - } - -+ /* -+ * Call huge_pmd_unshare to potentially unshare a huge pmd. Pass -+ * sh_address as it will be modified if unsharing is successful. -+ */ -+ if (PageHuge(page) && huge_pmd_unshare(mm, &sh_address, pte)) { -+ /* -+ * huge_pmd_unshare unmapped an entire PMD page. There is -+ * no way of knowing exactly which PMDs may be cached for -+ * this mm, so flush them all. spmd_start/spmd_end cover -+ * this PUD_SIZE range. -+ */ -+ flush_cache_range(vma, spmd_start, spmd_end); -+ flush_tlb_range(vma, spmd_start, spmd_end); -+ -+ /* -+ * The ref count of the PMD page was dropped which is part -+ * of the way map counting is done for shared PMDs. When -+ * there is no other sharing, huge_pmd_unshare returns false -+ * and we will unmap the actual page and drop map count -+ * to zero. -+ */ -+ goto out_unmap; -+ } -+ - /* Nuke the page table entry. */ - flush_cache_page(vma, address, page_to_pfn(page)); - if (should_defer_flush(mm, flags)) { -@@ -1450,6 +1503,9 @@ out_unmap: - if (ret != SWAP_FAIL && ret != SWAP_MLOCK && !(flags & TTU_MUNLOCK)) - mmu_notifier_invalidate_page(mm, address); - out: -+ if (pmd_sharing_possible) -+ mmu_notifier_invalidate_range_end(vma->vm_mm, -+ spmd_start, spmd_end); - return ret; - } - -diff --git a/net/9p/protocol.c b/net/9p/protocol.c -index 16d287565987..145f80518064 100644 ---- a/net/9p/protocol.c -+++ b/net/9p/protocol.c -@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...); - void p9stat_free(struct p9_wstat *stbuf) - { - kfree(stbuf->name); -+ stbuf->name = NULL; - kfree(stbuf->uid); -+ stbuf->uid = NULL; - kfree(stbuf->gid); -+ stbuf->gid = NULL; - kfree(stbuf->muid); -+ stbuf->muid = NULL; - kfree(stbuf->extension); -+ stbuf->extension = NULL; - } - EXPORT_SYMBOL(p9stat_free); - -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index 5169b9b36b6a..cfaacaa023e6 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -1582,7 +1582,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def, - * - * Description: - * Parse the packet's IP header looking for a CIPSO option. Returns a pointer -- * to the start of the CIPSO option on success, NULL if one if not found. -+ * to the start of the CIPSO option on success, NULL if one is not found. - * - */ - unsigned char *cipso_v4_optptr(const struct sk_buff *skb) -@@ -1592,10 +1592,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) - int optlen; - int taglen; - -- for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { -+ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) { - switch (optptr[0]) { -- case IPOPT_CIPSO: -- return optptr; - case IPOPT_END: - return NULL; - case IPOPT_NOOP: -@@ -1604,6 +1602,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) - default: - taglen = optptr[1]; - } -+ if (!taglen || taglen > optlen) -+ return NULL; -+ if (optptr[0] == IPOPT_CIPSO) -+ return optptr; -+ - optlen -= taglen; - optptr += taglen; - } -diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c -index a6cbb2104667..71f15da72f02 100644 ---- a/net/sunrpc/svc_xprt.c -+++ b/net/sunrpc/svc_xprt.c -@@ -945,7 +945,7 @@ static void call_xpt_users(struct svc_xprt *xprt) - spin_lock(&xprt->xpt_lock); - while (!list_empty(&xprt->xpt_users)) { - u = list_first_entry(&xprt->xpt_users, struct svc_xpt_user, list); -- list_del(&u->list); -+ list_del_init(&u->list); - u->callback(u); - } - spin_unlock(&xprt->xpt_lock); -diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c -index 4439ac4c1b53..9b8d855e4a87 100644 ---- a/net/sunrpc/xdr.c -+++ b/net/sunrpc/xdr.c -@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len) - WARN_ON_ONCE(xdr->iov); - return; - } -- if (fraglen) { -+ if (fraglen) - xdr->end = head->iov_base + head->iov_len; -- xdr->page_ptr--; -- } - /* (otherwise assume xdr->end is already set) */ -+ xdr->page_ptr--; - head->iov_len = len; - buf->len = len; - xdr->p = head->iov_base + head->iov_len; -diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c -index 816d175da79a..30aced99bc55 100644 ---- a/security/integrity/ima/ima_fs.c -+++ b/security/integrity/ima/ima_fs.c -@@ -26,14 +26,14 @@ - #include "ima.h" - - static int valid_policy = 1; --#define TMPBUFLEN 12 -+ - static ssize_t ima_show_htable_value(char __user *buf, size_t count, - loff_t *ppos, atomic_long_t *val) - { -- char tmpbuf[TMPBUFLEN]; -+ char tmpbuf[32]; /* greater than largest 'long' string value */ - ssize_t len; - -- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val)); -+ len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val)); - return simple_read_from_buffer(buf, count, ppos, tmpbuf, len); - } - -diff --git a/sound/pci/ca0106/ca0106.h b/sound/pci/ca0106/ca0106.h -index 04402c14cb23..9847b669cf3c 100644 ---- a/sound/pci/ca0106/ca0106.h -+++ b/sound/pci/ca0106/ca0106.h -@@ -582,7 +582,7 @@ - #define SPI_PL_BIT_R_R (2<<7) /* right channel = right */ - #define SPI_PL_BIT_R_C (3<<7) /* right channel = (L+R)/2 */ - #define SPI_IZD_REG 2 --#define SPI_IZD_BIT (1<<4) /* infinite zero detect */ -+#define SPI_IZD_BIT (0<<4) /* infinite zero detect */ - - #define SPI_FMT_REG 3 - #define SPI_FMT_BIT_RJ (0<<0) /* right justified mode */ -diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h -index b17539537b2e..55ec4470f6b6 100644 ---- a/sound/pci/hda/hda_controller.h -+++ b/sound/pci/hda/hda_controller.h -@@ -151,6 +151,7 @@ struct azx { - unsigned int msi:1; - unsigned int probing:1; /* codec probing phase */ - unsigned int snoop:1; -+ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */ - unsigned int align_buffer_size:1; - unsigned int region_requested:1; - unsigned int disabled:1; /* disabled by vga_switcheroo */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 95a82e428f37..ecb07fb036af 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -401,7 +401,7 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool - #ifdef CONFIG_SND_DMA_SGBUF - if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) { - struct snd_sg_buf *sgbuf = dmab->private_data; -- if (chip->driver_type == AZX_DRIVER_CMEDIA) -+ if (!chip->uc_buffer) - return; /* deal with only CORB/RIRB buffers */ - if (on) - set_pages_array_wc(sgbuf->page_table, sgbuf->pages); -@@ -1538,6 +1538,7 @@ static void azx_check_snoop_available(struct azx *chip) - dev_info(chip->card->dev, "Force to %s mode by module option\n", - snoop ? "snoop" : "non-snoop"); - chip->snoop = snoop; -+ chip->uc_buffer = !snoop; - return; - } - -@@ -1558,8 +1559,12 @@ static void azx_check_snoop_available(struct azx *chip) - snoop = false; - - chip->snoop = snoop; -- if (!snoop) -+ if (!snoop) { - dev_info(chip->card->dev, "Force to non-snoop mode\n"); -+ /* C-Media requires non-cached pages only for CORB/RIRB */ -+ if (chip->driver_type != AZX_DRIVER_CMEDIA) -+ chip->uc_buffer = true; -+ } - } - - static void azx_probe_work(struct work_struct *work) -@@ -1958,7 +1963,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream, - #ifdef CONFIG_X86 - struct azx_pcm *apcm = snd_pcm_substream_chip(substream); - struct azx *chip = apcm->chip; -- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA) -+ if (chip->uc_buffer) - area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); - #endif - } -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index a1a3ce8c3f56..aea3cc2abe3a 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -867,6 +867,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410), - SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410), - SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD), -+ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), -diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c -index d995743cb673..58ce62088a39 100644 ---- a/tools/perf/util/trace-event-info.c -+++ b/tools/perf/util/trace-event-info.c -@@ -507,12 +507,14 @@ struct tracing_data *tracing_data_get(struct list_head *pattrs, - "/tmp/perf-XXXXXX"); - if (!mkstemp(tdata->temp_file)) { - pr_debug("Can't make temp file"); -+ free(tdata); - return NULL; - } - - temp_fd = open(tdata->temp_file, O_RDWR); - if (temp_fd < 0) { - pr_debug("Can't read '%s'", tdata->temp_file); -+ free(tdata); - return NULL; - } - -diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c -index b67a0ccf5ab9..23baee7b786a 100644 ---- a/tools/perf/util/trace-event-read.c -+++ b/tools/perf/util/trace-event-read.c -@@ -334,9 +334,12 @@ static int read_event_files(struct pevent *pevent) - for (x=0; x < count; x++) { - size = read8(pevent); - ret = read_event_file(pevent, sys, size); -- if (ret) -+ if (ret) { -+ free(sys); - return ret; -+ } - } -+ free(sys); - } - return 0; - } -diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc -new file mode 100644 -index 000000000000..88e6c3f43006 ---- /dev/null -+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc -@@ -0,0 +1,80 @@ -+#!/bin/sh -+# SPDX-License-Identifier: GPL-2.0 -+# description: event trigger - test synthetic_events syntax parser -+ -+do_reset() { -+ reset_trigger -+ echo > set_event -+ clear_trace -+} -+ -+fail() { #msg -+ do_reset -+ echo $1 -+ exit_fail -+} -+ -+if [ ! -f set_event ]; then -+ echo "event tracing is not supported" -+ exit_unsupported -+fi -+ -+if [ ! -f synthetic_events ]; then -+ echo "synthetic event is not supported" -+ exit_unsupported -+fi -+ -+reset_tracer -+do_reset -+ -+echo "Test synthetic_events syntax parser" -+ -+echo > synthetic_events -+ -+# synthetic event must have a field -+! echo "myevent" >> synthetic_events -+echo "myevent u64 var1" >> synthetic_events -+ -+# synthetic event must be found in synthetic_events -+grep "myevent[[:space:]]u64 var1" synthetic_events -+ -+# it is not possible to add same name event -+! echo "myevent u64 var2" >> synthetic_events -+ -+# Non-append open will cleanup all events and add new one -+echo "myevent u64 var2" > synthetic_events -+ -+# multiple fields with different spaces -+echo "myevent u64 var1; u64 var2;" > synthetic_events -+grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events -+echo "myevent u64 var1 ; u64 var2 ;" > synthetic_events -+grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events -+echo "myevent u64 var1 ;u64 var2" > synthetic_events -+grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events -+ -+# test field types -+echo "myevent u32 var" > synthetic_events -+echo "myevent u16 var" > synthetic_events -+echo "myevent u8 var" > synthetic_events -+echo "myevent s64 var" > synthetic_events -+echo "myevent s32 var" > synthetic_events -+echo "myevent s16 var" > synthetic_events -+echo "myevent s8 var" > synthetic_events -+ -+echo "myevent char var" > synthetic_events -+echo "myevent int var" > synthetic_events -+echo "myevent long var" > synthetic_events -+echo "myevent pid_t var" > synthetic_events -+ -+echo "myevent unsigned char var" > synthetic_events -+echo "myevent unsigned int var" > synthetic_events -+echo "myevent unsigned long var" > synthetic_events -+grep "myevent[[:space:]]unsigned long var" synthetic_events -+ -+# test string type -+echo "myevent char var[10]" > synthetic_events -+grep "myevent[[:space:]]char\[10\] var" synthetic_events -+ -+do_reset -+ -+exit 0 diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.164-165.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.164-165.patch deleted file mode 100644 index 5e47750f0e40..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.164-165.patch +++ /dev/null @@ -1,958 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9382e7e4e750..441a760dc5a4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 164 -+SUBLEVEL = 165 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -612,6 +607,22 @@ endif # $(dot-config) - # Defaults to vmlinux, but the arch makefile usually adds further targets - all: vmlinux - -+ifeq ($(cc-name),clang) -+ifneq ($(CROSS_COMPILE),) -+CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%)) -+GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD))) -+CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR) -+GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) -+endif -+ifneq ($(GCC_TOOLCHAIN),) -+CLANG_GCC_TC := --gcc-toolchain=$(GCC_TOOLCHAIN) -+endif -+KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX) -+KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX) -+KBUILD_CFLAGS += $(call cc-option, -no-integrated-as) -+KBUILD_AFLAGS += $(call cc-option, -no-integrated-as) -+endif -+ - # The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default - # values of the respective KBUILD_* variables - ARCH_CPPFLAGS := -@@ -713,11 +723,11 @@ KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior) - else - - # These warnings generated too much noise in a regular build. --# Use make W=1 to enable them (see scripts/Makefile.build) -+# Use make W=1 to enable them (see scripts/Makefile.extrawarn) - KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) --KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) - endif - -+KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) - ifdef CONFIG_FRAME_POINTER - KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls - else -@@ -1575,6 +1588,8 @@ endif - $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) - %.symtypes: %.c prepare scripts FORCE - $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -+%.ll: %.c prepare scripts FORCE -+ $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) - - # Modules - /: prepare scripts FORCE -diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h -index 8a336852eeba..aea904713d0f 100644 ---- a/arch/arm64/include/asm/percpu.h -+++ b/arch/arm64/include/asm/percpu.h -@@ -84,6 +84,7 @@ static inline unsigned long __percpu_##op(void *ptr, \ - : [val] "Ir" (val)); \ - break; \ - default: \ -+ ret = 0; \ - BUILD_BUG(); \ - } \ - \ -@@ -113,6 +114,7 @@ static inline unsigned long __percpu_read(void *ptr, int size) - ret = ACCESS_ONCE(*(u64 *)ptr); - break; - default: -+ ret = 0; - BUILD_BUG(); - } - -@@ -182,6 +184,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val, - : [val] "r" (val)); - break; - default: -+ ret = 0; - BUILD_BUG(); - } - -diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile -index ee8a18e50a25..29b72c46284d 100644 ---- a/arch/s390/kernel/vdso32/Makefile -+++ b/arch/s390/kernel/vdso32/Makefile -@@ -29,7 +29,7 @@ GCOV_PROFILE := n - $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so - - # link rule for the .so file, .lds has to be first --$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) -+$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE - $(call if_changed,vdso32ld) - - # strip rule for the .so file -@@ -38,12 +38,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE - $(call if_changed,objcopy) - - # assembly rules for the .S files --$(obj-vdso32): %.o: %.S -+$(obj-vdso32): %.o: %.S FORCE - $(call if_changed_dep,vdso32as) - - # actual build commands - quiet_cmd_vdso32ld = VDSO32L $@ -- cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ -+ cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ - quiet_cmd_vdso32as = VDSO32A $@ - cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< - -diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile -index c4b03f9ed228..1b083d80de50 100644 ---- a/arch/s390/kernel/vdso64/Makefile -+++ b/arch/s390/kernel/vdso64/Makefile -@@ -29,7 +29,7 @@ GCOV_PROFILE := n - $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so - - # link rule for the .so file, .lds has to be first --$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) -+$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE - $(call if_changed,vdso64ld) - - # strip rule for the .so file -@@ -38,12 +38,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE - $(call if_changed,objcopy) - - # assembly rules for the .S files --$(obj-vdso64): %.o: %.S -+$(obj-vdso64): %.o: %.S FORCE - $(call if_changed_dep,vdso64as) - - # actual build commands - quiet_cmd_vdso64ld = VDSO64L $@ -- cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ -+ cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ - quiet_cmd_vdso64as = VDSO64A $@ - cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< - -diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c -index 43f32ce60aa3..734f56d774bb 100644 ---- a/arch/s390/numa/numa.c -+++ b/arch/s390/numa/numa.c -@@ -47,6 +47,7 @@ int __node_distance(int a, int b) - { - return mode->distance ? mode->distance(a, b) : 0; - } -+EXPORT_SYMBOL(__node_distance); - - int numa_debug_enabled; - -diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c -index b856c66ebd3a..6dbf27ffafc8 100644 ---- a/arch/um/os-Linux/skas/process.c -+++ b/arch/um/os-Linux/skas/process.c -@@ -585,6 +585,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf) - fatal_sigsegv(); - } - longjmp(*switch_buf, 1); -+ -+ /* unreachable */ -+ printk(UM_KERN_ERR "impossible long jump!"); -+ fatal_sigsegv(); -+ return 0; - } - - void initial_thread_cb_skas(void (*proc)(void *), void *arg) -diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c -index 5365ff6e69c1..ee565b23795b 100644 ---- a/drivers/acpi/acpi_platform.c -+++ b/drivers/acpi/acpi_platform.c -@@ -29,6 +29,7 @@ static const struct acpi_device_id forbidden_id_list[] = { - {"PNP0200", 0}, /* AT DMA Controller */ - {"ACPI0009", 0}, /* IOxAPIC */ - {"ACPI000A", 0}, /* IOAPIC */ -+ {"SMB0001", 0}, /* ACPI SMBUS virtual device */ - {"", 0}, - }; - -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 502406c9e6e1..616ee4f9c233 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -1184,6 +1184,11 @@ static struct attribute_group zram_disk_attr_group = { - .attrs = zram_disk_attrs, - }; - -+static const struct attribute_group *zram_disk_attr_groups[] = { -+ &zram_disk_attr_group, -+ NULL, -+}; -+ - /* - * Allocate and initialize new zram device. the function returns - * '>= 0' device_id upon success, and negative value otherwise. -@@ -1264,15 +1269,9 @@ static int zram_add(void) - zram->disk->queue->limits.discard_zeroes_data = 0; - queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, zram->disk->queue); - -+ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups; - add_disk(zram->disk); - -- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj, -- &zram_disk_attr_group); -- if (ret < 0) { -- pr_err("Error creating sysfs group for device %d\n", -- device_id); -- goto out_free_disk; -- } - strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor)); - zram->meta = NULL; - zram->max_comp_streams = 1; -@@ -1280,9 +1279,6 @@ static int zram_add(void) - pr_info("Added device: %s\n", zram->disk->disk_name); - return device_id; - --out_free_disk: -- del_gendisk(zram->disk); -- put_disk(zram->disk); - out_free_queue: - blk_cleanup_queue(queue); - out_free_idr: -@@ -1310,16 +1306,6 @@ static int zram_remove(struct zram *zram) - zram->claim = true; - mutex_unlock(&bdev->bd_mutex); - -- /* -- * Remove sysfs first, so no one will perform a disksize -- * store while we destroy the devices. This also helps during -- * hot_remove -- zram_reset_device() is the last holder of -- * ->init_lock, no later/concurrent disksize_store() or any -- * other sysfs handlers are possible. -- */ -- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj, -- &zram_disk_attr_group); -- - /* Make sure all the pending I/O are finished */ - fsync_bdev(bdev); - zram_reset_device(zram); -diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c -index 389af3c15ec4..bde71b07f15e 100644 ---- a/drivers/clk/samsung/clk-exynos5420.c -+++ b/drivers/clk/samsung/clk-exynos5420.c -@@ -273,6 +273,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = { - { .offset = GATE_BUS_TOP, .value = 0xffffffff, }, - { .offset = GATE_BUS_DISP1, .value = 0xffffffff, }, - { .offset = GATE_IP_PERIC, .value = 0xffffffff, }, -+ { .offset = GATE_IP_PERIS, .value = 0xffffffff, }, - }; - - static int exynos5420_clk_suspend(void) -diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c -index 1a2032c2c1fb..f6863adc15ad 100644 ---- a/drivers/hid/uhid.c -+++ b/drivers/hid/uhid.c -@@ -12,6 +12,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -24,6 +25,7 @@ - #include - #include - #include -+#include - - #define UHID_NAME "uhid" - #define UHID_BUFSIZE 32 -@@ -721,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer, - - switch (uhid->input_buf.type) { - case UHID_CREATE: -+ /* -+ * 'struct uhid_create_req' contains a __user pointer which is -+ * copied from, so it's unsafe to allow this with elevated -+ * privileges (e.g. from a setuid binary) or via kernel_write(). -+ */ -+ if (file->f_cred != current_cred() || uaccess_kernel()) { -+ pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n", -+ task_tgid_vnr(current), current->comm); -+ ret = -EACCES; -+ goto unlock; -+ } - ret = uhid_dev_create(uhid, &uhid->input_buf); - break; - case UHID_CREATE2: -diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c -index 55b5a8ff1cfe..ca3aa28977bc 100644 ---- a/drivers/hwmon/ibmpowernv.c -+++ b/drivers/hwmon/ibmpowernv.c -@@ -114,7 +114,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr, - return sprintf(buf, "%s\n", sdata->label); - } - --static int __init get_logical_cpu(int hwcpu) -+static int get_logical_cpu(int hwcpu) - { - int cpu; - -@@ -125,9 +125,8 @@ static int __init get_logical_cpu(int hwcpu) - return -ENOENT; - } - --static void __init make_sensor_label(struct device_node *np, -- struct sensor_data *sdata, -- const char *label) -+static void make_sensor_label(struct device_node *np, -+ struct sensor_data *sdata, const char *label) - { - u32 id; - size_t n; -diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c -index b47ac4e053d0..f5c8a952f0aa 100644 ---- a/drivers/media/v4l2-core/v4l2-event.c -+++ b/drivers/media/v4l2-core/v4l2-event.c -@@ -197,6 +197,22 @@ int v4l2_event_pending(struct v4l2_fh *fh) - } - EXPORT_SYMBOL_GPL(v4l2_event_pending); - -+static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev) -+{ -+ struct v4l2_fh *fh = sev->fh; -+ unsigned int i; -+ -+ lockdep_assert_held(&fh->subscribe_lock); -+ assert_spin_locked(&fh->vdev->fh_lock); -+ -+ /* Remove any pending events for this subscription */ -+ for (i = 0; i < sev->in_use; i++) { -+ list_del(&sev->events[sev_pos(sev, i)].list); -+ fh->navailable--; -+ } -+ list_del(&sev->list); -+} -+ - int v4l2_event_subscribe(struct v4l2_fh *fh, - const struct v4l2_event_subscription *sub, unsigned elems, - const struct v4l2_subscribed_event_ops *ops) -@@ -228,27 +244,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, - - spin_lock_irqsave(&fh->vdev->fh_lock, flags); - found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); -+ if (!found_ev) -+ list_add(&sev->list, &fh->subscribed); - spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); - - if (found_ev) { - /* Already listening */ - kfree(sev); -- goto out_unlock; -- } -- -- if (sev->ops && sev->ops->add) { -+ } else if (sev->ops && sev->ops->add) { - ret = sev->ops->add(sev, elems); - if (ret) { -+ spin_lock_irqsave(&fh->vdev->fh_lock, flags); -+ __v4l2_event_unsubscribe(sev); -+ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); - kfree(sev); -- goto out_unlock; - } - } - -- spin_lock_irqsave(&fh->vdev->fh_lock, flags); -- list_add(&sev->list, &fh->subscribed); -- spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); -- --out_unlock: - mutex_unlock(&fh->subscribe_lock); - - return ret; -@@ -283,7 +295,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, - { - struct v4l2_subscribed_event *sev; - unsigned long flags; -- int i; - - if (sub->type == V4L2_EVENT_ALL) { - v4l2_event_unsubscribe_all(fh); -@@ -295,14 +306,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, - spin_lock_irqsave(&fh->vdev->fh_lock, flags); - - sev = v4l2_event_subscribed(fh, sub->type, sub->id); -- if (sev != NULL) { -- /* Remove any pending events for this subscription */ -- for (i = 0; i < sev->in_use; i++) { -- list_del(&sev->events[sev_pos(sev, i)].list); -- fh->navailable--; -- } -- list_del(&sev->list); -- } -+ if (sev != NULL) -+ __v4l2_event_unsubscribe(sev); - - spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); - -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index 1c37d5a78822..8ce9c63dfc59 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -870,12 +870,9 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state) - dprintk(4, "done processing on buffer %d, state: %d\n", - vb->index, state); - -- if (state != VB2_BUF_STATE_QUEUED && -- state != VB2_BUF_STATE_REQUEUEING) { -- /* sync buffers */ -- for (plane = 0; plane < vb->num_planes; ++plane) -- call_void_memop(vb, finish, vb->planes[plane].mem_priv); -- } -+ /* sync buffers */ -+ for (plane = 0; plane < vb->num_planes; ++plane) -+ call_void_memop(vb, finish, vb->planes[plane].mem_priv); - - spin_lock_irqsave(&q->done_lock, flags); - if (state == VB2_BUF_STATE_QUEUED || -diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c -index e11a0bd6c66e..e2474af7386a 100644 ---- a/drivers/misc/atmel-ssc.c -+++ b/drivers/misc/atmel-ssc.c -@@ -129,7 +129,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = { - MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids); - #endif - --static inline const struct atmel_ssc_platform_data * __init -+static inline const struct atmel_ssc_platform_data * - atmel_ssc_get_driver_data(struct platform_device *pdev) - { - if (pdev->dev.of_node) { -diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c -index 313da3150262..1540a7785e14 100644 ---- a/drivers/misc/sgi-gru/grukdump.c -+++ b/drivers/misc/sgi-gru/grukdump.c -@@ -27,6 +27,9 @@ - #include - #include - #include -+ -+#include -+ - #include "gru.h" - #include "grutables.h" - #include "gruhandles.h" -@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg) - /* Currently, only dump by gid is implemented */ - if (req.gid >= gru_max_gids) - return -EINVAL; -+ req.gid = array_index_nospec(req.gid, gru_max_gids); - - gru = GID_TO_GRU(req.gid); - ubuf = req.buf; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index ce3a56bea6e6..58102e96ac5c 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -12379,6 +12379,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e - { - struct tg3 *tp = netdev_priv(dev); - int i, irq_sync = 0, err = 0; -+ bool reset_phy = false; - - if ((ering->rx_pending > tp->rx_std_ring_mask) || - (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) || -@@ -12410,7 +12411,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e - - if (netif_running(dev)) { - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); -- err = tg3_restart_hw(tp, false); -+ /* Reset PHY to avoid PHY lock up */ -+ if (tg3_asic_rev(tp) == ASIC_REV_5717 || -+ tg3_asic_rev(tp) == ASIC_REV_5719 || -+ tg3_asic_rev(tp) == ASIC_REV_5720) -+ reset_phy = true; -+ -+ err = tg3_restart_hw(tp, reset_phy); - if (!err) - tg3_netif_start(tp); - } -@@ -12444,6 +12451,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam - { - struct tg3 *tp = netdev_priv(dev); - int err = 0; -+ bool reset_phy = false; - - if (tp->link_config.autoneg == AUTONEG_ENABLE) - tg3_warn_mgmt_link_flap(tp); -@@ -12534,7 +12542,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam - - if (netif_running(dev)) { - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); -- err = tg3_restart_hw(tp, false); -+ /* Reset PHY to avoid PHY lock up */ -+ if (tg3_asic_rev(tp) == ASIC_REV_5717 || -+ tg3_asic_rev(tp) == ASIC_REV_5719 || -+ tg3_asic_rev(tp) == ASIC_REV_5720) -+ reset_phy = true; -+ -+ err = tg3_restart_hw(tp, reset_phy); - if (!err) - tg3_netif_start(tp); - } -diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c -index 460fa6708bfc..3c4b107aba78 100644 ---- a/drivers/platform/x86/acerhdf.c -+++ b/drivers/platform/x86/acerhdf.c -@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = { - {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0}, - {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0}, - {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0}, -+ {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0}, - /* Packard Bell */ - {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0}, - {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0}, -diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c -index 0ab15d833d1b..50fe1f76ea42 100644 ---- a/drivers/uio/uio.c -+++ b/drivers/uio/uio.c -@@ -842,6 +842,8 @@ int __uio_register_device(struct module *owner, - if (ret) - goto err_uio_dev_add_attributes; - -+ info->uio_dev = idev; -+ - if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { - /* - * Note that we deliberately don't use devm_request_irq -@@ -853,11 +855,12 @@ int __uio_register_device(struct module *owner, - */ - ret = request_irq(info->irq, uio_interrupt, - info->irq_flags, info->name, idev); -- if (ret) -+ if (ret) { -+ info->uio_dev = NULL; - goto err_request_irq; -+ } - } - -- info->uio_dev = idev; - return 0; - - err_request_irq: -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 3cbf6aa10f2c..0a8e5ac891d4 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1716,6 +1716,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -+ { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */ -+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ -+ }, - { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ - .driver_info = QUIRK_CONTROL_LINE_STATE, }, - { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 37a5e07b3488..1e8f68960014 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -243,6 +243,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | - USB_QUIRK_DELAY_CTRL_MSG }, - -+ /* Corsair K70 LUX RGB */ -+ { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* Corsair K70 LUX */ - { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, - -@@ -263,6 +266,11 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x2040, 0x7200), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, - -+ /* Raydium Touchscreen */ -+ { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM }, -+ -+ { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* DJI CineSSD */ - { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index f788f80fe1aa..aee29604bd79 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -348,7 +348,7 @@ int xhci_find_slot_id_by_port(struct usb_hcd *hcd, struct xhci_hcd *xhci, - - slot_id = 0; - for (i = 0; i < MAX_HC_SLOTS; i++) { -- if (!xhci->devs[i]) -+ if (!xhci->devs[i] || !xhci->devs[i]->udev) - continue; - speed = xhci->devs[i]->udev->speed; - if (((speed >= USB_SPEED_SUPER) == (hcd->speed >= HCD_USB3)) -diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c -index a0a3827b4aff..b15842c6f916 100644 ---- a/drivers/usb/misc/appledisplay.c -+++ b/drivers/usb/misc/appledisplay.c -@@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = { - { APPLEDISPLAY_DEVICE(0x9219) }, - { APPLEDISPLAY_DEVICE(0x921c) }, - { APPLEDISPLAY_DEVICE(0x921d) }, -+ { APPLEDISPLAY_DEVICE(0x9222) }, - { APPLEDISPLAY_DEVICE(0x9236) }, - - /* Terminating entry */ -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 8dbb00fbb00b..b0875ef48522 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4333,6 +4333,7 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root, - static int btrfs_destroy_pinned_extent(struct btrfs_root *root, - struct extent_io_tree *pinned_extents) - { -+ struct btrfs_fs_info *fs_info = root->fs_info; - struct extent_io_tree *unpin; - u64 start; - u64 end; -@@ -4342,21 +4343,31 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root, - unpin = pinned_extents; - again: - while (1) { -+ /* -+ * The btrfs_finish_extent_commit() may get the same range as -+ * ours between find_first_extent_bit and clear_extent_dirty. -+ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin -+ * the same extent range. -+ */ -+ mutex_lock(&fs_info->unused_bg_unpin_mutex); - ret = find_first_extent_bit(unpin, 0, &start, &end, - EXTENT_DIRTY, NULL); -- if (ret) -+ if (ret) { -+ mutex_unlock(&fs_info->unused_bg_unpin_mutex); - break; -+ } - - clear_extent_dirty(unpin, start, end, GFP_NOFS); - btrfs_error_unpin_extent_range(root, start, end); -+ mutex_unlock(&fs_info->unused_bg_unpin_mutex); - cond_resched(); - } - - if (loop) { -- if (unpin == &root->fs_info->freed_extents[0]) -- unpin = &root->fs_info->freed_extents[1]; -+ if (unpin == &fs_info->freed_extents[0]) -+ unpin = &fs_info->freed_extents[1]; - else -- unpin = &root->fs_info->freed_extents[0]; -+ unpin = &fs_info->freed_extents[0]; - loop = false; - goto again; - } -diff --git a/fs/exofs/super.c b/fs/exofs/super.c -index b795c567b5e1..360ba74e04e6 100644 ---- a/fs/exofs/super.c -+++ b/fs/exofs/super.c -@@ -100,6 +100,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts) - token = match_token(p, tokens, args); - switch (token) { - case Opt_name: -+ kfree(opts->dev_name); - opts->dev_name = match_strdup(&args[0]); - if (unlikely(!opts->dev_name)) { - EXOFS_ERR("Error allocating dev_name"); -@@ -868,8 +869,10 @@ static struct dentry *exofs_mount(struct file_system_type *type, - int ret; - - ret = parse_options(data, &opts); -- if (ret) -+ if (ret) { -+ kfree(opts.dev_name); - return ERR_PTR(ret); -+ } - - if (!opts.dev_name) - opts.dev_name = dev_name; -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index c134c0462cee..ef24894edecc 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -732,6 +732,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) - spin_lock(&gl->gl_lockref.lock); - gl->gl_object = NULL; - spin_unlock(&gl->gl_lockref.lock); -+ gfs2_rgrp_brelse(rgd); - gfs2_glock_add_to_lru(gl); - gfs2_glock_put(gl); - } -@@ -1139,7 +1140,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) - * @rgd: the struct gfs2_rgrpd describing the RG to read in - * - * Read in all of a Resource Group's header and bitmap blocks. -- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. -+ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. - * - * Returns: errno - */ -diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c -index 2a6f3c67cb3f..2e713673df42 100644 ---- a/fs/hfs/brec.c -+++ b/fs/hfs/brec.c -@@ -424,6 +424,10 @@ skip: - if (new_node) { - __be32 cnid; - -+ if (!new_node->parent) { -+ hfs_btree_inc_height(tree); -+ new_node->parent = tree->root; -+ } - fd->bnode = hfs_bnode_find(tree, new_node->parent); - /* create index key and entry */ - hfs_bnode_read_key(new_node, fd->search_key, 14); -diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c -index 754fdf8c6356..1002a0c08319 100644 ---- a/fs/hfsplus/brec.c -+++ b/fs/hfsplus/brec.c -@@ -427,6 +427,10 @@ skip: - if (new_node) { - __be32 cnid; - -+ if (!new_node->parent) { -+ hfs_btree_inc_height(tree); -+ new_node->parent = tree->root; -+ } - fd->bnode = hfs_bnode_find(tree, new_node->parent); - /* create index key and entry */ - hfs_bnode_read_key(new_node, fd->search_key, 14); -diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c -index 8b32fdaad468..d424b3d4bf3b 100644 ---- a/fs/reiserfs/xattr.c -+++ b/fs/reiserfs/xattr.c -@@ -184,6 +184,7 @@ struct reiserfs_dentry_buf { - struct dir_context ctx; - struct dentry *xadir; - int count; -+ int err; - struct dentry *dentries[8]; - }; - -@@ -206,6 +207,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, - - dentry = lookup_one_len(name, dbuf->xadir, namelen); - if (IS_ERR(dentry)) { -+ dbuf->err = PTR_ERR(dentry); - return PTR_ERR(dentry); - } else if (d_really_is_negative(dentry)) { - /* A directory entry exists, but no file? */ -@@ -214,6 +216,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, - "not found for file %pd.\n", - dentry, dbuf->xadir); - dput(dentry); -+ dbuf->err = -EIO; - return -EIO; - } - -@@ -261,6 +264,10 @@ static int reiserfs_for_each_xattr(struct inode *inode, - err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx); - if (err) - break; -+ if (buf.err) { -+ err = buf.err; -+ break; -+ } - if (!buf.count) - break; - for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) { -diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h -index 8d0248525957..9f34204978e4 100644 ---- a/include/linux/netfilter/ipset/ip_set_comment.h -+++ b/include/linux/netfilter/ipset/ip_set_comment.h -@@ -41,11 +41,11 @@ ip_set_init_comment(struct ip_set_comment *comment, - rcu_assign_pointer(comment->c, c); - } - --/* Used only when dumping a set, protected by rcu_read_lock_bh() */ -+/* Used only when dumping a set, protected by rcu_read_lock() */ - static inline int - ip_set_put_comment(struct sk_buff *skb, struct ip_set_comment *comment) - { -- struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); -+ struct ip_set_comment_rcu *c = rcu_dereference(comment->c); - - if (!c) - return 0; -diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h -index 558129af828a..15c7b5420d8a 100644 ---- a/include/linux/uaccess.h -+++ b/include/linux/uaccess.h -@@ -2,6 +2,9 @@ - #define __LINUX_UACCESS_H__ - - #include -+ -+#define uaccess_kernel() segment_eq(get_fs(), KERNEL_DS) -+ - #include - - static __always_inline void pagefault_disabled_inc(void) -diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile -index 29090f3db677..28c089cb13f1 100644 ---- a/lib/raid6/test/Makefile -+++ b/lib/raid6/test/Makefile -@@ -26,7 +26,7 @@ ifeq ($(ARCH),arm) - CFLAGS += -I../../../arch/arm/include -mfpu=neon - HAS_NEON = yes - endif --ifeq ($(ARCH),arm64) -+ifeq ($(ARCH),aarch64) - CFLAGS += -I../../../arch/arm64/include - HAS_NEON = yes - endif -@@ -37,7 +37,7 @@ ifeq ($(IS_X86),yes) - gcc -c -x assembler - >&/dev/null && \ - rm ./-.o && echo -DCONFIG_AS_AVX2=1) - else ifeq ($(HAS_NEON),yes) -- OBJS += neon.o neon1.o neon2.o neon4.o neon8.o -+ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o - CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 - else - HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ -diff --git a/net/core/dev.c b/net/core/dev.c -index 7366feb8b5b3..e03c1d2f6707 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4481,6 +4481,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb) - skb->vlan_tci = 0; - skb->dev = napi->dev; - skb->skb_iif = 0; -+ -+ /* eth_type_trans() assumes pkt_type is PACKET_HOST */ -+ skb->pkt_type = PACKET_HOST; -+ - skb->encapsulation = 0; - skb_shinfo(skb)->gso_type = 0; - skb->truesize = SKB_TRUESIZE(skb_end_offset(skb)); -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 4d14908afaec..697c4212129a 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -480,8 +480,8 @@ ip_proto_again: - break; - } - -- if (dissector_uses_key(flow_dissector, -- FLOW_DISSECTOR_KEY_PORTS)) { -+ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) && -+ !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) { - key_ports = skb_flow_dissector_target(flow_dissector, - FLOW_DISSECTOR_KEY_PORTS, - target_container); -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index dbda0565781c..4916d1857b75 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -71,7 +71,7 @@ int iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb, - - iph->version = 4; - iph->ihl = sizeof(struct iphdr) >> 2; -- iph->frag_off = df; -+ iph->frag_off = ip_mtu_locked(&rt->dst) ? 0 : df; - iph->protocol = proto; - iph->tos = tos; - iph->daddr = dst; -diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c -index 9a14c237830f..b259a5814965 100644 ---- a/net/netfilter/ipset/ip_set_hash_netportnet.c -+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c -@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], - - if (tb[IPSET_ATTR_CIDR]) { - e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); -- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) -+ if (e.cidr[0] > HOST_MASK) - return -IPSET_ERR_INVALID_CIDR; - } - - if (tb[IPSET_ATTR_CIDR2]) { - e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); -- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) -+ if (e.cidr[1] > HOST_MASK) - return -IPSET_ERR_INVALID_CIDR; - } - -@@ -492,13 +492,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], - - if (tb[IPSET_ATTR_CIDR]) { - e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); -- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) -+ if (e.cidr[0] > HOST_MASK) - return -IPSET_ERR_INVALID_CIDR; - } - - if (tb[IPSET_ATTR_CIDR2]) { - e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); -- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) -+ if (e.cidr[1] > HOST_MASK) - return -IPSET_ERR_INVALID_CIDR; - } - -diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c -index 1718f536689f..8a1d2af3eed0 100644 ---- a/net/netfilter/xt_IDLETIMER.c -+++ b/net/netfilter/xt_IDLETIMER.c -@@ -116,6 +116,22 @@ static void idletimer_tg_expired(unsigned long data) - schedule_work(&timer->work); - } - -+static int idletimer_check_sysfs_name(const char *name, unsigned int size) -+{ -+ int ret; -+ -+ ret = xt_check_proc_name(name, size); -+ if (ret < 0) -+ return ret; -+ -+ if (!strcmp(name, "power") || -+ !strcmp(name, "subsystem") || -+ !strcmp(name, "uevent")) -+ return -EINVAL; -+ -+ return 0; -+} -+ - static int idletimer_tg_create(struct idletimer_tg_info *info) - { - int ret; -@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) - goto out; - } - -+ ret = idletimer_check_sysfs_name(info->label, sizeof(info->label)); -+ if (ret < 0) -+ goto out_free_timer; -+ - sysfs_attr_init(&info->timer->attr.attr); - info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); - if (!info->timer->attr.attr.name) { -diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c -index 9b8d855e4a87..ed9bbd383f7d 100644 ---- a/net/sunrpc/xdr.c -+++ b/net/sunrpc/xdr.c -@@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode); - static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, - size_t nbytes) - { -- static __be32 *p; -+ __be32 *p; - int space_left; - int frag1bytes, frag2bytes; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.165-166.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.165-166.patch deleted file mode 100644 index 6f4427787a83..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.165-166.patch +++ /dev/null @@ -1,2967 +0,0 @@ -diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt -index 35e17f748ca7..af5859b2d0f9 100644 ---- a/Documentation/sysctl/fs.txt -+++ b/Documentation/sysctl/fs.txt -@@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/fs: - - overflowgid - - pipe-user-pages-hard - - pipe-user-pages-soft -+- protected_fifos - - protected_hardlinks -+- protected_regular - - protected_symlinks - - suid_dumpable - - super-max -@@ -182,6 +184,24 @@ applied. - - ============================================================== - -+protected_fifos: -+ -+The intent of this protection is to avoid unintentional writes to -+an attacker-controlled FIFO, where a program expected to create a regular -+file. -+ -+When set to "0", writing to FIFOs is unrestricted. -+ -+When set to "1" don't allow O_CREAT open on FIFOs that we don't own -+in world writable sticky directories, unless they are owned by the -+owner of the directory. -+ -+When set to "2" it also applies to group writable sticky directories. -+ -+This protection is based on the restrictions in Openwall. -+ -+============================================================== -+ - protected_hardlinks: - - A long-standing class of security issues is the hardlink-based -@@ -202,6 +222,22 @@ This protection is based on the restrictions in Openwall and grsecurity. - - ============================================================== - -+protected_regular: -+ -+This protection is similar to protected_fifos, but it -+avoids writes to an attacker-controlled regular file, where a program -+expected to create one. -+ -+When set to "0", writing to regular files is unrestricted. -+ -+When set to "1" don't allow O_CREAT open on regular files that we -+don't own in world writable sticky directories, unless they are -+owned by the owner of the directory. -+ -+When set to "2" it also applies to group writable sticky directories. -+ -+============================================================== -+ - protected_symlinks: - - A long-standing class of security issues is the symlink-based -diff --git a/MAINTAINERS b/MAINTAINERS -index ab65bbecb159..f4d4a5544dc1 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -10135,6 +10135,7 @@ F: arch/alpha/kernel/srm_env.c - - STABLE BRANCH - M: Greg Kroah-Hartman -+M: Sasha Levin - L: stable@vger.kernel.org - S: Supported - F: Documentation/stable_kernel_rules.txt -diff --git a/Makefile b/Makefile -index 441a760dc5a4..64521458d35e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 165 -+SUBLEVEL = 166 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index c10bb98144b0..fb4ac87fc398 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -10,7 +10,7 @@ - # - # Copyright (C) 1995-2001 by Russell King - --LDFLAGS_vmlinux :=-p --no-undefined -X -+LDFLAGS_vmlinux :=--no-undefined -X - CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) - OBJCOPYFLAGS :=-O binary -R .note -R .note.gnu.build-id -R .comment -S - GZFLAGS :=-9 -diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h -index 2e0e67ef3544..e8cedf32345a 100644 ---- a/arch/powerpc/kvm/trace.h -+++ b/arch/powerpc/kvm/trace.h -@@ -5,8 +5,6 @@ - - #undef TRACE_SYSTEM - #define TRACE_SYSTEM kvm --#define TRACE_INCLUDE_PATH . --#define TRACE_INCLUDE_FILE trace - - /* - * Tracepoint for guest mode entry. -@@ -119,4 +117,10 @@ TRACE_EVENT(kvm_check_requests, - #endif /* _TRACE_KVM_H */ - - /* This part must be outside protection */ -+#undef TRACE_INCLUDE_PATH -+#undef TRACE_INCLUDE_FILE -+ -+#define TRACE_INCLUDE_PATH . -+#define TRACE_INCLUDE_FILE trace -+ - #include -diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h -index 7ec534d1db9f..7eadbf449a1f 100644 ---- a/arch/powerpc/kvm/trace_booke.h -+++ b/arch/powerpc/kvm/trace_booke.h -@@ -5,8 +5,6 @@ - - #undef TRACE_SYSTEM - #define TRACE_SYSTEM kvm_booke --#define TRACE_INCLUDE_PATH . --#define TRACE_INCLUDE_FILE trace_booke - - #define kvm_trace_symbol_exit \ - {0, "CRITICAL"}, \ -@@ -217,4 +215,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio, - #endif - - /* This part must be outside protection */ -+ -+#undef TRACE_INCLUDE_PATH -+#undef TRACE_INCLUDE_FILE -+ -+#define TRACE_INCLUDE_PATH . -+#define TRACE_INCLUDE_FILE trace_booke -+ - #include -diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h -index 33d9daff5783..d1bfe017d751 100644 ---- a/arch/powerpc/kvm/trace_hv.h -+++ b/arch/powerpc/kvm/trace_hv.h -@@ -8,8 +8,6 @@ - - #undef TRACE_SYSTEM - #define TRACE_SYSTEM kvm_hv --#define TRACE_INCLUDE_PATH . --#define TRACE_INCLUDE_FILE trace_hv - - #define kvm_trace_symbol_hcall \ - {H_REMOVE, "H_REMOVE"}, \ -@@ -474,4 +472,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit, - #endif /* _TRACE_KVM_HV_H */ - - /* This part must be outside protection */ -+ -+#undef TRACE_INCLUDE_PATH -+#undef TRACE_INCLUDE_FILE -+ -+#define TRACE_INCLUDE_PATH . -+#define TRACE_INCLUDE_FILE trace_hv -+ - #include -diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h -index 810507cb688a..1e40aa2aa5af 100644 ---- a/arch/powerpc/kvm/trace_pr.h -+++ b/arch/powerpc/kvm/trace_pr.h -@@ -7,8 +7,6 @@ - - #undef TRACE_SYSTEM - #define TRACE_SYSTEM kvm_pr --#define TRACE_INCLUDE_PATH . --#define TRACE_INCLUDE_FILE trace_pr - - TRACE_EVENT(kvm_book3s_reenter, - TP_PROTO(int r, struct kvm_vcpu *vcpu), -@@ -271,4 +269,11 @@ TRACE_EVENT(kvm_unmap_hva, - #endif /* _TRACE_KVM_H */ - - /* This part must be outside protection */ -+ -+#undef TRACE_INCLUDE_PATH -+#undef TRACE_INCLUDE_FILE -+ -+#define TRACE_INCLUDE_PATH . -+#define TRACE_INCLUDE_FILE trace_pr -+ - #include -diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c -index 3c4faa4c2742..bb3df222ae71 100644 ---- a/arch/powerpc/mm/numa.c -+++ b/arch/powerpc/mm/numa.c -@@ -1319,7 +1319,7 @@ static long vphn_get_associativity(unsigned long cpu, - - switch (rc) { - case H_FUNCTION: -- printk(KERN_INFO -+ printk_once(KERN_INFO - "VPHN is not supported. Disabling polling...\n"); - stop_topology_update(); - break; -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 05ae254f84cf..1866b6a5171a 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -637,6 +637,8 @@ void gmap_discard(struct gmap *gmap, unsigned long from, unsigned long to) - vmaddr |= gaddr & ~PMD_MASK; - /* Find vma in the parent mm */ - vma = find_vma(gmap->mm, vmaddr); -+ if (!vma) -+ continue; - size = min(to - gaddr, PMD_SIZE - (gaddr & ~PMD_MASK)); - zap_page_range(vma, vmaddr, size, NULL); - } -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 8be48b1d7596..375ed605c83d 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -856,7 +856,7 @@ ENTRY(\sym) - - call \do_sym - -- jmp error_exit /* %ebx: no swapgs flag */ -+ jmp error_exit - .endif - END(\sym) - .endm -@@ -1118,7 +1118,6 @@ END(paranoid_exit) - - /* - * Save all registers in pt_regs, and switch gs if needed. -- * Return: EBX=0: came from user mode; EBX=1: otherwise - */ - ENTRY(error_entry) - cld -@@ -1131,7 +1130,6 @@ ENTRY(error_entry) - * the kernel CR3 here. - */ - SWITCH_KERNEL_CR3 -- xorl %ebx, %ebx - testb $3, CS+8(%rsp) - jz .Lerror_kernelspace - -@@ -1165,7 +1163,6 @@ ENTRY(error_entry) - * for these here too. - */ - .Lerror_kernelspace: -- incl %ebx - leaq native_irq_return_iret(%rip), %rcx - cmpq %rcx, RIP+8(%rsp) - je .Lerror_bad_iret -@@ -1196,28 +1193,19 @@ ENTRY(error_entry) - - /* - * Pretend that the exception came from user mode: set up pt_regs -- * as if we faulted immediately after IRET and clear EBX so that -- * error_exit knows that we will be returning to user mode. -+ * as if we faulted immediately after IRET. - */ - mov %rsp, %rdi - call fixup_bad_iret - mov %rax, %rsp -- decl %ebx - jmp .Lerror_entry_from_usermode_after_swapgs - END(error_entry) - -- --/* -- * On entry, EBS is a "return to kernel mode" flag: -- * 1: already in kernel mode, don't need SWAPGS -- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode -- */ - ENTRY(error_exit) -- movl %ebx, %eax - DISABLE_INTERRUPTS(CLBR_NONE) - TRACE_IRQS_OFF -- testl %eax, %eax -- jnz retint_kernel -+ testb $3, CS(%rsp) -+ jz retint_kernel - jmp retint_user - END(error_exit) - -diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c -index ef1fa8145419..fa86946d12aa 100644 ---- a/drivers/cpufreq/imx6q-cpufreq.c -+++ b/drivers/cpufreq/imx6q-cpufreq.c -@@ -130,8 +130,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index) - /* Ensure the arm clock divider is what we expect */ - ret = clk_set_rate(arm_clk, new_freq * 1000); - if (ret) { -+ int ret1; -+ - dev_err(cpu_dev, "failed to set clock rate: %d\n", ret); -- regulator_set_voltage_tol(arm_reg, volt_old, 0); -+ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0); -+ if (ret1) -+ dev_warn(cpu_dev, -+ "failed to restore vddarm voltage: %d\n", ret1); - return ret; - } - -diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c -index 9a32d9dfdd26..011700262824 100644 ---- a/drivers/gpu/drm/ast/ast_drv.c -+++ b/drivers/gpu/drm/ast/ast_drv.c -@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = { - - MODULE_DEVICE_TABLE(pci, pciidlist); - -+static void ast_kick_out_firmware_fb(struct pci_dev *pdev) -+{ -+ struct apertures_struct *ap; -+ bool primary = false; -+ -+ ap = alloc_apertures(1); -+ if (!ap) -+ return; -+ -+ ap->ranges[0].base = pci_resource_start(pdev, 0); -+ ap->ranges[0].size = pci_resource_len(pdev, 0); -+ -+#ifdef CONFIG_X86 -+ primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW; -+#endif -+ remove_conflicting_framebuffers(ap, "astdrmfb", primary); -+ kfree(ap); -+} -+ - static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - { -+ ast_kick_out_firmware_fb(pdev); -+ - return drm_get_pci_dev(pdev, ent, &driver); - } - -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index 69d19f3304a5..21085f669e21 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -552,6 +552,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc, - } - ast_bo_unreserve(bo); - -+ ast_set_offset_reg(crtc); - ast_set_start_address_crt1(crtc, (u32)gpu_addr); - - return 0; -@@ -1249,7 +1250,7 @@ static int ast_cursor_move(struct drm_crtc *crtc, - ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07)); - - /* dummy write to fire HWC */ -- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00); -+ ast_show_cursor(crtc); - - return 0; - } -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 3258baf3282e..2e52015634f9 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -76,18 +76,23 @@ - */ - - #include -+#include -+#include - #include - #include - #include - #include -+#include - - #define DRIVER_AUTHOR "Marko Friedemann " - #define DRIVER_DESC "X-Box pad driver" - --#define XPAD_PKT_LEN 32 -+#define XPAD_PKT_LEN 64 - --/* xbox d-pads should map to buttons, as is required for DDR pads -- but we map them to axes when possible to simplify things */ -+/* -+ * xbox d-pads should map to buttons, as is required for DDR pads -+ * but we map them to axes when possible to simplify things -+ */ - #define MAP_DPAD_TO_BUTTONS (1 << 0) - #define MAP_TRIGGERS_TO_BUTTONS (1 << 1) - #define MAP_STICKS_TO_NULL (1 << 2) -@@ -112,6 +117,10 @@ static bool sticks_to_null; - module_param(sticks_to_null, bool, S_IRUGO); - MODULE_PARM_DESC(sticks_to_null, "Do not map sticks at all for unknown pads"); - -+static bool auto_poweroff = true; -+module_param(auto_poweroff, bool, S_IWUSR | S_IRUGO); -+MODULE_PARM_DESC(auto_poweroff, "Power off wireless controllers on suspend"); -+ - static const struct xpad_device { - u16 idVendor; - u16 idProduct; -@@ -119,43 +128,77 @@ static const struct xpad_device { - u8 mapping; - u8 xtype; - } xpad_device[] = { -+ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 }, -+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, -+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, -+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, -+ { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX }, -+ { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, - { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX }, - { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX }, - { 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX }, -+ { 0x045e, 0x0288, "Microsoft Xbox Controller S v2", 0, XTYPE_XBOX }, - { 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX }, - { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, -- { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, -- { 0x045e, 0x02dd, "Microsoft X-Box One pad (Covert Forces)", 0, XTYPE_XBOXONE }, -+ { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 }, - { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, -+ { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, -+ { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, -+ { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", 0, XTYPE_XBOXONE }, -+ { 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE }, - { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, -- { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, -- { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 }, - { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 }, - { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX }, - { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, -+ { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, -+ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, -+ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, - { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, - { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, -+ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, -+ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, -+ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, -+ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, -+ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, -+ { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX }, -+ { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 }, -+ { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX }, - { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX }, -+ { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, - { 0x0738, 0x4522, "Mad Catz LumiCON", 0, XTYPE_XBOX }, - { 0x0738, 0x4526, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, -+ { 0x0738, 0x4530, "Mad Catz Universal MC2 Racing Wheel and Pedals", 0, XTYPE_XBOX }, - { 0x0738, 0x4536, "Mad Catz MicroCON", 0, XTYPE_XBOX }, - { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, - { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", 0, XTYPE_XBOX }, -+ { 0x0738, 0x4586, "Mad Catz MicroCon Wireless Controller", 0, XTYPE_XBOX }, -+ { 0x0738, 0x4588, "Mad Catz Blaster", 0, XTYPE_XBOX }, -+ { 0x0738, 0x45ff, "Mad Catz Beat Pad (w/ Handle)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, - { 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, - { 0x0738, 0x4718, "Mad Catz Street Fighter IV FightStick SE", 0, XTYPE_XBOX360 }, - { 0x0738, 0x4726, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, - { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x0738, 0x4736, "Mad Catz MicroCon Gamepad", 0, XTYPE_XBOX360 }, - { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 }, -+ { 0x0738, 0x4743, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, -+ { 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, - { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, -+ { 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 }, - { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 }, -+ { 0x0738, 0xb738, "Mad Catz MVC2TE Stick 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 }, - { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, - { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, -+ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 }, - { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, -+ { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 }, -+ { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX }, -+ { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX }, - { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, - { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", DANCEPAD_MAP_CONFIG, XTYPE_XBOX }, - { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX }, -@@ -163,32 +206,66 @@ static const struct xpad_device { - { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX }, - { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, - { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX }, -+ { 0x0e4c, 0x1103, "Radica Gamester Reflex", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX }, - { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX }, -+ { 0x0e4c, 0x3510, "Radica Gamester", 0, XTYPE_XBOX }, - { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", 0, XTYPE_XBOX }, - { 0x0e6f, 0x0005, "Eclipse wireless Controller", 0, XTYPE_XBOX }, - { 0x0e6f, 0x0006, "Edge wireless Controller", 0, XTYPE_XBOX }, -+ { 0x0e6f, 0x0008, "After Glow Pro Controller", 0, XTYPE_XBOX }, - { 0x0e6f, 0x0105, "HSM3 Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x0e6f, 0x0113, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0131, "PDP EA Sports Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0133, "Xbox 360 Wired Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0164, "PDP Battlefield One", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x0165, "PDP Titanfall 2", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, - { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, - { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE }, -+ { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE }, - { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0x0501, "PDP Xbox 360 Controller", 0, XTYPE_XBOX360 }, -+ { 0x0e6f, 0xf900, "PDP Afterglow AX.1", 0, XTYPE_XBOX360 }, - { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", 0, XTYPE_XBOX }, - { 0x0e8f, 0x3008, "Generic xbox control (dealextreme)", 0, XTYPE_XBOX }, - { 0x0f0d, 0x000a, "Hori Co. DOA4 FightStick", 0, XTYPE_XBOX360 }, -+ { 0x0f0d, 0x000c, "Hori PadEX Turbo", 0, XTYPE_XBOX360 }, - { 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x0f0d, 0x001b, "Hori Real Arcade Pro VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, -+ { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE }, -+ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, -+ { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX }, - { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, - { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, - { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, -+ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, - { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, -+ { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x12ab, 0x8809, "Xbox DDR dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, - { 0x1430, 0x4748, "RedOctane Guitar Hero X-plorer", 0, XTYPE_XBOX360 }, - { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, -+ { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, - { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, - { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, -+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, - { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, - { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, - { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, -@@ -196,24 +273,67 @@ static const struct xpad_device { - { 0x162e, 0xbeef, "Joytech Neo-Se Take2", 0, XTYPE_XBOX360 }, - { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, - { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, -- { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, -+ { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, - { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf018, "Mad Catz Street Fighter IV SE Fighting Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf019, "Mad Catz Brawlstick for Xbox 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf021, "Mad Cats Ghost Recon FS GamePad", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf023, "MLG Pro Circuit Controller (Xbox)", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf025, "Mad Catz Call Of Duty", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf027, "Mad Catz FPS Pro", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf028, "Street Fighter IV FightPad", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf02e, "Mad Catz Fightpad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf030, "Mad Catz Xbox 360 MC2 MicroCon Racing Wheel", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf036, "Mad Catz MicroCon GamePad Pro", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf038, "Street Fighter IV FightStick TE", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf039, "Mad Catz MvC2 TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf03a, "Mad Catz SFxT Fightstick Pro", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf03d, "Street Fighter IV Arcade Stick TE - Chun Li", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf03e, "Mad Catz MLG FightStick TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf03f, "Mad Catz FightStick SoulCaliber", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf042, "Mad Catz FightStick TES+", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf080, "Mad Catz FightStick TE2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf501, "HoriPad EX2 Turbo", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf502, "Hori Real Arcade Pro.VX SA", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf503, "Hori Fighting Stick VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf504, "Hori Real Arcade Pro. EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf505, "Hori Fighting Stick EX2B", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf506, "Hori Real Arcade Pro.EX Premium VLX", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf900, "Harmonix Xbox 360 Controller", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf901, "Gamestop Xbox 360 Controller", 0, XTYPE_XBOX360 }, - { 0x1bad, 0xf903, "Tron Xbox 360 controller", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf904, "PDP Versus Fighting Pad", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xf906, "MortalKombat FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, -+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x530a, "Xbox 360 Pro EX Controller", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x531a, "PowerA Pro Ex", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x5397, "FUS1ON Tournament Controller", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x541a, "PowerA Xbox One Mini Wired Controller", 0, XTYPE_XBOXONE }, -+ { 0x24c6, 0x542a, "Xbox ONE spectra", 0, XTYPE_XBOXONE }, -+ { 0x24c6, 0x543a, "PowerA Xbox One wired controller", 0, XTYPE_XBOXONE }, - { 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, -+ { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE }, -+ { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE }, -+ { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, - { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, -+ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, -+ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, - { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, - { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } - }; -@@ -274,15 +394,15 @@ static const signed short xpad_abs_triggers[] = { - * match against vendor id as well. Wired Xbox 360 devices have protocol 1, - * wireless controllers have protocol 129. - */ --#define XPAD_XBOX360_VENDOR_PROTOCOL(vend,pr) \ -+#define XPAD_XBOX360_VENDOR_PROTOCOL(vend, pr) \ - .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \ - .idVendor = (vend), \ - .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \ - .bInterfaceSubClass = 93, \ - .bInterfaceProtocol = (pr) - #define XPAD_XBOX360_VENDOR(vend) \ -- { XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \ -- { XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) } -+ { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 1) }, \ -+ { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 129) } - - /* The Xbox One controller uses subclass 71 and protocol 208. */ - #define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \ -@@ -292,33 +412,138 @@ static const signed short xpad_abs_triggers[] = { - .bInterfaceSubClass = 71, \ - .bInterfaceProtocol = (pr) - #define XPAD_XBOXONE_VENDOR(vend) \ -- { XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) } -+ { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) } - --static struct usb_device_id xpad_table[] = { -+static const struct usb_device_id xpad_table[] = { - { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */ -+ XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */ - XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */ - XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ - XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ - XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */ -+ XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */ -+ XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */ - XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */ - { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */ -+ XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */ -+ XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz GamePad */ - XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f X-Box 360 controllers */ -+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */ -+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ -+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ -+ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ - XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ - XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ - XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */ -- XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ -- XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ -- XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ -- XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */ - XPAD_XBOX360_VENDOR(0x1532), /* Razer Sabertooth */ - XPAD_XBOXONE_VENDOR(0x1532), /* Razer Wildcat */ - XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */ - XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ -+ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ -+ XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ -+ XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */ -+ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */ - { } - }; - - MODULE_DEVICE_TABLE(usb, xpad_table); - -+struct xboxone_init_packet { -+ u16 idVendor; -+ u16 idProduct; -+ const u8 *data; -+ u8 len; -+}; -+ -+#define XBOXONE_INIT_PKT(_vid, _pid, _data) \ -+ { \ -+ .idVendor = (_vid), \ -+ .idProduct = (_pid), \ -+ .data = (_data), \ -+ .len = ARRAY_SIZE(_data), \ -+ } -+ -+ -+/* -+ * This packet is required for all Xbox One pads with 2015 -+ * or later firmware installed (or present from the factory). -+ */ -+static const u8 xboxone_fw2015_init[] = { -+ 0x05, 0x20, 0x00, 0x01, 0x00 -+}; -+ -+/* -+ * This packet is required for the Titanfall 2 Xbox One pads -+ * (0x0e6f:0x0165) to finish initialization and for Hori pads -+ * (0x0f0d:0x0067) to make the analog sticks work. -+ */ -+static const u8 xboxone_hori_init[] = { -+ 0x01, 0x20, 0x00, 0x09, 0x00, 0x04, 0x20, 0x3a, -+ 0x00, 0x00, 0x00, 0x80, 0x00 -+}; -+ -+/* -+ * This packet is required for some of the PDP pads to start -+ * sending input reports. These pads include: (0x0e6f:0x02ab), -+ * (0x0e6f:0x02a4). -+ */ -+static const u8 xboxone_pdp_init1[] = { -+ 0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14 -+}; -+ -+/* -+ * This packet is required for some of the PDP pads to start -+ * sending input reports. These pads include: (0x0e6f:0x02ab), -+ * (0x0e6f:0x02a4). -+ */ -+static const u8 xboxone_pdp_init2[] = { -+ 0x06, 0x20, 0x00, 0x02, 0x01, 0x00 -+}; -+ -+/* -+ * A specific rumble packet is required for some PowerA pads to start -+ * sending input reports. One of those pads is (0x24c6:0x543a). -+ */ -+static const u8 xboxone_rumblebegin_init[] = { -+ 0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00, -+ 0x1D, 0x1D, 0xFF, 0x00, 0x00 -+}; -+ -+/* -+ * A rumble packet with zero FF intensity will immediately -+ * terminate the rumbling required to init PowerA pads. -+ * This should happen fast enough that the motors don't -+ * spin up to enough speed to actually vibrate the gamepad. -+ */ -+static const u8 xboxone_rumbleend_init[] = { -+ 0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+/* -+ * This specifies the selection of init packets that a gamepad -+ * will be sent on init *and* the order in which they will be -+ * sent. The correct sequence number will be added when the -+ * packet is going to be sent. -+ */ -+static const struct xboxone_init_packet xboxone_init_packets[] = { -+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), -+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), -+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1), -+ XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2), -+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), -+ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), -+ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), -+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumbleend_init), -+ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumbleend_init), -+ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumbleend_init), -+}; -+ - struct xpad_output_packet { - u8 data[XPAD_PKT_LEN]; - u8 len; -@@ -334,23 +559,28 @@ struct xpad_output_packet { - - struct usb_xpad { - struct input_dev *dev; /* input device interface */ -+ struct input_dev __rcu *x360w_dev; - struct usb_device *udev; /* usb device */ - struct usb_interface *intf; /* usb interface */ - -- int pad_present; -+ bool pad_present; -+ bool input_created; - - struct urb *irq_in; /* urb for interrupt in report */ - unsigned char *idata; /* input data */ - dma_addr_t idata_dma; - - struct urb *irq_out; /* urb for interrupt out report */ -+ struct usb_anchor irq_out_anchor; - bool irq_out_active; /* we must not use an active URB */ -+ u8 odata_serial; /* serial number for xbox one protocol */ - unsigned char *odata; /* output data */ - dma_addr_t odata_dma; - spinlock_t odata_lock; - - struct xpad_output_packet out_packets[XPAD_NUM_OUT_PACKETS]; - int last_out_packet; -+ int init_seq; - - #if defined(CONFIG_JOYSTICK_XPAD_LEDS) - struct xpad_led *led; -@@ -362,8 +592,13 @@ struct usb_xpad { - int xtype; /* type of xbox device */ - int pad_nr; /* the order x360 pads were attached */ - const char *name; /* name of the device */ -+ struct work_struct work; /* init/remove device from callback */ - }; - -+static int xpad_init_input(struct usb_xpad *xpad); -+static void xpad_deinit_input(struct usb_xpad *xpad); -+static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num); -+ - /* - * xpad_process_packet - * -@@ -443,10 +678,12 @@ static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *d - * http://www.free60.org/wiki/Gamepad - */ - --static void xpad360_process_packet(struct usb_xpad *xpad, -+static void xpad360_process_packet(struct usb_xpad *xpad, struct input_dev *dev, - u16 cmd, unsigned char *data) - { -- struct input_dev *dev = xpad->dev; -+ /* valid pad data */ -+ if (data[0] != 0x00) -+ return; - - /* digital pad */ - if (xpad->mapping & MAP_DPAD_TO_BUTTONS) { -@@ -514,7 +751,30 @@ static void xpad360_process_packet(struct usb_xpad *xpad, - input_sync(dev); - } - --static void xpad_identify_controller(struct usb_xpad *xpad); -+static void xpad_presence_work(struct work_struct *work) -+{ -+ struct usb_xpad *xpad = container_of(work, struct usb_xpad, work); -+ int error; -+ -+ if (xpad->pad_present) { -+ error = xpad_init_input(xpad); -+ if (error) { -+ /* complain only, not much else we can do here */ -+ dev_err(&xpad->dev->dev, -+ "unable to init device: %d\n", error); -+ } else { -+ rcu_assign_pointer(xpad->x360w_dev, xpad->dev); -+ } -+ } else { -+ RCU_INIT_POINTER(xpad->x360w_dev, NULL); -+ synchronize_rcu(); -+ /* -+ * Now that we are sure xpad360w_process_packet is not -+ * using input device we can get rid of it. -+ */ -+ xpad_deinit_input(xpad); -+ } -+} - - /* - * xpad360w_process_packet -@@ -532,35 +792,61 @@ static void xpad_identify_controller(struct usb_xpad *xpad); - */ - static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data) - { -+ struct input_dev *dev; -+ bool present; -+ - /* Presence change */ - if (data[0] & 0x08) { -- if (data[1] & 0x80) { -- xpad->pad_present = 1; -- /* -- * Light up the segment corresponding to -- * controller number. -- */ -- xpad_identify_controller(xpad); -- } else -- xpad->pad_present = 0; -+ present = (data[1] & 0x80) != 0; -+ -+ if (xpad->pad_present != present) { -+ xpad->pad_present = present; -+ schedule_work(&xpad->work); -+ } - } - - /* Valid pad data */ -- if (!(data[1] & 0x1)) -+ if (data[1] != 0x1) - return; - -- xpad360_process_packet(xpad, cmd, &data[4]); -+ rcu_read_lock(); -+ dev = rcu_dereference(xpad->x360w_dev); -+ if (dev) -+ xpad360_process_packet(xpad, dev, cmd, &data[4]); -+ rcu_read_unlock(); - } - - /* -- * xpadone_process_buttons -+ * xpadone_process_packet - * -- * Process a button update packet from an Xbox one controller. -+ * Completes a request by converting the data into events for the -+ * input subsystem. This version is for the Xbox One controller. -+ * -+ * The report format was gleaned from -+ * https://github.com/kylelemons/xbox/blob/master/xbox.go - */ --static void xpadone_process_buttons(struct usb_xpad *xpad, -- struct input_dev *dev, -- unsigned char *data) -+static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data) - { -+ struct input_dev *dev = xpad->dev; -+ -+ /* the xbox button has its own special report */ -+ if (data[0] == 0X07) { -+ /* -+ * The Xbox One S controller requires these reports to be -+ * acked otherwise it continues sending them forever and -+ * won't report further mode button events. -+ */ -+ if (data[1] == 0x30) -+ xpadone_ack_mode_report(xpad, data[2]); -+ -+ input_report_key(dev, BTN_MODE, data[4] & 0x01); -+ input_sync(dev); -+ return; -+ } -+ /* check invalid packet */ -+ else if (data[0] != 0X20) -+ return; -+ - /* menu/view buttons */ - input_report_key(dev, BTN_START, data[4] & 0x04); - input_report_key(dev, BTN_SELECT, data[4] & 0x08); -@@ -623,34 +909,6 @@ static void xpadone_process_buttons(struct usb_xpad *xpad, - input_sync(dev); - } - --/* -- * xpadone_process_packet -- * -- * Completes a request by converting the data into events for the -- * input subsystem. This version is for the Xbox One controller. -- * -- * The report format was gleaned from -- * https://github.com/kylelemons/xbox/blob/master/xbox.go -- */ -- --static void xpadone_process_packet(struct usb_xpad *xpad, -- u16 cmd, unsigned char *data) --{ -- struct input_dev *dev = xpad->dev; -- -- switch (data[0]) { -- case 0x20: -- xpadone_process_buttons(xpad, dev, data); -- break; -- -- case 0x07: -- /* the xbox button has its own special report */ -- input_report_key(dev, BTN_MODE, data[4] & 0x01); -- input_sync(dev); -- break; -- } --} -- - static void xpad_irq_in(struct urb *urb) - { - struct usb_xpad *xpad = urb->context; -@@ -678,7 +936,7 @@ static void xpad_irq_in(struct urb *urb) - - switch (xpad->xtype) { - case XTYPE_XBOX360: -- xpad360_process_packet(xpad, 0, xpad->idata); -+ xpad360_process_packet(xpad, xpad->dev, 0, xpad->idata); - break; - case XTYPE_XBOX360W: - xpad360w_process_packet(xpad, 0, xpad->idata); -@@ -697,12 +955,48 @@ exit: - __func__, retval); - } - -+/* Callers must hold xpad->odata_lock spinlock */ -+static bool xpad_prepare_next_init_packet(struct usb_xpad *xpad) -+{ -+ const struct xboxone_init_packet *init_packet; -+ -+ if (xpad->xtype != XTYPE_XBOXONE) -+ return false; -+ -+ /* Perform initialization sequence for Xbox One pads that require it */ -+ while (xpad->init_seq < ARRAY_SIZE(xboxone_init_packets)) { -+ init_packet = &xboxone_init_packets[xpad->init_seq++]; -+ -+ if (init_packet->idVendor != 0 && -+ init_packet->idVendor != xpad->dev->id.vendor) -+ continue; -+ -+ if (init_packet->idProduct != 0 && -+ init_packet->idProduct != xpad->dev->id.product) -+ continue; -+ -+ /* This packet applies to our device, so prepare to send it */ -+ memcpy(xpad->odata, init_packet->data, init_packet->len); -+ xpad->irq_out->transfer_buffer_length = init_packet->len; -+ -+ /* Update packet with current sequence number */ -+ xpad->odata[2] = xpad->odata_serial++; -+ return true; -+ } -+ -+ return false; -+} -+ - /* Callers must hold xpad->odata_lock spinlock */ - static bool xpad_prepare_next_out_packet(struct usb_xpad *xpad) - { - struct xpad_output_packet *pkt, *packet = NULL; - int i; - -+ /* We may have init packets to send before we can send user commands */ -+ if (xpad_prepare_next_init_packet(xpad)) -+ return true; -+ - for (i = 0; i < XPAD_NUM_OUT_PACKETS; i++) { - if (++xpad->last_out_packet >= XPAD_NUM_OUT_PACKETS) - xpad->last_out_packet = 0; -@@ -733,11 +1027,13 @@ static int xpad_try_sending_next_out_packet(struct usb_xpad *xpad) - int error; - - if (!xpad->irq_out_active && xpad_prepare_next_out_packet(xpad)) { -+ usb_anchor_urb(xpad->irq_out, &xpad->irq_out_anchor); - error = usb_submit_urb(xpad->irq_out, GFP_ATOMIC); - if (error) { - dev_err(&xpad->intf->dev, - "%s - usb_submit_urb failed with result %d\n", - __func__, error); -+ usb_unanchor_urb(xpad->irq_out); - return -EIO; - } - -@@ -779,11 +1075,13 @@ static void xpad_irq_out(struct urb *urb) - } - - if (xpad->irq_out_active) { -+ usb_anchor_urb(urb, &xpad->irq_out_anchor); - error = usb_submit_urb(urb, GFP_ATOMIC); - if (error) { - dev_err(dev, - "%s - usb_submit_urb failed with result %d\n", - __func__, error); -+ usb_unanchor_urb(urb); - xpad->irq_out_active = false; - } - } -@@ -791,34 +1089,29 @@ static void xpad_irq_out(struct urb *urb) - spin_unlock_irqrestore(&xpad->odata_lock, flags); - } - --static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) -+static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad, -+ struct usb_endpoint_descriptor *ep_irq_out) - { -- struct usb_endpoint_descriptor *ep_irq_out; -- int ep_irq_out_idx; - int error; - - if (xpad->xtype == XTYPE_UNKNOWN) - return 0; - -+ init_usb_anchor(&xpad->irq_out_anchor); -+ - xpad->odata = usb_alloc_coherent(xpad->udev, XPAD_PKT_LEN, - GFP_KERNEL, &xpad->odata_dma); -- if (!xpad->odata) { -- error = -ENOMEM; -- goto fail1; -- } -+ if (!xpad->odata) -+ return -ENOMEM; - - spin_lock_init(&xpad->odata_lock); - - xpad->irq_out = usb_alloc_urb(0, GFP_KERNEL); - if (!xpad->irq_out) { - error = -ENOMEM; -- goto fail2; -+ goto err_free_coherent; - } - -- /* Xbox One controller has in/out endpoints swapped. */ -- ep_irq_out_idx = xpad->xtype == XTYPE_XBOXONE ? 0 : 1; -- ep_irq_out = &intf->cur_altsetting->endpoint[ep_irq_out_idx].desc; -- - usb_fill_int_urb(xpad->irq_out, xpad->udev, - usb_sndintpipe(xpad->udev, ep_irq_out->bEndpointAddress), - xpad->odata, XPAD_PKT_LEN, -@@ -828,14 +1121,21 @@ static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) - - return 0; - -- fail2: usb_free_coherent(xpad->udev, XPAD_PKT_LEN, xpad->odata, xpad->odata_dma); -- fail1: return error; -+err_free_coherent: -+ usb_free_coherent(xpad->udev, XPAD_PKT_LEN, xpad->odata, xpad->odata_dma); -+ return error; - } - - static void xpad_stop_output(struct usb_xpad *xpad) - { -- if (xpad->xtype != XTYPE_UNKNOWN) -- usb_kill_urb(xpad->irq_out); -+ if (xpad->xtype != XTYPE_UNKNOWN) { -+ if (!usb_wait_anchor_empty_timeout(&xpad->irq_out_anchor, -+ 5000)) { -+ dev_warn(&xpad->intf->dev, -+ "timed out waiting for output URB to complete, killing\n"); -+ usb_kill_anchored_urbs(&xpad->irq_out_anchor); -+ } -+ } - } - - static void xpad_deinit_output(struct usb_xpad *xpad) -@@ -882,21 +1182,17 @@ static int xpad_inquiry_pad_presence(struct usb_xpad *xpad) - - static int xpad_start_xbox_one(struct usb_xpad *xpad) - { -- struct xpad_output_packet *packet = -- &xpad->out_packets[XPAD_OUT_CMD_IDX]; - unsigned long flags; - int retval; - - spin_lock_irqsave(&xpad->odata_lock, flags); - -- /* Xbox one controller needs to be initialized. */ -- packet->data[0] = 0x05; -- packet->data[1] = 0x20; -- packet->len = 2; -- packet->pending = true; -- -- /* Reset the sequence so we send out start packet first */ -- xpad->last_out_packet = -1; -+ /* -+ * Begin the init sequence by attempting to send a packet. -+ * We will cycle through the init packet sequence before -+ * sending any packets from the output ring. -+ */ -+ xpad->init_seq = 0; - retval = xpad_try_sending_next_out_packet(xpad); - - spin_unlock_irqrestore(&xpad->odata_lock, flags); -@@ -904,6 +1200,30 @@ static int xpad_start_xbox_one(struct usb_xpad *xpad) - return retval; - } - -+static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num) -+{ -+ unsigned long flags; -+ struct xpad_output_packet *packet = -+ &xpad->out_packets[XPAD_OUT_CMD_IDX]; -+ static const u8 mode_report_ack[] = { -+ 0x01, 0x20, 0x00, 0x09, 0x00, 0x07, 0x20, 0x02, -+ 0x00, 0x00, 0x00, 0x00, 0x00 -+ }; -+ -+ spin_lock_irqsave(&xpad->odata_lock, flags); -+ -+ packet->len = sizeof(mode_report_ack); -+ memcpy(packet->data, mode_report_ack, packet->len); -+ packet->data[2] = seq_num; -+ packet->pending = true; -+ -+ /* Reset the sequence so we send out the ack now */ -+ xpad->last_out_packet = -1; -+ xpad_try_sending_next_out_packet(xpad); -+ -+ spin_unlock_irqrestore(&xpad->odata_lock, flags); -+} -+ - #ifdef CONFIG_JOYSTICK_XPAD_FF - static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect) - { -@@ -966,18 +1286,19 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect - - case XTYPE_XBOXONE: - packet->data[0] = 0x09; /* activate rumble */ -- packet->data[1] = 0x08; -- packet->data[2] = 0x00; -- packet->data[3] = 0x08; /* continuous effect */ -- packet->data[4] = 0x00; /* simple rumble mode */ -- packet->data[5] = 0x03; /* L and R actuator only */ -- packet->data[6] = 0x00; /* TODO: LT actuator */ -- packet->data[7] = 0x00; /* TODO: RT actuator */ -- packet->data[8] = strong / 256; /* left actuator */ -- packet->data[9] = weak / 256; /* right actuator */ -- packet->data[10] = 0x80; /* length of pulse */ -- packet->data[11] = 0x00; /* stop period of pulse */ -- packet->len = 12; -+ packet->data[1] = 0x00; -+ packet->data[2] = xpad->odata_serial++; -+ packet->data[3] = 0x09; -+ packet->data[4] = 0x00; -+ packet->data[5] = 0x0F; -+ packet->data[6] = 0x00; -+ packet->data[7] = 0x00; -+ packet->data[8] = strong / 512; /* left actuator */ -+ packet->data[9] = weak / 512; /* right actuator */ -+ packet->data[10] = 0xFF; /* on period */ -+ packet->data[11] = 0x00; /* off period */ -+ packet->data[12] = 0xFF; /* repeat count */ -+ packet->len = 13; - packet->pending = true; - break; - -@@ -1090,7 +1411,7 @@ static void xpad_send_led_command(struct usb_xpad *xpad, int command) - */ - static void xpad_identify_controller(struct usb_xpad *xpad) - { -- xpad_send_led_command(xpad, (xpad->pad_nr % 4) + 2); -+ led_set_brightness(&xpad->led->led_cdev, (xpad->pad_nr % 4) + 2); - } - - static void xpad_led_set(struct led_classdev *led_cdev, -@@ -1127,19 +1448,13 @@ static int xpad_led_probe(struct usb_xpad *xpad) - led_cdev = &led->led_cdev; - led_cdev->name = led->name; - led_cdev->brightness_set = xpad_led_set; -+ led_cdev->flags = LED_CORE_SUSPENDRESUME; - - error = led_classdev_register(&xpad->udev->dev, led_cdev); - if (error) - goto err_free_id; - -- if (xpad->xtype == XTYPE_XBOX360) { -- /* -- * Light up the segment corresponding to controller -- * number on wired devices. On wireless we'll do that -- * when they respond to "presence" packet. -- */ -- xpad_identify_controller(xpad); -- } -+ xpad_identify_controller(xpad); - - return 0; - -@@ -1164,41 +1479,110 @@ static void xpad_led_disconnect(struct usb_xpad *xpad) - #else - static int xpad_led_probe(struct usb_xpad *xpad) { return 0; } - static void xpad_led_disconnect(struct usb_xpad *xpad) { } --static void xpad_identify_controller(struct usb_xpad *xpad) { } - #endif - --static int xpad_open(struct input_dev *dev) -+static int xpad_start_input(struct usb_xpad *xpad) - { -- struct usb_xpad *xpad = input_get_drvdata(dev); -- -- /* URB was submitted in probe */ -- if (xpad->xtype == XTYPE_XBOX360W) -- return 0; -+ int error; - -- xpad->irq_in->dev = xpad->udev; - if (usb_submit_urb(xpad->irq_in, GFP_KERNEL)) - return -EIO; - -- if (xpad->xtype == XTYPE_XBOXONE) -- return xpad_start_xbox_one(xpad); -+ if (xpad->xtype == XTYPE_XBOXONE) { -+ error = xpad_start_xbox_one(xpad); -+ if (error) { -+ usb_kill_urb(xpad->irq_in); -+ return error; -+ } -+ } - - return 0; - } - --static void xpad_close(struct input_dev *dev) -+static void xpad_stop_input(struct usb_xpad *xpad) - { -- struct usb_xpad *xpad = input_get_drvdata(dev); -+ usb_kill_urb(xpad->irq_in); -+} - -- if (xpad->xtype != XTYPE_XBOX360W) -+static void xpad360w_poweroff_controller(struct usb_xpad *xpad) -+{ -+ unsigned long flags; -+ struct xpad_output_packet *packet = -+ &xpad->out_packets[XPAD_OUT_CMD_IDX]; -+ -+ spin_lock_irqsave(&xpad->odata_lock, flags); -+ -+ packet->data[0] = 0x00; -+ packet->data[1] = 0x00; -+ packet->data[2] = 0x08; -+ packet->data[3] = 0xC0; -+ packet->data[4] = 0x00; -+ packet->data[5] = 0x00; -+ packet->data[6] = 0x00; -+ packet->data[7] = 0x00; -+ packet->data[8] = 0x00; -+ packet->data[9] = 0x00; -+ packet->data[10] = 0x00; -+ packet->data[11] = 0x00; -+ packet->len = 12; -+ packet->pending = true; -+ -+ /* Reset the sequence so we send out poweroff now */ -+ xpad->last_out_packet = -1; -+ xpad_try_sending_next_out_packet(xpad); -+ -+ spin_unlock_irqrestore(&xpad->odata_lock, flags); -+} -+ -+static int xpad360w_start_input(struct usb_xpad *xpad) -+{ -+ int error; -+ -+ error = usb_submit_urb(xpad->irq_in, GFP_KERNEL); -+ if (error) -+ return -EIO; -+ -+ /* -+ * Send presence packet. -+ * This will force the controller to resend connection packets. -+ * This is useful in the case we activate the module after the -+ * adapter has been plugged in, as it won't automatically -+ * send us info about the controllers. -+ */ -+ error = xpad_inquiry_pad_presence(xpad); -+ if (error) { - usb_kill_urb(xpad->irq_in); -+ return error; -+ } - -- xpad_stop_output(xpad); -+ return 0; -+} -+ -+static void xpad360w_stop_input(struct usb_xpad *xpad) -+{ -+ usb_kill_urb(xpad->irq_in); -+ -+ /* Make sure we are done with presence work if it was scheduled */ -+ flush_work(&xpad->work); -+} -+ -+static int xpad_open(struct input_dev *dev) -+{ -+ struct usb_xpad *xpad = input_get_drvdata(dev); -+ -+ return xpad_start_input(xpad); -+} -+ -+static void xpad_close(struct input_dev *dev) -+{ -+ struct usb_xpad *xpad = input_get_drvdata(dev); -+ -+ xpad_stop_input(xpad); - } - - static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) - { - struct usb_xpad *xpad = input_get_drvdata(input_dev); -- set_bit(abs, input_dev->absbit); - - switch (abs) { - case ABS_X: -@@ -1218,13 +1602,19 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) - case ABS_HAT0Y: /* the d-pad (only if dpad is mapped to axes */ - input_set_abs_params(input_dev, abs, -1, 1, 0, 0); - break; -+ default: -+ input_set_abs_params(input_dev, abs, 0, 0, 0, 0); -+ break; - } - } - - static void xpad_deinit_input(struct usb_xpad *xpad) - { -- xpad_led_disconnect(xpad); -- input_unregister_device(xpad->dev); -+ if (xpad->input_created) { -+ xpad->input_created = false; -+ xpad_led_disconnect(xpad); -+ input_unregister_device(xpad->dev); -+ } - } - - static int xpad_init_input(struct usb_xpad *xpad) -@@ -1250,13 +1640,12 @@ static int xpad_init_input(struct usb_xpad *xpad) - - input_set_drvdata(input_dev, xpad); - -- input_dev->open = xpad_open; -- input_dev->close = xpad_close; -- -- __set_bit(EV_KEY, input_dev->evbit); -+ if (xpad->xtype != XTYPE_XBOX360W) { -+ input_dev->open = xpad_open; -+ input_dev->close = xpad_close; -+ } - - if (!(xpad->mapping & MAP_STICKS_TO_NULL)) { -- __set_bit(EV_ABS, input_dev->evbit); - /* set up axes */ - for (i = 0; xpad_abs[i] >= 0; i++) - xpad_set_up_abs(input_dev, xpad_abs[i]); -@@ -1264,21 +1653,22 @@ static int xpad_init_input(struct usb_xpad *xpad) - - /* set up standard buttons */ - for (i = 0; xpad_common_btn[i] >= 0; i++) -- __set_bit(xpad_common_btn[i], input_dev->keybit); -+ input_set_capability(input_dev, EV_KEY, xpad_common_btn[i]); - - /* set up model-specific ones */ - if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W || - xpad->xtype == XTYPE_XBOXONE) { - for (i = 0; xpad360_btn[i] >= 0; i++) -- __set_bit(xpad360_btn[i], input_dev->keybit); -+ input_set_capability(input_dev, EV_KEY, xpad360_btn[i]); - } else { - for (i = 0; xpad_btn[i] >= 0; i++) -- __set_bit(xpad_btn[i], input_dev->keybit); -+ input_set_capability(input_dev, EV_KEY, xpad_btn[i]); - } - - if (xpad->mapping & MAP_DPAD_TO_BUTTONS) { - for (i = 0; xpad_btn_pad[i] >= 0; i++) -- __set_bit(xpad_btn_pad[i], input_dev->keybit); -+ input_set_capability(input_dev, EV_KEY, -+ xpad_btn_pad[i]); - } - - /* -@@ -1295,7 +1685,8 @@ static int xpad_init_input(struct usb_xpad *xpad) - - if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) { - for (i = 0; xpad_btn_triggers[i] >= 0; i++) -- __set_bit(xpad_btn_triggers[i], input_dev->keybit); -+ input_set_capability(input_dev, EV_KEY, -+ xpad_btn_triggers[i]); - } else { - for (i = 0; xpad_abs_triggers[i] >= 0; i++) - xpad_set_up_abs(input_dev, xpad_abs_triggers[i]); -@@ -1313,6 +1704,7 @@ static int xpad_init_input(struct usb_xpad *xpad) - if (error) - goto err_disconnect_led; - -+ xpad->input_created = true; - return 0; - - err_disconnect_led: -@@ -1328,8 +1720,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id - { - struct usb_device *udev = interface_to_usbdev(intf); - struct usb_xpad *xpad; -- struct usb_endpoint_descriptor *ep_irq_in; -- int ep_irq_in_idx; -+ struct usb_endpoint_descriptor *ep_irq_in, *ep_irq_out; - int i, error; - - if (intf->cur_altsetting->desc.bNumEndpoints != 2) -@@ -1366,6 +1757,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id - xpad->mapping = xpad_device[i].mapping; - xpad->xtype = xpad_device[i].xtype; - xpad->name = xpad_device[i].name; -+ INIT_WORK(&xpad->work, xpad_presence_work); - - if (xpad->xtype == XTYPE_UNKNOWN) { - if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) { -@@ -1398,13 +1790,28 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id - goto err_free_in_urb; - } - -- error = xpad_init_output(intf, xpad); -- if (error) -+ ep_irq_in = ep_irq_out = NULL; -+ -+ for (i = 0; i < 2; i++) { -+ struct usb_endpoint_descriptor *ep = -+ &intf->cur_altsetting->endpoint[i].desc; -+ -+ if (usb_endpoint_xfer_int(ep)) { -+ if (usb_endpoint_dir_in(ep)) -+ ep_irq_in = ep; -+ else -+ ep_irq_out = ep; -+ } -+ } -+ -+ if (!ep_irq_in || !ep_irq_out) { -+ error = -ENODEV; - goto err_free_in_urb; -+ } - -- /* Xbox One controller has in/out endpoints swapped. */ -- ep_irq_in_idx = xpad->xtype == XTYPE_XBOXONE ? 1 : 0; -- ep_irq_in = &intf->cur_altsetting->endpoint[ep_irq_in_idx].desc; -+ error = xpad_init_output(intf, xpad, ep_irq_out); -+ if (error) -+ goto err_free_in_urb; - - usb_fill_int_urb(xpad->irq_in, udev, - usb_rcvintpipe(udev, ep_irq_in->bEndpointAddress), -@@ -1415,10 +1822,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id - - usb_set_intfdata(intf, xpad); - -- error = xpad_init_input(xpad); -- if (error) -- goto err_deinit_output; -- - if (xpad->xtype == XTYPE_XBOX360W) { - /* - * Submit the int URB immediately rather than waiting for open -@@ -1427,28 +1830,24 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id - * exactly the message that a controller has arrived that - * we're waiting for. - */ -- xpad->irq_in->dev = xpad->udev; -- error = usb_submit_urb(xpad->irq_in, GFP_KERNEL); -+ error = xpad360w_start_input(xpad); - if (error) -- goto err_deinit_input; -- -+ goto err_deinit_output; - /* -- * Send presence packet. -- * This will force the controller to resend connection packets. -- * This is useful in the case we activate the module after the -- * adapter has been plugged in, as it won't automatically -- * send us info about the controllers. -+ * Wireless controllers require RESET_RESUME to work properly -+ * after suspend. Ideally this quirk should be in usb core -+ * quirk list, but we have too many vendors producing these -+ * controllers and we'd need to maintain 2 identical lists -+ * here in this driver and in usb core. - */ -- error = xpad_inquiry_pad_presence(xpad); -+ udev->quirks |= USB_QUIRK_RESET_RESUME; -+ } else { -+ error = xpad_init_input(xpad); - if (error) -- goto err_kill_in_urb; -+ goto err_deinit_output; - } - return 0; - --err_kill_in_urb: -- usb_kill_urb(xpad->irq_in); --err_deinit_input: -- xpad_deinit_input(xpad); - err_deinit_output: - xpad_deinit_output(xpad); - err_free_in_urb: -@@ -1458,19 +1857,24 @@ err_free_idata: - err_free_mem: - kfree(xpad); - return error; -- - } - - static void xpad_disconnect(struct usb_interface *intf) - { -- struct usb_xpad *xpad = usb_get_intfdata (intf); -+ struct usb_xpad *xpad = usb_get_intfdata(intf); -+ -+ if (xpad->xtype == XTYPE_XBOX360W) -+ xpad360w_stop_input(xpad); - - xpad_deinit_input(xpad); -- xpad_deinit_output(xpad); - -- if (xpad->xtype == XTYPE_XBOX360W) { -- usb_kill_urb(xpad->irq_in); -- } -+ /* -+ * Now that both input device and LED device are gone we can -+ * stop output URB. -+ */ -+ xpad_stop_output(xpad); -+ -+ xpad_deinit_output(xpad); - - usb_free_urb(xpad->irq_in); - usb_free_coherent(xpad->udev, XPAD_PKT_LEN, -@@ -1481,10 +1885,72 @@ static void xpad_disconnect(struct usb_interface *intf) - usb_set_intfdata(intf, NULL); - } - -+static int xpad_suspend(struct usb_interface *intf, pm_message_t message) -+{ -+ struct usb_xpad *xpad = usb_get_intfdata(intf); -+ struct input_dev *input = xpad->dev; -+ -+ if (xpad->xtype == XTYPE_XBOX360W) { -+ /* -+ * Wireless controllers always listen to input so -+ * they are notified when controller shows up -+ * or goes away. -+ */ -+ xpad360w_stop_input(xpad); -+ -+ /* -+ * The wireless adapter is going off now, so the -+ * gamepads are going to become disconnected. -+ * Unless explicitly disabled, power them down -+ * so they don't just sit there flashing. -+ */ -+ if (auto_poweroff && xpad->pad_present) -+ xpad360w_poweroff_controller(xpad); -+ } else { -+ mutex_lock(&input->mutex); -+ if (input->users) -+ xpad_stop_input(xpad); -+ mutex_unlock(&input->mutex); -+ } -+ -+ xpad_stop_output(xpad); -+ -+ return 0; -+} -+ -+static int xpad_resume(struct usb_interface *intf) -+{ -+ struct usb_xpad *xpad = usb_get_intfdata(intf); -+ struct input_dev *input = xpad->dev; -+ int retval = 0; -+ -+ if (xpad->xtype == XTYPE_XBOX360W) { -+ retval = xpad360w_start_input(xpad); -+ } else { -+ mutex_lock(&input->mutex); -+ if (input->users) { -+ retval = xpad_start_input(xpad); -+ } else if (xpad->xtype == XTYPE_XBOXONE) { -+ /* -+ * Even if there are no users, we'll send Xbox One pads -+ * the startup sequence so they don't sit there and -+ * blink until somebody opens the input device again. -+ */ -+ retval = xpad_start_xbox_one(xpad); -+ } -+ mutex_unlock(&input->mutex); -+ } -+ -+ return retval; -+} -+ - static struct usb_driver xpad_driver = { - .name = "xpad", - .probe = xpad_probe, - .disconnect = xpad_disconnect, -+ .suspend = xpad_suspend, -+ .resume = xpad_resume, -+ .reset_resume = xpad_resume, - .id_table = xpad_table, - }; - -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index eab132778e67..1dbee1cb3df9 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -423,6 +423,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, - } - EXPORT_SYMBOL_GPL(can_put_echo_skb); - -+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) -+{ -+ struct can_priv *priv = netdev_priv(dev); -+ struct sk_buff *skb = priv->echo_skb[idx]; -+ struct canfd_frame *cf; -+ -+ if (idx >= priv->echo_skb_max) { -+ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", -+ __func__, idx, priv->echo_skb_max); -+ return NULL; -+ } -+ -+ if (!skb) { -+ netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", -+ __func__, idx); -+ return NULL; -+ } -+ -+ /* Using "struct canfd_frame::len" for the frame -+ * length is supported on both CAN and CANFD frames. -+ */ -+ cf = (struct canfd_frame *)skb->data; -+ *len_ptr = cf->len; -+ priv->echo_skb[idx] = NULL; -+ -+ return skb; -+} -+ - /* - * Get the skb from the stack and loop it back locally - * -@@ -432,22 +460,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); - */ - unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx) - { -- struct can_priv *priv = netdev_priv(dev); -- -- BUG_ON(idx >= priv->echo_skb_max); -- -- if (priv->echo_skb[idx]) { -- struct sk_buff *skb = priv->echo_skb[idx]; -- struct can_frame *cf = (struct can_frame *)skb->data; -- u8 dlc = cf->can_dlc; -+ struct sk_buff *skb; -+ u8 len; - -- netif_rx(priv->echo_skb[idx]); -- priv->echo_skb[idx] = NULL; -+ skb = __can_get_echo_skb(dev, idx, &len); -+ if (!skb) -+ return 0; - -- return dlc; -- } -+ netif_rx(skb); - -- return 0; -+ return len; - } - EXPORT_SYMBOL_GPL(can_get_echo_skb); - -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index 4c73feca4842..0565efad6e6e 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -491,7 +491,7 @@ static int bcmgenet_mii_of_init(struct bcmgenet_priv *priv) - if (!compat) - return -ENOMEM; - -- priv->mdio_dn = of_find_compatible_node(dn, NULL, compat); -+ priv->mdio_dn = of_get_compatible_child(dn, compat); - kfree(compat); - if (!priv->mdio_dn) { - dev_err(kdev, "unable to find MDIO bus node\n"); -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 4644357d291a..398068ad0b62 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -4470,7 +4470,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, - } - - ar->free_vdev_map &= ~(1LL << arvif->vdev_id); -+ spin_lock_bh(&ar->data_lock); - list_add(&arvif->list, &ar->arvifs); -+ spin_unlock_bh(&ar->data_lock); - - /* It makes no sense to have firmware do keepalives. mac80211 already - * takes care of this with idle connection polling. -@@ -4603,7 +4605,9 @@ err_peer_delete: - err_vdev_delete: - ath10k_wmi_vdev_delete(ar, arvif->vdev_id); - ar->free_vdev_map |= 1LL << arvif->vdev_id; -+ spin_lock_bh(&ar->data_lock); - list_del(&arvif->list); -+ spin_unlock_bh(&ar->data_lock); - - err: - if (arvif->beacon_buf) { -@@ -4647,7 +4651,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw, - arvif->vdev_id, ret); - - ar->free_vdev_map |= 1LL << arvif->vdev_id; -+ spin_lock_bh(&ar->data_lock); - list_del(&arvif->list); -+ spin_unlock_bh(&ar->data_lock); - - if (arvif->vdev_type == WMI_VDEV_TYPE_AP || - arvif->vdev_type == WMI_VDEV_TYPE_IBSS) { -diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c -index 3dd46c78c1cc..5a595f9f47ff 100644 ---- a/drivers/net/wireless/cw1200/wsm.c -+++ b/drivers/net/wireless/cw1200/wsm.c -@@ -1805,16 +1805,18 @@ static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size) - { - size_t pos = buf->data - buf->begin; - size_t size = pos + extra_size; -+ u8 *tmp; - - size = round_up(size, FWLOAD_BLOCK_SIZE); - -- buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); -- if (buf->begin) { -- buf->data = &buf->begin[pos]; -- buf->end = &buf->begin[size]; -- return 0; -- } else { -- buf->end = buf->data = buf->begin; -+ tmp = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); -+ if (!tmp) { -+ wsm_buf_deinit(buf); - return -ENOMEM; - } -+ -+ buf->begin = tmp; -+ buf->data = &buf->begin[pos]; -+ buf->end = &buf->begin[size]; -+ return 0; - } -diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -index 984cd2f05c4a..7b2a7d848a56 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -@@ -322,8 +322,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy, - goto out; - } - -- if (changed) -- *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE); -+ if (changed) { -+ u32 status = le32_to_cpu(resp->status); -+ -+ *changed = (status == MCC_RESP_NEW_CHAN_PROFILE || -+ status == MCC_RESP_ILLEGAL); -+ } - - regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg, - __le32_to_cpu(resp->n_channels), -@@ -4050,10 +4054,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw, - struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); - struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); - -- if (!fw_has_capa(&mvm->fw->ucode_capa, -- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) -- return; -- - /* if beacon filtering isn't on mac80211 does it anyway */ - if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER)) - return; -diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c -index 2ee0f6fe56a1..5509c5024352 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/nvm.c -+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c -@@ -667,9 +667,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, - - n_channels = __le32_to_cpu(mcc_resp->n_channels); - IWL_DEBUG_LAR(mvm, -- "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n", -- status, mcc, mcc >> 8, mcc & 0xff, -- !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels); -+ "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n", -+ status, mcc, mcc >> 8, mcc & 0xff, n_channels); - - resp_len = sizeof(*mcc_resp) + n_channels * sizeof(__le32); - resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL); -diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c -index 9a8982f581c5..1e074eaf613d 100644 ---- a/drivers/net/wireless/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/mwifiex/cfg80211.c -@@ -1150,6 +1150,12 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy, - priv->adapter->curr_iface_comb.p2p_intf--; - priv->adapter->curr_iface_comb.sta_intf++; - dev->ieee80211_ptr->iftype = type; -+ if (mwifiex_deinit_priv_params(priv)) -+ return -1; -+ if (mwifiex_init_new_priv_params(priv, dev, type)) -+ return -1; -+ if (mwifiex_sta_init_cmd(priv, false, false)) -+ return -1; - break; - case NL80211_IFTYPE_ADHOC: - if (mwifiex_cfg80211_deinit_p2p(priv)) -@@ -2839,8 +2845,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev) - - mwifiex_stop_net_dev_queue(priv->netdev, adapter); - -- skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) -+ skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { -+ skb_unlink(skb, &priv->bypass_txq); - mwifiex_write_data_complete(priv->adapter, skb, 0, -1); -+ } - - if (netif_carrier_ok(priv->netdev)) - netif_carrier_off(priv->netdev); -diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c -index acccd6734e3b..ed8b69d1d65c 100644 ---- a/drivers/net/wireless/mwifiex/wmm.c -+++ b/drivers/net/wireless/mwifiex/wmm.c -@@ -501,8 +501,10 @@ mwifiex_wmm_del_pkts_in_ralist_node(struct mwifiex_private *priv, - struct mwifiex_adapter *adapter = priv->adapter; - struct sk_buff *skb, *tmp; - -- skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) -+ skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) { -+ skb_unlink(skb, &ra_list->skb_head); - mwifiex_write_data_complete(adapter, skb, 0, -1); -+ } - } - - /* -@@ -598,11 +600,15 @@ mwifiex_clean_txrx(struct mwifiex_private *priv) - priv->adapter->if_ops.clean_pcie_ring(priv->adapter); - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); - -- skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) -+ skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) { -+ skb_unlink(skb, &priv->tdls_txq); - mwifiex_write_data_complete(priv->adapter, skb, 0, -1); -+ } - -- skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) -+ skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { -+ skb_unlink(skb, &priv->bypass_txq); - mwifiex_write_data_complete(priv->adapter, skb, 0, -1); -+ } - atomic_set(&priv->adapter->bypass_tx_pending, 0); - - idr_for_each(&priv->ack_status_frames, mwifiex_free_ack_frame, NULL); -diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c -index 6c0c301611c4..1b11ded79c4f 100644 ---- a/drivers/nfc/nfcmrvl/uart.c -+++ b/drivers/nfc/nfcmrvl/uart.c -@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node, - struct device_node *matched_node; - int ret; - -- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart"); -+ matched_node = of_get_compatible_child(node, "marvell,nfc-uart"); - if (!matched_node) { -- matched_node = of_find_compatible_node(node, NULL, -- "mrvl,nfc-uart"); -+ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart"); - if (!matched_node) - return -ENODEV; - } -diff --git a/drivers/of/base.c b/drivers/of/base.c -index 31341290cd91..c6e019208d17 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -712,6 +712,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node, - } - EXPORT_SYMBOL(of_get_next_available_child); - -+/** -+ * of_get_compatible_child - Find compatible child node -+ * @parent: parent node -+ * @compatible: compatible string -+ * -+ * Lookup child node whose compatible property contains the given compatible -+ * string. -+ * -+ * Returns a node pointer with refcount incremented, use of_node_put() on it -+ * when done; or NULL if not found. -+ */ -+struct device_node *of_get_compatible_child(const struct device_node *parent, -+ const char *compatible) -+{ -+ struct device_node *child; -+ -+ for_each_child_of_node(parent, child) { -+ if (of_device_is_compatible(child, compatible)) -+ break; -+ } -+ -+ return child; -+} -+EXPORT_SYMBOL(of_get_compatible_child); -+ - /** - * of_get_child_by_name - Find the child node by name for a given parent - * @node: parent node -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 18b19744398a..ff5df33fc740 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -685,6 +685,11 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd) - srb_t *sp; - int rval; - -+ if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) { -+ cmd->result = DID_NO_CONNECT << 16; -+ goto qc24_fail_command; -+ } -+ - if (ha->flags.eeh_busy) { - if (ha->flags.pci_channel_io_perm_failure) { - ql_dbg(ql_dbg_aer, vha, 0x9010, -diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h -index 42c459a9d3fe..ce5234555cc9 100644 ---- a/drivers/scsi/ufs/ufs.h -+++ b/drivers/scsi/ufs/ufs.h -@@ -45,6 +45,7 @@ - #define QUERY_DESC_MIN_SIZE 2 - #define QUERY_OSF_SIZE (GENERAL_UPIU_REQUEST_SIZE - \ - (sizeof(struct utp_upiu_header))) -+#define RESPONSE_UPIU_SENSE_DATA_LENGTH 18 - - #define UPIU_HEADER_DWORD(byte3, byte2, byte1, byte0)\ - cpu_to_be32((byte3 << 24) | (byte2 << 16) |\ -@@ -383,7 +384,7 @@ struct utp_cmd_rsp { - __be32 residual_transfer_count; - __be32 reserved[4]; - __be16 sense_data_len; -- u8 sense_data[18]; -+ u8 sense_data[RESPONSE_UPIU_SENSE_DATA_LENGTH]; - }; - - /** -diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c -index d15eaa466c59..52b546fb509b 100644 ---- a/drivers/scsi/ufs/ufshcd-pci.c -+++ b/drivers/scsi/ufs/ufshcd-pci.c -@@ -104,6 +104,7 @@ static void ufshcd_pci_remove(struct pci_dev *pdev) - pm_runtime_forbid(&pdev->dev); - pm_runtime_get_noresume(&pdev->dev); - ufshcd_remove(hba); -+ ufshcd_dealloc_host(hba); - } - - /** -@@ -147,6 +148,7 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - err = ufshcd_init(hba, mmio_base, pdev->irq); - if (err) { - dev_err(&pdev->dev, "Initialization failed\n"); -+ ufshcd_dealloc_host(hba); - return err; - } - -diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c -index 9714f2a8b329..f58abfcdfe81 100644 ---- a/drivers/scsi/ufs/ufshcd-pltfrm.c -+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c -@@ -161,7 +161,7 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name, - if (ret) { - dev_err(dev, "%s: unable to find %s err %d\n", - __func__, prop_name, ret); -- goto out_free; -+ goto out; - } - - vreg->min_uA = 0; -@@ -183,9 +183,6 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name, - - goto out; - --out_free: -- devm_kfree(dev, vreg); -- vreg = NULL; - out: - if (!ret) - *out_vreg = vreg; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 8c58adadb728..c94d465de941 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -585,6 +585,21 @@ int ufshcd_hold(struct ufs_hba *hba, bool async) - start: - switch (hba->clk_gating.state) { - case CLKS_ON: -+ /* -+ * Wait for the ungate work to complete if in progress. -+ * Though the clocks may be in ON state, the link could -+ * still be in hibner8 state if hibern8 is allowed -+ * during clock gating. -+ * Make sure we exit hibern8 state also in addition to -+ * clocks being ON. -+ */ -+ if (ufshcd_can_hibern8_during_gating(hba) && -+ ufshcd_is_link_hibern8(hba)) { -+ spin_unlock_irqrestore(hba->host->host_lock, flags); -+ flush_work(&hba->clk_gating.ungate_work); -+ spin_lock_irqsave(hba->host->host_lock, flags); -+ goto start; -+ } - break; - case REQ_CLKS_OFF: - if (cancel_delayed_work(&hba->clk_gating.gate_work)) { -@@ -813,10 +828,14 @@ static inline void ufshcd_copy_sense_data(struct ufshcd_lrb *lrbp) - int len; - if (lrbp->sense_buffer && - ufshcd_get_rsp_upiu_data_seg_len(lrbp->ucd_rsp_ptr)) { -+ int len_to_copy; -+ - len = be16_to_cpu(lrbp->ucd_rsp_ptr->sr.sense_data_len); -+ len_to_copy = min_t(int, RESPONSE_UPIU_SENSE_DATA_LENGTH, len); -+ - memcpy(lrbp->sense_buffer, - lrbp->ucd_rsp_ptr->sr.sense_data, -- min_t(int, len, SCSI_SENSE_BUFFERSIZE)); -+ min_t(int, len_to_copy, SCSI_SENSE_BUFFERSIZE)); - } - } - -@@ -5251,7 +5270,10 @@ EXPORT_SYMBOL(ufshcd_system_suspend); - - int ufshcd_system_resume(struct ufs_hba *hba) - { -- if (!hba || !hba->is_powered || pm_runtime_suspended(hba->dev)) -+ if (!hba) -+ return -EINVAL; -+ -+ if (!hba->is_powered || pm_runtime_suspended(hba->dev)) - /* - * Let the runtime resume take care of resuming - * if runtime suspended. -@@ -5272,7 +5294,10 @@ EXPORT_SYMBOL(ufshcd_system_resume); - */ - int ufshcd_runtime_suspend(struct ufs_hba *hba) - { -- if (!hba || !hba->is_powered) -+ if (!hba) -+ return -EINVAL; -+ -+ if (!hba->is_powered) - return 0; - - return ufshcd_suspend(hba, UFS_RUNTIME_PM); -@@ -5302,10 +5327,13 @@ EXPORT_SYMBOL(ufshcd_runtime_suspend); - */ - int ufshcd_runtime_resume(struct ufs_hba *hba) - { -- if (!hba || !hba->is_powered) -+ if (!hba) -+ return -EINVAL; -+ -+ if (!hba->is_powered) - return 0; -- else -- return ufshcd_resume(hba, UFS_RUNTIME_PM); -+ -+ return ufshcd_resume(hba, UFS_RUNTIME_PM); - } - EXPORT_SYMBOL(ufshcd_runtime_resume); - -@@ -5357,8 +5385,6 @@ void ufshcd_remove(struct ufs_hba *hba) - ufshcd_disable_intr(hba, hba->intr_mask); - ufshcd_hba_stop(hba); - -- scsi_host_put(hba->host); -- - ufshcd_exit_clk_gating(hba); - if (ufshcd_is_clkscaling_enabled(hba)) - devfreq_remove_device(hba->devfreq); -@@ -5483,15 +5509,47 @@ static int ufshcd_devfreq_target(struct device *dev, - { - int err = 0; - struct ufs_hba *hba = dev_get_drvdata(dev); -+ bool release_clk_hold = false; -+ unsigned long irq_flags; - - if (!ufshcd_is_clkscaling_enabled(hba)) - return -EINVAL; - -+ spin_lock_irqsave(hba->host->host_lock, irq_flags); -+ if (ufshcd_eh_in_progress(hba)) { -+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); -+ return 0; -+ } -+ -+ if (ufshcd_is_clkgating_allowed(hba) && -+ (hba->clk_gating.state != CLKS_ON)) { -+ if (cancel_delayed_work(&hba->clk_gating.gate_work)) { -+ /* hold the vote until the scaling work is completed */ -+ hba->clk_gating.active_reqs++; -+ release_clk_hold = true; -+ hba->clk_gating.state = CLKS_ON; -+ } else { -+ /* -+ * Clock gating work seems to be running in parallel -+ * hence skip scaling work to avoid deadlock between -+ * current scaling work and gating work. -+ */ -+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); -+ return 0; -+ } -+ } -+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); -+ - if (*freq == UINT_MAX) - err = ufshcd_scale_clks(hba, true); - else if (*freq == 0) - err = ufshcd_scale_clks(hba, false); - -+ spin_lock_irqsave(hba->host->host_lock, irq_flags); -+ if (release_clk_hold) -+ __ufshcd_release(hba); -+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); -+ - return err; - } - -@@ -5673,7 +5731,6 @@ exit_gating: - ufshcd_exit_clk_gating(hba); - out_disable: - hba->is_irq_enabled = false; -- scsi_host_put(host); - ufshcd_hba_exit(hba); - out_error: - return err; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index b1ec202099b2..b74de014cef1 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -165,15 +165,29 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x, - return put_user(x, ptr); - } - -+/* If we are not echoing the data, perhaps this is a secret so erase it */ -+static inline void zero_buffer(struct tty_struct *tty, u8 *buffer, int size) -+{ -+ bool icanon = !!L_ICANON(tty); -+ bool no_echo = !L_ECHO(tty); -+ -+ if (icanon && no_echo) -+ memset(buffer, 0x00, size); -+} -+ - static inline int tty_copy_to_user(struct tty_struct *tty, - void __user *to, -- const void *from, -+ void *from, - unsigned long n) - { - struct n_tty_data *ldata = tty->disc_data; -+ int retval; - - tty_audit_add_data(tty, from, n, ldata->icanon); -- return copy_to_user(to, from, n); -+ retval = copy_to_user(to, from, n); -+ if (!retval) -+ zero_buffer(tty, from, n); -+ return retval; - } - - /** -@@ -2005,6 +2019,7 @@ static int copy_from_read_buf(struct tty_struct *tty, - is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty); - tty_audit_add_data(tty, read_buf_addr(ldata, tail), n, - ldata->icanon); -+ zero_buffer(tty, read_buf_addr(ldata, tail), n); - smp_store_release(&ldata->read_tail, ldata->read_tail + n); - /* Turn single EOF into zero-length read */ - if (L_EXTPROC(tty) && ldata->icanon && is_eof && -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index 8f3566cde3eb..355e9cad680d 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -454,6 +454,8 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count) - if (count && disc->ops->receive_buf) - disc->ops->receive_buf(tty, p, f, count); - } -+ if (count > 0) -+ memset(p, 0, count); - return count; - } - -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 2facffea2ee0..f7af730aae82 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2757,7 +2757,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, - USB_PORT_FEAT_C_BH_PORT_RESET); - usb_clear_port_feature(hub->hdev, port1, - USB_PORT_FEAT_C_PORT_LINK_STATE); -- usb_clear_port_feature(hub->hdev, port1, -+ -+ if (udev) -+ usb_clear_port_feature(hub->hdev, port1, - USB_PORT_FEAT_C_CONNECTION); - - /* -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index aee29604bd79..5d21cd8359d4 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -744,7 +744,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - status |= USB_PORT_STAT_SUSPEND; - } - if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME && -- !DEV_SUPERSPEED_ANY(raw_port_status)) { -+ !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) { - if ((raw_port_status & PORT_RESET) || - !(raw_port_status & PORT_PE)) - return 0xffffffff; -@@ -790,7 +790,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - time_left = wait_for_completion_timeout( - &bus_state->rexit_done[wIndex], - msecs_to_jiffies( -- XHCI_MAX_REXIT_TIMEOUT)); -+ XHCI_MAX_REXIT_TIMEOUT_MS)); - spin_lock_irqsave(&xhci->lock, flags); - - if (time_left) { -@@ -804,7 +804,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - } else { - int port_status = readl(port_array[wIndex]); - xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n", -- XHCI_MAX_REXIT_TIMEOUT, -+ XHCI_MAX_REXIT_TIMEOUT_MS, - port_status); - status |= USB_PORT_STAT_SUSPEND; - clear_bit(wIndex, &bus_state->rexit_ports); -@@ -1298,13 +1298,16 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - __le32 __iomem **port_array; - struct xhci_bus_state *bus_state; - unsigned long flags; -+ u32 portsc_buf[USB_MAXCHILDREN]; -+ bool wake_enabled; - - max_ports = xhci_get_ports(hcd, &port_array); - bus_state = &xhci->bus_state[hcd_index(hcd)]; -+ wake_enabled = hcd->self.root_hub->do_remote_wakeup; - - spin_lock_irqsave(&xhci->lock, flags); - -- if (hcd->self.root_hub->do_remote_wakeup) { -+ if (wake_enabled) { - if (bus_state->resuming_ports || /* USB2 */ - bus_state->port_remote_wakeup) { /* USB3 */ - spin_unlock_irqrestore(&xhci->lock, flags); -@@ -1312,26 +1315,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - return -EBUSY; - } - } -- -- port_index = max_ports; -+ /* -+ * Prepare ports for suspend, but don't write anything before all ports -+ * are checked and we know bus suspend can proceed -+ */ - bus_state->bus_suspended = 0; -+ port_index = max_ports; - while (port_index--) { -- /* suspend the port if the port is not suspended */ - u32 t1, t2; -- int slot_id; - - t1 = readl(port_array[port_index]); - t2 = xhci_port_state_to_neutral(t1); -+ portsc_buf[port_index] = 0; - -- if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) { -- xhci_dbg(xhci, "port %d not suspended\n", port_index); -- slot_id = xhci_find_slot_id_by_port(hcd, xhci, -- port_index + 1); -- if (slot_id) { -+ /* Bail out if a USB3 port has a new device in link training */ -+ if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { -+ bus_state->bus_suspended = 0; -+ spin_unlock_irqrestore(&xhci->lock, flags); -+ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); -+ return -EBUSY; -+ } -+ -+ /* suspend ports in U0, or bail out for new connect changes */ -+ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { -+ if ((t1 & PORT_CSC) && wake_enabled) { -+ bus_state->bus_suspended = 0; - spin_unlock_irqrestore(&xhci->lock, flags); -- xhci_stop_device(xhci, slot_id, 1); -- spin_lock_irqsave(&xhci->lock, flags); -+ xhci_dbg(xhci, "Bus suspend bailout, port connect change\n"); -+ return -EBUSY; - } -+ xhci_dbg(xhci, "port %d not suspended\n", port_index); - t2 &= ~PORT_PLS_MASK; - t2 |= PORT_LINK_STROBE | XDEV_U3; - set_bit(port_index, &bus_state->bus_suspended); -@@ -1340,7 +1353,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - * including the USB 3.0 roothub, but only if CONFIG_PM - * is enabled, so also enable remote wake here. - */ -- if (hcd->self.root_hub->do_remote_wakeup) { -+ if (wake_enabled) { - if (t1 & PORT_CONNECT) { - t2 |= PORT_WKOC_E | PORT_WKDISC_E; - t2 &= ~PORT_WKCONN_E; -@@ -1353,7 +1366,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - - t1 = xhci_port_state_to_neutral(t1); - if (t1 != t2) -- writel(t2, port_array[port_index]); -+ portsc_buf[port_index] = t2; -+ } -+ -+ /* write port settings, stopping and suspending ports if needed */ -+ port_index = max_ports; -+ while (port_index--) { -+ if (!portsc_buf[port_index]) -+ continue; -+ if (test_bit(port_index, &bus_state->bus_suspended)) { -+ int slot_id; -+ -+ slot_id = xhci_find_slot_id_by_port(hcd, xhci, -+ port_index + 1); -+ if (slot_id) { -+ spin_unlock_irqrestore(&xhci->lock, flags); -+ xhci_stop_device(xhci, slot_id, 1); -+ spin_lock_irqsave(&xhci->lock, flags); -+ } -+ } -+ writel(portsc_buf[port_index], port_array[port_index]); - } - hcd->state = HC_STATE_SUSPENDED; - bus_state->next_statechange = jiffies + msecs_to_jiffies(10); -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index ece0787d62bf..845fa426fa0d 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1673,7 +1673,7 @@ static void handle_port_status(struct xhci_hcd *xhci, - * RExit to a disconnect state). If so, let the the driver know it's - * out of the RExit state. - */ -- if (!DEV_SUPERSPEED_ANY(temp) && -+ if (!DEV_SUPERSPEED_ANY(temp) && hcd->speed < HCD_USB3 && - test_and_clear_bit(faked_port_index, - &bus_state->rexit_ports)) { - complete(&bus_state->rexit_done[faked_port_index]); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 84d8871755b7..0635cea42e6f 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1490,7 +1490,7 @@ struct xhci_bus_state { - * It can take up to 20 ms to transition from RExit to U0 on the - * Intel Lynx Point LP xHCI host. - */ --#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000) -+#define XHCI_MAX_REXIT_TIMEOUT_MS 20 - - static inline unsigned int hcd_index(struct usb_hcd *hcd) - { -diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c -index 5cc00e56206e..7d889f56b8e7 100644 ---- a/fs/9p/vfs_dir.c -+++ b/fs/9p/vfs_dir.c -@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstat *mistat) - return rettype; - } - --static void p9stat_init(struct p9_wstat *stbuf) --{ -- stbuf->name = NULL; -- stbuf->uid = NULL; -- stbuf->gid = NULL; -- stbuf->muid = NULL; -- stbuf->extension = NULL; --} -- - /** - * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir - * @filp: opened file structure -@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) - rdir->tail = n; - } - while (rdir->head < rdir->tail) { -- p9stat_init(&st); - err = p9stat_read(fid->clnt, rdir->buf + rdir->head, - rdir->tail - rdir->head, &st); - if (err) { - p9_debug(P9_DEBUG_VFS, "returned %d\n", err); -- p9stat_free(&st); - return -EIO; - } - reclen = st.size+2; -diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c -index fdcb4d69f430..4714c55c1ae5 100644 ---- a/fs/bfs/inode.c -+++ b/fs/bfs/inode.c -@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) - - s->s_magic = BFS_MAGIC; - -- if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) { -+ if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) || -+ le32_to_cpu(bfs_sb->s_start) < BFS_BSIZE) { - printf("Superblock is corrupted\n"); - goto out1; - } -@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) - sizeof(struct bfs_inode) - + BFS_ROOT_INO - 1; - imap_len = (info->si_lasti / 8) + 1; -- info->si_imap = kzalloc(imap_len, GFP_KERNEL); -- if (!info->si_imap) -+ info->si_imap = kzalloc(imap_len, GFP_KERNEL | __GFP_NOWARN); -+ if (!info->si_imap) { -+ printf("Cannot allocate %u bytes\n", imap_len); - goto out1; -+ } - for (i = 0; i < BFS_ROOT_INO; i++) - set_bit(i, info->si_imap); - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 80cd28456f08..13ff0fdae03e 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -10708,17 +10708,9 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) - u64 start; - u64 end; - u64 trimmed = 0; -- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); - int ret = 0; - -- /* -- * try to trim all FS space, our block group may start from non-zero. -- */ -- if (range->len == total_bytes) -- cache = btrfs_lookup_first_block_group(fs_info, range->start); -- else -- cache = btrfs_lookup_block_group(fs_info, range->start); -- -+ cache = btrfs_lookup_first_block_group(fs_info, range->start); - while (cache) { - if (cache->key.objectid >= (range->start + range->len)) { - btrfs_put_block_group(cache); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 150d3c891815..3379490ce54d 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -378,7 +378,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) - struct fstrim_range range; - u64 minlen = ULLONG_MAX; - u64 num_devices = 0; -- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); - int ret; - - if (!capable(CAP_SYS_ADMIN)) -@@ -402,11 +401,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) - return -EOPNOTSUPP; - if (copy_from_user(&range, arg, sizeof(range))) - return -EFAULT; -- if (range.start > total_bytes || -- range.len < fs_info->sb->s_blocksize) -+ -+ /* -+ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of -+ * block group is in the logical address space, which can be any -+ * sectorsize aligned bytenr in the range [0, U64_MAX]. -+ */ -+ if (range.len < fs_info->sb->s_blocksize) - return -EINVAL; - -- range.len = min(range.len, total_bytes - range.start); - range.minlen = max(range.minlen, minlen); - ret = btrfs_trim_fs(fs_info->tree_root, &range); - if (ret < 0) -diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c -index d9178388cf48..de7143e2b361 100644 ---- a/fs/gfs2/ops_fstype.c -+++ b/fs/gfs2/ops_fstype.c -@@ -71,13 +71,13 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb) - if (!sdp) - return NULL; - -- sb->s_fs_info = sdp; - sdp->sd_vfs = sb; - sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats); - if (!sdp->sd_lkstats) { - kfree(sdp); - return NULL; - } -+ sb->s_fs_info = sdp; - - set_bit(SDF_NOJOURNALID, &sdp->sd_flags); - gfs2_tune_init(&sdp->sd_tune); -diff --git a/fs/namei.c b/fs/namei.c -index de57dd59d95f..40049d61ef37 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -869,6 +869,8 @@ static inline void put_link(struct nameidata *nd) - - int sysctl_protected_symlinks __read_mostly = 0; - int sysctl_protected_hardlinks __read_mostly = 0; -+int sysctl_protected_fifos __read_mostly; -+int sysctl_protected_regular __read_mostly; - - /** - * may_follow_link - Check symlink following for unsafe situations -@@ -982,6 +984,45 @@ static int may_linkat(struct path *link) - return -EPERM; - } - -+/** -+ * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory -+ * should be allowed, or not, on files that already -+ * exist. -+ * @dir: the sticky parent directory -+ * @inode: the inode of the file to open -+ * -+ * Block an O_CREAT open of a FIFO (or a regular file) when: -+ * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled -+ * - the file already exists -+ * - we are in a sticky directory -+ * - we don't own the file -+ * - the owner of the directory doesn't own the file -+ * - the directory is world writable -+ * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 -+ * the directory doesn't have to be world writable: being group writable will -+ * be enough. -+ * -+ * Returns 0 if the open is allowed, -ve on error. -+ */ -+static int may_create_in_sticky(struct dentry * const dir, -+ struct inode * const inode) -+{ -+ if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || -+ (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || -+ likely(!(dir->d_inode->i_mode & S_ISVTX)) || -+ uid_eq(inode->i_uid, dir->d_inode->i_uid) || -+ uid_eq(current_fsuid(), inode->i_uid)) -+ return 0; -+ -+ if (likely(dir->d_inode->i_mode & 0002) || -+ (dir->d_inode->i_mode & 0020 && -+ ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || -+ (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { -+ return -EACCES; -+ } -+ return 0; -+} -+ - static __always_inline - const char *get_link(struct nameidata *nd) - { -@@ -3166,9 +3207,15 @@ finish_open: - error = -ELOOP; - goto out; - } -- error = -EISDIR; -- if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) -- goto out; -+ if (open_flag & O_CREAT) { -+ error = -EISDIR; -+ if (d_is_dir(nd->path.dentry)) -+ goto out; -+ error = may_create_in_sticky(dir, -+ d_backing_inode(nd->path.dentry)); -+ if (unlikely(error)) -+ goto out; -+ } - error = -ENOTDIR; - if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) - goto out; -diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h -index 5f5270941ba0..f7178f44825b 100644 ---- a/include/linux/can/dev.h -+++ b/include/linux/can/dev.h -@@ -154,6 +154,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf, - - void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, - unsigned int idx); -+struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr); - unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx); - void can_free_echo_skb(struct net_device *dev, unsigned int idx); - -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 240cbaee819f..13277d2715df 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -65,6 +65,8 @@ extern struct inodes_stat_t inodes_stat; - extern int leases_enable, lease_break_time; - extern int sysctl_protected_symlinks; - extern int sysctl_protected_hardlinks; -+extern int sysctl_protected_fifos; -+extern int sysctl_protected_regular; - - struct buffer_head; - typedef int (get_block_t)(struct inode *inode, sector_t iblock, -diff --git a/include/linux/of.h b/include/linux/of.h -index dd10626a615f..d9371c9cd88a 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -265,6 +265,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node, - extern struct device_node *of_get_next_available_child( - const struct device_node *node, struct device_node *prev); - -+extern struct device_node *of_get_compatible_child(const struct device_node *parent, -+ const char *compatible); - extern struct device_node *of_get_child_by_name(const struct device_node *node, - const char *name); - -@@ -462,6 +464,12 @@ static inline bool of_have_populated_dt(void) - return false; - } - -+static inline struct device_node *of_get_compatible_child(const struct device_node *parent, -+ const char *compatible) -+{ -+ return NULL; -+} -+ - static inline struct device_node *of_get_child_by_name( - const struct device_node *node, - const char *name) -diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c -index 77777d918676..cc892a9e109d 100644 ---- a/kernel/debug/kdb/kdb_io.c -+++ b/kernel/debug/kdb/kdb_io.c -@@ -215,7 +215,7 @@ static char *kdb_read(char *buffer, size_t bufsize) - int count; - int i; - int diag, dtab_count; -- int key; -+ int key, buf_size, ret; - static int last_crlf; - - diag = kdbgetintenv("DTABCOUNT", &dtab_count); -@@ -335,9 +335,8 @@ poll_again: - else - p_tmp = tmpbuffer; - len = strlen(p_tmp); -- count = kallsyms_symbol_complete(p_tmp, -- sizeof(tmpbuffer) - -- (p_tmp - tmpbuffer)); -+ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer); -+ count = kallsyms_symbol_complete(p_tmp, buf_size); - if (tab == 2 && count > 0) { - kdb_printf("\n%d symbols are found.", count); - if (count > dtab_count) { -@@ -349,9 +348,13 @@ poll_again: - } - kdb_printf("\n"); - for (i = 0; i < count; i++) { -- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) -+ ret = kallsyms_symbol_next(p_tmp, i, buf_size); -+ if (WARN_ON(!ret)) - break; -- kdb_printf("%s ", p_tmp); -+ if (ret != -E2BIG) -+ kdb_printf("%s ", p_tmp); -+ else -+ kdb_printf("%s... ", p_tmp); - *(p_tmp + len) = '\0'; - } - if (i >= dtab_count) -diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h -index 75014d7f4568..533e04e75a9c 100644 ---- a/kernel/debug/kdb/kdb_private.h -+++ b/kernel/debug/kdb/kdb_private.h -@@ -83,7 +83,7 @@ typedef struct __ksymtab { - unsigned long sym_start; - unsigned long sym_end; - } kdb_symtab_t; --extern int kallsyms_symbol_next(char *prefix_name, int flag); -+extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size); - extern int kallsyms_symbol_complete(char *prefix_name, int max_len); - - /* Exported Symbols for kernel loadable modules to use. */ -diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c -index d35cc2d3a4cc..2aed4a33521b 100644 ---- a/kernel/debug/kdb/kdb_support.c -+++ b/kernel/debug/kdb/kdb_support.c -@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len) - * Parameters: - * prefix_name prefix of a symbol name to lookup - * flag 0 means search from the head, 1 means continue search. -+ * buf_size maximum length that can be written to prefix_name -+ * buffer - * Returns: - * 1 if a symbol matches the given prefix. - * 0 if no string found - */ --int kallsyms_symbol_next(char *prefix_name, int flag) -+int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size) - { - int prefix_len = strlen(prefix_name); - static loff_t pos; -@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag) - pos = 0; - - while ((name = kdb_walk_kallsyms(&pos))) { -- if (strncmp(name, prefix_name, prefix_len) == 0) { -- strncpy(prefix_name, name, strlen(name)+1); -- return 1; -- } -+ if (!strncmp(name, prefix_name, prefix_len)) -+ return strscpy(prefix_name, name, buf_size); - } - return 0; - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 4743e1f2a3d1..d0618951014b 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -3822,8 +3822,8 @@ static int __sched_setscheduler(struct task_struct *p, - struct rq *rq; - int reset_on_fork; - -- /* may grab non-irq protected spin_locks */ -- BUG_ON(in_interrupt()); -+ /* The pi code expects interrupts enabled */ -+ BUG_ON(pi && in_interrupt()); - recheck: - /* double check policy once rq lock held */ - if (policy < 0) { -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 66100d1bc3f7..7e832f9a8f42 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -1715,6 +1715,24 @@ static struct ctl_table fs_table[] = { - .extra1 = &zero, - .extra2 = &one, - }, -+ { -+ .procname = "protected_fifos", -+ .data = &sysctl_protected_fifos, -+ .maxlen = sizeof(int), -+ .mode = 0600, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &zero, -+ .extra2 = &two, -+ }, -+ { -+ .procname = "protected_regular", -+ .data = &sysctl_protected_regular, -+ .maxlen = sizeof(int), -+ .mode = 0600, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &zero, -+ .extra2 = &two, -+ }, - { - .procname = "suid_dumpable", - .data = &suid_dumpable, -diff --git a/mm/shmem.c b/mm/shmem.c -index 8e506a45a6ef..d902b413941a 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -1818,9 +1818,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence) - mutex_lock(&inode->i_mutex); - /* We're holding i_mutex so we can access i_size directly */ - -- if (offset < 0) -- offset = -EINVAL; -- else if (offset >= inode->i_size) -+ if (offset < 0 || offset >= inode->i_size) - offset = -ENXIO; - else { - start = offset >> PAGE_CACHE_SHIFT; -diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 83e8a295c806..c153fc2883a8 100644 ---- a/net/llc/af_llc.c -+++ b/net/llc/af_llc.c -@@ -726,7 +726,6 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - struct sk_buff *skb = NULL; - struct sock *sk = sock->sk; - struct llc_sock *llc = llc_sk(sk); -- unsigned long cpu_flags; - size_t copied = 0; - u32 peek_seq = 0; - u32 *seq, skb_len; -@@ -851,9 +850,8 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - goto copy_uaddr; - - if (!(flags & MSG_PEEK)) { -- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); -- sk_eat_skb(sk, skb); -- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); -+ skb_unlink(skb, &sk->sk_receive_queue); -+ kfree_skb(skb); - *seq = 0; - } - -@@ -874,9 +872,8 @@ copy_uaddr: - llc_cmsg_rcv(msg, skb); - - if (!(flags & MSG_PEEK)) { -- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); -- sk_eat_skb(sk, skb); -- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); -+ skb_unlink(skb, &sk->sk_receive_queue); -+ kfree_skb(skb); - *seq = 0; - } - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 120e9ae04db3..a7967af0da82 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -3452,6 +3452,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, - dreg = nft_type_to_reg(set->dtype); - list_for_each_entry(binding, &set->bindings, list) { - struct nft_ctx bind_ctx = { -+ .net = ctx->net, - .afi = ctx->afi, - .table = ctx->table, - .chain = (struct nft_chain *)binding->chain, -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index a40b8b0ef0d5..f085b01b6603 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -486,8 +486,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc, - void sctp_assoc_rm_peer(struct sctp_association *asoc, - struct sctp_transport *peer) - { -- struct list_head *pos; -- struct sctp_transport *transport; -+ struct sctp_transport *transport; -+ struct list_head *pos; -+ struct sctp_chunk *ch; - - pr_debug("%s: association:%p addr:%pISpc\n", - __func__, asoc, &peer->ipaddr.sa); -@@ -543,7 +544,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, - */ - if (!list_empty(&peer->transmitted)) { - struct sctp_transport *active = asoc->peer.active_path; -- struct sctp_chunk *ch; - - /* Reset the transport of each chunk on this list */ - list_for_each_entry(ch, &peer->transmitted, -@@ -565,6 +565,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, - sctp_transport_hold(active); - } - -+ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) -+ if (ch->transport == peer) -+ ch->transport = NULL; -+ - asoc->peer.transport_count--; - - sctp_transport_free(peer); -diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c -index 41248b1820c7..cc27e38392ea 100644 ---- a/net/sunrpc/auth_generic.c -+++ b/net/sunrpc/auth_generic.c -@@ -272,13 +272,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred) - { - struct auth_cred *acred = &container_of(cred, struct generic_cred, - gc_base)->acred; -- bool ret; -- -- get_rpccred(cred); -- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); -- put_rpccred(cred); -- -- return ret; -+ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); - } - - static const struct rpc_credops generic_credops = { diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.166-167.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.166-167.patch deleted file mode 100644 index de3a7c4b2a16..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.166-167.patch +++ /dev/null @@ -1,2689 +0,0 @@ -diff --git a/Makefile b/Makefile -index 64521458d35e..6b30551caee4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 166 -+SUBLEVEL = 167 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -793,6 +793,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,) - # disable pointer signed / unsigned warnings in gcc 4.0 - KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) - -+# disable stringop warnings in gcc 8+ -+KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) -+ - # disable invalid "can't wrap" optimizations for signed / pointers - KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) - -diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig -index c4ee25e88a7b..e983f410135a 100644 ---- a/arch/arc/Kconfig -+++ b/arch/arc/Kconfig -@@ -96,7 +96,7 @@ endmenu - - choice - prompt "ARC Instruction Set" -- default ISA_ARCOMPACT -+ default ISA_ARCV2 - - config ISA_ARCOMPACT - bool "ARCompact ISA" -diff --git a/arch/arc/Makefile b/arch/arc/Makefile -index 9d64eacdd2aa..fffaff9c7b2c 100644 ---- a/arch/arc/Makefile -+++ b/arch/arc/Makefile -@@ -12,7 +12,7 @@ ifeq ($(CROSS_COMPILE),) - CROSS_COMPILE := arc-linux- - endif - --KBUILD_DEFCONFIG := nsim_700_defconfig -+KBUILD_DEFCONFIG := nsim_hs_defconfig - - cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ - cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 -diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig -index dbee1934dfc6..3023f91c77c2 100644 ---- a/arch/arc/configs/axs101_defconfig -+++ b/arch/arc/configs/axs101_defconfig -@@ -17,6 +17,7 @@ CONFIG_PERF_EVENTS=y - # CONFIG_VM_EVENT_COUNTERS is not set - # CONFIG_SLUB_DEBUG is not set - # CONFIG_COMPAT_BRK is not set -+CONFIG_ISA_ARCOMPACT=y - CONFIG_MODULES=y - CONFIG_PARTITION_ADVANCED=y - CONFIG_ARC_PLAT_AXS10X=y -@@ -97,6 +98,7 @@ CONFIG_NTFS_FS=y - CONFIG_TMPFS=y - CONFIG_JFFS2_FS=y - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - CONFIG_NLS_CODEPAGE_437=y - CONFIG_NLS_ISO8859_1=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set -diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig -index 561eac854cc3..f18107185f53 100644 ---- a/arch/arc/configs/axs103_defconfig -+++ b/arch/arc/configs/axs103_defconfig -@@ -103,6 +103,7 @@ CONFIG_NTFS_FS=y - CONFIG_TMPFS=y - CONFIG_JFFS2_FS=y - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - CONFIG_NLS_CODEPAGE_437=y - CONFIG_NLS_ISO8859_1=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set -diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig -index aa4f261b6508..6e1dd8521d2a 100644 ---- a/arch/arc/configs/axs103_smp_defconfig -+++ b/arch/arc/configs/axs103_smp_defconfig -@@ -104,6 +104,7 @@ CONFIG_NTFS_FS=y - CONFIG_TMPFS=y - CONFIG_JFFS2_FS=y - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - CONFIG_NLS_CODEPAGE_437=y - CONFIG_NLS_ISO8859_1=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set -diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig -index 138f9d887957..86e5a62556a8 100644 ---- a/arch/arc/configs/nsim_700_defconfig -+++ b/arch/arc/configs/nsim_700_defconfig -@@ -16,6 +16,7 @@ CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set - # CONFIG_COMPAT_BRK is not set -+CONFIG_ISA_ARCOMPACT=y - CONFIG_KPROBES=y - CONFIG_MODULES=y - # CONFIG_LBDAF is not set -diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig -index 31e1d95764ff..a4d7b919224a 100644 ---- a/arch/arc/configs/nsimosci_defconfig -+++ b/arch/arc/configs/nsimosci_defconfig -@@ -17,6 +17,7 @@ CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set - # CONFIG_COMPAT_BRK is not set -+CONFIG_ISA_ARCOMPACT=y - CONFIG_KPROBES=y - CONFIG_MODULES=y - # CONFIG_LBDAF is not set -@@ -69,5 +70,6 @@ CONFIG_EXT2_FS_XATTR=y - CONFIG_TMPFS=y - # CONFIG_MISC_FILESYSTEMS is not set - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set - # CONFIG_ENABLE_MUST_CHECK is not set -diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig -index fcae66683ca0..b3fb49c8bd14 100644 ---- a/arch/arc/configs/nsimosci_hs_defconfig -+++ b/arch/arc/configs/nsimosci_hs_defconfig -@@ -69,5 +69,6 @@ CONFIG_EXT2_FS_XATTR=y - CONFIG_TMPFS=y - # CONFIG_MISC_FILESYSTEMS is not set - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set - # CONFIG_ENABLE_MUST_CHECK is not set -diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig -index b01b659168ea..710c167bbdd8 100644 ---- a/arch/arc/configs/nsimosci_hs_smp_defconfig -+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig -@@ -88,6 +88,7 @@ CONFIG_EXT2_FS_XATTR=y - CONFIG_TMPFS=y - # CONFIG_MISC_FILESYSTEMS is not set - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set - # CONFIG_ENABLE_MUST_CHECK is not set - CONFIG_FTRACE=y -diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig -index 3b4dc9cebcf1..7469b754ac77 100644 ---- a/arch/arc/configs/tb10x_defconfig -+++ b/arch/arc/configs/tb10x_defconfig -@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y - # CONFIG_AIO is not set - CONFIG_EMBEDDED=y - # CONFIG_COMPAT_BRK is not set -+CONFIG_ISA_ARCOMPACT=y - CONFIG_SLAB=y - CONFIG_MODULES=y - CONFIG_MODULE_FORCE_LOAD=y -diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig -index a07f20de221b..772073e5ba04 100644 ---- a/arch/arc/configs/vdk_hs38_defconfig -+++ b/arch/arc/configs/vdk_hs38_defconfig -@@ -89,6 +89,7 @@ CONFIG_NTFS_FS=y - CONFIG_TMPFS=y - CONFIG_JFFS2_FS=y - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - CONFIG_NLS_CODEPAGE_437=y - CONFIG_NLS_ISO8859_1=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set -diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig -index f36c047b33ca..50e215a163ff 100644 ---- a/arch/arc/configs/vdk_hs38_smp_defconfig -+++ b/arch/arc/configs/vdk_hs38_smp_defconfig -@@ -91,6 +91,7 @@ CONFIG_NTFS_FS=y - CONFIG_TMPFS=y - CONFIG_JFFS2_FS=y - CONFIG_NFS_FS=y -+CONFIG_NFS_V3_ACL=y - CONFIG_NLS_CODEPAGE_437=y - CONFIG_NLS_ISO8859_1=y - # CONFIG_ENABLE_WARN_DEPRECATED is not set -diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h -index 47bc45a67e9b..032a497356f3 100644 ---- a/arch/mips/include/asm/syscall.h -+++ b/arch/mips/include/asm/syscall.h -@@ -51,7 +51,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg, - #ifdef CONFIG_64BIT - case 4: case 5: case 6: case 7: - #ifdef CONFIG_MIPS32_O32 -- if (test_thread_flag(TIF_32BIT_REGS)) -+ if (test_tsk_thread_flag(task, TIF_32BIT_REGS)) - return get_user(*arg, (int *)usp + n); - else - #endif -diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c -index c5f45fc96c74..9c19f5493b85 100644 ---- a/arch/mips/ralink/mt7620.c -+++ b/arch/mips/ralink/mt7620.c -@@ -81,7 +81,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = { - }; - static struct rt2880_pmx_func nd_sd_grp[] = { - FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15), -- FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15) -+ FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13) - }; - - static struct rt2880_pmx_group mt7620a_pinmux_data[] = { -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 2b71f2c03b9e..a5b533aea958 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -4174,9 +4174,9 @@ static void mmu_pte_write_flush_tlb(struct kvm_vcpu *vcpu, bool zap_page, - } - - static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa, -- const u8 *new, int *bytes) -+ int *bytes) - { -- u64 gentry; -+ u64 gentry = 0; - int r; - - /* -@@ -4188,22 +4188,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa, - /* Handle a 32-bit guest writing two halves of a 64-bit gpte */ - *gpa &= ~(gpa_t)7; - *bytes = 8; -- r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8); -- if (r) -- gentry = 0; -- new = (const u8 *)&gentry; - } - -- switch (*bytes) { -- case 4: -- gentry = *(const u32 *)new; -- break; -- case 8: -- gentry = *(const u64 *)new; -- break; -- default: -- gentry = 0; -- break; -+ if (*bytes == 4 || *bytes == 8) { -+ r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes); -+ if (r) -+ gentry = 0; - } - - return gentry; -@@ -4313,8 +4303,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, - - pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes); - -- gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes); -- - /* - * No need to care whether allocation memory is successful - * or not since pte prefetch is skiped if it does not have -@@ -4323,6 +4311,9 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, - mmu_topup_memory_caches(vcpu); - - spin_lock(&vcpu->kvm->mmu_lock); -+ -+ gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes); -+ - ++vcpu->kvm->stat.mmu_pte_write; - kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); - -diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c -index b123ace3b67c..cbefed1800c1 100644 ---- a/arch/xtensa/kernel/asm-offsets.c -+++ b/arch/xtensa/kernel/asm-offsets.c -@@ -90,14 +90,14 @@ int main(void) - DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp)); - DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable)); - #if XTENSA_HAVE_COPROCESSORS -- DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp)); -- DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp)); -+ DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0)); -+ DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1)); -+ DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2)); -+ DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3)); -+ DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4)); -+ DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5)); -+ DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6)); -+ DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7)); - #endif - DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user)); - DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t)); -diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c -index 1c85323f01d7..df70d47d14ab 100644 ---- a/arch/xtensa/kernel/process.c -+++ b/arch/xtensa/kernel/process.c -@@ -83,18 +83,21 @@ void coprocessor_release_all(struct thread_info *ti) - - void coprocessor_flush_all(struct thread_info *ti) - { -- unsigned long cpenable; -+ unsigned long cpenable, old_cpenable; - int i; - - preempt_disable(); - -+ RSR_CPENABLE(old_cpenable); - cpenable = ti->cpenable; -+ WSR_CPENABLE(cpenable); - - for (i = 0; i < XCHAL_CP_MAX; i++) { - if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti) - coprocessor_flush(ti, i); - cpenable >>= 1; - } -+ WSR_CPENABLE(old_cpenable); - - preempt_enable(); - } -diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c -index be26f625bb3e..941ace052130 100644 ---- a/drivers/dma/at_hdmac.c -+++ b/drivers/dma/at_hdmac.c -@@ -1781,6 +1781,12 @@ static void atc_free_chan_resources(struct dma_chan *chan) - atchan->descs_allocated = 0; - atchan->status = 0; - -+ /* -+ * Free atslave allocated in at_dma_xlate() -+ */ -+ kfree(chan->private); -+ chan->private = NULL; -+ - dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); - } - -@@ -1815,7 +1821,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, - dma_cap_zero(mask); - dma_cap_set(DMA_SLAVE, mask); - -- atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL); -+ atslave = kzalloc(sizeof(*atslave), GFP_KERNEL); - if (!atslave) - return NULL; - -@@ -2146,6 +2152,8 @@ static int at_dma_remove(struct platform_device *pdev) - struct resource *io; - - at_dma_off(atdma); -+ if (pdev->dev.of_node) -+ of_dma_controller_free(pdev->dev.of_node); - dma_async_device_unregister(&atdma->dma_common); - - dma_pool_destroy(atdma->memset_pool); -diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c -index 498a94069e6b..1acebd64fded 100644 ---- a/drivers/gpu/drm/ast/ast_main.c -+++ b/drivers/gpu/drm/ast/ast_main.c -@@ -557,7 +557,8 @@ int ast_driver_unload(struct drm_device *dev) - drm_mode_config_cleanup(dev); - - ast_mm_fini(ast); -- pci_iounmap(dev->pdev, ast->ioregs); -+ if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET) -+ pci_iounmap(dev->pdev, ast->ioregs); - pci_iounmap(dev->pdev, ast->regs); - kfree(ast); - return 0; -diff --git a/drivers/gpu/drm/gma500/mdfld_intel_display.c b/drivers/gpu/drm/gma500/mdfld_intel_display.c -index acd38344b302..764094dd30dd 100644 ---- a/drivers/gpu/drm/gma500/mdfld_intel_display.c -+++ b/drivers/gpu/drm/gma500/mdfld_intel_display.c -@@ -99,7 +99,7 @@ void mdfldWaitForPipeEnable(struct drm_device *dev, int pipe) - /* Wait for for the pipe enable to take effect. */ - for (count = 0; count < COUNT_MAX; count++) { - temp = REG_READ(map->conf); -- if ((temp & PIPEACONF_PIPE_STATE) == 1) -+ if (temp & PIPEACONF_PIPE_STATE) - break; - } - } -diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c -index 0cbc7ceb9a55..1610accfed0b 100644 ---- a/drivers/infiniband/ulp/iser/iser_verbs.c -+++ b/drivers/infiniband/ulp/iser/iser_verbs.c -@@ -1289,7 +1289,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task, - IB_MR_CHECK_SIG_STATUS, &mr_status); - if (ret) { - pr_err("ib_check_mr_status failed, ret %d\n", ret); -- goto err; -+ /* Not a lot we can do, return ambiguous guard error */ -+ *sector = 0; -+ return 0x1; - } - - if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) { -@@ -1317,7 +1319,4 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task, - } - - return 0; --err: -- /* Not alot we can do here, return ambiguous guard error */ -- return 0x1; - } -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 2e52015634f9..f55dcdf99bc5 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -483,18 +483,18 @@ static const u8 xboxone_hori_init[] = { - }; - - /* -- * This packet is required for some of the PDP pads to start -+ * This packet is required for most (all?) of the PDP pads to start - * sending input reports. These pads include: (0x0e6f:0x02ab), -- * (0x0e6f:0x02a4). -+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6). - */ - static const u8 xboxone_pdp_init1[] = { - 0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14 - }; - - /* -- * This packet is required for some of the PDP pads to start -+ * This packet is required for most (all?) of the PDP pads to start - * sending input reports. These pads include: (0x0e6f:0x02ab), -- * (0x0e6f:0x02a4). -+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6). - */ - static const u8 xboxone_pdp_init2[] = { - 0x06, 0x20, 0x00, 0x02, 0x01, 0x00 -@@ -530,12 +530,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = { - XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), - XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), - XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), -- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1), -- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2), -- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1), -- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2), -- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1), -- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2), -+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1), -+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2), - XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), - XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), - XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), -diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c -index 795fa353de7c..c64d87442a62 100644 ---- a/drivers/input/keyboard/matrix_keypad.c -+++ b/drivers/input/keyboard/matrix_keypad.c -@@ -405,7 +405,7 @@ matrix_keypad_parse_dt(struct device *dev) - struct matrix_keypad_platform_data *pdata; - struct device_node *np = dev->of_node; - unsigned int *gpios; -- int i, nrow, ncol; -+ int ret, i, nrow, ncol; - - if (!np) { - dev_err(dev, "device lacks DT data\n"); -@@ -447,12 +447,19 @@ matrix_keypad_parse_dt(struct device *dev) - return ERR_PTR(-ENOMEM); - } - -- for (i = 0; i < pdata->num_row_gpios; i++) -- gpios[i] = of_get_named_gpio(np, "row-gpios", i); -+ for (i = 0; i < nrow; i++) { -+ ret = of_get_named_gpio(np, "row-gpios", i); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ gpios[i] = ret; -+ } - -- for (i = 0; i < pdata->num_col_gpios; i++) -- gpios[pdata->num_row_gpios + i] = -- of_get_named_gpio(np, "col-gpios", i); -+ for (i = 0; i < ncol; i++) { -+ ret = of_get_named_gpio(np, "col-gpios", i); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ gpios[nrow + i] = ret; -+ } - - pdata->row_gpios = gpios; - pdata->col_gpios = &gpios[pdata->num_row_gpios]; -@@ -479,10 +486,8 @@ static int matrix_keypad_probe(struct platform_device *pdev) - pdata = dev_get_platdata(&pdev->dev); - if (!pdata) { - pdata = matrix_keypad_parse_dt(&pdev->dev); -- if (IS_ERR(pdata)) { -- dev_err(&pdev->dev, "no platform data defined\n"); -+ if (IS_ERR(pdata)) - return PTR_ERR(pdata); -- } - } else if (!pdata->keymap_data) { - dev_err(&pdev->dev, "no keymap data defined\n"); - return -EINVAL; -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index b3119589a444..471984ec2db0 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1253,6 +1253,9 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0618", 0 }, - { "ELAN061C", 0 }, - { "ELAN061D", 0 }, -+ { "ELAN061E", 0 }, -+ { "ELAN0620", 0 }, -+ { "ELAN0621", 0 }, - { "ELAN0622", 0 }, - { "ELAN1000", 0 }, - { } -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 49b266433f4c..7feaa82f8c7c 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -2977,7 +2977,7 @@ static int copy_context_table(struct intel_iommu *iommu, - } - - if (old_ce) -- iounmap(old_ce); -+ memunmap(old_ce); - - ret = 0; - if (devfn < 0x80) -diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c -index 10068a481e22..cbde03e509c1 100644 ---- a/drivers/iommu/intel-svm.c -+++ b/drivers/iommu/intel-svm.c -@@ -558,7 +558,7 @@ static irqreturn_t prq_event_thread(int irq, void *d) - pr_err("%s: Page request without PASID: %08llx %08llx\n", - iommu->name, ((unsigned long long *)req)[0], - ((unsigned long long *)req)[1]); -- goto bad_req; -+ goto no_pasid; - } - - if (!svm || svm->pasid != req->pasid) { -diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c -index 624e7ff76166..9101be1a6b59 100644 ---- a/drivers/iommu/ipmmu-vmsa.c -+++ b/drivers/iommu/ipmmu-vmsa.c -@@ -372,6 +372,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) - - static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) - { -+ if (!domain->mmu) -+ return; -+ - /* - * Disable the context. Flush the TLB as required when modifying the - * context registers. -diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c -index 7385f98dd54b..51a5b51ec467 100644 ---- a/drivers/leds/led-class.c -+++ b/drivers/leds/led-class.c -@@ -247,12 +247,13 @@ void led_classdev_unregister(struct led_classdev *led_cdev) - up_write(&led_cdev->trigger_lock); - #endif - -- cancel_work_sync(&led_cdev->set_brightness_work); -- - /* Stop blinking */ - led_stop_software_blink(led_cdev); -+ - led_set_brightness(led_cdev, LED_OFF); - -+ flush_work(&led_cdev->set_brightness_work); -+ - device_unregister(led_cdev->dev); - - down_write(&leds_list_lock); -diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c -index 5db4515a4fd7..df186b38da78 100644 ---- a/drivers/leds/leds-gpio.c -+++ b/drivers/leds/leds-gpio.c -@@ -118,8 +118,8 @@ static int create_gpio_led(const struct gpio_led *template, - return ret; - - led_dat->gpiod = gpio_to_desc(template->gpio); -- if (IS_ERR(led_dat->gpiod)) -- return PTR_ERR(led_dat->gpiod); -+ if (!led_dat->gpiod) -+ return -EINVAL; - } - - led_dat->cdev.name = template->name; -diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c -index 1d07e3e83d29..3149dbece146 100644 ---- a/drivers/leds/leds-pwm.c -+++ b/drivers/leds/leds-pwm.c -@@ -132,6 +132,7 @@ static int led_pwm_add(struct device *dev, struct led_pwm_priv *priv, - ret = led_classdev_register(dev, &led_data->cdev); - if (ret == 0) { - priv->num_leds++; -+ led_pwm_set(&led_data->cdev, led_data->cdev.brightness); - } else { - dev_err(dev, "failed to register PWM led for %s: %d\n", - led->name, ret); -diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c -index 357be76c7a55..5502a0fb94fd 100644 ---- a/drivers/media/usb/em28xx/em28xx-dvb.c -+++ b/drivers/media/usb/em28xx/em28xx-dvb.c -@@ -1806,6 +1806,8 @@ static int em28xx_dvb_fini(struct em28xx *dev) - } - } - -+ em28xx_unregister_dvb(dvb); -+ - /* remove I2C SEC */ - client = dvb->i2c_client_sec; - if (client) { -@@ -1827,7 +1829,6 @@ static int em28xx_dvb_fini(struct em28xx *dev) - i2c_unregister_device(client); - } - -- em28xx_unregister_dvb(dvb); - kfree(dvb); - dev->dvb = NULL; - kref_put(&dev->ref, em28xx_free_device); -diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c -index 6a451bd65bf3..8bd63128d536 100644 ---- a/drivers/misc/mic/scif/scif_rma.c -+++ b/drivers/misc/mic/scif/scif_rma.c -@@ -414,7 +414,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev, - if (err) - goto error_window; - err = scif_map_page(&window->num_pages_lookup.lookup[j], -- vmalloc_dma_phys ? -+ vmalloc_num_pages ? - vmalloc_to_page(&window->num_pages[i]) : - virt_to_page(&window->num_pages[i]), - remote_dev); -diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c -index bc46be39549d..9d93492ddfcc 100644 ---- a/drivers/net/can/rcar_can.c -+++ b/drivers/net/can/rcar_can.c -@@ -24,6 +24,9 @@ - - #define RCAR_CAN_DRV_NAME "rcar_can" - -+#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \ -+ BIT(CLKR_CLKEXT)) -+ - /* Mailbox configuration: - * mailbox 60 - 63 - Rx FIFO mailboxes - * mailbox 56 - 59 - Tx FIFO mailboxes -@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev) - goto fail_clk; - } - -- if (clock_select >= ARRAY_SIZE(clock_names)) { -+ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) { - err = -EINVAL; - dev_err(&pdev->dev, "invalid CAN clock selected\n"); - goto fail_clk; -diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c -index 7847638bdd22..8914170fccff 100644 ---- a/drivers/net/ethernet/amd/sunlance.c -+++ b/drivers/net/ethernet/amd/sunlance.c -@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op, - - prop = of_get_property(nd, "tpe-link-test?", NULL); - if (!prop) -- goto no_link_test; -+ goto node_put; - - if (strcmp(prop, "true")) { - printk(KERN_NOTICE "SunLance: warning: overriding option " -@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op, - "to ecd@skynet.be\n"); - auxio_set_lte(AUXIO_LTE_ON); - } -+node_put: -+ of_node_put(nd); - no_link_test: - lp->auto_select = 1; - lp->tpe = 0; -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -index 1ea068815419..2491cdc2535c 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h -@@ -2291,6 +2291,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id, - #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \ - E1HVN_MAX) - -+/* Following is the DMAE channel number allocation for the clients. -+ * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively. -+ * Driver: 0-3 and 8-11 (for PF dmae operations) -+ * 4 and 12 (for stats requests) -+ */ -+#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */ -+ - /* PCIE link and speed */ - #define PCICFG_LINK_WIDTH 0x1f00000 - #define PCICFG_LINK_WIDTH_SHIFT 20 -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c -index ff702a707a91..343e3366d751 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c -@@ -5931,6 +5931,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp, - rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag); - rdata->path_id = BP_PATH(bp); - rdata->network_cos_mode = start_params->network_cos_mode; -+ rdata->dmae_cmd_id = BNX2X_FW_DMAE_C; - - rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port); - rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port); -diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c -index dce5f7b7f772..05e1f923f49e 100644 ---- a/drivers/net/ethernet/faraday/ftmac100.c -+++ b/drivers/net/ethernet/faraday/ftmac100.c -@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id) - struct net_device *netdev = dev_id; - struct ftmac100 *priv = netdev_priv(netdev); - -- if (likely(netif_running(netdev))) { -- /* Disable interrupts for polling */ -- ftmac100_disable_all_int(priv); -+ /* Disable interrupts for polling */ -+ ftmac100_disable_all_int(priv); -+ if (likely(netif_running(netdev))) - napi_schedule(&priv->napi); -- } - - return IRQ_HANDLED; - } -diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c -index 0c51c69f802f..a4912b11e54f 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/alloc.c -+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c -@@ -339,7 +339,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc) - static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count, - int align, u32 skip_mask, u32 *puid) - { -- u32 uid; -+ u32 uid = 0; - u32 res; - struct mlx4_zone_allocator *zone_alloc = zone->allocator; - struct mlx4_zone_entry *curr_node; -diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h -index f5fdbd53d052..db40387ffaf6 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h -+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h -@@ -537,8 +537,8 @@ struct slave_list { - struct resource_allocator { - spinlock_t alloc_lock; /* protect quotas */ - union { -- int res_reserved; -- int res_port_rsvd[MLX4_MAX_PORTS]; -+ unsigned int res_reserved; -+ unsigned int res_port_rsvd[MLX4_MAX_PORTS]; - }; - union { - int res_free; -diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c -index 93195191f45b..53833c06696f 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mr.c -+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c -@@ -366,6 +366,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr, - container_of((void *)mpt_entry, struct mlx4_cmd_mailbox, - buf); - -+ (*mpt_entry)->lkey = 0; - err = mlx4_SW2HW_MPT(dev, mailbox, key); - } - -diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c -index 9cc9d62c1fec..8b15a018d625 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_int.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c -@@ -177,6 +177,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn) - */ - do { - index = p_sb_attn->sb_index; -+ /* finish reading index before the loop condition */ -+ dma_rmb(); - attn_bits = le32_to_cpu(p_sb_attn->atten_bits); - attn_acks = le32_to_cpu(p_sb_attn->atten_ack); - } while (index != p_sb_attn->sb_index); -diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c -index 35e1468d8196..b8ae6ed5c7ba 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_main.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c -@@ -1124,9 +1124,9 @@ static int qed_drain(struct qed_dev *cdev) - return -EBUSY; - } - rc = qed_mcp_drain(hwfn, ptt); -+ qed_ptt_release(hwfn, ptt); - if (rc) - return rc; -- qed_ptt_release(hwfn, ptt); - } - - return 0; -diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c -index e7034c55e796..6ef9188384ce 100644 ---- a/drivers/net/rionet.c -+++ b/drivers/net/rionet.c -@@ -215,9 +215,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev) - * it just report sending a packet to the target - * (without actual packet transfer). - */ -- dev_kfree_skb_any(skb); - ndev->stats.tx_packets++; - ndev->stats.tx_bytes += skb->len; -+ dev_kfree_skb_any(skb); - } - } - -diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c -index 76465b117b72..f1f8227e7342 100644 ---- a/drivers/net/usb/ipheth.c -+++ b/drivers/net/usb/ipheth.c -@@ -140,7 +140,6 @@ struct ipheth_device { - struct usb_device *udev; - struct usb_interface *intf; - struct net_device *net; -- struct sk_buff *tx_skb; - struct urb *tx_urb; - struct urb *rx_urb; - unsigned char *tx_buf; -@@ -229,6 +228,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb) - case -ENOENT: - case -ECONNRESET: - case -ESHUTDOWN: -+ case -EPROTO: - return; - case 0: - break; -@@ -280,7 +280,6 @@ static void ipheth_sndbulk_callback(struct urb *urb) - dev_err(&dev->intf->dev, "%s: urb status: %d\n", - __func__, status); - -- dev_kfree_skb_irq(dev->tx_skb); - netif_wake_queue(dev->net); - } - -@@ -410,7 +409,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) - if (skb->len > IPHETH_BUF_SIZE) { - WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len); - dev->net->stats.tx_dropped++; -- dev_kfree_skb_irq(skb); -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -@@ -430,12 +429,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) - dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n", - __func__, retval); - dev->net->stats.tx_errors++; -- dev_kfree_skb_irq(skb); -+ dev_kfree_skb_any(skb); - } else { -- dev->tx_skb = skb; -- - dev->net->stats.tx_packets++; - dev->net->stats.tx_bytes += skb->len; -+ dev_consume_skb_any(skb); - netif_stop_queue(net); - } - -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 05413176a5d6..ab480ea6d95a 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2515,6 +2515,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, - if (param->no_vif) - ieee80211_hw_set(hw, NO_AUTO_VIF); - -+ tasklet_hrtimer_init(&data->beacon_timer, -+ mac80211_hwsim_beacon, -+ CLOCK_MONOTONIC, HRTIMER_MODE_ABS); -+ - err = ieee80211_register_hw(hw); - if (err < 0) { - printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n", -@@ -2539,10 +2543,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, - data->debugfs, - data, &hwsim_simulate_radar); - -- tasklet_hrtimer_init(&data->beacon_timer, -- mac80211_hwsim_beacon, -- CLOCK_MONOTONIC, HRTIMER_MODE_ABS); -- - spin_lock_bh(&hwsim_radio_lock); - list_add_tail(&data->list, &hwsim_radios); - spin_unlock_bh(&hwsim_radio_lock); -diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c -index 15dc7a398b90..f01d24baff7c 100644 ---- a/drivers/net/wireless/ti/wlcore/cmd.c -+++ b/drivers/net/wireless/ti/wlcore/cmd.c -@@ -35,7 +35,6 @@ - #include "wl12xx_80211.h" - #include "cmd.h" - #include "event.h" --#include "ps.h" - #include "tx.h" - #include "hw_ops.h" - -@@ -192,10 +191,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, - - timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT); - -- ret = wl1271_ps_elp_wakeup(wl); -- if (ret < 0) -- return ret; -- - do { - if (time_after(jiffies, timeout_time)) { - wl1271_debug(DEBUG_CMD, "timeout waiting for event %d", -@@ -227,7 +222,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, - } while (!event); - - out: -- wl1271_ps_elp_sleep(wl); - kfree(events_vector); - return ret; - } -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index 09ac56317f1b..533bd2467910 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -4519,8 +4519,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card, - { - struct qeth_ipa_cmd *cmd; - struct qeth_arp_query_info *qinfo; -- struct qeth_snmp_cmd *snmp; - unsigned char *data; -+ void *snmp_data; - __u16 data_len; - - QETH_CARD_TEXT(card, 3, "snpcmdcb"); -@@ -4528,7 +4528,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card, - cmd = (struct qeth_ipa_cmd *) sdata; - data = (unsigned char *)((char *)cmd - reply->offset); - qinfo = (struct qeth_arp_query_info *) reply->param; -- snmp = &cmd->data.setadapterparms.data.snmp; - - if (cmd->hdr.return_code) { - QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code); -@@ -4541,10 +4540,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card, - return 0; - } - data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data)); -- if (cmd->data.setadapterparms.hdr.seq_no == 1) -- data_len -= (__u16)((char *)&snmp->data - (char *)cmd); -- else -- data_len -= (__u16)((char *)&snmp->request - (char *)cmd); -+ if (cmd->data.setadapterparms.hdr.seq_no == 1) { -+ snmp_data = &cmd->data.setadapterparms.data.snmp; -+ data_len -= offsetof(struct qeth_ipa_cmd, -+ data.setadapterparms.data.snmp); -+ } else { -+ snmp_data = &cmd->data.setadapterparms.data.snmp.request; -+ data_len -= offsetof(struct qeth_ipa_cmd, -+ data.setadapterparms.data.snmp.request); -+ } - - /* check if there is enough room in userspace */ - if ((qinfo->udata_len - qinfo->udata_offset) < data_len) { -@@ -4557,16 +4561,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card, - QETH_CARD_TEXT_(card, 4, "sseqn%i", - cmd->data.setadapterparms.hdr.seq_no); - /*copy entries to user buffer*/ -- if (cmd->data.setadapterparms.hdr.seq_no == 1) { -- memcpy(qinfo->udata + qinfo->udata_offset, -- (char *)snmp, -- data_len + offsetof(struct qeth_snmp_cmd, data)); -- qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data); -- } else { -- memcpy(qinfo->udata + qinfo->udata_offset, -- (char *)&snmp->request, data_len); -- } -+ memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len); - qinfo->udata_offset += data_len; -+ - /* check if all replies received ... */ - QETH_CARD_TEXT_(card, 4, "srtot%i", - cmd->data.setadapterparms.hdr.used_total); -diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c -index 1b831598df7c..ff06bdfd2b20 100644 ---- a/drivers/s390/virtio/virtio_ccw.c -+++ b/drivers/s390/virtio/virtio_ccw.c -@@ -59,6 +59,7 @@ struct virtio_ccw_device { - unsigned int revision; /* Transport revision */ - wait_queue_head_t wait_q; - spinlock_t lock; -+ struct mutex io_lock; /* Serializes I/O requests */ - struct list_head virtqueues; - unsigned long indicators; - unsigned long indicators2; -@@ -307,6 +308,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev, - unsigned long flags; - int flag = intparm & VIRTIO_CCW_INTPARM_MASK; - -+ mutex_lock(&vcdev->io_lock); - do { - spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags); - ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0); -@@ -319,7 +321,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev, - cpu_relax(); - } while (ret == -EBUSY); - wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0); -- return ret ? ret : vcdev->err; -+ ret = ret ? ret : vcdev->err; -+ mutex_unlock(&vcdev->io_lock); -+ return ret; - } - - static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev, -@@ -833,6 +837,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, - int ret; - struct ccw1 *ccw; - void *config_area; -+ unsigned long flags; - - ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); - if (!ccw) -@@ -851,11 +856,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, - if (ret) - goto out_free; - -+ spin_lock_irqsave(&vcdev->lock, flags); - memcpy(vcdev->config, config_area, offset + len); -- if (buf) -- memcpy(buf, &vcdev->config[offset], len); - if (vcdev->config_ready < offset + len) - vcdev->config_ready = offset + len; -+ spin_unlock_irqrestore(&vcdev->lock, flags); -+ if (buf) -+ memcpy(buf, config_area + offset, len); - - out_free: - kfree(config_area); -@@ -869,6 +876,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, - struct virtio_ccw_device *vcdev = to_vc_device(vdev); - struct ccw1 *ccw; - void *config_area; -+ unsigned long flags; - - ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); - if (!ccw) -@@ -881,9 +889,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, - /* Make sure we don't overwrite fields. */ - if (vcdev->config_ready < offset) - virtio_ccw_get_config(vdev, 0, NULL, offset); -+ spin_lock_irqsave(&vcdev->lock, flags); - memcpy(&vcdev->config[offset], buf, len); - /* Write the config area to the host. */ - memcpy(config_area, vcdev->config, sizeof(vcdev->config)); -+ spin_unlock_irqrestore(&vcdev->lock, flags); - ccw->cmd_code = CCW_CMD_WRITE_CONF; - ccw->flags = 0; - ccw->count = offset + len; -@@ -1230,6 +1240,7 @@ static int virtio_ccw_online(struct ccw_device *cdev) - init_waitqueue_head(&vcdev->wait_q); - INIT_LIST_HEAD(&vcdev->virtqueues); - spin_lock_init(&vcdev->lock); -+ mutex_init(&vcdev->io_lock); - - spin_lock_irqsave(get_ccwdev_lock(cdev), flags); - dev_set_drvdata(&cdev->dev, vcdev); -diff --git a/drivers/scsi/bfa/bfa_fcbuild.c b/drivers/scsi/bfa/bfa_fcbuild.c -index dce787f6cca2..daade591409a 100644 ---- a/drivers/scsi/bfa/bfa_fcbuild.c -+++ b/drivers/scsi/bfa/bfa_fcbuild.c -@@ -1249,8 +1249,8 @@ fc_rspnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id, - memset(rspnid, 0, sizeof(struct fcgs_rspnid_req_s)); - - rspnid->dap = s_id; -- rspnid->spn_len = (u8) strlen((char *)name); -- strncpy((char *)rspnid->spn, (char *)name, rspnid->spn_len); -+ strlcpy(rspnid->spn, name, sizeof(rspnid->spn)); -+ rspnid->spn_len = (u8) strlen(rspnid->spn); - - return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s); - } -@@ -1270,8 +1270,8 @@ fc_rsnn_nn_build(struct fchs_s *fchs, void *pyld, u32 s_id, - memset(rsnn_nn, 0, sizeof(struct fcgs_rsnn_nn_req_s)); - - rsnn_nn->node_name = node_name; -- rsnn_nn->snn_len = (u8) strlen((char *)name); -- strncpy((char *)rsnn_nn->snn, (char *)name, rsnn_nn->snn_len); -+ strlcpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn)); -+ rsnn_nn->snn_len = (u8) strlen(rsnn_nn->snn); - - return sizeof(struct fcgs_rsnn_nn_req_s) + sizeof(struct ct_hdr_s); - } -diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c -index 0f19455951ec..475470efb7c6 100644 ---- a/drivers/scsi/bfa/bfa_fcs.c -+++ b/drivers/scsi/bfa/bfa_fcs.c -@@ -831,23 +831,23 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric) - bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model); - - /* Model name/number */ -- strncpy((char *)&port_cfg->sym_name, model, -- BFA_FCS_PORT_SYMBNAME_MODEL_SZ); -- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ strlcpy(port_cfg->sym_name.symname, model, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -+ BFA_SYMNAME_MAXLEN); - - /* Driver Version */ -- strncat((char *)&port_cfg->sym_name, (char *)driver_info->version, -- BFA_FCS_PORT_SYMBNAME_VERSION_SZ); -- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ strlcat(port_cfg->sym_name.symname, driver_info->version, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -+ BFA_SYMNAME_MAXLEN); - - /* Host machine name */ -- strncat((char *)&port_cfg->sym_name, -- (char *)driver_info->host_machine_name, -- BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ); -- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ strlcat(port_cfg->sym_name.symname, -+ driver_info->host_machine_name, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -+ BFA_SYMNAME_MAXLEN); - - /* - * Host OS Info : -@@ -855,24 +855,24 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric) - * OS name string and instead copy the entire OS info string (64 bytes). - */ - if (driver_info->host_os_patch[0] == '\0') { -- strncat((char *)&port_cfg->sym_name, -- (char *)driver_info->host_os_name, -- BFA_FCS_OS_STR_LEN); -- strncat((char *)&port_cfg->sym_name, -+ strlcat(port_cfg->sym_name.symname, -+ driver_info->host_os_name, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->sym_name.symname, - BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ BFA_SYMNAME_MAXLEN); - } else { -- strncat((char *)&port_cfg->sym_name, -- (char *)driver_info->host_os_name, -- BFA_FCS_PORT_SYMBNAME_OSINFO_SZ); -- strncat((char *)&port_cfg->sym_name, -+ strlcat(port_cfg->sym_name.symname, -+ driver_info->host_os_name, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->sym_name.symname, - BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ BFA_SYMNAME_MAXLEN); - - /* Append host OS Patch Info */ -- strncat((char *)&port_cfg->sym_name, -- (char *)driver_info->host_os_patch, -- BFA_FCS_PORT_SYMBNAME_OSPATCH_SZ); -+ strlcat(port_cfg->sym_name.symname, -+ driver_info->host_os_patch, -+ BFA_SYMNAME_MAXLEN); - } - - /* null terminate */ -@@ -892,26 +892,26 @@ bfa_fcs_fabric_nsymb_init(struct bfa_fcs_fabric_s *fabric) - bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model); - - /* Model name/number */ -- strncpy((char *)&port_cfg->node_sym_name, model, -- BFA_FCS_PORT_SYMBNAME_MODEL_SZ); -- strncat((char *)&port_cfg->node_sym_name, -+ strlcpy(port_cfg->node_sym_name.symname, model, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->node_sym_name.symname, - BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ BFA_SYMNAME_MAXLEN); - - /* Driver Version */ -- strncat((char *)&port_cfg->node_sym_name, (char *)driver_info->version, -- BFA_FCS_PORT_SYMBNAME_VERSION_SZ); -- strncat((char *)&port_cfg->node_sym_name, -+ strlcat(port_cfg->node_sym_name.symname, (char *)driver_info->version, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->node_sym_name.symname, - BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ BFA_SYMNAME_MAXLEN); - - /* Host machine name */ -- strncat((char *)&port_cfg->node_sym_name, -- (char *)driver_info->host_machine_name, -- BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ); -- strncat((char *)&port_cfg->node_sym_name, -+ strlcat(port_cfg->node_sym_name.symname, -+ driver_info->host_machine_name, -+ BFA_SYMNAME_MAXLEN); -+ strlcat(port_cfg->node_sym_name.symname, - BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -+ BFA_SYMNAME_MAXLEN); - - /* null terminate */ - port_cfg->node_sym_name.symname[BFA_SYMNAME_MAXLEN - 1] = 0; -diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c -index ff75ef891755..aa96f31ebc43 100644 ---- a/drivers/scsi/bfa/bfa_fcs_lport.c -+++ b/drivers/scsi/bfa/bfa_fcs_lport.c -@@ -2630,10 +2630,10 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi, - bfa_ioc_get_adapter_fw_ver(&port->fcs->bfa->ioc, - hba_attr->fw_version); - -- strncpy(hba_attr->driver_version, (char *)driver_info->version, -+ strlcpy(hba_attr->driver_version, (char *)driver_info->version, - sizeof(hba_attr->driver_version)); - -- strncpy(hba_attr->os_name, driver_info->host_os_name, -+ strlcpy(hba_attr->os_name, driver_info->host_os_name, - sizeof(hba_attr->os_name)); - - /* -@@ -2641,23 +2641,23 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi, - * to the os name along with a separator - */ - if (driver_info->host_os_patch[0] != '\0') { -- strncat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); -- strncat(hba_attr->os_name, driver_info->host_os_patch, -- sizeof(driver_info->host_os_patch)); -+ strlcat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, -+ sizeof(hba_attr->os_name)); -+ strlcat(hba_attr->os_name, driver_info->host_os_patch, -+ sizeof(hba_attr->os_name)); - } - - /* Retrieve the max frame size from the port attr */ - bfa_fcs_fdmi_get_portattr(fdmi, &fcs_port_attr); - hba_attr->max_ct_pyld = fcs_port_attr.max_frm_size; - -- strncpy(hba_attr->node_sym_name.symname, -+ strlcpy(hba_attr->node_sym_name.symname, - port->port_cfg.node_sym_name.symname, BFA_SYMNAME_MAXLEN); - strcpy(hba_attr->vendor_info, "BROCADE"); - hba_attr->num_ports = - cpu_to_be32(bfa_ioc_get_nports(&port->fcs->bfa->ioc)); - hba_attr->fabric_name = port->fabric->lps->pr_nwwn; -- strncpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN); -+ strlcpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN); - - } - -@@ -2724,20 +2724,20 @@ bfa_fcs_fdmi_get_portattr(struct bfa_fcs_lport_fdmi_s *fdmi, - /* - * OS device Name - */ -- strncpy(port_attr->os_device_name, (char *)driver_info->os_device_name, -+ strlcpy(port_attr->os_device_name, driver_info->os_device_name, - sizeof(port_attr->os_device_name)); - - /* - * Host name - */ -- strncpy(port_attr->host_name, (char *)driver_info->host_machine_name, -+ strlcpy(port_attr->host_name, driver_info->host_machine_name, - sizeof(port_attr->host_name)); - - port_attr->node_name = bfa_fcs_lport_get_nwwn(port); - port_attr->port_name = bfa_fcs_lport_get_pwwn(port); - -- strncpy(port_attr->port_sym_name.symname, -- (char *)&bfa_fcs_lport_get_psym_name(port), BFA_SYMNAME_MAXLEN); -+ strlcpy(port_attr->port_sym_name.symname, -+ bfa_fcs_lport_get_psym_name(port).symname, BFA_SYMNAME_MAXLEN); - bfa_fcs_lport_get_attr(port, &lport_attr); - port_attr->port_type = cpu_to_be32(lport_attr.port_type); - port_attr->scos = pport_attr.cos_supported; -@@ -3217,7 +3217,7 @@ bfa_fcs_lport_ms_gmal_response(void *fcsarg, struct bfa_fcxp_s *fcxp, - rsp_str[gmal_entry->len-1] = 0; - - /* copy IP Address to fabric */ -- strncpy(bfa_fcs_lport_get_fabric_ipaddr(port), -+ strlcpy(bfa_fcs_lport_get_fabric_ipaddr(port), - gmal_entry->ip_addr, - BFA_FCS_FABRIC_IPADDR_SZ); - break; -@@ -4655,21 +4655,13 @@ bfa_fcs_lport_ns_send_rspn_id(void *ns_cbarg, struct bfa_fcxp_s *fcxp_alloced) - * to that of the base port. - */ - -- strncpy((char *)psymbl, -- (char *) & -- (bfa_fcs_lport_get_psym_name -+ strlcpy(symbl, -+ (char *)&(bfa_fcs_lport_get_psym_name - (bfa_fcs_get_base_port(port->fcs))), -- strlen((char *) & -- bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port -- (port->fcs)))); -- -- /* Ensure we have a null terminating string. */ -- ((char *)psymbl)[strlen((char *) & -- bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port -- (port->fcs)))] = 0; -- strncat((char *)psymbl, -- (char *) &(bfa_fcs_lport_get_psym_name(port)), -- strlen((char *) &bfa_fcs_lport_get_psym_name(port))); -+ sizeof(symbl)); -+ -+ strlcat(symbl, (char *)&(bfa_fcs_lport_get_psym_name(port)), -+ sizeof(symbl)); - } else { - psymbl = (u8 *) &(bfa_fcs_lport_get_psym_name(port)); - } -@@ -5161,7 +5153,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced) - struct fchs_s fchs; - struct bfa_fcxp_s *fcxp; - u8 symbl[256]; -- u8 *psymbl = &symbl[0]; - int len; - - /* Avoid sending RSPN in the following states. */ -@@ -5191,22 +5182,17 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced) - * For Vports, we append the vport's port symbolic name - * to that of the base port. - */ -- strncpy((char *)psymbl, (char *)&(bfa_fcs_lport_get_psym_name -+ strlcpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name - (bfa_fcs_get_base_port(port->fcs))), -- strlen((char *)&bfa_fcs_lport_get_psym_name( -- bfa_fcs_get_base_port(port->fcs)))); -- -- /* Ensure we have a null terminating string. */ -- ((char *)psymbl)[strlen((char *)&bfa_fcs_lport_get_psym_name( -- bfa_fcs_get_base_port(port->fcs)))] = 0; -+ sizeof(symbl)); - -- strncat((char *)psymbl, -+ strlcat(symbl, - (char *)&(bfa_fcs_lport_get_psym_name(port)), -- strlen((char *)&bfa_fcs_lport_get_psym_name(port))); -+ sizeof(symbl)); - } - - len = fc_rspnid_build(&fchs, bfa_fcxp_get_reqbuf(fcxp), -- bfa_fcs_lport_get_fcid(port), 0, psymbl); -+ bfa_fcs_lport_get_fcid(port), 0, symbl); - - bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE, - FC_CLASS_3, len, &fchs, NULL, NULL, FC_MAX_PDUSZ, 0); -diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c -index 98f7e8cca52d..e533474748a5 100644 ---- a/drivers/scsi/bfa/bfa_ioc.c -+++ b/drivers/scsi/bfa/bfa_ioc.c -@@ -2802,7 +2802,7 @@ void - bfa_ioc_get_adapter_manufacturer(struct bfa_ioc_s *ioc, char *manufacturer) - { - memset((void *)manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN); -- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); -+ strlcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); - } - - void -diff --git a/drivers/scsi/bfa/bfa_svc.c b/drivers/scsi/bfa/bfa_svc.c -index 625225f31081..15d02eb09476 100644 ---- a/drivers/scsi/bfa/bfa_svc.c -+++ b/drivers/scsi/bfa/bfa_svc.c -@@ -365,8 +365,8 @@ bfa_plog_str(struct bfa_plog_s *plog, enum bfa_plog_mid mid, - lp.eid = event; - lp.log_type = BFA_PL_LOG_TYPE_STRING; - lp.misc = misc; -- strncpy(lp.log_entry.string_log, log_str, -- BFA_PL_STRING_LOG_SZ - 1); -+ strlcpy(lp.log_entry.string_log, log_str, -+ BFA_PL_STRING_LOG_SZ); - lp.log_entry.string_log[BFA_PL_STRING_LOG_SZ - 1] = '\0'; - bfa_plog_add(plog, &lp); - } -diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c -index cc3b9d3d6d40..bfefa2bfde0e 100644 ---- a/drivers/scsi/bfa/bfad.c -+++ b/drivers/scsi/bfa/bfad.c -@@ -987,20 +987,20 @@ bfad_start_ops(struct bfad_s *bfad) { - - /* Fill the driver_info info to fcs*/ - memset(&driver_info, 0, sizeof(driver_info)); -- strncpy(driver_info.version, BFAD_DRIVER_VERSION, -- sizeof(driver_info.version) - 1); -+ strlcpy(driver_info.version, BFAD_DRIVER_VERSION, -+ sizeof(driver_info.version)); - if (host_name) -- strncpy(driver_info.host_machine_name, host_name, -- sizeof(driver_info.host_machine_name) - 1); -+ strlcpy(driver_info.host_machine_name, host_name, -+ sizeof(driver_info.host_machine_name)); - if (os_name) -- strncpy(driver_info.host_os_name, os_name, -- sizeof(driver_info.host_os_name) - 1); -+ strlcpy(driver_info.host_os_name, os_name, -+ sizeof(driver_info.host_os_name)); - if (os_patch) -- strncpy(driver_info.host_os_patch, os_patch, -- sizeof(driver_info.host_os_patch) - 1); -+ strlcpy(driver_info.host_os_patch, os_patch, -+ sizeof(driver_info.host_os_patch)); - -- strncpy(driver_info.os_device_name, bfad->pci_name, -- sizeof(driver_info.os_device_name) - 1); -+ strlcpy(driver_info.os_device_name, bfad->pci_name, -+ sizeof(driver_info.os_device_name)); - - /* FCS driver info init */ - spin_lock_irqsave(&bfad->bfad_lock, flags); -diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c -index 40be670a1cbc..6d21bc6a7713 100644 ---- a/drivers/scsi/bfa/bfad_attr.c -+++ b/drivers/scsi/bfa/bfad_attr.c -@@ -842,7 +842,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, - char symname[BFA_SYMNAME_MAXLEN]; - - bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); -- strncpy(symname, port_attr.port_cfg.sym_name.symname, -+ strlcpy(symname, port_attr.port_cfg.sym_name.symname, - BFA_SYMNAME_MAXLEN); - return snprintf(buf, PAGE_SIZE, "%s\n", symname); - } -diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c -index 023b9d42ad9a..be2de04179d0 100644 ---- a/drivers/scsi/bfa/bfad_bsg.c -+++ b/drivers/scsi/bfa/bfad_bsg.c -@@ -126,7 +126,7 @@ bfad_iocmd_ioc_get_attr(struct bfad_s *bfad, void *cmd) - - /* fill in driver attr info */ - strcpy(iocmd->ioc_attr.driver_attr.driver, BFAD_DRIVER_NAME); -- strncpy(iocmd->ioc_attr.driver_attr.driver_ver, -+ strlcpy(iocmd->ioc_attr.driver_attr.driver_ver, - BFAD_DRIVER_VERSION, BFA_VERSION_LEN); - strcpy(iocmd->ioc_attr.driver_attr.fw_ver, - iocmd->ioc_attr.adapter_attr.fw_ver); -@@ -314,9 +314,9 @@ bfad_iocmd_port_get_attr(struct bfad_s *bfad, void *cmd) - iocmd->attr.port_type = port_attr.port_type; - iocmd->attr.loopback = port_attr.loopback; - iocmd->attr.authfail = port_attr.authfail; -- strncpy(iocmd->attr.port_symname.symname, -+ strlcpy(iocmd->attr.port_symname.symname, - port_attr.port_cfg.sym_name.symname, -- sizeof(port_attr.port_cfg.sym_name.symname)); -+ sizeof(iocmd->attr.port_symname.symname)); - - iocmd->status = BFA_STATUS_OK; - return 0; -diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c -index c00b2ff72b55..be5ee2d37815 100644 ---- a/drivers/scsi/csiostor/csio_lnode.c -+++ b/drivers/scsi/csiostor/csio_lnode.c -@@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len) - } - - static inline void --csio_append_attrib(uint8_t **ptr, uint16_t type, uint8_t *val, uint16_t len) -+csio_append_attrib(uint8_t **ptr, uint16_t type, void *val, size_t val_len) - { -+ uint16_t len; - struct fc_fdmi_attr_entry *ae = (struct fc_fdmi_attr_entry *)*ptr; -+ -+ if (WARN_ON(val_len > U16_MAX)) -+ return; -+ -+ len = val_len; -+ - ae->type = htons(type); - len += 4; /* includes attribute type and length */ - len = (len + 3) & ~3; /* should be multiple of 4 bytes */ - ae->len = htons(len); -- memcpy(ae->value, val, len); -+ memcpy(ae->value, val, val_len); -+ if (len > val_len) -+ memset(ae->value + val_len, 0, len - val_len); - *ptr += len; - } - -@@ -335,7 +344,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - numattrs++; - val = htonl(FC_PORTSPEED_1GBIT | FC_PORTSPEED_10GBIT); - csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_SUPPORTEDSPEED, -- (uint8_t *)&val, -+ &val, - FC_FDMI_PORT_ATTR_SUPPORTEDSPEED_LEN); - numattrs++; - -@@ -346,23 +355,22 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - else - val = htonl(CSIO_HBA_PORTSPEED_UNKNOWN); - csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED, -- (uint8_t *)&val, -- FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN); -+ &val, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN); - numattrs++; - - mfs = ln->ln_sparm.csp.sp_bb_data; - csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_MAXFRAMESIZE, -- (uint8_t *)&mfs, FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN); -+ &mfs, sizeof(mfs)); - numattrs++; - - strcpy(buf, "csiostor"); - csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_OSDEVICENAME, buf, -- (uint16_t)strlen(buf)); -+ strlen(buf)); - numattrs++; - - if (!csio_hostname(buf, sizeof(buf))) { - csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_HOSTNAME, -- buf, (uint16_t)strlen(buf)); -+ buf, strlen(buf)); - numattrs++; - } - attrib_blk->numattrs = htonl(numattrs); -@@ -444,33 +452,32 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - - strcpy(buf, "Chelsio Communications"); - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MANUFACTURER, buf, -- (uint16_t)strlen(buf)); -+ strlen(buf)); - numattrs++; - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_SERIALNUMBER, -- hw->vpd.sn, (uint16_t)sizeof(hw->vpd.sn)); -+ hw->vpd.sn, sizeof(hw->vpd.sn)); - numattrs++; - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODEL, hw->vpd.id, -- (uint16_t)sizeof(hw->vpd.id)); -+ sizeof(hw->vpd.id)); - numattrs++; - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODELDESCRIPTION, -- hw->model_desc, (uint16_t)strlen(hw->model_desc)); -+ hw->model_desc, strlen(hw->model_desc)); - numattrs++; - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_HARDWAREVERSION, -- hw->hw_ver, (uint16_t)sizeof(hw->hw_ver)); -+ hw->hw_ver, sizeof(hw->hw_ver)); - numattrs++; - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_FIRMWAREVERSION, -- hw->fwrev_str, (uint16_t)strlen(hw->fwrev_str)); -+ hw->fwrev_str, strlen(hw->fwrev_str)); - numattrs++; - - if (!csio_osname(buf, sizeof(buf))) { - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_OSNAMEVERSION, -- buf, (uint16_t)strlen(buf)); -+ buf, strlen(buf)); - numattrs++; - } - - csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD, -- (uint8_t *)&maxpayload, -- FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN); -+ &maxpayload, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN); - len = (uint32_t)(pld - (uint8_t *)cmd); - numattrs++; - attrib_blk->numattrs = htonl(numattrs); -@@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req, - struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw); - int rv; - -+ BUG_ON(pld_len > pld->len); -+ - io_req->io_cbfn = io_cbfn; /* Upper layer callback handler */ - io_req->fw_handle = (uintptr_t) (io_req); - io_req->eq_idx = mgmtm->eq_idx; -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 6b61b09b3226..75f2179860a7 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -33,7 +33,6 @@ struct scsi_dev_info_list_table { - }; - - --static const char spaces[] = " "; /* 16 of them */ - static unsigned scsi_default_dev_flags; - static LIST_HEAD(scsi_dev_info_list); - static char scsi_dev_flags[256]; -@@ -291,20 +290,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length, - size_t from_length; - - from_length = strlen(from); -- strncpy(to, from, min(to_length, from_length)); -- if (from_length < to_length) { -- if (compatible) { -- /* -- * NUL terminate the string if it is short. -- */ -- to[from_length] = '\0'; -- } else { -- /* -- * space pad the string if it is short. -- */ -- strncpy(&to[from_length], spaces, -- to_length - from_length); -- } -+ /* this zero-pads the destination */ -+ strncpy(to, from, to_length); -+ if (from_length < to_length && !compatible) { -+ /* -+ * space pad the string if it is short. -+ */ -+ memset(&to[from_length], ' ', to_length - from_length); - } - if (from_length > to_length) - printk(KERN_WARNING "%s: %s string '%s' is too long\n", -diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c -index 635a93cc94de..eed7603db5ec 100644 ---- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c -+++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c -@@ -700,7 +700,7 @@ repeat_fid2path: - memmove(ptr + strlen(gf->gf_path) + 1, ptr, - strlen(ori_gf->gf_path)); - -- strncpy(ptr, gf->gf_path, strlen(gf->gf_path)); -+ strcpy(ptr, gf->gf_path); - ptr += strlen(gf->gf_path); - *ptr = '/'; - } -diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c -index 9a876ce92dbd..dc91cd29f1d2 100644 ---- a/drivers/staging/rts5208/sd.c -+++ b/drivers/staging/rts5208/sd.c -@@ -4165,12 +4165,6 @@ RTY_SEND_CMD: - rtsx_trace(chip); - return STATUS_FAIL; - } -- -- } else if (rsp_type == SD_RSP_TYPE_R0) { -- if ((ptr[3] & 0x1E) != 0x03) { -- rtsx_trace(chip); -- return STATUS_FAIL; -- } - } - } - } -diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c -index 78883ca64ddd..035810bbcd02 100644 ---- a/drivers/tty/serial/8250/8250_mtk.c -+++ b/drivers/tty/serial/8250/8250_mtk.c -@@ -231,17 +231,17 @@ static int mtk8250_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, data); - -- pm_runtime_enable(&pdev->dev); -- if (!pm_runtime_enabled(&pdev->dev)) { -- err = mtk8250_runtime_resume(&pdev->dev); -- if (err) -- return err; -- } -+ err = mtk8250_runtime_resume(&pdev->dev); -+ if (err) -+ return err; - - data->line = serial8250_register_8250_port(&uart); - if (data->line < 0) - return data->line; - -+ pm_runtime_set_active(&pdev->dev); -+ pm_runtime_enable(&pdev->dev); -+ - return 0; - } - -@@ -252,13 +252,11 @@ static int mtk8250_remove(struct platform_device *pdev) - pm_runtime_get_sync(&pdev->dev); - - serial8250_unregister_port(data->line); -+ mtk8250_runtime_suspend(&pdev->dev); - - pm_runtime_disable(&pdev->dev); - pm_runtime_put_noidle(&pdev->dev); - -- if (!pm_runtime_status_suspended(&pdev->dev)) -- mtk8250_runtime_suspend(&pdev->dev); -- - return 0; - } - -diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c -index 2db68dfe497d..f2b0d8cee8ef 100644 ---- a/drivers/tty/serial/kgdboc.c -+++ b/drivers/tty/serial/kgdboc.c -@@ -131,24 +131,6 @@ static void kgdboc_unregister_kbd(void) - #define kgdboc_restore_input() - #endif /* ! CONFIG_KDB_KEYBOARD */ - --static int kgdboc_option_setup(char *opt) --{ -- if (!opt) { -- pr_err("kgdboc: config string not provided\n"); -- return -EINVAL; -- } -- -- if (strlen(opt) >= MAX_CONFIG_LEN) { -- printk(KERN_ERR "kgdboc: config string too long\n"); -- return -ENOSPC; -- } -- strcpy(config, opt); -- -- return 0; --} -- --__setup("kgdboc=", kgdboc_option_setup); -- - static void cleanup_kgdboc(void) - { - if (kgdb_unregister_nmi_console()) -@@ -162,15 +144,13 @@ static int configure_kgdboc(void) - { - struct tty_driver *p; - int tty_line = 0; -- int err; -+ int err = -ENODEV; - char *cptr = config; - struct console *cons; - -- err = kgdboc_option_setup(config); -- if (err || !strlen(config) || isspace(config[0])) -+ if (!strlen(config) || isspace(config[0])) - goto noconfig; - -- err = -ENODEV; - kgdboc_io_ops.is_console = 0; - kgdb_tty_driver = NULL; - -@@ -252,7 +232,7 @@ static void kgdboc_put_char(u8 chr) - - static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp) - { -- int len = strlen(kmessage); -+ size_t len = strlen(kmessage); - - if (len >= MAX_CONFIG_LEN) { - printk(KERN_ERR "kgdboc: config string too long\n"); -@@ -274,7 +254,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp) - - strcpy(config, kmessage); - /* Chop out \n char as a result of echo */ -- if (config[len - 1] == '\n') -+ if (len && config[len - 1] == '\n') - config[len - 1] = '\0'; - - if (configured == 1) -@@ -318,6 +298,25 @@ static struct kgdb_io kgdboc_io_ops = { - }; - - #ifdef CONFIG_KGDB_SERIAL_CONSOLE -+static int kgdboc_option_setup(char *opt) -+{ -+ if (!opt) { -+ pr_err("config string not provided\n"); -+ return -EINVAL; -+ } -+ -+ if (strlen(opt) >= MAX_CONFIG_LEN) { -+ pr_err("config string too long\n"); -+ return -ENOSPC; -+ } -+ strcpy(config, opt); -+ -+ return 0; -+} -+ -+__setup("kgdboc=", kgdboc_option_setup); -+ -+ - /* This is only available if kgdboc is a built in for early debugging */ - static int __init kgdboc_early_init(char *opt) - { -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index f7af730aae82..be63db142d3f 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2211,7 +2211,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev) - /* descriptor may appear anywhere in config */ - err = __usb_get_extra_descriptor(udev->rawdescriptors[0], - le16_to_cpu(udev->config[0].desc.wTotalLength), -- USB_DT_OTG, (void **) &desc); -+ USB_DT_OTG, (void **) &desc, sizeof(*desc)); - if (err || !(desc->bmAttributes & USB_OTG_HNP)) - return 0; - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 1e8f68960014..cf378b1ed373 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -64,6 +64,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Microsoft LifeCam-VX700 v2.0 */ - { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */ -+ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, -+ - /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, -@@ -185,6 +188,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Midiman M-Audio Keystation 88es */ - { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* SanDisk Ultra Fit and Ultra Flair */ -+ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, -+ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* M-Systems Flash Disk Pioneers */ - { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c -index ad308c8e9af5..36e5098e4e6f 100644 ---- a/drivers/usb/core/usb.c -+++ b/drivers/usb/core/usb.c -@@ -678,14 +678,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number); - */ - - int __usb_get_extra_descriptor(char *buffer, unsigned size, -- unsigned char type, void **ptr) -+ unsigned char type, void **ptr, size_t minsize) - { - struct usb_descriptor_header *header; - - while (size >= sizeof(struct usb_descriptor_header)) { - header = (struct usb_descriptor_header *)buffer; - -- if (header->bLength < 2) { -+ if (header->bLength < 2 || header->bLength > size) { - printk(KERN_ERR - "%s: bogus descriptor, type %d length %d\n", - usbcore_name, -@@ -694,7 +694,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size, - return -1; - } - -- if (header->bDescriptorType == type) { -+ if (header->bDescriptorType == type && header->bLength >= minsize) { - *ptr = header; - return 0; - } -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index eb876ed96861..85f1f282c1d5 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -379,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd) - USB_PORT_STAT_CONNECTION) == 0) - dum_hcd->port_status |= - (USB_PORT_STAT_C_CONNECTION << 16); -- if ((dum_hcd->port_status & -- USB_PORT_STAT_ENABLE) == 1 && -- (dum_hcd->port_status & -- USB_SS_PORT_LS_U0) == 1 && -- dum_hcd->rh_state != DUMMY_RH_SUSPENDED) -+ if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) && -+ (dum_hcd->port_status & -+ USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 && -+ dum_hcd->rh_state != DUMMY_RH_SUSPENDED) - dum_hcd->active = 1; - } - } else { -diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c -index 1db0626c8bf4..97750f162f01 100644 ---- a/drivers/usb/host/hwa-hc.c -+++ b/drivers/usb/host/hwa-hc.c -@@ -654,7 +654,7 @@ static int hwahc_security_create(struct hwahc *hwahc) - top = itr + itr_size; - result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index], - le16_to_cpu(usb_dev->actconfig->desc.wTotalLength), -- USB_DT_SECURITY, (void **) &secd); -+ USB_DT_SECURITY, (void **) &secd, sizeof(*secd)); - if (result == -1) { - dev_warn(dev, "BUG? WUSB host has no security descriptors\n"); - return 0; -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 9dbf1583bd7a..e3fdc799ad6e 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -4417,6 +4417,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -+ /* Prevent U1 if service interval is shorter than U1 exit latency */ -+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -+ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) { -+ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n"); -+ return USB3_LPM_DISABLED; -+ } -+ } -+ - if (xhci->quirks & XHCI_INTEL_HOST) - timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); - else -@@ -4473,6 +4481,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -+ /* Prevent U2 if service interval is shorter than U2 exit latency */ -+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -+ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) { -+ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n"); -+ return USB3_LPM_DISABLED; -+ } -+ } -+ - if (xhci->quirks & XHCI_INTEL_HOST) - timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); - else -diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c -index b15842c6f916..993f4da065c3 100644 ---- a/drivers/usb/misc/appledisplay.c -+++ b/drivers/usb/misc/appledisplay.c -@@ -64,6 +64,7 @@ static const struct usb_device_id appledisplay_table[] = { - { APPLEDISPLAY_DEVICE(0x921c) }, - { APPLEDISPLAY_DEVICE(0x921d) }, - { APPLEDISPLAY_DEVICE(0x9222) }, -+ { APPLEDISPLAY_DEVICE(0x9226) }, - { APPLEDISPLAY_DEVICE(0x9236) }, - - /* Terminating entry */ -diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h -index e41f50c95ed4..f5fc3271e19c 100644 ---- a/drivers/usb/storage/unusual_realtek.h -+++ b/drivers/usb/storage/unusual_realtek.h -@@ -38,4 +38,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999, - "USB Card Reader", - USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), - -+UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999, -+ "Realtek", -+ "USB Card Reader", -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), -+ -+UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999, -+ "Realtek", -+ "USB Card Reader", -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), -+ - #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */ -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index b0875ef48522..1f21c6c33228 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -445,9 +445,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root, - int mirror_num = 0; - int failed_mirror = 0; - -- clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags); - io_tree = &BTRFS_I(root->fs_info->btree_inode)->io_tree; - while (1) { -+ clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags); - ret = read_extent_buffer_pages(io_tree, eb, start, - WAIT_COMPLETE, - btree_get_extent, mirror_num); -@@ -459,14 +459,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root, - ret = -EIO; - } - -- /* -- * This buffer's crc is fine, but its contents are corrupted, so -- * there is no reason to read the other copies, they won't be -- * any less wrong. -- */ -- if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags)) -- break; -- - num_copies = btrfs_num_copies(root->fs_info, - eb->start, eb->len); - if (num_copies == 1) -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index 1aa897dd9ce3..6c0161284a9e 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -2469,6 +2469,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group, - struct rb_node *n; - int count = 0; - -+ spin_lock(&ctl->tree_lock); - for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) { - info = rb_entry(n, struct btrfs_free_space, offset_index); - if (info->bytes >= bytes && !block_group->ro) -@@ -2478,6 +2479,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group, - info->offset, info->bytes, - (info->bitmap) ? "yes" : "no"); - } -+ spin_unlock(&ctl->tree_lock); - btrfs_info(block_group->fs_info, "block group has cluster?: %s", - list_empty(&block_group->cluster_list) ? "no" : "yes"); - btrfs_info(block_group->fs_info, -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index 3bd2233737ac..0f99336c37eb 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -2104,6 +2104,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, - vol = memdup_user((void __user *)arg, sizeof(*vol)); - if (IS_ERR(vol)) - return PTR_ERR(vol); -+ vol->name[BTRFS_PATH_NAME_MAX] = '\0'; - - switch (cmd) { - case BTRFS_IOC_SCAN_DEV: -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index be8eae80ff65..098016338f98 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -1821,6 +1821,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, - return ret; - } - -+ btrfs_trans_release_metadata(trans, root); -+ trans->block_rsv = NULL; -+ - /* make a pass through all the delayed refs we have so far - * any runnings procs may add more while we are here - */ -@@ -1830,9 +1833,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, - return ret; - } - -- btrfs_trans_release_metadata(trans, root); -- trans->block_rsv = NULL; -- - cur_trans = trans->transaction; - - /* -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index 76dacd5307b9..afd317eb9db9 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -163,7 +163,7 @@ cifs_bp_rename_retry: - - cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath); - memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1); -- full_path[dfsplen] = '\\'; -+ full_path[dfsplen] = dirsep; - for (i = 0; i < pplen-1; i++) - if (full_path[dfsplen+1+i] == '/') - full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb); -diff --git a/fs/exec.c b/fs/exec.c -index 9c5ee2a880aa..910fc70c4542 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1077,15 +1077,14 @@ killed: - return -EAGAIN; - } - --char *get_task_comm(char *buf, struct task_struct *tsk) -+char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) - { -- /* buf must be at least sizeof(tsk->comm) in size */ - task_lock(tsk); -- strncpy(buf, tsk->comm, sizeof(tsk->comm)); -+ strncpy(buf, tsk->comm, buf_size); - task_unlock(tsk); - return buf; - } --EXPORT_SYMBOL_GPL(get_task_comm); -+EXPORT_SYMBOL_GPL(__get_task_comm); - - /* - * These functions flushes out all traces of the currently running executable -diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c -index fa70848afa8f..22d817dc821e 100644 ---- a/fs/ext2/xattr.c -+++ b/fs/ext2/xattr.c -@@ -605,9 +605,9 @@ skip_replace: - } - - cleanup: -- brelse(bh); - if (!(bh && header == HDR(bh))) - kfree(header); -+ brelse(bh); - up_write(&EXT2_I(inode)->xattr_sem); - - return error; -diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c -index db272528ab5b..b3b293e2c099 100644 ---- a/fs/kernfs/symlink.c -+++ b/fs/kernfs/symlink.c -@@ -88,7 +88,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent, - int slen = strlen(kn->name); - - len -= slen; -- strncpy(s + len, kn->name, slen); -+ memcpy(s + len, kn->name, slen); - if (len) - s[--len] = '/'; - -diff --git a/include/linux/sched.h b/include/linux/sched.h -index b30540d6d125..48a59f731406 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -2668,7 +2668,12 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from) - { - __set_task_comm(tsk, from, false); - } --extern char *get_task_comm(char *to, struct task_struct *tsk); -+ -+extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk); -+#define get_task_comm(buf, tsk) ({ \ -+ BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN); \ -+ __get_task_comm(buf, sizeof(buf), tsk); \ -+}) - - #ifdef CONFIG_SMP - void scheduler_ipi(void); -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 092b5658b9c3..5c03ebc6dfa0 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -334,11 +334,11 @@ struct usb_host_bos { - }; - - int __usb_get_extra_descriptor(char *buffer, unsigned size, -- unsigned char type, void **ptr); -+ unsigned char type, void **ptr, size_t min); - #define usb_get_extra_descriptor(ifpoint, type, ptr) \ - __usb_get_extra_descriptor((ifpoint)->extra, \ - (ifpoint)->extralen, \ -- type, (void **)ptr) -+ type, (void **)ptr, sizeof(**(ptr))) - - /* ----------------------------------------------------------------------- */ - -diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h -index c704357775fc..2af7bb3ee57d 100644 ---- a/include/sound/pcm_params.h -+++ b/include/sound/pcm_params.h -@@ -247,11 +247,13 @@ static inline int snd_interval_empty(const struct snd_interval *i) - static inline int snd_interval_single(const struct snd_interval *i) - { - return (i->min == i->max || -- (i->min + 1 == i->max && i->openmax)); -+ (i->min + 1 == i->max && (i->openmin || i->openmax))); - } - - static inline int snd_interval_value(const struct snd_interval *i) - { -+ if (i->openmin && !i->openmax) -+ return i->max; - return i->min; - } - -diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c -index 2aed4a33521b..61cd704a21c8 100644 ---- a/kernel/debug/kdb/kdb_support.c -+++ b/kernel/debug/kdb/kdb_support.c -@@ -129,13 +129,13 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) - } - if (i >= ARRAY_SIZE(kdb_name_table)) { - debug_kfree(kdb_name_table[0]); -- memcpy(kdb_name_table, kdb_name_table+1, -+ memmove(kdb_name_table, kdb_name_table+1, - sizeof(kdb_name_table[0]) * - (ARRAY_SIZE(kdb_name_table)-1)); - } else { - debug_kfree(knt1); - knt1 = kdb_name_table[i]; -- memcpy(kdb_name_table+i, kdb_name_table+i+1, -+ memmove(kdb_name_table+i, kdb_name_table+i+1, - sizeof(kdb_name_table[0]) * - (ARRAY_SIZE(kdb_name_table)-i-1)); - } -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index da0c09ff6112..7108097fa2f2 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -606,7 +606,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file, - BUG_ON((uprobe->offset & ~PAGE_MASK) + - UPROBE_SWBP_INSN_SIZE > PAGE_SIZE); - -- smp_wmb(); /* pairs with rmb() in find_active_uprobe() */ -+ smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */ - set_bit(UPROBE_COPY_INSN, &uprobe->flags); - - out: -@@ -1892,10 +1892,18 @@ static void handle_swbp(struct pt_regs *regs) - * After we hit the bp, _unregister + _register can install the - * new and not-yet-analyzed uprobe at the same address, restart. - */ -- smp_rmb(); /* pairs with wmb() in install_breakpoint() */ - if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags))) - goto out; - -+ /* -+ * Pairs with the smp_wmb() in prepare_uprobe(). -+ * -+ * Guarantees that if we see the UPROBE_COPY_INSN bit set, then -+ * we must also see the stores to &uprobe->arch performed by the -+ * prepare_uprobe() call. -+ */ -+ smp_rmb(); -+ - /* Tracing handlers use ->utask to communicate with fetch methods */ - if (!get_utask()) - goto out; -diff --git a/lib/kobject.c b/lib/kobject.c -index 895edb63fba4..35d490b02cdd 100644 ---- a/lib/kobject.c -+++ b/lib/kobject.c -@@ -127,7 +127,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) - int cur = strlen(kobject_name(parent)); - /* back up enough to print this name with '/' */ - length -= cur; -- strncpy(path + length, kobject_name(parent), cur); -+ memcpy(path + length, kobject_name(parent), cur); - *(path + --length) = '/'; - } - -diff --git a/mm/mlock.c b/mm/mlock.c -index 9d2e773f3a95..b03f160c1bdd 100644 ---- a/mm/mlock.c -+++ b/mm/mlock.c -@@ -504,6 +504,7 @@ static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev, - int nr_pages; - int ret = 0; - int lock = !!(newflags & VM_LOCKED); -+ vm_flags_t old_flags = vma->vm_flags; - - if (newflags == vma->vm_flags || (vma->vm_flags & VM_SPECIAL) || - is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm)) -@@ -538,6 +539,8 @@ success: - nr_pages = (end - start) >> PAGE_SHIFT; - if (!lock) - nr_pages = -nr_pages; -+ else if (old_flags & VM_LOCKED) -+ nr_pages = 0; - mm->locked_vm += nr_pages; - - /* -diff --git a/mm/truncate.c b/mm/truncate.c -index f4c8270f7b84..aeb1adba329e 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -432,9 +432,13 @@ void truncate_inode_pages_final(struct address_space *mapping) - */ - spin_lock_irq(&mapping->tree_lock); - spin_unlock_irq(&mapping->tree_lock); -- -- truncate_inode_pages(mapping, 0); - } -+ -+ /* -+ * Cleancache needs notification even if there are no pages or shadow -+ * entries. -+ */ -+ truncate_inode_pages(mapping, 0); - } - EXPORT_SYMBOL(truncate_inode_pages_final); - -diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c -index 5d2f9d4879b2..d50c3b003dc9 100644 ---- a/net/batman-adv/fragmentation.c -+++ b/net/batman-adv/fragmentation.c -@@ -266,7 +266,7 @@ batadv_frag_merge_packets(struct hlist_head *chain) - kfree(entry); - - packet = (struct batadv_frag_packet *)skb_out->data; -- size = ntohs(packet->total_size); -+ size = ntohs(packet->total_size) + hdr_size; - - /* Make room for the rest of the fragments. */ - if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 9d3176b080a4..91ae061d46ac 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net, - } else { - if (strlen(ops->kind) > (IFNAMSIZ - 3)) - goto failed; -- strlcpy(name, ops->kind, IFNAMSIZ); -- strncat(name, "%d", 2); -+ strcpy(name, ops->kind); -+ strcat(name, "%d"); - } - - ASSERT_RTNL(); -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index 58588a610b05..519def0e15f1 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -987,6 +987,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, - if (local->open_count == 0) - ieee80211_clear_tx_pending(local); - -+ sdata->vif.bss_conf.beacon_int = 0; -+ - /* - * If the interface goes down while suspended, presumably because - * the device was unplugged and that happens before our resume, -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index f8406c37fc1d..64f76f88f819 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -1109,6 +1109,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) - return RX_CONTINUE; - - if (ieee80211_is_ctl(hdr->frame_control) || -+ ieee80211_is_nullfunc(hdr->frame_control) || - ieee80211_is_qos_nullfunc(hdr->frame_control) || - is_multicast_ether_addr(hdr->addr1)) - return RX_CONTINUE; -diff --git a/net/mac80211/status.c b/net/mac80211/status.c -index 2731cf5bf052..d221300e59e5 100644 ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -648,6 +648,8 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw, - /* Track when last TDLS packet was ACKed */ - if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) - sta->status_stats.last_tdls_pkt_time = jiffies; -+ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) { -+ return; - } else { - ieee80211_lost_packet(sta, info); - } -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index ea5dfefd765a..c1c27a516e45 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -431,8 +431,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) - if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL)) - info->hw_queue = tx->sdata->vif.cab_queue; - -- /* no stations in PS mode */ -- if (!atomic_read(&ps->num_sta_ps)) -+ /* no stations in PS mode and no buffered packets */ -+ if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf)) - return TX_CONTINUE; - - info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; -diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c -index 1f0687d8e3d7..62fca77bf3c7 100644 ---- a/net/sunrpc/auth_gss/auth_gss.c -+++ b/net/sunrpc/auth_gss/auth_gss.c -@@ -1722,6 +1722,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp) - for (i=0; i < rqstp->rq_enc_pages_num; i++) - __free_page(rqstp->rq_enc_pages[i]); - kfree(rqstp->rq_enc_pages); -+ rqstp->rq_release_snd_buf = NULL; - } - - static int -@@ -1730,6 +1731,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp) - struct xdr_buf *snd_buf = &rqstp->rq_snd_buf; - int first, last, i; - -+ if (rqstp->rq_release_snd_buf) -+ rqstp->rq_release_snd_buf(rqstp); -+ - if (snd_buf->page_len == 0) { - rqstp->rq_enc_pages_num = 0; - return 0; -diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn -index abe5f47b1ab0..93e23a73b232 100644 ---- a/scripts/Makefile.extrawarn -+++ b/scripts/Makefile.extrawarn -@@ -10,6 +10,8 @@ - # are not supported by all versions of the compiler - # ========================================================================== - -+KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned) -+ - ifeq ("$(origin W)", "command line") - export KBUILD_ENABLE_EXTRA_GCC_CHECKS := $(W) - endif -@@ -25,6 +27,7 @@ warning-1 += -Wold-style-definition - warning-1 += $(call cc-option, -Wmissing-include-dirs) - warning-1 += $(call cc-option, -Wunused-but-set-variable) - warning-1 += $(call cc-option, -Wunused-const-variable) -+warning-1 += $(call cc-option, -Wpacked-not-aligned) - warning-1 += $(call cc-disable-warning, missing-field-initializers) - - warning-2 := -Waggregate-return -diff --git a/scripts/unifdef.c b/scripts/unifdef.c -index 7493c0ee51cc..db00e3e30a59 100644 ---- a/scripts/unifdef.c -+++ b/scripts/unifdef.c -@@ -395,7 +395,7 @@ usage(void) - * When we have processed a group that starts off with a known-false - * #if/#elif sequence (which has therefore been deleted) followed by a - * #elif that we don't understand and therefore must keep, we edit the -- * latter into a #if to keep the nesting correct. We use strncpy() to -+ * latter into a #if to keep the nesting correct. We use memcpy() to - * overwrite the 4 byte token "elif" with "if " without a '\0' byte. - * - * When we find a true #elif in a group, the following block will -@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop(); ignoreon(); } - static void Itrue (void) { Ftrue(); ignoreon(); } - static void Ifalse(void) { Ffalse(); ignoreon(); } - /* modify this line */ --static void Mpass (void) { strncpy(keyword, "if ", 4); Pelif(); } -+static void Mpass (void) { memcpy(keyword, "if ", 4); Pelif(); } - static void Mtrue (void) { keywordedit("else"); state(IS_TRUE_MIDDLE); } - static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); } - static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); } -diff --git a/sound/core/control.c b/sound/core/control.c -index bd01d492f46a..2be860a446a2 100644 ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -346,6 +346,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count) - return 0; - } - -+/* add a new kcontrol object; call with card->controls_rwsem locked */ -+static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) -+{ -+ struct snd_ctl_elem_id id; -+ unsigned int idx; -+ unsigned int count; -+ -+ id = kcontrol->id; -+ if (id.index > UINT_MAX - kcontrol->count) -+ return -EINVAL; -+ -+ if (snd_ctl_find_id(card, &id)) { -+ dev_err(card->dev, -+ "control %i:%i:%i:%s:%i is already present\n", -+ id.iface, id.device, id.subdevice, id.name, id.index); -+ return -EBUSY; -+ } -+ -+ if (snd_ctl_find_hole(card, kcontrol->count) < 0) -+ return -ENOMEM; -+ -+ list_add_tail(&kcontrol->list, &card->controls); -+ card->controls_count += kcontrol->count; -+ kcontrol->id.numid = card->last_numid + 1; -+ card->last_numid += kcontrol->count; -+ -+ id = kcontrol->id; -+ count = kcontrol->count; -+ for (idx = 0; idx < count; idx++, id.index++, id.numid++) -+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); -+ -+ return 0; -+} -+ - /** - * snd_ctl_add - add the control instance to the card - * @card: the card instance -@@ -362,45 +396,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count) - */ - int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) - { -- struct snd_ctl_elem_id id; -- unsigned int idx; -- unsigned int count; - int err = -EINVAL; - - if (! kcontrol) - return err; - if (snd_BUG_ON(!card || !kcontrol->info)) - goto error; -- id = kcontrol->id; -- if (id.index > UINT_MAX - kcontrol->count) -- goto error; - - down_write(&card->controls_rwsem); -- if (snd_ctl_find_id(card, &id)) { -- up_write(&card->controls_rwsem); -- dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n", -- id.iface, -- id.device, -- id.subdevice, -- id.name, -- id.index); -- err = -EBUSY; -- goto error; -- } -- if (snd_ctl_find_hole(card, kcontrol->count) < 0) { -- up_write(&card->controls_rwsem); -- err = -ENOMEM; -- goto error; -- } -- list_add_tail(&kcontrol->list, &card->controls); -- card->controls_count += kcontrol->count; -- kcontrol->id.numid = card->last_numid + 1; -- card->last_numid += kcontrol->count; -- id = kcontrol->id; -- count = kcontrol->count; -+ err = __snd_ctl_add(card, kcontrol); - up_write(&card->controls_rwsem); -- for (idx = 0; idx < count; idx++, id.index++, id.numid++) -- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); -+ if (err < 0) -+ goto error; - return 0; - - error: -@@ -1322,9 +1329,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, - kctl->tlv.c = snd_ctl_elem_user_tlv; - - /* This function manage to free the instance on failure. */ -- err = snd_ctl_add(card, kctl); -- if (err < 0) -- return err; -+ down_write(&card->controls_rwsem); -+ err = __snd_ctl_add(card, kctl); -+ if (err < 0) { -+ snd_ctl_free_one(kctl); -+ goto unlock; -+ } - offset = snd_ctl_get_ioff(kctl, &info->id); - snd_ctl_build_ioff(&info->id, kctl, offset); - /* -@@ -1335,10 +1345,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, - * which locks the element. - */ - -- down_write(&card->controls_rwsem); - card->user_ctl_count++; -- up_write(&card->controls_rwsem); - -+ unlock: -+ up_write(&card->controls_rwsem); - return 0; - } - -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 3de88974eeb6..0ad194002c0c 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - /* - * Compatibility -@@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem); - * and this may lead to a deadlock when the code path takes read sem - * twice (e.g. one in snd_pcm_action_nonatomic() and another in - * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to -- * spin until it gets the lock. -+ * sleep until all the readers are completed without blocking by writer. - */ --static inline void down_write_nonblock(struct rw_semaphore *lock) -+static inline void down_write_nonfifo(struct rw_semaphore *lock) - { - while (!down_write_trylock(lock)) -- cond_resched(); -+ msleep(1); - } - - /** -@@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd) - res = -ENOMEM; - goto _nolock; - } -- down_write_nonblock(&snd_pcm_link_rwsem); -+ down_write_nonfifo(&snd_pcm_link_rwsem); - write_lock_irq(&snd_pcm_link_rwlock); - if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN || - substream->runtime->status->state != substream1->runtime->status->state || -@@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream) - struct snd_pcm_substream *s; - int res = 0; - -- down_write_nonblock(&snd_pcm_link_rwsem); -+ down_write_nonfifo(&snd_pcm_link_rwsem); - write_lock_irq(&snd_pcm_link_rwlock); - if (!snd_pcm_stream_linked(substream)) { - res = -EALREADY; -@@ -2224,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream) - - static void pcm_release_private(struct snd_pcm_substream *substream) - { -- snd_pcm_unlink(substream); -+ if (snd_pcm_stream_linked(substream)) -+ snd_pcm_unlink(substream); - } - - void snd_pcm_release_substream(struct snd_pcm_substream *substream) -diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c -index 913b731d2236..f40330ddb9b2 100644 ---- a/sound/isa/wss/wss_lib.c -+++ b/sound/isa/wss/wss_lib.c -@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream) - if (err < 0) { - if (chip->release_dma) - chip->release_dma(chip, chip->dma_private_data, chip->dma1); -- snd_free_pages(runtime->dma_area, runtime->dma_bytes); - return err; - } - chip->playback_substream = substream; -@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream) - if (err < 0) { - if (chip->release_dma) - chip->release_dma(chip, chip->dma_private_data, chip->dma2); -- snd_free_pages(runtime->dma_area, runtime->dma_bytes); - return err; - } - chip->capture_substream = substream; -diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c -index 82259ca61e64..c4840fda44b4 100644 ---- a/sound/pci/ac97/ac97_codec.c -+++ b/sound/pci/ac97/ac97_codec.c -@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ - { - struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); - int reg = kcontrol->private_value & 0xff; -- int shift = (kcontrol->private_value >> 8) & 0xff; -+ int shift = (kcontrol->private_value >> 8) & 0x0f; - int mask = (kcontrol->private_value >> 16) & 0xff; - // int invert = (kcontrol->private_value >> 24) & 0xff; - unsigned short value, old, new; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index ecb07fb036af..f964743b104c 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2363,6 +2363,10 @@ static const struct pci_device_id azx_ids[] = { - /* AMD Hudson */ - { PCI_DEVICE(0x1022, 0x780d), - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, -+ /* AMD Stoney */ -+ { PCI_DEVICE(0x1022, 0x157a), -+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | -+ AZX_DCAPS_PM_RUNTIME }, - /* AMD Raven */ - { PCI_DEVICE(0x1022, 0x15e3), - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | -diff --git a/sound/pci/trident/trident.c b/sound/pci/trident/trident.c -index cedf13b64803..2f18b1cdc2cd 100644 ---- a/sound/pci/trident/trident.c -+++ b/sound/pci/trident/trident.c -@@ -123,7 +123,7 @@ static int snd_trident_probe(struct pci_dev *pci, - } else { - strcpy(card->shortname, "Trident "); - } -- strcat(card->shortname, card->driver); -+ strcat(card->shortname, str); - sprintf(card->longname, "%s PCI Audio at 0x%lx, irq %d", - card->shortname, trident->port, trident->irq); - -diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c -index 30bdc971883b..017e241b0ec9 100644 ---- a/sound/sparc/cs4231.c -+++ b/sound/sparc/cs4231.c -@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream) - runtime->hw = snd_cs4231_playback; - - err = snd_cs4231_open(chip, CS4231_MODE_PLAY); -- if (err < 0) { -- snd_free_pages(runtime->dma_area, runtime->dma_bytes); -+ if (err < 0) - return err; -- } - chip->playback_substream = substream; - chip->p_periods_sent = 0; - snd_pcm_set_sync(substream); -@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream) - runtime->hw = snd_cs4231_capture; - - err = snd_cs4231_open(chip, CS4231_MODE_RECORD); -- if (err < 0) { -- snd_free_pages(runtime->dma_area, runtime->dma_bytes); -+ if (err < 0) - return err; -- } - chip->capture_substream = substream; - chip->c_periods_sent = 0; - snd_pcm_set_sync(substream); -diff --git a/sound/usb/card.c b/sound/usb/card.c -index 83336bb6333e..084d413d7a37 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_interface *intf, - - __error: - if (chip) { -+ /* chip->active is inside the chip->card object, -+ * decrement before memory is possibly returned. -+ */ -+ atomic_dec(&chip->active); - if (!chip->num_interfaces) - snd_card_free(chip->card); -- atomic_dec(&chip->active); - } - mutex_unlock(®ister_mutex); - return err; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168.patch deleted file mode 100644 index 32bb254ac6dc..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168.patch +++ /dev/null @@ -1,7597 +0,0 @@ -diff --git a/Documentation/Makefile b/Documentation/Makefile -index fc759598c4c9..59d516b7afcb 100644 ---- a/Documentation/Makefile -+++ b/Documentation/Makefile -@@ -1,4 +1,3 @@ - subdir-y := accounting auxdisplay blackfin connector \ - filesystems filesystems ia64 laptops misc-devices \ -- networking pcmcia prctl ptp spi timers vDSO video4linux \ -- watchdog -+ pcmcia prctl ptp spi timers vDSO video4linux watchdog -diff --git a/Documentation/networking/Makefile b/Documentation/networking/Makefile -deleted file mode 100644 -index 4c5d7c485439..000000000000 ---- a/Documentation/networking/Makefile -+++ /dev/null -@@ -1 +0,0 @@ --subdir-y := timestamping -diff --git a/Documentation/networking/timestamping/.gitignore b/Documentation/networking/timestamping/.gitignore -deleted file mode 100644 -index 9e69e982fb38..000000000000 ---- a/Documentation/networking/timestamping/.gitignore -+++ /dev/null -@@ -1,3 +0,0 @@ --timestamping --txtimestamp --hwtstamp_config -diff --git a/Documentation/networking/timestamping/Makefile b/Documentation/networking/timestamping/Makefile -deleted file mode 100644 -index 8c20dfaa4d6e..000000000000 ---- a/Documentation/networking/timestamping/Makefile -+++ /dev/null -@@ -1,14 +0,0 @@ --# To compile, from the source root --# --# make headers_install --# make M=documentation -- --# List of programs to build --hostprogs-y := hwtstamp_config timestamping txtimestamp -- --# Tell kbuild to always build the programs --always := $(hostprogs-y) -- --HOSTCFLAGS_timestamping.o += -I$(objtree)/usr/include --HOSTCFLAGS_txtimestamp.o += -I$(objtree)/usr/include --HOSTCFLAGS_hwtstamp_config.o += -I$(objtree)/usr/include -diff --git a/Documentation/networking/timestamping/hwtstamp_config.c b/Documentation/networking/timestamping/hwtstamp_config.c -deleted file mode 100644 -index e8b685a7f15f..000000000000 ---- a/Documentation/networking/timestamping/hwtstamp_config.c -+++ /dev/null -@@ -1,134 +0,0 @@ --/* Test program for SIOC{G,S}HWTSTAMP -- * Copyright 2013 Solarflare Communications -- * Author: Ben Hutchings -- */ -- --#include --#include --#include --#include -- --#include --#include -- --#include --#include --#include -- --static int --lookup_value(const char **names, int size, const char *name) --{ -- int value; -- -- for (value = 0; value < size; value++) -- if (names[value] && strcasecmp(names[value], name) == 0) -- return value; -- -- return -1; --} -- --static const char * --lookup_name(const char **names, int size, int value) --{ -- return (value >= 0 && value < size) ? names[value] : NULL; --} -- --static void list_names(FILE *f, const char **names, int size) --{ -- int value; -- -- for (value = 0; value < size; value++) -- if (names[value]) -- fprintf(f, " %s\n", names[value]); --} -- --static const char *tx_types[] = { --#define TX_TYPE(name) [HWTSTAMP_TX_ ## name] = #name -- TX_TYPE(OFF), -- TX_TYPE(ON), -- TX_TYPE(ONESTEP_SYNC) --#undef TX_TYPE --}; --#define N_TX_TYPES ((int)(sizeof(tx_types) / sizeof(tx_types[0]))) -- --static const char *rx_filters[] = { --#define RX_FILTER(name) [HWTSTAMP_FILTER_ ## name] = #name -- RX_FILTER(NONE), -- RX_FILTER(ALL), -- RX_FILTER(SOME), -- RX_FILTER(PTP_V1_L4_EVENT), -- RX_FILTER(PTP_V1_L4_SYNC), -- RX_FILTER(PTP_V1_L4_DELAY_REQ), -- RX_FILTER(PTP_V2_L4_EVENT), -- RX_FILTER(PTP_V2_L4_SYNC), -- RX_FILTER(PTP_V2_L4_DELAY_REQ), -- RX_FILTER(PTP_V2_L2_EVENT), -- RX_FILTER(PTP_V2_L2_SYNC), -- RX_FILTER(PTP_V2_L2_DELAY_REQ), -- RX_FILTER(PTP_V2_EVENT), -- RX_FILTER(PTP_V2_SYNC), -- RX_FILTER(PTP_V2_DELAY_REQ), --#undef RX_FILTER --}; --#define N_RX_FILTERS ((int)(sizeof(rx_filters) / sizeof(rx_filters[0]))) -- --static void usage(void) --{ -- fputs("Usage: hwtstamp_config if_name [tx_type rx_filter]\n" -- "tx_type is any of (case-insensitive):\n", -- stderr); -- list_names(stderr, tx_types, N_TX_TYPES); -- fputs("rx_filter is any of (case-insensitive):\n", stderr); -- list_names(stderr, rx_filters, N_RX_FILTERS); --} -- --int main(int argc, char **argv) --{ -- struct ifreq ifr; -- struct hwtstamp_config config; -- const char *name; -- int sock; -- -- if ((argc != 2 && argc != 4) || (strlen(argv[1]) >= IFNAMSIZ)) { -- usage(); -- return 2; -- } -- -- if (argc == 4) { -- config.flags = 0; -- config.tx_type = lookup_value(tx_types, N_TX_TYPES, argv[2]); -- config.rx_filter = lookup_value(rx_filters, N_RX_FILTERS, argv[3]); -- if (config.tx_type < 0 || config.rx_filter < 0) { -- usage(); -- return 2; -- } -- } -- -- sock = socket(AF_INET, SOCK_DGRAM, 0); -- if (sock < 0) { -- perror("socket"); -- return 1; -- } -- -- strcpy(ifr.ifr_name, argv[1]); -- ifr.ifr_data = (caddr_t)&config; -- -- if (ioctl(sock, (argc == 2) ? SIOCGHWTSTAMP : SIOCSHWTSTAMP, &ifr)) { -- perror("ioctl"); -- return 1; -- } -- -- printf("flags = %#x\n", config.flags); -- name = lookup_name(tx_types, N_TX_TYPES, config.tx_type); -- if (name) -- printf("tx_type = %s\n", name); -- else -- printf("tx_type = %d\n", config.tx_type); -- name = lookup_name(rx_filters, N_RX_FILTERS, config.rx_filter); -- if (name) -- printf("rx_filter = %s\n", name); -- else -- printf("rx_filter = %d\n", config.rx_filter); -- -- return 0; --} -diff --git a/Documentation/networking/timestamping/timestamping.c b/Documentation/networking/timestamping/timestamping.c -deleted file mode 100644 -index 5cdfd743447b..000000000000 ---- a/Documentation/networking/timestamping/timestamping.c -+++ /dev/null -@@ -1,528 +0,0 @@ --/* -- * This program demonstrates how the various time stamping features in -- * the Linux kernel work. It emulates the behavior of a PTP -- * implementation in stand-alone master mode by sending PTPv1 Sync -- * multicasts once every second. It looks for similar packets, but -- * beyond that doesn't actually implement PTP. -- * -- * Outgoing packets are time stamped with SO_TIMESTAMPING with or -- * without hardware support. -- * -- * Incoming packets are time stamped with SO_TIMESTAMPING with or -- * without hardware support, SIOCGSTAMP[NS] (per-socket time stamp) and -- * SO_TIMESTAMP[NS]. -- * -- * Copyright (C) 2009 Intel Corporation. -- * Author: Patrick Ohly -- * -- * This program is free software; you can redistribute it and/or modify it -- * under the terms and conditions of the GNU General Public License, -- * version 2, as published by the Free Software Foundation. -- * -- * This program is distributed in the hope it will be useful, but WITHOUT -- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -- * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for -- * more details. -- * -- * You should have received a copy of the GNU General Public License along with -- * this program; if not, write to the Free Software Foundation, Inc., -- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. -- */ -- --#include --#include --#include --#include -- --#include --#include --#include --#include --#include --#include -- --#include --#include --#include -- --#ifndef SO_TIMESTAMPING --# define SO_TIMESTAMPING 37 --# define SCM_TIMESTAMPING SO_TIMESTAMPING --#endif -- --#ifndef SO_TIMESTAMPNS --# define SO_TIMESTAMPNS 35 --#endif -- --#ifndef SIOCGSTAMPNS --# define SIOCGSTAMPNS 0x8907 --#endif -- --#ifndef SIOCSHWTSTAMP --# define SIOCSHWTSTAMP 0x89b0 --#endif -- --static void usage(const char *error) --{ -- if (error) -- printf("invalid option: %s\n", error); -- printf("timestamping interface option*\n\n" -- "Options:\n" -- " IP_MULTICAST_LOOP - looping outgoing multicasts\n" -- " SO_TIMESTAMP - normal software time stamping, ms resolution\n" -- " SO_TIMESTAMPNS - more accurate software time stamping\n" -- " SOF_TIMESTAMPING_TX_HARDWARE - hardware time stamping of outgoing packets\n" -- " SOF_TIMESTAMPING_TX_SOFTWARE - software fallback for outgoing packets\n" -- " SOF_TIMESTAMPING_RX_HARDWARE - hardware time stamping of incoming packets\n" -- " SOF_TIMESTAMPING_RX_SOFTWARE - software fallback for incoming packets\n" -- " SOF_TIMESTAMPING_SOFTWARE - request reporting of software time stamps\n" -- " SOF_TIMESTAMPING_RAW_HARDWARE - request reporting of raw HW time stamps\n" -- " SIOCGSTAMP - check last socket time stamp\n" -- " SIOCGSTAMPNS - more accurate socket time stamp\n"); -- exit(1); --} -- --static void bail(const char *error) --{ -- printf("%s: %s\n", error, strerror(errno)); -- exit(1); --} -- --static const unsigned char sync[] = { -- 0x00, 0x01, 0x00, 0x01, -- 0x5f, 0x44, 0x46, 0x4c, -- 0x54, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, -- 0x01, 0x01, -- -- /* fake uuid */ -- 0x00, 0x01, -- 0x02, 0x03, 0x04, 0x05, -- -- 0x00, 0x01, 0x00, 0x37, -- 0x00, 0x00, 0x00, 0x08, -- 0x00, 0x00, 0x00, 0x00, -- 0x49, 0x05, 0xcd, 0x01, -- 0x29, 0xb1, 0x8d, 0xb0, -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x01, -- -- /* fake uuid */ -- 0x00, 0x01, -- 0x02, 0x03, 0x04, 0x05, -- -- 0x00, 0x00, 0x00, 0x37, -- 0x00, 0x00, 0x00, 0x04, -- 0x44, 0x46, 0x4c, 0x54, -- 0x00, 0x00, 0xf0, 0x60, -- 0x00, 0x01, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x01, -- 0x00, 0x00, 0xf0, 0x60, -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x04, -- 0x44, 0x46, 0x4c, 0x54, -- 0x00, 0x01, -- -- /* fake uuid */ -- 0x00, 0x01, -- 0x02, 0x03, 0x04, 0x05, -- -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00 --}; -- --static void sendpacket(int sock, struct sockaddr *addr, socklen_t addr_len) --{ -- struct timeval now; -- int res; -- -- res = sendto(sock, sync, sizeof(sync), 0, -- addr, addr_len); -- gettimeofday(&now, 0); -- if (res < 0) -- printf("%s: %s\n", "send", strerror(errno)); -- else -- printf("%ld.%06ld: sent %d bytes\n", -- (long)now.tv_sec, (long)now.tv_usec, -- res); --} -- --static void printpacket(struct msghdr *msg, int res, -- char *data, -- int sock, int recvmsg_flags, -- int siocgstamp, int siocgstampns) --{ -- struct sockaddr_in *from_addr = (struct sockaddr_in *)msg->msg_name; -- struct cmsghdr *cmsg; -- struct timeval tv; -- struct timespec ts; -- struct timeval now; -- -- gettimeofday(&now, 0); -- -- printf("%ld.%06ld: received %s data, %d bytes from %s, %zu bytes control messages\n", -- (long)now.tv_sec, (long)now.tv_usec, -- (recvmsg_flags & MSG_ERRQUEUE) ? "error" : "regular", -- res, -- inet_ntoa(from_addr->sin_addr), -- msg->msg_controllen); -- for (cmsg = CMSG_FIRSTHDR(msg); -- cmsg; -- cmsg = CMSG_NXTHDR(msg, cmsg)) { -- printf(" cmsg len %zu: ", cmsg->cmsg_len); -- switch (cmsg->cmsg_level) { -- case SOL_SOCKET: -- printf("SOL_SOCKET "); -- switch (cmsg->cmsg_type) { -- case SO_TIMESTAMP: { -- struct timeval *stamp = -- (struct timeval *)CMSG_DATA(cmsg); -- printf("SO_TIMESTAMP %ld.%06ld", -- (long)stamp->tv_sec, -- (long)stamp->tv_usec); -- break; -- } -- case SO_TIMESTAMPNS: { -- struct timespec *stamp = -- (struct timespec *)CMSG_DATA(cmsg); -- printf("SO_TIMESTAMPNS %ld.%09ld", -- (long)stamp->tv_sec, -- (long)stamp->tv_nsec); -- break; -- } -- case SO_TIMESTAMPING: { -- struct timespec *stamp = -- (struct timespec *)CMSG_DATA(cmsg); -- printf("SO_TIMESTAMPING "); -- printf("SW %ld.%09ld ", -- (long)stamp->tv_sec, -- (long)stamp->tv_nsec); -- stamp++; -- /* skip deprecated HW transformed */ -- stamp++; -- printf("HW raw %ld.%09ld", -- (long)stamp->tv_sec, -- (long)stamp->tv_nsec); -- break; -- } -- default: -- printf("type %d", cmsg->cmsg_type); -- break; -- } -- break; -- case IPPROTO_IP: -- printf("IPPROTO_IP "); -- switch (cmsg->cmsg_type) { -- case IP_RECVERR: { -- struct sock_extended_err *err = -- (struct sock_extended_err *)CMSG_DATA(cmsg); -- printf("IP_RECVERR ee_errno '%s' ee_origin %d => %s", -- strerror(err->ee_errno), -- err->ee_origin, --#ifdef SO_EE_ORIGIN_TIMESTAMPING -- err->ee_origin == SO_EE_ORIGIN_TIMESTAMPING ? -- "bounced packet" : "unexpected origin" --#else -- "probably SO_EE_ORIGIN_TIMESTAMPING" --#endif -- ); -- if (res < sizeof(sync)) -- printf(" => truncated data?!"); -- else if (!memcmp(sync, data + res - sizeof(sync), -- sizeof(sync))) -- printf(" => GOT OUR DATA BACK (HURRAY!)"); -- break; -- } -- case IP_PKTINFO: { -- struct in_pktinfo *pktinfo = -- (struct in_pktinfo *)CMSG_DATA(cmsg); -- printf("IP_PKTINFO interface index %u", -- pktinfo->ipi_ifindex); -- break; -- } -- default: -- printf("type %d", cmsg->cmsg_type); -- break; -- } -- break; -- default: -- printf("level %d type %d", -- cmsg->cmsg_level, -- cmsg->cmsg_type); -- break; -- } -- printf("\n"); -- } -- -- if (siocgstamp) { -- if (ioctl(sock, SIOCGSTAMP, &tv)) -- printf(" %s: %s\n", "SIOCGSTAMP", strerror(errno)); -- else -- printf("SIOCGSTAMP %ld.%06ld\n", -- (long)tv.tv_sec, -- (long)tv.tv_usec); -- } -- if (siocgstampns) { -- if (ioctl(sock, SIOCGSTAMPNS, &ts)) -- printf(" %s: %s\n", "SIOCGSTAMPNS", strerror(errno)); -- else -- printf("SIOCGSTAMPNS %ld.%09ld\n", -- (long)ts.tv_sec, -- (long)ts.tv_nsec); -- } --} -- --static void recvpacket(int sock, int recvmsg_flags, -- int siocgstamp, int siocgstampns) --{ -- char data[256]; -- struct msghdr msg; -- struct iovec entry; -- struct sockaddr_in from_addr; -- struct { -- struct cmsghdr cm; -- char control[512]; -- } control; -- int res; -- -- memset(&msg, 0, sizeof(msg)); -- msg.msg_iov = &entry; -- msg.msg_iovlen = 1; -- entry.iov_base = data; -- entry.iov_len = sizeof(data); -- msg.msg_name = (caddr_t)&from_addr; -- msg.msg_namelen = sizeof(from_addr); -- msg.msg_control = &control; -- msg.msg_controllen = sizeof(control); -- -- res = recvmsg(sock, &msg, recvmsg_flags|MSG_DONTWAIT); -- if (res < 0) { -- printf("%s %s: %s\n", -- "recvmsg", -- (recvmsg_flags & MSG_ERRQUEUE) ? "error" : "regular", -- strerror(errno)); -- } else { -- printpacket(&msg, res, data, -- sock, recvmsg_flags, -- siocgstamp, siocgstampns); -- } --} -- --int main(int argc, char **argv) --{ -- int so_timestamping_flags = 0; -- int so_timestamp = 0; -- int so_timestampns = 0; -- int siocgstamp = 0; -- int siocgstampns = 0; -- int ip_multicast_loop = 0; -- char *interface; -- int i; -- int enabled = 1; -- int sock; -- struct ifreq device; -- struct ifreq hwtstamp; -- struct hwtstamp_config hwconfig, hwconfig_requested; -- struct sockaddr_in addr; -- struct ip_mreq imr; -- struct in_addr iaddr; -- int val; -- socklen_t len; -- struct timeval next; -- -- if (argc < 2) -- usage(0); -- interface = argv[1]; -- -- for (i = 2; i < argc; i++) { -- if (!strcasecmp(argv[i], "SO_TIMESTAMP")) -- so_timestamp = 1; -- else if (!strcasecmp(argv[i], "SO_TIMESTAMPNS")) -- so_timestampns = 1; -- else if (!strcasecmp(argv[i], "SIOCGSTAMP")) -- siocgstamp = 1; -- else if (!strcasecmp(argv[i], "SIOCGSTAMPNS")) -- siocgstampns = 1; -- else if (!strcasecmp(argv[i], "IP_MULTICAST_LOOP")) -- ip_multicast_loop = 1; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_TX_HARDWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_TX_HARDWARE; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_TX_SOFTWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_TX_SOFTWARE; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RX_HARDWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_RX_HARDWARE; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RX_SOFTWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_RX_SOFTWARE; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_SOFTWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_SOFTWARE; -- else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RAW_HARDWARE")) -- so_timestamping_flags |= SOF_TIMESTAMPING_RAW_HARDWARE; -- else -- usage(argv[i]); -- } -- -- sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); -- if (sock < 0) -- bail("socket"); -- -- memset(&device, 0, sizeof(device)); -- strncpy(device.ifr_name, interface, sizeof(device.ifr_name)); -- if (ioctl(sock, SIOCGIFADDR, &device) < 0) -- bail("getting interface IP address"); -- -- memset(&hwtstamp, 0, sizeof(hwtstamp)); -- strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name)); -- hwtstamp.ifr_data = (void *)&hwconfig; -- memset(&hwconfig, 0, sizeof(hwconfig)); -- hwconfig.tx_type = -- (so_timestamping_flags & SOF_TIMESTAMPING_TX_HARDWARE) ? -- HWTSTAMP_TX_ON : HWTSTAMP_TX_OFF; -- hwconfig.rx_filter = -- (so_timestamping_flags & SOF_TIMESTAMPING_RX_HARDWARE) ? -- HWTSTAMP_FILTER_PTP_V1_L4_SYNC : HWTSTAMP_FILTER_NONE; -- hwconfig_requested = hwconfig; -- if (ioctl(sock, SIOCSHWTSTAMP, &hwtstamp) < 0) { -- if ((errno == EINVAL || errno == ENOTSUP) && -- hwconfig_requested.tx_type == HWTSTAMP_TX_OFF && -- hwconfig_requested.rx_filter == HWTSTAMP_FILTER_NONE) -- printf("SIOCSHWTSTAMP: disabling hardware time stamping not possible\n"); -- else -- bail("SIOCSHWTSTAMP"); -- } -- printf("SIOCSHWTSTAMP: tx_type %d requested, got %d; rx_filter %d requested, got %d\n", -- hwconfig_requested.tx_type, hwconfig.tx_type, -- hwconfig_requested.rx_filter, hwconfig.rx_filter); -- -- /* bind to PTP port */ -- addr.sin_family = AF_INET; -- addr.sin_addr.s_addr = htonl(INADDR_ANY); -- addr.sin_port = htons(319 /* PTP event port */); -- if (bind(sock, -- (struct sockaddr *)&addr, -- sizeof(struct sockaddr_in)) < 0) -- bail("bind"); -- -- /* set multicast group for outgoing packets */ -- inet_aton("224.0.1.130", &iaddr); /* alternate PTP domain 1 */ -- addr.sin_addr = iaddr; -- imr.imr_multiaddr.s_addr = iaddr.s_addr; -- imr.imr_interface.s_addr = -- ((struct sockaddr_in *)&device.ifr_addr)->sin_addr.s_addr; -- if (setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, -- &imr.imr_interface.s_addr, sizeof(struct in_addr)) < 0) -- bail("set multicast"); -- -- /* join multicast group, loop our own packet */ -- if (setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP, -- &imr, sizeof(struct ip_mreq)) < 0) -- bail("join multicast group"); -- -- if (setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, -- &ip_multicast_loop, sizeof(enabled)) < 0) { -- bail("loop multicast"); -- } -- -- /* set socket options for time stamping */ -- if (so_timestamp && -- setsockopt(sock, SOL_SOCKET, SO_TIMESTAMP, -- &enabled, sizeof(enabled)) < 0) -- bail("setsockopt SO_TIMESTAMP"); -- -- if (so_timestampns && -- setsockopt(sock, SOL_SOCKET, SO_TIMESTAMPNS, -- &enabled, sizeof(enabled)) < 0) -- bail("setsockopt SO_TIMESTAMPNS"); -- -- if (so_timestamping_flags && -- setsockopt(sock, SOL_SOCKET, SO_TIMESTAMPING, -- &so_timestamping_flags, -- sizeof(so_timestamping_flags)) < 0) -- bail("setsockopt SO_TIMESTAMPING"); -- -- /* request IP_PKTINFO for debugging purposes */ -- if (setsockopt(sock, SOL_IP, IP_PKTINFO, -- &enabled, sizeof(enabled)) < 0) -- printf("%s: %s\n", "setsockopt IP_PKTINFO", strerror(errno)); -- -- /* verify socket options */ -- len = sizeof(val); -- if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMP, &val, &len) < 0) -- printf("%s: %s\n", "getsockopt SO_TIMESTAMP", strerror(errno)); -- else -- printf("SO_TIMESTAMP %d\n", val); -- -- if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMPNS, &val, &len) < 0) -- printf("%s: %s\n", "getsockopt SO_TIMESTAMPNS", -- strerror(errno)); -- else -- printf("SO_TIMESTAMPNS %d\n", val); -- -- if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMPING, &val, &len) < 0) { -- printf("%s: %s\n", "getsockopt SO_TIMESTAMPING", -- strerror(errno)); -- } else { -- printf("SO_TIMESTAMPING %d\n", val); -- if (val != so_timestamping_flags) -- printf(" not the expected value %d\n", -- so_timestamping_flags); -- } -- -- /* send packets forever every five seconds */ -- gettimeofday(&next, 0); -- next.tv_sec = (next.tv_sec + 1) / 5 * 5; -- next.tv_usec = 0; -- while (1) { -- struct timeval now; -- struct timeval delta; -- long delta_us; -- int res; -- fd_set readfs, errorfs; -- -- gettimeofday(&now, 0); -- delta_us = (long)(next.tv_sec - now.tv_sec) * 1000000 + -- (long)(next.tv_usec - now.tv_usec); -- if (delta_us > 0) { -- /* continue waiting for timeout or data */ -- delta.tv_sec = delta_us / 1000000; -- delta.tv_usec = delta_us % 1000000; -- -- FD_ZERO(&readfs); -- FD_ZERO(&errorfs); -- FD_SET(sock, &readfs); -- FD_SET(sock, &errorfs); -- printf("%ld.%06ld: select %ldus\n", -- (long)now.tv_sec, (long)now.tv_usec, -- delta_us); -- res = select(sock + 1, &readfs, 0, &errorfs, &delta); -- gettimeofday(&now, 0); -- printf("%ld.%06ld: select returned: %d, %s\n", -- (long)now.tv_sec, (long)now.tv_usec, -- res, -- res < 0 ? strerror(errno) : "success"); -- if (res > 0) { -- if (FD_ISSET(sock, &readfs)) -- printf("ready for reading\n"); -- if (FD_ISSET(sock, &errorfs)) -- printf("has error\n"); -- recvpacket(sock, 0, -- siocgstamp, -- siocgstampns); -- recvpacket(sock, MSG_ERRQUEUE, -- siocgstamp, -- siocgstampns); -- } -- } else { -- /* write one packet */ -- sendpacket(sock, -- (struct sockaddr *)&addr, -- sizeof(addr)); -- next.tv_sec += 5; -- continue; -- } -- } -- -- return 0; --} -diff --git a/Documentation/networking/timestamping/txtimestamp.c b/Documentation/networking/timestamping/txtimestamp.c -deleted file mode 100644 -index 5df07047ca86..000000000000 ---- a/Documentation/networking/timestamping/txtimestamp.c -+++ /dev/null -@@ -1,549 +0,0 @@ --/* -- * Copyright 2014 Google Inc. -- * Author: willemb@google.com (Willem de Bruijn) -- * -- * Test software tx timestamping, including -- * -- * - SCHED, SND and ACK timestamps -- * - RAW, UDP and TCP -- * - IPv4 and IPv6 -- * - various packet sizes (to test GSO and TSO) -- * -- * Consult the command line arguments for help on running -- * the various testcases. -- * -- * This test requires a dummy TCP server. -- * A simple `nc6 [-u] -l -p $DESTPORT` will do -- * -- * -- * This program is free software; you can redistribute it and/or modify it -- * under the terms and conditions of the GNU General Public License, -- * version 2, as published by the Free Software Foundation. -- * -- * This program is distributed in the hope it will be useful, but WITHOUT -- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -- * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for -- * more details. -- * -- * You should have received a copy of the GNU General Public License along with -- * this program; if not, write to the Free Software Foundation, Inc., -- * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. -- */ -- --#define _GNU_SOURCE -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --/* command line parameters */ --static int cfg_proto = SOCK_STREAM; --static int cfg_ipproto = IPPROTO_TCP; --static int cfg_num_pkts = 4; --static int do_ipv4 = 1; --static int do_ipv6 = 1; --static int cfg_payload_len = 10; --static bool cfg_show_payload; --static bool cfg_do_pktinfo; --static bool cfg_loop_nodata; --static uint16_t dest_port = 9000; -- --static struct sockaddr_in daddr; --static struct sockaddr_in6 daddr6; --static struct timespec ts_prev; -- --static void __print_timestamp(const char *name, struct timespec *cur, -- uint32_t key, int payload_len) --{ -- if (!(cur->tv_sec | cur->tv_nsec)) -- return; -- -- fprintf(stderr, " %s: %lu s %lu us (seq=%u, len=%u)", -- name, cur->tv_sec, cur->tv_nsec / 1000, -- key, payload_len); -- -- if ((ts_prev.tv_sec | ts_prev.tv_nsec)) { -- int64_t cur_ms, prev_ms; -- -- cur_ms = (long) cur->tv_sec * 1000 * 1000; -- cur_ms += cur->tv_nsec / 1000; -- -- prev_ms = (long) ts_prev.tv_sec * 1000 * 1000; -- prev_ms += ts_prev.tv_nsec / 1000; -- -- fprintf(stderr, " (%+" PRId64 " us)", cur_ms - prev_ms); -- } -- -- ts_prev = *cur; -- fprintf(stderr, "\n"); --} -- --static void print_timestamp_usr(void) --{ -- struct timespec ts; -- struct timeval tv; /* avoid dependency on -lrt */ -- -- gettimeofday(&tv, NULL); -- ts.tv_sec = tv.tv_sec; -- ts.tv_nsec = tv.tv_usec * 1000; -- -- __print_timestamp(" USR", &ts, 0, 0); --} -- --static void print_timestamp(struct scm_timestamping *tss, int tstype, -- int tskey, int payload_len) --{ -- const char *tsname; -- -- switch (tstype) { -- case SCM_TSTAMP_SCHED: -- tsname = " ENQ"; -- break; -- case SCM_TSTAMP_SND: -- tsname = " SND"; -- break; -- case SCM_TSTAMP_ACK: -- tsname = " ACK"; -- break; -- default: -- error(1, 0, "unknown timestamp type: %u", -- tstype); -- } -- __print_timestamp(tsname, &tss->ts[0], tskey, payload_len); --} -- --/* TODO: convert to check_and_print payload once API is stable */ --static void print_payload(char *data, int len) --{ -- int i; -- -- if (!len) -- return; -- -- if (len > 70) -- len = 70; -- -- fprintf(stderr, "payload: "); -- for (i = 0; i < len; i++) -- fprintf(stderr, "%02hhx ", data[i]); -- fprintf(stderr, "\n"); --} -- --static void print_pktinfo(int family, int ifindex, void *saddr, void *daddr) --{ -- char sa[INET6_ADDRSTRLEN], da[INET6_ADDRSTRLEN]; -- -- fprintf(stderr, " pktinfo: ifindex=%u src=%s dst=%s\n", -- ifindex, -- saddr ? inet_ntop(family, saddr, sa, sizeof(sa)) : "unknown", -- daddr ? inet_ntop(family, daddr, da, sizeof(da)) : "unknown"); --} -- --static void __poll(int fd) --{ -- struct pollfd pollfd; -- int ret; -- -- memset(&pollfd, 0, sizeof(pollfd)); -- pollfd.fd = fd; -- ret = poll(&pollfd, 1, 100); -- if (ret != 1) -- error(1, errno, "poll"); --} -- --static void __recv_errmsg_cmsg(struct msghdr *msg, int payload_len) --{ -- struct sock_extended_err *serr = NULL; -- struct scm_timestamping *tss = NULL; -- struct cmsghdr *cm; -- int batch = 0; -- -- for (cm = CMSG_FIRSTHDR(msg); -- cm && cm->cmsg_len; -- cm = CMSG_NXTHDR(msg, cm)) { -- if (cm->cmsg_level == SOL_SOCKET && -- cm->cmsg_type == SCM_TIMESTAMPING) { -- tss = (void *) CMSG_DATA(cm); -- } else if ((cm->cmsg_level == SOL_IP && -- cm->cmsg_type == IP_RECVERR) || -- (cm->cmsg_level == SOL_IPV6 && -- cm->cmsg_type == IPV6_RECVERR)) { -- serr = (void *) CMSG_DATA(cm); -- if (serr->ee_errno != ENOMSG || -- serr->ee_origin != SO_EE_ORIGIN_TIMESTAMPING) { -- fprintf(stderr, "unknown ip error %d %d\n", -- serr->ee_errno, -- serr->ee_origin); -- serr = NULL; -- } -- } else if (cm->cmsg_level == SOL_IP && -- cm->cmsg_type == IP_PKTINFO) { -- struct in_pktinfo *info = (void *) CMSG_DATA(cm); -- print_pktinfo(AF_INET, info->ipi_ifindex, -- &info->ipi_spec_dst, &info->ipi_addr); -- } else if (cm->cmsg_level == SOL_IPV6 && -- cm->cmsg_type == IPV6_PKTINFO) { -- struct in6_pktinfo *info6 = (void *) CMSG_DATA(cm); -- print_pktinfo(AF_INET6, info6->ipi6_ifindex, -- NULL, &info6->ipi6_addr); -- } else -- fprintf(stderr, "unknown cmsg %d,%d\n", -- cm->cmsg_level, cm->cmsg_type); -- -- if (serr && tss) { -- print_timestamp(tss, serr->ee_info, serr->ee_data, -- payload_len); -- serr = NULL; -- tss = NULL; -- batch++; -- } -- } -- -- if (batch > 1) -- fprintf(stderr, "batched %d timestamps\n", batch); --} -- --static int recv_errmsg(int fd) --{ -- static char ctrl[1024 /* overprovision*/]; -- static struct msghdr msg; -- struct iovec entry; -- static char *data; -- int ret = 0; -- -- data = malloc(cfg_payload_len); -- if (!data) -- error(1, 0, "malloc"); -- -- memset(&msg, 0, sizeof(msg)); -- memset(&entry, 0, sizeof(entry)); -- memset(ctrl, 0, sizeof(ctrl)); -- -- entry.iov_base = data; -- entry.iov_len = cfg_payload_len; -- msg.msg_iov = &entry; -- msg.msg_iovlen = 1; -- msg.msg_name = NULL; -- msg.msg_namelen = 0; -- msg.msg_control = ctrl; -- msg.msg_controllen = sizeof(ctrl); -- -- ret = recvmsg(fd, &msg, MSG_ERRQUEUE); -- if (ret == -1 && errno != EAGAIN) -- error(1, errno, "recvmsg"); -- -- if (ret >= 0) { -- __recv_errmsg_cmsg(&msg, ret); -- if (cfg_show_payload) -- print_payload(data, cfg_payload_len); -- } -- -- free(data); -- return ret == -1; --} -- --static void do_test(int family, unsigned int opt) --{ -- char *buf; -- int fd, i, val = 1, total_len; -- -- if (family == AF_INET6 && cfg_proto != SOCK_STREAM) { -- /* due to lack of checksum generation code */ -- fprintf(stderr, "test: skipping datagram over IPv6\n"); -- return; -- } -- -- total_len = cfg_payload_len; -- if (cfg_proto == SOCK_RAW) { -- total_len += sizeof(struct udphdr); -- if (cfg_ipproto == IPPROTO_RAW) -- total_len += sizeof(struct iphdr); -- } -- -- buf = malloc(total_len); -- if (!buf) -- error(1, 0, "malloc"); -- -- fd = socket(family, cfg_proto, cfg_ipproto); -- if (fd < 0) -- error(1, errno, "socket"); -- -- if (cfg_proto == SOCK_STREAM) { -- if (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, -- (char*) &val, sizeof(val))) -- error(1, 0, "setsockopt no nagle"); -- -- if (family == PF_INET) { -- if (connect(fd, (void *) &daddr, sizeof(daddr))) -- error(1, errno, "connect ipv4"); -- } else { -- if (connect(fd, (void *) &daddr6, sizeof(daddr6))) -- error(1, errno, "connect ipv6"); -- } -- } -- -- if (cfg_do_pktinfo) { -- if (family == AF_INET6) { -- if (setsockopt(fd, SOL_IPV6, IPV6_RECVPKTINFO, -- &val, sizeof(val))) -- error(1, errno, "setsockopt pktinfo ipv6"); -- } else { -- if (setsockopt(fd, SOL_IP, IP_PKTINFO, -- &val, sizeof(val))) -- error(1, errno, "setsockopt pktinfo ipv4"); -- } -- } -- -- opt |= SOF_TIMESTAMPING_SOFTWARE | -- SOF_TIMESTAMPING_OPT_CMSG | -- SOF_TIMESTAMPING_OPT_ID; -- if (cfg_loop_nodata) -- opt |= SOF_TIMESTAMPING_OPT_TSONLY; -- -- if (setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, -- (char *) &opt, sizeof(opt))) -- error(1, 0, "setsockopt timestamping"); -- -- for (i = 0; i < cfg_num_pkts; i++) { -- memset(&ts_prev, 0, sizeof(ts_prev)); -- memset(buf, 'a' + i, total_len); -- -- if (cfg_proto == SOCK_RAW) { -- struct udphdr *udph; -- int off = 0; -- -- if (cfg_ipproto == IPPROTO_RAW) { -- struct iphdr *iph = (void *) buf; -- -- memset(iph, 0, sizeof(*iph)); -- iph->ihl = 5; -- iph->version = 4; -- iph->ttl = 2; -- iph->daddr = daddr.sin_addr.s_addr; -- iph->protocol = IPPROTO_UDP; -- /* kernel writes saddr, csum, len */ -- -- off = sizeof(*iph); -- } -- -- udph = (void *) buf + off; -- udph->source = ntohs(9000); /* random spoof */ -- udph->dest = ntohs(dest_port); -- udph->len = ntohs(sizeof(*udph) + cfg_payload_len); -- udph->check = 0; /* not allowed for IPv6 */ -- } -- -- print_timestamp_usr(); -- if (cfg_proto != SOCK_STREAM) { -- if (family == PF_INET) -- val = sendto(fd, buf, total_len, 0, (void *) &daddr, sizeof(daddr)); -- else -- val = sendto(fd, buf, total_len, 0, (void *) &daddr6, sizeof(daddr6)); -- } else { -- val = send(fd, buf, cfg_payload_len, 0); -- } -- if (val != total_len) -- error(1, errno, "send"); -- -- /* wait for all errors to be queued, else ACKs arrive OOO */ -- usleep(50 * 1000); -- -- __poll(fd); -- -- while (!recv_errmsg(fd)) {} -- } -- -- if (close(fd)) -- error(1, errno, "close"); -- -- free(buf); -- usleep(400 * 1000); --} -- --static void __attribute__((noreturn)) usage(const char *filepath) --{ -- fprintf(stderr, "\nUsage: %s [options] hostname\n" -- "\nwhere options are:\n" -- " -4: only IPv4\n" -- " -6: only IPv6\n" -- " -h: show this message\n" -- " -I: request PKTINFO\n" -- " -l N: send N bytes at a time\n" -- " -n: set no-payload option\n" -- " -r: use raw\n" -- " -R: use raw (IP_HDRINCL)\n" -- " -p N: connect to port N\n" -- " -u: use udp\n" -- " -x: show payload (up to 70 bytes)\n", -- filepath); -- exit(1); --} -- --static void parse_opt(int argc, char **argv) --{ -- int proto_count = 0; -- char c; -- -- while ((c = getopt(argc, argv, "46hIl:np:rRux")) != -1) { -- switch (c) { -- case '4': -- do_ipv6 = 0; -- break; -- case '6': -- do_ipv4 = 0; -- break; -- case 'I': -- cfg_do_pktinfo = true; -- break; -- case 'n': -- cfg_loop_nodata = true; -- break; -- case 'r': -- proto_count++; -- cfg_proto = SOCK_RAW; -- cfg_ipproto = IPPROTO_UDP; -- break; -- case 'R': -- proto_count++; -- cfg_proto = SOCK_RAW; -- cfg_ipproto = IPPROTO_RAW; -- break; -- case 'u': -- proto_count++; -- cfg_proto = SOCK_DGRAM; -- cfg_ipproto = IPPROTO_UDP; -- break; -- case 'l': -- cfg_payload_len = strtoul(optarg, NULL, 10); -- break; -- case 'p': -- dest_port = strtoul(optarg, NULL, 10); -- break; -- case 'x': -- cfg_show_payload = true; -- break; -- case 'h': -- default: -- usage(argv[0]); -- } -- } -- -- if (!cfg_payload_len) -- error(1, 0, "payload may not be nonzero"); -- if (cfg_proto != SOCK_STREAM && cfg_payload_len > 1472) -- error(1, 0, "udp packet might exceed expected MTU"); -- if (!do_ipv4 && !do_ipv6) -- error(1, 0, "pass -4 or -6, not both"); -- if (proto_count > 1) -- error(1, 0, "pass -r, -R or -u, not multiple"); -- -- if (optind != argc - 1) -- error(1, 0, "missing required hostname argument"); --} -- --static void resolve_hostname(const char *hostname) --{ -- struct addrinfo *addrs, *cur; -- int have_ipv4 = 0, have_ipv6 = 0; -- -- if (getaddrinfo(hostname, NULL, NULL, &addrs)) -- error(1, errno, "getaddrinfo"); -- -- cur = addrs; -- while (cur && !have_ipv4 && !have_ipv6) { -- if (!have_ipv4 && cur->ai_family == AF_INET) { -- memcpy(&daddr, cur->ai_addr, sizeof(daddr)); -- daddr.sin_port = htons(dest_port); -- have_ipv4 = 1; -- } -- else if (!have_ipv6 && cur->ai_family == AF_INET6) { -- memcpy(&daddr6, cur->ai_addr, sizeof(daddr6)); -- daddr6.sin6_port = htons(dest_port); -- have_ipv6 = 1; -- } -- cur = cur->ai_next; -- } -- if (addrs) -- freeaddrinfo(addrs); -- -- do_ipv4 &= have_ipv4; -- do_ipv6 &= have_ipv6; --} -- --static void do_main(int family) --{ -- fprintf(stderr, "family: %s\n", -- family == PF_INET ? "INET" : "INET6"); -- -- fprintf(stderr, "test SND\n"); -- do_test(family, SOF_TIMESTAMPING_TX_SOFTWARE); -- -- fprintf(stderr, "test ENQ\n"); -- do_test(family, SOF_TIMESTAMPING_TX_SCHED); -- -- fprintf(stderr, "test ENQ + SND\n"); -- do_test(family, SOF_TIMESTAMPING_TX_SCHED | -- SOF_TIMESTAMPING_TX_SOFTWARE); -- -- if (cfg_proto == SOCK_STREAM) { -- fprintf(stderr, "\ntest ACK\n"); -- do_test(family, SOF_TIMESTAMPING_TX_ACK); -- -- fprintf(stderr, "\ntest SND + ACK\n"); -- do_test(family, SOF_TIMESTAMPING_TX_SOFTWARE | -- SOF_TIMESTAMPING_TX_ACK); -- -- fprintf(stderr, "\ntest ENQ + SND + ACK\n"); -- do_test(family, SOF_TIMESTAMPING_TX_SCHED | -- SOF_TIMESTAMPING_TX_SOFTWARE | -- SOF_TIMESTAMPING_TX_ACK); -- } --} -- --const char *sock_names[] = { NULL, "TCP", "UDP", "RAW" }; -- --int main(int argc, char **argv) --{ -- if (argc == 1) -- usage(argv[0]); -- -- parse_opt(argc, argv); -- resolve_hostname(argv[argc - 1]); -- -- fprintf(stderr, "protocol: %s\n", sock_names[cfg_proto]); -- fprintf(stderr, "payload: %u\n", cfg_payload_len); -- fprintf(stderr, "server port: %u\n", dest_port); -- fprintf(stderr, "\n"); -- -- if (do_ipv4) -- do_main(PF_INET); -- if (do_ipv6) -- do_main(PF_INET6); -- -- return 0; --} -diff --git a/Makefile b/Makefile -index 6b30551caee4..082f82471b51 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 167 -+SUBLEVEL = 168 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c -index a95499ea8706..fa1d41edce68 100644 ---- a/arch/arm/mach-omap1/board-ams-delta.c -+++ b/arch/arm/mach-omap1/board-ams-delta.c -@@ -511,6 +511,9 @@ static void modem_pm(struct uart_port *port, unsigned int state, unsigned old) - { - struct modem_private_data *priv = port->private_data; - -+ if (!priv) -+ return; -+ - if (IS_ERR(priv->regulator)) - return; - -diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c -index 30768003f854..8c505284bc0c 100644 ---- a/arch/arm/mach-omap2/prm44xx.c -+++ b/arch/arm/mach-omap2/prm44xx.c -@@ -344,7 +344,7 @@ static void omap44xx_prm_reconfigure_io_chain(void) - * to occur, WAKEUPENABLE bits must be set in the pad mux registers, and - * omap44xx_prm_reconfigure_io_chain() must be called. No return value. - */ --static void __init omap44xx_prm_enable_io_wakeup(void) -+static void omap44xx_prm_enable_io_wakeup(void) - { - s32 inst = omap4_prmst_get_prm_dev_inst(); - -diff --git a/arch/cris/arch-v32/drivers/cryptocop.c b/arch/cris/arch-v32/drivers/cryptocop.c -index 877da1908234..98e2a5dbcfda 100644 ---- a/arch/cris/arch-v32/drivers/cryptocop.c -+++ b/arch/cris/arch-v32/drivers/cryptocop.c -@@ -2724,7 +2724,6 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig - (unsigned long int)(oper.indata + prev_ix), - noinpages, - 0, /* read access only for in data */ -- 0, /* no force */ - inpages, - NULL); - -@@ -2740,8 +2739,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig - current->mm, - (unsigned long int)oper.cipher_outdata, - nooutpages, -- 1, /* write access for out data */ -- 0, /* no force */ -+ FOLL_WRITE, /* write access for out data */ - outpages, - NULL); - up_read(¤t->mm->mmap_sem); -diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c -index 0c161ed6d18e..8205b456de7a 100644 ---- a/arch/ia64/kernel/err_inject.c -+++ b/arch/ia64/kernel/err_inject.c -@@ -143,7 +143,7 @@ store_virtual_to_phys(struct device *dev, struct device_attribute *attr, - int ret; - - ret = get_user_pages(current, current->mm, virt_addr, -- 1, VM_READ, 0, NULL, NULL); -+ 1, FOLL_WRITE, NULL, NULL); - if (ret<=0) { - #ifdef ERR_INJ_DEBUG - printk("Virtual address %lx is not existing.\n",virt_addr); -diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c -index 349995d19c7f..e596e0a1cecc 100644 ---- a/arch/mips/mm/gup.c -+++ b/arch/mips/mm/gup.c -@@ -303,7 +303,7 @@ slow_irqon: - - ret = get_user_pages_unlocked(current, mm, start, - (end - start) >> PAGE_SHIFT, -- write, 0, pages); -+ pages, write ? FOLL_WRITE : 0); - - /* Have to be a bit careful with return values */ - if (nr > 0) { -diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c -index 929c147e07b4..1b69bfdf59f9 100644 ---- a/arch/s390/kernel/perf_cpum_cf.c -+++ b/arch/s390/kernel/perf_cpum_cf.c -@@ -344,6 +344,8 @@ static int __hw_perf_event_init(struct perf_event *event) - break; - - case PERF_TYPE_HARDWARE: -+ if (is_sampling_event(event)) /* No sampling support */ -+ return -ENOENT; - ev = attr->config; - /* Count user space (problem-state) only */ - if (!attr->exclude_user && attr->exclude_kernel) { -diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c -index 12bbf0e8478f..7ad41be8b373 100644 ---- a/arch/s390/mm/gup.c -+++ b/arch/s390/mm/gup.c -@@ -242,7 +242,7 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, - start += nr << PAGE_SHIFT; - pages += nr; - ret = get_user_pages_unlocked(current, mm, start, -- nr_pages - nr, write, 0, pages); -+ nr_pages - nr, pages, write ? FOLL_WRITE : 0); - /* Have to be a bit careful with return values */ - if (nr > 0) - ret = (ret < 0) ? nr : ret + nr; -diff --git a/arch/sh/mm/gup.c b/arch/sh/mm/gup.c -index e7af6a65baab..8c51a0e94854 100644 ---- a/arch/sh/mm/gup.c -+++ b/arch/sh/mm/gup.c -@@ -258,7 +258,8 @@ slow_irqon: - pages += nr; - - ret = get_user_pages_unlocked(current, mm, start, -- (end - start) >> PAGE_SHIFT, write, 0, pages); -+ (end - start) >> PAGE_SHIFT, pages, -+ write ? FOLL_WRITE : 0); - - /* Have to be a bit careful with return values */ - if (nr > 0) { -diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c -index 2e5c4fc2daa9..150f48303fb0 100644 ---- a/arch/sparc/mm/gup.c -+++ b/arch/sparc/mm/gup.c -@@ -250,7 +250,8 @@ slow: - pages += nr; - - ret = get_user_pages_unlocked(current, mm, start, -- (end - start) >> PAGE_SHIFT, write, 0, pages); -+ (end - start) >> PAGE_SHIFT, pages, -+ write ? FOLL_WRITE : 0); - - /* Have to be a bit careful with return values */ - if (nr > 0) { -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 3a37cdbdfbaa..c048d0d70cc4 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -765,7 +765,7 @@ struct kvm_x86_ops { - int (*hardware_setup)(void); /* __init */ - void (*hardware_unsetup)(void); /* __exit */ - bool (*cpu_has_accelerated_tpr)(void); -- bool (*cpu_has_high_real_mode_segbase)(void); -+ bool (*has_emulated_msr)(int index); - void (*cpuid_update)(struct kvm_vcpu *vcpu); - - /* Create, but do not attach this VCPU */ -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index d788b0cdc0ad..6f8eadf0681f 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -144,9 +144,14 @@ extern int __get_user_4(void); - extern int __get_user_8(void); - extern int __get_user_bad(void); - - #define __uaccess_begin() stac() - #define __uaccess_end() clac() -+#define __uaccess_begin_nospec() \ -+({ \ -+ stac(); \ -+ barrier_nospec(); \ -+}) - - /* - * This is a type: either unsigned long, if the argument fits into - * that type, or otherwise unsigned long long. -@@ -423,9 +428,9 @@ do { \ - ({ \ - int __gu_err; \ - unsigned long __gu_val; \ -- __uaccess_begin(); \ -+ __uaccess_begin_nospec(); \ - __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ - __uaccess_end(); \ - (x) = (__force __typeof__(*(ptr)))__gu_val; \ - __builtin_expect(__gu_err, 0); \ - }) -@@ -471,11 +476,15 @@ struct __large_struct { unsigned long buf[100]; }; - */ - #define uaccess_try do { \ - current_thread_info()->uaccess_err = 0; \ - __uaccess_begin(); \ - barrier(); - -+#define uaccess_try_nospec do { \ -+ current_thread_info()->uaccess_err = 0; \ -+ __uaccess_begin_nospec(); \ -+ - #define uaccess_catch(err) \ - __uaccess_end(); \ - (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \ - } while (0) - -@@ -537,7 +546,7 @@ struct __large_struct { unsigned long buf[100]; }; - * get_user_ex(...); - * } get_user_catch(err) - */ --#define get_user_try uaccess_try -+#define get_user_try uaccess_try_nospec - #define get_user_catch(err) uaccess_catch(err) - - #define get_user_ex(x, ptr) do { \ -@@ -572,12 +581,12 @@ extern void __cmpxchg_wrong_size(void) - __typeof__(ptr) __uval = (uval); \ - __typeof__(*(ptr)) __old = (old); \ - __typeof__(*(ptr)) __new = (new); \ -- __uaccess_begin(); \ -+ __uaccess_begin_nospec(); \ - switch (size) { \ - case 1: \ - { \ - asm volatile("\n" \ - "1:\t" LOCK_PREFIX "cmpxchgb %4, %2\n" \ - "2:\n" \ - "\t.section .fixup, \"ax\"\n" \ - "3:\tmov %3, %0\n" \ - "\tjmp 2b\n" \ -diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h -index f5dcb5204dcd..f575ee3aea5c 100644 ---- a/arch/x86/include/asm/uaccess_32.h -+++ b/arch/x86/include/asm/uaccess_32.h -@@ -102,19 +102,19 @@ __copy_from_user(void *to, const void __user *from, unsigned long n) - - switch (n) { - case 1: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u8 *)to, from, 1, ret, 1); - __uaccess_end(); - return ret; - case 2: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u16 *)to, from, 2, ret, 2); - __uaccess_end(); - return ret; - case 4: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u32 *)to, from, 4, ret, 4); - __uaccess_end(); - return ret; - } - } -@@ -130,19 +130,19 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to, - - switch (n) { - case 1: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u8 *)to, from, 1, ret, 1); - __uaccess_end(); - return ret; - case 2: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u16 *)to, from, 2, ret, 2); - __uaccess_end(); - return ret; - case 4: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_size(*(u32 *)to, from, 4, ret, 4); - __uaccess_end(); - return ret; - } - } -diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h -index d83a55b95a48..dc2d00e7ced3 100644 ---- a/arch/x86/include/asm/uaccess_64.h -+++ b/arch/x86/include/asm/uaccess_64.h -@@ -57,49 +57,49 @@ int __copy_from_user_nocheck(void *dst, const void __user *src, unsigned size) - if (!__builtin_constant_p(size)) - return copy_user_generic(dst, (__force void *)src, size); - switch (size) { - case 1: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u8 *)dst, (u8 __user *)src, - ret, "b", "b", "=q", 1); - __uaccess_end(); - return ret; - case 2: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u16 *)dst, (u16 __user *)src, - ret, "w", "w", "=r", 2); - __uaccess_end(); - return ret; - case 4: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u32 *)dst, (u32 __user *)src, - ret, "l", "k", "=r", 4); - __uaccess_end(); - return ret; - case 8: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u64 *)dst, (u64 __user *)src, - ret, "q", "", "=r", 8); - __uaccess_end(); - return ret; - case 10: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u64 *)dst, (u64 __user *)src, - ret, "q", "", "=r", 10); - if (likely(!ret)) - __get_user_asm(*(u16 *)(8 + (char *)dst), - (u16 __user *)(8 + (char __user *)src), - ret, "w", "w", "=r", 2); - __uaccess_end(); - return ret; - case 16: -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(*(u64 *)dst, (u64 __user *)src, - ret, "q", "", "=r", 16); - if (likely(!ret)) - __get_user_asm(*(u64 *)(8 + (char *)dst), - (u64 __user *)(8 + (char __user *)src), - ret, "q", "", "=r", 8); - __uaccess_end(); - return ret; - default: - return copy_user_generic(dst, (__force void *)src, size); -@@ -192,47 +192,47 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size) - switch (size) { - case 1: { - u8 tmp; -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(tmp, (u8 __user *)src, - ret, "b", "b", "=q", 1); - if (likely(!ret)) - __put_user_asm(tmp, (u8 __user *)dst, - ret, "b", "b", "iq", 1); - __uaccess_end(); - return ret; - } - case 2: { - u16 tmp; -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(tmp, (u16 __user *)src, - ret, "w", "w", "=r", 2); - if (likely(!ret)) - __put_user_asm(tmp, (u16 __user *)dst, - ret, "w", "w", "ir", 2); - __uaccess_end(); - return ret; - } - - case 4: { - u32 tmp; -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(tmp, (u32 __user *)src, - ret, "l", "k", "=r", 4); - if (likely(!ret)) - __put_user_asm(tmp, (u32 __user *)dst, - ret, "l", "k", "ir", 4); - __uaccess_end(); - return ret; - } - case 8: { - u64 tmp; -- __uaccess_begin(); -+ __uaccess_begin_nospec(); - __get_user_asm(tmp, (u64 __user *)src, - ret, "q", "", "=r", 8); - if (likely(!ret)) - __put_user_asm(tmp, (u64 __user *)dst, - ret, "q", "", "er", 8); - __uaccess_end(); - return ret; - } - default: -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index b12c0287d6cf..e8b46f575306 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -693,7 +693,8 @@ static void init_speculation_control(struct cpuinfo_x86 *c) - if (cpu_has(c, X86_FEATURE_INTEL_STIBP)) - set_cpu_cap(c, X86_FEATURE_STIBP); - -- if (cpu_has(c, X86_FEATURE_SPEC_CTRL_SSBD)) -+ if (cpu_has(c, X86_FEATURE_SPEC_CTRL_SSBD) || -+ cpu_has(c, X86_FEATURE_VIRT_SSBD)) - set_cpu_cap(c, X86_FEATURE_SSBD); - - if (cpu_has(c, X86_FEATURE_AMD_IBRS)) { -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 338d13d4fd2f..b857bb9f6f23 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -341,6 +341,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - F(3DNOWPREFETCH) | F(OSVW) | 0 /* IBS */ | F(XOP) | - 0 /* SKINIT, WDT, LWP */ | F(FMA4) | F(TBM); - -+ /* cpuid 0x80000008.ebx */ -+ const u32 kvm_cpuid_8000_0008_ebx_x86_features = -+ F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD); -+ - /* cpuid 0xC0000001.edx */ - const u32 kvm_supported_word5_x86_features = - F(XSTORE) | F(XSTORE_EN) | F(XCRYPT) | F(XCRYPT_EN) | -@@ -358,6 +362,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - const u32 kvm_supported_word10_x86_features = - F(XSAVEOPT) | F(XSAVEC) | F(XGETBV1) | f_xsaves; - -+ /* cpuid 7.0.edx*/ -+ const u32 kvm_cpuid_7_0_edx_x86_features = -+ F(SPEC_CTRL) | F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES); -+ - /* all calls to cpuid_count() should be made on the same cpu */ - get_cpu(); - -@@ -435,11 +443,14 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - cpuid_mask(&entry->ebx, 9); - // TSC_ADJUST is emulated - entry->ebx |= F(TSC_ADJUST); -- } else -+ entry->edx &= kvm_cpuid_7_0_edx_x86_features; -+ cpuid_mask(&entry->edx, CPUID_7_EDX); -+ } else { - entry->ebx = 0; -+ entry->edx = 0; -+ } - entry->eax = 0; - entry->ecx = 0; -- entry->edx = 0; - break; - } - case 9: -@@ -583,7 +594,21 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - if (!g_phys_as) - g_phys_as = phys_as; - entry->eax = g_phys_as | (virt_as << 8); -- entry->ebx = entry->edx = 0; -+ entry->edx = 0; -+ /* -+ * IBRS, IBPB and VIRT_SSBD aren't necessarily present in -+ * hardware cpuid -+ */ -+ if (boot_cpu_has(X86_FEATURE_AMD_IBPB)) -+ entry->ebx |= F(AMD_IBPB); -+ if (boot_cpu_has(X86_FEATURE_AMD_IBRS)) -+ entry->ebx |= F(AMD_IBRS); -+ if (boot_cpu_has(X86_FEATURE_VIRT_SSBD)) -+ entry->ebx |= F(VIRT_SSBD); -+ entry->ebx &= kvm_cpuid_8000_0008_ebx_x86_features; -+ cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX); -+ if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD)) -+ entry->ebx |= F(VIRT_SSBD); - break; - } - case 0x80000019: -diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h -index d1534feefcfe..72f159f4d456 100644 ---- a/arch/x86/kvm/cpuid.h -+++ b/arch/x86/kvm/cpuid.h -@@ -159,6 +159,46 @@ static inline bool guest_cpuid_has_rdtscp(struct kvm_vcpu *vcpu) - return best && (best->edx & bit(X86_FEATURE_RDTSCP)); - } - -+static inline bool guest_cpuid_has_ibpb(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_cpuid_entry2 *best; -+ -+ best = kvm_find_cpuid_entry(vcpu, 0x80000008, 0); -+ if (best && (best->ebx & bit(X86_FEATURE_AMD_IBPB))) -+ return true; -+ best = kvm_find_cpuid_entry(vcpu, 7, 0); -+ return best && (best->edx & bit(X86_FEATURE_SPEC_CTRL)); -+} -+ -+static inline bool guest_cpuid_has_spec_ctrl(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_cpuid_entry2 *best; -+ -+ best = kvm_find_cpuid_entry(vcpu, 0x80000008, 0); -+ if (best && (best->ebx & bit(X86_FEATURE_AMD_IBRS))) -+ return true; -+ best = kvm_find_cpuid_entry(vcpu, 7, 0); -+ return best && (best->edx & (bit(X86_FEATURE_SPEC_CTRL) | bit(X86_FEATURE_SPEC_CTRL_SSBD))); -+} -+ -+static inline bool guest_cpuid_has_arch_capabilities(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_cpuid_entry2 *best; -+ -+ best = kvm_find_cpuid_entry(vcpu, 7, 0); -+ return best && (best->edx & bit(X86_FEATURE_ARCH_CAPABILITIES)); -+} -+ -+static inline bool guest_cpuid_has_virt_ssbd(struct kvm_vcpu *vcpu) -+{ -+ struct kvm_cpuid_entry2 *best; -+ -+ best = kvm_find_cpuid_entry(vcpu, 0x80000008, 0); -+ return best && (best->ebx & bit(X86_FEATURE_VIRT_SSBD)); -+} -+ -+ -+ - /* - * NRIPS is provided through cpuidfn 0x8000000a.edx bit 3 - */ -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index a1afd80a68aa..3c70f6c76d3a 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -56,7 +56,7 @@ - #define APIC_BUS_CYCLE_NS 1 - - /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */ --#define apic_debug(fmt, arg...) -+#define apic_debug(fmt, arg...) do {} while (0) - - #define APIC_LVT_NUM 6 - /* 14 is the version for Xeon and Pentium 8.4.8*/ -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index df7827a981dd..ecdf724da371 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -147,6 +148,14 @@ struct vcpu_svm { - u64 gs_base; - } host; - -+ u64 spec_ctrl; -+ /* -+ * Contains guest-controlled bits of VIRT_SPEC_CTRL, which will be -+ * translated into the appropriate L2_CFG bits on the host to -+ * perform speculative control. -+ */ -+ u64 virt_spec_ctrl; -+ - u32 *msrpm; - - ulong nmi_iret_rip; -@@ -182,6 +191,8 @@ static const struct svm_direct_access_msrs { - { .index = MSR_CSTAR, .always = true }, - { .index = MSR_SYSCALL_MASK, .always = true }, - #endif -+ { .index = MSR_IA32_SPEC_CTRL, .always = false }, -+ { .index = MSR_IA32_PRED_CMD, .always = false }, - { .index = MSR_IA32_LASTBRANCHFROMIP, .always = false }, - { .index = MSR_IA32_LASTBRANCHTOIP, .always = false }, - { .index = MSR_IA32_LASTINTFROMIP, .always = false }, -@@ -411,6 +422,7 @@ struct svm_cpu_data { - struct kvm_ldttss_desc *tss_desc; - - struct page *save_area; -+ struct vmcb *current_vmcb; - }; - - static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data); -@@ -762,6 +774,25 @@ static bool valid_msr_intercept(u32 index) - return false; - } - -+static bool msr_write_intercepted(struct kvm_vcpu *vcpu, unsigned msr) -+{ -+ u8 bit_write; -+ unsigned long tmp; -+ u32 offset; -+ u32 *msrpm; -+ -+ msrpm = is_guest_mode(vcpu) ? to_svm(vcpu)->nested.msrpm: -+ to_svm(vcpu)->msrpm; -+ -+ offset = svm_msrpm_offset(msr); -+ bit_write = 2 * (msr & 0x0f) + 1; -+ tmp = msrpm[offset]; -+ -+ BUG_ON(offset == MSR_INVALID); -+ -+ return !!test_bit(bit_write, &tmp); -+} -+ - static void set_msr_interception(u32 *msrpm, unsigned msr, - int read, int write) - { -@@ -1120,6 +1151,9 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) - u32 dummy; - u32 eax = 1; - -+ svm->spec_ctrl = 0; -+ svm->virt_spec_ctrl = 0; -+ - if (!init_event) { - svm->vcpu.arch.apic_base = APIC_DEFAULT_PHYS_BASE | - MSR_IA32_APICBASE_ENABLE; -@@ -1210,11 +1244,17 @@ static void svm_free_vcpu(struct kvm_vcpu *vcpu) - __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER); - kvm_vcpu_uninit(vcpu); - kmem_cache_free(kvm_vcpu_cache, svm); -+ /* -+ * The vmcb page can be recycled, causing a false negative in -+ * svm_vcpu_load(). So do a full IBPB now. -+ */ -+ indirect_branch_prediction_barrier(); - } - - static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - { - struct vcpu_svm *svm = to_svm(vcpu); -+ struct svm_cpu_data *sd = per_cpu(svm_data, cpu); - int i; - - if (unlikely(cpu != vcpu->cpu)) { -@@ -1239,6 +1279,10 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - wrmsrl(MSR_AMD64_TSC_RATIO, tsc_ratio); - } - } -+ if (sd->current_vmcb != svm->vmcb) { -+ sd->current_vmcb = svm->vmcb; -+ indirect_branch_prediction_barrier(); -+ } - } - - static void svm_vcpu_put(struct kvm_vcpu *vcpu) -@@ -3051,6 +3095,20 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_VM_CR: - msr_info->data = svm->nested.vm_cr_msr; - break; -+ case MSR_IA32_SPEC_CTRL: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_spec_ctrl(vcpu)) -+ return 1; -+ -+ msr_info->data = svm->spec_ctrl; -+ break; -+ case MSR_AMD64_VIRT_SPEC_CTRL: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_virt_ssbd(vcpu)) -+ return 1; -+ -+ msr_info->data = svm->virt_spec_ctrl; -+ break; - case MSR_IA32_UCODE_REV: - msr_info->data = 0x01000065; - break; -@@ -3125,6 +3183,59 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - case MSR_IA32_TSC: - kvm_write_tsc(vcpu, msr); - break; -+ case MSR_IA32_SPEC_CTRL: -+ if (!msr->host_initiated && -+ !guest_cpuid_has_spec_ctrl(vcpu)) -+ return 1; -+ -+ /* The STIBP bit doesn't fault even if it's not advertised */ -+ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP)) -+ return 1; -+ -+ svm->spec_ctrl = data; -+ -+ if (!data) -+ break; -+ -+ /* -+ * For non-nested: -+ * When it's written (to non-zero) for the first time, pass -+ * it through. -+ * -+ * For nested: -+ * The handling of the MSR bitmap for L2 guests is done in -+ * nested_svm_vmrun_msrpm. -+ * We update the L1 MSR bit as well since it will end up -+ * touching the MSR anyway now. -+ */ -+ set_msr_interception(svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1); -+ break; -+ case MSR_IA32_PRED_CMD: -+ if (!msr->host_initiated && -+ !guest_cpuid_has_ibpb(vcpu)) -+ return 1; -+ -+ if (data & ~PRED_CMD_IBPB) -+ return 1; -+ -+ if (!data) -+ break; -+ -+ wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); -+ if (is_guest_mode(vcpu)) -+ break; -+ set_msr_interception(svm->msrpm, MSR_IA32_PRED_CMD, 0, 1); -+ break; -+ case MSR_AMD64_VIRT_SPEC_CTRL: -+ if (!msr->host_initiated && -+ !guest_cpuid_has_virt_ssbd(vcpu)) -+ return 1; -+ -+ if (data & ~SPEC_CTRL_SSBD) -+ return 1; -+ -+ svm->virt_spec_ctrl = data; -+ break; - case MSR_STAR: - svm->vmcb->save.star = data; - break; -@@ -3811,6 +3922,14 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) - - local_irq_enable(); - -+ /* -+ * If this vCPU has touched SPEC_CTRL, restore the guest's value if -+ * it's non-zero. Since vmentry is serialising on affected CPUs, there -+ * is no need to worry about the conditional branch over the wrmsr -+ * being speculatively taken. -+ */ -+ x86_spec_ctrl_set_guest(svm->spec_ctrl, svm->virt_spec_ctrl); -+ - asm volatile ( - "push %%" _ASM_BP "; \n\t" - "mov %c[rbx](%[svm]), %%" _ASM_BX " \n\t" -@@ -3915,6 +4034,26 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) - #endif - #endif - -+ /* -+ * We do not use IBRS in the kernel. If this vCPU has used the -+ * SPEC_CTRL MSR it may have left it on; save the value and -+ * turn it off. This is much more efficient than blindly adding -+ * it to the atomic save/restore list. Especially as the former -+ * (Saving guest MSRs on vmexit) doesn't even exist in KVM. -+ * -+ * For non-nested case: -+ * If the L01 MSR bitmap does not intercept the MSR, then we need to -+ * save it. -+ * -+ * For nested case: -+ * If the L02 MSR bitmap does not intercept the MSR, then we need to -+ * save it. -+ */ -+ if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) -+ svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); -+ -+ x86_spec_ctrl_restore_host(svm->spec_ctrl, svm->virt_spec_ctrl); -+ - reload_tss(vcpu); - - local_irq_disable(); -@@ -4015,7 +4154,7 @@ static bool svm_cpu_has_accelerated_tpr(void) - return false; - } - --static bool svm_has_high_real_mode_segbase(void) -+static bool svm_has_emulated_msr(int index) - { - return true; - } -@@ -4299,7 +4438,7 @@ static struct kvm_x86_ops svm_x86_ops = { - .hardware_enable = svm_hardware_enable, - .hardware_disable = svm_hardware_disable, - .cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr, -- .cpu_has_high_real_mode_segbase = svm_has_high_real_mode_segbase, -+ .has_emulated_msr = svm_has_emulated_msr, - - .vcpu_create = svm_create_vcpu, - .vcpu_free = svm_free_vcpu, -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index c5a4b1978cbf..e4b5fd72ca24 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -48,6 +48,7 @@ - #include - #include - #include -+#include - #include - - #include "trace.h" -@@ -109,6 +110,14 @@ static u64 __read_mostly host_xss; - static bool __read_mostly enable_pml = 1; - module_param_named(pml, enable_pml, bool, S_IRUGO); - -+#define MSR_TYPE_R 1 -+#define MSR_TYPE_W 2 -+#define MSR_TYPE_RW 3 -+ -+#define MSR_BITMAP_MODE_X2APIC 1 -+#define MSR_BITMAP_MODE_X2APIC_APICV 2 -+#define MSR_BITMAP_MODE_LM 4 -+ - #define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL - - #define KVM_GUEST_CR0_MASK (X86_CR0_NW | X86_CR0_CD) -@@ -172,7 +181,6 @@ module_param(ple_window_max, int, S_IRUGO); - extern const ulong vmx_return; - - #define NR_AUTOLOAD_MSRS 8 --#define VMCS02_POOL_SIZE 1 - - struct vmcs { - u32 revision_id; -@@ -189,6 +197,7 @@ struct loaded_vmcs { - struct vmcs *vmcs; - int cpu; - int launched; -+ unsigned long *msr_bitmap; - struct list_head loaded_vmcss_on_cpu_link; - }; - -@@ -205,7 +214,7 @@ struct shared_msr_entry { - * stored in guest memory specified by VMPTRLD, but is opaque to the guest, - * which must access it using VMREAD/VMWRITE/VMCLEAR instructions. - * More than one of these structures may exist, if L1 runs multiple L2 guests. -- * nested_vmx_run() will use the data here to build a vmcs02: a VMCS for the -+ * nested_vmx_run() will use the data here to build the vmcs02: a VMCS for the - * underlying hardware which will be used to run L2. - * This structure is packed to ensure that its layout is identical across - * machines (necessary for live migration). -@@ -384,13 +393,6 @@ struct __packed vmcs12 { - */ - #define VMCS12_SIZE 0x1000 - --/* Used to remember the last vmcs02 used for some recently used vmcs12s */ --struct vmcs02_list { -- struct list_head list; -- gpa_t vmptr; -- struct loaded_vmcs vmcs02; --}; -- - /* - * The nested_vmx structure is part of vcpu_vmx, and holds information we need - * for correct emulation of VMX (i.e., nested VMX) on this vcpu. -@@ -412,16 +414,16 @@ struct nested_vmx { - */ - bool sync_shadow_vmcs; - -- /* vmcs02_list cache of VMCSs recently used to run L2 guests */ -- struct list_head vmcs02_pool; -- int vmcs02_num; - u64 vmcs01_tsc_offset; - bool change_vmcs01_virtual_x2apic_mode; - /* L2 must run next, and mustn't decide to exit to L1. */ - bool nested_run_pending; -+ -+ struct loaded_vmcs vmcs02; -+ - /* -- * Guest pages referred to in vmcs02 with host-physical pointers, so -- * we must keep them pinned while L2 runs. -+ * Guest pages referred to in the vmcs02 with host-physical -+ * pointers, so we must keep them pinned while L2 runs. - */ - struct page *apic_access_page; - struct page *virtual_apic_page; -@@ -531,6 +533,7 @@ struct vcpu_vmx { - unsigned long host_rsp; - u8 fail; - bool nmi_known_unmasked; -+ u8 msr_bitmap_mode; - u32 exit_intr_info; - u32 idt_vectoring_info; - ulong rflags; -@@ -542,6 +545,10 @@ struct vcpu_vmx { - u64 msr_host_kernel_gs_base; - u64 msr_guest_kernel_gs_base; - #endif -+ -+ u64 arch_capabilities; -+ u64 spec_ctrl; -+ - u32 vm_entry_controls_shadow; - u32 vm_exit_controls_shadow; - /* -@@ -889,6 +896,9 @@ static void vmx_sync_pir_to_irr_dummy(struct kvm_vcpu *vcpu); - static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx); - static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx); - static int alloc_identity_pagetable(struct kvm *kvm); -+static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu); -+static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap, -+ u32 msr, int type); - - static DEFINE_PER_CPU(struct vmcs *, vmxarea); - static DEFINE_PER_CPU(struct vmcs *, current_vmcs); -@@ -908,11 +918,6 @@ static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock); - - static unsigned long *vmx_io_bitmap_a; - static unsigned long *vmx_io_bitmap_b; --static unsigned long *vmx_msr_bitmap_legacy; --static unsigned long *vmx_msr_bitmap_longmode; --static unsigned long *vmx_msr_bitmap_legacy_x2apic; --static unsigned long *vmx_msr_bitmap_longmode_x2apic; --static unsigned long *vmx_msr_bitmap_nested; - static unsigned long *vmx_vmread_bitmap; - static unsigned long *vmx_vmwrite_bitmap; - -@@ -1689,6 +1694,52 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) - vmcs_write32(EXCEPTION_BITMAP, eb); - } - -+/* -+ * Check if MSR is intercepted for currently loaded MSR bitmap. -+ */ -+static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr) -+{ -+ unsigned long *msr_bitmap; -+ int f = sizeof(unsigned long); -+ -+ if (!cpu_has_vmx_msr_bitmap()) -+ return true; -+ -+ msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap; -+ -+ if (msr <= 0x1fff) { -+ return !!test_bit(msr, msr_bitmap + 0x800 / f); -+ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) { -+ msr &= 0x1fff; -+ return !!test_bit(msr, msr_bitmap + 0xc00 / f); -+ } -+ -+ return true; -+} -+ -+/* -+ * Check if MSR is intercepted for L01 MSR bitmap. -+ */ -+static bool msr_write_intercepted_l01(struct kvm_vcpu *vcpu, u32 msr) -+{ -+ unsigned long *msr_bitmap; -+ int f = sizeof(unsigned long); -+ -+ if (!cpu_has_vmx_msr_bitmap()) -+ return true; -+ -+ msr_bitmap = to_vmx(vcpu)->vmcs01.msr_bitmap; -+ -+ if (msr <= 0x1fff) { -+ return !!test_bit(msr, msr_bitmap + 0x800 / f); -+ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) { -+ msr &= 0x1fff; -+ return !!test_bit(msr, msr_bitmap + 0xc00 / f); -+ } -+ -+ return true; -+} -+ - static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx, - unsigned long entry, unsigned long exit) - { -@@ -2074,6 +2125,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) - if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) { - per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs; - vmcs_load(vmx->loaded_vmcs->vmcs); -+ indirect_branch_prediction_barrier(); - } - - if (vmx->loaded_vmcs->cpu != cpu) { -@@ -2353,27 +2405,6 @@ static void move_msr_up(struct vcpu_vmx *vmx, int from, int to) - vmx->guest_msrs[from] = tmp; - } - --static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu) --{ -- unsigned long *msr_bitmap; -- -- if (is_guest_mode(vcpu)) -- msr_bitmap = vmx_msr_bitmap_nested; -- else if (vcpu->arch.apic_base & X2APIC_ENABLE) { -- if (is_long_mode(vcpu)) -- msr_bitmap = vmx_msr_bitmap_longmode_x2apic; -- else -- msr_bitmap = vmx_msr_bitmap_legacy_x2apic; -- } else { -- if (is_long_mode(vcpu)) -- msr_bitmap = vmx_msr_bitmap_longmode; -- else -- msr_bitmap = vmx_msr_bitmap_legacy; -- } -- -- vmcs_write64(MSR_BITMAP, __pa(msr_bitmap)); --} -- - /* - * Set up the vmcs to automatically save and restore system - * msrs. Don't touch the 64-bit msrs if the guest is in legacy -@@ -2414,7 +2445,7 @@ static void setup_msrs(struct vcpu_vmx *vmx) - vmx->save_nmsrs = save_nmsrs; - - if (cpu_has_vmx_msr_bitmap()) -- vmx_set_msr_bitmap(&vmx->vcpu); -+ vmx_update_msr_bitmap(&vmx->vcpu); - } - - /* -@@ -2828,6 +2859,19 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_IA32_TSC: - msr_info->data = guest_read_tsc(vcpu); - break; -+ case MSR_IA32_SPEC_CTRL: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_spec_ctrl(vcpu)) -+ return 1; -+ -+ msr_info->data = to_vmx(vcpu)->spec_ctrl; -+ break; -+ case MSR_IA32_ARCH_CAPABILITIES: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_arch_capabilities(vcpu)) -+ return 1; -+ msr_info->data = to_vmx(vcpu)->arch_capabilities; -+ break; - case MSR_IA32_SYSENTER_CS: - msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); - break; -@@ -2927,6 +2971,68 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_IA32_TSC: - kvm_write_tsc(vcpu, msr_info); - break; -+ case MSR_IA32_SPEC_CTRL: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_spec_ctrl(vcpu)) -+ return 1; -+ -+ /* The STIBP bit doesn't fault even if it's not advertised */ -+ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD)) -+ return 1; -+ -+ vmx->spec_ctrl = data; -+ -+ if (!data) -+ break; -+ -+ /* -+ * For non-nested: -+ * When it's written (to non-zero) for the first time, pass -+ * it through. -+ * -+ * For nested: -+ * The handling of the MSR bitmap for L2 guests is done in -+ * nested_vmx_merge_msr_bitmap. We should not touch the -+ * vmcs02.msr_bitmap here since it gets completely overwritten -+ * in the merging. We update the vmcs01 here for L1 as well -+ * since it will end up touching the MSR anyway now. -+ */ -+ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, -+ MSR_IA32_SPEC_CTRL, -+ MSR_TYPE_RW); -+ break; -+ case MSR_IA32_PRED_CMD: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_ibpb(vcpu)) -+ return 1; -+ -+ if (data & ~PRED_CMD_IBPB) -+ return 1; -+ -+ if (!data) -+ break; -+ -+ wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); -+ -+ /* -+ * For non-nested: -+ * When it's written (to non-zero) for the first time, pass -+ * it through. -+ * -+ * For nested: -+ * The handling of the MSR bitmap for L2 guests is done in -+ * nested_vmx_merge_msr_bitmap. We should not touch the -+ * vmcs02.msr_bitmap here since it gets completely overwritten -+ * in the merging. -+ */ -+ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, -+ MSR_TYPE_W); -+ break; -+ case MSR_IA32_ARCH_CAPABILITIES: -+ if (!msr_info->host_initiated) -+ return 1; -+ vmx->arch_capabilities = data; -+ break; - case MSR_IA32_CR_PAT: - if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { - if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) -@@ -3352,11 +3458,6 @@ static struct vmcs *alloc_vmcs_cpu(int cpu) - return vmcs; - } - --static struct vmcs *alloc_vmcs(void) --{ -- return alloc_vmcs_cpu(raw_smp_processor_id()); --} -- - static void free_vmcs(struct vmcs *vmcs) - { - free_pages((unsigned long)vmcs, vmcs_config.order); -@@ -3372,6 +3473,34 @@ static void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs) - loaded_vmcs_clear(loaded_vmcs); - free_vmcs(loaded_vmcs->vmcs); - loaded_vmcs->vmcs = NULL; -+ if (loaded_vmcs->msr_bitmap) -+ free_page((unsigned long)loaded_vmcs->msr_bitmap); -+} -+ -+static struct vmcs *alloc_vmcs(void) -+{ -+ return alloc_vmcs_cpu(raw_smp_processor_id()); -+} -+ -+static int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs) -+{ -+ loaded_vmcs->vmcs = alloc_vmcs(); -+ if (!loaded_vmcs->vmcs) -+ return -ENOMEM; -+ -+ loaded_vmcs_init(loaded_vmcs); -+ -+ if (cpu_has_vmx_msr_bitmap()) { -+ loaded_vmcs->msr_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL); -+ if (!loaded_vmcs->msr_bitmap) -+ goto out_vmcs; -+ memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE); -+ } -+ return 0; -+ -+out_vmcs: -+ free_loaded_vmcs(loaded_vmcs); -+ return -ENOMEM; - } - - static void free_kvm_area(void) -@@ -4370,10 +4499,8 @@ static void free_vpid(int vpid) - spin_unlock(&vmx_vpid_lock); - } - --#define MSR_TYPE_R 1 --#define MSR_TYPE_W 2 --static void __vmx_disable_intercept_for_msr(unsigned long *msr_bitmap, -- u32 msr, int type) -+static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap, -+ u32 msr, int type) - { - int f = sizeof(unsigned long); - -@@ -4407,8 +4534,8 @@ static void __vmx_disable_intercept_for_msr(unsigned long *msr_bitmap, - } - } - --static void __vmx_enable_intercept_for_msr(unsigned long *msr_bitmap, -- u32 msr, int type) -+static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitmap, -+ u32 msr, int type) - { - int f = sizeof(unsigned long); - -@@ -4488,37 +4615,76 @@ static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1, - } - } - --static void vmx_disable_intercept_for_msr(u32 msr, bool longmode_only) -+static void __always_inline vmx_set_intercept_for_msr(unsigned long *msr_bitmap, -+ u32 msr, int type, bool value) - { -- if (!longmode_only) -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_legacy, -- msr, MSR_TYPE_R | MSR_TYPE_W); -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_longmode, -- msr, MSR_TYPE_R | MSR_TYPE_W); -+ if (value) -+ vmx_enable_intercept_for_msr(msr_bitmap, msr, type); -+ else -+ vmx_disable_intercept_for_msr(msr_bitmap, msr, type); - } - --static void vmx_enable_intercept_msr_read_x2apic(u32 msr) -+static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu) - { -- __vmx_enable_intercept_for_msr(vmx_msr_bitmap_legacy_x2apic, -- msr, MSR_TYPE_R); -- __vmx_enable_intercept_for_msr(vmx_msr_bitmap_longmode_x2apic, -- msr, MSR_TYPE_R); -+ u8 mode = 0; -+ -+ if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) { -+ mode |= MSR_BITMAP_MODE_X2APIC; -+ if (enable_apicv) -+ mode |= MSR_BITMAP_MODE_X2APIC_APICV; -+ } -+ -+ if (is_long_mode(vcpu)) -+ mode |= MSR_BITMAP_MODE_LM; -+ -+ return mode; - } - --static void vmx_disable_intercept_msr_read_x2apic(u32 msr) -+#define X2APIC_MSR(r) (APIC_BASE_MSR + ((r) >> 4)) -+ -+static void vmx_update_msr_bitmap_x2apic(unsigned long *msr_bitmap, -+ u8 mode) - { -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_legacy_x2apic, -- msr, MSR_TYPE_R); -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_longmode_x2apic, -- msr, MSR_TYPE_R); -+ int msr; -+ -+ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) { -+ unsigned word = msr / BITS_PER_LONG; -+ msr_bitmap[word] = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0; -+ msr_bitmap[word + (0x800 / sizeof(long))] = ~0; -+ } -+ -+ if (mode & MSR_BITMAP_MODE_X2APIC) { -+ /* -+ * TPR reads and writes can be virtualized even if virtual interrupt -+ * delivery is not in use. -+ */ -+ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW); -+ if (mode & MSR_BITMAP_MODE_X2APIC_APICV) { -+ vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_ID), MSR_TYPE_R); -+ vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_R); -+ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_EOI), MSR_TYPE_W); -+ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W); -+ } -+ } - } - --static void vmx_disable_intercept_msr_write_x2apic(u32 msr) -+static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu) - { -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_legacy_x2apic, -- msr, MSR_TYPE_W); -- __vmx_disable_intercept_for_msr(vmx_msr_bitmap_longmode_x2apic, -- msr, MSR_TYPE_W); -+ struct vcpu_vmx *vmx = to_vmx(vcpu); -+ unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap; -+ u8 mode = vmx_msr_bitmap_mode(vcpu); -+ u8 changed = mode ^ vmx->msr_bitmap_mode; -+ -+ if (!changed) -+ return; -+ -+ vmx_set_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW, -+ !(mode & MSR_BITMAP_MODE_LM)); -+ -+ if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV)) -+ vmx_update_msr_bitmap_x2apic(msr_bitmap, mode); -+ -+ vmx->msr_bitmap_mode = mode; - } - - static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu) -@@ -4526,6 +4692,28 @@ static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu) - return enable_apicv && lapic_in_kernel(vcpu); - } - -+static void nested_mark_vmcs12_pages_dirty(struct kvm_vcpu *vcpu) -+{ -+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu); -+ gfn_t gfn; -+ -+ /* -+ * Don't need to mark the APIC access page dirty; it is never -+ * written to by the CPU during APIC virtualization. -+ */ -+ -+ if (nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) { -+ gfn = vmcs12->virtual_apic_page_addr >> PAGE_SHIFT; -+ kvm_vcpu_mark_page_dirty(vcpu, gfn); -+ } -+ -+ if (nested_cpu_has_posted_intr(vmcs12)) { -+ gfn = vmcs12->posted_intr_desc_addr >> PAGE_SHIFT; -+ kvm_vcpu_mark_page_dirty(vcpu, gfn); -+ } -+} -+ -+ - static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); -@@ -4533,18 +4721,15 @@ static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - void *vapic_page; - u16 status; - -- if (vmx->nested.pi_desc && -- vmx->nested.pi_pending) { -- vmx->nested.pi_pending = false; -- if (!pi_test_and_clear_on(vmx->nested.pi_desc)) -- return; -- -- max_irr = find_last_bit( -- (unsigned long *)vmx->nested.pi_desc->pir, 256); -+ if (!vmx->nested.pi_desc || !vmx->nested.pi_pending) -+ return; - -- if (max_irr == 256) -- return; -+ vmx->nested.pi_pending = false; -+ if (!pi_test_and_clear_on(vmx->nested.pi_desc)) -+ return; - -+ max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256); -+ if (max_irr != 256) { - vapic_page = kmap(vmx->nested.virtual_apic_page); - __kvm_apic_update_irr(vmx->nested.pi_desc->pir, vapic_page); - kunmap(vmx->nested.virtual_apic_page); -@@ -4556,6 +4741,8 @@ static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - vmcs_write16(GUEST_INTR_STATUS, status); - } - } -+ -+ nested_mark_vmcs12_pages_dirty(vcpu); - } - - static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu) -@@ -4818,7 +5005,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) - vmcs_write64(VMWRITE_BITMAP, __pa(vmx_vmwrite_bitmap)); - } - if (cpu_has_vmx_msr_bitmap()) -- vmcs_write64(MSR_BITMAP, __pa(vmx_msr_bitmap_legacy)); -+ vmcs_write64(MSR_BITMAP, __pa(vmx->vmcs01.msr_bitmap)); - - vmcs_write64(VMCS_LINK_POINTER, -1ull); /* 22.3.1.5 */ - -@@ -4890,6 +5077,8 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) - ++vmx->nmsrs; - } - -+ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) -+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, vmx->arch_capabilities); - - vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); - -@@ -4918,6 +5107,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) - u64 cr0; - - vmx->rmode.vm86_active = 0; -+ vmx->spec_ctrl = 0; - - vmx->soft_vnmi_blocked = 0; - -@@ -6159,7 +6349,7 @@ static void wakeup_handler(void) - - static __init int hardware_setup(void) - { -- int r = -ENOMEM, i, msr; -+ int r = -ENOMEM, i; - - rdmsrl_safe(MSR_EFER, &host_efer); - -@@ -6174,38 +6364,13 @@ static __init int hardware_setup(void) - if (!vmx_io_bitmap_b) - goto out; - -- vmx_msr_bitmap_legacy = (unsigned long *)__get_free_page(GFP_KERNEL); -- if (!vmx_msr_bitmap_legacy) -- goto out1; -- -- vmx_msr_bitmap_legacy_x2apic = -- (unsigned long *)__get_free_page(GFP_KERNEL); -- if (!vmx_msr_bitmap_legacy_x2apic) -- goto out2; -- -- vmx_msr_bitmap_longmode = (unsigned long *)__get_free_page(GFP_KERNEL); -- if (!vmx_msr_bitmap_longmode) -- goto out3; -- -- vmx_msr_bitmap_longmode_x2apic = -- (unsigned long *)__get_free_page(GFP_KERNEL); -- if (!vmx_msr_bitmap_longmode_x2apic) -- goto out4; -- -- if (nested) { -- vmx_msr_bitmap_nested = -- (unsigned long *)__get_free_page(GFP_KERNEL); -- if (!vmx_msr_bitmap_nested) -- goto out5; -- } -- - vmx_vmread_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL); - if (!vmx_vmread_bitmap) -- goto out6; -+ goto out1; - - vmx_vmwrite_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL); - if (!vmx_vmwrite_bitmap) -- goto out7; -+ goto out2; - - memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); - memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); -@@ -6214,14 +6379,9 @@ static __init int hardware_setup(void) - - memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE); - -- memset(vmx_msr_bitmap_legacy, 0xff, PAGE_SIZE); -- memset(vmx_msr_bitmap_longmode, 0xff, PAGE_SIZE); -- if (nested) -- memset(vmx_msr_bitmap_nested, 0xff, PAGE_SIZE); -- - if (setup_vmcs_config(&vmcs_config) < 0) { - r = -EIO; -- goto out8; -+ goto out3; - } - - if (boot_cpu_has(X86_FEATURE_NX)) -@@ -6287,38 +6447,8 @@ static __init int hardware_setup(void) - kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy; - } - -- vmx_disable_intercept_for_msr(MSR_FS_BASE, false); -- vmx_disable_intercept_for_msr(MSR_GS_BASE, false); -- vmx_disable_intercept_for_msr(MSR_KERNEL_GS_BASE, true); -- vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false); -- vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false); -- vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false); -- -- memcpy(vmx_msr_bitmap_legacy_x2apic, -- vmx_msr_bitmap_legacy, PAGE_SIZE); -- memcpy(vmx_msr_bitmap_longmode_x2apic, -- vmx_msr_bitmap_longmode, PAGE_SIZE); -- - set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */ - -- if (enable_apicv) { -- for (msr = 0x800; msr <= 0x8ff; msr++) -- vmx_disable_intercept_msr_read_x2apic(msr); -- -- /* According SDM, in x2apic mode, the whole id reg is used. -- * But in KVM, it only use the highest eight bits. Need to -- * intercept it */ -- vmx_enable_intercept_msr_read_x2apic(0x802); -- /* TMCCT */ -- vmx_enable_intercept_msr_read_x2apic(0x839); -- /* TPR */ -- vmx_disable_intercept_msr_write_x2apic(0x808); -- /* EOI */ -- vmx_disable_intercept_msr_write_x2apic(0x80b); -- /* SELF-IPI */ -- vmx_disable_intercept_msr_write_x2apic(0x83f); -- } -- - if (enable_ept) { - kvm_mmu_set_mask_ptes(0ull, - (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull, -@@ -6349,21 +6479,10 @@ static __init int hardware_setup(void) - - return alloc_kvm_area(); - --out8: -- free_page((unsigned long)vmx_vmwrite_bitmap); --out7: -- free_page((unsigned long)vmx_vmread_bitmap); --out6: -- if (nested) -- free_page((unsigned long)vmx_msr_bitmap_nested); --out5: -- free_page((unsigned long)vmx_msr_bitmap_longmode_x2apic); --out4: -- free_page((unsigned long)vmx_msr_bitmap_longmode); - out3: -- free_page((unsigned long)vmx_msr_bitmap_legacy_x2apic); -+ free_page((unsigned long)vmx_vmwrite_bitmap); - out2: -- free_page((unsigned long)vmx_msr_bitmap_legacy); -+ free_page((unsigned long)vmx_vmread_bitmap); - out1: - free_page((unsigned long)vmx_io_bitmap_b); - out: -@@ -6374,16 +6493,10 @@ out: - - static __exit void hardware_unsetup(void) - { -- free_page((unsigned long)vmx_msr_bitmap_legacy_x2apic); -- free_page((unsigned long)vmx_msr_bitmap_longmode_x2apic); -- free_page((unsigned long)vmx_msr_bitmap_legacy); -- free_page((unsigned long)vmx_msr_bitmap_longmode); - free_page((unsigned long)vmx_io_bitmap_b); - free_page((unsigned long)vmx_io_bitmap_a); - free_page((unsigned long)vmx_vmwrite_bitmap); - free_page((unsigned long)vmx_vmread_bitmap); -- if (nested) -- free_page((unsigned long)vmx_msr_bitmap_nested); - - free_kvm_area(); - } -@@ -6426,93 +6539,6 @@ static int handle_monitor(struct kvm_vcpu *vcpu) - return handle_nop(vcpu); - } - --/* -- * To run an L2 guest, we need a vmcs02 based on the L1-specified vmcs12. -- * We could reuse a single VMCS for all the L2 guests, but we also want the -- * option to allocate a separate vmcs02 for each separate loaded vmcs12 - this -- * allows keeping them loaded on the processor, and in the future will allow -- * optimizations where prepare_vmcs02 doesn't need to set all the fields on -- * every entry if they never change. -- * So we keep, in vmx->nested.vmcs02_pool, a cache of size VMCS02_POOL_SIZE -- * (>=0) with a vmcs02 for each recently loaded vmcs12s, most recent first. -- * -- * The following functions allocate and free a vmcs02 in this pool. -- */ -- --/* Get a VMCS from the pool to use as vmcs02 for the current vmcs12. */ --static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx) --{ -- struct vmcs02_list *item; -- list_for_each_entry(item, &vmx->nested.vmcs02_pool, list) -- if (item->vmptr == vmx->nested.current_vmptr) { -- list_move(&item->list, &vmx->nested.vmcs02_pool); -- return &item->vmcs02; -- } -- -- if (vmx->nested.vmcs02_num >= max(VMCS02_POOL_SIZE, 1)) { -- /* Recycle the least recently used VMCS. */ -- item = list_entry(vmx->nested.vmcs02_pool.prev, -- struct vmcs02_list, list); -- item->vmptr = vmx->nested.current_vmptr; -- list_move(&item->list, &vmx->nested.vmcs02_pool); -- return &item->vmcs02; -- } -- -- /* Create a new VMCS */ -- item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL); -- if (!item) -- return NULL; -- item->vmcs02.vmcs = alloc_vmcs(); -- if (!item->vmcs02.vmcs) { -- kfree(item); -- return NULL; -- } -- loaded_vmcs_init(&item->vmcs02); -- item->vmptr = vmx->nested.current_vmptr; -- list_add(&(item->list), &(vmx->nested.vmcs02_pool)); -- vmx->nested.vmcs02_num++; -- return &item->vmcs02; --} -- --/* Free and remove from pool a vmcs02 saved for a vmcs12 (if there is one) */ --static void nested_free_vmcs02(struct vcpu_vmx *vmx, gpa_t vmptr) --{ -- struct vmcs02_list *item; -- list_for_each_entry(item, &vmx->nested.vmcs02_pool, list) -- if (item->vmptr == vmptr) { -- free_loaded_vmcs(&item->vmcs02); -- list_del(&item->list); -- kfree(item); -- vmx->nested.vmcs02_num--; -- return; -- } --} -- --/* -- * Free all VMCSs saved for this vcpu, except the one pointed by -- * vmx->loaded_vmcs. We must be running L1, so vmx->loaded_vmcs -- * must be &vmx->vmcs01. -- */ --static void nested_free_all_saved_vmcss(struct vcpu_vmx *vmx) --{ -- struct vmcs02_list *item, *n; -- -- WARN_ON(vmx->loaded_vmcs != &vmx->vmcs01); -- list_for_each_entry_safe(item, n, &vmx->nested.vmcs02_pool, list) { -- /* -- * Something will leak if the above WARN triggers. Better than -- * a use-after-free. -- */ -- if (vmx->loaded_vmcs == &item->vmcs02) -- continue; -- -- free_loaded_vmcs(&item->vmcs02); -- list_del(&item->list); -- kfree(item); -- vmx->nested.vmcs02_num--; -- } --} -- - /* - * The following 3 functions, nested_vmx_succeed()/failValid()/failInvalid(), - * set the success or error code of an emulated VMX instruction, as specified -@@ -6786,6 +6812,7 @@ static int handle_vmon(struct kvm_vcpu *vcpu) - struct vmcs *shadow_vmcs; - const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED - | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX; -+ int r; - - /* The Intel VMX Instruction Reference lists a bunch of bits that - * are prerequisite to running VMXON, most notably cr4.VMXE must be -@@ -6825,10 +6852,14 @@ static int handle_vmon(struct kvm_vcpu *vcpu) - return 1; - } - -+ r = alloc_loaded_vmcs(&vmx->nested.vmcs02); -+ if (r < 0) -+ goto out_vmcs02; -+ - if (enable_shadow_vmcs) { - shadow_vmcs = alloc_vmcs(); - if (!shadow_vmcs) -- return -ENOMEM; -+ goto out_shadow_vmcs; - /* mark vmcs as shadow */ - shadow_vmcs->revision_id |= (1u << 31); - /* init shadow vmcs */ -@@ -6836,9 +6867,6 @@ static int handle_vmon(struct kvm_vcpu *vcpu) - vmx->nested.current_shadow_vmcs = shadow_vmcs; - } - -- INIT_LIST_HEAD(&(vmx->nested.vmcs02_pool)); -- vmx->nested.vmcs02_num = 0; -- - hrtimer_init(&vmx->nested.preemption_timer, CLOCK_MONOTONIC, - HRTIMER_MODE_REL); - vmx->nested.preemption_timer.function = vmx_preemption_timer_fn; -@@ -6850,6 +6878,12 @@ static int handle_vmon(struct kvm_vcpu *vcpu) - skip_emulated_instruction(vcpu); - nested_vmx_succeed(vcpu); - return 1; -+ -+out_shadow_vmcs: -+ free_loaded_vmcs(&vmx->nested.vmcs02); -+ -+out_vmcs02: -+ return -ENOMEM; - } - - /* -@@ -6921,7 +6955,7 @@ static void free_nested(struct vcpu_vmx *vmx) - nested_release_vmcs12(vmx); - if (enable_shadow_vmcs) - free_vmcs(vmx->nested.current_shadow_vmcs); -- /* Unpin physical memory we referred to in current vmcs02 */ -+ /* Unpin physical memory we referred to in the vmcs02 */ - if (vmx->nested.apic_access_page) { - nested_release_page(vmx->nested.apic_access_page); - vmx->nested.apic_access_page = NULL; -@@ -6937,7 +6971,7 @@ static void free_nested(struct vcpu_vmx *vmx) - vmx->nested.pi_desc = NULL; - } - -- nested_free_all_saved_vmcss(vmx); -+ free_loaded_vmcs(&vmx->nested.vmcs02); - } - - /* Emulate the VMXOFF instruction */ -@@ -6971,8 +7005,6 @@ static int handle_vmclear(struct kvm_vcpu *vcpu) - vmptr + offsetof(struct vmcs12, launch_state), - &zero, sizeof(zero)); - -- nested_free_vmcs02(vmx, vmptr); -- - skip_emulated_instruction(vcpu); - nested_vmx_succeed(vcpu); - return 1; -@@ -7757,6 +7789,19 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) - vmcs_read32(VM_EXIT_INTR_ERROR_CODE), - KVM_ISA_VMX); - -+ /* -+ * The host physical addresses of some pages of guest memory -+ * are loaded into the vmcs02 (e.g. vmcs12's Virtual APIC -+ * Page). The CPU may write to these pages via their host -+ * physical address while L2 is running, bypassing any -+ * address-translation-based dirty tracking (e.g. EPT write -+ * protection). -+ * -+ * Mark them dirty on every exit from L2 to prevent them from -+ * getting out of sync with dirty tracking. -+ */ -+ nested_mark_vmcs12_pages_dirty(vcpu); -+ - if (vmx->nested.nested_run_pending) - return false; - -@@ -8244,7 +8289,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set) - } - vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control); - -- vmx_set_msr_bitmap(vcpu); -+ vmx_update_msr_bitmap(vcpu); - } - - static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa) -@@ -8413,9 +8458,21 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) - local_irq_enable(); - } - --static bool vmx_has_high_real_mode_segbase(void) -+static bool vmx_has_emulated_msr(int index) - { -- return enable_unrestricted_guest || emulate_invalid_guest_state; -+ switch (index) { -+ case MSR_IA32_SMBASE: -+ /* -+ * We cannot do SMM unless we can run the guest in big -+ * real mode. -+ */ -+ return enable_unrestricted_guest || emulate_invalid_guest_state; -+ case MSR_AMD64_VIRT_SPEC_CTRL: -+ /* This is AMD only. */ -+ return false; -+ default: -+ return true; -+ } - } - - static bool vmx_mpx_supported(void) -@@ -8607,7 +8664,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - atomic_switch_perf_msrs(vmx); - debugctlmsr = get_debugctlmsr(); - -+ /* -+ * If this vCPU has touched SPEC_CTRL, restore the guest's value if -+ * it's non-zero. Since vmentry is serialising on affected CPUs, there -+ * is no need to worry about the conditional branch over the wrmsr -+ * being speculatively taken. -+ */ -+ x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0); -+ - vmx->__launched = vmx->loaded_vmcs->launched; -+ - asm( - /* Store host registers */ - "push %%" _ASM_DX "; push %%" _ASM_BP ";" -@@ -8725,6 +8791,26 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - #endif - ); - -+ /* -+ * We do not use IBRS in the kernel. If this vCPU has used the -+ * SPEC_CTRL MSR it may have left it on; save the value and -+ * turn it off. This is much more efficient than blindly adding -+ * it to the atomic save/restore list. Especially as the former -+ * (Saving guest MSRs on vmexit) doesn't even exist in KVM. -+ * -+ * For non-nested case: -+ * If the L01 MSR bitmap does not intercept the MSR, then we need to -+ * save it. -+ * -+ * For nested case: -+ * If the L02 MSR bitmap does not intercept the MSR, then we need to -+ * save it. -+ */ -+ if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) -+ vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); -+ -+ x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0); -+ - /* Eliminate branch target predictions from guest mode */ - vmexit_fill_RSB(); - -@@ -8824,6 +8910,7 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) - { - int err; - struct vcpu_vmx *vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL); -+ unsigned long *msr_bitmap; - int cpu; - - if (!vmx) -@@ -8856,16 +8943,24 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) - if (!vmx->guest_msrs) - goto free_pml; - -- vmx->loaded_vmcs = &vmx->vmcs01; -- vmx->loaded_vmcs->vmcs = alloc_vmcs(); -- if (!vmx->loaded_vmcs->vmcs) -- goto free_msrs; - if (!vmm_exclusive) - kvm_cpu_vmxon(__pa(per_cpu(vmxarea, raw_smp_processor_id()))); -- loaded_vmcs_init(vmx->loaded_vmcs); -+ err = alloc_loaded_vmcs(&vmx->vmcs01); - if (!vmm_exclusive) - kvm_cpu_vmxoff(); -+ if (err < 0) -+ goto free_msrs; -+ -+ msr_bitmap = vmx->vmcs01.msr_bitmap; -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_FS_BASE, MSR_TYPE_RW); -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_GS_BASE, MSR_TYPE_RW); -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW); -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW); -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW); -+ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW); -+ vmx->msr_bitmap_mode = 0; - -+ vmx->loaded_vmcs = &vmx->vmcs01; - cpu = get_cpu(); - vmx_vcpu_load(&vmx->vcpu, cpu); - vmx->vcpu.cpu = cpu; -@@ -9248,9 +9343,26 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, - { - int msr; - struct page *page; -- unsigned long *msr_bitmap; -+ unsigned long *msr_bitmap_l1; -+ unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.vmcs02.msr_bitmap; -+ /* -+ * pred_cmd & spec_ctrl are trying to verify two things: -+ * -+ * 1. L0 gave a permission to L1 to actually passthrough the MSR. This -+ * ensures that we do not accidentally generate an L02 MSR bitmap -+ * from the L12 MSR bitmap that is too permissive. -+ * 2. That L1 or L2s have actually used the MSR. This avoids -+ * unnecessarily merging of the bitmap if the MSR is unused. This -+ * works properly because we only update the L01 MSR bitmap lazily. -+ * So even if L0 should pass L1 these MSRs, the L01 bitmap is only -+ * updated to reflect this when L1 (or its L2s) actually write to -+ * the MSR. -+ */ -+ bool pred_cmd = msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD); -+ bool spec_ctrl = msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL); - -- if (!nested_cpu_has_virt_x2apic_mode(vmcs12)) -+ if (!nested_cpu_has_virt_x2apic_mode(vmcs12) && -+ !pred_cmd && !spec_ctrl) - return false; - - page = nested_get_page(vcpu, vmcs12->msr_bitmap); -@@ -9258,59 +9370,46 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, - WARN_ON(1); - return false; - } -- msr_bitmap = (unsigned long *)kmap(page); -+ msr_bitmap_l1 = (unsigned long *)kmap(page); -+ -+ memset(msr_bitmap_l0, 0xff, PAGE_SIZE); - - if (nested_cpu_has_virt_x2apic_mode(vmcs12)) { - if (nested_cpu_has_apic_reg_virt(vmcs12)) - for (msr = 0x800; msr <= 0x8ff; msr++) - nested_vmx_disable_intercept_for_msr( -- msr_bitmap, -- vmx_msr_bitmap_nested, -+ msr_bitmap_l1, msr_bitmap_l0, - msr, MSR_TYPE_R); -- /* TPR is allowed */ -- nested_vmx_disable_intercept_for_msr(msr_bitmap, -- vmx_msr_bitmap_nested, -+ -+ nested_vmx_disable_intercept_for_msr( -+ msr_bitmap_l1, msr_bitmap_l0, - APIC_BASE_MSR + (APIC_TASKPRI >> 4), - MSR_TYPE_R | MSR_TYPE_W); -+ - if (nested_cpu_has_vid(vmcs12)) { -- /* EOI and self-IPI are allowed */ - nested_vmx_disable_intercept_for_msr( -- msr_bitmap, -- vmx_msr_bitmap_nested, -+ msr_bitmap_l1, msr_bitmap_l0, - APIC_BASE_MSR + (APIC_EOI >> 4), - MSR_TYPE_W); - nested_vmx_disable_intercept_for_msr( -- msr_bitmap, -- vmx_msr_bitmap_nested, -+ msr_bitmap_l1, msr_bitmap_l0, - APIC_BASE_MSR + (APIC_SELF_IPI >> 4), - MSR_TYPE_W); - } -- } else { -- /* -- * Enable reading intercept of all the x2apic -- * MSRs. We should not rely on vmcs12 to do any -- * optimizations here, it may have been modified -- * by L1. -- */ -- for (msr = 0x800; msr <= 0x8ff; msr++) -- __vmx_enable_intercept_for_msr( -- vmx_msr_bitmap_nested, -- msr, -- MSR_TYPE_R); -- -- __vmx_enable_intercept_for_msr( -- vmx_msr_bitmap_nested, -- APIC_BASE_MSR + (APIC_TASKPRI >> 4), -- MSR_TYPE_W); -- __vmx_enable_intercept_for_msr( -- vmx_msr_bitmap_nested, -- APIC_BASE_MSR + (APIC_EOI >> 4), -- MSR_TYPE_W); -- __vmx_enable_intercept_for_msr( -- vmx_msr_bitmap_nested, -- APIC_BASE_MSR + (APIC_SELF_IPI >> 4), -- MSR_TYPE_W); - } -+ -+ if (spec_ctrl) -+ nested_vmx_disable_intercept_for_msr( -+ msr_bitmap_l1, msr_bitmap_l0, -+ MSR_IA32_SPEC_CTRL, -+ MSR_TYPE_R | MSR_TYPE_W); -+ -+ if (pred_cmd) -+ nested_vmx_disable_intercept_for_msr( -+ msr_bitmap_l1, msr_bitmap_l0, -+ MSR_IA32_PRED_CMD, -+ MSR_TYPE_W); -+ - kunmap(page); - nested_release_page_clean(page); - -@@ -9729,10 +9828,10 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) - } - - if (cpu_has_vmx_msr_bitmap() && -- exec_control & CPU_BASED_USE_MSR_BITMAPS) { -- nested_vmx_merge_msr_bitmap(vcpu, vmcs12); -- /* MSR_BITMAP will be set by following vmx_set_efer. */ -- } else -+ exec_control & CPU_BASED_USE_MSR_BITMAPS && -+ nested_vmx_merge_msr_bitmap(vcpu, vmcs12)) -+ ; /* MSR_BITMAP will be set by following vmx_set_efer. */ -+ else - exec_control &= ~CPU_BASED_USE_MSR_BITMAPS; - - /* -@@ -9784,6 +9883,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) - else - vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset); - -+ if (cpu_has_vmx_msr_bitmap()) -+ vmcs_write64(MSR_BITMAP, __pa(vmx->nested.vmcs02.msr_bitmap)); -+ - if (enable_vpid) { - /* - * There is no direct mapping between vpid02 and vpid12, the -@@ -9876,7 +9978,6 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch) - struct vmcs12 *vmcs12; - struct vcpu_vmx *vmx = to_vmx(vcpu); - int cpu; -- struct loaded_vmcs *vmcs02; - bool ia32e; - u32 msr_entry_idx; - -@@ -10016,10 +10117,6 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch) - * the nested entry. - */ - -- vmcs02 = nested_get_current_vmcs02(vmx); -- if (!vmcs02) -- return -ENOMEM; -- - enter_guest_mode(vcpu); - - vmx->nested.vmcs01_tsc_offset = vmcs_read64(TSC_OFFSET); -@@ -10028,7 +10125,7 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch) - vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL); - - cpu = get_cpu(); -- vmx->loaded_vmcs = vmcs02; -+ vmx->loaded_vmcs = &vmx->nested.vmcs02; - vmx_vcpu_put(vcpu); - vmx_vcpu_load(vcpu, cpu); - vcpu->cpu = cpu; -@@ -10489,7 +10586,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, - vmcs_write64(GUEST_IA32_DEBUGCTL, 0); - - if (cpu_has_vmx_msr_bitmap()) -- vmx_set_msr_bitmap(vcpu); -+ vmx_update_msr_bitmap(vcpu); - - if (nested_vmx_load_msr(vcpu, vmcs12->vm_exit_msr_load_addr, - vmcs12->vm_exit_msr_load_count)) -@@ -10540,10 +10637,6 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, - vm_exit_controls_init(vmx, vmcs_read32(VM_EXIT_CONTROLS)); - vmx_segment_cache_clear(vmx); - -- /* if no vmcs02 cache requested, remove the one we used */ -- if (VMCS02_POOL_SIZE == 0) -- nested_free_vmcs02(vmx, vmx->nested.current_vmptr); -- - load_vmcs12_host_state(vcpu, vmcs12); - - /* Update TSC_OFFSET if TSC was changed while L2 ran */ -@@ -10871,7 +10964,7 @@ static struct kvm_x86_ops vmx_x86_ops = { - .hardware_enable = hardware_enable, - .hardware_disable = hardware_disable, - .cpu_has_accelerated_tpr = report_flexpriority, -- .cpu_has_high_real_mode_segbase = vmx_has_high_real_mode_segbase, -+ .has_emulated_msr = vmx_has_emulated_msr, - - .vcpu_create = vmx_create_vcpu, - .vcpu_free = vmx_free_vcpu, -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index e6ab034f0bc7..aa1a0277a678 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -961,6 +961,7 @@ static u32 msrs_to_save[] = { - #endif - MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA, - MSR_IA32_FEATURE_CONTROL, MSR_IA32_BNDCFGS, MSR_TSC_AUX, -+ MSR_IA32_SPEC_CTRL, MSR_IA32_ARCH_CAPABILITIES - }; - - static unsigned num_msrs_to_save; -@@ -984,6 +985,7 @@ static u32 emulated_msrs[] = { - MSR_IA32_MCG_STATUS, - MSR_IA32_MCG_CTL, - MSR_IA32_SMBASE, -+ MSR_AMD64_VIRT_SPEC_CTRL, - }; - - static unsigned num_emulated_msrs; -@@ -2583,7 +2585,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) - * fringe case that is not enabled except via specific settings - * of the module parameters. - */ -- r = kvm_x86_ops->cpu_has_high_real_mode_segbase(); -+ r = kvm_x86_ops->has_emulated_msr(MSR_IA32_SMBASE); - break; - case KVM_CAP_COALESCED_MMIO: - r = KVM_COALESCED_MMIO_PAGE_OFFSET; -@@ -4072,14 +4074,8 @@ static void kvm_init_msr_list(void) - num_msrs_to_save = j; - - for (i = j = 0; i < ARRAY_SIZE(emulated_msrs); i++) { -- switch (emulated_msrs[i]) { -- case MSR_IA32_SMBASE: -- if (!kvm_x86_ops->cpu_has_high_real_mode_segbase()) -- continue; -- break; -- default: -- break; -- } -+ if (!kvm_x86_ops->has_emulated_msr(emulated_msrs[i])) -+ continue; - - if (j < i) - emulated_msrs[j] = emulated_msrs[i]; -diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c -index 91d93b95bd86..0a6fcae404f8 100644 ---- a/arch/x86/lib/usercopy_32.c -+++ b/arch/x86/lib/usercopy_32.c -@@ -570,12 +570,12 @@ do { \ - unsigned long __copy_to_user_ll(void __user *to, const void *from, - unsigned long n) - { -- stac(); -+ __uaccess_begin_nospec(); - if (movsl_is_ok(to, from, n)) - __copy_user(to, from, n); - else - n = __copy_user_intel(to, from, n); -- clac(); -+ __uaccess_end(); - return n; - } - EXPORT_SYMBOL(__copy_to_user_ll); -@@ -583,12 +583,12 @@ EXPORT_SYMBOL(__copy_to_user_ll); - unsigned long __copy_from_user_ll(void *to, const void __user *from, - unsigned long n) - { -- stac(); -+ __uaccess_begin_nospec(); - if (movsl_is_ok(to, from, n)) - __copy_user_zeroing(to, from, n); - else - n = __copy_user_zeroing_intel(to, from, n); -- clac(); -+ __uaccess_end(); - return n; - } - EXPORT_SYMBOL(__copy_from_user_ll); -@@ -596,13 +596,13 @@ EXPORT_SYMBOL(__copy_from_user_ll); - unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from, - unsigned long n) - { -- stac(); -+ __uaccess_begin_nospec(); - if (movsl_is_ok(to, from, n)) - __copy_user(to, from, n); - else - n = __copy_user_intel((void __user *)to, - (const void *)from, n); -- clac(); -+ __uaccess_end(); - return n; - } - EXPORT_SYMBOL(__copy_from_user_ll_nozero); -@@ -610,7 +610,7 @@ EXPORT_SYMBOL(__copy_from_user_ll_nozero); - unsigned long __copy_from_user_ll_nocache(void *to, const void __user *from, - unsigned long n) - { -- stac(); -+ __uaccess_begin_nospec(); - #ifdef CONFIG_X86_INTEL_USERCOPY - if (n > 64 && cpu_has_xmm2) - n = __copy_user_zeroing_intel_nocache(to, from, n); -@@ -619,7 +619,7 @@ unsigned long __copy_from_user_ll_nocache(void *to, const void __user *from, - #else - __copy_user_zeroing(to, from, n); - #endif -- clac(); -+ __uaccess_end(); - return n; - } - EXPORT_SYMBOL(__copy_from_user_ll_nocache); -@@ -627,7 +627,7 @@ EXPORT_SYMBOL(__copy_from_user_ll_nocache); - unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *from, - unsigned long n) - { -- stac(); -+ __uaccess_begin_nospec(); - #ifdef CONFIG_X86_INTEL_USERCOPY - if (n > 64 && cpu_has_xmm2) - n = __copy_user_intel_nocache(to, from, n); -@@ -636,7 +636,7 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr - #else - __copy_user(to, from, n); - #endif -- clac(); -+ __uaccess_end(); - return n; - } - EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero); -diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c -index ae9a37bf1371..7d2542ad346a 100644 ---- a/arch/x86/mm/gup.c -+++ b/arch/x86/mm/gup.c -@@ -388,7 +388,7 @@ slow_irqon: - - ret = get_user_pages_unlocked(current, mm, start, - (end - start) >> PAGE_SHIFT, -- write, 0, pages); -+ pages, write ? FOLL_WRITE : 0); - - /* Have to be a bit careful with return values */ - if (nr > 0) { -diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c -index 7ed47b1e6f42..7e94fc6f608a 100644 ---- a/arch/x86/mm/mpx.c -+++ b/arch/x86/mm/mpx.c -@@ -536,10 +536,9 @@ static int mpx_resolve_fault(long __user *addr, int write) - { - long gup_ret; - int nr_pages = 1; -- int force = 0; - - gup_ret = get_user_pages(current, current->mm, (unsigned long)addr, -- nr_pages, write, force, NULL, NULL); -+ nr_pages, write ? FOLL_WRITE : 0, NULL, NULL); - /* - * get_user_pages() returns number of pages gotten. - * 0 means we failed to fault in and get anything, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index e40a6d8b0b92..062c23125b2a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -496,9 +496,13 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) - int r; - - int write = !(gtt->userflags & AMDGPU_GEM_USERPTR_READONLY); -+ unsigned int flags = 0; - enum dma_data_direction direction = write ? - DMA_BIDIRECTIONAL : DMA_TO_DEVICE; - -+ if (write) -+ flags |= FOLL_WRITE; -+ - if (current->mm != gtt->usermm) - return -EPERM; - -@@ -519,7 +523,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) - struct page **pages = ttm->pages + pinned; - - r = get_user_pages(current, current->mm, userptr, num_pages, -- write, 0, pages, NULL); -+ flags, pages, NULL); - if (r < 0) - goto release_pages; - -diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c -index 21085f669e21..b19ba1792607 100644 ---- a/drivers/gpu/drm/ast/ast_mode.c -+++ b/drivers/gpu/drm/ast/ast_mode.c -@@ -968,9 +968,21 @@ static int get_clock(void *i2c_priv) - { - struct ast_i2c_chan *i2c = i2c_priv; - struct ast_private *ast = i2c->dev->dev_private; -- uint32_t val; -+ uint32_t val, val2, count, pass; -+ -+ count = 0; -+ pass = 0; -+ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01; -+ do { -+ val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01; -+ if (val == val2) { -+ pass++; -+ } else { -+ pass = 0; -+ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01; -+ } -+ } while ((pass < 5) && (count++ < 0x10000)); - -- val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4; - return val & 1 ? 1 : 0; - } - -@@ -978,9 +990,21 @@ static int get_data(void *i2c_priv) - { - struct ast_i2c_chan *i2c = i2c_priv; - struct ast_private *ast = i2c->dev->dev_private; -- uint32_t val; -+ uint32_t val, val2, count, pass; -+ -+ count = 0; -+ pass = 0; -+ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01; -+ do { -+ val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01; -+ if (val == val2) { -+ pass++; -+ } else { -+ pass = 0; -+ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01; -+ } -+ } while ((pass < 5) && (count++ < 0x10000)); - -- val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5; - return val & 1 ? 1 : 0; - } - -@@ -993,7 +1017,7 @@ static void set_clock(void *i2c_priv, int clock) - - for (i = 0; i < 0x10000; i++) { - ujcrb7 = ((clock & 0x01) ? 0 : 1); -- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfe, ujcrb7); -+ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf4, ujcrb7); - jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x01); - if (ujcrb7 == jtemp) - break; -@@ -1009,7 +1033,7 @@ static void set_data(void *i2c_priv, int data) - - for (i = 0; i < 0x10000; i++) { - ujcrb7 = ((data & 0x01) ? 0 : 1) << 2; -- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfb, ujcrb7); -+ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf1, ujcrb7); - jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x04); - if (ujcrb7 == jtemp) - break; -diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c -index c17efdb238a6..639ea28808e2 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c -@@ -471,7 +471,8 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev, - goto err_free; - } - -- ret = get_vaddr_frames(start, npages, true, true, g2d_userptr->vec); -+ ret = get_vaddr_frames(start, npages, FOLL_FORCE | FOLL_WRITE, -+ g2d_userptr->vec); - if (ret != npages) { - DRM_ERROR("failed to get user pages from userptr.\n"); - if (ret < 0) -diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c -index 359fe2b8bb8a..b02113b57d51 100644 ---- a/drivers/gpu/drm/i915/i915_gem_userptr.c -+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c -@@ -581,13 +581,17 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) - pvec = drm_malloc_ab(npages, sizeof(struct page *)); - if (pvec != NULL) { - struct mm_struct *mm = obj->userptr.mm->mm; -+ unsigned int flags = 0; -+ -+ if (!obj->userptr.read_only) -+ flags |= FOLL_WRITE; - - down_read(&mm->mmap_sem); - while (pinned < npages) { - ret = get_user_pages(work->task, mm, - obj->userptr.ptr + pinned * PAGE_SIZE, - npages - pinned, -- !obj->userptr.read_only, 0, -+ flags, - pvec + pinned, NULL); - if (ret < 0) - break; -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index d684e2b79d2b..0c380fe77382 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -557,7 +557,7 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_tt *ttm) - struct page **pages = ttm->pages + pinned; - - r = get_user_pages(current, current->mm, userptr, num_pages, -- write, 0, pages, NULL); -+ write ? FOLL_WRITE : 0, pages, NULL); - if (r < 0) - goto release_pages; - -diff --git a/drivers/gpu/drm/via/via_dmablit.c b/drivers/gpu/drm/via/via_dmablit.c -index d0cbd5ecd7f0..4459cb32d1fe 100644 ---- a/drivers/gpu/drm/via/via_dmablit.c -+++ b/drivers/gpu/drm/via/via_dmablit.c -@@ -242,8 +242,8 @@ via_lock_all_dma_pages(drm_via_sg_info_t *vsg, drm_via_dmablit_t *xfer) - ret = get_user_pages(current, current->mm, - (unsigned long)xfer->mem_addr, - vsg->num_pages, -- (vsg->direction == DMA_FROM_DEVICE), -- 0, vsg->pages, NULL); -+ (vsg->direction == DMA_FROM_DEVICE) ? FOLL_WRITE : 0, -+ vsg->pages, NULL); - - up_read(¤t->mm->mmap_sem); - if (ret != vsg->num_pages) { -diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c -index 9ac6e1673375..1f291b344178 100644 ---- a/drivers/hwmon/ina2xx.c -+++ b/drivers/hwmon/ina2xx.c -@@ -273,7 +273,7 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg, - break; - case INA2XX_CURRENT: - /* signed register, result in mA */ -- val = regval * data->current_lsb_uA; -+ val = (s16)regval * data->current_lsb_uA; - val = DIV_ROUND_CLOSEST(val, 1000); - break; - case INA2XX_CALIBRATION: -diff --git a/drivers/hwmon/w83795.c b/drivers/hwmon/w83795.c -index 49276bbdac3d..1bb80f992aa8 100644 ---- a/drivers/hwmon/w83795.c -+++ b/drivers/hwmon/w83795.c -@@ -1691,7 +1691,7 @@ store_sf_setup(struct device *dev, struct device_attribute *attr, - * somewhere else in the code - */ - #define SENSOR_ATTR_TEMP(index) { \ -- SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 4 ? S_IWUSR : 0), \ -+ SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 5 ? S_IWUSR : 0), \ - show_temp_mode, store_temp_mode, NOT_USED, index - 1), \ - SENSOR_ATTR_2(temp##index##_input, S_IRUGO, show_temp, \ - NULL, TEMP_READ, index - 1), \ -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index 98fd9a594841..8762eac47570 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -95,6 +95,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - DEFINE_DMA_ATTRS(attrs); - struct scatterlist *sg, *sg_list_start; - int need_release = 0; -+ unsigned int gup_flags = FOLL_WRITE; - - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); -@@ -177,6 +178,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - if (ret) - goto out; - -+ if (!umem->writable) -+ gup_flags |= FOLL_FORCE; -+ - need_release = 1; - sg_list_start = umem->sg_head.sgl; - -@@ -184,7 +188,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - ret = get_user_pages(current, current->mm, cur_base, - min_t(unsigned long, npages, - PAGE_SIZE / sizeof (struct page *)), -- 1, !umem->writable, page_list, vma_list); -+ gup_flags, page_list, vma_list); - - if (ret < 0) - goto out; -diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c -index 40becdb3196e..738ccfee7cae 100644 ---- a/drivers/infiniband/core/umem_odp.c -+++ b/drivers/infiniband/core/umem_odp.c -@@ -527,6 +527,7 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt, - u64 off; - int j, k, ret = 0, start_idx, npages = 0; - u64 base_virt_addr; -+ unsigned int flags = 0; - - if (access_mask == 0) - return -EINVAL; -@@ -556,6 +557,9 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt, - goto out_put_task; - } - -+ if (access_mask & ODP_WRITE_ALLOWED_BIT) -+ flags |= FOLL_WRITE; -+ - start_idx = (user_virt - ib_umem_start(umem)) >> PAGE_SHIFT; - k = start_idx; - -@@ -574,8 +578,7 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt, - */ - npages = get_user_pages(owning_process, owning_mm, user_virt, - gup_num_pages, -- access_mask & ODP_WRITE_ALLOWED_BIT, 0, -- local_page_list, NULL); -+ flags, local_page_list, NULL); - up_read(&owning_mm->mmap_sem); - - if (npages < 0) -diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c -index 7d2e42dd6926..8676685dbf3d 100644 ---- a/drivers/infiniband/hw/mthca/mthca_memfree.c -+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c -@@ -472,8 +472,8 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar, - goto out; - } - -- ret = get_user_pages(current, current->mm, uaddr & PAGE_MASK, 1, 1, 0, -- pages, NULL); -+ ret = get_user_pages(current, current->mm, uaddr & PAGE_MASK, 1, -+ FOLL_WRITE, pages, NULL); - if (ret < 0) - goto out; - -diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c -index ab1588ae1c85..75c3f0dffe63 100644 ---- a/drivers/infiniband/hw/qib/qib_user_pages.c -+++ b/drivers/infiniband/hw/qib/qib_user_pages.c -@@ -68,7 +68,8 @@ static int __qib_get_user_pages(unsigned long start_page, size_t num_pages, - for (got = 0; got < num_pages; got += ret) { - ret = get_user_pages(current, current->mm, - start_page + got * PAGE_SIZE, -- num_pages - got, 1, 1, -+ num_pages - got, -+ FOLL_WRITE | FOLL_FORCE, - p + got, NULL); - if (ret < 0) - goto bail_release; -diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c -index 645a5f6e6c88..7f0d75e29441 100644 ---- a/drivers/infiniband/hw/usnic/usnic_uiom.c -+++ b/drivers/infiniband/hw/usnic/usnic_uiom.c -@@ -113,6 +113,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable, - int flags; - dma_addr_t pa; - DEFINE_DMA_ATTRS(attrs); -+ unsigned int gup_flags; - - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); -@@ -140,6 +141,8 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable, - - flags = IOMMU_READ | IOMMU_CACHE; - flags |= (writable) ? IOMMU_WRITE : 0; -+ gup_flags = FOLL_WRITE; -+ gup_flags |= (writable) ? 0 : FOLL_FORCE; - cur_base = addr & PAGE_MASK; - ret = 0; - -@@ -147,7 +150,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable, - ret = get_user_pages(current, current->mm, cur_base, - min_t(unsigned long, npages, - PAGE_SIZE / sizeof(struct page *)), -- 1, !writable, page_list, NULL); -+ gup_flags, page_list, NULL); - - if (ret < 0) - goto out; -diff --git a/drivers/media/dvb-frontends/ascot2e.c b/drivers/media/dvb-frontends/ascot2e.c -index f770f6a2c987..3ea9edc8cdbe 100644 ---- a/drivers/media/dvb-frontends/ascot2e.c -+++ b/drivers/media/dvb-frontends/ascot2e.c -@@ -155,7 +155,9 @@ static int ascot2e_write_regs(struct ascot2e_priv *priv, - - static int ascot2e_write_reg(struct ascot2e_priv *priv, u8 reg, u8 val) - { -- return ascot2e_write_regs(priv, reg, &val, 1); -+ u8 tmp = val; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return ascot2e_write_regs(priv, reg, &tmp, 1); - } - - static int ascot2e_read_regs(struct ascot2e_priv *priv, -diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c -index 107853b0fddd..bde77671a37c 100644 ---- a/drivers/media/dvb-frontends/cxd2841er.c -+++ b/drivers/media/dvb-frontends/cxd2841er.c -@@ -241,7 +241,9 @@ static int cxd2841er_write_regs(struct cxd2841er_priv *priv, - static int cxd2841er_write_reg(struct cxd2841er_priv *priv, - u8 addr, u8 reg, u8 val) - { -- return cxd2841er_write_regs(priv, addr, reg, &val, 1); -+ u8 tmp = val; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return cxd2841er_write_regs(priv, addr, reg, &tmp, 1); - } - - static int cxd2841er_read_regs(struct cxd2841er_priv *priv, -diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c -index 000606af70f7..f770ab72a8e3 100644 ---- a/drivers/media/dvb-frontends/horus3a.c -+++ b/drivers/media/dvb-frontends/horus3a.c -@@ -89,7 +89,9 @@ static int horus3a_write_regs(struct horus3a_priv *priv, - - static int horus3a_write_reg(struct horus3a_priv *priv, u8 reg, u8 val) - { -- return horus3a_write_regs(priv, reg, &val, 1); -+ u8 tmp = val; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return horus3a_write_regs(priv, reg, &tmp, 1); - } - - static int horus3a_enter_power_save(struct horus3a_priv *priv) -diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c -index cadcae4cff89..ac9d2591bb6f 100644 ---- a/drivers/media/dvb-frontends/itd1000.c -+++ b/drivers/media/dvb-frontends/itd1000.c -@@ -99,8 +99,9 @@ static int itd1000_read_reg(struct itd1000_state *state, u8 reg) - - static inline int itd1000_write_reg(struct itd1000_state *state, u8 r, u8 v) - { -- int ret = itd1000_write_regs(state, r, &v, 1); -- state->shadow[r] = v; -+ u8 tmp = v; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ int ret = itd1000_write_regs(state, r, &tmp, 1); -+ state->shadow[r] = tmp; - return ret; - } - -diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c -index c36e6764eead..c44188271028 100644 ---- a/drivers/media/dvb-frontends/mt312.c -+++ b/drivers/media/dvb-frontends/mt312.c -@@ -142,7 +142,10 @@ static inline int mt312_readreg(struct mt312_state *state, - static inline int mt312_writereg(struct mt312_state *state, - const enum mt312_reg_addr reg, const u8 val) - { -- return mt312_write(state, reg, &val, 1); -+ u8 tmp = val; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ -+ return mt312_write(state, reg, &tmp, 1); - } - - static inline u32 mt312_div(u32 a, u32 b) -diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c -index 756650f154ab..ad9b7d4f8d95 100644 ---- a/drivers/media/dvb-frontends/stb0899_drv.c -+++ b/drivers/media/dvb-frontends/stb0899_drv.c -@@ -552,7 +552,8 @@ int stb0899_write_regs(struct stb0899_state *state, unsigned int reg, u8 *data, - - int stb0899_write_reg(struct stb0899_state *state, unsigned int reg, u8 data) - { -- return stb0899_write_regs(state, reg, &data, 1); -+ u8 tmp = data; -+ return stb0899_write_regs(state, reg, &tmp, 1); - } - - /* -diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c -index 4ef8a5c7003e..44fac2570034 100644 ---- a/drivers/media/dvb-frontends/stb6100.c -+++ b/drivers/media/dvb-frontends/stb6100.c -@@ -226,12 +226,14 @@ static int stb6100_write_reg_range(struct stb6100_state *state, u8 buf[], int st - - static int stb6100_write_reg(struct stb6100_state *state, u8 reg, u8 data) - { -+ u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ - if (unlikely(reg >= STB6100_NUMREGS)) { - dprintk(verbose, FE_ERROR, 1, "Invalid register offset 0x%x", reg); - return -EREMOTEIO; - } -- data = (data & stb6100_template[reg].mask) | stb6100_template[reg].set; -- return stb6100_write_reg_range(state, &data, reg, 1); -+ tmp = (tmp & stb6100_template[reg].mask) | stb6100_template[reg].set; -+ return stb6100_write_reg_range(state, &tmp, reg, 1); - } - - -diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c -index 44cb73f68af6..ddd0d778ad6e 100644 ---- a/drivers/media/dvb-frontends/stv0367.c -+++ b/drivers/media/dvb-frontends/stv0367.c -@@ -804,7 +804,9 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len) - - static int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data) - { -- return stv0367_writeregs(state, reg, &data, 1); -+ u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return stv0367_writeregs(state, reg, &tmp, 1); - } - - static u8 stv0367_readreg(struct stv0367_state *state, u16 reg) -diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c -index 25bdf6e0f963..f0377e2b341b 100644 ---- a/drivers/media/dvb-frontends/stv090x.c -+++ b/drivers/media/dvb-frontends/stv090x.c -@@ -761,7 +761,9 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8 - - static int stv090x_write_reg(struct stv090x_state *state, unsigned int reg, u8 data) - { -- return stv090x_write_regs(state, reg, &data, 1); -+ u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return stv090x_write_regs(state, reg, &tmp, 1); - } - - static int stv090x_i2c_gate_ctrl(struct stv090x_state *state, int enable) -diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c -index e66154e5c1d7..45d14869e7b8 100644 ---- a/drivers/media/dvb-frontends/stv6110x.c -+++ b/drivers/media/dvb-frontends/stv6110x.c -@@ -97,7 +97,9 @@ static int stv6110x_write_regs(struct stv6110x_state *stv6110x, int start, u8 da - - static int stv6110x_write_reg(struct stv6110x_state *stv6110x, u8 reg, u8 data) - { -- return stv6110x_write_regs(stv6110x, reg, &data, 1); -+ u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return stv6110x_write_regs(stv6110x, reg, &tmp, 1); - } - - static int stv6110x_init(struct dvb_frontend *fe) -diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c -index ee09ec26c553..b273e4fd8024 100644 ---- a/drivers/media/dvb-frontends/zl10039.c -+++ b/drivers/media/dvb-frontends/zl10039.c -@@ -138,7 +138,9 @@ static inline int zl10039_writereg(struct zl10039_state *state, - const enum zl10039_reg_addr reg, - const u8 val) - { -- return zl10039_write(state, reg, &val, 1); -+ const u8 tmp = val; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */ -+ -+ return zl10039_write(state, reg, &tmp, 1); - } - - static int zl10039_init(struct dvb_frontend *fe) -diff --git a/drivers/media/pci/ivtv/ivtv-udma.c b/drivers/media/pci/ivtv/ivtv-udma.c -index 24152accc66c..8729fdebef8f 100644 ---- a/drivers/media/pci/ivtv/ivtv-udma.c -+++ b/drivers/media/pci/ivtv/ivtv-udma.c -@@ -125,7 +125,8 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr, - - /* Get user pages for DMA Xfer */ - err = get_user_pages_unlocked(current, current->mm, -- user_dma.uaddr, user_dma.page_count, 0, 1, dma->map); -+ user_dma.uaddr, user_dma.page_count, dma->map, -+ FOLL_FORCE); - - if (user_dma.page_count != err) { - IVTV_DEBUG_WARN("failed to map user pages, returned %d instead of %d\n", -diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c -index 2b8e7b2f2b86..9cd995f418e0 100644 ---- a/drivers/media/pci/ivtv/ivtv-yuv.c -+++ b/drivers/media/pci/ivtv/ivtv-yuv.c -@@ -76,13 +76,13 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma, - - /* Get user pages for DMA Xfer */ - y_pages = get_user_pages_unlocked(current, current->mm, -- y_dma.uaddr, y_dma.page_count, 0, 1, -- &dma->map[0]); -+ y_dma.uaddr, y_dma.page_count, -+ &dma->map[0], FOLL_FORCE); - uv_pages = 0; /* silence gcc. value is set and consumed only if: */ - if (y_pages == y_dma.page_count) { - uv_pages = get_user_pages_unlocked(current, current->mm, -- uv_dma.uaddr, uv_dma.page_count, 0, 1, -- &dma->map[y_pages]); -+ uv_dma.uaddr, uv_dma.page_count, -+ &dma->map[y_pages], FOLL_FORCE); - } - - if (y_pages != y_dma.page_count || uv_pages != uv_dma.page_count) { -diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c -index 70c28d19ea04..596359576109 100644 ---- a/drivers/media/platform/omap/omap_vout.c -+++ b/drivers/media/platform/omap/omap_vout.c -@@ -214,7 +214,7 @@ static int omap_vout_get_userptr(struct videobuf_buffer *vb, u32 virtp, - if (!vec) - return -ENOMEM; - -- ret = get_vaddr_frames(virtp, 1, true, false, vec); -+ ret = get_vaddr_frames(virtp, 1, FOLL_WRITE, vec); - if (ret != 1) { - frame_vector_destroy(vec); - return -EINVAL; -diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c -index f669cedca8bd..f74a74d91b9e 100644 ---- a/drivers/media/v4l2-core/videobuf-dma-sg.c -+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c -@@ -156,6 +156,7 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma, - { - unsigned long first, last; - int err, rw = 0; -+ unsigned int flags = FOLL_FORCE; - - dma->direction = direction; - switch (dma->direction) { -@@ -178,13 +179,15 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma, - if (NULL == dma->pages) - return -ENOMEM; - -+ if (rw == READ) -+ flags |= FOLL_WRITE; -+ - dprintk(1, "init user [0x%lx+0x%lx => %d pages]\n", - data, size, dma->nr_pages); - - err = get_user_pages(current, current->mm, - data & PAGE_MASK, dma->nr_pages, -- rw == READ, 1, /* force */ -- dma->pages, NULL); -+ flags, dma->pages, NULL); - - if (err != dma->nr_pages) { - dma->nr_pages = (err >= 0) ? err : 0; -diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c -index 3c3b517f1d1c..1cd322e939c7 100644 ---- a/drivers/media/v4l2-core/videobuf2-memops.c -+++ b/drivers/media/v4l2-core/videobuf2-memops.c -@@ -42,6 +42,10 @@ struct frame_vector *vb2_create_framevec(unsigned long start, - unsigned long first, last; - unsigned long nr; - struct frame_vector *vec; -+ unsigned int flags = FOLL_FORCE; -+ -+ if (write) -+ flags |= FOLL_WRITE; - - first = start >> PAGE_SHIFT; - last = (start + length - 1) >> PAGE_SHIFT; -@@ -49,7 +53,7 @@ struct frame_vector *vb2_create_framevec(unsigned long start, - vec = frame_vector_create(nr); - if (!vec) - return ERR_PTR(-ENOMEM); -- ret = get_vaddr_frames(start & PAGE_MASK, nr, write, true, vec); -+ ret = get_vaddr_frames(start & PAGE_MASK, nr, flags, vec); - if (ret < 0) - goto out_destroy; - /* We accept only complete set of PFNs */ -diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c -index 8bd63128d536..71c69e1c4ac0 100644 ---- a/drivers/misc/mic/scif/scif_rma.c -+++ b/drivers/misc/mic/scif/scif_rma.c -@@ -1398,8 +1398,7 @@ retry: - mm, - (u64)addr, - nr_pages, -- !!(prot & SCIF_PROT_WRITE), -- 0, -+ (prot & SCIF_PROT_WRITE) ? FOLL_WRITE : 0, - pinned_pages->pages, - NULL); - up_write(&mm->mmap_sem); -diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c -index f74fc0ca2ef9..e6b723c6a2af 100644 ---- a/drivers/misc/sgi-gru/grufault.c -+++ b/drivers/misc/sgi-gru/grufault.c -@@ -199,7 +199,7 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma, - *pageshift = PAGE_SHIFT; - #endif - if (get_user_pages -- (current, current->mm, vaddr, 1, write, 0, &page, NULL) <= 0) -+ (current, current->mm, vaddr, 1, write ? FOLL_WRITE : 0, &page, NULL) <= 0) - return -EFAULT; - *paddr = page_to_phys(page); - put_page(page); -diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c -index 16baaafed26c..cbdeb54eab51 100644 ---- a/drivers/net/ethernet/cavium/thunder/nic_main.c -+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c -@@ -1090,6 +1090,9 @@ static void nic_remove(struct pci_dev *pdev) - { - struct nicpf *nic = pci_get_drvdata(pdev); - -+ if (!nic) -+ return; -+ - if (nic->flags & NIC_SRIOV_ENABLED) - pci_disable_sriov(pdev); - -diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c -index 253f8ed0537a..60c727b0b7ab 100644 ---- a/drivers/net/ethernet/hisilicon/hip04_eth.c -+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c -@@ -919,10 +919,8 @@ static int hip04_mac_probe(struct platform_device *pdev) - } - - ret = register_netdev(ndev); -- if (ret) { -- free_netdev(ndev); -+ if (ret) - goto alloc_fail; -- } - - return 0; - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index ffd2e74e5638..dcd718ce13d5 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -1429,7 +1429,9 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw, - *autoneg = false; - - if (hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core0 || -- hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1) { -+ hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1 || -+ hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core0 || -+ hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core1) { - *speed = IXGBE_LINK_SPEED_1GB_FULL; - return 0; - } -diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c -index deae10d7426d..9b588251f2a7 100644 ---- a/drivers/net/ethernet/realtek/8139cp.c -+++ b/drivers/net/ethernet/realtek/8139cp.c -@@ -578,6 +578,7 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance) - struct cp_private *cp; - int handled = 0; - u16 status; -+ u16 mask; - - if (unlikely(dev == NULL)) - return IRQ_NONE; -@@ -585,6 +586,10 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance) - - spin_lock(&cp->lock); - -+ mask = cpr16(IntrMask); -+ if (!mask) -+ goto out_unlock; -+ - status = cpr16(IntrStatus); - if (!status || (status == 0xFFFF)) - goto out_unlock; -diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c -index 3920c3eb6006..df6063faad2e 100644 ---- a/drivers/net/ethernet/rocker/rocker.c -+++ b/drivers/net/ethernet/rocker/rocker.c -@@ -821,37 +821,49 @@ static int rocker_tlv_put(struct rocker_desc_info *desc_info, - static int rocker_tlv_put_u8(struct rocker_desc_info *desc_info, - int attrtype, u8 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value); -+ u8 tmp = value; /* work around GCC PR81715 */ -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp); - } - - static int rocker_tlv_put_u16(struct rocker_desc_info *desc_info, - int attrtype, u16 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value); -+ u16 tmp = value; -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp); - } - - static int rocker_tlv_put_be16(struct rocker_desc_info *desc_info, - int attrtype, __be16 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value); -+ __be16 tmp = value; -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp); - } - - static int rocker_tlv_put_u32(struct rocker_desc_info *desc_info, - int attrtype, u32 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value); -+ u32 tmp = value; -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp); - } - - static int rocker_tlv_put_be32(struct rocker_desc_info *desc_info, - int attrtype, __be32 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value); -+ __be32 tmp = value; -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp); - } - - static int rocker_tlv_put_u64(struct rocker_desc_info *desc_info, - int attrtype, u64 value) - { -- return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value); -+ u64 tmp = value; -+ -+ return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp); - } - - static struct rocker_tlv * -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 1f2f25a71d18..70f26b30729c 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1265,20 +1265,17 @@ static int gen10g_resume(struct phy_device *phydev) - - static int __set_phy_supported(struct phy_device *phydev, u32 max_speed) - { -- phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES | -- PHY_10BT_FEATURES); -- - switch (max_speed) { -- default: -- return -ENOTSUPP; -- case SPEED_1000: -- phydev->supported |= PHY_1000BT_FEATURES; -+ case SPEED_10: -+ phydev->supported &= ~PHY_100BT_FEATURES; - /* fall through */ - case SPEED_100: -- phydev->supported |= PHY_100BT_FEATURES; -- /* fall through */ -- case SPEED_10: -- phydev->supported |= PHY_10BT_FEATURES; -+ phydev->supported &= ~PHY_1000BT_FEATURES; -+ break; -+ case SPEED_1000: -+ break; -+ default: -+ return -ENOTSUPP; - } - - return 0; -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 5ac0b850d6b1..fd9ff9eff237 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1475,9 +1475,9 @@ static void tun_setup(struct net_device *dev) - */ - static int tun_validate(struct nlattr *tb[], struct nlattr *data[]) - { -- if (!data) -- return 0; -- return -EINVAL; -+ /* NL_SET_ERR_MSG(extack, -+ "tun/tap creation via rtnetlink is not supported."); */ -+ return -EOPNOTSUPP; - } - - static struct rtnl_link_ops tun_link_ops __read_mostly = { -diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c -index 6ed26baca0e5..7af8479acb98 100644 ---- a/drivers/net/wireless/ath/wil6210/wmi.c -+++ b/drivers/net/wireless/ath/wil6210/wmi.c -@@ -1035,8 +1035,14 @@ int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie) - }; - int rc; - u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len; -- struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL); -+ struct wmi_set_appie_cmd *cmd; - -+ if (len < ie_len) { -+ rc = -EINVAL; -+ goto out; -+ } -+ -+ cmd = kzalloc(len, GFP_KERNEL); - if (!cmd) { - rc = -ENOMEM; - goto out; -diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c -index 03054c0e7689..3c3e8115f73d 100644 ---- a/drivers/scsi/sr_ioctl.c -+++ b/drivers/scsi/sr_ioctl.c -@@ -187,30 +187,25 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc) - struct scsi_device *SDev; - struct scsi_sense_hdr sshdr; - int result, err = 0, retries = 0; -- struct request_sense *sense = cgc->sense; -+ unsigned char sense_buffer[SCSI_SENSE_BUFFERSIZE]; - - SDev = cd->device; - -- if (!sense) { -- sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL); -- if (!sense) { -- err = -ENOMEM; -- goto out; -- } -- } -- - retry: - if (!scsi_block_when_processing_errors(SDev)) { - err = -ENODEV; - goto out; - } - -- memset(sense, 0, sizeof(*sense)); -+ memset(sense_buffer, 0, sizeof(sense_buffer)); - result = scsi_execute(SDev, cgc->cmd, cgc->data_direction, -- cgc->buffer, cgc->buflen, (char *)sense, -+ cgc->buffer, cgc->buflen, sense_buffer, - cgc->timeout, IOCTL_RETRIES, 0, NULL); - -- scsi_normalize_sense((char *)sense, sizeof(*sense), &sshdr); -+ scsi_normalize_sense(sense_buffer, sizeof(sense_buffer), &sshdr); -+ -+ if (cgc->sense) -+ memcpy(cgc->sense, sense_buffer, sizeof(*cgc->sense)); - - /* Minimal error checking. Ignore cases we know about, and report the rest. */ - if (driver_byte(result) != 0) { -@@ -261,8 +256,6 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc) - - /* Wake up a process waiting for device */ - out: -- if (!cgc->sense) -- kfree(sense); - cgc->stat = err; - return err; - } -diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c -index 2e522951b619..088a68ab4246 100644 ---- a/drivers/scsi/st.c -+++ b/drivers/scsi/st.c -@@ -4821,9 +4821,8 @@ static int sgl_map_user_pages(struct st_buffer *STbp, - current->mm, - uaddr, - nr_pages, -- rw == READ, -- 0, /* don't force */ -- pages); -+ pages, -+ rw == READ ? FOLL_WRITE : 0); /* don't force */ - - /* Errors and no page mapped should return here */ - if (res < nr_pages) -diff --git a/drivers/staging/rdma/hfi1/user_pages.c b/drivers/staging/rdma/hfi1/user_pages.c -index 9071afbd7bf4..b776b74d3d14 100644 ---- a/drivers/staging/rdma/hfi1/user_pages.c -+++ b/drivers/staging/rdma/hfi1/user_pages.c -@@ -85,7 +85,7 @@ static int __hfi1_get_user_pages(unsigned long start_page, size_t num_pages, - for (got = 0; got < num_pages; got += ret) { - ret = get_user_pages(current, current->mm, - start_page + got * PAGE_SIZE, -- num_pages - got, 1, 1, -+ num_pages - got, FOLL_WRITE | FOLL_FORCE, - p + got, NULL); - if (ret < 0) - goto bail_release; -diff --git a/drivers/staging/rdma/ipath/ipath_user_pages.c b/drivers/staging/rdma/ipath/ipath_user_pages.c -index d29b4daf61f8..f69ec728e0de 100644 ---- a/drivers/staging/rdma/ipath/ipath_user_pages.c -+++ b/drivers/staging/rdma/ipath/ipath_user_pages.c -@@ -72,7 +72,7 @@ static int __ipath_get_user_pages(unsigned long start_page, size_t num_pages, - for (got = 0; got < num_pages; got += ret) { - ret = get_user_pages(current, current->mm, - start_page + got * PAGE_SIZE, -- num_pages - got, 1, 1, -+ num_pages - got, FOLL_WRITE | FOLL_FORCE, - p + got, NULL); - if (ret < 0) - goto bail_release; -diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c -index 06ef26872462..52aed7cfeb24 100644 ---- a/drivers/staging/speakup/kobjects.c -+++ b/drivers/staging/speakup/kobjects.c -@@ -387,7 +387,7 @@ static ssize_t synth_store(struct kobject *kobj, struct kobj_attribute *attr, - len = strlen(buf); - if (len < 2 || len > 9) - return -EINVAL; -- strncpy(new_synth_name, buf, len); -+ memcpy(new_synth_name, buf, len); - if (new_synth_name[len - 1] == '\n') - len--; - new_synth_name[len] = '\0'; -@@ -514,7 +514,7 @@ static ssize_t punc_store(struct kobject *kobj, struct kobj_attribute *attr, - return -EINVAL; - } - -- strncpy(punc_buf, buf, x); -+ memcpy(punc_buf, buf, x); - - while (x && punc_buf[x - 1] == '\n') - x--; -diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c -index 9b7d39484ed3..d1ed92acafa3 100644 ---- a/drivers/usb/gadget/udc/omap_udc.c -+++ b/drivers/usb/gadget/udc/omap_udc.c -@@ -2037,6 +2037,7 @@ static inline int machine_without_vbus_sense(void) - { - return machine_is_omap_innovator() - || machine_is_omap_osk() -+ || machine_is_omap_palmte() - || machine_is_sx1() - /* No known omap7xx boards with vbus sense */ - || cpu_is_omap7xx(); -@@ -2045,7 +2046,7 @@ static inline int machine_without_vbus_sense(void) - static int omap_udc_start(struct usb_gadget *g, - struct usb_gadget_driver *driver) - { -- int status = -ENODEV; -+ int status; - struct omap_ep *ep; - unsigned long flags; - -@@ -2083,6 +2084,7 @@ static int omap_udc_start(struct usb_gadget *g, - goto done; - } - } else { -+ status = 0; - if (can_pullup(udc)) - pullup_enable(udc); - else -@@ -2612,9 +2614,22 @@ omap_ep_setup(char *name, u8 addr, u8 type, - - static void omap_udc_release(struct device *dev) - { -- complete(udc->done); -+ pullup_disable(udc); -+ if (!IS_ERR_OR_NULL(udc->transceiver)) { -+ usb_put_phy(udc->transceiver); -+ udc->transceiver = NULL; -+ } -+ omap_writew(0, UDC_SYSCON1); -+ remove_proc_file(); -+ if (udc->dc_clk) { -+ if (udc->clk_requested) -+ omap_udc_enable_clock(0); -+ clk_put(udc->hhc_clk); -+ clk_put(udc->dc_clk); -+ } -+ if (udc->done) -+ complete(udc->done); - kfree(udc); -- udc = NULL; - } - - static int -@@ -2886,8 +2901,8 @@ bad_on_1710: - udc->clr_halt = UDC_RESET_EP; - - /* USB general purpose IRQ: ep0, state changes, dma, etc */ -- status = request_irq(pdev->resource[1].start, omap_udc_irq, -- 0, driver_name, udc); -+ status = devm_request_irq(&pdev->dev, pdev->resource[1].start, -+ omap_udc_irq, 0, driver_name, udc); - if (status != 0) { - ERR("can't get irq %d, err %d\n", - (int) pdev->resource[1].start, status); -@@ -2895,20 +2910,20 @@ bad_on_1710: - } - - /* USB "non-iso" IRQ (PIO for all but ep0) */ -- status = request_irq(pdev->resource[2].start, omap_udc_pio_irq, -- 0, "omap_udc pio", udc); -+ status = devm_request_irq(&pdev->dev, pdev->resource[2].start, -+ omap_udc_pio_irq, 0, "omap_udc pio", udc); - if (status != 0) { - ERR("can't get irq %d, err %d\n", - (int) pdev->resource[2].start, status); -- goto cleanup2; -+ goto cleanup1; - } - #ifdef USE_ISO -- status = request_irq(pdev->resource[3].start, omap_udc_iso_irq, -- 0, "omap_udc iso", udc); -+ status = devm_request_irq(&pdev->dev, pdev->resource[3].start, -+ omap_udc_iso_irq, 0, "omap_udc iso", udc); - if (status != 0) { - ERR("can't get irq %d, err %d\n", - (int) pdev->resource[3].start, status); -- goto cleanup3; -+ goto cleanup1; - } - #endif - if (cpu_is_omap16xx() || cpu_is_omap7xx()) { -@@ -2919,23 +2934,8 @@ bad_on_1710: - } - - create_proc_file(); -- status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget, -- omap_udc_release); -- if (status) -- goto cleanup4; -- -- return 0; -- --cleanup4: -- remove_proc_file(); -- --#ifdef USE_ISO --cleanup3: -- free_irq(pdev->resource[2].start, udc); --#endif -- --cleanup2: -- free_irq(pdev->resource[1].start, udc); -+ return usb_add_gadget_udc_release(&pdev->dev, &udc->gadget, -+ omap_udc_release); - - cleanup1: - kfree(udc); -@@ -2962,42 +2962,15 @@ static int omap_udc_remove(struct platform_device *pdev) - { - DECLARE_COMPLETION_ONSTACK(done); - -- if (!udc) -- return -ENODEV; -- -- usb_del_gadget_udc(&udc->gadget); -- if (udc->driver) -- return -EBUSY; -- - udc->done = &done; - -- pullup_disable(udc); -- if (!IS_ERR_OR_NULL(udc->transceiver)) { -- usb_put_phy(udc->transceiver); -- udc->transceiver = NULL; -- } -- omap_writew(0, UDC_SYSCON1); -- -- remove_proc_file(); -- --#ifdef USE_ISO -- free_irq(pdev->resource[3].start, udc); --#endif -- free_irq(pdev->resource[2].start, udc); -- free_irq(pdev->resource[1].start, udc); -+ usb_del_gadget_udc(&udc->gadget); - -- if (udc->dc_clk) { -- if (udc->clk_requested) -- omap_udc_enable_clock(0); -- clk_put(udc->hhc_clk); -- clk_put(udc->dc_clk); -- } -+ wait_for_completion(&done); - - release_mem_region(pdev->resource[0].start, - pdev->resource[0].end - pdev->resource[0].start + 1); - -- wait_for_completion(&done); -- - return 0; - } - -diff --git a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c -index 195ad7cac1ba..68fa037d8cbc 100644 ---- a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c -+++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c -@@ -372,7 +372,7 @@ static int Ti3026_init(struct matrox_fb_info *minfo, struct my_timming *m) - - DBG(__func__) - -- memcpy(hw->DACreg, MGADACbpp32, sizeof(hw->DACreg)); -+ memcpy(hw->DACreg, MGADACbpp32, sizeof(MGADACbpp32)); - switch (minfo->fbcon.var.bits_per_pixel) { - case 4: hw->DACreg[POS3026_XLATCHCTRL] = TVP3026_XLATCHCTRL_16_1; /* or _8_1, they are same */ - hw->DACreg[POS3026_XTRUECOLORCTRL] = TVP3026_XTRUECOLORCTRL_PSEUDOCOLOR; -diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c -index 0e24eb9c219c..750a384bf191 100644 ---- a/drivers/video/fbdev/pvr2fb.c -+++ b/drivers/video/fbdev/pvr2fb.c -@@ -687,7 +687,7 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf, - return -ENOMEM; - - ret = get_user_pages_unlocked(current, current->mm, (unsigned long)buf, -- nr_pages, WRITE, 0, pages); -+ nr_pages, pages, FOLL_WRITE); - - if (ret < nr_pages) { - nr_pages = ret; -diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c -index 32c8fc5f7a5c..590a0f51a249 100644 ---- a/drivers/virt/fsl_hypervisor.c -+++ b/drivers/virt/fsl_hypervisor.c -@@ -246,8 +246,8 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - down_read(¤t->mm->mmap_sem); - num_pinned = get_user_pages(current, current->mm, - param.local_vaddr - lb_offset, num_pages, -- (param.source == -1) ? READ : WRITE, -- 0, pages, NULL); -+ (param.source == -1) ? 0 : FOLL_WRITE, -+ pages, NULL); - up_read(¤t->mm->mmap_sem); - - if (num_pinned != num_pages) { -diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c -index 5063c5e796b7..84a1fab0dd6b 100644 ---- a/drivers/xen/xlate_mmu.c -+++ b/drivers/xen/xlate_mmu.c -@@ -34,6 +34,7 @@ - #include - - #include -+#include - #include - #include - #include -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index 83c73738165e..40d1ab957fb6 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -3232,7 +3232,8 @@ static void free_pending_move(struct send_ctx *sctx, struct pending_dir_move *m) - kfree(m); - } - --static void tail_append_pending_moves(struct pending_dir_move *moves, -+static void tail_append_pending_moves(struct send_ctx *sctx, -+ struct pending_dir_move *moves, - struct list_head *stack) - { - if (list_empty(&moves->list)) { -@@ -3243,6 +3244,10 @@ static void tail_append_pending_moves(struct pending_dir_move *moves, - list_add_tail(&moves->list, stack); - list_splice_tail(&list, stack); - } -+ if (!RB_EMPTY_NODE(&moves->node)) { -+ rb_erase(&moves->node, &sctx->pending_dir_moves); -+ RB_CLEAR_NODE(&moves->node); -+ } - } - - static int apply_children_dir_moves(struct send_ctx *sctx) -@@ -3257,7 +3262,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx) - return 0; - - INIT_LIST_HEAD(&stack); -- tail_append_pending_moves(pm, &stack); -+ tail_append_pending_moves(sctx, pm, &stack); - - while (!list_empty(&stack)) { - pm = list_first_entry(&stack, struct pending_dir_move, list); -@@ -3268,7 +3273,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx) - goto out; - pm = get_pending_dir_moves(sctx, parent_ino); - if (pm) -- tail_append_pending_moves(pm, &stack); -+ tail_append_pending_moves(sctx, pm, &stack); - } - return 0; - -diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c -index 5b68cf526887..c05ab2ec0fef 100644 ---- a/fs/cachefiles/rdwr.c -+++ b/fs/cachefiles/rdwr.c -@@ -963,11 +963,8 @@ error: - void cachefiles_uncache_page(struct fscache_object *_object, struct page *page) - { - struct cachefiles_object *object; -- struct cachefiles_cache *cache; - - object = container_of(_object, struct cachefiles_object, fscache); -- cache = container_of(object->fscache.cache, -- struct cachefiles_cache, cache); - - _enter("%p,{%lu}", object, page->index); - -diff --git a/fs/exec.c b/fs/exec.c -index 910fc70c4542..3dad755b7048 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -191,6 +191,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - { - struct page *page; - int ret; -+ unsigned int gup_flags = FOLL_FORCE; - - #ifdef CONFIG_STACK_GROWSUP - if (write) { -@@ -199,8 +200,12 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - return NULL; - } - #endif -- ret = get_user_pages(current, bprm->mm, pos, -- 1, write, 1, &page, NULL); -+ -+ if (write) -+ gup_flags |= FOLL_WRITE; -+ -+ ret = get_user_pages(current, bprm->mm, pos, 1, gup_flags, -+ &page, NULL); - if (ret <= 0) - return NULL; - -diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c -index 714cd37a6ba3..6599c6124552 100644 ---- a/fs/exportfs/expfs.c -+++ b/fs/exportfs/expfs.c -@@ -76,7 +76,7 @@ static bool dentry_connected(struct dentry *dentry) - struct dentry *parent = dget_parent(dentry); - - dput(dentry); -- if (IS_ROOT(dentry)) { -+ if (dentry == parent) { - dput(parent); - return false; - } -diff --git a/fs/fscache/object.c b/fs/fscache/object.c -index 7a182c87f378..ab1d7f35f6c2 100644 ---- a/fs/fscache/object.c -+++ b/fs/fscache/object.c -@@ -715,6 +715,9 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob - - if (awaken) - wake_up_bit(&cookie->flags, FSCACHE_COOKIE_INVALIDATING); -+ if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags)) -+ wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP); -+ - - /* Prevent a race with our last child, which has to signal EV_CLEARED - * before dropping our spinlock. -diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c -index 1ab19e660e69..1ff5774a5382 100644 ---- a/fs/hfs/btree.c -+++ b/fs/hfs/btree.c -@@ -328,13 +328,14 @@ void hfs_bmap_free(struct hfs_bnode *node) - - nidx -= len * 8; - i = node->next; -- hfs_bnode_put(node); - if (!i) { - /* panic */; - pr_crit("unable to free bnode %u. bmap not found!\n", - node->this); -+ hfs_bnode_put(node); - return; - } -+ hfs_bnode_put(node); - node = hfs_bnode_find(tree, i); - if (IS_ERR(node)) - return; -diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c -index 3345c7553edc..7adc8a327e03 100644 ---- a/fs/hfsplus/btree.c -+++ b/fs/hfsplus/btree.c -@@ -453,14 +453,15 @@ void hfs_bmap_free(struct hfs_bnode *node) - - nidx -= len * 8; - i = node->next; -- hfs_bnode_put(node); - if (!i) { - /* panic */; - pr_crit("unable to free bnode %u. " - "bmap not found!\n", - node->this); -+ hfs_bnode_put(node); - return; - } -+ hfs_bnode_put(node); - node = hfs_bnode_find(tree, i); - if (IS_ERR(node)) - return; -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index a17da8b57fc6..ab34f613fa85 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -118,6 +118,16 @@ static void huge_pagevec_release(struct pagevec *pvec) - pagevec_reinit(pvec); - } - -+/* -+ * Mask used when checking the page offset value passed in via system -+ * calls. This value will be converted to a loff_t which is signed. -+ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the -+ * value. The extra bit (- 1 in the shift value) is to take the sign -+ * bit into account. -+ */ -+#define PGOFF_LOFFT_MAX \ -+ (((1UL << (PAGE_SHIFT + 1)) - 1) << (BITS_PER_LONG - (PAGE_SHIFT + 1))) -+ - static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) - { - struct inode *inode = file_inode(file); -@@ -136,17 +146,31 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) - vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND; - vma->vm_ops = &hugetlb_vm_ops; - -+ /* -+ * page based offset in vm_pgoff could be sufficiently large to -+ * overflow a loff_t when converted to byte offset. This can -+ * only happen on architectures where sizeof(loff_t) == -+ * sizeof(unsigned long). So, only check in those instances. -+ */ -+ if (sizeof(unsigned long) == sizeof(loff_t)) { -+ if (vma->vm_pgoff & PGOFF_LOFFT_MAX) -+ return -EINVAL; -+ } -+ -+ /* must be huge page aligned */ - if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT)) - return -EINVAL; - - vma_len = (loff_t)(vma->vm_end - vma->vm_start); -+ len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); -+ /* check for overflow */ -+ if (len < vma_len) -+ return -EINVAL; - - mutex_lock(&inode->i_mutex); - file_accessed(file); - - ret = -ENOMEM; -- len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); -- - if (hugetlb_reserve_pages(inode, - vma->vm_pgoff >> huge_page_order(h), - len >> huge_page_shift(h), vma, -@@ -155,7 +179,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) - - ret = 0; - if (vma->vm_flags & VM_WRITE && inode->i_size < len) -- inode->i_size = len; -+ i_size_write(inode, len); - out: - mutex_unlock(&inode->i_mutex); - -diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c -index 827fc9809bc2..3494e220b510 100644 ---- a/fs/ocfs2/export.c -+++ b/fs/ocfs2/export.c -@@ -125,10 +125,10 @@ check_err: - - check_gen: - if (handle->ih_generation != inode->i_generation) { -- iput(inode); - trace_ocfs2_get_dentry_generation((unsigned long long)blkno, - handle->ih_generation, - inode->i_generation); -+ iput(inode); - result = ERR_PTR(-ESTALE); - goto bail; - } -diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c -index 124471d26a73..c1a83c58456e 100644 ---- a/fs/ocfs2/move_extents.c -+++ b/fs/ocfs2/move_extents.c -@@ -156,18 +156,14 @@ out: - } - - /* -- * lock allocators, and reserving appropriate number of bits for -- * meta blocks and data clusters. -- * -- * in some cases, we don't need to reserve clusters, just let data_ac -- * be NULL. -+ * lock allocator, and reserve appropriate number of bits for -+ * meta blocks. - */ --static int ocfs2_lock_allocators_move_extents(struct inode *inode, -+static int ocfs2_lock_meta_allocator_move_extents(struct inode *inode, - struct ocfs2_extent_tree *et, - u32 clusters_to_move, - u32 extents_to_split, - struct ocfs2_alloc_context **meta_ac, -- struct ocfs2_alloc_context **data_ac, - int extra_blocks, - int *credits) - { -@@ -192,13 +188,6 @@ static int ocfs2_lock_allocators_move_extents(struct inode *inode, - goto out; - } - -- if (data_ac) { -- ret = ocfs2_reserve_clusters(osb, clusters_to_move, data_ac); -- if (ret) { -- mlog_errno(ret); -- goto out; -- } -- } - - *credits += ocfs2_calc_extend_credits(osb->sb, et->et_root_el); - -@@ -260,10 +249,10 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context, - } - } - -- ret = ocfs2_lock_allocators_move_extents(inode, &context->et, *len, 1, -- &context->meta_ac, -- &context->data_ac, -- extra_blocks, &credits); -+ ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et, -+ *len, 1, -+ &context->meta_ac, -+ extra_blocks, &credits); - if (ret) { - mlog_errno(ret); - goto out; -@@ -286,6 +275,21 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context, - } - } - -+ /* -+ * Make sure ocfs2_reserve_cluster is called after -+ * __ocfs2_flush_truncate_log, otherwise, dead lock may happen. -+ * -+ * If ocfs2_reserve_cluster is called -+ * before __ocfs2_flush_truncate_log, dead lock on global bitmap -+ * may happen. -+ * -+ */ -+ ret = ocfs2_reserve_clusters(osb, *len, &context->data_ac); -+ if (ret) { -+ mlog_errno(ret); -+ goto out_unlock_mutex; -+ } -+ - handle = ocfs2_start_trans(osb, credits); - if (IS_ERR(handle)) { - ret = PTR_ERR(handle); -@@ -606,9 +610,10 @@ static int ocfs2_move_extent(struct ocfs2_move_extents_context *context, - } - } - -- ret = ocfs2_lock_allocators_move_extents(inode, &context->et, len, 1, -- &context->meta_ac, -- NULL, extra_blocks, &credits); -+ ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et, -+ len, 1, -+ &context->meta_ac, -+ extra_blocks, &credits); - if (ret) { - mlog_errno(ret); - goto out; -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 4beed301e224..bd8c26a409a7 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -254,7 +254,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, - * Inherently racy -- command line shares address space - * with code and data. - */ -- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); -+ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); - if (rv <= 0) - goto out_free_page; - -@@ -272,7 +272,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, - int nr_read; - - _count = min3(count, len, PAGE_SIZE); -- nr_read = access_remote_vm(mm, p, page, _count, 0); -+ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); - if (nr_read < 0) - rv = nr_read; - if (nr_read <= 0) -@@ -307,7 +307,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, - bool final; - - _count = min3(count, len, PAGE_SIZE); -- nr_read = access_remote_vm(mm, p, page, _count, 0); -+ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); - if (nr_read < 0) - rv = nr_read; - if (nr_read <= 0) -@@ -356,7 +356,7 @@ skip_argv: - bool final; - - _count = min3(count, len, PAGE_SIZE); -- nr_read = access_remote_vm(mm, p, page, _count, 0); -+ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); - if (nr_read < 0) - rv = nr_read; - if (nr_read <= 0) -@@ -868,6 +868,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf, - unsigned long addr = *ppos; - ssize_t copied; - char *page; -+ unsigned int flags; - - if (!mm) - return 0; -@@ -880,6 +881,11 @@ static ssize_t mem_rw(struct file *file, char __user *buf, - if (!atomic_inc_not_zero(&mm->mm_users)) - goto free; - -+ /* Maybe we should limit FOLL_FORCE to actual ptrace users? */ -+ flags = FOLL_FORCE; -+ if (write) -+ flags |= FOLL_WRITE; -+ - while (count > 0) { - int this_len = min_t(int, count, PAGE_SIZE); - -@@ -888,7 +894,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf, - break; - } - -- this_len = access_remote_vm(mm, addr, page, this_len, write); -+ this_len = access_remote_vm(mm, addr, page, this_len, flags); - if (!this_len) { - if (!copied) - copied = -EIO; -@@ -1000,8 +1006,7 @@ static ssize_t environ_read(struct file *file, char __user *buf, - max_len = min_t(size_t, PAGE_SIZE, count); - this_len = min(max_len, this_len); - -- retval = access_remote_vm(mm, (env_start + src), -- page, this_len, 0); -+ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); - - if (retval <= 0) { - ret = retval; -diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c -index 588461bb2dd4..e97e7d74e134 100644 ---- a/fs/pstore/platform.c -+++ b/fs/pstore/platform.c -@@ -392,8 +392,8 @@ static void pstore_console_write(struct console *con, const char *s, unsigned c) - } else { - spin_lock_irqsave(&psinfo->buf_lock, flags); - } -- memcpy(psinfo->buf, s, c); -- psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, 0, 0, c, psinfo); -+ psinfo->write_buf(PSTORE_TYPE_CONSOLE, 0, &id, 0, -+ s, 0, c, psinfo); - spin_unlock_irqrestore(&psinfo->buf_lock, flags); - s += c; - c = e - s; -diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c -index 02fa1dcc5969..29f5b2e589a1 100644 ---- a/fs/sysv/inode.c -+++ b/fs/sysv/inode.c -@@ -275,7 +275,7 @@ static int __sysv_write_inode(struct inode *inode, int wait) - } - } - brelse(bh); -- return 0; -+ return err; - } - - int sysv_write_inode(struct inode *inode, struct writeback_control *wbc) -diff --git a/include/linux/mm.h b/include/linux/mm.h -index d4e8077fca96..251adf4d8a71 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1191,7 +1191,7 @@ static inline int fixup_user_fault(struct task_struct *tsk, - - extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write); - extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, -- void *buf, int len, int write); -+ void *buf, int len, unsigned int gup_flags); - - long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -@@ -1199,19 +1199,17 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, - struct vm_area_struct **vmas, int *nonblocking); - long get_user_pages(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -+ unsigned int gup_flags, struct page **pages, - struct vm_area_struct **vmas); - long get_user_pages_locked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -- int *locked); -+ unsigned int gup_flags, struct page **pages, int *locked); - long __get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -- unsigned int gup_flags); -+ struct page **pages, unsigned int gup_flags); - long get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages); -+ struct page **pages, unsigned int gup_flags); - int get_user_pages_fast(unsigned long start, int nr_pages, int write, - struct page **pages); - -@@ -1229,7 +1227,7 @@ struct frame_vector { - struct frame_vector *frame_vector_create(unsigned int nr_frames); - void frame_vector_destroy(struct frame_vector *vec); - int get_vaddr_frames(unsigned long start, unsigned int nr_pfns, -- bool write, bool force, struct frame_vector *vec); -+ unsigned int gup_flags, struct frame_vector *vec); - void put_vaddr_frames(struct frame_vector *vec); - int frame_vector_to_pages(struct frame_vector *vec); - void frame_vector_to_pfns(struct frame_vector *vec); -@@ -2122,6 +2120,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma, - #define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */ - #define FOLL_MLOCK 0x1000 /* lock present pages */ - #define FOLL_COW 0x4000 /* internal GUP flag */ -+#define FOLL_ANON 0x8000 /* don't do file mappings */ - - typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, - void *data); -diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h -index 907f3fd191ac..3e28a1a8d823 100644 ---- a/include/linux/posix-timers.h -+++ b/include/linux/posix-timers.h -@@ -65,8 +65,8 @@ struct k_itimer { - spinlock_t it_lock; - clockid_t it_clock; /* which timer type */ - timer_t it_id; /* timer id */ -- int it_overrun; /* overrun on pending signal */ -- int it_overrun_last; /* overrun on last delivered signal */ -+ s64 it_overrun; /* overrun on pending signal */ -+ s64 it_overrun_last; /* overrun on last delivered signal */ - int it_requeue_pending; /* waiting to requeue this timer */ - #define REQUEUE_PENDING 1 - int it_sigev_notify; /* notify word of sigevent struct */ -diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index 8b683841e574..f6017ddc4ded 100644 ---- a/include/net/neighbour.h -+++ b/include/net/neighbour.h -@@ -448,6 +448,7 @@ static inline int neigh_hh_bridge(struct hh_cache *hh, struct sk_buff *skb) - - static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb) - { -+ unsigned int hh_alen = 0; - unsigned int seq; - int hh_len; - -@@ -455,16 +456,33 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb - seq = read_seqbegin(&hh->hh_lock); - hh_len = hh->hh_len; - if (likely(hh_len <= HH_DATA_MOD)) { -- /* this is inlined by gcc */ -- memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD); -+ hh_alen = HH_DATA_MOD; -+ -+ /* skb_push() would proceed silently if we have room for -+ * the unaligned size but not for the aligned size: -+ * check headroom explicitly. -+ */ -+ if (likely(skb_headroom(skb) >= HH_DATA_MOD)) { -+ /* this is inlined by gcc */ -+ memcpy(skb->data - HH_DATA_MOD, hh->hh_data, -+ HH_DATA_MOD); -+ } - } else { -- int hh_alen = HH_DATA_ALIGN(hh_len); -+ hh_alen = HH_DATA_ALIGN(hh_len); - -- memcpy(skb->data - hh_alen, hh->hh_data, hh_alen); -+ if (likely(skb_headroom(skb) >= hh_alen)) { -+ memcpy(skb->data - hh_alen, hh->hh_data, -+ hh_alen); -+ } - } - } while (read_seqretry(&hh->hh_lock, seq)); - -- skb_push(skb, hh_len); -+ if (WARN_ON_ONCE(skb_headroom(skb) < hh_alen)) { -+ kfree_skb(skb); -+ return NET_XMIT_DROP; -+ } -+ -+ __skb_push(skb, hh_len); - return dev_queue_xmit(skb); - } - -diff --git a/include/sound/pcm.h b/include/sound/pcm.h -index b0be09279943..ffc161906d36 100644 ---- a/include/sound/pcm.h -+++ b/include/sound/pcm.h -@@ -100,7 +100,7 @@ struct snd_pcm_ops { - #endif - - #define SNDRV_PCM_IOCTL1_RESET 0 --#define SNDRV_PCM_IOCTL1_INFO 1 -+/* 1 is absent slot. */ - #define SNDRV_PCM_IOCTL1_CHANNEL_INFO 2 - #define SNDRV_PCM_IOCTL1_GSTATE 3 - #define SNDRV_PCM_IOCTL1_FIFO_SIZE 4 -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 35dfa9e9d69e..c43ca9857479 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -191,6 +191,7 @@ struct bpf_insn_aux_data { - enum bpf_reg_type ptr_type; /* pointer type for load/store insns */ - struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */ - }; -+ int sanitize_stack_off; /* stack slot to be cleared */ - bool seen; /* this insn was processed by the verifier */ - }; - -@@ -569,10 +570,11 @@ static bool is_spillable_regtype(enum bpf_reg_type type) - /* check_stack_read/write functions track spill/fill of registers, - * stack boundary and alignment are checked in check_mem_access() - */ --static int check_stack_write(struct verifier_state *state, int off, int size, -- int value_regno) -+static int check_stack_write(struct verifier_env *env, -+ struct verifier_state *state, int off, -+ int size, int value_regno, int insn_idx) - { -- int i; -+ int i, spi = (MAX_BPF_STACK + off) / BPF_REG_SIZE; - /* caller checked that off % size == 0 and -MAX_BPF_STACK <= off < 0, - * so it's aligned access and [off, off + size) are within stack limits - */ -@@ -587,15 +589,37 @@ static int check_stack_write(struct verifier_state *state, int off, int size, - } - - /* save register state */ -- state->spilled_regs[(MAX_BPF_STACK + off) / BPF_REG_SIZE] = -- state->regs[value_regno]; -- -- for (i = 0; i < BPF_REG_SIZE; i++) -+ state->spilled_regs[spi] = state->regs[value_regno]; -+ -+ for (i = 0; i < BPF_REG_SIZE; i++) { -+ if (state->stack_slot_type[MAX_BPF_STACK + off + i] == STACK_MISC && -+ !env->allow_ptr_leaks) { -+ int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off; -+ int soff = (-spi - 1) * BPF_REG_SIZE; -+ -+ /* detected reuse of integer stack slot with a pointer -+ * which means either llvm is reusing stack slot or -+ * an attacker is trying to exploit CVE-2018-3639 -+ * (speculative store bypass) -+ * Have to sanitize that slot with preemptive -+ * store of zero. -+ */ -+ if (*poff && *poff != soff) { -+ /* disallow programs where single insn stores -+ * into two different stack slots, since verifier -+ * cannot sanitize them -+ */ -+ verbose("insn %d cannot access two stack slots fp%d and fp%d", -+ insn_idx, *poff, soff); -+ return -EINVAL; -+ } -+ *poff = soff; -+ } - state->stack_slot_type[MAX_BPF_STACK + off + i] = STACK_SPILL; -+ } - } else { - /* regular write of data into stack */ -- state->spilled_regs[(MAX_BPF_STACK + off) / BPF_REG_SIZE] = -- (struct reg_state) {}; -+ state->spilled_regs[spi] = (struct reg_state) {}; - - for (i = 0; i < size; i++) - state->stack_slot_type[MAX_BPF_STACK + off + i] = STACK_MISC; -@@ -696,7 +720,7 @@ static bool is_ctx_reg(struct verifier_env *env, int regno) - * if t==write && value_regno==-1, some unknown value is stored into memory - * if t==read && value_regno==-1, don't care what we read from memory - */ --static int check_mem_access(struct verifier_env *env, u32 regno, int off, -+static int check_mem_access(struct verifier_env *env, int insn_idx, u32 regno, int off, - int bpf_size, enum bpf_access_type t, - int value_regno) - { -@@ -748,7 +772,8 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off, - verbose("attempt to corrupt spilled pointer on stack\n"); - return -EACCES; - } -- err = check_stack_write(state, off, size, value_regno); -+ err = check_stack_write(env, state, off, size, -+ value_regno, insn_idx); - } else { - err = check_stack_read(state, off, size, value_regno); - } -@@ -760,7 +785,7 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off, - return err; - } - --static int check_xadd(struct verifier_env *env, struct bpf_insn *insn) -+static int check_xadd(struct verifier_env *env, int insn_idx, struct bpf_insn *insn) - { - struct reg_state *regs = env->cur_state.regs; - int err; -@@ -793,13 +818,13 @@ static int check_xadd(struct verifier_env *env, struct bpf_insn *insn) - } - - /* check whether atomic_add can read the memory */ -- err = check_mem_access(env, insn->dst_reg, insn->off, -+ err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_READ, -1); - if (err) - return err; - - /* check whether atomic_add can write into the same memory */ -- return check_mem_access(env, insn->dst_reg, insn->off, -+ return check_mem_access(env, insn_idx, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_WRITE, -1); - } - -@@ -1838,13 +1863,14 @@ static int do_check(struct verifier_env *env) - /* check that memory (src_reg + off) is readable, - * the state of dst_reg will be updated by this func - */ -- err = check_mem_access(env, insn->src_reg, insn->off, -+ err = check_mem_access(env, insn_idx, insn->src_reg, insn->off, - BPF_SIZE(insn->code), BPF_READ, - insn->dst_reg); - if (err) - return err; - -- if (BPF_SIZE(insn->code) != BPF_W) { -+ if (BPF_SIZE(insn->code) != BPF_W && -+ BPF_SIZE(insn->code) != BPF_DW) { - insn_idx++; - continue; - } -@@ -1876,7 +1902,7 @@ static int do_check(struct verifier_env *env) - enum bpf_reg_type *prev_dst_type, dst_reg_type; - - if (BPF_MODE(insn->code) == BPF_XADD) { -- err = check_xadd(env, insn); -+ err = check_xadd(env, insn_idx, insn); - if (err) - return err; - insn_idx++; -@@ -1895,7 +1921,7 @@ static int do_check(struct verifier_env *env) - dst_reg_type = regs[insn->dst_reg].type; - - /* check that memory (dst_reg + off) is writeable */ -- err = check_mem_access(env, insn->dst_reg, insn->off, -+ err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_WRITE, - insn->src_reg); - if (err) -@@ -1930,7 +1956,7 @@ static int do_check(struct verifier_env *env) - } - - /* check that memory (dst_reg + off) is writeable */ -- err = check_mem_access(env, insn->dst_reg, insn->off, -+ err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_WRITE, - -1); - if (err) -@@ -2220,13 +2246,43 @@ static int convert_ctx_accesses(struct verifier_env *env) - for (i = 0; i < insn_cnt; i++, insn++) { - u32 cnt; - -- if (insn->code == (BPF_LDX | BPF_MEM | BPF_W)) -+ if (insn->code == (BPF_LDX | BPF_MEM | BPF_W) || -+ insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) - type = BPF_READ; -- else if (insn->code == (BPF_STX | BPF_MEM | BPF_W)) -+ else if (insn->code == (BPF_STX | BPF_MEM | BPF_W) || -+ insn->code == (BPF_STX | BPF_MEM | BPF_DW)) - type = BPF_WRITE; - else - continue; - -+ if (type == BPF_WRITE && -+ env->insn_aux_data[i + delta].sanitize_stack_off) { -+ struct bpf_insn patch[] = { -+ /* Sanitize suspicious stack slot with zero. -+ * There are no memory dependencies for this store, -+ * since it's only using frame pointer and immediate -+ * constant of zero -+ */ -+ BPF_ST_MEM(BPF_DW, BPF_REG_FP, -+ env->insn_aux_data[i + delta].sanitize_stack_off, -+ 0), -+ /* the original STX instruction will immediately -+ * overwrite the same stack slot with appropriate value -+ */ -+ *insn, -+ }; -+ -+ cnt = ARRAY_SIZE(patch); -+ new_prog = bpf_patch_insn_data(env, i + delta, patch, cnt); -+ if (!new_prog) -+ return -ENOMEM; -+ -+ delta += cnt - 1; -+ env->prog = new_prog; -+ insn = new_prog->insnsi + i + delta; -+ continue; -+ } -+ - if (env->insn_aux_data[i + delta].ptr_type != PTR_TO_CTX) - continue; - -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index 7108097fa2f2..aad43c88a668 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -299,7 +299,7 @@ int uprobe_write_opcode(struct mm_struct *mm, unsigned long vaddr, - - retry: - /* Read the page with vaddr into memory */ -- ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &old_page, &vma); -+ ret = get_user_pages(NULL, mm, vaddr, 1, FOLL_FORCE, &old_page, &vma); - if (ret <= 0) - return ret; - -@@ -1700,7 +1700,7 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr) - if (likely(result == 0)) - goto out; - -- result = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL); -+ result = get_user_pages(NULL, mm, vaddr, 1, FOLL_FORCE, &page, NULL); - if (result < 0) - return result; - -diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c -index 80016b329d94..8fc68e60c795 100644 ---- a/kernel/time/posix-cpu-timers.c -+++ b/kernel/time/posix-cpu-timers.c -@@ -103,7 +103,7 @@ static void bump_cpu_timer(struct k_itimer *timer, - continue; - - timer->it.cpu.expires += incr; -- timer->it_overrun += 1 << i; -+ timer->it_overrun += 1LL << i; - delta -= incr; - } - } -diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c -index fc7c37ad90a0..0e6ed2e7d066 100644 ---- a/kernel/time/posix-timers.c -+++ b/kernel/time/posix-timers.c -@@ -355,6 +355,17 @@ static __init int init_posix_timers(void) - - __initcall(init_posix_timers); - -+/* -+ * The siginfo si_overrun field and the return value of timer_getoverrun(2) -+ * are of type int. Clamp the overrun value to INT_MAX -+ */ -+static inline int timer_overrun_to_int(struct k_itimer *timr, int baseval) -+{ -+ s64 sum = timr->it_overrun_last + (s64)baseval; -+ -+ return sum > (s64)INT_MAX ? INT_MAX : (int)sum; -+} -+ - static void schedule_next_timer(struct k_itimer *timr) - { - struct hrtimer *timer = &timr->it.real.timer; -@@ -362,12 +373,11 @@ static void schedule_next_timer(struct k_itimer *timr) - if (timr->it.real.interval.tv64 == 0) - return; - -- timr->it_overrun += (unsigned int) hrtimer_forward(timer, -- timer->base->get_time(), -- timr->it.real.interval); -+ timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(), -+ timr->it.real.interval); - - timr->it_overrun_last = timr->it_overrun; -- timr->it_overrun = -1; -+ timr->it_overrun = -1LL; - ++timr->it_requeue_pending; - hrtimer_restart(timer); - } -@@ -396,7 +406,7 @@ void do_schedule_next_timer(struct siginfo *info) - else - schedule_next_timer(timr); - -- info->si_overrun += timr->it_overrun_last; -+ info->si_overrun = timer_overrun_to_int(timr, info->si_overrun); - } - - if (timr) -@@ -491,8 +501,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer) - now = ktime_add(now, kj); - } - #endif -- timr->it_overrun += (unsigned int) -- hrtimer_forward(timer, now, -+ timr->it_overrun += hrtimer_forward(timer, now, - timr->it.real.interval); - ret = HRTIMER_RESTART; - ++timr->it_requeue_pending; -@@ -633,7 +642,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock, - it_id_set = IT_ID_SET; - new_timer->it_id = (timer_t) new_timer_id; - new_timer->it_clock = which_clock; -- new_timer->it_overrun = -1; -+ new_timer->it_overrun = -1LL; - - if (timer_event_spec) { - if (copy_from_user(&event, timer_event_spec, sizeof (event))) { -@@ -762,7 +771,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) - */ - if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING || - timr->it_sigev_notify == SIGEV_NONE)) -- timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv); -+ timr->it_overrun += hrtimer_forward(timer, now, iv); - - remaining = __hrtimer_expires_remaining_adjusted(timer, now); - /* Return 0 only, when the timer is expired and not pending */ -@@ -824,7 +833,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id) - if (!timr) - return -EINVAL; - -- overrun = timr->it_overrun_last; -+ overrun = timer_overrun_to_int(timr, 0); - unlock_timer(timr, flags); - - return overrun; -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index 4228fd3682c3..3dd40c736067 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -119,11 +119,13 @@ static u64 bpf_trace_printk(u64 r1, u64 fmt_size, u64 r3, u64 r4, u64 r5) - i++; - } else if (fmt[i] == 'p' || fmt[i] == 's') { - mod[fmt_cnt]++; -- i++; -- if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0) -+ /* disallow any further format extensions */ -+ if (fmt[i + 1] != 0 && -+ !isspace(fmt[i + 1]) && -+ !ispunct(fmt[i + 1])) - return -EINVAL; - fmt_cnt++; -- if (fmt[i - 1] == 's') { -+ if (fmt[i] == 's') { - if (str_seen) - /* allow only one '%s' per fmt string */ - return -EINVAL; -diff --git a/lib/debugobjects.c b/lib/debugobjects.c -index a26328ec39f1..bb37541cd441 100644 ---- a/lib/debugobjects.c -+++ b/lib/debugobjects.c -@@ -1088,7 +1088,8 @@ void __init debug_objects_mem_init(void) - - obj_cache = kmem_cache_create("debug_objects_cache", - sizeof (struct debug_obj), 0, -- SLAB_DEBUG_OBJECTS, NULL); -+ SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE, -+ NULL); - - if (!obj_cache || debug_objects_replace_static_objects()) { - debug_objects_enabled = 0; -diff --git a/lib/swiotlb.c b/lib/swiotlb.c -index 771234d050c7..6bc452b33b76 100644 ---- a/lib/swiotlb.c -+++ b/lib/swiotlb.c -@@ -17,6 +17,8 @@ - * 08/12/11 beckyb Add highmem support - */ - -+#define pr_fmt(fmt) "software IO TLB: " fmt -+ - #include - #include - #include -@@ -143,20 +145,16 @@ static bool no_iotlb_memory; - void swiotlb_print_info(void) - { - unsigned long bytes = io_tlb_nslabs << IO_TLB_SHIFT; -- unsigned char *vstart, *vend; - - if (no_iotlb_memory) { -- pr_warn("software IO TLB: No low mem\n"); -+ pr_warn("No low mem\n"); - return; - } - -- vstart = phys_to_virt(io_tlb_start); -- vend = phys_to_virt(io_tlb_end); -- -- printk(KERN_INFO "software IO TLB [mem %#010llx-%#010llx] (%luMB) mapped at [%p-%p]\n", -+ pr_info("mapped [mem %#010llx-%#010llx] (%luMB)\n", - (unsigned long long)io_tlb_start, - (unsigned long long)io_tlb_end, -- bytes >> 20, vstart, vend - 1); -+ bytes >> 20); - } - - int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose) -@@ -230,7 +228,7 @@ swiotlb_init(int verbose) - if (io_tlb_start) - memblock_free_early(io_tlb_start, - PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT)); -- pr_warn("Cannot allocate SWIOTLB buffer"); -+ pr_warn("Cannot allocate buffer"); - no_iotlb_memory = true; - } - -@@ -272,8 +270,8 @@ swiotlb_late_init_with_default_size(size_t default_size) - return -ENOMEM; - } - if (order != get_order(bytes)) { -- printk(KERN_WARNING "Warning: only able to allocate %ld MB " -- "for software IO TLB\n", (PAGE_SIZE << order) >> 20); -+ pr_warn("only able to allocate %ld MB\n", -+ (PAGE_SIZE << order) >> 20); - io_tlb_nslabs = SLABS_PER_PAGE << order; - } - rc = swiotlb_late_init_with_tbl(vstart, io_tlb_nslabs); -@@ -680,7 +678,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size, - return ret; - - err_warn: -- pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n", -+ pr_warn("coherent allocation failed for device %s size=%zu\n", - dev_name(hwdev), size); - dump_stack(); - -diff --git a/mm/frame_vector.c b/mm/frame_vector.c -index 7cf2b7163222..c1e7926a41c4 100644 ---- a/mm/frame_vector.c -+++ b/mm/frame_vector.c -@@ -11,10 +11,7 @@ - * get_vaddr_frames() - map virtual addresses to pfns - * @start: starting user address - * @nr_frames: number of pages / pfns from start to map -- * @write: whether pages will be written to by the caller -- * @force: whether to force write access even if user mapping is -- * readonly. See description of the same argument of -- get_user_pages(). -+ * @gup_flags: flags modifying lookup behaviour - * @vec: structure which receives pages / pfns of the addresses mapped. - * It should have space for at least nr_frames entries. - * -@@ -34,7 +31,7 @@ - * This function takes care of grabbing mmap_sem as necessary. - */ - int get_vaddr_frames(unsigned long start, unsigned int nr_frames, -- bool write, bool force, struct frame_vector *vec) -+ unsigned int gup_flags, struct frame_vector *vec) - { - struct mm_struct *mm = current->mm; - struct vm_area_struct *vma; -@@ -59,7 +56,7 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, - vec->got_ref = true; - vec->is_pfns = false; - ret = get_user_pages_locked(current, mm, start, nr_frames, -- write, force, (struct page **)(vec->ptrs), &locked); -+ gup_flags, (struct page **)(vec->ptrs), &locked); - goto out; - } - -diff --git a/mm/gup.c b/mm/gup.c -index 018144c4b9ec..2cd3b31e3666 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -368,6 +368,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) - if (vm_flags & (VM_IO | VM_PFNMAP)) - return -EFAULT; - -+ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) -+ return -EFAULT; -+ - if (gup_flags & FOLL_WRITE) { - if (!(vm_flags & VM_WRITE)) { - if (!(gup_flags & FOLL_FORCE)) -@@ -627,7 +630,6 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk, - struct mm_struct *mm, - unsigned long start, - unsigned long nr_pages, -- int write, int force, - struct page **pages, - struct vm_area_struct **vmas, - int *locked, bool notify_drop, -@@ -645,10 +647,6 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk, - - if (pages) - flags |= FOLL_GET; -- if (write) -- flags |= FOLL_WRITE; -- if (force) -- flags |= FOLL_FORCE; - - pages_done = 0; - lock_dropped = false; -@@ -742,11 +740,12 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk, - */ - long get_user_pages_locked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -+ unsigned int gup_flags, struct page **pages, - int *locked) - { -- return __get_user_pages_locked(tsk, mm, start, nr_pages, write, force, -- pages, NULL, locked, true, FOLL_TOUCH); -+ return __get_user_pages_locked(tsk, mm, start, nr_pages, -+ pages, NULL, locked, true, -+ gup_flags | FOLL_TOUCH); - } - EXPORT_SYMBOL(get_user_pages_locked); - -@@ -762,14 +761,14 @@ EXPORT_SYMBOL(get_user_pages_locked); - */ - __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -- unsigned int gup_flags) -+ struct page **pages, unsigned int gup_flags) - { - long ret; - int locked = 1; -+ - down_read(&mm->mmap_sem); -- ret = __get_user_pages_locked(tsk, mm, start, nr_pages, write, force, -- pages, NULL, &locked, false, gup_flags); -+ ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, -+ &locked, false, gup_flags); - if (locked) - up_read(&mm->mmap_sem); - return ret; -@@ -795,10 +794,10 @@ EXPORT_SYMBOL(__get_user_pages_unlocked); - */ - long get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages) -+ struct page **pages, unsigned int gup_flags) - { -- return __get_user_pages_unlocked(tsk, mm, start, nr_pages, write, -- force, pages, FOLL_TOUCH); -+ return __get_user_pages_unlocked(tsk, mm, start, nr_pages, -+ pages, gup_flags | FOLL_TOUCH); - } - EXPORT_SYMBOL(get_user_pages_unlocked); - -@@ -858,11 +857,13 @@ EXPORT_SYMBOL(get_user_pages_unlocked); - * FAULT_FLAG_ALLOW_RETRY to handle_mm_fault. - */ - long get_user_pages(struct task_struct *tsk, struct mm_struct *mm, -- unsigned long start, unsigned long nr_pages, int write, -- int force, struct page **pages, struct vm_area_struct **vmas) -+ unsigned long start, unsigned long nr_pages, -+ unsigned int gup_flags, struct page **pages, -+ struct vm_area_struct **vmas) - { -- return __get_user_pages_locked(tsk, mm, start, nr_pages, write, force, -- pages, vmas, NULL, false, FOLL_TOUCH); -+ return __get_user_pages_locked(tsk, mm, start, nr_pages, -+ pages, vmas, NULL, false, -+ gup_flags | FOLL_TOUCH); - } - EXPORT_SYMBOL(get_user_pages); - -@@ -1411,7 +1412,8 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, - pages += nr; - - ret = get_user_pages_unlocked(current, mm, start, -- nr_pages - nr, write, 0, pages); -+ nr_pages - nr, pages, -+ write ? FOLL_WRITE : 0); - - /* Have to be a bit careful with return values */ - if (nr > 0) { -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 6f99a0f906bb..f1a45f5077fe 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -4053,6 +4053,14 @@ int hugetlb_reserve_pages(struct inode *inode, - struct resv_map *resv_map; - long gbl_reserve; - -+ /* This should never happen */ -+ if (from > to) { -+#ifdef CONFIG_DEBUG_VM -+ WARN(1, "%s called with a negative range\n", __func__); -+#endif -+ return -EINVAL; -+ } -+ - /* - * Only apply hugepage reservation if asked. At fault time, an - * attempt will be made for VM_NORESERVE to allocate a page -@@ -4142,7 +4150,9 @@ int hugetlb_reserve_pages(struct inode *inode, - return 0; - out_err: - if (!vma || vma->vm_flags & VM_MAYSHARE) -- region_abort(resv_map, from, to); -+ /* Don't call region_abort if region_chg failed */ -+ if (chg >= 0) -+ region_abort(resv_map, from, to); - if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER)) - kref_put(&resv_map->refs, resv_map_release); - return ret; -diff --git a/mm/memory.c b/mm/memory.c -index 5aee9ec8b8c6..fa752df6dc85 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -3711,10 +3711,11 @@ EXPORT_SYMBOL_GPL(generic_access_phys); - * given task for page fault accounting. - */ - static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, -- unsigned long addr, void *buf, int len, int write) -+ unsigned long addr, void *buf, int len, unsigned int gup_flags) - { - struct vm_area_struct *vma; - void *old_buf = buf; -+ int write = gup_flags & FOLL_WRITE; - - down_read(&mm->mmap_sem); - /* ignore errors, just check how much was successfully transferred */ -@@ -3724,7 +3725,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, - struct page *page = NULL; - - ret = get_user_pages(tsk, mm, addr, 1, -- write, 1, &page, &vma); -+ gup_flags, &page, &vma); - if (ret <= 0) { - #ifndef CONFIG_HAVE_IOREMAP_PROT - break; -@@ -3776,14 +3777,14 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, - * @addr: start address to access - * @buf: source or destination buffer - * @len: number of bytes to transfer -- * @write: whether the access is a write -+ * @gup_flags: flags modifying lookup behaviour - * - * The caller must hold a reference on @mm. - */ - int access_remote_vm(struct mm_struct *mm, unsigned long addr, -- void *buf, int len, int write) -+ void *buf, int len, unsigned int gup_flags) - { -- return __access_remote_vm(NULL, mm, addr, buf, len, write); -+ return __access_remote_vm(NULL, mm, addr, buf, len, gup_flags); - } - - /* -@@ -3796,12 +3797,17 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, - { - struct mm_struct *mm; - int ret; -+ unsigned int flags = FOLL_FORCE; - - mm = get_task_mm(tsk); - if (!mm) - return 0; - -- ret = __access_remote_vm(tsk, mm, addr, buf, len, write); -+ if (write) -+ flags |= FOLL_WRITE; -+ -+ ret = __access_remote_vm(tsk, mm, addr, buf, len, flags); -+ - mmput(mm); - - return ret; -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index be9840bf11d1..44134ba6fb53 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -818,7 +818,7 @@ static int lookup_node(struct mm_struct *mm, unsigned long addr) - struct page *p; - int err; - -- err = get_user_pages(current, mm, addr & PAGE_MASK, 1, 0, 0, &p, NULL); -+ err = get_user_pages(current, mm, addr & PAGE_MASK, 1, 0, &p, NULL); - if (err >= 0) { - err = page_to_nid(p); - put_page(p); -diff --git a/mm/nommu.c b/mm/nommu.c -index 92be862c859b..2360546db065 100644 ---- a/mm/nommu.c -+++ b/mm/nommu.c -@@ -184,40 +184,32 @@ finish_or_fault: - */ - long get_user_pages(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -+ unsigned int gup_flags, struct page **pages, - struct vm_area_struct **vmas) - { -- int flags = 0; -- -- if (write) -- flags |= FOLL_WRITE; -- if (force) -- flags |= FOLL_FORCE; -- -- return __get_user_pages(tsk, mm, start, nr_pages, flags, pages, vmas, -- NULL); -+ return __get_user_pages(tsk, mm, start, nr_pages, -+ gup_flags, pages, vmas, NULL); - } - EXPORT_SYMBOL(get_user_pages); - - long get_user_pages_locked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -+ unsigned int gup_flags, struct page **pages, - int *locked) - { -- return get_user_pages(tsk, mm, start, nr_pages, write, force, -+ return get_user_pages(tsk, mm, start, nr_pages, gup_flags, - pages, NULL); - } - EXPORT_SYMBOL(get_user_pages_locked); - - long __get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages, -- unsigned int gup_flags) -+ struct page **pages, unsigned int gup_flags) - { - long ret; - down_read(&mm->mmap_sem); -- ret = get_user_pages(tsk, mm, start, nr_pages, write, force, -- pages, NULL); -+ ret = __get_user_pages(tsk, mm, start, nr_pages, gup_flags, pages, -+ NULL, NULL); - up_read(&mm->mmap_sem); - return ret; - } -@@ -225,10 +217,10 @@ EXPORT_SYMBOL(__get_user_pages_unlocked); - - long get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, - unsigned long start, unsigned long nr_pages, -- int write, int force, struct page **pages) -+ struct page **pages, unsigned int gup_flags) - { -- return __get_user_pages_unlocked(tsk, mm, start, nr_pages, write, -- force, pages, 0); -+ return __get_user_pages_unlocked(tsk, mm, start, nr_pages, -+ pages, gup_flags); - } - EXPORT_SYMBOL(get_user_pages_unlocked); - -@@ -1937,9 +1929,10 @@ void filemap_map_pages(struct vm_area_struct *vma, struct vm_fault *vmf) - EXPORT_SYMBOL(filemap_map_pages); - - static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, -- unsigned long addr, void *buf, int len, int write) -+ unsigned long addr, void *buf, int len, unsigned int gup_flags) - { - struct vm_area_struct *vma; -+ int write = gup_flags & FOLL_WRITE; - - down_read(&mm->mmap_sem); - -@@ -1974,14 +1967,14 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm, - * @addr: start address to access - * @buf: source or destination buffer - * @len: number of bytes to transfer -- * @write: whether the access is a write -+ * @gup_flags: flags modifying lookup behaviour - * - * The caller must hold a reference on @mm. - */ - int access_remote_vm(struct mm_struct *mm, unsigned long addr, -- void *buf, int len, int write) -+ void *buf, int len, unsigned int gup_flags) - { -- return __access_remote_vm(NULL, mm, addr, buf, len, write); -+ return __access_remote_vm(NULL, mm, addr, buf, len, gup_flags); - } - - /* -@@ -1999,7 +1992,8 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in - if (!mm) - return 0; - -- len = __access_remote_vm(tsk, mm, addr, buf, len, write); -+ len = __access_remote_vm(tsk, mm, addr, buf, len, -+ write ? FOLL_WRITE : 0); - - mmput(mm); - return len; -diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index 5d453e58ddbf..1b5a6104c5fc 100644 ---- a/mm/process_vm_access.c -+++ b/mm/process_vm_access.c -@@ -88,19 +88,23 @@ static int process_vm_rw_single_vec(unsigned long addr, - ssize_t rc = 0; - unsigned long max_pages_per_loop = PVM_MAX_KMALLOC_PAGES - / sizeof(struct pages *); -+ unsigned int flags = 0; - - /* Work out address and page range required */ - if (len == 0) - return 0; - nr_pages = (addr + len - 1) / PAGE_SIZE - addr / PAGE_SIZE + 1; - -+ if (vm_write) -+ flags |= FOLL_WRITE; -+ - while (!rc && nr_pages && iov_iter_count(iter)) { - int pages = min(nr_pages, max_pages_per_loop); - size_t bytes; - - /* Get the pages we're interested in */ - pages = get_user_pages_unlocked(task, mm, pa, pages, -- vm_write, 0, process_pages); -+ process_pages, flags); - if (pages <= 0) - return -EFAULT; - -diff --git a/mm/util.c b/mm/util.c -index 5fae5b9c2885..db39235970c6 100644 ---- a/mm/util.c -+++ b/mm/util.c -@@ -278,7 +278,7 @@ int __weak get_user_pages_fast(unsigned long start, - { - struct mm_struct *mm = current->mm; - return get_user_pages_unlocked(current, mm, start, nr_pages, -- write, 0, pages); -+ pages, write ? FOLL_WRITE : 0); - } - EXPORT_SYMBOL_GPL(get_user_pages_fast); - -diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c -index d4f5f220a8e5..28453d698d86 100644 ---- a/net/ceph/pagevec.c -+++ b/net/ceph/pagevec.c -@@ -26,7 +26,7 @@ struct page **ceph_get_direct_page_vector(const void __user *data, - while (got < num_pages) { - rc = get_user_pages_unlocked(current, current->mm, - (unsigned long)data + ((unsigned long)got * PAGE_SIZE), -- num_pages - got, write_page, 0, pages + got); -+ num_pages - got, pages + got, write_page ? FOLL_WRITE : 0); - if (rc < 0) - break; - BUG_ON(rc == 0); -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index d2a46ffe6382..d52b633164c9 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2931,6 +2931,9 @@ int ndo_dflt_fdb_dump(struct sk_buff *skb, - { - int err; - -+ if (dev->type != ARPHRD_ETHER) -+ return -EINVAL; -+ - netif_addr_lock_bh(dev); - err = nlmsg_populate_fdb(skb, cb, dev, &idx, &dev->uc); - if (err) -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 2d3c9df8d75c..b55b8954dae5 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2263,14 +2263,18 @@ void tcp_send_loss_probe(struct sock *sk) - skb = tcp_write_queue_tail(sk); - } - -+ if (unlikely(!skb)) { -+ WARN_ONCE(tp->packets_out, -+ "invalid inflight: %u state %u cwnd %u mss %d\n", -+ tp->packets_out, sk->sk_state, tp->snd_cwnd, mss); -+ inet_csk(sk)->icsk_pending = 0; -+ return; -+ } -+ - /* At most one outstanding TLP retransmission. */ - if (tp->tlp_high_seq) - goto rearm_timer; - -- /* Retransmit last segment. */ -- if (WARN_ON(!skb)) -- goto rearm_timer; -- - if (skb_still_in_host_queue(sk, skb)) - goto rearm_timer; - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 530b62fd6b64..f8cca81d66f2 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -169,37 +169,37 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, - const struct ipv6_pinfo *np = inet6_sk(sk); - struct in6_addr *first_hop = &fl6->daddr; - struct dst_entry *dst = skb_dst(skb); -+ unsigned int head_room; - struct ipv6hdr *hdr; - u8 proto = fl6->flowi6_proto; - int seg_len = skb->len; - int hlimit = -1; - u32 mtu; - -- if (opt) { -- unsigned int head_room; -+ head_room = sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev); -+ if (opt) -+ head_room += opt->opt_nflen + opt->opt_flen; - -- /* First: exthdrs may take lots of space (~8K for now) -- MAX_HEADER is not enough. -- */ -- head_room = opt->opt_nflen + opt->opt_flen; -- seg_len += head_room; -- head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev); -- -- if (skb_headroom(skb) < head_room) { -- struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room); -- if (!skb2) { -- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), -- IPSTATS_MIB_OUTDISCARDS); -- kfree_skb(skb); -- return -ENOBUFS; -- } -- if (skb->sk) -- skb_set_owner_w(skb2, skb->sk); -- consume_skb(skb); -- skb = skb2; -+ if (unlikely(skb_headroom(skb) < head_room)) { -+ struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room); -+ if (!skb2) { -+ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), -+ IPSTATS_MIB_OUTDISCARDS); -+ kfree_skb(skb); -+ return -ENOBUFS; - } -+ if (skb->sk) -+ skb_set_owner_w(skb2, skb->sk); -+ consume_skb(skb); -+ skb = skb2; -+ } -+ -+ if (opt) { -+ seg_len += opt->opt_nflen + opt->opt_flen; -+ - if (opt->opt_flen) - ipv6_push_frag_opts(skb, opt, &proto); -+ - if (opt->opt_nflen) - ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop); - } -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 743ff23885da..7acf1f2b8dfc 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -432,6 +432,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - int count = 1; - int rc = NET_XMIT_SUCCESS; - -+ /* Do not fool qdisc_drop_all() */ -+ skb->prev = NULL; -+ - /* Random duplication */ - if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor)) - ++count; -diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c -index 38651454ed08..6f388e77999c 100644 ---- a/security/tomoyo/domain.c -+++ b/security/tomoyo/domain.c -@@ -874,7 +874,8 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, - } - /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */ - #ifdef CONFIG_MMU -- if (get_user_pages(current, bprm->mm, pos, 1, 0, 1, &page, NULL) <= 0) -+ if (get_user_pages(current, bprm->mm, pos, 1, -+ FOLL_FORCE, &page, NULL) <= 0) - return false; - #else - page = bprm->page[pos / PAGE_SIZE]; -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 5bc7ddf8fc70..3ce2b8771762 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -1849,8 +1849,6 @@ int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream, - unsigned int cmd, void *arg) - { - switch (cmd) { -- case SNDRV_PCM_IOCTL1_INFO: -- return 0; - case SNDRV_PCM_IOCTL1_RESET: - return snd_pcm_lib_ioctl_reset(substream, arg); - case SNDRV_PCM_IOCTL1_CHANNEL_INFO: -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 0ad194002c0c..9b6dcdea4431 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -214,11 +214,7 @@ int snd_pcm_info(struct snd_pcm_substream *substream, struct snd_pcm_info *info) - info->subdevices_avail = pstr->substream_count - pstr->substream_opened; - strlcpy(info->subname, substream->name, sizeof(info->subname)); - runtime = substream->runtime; -- /* AB: FIXME!!! This is definitely nonsense */ -- if (runtime) { -- info->sync = runtime->sync; -- substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_INFO, info); -- } -+ - return 0; - } - -diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c -index 09db2aec12a3..776e809a8aab 100644 ---- a/sound/soc/omap/omap-dmic.c -+++ b/sound/soc/omap/omap-dmic.c -@@ -48,6 +48,8 @@ struct omap_dmic { - struct device *dev; - void __iomem *io_base; - struct clk *fclk; -+ struct pm_qos_request pm_qos_req; -+ int latency; - int fclk_freq; - int out_freq; - int clk_div; -@@ -124,6 +126,8 @@ static void omap_dmic_dai_shutdown(struct snd_pcm_substream *substream, - - mutex_lock(&dmic->mutex); - -+ pm_qos_remove_request(&dmic->pm_qos_req); -+ - if (!dai->active) - dmic->active = 0; - -@@ -226,6 +230,8 @@ static int omap_dmic_dai_hw_params(struct snd_pcm_substream *substream, - /* packet size is threshold * channels */ - dma_data = snd_soc_dai_get_dma_data(dai, substream); - dma_data->maxburst = dmic->threshold * channels; -+ dmic->latency = (OMAP_DMIC_THRES_MAX - dmic->threshold) * USEC_PER_SEC / -+ params_rate(params); - - return 0; - } -@@ -236,6 +242,9 @@ static int omap_dmic_dai_prepare(struct snd_pcm_substream *substream, - struct omap_dmic *dmic = snd_soc_dai_get_drvdata(dai); - u32 ctrl; - -+ if (pm_qos_request_active(&dmic->pm_qos_req)) -+ pm_qos_update_request(&dmic->pm_qos_req, dmic->latency); -+ - /* Configure uplink threshold */ - omap_dmic_write(dmic, OMAP_DMIC_FIFO_CTRL_REG, dmic->threshold); - -diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c -index 8d0d45d330e7..8eb2d12b6a34 100644 ---- a/sound/soc/omap/omap-mcpdm.c -+++ b/sound/soc/omap/omap-mcpdm.c -@@ -54,6 +54,8 @@ struct omap_mcpdm { - unsigned long phys_base; - void __iomem *io_base; - int irq; -+ struct pm_qos_request pm_qos_req; -+ int latency[2]; - - struct mutex mutex; - -@@ -273,6 +275,9 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream, - struct snd_soc_dai *dai) - { - struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai); -+ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK); -+ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE; -+ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; - - mutex_lock(&mcpdm->mutex); - -@@ -285,6 +290,14 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream, - } - } - -+ if (mcpdm->latency[stream2]) -+ pm_qos_update_request(&mcpdm->pm_qos_req, -+ mcpdm->latency[stream2]); -+ else if (mcpdm->latency[stream1]) -+ pm_qos_remove_request(&mcpdm->pm_qos_req); -+ -+ mcpdm->latency[stream1] = 0; -+ - mutex_unlock(&mcpdm->mutex); - } - -@@ -296,7 +309,7 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream, - int stream = substream->stream; - struct snd_dmaengine_dai_dma_data *dma_data; - u32 threshold; -- int channels; -+ int channels, latency; - int link_mask = 0; - - channels = params_channels(params); -@@ -336,14 +349,25 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream, - - dma_data->maxburst = - (MCPDM_DN_THRES_MAX - threshold) * channels; -+ latency = threshold; - } else { - /* If playback is not running assume a stereo stream to come */ - if (!mcpdm->config[!stream].link_mask) - mcpdm->config[!stream].link_mask = (0x3 << 3); - - dma_data->maxburst = threshold * channels; -+ latency = (MCPDM_DN_THRES_MAX - threshold); - } - -+ /* -+ * The DMA must act to a DMA request within latency time (usec) to avoid -+ * under/overflow -+ */ -+ mcpdm->latency[stream] = latency * USEC_PER_SEC / params_rate(params); -+ -+ if (!mcpdm->latency[stream]) -+ mcpdm->latency[stream] = 10; -+ - /* Check if we need to restart McPDM with this stream */ - if (mcpdm->config[stream].link_mask && - mcpdm->config[stream].link_mask != link_mask) -@@ -358,6 +382,20 @@ static int omap_mcpdm_prepare(struct snd_pcm_substream *substream, - struct snd_soc_dai *dai) - { - struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai); -+ struct pm_qos_request *pm_qos_req = &mcpdm->pm_qos_req; -+ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK); -+ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE; -+ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; -+ int latency = mcpdm->latency[stream2]; -+ -+ /* Prevent omap hardware from hitting off between FIFO fills */ -+ if (!latency || mcpdm->latency[stream1] < latency) -+ latency = mcpdm->latency[stream1]; -+ -+ if (pm_qos_request_active(pm_qos_req)) -+ pm_qos_update_request(pm_qos_req, latency); -+ else if (latency) -+ pm_qos_add_request(pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency); - - if (!omap_mcpdm_active(mcpdm)) { - omap_mcpdm_start(mcpdm); -@@ -419,6 +457,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai) - free_irq(mcpdm->irq, (void *)mcpdm); - pm_runtime_disable(mcpdm->dev); - -+ if (pm_qos_request_active(&mcpdm->pm_qos_req)) -+ pm_qos_remove_request(&mcpdm->pm_qos_req); -+ - return 0; - } - -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index fa6b74a304a7..b927f9c81d92 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -1711,6 +1711,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card) - } - - card->instantiated = 1; -+ dapm_mark_endpoints_dirty(card); - snd_soc_dapm_sync(&card->dapm); - mutex_unlock(&card->mutex); - mutex_unlock(&client_mutex); -diff --git a/tools/testing/selftests/networking/timestamping/.gitignore b/tools/testing/selftests/networking/timestamping/.gitignore -new file mode 100644 -index 000000000000..9e69e982fb38 ---- /dev/null -+++ b/tools/testing/selftests/networking/timestamping/.gitignore -@@ -0,0 +1,3 @@ -+timestamping -+txtimestamp -+hwtstamp_config -diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile -new file mode 100644 -index 000000000000..ccbb9edbbbb9 ---- /dev/null -+++ b/tools/testing/selftests/networking/timestamping/Makefile -@@ -0,0 +1,8 @@ -+TEST_PROGS := hwtstamp_config timestamping txtimestamp -+ -+all: $(TEST_PROGS) -+ -+include ../../lib.mk -+ -+clean: -+ rm -fr $(TEST_PROGS) -diff --git a/tools/testing/selftests/networking/timestamping/hwtstamp_config.c b/tools/testing/selftests/networking/timestamping/hwtstamp_config.c -new file mode 100644 -index 000000000000..e8b685a7f15f ---- /dev/null -+++ b/tools/testing/selftests/networking/timestamping/hwtstamp_config.c -@@ -0,0 +1,134 @@ -+/* Test program for SIOC{G,S}HWTSTAMP -+ * Copyright 2013 Solarflare Communications -+ * Author: Ben Hutchings -+ */ -+ -+#include -+#include -+#include -+#include -+ -+#include -+#include -+ -+#include -+#include -+#include -+ -+static int -+lookup_value(const char **names, int size, const char *name) -+{ -+ int value; -+ -+ for (value = 0; value < size; value++) -+ if (names[value] && strcasecmp(names[value], name) == 0) -+ return value; -+ -+ return -1; -+} -+ -+static const char * -+lookup_name(const char **names, int size, int value) -+{ -+ return (value >= 0 && value < size) ? names[value] : NULL; -+} -+ -+static void list_names(FILE *f, const char **names, int size) -+{ -+ int value; -+ -+ for (value = 0; value < size; value++) -+ if (names[value]) -+ fprintf(f, " %s\n", names[value]); -+} -+ -+static const char *tx_types[] = { -+#define TX_TYPE(name) [HWTSTAMP_TX_ ## name] = #name -+ TX_TYPE(OFF), -+ TX_TYPE(ON), -+ TX_TYPE(ONESTEP_SYNC) -+#undef TX_TYPE -+}; -+#define N_TX_TYPES ((int)(sizeof(tx_types) / sizeof(tx_types[0]))) -+ -+static const char *rx_filters[] = { -+#define RX_FILTER(name) [HWTSTAMP_FILTER_ ## name] = #name -+ RX_FILTER(NONE), -+ RX_FILTER(ALL), -+ RX_FILTER(SOME), -+ RX_FILTER(PTP_V1_L4_EVENT), -+ RX_FILTER(PTP_V1_L4_SYNC), -+ RX_FILTER(PTP_V1_L4_DELAY_REQ), -+ RX_FILTER(PTP_V2_L4_EVENT), -+ RX_FILTER(PTP_V2_L4_SYNC), -+ RX_FILTER(PTP_V2_L4_DELAY_REQ), -+ RX_FILTER(PTP_V2_L2_EVENT), -+ RX_FILTER(PTP_V2_L2_SYNC), -+ RX_FILTER(PTP_V2_L2_DELAY_REQ), -+ RX_FILTER(PTP_V2_EVENT), -+ RX_FILTER(PTP_V2_SYNC), -+ RX_FILTER(PTP_V2_DELAY_REQ), -+#undef RX_FILTER -+}; -+#define N_RX_FILTERS ((int)(sizeof(rx_filters) / sizeof(rx_filters[0]))) -+ -+static void usage(void) -+{ -+ fputs("Usage: hwtstamp_config if_name [tx_type rx_filter]\n" -+ "tx_type is any of (case-insensitive):\n", -+ stderr); -+ list_names(stderr, tx_types, N_TX_TYPES); -+ fputs("rx_filter is any of (case-insensitive):\n", stderr); -+ list_names(stderr, rx_filters, N_RX_FILTERS); -+} -+ -+int main(int argc, char **argv) -+{ -+ struct ifreq ifr; -+ struct hwtstamp_config config; -+ const char *name; -+ int sock; -+ -+ if ((argc != 2 && argc != 4) || (strlen(argv[1]) >= IFNAMSIZ)) { -+ usage(); -+ return 2; -+ } -+ -+ if (argc == 4) { -+ config.flags = 0; -+ config.tx_type = lookup_value(tx_types, N_TX_TYPES, argv[2]); -+ config.rx_filter = lookup_value(rx_filters, N_RX_FILTERS, argv[3]); -+ if (config.tx_type < 0 || config.rx_filter < 0) { -+ usage(); -+ return 2; -+ } -+ } -+ -+ sock = socket(AF_INET, SOCK_DGRAM, 0); -+ if (sock < 0) { -+ perror("socket"); -+ return 1; -+ } -+ -+ strcpy(ifr.ifr_name, argv[1]); -+ ifr.ifr_data = (caddr_t)&config; -+ -+ if (ioctl(sock, (argc == 2) ? SIOCGHWTSTAMP : SIOCSHWTSTAMP, &ifr)) { -+ perror("ioctl"); -+ return 1; -+ } -+ -+ printf("flags = %#x\n", config.flags); -+ name = lookup_name(tx_types, N_TX_TYPES, config.tx_type); -+ if (name) -+ printf("tx_type = %s\n", name); -+ else -+ printf("tx_type = %d\n", config.tx_type); -+ name = lookup_name(rx_filters, N_RX_FILTERS, config.rx_filter); -+ if (name) -+ printf("rx_filter = %s\n", name); -+ else -+ printf("rx_filter = %d\n", config.rx_filter); -+ -+ return 0; -+} -diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c -new file mode 100644 -index 000000000000..5cdfd743447b ---- /dev/null -+++ b/tools/testing/selftests/networking/timestamping/timestamping.c -@@ -0,0 +1,528 @@ -+/* -+ * This program demonstrates how the various time stamping features in -+ * the Linux kernel work. It emulates the behavior of a PTP -+ * implementation in stand-alone master mode by sending PTPv1 Sync -+ * multicasts once every second. It looks for similar packets, but -+ * beyond that doesn't actually implement PTP. -+ * -+ * Outgoing packets are time stamped with SO_TIMESTAMPING with or -+ * without hardware support. -+ * -+ * Incoming packets are time stamped with SO_TIMESTAMPING with or -+ * without hardware support, SIOCGSTAMP[NS] (per-socket time stamp) and -+ * SO_TIMESTAMP[NS]. -+ * -+ * Copyright (C) 2009 Intel Corporation. -+ * Author: Patrick Ohly -+ * -+ * This program is free software; you can redistribute it and/or modify it -+ * under the terms and conditions of the GNU General Public License, -+ * version 2, as published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for -+ * more details. -+ * -+ * You should have received a copy of the GNU General Public License along with -+ * this program; if not, write to the Free Software Foundation, Inc., -+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. -+ */ -+ -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+ -+#ifndef SO_TIMESTAMPING -+# define SO_TIMESTAMPING 37 -+# define SCM_TIMESTAMPING SO_TIMESTAMPING -+#endif -+ -+#ifndef SO_TIMESTAMPNS -+# define SO_TIMESTAMPNS 35 -+#endif -+ -+#ifndef SIOCGSTAMPNS -+# define SIOCGSTAMPNS 0x8907 -+#endif -+ -+#ifndef SIOCSHWTSTAMP -+# define SIOCSHWTSTAMP 0x89b0 -+#endif -+ -+static void usage(const char *error) -+{ -+ if (error) -+ printf("invalid option: %s\n", error); -+ printf("timestamping interface option*\n\n" -+ "Options:\n" -+ " IP_MULTICAST_LOOP - looping outgoing multicasts\n" -+ " SO_TIMESTAMP - normal software time stamping, ms resolution\n" -+ " SO_TIMESTAMPNS - more accurate software time stamping\n" -+ " SOF_TIMESTAMPING_TX_HARDWARE - hardware time stamping of outgoing packets\n" -+ " SOF_TIMESTAMPING_TX_SOFTWARE - software fallback for outgoing packets\n" -+ " SOF_TIMESTAMPING_RX_HARDWARE - hardware time stamping of incoming packets\n" -+ " SOF_TIMESTAMPING_RX_SOFTWARE - software fallback for incoming packets\n" -+ " SOF_TIMESTAMPING_SOFTWARE - request reporting of software time stamps\n" -+ " SOF_TIMESTAMPING_RAW_HARDWARE - request reporting of raw HW time stamps\n" -+ " SIOCGSTAMP - check last socket time stamp\n" -+ " SIOCGSTAMPNS - more accurate socket time stamp\n"); -+ exit(1); -+} -+ -+static void bail(const char *error) -+{ -+ printf("%s: %s\n", error, strerror(errno)); -+ exit(1); -+} -+ -+static const unsigned char sync[] = { -+ 0x00, 0x01, 0x00, 0x01, -+ 0x5f, 0x44, 0x46, 0x4c, -+ 0x54, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x01, 0x01, -+ -+ /* fake uuid */ -+ 0x00, 0x01, -+ 0x02, 0x03, 0x04, 0x05, -+ -+ 0x00, 0x01, 0x00, 0x37, -+ 0x00, 0x00, 0x00, 0x08, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x49, 0x05, 0xcd, 0x01, -+ 0x29, 0xb1, 0x8d, 0xb0, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x01, -+ -+ /* fake uuid */ -+ 0x00, 0x01, -+ 0x02, 0x03, 0x04, 0x05, -+ -+ 0x00, 0x00, 0x00, 0x37, -+ 0x00, 0x00, 0x00, 0x04, -+ 0x44, 0x46, 0x4c, 0x54, -+ 0x00, 0x00, 0xf0, 0x60, -+ 0x00, 0x01, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x01, -+ 0x00, 0x00, 0xf0, 0x60, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x04, -+ 0x44, 0x46, 0x4c, 0x54, -+ 0x00, 0x01, -+ -+ /* fake uuid */ -+ 0x00, 0x01, -+ 0x02, 0x03, 0x04, 0x05, -+ -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static void sendpacket(int sock, struct sockaddr *addr, socklen_t addr_len) -+{ -+ struct timeval now; -+ int res; -+ -+ res = sendto(sock, sync, sizeof(sync), 0, -+ addr, addr_len); -+ gettimeofday(&now, 0); -+ if (res < 0) -+ printf("%s: %s\n", "send", strerror(errno)); -+ else -+ printf("%ld.%06ld: sent %d bytes\n", -+ (long)now.tv_sec, (long)now.tv_usec, -+ res); -+} -+ -+static void printpacket(struct msghdr *msg, int res, -+ char *data, -+ int sock, int recvmsg_flags, -+ int siocgstamp, int siocgstampns) -+{ -+ struct sockaddr_in *from_addr = (struct sockaddr_in *)msg->msg_name; -+ struct cmsghdr *cmsg; -+ struct timeval tv; -+ struct timespec ts; -+ struct timeval now; -+ -+ gettimeofday(&now, 0); -+ -+ printf("%ld.%06ld: received %s data, %d bytes from %s, %zu bytes control messages\n", -+ (long)now.tv_sec, (long)now.tv_usec, -+ (recvmsg_flags & MSG_ERRQUEUE) ? "error" : "regular", -+ res, -+ inet_ntoa(from_addr->sin_addr), -+ msg->msg_controllen); -+ for (cmsg = CMSG_FIRSTHDR(msg); -+ cmsg; -+ cmsg = CMSG_NXTHDR(msg, cmsg)) { -+ printf(" cmsg len %zu: ", cmsg->cmsg_len); -+ switch (cmsg->cmsg_level) { -+ case SOL_SOCKET: -+ printf("SOL_SOCKET "); -+ switch (cmsg->cmsg_type) { -+ case SO_TIMESTAMP: { -+ struct timeval *stamp = -+ (struct timeval *)CMSG_DATA(cmsg); -+ printf("SO_TIMESTAMP %ld.%06ld", -+ (long)stamp->tv_sec, -+ (long)stamp->tv_usec); -+ break; -+ } -+ case SO_TIMESTAMPNS: { -+ struct timespec *stamp = -+ (struct timespec *)CMSG_DATA(cmsg); -+ printf("SO_TIMESTAMPNS %ld.%09ld", -+ (long)stamp->tv_sec, -+ (long)stamp->tv_nsec); -+ break; -+ } -+ case SO_TIMESTAMPING: { -+ struct timespec *stamp = -+ (struct timespec *)CMSG_DATA(cmsg); -+ printf("SO_TIMESTAMPING "); -+ printf("SW %ld.%09ld ", -+ (long)stamp->tv_sec, -+ (long)stamp->tv_nsec); -+ stamp++; -+ /* skip deprecated HW transformed */ -+ stamp++; -+ printf("HW raw %ld.%09ld", -+ (long)stamp->tv_sec, -+ (long)stamp->tv_nsec); -+ break; -+ } -+ default: -+ printf("type %d", cmsg->cmsg_type); -+ break; -+ } -+ break; -+ case IPPROTO_IP: -+ printf("IPPROTO_IP "); -+ switch (cmsg->cmsg_type) { -+ case IP_RECVERR: { -+ struct sock_extended_err *err = -+ (struct sock_extended_err *)CMSG_DATA(cmsg); -+ printf("IP_RECVERR ee_errno '%s' ee_origin %d => %s", -+ strerror(err->ee_errno), -+ err->ee_origin, -+#ifdef SO_EE_ORIGIN_TIMESTAMPING -+ err->ee_origin == SO_EE_ORIGIN_TIMESTAMPING ? -+ "bounced packet" : "unexpected origin" -+#else -+ "probably SO_EE_ORIGIN_TIMESTAMPING" -+#endif -+ ); -+ if (res < sizeof(sync)) -+ printf(" => truncated data?!"); -+ else if (!memcmp(sync, data + res - sizeof(sync), -+ sizeof(sync))) -+ printf(" => GOT OUR DATA BACK (HURRAY!)"); -+ break; -+ } -+ case IP_PKTINFO: { -+ struct in_pktinfo *pktinfo = -+ (struct in_pktinfo *)CMSG_DATA(cmsg); -+ printf("IP_PKTINFO interface index %u", -+ pktinfo->ipi_ifindex); -+ break; -+ } -+ default: -+ printf("type %d", cmsg->cmsg_type); -+ break; -+ } -+ break; -+ default: -+ printf("level %d type %d", -+ cmsg->cmsg_level, -+ cmsg->cmsg_type); -+ break; -+ } -+ printf("\n"); -+ } -+ -+ if (siocgstamp) { -+ if (ioctl(sock, SIOCGSTAMP, &tv)) -+ printf(" %s: %s\n", "SIOCGSTAMP", strerror(errno)); -+ else -+ printf("SIOCGSTAMP %ld.%06ld\n", -+ (long)tv.tv_sec, -+ (long)tv.tv_usec); -+ } -+ if (siocgstampns) { -+ if (ioctl(sock, SIOCGSTAMPNS, &ts)) -+ printf(" %s: %s\n", "SIOCGSTAMPNS", strerror(errno)); -+ else -+ printf("SIOCGSTAMPNS %ld.%09ld\n", -+ (long)ts.tv_sec, -+ (long)ts.tv_nsec); -+ } -+} -+ -+static void recvpacket(int sock, int recvmsg_flags, -+ int siocgstamp, int siocgstampns) -+{ -+ char data[256]; -+ struct msghdr msg; -+ struct iovec entry; -+ struct sockaddr_in from_addr; -+ struct { -+ struct cmsghdr cm; -+ char control[512]; -+ } control; -+ int res; -+ -+ memset(&msg, 0, sizeof(msg)); -+ msg.msg_iov = &entry; -+ msg.msg_iovlen = 1; -+ entry.iov_base = data; -+ entry.iov_len = sizeof(data); -+ msg.msg_name = (caddr_t)&from_addr; -+ msg.msg_namelen = sizeof(from_addr); -+ msg.msg_control = &control; -+ msg.msg_controllen = sizeof(control); -+ -+ res = recvmsg(sock, &msg, recvmsg_flags|MSG_DONTWAIT); -+ if (res < 0) { -+ printf("%s %s: %s\n", -+ "recvmsg", -+ (recvmsg_flags & MSG_ERRQUEUE) ? "error" : "regular", -+ strerror(errno)); -+ } else { -+ printpacket(&msg, res, data, -+ sock, recvmsg_flags, -+ siocgstamp, siocgstampns); -+ } -+} -+ -+int main(int argc, char **argv) -+{ -+ int so_timestamping_flags = 0; -+ int so_timestamp = 0; -+ int so_timestampns = 0; -+ int siocgstamp = 0; -+ int siocgstampns = 0; -+ int ip_multicast_loop = 0; -+ char *interface; -+ int i; -+ int enabled = 1; -+ int sock; -+ struct ifreq device; -+ struct ifreq hwtstamp; -+ struct hwtstamp_config hwconfig, hwconfig_requested; -+ struct sockaddr_in addr; -+ struct ip_mreq imr; -+ struct in_addr iaddr; -+ int val; -+ socklen_t len; -+ struct timeval next; -+ -+ if (argc < 2) -+ usage(0); -+ interface = argv[1]; -+ -+ for (i = 2; i < argc; i++) { -+ if (!strcasecmp(argv[i], "SO_TIMESTAMP")) -+ so_timestamp = 1; -+ else if (!strcasecmp(argv[i], "SO_TIMESTAMPNS")) -+ so_timestampns = 1; -+ else if (!strcasecmp(argv[i], "SIOCGSTAMP")) -+ siocgstamp = 1; -+ else if (!strcasecmp(argv[i], "SIOCGSTAMPNS")) -+ siocgstampns = 1; -+ else if (!strcasecmp(argv[i], "IP_MULTICAST_LOOP")) -+ ip_multicast_loop = 1; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_TX_HARDWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_TX_HARDWARE; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_TX_SOFTWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_TX_SOFTWARE; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RX_HARDWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_RX_HARDWARE; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RX_SOFTWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_RX_SOFTWARE; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_SOFTWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_SOFTWARE; -+ else if (!strcasecmp(argv[i], "SOF_TIMESTAMPING_RAW_HARDWARE")) -+ so_timestamping_flags |= SOF_TIMESTAMPING_RAW_HARDWARE; -+ else -+ usage(argv[i]); -+ } -+ -+ sock = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); -+ if (sock < 0) -+ bail("socket"); -+ -+ memset(&device, 0, sizeof(device)); -+ strncpy(device.ifr_name, interface, sizeof(device.ifr_name)); -+ if (ioctl(sock, SIOCGIFADDR, &device) < 0) -+ bail("getting interface IP address"); -+ -+ memset(&hwtstamp, 0, sizeof(hwtstamp)); -+ strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name)); -+ hwtstamp.ifr_data = (void *)&hwconfig; -+ memset(&hwconfig, 0, sizeof(hwconfig)); -+ hwconfig.tx_type = -+ (so_timestamping_flags & SOF_TIMESTAMPING_TX_HARDWARE) ? -+ HWTSTAMP_TX_ON : HWTSTAMP_TX_OFF; -+ hwconfig.rx_filter = -+ (so_timestamping_flags & SOF_TIMESTAMPING_RX_HARDWARE) ? -+ HWTSTAMP_FILTER_PTP_V1_L4_SYNC : HWTSTAMP_FILTER_NONE; -+ hwconfig_requested = hwconfig; -+ if (ioctl(sock, SIOCSHWTSTAMP, &hwtstamp) < 0) { -+ if ((errno == EINVAL || errno == ENOTSUP) && -+ hwconfig_requested.tx_type == HWTSTAMP_TX_OFF && -+ hwconfig_requested.rx_filter == HWTSTAMP_FILTER_NONE) -+ printf("SIOCSHWTSTAMP: disabling hardware time stamping not possible\n"); -+ else -+ bail("SIOCSHWTSTAMP"); -+ } -+ printf("SIOCSHWTSTAMP: tx_type %d requested, got %d; rx_filter %d requested, got %d\n", -+ hwconfig_requested.tx_type, hwconfig.tx_type, -+ hwconfig_requested.rx_filter, hwconfig.rx_filter); -+ -+ /* bind to PTP port */ -+ addr.sin_family = AF_INET; -+ addr.sin_addr.s_addr = htonl(INADDR_ANY); -+ addr.sin_port = htons(319 /* PTP event port */); -+ if (bind(sock, -+ (struct sockaddr *)&addr, -+ sizeof(struct sockaddr_in)) < 0) -+ bail("bind"); -+ -+ /* set multicast group for outgoing packets */ -+ inet_aton("224.0.1.130", &iaddr); /* alternate PTP domain 1 */ -+ addr.sin_addr = iaddr; -+ imr.imr_multiaddr.s_addr = iaddr.s_addr; -+ imr.imr_interface.s_addr = -+ ((struct sockaddr_in *)&device.ifr_addr)->sin_addr.s_addr; -+ if (setsockopt(sock, IPPROTO_IP, IP_MULTICAST_IF, -+ &imr.imr_interface.s_addr, sizeof(struct in_addr)) < 0) -+ bail("set multicast"); -+ -+ /* join multicast group, loop our own packet */ -+ if (setsockopt(sock, IPPROTO_IP, IP_ADD_MEMBERSHIP, -+ &imr, sizeof(struct ip_mreq)) < 0) -+ bail("join multicast group"); -+ -+ if (setsockopt(sock, IPPROTO_IP, IP_MULTICAST_LOOP, -+ &ip_multicast_loop, sizeof(enabled)) < 0) { -+ bail("loop multicast"); -+ } -+ -+ /* set socket options for time stamping */ -+ if (so_timestamp && -+ setsockopt(sock, SOL_SOCKET, SO_TIMESTAMP, -+ &enabled, sizeof(enabled)) < 0) -+ bail("setsockopt SO_TIMESTAMP"); -+ -+ if (so_timestampns && -+ setsockopt(sock, SOL_SOCKET, SO_TIMESTAMPNS, -+ &enabled, sizeof(enabled)) < 0) -+ bail("setsockopt SO_TIMESTAMPNS"); -+ -+ if (so_timestamping_flags && -+ setsockopt(sock, SOL_SOCKET, SO_TIMESTAMPING, -+ &so_timestamping_flags, -+ sizeof(so_timestamping_flags)) < 0) -+ bail("setsockopt SO_TIMESTAMPING"); -+ -+ /* request IP_PKTINFO for debugging purposes */ -+ if (setsockopt(sock, SOL_IP, IP_PKTINFO, -+ &enabled, sizeof(enabled)) < 0) -+ printf("%s: %s\n", "setsockopt IP_PKTINFO", strerror(errno)); -+ -+ /* verify socket options */ -+ len = sizeof(val); -+ if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMP, &val, &len) < 0) -+ printf("%s: %s\n", "getsockopt SO_TIMESTAMP", strerror(errno)); -+ else -+ printf("SO_TIMESTAMP %d\n", val); -+ -+ if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMPNS, &val, &len) < 0) -+ printf("%s: %s\n", "getsockopt SO_TIMESTAMPNS", -+ strerror(errno)); -+ else -+ printf("SO_TIMESTAMPNS %d\n", val); -+ -+ if (getsockopt(sock, SOL_SOCKET, SO_TIMESTAMPING, &val, &len) < 0) { -+ printf("%s: %s\n", "getsockopt SO_TIMESTAMPING", -+ strerror(errno)); -+ } else { -+ printf("SO_TIMESTAMPING %d\n", val); -+ if (val != so_timestamping_flags) -+ printf(" not the expected value %d\n", -+ so_timestamping_flags); -+ } -+ -+ /* send packets forever every five seconds */ -+ gettimeofday(&next, 0); -+ next.tv_sec = (next.tv_sec + 1) / 5 * 5; -+ next.tv_usec = 0; -+ while (1) { -+ struct timeval now; -+ struct timeval delta; -+ long delta_us; -+ int res; -+ fd_set readfs, errorfs; -+ -+ gettimeofday(&now, 0); -+ delta_us = (long)(next.tv_sec - now.tv_sec) * 1000000 + -+ (long)(next.tv_usec - now.tv_usec); -+ if (delta_us > 0) { -+ /* continue waiting for timeout or data */ -+ delta.tv_sec = delta_us / 1000000; -+ delta.tv_usec = delta_us % 1000000; -+ -+ FD_ZERO(&readfs); -+ FD_ZERO(&errorfs); -+ FD_SET(sock, &readfs); -+ FD_SET(sock, &errorfs); -+ printf("%ld.%06ld: select %ldus\n", -+ (long)now.tv_sec, (long)now.tv_usec, -+ delta_us); -+ res = select(sock + 1, &readfs, 0, &errorfs, &delta); -+ gettimeofday(&now, 0); -+ printf("%ld.%06ld: select returned: %d, %s\n", -+ (long)now.tv_sec, (long)now.tv_usec, -+ res, -+ res < 0 ? strerror(errno) : "success"); -+ if (res > 0) { -+ if (FD_ISSET(sock, &readfs)) -+ printf("ready for reading\n"); -+ if (FD_ISSET(sock, &errorfs)) -+ printf("has error\n"); -+ recvpacket(sock, 0, -+ siocgstamp, -+ siocgstampns); -+ recvpacket(sock, MSG_ERRQUEUE, -+ siocgstamp, -+ siocgstampns); -+ } -+ } else { -+ /* write one packet */ -+ sendpacket(sock, -+ (struct sockaddr *)&addr, -+ sizeof(addr)); -+ next.tv_sec += 5; -+ continue; -+ } -+ } -+ -+ return 0; -+} -diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c -new file mode 100644 -index 000000000000..5df07047ca86 ---- /dev/null -+++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c -@@ -0,0 +1,549 @@ -+/* -+ * Copyright 2014 Google Inc. -+ * Author: willemb@google.com (Willem de Bruijn) -+ * -+ * Test software tx timestamping, including -+ * -+ * - SCHED, SND and ACK timestamps -+ * - RAW, UDP and TCP -+ * - IPv4 and IPv6 -+ * - various packet sizes (to test GSO and TSO) -+ * -+ * Consult the command line arguments for help on running -+ * the various testcases. -+ * -+ * This test requires a dummy TCP server. -+ * A simple `nc6 [-u] -l -p $DESTPORT` will do -+ * -+ * -+ * This program is free software; you can redistribute it and/or modify it -+ * under the terms and conditions of the GNU General Public License, -+ * version 2, as published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for -+ * more details. -+ * -+ * You should have received a copy of the GNU General Public License along with -+ * this program; if not, write to the Free Software Foundation, Inc., -+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. -+ */ -+ -+#define _GNU_SOURCE -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+/* command line parameters */ -+static int cfg_proto = SOCK_STREAM; -+static int cfg_ipproto = IPPROTO_TCP; -+static int cfg_num_pkts = 4; -+static int do_ipv4 = 1; -+static int do_ipv6 = 1; -+static int cfg_payload_len = 10; -+static bool cfg_show_payload; -+static bool cfg_do_pktinfo; -+static bool cfg_loop_nodata; -+static uint16_t dest_port = 9000; -+ -+static struct sockaddr_in daddr; -+static struct sockaddr_in6 daddr6; -+static struct timespec ts_prev; -+ -+static void __print_timestamp(const char *name, struct timespec *cur, -+ uint32_t key, int payload_len) -+{ -+ if (!(cur->tv_sec | cur->tv_nsec)) -+ return; -+ -+ fprintf(stderr, " %s: %lu s %lu us (seq=%u, len=%u)", -+ name, cur->tv_sec, cur->tv_nsec / 1000, -+ key, payload_len); -+ -+ if ((ts_prev.tv_sec | ts_prev.tv_nsec)) { -+ int64_t cur_ms, prev_ms; -+ -+ cur_ms = (long) cur->tv_sec * 1000 * 1000; -+ cur_ms += cur->tv_nsec / 1000; -+ -+ prev_ms = (long) ts_prev.tv_sec * 1000 * 1000; -+ prev_ms += ts_prev.tv_nsec / 1000; -+ -+ fprintf(stderr, " (%+" PRId64 " us)", cur_ms - prev_ms); -+ } -+ -+ ts_prev = *cur; -+ fprintf(stderr, "\n"); -+} -+ -+static void print_timestamp_usr(void) -+{ -+ struct timespec ts; -+ struct timeval tv; /* avoid dependency on -lrt */ -+ -+ gettimeofday(&tv, NULL); -+ ts.tv_sec = tv.tv_sec; -+ ts.tv_nsec = tv.tv_usec * 1000; -+ -+ __print_timestamp(" USR", &ts, 0, 0); -+} -+ -+static void print_timestamp(struct scm_timestamping *tss, int tstype, -+ int tskey, int payload_len) -+{ -+ const char *tsname; -+ -+ switch (tstype) { -+ case SCM_TSTAMP_SCHED: -+ tsname = " ENQ"; -+ break; -+ case SCM_TSTAMP_SND: -+ tsname = " SND"; -+ break; -+ case SCM_TSTAMP_ACK: -+ tsname = " ACK"; -+ break; -+ default: -+ error(1, 0, "unknown timestamp type: %u", -+ tstype); -+ } -+ __print_timestamp(tsname, &tss->ts[0], tskey, payload_len); -+} -+ -+/* TODO: convert to check_and_print payload once API is stable */ -+static void print_payload(char *data, int len) -+{ -+ int i; -+ -+ if (!len) -+ return; -+ -+ if (len > 70) -+ len = 70; -+ -+ fprintf(stderr, "payload: "); -+ for (i = 0; i < len; i++) -+ fprintf(stderr, "%02hhx ", data[i]); -+ fprintf(stderr, "\n"); -+} -+ -+static void print_pktinfo(int family, int ifindex, void *saddr, void *daddr) -+{ -+ char sa[INET6_ADDRSTRLEN], da[INET6_ADDRSTRLEN]; -+ -+ fprintf(stderr, " pktinfo: ifindex=%u src=%s dst=%s\n", -+ ifindex, -+ saddr ? inet_ntop(family, saddr, sa, sizeof(sa)) : "unknown", -+ daddr ? inet_ntop(family, daddr, da, sizeof(da)) : "unknown"); -+} -+ -+static void __poll(int fd) -+{ -+ struct pollfd pollfd; -+ int ret; -+ -+ memset(&pollfd, 0, sizeof(pollfd)); -+ pollfd.fd = fd; -+ ret = poll(&pollfd, 1, 100); -+ if (ret != 1) -+ error(1, errno, "poll"); -+} -+ -+static void __recv_errmsg_cmsg(struct msghdr *msg, int payload_len) -+{ -+ struct sock_extended_err *serr = NULL; -+ struct scm_timestamping *tss = NULL; -+ struct cmsghdr *cm; -+ int batch = 0; -+ -+ for (cm = CMSG_FIRSTHDR(msg); -+ cm && cm->cmsg_len; -+ cm = CMSG_NXTHDR(msg, cm)) { -+ if (cm->cmsg_level == SOL_SOCKET && -+ cm->cmsg_type == SCM_TIMESTAMPING) { -+ tss = (void *) CMSG_DATA(cm); -+ } else if ((cm->cmsg_level == SOL_IP && -+ cm->cmsg_type == IP_RECVERR) || -+ (cm->cmsg_level == SOL_IPV6 && -+ cm->cmsg_type == IPV6_RECVERR)) { -+ serr = (void *) CMSG_DATA(cm); -+ if (serr->ee_errno != ENOMSG || -+ serr->ee_origin != SO_EE_ORIGIN_TIMESTAMPING) { -+ fprintf(stderr, "unknown ip error %d %d\n", -+ serr->ee_errno, -+ serr->ee_origin); -+ serr = NULL; -+ } -+ } else if (cm->cmsg_level == SOL_IP && -+ cm->cmsg_type == IP_PKTINFO) { -+ struct in_pktinfo *info = (void *) CMSG_DATA(cm); -+ print_pktinfo(AF_INET, info->ipi_ifindex, -+ &info->ipi_spec_dst, &info->ipi_addr); -+ } else if (cm->cmsg_level == SOL_IPV6 && -+ cm->cmsg_type == IPV6_PKTINFO) { -+ struct in6_pktinfo *info6 = (void *) CMSG_DATA(cm); -+ print_pktinfo(AF_INET6, info6->ipi6_ifindex, -+ NULL, &info6->ipi6_addr); -+ } else -+ fprintf(stderr, "unknown cmsg %d,%d\n", -+ cm->cmsg_level, cm->cmsg_type); -+ -+ if (serr && tss) { -+ print_timestamp(tss, serr->ee_info, serr->ee_data, -+ payload_len); -+ serr = NULL; -+ tss = NULL; -+ batch++; -+ } -+ } -+ -+ if (batch > 1) -+ fprintf(stderr, "batched %d timestamps\n", batch); -+} -+ -+static int recv_errmsg(int fd) -+{ -+ static char ctrl[1024 /* overprovision*/]; -+ static struct msghdr msg; -+ struct iovec entry; -+ static char *data; -+ int ret = 0; -+ -+ data = malloc(cfg_payload_len); -+ if (!data) -+ error(1, 0, "malloc"); -+ -+ memset(&msg, 0, sizeof(msg)); -+ memset(&entry, 0, sizeof(entry)); -+ memset(ctrl, 0, sizeof(ctrl)); -+ -+ entry.iov_base = data; -+ entry.iov_len = cfg_payload_len; -+ msg.msg_iov = &entry; -+ msg.msg_iovlen = 1; -+ msg.msg_name = NULL; -+ msg.msg_namelen = 0; -+ msg.msg_control = ctrl; -+ msg.msg_controllen = sizeof(ctrl); -+ -+ ret = recvmsg(fd, &msg, MSG_ERRQUEUE); -+ if (ret == -1 && errno != EAGAIN) -+ error(1, errno, "recvmsg"); -+ -+ if (ret >= 0) { -+ __recv_errmsg_cmsg(&msg, ret); -+ if (cfg_show_payload) -+ print_payload(data, cfg_payload_len); -+ } -+ -+ free(data); -+ return ret == -1; -+} -+ -+static void do_test(int family, unsigned int opt) -+{ -+ char *buf; -+ int fd, i, val = 1, total_len; -+ -+ if (family == AF_INET6 && cfg_proto != SOCK_STREAM) { -+ /* due to lack of checksum generation code */ -+ fprintf(stderr, "test: skipping datagram over IPv6\n"); -+ return; -+ } -+ -+ total_len = cfg_payload_len; -+ if (cfg_proto == SOCK_RAW) { -+ total_len += sizeof(struct udphdr); -+ if (cfg_ipproto == IPPROTO_RAW) -+ total_len += sizeof(struct iphdr); -+ } -+ -+ buf = malloc(total_len); -+ if (!buf) -+ error(1, 0, "malloc"); -+ -+ fd = socket(family, cfg_proto, cfg_ipproto); -+ if (fd < 0) -+ error(1, errno, "socket"); -+ -+ if (cfg_proto == SOCK_STREAM) { -+ if (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, -+ (char*) &val, sizeof(val))) -+ error(1, 0, "setsockopt no nagle"); -+ -+ if (family == PF_INET) { -+ if (connect(fd, (void *) &daddr, sizeof(daddr))) -+ error(1, errno, "connect ipv4"); -+ } else { -+ if (connect(fd, (void *) &daddr6, sizeof(daddr6))) -+ error(1, errno, "connect ipv6"); -+ } -+ } -+ -+ if (cfg_do_pktinfo) { -+ if (family == AF_INET6) { -+ if (setsockopt(fd, SOL_IPV6, IPV6_RECVPKTINFO, -+ &val, sizeof(val))) -+ error(1, errno, "setsockopt pktinfo ipv6"); -+ } else { -+ if (setsockopt(fd, SOL_IP, IP_PKTINFO, -+ &val, sizeof(val))) -+ error(1, errno, "setsockopt pktinfo ipv4"); -+ } -+ } -+ -+ opt |= SOF_TIMESTAMPING_SOFTWARE | -+ SOF_TIMESTAMPING_OPT_CMSG | -+ SOF_TIMESTAMPING_OPT_ID; -+ if (cfg_loop_nodata) -+ opt |= SOF_TIMESTAMPING_OPT_TSONLY; -+ -+ if (setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, -+ (char *) &opt, sizeof(opt))) -+ error(1, 0, "setsockopt timestamping"); -+ -+ for (i = 0; i < cfg_num_pkts; i++) { -+ memset(&ts_prev, 0, sizeof(ts_prev)); -+ memset(buf, 'a' + i, total_len); -+ -+ if (cfg_proto == SOCK_RAW) { -+ struct udphdr *udph; -+ int off = 0; -+ -+ if (cfg_ipproto == IPPROTO_RAW) { -+ struct iphdr *iph = (void *) buf; -+ -+ memset(iph, 0, sizeof(*iph)); -+ iph->ihl = 5; -+ iph->version = 4; -+ iph->ttl = 2; -+ iph->daddr = daddr.sin_addr.s_addr; -+ iph->protocol = IPPROTO_UDP; -+ /* kernel writes saddr, csum, len */ -+ -+ off = sizeof(*iph); -+ } -+ -+ udph = (void *) buf + off; -+ udph->source = ntohs(9000); /* random spoof */ -+ udph->dest = ntohs(dest_port); -+ udph->len = ntohs(sizeof(*udph) + cfg_payload_len); -+ udph->check = 0; /* not allowed for IPv6 */ -+ } -+ -+ print_timestamp_usr(); -+ if (cfg_proto != SOCK_STREAM) { -+ if (family == PF_INET) -+ val = sendto(fd, buf, total_len, 0, (void *) &daddr, sizeof(daddr)); -+ else -+ val = sendto(fd, buf, total_len, 0, (void *) &daddr6, sizeof(daddr6)); -+ } else { -+ val = send(fd, buf, cfg_payload_len, 0); -+ } -+ if (val != total_len) -+ error(1, errno, "send"); -+ -+ /* wait for all errors to be queued, else ACKs arrive OOO */ -+ usleep(50 * 1000); -+ -+ __poll(fd); -+ -+ while (!recv_errmsg(fd)) {} -+ } -+ -+ if (close(fd)) -+ error(1, errno, "close"); -+ -+ free(buf); -+ usleep(400 * 1000); -+} -+ -+static void __attribute__((noreturn)) usage(const char *filepath) -+{ -+ fprintf(stderr, "\nUsage: %s [options] hostname\n" -+ "\nwhere options are:\n" -+ " -4: only IPv4\n" -+ " -6: only IPv6\n" -+ " -h: show this message\n" -+ " -I: request PKTINFO\n" -+ " -l N: send N bytes at a time\n" -+ " -n: set no-payload option\n" -+ " -r: use raw\n" -+ " -R: use raw (IP_HDRINCL)\n" -+ " -p N: connect to port N\n" -+ " -u: use udp\n" -+ " -x: show payload (up to 70 bytes)\n", -+ filepath); -+ exit(1); -+} -+ -+static void parse_opt(int argc, char **argv) -+{ -+ int proto_count = 0; -+ char c; -+ -+ while ((c = getopt(argc, argv, "46hIl:np:rRux")) != -1) { -+ switch (c) { -+ case '4': -+ do_ipv6 = 0; -+ break; -+ case '6': -+ do_ipv4 = 0; -+ break; -+ case 'I': -+ cfg_do_pktinfo = true; -+ break; -+ case 'n': -+ cfg_loop_nodata = true; -+ break; -+ case 'r': -+ proto_count++; -+ cfg_proto = SOCK_RAW; -+ cfg_ipproto = IPPROTO_UDP; -+ break; -+ case 'R': -+ proto_count++; -+ cfg_proto = SOCK_RAW; -+ cfg_ipproto = IPPROTO_RAW; -+ break; -+ case 'u': -+ proto_count++; -+ cfg_proto = SOCK_DGRAM; -+ cfg_ipproto = IPPROTO_UDP; -+ break; -+ case 'l': -+ cfg_payload_len = strtoul(optarg, NULL, 10); -+ break; -+ case 'p': -+ dest_port = strtoul(optarg, NULL, 10); -+ break; -+ case 'x': -+ cfg_show_payload = true; -+ break; -+ case 'h': -+ default: -+ usage(argv[0]); -+ } -+ } -+ -+ if (!cfg_payload_len) -+ error(1, 0, "payload may not be nonzero"); -+ if (cfg_proto != SOCK_STREAM && cfg_payload_len > 1472) -+ error(1, 0, "udp packet might exceed expected MTU"); -+ if (!do_ipv4 && !do_ipv6) -+ error(1, 0, "pass -4 or -6, not both"); -+ if (proto_count > 1) -+ error(1, 0, "pass -r, -R or -u, not multiple"); -+ -+ if (optind != argc - 1) -+ error(1, 0, "missing required hostname argument"); -+} -+ -+static void resolve_hostname(const char *hostname) -+{ -+ struct addrinfo *addrs, *cur; -+ int have_ipv4 = 0, have_ipv6 = 0; -+ -+ if (getaddrinfo(hostname, NULL, NULL, &addrs)) -+ error(1, errno, "getaddrinfo"); -+ -+ cur = addrs; -+ while (cur && !have_ipv4 && !have_ipv6) { -+ if (!have_ipv4 && cur->ai_family == AF_INET) { -+ memcpy(&daddr, cur->ai_addr, sizeof(daddr)); -+ daddr.sin_port = htons(dest_port); -+ have_ipv4 = 1; -+ } -+ else if (!have_ipv6 && cur->ai_family == AF_INET6) { -+ memcpy(&daddr6, cur->ai_addr, sizeof(daddr6)); -+ daddr6.sin6_port = htons(dest_port); -+ have_ipv6 = 1; -+ } -+ cur = cur->ai_next; -+ } -+ if (addrs) -+ freeaddrinfo(addrs); -+ -+ do_ipv4 &= have_ipv4; -+ do_ipv6 &= have_ipv6; -+} -+ -+static void do_main(int family) -+{ -+ fprintf(stderr, "family: %s\n", -+ family == PF_INET ? "INET" : "INET6"); -+ -+ fprintf(stderr, "test SND\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_SOFTWARE); -+ -+ fprintf(stderr, "test ENQ\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_SCHED); -+ -+ fprintf(stderr, "test ENQ + SND\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_SCHED | -+ SOF_TIMESTAMPING_TX_SOFTWARE); -+ -+ if (cfg_proto == SOCK_STREAM) { -+ fprintf(stderr, "\ntest ACK\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_ACK); -+ -+ fprintf(stderr, "\ntest SND + ACK\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_SOFTWARE | -+ SOF_TIMESTAMPING_TX_ACK); -+ -+ fprintf(stderr, "\ntest ENQ + SND + ACK\n"); -+ do_test(family, SOF_TIMESTAMPING_TX_SCHED | -+ SOF_TIMESTAMPING_TX_SOFTWARE | -+ SOF_TIMESTAMPING_TX_ACK); -+ } -+} -+ -+const char *sock_names[] = { NULL, "TCP", "UDP", "RAW" }; -+ -+int main(int argc, char **argv) -+{ -+ if (argc == 1) -+ usage(argv[0]); -+ -+ parse_opt(argc, argv); -+ resolve_hostname(argv[argc - 1]); -+ -+ fprintf(stderr, "protocol: %s\n", sock_names[cfg_proto]); -+ fprintf(stderr, "payload: %u\n", cfg_payload_len); -+ fprintf(stderr, "server port: %u\n", dest_port); -+ fprintf(stderr, "\n"); -+ -+ if (do_ipv4) -+ do_main(PF_INET); -+ if (do_ipv6) -+ do_main(PF_INET6); -+ -+ return 0; -+} -diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c -index 4f70d12e392d..eddce59986ee 100644 ---- a/virt/kvm/async_pf.c -+++ b/virt/kvm/async_pf.c -@@ -80,7 +80,7 @@ static void async_pf_execute(struct work_struct *work) - - might_sleep(); - -- get_user_pages_unlocked(NULL, mm, addr, 1, 1, 0, NULL); -+ get_user_pages_unlocked(NULL, mm, addr, 1, NULL, FOLL_WRITE); - kvm_async_page_present_sync(vcpu, apf); - - spin_lock(&vcpu->async_pf.lock); -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index b814ae6822b6..e4be695eb789 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -1352,10 +1352,15 @@ static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault, - npages = get_user_page_nowait(current, current->mm, - addr, write_fault, page); - up_read(¤t->mm->mmap_sem); -- } else -+ } else { -+ unsigned int flags = FOLL_TOUCH | FOLL_HWPOISON; -+ -+ if (write_fault) -+ flags |= FOLL_WRITE; -+ - npages = __get_user_pages_unlocked(current, current->mm, addr, 1, -- write_fault, 0, page, -- FOLL_TOUCH|FOLL_HWPOISON); -+ page, flags); -+ } - if (npages != 1) - return npages; - -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index a83798cc448b..611bf28851c6 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -141,7 +141,7 @@ static void seq_print_vma_name(struct seq_file *m, struct vm_area_struct *vma) - struct page *page; - - pages_pinned = get_user_pages(current, mm, page_start_vaddr, -- 1, 0, 0, &page, NULL); -+ 1, 0, &page, NULL); - if (pages_pinned < 1) { - seq_puts(m, "]"); - return; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168_mali.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168_mali.patch deleted file mode 100644 index d7e321ec60ca..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.167-168_mali.patch +++ /dev/null @@ -1,49 +0,0 @@ -diff --git a/drivers/gpu/arm/midgard/mali_kbase_mem.c b/drivers/gpu/arm/midgard/mali_kbase_mem.c -index 4a223e8ee..42e0df5db 100644 ---- a/drivers/gpu/arm/midgard/mali_kbase_mem.c -+++ b/drivers/gpu/arm/midgard/mali_kbase_mem.c -@@ -2182,14 +2182,14 @@ static int kbase_jd_user_buf_map(struct kbase_context *kctx, - pinned_pages = get_user_pages(NULL, mm, - address, - alloc->imported.user_buf.nr_pages, -- reg->flags & KBASE_REG_GPU_WR, -- 0, pages, NULL); -+ reg->flags & KBASE_REG_GPU_WR ? FOLL_WRITE : 0, -+ pages, NULL); - #elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0) - pinned_pages = get_user_pages_remote(NULL, mm, - address, - alloc->imported.user_buf.nr_pages, -- reg->flags & KBASE_REG_GPU_WR, -- 0, pages, NULL); -+ reg->flags & KBASE_REG_GPU_WR ? FOLL_WRITE : 0, -+ pages, NULL); - #elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0) - pinned_pages = get_user_pages_remote(NULL, mm, - address, -@@ -2201,7 +2201,7 @@ static int kbase_jd_user_buf_map(struct kbase_context *kctx, - address, - alloc->imported.user_buf.nr_pages, - reg->flags & KBASE_REG_GPU_WR ? FOLL_WRITE : 0, -- pages, NULL, NULL); -+ pages, NULL); - #endif - - if (pinned_pages <= 0) -diff --git a/drivers/gpu/arm/midgard/mali_kbase_mem_linux.c b/drivers/gpu/arm/midgard/mali_kbase_mem_linux.c -index eea429a8..76610fda 100644 ---- a/drivers/gpu/arm/midgard/mali_kbase_mem_linux.c -+++ b/drivers/gpu/arm/midgard/mali_kbase_mem_linux.c -@@ -1161,10 +1161,8 @@ static struct kbase_va_region *kbase_mem_from_user_buffer( - - #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 6, 0) - faulted_pages = get_user_pages(current, current->mm, address, *va_pages, -- reg->flags & KBASE_REG_GPU_WR, 0, pages, NULL); --#elif LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0) -- faulted_pages = get_user_pages(address, *va_pages, -- reg->flags & KBASE_REG_GPU_WR, 0, pages, NULL); -+ reg->flags & KBASE_REG_GPU_WR ? FOLL_WRITE : 0, -+ pages, NULL); - #else - faulted_pages = get_user_pages(address, *va_pages, - reg->flags & KBASE_REG_GPU_WR ? FOLL_WRITE : 0, diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.168-169.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.168-169.patch deleted file mode 100644 index b0ece2fd13b2..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.168-169.patch +++ /dev/null @@ -1,1260 +0,0 @@ -diff --git a/Makefile b/Makefile -index 082f82471b51..0d41b0626c0c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 168 -+SUBLEVEL = 169 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h -index cb69299a492e..f120d823e8c2 100644 ---- a/arch/arc/include/asm/io.h -+++ b/arch/arc/include/asm/io.h -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_ISA_ARCV2 - #include -@@ -85,6 +86,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr) - return w; - } - -+/* -+ * {read,write}s{b,w,l}() repeatedly access the same IO address in -+ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory, -+ * @count times -+ */ -+#define __raw_readsx(t,f) \ -+static inline void __raw_reads##f(const volatile void __iomem *addr, \ -+ void *ptr, unsigned int count) \ -+{ \ -+ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \ -+ u##t *buf = ptr; \ -+ \ -+ if (!count) \ -+ return; \ -+ \ -+ /* Some ARC CPU's don't support unaligned accesses */ \ -+ if (is_aligned) { \ -+ do { \ -+ u##t x = __raw_read##f(addr); \ -+ *buf++ = x; \ -+ } while (--count); \ -+ } else { \ -+ do { \ -+ u##t x = __raw_read##f(addr); \ -+ put_unaligned(x, buf++); \ -+ } while (--count); \ -+ } \ -+} -+ -+#define __raw_readsb __raw_readsb -+__raw_readsx(8, b) -+#define __raw_readsw __raw_readsw -+__raw_readsx(16, w) -+#define __raw_readsl __raw_readsl -+__raw_readsx(32, l) -+ - #define __raw_writeb __raw_writeb - static inline void __raw_writeb(u8 b, volatile void __iomem *addr) - { -@@ -117,6 +154,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) - - } - -+#define __raw_writesx(t,f) \ -+static inline void __raw_writes##f(volatile void __iomem *addr, \ -+ const void *ptr, unsigned int count) \ -+{ \ -+ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \ -+ const u##t *buf = ptr; \ -+ \ -+ if (!count) \ -+ return; \ -+ \ -+ /* Some ARC CPU's don't support unaligned accesses */ \ -+ if (is_aligned) { \ -+ do { \ -+ __raw_write##f(*buf++, addr); \ -+ } while (--count); \ -+ } else { \ -+ do { \ -+ __raw_write##f(get_unaligned(buf++), addr); \ -+ } while (--count); \ -+ } \ -+} -+ -+#define __raw_writesb __raw_writesb -+__raw_writesx(8, b) -+#define __raw_writesw __raw_writesw -+__raw_writesx(16, w) -+#define __raw_writesl __raw_writesl -+__raw_writesx(32, l) -+ - /* - * MMIO can also get buffered/optimized in micro-arch, so barriers needed - * Based on ARM model for the typical use case -@@ -132,10 +198,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) - #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; }) - #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; }) - #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; }) -+#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); }) -+#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); }) -+#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); }) - - #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); }) - #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); }) - #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); }) -+#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); }) -+#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); }) -+#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); }) - - /* - * Relaxed API for drivers which can handle barrier ordering themselves -diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S -index a134d8a13d00..11d699af30ed 100644 ---- a/arch/arm/mm/cache-v7.S -+++ b/arch/arm/mm/cache-v7.S -@@ -359,14 +359,16 @@ v7_dma_inv_range: - ALT_UP(W(nop)) - #endif - mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line -+ addne r0, r0, r2 - - tst r1, r3 - bic r1, r1, r3 - mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line --1: -- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line -- add r0, r0, r2 - cmp r0, r1 -+1: -+ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line -+ addlo r0, r0, r2 -+ cmplo r0, r1 - blo 1b - dsb st - ret lr -diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile -index 99e4487248ff..57003d1bd243 100644 ---- a/arch/powerpc/boot/Makefile -+++ b/arch/powerpc/boot/Makefile -@@ -70,7 +70,8 @@ $(addprefix $(obj)/,$(zlib) cuboot-c2k.o gunzip_util.o main.o): \ - libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c - libfdtheader := fdt.h libfdt.h libfdt_internal.h - --$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o): \ -+$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o \ -+ treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \ - $(addprefix $(obj)/,$(libfdtheader)) - - src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \ -diff --git a/arch/powerpc/kernel/msi.c b/arch/powerpc/kernel/msi.c -index dab616a33b8d..f2197654be07 100644 ---- a/arch/powerpc/kernel/msi.c -+++ b/arch/powerpc/kernel/msi.c -@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev) - { - struct pci_controller *phb = pci_bus_to_host(dev->bus); - -- phb->controller_ops.teardown_msi_irqs(dev); -+ /* -+ * We can be called even when arch_setup_msi_irqs() returns -ENOSYS, -+ * so check the pointer again. -+ */ -+ if (phb->controller_ops.teardown_msi_irqs) -+ phb->controller_ops.teardown_msi_irqs(dev); - } -diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c -index 524142117296..82324fc25d5e 100644 ---- a/arch/x86/platform/efi/early_printk.c -+++ b/arch/x86/platform/efi/early_printk.c -@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num) - num--; - } - -- if (efi_x >= si->lfb_width) { -+ if (efi_x + font->width > si->lfb_width) { - efi_x = 0; - efi_y += font->height; - } -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index ba514fa733de..d543172b20b3 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4297,6 +4297,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, -+ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, - - /* -diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c -index 61893fe73251..18b6c9b55b95 100644 ---- a/drivers/clk/mmp/clk.c -+++ b/drivers/clk/mmp/clk.c -@@ -182,7 +182,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id, - pr_err("CLK %d has invalid pointer %p\n", id, clk); - return; - } -- if (id > unit->nr_clks) { -+ if (id >= unit->nr_clks) { - pr_err("CLK %d is invalid\n", id); - return; - } -diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c -index 7eb253bc24df..221eaea651d4 100644 ---- a/drivers/gpu/drm/msm/msm_atomic.c -+++ b/drivers/gpu/drm/msm/msm_atomic.c -@@ -107,7 +107,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev, - if (old_state->legacy_cursor_update) - continue; - -+ if (drm_crtc_vblank_get(crtc)) -+ continue; -+ - kms->funcs->wait_for_crtc_commit_done(kms, crtc); -+ -+ drm_crtc_vblank_put(crtc); - } - } - -diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c -index c335cc7852f9..9c9fd2e87a4b 100644 ---- a/drivers/i2c/busses/i2c-axxia.c -+++ b/drivers/i2c/busses/i2c-axxia.c -@@ -74,8 +74,7 @@ - MST_STATUS_ND) - #define MST_STATUS_ERR (MST_STATUS_NAK | \ - MST_STATUS_AL | \ -- MST_STATUS_IP | \ -- MST_STATUS_TSS) -+ MST_STATUS_IP) - #define MST_TX_BYTES_XFRD 0x50 - #define MST_RX_BYTES_XFRD 0x54 - #define SCL_HIGH_PERIOD 0x80 -@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev) - */ - if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) { - idev->msg_err = -EPROTO; -- i2c_int_disable(idev, ~0); -+ i2c_int_disable(idev, ~MST_STATUS_TSS); - complete(&idev->msg_complete); - break; - } -@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) - - if (status & MST_STATUS_SCC) { - /* Stop completed */ -- i2c_int_disable(idev, ~0); -+ i2c_int_disable(idev, ~MST_STATUS_TSS); - complete(&idev->msg_complete); - } else if (status & MST_STATUS_SNS) { - /* Transfer done */ -- i2c_int_disable(idev, ~0); -+ i2c_int_disable(idev, ~MST_STATUS_TSS); - if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) - axxia_i2c_empty_rx_fifo(idev); - complete(&idev->msg_complete); -+ } else if (status & MST_STATUS_TSS) { -+ /* Transfer timeout */ -+ idev->msg_err = -ETIMEDOUT; -+ i2c_int_disable(idev, ~MST_STATUS_TSS); -+ complete(&idev->msg_complete); - } else if (unlikely(status & MST_STATUS_ERR)) { - /* Transfer error */ - i2c_int_disable(idev, ~0); -@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) - u32 rx_xfer, tx_xfer; - u32 addr_1, addr_2; - unsigned long time_left; -+ unsigned int wt_value; - - idev->msg = msg; - idev->msg_xfrd = 0; -- idev->msg_err = 0; - reinit_completion(&idev->msg_complete); - - if (i2c_m_ten(msg)) { -@@ -382,9 +386,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) - else if (axxia_i2c_fill_tx_fifo(idev) != 0) - int_mask |= MST_STATUS_TFL; - -+ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL)); -+ /* Disable wait timer temporarly */ -+ writel(wt_value, idev->base + WAIT_TIMER_CONTROL); -+ /* Check if timeout error happened */ -+ if (idev->msg_err) -+ goto out; -+ - /* Start manual mode */ - writel(CMD_MANUAL, idev->base + MST_COMMAND); - -+ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL); -+ - i2c_int_enable(idev, int_mask); - - time_left = wait_for_completion_timeout(&idev->msg_complete, -@@ -395,13 +408,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) - if (readl(idev->base + MST_COMMAND) & CMD_BUSY) - dev_warn(idev->dev, "busy after xfer\n"); - -- if (time_left == 0) -+ if (time_left == 0) { - idev->msg_err = -ETIMEDOUT; -- -- if (idev->msg_err == -ETIMEDOUT) - i2c_recover_bus(&idev->adapter); -+ axxia_i2c_init(idev); -+ } - -- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO) -+out: -+ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO && -+ idev->msg_err != -ETIMEDOUT) - axxia_i2c_init(idev); - - return idev->msg_err; -@@ -409,7 +424,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) - - static int axxia_i2c_stop(struct axxia_i2c_dev *idev) - { -- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC; -+ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS; - unsigned long time_left; - - reinit_completion(&idev->msg_complete); -@@ -436,6 +451,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) - int i; - int ret = 0; - -+ idev->msg_err = 0; -+ i2c_int_enable(idev, MST_STATUS_TSS); -+ - for (i = 0; ret == 0 && i < num; ++i) - ret = axxia_i2c_xfer_msg(idev, &msgs[i]); - -diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c -index efefcfa24a4c..d2178f701b41 100644 ---- a/drivers/i2c/busses/i2c-scmi.c -+++ b/drivers/i2c/busses/i2c-scmi.c -@@ -364,6 +364,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) - { - struct acpi_smbus_cmi *smbus_cmi; - const struct acpi_device_id *id; -+ int ret; - - smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL); - if (!smbus_cmi) -@@ -385,8 +386,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) - acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1, - acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL); - -- if (smbus_cmi->cap_info == 0) -+ if (smbus_cmi->cap_info == 0) { -+ ret = -ENODEV; - goto err; -+ } - - snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name), - "SMBus CMI adapter %s", -@@ -397,7 +400,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) - smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD; - smbus_cmi->adapter.dev.parent = &device->dev; - -- if (i2c_add_adapter(&smbus_cmi->adapter)) { -+ ret = i2c_add_adapter(&smbus_cmi->adapter); -+ if (ret) { - dev_err(&device->dev, "Couldn't register adapter!\n"); - goto err; - } -@@ -407,7 +411,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) - err: - kfree(smbus_cmi); - device->driver_data = NULL; -- return -EIO; -+ return ret; - } - - static int acpi_smbus_cmi_remove(struct acpi_device *device) -diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c -index 96a345248224..0add5bb3cee8 100644 ---- a/drivers/ide/pmac.c -+++ b/drivers/ide/pmac.c -@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif) - struct device_node *root = of_find_node_by_path("/"); - const char *model = of_get_property(root, "model", NULL); - -+ of_node_put(root); - /* Get cable type from device-tree. */ - if (cable && !strncmp(cable, "80-", 3)) { - /* Some drives fail to detect 80c cable in PowerBook */ -diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c -index 6639b2b8528a..f78c464899db 100644 ---- a/drivers/input/keyboard/omap4-keypad.c -+++ b/drivers/input/keyboard/omap4-keypad.c -@@ -60,8 +60,18 @@ - - /* OMAP4 values */ - #define OMAP4_VAL_IRQDISABLE 0x0 --#define OMAP4_VAL_DEBOUNCINGTIME 0x7 --#define OMAP4_VAL_PVT 0x7 -+ -+/* -+ * Errata i689: If a key is released for a time shorter than debounce time, -+ * the keyboard will idle and never detect the key release. The workaround -+ * is to use at least a 12ms debounce time. See omap5432 TRM chapter -+ * "26.4.6.2 Keyboard Controller Timer" for more information. -+ */ -+#define OMAP4_KEYPAD_PTV_DIV_128 0x6 -+#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \ -+ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1) -+#define OMAP4_VAL_DEBOUNCINGTIME_16MS \ -+ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128) - - enum { - KBD_REVISION_OMAP4 = 0, -@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input) - - kbd_writel(keypad_data, OMAP4_KBD_CTRL, - OMAP4_DEF_CTRL_NOSOFTMODE | -- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT)); -+ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT)); - kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME, -- OMAP4_VAL_DEBOUNCINGTIME); -+ OMAP4_VAL_DEBOUNCINGTIME_16MS); - /* clear pending interrupts */ - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, - kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); -diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c -index b9958a123594..5bcf4f45f8b4 100644 ---- a/drivers/mmc/host/omap.c -+++ b/drivers/mmc/host/omap.c -@@ -105,6 +105,7 @@ struct mmc_omap_slot { - unsigned int vdd; - u16 saved_con; - u16 bus_mode; -+ u16 power_mode; - unsigned int fclk_freq; - - struct tasklet_struct cover_tasklet; -@@ -1156,7 +1157,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - struct mmc_omap_slot *slot = mmc_priv(mmc); - struct mmc_omap_host *host = slot->host; - int i, dsor; -- int clk_enabled; -+ int clk_enabled, init_stream; - - mmc_omap_select_slot(slot, 0); - -@@ -1166,6 +1167,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - slot->vdd = ios->vdd; - - clk_enabled = 0; -+ init_stream = 0; - switch (ios->power_mode) { - case MMC_POWER_OFF: - mmc_omap_set_power(slot, 0, ios->vdd); -@@ -1173,13 +1175,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - case MMC_POWER_UP: - /* Cannot touch dsor yet, just power up MMC */ - mmc_omap_set_power(slot, 1, ios->vdd); -+ slot->power_mode = ios->power_mode; - goto exit; - case MMC_POWER_ON: - mmc_omap_fclk_enable(host, 1); - clk_enabled = 1; - dsor |= 1 << 11; -+ if (slot->power_mode != MMC_POWER_ON) -+ init_stream = 1; - break; - } -+ slot->power_mode = ios->power_mode; - - if (slot->bus_mode != ios->bus_mode) { - if (slot->pdata->set_bus_mode != NULL) -@@ -1195,7 +1201,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - for (i = 0; i < 2; i++) - OMAP_MMC_WRITE(host, CON, dsor); - slot->saved_con = dsor; -- if (ios->power_mode == MMC_POWER_ON) { -+ if (init_stream) { - /* worst case at 400kHz, 80 cycles makes 200 microsecs */ - int usecs = 250; - -@@ -1233,6 +1239,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id) - slot->host = host; - slot->mmc = mmc; - slot->id = id; -+ slot->power_mode = MMC_POWER_UNDEFINED; - slot->pdata = &host->pdata->slots[id]; - - host->slots[id] = slot; -diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c -index 940e2ebbdea8..399c627b15cc 100644 ---- a/drivers/net/bonding/bond_3ad.c -+++ b/drivers/net/bonding/bond_3ad.c -@@ -2011,6 +2011,9 @@ void bond_3ad_unbind_slave(struct slave *slave) - aggregator->aggregator_identifier); - - /* Tell the partner that this port is not suitable for aggregation */ -+ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION; -+ port->actor_oper_port_state &= ~AD_STATE_COLLECTING; -+ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING; - port->actor_oper_port_state &= ~AD_STATE_AGGREGATION; - __update_lacpdu_from_port(port); - ad_lacpdu_send(port); -diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c -index 0527f485c3dc..973fcd442aea 100644 ---- a/drivers/net/dsa/mv88e6060.c -+++ b/drivers/net/dsa/mv88e6060.c -@@ -98,8 +98,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds) - /* Reset the switch. */ - REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL, - GLOBAL_ATU_CONTROL_SWRESET | -- GLOBAL_ATU_CONTROL_ATUSIZE_1024 | -- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN); -+ GLOBAL_ATU_CONTROL_LEARNDIS); - - /* Wait up to one second for reset to complete. */ - timeout = jiffies + 1 * HZ; -@@ -124,13 +123,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds) - */ - REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536); - -- /* Enable automatic address learning, set the address -- * database size to 1024 entries, and set the default aging -- * time to 5 minutes. -+ /* Disable automatic address learning. - */ - REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL, -- GLOBAL_ATU_CONTROL_ATUSIZE_1024 | -- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN); -+ GLOBAL_ATU_CONTROL_LEARNDIS); - - return 0; - } -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index ab480ea6d95a..0d1abcfec003 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -3195,16 +3195,16 @@ static int __init init_mac80211_hwsim(void) - if (err) - return err; - -+ err = hwsim_init_netlink(); -+ if (err) -+ goto out_unregister_driver; -+ - hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim"); - if (IS_ERR(hwsim_class)) { - err = PTR_ERR(hwsim_class); -- goto out_unregister_driver; -+ goto out_exit_netlink; - } - -- err = hwsim_init_netlink(); -- if (err < 0) -- goto out_unregister_driver; -- - for (i = 0; i < radios; i++) { - struct hwsim_new_radio_params param = { 0 }; - -@@ -3310,6 +3310,8 @@ out_free_mon: - free_netdev(hwsim_mon); - out_free_radios: - mac80211_hwsim_free(); -+out_exit_netlink: -+ hwsim_exit_netlink(); - out_unregister_driver: - platform_driver_unregister(&mac80211_hwsim_driver); - return err; -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -index a7c81e988656..383977ea3a3c 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -@@ -568,7 +568,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = { - SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 11), - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out"), -- SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 1)), /* PH_EINT11 */ -+ SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 11)), /* PH_EINT11 */ - }; - - static const struct sunxi_pinctrl_desc sun8i_a83t_pinctrl_data = { -diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c -index a161fbf6f172..63ad5b543f14 100644 ---- a/drivers/rtc/rtc-snvs.c -+++ b/drivers/rtc/rtc-snvs.c -@@ -47,49 +47,83 @@ struct snvs_rtc_data { - struct clk *clk; - }; - -+/* Read 64 bit timer register, which could be in inconsistent state */ -+static u64 rtc_read_lpsrt(struct snvs_rtc_data *data) -+{ -+ u32 msb, lsb; -+ -+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &msb); -+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &lsb); -+ return (u64)msb << 32 | lsb; -+} -+ -+/* Read the secure real time counter, taking care to deal with the cases of the -+ * counter updating while being read. -+ */ - static u32 rtc_read_lp_counter(struct snvs_rtc_data *data) - { - u64 read1, read2; -- u32 val; -+ unsigned int timeout = 100; - -+ /* As expected, the registers might update between the read of the LSB -+ * reg and the MSB reg. It's also possible that one register might be -+ * in partially modified state as well. -+ */ -+ read1 = rtc_read_lpsrt(data); - do { -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val); -- read1 = val; -- read1 <<= 32; -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val); -- read1 |= val; -- -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCMR, &val); -- read2 = val; -- read2 <<= 32; -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &val); -- read2 |= val; -- } while (read1 != read2); -+ read2 = read1; -+ read1 = rtc_read_lpsrt(data); -+ } while (read1 != read2 && --timeout); -+ if (!timeout) -+ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n"); - - /* Convert 47-bit counter to 32-bit raw second count */ - return (u32) (read1 >> CNTR_TO_SECS_SH); - } - --static void rtc_write_sync_lp(struct snvs_rtc_data *data) -+/* Just read the lsb from the counter, dealing with inconsistent state */ -+static int rtc_read_lp_counter_lsb(struct snvs_rtc_data *data, u32 *lsb) - { -- u32 count1, count2, count3; -- int i; -- -- /* Wait for 3 CKIL cycles */ -- for (i = 0; i < 3; i++) { -- do { -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1); -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2); -- } while (count1 != count2); -- -- /* Now wait until counter value changes */ -- do { -- do { -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count2); -- regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count3); -- } while (count2 != count3); -- } while (count3 == count1); -+ u32 count1, count2; -+ unsigned int timeout = 100; -+ -+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1); -+ do { -+ count2 = count1; -+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1); -+ } while (count1 != count2 && --timeout); -+ if (!timeout) { -+ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n"); -+ return -ETIMEDOUT; - } -+ -+ *lsb = count1; -+ return 0; -+} -+ -+static int rtc_write_sync_lp(struct snvs_rtc_data *data) -+{ -+ u32 count1, count2; -+ u32 elapsed; -+ unsigned int timeout = 1000; -+ int ret; -+ -+ ret = rtc_read_lp_counter_lsb(data, &count1); -+ if (ret) -+ return ret; -+ -+ /* Wait for 3 CKIL cycles, about 61.0-91.5 µs */ -+ do { -+ ret = rtc_read_lp_counter_lsb(data, &count2); -+ if (ret) -+ return ret; -+ elapsed = count2 - count1; /* wrap around _is_ handled! */ -+ } while (elapsed < 3 && --timeout); -+ if (!timeout) { -+ dev_err(&data->rtc->dev, "Timeout waiting for LPSRT Counter to change\n"); -+ return -ETIMEDOUT; -+ } -+ return 0; - } - - static int snvs_rtc_enable(struct snvs_rtc_data *data, bool enable) -@@ -173,9 +207,7 @@ static int snvs_rtc_alarm_irq_enable(struct device *dev, unsigned int enable) - (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN), - enable ? (SNVS_LPCR_LPTA_EN | SNVS_LPCR_LPWUI_EN) : 0); - -- rtc_write_sync_lp(data); -- -- return 0; -+ return rtc_write_sync_lp(data); - } - - static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) -@@ -183,10 +215,14 @@ static int snvs_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) - struct snvs_rtc_data *data = dev_get_drvdata(dev); - struct rtc_time *alrm_tm = &alrm->time; - unsigned long time; -+ int ret; - - rtc_tm_to_time(alrm_tm, &time); - - regmap_update_bits(data->regmap, data->offset + SNVS_LPCR, SNVS_LPCR_LPTA_EN, 0); -+ ret = rtc_write_sync_lp(data); -+ if (ret) -+ return ret; - regmap_write(data->regmap, data->offset + SNVS_LPTAR, time); - - /* Clear alarm interrupt status bit */ -diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c -index 33fbe8249fd5..044cffbc45e8 100644 ---- a/drivers/sbus/char/display7seg.c -+++ b/drivers/sbus/char/display7seg.c -@@ -221,6 +221,7 @@ static int d7s_probe(struct platform_device *op) - dev_set_drvdata(&op->dev, p); - d7s_device = p; - err = 0; -+ of_node_put(opts); - - out: - return err; -diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c -index 5609b602c54d..baa9b322520b 100644 ---- a/drivers/sbus/char/envctrl.c -+++ b/drivers/sbus/char/envctrl.c -@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp, - for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) { - pchild->mon_type[len] = ENVCTRL_NOMON; - } -+ of_node_put(root_node); - return; - } -+ of_node_put(root_node); - } - - /* Get the monitor channels. */ -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index a74f8fbefd33..009a2ef829d6 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc) - failed: - ISCSI_DBG_EH(session, - "failing session reset: Could not log back into " -- "%s, %s [age %d]\n", session->targetname, -- conn->persistent_address, session->age); -+ "%s [age %d]\n", session->targetname, -+ session->age); - spin_unlock_bh(&session->frwd_lock); - mutex_unlock(&session->eh_mutex); - return FAILED; -diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c -index 0de2f9069e23..23081ed8f1e3 100644 ---- a/drivers/scsi/vmw_pvscsi.c -+++ b/drivers/scsi/vmw_pvscsi.c -@@ -1199,8 +1199,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter) - - static void pvscsi_release_resources(struct pvscsi_adapter *adapter) - { -- pvscsi_shutdown_intr(adapter); -- - if (adapter->workqueue) - destroy_workqueue(adapter->workqueue); - -@@ -1529,6 +1527,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id) - out_reset_adapter: - ll_adapter_reset(adapter); - out_release_resources: -+ pvscsi_shutdown_intr(adapter); - pvscsi_release_resources(adapter); - scsi_host_put(host); - out_disable_device: -@@ -1537,6 +1536,7 @@ out_disable_device: - return error; - - out_release_resources_and_disable: -+ pvscsi_shutdown_intr(adapter); - pvscsi_release_resources(adapter); - goto out_disable_device; - } -diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c -index 127472bd6a7c..209f314745ab 100644 ---- a/drivers/tty/serial/suncore.c -+++ b/drivers/tty/serial/suncore.c -@@ -111,6 +111,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp) - mode = of_get_property(dp, mode_prop, NULL); - if (!mode) - mode = "9600,8,n,1,-"; -+ of_node_put(dp); - } - - cflag = CREAD | HUPCL | CLOCAL; -diff --git a/fs/aio.c b/fs/aio.c -index c283eb03cb38..7187d03aa0bc 100644 ---- a/fs/aio.c -+++ b/fs/aio.c -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1063,6 +1064,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) - if (!table || id >= table->nr) - goto out; - -+ id = array_index_nospec(id, table->nr); - ctx = rcu_dereference(table->table[id]); - if (ctx && ctx->user_id == ctx_id) { - if (percpu_ref_tryget_live(&ctx->users)) -diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig -index e7b478b49985..8bef27b8f85d 100644 ---- a/fs/cifs/Kconfig -+++ b/fs/cifs/Kconfig -@@ -111,7 +111,7 @@ config CIFS_XATTR - - config CIFS_POSIX - bool "CIFS POSIX Extensions" -- depends on CIFS_XATTR -+ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR - help - Enabling this option will cause the cifs client to attempt to - negotiate a newer dialect with servers, such as Samba 3.0.5 -diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c -index ef4f16e81283..1407ed20ea93 100644 ---- a/kernel/time/timer_list.c -+++ b/kernel/time/timer_list.c -@@ -399,7 +399,7 @@ static int __init init_timer_list_procfs(void) - { - struct proc_dir_entry *pe; - -- pe = proc_create("timer_list", 0444, NULL, &timer_list_fops); -+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops); - if (!pe) - return -ENOMEM; - return 0; -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index ac758a53fcea..d90b42b39908 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -4767,6 +4767,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops) - if (ops->flags & FTRACE_OPS_FL_ENABLED) - ftrace_shutdown(ops, 0); - ops->flags |= FTRACE_OPS_FL_DELETED; -+ ftrace_free_filter(ops); - mutex_unlock(&ftrace_lock); - } - -diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c -index b8a894adab2c..8be66a2b0cac 100644 ---- a/kernel/trace/trace_events_trigger.c -+++ b/kernel/trace/trace_events_trigger.c -@@ -727,8 +727,10 @@ static int set_trigger_filter(char *filter_str, - - /* The filter is for the 'trigger' event, not the triggered event */ - ret = create_event_filter(file->event_call, filter_str, false, &filter); -- if (ret) -- goto out; -+ /* -+ * If create_event_filter() fails, filter still needs to be freed. -+ * Which the calling code will do with data->filter. -+ */ - assign: - tmp = rcu_access_pointer(data->filter); - -diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c -index 245900b98c8e..222c8010bda0 100644 ---- a/lib/interval_tree_test.c -+++ b/lib/interval_tree_test.c -@@ -1,27 +1,38 @@ - #include -+#include - #include - #include -+#include - #include - --#define NODES 100 --#define PERF_LOOPS 100000 --#define SEARCHES 100 --#define SEARCH_LOOPS 10000 -+#define __param(type, name, init, msg) \ -+ static type name = init; \ -+ module_param(name, type, 0444); \ -+ MODULE_PARM_DESC(name, msg); -+ -+__param(int, nnodes, 100, "Number of nodes in the interval tree"); -+__param(int, perf_loops, 1000, "Number of iterations modifying the tree"); -+ -+__param(int, nsearches, 100, "Number of searches to the interval tree"); -+__param(int, search_loops, 1000, "Number of iterations searching the tree"); -+__param(bool, search_all, false, "Searches will iterate all nodes in the tree"); -+ -+__param(uint, max_endpoint, ~0, "Largest value for the interval's endpoint"); - - static struct rb_root root = RB_ROOT; --static struct interval_tree_node nodes[NODES]; --static u32 queries[SEARCHES]; -+static struct interval_tree_node *nodes = NULL; -+static u32 *queries = NULL; - - static struct rnd_state rnd; - - static inline unsigned long --search(unsigned long query, struct rb_root *root) -+search(struct rb_root *root, unsigned long start, unsigned long last) - { - struct interval_tree_node *node; - unsigned long results = 0; - -- for (node = interval_tree_iter_first(root, query, query); node; -- node = interval_tree_iter_next(node, query, query)) -+ for (node = interval_tree_iter_first(root, start, last); node; -+ node = interval_tree_iter_next(node, start, last)) - results++; - return results; - } -@@ -29,19 +40,22 @@ search(unsigned long query, struct rb_root *root) - static void init(void) - { - int i; -- for (i = 0; i < NODES; i++) { -- u32 a = prandom_u32_state(&rnd); -- u32 b = prandom_u32_state(&rnd); -- if (a <= b) { -- nodes[i].start = a; -- nodes[i].last = b; -- } else { -- nodes[i].start = b; -- nodes[i].last = a; -- } -+ -+ for (i = 0; i < nnodes; i++) { -+ u32 b = (prandom_u32_state(&rnd) >> 4) % max_endpoint; -+ u32 a = (prandom_u32_state(&rnd) >> 4) % b; -+ -+ nodes[i].start = a; -+ nodes[i].last = b; - } -- for (i = 0; i < SEARCHES; i++) -- queries[i] = prandom_u32_state(&rnd); -+ -+ /* -+ * Limit the search scope to what the user defined. -+ * Otherwise we are merely measuring empty walks, -+ * which is pointless. -+ */ -+ for (i = 0; i < nsearches; i++) -+ queries[i] = (prandom_u32_state(&rnd) >> 4) % max_endpoint; - } - - static int interval_tree_test_init(void) -@@ -50,6 +64,16 @@ static int interval_tree_test_init(void) - unsigned long results; - cycles_t time1, time2, time; - -+ nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL); -+ if (!nodes) -+ return -ENOMEM; -+ -+ queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL); -+ if (!queries) { -+ kfree(nodes); -+ return -ENOMEM; -+ } -+ - printk(KERN_ALERT "interval tree insert/remove"); - - prandom_seed_state(&rnd, 3141592653589793238ULL); -@@ -57,39 +81,46 @@ static int interval_tree_test_init(void) - - time1 = get_cycles(); - -- for (i = 0; i < PERF_LOOPS; i++) { -- for (j = 0; j < NODES; j++) -+ for (i = 0; i < perf_loops; i++) { -+ for (j = 0; j < nnodes; j++) - interval_tree_insert(nodes + j, &root); -- for (j = 0; j < NODES; j++) -+ for (j = 0; j < nnodes; j++) - interval_tree_remove(nodes + j, &root); - } - - time2 = get_cycles(); - time = time2 - time1; - -- time = div_u64(time, PERF_LOOPS); -+ time = div_u64(time, perf_loops); - printk(" -> %llu cycles\n", (unsigned long long)time); - - printk(KERN_ALERT "interval tree search"); - -- for (j = 0; j < NODES; j++) -+ for (j = 0; j < nnodes; j++) - interval_tree_insert(nodes + j, &root); - - time1 = get_cycles(); - - results = 0; -- for (i = 0; i < SEARCH_LOOPS; i++) -- for (j = 0; j < SEARCHES; j++) -- results += search(queries[j], &root); -+ for (i = 0; i < search_loops; i++) -+ for (j = 0; j < nsearches; j++) { -+ unsigned long start = search_all ? 0 : queries[j]; -+ unsigned long last = search_all ? max_endpoint : queries[j]; -+ -+ results += search(&root, start, last); -+ } - - time2 = get_cycles(); - time = time2 - time1; - -- time = div_u64(time, SEARCH_LOOPS); -- results = div_u64(results, SEARCH_LOOPS); -+ time = div_u64(time, search_loops); -+ results = div_u64(results, search_loops); - printk(" -> %llu cycles (%lu results)\n", - (unsigned long long)time, results); - -+ kfree(queries); -+ kfree(nodes); -+ - return -EAGAIN; /* Fail will directly unload the module */ - } - -diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c -index 8b3c9dc88262..afedd3770562 100644 ---- a/lib/rbtree_test.c -+++ b/lib/rbtree_test.c -@@ -1,11 +1,18 @@ - #include -+#include - #include - #include -+#include - #include - --#define NODES 100 --#define PERF_LOOPS 100000 --#define CHECK_LOOPS 100 -+#define __param(type, name, init, msg) \ -+ static type name = init; \ -+ module_param(name, type, 0444); \ -+ MODULE_PARM_DESC(name, msg); -+ -+__param(int, nnodes, 100, "Number of nodes in the rb-tree"); -+__param(int, perf_loops, 1000, "Number of iterations modifying the rb-tree"); -+__param(int, check_loops, 100, "Number of iterations modifying and verifying the rb-tree"); - - struct test_node { - u32 key; -@@ -17,7 +24,7 @@ struct test_node { - }; - - static struct rb_root root = RB_ROOT; --static struct test_node nodes[NODES]; -+static struct test_node *nodes = NULL; - - static struct rnd_state rnd; - -@@ -95,7 +102,7 @@ static void erase_augmented(struct test_node *node, struct rb_root *root) - static void init(void) - { - int i; -- for (i = 0; i < NODES; i++) { -+ for (i = 0; i < nnodes; i++) { - nodes[i].key = prandom_u32_state(&rnd); - nodes[i].val = prandom_u32_state(&rnd); - } -@@ -177,6 +184,10 @@ static int __init rbtree_test_init(void) - int i, j; - cycles_t time1, time2, time; - -+ nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL); -+ if (!nodes) -+ return -ENOMEM; -+ - printk(KERN_ALERT "rbtree testing"); - - prandom_seed_state(&rnd, 3141592653589793238ULL); -@@ -184,27 +195,27 @@ static int __init rbtree_test_init(void) - - time1 = get_cycles(); - -- for (i = 0; i < PERF_LOOPS; i++) { -- for (j = 0; j < NODES; j++) -+ for (i = 0; i < perf_loops; i++) { -+ for (j = 0; j < nnodes; j++) - insert(nodes + j, &root); -- for (j = 0; j < NODES; j++) -+ for (j = 0; j < nnodes; j++) - erase(nodes + j, &root); - } - - time2 = get_cycles(); - time = time2 - time1; - -- time = div_u64(time, PERF_LOOPS); -+ time = div_u64(time, perf_loops); - printk(" -> %llu cycles\n", (unsigned long long)time); - -- for (i = 0; i < CHECK_LOOPS; i++) { -+ for (i = 0; i < check_loops; i++) { - init(); -- for (j = 0; j < NODES; j++) { -+ for (j = 0; j < nnodes; j++) { - check(j); - insert(nodes + j, &root); - } -- for (j = 0; j < NODES; j++) { -- check(NODES - j); -+ for (j = 0; j < nnodes; j++) { -+ check(nnodes - j); - erase(nodes + j, &root); - } - check(0); -@@ -216,32 +227,34 @@ static int __init rbtree_test_init(void) - - time1 = get_cycles(); - -- for (i = 0; i < PERF_LOOPS; i++) { -- for (j = 0; j < NODES; j++) -+ for (i = 0; i < perf_loops; i++) { -+ for (j = 0; j < nnodes; j++) - insert_augmented(nodes + j, &root); -- for (j = 0; j < NODES; j++) -+ for (j = 0; j < nnodes; j++) - erase_augmented(nodes + j, &root); - } - - time2 = get_cycles(); - time = time2 - time1; - -- time = div_u64(time, PERF_LOOPS); -+ time = div_u64(time, perf_loops); - printk(" -> %llu cycles\n", (unsigned long long)time); - -- for (i = 0; i < CHECK_LOOPS; i++) { -+ for (i = 0; i < check_loops; i++) { - init(); -- for (j = 0; j < NODES; j++) { -+ for (j = 0; j < nnodes; j++) { - check_augmented(j); - insert_augmented(nodes + j, &root); - } -- for (j = 0; j < NODES; j++) { -- check_augmented(NODES - j); -+ for (j = 0; j < nnodes; j++) { -+ check_augmented(nnodes - j); - erase_augmented(nodes + j, &root); - } - check_augmented(0); - } - -+ kfree(nodes); -+ - return -EAGAIN; /* Fail will directly unload the module */ - } - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index a5e11280f405..ed4fef32b394 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -1886,7 +1886,8 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local, - params[ac].acm = acm; - params[ac].uapsd = uapsd; - -- if (params[ac].cw_min > params[ac].cw_max) { -+ if (params[ac].cw_min == 0 || -+ params[ac].cw_min > params[ac].cw_max) { - sdata_info(sdata, - "AP has invalid WMM params (CWmin/max=%d/%d for ACI %d), using defaults\n", - params[ac].cw_min, params[ac].cw_max, aci); -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 2e98f4a243e5..112c191b8336 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -758,8 +758,15 @@ void xprt_connect(struct rpc_task *task) - return; - if (xprt_test_and_set_connecting(xprt)) - return; -- xprt->stat.connect_start = jiffies; -- xprt->ops->connect(xprt, task); -+ /* Race breaker */ -+ if (!xprt_connected(xprt)) { -+ xprt->stat.connect_start = jiffies; -+ xprt->ops->connect(xprt, task); -+ } else { -+ xprt_clear_connecting(xprt); -+ task->tk_status = 0; -+ rpc_wake_up_queued_task(&xprt->pending, task); -+ } - } - xprt_release_write(xprt, task); - } -diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c -index 69f76ff5693d..718d5e3b7806 100644 ---- a/sound/isa/wavefront/wavefront_synth.c -+++ b/sound/isa/wavefront/wavefront_synth.c -@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header) - DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n", - header->number); - -+ if (header->number >= ARRAY_SIZE(dev->patch_status)) -+ return -EINVAL; -+ - dev->patch_status[header->number] |= WF_SLOT_FILLED; - - bptr = buf; -@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header) - DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n", - header->number); - -+ if (header->number >= ARRAY_SIZE(dev->prog_status)) -+ return -EINVAL; -+ - dev->prog_status[header->number] = WF_SLOT_USED; - - /* XXX need to zero existing SLOT_USED bit for program_status[i] -@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev, - header->number = x; - } - -+ if (header->number >= WF_MAX_SAMPLE) -+ return -EINVAL; -+ - if (header->size) { - - /* XXX it's a debatable point whether or not RDONLY semantics diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.169-170.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.169-170.patch deleted file mode 100644 index db38c6d6a666..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.169-170.patch +++ /dev/null @@ -1,2154 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0d41b0626c0c..bc58f206c0da 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 169 -+SUBLEVEL = 170 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c -index 3c6672b3796b..7f5df8992008 100644 ---- a/arch/arm/mach-imx/cpuidle-imx6sx.c -+++ b/arch/arm/mach-imx/cpuidle-imx6sx.c -@@ -97,7 +97,7 @@ int __init imx6sx_cpuidle_init(void) - * except for power up sw2iso which need to be - * larger than LDO ramp up time. - */ -- imx_gpc_set_arm_power_up_timing(2, 1); -+ imx_gpc_set_arm_power_up_timing(0xf, 1); - imx_gpc_set_arm_power_down_timing(1, 1); - - return cpuidle_register(&imx6sx_cpuidle_driver, NULL); -diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -index 37fe58c19a90..542c3ede9722 100644 ---- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -+++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include "../../../../include/linux/sizes.h" - - int main(int argc, char *argv[]) - { -@@ -45,11 +46,11 @@ int main(int argc, char *argv[]) - vmlinuz_load_addr = vmlinux_load_addr + vmlinux_size; - - /* -- * Align with 16 bytes: "greater than that used for any standard data -- * types by a MIPS compiler." -- See MIPS Run Linux (Second Edition). -+ * Align with 64KB: KEXEC needs load sections to be aligned to PAGE_SIZE, -+ * which may be as large as 64KB depending on the kernel configuration. - */ - -- vmlinuz_load_addr += (16 - vmlinux_size % 16); -+ vmlinuz_load_addr += (SZ_64K - vmlinux_size % SZ_64K); - - printf("0x%llx\n", vmlinuz_load_addr); - -diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h -index cf661a2fb141..16fade4f49dd 100644 ---- a/arch/mips/include/asm/pgtable-64.h -+++ b/arch/mips/include/asm/pgtable-64.h -@@ -189,6 +189,11 @@ static inline int pmd_bad(pmd_t pmd) - - static inline int pmd_present(pmd_t pmd) - { -+#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT -+ if (unlikely(pmd_val(pmd) & _PAGE_HUGE)) -+ return pmd_val(pmd) & _PAGE_PRESENT; -+#endif -+ - return pmd_val(pmd) != (unsigned long) invalid_pte_table; - } - -diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S -index 5c2199857aa8..a3550e8f1a77 100644 ---- a/arch/powerpc/boot/crt0.S -+++ b/arch/powerpc/boot/crt0.S -@@ -15,7 +15,7 @@ - RELA = 7 - RELACOUNT = 0x6ffffff9 - -- .text -+ .data - /* A procedure descriptor used when booting this as a COFF file. - * When making COFF, this comes first in the link and we're - * linked at 0x500000. -@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9 - .globl _zimage_start_opd - _zimage_start_opd: - .long 0x500000, 0, 0, 0 -+ .text -+ b _zimage_start - - #ifdef __powerpc64__ - .balign 8 -diff --git a/arch/x86/crypto/chacha20_glue.c b/arch/x86/crypto/chacha20_glue.c -index 8baaff5af0b5..75b9d43069f1 100644 ---- a/arch/x86/crypto/chacha20_glue.c -+++ b/arch/x86/crypto/chacha20_glue.c -@@ -77,6 +77,7 @@ static int chacha20_simd(struct blkcipher_desc *desc, struct scatterlist *dst, - - blkcipher_walk_init(&walk, dst, src, nbytes); - err = blkcipher_walk_virt_block(desc, &walk, CHACHA20_BLOCK_SIZE); -+ desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; - - crypto_chacha20_init(state, crypto_blkcipher_ctx(desc->tfm), walk.iv); - -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index c048d0d70cc4..2cb49ac1b2b2 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1200,7 +1200,7 @@ asmlinkage void kvm_spurious_fault(void); - "cmpb $0, kvm_rebooting \n\t" \ - "jne 668b \n\t" \ - __ASM_SIZE(push) " $666b \n\t" \ -- "call kvm_spurious_fault \n\t" \ -+ "jmp kvm_spurious_fault \n\t" \ - ".popsection \n\t" \ - _ASM_EXTABLE(666b, 667b) - -diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c -index d76f13d6d8d6..ec894bf5eeb0 100644 ---- a/arch/x86/kernel/cpu/mtrr/if.c -+++ b/arch/x86/kernel/cpu/mtrr/if.c -@@ -173,6 +173,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg) - struct mtrr_gentry gentry; - void __user *arg = (void __user *) __arg; - -+ memset(&gentry, 0, sizeof(gentry)); -+ - switch (cmd) { - case MTRRIOC_ADD_ENTRY: - case MTRRIOC_SET_ENTRY: -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index e4b5fd72ca24..3bdb2e747b89 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -6163,9 +6163,24 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) - - gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS); - if (!kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) { -- skip_emulated_instruction(vcpu); - trace_kvm_fast_mmio(gpa); -- return 1; -+ /* -+ * Doing kvm_skip_emulated_instruction() depends on undefined -+ * behavior: Intel's manual doesn't mandate -+ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG -+ * occurs and while on real hardware it was observed to be set, -+ * other hypervisors (namely Hyper-V) don't set it, we end up -+ * advancing IP with some random value. Disable fast mmio when -+ * running nested and keep it for real hardware in hope that -+ * VM_EXIT_INSTRUCTION_LEN will always be set correctly. -+ */ -+ if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) { -+ skip_emulated_instruction(vcpu); -+ return 1; -+ } -+ else -+ return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP, -+ NULL, 0) == EMULATE_DONE; - } - - ret = handle_mmio_page_fault(vcpu, gpa, true); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index aa1a0277a678..1a934bb8ed1c 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5436,7 +5436,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, - * handle watchpoints yet, those would be handled in - * the emulate_ops. - */ -- if (kvm_vcpu_check_breakpoint(vcpu, &r)) -+ if (!(emulation_type & EMULTYPE_SKIP) && -+ kvm_vcpu_check_breakpoint(vcpu, &r)) - return r; - - ctxt->interruptibility = 0; -diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c -index 05813fbf3daf..647dfbbc4e1c 100644 ---- a/drivers/gpio/gpio-max7301.c -+++ b/drivers/gpio/gpio-max7301.c -@@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg, - struct spi_device *spi = to_spi_device(dev); - u16 word = ((reg & 0x7F) << 8) | (val & 0xFF); - -- return spi_write(spi, (const u8 *)&word, sizeof(word)); -+ return spi_write_then_read(spi, &word, sizeof(word), NULL, 0); - } - - /* A read from the MAX7301 means two transfers; here, one message each */ -@@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg) - struct spi_device *spi = to_spi_device(dev); - - word = 0x8000 | (reg << 8); -- ret = spi_write(spi, (const u8 *)&word, sizeof(word)); -- if (ret) -- return ret; -- /* -- * This relies on the fact, that a transfer with NULL tx_buf shifts out -- * zero bytes (=NOOP for MAX7301) -- */ -- ret = spi_read(spi, (u8 *)&word, sizeof(word)); -+ ret = spi_write_then_read(spi, &word, sizeof(word), &word, -+ sizeof(word)); - if (ret) - return ret; - return word & 0xff; -diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c -index 8ce2a0c59116..a7030ada81fd 100644 ---- a/drivers/gpu/drm/drm_ioctl.c -+++ b/drivers/gpu/drm/drm_ioctl.c -@@ -36,6 +36,7 @@ - - #include - #include -+#include - - static int drm_version(struct drm_device *dev, void *data, - struct drm_file *file_priv); -@@ -702,13 +703,17 @@ long drm_ioctl(struct file *filp, - - if (is_driver_ioctl) { - /* driver ioctl */ -- if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls) -+ unsigned int index = nr - DRM_COMMAND_BASE; -+ -+ if (index >= dev->driver->num_ioctls) - goto err_i1; -- ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE]; -+ index = array_index_nospec(index, dev->driver->num_ioctls); -+ ioctl = &dev->driver->ioctls[index]; - } else { - /* core ioctl */ - if (nr >= DRM_CORE_IOCTL_COUNT) - goto err_i1; -+ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); - ioctl = &drm_ioctls[nr]; - } - -@@ -810,6 +815,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags) - - if (nr >= DRM_CORE_IOCTL_COUNT) - return false; -+ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT); - - *flags = drm_ioctls[nr].flags; - return true; -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 802dcb409030..b877cce0409b 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -316,6 +316,8 @@ static ssize_t out_intr_mask_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); - return sprintf(buf, "%d\n", outbound.current_interrupt_mask); - } -@@ -329,6 +331,8 @@ static ssize_t out_read_index_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); - return sprintf(buf, "%d\n", outbound.current_read_index); - } -@@ -343,6 +347,8 @@ static ssize_t out_write_index_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); - return sprintf(buf, "%d\n", outbound.current_write_index); - } -@@ -357,6 +363,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); - return sprintf(buf, "%d\n", outbound.bytes_avail_toread); - } -@@ -371,6 +379,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound); - return sprintf(buf, "%d\n", outbound.bytes_avail_towrite); - } -@@ -384,6 +394,8 @@ static ssize_t in_intr_mask_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); - return sprintf(buf, "%d\n", inbound.current_interrupt_mask); - } -@@ -397,6 +409,8 @@ static ssize_t in_read_index_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); - return sprintf(buf, "%d\n", inbound.current_read_index); - } -@@ -410,6 +424,8 @@ static ssize_t in_write_index_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); - return sprintf(buf, "%d\n", inbound.current_write_index); - } -@@ -424,6 +440,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); - return sprintf(buf, "%d\n", inbound.bytes_avail_toread); - } -@@ -438,6 +456,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev, - - if (!hv_dev->channel) - return -ENODEV; -+ if (hv_dev->channel->state != CHANNEL_OPENED_STATE) -+ return -EINVAL; - hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound); - return sprintf(buf, "%d\n", inbound.bytes_avail_towrite); - } -diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c -index 70ca27e45602..9d9e47eb0842 100644 ---- a/drivers/hwtracing/intel_th/msu.c -+++ b/drivers/hwtracing/intel_th/msu.c -@@ -1418,7 +1418,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr, - if (!end) - break; - -- len -= end - p; -+ /* consume the number and the following comma, hence +1 */ -+ len -= end - p + 1; - p = end + 1; - } while (len); - -diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c -index f78c464899db..3d2c60c8de83 100644 ---- a/drivers/input/keyboard/omap4-keypad.c -+++ b/drivers/input/keyboard/omap4-keypad.c -@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id) - { - struct omap4_keypad *keypad_data = dev_id; - -- if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) { -- /* Disable interrupts */ -- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, -- OMAP4_VAL_IRQDISABLE); -+ if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) - return IRQ_WAKE_THREAD; -- } - - return IRQ_NONE; - } -@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id) - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, - kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); - -- /* enable interrupts */ -- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, -- OMAP4_DEF_IRQENABLE_EVENTEN | -- OMAP4_DEF_IRQENABLE_LONGKEY); -- - return IRQ_HANDLED; - } - -@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input) - - disable_irq(keypad_data->irq); - -- /* Disable interrupts */ -+ /* Disable interrupts and wake-up events */ - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, - OMAP4_VAL_IRQDISABLE); -+ kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0); - - /* clear pending interrupts */ - kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, -@@ -364,7 +356,7 @@ static int omap4_keypad_probe(struct platform_device *pdev) - } - - error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler, -- omap4_keypad_irq_thread_fn, 0, -+ omap4_keypad_irq_thread_fn, IRQF_ONESHOT, - "omap4-keypad", keypad_data); - if (error) { - dev_err(&pdev->dev, "failed to register interrupt\n"); -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 471984ec2db0..30adc5745cba 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1240,6 +1240,7 @@ MODULE_DEVICE_TABLE(i2c, elan_id); - static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0000", 0 }, - { "ELAN0100", 0 }, -+ { "ELAN0501", 0 }, - { "ELAN0600", 0 }, - { "ELAN0602", 0 }, - { "ELAN0605", 0 }, -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 7feaa82f8c7c..8b4a4d95669a 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -2041,7 +2041,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain, - * than default. Unnecessary for PT mode. - */ - if (translation != CONTEXT_TT_PASS_THROUGH) { -- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) { -+ for (agaw = domain->agaw; agaw > iommu->agaw; agaw--) { - ret = -ENOMEM; - pgd = phys_to_virt(dma_pte_addr(pgd)); - if (!dma_pte_present(pgd)) -@@ -2055,7 +2055,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain, - translation = CONTEXT_TT_MULTI_LEVEL; - - context_set_address_root(context, virt_to_phys(pgd)); -- context_set_address_width(context, iommu->agaw); -+ context_set_address_width(context, agaw); - } else { - /* - * In pass through mode, AW must be programmed to -diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c -index dd7e38ac29bd..d15347de415a 100644 ---- a/drivers/isdn/capi/kcapi.c -+++ b/drivers/isdn/capi/kcapi.c -@@ -851,7 +851,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf) - u16 ret; - - if (contr == 0) { -- strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN); -+ strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN); - return CAPI_NOERROR; - } - -@@ -859,7 +859,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf) - - ctr = get_capi_ctr_by_nr(contr); - if (ctr && ctr->state == CAPI_CTR_RUNNING) { -- strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN); -+ strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN); - ret = CAPI_NOERROR; - } else - ret = CAPI_REGNOTINSTALLED; -diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c -index ef5412311b2f..a84954f1be34 100644 ---- a/drivers/media/platform/vivid/vivid-vid-cap.c -+++ b/drivers/media/platform/vivid/vivid-vid-cap.c -@@ -461,6 +461,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls) - tpg_s_rgb_range(&dev->tpg, v4l2_ctrl_g_ctrl(dev->rgb_range_cap)); - break; - } -+ vfree(dev->bitmap_cap); -+ dev->bitmap_cap = NULL; - vivid_update_quality(dev); - tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap); - dev->crop_cap = dev->src_rect; -diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c -index 524660510599..0c15ba21fa54 100644 ---- a/drivers/misc/genwqe/card_utils.c -+++ b/drivers/misc/genwqe/card_utils.c -@@ -217,7 +217,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init) - void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size, - dma_addr_t *dma_handle) - { -- if (get_order(size) > MAX_ORDER) -+ if (get_order(size) >= MAX_ORDER) - return NULL; - - return dma_alloc_coherent(&cd->pci_dev->dev, size, dma_handle, -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index 79a0c26e1419..a31789be0840 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1608,9 +1608,11 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, - if (err) { - pr_warn("%s: Enabling HPI failed\n", - mmc_hostname(card->host)); -+ card->ext_csd.hpi_en = 0; - err = 0; -- } else -+ } else { - card->ext_csd.hpi_en = 1; -+ } - } - - /* -diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c -index 6b814d7d6560..af937d3e8c3e 100644 ---- a/drivers/mmc/host/omap_hsmmc.c -+++ b/drivers/mmc/host/omap_hsmmc.c -@@ -2117,7 +2117,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev) - mmc->max_blk_size = 512; /* Block Length at max can be 1024 */ - mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */ - mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count; -- mmc->max_seg_size = mmc->max_req_size; - - mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED | - MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE; -@@ -2174,6 +2173,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev) - goto err_irq; - } - -+ /* -+ * Limit the maximum segment size to the lower of the request size -+ * and the DMA engine device segment size limits. In reality, with -+ * 32-bit transfers, the DMA engine can do longer segments than this -+ * but there is no way to represent that in the DMA model - if we -+ * increase this figure here, we get warnings from the DMA API debug. -+ */ -+ mmc->max_seg_size = min3(mmc->max_req_size, -+ dma_get_max_seg_size(host->rx_chan->device->dev), -+ dma_get_max_seg_size(host->tx_chan->device->dev)); -+ - /* Request IRQ for MMC operations */ - ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0, - mmc_hostname(mmc), host); -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 2f9b12cf9ee5..61a9ab4fe047 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1163,11 +1163,15 @@ out: - - map_failed_frags: - last = i+1; -- for (i = 0; i < last; i++) -+ for (i = 1; i < last; i++) - dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address, - descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK, - DMA_TO_DEVICE); - -+ dma_unmap_single(&adapter->vdev->dev, -+ descs[0].fields.address, -+ descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK, -+ DMA_TO_DEVICE); - map_failed: - if (!firmware_has_feature(FW_FEATURE_CMO)) - netdev_err(netdev, "tx: unable to map xmit buffer\n"); -diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c -index 111d907e0c11..79cede19e0c4 100644 ---- a/drivers/net/usb/hso.c -+++ b/drivers/net/usb/hso.c -@@ -2825,6 +2825,12 @@ static int hso_get_config_data(struct usb_interface *interface) - return -EIO; - } - -+ /* check if we have a valid interface */ -+ if (if_num > 16) { -+ kfree(config_data); -+ return -EINVAL; -+ } -+ - switch (config_data[if_num]) { - case 0x0: - result = 0; -@@ -2895,10 +2901,18 @@ static int hso_probe(struct usb_interface *interface, - - /* Get the interface/port specification from either driver_info or from - * the device itself */ -- if (id->driver_info) -+ if (id->driver_info) { -+ /* if_num is controlled by the device, driver_info is a 0 terminated -+ * array. Make sure, the access is in bounds! */ -+ for (i = 0; i <= if_num; ++i) -+ if (((u32 *)(id->driver_info))[i] == 0) -+ goto exit; - port_spec = ((u32 *)(id->driver_info))[if_num]; -- else -+ } else { - port_spec = hso_get_config_data(interface); -+ if (port_spec < 0) -+ goto exit; -+ } - - /* Check if we need to switch to alt interfaces prior to port - * configuration */ -diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c -index ec2b9c577b90..3644c9edaf81 100644 ---- a/drivers/net/wireless/b43/phy_common.c -+++ b/drivers/net/wireless/b43/phy_common.c -@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta) - u8 i; - s32 tmp; - s8 signx = 1; -- u32 angle = 0; -+ s32 angle = 0; - struct b43_c32 ret = { .i = 39797, .q = 0, }; - - while (theta > (180 << 16)) -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 0a4bd73caae5..6f55ab4f7959 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -889,7 +889,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, - if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) { - unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to; - -- BUG_ON(pull_to <= skb_headlen(skb)); -+ BUG_ON(pull_to < skb_headlen(skb)); - __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); - } - if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { -diff --git a/drivers/power/olpc_battery.c b/drivers/power/olpc_battery.c -index 9e29b1321648..15783869e1a0 100644 ---- a/drivers/power/olpc_battery.c -+++ b/drivers/power/olpc_battery.c -@@ -427,14 +427,14 @@ static int olpc_bat_get_property(struct power_supply *psy, - if (ret) - return ret; - -- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256; -+ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256; - break; - case POWER_SUPPLY_PROP_TEMP_AMBIENT: - ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2); - if (ret) - return ret; - -- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256; -+ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256; - break; - case POWER_SUPPLY_PROP_CHARGE_COUNTER: - ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2); -diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c -index 38c8e308d4c8..a96c98e3fc73 100644 ---- a/drivers/s390/scsi/zfcp_aux.c -+++ b/drivers/s390/scsi/zfcp_aux.c -@@ -275,16 +275,16 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter) - */ - int zfcp_status_read_refill(struct zfcp_adapter *adapter) - { -- while (atomic_read(&adapter->stat_miss) > 0) -+ while (atomic_add_unless(&adapter->stat_miss, -1, 0)) - if (zfcp_fsf_status_read(adapter->qdio)) { -+ atomic_inc(&adapter->stat_miss); /* undo add -1 */ - if (atomic_read(&adapter->stat_miss) >= - adapter->stat_read_buf_num) { - zfcp_erp_adapter_reopen(adapter, 0, "axsref1"); - return 1; - } - break; -- } else -- atomic_dec(&adapter->stat_miss); -+ } - return 0; - } - -diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -index d0b227ffbd5f..573aeec7a02b 100644 ---- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c -@@ -2279,7 +2279,7 @@ static int _bnx2fc_create(struct net_device *netdev, - if (!interface) { - printk(KERN_ERR PFX "bnx2fc_interface_create failed\n"); - rc = -ENOMEM; -- goto ifput_err; -+ goto netdev_err; - } - - if (netdev->priv_flags & IFF_802_1Q_VLAN) { -diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c -index cf04960cc3e6..1a1368f5863c 100644 ---- a/drivers/spi/spi-bcm2835.c -+++ b/drivers/spi/spi-bcm2835.c -@@ -88,7 +88,7 @@ struct bcm2835_spi { - u8 *rx_buf; - int tx_len; - int rx_len; -- bool dma_pending; -+ unsigned int dma_pending; - }; - - static inline u32 bcm2835_rd(struct bcm2835_spi *bs, unsigned reg) -@@ -155,8 +155,7 @@ static irqreturn_t bcm2835_spi_interrupt(int irq, void *dev_id) - /* Write as many bytes as possible to FIFO */ - bcm2835_wr_fifo(bs); - -- /* based on flags decide if we can finish the transfer */ -- if (bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_DONE) { -+ if (!bs->rx_len) { - /* Transfer complete - reset SPI HW */ - bcm2835_spi_reset_hw(master); - /* wake up the framework */ -@@ -233,10 +232,9 @@ static void bcm2835_spi_dma_done(void *data) - * is called the tx-dma must have finished - can't get to this - * situation otherwise... - */ -- dmaengine_terminate_all(master->dma_tx); -- -- /* mark as no longer pending */ -- bs->dma_pending = 0; -+ if (cmpxchg(&bs->dma_pending, true, false)) { -+ dmaengine_terminate_all(master->dma_tx); -+ } - - /* and mark as completed */; - complete(&master->xfer_completion); -@@ -342,6 +340,7 @@ static int bcm2835_spi_transfer_one_dma(struct spi_master *master, - if (ret) { - /* need to reset on errors */ - dmaengine_terminate_all(master->dma_tx); -+ bs->dma_pending = false; - bcm2835_spi_reset_hw(master); - return ret; - } -@@ -617,10 +616,9 @@ static void bcm2835_spi_handle_err(struct spi_master *master, - struct bcm2835_spi *bs = spi_master_get_devdata(master); - - /* if an error occurred and we have an active dma, then terminate */ -- if (bs->dma_pending) { -+ if (cmpxchg(&bs->dma_pending, true, false)) { - dmaengine_terminate_all(master->dma_tx); - dmaengine_terminate_all(master->dma_rx); -- bs->dma_pending = 0; - } - /* and reset */ - bcm2835_spi_reset_hw(master); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 0a8e5ac891d4..3919ea066bf9 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -507,6 +507,13 @@ static int acm_tty_install(struct tty_driver *driver, struct tty_struct *tty) - if (retval) - goto error_init_termios; - -+ /* -+ * Suppress initial echoing for some devices which might send data -+ * immediately after acm driver has been installed. -+ */ -+ if (acm->quirks & DISABLE_ECHO) -+ tty->termios.c_lflag &= ~ECHO; -+ - tty->driver_data = acm; - - return 0; -@@ -1677,6 +1684,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -+ { USB_DEVICE(0x0e8d, 0x2000), /* MediaTek Inc Preloader */ -+ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */ -+ }, - { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h -index b30ac5fcde68..1ad9ff9f493d 100644 ---- a/drivers/usb/class/cdc-acm.h -+++ b/drivers/usb/class/cdc-acm.h -@@ -134,3 +134,4 @@ struct acm { - #define QUIRK_CONTROL_LINE_STATE BIT(6) - #define CLEAR_HALT_CONDITIONS BIT(7) - #define SEND_ZERO_PACKET BIT(8) -+#define DISABLE_ECHO BIT(9) -diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c -index a11c2c8bda53..a217f71b45c6 100644 ---- a/drivers/usb/host/r8a66597-hcd.c -+++ b/drivers/usb/host/r8a66597-hcd.c -@@ -1990,6 +1990,8 @@ static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, - - static void r8a66597_endpoint_disable(struct usb_hcd *hcd, - struct usb_host_endpoint *hep) -+__acquires(r8a66597->lock) -+__releases(r8a66597->lock) - { - struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd); - struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv; -@@ -2002,13 +2004,14 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd, - return; - pipenum = pipe->info.pipenum; - -+ spin_lock_irqsave(&r8a66597->lock, flags); - if (pipenum == 0) { - kfree(hep->hcpriv); - hep->hcpriv = NULL; -+ spin_unlock_irqrestore(&r8a66597->lock, flags); - return; - } - -- spin_lock_irqsave(&r8a66597->lock, flags); - pipe_stop(r8a66597, pipe); - pipe_irq_disable(r8a66597, pipenum); - disable_irq_empty(r8a66597, pipenum); -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 5d21cd8359d4..421825b44202 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -1329,7 +1329,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd) - portsc_buf[port_index] = 0; - - /* Bail out if a USB3 port has a new device in link training */ -- if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { -+ if ((hcd->speed >= HCD_USB3) && -+ (t1 & PORT_PLS_MASK) == XDEV_POLLING) { - bus_state->bus_suspended = 0; - spin_unlock_irqrestore(&xhci->lock, flags); - xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 2b81939fecd7..7bc2c9fef605 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1163,6 +1163,10 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ -+ .driver_info = NCTRL(0) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = RSVD(1) }, -@@ -1327,6 +1331,7 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), - .driver_info = RSVD(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), -@@ -1530,6 +1535,7 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(2) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ - .driver_info = RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, -@@ -1757,6 +1763,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, - { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), - .driver_info = RSVD(5) | RSVD(6) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), -@@ -1941,7 +1948,18 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, -- { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) }, -+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ -+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, -+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ -+ .driver_info = RSVD(4) | RSVD(5) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ -+ .driver_info = RSVD(6) }, - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 3da25ad267a2..4966768d3c98 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -86,9 +86,14 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) }, - { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, - { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, -+ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, - { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, - { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) }, - { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 123289085ee2..a84f0959ab34 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -123,10 +123,15 @@ - - /* Hewlett-Packard POS Pole Displays */ - #define HP_VENDOR_ID 0x03f0 -+#define HP_LM920_PRODUCT_ID 0x026b -+#define HP_TD620_PRODUCT_ID 0x0956 - #define HP_LD960_PRODUCT_ID 0x0b39 - #define HP_LCM220_PRODUCT_ID 0x3139 - #define HP_LCM960_PRODUCT_ID 0x3239 - #define HP_LD220_PRODUCT_ID 0x3524 -+#define HP_LD220TA_PRODUCT_ID 0x4349 -+#define HP_LD960TA_PRODUCT_ID 0x4439 -+#define HP_LM940_PRODUCT_ID 0x5039 - - /* Cressi Edy (diving computer) PC interface */ - #define CRESSI_VENDOR_ID 0x04b8 -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index c54d388310f0..2ed0a356d1d3 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -1550,6 +1550,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads, - return -EFAULT; - } - if (unlikely(vq->log_used)) { -+ /* Make sure used idx is seen before log. */ -+ smp_wmb(); - /* Log used index update. */ - log_write(vq->log_base, - vq->log_addr + offsetof(struct vring_used, idx), -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index 0e3de1bb6500..e7b54514d99a 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -3243,7 +3243,6 @@ retry: - tcap->cap_id = t_cap_id; - tcap->seq = t_seq - 1; - tcap->issue_seq = t_seq - 1; -- tcap->mseq = t_mseq; - tcap->issued |= issued; - tcap->implemented |= issued; - if (cap == ci->i_auth_cap) -diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c -index 8257a5a97cc0..98c25b969ab8 100644 ---- a/fs/cifs/smb2maperror.c -+++ b/fs/cifs/smb2maperror.c -@@ -377,8 +377,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = { - {STATUS_NONEXISTENT_EA_ENTRY, -EIO, "STATUS_NONEXISTENT_EA_ENTRY"}, - {STATUS_NO_EAS_ON_FILE, -ENODATA, "STATUS_NO_EAS_ON_FILE"}, - {STATUS_EA_CORRUPT_ERROR, -EIO, "STATUS_EA_CORRUPT_ERROR"}, -- {STATUS_FILE_LOCK_CONFLICT, -EIO, "STATUS_FILE_LOCK_CONFLICT"}, -- {STATUS_LOCK_NOT_GRANTED, -EIO, "STATUS_LOCK_NOT_GRANTED"}, -+ {STATUS_FILE_LOCK_CONFLICT, -EACCES, "STATUS_FILE_LOCK_CONFLICT"}, -+ {STATUS_LOCK_NOT_GRANTED, -EACCES, "STATUS_LOCK_NOT_GRANTED"}, - {STATUS_DELETE_PENDING, -ENOENT, "STATUS_DELETE_PENDING"}, - {STATUS_CTL_FILE_NOT_SUPPORTED, -ENOSYS, - "STATUS_CTL_FILE_NOT_SUPPORTED"}, -diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c -index 35502d4046f5..3a7f401e943c 100644 ---- a/fs/dlm/lock.c -+++ b/fs/dlm/lock.c -@@ -1210,6 +1210,7 @@ static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret) - - if (rv < 0) { - log_error(ls, "create_lkb idr error %d", rv); -+ dlm_free_lkb(lkb); - return rv; - } - -@@ -4177,6 +4178,7 @@ static int receive_convert(struct dlm_ls *ls, struct dlm_message *ms) - (unsigned long long)lkb->lkb_recover_seq, - ms->m_header.h_nodeid, ms->m_lkid); - error = -ENOENT; -+ dlm_put_lkb(lkb); - goto fail; - } - -@@ -4230,6 +4232,7 @@ static int receive_unlock(struct dlm_ls *ls, struct dlm_message *ms) - lkb->lkb_id, lkb->lkb_remid, - ms->m_header.h_nodeid, ms->m_lkid); - error = -ENOENT; -+ dlm_put_lkb(lkb); - goto fail; - } - -@@ -5792,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua, - goto out; - } - } -- -- /* After ua is attached to lkb it will be freed by dlm_free_lkb(). -- When DLM_IFL_USER is set, the dlm knows that this is a userspace -- lock and that lkb_astparam is the dlm_user_args structure. */ -- - error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs, - fake_astfn, ua, fake_bastfn, &args); -- lkb->lkb_flags |= DLM_IFL_USER; -- - if (error) { -+ kfree(ua->lksb.sb_lvbptr); -+ ua->lksb.sb_lvbptr = NULL; -+ kfree(ua); - __put_lkb(ls, lkb); - goto out; - } - -+ /* After ua is attached to lkb it will be freed by dlm_free_lkb(). -+ When DLM_IFL_USER is set, the dlm knows that this is a userspace -+ lock and that lkb_astparam is the dlm_user_args structure. */ -+ lkb->lkb_flags |= DLM_IFL_USER; - error = request_lock(ls, lkb, name, namelen, &args); - - switch (error) { -diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c -index f3e72787e7f9..30e4e01db35a 100644 ---- a/fs/dlm/lockspace.c -+++ b/fs/dlm/lockspace.c -@@ -673,11 +673,11 @@ static int new_lockspace(const char *name, const char *cluster, - kfree(ls->ls_recover_buf); - out_lkbidr: - idr_destroy(&ls->ls_lkbidr); -+ out_rsbtbl: - for (i = 0; i < DLM_REMOVE_NAMES_MAX; i++) { - if (ls->ls_remove_names[i]) - kfree(ls->ls_remove_names[i]); - } -- out_rsbtbl: - vfree(ls->ls_rsbtbl); - out_lsfree: - if (do_unreg) -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 1aec46733ef8..46d4fac48cf4 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -701,8 +701,11 @@ int ext4_try_to_write_inline_data(struct address_space *mapping, - - if (!PageUptodate(page)) { - ret = ext4_read_inline_page(inode, page); -- if (ret < 0) -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); - goto out_up_read; -+ } - } - - ret = 1; -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index bad13f049fb0..2fc1564f62dd 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1600,7 +1600,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input) - } - - if (reserved_gdb || gdb_off == 0) { -- if (ext4_has_feature_resize_inode(sb) || -+ if (!ext4_has_feature_resize_inode(sb) || - !le16_to_cpu(es->s_reserved_gdt_blocks)) { - ext4_warning(sb, - "No reserved GDT blocks, can't resize"); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index cd9cd581fd92..6a7df72cb3da 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1049,6 +1049,16 @@ static struct dentry *ext4_fh_to_parent(struct super_block *sb, struct fid *fid, - ext4_nfs_get_inode); - } - -+static int ext4_nfs_commit_metadata(struct inode *inode) -+{ -+ struct writeback_control wbc = { -+ .sync_mode = WB_SYNC_ALL -+ }; -+ -+ trace_ext4_nfs_commit_metadata(inode); -+ return ext4_write_inode(inode, &wbc); -+} -+ - /* - * Try to release metadata pages (indirect blocks, directories) which are - * mapped via the block device. Since these pages could have journal heads -@@ -1143,6 +1153,7 @@ static const struct export_operations ext4_export_ops = { - .fh_to_dentry = ext4_fh_to_dentry, - .fh_to_parent = ext4_fh_to_parent, - .get_parent = ext4_get_parent, -+ .commit_metadata = ext4_nfs_commit_metadata, - }; - - enum { -@@ -5184,9 +5195,9 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, - qf_inode->i_flags |= S_NOQUOTA; - lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); - err = dquot_enable(qf_inode, type, format_id, flags); -- iput(qf_inode); - if (err) - lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); -+ iput(qf_inode); - - return err; - } -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index ef24894edecc..763fe7737065 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -1720,9 +1720,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, - goto next_iter; - } - if (ret == -E2BIG) { -+ n += rbm->bii - initial_bii; - rbm->bii = 0; - rbm->offset = 0; -- n += (rbm->bii - initial_bii); - goto res_covered_end_of_rgrp; - } - return ret; -diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h -index cf6c74550baa..86316f90ea1e 100644 ---- a/include/net/gro_cells.h -+++ b/include/net/gro_cells.h -@@ -84,6 +84,7 @@ static inline void gro_cells_destroy(struct gro_cells *gcells) - for_each_possible_cpu(i) { - struct gro_cell *cell = per_cpu_ptr(gcells->cells, i); - -+ napi_disable(&cell->napi); - netif_napi_del(&cell->napi); - __skb_queue_purge(&cell->napi_skbs); - } -diff --git a/include/net/sock.h b/include/net/sock.h -index 577075713ad5..7420299c31f5 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -299,6 +299,7 @@ struct cg_proto; - * @sk_filter: socket filtering instructions - * @sk_timer: sock cleanup timer - * @sk_stamp: time stamp of last packet received -+ * @sk_stamp_seq: lock for accessing sk_stamp on 32 bit architectures only - * @sk_tsflags: SO_TIMESTAMPING socket options - * @sk_tskey: counter to disambiguate concurrent tstamp requests - * @sk_socket: Identd and reporting IO signals -@@ -434,6 +435,9 @@ struct sock { - long sk_sndtimeo; - struct timer_list sk_timer; - ktime_t sk_stamp; -+#if BITS_PER_LONG==32 -+ seqlock_t sk_stamp_seq; -+#endif - u16 sk_tsflags; - u32 sk_tskey; - struct socket *sk_socket; -@@ -2146,6 +2150,34 @@ static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb) - atomic_add(segs, &sk->sk_drops); - } - -+static inline ktime_t sock_read_timestamp(struct sock *sk) -+{ -+#if BITS_PER_LONG==32 -+ unsigned int seq; -+ ktime_t kt; -+ -+ do { -+ seq = read_seqbegin(&sk->sk_stamp_seq); -+ kt = sk->sk_stamp; -+ } while (read_seqretry(&sk->sk_stamp_seq, seq)); -+ -+ return kt; -+#else -+ return sk->sk_stamp; -+#endif -+} -+ -+static inline void sock_write_timestamp(struct sock *sk, ktime_t kt) -+{ -+#if BITS_PER_LONG==32 -+ write_seqlock(&sk->sk_stamp_seq); -+ sk->sk_stamp = kt; -+ write_sequnlock(&sk->sk_stamp_seq); -+#else -+ sk->sk_stamp = kt; -+#endif -+} -+ - void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, - struct sk_buff *skb); - void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk, -@@ -2170,7 +2202,7 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb) - (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE))) - __sock_recv_timestamp(msg, sk, skb); - else -- sk->sk_stamp = kt; -+ sock_write_timestamp(sk, kt); - - if (sock_flag(sk, SOCK_WIFI_STATUS) && skb->wifi_acked_valid) - __sock_recv_wifi_status(msg, sk, skb); -@@ -2190,7 +2222,7 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk, - if (sk->sk_flags & FLAGS_TS_OR_DROPS || sk->sk_tsflags & TSFLAGS_ANY) - __sock_recv_ts_and_drops(msg, sk, skb); - else -- sk->sk_stamp = skb->tstamp; -+ sock_write_timestamp(sk, skb->tstamp); - } - - void __sock_tx_timestamp(const struct sock *sk, __u8 *tx_flags); -diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h -index 594b4b29a224..7ef11b97cb2a 100644 ---- a/include/trace/events/ext4.h -+++ b/include/trace/events/ext4.h -@@ -223,6 +223,26 @@ TRACE_EVENT(ext4_drop_inode, - (unsigned long) __entry->ino, __entry->drop) - ); - -+TRACE_EVENT(ext4_nfs_commit_metadata, -+ TP_PROTO(struct inode *inode), -+ -+ TP_ARGS(inode), -+ -+ TP_STRUCT__entry( -+ __field( dev_t, dev ) -+ __field( ino_t, ino ) -+ ), -+ -+ TP_fast_assign( -+ __entry->dev = inode->i_sb->s_dev; -+ __entry->ino = inode->i_ino; -+ ), -+ -+ TP_printk("dev %d,%d ino %lu", -+ MAJOR(__entry->dev), MINOR(__entry->dev), -+ (unsigned long) __entry->ino) -+); -+ - TRACE_EVENT(ext4_mark_inode_dirty, - TP_PROTO(struct inode *inode, unsigned long IP), - -diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h -index 87cf351bab03..9e07bf4259e1 100644 ---- a/include/uapi/linux/input-event-codes.h -+++ b/include/uapi/linux/input-event-codes.h -@@ -708,6 +708,15 @@ - - #define ABS_MISC 0x28 - -+/* -+ * 0x2e is reserved and should not be used in input drivers. -+ * It was used by HID as ABS_MISC+6 and userspace needs to detect if -+ * the next ABS_* event is correct or is just ABS_MISC + n. -+ * We define here ABS_RESERVED so userspace can rely on it and detect -+ * the situation described above. -+ */ -+#define ABS_RESERVED 0x2e -+ - #define ABS_MT_SLOT 0x2f /* MT slot being modified */ - #define ABS_MT_TOUCH_MAJOR 0x30 /* Major axis of touching ellipse */ - #define ABS_MT_TOUCH_MINOR 0x31 /* Minor axis (omit if circular) */ -diff --git a/kernel/fork.c b/kernel/fork.c -index dd2f79ac0771..e4b81913a998 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1411,8 +1411,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, - - posix_cpu_timers_init(p); - -- p->start_time = ktime_get_ns(); -- p->real_start_time = ktime_get_boot_ns(); - p->io_context = NULL; - p->audit_context = NULL; - cgroup_fork(p); -@@ -1572,6 +1570,17 @@ static struct task_struct *copy_process(unsigned long clone_flags, - if (retval) - goto bad_fork_free_pid; - -+ /* -+ * From this point on we must avoid any synchronous user-space -+ * communication until we take the tasklist-lock. In particular, we do -+ * not want user-space to be able to predict the process start-time by -+ * stalling fork(2) after we recorded the start_time but before it is -+ * visible to the system. -+ */ -+ -+ p->start_time = ktime_get_ns(); -+ p->real_start_time = ktime_get_boot_ns(); -+ - /* - * Make it visible to the rest of the system, but dont wake it up yet. - * Need tasklist lock for parent etc handling! -diff --git a/kernel/memremap.c b/kernel/memremap.c -index f719c925cb54..1be42f9b3e00 100644 ---- a/kernel/memremap.c -+++ b/kernel/memremap.c -@@ -171,15 +171,12 @@ void *devm_memremap_pages(struct device *dev, struct resource *res) - struct page_map *page_map; - int error, nid; - -- if (is_ram == REGION_MIXED) { -- WARN_ONCE(1, "%s attempted on mixed region %pr\n", -- __func__, res); -+ if (is_ram != REGION_DISJOINT) { -+ WARN_ONCE(1, "%s attempted on %s region %pr\n", __func__, -+ is_ram == REGION_MIXED ? "mixed" : "ram", res); - return ERR_PTR(-ENXIO); - } - -- if (is_ram == REGION_INTERSECTS) -- return __va(res->start); -- - page_map = devres_alloc_node(devm_memremap_pages_release, - sizeof(*page_map), GFP_KERNEL, dev_to_node(dev)); - if (!page_map) -@@ -202,5 +199,5 @@ void *devm_memremap_pages(struct device *dev, struct resource *res) - devres_add(dev, page_map); - return __va(res->start); - } --EXPORT_SYMBOL(devm_memremap_pages); -+EXPORT_SYMBOL_GPL(devm_memremap_pages); - #endif /* CONFIG_ZONE_DEVICE */ -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index a18923e4359d..0addef5f8aa3 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - - #include - -@@ -1471,6 +1472,21 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) - continue; - } - -+ /* -+ * HWPoison pages have elevated reference counts so the migration would -+ * fail on them. It also doesn't make any sense to migrate them in the -+ * first place. Still try to unmap such a page in case it is still mapped -+ * (e.g. current hwpoison implementation doesn't unmap KSM pages but keep -+ * the unmap as the catch all safety net). -+ */ -+ if (PageHWPoison(page)) { -+ if (WARN_ON(PageLRU(page))) -+ isolate_lru_page(page); -+ if (page_mapped(page)) -+ try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS); -+ continue; -+ } -+ - if (!get_page_unless_zero(page)) - continue; - /* -diff --git a/net/9p/client.c b/net/9p/client.c -index ed8738c4dc09..8fba9cd973c1 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -156,6 +156,12 @@ static int parse_opts(char *opts, struct p9_client *clnt) - ret = r; - continue; - } -+ if (option < 4096) { -+ p9_debug(P9_DEBUG_ERROR, -+ "msize should be at least 4k\n"); -+ ret = -EINVAL; -+ continue; -+ } - clnt->msize = option; - break; - case Opt_trans: -@@ -972,10 +978,18 @@ static int p9_client_version(struct p9_client *c) - else if (!strncmp(version, "9P2000", 6)) - c->proto_version = p9_proto_legacy; - else { -+ p9_debug(P9_DEBUG_ERROR, -+ "server returned an unknown version: %s\n", version); - err = -EREMOTEIO; - goto error; - } - -+ if (msize < 4096) { -+ p9_debug(P9_DEBUG_ERROR, -+ "server returned a msize < 4096: %d\n", msize); -+ err = -EREMOTEIO; -+ goto error; -+ } - if (msize < c->msize) - c->msize = msize; - -@@ -1040,6 +1054,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) - if (clnt->msize > clnt->trans_mod->maxsize) - clnt->msize = clnt->trans_mod->maxsize; - -+ if (clnt->msize < 4096) { -+ p9_debug(P9_DEBUG_ERROR, -+ "Please specify a msize of at least 4k\n"); -+ err = -EINVAL; -+ goto free_client; -+ } -+ - err = p9_client_version(clnt); - if (err) - goto close_trans; -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 2fdebabbfacd..2772f6a13fcb 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -654,15 +654,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname, - break; - } - -- dev = dev_get_by_name(&init_net, devname); -+ rtnl_lock(); -+ dev = __dev_get_by_name(&init_net, devname); - if (!dev) { -+ rtnl_unlock(); - res = -ENODEV; - break; - } - - ax25->ax25_dev = ax25_dev_ax25dev(dev); -+ if (!ax25->ax25_dev) { -+ rtnl_unlock(); -+ res = -ENODEV; -+ break; -+ } - ax25_fillin_cb(ax25, ax25->ax25_dev); -- dev_put(dev); -+ rtnl_unlock(); - break; - - default: -diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c -index 3d106767b272..5faca5db6385 100644 ---- a/net/ax25/ax25_dev.c -+++ b/net/ax25/ax25_dev.c -@@ -116,6 +116,7 @@ void ax25_dev_device_down(struct net_device *dev) - if ((s = ax25_dev_list) == ax25_dev) { - ax25_dev_list = s->next; - spin_unlock_bh(&ax25_dev_lock); -+ dev->ax25_ptr = NULL; - dev_put(dev); - kfree(ax25_dev); - return; -@@ -125,6 +126,7 @@ void ax25_dev_device_down(struct net_device *dev) - if (s->next == ax25_dev) { - s->next = ax25_dev->next; - spin_unlock_bh(&ax25_dev_lock); -+ dev->ax25_ptr = NULL; - dev_put(dev); - kfree(ax25_dev); - return; -diff --git a/net/compat.c b/net/compat.c -index 17e97b106458..d67684010455 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -443,12 +443,14 @@ int compat_sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp) - err = -ENOENT; - if (!sock_flag(sk, SOCK_TIMESTAMP)) - sock_enable_timestamp(sk, SOCK_TIMESTAMP); -- tv = ktime_to_timeval(sk->sk_stamp); -+ tv = ktime_to_timeval(sock_read_timestamp(sk)); -+ - if (tv.tv_sec == -1) - return err; - if (tv.tv_sec == 0) { -- sk->sk_stamp = ktime_get_real(); -- tv = ktime_to_timeval(sk->sk_stamp); -+ ktime_t kt = ktime_get_real(); -+ sock_write_timestamp(sk, kt); -+ tv = ktime_to_timeval(kt); - } - err = 0; - if (put_user(tv.tv_sec, &ctv->tv_sec) || -@@ -471,12 +473,13 @@ int compat_sock_get_timestampns(struct sock *sk, struct timespec __user *usersta - err = -ENOENT; - if (!sock_flag(sk, SOCK_TIMESTAMP)) - sock_enable_timestamp(sk, SOCK_TIMESTAMP); -- ts = ktime_to_timespec(sk->sk_stamp); -+ ts = ktime_to_timespec(sock_read_timestamp(sk)); - if (ts.tv_sec == -1) - return err; - if (ts.tv_sec == 0) { -- sk->sk_stamp = ktime_get_real(); -- ts = ktime_to_timespec(sk->sk_stamp); -+ ktime_t kt = ktime_get_real(); -+ sock_write_timestamp(sk, kt); -+ ts = ktime_to_timespec(kt); - } - err = 0; - if (put_user(ts.tv_sec, &ctv->tv_sec) || -diff --git a/net/core/sock.c b/net/core/sock.c -index 4238835a0e4e..9fb1c073d0c4 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2423,6 +2423,9 @@ void sock_init_data(struct socket *sock, struct sock *sk) - sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; - - sk->sk_stamp = ktime_set(-1L, 0); -+#if BITS_PER_LONG==32 -+ seqlock_init(&sk->sk_stamp_seq); -+#endif - - #ifdef CONFIG_NET_RX_BUSY_POLL - sk->sk_napi_id = 0; -diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c -index a10db45b2e1e..df32134da924 100644 ---- a/net/ieee802154/6lowpan/tx.c -+++ b/net/ieee802154/6lowpan/tx.c -@@ -55,6 +55,9 @@ int lowpan_header_create(struct sk_buff *skb, struct net_device *ldev, - const u8 *daddr = _daddr; - struct lowpan_addr_info *info; - -+ if (!daddr) -+ return -EINVAL; -+ - /* TODO: - * if this package isn't ipv6 one, where should it be routed? - */ -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 8e77786549c6..1cb865fcc91b 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -66,6 +66,7 @@ - #include - #include - #include -+#include - - #if defined(CONFIG_IP_PIMSM_V1) || defined(CONFIG_IP_PIMSM_V2) - #define CONFIG_IP_PIMSM 1 -@@ -1574,6 +1575,7 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) - return -EFAULT; - if (vr.vifi >= mrt->maxvif) - return -EINVAL; -+ vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif); - read_lock(&mrt_lock); - vif = &mrt->vif_table[vr.vifi]; - if (VIF_EXISTS(mrt, vr.vifi)) { -diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c -index 14dacf1df529..30b03d8e321a 100644 ---- a/net/ipv6/ip6_udp_tunnel.c -+++ b/net/ipv6/ip6_udp_tunnel.c -@@ -15,7 +15,7 @@ - int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg, - struct socket **sockp) - { -- struct sockaddr_in6 udp6_addr; -+ struct sockaddr_in6 udp6_addr = {}; - int err; - struct socket *sock = NULL; - -@@ -42,6 +42,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg, - goto error; - - if (cfg->peer_udp_port) { -+ memset(&udp6_addr, 0, sizeof(udp6_addr)); - udp6_addr.sin6_family = AF_INET6; - memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6, - sizeof(udp6_addr.sin6_addr)); -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 9b92960f024d..74b3e9718e84 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -72,6 +72,8 @@ struct mr6_table { - #endif - }; - -+#include -+ - struct ip6mr_rule { - struct fib_rule common; - }; -@@ -1871,6 +1873,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg) - return -EFAULT; - if (vr.mifi >= mrt->maxvif) - return -EINVAL; -+ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif); - read_lock(&mrt_lock); - vif = &mrt->vif6_table[vr.mifi]; - if (MIF_EXISTS(mrt, vr.mifi)) { -@@ -1945,6 +1948,7 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) - return -EFAULT; - if (vr.mifi >= mrt->maxvif) - return -EINVAL; -+ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif); - read_lock(&mrt_lock); - vif = &mrt->vif6_table[vr.mifi]; - if (MIF_EXISTS(mrt, vr.mifi)) { -diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c -index ed212ffc1d9d..046ae1caecea 100644 ---- a/net/netrom/af_netrom.c -+++ b/net/netrom/af_netrom.c -@@ -153,7 +153,7 @@ static struct sock *nr_find_listener(ax25_address *addr) - sk_for_each(s, &nr_list) - if (!ax25cmp(&nr_sk(s)->source_addr, addr) && - s->sk_state == TCP_LISTEN) { -- bh_lock_sock(s); -+ sock_hold(s); - goto found; - } - s = NULL; -@@ -174,7 +174,7 @@ static struct sock *nr_find_socket(unsigned char index, unsigned char id) - struct nr_sock *nr = nr_sk(s); - - if (nr->my_index == index && nr->my_id == id) { -- bh_lock_sock(s); -+ sock_hold(s); - goto found; - } - } -@@ -198,7 +198,7 @@ static struct sock *nr_find_peer(unsigned char index, unsigned char id, - - if (nr->your_index == index && nr->your_id == id && - !ax25cmp(&nr->dest_addr, dest)) { -- bh_lock_sock(s); -+ sock_hold(s); - goto found; - } - } -@@ -224,7 +224,7 @@ static unsigned short nr_find_next_circuit(void) - if (i != 0 && j != 0) { - if ((sk=nr_find_socket(i, j)) == NULL) - break; -- bh_unlock_sock(sk); -+ sock_put(sk); - } - - id++; -@@ -918,6 +918,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - } - - if (sk != NULL) { -+ bh_lock_sock(sk); - skb_reset_transport_header(skb); - - if (frametype == NR_CONNACK && skb->len == 22) -@@ -927,6 +928,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - - ret = nr_process_rx_frame(sk, skb); - bh_unlock_sock(sk); -+ sock_put(sk); - return ret; - } - -@@ -958,10 +960,12 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - (make = nr_make_new(sk)) == NULL) { - nr_transmit_refusal(skb, 0); - if (sk) -- bh_unlock_sock(sk); -+ sock_put(sk); - return 0; - } - -+ bh_lock_sock(sk); -+ - window = skb->data[20]; - - skb->sk = make; -@@ -1014,6 +1018,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - sk->sk_data_ready(sk); - - bh_unlock_sock(sk); -+ sock_put(sk); - - nr_insert_socket(make); - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 07668f152a3a..0f50977ed53b 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2511,8 +2511,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - sll_addr))) - goto out; - proto = saddr->sll_protocol; -- addr = saddr->sll_addr; -+ addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); -+ if (addr && dev && saddr->sll_halen < dev->addr_len) -+ goto out; - } - - err = -ENXIO; -@@ -2678,8 +2680,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) - goto out; - proto = saddr->sll_protocol; -- addr = saddr->sll_addr; -+ addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); -+ if (addr && dev && saddr->sll_halen < dev->addr_len) -+ goto out; - } - - err = -ENXIO; -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 5ca8309ea7b1..7dffc97a953c 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -101,6 +101,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev, - if (addr) { - addr->a.v6.sin6_family = AF_INET6; - addr->a.v6.sin6_port = 0; -+ addr->a.v6.sin6_flowinfo = 0; - addr->a.v6.sin6_addr = ifa->addr; - addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex; - addr->valid = 1; -diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index 036bbf2b44c1..b5291ea54a3d 100644 ---- a/net/sunrpc/auth_gss/svcauth_gss.c -+++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -1105,7 +1105,7 @@ static int svcauth_gss_legacy_init(struct svc_rqst *rqstp, - struct kvec *resv = &rqstp->rq_res.head[0]; - struct rsi *rsip, rsikey; - int ret; -- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); -+ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); - - memset(&rsikey, 0, sizeof(rsikey)); - ret = gss_read_verf(gc, argv, authp, -@@ -1216,7 +1216,7 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp, - uint64_t handle; - int status; - int ret; -- struct net *net = rqstp->rq_xprt->xpt_net; -+ struct net *net = SVC_NET(rqstp); - struct sunrpc_net *sn = net_generic(net, sunrpc_net_id); - - memset(&ud, 0, sizeof(ud)); -@@ -1406,7 +1406,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp) - __be32 *rpcstart; - __be32 *reject_stat = resv->iov_base + resv->iov_len; - int ret; -- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); -+ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); - - dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n", - argv->iov_len); -@@ -1694,7 +1694,7 @@ svcauth_gss_release(struct svc_rqst *rqstp) - struct rpc_gss_wire_cred *gc = &gsd->clcred; - struct xdr_buf *resbuf = &rqstp->rq_res; - int stat = -EINVAL; -- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id); -+ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id); - - if (gc->gc_proc != RPC_GSS_PROC_DATA) - goto out; -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 63fb5ee212cf..af17b00145e1 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -54,6 +54,11 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) - h->last_refresh = now; - } - -+static void cache_fresh_locked(struct cache_head *head, time_t expiry, -+ struct cache_detail *detail); -+static void cache_fresh_unlocked(struct cache_head *head, -+ struct cache_detail *detail); -+ - struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, - struct cache_head *key, int hash) - { -@@ -95,6 +100,7 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, - if (cache_is_expired(detail, tmp)) { - hlist_del_init(&tmp->cache_list); - detail->entries --; -+ cache_fresh_locked(tmp, 0, detail); - freeme = tmp; - break; - } -@@ -110,8 +116,10 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, - cache_get(new); - write_unlock(&detail->hash_lock); - -- if (freeme) -+ if (freeme) { -+ cache_fresh_unlocked(freeme, detail); - cache_put(freeme, detail); -+ } - return new; - } - EXPORT_SYMBOL_GPL(sunrpc_cache_lookup); -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 1413cdcc131c..9701fcca002c 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -614,7 +614,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp) - /* Don't enable netstamp, sunrpc doesn't - need that much accuracy */ - } -- svsk->sk_sk->sk_stamp = skb->tstamp; -+ sock_write_timestamp(svsk->sk_sk, skb->tstamp); - set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); /* there may be more data... */ - - len = skb->len - sizeof(struct udphdr); -diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c -index 589c8b9908a5..d24773552b64 100644 ---- a/net/vmw_vsock/vmci_transport.c -+++ b/net/vmw_vsock/vmci_transport.c -@@ -272,6 +272,31 @@ vmci_transport_send_control_pkt_bh(struct sockaddr_vm *src, - false); - } - -+static int -+vmci_transport_alloc_send_control_pkt(struct sockaddr_vm *src, -+ struct sockaddr_vm *dst, -+ enum vmci_transport_packet_type type, -+ u64 size, -+ u64 mode, -+ struct vmci_transport_waiting_info *wait, -+ u16 proto, -+ struct vmci_handle handle) -+{ -+ struct vmci_transport_packet *pkt; -+ int err; -+ -+ pkt = kmalloc(sizeof(*pkt), GFP_KERNEL); -+ if (!pkt) -+ return -ENOMEM; -+ -+ err = __vmci_transport_send_control_pkt(pkt, src, dst, type, size, -+ mode, wait, proto, handle, -+ true); -+ kfree(pkt); -+ -+ return err; -+} -+ - static int - vmci_transport_send_control_pkt(struct sock *sk, - enum vmci_transport_packet_type type, -@@ -281,9 +306,7 @@ vmci_transport_send_control_pkt(struct sock *sk, - u16 proto, - struct vmci_handle handle) - { -- struct vmci_transport_packet *pkt; - struct vsock_sock *vsk; -- int err; - - vsk = vsock_sk(sk); - -@@ -293,17 +316,10 @@ vmci_transport_send_control_pkt(struct sock *sk, - if (!vsock_addr_bound(&vsk->remote_addr)) - return -EINVAL; - -- pkt = kmalloc(sizeof(*pkt), GFP_KERNEL); -- if (!pkt) -- return -ENOMEM; -- -- err = __vmci_transport_send_control_pkt(pkt, &vsk->local_addr, -- &vsk->remote_addr, type, size, -- mode, wait, proto, handle, -- true); -- kfree(pkt); -- -- return err; -+ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr, -+ &vsk->remote_addr, -+ type, size, mode, -+ wait, proto, handle); - } - - static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst, -@@ -321,12 +337,29 @@ static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst, - static int vmci_transport_send_reset(struct sock *sk, - struct vmci_transport_packet *pkt) - { -+ struct sockaddr_vm *dst_ptr; -+ struct sockaddr_vm dst; -+ struct vsock_sock *vsk; -+ - if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST) - return 0; -- return vmci_transport_send_control_pkt(sk, -- VMCI_TRANSPORT_PACKET_TYPE_RST, -- 0, 0, NULL, VSOCK_PROTO_INVALID, -- VMCI_INVALID_HANDLE); -+ -+ vsk = vsock_sk(sk); -+ -+ if (!vsock_addr_bound(&vsk->local_addr)) -+ return -EINVAL; -+ -+ if (vsock_addr_bound(&vsk->remote_addr)) { -+ dst_ptr = &vsk->remote_addr; -+ } else { -+ vsock_addr_init(&dst, pkt->dg.src.context, -+ pkt->src_port); -+ dst_ptr = &dst; -+ } -+ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr, dst_ptr, -+ VMCI_TRANSPORT_PACKET_TYPE_RST, -+ 0, 0, NULL, VSOCK_PROTO_INVALID, -+ VMCI_INVALID_HANDLE); - } - - static int vmci_transport_send_negotiate(struct sock *sk, size_t size) -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 9b6e51450fc5..13f261feb75c 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -623,7 +623,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si) - { - spin_lock_bh(&net->xfrm.xfrm_state_lock); - si->sadcnt = net->xfrm.state_num; -- si->sadhcnt = net->xfrm.state_hmask; -+ si->sadhcnt = net->xfrm.state_hmask + 1; - si->sadhmcnt = xfrm_state_hashmax; - spin_unlock_bh(&net->xfrm.xfrm_state_lock); - } -diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl -index dd8397894d5c..12a6940741fe 100755 ---- a/scripts/checkstack.pl -+++ b/scripts/checkstack.pl -@@ -46,8 +46,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre); - $xs = "[0-9a-f ]"; # hex character or space - $funcre = qr/^$x* <(.*)>:$/; - if ($arch eq 'aarch64') { -- #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]! -- $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o; -+ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]! -+ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o; - } elsif ($arch eq 'arm') { - #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64 - $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o; -diff --git a/sound/core/pcm.c b/sound/core/pcm.c -index 6bda8f6c5f84..cdff5f976480 100644 ---- a/sound/core/pcm.c -+++ b/sound/core/pcm.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -125,6 +126,7 @@ static int snd_pcm_control_ioctl(struct snd_card *card, - return -EFAULT; - if (stream < 0 || stream > 1) - return -EINVAL; -+ stream = array_index_nospec(stream, 2); - if (get_user(subdevice, &info->subdevice)) - return -EFAULT; - mutex_lock(®ister_mutex); -diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c -index d2951ed4bf71..1984291ebd07 100644 ---- a/sound/pci/cs46xx/dsp_spos.c -+++ b/sound/pci/cs46xx/dsp_spos.c -@@ -899,6 +899,9 @@ int cs46xx_dsp_proc_done (struct snd_cs46xx *chip) - struct dsp_spos_instance * ins = chip->dsp_spos_instance; - int i; - -+ if (!ins) -+ return 0; -+ - snd_info_free_entry(ins->proc_sym_info_entry); - ins->proc_sym_info_entry = NULL; - -diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c -index 50b216fc369f..5d422d65e62b 100644 ---- a/sound/pci/emu10k1/emufx.c -+++ b/sound/pci/emu10k1/emufx.c -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1000,6 +1001,8 @@ static int snd_emu10k1_ipcm_poke(struct snd_emu10k1 *emu, - - if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT) - return -EINVAL; -+ ipcm->substream = array_index_nospec(ipcm->substream, -+ EMU10K1_FX8010_PCM_COUNT); - if (ipcm->channels > 32) - return -EINVAL; - pcm = &emu->fx8010.pcm[ipcm->substream]; -@@ -1046,6 +1049,8 @@ static int snd_emu10k1_ipcm_peek(struct snd_emu10k1 *emu, - - if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT) - return -EINVAL; -+ ipcm->substream = array_index_nospec(ipcm->substream, -+ EMU10K1_FX8010_PCM_COUNT); - pcm = &emu->fx8010.pcm[ipcm->substream]; - mutex_lock(&emu->fx8010.lock); - spin_lock_irq(&emu->reg_lock); -diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c -index 17fd81736d3d..039fbbb1e53c 100644 ---- a/sound/pci/hda/hda_tegra.c -+++ b/sound/pci/hda/hda_tegra.c -@@ -249,10 +249,12 @@ static int hda_tegra_suspend(struct device *dev) - struct snd_card *card = dev_get_drvdata(dev); - struct azx *chip = card->private_data; - struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip); -+ struct hdac_bus *bus = azx_bus(chip); - - snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); - - azx_stop_chip(chip); -+ synchronize_irq(bus->irq); - azx_enter_link_reset(chip); - hda_tegra_disable_clocks(hda); - -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index aea3cc2abe3a..536184ac315d 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -853,6 +853,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), -+ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), -diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c -index 7c8941b8b2de..dd6c9e6a1d53 100644 ---- a/sound/pci/rme9652/hdsp.c -+++ b/sound/pci/rme9652/hdsp.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -4065,15 +4066,16 @@ static int snd_hdsp_channel_info(struct snd_pcm_substream *substream, - struct snd_pcm_channel_info *info) - { - struct hdsp *hdsp = snd_pcm_substream_chip(substream); -- int mapped_channel; -+ unsigned int channel = info->channel; - -- if (snd_BUG_ON(info->channel >= hdsp->max_channels)) -+ if (snd_BUG_ON(channel >= hdsp->max_channels)) - return -EINVAL; -+ channel = array_index_nospec(channel, hdsp->max_channels); - -- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0) -+ if (hdsp->channel_map[channel] < 0) - return -EINVAL; - -- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES; -+ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES; - info->first = 0; - info->step = 32; - return 0; -diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c -index e557946718a9..d9fcae071b47 100644 ---- a/sound/synth/emux/emux_hwdep.c -+++ b/sound/synth/emux/emux_hwdep.c -@@ -22,9 +22,9 @@ - #include - #include - #include -+#include - #include "emux_voice.h" - -- - #define TMP_CLIENT_ID 0x1001 - - /* -@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux *emu, void __user *arg) - return -EFAULT; - if (info.mode < 0 || info.mode >= EMUX_MD_END) - return -EINVAL; -+ info.mode = array_index_nospec(info.mode, EMUX_MD_END); - - if (info.port < 0) { - for (i = 0; i < emu->num_ports; i++) - emu->portptrs[i]->ctrls[info.mode] = info.value; - } else { -- if (info.port < emu->num_ports) -+ if (info.port < emu->num_ports) { -+ info.port = array_index_nospec(info.port, emu->num_ports); - emu->portptrs[info.port]->ctrls[info.mode] = info.value; -+ } - } - return 0; - } -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 97d6a18e6956..f7eb0d2f797b 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -1816,7 +1816,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, - char *name) - { - struct uac_processing_unit_descriptor *desc = raw_desc; -- int num_ins = desc->bNrInPins; -+ int num_ins; - struct usb_mixer_elem_info *cval; - struct snd_kcontrol *kctl; - int i, err, nameid, type, len; -@@ -1831,7 +1831,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid, - 0, NULL, default_value_info - }; - -- if (desc->bLength < 13 || desc->bLength < 13 + num_ins || -+ if (desc->bLength < 13) { -+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); -+ return -EINVAL; -+ } -+ -+ num_ins = desc->bNrInPins; -+ if (desc->bLength < 13 + num_ins || - desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) { - usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid); - return -EINVAL; -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 15cbe2565703..d32727c74a16 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3321,6 +3321,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - } - } - }, -+ { -+ .ifnum = -1 -+ }, - } - } - }, -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index 593066c68e3d..4f650ebd564a 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -100,7 +100,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char * - char path[PATH_MAX]; - const char *lc; - -- snprintf(path, PATH_MAX, "%s/%s.scale", dir, name); -+ scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name); - - fd = open(path, O_RDONLY); - if (fd == -1) -@@ -147,7 +147,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n - ssize_t sret; - int fd; - -- snprintf(path, PATH_MAX, "%s/%s.unit", dir, name); -+ scnprintf(path, PATH_MAX, "%s/%s.unit", dir, name); - - fd = open(path, O_RDONLY); - if (fd == -1) -@@ -177,7 +177,7 @@ perf_pmu__parse_per_pkg(struct perf_pmu_alias *alias, char *dir, char *name) - char path[PATH_MAX]; - int fd; - -- snprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name); -+ scnprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name); - - fd = open(path, O_RDONLY); - if (fd == -1) -@@ -195,7 +195,7 @@ static int perf_pmu__parse_snapshot(struct perf_pmu_alias *alias, - char path[PATH_MAX]; - int fd; - -- snprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name); -+ scnprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name); - - fd = open(path, O_RDONLY); - if (fd == -1) diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.170-171.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.170-171.patch deleted file mode 100644 index 4061abc0c7d1..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.170-171.patch +++ /dev/null @@ -1,2650 +0,0 @@ -diff --git a/Makefile b/Makefile -index bc58f206c0da..c6b680faedd8 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 170 -+SUBLEVEL = 171 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/crypto/cts.c b/crypto/cts.c -index e467ec0acf9f..e65688d6a4ca 100644 ---- a/crypto/cts.c -+++ b/crypto/cts.c -@@ -137,8 +137,8 @@ static int crypto_cts_encrypt(struct blkcipher_desc *desc, - lcldesc.info = desc->info; - lcldesc.flags = desc->flags; - -- if (tot_blocks == 1) { -- err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, bsize); -+ if (tot_blocks <= 1) { -+ err = crypto_blkcipher_encrypt_iv(&lcldesc, dst, src, nbytes); - } else if (nbytes <= bsize * 2) { - err = cts_cbc_encrypt(ctx, desc, dst, src, 0, nbytes); - } else { -@@ -232,8 +232,8 @@ static int crypto_cts_decrypt(struct blkcipher_desc *desc, - lcldesc.info = desc->info; - lcldesc.flags = desc->flags; - -- if (tot_blocks == 1) { -- err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, bsize); -+ if (tot_blocks <= 1) { -+ err = crypto_blkcipher_decrypt_iv(&lcldesc, dst, src, nbytes); - } else if (nbytes <= bsize * 2) { - err = cts_cbc_decrypt(ctx, desc, dst, src, 0, nbytes); - } else { -diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c -index 1c2b846c5776..f28b4949cb9d 100644 ---- a/drivers/acpi/power.c -+++ b/drivers/acpi/power.c -@@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list) - } - } - -+static bool acpi_power_resource_is_dup(union acpi_object *package, -+ unsigned int start, unsigned int i) -+{ -+ acpi_handle rhandle, dup; -+ unsigned int j; -+ -+ /* The caller is expected to check the package element types */ -+ rhandle = package->package.elements[i].reference.handle; -+ for (j = start; j < i; j++) { -+ dup = package->package.elements[j].reference.handle; -+ if (dup == rhandle) -+ return true; -+ } -+ -+ return false; -+} -+ - int acpi_extract_power_resources(union acpi_object *package, unsigned int start, - struct list_head *list) - { -@@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start, - err = -ENODEV; - break; - } -+ -+ /* Some ACPI tables contain duplicate power resource references */ -+ if (acpi_power_resource_is_dup(package, start, i)) -+ continue; -+ - err = acpi_add_power_resource(rhandle); - if (err) - break; -diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c -index 94c837046786..57e3790c87b1 100644 ---- a/drivers/i2c/i2c-dev.c -+++ b/drivers/i2c/i2c-dev.c -@@ -459,9 +459,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - return i2cdev_ioctl_smbus(client, arg); - - case I2C_RETRIES: -+ if (arg > INT_MAX) -+ return -EINVAL; -+ - client->adapter->retries = arg; - break; - case I2C_TIMEOUT: -+ if (arg > INT_MAX) -+ return -EINVAL; -+ - /* For historical reasons, user-space sets the timeout - * value in units of 10 ms. - */ -diff --git a/drivers/pci/host/pcie-altera.c b/drivers/pci/host/pcie-altera.c -index 99da549d5d06..0118287a8a10 100644 ---- a/drivers/pci/host/pcie-altera.c -+++ b/drivers/pci/host/pcie-altera.c -@@ -40,8 +40,10 @@ - #define P2A_INT_ENABLE 0x3070 - #define P2A_INT_ENA_ALL 0xf - #define RP_LTSSM 0x3c64 -+#define RP_LTSSM_MASK 0x1f - #define LTSSM_L0 0xf - -+#define PCIE_CAP_OFFSET 0x80 - /* TLP configuration type 0 and 1 */ - #define TLP_FMTTYPE_CFGRD0 0x04 /* Configuration Read Type 0 */ - #define TLP_FMTTYPE_CFGWR0 0x44 /* Configuration Write Type 0 */ -@@ -60,6 +62,9 @@ - #define TLP_LOOP 500 - #define RP_DEVFN 0 - -+#define LINK_UP_TIMEOUT HZ -+#define LINK_RETRAIN_TIMEOUT HZ -+ - #define INTX_NUM 4 - - #define DWORD_MASK 3 -@@ -80,25 +85,21 @@ struct tlp_rp_regpair_t { - u32 reg1; - }; - --static void altera_pcie_retrain(struct pci_dev *dev) -+static inline void cra_writel(struct altera_pcie *pcie, const u32 value, -+ const u32 reg) - { -- u16 linkcap, linkstat; -- -- /* -- * Set the retrain bit if the PCIe rootport support > 2.5GB/s, but -- * current speed is 2.5 GB/s. -- */ -- pcie_capability_read_word(dev, PCI_EXP_LNKCAP, &linkcap); -+ writel_relaxed(value, pcie->cra_base + reg); -+} - -- if ((linkcap & PCI_EXP_LNKCAP_SLS) <= PCI_EXP_LNKCAP_SLS_2_5GB) -- return; -+static inline u32 cra_readl(struct altera_pcie *pcie, const u32 reg) -+{ -+ return readl_relaxed(pcie->cra_base + reg); -+} - -- pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &linkstat); -- if ((linkstat & PCI_EXP_LNKSTA_CLS) == PCI_EXP_LNKSTA_CLS_2_5GB) -- pcie_capability_set_word(dev, PCI_EXP_LNKCTL, -- PCI_EXP_LNKCTL_RL); -+static bool altera_pcie_link_is_up(struct altera_pcie *pcie) -+{ -+ return !!((cra_readl(pcie, RP_LTSSM) & RP_LTSSM_MASK) == LTSSM_L0); - } --DECLARE_PCI_FIXUP_EARLY(0x1172, PCI_ANY_ID, altera_pcie_retrain); - - /* - * Altera PCIe port uses BAR0 of RC's configuration space as the translation -@@ -119,17 +120,6 @@ static bool altera_pcie_hide_rc_bar(struct pci_bus *bus, unsigned int devfn, - return false; - } - --static inline void cra_writel(struct altera_pcie *pcie, const u32 value, -- const u32 reg) --{ -- writel_relaxed(value, pcie->cra_base + reg); --} -- --static inline u32 cra_readl(struct altera_pcie *pcie, const u32 reg) --{ -- return readl_relaxed(pcie->cra_base + reg); --} -- - static void tlp_write_tx(struct altera_pcie *pcie, - struct tlp_rp_regpair_t *tlp_rp_regdata) - { -@@ -138,11 +128,6 @@ static void tlp_write_tx(struct altera_pcie *pcie, - cra_writel(pcie, tlp_rp_regdata->ctrl, RP_TX_CNTRL); - } - --static bool altera_pcie_link_is_up(struct altera_pcie *pcie) --{ -- return !!(cra_readl(pcie, RP_LTSSM) & LTSSM_L0); --} -- - static bool altera_pcie_valid_config(struct altera_pcie *pcie, - struct pci_bus *bus, int dev) - { -@@ -286,22 +271,14 @@ static int tlp_cfg_dword_write(struct altera_pcie *pcie, u8 bus, u32 devfn, - return PCIBIOS_SUCCESSFUL; - } - --static int altera_pcie_cfg_read(struct pci_bus *bus, unsigned int devfn, -- int where, int size, u32 *value) -+static int _altera_pcie_cfg_read(struct altera_pcie *pcie, u8 busno, -+ unsigned int devfn, int where, int size, -+ u32 *value) - { -- struct altera_pcie *pcie = bus->sysdata; - int ret; - u32 data; - u8 byte_en; - -- if (altera_pcie_hide_rc_bar(bus, devfn, where)) -- return PCIBIOS_BAD_REGISTER_NUMBER; -- -- if (!altera_pcie_valid_config(pcie, bus, PCI_SLOT(devfn))) { -- *value = 0xffffffff; -- return PCIBIOS_DEVICE_NOT_FOUND; -- } -- - switch (size) { - case 1: - byte_en = 1 << (where & 3); -@@ -314,7 +291,7 @@ static int altera_pcie_cfg_read(struct pci_bus *bus, unsigned int devfn, - break; - } - -- ret = tlp_cfg_dword_read(pcie, bus->number, devfn, -+ ret = tlp_cfg_dword_read(pcie, busno, devfn, - (where & ~DWORD_MASK), byte_en, &data); - if (ret != PCIBIOS_SUCCESSFUL) - return ret; -@@ -334,20 +311,14 @@ static int altera_pcie_cfg_read(struct pci_bus *bus, unsigned int devfn, - return PCIBIOS_SUCCESSFUL; - } - --static int altera_pcie_cfg_write(struct pci_bus *bus, unsigned int devfn, -- int where, int size, u32 value) -+static int _altera_pcie_cfg_write(struct altera_pcie *pcie, u8 busno, -+ unsigned int devfn, int where, int size, -+ u32 value) - { -- struct altera_pcie *pcie = bus->sysdata; - u32 data32; - u32 shift = 8 * (where & 3); - u8 byte_en; - -- if (altera_pcie_hide_rc_bar(bus, devfn, where)) -- return PCIBIOS_BAD_REGISTER_NUMBER; -- -- if (!altera_pcie_valid_config(pcie, bus, PCI_SLOT(devfn))) -- return PCIBIOS_DEVICE_NOT_FOUND; -- - switch (size) { - case 1: - data32 = (value & 0xff) << shift; -@@ -363,8 +334,40 @@ static int altera_pcie_cfg_write(struct pci_bus *bus, unsigned int devfn, - break; - } - -- return tlp_cfg_dword_write(pcie, bus->number, devfn, -- (where & ~DWORD_MASK), byte_en, data32); -+ return tlp_cfg_dword_write(pcie, busno, devfn, (where & ~DWORD_MASK), -+ byte_en, data32); -+} -+ -+static int altera_pcie_cfg_read(struct pci_bus *bus, unsigned int devfn, -+ int where, int size, u32 *value) -+{ -+ struct altera_pcie *pcie = bus->sysdata; -+ -+ if (altera_pcie_hide_rc_bar(bus, devfn, where)) -+ return PCIBIOS_BAD_REGISTER_NUMBER; -+ -+ if (!altera_pcie_valid_config(pcie, bus, PCI_SLOT(devfn))) { -+ *value = 0xffffffff; -+ return PCIBIOS_DEVICE_NOT_FOUND; -+ } -+ -+ return _altera_pcie_cfg_read(pcie, bus->number, devfn, where, size, -+ value); -+} -+ -+static int altera_pcie_cfg_write(struct pci_bus *bus, unsigned int devfn, -+ int where, int size, u32 value) -+{ -+ struct altera_pcie *pcie = bus->sysdata; -+ -+ if (altera_pcie_hide_rc_bar(bus, devfn, where)) -+ return PCIBIOS_BAD_REGISTER_NUMBER; -+ -+ if (!altera_pcie_valid_config(pcie, bus, PCI_SLOT(devfn))) -+ return PCIBIOS_DEVICE_NOT_FOUND; -+ -+ return _altera_pcie_cfg_write(pcie, bus->number, devfn, where, size, -+ value); - } - - static struct pci_ops altera_pcie_ops = { -@@ -372,6 +375,90 @@ static struct pci_ops altera_pcie_ops = { - .write = altera_pcie_cfg_write, - }; - -+static int altera_read_cap_word(struct altera_pcie *pcie, u8 busno, -+ unsigned int devfn, int offset, u16 *value) -+{ -+ u32 data; -+ int ret; -+ -+ ret = _altera_pcie_cfg_read(pcie, busno, devfn, -+ PCIE_CAP_OFFSET + offset, sizeof(*value), -+ &data); -+ *value = data; -+ return ret; -+} -+ -+static int altera_write_cap_word(struct altera_pcie *pcie, u8 busno, -+ unsigned int devfn, int offset, u16 value) -+{ -+ return _altera_pcie_cfg_write(pcie, busno, devfn, -+ PCIE_CAP_OFFSET + offset, sizeof(value), -+ value); -+} -+ -+static void altera_wait_link_retrain(struct altera_pcie *pcie) -+{ -+ u16 reg16; -+ unsigned long start_jiffies; -+ -+ /* Wait for link training end. */ -+ start_jiffies = jiffies; -+ for (;;) { -+ altera_read_cap_word(pcie, pcie->root_bus_nr, RP_DEVFN, -+ PCI_EXP_LNKSTA, ®16); -+ if (!(reg16 & PCI_EXP_LNKSTA_LT)) -+ break; -+ -+ if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT)) { -+ dev_err(&pcie->pdev->dev, "link retrain timeout\n"); -+ break; -+ } -+ udelay(100); -+ } -+ -+ /* Wait for link is up */ -+ start_jiffies = jiffies; -+ for (;;) { -+ if (altera_pcie_link_is_up(pcie)) -+ break; -+ -+ if (time_after(jiffies, start_jiffies + LINK_UP_TIMEOUT)) { -+ dev_err(&pcie->pdev->dev, "link up timeout\n"); -+ break; -+ } -+ udelay(100); -+ } -+} -+ -+static void altera_pcie_retrain(struct altera_pcie *pcie) -+{ -+ u16 linkcap, linkstat, linkctl; -+ -+ if (!altera_pcie_link_is_up(pcie)) -+ return; -+ -+ /* -+ * Set the retrain bit if the PCIe rootport support > 2.5GB/s, but -+ * current speed is 2.5 GB/s. -+ */ -+ altera_read_cap_word(pcie, pcie->root_bus_nr, RP_DEVFN, PCI_EXP_LNKCAP, -+ &linkcap); -+ if ((linkcap & PCI_EXP_LNKCAP_SLS) <= PCI_EXP_LNKCAP_SLS_2_5GB) -+ return; -+ -+ altera_read_cap_word(pcie, pcie->root_bus_nr, RP_DEVFN, PCI_EXP_LNKSTA, -+ &linkstat); -+ if ((linkstat & PCI_EXP_LNKSTA_CLS) == PCI_EXP_LNKSTA_CLS_2_5GB) { -+ altera_read_cap_word(pcie, pcie->root_bus_nr, RP_DEVFN, -+ PCI_EXP_LNKCTL, &linkctl); -+ linkctl |= PCI_EXP_LNKCTL_RL; -+ altera_write_cap_word(pcie, pcie->root_bus_nr, RP_DEVFN, -+ PCI_EXP_LNKCTL, linkctl); -+ -+ altera_wait_link_retrain(pcie); -+ } -+} -+ - static int altera_pcie_intx_map(struct irq_domain *domain, unsigned int irq, - irq_hw_number_t hwirq) - { -@@ -506,6 +593,11 @@ static int altera_pcie_parse_dt(struct altera_pcie *pcie) - return 0; - } - -+static void altera_pcie_host_init(struct altera_pcie *pcie) -+{ -+ altera_pcie_retrain(pcie); -+} -+ - static int altera_pcie_probe(struct platform_device *pdev) - { - struct altera_pcie *pcie; -@@ -543,6 +635,7 @@ static int altera_pcie_probe(struct platform_device *pdev) - cra_writel(pcie, P2A_INT_STS_ALL, P2A_INT_STATUS); - /* enable all interrupts */ - cra_writel(pcie, P2A_INT_ENA_ALL, P2A_INT_ENABLE); -+ altera_pcie_host_init(pcie); - - bus = pci_scan_root_bus(&pdev->dev, pcie->root_bus_nr, &altera_pcie_ops, - pcie, &pcie->resources); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 3919ea066bf9..736de1021d8b 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1885,6 +1885,13 @@ static const struct usb_device_id acm_ids[] = { - .driver_info = IGNORE_DEVICE, - }, - -+ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ -+ .driver_info = SEND_ZERO_PACKET, -+ }, -+ { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */ -+ .driver_info = SEND_ZERO_PACKET, -+ }, -+ - /* control interfaces without any protocol set */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, - USB_CDC_PROTO_NONE) }, -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index cf378b1ed373..733479ddf8a7 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -240,7 +240,8 @@ static const struct usb_device_id usb_quirk_list[] = { - USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, - - /* Corsair K70 RGB */ -- { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, -+ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT | -+ USB_QUIRK_DELAY_CTRL_MSG }, - - /* Corsair Strafe */ - { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT | -diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c -index 6c186b4df94a..b3344a77dcce 100644 ---- a/drivers/usb/storage/scsiglue.c -+++ b/drivers/usb/storage/scsiglue.c -@@ -223,8 +223,12 @@ static int slave_configure(struct scsi_device *sdev) - if (!(us->fflags & US_FL_NEEDS_CAP16)) - sdev->try_rc_10_first = 1; - -- /* assume SPC3 or latter devices support sense size > 18 */ -- if (sdev->scsi_level > SCSI_SPC_2) -+ /* -+ * assume SPC3 or latter devices support sense size > 18 -+ * unless US_FL_BAD_SENSE quirk is specified. -+ */ -+ if (sdev->scsi_level > SCSI_SPC_2 && -+ !(us->fflags & US_FL_BAD_SENSE)) - us->fflags |= US_FL_SANE_SENSE; - - /* USB-IDE bridges tend to report SK = 0x04 (Non-recoverable -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 898215cad351..d92b974f0635 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -1392,6 +1392,18 @@ UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_SANE_SENSE), - -+/* -+ * Reported by Icenowy Zheng -+ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state -+ * that do not process read/write command if a long sense is requested, -+ * so force to use 18-byte sense. -+ */ -+UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff, -+ "SMI", -+ "SM3350 UFS-to-USB-Mass-Storage bridge", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_BAD_SENSE ), -+ - /* - * Pete Zaitcev , bz#164688. - * The device blatantly ignores LUN and returns 1 in GetMaxLUN. -diff --git a/fs/btrfs/Makefile b/fs/btrfs/Makefile -index 6d1d0b93b1aa..c792df826e12 100644 ---- a/fs/btrfs/Makefile -+++ b/fs/btrfs/Makefile -@@ -9,7 +9,7 @@ btrfs-y += super.o ctree.o extent-tree.o print-tree.o root-tree.o dir-item.o \ - export.o tree-log.o free-space-cache.o zlib.o lzo.o \ - compression.o delayed-ref.o relocation.o delayed-inode.o scrub.o \ - reada.o backref.o ulist.o qgroup.o send.o dev-replace.o raid56.o \ -- uuid-tree.o props.o hash.o -+ uuid-tree.o props.o hash.o tree-checker.o - - btrfs-$(CONFIG_BTRFS_FS_POSIX_ACL) += acl.o - btrfs-$(CONFIG_BTRFS_FS_CHECK_INTEGRITY) += check-integrity.o -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 38ee08675468..8f4baa3cb992 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -1726,20 +1726,6 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans, - return err; - } - --/* -- * The leaf data grows from end-to-front in the node. -- * this returns the address of the start of the last item, -- * which is the stop of the leaf data stack -- */ --static inline unsigned int leaf_data_end(struct btrfs_root *root, -- struct extent_buffer *leaf) --{ -- u32 nr = btrfs_header_nritems(leaf); -- if (nr == 0) -- return BTRFS_LEAF_DATA_SIZE(root); -- return btrfs_item_offset_nr(leaf, nr - 1); --} -- - - /* - * search for key in the extent_buffer. The items start at offset p, -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index e847573c6db0..4a91d3119e59 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - #include "extent_io.h" - #include "extent_map.h" - #include "async-thread.h" -@@ -897,6 +898,7 @@ struct btrfs_balance_item { - #define BTRFS_FILE_EXTENT_INLINE 0 - #define BTRFS_FILE_EXTENT_REG 1 - #define BTRFS_FILE_EXTENT_PREALLOC 2 -+#define BTRFS_FILE_EXTENT_TYPES 2 - - struct btrfs_file_extent_item { - /* -@@ -2283,7 +2285,7 @@ do { \ - #define BTRFS_INODE_ROOT_ITEM_INIT (1 << 31) - - struct btrfs_map_token { -- struct extent_buffer *eb; -+ const struct extent_buffer *eb; - char *kaddr; - unsigned long offset; - }; -@@ -2314,18 +2316,19 @@ static inline void btrfs_init_map_token (struct btrfs_map_token *token) - sizeof(((type *)0)->member))) - - #define DECLARE_BTRFS_SETGET_BITS(bits) \ --u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr, \ -- unsigned long off, \ -- struct btrfs_map_token *token); \ --void btrfs_set_token_##bits(struct extent_buffer *eb, void *ptr, \ -+u##bits btrfs_get_token_##bits(const struct extent_buffer *eb, \ -+ const void *ptr, unsigned long off, \ -+ struct btrfs_map_token *token); \ -+void btrfs_set_token_##bits(struct extent_buffer *eb, const void *ptr, \ - unsigned long off, u##bits val, \ - struct btrfs_map_token *token); \ --static inline u##bits btrfs_get_##bits(struct extent_buffer *eb, void *ptr, \ -+static inline u##bits btrfs_get_##bits(const struct extent_buffer *eb, \ -+ const void *ptr, \ - unsigned long off) \ - { \ - return btrfs_get_token_##bits(eb, ptr, off, NULL); \ - } \ --static inline void btrfs_set_##bits(struct extent_buffer *eb, void *ptr, \ -+static inline void btrfs_set_##bits(struct extent_buffer *eb, void *ptr,\ - unsigned long off, u##bits val) \ - { \ - btrfs_set_token_##bits(eb, ptr, off, val, NULL); \ -@@ -2337,7 +2340,8 @@ DECLARE_BTRFS_SETGET_BITS(32) - DECLARE_BTRFS_SETGET_BITS(64) - - #define BTRFS_SETGET_FUNCS(name, type, member, bits) \ --static inline u##bits btrfs_##name(struct extent_buffer *eb, type *s) \ -+static inline u##bits btrfs_##name(const struct extent_buffer *eb, \ -+ const type *s) \ - { \ - BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member); \ - return btrfs_get_##bits(eb, s, offsetof(type, member)); \ -@@ -2348,7 +2352,8 @@ static inline void btrfs_set_##name(struct extent_buffer *eb, type *s, \ - BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member); \ - btrfs_set_##bits(eb, s, offsetof(type, member), val); \ - } \ --static inline u##bits btrfs_token_##name(struct extent_buffer *eb, type *s, \ -+static inline u##bits btrfs_token_##name(const struct extent_buffer *eb,\ -+ const type *s, \ - struct btrfs_map_token *token) \ - { \ - BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member); \ -@@ -2363,9 +2368,9 @@ static inline void btrfs_set_token_##name(struct extent_buffer *eb, \ - } - - #define BTRFS_SETGET_HEADER_FUNCS(name, type, member, bits) \ --static inline u##bits btrfs_##name(struct extent_buffer *eb) \ -+static inline u##bits btrfs_##name(const struct extent_buffer *eb) \ - { \ -- type *p = page_address(eb->pages[0]); \ -+ const type *p = page_address(eb->pages[0]); \ - u##bits res = le##bits##_to_cpu(p->member); \ - return res; \ - } \ -@@ -2377,7 +2382,7 @@ static inline void btrfs_set_##name(struct extent_buffer *eb, \ - } - - #define BTRFS_SETGET_STACK_FUNCS(name, type, member, bits) \ --static inline u##bits btrfs_##name(type *s) \ -+static inline u##bits btrfs_##name(const type *s) \ - { \ - return le##bits##_to_cpu(s->member); \ - } \ -@@ -2678,7 +2683,7 @@ static inline unsigned long btrfs_node_key_ptr_offset(int nr) - sizeof(struct btrfs_key_ptr) * nr; - } - --void btrfs_node_key(struct extent_buffer *eb, -+void btrfs_node_key(const struct extent_buffer *eb, - struct btrfs_disk_key *disk_key, int nr); - - static inline void btrfs_set_node_key(struct extent_buffer *eb, -@@ -2707,28 +2712,28 @@ static inline struct btrfs_item *btrfs_item_nr(int nr) - return (struct btrfs_item *)btrfs_item_nr_offset(nr); - } - --static inline u32 btrfs_item_end(struct extent_buffer *eb, -+static inline u32 btrfs_item_end(const struct extent_buffer *eb, - struct btrfs_item *item) - { - return btrfs_item_offset(eb, item) + btrfs_item_size(eb, item); - } - --static inline u32 btrfs_item_end_nr(struct extent_buffer *eb, int nr) -+static inline u32 btrfs_item_end_nr(const struct extent_buffer *eb, int nr) - { - return btrfs_item_end(eb, btrfs_item_nr(nr)); - } - --static inline u32 btrfs_item_offset_nr(struct extent_buffer *eb, int nr) -+static inline u32 btrfs_item_offset_nr(const struct extent_buffer *eb, int nr) - { - return btrfs_item_offset(eb, btrfs_item_nr(nr)); - } - --static inline u32 btrfs_item_size_nr(struct extent_buffer *eb, int nr) -+static inline u32 btrfs_item_size_nr(const struct extent_buffer *eb, int nr) - { - return btrfs_item_size(eb, btrfs_item_nr(nr)); - } - --static inline void btrfs_item_key(struct extent_buffer *eb, -+static inline void btrfs_item_key(const struct extent_buffer *eb, - struct btrfs_disk_key *disk_key, int nr) - { - struct btrfs_item *item = btrfs_item_nr(nr); -@@ -2764,8 +2769,8 @@ BTRFS_SETGET_STACK_FUNCS(stack_dir_name_len, struct btrfs_dir_item, - BTRFS_SETGET_STACK_FUNCS(stack_dir_transid, struct btrfs_dir_item, - transid, 64); - --static inline void btrfs_dir_item_key(struct extent_buffer *eb, -- struct btrfs_dir_item *item, -+static inline void btrfs_dir_item_key(const struct extent_buffer *eb, -+ const struct btrfs_dir_item *item, - struct btrfs_disk_key *key) - { - read_eb_member(eb, item, struct btrfs_dir_item, location, key); -@@ -2773,7 +2778,7 @@ static inline void btrfs_dir_item_key(struct extent_buffer *eb, - - static inline void btrfs_set_dir_item_key(struct extent_buffer *eb, - struct btrfs_dir_item *item, -- struct btrfs_disk_key *key) -+ const struct btrfs_disk_key *key) - { - write_eb_member(eb, item, struct btrfs_dir_item, location, key); - } -@@ -2785,8 +2790,8 @@ BTRFS_SETGET_FUNCS(free_space_bitmaps, struct btrfs_free_space_header, - BTRFS_SETGET_FUNCS(free_space_generation, struct btrfs_free_space_header, - generation, 64); - --static inline void btrfs_free_space_key(struct extent_buffer *eb, -- struct btrfs_free_space_header *h, -+static inline void btrfs_free_space_key(const struct extent_buffer *eb, -+ const struct btrfs_free_space_header *h, - struct btrfs_disk_key *key) - { - read_eb_member(eb, h, struct btrfs_free_space_header, location, key); -@@ -2794,7 +2799,7 @@ static inline void btrfs_free_space_key(struct extent_buffer *eb, - - static inline void btrfs_set_free_space_key(struct extent_buffer *eb, - struct btrfs_free_space_header *h, -- struct btrfs_disk_key *key) -+ const struct btrfs_disk_key *key) - { - write_eb_member(eb, h, struct btrfs_free_space_header, location, key); - } -@@ -2821,25 +2826,25 @@ static inline void btrfs_cpu_key_to_disk(struct btrfs_disk_key *disk, - disk->objectid = cpu_to_le64(cpu->objectid); - } - --static inline void btrfs_node_key_to_cpu(struct extent_buffer *eb, -- struct btrfs_key *key, int nr) -+static inline void btrfs_node_key_to_cpu(const struct extent_buffer *eb, -+ struct btrfs_key *key, int nr) - { - struct btrfs_disk_key disk_key; - btrfs_node_key(eb, &disk_key, nr); - btrfs_disk_key_to_cpu(key, &disk_key); - } - --static inline void btrfs_item_key_to_cpu(struct extent_buffer *eb, -- struct btrfs_key *key, int nr) -+static inline void btrfs_item_key_to_cpu(const struct extent_buffer *eb, -+ struct btrfs_key *key, int nr) - { - struct btrfs_disk_key disk_key; - btrfs_item_key(eb, &disk_key, nr); - btrfs_disk_key_to_cpu(key, &disk_key); - } - --static inline void btrfs_dir_item_key_to_cpu(struct extent_buffer *eb, -- struct btrfs_dir_item *item, -- struct btrfs_key *key) -+static inline void btrfs_dir_item_key_to_cpu(const struct extent_buffer *eb, -+ const struct btrfs_dir_item *item, -+ struct btrfs_key *key) - { - struct btrfs_disk_key disk_key; - btrfs_dir_item_key(eb, item, &disk_key); -@@ -2872,7 +2877,7 @@ BTRFS_SETGET_STACK_FUNCS(stack_header_nritems, struct btrfs_header, - nritems, 32); - BTRFS_SETGET_STACK_FUNCS(stack_header_bytenr, struct btrfs_header, bytenr, 64); - --static inline int btrfs_header_flag(struct extent_buffer *eb, u64 flag) -+static inline int btrfs_header_flag(const struct extent_buffer *eb, u64 flag) - { - return (btrfs_header_flags(eb) & flag) == flag; - } -@@ -2891,7 +2896,7 @@ static inline int btrfs_clear_header_flag(struct extent_buffer *eb, u64 flag) - return (flags & flag) == flag; - } - --static inline int btrfs_header_backref_rev(struct extent_buffer *eb) -+static inline int btrfs_header_backref_rev(const struct extent_buffer *eb) - { - u64 flags = btrfs_header_flags(eb); - return flags >> BTRFS_BACKREF_REV_SHIFT; -@@ -2911,12 +2916,12 @@ static inline unsigned long btrfs_header_fsid(void) - return offsetof(struct btrfs_header, fsid); - } - --static inline unsigned long btrfs_header_chunk_tree_uuid(struct extent_buffer *eb) -+static inline unsigned long btrfs_header_chunk_tree_uuid(const struct extent_buffer *eb) - { - return offsetof(struct btrfs_header, chunk_tree_uuid); - } - --static inline int btrfs_is_leaf(struct extent_buffer *eb) -+static inline int btrfs_is_leaf(const struct extent_buffer *eb) - { - return btrfs_header_level(eb) == 0; - } -@@ -2950,12 +2955,12 @@ BTRFS_SETGET_STACK_FUNCS(root_stransid, struct btrfs_root_item, - BTRFS_SETGET_STACK_FUNCS(root_rtransid, struct btrfs_root_item, - rtransid, 64); - --static inline bool btrfs_root_readonly(struct btrfs_root *root) -+static inline bool btrfs_root_readonly(const struct btrfs_root *root) - { - return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0; - } - --static inline bool btrfs_root_dead(struct btrfs_root *root) -+static inline bool btrfs_root_dead(const struct btrfs_root *root) - { - return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_DEAD)) != 0; - } -@@ -3012,51 +3017,51 @@ BTRFS_SETGET_STACK_FUNCS(backup_num_devices, struct btrfs_root_backup, - /* struct btrfs_balance_item */ - BTRFS_SETGET_FUNCS(balance_flags, struct btrfs_balance_item, flags, 64); - --static inline void btrfs_balance_data(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -+static inline void btrfs_balance_data(const struct extent_buffer *eb, -+ const struct btrfs_balance_item *bi, - struct btrfs_disk_balance_args *ba) - { - read_eb_member(eb, bi, struct btrfs_balance_item, data, ba); - } - - static inline void btrfs_set_balance_data(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -- struct btrfs_disk_balance_args *ba) -+ struct btrfs_balance_item *bi, -+ const struct btrfs_disk_balance_args *ba) - { - write_eb_member(eb, bi, struct btrfs_balance_item, data, ba); - } - --static inline void btrfs_balance_meta(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -+static inline void btrfs_balance_meta(const struct extent_buffer *eb, -+ const struct btrfs_balance_item *bi, - struct btrfs_disk_balance_args *ba) - { - read_eb_member(eb, bi, struct btrfs_balance_item, meta, ba); - } - - static inline void btrfs_set_balance_meta(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -- struct btrfs_disk_balance_args *ba) -+ struct btrfs_balance_item *bi, -+ const struct btrfs_disk_balance_args *ba) - { - write_eb_member(eb, bi, struct btrfs_balance_item, meta, ba); - } - --static inline void btrfs_balance_sys(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -+static inline void btrfs_balance_sys(const struct extent_buffer *eb, -+ const struct btrfs_balance_item *bi, - struct btrfs_disk_balance_args *ba) - { - read_eb_member(eb, bi, struct btrfs_balance_item, sys, ba); - } - - static inline void btrfs_set_balance_sys(struct extent_buffer *eb, -- struct btrfs_balance_item *bi, -- struct btrfs_disk_balance_args *ba) -+ struct btrfs_balance_item *bi, -+ const struct btrfs_disk_balance_args *ba) - { - write_eb_member(eb, bi, struct btrfs_balance_item, sys, ba); - } - - static inline void - btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu, -- struct btrfs_disk_balance_args *disk) -+ const struct btrfs_disk_balance_args *disk) - { - memset(cpu, 0, sizeof(*cpu)); - -@@ -3076,7 +3081,7 @@ btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu, - - static inline void - btrfs_cpu_balance_args_to_disk(struct btrfs_disk_balance_args *disk, -- struct btrfs_balance_args *cpu) -+ const struct btrfs_balance_args *cpu) - { - memset(disk, 0, sizeof(*disk)); - -@@ -3144,7 +3149,7 @@ BTRFS_SETGET_STACK_FUNCS(super_magic, struct btrfs_super_block, magic, 64); - BTRFS_SETGET_STACK_FUNCS(super_uuid_tree_generation, struct btrfs_super_block, - uuid_tree_generation, 64); - --static inline int btrfs_super_csum_size(struct btrfs_super_block *s) -+static inline int btrfs_super_csum_size(const struct btrfs_super_block *s) - { - u16 t = btrfs_super_csum_type(s); - /* -@@ -3158,6 +3163,21 @@ static inline unsigned long btrfs_leaf_data(struct extent_buffer *l) - return offsetof(struct btrfs_leaf, items); - } - -+/* -+ * The leaf data grows from end-to-front in the node. -+ * this returns the address of the start of the last item, -+ * which is the stop of the leaf data stack -+ */ -+static inline unsigned int leaf_data_end(const struct btrfs_root *root, -+ const struct extent_buffer *leaf) -+{ -+ u32 nr = btrfs_header_nritems(leaf); -+ -+ if (nr == 0) -+ return BTRFS_LEAF_DATA_SIZE(root); -+ return btrfs_item_offset_nr(leaf, nr - 1); -+} -+ - /* struct btrfs_file_extent_item */ - BTRFS_SETGET_FUNCS(file_extent_type, struct btrfs_file_extent_item, type, 8); - BTRFS_SETGET_STACK_FUNCS(stack_file_extent_disk_bytenr, -@@ -3174,7 +3194,7 @@ BTRFS_SETGET_STACK_FUNCS(stack_file_extent_compression, - struct btrfs_file_extent_item, compression, 8); - - static inline unsigned long --btrfs_file_extent_inline_start(struct btrfs_file_extent_item *e) -+btrfs_file_extent_inline_start(const struct btrfs_file_extent_item *e) - { - return (unsigned long)e + BTRFS_FILE_EXTENT_INLINE_DATA_START; - } -@@ -3208,8 +3228,9 @@ BTRFS_SETGET_FUNCS(file_extent_other_encoding, struct btrfs_file_extent_item, - * size of any extent headers. If a file is compressed on disk, this is - * the compressed size - */ --static inline u32 btrfs_file_extent_inline_item_len(struct extent_buffer *eb, -- struct btrfs_item *e) -+static inline u32 btrfs_file_extent_inline_item_len( -+ const struct extent_buffer *eb, -+ struct btrfs_item *e) - { - return btrfs_item_size(eb, e) - BTRFS_FILE_EXTENT_INLINE_DATA_START; - } -@@ -3217,9 +3238,9 @@ static inline u32 btrfs_file_extent_inline_item_len(struct extent_buffer *eb, - /* this returns the number of file bytes represented by the inline item. - * If an item is compressed, this is the uncompressed size - */ --static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb, -- int slot, -- struct btrfs_file_extent_item *fi) -+static inline u32 btrfs_file_extent_inline_len(const struct extent_buffer *eb, -+ int slot, -+ const struct btrfs_file_extent_item *fi) - { - struct btrfs_map_token token; - -@@ -3241,8 +3262,8 @@ static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb, - - - /* btrfs_dev_stats_item */ --static inline u64 btrfs_dev_stats_value(struct extent_buffer *eb, -- struct btrfs_dev_stats_item *ptr, -+static inline u64 btrfs_dev_stats_value(const struct extent_buffer *eb, -+ const struct btrfs_dev_stats_item *ptr, - int index) - { - u64 val; -diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c -index 176a27bc63aa..81e5bc62e8e3 100644 ---- a/fs/btrfs/dev-replace.c -+++ b/fs/btrfs/dev-replace.c -@@ -620,7 +620,7 @@ static void btrfs_dev_replace_update_device_in_mapping_tree( - em = lookup_extent_mapping(em_tree, start, (u64)-1); - if (!em) - break; -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - for (i = 0; i < map->num_stripes; i++) - if (srcdev == map->stripes[i].dev) - map->stripes[i].dev = tgtdev; -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 1f21c6c33228..f80a0af68736 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -49,6 +49,7 @@ - #include "raid56.h" - #include "sysfs.h" - #include "qgroup.h" -+#include "tree-checker.h" - - #ifdef CONFIG_X86 - #include -@@ -522,72 +523,6 @@ static int check_tree_block_fsid(struct btrfs_fs_info *fs_info, - return ret; - } - --#define CORRUPT(reason, eb, root, slot) \ -- btrfs_crit(root->fs_info, "corrupt leaf, %s: block=%llu," \ -- "root=%llu, slot=%d", reason, \ -- btrfs_header_bytenr(eb), root->objectid, slot) -- --static noinline int check_leaf(struct btrfs_root *root, -- struct extent_buffer *leaf) --{ -- struct btrfs_key key; -- struct btrfs_key leaf_key; -- u32 nritems = btrfs_header_nritems(leaf); -- int slot; -- -- if (nritems == 0) -- return 0; -- -- /* Check the 0 item */ -- if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) != -- BTRFS_LEAF_DATA_SIZE(root)) { -- CORRUPT("invalid item offset size pair", leaf, root, 0); -- return -EIO; -- } -- -- /* -- * Check to make sure each items keys are in the correct order and their -- * offsets make sense. We only have to loop through nritems-1 because -- * we check the current slot against the next slot, which verifies the -- * next slot's offset+size makes sense and that the current's slot -- * offset is correct. -- */ -- for (slot = 0; slot < nritems - 1; slot++) { -- btrfs_item_key_to_cpu(leaf, &leaf_key, slot); -- btrfs_item_key_to_cpu(leaf, &key, slot + 1); -- -- /* Make sure the keys are in the right order */ -- if (btrfs_comp_cpu_keys(&leaf_key, &key) >= 0) { -- CORRUPT("bad key order", leaf, root, slot); -- return -EIO; -- } -- -- /* -- * Make sure the offset and ends are right, remember that the -- * item data starts at the end of the leaf and grows towards the -- * front. -- */ -- if (btrfs_item_offset_nr(leaf, slot) != -- btrfs_item_end_nr(leaf, slot + 1)) { -- CORRUPT("slot offset bad", leaf, root, slot); -- return -EIO; -- } -- -- /* -- * Check to make sure that we don't point outside of the leaf, -- * just incase all the items are consistent to eachother, but -- * all point outside of the leaf. -- */ -- if (btrfs_item_end_nr(leaf, slot) > -- BTRFS_LEAF_DATA_SIZE(root)) { -- CORRUPT("slot end outside of leaf", leaf, root, slot); -- return -EIO; -- } -- } -- -- return 0; --} -- - static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio, - u64 phy_offset, struct page *page, - u64 start, u64 end, int mirror) -@@ -654,11 +589,14 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio, - * that we don't try and read the other copies of this block, just - * return -EIO. - */ -- if (found_level == 0 && check_leaf(root, eb)) { -+ if (found_level == 0 && btrfs_check_leaf_full(root, eb)) { - set_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags); - ret = -EIO; - } - -+ if (found_level > 0 && btrfs_check_node(root, eb)) -+ ret = -EIO; -+ - if (!ret) - set_extent_buffer_uptodate(eb); - err: -@@ -3958,7 +3896,13 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf) - buf->len, - root->fs_info->dirty_metadata_batch); - #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY -- if (btrfs_header_level(buf) == 0 && check_leaf(root, buf)) { -+ /* -+ * Since btrfs_mark_buffer_dirty() can be called with item pointer set -+ * but item data not updated. -+ * So here we should only check item pointers, not item data. -+ */ -+ if (btrfs_header_level(buf) == 0 && -+ btrfs_check_leaf_relaxed(root, buf)) { - btrfs_print_leaf(root, buf); - ASSERT(0); - } -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 13ff0fdae03e..978bbfed5a2c 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -2342,7 +2342,13 @@ static int run_delayed_tree_ref(struct btrfs_trans_handle *trans, - ins.type = BTRFS_EXTENT_ITEM_KEY; - } - -- BUG_ON(node->ref_mod != 1); -+ if (node->ref_mod != 1) { -+ btrfs_err(root->fs_info, -+ "btree block(%llu) has %d references rather than 1: action %d ref_root %llu parent %llu", -+ node->bytenr, node->ref_mod, node->action, ref_root, -+ parent); -+ return -EIO; -+ } - if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) { - BUG_ON(!extent_op || !extent_op->update_flags); - ret = alloc_reserved_tree_block(trans, root, -@@ -9481,6 +9487,8 @@ static int find_first_block_group(struct btrfs_root *root, - int ret = 0; - struct btrfs_key found_key; - struct extent_buffer *leaf; -+ struct btrfs_block_group_item bg; -+ u64 flags; - int slot; - - ret = btrfs_search_slot(NULL, root, key, path, 0, 0); -@@ -9502,7 +9510,47 @@ static int find_first_block_group(struct btrfs_root *root, - - if (found_key.objectid >= key->objectid && - found_key.type == BTRFS_BLOCK_GROUP_ITEM_KEY) { -- ret = 0; -+ struct extent_map_tree *em_tree; -+ struct extent_map *em; -+ -+ em_tree = &root->fs_info->mapping_tree.map_tree; -+ read_lock(&em_tree->lock); -+ em = lookup_extent_mapping(em_tree, found_key.objectid, -+ found_key.offset); -+ read_unlock(&em_tree->lock); -+ if (!em) { -+ btrfs_err(root->fs_info, -+ "logical %llu len %llu found bg but no related chunk", -+ found_key.objectid, found_key.offset); -+ ret = -ENOENT; -+ } else if (em->start != found_key.objectid || -+ em->len != found_key.offset) { -+ btrfs_err(root->fs_info, -+ "block group %llu len %llu mismatch with chunk %llu len %llu", -+ found_key.objectid, found_key.offset, -+ em->start, em->len); -+ ret = -EUCLEAN; -+ } else { -+ read_extent_buffer(leaf, &bg, -+ btrfs_item_ptr_offset(leaf, slot), -+ sizeof(bg)); -+ flags = btrfs_block_group_flags(&bg) & -+ BTRFS_BLOCK_GROUP_TYPE_MASK; -+ -+ if (flags != (em->map_lookup->type & -+ BTRFS_BLOCK_GROUP_TYPE_MASK)) { -+ btrfs_err(root->fs_info, -+"block group %llu len %llu type flags 0x%llx mismatch with chunk type flags 0x%llx", -+ found_key.objectid, -+ found_key.offset, flags, -+ (BTRFS_BLOCK_GROUP_TYPE_MASK & -+ em->map_lookup->type)); -+ ret = -EUCLEAN; -+ } else { -+ ret = 0; -+ } -+ } -+ free_extent_map(em); - goto out; - } - path->slots[0]++; -@@ -9717,6 +9765,62 @@ btrfs_create_block_group_cache(struct btrfs_root *root, u64 start, u64 size) - return cache; - } - -+ -+/* -+ * Iterate all chunks and verify that each of them has the corresponding block -+ * group -+ */ -+static int check_chunk_block_group_mappings(struct btrfs_fs_info *fs_info) -+{ -+ struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree; -+ struct extent_map *em; -+ struct btrfs_block_group_cache *bg; -+ u64 start = 0; -+ int ret = 0; -+ -+ while (1) { -+ read_lock(&map_tree->map_tree.lock); -+ /* -+ * lookup_extent_mapping will return the first extent map -+ * intersecting the range, so setting @len to 1 is enough to -+ * get the first chunk. -+ */ -+ em = lookup_extent_mapping(&map_tree->map_tree, start, 1); -+ read_unlock(&map_tree->map_tree.lock); -+ if (!em) -+ break; -+ -+ bg = btrfs_lookup_block_group(fs_info, em->start); -+ if (!bg) { -+ btrfs_err(fs_info, -+ "chunk start=%llu len=%llu doesn't have corresponding block group", -+ em->start, em->len); -+ ret = -EUCLEAN; -+ free_extent_map(em); -+ break; -+ } -+ if (bg->key.objectid != em->start || -+ bg->key.offset != em->len || -+ (bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK) != -+ (em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK)) { -+ btrfs_err(fs_info, -+"chunk start=%llu len=%llu flags=0x%llx doesn't match block group start=%llu len=%llu flags=0x%llx", -+ em->start, em->len, -+ em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK, -+ bg->key.objectid, bg->key.offset, -+ bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK); -+ ret = -EUCLEAN; -+ free_extent_map(em); -+ btrfs_put_block_group(bg); -+ break; -+ } -+ start = em->start + em->len; -+ free_extent_map(em); -+ btrfs_put_block_group(bg); -+ } -+ return ret; -+} -+ - int btrfs_read_block_groups(struct btrfs_root *root) - { - struct btrfs_path *path; -@@ -9903,7 +10007,7 @@ int btrfs_read_block_groups(struct btrfs_root *root) - } - - init_global_block_rsv(info); -- ret = 0; -+ ret = check_chunk_block_group_mappings(info); - error: - btrfs_free_path(path); - return ret; -@@ -10388,7 +10492,7 @@ btrfs_start_trans_remove_block_group(struct btrfs_fs_info *fs_info, - * more device items and remove one chunk item), but this is done at - * btrfs_remove_chunk() through a call to check_system_chunk(). - */ -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - num_items = 3 + map->num_stripes; - free_extent_map(em); - -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 88bee6703cc0..42e7f6a8f91d 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -3847,8 +3847,10 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb, - struct block_device *bdev = fs_info->fs_devices->latest_bdev; - struct extent_io_tree *tree = &BTRFS_I(fs_info->btree_inode)->io_tree; - u64 offset = eb->start; -+ u32 nritems; - unsigned long i, num_pages; - unsigned long bio_flags = 0; -+ unsigned long start, end; - int rw = (epd->sync_io ? WRITE_SYNC : WRITE) | REQ_META; - int ret = 0; - -@@ -3858,6 +3860,23 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb, - if (btrfs_header_owner(eb) == BTRFS_TREE_LOG_OBJECTID) - bio_flags = EXTENT_BIO_TREE_LOG; - -+ /* set btree blocks beyond nritems with 0 to avoid stale content. */ -+ nritems = btrfs_header_nritems(eb); -+ if (btrfs_header_level(eb) > 0) { -+ end = btrfs_node_key_ptr_offset(nritems); -+ -+ memset_extent_buffer(eb, 0, end, eb->len - end); -+ } else { -+ /* -+ * leaf: -+ * header 0 1 2 .. N ... data_N .. data_2 data_1 data_0 -+ */ -+ start = btrfs_item_nr_offset(nritems); -+ end = btrfs_leaf_data(eb) + -+ leaf_data_end(fs_info->tree_root, eb); -+ memset_extent_buffer(eb, 0, start, end - start); -+ } -+ - for (i = 0; i < num_pages; i++) { - struct page *p = eb->pages[i]; - -@@ -5362,9 +5381,8 @@ unlock_exit: - return ret; - } - --void read_extent_buffer(struct extent_buffer *eb, void *dstv, -- unsigned long start, -- unsigned long len) -+void read_extent_buffer(const struct extent_buffer *eb, void *dstv, -+ unsigned long start, unsigned long len) - { - size_t cur; - size_t offset; -@@ -5393,9 +5411,9 @@ void read_extent_buffer(struct extent_buffer *eb, void *dstv, - } - } - --int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv, -- unsigned long start, -- unsigned long len) -+int read_extent_buffer_to_user(const struct extent_buffer *eb, -+ void __user *dstv, -+ unsigned long start, unsigned long len) - { - size_t cur; - size_t offset; -@@ -5430,10 +5448,10 @@ int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv, - return ret; - } - --int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start, -- unsigned long min_len, char **map, -- unsigned long *map_start, -- unsigned long *map_len) -+int map_private_extent_buffer(const struct extent_buffer *eb, -+ unsigned long start, unsigned long min_len, -+ char **map, unsigned long *map_start, -+ unsigned long *map_len) - { - size_t offset = start & (PAGE_CACHE_SIZE - 1); - char *kaddr; -@@ -5468,9 +5486,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start, - return 0; - } - --int memcmp_extent_buffer(struct extent_buffer *eb, const void *ptrv, -- unsigned long start, -- unsigned long len) -+int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv, -+ unsigned long start, unsigned long len) - { - size_t cur; - size_t offset; -diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h -index f4c1ae11855f..751435967724 100644 ---- a/fs/btrfs/extent_io.h -+++ b/fs/btrfs/extent_io.h -@@ -308,14 +308,13 @@ static inline void extent_buffer_get(struct extent_buffer *eb) - atomic_inc(&eb->refs); - } - --int memcmp_extent_buffer(struct extent_buffer *eb, const void *ptrv, -- unsigned long start, -- unsigned long len); --void read_extent_buffer(struct extent_buffer *eb, void *dst, -+int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv, -+ unsigned long start, unsigned long len); -+void read_extent_buffer(const struct extent_buffer *eb, void *dst, - unsigned long start, - unsigned long len); --int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dst, -- unsigned long start, -+int read_extent_buffer_to_user(const struct extent_buffer *eb, -+ void __user *dst, unsigned long start, - unsigned long len); - void write_extent_buffer(struct extent_buffer *eb, const void *src, - unsigned long start, unsigned long len); -@@ -334,10 +333,10 @@ int set_extent_buffer_uptodate(struct extent_buffer *eb); - int clear_extent_buffer_uptodate(struct extent_buffer *eb); - int extent_buffer_uptodate(struct extent_buffer *eb); - int extent_buffer_under_io(struct extent_buffer *eb); --int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset, -- unsigned long min_len, char **map, -- unsigned long *map_start, -- unsigned long *map_len); -+int map_private_extent_buffer(const struct extent_buffer *eb, -+ unsigned long offset, unsigned long min_len, -+ char **map, unsigned long *map_start, -+ unsigned long *map_len); - int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end); - int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end); - int extent_clear_unlock_delalloc(struct inode *inode, u64 start, u64 end, -diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c -index 6a98bddd8f33..84fb56d5c018 100644 ---- a/fs/btrfs/extent_map.c -+++ b/fs/btrfs/extent_map.c -@@ -76,7 +76,7 @@ void free_extent_map(struct extent_map *em) - WARN_ON(extent_map_in_tree(em)); - WARN_ON(!list_empty(&em->list)); - if (test_bit(EXTENT_FLAG_FS_MAPPING, &em->flags)) -- kfree(em->bdev); -+ kfree(em->map_lookup); - kmem_cache_free(extent_map_cache, em); - } - } -diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h -index b2991fd8583e..eb8b8fae036b 100644 ---- a/fs/btrfs/extent_map.h -+++ b/fs/btrfs/extent_map.h -@@ -32,7 +32,15 @@ struct extent_map { - u64 block_len; - u64 generation; - unsigned long flags; -- struct block_device *bdev; -+ union { -+ struct block_device *bdev; -+ -+ /* -+ * used for chunk mappings -+ * flags & EXTENT_FLAG_FS_MAPPING must be set -+ */ -+ struct map_lookup *map_lookup; -+ }; - atomic_t refs; - unsigned int compress_type; - struct list_head list; -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 6dca9f937bf6..cc9ccc42f469 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -3460,7 +3460,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx, - return ret; - } - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - if (em->start != chunk_offset) - goto out; - -diff --git a/fs/btrfs/struct-funcs.c b/fs/btrfs/struct-funcs.c -index b976597b0721..63ffd213b0b7 100644 ---- a/fs/btrfs/struct-funcs.c -+++ b/fs/btrfs/struct-funcs.c -@@ -50,8 +50,8 @@ static inline void put_unaligned_le8(u8 val, void *p) - */ - - #define DEFINE_BTRFS_SETGET_BITS(bits) \ --u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr, \ -- unsigned long off, \ -+u##bits btrfs_get_token_##bits(const struct extent_buffer *eb, \ -+ const void *ptr, unsigned long off, \ - struct btrfs_map_token *token) \ - { \ - unsigned long part_offset = (unsigned long)ptr; \ -@@ -90,7 +90,8 @@ u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr, \ - return res; \ - } \ - void btrfs_set_token_##bits(struct extent_buffer *eb, \ -- void *ptr, unsigned long off, u##bits val, \ -+ const void *ptr, unsigned long off, \ -+ u##bits val, \ - struct btrfs_map_token *token) \ - { \ - unsigned long part_offset = (unsigned long)ptr; \ -@@ -133,7 +134,7 @@ DEFINE_BTRFS_SETGET_BITS(16) - DEFINE_BTRFS_SETGET_BITS(32) - DEFINE_BTRFS_SETGET_BITS(64) - --void btrfs_node_key(struct extent_buffer *eb, -+void btrfs_node_key(const struct extent_buffer *eb, - struct btrfs_disk_key *disk_key, int nr) - { - unsigned long ptr = btrfs_node_key_ptr_offset(nr); -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -new file mode 100644 -index 000000000000..5b98f3c76ce4 ---- /dev/null -+++ b/fs/btrfs/tree-checker.c -@@ -0,0 +1,649 @@ -+/* -+ * Copyright (C) Qu Wenruo 2017. All rights reserved. -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public -+ * License v2 as published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public -+ * License along with this program. -+ */ -+ -+/* -+ * The module is used to catch unexpected/corrupted tree block data. -+ * Such behavior can be caused either by a fuzzed image or bugs. -+ * -+ * The objective is to do leaf/node validation checks when tree block is read -+ * from disk, and check *every* possible member, so other code won't -+ * need to checking them again. -+ * -+ * Due to the potential and unwanted damage, every checker needs to be -+ * carefully reviewed otherwise so it does not prevent mount of valid images. -+ */ -+ -+#include "ctree.h" -+#include "tree-checker.h" -+#include "disk-io.h" -+#include "compression.h" -+#include "hash.h" -+#include "volumes.h" -+ -+#define CORRUPT(reason, eb, root, slot) \ -+ btrfs_crit(root->fs_info, \ -+ "corrupt %s, %s: block=%llu, root=%llu, slot=%d", \ -+ btrfs_header_level(eb) == 0 ? "leaf" : "node", \ -+ reason, btrfs_header_bytenr(eb), root->objectid, slot) -+ -+/* -+ * Error message should follow the following format: -+ * corrupt : , [, ] -+ * -+ * @type: leaf or node -+ * @identifier: the necessary info to locate the leaf/node. -+ * It's recommened to decode key.objecitd/offset if it's -+ * meaningful. -+ * @reason: describe the error -+ * @bad_value: optional, it's recommened to output bad value and its -+ * expected value (range). -+ * -+ * Since comma is used to separate the components, only space is allowed -+ * inside each component. -+ */ -+ -+/* -+ * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt. -+ * Allows callers to customize the output. -+ */ -+__printf(4, 5) -+static void generic_err(const struct btrfs_root *root, -+ const struct extent_buffer *eb, int slot, -+ const char *fmt, ...) -+{ -+ struct va_format vaf; -+ va_list args; -+ -+ va_start(args, fmt); -+ -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ btrfs_crit(root->fs_info, -+ "corrupt %s: root=%llu block=%llu slot=%d, %pV", -+ btrfs_header_level(eb) == 0 ? "leaf" : "node", -+ root->objectid, btrfs_header_bytenr(eb), slot, &vaf); -+ va_end(args); -+} -+ -+static int check_extent_data_item(struct btrfs_root *root, -+ struct extent_buffer *leaf, -+ struct btrfs_key *key, int slot) -+{ -+ struct btrfs_file_extent_item *fi; -+ u32 sectorsize = root->sectorsize; -+ u32 item_size = btrfs_item_size_nr(leaf, slot); -+ -+ if (!IS_ALIGNED(key->offset, sectorsize)) { -+ CORRUPT("unaligned key offset for file extent", -+ leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); -+ -+ if (btrfs_file_extent_type(leaf, fi) > BTRFS_FILE_EXTENT_TYPES) { -+ CORRUPT("invalid file extent type", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ /* -+ * Support for new compression/encrption must introduce incompat flag, -+ * and must be caught in open_ctree(). -+ */ -+ if (btrfs_file_extent_compression(leaf, fi) > BTRFS_COMPRESS_TYPES) { -+ CORRUPT("invalid file extent compression", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ if (btrfs_file_extent_encryption(leaf, fi)) { -+ CORRUPT("invalid file extent encryption", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) { -+ /* Inline extent must have 0 as key offset */ -+ if (key->offset) { -+ CORRUPT("inline extent has non-zero key offset", -+ leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ /* Compressed inline extent has no on-disk size, skip it */ -+ if (btrfs_file_extent_compression(leaf, fi) != -+ BTRFS_COMPRESS_NONE) -+ return 0; -+ -+ /* Uncompressed inline extent size must match item size */ -+ if (item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START + -+ btrfs_file_extent_ram_bytes(leaf, fi)) { -+ CORRUPT("plaintext inline extent has invalid size", -+ leaf, root, slot); -+ return -EUCLEAN; -+ } -+ return 0; -+ } -+ -+ /* Regular or preallocated extent has fixed item size */ -+ if (item_size != sizeof(*fi)) { -+ CORRUPT( -+ "regluar or preallocated extent data item size is invalid", -+ leaf, root, slot); -+ return -EUCLEAN; -+ } -+ if (!IS_ALIGNED(btrfs_file_extent_ram_bytes(leaf, fi), sectorsize) || -+ !IS_ALIGNED(btrfs_file_extent_disk_bytenr(leaf, fi), sectorsize) || -+ !IS_ALIGNED(btrfs_file_extent_disk_num_bytes(leaf, fi), sectorsize) || -+ !IS_ALIGNED(btrfs_file_extent_offset(leaf, fi), sectorsize) || -+ !IS_ALIGNED(btrfs_file_extent_num_bytes(leaf, fi), sectorsize)) { -+ CORRUPT( -+ "regular or preallocated extent data item has unaligned value", -+ leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ return 0; -+} -+ -+static int check_csum_item(struct btrfs_root *root, struct extent_buffer *leaf, -+ struct btrfs_key *key, int slot) -+{ -+ u32 sectorsize = root->sectorsize; -+ u32 csumsize = btrfs_super_csum_size(root->fs_info->super_copy); -+ -+ if (key->objectid != BTRFS_EXTENT_CSUM_OBJECTID) { -+ CORRUPT("invalid objectid for csum item", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ if (!IS_ALIGNED(key->offset, sectorsize)) { -+ CORRUPT("unaligned key offset for csum item", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ if (!IS_ALIGNED(btrfs_item_size_nr(leaf, slot), csumsize)) { -+ CORRUPT("unaligned csum item size", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ return 0; -+} -+ -+/* -+ * Customized reported for dir_item, only important new info is key->objectid, -+ * which represents inode number -+ */ -+__printf(4, 5) -+static void dir_item_err(const struct btrfs_root *root, -+ const struct extent_buffer *eb, int slot, -+ const char *fmt, ...) -+{ -+ struct btrfs_key key; -+ struct va_format vaf; -+ va_list args; -+ -+ btrfs_item_key_to_cpu(eb, &key, slot); -+ va_start(args, fmt); -+ -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ btrfs_crit(root->fs_info, -+ "corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV", -+ btrfs_header_level(eb) == 0 ? "leaf" : "node", root->objectid, -+ btrfs_header_bytenr(eb), slot, key.objectid, &vaf); -+ va_end(args); -+} -+ -+static int check_dir_item(struct btrfs_root *root, -+ struct extent_buffer *leaf, -+ struct btrfs_key *key, int slot) -+{ -+ struct btrfs_dir_item *di; -+ u32 item_size = btrfs_item_size_nr(leaf, slot); -+ u32 cur = 0; -+ -+ di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item); -+ while (cur < item_size) { -+ u32 name_len; -+ u32 data_len; -+ u32 max_name_len; -+ u32 total_size; -+ u32 name_hash; -+ u8 dir_type; -+ -+ /* header itself should not cross item boundary */ -+ if (cur + sizeof(*di) > item_size) { -+ dir_item_err(root, leaf, slot, -+ "dir item header crosses item boundary, have %zu boundary %u", -+ cur + sizeof(*di), item_size); -+ return -EUCLEAN; -+ } -+ -+ /* dir type check */ -+ dir_type = btrfs_dir_type(leaf, di); -+ if (dir_type >= BTRFS_FT_MAX) { -+ dir_item_err(root, leaf, slot, -+ "invalid dir item type, have %u expect [0, %u)", -+ dir_type, BTRFS_FT_MAX); -+ return -EUCLEAN; -+ } -+ -+ if (key->type == BTRFS_XATTR_ITEM_KEY && -+ dir_type != BTRFS_FT_XATTR) { -+ dir_item_err(root, leaf, slot, -+ "invalid dir item type for XATTR key, have %u expect %u", -+ dir_type, BTRFS_FT_XATTR); -+ return -EUCLEAN; -+ } -+ if (dir_type == BTRFS_FT_XATTR && -+ key->type != BTRFS_XATTR_ITEM_KEY) { -+ dir_item_err(root, leaf, slot, -+ "xattr dir type found for non-XATTR key"); -+ return -EUCLEAN; -+ } -+ if (dir_type == BTRFS_FT_XATTR) -+ max_name_len = XATTR_NAME_MAX; -+ else -+ max_name_len = BTRFS_NAME_LEN; -+ -+ /* Name/data length check */ -+ name_len = btrfs_dir_name_len(leaf, di); -+ data_len = btrfs_dir_data_len(leaf, di); -+ if (name_len > max_name_len) { -+ dir_item_err(root, leaf, slot, -+ "dir item name len too long, have %u max %u", -+ name_len, max_name_len); -+ return -EUCLEAN; -+ } -+ if (name_len + data_len > BTRFS_MAX_XATTR_SIZE(root)) { -+ dir_item_err(root, leaf, slot, -+ "dir item name and data len too long, have %u max %zu", -+ name_len + data_len, -+ BTRFS_MAX_XATTR_SIZE(root)); -+ return -EUCLEAN; -+ } -+ -+ if (data_len && dir_type != BTRFS_FT_XATTR) { -+ dir_item_err(root, leaf, slot, -+ "dir item with invalid data len, have %u expect 0", -+ data_len); -+ return -EUCLEAN; -+ } -+ -+ total_size = sizeof(*di) + name_len + data_len; -+ -+ /* header and name/data should not cross item boundary */ -+ if (cur + total_size > item_size) { -+ dir_item_err(root, leaf, slot, -+ "dir item data crosses item boundary, have %u boundary %u", -+ cur + total_size, item_size); -+ return -EUCLEAN; -+ } -+ -+ /* -+ * Special check for XATTR/DIR_ITEM, as key->offset is name -+ * hash, should match its name -+ */ -+ if (key->type == BTRFS_DIR_ITEM_KEY || -+ key->type == BTRFS_XATTR_ITEM_KEY) { -+ char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)]; -+ -+ read_extent_buffer(leaf, namebuf, -+ (unsigned long)(di + 1), name_len); -+ name_hash = btrfs_name_hash(namebuf, name_len); -+ if (key->offset != name_hash) { -+ dir_item_err(root, leaf, slot, -+ "name hash mismatch with key, have 0x%016x expect 0x%016llx", -+ name_hash, key->offset); -+ return -EUCLEAN; -+ } -+ } -+ cur += total_size; -+ di = (struct btrfs_dir_item *)((void *)di + total_size); -+ } -+ return 0; -+} -+ -+__printf(4, 5) -+__cold -+static void block_group_err(const struct btrfs_fs_info *fs_info, -+ const struct extent_buffer *eb, int slot, -+ const char *fmt, ...) -+{ -+ struct btrfs_key key; -+ struct va_format vaf; -+ va_list args; -+ -+ btrfs_item_key_to_cpu(eb, &key, slot); -+ va_start(args, fmt); -+ -+ vaf.fmt = fmt; -+ vaf.va = &args; -+ -+ btrfs_crit(fs_info, -+ "corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV", -+ btrfs_header_level(eb) == 0 ? "leaf" : "node", -+ btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, -+ key.objectid, key.offset, &vaf); -+ va_end(args); -+} -+ -+static int check_block_group_item(struct btrfs_fs_info *fs_info, -+ struct extent_buffer *leaf, -+ struct btrfs_key *key, int slot) -+{ -+ struct btrfs_block_group_item bgi; -+ u32 item_size = btrfs_item_size_nr(leaf, slot); -+ u64 flags; -+ u64 type; -+ -+ /* -+ * Here we don't really care about alignment since extent allocator can -+ * handle it. We care more about the size, as if one block group is -+ * larger than maximum size, it's must be some obvious corruption. -+ */ -+ if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) { -+ block_group_err(fs_info, leaf, slot, -+ "invalid block group size, have %llu expect (0, %llu]", -+ key->offset, BTRFS_MAX_DATA_CHUNK_SIZE); -+ return -EUCLEAN; -+ } -+ -+ if (item_size != sizeof(bgi)) { -+ block_group_err(fs_info, leaf, slot, -+ "invalid item size, have %u expect %zu", -+ item_size, sizeof(bgi)); -+ return -EUCLEAN; -+ } -+ -+ read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot), -+ sizeof(bgi)); -+ if (btrfs_block_group_chunk_objectid(&bgi) != -+ BTRFS_FIRST_CHUNK_TREE_OBJECTID) { -+ block_group_err(fs_info, leaf, slot, -+ "invalid block group chunk objectid, have %llu expect %llu", -+ btrfs_block_group_chunk_objectid(&bgi), -+ BTRFS_FIRST_CHUNK_TREE_OBJECTID); -+ return -EUCLEAN; -+ } -+ -+ if (btrfs_block_group_used(&bgi) > key->offset) { -+ block_group_err(fs_info, leaf, slot, -+ "invalid block group used, have %llu expect [0, %llu)", -+ btrfs_block_group_used(&bgi), key->offset); -+ return -EUCLEAN; -+ } -+ -+ flags = btrfs_block_group_flags(&bgi); -+ if (hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1) { -+ block_group_err(fs_info, leaf, slot, -+"invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set", -+ flags & BTRFS_BLOCK_GROUP_PROFILE_MASK, -+ hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK)); -+ return -EUCLEAN; -+ } -+ -+ type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK; -+ if (type != BTRFS_BLOCK_GROUP_DATA && -+ type != BTRFS_BLOCK_GROUP_METADATA && -+ type != BTRFS_BLOCK_GROUP_SYSTEM && -+ type != (BTRFS_BLOCK_GROUP_METADATA | -+ BTRFS_BLOCK_GROUP_DATA)) { -+ block_group_err(fs_info, leaf, slot, -+"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx", -+ type, hweight64(type), -+ BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA, -+ BTRFS_BLOCK_GROUP_SYSTEM, -+ BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA); -+ return -EUCLEAN; -+ } -+ return 0; -+} -+ -+/* -+ * Common point to switch the item-specific validation. -+ */ -+static int check_leaf_item(struct btrfs_root *root, -+ struct extent_buffer *leaf, -+ struct btrfs_key *key, int slot) -+{ -+ int ret = 0; -+ -+ switch (key->type) { -+ case BTRFS_EXTENT_DATA_KEY: -+ ret = check_extent_data_item(root, leaf, key, slot); -+ break; -+ case BTRFS_EXTENT_CSUM_KEY: -+ ret = check_csum_item(root, leaf, key, slot); -+ break; -+ case BTRFS_DIR_ITEM_KEY: -+ case BTRFS_DIR_INDEX_KEY: -+ case BTRFS_XATTR_ITEM_KEY: -+ ret = check_dir_item(root, leaf, key, slot); -+ break; -+ case BTRFS_BLOCK_GROUP_ITEM_KEY: -+ ret = check_block_group_item(root->fs_info, leaf, key, slot); -+ break; -+ } -+ return ret; -+} -+ -+static int check_leaf(struct btrfs_root *root, struct extent_buffer *leaf, -+ bool check_item_data) -+{ -+ struct btrfs_fs_info *fs_info = root->fs_info; -+ /* No valid key type is 0, so all key should be larger than this key */ -+ struct btrfs_key prev_key = {0, 0, 0}; -+ struct btrfs_key key; -+ u32 nritems = btrfs_header_nritems(leaf); -+ int slot; -+ -+ if (btrfs_header_level(leaf) != 0) { -+ generic_err(root, leaf, 0, -+ "invalid level for leaf, have %d expect 0", -+ btrfs_header_level(leaf)); -+ return -EUCLEAN; -+ } -+ -+ /* -+ * Extent buffers from a relocation tree have a owner field that -+ * corresponds to the subvolume tree they are based on. So just from an -+ * extent buffer alone we can not find out what is the id of the -+ * corresponding subvolume tree, so we can not figure out if the extent -+ * buffer corresponds to the root of the relocation tree or not. So -+ * skip this check for relocation trees. -+ */ -+ if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) { -+ u64 owner = btrfs_header_owner(leaf); -+ struct btrfs_root *check_root; -+ -+ /* These trees must never be empty */ -+ if (owner == BTRFS_ROOT_TREE_OBJECTID || -+ owner == BTRFS_CHUNK_TREE_OBJECTID || -+ owner == BTRFS_EXTENT_TREE_OBJECTID || -+ owner == BTRFS_DEV_TREE_OBJECTID || -+ owner == BTRFS_FS_TREE_OBJECTID || -+ owner == BTRFS_DATA_RELOC_TREE_OBJECTID) { -+ generic_err(root, leaf, 0, -+ "invalid root, root %llu must never be empty", -+ owner); -+ return -EUCLEAN; -+ } -+ key.objectid = owner; -+ key.type = BTRFS_ROOT_ITEM_KEY; -+ key.offset = (u64)-1; -+ -+ check_root = btrfs_get_fs_root(fs_info, &key, false); -+ /* -+ * The only reason we also check NULL here is that during -+ * open_ctree() some roots has not yet been set up. -+ */ -+ if (!IS_ERR_OR_NULL(check_root)) { -+ struct extent_buffer *eb; -+ -+ eb = btrfs_root_node(check_root); -+ /* if leaf is the root, then it's fine */ -+ if (leaf != eb) { -+ CORRUPT("non-root leaf's nritems is 0", -+ leaf, check_root, 0); -+ free_extent_buffer(eb); -+ return -EUCLEAN; -+ } -+ free_extent_buffer(eb); -+ } -+ return 0; -+ } -+ -+ if (nritems == 0) -+ return 0; -+ -+ /* -+ * Check the following things to make sure this is a good leaf, and -+ * leaf users won't need to bother with similar sanity checks: -+ * -+ * 1) key ordering -+ * 2) item offset and size -+ * No overlap, no hole, all inside the leaf. -+ * 3) item content -+ * If possible, do comprehensive sanity check. -+ * NOTE: All checks must only rely on the item data itself. -+ */ -+ for (slot = 0; slot < nritems; slot++) { -+ u32 item_end_expected; -+ int ret; -+ -+ btrfs_item_key_to_cpu(leaf, &key, slot); -+ -+ /* Make sure the keys are in the right order */ -+ if (btrfs_comp_cpu_keys(&prev_key, &key) >= 0) { -+ CORRUPT("bad key order", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ /* -+ * Make sure the offset and ends are right, remember that the -+ * item data starts at the end of the leaf and grows towards the -+ * front. -+ */ -+ if (slot == 0) -+ item_end_expected = BTRFS_LEAF_DATA_SIZE(root); -+ else -+ item_end_expected = btrfs_item_offset_nr(leaf, -+ slot - 1); -+ if (btrfs_item_end_nr(leaf, slot) != item_end_expected) { -+ CORRUPT("slot offset bad", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ /* -+ * Check to make sure that we don't point outside of the leaf, -+ * just in case all the items are consistent to each other, but -+ * all point outside of the leaf. -+ */ -+ if (btrfs_item_end_nr(leaf, slot) > -+ BTRFS_LEAF_DATA_SIZE(root)) { -+ CORRUPT("slot end outside of leaf", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ /* Also check if the item pointer overlaps with btrfs item. */ -+ if (btrfs_item_nr_offset(slot) + sizeof(struct btrfs_item) > -+ btrfs_item_ptr_offset(leaf, slot)) { -+ CORRUPT("slot overlap with its data", leaf, root, slot); -+ return -EUCLEAN; -+ } -+ -+ if (check_item_data) { -+ /* -+ * Check if the item size and content meet other -+ * criteria -+ */ -+ ret = check_leaf_item(root, leaf, &key, slot); -+ if (ret < 0) -+ return ret; -+ } -+ -+ prev_key.objectid = key.objectid; -+ prev_key.type = key.type; -+ prev_key.offset = key.offset; -+ } -+ -+ return 0; -+} -+ -+int btrfs_check_leaf_full(struct btrfs_root *root, struct extent_buffer *leaf) -+{ -+ return check_leaf(root, leaf, true); -+} -+ -+int btrfs_check_leaf_relaxed(struct btrfs_root *root, -+ struct extent_buffer *leaf) -+{ -+ return check_leaf(root, leaf, false); -+} -+ -+int btrfs_check_node(struct btrfs_root *root, struct extent_buffer *node) -+{ -+ unsigned long nr = btrfs_header_nritems(node); -+ struct btrfs_key key, next_key; -+ int slot; -+ int level = btrfs_header_level(node); -+ u64 bytenr; -+ int ret = 0; -+ -+ if (level <= 0 || level >= BTRFS_MAX_LEVEL) { -+ generic_err(root, node, 0, -+ "invalid level for node, have %d expect [1, %d]", -+ level, BTRFS_MAX_LEVEL - 1); -+ return -EUCLEAN; -+ } -+ if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) { -+ btrfs_crit(root->fs_info, -+"corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%zu]", -+ root->objectid, node->start, -+ nr == 0 ? "small" : "large", nr, -+ BTRFS_NODEPTRS_PER_BLOCK(root)); -+ return -EUCLEAN; -+ } -+ -+ for (slot = 0; slot < nr - 1; slot++) { -+ bytenr = btrfs_node_blockptr(node, slot); -+ btrfs_node_key_to_cpu(node, &key, slot); -+ btrfs_node_key_to_cpu(node, &next_key, slot + 1); -+ -+ if (!bytenr) { -+ generic_err(root, node, slot, -+ "invalid NULL node pointer"); -+ ret = -EUCLEAN; -+ goto out; -+ } -+ if (!IS_ALIGNED(bytenr, root->sectorsize)) { -+ generic_err(root, node, slot, -+ "unaligned pointer, have %llu should be aligned to %u", -+ bytenr, root->sectorsize); -+ ret = -EUCLEAN; -+ goto out; -+ } -+ -+ if (btrfs_comp_cpu_keys(&key, &next_key) >= 0) { -+ generic_err(root, node, slot, -+ "bad key order, current (%llu %u %llu) next (%llu %u %llu)", -+ key.objectid, key.type, key.offset, -+ next_key.objectid, next_key.type, -+ next_key.offset); -+ ret = -EUCLEAN; -+ goto out; -+ } -+ } -+out: -+ return ret; -+} -diff --git a/fs/btrfs/tree-checker.h b/fs/btrfs/tree-checker.h -new file mode 100644 -index 000000000000..3d53e8d6fda0 ---- /dev/null -+++ b/fs/btrfs/tree-checker.h -@@ -0,0 +1,38 @@ -+/* -+ * Copyright (C) Qu Wenruo 2017. All rights reserved. -+ * -+ * This program is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU General Public -+ * License v2 as published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public -+ * License along with this program. -+ */ -+ -+#ifndef __BTRFS_TREE_CHECKER__ -+#define __BTRFS_TREE_CHECKER__ -+ -+#include "ctree.h" -+#include "extent_io.h" -+ -+/* -+ * Comprehensive leaf checker. -+ * Will check not only the item pointers, but also every possible member -+ * in item data. -+ */ -+int btrfs_check_leaf_full(struct btrfs_root *root, struct extent_buffer *leaf); -+ -+/* -+ * Less strict leaf checker. -+ * Will only check item pointers, not reading item data. -+ */ -+int btrfs_check_leaf_relaxed(struct btrfs_root *root, -+ struct extent_buffer *leaf); -+int btrfs_check_node(struct btrfs_root *root, struct extent_buffer *node); -+ -+#endif -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index b4d63a9842fa..5e8fe8f3942d 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -1184,7 +1184,7 @@ again: - struct map_lookup *map; - int i; - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - for (i = 0; i < map->num_stripes; i++) { - u64 end; - -@@ -2757,7 +2757,7 @@ int btrfs_remove_chunk(struct btrfs_trans_handle *trans, - free_extent_map(em); - return -EINVAL; - } -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - lock_chunks(root->fs_info->chunk_root); - check_system_chunk(trans, extent_root, map->type); - unlock_chunks(root->fs_info->chunk_root); -@@ -4540,7 +4540,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, - - if (type & BTRFS_BLOCK_GROUP_DATA) { - max_stripe_size = 1024 * 1024 * 1024; -- max_chunk_size = 10 * max_stripe_size; -+ max_chunk_size = BTRFS_MAX_DATA_CHUNK_SIZE; - if (!devs_max) - devs_max = BTRFS_MAX_DEVS(info->chunk_root); - } else if (type & BTRFS_BLOCK_GROUP_METADATA) { -@@ -4731,7 +4731,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, - goto error; - } - set_bit(EXTENT_FLAG_FS_MAPPING, &em->flags); -- em->bdev = (struct block_device *)map; -+ em->map_lookup = map; - em->start = start; - em->len = num_bytes; - em->block_start = 0; -@@ -4826,7 +4826,7 @@ int btrfs_finish_chunk_alloc(struct btrfs_trans_handle *trans, - return -EINVAL; - } - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - item_size = btrfs_chunk_item_size(map->num_stripes); - stripe_size = em->orig_block_len; - -@@ -4968,7 +4968,7 @@ int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset) - if (!em) - return 1; - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - for (i = 0; i < map->num_stripes; i++) { - if (map->stripes[i].dev->missing) { - miss_ndevs++; -@@ -5048,7 +5048,7 @@ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len) - return 1; - } - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - if (map->type & (BTRFS_BLOCK_GROUP_DUP | BTRFS_BLOCK_GROUP_RAID1)) - ret = map->num_stripes; - else if (map->type & BTRFS_BLOCK_GROUP_RAID10) -@@ -5091,7 +5091,7 @@ unsigned long btrfs_full_stripe_len(struct btrfs_root *root, - BUG_ON(!em); - - BUG_ON(em->start > logical || em->start + em->len < logical); -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK) - len = map->stripe_len * nr_data_stripes(map); - free_extent_map(em); -@@ -5112,7 +5112,7 @@ int btrfs_is_parity_mirror(struct btrfs_mapping_tree *map_tree, - BUG_ON(!em); - - BUG_ON(em->start > logical || em->start + em->len < logical); -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK) - ret = 1; - free_extent_map(em); -@@ -5271,7 +5271,7 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, int rw, - return -EINVAL; - } - -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - offset = logical - em->start; - - stripe_len = map->stripe_len; -@@ -5813,7 +5813,7 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree, - free_extent_map(em); - return -EIO; - } -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - - length = em->len; - rmap_len = map->stripe_len; -@@ -6208,6 +6208,101 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info, - return dev; - } - -+/* Return -EIO if any error, otherwise return 0. */ -+static int btrfs_check_chunk_valid(struct btrfs_root *root, -+ struct extent_buffer *leaf, -+ struct btrfs_chunk *chunk, u64 logical) -+{ -+ u64 length; -+ u64 stripe_len; -+ u16 num_stripes; -+ u16 sub_stripes; -+ u64 type; -+ u64 features; -+ bool mixed = false; -+ -+ length = btrfs_chunk_length(leaf, chunk); -+ stripe_len = btrfs_chunk_stripe_len(leaf, chunk); -+ num_stripes = btrfs_chunk_num_stripes(leaf, chunk); -+ sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk); -+ type = btrfs_chunk_type(leaf, chunk); -+ -+ if (!num_stripes) { -+ btrfs_err(root->fs_info, "invalid chunk num_stripes: %u", -+ num_stripes); -+ return -EIO; -+ } -+ if (!IS_ALIGNED(logical, root->sectorsize)) { -+ btrfs_err(root->fs_info, -+ "invalid chunk logical %llu", logical); -+ return -EIO; -+ } -+ if (btrfs_chunk_sector_size(leaf, chunk) != root->sectorsize) { -+ btrfs_err(root->fs_info, "invalid chunk sectorsize %u", -+ btrfs_chunk_sector_size(leaf, chunk)); -+ return -EIO; -+ } -+ if (!length || !IS_ALIGNED(length, root->sectorsize)) { -+ btrfs_err(root->fs_info, -+ "invalid chunk length %llu", length); -+ return -EIO; -+ } -+ if (!is_power_of_2(stripe_len)) { -+ btrfs_err(root->fs_info, "invalid chunk stripe length: %llu", -+ stripe_len); -+ return -EIO; -+ } -+ if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) & -+ type) { -+ btrfs_err(root->fs_info, "unrecognized chunk type: %llu", -+ ~(BTRFS_BLOCK_GROUP_TYPE_MASK | -+ BTRFS_BLOCK_GROUP_PROFILE_MASK) & -+ btrfs_chunk_type(leaf, chunk)); -+ return -EIO; -+ } -+ -+ if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) { -+ btrfs_err(root->fs_info, "missing chunk type flag: 0x%llx", type); -+ return -EIO; -+ } -+ -+ if ((type & BTRFS_BLOCK_GROUP_SYSTEM) && -+ (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) { -+ btrfs_err(root->fs_info, -+ "system chunk with data or metadata type: 0x%llx", type); -+ return -EIO; -+ } -+ -+ features = btrfs_super_incompat_flags(root->fs_info->super_copy); -+ if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS) -+ mixed = true; -+ -+ if (!mixed) { -+ if ((type & BTRFS_BLOCK_GROUP_METADATA) && -+ (type & BTRFS_BLOCK_GROUP_DATA)) { -+ btrfs_err(root->fs_info, -+ "mixed chunk type in non-mixed mode: 0x%llx", type); -+ return -EIO; -+ } -+ } -+ -+ if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) || -+ (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) || -+ (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) || -+ (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) || -+ (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) || -+ ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && -+ num_stripes != 1)) { -+ btrfs_err(root->fs_info, -+ "invalid num_stripes:sub_stripes %u:%u for profile %llu", -+ num_stripes, sub_stripes, -+ type & BTRFS_BLOCK_GROUP_PROFILE_MASK); -+ return -EIO; -+ } -+ -+ return 0; -+} -+ - static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, - struct extent_buffer *leaf, - struct btrfs_chunk *chunk) -@@ -6217,6 +6312,7 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, - struct extent_map *em; - u64 logical; - u64 length; -+ u64 stripe_len; - u64 devid; - u8 uuid[BTRFS_UUID_SIZE]; - int num_stripes; -@@ -6225,6 +6321,12 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, - - logical = key->offset; - length = btrfs_chunk_length(leaf, chunk); -+ stripe_len = btrfs_chunk_stripe_len(leaf, chunk); -+ num_stripes = btrfs_chunk_num_stripes(leaf, chunk); -+ -+ ret = btrfs_check_chunk_valid(root, leaf, chunk, logical); -+ if (ret) -+ return ret; - - read_lock(&map_tree->map_tree.lock); - em = lookup_extent_mapping(&map_tree->map_tree, logical, 1); -@@ -6241,7 +6343,6 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, - em = alloc_extent_map(); - if (!em) - return -ENOMEM; -- num_stripes = btrfs_chunk_num_stripes(leaf, chunk); - map = kmalloc(map_lookup_size(num_stripes), GFP_NOFS); - if (!map) { - free_extent_map(em); -@@ -6249,7 +6350,7 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key, - } - - set_bit(EXTENT_FLAG_FS_MAPPING, &em->flags); -- em->bdev = (struct block_device *)map; -+ em->map_lookup = map; - em->start = logical; - em->len = length; - em->orig_start = 0; -@@ -6473,6 +6574,7 @@ int btrfs_read_sys_array(struct btrfs_root *root) - u32 array_size; - u32 len = 0; - u32 cur_offset; -+ u64 type; - struct btrfs_key key; - - ASSERT(BTRFS_SUPER_INFO_SIZE <= root->nodesize); -@@ -6539,6 +6641,15 @@ int btrfs_read_sys_array(struct btrfs_root *root) - break; - } - -+ type = btrfs_chunk_type(sb, chunk); -+ if ((type & BTRFS_BLOCK_GROUP_SYSTEM) == 0) { -+ btrfs_err(root->fs_info, -+ "invalid chunk type %llu in sys_array at offset %u", -+ type, cur_offset); -+ ret = -EIO; -+ break; -+ } -+ - len = btrfs_chunk_item_size(num_stripes); - if (cur_offset + len > array_size) - goto out_short_read; -@@ -6948,7 +7059,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_root *root, - /* In order to kick the device replace finish process */ - lock_chunks(root); - list_for_each_entry(em, &transaction->pending_chunks, list) { -- map = (struct map_lookup *)em->bdev; -+ map = em->map_lookup; - - for (i = 0; i < map->num_stripes; i++) { - dev = map->stripes[i].dev; -diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h -index d5c84f6b1353..3c651df420be 100644 ---- a/fs/btrfs/volumes.h -+++ b/fs/btrfs/volumes.h -@@ -24,6 +24,8 @@ - #include - #include "async-thread.h" - -+#define BTRFS_MAX_DATA_CHUNK_SIZE (10ULL * SZ_1G) -+ - extern struct mutex uuid_mutex; - - #define BTRFS_STRIPE_LEN (64 * 1024) -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 0141aba9eca6..026b399af215 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -1073,10 +1073,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) - - /* - * Accessing maxBuf is racy with cifs_reconnect - need to store value -- * and check it for zero before using. -+ * and check it before using. - */ - max_buf = tcon->ses->server->maxBuf; -- if (!max_buf) { -+ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) { - free_xid(xid); - return -EINVAL; - } -@@ -1404,10 +1404,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - - /* - * Accessing maxBuf is racy with cifs_reconnect - need to store value -- * and check it for zero before using. -+ * and check it before using. - */ - max_buf = tcon->ses->server->maxBuf; -- if (!max_buf) -+ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) - return -EINVAL; - - max_num = (max_buf - sizeof(struct smb_hdr)) / -diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c -index b2aff0c6f22c..b7885dc0d9bb 100644 ---- a/fs/cifs/smb2file.c -+++ b/fs/cifs/smb2file.c -@@ -123,10 +123,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - - /* - * Accessing maxBuf is racy with cifs_reconnect - need to store value -- * and check it for zero before using. -+ * and check it before using. - */ - max_buf = tcon->ses->server->maxBuf; -- if (!max_buf) -+ if (max_buf < sizeof(struct smb2_lock_element)) - return -EINVAL; - - max_num = max_buf / sizeof(struct smb2_lock_element); -diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c -index 54af10204e83..1cf0a336ec06 100644 ---- a/fs/cifs/transport.c -+++ b/fs/cifs/transport.c -@@ -360,7 +360,7 @@ uncork: - if (rc < 0 && rc != -EINTR) - cifs_dbg(VFS, "Error %d sending data on socket to server\n", - rc); -- else -+ else if (rc > 0) - rc = 0; - - return rc; -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 46d4fac48cf4..0dcd33f62637 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1861,12 +1861,12 @@ int ext4_inline_data_fiemap(struct inode *inode, - physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data; - physical += offsetof(struct ext4_inode, i_block); - -- if (physical) -- error = fiemap_fill_next_extent(fieinfo, start, physical, -- inline_len, flags); - brelse(iloc.bh); - out: - up_read(&EXT4_I(inode)->xattr_sem); -+ if (physical) -+ error = fiemap_fill_next_extent(fieinfo, start, physical, -+ inline_len, flags); - return (error < 0 ? error : 0); - } - -diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h -index cc0fc712bb82..a8ac3f25b4ec 100644 ---- a/include/linux/sunrpc/svc.h -+++ b/include/linux/sunrpc/svc.h -@@ -290,9 +290,12 @@ struct svc_rqst { - struct svc_cacherep * rq_cacherep; /* cache info */ - struct task_struct *rq_task; /* service thread */ - spinlock_t rq_lock; /* per-request lock */ -+ struct net *rq_bc_net; /* pointer to backchannel's -+ * net namespace -+ */ - }; - --#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net) -+#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net) - - /* - * Rigorous type checking on sockaddr type conversions -diff --git a/mm/slab.c b/mm/slab.c -index fa49c01225a7..92df044f5e00 100644 ---- a/mm/slab.c -+++ b/mm/slab.c -@@ -875,8 +875,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, - struct alien_cache *alc = NULL; - - alc = kmalloc_node(memsize, gfp, node); -- init_arraycache(&alc->ac, entries, batch); -- spin_lock_init(&alc->lock); -+ if (alc) { -+ init_arraycache(&alc->ac, entries, batch); -+ spin_lock_init(&alc->lock); -+ } - return alc; - } - -diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c -index c5b0cb4f4056..41f6e964fe91 100644 ---- a/net/sunrpc/svc.c -+++ b/net/sunrpc/svc.c -@@ -1062,6 +1062,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) - static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {} - #endif - -+extern void svc_tcp_prep_reply_hdr(struct svc_rqst *); -+ - /* - * Common routine for processing the RPC request. - */ -@@ -1091,7 +1093,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) - clear_bit(RQ_DROPME, &rqstp->rq_flags); - - /* Setup reply header */ -- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); -+ if (rqstp->rq_prot == IPPROTO_TCP) -+ svc_tcp_prep_reply_hdr(rqstp); - - svc_putu32(resv, rqstp->rq_xid); - -@@ -1138,7 +1141,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) - case SVC_DENIED: - goto err_bad_auth; - case SVC_CLOSE: -- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) -+ if (rqstp->rq_xprt && -+ test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) - svc_close_xprt(rqstp->rq_xprt); - case SVC_DROP: - goto dropit; -@@ -1360,10 +1364,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req, - dprintk("svc: %s(%p)\n", __func__, req); - - /* Build the svc_rqst used by the common processing routine */ -- rqstp->rq_xprt = serv->sv_bc_xprt; - rqstp->rq_xid = req->rq_xid; - rqstp->rq_prot = req->rq_xprt->prot; - rqstp->rq_server = serv; -+ rqstp->rq_bc_net = req->rq_xprt->xprt_net; - - rqstp->rq_addrlen = sizeof(req->rq_xprt->addr); - memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen); -diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c -index 71f15da72f02..2b8e80c721db 100644 ---- a/net/sunrpc/svc_xprt.c -+++ b/net/sunrpc/svc_xprt.c -@@ -454,10 +454,11 @@ out: - */ - void svc_reserve(struct svc_rqst *rqstp, int space) - { -+ struct svc_xprt *xprt = rqstp->rq_xprt; -+ - space += rqstp->rq_res.head[0].iov_len; - -- if (space < rqstp->rq_reserved) { -- struct svc_xprt *xprt = rqstp->rq_xprt; -+ if (xprt && space < rqstp->rq_reserved) { - atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved); - rqstp->rq_reserved = space; - -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 9701fcca002c..0a9fe033132c 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -1240,7 +1240,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) - /* - * Setup response header. TCP has a 4B record length field. - */ --static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) -+void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) - { - struct kvec *resv = &rqstp->rq_res.head[0]; - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 0467e5ba82e0..5d8ac2d798df 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4792,6 +4792,13 @@ static void alc280_fixup_hp_9480m(struct hda_codec *codec, - } - } - -+static void alc_fixup_disable_mic_vref(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ if (action == HDA_FIXUP_ACT_PRE_PROBE) -+ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ); -+} -+ - /* for hda_fixup_thinkpad_acpi() */ - #include "thinkpad_helper.c" - -@@ -4891,6 +4898,7 @@ enum { - ALC293_FIXUP_LENOVO_SPK_NOISE, - ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, - ALC255_FIXUP_DELL_SPK_NOISE, -+ ALC225_FIXUP_DISABLE_MIC_VREF, - ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC295_FIXUP_DISABLE_DAC3, - ALC280_FIXUP_HP_HEADSET_MIC, -@@ -5546,6 +5554,12 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE - }, -+ [ALC225_FIXUP_DISABLE_MIC_VREF] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc_fixup_disable_mic_vref, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE -+ }, - [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = { - .type = HDA_FIXUP_VERBS, - .v.verbs = (const struct hda_verb[]) { -@@ -5555,7 +5569,7 @@ static const struct hda_fixup alc269_fixups[] = { - {} - }, - .chained = true, -- .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE -+ .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF - }, - [ALC280_FIXUP_HP_HEADSET_MIC] = { - .type = HDA_FIXUP_FUNC, diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.171-172.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.171-172.patch deleted file mode 100644 index 3e34153b754f..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.171-172.patch +++ /dev/null @@ -1,1939 +0,0 @@ -diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt -index 6d2689ebf824..5b87946a53a3 100644 ---- a/Documentation/filesystems/proc.txt -+++ b/Documentation/filesystems/proc.txt -@@ -466,7 +466,9 @@ manner. The codes are the following: - - Note that there is no guarantee that every flag and associated mnemonic will - be present in all further kernel releases. Things get changed, the flags may --be vanished or the reverse -- new added. -+be vanished or the reverse -- new added. Interpretation of their meaning -+might change in future as well. So each consumer of these flags has to -+follow each specific kernel version for the exact semantic. - - This file is only present if the CONFIG_MMU kernel configuration option is - enabled. -diff --git a/Makefile b/Makefile -index c6b680faedd8..2aa8db459a74 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 171 -+SUBLEVEL = 172 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h -index ef8e13d379cb..d7e7cf56e8d6 100644 ---- a/arch/arm64/include/asm/kvm_arm.h -+++ b/arch/arm64/include/asm/kvm_arm.h -@@ -23,6 +23,8 @@ - #include - - /* Hyp Configuration Register (HCR) bits */ -+#define HCR_API (UL(1) << 41) -+#define HCR_APK (UL(1) << 40) - #define HCR_ID (UL(1) << 33) - #define HCR_CD (UL(1) << 32) - #define HCR_RW_SHIFT 31 -@@ -81,6 +83,7 @@ - HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW) - #define HCR_VIRT_EXCP_MASK (HCR_VA | HCR_VI | HCR_VF) - #define HCR_INT_OVERRIDE (HCR_FMO | HCR_IMO) -+#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK) - - - /* Hyp System Control Register (SCTLR_EL2) bits */ -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index d019c3a58cc2..0382eba4bf7b 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -464,7 +465,7 @@ CPU_LE( bic x0, x0, #(3 << 24) ) // Clear the EE and E0E bits for EL1 - ret - - /* Hyp configuration. */ --2: mov x0, #(1 << 31) // 64-bit EL1 -+2: mov_q x0, HCR_HOST_NVHE_FLAGS - msr hcr_el2, x0 - - /* Generic timers. */ -diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c -index 62d3dc60ca09..e99a0ed7e66b 100644 ---- a/arch/arm64/kernel/perf_event.c -+++ b/arch/arm64/kernel/perf_event.c -@@ -670,6 +670,7 @@ static struct platform_driver armv8_pmu_driver = { - .driver = { - .name = "armv8-pmu", - .of_match_table = armv8_pmu_of_device_ids, -+ .suppress_bind_attrs = true, - }, - .probe = armv8_pmu_device_probe, - }; -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 8b0424abc84c..333ea0389adb 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -760,6 +760,7 @@ config SIBYTE_SWARM - select SYS_SUPPORTS_HIGHMEM - select SYS_SUPPORTS_LITTLE_ENDIAN - select ZONE_DMA32 if 64BIT -+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SIBYTE_LITTLESUR - bool "Sibyte BCM91250C2-LittleSur" -@@ -782,6 +783,7 @@ config SIBYTE_SENTOSA - select SYS_HAS_CPU_SB1 - select SYS_SUPPORTS_BIG_ENDIAN - select SYS_SUPPORTS_LITTLE_ENDIAN -+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SIBYTE_BIGSUR - bool "Sibyte BCM91480B-BigSur" -@@ -795,6 +797,7 @@ config SIBYTE_BIGSUR - select SYS_SUPPORTS_HIGHMEM - select SYS_SUPPORTS_LITTLE_ENDIAN - select ZONE_DMA32 if 64BIT -+ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SNI_RM - bool "SNI RM200/300/400" -@@ -2972,6 +2975,7 @@ config MIPS32_O32 - config MIPS32_N32 - bool "Kernel support for n32 binaries" - depends on 64BIT -+ select ARCH_WANT_COMPAT_IPC_PARSE_VERSION - select COMPAT - select MIPS32_COMPAT - select SYSVIPC_COMPAT if SYSVIPC -diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c -index 2a5bb849b10e..288b58b00dc8 100644 ---- a/arch/mips/pci/msi-octeon.c -+++ b/arch/mips/pci/msi-octeon.c -@@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void) - int irq; - struct irq_chip *msi; - -- if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) { -+ if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) { -+ return 0; -+ } else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) { - msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0; - msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1; - msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2; -diff --git a/arch/mips/sibyte/common/Makefile b/arch/mips/sibyte/common/Makefile -index b3d6bf23a662..3ef3fb658136 100644 ---- a/arch/mips/sibyte/common/Makefile -+++ b/arch/mips/sibyte/common/Makefile -@@ -1,4 +1,5 @@ - obj-y := cfe.o -+obj-$(CONFIG_SWIOTLB) += dma.o - obj-$(CONFIG_SIBYTE_BUS_WATCHER) += bus_watcher.o - obj-$(CONFIG_SIBYTE_CFE_CONSOLE) += cfe_console.o - obj-$(CONFIG_SIBYTE_TBPROF) += sb_tbprof.o -diff --git a/arch/mips/sibyte/common/dma.c b/arch/mips/sibyte/common/dma.c -new file mode 100644 -index 000000000000..eb47a94f3583 ---- /dev/null -+++ b/arch/mips/sibyte/common/dma.c -@@ -0,0 +1,14 @@ -+// SPDX-License-Identifier: GPL-2.0+ -+/* -+ * DMA support for Broadcom SiByte platforms. -+ * -+ * Copyright (c) 2018 Maciej W. Rozycki -+ */ -+ -+#include -+#include -+ -+void __init plat_swiotlb_setup(void) -+{ -+ swiotlb_init(1); -+} -diff --git a/crypto/authenc.c b/crypto/authenc.c -index b7290c5b1eaa..5c25005ff398 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -58,14 +58,22 @@ int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key, - return -EINVAL; - if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM) - return -EINVAL; -- if (RTA_PAYLOAD(rta) < sizeof(*param)) -+ -+ /* -+ * RTA_OK() didn't align the rtattr's payload when validating that it -+ * fits in the buffer. Yet, the keys should start on the next 4-byte -+ * aligned boundary. To avoid confusion, require that the rtattr -+ * payload be exactly the param struct, which has a 4-byte aligned size. -+ */ -+ if (RTA_PAYLOAD(rta) != sizeof(*param)) - return -EINVAL; -+ BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO); - - param = RTA_DATA(rta); - keys->enckeylen = be32_to_cpu(param->enckeylen); - -- key += RTA_ALIGN(rta->rta_len); -- keylen -= RTA_ALIGN(rta->rta_len); -+ key += rta->rta_len; -+ keylen -= rta->rta_len; - - if (keylen < keys->enckeylen) - return -EINVAL; -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index fa0c4567f697..5fdf3e532310 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -276,7 +276,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq, - struct aead_request *req = areq->data; - - err = err ?: crypto_authenc_esn_decrypt_tail(req, 0); -- aead_request_complete(req, err); -+ authenc_esn_request_complete(req, err); - } - - static int crypto_authenc_esn_decrypt(struct aead_request *req) -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index 0346e46e2871..ecca4ae248e0 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -33,6 +33,9 @@ static struct kset *system_kset; - - #define to_drv_attr(_attr) container_of(_attr, struct driver_attribute, attr) - -+#define DRIVER_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \ -+ struct driver_attribute driver_attr_##_name = \ -+ __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) - - static int __must_check bus_rescan_devices_helper(struct device *dev, - void *data); -@@ -198,7 +201,7 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf, - bus_put(bus); - return err; - } --static DRIVER_ATTR_WO(unbind); -+static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, S_IWUSR, NULL, unbind_store); - - /* - * Manually attach a device to a driver. -@@ -234,7 +237,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, - bus_put(bus); - return err; - } --static DRIVER_ATTR_WO(bind); -+static DRIVER_ATTR_IGNORE_LOCKDEP(bind, S_IWUSR, NULL, bind_store); - - static ssize_t show_drivers_autoprobe(struct bus_type *bus, char *buf) - { -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index da3902ac16c8..b1cf891cb3d9 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -81,7 +81,7 @@ - #include - - static DEFINE_IDR(loop_index_idr); --static DEFINE_MUTEX(loop_index_mutex); -+static DEFINE_MUTEX(loop_ctl_mutex); - - static int max_part; - static int part_shift; -@@ -1044,7 +1044,7 @@ static int loop_clr_fd(struct loop_device *lo) - */ - if (atomic_read(&lo->lo_refcnt) > 1) { - lo->lo_flags |= LO_FLAGS_AUTOCLEAR; -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - return 0; - } - -@@ -1093,12 +1093,12 @@ static int loop_clr_fd(struct loop_device *lo) - if (!part_shift) - lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; - loop_unprepare_queue(lo); -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - /* -- * Need not hold lo_ctl_mutex to fput backing file. -- * Calling fput holding lo_ctl_mutex triggers a circular -+ * Need not hold loop_ctl_mutex to fput backing file. -+ * Calling fput holding loop_ctl_mutex triggers a circular - * lock dependency possibility warning as fput can take -- * bd_mutex which is usually taken before lo_ctl_mutex. -+ * bd_mutex which is usually taken before loop_ctl_mutex. - */ - fput(filp); - return 0; -@@ -1361,7 +1361,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - struct loop_device *lo = bdev->bd_disk->private_data; - int err; - -- mutex_lock_nested(&lo->lo_ctl_mutex, 1); -+ mutex_lock_nested(&loop_ctl_mutex, 1); - switch (cmd) { - case LOOP_SET_FD: - err = loop_set_fd(lo, mode, bdev, arg); -@@ -1370,7 +1370,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - err = loop_change_fd(lo, bdev, arg); - break; - case LOOP_CLR_FD: -- /* loop_clr_fd would have unlocked lo_ctl_mutex on success */ -+ /* loop_clr_fd would have unlocked loop_ctl_mutex on success */ - err = loop_clr_fd(lo); - if (!err) - goto out_unlocked; -@@ -1406,7 +1406,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - default: - err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL; - } -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - - out_unlocked: - return err; -@@ -1539,16 +1539,16 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, - - switch(cmd) { - case LOOP_SET_STATUS: -- mutex_lock(&lo->lo_ctl_mutex); -+ mutex_lock(&loop_ctl_mutex); - err = loop_set_status_compat( - lo, (const struct compat_loop_info __user *) arg); -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - break; - case LOOP_GET_STATUS: -- mutex_lock(&lo->lo_ctl_mutex); -+ mutex_lock(&loop_ctl_mutex); - err = loop_get_status_compat( - lo, (struct compat_loop_info __user *) arg); -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - break; - case LOOP_SET_CAPACITY: - case LOOP_CLR_FD: -@@ -1570,9 +1570,11 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, - static int lo_open(struct block_device *bdev, fmode_t mode) - { - struct loop_device *lo; -- int err = 0; -+ int err; - -- mutex_lock(&loop_index_mutex); -+ err = mutex_lock_killable(&loop_ctl_mutex); -+ if (err) -+ return err; - lo = bdev->bd_disk->private_data; - if (!lo) { - err = -ENXIO; -@@ -1581,18 +1583,20 @@ static int lo_open(struct block_device *bdev, fmode_t mode) - - atomic_inc(&lo->lo_refcnt); - out: -- mutex_unlock(&loop_index_mutex); -+ mutex_unlock(&loop_ctl_mutex); - return err; - } - --static void __lo_release(struct loop_device *lo) -+static void lo_release(struct gendisk *disk, fmode_t mode) - { -+ struct loop_device *lo; - int err; - -+ mutex_lock(&loop_ctl_mutex); -+ lo = disk->private_data; - if (atomic_dec_return(&lo->lo_refcnt)) -- return; -+ goto out_unlock; - -- mutex_lock(&lo->lo_ctl_mutex); - if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { - /* - * In autoclear mode, stop the loop thread -@@ -1609,14 +1613,8 @@ static void __lo_release(struct loop_device *lo) - loop_flush(lo); - } - -- mutex_unlock(&lo->lo_ctl_mutex); --} -- --static void lo_release(struct gendisk *disk, fmode_t mode) --{ -- mutex_lock(&loop_index_mutex); -- __lo_release(disk->private_data); -- mutex_unlock(&loop_index_mutex); -+out_unlock: -+ mutex_unlock(&loop_ctl_mutex); - } - - static const struct block_device_operations lo_fops = { -@@ -1655,10 +1653,10 @@ static int unregister_transfer_cb(int id, void *ptr, void *data) - struct loop_device *lo = ptr; - struct loop_func_table *xfer = data; - -- mutex_lock(&lo->lo_ctl_mutex); -+ mutex_lock(&loop_ctl_mutex); - if (lo->lo_encryption == xfer) - loop_release_xfer(lo); -- mutex_unlock(&lo->lo_ctl_mutex); -+ mutex_unlock(&loop_ctl_mutex); - return 0; - } - -@@ -1820,7 +1818,6 @@ static int loop_add(struct loop_device **l, int i) - if (!part_shift) - disk->flags |= GENHD_FL_NO_PART_SCAN; - disk->flags |= GENHD_FL_EXT_DEVT; -- mutex_init(&lo->lo_ctl_mutex); - atomic_set(&lo->lo_refcnt, 0); - lo->lo_number = i; - spin_lock_init(&lo->lo_lock); -@@ -1899,7 +1896,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) - struct kobject *kobj; - int err; - -- mutex_lock(&loop_index_mutex); -+ mutex_lock(&loop_ctl_mutex); - err = loop_lookup(&lo, MINOR(dev) >> part_shift); - if (err < 0) - err = loop_add(&lo, MINOR(dev) >> part_shift); -@@ -1907,7 +1904,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) - kobj = NULL; - else - kobj = get_disk(lo->lo_disk); -- mutex_unlock(&loop_index_mutex); -+ mutex_unlock(&loop_ctl_mutex); - - *part = 0; - return kobj; -@@ -1917,9 +1914,13 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - unsigned long parm) - { - struct loop_device *lo; -- int ret = -ENOSYS; -+ int ret; -+ -+ ret = mutex_lock_killable(&loop_ctl_mutex); -+ if (ret) -+ return ret; - -- mutex_lock(&loop_index_mutex); -+ ret = -ENOSYS; - switch (cmd) { - case LOOP_CTL_ADD: - ret = loop_lookup(&lo, parm); -@@ -1933,19 +1934,15 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - ret = loop_lookup(&lo, parm); - if (ret < 0) - break; -- mutex_lock(&lo->lo_ctl_mutex); - if (lo->lo_state != Lo_unbound) { - ret = -EBUSY; -- mutex_unlock(&lo->lo_ctl_mutex); - break; - } - if (atomic_read(&lo->lo_refcnt) > 0) { - ret = -EBUSY; -- mutex_unlock(&lo->lo_ctl_mutex); - break; - } - lo->lo_disk->private_data = NULL; -- mutex_unlock(&lo->lo_ctl_mutex); - idr_remove(&loop_index_idr, lo->lo_number); - loop_remove(lo); - break; -@@ -1955,7 +1952,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - break; - ret = loop_add(&lo, -1); - } -- mutex_unlock(&loop_index_mutex); -+ mutex_unlock(&loop_ctl_mutex); - - return ret; - } -@@ -2038,10 +2035,10 @@ static int __init loop_init(void) - THIS_MODULE, loop_probe, NULL, NULL); - - /* pre-create number of devices given by config or max_loop */ -- mutex_lock(&loop_index_mutex); -+ mutex_lock(&loop_ctl_mutex); - for (i = 0; i < nr; i++) - loop_add(&lo, i); -- mutex_unlock(&loop_index_mutex); -+ mutex_unlock(&loop_ctl_mutex); - - printk(KERN_INFO "loop: module loaded\n"); - return 0; -diff --git a/drivers/block/loop.h b/drivers/block/loop.h -index 60f0fd2c0c65..a923e74495ce 100644 ---- a/drivers/block/loop.h -+++ b/drivers/block/loop.h -@@ -55,7 +55,6 @@ struct loop_device { - - spinlock_t lo_lock; - int lo_state; -- struct mutex lo_ctl_mutex; - struct kthread_worker worker; - struct task_struct *worker_task; - bool use_dio; -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index 7a2e23d6bfdd..b2da2382d544 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -637,8 +637,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - - /* Remove the multi-part read marker. */ - len -= 2; -+ data += 2; - for (i = 0; i < len; i++) -- ssif_info->data[i] = data[i+2]; -+ ssif_info->data[i] = data[i]; - ssif_info->multi_len = len; - ssif_info->multi_pos = 1; - -@@ -666,8 +667,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - } - - blocknum = data[0]; -+ len--; -+ data++; -+ -+ if (blocknum != 0xff && len != 31) { -+ /* All blocks but the last must have 31 data bytes. */ -+ result = -EIO; -+ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) -+ pr_info("Received middle message <31\n"); - -- if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) { -+ goto continue_op; -+ } -+ -+ if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) { - /* Received message too big, abort the operation. */ - result = -E2BIG; - if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) -@@ -676,16 +688,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - goto continue_op; - } - -- /* Remove the blocknum from the data. */ -- len--; - for (i = 0; i < len; i++) -- ssif_info->data[i + ssif_info->multi_len] = data[i + 1]; -+ ssif_info->data[i + ssif_info->multi_len] = data[i]; - ssif_info->multi_len += len; - if (blocknum == 0xff) { - /* End of read */ - len = ssif_info->multi_len; - data = ssif_info->data; -- } else if (blocknum + 1 != ssif_info->multi_pos) { -+ } else if (blocknum != ssif_info->multi_pos) { - /* - * Out of sequence block, just abort. Block - * numbers start at zero for the second block, -@@ -713,6 +723,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - } - } - -+ continue_op: - if (result < 0) { - ssif_inc_stat(ssif_info, receive_errors); - } else { -@@ -720,8 +731,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - ssif_inc_stat(ssif_info, received_message_parts); - } - -- -- continue_op: - if (ssif_info->ssif_debug & SSIF_DEBUG_STATE) - pr_info(PFX "DONE 1: state = %d, result=%d.\n", - ssif_info->ssif_state, result); -diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c -index a0df83e6b84b..46c05c9a9354 100644 ---- a/drivers/clk/imx/clk-imx6q.c -+++ b/drivers/clk/imx/clk-imx6q.c -@@ -239,8 +239,12 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) - * lvds1_gate and lvds2_gate are pseudo-gates. Both can be - * independently configured as clock inputs or outputs. We treat - * the "output_enable" bit as a gate, even though it's really just -- * enabling clock output. -+ * enabling clock output. Initially the gate bits are cleared, as -+ * otherwise the exclusive configuration gets locked in the setup done -+ * by software running before the clock driver, with no way to change -+ * it. - */ -+ writel(readl(base + 0x160) & ~0x3c00, base + 0x160); - clk[IMX6QDL_CLK_LVDS1_GATE] = imx_clk_gate_exclusive("lvds1_gate", "lvds1_sel", base + 0x160, 10, BIT(12)); - clk[IMX6QDL_CLK_LVDS2_GATE] = imx_clk_gate_exclusive("lvds2_gate", "lvds2_sel", base + 0x160, 11, BIT(13)); - -diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c -index 07135e009d8b..601a6c3acc7f 100644 ---- a/drivers/cpuidle/cpuidle-pseries.c -+++ b/drivers/cpuidle/cpuidle-pseries.c -@@ -240,7 +240,13 @@ static int pseries_idle_probe(void) - return -ENODEV; - - if (firmware_has_feature(FW_FEATURE_SPLPAR)) { -- if (lppaca_shared_proc(get_lppaca())) { -+ /* -+ * Use local_paca instead of get_lppaca() since -+ * preemption is not disabled, and it is not required in -+ * fact, since lppaca_ptr does not need to be the value -+ * associated to the current CPU, it can be from any CPU. -+ */ -+ if (lppaca_shared_proc(local_paca->lppaca_ptr)) { - cpuidle_state_table = shared_states; - max_idle_state = ARRAY_SIZE(shared_states); - } else { -diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c -index 5ad036741b99..e449f22c8f29 100644 ---- a/drivers/gpu/drm/drm_fb_helper.c -+++ b/drivers/gpu/drm/drm_fb_helper.c -@@ -1109,9 +1109,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, - struct drm_framebuffer *fb = fb_helper->fb; - int depth; - -- if (var->pixclock != 0 || in_dbg_master()) -+ if (in_dbg_master()) - return -EINVAL; - -+ if (var->pixclock != 0) { -+ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n"); -+ var->pixclock = 0; -+ } -+ - /* Need to resize the fb object !!! */ - if (var->bits_per_pixel > fb->bits_per_pixel || - var->xres > fb->width || var->yres > fb->height || -diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c -index 54c308e6704f..04248394843e 100644 ---- a/drivers/md/dm-kcopyd.c -+++ b/drivers/md/dm-kcopyd.c -@@ -55,15 +55,17 @@ struct dm_kcopyd_client { - struct dm_kcopyd_throttle *throttle; - - /* -- * We maintain three lists of jobs: -+ * We maintain four lists of jobs: - * - * i) jobs waiting for pages - * ii) jobs that have pages, and are waiting for the io to be issued. -- * iii) jobs that have completed. -+ * iii) jobs that don't need to do any IO and just run a callback -+ * iv) jobs that have completed. - * -- * All three of these are protected by job_lock. -+ * All four of these are protected by job_lock. - */ - spinlock_t job_lock; -+ struct list_head callback_jobs; - struct list_head complete_jobs; - struct list_head io_jobs; - struct list_head pages_jobs; -@@ -583,6 +585,7 @@ static void do_work(struct work_struct *work) - struct dm_kcopyd_client *kc = container_of(work, - struct dm_kcopyd_client, kcopyd_work); - struct blk_plug plug; -+ unsigned long flags; - - /* - * The order that these are called is *very* important. -@@ -591,6 +594,10 @@ static void do_work(struct work_struct *work) - * list. io jobs call wake when they complete and it all - * starts again. - */ -+ spin_lock_irqsave(&kc->job_lock, flags); -+ list_splice_tail_init(&kc->callback_jobs, &kc->complete_jobs); -+ spin_unlock_irqrestore(&kc->job_lock, flags); -+ - blk_start_plug(&plug); - process_jobs(&kc->complete_jobs, kc, run_complete_job); - process_jobs(&kc->pages_jobs, kc, run_pages_job); -@@ -608,7 +615,7 @@ static void dispatch_job(struct kcopyd_job *job) - struct dm_kcopyd_client *kc = job->kc; - atomic_inc(&kc->nr_jobs); - if (unlikely(!job->source.count)) -- push(&kc->complete_jobs, job); -+ push(&kc->callback_jobs, job); - else if (job->pages == &zero_page_list) - push(&kc->io_jobs, job); - else -@@ -795,7 +802,7 @@ void dm_kcopyd_do_callback(void *j, int read_err, unsigned long write_err) - job->read_err = read_err; - job->write_err = write_err; - -- push(&kc->complete_jobs, job); -+ push(&kc->callback_jobs, job); - wake(kc); - } - EXPORT_SYMBOL(dm_kcopyd_do_callback); -@@ -825,6 +832,7 @@ struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *thro - return ERR_PTR(-ENOMEM); - - spin_lock_init(&kc->job_lock); -+ INIT_LIST_HEAD(&kc->callback_jobs); - INIT_LIST_HEAD(&kc->complete_jobs); - INIT_LIST_HEAD(&kc->io_jobs); - INIT_LIST_HEAD(&kc->pages_jobs); -@@ -874,6 +882,7 @@ void dm_kcopyd_client_destroy(struct dm_kcopyd_client *kc) - /* Wait for completion of all jobs submitted by this client. */ - wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs)); - -+ BUG_ON(!list_empty(&kc->callback_jobs)); - BUG_ON(!list_empty(&kc->complete_jobs)); - BUG_ON(!list_empty(&kc->io_jobs)); - BUG_ON(!list_empty(&kc->pages_jobs)); -diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c -index e108deebbaaa..5d3797728b9c 100644 ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - - #include "dm.h" - -@@ -105,6 +106,9 @@ struct dm_snapshot { - /* The on disk metadata handler */ - struct dm_exception_store *store; - -+ /* Maximum number of in-flight COW jobs. */ -+ struct semaphore cow_count; -+ - struct dm_kcopyd_client *kcopyd_client; - - /* Wait for events based on state_bits */ -@@ -145,6 +149,19 @@ struct dm_snapshot { - #define RUNNING_MERGE 0 - #define SHUTDOWN_MERGE 1 - -+/* -+ * Maximum number of chunks being copied on write. -+ * -+ * The value was decided experimentally as a trade-off between memory -+ * consumption, stalling the kernel's workqueues and maintaining a high enough -+ * throughput. -+ */ -+#define DEFAULT_COW_THRESHOLD 2048 -+ -+static int cow_threshold = DEFAULT_COW_THRESHOLD; -+module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644); -+MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write"); -+ - DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle, - "A percentage of time allocated for copy on write"); - -@@ -1190,6 +1207,8 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - goto bad_hash_tables; - } - -+ sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX); -+ - s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle); - if (IS_ERR(s->kcopyd_client)) { - r = PTR_ERR(s->kcopyd_client); -@@ -1563,6 +1582,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context) - } - list_add(&pe->out_of_order_entry, lh); - } -+ up(&s->cow_count); - } - - /* -@@ -1586,6 +1606,7 @@ static void start_copy(struct dm_snap_pending_exception *pe) - dest.count = src.count; - - /* Hand over to kcopyd */ -+ down(&s->cow_count); - dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe); - } - -@@ -1606,6 +1627,7 @@ static void start_full_bio(struct dm_snap_pending_exception *pe, - pe->full_bio_end_io = bio->bi_end_io; - pe->full_bio_private = bio->bi_private; - -+ down(&s->cow_count); - callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client, - copy_callback, pe); - -diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c -index 251a556112a9..280b5ffea592 100644 ---- a/drivers/media/firewire/firedtv-avc.c -+++ b/drivers/media/firewire/firedtv-avc.c -@@ -968,7 +968,8 @@ static int get_ca_object_length(struct avc_response_frame *r) - return r->operand[7]; - } - --int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len) -+int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info, -+ unsigned int *len) - { - struct avc_command_frame *c = (void *)fdtv->avc_data; - struct avc_response_frame *r = (void *)fdtv->avc_data; -@@ -1009,7 +1010,8 @@ out: - return ret; - } - --int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len) -+int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info, -+ unsigned int *len) - { - struct avc_command_frame *c = (void *)fdtv->avc_data; - struct avc_response_frame *r = (void *)fdtv->avc_data; -diff --git a/drivers/media/firewire/firedtv.h b/drivers/media/firewire/firedtv.h -index 345d1eda8c05..5b18a08c6285 100644 ---- a/drivers/media/firewire/firedtv.h -+++ b/drivers/media/firewire/firedtv.h -@@ -124,8 +124,10 @@ int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst, - struct dvb_diseqc_master_cmd *diseqcmd); - void avc_remote_ctrl_work(struct work_struct *work); - int avc_register_remote_control(struct firedtv *fdtv); --int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len); --int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len); -+int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info, -+ unsigned int *len); -+int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info, -+ unsigned int *len); - int avc_ca_reset(struct firedtv *fdtv); - int avc_ca_pmt(struct firedtv *fdtv, char *app_info, int length); - int avc_ca_get_time_date(struct firedtv *fdtv, int *interval); -diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c -index 83cc6d3b4784..81ba454a6d95 100644 ---- a/drivers/media/platform/vivid/vivid-kthread-cap.c -+++ b/drivers/media/platform/vivid/vivid-kthread-cap.c -@@ -863,8 +863,11 @@ int vivid_start_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming) - "%s-vid-cap", dev->v4l2_dev.name); - - if (IS_ERR(dev->kthread_vid_cap)) { -+ int err = PTR_ERR(dev->kthread_vid_cap); -+ -+ dev->kthread_vid_cap = NULL; - v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n"); -- return PTR_ERR(dev->kthread_vid_cap); -+ return err; - } - *pstreaming = true; - vivid_grab_controls(dev, true); -diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c -index c2c46dcdbe95..2c5dbdcb576a 100644 ---- a/drivers/media/platform/vivid/vivid-kthread-out.c -+++ b/drivers/media/platform/vivid/vivid-kthread-out.c -@@ -248,8 +248,11 @@ int vivid_start_generating_vid_out(struct vivid_dev *dev, bool *pstreaming) - "%s-vid-out", dev->v4l2_dev.name); - - if (IS_ERR(dev->kthread_vid_out)) { -+ int err = PTR_ERR(dev->kthread_vid_out); -+ -+ dev->kthread_vid_out = NULL; - v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n"); -- return PTR_ERR(dev->kthread_vid_out); -+ return err; - } - *pstreaming = true; - vivid_grab_controls(dev, true); -diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c -index 1678b730dba2..2e82f520a869 100644 ---- a/drivers/media/platform/vivid/vivid-vid-common.c -+++ b/drivers/media/platform/vivid/vivid-vid-common.c -@@ -33,7 +33,7 @@ const struct v4l2_dv_timings_cap vivid_dv_timings_cap = { - .type = V4L2_DV_BT_656_1120, - /* keep this initialization for compatibility with GCC < 4.4.6 */ - .reserved = { 0 }, -- V4L2_INIT_BT_TIMINGS(0, MAX_WIDTH, 0, MAX_HEIGHT, 14000000, 775000000, -+ V4L2_INIT_BT_TIMINGS(16, MAX_WIDTH, 16, MAX_HEIGHT, 14000000, 775000000, - V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | - V4L2_DV_BT_STD_CVT | V4L2_DV_BT_STD_GTF, - V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_INTERLACED) -diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c -index 6cfcdcea27e0..873948e429e8 100644 ---- a/drivers/media/usb/em28xx/em28xx-video.c -+++ b/drivers/media/usb/em28xx/em28xx-video.c -@@ -930,6 +930,8 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count) - - em28xx_videodbg("%s\n", __func__); - -+ dev->v4l2->field_count = 0; -+ - /* Make sure streaming is not already in progress for this type - of filehandle (e.g. video, vbi) */ - rc = res_get(dev, vq->type); -@@ -1149,8 +1151,6 @@ static void em28xx_ctrl_notify(struct v4l2_ctrl *ctrl, void *priv) - { - struct em28xx *dev = priv; - -- dev->v4l2->field_count = 0; -- - /* - * In the case of non-AC97 volume controls, we still need - * to do some setups at em28xx, in order to mute/unmute -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index 8ce9c63dfc59..e0041fcfa783 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -1976,9 +1976,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) - return -EINVAL; - } - } -+ -+ mutex_lock(&q->mmap_lock); -+ - if (vb2_fileio_is_active(q)) { - dprintk(1, "mmap: file io in progress\n"); -- return -EBUSY; -+ ret = -EBUSY; -+ goto unlock; - } - - /* -@@ -1986,7 +1990,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) - */ - ret = __find_plane_by_offset(q, off, &buffer, &plane); - if (ret) -- return ret; -+ goto unlock; - - vb = q->bufs[buffer]; - -@@ -1999,11 +2003,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) - if (length < (vma->vm_end - vma->vm_start)) { - dprintk(1, - "MMAP invalid, as it would overflow buffer length\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto unlock; - } - -- mutex_lock(&q->mmap_lock); - ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma); -+ -+unlock: - mutex_unlock(&q->mmap_lock); - if (ret) - return ret; -diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c -index 5628a6b5b19b..c5c320efc7b4 100644 ---- a/drivers/mfd/tps6586x.c -+++ b/drivers/mfd/tps6586x.c -@@ -594,6 +594,29 @@ static int tps6586x_i2c_remove(struct i2c_client *client) - return 0; - } - -+static int __maybe_unused tps6586x_i2c_suspend(struct device *dev) -+{ -+ struct tps6586x *tps6586x = dev_get_drvdata(dev); -+ -+ if (tps6586x->client->irq) -+ disable_irq(tps6586x->client->irq); -+ -+ return 0; -+} -+ -+static int __maybe_unused tps6586x_i2c_resume(struct device *dev) -+{ -+ struct tps6586x *tps6586x = dev_get_drvdata(dev); -+ -+ if (tps6586x->client->irq) -+ enable_irq(tps6586x->client->irq); -+ -+ return 0; -+} -+ -+static SIMPLE_DEV_PM_OPS(tps6586x_pm_ops, tps6586x_i2c_suspend, -+ tps6586x_i2c_resume); -+ - static const struct i2c_device_id tps6586x_id_table[] = { - { "tps6586x", 0 }, - { }, -@@ -604,6 +627,7 @@ static struct i2c_driver tps6586x_driver = { - .driver = { - .name = "tps6586x", - .of_match_table = of_match_ptr(tps6586x_of_match), -+ .pm = &tps6586x_pm_ops, - }, - .probe = tps6586x_i2c_probe, - .remove = tps6586x_i2c_remove, -diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c -index bf62e429f7fc..98be9eb3184b 100644 ---- a/drivers/mmc/host/atmel-mci.c -+++ b/drivers/mmc/host/atmel-mci.c -@@ -1840,13 +1840,14 @@ static void atmci_tasklet_func(unsigned long priv) - } - - atmci_request_end(host, host->mrq); -- state = STATE_IDLE; -+ goto unlock; /* atmci_request_end() sets host->state */ - break; - } - } while (state != prev_state); - - host->state = state; - -+unlock: - spin_unlock(&host->lock); - } - -diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c -index 25a0ad5102d6..855cf8c15c8a 100644 ---- a/drivers/net/ethernet/intel/e1000e/ptp.c -+++ b/drivers/net/ethernet/intel/e1000e/ptp.c -@@ -111,10 +111,14 @@ static int e1000e_phc_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) - struct e1000_adapter *adapter = container_of(ptp, struct e1000_adapter, - ptp_clock_info); - unsigned long flags; -- u64 ns; -+ u64 cycles, ns; - - spin_lock_irqsave(&adapter->systim_lock, flags); -- ns = timecounter_read(&adapter->tc); -+ -+ /* Use timecounter_cyc2time() to allow non-monotonic SYSTIM readings */ -+ cycles = adapter->cc.read(&adapter->cc); -+ ns = timecounter_cyc2time(&adapter->tc, cycles); -+ - spin_unlock_irqrestore(&adapter->systim_lock, flags); - - *ts = ns_to_timespec64(ns); -@@ -170,9 +174,12 @@ static void e1000e_systim_overflow_work(struct work_struct *work) - systim_overflow_work.work); - struct e1000_hw *hw = &adapter->hw; - struct timespec64 ts; -+ u64 ns; - -- adapter->ptp_clock_info.gettime64(&adapter->ptp_clock_info, &ts); -+ /* Update the timecounter */ -+ ns = timecounter_read(&adapter->tc); - -+ ts = ns_to_timespec64(ns); - e_dbg("SYSTIM overflow check at %lld.%09lu\n", - (long long) ts.tv_sec, ts.tv_nsec); - -diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c -index f96f7b865267..7c1defaef3f5 100644 ---- a/drivers/platform/x86/asus-wmi.c -+++ b/drivers/platform/x86/asus-wmi.c -@@ -2084,7 +2084,8 @@ static int asus_wmi_add(struct platform_device *pdev) - err = asus_wmi_backlight_init(asus); - if (err && err != -ENODEV) - goto fail_backlight; -- } -+ } else -+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL); - - status = wmi_install_notify_handler(asus->driver->event_guid, - asus_wmi_notify, asus); -diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c -index 741509b35617..14f32c114c55 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_fp.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fp.c -@@ -1273,7 +1273,7 @@ void mr_update_load_balance_params(struct MR_DRV_RAID_MAP_ALL *drv_map, - - for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) { - ld = MR_TargetIdToLdGet(ldCount, drv_map); -- if (ld >= MAX_LOGICAL_DRIVES_EXT) { -+ if (ld >= MAX_LOGICAL_DRIVES_EXT - 1) { - lbInfo[ldCount].loadBalanceFlag = 0; - continue; - } -diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c -index 213944ed64d9..3d3bfa814093 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c -+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c -@@ -1758,7 +1758,7 @@ static void megasas_build_ld_nonrw_fusion(struct megasas_instance *instance, - device_id < instance->fw_supported_vd_count)) { - - ld = MR_TargetIdToLdGet(device_id, local_map_ptr); -- if (ld >= instance->fw_supported_vd_count) -+ if (ld >= instance->fw_supported_vd_count - 1) - fp_possible = 0; - - raid = MR_LdRaidGet(ld, local_map_ptr); -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 6fffb73766de..ec80a0077ace 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -207,6 +207,12 @@ cache_type_store(struct device *dev, struct device_attribute *attr, - sp = buffer_data[0] & 0x80 ? 1 : 0; - buffer_data[0] &= ~0x80; - -+ /* -+ * Ensure WP, DPOFUA, and RESERVED fields are cleared in -+ * received mode parameter buffer before doing MODE SELECT. -+ */ -+ data.device_specific = 0; -+ - if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT, - SD_MAX_RETRIES, &data, &sshdr)) { - if (scsi_sense_valid(&sshdr)) -diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c -index 9413e1a949e5..5af4d6a03d6e 100644 ---- a/drivers/target/target_core_spc.c -+++ b/drivers/target/target_core_spc.c -@@ -108,12 +108,17 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf) - - buf[7] = 0x2; /* CmdQue=1 */ - -- memcpy(&buf[8], "LIO-ORG ", 8); -- memset(&buf[16], 0x20, 16); -+ /* -+ * ASCII data fields described as being left-aligned shall have any -+ * unused bytes at the end of the field (i.e., highest offset) and the -+ * unused bytes shall be filled with ASCII space characters (20h). -+ */ -+ memset(&buf[8], 0x20, 8 + 16 + 4); -+ memcpy(&buf[8], "LIO-ORG", sizeof("LIO-ORG") - 1); - memcpy(&buf[16], dev->t10_wwn.model, -- min_t(size_t, strlen(dev->t10_wwn.model), 16)); -+ strnlen(dev->t10_wwn.model, 16)); - memcpy(&buf[32], dev->t10_wwn.revision, -- min_t(size_t, strlen(dev->t10_wwn.revision), 4)); -+ strnlen(dev->t10_wwn.revision, 4)); - buf[4] = 31; /* Set additional length to 31 */ - - return 0; -@@ -251,7 +256,9 @@ check_t10_vend_desc: - buf[off] = 0x2; /* ASCII */ - buf[off+1] = 0x1; /* T10 Vendor ID */ - buf[off+2] = 0x0; -- memcpy(&buf[off+4], "LIO-ORG", 8); -+ /* left align Vendor ID and pad with spaces */ -+ memset(&buf[off+4], 0x20, 8); -+ memcpy(&buf[off+4], "LIO-ORG", sizeof("LIO-ORG") - 1); - /* Extra Byte for NULL Terminator */ - id_len++; - /* Identifier Length */ -diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c -index ad7eba5ca380..34234c233851 100644 ---- a/drivers/tty/tty_ldsem.c -+++ b/drivers/tty/tty_ldsem.c -@@ -307,6 +307,16 @@ down_write_failed(struct ld_semaphore *sem, long count, long timeout) - if (!locked) - ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem); - list_del(&waiter.list); -+ -+ /* -+ * In case of timeout, wake up every reader who gave the right of way -+ * to writer. Prevent separation readers into two groups: -+ * one that helds semaphore and another that sleeps. -+ * (in case of no contention with a writer) -+ */ -+ if (!locked && list_empty(&sem->write_wait)) -+ __ldsem_wake_readers(sem); -+ - raw_spin_unlock_irq(&sem->wait_lock); - - __set_task_state(tsk, TASK_RUNNING); -diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -index 34ab4f950f0a..0c1c34ff40a9 100644 ---- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c -@@ -609,6 +609,8 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg) - - int r = 0; - -+ memset(&p, 0, sizeof(p)); -+ - switch (cmd) { - case OMAPFB_SYNC_GFX: - DBG("ioctl SYNC_GFX\n"); -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index f80a0af68736..78722aaffecd 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4111,6 +4111,14 @@ static void btrfs_destroy_all_ordered_extents(struct btrfs_fs_info *fs_info) - spin_lock(&fs_info->ordered_root_lock); - } - spin_unlock(&fs_info->ordered_root_lock); -+ -+ /* -+ * We need this here because if we've been flipped read-only we won't -+ * get sync() from the umount, so we need to make sure any ordered -+ * extents that haven't had their dirty pages IO start writeout yet -+ * actually get run and error out properly. -+ */ -+ btrfs_wait_ordered_roots(fs_info, -1); - } - - static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans, -diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c -index 1544f530ccd0..023e7f32ee1b 100644 ---- a/fs/jffs2/super.c -+++ b/fs/jffs2/super.c -@@ -101,7 +101,8 @@ static int jffs2_sync_fs(struct super_block *sb, int wait) - struct jffs2_sb_info *c = JFFS2_SB_INFO(sb); - - #ifdef CONFIG_JFFS2_FS_WRITEBUFFER -- cancel_delayed_work_sync(&c->wbuf_dwork); -+ if (jffs2_is_writebuffered(c)) -+ cancel_delayed_work_sync(&c->wbuf_dwork); - #endif - - mutex_lock(&c->alloc_sem); -diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c -index 0a4457fb0711..85111d740c9d 100644 ---- a/fs/ocfs2/localalloc.c -+++ b/fs/ocfs2/localalloc.c -@@ -345,13 +345,18 @@ int ocfs2_load_local_alloc(struct ocfs2_super *osb) - if (num_used - || alloc->id1.bitmap1.i_used - || alloc->id1.bitmap1.i_total -- || la->la_bm_off) -- mlog(ML_ERROR, "Local alloc hasn't been recovered!\n" -+ || la->la_bm_off) { -+ mlog(ML_ERROR, "inconsistent detected, clean journal with" -+ " unrecovered local alloc, please run fsck.ocfs2!\n" - "found = %u, set = %u, taken = %u, off = %u\n", - num_used, le32_to_cpu(alloc->id1.bitmap1.i_used), - le32_to_cpu(alloc->id1.bitmap1.i_total), - OCFS2_LOCAL_ALLOC(alloc)->la_bm_off); - -+ status = -EINVAL; -+ goto bail; -+ } -+ - osb->local_alloc_bh = alloc_bh; - osb->local_alloc_state = OCFS2_LA_ENABLED; - -diff --git a/fs/proc/array.c b/fs/proc/array.c -index cb71cbae606d..60cbaa821164 100644 ---- a/fs/proc/array.c -+++ b/fs/proc/array.c -@@ -333,7 +333,7 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) - #ifdef CONFIG_SECCOMP - seq_printf(m, "Seccomp:\t%d\n", p->seccomp.mode); - #endif -- seq_printf(m, "\nSpeculation_Store_Bypass:\t"); -+ seq_printf(m, "Speculation_Store_Bypass:\t"); - switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { - case -EINVAL: - seq_printf(m, "unknown"); -diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c -index bd21795ce657..679d75a864d0 100644 ---- a/fs/pstore/ram_core.c -+++ b/fs/pstore/ram_core.c -@@ -445,6 +445,11 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig, - sig ^= PERSISTENT_RAM_SIG; - - if (prz->buffer->sig == sig) { -+ if (buffer_size(prz) == 0) { -+ pr_debug("found existing empty buffer\n"); -+ return 0; -+ } -+ - if (buffer_size(prz) > prz->buffer_size || - buffer_start(prz) > buffer_size(prz)) - pr_info("found existing invalid buffer, size %zu, start %zu\n", -diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c -index fb9636cc927c..5d8d12746e6e 100644 ---- a/fs/xfs/libxfs/xfs_attr.c -+++ b/fs/xfs/libxfs/xfs_attr.c -@@ -528,7 +528,14 @@ xfs_attr_shortform_addname(xfs_da_args_t *args) - if (args->flags & ATTR_CREATE) - return retval; - retval = xfs_attr_shortform_remove(args); -- ASSERT(retval == 0); -+ if (retval) -+ return retval; -+ /* -+ * Since we have removed the old attr, clear ATTR_REPLACE so -+ * that the leaf format add routine won't trip over the attr -+ * not being around. -+ */ -+ args->flags &= ~ATTR_REPLACE; - } - - if (args->namelen >= XFS_ATTR_SF_ENTSIZE_MAX || -diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h -index a307c37c2e6c..072501a0ac86 100644 ---- a/include/linux/backing-dev-defs.h -+++ b/include/linux/backing-dev-defs.h -@@ -225,6 +225,14 @@ static inline void wb_get(struct bdi_writeback *wb) - */ - static inline void wb_put(struct bdi_writeback *wb) - { -+ if (WARN_ON_ONCE(!wb->bdi)) { -+ /* -+ * A driver bug might cause a file to be removed before bdi was -+ * initialized. -+ */ -+ return; -+ } -+ - if (wb != &wb->bdi->wb) - percpu_ref_put(&wb->refcnt); - } -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 3309dbda7ffa..0bc7fa21db85 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -2151,6 +2151,7 @@ int write_cache_pages(struct address_space *mapping, - { - int ret = 0; - int done = 0; -+ int error; - struct pagevec pvec; - int nr_pages; - pgoff_t uninitialized_var(writeback_index); -@@ -2247,25 +2248,31 @@ continue_unlock: - goto continue_unlock; - - trace_wbc_writepage(wbc, inode_to_bdi(mapping->host)); -- ret = (*writepage)(page, wbc, data); -- if (unlikely(ret)) { -- if (ret == AOP_WRITEPAGE_ACTIVATE) { -+ error = (*writepage)(page, wbc, data); -+ if (unlikely(error)) { -+ /* -+ * Handle errors according to the type of -+ * writeback. There's no need to continue for -+ * background writeback. Just push done_index -+ * past this page so media errors won't choke -+ * writeout for the entire file. For integrity -+ * writeback, we must process the entire dirty -+ * set regardless of errors because the fs may -+ * still have state to clear for each page. In -+ * that case we continue processing and return -+ * the first error. -+ */ -+ if (error == AOP_WRITEPAGE_ACTIVATE) { - unlock_page(page); -- ret = 0; -- } else { -- /* -- * done_index is set past this page, -- * so media errors will not choke -- * background writeout for the entire -- * file. This has consequences for -- * range_cyclic semantics (ie. it may -- * not be suitable for data integrity -- * writeout). -- */ -+ error = 0; -+ } else if (wbc->sync_mode != WB_SYNC_ALL) { -+ ret = error; - done_index = page->index + 1; - done = 1; - break; - } -+ if (!ret) -+ ret = error; - } - - /* -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 55dcb2b20b59..6def85d75b1d 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -267,7 +267,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_ - struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); - int ret; - -- if (neigh->hh.hh_len) { -+ if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) { - neigh_hh_bridge(&neigh->hh, skb); - skb->dev = nf_bridge->physindev; - ret = br_handle_frame_finish(net, sk, skb); -diff --git a/net/can/gw.c b/net/can/gw.c -index 77c8af4047ef..81650affa3fa 100644 ---- a/net/can/gw.c -+++ b/net/can/gw.c -@@ -418,13 +418,29 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx]) - (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod); - -- /* check for checksum updates when the CAN frame has been modified */ -+ /* Has the CAN frame been modified? */ - if (modidx) { -- if (gwj->mod.csumfunc.crc8) -+ /* get available space for the processed CAN frame type */ -+ int max_len = nskb->len - offsetof(struct can_frame, data); -+ -+ /* dlc may have changed, make sure it fits to the CAN frame */ -+ if (cf->can_dlc > max_len) -+ goto out_delete; -+ -+ /* check for checksum updates in classic CAN length only */ -+ if (gwj->mod.csumfunc.crc8) { -+ if (cf->can_dlc > 8) -+ goto out_delete; -+ - (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8); -+ } -+ -+ if (gwj->mod.csumfunc.xor) { -+ if (cf->can_dlc > 8) -+ goto out_delete; - -- if (gwj->mod.csumfunc.xor) - (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor); -+ } - } - - /* clear the skb timestamp if not configured the other way */ -@@ -436,6 +452,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data) - gwj->dropped_frames++; - else - gwj->handled_frames++; -+ -+ return; -+ -+ out_delete: -+ /* delete frame due to misconfiguration */ -+ gwj->deleted_frames++; -+ kfree_skb(nskb); -+ return; - } - - static inline int cgw_register_filter(struct cgw_job *gwj) -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 9703924ed071..8a57bbaf7452 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2388,12 +2388,15 @@ EXPORT_SYMBOL(skb_queue_purge); - */ - void skb_rbtree_purge(struct rb_root *root) - { -- struct sk_buff *skb, *next; -+ struct rb_node *p = rb_first(root); - -- rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) -- kfree_skb(skb); -+ while (p) { -+ struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); - -- *root = RB_ROOT; -+ p = rb_next(p); -+ rb_erase(&skb->rbnode, root); -+ kfree_skb(skb); -+ } - } - - /** -diff --git a/net/core/sock.c b/net/core/sock.c -index 9fb1c073d0c4..8aa4a5f89572 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -732,6 +732,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, - break; - case SO_DONTROUTE: - sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool); -+ sk_dst_reset(sk); - break; - case SO_BROADCAST: - sock_valbool_flag(sk, SOCK_BROADCAST, valbool); -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 3f8caf7d19b8..1ea36bf778e6 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -133,19 +133,17 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) - - static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) - { -+ __be16 _ports[2], *ports; - struct sockaddr_in sin; -- __be16 *ports; -- int end; -- -- end = skb_transport_offset(skb) + 4; -- if (end > 0 && !pskb_may_pull(skb, end)) -- return; - - /* All current transport protocols have the port numbers in the - * first four bytes of the transport header and this function is - * written with this assumption in mind. - */ -- ports = (__be16 *)skb_transport_header(skb); -+ ports = skb_header_pointer(skb, skb_transport_offset(skb), -+ sizeof(_ports), &_ports); -+ if (!ports) -+ return; - - sin.sin_family = AF_INET; - sin.sin_addr.s_addr = ip_hdr(skb)->daddr; -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 637a0e41b0aa..d6f2dab28d14 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -292,6 +292,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - - /* Check if the address belongs to the host. */ - if (addr_type == IPV6_ADDR_MAPPED) { -+ struct net_device *dev = NULL; - int chk_addr_ret; - - /* Binding to v4-mapped address on a v6-only socket -@@ -302,9 +303,20 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - goto out; - } - -+ rcu_read_lock(); -+ if (sk->sk_bound_dev_if) { -+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if); -+ if (!dev) { -+ err = -ENODEV; -+ goto out_unlock; -+ } -+ } -+ - /* Reproduce AF_INET checks to make the bindings consistent */ - v4addr = addr->sin6_addr.s6_addr32[3]; -- chk_addr_ret = inet_addr_type(net, v4addr); -+ chk_addr_ret = inet_addr_type_dev_table(net, dev, v4addr); -+ rcu_read_unlock(); -+ - if (!net->ipv4.sysctl_ip_nonlocal_bind && - !(inet->freebind || inet->transparent) && - v4addr != htonl(INADDR_ANY) && -diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c -index 9f6e57ded338..27cdf543c539 100644 ---- a/net/ipv6/datagram.c -+++ b/net/ipv6/datagram.c -@@ -290,6 +290,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info) - skb_reset_network_header(skb); - iph = ipv6_hdr(skb); - iph->daddr = fl6->daddr; -+ ip6_flow_hdr(iph, 0, 0); - - serr = SKB_EXT_ERR(skb); - serr->ee.ee_errno = err; -@@ -657,17 +658,15 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg, - } - if (np->rxopt.bits.rxorigdstaddr) { - struct sockaddr_in6 sin6; -- __be16 *ports; -- int end; -+ __be16 _ports[2], *ports; - -- end = skb_transport_offset(skb) + 4; -- if (end <= 0 || pskb_may_pull(skb, end)) { -+ ports = skb_header_pointer(skb, skb_transport_offset(skb), -+ sizeof(_ports), &_ports); -+ if (ports) { - /* All current transport protocols have the port numbers in the - * first four bytes of the transport header and this function is - * written with this assumption in mind. - */ -- ports = (__be16 *)skb_transport_header(skb); -- - sin6.sin6_family = AF_INET6; - sin6.sin6_addr = ipv6_hdr(skb)->daddr; - sin6.sin6_port = ports[1]; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 0f50977ed53b..753b2837318d 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2514,7 +2514,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); - if (addr && dev && saddr->sll_halen < dev->addr_len) -- goto out; -+ goto out_put; - } - - err = -ENXIO; -@@ -2683,7 +2683,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); - if (addr && dev && saddr->sll_halen < dev->addr_len) -- goto out; -+ goto out_unlock; - } - - err = -ENXIO; -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 7dffc97a953c..9fa0b0dc3868 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev, - - switch (ev) { - case NETDEV_UP: -- addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC); -+ addr = kzalloc(sizeof(*addr), GFP_ATOMIC); - if (addr) { - addr->a.v6.sin6_family = AF_INET6; -- addr->a.v6.sin6_port = 0; -- addr->a.v6.sin6_flowinfo = 0; - addr->a.v6.sin6_addr = ifa->addr; - addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex; - addr->valid = 1; -@@ -412,7 +410,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist, - addr = kzalloc(sizeof(*addr), GFP_ATOMIC); - if (addr) { - addr->a.v6.sin6_family = AF_INET6; -- addr->a.v6.sin6_port = 0; - addr->a.v6.sin6_addr = ifp->addr; - addr->a.v6.sin6_scope_id = dev->ifindex; - addr->valid = 1; -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index dc030efa4447..9f2f3c48b7b6 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -151,7 +151,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist, - addr = kzalloc(sizeof(*addr), GFP_ATOMIC); - if (addr) { - addr->a.v4.sin_family = AF_INET; -- addr->a.v4.sin_port = 0; - addr->a.v4.sin_addr.s_addr = ifa->ifa_local; - addr->valid = 1; - INIT_LIST_HEAD(&addr->list); -@@ -775,10 +774,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev, - - switch (ev) { - case NETDEV_UP: -- addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC); -+ addr = kzalloc(sizeof(*addr), GFP_ATOMIC); - if (addr) { - addr->a.v4.sin_family = AF_INET; -- addr->a.v4.sin_port = 0; - addr->a.v4.sin_addr.s_addr = ifa->ifa_local; - addr->valid = 1; - spin_lock_bh(&net->sctp.local_addr_lock); -diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c -index cf5770d8f49a..c89626b2afff 100644 ---- a/net/sunrpc/rpcb_clnt.c -+++ b/net/sunrpc/rpcb_clnt.c -@@ -772,6 +772,12 @@ void rpcb_getport_async(struct rpc_task *task) - case RPCBVERS_3: - map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID]; - map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC); -+ if (!map->r_addr) { -+ status = -ENOMEM; -+ dprintk("RPC: %5u %s: no memory available\n", -+ task->tk_pid, __func__); -+ goto bailout_free_args; -+ } - map->r_owner = ""; - break; - case RPCBVERS_2: -@@ -794,6 +800,8 @@ void rpcb_getport_async(struct rpc_task *task) - rpc_put_task(child); - return; - -+bailout_free_args: -+ kfree(map); - bailout_release_client: - rpc_release_client(rpcb_clnt); - bailout_nofree: -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index f86c6555a539..e9653c42cdd1 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -87,6 +87,11 @@ static int tipc_skb_tailroom(struct sk_buff *skb) - return limit; - } - -+static inline int TLV_GET_DATA_LEN(struct tlv_desc *tlv) -+{ -+ return TLV_GET_LEN(tlv) - TLV_SPACE(0); -+} -+ - static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len) - { - struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(skb); -@@ -166,6 +171,11 @@ static struct sk_buff *tipc_get_err_tlv(char *str) - return buf; - } - -+static inline bool string_is_valid(char *s, int len) -+{ -+ return memchr(s, '\0', len) ? true : false; -+} -+ - static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - struct tipc_nl_compat_msg *msg, - struct sk_buff *arg) -@@ -364,6 +374,7 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd, - struct nlattr *prop; - struct nlattr *bearer; - struct tipc_bearer_config *b; -+ int len; - - b = (struct tipc_bearer_config *)TLV_DATA(msg->req); - -@@ -371,6 +382,10 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd, - if (!bearer) - return -EMSGSIZE; - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); -+ if (!string_is_valid(b->name, len)) -+ return -EINVAL; -+ - if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, b->name)) - return -EMSGSIZE; - -@@ -396,6 +411,7 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, - { - char *name; - struct nlattr *bearer; -+ int len; - - name = (char *)TLV_DATA(msg->req); - -@@ -403,6 +419,10 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, - if (!bearer) - return -EMSGSIZE; - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); -+ if (!string_is_valid(name, len)) -+ return -EINVAL; -+ - if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, name)) - return -EMSGSIZE; - -@@ -462,6 +482,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, - struct nlattr *link[TIPC_NLA_LINK_MAX + 1]; - struct nlattr *prop[TIPC_NLA_PROP_MAX + 1]; - struct nlattr *stats[TIPC_NLA_STATS_MAX + 1]; -+ int len; - - nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK], NULL); - -@@ -472,6 +493,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, - NULL); - - name = (char *)TLV_DATA(msg->req); -+ -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ if (!string_is_valid(name, len)) -+ return -EINVAL; -+ - if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0) - return 0; - -@@ -605,6 +631,7 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb, - struct nlattr *prop; - struct nlattr *media; - struct tipc_link_config *lc; -+ int len; - - lc = (struct tipc_link_config *)TLV_DATA(msg->req); - -@@ -612,6 +639,10 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb, - if (!media) - return -EMSGSIZE; - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME); -+ if (!string_is_valid(lc->name, len)) -+ return -EINVAL; -+ - if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name)) - return -EMSGSIZE; - -@@ -632,6 +663,7 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb, - struct nlattr *prop; - struct nlattr *bearer; - struct tipc_link_config *lc; -+ int len; - - lc = (struct tipc_link_config *)TLV_DATA(msg->req); - -@@ -639,6 +671,10 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb, - if (!bearer) - return -EMSGSIZE; - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME); -+ if (!string_is_valid(lc->name, len)) -+ return -EINVAL; -+ - if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name)) - return -EMSGSIZE; - -@@ -687,9 +723,14 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd, - struct tipc_link_config *lc; - struct tipc_bearer *bearer; - struct tipc_media *media; -+ int len; - - lc = (struct tipc_link_config *)TLV_DATA(msg->req); - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ if (!string_is_valid(lc->name, len)) -+ return -EINVAL; -+ - media = tipc_media_find(lc->name); - if (media) { - cmd->doit = &tipc_nl_media_set; -@@ -711,6 +752,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, - { - char *name; - struct nlattr *link; -+ int len; - - name = (char *)TLV_DATA(msg->req); - -@@ -718,6 +760,10 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, - if (!link) - return -EMSGSIZE; - -+ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ if (!string_is_valid(name, len)) -+ return -EINVAL; -+ - if (nla_put_string(skb, TIPC_NLA_LINK_NAME, name)) - return -EMSGSIZE; - -@@ -739,6 +785,8 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg) - }; - - ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req); -+ if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query)) -+ return -EINVAL; - - depth = ntohl(ntq->depth); - -@@ -1117,7 +1165,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info) - } - - len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN); -- if (len && !TLV_OK(msg.req, len)) { -+ if (!len || !TLV_OK(msg.req, len)) { - msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED); - err = -EOPNOTSUPP; - goto send; -diff --git a/scripts/kconfig/zconf.l b/scripts/kconfig/zconf.l -index c410d257da06..0c7800112ff5 100644 ---- a/scripts/kconfig/zconf.l -+++ b/scripts/kconfig/zconf.l -@@ -71,7 +71,7 @@ static void warn_ignored_character(char chr) - { - fprintf(stderr, - "%s:%d:warning: ignoring unsupported character '%c'\n", -- zconf_curname(), zconf_lineno(), chr); -+ current_file->name, yylineno, chr); - } - %} - -@@ -191,6 +191,8 @@ n [A-Za-z0-9_-] - } - <> { - BEGIN(INITIAL); -+ yylval.string = text; -+ return T_WORD_QUOTE; - } - } - -diff --git a/security/security.c b/security/security.c -index 46f405ce6b0f..0dde287db5c5 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -861,6 +861,13 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) - - void security_cred_free(struct cred *cred) - { -+ /* -+ * There is a failure case in prepare_creds() that -+ * may result in a call here with ->security being NULL. -+ */ -+ if (unlikely(cred->security == NULL)) -+ return; -+ - call_void_hook(cred_free, cred); - } - -diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c -index 992a31530825..965a55eacaba 100644 ---- a/security/selinux/ss/policydb.c -+++ b/security/selinux/ss/policydb.c -@@ -726,7 +726,8 @@ static int sens_destroy(void *key, void *datum, void *p) - kfree(key); - if (datum) { - levdatum = datum; -- ebitmap_destroy(&levdatum->level->cat); -+ if (levdatum->level) -+ ebitmap_destroy(&levdatum->level->cat); - kfree(levdatum->level); - } - kfree(datum); -diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c -index cb6ed10816d4..0a8808954bd8 100644 ---- a/security/yama/yama_lsm.c -+++ b/security/yama/yama_lsm.c -@@ -288,7 +288,9 @@ static int yama_ptrace_access_check(struct task_struct *child, - break; - case YAMA_SCOPE_RELATIONAL: - rcu_read_lock(); -- if (!task_is_descendant(current, child) && -+ if (!pid_alive(child)) -+ rc = -EPERM; -+ if (!rc && !task_is_descendant(current, child) && - !ptracer_exception_found(current, child) && - !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) - rc = -EPERM; -diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c -index 091290d1f3ea..1898fa4228ad 100644 ---- a/sound/firewire/bebob/bebob.c -+++ b/sound/firewire/bebob/bebob.c -@@ -382,7 +382,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { - /* Apogee Electronics, DA/AD/DD-16X (X-FireWire card) */ - SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00010048, &spec_normal), - /* Apogee Electronics, Ensemble */ -- SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00001eee, &spec_normal), -+ SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x01eeee, &spec_normal), - /* ESI, Quatafire610 */ - SND_BEBOB_DEV_ENTRY(VEN_ESI, 0x00010064, &spec_normal), - /* AcousticReality, eARMasterOne */ -diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c -index c53f78767568..df21da796fa7 100644 ---- a/tools/perf/arch/x86/util/intel-pt.c -+++ b/tools/perf/arch/x86/util/intel-pt.c -@@ -471,10 +471,21 @@ static int intel_pt_validate_config(struct perf_pmu *intel_pt_pmu, - struct perf_evsel *evsel) - { - int err; -+ char c; - - if (!evsel) - return 0; - -+ /* -+ * If supported, force pass-through config term (pt=1) even if user -+ * sets pt=0, which avoids senseless kernel errors. -+ */ -+ if (perf_pmu__scan_file(intel_pt_pmu, "format/pt", "%c", &c) == 1 && -+ !(evsel->attr.config & 1)) { -+ pr_warning("pt=0 doesn't make sense, forcing pt=1\n"); -+ evsel->attr.config |= 1; -+ } -+ - err = intel_pt_val_config_term(intel_pt_pmu, "caps/cycle_thresholds", - "cyc_thresh", "caps/psb_cyc", - evsel->attr.config); -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index e81dfb2e239c..9351738df703 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -1903,7 +1903,7 @@ restart: - if (!name_only && strlen(syms->alias)) - snprintf(name, MAX_NAME_LEN, "%s OR %s", syms->symbol, syms->alias); - else -- strncpy(name, syms->symbol, MAX_NAME_LEN); -+ strlcpy(name, syms->symbol, MAX_NAME_LEN); - - evt_list[evt_i] = strdup(name); - if (evt_list[evt_i] == NULL) -diff --git a/tools/perf/util/svghelper.c b/tools/perf/util/svghelper.c -index eec6c1149f44..132878d4847a 100644 ---- a/tools/perf/util/svghelper.c -+++ b/tools/perf/util/svghelper.c -@@ -333,7 +333,7 @@ static char *cpu_model(void) - if (file) { - while (fgets(buf, 255, file)) { - if (strstr(buf, "model name")) { -- strncpy(cpu_m, &buf[13], 255); -+ strlcpy(cpu_m, &buf[13], 255); - break; - } - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.172-173.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.172-173.patch deleted file mode 100644 index 487b0a9225e9..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.172-173.patch +++ /dev/null @@ -1,1690 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2aa8db459a74..db7665e32da8 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 172 -+SUBLEVEL = 173 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h -index 5f071762fb1c..6a2ae61748e4 100644 ---- a/arch/arc/include/asm/perf_event.h -+++ b/arch/arc/include/asm/perf_event.h -@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = { - - /* counts condition */ - [PERF_COUNT_HW_INSTRUCTIONS] = "iall", -- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */ -+ /* All jump instructions that are taken */ -+ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak", - [PERF_COUNT_ARC_BPOK] = "bpok", /* NP-NT, PT-T, PNT-NT */ - #ifdef CONFIG_ISA_ARCV2 - [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp", -diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c -index 318394ed5c7a..5e11ad3164e0 100644 ---- a/arch/arm/mach-cns3xxx/pcie.c -+++ b/arch/arm/mach-cns3xxx/pcie.c -@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus, - } else /* remote PCI bus */ - base = cnspci->cfg1_regs + ((busno & 0xf) << 20); - -- return base + (where & 0xffc) + (devfn << 12); -+ return base + where + (devfn << 12); - } - - static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn, -diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S -index a272f335c289..096e957aecb0 100644 ---- a/arch/arm64/kernel/hyp-stub.S -+++ b/arch/arm64/kernel/hyp-stub.S -@@ -26,6 +26,8 @@ - #include - - .text -+ .pushsection .hyp.text, "ax" -+ - .align 11 - - ENTRY(__hyp_stub_vectors) -diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c -index c26b804015e8..a90615baa529 100644 ---- a/arch/arm64/mm/flush.c -+++ b/arch/arm64/mm/flush.c -@@ -70,10 +70,6 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr) - { - struct page *page = pte_page(pte); - -- /* no flushing needed for anonymous pages */ -- if (!page_mapping(page)) -- return; -- - if (!test_and_set_bit(PG_dcache_clean, &page->flags)) - sync_icache_aliases(page_address(page), - PAGE_SIZE << compound_order(page)); -diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c -index 8eccead675d4..cc7b450a7766 100644 ---- a/arch/s390/kernel/early.c -+++ b/arch/s390/kernel/early.c -@@ -224,10 +224,10 @@ static noinline __init void detect_machine_type(void) - if (stsi(vmms, 3, 2, 2) || !vmms->count) - return; - -- /* Running under KVM? If not we assume z/VM */ -+ /* Detect known hypervisors */ - if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3)) - S390_lowcore.machine_flags |= MACHINE_FLAG_KVM; -- else -+ else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4)) - S390_lowcore.machine_flags |= MACHINE_FLAG_VM; - } - -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index e7a43a30e3ff..47692c78d09c 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -833,6 +833,8 @@ void __init setup_arch(char **cmdline_p) - pr_info("Linux is running under KVM in 64-bit mode\n"); - else if (MACHINE_IS_LPAR) - pr_info("Linux is running natively in 64-bit mode\n"); -+ else -+ pr_info("Linux is running as a guest in 64-bit mode\n"); - - /* Have one command line that is parsed and saved in /proc/cmdline */ - /* boot_command_line has been already set up in early.c */ -diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c -index 77f4f334a465..29e5409c0d48 100644 ---- a/arch/s390/kernel/smp.c -+++ b/arch/s390/kernel/smp.c -@@ -360,9 +360,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data) - */ - void smp_call_ipl_cpu(void (*func)(void *), void *data) - { -+ struct _lowcore *lc = pcpu_devices->lowcore; -+ -+ if (pcpu_devices[0].address == stap()) -+ lc = &S390_lowcore; -+ - pcpu_delegate(&pcpu_devices[0], func, data, -- pcpu_devices->lowcore->panic_stack - -- PANIC_FRAME_OFFSET + PAGE_SIZE); -+ lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE); - } - - int smp_find_processor_id(u16 address) -@@ -1152,7 +1156,11 @@ static ssize_t __ref rescan_store(struct device *dev, - { - int rc; - -+ rc = lock_device_hotplug_sysfs(); -+ if (rc) -+ return rc; - rc = smp_rescan_cpus(); -+ unlock_device_hotplug(); - return rc ? rc : count; - } - static DEVICE_ATTR(rescan, 0200, NULL, rescan_store); -diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c -index 31dab2135188..21332b431f10 100644 ---- a/arch/x86/boot/compressed/aslr.c -+++ b/arch/x86/boot/compressed/aslr.c -@@ -25,8 +25,8 @@ static inline u16 i8254(void) - u16 status, timer; - - do { -- outb(I8254_PORT_CONTROL, -- I8254_CMD_READBACK | I8254_SELECT_COUNTER0); -+ outb(I8254_CMD_READBACK | I8254_SELECT_COUNTER0, -+ I8254_PORT_CONTROL); - status = inb(I8254_PORT_COUNTER0); - timer = inb(I8254_PORT_COUNTER0); - timer |= inb(I8254_PORT_COUNTER0) << 8; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 1a934bb8ed1c..758e2b39567d 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5524,8 +5524,7 @@ restart: - toggle_interruptibility(vcpu, ctxt->interruptibility); - vcpu->arch.emulate_regs_need_sync_to_vcpu = false; - kvm_rip_write(vcpu, ctxt->eip); -- if (r == EMULATE_DONE && -- (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) -+ if (r == EMULATE_DONE && ctxt->tf) - kvm_vcpu_do_singlestep(vcpu, &r); - if (!ctxt->have_exception || - exception_type(ctxt->exception.vector) == EXCPT_TRAP) -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 049ccc070ce5..cb5718d2669e 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -862,6 +862,8 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) - return; - - mutex_lock(&gdp_mutex); -+ if (!kobject_has_children(glue_dir)) -+ kobject_del(glue_dir); - kobject_put(glue_dir); - mutex_unlock(&gdp_mutex); - } -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index b1cf891cb3d9..ae361ee90587 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -81,6 +81,7 @@ - #include - - static DEFINE_IDR(loop_index_idr); -+static DEFINE_MUTEX(loop_index_mutex); - static DEFINE_MUTEX(loop_ctl_mutex); - - static int max_part; -@@ -1570,11 +1571,9 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, - static int lo_open(struct block_device *bdev, fmode_t mode) - { - struct loop_device *lo; -- int err; -+ int err = 0; - -- err = mutex_lock_killable(&loop_ctl_mutex); -- if (err) -- return err; -+ mutex_lock(&loop_index_mutex); - lo = bdev->bd_disk->private_data; - if (!lo) { - err = -ENXIO; -@@ -1583,20 +1582,18 @@ static int lo_open(struct block_device *bdev, fmode_t mode) - - atomic_inc(&lo->lo_refcnt); - out: -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&loop_index_mutex); - return err; - } - --static void lo_release(struct gendisk *disk, fmode_t mode) -+static void __lo_release(struct loop_device *lo) - { -- struct loop_device *lo; - int err; - -- mutex_lock(&loop_ctl_mutex); -- lo = disk->private_data; - if (atomic_dec_return(&lo->lo_refcnt)) -- goto out_unlock; -+ return; - -+ mutex_lock(&loop_ctl_mutex); - if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { - /* - * In autoclear mode, stop the loop thread -@@ -1613,10 +1610,16 @@ static void lo_release(struct gendisk *disk, fmode_t mode) - loop_flush(lo); - } - --out_unlock: - mutex_unlock(&loop_ctl_mutex); - } - -+static void lo_release(struct gendisk *disk, fmode_t mode) -+{ -+ mutex_lock(&loop_index_mutex); -+ __lo_release(disk->private_data); -+ mutex_unlock(&loop_index_mutex); -+} -+ - static const struct block_device_operations lo_fops = { - .owner = THIS_MODULE, - .open = lo_open, -@@ -1896,7 +1899,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) - struct kobject *kobj; - int err; - -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&loop_index_mutex); - err = loop_lookup(&lo, MINOR(dev) >> part_shift); - if (err < 0) - err = loop_add(&lo, MINOR(dev) >> part_shift); -@@ -1904,7 +1907,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data) - kobj = NULL; - else - kobj = get_disk(lo->lo_disk); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&loop_index_mutex); - - *part = 0; - return kobj; -@@ -1914,13 +1917,9 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - unsigned long parm) - { - struct loop_device *lo; -- int ret; -- -- ret = mutex_lock_killable(&loop_ctl_mutex); -- if (ret) -- return ret; -+ int ret = -ENOSYS; - -- ret = -ENOSYS; -+ mutex_lock(&loop_index_mutex); - switch (cmd) { - case LOOP_CTL_ADD: - ret = loop_lookup(&lo, parm); -@@ -1934,15 +1933,19 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - ret = loop_lookup(&lo, parm); - if (ret < 0) - break; -+ mutex_lock(&loop_ctl_mutex); - if (lo->lo_state != Lo_unbound) { - ret = -EBUSY; -+ mutex_unlock(&loop_ctl_mutex); - break; - } - if (atomic_read(&lo->lo_refcnt) > 0) { - ret = -EBUSY; -+ mutex_unlock(&loop_ctl_mutex); - break; - } - lo->lo_disk->private_data = NULL; -+ mutex_unlock(&loop_ctl_mutex); - idr_remove(&loop_index_idr, lo->lo_number); - loop_remove(lo); - break; -@@ -1952,7 +1955,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - break; - ret = loop_add(&lo, -1); - } -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&loop_index_mutex); - - return ret; - } -@@ -2035,10 +2038,10 @@ static int __init loop_init(void) - THIS_MODULE, loop_probe, NULL, NULL); - - /* pre-create number of devices given by config or max_loop */ -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&loop_index_mutex); - for (i = 0; i < nr; i++) - loop_add(&lo, i); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&loop_index_mutex); - - printk(KERN_INFO "loop: module loaded\n"); - return 0; -diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c -index 164544afd680..618f3df6c3b9 100644 ---- a/drivers/char/mwave/mwavedd.c -+++ b/drivers/char/mwave/mwavedd.c -@@ -59,6 +59,7 @@ - #include - #include - #include -+#include - #include "smapi.h" - #include "mwavedd.h" - #include "3780i.h" -@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, - ipcnum); - return -EINVAL; - } -+ ipcnum = array_index_nospec(ipcnum, -+ ARRAY_SIZE(pDrvData->IPCs)); - PRINTK_3(TRACE_MWAVE, - "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC" - " ipcnum %x entry usIntCount %x\n", -@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, - " Invalid ipcnum %x\n", ipcnum); - return -EINVAL; - } -+ ipcnum = array_index_nospec(ipcnum, -+ ARRAY_SIZE(pDrvData->IPCs)); - PRINTK_3(TRACE_MWAVE, - "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC" - " ipcnum %x, usIntCount %x\n", -@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd, - ipcnum); - return -EINVAL; - } -+ ipcnum = array_index_nospec(ipcnum, -+ ARRAY_SIZE(pDrvData->IPCs)); - mutex_lock(&mwave_mutex); - if (pDrvData->IPCs[ipcnum].bIsEnabled == TRUE) { - pDrvData->IPCs[ipcnum].bIsEnabled = FALSE; -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index f55dcdf99bc5..26476a64e663 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -255,6 +255,8 @@ static const struct xpad_device { - { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, - { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, - { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, -+ { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, -+ { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, - { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, - { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, -@@ -431,6 +433,7 @@ static const struct usb_device_id xpad_table[] = { - XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */ - XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ - XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ -+ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ - XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ - XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ - XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ -diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c -index c3d7a1461043..114d5883d497 100644 ---- a/drivers/irqchip/irq-gic-v3-its.c -+++ b/drivers/irqchip/irq-gic-v3-its.c -@@ -1230,13 +1230,14 @@ static void its_free_device(struct its_device *its_dev) - kfree(its_dev); - } - --static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq) -+static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq) - { - int idx; - -- idx = find_first_zero_bit(dev->event_map.lpi_map, -- dev->event_map.nr_lpis); -- if (idx == dev->event_map.nr_lpis) -+ idx = bitmap_find_free_region(dev->event_map.lpi_map, -+ dev->event_map.nr_lpis, -+ get_count_order(nvecs)); -+ if (idx < 0) - return -ENOSPC; - - *hwirq = dev->event_map.lpi_base + idx; -@@ -1317,20 +1318,20 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, - int err; - int i; - -- for (i = 0; i < nr_irqs; i++) { -- err = its_alloc_device_irq(its_dev, &hwirq); -- if (err) -- return err; -+ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq); -+ if (err) -+ return err; - -- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq); -+ for (i = 0; i < nr_irqs; i++) { -+ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i); - if (err) - return err; - - irq_domain_set_hwirq_and_chip(domain, virq + i, -- hwirq, &its_irq_chip, its_dev); -+ hwirq + i, &its_irq_chip, its_dev); - pr_debug("ID:%d pID:%d vID:%d\n", -- (int)(hwirq - its_dev->event_map.lpi_base), -- (int) hwirq, virq + i); -+ (int)(hwirq + i - its_dev->event_map.lpi_base), -+ (int)(hwirq + i), virq + i); - } - - return 0; -diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c -index ffd448149796..4a2ae06d0da4 100644 ---- a/drivers/mmc/host/sdhci-iproc.c -+++ b/drivers/mmc/host/sdhci-iproc.c -@@ -217,7 +217,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev) - - iproc_host->data = iproc_data; - -- mmc_of_parse(host->mmc); -+ ret = mmc_of_parse(host->mmc); -+ if (ret) -+ goto err; -+ - sdhci_get_of_property(pdev); - - /* Enable EMMC 1/8V DDR capable */ -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 1dbee1cb3df9..8b7c6425b681 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -426,8 +426,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); - struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) - { - struct can_priv *priv = netdev_priv(dev); -- struct sk_buff *skb = priv->echo_skb[idx]; -- struct canfd_frame *cf; - - if (idx >= priv->echo_skb_max) { - netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", -@@ -435,20 +433,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 - return NULL; - } - -- if (!skb) { -- netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", -- __func__, idx); -- return NULL; -- } -+ if (priv->echo_skb[idx]) { -+ /* Using "struct canfd_frame::len" for the frame -+ * length is supported on both CAN and CANFD frames. -+ */ -+ struct sk_buff *skb = priv->echo_skb[idx]; -+ struct canfd_frame *cf = (struct canfd_frame *)skb->data; -+ u8 len = cf->len; -+ -+ *len_ptr = len; -+ priv->echo_skb[idx] = NULL; - -- /* Using "struct canfd_frame::len" for the frame -- * length is supported on both CAN and CANFD frames. -- */ -- cf = (struct canfd_frame *)skb->data; -- *len_ptr = cf->len; -- priv->echo_skb[idx] = NULL; -+ return skb; -+ } - -- return skb; -+ return NULL; - } - - /* -diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c -index 650f7888e32b..55ac00055977 100644 ---- a/drivers/net/ethernet/freescale/ucc_geth.c -+++ b/drivers/net/ethernet/freescale/ucc_geth.c -@@ -1888,6 +1888,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth) - u16 i, j; - u8 __iomem *bd; - -+ netdev_reset_queue(ugeth->ndev); -+ - ug_info = ugeth->ug_info; - uf_info = &ug_info->uf_info; - -diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c -index 90db94e83fde..033f99d2f15c 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/fw.c -+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c -@@ -1906,9 +1906,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, - { - struct mlx4_cmd_mailbox *mailbox; - __be32 *outbox; -+ u64 qword_field; - u32 dword_field; -- int err; -+ u16 word_field; - u8 byte_field; -+ int err; - static const u8 a0_dmfs_query_hw_steering[] = { - [0] = MLX4_STEERING_DMFS_A0_DEFAULT, - [1] = MLX4_STEERING_DMFS_A0_DYNAMIC, -@@ -1936,19 +1938,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, - - /* QPC/EEC/CQC/EQC/RDMARC attributes */ - -- MLX4_GET(param->qpc_base, outbox, INIT_HCA_QPC_BASE_OFFSET); -- MLX4_GET(param->log_num_qps, outbox, INIT_HCA_LOG_QP_OFFSET); -- MLX4_GET(param->srqc_base, outbox, INIT_HCA_SRQC_BASE_OFFSET); -- MLX4_GET(param->log_num_srqs, outbox, INIT_HCA_LOG_SRQ_OFFSET); -- MLX4_GET(param->cqc_base, outbox, INIT_HCA_CQC_BASE_OFFSET); -- MLX4_GET(param->log_num_cqs, outbox, INIT_HCA_LOG_CQ_OFFSET); -- MLX4_GET(param->altc_base, outbox, INIT_HCA_ALTC_BASE_OFFSET); -- MLX4_GET(param->auxc_base, outbox, INIT_HCA_AUXC_BASE_OFFSET); -- MLX4_GET(param->eqc_base, outbox, INIT_HCA_EQC_BASE_OFFSET); -- MLX4_GET(param->log_num_eqs, outbox, INIT_HCA_LOG_EQ_OFFSET); -- MLX4_GET(param->num_sys_eqs, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET); -- MLX4_GET(param->rdmarc_base, outbox, INIT_HCA_RDMARC_BASE_OFFSET); -- MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET); -+ MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET); -+ param->qpc_base = qword_field & ~((u64)0x1f); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET); -+ param->log_num_qps = byte_field & 0x1f; -+ MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET); -+ param->srqc_base = qword_field & ~((u64)0x1f); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET); -+ param->log_num_srqs = byte_field & 0x1f; -+ MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET); -+ param->cqc_base = qword_field & ~((u64)0x1f); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET); -+ param->log_num_cqs = byte_field & 0x1f; -+ MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET); -+ param->altc_base = qword_field; -+ MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET); -+ param->auxc_base = qword_field; -+ MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET); -+ param->eqc_base = qword_field & ~((u64)0x1f); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET); -+ param->log_num_eqs = byte_field & 0x1f; -+ MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET); -+ param->num_sys_eqs = word_field & 0xfff; -+ MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET); -+ param->rdmarc_base = qword_field & ~((u64)0x1f); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET); -+ param->log_rd_per_qp = byte_field & 0x7; - - MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET); - if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) { -@@ -1967,22 +1982,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, - /* steering attributes */ - if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) { - MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET); -- MLX4_GET(param->log_mc_entry_sz, outbox, -- INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET); -- MLX4_GET(param->log_mc_table_sz, outbox, -- INIT_HCA_FS_LOG_TABLE_SZ_OFFSET); -- MLX4_GET(byte_field, outbox, -- INIT_HCA_FS_A0_OFFSET); -+ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET); -+ param->log_mc_entry_sz = byte_field & 0x1f; -+ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET); -+ param->log_mc_table_sz = byte_field & 0x1f; -+ MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET); - param->dmfs_high_steer_mode = - a0_dmfs_query_hw_steering[(byte_field >> 6) & 3]; - } else { - MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET); -- MLX4_GET(param->log_mc_entry_sz, outbox, -- INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET); -- MLX4_GET(param->log_mc_hash_sz, outbox, -- INIT_HCA_LOG_MC_HASH_SZ_OFFSET); -- MLX4_GET(param->log_mc_table_sz, outbox, -- INIT_HCA_LOG_MC_TABLE_SZ_OFFSET); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET); -+ param->log_mc_entry_sz = byte_field & 0x1f; -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET); -+ param->log_mc_hash_sz = byte_field & 0x1f; -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET); -+ param->log_mc_table_sz = byte_field & 0x1f; - } - - /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */ -@@ -2006,15 +2020,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev, - /* TPT attributes */ - - MLX4_GET(param->dmpt_base, outbox, INIT_HCA_DMPT_BASE_OFFSET); -- MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET); -- MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET); -+ MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET); -+ param->mw_enabled = byte_field >> 7; -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET); -+ param->log_mpt_sz = byte_field & 0x3f; - MLX4_GET(param->mtt_base, outbox, INIT_HCA_MTT_BASE_OFFSET); - MLX4_GET(param->cmpt_base, outbox, INIT_HCA_CMPT_BASE_OFFSET); - - /* UAR attributes */ - - MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET); -- MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET); -+ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET); -+ param->log_uar_sz = byte_field & 0xf; - - /* phv_check enable */ - MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET); -diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c -index 583d50f80b24..02327e6c4819 100644 ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -442,6 +442,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, - if (pskb_trim_rcsum(skb, len)) - goto drop; - -+ ph = pppoe_hdr(skb); - pn = pppoe_pernet(dev_net(dev)); - - /* Note that get_item does a sock_hold(), so sk_pppox(po) -diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c -index 852d2de7f69f..a284a2b42bcd 100644 ---- a/drivers/platform/x86/asus-nb-wmi.c -+++ b/drivers/platform/x86/asus-nb-wmi.c -@@ -339,8 +339,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { - { KE_KEY, 0x30, { KEY_VOLUMEUP } }, - { KE_KEY, 0x31, { KEY_VOLUMEDOWN } }, - { KE_KEY, 0x32, { KEY_MUTE } }, -- { KE_KEY, 0x33, { KEY_DISPLAYTOGGLE } }, /* LCD on */ -- { KE_KEY, 0x34, { KEY_DISPLAY_OFF } }, /* LCD off */ -+ { KE_KEY, 0x35, { KEY_SCREENLOCK } }, - { KE_KEY, 0x40, { KEY_PREVIOUSSONG } }, - { KE_KEY, 0x41, { KEY_NEXTSONG } }, - { KE_KEY, 0x43, { KEY_STOPCD } }, /* Stop/Eject */ -diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c -index 944156207477..dcb949dcfa66 100644 ---- a/drivers/s390/char/sclp_config.c -+++ b/drivers/s390/char/sclp_config.c -@@ -43,7 +43,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work) - - static void __ref sclp_cpu_change_notify(struct work_struct *work) - { -+ lock_device_hotplug(); - smp_rescan_cpus(); -+ unlock_device_hotplug(); - } - - static void sclp_conf_receiver_fn(struct evbuf_header *evbuf) -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index c2d2c17550a7..951f22265105 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { - {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ - {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ - {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ -+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ - {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ - {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ - {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ -diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c -index 6d1e2f746ab4..8d6253903f24 100644 ---- a/drivers/tty/n_hdlc.c -+++ b/drivers/tty/n_hdlc.c -@@ -598,6 +598,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, - /* too large for caller's buffer */ - ret = -EOVERFLOW; - } else { -+ __set_current_state(TASK_RUNNING); - if (copy_to_user(buf, rbuf->buf, rbuf->count)) - ret = -EFAULT; - else -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index c1cff2b455ae..5b86ebc76a8a 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -2297,7 +2297,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p) - return -EFAULT; - tty_audit_tiocsti(tty, ch); - ld = tty_ldisc_ref_wait(tty); -- ld->ops->receive_buf(tty, &ch, &mbz, 1); -+ if (ld->ops->receive_buf) -+ ld->ops->receive_buf(tty, &ch, &mbz, 1); - tty_ldisc_deref(ld); - return 0; - } -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index ff3286fc22d8..6779f733bb83 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -958,6 +958,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (CON_IS_VISIBLE(vc)) - update_screen(vc); - vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num); -+ notify_update(vc); - return err; - } - -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 4966768d3c98..9706d214c409 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -47,6 +47,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, -+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) }, - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, - { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index a84f0959ab34..d84c3b3d477b 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -13,6 +13,7 @@ - - #define PL2303_VENDOR_ID 0x067b - #define PL2303_PRODUCT_ID 0x2303 -+#define PL2303_PRODUCT_ID_TB 0x2304 - #define PL2303_PRODUCT_ID_RSAQ2 0x04bb - #define PL2303_PRODUCT_ID_DCU11 0x1234 - #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 -@@ -25,6 +26,7 @@ - #define PL2303_PRODUCT_ID_MOTOROLA 0x0307 - #define PL2303_PRODUCT_ID_ZTEK 0xe1f1 - -+ - #define ATEN_VENDOR_ID 0x0557 - #define ATEN_VENDOR_ID2 0x0547 - #define ATEN_PRODUCT_ID 0x2008 -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index 6d6acf2c07c3..511242111403 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -88,7 +88,8 @@ DEVICE(moto_modem, MOTO_IDS); - /* Motorola Tetra driver */ - #define MOTOROLA_TETRA_IDS() \ - { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \ -- { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */ -+ { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \ -+ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ - DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); - - /* Novatel Wireless GPS driver */ -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 1eeb4780c3ed..eacf57c24ca9 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -48,6 +48,7 @@ - #include "cifs_unicode.h" - #include "cifs_debug.h" - #include "cifs_fs_sb.h" -+#include "dns_resolve.h" - #include "ntlmssp.h" - #include "nterr.h" - #include "rfc1002pdu.h" -@@ -303,6 +304,53 @@ static void cifs_prune_tlinks(struct work_struct *work); - static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data, - const char *devname); - -+/* -+ * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may -+ * get their ip addresses changed at some point. -+ * -+ * This should be called with server->srv_mutex held. -+ */ -+#ifdef CONFIG_CIFS_DFS_UPCALL -+static int reconn_set_ipaddr(struct TCP_Server_Info *server) -+{ -+ int rc; -+ int len; -+ char *unc, *ipaddr = NULL; -+ -+ if (!server->hostname) -+ return -EINVAL; -+ -+ len = strlen(server->hostname) + 3; -+ -+ unc = kmalloc(len, GFP_KERNEL); -+ if (!unc) { -+ cifs_dbg(FYI, "%s: failed to create UNC path\n", __func__); -+ return -ENOMEM; -+ } -+ snprintf(unc, len, "\\\\%s", server->hostname); -+ -+ rc = dns_resolve_server_name_to_ip(unc, &ipaddr); -+ kfree(unc); -+ -+ if (rc < 0) { -+ cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n", -+ __func__, server->hostname, rc); -+ return rc; -+ } -+ -+ rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr, -+ strlen(ipaddr)); -+ kfree(ipaddr); -+ -+ return !rc ? -1 : 0; -+} -+#else -+static inline int reconn_set_ipaddr(struct TCP_Server_Info *server) -+{ -+ return 0; -+} -+#endif -+ - /* - * cifs tcp session reconnection - * -@@ -400,6 +448,11 @@ cifs_reconnect(struct TCP_Server_Info *server) - rc = generic_ip_connect(server); - if (rc) { - cifs_dbg(FYI, "reconnect error %d\n", rc); -+ rc = reconn_set_ipaddr(server); -+ if (rc) { -+ cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n", -+ __func__, rc); -+ } - mutex_unlock(&server->srv_mutex); - msleep(3000); - } else { -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 2725085a3f9f..eae3cdffaf7f 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -143,14 +143,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size, - - scredits = server->credits; - /* can deadlock with reopen */ -- if (scredits == 1) { -+ if (scredits <= 8) { - *num = SMB2_MAX_BUFFER_SIZE; - *credits = 0; - break; - } - -- /* leave one credit for a possible reopen */ -- scredits--; -+ /* leave some credits for reopen and other ops */ -+ scredits -= 8; - *num = min_t(unsigned int, size, - scredits * SMB2_MAX_BUFFER_SIZE); - -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index f7111bb88ec1..5e21d58c49ef 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -2523,8 +2523,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, - if (rc == -ENODATA && rsp->hdr.Status == STATUS_NO_MORE_FILES) { - srch_inf->endOfSearch = true; - rc = 0; -- } -- cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); -+ } else -+ cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE); - goto qdir_exit; - } - -diff --git a/fs/dcache.c b/fs/dcache.c -index 141651b0c766..9ffe60702299 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1155,15 +1155,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item, - */ - void shrink_dcache_sb(struct super_block *sb) - { -- long freed; -- - do { - LIST_HEAD(dispose); - -- freed = list_lru_walk(&sb->s_dentry_lru, -+ list_lru_walk(&sb->s_dentry_lru, - dentry_lru_isolate_shrink, &dispose, 1024); -- -- this_cpu_sub(nr_dentry_unused, freed); - shrink_dentry_list(&dispose); - cond_resched(); - } while (list_lru_count(&sb->s_dentry_lru) > 0); -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 3685fea62333..582373849332 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -590,6 +590,7 @@ static void truncate_node(struct dnode_of_data *dn) - { - struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); - struct node_info ni; -+ pgoff_t index; - - get_node_info(sbi, dn->nid, &ni); - if (dn->inode->i_blocks == 0) { -@@ -613,10 +614,11 @@ invalidate: - clear_node_page_dirty(dn->node_page); - set_sbi_flag(sbi, SBI_IS_DIRTY); - -+ index = dn->node_page->index; - f2fs_put_page(dn->node_page, 1); - - invalidate_mapping_pages(NODE_MAPPING(sbi), -- dn->node_page->index, dn->node_page->index); -+ index, index); - - dn->node_page = NULL; - trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr); -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index 763fe7737065..ef24894edecc 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -1720,9 +1720,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, - goto next_iter; - } - if (ret == -E2BIG) { -- n += rbm->bii - initial_bii; - rbm->bii = 0; - rbm->offset = 0; -+ n += (rbm->bii - initial_bii); - goto res_covered_end_of_rgrp; - } - return ret; -diff --git a/fs/read_write.c b/fs/read_write.c -index bfd1a5dddf6e..16e554ba885d 100644 ---- a/fs/read_write.c -+++ b/fs/read_write.c -@@ -363,8 +363,10 @@ ssize_t vfs_iter_write(struct file *file, struct iov_iter *iter, loff_t *ppos) - iter->type |= WRITE; - ret = file->f_op->write_iter(&kiocb, iter); - BUG_ON(ret == -EIOCBQUEUED); -- if (ret > 0) -+ if (ret > 0) { - *ppos = kiocb.ki_pos; -+ fsnotify_modify(file); -+ } - return ret; - } - EXPORT_SYMBOL(vfs_iter_write); -diff --git a/fs/super.c b/fs/super.c -index 09b526a50986..b9cd7982f6e2 100644 ---- a/fs/super.c -+++ b/fs/super.c -@@ -118,13 +118,23 @@ static unsigned long super_cache_count(struct shrinker *shrink, - sb = container_of(shrink, struct super_block, s_shrink); - - /* -- * Don't call trylock_super as it is a potential -- * scalability bottleneck. The counts could get updated -- * between super_cache_count and super_cache_scan anyway. -- * Call to super_cache_count with shrinker_rwsem held -- * ensures the safety of call to list_lru_shrink_count() and -- * s_op->nr_cached_objects(). -+ * We don't call trylock_super() here as it is a scalability bottleneck, -+ * so we're exposed to partial setup state. The shrinker rwsem does not -+ * protect filesystem operations backing list_lru_shrink_count() or -+ * s_op->nr_cached_objects(). Counts can change between -+ * super_cache_count and super_cache_scan, so we really don't need locks -+ * here. -+ * -+ * However, if we are currently mounting the superblock, the underlying -+ * filesystem might be in a state of partial construction and hence it -+ * is dangerous to access it. trylock_super() uses a MS_BORN check to -+ * avoid this situation, so do the same here. The memory barrier is -+ * matched with the one in mount_fs() as we don't hold locks here. - */ -+ if (!(sb->s_flags & MS_BORN)) -+ return 0; -+ smp_rmb(); -+ - if (sb->s_op && sb->s_op->nr_cached_objects) - total_objects = sb->s_op->nr_cached_objects(sb, sc); - -@@ -1133,6 +1143,14 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) - sb = root->d_sb; - BUG_ON(!sb); - WARN_ON(!sb->s_bdi); -+ -+ /* -+ * Write barrier is for super_cache_count(). We place it before setting -+ * MS_BORN as the data dependency between the two functions is the -+ * superblock structure contents that we just set up, not the MS_BORN -+ * flag. -+ */ -+ smp_wmb(); - sb->s_flags |= MS_BORN; - - error = security_sb_kern_mount(sb, flags, secdata); -diff --git a/include/linux/kobject.h b/include/linux/kobject.h -index e6284591599e..5957c6a3fd7f 100644 ---- a/include/linux/kobject.h -+++ b/include/linux/kobject.h -@@ -113,6 +113,23 @@ extern void kobject_put(struct kobject *kobj); - extern const void *kobject_namespace(struct kobject *kobj); - extern char *kobject_get_path(struct kobject *kobj, gfp_t flag); - -+/** -+ * kobject_has_children - Returns whether a kobject has children. -+ * @kobj: the object to test -+ * -+ * This will return whether a kobject has other kobjects as children. -+ * -+ * It does NOT account for the presence of attribute files, only sub -+ * directories. It also assumes there is no concurrent addition or -+ * removal of such children, and thus relies on external locking. -+ */ -+static inline bool kobject_has_children(struct kobject *kobj) -+{ -+ WARN_ON_ONCE(atomic_read(&kobj->kref.refcount) == 0); -+ -+ return kobj->sd && kobj->sd->dir.subdirs; -+} -+ - struct kobj_type { - void (*release)(struct kobject *kobj); - const struct sysfs_ops *sysfs_ops; -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index a490dd718654..6d39d81d3c38 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2798,6 +2798,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, - * - * This is exactly the same as pskb_trim except that it ensures the - * checksum of received packets are still valid after the operation. -+ * It can change skb pointers. - */ - - static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) -diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h -index 2a25b53cd427..f6ff83b2ac87 100644 ---- a/include/net/ip_fib.h -+++ b/include/net/ip_fib.h -@@ -200,7 +200,7 @@ int fib_table_insert(struct fib_table *, struct fib_config *); - int fib_table_delete(struct fib_table *, struct fib_config *); - int fib_table_dump(struct fib_table *table, struct sk_buff *skb, - struct netlink_callback *cb); --int fib_table_flush(struct fib_table *table); -+int fib_table_flush(struct fib_table *table, bool flush_all); - struct fib_table *fib_trie_unmerge(struct fib_table *main_tb); - void fib_table_flush_external(struct fib_table *table); - void fib_free_table(struct fib_table *tb); -diff --git a/kernel/exit.c b/kernel/exit.c -index f20e6339761b..03f6722302b5 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -450,12 +450,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p) - return NULL; - } - --static struct task_struct *find_child_reaper(struct task_struct *father) -+static struct task_struct *find_child_reaper(struct task_struct *father, -+ struct list_head *dead) - __releases(&tasklist_lock) - __acquires(&tasklist_lock) - { - struct pid_namespace *pid_ns = task_active_pid_ns(father); - struct task_struct *reaper = pid_ns->child_reaper; -+ struct task_struct *p, *n; - - if (likely(reaper != father)) - return reaper; -@@ -471,6 +473,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father) - panic("Attempted to kill init! exitcode=0x%08x\n", - father->signal->group_exit_code ?: father->exit_code); - } -+ -+ list_for_each_entry_safe(p, n, dead, ptrace_entry) { -+ list_del_init(&p->ptrace_entry); -+ release_task(p); -+ } -+ - zap_pid_ns_processes(pid_ns); - write_lock_irq(&tasklist_lock); - -@@ -557,7 +565,7 @@ static void forget_original_parent(struct task_struct *father, - exit_ptrace(father, dead); - - /* Can drop and reacquire tasklist_lock */ -- reaper = find_child_reaper(father); -+ reaper = find_child_reaper(father, dead); - if (list_empty(&father->children)) - return; - -diff --git a/mm/migrate.c b/mm/migrate.c -index afedcfab60e2..ce88dff1da98 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -936,6 +936,7 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page, - int rc = MIGRATEPAGE_SUCCESS; - int *result = NULL; - struct page *newpage; -+ bool is_lru = !isolated_balloon_page(page); - - newpage = get_new_page(page, private, &result); - if (!newpage) -@@ -983,11 +984,13 @@ out: - /* - * If migration was not successful and there's a freeing callback, use - * it. Otherwise, putback_lru_page() will drop the reference grabbed -- * during isolation. -+ * during isolation. Use the old state of the isolated source page to -+ * determine if we migrated a LRU page. newpage was already unlocked -+ * and possibly modified by its owner - don't rely on the page state. - */ - if (put_new_page) - put_new_page(newpage, private); -- else if (unlikely(__is_movable_balloon_page(newpage))) { -+ else if (rc == MIGRATEPAGE_SUCCESS && unlikely(!is_lru)) { - /* drop our reference, page already in the balloon */ - put_page(newpage); - } else -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index c12680993ff3..bc781cdc0d04 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -544,6 +544,13 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, - * still freeing memory. - */ - read_lock(&tasklist_lock); -+ -+ /* -+ * The task 'p' might have already exited before reaching here. The -+ * put_task_struct() will free task_struct 'p' while the loop still try -+ * to access the field of 'p', so, get an extra reference. -+ */ -+ get_task_struct(p); - for_each_thread(p, t) { - list_for_each_entry(child, &t->children, sibling) { - unsigned int child_points; -@@ -563,6 +570,7 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, - } - } - } -+ put_task_struct(p); - read_unlock(&tasklist_lock); - - p = find_lock_task_mm(victim); -diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c -index fcdb86dd5a23..c21209aada8c 100644 ---- a/net/bridge/br_forward.c -+++ b/net/bridge/br_forward.c -@@ -39,10 +39,10 @@ static inline int should_deliver(const struct net_bridge_port *p, - - int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) - { -+ skb_push(skb, ETH_HLEN); - if (!is_skb_forwardable(skb->dev, skb)) - goto drop; - -- skb_push(skb, ETH_HLEN); - br_drop_fake_rtable(skb); - skb_sender_cpu_clear(skb); - -@@ -88,12 +88,11 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb) - skb->dev = to->dev; - - if (unlikely(netpoll_tx_running(to->br->dev))) { -+ skb_push(skb, ETH_HLEN); - if (!is_skb_forwardable(skb->dev, skb)) - kfree_skb(skb); -- else { -- skb_push(skb, ETH_HLEN); -+ else - br_netpoll_send_skb(to, skb); -- } - return; - } - -diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c -index d61f56efc8dc..69dfd212e50d 100644 ---- a/net/bridge/br_netfilter_ipv6.c -+++ b/net/bridge/br_netfilter_ipv6.c -@@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, struct sk_buff *skb) - IPSTATS_MIB_INDISCARDS); - goto drop; - } -+ hdr = ipv6_hdr(skb); - } - if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb)) - goto drop; -diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c -index fdba3d9fbff3..6e48aa69fa24 100644 ---- a/net/bridge/netfilter/nft_reject_bridge.c -+++ b/net/bridge/netfilter/nft_reject_bridge.c -@@ -192,6 +192,7 @@ static bool reject6_br_csum_ok(struct sk_buff *skb, int hook) - pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h))) - return false; - -+ ip6h = ipv6_hdr(skb); - thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo); - if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0) - return false; -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 4ccfd356baed..1f15622d3c65 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -67,6 +67,9 @@ - */ - #define MAX_NFRAMES 256 - -+/* limit timers to 400 days for sending/timeouts */ -+#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60) -+ - /* use of last_frames[index].can_dlc */ - #define RX_RECV 0x40 /* received data for this element */ - #define RX_THR 0x80 /* element not been sent due to throttle feature */ -@@ -136,6 +139,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv) - return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC); - } - -+/* check limitations for timeval provided by user */ -+static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head) -+{ -+ if ((msg_head->ival1.tv_sec < 0) || -+ (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) || -+ (msg_head->ival1.tv_usec < 0) || -+ (msg_head->ival1.tv_usec >= USEC_PER_SEC) || -+ (msg_head->ival2.tv_sec < 0) || -+ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) || -+ (msg_head->ival2.tv_usec < 0) || -+ (msg_head->ival2.tv_usec >= USEC_PER_SEC)) -+ return true; -+ -+ return false; -+} -+ - #define CFSIZ sizeof(struct can_frame) - #define OPSIZ sizeof(struct bcm_op) - #define MHSIZ sizeof(struct bcm_msg_head) -@@ -855,6 +874,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES) - return -EINVAL; - -+ /* check timeval limitations */ -+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) -+ return -EINVAL; -+ - /* check the given can_id */ - op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex); - -@@ -1020,6 +1043,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - (!(msg_head->can_id & CAN_RTR_FLAG)))) - return -EINVAL; - -+ /* check timeval limitations */ -+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) -+ return -EINVAL; -+ - /* check the given can_id */ - op = bcm_find_op(&bo->rx_ops, msg_head->can_id, ifindex); - if (op) { -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index ce646572b912..1f7b47ca2243 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -187,7 +187,7 @@ static void fib_flush(struct net *net) - struct fib_table *tb; - - hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) -- flushed += fib_table_flush(tb); -+ flushed += fib_table_flush(tb, false); - } - - if (flushed) -@@ -1277,7 +1277,7 @@ static void ip_fib_net_exit(struct net *net) - - hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) { - hlist_del(&tb->tb_hlist); -- fib_table_flush(tb); -+ fib_table_flush(tb, true); - fib_free_table(tb); - } - } -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 5c598f99a500..fdaa905dccdd 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -1806,7 +1806,7 @@ void fib_table_flush_external(struct fib_table *tb) - } - - /* Caller must hold RTNL. */ --int fib_table_flush(struct fib_table *tb) -+int fib_table_flush(struct fib_table *tb, bool flush_all) - { - struct trie *t = (struct trie *)tb->tb_data; - struct key_vector *pn = t->kv; -@@ -1850,7 +1850,17 @@ int fib_table_flush(struct fib_table *tb) - hlist_for_each_entry_safe(fa, tmp, &n->leaf, fa_list) { - struct fib_info *fi = fa->fa_info; - -- if (!fi || !(fi->fib_flags & RTNH_F_DEAD)) { -+ if (!fi || -+ (!(fi->fib_flags & RTNH_F_DEAD) && -+ !fib_props[fa->fa_type].error)) { -+ slen = fa->fa_slen; -+ continue; -+ } -+ -+ /* Do not flush error routes if network namespace is -+ * not being dismantled -+ */ -+ if (!flush_all && fib_props[fa->fa_type].error) { - slen = fa->fa_slen; - continue; - } -diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c -index b1209b63381f..eb1834f2682f 100644 ---- a/net/ipv4/ip_input.c -+++ b/net/ipv4/ip_input.c -@@ -444,6 +444,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, - goto drop; - } - -+ iph = ip_hdr(skb); - skb->transport_header = skb->network_header + iph->ihl*4; - - /* Remove any debris in the socket control block */ -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index d6f2dab28d14..f9a4447ca002 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -345,6 +345,9 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - err = -EINVAL; - goto out_unlock; - } -+ } -+ -+ if (sk->sk_bound_dev_if) { - dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if); - if (!dev) { - err = -ENODEV; -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 591d18785285..429dbb064240 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -83,8 +83,7 @@ - #define L2TP_SLFLAG_S 0x40000000 - #define L2TP_SL_SEQ_MASK 0x00ffffff - --#define L2TP_HDR_SIZE_SEQ 10 --#define L2TP_HDR_SIZE_NOSEQ 6 -+#define L2TP_HDR_SIZE_MAX 14 - - /* Default trace flags */ - #define L2TP_DEFAULT_DEBUG_FLAGS 0 -@@ -705,11 +704,9 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, - "%s: recv data ns=%u, session nr=%u\n", - session->name, ns, session->nr); - } -+ ptr += 4; - } - -- /* Advance past L2-specific header, if present */ -- ptr += session->l2specific_len; -- - if (L2TP_SKB_CB(skb)->has_seq) { - /* Received a packet with sequence numbers. If we're the LNS, - * check if we sre sending sequence numbers and if not, -@@ -860,7 +857,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, - __skb_pull(skb, sizeof(struct udphdr)); - - /* Short packet? */ -- if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) { -+ if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) { - l2tp_info(tunnel, L2TP_MSG_DATA, - "%s: recv short packet (len=%d)\n", - tunnel->name, skb->len); -@@ -933,6 +930,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, - goto error; - } - -+ if (tunnel->version == L2TP_HDR_VER_3 && -+ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) -+ goto error; -+ - l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook); - - return 0; -@@ -1031,21 +1032,20 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) - memcpy(bufp, &session->cookie[0], session->cookie_len); - bufp += session->cookie_len; - } -- if (session->l2specific_len) { -- if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { -- u32 l2h = 0; -- if (session->send_seq) { -- l2h = 0x40000000 | session->ns; -- session->ns++; -- session->ns &= 0xffffff; -- l2tp_dbg(session, L2TP_MSG_SEQ, -- "%s: updated ns to %u\n", -- session->name, session->ns); -- } -+ if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { -+ u32 l2h = 0; - -- *((__be32 *) bufp) = htonl(l2h); -+ if (session->send_seq) { -+ l2h = 0x40000000 | session->ns; -+ session->ns++; -+ session->ns &= 0xffffff; -+ l2tp_dbg(session, L2TP_MSG_SEQ, -+ "%s: updated ns to %u\n", -+ session->name, session->ns); - } -- bufp += session->l2specific_len; -+ -+ *((__be32 *)bufp) = htonl(l2h); -+ bufp += 4; - } - if (session->offset) - bufp += session->offset; -@@ -1724,7 +1724,7 @@ int l2tp_session_delete(struct l2tp_session *session) - EXPORT_SYMBOL_GPL(l2tp_session_delete); - - /* We come here whenever a session's send_seq, cookie_len or -- * l2specific_len parameters are set. -+ * l2specific_type parameters are set. - */ - void l2tp_session_set_header_len(struct l2tp_session *session, int version) - { -@@ -1733,7 +1733,8 @@ void l2tp_session_set_header_len(struct l2tp_session *session, int version) - if (session->send_seq) - session->hdr_len += 4; - } else { -- session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset; -+ session->hdr_len = 4 + session->cookie_len + session->offset; -+ session->hdr_len += l2tp_get_l2specific_len(session); - if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP) - session->hdr_len += 4; - } -diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h -index 9cf546846edb..fad47e9d74bc 100644 ---- a/net/l2tp/l2tp_core.h -+++ b/net/l2tp/l2tp_core.h -@@ -313,6 +313,37 @@ do { \ - #define l2tp_session_dec_refcount(s) l2tp_session_dec_refcount_1(s) - #endif - -+static inline int l2tp_get_l2specific_len(struct l2tp_session *session) -+{ -+ switch (session->l2specific_type) { -+ case L2TP_L2SPECTYPE_DEFAULT: -+ return 4; -+ case L2TP_L2SPECTYPE_NONE: -+ default: -+ return 0; -+ } -+} -+ -+static inline int l2tp_v3_ensure_opt_in_linear(struct l2tp_session *session, struct sk_buff *skb, -+ unsigned char **ptr, unsigned char **optr) -+{ -+ int opt_len = session->peer_cookie_len + l2tp_get_l2specific_len(session); -+ -+ if (opt_len > 0) { -+ int off = *ptr - *optr; -+ -+ if (!pskb_may_pull(skb, off + opt_len)) -+ return -1; -+ -+ if (skb->data != *optr) { -+ *optr = skb->data; -+ *ptr = skb->data + off; -+ } -+ } -+ -+ return 0; -+} -+ - #define l2tp_printk(ptr, type, func, fmt, ...) \ - do { \ - if (((ptr)->debug) & (type)) \ -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index af74e3ba0f92..7efb3cadc152 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -163,6 +163,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } - -+ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) -+ goto discard; -+ - l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, tunnel->recv_payload_hook); - - return 0; -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index 591d308bf63a..e066111b9398 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -174,6 +174,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) - print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); - } - -+ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) -+ goto discard; -+ - l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, - tunnel->recv_payload_hook); - return 0; -diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c -index 94d05806a9a2..f0ecaec1ff3d 100644 ---- a/net/netrom/nr_timer.c -+++ b/net/netrom/nr_timer.c -@@ -53,21 +53,21 @@ void nr_start_t1timer(struct sock *sk) - { - struct nr_sock *nr = nr_sk(sk); - -- mod_timer(&nr->t1timer, jiffies + nr->t1); -+ sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1); - } - - void nr_start_t2timer(struct sock *sk) - { - struct nr_sock *nr = nr_sk(sk); - -- mod_timer(&nr->t2timer, jiffies + nr->t2); -+ sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2); - } - - void nr_start_t4timer(struct sock *sk) - { - struct nr_sock *nr = nr_sk(sk); - -- mod_timer(&nr->t4timer, jiffies + nr->t4); -+ sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4); - } - - void nr_start_idletimer(struct sock *sk) -@@ -75,37 +75,37 @@ void nr_start_idletimer(struct sock *sk) - struct nr_sock *nr = nr_sk(sk); - - if (nr->idle > 0) -- mod_timer(&nr->idletimer, jiffies + nr->idle); -+ sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle); - } - - void nr_start_heartbeat(struct sock *sk) - { -- mod_timer(&sk->sk_timer, jiffies + 5 * HZ); -+ sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ); - } - - void nr_stop_t1timer(struct sock *sk) - { -- del_timer(&nr_sk(sk)->t1timer); -+ sk_stop_timer(sk, &nr_sk(sk)->t1timer); - } - - void nr_stop_t2timer(struct sock *sk) - { -- del_timer(&nr_sk(sk)->t2timer); -+ sk_stop_timer(sk, &nr_sk(sk)->t2timer); - } - - void nr_stop_t4timer(struct sock *sk) - { -- del_timer(&nr_sk(sk)->t4timer); -+ sk_stop_timer(sk, &nr_sk(sk)->t4timer); - } - - void nr_stop_idletimer(struct sock *sk) - { -- del_timer(&nr_sk(sk)->idletimer); -+ sk_stop_timer(sk, &nr_sk(sk)->idletimer); - } - - void nr_stop_heartbeat(struct sock *sk) - { -- del_timer(&sk->sk_timer); -+ sk_stop_timer(sk, &sk->sk_timer); - } - - int nr_t1timer_running(struct sock *sk) -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index 624c4719e404..537917dfa83a 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -409,7 +409,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr, - return -EINVAL; - } - -- if (!nz || !is_all_zero(nla_data(nla), expected_len)) { -+ if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) { - attrs |= 1 << type; - a[type] = nla; - } -diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c -index 0fc76d845103..9f704a7f2a28 100644 ---- a/net/rose/rose_route.c -+++ b/net/rose/rose_route.c -@@ -848,6 +848,7 @@ void rose_link_device_down(struct net_device *dev) - - /* - * Route a frame to an appropriate AX.25 connection. -+ * A NULL ax25_cb indicates an internally generated frame. - */ - int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - { -@@ -865,6 +866,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) - - if (skb->len < ROSE_MIN_LEN) - return res; -+ -+ if (!ax25) -+ return rose_loopback_queue(skb, NULL); -+ - frametype = skb->data[2]; - lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF); - if (frametype == ROSE_CALL_REQUEST && -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 6d340cd6e2a7..b379c330a338 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -1823,7 +1823,6 @@ done: - int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp, - struct tcf_result *res, bool compat_mode) - { -- __be16 protocol = tc_skb_protocol(skb); - #ifdef CONFIG_NET_CLS_ACT - const struct tcf_proto *old_tp = tp; - int limit = 0; -@@ -1831,6 +1830,7 @@ int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp, - reclassify: - #endif - for (; tp; tp = rcu_dereference_bh(tp->next)) { -+ __be16 protocol = tc_skb_protocol(skb); - int err; - - if (tp->protocol != protocol && -@@ -1857,7 +1857,6 @@ reset: - } - - tp = old_tp; -- protocol = tc_skb_protocol(skb); - goto reclassify; - #endif - } -diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -index 2b96b11fbe71..1d9dfb92b3b4 100644 ---- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c -+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -@@ -398,7 +398,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params, - struct snd_soc_dai *dai) - { -- snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params)); -+ int ret; -+ -+ ret = -+ snd_pcm_lib_malloc_pages(substream, -+ params_buffer_bytes(params)); -+ if (ret) -+ return ret; - memset(substream->runtime->dma_area, 0, params_buffer_bytes(params)); - return 0; - } -diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c -index 60edec383281..bf5ee8906fb2 100644 ---- a/tools/perf/util/unwind-libdw.c -+++ b/tools/perf/util/unwind-libdw.c -@@ -41,13 +41,13 @@ static int __report_module(struct addr_location *al, u64 ip, - Dwarf_Addr s; - - dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); -- if (s != al->map->start) -+ if (s != al->map->start - al->map->pgoff) - mod = 0; - } - - if (!mod) - mod = dwfl_report_elf(ui->dwfl, dso->short_name, -- dso->long_name, -1, al->map->start, -+ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff, - false); - - return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.173-174.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.173-174.patch deleted file mode 100644 index 3060cab79a65..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.173-174.patch +++ /dev/null @@ -1,3075 +0,0 @@ -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 2ea4c45cf1c8..7c229f59016f 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -112,14 +112,11 @@ min_adv_mss - INTEGER - - IP Fragmentation: - --ipfrag_high_thresh - INTEGER -- Maximum memory used to reassemble IP fragments. When -- ipfrag_high_thresh bytes of memory is allocated for this purpose, -- the fragment handler will toss packets until ipfrag_low_thresh -- is reached. This also serves as a maximum limit to namespaces -- different from the initial one. -- --ipfrag_low_thresh - INTEGER -+ipfrag_high_thresh - LONG INTEGER -+ Maximum memory used to reassemble IP fragments. -+ -+ipfrag_low_thresh - LONG INTEGER -+ (Obsolete since linux-4.17) - Maximum memory used to reassemble IP fragments before the kernel - begins to remove incomplete fragment queues to free up resources. - The kernel still accepts new fragments for defragmentation. -diff --git a/Makefile b/Makefile -index db7665e32da8..1fa281069379 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 173 -+SUBLEVEL = 174 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h -index e50b31d18462..e97cdfd6cba9 100644 ---- a/include/linux/rhashtable.h -+++ b/include/linux/rhashtable.h -@@ -133,23 +133,23 @@ struct rhashtable_params { - /** - * struct rhashtable - Hash table handle - * @tbl: Bucket table -- * @nelems: Number of elements in table - * @key_len: Key length for hashfn - * @elasticity: Maximum chain length before rehash - * @p: Configuration parameters - * @run_work: Deferred worker to expand/shrink asynchronously - * @mutex: Mutex to protect current/future table swapping - * @lock: Spin lock to protect walker list -+ * @nelems: Number of elements in table - */ - struct rhashtable { - struct bucket_table __rcu *tbl; -- atomic_t nelems; - unsigned int key_len; - unsigned int elasticity; - struct rhashtable_params p; - struct work_struct run_work; - struct mutex mutex; - spinlock_t lock; -+ atomic_t nelems; - }; - - /** -@@ -343,7 +343,8 @@ int rhashtable_init(struct rhashtable *ht, - struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht, - const void *key, - struct rhash_head *obj, -- struct bucket_table *old_tbl); -+ struct bucket_table *old_tbl, -+ void **data); - int rhashtable_insert_rehash(struct rhashtable *ht, struct bucket_table *tbl); - - int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter); -@@ -514,18 +515,8 @@ static inline int rhashtable_compare(struct rhashtable_compare_arg *arg, - return memcmp(ptr + ht->p.key_offset, arg->key, ht->p.key_len); - } - --/** -- * rhashtable_lookup_fast - search hash table, inlined version -- * @ht: hash table -- * @key: the pointer to the key -- * @params: hash table parameters -- * -- * Computes the hash value for the key and traverses the bucket chain looking -- * for a entry with an identical key. The first matching entry is returned. -- * -- * Returns the first entry on which the compare function returned true. -- */ --static inline void *rhashtable_lookup_fast( -+/* Internal function, do not use. */ -+static inline struct rhash_head *__rhashtable_lookup( - struct rhashtable *ht, const void *key, - const struct rhashtable_params params) - { -@@ -537,8 +528,6 @@ static inline void *rhashtable_lookup_fast( - struct rhash_head *he; - unsigned int hash; - -- rcu_read_lock(); -- - tbl = rht_dereference_rcu(ht->tbl, ht); - restart: - hash = rht_key_hashfn(ht, tbl, key, params); -@@ -547,8 +536,7 @@ restart: - params.obj_cmpfn(&arg, rht_obj(ht, he)) : - rhashtable_compare(&arg, rht_obj(ht, he))) - continue; -- rcu_read_unlock(); -- return rht_obj(ht, he); -+ return he; - } - - /* Ensure we see any new tables. */ -@@ -557,13 +545,64 @@ restart: - tbl = rht_dereference_rcu(tbl->future_tbl, ht); - if (unlikely(tbl)) - goto restart; -- rcu_read_unlock(); - - return NULL; - } - --/* Internal function, please use rhashtable_insert_fast() instead */ --static inline int __rhashtable_insert_fast( -+/** -+ * rhashtable_lookup - search hash table -+ * @ht: hash table -+ * @key: the pointer to the key -+ * @params: hash table parameters -+ * -+ * Computes the hash value for the key and traverses the bucket chain looking -+ * for a entry with an identical key. The first matching entry is returned. -+ * -+ * This must only be called under the RCU read lock. -+ * -+ * Returns the first entry on which the compare function returned true. -+ */ -+static inline void *rhashtable_lookup( -+ struct rhashtable *ht, const void *key, -+ const struct rhashtable_params params) -+{ -+ struct rhash_head *he = __rhashtable_lookup(ht, key, params); -+ -+ return he ? rht_obj(ht, he) : NULL; -+} -+ -+/** -+ * rhashtable_lookup_fast - search hash table, without RCU read lock -+ * @ht: hash table -+ * @key: the pointer to the key -+ * @params: hash table parameters -+ * -+ * Computes the hash value for the key and traverses the bucket chain looking -+ * for a entry with an identical key. The first matching entry is returned. -+ * -+ * Only use this function when you have other mechanisms guaranteeing -+ * that the object won't go away after the RCU read lock is released. -+ * -+ * Returns the first entry on which the compare function returned true. -+ */ -+static inline void *rhashtable_lookup_fast( -+ struct rhashtable *ht, const void *key, -+ const struct rhashtable_params params) -+{ -+ void *obj; -+ -+ rcu_read_lock(); -+ obj = rhashtable_lookup(ht, key, params); -+ rcu_read_unlock(); -+ -+ return obj; -+} -+ -+/* Internal function, please use rhashtable_insert_fast() instead. This -+ * function returns the existing element already in hashes in there is a clash, -+ * otherwise it returns an error via ERR_PTR(). -+ */ -+static inline void *__rhashtable_insert_fast( - struct rhashtable *ht, const void *key, struct rhash_head *obj, - const struct rhashtable_params params) - { -@@ -576,6 +615,7 @@ static inline int __rhashtable_insert_fast( - spinlock_t *lock; - unsigned int elasticity; - unsigned int hash; -+ void *data = NULL; - int err; - - restart: -@@ -600,11 +640,14 @@ restart: - - new_tbl = rht_dereference_rcu(tbl->future_tbl, ht); - if (unlikely(new_tbl)) { -- tbl = rhashtable_insert_slow(ht, key, obj, new_tbl); -+ tbl = rhashtable_insert_slow(ht, key, obj, new_tbl, &data); - if (!IS_ERR_OR_NULL(tbl)) - goto slow_path; - - err = PTR_ERR(tbl); -+ if (err == -EEXIST) -+ err = 0; -+ - goto out; - } - -@@ -618,25 +661,25 @@ slow_path: - err = rhashtable_insert_rehash(ht, tbl); - rcu_read_unlock(); - if (err) -- return err; -+ return ERR_PTR(err); - - goto restart; - } - -- err = -EEXIST; -+ err = 0; - elasticity = ht->elasticity; - rht_for_each(head, tbl, hash) { - if (key && - unlikely(!(params.obj_cmpfn ? - params.obj_cmpfn(&arg, rht_obj(ht, head)) : -- rhashtable_compare(&arg, rht_obj(ht, head))))) -+ rhashtable_compare(&arg, rht_obj(ht, head))))) { -+ data = rht_obj(ht, head); - goto out; -+ } - if (!--elasticity) - goto slow_path; - } - -- err = 0; -- - head = rht_dereference_bucket(tbl->buckets[hash], tbl, hash); - - RCU_INIT_POINTER(obj->next, head); -@@ -651,7 +694,7 @@ out: - spin_unlock_bh(lock); - rcu_read_unlock(); - -- return err; -+ return err ? ERR_PTR(err) : data; - } - - /** -@@ -674,7 +717,13 @@ static inline int rhashtable_insert_fast( - struct rhashtable *ht, struct rhash_head *obj, - const struct rhashtable_params params) - { -- return __rhashtable_insert_fast(ht, NULL, obj, params); -+ void *ret; -+ -+ ret = __rhashtable_insert_fast(ht, NULL, obj, params); -+ if (IS_ERR(ret)) -+ return PTR_ERR(ret); -+ -+ return ret == NULL ? 0 : -EEXIST; - } - - /** -@@ -703,11 +752,15 @@ static inline int rhashtable_lookup_insert_fast( - const struct rhashtable_params params) - { - const char *key = rht_obj(ht, obj); -+ void *ret; - - BUG_ON(ht->p.obj_hashfn); - -- return __rhashtable_insert_fast(ht, key + ht->p.key_offset, obj, -- params); -+ ret = __rhashtable_insert_fast(ht, key + ht->p.key_offset, obj, params); -+ if (IS_ERR(ret)) -+ return PTR_ERR(ret); -+ -+ return ret == NULL ? 0 : -EEXIST; - } - - /** -@@ -735,6 +788,32 @@ static inline int rhashtable_lookup_insert_fast( - static inline int rhashtable_lookup_insert_key( - struct rhashtable *ht, const void *key, struct rhash_head *obj, - const struct rhashtable_params params) -+{ -+ void *ret; -+ -+ BUG_ON(!ht->p.obj_hashfn || !key); -+ -+ ret = __rhashtable_insert_fast(ht, key, obj, params); -+ if (IS_ERR(ret)) -+ return PTR_ERR(ret); -+ -+ return ret == NULL ? 0 : -EEXIST; -+} -+ -+/** -+ * rhashtable_lookup_get_insert_key - lookup and insert object into hash table -+ * @ht: hash table -+ * @obj: pointer to hash head inside object -+ * @params: hash table parameters -+ * @data: pointer to element data already in hashes -+ * -+ * Just like rhashtable_lookup_insert_key(), but this function returns the -+ * object if it exists, NULL if it does not and the insertion was successful, -+ * and an ERR_PTR otherwise. -+ */ -+static inline void *rhashtable_lookup_get_insert_key( -+ struct rhashtable *ht, const void *key, struct rhash_head *obj, -+ const struct rhashtable_params params) - { - BUG_ON(!ht->p.obj_hashfn || !key); - -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 6d39d81d3c38..502787c29ce9 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -556,9 +556,14 @@ struct sk_buff { - struct skb_mstamp skb_mstamp; - }; - }; -- struct rb_node rbnode; /* used in netem & tcp stack */ -+ struct rb_node rbnode; /* used in netem, ip4 defrag, and tcp stack */ - }; -- struct sock *sk; -+ -+ union { -+ struct sock *sk; -+ int ip_defrag_offset; -+ }; -+ - struct net_device *dev; - - /* -@@ -2273,7 +2278,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) - kfree_skb(skb); - } - --void skb_rbtree_purge(struct rb_root *root); -+unsigned int skb_rbtree_purge(struct rb_root *root); - - void *netdev_alloc_frag(unsigned int fragsz); - -@@ -2791,6 +2796,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, - return skb->data; - } - -+int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len); - /** - * pskb_trim_rcsum - trim received skb and update checksum - * @skb: buffer to trim -@@ -2805,9 +2811,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) - { - if (likely(len >= skb->len)) - return 0; -- if (skb->ip_summed == CHECKSUM_COMPLETE) -- skb->ip_summed = CHECKSUM_NONE; -- return __pskb_trim(skb, len); -+ return pskb_trim_rcsum_slow(skb, len); - } - - #define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) -diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h -index c26a6e4dc306..6260ec146142 100644 ---- a/include/net/inet_frag.h -+++ b/include/net/inet_frag.h -@@ -1,13 +1,19 @@ - #ifndef __NET_FRAG_H__ - #define __NET_FRAG_H__ - -+#include -+ - struct netns_frags { -- /* Keep atomic mem on separate cachelines in structs that include it */ -- atomic_t mem ____cacheline_aligned_in_smp; - /* sysctls */ -+ long high_thresh; -+ long low_thresh; - int timeout; -- int high_thresh; -- int low_thresh; -+ struct inet_frags *f; -+ -+ struct rhashtable rhashtable ____cacheline_aligned_in_smp; -+ -+ /* Keep atomic mem on separate cachelines in structs that include it */ -+ atomic_long_t mem ____cacheline_aligned_in_smp; - }; - - /** -@@ -23,74 +29,68 @@ enum { - INET_FRAG_COMPLETE = BIT(2), - }; - -+struct frag_v4_compare_key { -+ __be32 saddr; -+ __be32 daddr; -+ u32 user; -+ u32 vif; -+ __be16 id; -+ u16 protocol; -+}; -+ -+struct frag_v6_compare_key { -+ struct in6_addr saddr; -+ struct in6_addr daddr; -+ u32 user; -+ __be32 id; -+ u32 iif; -+}; -+ - /** - * struct inet_frag_queue - fragment queue - * -- * @lock: spinlock protecting the queue -+ * @node: rhash node -+ * @key: keys identifying this frag. - * @timer: queue expiration timer -- * @list: hash bucket list -+ * @lock: spinlock protecting this frag - * @refcnt: reference count of the queue - * @fragments: received fragments head -+ * @rb_fragments: received fragments rb-tree root - * @fragments_tail: received fragments tail -+ * @last_run_head: the head of the last "run". see ip_fragment.c - * @stamp: timestamp of the last received fragment - * @len: total length of the original datagram - * @meat: length of received fragments so far - * @flags: fragment queue flags - * @max_size: maximum received fragment size - * @net: namespace that this frag belongs to -- * @list_evictor: list of queues to forcefully evict (e.g. due to low memory) -+ * @rcu: rcu head for freeing deferall - */ - struct inet_frag_queue { -- spinlock_t lock; -+ struct rhash_head node; -+ union { -+ struct frag_v4_compare_key v4; -+ struct frag_v6_compare_key v6; -+ } key; - struct timer_list timer; -- struct hlist_node list; -+ spinlock_t lock; - atomic_t refcnt; -- struct sk_buff *fragments; -+ struct sk_buff *fragments; /* Used in IPv6. */ -+ struct rb_root rb_fragments; /* Used in IPv4. */ - struct sk_buff *fragments_tail; -+ struct sk_buff *last_run_head; - ktime_t stamp; - int len; - int meat; - __u8 flags; - u16 max_size; -- struct netns_frags *net; -- struct hlist_node list_evictor; --}; -- --#define INETFRAGS_HASHSZ 1024 -- --/* averaged: -- * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / -- * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or -- * struct frag_queue)) -- */ --#define INETFRAGS_MAXDEPTH 128 -- --struct inet_frag_bucket { -- struct hlist_head chain; -- spinlock_t chain_lock; -+ struct netns_frags *net; -+ struct rcu_head rcu; - }; - - struct inet_frags { -- struct inet_frag_bucket hash[INETFRAGS_HASHSZ]; -- -- struct work_struct frags_work; -- unsigned int next_bucket; -- unsigned long last_rebuild_jiffies; -- bool rebuild; -- -- /* The first call to hashfn is responsible to initialize -- * rnd. This is best done with net_get_random_once. -- * -- * rnd_seqlock is used to let hash insertion detect -- * when it needs to re-lookup the hash chain to use. -- */ -- u32 rnd; -- seqlock_t rnd_seqlock; - int qsize; - -- unsigned int (*hashfn)(const struct inet_frag_queue *); -- bool (*match)(const struct inet_frag_queue *q, -- const void *arg); - void (*constructor)(struct inet_frag_queue *q, - const void *arg); - void (*destructor)(struct inet_frag_queue *); -@@ -98,56 +98,47 @@ struct inet_frags { - void (*frag_expire)(unsigned long data); - struct kmem_cache *frags_cachep; - const char *frags_cache_name; -+ struct rhashtable_params rhash_params; - }; - - int inet_frags_init(struct inet_frags *); - void inet_frags_fini(struct inet_frags *); - --static inline void inet_frags_init_net(struct netns_frags *nf) -+static inline int inet_frags_init_net(struct netns_frags *nf) - { -- atomic_set(&nf->mem, 0); -+ atomic_long_set(&nf->mem, 0); -+ return rhashtable_init(&nf->rhashtable, &nf->f->rhash_params); - } --void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); -+void inet_frags_exit_net(struct netns_frags *nf); - --void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); --void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f); --struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, -- struct inet_frags *f, void *key, unsigned int hash); -+void inet_frag_kill(struct inet_frag_queue *q); -+void inet_frag_destroy(struct inet_frag_queue *q); -+struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key); - --void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, -- const char *prefix); -+/* Free all skbs in the queue; return the sum of their truesizes. */ -+unsigned int inet_frag_rbtree_purge(struct rb_root *root); - --static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) -+static inline void inet_frag_put(struct inet_frag_queue *q) - { - if (atomic_dec_and_test(&q->refcnt)) -- inet_frag_destroy(q, f); --} -- --static inline bool inet_frag_evicting(struct inet_frag_queue *q) --{ -- return !hlist_unhashed(&q->list_evictor); -+ inet_frag_destroy(q); - } - - /* Memory Tracking Functions. */ - --static inline int frag_mem_limit(struct netns_frags *nf) --{ -- return atomic_read(&nf->mem); --} -- --static inline void sub_frag_mem_limit(struct netns_frags *nf, int i) -+static inline long frag_mem_limit(const struct netns_frags *nf) - { -- atomic_sub(i, &nf->mem); -+ return atomic_long_read(&nf->mem); - } - --static inline void add_frag_mem_limit(struct netns_frags *nf, int i) -+static inline void sub_frag_mem_limit(struct netns_frags *nf, long val) - { -- atomic_add(i, &nf->mem); -+ atomic_long_sub(val, &nf->mem); - } - --static inline int sum_frag_mem_limit(struct netns_frags *nf) -+static inline void add_frag_mem_limit(struct netns_frags *nf, long val) - { -- return atomic_read(&nf->mem); -+ atomic_long_add(val, &nf->mem); - } - - /* RFC 3168 support : -diff --git a/include/net/ip.h b/include/net/ip.h -index 0530bcdbc212..7b968927477d 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -524,7 +524,6 @@ static inline struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *s - return skb; - } - #endif --int ip_frag_mem(struct net *net); - - /* - * Functions provided by ip_forward.c -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index 0e01d570fa22..c07cf9596b6f 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -320,13 +320,6 @@ static inline bool ipv6_accept_ra(struct inet6_dev *idev) - idev->cnf.accept_ra; - } - --#if IS_ENABLED(CONFIG_IPV6) --static inline int ip6_frag_mem(struct net *net) --{ -- return sum_frag_mem_limit(&net->ipv6.frags); --} --#endif -- - #define IPV6_FRAG_HIGH_THRESH (4 * 1024*1024) /* 4194304 */ - #define IPV6_FRAG_LOW_THRESH (3 * 1024*1024) /* 3145728 */ - #define IPV6_FRAG_TIMEOUT (60 * HZ) /* 60 seconds */ -@@ -505,17 +498,8 @@ enum ip6_defrag_users { - __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX, - }; - --struct ip6_create_arg { -- __be32 id; -- u32 user; -- const struct in6_addr *src; -- const struct in6_addr *dst; -- int iif; -- u8 ecn; --}; -- - void ip6_frag_init(struct inet_frag_queue *q, const void *a); --bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); -+extern const struct rhashtable_params ip6_rhash_params; - - /* - * Equivalent of ipv4 struct ip -@@ -523,19 +507,13 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); - struct frag_queue { - struct inet_frag_queue q; - -- __be32 id; /* fragment id */ -- u32 user; -- struct in6_addr saddr; -- struct in6_addr daddr; -- - int iif; - unsigned int csum; - __u16 nhoffset; - u8 ecn; - }; - --void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, -- struct inet_frags *frags); -+void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq); - - static inline bool ipv6_addr_any(const struct in6_addr *a) - { -diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h -index 25a9ad8bcef1..9de808ebce05 100644 ---- a/include/uapi/linux/snmp.h -+++ b/include/uapi/linux/snmp.h -@@ -55,6 +55,7 @@ enum - IPSTATS_MIB_ECT1PKTS, /* InECT1Pkts */ - IPSTATS_MIB_ECT0PKTS, /* InECT0Pkts */ - IPSTATS_MIB_CEPKTS, /* InCEPkts */ -+ IPSTATS_MIB_REASM_OVERLAPS, /* ReasmOverlaps */ - __IPSTATS_MIB_MAX - }; - -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 8a62cbfe1f2f..4e886ccd40db 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -3817,7 +3817,7 @@ static void synchronize_sched_expedited_wait(struct rcu_state *rsp) - continue; - rdp = per_cpu_ptr(rsp->rda, cpu); - pr_cont(" %d-%c%c%c", cpu, -- "O."[cpu_online(cpu)], -+ "O."[!!cpu_online(cpu)], - "o."[!!(rdp->grpmask & rnp->expmaskinit)], - "N."[!!(rdp->grpmask & rnp->expmaskinitnext)]); - } -diff --git a/lib/rhashtable.c b/lib/rhashtable.c -index 37ea94b636a3..7bb8649429bf 100644 ---- a/lib/rhashtable.c -+++ b/lib/rhashtable.c -@@ -250,8 +250,10 @@ static int rhashtable_rehash_table(struct rhashtable *ht) - if (!new_tbl) - return 0; - -- for (old_hash = 0; old_hash < old_tbl->size; old_hash++) -+ for (old_hash = 0; old_hash < old_tbl->size; old_hash++) { - rhashtable_rehash_chain(ht, old_hash); -+ cond_resched(); -+ } - - /* Publish the new table pointer. */ - rcu_assign_pointer(ht->tbl, new_tbl); -@@ -441,7 +443,8 @@ EXPORT_SYMBOL_GPL(rhashtable_insert_rehash); - struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht, - const void *key, - struct rhash_head *obj, -- struct bucket_table *tbl) -+ struct bucket_table *tbl, -+ void **data) - { - struct rhash_head *head; - unsigned int hash; -@@ -452,8 +455,11 @@ struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht, - spin_lock_nested(rht_bucket_lock(tbl, hash), SINGLE_DEPTH_NESTING); - - err = -EEXIST; -- if (key && rhashtable_lookup_fast(ht, key, ht->p)) -- goto exit; -+ if (key) { -+ *data = rhashtable_lookup_fast(ht, key, ht->p); -+ if (*data) -+ goto exit; -+ } - - err = -E2BIG; - if (unlikely(rht_grow_above_max(ht, tbl))) -@@ -838,6 +844,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht, - for (i = 0; i < tbl->size; i++) { - struct rhash_head *pos, *next; - -+ cond_resched(); - for (pos = rht_dereference(tbl->buckets[i], ht), - next = !rht_is_a_nulls(pos) ? - rht_dereference(pos->next, ht) : NULL; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 8a57bbaf7452..fea7c24e99d0 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -1502,6 +1502,21 @@ done: - } - EXPORT_SYMBOL(___pskb_trim); - -+/* Note : use pskb_trim_rcsum() instead of calling this directly -+ */ -+int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) -+{ -+ if (skb->ip_summed == CHECKSUM_COMPLETE) { -+ int delta = skb->len - len; -+ -+ skb->csum = csum_block_sub(skb->csum, -+ skb_checksum(skb, len, delta, 0), -+ len); -+ } -+ return __pskb_trim(skb, len); -+} -+EXPORT_SYMBOL(pskb_trim_rcsum_slow); -+ - /** - * __pskb_pull_tail - advance tail of skb header - * @skb: buffer to reallocate -@@ -2380,23 +2395,27 @@ EXPORT_SYMBOL(skb_queue_purge); - /** - * skb_rbtree_purge - empty a skb rbtree - * @root: root of the rbtree to empty -+ * Return value: the sum of truesizes of all purged skbs. - * - * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from - * the list and one reference dropped. This function does not take - * any lock. Synchronization should be handled by the caller (e.g., TCP - * out-of-order queue is protected by the socket lock). - */ --void skb_rbtree_purge(struct rb_root *root) -+unsigned int skb_rbtree_purge(struct rb_root *root) - { - struct rb_node *p = rb_first(root); -+ unsigned int sum = 0; - - while (p) { - struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); - - p = rb_next(p); - rb_erase(&skb->rbnode, root); -+ sum += skb->truesize; - kfree_skb(skb); - } -+ return sum; - } - - /** -diff --git a/net/ieee802154/6lowpan/6lowpan_i.h b/net/ieee802154/6lowpan/6lowpan_i.h -index b4e17a7c0df0..fdbebe51446f 100644 ---- a/net/ieee802154/6lowpan/6lowpan_i.h -+++ b/net/ieee802154/6lowpan/6lowpan_i.h -@@ -16,37 +16,19 @@ typedef unsigned __bitwise__ lowpan_rx_result; - #define LOWPAN_DISPATCH_FRAG1 0xc0 - #define LOWPAN_DISPATCH_FRAGN 0xe0 - --struct lowpan_create_arg { -+struct frag_lowpan_compare_key { - u16 tag; - u16 d_size; -- const struct ieee802154_addr *src; -- const struct ieee802154_addr *dst; -+ struct ieee802154_addr src; -+ struct ieee802154_addr dst; - }; - --/* Equivalent of ipv4 struct ip -+/* Equivalent of ipv4 struct ipq - */ - struct lowpan_frag_queue { - struct inet_frag_queue q; -- -- u16 tag; -- u16 d_size; -- struct ieee802154_addr saddr; -- struct ieee802154_addr daddr; - }; - --static inline u32 ieee802154_addr_hash(const struct ieee802154_addr *a) --{ -- switch (a->mode) { -- case IEEE802154_ADDR_LONG: -- return (((__force u64)a->extended_addr) >> 32) ^ -- (((__force u64)a->extended_addr) & 0xffffffff); -- case IEEE802154_ADDR_SHORT: -- return (__force u32)(a->short_addr); -- default: -- return 0; -- } --} -- - /* private device info */ - struct lowpan_dev_info { - struct net_device *wdev; /* wpan device ptr */ -diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c -index 12e8cf4bda9f..6183730d38db 100644 ---- a/net/ieee802154/6lowpan/reassembly.c -+++ b/net/ieee802154/6lowpan/reassembly.c -@@ -37,47 +37,15 @@ static struct inet_frags lowpan_frags; - static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, - struct sk_buff *prev, struct net_device *ldev); - --static unsigned int lowpan_hash_frag(u16 tag, u16 d_size, -- const struct ieee802154_addr *saddr, -- const struct ieee802154_addr *daddr) --{ -- net_get_random_once(&lowpan_frags.rnd, sizeof(lowpan_frags.rnd)); -- return jhash_3words(ieee802154_addr_hash(saddr), -- ieee802154_addr_hash(daddr), -- (__force u32)(tag + (d_size << 16)), -- lowpan_frags.rnd); --} -- --static unsigned int lowpan_hashfn(const struct inet_frag_queue *q) --{ -- const struct lowpan_frag_queue *fq; -- -- fq = container_of(q, struct lowpan_frag_queue, q); -- return lowpan_hash_frag(fq->tag, fq->d_size, &fq->saddr, &fq->daddr); --} -- --static bool lowpan_frag_match(const struct inet_frag_queue *q, const void *a) --{ -- const struct lowpan_frag_queue *fq; -- const struct lowpan_create_arg *arg = a; -- -- fq = container_of(q, struct lowpan_frag_queue, q); -- return fq->tag == arg->tag && fq->d_size == arg->d_size && -- ieee802154_addr_equal(&fq->saddr, arg->src) && -- ieee802154_addr_equal(&fq->daddr, arg->dst); --} -- - static void lowpan_frag_init(struct inet_frag_queue *q, const void *a) - { -- const struct lowpan_create_arg *arg = a; -+ const struct frag_lowpan_compare_key *key = a; - struct lowpan_frag_queue *fq; - - fq = container_of(q, struct lowpan_frag_queue, q); - -- fq->tag = arg->tag; -- fq->d_size = arg->d_size; -- fq->saddr = *arg->src; -- fq->daddr = *arg->dst; -+ BUILD_BUG_ON(sizeof(*key) > sizeof(q->key)); -+ memcpy(&q->key, key, sizeof(*key)); - } - - static void lowpan_frag_expire(unsigned long data) -@@ -93,10 +61,10 @@ static void lowpan_frag_expire(unsigned long data) - if (fq->q.flags & INET_FRAG_COMPLETE) - goto out; - -- inet_frag_kill(&fq->q, &lowpan_frags); -+ inet_frag_kill(&fq->q); - out: - spin_unlock(&fq->q.lock); -- inet_frag_put(&fq->q, &lowpan_frags); -+ inet_frag_put(&fq->q); - } - - static inline struct lowpan_frag_queue * -@@ -104,25 +72,20 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb, - const struct ieee802154_addr *src, - const struct ieee802154_addr *dst) - { -- struct inet_frag_queue *q; -- struct lowpan_create_arg arg; -- unsigned int hash; - struct netns_ieee802154_lowpan *ieee802154_lowpan = - net_ieee802154_lowpan(net); -+ struct frag_lowpan_compare_key key = {}; -+ struct inet_frag_queue *q; - -- arg.tag = cb->d_tag; -- arg.d_size = cb->d_size; -- arg.src = src; -- arg.dst = dst; -- -- hash = lowpan_hash_frag(cb->d_tag, cb->d_size, src, dst); -+ key.tag = cb->d_tag; -+ key.d_size = cb->d_size; -+ key.src = *src; -+ key.dst = *dst; - -- q = inet_frag_find(&ieee802154_lowpan->frags, -- &lowpan_frags, &arg, hash); -- if (IS_ERR_OR_NULL(q)) { -- inet_frag_maybe_warn_overflow(q, pr_fmt()); -+ q = inet_frag_find(&ieee802154_lowpan->frags, &key); -+ if (!q) - return NULL; -- } -+ - return container_of(q, struct lowpan_frag_queue, q); - } - -@@ -229,7 +192,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev, - struct sk_buff *fp, *head = fq->q.fragments; - int sum_truesize; - -- inet_frag_kill(&fq->q, &lowpan_frags); -+ inet_frag_kill(&fq->q); - - /* Make the one we just received the head. */ - if (prev) { -@@ -408,7 +371,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) - struct lowpan_frag_queue *fq; - struct net *net = dev_net(skb->dev); - struct lowpan_802154_cb *cb = lowpan_802154_cb(skb); -- struct ieee802154_hdr hdr; -+ struct ieee802154_hdr hdr = {}; - int err; - - if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) -@@ -437,7 +400,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) - ret = lowpan_frag_queue(fq, skb, frag_type); - spin_unlock(&fq->q.lock); - -- inet_frag_put(&fq->q, &lowpan_frags); -+ inet_frag_put(&fq->q); - return ret; - } - -@@ -447,24 +410,22 @@ err: - } - - #ifdef CONFIG_SYSCTL --static int zero; - - static struct ctl_table lowpan_frags_ns_ctl_table[] = { - { - .procname = "6lowpanfrag_high_thresh", - .data = &init_net.ieee802154_lowpan.frags.high_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -+ .proc_handler = proc_doulongvec_minmax, - .extra1 = &init_net.ieee802154_lowpan.frags.low_thresh - }, - { - .procname = "6lowpanfrag_low_thresh", - .data = &init_net.ieee802154_lowpan.frags.low_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero, -+ .proc_handler = proc_doulongvec_minmax, - .extra2 = &init_net.ieee802154_lowpan.frags.high_thresh - }, - { -@@ -580,14 +541,20 @@ static int __net_init lowpan_frags_init_net(struct net *net) - { - struct netns_ieee802154_lowpan *ieee802154_lowpan = - net_ieee802154_lowpan(net); -+ int res; - - ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; - ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; -+ ieee802154_lowpan->frags.f = &lowpan_frags; - -- inet_frags_init_net(&ieee802154_lowpan->frags); -- -- return lowpan_frags_ns_sysctl_register(net); -+ res = inet_frags_init_net(&ieee802154_lowpan->frags); -+ if (res < 0) -+ return res; -+ res = lowpan_frags_ns_sysctl_register(net); -+ if (res < 0) -+ inet_frags_exit_net(&ieee802154_lowpan->frags); -+ return res; - } - - static void __net_exit lowpan_frags_exit_net(struct net *net) -@@ -596,7 +563,7 @@ static void __net_exit lowpan_frags_exit_net(struct net *net) - net_ieee802154_lowpan(net); - - lowpan_frags_ns_sysctl_unregister(net); -- inet_frags_exit_net(&ieee802154_lowpan->frags, &lowpan_frags); -+ inet_frags_exit_net(&ieee802154_lowpan->frags); - } - - static struct pernet_operations lowpan_frags_ops = { -@@ -604,33 +571,64 @@ static struct pernet_operations lowpan_frags_ops = { - .exit = lowpan_frags_exit_net, - }; - --int __init lowpan_net_frag_init(void) -+static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed) - { -- int ret; -+ return jhash2(data, -+ sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); -+} - -- ret = lowpan_frags_sysctl_register(); -- if (ret) -- return ret; -+static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed) -+{ -+ const struct inet_frag_queue *fq = data; - -- ret = register_pernet_subsys(&lowpan_frags_ops); -- if (ret) -- goto err_pernet; -+ return jhash2((const u32 *)&fq->key, -+ sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); -+} -+ -+static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) -+{ -+ const struct frag_lowpan_compare_key *key = arg->key; -+ const struct inet_frag_queue *fq = ptr; -+ -+ return !!memcmp(&fq->key, key, sizeof(*key)); -+} -+ -+static const struct rhashtable_params lowpan_rhash_params = { -+ .head_offset = offsetof(struct inet_frag_queue, node), -+ .hashfn = lowpan_key_hashfn, -+ .obj_hashfn = lowpan_obj_hashfn, -+ .obj_cmpfn = lowpan_obj_cmpfn, -+ .automatic_shrinking = true, -+}; -+ -+int __init lowpan_net_frag_init(void) -+{ -+ int ret; - -- lowpan_frags.hashfn = lowpan_hashfn; - lowpan_frags.constructor = lowpan_frag_init; - lowpan_frags.destructor = NULL; - lowpan_frags.skb_free = NULL; - lowpan_frags.qsize = sizeof(struct frag_queue); -- lowpan_frags.match = lowpan_frag_match; - lowpan_frags.frag_expire = lowpan_frag_expire; - lowpan_frags.frags_cache_name = lowpan_frags_cache_name; -+ lowpan_frags.rhash_params = lowpan_rhash_params; - ret = inet_frags_init(&lowpan_frags); - if (ret) -- goto err_pernet; -+ goto out; - -+ ret = lowpan_frags_sysctl_register(); -+ if (ret) -+ goto err_sysctl; -+ -+ ret = register_pernet_subsys(&lowpan_frags_ops); -+ if (ret) -+ goto err_pernet; -+out: - return ret; - err_pernet: - lowpan_frags_sysctl_unregister(); -+err_sysctl: -+ inet_frags_fini(&lowpan_frags); - return ret; - } - -diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c -index b2001b20e029..c03e5f5859e1 100644 ---- a/net/ipv4/inet_fragment.c -+++ b/net/ipv4/inet_fragment.c -@@ -25,12 +25,6 @@ - #include - #include - --#define INETFRAGS_EVICT_BUCKETS 128 --#define INETFRAGS_EVICT_MAX 512 -- --/* don't rebuild inetfrag table with new secret more often than this */ --#define INETFRAGS_MIN_REBUILD_INTERVAL (5 * HZ) -- - /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements - * Value : 0xff if frame should be dropped. - * 0 or INET_ECN_CE value, to be ORed in to final iph->tos field -@@ -52,157 +46,8 @@ const u8 ip_frag_ecn_table[16] = { - }; - EXPORT_SYMBOL(ip_frag_ecn_table); - --static unsigned int --inet_frag_hashfn(const struct inet_frags *f, const struct inet_frag_queue *q) --{ -- return f->hashfn(q) & (INETFRAGS_HASHSZ - 1); --} -- --static bool inet_frag_may_rebuild(struct inet_frags *f) --{ -- return time_after(jiffies, -- f->last_rebuild_jiffies + INETFRAGS_MIN_REBUILD_INTERVAL); --} -- --static void inet_frag_secret_rebuild(struct inet_frags *f) --{ -- int i; -- -- write_seqlock_bh(&f->rnd_seqlock); -- -- if (!inet_frag_may_rebuild(f)) -- goto out; -- -- get_random_bytes(&f->rnd, sizeof(u32)); -- -- for (i = 0; i < INETFRAGS_HASHSZ; i++) { -- struct inet_frag_bucket *hb; -- struct inet_frag_queue *q; -- struct hlist_node *n; -- -- hb = &f->hash[i]; -- spin_lock(&hb->chain_lock); -- -- hlist_for_each_entry_safe(q, n, &hb->chain, list) { -- unsigned int hval = inet_frag_hashfn(f, q); -- -- if (hval != i) { -- struct inet_frag_bucket *hb_dest; -- -- hlist_del(&q->list); -- -- /* Relink to new hash chain. */ -- hb_dest = &f->hash[hval]; -- -- /* This is the only place where we take -- * another chain_lock while already holding -- * one. As this will not run concurrently, -- * we cannot deadlock on hb_dest lock below, if its -- * already locked it will be released soon since -- * other caller cannot be waiting for hb lock -- * that we've taken above. -- */ -- spin_lock_nested(&hb_dest->chain_lock, -- SINGLE_DEPTH_NESTING); -- hlist_add_head(&q->list, &hb_dest->chain); -- spin_unlock(&hb_dest->chain_lock); -- } -- } -- spin_unlock(&hb->chain_lock); -- } -- -- f->rebuild = false; -- f->last_rebuild_jiffies = jiffies; --out: -- write_sequnlock_bh(&f->rnd_seqlock); --} -- --static bool inet_fragq_should_evict(const struct inet_frag_queue *q) --{ -- if (!hlist_unhashed(&q->list_evictor)) -- return false; -- -- return q->net->low_thresh == 0 || -- frag_mem_limit(q->net) >= q->net->low_thresh; --} -- --static unsigned int --inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb) --{ -- struct inet_frag_queue *fq; -- struct hlist_node *n; -- unsigned int evicted = 0; -- HLIST_HEAD(expired); -- -- spin_lock(&hb->chain_lock); -- -- hlist_for_each_entry_safe(fq, n, &hb->chain, list) { -- if (!inet_fragq_should_evict(fq)) -- continue; -- -- if (!del_timer(&fq->timer)) -- continue; -- -- hlist_add_head(&fq->list_evictor, &expired); -- ++evicted; -- } -- -- spin_unlock(&hb->chain_lock); -- -- hlist_for_each_entry_safe(fq, n, &expired, list_evictor) -- f->frag_expire((unsigned long) fq); -- -- return evicted; --} -- --static void inet_frag_worker(struct work_struct *work) --{ -- unsigned int budget = INETFRAGS_EVICT_BUCKETS; -- unsigned int i, evicted = 0; -- struct inet_frags *f; -- -- f = container_of(work, struct inet_frags, frags_work); -- -- BUILD_BUG_ON(INETFRAGS_EVICT_BUCKETS >= INETFRAGS_HASHSZ); -- -- local_bh_disable(); -- -- for (i = ACCESS_ONCE(f->next_bucket); budget; --budget) { -- evicted += inet_evict_bucket(f, &f->hash[i]); -- i = (i + 1) & (INETFRAGS_HASHSZ - 1); -- if (evicted > INETFRAGS_EVICT_MAX) -- break; -- } -- -- f->next_bucket = i; -- -- local_bh_enable(); -- -- if (f->rebuild && inet_frag_may_rebuild(f)) -- inet_frag_secret_rebuild(f); --} -- --static void inet_frag_schedule_worker(struct inet_frags *f) --{ -- if (unlikely(!work_pending(&f->frags_work))) -- schedule_work(&f->frags_work); --} -- - int inet_frags_init(struct inet_frags *f) - { -- int i; -- -- INIT_WORK(&f->frags_work, inet_frag_worker); -- -- for (i = 0; i < INETFRAGS_HASHSZ; i++) { -- struct inet_frag_bucket *hb = &f->hash[i]; -- -- spin_lock_init(&hb->chain_lock); -- INIT_HLIST_HEAD(&hb->chain); -- } -- -- seqlock_init(&f->rnd_seqlock); -- f->last_rebuild_jiffies = 0; - f->frags_cachep = kmem_cache_create(f->frags_cache_name, f->qsize, 0, 0, - NULL); - if (!f->frags_cachep) -@@ -214,73 +59,53 @@ EXPORT_SYMBOL(inet_frags_init); - - void inet_frags_fini(struct inet_frags *f) - { -- cancel_work_sync(&f->frags_work); -+ /* We must wait that all inet_frag_destroy_rcu() have completed. */ -+ rcu_barrier(); -+ - kmem_cache_destroy(f->frags_cachep); -+ f->frags_cachep = NULL; - } - EXPORT_SYMBOL(inet_frags_fini); - --void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f) -+static void inet_frags_free_cb(void *ptr, void *arg) - { -- unsigned int seq; -- int i; -+ struct inet_frag_queue *fq = ptr; - -- nf->low_thresh = 0; -- --evict_again: -- local_bh_disable(); -- seq = read_seqbegin(&f->rnd_seqlock); -- -- for (i = 0; i < INETFRAGS_HASHSZ ; i++) -- inet_evict_bucket(f, &f->hash[i]); -- -- local_bh_enable(); -- cond_resched(); -- -- if (read_seqretry(&f->rnd_seqlock, seq) || -- sum_frag_mem_limit(nf)) -- goto evict_again; --} --EXPORT_SYMBOL(inet_frags_exit_net); -- --static struct inet_frag_bucket * --get_frag_bucket_locked(struct inet_frag_queue *fq, struct inet_frags *f) --__acquires(hb->chain_lock) --{ -- struct inet_frag_bucket *hb; -- unsigned int seq, hash; -- -- restart: -- seq = read_seqbegin(&f->rnd_seqlock); -- -- hash = inet_frag_hashfn(f, fq); -- hb = &f->hash[hash]; -+ /* If we can not cancel the timer, it means this frag_queue -+ * is already disappearing, we have nothing to do. -+ * Otherwise, we own a refcount until the end of this function. -+ */ -+ if (!del_timer(&fq->timer)) -+ return; - -- spin_lock(&hb->chain_lock); -- if (read_seqretry(&f->rnd_seqlock, seq)) { -- spin_unlock(&hb->chain_lock); -- goto restart; -+ spin_lock_bh(&fq->lock); -+ if (!(fq->flags & INET_FRAG_COMPLETE)) { -+ fq->flags |= INET_FRAG_COMPLETE; -+ atomic_dec(&fq->refcnt); - } -+ spin_unlock_bh(&fq->lock); - -- return hb; -+ inet_frag_put(fq); - } - --static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f) -+void inet_frags_exit_net(struct netns_frags *nf) - { -- struct inet_frag_bucket *hb; -+ nf->high_thresh = 0; /* prevent creation of new frags */ - -- hb = get_frag_bucket_locked(fq, f); -- hlist_del(&fq->list); -- fq->flags |= INET_FRAG_COMPLETE; -- spin_unlock(&hb->chain_lock); -+ rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); - } -+EXPORT_SYMBOL(inet_frags_exit_net); - --void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f) -+void inet_frag_kill(struct inet_frag_queue *fq) - { - if (del_timer(&fq->timer)) - atomic_dec(&fq->refcnt); - - if (!(fq->flags & INET_FRAG_COMPLETE)) { -- fq_unlink(fq, f); -+ struct netns_frags *nf = fq->net; -+ -+ fq->flags |= INET_FRAG_COMPLETE; -+ rhashtable_remove_fast(&nf->rhashtable, &fq->node, nf->f->rhash_params); - atomic_dec(&fq->refcnt); - } - } -@@ -294,11 +119,23 @@ static inline void frag_kfree_skb(struct netns_frags *nf, struct inet_frags *f, - kfree_skb(skb); - } - --void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) -+static void inet_frag_destroy_rcu(struct rcu_head *head) -+{ -+ struct inet_frag_queue *q = container_of(head, struct inet_frag_queue, -+ rcu); -+ struct inet_frags *f = q->net->f; -+ -+ if (f->destructor) -+ f->destructor(q); -+ kmem_cache_free(f->frags_cachep, q); -+} -+ -+void inet_frag_destroy(struct inet_frag_queue *q) - { - struct sk_buff *fp; - struct netns_frags *nf; - unsigned int sum, sum_truesize = 0; -+ struct inet_frags *f; - - WARN_ON(!(q->flags & INET_FRAG_COMPLETE)); - WARN_ON(del_timer(&q->timer) != 0); -@@ -306,64 +143,35 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) - /* Release all fragment data. */ - fp = q->fragments; - nf = q->net; -- while (fp) { -- struct sk_buff *xp = fp->next; -- -- sum_truesize += fp->truesize; -- frag_kfree_skb(nf, f, fp); -- fp = xp; -+ f = nf->f; -+ if (fp) { -+ do { -+ struct sk_buff *xp = fp->next; -+ -+ sum_truesize += fp->truesize; -+ frag_kfree_skb(nf, f, fp); -+ fp = xp; -+ } while (fp); -+ } else { -+ sum_truesize = inet_frag_rbtree_purge(&q->rb_fragments); - } - sum = sum_truesize + f->qsize; - -- if (f->destructor) -- f->destructor(q); -- kmem_cache_free(f->frags_cachep, q); -+ call_rcu(&q->rcu, inet_frag_destroy_rcu); - - sub_frag_mem_limit(nf, sum); - } - EXPORT_SYMBOL(inet_frag_destroy); - --static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, -- struct inet_frag_queue *qp_in, -- struct inet_frags *f, -- void *arg) --{ -- struct inet_frag_bucket *hb = get_frag_bucket_locked(qp_in, f); -- struct inet_frag_queue *qp; -- --#ifdef CONFIG_SMP -- /* With SMP race we have to recheck hash table, because -- * such entry could have been created on other cpu before -- * we acquired hash bucket lock. -- */ -- hlist_for_each_entry(qp, &hb->chain, list) { -- if (qp->net == nf && f->match(qp, arg)) { -- atomic_inc(&qp->refcnt); -- spin_unlock(&hb->chain_lock); -- qp_in->flags |= INET_FRAG_COMPLETE; -- inet_frag_put(qp_in, f); -- return qp; -- } -- } --#endif -- qp = qp_in; -- if (!mod_timer(&qp->timer, jiffies + nf->timeout)) -- atomic_inc(&qp->refcnt); -- -- atomic_inc(&qp->refcnt); -- hlist_add_head(&qp->list, &hb->chain); -- -- spin_unlock(&hb->chain_lock); -- -- return qp; --} -- - static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, - struct inet_frags *f, - void *arg) - { - struct inet_frag_queue *q; - -+ if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) -+ return NULL; -+ - q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); - if (!q) - return NULL; -@@ -374,75 +182,52 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, - - setup_timer(&q->timer, f->frag_expire, (unsigned long)q); - spin_lock_init(&q->lock); -- atomic_set(&q->refcnt, 1); -+ atomic_set(&q->refcnt, 3); - - return q; - } - - static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, -- struct inet_frags *f, -- void *arg) -+ void *arg, -+ struct inet_frag_queue **prev) - { -+ struct inet_frags *f = nf->f; - struct inet_frag_queue *q; - - q = inet_frag_alloc(nf, f, arg); -- if (!q) -- return NULL; -- -- return inet_frag_intern(nf, q, f, arg); --} -- --struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, -- struct inet_frags *f, void *key, -- unsigned int hash) --{ -- struct inet_frag_bucket *hb; -- struct inet_frag_queue *q; -- int depth = 0; -- -- if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { -- inet_frag_schedule_worker(f); -+ if (!q) { -+ *prev = ERR_PTR(-ENOMEM); - return NULL; - } -- -- if (frag_mem_limit(nf) > nf->low_thresh) -- inet_frag_schedule_worker(f); -- -- hash &= (INETFRAGS_HASHSZ - 1); -- hb = &f->hash[hash]; -- -- spin_lock(&hb->chain_lock); -- hlist_for_each_entry(q, &hb->chain, list) { -- if (q->net == nf && f->match(q, key)) { -- atomic_inc(&q->refcnt); -- spin_unlock(&hb->chain_lock); -- return q; -- } -- depth++; -- } -- spin_unlock(&hb->chain_lock); -- -- if (depth <= INETFRAGS_MAXDEPTH) -- return inet_frag_create(nf, f, key); -- -- if (inet_frag_may_rebuild(f)) { -- if (!f->rebuild) -- f->rebuild = true; -- inet_frag_schedule_worker(f); -+ mod_timer(&q->timer, jiffies + nf->timeout); -+ -+ *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, -+ &q->node, f->rhash_params); -+ if (*prev) { -+ q->flags |= INET_FRAG_COMPLETE; -+ inet_frag_kill(q); -+ inet_frag_destroy(q); -+ return NULL; - } -- -- return ERR_PTR(-ENOBUFS); -+ return q; - } --EXPORT_SYMBOL(inet_frag_find); -+EXPORT_SYMBOL(inet_frag_create); - --void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, -- const char *prefix) -+/* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ -+struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key) - { -- static const char msg[] = "inet_frag_find: Fragment hash bucket" -- " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) -- ". Dropping fragment.\n"; -+ struct inet_frag_queue *fq = NULL, *prev; - -- if (PTR_ERR(q) == -ENOBUFS) -- net_dbg_ratelimited("%s%s", prefix, msg); -+ rcu_read_lock(); -+ prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); -+ if (!prev) -+ fq = inet_frag_create(nf, key, &prev); -+ if (prev && !IS_ERR(prev)) { -+ fq = prev; -+ if (!atomic_inc_not_zero(&fq->refcnt)) -+ fq = NULL; -+ } -+ rcu_read_unlock(); -+ return fq; - } --EXPORT_SYMBOL(inet_frag_maybe_warn_overflow); -+EXPORT_SYMBOL(inet_frag_find); -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 72915658a6b1..9b09a9b5a4fe 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -58,27 +58,64 @@ - static int sysctl_ipfrag_max_dist __read_mostly = 64; - static const char ip_frag_cache_name[] = "ip4-frags"; - --struct ipfrag_skb_cb --{ -+/* Use skb->cb to track consecutive/adjacent fragments coming at -+ * the end of the queue. Nodes in the rb-tree queue will -+ * contain "runs" of one or more adjacent fragments. -+ * -+ * Invariants: -+ * - next_frag is NULL at the tail of a "run"; -+ * - the head of a "run" has the sum of all fragment lengths in frag_run_len. -+ */ -+struct ipfrag_skb_cb { - struct inet_skb_parm h; -- int offset; -+ struct sk_buff *next_frag; -+ int frag_run_len; - }; - --#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) -+#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) -+ -+static void ip4_frag_init_run(struct sk_buff *skb) -+{ -+ BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb)); -+ -+ FRAG_CB(skb)->next_frag = NULL; -+ FRAG_CB(skb)->frag_run_len = skb->len; -+} -+ -+/* Append skb to the last "run". */ -+static void ip4_frag_append_to_last_run(struct inet_frag_queue *q, -+ struct sk_buff *skb) -+{ -+ RB_CLEAR_NODE(&skb->rbnode); -+ FRAG_CB(skb)->next_frag = NULL; -+ -+ FRAG_CB(q->last_run_head)->frag_run_len += skb->len; -+ FRAG_CB(q->fragments_tail)->next_frag = skb; -+ q->fragments_tail = skb; -+} -+ -+/* Create a new "run" with the skb. */ -+static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb) -+{ -+ if (q->last_run_head) -+ rb_link_node(&skb->rbnode, &q->last_run_head->rbnode, -+ &q->last_run_head->rbnode.rb_right); -+ else -+ rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node); -+ rb_insert_color(&skb->rbnode, &q->rb_fragments); -+ -+ ip4_frag_init_run(skb); -+ q->fragments_tail = skb; -+ q->last_run_head = skb; -+} - - /* Describe an entry in the "incomplete datagrams" queue. */ - struct ipq { - struct inet_frag_queue q; - -- u32 user; -- __be32 saddr; -- __be32 daddr; -- __be16 id; -- u8 protocol; - u8 ecn; /* RFC3168 support */ - u16 max_df_size; /* largest frag with DF set seen */ - int iif; -- int vif; /* L3 master device index */ - unsigned int rid; - struct inet_peer *peer; - }; -@@ -90,49 +127,9 @@ static u8 ip4_frag_ecn(u8 tos) - - static struct inet_frags ip4_frags; - --int ip_frag_mem(struct net *net) --{ -- return sum_frag_mem_limit(&net->ipv4.frags); --} -- --static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, -- struct net_device *dev); -- --struct ip4_create_arg { -- struct iphdr *iph; -- u32 user; -- int vif; --}; -+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, -+ struct sk_buff *prev_tail, struct net_device *dev); - --static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) --{ -- net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); -- return jhash_3words((__force u32)id << 16 | prot, -- (__force u32)saddr, (__force u32)daddr, -- ip4_frags.rnd); --} -- --static unsigned int ip4_hashfn(const struct inet_frag_queue *q) --{ -- const struct ipq *ipq; -- -- ipq = container_of(q, struct ipq, q); -- return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol); --} -- --static bool ip4_frag_match(const struct inet_frag_queue *q, const void *a) --{ -- const struct ipq *qp; -- const struct ip4_create_arg *arg = a; -- -- qp = container_of(q, struct ipq, q); -- return qp->id == arg->iph->id && -- qp->saddr == arg->iph->saddr && -- qp->daddr == arg->iph->daddr && -- qp->protocol == arg->iph->protocol && -- qp->user == arg->user && -- qp->vif == arg->vif; --} - - static void ip4_frag_init(struct inet_frag_queue *q, const void *a) - { -@@ -141,17 +138,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a) - frags); - struct net *net = container_of(ipv4, struct net, ipv4); - -- const struct ip4_create_arg *arg = a; -+ const struct frag_v4_compare_key *key = a; - -- qp->protocol = arg->iph->protocol; -- qp->id = arg->iph->id; -- qp->ecn = ip4_frag_ecn(arg->iph->tos); -- qp->saddr = arg->iph->saddr; -- qp->daddr = arg->iph->daddr; -- qp->vif = arg->vif; -- qp->user = arg->user; -+ q->key.v4 = *key; -+ qp->ecn = 0; - qp->peer = sysctl_ipfrag_max_dist ? -- inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) : -+ inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : - NULL; - } - -@@ -169,7 +161,7 @@ static void ip4_frag_free(struct inet_frag_queue *q) - - static void ipq_put(struct ipq *ipq) - { -- inet_frag_put(&ipq->q, &ip4_frags); -+ inet_frag_put(&ipq->q); - } - - /* Kill ipq entry. It is not destroyed immediately, -@@ -177,7 +169,7 @@ static void ipq_put(struct ipq *ipq) - */ - static void ipq_kill(struct ipq *ipq) - { -- inet_frag_kill(&ipq->q, &ip4_frags); -+ inet_frag_kill(&ipq->q); - } - - static bool frag_expire_skip_icmp(u32 user) -@@ -194,8 +186,11 @@ static bool frag_expire_skip_icmp(u32 user) - */ - static void ip_expire(unsigned long arg) - { -- struct ipq *qp; -+ const struct iphdr *iph; -+ struct sk_buff *head = NULL; - struct net *net; -+ struct ipq *qp; -+ int err; - - qp = container_of((struct inet_frag_queue *) arg, struct ipq, q); - net = container_of(qp->q.net, struct net, ipv4.frags); -@@ -208,51 +203,65 @@ static void ip_expire(unsigned long arg) - - ipq_kill(qp); - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS); -+ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMTIMEOUT); - -- if (!inet_frag_evicting(&qp->q)) { -- struct sk_buff *clone, *head = qp->q.fragments; -- const struct iphdr *iph; -- int err; -- -- IP_INC_STATS_BH(net, IPSTATS_MIB_REASMTIMEOUT); -+ if (!(qp->q.flags & INET_FRAG_FIRST_IN)) -+ goto out; - -- if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) -+ /* sk_buff::dev and sk_buff::rbnode are unionized. So we -+ * pull the head out of the tree in order to be able to -+ * deal with head->dev. -+ */ -+ if (qp->q.fragments) { -+ head = qp->q.fragments; -+ qp->q.fragments = head->next; -+ } else { -+ head = skb_rb_first(&qp->q.rb_fragments); -+ if (!head) - goto out; -+ if (FRAG_CB(head)->next_frag) -+ rb_replace_node(&head->rbnode, -+ &FRAG_CB(head)->next_frag->rbnode, -+ &qp->q.rb_fragments); -+ else -+ rb_erase(&head->rbnode, &qp->q.rb_fragments); -+ memset(&head->rbnode, 0, sizeof(head->rbnode)); -+ barrier(); -+ } -+ if (head == qp->q.fragments_tail) -+ qp->q.fragments_tail = NULL; - -- head->dev = dev_get_by_index_rcu(net, qp->iif); -- if (!head->dev) -- goto out; -+ sub_frag_mem_limit(qp->q.net, head->truesize); -+ -+ head->dev = dev_get_by_index_rcu(net, qp->iif); -+ if (!head->dev) -+ goto out; - - -- /* skb has no dst, perform route lookup again */ -- iph = ip_hdr(head); -- err = ip_route_input_noref(head, iph->daddr, iph->saddr, -+ /* skb has no dst, perform route lookup again */ -+ iph = ip_hdr(head); -+ err = ip_route_input_noref(head, iph->daddr, iph->saddr, - iph->tos, head->dev); -- if (err) -- goto out; -+ if (err) -+ goto out; - -- /* Only an end host needs to send an ICMP -- * "Fragment Reassembly Timeout" message, per RFC792. -- */ -- if (frag_expire_skip_icmp(qp->user) && -- (skb_rtable(head)->rt_type != RTN_LOCAL)) -- goto out; -+ /* Only an end host needs to send an ICMP -+ * "Fragment Reassembly Timeout" message, per RFC792. -+ */ -+ if (frag_expire_skip_icmp(qp->q.key.v4.user) && -+ (skb_rtable(head)->rt_type != RTN_LOCAL)) -+ goto out; - -- clone = skb_clone(head, GFP_ATOMIC); -+ spin_unlock(&qp->q.lock); -+ icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); -+ goto out_rcu_unlock; - -- /* Send an ICMP "Fragment Reassembly Timeout" message. */ -- if (clone) { -- spin_unlock(&qp->q.lock); -- icmp_send(clone, ICMP_TIME_EXCEEDED, -- ICMP_EXC_FRAGTIME, 0); -- consume_skb(clone); -- goto out_rcu_unlock; -- } -- } - out: - spin_unlock(&qp->q.lock); - out_rcu_unlock: - rcu_read_unlock(); -+ if (head) -+ kfree_skb(head); - ipq_put(qp); - } - -@@ -262,21 +271,20 @@ out_rcu_unlock: - static struct ipq *ip_find(struct net *net, struct iphdr *iph, - u32 user, int vif) - { -+ struct frag_v4_compare_key key = { -+ .saddr = iph->saddr, -+ .daddr = iph->daddr, -+ .user = user, -+ .vif = vif, -+ .id = iph->id, -+ .protocol = iph->protocol, -+ }; - struct inet_frag_queue *q; -- struct ip4_create_arg arg; -- unsigned int hash; -- -- arg.iph = iph; -- arg.user = user; -- arg.vif = vif; -- -- hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); - -- q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); -- if (IS_ERR_OR_NULL(q)) { -- inet_frag_maybe_warn_overflow(q, pr_fmt()); -+ q = inet_frag_find(&net->ipv4.frags, &key); -+ if (!q) - return NULL; -- } -+ - return container_of(q, struct ipq, q); - } - -@@ -296,7 +304,7 @@ static int ip_frag_too_far(struct ipq *qp) - end = atomic_inc_return(&peer->rid); - qp->rid = end; - -- rc = qp->q.fragments && (end - start) > max; -+ rc = qp->q.fragments_tail && (end - start) > max; - - if (rc) { - struct net *net; -@@ -310,7 +318,6 @@ static int ip_frag_too_far(struct ipq *qp) - - static int ip_frag_reinit(struct ipq *qp) - { -- struct sk_buff *fp; - unsigned int sum_truesize = 0; - - if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) { -@@ -318,21 +325,16 @@ static int ip_frag_reinit(struct ipq *qp) - return -ETIMEDOUT; - } - -- fp = qp->q.fragments; -- do { -- struct sk_buff *xp = fp->next; -- -- sum_truesize += fp->truesize; -- kfree_skb(fp); -- fp = xp; -- } while (fp); -+ sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments); - sub_frag_mem_limit(qp->q.net, sum_truesize); - - qp->q.flags = 0; - qp->q.len = 0; - qp->q.meat = 0; - qp->q.fragments = NULL; -+ qp->q.rb_fragments = RB_ROOT; - qp->q.fragments_tail = NULL; -+ qp->q.last_run_head = NULL; - qp->iif = 0; - qp->ecn = 0; - -@@ -342,11 +344,13 @@ static int ip_frag_reinit(struct ipq *qp) - /* Add new segment to existing queue. */ - static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - { -- struct sk_buff *prev, *next; -+ struct net *net = container_of(qp->q.net, struct net, ipv4.frags); -+ struct rb_node **rbn, *parent; -+ struct sk_buff *skb1, *prev_tail; -+ int ihl, end, skb1_run_end; - struct net_device *dev; - unsigned int fragsize; - int flags, offset; -- int ihl, end; - int err = -ENOENT; - u8 ecn; - -@@ -405,94 +409,68 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) - if (err) - goto err; - -- /* Find out which fragments are in front and at the back of us -- * in the chain of fragments so far. We must know where to put -- * this fragment, right? -- */ -- prev = qp->q.fragments_tail; -- if (!prev || FRAG_CB(prev)->offset < offset) { -- next = NULL; -- goto found; -- } -- prev = NULL; -- for (next = qp->q.fragments; next != NULL; next = next->next) { -- if (FRAG_CB(next)->offset >= offset) -- break; /* bingo! */ -- prev = next; -- } -- --found: -- /* We found where to put this one. Check for overlap with -- * preceding fragment, and, if needed, align things so that -- * any overlaps are eliminated. -+ /* Note : skb->rbnode and skb->dev share the same location. */ -+ dev = skb->dev; -+ /* Makes sure compiler wont do silly aliasing games */ -+ barrier(); -+ -+ /* RFC5722, Section 4, amended by Errata ID : 3089 -+ * When reassembling an IPv6 datagram, if -+ * one or more its constituent fragments is determined to be an -+ * overlapping fragment, the entire datagram (and any constituent -+ * fragments) MUST be silently discarded. -+ * -+ * We do the same here for IPv4 (and increment an snmp counter) but -+ * we do not want to drop the whole queue in response to a duplicate -+ * fragment. - */ -- if (prev) { -- int i = (FRAG_CB(prev)->offset + prev->len) - offset; -- -- if (i > 0) { -- offset += i; -- err = -EINVAL; -- if (end <= offset) -- goto err; -- err = -ENOMEM; -- if (!pskb_pull(skb, i)) -- goto err; -- if (skb->ip_summed != CHECKSUM_UNNECESSARY) -- skb->ip_summed = CHECKSUM_NONE; -- } -- } - -- err = -ENOMEM; -- -- while (next && FRAG_CB(next)->offset < end) { -- int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ -- -- if (i < next->len) { -- /* Eat head of the next overlapped fragment -- * and leave the loop. The next ones cannot overlap. -- */ -- if (!pskb_pull(next, i)) -- goto err; -- FRAG_CB(next)->offset += i; -- qp->q.meat -= i; -- if (next->ip_summed != CHECKSUM_UNNECESSARY) -- next->ip_summed = CHECKSUM_NONE; -- break; -- } else { -- struct sk_buff *free_it = next; -- -- /* Old fragment is completely overridden with -- * new one drop it. -- */ -- next = next->next; -- -- if (prev) -- prev->next = next; -+ err = -EINVAL; -+ /* Find out where to put this fragment. */ -+ prev_tail = qp->q.fragments_tail; -+ if (!prev_tail) -+ ip4_frag_create_run(&qp->q, skb); /* First fragment. */ -+ else if (prev_tail->ip_defrag_offset + prev_tail->len < end) { -+ /* This is the common case: skb goes to the end. */ -+ /* Detect and discard overlaps. */ -+ if (offset < prev_tail->ip_defrag_offset + prev_tail->len) -+ goto discard_qp; -+ if (offset == prev_tail->ip_defrag_offset + prev_tail->len) -+ ip4_frag_append_to_last_run(&qp->q, skb); -+ else -+ ip4_frag_create_run(&qp->q, skb); -+ } else { -+ /* Binary search. Note that skb can become the first fragment, -+ * but not the last (covered above). -+ */ -+ rbn = &qp->q.rb_fragments.rb_node; -+ do { -+ parent = *rbn; -+ skb1 = rb_to_skb(parent); -+ skb1_run_end = skb1->ip_defrag_offset + -+ FRAG_CB(skb1)->frag_run_len; -+ if (end <= skb1->ip_defrag_offset) -+ rbn = &parent->rb_left; -+ else if (offset >= skb1_run_end) -+ rbn = &parent->rb_right; -+ else if (offset >= skb1->ip_defrag_offset && -+ end <= skb1_run_end) -+ goto err; /* No new data, potential duplicate */ - else -- qp->q.fragments = next; -- -- qp->q.meat -= free_it->len; -- sub_frag_mem_limit(qp->q.net, free_it->truesize); -- kfree_skb(free_it); -- } -+ goto discard_qp; /* Found an overlap */ -+ } while (*rbn); -+ /* Here we have parent properly set, and rbn pointing to -+ * one of its NULL left/right children. Insert skb. -+ */ -+ ip4_frag_init_run(skb); -+ rb_link_node(&skb->rbnode, parent, rbn); -+ rb_insert_color(&skb->rbnode, &qp->q.rb_fragments); - } - -- FRAG_CB(skb)->offset = offset; -- -- /* Insert this fragment in the chain of fragments. */ -- skb->next = next; -- if (!next) -- qp->q.fragments_tail = skb; -- if (prev) -- prev->next = skb; -- else -- qp->q.fragments = skb; -- -- dev = skb->dev; -- if (dev) { -+ if (dev) - qp->iif = dev->ifindex; -- skb->dev = NULL; -- } -+ skb->ip_defrag_offset = offset; -+ - qp->q.stamp = skb->tstamp; - qp->q.meat += skb->len; - qp->ecn |= ecn; -@@ -514,7 +492,7 @@ found: - unsigned long orefdst = skb->_skb_refdst; - - skb->_skb_refdst = 0UL; -- err = ip_frag_reasm(qp, prev, dev); -+ err = ip_frag_reasm(qp, skb, prev_tail, dev); - skb->_skb_refdst = orefdst; - return err; - } -@@ -522,20 +500,23 @@ found: - skb_dst_drop(skb); - return -EINPROGRESS; - -+discard_qp: -+ inet_frag_kill(&qp->q); -+ IP_INC_STATS_BH(net, IPSTATS_MIB_REASM_OVERLAPS); - err: - kfree_skb(skb); - return err; - } - -- - /* Build a new IP datagram from all its fragments. */ -- --static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, -- struct net_device *dev) -+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, -+ struct sk_buff *prev_tail, struct net_device *dev) - { - struct net *net = container_of(qp->q.net, struct net, ipv4.frags); - struct iphdr *iph; -- struct sk_buff *fp, *head = qp->q.fragments; -+ struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments); -+ struct sk_buff **nextp; /* To build frag_list. */ -+ struct rb_node *rbn; - int len; - int ihlen; - int err; -@@ -549,26 +530,27 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - goto out_fail; - } - /* Make the one we just received the head. */ -- if (prev) { -- head = prev->next; -- fp = skb_clone(head, GFP_ATOMIC); -+ if (head != skb) { -+ fp = skb_clone(skb, GFP_ATOMIC); - if (!fp) - goto out_nomem; -- -- fp->next = head->next; -- if (!fp->next) -+ FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag; -+ if (RB_EMPTY_NODE(&skb->rbnode)) -+ FRAG_CB(prev_tail)->next_frag = fp; -+ else -+ rb_replace_node(&skb->rbnode, &fp->rbnode, -+ &qp->q.rb_fragments); -+ if (qp->q.fragments_tail == skb) - qp->q.fragments_tail = fp; -- prev->next = fp; -- -- skb_morph(head, qp->q.fragments); -- head->next = qp->q.fragments->next; -- -- consume_skb(qp->q.fragments); -- qp->q.fragments = head; -+ skb_morph(skb, head); -+ FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag; -+ rb_replace_node(&head->rbnode, &skb->rbnode, -+ &qp->q.rb_fragments); -+ consume_skb(head); -+ head = skb; - } - -- WARN_ON(!head); -- WARN_ON(FRAG_CB(head)->offset != 0); -+ WARN_ON(head->ip_defrag_offset != 0); - - /* Allocate a new buffer for the datagram. */ - ihlen = ip_hdrlen(head); -@@ -592,35 +574,61 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - clone = alloc_skb(0, GFP_ATOMIC); - if (!clone) - goto out_nomem; -- clone->next = head->next; -- head->next = clone; - skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; - skb_frag_list_init(head); - for (i = 0; i < skb_shinfo(head)->nr_frags; i++) - plen += skb_frag_size(&skb_shinfo(head)->frags[i]); - clone->len = clone->data_len = head->data_len - plen; -- head->data_len -= clone->len; -- head->len -= clone->len; -+ head->truesize += clone->truesize; - clone->csum = 0; - clone->ip_summed = head->ip_summed; - add_frag_mem_limit(qp->q.net, clone->truesize); -+ skb_shinfo(head)->frag_list = clone; -+ nextp = &clone->next; -+ } else { -+ nextp = &skb_shinfo(head)->frag_list; - } - -- skb_shinfo(head)->frag_list = head->next; - skb_push(head, head->data - skb_network_header(head)); - -- for (fp=head->next; fp; fp = fp->next) { -- head->data_len += fp->len; -- head->len += fp->len; -- if (head->ip_summed != fp->ip_summed) -- head->ip_summed = CHECKSUM_NONE; -- else if (head->ip_summed == CHECKSUM_COMPLETE) -- head->csum = csum_add(head->csum, fp->csum); -- head->truesize += fp->truesize; -+ /* Traverse the tree in order, to build frag_list. */ -+ fp = FRAG_CB(head)->next_frag; -+ rbn = rb_next(&head->rbnode); -+ rb_erase(&head->rbnode, &qp->q.rb_fragments); -+ while (rbn || fp) { -+ /* fp points to the next sk_buff in the current run; -+ * rbn points to the next run. -+ */ -+ /* Go through the current run. */ -+ while (fp) { -+ *nextp = fp; -+ nextp = &fp->next; -+ fp->prev = NULL; -+ memset(&fp->rbnode, 0, sizeof(fp->rbnode)); -+ fp->sk = NULL; -+ head->data_len += fp->len; -+ head->len += fp->len; -+ if (head->ip_summed != fp->ip_summed) -+ head->ip_summed = CHECKSUM_NONE; -+ else if (head->ip_summed == CHECKSUM_COMPLETE) -+ head->csum = csum_add(head->csum, fp->csum); -+ head->truesize += fp->truesize; -+ fp = FRAG_CB(fp)->next_frag; -+ } -+ /* Move to the next run. */ -+ if (rbn) { -+ struct rb_node *rbnext = rb_next(rbn); -+ -+ fp = rb_to_skb(rbn); -+ rb_erase(rbn, &qp->q.rb_fragments); -+ rbn = rbnext; -+ } - } - sub_frag_mem_limit(qp->q.net, head->truesize); - -+ *nextp = NULL; - head->next = NULL; -+ head->prev = NULL; - head->dev = dev; - head->tstamp = qp->q.stamp; - IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size); -@@ -648,7 +656,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, - - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); - qp->q.fragments = NULL; -+ qp->q.rb_fragments = RB_ROOT; - qp->q.fragments_tail = NULL; -+ qp->q.last_run_head = NULL; - return 0; - - out_nomem: -@@ -656,7 +666,7 @@ out_nomem: - err = -ENOMEM; - goto out_fail; - out_oversize: -- net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr); -+ net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr); - out_fail: - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS); - return err; -@@ -734,25 +744,46 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) - } - EXPORT_SYMBOL(ip_check_defrag); - -+unsigned int inet_frag_rbtree_purge(struct rb_root *root) -+{ -+ struct rb_node *p = rb_first(root); -+ unsigned int sum = 0; -+ -+ while (p) { -+ struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); -+ -+ p = rb_next(p); -+ rb_erase(&skb->rbnode, root); -+ while (skb) { -+ struct sk_buff *next = FRAG_CB(skb)->next_frag; -+ -+ sum += skb->truesize; -+ kfree_skb(skb); -+ skb = next; -+ } -+ } -+ return sum; -+} -+EXPORT_SYMBOL(inet_frag_rbtree_purge); -+ - #ifdef CONFIG_SYSCTL --static int zero; -+static int dist_min; - - static struct ctl_table ip4_frags_ns_ctl_table[] = { - { - .procname = "ipfrag_high_thresh", - .data = &init_net.ipv4.frags.high_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -+ .proc_handler = proc_doulongvec_minmax, - .extra1 = &init_net.ipv4.frags.low_thresh - }, - { - .procname = "ipfrag_low_thresh", - .data = &init_net.ipv4.frags.low_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero, -+ .proc_handler = proc_doulongvec_minmax, - .extra2 = &init_net.ipv4.frags.high_thresh - }, - { -@@ -781,7 +812,7 @@ static struct ctl_table ip4_frags_ctl_table[] = { - .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero -+ .extra1 = &dist_min, - }, - { } - }; -@@ -853,6 +884,8 @@ static void __init ip4_frags_ctl_register(void) - - static int __net_init ipv4_frags_init_net(struct net *net) - { -+ int res; -+ - /* Fragment cache limits. - * - * The fragment memory accounting code, (tries to) account for -@@ -876,15 +909,21 @@ static int __net_init ipv4_frags_init_net(struct net *net) - */ - net->ipv4.frags.timeout = IP_FRAG_TIME; - -- inet_frags_init_net(&net->ipv4.frags); -+ net->ipv4.frags.f = &ip4_frags; - -- return ip4_frags_ns_ctl_register(net); -+ res = inet_frags_init_net(&net->ipv4.frags); -+ if (res < 0) -+ return res; -+ res = ip4_frags_ns_ctl_register(net); -+ if (res < 0) -+ inet_frags_exit_net(&net->ipv4.frags); -+ return res; - } - - static void __net_exit ipv4_frags_exit_net(struct net *net) - { - ip4_frags_ns_ctl_unregister(net); -- inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); -+ inet_frags_exit_net(&net->ipv4.frags); - } - - static struct pernet_operations ip4_frags_ops = { -@@ -892,18 +931,50 @@ static struct pernet_operations ip4_frags_ops = { - .exit = ipv4_frags_exit_net, - }; - -+ -+static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed) -+{ -+ return jhash2(data, -+ sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); -+} -+ -+static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed) -+{ -+ const struct inet_frag_queue *fq = data; -+ -+ return jhash2((const u32 *)&fq->key.v4, -+ sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); -+} -+ -+static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) -+{ -+ const struct frag_v4_compare_key *key = arg->key; -+ const struct inet_frag_queue *fq = ptr; -+ -+ return !!memcmp(&fq->key, key, sizeof(*key)); -+} -+ -+static const struct rhashtable_params ip4_rhash_params = { -+ .head_offset = offsetof(struct inet_frag_queue, node), -+ .key_offset = offsetof(struct inet_frag_queue, key), -+ .key_len = sizeof(struct frag_v4_compare_key), -+ .hashfn = ip4_key_hashfn, -+ .obj_hashfn = ip4_obj_hashfn, -+ .obj_cmpfn = ip4_obj_cmpfn, -+ .automatic_shrinking = true, -+}; -+ - void __init ipfrag_init(void) - { -- ip4_frags_ctl_register(); -- register_pernet_subsys(&ip4_frags_ops); -- ip4_frags.hashfn = ip4_hashfn; - ip4_frags.constructor = ip4_frag_init; - ip4_frags.destructor = ip4_frag_free; - ip4_frags.skb_free = NULL; - ip4_frags.qsize = sizeof(struct ipq); -- ip4_frags.match = ip4_frag_match; - ip4_frags.frag_expire = ip_expire; - ip4_frags.frags_cache_name = ip_frag_cache_name; -+ ip4_frags.rhash_params = ip4_rhash_params; - if (inet_frags_init(&ip4_frags)) - panic("IP: failed to allocate ip4_frags cache\n"); -+ ip4_frags_ctl_register(); -+ register_pernet_subsys(&ip4_frags_ops); - } -diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c -index 3abd9d7a3adf..b001ad668108 100644 ---- a/net/ipv4/proc.c -+++ b/net/ipv4/proc.c -@@ -52,7 +52,6 @@ - static int sockstat_seq_show(struct seq_file *seq, void *v) - { - struct net *net = seq->private; -- unsigned int frag_mem; - int orphans, sockets; - - local_bh_disable(); -@@ -72,8 +71,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v) - sock_prot_inuse_get(net, &udplite_prot)); - seq_printf(seq, "RAW: inuse %d\n", - sock_prot_inuse_get(net, &raw_prot)); -- frag_mem = ip_frag_mem(net); -- seq_printf(seq, "FRAG: inuse %u memory %u\n", !!frag_mem, frag_mem); -+ seq_printf(seq, "FRAG: inuse %u memory %lu\n", -+ atomic_read(&net->ipv4.frags.rhashtable.nelems), -+ frag_mem_limit(&net->ipv4.frags)); - return 0; - } - -@@ -132,6 +132,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = { - SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS), - SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS), - SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS), -+ SNMP_MIB_ITEM("ReasmOverlaps", IPSTATS_MIB_REASM_OVERLAPS), - SNMP_MIB_SENTINEL - }; - -diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c -index 5a9ae56e7868..664c84e47bab 100644 ---- a/net/ipv6/netfilter/nf_conntrack_reasm.c -+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c -@@ -64,7 +64,6 @@ struct nf_ct_frag6_skb_cb - static struct inet_frags nf_frags; - - #ifdef CONFIG_SYSCTL --static int zero; - - static struct ctl_table nf_ct_frag6_sysctl_table[] = { - { -@@ -77,18 +76,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { - { - .procname = "nf_conntrack_frag6_low_thresh", - .data = &init_net.nf_frag.frags.low_thresh, -- .maxlen = sizeof(unsigned int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero, -+ .proc_handler = proc_doulongvec_minmax, - .extra2 = &init_net.nf_frag.frags.high_thresh - }, - { - .procname = "nf_conntrack_frag6_high_thresh", - .data = &init_net.nf_frag.frags.high_thresh, -- .maxlen = sizeof(unsigned int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -+ .proc_handler = proc_doulongvec_minmax, - .extra1 = &init_net.nf_frag.frags.low_thresh - }, - { } -@@ -153,23 +151,6 @@ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h) - return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK); - } - --static unsigned int nf_hash_frag(__be32 id, const struct in6_addr *saddr, -- const struct in6_addr *daddr) --{ -- net_get_random_once(&nf_frags.rnd, sizeof(nf_frags.rnd)); -- return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), -- (__force u32)id, nf_frags.rnd); --} -- -- --static unsigned int nf_hashfn(const struct inet_frag_queue *q) --{ -- const struct frag_queue *nq; -- -- nq = container_of(q, struct frag_queue, q); -- return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr); --} -- - static void nf_skb_free(struct sk_buff *skb) - { - if (NFCT_FRAG6_CB(skb)->orig) -@@ -184,34 +165,26 @@ static void nf_ct_frag6_expire(unsigned long data) - fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); - net = container_of(fq->q.net, struct net, nf_frag.frags); - -- ip6_expire_frag_queue(net, fq, &nf_frags); -+ ip6_expire_frag_queue(net, fq); - } - - /* Creation primitives. */ --static inline struct frag_queue *fq_find(struct net *net, __be32 id, -- u32 user, struct in6_addr *src, -- struct in6_addr *dst, int iif, u8 ecn) -+static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, -+ const struct ipv6hdr *hdr, int iif) - { -+ struct frag_v6_compare_key key = { -+ .id = id, -+ .saddr = hdr->saddr, -+ .daddr = hdr->daddr, -+ .user = user, -+ .iif = iif, -+ }; - struct inet_frag_queue *q; -- struct ip6_create_arg arg; -- unsigned int hash; -- -- arg.id = id; -- arg.user = user; -- arg.src = src; -- arg.dst = dst; -- arg.iif = iif; -- arg.ecn = ecn; -- -- local_bh_disable(); -- hash = nf_hash_frag(id, src, dst); -- -- q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash); -- local_bh_enable(); -- if (IS_ERR_OR_NULL(q)) { -- inet_frag_maybe_warn_overflow(q, pr_fmt()); -+ -+ q = inet_frag_find(&net->nf_frag.frags, &key); -+ if (!q) - return NULL; -- } -+ - return container_of(q, struct frag_queue, q); - } - -@@ -362,7 +335,7 @@ found: - return 0; - - discard_fq: -- inet_frag_kill(&fq->q, &nf_frags); -+ inet_frag_kill(&fq->q); - err: - return -1; - } -@@ -383,7 +356,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev) - int payload_len; - u8 ecn; - -- inet_frag_kill(&fq->q, &nf_frags); -+ inet_frag_kill(&fq->q); - - WARN_ON(head == NULL); - WARN_ON(NFCT_FRAG6_CB(head)->offset != 0); -@@ -454,6 +427,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev) - else if (head->ip_summed == CHECKSUM_COMPLETE) - head->csum = csum_add(head->csum, fp->csum); - head->truesize += fp->truesize; -+ fp->sk = NULL; - } - sub_frag_mem_limit(fq->q.net, head->truesize); - -@@ -472,6 +446,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev) - head->csum); - - fq->q.fragments = NULL; -+ fq->q.rb_fragments = RB_ROOT; - fq->q.fragments_tail = NULL; - - /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */ -@@ -601,9 +576,13 @@ struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 use - hdr = ipv6_hdr(clone); - fhdr = (struct frag_hdr *)skb_transport_header(clone); - -+ if (clone->len - skb_network_offset(clone) < IPV6_MIN_MTU && -+ fhdr->frag_off & htons(IP6_MF)) -+ goto ret_orig; -+ - skb_orphan(skb); -- fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, -- skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); -+ fq = fq_find(net, fhdr->identification, user, hdr, -+ skb->dev ? skb->dev->ifindex : 0); - if (fq == NULL) { - pr_debug("Can't find and can't create new queue\n"); - goto ret_orig; -@@ -614,7 +593,7 @@ struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 use - if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) { - spin_unlock_bh(&fq->q.lock); - pr_debug("Can't insert skb to queue\n"); -- inet_frag_put(&fq->q, &nf_frags); -+ inet_frag_put(&fq->q); - goto ret_orig; - } - -@@ -626,7 +605,7 @@ struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 use - } - spin_unlock_bh(&fq->q.lock); - -- inet_frag_put(&fq->q, &nf_frags); -+ inet_frag_put(&fq->q); - return ret_skb; - - ret_orig: -@@ -650,18 +629,26 @@ EXPORT_SYMBOL_GPL(nf_ct_frag6_consume_orig); - - static int nf_ct_net_init(struct net *net) - { -+ int res; -+ - net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; - net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; -- inet_frags_init_net(&net->nf_frag.frags); -- -- return nf_ct_frag6_sysctl_register(net); -+ net->nf_frag.frags.f = &nf_frags; -+ -+ res = inet_frags_init_net(&net->nf_frag.frags); -+ if (res < 0) -+ return res; -+ res = nf_ct_frag6_sysctl_register(net); -+ if (res < 0) -+ inet_frags_exit_net(&net->nf_frag.frags); -+ return res; - } - - static void nf_ct_net_exit(struct net *net) - { - nf_ct_frags6_sysctl_unregister(net); -- inet_frags_exit_net(&net->nf_frag.frags, &nf_frags); -+ inet_frags_exit_net(&net->nf_frag.frags); - } - - static struct pernet_operations nf_ct_net_ops = { -@@ -673,14 +660,13 @@ int nf_ct_frag6_init(void) - { - int ret = 0; - -- nf_frags.hashfn = nf_hashfn; - nf_frags.constructor = ip6_frag_init; - nf_frags.destructor = NULL; - nf_frags.skb_free = nf_skb_free; - nf_frags.qsize = sizeof(struct frag_queue); -- nf_frags.match = ip6_frag_match; - nf_frags.frag_expire = nf_ct_frag6_expire; - nf_frags.frags_cache_name = nf_frags_cache_name; -+ nf_frags.rhash_params = ip6_rhash_params; - ret = inet_frags_init(&nf_frags); - if (ret) - goto out; -diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c -index 679253d0af84..73e766e7bc37 100644 ---- a/net/ipv6/proc.c -+++ b/net/ipv6/proc.c -@@ -33,7 +33,6 @@ - static int sockstat6_seq_show(struct seq_file *seq, void *v) - { - struct net *net = seq->private; -- unsigned int frag_mem = ip6_frag_mem(net); - - seq_printf(seq, "TCP6: inuse %d\n", - sock_prot_inuse_get(net, &tcpv6_prot)); -@@ -43,7 +42,9 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v) - sock_prot_inuse_get(net, &udplitev6_prot)); - seq_printf(seq, "RAW6: inuse %d\n", - sock_prot_inuse_get(net, &rawv6_prot)); -- seq_printf(seq, "FRAG6: inuse %u memory %u\n", !!frag_mem, frag_mem); -+ seq_printf(seq, "FRAG6: inuse %u memory %lu\n", -+ atomic_read(&net->ipv6.frags.rhashtable.nelems), -+ frag_mem_limit(&net->ipv6.frags)); - return 0; - } - -diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c -index 58f2139ebb5e..ec917f58d105 100644 ---- a/net/ipv6/reassembly.c -+++ b/net/ipv6/reassembly.c -@@ -79,94 +79,58 @@ static struct inet_frags ip6_frags; - static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, - struct net_device *dev); - --/* -- * callers should be careful not to use the hash value outside the ipfrag_lock -- * as doing so could race with ipfrag_hash_rnd being recalculated. -- */ --static unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, -- const struct in6_addr *daddr) --{ -- net_get_random_once(&ip6_frags.rnd, sizeof(ip6_frags.rnd)); -- return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), -- (__force u32)id, ip6_frags.rnd); --} -- --static unsigned int ip6_hashfn(const struct inet_frag_queue *q) --{ -- const struct frag_queue *fq; -- -- fq = container_of(q, struct frag_queue, q); -- return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr); --} -- --bool ip6_frag_match(const struct inet_frag_queue *q, const void *a) --{ -- const struct frag_queue *fq; -- const struct ip6_create_arg *arg = a; -- -- fq = container_of(q, struct frag_queue, q); -- return fq->id == arg->id && -- fq->user == arg->user && -- ipv6_addr_equal(&fq->saddr, arg->src) && -- ipv6_addr_equal(&fq->daddr, arg->dst) && -- (arg->iif == fq->iif || -- !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | -- IPV6_ADDR_LINKLOCAL))); --} --EXPORT_SYMBOL(ip6_frag_match); -- - void ip6_frag_init(struct inet_frag_queue *q, const void *a) - { - struct frag_queue *fq = container_of(q, struct frag_queue, q); -- const struct ip6_create_arg *arg = a; -+ const struct frag_v6_compare_key *key = a; - -- fq->id = arg->id; -- fq->user = arg->user; -- fq->saddr = *arg->src; -- fq->daddr = *arg->dst; -- fq->ecn = arg->ecn; -+ q->key.v6 = *key; -+ fq->ecn = 0; - } - EXPORT_SYMBOL(ip6_frag_init); - --void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, -- struct inet_frags *frags) -+void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq) - { - struct net_device *dev = NULL; -+ struct sk_buff *head; - -+ rcu_read_lock(); - spin_lock(&fq->q.lock); - - if (fq->q.flags & INET_FRAG_COMPLETE) - goto out; - -- inet_frag_kill(&fq->q, frags); -+ inet_frag_kill(&fq->q); - -- rcu_read_lock(); - dev = dev_get_by_index_rcu(net, fq->iif); - if (!dev) -- goto out_rcu_unlock; -+ goto out; - - IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); -- -- if (inet_frag_evicting(&fq->q)) -- goto out_rcu_unlock; -- - IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); - - /* Don't send error if the first segment did not arrive. */ -- if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !fq->q.fragments) -- goto out_rcu_unlock; -+ head = fq->q.fragments; -+ if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !head) -+ goto out; - - /* But use as source device on which LAST ARRIVED - * segment was received. And do not use fq->dev - * pointer directly, device might already disappeared. - */ -- fq->q.fragments->dev = dev; -- icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); --out_rcu_unlock: -- rcu_read_unlock(); -+ head->dev = dev; -+ skb_get(head); -+ spin_unlock(&fq->q.lock); -+ -+ icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); -+ kfree_skb(head); -+ goto out_rcu_unlock; -+ - out: - spin_unlock(&fq->q.lock); -- inet_frag_put(&fq->q, frags); -+out_rcu_unlock: -+ rcu_read_unlock(); -+ inet_frag_put(&fq->q); - } - EXPORT_SYMBOL(ip6_expire_frag_queue); - -@@ -178,31 +142,29 @@ static void ip6_frag_expire(unsigned long data) - fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); - net = container_of(fq->q.net, struct net, ipv6.frags); - -- ip6_expire_frag_queue(net, fq, &ip6_frags); -+ ip6_expire_frag_queue(net, fq); - } - - static struct frag_queue * --fq_find(struct net *net, __be32 id, const struct in6_addr *src, -- const struct in6_addr *dst, int iif, u8 ecn) -+fq_find(struct net *net, __be32 id, const struct ipv6hdr *hdr, int iif) - { -+ struct frag_v6_compare_key key = { -+ .id = id, -+ .saddr = hdr->saddr, -+ .daddr = hdr->daddr, -+ .user = IP6_DEFRAG_LOCAL_DELIVER, -+ .iif = iif, -+ }; - struct inet_frag_queue *q; -- struct ip6_create_arg arg; -- unsigned int hash; - -- arg.id = id; -- arg.user = IP6_DEFRAG_LOCAL_DELIVER; -- arg.src = src; -- arg.dst = dst; -- arg.iif = iif; -- arg.ecn = ecn; -+ if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | -+ IPV6_ADDR_LINKLOCAL))) -+ key.iif = 0; - -- hash = inet6_hash_frag(id, src, dst); -- -- q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); -- if (IS_ERR_OR_NULL(q)) { -- inet_frag_maybe_warn_overflow(q, pr_fmt()); -+ q = inet_frag_find(&net->ipv6.frags, &key); -+ if (!q) - return NULL; -- } -+ - return container_of(q, struct frag_queue, q); - } - -@@ -359,7 +321,7 @@ found: - return -1; - - discard_fq: -- inet_frag_kill(&fq->q, &ip6_frags); -+ inet_frag_kill(&fq->q); - err: - IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), - IPSTATS_MIB_REASMFAILS); -@@ -386,7 +348,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, - int sum_truesize; - u8 ecn; - -- inet_frag_kill(&fq->q, &ip6_frags); -+ inet_frag_kill(&fq->q); - - ecn = ip_frag_ecn_table[fq->ecn]; - if (unlikely(ecn == 0xff)) -@@ -503,6 +465,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, - IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS); - rcu_read_unlock(); - fq->q.fragments = NULL; -+ fq->q.rb_fragments = RB_ROOT; - fq->q.fragments_tail = NULL; - return 1; - -@@ -524,6 +487,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) - struct frag_queue *fq; - const struct ipv6hdr *hdr = ipv6_hdr(skb); - struct net *net = dev_net(skb_dst(skb)->dev); -+ int iif; - - if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) - goto fail_hdr; -@@ -552,17 +516,22 @@ static int ipv6_frag_rcv(struct sk_buff *skb) - return 1; - } - -- fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, -- skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); -+ if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && -+ fhdr->frag_off & htons(IP6_MF)) -+ goto fail_hdr; -+ -+ iif = skb->dev ? skb->dev->ifindex : 0; -+ fq = fq_find(net, fhdr->identification, hdr, iif); - if (fq) { - int ret; - - spin_lock(&fq->q.lock); - -+ fq->iif = iif; - ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); - - spin_unlock(&fq->q.lock); -- inet_frag_put(&fq->q, &ip6_frags); -+ inet_frag_put(&fq->q); - return ret; - } - -@@ -583,24 +552,22 @@ static const struct inet6_protocol frag_protocol = { - }; - - #ifdef CONFIG_SYSCTL --static int zero; - - static struct ctl_table ip6_frags_ns_ctl_table[] = { - { - .procname = "ip6frag_high_thresh", - .data = &init_net.ipv6.frags.high_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -+ .proc_handler = proc_doulongvec_minmax, - .extra1 = &init_net.ipv6.frags.low_thresh - }, - { - .procname = "ip6frag_low_thresh", - .data = &init_net.ipv6.frags.low_thresh, -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero, -+ .proc_handler = proc_doulongvec_minmax, - .extra2 = &init_net.ipv6.frags.high_thresh - }, - { -@@ -708,19 +675,27 @@ static void ip6_frags_sysctl_unregister(void) - - static int __net_init ipv6_frags_init_net(struct net *net) - { -+ int res; -+ - net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; - net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; -+ net->ipv6.frags.f = &ip6_frags; - -- inet_frags_init_net(&net->ipv6.frags); -+ res = inet_frags_init_net(&net->ipv6.frags); -+ if (res < 0) -+ return res; - -- return ip6_frags_ns_sysctl_register(net); -+ res = ip6_frags_ns_sysctl_register(net); -+ if (res < 0) -+ inet_frags_exit_net(&net->ipv6.frags); -+ return res; - } - - static void __net_exit ipv6_frags_exit_net(struct net *net) - { - ip6_frags_ns_sysctl_unregister(net); -- inet_frags_exit_net(&net->ipv6.frags, &ip6_frags); -+ inet_frags_exit_net(&net->ipv6.frags); - } - - static struct pernet_operations ip6_frags_ops = { -@@ -728,14 +703,55 @@ static struct pernet_operations ip6_frags_ops = { - .exit = ipv6_frags_exit_net, - }; - -+static u32 ip6_key_hashfn(const void *data, u32 len, u32 seed) -+{ -+ return jhash2(data, -+ sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); -+} -+ -+static u32 ip6_obj_hashfn(const void *data, u32 len, u32 seed) -+{ -+ const struct inet_frag_queue *fq = data; -+ -+ return jhash2((const u32 *)&fq->key.v6, -+ sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); -+} -+ -+static int ip6_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) -+{ -+ const struct frag_v6_compare_key *key = arg->key; -+ const struct inet_frag_queue *fq = ptr; -+ -+ return !!memcmp(&fq->key, key, sizeof(*key)); -+} -+ -+const struct rhashtable_params ip6_rhash_params = { -+ .head_offset = offsetof(struct inet_frag_queue, node), -+ .hashfn = ip6_key_hashfn, -+ .obj_hashfn = ip6_obj_hashfn, -+ .obj_cmpfn = ip6_obj_cmpfn, -+ .automatic_shrinking = true, -+}; -+EXPORT_SYMBOL(ip6_rhash_params); -+ - int __init ipv6_frag_init(void) - { - int ret; - -- ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); -+ ip6_frags.constructor = ip6_frag_init; -+ ip6_frags.destructor = NULL; -+ ip6_frags.qsize = sizeof(struct frag_queue); -+ ip6_frags.frag_expire = ip6_frag_expire; -+ ip6_frags.frags_cache_name = ip6_frag_cache_name; -+ ip6_frags.rhash_params = ip6_rhash_params; -+ ret = inet_frags_init(&ip6_frags); - if (ret) - goto out; - -+ ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); -+ if (ret) -+ goto err_protocol; -+ - ret = ip6_frags_sysctl_register(); - if (ret) - goto err_sysctl; -@@ -744,17 +760,6 @@ int __init ipv6_frag_init(void) - if (ret) - goto err_pernet; - -- ip6_frags.hashfn = ip6_hashfn; -- ip6_frags.constructor = ip6_frag_init; -- ip6_frags.destructor = NULL; -- ip6_frags.skb_free = NULL; -- ip6_frags.qsize = sizeof(struct frag_queue); -- ip6_frags.match = ip6_frag_match; -- ip6_frags.frag_expire = ip6_frag_expire; -- ip6_frags.frags_cache_name = ip6_frag_cache_name; -- ret = inet_frags_init(&ip6_frags); -- if (ret) -- goto err_pernet; - out: - return ret; - -@@ -762,6 +767,8 @@ err_pernet: - ip6_frags_sysctl_unregister(); - err_sysctl: - inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); -+err_protocol: -+ inet_frags_fini(&ip6_frags); - goto out; - } - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.174-175.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.174-175.patch deleted file mode 100644 index 0dc0f45078af..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.174-175.patch +++ /dev/null @@ -1,3518 +0,0 @@ -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 7c229f59016f..2fb35658d151 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -116,7 +116,7 @@ ipfrag_high_thresh - LONG INTEGER - Maximum memory used to reassemble IP fragments. - - ipfrag_low_thresh - LONG INTEGER -- (Obsolete since linux-4.17) -+ (Obsolete since linux-4.4.174, backported from linux-4.17) - Maximum memory used to reassemble IP fragments before the kernel - begins to remove incomplete fragment queues to free up resources. - The kernel still accepts new fragments for defragmentation. -diff --git a/Makefile b/Makefile -index 1fa281069379..5f0bdef2af99 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 174 -+SUBLEVEL = 175 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/include/asm/irq.h b/arch/alpha/include/asm/irq.h -index 06377400dc09..469642801a68 100644 ---- a/arch/alpha/include/asm/irq.h -+++ b/arch/alpha/include/asm/irq.h -@@ -55,15 +55,15 @@ - - #elif defined(CONFIG_ALPHA_DP264) || \ - defined(CONFIG_ALPHA_LYNX) || \ -- defined(CONFIG_ALPHA_SHARK) || \ -- defined(CONFIG_ALPHA_EIGER) -+ defined(CONFIG_ALPHA_SHARK) - # define NR_IRQS 64 - - #elif defined(CONFIG_ALPHA_TITAN) - #define NR_IRQS 80 - - #elif defined(CONFIG_ALPHA_RAWHIDE) || \ -- defined(CONFIG_ALPHA_TAKARA) -+ defined(CONFIG_ALPHA_TAKARA) || \ -+ defined(CONFIG_ALPHA_EIGER) - # define NR_IRQS 128 - - #elif defined(CONFIG_ALPHA_WILDFIRE) -diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c -index 4a905bd667e2..0f68f0de9b5e 100644 ---- a/arch/alpha/mm/fault.c -+++ b/arch/alpha/mm/fault.c -@@ -77,7 +77,7 @@ __load_new_mm_context(struct mm_struct *next_mm) - /* Macro for exception fixup code to access integer registers. */ - #define dpf_reg(r) \ - (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \ -- (r) <= 18 ? (r)+8 : (r)-10]) -+ (r) <= 18 ? (r)+10 : (r)-10]) - - asmlinkage void - do_page_fault(unsigned long address, unsigned long mmcsr, -diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts -index 6881757b03e8..67369f284b91 100644 ---- a/arch/arm/boot/dts/da850-evm.dts -+++ b/arch/arm/boot/dts/da850-evm.dts -@@ -147,7 +147,7 @@ - - sound { - compatible = "simple-audio-card"; -- simple-audio-card,name = "DA850/OMAP-L138 EVM"; -+ simple-audio-card,name = "DA850-OMAPL138 EVM"; - simple-audio-card,widgets = - "Line", "Line In", - "Line", "Line Out"; -diff --git a/arch/arm/boot/dts/kirkwood-dnskw.dtsi b/arch/arm/boot/dts/kirkwood-dnskw.dtsi -index 113dcf056dcf..1b2dacfa6132 100644 ---- a/arch/arm/boot/dts/kirkwood-dnskw.dtsi -+++ b/arch/arm/boot/dts/kirkwood-dnskw.dtsi -@@ -35,8 +35,8 @@ - compatible = "gpio-fan"; - pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>; - pinctrl-names = "default"; -- gpios = <&gpio1 14 GPIO_ACTIVE_LOW -- &gpio1 13 GPIO_ACTIVE_LOW>; -+ gpios = <&gpio1 14 GPIO_ACTIVE_HIGH -+ &gpio1 13 GPIO_ACTIVE_HIGH>; - gpio-fan,speed-map = <0 0 - 3000 1 - 6000 2>; -diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi -index 766bbb8495b6..47e5b63339d1 100644 ---- a/arch/arm/boot/dts/mmp2.dtsi -+++ b/arch/arm/boot/dts/mmp2.dtsi -@@ -220,12 +220,15 @@ - status = "disabled"; - }; - -- twsi2: i2c@d4025000 { -+ twsi2: i2c@d4031000 { - compatible = "mrvl,mmp-twsi"; -- reg = <0xd4025000 0x1000>; -- interrupts = <58>; -+ reg = <0xd4031000 0x1000>; -+ interrupt-parent = <&intcmux17>; -+ interrupts = <0>; - clocks = <&soc_clocks MMP2_CLK_TWSI1>; - resets = <&soc_clocks MMP2_CLK_TWSI1>; -+ #address-cells = <1>; -+ #size-cells = <0>; - status = "disabled"; - }; - -diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts -index f0bdc41f8eff..235d1493f8aa 100644 ---- a/arch/arm/boot/dts/omap4-sdp.dts -+++ b/arch/arm/boot/dts/omap4-sdp.dts -@@ -33,6 +33,7 @@ - gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>; /* gpio line 48 */ - enable-active-high; - regulator-boot-on; -+ startup-delay-us = <25000>; - }; - - vbat: fixedregulator-vbat { -diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index b26361355dae..e42be5800f37 100644 ---- a/arch/arm/kernel/smp.c -+++ b/arch/arm/kernel/smp.c -@@ -687,6 +687,21 @@ void smp_send_stop(void) - pr_warn("SMP: failed to stop secondary CPUs\n"); - } - -+/* In case panic() and panic() called at the same time on CPU1 and CPU2, -+ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop() -+ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online, -+ * kdump fails. So split out the panic_smp_self_stop() and add -+ * set_cpu_online(smp_processor_id(), false). -+ */ -+void panic_smp_self_stop(void) -+{ -+ pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n", -+ smp_processor_id()); -+ set_cpu_online(smp_processor_id(), false); -+ while (1) -+ cpu_relax(); -+} -+ - /* - * not supported here - */ -diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c -index 387ee2a11e36..885cd0e0015b 100644 ---- a/arch/arm/kvm/mmio.c -+++ b/arch/arm/kvm/mmio.c -@@ -118,6 +118,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) - vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data); - } - -+ /* -+ * The MMIO instruction is emulated and should not be re-executed -+ * in the guest. -+ */ -+ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); -+ - return 0; - } - -@@ -151,11 +157,6 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len) - vcpu->arch.mmio_decode.sign_extend = sign_extend; - vcpu->arch.mmio_decode.rt = rt; - -- /* -- * The MMIO instruction is emulated and should not be re-executed -- * in the guest. -- */ -- kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); - return 0; - } - -diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c -index 38b0da300dd5..423a88ff908c 100644 ---- a/arch/arm/mach-integrator/impd1.c -+++ b/arch/arm/mach-integrator/impd1.c -@@ -394,7 +394,11 @@ static int __init_refok impd1_probe(struct lm_device *dev) - sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup), - GFP_KERNEL); - chipname = devm_kstrdup(&dev->dev, devname, GFP_KERNEL); -- mmciname = kasprintf(GFP_KERNEL, "lm%x:00700", dev->id); -+ mmciname = devm_kasprintf(&dev->dev, GFP_KERNEL, -+ "lm%x:00700", dev->id); -+ if (!lookup || !chipname || !mmciname) -+ return -ENOMEM; -+ - lookup->dev_id = mmciname; - /* - * Offsets on GPIO block 1: -diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c -index c1cd80ecc219..a904244264ce 100644 ---- a/arch/arm/mach-iop32x/n2100.c -+++ b/arch/arm/mach-iop32x/n2100.c -@@ -75,8 +75,7 @@ void __init n2100_map_io(void) - /* - * N2100 PCI. - */ --static int __init --n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) -+static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin) - { - int irq; - -diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index 147c90e70b2e..36706d32d656 100644 ---- a/arch/arm/mach-omap2/omap_hwmod.c -+++ b/arch/arm/mach-omap2/omap_hwmod.c -@@ -2526,7 +2526,7 @@ static int __init _init(struct omap_hwmod *oh, void *data) - * a stub; implementing this properly requires iclk autoidle usecounting in - * the clock code. No return value. - */ --static void __init _setup_iclk_autoidle(struct omap_hwmod *oh) -+static void _setup_iclk_autoidle(struct omap_hwmod *oh) - { - struct omap_hwmod_ocp_if *os; - struct list_head *p; -@@ -2561,7 +2561,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh) - * reset. Returns 0 upon success or a negative error code upon - * failure. - */ --static int __init _setup_reset(struct omap_hwmod *oh) -+static int _setup_reset(struct omap_hwmod *oh) - { - int r; - -@@ -2622,7 +2622,7 @@ static int __init _setup_reset(struct omap_hwmod *oh) - * - * No return value. - */ --static void __init _setup_postsetup(struct omap_hwmod *oh) -+static void _setup_postsetup(struct omap_hwmod *oh) - { - u8 postsetup_state; - -diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c -index a7dae60810e8..307fc18edede 100644 ---- a/arch/arm/mach-pxa/cm-x300.c -+++ b/arch/arm/mach-pxa/cm-x300.c -@@ -547,7 +547,7 @@ static struct pxa3xx_u2d_platform_data cm_x300_u2d_platform_data = { - .exit = cm_x300_u2d_exit, - }; - --static void cm_x300_init_u2d(void) -+static void __init cm_x300_init_u2d(void) - { - pxa3xx_set_u2d_info(&cm_x300_u2d_platform_data); - } -diff --git a/arch/arm/mach-pxa/littleton.c b/arch/arm/mach-pxa/littleton.c -index 5d665588c7eb..05aa7071efd6 100644 ---- a/arch/arm/mach-pxa/littleton.c -+++ b/arch/arm/mach-pxa/littleton.c -@@ -183,7 +183,7 @@ static struct pxafb_mach_info littleton_lcd_info = { - .lcd_conn = LCD_COLOR_TFT_16BPP, - }; - --static void littleton_init_lcd(void) -+static void __init littleton_init_lcd(void) - { - pxa_set_fb_info(NULL, &littleton_lcd_info); - } -diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c -index d757cfb5f8a6..4da2458d7f32 100644 ---- a/arch/arm/mach-pxa/zeus.c -+++ b/arch/arm/mach-pxa/zeus.c -@@ -558,7 +558,7 @@ static struct pxaohci_platform_data zeus_ohci_platform_data = { - .flags = ENABLE_PORT_ALL | POWER_SENSE_LOW, - }; - --static void zeus_register_ohci(void) -+static void __init zeus_register_ohci(void) - { - /* Port 2 is shared between host and client interface. */ - UP2OCR = UP2OCR_HXOE | UP2OCR_HXS | UP2OCR_DMPDE | UP2OCR_DPPDE; -diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S -index 0f03a8fe2314..d18d15810d19 100644 ---- a/arch/arm64/kernel/entry-ftrace.S -+++ b/arch/arm64/kernel/entry-ftrace.S -@@ -78,7 +78,6 @@ - .macro mcount_get_lr reg - ldr \reg, [x29] - ldr \reg, [\reg, #8] -- mcount_adjust_addr \reg, \reg - .endm - - .macro mcount_get_lr_addr reg -diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h -index 1b6f2f219298..9db764b51ffe 100644 ---- a/arch/mips/include/uapi/asm/inst.h -+++ b/arch/mips/include/uapi/asm/inst.h -@@ -290,8 +290,8 @@ enum mm_32a_minor_op { - mm_ext_op = 0x02c, - mm_pool32axf_op = 0x03c, - mm_srl32_op = 0x040, -+ mm_srlv32_op = 0x050, - mm_sra_op = 0x080, -- mm_srlv32_op = 0x090, - mm_rotr_op = 0x0c0, - mm_lwxs_op = 0x118, - mm_addu32_op = 0x150, -diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c -index 1448c1f43d4e..76f18c56141c 100644 ---- a/arch/mips/kernel/mips-cm.c -+++ b/arch/mips/kernel/mips-cm.c -@@ -424,5 +424,5 @@ void mips_cm_error_report(void) - } - - /* reprime cause register */ -- write_gcr_error_cause(0); -+ write_gcr_error_cause(cm_error); - } -diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c -index c258cd406fbb..b36bbda31058 100644 ---- a/arch/mips/pci/pci-octeon.c -+++ b/arch/mips/pci/pci-octeon.c -@@ -571,6 +571,11 @@ static int __init octeon_pci_setup(void) - if (octeon_has_feature(OCTEON_FEATURE_PCIE)) - return 0; - -+ if (!octeon_is_pci_host()) { -+ pr_notice("Not in host mode, PCI Controller not initialized\n"); -+ return 0; -+ } -+ - /* Point pcibios_map_irq() to the PCI version of it */ - octeon_pcibios_map_irq = octeon_pci_pcibios_map_irq; - -@@ -582,11 +587,6 @@ static int __init octeon_pci_setup(void) - else - octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_BIG; - -- if (!octeon_is_pci_host()) { -- pr_notice("Not in host mode, PCI Controller not initialized\n"); -- return 0; -- } -- - /* PCI I/O and PCI MEM values */ - set_io_port_base(OCTEON_PCI_IOSPACE_BASE); - ioport_resource.start = 0; -diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile -index 6c7d78546eee..886005b1e87d 100644 ---- a/arch/mips/vdso/Makefile -+++ b/arch/mips/vdso/Makefile -@@ -107,7 +107,7 @@ $(obj)/%-o32.o: $(src)/%.c FORCE - $(call cmd,force_checksrc) - $(call if_changed_rule,cc_o_c) - --$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := -mabi=32 -+$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=32 - $(obj)/vdso-o32.lds: $(src)/vdso.lds.S FORCE - $(call if_changed_dep,cpp_lds_S) - -@@ -143,7 +143,7 @@ $(obj)/%-n32.o: $(src)/%.c FORCE - $(call cmd,force_checksrc) - $(call if_changed_rule,cc_o_c) - --$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := -mabi=n32 -+$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=n32 - $(obj)/vdso-n32.lds: $(src)/vdso.lds.S FORCE - $(call if_changed_dep,cpp_lds_S) - -diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index a5ffe0207c16..05f1389228d2 100644 ---- a/arch/powerpc/include/asm/uaccess.h -+++ b/arch/powerpc/include/asm/uaccess.h -@@ -59,7 +59,7 @@ - #endif - - #define access_ok(type, addr, size) \ -- (__chk_user_ptr(addr), \ -+ (__chk_user_ptr(addr), (void)(type), \ - __access_ok((__force unsigned long)(addr), (size), get_fs())) - - /* -diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c -index 96536c969c9c..a8efed3b4691 100644 ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -280,6 +280,8 @@ int dlpar_detach_node(struct device_node *dn) - if (rc) - return rc; - -+ of_node_put(dn); -+ - return 0; - } - -diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h -index 18eb9924dda3..aeb430212947 100644 ---- a/arch/um/include/asm/pgtable.h -+++ b/arch/um/include/asm/pgtable.h -@@ -197,12 +197,17 @@ static inline pte_t pte_mkold(pte_t pte) - - static inline pte_t pte_wrprotect(pte_t pte) - { -- pte_clear_bits(pte, _PAGE_RW); -+ if (likely(pte_get_bits(pte, _PAGE_RW))) -+ pte_clear_bits(pte, _PAGE_RW); -+ else -+ return pte; - return(pte_mknewprot(pte)); - } - - static inline pte_t pte_mkread(pte_t pte) - { -+ if (unlikely(pte_get_bits(pte, _PAGE_USER))) -+ return pte; - pte_set_bits(pte, _PAGE_USER); - return(pte_mknewprot(pte)); - } -@@ -221,6 +226,8 @@ static inline pte_t pte_mkyoung(pte_t pte) - - static inline pte_t pte_mkwrite(pte_t pte) - { -+ if (unlikely(pte_get_bits(pte, _PAGE_RW))) -+ return pte; - pte_set_bits(pte, _PAGE_RW); - return(pte_mknewprot(pte)); - } -diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c -index ae6aad1d24f7..b348c4641312 100644 ---- a/arch/x86/ia32/ia32_aout.c -+++ b/arch/x86/ia32/ia32_aout.c -@@ -50,7 +50,7 @@ static unsigned long get_dr(int n) - /* - * fill in the user structure for a core dump.. - */ --static void dump_thread32(struct pt_regs *regs, struct user32 *dump) -+static void fill_dump(struct pt_regs *regs, struct user32 *dump) - { - u32 fs, gs; - memset(dump, 0, sizeof(*dump)); -@@ -156,10 +156,12 @@ static int aout_core_dump(struct coredump_params *cprm) - fs = get_fs(); - set_fs(KERNEL_DS); - has_dumped = 1; -+ -+ fill_dump(cprm->regs, &dump); -+ - strncpy(dump.u_comm, current->comm, sizeof(current->comm)); - dump.u_ar0 = offsetof(struct user32, regs); - dump.signal = cprm->siginfo->si_signo; -- dump_thread32(cprm->regs, &dump); - - /* - * If the size of the dump file exceeds the rlimit, then see -diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index 16825dda18dc..66a5e60f60c4 100644 ---- a/arch/x86/include/asm/fpu/internal.h -+++ b/arch/x86/include/asm/fpu/internal.h -@@ -94,6 +94,9 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu); - #define user_insn(insn, output, input...) \ - ({ \ - int err; \ -+ \ -+ might_fault(); \ -+ \ - asm volatile(ASM_STAC "\n" \ - "1:" #insn "\n\t" \ - "2: " ASM_CLAC "\n" \ -diff --git a/arch/x86/include/asm/uv/bios.h b/arch/x86/include/asm/uv/bios.h -index 71605c7d5c5c..8b7594f2d48f 100644 ---- a/arch/x86/include/asm/uv/bios.h -+++ b/arch/x86/include/asm/uv/bios.h -@@ -48,7 +48,8 @@ enum { - BIOS_STATUS_SUCCESS = 0, - BIOS_STATUS_UNIMPLEMENTED = -ENOSYS, - BIOS_STATUS_EINVAL = -EINVAL, -- BIOS_STATUS_UNAVAIL = -EBUSY -+ BIOS_STATUS_UNAVAIL = -EBUSY, -+ BIOS_STATUS_ABORT = -EINTR, - }; - - /* -@@ -111,4 +112,9 @@ extern long system_serial_number; - - extern struct kobject *sgi_uv_kobj; /* /sys/firmware/sgi_uv */ - -+/* -+ * EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details -+ */ -+extern struct semaphore __efi_uv_runtime_lock; -+ - #endif /* _ASM_X86_UV_BIOS_H */ -diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 7b8c8c838191..77f7580e22c6 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce.c -+++ b/arch/x86/kernel/cpu/mcheck/mce.c -@@ -670,6 +670,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, - } - - if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { -+ m->bank = i; - *msg = tmp; - ret = 1; - } -diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -index f0f4fcba252e..947579425861 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c -@@ -1081,6 +1081,8 @@ static struct pci_driver snbep_uncore_pci_driver = { - .id_table = snbep_uncore_pci_ids, - }; - -+#define NODE_ID_MASK 0x7 -+ - /* - * build pci bus to socket mapping - */ -@@ -1102,7 +1104,7 @@ static int snbep_pci2phy_map_init(int devid) - err = pci_read_config_dword(ubox_dev, 0x40, &config); - if (err) - break; -- nodeid = config; -+ nodeid = config & NODE_ID_MASK; - /* get the Node ID mapping */ - err = pci_read_config_dword(ubox_dev, 0x54, &config); - if (err) -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index ecdf724da371..7ce1a19d9d8b 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -4156,6 +4156,13 @@ static bool svm_cpu_has_accelerated_tpr(void) - - static bool svm_has_emulated_msr(int index) - { -+ switch (index) { -+ case MSR_IA32_MCG_EXT_CTL: -+ return false; -+ default: -+ break; -+ } -+ - return true; - } - -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 3bdb2e747b89..aee2886a387c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -6965,6 +6965,7 @@ static void free_nested(struct vcpu_vmx *vmx) - if (!vmx->nested.vmxon) - return; - -+ hrtimer_cancel(&vmx->nested.preemption_timer); - vmx->nested.vmxon = false; - free_vpid(vmx->nested.vpid02); - nested_release_vmcs12(vmx); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 758e2b39567d..6bd0538d8ebf 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -4247,6 +4247,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu, - { - u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0; - -+ /* -+ * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED -+ * is returned, but our callers are not ready for that and they blindly -+ * call kvm_inject_page_fault. Ensure that they at least do not leak -+ * uninitialized kernel stack memory into cr2 and error code. -+ */ -+ memset(exception, 0, sizeof(*exception)); - return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, - exception); - } -diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c -index 526536c81ddc..ca1e8e6dccc8 100644 ---- a/arch/x86/pci/broadcom_bus.c -+++ b/arch/x86/pci/broadcom_bus.c -@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func) - word1 = read_pci_config_16(bus, slot, func, 0xc0); - word2 = read_pci_config_16(bus, slot, func, 0xc2); - if (word1 != word2) { -- res.start = (word1 << 16) | 0x0000; -- res.end = (word2 << 16) | 0xffff; -+ res.start = ((resource_size_t) word1 << 16) | 0x0000; -+ res.end = ((resource_size_t) word2 << 16) | 0xffff; - res.flags = IORESOURCE_MEM; - update_res(info, res.start, res.end, res.flags, 0); - } -diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c -index 1584cbed0dce..a45a1c5aabea 100644 ---- a/arch/x86/platform/uv/bios_uv.c -+++ b/arch/x86/platform/uv/bios_uv.c -@@ -28,7 +28,8 @@ - - static struct uv_systab uv_systab; - --s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5) -+static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, -+ u64 a4, u64 a5) - { - struct uv_systab *tab = &uv_systab; - s64 ret; -@@ -43,6 +44,19 @@ s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5) - a1, a2, a3, a4, a5); - return ret; - } -+ -+s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5) -+{ -+ s64 ret; -+ -+ if (down_interruptible(&__efi_uv_runtime_lock)) -+ return BIOS_STATUS_ABORT; -+ -+ ret = __uv_bios_call(which, a1, a2, a3, a4, a5); -+ up(&__efi_uv_runtime_lock); -+ -+ return ret; -+} - EXPORT_SYMBOL_GPL(uv_bios_call); - - s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, -@@ -51,10 +65,15 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, - unsigned long bios_flags; - s64 ret; - -+ if (down_interruptible(&__efi_uv_runtime_lock)) -+ return BIOS_STATUS_ABORT; -+ - local_irq_save(bios_flags); -- ret = uv_bios_call(which, a1, a2, a3, a4, a5); -+ ret = __uv_bios_call(which, a1, a2, a3, a4, a5); - local_irq_restore(bios_flags); - -+ up(&__efi_uv_runtime_lock); -+ - return ret; - } - -diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c -index 8804127b108c..21b80f5ee092 100644 ---- a/drivers/ata/sata_rcar.c -+++ b/drivers/ata/sata_rcar.c -@@ -875,7 +875,9 @@ static int sata_rcar_probe(struct platform_device *pdev) - int ret = 0; - - irq = platform_get_irq(pdev, 0); -- if (irq <= 0) -+ if (irq < 0) -+ return irq; -+ if (!irq) - return -EINVAL; - - priv = devm_kzalloc(&pdev->dev, sizeof(struct sata_rcar_priv), -diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c -index e80cbefbc2b5..27e1abcf5710 100644 ---- a/drivers/block/drbd/drbd_nl.c -+++ b/drivers/block/drbd/drbd_nl.c -@@ -632,14 +632,15 @@ drbd_set_role(struct drbd_device *const device, enum drbd_role new_role, int for - if (rv == SS_TWO_PRIMARIES) { - /* Maybe the peer is detected as dead very soon... - retry at most once more in this case. */ -- int timeo; -- rcu_read_lock(); -- nc = rcu_dereference(connection->net_conf); -- timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1; -- rcu_read_unlock(); -- schedule_timeout_interruptible(timeo); -- if (try < max_tries) -+ if (try < max_tries) { -+ int timeo; - try = max_tries - 1; -+ rcu_read_lock(); -+ nc = rcu_dereference(connection->net_conf); -+ timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1; -+ rcu_read_unlock(); -+ schedule_timeout_interruptible(timeo); -+ } - continue; - } - if (rv < SS_SUCCESS) { -diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c -index b4b5680ac6ad..b1ee358edd3b 100644 ---- a/drivers/block/drbd/drbd_receiver.c -+++ b/drivers/block/drbd/drbd_receiver.c -@@ -3126,7 +3126,7 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, - enum drbd_conns rv = C_MASK; - enum drbd_disk_state mydisk; - struct net_conf *nc; -- int hg, rule_nr, rr_conflict, tentative; -+ int hg, rule_nr, rr_conflict, tentative, always_asbp; - - mydisk = device->state.disk; - if (mydisk == D_NEGOTIATING) -@@ -3168,8 +3168,12 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, - - rcu_read_lock(); - nc = rcu_dereference(peer_device->connection->net_conf); -+ always_asbp = nc->always_asbp; -+ rr_conflict = nc->rr_conflict; -+ tentative = nc->tentative; -+ rcu_read_unlock(); - -- if (hg == 100 || (hg == -100 && nc->always_asbp)) { -+ if (hg == 100 || (hg == -100 && always_asbp)) { - int pcount = (device->state.role == R_PRIMARY) - + (peer_role == R_PRIMARY); - int forced = (hg == -100); -@@ -3208,9 +3212,6 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, - "Sync from %s node\n", - (hg < 0) ? "peer" : "this"); - } -- rr_conflict = nc->rr_conflict; -- tentative = nc->tentative; -- rcu_read_unlock(); - - if (hg == -100) { - /* FIXME this log message is not correct if we end up here -@@ -3889,7 +3890,7 @@ static int receive_uuids(struct drbd_connection *connection, struct packet_info - kfree(device->p_uuid); - device->p_uuid = p_uuid; - -- if (device->state.conn < C_CONNECTED && -+ if ((device->state.conn < C_CONNECTED || device->state.pdsk == D_DISKLESS) && - device->state.disk < D_INCONSISTENT && - device->state.role == R_PRIMARY && - (device->ed_uuid & ~((u64)1)) != (p_uuid[UI_CURRENT] & ~((u64)1))) { -diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c -index 4b911ed96ea3..31219fb9e7f4 100644 ---- a/drivers/block/sunvdc.c -+++ b/drivers/block/sunvdc.c -@@ -40,6 +40,8 @@ MODULE_VERSION(DRV_MODULE_VERSION); - #define WAITING_FOR_GEN_CMD 0x04 - #define WAITING_FOR_ANY -1 - -+#define VDC_MAX_RETRIES 10 -+ - static struct workqueue_struct *sunvdc_wq; - - struct vdc_req_entry { -@@ -419,6 +421,7 @@ static int __vdc_tx_trigger(struct vdc_port *port) - .end_idx = dr->prod, - }; - int err, delay; -+ int retries = 0; - - hdr.seq = dr->snd_nxt; - delay = 1; -@@ -431,6 +434,8 @@ static int __vdc_tx_trigger(struct vdc_port *port) - udelay(delay); - if ((delay <<= 1) > 128) - delay = 128; -+ if (retries++ > VDC_MAX_RETRIES) -+ break; - } while (err == -EAGAIN); - - if (err == -ENOTCONN) -diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c -index c264f2d284a7..2e0a9e2531cb 100644 ---- a/drivers/block/swim3.c -+++ b/drivers/block/swim3.c -@@ -1027,7 +1027,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode) - struct swim3 __iomem *sw = fs->swim3; - - mutex_lock(&swim3_mutex); -- if (fs->ref_count > 0 && --fs->ref_count == 0) { -+ if (fs->ref_count > 0) -+ --fs->ref_count; -+ else if (fs->ref_count == -1) -+ fs->ref_count = 0; -+ if (fs->ref_count == 0) { - swim3_action(fs, MOTOR_OFF); - out_8(&sw->control_bic, 0xff); - swim3_select(fs, RELAX); -diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c -index e2808fefbb78..1852d19d0d7b 100644 ---- a/drivers/cdrom/gdrom.c -+++ b/drivers/cdrom/gdrom.c -@@ -882,6 +882,7 @@ static void __exit exit_gdrom(void) - platform_device_unregister(pd); - platform_driver_unregister(&gdrom_driver); - kfree(gd.toc); -+ kfree(gd.cd_info); - } - - module_init(init_gdrom); -diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c -index 1be6230a07af..8b6306dc5fc6 100644 ---- a/drivers/clk/imx/clk-imx6sl.c -+++ b/drivers/clk/imx/clk-imx6sl.c -@@ -17,6 +17,8 @@ - - #include "clk.h" - -+#define CCDR 0x4 -+#define BM_CCM_CCDR_MMDC_CH0_MASK (1 << 17) - #define CCSR 0xc - #define BM_CCSR_PLL1_SW_CLK_SEL (1 << 2) - #define CACRR 0x10 -@@ -414,6 +416,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node) - clks[IMX6SL_CLK_USDHC3] = imx_clk_gate2("usdhc3", "usdhc3_podf", base + 0x80, 6); - clks[IMX6SL_CLK_USDHC4] = imx_clk_gate2("usdhc4", "usdhc4_podf", base + 0x80, 8); - -+ /* Ensure the MMDC CH0 handshake is bypassed */ -+ writel_relaxed(readl_relaxed(base + CCDR) | -+ BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR); -+ - imx_check_clocks(clks, ARRAY_SIZE(clks)); - - clk_data.clks = clks; -diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c -index db2ede565f1a..b44476a1b7ad 100644 ---- a/drivers/cpuidle/cpuidle-big_little.c -+++ b/drivers/cpuidle/cpuidle-big_little.c -@@ -167,6 +167,7 @@ static int __init bl_idle_init(void) - { - int ret; - struct device_node *root = of_find_node_by_path("/"); -+ const struct of_device_id *match_id; - - if (!root) - return -ENODEV; -@@ -174,7 +175,11 @@ static int __init bl_idle_init(void) - /* - * Initialize the driver just for a compliant set of machines - */ -- if (!of_match_node(compatible_machine_match, root)) -+ match_id = of_match_node(compatible_machine_match, root); -+ -+ of_node_put(root); -+ -+ if (!match_id) - return -ENODEV; - - if (!mcpm_is_available()) -diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c -index 790f7cadc1ed..efebc484e371 100644 ---- a/drivers/crypto/ux500/cryp/cryp_core.c -+++ b/drivers/crypto/ux500/cryp/cryp_core.c -@@ -555,7 +555,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx, - desc = dmaengine_prep_slave_sg(channel, - ctx->device->dma.sg_src, - ctx->device->dma.sg_src_len, -- direction, DMA_CTRL_ACK); -+ DMA_MEM_TO_DEV, DMA_CTRL_ACK); - break; - - case DMA_FROM_DEVICE: -@@ -579,7 +579,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx, - desc = dmaengine_prep_slave_sg(channel, - ctx->device->dma.sg_dst, - ctx->device->dma.sg_dst_len, -- direction, -+ DMA_DEV_TO_MEM, - DMA_CTRL_ACK | - DMA_PREP_INTERRUPT); - -diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c -index cd4398498495..bca6b701c067 100644 ---- a/drivers/crypto/ux500/hash/hash_core.c -+++ b/drivers/crypto/ux500/hash/hash_core.c -@@ -181,7 +181,7 @@ static int hash_set_dma_transfer(struct hash_ctx *ctx, struct scatterlist *sg, - __func__); - desc = dmaengine_prep_slave_sg(channel, - ctx->device->dma.sg, ctx->device->dma.sg_len, -- direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); -+ DMA_MEM_TO_DEV, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); - if (!desc) { - dev_err(ctx->device->dev, - "%s: dmaengine_prep_slave_sg() failed!\n", __func__); -diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c -index 48d85f8b95fe..dfa337ae06fc 100644 ---- a/drivers/dma/imx-dma.c -+++ b/drivers/dma/imx-dma.c -@@ -619,7 +619,7 @@ static void imxdma_tasklet(unsigned long data) - { - struct imxdma_channel *imxdmac = (void *)data; - struct imxdma_engine *imxdma = imxdmac->imxdma; -- struct imxdma_desc *desc; -+ struct imxdma_desc *desc, *next_desc; - unsigned long flags; - - spin_lock_irqsave(&imxdma->lock, flags); -@@ -649,10 +649,10 @@ static void imxdma_tasklet(unsigned long data) - list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free); - - if (!list_empty(&imxdmac->ld_queue)) { -- desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc, -- node); -+ next_desc = list_first_entry(&imxdmac->ld_queue, -+ struct imxdma_desc, node); - list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active); -- if (imxdma_xfer_desc(desc) < 0) -+ if (imxdma_xfer_desc(next_desc) < 0) - dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n", - __func__, imxdmac->channel); - } -diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c -index 228bbf910461..906d0224f50d 100644 ---- a/drivers/firmware/efi/runtime-wrappers.c -+++ b/drivers/firmware/efi/runtime-wrappers.c -@@ -87,6 +87,13 @@ static DEFINE_SPINLOCK(efi_runtime_lock); - * context through efi_pstore_write(). - */ - -+/* -+ * Expose the EFI runtime lock to the UV platform -+ */ -+#ifdef CONFIG_X86_UV -+extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); -+#endif -+ - /* - * As per commit ef68c8f87ed1 ("x86: Serialize EFI time accesses on rtc_lock"), - * the EFI specification requires that callers of the time related runtime -diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c -index f1a204d253cc..ac22b8d86249 100644 ---- a/drivers/gpu/drm/drm_bufs.c -+++ b/drivers/gpu/drm/drm_bufs.c -@@ -36,6 +36,8 @@ - #include - #include "drm_legacy.h" - -+#include -+ - static struct drm_map_list *drm_find_matching_map(struct drm_device *dev, - struct drm_local_map *map) - { -@@ -1332,6 +1334,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data, - idx, dma->buf_count - 1); - return -EINVAL; - } -+ idx = array_index_nospec(idx, dma->buf_count); - buf = dma->buflist[idx]; - if (buf->file_priv != file_priv) { - DRM_ERROR("Process %d freeing buffer not owned\n", -diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c -index 71a10f08522e..a5b052203c2c 100644 ---- a/drivers/gpu/drm/drm_modes.c -+++ b/drivers/gpu/drm/drm_modes.c -@@ -722,7 +722,7 @@ int drm_mode_hsync(const struct drm_display_mode *mode) - if (mode->hsync) - return mode->hsync; - -- if (mode->htotal < 0) -+ if (mode->htotal <= 0) - return 0; - - calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */ -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index be3971b22a02..ed92b9ac01b2 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -594,13 +594,16 @@ out_fixup: - static int vmw_dma_masks(struct vmw_private *dev_priv) - { - struct drm_device *dev = dev_priv->dev; -+ int ret = 0; - -- if (intel_iommu_enabled && -+ ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64)); -+ if (dev_priv->map_mode != vmw_dma_phys && - (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) { - DRM_INFO("Restricting DMA addresses to 44 bits.\n"); -- return dma_set_mask(dev->dev, DMA_BIT_MASK(44)); -+ return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44)); - } -- return 0; -+ -+ return ret; - } - #else - static int vmw_dma_masks(struct vmw_private *dev_priv) -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index fda8e85dd5a2..ad0dd566aded 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -3663,7 +3663,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv, - *p_fence = NULL; - } - -- return 0; -+ return ret; - } - - /** -diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c -index 6c60f4b63d21..d7179dd3c9ef 100644 ---- a/drivers/hid/hid-debug.c -+++ b/drivers/hid/hid-debug.c -@@ -30,6 +30,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -455,7 +456,7 @@ static char *resolv_usage_page(unsigned page, struct seq_file *f) { - char *buf = NULL; - - if (!f) { -- buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC); -+ buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_ATOMIC); - if (!buf) - return ERR_PTR(-ENOMEM); - } -@@ -659,17 +660,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device); - /* enqueue string to 'events' ring buffer */ - void hid_debug_event(struct hid_device *hdev, char *buf) - { -- int i; - struct hid_debug_list *list; - unsigned long flags; - - spin_lock_irqsave(&hdev->debug_list_lock, flags); -- list_for_each_entry(list, &hdev->debug_list, node) { -- for (i = 0; i < strlen(buf); i++) -- list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] = -- buf[i]; -- list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE; -- } -+ list_for_each_entry(list, &hdev->debug_list, node) -+ kfifo_in(&list->hid_debug_fifo, buf, strlen(buf)); - spin_unlock_irqrestore(&hdev->debug_list_lock, flags); - - wake_up_interruptible(&hdev->debug_wait); -@@ -720,8 +716,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu - hid_debug_event(hdev, buf); - - kfree(buf); -- wake_up_interruptible(&hdev->debug_wait); -- -+ wake_up_interruptible(&hdev->debug_wait); - } - EXPORT_SYMBOL_GPL(hid_dump_input); - -@@ -1086,8 +1081,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file) - goto out; - } - -- if (!(list->hid_debug_buf = kzalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_KERNEL))) { -- err = -ENOMEM; -+ err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL); -+ if (err) { - kfree(list); - goto out; - } -@@ -1107,77 +1102,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, - size_t count, loff_t *ppos) - { - struct hid_debug_list *list = file->private_data; -- int ret = 0, len; -+ int ret = 0, copied; - DECLARE_WAITQUEUE(wait, current); - - mutex_lock(&list->read_mutex); -- while (ret == 0) { -- if (list->head == list->tail) { -- add_wait_queue(&list->hdev->debug_wait, &wait); -- set_current_state(TASK_INTERRUPTIBLE); -- -- while (list->head == list->tail) { -- if (file->f_flags & O_NONBLOCK) { -- ret = -EAGAIN; -- break; -- } -- if (signal_pending(current)) { -- ret = -ERESTARTSYS; -- break; -- } -+ if (kfifo_is_empty(&list->hid_debug_fifo)) { -+ add_wait_queue(&list->hdev->debug_wait, &wait); -+ set_current_state(TASK_INTERRUPTIBLE); -+ -+ while (kfifo_is_empty(&list->hid_debug_fifo)) { -+ if (file->f_flags & O_NONBLOCK) { -+ ret = -EAGAIN; -+ break; -+ } - -- if (!list->hdev || !list->hdev->debug) { -- ret = -EIO; -- set_current_state(TASK_RUNNING); -- goto out; -- } -+ if (signal_pending(current)) { -+ ret = -ERESTARTSYS; -+ break; -+ } - -- /* allow O_NONBLOCK from other threads */ -- mutex_unlock(&list->read_mutex); -- schedule(); -- mutex_lock(&list->read_mutex); -- set_current_state(TASK_INTERRUPTIBLE); -+ /* if list->hdev is NULL we cannot remove_wait_queue(). -+ * if list->hdev->debug is 0 then hid_debug_unregister() -+ * was already called and list->hdev is being destroyed. -+ * if we add remove_wait_queue() here we can hit a race. -+ */ -+ if (!list->hdev || !list->hdev->debug) { -+ ret = -EIO; -+ set_current_state(TASK_RUNNING); -+ goto out; - } - -- set_current_state(TASK_RUNNING); -- remove_wait_queue(&list->hdev->debug_wait, &wait); -+ /* allow O_NONBLOCK from other threads */ -+ mutex_unlock(&list->read_mutex); -+ schedule(); -+ mutex_lock(&list->read_mutex); -+ set_current_state(TASK_INTERRUPTIBLE); - } - -- if (ret) -- goto out; -+ __set_current_state(TASK_RUNNING); -+ remove_wait_queue(&list->hdev->debug_wait, &wait); - -- /* pass the ringbuffer contents to userspace */ --copy_rest: -- if (list->tail == list->head) -+ if (ret) - goto out; -- if (list->tail > list->head) { -- len = list->tail - list->head; -- if (len > count) -- len = count; -- -- if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { -- ret = -EFAULT; -- goto out; -- } -- ret += len; -- list->head += len; -- } else { -- len = HID_DEBUG_BUFSIZE - list->head; -- if (len > count) -- len = count; -- -- if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { -- ret = -EFAULT; -- goto out; -- } -- list->head = 0; -- ret += len; -- count -= len; -- if (count > 0) -- goto copy_rest; -- } -- - } -+ -+ /* pass the fifo content to userspace, locking is not needed with only -+ * one concurrent reader and one concurrent writer -+ */ -+ ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied); -+ if (ret) -+ goto out; -+ ret = copied; - out: - mutex_unlock(&list->read_mutex); - return ret; -@@ -1188,7 +1163,7 @@ static unsigned int hid_debug_events_poll(struct file *file, poll_table *wait) - struct hid_debug_list *list = file->private_data; - - poll_wait(file, &list->hdev->debug_wait, wait); -- if (list->head != list->tail) -+ if (!kfifo_is_empty(&list->hid_debug_fifo)) - return POLLIN | POLLRDNORM; - if (!list->hdev->debug) - return POLLERR | POLLHUP; -@@ -1203,7 +1178,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file) - spin_lock_irqsave(&list->hdev->debug_list_lock, flags); - list_del(&list->node); - spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags); -- kfree(list->hid_debug_buf); -+ kfifo_free(&list->hid_debug_fifo); - kfree(list); - - return 0; -@@ -1254,4 +1229,3 @@ void hid_debug_exit(void) - { - debugfs_remove_recursive(hid_debug_root); - } -- -diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c -index 8979f1fd5208..24a4a23bdc90 100644 ---- a/drivers/hid/hid-lenovo.c -+++ b/drivers/hid/hid-lenovo.c -@@ -703,7 +703,9 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev) - data_pointer->led_mute.brightness_get = lenovo_led_brightness_get_tpkbd; - data_pointer->led_mute.brightness_set = lenovo_led_brightness_set_tpkbd; - data_pointer->led_mute.dev = dev; -- led_classdev_register(dev, &data_pointer->led_mute); -+ ret = led_classdev_register(dev, &data_pointer->led_mute); -+ if (ret < 0) -+ goto err; - - data_pointer->led_micmute.name = name_micmute; - data_pointer->led_micmute.brightness_get = -@@ -711,7 +713,11 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev) - data_pointer->led_micmute.brightness_set = - lenovo_led_brightness_set_tpkbd; - data_pointer->led_micmute.dev = dev; -- led_classdev_register(dev, &data_pointer->led_micmute); -+ ret = led_classdev_register(dev, &data_pointer->led_micmute); -+ if (ret < 0) { -+ led_classdev_unregister(&data_pointer->led_mute); -+ goto err; -+ } - - lenovo_features_set_tpkbd(hdev); - -diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c -index 4bcd9b882948..cb6606a0470d 100644 ---- a/drivers/hwmon/lm80.c -+++ b/drivers/hwmon/lm80.c -@@ -360,9 +360,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, - struct i2c_client *client = data->client; - unsigned long min, val; - u8 reg; -- int err = kstrtoul(buf, 10, &val); -- if (err < 0) -- return err; -+ int rv; -+ -+ rv = kstrtoul(buf, 10, &val); -+ if (rv < 0) -+ return rv; - - /* Save fan_min */ - mutex_lock(&data->update_lock); -@@ -390,8 +392,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, - return -EINVAL; - } - -- reg = (lm80_read_value(client, LM80_REG_FANDIV) & -- ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1))); -+ rv = lm80_read_value(client, LM80_REG_FANDIV); -+ if (rv < 0) -+ return rv; -+ reg = (rv & ~(3 << (2 * (nr + 1)))) -+ | (data->fan_div[nr] << (2 * (nr + 1))); - lm80_write_value(client, LM80_REG_FANDIV, reg); - - /* Restore fan_min */ -@@ -623,6 +628,7 @@ static int lm80_probe(struct i2c_client *client, - struct device *dev = &client->dev; - struct device *hwmon_dev; - struct lm80_data *data; -+ int rv; - - data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); - if (!data) -@@ -635,8 +641,14 @@ static int lm80_probe(struct i2c_client *client, - lm80_init_client(client); - - /* A few vars need to be filled upon startup */ -- data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); -- data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); -+ rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); -+ if (rv < 0) -+ return rv; -+ data->fan[f_min][0] = rv; -+ rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); -+ if (rv < 0) -+ return rv; -+ data->fan[f_min][1] = rv; - - hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, - data, lm80_groups); -diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c -index 9c9fd2e87a4b..1c68b05c8649 100644 ---- a/drivers/i2c/busses/i2c-axxia.c -+++ b/drivers/i2c/busses/i2c-axxia.c -@@ -296,22 +296,7 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) - i2c_int_disable(idev, MST_STATUS_TFL); - } - -- if (status & MST_STATUS_SCC) { -- /* Stop completed */ -- i2c_int_disable(idev, ~MST_STATUS_TSS); -- complete(&idev->msg_complete); -- } else if (status & MST_STATUS_SNS) { -- /* Transfer done */ -- i2c_int_disable(idev, ~MST_STATUS_TSS); -- if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) -- axxia_i2c_empty_rx_fifo(idev); -- complete(&idev->msg_complete); -- } else if (status & MST_STATUS_TSS) { -- /* Transfer timeout */ -- idev->msg_err = -ETIMEDOUT; -- i2c_int_disable(idev, ~MST_STATUS_TSS); -- complete(&idev->msg_complete); -- } else if (unlikely(status & MST_STATUS_ERR)) { -+ if (unlikely(status & MST_STATUS_ERR)) { - /* Transfer error */ - i2c_int_disable(idev, ~0); - if (status & MST_STATUS_AL) -@@ -328,6 +313,21 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) - readl(idev->base + MST_TX_BYTES_XFRD), - readl(idev->base + MST_TX_XFER)); - complete(&idev->msg_complete); -+ } else if (status & MST_STATUS_SCC) { -+ /* Stop completed */ -+ i2c_int_disable(idev, ~MST_STATUS_TSS); -+ complete(&idev->msg_complete); -+ } else if (status & MST_STATUS_SNS) { -+ /* Transfer done */ -+ i2c_int_disable(idev, ~MST_STATUS_TSS); -+ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) -+ axxia_i2c_empty_rx_fifo(idev); -+ complete(&idev->msg_complete); -+ } else if (status & MST_STATUS_TSS) { -+ /* Transfer timeout */ -+ idev->msg_err = -ETIMEDOUT; -+ i2c_int_disable(idev, ~MST_STATUS_TSS); -+ complete(&idev->msg_complete); - } - - out: -diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c -index 1d0e61d7c131..b6c1d1d482c1 100644 ---- a/drivers/input/misc/bma150.c -+++ b/drivers/input/misc/bma150.c -@@ -482,13 +482,14 @@ static int bma150_register_input_device(struct bma150_data *bma150) - idev->close = bma150_irq_close; - input_set_drvdata(idev, bma150); - -+ bma150->input = idev; -+ - error = input_register_device(idev); - if (error) { - input_free_device(idev); - return error; - } - -- bma150->input = idev; - return 0; - } - -@@ -511,15 +512,15 @@ static int bma150_register_polled_device(struct bma150_data *bma150) - - bma150_init_input_device(bma150, ipoll_dev->input); - -+ bma150->input_polled = ipoll_dev; -+ bma150->input = ipoll_dev->input; -+ - error = input_register_polled_device(ipoll_dev); - if (error) { - input_free_polled_device(ipoll_dev); - return error; - } - -- bma150->input_polled = ipoll_dev; -- bma150->input = ipoll_dev->input; -- - return 0; - } - -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 30adc5745cba..25ce9047b682 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1240,7 +1240,6 @@ MODULE_DEVICE_TABLE(i2c, elan_id); - static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0000", 0 }, - { "ELAN0100", 0 }, -- { "ELAN0501", 0 }, - { "ELAN0600", 0 }, - { "ELAN0602", 0 }, - { "ELAN0605", 0 }, -@@ -1251,6 +1250,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN060C", 0 }, - { "ELAN0611", 0 }, - { "ELAN0612", 0 }, -+ { "ELAN0617", 0 }, - { "ELAN0618", 0 }, - { "ELAN061C", 0 }, - { "ELAN061D", 0 }, -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 84aead19622c..4c1e527f14a5 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1121,6 +1121,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, - * Asus UX31 0x361f00 20, 15, 0e clickpad - * Asus UX32VD 0x361f02 00, 15, 0e clickpad - * Avatar AVIU-145A2 0x361f00 ? clickpad -+ * Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**) -+ * Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**) - * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons - * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons - * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons -@@ -1173,6 +1175,13 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"), - }, - }, -+ { -+ /* Fujitsu H780 also has a middle button */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"), -+ }, -+ }, - #endif - { } - }; -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index fc6eb752ab35..eb9937225d64 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -683,7 +683,13 @@ static void queue_inc_cons(struct arm_smmu_queue *q) - u32 cons = (Q_WRP(q, q->cons) | Q_IDX(q, q->cons)) + 1; - - q->cons = Q_OVF(q, q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons); -- writel(q->cons, q->cons_reg); -+ -+ /* -+ * Ensure that all CPU accesses (reads and writes) to the queue -+ * are complete before we update the cons pointer. -+ */ -+ mb(); -+ writel_relaxed(q->cons, q->cons_reg); - } - - static int queue_sync_prod(struct arm_smmu_queue *q) -diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c -index 90449e1e91e5..1b1453d62fed 100644 ---- a/drivers/isdn/hisax/hfc_pci.c -+++ b/drivers/isdn/hisax/hfc_pci.c -@@ -1169,11 +1169,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg) - if (cs->debug & L1_DEB_LAPD) - debugl1(cs, "-> PH_REQUEST_PULL"); - #endif -+ spin_lock_irqsave(&cs->lock, flags); - if (!cs->tx_skb) { - test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags); - st->l1.l1l2(st, PH_PULL | CONFIRM, NULL); - } else - test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags); -+ spin_unlock_irqrestore(&cs->lock, flags); - break; - case (HW_RESET | REQUEST): - spin_lock_irqsave(&cs->lock, flags); -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index bc4e6825ff62..07eaa9f90712 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -256,6 +256,7 @@ struct pool { - - spinlock_t lock; - struct bio_list deferred_flush_bios; -+ struct bio_list deferred_flush_completions; - struct list_head prepared_mappings; - struct list_head prepared_discards; - struct list_head active_thins; -@@ -920,6 +921,39 @@ static void process_prepared_mapping_fail(struct dm_thin_new_mapping *m) - mempool_free(m, m->tc->pool->mapping_pool); - } - -+static void complete_overwrite_bio(struct thin_c *tc, struct bio *bio) -+{ -+ struct pool *pool = tc->pool; -+ unsigned long flags; -+ -+ /* -+ * If the bio has the REQ_FUA flag set we must commit the metadata -+ * before signaling its completion. -+ */ -+ if (!bio_triggers_commit(tc, bio)) { -+ bio_endio(bio); -+ return; -+ } -+ -+ /* -+ * Complete bio with an error if earlier I/O caused changes to the -+ * metadata that can't be committed, e.g, due to I/O errors on the -+ * metadata device. -+ */ -+ if (dm_thin_aborted_changes(tc->td)) { -+ bio_io_error(bio); -+ return; -+ } -+ -+ /* -+ * Batch together any bios that trigger commits and then issue a -+ * single commit for them in process_deferred_bios(). -+ */ -+ spin_lock_irqsave(&pool->lock, flags); -+ bio_list_add(&pool->deferred_flush_completions, bio); -+ spin_unlock_irqrestore(&pool->lock, flags); -+} -+ - static void process_prepared_mapping(struct dm_thin_new_mapping *m) - { - struct thin_c *tc = m->tc; -@@ -952,7 +986,7 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m) - */ - if (bio) { - inc_remap_and_issue_cell(tc, m->cell, m->data_block); -- bio_endio(bio); -+ complete_overwrite_bio(tc, bio); - } else { - inc_all_io_entry(tc->pool, m->cell->holder); - remap_and_issue(tc, m->cell->holder, m->data_block); -@@ -2228,7 +2262,7 @@ static void process_deferred_bios(struct pool *pool) - { - unsigned long flags; - struct bio *bio; -- struct bio_list bios; -+ struct bio_list bios, bio_completions; - struct thin_c *tc; - - tc = get_first_thin(pool); -@@ -2239,26 +2273,36 @@ static void process_deferred_bios(struct pool *pool) - } - - /* -- * If there are any deferred flush bios, we must commit -- * the metadata before issuing them. -+ * If there are any deferred flush bios, we must commit the metadata -+ * before issuing them or signaling their completion. - */ - bio_list_init(&bios); -+ bio_list_init(&bio_completions); -+ - spin_lock_irqsave(&pool->lock, flags); - bio_list_merge(&bios, &pool->deferred_flush_bios); - bio_list_init(&pool->deferred_flush_bios); -+ -+ bio_list_merge(&bio_completions, &pool->deferred_flush_completions); -+ bio_list_init(&pool->deferred_flush_completions); - spin_unlock_irqrestore(&pool->lock, flags); - -- if (bio_list_empty(&bios) && -+ if (bio_list_empty(&bios) && bio_list_empty(&bio_completions) && - !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool))) - return; - - if (commit(pool)) { -+ bio_list_merge(&bios, &bio_completions); -+ - while ((bio = bio_list_pop(&bios))) - bio_io_error(bio); - return; - } - pool->last_commit_jiffies = jiffies; - -+ while ((bio = bio_list_pop(&bio_completions))) -+ bio_endio(bio); -+ - while ((bio = bio_list_pop(&bios))) - generic_make_request(bio); - } -@@ -2885,6 +2929,7 @@ static struct pool *pool_create(struct mapped_device *pool_md, - INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout); - spin_lock_init(&pool->lock); - bio_list_init(&pool->deferred_flush_bios); -+ bio_list_init(&pool->deferred_flush_completions); - INIT_LIST_HEAD(&pool->prepared_mappings); - INIT_LIST_HEAD(&pool->prepared_discards); - INIT_LIST_HEAD(&pool->active_thins); -diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c -index 9a6c2cc38acb..abce9c4a1a8e 100644 ---- a/drivers/media/platform/davinci/vpbe.c -+++ b/drivers/media/platform/davinci/vpbe.c -@@ -753,7 +753,7 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev) - if (ret) { - v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default output %s", - def_output); -- return ret; -+ goto fail_kfree_amp; - } - - printk(KERN_NOTICE "Setting default mode to %s\n", def_mode); -@@ -761,12 +761,15 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev) - if (ret) { - v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default mode %s", - def_mode); -- return ret; -+ goto fail_kfree_amp; - } - vpbe_dev->initialized = 1; - /* TBD handling of bootargs for default output and mode */ - return 0; - -+fail_kfree_amp: -+ mutex_lock(&vpbe_dev->lock); -+ kfree(vpbe_dev->amp); - fail_kfree_encoders: - kfree(vpbe_dev->encoders); - fail_dev_unregister: -diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c -index a0547dbf9806..4d673a626db4 100644 ---- a/drivers/memstick/core/memstick.c -+++ b/drivers/memstick/core/memstick.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - - #define DRIVER_NAME "memstick" - -@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work) - struct memstick_dev *card; - - dev_dbg(&host->dev, "memstick_check started\n"); -+ pm_runtime_get_noresume(host->dev.parent); - mutex_lock(&host->lock); - if (!host->card) { - if (memstick_power_on(host)) -@@ -479,6 +481,7 @@ out_power_off: - host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF); - - mutex_unlock(&host->lock); -+ pm_runtime_put(host->dev.parent); - dev_dbg(&host->dev, "memstick_check finished\n"); - } - -diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c -index c344483fa7d6..9f257c53e6d4 100644 ---- a/drivers/misc/vexpress-syscfg.c -+++ b/drivers/misc/vexpress-syscfg.c -@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func, - int tries; - long timeout; - -- if (WARN_ON(index > func->num_templates)) -+ if (WARN_ON(index >= func->num_templates)) - return -EINVAL; - - command = readl(syscfg->base + SYS_CFGCTRL); -diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c -index 43fa16b5f510..672c02e32a39 100644 ---- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c -+++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c -@@ -168,9 +168,10 @@ int gpmi_init(struct gpmi_nand_data *this) - - /* - * Reset BCH here, too. We got failures otherwise :( -- * See later BCH reset for explanation of MX23 handling -+ * See later BCH reset for explanation of MX23 and MX28 handling - */ -- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this)); -+ ret = gpmi_reset_block(r->bch_regs, -+ GPMI_IS_MX23(this) || GPMI_IS_MX28(this)); - if (ret) - goto err_out; - -@@ -274,13 +275,11 @@ int bch_set_geometry(struct gpmi_nand_data *this) - - /* - * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this -- * chip, otherwise it will lock up. So we skip resetting BCH on the MX23. -- * On the other hand, the MX28 needs the reset, because one case has been -- * seen where the BCH produced ECC errors constantly after 10000 -- * consecutive reboots. The latter case has not been seen on the MX23 -- * yet, still we don't know if it could happen there as well. -+ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23 -+ * and MX28. - */ -- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this)); -+ ret = gpmi_reset_block(r->bch_regs, -+ GPMI_IS_MX23(this) || GPMI_IS_MX28(this)); - if (ret) - goto err_out; - -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 7a6dd5e5e498..143b9a384af8 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -400,7 +400,6 @@ static void bcm_sysport_get_wol(struct net_device *dev, - struct ethtool_wolinfo *wol) - { - struct bcm_sysport_priv *priv = netdev_priv(dev); -- u32 reg; - - wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE; - wol->wolopts = priv->wolopts; -@@ -408,11 +407,7 @@ static void bcm_sysport_get_wol(struct net_device *dev, - if (!(priv->wolopts & WAKE_MAGICSECURE)) - return; - -- /* Return the programmed SecureOn password */ -- reg = umac_readl(priv, UMAC_PSW_MS); -- put_unaligned_be16(reg, &wol->sopass[0]); -- reg = umac_readl(priv, UMAC_PSW_LS); -- put_unaligned_be32(reg, &wol->sopass[2]); -+ memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass)); - } - - static int bcm_sysport_set_wol(struct net_device *dev, -@@ -428,13 +423,8 @@ static int bcm_sysport_set_wol(struct net_device *dev, - if (wol->wolopts & ~supported) - return -EINVAL; - -- /* Program the SecureOn password */ -- if (wol->wolopts & WAKE_MAGICSECURE) { -- umac_writel(priv, get_unaligned_be16(&wol->sopass[0]), -- UMAC_PSW_MS); -- umac_writel(priv, get_unaligned_be32(&wol->sopass[2]), -- UMAC_PSW_LS); -- } -+ if (wol->wolopts & WAKE_MAGICSECURE) -+ memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass)); - - /* Flag the device and relevant IRQ as wakeup capable */ - if (wol->wolopts) { -@@ -1889,12 +1879,17 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) - unsigned int timeout = 1000; - u32 reg; - -- /* Password has already been programmed */ - reg = umac_readl(priv, UMAC_MPD_CTRL); - reg |= MPD_EN; - reg &= ~PSW_EN; -- if (priv->wolopts & WAKE_MAGICSECURE) -+ if (priv->wolopts & WAKE_MAGICSECURE) { -+ /* Program the SecureOn password */ -+ umac_writel(priv, get_unaligned_be16(&priv->sopass[0]), -+ UMAC_PSW_MS); -+ umac_writel(priv, get_unaligned_be32(&priv->sopass[2]), -+ UMAC_PSW_LS); - reg |= PSW_EN; -+ } - umac_writel(priv, reg, UMAC_MPD_CTRL); - - /* Make sure RBUF entered WoL mode as result */ -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h -index 8ace6ecb5f79..e668b1ce5828 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.h -+++ b/drivers/net/ethernet/broadcom/bcmsysport.h -@@ -11,6 +11,7 @@ - #ifndef __BCM_SYSPORT_H - #define __BCM_SYSPORT_H - -+#include - #include - - /* Receive/transmit descriptor format */ -@@ -682,6 +683,7 @@ struct bcm_sysport_priv { - unsigned int crc_fwd:1; - u16 rev; - u32 wolopts; -+ u8 sopass[SOPASS_MAX]; - unsigned int wol_irq_disabled:1; - - /* MIB related fields */ -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index 0433fdebda25..9ef4caa4b84d 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -1180,7 +1180,7 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq, - * CHECSUM_UNNECESSARY. - */ - if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok && -- ipv4_csum_ok) -+ (ipv4_csum_ok || ipv6)) - skb->ip_summed = CHECKSUM_UNNECESSARY; - - if (vlan_stripped) -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 02b23f6277fb..c1796aa2dde5 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -7339,9 +7339,11 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - rtnl_unlock(); - - #ifdef CONFIG_PM -- retval = pci_save_state(pdev); -- if (retval) -- return retval; -+ if (!runtime) { -+ retval = pci_save_state(pdev); -+ if (retval) -+ return retval; -+ } - #endif - - status = rd32(E1000_STATUS); -diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c -index 7173836fe361..c9f4b5412844 100644 ---- a/drivers/net/ethernet/marvell/skge.c -+++ b/drivers/net/ethernet/marvell/skge.c -@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs, - memset(p, 0, regs->len); - memcpy_fromio(p, io, B3_RAM_ADDR); - -- memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1, -- regs->len - B3_RI_WTO_R1); -+ if (regs->len > B3_RI_WTO_R1) { -+ memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1, -+ regs->len - B3_RI_WTO_R1); -+ } - } - - /* Wake on Lan only supported on Yukon chips with rev 1 or above */ -diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c -index ccebf89aa1e4..85f3a2c0d4dd 100644 ---- a/drivers/net/ethernet/sun/niu.c -+++ b/drivers/net/ethernet/sun/niu.c -@@ -8121,6 +8121,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) - start += 3; - - prop_len = niu_pci_eeprom_read(np, start + 4); -+ if (prop_len < 0) -+ return prop_len; - err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64); - if (err < 0) - return err; -@@ -8165,8 +8167,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) - netif_printk(np, probe, KERN_DEBUG, np->dev, - "VPD_SCAN: Reading in property [%s] len[%d]\n", - namebuf, prop_len); -- for (i = 0; i < prop_len; i++) -- *prop_buf++ = niu_pci_eeprom_read(np, off + i); -+ for (i = 0; i < prop_len; i++) { -+ err = niu_pci_eeprom_read(np, off + i); -+ if (err >= 0) -+ *prop_buf = err; -+ ++prop_buf; -+ } - } - - start += len; -diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c -index dc934347ae28..e6f564d50663 100644 ---- a/drivers/net/phy/dp83640.c -+++ b/drivers/net/phy/dp83640.c -@@ -890,14 +890,14 @@ static void decode_txts(struct dp83640_private *dp83640, - struct phy_txts *phy_txts) - { - struct skb_shared_hwtstamps shhwtstamps; -+ struct dp83640_skb_info *skb_info; - struct sk_buff *skb; -- u64 ns; - u8 overflow; -+ u64 ns; - - /* We must already have the skb that triggered this. */ -- -+again: - skb = skb_dequeue(&dp83640->tx_queue); -- - if (!skb) { - pr_debug("have timestamp but tx_queue empty\n"); - return; -@@ -912,6 +912,11 @@ static void decode_txts(struct dp83640_private *dp83640, - } - return; - } -+ skb_info = (struct dp83640_skb_info *)skb->cb; -+ if (time_after(jiffies, skb_info->tmo)) { -+ kfree_skb(skb); -+ goto again; -+ } - - ns = phy2txts(phy_txts); - memset(&shhwtstamps, 0, sizeof(shhwtstamps)); -@@ -1461,6 +1466,7 @@ static bool dp83640_rxtstamp(struct phy_device *phydev, - static void dp83640_txtstamp(struct phy_device *phydev, - struct sk_buff *skb, int type) - { -+ struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb; - struct dp83640_private *dp83640 = phydev->priv; - - switch (dp83640->hwts_tx_en) { -@@ -1473,6 +1479,7 @@ static void dp83640_txtstamp(struct phy_device *phydev, - /* fall through */ - case HWTSTAMP_TX_ON: - skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; -+ skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT; - skb_queue_tail(&dp83640->tx_queue, skb); - break; - -diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c -index 5e151e6a3e09..3c7715ea40c1 100644 ---- a/drivers/net/usb/ch9200.c -+++ b/drivers/net/usb/ch9200.c -@@ -255,14 +255,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb, - tx_overhead = 0x40; - - len = skb->len; -- if (skb_headroom(skb) < tx_overhead) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, tx_overhead, 0, flags); -+ if (skb_cow_head(skb, tx_overhead)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - __skb_push(skb, tx_overhead); -diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c -index cd93220c9b45..a628db738b8a 100644 ---- a/drivers/net/usb/kaweth.c -+++ b/drivers/net/usb/kaweth.c -@@ -812,18 +812,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb, - } - - /* We now decide whether we can put our special header into the sk_buff */ -- if (skb_cloned(skb) || skb_headroom(skb) < 2) { -- /* no such luck - we make our own */ -- struct sk_buff *copied_skb; -- copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC); -- dev_kfree_skb_irq(skb); -- skb = copied_skb; -- if (!copied_skb) { -- kaweth->stats.tx_errors++; -- netif_start_queue(net); -- spin_unlock_irq(&kaweth->device_lock); -- return NETDEV_TX_OK; -- } -+ if (skb_cow_head(skb, 2)) { -+ kaweth->stats.tx_errors++; -+ netif_start_queue(net); -+ spin_unlock_irq(&kaweth->device_lock); -+ dev_kfree_skb_any(skb); -+ return NETDEV_TX_OK; - } - - private_header = (__le16 *)__skb_push(skb, 2); -diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c -index 7cee7777d13f..b6b8aec73b28 100644 ---- a/drivers/net/usb/smsc95xx.c -+++ b/drivers/net/usb/smsc95xx.c -@@ -1838,13 +1838,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev, - /* We do not advertise SG, so skbs should be already linearized */ - BUG_ON(skb_shinfo(skb)->nr_frags); - -- if (skb_headroom(skb) < overhead) { -- struct sk_buff *skb2 = skb_copy_expand(skb, -- overhead, 0, flags); -+ /* Make writable and expand header space by overhead if required */ -+ if (skb_cow_head(skb, overhead)) { -+ /* Must deallocate here as returning NULL to indicate error -+ * means the skb won't be deallocated in the caller. -+ */ - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - if (csum) { -diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c -index bff81b8d4164..9f1037e7e55c 100644 ---- a/drivers/net/wireless/cw1200/scan.c -+++ b/drivers/net/wireless/cw1200/scan.c -@@ -78,6 +78,10 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, - if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS) - return -EINVAL; - -+ /* will be unlocked in cw1200_scan_work() */ -+ down(&priv->scan.lock); -+ mutex_lock(&priv->conf_mutex); -+ - frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0, - req->ie_len); - if (!frame.skb) -@@ -86,19 +90,15 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, - if (req->ie_len) - memcpy(skb_put(frame.skb, req->ie_len), req->ie, req->ie_len); - -- /* will be unlocked in cw1200_scan_work() */ -- down(&priv->scan.lock); -- mutex_lock(&priv->conf_mutex); -- - ret = wsm_set_template_frame(priv, &frame); - if (!ret) { - /* Host want to be the probe responder. */ - ret = wsm_set_probe_responder(priv, true); - } - if (ret) { -+ dev_kfree_skb(frame.skb); - mutex_unlock(&priv->conf_mutex); - up(&priv->scan.lock); -- dev_kfree_skb(frame.skb); - return ret; - } - -@@ -120,10 +120,9 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, - ++priv->scan.n_ssids; - } - -- mutex_unlock(&priv->conf_mutex); -- - if (frame.skb) - dev_kfree_skb(frame.skb); -+ mutex_unlock(&priv->conf_mutex); - queue_work(priv->workqueue, &priv->scan.work); - return 0; - } -diff --git a/drivers/nfc/nxp-nci/firmware.c b/drivers/nfc/nxp-nci/firmware.c -index 5291797324ba..553011f58339 100644 ---- a/drivers/nfc/nxp-nci/firmware.c -+++ b/drivers/nfc/nxp-nci/firmware.c -@@ -24,7 +24,7 @@ - #include - #include - #include --#include -+#include - - #include "nxp-nci.h" - -diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c -index df4333c7ee0f..0b1122cb5d0c 100644 ---- a/drivers/nfc/nxp-nci/i2c.c -+++ b/drivers/nfc/nxp-nci/i2c.c -@@ -36,7 +36,7 @@ - #include - #include - #include --#include -+#include - - #include - -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c -index 9736f9be5447..a9d2e8a0aa85 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm.c -@@ -806,11 +806,24 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) - return ret; - } - -- ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio); -- if (ret) { -- dev_err(pctrl->dev, "Failed to add pin range\n"); -- gpiochip_remove(&pctrl->chip); -- return ret; -+ /* -+ * For DeviceTree-supported systems, the gpio core checks the -+ * pinctrl's device node for the "gpio-ranges" property. -+ * If it is present, it takes care of adding the pin ranges -+ * for the driver. In this case the driver can skip ahead. -+ * -+ * In order to remain compatible with older, existing DeviceTree -+ * files which don't set the "gpio-ranges" property or systems that -+ * utilize ACPI the driver has to call gpiochip_add_pin_range(). -+ */ -+ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { -+ ret = gpiochip_add_pin_range(&pctrl->chip, -+ dev_name(pctrl->dev), 0, 0, chip->ngpio); -+ if (ret) { -+ dev_err(pctrl->dev, "Failed to add pin range\n"); -+ gpiochip_remove(&pctrl->chip); -+ return ret; -+ } - } - - ret = gpiochip_irqchip_add(chip, -diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c -index 4eb254a273f8..4861cfddcdd3 100644 ---- a/drivers/ptp/ptp_chardev.c -+++ b/drivers/ptp/ptp_chardev.c -@@ -204,7 +204,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) - pct->sec = ts.tv_sec; - pct->nsec = ts.tv_nsec; - pct++; -- ptp->info->gettime64(ptp->info, &ts); -+ err = ptp->info->gettime64(ptp->info, &ts); -+ if (err) -+ goto out; - pct->sec = ts.tv_sec; - pct->nsec = ts.tv_nsec; - pct++; -@@ -257,6 +259,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) - break; - } - -+out: - kfree(sysoff); - return err; - } -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index fd8fe1202dbe..398c9a0a5ade 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5105,6 +5105,9 @@ error: - stat = (struct ls_rjt *)(pcmd + sizeof(uint32_t)); - stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC; - -+ if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE) -+ stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS; -+ - elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; - phba->fc_stat.elsXmitLSRJT++; - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); -diff --git a/drivers/soc/tegra/common.c b/drivers/soc/tegra/common.c -index cd8f41351add..7bfb154d6fa5 100644 ---- a/drivers/soc/tegra/common.c -+++ b/drivers/soc/tegra/common.c -@@ -22,11 +22,15 @@ static const struct of_device_id tegra_machine_match[] = { - - bool soc_is_tegra(void) - { -+ const struct of_device_id *match; - struct device_node *root; - - root = of_find_node_by_path("/"); - if (!root) - return false; - -- return of_match_node(tegra_machine_match, root) != NULL; -+ match = of_match_node(tegra_machine_match, root); -+ of_node_put(root); -+ -+ return match != NULL; - } -diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c -index 35acb1a4669b..db8390022732 100644 ---- a/drivers/staging/iio/adc/ad7280a.c -+++ b/drivers/staging/iio/adc/ad7280a.c -@@ -250,7 +250,9 @@ static int ad7280_read(struct ad7280_state *st, unsigned devaddr, - if (ret) - return ret; - -- __ad7280_read32(st, &tmp); -+ ret = __ad7280_read32(st, &tmp); -+ if (ret) -+ return ret; - - if (ad7280_check_crc(st, tmp)) - return -EIO; -@@ -288,7 +290,9 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned devaddr, - - ad7280_delay(st); - -- __ad7280_read32(st, &tmp); -+ ret = __ad7280_read32(st, &tmp); -+ if (ret) -+ return ret; - - if (ad7280_check_crc(st, tmp)) - return -EIO; -@@ -321,7 +325,9 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned cnt, - ad7280_delay(st); - - for (i = 0; i < cnt; i++) { -- __ad7280_read32(st, &tmp); -+ ret = __ad7280_read32(st, &tmp); -+ if (ret) -+ return ret; - - if (ad7280_check_crc(st, tmp)) - return -EIO; -@@ -364,7 +370,10 @@ static int ad7280_chain_setup(struct ad7280_state *st) - return ret; - - for (n = 0; n <= AD7280A_MAX_CHAIN; n++) { -- __ad7280_read32(st, &val); -+ ret = __ad7280_read32(st, &val); -+ if (ret) -+ return ret; -+ - if (val == 0) - return n - 1; - -diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c -index 3abc7789237f..531338ea5eb4 100644 ---- a/drivers/staging/iio/adc/ad7780.c -+++ b/drivers/staging/iio/adc/ad7780.c -@@ -90,12 +90,16 @@ static int ad7780_read_raw(struct iio_dev *indio_dev, - long m) - { - struct ad7780_state *st = iio_priv(indio_dev); -+ int voltage_uv; - - switch (m) { - case IIO_CHAN_INFO_RAW: - return ad_sigma_delta_single_conversion(indio_dev, chan, val); - case IIO_CHAN_INFO_SCALE: -- *val = st->int_vref_mv * st->gain; -+ voltage_uv = regulator_get_voltage(st->reg); -+ if (voltage_uv < 0) -+ return voltage_uv; -+ *val = (voltage_uv / 1000) * st->gain; - *val2 = chan->scan_type.realbits - 1; - return IIO_VAL_FRACTIONAL_LOG2; - case IIO_CHAN_INFO_OFFSET: -diff --git a/drivers/staging/iio/resolver/ad2s90.c b/drivers/staging/iio/resolver/ad2s90.c -index 5b1c0db33e7f..b44253eb62ec 100644 ---- a/drivers/staging/iio/resolver/ad2s90.c -+++ b/drivers/staging/iio/resolver/ad2s90.c -@@ -86,7 +86,12 @@ static int ad2s90_probe(struct spi_device *spi) - /* need 600ns between CS and the first falling edge of SCLK */ - spi->max_speed_hz = 830000; - spi->mode = SPI_MODE_3; -- spi_setup(spi); -+ ret = spi_setup(spi); -+ -+ if (ret < 0) { -+ dev_err(&spi->dev, "spi_setup failed!\n"); -+ return ret; -+ } - - return 0; - } -diff --git a/drivers/thermal/thermal_hwmon.h b/drivers/thermal/thermal_hwmon.h -index c798fdb2ae43..f97f76691bd0 100644 ---- a/drivers/thermal/thermal_hwmon.h -+++ b/drivers/thermal/thermal_hwmon.h -@@ -34,13 +34,13 @@ - int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz); - void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz); - #else --static int -+static inline int - thermal_add_hwmon_sysfs(struct thermal_zone_device *tz) - { - return 0; - } - --static void -+static inline void - thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz) - { - } -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 01e2274b23f2..8b5ec9386f0f 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -1267,6 +1267,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios, - else - cr1 &= ~UARTCR1_PT; - } -+ } else { -+ cr1 &= ~UARTCR1_PE; - } - - /* ask the core to calculate the divisor */ -@@ -1402,6 +1404,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, - else - ctrl &= ~UARTCTRL_PT; - } -+ } else { -+ ctrl &= ~UARTCTRL_PE; - } - - /* ask the core to calculate the divisor */ -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 4d532a085db9..12bac2cbae4b 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1329,11 +1329,14 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, - wr_regl(port, S3C2410_ULCON, ulcon); - wr_regl(port, S3C2410_UBRDIV, quot); - -+ port->status &= ~UPSTAT_AUTOCTS; -+ - umcon = rd_regl(port, S3C2410_UMCON); - if (termios->c_cflag & CRTSCTS) { - umcon |= S3C2410_UMCOM_AFC; - /* Disable RTS when RX FIFO contains 63 bytes */ - umcon &= ~S3C2412_UMCON_AFC_8; -+ port->status = UPSTAT_AUTOCTS; - } else { - umcon &= ~S3C2410_UMCOM_AFC; - } -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index be63db142d3f..3a6978458d95 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1092,6 +1092,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - USB_PORT_FEAT_ENABLE); - } - -+ /* -+ * Add debounce if USB3 link is in polling/link training state. -+ * Link will automatically transition to Enabled state after -+ * link training completes. -+ */ -+ if (hub_is_superspeed(hdev) && -+ ((portstatus & USB_PORT_STAT_LINK_STATE) == -+ USB_SS_PORT_LS_POLLING)) -+ need_debounce_delay = true; -+ - /* Clear status-change flags; we'll debounce later */ - if (portchange & USB_PORT_STAT_C_CONNECTION) { - need_debounce_delay = true; -diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c -index 18f5ebd447b8..3b6e34fc032b 100644 ---- a/drivers/usb/gadget/udc/net2272.c -+++ b/drivers/usb/gadget/udc/net2272.c -@@ -2100,7 +2100,7 @@ static irqreturn_t net2272_irq(int irq, void *_dev) - #if defined(PLX_PCI_RDK2) - /* see if PCI int for us by checking irqstat */ - intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT); -- if (!intcsr & (1 << NET2272_PCI_IRQ)) { -+ if (!(intcsr & (1 << NET2272_PCI_IRQ))) { - spin_unlock(&dev->lock); - return IRQ_NONE; - } -diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c -index 90b67a4ca221..558f33a75fd9 100644 ---- a/drivers/usb/phy/phy-am335x.c -+++ b/drivers/usb/phy/phy-am335x.c -@@ -56,9 +56,6 @@ static int am335x_phy_probe(struct platform_device *pdev) - if (ret) - return ret; - -- ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy); -- if (ret) -- return ret; - am_phy->usb_phy_gen.phy.init = am335x_init; - am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown; - -@@ -77,7 +74,7 @@ static int am335x_phy_probe(struct platform_device *pdev) - device_set_wakeup_enable(dev, false); - phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, false); - -- return 0; -+ return usb_add_phy_dev(&am_phy->usb_phy_gen.phy); - } - - static int am335x_phy_remove(struct platform_device *pdev) -diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c -index 4e3c78d88832..c03c5b9602bb 100644 ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -3032,7 +3032,7 @@ static int fbcon_fb_unbind(int idx) - for (i = first_fb_vc; i <= last_fb_vc; i++) { - if (con2fb_map[i] != idx && - con2fb_map[i] != -1) { -- new_idx = i; -+ new_idx = con2fb_map[i]; - break; - } - } -diff --git a/drivers/video/fbdev/clps711x-fb.c b/drivers/video/fbdev/clps711x-fb.c -index 649b32f78c08..c55109524fd5 100644 ---- a/drivers/video/fbdev/clps711x-fb.c -+++ b/drivers/video/fbdev/clps711x-fb.c -@@ -287,14 +287,17 @@ static int clps711x_fb_probe(struct platform_device *pdev) - } - - ret = of_get_fb_videomode(disp, &cfb->mode, OF_USE_NATIVE_MODE); -- if (ret) -+ if (ret) { -+ of_node_put(disp); - goto out_fb_release; -+ } - - of_property_read_u32(disp, "ac-prescale", &cfb->ac_prescale); - cfb->cmap_invert = of_property_read_bool(disp, "cmap-invert"); - - ret = of_property_read_u32(disp, "bits-per-pixel", - &info->var.bits_per_pixel); -+ of_node_put(disp); - if (ret) - goto out_fb_release; - -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index 8a29ec5992fd..ea2bd6208a2f 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -433,7 +433,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, - image->dx += image->width + 8; - } - } else if (rotate == FB_ROTATE_UD) { -- for (x = 0; x < num; x++) { -+ u32 dx = image->dx; -+ -+ for (x = 0; x < num && image->dx <= dx; x++) { - info->fbops->fb_imageblit(info, image); - image->dx -= image->width + 8; - } -@@ -445,7 +447,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, - image->dy += image->height + 8; - } - } else if (rotate == FB_ROTATE_CCW) { -- for (x = 0; x < num; x++) { -+ u32 dy = image->dy; -+ -+ for (x = 0; x < num && image->dy <= dy; x++) { - info->fbops->fb_imageblit(info, image); - image->dy -= image->height + 8; - } -diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig -index 8bef27b8f85d..e7b478b49985 100644 ---- a/fs/cifs/Kconfig -+++ b/fs/cifs/Kconfig -@@ -111,7 +111,7 @@ config CIFS_XATTR - - config CIFS_POSIX - bool "CIFS POSIX Extensions" -- depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR -+ depends on CIFS_XATTR - help - Enabling this option will cause the cifs client to attempt to - negotiate a newer dialect with servers, such as Samba 3.0.5 -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 026b399af215..1062e96ee272 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -1081,6 +1081,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) - return -EINVAL; - } - -+ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) > -+ PAGE_SIZE); -+ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), -+ PAGE_SIZE); - max_num = (max_buf - sizeof(struct smb_hdr)) / - sizeof(LOCKING_ANDX_RANGE); - buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); -@@ -1410,6 +1414,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) - return -EINVAL; - -+ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) > -+ PAGE_SIZE); -+ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), -+ PAGE_SIZE); - max_num = (max_buf - sizeof(struct smb_hdr)) / - sizeof(LOCKING_ANDX_RANGE); - buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); -diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c -index 57b039ebfb1f..43fa471c88d7 100644 ---- a/fs/cifs/readdir.c -+++ b/fs/cifs/readdir.c -@@ -652,7 +652,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, - /* scan and find it */ - int i; - char *cur_ent; -- char *end_of_smb = cfile->srch_inf.ntwrk_buf_start + -+ char *end_of_smb; -+ -+ if (cfile->srch_inf.ntwrk_buf_start == NULL) { -+ cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n"); -+ return -EIO; -+ } -+ -+ end_of_smb = cfile->srch_inf.ntwrk_buf_start + - server->ops->calc_smb_size( - cfile->srch_inf.ntwrk_buf_start); - -diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c -index b7885dc0d9bb..dee5250701de 100644 ---- a/fs/cifs/smb2file.c -+++ b/fs/cifs/smb2file.c -@@ -129,6 +129,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - if (max_buf < sizeof(struct smb2_lock_element)) - return -EINVAL; - -+ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE); -+ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); - max_num = max_buf / sizeof(struct smb2_lock_element); - buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL); - if (!buf) -@@ -265,6 +267,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile) - return -EINVAL; - } - -+ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE); -+ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); - max_num = max_buf / sizeof(struct smb2_lock_element); - buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL); - if (!buf) { -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index e49ba072bd64..22fe11baef2b 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -671,6 +671,13 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, - struct dentry *dentry = NULL, *trap; - struct name_snapshot old_name; - -+ if (IS_ERR(old_dir)) -+ return old_dir; -+ if (IS_ERR(new_dir)) -+ return new_dir; -+ if (IS_ERR_OR_NULL(old_dentry)) -+ return old_dentry; -+ - trap = lock_rename(new_dir, old_dir); - /* Source or destination directories don't exist? */ - if (d_really_is_negative(old_dir) || d_really_is_negative(new_dir)) -diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c -index dcea1e37a1b7..f18619bc2e09 100644 ---- a/fs/dlm/ast.c -+++ b/fs/dlm/ast.c -@@ -290,6 +290,8 @@ void dlm_callback_suspend(struct dlm_ls *ls) - flush_workqueue(ls->ls_callback_wq); - } - -+#define MAX_CB_QUEUE 25 -+ - void dlm_callback_resume(struct dlm_ls *ls) - { - struct dlm_lkb *lkb, *safe; -@@ -300,15 +302,23 @@ void dlm_callback_resume(struct dlm_ls *ls) - if (!ls->ls_callback_wq) - return; - -+more: - mutex_lock(&ls->ls_cb_mutex); - list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) { - list_del_init(&lkb->lkb_cb_list); - queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work); - count++; -+ if (count == MAX_CB_QUEUE) -+ break; - } - mutex_unlock(&ls->ls_cb_mutex); - - if (count) - log_rinfo(ls, "dlm_callback_resume %d", count); -+ if (count == MAX_CB_QUEUE) { -+ count = 0; -+ cond_resched(); -+ goto more; -+ } - } - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 1b08556776ce..240d9ceb8d0c 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -1034,7 +1034,7 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k - * semantics). All the events that happen during that period of time are - * chained in ep->ovflist and requeued later on. - */ -- if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) { -+ if (ep->ovflist != EP_UNACTIVE_PTR) { - if (epi->next == EP_UNACTIVE_PTR) { - epi->next = ep->ovflist; - ep->ovflist = epi; -diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c -index 83dcf7bfd7b8..f0ea91925343 100644 ---- a/fs/f2fs/acl.c -+++ b/fs/f2fs/acl.c -@@ -350,12 +350,14 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode, - return PTR_ERR(p); - - clone = f2fs_acl_clone(p, GFP_NOFS); -- if (!clone) -- goto no_mem; -+ if (!clone) { -+ ret = -ENOMEM; -+ goto release_acl; -+ } - - ret = f2fs_acl_create_masq(clone, mode); - if (ret < 0) -- goto no_mem_clone; -+ goto release_clone; - - if (ret == 0) - posix_acl_release(clone); -@@ -369,11 +371,11 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode, - - return 0; - --no_mem_clone: -+release_clone: - posix_acl_release(clone); --no_mem: -+release_acl: - posix_acl_release(p); -- return -ENOMEM; -+ return ret; - } - - int f2fs_init_acl(struct inode *inode, struct inode *dir, struct page *ipage, -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 96bfd9f0ea02..bee3bc7a16ac 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -200,6 +200,9 @@ int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - - trace_f2fs_sync_file_enter(inode); - -+ if (S_ISDIR(inode->i_mode)) -+ goto go_write; -+ - /* if fdatasync is triggered, let's do in-place-update */ - if (get_dirty_pages(inode) <= SM_I(sbi)->min_fsync_blocks) - set_inode_flag(fi, FI_NEED_IPU); -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index e566652ac922..341196338e48 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -1741,7 +1741,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, - req->in.h.nodeid = outarg->nodeid; - req->in.numargs = 2; - req->in.argpages = 1; -- req->page_descs[0].offset = offset; - req->end = fuse_retrieve_end; - - index = outarg->offset >> PAGE_CACHE_SHIFT; -@@ -1756,6 +1755,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, - - this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset); - req->pages[req->num_pages] = page; -+ req->page_descs[req->num_pages].offset = offset; - req->page_descs[req->num_pages].length = this_num; - req->num_pages++; - -@@ -2074,10 +2074,13 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, - - ret = fuse_dev_do_write(fud, &cs, len); - -+ pipe_lock(pipe); - for (idx = 0; idx < nbuf; idx++) { - struct pipe_buffer *buf = &bufs[idx]; - buf->ops->release(pipe, buf); - } -+ pipe_unlock(pipe); -+ - out: - kfree(bufs); - return ret; -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 7014318f6d18..d40c2451487c 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1784,7 +1784,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req, - spin_unlock(&fc->lock); - - dec_wb_stat(&bdi->wb, WB_WRITEBACK); -- dec_zone_page_state(page, NR_WRITEBACK_TEMP); -+ dec_zone_page_state(new_req->pages[0], NR_WRITEBACK_TEMP); - wb_writeout_inc(&bdi->wb); - fuse_writepage_free(fc, new_req); - fuse_request_free(new_req); -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index 62f358f67764..412fcfbc50e2 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -2376,8 +2376,7 @@ static int nfs_compare_mount_options(const struct super_block *s, const struct n - goto Ebusy; - if (a->acdirmax != b->acdirmax) - goto Ebusy; -- if (b->auth_info.flavor_len > 0 && -- clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor) -+ if (clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor) - goto Ebusy; - return 1; - Ebusy: -diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c -index 9690cb4dd588..03c7a4e7b6ba 100644 ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -1106,6 +1106,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) - case 'Y': - case 'y': - case '1': -+ if (nn->nfsd_serv) -+ return -EBUSY; - nfsd4_end_grace(nn); - break; - default: -diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c -index 272269f1c310..9ee8bcfbf00f 100644 ---- a/fs/ocfs2/buffer_head_io.c -+++ b/fs/ocfs2/buffer_head_io.c -@@ -146,7 +146,6 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, - BUG(); - } - -- clear_buffer_uptodate(bh); - get_bh(bh); /* for end_buffer_read_sync() */ - bh->b_end_io = end_buffer_read_sync; - submit_bh(READ, bh); -@@ -300,7 +299,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, - continue; - } - -- clear_buffer_uptodate(bh); - get_bh(bh); /* for end_buffer_read_sync() */ - if (validate) - set_buffer_needs_validate(bh); -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 0e659d9c69a1..613193c6bb42 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1364,6 +1364,12 @@ reread: - - iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) & - ICBTAG_FLAG_AD_MASK; -+ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT && -+ iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG && -+ iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) { -+ ret = -EIO; -+ goto out; -+ } - iinfo->i_unique = 0; - iinfo->i_lenEAttr = 0; - iinfo->i_lenExtents = 0; -diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h -index eecd19b37001..250e9be65e74 100644 ---- a/include/linux/genl_magic_struct.h -+++ b/include/linux/genl_magic_struct.h -@@ -185,6 +185,7 @@ static inline void ct_assert_unique_operations(void) - { - switch (0) { - #include GENL_MAGIC_INCLUDE_FILE -+ case 0: - ; - } - } -@@ -203,6 +204,7 @@ static inline void ct_assert_unique_top_level_attributes(void) - { - switch (0) { - #include GENL_MAGIC_INCLUDE_FILE -+ case 0: - ; - } - } -@@ -212,7 +214,8 @@ static inline void ct_assert_unique_top_level_attributes(void) - static inline void ct_assert_unique_ ## s_name ## _attributes(void) \ - { \ - switch (0) { \ -- s_fields \ -+ s_fields \ -+ case 0: \ - ; \ - } \ - } -diff --git a/include/linux/hid-debug.h b/include/linux/hid-debug.h -index 8663f216c563..2d6100edf204 100644 ---- a/include/linux/hid-debug.h -+++ b/include/linux/hid-debug.h -@@ -24,7 +24,10 @@ - - #ifdef CONFIG_DEBUG_FS - -+#include -+ - #define HID_DEBUG_BUFSIZE 512 -+#define HID_DEBUG_FIFOSIZE 512 - - void hid_dump_input(struct hid_device *, struct hid_usage *, __s32); - void hid_dump_report(struct hid_device *, int , u8 *, int); -@@ -37,11 +40,8 @@ void hid_debug_init(void); - void hid_debug_exit(void); - void hid_debug_event(struct hid_device *, char *); - -- - struct hid_debug_list { -- char *hid_debug_buf; -- int head; -- int tail; -+ DECLARE_KFIFO_PTR(hid_debug_fifo, char); - struct fasync_struct *fasync; - struct hid_device *hdev; - struct list_head node; -@@ -64,4 +64,3 @@ struct hid_debug_list { - #endif - - #endif -- -diff --git a/include/linux/string.h b/include/linux/string.h -index 98bb781a2eff..c026b7a19e26 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -26,7 +26,7 @@ extern char * strncpy(char *,const char *, __kernel_size_t); - size_t strlcpy(char *, const char *, size_t); - #endif - #ifndef __HAVE_ARCH_STRSCPY --ssize_t __must_check strscpy(char *, const char *, size_t); -+ssize_t strscpy(char *, const char *, size_t); - #endif - #ifndef __HAVE_ARCH_STRCAT - extern char * strcat(char *, const char *); -diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h -index fa1d05512c09..85ff3181e6f1 100644 ---- a/include/sound/compress_driver.h -+++ b/include/sound/compress_driver.h -@@ -178,7 +178,11 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) - if (snd_BUG_ON(!stream)) - return; - -- stream->runtime->state = SNDRV_PCM_STATE_SETUP; -+ if (stream->direction == SND_COMPRESS_PLAYBACK) -+ stream->runtime->state = SNDRV_PCM_STATE_SETUP; -+ else -+ stream->runtime->state = SNDRV_PCM_STATE_PREPARED; -+ - wake_up(&stream->runtime->sleep); - } - -diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h -index 064d2026ab38..373afec2ed34 100644 ---- a/include/uapi/linux/if_ether.h -+++ b/include/uapi/linux/if_ether.h -@@ -136,11 +136,18 @@ - * This is an Ethernet frame header. - */ - -+/* allow libcs like musl to deactivate this, glibc does not implement this. */ -+#ifndef __UAPI_DEF_ETHHDR -+#define __UAPI_DEF_ETHHDR 1 -+#endif -+ -+#if __UAPI_DEF_ETHHDR - struct ethhdr { - unsigned char h_dest[ETH_ALEN]; /* destination eth addr */ - unsigned char h_source[ETH_ALEN]; /* source ether addr */ - __be16 h_proto; /* packet type ID field */ - } __attribute__((packed)); -+#endif - - - #endif /* _UAPI_LINUX_IF_ETHER_H */ -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index 58013ef228a1..358bb53c1e74 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -637,6 +637,9 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags) - size = sizeof(struct ring_buffer); - size += nr_pages * sizeof(void *); - -+ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER) -+ goto fail; -+ - rb = kzalloc(size, GFP_KERNEL); - if (!rb) - goto fail; -diff --git a/kernel/hung_task.c b/kernel/hung_task.c -index e0f90c2b57aa..cc05b97ba569 100644 ---- a/kernel/hung_task.c -+++ b/kernel/hung_task.c -@@ -30,7 +30,7 @@ int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT; - * is disabled during the critical section. It also controls the size of - * the RCU grace period. So it needs to be upper-bound. - */ --#define HUNG_TASK_BATCHING 1024 -+#define HUNG_TASK_LOCK_BREAK (HZ / 10) - - /* - * Zero means infinite timeout - no checking done: -@@ -158,7 +158,7 @@ static bool rcu_lock_break(struct task_struct *g, struct task_struct *t) - static void check_hung_uninterruptible_tasks(unsigned long timeout) - { - int max_count = sysctl_hung_task_check_count; -- int batch_count = HUNG_TASK_BATCHING; -+ unsigned long last_break = jiffies; - struct task_struct *g, *t; - - /* -@@ -172,10 +172,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout) - for_each_process_thread(g, t) { - if (!max_count--) - goto unlock; -- if (!--batch_count) { -- batch_count = HUNG_TASK_BATCHING; -+ if (time_after(jiffies, last_break + HUNG_TASK_LOCK_BREAK)) { - if (!rcu_lock_break(g, t)) - goto unlock; -+ last_break = jiffies; - } - /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */ - if (t->state == TASK_UNINTERRUPTIBLE) -diff --git a/kernel/signal.c b/kernel/signal.c -index 5b1313309356..96e8c3cbfa38 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -696,6 +696,48 @@ static inline bool si_fromuser(const struct siginfo *info) - (!is_si_special(info) && SI_FROMUSER(info)); - } - -+static int dequeue_synchronous_signal(siginfo_t *info) -+{ -+ struct task_struct *tsk = current; -+ struct sigpending *pending = &tsk->pending; -+ struct sigqueue *q, *sync = NULL; -+ -+ /* -+ * Might a synchronous signal be in the queue? -+ */ -+ if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK)) -+ return 0; -+ -+ /* -+ * Return the first synchronous signal in the queue. -+ */ -+ list_for_each_entry(q, &pending->list, list) { -+ /* Synchronous signals have a postive si_code */ -+ if ((q->info.si_code > SI_USER) && -+ (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) { -+ sync = q; -+ goto next; -+ } -+ } -+ return 0; -+next: -+ /* -+ * Check if there is another siginfo for the same signal. -+ */ -+ list_for_each_entry_continue(q, &pending->list, list) { -+ if (q->info.si_signo == sync->info.si_signo) -+ goto still_pending; -+ } -+ -+ sigdelset(&pending->signal, sync->info.si_signo); -+ recalc_sigpending(); -+still_pending: -+ list_del_init(&sync->list); -+ copy_siginfo(info, &sync->info); -+ __sigqueue_free(sync); -+ return info->si_signo; -+} -+ - /* - * called with RCU read lock from check_kill_permission() - */ -@@ -2198,6 +2240,14 @@ relock: - goto relock; - } - -+ /* Has this task already been marked for death? */ -+ if (signal_group_exit(signal)) { -+ ksig->info.si_signo = signr = SIGKILL; -+ sigdelset(¤t->pending.signal, SIGKILL); -+ recalc_sigpending(); -+ goto fatal; -+ } -+ - for (;;) { - struct k_sigaction *ka; - -@@ -2211,7 +2261,15 @@ relock: - goto relock; - } - -- signr = dequeue_signal(current, ¤t->blocked, &ksig->info); -+ /* -+ * Signals generated by the execution of an instruction -+ * need to be delivered before any other pending signals -+ * so that the instruction pointer in the signal stack -+ * frame points to the faulting instruction. -+ */ -+ signr = dequeue_synchronous_signal(&ksig->info); -+ if (!signr) -+ signr = dequeue_signal(current, ¤t->blocked, &ksig->info); - - if (!signr) - break; /* will return 0 */ -@@ -2293,6 +2351,7 @@ relock: - continue; - } - -+ fatal: - spin_unlock_irq(&sighand->siglock); - - /* -diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index fed86b2dfc89..d9837d25dfe0 100644 ---- a/kernel/time/timekeeping.c -+++ b/kernel/time/timekeeping.c -@@ -39,7 +39,9 @@ - static struct { - seqcount_t seq; - struct timekeeper timekeeper; --} tk_core ____cacheline_aligned; -+} tk_core ____cacheline_aligned = { -+ .seq = SEQCNT_ZERO(tk_core.seq), -+}; - - static DEFINE_RAW_SPINLOCK(timekeeper_lock); - static struct timekeeper shadow_timekeeper; -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index 1dc887bab085..518e62a398d2 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -150,7 +150,14 @@ static void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, - - ret = strncpy_from_user(dst, src, maxlen); - if (ret == maxlen) -- dst[--ret] = '\0'; -+ dst[ret - 1] = '\0'; -+ else if (ret >= 0) -+ /* -+ * Include the terminating null byte. In this case it -+ * was copied by strncpy_from_user but not accounted -+ * for in ret. -+ */ -+ ret++; - - if (ret < 0) { /* Failed to fetch string */ - ((u8 *)get_rloc_data(dest))[0] = '\0'; -diff --git a/lib/seq_buf.c b/lib/seq_buf.c -index 5c94e1012a91..cbef5ee4c459 100644 ---- a/lib/seq_buf.c -+++ b/lib/seq_buf.c -@@ -143,9 +143,13 @@ int seq_buf_puts(struct seq_buf *s, const char *str) - - WARN_ON(s->size == 0); - -+ /* Add 1 to len for the trailing null byte which must be there */ -+ len += 1; -+ - if (seq_buf_can_fit(s, len)) { - memcpy(s->buffer + s->len, str, len); -- s->len += len; -+ /* Don't count the trailing null byte against the capacity */ -+ s->len += len - 1; - return 0; - } - seq_buf_set_overflow(s); -diff --git a/lib/test-hexdump.c b/lib/test-hexdump.c -index 5241df36eedf..dadcabe50988 100644 ---- a/lib/test-hexdump.c -+++ b/lib/test-hexdump.c -@@ -81,7 +81,7 @@ static void __init test_hexdump(size_t len, int rowsize, int groupsize, - const char *q = *result++; - size_t amount = strlen(q); - -- strncpy(p, q, amount); -+ memcpy(p, q, amount); - p += amount + 1; - } - if (i) -diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c -index f11345e163d7..3c8d8142e8c6 100644 ---- a/net/batman-adv/hard-interface.c -+++ b/net/batman-adv/hard-interface.c -@@ -18,7 +18,6 @@ - #include "hard-interface.h" - #include "main.h" - --#include - #include - #include - #include -@@ -104,8 +103,10 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev) - /* recurse over the parent device */ - parent_dev = __dev_get_by_index(&init_net, dev_get_iflink(net_dev)); - /* if we got a NULL parent_dev there is something broken.. */ -- if (WARN(!parent_dev, "Cannot find parent device")) -+ if (!parent_dev) { -+ pr_err("Cannot find parent device\n"); - return false; -+ } - - ret = batadv_is_on_batman_iface(parent_dev); - -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index 9f1fe6169bef..5aeb585571ed 100644 ---- a/net/batman-adv/soft-interface.c -+++ b/net/batman-adv/soft-interface.c -@@ -209,6 +209,8 @@ static int batadv_interface_tx(struct sk_buff *skb, - - soft_iface->trans_start = jiffies; - vid = batadv_get_vid(skb, 0); -+ -+ skb_reset_mac_header(skb); - ethhdr = eth_hdr(skb); - - switch (ntohs(ethhdr->h_proto)) { -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index d40d32a2c12d..37fe2b158c2a 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5185,6 +5185,12 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, - return true; - } - -+ /* Check if request ended in Command Status - no way to retreive -+ * any extra parameters in this case. -+ */ -+ if (hdr->evt == HCI_EV_CMD_STATUS) -+ return false; -+ - if (hdr->evt != HCI_EV_CMD_COMPLETE) { - BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt); - return false; -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index ad3c9e96a275..3e6897efe1eb 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -3181,9 +3181,10 @@ void ceph_con_keepalive(struct ceph_connection *con) - dout("con_keepalive %p\n", con); - mutex_lock(&con->mutex); - clear_standby(con); -+ con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING); - mutex_unlock(&con->mutex); -- if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 && -- con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0) -+ -+ if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0) - queue_con(con); - } - EXPORT_SYMBOL(ceph_con_keepalive); -diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h -index 6eb837a47b5c..baaaeb2b2c42 100644 ---- a/net/dccp/ccid.h -+++ b/net/dccp/ccid.h -@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk, - static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk, - u8 pkt, u8 opt, u8 *val, u8 len) - { -- if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL) -+ if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options) - return 0; - return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len); - } -@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk, - static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk, - u8 pkt, u8 opt, u8 *val, u8 len) - { -- if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL) -+ if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options) - return 0; - return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len); - } -diff --git a/net/dsa/slave.c b/net/dsa/slave.c -index 48b28a7ecc7a..4256ac95a141 100644 ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -157,10 +157,14 @@ static void dsa_slave_change_rx_flags(struct net_device *dev, int change) - struct dsa_slave_priv *p = netdev_priv(dev); - struct net_device *master = p->parent->dst->master_netdev; - -- if (change & IFF_ALLMULTI) -- dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1); -- if (change & IFF_PROMISC) -- dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1); -+ if (dev->flags & IFF_UP) { -+ if (change & IFF_ALLMULTI) -+ dev_set_allmulti(master, -+ dev->flags & IFF_ALLMULTI ? 1 : -1); -+ if (change & IFF_PROMISC) -+ dev_set_promiscuity(master, -+ dev->flags & IFF_PROMISC ? 1 : -1); -+ } - } - - static void dsa_slave_set_rx_mode(struct net_device *dev) -diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c -index 5743044cd660..56b72cada346 100644 ---- a/net/ipv6/xfrm6_tunnel.c -+++ b/net/ipv6/xfrm6_tunnel.c -@@ -144,6 +144,9 @@ static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr) - index = __xfrm6_tunnel_spi_check(net, spi); - if (index >= 0) - goto alloc_spi; -+ -+ if (spi == XFRM6_TUNNEL_SPI_MAX) -+ break; - } - for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) { - index = __xfrm6_tunnel_spi_check(net, spi); -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 64f76f88f819..acacceec8cd8 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -149,6 +149,9 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, - /* allocate extra bitmaps */ - if (status->chains) - len += 4 * hweight8(status->chains); -+ /* vendor presence bitmap */ -+ if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) -+ len += 4; - - if (ieee80211_have_rx_timestamp(status)) { - len = ALIGN(len, 8); -@@ -185,8 +188,6 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, - if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { - struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; - -- /* vendor presence bitmap */ -- len += 4; - /* alignment for fixed 6-byte vendor data header */ - len = ALIGN(len, 2); - /* vendor data header */ -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index c1c27a516e45..41f3eb565ef3 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -1599,9 +1599,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, - int head_need, bool may_encrypt) - { - struct ieee80211_local *local = sdata->local; -+ struct ieee80211_hdr *hdr; -+ bool enc_tailroom; - int tail_need = 0; - -- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { -+ hdr = (struct ieee80211_hdr *) skb->data; -+ enc_tailroom = may_encrypt && -+ (sdata->crypto_tx_tailroom_needed_cnt || -+ ieee80211_is_mgmt(hdr->frame_control)); -+ -+ if (enc_tailroom) { - tail_need = IEEE80211_ENCRYPT_TAILROOM; - tail_need -= skb_tailroom(skb); - tail_need = max_t(int, tail_need, 0); -@@ -1609,8 +1616,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, - - if (skb_cloned(skb) && - (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) || -- !skb_clone_writable(skb, ETH_HLEN) || -- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt))) -+ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom)) - I802_DEBUG_INC(local->tx_expand_skb_head_cloned); - else if (head_need || tail_need) - I802_DEBUG_INC(local->tx_expand_skb_head); -diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c -index f9ff73a8d815..500c9e614a06 100644 ---- a/net/tipc/subscr.c -+++ b/net/tipc/subscr.c -@@ -337,7 +337,7 @@ int tipc_topsrv_start(struct net *net) - topsrv->tipc_conn_new = tipc_subscrb_connect_cb; - topsrv->tipc_conn_shutdown = tipc_subscrb_shutdown_cb; - -- strncpy(topsrv->name, name, strlen(name) + 1); -+ strscpy(topsrv->name, name, sizeof(topsrv->name)); - tn->topsrv = topsrv; - atomic_set(&tn->subscription_count, 0); - -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 476f1fc6d655..177a6c75f136 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -1404,10 +1404,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) - if (!ut[i].family) - ut[i].family = family; - -- if ((ut[i].mode == XFRM_MODE_TRANSPORT) && -- (ut[i].family != prev_family)) -- return -EINVAL; -- -+ switch (ut[i].mode) { -+ case XFRM_MODE_TUNNEL: -+ case XFRM_MODE_BEET: -+ break; -+ default: -+ if (ut[i].family != prev_family) -+ return -EINVAL; -+ break; -+ } - if (ut[i].mode >= XFRM_MODE_MAX) - return -EINVAL; - -diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh -index 00d6d53c2681..ffc46c7c3afb 100755 ---- a/scripts/decode_stacktrace.sh -+++ b/scripts/decode_stacktrace.sh -@@ -64,7 +64,7 @@ parse_symbol() { - fi - - # Strip out the base of the path -- code=${code//$basepath/""} -+ code=${code//^$basepath/""} - - # In the case of inlines, move everything to same line - code=${code//$'\n'/' '} -diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index 064fbfbbb22c..81b1c02a76fa 100644 ---- a/scripts/mod/modpost.c -+++ b/scripts/mod/modpost.c -@@ -1197,6 +1197,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch, - return 1; - } - -+static inline int is_arm_mapping_symbol(const char *str) -+{ -+ return str[0] == '$' && strchr("axtd", str[1]) -+ && (str[2] == '\0' || str[2] == '.'); -+} -+ -+/* -+ * If there's no name there, ignore it; likewise, ignore it if it's -+ * one of the magic symbols emitted used by current ARM tools. -+ * -+ * Otherwise if find_symbols_between() returns those symbols, they'll -+ * fail the whitelist tests and cause lots of false alarms ... fixable -+ * only by merging __exit and __init sections into __text, bloating -+ * the kernel (which is especially evil on embedded platforms). -+ */ -+static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) -+{ -+ const char *name = elf->strtab + sym->st_name; -+ -+ if (!name || !strlen(name)) -+ return 0; -+ return !is_arm_mapping_symbol(name); -+} -+ - /** - * Find symbol based on relocation record info. - * In some cases the symbol supplied is a valid symbol so -@@ -1222,6 +1246,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, - continue; - if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) - continue; -+ if (!is_valid_name(elf, sym)) -+ continue; - if (sym->st_value == addr) - return sym; - /* Find a symbol nearby - addr are maybe negative */ -@@ -1240,30 +1266,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, - return NULL; - } - --static inline int is_arm_mapping_symbol(const char *str) --{ -- return str[0] == '$' && strchr("axtd", str[1]) -- && (str[2] == '\0' || str[2] == '.'); --} -- --/* -- * If there's no name there, ignore it; likewise, ignore it if it's -- * one of the magic symbols emitted used by current ARM tools. -- * -- * Otherwise if find_symbols_between() returns those symbols, they'll -- * fail the whitelist tests and cause lots of false alarms ... fixable -- * only by merging __exit and __init sections into __text, bloating -- * the kernel (which is especially evil on embedded platforms). -- */ --static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) --{ -- const char *name = elf->strtab + sym->st_name; -- -- if (!name || !strlen(name)) -- return 0; -- return !is_arm_mapping_symbol(name); --} -- - /* - * Find symbols before or equal addr and after addr - in the section sec. - * If we find two symbols with equal offset prefer one with a valid name. -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index c73361859d11..9db7c80a74aa 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -4311,6 +4311,12 @@ static int smack_key_permission(key_ref_t key_ref, - int request = 0; - int rc; - -+ /* -+ * Validate requested permissions -+ */ -+ if (perm & ~KEY_NEED_ALL) -+ return -EINVAL; -+ - keyp = key_ref_to_ptr(key_ref); - if (keyp == NULL) - return -EINVAL; -@@ -4330,10 +4336,10 @@ static int smack_key_permission(key_ref_t key_ref, - ad.a.u.key_struct.key = keyp->serial; - ad.a.u.key_struct.key_desc = keyp->description; - #endif -- if (perm & KEY_NEED_READ) -- request = MAY_READ; -+ if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW)) -+ request |= MAY_READ; - if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) -- request = MAY_WRITE; -+ request |= MAY_WRITE; - rc = smk_access(tkp, keyp->security, request, &ad); - rc = smk_bu_note("key access", tkp, keyp->security, request, rc); - return rc; -diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c -index 6efadbfb3fe3..7ea201c05e5d 100644 ---- a/sound/pci/hda/hda_bind.c -+++ b/sound/pci/hda/hda_bind.c -@@ -109,7 +109,8 @@ static int hda_codec_driver_probe(struct device *dev) - err = snd_hda_codec_build_controls(codec); - if (err < 0) - goto error_module; -- if (codec->card->registered) { -+ /* only register after the bus probe finished; otherwise it's racy */ -+ if (!codec->bus->bus_probing && codec->card->registered) { - err = snd_card_register(codec->card); - if (err < 0) - goto error_module; -diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h -index 776dffa88aee..171e11be938d 100644 ---- a/sound/pci/hda/hda_codec.h -+++ b/sound/pci/hda/hda_codec.h -@@ -68,6 +68,7 @@ struct hda_bus { - unsigned int response_reset:1; /* controller was reset */ - unsigned int in_reset:1; /* during reset operation */ - unsigned int no_response_fallback:1; /* don't fallback at RIRB error */ -+ unsigned int bus_probing :1; /* during probing process */ - - int primary_dig_out_type; /* primary digital out PCM type */ - unsigned int mixer_assigned; /* codec addr for mixer name */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index f964743b104c..74c9600876d6 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2100,6 +2100,7 @@ static int azx_probe_continue(struct azx *chip) - int val; - int err; - -+ to_hda_bus(bus)->bus_probing = 1; - hda->probe_continued = 1; - - /* Request display power well for the HDA controller or codec. For -@@ -2200,6 +2201,7 @@ i915_power_fail: - if (err < 0) - hda->init_failed = 1; - complete_all(&hda->probe_wait); -+ to_hda_bus(bus)->bus_probing = 0; - return err; - } - -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 536184ac315d..40dd46556452 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -854,6 +854,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), -+ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), -diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig -index 14dfdee05fd5..3066e068aae5 100644 ---- a/sound/soc/fsl/Kconfig -+++ b/sound/soc/fsl/Kconfig -@@ -219,7 +219,7 @@ config SND_SOC_PHYCORE_AC97 - - config SND_SOC_EUKREA_TLV320 - tristate "Eukrea TLV320" -- depends on ARCH_MXC && I2C -+ depends on ARCH_MXC && !ARM64 && I2C - select SND_SOC_TLV320AIC23_I2C - select SND_SOC_IMX_AUDMUX - select SND_SOC_IMX_SSI -diff --git a/sound/soc/intel/atom/sst/sst_loader.c b/sound/soc/intel/atom/sst/sst_loader.c -index 33917146d9c4..054b1d514e8a 100644 ---- a/sound/soc/intel/atom/sst/sst_loader.c -+++ b/sound/soc/intel/atom/sst/sst_loader.c -@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst) - const struct firmware *fw; - - retval = request_firmware(&fw, sst->firmware_name, sst->dev); -- if (fw == NULL) { -- dev_err(sst->dev, "fw is returning as null\n"); -- return -EINVAL; -- } - if (retval) { - dev_err(sst->dev, "request fw failed %d\n", retval); - return retval; - } -+ if (fw == NULL) { -+ dev_err(sst->dev, "fw is returning as null\n"); -+ return -EINVAL; -+ } - mutex_lock(&sst->sst_lock); - retval = sst_cache_and_parse_fw(sst, fw); - mutex_unlock(&sst->sst_lock); -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index a9079654107c..1ea1384bc236 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -313,6 +313,9 @@ static int search_roland_implicit_fb(struct usb_device *dev, int ifnum, - return 0; - } - -+/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk -+ * applies. Returns 1 if a quirk was found. -+ */ - static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, - struct usb_device *dev, - struct usb_interface_descriptor *altsd, -@@ -381,7 +384,7 @@ add_sync_ep: - - subs->data_endpoint->sync_master = subs->sync_endpoint; - -- return 0; -+ return 1; - } - - static int set_sync_endpoint(struct snd_usb_substream *subs, -@@ -420,6 +423,10 @@ static int set_sync_endpoint(struct snd_usb_substream *subs, - if (err < 0) - return err; - -+ /* endpoint set by quirk */ -+ if (err > 0) -+ return 0; -+ - if (altsd->bNumEndpoints < 2) - return 0; - -diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c -index 14e4e668fad7..f97696a418cc 100644 ---- a/tools/perf/arch/x86/util/kvm-stat.c -+++ b/tools/perf/arch/x86/util/kvm-stat.c -@@ -146,7 +146,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid) - if (strstr(cpuid, "Intel")) { - kvm->exit_reasons = vmx_exit_reasons; - kvm->exit_reasons_isa = "VMX"; -- } else if (strstr(cpuid, "AMD")) { -+ } else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) { - kvm->exit_reasons = svm_exit_reasons; - kvm->exit_reasons_isa = "SVM"; - } else -diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c -index 790e413d9a1f..da474d743b6a 100644 ---- a/tools/perf/tests/evsel-tp-sched.c -+++ b/tools/perf/tests/evsel-tp-sched.c -@@ -16,7 +16,7 @@ static int perf_evsel__test_field(struct perf_evsel *evsel, const char *name, - return -1; - } - -- is_signed = !!(field->flags | FIELD_IS_SIGNED); -+ is_signed = !!(field->flags & FIELD_IS_SIGNED); - if (should_be_signed && !is_signed) { - pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n", - evsel->name, name, is_signed, should_be_signed); diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.175-176.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.175-176.patch deleted file mode 100644 index 1bac36af5043..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.175-176.patch +++ /dev/null @@ -1,597 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5f0bdef2af99..d7a3b832e0fd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 175 -+SUBLEVEL = 176 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/livepatch.c b/arch/x86/kernel/livepatch.c -index d1d35ccffed3..579f8f813ce0 100644 ---- a/arch/x86/kernel/livepatch.c -+++ b/arch/x86/kernel/livepatch.c -@@ -58,6 +58,7 @@ int klp_write_module_reloc(struct module *mod, unsigned long type, - val = (s32)value; - break; - case R_X86_64_PC32: -+ case R_X86_64_PLT32: - val = (u32)(value - loc); - break; - default: -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index aee2886a387c..14553f6c03a6 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -4628,7 +4628,9 @@ static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu) - { - u8 mode = 0; - -- if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) { -+ if (cpu_has_secondary_exec_ctrls() && -+ (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) & -+ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) { - mode |= MSR_BITMAP_MODE_X2APIC; - if (enable_apicv) - mode |= MSR_BITMAP_MODE_X2APIC_APICV; -diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c -index cb6606a0470d..be60bd5bab78 100644 ---- a/drivers/hwmon/lm80.c -+++ b/drivers/hwmon/lm80.c -@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, - } - - rv = lm80_read_value(client, LM80_REG_FANDIV); -- if (rv < 0) -+ if (rv < 0) { -+ mutex_unlock(&data->update_lock); - return rv; -+ } - reg = (rv & ~(3 << (2 * (nr + 1)))) - | (data->fan_div[nr] << (2 * (nr + 1))); - lm80_write_value(client, LM80_REG_FANDIV, reg); -diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c -index 9438d7ec3308..8b29e97cf668 100644 ---- a/drivers/isdn/mISDN/timerdev.c -+++ b/drivers/isdn/mISDN/timerdev.c -@@ -168,8 +168,8 @@ dev_expire_timer(unsigned long data) - spin_lock_irqsave(&timer->dev->lock, flags); - if (timer->id >= 0) - list_move_tail(&timer->list, &timer->dev->expired); -- spin_unlock_irqrestore(&timer->dev->lock, flags); - wake_up_interruptible(&timer->dev->wait); -+ spin_unlock_irqrestore(&timer->dev->lock, flags); - } - - static int -diff --git a/drivers/mfd/as3722.c b/drivers/mfd/as3722.c -index 924ea90494ae..e1f597f97f86 100644 ---- a/drivers/mfd/as3722.c -+++ b/drivers/mfd/as3722.c -@@ -405,6 +405,8 @@ static int as3722_i2c_probe(struct i2c_client *i2c, - goto scrub; - } - -+ device_init_wakeup(as3722->dev, true); -+ - dev_dbg(as3722->dev, "AS3722 core driver initialized successfully\n"); - return 0; - -@@ -422,6 +424,29 @@ static int as3722_i2c_remove(struct i2c_client *i2c) - return 0; - } - -+static int __maybe_unused as3722_i2c_suspend(struct device *dev) -+{ -+ struct as3722 *as3722 = dev_get_drvdata(dev); -+ -+ if (device_may_wakeup(dev)) -+ enable_irq_wake(as3722->chip_irq); -+ disable_irq(as3722->chip_irq); -+ -+ return 0; -+} -+ -+static int __maybe_unused as3722_i2c_resume(struct device *dev) -+{ -+ struct as3722 *as3722 = dev_get_drvdata(dev); -+ -+ enable_irq(as3722->chip_irq); -+ -+ if (device_may_wakeup(dev)) -+ disable_irq_wake(as3722->chip_irq); -+ -+ return 0; -+} -+ - static const struct of_device_id as3722_of_match[] = { - { .compatible = "ams,as3722", }, - {}, -@@ -434,10 +459,15 @@ static const struct i2c_device_id as3722_i2c_id[] = { - }; - MODULE_DEVICE_TABLE(i2c, as3722_i2c_id); - -+static const struct dev_pm_ops as3722_pm_ops = { -+ SET_SYSTEM_SLEEP_PM_OPS(as3722_i2c_suspend, as3722_i2c_resume) -+}; -+ - static struct i2c_driver as3722_i2c_driver = { - .driver = { - .name = "as3722", - .of_match_table = as3722_of_match, -+ .pm = &as3722_pm_ops, - }, - .probe = as3722_i2c_probe, - .remove = as3722_i2c_remove, -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 6e5065f0907b..4b97aa24559a 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -5079,7 +5079,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - INIT_WORK(&hw->restart_work, sky2_restart); - - pci_set_drvdata(pdev, hw); -- pdev->d3_delay = 200; -+ pdev->d3_delay = 300; - - return 0; - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -index 2e51b816a7e8..fbf701e5f1e9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c -@@ -614,25 +614,27 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, - struct ethtool_eee *edata) - { - struct stmmac_priv *priv = netdev_priv(dev); -+ int ret; - -- priv->eee_enabled = edata->eee_enabled; -- -- if (!priv->eee_enabled) -+ if (!edata->eee_enabled) { - stmmac_disable_eee_mode(priv); -- else { -+ } else { - /* We are asking for enabling the EEE but it is safe - * to verify all by invoking the eee_init function. - * In case of failure it will return an error. - */ -- priv->eee_enabled = stmmac_eee_init(priv); -- if (!priv->eee_enabled) -+ edata->eee_enabled = stmmac_eee_init(priv); -+ if (!edata->eee_enabled) - return -EOPNOTSUPP; -- -- /* Do not change tx_lpi_timer in case of failure */ -- priv->tx_lpi_timer = edata->tx_lpi_timer; - } - -- return phy_ethtool_set_eee(priv->phydev, edata); -+ ret = phy_ethtool_set_eee(dev->phydev, edata); -+ if (ret) -+ return ret; -+ -+ priv->eee_enabled = edata->eee_enabled; -+ priv->tx_lpi_timer = edata->tx_lpi_timer; -+ return 0; - } - - static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv) -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index c41378214ede..553908adf3c5 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -1881,7 +1881,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - struct pcpu_sw_netstats *tx_stats, *rx_stats; - union vxlan_addr loopback; - union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip; -- struct net_device *dev = skb->dev; -+ struct net_device *dev; - int len = skb->len; - - tx_stats = this_cpu_ptr(src_vxlan->dev->tstats); -@@ -1901,8 +1901,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - #endif - } - -+ rcu_read_lock(); -+ dev = skb->dev; -+ if (unlikely(!(dev->flags & IFF_UP))) { -+ kfree_skb(skb); -+ goto drop; -+ } -+ - if (dst_vxlan->flags & VXLAN_F_LEARN) -- vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source); -+ vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source); - - u64_stats_update_begin(&tx_stats->syncp); - tx_stats->tx_packets++; -@@ -1915,8 +1922,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, - rx_stats->rx_bytes += len; - u64_stats_update_end(&rx_stats->syncp); - } else { -+drop: - dev->stats.rx_dropped++; - } -+ rcu_read_unlock(); - } - - static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, -diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h -index f0d87347df19..0508fcc67480 100644 ---- a/include/linux/netdev_features.h -+++ b/include/linux/netdev_features.h -@@ -11,6 +11,8 @@ - #define _LINUX_NETDEV_FEATURES_H - - #include -+#include -+#include - - typedef u64 netdev_features_t; - -@@ -125,8 +127,26 @@ enum { - #define NETIF_F_HW_L2FW_DOFFLOAD __NETIF_F(HW_L2FW_DOFFLOAD) - #define NETIF_F_BUSY_POLL __NETIF_F(BUSY_POLL) - --#define for_each_netdev_feature(mask_addr, bit) \ -- for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT) -+/* Finds the next feature with the highest number of the range of start till 0. -+ */ -+static inline int find_next_netdev_feature(u64 feature, unsigned long start) -+{ -+ /* like BITMAP_LAST_WORD_MASK() for u64 -+ * this sets the most significant 64 - start to 0. -+ */ -+ feature &= ~0ULL >> (-start & ((sizeof(feature) * 8) - 1)); -+ -+ return fls64(feature) - 1; -+} -+ -+/* This goes for the MSB to the LSB through the set feature bits, -+ * mask_addr should be a u64 and bit an int -+ */ -+#define for_each_netdev_feature(mask_addr, bit) \ -+ for ((bit) = find_next_netdev_feature((mask_addr), \ -+ NETDEV_FEATURE_COUNT); \ -+ (bit) >= 0; \ -+ (bit) = find_next_netdev_feature((mask_addr), (bit) - 1)) - - /* Features valid for ethtool to change */ - /* = all defined minus driver/device-class-related */ -diff --git a/include/net/ax25.h b/include/net/ax25.h -index e602f8177ebf..b507ce2b1952 100644 ---- a/include/net/ax25.h -+++ b/include/net/ax25.h -@@ -199,6 +199,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt) - - void __ax25_put_route(ax25_route *ax25_rt); - -+extern rwlock_t ax25_route_lock; -+ -+static inline void ax25_route_lock_use(void) -+{ -+ read_lock(&ax25_route_lock); -+} -+ -+static inline void ax25_route_lock_unuse(void) -+{ -+ read_unlock(&ax25_route_lock); -+} -+ - static inline void ax25_put_route(ax25_route *ax25_rt) - { - if (atomic_dec_and_test(&ax25_rt->refcount)) -diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h -index 235c7811a86a..408d76f47bd2 100644 ---- a/include/net/inetpeer.h -+++ b/include/net/inetpeer.h -@@ -40,6 +40,7 @@ struct inet_peer { - - u32 metrics[RTAX_MAX]; - u32 rate_tokens; /* rate limiting for ICMP */ -+ u32 n_redirects; - unsigned long rate_last; - union { - struct list_head gc_list; -diff --git a/include/net/tcp.h b/include/net/tcp.h -index a99f75ef6a73..14ec97309581 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1457,6 +1457,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) - sk_wmem_free_skb(sk, skb); - sk_mem_reclaim(sk); - tcp_clear_all_retrans_hints(tcp_sk(sk)); -+ inet_csk(sk)->icsk_backoff = 0; - } - - static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk) -diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c -index 2fa3be965101..cd9a24e5b97a 100644 ---- a/net/ax25/ax25_ip.c -+++ b/net/ax25/ax25_ip.c -@@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - dst = (ax25_address *)(bp + 1); - src = (ax25_address *)(bp + 8); - -+ ax25_route_lock_use(); - route = ax25_get_route(dst, NULL); - if (route) { - digipeat = route->digipeat; -@@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) - ax25_queue_xmit(skb, dev); - - put: -- if (route) -- ax25_put_route(route); - -+ ax25_route_lock_unuse(); - return NETDEV_TX_OK; - } - -diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c -index d39097737e38..149f82bd83fd 100644 ---- a/net/ax25/ax25_route.c -+++ b/net/ax25/ax25_route.c -@@ -40,7 +40,7 @@ - #include - - static ax25_route *ax25_route_list; --static DEFINE_RWLOCK(ax25_route_lock); -+DEFINE_RWLOCK(ax25_route_lock); - - void ax25_rt_device_down(struct net_device *dev) - { -@@ -349,6 +349,7 @@ const struct file_operations ax25_route_fops = { - * Find AX.25 route - * - * Only routes with a reference count of zero can be destroyed. -+ * Must be called with ax25_route_lock read locked. - */ - ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev) - { -@@ -356,7 +357,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev) - ax25_route *ax25_def_rt = NULL; - ax25_route *ax25_rt; - -- read_lock(&ax25_route_lock); - /* - * Bind to the physical interface we heard them on, or the default - * route if none is found; -@@ -379,11 +379,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev) - if (ax25_spe_rt != NULL) - ax25_rt = ax25_spe_rt; - -- if (ax25_rt != NULL) -- ax25_hold_route(ax25_rt); -- -- read_unlock(&ax25_route_lock); -- - return ax25_rt; - } - -@@ -414,9 +409,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) - ax25_route *ax25_rt; - int err = 0; - -- if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL) -+ ax25_route_lock_use(); -+ ax25_rt = ax25_get_route(addr, NULL); -+ if (!ax25_rt) { -+ ax25_route_lock_unuse(); - return -EHOSTUNREACH; -- -+ } - if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) { - err = -EHOSTUNREACH; - goto put; -@@ -451,8 +449,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) - } - - put: -- ax25_put_route(ax25_rt); -- -+ ax25_route_lock_unuse(); - return err; - } - -diff --git a/net/core/dev.c b/net/core/dev.c -index e03c1d2f6707..49f78bce5795 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6421,7 +6421,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower, - netdev_features_t feature; - int feature_bit; - -- for_each_netdev_feature(&upper_disables, feature_bit) { -+ for_each_netdev_feature(upper_disables, feature_bit) { - feature = __NETIF_F_BIT(feature_bit); - if (!(upper->wanted_features & feature) - && (features & feature)) { -@@ -6441,7 +6441,7 @@ static void netdev_sync_lower_features(struct net_device *upper, - netdev_features_t feature; - int feature_bit; - -- for_each_netdev_feature(&upper_disables, feature_bit) { -+ for_each_netdev_feature(upper_disables, feature_bit) { - feature = __NETIF_F_BIT(feature_bit); - if (!(features & feature) && (lower->features & feature)) { - netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n", -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index fea7c24e99d0..2f63a90065e6 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -374,6 +374,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask) - */ - void *netdev_alloc_frag(unsigned int fragsz) - { -+ fragsz = SKB_DATA_ALIGN(fragsz); -+ - return __netdev_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD); - } - EXPORT_SYMBOL(netdev_alloc_frag); -@@ -387,6 +389,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask) - - void *napi_alloc_frag(unsigned int fragsz) - { -+ fragsz = SKB_DATA_ALIGN(fragsz); -+ - return __napi_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD); - } - EXPORT_SYMBOL(napi_alloc_frag); -diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c -index 86fa45809540..0c5862914f05 100644 ---- a/net/ipv4/inetpeer.c -+++ b/net/ipv4/inetpeer.c -@@ -448,6 +448,7 @@ relookup: - atomic_set(&p->rid, 0); - p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; - p->rate_tokens = 0; -+ p->n_redirects = 0; - /* 60*HZ is arbitrary, but chosen enough high so that the first - * calculation of tokens is at its maximum. - */ -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 3251dede1815..80ce6b0672d2 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -876,13 +876,15 @@ void ip_rt_send_redirect(struct sk_buff *skb) - /* No redirected packets during ip_rt_redirect_silence; - * reset the algorithm. - */ -- if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) -+ if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) { - peer->rate_tokens = 0; -+ peer->n_redirects = 0; -+ } - - /* Too many ignored redirects; do not send anything - * set dst.rate_last to the last seen redirected packet. - */ -- if (peer->rate_tokens >= ip_rt_redirect_number) { -+ if (peer->n_redirects >= ip_rt_redirect_number) { - peer->rate_last = jiffies; - goto out_put_peer; - } -@@ -899,6 +901,7 @@ void ip_rt_send_redirect(struct sk_buff *skb) - icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw); - peer->rate_last = jiffies; - ++peer->rate_tokens; -+ ++peer->n_redirects; - #ifdef CONFIG_IP_ROUTE_VERBOSE - if (log_martians && - peer->rate_tokens == ip_rt_redirect_number) -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index b7492aabe710..f3a4d2dcbf7a 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2253,7 +2253,6 @@ int tcp_disconnect(struct sock *sk, int flags) - tp->write_seq += tp->max_window + 2; - if (tp->write_seq == 0) - tp->write_seq = 1; -- icsk->icsk_backoff = 0; - tp->snd_cwnd = 2; - icsk->icsk_probes_out = 0; - tp->packets_out = 0; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index ee8399f11fd0..b3d6b8e77300 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -466,14 +466,15 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) - if (sock_owned_by_user(sk)) - break; - -+ skb = tcp_write_queue_head(sk); -+ if (WARN_ON_ONCE(!skb)) -+ break; -+ - icsk->icsk_backoff--; - icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) : - TCP_TIMEOUT_INIT; - icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX); - -- skb = tcp_write_queue_head(sk); -- BUG_ON(!skb); -- - remaining = icsk->icsk_rto - - min(icsk->icsk_rto, - tcp_time_stamp - tcp_skb_timestamp(skb)); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 4dde1e0e7d37..086cdf9f0501 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -1043,7 +1043,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires) - list_for_each_entry(ifa, &idev->addr_list, if_list) { - if (ifa == ifp) - continue; -- if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr, -+ if (ifa->prefix_len != ifp->prefix_len || -+ !ipv6_prefix_equal(&ifa->addr, &ifp->addr, - ifp->prefix_len)) - continue; - if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE)) -diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c -index d24773552b64..217810674c35 100644 ---- a/net/vmw_vsock/vmci_transport.c -+++ b/net/vmw_vsock/vmci_transport.c -@@ -1656,6 +1656,10 @@ static void vmci_transport_cleanup(struct work_struct *work) - - static void vmci_transport_destruct(struct vsock_sock *vsk) - { -+ /* transport can be NULL if we hit a failure at init() time */ -+ if (!vmci_trans(vsk)) -+ return; -+ - /* Ensure that the detach callback doesn't use the sk/vsk - * we are about to destruct. - */ -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index c6ab4da4b8e2..8d7b2802d33f 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb) - unsigned int lci = 1; - struct sock *sk; - -- read_lock_bh(&x25_list_lock); -- -- while ((sk = __x25_find_socket(lci, nb)) != NULL) { -+ while ((sk = x25_find_socket(lci, nb)) != NULL) { - sock_put(sk); - if (++lci == 4096) { - lci = 0; - break; - } -+ cond_resched(); - } - -- read_unlock_bh(&x25_list_lock); - return lci; - } - -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index e4be695eb789..fce48d11ae07 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -2711,14 +2711,15 @@ static int kvm_ioctl_create_device(struct kvm *kvm, - return ret; - } - -+ kvm_get_kvm(kvm); - ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); - if (ret < 0) { -+ kvm_put_kvm(kvm); - ops->destroy(dev); - return ret; - } - - list_add(&dev->vm_node, &kvm->devices); -- kvm_get_kvm(kvm); - cd->fd = ret; - return 0; - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.176-177.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.176-177.patch deleted file mode 100644 index fae97628ede0..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.176-177.patch +++ /dev/null @@ -1,8231 +0,0 @@ -diff --git a/Makefile b/Makefile -index d7a3b832e0fd..1de443248119 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 176 -+SUBLEVEL = 177 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h -index 0352fb8d21b9..9623ae002f5b 100644 ---- a/arch/arc/include/asm/bitops.h -+++ b/arch/arc/include/asm/bitops.h -@@ -286,7 +286,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x) - /* - * __ffs: Similar to ffs, but zero based (0-31) - */ --static inline __attribute__ ((const)) int __ffs(unsigned long word) -+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word) - { - if (!word) - return word; -@@ -346,9 +346,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x) - /* - * __ffs: Similar to ffs, but zero based (0-31) - */ --static inline __attribute__ ((const)) int __ffs(unsigned long x) -+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x) - { -- int n; -+ unsigned long n; - - asm volatile( - " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */ -diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h -index 57387b567f34..f077a419cb51 100644 ---- a/arch/arc/include/asm/uaccess.h -+++ b/arch/arc/include/asm/uaccess.h -@@ -209,7 +209,7 @@ __arc_copy_from_user(void *to, const void __user *from, unsigned long n) - */ - "=&r" (tmp), "+r" (to), "+r" (from) - : -- : "lp_count", "lp_start", "lp_end", "memory"); -+ : "lp_count", "memory"); - - return n; - } -@@ -438,7 +438,7 @@ __arc_copy_to_user(void __user *to, const void *from, unsigned long n) - */ - "=&r" (tmp), "+r" (to), "+r" (from) - : -- : "lp_count", "lp_start", "lp_end", "memory"); -+ : "lp_count", "memory"); - - return n; - } -@@ -658,7 +658,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n) - " .previous \n" - : "+r"(d_char), "+r"(res) - : "i"(0) -- : "lp_count", "lp_start", "lp_end", "memory"); -+ : "lp_count", "memory"); - - return res; - } -@@ -691,7 +691,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) - " .previous \n" - : "+r"(res), "+r"(dst), "+r"(src), "=r"(val) - : "g"(-EFAULT), "r"(count) -- : "lp_count", "lp_start", "lp_end", "memory"); -+ : "lp_count", "memory"); - - return res; - } -diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S -index 689dd867fdff..cd64cb4ef7b0 100644 ---- a/arch/arc/kernel/head.S -+++ b/arch/arc/kernel/head.S -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - .macro CPU_EARLY_SETUP - -@@ -47,6 +48,15 @@ - sr r5, [ARC_REG_DC_CTRL] - - 1: -+ -+#ifdef CONFIG_ISA_ARCV2 -+ ; Unaligned access is disabled at reset, so re-enable early as -+ ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access -+ ; by default -+ lr r5, [status32] -+ bset r5, r5, STATUS_AD_BIT -+ kflag r5 -+#endif - .endm - - .section .init.text, "ax",@progbits -diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig -index 34e1569a11ee..3a0277c6c060 100644 ---- a/arch/arm/Kconfig -+++ b/arch/arm/Kconfig -@@ -1475,6 +1475,7 @@ config NR_CPUS - config HOTPLUG_CPU - bool "Support for hot-pluggable CPUs" - depends on SMP -+ select GENERIC_IRQ_MIGRATION - help - Say Y here to experiment with turning CPUs off and on. CPUs - can be controlled through /sys/devices/system/cpu. -diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi -index 2f30d632f1cc..e81a27214188 100644 ---- a/arch/arm/boot/dts/exynos3250.dtsi -+++ b/arch/arm/boot/dts/exynos3250.dtsi -@@ -150,6 +150,9 @@ - interrupt-controller; - #interrupt-cells = <3>; - interrupt-parent = <&gic>; -+ clock-names = "clkout8"; -+ clocks = <&cmu CLK_FIN_PLL>; -+ #clock-cells = <1>; - }; - - mipi_phy: video-phy@10020710 { -diff --git a/arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi -new file mode 100644 -index 000000000000..c8771c660550 ---- /dev/null -+++ b/arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi -@@ -0,0 +1,25 @@ -+/* -+ * Device tree sources for Exynos5420 TMU sensor configuration -+ * -+ * Copyright (c) 2014 Lukasz Majewski -+ * Copyright (c) 2017 Krzysztof Kozlowski -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License version 2 as -+ * published by the Free Software Foundation. -+ * -+ */ -+ -+#include -+ -+#thermal-sensor-cells = <0>; -+samsung,tmu_gain = <8>; -+samsung,tmu_reference_voltage = <16>; -+samsung,tmu_noise_cancel_mode = <4>; -+samsung,tmu_efuse_value = <55>; -+samsung,tmu_min_efuse_value = <0>; -+samsung,tmu_max_efuse_value = <100>; -+samsung,tmu_first_point_trim = <25>; -+samsung,tmu_second_point_trim = <85>; -+samsung,tmu_default_temp_offset = <50>; -+samsung,tmu_cal_type = ; -diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi -index 1b3d6c769a3c..d5edb7766942 100644 ---- a/arch/arm/boot/dts/exynos5420.dtsi -+++ b/arch/arm/boot/dts/exynos5420.dtsi -@@ -777,7 +777,7 @@ - interrupts = <0 65 0>; - clocks = <&clock CLK_TMU>; - clock-names = "tmu_apbif"; -- #include "exynos4412-tmu-sensor-conf.dtsi" -+ #include "exynos5420-tmu-sensor-conf.dtsi" - }; - - tmu_cpu1: tmu@10064000 { -@@ -786,7 +786,7 @@ - interrupts = <0 183 0>; - clocks = <&clock CLK_TMU>; - clock-names = "tmu_apbif"; -- #include "exynos4412-tmu-sensor-conf.dtsi" -+ #include "exynos5420-tmu-sensor-conf.dtsi" - }; - - tmu_cpu2: tmu@10068000 { -@@ -795,7 +795,7 @@ - interrupts = <0 184 0>; - clocks = <&clock CLK_TMU>, <&clock CLK_TMU>; - clock-names = "tmu_apbif", "tmu_triminfo_apbif"; -- #include "exynos4412-tmu-sensor-conf.dtsi" -+ #include "exynos5420-tmu-sensor-conf.dtsi" - }; - - tmu_cpu3: tmu@1006c000 { -@@ -804,7 +804,7 @@ - interrupts = <0 185 0>; - clocks = <&clock CLK_TMU>, <&clock CLK_TMU_GPU>; - clock-names = "tmu_apbif", "tmu_triminfo_apbif"; -- #include "exynos4412-tmu-sensor-conf.dtsi" -+ #include "exynos5420-tmu-sensor-conf.dtsi" - }; - - tmu_gpu: tmu@100a0000 { -@@ -813,7 +813,7 @@ - interrupts = <0 215 0>; - clocks = <&clock CLK_TMU_GPU>, <&clock CLK_TMU>; - clock-names = "tmu_apbif", "tmu_triminfo_apbif"; -- #include "exynos4412-tmu-sensor-conf.dtsi" -+ #include "exynos5420-tmu-sensor-conf.dtsi" - }; - - thermal-zones { -diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h -index 1bd9510de1b9..cae4df39f02e 100644 ---- a/arch/arm/include/asm/irq.h -+++ b/arch/arm/include/asm/irq.h -@@ -24,7 +24,6 @@ - #ifndef __ASSEMBLY__ - struct irqaction; - struct pt_regs; --extern void migrate_irqs(void); - - extern void asm_do_IRQ(unsigned int, struct pt_regs *); - void handle_IRQ(unsigned int, struct pt_regs *); -diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c -index 1d45320ee125..900c591913d5 100644 ---- a/arch/arm/kernel/irq.c -+++ b/arch/arm/kernel/irq.c -@@ -31,7 +31,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -119,64 +118,3 @@ int __init arch_probe_nr_irqs(void) - return nr_irqs; - } - #endif -- --#ifdef CONFIG_HOTPLUG_CPU --static bool migrate_one_irq(struct irq_desc *desc) --{ -- struct irq_data *d = irq_desc_get_irq_data(desc); -- const struct cpumask *affinity = irq_data_get_affinity_mask(d); -- struct irq_chip *c; -- bool ret = false; -- -- /* -- * If this is a per-CPU interrupt, or the affinity does not -- * include this CPU, then we have nothing to do. -- */ -- if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity)) -- return false; -- -- if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) { -- affinity = cpu_online_mask; -- ret = true; -- } -- -- c = irq_data_get_irq_chip(d); -- if (!c->irq_set_affinity) -- pr_debug("IRQ%u: unable to set affinity\n", d->irq); -- else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret) -- cpumask_copy(irq_data_get_affinity_mask(d), affinity); -- -- return ret; --} -- --/* -- * The current CPU has been marked offline. Migrate IRQs off this CPU. -- * If the affinity settings do not allow other CPUs, force them onto any -- * available CPU. -- * -- * Note: we must iterate over all IRQs, whether they have an attached -- * action structure or not, as we need to get chained interrupts too. -- */ --void migrate_irqs(void) --{ -- unsigned int i; -- struct irq_desc *desc; -- unsigned long flags; -- -- local_irq_save(flags); -- -- for_each_irq_desc(i, desc) { -- bool affinity_broken; -- -- raw_spin_lock(&desc->lock); -- affinity_broken = migrate_one_irq(desc); -- raw_spin_unlock(&desc->lock); -- -- if (affinity_broken) -- pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n", -- i, smp_processor_id()); -- } -- -- local_irq_restore(flags); --} --#endif /* CONFIG_HOTPLUG_CPU */ -diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index e42be5800f37..08ce9e36dc5a 100644 ---- a/arch/arm/kernel/smp.c -+++ b/arch/arm/kernel/smp.c -@@ -218,7 +218,7 @@ int __cpu_disable(void) - /* - * OK - migrate IRQs away from this CPU - */ -- migrate_irqs(); -+ irq_migrate_all_off_this_cpu(); - - /* - * Flush user cache and TLB mappings, and then remove this CPU -diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c -index 885cd0e0015b..ae61e2ea7255 100644 ---- a/arch/arm/kvm/mmio.c -+++ b/arch/arm/kvm/mmio.c -@@ -87,11 +87,10 @@ static unsigned long mmio_read_buf(char *buf, unsigned int len) - - /** - * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation -+ * or in-kernel IO emulation -+ * - * @vcpu: The VCPU pointer - * @run: The VCPU run struct containing the mmio data -- * -- * This should only be called after returning from userspace for MMIO load -- * emulation. - */ - int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) - { -@@ -207,14 +206,17 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run, - run->mmio.is_write = is_write; - run->mmio.phys_addr = fault_ipa; - run->mmio.len = len; -- memcpy(run->mmio.data, data_buf, len); - - if (!ret) { - /* We handled the access successfully in the kernel. */ -+ if (!is_write) -+ memcpy(run->mmio.data, data_buf, len); - kvm_handle_mmio_return(vcpu, run); - return 1; - } - -+ if (is_write) -+ memcpy(run->mmio.data, data_buf, len); - run->exit_reason = KVM_EXIT_MMIO; - return 0; - } -diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c -index 6ab13d18c636..cde86d1199cf 100644 ---- a/arch/arm/mach-omap2/display.c -+++ b/arch/arm/mach-omap2/display.c -@@ -115,6 +115,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes) - u32 enable_mask, enable_shift; - u32 pipd_mask, pipd_shift; - u32 reg; -+ int ret; - - if (dsi_id == 0) { - enable_mask = OMAP4_DSI1_LANEENABLE_MASK; -@@ -130,7 +131,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes) - return -ENODEV; - } - -- regmap_read(omap4_dsi_mux_syscon, OMAP4_DSIPHY_SYSCON_OFFSET, ®); -+ ret = regmap_read(omap4_dsi_mux_syscon, -+ OMAP4_DSIPHY_SYSCON_OFFSET, -+ ®); -+ if (ret) -+ return ret; - - reg &= ~enable_mask; - reg &= ~pipd_mask; -diff --git a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c -index ce2db235dbaf..5e8a306163de 100644 ---- a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c -+++ b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c -@@ -70,16 +70,16 @@ static int osiris_dvs_notify(struct notifier_block *nb, - - switch (val) { - case CPUFREQ_PRECHANGE: -- if (old_dvs & !new_dvs || -- cur_dvs & !new_dvs) { -+ if ((old_dvs && !new_dvs) || -+ (cur_dvs && !new_dvs)) { - pr_debug("%s: exiting dvs\n", __func__); - cur_dvs = false; - gpio_set_value(OSIRIS_GPIO_DVS, 1); - } - break; - case CPUFREQ_POSTCHANGE: -- if (!old_dvs & new_dvs || -- !cur_dvs & new_dvs) { -+ if ((!old_dvs && new_dvs) || -+ (!cur_dvs && new_dvs)) { - pr_debug("entering dvs\n"); - cur_dvs = true; - gpio_set_value(OSIRIS_GPIO_DVS, 0); -diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c -index daa1a65f2eb7..6748827c2ec8 100644 ---- a/arch/arm/plat-pxa/ssp.c -+++ b/arch/arm/plat-pxa/ssp.c -@@ -238,8 +238,6 @@ static int pxa_ssp_remove(struct platform_device *pdev) - if (ssp == NULL) - return -ENODEV; - -- iounmap(ssp->mmio_base); -- - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - release_mem_region(res->start, resource_size(res)); - -@@ -249,7 +247,6 @@ static int pxa_ssp_remove(struct platform_device *pdev) - list_del(&ssp->node); - mutex_unlock(&ssp_lock); - -- kfree(ssp); - return 0; - } - -diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S -index 3363560c79b7..7bc459d9235c 100644 ---- a/arch/arm64/crypto/aes-ce-ccm-core.S -+++ b/arch/arm64/crypto/aes-ce-ccm-core.S -@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data) - beq 10f - ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */ - b 7b --8: mov w7, w8 -+8: cbz w8, 91f -+ mov w7, w8 - add w8, w8, #16 - 9: ext v1.16b, v1.16b, v1.16b, #1 - adds w7, w7, #1 - bne 9b -- eor v0.16b, v0.16b, v1.16b -+91: eor v0.16b, v0.16b, v1.16b - st1 {v0.16b}, [x0] - 10: str w8, [x3] - ret -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 0382eba4bf7b..6299a8a361ee 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -478,8 +478,7 @@ CPU_LE( bic x0, x0, #(3 << 24) ) // Clear the EE and E0E bits for EL1 - /* GICv3 system register access */ - mrs x0, id_aa64pfr0_el1 - ubfx x0, x0, #24, #4 -- cmp x0, #1 -- b.ne 3f -+ cbz x0, 3f - - mrs_s x0, ICC_SRE_EL2 - orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1 -diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile -index 0b29dcfef69f..0c736ed58abd 100644 ---- a/arch/m68k/Makefile -+++ b/arch/m68k/Makefile -@@ -59,7 +59,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-option,-mcpu=5206e,-m5200) - cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200) - - KBUILD_AFLAGS += $(cpuflags-y) --KBUILD_CFLAGS += $(cpuflags-y) -pipe -+KBUILD_CFLAGS += $(cpuflags-y) -+ -+KBUILD_CFLAGS += -pipe -ffreestanding -+ - ifdef CONFIG_MMU - # without -fno-strength-reduce the 53c7xx.c driver fails ;-( - KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2 -diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig -index 134879c1310a..4ed369c0ec6a 100644 ---- a/arch/mips/configs/ath79_defconfig -+++ b/arch/mips/configs/ath79_defconfig -@@ -74,6 +74,7 @@ CONFIG_SERIAL_8250_CONSOLE=y - # CONFIG_SERIAL_8250_PCI is not set - CONFIG_SERIAL_8250_NR_UARTS=1 - CONFIG_SERIAL_8250_RUNTIME_UARTS=1 -+CONFIG_SERIAL_OF_PLATFORM=y - CONFIG_SERIAL_AR933X=y - CONFIG_SERIAL_AR933X_CONSOLE=y - # CONFIG_HW_RANDOM is not set -diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c -index db6f5afff4ff..ea897912bc71 100644 ---- a/arch/mips/jazz/jazzdma.c -+++ b/arch/mips/jazz/jazzdma.c -@@ -71,14 +71,15 @@ static int __init vdma_init(void) - get_order(VDMA_PGTBL_SIZE)); - BUG_ON(!pgtbl); - dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE); -- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); -+ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl); - - /* - * Clear the R4030 translation table - */ - vdma_pgtbl_init(); - -- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); -+ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, -+ CPHYSADDR((unsigned long)pgtbl)); - r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE); - r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0); - -diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c -index dc1180a8bfa1..66736397af9f 100644 ---- a/arch/mips/kernel/irq.c -+++ b/arch/mips/kernel/irq.c -@@ -52,6 +52,7 @@ asmlinkage void spurious_interrupt(void) - void __init init_IRQ(void) - { - int i; -+ unsigned int order = get_order(IRQ_STACK_SIZE); - - for (i = 0; i < NR_IRQS; i++) - irq_set_noprobe(i); -@@ -59,8 +60,7 @@ void __init init_IRQ(void) - arch_init_irq(); - - for_each_possible_cpu(i) { -- int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE; -- void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages); -+ void *s = (void *)__get_free_pages(GFP_KERNEL, order); - - irq_stack[i] = s; - pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i, -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index ebd8a715fe38..e6102775892d 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -339,7 +339,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip) - static int get_frame_info(struct mips_frame_info *info) - { - bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); -- union mips_instruction insn, *ip, *ip_end; -+ union mips_instruction insn, *ip; - const unsigned int max_insns = 128; - unsigned int last_insn_size = 0; - unsigned int i; -@@ -351,10 +351,9 @@ static int get_frame_info(struct mips_frame_info *info) - if (!ip) - goto err; - -- ip_end = (void *)ip + info->func_size; -- -- for (i = 0; i < max_insns && ip < ip_end; i++) { -+ for (i = 0; i < max_insns; i++) { - ip = (void *)ip + last_insn_size; -+ - if (is_mmips && mm_insn_16bit(ip->halfword[0])) { - insn.halfword[0] = 0; - insn.halfword[1] = ip->halfword[0]; -diff --git a/arch/powerpc/include/asm/epapr_hcalls.h b/arch/powerpc/include/asm/epapr_hcalls.h -index 334459ad145b..90863245df53 100644 ---- a/arch/powerpc/include/asm/epapr_hcalls.h -+++ b/arch/powerpc/include/asm/epapr_hcalls.h -@@ -508,7 +508,7 @@ static unsigned long epapr_hypercall(unsigned long *in, - - static inline long epapr_hypercall0_1(unsigned int nr, unsigned long *r2) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - unsigned long r; - -@@ -520,7 +520,7 @@ static inline long epapr_hypercall0_1(unsigned int nr, unsigned long *r2) - - static inline long epapr_hypercall0(unsigned int nr) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - - return epapr_hypercall(in, out, nr); -@@ -528,7 +528,7 @@ static inline long epapr_hypercall0(unsigned int nr) - - static inline long epapr_hypercall1(unsigned int nr, unsigned long p1) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - - in[0] = p1; -@@ -538,7 +538,7 @@ static inline long epapr_hypercall1(unsigned int nr, unsigned long p1) - static inline long epapr_hypercall2(unsigned int nr, unsigned long p1, - unsigned long p2) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - - in[0] = p1; -@@ -549,7 +549,7 @@ static inline long epapr_hypercall2(unsigned int nr, unsigned long p1, - static inline long epapr_hypercall3(unsigned int nr, unsigned long p1, - unsigned long p2, unsigned long p3) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - - in[0] = p1; -@@ -562,7 +562,7 @@ static inline long epapr_hypercall4(unsigned int nr, unsigned long p1, - unsigned long p2, unsigned long p3, - unsigned long p4) - { -- unsigned long in[8]; -+ unsigned long in[8] = {0}; - unsigned long out[8]; - - in[0] = p1; -diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S -index 2405631e91a2..3728e617e17e 100644 ---- a/arch/powerpc/kernel/entry_32.S -+++ b/arch/powerpc/kernel/entry_32.S -@@ -685,6 +685,9 @@ fast_exception_return: - mtcr r10 - lwz r10,_LINK(r11) - mtlr r10 -+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ -+ li r10, 0 -+ stw r10, 8(r11) - REST_GPR(10, r11) - mtspr SPRN_SRR1,r9 - mtspr SPRN_SRR0,r12 -@@ -915,6 +918,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX) - mtcrf 0xFF,r10 - mtlr r11 - -+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ -+ li r10, 0 -+ stw r10, 8(r1) - /* - * Once we put values in SRR0 and SRR1, we are in a state - * where exceptions are not recoverable, since taking an -@@ -952,6 +958,9 @@ exc_exit_restart_end: - mtlr r11 - lwz r10,_CCR(r1) - mtcrf 0xff,r10 -+ /* Clear the exception_marker on the stack to avoid confusing stacktrace */ -+ li r10, 0 -+ stw r10, 8(r1) - REST_2GPRS(9, r1) - .globl exc_exit_restart - exc_exit_restart: -diff --git a/arch/powerpc/platforms/83xx/suspend-asm.S b/arch/powerpc/platforms/83xx/suspend-asm.S -index 3d1ecd211776..8137f77abad5 100644 ---- a/arch/powerpc/platforms/83xx/suspend-asm.S -+++ b/arch/powerpc/platforms/83xx/suspend-asm.S -@@ -26,13 +26,13 @@ - #define SS_MSR 0x74 - #define SS_SDR1 0x78 - #define SS_LR 0x7c --#define SS_SPRG 0x80 /* 4 SPRGs */ --#define SS_DBAT 0x90 /* 8 DBATs */ --#define SS_IBAT 0xd0 /* 8 IBATs */ --#define SS_TB 0x110 --#define SS_CR 0x118 --#define SS_GPREG 0x11c /* r12-r31 */ --#define STATE_SAVE_SIZE 0x16c -+#define SS_SPRG 0x80 /* 8 SPRGs */ -+#define SS_DBAT 0xa0 /* 8 DBATs */ -+#define SS_IBAT 0xe0 /* 8 IBATs */ -+#define SS_TB 0x120 -+#define SS_CR 0x128 -+#define SS_GPREG 0x12c /* r12-r31 */ -+#define STATE_SAVE_SIZE 0x17c - - .section .data - .align 5 -@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) - stw r7, SS_SPRG+12(r3) - stw r8, SS_SDR1(r3) - -+ mfspr r4, SPRN_SPRG4 -+ mfspr r5, SPRN_SPRG5 -+ mfspr r6, SPRN_SPRG6 -+ mfspr r7, SPRN_SPRG7 -+ -+ stw r4, SS_SPRG+16(r3) -+ stw r5, SS_SPRG+20(r3) -+ stw r6, SS_SPRG+24(r3) -+ stw r7, SS_SPRG+28(r3) -+ - mfspr r4, SPRN_DBAT0U - mfspr r5, SPRN_DBAT0L - mfspr r6, SPRN_DBAT1U -@@ -493,6 +503,16 @@ mpc83xx_deep_resume: - mtspr SPRN_IBAT7U, r6 - mtspr SPRN_IBAT7L, r7 - -+ lwz r4, SS_SPRG+16(r3) -+ lwz r5, SS_SPRG+20(r3) -+ lwz r6, SS_SPRG+24(r3) -+ lwz r7, SS_SPRG+28(r3) -+ -+ mtspr SPRN_SPRG4, r4 -+ mtspr SPRN_SPRG5, r5 -+ mtspr SPRN_SPRG6, r6 -+ mtspr SPRN_SPRG7, r7 -+ - lwz r4, SS_SPRG+0(r3) - lwz r5, SS_SPRG+4(r3) - lwz r6, SS_SPRG+8(r3) -diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c -index 352592d3e44e..7fd19a480422 100644 ---- a/arch/powerpc/platforms/embedded6xx/wii.c -+++ b/arch/powerpc/platforms/embedded6xx/wii.c -@@ -104,6 +104,10 @@ unsigned long __init wii_mmu_mapin_mem2(unsigned long top) - /* MEM2 64MB@0x10000000 */ - delta = wii_hole_start + wii_hole_size; - size = top - delta; -+ -+ if (__map_without_bats) -+ return delta; -+ - for (bl = 128<<10; bl < max_size; bl <<= 1) { - if (bl * 2 > size) - break; -diff --git a/arch/powerpc/platforms/powernv/opal-msglog.c b/arch/powerpc/platforms/powernv/opal-msglog.c -index 44ed78af1a0d..9021b7272889 100644 ---- a/arch/powerpc/platforms/powernv/opal-msglog.c -+++ b/arch/powerpc/platforms/powernv/opal-msglog.c -@@ -92,7 +92,7 @@ out: - } - - static struct bin_attribute opal_msglog_attr = { -- .attr = {.name = "msglog", .mode = 0444}, -+ .attr = {.name = "msglog", .mode = 0400}, - .read = opal_msglog_read - }; - -diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h -index 4928cf0d5af0..fb1251946b45 100644 ---- a/arch/x86/include/asm/page_64_types.h -+++ b/arch/x86/include/asm/page_64_types.h -@@ -2,7 +2,11 @@ - #define _ASM_X86_PAGE_64_DEFS_H - - #ifdef CONFIG_KASAN -+#ifdef CONFIG_KASAN_EXTRA -+#define KASAN_STACK_ORDER 2 -+#else - #define KASAN_STACK_ORDER 1 -+#endif - #else - #define KASAN_STACK_ORDER 0 - #endif -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index 6f8eadf0681f..ac6932bf1a01 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -314,8 +314,7 @@ do { \ - __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \ - break; \ - case 8: \ -- __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \ -- errret); \ -+ __put_user_asm_u64(x, ptr, retval, errret); \ - break; \ - default: \ - __put_user_bad(); \ -@@ -426,8 +425,10 @@ do { \ - #define __put_user_nocheck(x, ptr, size) \ - ({ \ - int __pu_err; \ -+ __typeof__(*(ptr)) __pu_val; \ -+ __pu_val = x; \ - __uaccess_begin(); \ -- __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \ -+ __put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT);\ - __uaccess_end(); \ - __builtin_expect(__pu_err, 0); \ - }) -diff --git a/arch/x86/include/asm/uv/bios.h b/arch/x86/include/asm/uv/bios.h -index 8b7594f2d48f..71605c7d5c5c 100644 ---- a/arch/x86/include/asm/uv/bios.h -+++ b/arch/x86/include/asm/uv/bios.h -@@ -48,8 +48,7 @@ enum { - BIOS_STATUS_SUCCESS = 0, - BIOS_STATUS_UNIMPLEMENTED = -ENOSYS, - BIOS_STATUS_EINVAL = -EINVAL, -- BIOS_STATUS_UNAVAIL = -EBUSY, -- BIOS_STATUS_ABORT = -EINTR, -+ BIOS_STATUS_UNAVAIL = -EBUSY - }; - - /* -@@ -112,9 +111,4 @@ extern long system_serial_number; - - extern struct kobject *sgi_uv_kobj; /* /sys/firmware/sgi_uv */ - --/* -- * EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details -- */ --extern struct semaphore __efi_uv_runtime_lock; -- - #endif /* _ASM_X86_UV_BIOS_H */ -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 9f6151884249..e94e6f16172b 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -716,11 +716,9 @@ static void init_amd_bd(struct cpuinfo_x86 *c) - static void init_amd_zn(struct cpuinfo_x86 *c) - { - set_cpu_cap(c, X86_FEATURE_ZEN); -- /* -- * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects -- * all up to and including B1. -- */ -- if (c->x86_model <= 1 && c->x86_mask <= 1) -+ -+ /* Fix erratum 1076: CPB feature bit not being set in CPUID. */ -+ if (!cpu_has(c, X86_FEATURE_CPB)) - set_cpu_cap(c, X86_FEATURE_CPB); - } - -diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index 0f8a6bbaaa44..0bf17576dd2a 100644 ---- a/arch/x86/kernel/kexec-bzimage64.c -+++ b/arch/x86/kernel/kexec-bzimage64.c -@@ -168,6 +168,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr, - struct efi_info *current_ei = &boot_params.efi_info; - struct efi_info *ei = ¶ms->efi_info; - -+ if (!efi_enabled(EFI_RUNTIME_SERVICES)) -+ return 0; -+ - if (!current_ei->efi_memmap_size) - return 0; - -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 7ce1a19d9d8b..acbde1249b6f 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -2388,6 +2388,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) - kvm_mmu_reset_context(&svm->vcpu); - kvm_mmu_load(&svm->vcpu); - -+ /* -+ * Drop what we picked up for L2 via svm_complete_interrupts() so it -+ * doesn't end up in L1. -+ */ -+ svm->vcpu.arch.nmi_injected = false; -+ kvm_clear_exception_queue(&svm->vcpu); -+ kvm_clear_interrupt_queue(&svm->vcpu); -+ - return 0; - } - -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 14553f6c03a6..098be61a6b4c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -5574,6 +5574,7 @@ static int handle_external_interrupt(struct kvm_vcpu *vcpu) - static int handle_triple_fault(struct kvm_vcpu *vcpu) - { - vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN; -+ vcpu->mmio_needed = 0; - return 0; - } - -@@ -6656,6 +6657,10 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu, - /* Addr = segment_base + offset */ - /* offset = base + [index * scale] + displacement */ - off = exit_qualification; /* holds the displacement */ -+ if (addr_size == 1) -+ off = (gva_t)sign_extend64(off, 31); -+ else if (addr_size == 0) -+ off = (gva_t)sign_extend64(off, 15); - if (base_is_valid) - off += kvm_register_read(vcpu, base_reg); - if (index_is_valid) -@@ -6698,10 +6703,16 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu, - /* Protected mode: #GP(0)/#SS(0) if the segment is unusable. - */ - exn = (s.unusable != 0); -- /* Protected mode: #GP(0)/#SS(0) if the memory -- * operand is outside the segment limit. -+ -+ /* -+ * Protected mode: #GP(0)/#SS(0) if the memory operand is -+ * outside the segment limit. All CPUs that support VMX ignore -+ * limit checks for flat segments, i.e. segments with base==0, -+ * limit==0xffffffff and of type expand-up data or code. - */ -- exn = exn || (off + sizeof(u64) > s.limit); -+ if (!(s.base == 0 && s.limit == 0xffffffff && -+ ((s.type & 8) || !(s.type & 4)))) -+ exn = exn || (off + sizeof(u64) > s.limit); - } - if (exn) { - kvm_queue_exception_e(vcpu, -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 6bd0538d8ebf..706c5d63a53f 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -6478,6 +6478,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) - } - if (kvm_check_request(KVM_REQ_TRIPLE_FAULT, vcpu)) { - vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN; -+ vcpu->mmio_needed = 0; - r = 0; - goto out; - } -diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c -index a45a1c5aabea..1584cbed0dce 100644 ---- a/arch/x86/platform/uv/bios_uv.c -+++ b/arch/x86/platform/uv/bios_uv.c -@@ -28,8 +28,7 @@ - - static struct uv_systab uv_systab; - --static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, -- u64 a4, u64 a5) -+s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5) - { - struct uv_systab *tab = &uv_systab; - s64 ret; -@@ -44,19 +43,6 @@ static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, - a1, a2, a3, a4, a5); - return ret; - } -- --s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5) --{ -- s64 ret; -- -- if (down_interruptible(&__efi_uv_runtime_lock)) -- return BIOS_STATUS_ABORT; -- -- ret = __uv_bios_call(which, a1, a2, a3, a4, a5); -- up(&__efi_uv_runtime_lock); -- -- return ret; --} - EXPORT_SYMBOL_GPL(uv_bios_call); - - s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, -@@ -65,15 +51,10 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, - unsigned long bios_flags; - s64 ret; - -- if (down_interruptible(&__efi_uv_runtime_lock)) -- return BIOS_STATUS_ABORT; -- - local_irq_save(bios_flags); -- ret = __uv_bios_call(which, a1, a2, a3, a4, a5); -+ ret = uv_bios_call(which, a1, a2, a3, a4, a5); - local_irq_restore(bios_flags); - -- up(&__efi_uv_runtime_lock); -- - return ret; - } - -diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig -index 22eeacba37cc..199e05f85e89 100644 ---- a/arch/xtensa/configs/smp_lx200_defconfig -+++ b/arch/xtensa/configs/smp_lx200_defconfig -@@ -35,6 +35,7 @@ CONFIG_SMP=y - CONFIG_HOTPLUG_CPU=y - # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set - # CONFIG_PCI is not set -+CONFIG_VECTORS_OFFSET=0x00002000 - CONFIG_XTENSA_PLATFORM_XTFPGA=y - CONFIG_CMDLINE_BOOL=y - CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug" -diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S -index c7b3bedbfffe..e3823b4f9d08 100644 ---- a/arch/xtensa/kernel/head.S -+++ b/arch/xtensa/kernel/head.S -@@ -286,12 +286,13 @@ should_never_return: - - movi a2, cpu_start_ccount - 1: -+ memw - l32i a3, a2, 0 - beqi a3, 0, 1b - movi a3, 0 - s32i a3, a2, 0 -- memw - 1: -+ memw - l32i a3, a2, 0 - beqi a3, 0, 1b - wsr a3, ccount -@@ -328,11 +329,13 @@ ENTRY(cpu_restart) - rsr a0, prid - neg a2, a0 - movi a3, cpu_start_id -+ memw - s32i a2, a3, 0 - #if XCHAL_DCACHE_IS_WRITEBACK - dhwbi a3, 0 - #endif - 1: -+ memw - l32i a2, a3, 0 - dhi a3, 0 - bne a2, a0, 1b -diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c -index 4d02e38514f5..54bb8e0473a0 100644 ---- a/arch/xtensa/kernel/smp.c -+++ b/arch/xtensa/kernel/smp.c -@@ -80,7 +80,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) - { - unsigned i; - -- for (i = 0; i < max_cpus; ++i) -+ for_each_possible_cpu(i) - set_cpu_present(i, true); - } - -@@ -93,6 +93,11 @@ void __init smp_init_cpus(void) - pr_info("%s: Core Count = %d\n", __func__, ncpus); - pr_info("%s: Core Id = %d\n", __func__, core_id); - -+ if (ncpus > NR_CPUS) { -+ ncpus = NR_CPUS; -+ pr_info("%s: limiting core count by %d\n", __func__, ncpus); -+ } -+ - for (i = 0; i < ncpus; ++i) - set_cpu_possible(i, true); - } -@@ -192,9 +197,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) - int i; - - #ifdef CONFIG_HOTPLUG_CPU -- cpu_start_id = cpu; -- system_flush_invalidate_dcache_range( -- (unsigned long)&cpu_start_id, sizeof(cpu_start_id)); -+ WRITE_ONCE(cpu_start_id, cpu); -+ /* Pairs with the third memw in the cpu_restart */ -+ mb(); -+ system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id, -+ sizeof(cpu_start_id)); - #endif - smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1); - -@@ -203,18 +210,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) - ccount = get_ccount(); - while (!ccount); - -- cpu_start_ccount = ccount; -+ WRITE_ONCE(cpu_start_ccount, ccount); - -- while (time_before(jiffies, timeout)) { -+ do { -+ /* -+ * Pairs with the first two memws in the -+ * .Lboot_secondary. -+ */ - mb(); -- if (!cpu_start_ccount) -- break; -- } -+ ccount = READ_ONCE(cpu_start_ccount); -+ } while (ccount && time_before(jiffies, timeout)); - -- if (cpu_start_ccount) { -+ if (ccount) { - smp_call_function_single(0, mx_cpu_stop, -- (void *)cpu, 1); -- cpu_start_ccount = 0; -+ (void *)cpu, 1); -+ WRITE_ONCE(cpu_start_ccount, 0); - return -EIO; - } - } -@@ -234,6 +244,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) - pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n", - __func__, cpu, idle, start_info.stack); - -+ init_completion(&cpu_running); - ret = boot_secondary(cpu, idle); - if (ret == 0) { - wait_for_completion_timeout(&cpu_running, -@@ -295,8 +306,10 @@ void __cpu_die(unsigned int cpu) - unsigned long timeout = jiffies + msecs_to_jiffies(1000); - while (time_before(jiffies, timeout)) { - system_invalidate_dcache_range((unsigned long)&cpu_start_id, -- sizeof(cpu_start_id)); -- if (cpu_start_id == -cpu) { -+ sizeof(cpu_start_id)); -+ /* Pairs with the second memw in the cpu_restart */ -+ mb(); -+ if (READ_ONCE(cpu_start_id) == -cpu) { - platform_cpu_kill(cpu); - return; - } -diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c -index b9ad9feadc2d..a992cb6a47db 100644 ---- a/arch/xtensa/kernel/time.c -+++ b/arch/xtensa/kernel/time.c -@@ -87,7 +87,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt) - container_of(evt, struct ccount_timer, evt); - - if (timer->irq_enabled) { -- disable_irq(evt->irq); -+ disable_irq_nosync(evt->irq); - timer->irq_enabled = 0; - } - return 0; -diff --git a/crypto/ahash.c b/crypto/ahash.c -index 6978ad86e516..595c4f3657ff 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -85,17 +85,17 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk) - int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) - { - unsigned int alignmask = walk->alignmask; -- unsigned int nbytes = walk->entrylen; - - walk->data -= walk->offset; - -- if (nbytes && walk->offset & alignmask && !err) { -- walk->offset = ALIGN(walk->offset, alignmask + 1); -- nbytes = min(nbytes, -- ((unsigned int)(PAGE_SIZE)) - walk->offset); -- walk->entrylen -= nbytes; -+ if (walk->entrylen && (walk->offset & alignmask) && !err) { -+ unsigned int nbytes; - -+ walk->offset = ALIGN(walk->offset, alignmask + 1); -+ nbytes = min(walk->entrylen, -+ (unsigned int)(PAGE_SIZE - walk->offset)); - if (nbytes) { -+ walk->entrylen -= nbytes; - walk->data += walk->offset; - return nbytes; - } -@@ -115,7 +115,7 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) - if (err) - return err; - -- if (nbytes) { -+ if (walk->entrylen) { - walk->offset = 0; - walk->pg++; - return hash_walk_next(walk); -diff --git a/crypto/pcbc.c b/crypto/pcbc.c -index f654965f0933..de81f716cf26 100644 ---- a/crypto/pcbc.c -+++ b/crypto/pcbc.c -@@ -52,7 +52,7 @@ static int crypto_pcbc_encrypt_segment(struct blkcipher_desc *desc, - unsigned int nbytes = walk->nbytes; - u8 *src = walk->src.virt.addr; - u8 *dst = walk->dst.virt.addr; -- u8 *iv = walk->iv; -+ u8 * const iv = walk->iv; - - do { - crypto_xor(iv, src, bsize); -@@ -76,7 +76,7 @@ static int crypto_pcbc_encrypt_inplace(struct blkcipher_desc *desc, - int bsize = crypto_cipher_blocksize(tfm); - unsigned int nbytes = walk->nbytes; - u8 *src = walk->src.virt.addr; -- u8 *iv = walk->iv; -+ u8 * const iv = walk->iv; - u8 tmpbuf[bsize]; - - do { -@@ -89,8 +89,6 @@ static int crypto_pcbc_encrypt_inplace(struct blkcipher_desc *desc, - src += bsize; - } while ((nbytes -= bsize) >= bsize); - -- memcpy(walk->iv, iv, bsize); -- - return nbytes; - } - -@@ -130,7 +128,7 @@ static int crypto_pcbc_decrypt_segment(struct blkcipher_desc *desc, - unsigned int nbytes = walk->nbytes; - u8 *src = walk->src.virt.addr; - u8 *dst = walk->dst.virt.addr; -- u8 *iv = walk->iv; -+ u8 * const iv = walk->iv; - - do { - fn(crypto_cipher_tfm(tfm), dst, src); -@@ -142,8 +140,6 @@ static int crypto_pcbc_decrypt_segment(struct blkcipher_desc *desc, - dst += bsize; - } while ((nbytes -= bsize) >= bsize); - -- memcpy(walk->iv, iv, bsize); -- - return nbytes; - } - -@@ -156,7 +152,7 @@ static int crypto_pcbc_decrypt_inplace(struct blkcipher_desc *desc, - int bsize = crypto_cipher_blocksize(tfm); - unsigned int nbytes = walk->nbytes; - u8 *src = walk->src.virt.addr; -- u8 *iv = walk->iv; -+ u8 * const iv = walk->iv; - u8 tmpbuf[bsize]; - - do { -@@ -169,8 +165,6 @@ static int crypto_pcbc_decrypt_inplace(struct blkcipher_desc *desc, - src += bsize; - } while ((nbytes -= bsize) >= bsize); - -- memcpy(walk->iv, iv, bsize); -- - return nbytes; - } - -diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c -index 1521d9a41d25..a899a7abcf63 100644 ---- a/drivers/acpi/device_sysfs.c -+++ b/drivers/acpi/device_sysfs.c -@@ -202,11 +202,15 @@ static int create_of_modalias(struct acpi_device *acpi_dev, char *modalias, - { - struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER }; - const union acpi_object *of_compatible, *obj; -+ acpi_status status; - int len, count; - int i, nval; - char *c; - -- acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf); -+ status = acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf); -+ if (ACPI_FAILURE(status)) -+ return -ENODEV; -+ - /* DT strings are all in lower case */ - for (c = buf.pointer; *c != '\0'; c++) - *c = tolower(*c); -diff --git a/drivers/atm/he.c b/drivers/atm/he.c -index 0f5cb37636bc..010581e8bee0 100644 ---- a/drivers/atm/he.c -+++ b/drivers/atm/he.c -@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) - instead of '/ 512', use '>> 9' to prevent a call - to divdu3 on x86 platforms - */ -- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; -+ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9; - - if (rate_cps < 10) - rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ -diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c -index e613633ffe9c..4e01bf65317a 100644 ---- a/drivers/base/power/wakeup.c -+++ b/drivers/base/power/wakeup.c -@@ -113,7 +113,6 @@ void wakeup_source_drop(struct wakeup_source *ws) - if (!ws) - return; - -- del_timer_sync(&ws->timer); - __pm_relax(ws); - } - EXPORT_SYMBOL_GPL(wakeup_source_drop); -@@ -201,6 +200,13 @@ void wakeup_source_remove(struct wakeup_source *ws) - list_del_rcu(&ws->entry); - spin_unlock_irqrestore(&events_lock, flags); - synchronize_srcu(&wakeup_srcu); -+ -+ del_timer_sync(&ws->timer); -+ /* -+ * Clear timer.function to make wakeup_source_not_registered() treat -+ * this wakeup source as not registered. -+ */ -+ ws->timer.function = NULL; - } - EXPORT_SYMBOL_GPL(wakeup_source_remove); - -diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c -index 14790304b84b..9fcd51095d13 100644 ---- a/drivers/char/applicom.c -+++ b/drivers/char/applicom.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, - TicCard = st_loc.tic_des_from_pc; /* tic number to send */ - IndexCard = NumCard - 1; - -- if((NumCard < 1) || (NumCard > MAX_BOARD) || !apbs[IndexCard].RamIO) -+ if (IndexCard >= MAX_BOARD) -+ return -EINVAL; -+ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); -+ -+ if (!apbs[IndexCard].RamIO) - return -EINVAL; - - #ifdef DEBUG -@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - unsigned char IndexCard; - void __iomem *pmem; - int ret = 0; -+ static int warncount = 10; - volatile unsigned char byte_reset_it; - struct st_ram_io *adgl; - void __user *argp = (void __user *)arg; -@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - mutex_lock(&ac_mutex); - IndexCard = adgl->num_card-1; - -- if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) { -- static int warncount = 10; -- if (warncount) { -- printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); -- warncount--; -- } -- kfree(adgl); -- mutex_unlock(&ac_mutex); -- return -EINVAL; -- } -+ if (cmd != 6 && IndexCard >= MAX_BOARD) -+ goto err; -+ IndexCard = array_index_nospec(IndexCard, MAX_BOARD); -+ -+ if (cmd != 6 && !apbs[IndexCard].RamIO) -+ goto err; - - switch (cmd) { - -@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - kfree(adgl); - mutex_unlock(&ac_mutex); - return 0; -+ -+err: -+ if (warncount) { -+ pr_warn("APPLICOM driver IOCTL, bad board number %d\n", -+ (int)IndexCard + 1); -+ warncount--; -+ } -+ kfree(adgl); -+ mutex_unlock(&ac_mutex); -+ return -EINVAL; -+ - } - -diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c -index 7cfb7b2a2ed6..8878efb80620 100644 ---- a/drivers/clk/ingenic/cgu.c -+++ b/drivers/clk/ingenic/cgu.c -@@ -355,16 +355,16 @@ ingenic_clk_round_rate(struct clk_hw *hw, unsigned long req_rate, - struct ingenic_clk *ingenic_clk = to_ingenic_clk(hw); - struct ingenic_cgu *cgu = ingenic_clk->cgu; - const struct ingenic_cgu_clk_info *clk_info; -- long rate = *parent_rate; -+ unsigned int div = 1; - - clk_info = &cgu->clock_info[ingenic_clk->idx]; - - if (clk_info->type & CGU_CLK_DIV) -- rate /= ingenic_clk_calc_div(clk_info, *parent_rate, req_rate); -+ div = ingenic_clk_calc_div(clk_info, *parent_rate, req_rate); - else if (clk_info->type & CGU_CLK_FIXDIV) -- rate /= clk_info->fixdiv.div; -+ div = clk_info->fixdiv.div; - -- return rate; -+ return DIV_ROUND_UP(*parent_rate, div); - } - - static int -@@ -384,7 +384,7 @@ ingenic_clk_set_rate(struct clk_hw *hw, unsigned long req_rate, - - if (clk_info->type & CGU_CLK_DIV) { - div = ingenic_clk_calc_div(clk_info, parent_rate, req_rate); -- rate = parent_rate / div; -+ rate = DIV_ROUND_UP(parent_rate, div); - - if (rate != req_rate) - return -EINVAL; -diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c -index 47f8aafe3344..d65a6036d610 100644 ---- a/drivers/clocksource/exynos_mct.c -+++ b/drivers/clocksource/exynos_mct.c -@@ -379,6 +379,13 @@ static void exynos4_mct_tick_start(unsigned long cycles, - exynos4_mct_write(tmp, mevt->base + MCT_L_TCON_OFFSET); - } - -+static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) -+{ -+ /* Clear the MCT tick interrupt */ -+ if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1) -+ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET); -+} -+ - static int exynos4_tick_set_next_event(unsigned long cycles, - struct clock_event_device *evt) - { -@@ -395,6 +402,7 @@ static int set_state_shutdown(struct clock_event_device *evt) - - mevt = container_of(evt, struct mct_clock_event_device, evt); - exynos4_mct_tick_stop(mevt); -+ exynos4_mct_tick_clear(mevt); - return 0; - } - -@@ -411,8 +419,11 @@ static int set_state_periodic(struct clock_event_device *evt) - return 0; - } - --static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) -+static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id) - { -+ struct mct_clock_event_device *mevt = dev_id; -+ struct clock_event_device *evt = &mevt->evt; -+ - /* - * This is for supporting oneshot mode. - * Mct would generate interrupt periodically -@@ -421,16 +432,6 @@ static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt) - if (!clockevent_state_periodic(&mevt->evt)) - exynos4_mct_tick_stop(mevt); - -- /* Clear the MCT tick interrupt */ -- if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1) -- exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET); --} -- --static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id) --{ -- struct mct_clock_event_device *mevt = dev_id; -- struct clock_event_device *evt = &mevt->evt; -- - exynos4_mct_tick_clear(mevt); - - evt->event_handler(evt); -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index f3307fc38e79..f2d1fea23fbf 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -2081,6 +2081,7 @@ static void init_aead_job(struct aead_request *req, - if (unlikely(req->src != req->dst)) { - if (!edesc->dst_nents) { - dst_dma = sg_dma_address(req->dst); -+ out_options = 0; - } else { - dst_dma = edesc->sec4_sg_dma + - sec4_sg_index * -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index 82a7c89caae2..af24c5bf32d6 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -203,6 +203,7 @@ struct at_xdmac_chan { - u32 save_cim; - u32 save_cnda; - u32 save_cndc; -+ u32 irq_status; - unsigned long status; - struct tasklet_struct tasklet; - struct dma_slave_config sconfig; -@@ -1582,8 +1583,8 @@ static void at_xdmac_tasklet(unsigned long data) - struct at_xdmac_desc *desc; - u32 error_mask; - -- dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n", -- __func__, atchan->status); -+ dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n", -+ __func__, atchan->irq_status); - - error_mask = AT_XDMAC_CIS_RBEIS - | AT_XDMAC_CIS_WBEIS -@@ -1591,15 +1592,15 @@ static void at_xdmac_tasklet(unsigned long data) - - if (at_xdmac_chan_is_cyclic(atchan)) { - at_xdmac_handle_cyclic(atchan); -- } else if ((atchan->status & AT_XDMAC_CIS_LIS) -- || (atchan->status & error_mask)) { -+ } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS) -+ || (atchan->irq_status & error_mask)) { - struct dma_async_tx_descriptor *txd; - -- if (atchan->status & AT_XDMAC_CIS_RBEIS) -+ if (atchan->irq_status & AT_XDMAC_CIS_RBEIS) - dev_err(chan2dev(&atchan->chan), "read bus error!!!"); -- if (atchan->status & AT_XDMAC_CIS_WBEIS) -+ if (atchan->irq_status & AT_XDMAC_CIS_WBEIS) - dev_err(chan2dev(&atchan->chan), "write bus error!!!"); -- if (atchan->status & AT_XDMAC_CIS_ROIS) -+ if (atchan->irq_status & AT_XDMAC_CIS_ROIS) - dev_err(chan2dev(&atchan->chan), "request overflow error!!!"); - - spin_lock_bh(&atchan->lock); -@@ -1654,7 +1655,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) - atchan = &atxdmac->chan[i]; - chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM); - chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS); -- atchan->status = chan_status & chan_imr; -+ atchan->irq_status = chan_status & chan_imr; - dev_vdbg(atxdmac->dma.dev, - "%s: chan%d: imr=0x%x, status=0x%x\n", - __func__, i, chan_imr, chan_status); -@@ -1668,7 +1669,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) - at_xdmac_chan_read(atchan, AT_XDMAC_CDA), - at_xdmac_chan_read(atchan, AT_XDMAC_CUBC)); - -- if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS)) -+ if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS)) - at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask); - - tasklet_schedule(&atchan->tasklet); -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index 6796eb1a8a4c..884aecebb249 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -563,11 +563,9 @@ static int dmatest_func(void *data) - srcs[i] = um->addr[i] + src_off; - ret = dma_mapping_error(dev->dev, um->addr[i]); - if (ret) { -- dmaengine_unmap_put(um); - result("src mapping error", total_tests, - src_off, dst_off, len, ret); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } - um->to_cnt++; - } -@@ -582,11 +580,9 @@ static int dmatest_func(void *data) - DMA_BIDIRECTIONAL); - ret = dma_mapping_error(dev->dev, dsts[i]); - if (ret) { -- dmaengine_unmap_put(um); - result("dst mapping error", total_tests, - src_off, dst_off, len, ret); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } - um->bidi_cnt++; - } -@@ -611,12 +607,10 @@ static int dmatest_func(void *data) - } - - if (!tx) { -- dmaengine_unmap_put(um); - result("prep error", total_tests, src_off, - dst_off, len, ret); - msleep(100); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } - - done->done = false; -@@ -625,12 +619,10 @@ static int dmatest_func(void *data) - cookie = tx->tx_submit(tx); - - if (dma_submit_error(cookie)) { -- dmaengine_unmap_put(um); - result("submit error", total_tests, src_off, - dst_off, len, ret); - msleep(100); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } - dma_async_issue_pending(chan); - -@@ -643,16 +635,14 @@ static int dmatest_func(void *data) - dmaengine_unmap_put(um); - result("test timed out", total_tests, src_off, dst_off, - len, 0); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } else if (status != DMA_COMPLETE) { - dmaengine_unmap_put(um); - result(status == DMA_ERROR ? - "completion error status" : - "completion busy status", total_tests, src_off, - dst_off, len, ret); -- failed_tests++; -- continue; -+ goto error_unmap_continue; - } - - dmaengine_unmap_put(um); -@@ -691,6 +681,12 @@ static int dmatest_func(void *data) - verbose_result("test passed", total_tests, src_off, - dst_off, len, 0); - } -+ -+ continue; -+ -+error_unmap_continue: -+ dmaengine_unmap_put(um); -+ failed_tests++; - } - runtime = ktime_us_delta(ktime_get(), ktime); - -diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c -index 6682b3eec2b6..cc8fc601ed47 100644 ---- a/drivers/dma/sh/usb-dmac.c -+++ b/drivers/dma/sh/usb-dmac.c -@@ -700,6 +700,8 @@ static int usb_dmac_runtime_resume(struct device *dev) - #endif /* CONFIG_PM */ - - static const struct dev_pm_ops usb_dmac_pm = { -+ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, -+ pm_runtime_force_resume) - SET_RUNTIME_PM_OPS(usb_dmac_runtime_suspend, usb_dmac_runtime_resume, - NULL) - }; -diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c -index 906d0224f50d..228bbf910461 100644 ---- a/drivers/firmware/efi/runtime-wrappers.c -+++ b/drivers/firmware/efi/runtime-wrappers.c -@@ -87,13 +87,6 @@ static DEFINE_SPINLOCK(efi_runtime_lock); - * context through efi_pstore_write(). - */ - --/* -- * Expose the EFI runtime lock to the UV platform -- */ --#ifdef CONFIG_X86_UV --extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); --#endif -- - /* - * As per commit ef68c8f87ed1 ("x86: Serialize EFI time accesses on rtc_lock"), - * the EFI specification requires that callers of the time related runtime -diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c -index 72791232e46b..437c8ef90643 100644 ---- a/drivers/firmware/iscsi_ibft.c -+++ b/drivers/firmware/iscsi_ibft.c -@@ -513,6 +513,7 @@ static umode_t __init ibft_check_tgt_for(void *data, int type) - case ISCSI_BOOT_TGT_NIC_ASSOC: - case ISCSI_BOOT_TGT_CHAP_TYPE: - rc = S_IRUGO; -+ break; - case ISCSI_BOOT_TGT_NAME: - if (tgt->tgt_name_len) - rc = S_IRUGO; -diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c -index 87b950cec6ec..db95c4b99a74 100644 ---- a/drivers/gpio/gpio-vf610.c -+++ b/drivers/gpio/gpio-vf610.c -@@ -227,6 +227,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) - struct vf610_gpio_port *port; - struct resource *iores; - struct gpio_chip *gc; -+ int i; - int ret; - - port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL); -@@ -265,6 +266,10 @@ static int vf610_gpio_probe(struct platform_device *pdev) - if (ret < 0) - return ret; - -+ /* Mask all GPIO interrupts */ -+ for (i = 0; i < gc->ngpio; i++) -+ vf610_gpio_writel(0, port->base + PORT_PCR(i)); -+ - /* Clear the interrupt status register for all GPIO's */ - vf610_gpio_writel(~0, port->base + PORT_ISFR); - -diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c -index 9a78c48817c6..909a52b21ebe 100644 ---- a/drivers/gpu/drm/msm/msm_rd.c -+++ b/drivers/gpu/drm/msm/msm_rd.c -@@ -103,7 +103,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz) - char *fptr = &fifo->buf[fifo->head]; - int n; - -- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0); -+ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open); -+ if (!rd->open) -+ return; - - n = min(sz, circ_space_to_end(&rd->fifo)); - memcpy(fptr, ptr, n); -@@ -192,7 +194,10 @@ out: - static int rd_release(struct inode *inode, struct file *file) - { - struct msm_rd_state *rd = inode->i_private; -+ - rd->open = false; -+ wake_up_all(&rd->fifo_event); -+ - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c -index 46f87d4aaf31..782fee330b4c 100644 ---- a/drivers/gpu/drm/radeon/evergreen_cs.c -+++ b/drivers/gpu/drm/radeon/evergreen_cs.c -@@ -1299,6 +1299,7 @@ static int evergreen_cs_handle_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) - return -EINVAL; - } - ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); -+ break; - case CB_TARGET_MASK: - track->cb_target_mask = radeon_get_ib_value(p, idx); - track->cb_dirty = true; -diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c -index 5030cba4a581..df295a0ce87d 100644 ---- a/drivers/gpu/ipu-v3/ipu-common.c -+++ b/drivers/gpu/ipu-v3/ipu-common.c -@@ -746,8 +746,8 @@ static struct ipu_devtype ipu_type_imx51 = { - .cpmem_ofs = 0x1f000000, - .srm_ofs = 0x1f040000, - .tpm_ofs = 0x1f060000, -- .csi0_ofs = 0x1f030000, -- .csi1_ofs = 0x1f038000, -+ .csi0_ofs = 0x1e030000, -+ .csi1_ofs = 0x1e038000, - .ic_ofs = 0x1e020000, - .disp0_ofs = 0x1e040000, - .disp1_ofs = 0x1e048000, -@@ -762,8 +762,8 @@ static struct ipu_devtype ipu_type_imx53 = { - .cpmem_ofs = 0x07000000, - .srm_ofs = 0x07040000, - .tpm_ofs = 0x07060000, -- .csi0_ofs = 0x07030000, -- .csi1_ofs = 0x07038000, -+ .csi0_ofs = 0x06030000, -+ .csi1_ofs = 0x06038000, - .ic_ofs = 0x06020000, - .disp0_ofs = 0x06040000, - .disp1_ofs = 0x06048000, -diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c -index 2dc5378ccd3a..eb43943cdf07 100644 ---- a/drivers/hwtracing/intel_th/gth.c -+++ b/drivers/hwtracing/intel_th/gth.c -@@ -591,11 +591,15 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, - { - struct gth_device *gth = dev_get_drvdata(&thdev->dev); - int port = othdev->output.port; -+ int master; - - spin_lock(>h->gth_lock); - othdev->output.port = -1; - othdev->output.active = false; - gth->output[port].output = NULL; -+ for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++) -+ if (gth->master[master] == port) -+ gth->master[master] = -1; - spin_unlock(>h->gth_lock); - } - -diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c -index 99434f5be34c..92ab51aa8a74 100644 ---- a/drivers/hwtracing/stm/core.c -+++ b/drivers/hwtracing/stm/core.c -@@ -229,6 +229,9 @@ static int find_free_channels(unsigned long *bitmap, unsigned int start, - ; - if (i == width) - return pos; -+ -+ /* step over [pos..pos+i) to continue search */ -+ pos += i; - } - - return -1; -@@ -474,7 +477,7 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg) - { - struct stm_device *stm = stmf->stm; - struct stp_policy_id *id; -- int ret = -EINVAL; -+ int ret = -EINVAL, wlimit = 1; - u32 size; - - if (stmf->output.nr_chans) -@@ -502,8 +505,10 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg) - if (id->__reserved_0 || id->__reserved_1) - goto err_free; - -- if (id->width < 1 || -- id->width > PAGE_SIZE / stm->data->sw_mmiosz) -+ if (stm->data->sw_mmiosz) -+ wlimit = PAGE_SIZE / stm->data->sw_mmiosz; -+ -+ if (id->width < 1 || id->width > wlimit) - goto err_free; - - ret = stm_file_assign(stmf, id->id, id->width); -diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c -index 84deed6571bd..6d32e6da3110 100644 ---- a/drivers/i2c/busses/i2c-cadence.c -+++ b/drivers/i2c/busses/i2c-cadence.c -@@ -378,8 +378,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) - * Check for the message size against FIFO depth and set the - * 'hold bus' bit if it is greater than FIFO depth. - */ -- if (id->recv_count > CDNS_I2C_FIFO_DEPTH) -+ if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) - ctrl_reg |= CDNS_I2C_CR_HOLD; -+ else -+ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; - - cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); - -@@ -436,8 +438,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id) - * Check for the message size against FIFO depth and set the - * 'hold bus' bit if it is greater than FIFO depth. - */ -- if (id->send_count > CDNS_I2C_FIFO_DEPTH) -+ if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag) - ctrl_reg |= CDNS_I2C_CR_HOLD; -+ else -+ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD; -+ - cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET); - - /* Clear the interrupts in interrupt status register. */ -diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c -index a0522fcc4ff8..1004422dbb10 100644 ---- a/drivers/i2c/busses/i2c-tegra.c -+++ b/drivers/i2c/busses/i2c-tegra.c -@@ -696,7 +696,7 @@ static const struct i2c_algorithm tegra_i2c_algo = { - /* payload size is only 12 bit */ - static struct i2c_adapter_quirks tegra_i2c_quirks = { - .max_read_len = 4096, -- .max_write_len = 4096, -+ .max_write_len = 4096 - 12, - }; - - static const struct tegra_i2c_hw_feature tegra20_i2c_hw = { -diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c -index 59193f67ea78..56bd59bc08b5 100644 ---- a/drivers/infiniband/hw/qib/qib_ud.c -+++ b/drivers/infiniband/hw/qib/qib_ud.c -@@ -515,7 +515,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr, - opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { - wc.ex.imm_data = ohdr->u.ud.imm_data; - wc.wc_flags = IB_WC_WITH_IMM; -- tlen -= sizeof(u32); - } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { - wc.ex.imm_data = 0; - wc.wc_flags = 0; -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 1897c4080346..3dbc3ed263c2 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -2594,7 +2594,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) - { - struct srp_target_port *target = host_to_target(scmnd->device->host); - struct srp_rdma_ch *ch; -- int i, j; - u8 status; - - shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); -@@ -2606,15 +2605,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) - if (status) - return FAILED; - -- for (i = 0; i < target->ch_count; i++) { -- ch = &target->ch[i]; -- for (j = 0; j < target->req_ring_size; ++j) { -- struct srp_request *req = &ch->req_ring[j]; -- -- srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); -- } -- } -- - return SUCCESS; - } - -diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c -index c64d87442a62..2e12e31f45c5 100644 ---- a/drivers/input/keyboard/matrix_keypad.c -+++ b/drivers/input/keyboard/matrix_keypad.c -@@ -220,7 +220,7 @@ static void matrix_keypad_stop(struct input_dev *dev) - keypad->stopped = true; - spin_unlock_irq(&keypad->lock); - -- flush_work(&keypad->work.work); -+ flush_delayed_work(&keypad->work); - /* - * matrix_keypad_scan() will leave IRQs enabled; - * we should disable them now. -diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c -index de7be4f03d91..ebf9f643d910 100644 ---- a/drivers/input/keyboard/st-keyscan.c -+++ b/drivers/input/keyboard/st-keyscan.c -@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev) - - input_dev->id.bustype = BUS_HOST; - -+ keypad_data->input_dev = input_dev; -+ - error = keypad_matrix_key_parse_dt(keypad_data); - if (error) - return error; -@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev) - - input_set_drvdata(input_dev, keypad_data); - -- keypad_data->input_dev = input_dev; -- - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - keypad_data->base = devm_ioremap_resource(&pdev->dev, res); - if (IS_ERR(keypad_data->base)) -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 25ce9047b682..16f5d5660053 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1241,6 +1241,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0000", 0 }, - { "ELAN0100", 0 }, - { "ELAN0600", 0 }, -+ { "ELAN0601", 0 }, - { "ELAN0602", 0 }, - { "ELAN0605", 0 }, - { "ELAN0608", 0 }, -diff --git a/drivers/input/tablet/wacom_serial4.c b/drivers/input/tablet/wacom_serial4.c -index 20ab802461e7..1d46b763aae6 100644 ---- a/drivers/input/tablet/wacom_serial4.c -+++ b/drivers/input/tablet/wacom_serial4.c -@@ -187,6 +187,7 @@ enum { - MODEL_DIGITIZER_II = 0x5544, /* UD */ - MODEL_GRAPHIRE = 0x4554, /* ET */ - MODEL_PENPARTNER = 0x4354, /* CT */ -+ MODEL_ARTPAD_II = 0x4B54, /* KT */ - }; - - static void wacom_handle_model_response(struct wacom *wacom) -@@ -245,6 +246,7 @@ static void wacom_handle_model_response(struct wacom *wacom) - wacom->flags = F_HAS_STYLUS2 | F_HAS_SCROLLWHEEL; - break; - -+ case MODEL_ARTPAD_II: - case MODEL_DIGITIZER_II: - wacom->dev->name = "Wacom Digitizer II"; - wacom->dev->id.version = MODEL_DIGITIZER_II; -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 52c36394dba5..0ad8b7c78a43 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -1982,6 +1982,7 @@ static void do_attach(struct iommu_dev_data *dev_data, - - static void do_detach(struct iommu_dev_data *dev_data) - { -+ struct protection_domain *domain = dev_data->domain; - struct amd_iommu *iommu; - u16 alias; - -@@ -1997,10 +1998,6 @@ static void do_detach(struct iommu_dev_data *dev_data) - iommu = amd_iommu_rlookup_table[dev_data->devid]; - alias = dev_data->alias; - -- /* decrease reference counters */ -- dev_data->domain->dev_iommu[iommu->index] -= 1; -- dev_data->domain->dev_cnt -= 1; -- - /* Update data structures */ - dev_data->domain = NULL; - list_del(&dev_data->list); -@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data) - - /* Flush the DTE entry */ - device_flush_dte(dev_data); -+ -+ /* Flush IOTLB */ -+ domain_flush_tlb_pde(domain); -+ -+ /* Wait for the flushes to finish */ -+ domain_flush_complete(domain); -+ -+ /* decrease reference counters - needs to happen after the flushes */ -+ domain->dev_iommu[iommu->index] -= 1; -+ domain->dev_cnt -= 1; - } - - /* -diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c -index 013fc9659a84..2fe2bcb63a71 100644 ---- a/drivers/irqchip/irq-mmp.c -+++ b/drivers/irqchip/irq-mmp.c -@@ -34,6 +34,9 @@ - #define SEL_INT_PENDING (1 << 6) - #define SEL_INT_NUM_MASK 0x3f - -+#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) -+#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) -+ - struct icu_chip_data { - int nr_irqs; - unsigned int virq_base; -@@ -190,7 +193,8 @@ static struct mmp_intc_conf mmp_conf = { - static struct mmp_intc_conf mmp2_conf = { - .conf_enable = 0x20, - .conf_disable = 0x0, -- .conf_mask = 0x7f, -+ .conf_mask = MMP2_ICU_INT_ROUTE_PJ4_IRQ | -+ MMP2_ICU_INT_ROUTE_PJ4_FIQ, - }; - - static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs) -diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c -index 4d9b195547c5..df2a10157720 100644 ---- a/drivers/isdn/hardware/avm/b1.c -+++ b/drivers/isdn/hardware/avm/b1.c -@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo) - int i, j; - - for (j = 0; j < AVM_MAXVERSION; j++) -- cinfo->version[j] = "\0\0" + 1; -+ cinfo->version[j] = ""; - for (i = 0, j = 0; - j < AVM_MAXVERSION && i < cinfo->versionlen; - j++, i += cinfo->versionbuf[i] + 1) -diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c -index 2175225af742..2da3f5cd0729 100644 ---- a/drivers/isdn/i4l/isdn_tty.c -+++ b/drivers/isdn/i4l/isdn_tty.c -@@ -786,7 +786,7 @@ isdn_tty_suspend(char *id, modem_info *info, atemu *m) - cmd.parm.cmsg.para[3] = 4; /* 16 bit 0x0004 Suspend */ - cmd.parm.cmsg.para[4] = 0; - cmd.parm.cmsg.para[5] = l; -- strncpy(&cmd.parm.cmsg.para[6], id, l); -+ strscpy(&cmd.parm.cmsg.para[6], id, l); - cmd.command = CAPI_PUT_MESSAGE; - cmd.driver = info->isdn_driver; - cmd.arg = info->isdn_channel; -@@ -1459,15 +1459,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) - { - modem_info *info = (modem_info *) tty->driver_data; - -+ mutex_lock(&modem_info_mutex); - if (!old_termios) - isdn_tty_change_speed(info); - else { - if (tty->termios.c_cflag == old_termios->c_cflag && - tty->termios.c_ispeed == old_termios->c_ispeed && -- tty->termios.c_ospeed == old_termios->c_ospeed) -+ tty->termios.c_ospeed == old_termios->c_ospeed) { -+ mutex_unlock(&modem_info_mutex); - return; -+ } - isdn_tty_change_speed(info); - } -+ mutex_unlock(&modem_info_mutex); - } - - /* -diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c -index 1d0187f42941..d12370352ae3 100644 ---- a/drivers/leds/leds-lp5523.c -+++ b/drivers/leds/leds-lp5523.c -@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) - - /* Let the programs run for couple of ms and check the engine status */ - usleep_range(3000, 6000); -- lp55xx_read(chip, LP5523_REG_STATUS, &status); -+ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); -+ if (ret) -+ return ret; - status &= LP5523_ENG_STATUS_MASK; - - if (status != LP5523_ENG_STATUS_MASK) { -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 8d613652d0e2..69e9abf00c74 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -3755,6 +3755,8 @@ static int run(struct mddev *mddev) - set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); - mddev->sync_thread = md_register_thread(md_do_sync, mddev, - "reshape"); -+ if (!mddev->sync_thread) -+ goto out_free_conf; - } - - return 0; -@@ -4442,7 +4444,6 @@ bio_full: - atomic_inc(&r10_bio->remaining); - read_bio->bi_next = NULL; - generic_make_request(read_bio); -- sector_nr += nr_sectors; - sectors_done += nr_sectors; - if (sector_nr <= last) - goto read_more; -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 0841d8f10a58..5e65dc6def7e 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -6973,6 +6973,8 @@ static int run(struct mddev *mddev) - set_bit(MD_RECOVERY_RUNNING, &mddev->recovery); - mddev->sync_thread = md_register_thread(md_do_sync, mddev, - "reshape"); -+ if (!mddev->sync_thread) -+ goto abort; - } - - /* Ok, everything is just fine now */ -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 885f689ac870..f2e3fdf385cc 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -1019,11 +1019,19 @@ static int uvc_parse_standard_control(struct uvc_device *dev, - return -EINVAL; - } - -- /* Make sure the terminal type MSB is not null, otherwise it -- * could be confused with a unit. -+ /* -+ * Reject invalid terminal types that would cause issues: -+ * -+ * - The high byte must be non-zero, otherwise it would be -+ * confused with a unit. -+ * -+ * - Bit 15 must be 0, as we use it internally as a terminal -+ * direction flag. -+ * -+ * Other unknown types are accepted. - */ - type = get_unaligned_le16(&buffer[4]); -- if ((type & 0xff00) == 0) { -+ if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) { - uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " - "interface %d INPUT_TERMINAL %d has invalid " - "type 0x%04x, skipping\n", udev->devnum, -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index a4048a04d236..a550dbe36dc5 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -638,6 +638,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream, - if (!uvc_hw_timestamps_param) - return; - -+ /* -+ * We will get called from __vb2_queue_cancel() if there are buffers -+ * done but not dequeued by the user, but the sample array has already -+ * been released at that time. Just bail out in that case. -+ */ -+ if (!clock->samples) -+ return; -+ - spin_lock_irqsave(&clock->lock, flags); - - if (clock->count < clock->size) -diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c -index bf23234d957e..412a6a74d0a8 100644 ---- a/drivers/media/v4l2-core/videobuf2-v4l2.c -+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c -@@ -141,7 +141,6 @@ static void vb2_warn_zero_bytesused(struct vb2_buffer *vb) - return; - - check_once = true; -- WARN_ON(1); - - pr_warn("use of bytesused == 0 is deprecated and will be removed in the future,\n"); - if (vb->vb2_queue->allow_zero_bytesused) -diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c -index fefbe4cfa61d..1263cfd8b4d2 100644 ---- a/drivers/mfd/ab8500-core.c -+++ b/drivers/mfd/ab8500-core.c -@@ -259,7 +259,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank, - mutex_unlock(&ab8500->lock); - dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret); - -- return ret; -+ return (ret < 0) ? ret : 0; - } - - static int ab8500_get_register(struct device *dev, u8 bank, -diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c -index 12099b09a9a7..e71b9f23379d 100644 ---- a/drivers/mfd/db8500-prcmu.c -+++ b/drivers/mfd/db8500-prcmu.c -@@ -2610,7 +2610,7 @@ static struct irq_chip prcmu_irq_chip = { - .irq_unmask = prcmu_irq_unmask, - }; - --static __init char *fw_project_name(u32 project) -+static char *fw_project_name(u32 project) - { - switch (project) { - case PRCMU_FW_PROJECT_U8500: -@@ -2758,7 +2758,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size) - INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work); - } - --static void __init init_prcm_registers(void) -+static void init_prcm_registers(void) - { - u32 val; - -diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c -index 3f9f4c874d2a..8d74806b83c1 100644 ---- a/drivers/mfd/mc13xxx-core.c -+++ b/drivers/mfd/mc13xxx-core.c -@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, - - mc13xxx->adcflags |= MC13XXX_ADC_WORKING; - -- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); -+ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); -+ if (ret) -+ goto out; - - adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2; - adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC; -diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c -index a867cc91657e..27486f278201 100644 ---- a/drivers/mfd/qcom_rpm.c -+++ b/drivers/mfd/qcom_rpm.c -@@ -570,6 +570,10 @@ static int qcom_rpm_probe(struct platform_device *pdev) - return -EFAULT; - } - -+ writel(fw_version[0], RPM_CTRL_REG(rpm, 0)); -+ writel(fw_version[1], RPM_CTRL_REG(rpm, 1)); -+ writel(fw_version[2], RPM_CTRL_REG(rpm, 2)); -+ - dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0], - fw_version[1], - fw_version[2]); -diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c -index 4a0f076c91ba..faf8ce5be576 100644 ---- a/drivers/mfd/ti_am335x_tscadc.c -+++ b/drivers/mfd/ti_am335x_tscadc.c -@@ -279,8 +279,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) - cell->pdata_size = sizeof(tscadc); - } - -- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells, -- tscadc->used_cells, NULL, 0, NULL); -+ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, -+ tscadc->cells, tscadc->used_cells, NULL, -+ 0, NULL); - if (err < 0) - goto err_disable_clk; - -diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c -index 831696ee2472..90732a655d57 100644 ---- a/drivers/mfd/twl-core.c -+++ b/drivers/mfd/twl-core.c -@@ -982,7 +982,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base, - * letting it generate the right frequencies for USB, MADC, and - * other purposes. - */ --static inline int __init protect_pm_master(void) -+static inline int protect_pm_master(void) - { - int e = 0; - -@@ -991,7 +991,7 @@ static inline int __init protect_pm_master(void) - return e; - } - --static inline int __init unprotect_pm_master(void) -+static inline int unprotect_pm_master(void) - { - int e = 0; - -diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c -index 2bb2d0467a92..c47efe6dcb01 100644 ---- a/drivers/mfd/wm5110-tables.c -+++ b/drivers/mfd/wm5110-tables.c -@@ -1622,6 +1622,7 @@ static const struct reg_default wm5110_reg_default[] = { - { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ - { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ - { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ -+ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ - { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ - { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ - { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */ -@@ -2877,6 +2878,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg) - case ARIZONA_ASRC_ENABLE: - case ARIZONA_ASRC_STATUS: - case ARIZONA_ASRC_RATE1: -+ case ARIZONA_ASRC_RATE2: - case ARIZONA_ISRC_1_CTRL_1: - case ARIZONA_ISRC_1_CTRL_2: - case ARIZONA_ISRC_1_CTRL_3: -diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c -index aad3243a48fc..e03ec74f3fb0 100644 ---- a/drivers/mmc/host/mmc_spi.c -+++ b/drivers/mmc/host/mmc_spi.c -@@ -1451,6 +1451,7 @@ static int mmc_spi_probe(struct spi_device *spi) - if (status != 0) - goto fail_add_host; - } -+ mmc_detect_change(mmc, 0); - - dev_info(&spi->dev, "SD/MMC host %s%s%s%s%s\n", - dev_name(&mmc->class_dev), -diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c -index 2dea39b5cb0b..e2414f2d7ba9 100644 ---- a/drivers/net/dsa/mv88e6xxx.c -+++ b/drivers/net/dsa/mv88e6xxx.c -@@ -712,7 +712,7 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct dsa_switch *ds, - if (s->sizeof_stat == 8) - _mv88e6xxx_stats_read(ds, s->reg + 1, &high); - } -- value = (((u64)high) << 16) | low; -+ value = (((u64)high) << 32) | low; - return value; - } - -diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c -index 0fb986ba3290..0ae723f75341 100644 ---- a/drivers/net/ethernet/altera/altera_msgdma.c -+++ b/drivers/net/ethernet/altera/altera_msgdma.c -@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) - & 0xffff; - - if (inuse) { /* Tx FIFO is not empty */ -- ready = priv->tx_prod - priv->tx_cons - inuse - 1; -+ ready = max_t(int, -+ priv->tx_prod - priv->tx_cons - inuse - 1, 0); - } else { - /* Check for buffered last packet */ - status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status)); -diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c -index fe644823ceaf..bb51f124d8c7 100644 ---- a/drivers/net/ethernet/altera/altera_tse_main.c -+++ b/drivers/net/ethernet/altera/altera_tse_main.c -@@ -716,8 +716,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) - - phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link, - priv->phy_iface); -- if (IS_ERR(phydev)) -+ if (IS_ERR(phydev)) { - netdev_err(dev, "Could not attach to PHY\n"); -+ phydev = NULL; -+ } - - } else { - int ret; -diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c -index 2ff465848b65..097a0bf592ab 100644 ---- a/drivers/net/ethernet/atheros/atlx/atl2.c -+++ b/drivers/net/ethernet/atheros/atlx/atl2.c -@@ -1338,13 +1338,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - { - struct net_device *netdev; - struct atl2_adapter *adapter; -- static int cards_found; -+ static int cards_found = 0; - unsigned long mmio_start; - int mmio_len; - int err; - -- cards_found = 0; -- - err = pci_enable_device(pdev); - if (err) - return err; -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 143b9a384af8..53b3c1a5851c 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -126,6 +126,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev, - - priv->rx_chk_en = !!(wanted & NETIF_F_RXCSUM); - reg = rxchk_readl(priv, RXCHK_CONTROL); -+ /* Clear L2 header checks, which would prevent BPDUs -+ * from being received. -+ */ -+ reg &= ~RXCHK_L2_HDR_DIS; - if (priv->rx_chk_en) - reg |= RXCHK_EN; - else -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index fea8116da06a..00bd7be85679 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -330,6 +330,12 @@ normal_tx: - } - - length >>= 9; -+ if (unlikely(length >= ARRAY_SIZE(bnxt_lhint_arr))) { -+ dev_warn_ratelimited(&pdev->dev, "Dropped oversize %d bytes TX packet.\n", -+ skb->len); -+ i = 0; -+ goto tx_dma_error; -+ } - flags |= bnxt_lhint_arr[length]; - txbd->tx_bd_len_flags_type = cpu_to_le32(flags); - -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c -index 1a16c0307b47..bd36fbe81ad2 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c -@@ -188,12 +188,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle) - struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle); - int i; - -- vf_cb->mac_cb = NULL; -- -- kfree(vf_cb); -- - for (i = 0; i < handle->q_num; i++) - hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0; -+ -+ kfree(vf_cb); - } - - static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val) -diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c -index 37491c85bc42..6ff13c559e52 100644 ---- a/drivers/net/ethernet/hisilicon/hns_mdio.c -+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c -@@ -319,7 +319,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum) - } - - hns_mdio_cmd_write(mdio_dev, is_c45, -- MDIO_C45_WRITE_ADDR, phy_id, devad); -+ MDIO_C45_READ, phy_id, devad); - } - - /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/ -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 61a9ab4fe047..70b3253e7ed5 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1238,7 +1238,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) - struct iphdr *iph; - u16 mss = 0; - --restart_poll: - while (frames_processed < budget) { - if (!ibmveth_rxq_pending_buffer(adapter)) - break; -@@ -1336,7 +1335,6 @@ restart_poll: - napi_reschedule(napi)) { - lpar_rc = h_vio_signal(adapter->vdev->unit_address, - VIO_IRQ_DISABLE); -- goto restart_poll; - } - } - -diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c -index 4182290fdbcf..82f080a5ed5c 100644 ---- a/drivers/net/ethernet/marvell/mv643xx_eth.c -+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c -@@ -2884,7 +2884,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) - - ret = mv643xx_eth_shared_of_probe(pdev); - if (ret) -- return ret; -+ goto err_put_clk; - pd = dev_get_platdata(&pdev->dev); - - msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ? -@@ -2892,6 +2892,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) - infer_hw_params(msp); - - return 0; -+ -+err_put_clk: -+ if (!IS_ERR(msp->clk)) -+ clk_disable_unprepare(msp->clk); -+ return ret; - } - - static int mv643xx_eth_shared_remove(struct platform_device *pdev) -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 4b97aa24559a..5cc05df69a86 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -46,6 +46,7 @@ - #include - #include - #include -+#include - - #include - -@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128; - module_param(copybreak, int, 0); - MODULE_PARM_DESC(copybreak, "Receive copy threshold"); - --static int disable_msi = 0; -+static int disable_msi = -1; - module_param(disable_msi, int, 0); - MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)"); - -@@ -4923,6 +4924,24 @@ static const char *sky2_name(u8 chipid, char *buf, int sz) - return buf; - } - -+static const struct dmi_system_id msi_blacklist[] = { -+ { -+ .ident = "Dell Inspiron 1545", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1545"), -+ }, -+ }, -+ { -+ .ident = "Gateway P-79", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Gateway"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"), -+ }, -+ }, -+ {} -+}; -+ - static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - { - struct net_device *dev, *dev1; -@@ -5034,6 +5053,9 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - goto err_out_free_pci; - } - -+ if (disable_msi == -1) -+ disable_msi = !!dmi_check_system(msi_blacklist); -+ - if (!disable_msi && pci_enable_msi(pdev) == 0) { - err = sky2_test_msi(hw); - if (err) { -diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c -index fc222df47aa9..9e104dcfa9dd 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c -@@ -2636,6 +2636,7 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev) - down(&priv->cmd.event_sem); - - kfree(priv->cmd.context); -+ priv->cmd.context = NULL; - - up(&priv->cmd.poll_sem); - } -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -index 82bf1b539d87..ac7c64bae2a5 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -@@ -725,13 +725,27 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb, - return 0; - } - #endif -+ -+#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN) -+ - static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va, - netdev_features_t dev_features) - { - __wsum hw_checksum = 0; -+ void *hdr; -+ -+ /* CQE csum doesn't cover padding octets in short ethernet -+ * frames. And the pad field is appended prior to calculating -+ * and appending the FCS field. -+ * -+ * Detecting these padded frames requires to verify and parse -+ * IP headers, so we simply force all those small frames to skip -+ * checksum complete. -+ */ -+ if (short_frame(skb->len)) -+ return -EINVAL; - -- void *hdr = (u8 *)va + sizeof(struct ethhdr); -- -+ hdr = (u8 *)va + sizeof(struct ethhdr); - hw_checksum = csum_unfold((__force __sum16)cqe->checksum); - - if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) && -@@ -851,6 +865,11 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud - (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_L2_TUNNEL)); - - if (likely(dev->features & NETIF_F_RXCSUM)) { -+ /* TODO: For IP non TCP/UDP packets when csum complete is -+ * not an option (not supported or any other reason) we can -+ * actually check cqe IPOK status bit and report -+ * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE -+ */ - if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP | - MLX4_CQE_STATUS_UDP)) { - if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) && -diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -index 7911dc3da98e..37dfdb1329f4 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -@@ -2652,13 +2652,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc) - int total_pages; - int total_mem; - int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f; -+ int tot; - - sq_size = 1 << (log_sq_size + log_sq_sride + 4); - rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4)); - total_mem = sq_size + rq_size; -- total_pages = -- roundup_pow_of_two((total_mem + (page_offset << 6)) >> -- page_shift); -+ tot = (total_mem + (page_offset << 6)) >> page_shift; -+ total_pages = !tot ? 1 : roundup_pow_of_two(tot); - - return total_pages; - } -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index f735dfcb64ae..29d31eb995d7 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -453,7 +453,7 @@ static int ravb_dmac_init(struct net_device *ndev) - ravb_write(ndev, RCR_EFFS | RCR_ENCF | RCR_ETS0 | 0x18000000, RCR); - - /* Set FIFO size */ -- ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00222200, TGC); -+ ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00112200, TGC); - - /* Timestamp enable */ - ravb_write(ndev, TCCR_TFEN, TCCR); -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -index 0cd3ecff768b..398b08e07149 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -@@ -535,8 +535,10 @@ static int rk_gmac_init(struct platform_device *pdev, void *priv) - int ret; - - ret = phy_power_on(bsp_priv, true); -- if (ret) -+ if (ret) { -+ gmac_clk_enable(bsp_priv, false); - return ret; -+ } - - ret = gmac_clk_enable(bsp_priv, true); - if (ret) -diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c -index a9268db4e349..ae02ce17c505 100644 ---- a/drivers/net/ipvlan/ipvlan_main.c -+++ b/drivers/net/ipvlan/ipvlan_main.c -@@ -389,7 +389,12 @@ static int ipvlan_nl_changelink(struct net_device *dev, - struct ipvl_dev *ipvlan = netdev_priv(dev); - struct ipvl_port *port = ipvlan_port_get_rtnl(ipvlan->phy_dev); - -- if (data && data[IFLA_IPVLAN_MODE]) { -+ if (!data) -+ return 0; -+ if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN)) -+ return -EPERM; -+ -+ if (data[IFLA_IPVLAN_MODE]) { - u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]); - - ipvlan_set_port_mode(port, nmode); -@@ -454,6 +459,8 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev, - struct ipvl_dev *tmp = netdev_priv(phy_dev); - - phy_dev = tmp->phy_dev; -+ if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN)) -+ return -EPERM; - } else if (!netif_is_ipvlan_port(phy_dev)) { - err = ipvlan_port_create(phy_dev); - if (err < 0) -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index 88cb4592b6fb..ccefba7af960 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -267,7 +267,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) - err = device_register(&bus->dev); - if (err) { - pr_err("mii_bus %s failed to register\n", bus->id); -- put_device(&bus->dev); - return -EINVAL; - } - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index 920391165f18..ba84fc3637b1 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - /* Operation Mode Strap Override */ - #define MII_KSZPHY_OMSO 0x16 -@@ -287,6 +288,17 @@ static int kszphy_config_init(struct phy_device *phydev) - return 0; - } - -+static int ksz8061_config_init(struct phy_device *phydev) -+{ -+ int ret; -+ -+ ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_DEVID1, 0xB61A); -+ if (ret) -+ return ret; -+ -+ return kszphy_config_init(phydev); -+} -+ - static int ksz9021_load_values_from_of(struct phy_device *phydev, - const struct device_node *of_node, - u16 reg, -@@ -771,7 +783,7 @@ static struct phy_driver ksphy_driver[] = { - .phy_id_mask = 0x00fffff0, - .features = (PHY_BASIC_FEATURES | SUPPORTED_Pause), - .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, -- .config_init = kszphy_config_init, -+ .config_init = ksz8061_config_init, - .config_aneg = genphy_config_aneg, - .read_status = genphy_read_status, - .ack_interrupt = kszphy_ack_interrupt, -diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c -index 12a627fcc02c..53c1f2bd0f24 100644 ---- a/drivers/net/ppp/pptp.c -+++ b/drivers/net/ppp/pptp.c -@@ -577,6 +577,7 @@ static void pptp_sock_destruct(struct sock *sk) - pppox_unbind_sock(sk); - } - skb_queue_purge(&sk->sk_receive_queue); -+ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1)); - } - - static int pptp_create(struct net *net, struct socket *sock, int kern) -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 33ffb573fd67..267a90423154 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -247,17 +247,6 @@ static void __team_option_inst_mark_removed_port(struct team *team, - } - } - --static bool __team_option_inst_tmp_find(const struct list_head *opts, -- const struct team_option_inst *needle) --{ -- struct team_option_inst *opt_inst; -- -- list_for_each_entry(opt_inst, opts, tmp_list) -- if (opt_inst == needle) -- return true; -- return false; --} -- - static int __team_options_register(struct team *team, - const struct team_option *option, - size_t option_count) -@@ -2447,7 +2436,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) - int err = 0; - int i; - struct nlattr *nl_option; -- LIST_HEAD(opt_inst_list); - - team = team_nl_team_get(info); - if (!team) -@@ -2463,6 +2451,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) - struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1]; - struct nlattr *attr; - struct nlattr *attr_data; -+ LIST_HEAD(opt_inst_list); - enum team_option_type opt_type; - int opt_port_ifindex = 0; /* != 0 for per-port options */ - u32 opt_array_index = 0; -@@ -2566,23 +2555,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) - if (err) - goto team_put; - opt_inst->changed = true; -- -- /* dumb/evil user-space can send us duplicate opt, -- * keep only the last one -- */ -- if (__team_option_inst_tmp_find(&opt_inst_list, -- opt_inst)) -- continue; -- - list_add(&opt_inst->tmp_list, &opt_inst_list); - } - if (!opt_found) { - err = -ENOENT; - goto team_put; - } -- } - -- err = team_nl_send_event_options_get(team, &opt_inst_list); -+ err = team_nl_send_event_options_get(team, &opt_inst_list); -+ if (err) -+ break; -+ } - - team_put: - team_nl_team_put(team); -diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c -index a1536d0d83a9..a00335b3786e 100644 ---- a/drivers/net/team/team_mode_loadbalance.c -+++ b/drivers/net/team/team_mode_loadbalance.c -@@ -305,6 +305,20 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx) - return 0; - } - -+static void lb_bpf_func_free(struct team *team) -+{ -+ struct lb_priv *lb_priv = get_lb_priv(team); -+ struct bpf_prog *fp; -+ -+ if (!lb_priv->ex->orig_fprog) -+ return; -+ -+ __fprog_destroy(lb_priv->ex->orig_fprog); -+ fp = rcu_dereference_protected(lb_priv->fp, -+ lockdep_is_held(&team->lock)); -+ bpf_prog_destroy(fp); -+} -+ - static int lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx) - { - struct lb_priv *lb_priv = get_lb_priv(team); -@@ -619,6 +633,7 @@ static void lb_exit(struct team *team) - - team_options_unregister(team, lb_options, - ARRAY_SIZE(lb_options)); -+ lb_bpf_func_free(team); - cancel_delayed_work_sync(&lb_priv->ex->stats.refresh_dw); - free_percpu(lb_priv->pcpu_stats); - kfree(lb_priv->ex); -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 553908adf3c5..5dadfc508ade 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -1229,6 +1229,14 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb, - } - } - -+ rcu_read_lock(); -+ -+ if (unlikely(!(vxlan->dev->flags & IFF_UP))) { -+ rcu_read_unlock(); -+ atomic_long_inc(&vxlan->dev->rx_dropped); -+ goto drop; -+ } -+ - stats = this_cpu_ptr(vxlan->dev->tstats); - u64_stats_update_begin(&stats->syncp); - stats->rx_packets++; -@@ -1237,6 +1245,8 @@ static void vxlan_rcv(struct vxlan_sock *vs, struct sk_buff *skb, - - gro_cells_receive(&vxlan->gro_cells, skb); - -+ rcu_read_unlock(); -+ - return; - drop: - if (tun_dst) -@@ -2312,6 +2322,8 @@ static void vxlan_uninit(struct net_device *dev) - { - struct vxlan_dev *vxlan = netdev_priv(dev); - -+ gro_cells_destroy(&vxlan->gro_cells); -+ - vxlan_fdb_delete_default(vxlan); - - free_percpu(dev->tstats); -@@ -3056,7 +3068,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head) - { - struct vxlan_dev *vxlan = netdev_priv(dev); - -- gro_cells_destroy(&vxlan->gro_cells); - list_del(&vxlan->next); - unregister_netdevice_queue(dev, head); - } -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 0d1abcfec003..0f582117b0e3 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -3002,7 +3002,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) - goto out_err; - } - -- genlmsg_reply(skb, info); -+ res = genlmsg_reply(skb, info); - break; - } - -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 02db20b26749..d324ac308e6d 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -1538,11 +1538,6 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s - skb_frag_size_set(&frags[i], len); - } - -- /* Copied all the bits from the frag list -- free it. */ -- skb_frag_list_init(skb); -- xenvif_skb_zerocopy_prepare(queue, nskb); -- kfree_skb(nskb); -- - /* Release all the original (foreign) frags. */ - for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) - skb_frag_unref(skb, f); -@@ -1611,6 +1606,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) - xenvif_fill_frags(queue, skb); - - if (unlikely(skb_has_frag_list(skb))) { -+ struct sk_buff *nskb = skb_shinfo(skb)->frag_list; -+ xenvif_skb_zerocopy_prepare(queue, nskb); - if (xenvif_handle_frag_list(queue, skb)) { - if (net_ratelimit()) - netdev_err(queue->vif->dev, -@@ -1619,6 +1616,9 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) - kfree_skb(skb); - continue; - } -+ /* Copied all the bits from the frag list -- free it. */ -+ skb_frag_list_init(skb); -+ kfree_skb(nskb); - } - - skb->dev = queue->vif->dev; -diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c -index bdce0679674c..02e6485c1ed5 100644 ---- a/drivers/parport/parport_pc.c -+++ b/drivers/parport/parport_pc.c -@@ -1377,7 +1377,7 @@ static struct superio_struct *find_superio(struct parport *p) - { - int i; - for (i = 0; i < NR_SUPERIOS; i++) -- if (superios[i].io != p->base) -+ if (superios[i].io == p->base) - return &superios[i]; - return NULL; - } -diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c -index b505b87661f8..07c4153e6f3d 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson8b.c -+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c -@@ -656,7 +656,7 @@ static const char * const sd_a_groups[] = { - - static const char * const sdxc_a_groups[] = { - "sdxc_d0_0_a", "sdxc_d13_0_a", "sdxc_d47_a", "sdxc_clk_a", -- "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d0_13_1_a" -+ "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d13_1_a" - }; - - static const char * const pcm_a_groups[] = { -diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig -index 988ebe9a6b90..953974b5a9a9 100644 ---- a/drivers/platform/x86/Kconfig -+++ b/drivers/platform/x86/Kconfig -@@ -881,6 +881,7 @@ config INTEL_OAKTRAIL - config SAMSUNG_Q10 - tristate "Samsung Q10 Extras" - depends on ACPI -+ depends on BACKLIGHT_LCD_SUPPORT - select BACKLIGHT_CLASS_DEVICE - ---help--- - This driver provides support for backlight control on Samsung Q10 -diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c -index 92f88753bfed..2daf751c26c7 100644 ---- a/drivers/regulator/s2mpa01.c -+++ b/drivers/regulator/s2mpa01.c -@@ -303,13 +303,13 @@ static const struct regulator_desc regulators[] = { - regulator_desc_ldo(2, STEP_50_MV), - regulator_desc_ldo(3, STEP_50_MV), - regulator_desc_ldo(4, STEP_50_MV), -- regulator_desc_ldo(5, STEP_50_MV), -+ regulator_desc_ldo(5, STEP_25_MV), - regulator_desc_ldo(6, STEP_25_MV), - regulator_desc_ldo(7, STEP_50_MV), - regulator_desc_ldo(8, STEP_50_MV), - regulator_desc_ldo(9, STEP_50_MV), - regulator_desc_ldo(10, STEP_50_MV), -- regulator_desc_ldo(11, STEP_25_MV), -+ regulator_desc_ldo(11, STEP_50_MV), - regulator_desc_ldo(12, STEP_50_MV), - regulator_desc_ldo(13, STEP_50_MV), - regulator_desc_ldo(14, STEP_50_MV), -@@ -320,11 +320,11 @@ static const struct regulator_desc regulators[] = { - regulator_desc_ldo(19, STEP_50_MV), - regulator_desc_ldo(20, STEP_50_MV), - regulator_desc_ldo(21, STEP_50_MV), -- regulator_desc_ldo(22, STEP_25_MV), -- regulator_desc_ldo(23, STEP_25_MV), -+ regulator_desc_ldo(22, STEP_50_MV), -+ regulator_desc_ldo(23, STEP_50_MV), - regulator_desc_ldo(24, STEP_50_MV), - regulator_desc_ldo(25, STEP_50_MV), -- regulator_desc_ldo(26, STEP_50_MV), -+ regulator_desc_ldo(26, STEP_25_MV), - regulator_desc_buck1_4(1), - regulator_desc_buck1_4(2), - regulator_desc_buck1_4(3), -diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c -index b6d831b84e1d..47694dd515ab 100644 ---- a/drivers/regulator/s2mps11.c -+++ b/drivers/regulator/s2mps11.c -@@ -372,7 +372,7 @@ static const struct regulator_desc s2mps11_regulators[] = { - regulator_desc_s2mps11_ldo(32, STEP_50_MV), - regulator_desc_s2mps11_ldo(33, STEP_50_MV), - regulator_desc_s2mps11_ldo(34, STEP_50_MV), -- regulator_desc_s2mps11_ldo(35, STEP_50_MV), -+ regulator_desc_s2mps11_ldo(35, STEP_25_MV), - regulator_desc_s2mps11_ldo(36, STEP_50_MV), - regulator_desc_s2mps11_ldo(37, STEP_50_MV), - regulator_desc_s2mps11_ldo(38, STEP_50_MV), -@@ -382,8 +382,8 @@ static const struct regulator_desc s2mps11_regulators[] = { - regulator_desc_s2mps11_buck1_4(4), - regulator_desc_s2mps11_buck5, - regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_6_25_MV), -+ regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV), -+ regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV), - regulator_desc_s2mps11_buck9, - regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), - }; -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index dac2f6883e28..80a43074c2f9 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -4023,6 +4023,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) - usrparm.psf_data &= 0x7fffffffULL; - usrparm.rssd_result &= 0x7fffffffULL; - } -+ /* at least 2 bytes are accessed and should be allocated */ -+ if (usrparm.psf_data_len < 2) { -+ DBF_DEV_EVENT(DBF_WARNING, device, -+ "Symmetrix ioctl invalid data length %d", -+ usrparm.psf_data_len); -+ rc = -EINVAL; -+ goto out; -+ } - /* alloc I/O data area */ - psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); - rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA); -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index 533bd2467910..b40604d0126f 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -2452,11 +2452,12 @@ out: - return rc; - } - --static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q) -+static void qeth_free_output_queue(struct qeth_qdio_out_q *q) - { - if (!q) - return; - -+ qeth_clear_outq_buffers(q, 1); - qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q); - kfree(q); - } -@@ -2529,10 +2530,8 @@ out_freeoutqbufs: - card->qdio.out_qs[i]->bufs[j] = NULL; - } - out_freeoutq: -- while (i > 0) { -- qeth_free_qdio_out_buf(card->qdio.out_qs[--i]); -- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1); -- } -+ while (i > 0) -+ qeth_free_output_queue(card->qdio.out_qs[--i]); - kfree(card->qdio.out_qs); - card->qdio.out_qs = NULL; - out_freepool: -@@ -2565,10 +2564,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card) - qeth_free_buffer_pool(card); - /* free outbound qdio_qs */ - if (card->qdio.out_qs) { -- for (i = 0; i < card->qdio.no_out_queues; ++i) { -- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1); -- qeth_free_qdio_out_buf(card->qdio.out_qs[i]); -- } -+ for (i = 0; i < card->qdio.no_out_queues; i++) -+ qeth_free_output_queue(card->qdio.out_qs[i]); - kfree(card->qdio.out_qs); - card->qdio.out_qs = NULL; - } -diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c -index ff06bdfd2b20..2bb275fb39d1 100644 ---- a/drivers/s390/virtio/virtio_ccw.c -+++ b/drivers/s390/virtio/virtio_ccw.c -@@ -283,6 +283,8 @@ static void virtio_ccw_drop_indicators(struct virtio_ccw_device *vcdev) - { - struct virtio_ccw_vq_info *info; - -+ if (!vcdev->airq_info) -+ return; - list_for_each_entry(info, &vcdev->virtqueues, node) - drop_airq_indicator(info->vq, vcdev->airq_info); - } -@@ -423,7 +425,7 @@ static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev, - ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF); - if (ret) - return ret; -- return vcdev->config_block->num; -+ return vcdev->config_block->num ?: -ENOENT; - } - - static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw) -diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c -index 2d1c4ebd40f9..6587f20cff1a 100644 ---- a/drivers/scsi/csiostor/csio_attr.c -+++ b/drivers/scsi/csiostor/csio_attr.c -@@ -582,12 +582,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) - } - - fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); -+ ln->fc_vport = fc_vport; - - if (csio_fcoe_alloc_vnp(hw, ln)) - goto error; - - *(struct csio_lnode **)fc_vport->dd_data = ln; -- ln->fc_vport = fc_vport; - if (!fc_vport->node_name) - fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); - if (!fc_vport->port_name) -diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c -index 77128d680e3b..6f38fa1f468a 100644 ---- a/drivers/scsi/isci/init.c -+++ b/drivers/scsi/isci/init.c -@@ -595,6 +595,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) - shost->max_lun = ~0; - shost->max_cmd_len = MAX_COMMAND_SIZE; - -+ /* turn on DIF support */ -+ scsi_host_set_prot(shost, -+ SHOST_DIF_TYPE1_PROTECTION | -+ SHOST_DIF_TYPE2_PROTECTION | -+ SHOST_DIF_TYPE3_PROTECTION); -+ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC); -+ - err = scsi_add_host(shost, &pdev->dev); - if (err) - goto err_shost; -@@ -682,13 +689,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - goto err_host_alloc; - } - pci_info->hosts[i] = h; -- -- /* turn on DIF support */ -- scsi_host_set_prot(to_shost(h), -- SHOST_DIF_TYPE1_PROTECTION | -- SHOST_DIF_TYPE2_PROTECTION | -- SHOST_DIF_TYPE3_PROTECTION); -- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC); - } - - err = isci_setup_interrupts(pdev); -diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c -index e01a29863c38..867fc036d6ef 100644 ---- a/drivers/scsi/libfc/fc_lport.c -+++ b/drivers/scsi/libfc/fc_lport.c -@@ -1739,14 +1739,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, - fc_frame_payload_op(fp) != ELS_LS_ACC) { - FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n"); - fc_lport_error(lport, fp); -- goto err; -+ goto out; - } - - flp = fc_frame_payload_get(fp, sizeof(*flp)); - if (!flp) { - FC_LPORT_DBG(lport, "FLOGI bad response\n"); - fc_lport_error(lport, fp); -- goto err; -+ goto out; - } - - mfs = ntohs(flp->fl_csp.sp_bb_data) & -@@ -1756,7 +1756,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, - FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, " - "lport->mfs:%hu\n", mfs, lport->mfs); - fc_lport_error(lport, fp); -- goto err; -+ goto out; - } - - if (mfs <= lport->mfs) { -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index 009a2ef829d6..0fdc8c417035 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -1448,7 +1448,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn) - if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) - return -ENODATA; - -+ spin_lock_bh(&conn->session->back_lock); -+ if (conn->task == NULL) { -+ spin_unlock_bh(&conn->session->back_lock); -+ return -ENODATA; -+ } - __iscsi_get_task(task); -+ spin_unlock_bh(&conn->session->back_lock); - spin_unlock_bh(&conn->session->frwd_lock); - rc = conn->session->tt->xmit_task(task); - spin_lock_bh(&conn->session->frwd_lock); -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 12886f96b286..7be581f7c35d 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -818,6 +818,7 @@ static struct domain_device *sas_ex_discover_end_dev( - rphy = sas_end_device_alloc(phy->port); - if (!rphy) - goto out_free; -+ rphy->identify.phy_identifier = phy_id; - - child->rphy = rphy; - get_device(&rphy->dev); -@@ -845,6 +846,7 @@ static struct domain_device *sas_ex_discover_end_dev( - - child->rphy = rphy; - get_device(&rphy->dev); -+ rphy->identify.phy_identifier = phy_id; - sas_fill_in_rphy(child, rphy); - - list_add_tail(&child->disco_list_node, &parent->port->disco_list); -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index d8c03431d0aa..f9f899ec9427 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -7245,6 +7245,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, - - rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn, - fw_ddb_entry); -+ if (rc) -+ goto free_sess; - - ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n", - __func__, fnode_sess->dev.kobj.name); -diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c -index 8ef905cbfc9c..9237427728ce 100644 ---- a/drivers/scsi/virtio_scsi.c -+++ b/drivers/scsi/virtio_scsi.c -@@ -692,7 +692,6 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc) - return FAILED; - - memset(cmd, 0, sizeof(*cmd)); -- cmd->sc = sc; - cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ - .type = VIRTIO_SCSI_T_TMF, - .subtype = cpu_to_virtio32(vscsi->vdev, -@@ -751,7 +750,6 @@ static int virtscsi_abort(struct scsi_cmnd *sc) - return FAILED; - - memset(cmd, 0, sizeof(*cmd)); -- cmd->sc = sc; - cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){ - .type = VIRTIO_SCSI_T_TMF, - .subtype = VIRTIO_SCSI_T_TMF_ABORT_TASK, -diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c -index ecfe73302350..46a24b4ead09 100644 ---- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c -+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c -@@ -2621,8 +2621,8 @@ ksocknal_enumerate_interfaces(ksock_net_t *net) - - net->ksnn_interfaces[j].ksni_ipaddr = ip; - net->ksnn_interfaces[j].ksni_netmask = mask; -- strncpy(&net->ksnn_interfaces[j].ksni_name[0], -- names[i], IFNAMSIZ); -+ strlcpy(net->ksnn_interfaces[j].ksni_name, -+ names[i], sizeof(net->ksnn_interfaces[j].ksni_name)); - j++; - } - -@@ -2805,8 +2805,9 @@ ksocknal_startup(lnet_ni_t *ni) - goto fail_1; - } - -- strncpy(&net->ksnn_interfaces[i].ksni_name[0], -- ni->ni_interfaces[i], IFNAMSIZ); -+ strlcpy(net->ksnn_interfaces[i].ksni_name, -+ ni->ni_interfaces[i], -+ sizeof(net->ksnn_interfaces[i].ksni_name)); - } - net->ksnn_ninterfaces = i; - } -diff --git a/drivers/staging/lustre/lnet/lnet/config.c b/drivers/staging/lustre/lnet/lnet/config.c -index 1b3bc8386524..75f120da0a84 100644 ---- a/drivers/staging/lustre/lnet/lnet/config.c -+++ b/drivers/staging/lustre/lnet/lnet/config.c -@@ -650,8 +650,8 @@ lnet_parse_route(char *str, int *im_a_router) - INIT_LIST_HEAD(&nets); - - /* save a copy of the string for error messages */ -- strncpy(cmd, str, sizeof(cmd) - 1); -- cmd[sizeof(cmd) - 1] = 0; -+ strncpy(cmd, str, sizeof(cmd)); -+ cmd[sizeof(cmd) - 1] = '\0'; - - sep = str; - for (;;) { -@@ -972,11 +972,13 @@ lnet_splitnets(char *source, struct list_head *nets) - return 0; - - offset += (int)(sep - tb->ltb_text); -- tb2 = lnet_new_text_buf(strlen(sep)); -+ len = strlen(sep); -+ tb2 = lnet_new_text_buf(len); - if (tb2 == NULL) - return -ENOMEM; - -- strcpy(tb2->ltb_text, sep); -+ strncpy(tb2->ltb_text, sep, len); -+ tb2->ltb_text[len] = '\0'; - list_add_tail(&tb2->ltb_list, nets); - - tb = tb2; -@@ -1021,8 +1023,8 @@ lnet_match_networks(char **networksp, char *ip2nets, __u32 *ipaddrs, int nip) - tb = list_entry(raw_entries.next, struct lnet_text_buf_t, - ltb_list); - -- strncpy(source, tb->ltb_text, sizeof(source)-1); -- source[sizeof(source)-1] = 0; -+ strncpy(source, tb->ltb_text, sizeof(source)); -+ source[sizeof(source)-1] = '\0'; - - /* replace ltb_text with the network(s) add on match */ - rc = lnet_match_network_tokens(tb->ltb_text, ipaddrs, nip); -diff --git a/drivers/staging/lustre/lnet/selftest/conrpc.c b/drivers/staging/lustre/lnet/selftest/conrpc.c -index 64a0335934f3..1066c70434b1 100644 ---- a/drivers/staging/lustre/lnet/selftest/conrpc.c -+++ b/drivers/staging/lustre/lnet/selftest/conrpc.c -@@ -612,8 +612,8 @@ lstcon_sesrpc_prep(lstcon_node_t *nd, int transop, - msrq = &(*crpc)->crp_rpc->crpc_reqstmsg.msg_body.mksn_reqst; - msrq->mksn_sid = console_session.ses_id; - msrq->mksn_force = console_session.ses_force; -- strncpy(msrq->mksn_name, console_session.ses_name, -- strlen(console_session.ses_name)); -+ strlcpy(msrq->mksn_name, console_session.ses_name, -+ sizeof(msrq->mksn_name)); - break; - - case LST_TRANS_SESEND: -diff --git a/drivers/staging/lustre/lnet/selftest/console.c b/drivers/staging/lustre/lnet/selftest/console.c -index d315dd44ae3b..ed1bc6ac79dd 100644 ---- a/drivers/staging/lustre/lnet/selftest/console.c -+++ b/drivers/staging/lustre/lnet/selftest/console.c -@@ -1739,7 +1739,8 @@ lstcon_session_new(char *name, int key, unsigned feats, - console_session.ses_feats_updated = 0; - console_session.ses_timeout = (timeout <= 0) ? - LST_CONSOLE_TIMEOUT : timeout; -- strcpy(console_session.ses_name, name); -+ strlcpy(console_session.ses_name, name, -+ sizeof(console_session.ses_name)); - - rc = lstcon_batch_add(LST_DEFAULT_BATCH); - if (rc != 0) -@@ -1959,7 +1960,8 @@ lstcon_acceptor_handle(srpc_server_rpc_t *rpc) - if (grp->grp_userland == 0) - grp->grp_userland = 1; - -- strcpy(jrep->join_session, console_session.ses_name); -+ strlcpy(jrep->join_session, console_session.ses_name, -+ sizeof(jrep->join_session)); - jrep->join_timeout = console_session.ses_timeout; - jrep->join_status = 0; - -diff --git a/drivers/staging/lustre/lustre/include/lustre_disk.h b/drivers/staging/lustre/lustre/include/lustre_disk.h -index 5e1ac129a681..7c6933ffc9c1 100644 ---- a/drivers/staging/lustre/lustre/include/lustre_disk.h -+++ b/drivers/staging/lustre/lustre/include/lustre_disk.h -@@ -68,6 +68,7 @@ - everything as string options */ - - #define LMD_MAGIC 0xbdacbd03 -+#define LMD_PARAMS_MAXLEN 4096 - - /* gleaned from the mount command - no persistent info here */ - struct lustre_mount_data { -diff --git a/drivers/staging/lustre/lustre/libcfs/debug.c b/drivers/staging/lustre/lustre/libcfs/debug.c -index 1d1c67164418..170775bc7bc0 100644 ---- a/drivers/staging/lustre/lustre/libcfs/debug.c -+++ b/drivers/staging/lustre/lustre/libcfs/debug.c -@@ -512,9 +512,9 @@ int libcfs_debug_init(unsigned long bufsize) - } - - if (libcfs_debug_file_path != NULL) { -- strncpy(libcfs_debug_file_path_arr, -- libcfs_debug_file_path, PATH_MAX-1); -- libcfs_debug_file_path_arr[PATH_MAX - 1] = '\0'; -+ strlcpy(libcfs_debug_file_path_arr, -+ libcfs_debug_file_path, -+ sizeof(libcfs_debug_file_path_arr)); - } - - /* If libcfs_debug_mb is set to an invalid value or uninitialized -diff --git a/drivers/staging/lustre/lustre/libcfs/hash.c b/drivers/staging/lustre/lustre/libcfs/hash.c -index 030874428952..55fc2190a5bb 100644 ---- a/drivers/staging/lustre/lustre/libcfs/hash.c -+++ b/drivers/staging/lustre/lustre/libcfs/hash.c -@@ -1062,8 +1062,7 @@ cfs_hash_create(char *name, unsigned cur_bits, unsigned max_bits, - if (hs == NULL) - return NULL; - -- strncpy(hs->hs_name, name, len); -- hs->hs_name[len - 1] = '\0'; -+ strlcpy(hs->hs_name, name, len); - hs->hs_flags = flags; - - atomic_set(&hs->hs_refcount, 1); -diff --git a/drivers/staging/lustre/lustre/libcfs/workitem.c b/drivers/staging/lustre/lustre/libcfs/workitem.c -index e1143a566ac4..f6cc434af756 100644 ---- a/drivers/staging/lustre/lustre/libcfs/workitem.c -+++ b/drivers/staging/lustre/lustre/libcfs/workitem.c -@@ -360,8 +360,8 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab, - if (sched == NULL) - return -ENOMEM; - -- strncpy(sched->ws_name, name, CFS_WS_NAME_LEN); -- sched->ws_name[CFS_WS_NAME_LEN - 1] = '\0'; -+ strlcpy(sched->ws_name, name, CFS_WS_NAME_LEN); -+ - sched->ws_cptab = cptab; - sched->ws_cpt = cpt; - -diff --git a/drivers/staging/lustre/lustre/llite/dir.c b/drivers/staging/lustre/lustre/llite/dir.c -index 5c9502b5b358..951259a98323 100644 ---- a/drivers/staging/lustre/lustre/llite/dir.c -+++ b/drivers/staging/lustre/lustre/llite/dir.c -@@ -641,7 +641,7 @@ static int ll_send_mgc_param(struct obd_export *mgc, char *string) - if (!msp) - return -ENOMEM; - -- strncpy(msp->mgs_param, string, MGS_PARAM_MAXLEN); -+ strlcpy(msp->mgs_param, string, sizeof(msp->mgs_param)); - rc = obd_set_info_async(NULL, mgc, sizeof(KEY_SET_INFO), KEY_SET_INFO, - sizeof(struct mgs_send_param), msp, NULL); - if (rc) -diff --git a/drivers/staging/lustre/lustre/lov/lov_pool.c b/drivers/staging/lustre/lustre/lov/lov_pool.c -index b03827ef6514..b43ce6cd64c2 100644 ---- a/drivers/staging/lustre/lustre/lov/lov_pool.c -+++ b/drivers/staging/lustre/lustre/lov/lov_pool.c -@@ -412,8 +412,7 @@ int lov_pool_new(struct obd_device *obd, char *poolname) - if (!new_pool) - return -ENOMEM; - -- strncpy(new_pool->pool_name, poolname, LOV_MAXPOOLNAME); -- new_pool->pool_name[LOV_MAXPOOLNAME] = '\0'; -+ strlcpy(new_pool->pool_name, poolname, sizeof(new_pool->pool_name)); - new_pool->pool_lobd = obd; - /* ref count init to 1 because when created a pool is always used - * up to deletion -diff --git a/drivers/staging/lustre/lustre/obdclass/obd_mount.c b/drivers/staging/lustre/lustre/obdclass/obd_mount.c -index 48003d5325e3..7617c57d16e0 100644 ---- a/drivers/staging/lustre/lustre/obdclass/obd_mount.c -+++ b/drivers/staging/lustre/lustre/obdclass/obd_mount.c -@@ -892,7 +892,7 @@ static int lmd_parse(char *options, struct lustre_mount_data *lmd) - } - lmd->lmd_magic = LMD_MAGIC; - -- lmd->lmd_params = kzalloc(4096, GFP_NOFS); -+ lmd->lmd_params = kzalloc(LMD_PARAMS_MAXLEN, GFP_NOFS); - if (!lmd->lmd_params) - return -ENOMEM; - lmd->lmd_params[0] = '\0'; -@@ -978,7 +978,7 @@ static int lmd_parse(char *options, struct lustre_mount_data *lmd) - goto invalid; - clear++; - } else if (strncmp(s1, "param=", 6) == 0) { -- int length; -+ size_t length, params_length; - char *tail = strchr(s1 + 6, ','); - - if (tail == NULL) -@@ -986,8 +986,12 @@ static int lmd_parse(char *options, struct lustre_mount_data *lmd) - else - length = tail - s1; - length -= 6; -+ params_length = strlen(lmd->lmd_params); -+ if (params_length + length + 1 >= LMD_PARAMS_MAXLEN) -+ return -E2BIG; - strncat(lmd->lmd_params, s1 + 6, length); -- strcat(lmd->lmd_params, " "); -+ lmd->lmd_params[params_length + length] = '\0'; -+ strlcat(lmd->lmd_params, " ", LMD_PARAMS_MAXLEN); - clear++; - } else if (strncmp(s1, "osd=", 4) == 0) { - rc = lmd_parse_string(&lmd->lmd_osd_type, s1 + 4); -diff --git a/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c b/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c -index ce036a1ac466..ac87aa12bd7e 100644 ---- a/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c -+++ b/drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c -@@ -422,6 +422,7 @@ static int ptlrpcd(void *arg) - complete(&pc->pc_starting); - - /* -+ - * This mainloop strongly resembles ptlrpc_set_wait() except that our - * set never completes. ptlrpcd_check() calls ptlrpc_check_set() when - * there are requests in the set. New requests come in on the set's -diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec_config.c b/drivers/staging/lustre/lustre/ptlrpc/sec_config.c -index 7ff948fe1424..7a206705865b 100644 ---- a/drivers/staging/lustre/lustre/ptlrpc/sec_config.c -+++ b/drivers/staging/lustre/lustre/ptlrpc/sec_config.c -@@ -83,8 +83,7 @@ int sptlrpc_parse_flavor(const char *str, struct sptlrpc_flavor *flvr) - return 0; - } - -- strncpy(buf, str, sizeof(buf)); -- buf[sizeof(buf) - 1] = '\0'; -+ strlcpy(buf, str, sizeof(buf)); - - bulk = strchr(buf, '-'); - if (bulk) -diff --git a/drivers/staging/rdma/hfi1/ud.c b/drivers/staging/rdma/hfi1/ud.c -index 5a9c784bec04..a88e37444be0 100644 ---- a/drivers/staging/rdma/hfi1/ud.c -+++ b/drivers/staging/rdma/hfi1/ud.c -@@ -793,7 +793,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet) - opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { - wc.ex.imm_data = ohdr->u.ud.imm_data; - wc.wc_flags = IB_WC_WITH_IMM; -- tlen -= sizeof(u32); - } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { - wc.ex.imm_data = 0; - wc.wc_flags = 0; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 58fe27705b96..cbb4414edd71 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4232,9 +4232,9 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) - struct se_cmd *se_cmd = &cmd->se_cmd; - - if (se_cmd->se_tfo != NULL) { -- spin_lock(&se_cmd->t_state_lock); -+ spin_lock_irq(&se_cmd->t_state_lock); - se_cmd->transport_state |= CMD_T_FABRIC_STOP; -- spin_unlock(&se_cmd->t_state_lock); -+ spin_unlock_irq(&se_cmd->t_state_lock); - } - } - spin_unlock_bh(&conn->cmd_lock); -diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c -index ccc0ad02d066..7f374ab5b176 100644 ---- a/drivers/thermal/int340x_thermal/processor_thermal_device.c -+++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c -@@ -363,7 +363,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, - proc_priv->soc_dts = intel_soc_dts_iosf_init( - INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0); - -- if (proc_priv->soc_dts && pdev->irq) { -+ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) { - ret = pci_enable_msi(pdev); - if (!ret) { - ret = request_threaded_irq(pdev->irq, NULL, -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 746c76b358a0..b032add92722 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -2326,6 +2326,111 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = { - .setup = pci_default_setup, - .exit = pci_plx9050_exit, - }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, -+ { -+ .vendor = PCI_VENDOR_ID_ACCESIO, -+ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, -+ .subvendor = PCI_ANY_ID, -+ .subdevice = PCI_ANY_ID, -+ .setup = pci_pericom_setup, -+ }, - /* - * SBS Technologies, Inc., PMC-OCTALPRO 232 - */ -@@ -5176,10 +5281,10 @@ static struct pci_device_id serial_pci_tbl[] = { - */ - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, -@@ -5188,10 +5293,10 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, -@@ -5200,10 +5305,10 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, -@@ -5212,13 +5317,13 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7951 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, -@@ -5227,16 +5332,16 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7954 }, -@@ -5245,13 +5350,13 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7954 }, -+ pbn_pericom_PI7C9X7952 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7958 }, -+ pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7958 }, -+ pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7958 }, -@@ -5260,19 +5365,19 @@ static struct pci_device_id serial_pci_tbl[] = { - pbn_pericom_PI7C9X7958 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7958 }, -+ pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7958 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7958 }, -+ pbn_pericom_PI7C9X7954 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_pericom_PI7C9X7958 }, - { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM, - PCI_ANY_ID, PCI_ANY_ID, 0, 0, -- pbn_pericom_PI7C9X7958 }, -+ pbn_pericom_PI7C9X7954 }, - /* - * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke) - */ -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 8b5ec9386f0f..1544a7cc76ff 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -1409,7 +1409,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, - } - - /* ask the core to calculate the divisor */ -- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16); -+ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4); - - spin_lock_irqsave(&sport->port.lock, flags); - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index b6037a0ae829..557f08adf644 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1676,6 +1676,7 @@ static int dwc3_gadget_start(struct usb_gadget *g, - - /* begin to receive SETUP packets */ - dwc->ep0state = EP0_SETUP_PHASE; -+ dwc->link_state = DWC3_LINK_STATE_SS_DIS; - dwc3_ep0_out_start(dwc); - - dwc3_gadget_enable_irq(dwc); -diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c -index 67b243989938..d7d095781be1 100644 ---- a/drivers/usb/gadget/function/f_sourcesink.c -+++ b/drivers/usb/gadget/function/f_sourcesink.c -@@ -849,7 +849,7 @@ static struct usb_function *source_sink_alloc_func( - - ss = kzalloc(sizeof(*ss), GFP_KERNEL); - if (!ss) -- return NULL; -+ return ERR_PTR(-ENOMEM); - - ss_opts = container_of(fi, struct f_ss_opts, func_inst); - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 97382301c393..b317594a6342 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -57,6 +57,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ - { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ - { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ -+ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ - { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ - { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ - { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 3e5b189a79b4..4287e2b1c175 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1020,6 +1020,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, - { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, - { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, -+ /* EZPrototypes devices */ -+ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 76a10b222ff9..ddf5ab983dc9 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1307,6 +1307,12 @@ - #define IONICS_VID 0x1c0c - #define IONICS_PLUGCOMPUTER_PID 0x0102 - -+/* -+ * EZPrototypes (PID reseller) -+ */ -+#define EZPROTOTYPES_VID 0x1c40 -+#define HJELMSLUND_USB485_ISO_PID 0x0477 -+ - /* - * Dresden Elektronik Sensor Terminal Board - */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 7bc2c9fef605..b2b7c12e5c86 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1147,6 +1147,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), - .driver_info = NCTRL(0) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ -+ .driver_info = NCTRL(0) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -diff --git a/fs/9p/cache.c b/fs/9p/cache.c -index a69260f27555..103ca5e1267b 100644 ---- a/fs/9p/cache.c -+++ b/fs/9p/cache.c -@@ -243,14 +243,14 @@ void v9fs_cache_inode_set_cookie(struct inode *inode, struct file *filp) - if (!v9inode->fscache) - return; - -- spin_lock(&v9inode->fscache_lock); -+ mutex_lock(&v9inode->fscache_lock); - - if ((filp->f_flags & O_ACCMODE) != O_RDONLY) - v9fs_cache_inode_flush_cookie(inode); - else - v9fs_cache_inode_get_cookie(inode); - -- spin_unlock(&v9inode->fscache_lock); -+ mutex_unlock(&v9inode->fscache_lock); - } - - void v9fs_cache_inode_reset_cookie(struct inode *inode) -@@ -264,7 +264,7 @@ void v9fs_cache_inode_reset_cookie(struct inode *inode) - - old = v9inode->fscache; - -- spin_lock(&v9inode->fscache_lock); -+ mutex_lock(&v9inode->fscache_lock); - fscache_relinquish_cookie(v9inode->fscache, 1); - - v9ses = v9fs_inode2v9ses(inode); -@@ -274,7 +274,7 @@ void v9fs_cache_inode_reset_cookie(struct inode *inode) - p9_debug(P9_DEBUG_FSC, "inode %p revalidating cookie old %p new %p\n", - inode, old, v9inode->fscache); - -- spin_unlock(&v9inode->fscache_lock); -+ mutex_unlock(&v9inode->fscache_lock); - } - - int __v9fs_fscache_release_page(struct page *page, gfp_t gfp) -diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h -index 0923f2cf3c80..6877050384a1 100644 ---- a/fs/9p/v9fs.h -+++ b/fs/9p/v9fs.h -@@ -123,7 +123,7 @@ struct v9fs_session_info { - - struct v9fs_inode { - #ifdef CONFIG_9P_FSCACHE -- spinlock_t fscache_lock; -+ struct mutex fscache_lock; - struct fscache_cookie *fscache; - #endif - struct p9_qid qid; -diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h -index 5a0db6dec8d1..aaee1e6584e6 100644 ---- a/fs/9p/v9fs_vfs.h -+++ b/fs/9p/v9fs_vfs.h -@@ -40,6 +40,9 @@ - */ - #define P9_LOCK_TIMEOUT (30*HZ) - -+/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */ -+#define V9FS_STAT2INODE_KEEP_ISIZE 1 -+ - extern struct file_system_type v9fs_fs_type; - extern const struct address_space_operations v9fs_addr_operations; - extern const struct file_operations v9fs_file_operations; -@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses, - struct inode *inode, umode_t mode, dev_t); - void v9fs_evict_inode(struct inode *inode); - ino_t v9fs_qid2ino(struct p9_qid *qid); --void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *); --void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *); -+void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, -+ struct super_block *sb, unsigned int flags); -+void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, -+ unsigned int flags); - int v9fs_dir_release(struct inode *inode, struct file *filp); - int v9fs_file_open(struct inode *inode, struct file *file); - void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat); -@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode) - } - - int v9fs_open_to_dotl_flags(int flags); -+ -+static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size) -+{ -+ /* -+ * 32-bit need the lock, concurrent updates could break the -+ * sequences and make i_size_read() loop forever. -+ * 64-bit updates are atomic and can skip the locking. -+ */ -+ if (sizeof(i_size) > sizeof(long)) -+ spin_lock(&inode->i_lock); -+ i_size_write(inode, i_size); -+ if (sizeof(i_size) > sizeof(long)) -+ spin_unlock(&inode->i_lock); -+} - #endif -diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c -index e7b3d2c4472d..62ce8b4a7e5f 100644 ---- a/fs/9p/vfs_file.c -+++ b/fs/9p/vfs_file.c -@@ -442,7 +442,11 @@ v9fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) - i_size = i_size_read(inode); - if (iocb->ki_pos > i_size) { - inode_add_bytes(inode, iocb->ki_pos - i_size); -- i_size_write(inode, iocb->ki_pos); -+ /* -+ * Need to serialize against i_size_write() in -+ * v9fs_stat2inode() -+ */ -+ v9fs_i_size_write(inode, iocb->ki_pos); - } - return retval; - } -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index 73f1d1b3a51c..2de1505aedfd 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -244,7 +244,7 @@ struct inode *v9fs_alloc_inode(struct super_block *sb) - return NULL; - #ifdef CONFIG_9P_FSCACHE - v9inode->fscache = NULL; -- spin_lock_init(&v9inode->fscache_lock); -+ mutex_init(&v9inode->fscache_lock); - #endif - v9inode->writeback_fid = NULL; - v9inode->cache_validity = 0; -@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb, - if (retval) - goto error; - -- v9fs_stat2inode(st, inode, sb); -+ v9fs_stat2inode(st, inode, sb, 0); - v9fs_cache_inode_get_cookie(inode); - unlock_new_inode(inode); - return inode; -@@ -1074,7 +1074,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry, - if (IS_ERR(st)) - return PTR_ERR(st); - -- v9fs_stat2inode(st, d_inode(dentry), d_inode(dentry)->i_sb); -+ v9fs_stat2inode(st, d_inode(dentry), d_inode(dentry)->i_sb, 0); - generic_fillattr(d_inode(dentry), stat); - - p9stat_free(st); -@@ -1152,12 +1152,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr) - * @stat: Plan 9 metadata (mistat) structure - * @inode: inode to populate - * @sb: superblock of filesystem -+ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) - * - */ - - void - v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, -- struct super_block *sb) -+ struct super_block *sb, unsigned int flags) - { - umode_t mode; - char ext[32]; -@@ -1198,10 +1199,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode, - mode = p9mode2perm(v9ses, stat); - mode |= inode->i_mode & ~S_IALLUGO; - inode->i_mode = mode; -- i_size_write(inode, stat->length); - -+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) -+ v9fs_i_size_write(inode, stat->length); - /* not real number of blocks, but 512 byte ones ... */ -- inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9; -+ inode->i_blocks = (stat->length + 512 - 1) >> 9; - v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR; - } - -@@ -1389,9 +1391,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) - { - int umode; - dev_t rdev; -- loff_t i_size; - struct p9_wstat *st; - struct v9fs_session_info *v9ses; -+ unsigned int flags; - - v9ses = v9fs_inode2v9ses(inode); - st = p9_client_stat(fid); -@@ -1404,16 +1406,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode) - if ((inode->i_mode & S_IFMT) != (umode & S_IFMT)) - goto out; - -- spin_lock(&inode->i_lock); - /* - * We don't want to refresh inode->i_size, - * because we may have cached data - */ -- i_size = inode->i_size; -- v9fs_stat2inode(st, inode, inode->i_sb); -- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) -- inode->i_size = i_size; -- spin_unlock(&inode->i_lock); -+ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? -+ V9FS_STAT2INODE_KEEP_ISIZE : 0; -+ v9fs_stat2inode(st, inode, inode->i_sb, flags); - out: - p9stat_free(st); - kfree(st); -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index 0b88744c6446..7ae67fcca031 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb, - if (retval) - goto error; - -- v9fs_stat2inode_dotl(st, inode); -+ v9fs_stat2inode_dotl(st, inode, 0); - v9fs_cache_inode_get_cookie(inode); - retval = v9fs_get_acl(inode, fid); - if (retval) -@@ -498,7 +498,7 @@ v9fs_vfs_getattr_dotl(struct vfsmount *mnt, struct dentry *dentry, - if (IS_ERR(st)) - return PTR_ERR(st); - -- v9fs_stat2inode_dotl(st, d_inode(dentry)); -+ v9fs_stat2inode_dotl(st, d_inode(dentry), 0); - generic_fillattr(d_inode(dentry), stat); - /* Change block size to what the server returned */ - stat->blksize = st->st_blksize; -@@ -609,11 +609,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr) - * v9fs_stat2inode_dotl - populate an inode structure with stat info - * @stat: stat structure - * @inode: inode to populate -+ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) - * - */ - - void --v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) -+v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode, -+ unsigned int flags) - { - umode_t mode; - struct v9fs_inode *v9inode = V9FS_I(inode); -@@ -633,7 +635,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) - mode |= inode->i_mode & ~S_IALLUGO; - inode->i_mode = mode; - -- i_size_write(inode, stat->st_size); -+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE)) -+ v9fs_i_size_write(inode, stat->st_size); - inode->i_blocks = stat->st_blocks; - } else { - if (stat->st_result_mask & P9_STATS_ATIME) { -@@ -663,8 +666,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode) - } - if (stat->st_result_mask & P9_STATS_RDEV) - inode->i_rdev = new_decode_dev(stat->st_rdev); -- if (stat->st_result_mask & P9_STATS_SIZE) -- i_size_write(inode, stat->st_size); -+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) && -+ stat->st_result_mask & P9_STATS_SIZE) -+ v9fs_i_size_write(inode, stat->st_size); - if (stat->st_result_mask & P9_STATS_BLOCKS) - inode->i_blocks = stat->st_blocks; - } -@@ -926,9 +930,9 @@ v9fs_vfs_follow_link_dotl(struct dentry *dentry, void **cookie) - - int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) - { -- loff_t i_size; - struct p9_stat_dotl *st; - struct v9fs_session_info *v9ses; -+ unsigned int flags; - - v9ses = v9fs_inode2v9ses(inode); - st = p9_client_getattr_dotl(fid, P9_STATS_ALL); -@@ -940,16 +944,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode) - if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT)) - goto out; - -- spin_lock(&inode->i_lock); - /* - * We don't want to refresh inode->i_size, - * because we may have cached data - */ -- i_size = inode->i_size; -- v9fs_stat2inode_dotl(st, inode); -- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) -- inode->i_size = i_size; -- spin_unlock(&inode->i_lock); -+ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ? -+ V9FS_STAT2INODE_KEEP_ISIZE : 0; -+ v9fs_stat2inode_dotl(st, inode, flags); - out: - kfree(st); - return 0; -diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c -index bf495cedec26..ccf935d9e722 100644 ---- a/fs/9p/vfs_super.c -+++ b/fs/9p/vfs_super.c -@@ -165,7 +165,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, - goto release_sb; - } - d_inode(root)->i_ino = v9fs_qid2ino(&st->qid); -- v9fs_stat2inode_dotl(st, d_inode(root)); -+ v9fs_stat2inode_dotl(st, d_inode(root), 0); - kfree(st); - } else { - struct p9_wstat *st = NULL; -@@ -176,7 +176,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags, - } - - d_inode(root)->i_ino = v9fs_qid2ino(&st->qid); -- v9fs_stat2inode(st, d_inode(root), sb); -+ v9fs_stat2inode(st, d_inode(root), sb, 0); - - p9stat_free(st); - kfree(st); -diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c -index 7a5a598a2d94..0d8b9c4f27f2 100644 ---- a/fs/autofs4/expire.c -+++ b/fs/autofs4/expire.c -@@ -560,7 +560,6 @@ int autofs4_expire_run(struct super_block *sb, - pkt.len = dentry->d_name.len; - memcpy(pkt.name, dentry->d_name.name, pkt.len); - pkt.name[pkt.len] = '\0'; -- dput(dentry); - - if ( copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)) ) - ret = -EFAULT; -@@ -573,6 +572,8 @@ int autofs4_expire_run(struct super_block *sb, - complete_all(&ino->expire_complete); - spin_unlock(&sbi->fs_lock); - -+ dput(dentry); -+ - return ret; - } - -diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c -index 1132fe71b312..0fd472d67029 100644 ---- a/fs/autofs4/inode.c -+++ b/fs/autofs4/inode.c -@@ -255,8 +255,10 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) - } - root_inode = autofs4_get_inode(s, S_IFDIR | 0755); - root = d_make_root(root_inode); -- if (!root) -+ if (!root) { -+ ret = -ENOMEM; - goto fail_ino; -+ } - pipe = NULL; - - root->d_fsdata = ino; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 42e7f6a8f91d..a18f558b4477 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -3106,11 +3106,11 @@ static int __do_readpage(struct extent_io_tree *tree, - */ - if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) && - prev_em_start && *prev_em_start != (u64)-1 && -- *prev_em_start != em->orig_start) -+ *prev_em_start != em->start) - force_bio_submit = true; - - if (prev_em_start) -- *prev_em_start = em->orig_start; -+ *prev_em_start = em->start; - - free_extent_map(em); - em = NULL; -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 5e8fe8f3942d..d1cca19b29d3 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -6287,10 +6287,10 @@ static int btrfs_check_chunk_valid(struct btrfs_root *root, - } - - if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) || -- (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) || -+ (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) || - (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) || - (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) || -- (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) || -+ (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) || - ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && - num_stripes != 1)) { - btrfs_err(root->fs_info, -diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c -index 4aa7122a8d38..a485d0cdc559 100644 ---- a/fs/ceph/snap.c -+++ b/fs/ceph/snap.c -@@ -611,7 +611,8 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci, - capsnap->size); - - spin_lock(&mdsc->snap_flush_lock); -- list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); -+ if (list_empty(&ci->i_snap_flush_item)) -+ list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); - spin_unlock(&mdsc->snap_flush_lock); - return 1; /* caller may want to ceph_flush_snaps */ - } -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 1062e96ee272..0305e3866216 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2753,14 +2753,16 @@ cifs_strict_writev(struct kiocb *iocb, struct iov_iter *from) - * these pages but not on the region from pos to ppos+len-1. - */ - written = cifs_user_writev(iocb, from); -- if (written > 0 && CIFS_CACHE_READ(cinode)) { -+ if (CIFS_CACHE_READ(cinode)) { - /* -- * Windows 7 server can delay breaking level2 oplock if a write -- * request comes - break it on the client to prevent reading -- * an old data. -+ * We have read level caching and we have just sent a write -+ * request to the server thus making data in the cache stale. -+ * Zap the cache and set oplock/lease level to NONE to avoid -+ * reading stale data from the cache. All subsequent read -+ * operations will read new data from the server. - */ - cifs_zap_mapping(inode); -- cifs_dbg(FYI, "Set no oplock for inode=%p after a write operation\n", -+ cifs_dbg(FYI, "Set Oplock/Lease to NONE for inode=%p after write\n", - inode); - cinode->oplock = 0; - } -diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h -index aacb15bd56fe..f087158c5555 100644 ---- a/fs/cifs/smb2pdu.h -+++ b/fs/cifs/smb2pdu.h -@@ -82,8 +82,8 @@ - - #define NUMBER_OF_SMB2_COMMANDS 0x0013 - --/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ --#define MAX_SMB2_HDR_SIZE 0x00b0 -+/* 52 transform hdr + 64 hdr + 88 create rsp */ -+#define MAX_SMB2_HDR_SIZE 204 - - #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe) - -diff --git a/fs/drop_caches.c b/fs/drop_caches.c -index d72d52b90433..280460fef066 100644 ---- a/fs/drop_caches.c -+++ b/fs/drop_caches.c -@@ -20,8 +20,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) - spin_lock(&sb->s_inode_list_lock); - list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { - spin_lock(&inode->i_lock); -+ /* -+ * We must skip inodes in unusual state. We may also skip -+ * inodes without pages but we deliberately won't in case -+ * we need to reschedule to avoid softlockups. -+ */ - if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) || -- (inode->i_mapping->nrpages == 0)) { -+ (inode->i_mapping->nrpages == 0 && !need_resched())) { - spin_unlock(&inode->i_lock); - continue; - } -@@ -29,6 +34,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) - spin_unlock(&inode->i_lock); - spin_unlock(&sb->s_inode_list_lock); - -+ cond_resched(); - invalidate_mapping_pages(inode->i_mapping, 0, -1); - iput(toput_inode); - toput_inode = inode; -diff --git a/fs/ext2/super.c b/fs/ext2/super.c -index 748d35afc902..860024392969 100644 ---- a/fs/ext2/super.c -+++ b/fs/ext2/super.c -@@ -721,7 +721,8 @@ static loff_t ext2_max_size(int bits) - { - loff_t res = EXT2_NDIR_BLOCKS; - int meta_blocks; -- loff_t upper_limit; -+ unsigned int upper_limit; -+ unsigned int ppb = 1 << (bits-2); - - /* This is calculated to be the largest file size for a - * dense, file such that the total number of -@@ -735,24 +736,34 @@ static loff_t ext2_max_size(int bits) - /* total blocks in file system block size */ - upper_limit >>= (bits - 9); - -+ /* Compute how many blocks we can address by block tree */ -+ res += 1LL << (bits-2); -+ res += 1LL << (2*(bits-2)); -+ res += 1LL << (3*(bits-2)); -+ /* Does block tree limit file size? */ -+ if (res < upper_limit) -+ goto check_lfs; - -+ res = upper_limit; -+ /* How many metadata blocks are needed for addressing upper_limit? */ -+ upper_limit -= EXT2_NDIR_BLOCKS; - /* indirect blocks */ - meta_blocks = 1; -+ upper_limit -= ppb; - /* double indirect blocks */ -- meta_blocks += 1 + (1LL << (bits-2)); -- /* tripple indirect blocks */ -- meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2))); -- -- upper_limit -= meta_blocks; -- upper_limit <<= bits; -- -- res += 1LL << (bits-2); -- res += 1LL << (2*(bits-2)); -- res += 1LL << (3*(bits-2)); -+ if (upper_limit < ppb * ppb) { -+ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb); -+ res -= meta_blocks; -+ goto check_lfs; -+ } -+ meta_blocks += 1 + ppb; -+ upper_limit -= ppb * ppb; -+ /* tripple indirect blocks for the rest */ -+ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) + -+ DIV_ROUND_UP(upper_limit, ppb*ppb); -+ res -= meta_blocks; -+check_lfs: - res <<= bits; -- if (res > upper_limit) -- res = upper_limit; -- - if (res > MAX_LFS_FILESIZE) - res = MAX_LFS_FILESIZE; - -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 2fc1564f62dd..4bd12247a9be 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1928,7 +1928,8 @@ retry: - le16_to_cpu(es->s_reserved_gdt_blocks); - n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb); - n_blocks_count = (ext4_fsblk_t)n_group * -- EXT4_BLOCKS_PER_GROUP(sb); -+ EXT4_BLOCKS_PER_GROUP(sb) + -+ le32_to_cpu(es->s_first_data_block); - n_group--; /* set to last group number */ - } - -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index ab34f613fa85..cefae2350da5 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -869,6 +869,18 @@ static int hugetlbfs_migrate_page(struct address_space *mapping, - rc = migrate_huge_page_move_mapping(mapping, newpage, page); - if (rc != MIGRATEPAGE_SUCCESS) - return rc; -+ -+ /* -+ * page_private is subpool pointer in hugetlb pages. Transfer to -+ * new page. PagePrivate is not associated with page_private for -+ * hugetlb pages and can not be set here as only page_huge_active -+ * pages can be migrated. -+ */ -+ if (page_private(page)) { -+ set_page_private(newpage, page_private(page)); -+ set_page_private(page, 0); -+ } -+ - migrate_page_copy(newpage, page); - - return MIGRATEPAGE_SUCCESS; -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index bce343febb9e..c34433432d47 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1215,11 +1215,12 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh) - struct journal_head *jh; - char *committed_data = NULL; - -- JBUFFER_TRACE(jh, "entry"); - if (jbd2_write_access_granted(handle, bh, true)) - return 0; - - jh = jbd2_journal_add_journal_head(bh); -+ JBUFFER_TRACE(jh, "entry"); -+ - /* - * Do this first --- it can drop the journal lock, so we want to - * make sure that obtaining the committed_data is done -@@ -1336,15 +1337,17 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - - if (is_handle_aborted(handle)) - return -EROFS; -- if (!buffer_jbd(bh)) { -- ret = -EUCLEAN; -- goto out; -- } -+ if (!buffer_jbd(bh)) -+ return -EUCLEAN; -+ - /* - * We don't grab jh reference here since the buffer must be part - * of the running transaction. - */ - jh = bh2jh(bh); -+ jbd_debug(5, "journal_head %p\n", jh); -+ JBUFFER_TRACE(jh, "entry"); -+ - /* - * This and the following assertions are unreliable since we may see jh - * in inconsistent state unless we grab bh_state lock. But this is -@@ -1378,9 +1381,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) - } - - journal = transaction->t_journal; -- jbd_debug(5, "journal_head %p\n", jh); -- JBUFFER_TRACE(jh, "entry"); -- - jbd_lock_bh_state(bh); - - if (jh->b_modified == 0) { -@@ -1578,14 +1578,21 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) - /* However, if the buffer is still owned by a prior - * (committing) transaction, we can't drop it yet... */ - JBUFFER_TRACE(jh, "belongs to older transaction"); -- /* ... but we CAN drop it from the new transaction if we -- * have also modified it since the original commit. */ -+ /* ... but we CAN drop it from the new transaction through -+ * marking the buffer as freed and set j_next_transaction to -+ * the new transaction, so that not only the commit code -+ * knows it should clear dirty bits when it is done with the -+ * buffer, but also the buffer can be checkpointed only -+ * after the new transaction commits. */ - -- if (jh->b_next_transaction) { -- J_ASSERT(jh->b_next_transaction == transaction); -+ set_buffer_freed(bh); -+ -+ if (!jh->b_next_transaction) { - spin_lock(&journal->j_list_lock); -- jh->b_next_transaction = NULL; -+ jh->b_next_transaction = transaction; - spin_unlock(&journal->j_list_lock); -+ } else { -+ J_ASSERT(jh->b_next_transaction == transaction); - - /* - * only drop a reference if this transaction modified -diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c -index 0a3f9b594602..37779ed3f790 100644 ---- a/fs/ncpfs/ioctl.c -+++ b/fs/ncpfs/ioctl.c -@@ -233,7 +233,7 @@ ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg) - len = strlen(server->nls_vol->charset); - if (len > NCP_IOCSNAME_LEN) - len = NCP_IOCSNAME_LEN; -- strncpy(user.codepage, server->nls_vol->charset, len); -+ strscpy(user.codepage, server->nls_vol->charset, NCP_IOCSNAME_LEN); - user.codepage[len] = 0; - } - -@@ -243,7 +243,7 @@ ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg) - len = strlen(server->nls_io->charset); - if (len > NCP_IOCSNAME_LEN) - len = NCP_IOCSNAME_LEN; -- strncpy(user.iocharset, server->nls_io->charset, len); -+ strscpy(user.iocharset, server->nls_io->charset, NCP_IOCSNAME_LEN); - user.iocharset[len] = 0; - } - mutex_unlock(&server->root_setup_lock); -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 211440722e24..88cb8e0d6014 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -670,6 +670,10 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) - - req = nfs_list_entry(reqs.next); - nfs_direct_setup_mirroring(dreq, &desc, req); -+ if (desc.pg_error < 0) { -+ list_splice_init(&reqs, &failed); -+ goto out_failed; -+ } - - list_for_each_entry_safe(req, tmp, &reqs, wb_list) { - if (!nfs_pageio_add_request(&desc, req)) { -@@ -677,13 +681,17 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) - nfs_list_add_request(req, &failed); - spin_lock(cinfo.lock); - dreq->flags = 0; -- dreq->error = -EIO; -+ if (desc.pg_error < 0) -+ dreq->error = desc.pg_error; -+ else -+ dreq->error = -EIO; - spin_unlock(cinfo.lock); - } - nfs_release_request(req); - } - nfs_pageio_complete(&desc); - -+out_failed: - while (!list_empty(&failed)) { - req = nfs_list_entry(failed.next); - nfs_list_remove_request(req); -@@ -898,6 +906,11 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, - } - - nfs_direct_setup_mirroring(dreq, &desc, req); -+ if (desc.pg_error < 0) { -+ nfs_free_request(req); -+ result = desc.pg_error; -+ break; -+ } - - nfs_lock_request(req); - req->wb_index = pos >> PAGE_SHIFT; -diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c -index fd8da630fd22..8e268965c96d 100644 ---- a/fs/nfs/filelayout/filelayout.c -+++ b/fs/nfs/filelayout/filelayout.c -@@ -882,13 +882,19 @@ static void - filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio, - struct nfs_page *req) - { -- if (!pgio->pg_lseg) -+ if (!pgio->pg_lseg) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - 0, - NFS4_MAX_UINT64, - IOMODE_READ, - GFP_KERNEL); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } -+ } - /* If no lseg, fall back to read through mds */ - if (pgio->pg_lseg == NULL) - nfs_pageio_reset_read_mds(pgio); -@@ -901,13 +907,20 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio, - struct nfs_commit_info cinfo; - int status; - -- if (!pgio->pg_lseg) -+ if (!pgio->pg_lseg) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - 0, - NFS4_MAX_UINT64, - IOMODE_RW, - GFP_NOFS); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } -+ } -+ - /* If no lseg, fall back to write through mds */ - if (pgio->pg_lseg == NULL) - goto out_mds; -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index c8e90152b61b..6506775575aa 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -786,13 +786,19 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio, - int ds_idx; - - /* Use full layout for now */ -- if (!pgio->pg_lseg) -+ if (!pgio->pg_lseg) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - 0, - NFS4_MAX_UINT64, - IOMODE_READ, - GFP_KERNEL); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } -+ } - /* If no lseg, fall back to read through mds */ - if (pgio->pg_lseg == NULL) - goto out_mds; -@@ -826,13 +832,19 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio, - int i; - int status; - -- if (!pgio->pg_lseg) -+ if (!pgio->pg_lseg) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - 0, - NFS4_MAX_UINT64, - IOMODE_RW, - GFP_NOFS); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } -+ } - /* If no lseg, fall back to write through mds */ - if (pgio->pg_lseg == NULL) - goto out_mds; -@@ -868,18 +880,25 @@ static unsigned int - ff_layout_pg_get_mirror_count_write(struct nfs_pageio_descriptor *pgio, - struct nfs_page *req) - { -- if (!pgio->pg_lseg) -+ if (!pgio->pg_lseg) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - 0, - NFS4_MAX_UINT64, - IOMODE_RW, - GFP_NOFS); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ goto out; -+ } -+ } - if (pgio->pg_lseg) - return FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg); - - /* no lseg means that pnfs is not in use, so no mirroring here */ - nfs_pageio_reset_write_mds(pgio); -+out: - return 1; - } - -diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c -index 4bdc2fc86280..8a2077408ab0 100644 ---- a/fs/nfs/pagelist.c -+++ b/fs/nfs/pagelist.c -@@ -872,6 +872,9 @@ static int nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio, - - mirror_count = pgio->pg_ops->pg_get_mirror_count(pgio, req); - -+ if (pgio->pg_error < 0) -+ return pgio->pg_error; -+ - if (!mirror_count || mirror_count > NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX) - return -EINVAL; - -@@ -980,6 +983,8 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc, - } else { - if (desc->pg_ops->pg_init) - desc->pg_ops->pg_init(desc, req); -+ if (desc->pg_error < 0) -+ return 0; - mirror->pg_base = req->wb_pgbase; - } - if (!nfs_can_coalesce_requests(prev, req, desc)) -@@ -1102,7 +1107,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc) - struct nfs_page *req; - - req = list_first_entry(&head, struct nfs_page, wb_list); -- nfs_list_remove_request(req); - if (__nfs_pageio_add_request(desc, req)) - continue; - if (desc->pg_error < 0) { -@@ -1145,6 +1149,8 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, - bytes = req->wb_bytes; - - nfs_pageio_setup_mirroring(desc, req); -+ if (desc->pg_error < 0) -+ return 0; - - for (midx = 0; midx < desc->pg_mirror_count; midx++) { - if (midx) { -@@ -1196,7 +1202,7 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc, - desc->pg_mirror_idx = mirror_idx; - for (;;) { - nfs_pageio_doio(desc); -- if (!mirror->pg_recoalesce) -+ if (desc->pg_error < 0 || !mirror->pg_recoalesce) - break; - if (!nfs_do_recoalesce(desc)) - break; -@@ -1230,7 +1236,7 @@ int nfs_pageio_resend(struct nfs_pageio_descriptor *desc, - nfs_pageio_complete(desc); - if (!list_empty(&failed)) { - list_move(&failed, &hdr->pages); -- return -EIO; -+ return desc->pg_error < 0 ? desc->pg_error : -EIO; - } - return 0; - } -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index c8e75e5e6a67..d34fb0feb5c2 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -909,14 +909,15 @@ send_layoutget(struct pnfs_layout_hdr *lo, - - if (IS_ERR(lseg)) { - switch (PTR_ERR(lseg)) { -- case -ENOMEM: - case -ERESTARTSYS: -+ case -EIO: -+ case -ENOSPC: -+ case -EROFS: -+ case -E2BIG: - break; - default: -- /* remember that LAYOUTGET failed and suspend trying */ -- pnfs_layout_io_set_failed(lo, range->iomode); -+ return NULL; - } -- return NULL; - } else - pnfs_layout_clear_fail_bit(lo, - pnfs_iomode_to_fail_bit(range->iomode)); -@@ -1625,7 +1626,7 @@ out: - "(%s, offset: %llu, length: %llu)\n", - __func__, ino->i_sb->s_id, - (unsigned long long)NFS_FILEID(ino), -- lseg == NULL ? "not found" : "found", -+ IS_ERR_OR_NULL(lseg) ? "not found" : "found", - iomode==IOMODE_RW ? "read/write" : "read-only", - (unsigned long long)pos, - (unsigned long long)count); -@@ -1804,6 +1805,11 @@ pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *r - rd_size, - IOMODE_READ, - GFP_KERNEL); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } - } - /* If no lseg, fall back to read through mds */ - if (pgio->pg_lseg == NULL) -@@ -1816,13 +1822,19 @@ void - pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio, - struct nfs_page *req, u64 wb_size) - { -- if (pgio->pg_lseg == NULL) -+ if (pgio->pg_lseg == NULL) { - pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode, - req->wb_context, - req_offset(req), - wb_size, - IOMODE_RW, - GFP_NOFS); -+ if (IS_ERR(pgio->pg_lseg)) { -+ pgio->pg_error = PTR_ERR(pgio->pg_lseg); -+ pgio->pg_lseg = NULL; -+ return; -+ } -+ } - /* If no lseg, fall back to write through mds */ - if (pgio->pg_lseg == NULL) - nfs_pageio_reset_write_mds(pgio); -diff --git a/fs/nfs/read.c b/fs/nfs/read.c -index 0a5e33f33b5c..0bb580174cb3 100644 ---- a/fs/nfs/read.c -+++ b/fs/nfs/read.c -@@ -115,7 +115,7 @@ int nfs_readpage_async(struct nfs_open_context *ctx, struct inode *inode, - pgm = &pgio.pg_mirrors[0]; - NFS_I(inode)->read_io += pgm->pg_bytes_written; - -- return 0; -+ return pgio.pg_error < 0 ? pgio.pg_error : 0; - } - - static void nfs_readpage_release(struct nfs_page *req) -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index 412fcfbc50e2..9b42139a479b 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -1877,6 +1877,11 @@ static int nfs_parse_devname(const char *dev_name, - size_t len; - char *end; - -+ if (unlikely(!dev_name || !*dev_name)) { -+ dfprintk(MOUNT, "NFS: device name not specified\n"); -+ return -EINVAL; -+ } -+ - /* Is the host name protected with square brakcets? */ - if (*dev_name == '[') { - end = strchr(++dev_name, ']'); -diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c -index 7b755b7f785c..91146f025769 100644 ---- a/fs/nfsd/nfs3proc.c -+++ b/fs/nfsd/nfs3proc.c -@@ -430,8 +430,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp, - &resp->common, nfs3svc_encode_entry); - memcpy(resp->verf, argp->verf, 8); - resp->count = resp->buffer - argp->buffer; -- if (resp->offset) -- xdr_encode_hyper(resp->offset, argp->cookie); -+ if (resp->offset) { -+ loff_t offset = argp->cookie; -+ -+ if (unlikely(resp->offset1)) { -+ /* we ended up with offset on a page boundary */ -+ *resp->offset = htonl(offset >> 32); -+ *resp->offset1 = htonl(offset & 0xffffffff); -+ resp->offset1 = NULL; -+ } else { -+ xdr_encode_hyper(resp->offset, offset); -+ } -+ resp->offset = NULL; -+ } - - RETURN_STATUS(nfserr); - } -@@ -499,6 +510,7 @@ nfsd3_proc_readdirplus(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp, - } else { - xdr_encode_hyper(resp->offset, offset); - } -+ resp->offset = NULL; - } - - RETURN_STATUS(nfserr); -diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c -index 7162ab7bc093..d4fa7fbc37dc 100644 ---- a/fs/nfsd/nfs3xdr.c -+++ b/fs/nfsd/nfs3xdr.c -@@ -898,6 +898,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen, - } else { - xdr_encode_hyper(cd->offset, offset64); - } -+ cd->offset = NULL; - } - - /* -diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c -index 03c7a4e7b6ba..0cd57db5c5af 100644 ---- a/fs/nfsd/nfsctl.c -+++ b/fs/nfsd/nfsctl.c -@@ -1106,7 +1106,7 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) - case 'Y': - case 'y': - case '1': -- if (nn->nfsd_serv) -+ if (!nn->nfsd_serv) - return -EBUSY; - nfsd4_end_grace(nn); - break; -diff --git a/include/keys/user-type.h b/include/keys/user-type.h -index c56fef40f53e..5d744ec8f644 100644 ---- a/include/keys/user-type.h -+++ b/include/keys/user-type.h -@@ -31,7 +31,7 @@ - struct user_key_payload { - struct rcu_head rcu; /* RCU destructor */ - unsigned short datalen; /* length of this data */ -- char data[0]; /* actual data */ -+ char data[0] __aligned(__alignof__(u64)); /* actual data */ - }; - - extern struct key_type key_type_user; -diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h -index 899ab9f8549e..82621fa441f3 100644 ---- a/include/linux/device-mapper.h -+++ b/include/linux/device-mapper.h -@@ -593,7 +593,7 @@ extern struct ratelimit_state dm_ratelimit_state; - */ - #define dm_target_offset(ti, sector) ((sector) - (ti)->begin) - --static inline sector_t to_sector(unsigned long n) -+static inline sector_t to_sector(unsigned long long n) - { - return (n >> SECTOR_SHIFT); - } -diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h -index 86316f90ea1e..cd856b7a11f5 100644 ---- a/include/net/gro_cells.h -+++ b/include/net/gro_cells.h -@@ -19,22 +19,30 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s - struct gro_cell *cell; - struct net_device *dev = skb->dev; - -+ rcu_read_lock(); -+ if (unlikely(!(dev->flags & IFF_UP))) -+ goto drop; -+ - if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) { - netif_rx(skb); -- return; -+ goto unlock; - } - - cell = this_cpu_ptr(gcells->cells); - - if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) { -+drop: - atomic_long_inc(&dev->rx_dropped); - kfree_skb(skb); -- return; -+ goto unlock; - } - - __skb_queue_tail(&cell->napi_skbs, skb); - if (skb_queue_len(&cell->napi_skbs) == 1) - napi_schedule(&cell->napi); -+ -+unlock: -+ rcu_read_unlock(); - } - - /* called under BH context */ -diff --git a/include/net/icmp.h b/include/net/icmp.h -index 970028e13382..06ceb483475d 100644 ---- a/include/net/icmp.h -+++ b/include/net/icmp.h -@@ -22,6 +22,7 @@ - - #include - #include -+#include - - struct icmp_err { - int errno; -@@ -39,7 +40,13 @@ struct net_proto_family; - struct sk_buff; - struct net; - --void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info); -+void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, -+ const struct ip_options *opt); -+static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) -+{ -+ __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt); -+} -+ - int icmp_rcv(struct sk_buff *skb); - void icmp_err(struct sk_buff *skb, u32 info); - int icmp_init(void); -diff --git a/include/net/ip.h b/include/net/ip.h -index 7b968927477d..e2320f9e4d3e 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -546,6 +546,8 @@ static inline int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb) - } - - void ip_options_fragment(struct sk_buff *skb); -+int __ip_options_compile(struct net *net, struct ip_options *opt, -+ struct sk_buff *skb, __be32 *info); - int ip_options_compile(struct net *net, struct ip_options *opt, - struct sk_buff *skb); - int ip_options_get(struct net *net, struct ip_options_rcu **optp, -diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h -index b669fe6dbc3b..98f31c7ea23d 100644 ---- a/include/net/phonet/pep.h -+++ b/include/net/phonet/pep.h -@@ -63,10 +63,11 @@ struct pnpipehdr { - u8 state_after_reset; /* reset request */ - u8 error_code; /* any response */ - u8 pep_type; /* status indication */ -- u8 data[1]; -+ u8 data0; /* anything else */ - }; -+ u8 data[]; - }; --#define other_pep_type data[1] -+#define other_pep_type data[0] - - static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb) - { -diff --git a/kernel/futex.c b/kernel/futex.c -index a26d217c99fe..0c92c8d34ffa 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -2923,10 +2923,13 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - */ - WARN_ON(!q.pi_state); - pi_mutex = &q.pi_state->pi_mutex; -- ret = rt_mutex_finish_proxy_lock(pi_mutex, to, &rt_waiter); -- debug_rt_mutex_free_waiter(&rt_waiter); -+ ret = rt_mutex_wait_proxy_lock(pi_mutex, to, &rt_waiter); - - spin_lock(q.lock_ptr); -+ if (ret && !rt_mutex_cleanup_proxy_lock(pi_mutex, &rt_waiter)) -+ ret = 0; -+ -+ debug_rt_mutex_free_waiter(&rt_waiter); - /* - * Fixup the pi_state owner and possibly acquire the lock if we - * haven't already. -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index b066724d7a5b..dd173df9ee5e 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1712,21 +1712,23 @@ struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock) - } - - /** -- * rt_mutex_finish_proxy_lock() - Complete lock acquisition -+ * rt_mutex_wait_proxy_lock() - Wait for lock acquisition - * @lock: the rt_mutex we were woken on - * @to: the timeout, null if none. hrtimer should already have - * been started. - * @waiter: the pre-initialized rt_mutex_waiter - * -- * Complete the lock acquisition started our behalf by another thread. -+ * Wait for the the lock acquisition started on our behalf by -+ * rt_mutex_start_proxy_lock(). Upon failure, the caller must call -+ * rt_mutex_cleanup_proxy_lock(). - * - * Returns: - * 0 - success - * <0 - error, one of -EINTR, -ETIMEDOUT - * -- * Special API call for PI-futex requeue support -+ * Special API call for PI-futex support - */ --int rt_mutex_finish_proxy_lock(struct rt_mutex *lock, -+int rt_mutex_wait_proxy_lock(struct rt_mutex *lock, - struct hrtimer_sleeper *to, - struct rt_mutex_waiter *waiter) - { -@@ -1739,9 +1741,6 @@ int rt_mutex_finish_proxy_lock(struct rt_mutex *lock, - /* sleep on the mutex */ - ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter); - -- if (unlikely(ret)) -- remove_waiter(lock, waiter); -- - /* - * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might - * have to fix that up. -@@ -1752,3 +1751,42 @@ int rt_mutex_finish_proxy_lock(struct rt_mutex *lock, - - return ret; - } -+ -+/** -+ * rt_mutex_cleanup_proxy_lock() - Cleanup failed lock acquisition -+ * @lock: the rt_mutex we were woken on -+ * @waiter: the pre-initialized rt_mutex_waiter -+ * -+ * Attempt to clean up after a failed rt_mutex_wait_proxy_lock(). -+ * -+ * Unless we acquired the lock; we're still enqueued on the wait-list and can -+ * in fact still be granted ownership until we're removed. Therefore we can -+ * find we are in fact the owner and must disregard the -+ * rt_mutex_wait_proxy_lock() failure. -+ * -+ * Returns: -+ * true - did the cleanup, we done. -+ * false - we acquired the lock after rt_mutex_wait_proxy_lock() returned, -+ * caller should disregards its return value. -+ * -+ * Special API call for PI-futex support -+ */ -+bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock, -+ struct rt_mutex_waiter *waiter) -+{ -+ bool cleanup = false; -+ -+ raw_spin_lock_irq(&lock->wait_lock); -+ /* -+ * Unless we're the owner; we're still enqueued on the wait_list. -+ * So check if we became owner, if not, take us off the wait_list. -+ */ -+ if (rt_mutex_owner(lock) != current) { -+ remove_waiter(lock, waiter); -+ fixup_rt_mutex_waiters(lock); -+ cleanup = true; -+ } -+ raw_spin_unlock_irq(&lock->wait_lock); -+ -+ return cleanup; -+} -diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h -index e317e1cbb3eb..6f8f68edb700 100644 ---- a/kernel/locking/rtmutex_common.h -+++ b/kernel/locking/rtmutex_common.h -@@ -106,9 +106,11 @@ extern void rt_mutex_proxy_unlock(struct rt_mutex *lock, - extern int rt_mutex_start_proxy_lock(struct rt_mutex *lock, - struct rt_mutex_waiter *waiter, - struct task_struct *task); --extern int rt_mutex_finish_proxy_lock(struct rt_mutex *lock, -- struct hrtimer_sleeper *to, -- struct rt_mutex_waiter *waiter); -+extern int rt_mutex_wait_proxy_lock(struct rt_mutex *lock, -+ struct hrtimer_sleeper *to, -+ struct rt_mutex_waiter *waiter); -+extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock, -+ struct rt_mutex_waiter *waiter); - extern int rt_mutex_timed_futex_lock(struct rt_mutex *l, struct hrtimer_sleeper *to); - extern bool rt_mutex_futex_unlock(struct rt_mutex *lock, - struct wake_q_head *wqh); -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index 4e886ccd40db..082aedefe29c 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -1611,15 +1611,23 @@ static int rcu_future_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp) - } - - /* -- * Awaken the grace-period kthread for the specified flavor of RCU. -- * Don't do a self-awaken, and don't bother awakening when there is -- * nothing for the grace-period kthread to do (as in several CPUs -- * raced to awaken, and we lost), and finally don't try to awaken -- * a kthread that has not yet been created. -+ * Awaken the grace-period kthread. Don't do a self-awaken (unless in -+ * an interrupt or softirq handler), and don't bother awakening when there -+ * is nothing for the grace-period kthread to do (as in several CPUs raced -+ * to awaken, and we lost), and finally don't try to awaken a kthread that -+ * has not yet been created. If all those checks are passed, track some -+ * debug information and awaken. -+ * -+ * So why do the self-wakeup when in an interrupt or softirq handler -+ * in the grace-period kthread's context? Because the kthread might have -+ * been interrupted just as it was going to sleep, and just after the final -+ * pre-sleep check of the awaken condition. In this case, a wakeup really -+ * is required, and is therefore supplied. - */ - static void rcu_gp_kthread_wake(struct rcu_state *rsp) - { -- if (current == rsp->gp_kthread || -+ if ((current == rsp->gp_kthread && -+ !in_interrupt() && !in_serving_softirq()) || - !READ_ONCE(rsp->gp_flags) || - !rsp->gp_kthread) - return; -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 7e832f9a8f42..beadcf83ceba 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -2306,7 +2306,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp, - { - struct do_proc_dointvec_minmax_conv_param *param = data; - if (write) { -- int val = *negp ? -*lvalp : *lvalp; -+ int val; -+ if (*negp) { -+ if (*lvalp > (unsigned long) INT_MAX + 1) -+ return -EINVAL; -+ val = -*lvalp; -+ } else { -+ if (*lvalp > (unsigned long) INT_MAX) -+ return -EINVAL; -+ val = *lvalp; -+ } - if ((param->min && *param->min > val) || - (param->max && *param->max < val)) - return -EINVAL; -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 1a47a64d623f..8c097de8a596 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4646,7 +4646,6 @@ out: - return ret; - - fail: -- kfree(iter->trace); - kfree(iter); - __trace_array_put(tr); - mutex_unlock(&trace_types_lock); -diff --git a/lib/assoc_array.c b/lib/assoc_array.c -index 5cd093589c5a..3b46c5433b7a 100644 ---- a/lib/assoc_array.c -+++ b/lib/assoc_array.c -@@ -781,9 +781,11 @@ all_leaves_cluster_together: - new_s0->index_key[i] = - ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE); - -- blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK); -- pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank); -- new_s0->index_key[keylen - 1] &= ~blank; -+ if (level & ASSOC_ARRAY_KEY_CHUNK_MASK) { -+ blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK); -+ pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank); -+ new_s0->index_key[keylen - 1] &= ~blank; -+ } - - /* This now reduces to a node splitting exercise for which we'll need - * to regenerate the disparity table. -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index f1a45f5077fe..324b2953e57e 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3472,7 +3472,6 @@ retry_avoidcopy: - copy_user_huge_page(new_page, old_page, address, vma, - pages_per_huge_page(h)); - __SetPageUptodate(new_page); -- set_page_huge_active(new_page); - - mmun_start = address & huge_page_mask(h); - mmun_end = mmun_start + huge_page_size(h); -@@ -3494,6 +3493,7 @@ retry_avoidcopy: - make_huge_pte(vma, new_page, 1)); - page_remove_rmap(old_page); - hugepage_add_new_anon_rmap(new_page, vma, address); -+ set_page_huge_active(new_page); - /* Make the old page be freed below */ - new_page = old_page; - } -@@ -3575,6 +3575,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma, - struct page *page; - pte_t new_pte; - spinlock_t *ptl; -+ bool new_page = false; - - /* - * Currently, we are forced to kill the process in the event the -@@ -3608,7 +3609,7 @@ retry: - } - clear_huge_page(page, address, pages_per_huge_page(h)); - __SetPageUptodate(page); -- set_page_huge_active(page); -+ new_page = true; - - if (vma->vm_flags & VM_MAYSHARE) { - int err = huge_add_to_page_cache(page, mapping, idx); -@@ -3680,6 +3681,15 @@ retry: - } - - spin_unlock(ptl); -+ -+ /* -+ * Only make newly allocated pages active. Existing pages found -+ * in the pagecache could be !page_huge_active() if they have been -+ * isolated for migration. -+ */ -+ if (new_page) -+ set_page_huge_active(page); -+ - unlock_page(page); - out: - return ret; -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index 0addef5f8aa3..804cbfe9132d 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1358,7 +1358,8 @@ static struct page *next_active_pageblock(struct page *page) - int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) - { - struct page *page = pfn_to_page(start_pfn); -- struct page *end_page = page + nr_pages; -+ unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page))); -+ struct page *end_page = pfn_to_page(end_pfn); - - /* Check the starting page of each pageblock within the range */ - for (; page < end_page; page = next_active_pageblock(page)) { -@@ -1398,6 +1399,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, - i++; - if (i == MAX_ORDER_NR_PAGES) - continue; -+ /* Check if we got outside of the zone */ -+ if (zone && !zone_spans_pfn(zone, pfn + i)) -+ return 0; - page = pfn_to_page(pfn + i); - if (zone && page_zone(page) != zone) - return 0; -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 44134ba6fb53..5418ab0c5e2c 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -1295,7 +1295,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode, - nodemask_t *nodes) - { - unsigned long copy = ALIGN(maxnode-1, 64) / 8; -- const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long); -+ unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long); - - if (copy > nbytes) { - if (copy > PAGE_SIZE) -@@ -1456,7 +1456,7 @@ SYSCALL_DEFINE5(get_mempolicy, int __user *, policy, - int uninitialized_var(pval); - nodemask_t nodes; - -- if (nmask != NULL && maxnode < MAX_NUMNODES) -+ if (nmask != NULL && maxnode < nr_node_ids) - return -EINVAL; - - err = do_get_mempolicy(&pval, &nodes, addr, flags); -@@ -1485,7 +1485,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy, - unsigned long nr_bits, alloc_size; - DECLARE_BITMAP(bm, MAX_NUMNODES); - -- nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES); -+ nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids); - alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8; - - if (nmask) -diff --git a/mm/migrate.c b/mm/migrate.c -index ce88dff1da98..73da75d5e5b2 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -1056,6 +1056,16 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, - lock_page(hpage); - } - -+ /* -+ * Check for pages which are in the process of being freed. Without -+ * page_mapping() set, hugetlbfs specific move page routine will not -+ * be called and we could leak usage counts for subpools. -+ */ -+ if (page_private(hpage) && !page_mapping(hpage)) { -+ rc = -EBUSY; -+ goto out_unlock; -+ } -+ - if (PageAnon(hpage)) - anon_vma = page_get_anon_vma(hpage); - -@@ -1086,6 +1096,7 @@ put_anon: - put_new_page = NULL; - } - -+out_unlock: - unlock_page(hpage); - out: - if (rc != -EAGAIN) -diff --git a/mm/mmap.c b/mm/mmap.c -index 3074dbcd9621..baa4c1280bff 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2294,12 +2294,11 @@ int expand_downwards(struct vm_area_struct *vma, - struct mm_struct *mm = vma->vm_mm; - struct vm_area_struct *prev; - unsigned long gap_addr; -- int error; -+ int error = 0; - - address &= PAGE_MASK; -- error = security_mmap_addr(address); -- if (error) -- return error; -+ if (address < mmap_min_addr) -+ return -EPERM; - - /* Enforce stack_guard_gap */ - gap_addr = address - stack_guard_gap; -diff --git a/mm/shmem.c b/mm/shmem.c -index d902b413941a..f11aec40f2e1 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -2293,16 +2293,20 @@ static int shmem_create(struct inode *dir, struct dentry *dentry, umode_t mode, - static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry) - { - struct inode *inode = d_inode(old_dentry); -- int ret; -+ int ret = 0; - - /* - * No ordinary (disk based) filesystem counts links as inodes; - * but each new link needs a new dentry, pinning lowmem, and - * tmpfs dentries cannot be pruned until they are unlinked. -+ * But if an O_TMPFILE file is linked into the tmpfs, the -+ * first link must skip that, to get the accounting right. - */ -- ret = shmem_reserve_inode(inode->i_sb); -- if (ret) -- goto out; -+ if (inode->i_nlink) { -+ ret = shmem_reserve_inode(inode->i_sb); -+ if (ret) -+ goto out; -+ } - - dir->i_size += BOGO_DIRENT_SIZE; - inode->i_ctime = dir->i_ctime = dir->i_mtime = CURRENT_TIME; -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index de8e372ece04..400e580725da 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -2162,7 +2162,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, - if (!(area->flags & VM_USERMAP)) - return -EINVAL; - -- if (kaddr + size > area->addr + area->size) -+ if (kaddr + size > area->addr + get_vm_area_size(area)) - return -EINVAL; - - do { -diff --git a/net/9p/client.c b/net/9p/client.c -index 8fba9cd973c1..443db202db09 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -1058,7 +1058,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) - p9_debug(P9_DEBUG_ERROR, - "Please specify a msize of at least 4k\n"); - err = -EINVAL; -- goto free_client; -+ goto close_trans; - } - - err = p9_client_version(clnt); -diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index 5aeb585571ed..4812123e0a2c 100644 ---- a/net/batman-adv/soft-interface.c -+++ b/net/batman-adv/soft-interface.c -@@ -215,6 +215,8 @@ static int batadv_interface_tx(struct sk_buff *skb, - - switch (ntohs(ethhdr->h_proto)) { - case ETH_P_8021Q: -+ if (!pskb_may_pull(skb, sizeof(*vhdr))) -+ goto dropped; - vhdr = vlan_eth_hdr(skb); - - if (vhdr->h_vlan_encapsulated_proto != ethertype) { -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 270d9c9a5331..d80c15d028fe 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1261,14 +1261,7 @@ static void br_multicast_query_received(struct net_bridge *br, - return; - - br_multicast_update_query_timer(br, query, max_delay); -- -- /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, -- * the arrival port for IGMP Queries where the source address -- * is 0.0.0.0 should not be added to router port list. -- */ -- if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) || -- saddr->proto == htons(ETH_P_IPV6)) -- br_multicast_mark_router(br, port); -+ br_multicast_mark_router(br, port); - } - - static int br_ip4_multicast_query(struct net_bridge *br, -diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c -index 8b8a43fda6ca..f13402d407e4 100644 ---- a/net/bridge/netfilter/ebtables.c -+++ b/net/bridge/netfilter/ebtables.c -@@ -1528,6 +1528,8 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) - if (copy_from_user(&tmp, user, sizeof(tmp))) - return -EFAULT; - -+ tmp.name[sizeof(tmp.name) - 1] = '\0'; -+ - t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); - if (!t) - return ret; -@@ -2368,6 +2370,8 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd, - if (copy_from_user(&tmp, user, sizeof(tmp))) - return -EFAULT; - -+ tmp.name[sizeof(tmp.name) - 1] = '\0'; -+ - t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); - if (!t) - return ret; -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index 3e6897efe1eb..3ed2796d008b 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -2049,15 +2049,19 @@ static int process_connect(struct ceph_connection *con) - dout("process_connect on %p tag %d\n", con, (int)con->in_tag); - - if (con->auth_reply_buf) { -+ int len = le32_to_cpu(con->in_reply.authorizer_len); -+ - /* - * Any connection that defines ->get_authorizer() - * should also define ->verify_authorizer_reply(). - * See get_connect_authorizer(). - */ -- ret = con->ops->verify_authorizer_reply(con, 0); -- if (ret < 0) { -- con->error_msg = "bad authorize reply"; -- return ret; -+ if (len) { -+ ret = con->ops->verify_authorizer_reply(con, 0); -+ if (ret < 0) { -+ con->error_msg = "bad authorize reply"; -+ return ret; -+ } - } - } - -diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c -index f88a62ab019d..579d351f6ddd 100644 ---- a/net/core/net-sysfs.c -+++ b/net/core/net-sysfs.c -@@ -1361,6 +1361,9 @@ static int register_queue_kobjects(struct net_device *dev) - error: - netdev_queue_update_kobjects(dev, txq, 0); - net_rx_queue_update_kobjects(dev, rxq, 0); -+#ifdef CONFIG_SYSFS -+ kset_unregister(dev->queues_kset); -+#endif - return error; - } - -diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c -index c7d1adca30d8..943378d6e4c3 100644 ---- a/net/hsr/hsr_device.c -+++ b/net/hsr/hsr_device.c -@@ -93,9 +93,8 @@ static void hsr_check_announce(struct net_device *hsr_dev, - if ((hsr_dev->operstate == IF_OPER_UP) && (old_operstate != IF_OPER_UP)) { - /* Went up */ - hsr->announce_count = 0; -- hsr->announce_timer.expires = jiffies + -- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); -- add_timer(&hsr->announce_timer); -+ mod_timer(&hsr->announce_timer, -+ jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL)); - } - - if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP)) -@@ -323,6 +322,7 @@ static void hsr_announce(unsigned long data) - { - struct hsr_priv *hsr; - struct hsr_port *master; -+ unsigned long interval; - - hsr = (struct hsr_priv *) data; - -@@ -337,14 +337,12 @@ static void hsr_announce(unsigned long data) - } - - if (hsr->announce_count < 3) -- hsr->announce_timer.expires = jiffies + -- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); -+ interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL); - else -- hsr->announce_timer.expires = jiffies + -- msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); -+ interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL); - - if (is_admin_up(master->dev)) -- add_timer(&hsr->announce_timer); -+ mod_timer(&hsr->announce_timer, jiffies + interval); - - rcu_read_unlock(); - } -@@ -477,7 +475,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], - - res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER); - if (res) -- return res; -+ goto err_add_port; - - res = register_netdevice(hsr_dev); - if (res) -@@ -498,6 +496,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2], - fail: - hsr_for_each_port(hsr, port) - hsr_del_port(port); -+err_add_port: -+ hsr_del_node(&hsr->self_node_db); - - return res; - } -diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c -index bace124d14ef..46415839e67e 100644 ---- a/net/hsr/hsr_framereg.c -+++ b/net/hsr/hsr_framereg.c -@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_head *self_node_db, - return 0; - } - -+void hsr_del_node(struct list_head *self_node_db) -+{ -+ struct hsr_node *node; -+ -+ rcu_read_lock(); -+ node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); -+ rcu_read_unlock(); -+ if (node) { -+ list_del_rcu(&node->mac_list); -+ kfree(node); -+ } -+} - - /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; - * seq_out is used to initialize filtering of outgoing duplicate frames -diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h -index 438b40f98f5a..7a8f4e98f515 100644 ---- a/net/hsr/hsr_framereg.h -+++ b/net/hsr/hsr_framereg.h -@@ -16,6 +16,7 @@ - - struct hsr_node; - -+void hsr_del_node(struct list_head *self_node_db); - struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[], - u16 seq_out); - struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb, -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index cfaacaa023e6..7fe643062013 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -167,7 +167,8 @@ static int cipso_v4_bitmap_walk(const unsigned char *bitmap, - (state == 0 && (byte & bitmask) == 0)) - return bit_spot; - -- bit_spot++; -+ if (++bit_spot >= bitmap_len) -+ return -1; - bitmask >>= 1; - if (bitmask == 0) { - byte = bitmap[++byte_offset]; -@@ -737,7 +738,8 @@ static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level) - case CIPSO_V4_MAP_PASS: - return 0; - case CIPSO_V4_MAP_TRANS: -- if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL) -+ if ((level < doi_def->map.std->lvl.cipso_size) && -+ (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)) - return 0; - break; - } -@@ -1805,13 +1807,26 @@ validate_return: - */ - void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) - { -+ unsigned char optbuf[sizeof(struct ip_options) + 40]; -+ struct ip_options *opt = (struct ip_options *)optbuf; -+ - if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES) - return; - -+ /* -+ * We might be called above the IP layer, -+ * so we can not use icmp_send and IPCB here. -+ */ -+ -+ memset(opt, 0, sizeof(struct ip_options)); -+ opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); -+ if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL)) -+ return; -+ - if (gateway) -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0); -+ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0, opt); - else -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0); -+ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0, opt); - } - - /** -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index 36e26977c908..d0ec8a997210 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -565,7 +565,8 @@ relookup_failed: - * MUST reply to only the first fragment. - */ - --void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) -+void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info, -+ const struct ip_options *opt) - { - struct iphdr *iph; - int room; -@@ -679,7 +680,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) - iph->tos; - mark = IP4_REPLY_MARK(net, skb_in->mark); - -- if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb_in)) -+ if (__ip_options_echo(&icmp_param->replyopts.opt.opt, skb_in, opt)) - goto out_unlock; - - -@@ -731,7 +732,7 @@ out_free: - kfree(icmp_param); - out:; - } --EXPORT_SYMBOL(icmp_send); -+EXPORT_SYMBOL(__icmp_send); - - - static void icmp_socket_deliver(struct sk_buff *skb, u32 info) -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 01acb94c4963..6c9158805b57 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -787,7 +787,6 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req, - tcp_sk(child)->fastopen_rsk = NULL; - } - inet_csk_destroy_sock(child); -- reqsk_put(req); - } - - struct sock *inet_csk_reqsk_queue_add(struct sock *sk, -@@ -858,6 +857,7 @@ void inet_csk_listen_stop(struct sock *sk) - sock_hold(child); - - inet_child_forget(sk, req, child); -+ reqsk_put(req); - bh_unlock_sock(child); - local_bh_enable(); - sock_put(child); -diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c -index bd246792360b..d3922a93e4c1 100644 ---- a/net/ipv4/ip_options.c -+++ b/net/ipv4/ip_options.c -@@ -254,8 +254,9 @@ static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb) - * If opt == NULL, then skb->data should point to IP header. - */ - --int ip_options_compile(struct net *net, -- struct ip_options *opt, struct sk_buff *skb) -+int __ip_options_compile(struct net *net, -+ struct ip_options *opt, struct sk_buff *skb, -+ __be32 *info) - { - __be32 spec_dst = htonl(INADDR_ANY); - unsigned char *pp_ptr = NULL; -@@ -472,11 +473,22 @@ eol: - return 0; - - error: -- if (skb) { -- icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24)); -- } -+ if (info) -+ *info = htonl((pp_ptr-iph)<<24); - return -EINVAL; - } -+ -+int ip_options_compile(struct net *net, -+ struct ip_options *opt, struct sk_buff *skb) -+{ -+ int ret; -+ __be32 info; -+ -+ ret = __ip_options_compile(net, opt, skb, &info); -+ if (ret != 0 && skb) -+ icmp_send(skb, ICMP_PARAMETERPROB, 0, info); -+ return ret; -+} - EXPORT_SYMBOL(ip_options_compile); - - /* -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index 4b7c81f88abf..fcf327ebd134 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -75,6 +75,33 @@ drop: - return 0; - } - -+static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi, -+ int encap_type) -+{ -+ struct ip_tunnel *tunnel; -+ const struct iphdr *iph = ip_hdr(skb); -+ struct net *net = dev_net(skb->dev); -+ struct ip_tunnel_net *itn = net_generic(net, vti_net_id); -+ -+ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY, -+ iph->saddr, iph->daddr, 0); -+ if (tunnel) { -+ if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) -+ goto drop; -+ -+ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; -+ -+ skb->dev = tunnel->dev; -+ -+ return xfrm_input(skb, nexthdr, spi, encap_type); -+ } -+ -+ return -EINVAL; -+drop: -+ kfree_skb(skb); -+ return 0; -+} -+ - static int vti_rcv(struct sk_buff *skb) - { - XFRM_SPI_SKB_CB(skb)->family = AF_INET; -@@ -83,6 +110,14 @@ static int vti_rcv(struct sk_buff *skb) - return vti_input(skb, ip_hdr(skb)->protocol, 0, 0); - } - -+static int vti_rcv_ipip(struct sk_buff *skb) -+{ -+ XFRM_SPI_SKB_CB(skb)->family = AF_INET; -+ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); -+ -+ return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0); -+} -+ - static int vti_rcv_cb(struct sk_buff *skb, int err) - { - unsigned short family; -@@ -409,6 +444,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { - .priority = 100, - }; - -+static struct xfrm_tunnel ipip_handler __read_mostly = { -+ .handler = vti_rcv_ipip, -+ .err_handler = vti4_err, -+ .priority = 0, -+}; -+ - static int __net_init vti_init_net(struct net *net) - { - int err; -@@ -592,6 +633,13 @@ static int __init vti_init(void) - if (err < 0) - goto xfrm_proto_comp_failed; - -+ msg = "ipip tunnel"; -+ err = xfrm4_tunnel_register(&ipip_handler, AF_INET); -+ if (err < 0) { -+ pr_info("%s: cant't register tunnel\n",__func__); -+ goto xfrm_tunnel_failed; -+ } -+ - msg = "netlink interface"; - err = rtnl_link_register(&vti_link_ops); - if (err < 0) -@@ -601,6 +649,8 @@ static int __init vti_init(void) - - rtnl_link_failed: - xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); -+xfrm_tunnel_failed: -+ xfrm4_tunnel_deregister(&ipip_handler, AF_INET); - xfrm_proto_comp_failed: - xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); - xfrm_proto_ah_failed: -diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c -index f51b32ed353c..cbe630aab44a 100644 ---- a/net/ipv4/netfilter/arp_tables.c -+++ b/net/ipv4/netfilter/arp_tables.c -@@ -983,6 +983,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, - sizeof(struct arpt_get_entries) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - t = xt_find_table_lock(net, NFPROTO_ARP, get.name); - if (!IS_ERR_OR_NULL(t)) { -@@ -1557,6 +1558,7 @@ static int compat_get_entries(struct net *net, - *len, sizeof(get) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - xt_compat_lock(NFPROTO_ARP); - t = xt_find_table_lock(net, NFPROTO_ARP, get.name); -diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c -index 8adb6e9ba8f5..53d664a7774c 100644 ---- a/net/ipv4/netfilter/ip_tables.c -+++ b/net/ipv4/netfilter/ip_tables.c -@@ -1171,6 +1171,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, - *len, sizeof(get) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - t = xt_find_table_lock(net, AF_INET, get.name); - if (!IS_ERR_OR_NULL(t)) { -@@ -1799,6 +1800,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr, - *len, sizeof(get) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - xt_compat_lock(AF_INET); - t = xt_find_table_lock(net, AF_INET, get.name); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 80ce6b0672d2..97bf6c785767 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1604,6 +1604,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) - if (fnhe->fnhe_daddr == daddr) { - rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( - fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); -+ /* set fnhe_daddr to 0 to ensure it won't bind with -+ * new dsts in rt_bind_exception(). -+ */ -+ fnhe->fnhe_daddr = 0; - fnhe_flush_routes(fnhe); - kfree_rcu(fnhe, rcu); - break; -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index c22a74374a9c..f3d3ac5c23d5 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -228,7 +228,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, - if (child) { - atomic_set(&req->rsk_refcnt, 1); - sock_rps_save_rxhash(child, skb); -- inet_csk_reqsk_queue_add(sk, req, child); -+ if (!inet_csk_reqsk_queue_add(sk, req, child)) { -+ bh_unlock_sock(child); -+ sock_put(child); -+ child = NULL; -+ reqsk_put(req); -+ } - } else { - reqsk_free(req); - } -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 1aff93d76f24..561f568e8938 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -6409,7 +6409,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, - af_ops->send_synack(fastopen_sk, dst, &fl, req, - &foc, false); - /* Add the child socket directly into the accept queue */ -- inet_csk_reqsk_queue_add(sk, req, fastopen_sk); -+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) { -+ reqsk_fastopen_remove(fastopen_sk, req, false); -+ bh_unlock_sock(fastopen_sk); -+ sock_put(fastopen_sk); -+ reqsk_put(req); -+ goto drop; -+ } - sk->sk_data_ready(sk); - bh_unlock_sock(fastopen_sk); - sock_put(fastopen_sk); -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 6f929689fd03..0924f93a0aff 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1463,7 +1463,7 @@ static void udp_v4_rehash(struct sock *sk) - udp_lib_rehash(sk, new_hash); - } - --static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) -+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - { - int rc; - -diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h -index 7e0fe4bdd967..feb50a16398d 100644 ---- a/net/ipv4/udp_impl.h -+++ b/net/ipv4/udp_impl.h -@@ -25,7 +25,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock, - int flags, int *addr_len); - int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size, - int flags); --int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); -+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); - void udp_destroy_sock(struct sock *sk); - - #ifdef CONFIG_PROC_FS -diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c -index 3b3efbda48e1..78766b32b78b 100644 ---- a/net/ipv4/udplite.c -+++ b/net/ipv4/udplite.c -@@ -50,7 +50,7 @@ struct proto udplite_prot = { - .sendmsg = udp_sendmsg, - .recvmsg = udp_recvmsg, - .sendpage = udp_sendpage, -- .backlog_rcv = udp_queue_rcv_skb, -+ .backlog_rcv = __udp_queue_rcv_skb, - .hash = udp_lib_hash, - .unhash = udp_lib_unhash, - .get_port = udp_v4_get_port, -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 74b3e9718e84..e348a140e540 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -1990,10 +1990,10 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) - - static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), -- IPSTATS_MIB_OUTFORWDATAGRAMS); -- IP6_ADD_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), -- IPSTATS_MIB_OUTOCTETS, skb->len); -+ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), -+ IPSTATS_MIB_OUTFORWDATAGRAMS); -+ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)), -+ IPSTATS_MIB_OUTOCTETS, skb->len); - return dst_output(net, sk, skb); - } - -diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index 96de322fe5e2..f563cf3fcc4c 100644 ---- a/net/ipv6/netfilter/ip6_tables.c -+++ b/net/ipv6/netfilter/ip6_tables.c -@@ -1182,6 +1182,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, - *len, sizeof(get) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - t = xt_find_table_lock(net, AF_INET6, get.name); - if (!IS_ERR_OR_NULL(t)) { -@@ -1800,6 +1801,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr, - *len, sizeof(get) + get.size); - return -EINVAL; - } -+ get.name[sizeof(get.name) - 1] = '\0'; - - xt_compat_lock(AF_INET6); - t = xt_find_table_lock(net, AF_INET6, get.name); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 1cb8954885ec..fffd2ad28942 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3095,7 +3095,7 @@ static int rt6_fill_node(struct net *net, - table = rt->rt6i_table->tb6_id; - else - table = RT6_TABLE_UNSPEC; -- rtm->rtm_table = table; -+ rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT; - if (nla_put_u32(skb, RTA_TABLE, table)) - goto nla_put_failure; - if (rt->rt6i_flags & RTF_REJECT) { -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 11282ffca567..96582ec9c807 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -577,7 +577,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info) - goto out; - - err = 0; -- if (!ipip6_err_gen_icmpv6_unreach(skb)) -+ if (__in6_dev_get(skb->dev) && !ipip6_err_gen_icmpv6_unreach(skb)) - goto out; - - if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED) -@@ -772,8 +772,9 @@ static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst, - pbw0 = tunnel->ip6rd.prefixlen >> 5; - pbi0 = tunnel->ip6rd.prefixlen & 0x1f; - -- d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >> -- tunnel->ip6rd.relay_prefixlen; -+ d = tunnel->ip6rd.relay_prefixlen < 32 ? -+ (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >> -+ tunnel->ip6rd.relay_prefixlen : 0; - - pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen; - if (pbi1 > 0) -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 6eb1e9293b6f..f4e06748f86b 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -585,7 +585,7 @@ out: - sock_put(sk); - } - --static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) -+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) - { - int rc; - -diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h -index 0682c031ccdc..3c1dbc9f74cf 100644 ---- a/net/ipv6/udp_impl.h -+++ b/net/ipv6/udp_impl.h -@@ -26,7 +26,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname, - int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len); - int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock, - int flags, int *addr_len); --int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); -+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); - void udpv6_destroy_sock(struct sock *sk); - - void udp_v6_clear_sk(struct sock *sk, int size); -diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c -index 9cf097e206e9..d1eaeeaa34d2 100644 ---- a/net/ipv6/udplite.c -+++ b/net/ipv6/udplite.c -@@ -45,7 +45,7 @@ struct proto udplitev6_prot = { - .getsockopt = udpv6_getsockopt, - .sendmsg = udpv6_sendmsg, - .recvmsg = udpv6_recvmsg, -- .backlog_rcv = udpv6_queue_rcv_skb, -+ .backlog_rcv = __udpv6_queue_rcv_skb, - .hash = udp_lib_hash, - .unhash = udp_lib_unhash, - .get_port = udp_v6_get_port, -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index e066111b9398..a88649c5d26c 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -666,9 +666,6 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - if (flags & MSG_OOB) - goto out; - -- if (addr_len) -- *addr_len = sizeof(*lsa); -- - if (flags & MSG_ERRQUEUE) - return ipv6_recv_error(sk, msg, len, addr_len); - -@@ -698,6 +695,7 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, - lsa->l2tp_conn_id = 0; - if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL) - lsa->l2tp_scope_id = inet6_iif(skb); -+ *addr_len = sizeof(*lsa); - } - - if (np->rxopt.all) -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 67348d8ac35d..7349bf26ae7b 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1228,6 +1228,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, - if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) - sta->sta.tdls = true; - -+ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && -+ !sdata->u.mgd.associated) -+ return -EINVAL; -+ - err = sta_apply_parameters(local, sta, params); - if (err) { - sta_info_free(local, sta); -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index acacceec8cd8..833ad779659c 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2340,7 +2340,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) - skb_set_queue_mapping(skb, q); - - if (!--mesh_hdr->ttl) { -- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); -+ if (!is_multicast_ether_addr(hdr->addr1)) -+ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, -+ dropped_frames_ttl); - goto out; - } - -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index 3167ec76903a..56c62b65923f 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -2217,6 +2217,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user - u->tcp_fin_timeout, - u->udp_timeout); - -+#ifdef CONFIG_IP_VS_PROTO_TCP -+ if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) || -+ u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) { -+ return -EINVAL; -+ } -+#endif -+ -+#ifdef CONFIG_IP_VS_PROTO_UDP -+ if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ)) -+ return -EINVAL; -+#endif -+ - #ifdef CONFIG_IP_VS_PROTO_TCP - if (u->tcp_timeout) { - pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP); -diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c -index 278f3b9356ef..7cc1d9c22a9f 100644 ---- a/net/netfilter/nf_conntrack_proto_tcp.c -+++ b/net/netfilter/nf_conntrack_proto_tcp.c -@@ -410,6 +410,8 @@ static void tcp_options(const struct sk_buff *skb, - length--; - continue; - default: -+ if (length < 2) -+ return; - opsize=*ptr++; - if (opsize < 2) /* "silly options" */ - return; -@@ -470,6 +472,8 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff, - length--; - continue; - default: -+ if (length < 2) -+ return; - opsize = *ptr++; - if (opsize < 2) /* "silly options" */ - return; -diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c -index fefbf5f0b28d..088e8da06b00 100644 ---- a/net/netfilter/nfnetlink_acct.c -+++ b/net/netfilter/nfnetlink_acct.c -@@ -243,6 +243,9 @@ nfacct_filter_alloc(const struct nlattr * const attr) - if (err < 0) - return ERR_PTR(err); - -+ if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE]) -+ return ERR_PTR(-EINVAL); -+ - filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL); - if (!filter) - return ERR_PTR(-ENOMEM); -diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index 740cce4685ac..85b4f7902b49 100644 ---- a/net/netfilter/nfnetlink_log.c -+++ b/net/netfilter/nfnetlink_log.c -@@ -895,7 +895,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb, - goto out_put; - default: - ret = -ENOTSUPP; -- break; -+ goto out_put; - } - } else if (!inst) { - ret = -ENODEV; -diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c -index 04f060488686..96277ac37dac 100644 ---- a/net/nfc/llcp_commands.c -+++ b/net/nfc/llcp_commands.c -@@ -419,6 +419,10 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) - sock->service_name, - sock->service_name_len, - &service_name_tlv_length); -+ if (!service_name_tlv) { -+ err = -ENOMEM; -+ goto error_tlv; -+ } - size += service_name_tlv_length; - } - -@@ -429,9 +433,17 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock) - - miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0, - &miux_tlv_length); -+ if (!miux_tlv) { -+ err = -ENOMEM; -+ goto error_tlv; -+ } - size += miux_tlv_length; - - rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length); -+ if (!rw_tlv) { -+ err = -ENOMEM; -+ goto error_tlv; -+ } - size += rw_tlv_length; - - pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len); -@@ -486,9 +498,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock) - - miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0, - &miux_tlv_length); -+ if (!miux_tlv) { -+ err = -ENOMEM; -+ goto error_tlv; -+ } - size += miux_tlv_length; - - rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length); -+ if (!rw_tlv) { -+ err = -ENOMEM; -+ goto error_tlv; -+ } - size += rw_tlv_length; - - skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size); -diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c -index 98876274a1ee..c1334b826dd5 100644 ---- a/net/nfc/llcp_core.c -+++ b/net/nfc/llcp_core.c -@@ -532,10 +532,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(struct nfc_llcp_local *local) - - static int nfc_llcp_build_gb(struct nfc_llcp_local *local) - { -- u8 *gb_cur, *version_tlv, version, version_length; -- u8 *lto_tlv, lto_length; -- u8 *wks_tlv, wks_length; -- u8 *miux_tlv, miux_length; -+ u8 *gb_cur, version, version_length; -+ u8 lto_length, wks_length, miux_length; -+ u8 *version_tlv = NULL, *lto_tlv = NULL, -+ *wks_tlv = NULL, *miux_tlv = NULL; - __be16 wks = cpu_to_be16(local->local_wks); - u8 gb_len = 0; - int ret = 0; -@@ -543,17 +543,33 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local) - version = LLCP_VERSION_11; - version_tlv = nfc_llcp_build_tlv(LLCP_TLV_VERSION, &version, - 1, &version_length); -+ if (!version_tlv) { -+ ret = -ENOMEM; -+ goto out; -+ } - gb_len += version_length; - - lto_tlv = nfc_llcp_build_tlv(LLCP_TLV_LTO, &local->lto, 1, <o_length); -+ if (!lto_tlv) { -+ ret = -ENOMEM; -+ goto out; -+ } - gb_len += lto_length; - - pr_debug("Local wks 0x%lx\n", local->local_wks); - wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&wks, 2, &wks_length); -+ if (!wks_tlv) { -+ ret = -ENOMEM; -+ goto out; -+ } - gb_len += wks_length; - - miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0, - &miux_length); -+ if (!miux_tlv) { -+ ret = -ENOMEM; -+ goto out; -+ } - gb_len += miux_length; - - gb_len += ARRAY_SIZE(llcp_magic); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 753b2837318d..d517dd7f4ac7 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4217,7 +4217,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - rb->frames_per_block = req->tp_block_size / req->tp_frame_size; - if (unlikely(rb->frames_per_block == 0)) - goto out; -- if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) -+ if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr)) - goto out; - if (unlikely((rb->frames_per_block * req->tp_block_nr) != - req->tp_frame_nr)) -diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index 850a86cde0b3..f6aa532bcbf6 100644 ---- a/net/phonet/pep.c -+++ b/net/phonet/pep.c -@@ -131,7 +131,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code, - ph->utid = 0; - ph->message_id = id; - ph->pipe_handle = pn->pipe_handle; -- ph->data[0] = code; -+ ph->error_code = code; - return pn_skb_send(sk, skb, NULL); - } - -@@ -152,7 +152,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code, - ph->utid = id; /* whatever */ - ph->message_id = id; - ph->pipe_handle = pn->pipe_handle; -- ph->data[0] = code; -+ ph->error_code = code; - return pn_skb_send(sk, skb, NULL); - } - -@@ -207,7 +207,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, - struct pnpipehdr *ph; - struct sockaddr_pn dst; - u8 data[4] = { -- oph->data[0], /* PEP type */ -+ oph->pep_type, /* PEP type */ - code, /* error code, at an unusual offset */ - PAD, PAD, - }; -@@ -220,7 +220,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code, - ph->utid = oph->utid; - ph->message_id = PNS_PEP_CTRL_RESP; - ph->pipe_handle = oph->pipe_handle; -- ph->data[0] = oph->data[1]; /* CTRL id */ -+ ph->data0 = oph->data[0]; /* CTRL id */ - - pn_skb_get_src_sockaddr(oskb, &dst); - return pn_skb_send(sk, skb, &dst); -@@ -271,17 +271,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) - return -EINVAL; - - hdr = pnp_hdr(skb); -- if (hdr->data[0] != PN_PEP_TYPE_COMMON) { -+ if (hdr->pep_type != PN_PEP_TYPE_COMMON) { - net_dbg_ratelimited("Phonet unknown PEP type: %u\n", -- (unsigned int)hdr->data[0]); -+ (unsigned int)hdr->pep_type); - return -EOPNOTSUPP; - } - -- switch (hdr->data[1]) { -+ switch (hdr->data[0]) { - case PN_PEP_IND_FLOW_CONTROL: - switch (pn->tx_fc) { - case PN_LEGACY_FLOW_CONTROL: -- switch (hdr->data[4]) { -+ switch (hdr->data[3]) { - case PEP_IND_BUSY: - atomic_set(&pn->tx_credits, 0); - break; -@@ -291,7 +291,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) - } - break; - case PN_ONE_CREDIT_FLOW_CONTROL: -- if (hdr->data[4] == PEP_IND_READY) -+ if (hdr->data[3] == PEP_IND_READY) - atomic_set(&pn->tx_credits, wake = 1); - break; - } -@@ -300,12 +300,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb) - case PN_PEP_IND_ID_MCFC_GRANT_CREDITS: - if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL) - break; -- atomic_add(wake = hdr->data[4], &pn->tx_credits); -+ atomic_add(wake = hdr->data[3], &pn->tx_credits); - break; - - default: - net_dbg_ratelimited("Phonet unknown PEP indication: %u\n", -- (unsigned int)hdr->data[1]); -+ (unsigned int)hdr->data[0]); - return -EOPNOTSUPP; - } - if (wake) -@@ -317,7 +317,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb) - { - struct pep_sock *pn = pep_sk(sk); - struct pnpipehdr *hdr = pnp_hdr(skb); -- u8 n_sb = hdr->data[0]; -+ u8 n_sb = hdr->data0; - - pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL; - __skb_pull(skb, sizeof(*hdr)); -@@ -505,7 +505,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb) - return -ECONNREFUSED; - - /* Parse sub-blocks */ -- n_sb = hdr->data[4]; -+ n_sb = hdr->data[3]; - while (n_sb > 0) { - u8 type, buf[6], len = sizeof(buf); - const u8 *data = pep_get_sb(skb, &type, &len, buf); -@@ -738,7 +738,7 @@ static int pipe_do_remove(struct sock *sk) - ph->utid = 0; - ph->message_id = PNS_PIPE_REMOVE_REQ; - ph->pipe_handle = pn->pipe_handle; -- ph->data[0] = PAD; -+ ph->data0 = PAD; - return pn_skb_send(sk, skb, NULL); - } - -@@ -815,7 +815,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp) - peer_type = hdr->other_pep_type << 8; - - /* Parse sub-blocks (options) */ -- n_sb = hdr->data[4]; -+ n_sb = hdr->data[3]; - while (n_sb > 0) { - u8 type, buf[1], len = sizeof(buf); - const u8 *data = pep_get_sb(skb, &type, &len, buf); -@@ -1106,7 +1106,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb) - ph->utid = 0; - if (pn->aligned) { - ph->message_id = PNS_PIPE_ALIGNED_DATA; -- ph->data[0] = 0; /* padding */ -+ ph->data0 = 0; /* padding */ - } else - ph->message_id = PNS_PIPE_DATA; - ph->pipe_handle = pn->pipe_handle; -diff --git a/net/socket.c b/net/socket.c -index 96133777d17c..e5bb73eb36fe 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -470,27 +470,15 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) - static ssize_t sockfs_getxattr(struct dentry *dentry, - const char *name, void *value, size_t size) - { -- const char *proto_name; -- size_t proto_size; -- int error; -- -- error = -ENODATA; -- if (!strncmp(name, XATTR_NAME_SOCKPROTONAME, XATTR_NAME_SOCKPROTONAME_LEN)) { -- proto_name = dentry->d_name.name; -- proto_size = strlen(proto_name); -- -+ if (!strcmp(name, XATTR_NAME_SOCKPROTONAME)) { - if (value) { -- error = -ERANGE; -- if (proto_size + 1 > size) -- goto out; -- -- strncpy(value, proto_name, proto_size + 1); -+ if (dentry->d_name.len + 1 > size) -+ return -ERANGE; -+ memcpy(value, dentry->d_name.name, dentry->d_name.len + 1); - } -- error = proto_size + 1; -+ return dentry->d_name.len + 1; - } -- --out: -- return error; -+ return -EOPNOTSUPP; - } - - static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer, -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index c6b1eec94911..b1a72615fdc3 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -890,7 +890,7 @@ retry: - addr->hash ^= sk->sk_type; - - __unix_remove_socket(sk); -- u->addr = addr; -+ smp_store_release(&u->addr, addr); - __unix_insert_socket(&unix_socket_table[addr->hash], sk); - spin_unlock(&unix_table_lock); - err = 0; -@@ -1060,7 +1060,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - - err = 0; - __unix_remove_socket(sk); -- u->addr = addr; -+ smp_store_release(&u->addr, addr); - __unix_insert_socket(list, sk); - - out_unlock: -@@ -1331,15 +1331,29 @@ restart: - RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq); - otheru = unix_sk(other); - -- /* copy address information from listening to new sock*/ -- if (otheru->addr) { -- atomic_inc(&otheru->addr->refcnt); -- newu->addr = otheru->addr; -- } -+ /* copy address information from listening to new sock -+ * -+ * The contents of *(otheru->addr) and otheru->path -+ * are seen fully set up here, since we have found -+ * otheru in hash under unix_table_lock. Insertion -+ * into the hash chain we'd found it in had been done -+ * in an earlier critical area protected by unix_table_lock, -+ * the same one where we'd set *(otheru->addr) contents, -+ * as well as otheru->path and otheru->addr itself. -+ * -+ * Using smp_store_release() here to set newu->addr -+ * is enough to make those stores, as well as stores -+ * to newu->path visible to anyone who gets newu->addr -+ * by smp_load_acquire(). IOW, the same warranties -+ * as for unix_sock instances bound in unix_bind() or -+ * in unix_autobind(). -+ */ - if (otheru->path.dentry) { - path_get(&otheru->path); - newu->path = otheru->path; - } -+ atomic_inc(&otheru->addr->refcnt); -+ smp_store_release(&newu->addr, otheru->addr); - - /* Set credentials */ - copy_peercred(sk, other); -@@ -1452,7 +1466,7 @@ out: - static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer) - { - struct sock *sk = sock->sk; -- struct unix_sock *u; -+ struct unix_address *addr; - DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr); - int err = 0; - -@@ -1467,19 +1481,15 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_ - sock_hold(sk); - } - -- u = unix_sk(sk); -- unix_state_lock(sk); -- if (!u->addr) { -+ addr = smp_load_acquire(&unix_sk(sk)->addr); -+ if (!addr) { - sunaddr->sun_family = AF_UNIX; - sunaddr->sun_path[0] = 0; - *uaddr_len = sizeof(short); - } else { -- struct unix_address *addr = u->addr; -- - *uaddr_len = addr->len; - memcpy(sunaddr, addr->name, *uaddr_len); - } -- unix_state_unlock(sk); - sock_put(sk); - out: - return err; -@@ -2093,11 +2103,11 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg, - - static void unix_copy_addr(struct msghdr *msg, struct sock *sk) - { -- struct unix_sock *u = unix_sk(sk); -+ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); - -- if (u->addr) { -- msg->msg_namelen = u->addr->len; -- memcpy(msg->msg_name, u->addr->name, u->addr->len); -+ if (addr) { -+ msg->msg_namelen = addr->len; -+ memcpy(msg->msg_name, addr->name, addr->len); - } - } - -@@ -2820,7 +2830,7 @@ static int unix_seq_show(struct seq_file *seq, void *v) - (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING), - sock_i_ino(s)); - -- if (u->addr) { -+ if (u->addr) { // under unix_table_lock here - int i, len; - seq_putc(seq, ' '); - -diff --git a/net/unix/diag.c b/net/unix/diag.c -index 384c84e83462..3183d9b8ab33 100644 ---- a/net/unix/diag.c -+++ b/net/unix/diag.c -@@ -10,7 +10,8 @@ - - static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb) - { -- struct unix_address *addr = unix_sk(sk)->addr; -+ /* might or might not have unix_table_lock */ -+ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr); - - if (!addr) - return 0; -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 50dffd183cc6..429abf421906 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -780,7 +780,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range, - * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), - * however it is safe for now to assume that a frequency rule should not be - * part of a frequency's band if the start freq or end freq are off by more -- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the -+ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the - * 60 GHz band. - * This resolution can be lowered and should be considered as we add - * regulatory rule support for other "bands". -@@ -795,7 +795,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range, - * with the Channel starting frequency above 45 GHz. - */ - u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ? -- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; -+ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; - if (abs(freq_khz - freq_range->start_freq_khz) <= limit) - return true; - if (abs(freq_khz - freq_range->end_freq_khz) <= limit) -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index 8d7b2802d33f..5dca42dbc737 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -678,8 +678,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr; - int len, i, rc = 0; - -- if (!sock_flag(sk, SOCK_ZAPPED) || -- addr_len != sizeof(struct sockaddr_x25) || -+ if (addr_len != sizeof(struct sockaddr_x25) || - addr->sx25_family != AF_X25) { - rc = -EINVAL; - goto out; -@@ -694,9 +693,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - } - - lock_sock(sk); -- x25_sk(sk)->source_addr = addr->sx25_addr; -- x25_insert_socket(sk); -- sock_reset_flag(sk, SOCK_ZAPPED); -+ if (sock_flag(sk, SOCK_ZAPPED)) { -+ x25_sk(sk)->source_addr = addr->sx25_addr; -+ x25_insert_socket(sk); -+ sock_reset_flag(sk, SOCK_ZAPPED); -+ } else { -+ rc = -EINVAL; -+ } - release_sock(sk); - SOCK_DEBUG(sk, "x25_bind: socket is bound\n"); - out: -@@ -812,8 +815,13 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr, - sock->state = SS_CONNECTED; - rc = 0; - out_put_neigh: -- if (rc) -+ if (rc) { -+ read_lock_bh(&x25_list_lock); - x25_neigh_put(x25->neighbour); -+ x25->neighbour = NULL; -+ read_unlock_bh(&x25_list_lock); -+ x25->state = X25_STATE_0; -+ } - out_put_route: - x25_route_put(rt); - out: -diff --git a/security/keys/key.c b/security/keys/key.c -index 4d971bf88ac3..03160f1f1aa2 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -260,8 +260,8 @@ struct key *key_alloc(struct key_type *type, const char *desc, - - spin_lock(&user->lock); - if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) { -- if (user->qnkeys + 1 >= maxkeys || -- user->qnbytes + quotalen >= maxbytes || -+ if (user->qnkeys + 1 > maxkeys || -+ user->qnbytes + quotalen > maxbytes || - user->qnbytes + quotalen < user->qnbytes) - goto no_quota; - } -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index d5264f950ce1..737e60b3d4bd 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -628,9 +628,6 @@ static bool search_nested_keyrings(struct key *keyring, - BUG_ON((ctx->flags & STATE_CHECKS) == 0 || - (ctx->flags & STATE_CHECKS) == STATE_CHECKS); - -- if (ctx->index_key.description) -- ctx->index_key.desc_len = strlen(ctx->index_key.description); -- - /* Check to see if this top-level keyring is what we are looking for - * and whether it is valid or not. - */ -@@ -888,6 +885,7 @@ key_ref_t keyring_search(key_ref_t keyring, - struct keyring_search_context ctx = { - .index_key.type = type, - .index_key.description = description, -+ .index_key.desc_len = strlen(description), - .cred = current_cred(), - .match_data.cmp = key_default_cmp, - .match_data.raw_data = description, -diff --git a/security/keys/proc.c b/security/keys/proc.c -index 036128682463..f2c7e090a66d 100644 ---- a/security/keys/proc.c -+++ b/security/keys/proc.c -@@ -186,9 +186,8 @@ static int proc_keys_show(struct seq_file *m, void *v) - int rc; - - struct keyring_search_context ctx = { -- .index_key.type = key->type, -- .index_key.description = key->description, -- .cred = current_cred(), -+ .index_key = key->index_key, -+ .cred = m->file->f_cred, - .match_data.cmp = lookup_user_key_possessed, - .match_data.raw_data = key, - .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT, -@@ -208,11 +207,7 @@ static int proc_keys_show(struct seq_file *m, void *v) - } - } - -- /* check whether the current task is allowed to view the key (assuming -- * non-possession) -- * - the caller holds a spinlock, and thus the RCU read lock, making our -- * access to __current_cred() safe -- */ -+ /* check whether the current task is allowed to view the key */ - rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW); - if (rc < 0) - return 0; -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index 3ae3acf473c8..88172c163953 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -544,6 +544,7 @@ struct key *request_key_and_link(struct key_type *type, - struct keyring_search_context ctx = { - .index_key.type = type, - .index_key.description = description, -+ .index_key.desc_len = strlen(description), - .cred = current_cred(), - .match_data.cmp = key_default_cmp, - .match_data.raw_data = description, -diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c -index 217775fcd0f3..8882b729924d 100644 ---- a/security/keys/request_key_auth.c -+++ b/security/keys/request_key_auth.c -@@ -254,7 +254,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id) - struct key *authkey; - key_ref_t authkey_ref; - -- sprintf(description, "%x", target_id); -+ ctx.index_key.desc_len = sprintf(description, "%x", target_id); - - authkey_ref = search_process_keyrings(&ctx); - -diff --git a/security/lsm_audit.c b/security/lsm_audit.c -index cccbf3068cdc..331fd3bd0f39 100644 ---- a/security/lsm_audit.c -+++ b/security/lsm_audit.c -@@ -308,6 +308,7 @@ static void dump_common_audit_data(struct audit_buffer *ab, - if (a->u.net->sk) { - struct sock *sk = a->u.net->sk; - struct unix_sock *u; -+ struct unix_address *addr; - int len = 0; - char *p = NULL; - -@@ -338,14 +339,15 @@ static void dump_common_audit_data(struct audit_buffer *ab, - #endif - case AF_UNIX: - u = unix_sk(sk); -+ addr = smp_load_acquire(&u->addr); -+ if (!addr) -+ break; - if (u->path.dentry) { - audit_log_d_path(ab, " path=", &u->path); - break; - } -- if (!u->addr) -- break; -- len = u->addr->len-sizeof(short); -- p = &u->addr->name->sun_path[0]; -+ len = addr->len-sizeof(short); -+ p = &addr->name->sun_path[0]; - audit_log_format(ab, " path="); - if (*p) - audit_log_untrustedstring(ab, p); -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 6163bf3e8177..2272aee12871 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -500,7 +500,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) - { - /* first let's check the buffer parameter's */ - if (params->buffer.fragment_size == 0 || -- params->buffer.fragments > INT_MAX / params->buffer.fragment_size) -+ params->buffer.fragments > INT_MAX / params->buffer.fragment_size || -+ params->buffer.fragments == 0) - return -EINVAL; - - /* now codec parameters */ -diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c -index 1898fa4228ad..3a0361458597 100644 ---- a/sound/firewire/bebob/bebob.c -+++ b/sound/firewire/bebob/bebob.c -@@ -422,7 +422,19 @@ static const struct ieee1394_device_id bebob_id_table[] = { - /* Focusrite, SaffirePro 26 I/O */ - SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), - /* Focusrite, SaffirePro 10 I/O */ -- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec), -+ { -+ // The combination of vendor_id and model_id is the same as the -+ // same as the one of Liquid Saffire 56. -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_MODEL_ID | -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, -+ .vendor_id = VEN_FOCUSRITE, -+ .model_id = 0x000006, -+ .specifier_id = 0x00a02d, -+ .version = 0x010001, -+ .driver_data = (kernel_ulong_t)&saffirepro_10_spec, -+ }, - /* Focusrite, Saffire(no label and LE) */ - SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH, - &saffire_spec), -diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c -index e8adead8be00..a87836d4de15 100644 ---- a/sound/soc/fsl/fsl_esai.c -+++ b/sound/soc/fsl/fsl_esai.c -@@ -394,7 +394,8 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) - break; - case SND_SOC_DAIFMT_RIGHT_J: - /* Data on rising edge of bclk, frame high, right aligned */ -- xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; -+ xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; -+ xcr |= ESAI_xCR_xWA; - break; - case SND_SOC_DAIFMT_DSP_A: - /* Data on rising edge of bclk, frame high, 1clk before data */ -@@ -451,12 +452,12 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt) - return -EINVAL; - } - -- mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; -+ mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA; - regmap_update_bits(esai_priv->regmap, REG_ESAI_TCR, mask, xcr); - regmap_update_bits(esai_priv->regmap, REG_ESAI_RCR, mask, xcr); - - mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | -- ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; -+ ESAI_xCCR_xFSD | ESAI_xCCR_xCKD; - regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, mask, xccr); - regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, mask, xccr); - -diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c -index fc57da341d61..136df38c4536 100644 ---- a/sound/soc/fsl/imx-audmux.c -+++ b/sound/soc/fsl/imx-audmux.c -@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, - if (!buf) - return -ENOMEM; - -- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", -+ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", - pdcr, ptcr); - - if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "TxFS output from %s, ", - audmux_port_string((ptcr >> 27) & 0x7)); - else -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "TxFS input, "); - - if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "TxClk output from %s", - audmux_port_string((ptcr >> 22) & 0x7)); - else -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "TxClk input"); - -- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); - - if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "Port is symmetric"); - } else { - if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "RxFS output from %s, ", - audmux_port_string((ptcr >> 17) & 0x7)); - else -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "RxFS input, "); - - if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "RxClk output from %s", - audmux_port_string((ptcr >> 12) & 0x7)); - else -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "RxClk input"); - } - -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - "\nData received from %s\n", - audmux_port_string((pdcr >> 13) & 0x7)); - -diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c -index 3f8a1e10bed0..e5ca41ffa890 100644 ---- a/sound/soc/intel/boards/broadwell.c -+++ b/sound/soc/intel/boards/broadwell.c -@@ -191,7 +191,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { - .stream_name = "Loopback", - .cpu_dai_name = "Loopback Pin", - .platform_name = "haswell-pcm-audio", -- .dynamic = 0, -+ .dynamic = 1, - .codec_name = "snd-soc-dummy", - .codec_dai_name = "snd-soc-dummy-dai", - .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, -diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c -index 22558572cb9c..de955c2e8c4e 100644 ---- a/sound/soc/intel/boards/haswell.c -+++ b/sound/soc/intel/boards/haswell.c -@@ -145,7 +145,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { - .stream_name = "Loopback", - .cpu_dai_name = "Loopback Pin", - .platform_name = "haswell-pcm-audio", -- .dynamic = 0, -+ .dynamic = 1, - .codec_name = "snd-soc-dummy", - .codec_dai_name = "snd-soc-dummy-dai", - .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 0aefed8ab0cf..7e26d173da41 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -1943,19 +1943,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, - out = is_connected_output_ep(w, NULL); - } - -- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", -+ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", - w->name, w->power ? "On" : "Off", - w->force ? " (forced)" : "", in, out); - - if (w->reg >= 0) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - " - R%d(0x%x) mask 0x%x", - w->reg, w->reg, w->mask << w->shift); - -- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); - - if (w->sname) -- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", - w->sname, - w->active ? "active" : "inactive"); - -@@ -1968,7 +1968,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, - if (!p->connect) - continue; - -- ret += snprintf(buf + ret, PAGE_SIZE - ret, -+ ret += scnprintf(buf + ret, PAGE_SIZE - ret, - " %s \"%s\" \"%s\"\n", - (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", - p->name ? p->name : "static", -diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c -index c1e76feb3529..824f4d7fc41f 100644 ---- a/sound/soc/soc-topology.c -+++ b/sound/soc/soc-topology.c -@@ -1770,6 +1770,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, - struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id) - { - struct soc_tplg tplg; -+ int ret; - - /* setup parsing context */ - memset(&tplg, 0, sizeof(tplg)); -@@ -1783,7 +1784,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp, - tplg.bytes_ext_ops = ops->bytes_ext_ops; - tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count; - -- return soc_tplg_load(&tplg); -+ ret = soc_tplg_load(&tplg); -+ /* free the created components if fail to load topology */ -+ if (ret) -+ snd_soc_tplg_component_remove(comp, SND_SOC_TPLG_INDEX_ALL); -+ -+ return ret; - } - EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load); - -diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h -new file mode 100644 -index 000000000000..a5fa3195a230 ---- /dev/null -+++ b/tools/arch/x86/include/asm/cpufeatures.h -@@ -0,0 +1,336 @@ -+#ifndef _ASM_X86_CPUFEATURES_H -+#define _ASM_X86_CPUFEATURES_H -+ -+#ifndef _ASM_X86_REQUIRED_FEATURES_H -+#include -+#endif -+ -+#ifndef _ASM_X86_DISABLED_FEATURES_H -+#include -+#endif -+ -+/* -+ * Defines x86 CPU feature bits -+ */ -+#define NCAPINTS 19 /* N 32-bit words worth of info */ -+#define NBUGINTS 1 /* N 32-bit bug flags */ -+ -+/* -+ * Note: If the comment begins with a quoted string, that string is used -+ * in /proc/cpuinfo instead of the macro name. If the string is "", -+ * this feature bit is not displayed in /proc/cpuinfo at all. -+ */ -+ -+/* Intel-defined CPU features, CPUID level 0x00000001 (edx), word 0 */ -+#define X86_FEATURE_FPU ( 0*32+ 0) /* Onboard FPU */ -+#define X86_FEATURE_VME ( 0*32+ 1) /* Virtual Mode Extensions */ -+#define X86_FEATURE_DE ( 0*32+ 2) /* Debugging Extensions */ -+#define X86_FEATURE_PSE ( 0*32+ 3) /* Page Size Extensions */ -+#define X86_FEATURE_TSC ( 0*32+ 4) /* Time Stamp Counter */ -+#define X86_FEATURE_MSR ( 0*32+ 5) /* Model-Specific Registers */ -+#define X86_FEATURE_PAE ( 0*32+ 6) /* Physical Address Extensions */ -+#define X86_FEATURE_MCE ( 0*32+ 7) /* Machine Check Exception */ -+#define X86_FEATURE_CX8 ( 0*32+ 8) /* CMPXCHG8 instruction */ -+#define X86_FEATURE_APIC ( 0*32+ 9) /* Onboard APIC */ -+#define X86_FEATURE_SEP ( 0*32+11) /* SYSENTER/SYSEXIT */ -+#define X86_FEATURE_MTRR ( 0*32+12) /* Memory Type Range Registers */ -+#define X86_FEATURE_PGE ( 0*32+13) /* Page Global Enable */ -+#define X86_FEATURE_MCA ( 0*32+14) /* Machine Check Architecture */ -+#define X86_FEATURE_CMOV ( 0*32+15) /* CMOV instructions */ -+ /* (plus FCMOVcc, FCOMI with FPU) */ -+#define X86_FEATURE_PAT ( 0*32+16) /* Page Attribute Table */ -+#define X86_FEATURE_PSE36 ( 0*32+17) /* 36-bit PSEs */ -+#define X86_FEATURE_PN ( 0*32+18) /* Processor serial number */ -+#define X86_FEATURE_CLFLUSH ( 0*32+19) /* CLFLUSH instruction */ -+#define X86_FEATURE_DS ( 0*32+21) /* "dts" Debug Store */ -+#define X86_FEATURE_ACPI ( 0*32+22) /* ACPI via MSR */ -+#define X86_FEATURE_MMX ( 0*32+23) /* Multimedia Extensions */ -+#define X86_FEATURE_FXSR ( 0*32+24) /* FXSAVE/FXRSTOR, CR4.OSFXSR */ -+#define X86_FEATURE_XMM ( 0*32+25) /* "sse" */ -+#define X86_FEATURE_XMM2 ( 0*32+26) /* "sse2" */ -+#define X86_FEATURE_SELFSNOOP ( 0*32+27) /* "ss" CPU self snoop */ -+#define X86_FEATURE_HT ( 0*32+28) /* Hyper-Threading */ -+#define X86_FEATURE_ACC ( 0*32+29) /* "tm" Automatic clock control */ -+#define X86_FEATURE_IA64 ( 0*32+30) /* IA-64 processor */ -+#define X86_FEATURE_PBE ( 0*32+31) /* Pending Break Enable */ -+ -+/* AMD-defined CPU features, CPUID level 0x80000001, word 1 */ -+/* Don't duplicate feature flags which are redundant with Intel! */ -+#define X86_FEATURE_SYSCALL ( 1*32+11) /* SYSCALL/SYSRET */ -+#define X86_FEATURE_MP ( 1*32+19) /* MP Capable. */ -+#define X86_FEATURE_NX ( 1*32+20) /* Execute Disable */ -+#define X86_FEATURE_MMXEXT ( 1*32+22) /* AMD MMX extensions */ -+#define X86_FEATURE_FXSR_OPT ( 1*32+25) /* FXSAVE/FXRSTOR optimizations */ -+#define X86_FEATURE_GBPAGES ( 1*32+26) /* "pdpe1gb" GB pages */ -+#define X86_FEATURE_RDTSCP ( 1*32+27) /* RDTSCP */ -+#define X86_FEATURE_LM ( 1*32+29) /* Long Mode (x86-64) */ -+#define X86_FEATURE_3DNOWEXT ( 1*32+30) /* AMD 3DNow! extensions */ -+#define X86_FEATURE_3DNOW ( 1*32+31) /* 3DNow! */ -+ -+/* Transmeta-defined CPU features, CPUID level 0x80860001, word 2 */ -+#define X86_FEATURE_RECOVERY ( 2*32+ 0) /* CPU in recovery mode */ -+#define X86_FEATURE_LONGRUN ( 2*32+ 1) /* Longrun power control */ -+#define X86_FEATURE_LRTI ( 2*32+ 3) /* LongRun table interface */ -+ -+/* Other features, Linux-defined mapping, word 3 */ -+/* This range is used for feature bits which conflict or are synthesized */ -+#define X86_FEATURE_CXMMX ( 3*32+ 0) /* Cyrix MMX extensions */ -+#define X86_FEATURE_K6_MTRR ( 3*32+ 1) /* AMD K6 nonstandard MTRRs */ -+#define X86_FEATURE_CYRIX_ARR ( 3*32+ 2) /* Cyrix ARRs (= MTRRs) */ -+#define X86_FEATURE_CENTAUR_MCR ( 3*32+ 3) /* Centaur MCRs (= MTRRs) */ -+/* cpu types for specific tunings: */ -+#define X86_FEATURE_K8 ( 3*32+ 4) /* "" Opteron, Athlon64 */ -+#define X86_FEATURE_K7 ( 3*32+ 5) /* "" Athlon */ -+#define X86_FEATURE_P3 ( 3*32+ 6) /* "" P3 */ -+#define X86_FEATURE_P4 ( 3*32+ 7) /* "" P4 */ -+#define X86_FEATURE_CONSTANT_TSC ( 3*32+ 8) /* TSC ticks at a constant rate */ -+#define X86_FEATURE_UP ( 3*32+ 9) /* smp kernel running on up */ -+/* free, was #define X86_FEATURE_FXSAVE_LEAK ( 3*32+10) * "" FXSAVE leaks FOP/FIP/FOP */ -+#define X86_FEATURE_ARCH_PERFMON ( 3*32+11) /* Intel Architectural PerfMon */ -+#define X86_FEATURE_PEBS ( 3*32+12) /* Precise-Event Based Sampling */ -+#define X86_FEATURE_BTS ( 3*32+13) /* Branch Trace Store */ -+#define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in ia32 userspace */ -+#define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in ia32 userspace */ -+#define X86_FEATURE_REP_GOOD ( 3*32+16) /* rep microcode works well */ -+#define X86_FEATURE_MFENCE_RDTSC ( 3*32+17) /* "" Mfence synchronizes RDTSC */ -+#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" Lfence synchronizes RDTSC */ -+/* free, was #define X86_FEATURE_11AP ( 3*32+19) * "" Bad local APIC aka 11AP */ -+#define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ -+#define X86_FEATURE_ALWAYS ( 3*32+21) /* "" Always-present feature */ -+#define X86_FEATURE_XTOPOLOGY ( 3*32+22) /* cpu topology enum extensions */ -+#define X86_FEATURE_TSC_RELIABLE ( 3*32+23) /* TSC is known to be reliable */ -+#define X86_FEATURE_NONSTOP_TSC ( 3*32+24) /* TSC does not stop in C states */ -+/* free, was #define X86_FEATURE_CLFLUSH_MONITOR ( 3*32+25) * "" clflush reqd with monitor */ -+#define X86_FEATURE_EXTD_APICID ( 3*32+26) /* has extended APICID (8 bits) */ -+#define X86_FEATURE_AMD_DCM ( 3*32+27) /* multi-node processor */ -+#define X86_FEATURE_APERFMPERF ( 3*32+28) /* APERFMPERF */ -+#define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ -+ -+/* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ -+#define X86_FEATURE_XMM3 ( 4*32+ 0) /* "pni" SSE-3 */ -+#define X86_FEATURE_PCLMULQDQ ( 4*32+ 1) /* PCLMULQDQ instruction */ -+#define X86_FEATURE_DTES64 ( 4*32+ 2) /* 64-bit Debug Store */ -+#define X86_FEATURE_MWAIT ( 4*32+ 3) /* "monitor" Monitor/Mwait support */ -+#define X86_FEATURE_DSCPL ( 4*32+ 4) /* "ds_cpl" CPL Qual. Debug Store */ -+#define X86_FEATURE_VMX ( 4*32+ 5) /* Hardware virtualization */ -+#define X86_FEATURE_SMX ( 4*32+ 6) /* Safer mode */ -+#define X86_FEATURE_EST ( 4*32+ 7) /* Enhanced SpeedStep */ -+#define X86_FEATURE_TM2 ( 4*32+ 8) /* Thermal Monitor 2 */ -+#define X86_FEATURE_SSSE3 ( 4*32+ 9) /* Supplemental SSE-3 */ -+#define X86_FEATURE_CID ( 4*32+10) /* Context ID */ -+#define X86_FEATURE_SDBG ( 4*32+11) /* Silicon Debug */ -+#define X86_FEATURE_FMA ( 4*32+12) /* Fused multiply-add */ -+#define X86_FEATURE_CX16 ( 4*32+13) /* CMPXCHG16B */ -+#define X86_FEATURE_XTPR ( 4*32+14) /* Send Task Priority Messages */ -+#define X86_FEATURE_PDCM ( 4*32+15) /* Performance Capabilities */ -+#define X86_FEATURE_PCID ( 4*32+17) /* Process Context Identifiers */ -+#define X86_FEATURE_DCA ( 4*32+18) /* Direct Cache Access */ -+#define X86_FEATURE_XMM4_1 ( 4*32+19) /* "sse4_1" SSE-4.1 */ -+#define X86_FEATURE_XMM4_2 ( 4*32+20) /* "sse4_2" SSE-4.2 */ -+#define X86_FEATURE_X2APIC ( 4*32+21) /* x2APIC */ -+#define X86_FEATURE_MOVBE ( 4*32+22) /* MOVBE instruction */ -+#define X86_FEATURE_POPCNT ( 4*32+23) /* POPCNT instruction */ -+#define X86_FEATURE_TSC_DEADLINE_TIMER ( 4*32+24) /* Tsc deadline timer */ -+#define X86_FEATURE_AES ( 4*32+25) /* AES instructions */ -+#define X86_FEATURE_XSAVE ( 4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */ -+#define X86_FEATURE_OSXSAVE ( 4*32+27) /* "" XSAVE enabled in the OS */ -+#define X86_FEATURE_AVX ( 4*32+28) /* Advanced Vector Extensions */ -+#define X86_FEATURE_F16C ( 4*32+29) /* 16-bit fp conversions */ -+#define X86_FEATURE_RDRAND ( 4*32+30) /* The RDRAND instruction */ -+#define X86_FEATURE_HYPERVISOR ( 4*32+31) /* Running on a hypervisor */ -+ -+/* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */ -+#define X86_FEATURE_XSTORE ( 5*32+ 2) /* "rng" RNG present (xstore) */ -+#define X86_FEATURE_XSTORE_EN ( 5*32+ 3) /* "rng_en" RNG enabled */ -+#define X86_FEATURE_XCRYPT ( 5*32+ 6) /* "ace" on-CPU crypto (xcrypt) */ -+#define X86_FEATURE_XCRYPT_EN ( 5*32+ 7) /* "ace_en" on-CPU crypto enabled */ -+#define X86_FEATURE_ACE2 ( 5*32+ 8) /* Advanced Cryptography Engine v2 */ -+#define X86_FEATURE_ACE2_EN ( 5*32+ 9) /* ACE v2 enabled */ -+#define X86_FEATURE_PHE ( 5*32+10) /* PadLock Hash Engine */ -+#define X86_FEATURE_PHE_EN ( 5*32+11) /* PHE enabled */ -+#define X86_FEATURE_PMM ( 5*32+12) /* PadLock Montgomery Multiplier */ -+#define X86_FEATURE_PMM_EN ( 5*32+13) /* PMM enabled */ -+ -+/* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */ -+#define X86_FEATURE_LAHF_LM ( 6*32+ 0) /* LAHF/SAHF in long mode */ -+#define X86_FEATURE_CMP_LEGACY ( 6*32+ 1) /* If yes HyperThreading not valid */ -+#define X86_FEATURE_SVM ( 6*32+ 2) /* Secure virtual machine */ -+#define X86_FEATURE_EXTAPIC ( 6*32+ 3) /* Extended APIC space */ -+#define X86_FEATURE_CR8_LEGACY ( 6*32+ 4) /* CR8 in 32-bit mode */ -+#define X86_FEATURE_ABM ( 6*32+ 5) /* Advanced bit manipulation */ -+#define X86_FEATURE_SSE4A ( 6*32+ 6) /* SSE-4A */ -+#define X86_FEATURE_MISALIGNSSE ( 6*32+ 7) /* Misaligned SSE mode */ -+#define X86_FEATURE_3DNOWPREFETCH ( 6*32+ 8) /* 3DNow prefetch instructions */ -+#define X86_FEATURE_OSVW ( 6*32+ 9) /* OS Visible Workaround */ -+#define X86_FEATURE_IBS ( 6*32+10) /* Instruction Based Sampling */ -+#define X86_FEATURE_XOP ( 6*32+11) /* extended AVX instructions */ -+#define X86_FEATURE_SKINIT ( 6*32+12) /* SKINIT/STGI instructions */ -+#define X86_FEATURE_WDT ( 6*32+13) /* Watchdog timer */ -+#define X86_FEATURE_LWP ( 6*32+15) /* Light Weight Profiling */ -+#define X86_FEATURE_FMA4 ( 6*32+16) /* 4 operands MAC instructions */ -+#define X86_FEATURE_TCE ( 6*32+17) /* translation cache extension */ -+#define X86_FEATURE_NODEID_MSR ( 6*32+19) /* NodeId MSR */ -+#define X86_FEATURE_TBM ( 6*32+21) /* trailing bit manipulations */ -+#define X86_FEATURE_TOPOEXT ( 6*32+22) /* topology extensions CPUID leafs */ -+#define X86_FEATURE_PERFCTR_CORE ( 6*32+23) /* core performance counter extensions */ -+#define X86_FEATURE_PERFCTR_NB ( 6*32+24) /* NB performance counter extensions */ -+#define X86_FEATURE_BPEXT (6*32+26) /* data breakpoint extension */ -+#define X86_FEATURE_PERFCTR_L2 ( 6*32+28) /* L2 performance counter extensions */ -+#define X86_FEATURE_MWAITX ( 6*32+29) /* MWAIT extension (MONITORX/MWAITX) */ -+ -+/* -+ * Auxiliary flags: Linux defined - For features scattered in various -+ * CPUID levels like 0x6, 0xA etc, word 7. -+ * -+ * Reuse free bits when adding new feature flags! -+ */ -+ -+#define X86_FEATURE_CPB ( 7*32+ 2) /* AMD Core Performance Boost */ -+#define X86_FEATURE_EPB ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */ -+#define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 4) /* Effectively INVPCID && CR4.PCIDE=1 */ -+ -+#define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ -+#define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ -+ -+#define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ -+#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ -+ -+#define X86_FEATURE_INTEL_PT ( 7*32+15) /* Intel Processor Trace */ -+#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ -+ -+#define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */ -+#define X86_FEATURE_SSBD ( 7*32+17) /* Speculative Store Bypass Disable */ -+ -+/* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */ -+#define X86_FEATURE_KAISER ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */ -+ -+#define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled*/ -+#define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ -+#define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23) /* "" Disable Speculative Store Bypass. */ -+#define X86_FEATURE_LS_CFG_SSBD ( 7*32+24) /* "" AMD SSBD implementation */ -+ -+#define X86_FEATURE_IBRS ( 7*32+25) /* Indirect Branch Restricted Speculation */ -+#define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */ -+#define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */ -+#define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ -+#define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */ -+ -+/* Virtualization flags: Linux defined, word 8 */ -+#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ -+#define X86_FEATURE_VNMI ( 8*32+ 1) /* Intel Virtual NMI */ -+#define X86_FEATURE_FLEXPRIORITY ( 8*32+ 2) /* Intel FlexPriority */ -+#define X86_FEATURE_EPT ( 8*32+ 3) /* Intel Extended Page Table */ -+#define X86_FEATURE_VPID ( 8*32+ 4) /* Intel Virtual Processor ID */ -+ -+#define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer vmmcall to vmcall */ -+#define X86_FEATURE_XENPV ( 8*32+16) /* "" Xen paravirtual guest */ -+ -+ -+/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */ -+#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/ -+#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3b */ -+#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */ -+#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */ -+#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */ -+#define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Protection */ -+#define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */ -+#define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */ -+#define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */ -+#define X86_FEATURE_RTM ( 9*32+11) /* Restricted Transactional Memory */ -+#define X86_FEATURE_CQM ( 9*32+12) /* Cache QoS Monitoring */ -+#define X86_FEATURE_MPX ( 9*32+14) /* Memory Protection Extension */ -+#define X86_FEATURE_AVX512F ( 9*32+16) /* AVX-512 Foundation */ -+#define X86_FEATURE_RDSEED ( 9*32+18) /* The RDSEED instruction */ -+#define X86_FEATURE_ADX ( 9*32+19) /* The ADCX and ADOX instructions */ -+#define X86_FEATURE_SMAP ( 9*32+20) /* Supervisor Mode Access Prevention */ -+#define X86_FEATURE_PCOMMIT ( 9*32+22) /* PCOMMIT instruction */ -+#define X86_FEATURE_CLFLUSHOPT ( 9*32+23) /* CLFLUSHOPT instruction */ -+#define X86_FEATURE_CLWB ( 9*32+24) /* CLWB instruction */ -+#define X86_FEATURE_AVX512PF ( 9*32+26) /* AVX-512 Prefetch */ -+#define X86_FEATURE_AVX512ER ( 9*32+27) /* AVX-512 Exponential and Reciprocal */ -+#define X86_FEATURE_AVX512CD ( 9*32+28) /* AVX-512 Conflict Detection */ -+#define X86_FEATURE_SHA_NI ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */ -+ -+/* Extended state features, CPUID level 0x0000000d:1 (eax), word 10 */ -+#define X86_FEATURE_XSAVEOPT (10*32+ 0) /* XSAVEOPT */ -+#define X86_FEATURE_XSAVEC (10*32+ 1) /* XSAVEC */ -+#define X86_FEATURE_XGETBV1 (10*32+ 2) /* XGETBV with ECX = 1 */ -+#define X86_FEATURE_XSAVES (10*32+ 3) /* XSAVES/XRSTORS */ -+ -+/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (edx), word 11 */ -+#define X86_FEATURE_CQM_LLC (11*32+ 1) /* LLC QoS if 1 */ -+ -+/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (edx), word 12 */ -+#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring if 1 */ -+ -+/* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */ -+#define X86_FEATURE_CLZERO (13*32+0) /* CLZERO instruction */ -+#define X86_FEATURE_AMD_IBPB (13*32+12) /* Indirect Branch Prediction Barrier */ -+#define X86_FEATURE_AMD_IBRS (13*32+14) /* Indirect Branch Restricted Speculation */ -+#define X86_FEATURE_AMD_STIBP (13*32+15) /* Single Thread Indirect Branch Predictors */ -+#define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */ -+ -+/* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */ -+#define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */ -+#define X86_FEATURE_IDA (14*32+ 1) /* Intel Dynamic Acceleration */ -+#define X86_FEATURE_ARAT (14*32+ 2) /* Always Running APIC Timer */ -+#define X86_FEATURE_PLN (14*32+ 4) /* Intel Power Limit Notification */ -+#define X86_FEATURE_PTS (14*32+ 6) /* Intel Package Thermal Status */ -+#define X86_FEATURE_HWP (14*32+ 7) /* Intel Hardware P-states */ -+#define X86_FEATURE_HWP_NOTIFY (14*32+ 8) /* HWP Notification */ -+#define X86_FEATURE_HWP_ACT_WINDOW (14*32+ 9) /* HWP Activity Window */ -+#define X86_FEATURE_HWP_EPP (14*32+10) /* HWP Energy Perf. Preference */ -+#define X86_FEATURE_HWP_PKG_REQ (14*32+11) /* HWP Package Level Request */ -+ -+/* AMD SVM Feature Identification, CPUID level 0x8000000a (edx), word 15 */ -+#define X86_FEATURE_NPT (15*32+ 0) /* Nested Page Table support */ -+#define X86_FEATURE_LBRV (15*32+ 1) /* LBR Virtualization support */ -+#define X86_FEATURE_SVML (15*32+ 2) /* "svm_lock" SVM locking MSR */ -+#define X86_FEATURE_NRIPS (15*32+ 3) /* "nrip_save" SVM next_rip save */ -+#define X86_FEATURE_TSCRATEMSR (15*32+ 4) /* "tsc_scale" TSC scaling support */ -+#define X86_FEATURE_VMCBCLEAN (15*32+ 5) /* "vmcb_clean" VMCB clean bits support */ -+#define X86_FEATURE_FLUSHBYASID (15*32+ 6) /* flush-by-ASID support */ -+#define X86_FEATURE_DECODEASSISTS (15*32+ 7) /* Decode Assists support */ -+#define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */ -+#define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */ -+ -+/* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */ -+#define X86_FEATURE_PKU (16*32+ 3) /* Protection Keys for Userspace */ -+#define X86_FEATURE_OSPKE (16*32+ 4) /* OS Protection Keys Enable */ -+ -+/* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */ -+#define X86_FEATURE_OVERFLOW_RECOV (17*32+0) /* MCA overflow recovery support */ -+#define X86_FEATURE_SUCCOR (17*32+1) /* Uncorrectable error containment and recovery */ -+#define X86_FEATURE_SMCA (17*32+3) /* Scalable MCA */ -+ -+ -+/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ -+#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ -+#define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ -+#define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ -+#define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ -+#define X86_FEATURE_FLUSH_L1D (18*32+28) /* Flush L1D cache */ -+#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ -+#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ -+ -+/* -+ * BUG word(s) -+ */ -+#define X86_BUG(x) (NCAPINTS*32 + (x)) -+ -+#define X86_BUG_F00F X86_BUG(0) /* Intel F00F */ -+#define X86_BUG_FDIV X86_BUG(1) /* FPU FDIV */ -+#define X86_BUG_COMA X86_BUG(2) /* Cyrix 6x86 coma */ -+#define X86_BUG_AMD_TLB_MMATCH X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */ -+#define X86_BUG_AMD_APIC_C1E X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */ -+#define X86_BUG_11AP X86_BUG(5) /* Bad local APIC aka 11AP */ -+#define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ -+#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ -+#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ -+#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ -+#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ -+#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ -+#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ -+#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */ -+ -+#endif /* _ASM_X86_CPUFEATURES_H */ -diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h -new file mode 100644 -index 000000000000..1f8cca459c6c ---- /dev/null -+++ b/tools/arch/x86/include/asm/disabled-features.h -@@ -0,0 +1,65 @@ -+#ifndef _ASM_X86_DISABLED_FEATURES_H -+#define _ASM_X86_DISABLED_FEATURES_H -+ -+/* These features, although they might be available in a CPU -+ * will not be used because the compile options to support -+ * them are not present. -+ * -+ * This code allows them to be checked and disabled at -+ * compile time without an explicit #ifdef. Use -+ * cpu_feature_enabled(). -+ */ -+ -+#ifdef CONFIG_X86_INTEL_MPX -+# define DISABLE_MPX 0 -+#else -+# define DISABLE_MPX (1<<(X86_FEATURE_MPX & 31)) -+#endif -+ -+#ifdef CONFIG_X86_64 -+# define DISABLE_VME (1<<(X86_FEATURE_VME & 31)) -+# define DISABLE_K6_MTRR (1<<(X86_FEATURE_K6_MTRR & 31)) -+# define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31)) -+# define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31)) -+# define DISABLE_PCID 0 -+#else -+# define DISABLE_VME 0 -+# define DISABLE_K6_MTRR 0 -+# define DISABLE_CYRIX_ARR 0 -+# define DISABLE_CENTAUR_MCR 0 -+# define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31)) -+#endif /* CONFIG_X86_64 */ -+ -+#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS -+# define DISABLE_PKU 0 -+# define DISABLE_OSPKE 0 -+#else -+# define DISABLE_PKU (1<<(X86_FEATURE_PKU & 31)) -+# define DISABLE_OSPKE (1<<(X86_FEATURE_OSPKE & 31)) -+#endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */ -+ -+/* -+ * Make sure to add features to the correct mask -+ */ -+#define DISABLED_MASK0 (DISABLE_VME) -+#define DISABLED_MASK1 0 -+#define DISABLED_MASK2 0 -+#define DISABLED_MASK3 (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR) -+#define DISABLED_MASK4 (DISABLE_PCID) -+#define DISABLED_MASK5 0 -+#define DISABLED_MASK6 0 -+#define DISABLED_MASK7 0 -+#define DISABLED_MASK8 0 -+#define DISABLED_MASK9 (DISABLE_MPX) -+#define DISABLED_MASK10 0 -+#define DISABLED_MASK11 0 -+#define DISABLED_MASK12 0 -+#define DISABLED_MASK13 0 -+#define DISABLED_MASK14 0 -+#define DISABLED_MASK15 0 -+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE) -+#define DISABLED_MASK17 0 -+#define DISABLED_MASK18 0 -+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+ -+#endif /* _ASM_X86_DISABLED_FEATURES_H */ -diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h -new file mode 100644 -index 000000000000..6847d85400a8 ---- /dev/null -+++ b/tools/arch/x86/include/asm/required-features.h -@@ -0,0 +1,106 @@ -+#ifndef _ASM_X86_REQUIRED_FEATURES_H -+#define _ASM_X86_REQUIRED_FEATURES_H -+ -+/* Define minimum CPUID feature set for kernel These bits are checked -+ really early to actually display a visible error message before the -+ kernel dies. Make sure to assign features to the proper mask! -+ -+ Some requirements that are not in CPUID yet are also in the -+ CONFIG_X86_MINIMUM_CPU_FAMILY which is checked too. -+ -+ The real information is in arch/x86/Kconfig.cpu, this just converts -+ the CONFIGs into a bitmask */ -+ -+#ifndef CONFIG_MATH_EMULATION -+# define NEED_FPU (1<<(X86_FEATURE_FPU & 31)) -+#else -+# define NEED_FPU 0 -+#endif -+ -+#if defined(CONFIG_X86_PAE) || defined(CONFIG_X86_64) -+# define NEED_PAE (1<<(X86_FEATURE_PAE & 31)) -+#else -+# define NEED_PAE 0 -+#endif -+ -+#ifdef CONFIG_X86_CMPXCHG64 -+# define NEED_CX8 (1<<(X86_FEATURE_CX8 & 31)) -+#else -+# define NEED_CX8 0 -+#endif -+ -+#if defined(CONFIG_X86_CMOV) || defined(CONFIG_X86_64) -+# define NEED_CMOV (1<<(X86_FEATURE_CMOV & 31)) -+#else -+# define NEED_CMOV 0 -+#endif -+ -+#ifdef CONFIG_X86_USE_3DNOW -+# define NEED_3DNOW (1<<(X86_FEATURE_3DNOW & 31)) -+#else -+# define NEED_3DNOW 0 -+#endif -+ -+#if defined(CONFIG_X86_P6_NOP) || defined(CONFIG_X86_64) -+# define NEED_NOPL (1<<(X86_FEATURE_NOPL & 31)) -+#else -+# define NEED_NOPL 0 -+#endif -+ -+#ifdef CONFIG_MATOM -+# define NEED_MOVBE (1<<(X86_FEATURE_MOVBE & 31)) -+#else -+# define NEED_MOVBE 0 -+#endif -+ -+#ifdef CONFIG_X86_64 -+#ifdef CONFIG_PARAVIRT -+/* Paravirtualized systems may not have PSE or PGE available */ -+#define NEED_PSE 0 -+#define NEED_PGE 0 -+#else -+#define NEED_PSE (1<<(X86_FEATURE_PSE) & 31) -+#define NEED_PGE (1<<(X86_FEATURE_PGE) & 31) -+#endif -+#define NEED_MSR (1<<(X86_FEATURE_MSR & 31)) -+#define NEED_FXSR (1<<(X86_FEATURE_FXSR & 31)) -+#define NEED_XMM (1<<(X86_FEATURE_XMM & 31)) -+#define NEED_XMM2 (1<<(X86_FEATURE_XMM2 & 31)) -+#define NEED_LM (1<<(X86_FEATURE_LM & 31)) -+#else -+#define NEED_PSE 0 -+#define NEED_MSR 0 -+#define NEED_PGE 0 -+#define NEED_FXSR 0 -+#define NEED_XMM 0 -+#define NEED_XMM2 0 -+#define NEED_LM 0 -+#endif -+ -+#define REQUIRED_MASK0 (NEED_FPU|NEED_PSE|NEED_MSR|NEED_PAE|\ -+ NEED_CX8|NEED_PGE|NEED_FXSR|NEED_CMOV|\ -+ NEED_XMM|NEED_XMM2) -+#define SSE_MASK (NEED_XMM|NEED_XMM2) -+ -+#define REQUIRED_MASK1 (NEED_LM|NEED_3DNOW) -+ -+#define REQUIRED_MASK2 0 -+#define REQUIRED_MASK3 (NEED_NOPL) -+#define REQUIRED_MASK4 (NEED_MOVBE) -+#define REQUIRED_MASK5 0 -+#define REQUIRED_MASK6 0 -+#define REQUIRED_MASK7 0 -+#define REQUIRED_MASK8 0 -+#define REQUIRED_MASK9 0 -+#define REQUIRED_MASK10 0 -+#define REQUIRED_MASK11 0 -+#define REQUIRED_MASK12 0 -+#define REQUIRED_MASK13 0 -+#define REQUIRED_MASK14 0 -+#define REQUIRED_MASK15 0 -+#define REQUIRED_MASK16 0 -+#define REQUIRED_MASK17 0 -+#define REQUIRED_MASK18 0 -+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) -+ -+#endif /* _ASM_X86_REQUIRED_FEATURES_H */ -diff --git a/tools/arch/x86/lib/memcpy_64.S b/tools/arch/x86/lib/memcpy_64.S -new file mode 100644 -index 000000000000..a0de849435ad ---- /dev/null -+++ b/tools/arch/x86/lib/memcpy_64.S -@@ -0,0 +1,179 @@ -+/* Copyright 2002 Andi Kleen */ -+ -+#include -+#include -+#include -+ -+/* -+ * We build a jump to memcpy_orig by default which gets NOPped out on -+ * the majority of x86 CPUs which set REP_GOOD. In addition, CPUs which -+ * have the enhanced REP MOVSB/STOSB feature (ERMS), change those NOPs -+ * to a jmp to memcpy_erms which does the REP; MOVSB mem copy. -+ */ -+ -+.weak memcpy -+ -+/* -+ * memcpy - Copy a memory block. -+ * -+ * Input: -+ * rdi destination -+ * rsi source -+ * rdx count -+ * -+ * Output: -+ * rax original destination -+ */ -+ENTRY(__memcpy) -+ENTRY(memcpy) -+ ALTERNATIVE_2 "jmp memcpy_orig", "", X86_FEATURE_REP_GOOD, \ -+ "jmp memcpy_erms", X86_FEATURE_ERMS -+ -+ movq %rdi, %rax -+ movq %rdx, %rcx -+ shrq $3, %rcx -+ andl $7, %edx -+ rep movsq -+ movl %edx, %ecx -+ rep movsb -+ ret -+ENDPROC(memcpy) -+ENDPROC(__memcpy) -+ -+/* -+ * memcpy_erms() - enhanced fast string memcpy. This is faster and -+ * simpler than memcpy. Use memcpy_erms when possible. -+ */ -+ENTRY(memcpy_erms) -+ movq %rdi, %rax -+ movq %rdx, %rcx -+ rep movsb -+ ret -+ENDPROC(memcpy_erms) -+ -+ENTRY(memcpy_orig) -+ movq %rdi, %rax -+ -+ cmpq $0x20, %rdx -+ jb .Lhandle_tail -+ -+ /* -+ * We check whether memory false dependence could occur, -+ * then jump to corresponding copy mode. -+ */ -+ cmp %dil, %sil -+ jl .Lcopy_backward -+ subq $0x20, %rdx -+.Lcopy_forward_loop: -+ subq $0x20, %rdx -+ -+ /* -+ * Move in blocks of 4x8 bytes: -+ */ -+ movq 0*8(%rsi), %r8 -+ movq 1*8(%rsi), %r9 -+ movq 2*8(%rsi), %r10 -+ movq 3*8(%rsi), %r11 -+ leaq 4*8(%rsi), %rsi -+ -+ movq %r8, 0*8(%rdi) -+ movq %r9, 1*8(%rdi) -+ movq %r10, 2*8(%rdi) -+ movq %r11, 3*8(%rdi) -+ leaq 4*8(%rdi), %rdi -+ jae .Lcopy_forward_loop -+ addl $0x20, %edx -+ jmp .Lhandle_tail -+ -+.Lcopy_backward: -+ /* -+ * Calculate copy position to tail. -+ */ -+ addq %rdx, %rsi -+ addq %rdx, %rdi -+ subq $0x20, %rdx -+ /* -+ * At most 3 ALU operations in one cycle, -+ * so append NOPS in the same 16 bytes trunk. -+ */ -+ .p2align 4 -+.Lcopy_backward_loop: -+ subq $0x20, %rdx -+ movq -1*8(%rsi), %r8 -+ movq -2*8(%rsi), %r9 -+ movq -3*8(%rsi), %r10 -+ movq -4*8(%rsi), %r11 -+ leaq -4*8(%rsi), %rsi -+ movq %r8, -1*8(%rdi) -+ movq %r9, -2*8(%rdi) -+ movq %r10, -3*8(%rdi) -+ movq %r11, -4*8(%rdi) -+ leaq -4*8(%rdi), %rdi -+ jae .Lcopy_backward_loop -+ -+ /* -+ * Calculate copy position to head. -+ */ -+ addl $0x20, %edx -+ subq %rdx, %rsi -+ subq %rdx, %rdi -+.Lhandle_tail: -+ cmpl $16, %edx -+ jb .Lless_16bytes -+ -+ /* -+ * Move data from 16 bytes to 31 bytes. -+ */ -+ movq 0*8(%rsi), %r8 -+ movq 1*8(%rsi), %r9 -+ movq -2*8(%rsi, %rdx), %r10 -+ movq -1*8(%rsi, %rdx), %r11 -+ movq %r8, 0*8(%rdi) -+ movq %r9, 1*8(%rdi) -+ movq %r10, -2*8(%rdi, %rdx) -+ movq %r11, -1*8(%rdi, %rdx) -+ retq -+ .p2align 4 -+.Lless_16bytes: -+ cmpl $8, %edx -+ jb .Lless_8bytes -+ /* -+ * Move data from 8 bytes to 15 bytes. -+ */ -+ movq 0*8(%rsi), %r8 -+ movq -1*8(%rsi, %rdx), %r9 -+ movq %r8, 0*8(%rdi) -+ movq %r9, -1*8(%rdi, %rdx) -+ retq -+ .p2align 4 -+.Lless_8bytes: -+ cmpl $4, %edx -+ jb .Lless_3bytes -+ -+ /* -+ * Move data from 4 bytes to 7 bytes. -+ */ -+ movl (%rsi), %ecx -+ movl -4(%rsi, %rdx), %r8d -+ movl %ecx, (%rdi) -+ movl %r8d, -4(%rdi, %rdx) -+ retq -+ .p2align 4 -+.Lless_3bytes: -+ subl $1, %edx -+ jb .Lend -+ /* -+ * Move data from 1 bytes to 3 bytes. -+ */ -+ movzbl (%rsi), %ecx -+ jz .Lstore_1byte -+ movzbq 1(%rsi), %r8 -+ movzbq (%rsi, %rdx), %r9 -+ movb %r8b, 1(%rdi) -+ movb %r9b, (%rdi, %rdx) -+.Lstore_1byte: -+ movb %cl, (%rdi) -+ -+.Lend: -+ retq -+ENDPROC(memcpy_orig) -diff --git a/tools/arch/x86/lib/memset_64.S b/tools/arch/x86/lib/memset_64.S -new file mode 100644 -index 000000000000..c9c81227ea37 ---- /dev/null -+++ b/tools/arch/x86/lib/memset_64.S -@@ -0,0 +1,138 @@ -+/* Copyright 2002 Andi Kleen, SuSE Labs */ -+ -+#include -+#include -+#include -+ -+.weak memset -+ -+/* -+ * ISO C memset - set a memory block to a byte value. This function uses fast -+ * string to get better performance than the original function. The code is -+ * simpler and shorter than the orignal function as well. -+ * -+ * rdi destination -+ * rsi value (char) -+ * rdx count (bytes) -+ * -+ * rax original destination -+ */ -+ENTRY(memset) -+ENTRY(__memset) -+ /* -+ * Some CPUs support enhanced REP MOVSB/STOSB feature. It is recommended -+ * to use it when possible. If not available, use fast string instructions. -+ * -+ * Otherwise, use original memset function. -+ */ -+ ALTERNATIVE_2 "jmp memset_orig", "", X86_FEATURE_REP_GOOD, \ -+ "jmp memset_erms", X86_FEATURE_ERMS -+ -+ movq %rdi,%r9 -+ movq %rdx,%rcx -+ andl $7,%edx -+ shrq $3,%rcx -+ /* expand byte value */ -+ movzbl %sil,%esi -+ movabs $0x0101010101010101,%rax -+ imulq %rsi,%rax -+ rep stosq -+ movl %edx,%ecx -+ rep stosb -+ movq %r9,%rax -+ ret -+ENDPROC(memset) -+ENDPROC(__memset) -+ -+/* -+ * ISO C memset - set a memory block to a byte value. This function uses -+ * enhanced rep stosb to override the fast string function. -+ * The code is simpler and shorter than the fast string function as well. -+ * -+ * rdi destination -+ * rsi value (char) -+ * rdx count (bytes) -+ * -+ * rax original destination -+ */ -+ENTRY(memset_erms) -+ movq %rdi,%r9 -+ movb %sil,%al -+ movq %rdx,%rcx -+ rep stosb -+ movq %r9,%rax -+ ret -+ENDPROC(memset_erms) -+ -+ENTRY(memset_orig) -+ movq %rdi,%r10 -+ -+ /* expand byte value */ -+ movzbl %sil,%ecx -+ movabs $0x0101010101010101,%rax -+ imulq %rcx,%rax -+ -+ /* align dst */ -+ movl %edi,%r9d -+ andl $7,%r9d -+ jnz .Lbad_alignment -+.Lafter_bad_alignment: -+ -+ movq %rdx,%rcx -+ shrq $6,%rcx -+ jz .Lhandle_tail -+ -+ .p2align 4 -+.Lloop_64: -+ decq %rcx -+ movq %rax,(%rdi) -+ movq %rax,8(%rdi) -+ movq %rax,16(%rdi) -+ movq %rax,24(%rdi) -+ movq %rax,32(%rdi) -+ movq %rax,40(%rdi) -+ movq %rax,48(%rdi) -+ movq %rax,56(%rdi) -+ leaq 64(%rdi),%rdi -+ jnz .Lloop_64 -+ -+ /* Handle tail in loops. The loops should be faster than hard -+ to predict jump tables. */ -+ .p2align 4 -+.Lhandle_tail: -+ movl %edx,%ecx -+ andl $63&(~7),%ecx -+ jz .Lhandle_7 -+ shrl $3,%ecx -+ .p2align 4 -+.Lloop_8: -+ decl %ecx -+ movq %rax,(%rdi) -+ leaq 8(%rdi),%rdi -+ jnz .Lloop_8 -+ -+.Lhandle_7: -+ andl $7,%edx -+ jz .Lende -+ .p2align 4 -+.Lloop_1: -+ decl %edx -+ movb %al,(%rdi) -+ leaq 1(%rdi),%rdi -+ jnz .Lloop_1 -+ -+.Lende: -+ movq %r10,%rax -+ ret -+ -+.Lbad_alignment: -+ cmpq $7,%rdx -+ jbe .Lhandle_7 -+ movq %rax,(%rdi) /* unaligned store */ -+ movq $8,%r8 -+ subq %r9,%r8 -+ addq %r8,%rdi -+ subq %r8,%rdx -+ jmp .Lafter_bad_alignment -+.Lfinal: -+ENDPROC(memset_orig) -diff --git a/tools/include/asm/alternative-asm.h b/tools/include/asm/alternative-asm.h -new file mode 100644 -index 000000000000..2a4d1bfa2988 ---- /dev/null -+++ b/tools/include/asm/alternative-asm.h -@@ -0,0 +1,9 @@ -+#ifndef _TOOLS_ASM_ALTERNATIVE_ASM_H -+#define _TOOLS_ASM_ALTERNATIVE_ASM_H -+ -+/* Just disable it so we can build arch/x86/lib/memcpy_64.S for perf bench: */ -+ -+#define altinstruction_entry # -+#define ALTERNATIVE_2 # -+ -+#endif -diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST -index 39c38cb45b00..358b810057d6 100644 ---- a/tools/perf/MANIFEST -+++ b/tools/perf/MANIFEST -@@ -11,6 +11,11 @@ tools/arch/sparc/include/asm/barrier_32.h - tools/arch/sparc/include/asm/barrier_64.h - tools/arch/tile/include/asm/barrier.h - tools/arch/x86/include/asm/barrier.h -+tools/arch/x86/include/asm/cpufeatures.h -+tools/arch/x86/include/asm/disabled-features.h -+tools/arch/x86/include/asm/required-features.h -+tools/arch/x86/lib/memcpy_64.S -+tools/arch/x86/lib/memset_64.S - tools/arch/xtensa/include/asm/barrier.h - tools/scripts - tools/build -@@ -25,6 +30,7 @@ tools/lib/rbtree.c - tools/lib/symbol/kallsyms.c - tools/lib/symbol/kallsyms.h - tools/lib/util/find_next_bit.c -+tools/include/asm/alternative-asm.h - tools/include/asm/atomic.h - tools/include/asm/barrier.h - tools/include/asm/bug.h -@@ -65,8 +71,6 @@ include/linux/swab.h - arch/*/include/asm/unistd*.h - arch/*/include/uapi/asm/unistd*.h - arch/*/include/uapi/asm/perf_regs.h --arch/*/lib/memcpy*.S --arch/*/lib/memset*.S - include/linux/poison.h - include/linux/hw_breakpoint.h - include/uapi/linux/perf_event.h -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index b67e006d56cc..7e0837579f40 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -310,6 +310,21 @@ export srctree OUTPUT RM CC LD AR CFLAGS V BISON FLEX AWK - include $(srctree)/tools/build/Makefile.include - - $(PERF_IN): prepare FORCE -+ @(test -f ../../arch/x86/include/asm/disabled-features.h && ( \ -+ (diff -B ../arch/x86/include/asm/disabled-features.h ../../arch/x86/include/asm/disabled-features.h >/dev/null) \ -+ || echo "Warning: tools/arch/x86/include/asm/disabled-features.h differs from kernel" >&2 )) || true -+ @(test -f ../../arch/x86/include/asm/required-features.h && ( \ -+ (diff -B ../arch/x86/include/asm/required-features.h ../../arch/x86/include/asm/required-features.h >/dev/null) \ -+ || echo "Warning: tools/arch/x86/include/asm/required-features.h differs from kernel" >&2 )) || true -+ @(test -f ../../arch/x86/include/asm/cpufeatures.h && ( \ -+ (diff -B ../arch/x86/include/asm/cpufeatures.h ../../arch/x86/include/asm/cpufeatures.h >/dev/null) \ -+ || echo "Warning: tools/arch/x86/include/asm/cpufeatures.h differs from kernel" >&2 )) || true -+ @(test -f ../../arch/x86/lib/memcpy_64.S && ( \ -+ (diff -B ../arch/x86/lib/memcpy_64.S ../../arch/x86/lib/memcpy_64.S >/dev/null) \ -+ || echo "Warning: tools/arch/x86/lib/memcpy_64.S differs from kernel" >&2 )) || true -+ @(test -f ../../arch/x86/lib/memset_64.S && ( \ -+ (diff -B ../arch/x86/lib/memset_64.S ../../arch/x86/lib/memset_64.S >/dev/null) \ -+ || echo "Warning: tools/arch/x86/lib/memset_64.S differs from kernel" >&2 )) || true - $(Q)$(MAKE) $(build)=perf - - $(OUTPUT)perf: $(PERFLIBS) $(PERF_IN) $(LIBTRACEEVENT_DYNAMIC_LIST) -diff --git a/tools/perf/bench/mem-memcpy-x86-64-asm.S b/tools/perf/bench/mem-memcpy-x86-64-asm.S -index e4c2c30143b9..9d82c44a6d71 100644 ---- a/tools/perf/bench/mem-memcpy-x86-64-asm.S -+++ b/tools/perf/bench/mem-memcpy-x86-64-asm.S -@@ -1,7 +1,7 @@ - #define memcpy MEMCPY /* don't hide glibc's memcpy() */ - #define altinstr_replacement text - #define globl p2align 4; .globl --#include "../../../arch/x86/lib/memcpy_64.S" -+#include "../../arch/x86/lib/memcpy_64.S" - /* - * We need to provide note.GNU-stack section, saying that we want - * NOT executable stack. Otherwise the final linking will assume that -diff --git a/tools/perf/bench/mem-memset-x86-64-asm.S b/tools/perf/bench/mem-memset-x86-64-asm.S -index de278784c866..58407aa24c1b 100644 ---- a/tools/perf/bench/mem-memset-x86-64-asm.S -+++ b/tools/perf/bench/mem-memset-x86-64-asm.S -@@ -1,7 +1,7 @@ - #define memset MEMSET /* don't hide glibc's memset() */ - #define altinstr_replacement text - #define globl p2align 4; .globl --#include "../../../arch/x86/lib/memset_64.S" -+#include "../../arch/x86/lib/memset_64.S" - - /* - * We need to provide note.GNU-stack section, saying that we want -diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c -index 58426e7d320d..4b898b15643d 100644 ---- a/tools/perf/util/auxtrace.c -+++ b/tools/perf/util/auxtrace.c -@@ -1226,9 +1226,9 @@ static int __auxtrace_mmap__read(struct auxtrace_mmap *mm, - } - - /* padding must be written by fn() e.g. record__process_auxtrace() */ -- padding = size & 7; -+ padding = size & (PERF_AUXTRACE_RECORD_ALIGNMENT - 1); - if (padding) -- padding = 8 - padding; -+ padding = PERF_AUXTRACE_RECORD_ALIGNMENT - padding; - - memset(&ev, 0, sizeof(ev)); - ev.auxtrace.header.type = PERF_RECORD_AUXTRACE; -diff --git a/tools/perf/util/auxtrace.h b/tools/perf/util/auxtrace.h -index b86f90db1352..b6d6ccf630d9 100644 ---- a/tools/perf/util/auxtrace.h -+++ b/tools/perf/util/auxtrace.h -@@ -37,6 +37,9 @@ struct record_opts; - struct auxtrace_info_event; - struct events_stats; - -+/* Auxtrace records must have the same alignment as perf event records */ -+#define PERF_AUXTRACE_RECORD_ALIGNMENT 8 -+ - enum auxtrace_type { - PERF_AUXTRACE_UNKNOWN, - PERF_AUXTRACE_INTEL_PT, -diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c -index 10af1e7524fb..f1aae86f7f6c 100644 ---- a/tools/perf/util/cpumap.c -+++ b/tools/perf/util/cpumap.c -@@ -124,7 +124,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list) - if (!cpu_list) - return cpu_map__read_all_cpu_map(); - -- if (!isdigit(*cpu_list)) -+ /* -+ * must handle the case of empty cpumap to cover -+ * TOPOLOGY header for NUMA nodes with no CPU -+ * ( e.g., because of CPU hotplug) -+ */ -+ if (!isdigit(*cpu_list) && *cpu_list != '\0') - goto out; - - while (isdigit(*cpu_list)) { -@@ -171,8 +176,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list) - - if (nr_cpus > 0) - cpus = cpu_map__trim_new(nr_cpus, tmp_cpus); -- else -+ else if (*cpu_list != '\0') - cpus = cpu_map__default_new(); -+ else -+ cpus = cpu_map__dummy_new(); - invalid: - free(tmp_cpus); - out: -diff --git a/tools/perf/util/include/asm/alternative-asm.h b/tools/perf/util/include/asm/alternative-asm.h -deleted file mode 100644 -index 3a3a0f16456a..000000000000 ---- a/tools/perf/util/include/asm/alternative-asm.h -+++ /dev/null -@@ -1,9 +0,0 @@ --#ifndef _PERF_ASM_ALTERNATIVE_ASM_H --#define _PERF_ASM_ALTERNATIVE_ASM_H -- --/* Just disable it so we can build arch/x86/lib/memcpy_64.S for perf bench: */ -- --#define altinstruction_entry # --#define ALTERNATIVE_2 # -- --#endif -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index dc17c881275d..d01e2ce818f7 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -26,6 +26,7 @@ - - #include "../cache.h" - #include "../util.h" -+#include "../auxtrace.h" - - #include "intel-pt-insn-decoder.h" - #include "intel-pt-pkt-decoder.h" -@@ -1281,7 +1282,6 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder) - { - intel_pt_log("ERROR: Buffer overflow\n"); - intel_pt_clear_tx_flags(decoder); -- decoder->cbr = 0; - decoder->timestamp_insn_cnt = 0; - decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC; - decoder->overflow = true; -@@ -2321,6 +2321,34 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) - } - } - -+#define MAX_PADDING (PERF_AUXTRACE_RECORD_ALIGNMENT - 1) -+ -+/** -+ * adj_for_padding - adjust overlap to account for padding. -+ * @buf_b: second buffer -+ * @buf_a: first buffer -+ * @len_a: size of first buffer -+ * -+ * @buf_a might have up to 7 bytes of padding appended. Adjust the overlap -+ * accordingly. -+ * -+ * Return: A pointer into @buf_b from where non-overlapped data starts -+ */ -+static unsigned char *adj_for_padding(unsigned char *buf_b, -+ unsigned char *buf_a, size_t len_a) -+{ -+ unsigned char *p = buf_b - MAX_PADDING; -+ unsigned char *q = buf_a + len_a - MAX_PADDING; -+ int i; -+ -+ for (i = MAX_PADDING; i; i--, p++, q++) { -+ if (*p != *q) -+ break; -+ } -+ -+ return p; -+} -+ - /** - * intel_pt_find_overlap_tsc - determine start of non-overlapped trace data - * using TSC. -@@ -2371,8 +2399,11 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, - - /* Same TSC, so buffers are consecutive */ - if (!cmp && rem_b >= rem_a) { -+ unsigned char *start; -+ - *consecutive = true; -- return buf_b + len_b - (rem_b - rem_a); -+ start = buf_b + len_b - (rem_b - rem_a); -+ return adj_for_padding(start, buf_a, len_a); - } - if (cmp < 0) - return buf_b; /* tsc_a < tsc_b => no overlap */ -@@ -2435,7 +2466,7 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, - found = memmem(buf_a, len_a, buf_b, len_a); - if (found) { - *consecutive = true; -- return buf_b + len_a; -+ return adj_for_padding(buf_b + len_a, buf_a, len_a); - } - - /* Try again at next PSB in buffer 'a' */ -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 7c97ecaeae48..2070c02de3af 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -74,6 +74,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym) - return GELF_ST_TYPE(sym->st_info); - } - -+static inline uint8_t elf_sym__visibility(const GElf_Sym *sym) -+{ -+ return GELF_ST_VISIBILITY(sym->st_other); -+} -+ - #ifndef STT_GNU_IFUNC - #define STT_GNU_IFUNC 10 - #endif -@@ -98,7 +103,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym) - return elf_sym__type(sym) == STT_NOTYPE && - sym->st_name != 0 && - sym->st_shndx != SHN_UNDEF && -- sym->st_shndx != SHN_ABS; -+ sym->st_shndx != SHN_ABS && -+ elf_sym__visibility(sym) != STV_HIDDEN && -+ elf_sym__visibility(sym) != STV_INTERNAL; - } - - static bool elf_sym__is_a(GElf_Sym *sym, enum map_type type) -diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c -index 5d10f104f3eb..964df643509d 100644 ---- a/virt/kvm/arm/vgic.c -+++ b/virt/kvm/arm/vgic.c -@@ -821,7 +821,6 @@ static int vgic_handle_mmio_access(struct kvm_vcpu *vcpu, - struct vgic_dist *dist = &vcpu->kvm->arch.vgic; - struct vgic_io_device *iodev = container_of(this, - struct vgic_io_device, dev); -- struct kvm_run *run = vcpu->run; - const struct vgic_io_range *range; - struct kvm_exit_mmio mmio; - bool updated_state; -@@ -850,12 +849,6 @@ static int vgic_handle_mmio_access(struct kvm_vcpu *vcpu, - updated_state = false; - } - spin_unlock(&dist->lock); -- run->mmio.is_write = is_write; -- run->mmio.len = len; -- run->mmio.phys_addr = addr; -- memcpy(run->mmio.data, val, len); -- -- kvm_handle_mmio_return(vcpu, run); - - if (updated_state) - vgic_kick_vcpus(vcpu->kvm); diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.177-178.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.177-178.patch deleted file mode 100644 index 9b85380a07fb..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.177-178.patch +++ /dev/null @@ -1,1860 +0,0 @@ -diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt -index df8ab4fc240a..496673adcb6b 100644 ---- a/Documentation/virtual/kvm/api.txt -+++ b/Documentation/virtual/kvm/api.txt -@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes - - - VM ioctls: These query and set attributes that affect an entire virtual - machine, for example memory layout. In addition a VM ioctl is used to -- create virtual cpus (vcpus). -+ create virtual cpus (vcpus) and devices. - - Only run VM ioctls from the same process (address space) that was used - to create the VM. -@@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes - Only run vcpu ioctls from the same thread that was used to create the - vcpu. - -+ - device ioctls: These query and set attributes that control the operation -+ of a single device. -+ -+ device ioctls must be issued from the same process (address space) that -+ was used to create the VM. - - 2. File descriptors - ------------------- -@@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial - open("/dev/kvm") obtains a handle to the kvm subsystem; this handle - can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this - handle will create a VM file descriptor which can be used to issue VM --ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu --and return a file descriptor pointing to it. Finally, ioctls on a vcpu --fd can be used to control the vcpu, including the important task of --actually running guest code. -+ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will -+create a virtual cpu or device and return a file descriptor pointing to -+the new resource. Finally, ioctls on a vcpu or device fd can be used -+to control the vcpu or device. For vcpus, this includes the important -+task of actually running guest code. - - In general file descriptors can be migrated among processes by means - of fork() and the SCM_RIGHTS facility of unix domain socket. These -diff --git a/Makefile b/Makefile -index 1de443248119..35be7983ef2d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 177 -+SUBLEVEL = 178 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 5b47218809e0..f18b8c26a959 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -89,7 +89,6 @@ config ARM64 - select PERF_USE_VMALLOC - select POWER_RESET - select POWER_SUPPLY -- select RTC_LIB - select SPARSE_IRQ - select SYSCTL_EXCEPTION_TRACE - select HAVE_CONTEXT_TRACKING -@@ -819,6 +818,10 @@ config SYSVIPC_COMPAT - def_bool y - depends on COMPAT && SYSVIPC - -+config KEYS_COMPAT -+ def_bool y -+ depends on COMPAT && KEYS -+ - endmenu - - menu "Power management options" -diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index 5d270ca76aec..6b4579e07aa2 100644 ---- a/arch/arm64/kernel/traps.c -+++ b/arch/arm64/kernel/traps.c -@@ -239,10 +239,12 @@ void die(const char *str, struct pt_regs *regs, int err) - { - struct thread_info *thread = current_thread_info(); - int ret; -+ unsigned long flags; -+ -+ raw_spin_lock_irqsave(&die_lock, flags); - - oops_enter(); - -- raw_spin_lock_irq(&die_lock); - console_verbose(); - bust_spinlocks(1); - ret = __die(str, err, thread, regs); -@@ -252,13 +254,15 @@ void die(const char *str, struct pt_regs *regs, int err) - - bust_spinlocks(0); - add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); -- raw_spin_unlock_irq(&die_lock); - oops_exit(); - - if (in_interrupt()) - panic("Fatal exception in interrupt"); - if (panic_on_oops) - panic("Fatal exception"); -+ -+ raw_spin_unlock_irqrestore(&die_lock, flags); -+ - if (ret != NOTIFY_STOP) - do_exit(SIGSEGV); - } -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index be7f8416809f..04c4b88706d8 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -595,20 +595,33 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, - { - const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); - struct siginfo info; -+ int rv; - -- if (!inf->fn(addr, esr, regs)) -- return 1; -+ /* -+ * Tell lockdep we disabled irqs in entry.S. Do nothing if they were -+ * already disabled to preserve the last enabled/disabled addresses. -+ */ -+ if (interrupts_enabled(regs)) -+ trace_hardirqs_off(); - -- pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", -- inf->name, esr, addr); -+ if (!inf->fn(addr, esr, regs)) { -+ rv = 1; -+ } else { -+ pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", -+ inf->name, esr, addr); -+ -+ info.si_signo = inf->sig; -+ info.si_errno = 0; -+ info.si_code = inf->code; -+ info.si_addr = (void __user *)addr; -+ arm64_notify_die("", regs, &info, 0); -+ rv = 0; -+ } - -- info.si_signo = inf->sig; -- info.si_errno = 0; -- info.si_code = inf->code; -- info.si_addr = (void __user *)addr; -- arm64_notify_die("", regs, &info, 0); -+ if (interrupts_enabled(regs)) -+ trace_hardirqs_on(); - -- return 0; -+ return rv; - } - - #ifdef CONFIG_ARM64_PAN -diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h -index e77672539e8e..e4456e450f94 100644 ---- a/arch/mips/include/asm/jump_label.h -+++ b/arch/mips/include/asm/jump_label.h -@@ -21,15 +21,15 @@ - #endif - - #ifdef CONFIG_CPU_MICROMIPS --#define NOP_INSN "nop32" -+#define B_INSN "b32" - #else --#define NOP_INSN "nop" -+#define B_INSN "b" - #endif - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\t" NOP_INSN "\n\t" -- "nop\n\t" -+ asm_volatile_goto("1:\t" B_INSN " 2f\n\t" -+ "2:\tnop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - WORD_INSN " 1b, %l[l_yes], %0\n\t" - ".popsection\n\t" -diff --git a/arch/mips/loongson64/lemote-2f/irq.c b/arch/mips/loongson64/lemote-2f/irq.c -index cab5f43e0e29..d371f0294cbb 100644 ---- a/arch/mips/loongson64/lemote-2f/irq.c -+++ b/arch/mips/loongson64/lemote-2f/irq.c -@@ -102,7 +102,7 @@ static struct irqaction ip6_irqaction = { - static struct irqaction cascade_irqaction = { - .handler = no_action, - .name = "cascade", -- .flags = IRQF_NO_THREAD, -+ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND, - }; - - void __init mach_init_irq(void) -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 9beee7f364ad..4598d087dec2 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1970,14 +1970,8 @@ config PHYSICAL_ALIGN - Don't change this unless you know what you are doing. - - config HOTPLUG_CPU -- bool "Support for hot-pluggable CPUs" -+ def_bool y - depends on SMP -- ---help--- -- Say Y here to allow turning CPUs off and on. CPUs can be -- controlled through /sys/devices/system/cpu. -- ( Note: power management support will enable this option -- automatically on SMP systems. ) -- Say N if you want to disable CPU hotplug. - - config BOOTPARAM_HOTPLUG_CPU0 - bool "Set default setting of cpu0_hotpluggable" -diff --git a/drivers/extcon/extcon-usb-gpio.c b/drivers/extcon/extcon-usb-gpio.c -index 2b2fecffb1ad..c6a7c9ddf0ac 100644 ---- a/drivers/extcon/extcon-usb-gpio.c -+++ b/drivers/extcon/extcon-usb-gpio.c -@@ -192,6 +192,9 @@ static int usb_extcon_resume(struct device *dev) - } - - enable_irq(info->id_irq); -+ if (!device_may_wakeup(dev)) -+ queue_delayed_work(system_power_efficient_wq, -+ &info->wq_detcable, 0); - - return ret; - } -diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c -index d3d0a90fe542..995b2be45982 100644 ---- a/drivers/gpio/gpio-adnp.c -+++ b/drivers/gpio/gpio-adnp.c -@@ -137,8 +137,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset) - if (err < 0) - goto out; - -- if (err & BIT(pos)) -- err = -EACCES; -+ if (value & BIT(pos)) { -+ err = -EPERM; -+ goto out; -+ } - - err = 0; - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -index aec6e9eef489..55884cb5a0fc 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c -@@ -531,11 +531,9 @@ static int vmw_fb_set_par(struct fb_info *info) - 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) - }; -- struct drm_display_mode *old_mode; - struct drm_display_mode *mode; - int ret; - -- old_mode = par->set_mode; - mode = drm_mode_duplicate(vmw_priv->dev, &new_mode); - if (!mode) { - DRM_ERROR("Could not create new fb mode.\n"); -@@ -546,11 +544,7 @@ static int vmw_fb_set_par(struct fb_info *info) - mode->vdisplay = var->yres; - vmw_guess_mode_timing(mode); - -- if (old_mode && drm_mode_equal(old_mode, mode)) { -- drm_mode_destroy(vmw_priv->dev, mode); -- mode = old_mode; -- old_mode = NULL; -- } else if (!vmw_kms_validate_mode_vram(vmw_priv, -+ if (!vmw_kms_validate_mode_vram(vmw_priv, - mode->hdisplay * - DIV_ROUND_UP(var->bits_per_pixel, 8), - mode->vdisplay)) { -@@ -613,8 +607,8 @@ static int vmw_fb_set_par(struct fb_info *info) - schedule_delayed_work(&par->local_work, 0); - - out_unlock: -- if (old_mode) -- drm_mode_destroy(vmw_priv->dev, old_mode); -+ if (par->set_mode) -+ drm_mode_destroy(vmw_priv->dev, par->set_mode); - par->set_mode = mode; - - drm_modeset_unlock_all(vmw_priv->dev); -diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c -index 28543d795188..9a27809bdaf2 100644 ---- a/drivers/isdn/hardware/mISDN/hfcmulti.c -+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c -@@ -4370,7 +4370,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev, - if (m->clock2) - test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip); - -- if (ent->device == 0xB410) { -+ if (ent->vendor == PCI_VENDOR_ID_DIGIUM && -+ ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) { - test_and_set_bit(HFC_CHIP_B410P, &hc->chip); - test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip); - test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip); -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 618e4e2b4207..fea09a33c6c8 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -1202,7 +1202,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain *chain, - - __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl); - -- memset(ev->reserved, 0, sizeof(ev->reserved)); -+ memset(ev, 0, sizeof(*ev)); - ev->type = V4L2_EVENT_CTRL; - ev->id = v4l2_ctrl.id; - ev->u.ctrl.value = value; -diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c -index 523758e71fe6..70097cc3a35d 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls.c -@@ -1212,7 +1212,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl) - - static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes) - { -- memset(ev->reserved, 0, sizeof(ev->reserved)); -+ memset(ev, 0, sizeof(*ev)); - ev->type = V4L2_EVENT_CTRL; - ev->id = ctrl->id; - ev->u.ctrl.changes = changes; -diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c -index 154aced0b91b..705586dcd9fa 100644 ---- a/drivers/mmc/core/debugfs.c -+++ b/drivers/mmc/core/debugfs.c -@@ -220,7 +220,7 @@ static int mmc_clock_opt_set(void *data, u64 val) - struct mmc_host *host = data; - - /* We need this check due to input value is u64 */ -- if (val > host->f_max) -+ if (val != 0 && (val > host->f_max || val < host->f_min)) - return -EINVAL; - - mmc_claim_host(host); -diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c -index 72bbb12fb938..1d57c12b191c 100644 ---- a/drivers/mmc/host/pxamci.c -+++ b/drivers/mmc/host/pxamci.c -@@ -181,7 +181,7 @@ static void pxamci_dma_irq(void *param); - static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) - { - struct dma_async_tx_descriptor *tx; -- enum dma_data_direction direction; -+ enum dma_transfer_direction direction; - struct dma_slave_config config; - struct dma_chan *chan; - unsigned int nob = data->blocks; -diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c -index a10fde40b6c3..3c7c3a1c8f4f 100644 ---- a/drivers/mmc/host/tmio_mmc_pio.c -+++ b/drivers/mmc/host/tmio_mmc_pio.c -@@ -716,7 +716,7 @@ irqreturn_t tmio_mmc_sdio_irq(int irq, void *devid) - unsigned int sdio_status; - - if (!(pdata->flags & TMIO_MMC_SDIO_IRQ)) -- return IRQ_HANDLED; -+ return IRQ_NONE; - - status = sd_ctrl_read16(host, CTL_SDIO_STATUS); - ireg = status & TMIO_SDIO_MASK_ALL & ~host->sdcard_irq_mask; -@@ -730,7 +730,7 @@ irqreturn_t tmio_mmc_sdio_irq(int irq, void *devid) - if (mmc->caps & MMC_CAP_SDIO_IRQ && ireg & TMIO_SDIO_STAT_IOIRQ) - mmc_signal_sdio_irq(mmc); - -- return IRQ_HANDLED; -+ return IRQ_RETVAL(ireg); - } - EXPORT_SYMBOL(tmio_mmc_sdio_irq); - -@@ -747,9 +747,7 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid) - if (__tmio_mmc_sdcard_irq(host, ireg, status)) - return IRQ_HANDLED; - -- tmio_mmc_sdio_irq(irq, devid); -- -- return IRQ_HANDLED; -+ return tmio_mmc_sdio_irq(irq, devid); - } - EXPORT_SYMBOL(tmio_mmc_irq); - -diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c -index b9283901136e..0fdc9ad32a2e 100644 ---- a/drivers/net/ethernet/8390/mac8390.c -+++ b/drivers/net/ethernet/8390/mac8390.c -@@ -156,8 +156,6 @@ static void dayna_block_output(struct net_device *dev, int count, - #define memcpy_fromio(a, b, c) memcpy((a), (void *)(b), (c)) - #define memcpy_toio(a, b, c) memcpy((void *)(a), (b), (c)) - --#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c)) -- - /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */ - static void slow_sane_get_8390_hdr(struct net_device *dev, - struct e8390_pkt_hdr *hdr, int ring_page); -@@ -237,19 +235,26 @@ static enum mac8390_type __init mac8390_ident(struct nubus_dev *dev) - - static enum mac8390_access __init mac8390_testio(volatile unsigned long membase) - { -- unsigned long outdata = 0xA5A0B5B0; -- unsigned long indata = 0x00000000; -+ u32 outdata = 0xA5A0B5B0; -+ u32 indata = 0; -+ - /* Try writing 32 bits */ -- memcpy_toio(membase, &outdata, 4); -- /* Now compare them */ -- if (memcmp_withio(&outdata, membase, 4) == 0) -+ nubus_writel(outdata, membase); -+ /* Now read it back */ -+ indata = nubus_readl(membase); -+ if (outdata == indata) - return ACCESS_32; -+ -+ outdata = 0xC5C0D5D0; -+ indata = 0; -+ - /* Write 16 bit output */ - word_memcpy_tocard(membase, &outdata, 4); - /* Now read it back */ - word_memcpy_fromcard(&indata, membase, 4); - if (outdata == indata) - return ACCESS_16; -+ - return ACCESS_UNKNOWN; - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 7bba30f24135..059113dce6e0 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -2529,6 +2529,20 @@ static int stmmac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) - return ret; - } - -+static int stmmac_set_mac_address(struct net_device *ndev, void *addr) -+{ -+ struct stmmac_priv *priv = netdev_priv(ndev); -+ int ret = 0; -+ -+ ret = eth_mac_addr(ndev, addr); -+ if (ret) -+ return ret; -+ -+ priv->hw->mac->set_umac_addr(priv->hw, ndev->dev_addr, 0); -+ -+ return ret; -+} -+ - #ifdef CONFIG_DEBUG_FS - static struct dentry *stmmac_fs_dir; - -@@ -2730,7 +2744,7 @@ static const struct net_device_ops stmmac_netdev_ops = { - #ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = stmmac_poll_controller, - #endif -- .ndo_set_mac_address = eth_mac_addr, -+ .ndo_set_mac_address = stmmac_set_mac_address, - }; - - /** -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 5dadfc508ade..835129152fc4 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -3276,10 +3276,8 @@ static void __net_exit vxlan_exit_net(struct net *net) - /* If vxlan->dev is in the same netns, it has already been added - * to the list by the previous loop. - */ -- if (!net_eq(dev_net(vxlan->dev), net)) { -- gro_cells_destroy(&vxlan->gro_cells); -+ if (!net_eq(dev_net(vxlan->dev), net)) - unregister_netdevice_queue(vxlan->dev, &list); -- } - } - - unregister_netdevice_many(&list); -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index f201e50447d8..b867875aa6e6 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -4065,7 +4065,7 @@ static void ath10k_tpc_config_disp_tables(struct ath10k *ar, - rate_code[i], - type); - snprintf(buff, sizeof(buff), "%8d ", tpc[j]); -- strncat(tpc_value, buff, strlen(buff)); -+ strlcat(tpc_value, buff, sizeof(tpc_value)); - } - tpc_stats->tpc_table[type].pream_idx[i] = pream_idx; - tpc_stats->tpc_table[type].rate_code[i] = rate_code[i]; -diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c -index e6bfb9c42a10..5b136bdc03d4 100644 ---- a/drivers/rtc/rtc-lib.c -+++ b/drivers/rtc/rtc-lib.c -@@ -52,13 +52,11 @@ EXPORT_SYMBOL(rtc_year_days); - */ - void rtc_time64_to_tm(time64_t time, struct rtc_time *tm) - { -- unsigned int month, year; -- unsigned long secs; -+ unsigned int month, year, secs; - int days; - - /* time must be positive */ -- days = div_s64(time, 86400); -- secs = time - (unsigned int) days * 86400; -+ days = div_s64_rem(time, 86400, &secs); - - /* day of the week, 1970-01-01 was a Thursday */ - tm->tm_wday = (days + 4) % 7; -diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c -index 2abcd331b05d..abe460eac712 100644 ---- a/drivers/s390/scsi/zfcp_erp.c -+++ b/drivers/s390/scsi/zfcp_erp.c -@@ -652,6 +652,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action) - add_timer(&erp_action->timer); - } - -+void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, -+ int clear, char *dbftag) -+{ -+ unsigned long flags; -+ struct zfcp_port *port; -+ -+ write_lock_irqsave(&adapter->erp_lock, flags); -+ read_lock(&adapter->port_list_lock); -+ list_for_each_entry(port, &adapter->port_list, list) -+ _zfcp_erp_port_forced_reopen(port, clear, dbftag); -+ read_unlock(&adapter->port_list_lock); -+ write_unlock_irqrestore(&adapter->erp_lock, flags); -+} -+ - static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter, - int clear, char *id) - { -@@ -1306,6 +1320,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port) - struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); - int lun_status; - -+ if (sdev->sdev_state == SDEV_DEL || -+ sdev->sdev_state == SDEV_CANCEL) -+ continue; - if (zsdev->port != port) - continue; - /* LUN under port of interest */ -diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h -index b326f05c7f89..a39a74500e23 100644 ---- a/drivers/s390/scsi/zfcp_ext.h -+++ b/drivers/s390/scsi/zfcp_ext.h -@@ -68,6 +68,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32); - extern int zfcp_erp_port_reopen(struct zfcp_port *, int, char *); - extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *); - extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *); -+extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter, -+ int clear, char *dbftag); - extern void zfcp_erp_set_lun_status(struct scsi_device *, u32); - extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32); - extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *); -diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c -index 3afb200b2829..bdb257eaa2e5 100644 ---- a/drivers/s390/scsi/zfcp_scsi.c -+++ b/drivers/s390/scsi/zfcp_scsi.c -@@ -326,6 +326,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt) - struct zfcp_adapter *adapter = zfcp_sdev->port->adapter; - int ret = SUCCESS, fc_ret; - -+ if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) { -+ zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p"); -+ zfcp_erp_wait(adapter); -+ } - zfcp_erp_adapter_reopen(adapter, 0, "schrh_1"); - zfcp_erp_wait(adapter); - fc_ret = fc_block_scsi_eh(scpnt); -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index ec80a0077ace..62adaca8fb97 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -1276,11 +1276,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode) - scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); - } - -- /* -- * XXX and what if there are packets in flight and this close() -- * XXX is followed by a "rmmod sd_mod"? -- */ -- - scsi_disk_put(sdkp); - } - -@@ -3227,11 +3222,23 @@ static void scsi_disk_release(struct device *dev) - { - struct scsi_disk *sdkp = to_scsi_disk(dev); - struct gendisk *disk = sdkp->disk; -- -+ struct request_queue *q = disk->queue; -+ - spin_lock(&sd_index_lock); - ida_remove(&sd_index_ida, sdkp->index); - spin_unlock(&sd_index_lock); - -+ /* -+ * Wait until all requests that are in progress have completed. -+ * This is necessary to avoid that e.g. scsi_end_request() crashes -+ * due to clearing the disk->private_data pointer. Wait from inside -+ * scsi_disk_release() instead of from sd_release() to avoid that -+ * freezing and unfreezing the request queue affects user space I/O -+ * in case multiple processes open a /dev/sd... node concurrently. -+ */ -+ blk_mq_freeze_queue(q); -+ blk_mq_unfreeze_queue(q); -+ - disk->private_data = NULL; - put_disk(disk); - put_device(&sdkp->device->sdev_gendev); -diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c -index 8fd8f3a2d1bf..58b6403458b7 100644 ---- a/drivers/staging/vt6655/device_main.c -+++ b/drivers/staging/vt6655/device_main.c -@@ -972,8 +972,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) - return; - } - -- MACvIntDisable(priv->PortOffset); -- - spin_lock_irqsave(&priv->lock, flags); - - /* Read low level stats */ -@@ -1062,8 +1060,6 @@ static void vnt_interrupt_process(struct vnt_private *priv) - } - - spin_unlock_irqrestore(&priv->lock, flags); -- -- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); - } - - static void vnt_interrupt_work(struct work_struct *work) -@@ -1073,14 +1069,17 @@ static void vnt_interrupt_work(struct work_struct *work) - - if (priv->vif) - vnt_interrupt_process(priv); -+ -+ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); - } - - static irqreturn_t vnt_interrupt(int irq, void *arg) - { - struct vnt_private *priv = arg; - -- if (priv->vif) -- schedule_work(&priv->interrupt_work); -+ schedule_work(&priv->interrupt_work); -+ -+ MACvIntDisable(priv->PortOffset); - - return IRQ_HANDLED; - } -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index e0277cf0bf58..f5c4e92b5172 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -1167,6 +1167,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port) - sg_dma_len(&atmel_port->sg_rx)/2, - DMA_DEV_TO_MEM, - DMA_PREP_INTERRUPT); -+ if (!desc) { -+ dev_err(port->dev, "Preparing DMA cyclic failed\n"); -+ goto chan_err; -+ } - desc->callback = atmel_complete_rx_dma; - desc->callback_param = port; - atmel_port->desc_rx = desc; -diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c -index f2b0d8cee8ef..0314e78e31ff 100644 ---- a/drivers/tty/serial/kgdboc.c -+++ b/drivers/tty/serial/kgdboc.c -@@ -148,8 +148,10 @@ static int configure_kgdboc(void) - char *cptr = config; - struct console *cons; - -- if (!strlen(config) || isspace(config[0])) -+ if (!strlen(config) || isspace(config[0])) { -+ err = 0; - goto noconfig; -+ } - - kgdboc_io_ops.is_console = 0; - kgdb_tty_driver = NULL; -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index d45133056f51..be55fb6def89 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -1306,6 +1306,8 @@ static int max310x_spi_probe(struct spi_device *spi) - if (spi->dev.of_node) { - const struct of_device_id *of_id = - of_match_device(max310x_dt_ids, &spi->dev); -+ if (!of_id) -+ return -ENODEV; - - devtype = (struct max310x_devtype *)of_id->data; - } else { -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index b63920481b1d..669134e27ed9 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -746,19 +746,9 @@ static void sci_transmit_chars(struct uart_port *port) - - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) - uart_write_wakeup(port); -- if (uart_circ_empty(xmit)) { -+ if (uart_circ_empty(xmit)) - sci_stop_tx(port); -- } else { -- ctrl = serial_port_in(port, SCSCR); -- -- if (port->type != PORT_SCI) { -- serial_port_in(port, SCxSR); /* Dummy read */ -- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); -- } - -- ctrl |= SCSCR_TIE; -- serial_port_out(port, SCSCR, ctrl); -- } - } - - /* On SH3, SCIF may read end-of-break as a space->mark char */ -diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c -index 1e302caaa450..c894eca57e73 100644 ---- a/drivers/tty/serial/sprd_serial.c -+++ b/drivers/tty/serial/sprd_serial.c -@@ -36,7 +36,7 @@ - #define SPRD_FIFO_SIZE 128 - #define SPRD_DEF_RATE 26000000 - #define SPRD_BAUD_IO_LIMIT 3000000 --#define SPRD_TIMEOUT 256 -+#define SPRD_TIMEOUT 256000 - - /* the offset of serial registers and BITs for them */ - /* data registers */ -@@ -63,6 +63,7 @@ - - /* interrupt clear register */ - #define SPRD_ICLR 0x0014 -+#define SPRD_ICLR_TIMEOUT BIT(13) - - /* line control register */ - #define SPRD_LCR 0x0018 -@@ -298,7 +299,8 @@ static irqreturn_t sprd_handle_irq(int irq, void *dev_id) - return IRQ_NONE; - } - -- serial_out(port, SPRD_ICLR, ~0); -+ if (ims & SPRD_IMSR_TIMEOUT) -+ serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT); - - if (ims & (SPRD_IMSR_RX_FIFO_FULL | - SPRD_IMSR_BREAK_DETECT | SPRD_IMSR_TIMEOUT)) -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 58f5fbdb6959..8bf54477f472 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1819,6 +1819,8 @@ unknown: - break; - - case USB_RECIP_ENDPOINT: -+ if (!cdev->config) -+ break; - endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f); - list_for_each_entry(f, &cdev->config->functions, list) { - if (test_bit(endp, f->endpoints)) -diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c -index 70d3917cc003..2582db38d6a6 100644 ---- a/drivers/usb/gadget/function/rndis.c -+++ b/drivers/usb/gadget/function/rndis.c -@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params *params, - { - rndis_reset_cmplt_type *resp; - rndis_resp_t *r; -+ u8 *xbuf; -+ u32 length; -+ -+ /* drain the response queue */ -+ while ((xbuf = rndis_get_next_response(params, &length))) -+ rndis_free_response(params, xbuf); - - r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type)); - if (!r) -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index 4ea44f7122ee..d73618475664 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -361,10 +361,15 @@ __acquires(&port->port_lock) - */ - { - struct list_head *pool = &port->write_pool; -- struct usb_ep *in = port->port_usb->in; -+ struct usb_ep *in; - int status = 0; - bool do_tty_wake = false; - -+ if (!port->port_usb) -+ return status; -+ -+ in = port->port_usb->in; -+ - while (!port->write_busy && !list_empty(pool)) { - struct usb_request *req; - int len; -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 8647d2c2a8c4..c5553028e616 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -641,14 +641,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep) - struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); - struct usbhs_pipe *pipe; - unsigned long flags; -- int ret = 0; - - spin_lock_irqsave(&uep->lock, flags); - pipe = usbhsg_uep_to_pipe(uep); -- if (!pipe) { -- ret = -EINVAL; -+ if (!pipe) - goto out; -- } - - usbhsg_pipe_disable(uep); - usbhs_pipe_free(pipe); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index b317594a6342..e3ea0fdd3913 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -76,6 +76,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ - { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ - { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ -+ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ - { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ - { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ - { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 4287e2b1c175..af258bb632dd 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -604,6 +604,8 @@ static const struct usb_device_id id_table_combined[] = { - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, -+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index ddf5ab983dc9..15d220eaf6e6 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -566,7 +566,9 @@ - /* - * NovaTech product ids (FTDI_VID) - */ --#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ -+#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ -+#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ -+#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ - - /* - * Synapse Wireless product ids (FTDI_VID) -diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c -index 4581fa1dec98..286b43c79d38 100644 ---- a/drivers/usb/serial/mos7720.c -+++ b/drivers/usb/serial/mos7720.c -@@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, - if (!urbtrack) - return -ENOMEM; - -- kref_get(&mos_parport->ref_count); -- urbtrack->mos_parport = mos_parport; - urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); - if (!urbtrack->urb) { - kfree(urbtrack); -@@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, - usb_sndctrlpipe(usbdev, 0), - (unsigned char *)urbtrack->setup, - NULL, 0, async_complete, urbtrack); -+ kref_get(&mos_parport->ref_count); -+ urbtrack->mos_parport = mos_parport; - kref_init(&urbtrack->ref_count); - INIT_LIST_HEAD(&urbtrack->urblist_entry); - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index b2b7c12e5c86..9f96dd274370 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1066,7 +1066,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(3) }, - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ -- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ -+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ -+ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, - /* Quectel products using Qualcomm vendor ID */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, - { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), -@@ -1941,10 +1942,12 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ - .driver_info = RSVD(4) }, -- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ -- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ -- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ -- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ -+ .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ - { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, - { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, -diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c -index b9fa99577bf7..2d2a76906786 100644 ---- a/fs/btrfs/raid56.c -+++ b/fs/btrfs/raid56.c -@@ -2420,8 +2420,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, - bitmap_clear(rbio->dbitmap, pagenr, 1); - kunmap(p); - -- for (stripe = 0; stripe < rbio->real_stripes; stripe++) -+ for (stripe = 0; stripe < nr_data; stripe++) - kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); -+ kunmap(p_page); - } - - __free_page(p_page); -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 63f59f17c97e..c7190f322576 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3321,9 +3321,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, - } - btrfs_release_path(path); - -- /* find the first key from this transaction again */ -+ /* -+ * Find the first key from this transaction again. See the note for -+ * log_new_dir_dentries, if we're logging a directory recursively we -+ * won't be holding its i_mutex, which means we can modify the directory -+ * while we're logging it. If we remove an entry between our first -+ * search and this search we'll not find the key again and can just -+ * bail. -+ */ - ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); -- if (WARN_ON(ret != 0)) -+ if (ret != 0) - goto done; - - /* -diff --git a/fs/dcache.c b/fs/dcache.c -index 9ffe60702299..cb554e406545 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1510,7 +1510,7 @@ static void check_and_drop(void *_data) - { - struct detach_data *data = _data; - -- if (!data->mountpoint && !data->select.found) -+ if (!data->mountpoint && list_empty(&data->select.dispose)) - __d_drop(data->select.start); - } - -@@ -1552,17 +1552,15 @@ void d_invalidate(struct dentry *dentry) - - d_walk(dentry, &data, detach_and_collect, check_and_drop); - -- if (data.select.found) -+ if (!list_empty(&data.select.dispose)) - shrink_dentry_list(&data.select.dispose); -+ else if (!data.mountpoint) -+ return; - - if (data.mountpoint) { - detach_mounts(data.mountpoint); - dput(data.mountpoint); - } -- -- if (!data.mountpoint && !data.select.found) -- break; -- - cond_resched(); - } - } -diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h -index f817ed58f5ad..b40e75dbf48c 100644 ---- a/fs/ext4/ext4_jbd2.h -+++ b/fs/ext4/ext4_jbd2.h -@@ -372,7 +372,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle, - { - struct ext4_inode_info *ei = EXT4_I(inode); - -- if (ext4_handle_valid(handle)) { -+ if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) { - ei->i_sync_tid = handle->h_transaction->t_tid; - if (datasync) - ei->i_datasync_tid = handle->h_transaction->t_tid; -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index debf0707789d..2e5ae183a18a 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -79,7 +79,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter *from, loff_t pos) - struct super_block *sb = inode->i_sb; - int blockmask = sb->s_blocksize - 1; - -- if (pos >= i_size_read(inode)) -+ if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize)) - return 0; - - if ((pos | iov_iter_alignment(from)) & blockmask) -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index 355ef9c36c87..8f3e78eb0bbd 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -1491,10 +1491,14 @@ end_range: - partial->p + 1, - partial2->p, - (chain+n-1) - partial); -- BUFFER_TRACE(partial->bh, "call brelse"); -- brelse(partial->bh); -- BUFFER_TRACE(partial2->bh, "call brelse"); -- brelse(partial2->bh); -+ while (partial > chain) { -+ BUFFER_TRACE(partial->bh, "call brelse"); -+ brelse(partial->bh); -+ } -+ while (partial2 > chain2) { -+ BUFFER_TRACE(partial2->bh, "call brelse"); -+ brelse(partial2->bh); -+ } - return 0; - } - -diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c -index 5e1054f028af..c7e32a891502 100644 ---- a/fs/proc/proc_sysctl.c -+++ b/fs/proc/proc_sysctl.c -@@ -1550,7 +1550,8 @@ static void drop_sysctl_table(struct ctl_table_header *header) - if (--header->nreg) - return; - -- put_links(header); -+ if (parent) -+ put_links(header); - start_unregistering(header); - if (!--header->count) - kfree_rcu(header, rcu); -diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c -index 42b8c57795cb..c6ce7503a329 100644 ---- a/fs/udf/truncate.c -+++ b/fs/udf/truncate.c -@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode) - epos.block = eloc; - epos.bh = udf_tread(sb, - udf_get_lb_pblock(sb, &eloc, 0)); -+ /* Error reading indirect block? */ -+ if (!epos.bh) -+ return; - if (elen) - indirect_ext_len = - (elen + sb->s_blocksize - 1) >> -diff --git a/include/linux/rculist.h b/include/linux/rculist.h -index 5ed540986019..a579240c64e9 100644 ---- a/include/linux/rculist.h -+++ b/include/linux/rculist.h -@@ -401,6 +401,42 @@ static inline void hlist_add_head_rcu(struct hlist_node *n, - first->pprev = &n->next; - } - -+/** -+ * hlist_add_tail_rcu -+ * @n: the element to add to the hash list. -+ * @h: the list to add to. -+ * -+ * Description: -+ * Adds the specified element to the specified hlist, -+ * while permitting racing traversals. -+ * -+ * The caller must take whatever precautions are necessary -+ * (such as holding appropriate locks) to avoid racing -+ * with another list-mutation primitive, such as hlist_add_head_rcu() -+ * or hlist_del_rcu(), running on this same list. -+ * However, it is perfectly legal to run concurrently with -+ * the _rcu list-traversal primitives, such as -+ * hlist_for_each_entry_rcu(), used to prevent memory-consistency -+ * problems on Alpha CPUs. Regardless of the type of CPU, the -+ * list-traversal primitive must be guarded by rcu_read_lock(). -+ */ -+static inline void hlist_add_tail_rcu(struct hlist_node *n, -+ struct hlist_head *h) -+{ -+ struct hlist_node *i, *last = NULL; -+ -+ for (i = hlist_first_rcu(h); i; i = hlist_next_rcu(i)) -+ last = i; -+ -+ if (last) { -+ n->next = last->next; -+ n->pprev = &last->next; -+ rcu_assign_pointer(hlist_next_rcu(last), n); -+ } else { -+ hlist_add_head_rcu(n, h); -+ } -+} -+ - /** - * hlist_add_before_rcu - * @n: the new element to add to the hash list. -diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h -index 4a5b9a306c69..803fc26ef0ba 100644 ---- a/include/net/sctp/checksum.h -+++ b/include/net/sctp/checksum.h -@@ -60,7 +60,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2, - static inline __le32 sctp_compute_cksum(const struct sk_buff *skb, - unsigned int offset) - { -- struct sctphdr *sh = sctp_hdr(skb); -+ struct sctphdr *sh = (struct sctphdr *)(skb->data + offset); - __le32 ret, old = sh->checksum; - const struct skb_checksum_ops ops = { - .update = sctp_csum_update, -diff --git a/include/net/sock.h b/include/net/sock.h -index 7420299c31f5..0aadd3b03ced 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -651,6 +651,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list) - hlist_add_head_rcu(&sk->sk_node, list); - } - -+static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list) -+{ -+ sock_hold(sk); -+ hlist_add_tail_rcu(&sk->sk_node, list); -+} -+ - static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) - { - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); -diff --git a/kernel/futex.c b/kernel/futex.c -index 0c92c8d34ffa..ec9df5ba040b 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -3067,6 +3067,10 @@ int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) - { - u32 uval, uninitialized_var(nval), mval; - -+ /* Futex address must be 32bit aligned */ -+ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0) -+ return -1; -+ - retry: - if (get_user(uval, uaddr)) - return -1; -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 774ab79d3ec7..a49c565529a0 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3314,6 +3314,9 @@ __lock_set_class(struct lockdep_map *lock, const char *name, - unsigned int depth; - int i; - -+ if (unlikely(!debug_locks)) -+ return 0; -+ - depth = curr->lockdep_depth; - /* - * This function is about (re)setting the class of a held lock, -diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c -index 1ef4cc344977..1afb545a37c5 100644 ---- a/lib/int_sqrt.c -+++ b/lib/int_sqrt.c -@@ -22,6 +22,9 @@ unsigned long int_sqrt(unsigned long x) - return x; - - m = 1UL << (BITS_PER_LONG - 2); -+ while (m > x) -+ m >>= 2; -+ - while (m != 0) { - b = y + m; - y >>= 1; -diff --git a/mm/rmap.c b/mm/rmap.c -index 488dda209431..cf733fab230f 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -408,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) - list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { - struct anon_vma *anon_vma = avc->anon_vma; - -- BUG_ON(anon_vma->degree); -+ VM_WARN_ON(anon_vma->degree); - put_anon_vma(anon_vma); - - list_del(&avc->same_vma); -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index af68674690af..f76e9c1e9f17 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3315,16 +3315,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - - while (len >= L2CAP_CONF_OPT_SIZE) { - len -= l2cap_get_conf_opt(&req, &type, &olen, &val); -+ if (len < 0) -+ break; - - hint = type & L2CAP_CONF_HINT; - type &= L2CAP_CONF_MASK; - - switch (type) { - case L2CAP_CONF_MTU: -+ if (olen != 2) -+ break; - mtu = val; - break; - - case L2CAP_CONF_FLUSH_TO: -+ if (olen != 2) -+ break; - chan->flush_to = val; - break; - -@@ -3332,26 +3338,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - break; - - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -- memcpy(&rfc, (void *) val, olen); -+ if (olen != sizeof(rfc)) -+ break; -+ memcpy(&rfc, (void *) val, olen); - break; - - case L2CAP_CONF_FCS: -+ if (olen != 1) -+ break; - if (val == L2CAP_FCS_NONE) - set_bit(CONF_RECV_NO_FCS, &chan->conf_state); - break; - - case L2CAP_CONF_EFS: -- if (olen == sizeof(efs)) { -- remote_efs = 1; -- memcpy(&efs, (void *) val, olen); -- } -+ if (olen != sizeof(efs)) -+ break; -+ remote_efs = 1; -+ memcpy(&efs, (void *) val, olen); - break; - - case L2CAP_CONF_EWS: -+ if (olen != 2) -+ break; - if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) - return -ECONNREFUSED; -- - set_bit(FLAG_EXT_CTRL, &chan->flags); - set_bit(CONF_EWS_RECV, &chan->conf_state); - chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; -@@ -3361,7 +3371,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - default: - if (hint) - break; -- - result = L2CAP_CONF_UNKNOWN; - *((u8 *) ptr++) = type; - break; -@@ -3526,58 +3535,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - - while (len >= L2CAP_CONF_OPT_SIZE) { - len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ if (len < 0) -+ break; - - switch (type) { - case L2CAP_CONF_MTU: -+ if (olen != 2) -+ break; - if (val < L2CAP_DEFAULT_MIN_MTU) { - *result = L2CAP_CONF_UNACCEPT; - chan->imtu = L2CAP_DEFAULT_MIN_MTU; - } else - chan->imtu = val; -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, -+ endptr - ptr); - break; - - case L2CAP_CONF_FLUSH_TO: -+ if (olen != 2) -+ break; - chan->flush_to = val; -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, -- 2, chan->flush_to, endptr - ptr); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, -+ chan->flush_to, endptr - ptr); - break; - - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -- memcpy(&rfc, (void *)val, olen); -- -+ if (olen != sizeof(rfc)) -+ break; -+ memcpy(&rfc, (void *)val, olen); - if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && - rfc.mode != chan->mode) - return -ECONNREFUSED; -- - chan->fcs = 0; -- -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, -- sizeof(rfc), (unsigned long) &rfc, endptr - ptr); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -+ (unsigned long) &rfc, endptr - ptr); - break; - - case L2CAP_CONF_EWS: -+ if (olen != 2) -+ break; - chan->ack_win = min_t(u16, val, chan->ack_win); - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, - chan->tx_win, endptr - ptr); - break; - - case L2CAP_CONF_EFS: -- if (olen == sizeof(efs)) { -- memcpy(&efs, (void *)val, olen); -- -- if (chan->local_stype != L2CAP_SERV_NOTRAFIC && -- efs.stype != L2CAP_SERV_NOTRAFIC && -- efs.stype != chan->local_stype) -- return -ECONNREFUSED; -- -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), -- (unsigned long) &efs, endptr - ptr); -- } -+ if (olen != sizeof(efs)) -+ break; -+ memcpy(&efs, (void *)val, olen); -+ if (chan->local_stype != L2CAP_SERV_NOTRAFIC && -+ efs.stype != L2CAP_SERV_NOTRAFIC && -+ efs.stype != chan->local_stype) -+ return -ECONNREFUSED; -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), -+ (unsigned long) &efs, endptr - ptr); - break; - - case L2CAP_CONF_FCS: -+ if (olen != 1) -+ break; - if (*result == L2CAP_CONF_PENDING) - if (val == L2CAP_FCS_NONE) - set_bit(CONF_RECV_NO_FCS, -@@ -3706,13 +3722,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) - - while (len >= L2CAP_CONF_OPT_SIZE) { - len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ if (len < 0) -+ break; - - switch (type) { - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -- memcpy(&rfc, (void *)val, olen); -+ if (olen != sizeof(rfc)) -+ break; -+ memcpy(&rfc, (void *)val, olen); - break; - case L2CAP_CONF_EWS: -+ if (olen != 2) -+ break; - txwin_ext = val; - break; - } -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index d6c191158e07..6e7f99569bdf 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1043,11 +1043,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - newnp->ipv6_fl_list = NULL; - newnp->pktoptions = NULL; - newnp->opt = NULL; -- newnp->mcast_oif = tcp_v6_iif(skb); -- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; -- newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb)); -+ newnp->mcast_oif = inet_iif(skb); -+ newnp->mcast_hops = ip_hdr(skb)->ttl; -+ newnp->rcv_flowinfo = 0; - if (np->repflow) -- newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb)); -+ newnp->flow_label = 0; - - /* - * No need to charge this sock to the relevant IPv6 refcnt debug socks count -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d517dd7f4ac7..7d93228ba1e1 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3155,7 +3155,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, - } - - mutex_lock(&net->packet.sklist_lock); -- sk_add_node_rcu(sk, &net->packet.sklist); -+ sk_add_node_tail_rcu(sk, &net->packet.sklist); - mutex_unlock(&net->packet.sklist_lock); - - preempt_disable(); -@@ -4130,7 +4130,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order) - struct pgv *pg_vec; - int i; - -- pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL); -+ pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN); - if (unlikely(!pg_vec)) - goto out; - -diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c -index 7ca57741b2fb..7849f286bb93 100644 ---- a/net/rose/rose_subr.c -+++ b/net/rose/rose_subr.c -@@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype) - struct sk_buff *skb; - unsigned char *dptr; - unsigned char lci1, lci2; -- char buffer[100]; -- int len, faclen = 0; -+ int maxfaclen = 0; -+ int len, faclen; -+ int reserve; - -- len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1; -+ reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1; -+ len = ROSE_MIN_LEN; - - switch (frametype) { - case ROSE_CALL_REQUEST: - len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN; -- faclen = rose_create_facilities(buffer, rose); -- len += faclen; -+ maxfaclen = 256; - break; - case ROSE_CALL_ACCEPTED: - case ROSE_CLEAR_REQUEST: -@@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype) - break; - } - -- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL) -+ skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC); -+ if (!skb) - return; - - /* - * Space for AX.25 header and PID. - */ -- skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1); -+ skb_reserve(skb, reserve); - -- dptr = skb_put(skb, skb_tailroom(skb)); -+ dptr = skb_put(skb, len); - - lci1 = (rose->lci >> 8) & 0x0F; - lci2 = (rose->lci >> 0) & 0xFF; -@@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype) - dptr += ROSE_ADDR_LEN; - memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN); - dptr += ROSE_ADDR_LEN; -- memcpy(dptr, buffer, faclen); -+ faclen = rose_create_facilities(dptr, rose); -+ skb_put(skb, faclen); - dptr += faclen; - break; - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 642a78079ae1..81013490a99f 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -11721,7 +11721,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + len, gfp); - if (!msg) - return; - -@@ -11873,7 +11873,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); - if (!msg) - return; - -@@ -11913,7 +11913,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp); - if (!msg) - return; - -@@ -11951,7 +11951,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ msg = nlmsg_new(100 + ie_len, GFP_KERNEL); - if (!msg) - return; - -@@ -12028,7 +12028,7 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, - - trace_cfg80211_notify_new_peer_candidate(dev, addr); - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + ie_len, gfp); - if (!msg) - return; - -@@ -12397,7 +12397,7 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, - struct sk_buff *msg; - void *hdr; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + len, gfp); - if (!msg) - return -ENOMEM; - -@@ -12440,7 +12440,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, - - trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); -+ msg = nlmsg_new(100 + len, gfp); - if (!msg) - return; - -@@ -13244,7 +13244,7 @@ void cfg80211_ft_event(struct net_device *netdev, - if (!ft_event->target_ap) - return; - -- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); - if (!msg) - return; - -diff --git a/scripts/setlocalversion b/scripts/setlocalversion -index 63d91e22ed7c..966dd3924ea9 100755 ---- a/scripts/setlocalversion -+++ b/scripts/setlocalversion -@@ -143,7 +143,7 @@ fi - if test -e include/config/auto.conf; then - . include/config/auto.conf - else -- echo "Error: kernelrelease not valid - run 'make prepare' to update it" -+ echo "Error: kernelrelease not valid - run 'make prepare' to update it" >&2 - exit 1 - fi - -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 2272aee12871..3c88a3384064 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -859,6 +860,15 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg) - return retval; - } - -+/* support of 32bit userspace on 64bit platforms */ -+#ifdef CONFIG_COMPAT -+static long snd_compr_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg) -+{ -+ return snd_compr_ioctl(file, cmd, (unsigned long)compat_ptr(arg)); -+} -+#endif -+ - static const struct file_operations snd_compr_file_ops = { - .owner = THIS_MODULE, - .open = snd_compr_open, -@@ -866,6 +876,9 @@ static const struct file_operations snd_compr_file_ops = { - .write = snd_compr_write, - .read = snd_compr_read, - .unlocked_ioctl = snd_compr_ioctl, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = snd_compr_ioctl_compat, -+#endif - .mmap = snd_compr_mmap, - .poll = snd_compr_poll, - }; -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 07feb35f1935..443bb8ce8255 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -950,6 +950,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) - oss_frame_size = snd_pcm_format_physical_width(params_format(params)) * - params_channels(params) / 8; - -+ err = snd_pcm_oss_period_size(substream, params, sparams); -+ if (err < 0) -+ goto failure; -+ -+ n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); -+ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); -+ if (err < 0) -+ goto failure; -+ -+ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, -+ runtime->oss.periods, NULL); -+ if (err < 0) -+ goto failure; -+ -+ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); -+ -+ err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams); -+ if (err < 0) { -+ pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); -+ goto failure; -+ } -+ - #ifdef CONFIG_SND_PCM_OSS_PLUGINS - snd_pcm_oss_plugin_clear(substream); - if (!direct) { -@@ -984,27 +1006,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) - } - #endif - -- err = snd_pcm_oss_period_size(substream, params, sparams); -- if (err < 0) -- goto failure; -- -- n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); -- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); -- if (err < 0) -- goto failure; -- -- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, -- runtime->oss.periods, NULL); -- if (err < 0) -- goto failure; -- -- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); -- -- if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) { -- pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); -- goto failure; -- } -- - if (runtime->oss.trigger) { - sw_params->start_threshold = 1; - } else { -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 9b6dcdea4431..4d6f0f56d54a 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -1254,8 +1254,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push) - static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state) - { - struct snd_pcm_runtime *runtime = substream->runtime; -- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) -+ switch (runtime->status->state) { -+ case SNDRV_PCM_STATE_SUSPENDED: - return -EBUSY; -+ /* unresumable PCM state; return -EBUSY for skipping suspend */ -+ case SNDRV_PCM_STATE_OPEN: -+ case SNDRV_PCM_STATE_SETUP: -+ case SNDRV_PCM_STATE_DISCONNECTED: -+ return -EBUSY; -+ } - runtime->trigger_master = substream; - return 0; - } -diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c -index 59111cadaec2..c8b2309352d7 100644 ---- a/sound/core/rawmidi.c -+++ b/sound/core/rawmidi.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card, - return -ENXIO; - if (info->stream < 0 || info->stream > 1) - return -EINVAL; -+ info->stream = array_index_nospec(info->stream, 2); - pstr = &rmidi->streams[info->stream]; - if (pstr->substream_count == 0) - return -ENOENT; -diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c -index ea545f9291b4..df5b984bb33f 100644 ---- a/sound/core/seq/oss/seq_oss_synth.c -+++ b/sound/core/seq/oss/seq_oss_synth.c -@@ -617,13 +617,14 @@ int - snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf) - { - struct seq_oss_synth *rec; -+ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); - -- if (dev < 0 || dev >= dp->max_synthdev) -+ if (!info) - return -ENXIO; - -- if (dp->synths[dev].is_midi) { -+ if (info->is_midi) { - struct midi_info minf; -- snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf); -+ snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); - inf->synth_type = SYNTH_TYPE_MIDI; - inf->synth_subtype = 0; - inf->nr_voices = 16; -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index f6d4a1046e54..ad0b23a21bc8 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -3004,6 +3004,7 @@ static void hda_call_codec_resume(struct hda_codec *codec) - hda_jackpoll_work(&codec->jackpoll_work.work); - else - snd_hda_jack_report_sync(codec); -+ codec->core.dev.power.power_state = PMSG_ON; - atomic_dec(&codec->core.in_pm); - } - -@@ -3036,10 +3037,62 @@ static int hda_codec_runtime_resume(struct device *dev) - } - #endif /* CONFIG_PM */ - -+#ifdef CONFIG_PM_SLEEP -+static int hda_codec_force_resume(struct device *dev) -+{ -+ int ret; -+ -+ /* The get/put pair below enforces the runtime resume even if the -+ * device hasn't been used at suspend time. This trick is needed to -+ * update the jack state change during the sleep. -+ */ -+ pm_runtime_get_noresume(dev); -+ ret = pm_runtime_force_resume(dev); -+ pm_runtime_put(dev); -+ return ret; -+} -+ -+static int hda_codec_pm_suspend(struct device *dev) -+{ -+ dev->power.power_state = PMSG_SUSPEND; -+ return pm_runtime_force_suspend(dev); -+} -+ -+static int hda_codec_pm_resume(struct device *dev) -+{ -+ dev->power.power_state = PMSG_RESUME; -+ return hda_codec_force_resume(dev); -+} -+ -+static int hda_codec_pm_freeze(struct device *dev) -+{ -+ dev->power.power_state = PMSG_FREEZE; -+ return pm_runtime_force_suspend(dev); -+} -+ -+static int hda_codec_pm_thaw(struct device *dev) -+{ -+ dev->power.power_state = PMSG_THAW; -+ return hda_codec_force_resume(dev); -+} -+ -+static int hda_codec_pm_restore(struct device *dev) -+{ -+ dev->power.power_state = PMSG_RESTORE; -+ return hda_codec_force_resume(dev); -+} -+#endif /* CONFIG_PM_SLEEP */ -+ - /* referred in hda_bind.c */ - const struct dev_pm_ops hda_codec_driver_pm = { -- SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, -- pm_runtime_force_resume) -+#ifdef CONFIG_PM_SLEEP -+ .suspend = hda_codec_pm_suspend, -+ .resume = hda_codec_pm_resume, -+ .freeze = hda_codec_pm_freeze, -+ .thaw = hda_codec_pm_thaw, -+ .poweroff = hda_codec_pm_suspend, -+ .restore = hda_codec_pm_restore, -+#endif /* CONFIG_PM_SLEEP */ - SET_RUNTIME_PM_OPS(hda_codec_runtime_suspend, hda_codec_runtime_resume, - NULL) - }; -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index d01e2ce818f7..62b38f2ff60d 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -238,19 +238,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) - if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d)) - decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n / - decoder->tsc_ctc_ratio_d; -- -- /* -- * Allow for timestamps appearing to backwards because a TSC -- * packet has slipped past a MTC packet, so allow 2 MTC ticks -- * or ... -- */ -- decoder->tsc_slip = multdiv(2 << decoder->mtc_shift, -- decoder->tsc_ctc_ratio_n, -- decoder->tsc_ctc_ratio_d); - } -- /* ... or 0x100 paranoia */ -- if (decoder->tsc_slip < 0x100) -- decoder->tsc_slip = 0x100; -+ -+ /* -+ * A TSC packet can slip past MTC packets so that the timestamp appears -+ * to go backwards. One estimate is that can be up to about 40 CPU -+ * cycles, which is certainly less than 0x1000 TSC ticks, but accept -+ * slippage an order of magnitude more to be on the safe side. -+ */ -+ decoder->tsc_slip = 0x10000; - - intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift); - intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n); -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index fce48d11ae07..08a954582e31 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -2611,6 +2611,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, - { - struct kvm_device *dev = filp->private_data; - -+ if (dev->kvm->mm != current->mm) -+ return -EIO; -+ - switch (ioctl) { - case KVM_SET_DEVICE_ATTR: - return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg); diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.178-179.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.178-179.patch deleted file mode 100644 index 711ef543483a..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.178-179.patch +++ /dev/null @@ -1,5220 +0,0 @@ -diff --git a/Documentation/arm/kernel_mode_neon.txt b/Documentation/arm/kernel_mode_neon.txt -index 525452726d31..b9e060c5b61e 100644 ---- a/Documentation/arm/kernel_mode_neon.txt -+++ b/Documentation/arm/kernel_mode_neon.txt -@@ -6,7 +6,7 @@ TL;DR summary - * Use only NEON instructions, or VFP instructions that don't rely on support - code - * Isolate your NEON code in a separate compilation unit, and compile it with -- '-mfpu=neon -mfloat-abi=softfp' -+ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp' - * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your - NEON code - * Don't sleep in your NEON code, and be aware that it will be executed with -@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken. - Therefore, the recommended and only supported way of using NEON/VFP in the - kernel is by adhering to the following rules: - * isolate the NEON code in a separate compilation unit and compile it with -- '-mfpu=neon -mfloat-abi=softfp'; -+ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'; - * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls - into the unit containing the NEON code from a compilation unit which is *not* - built with the GCC flag '-mfpu=neon' set. -diff --git a/Makefile b/Makefile -index 35be7983ef2d..ee0a50b871b9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 178 -+SUBLEVEL = 179 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -639,7 +639,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) - KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) - - ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE --KBUILD_CFLAGS += $(call cc-option,-Oz,-Os) -+KBUILD_CFLAGS += -Os - else - ifdef CONFIG_PROFILE_ALL_BRANCHES - KBUILD_CFLAGS += -O2 -diff --git a/arch/arm/boot/dts/sama5d2-pinfunc.h b/arch/arm/boot/dts/sama5d2-pinfunc.h -index 8a394f336003..ee65702f9645 100644 ---- a/arch/arm/boot/dts/sama5d2-pinfunc.h -+++ b/arch/arm/boot/dts/sama5d2-pinfunc.h -@@ -517,7 +517,7 @@ - #define PIN_PC9__GPIO PINMUX_PIN(PIN_PC9, 0, 0) - #define PIN_PC9__FIQ PINMUX_PIN(PIN_PC9, 1, 3) - #define PIN_PC9__GTSUCOMP PINMUX_PIN(PIN_PC9, 2, 1) --#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 2, 1) -+#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 3, 1) - #define PIN_PC9__TIOA4 PINMUX_PIN(PIN_PC9, 4, 2) - #define PIN_PC10 74 - #define PIN_PC10__GPIO PINMUX_PIN(PIN_PC10, 0, 0) -diff --git a/arch/arm/crypto/sha256-armv4.pl b/arch/arm/crypto/sha256-armv4.pl -index fac0533ea633..f64e8413ab9a 100644 ---- a/arch/arm/crypto/sha256-armv4.pl -+++ b/arch/arm/crypto/sha256-armv4.pl -@@ -205,10 +205,11 @@ K256: - .global sha256_block_data_order - .type sha256_block_data_order,%function - sha256_block_data_order: -+.Lsha256_block_data_order: - #if __ARM_ARCH__<7 - sub r3,pc,#8 @ sha256_block_data_order - #else -- adr r3,sha256_block_data_order -+ adr r3,.Lsha256_block_data_order - #endif - #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__) - ldr r12,.LOPENSSL_armcap -diff --git a/arch/arm/crypto/sha256-core.S_shipped b/arch/arm/crypto/sha256-core.S_shipped -index 555a1a8eec90..72c248081d27 100644 ---- a/arch/arm/crypto/sha256-core.S_shipped -+++ b/arch/arm/crypto/sha256-core.S_shipped -@@ -86,10 +86,11 @@ K256: - .global sha256_block_data_order - .type sha256_block_data_order,%function - sha256_block_data_order: -+.Lsha256_block_data_order: - #if __ARM_ARCH__<7 - sub r3,pc,#8 @ sha256_block_data_order - #else -- adr r3,sha256_block_data_order -+ adr r3,.Lsha256_block_data_order - #endif - #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__) - ldr r12,.LOPENSSL_armcap -diff --git a/arch/arm/crypto/sha512-armv4.pl b/arch/arm/crypto/sha512-armv4.pl -index a2b11a844357..5fe336420bcf 100644 ---- a/arch/arm/crypto/sha512-armv4.pl -+++ b/arch/arm/crypto/sha512-armv4.pl -@@ -267,10 +267,11 @@ WORD64(0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817) - .global sha512_block_data_order - .type sha512_block_data_order,%function - sha512_block_data_order: -+.Lsha512_block_data_order: - #if __ARM_ARCH__<7 - sub r3,pc,#8 @ sha512_block_data_order - #else -- adr r3,sha512_block_data_order -+ adr r3,.Lsha512_block_data_order - #endif - #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__) - ldr r12,.LOPENSSL_armcap -diff --git a/arch/arm/crypto/sha512-core.S_shipped b/arch/arm/crypto/sha512-core.S_shipped -index 3694c4d4ca2b..de9bd7f55242 100644 ---- a/arch/arm/crypto/sha512-core.S_shipped -+++ b/arch/arm/crypto/sha512-core.S_shipped -@@ -134,10 +134,11 @@ WORD64(0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817) - .global sha512_block_data_order - .type sha512_block_data_order,%function - sha512_block_data_order: -+.Lsha512_block_data_order: - #if __ARM_ARCH__<7 - sub r3,pc,#8 @ sha512_block_data_order - #else -- adr r3,sha512_block_data_order -+ adr r3,.Lsha512_block_data_order - #endif - #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__) - ldr r12,.LOPENSSL_armcap -diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h -index 3ff5642d9788..27c1d26b05b5 100644 ---- a/arch/arm/include/asm/barrier.h -+++ b/arch/arm/include/asm/barrier.h -@@ -10,6 +10,8 @@ - #define sev() __asm__ __volatile__ ("sev" : : : "memory") - #define wfe() __asm__ __volatile__ ("wfe" : : : "memory") - #define wfi() __asm__ __volatile__ ("wfi" : : : "memory") -+#else -+#define wfe() do { } while (0) - #endif - - #if __LINUX_ARM_ARCH__ >= 7 -diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h -index 8a1e8e995dae..08509183c7df 100644 ---- a/arch/arm/include/asm/processor.h -+++ b/arch/arm/include/asm/processor.h -@@ -77,7 +77,11 @@ extern void release_thread(struct task_struct *); - unsigned long get_wchan(struct task_struct *p); - - #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327) --#define cpu_relax() smp_mb() -+#define cpu_relax() \ -+ do { \ -+ smp_mb(); \ -+ __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;"); \ -+ } while (0) - #else - #define cpu_relax() barrier() - #endif -diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c -index 8bf3b7c09888..46519916a465 100644 ---- a/arch/arm/kernel/machine_kexec.c -+++ b/arch/arm/kernel/machine_kexec.c -@@ -87,8 +87,11 @@ void machine_crash_nonpanic_core(void *unused) - - set_cpu_online(smp_processor_id(), false); - atomic_dec(&waiting_for_crash_ipi); -- while (1) -+ -+ while (1) { - cpu_relax(); -+ wfe(); -+ } - } - - static void machine_kexec_mask_interrupts(void) -diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c -index 69bda1a5707e..1f665acaa6a9 100644 ---- a/arch/arm/kernel/patch.c -+++ b/arch/arm/kernel/patch.c -@@ -15,7 +15,7 @@ struct patch { - unsigned int insn; - }; - --static DEFINE_SPINLOCK(patch_lock); -+static DEFINE_RAW_SPINLOCK(patch_lock); - - static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags) - __acquires(&patch_lock) -@@ -32,7 +32,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags) - return addr; - - if (flags) -- spin_lock_irqsave(&patch_lock, *flags); -+ raw_spin_lock_irqsave(&patch_lock, *flags); - else - __acquire(&patch_lock); - -@@ -47,7 +47,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) - clear_fixmap(fixmap); - - if (flags) -- spin_unlock_irqrestore(&patch_lock, *flags); -+ raw_spin_unlock_irqrestore(&patch_lock, *flags); - else - __release(&patch_lock); - } -diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index 08ce9e36dc5a..0f1c11861147 100644 ---- a/arch/arm/kernel/smp.c -+++ b/arch/arm/kernel/smp.c -@@ -563,8 +563,10 @@ static void ipi_cpu_stop(unsigned int cpu) - local_fiq_disable(); - local_irq_disable(); - -- while (1) -+ while (1) { - cpu_relax(); -+ wfe(); -+ } - } - - static DEFINE_PER_CPU(struct completion *, cpu_completion); -diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c -index 0bee233fef9a..314cfb232a63 100644 ---- a/arch/arm/kernel/unwind.c -+++ b/arch/arm/kernel/unwind.c -@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[]; - static const struct unwind_idx *__origin_unwind_idx; - extern const struct unwind_idx __stop_unwind_idx[]; - --static DEFINE_SPINLOCK(unwind_lock); -+static DEFINE_RAW_SPINLOCK(unwind_lock); - static LIST_HEAD(unwind_tables); - - /* Convert a prel31 symbol to an absolute address */ -@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) - /* module unwind tables */ - struct unwind_table *table; - -- spin_lock_irqsave(&unwind_lock, flags); -+ raw_spin_lock_irqsave(&unwind_lock, flags); - list_for_each_entry(table, &unwind_tables, list) { - if (addr >= table->begin_addr && - addr < table->end_addr) { -@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr) - break; - } - } -- spin_unlock_irqrestore(&unwind_lock, flags); -+ raw_spin_unlock_irqrestore(&unwind_lock, flags); - } - - pr_debug("%s: idx = %p\n", __func__, idx); -@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size, - tab->begin_addr = text_addr; - tab->end_addr = text_addr + text_size; - -- spin_lock_irqsave(&unwind_lock, flags); -+ raw_spin_lock_irqsave(&unwind_lock, flags); - list_add_tail(&tab->list, &unwind_tables); -- spin_unlock_irqrestore(&unwind_lock, flags); -+ raw_spin_unlock_irqrestore(&unwind_lock, flags); - - return tab; - } -@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab) - if (!tab) - return; - -- spin_lock_irqsave(&unwind_lock, flags); -+ raw_spin_lock_irqsave(&unwind_lock, flags); - list_del(&tab->list); -- spin_unlock_irqrestore(&unwind_lock, flags); -+ raw_spin_unlock_irqrestore(&unwind_lock, flags); - - kfree(tab); - } -diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile -index d8a780799506..06348a3d50c2 100644 ---- a/arch/arm/lib/Makefile -+++ b/arch/arm/lib/Makefile -@@ -35,7 +35,7 @@ $(obj)/csumpartialcopy.o: $(obj)/csumpartialcopygeneric.S - $(obj)/csumpartialcopyuser.o: $(obj)/csumpartialcopygeneric.S - - ifeq ($(CONFIG_KERNEL_MODE_NEON),y) -- NEON_FLAGS := -mfloat-abi=softfp -mfpu=neon -+ NEON_FLAGS := -march=armv7-a -mfloat-abi=softfp -mfpu=neon - CFLAGS_xor-neon.o += $(NEON_FLAGS) - obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o - endif -diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c -index 2c40aeab3eaa..c691b901092f 100644 ---- a/arch/arm/lib/xor-neon.c -+++ b/arch/arm/lib/xor-neon.c -@@ -14,7 +14,7 @@ - MODULE_LICENSE("GPL"); - - #ifndef __ARM_NEON__ --#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon' -+#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon' - #endif - - /* -diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c -index 0ce4548ef7f0..4b9e9d1d8229 100644 ---- a/arch/arm/mach-omap2/prm_common.c -+++ b/arch/arm/mach-omap2/prm_common.c -@@ -533,8 +533,10 @@ void omap_prm_reset_system(void) - - prm_ll_data->reset_system(); - -- while (1) -+ while (1) { - cpu_relax(); -+ wfe(); -+ } - } - - /** -diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig -index 57729b915003..b9396dcf836d 100644 ---- a/arch/arm/plat-samsung/Kconfig -+++ b/arch/arm/plat-samsung/Kconfig -@@ -255,7 +255,7 @@ config S3C_PM_DEBUG_LED_SMDK - - config SAMSUNG_PM_CHECK - bool "S3C2410 PM Suspend Memory CRC" -- depends on PM -+ depends on PM && (PLAT_S3C24XX || ARCH_S3C64XX || ARCH_S5PV210) - select CRC32 - help - Enable the PM code's memory area checksum over sleep. This option -diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h -index 195fd56b2377..34d4d2e2f561 100644 ---- a/arch/arm64/include/asm/futex.h -+++ b/arch/arm64/include/asm/futex.h -@@ -33,8 +33,8 @@ - " prfm pstl1strm, %2\n" \ - "1: ldxr %w1, %2\n" \ - insn "\n" \ --"2: stlxr %w3, %w0, %2\n" \ --" cbnz %w3, 1b\n" \ -+"2: stlxr %w0, %w3, %2\n" \ -+" cbnz %w0, 1b\n" \ - " dmb ish\n" \ - "3:\n" \ - " .pushsection .fixup,\"ax\"\n" \ -@@ -61,23 +61,23 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) - - switch (op) { - case FUTEX_OP_SET: -- __futex_atomic_op("mov %w0, %w4", -+ __futex_atomic_op("mov %w3, %w4", - ret, oldval, uaddr, tmp, oparg); - break; - case FUTEX_OP_ADD: -- __futex_atomic_op("add %w0, %w1, %w4", -+ __futex_atomic_op("add %w3, %w1, %w4", - ret, oldval, uaddr, tmp, oparg); - break; - case FUTEX_OP_OR: -- __futex_atomic_op("orr %w0, %w1, %w4", -+ __futex_atomic_op("orr %w3, %w1, %w4", - ret, oldval, uaddr, tmp, oparg); - break; - case FUTEX_OP_ANDN: -- __futex_atomic_op("and %w0, %w1, %w4", -+ __futex_atomic_op("and %w3, %w1, %w4", - ret, oldval, uaddr, tmp, ~oparg); - break; - case FUTEX_OP_XOR: -- __futex_atomic_op("eor %w0, %w1, %w4", -+ __futex_atomic_op("eor %w3, %w1, %w4", - ret, oldval, uaddr, tmp, oparg); - break; - default: -diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c -index bcac81e600b9..f72743dc070d 100644 ---- a/arch/arm64/kernel/kgdb.c -+++ b/arch/arm64/kernel/kgdb.c -@@ -215,25 +215,34 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, - - static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr) - { -+ if (user_mode(regs)) -+ return DBG_HOOK_ERROR; -+ - kgdb_handle_exception(1, SIGTRAP, 0, regs); -- return 0; -+ return DBG_HOOK_HANDLED; - } - NOKPROBE_SYMBOL(kgdb_brk_fn) - - static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr) - { -+ if (user_mode(regs)) -+ return DBG_HOOK_ERROR; -+ - compiled_break = 1; - kgdb_handle_exception(1, SIGTRAP, 0, regs); - -- return 0; -+ return DBG_HOOK_HANDLED; - } - NOKPROBE_SYMBOL(kgdb_compiled_brk_fn); - - static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) - { -+ if (user_mode(regs)) -+ return DBG_HOOK_ERROR; -+ - kgdb_handle_exception(1, SIGTRAP, 0, regs); -- return 0; -+ return DBG_HOOK_HANDLED; - } - NOKPROBE_SYMBOL(kgdb_step_brk_fn); - - static struct break_hook kgdb_brkpt_hook = { -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 04c4b88706d8..89abdf9af4e6 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -589,11 +589,12 @@ void __init hook_debug_fault_code(int nr, - debug_fault_info[nr].name = name; - } - --asmlinkage int __exception do_debug_exception(unsigned long addr, -+asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint, - unsigned int esr, - struct pt_regs *regs) - { - const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); -+ unsigned long pc = instruction_pointer(regs); - struct siginfo info; - int rv; - -@@ -604,16 +605,16 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, - if (interrupts_enabled(regs)) - trace_hardirqs_off(); - -- if (!inf->fn(addr, esr, regs)) { -+ if (!inf->fn(addr_if_watchpoint, esr, regs)) { - rv = 1; - } else { - pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", -- inf->name, esr, addr); -+ inf->name, esr, pc); - - info.si_signo = inf->sig; - info.si_errno = 0; - info.si_code = inf->code; -- info.si_addr = (void __user *)addr; -+ info.si_addr = (void __user *)pc; - arm64_notify_die("", regs, &info, 0); - rv = 0; - } -diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile -index e1c02ca230cb..073bba6f9f60 100644 ---- a/arch/h8300/Makefile -+++ b/arch/h8300/Makefile -@@ -23,7 +23,7 @@ KBUILD_AFLAGS += $(aflags-y) - LDFLAGS += $(ldflags-y) - - ifeq ($(CROSS_COMPILE),) --CROSS_COMPILE := h8300-unknown-linux- -+CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-) - endif - - core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/ -diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile -index 6da2cd0897f3..e94745321cac 100644 ---- a/arch/x86/boot/Makefile -+++ b/arch/x86/boot/Makefile -@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE - AFLAGS_header.o += -I$(obj) - $(obj)/header.o: $(obj)/voffset.h $(obj)/zoffset.h - --LDFLAGS_setup.elf := -T -+LDFLAGS_setup.elf := -m elf_i386 -T - $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE - $(call if_changed,ld) - -diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S -index eff2f414e22b..ec234c43b3f4 100644 ---- a/arch/x86/crypto/poly1305-avx2-x86_64.S -+++ b/arch/x86/crypto/poly1305-avx2-x86_64.S -@@ -321,6 +321,12 @@ ENTRY(poly1305_4block_avx2) - vpaddq t2,t1,t1 - vmovq t1x,d4 - -+ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> -+ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small -+ # amount. Careful: we must not assume the carry bits 'd0 >> 26', -+ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit -+ # integers. It's true in a single-block implementation, but not here. -+ - # d1 += d0 >> 26 - mov d0,%rax - shr $26,%rax -@@ -359,16 +365,16 @@ ENTRY(poly1305_4block_avx2) - # h0 += (d4 >> 26) * 5 - mov d4,%rax - shr $26,%rax -- lea (%eax,%eax,4),%eax -- add %eax,%ebx -+ lea (%rax,%rax,4),%rax -+ add %rax,%rbx - # h4 = d4 & 0x3ffffff - mov d4,%rax - and $0x3ffffff,%eax - mov %eax,h4 - - # h1 += h0 >> 26 -- mov %ebx,%eax -- shr $26,%eax -+ mov %rbx,%rax -+ shr $26,%rax - add %eax,h1 - # h0 = h0 & 0x3ffffff - andl $0x3ffffff,%ebx -diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S -index 338c748054ed..639d9760b089 100644 ---- a/arch/x86/crypto/poly1305-sse2-x86_64.S -+++ b/arch/x86/crypto/poly1305-sse2-x86_64.S -@@ -251,16 +251,16 @@ ENTRY(poly1305_block_sse2) - # h0 += (d4 >> 26) * 5 - mov d4,%rax - shr $26,%rax -- lea (%eax,%eax,4),%eax -- add %eax,%ebx -+ lea (%rax,%rax,4),%rax -+ add %rax,%rbx - # h4 = d4 & 0x3ffffff - mov d4,%rax - and $0x3ffffff,%eax - mov %eax,h4 - - # h1 += h0 >> 26 -- mov %ebx,%eax -- shr $26,%eax -+ mov %rbx,%rax -+ shr $26,%rax - add %eax,h1 - # h0 = h0 & 0x3ffffff - andl $0x3ffffff,%ebx -@@ -518,6 +518,12 @@ ENTRY(poly1305_2block_sse2) - paddq t2,t1 - movq t1,d4 - -+ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 -> -+ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small -+ # amount. Careful: we must not assume the carry bits 'd0 >> 26', -+ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit -+ # integers. It's true in a single-block implementation, but not here. -+ - # d1 += d0 >> 26 - mov d0,%rax - shr $26,%rax -@@ -556,16 +562,16 @@ ENTRY(poly1305_2block_sse2) - # h0 += (d4 >> 26) * 5 - mov d4,%rax - shr $26,%rax -- lea (%eax,%eax,4),%eax -- add %eax,%ebx -+ lea (%rax,%rax,4),%rax -+ add %rax,%rbx - # h4 = d4 & 0x3ffffff - mov d4,%rax - and $0x3ffffff,%eax - mov %eax,h4 - - # h1 += h0 >> 26 -- mov %ebx,%eax -- shr $26,%eax -+ mov %rbx,%rax -+ shr $26,%rax - add %eax,h1 - # h0 = h0 & 0x3ffffff - andl $0x3ffffff,%ebx -index 0977e7607046..5937b112ebc2 100644 ---- a/arch/x86/include/asm/xen/hypercall.h -+++ b/arch/x86/include/asm/xen/hypercall.h -@@ -215,6 +215,9 @@ privcmd_call(unsigned call, - __HYPERCALL_DECLS; - __HYPERCALL_5ARG(a1, a2, a3, a4, a5); - -+ if (call >= PAGE_SIZE / sizeof(hypercall_page[0])) -+ return -EINVAL; -+ - stac(); - asm volatile(CALL_NOSPEC - : __HYPERCALL_5PARAM -diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c -index 15e47c1cd412..6e4e4191abb5 100644 ---- a/arch/x86/kernel/cpu/cyrix.c -+++ b/arch/x86/kernel/cpu/cyrix.c -@@ -121,7 +121,7 @@ static void set_cx86_reorder(void) - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ - - /* Load/Store Serialize to mem access disable (=reorder it) */ -- setCx86_old(CX86_PCR0, getCx86_old(CX86_PCR0) & ~0x80); -+ setCx86(CX86_PCR0, getCx86(CX86_PCR0) & ~0x80); - /* set load/store serialize from 1GB to 4GB */ - ccr3 |= 0xe0; - setCx86(CX86_CCR3, ccr3); -@@ -132,11 +132,11 @@ static void set_cx86_memwb(void) - printk(KERN_INFO "Enable Memory-Write-back mode on Cyrix/NSC processor.\n"); - - /* CCR2 bit 2: unlock NW bit */ -- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) & ~0x04); -+ setCx86(CX86_CCR2, getCx86(CX86_CCR2) & ~0x04); - /* set 'Not Write-through' */ - write_cr0(read_cr0() | X86_CR0_NW); - /* CCR2 bit 2: lock NW bit and set WT1 */ -- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x14); -+ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14); - } - - /* -@@ -150,14 +150,14 @@ static void geode_configure(void) - local_irq_save(flags); - - /* Suspend on halt power saving and enable #SUSP pin */ -- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x88); -+ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88); - - ccr3 = getCx86(CX86_CCR3); - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */ - - - /* FPU fast, DTE cache, Mem bypass */ -- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x38); -+ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x38); - setCx86(CX86_CCR3, ccr3); /* disable MAPEN */ - - set_cx86_memwb(); -@@ -292,7 +292,7 @@ static void init_cyrix(struct cpuinfo_x86 *c) - /* GXm supports extended cpuid levels 'ala' AMD */ - if (c->cpuid_level == 2) { - /* Enable cxMMX extensions (GX1 Datasheet 54) */ -- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7) | 1); -+ setCx86(CX86_CCR7, getCx86(CX86_CCR7) | 1); - - /* - * GXm : 0x30 ... 0x5f GXm datasheet 51 -@@ -315,7 +315,7 @@ static void init_cyrix(struct cpuinfo_x86 *c) - if (dir1 > 7) { - dir0_msn++; /* M II */ - /* Enable MMX extensions (App note 108) */ -- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7)|1); -+ setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1); - } else { - /* A 6x86MX - it has the bug. */ - set_cpu_bug(c, X86_BUG_COMA); -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index 3fdc1e53aaac..9cce5504a5c7 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -825,6 +825,8 @@ int __init hpet_enable(void) - return 0; - - hpet_set_mapping(); -+ if (!hpet_virt_address) -+ return 0; - - /* - * Read the period and check for a sane value: -diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c -index 2bcfb5f2bc44..433f17d154e2 100644 ---- a/arch/x86/kernel/hw_breakpoint.c -+++ b/arch/x86/kernel/hw_breakpoint.c -@@ -351,6 +351,7 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp) - #endif - default: - WARN_ON_ONCE(1); -+ return -EINVAL; - } - - /* -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index c6f466d6cc57..a9fc2292d9ce 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -541,6 +541,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs) - unsigned long *sara = stack_addr(regs); - - ri->ret_addr = (kprobe_opcode_t *) *sara; -+ ri->fp = sara; - - /* Replace the return addr with trampoline addr */ - *sara = (unsigned long) &kretprobe_trampoline; -@@ -742,15 +743,21 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - unsigned long flags, orig_ret_address = 0; - unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline; - kprobe_opcode_t *correct_ret_addr = NULL; -+ void *frame_pointer; -+ bool skipped = false; - - INIT_HLIST_HEAD(&empty_rp); - kretprobe_hash_lock(current, &head, &flags); - /* fixup registers */ - #ifdef CONFIG_X86_64 - regs->cs = __KERNEL_CS; -+ /* On x86-64, we use pt_regs->sp for return address holder. */ -+ frame_pointer = ®s->sp; - #else - regs->cs = __KERNEL_CS | get_kernel_rpl(); - regs->gs = 0; -+ /* On x86-32, we use pt_regs->flags for return address holder. */ -+ frame_pointer = ®s->flags; - #endif - regs->ip = trampoline_address; - regs->orig_ax = ~0UL; -@@ -772,8 +779,25 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - if (ri->task != current) - /* another task is sharing our hash bucket */ - continue; -+ /* -+ * Return probes must be pushed on this hash list correct -+ * order (same as return order) so that it can be poped -+ * correctly. However, if we find it is pushed it incorrect -+ * order, this means we find a function which should not be -+ * probed, because the wrong order entry is pushed on the -+ * path of processing other kretprobe itself. -+ */ -+ if (ri->fp != frame_pointer) { -+ if (!skipped) -+ pr_warn("kretprobe is stacked incorrectly. Trying to fixup.\n"); -+ skipped = true; -+ continue; -+ } - - orig_ret_address = (unsigned long)ri->ret_addr; -+ if (skipped) -+ pr_warn("%ps must be blacklisted because of incorrect kretprobe order\n", -+ ri->rp->kp.addr); - - if (orig_ret_address != trampoline_address) - /* -@@ -791,6 +815,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) - if (ri->task != current) - /* another task is sharing our hash bucket */ - continue; -+ if (ri->fp != frame_pointer) -+ continue; - - orig_ret_address = (unsigned long)ri->ret_addr; - if (ri->rp && ri->rp->handler) { -diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S -index a703842b54de..17e1e60b6b40 100644 ---- a/arch/x86/kernel/vmlinux.lds.S -+++ b/arch/x86/kernel/vmlinux.lds.S -@@ -365,7 +365,7 @@ SECTIONS - * Per-cpu symbols which need to be offset from __per_cpu_load - * for the boot processor. - */ --#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load -+#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load - INIT_PER_CPU(gdt_page); - INIT_PER_CPU(irq_stack_union); - -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index f1507626ed36..5dd56e3517f3 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2567,15 +2567,13 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) - * CR0/CR3/CR4/EFER. It's all a bit more complicated if the vCPU - * supports long mode. - */ -- cr4 = ctxt->ops->get_cr(ctxt, 4); - if (emulator_has_longmode(ctxt)) { - struct desc_struct cs_desc; - - /* Zero CR4.PCIDE before CR0.PG. */ -- if (cr4 & X86_CR4_PCIDE) { -+ cr4 = ctxt->ops->get_cr(ctxt, 4); -+ if (cr4 & X86_CR4_PCIDE) - ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE); -- cr4 &= ~X86_CR4_PCIDE; -- } - - /* A 32-bit code segment is required to clear EFER.LMA. */ - memset(&cs_desc, 0, sizeof(cs_desc)); -@@ -2589,13 +2587,16 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) - if (cr0 & X86_CR0_PE) - ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE)); - -- /* Now clear CR4.PAE (which must be done before clearing EFER.LME). */ -- if (cr4 & X86_CR4_PAE) -- ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE); -+ if (emulator_has_longmode(ctxt)) { -+ /* Clear CR4.PAE before clearing EFER.LME. */ -+ cr4 = ctxt->ops->get_cr(ctxt, 4); -+ if (cr4 & X86_CR4_PAE) -+ ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE); - -- /* And finally go back to 32-bit mode. */ -- efer = 0; -- ctxt->ops->set_msr(ctxt, MSR_EFER, efer); -+ /* And finally go back to 32-bit mode. */ -+ efer = 0; -+ ctxt->ops->set_msr(ctxt, MSR_EFER, efer); -+ } - - smbase = ctxt->ops->get_smbase(ctxt); - if (emulator_has_longmode(ctxt)) -diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile -index 2730d775ef9a..228cb16962ba 100644 ---- a/arch/x86/realmode/rm/Makefile -+++ b/arch/x86/realmode/rm/Makefile -@@ -43,7 +43,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE - targets += realmode.lds - $(obj)/realmode.lds: $(obj)/pasyms.h - --LDFLAGS_realmode.elf := --emit-relocs -T -+LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T - CPPFLAGS_realmode.lds += -P -C -I$(obj) - - targets += realmode.elf -diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c -index 7538d802b65a..483593068139 100644 ---- a/arch/xtensa/kernel/stacktrace.c -+++ b/arch/xtensa/kernel/stacktrace.c -@@ -272,10 +272,14 @@ static int return_address_cb(struct stackframe *frame, void *data) - return 1; - } - -+/* -+ * level == 0 is for the return address from the caller of this function, -+ * not from this function itself. -+ */ - unsigned long return_address(unsigned level) - { - struct return_addr_data r = { -- .skip = level + 1, -+ .skip = level, - }; - walk_stackframe(stack_pointer(NULL), return_address_cb, &r); - return r.addr; -diff --git a/block/bio.c b/block/bio.c -index 63363a689922..cf513f74dffd 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1216,8 +1216,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q, - } - } - -- if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) -+ if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) { -+ if (!map_data) -+ __free_page(page); - break; -+ } - - len -= bytes; - offset = 0; -diff --git a/crypto/testmgr.h b/crypto/testmgr.h -index 0e02c60a57b6..743d6cb7f8cd 100644 ---- a/crypto/testmgr.h -+++ b/crypto/testmgr.h -@@ -3494,7 +3494,49 @@ static struct hash_testvec poly1305_tv_template[] = { - .psize = 80, - .digest = "\x13\x00\x00\x00\x00\x00\x00\x00" - "\x00\x00\x00\x00\x00\x00\x00\x00", -- }, -+ }, { /* Regression test for overflow in AVX2 implementation */ -+ .plaintext = "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff\xff\xff\xff\xff" -+ "\xff\xff\xff\xff", -+ .psize = 300, -+ .digest = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8" -+ "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1", -+ } - }; - - /* -diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c -index cb3dedb1beae..b133dac8a7f2 100644 ---- a/drivers/acpi/sbs.c -+++ b/drivers/acpi/sbs.c -@@ -443,9 +443,13 @@ static int acpi_ac_get_present(struct acpi_sbs *sbs) - - /* - * The spec requires that bit 4 always be 1. If it's not set, assume -- * that the implementation doesn't support an SBS charger -+ * that the implementation doesn't support an SBS charger. -+ * -+ * And on some MacBooks a status of 0xffff is always returned, no -+ * matter whether the charger is plugged in or not, which is also -+ * wrong, so ignore the SBS charger for those too. - */ -- if (!((status >> 4) & 0x1)) -+ if (!((status >> 4) & 0x1) || status == 0xffff) - return -ENODEV; - - sbs->charger_present = (status >> 15) & 0x1; -diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c -index d203940203b6..aee23092f50e 100644 ---- a/drivers/cdrom/cdrom.c -+++ b/drivers/cdrom/cdrom.c -@@ -265,6 +265,7 @@ - /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */ - /* #define ERRLOGMASK (CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */ - -+#include - #include - #include - #include -@@ -3677,9 +3678,9 @@ static struct ctl_table_header *cdrom_sysctl_header; - - static void cdrom_sysctl_register(void) - { -- static int initialized; -+ static atomic_t initialized = ATOMIC_INIT(0); - -- if (initialized == 1) -+ if (!atomic_add_unless(&initialized, 1, 1)) - return; - - cdrom_sysctl_header = register_sysctl_table(cdrom_root_table); -@@ -3690,8 +3691,6 @@ static void cdrom_sysctl_register(void) - cdrom_sysctl_settings.debug = debug; - cdrom_sysctl_settings.lock = lockdoor; - cdrom_sysctl_settings.check = check_media_type; -- -- initialized = 1; - } - - static void cdrom_sysctl_unregister(void) -diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig -index 3143db57ce44..2bc741bea8f3 100644 ---- a/drivers/char/Kconfig -+++ b/drivers/char/Kconfig -@@ -389,7 +389,7 @@ config XILINX_HWICAP - - config R3964 - tristate "Siemens R3964 line discipline" -- depends on TTY -+ depends on TTY && BROKEN - ---help--- - This driver allows synchronous communication with devices using the - Siemens R3964 packet protocol. Unless you are dealing with special -diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c -index 240b6cf1d97c..72e073895ed9 100644 ---- a/drivers/char/hpet.c -+++ b/drivers/char/hpet.c -@@ -376,7 +376,7 @@ static __init int hpet_mmap_enable(char *str) - pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled"); - return 1; - } --__setup("hpet_mmap", hpet_mmap_enable); -+__setup("hpet_mmap=", hpet_mmap_enable); - - static int hpet_mmap(struct file *file, struct vm_area_struct *vma) - { -diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c -index 3fa2f8a009b3..1c5c4314c6b5 100644 ---- a/drivers/char/hw_random/virtio-rng.c -+++ b/drivers/char/hw_random/virtio-rng.c -@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait) - - if (!vi->busy) { - vi->busy = true; -- init_completion(&vi->have_data); -+ reinit_completion(&vi->have_data); - register_buffer(vi, buf, size); - } - -diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c -index 35308dfff754..8226e3b6dc1f 100644 ---- a/drivers/char/tpm/tpm_crb.c -+++ b/drivers/char/tpm/tpm_crb.c -@@ -109,19 +109,29 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) - struct crb_priv *priv = chip->vendor.priv; - unsigned int expected; - -- /* sanity check */ -- if (count < 6) -+ /* A sanity check that the upper layer wants to get at least the header -+ * as that is the minimum size for any TPM response. -+ */ -+ if (count < TPM_HEADER_SIZE) - return -EIO; - -+ /* If this bit is set, according to the spec, the TPM is in -+ * unrecoverable condition. -+ */ - if (le32_to_cpu(ioread32(&priv->cca->sts)) & CRB_CA_STS_ERROR) - return -EIO; - -- memcpy_fromio(buf, priv->rsp, 6); -- expected = be32_to_cpup((__be32 *) &buf[2]); -- if (expected > count || expected < 6) -+ /* Read the first 8 bytes in order to get the length of the response. -+ * We read exactly a quad word in order to make sure that the remaining -+ * reads will be aligned. -+ */ -+ memcpy_fromio(buf, priv->rsp, 8); -+ -+ expected = be32_to_cpup((__be32 *)&buf[2]); -+ if (expected > count || expected < TPM_HEADER_SIZE) - return -EIO; - -- memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6); -+ memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); - - return expected; - } -diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c -index dd8f0eb3170a..73f7e0f7e34a 100644 ---- a/drivers/char/tpm/tpm_i2c_atmel.c -+++ b/drivers/char/tpm/tpm_i2c_atmel.c -@@ -65,7 +65,15 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) - dev_dbg(&chip->dev, - "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__, - (int)min_t(size_t, 64, len), buf, len, status); -- return status; -+ -+ if (status < 0) -+ return status; -+ -+ /* The upper layer does not support incomplete sends. */ -+ if (status != len) -+ return -E2BIG; -+ -+ return 0; - } - - static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) -diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c -index 4afca3968773..e3b8bebfdd30 100644 ---- a/drivers/crypto/amcc/crypto4xx_alg.c -+++ b/drivers/crypto/amcc/crypto4xx_alg.c -@@ -138,7 +138,8 @@ static int crypto4xx_setkey_aes(struct crypto_ablkcipher *cipher, - sa = (struct dynamic_sa_ctl *) ctx->sa_in; - ctx->hash_final = 0; - -- set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV, -+ set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ? -+ SA_SAVE_IV : SA_NOT_SAVE_IV), - SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE, - SA_NO_HEADER_PROC, SA_HASH_ALG_NULL, - SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO, -diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c -index 78d0722feacb..1e810f5f03fa 100644 ---- a/drivers/crypto/amcc/crypto4xx_core.c -+++ b/drivers/crypto/amcc/crypto4xx_core.c -@@ -645,6 +645,15 @@ static u32 crypto4xx_ablkcipher_done(struct crypto4xx_device *dev, - addr = dma_map_page(dev->core_dev->device, sg_page(dst), - dst->offset, dst->length, DMA_FROM_DEVICE); - } -+ -+ if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { -+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); -+ -+ crypto4xx_memcpy_from_le32((u32 *)req->iv, -+ pd_uinfo->sr_va->save_iv, -+ crypto_skcipher_ivsize(skcipher)); -+ } -+ - crypto4xx_ret_sg_desc(dev, pd_uinfo); - if (ablk_req->base.complete != NULL) - ablk_req->base.complete(&ablk_req->base, 0); -diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c -index dfa337ae06fc..529b315a6683 100644 ---- a/drivers/dma/imx-dma.c -+++ b/drivers/dma/imx-dma.c -@@ -286,7 +286,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d) - struct scatterlist *sg = d->sg; - unsigned long now; - -- now = min(d->len, sg_dma_len(sg)); -+ now = min_t(size_t, d->len, sg_dma_len(sg)); - if (d->len != IMX_DMA_LENGTH_LOOP) - d->len -= now; - -diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c -index c8f79dcaaee8..67f201b8dcda 100644 ---- a/drivers/dma/tegra20-apb-dma.c -+++ b/drivers/dma/tegra20-apb-dma.c -@@ -632,7 +632,10 @@ static void handle_cont_sngl_cycle_dma_done(struct tegra_dma_channel *tdc, - - sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node); - dma_desc = sgreq->dma_desc; -- dma_desc->bytes_transferred += sgreq->req_len; -+ /* if we dma for long enough the transfer count will wrap */ -+ dma_desc->bytes_transferred = -+ (dma_desc->bytes_transferred + sgreq->req_len) % -+ dma_desc->bytes_requested; - - /* Callback need to be call */ - if (!dma_desc->cb_count) -diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c -index f7fbb46d5d79..9943273ec981 100644 ---- a/drivers/gpio/gpio-omap.c -+++ b/drivers/gpio/gpio-omap.c -@@ -872,14 +872,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d) - if (trigger) - omap_set_gpio_triggering(bank, offset, trigger); - -- /* For level-triggered GPIOs, the clearing must be done after -- * the HW source is cleared, thus after the handler has run */ -- if (bank->level_mask & BIT(offset)) { -- omap_set_gpio_irqenable(bank, offset, 0); -+ omap_set_gpio_irqenable(bank, offset, 1); -+ -+ /* -+ * For level-triggered GPIOs, clearing must be done after the source -+ * is cleared, thus after the handler has run. OMAP4 needs this done -+ * after enabing the interrupt to clear the wakeup status. -+ */ -+ if (bank->level_mask & BIT(offset)) - omap_clear_gpio_irqstatus(bank, offset); -- } - -- omap_set_gpio_irqenable(bank, offset, 1); - raw_spin_unlock_irqrestore(&bank->lock, flags); - } - -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 5a1bafb5ecbb..ff12d926eb65 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -3019,6 +3019,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs - msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr; - msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len; - msg.u.i2c_read.transactions[i].bytes = msgs[i].buf; -+ msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & I2C_M_STOP); - } - msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr; - msg.u.i2c_read.num_bytes_read = msgs[num - 1].len; -diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c -index 0edc10b44004..c80cc18747cb 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x.c -@@ -54,7 +54,8 @@ static void etm4_os_unlock(void *info) - - static bool etm4_arch_supported(u8 arch) - { -- switch (arch) { -+ /* Mask out the minor version number */ -+ switch (arch & 0xf0) { - case ETM_ARCH_V4: - break; - default: -diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c -index e4587411b447..153376009b46 100644 ---- a/drivers/i2c/i2c-core.c -+++ b/drivers/i2c/i2c-core.c -@@ -2936,16 +2936,16 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, - the underlying bus driver */ - break; - case I2C_SMBUS_I2C_BLOCK_DATA: -+ if (data->block[0] > I2C_SMBUS_BLOCK_MAX) { -+ dev_err(&adapter->dev, "Invalid block %s size %d\n", -+ read_write == I2C_SMBUS_READ ? "read" : "write", -+ data->block[0]); -+ return -EINVAL; -+ } - if (read_write == I2C_SMBUS_READ) { - msg[1].len = data->block[0]; - } else { - msg[0].len = data->block[0] + 1; -- if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) { -- dev_err(&adapter->dev, -- "Invalid block write size %d\n", -- data->block[0]); -- return -EINVAL; -- } - for (i = 1; i <= data->block[0]; i++) - msgbuf0[i] = data->block[i]; - } -diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c -index 18c1b06684c1..0667b2875ee4 100644 ---- a/drivers/iio/accel/kxcjk-1013.c -+++ b/drivers/iio/accel/kxcjk-1013.c -@@ -1343,6 +1343,8 @@ static int kxcjk1013_resume(struct device *dev) - - mutex_lock(&data->mutex); - ret = kxcjk1013_set_mode(data, OPERATION); -+ if (ret == 0) -+ ret = kxcjk1013_set_range(data, data->range); - mutex_unlock(&data->mutex); - - return ret; -diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c -index 22c4c17cd996..a1d072ecb717 100644 ---- a/drivers/iio/adc/ad_sigma_delta.c -+++ b/drivers/iio/adc/ad_sigma_delta.c -@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta, - if (sigma_delta->info->has_registers) { - data[0] = reg << sigma_delta->info->addr_shift; - data[0] |= sigma_delta->info->read_mask; -+ data[0] |= sigma_delta->comm; - spi_message_add_tail(&t[0], &m); - } - spi_message_add_tail(&t[1], &m); -diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c -index d83e5b75a37b..4b317ffd144c 100644 ---- a/drivers/iio/adc/at91_adc.c -+++ b/drivers/iio/adc/at91_adc.c -@@ -702,23 +702,29 @@ static int at91_adc_read_raw(struct iio_dev *idev, - ret = wait_event_interruptible_timeout(st->wq_data_avail, - st->done, - msecs_to_jiffies(1000)); -- if (ret == 0) -- ret = -ETIMEDOUT; -- if (ret < 0) { -- mutex_unlock(&st->lock); -- return ret; -- } -- -- *val = st->last_value; - -+ /* Disable interrupts, regardless if adc conversion was -+ * successful or not -+ */ - at91_adc_writel(st, AT91_ADC_CHDR, - AT91_ADC_CH(chan->channel)); - at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel)); - -- st->last_value = 0; -- st->done = false; -+ if (ret > 0) { -+ /* a valid conversion took place */ -+ *val = st->last_value; -+ st->last_value = 0; -+ st->done = false; -+ ret = IIO_VAL_INT; -+ } else if (ret == 0) { -+ /* conversion timeout */ -+ dev_err(&idev->dev, "ADC Channel %d timeout.\n", -+ chan->channel); -+ ret = -ETIMEDOUT; -+ } -+ - mutex_unlock(&st->lock); -- return IIO_VAL_INT; -+ return ret; - - case IIO_CHAN_INFO_SCALE: - *val = st->vref_mv; -diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c -index 90841abd3ce4..a4dc6a3783d0 100644 ---- a/drivers/iio/gyro/bmg160_core.c -+++ b/drivers/iio/gyro/bmg160_core.c -@@ -519,11 +519,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev, - } else - return -EINVAL; - case IIO_CHAN_INFO_SCALE: -- *val = 0; - switch (chan->type) { - case IIO_TEMP: -- *val2 = 500000; -- return IIO_VAL_INT_PLUS_MICRO; -+ *val = 500; -+ return IIO_VAL_INT; - case IIO_ANGL_VEL: - { - int i; -@@ -531,6 +530,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev, - for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) { - if (bmg160_scale_table[i].dps_range == - data->dps_range) { -+ *val = 0; - *val2 = bmg160_scale_table[i].scale; - return IIO_VAL_INT_PLUS_MICRO; - } -diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c -index 21cb41a60fe8..3a70b418d913 100644 ---- a/drivers/infiniband/hw/mlx4/alias_GUID.c -+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c -@@ -805,8 +805,8 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev) - unsigned long flags; - - for (i = 0 ; i < dev->num_ports; i++) { -- cancel_delayed_work(&dev->sriov.alias_guid.ports_guid[i].alias_guid_work); - det = &sriov->alias_guid.ports_guid[i]; -+ cancel_delayed_work_sync(&det->alias_guid_work); - spin_lock_irqsave(&sriov->alias_guid.ag_work_lock, flags); - while (!list_empty(&det->cb_list)) { - cb_ctx = list_entry(det->cb_list.next, -diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c -index 39a488889fc7..5dc920fe1326 100644 ---- a/drivers/infiniband/hw/mlx4/cm.c -+++ b/drivers/infiniband/hw/mlx4/cm.c -@@ -39,7 +39,7 @@ - - #include "mlx4_ib.h" - --#define CM_CLEANUP_CACHE_TIMEOUT (5 * HZ) -+#define CM_CLEANUP_CACHE_TIMEOUT (30 * HZ) - - struct id_map_entry { - struct rb_node node; -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index 5a63e32a4a6b..cbad1926cec1 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -143,7 +143,7 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event) - for (tmp = dev; tmp; tmp = tmp->bus->self) - level++; - -- size = sizeof(*info) + level * sizeof(struct acpi_dmar_pci_path); -+ size = sizeof(*info) + level * sizeof(info->path[0]); - if (size <= sizeof(dmar_pci_notify_info_buf)) { - info = (struct dmar_pci_notify_info *)dmar_pci_notify_info_buf; - } else { -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 8b4a4d95669a..3e97c4b2ebed 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -1598,6 +1598,9 @@ static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu) - u32 pmen; - unsigned long flags; - -+ if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap)) -+ return; -+ - raw_spin_lock_irqsave(&iommu->register_lock, flags); - pmen = readl(iommu->reg + DMAR_PMEN_REG); - pmen &= ~DMA_PMEN_EPM; -diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c -index 59b76833f0d3..fd077c176a62 100644 ---- a/drivers/leds/leds-lp55xx-common.c -+++ b/drivers/leds/leds-lp55xx-common.c -@@ -200,7 +200,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) - - if (!fw) { - dev_err(dev, "firmware request failed\n"); -- goto out; -+ return; - } - - /* handling firmware data is chip dependent */ -@@ -213,9 +213,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context) - - mutex_unlock(&chip->lock); - --out: - /* firmware should be released for other channel use */ - release_firmware(chip->fw); -+ chip->fw = NULL; - } - - static int lp55xx_request_firmware(struct lp55xx_chip *chip) -diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c -index 5a5c1f1bd8a5..463ce6757338 100644 ---- a/drivers/md/bcache/sysfs.c -+++ b/drivers/md/bcache/sysfs.c -@@ -215,7 +215,9 @@ STORE(__cached_dev) - d_strtoul(writeback_rate_d_term); - d_strtoul_nonzero(writeback_rate_p_term_inverse); - -- d_strtoi_h(sequential_cutoff); -+ sysfs_strtoul_clamp(sequential_cutoff, -+ dc->sequential_cutoff, -+ 0, UINT_MAX); - d_strtoi_h(readahead); - - if (attr == &sysfs_clear_stats) -@@ -645,8 +647,17 @@ STORE(__bch_cache_set) - c->error_limit = strtoul_or_return(buf) << IO_ERROR_SHIFT; - - /* See count_io_errors() for why 88 */ -- if (attr == &sysfs_io_error_halflife) -- c->error_decay = strtoul_or_return(buf) / 88; -+ if (attr == &sysfs_io_error_halflife) { -+ unsigned long v = 0; -+ ssize_t ret; -+ -+ ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX); -+ if (!ret) { -+ c->error_decay = v / 88; -+ return size; -+ } -+ return ret; -+ } - - sysfs_strtoul(journal_delay_ms, c->journal_delay_ms); - sysfs_strtoul(verify, c->verify); -diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h -index 0526fe92a683..e7a3c12aa66f 100644 ---- a/drivers/md/bcache/sysfs.h -+++ b/drivers/md/bcache/sysfs.h -@@ -80,9 +80,16 @@ do { \ - - #define sysfs_strtoul_clamp(file, var, min, max) \ - do { \ -- if (attr == &sysfs_ ## file) \ -- return strtoul_safe_clamp(buf, var, min, max) \ -- ?: (ssize_t) size; \ -+ if (attr == &sysfs_ ## file) { \ -+ unsigned long v = 0; \ -+ ssize_t ret; \ -+ ret = strtoul_safe_clamp(buf, v, min, max); \ -+ if (!ret) { \ -+ var = v; \ -+ return size; \ -+ } \ -+ return ret; \ -+ } \ - } while (0) - - #define strtoul_or_return(cp) \ -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index 07eaa9f90712..d52ea584e0bc 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -3210,6 +3210,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) - as.argc = argc; - as.argv = argv; - -+ /* make sure metadata and data are different devices */ -+ if (!strcmp(argv[0], argv[1])) { -+ ti->error = "Error setting metadata or data device"; -+ r = -EINVAL; -+ goto out_unlock; -+ } -+ - /* - * Set default pool features. - */ -@@ -4092,6 +4099,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) - tc->sort_bio_list = RB_ROOT; - - if (argc == 3) { -+ if (!strcmp(argv[0], argv[2])) { -+ ti->error = "Error setting origin device"; -+ r = -EINVAL; -+ goto bad_origin_dev; -+ } -+ - r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev); - if (r) { - ti->error = "Error opening origin device"; -diff --git a/drivers/media/i2c/soc_camera/mt9m111.c b/drivers/media/i2c/soc_camera/mt9m111.c -index 6dfaead6aaa8..1d1ca03c797f 100644 ---- a/drivers/media/i2c/soc_camera/mt9m111.c -+++ b/drivers/media/i2c/soc_camera/mt9m111.c -@@ -988,6 +988,8 @@ static int mt9m111_probe(struct i2c_client *client, - mt9m111->rect.top = MT9M111_MIN_DARK_ROWS; - mt9m111->rect.width = MT9M111_MAX_WIDTH; - mt9m111->rect.height = MT9M111_MAX_HEIGHT; -+ mt9m111->width = mt9m111->rect.width; -+ mt9m111->height = mt9m111->rect.height; - mt9m111->fmt = &mt9m111_colour_fmts[0]; - mt9m111->lastpage = -1; - mutex_init(&mt9m111->power_lock); -diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c -index 03a1b606655d..009a4bb77d05 100644 ---- a/drivers/media/platform/mx2_emmaprp.c -+++ b/drivers/media/platform/mx2_emmaprp.c -@@ -289,7 +289,7 @@ static void emmaprp_device_run(void *priv) - { - struct emmaprp_ctx *ctx = priv; - struct emmaprp_q_data *s_q_data, *d_q_data; -- struct vb2_buffer *src_buf, *dst_buf; -+ struct vb2_v4l2_buffer *src_buf, *dst_buf; - struct emmaprp_dev *pcdev = ctx->dev; - unsigned int s_width, s_height; - unsigned int d_width, d_height; -@@ -309,8 +309,8 @@ static void emmaprp_device_run(void *priv) - d_height = d_q_data->height; - d_size = d_width * d_height; - -- p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0); -- p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0); -+ p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); -+ p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); - if (!p_in || !p_out) { - v4l2_err(&pcdev->v4l2_dev, - "Acquiring kernel pointers to buffers failed\n"); -diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c -index e1936d9d27da..2b939555cccb 100644 ---- a/drivers/media/platform/s5p-g2d/g2d.c -+++ b/drivers/media/platform/s5p-g2d/g2d.c -@@ -497,7 +497,7 @@ static void device_run(void *prv) - { - struct g2d_ctx *ctx = prv; - struct g2d_dev *dev = ctx->dev; -- struct vb2_buffer *src, *dst; -+ struct vb2_v4l2_buffer *src, *dst; - unsigned long flags; - u32 cmd = 0; - -@@ -512,10 +512,10 @@ static void device_run(void *prv) - spin_lock_irqsave(&dev->ctrl_lock, flags); - - g2d_set_src_size(dev, &ctx->in); -- g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0)); -+ g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0)); - - g2d_set_dst_size(dev, &ctx->out); -- g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0)); -+ g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0)); - - g2d_set_rop4(dev, ctx->rop); - g2d_set_flip(dev, ctx->flip); -diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c -index 9c6fc09b88e0..0d981bbf38bc 100644 ---- a/drivers/media/platform/s5p-jpeg/jpeg-core.c -+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c -@@ -788,14 +788,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len); - static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); -+ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - struct s5p_jpeg_buffer jpeg_buffer; - unsigned int word; - int c, x, components; - - jpeg_buffer.size = 2; /* Ls */ - jpeg_buffer.data = -- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2; -+ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; - jpeg_buffer.curr = 0; - - word = 0; -@@ -825,14 +825,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) - static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); -+ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - struct s5p_jpeg_buffer jpeg_buffer; - unsigned int word; - int c, i, n, j; - - for (j = 0; j < ctx->out_q.dht.n; ++j) { - jpeg_buffer.size = ctx->out_q.dht.len[j]; -- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + -+ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + - ctx->out_q.dht.marker[j]; - jpeg_buffer.curr = 0; - -@@ -884,13 +884,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx) - static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); -+ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - struct s5p_jpeg_buffer jpeg_buffer; - int c, x, components; - - jpeg_buffer.size = ctx->out_q.sof_len; - jpeg_buffer.data = -- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof; -+ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sof; - jpeg_buffer.curr = 0; - - skip(&jpeg_buffer, 5); /* P, Y, X */ -@@ -915,14 +915,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx) - static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); -+ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - struct s5p_jpeg_buffer jpeg_buffer; - unsigned int word; - int c, i, j; - - for (j = 0; j < ctx->out_q.dqt.n; ++j) { - jpeg_buffer.size = ctx->out_q.dqt.len[j]; -- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) + -+ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + - ctx->out_q.dqt.marker[j]; - jpeg_buffer.curr = 0; - -@@ -1262,13 +1262,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv, - return 0; - } - --static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n, -+static int enum_fmt(struct s5p_jpeg_ctx *ctx, -+ struct s5p_jpeg_fmt *sjpeg_formats, int n, - struct v4l2_fmtdesc *f, u32 type) - { - int i, num = 0; -+ unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag; - - for (i = 0; i < n; ++i) { -- if (sjpeg_formats[i].flags & type) { -+ if (sjpeg_formats[i].flags & type && -+ sjpeg_formats[i].flags & fmt_ver_flag) { - /* index-th format of type type found ? */ - if (num == f->index) - break; -@@ -1294,11 +1297,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv, - struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); - - if (ctx->mode == S5P_JPEG_ENCODE) -- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, -+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, - SJPEG_FMT_FLAG_ENC_CAPTURE); - -- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, -- SJPEG_FMT_FLAG_DEC_CAPTURE); -+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, -+ SJPEG_FMT_FLAG_DEC_CAPTURE); - } - - static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, -@@ -1307,11 +1310,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv, - struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv); - - if (ctx->mode == S5P_JPEG_ENCODE) -- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, -+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, - SJPEG_FMT_FLAG_ENC_OUTPUT); - -- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f, -- SJPEG_FMT_FLAG_DEC_OUTPUT); -+ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f, -+ SJPEG_FMT_FLAG_DEC_OUTPUT); - } - - static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx, -@@ -2016,15 +2019,15 @@ static void s5p_jpeg_device_run(void *priv) - { - struct s5p_jpeg_ctx *ctx = priv; - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *src_buf, *dst_buf; -+ struct vb2_v4l2_buffer *src_buf, *dst_buf; - unsigned long src_addr, dst_addr, flags; - - spin_lock_irqsave(&ctx->jpeg->slock, flags); - - src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); -- src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0); -- dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0); -+ src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0); -+ dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0); - - s5p_jpeg_reset(jpeg->regs); - s5p_jpeg_poweron(jpeg->regs); -@@ -2097,7 +2100,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; - struct s5p_jpeg_fmt *fmt; -- struct vb2_buffer *vb; -+ struct vb2_v4l2_buffer *vb; - struct s5p_jpeg_addr jpeg_addr = {}; - u32 pix_size, padding_bytes = 0; - -@@ -2116,7 +2119,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); - } - -- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); -+ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); - - if (fmt->colplanes == 2) { - jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes; -@@ -2134,7 +2137,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb; -+ struct vb2_v4l2_buffer *vb; - unsigned int jpeg_addr = 0; - - if (ctx->mode == S5P_JPEG_ENCODE) -@@ -2142,7 +2145,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) - else - vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - -- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); -+ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); - if (jpeg->variant->version == SJPEG_EXYNOS5433 && - ctx->mode == S5P_JPEG_DECODE) - jpeg_addr += ctx->out_q.sos; -@@ -2257,7 +2260,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; - struct s5p_jpeg_fmt *fmt; -- struct vb2_buffer *vb; -+ struct vb2_v4l2_buffer *vb; - struct s5p_jpeg_addr jpeg_addr = {}; - u32 pix_size; - -@@ -2271,7 +2274,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - fmt = ctx->cap_q.fmt; - } - -- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0); -+ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); - - if (fmt->colplanes == 2) { - jpeg_addr.cb = jpeg_addr.y + pix_size; -@@ -2289,7 +2292,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx) - static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) - { - struct s5p_jpeg *jpeg = ctx->jpeg; -- struct vb2_buffer *vb; -+ struct vb2_v4l2_buffer *vb; - unsigned int jpeg_addr = 0; - - if (ctx->mode == S5P_JPEG_ENCODE) -@@ -2297,7 +2300,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx) - else - vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); - -- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0); -+ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0); - exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr); - } - -diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c -index d6ab33e7060a..b9f4cdee555e 100644 ---- a/drivers/media/platform/sh_veu.c -+++ b/drivers/media/platform/sh_veu.c -@@ -277,13 +277,13 @@ static void sh_veu_process(struct sh_veu_dev *veu, - static void sh_veu_device_run(void *priv) - { - struct sh_veu_dev *veu = priv; -- struct vb2_buffer *src_buf, *dst_buf; -+ struct vb2_v4l2_buffer *src_buf, *dst_buf; - - src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx); - dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx); - - if (src_buf && dst_buf) -- sh_veu_process(veu, src_buf, dst_buf); -+ sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf); - } - - /* ========== video ioctls ========== */ -diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c -index ea2a2ebc6b91..dba7565571a5 100644 ---- a/drivers/mmc/host/davinci_mmc.c -+++ b/drivers/mmc/host/davinci_mmc.c -@@ -1147,7 +1147,7 @@ static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host) - { - } - #endif --static void __init init_mmcsd_host(struct mmc_davinci_host *host) -+static void init_mmcsd_host(struct mmc_davinci_host *host) - { - - mmc_davinci_reset_ctrl(host, 1); -diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c -index 5bcf4f45f8b4..20d422558fa3 100644 ---- a/drivers/mmc/host/omap.c -+++ b/drivers/mmc/host/omap.c -@@ -921,7 +921,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques - reg &= ~(1 << 5); - OMAP_MMC_WRITE(host, SDIO, reg); - /* Set maximum timeout */ -- OMAP_MMC_WRITE(host, CTO, 0xff); -+ OMAP_MMC_WRITE(host, CTO, 0xfd); - } - - static inline void set_data_timeout(struct mmc_omap_host *host, struct mmc_request *req) -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index a32dcb6718ca..fde7f5efc47d 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3067,8 +3067,12 @@ static int bond_netdev_event(struct notifier_block *this, - return NOTIFY_DONE; - - if (event_dev->flags & IFF_MASTER) { -+ int ret; -+ - netdev_dbg(event_dev, "IFF_MASTER\n"); -- return bond_master_netdev_event(event, event_dev); -+ ret = bond_master_netdev_event(event, event_dev); -+ if (ret != NOTIFY_DONE) -+ return ret; - } - - if (event_dev->flags & IFF_SLAVE) { -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index 9ef4caa4b84d..3c20d0dc9256 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -120,7 +120,7 @@ static void enic_init_affinity_hint(struct enic *enic) - - for (i = 0; i < enic->intr_count; i++) { - if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) || -- (enic->msix[i].affinity_mask && -+ (cpumask_available(enic->msix[i].affinity_mask) && - !cpumask_empty(enic->msix[i].affinity_mask))) - continue; - if (zalloc_cpumask_var(&enic->msix[i].affinity_mask, -@@ -149,7 +149,7 @@ static void enic_set_affinity_hint(struct enic *enic) - for (i = 0; i < enic->intr_count; i++) { - if (enic_is_err_intr(enic, i) || - enic_is_notify_intr(enic, i) || -- !enic->msix[i].affinity_mask || -+ !cpumask_available(enic->msix[i].affinity_mask) || - cpumask_empty(enic->msix[i].affinity_mask)) - continue; - err = irq_set_affinity_hint(enic->msix_entry[i].vector, -@@ -162,7 +162,7 @@ static void enic_set_affinity_hint(struct enic *enic) - for (i = 0; i < enic->wq_count; i++) { - int wq_intr = enic_msix_wq_intr(enic, i); - -- if (enic->msix[wq_intr].affinity_mask && -+ if (cpumask_available(enic->msix[wq_intr].affinity_mask) && - !cpumask_empty(enic->msix[wq_intr].affinity_mask)) - netif_set_xps_queue(enic->netdev, - enic->msix[wq_intr].affinity_mask, -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index 6369d88b81c1..6b1cacd86c6e 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -2131,7 +2131,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) - if (strlen(netdev->name) < (IFNAMSIZ - 5)) - snprintf(adapter->rx_ring->name, - sizeof(adapter->rx_ring->name) - 1, -- "%s-rx-0", netdev->name); -+ "%.14s-rx-0", netdev->name); - else - memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ); - err = request_irq(adapter->msix_entries[vector].vector, -@@ -2147,7 +2147,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter) - if (strlen(netdev->name) < (IFNAMSIZ - 5)) - snprintf(adapter->tx_ring->name, - sizeof(adapter->tx_ring->name) - 1, -- "%s-tx-0", netdev->name); -+ "%.14s-tx-0", netdev->name); - else - memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ); - err = request_irq(adapter->msix_entries[vector].vector, -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 3b67140eed73..ee6fefe92af4 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -717,6 +717,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ - {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ - {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ -+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ - {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ - {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ - {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ -diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h b/drivers/net/wireless/mediatek/mt7601u/eeprom.h -index 662d12703b69..57b503ae63f1 100644 ---- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h -+++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h -@@ -17,7 +17,7 @@ - - struct mt7601u_dev; - --#define MT7601U_EE_MAX_VER 0x0c -+#define MT7601U_EE_MAX_VER 0x0d - #define MT7601U_EEPROM_SIZE 256 - - #define MT7601U_DEFAULT_TX_POWER 6 -diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h -index d3fbe33d2324..a13f08fd8690 100644 ---- a/drivers/net/wireless/rsi/rsi_common.h -+++ b/drivers/net/wireless/rsi/rsi_common.h -@@ -75,7 +75,6 @@ static inline int rsi_kill_thread(struct rsi_thread *handle) - atomic_inc(&handle->thread_done); - rsi_set_event(&handle->event); - -- wait_for_completion(&handle->completion); - return kthread_stop(handle->task); - } - -diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c -index 7b27c7e23af2..cc10b72607c6 100644 ---- a/drivers/net/wireless/ti/wlcore/main.c -+++ b/drivers/net/wireless/ti/wlcore/main.c -@@ -1123,8 +1123,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt) - goto out; - - ret = wl12xx_fetch_firmware(wl, plt); -- if (ret < 0) -- goto out; -+ if (ret < 0) { -+ kfree(wl->fw_status); -+ kfree(wl->raw_fw_status); -+ kfree(wl->tx_res_if); -+ } - - out: - return ret; -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 84d501f5ff4e..d85010ebac5a 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3623,6 +3623,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, - /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */ - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130, - quirk_dma_func1_alias); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170, -+ quirk_dma_func1_alias); - /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */ - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172, - quirk_dma_func1_alias); -diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c -index f8d4cd3d1397..63a00d1d9360 100644 ---- a/drivers/regulator/act8865-regulator.c -+++ b/drivers/regulator/act8865-regulator.c -@@ -131,7 +131,7 @@ - * ACT8865 voltage number - */ - #define ACT8865_VOLTAGE_NUM 64 --#define ACT8600_SUDCDC_VOLTAGE_NUM 255 -+#define ACT8600_SUDCDC_VOLTAGE_NUM 256 - - struct act8865 { - struct regmap *regmap; -@@ -154,7 +154,8 @@ static const struct regulator_linear_range act8600_sudcdc_voltage_ranges[] = { - REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0), - REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000), - REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000), -- REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000), -+ REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000), -+ REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0), - }; - - static struct regulator_ops act8865_ops = { -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index ac7acd257c99..2422094f1f15 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -3847,6 +3847,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance) - if (megasas_create_frame_pool(instance)) { - dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating frame DMA pool\n"); - megasas_free_cmds(instance); -+ return -ENOMEM; - } - - return 0; -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 850ddc5fac04..3e2288af56bc 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -217,7 +217,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, - extern void scsi_requeue_run_queue(struct work_struct *work); - - sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size, -- GFP_ATOMIC); -+ GFP_KERNEL); - if (!sdev) - goto out; - -@@ -791,7 +791,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result, - */ - sdev->inquiry = kmemdup(inq_result, - max_t(size_t, sdev->inquiry_len, 36), -- GFP_ATOMIC); -+ GFP_KERNEL); - if (sdev->inquiry == NULL) - return SCSI_SCAN_NO_RESPONSE; - -@@ -1085,7 +1085,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget, - if (!sdev) - goto out; - -- result = kmalloc(result_len, GFP_ATOMIC | -+ result = kmalloc(result_len, GFP_KERNEL | - ((shost->unchecked_isa_dma) ? __GFP_DMA : 0)); - if (!result) - goto out_free_sdev; -diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c -index 09c669e70d63..038abc377fdb 100644 ---- a/drivers/soc/qcom/qcom_gsbi.c -+++ b/drivers/soc/qcom/qcom_gsbi.c -@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev) - struct resource *res; - void __iomem *base; - struct gsbi_info *gsbi; -- int i; -+ int i, ret; - u32 mask, gsbi_num; - const struct crci_config *config = NULL; - -@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, gsbi); - -- return of_platform_populate(node, NULL, NULL, &pdev->dev); -+ ret = of_platform_populate(node, NULL, NULL, &pdev->dev); -+ if (ret) -+ clk_disable_unprepare(gsbi->hclk); -+ return ret; - } - - static int gsbi_remove(struct platform_device *pdev) -diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c -index de2c1bfe28b5..c4f5e5bbb8dc 100644 ---- a/drivers/soc/tegra/fuse/fuse-tegra.c -+++ b/drivers/soc/tegra/fuse/fuse-tegra.c -@@ -131,13 +131,17 @@ static int tegra_fuse_probe(struct platform_device *pdev) - /* take over the memory region from the early initialization */ - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - fuse->base = devm_ioremap_resource(&pdev->dev, res); -- if (IS_ERR(fuse->base)) -- return PTR_ERR(fuse->base); -+ if (IS_ERR(fuse->base)) { -+ err = PTR_ERR(fuse->base); -+ fuse->base = base; -+ return err; -+ } - - fuse->clk = devm_clk_get(&pdev->dev, "fuse"); - if (IS_ERR(fuse->clk)) { - dev_err(&pdev->dev, "failed to get FUSE clock: %ld", - PTR_ERR(fuse->clk)); -+ fuse->base = base; - return PTR_ERR(fuse->clk); - } - -@@ -146,8 +150,10 @@ static int tegra_fuse_probe(struct platform_device *pdev) - - if (fuse->soc->probe) { - err = fuse->soc->probe(fuse); -- if (err < 0) -+ if (err < 0) { -+ fuse->base = base; - return err; -+ } - } - - if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size, -diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c -index 95b537a8ecdb..6778e2b73667 100644 ---- a/drivers/staging/comedi/drivers/ni_usb6501.c -+++ b/drivers/staging/comedi/drivers/ni_usb6501.c -@@ -472,10 +472,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev) - - size = le16_to_cpu(devpriv->ep_tx->wMaxPacketSize); - devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); -- if (!devpriv->usb_tx_buf) { -- kfree(devpriv->usb_rx_buf); -+ if (!devpriv->usb_tx_buf) - return -ENOMEM; -- } - - return 0; - } -@@ -527,6 +525,9 @@ static int ni6501_auto_attach(struct comedi_device *dev, - if (!devpriv) - return -ENOMEM; - -+ mutex_init(&devpriv->mut); -+ usb_set_intfdata(intf, devpriv); -+ - ret = ni6501_find_endpoints(dev); - if (ret) - return ret; -@@ -535,9 +536,6 @@ static int ni6501_auto_attach(struct comedi_device *dev, - if (ret) - return ret; - -- mutex_init(&devpriv->mut); -- usb_set_intfdata(intf, devpriv); -- - ret = comedi_alloc_subdevices(dev, 2); - if (ret) - return ret; -diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c -index 8c7393ef762d..95e53cfd76a4 100644 ---- a/drivers/staging/comedi/drivers/vmk80xx.c -+++ b/drivers/staging/comedi/drivers/vmk80xx.c -@@ -691,10 +691,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) - - size = le16_to_cpu(devpriv->ep_tx->wMaxPacketSize); - devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); -- if (!devpriv->usb_tx_buf) { -- kfree(devpriv->usb_rx_buf); -+ if (!devpriv->usb_tx_buf) - return -ENOMEM; -- } - - return 0; - } -@@ -809,6 +807,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev, - - devpriv->model = board->model; - -+ sema_init(&devpriv->limit_sem, 8); -+ - ret = vmk80xx_find_usb_endpoints(dev); - if (ret) - return ret; -@@ -817,8 +817,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev, - if (ret) - return ret; - -- sema_init(&devpriv->limit_sem, 8); -- - usb_set_intfdata(intf, devpriv); - - if (devpriv->model == VMK8055_MODEL) -diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c -index 5836e5554433..d4c374cc4f74 100644 ---- a/drivers/thermal/int340x_thermal/int3400_thermal.c -+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c -@@ -20,6 +20,13 @@ enum int3400_thermal_uuid { - INT3400_THERMAL_PASSIVE_1, - INT3400_THERMAL_ACTIVE, - INT3400_THERMAL_CRITICAL, -+ INT3400_THERMAL_ADAPTIVE_PERFORMANCE, -+ INT3400_THERMAL_EMERGENCY_CALL_MODE, -+ INT3400_THERMAL_PASSIVE_2, -+ INT3400_THERMAL_POWER_BOSS, -+ INT3400_THERMAL_VIRTUAL_SENSOR, -+ INT3400_THERMAL_COOLING_MODE, -+ INT3400_THERMAL_HARDWARE_DUTY_CYCLING, - INT3400_THERMAL_MAXIMUM_UUID, - }; - -@@ -27,6 +34,13 @@ static u8 *int3400_thermal_uuids[INT3400_THERMAL_MAXIMUM_UUID] = { - "42A441D6-AE6A-462b-A84B-4A8CE79027D3", - "3A95C389-E4B8-4629-A526-C52C88626BAE", - "97C68AE7-15FA-499c-B8C9-5DA81D606E0A", -+ "63BE270F-1C11-48FD-A6F7-3AF253FF3E2D", -+ "5349962F-71E6-431D-9AE8-0A635B710AEE", -+ "9E04115A-AE87-4D1C-9500-0F3E340BFE75", -+ "F5A35014-C209-46A4-993A-EB56DE7530A1", -+ "6ED722A7-9240-48A5-B479-31EEF723D7CF", -+ "16CAF1B7-DD38-40ED-B1C1-1B8A1913D531", -+ "BE84BABF-C4D4-403D-B495-3128FD44dAC1", - }; - - struct int3400_thermal_priv { -@@ -271,10 +285,9 @@ static int int3400_thermal_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, priv); - -- if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) { -- int3400_thermal_ops.get_mode = int3400_thermal_get_mode; -- int3400_thermal_ops.set_mode = int3400_thermal_set_mode; -- } -+ int3400_thermal_ops.get_mode = int3400_thermal_get_mode; -+ int3400_thermal_ops.set_mode = int3400_thermal_set_mode; -+ - priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0, - priv, &int3400_thermal_ops, - &int3400_thermal_params, 0, 0); -diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig -index 82c4d2e45319..864cceea46ad 100644 ---- a/drivers/tty/Kconfig -+++ b/drivers/tty/Kconfig -@@ -466,4 +466,27 @@ config MIPS_EJTAG_FDC_KGDB_CHAN - help - FDC channel number to use for KGDB. - -+config LDISC_AUTOLOAD -+ bool "Automatically load TTY Line Disciplines" -+ default y -+ help -+ Historically the kernel has always automatically loaded any -+ line discipline that is in a kernel module when a user asks -+ for it to be loaded with the TIOCSETD ioctl, or through other -+ means. This is not always the best thing to do on systems -+ where you know you will not be using some of the more -+ "ancient" line disciplines, so prevent the kernel from doing -+ this unless the request is coming from a process with the -+ CAP_SYS_MODULE permissions. -+ -+ Say 'Y' here if you trust your userspace users to do the right -+ thing, or if you have only provided the line disciplines that -+ you know you will be using, or if you wish to continue to use -+ the traditional method of on-demand loading of these modules -+ by any user. -+ -+ This functionality can be changed at runtime with the -+ dev.tty.ldisc_autoload sysctl, this configuration option will -+ only set the default value of this functionality. -+ - endif # TTY -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index f5c4e92b5172..fc46c8cf5fcd 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -169,6 +169,8 @@ struct atmel_uart_port { - unsigned int pending_status; - spinlock_t lock_suspended; - -+ bool hd_start_rx; /* can start RX during half-duplex operation */ -+ - int (*prepare_rx)(struct uart_port *port); - int (*prepare_tx)(struct uart_port *port); - void (*schedule_rx)(struct uart_port *port); -@@ -237,6 +239,12 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value) - - #endif - -+static inline int atmel_uart_is_half_duplex(struct uart_port *port) -+{ -+ return (port->rs485.flags & SER_RS485_ENABLED) && -+ !(port->rs485.flags & SER_RS485_RX_DURING_TX); -+} -+ - #ifdef CONFIG_SERIAL_ATMEL_PDC - static bool atmel_use_pdc_rx(struct uart_port *port) - { -@@ -481,9 +489,9 @@ static void atmel_stop_tx(struct uart_port *port) - /* Disable interrupts */ - atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); - -- if ((port->rs485.flags & SER_RS485_ENABLED) && -- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) -+ if (atmel_uart_is_half_duplex(port)) - atmel_start_rx(port); -+ - } - - /* -@@ -500,8 +508,7 @@ static void atmel_start_tx(struct uart_port *port) - return; - - if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) -- if ((port->rs485.flags & SER_RS485_ENABLED) && -- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) -+ if (atmel_uart_is_half_duplex(port)) - atmel_stop_rx(port); - - if (atmel_use_pdc_tx(port)) -@@ -810,10 +817,14 @@ static void atmel_complete_tx_dma(void *arg) - */ - if (!uart_circ_empty(xmit)) - tasklet_schedule(&atmel_port->tasklet); -- else if ((port->rs485.flags & SER_RS485_ENABLED) && -- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { -- /* DMA done, stop TX, start RX for RS485 */ -- atmel_start_rx(port); -+ else if (atmel_uart_is_half_duplex(port)) { -+ /* -+ * DMA done, re-enable TXEMPTY and signal that we can stop -+ * TX and start RX for RS485 -+ */ -+ atmel_port->hd_start_rx = true; -+ atmel_uart_writel(port, ATMEL_US_IER, -+ atmel_port->tx_done_mask); - } - - spin_unlock_irqrestore(&port->lock, flags); -@@ -1253,9 +1264,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) - struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); - - if (pending & atmel_port->tx_done_mask) { -- /* Either PDC or interrupt transmission */ - atmel_uart_writel(port, ATMEL_US_IDR, - atmel_port->tx_done_mask); -+ -+ /* Start RX if flag was set and FIFO is empty */ -+ if (atmel_port->hd_start_rx) { -+ if (!(atmel_uart_readl(port, ATMEL_US_CSR) -+ & ATMEL_US_TXEMPTY)) -+ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); -+ -+ atmel_port->hd_start_rx = false; -+ atmel_start_rx(port); -+ return; -+ } -+ - tasklet_schedule(&atmel_port->tasklet); - } - } -@@ -1388,8 +1410,7 @@ static void atmel_tx_pdc(struct uart_port *port) - atmel_uart_writel(port, ATMEL_US_IER, - atmel_port->tx_done_mask); - } else { -- if ((port->rs485.flags & SER_RS485_ENABLED) && -- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { -+ if (atmel_uart_is_half_duplex(port)) { - /* DMA done, stop TX, start RX for RS485 */ - atmel_start_rx(port); - } -diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c -index 4f2f4aca8d2e..06efcef1b495 100644 ---- a/drivers/tty/serial/xilinx_uartps.c -+++ b/drivers/tty/serial/xilinx_uartps.c -@@ -1145,7 +1145,7 @@ static void cdns_uart_console_write(struct console *co, const char *s, - * - * Return: 0 on success, negative errno otherwise. - */ --static int __init cdns_uart_console_setup(struct console *co, char *options) -+static int cdns_uart_console_setup(struct console *co, char *options) - { - struct uart_port *port = &cdns_uart_port[co->index]; - int baud = 9600; -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index 355e9cad680d..4706df20191b 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -25,7 +25,7 @@ - * Byte threshold to limit memory consumption for flip buffers. - * The actual memory limit is > 2x this amount. - */ --#define TTYB_DEFAULT_MEM_LIMIT 65536 -+#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL) - - /* - * We default to dicing tty buffer allocations to this many characters -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 5b86ebc76a8a..b7effcfee91d 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -513,6 +513,8 @@ void proc_clear_tty(struct task_struct *p) - tty_kref_put(tty); - } - -+extern void tty_sysctl_init(void); -+ - /** - * proc_set_tty - set the controlling terminal - * -@@ -3689,6 +3691,7 @@ void console_sysfs_notify(void) - */ - int __init tty_init(void) - { -+ tty_sysctl_init(); - cdev_init(&tty_cdev, &tty_fops); - if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) || - register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0) -diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c -index d9e013dc2c08..02ab7e2d4494 100644 ---- a/drivers/tty/tty_ldisc.c -+++ b/drivers/tty/tty_ldisc.c -@@ -148,6 +148,13 @@ static void put_ldops(struct tty_ldisc_ops *ldops) - * takes tty_ldiscs_lock to guard against ldisc races - */ - -+#if defined(CONFIG_LDISC_AUTOLOAD) -+ #define INITIAL_AUTOLOAD_STATE 1 -+#else -+ #define INITIAL_AUTOLOAD_STATE 0 -+#endif -+static int tty_ldisc_autoload = INITIAL_AUTOLOAD_STATE; -+ - static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc) - { - struct tty_ldisc *ld; -@@ -162,6 +169,8 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc) - */ - ldops = get_ldops(disc); - if (IS_ERR(ldops)) { -+ if (!capable(CAP_SYS_MODULE) && !tty_ldisc_autoload) -+ return ERR_PTR(-EPERM); - request_module("tty-ldisc-%d", disc); - ldops = get_ldops(disc); - if (IS_ERR(ldops)) -@@ -830,3 +839,41 @@ void tty_ldisc_begin(void) - /* Setup the default TTY line discipline. */ - (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY); - } -+ -+static int zero; -+static int one = 1; -+static struct ctl_table tty_table[] = { -+ { -+ .procname = "ldisc_autoload", -+ .data = &tty_ldisc_autoload, -+ .maxlen = sizeof(tty_ldisc_autoload), -+ .mode = 0644, -+ .proc_handler = proc_dointvec, -+ .extra1 = &zero, -+ .extra2 = &one, -+ }, -+ { } -+}; -+ -+static struct ctl_table tty_dir_table[] = { -+ { -+ .procname = "tty", -+ .mode = 0555, -+ .child = tty_table, -+ }, -+ { } -+}; -+ -+static struct ctl_table tty_root_table[] = { -+ { -+ .procname = "dev", -+ .mode = 0555, -+ .child = tty_dir_table, -+ }, -+ { } -+}; -+ -+void tty_sysctl_init(void) -+{ -+ register_sysctl_table(tty_root_table); -+} -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index 57ee43512992..dee22d8effda 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -913,8 +913,15 @@ static int ci_hdrc_probe(struct platform_device *pdev) - } else if (ci->platdata->usb_phy) { - ci->usb_phy = ci->platdata->usb_phy; - } else { -+ ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys", -+ 0); - ci->phy = devm_phy_get(dev->parent, "usb-phy"); -- ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2); -+ -+ /* Fallback to grabbing any registered USB2 PHY */ -+ if (IS_ERR(ci->usb_phy) && -+ PTR_ERR(ci->usb_phy) != -EPROBE_DEFER) -+ ci->usb_phy = devm_usb_get_phy(dev->parent, -+ USB_PHY_TYPE_USB2); - - /* if both generic PHY and USB PHY layers aren't enabled */ - if (PTR_ERR(ci->phy) == -ENOSYS && -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index ea2bd6208a2f..9eae191728d2 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -425,6 +425,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, - { - unsigned int x; - -+ if (image->width > info->var.xres || image->height > info->var.yres) -+ return; -+ - if (rotate == FB_ROTATE_UR) { - for (x = 0; - x < num && image->dx + image->width <= info->var.xres; -diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c -index 6caca025019d..1e9bb8db7b48 100644 ---- a/fs/9p/v9fs.c -+++ b/fs/9p/v9fs.c -@@ -59,6 +59,8 @@ enum { - Opt_cache_loose, Opt_fscache, Opt_mmap, - /* Access options */ - Opt_access, Opt_posixacl, -+ /* Lock timeout option */ -+ Opt_locktimeout, - /* Error token */ - Opt_err - }; -@@ -78,6 +80,7 @@ static const match_table_t tokens = { - {Opt_cachetag, "cachetag=%s"}, - {Opt_access, "access=%s"}, - {Opt_posixacl, "posixacl"}, -+ {Opt_locktimeout, "locktimeout=%u"}, - {Opt_err, NULL} - }; - -@@ -126,6 +129,7 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts) - #ifdef CONFIG_9P_FSCACHE - v9ses->cachetag = NULL; - #endif -+ v9ses->session_lock_timeout = P9_LOCK_TIMEOUT; - - if (!opts) - return 0; -@@ -298,6 +302,23 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts) - #endif - break; - -+ case Opt_locktimeout: -+ r = match_int(&args[0], &option); -+ if (r < 0) { -+ p9_debug(P9_DEBUG_ERROR, -+ "integer field, but no integer?\n"); -+ ret = r; -+ continue; -+ } -+ if (option < 1) { -+ p9_debug(P9_DEBUG_ERROR, -+ "locktimeout must be a greater than zero integer.\n"); -+ ret = -EINVAL; -+ continue; -+ } -+ v9ses->session_lock_timeout = (long)option * HZ; -+ break; -+ - default: - continue; - } -diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h -index 6877050384a1..3775f275ede3 100644 ---- a/fs/9p/v9fs.h -+++ b/fs/9p/v9fs.h -@@ -116,6 +116,7 @@ struct v9fs_session_info { - struct list_head slist; /* list of sessions registered with v9fs */ - struct backing_dev_info bdi; - struct rw_semaphore rename_sem; -+ long session_lock_timeout; /* retry interval for blocking locks */ - }; - - /* cache_validity flags */ -diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c -index 7d889f56b8e7..05769219d2c2 100644 ---- a/fs/9p/vfs_dir.c -+++ b/fs/9p/vfs_dir.c -@@ -105,7 +105,6 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) - int err = 0; - struct p9_fid *fid; - int buflen; -- int reclen = 0; - struct p9_rdir *rdir; - struct kvec kvec; - -@@ -138,11 +137,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) - while (rdir->head < rdir->tail) { - err = p9stat_read(fid->clnt, rdir->buf + rdir->head, - rdir->tail - rdir->head, &st); -- if (err) { -+ if (err <= 0) { - p9_debug(P9_DEBUG_VFS, "returned %d\n", err); - return -EIO; - } -- reclen = st.size+2; - - over = !dir_emit(ctx, st.name, strlen(st.name), - v9fs_qid2ino(&st.qid), dt_type(&st)); -@@ -150,8 +148,8 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) - if (over) - return 0; - -- rdir->head += reclen; -- ctx->pos += reclen; -+ rdir->head += err; -+ ctx->pos += err; - } - } - } -diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c -index 62ce8b4a7e5f..373cc50544e9 100644 ---- a/fs/9p/vfs_file.c -+++ b/fs/9p/vfs_file.c -@@ -154,6 +154,7 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) - uint8_t status = P9_LOCK_ERROR; - int res = 0; - unsigned char fl_type; -+ struct v9fs_session_info *v9ses; - - fid = filp->private_data; - BUG_ON(fid == NULL); -@@ -189,6 +190,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) - if (IS_SETLKW(cmd)) - flock.flags = P9_LOCK_FLAGS_BLOCK; - -+ v9ses = v9fs_inode2v9ses(file_inode(filp)); -+ - /* - * if its a blocked request and we get P9_LOCK_BLOCKED as the status - * for lock request, keep on trying -@@ -202,7 +205,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) - break; - if (status == P9_LOCK_BLOCKED && !IS_SETLKW(cmd)) - break; -- if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0) -+ if (schedule_timeout_interruptible(v9ses->session_lock_timeout) -+ != 0) - break; - /* - * p9_client_lock_dotl overwrites flock.client_id with the -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index f010d6c8dd14..f1f32e55d877 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -850,6 +850,7 @@ static int load_elf_binary(struct linux_binprm *bprm) - current->flags |= PF_RANDOMIZE; - - setup_new_exec(bprm); -+ install_exec_creds(bprm); - - /* Do this so that we can load the interpreter, if need be. We will - change some of these later */ -@@ -1084,7 +1085,6 @@ static int load_elf_binary(struct linux_binprm *bprm) - goto out; - #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ - -- install_exec_creds(bprm); - retval = create_elf_tables(bprm, &loc->elf_ex, - load_addr, interp_load_addr); - if (retval < 0) -diff --git a/fs/buffer.c b/fs/buffer.c -index 6f7d519a093b..f278e27bd8c0 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -2985,6 +2985,13 @@ void guard_bio_eod(int rw, struct bio *bio) - /* Uhhuh. We've got a bio that straddles the device size! */ - truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); - -+ /* -+ * The bio contains more than one segment which spans EOD, just return -+ * and let IO layer turn it into an EIO -+ */ -+ if (truncated_bytes > bvec->bv_len) -+ return; -+ - /* Truncate the bio.. */ - bio->bi_iter.bi_size -= truncated_bytes; - bvec->bv_len -= truncated_bytes; -diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c -index 7dc886c9a78f..1ea643faf04b 100644 ---- a/fs/cifs/cifs_dfs_ref.c -+++ b/fs/cifs/cifs_dfs_ref.c -@@ -266,9 +266,9 @@ static void dump_referral(const struct dfs_info3_param *ref) - { - cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name); - cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name); -- cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n", -+ cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n", - ref->flags, ref->server_type); -- cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n", -+ cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n", - ref->ref_flag, ref->path_consumed); - } - -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index eacf57c24ca9..9cb72fd40eff 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -1255,6 +1255,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol) - const char *delims = "/\\"; - size_t len; - -+ if (unlikely(!devname || !*devname)) { -+ cifs_dbg(VFS, "Device name not specified.\n"); -+ return -EINVAL; -+ } -+ - /* make sure we have a valid UNC double delimiter prefix */ - len = strspn(devname, delims); - if (len != 2) -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 0305e3866216..23a8374fa97f 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -1574,8 +1574,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type, - rc = server->ops->mand_unlock_range(cfile, flock, xid); - - out: -- if (flock->fl_flags & FL_POSIX && !rc) -+ if (flock->fl_flags & FL_POSIX) { -+ /* -+ * If this is a request to remove all locks because we -+ * are closing the file, it doesn't matter if the -+ * unlocking failed as both cifs.ko and the SMB server -+ * remove the lock on file close -+ */ -+ if (rc) { -+ cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc); -+ if (!(flock->fl_flags & FL_CLOSE)) -+ return rc; -+ } - rc = locks_lock_file_wait(file, flock); -+ } - return rc; - } - -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index 5c3187df9ab9..d8bd8dd36211 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -759,43 +759,50 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, - } else if ((rc == -EACCES) && backup_cred(cifs_sb) && - (strcmp(server->vals->version_string, SMB1_VERSION_STRING) - == 0)) { -- /* -- * For SMB2 and later the backup intent flag is already -- * sent if needed on open and there is no path based -- * FindFirst operation to use to retry with -- */ -- -- srchinf = kzalloc(sizeof(struct cifs_search_info), -- GFP_KERNEL); -- if (srchinf == NULL) { -- rc = -ENOMEM; -- goto cgii_exit; -- } -+ /* -+ * For SMB2 and later the backup intent flag is already -+ * sent if needed on open and there is no path based -+ * FindFirst operation to use to retry with -+ */ -+ -+ srchinf = kzalloc(sizeof(struct cifs_search_info), -+ GFP_KERNEL); -+ if (srchinf == NULL) { -+ rc = -ENOMEM; -+ goto cgii_exit; -+ } - -- srchinf->endOfSearch = false; -+ srchinf->endOfSearch = false; -+ if (tcon->unix_ext) -+ srchinf->info_level = SMB_FIND_FILE_UNIX; -+ else if ((tcon->ses->capabilities & -+ tcon->ses->server->vals->cap_nt_find) == 0) -+ srchinf->info_level = SMB_FIND_FILE_INFO_STANDARD; -+ else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) - srchinf->info_level = SMB_FIND_FILE_ID_FULL_DIR_INFO; -+ else /* no srvino useful for fallback to some netapp */ -+ srchinf->info_level = SMB_FIND_FILE_DIRECTORY_INFO; - -- srchflgs = CIFS_SEARCH_CLOSE_ALWAYS | -- CIFS_SEARCH_CLOSE_AT_END | -- CIFS_SEARCH_BACKUP_SEARCH; -+ srchflgs = CIFS_SEARCH_CLOSE_ALWAYS | -+ CIFS_SEARCH_CLOSE_AT_END | -+ CIFS_SEARCH_BACKUP_SEARCH; - -- rc = CIFSFindFirst(xid, tcon, full_path, -- cifs_sb, NULL, srchflgs, srchinf, false); -- if (!rc) { -- data = -- (FILE_ALL_INFO *)srchinf->srch_entries_start; -+ rc = CIFSFindFirst(xid, tcon, full_path, -+ cifs_sb, NULL, srchflgs, srchinf, false); -+ if (!rc) { -+ data = (FILE_ALL_INFO *)srchinf->srch_entries_start; - -- cifs_dir_info_to_fattr(&fattr, -- (FILE_DIRECTORY_INFO *)data, cifs_sb); -- fattr.cf_uniqueid = le64_to_cpu( -- ((SEARCH_ID_FULL_DIR_INFO *)data)->UniqueId); -- validinum = true; -+ cifs_dir_info_to_fattr(&fattr, -+ (FILE_DIRECTORY_INFO *)data, cifs_sb); -+ fattr.cf_uniqueid = le64_to_cpu( -+ ((SEARCH_ID_FULL_DIR_INFO *)data)->UniqueId); -+ validinum = true; - -- cifs_buf_release(srchinf->ntwrk_buf_start); -- } -- kfree(srchinf); -- if (rc) -- goto cgii_exit; -+ cifs_buf_release(srchinf->ntwrk_buf_start); -+ } -+ kfree(srchinf); -+ if (rc) -+ goto cgii_exit; - } else - goto cgii_exit; - -diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c -index efd72e1fae74..f7a9adab0b84 100644 ---- a/fs/cifs/smb1ops.c -+++ b/fs/cifs/smb1ops.c -@@ -305,7 +305,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) - remaining = tgt_total_cnt - total_in_tgt; - - if (remaining < 0) { -- cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%hu\n", -+ cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n", - tgt_total_cnt, total_in_tgt); - return -EPROTO; - } -diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c -index 98c25b969ab8..7e93d5706bf6 100644 ---- a/fs/cifs/smb2maperror.c -+++ b/fs/cifs/smb2maperror.c -@@ -1034,7 +1034,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = { - {STATUS_UNFINISHED_CONTEXT_DELETED, -EIO, - "STATUS_UNFINISHED_CONTEXT_DELETED"}, - {STATUS_NO_TGT_REPLY, -EIO, "STATUS_NO_TGT_REPLY"}, -- {STATUS_OBJECTID_NOT_FOUND, -EIO, "STATUS_OBJECTID_NOT_FOUND"}, -+ /* Note that ENOATTTR and ENODATA are the same errno */ -+ {STATUS_OBJECTID_NOT_FOUND, -ENODATA, "STATUS_OBJECTID_NOT_FOUND"}, - {STATUS_NO_IP_ADDRESSES, -EIO, "STATUS_NO_IP_ADDRESSES"}, - {STATUS_WRONG_CREDENTIAL_HANDLE, -EIO, - "STATUS_WRONG_CREDENTIAL_HANDLE"}, -diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c -index 8f3e78eb0bbd..08f3a0c0f468 100644 ---- a/fs/ext4/indirect.c -+++ b/fs/ext4/indirect.c -@@ -1323,6 +1323,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, - ext4_lblk_t offsets[4], offsets2[4]; - Indirect chain[4], chain2[4]; - Indirect *partial, *partial2; -+ Indirect *p = NULL, *p2 = NULL; - ext4_lblk_t max_block; - __le32 nr = 0, nr2 = 0; - int n = 0, n2 = 0; -@@ -1364,7 +1365,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, - } - - -- partial = ext4_find_shared(inode, n, offsets, chain, &nr); -+ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); - if (nr) { - if (partial == chain) { - /* Shared branch grows from the inode */ -@@ -1389,13 +1390,11 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode, - partial->p + 1, - (__le32 *)partial->bh->b_data+addr_per_block, - (chain+n-1) - partial); -- BUFFER_TRACE(partial->bh, "call brelse"); -- brelse(partial->bh); - partial--; - } - - end_range: -- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); -+ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); - if (nr2) { - if (partial2 == chain2) { - /* -@@ -1425,16 +1424,14 @@ end_range: - (__le32 *)partial2->bh->b_data, - partial2->p, - (chain2+n2-1) - partial2); -- BUFFER_TRACE(partial2->bh, "call brelse"); -- brelse(partial2->bh); - partial2--; - } - goto do_indirects; - } - - /* Punch happened within the same level (n == n2) */ -- partial = ext4_find_shared(inode, n, offsets, chain, &nr); -- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); -+ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr); -+ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2); - - /* Free top, but only if partial2 isn't its subtree. */ - if (nr) { -@@ -1491,15 +1488,7 @@ end_range: - partial->p + 1, - partial2->p, - (chain+n-1) - partial); -- while (partial > chain) { -- BUFFER_TRACE(partial->bh, "call brelse"); -- brelse(partial->bh); -- } -- while (partial2 > chain2) { -- BUFFER_TRACE(partial2->bh, "call brelse"); -- brelse(partial2->bh); -- } -- return 0; -+ goto cleanup; - } - - /* -@@ -1514,8 +1503,6 @@ end_range: - partial->p + 1, - (__le32 *)partial->bh->b_data+addr_per_block, - (chain+n-1) - partial); -- BUFFER_TRACE(partial->bh, "call brelse"); -- brelse(partial->bh); - partial--; - } - if (partial2 > chain2 && depth2 <= depth) { -@@ -1523,11 +1510,21 @@ end_range: - (__le32 *)partial2->bh->b_data, - partial2->p, - (chain2+n2-1) - partial2); -- BUFFER_TRACE(partial2->bh, "call brelse"); -- brelse(partial2->bh); - partial2--; - } - } -+ -+cleanup: -+ while (p && p > chain) { -+ BUFFER_TRACE(p->bh, "call brelse"); -+ brelse(p->bh); -+ p--; -+ } -+ while (p2 && p2 > chain2) { -+ BUFFER_TRACE(p2->bh, "call brelse"); -+ brelse(p2->bh); -+ p2--; -+ } - return 0; - - do_indirects: -@@ -1535,7 +1532,7 @@ do_indirects: - switch (offsets[0]) { - default: - if (++n >= n2) -- return 0; -+ break; - nr = i_data[EXT4_IND_BLOCK]; - if (nr) { - ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1); -@@ -1543,7 +1540,7 @@ do_indirects: - } - case EXT4_IND_BLOCK: - if (++n >= n2) -- return 0; -+ break; - nr = i_data[EXT4_DIND_BLOCK]; - if (nr) { - ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2); -@@ -1551,7 +1548,7 @@ do_indirects: - } - case EXT4_DIND_BLOCK: - if (++n >= n2) -- return 0; -+ break; - nr = i_data[EXT4_TIND_BLOCK]; - if (nr) { - ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3); -@@ -1560,5 +1557,5 @@ do_indirects: - case EXT4_TIND_BLOCK: - ; - } -- return 0; -+ goto cleanup; - } -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index bcd7c4788903..e44e3cd738b6 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -599,6 +599,13 @@ resizefs_out: - - if ((flags & BLKDEV_DISCARD_SECURE) && !blk_queue_secdiscard(q)) - return -EOPNOTSUPP; -+ /* -+ * We haven't replayed the journal, so we cannot use our -+ * block-bitmap-guided storage zapping commands. -+ */ -+ if (test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) -+ return -EROFS; -+ - if (copy_from_user(&range, (struct fstrim_range __user *)arg, - sizeof(range))) - return -EFAULT; -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 4bd12247a9be..5223eb25bf59 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -907,11 +907,18 @@ static int add_new_gdb_meta_bg(struct super_block *sb, - memcpy(n_group_desc, o_group_desc, - EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *)); - n_group_desc[gdb_num] = gdb_bh; -+ -+ BUFFER_TRACE(gdb_bh, "get_write_access"); -+ err = ext4_journal_get_write_access(handle, gdb_bh); -+ if (err) { -+ kvfree(n_group_desc); -+ brelse(gdb_bh); -+ return err; -+ } -+ - EXT4_SB(sb)->s_group_desc = n_group_desc; - EXT4_SB(sb)->s_gdb_count++; - kvfree(o_group_desc); -- BUFFER_TRACE(gdb_bh, "get_write_access"); -- err = ext4_journal_get_write_access(handle, gdb_bh); - return err; - } - -@@ -2040,6 +2047,10 @@ out: - free_flex_gd(flex_gd); - if (resize_inode != NULL) - iput(resize_inode); -- ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", n_blocks_count); -+ if (err) -+ ext4_warning(sb, "error (%d) occurred during " -+ "file system resize", err); -+ ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", -+ ext4_blocks_count(es)); - return err; - } -diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c -index 145fb659ad44..8f327fa7ae47 100644 ---- a/fs/f2fs/trace.c -+++ b/fs/f2fs/trace.c -@@ -60,6 +60,7 @@ void f2fs_trace_pid(struct page *page) - - page->private = pid; - -+retry: - if (radix_tree_preload(GFP_NOFS)) - return; - -@@ -70,7 +71,12 @@ void f2fs_trace_pid(struct page *page) - if (p) - radix_tree_delete(&pids, pid); - -- f2fs_radix_tree_insert(&pids, pid, current); -+ if (radix_tree_insert(&pids, pid, current)) { -+ spin_unlock(&pids_lock); -+ radix_tree_preload_end(); -+ cond_resched(); -+ goto retry; -+ } - - trace_printk("%3x:%3x %4x %-16s\n", - MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev), -diff --git a/fs/file.c b/fs/file.c -index 39f8f15921da..7e9eb65a2912 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -474,6 +474,7 @@ struct files_struct init_files = { - .full_fds_bits = init_files.full_fds_bits_init, - }, - .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock), -+ .resize_wait = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait), - }; - - static unsigned long find_next_fd(struct fdtable *fdt, unsigned long start) -diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c -index 3c45a9301a09..a87a08e1bfab 100644 ---- a/fs/ocfs2/cluster/nodemanager.c -+++ b/fs/ocfs2/cluster/nodemanager.c -@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group, - struct o2nm_node *node = to_o2nm_node(item); - struct o2nm_cluster *cluster = to_o2nm_cluster(group->cg_item.ci_parent); - -- o2net_disconnect_node(node); -+ if (cluster->cl_nodes[node->nd_num] == node) { -+ o2net_disconnect_node(node); - -- if (cluster->cl_has_local && -- (cluster->cl_local_node == node->nd_num)) { -- cluster->cl_has_local = 0; -- cluster->cl_local_node = O2NM_INVALID_NODE_NUM; -- o2net_stop_listening(node); -+ if (cluster->cl_has_local && -+ (cluster->cl_local_node == node->nd_num)) { -+ cluster->cl_has_local = 0; -+ cluster->cl_local_node = O2NM_INVALID_NODE_NUM; -+ o2net_stop_listening(node); -+ } - } - - /* XXX call into net to stop this node from trading messages */ -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index f8aa54272121..eedacae889b9 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -408,12 +408,21 @@ static int ovl_create_or_link(struct dentry *dentry, int mode, dev_t rdev, - err = ovl_create_upper(dentry, inode, &stat, link, hardlink); - } else { - const struct cred *old_cred; -+ struct cred *override_cred; - - old_cred = ovl_override_creds(dentry->d_sb); - -- err = ovl_create_over_whiteout(dentry, inode, &stat, link, -- hardlink); -+ err = -ENOMEM; -+ override_cred = prepare_creds(); -+ if (override_cred) { -+ override_cred->fsuid = old_cred->fsuid; -+ override_cred->fsgid = old_cred->fsgid; -+ put_cred(override_creds(override_cred)); -+ put_cred(override_cred); - -+ err = ovl_create_over_whiteout(dentry, inode, &stat, -+ link, hardlink); -+ } - revert_creds(old_cred); - } - -diff --git a/include/linux/atalk.h b/include/linux/atalk.h -index 73fd8b7e9534..af43ed404ff4 100644 ---- a/include/linux/atalk.h -+++ b/include/linux/atalk.h -@@ -150,19 +150,29 @@ extern int sysctl_aarp_retransmit_limit; - extern int sysctl_aarp_resolve_time; - - #ifdef CONFIG_SYSCTL --extern void atalk_register_sysctl(void); -+extern int atalk_register_sysctl(void); - extern void atalk_unregister_sysctl(void); - #else --#define atalk_register_sysctl() do { } while(0) --#define atalk_unregister_sysctl() do { } while(0) -+static inline int atalk_register_sysctl(void) -+{ -+ return 0; -+} -+static inline void atalk_unregister_sysctl(void) -+{ -+} - #endif - - #ifdef CONFIG_PROC_FS - extern int atalk_proc_init(void); - extern void atalk_proc_exit(void); - #else --#define atalk_proc_init() ({ 0; }) --#define atalk_proc_exit() do { } while(0) -+static inline int atalk_proc_init(void) -+{ -+ return 0; -+} -+static inline void atalk_proc_exit(void) -+{ -+} - #endif /* CONFIG_PROC_FS */ - - #endif /* __LINUX_ATALK_H__ */ -diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h -index fb790b8449c1..333e42cf08de 100644 ---- a/include/linux/bitrev.h -+++ b/include/linux/bitrev.h -@@ -31,32 +31,32 @@ static inline u32 __bitrev32(u32 x) - - #define __constant_bitrev32(x) \ - ({ \ -- u32 __x = x; \ -- __x = (__x >> 16) | (__x << 16); \ -- __x = ((__x & (u32)0xFF00FF00UL) >> 8) | ((__x & (u32)0x00FF00FFUL) << 8); \ -- __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4); \ -- __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2); \ -- __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1); \ -- __x; \ -+ u32 ___x = x; \ -+ ___x = (___x >> 16) | (___x << 16); \ -+ ___x = ((___x & (u32)0xFF00FF00UL) >> 8) | ((___x & (u32)0x00FF00FFUL) << 8); \ -+ ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4); \ -+ ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2); \ -+ ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1); \ -+ ___x; \ - }) - - #define __constant_bitrev16(x) \ - ({ \ -- u16 __x = x; \ -- __x = (__x >> 8) | (__x << 8); \ -- __x = ((__x & (u16)0xF0F0U) >> 4) | ((__x & (u16)0x0F0FU) << 4); \ -- __x = ((__x & (u16)0xCCCCU) >> 2) | ((__x & (u16)0x3333U) << 2); \ -- __x = ((__x & (u16)0xAAAAU) >> 1) | ((__x & (u16)0x5555U) << 1); \ -- __x; \ -+ u16 ___x = x; \ -+ ___x = (___x >> 8) | (___x << 8); \ -+ ___x = ((___x & (u16)0xF0F0U) >> 4) | ((___x & (u16)0x0F0FU) << 4); \ -+ ___x = ((___x & (u16)0xCCCCU) >> 2) | ((___x & (u16)0x3333U) << 2); \ -+ ___x = ((___x & (u16)0xAAAAU) >> 1) | ((___x & (u16)0x5555U) << 1); \ -+ ___x; \ - }) - - #define __constant_bitrev8(x) \ - ({ \ -- u8 __x = x; \ -- __x = (__x >> 4) | (__x << 4); \ -- __x = ((__x & (u8)0xCCU) >> 2) | ((__x & (u8)0x33U) << 2); \ -- __x = ((__x & (u8)0xAAU) >> 1) | ((__x & (u8)0x55U) << 1); \ -- __x; \ -+ u8 ___x = x; \ -+ ___x = (___x >> 4) | (___x << 4); \ -+ ___x = ((___x & (u8)0xCCU) >> 2) | ((___x & (u8)0x33U) << 2); \ -+ ___x = ((___x & (u8)0xAAU) >> 1) | ((___x & (u8)0x55U) << 1); \ -+ ___x; \ - }) - - #define bitrev32(x) \ -diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h -index e23392517db9..cb527c78de9f 100644 ---- a/include/linux/kprobes.h -+++ b/include/linux/kprobes.h -@@ -197,6 +197,7 @@ struct kretprobe_instance { - struct kretprobe *rp; - kprobe_opcode_t *ret_addr; - struct task_struct *task; -+ void *fp; - char data[0]; - }; - -diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h -index 19d0778ec382..121c8f99ecdd 100644 ---- a/include/linux/ring_buffer.h -+++ b/include/linux/ring_buffer.h -@@ -125,7 +125,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts, - unsigned long *lost_events); - - struct ring_buffer_iter * --ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu); -+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags); - void ring_buffer_read_prepare_sync(void); - void ring_buffer_read_start(struct ring_buffer_iter *iter); - void ring_buffer_read_finish(struct ring_buffer_iter *iter); -diff --git a/include/linux/string.h b/include/linux/string.h -index c026b7a19e26..870268d42ae7 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -110,6 +110,9 @@ extern void * memscan(void *,int,__kernel_size_t); - #ifndef __HAVE_ARCH_MEMCMP - extern int memcmp(const void *,const void *,__kernel_size_t); - #endif -+#ifndef __HAVE_ARCH_BCMP -+extern int bcmp(const void *,const void *,__kernel_size_t); -+#endif - #ifndef __HAVE_ARCH_MEMCHR - extern void * memchr(const void *,int,__kernel_size_t); - #endif -diff --git a/include/linux/swap.h b/include/linux/swap.h -index d8ca2eaa3a8b..0a0b7529dae4 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -135,9 +135,9 @@ struct swap_extent { - /* - * Max bad pages in the new format.. - */ --#define __swapoffset(x) ((unsigned long)&((union swap_header *)0)->x) - #define MAX_SWAP_BADPAGES \ -- ((__swapoffset(magic.magic) - __swapoffset(info.badpages)) / sizeof(int)) -+ ((offsetof(union swap_header, magic.magic) - \ -+ offsetof(union swap_header, info.badpages)) / sizeof(int)) - - enum { - SWP_USED = (1 << 0), /* is slot in swap_info[] used? */ -diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h -index 6965dfe7e88b..0daed810724d 100644 ---- a/include/net/net_namespace.h -+++ b/include/net/net_namespace.h -@@ -53,6 +53,7 @@ struct net { - */ - spinlock_t rules_mod_lock; - -+ u32 hash_mix; - atomic64_t cookie_gen; - - struct list_head list; /* list of network namespaces */ -diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h -index e8d1448425a7..b1d0d46344e2 100644 ---- a/include/net/netfilter/br_netfilter.h -+++ b/include/net/netfilter/br_netfilter.h -@@ -42,7 +42,6 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) - } - - struct net_device *setup_pre_routing(struct sk_buff *skb); --void br_netfilter_enable(void); - - #if IS_ENABLED(CONFIG_IPV6) - int br_validate_ipv6(struct net *net, struct sk_buff *skb); -diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h -index 69a6715d9f3f..a347b2f9e748 100644 ---- a/include/net/netns/hash.h -+++ b/include/net/netns/hash.h -@@ -1,21 +1,10 @@ - #ifndef __NET_NS_HASH_H__ - #define __NET_NS_HASH_H__ - --#include -- --struct net; -+#include - - static inline u32 net_hash_mix(const struct net *net) - { --#ifdef CONFIG_NET_NS -- /* -- * shift this right to eliminate bits, that are -- * always zeroed -- */ -- -- return (u32)(((unsigned long)net) >> L1_CACHE_SHIFT); --#else -- return 0; --#endif -+ return net->hash_mix; - } - #endif -diff --git a/kernel/events/core.c b/kernel/events/core.c -index e53dfb5b826e..17230ca00bd4 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -5998,6 +5998,7 @@ static void perf_event_mmap_output(struct perf_event *event, - struct perf_output_handle handle; - struct perf_sample_data sample; - int size = mmap_event->event_id.header.size; -+ u32 type = mmap_event->event_id.header.type; - int ret; - - if (!perf_event_mmap_match(event, data)) -@@ -6041,6 +6042,7 @@ static void perf_event_mmap_output(struct perf_event *event, - perf_output_end(&handle); - out: - mmap_event->event_id.header.size = size; -+ mmap_event->event_id.header.type = type; - } - - static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) -diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c -index 3c74e13a95dc..67aafc2b249c 100644 ---- a/kernel/irq/chip.c -+++ b/kernel/irq/chip.c -@@ -1056,6 +1056,10 @@ int irq_chip_set_vcpu_affinity_parent(struct irq_data *data, void *vcpu_info) - int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on) - { - data = data->parent_data; -+ -+ if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE) -+ return 0; -+ - if (data->chip->irq_set_wake) - return data->chip->irq_set_wake(data, on); - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index d8daf6c55d2b..a53998cba804 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -668,7 +668,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force) - static int reuse_unused_kprobe(struct kprobe *ap) - { - struct optimized_kprobe *op; -- int ret; - - BUG_ON(!kprobe_unused(ap)); - /* -@@ -682,9 +681,8 @@ static int reuse_unused_kprobe(struct kprobe *ap) - /* Enable the probe again */ - ap->flags &= ~KPROBE_FLAG_DISABLED; - /* Optimize it again (remove from op->list) */ -- ret = kprobe_optready(ap); -- if (ret) -- return ret; -+ if (!kprobe_optready(ap)) -+ return -EINVAL; - - optimize_kprobe(ap); - return 0; -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index a49c565529a0..774ab79d3ec7 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3314,9 +3314,6 @@ __lock_set_class(struct lockdep_map *lock, const char *name, - unsigned int depth; - int i; - -- if (unlikely(!debug_locks)) -- return 0; -- - depth = curr->lockdep_depth; - /* - * This function is about (re)setting the class of a held lock, -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 6051007918ad..d706cf4fda99 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4016,12 +4016,15 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct hrtimer *timer) - return HRTIMER_NORESTART; - } - -+extern const u64 max_cfs_quota_period; -+ - static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) - { - struct cfs_bandwidth *cfs_b = - container_of(timer, struct cfs_bandwidth, period_timer); - int overrun; - int idle = 0; -+ int count = 0; - - raw_spin_lock(&cfs_b->lock); - for (;;) { -@@ -4029,6 +4032,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) - if (!overrun) - break; - -+ if (++count > 3) { -+ u64 new, old = ktime_to_ns(cfs_b->period); -+ -+ new = (old * 147) / 128; /* ~115% */ -+ new = min(new, max_cfs_quota_period); -+ -+ cfs_b->period = ns_to_ktime(new); -+ -+ /* since max is 1s, this is limited to 1e9^2, which fits in u64 */ -+ cfs_b->quota *= new; -+ cfs_b->quota = div64_u64(cfs_b->quota, old); -+ -+ pr_warn_ratelimited( -+ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n", -+ smp_processor_id(), -+ div_u64(new, NSEC_PER_USEC), -+ div_u64(cfs_b->quota, NSEC_PER_USEC)); -+ -+ /* reset count so we don't come right back in here */ -+ count = 0; -+ } -+ - idle = do_sched_cfs_period_timer(cfs_b, overrun); - } - if (idle) -@@ -6022,10 +6047,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq) - if (cfs_rq->last_h_load_update == now) - return; - -- cfs_rq->h_load_next = NULL; -+ WRITE_ONCE(cfs_rq->h_load_next, NULL); - for_each_sched_entity(se) { - cfs_rq = cfs_rq_of(se); -- cfs_rq->h_load_next = se; -+ WRITE_ONCE(cfs_rq->h_load_next, se); - if (cfs_rq->last_h_load_update == now) - break; - } -@@ -6035,7 +6060,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq) - cfs_rq->last_h_load_update = now; - } - -- while ((se = cfs_rq->h_load_next) != NULL) { -+ while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) { - load = cfs_rq->h_load; - load = div64_ul(load * se->avg.load_avg, - cfs_rq_load_avg(cfs_rq) + 1); -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index beadcf83ceba..c140659db669 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -125,7 +125,9 @@ static int zero; - static int __maybe_unused one = 1; - static int __maybe_unused two = 2; - static int __maybe_unused four = 4; -+static unsigned long zero_ul; - static unsigned long one_ul = 1; -+static unsigned long long_max = LONG_MAX; - static int one_hundred = 100; - #ifdef CONFIG_PRINTK - static int ten_thousand = 10000; -@@ -1603,6 +1605,8 @@ static struct ctl_table fs_table[] = { - .maxlen = sizeof(files_stat.max_files), - .mode = 0644, - .proc_handler = proc_doulongvec_minmax, -+ .extra1 = &zero_ul, -+ .extra2 = &long_max, - }, - { - .procname = "nr_open", -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index d90b42b39908..6380ec0453e0 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - - #include - -@@ -5165,7 +5166,7 @@ static struct ftrace_ops control_ops = { - INIT_OPS_HASH(control_ops) - }; - --static inline void -+static nokprobe_inline void - __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip, - struct ftrace_ops *ignored, struct pt_regs *regs) - { -@@ -5214,11 +5215,13 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip, - { - __ftrace_ops_list_func(ip, parent_ip, NULL, regs); - } -+NOKPROBE_SYMBOL(ftrace_ops_list_func); - #else - static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip) - { - __ftrace_ops_list_func(ip, parent_ip, NULL, NULL); - } -+NOKPROBE_SYMBOL(ftrace_ops_no_ops); - #endif - - /* -@@ -5239,6 +5242,7 @@ static void ftrace_ops_recurs_func(unsigned long ip, unsigned long parent_ip, - - trace_clear_recursion(bit); - } -+NOKPROBE_SYMBOL(ftrace_ops_recurs_func); - - /** - * ftrace_ops_get_func - get the function a trampoline should call -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 74b20e3ab8c6..5e091614fe39 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -4042,6 +4042,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); - * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer - * @buffer: The ring buffer to read from - * @cpu: The cpu buffer to iterate over -+ * @flags: gfp flags to use for memory allocation - * - * This performs the initial preparations necessary to iterate - * through the buffer. Memory is allocated, buffer recording -@@ -4059,7 +4060,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume); - * This overall must be paired with ring_buffer_read_finish. - */ - struct ring_buffer_iter * --ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) -+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags) - { - struct ring_buffer_per_cpu *cpu_buffer; - struct ring_buffer_iter *iter; -@@ -4067,7 +4068,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu) - if (!cpumask_test_cpu(cpu, buffer->cpumask)) - return NULL; - -- iter = kmalloc(sizeof(*iter), GFP_KERNEL); -+ iter = kmalloc(sizeof(*iter), flags); - if (!iter) - return NULL; - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 8c097de8a596..ae00e68ceae3 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3122,7 +3122,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) - if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { - for_each_tracing_cpu(cpu) { - iter->buffer_iter[cpu] = -- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); -+ ring_buffer_read_prepare(iter->trace_buffer->buffer, -+ cpu, GFP_KERNEL); - } - ring_buffer_read_prepare_sync(); - for_each_tracing_cpu(cpu) { -@@ -3132,7 +3133,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) - } else { - cpu = iter->cpu_file; - iter->buffer_iter[cpu] = -- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu); -+ ring_buffer_read_prepare(iter->trace_buffer->buffer, -+ cpu, GFP_KERNEL); - ring_buffer_read_prepare_sync(); - ring_buffer_read_start(iter->buffer_iter[cpu]); - tracing_iter_reset(iter, cpu); -diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c -index 57149bce6aad..896458285fdd 100644 ---- a/kernel/trace/trace_kdb.c -+++ b/kernel/trace/trace_kdb.c -@@ -50,14 +50,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) - if (cpu_file == RING_BUFFER_ALL_CPUS) { - for_each_tracing_cpu(cpu) { - iter.buffer_iter[cpu] = -- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu); -+ ring_buffer_read_prepare(iter.trace_buffer->buffer, -+ cpu, GFP_ATOMIC); - ring_buffer_read_start(iter.buffer_iter[cpu]); - tracing_iter_reset(&iter, cpu); - } - } else { - iter.cpu_file = cpu_file; - iter.buffer_iter[cpu_file] = -- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file); -+ ring_buffer_read_prepare(iter.trace_buffer->buffer, -+ cpu_file, GFP_ATOMIC); - ring_buffer_read_start(iter.buffer_iter[cpu_file]); - tracing_iter_reset(&iter, cpu_file); - } -diff --git a/lib/bsearch.c b/lib/bsearch.c -index e33c179089db..d50048446b77 100644 ---- a/lib/bsearch.c -+++ b/lib/bsearch.c -@@ -11,6 +11,7 @@ - - #include - #include -+#include - - /* - * bsearch - binary search an array of elements -@@ -51,3 +52,4 @@ void *bsearch(const void *key, const void *base, size_t num, size_t size, - return NULL; - } - EXPORT_SYMBOL(bsearch); -+NOKPROBE_SYMBOL(bsearch); -diff --git a/lib/div64.c b/lib/div64.c -index 62a698a432bc..75b8521c2146 100644 ---- a/lib/div64.c -+++ b/lib/div64.c -@@ -100,7 +100,7 @@ u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder) - quot = div_u64_rem(dividend, divisor, &rem32); - *remainder = rem32; - } else { -- int n = 1 + fls(high); -+ int n = fls(high); - quot = div_u64(dividend >> n, divisor >> n); - - if (quot != 0) -@@ -138,7 +138,7 @@ u64 div64_u64(u64 dividend, u64 divisor) - if (high == 0) { - quot = div_u64(dividend, divisor); - } else { -- int n = 1 + fls(high); -+ int n = fls(high); - quot = div_u64(dividend >> n, divisor >> n); - - if (quot != 0) -diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c -index 1afb545a37c5..6d35274170bc 100644 ---- a/lib/int_sqrt.c -+++ b/lib/int_sqrt.c -@@ -7,6 +7,7 @@ - - #include - #include -+#include - - /** - * int_sqrt - rough approximation to sqrt -@@ -21,10 +22,7 @@ unsigned long int_sqrt(unsigned long x) - if (x <= 1) - return x; - -- m = 1UL << (BITS_PER_LONG - 2); -- while (m > x) -- m >>= 2; -- -+ m = 1UL << (__fls(x) & ~1UL); - while (m != 0) { - b = y + m; - y >>= 1; -diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile -index 3b10a48fa040..a84efd4aad37 100644 ---- a/lib/raid6/Makefile -+++ b/lib/raid6/Makefile -@@ -23,7 +23,7 @@ endif - ifeq ($(CONFIG_KERNEL_MODE_NEON),y) - NEON_FLAGS := -ffreestanding - ifeq ($(ARCH),arm) --NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon -+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon - endif - ifeq ($(ARCH),arm64) - CFLAGS_REMOVE_neon1.o += -mgeneral-regs-only -diff --git a/lib/string.c b/lib/string.c -index 1a90db9bc6e1..c7cf65ac42ad 100644 ---- a/lib/string.c -+++ b/lib/string.c -@@ -746,6 +746,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count) - EXPORT_SYMBOL(memcmp); - #endif - -+#ifndef __HAVE_ARCH_BCMP -+/** -+ * bcmp - returns 0 if and only if the buffers have identical contents. -+ * @a: pointer to first buffer. -+ * @b: pointer to second buffer. -+ * @len: size of buffers. -+ * -+ * The sign or magnitude of a non-zero return value has no particular -+ * meaning, and architectures may implement their own more efficient bcmp(). So -+ * while this particular implementation is a simple (tail) call to memcmp, do -+ * not rely on anything but whether the return value is zero or non-zero. -+ */ -+#undef bcmp -+int bcmp(const void *a, const void *b, size_t len) -+{ -+ return memcmp(a, b, len); -+} -+EXPORT_SYMBOL(bcmp); -+#endif -+ - #ifndef __HAVE_ARCH_MEMSCAN - /** - * memscan - Find a character in an area of memory. -diff --git a/mm/cma.c b/mm/cma.c -index 43f4a122e969..f0d91aca5a4c 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -339,12 +339,14 @@ int __init cma_declare_contiguous(phys_addr_t base, - - ret = cma_init_reserved_mem(base, size, order_per_bit, res_cma); - if (ret) -- goto err; -+ goto free_mem; - - pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M, - &base); - return 0; - -+free_mem: -+ memblock_free(base, size); - err: - pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M); - return ret; -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 5418ab0c5e2c..878d05bd185c 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -514,12 +514,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr, - if (node_isset(nid, *qp->nmask) == !!(flags & MPOL_MF_INVERT)) - continue; - -- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) -+ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) { -+ if (!vma_migratable(vma)) -+ break; - migrate_page_add(page, qp->pagelist, flags); -+ } else -+ break; - } - pte_unmap_unlock(pte - 1, ptl); - cond_resched(); -- return 0; -+ return addr != end ? -EIO : 0; - } - - static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask, -diff --git a/mm/page_ext.c b/mm/page_ext.c -index 4d1eac0d4fc5..de1f34c5a2f1 100644 ---- a/mm/page_ext.c -+++ b/mm/page_ext.c -@@ -255,6 +255,7 @@ static void free_page_ext(void *addr) - table_size = sizeof(struct page_ext) * PAGES_PER_SECTION; - - BUG_ON(PageReserved(page)); -+ kmemleak_free(addr); - free_pages_exact(addr, table_size); - } - } -diff --git a/mm/slab.c b/mm/slab.c -index 92df044f5e00..d043b8007f23 100644 ---- a/mm/slab.c -+++ b/mm/slab.c -@@ -660,14 +660,6 @@ static void start_cpu_timer(int cpu) - - static void init_arraycache(struct array_cache *ac, int limit, int batch) - { -- /* -- * The array_cache structures contain pointers to free object. -- * However, when such objects are allocated or transferred to another -- * cache the pointers are not cleared and they could be counted as -- * valid references during a kmemleak scan. Therefore, kmemleak must -- * not scan such objects. -- */ -- kmemleak_no_scan(ac); - if (ac) { - ac->avail = 0; - ac->limit = limit; -@@ -683,6 +675,14 @@ static struct array_cache *alloc_arraycache(int node, int entries, - struct array_cache *ac = NULL; - - ac = kmalloc_node(memsize, gfp, node); -+ /* -+ * The array_cache structures contain pointers to free object. -+ * However, when such objects are allocated or transferred to another -+ * cache the pointers are not cleared and they could be counted as -+ * valid references during a kmemleak scan. Therefore, kmemleak must -+ * not scan such objects. -+ */ -+ kmemleak_no_scan(ac); - init_arraycache(ac, entries, batchcount); - return ac; - } -@@ -876,6 +876,7 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, - - alc = kmalloc_node(memsize, gfp, node); - if (alc) { -+ kmemleak_no_scan(alc); - init_arraycache(&alc->ac, entries, batch); - spin_lock_init(&alc->lock); - } -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 400e580725da..7c556b59f0ec 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -446,7 +446,11 @@ nocache: - } - - found: -- if (addr + size > vend) -+ /* -+ * Check also calculated address against the vstart, -+ * because it can be 0 because of big align request. -+ */ -+ if (addr + size > vend || addr < vstart) - goto overflow; - - va->va_start = addr; -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 6af9bbad94c7..dd0a13013cb4 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -857,13 +857,8 @@ const char * const vmstat_text[] = { - #endif - #endif /* CONFIG_MEMORY_BALLOON */ - #ifdef CONFIG_DEBUG_TLBFLUSH --#ifdef CONFIG_SMP - "nr_tlb_remote_flush", - "nr_tlb_remote_flush_received", --#else -- "", /* nr_tlb_remote_flush */ -- "", /* nr_tlb_remote_flush_received */ --#endif /* CONFIG_SMP */ - "nr_tlb_local_flush_all", - "nr_tlb_local_flush_one", - #endif /* CONFIG_DEBUG_TLBFLUSH */ -diff --git a/net/9p/protocol.c b/net/9p/protocol.c -index 145f80518064..7f1b45c082c9 100644 ---- a/net/9p/protocol.c -+++ b/net/9p/protocol.c -@@ -570,9 +570,10 @@ int p9stat_read(struct p9_client *clnt, char *buf, int len, struct p9_wstat *st) - if (ret) { - p9_debug(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret); - trace_9p_protocol_dump(clnt, &fake_pdu); -+ return ret; - } - -- return ret; -+ return fake_pdu.offset; - } - EXPORT_SYMBOL(p9stat_read); - -diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c -index af46bc49e1e9..b5f84f428aa6 100644 ---- a/net/appletalk/atalk_proc.c -+++ b/net/appletalk/atalk_proc.c -@@ -293,7 +293,7 @@ out_interface: - goto out; - } - --void __exit atalk_proc_exit(void) -+void atalk_proc_exit(void) - { - remove_proc_entry("interface", atalk_proc_dir); - remove_proc_entry("route", atalk_proc_dir); -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index d5871ac493eb..4246df3b7ae8 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -1912,12 +1912,16 @@ static const char atalk_err_snap[] __initconst = - /* Called by proto.c on kernel start up */ - static int __init atalk_init(void) - { -- int rc = proto_register(&ddp_proto, 0); -+ int rc; - -- if (rc != 0) -+ rc = proto_register(&ddp_proto, 0); -+ if (rc) - goto out; - -- (void)sock_register(&atalk_family_ops); -+ rc = sock_register(&atalk_family_ops); -+ if (rc) -+ goto out_proto; -+ - ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv); - if (!ddp_dl) - printk(atalk_err_snap); -@@ -1925,12 +1929,33 @@ static int __init atalk_init(void) - dev_add_pack(<alk_packet_type); - dev_add_pack(&ppptalk_packet_type); - -- register_netdevice_notifier(&ddp_notifier); -+ rc = register_netdevice_notifier(&ddp_notifier); -+ if (rc) -+ goto out_sock; -+ - aarp_proto_init(); -- atalk_proc_init(); -- atalk_register_sysctl(); -+ rc = atalk_proc_init(); -+ if (rc) -+ goto out_aarp; -+ -+ rc = atalk_register_sysctl(); -+ if (rc) -+ goto out_proc; - out: - return rc; -+out_proc: -+ atalk_proc_exit(); -+out_aarp: -+ aarp_cleanup_module(); -+ unregister_netdevice_notifier(&ddp_notifier); -+out_sock: -+ dev_remove_pack(&ppptalk_packet_type); -+ dev_remove_pack(<alk_packet_type); -+ unregister_snap_client(ddp_dl); -+ sock_unregister(PF_APPLETALK); -+out_proto: -+ proto_unregister(&ddp_proto); -+ goto out; - } - module_init(atalk_init); - -diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c -index ebb864361f7a..4e6042e0fcac 100644 ---- a/net/appletalk/sysctl_net_atalk.c -+++ b/net/appletalk/sysctl_net_atalk.c -@@ -44,9 +44,12 @@ static struct ctl_table atalk_table[] = { - - static struct ctl_table_header *atalk_table_header; - --void atalk_register_sysctl(void) -+int __init atalk_register_sysctl(void) - { - atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table); -+ if (!atalk_table_header) -+ return -ENOMEM; -+ return 0; - } - - void atalk_unregister_sysctl(void) -diff --git a/net/atm/lec.c b/net/atm/lec.c -index 10e4066991b8..e4afac94ff15 100644 ---- a/net/atm/lec.c -+++ b/net/atm/lec.c -@@ -721,7 +721,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) - - static int lec_mcast_attach(struct atm_vcc *vcc, int arg) - { -- if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg]) -+ if (arg < 0 || arg >= MAX_LEC_ITF) -+ return -EINVAL; -+ arg = array_index_nospec(arg, MAX_LEC_ITF); -+ if (!dev_lec[arg]) - return -EINVAL; - vcc->proto_data = dev_lec[arg]; - return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc); -@@ -739,6 +742,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) - i = arg; - if (arg >= MAX_LEC_ITF) - return -EINVAL; -+ i = array_index_nospec(arg, MAX_LEC_ITF); - if (!dev_lec[i]) { - int size; - -diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index c842f40c1173..ea1cd8b21708 100644 ---- a/net/bluetooth/hci_sock.c -+++ b/net/bluetooth/hci_sock.c -@@ -558,13 +558,12 @@ static int hci_sock_release(struct socket *sock) - if (!sk) - return 0; - -- hdev = hci_pi(sk)->hdev; -- - if (hci_pi(sk)->channel == HCI_CHANNEL_MONITOR) - atomic_dec(&monitor_promisc); - - bt_sock_unlink(&hci_sk_list, sk); - -+ hdev = hci_pi(sk)->hdev; - if (hdev) { - if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { - /* When releasing an user channel exclusive access, -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index d80c15d028fe..a52b4ffe30f4 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1894,7 +1894,8 @@ static void br_multicast_start_querier(struct net_bridge *br, - - __br_multicast_open(br, query); - -- list_for_each_entry(port, &br->port_list, list) { -+ rcu_read_lock(); -+ list_for_each_entry_rcu(port, &br->port_list, list) { - if (port->state == BR_STATE_DISABLED || - port->state == BR_STATE_BLOCKING) - continue; -@@ -1906,6 +1907,7 @@ static void br_multicast_start_querier(struct net_bridge *br, - br_multicast_enable(&port->ip6_own_query); - #endif - } -+ rcu_read_unlock(); - } - - int br_multicast_toggle(struct net_bridge *br, unsigned long val) -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 6def85d75b1d..93b5525bcccf 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -873,11 +873,6 @@ static const struct nf_br_ops br_ops = { - .br_dev_xmit_hook = br_nf_dev_xmit, - }; - --void br_netfilter_enable(void) --{ --} --EXPORT_SYMBOL_GPL(br_netfilter_enable); -- - /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because - * br_dev_queue_push_xmit is called afterwards */ - static struct nf_hook_ops br_nf_ops[] __read_mostly = { -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index b6bca625b0d2..9a53c66deb64 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -1287,17 +1287,22 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr) - - gstrings.len = ret; - -- data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); -- if (!data) -- return -ENOMEM; -+ if (gstrings.len) { -+ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); -+ if (!data) -+ return -ENOMEM; - -- __ethtool_get_strings(dev, gstrings.string_set, data); -+ __ethtool_get_strings(dev, gstrings.string_set, data); -+ } else { -+ data = NULL; -+ } - - ret = -EFAULT; - if (copy_to_user(useraddr, &gstrings, sizeof(gstrings))) - goto out; - useraddr += sizeof(gstrings); -- if (copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN)) -+ if (gstrings.len && -+ copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN)) - goto out; - ret = 0; - -@@ -1385,17 +1390,21 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr) - return -EFAULT; - - stats.n_stats = n_stats; -- data = kmalloc(n_stats * sizeof(u64), GFP_USER); -- if (!data) -- return -ENOMEM; -+ if (n_stats) { -+ data = kmalloc(n_stats * sizeof(u64), GFP_USER); -+ if (!data) -+ return -ENOMEM; - -- ops->get_ethtool_stats(dev, &stats, data); -+ ops->get_ethtool_stats(dev, &stats, data); -+ } else { -+ data = NULL; -+ } - - ret = -EFAULT; - if (copy_to_user(useraddr, &stats, sizeof(stats))) - goto out; - useraddr += sizeof(stats); -- if (copy_to_user(useraddr, data, stats.n_stats * sizeof(u64))) -+ if (n_stats && copy_to_user(useraddr, data, n_stats * sizeof(u64))) - goto out; - ret = 0; - -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index ccd20669ac00..087ce1598b74 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -280,6 +280,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) - - atomic_set(&net->count, 1); - atomic_set(&net->passive, 1); -+ get_random_bytes(&net->hash_mix, sizeof(u32)); - net->dev_base_seq = 1; - net->user_ns = user_ns; - idr_init(&net->netns_ids); -diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c -index d83888bc33d3..b5a137338e50 100644 ---- a/net/ipv4/fou.c -+++ b/net/ipv4/fou.c -@@ -116,6 +116,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) - struct guehdr *guehdr; - void *data; - u16 doffset = 0; -+ u8 proto_ctype; - - if (!fou) - return 1; -@@ -173,13 +174,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb) - if (unlikely(guehdr->control)) - return gue_control_message(skb, guehdr); - -+ proto_ctype = guehdr->proto_ctype; - __skb_pull(skb, sizeof(struct udphdr) + hdrlen); - skb_reset_transport_header(skb); - - if (iptunnel_pull_offloads(skb)) - goto drop; - -- return -guehdr->proto_ctype; -+ return -proto_ctype; - - drop: - kfree_skb(skb); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 97bf6c785767..1d580d290054 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1164,9 +1164,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie) - - static void ipv4_link_failure(struct sk_buff *skb) - { -+ struct ip_options opt; - struct rtable *rt; -+ int res; -+ -+ /* Recompile ip options since IPCB may not be valid anymore. -+ */ -+ memset(&opt, 0, sizeof(opt)); -+ opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); -+ -+ rcu_read_lock(); -+ res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); -+ rcu_read_unlock(); -+ -+ if (res) -+ return; - -- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); -+ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt); - - rt = skb_rtable(skb); - if (rt) -diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c -index 62f90f6b7a9d..7ccbbd0d3e43 100644 ---- a/net/ipv4/tcp_dctcp.c -+++ b/net/ipv4/tcp_dctcp.c -@@ -66,11 +66,6 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA; - module_param(dctcp_alpha_on_init, uint, 0644); - MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value"); - --static unsigned int dctcp_clamp_alpha_on_loss __read_mostly; --module_param(dctcp_clamp_alpha_on_loss, uint, 0644); --MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss, -- "parameter for clamping alpha on loss"); -- - static struct tcp_congestion_ops dctcp_reno; - - static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca) -@@ -211,21 +206,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags) - } - } - --static void dctcp_state(struct sock *sk, u8 new_state) -+static void dctcp_react_to_loss(struct sock *sk) - { -- if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) { -- struct dctcp *ca = inet_csk_ca(sk); -+ struct dctcp *ca = inet_csk_ca(sk); -+ struct tcp_sock *tp = tcp_sk(sk); - -- /* If this extension is enabled, we clamp dctcp_alpha to -- * max on packet loss; the motivation is that dctcp_alpha -- * is an indicator to the extend of congestion and packet -- * loss is an indicator of extreme congestion; setting -- * this in practice turned out to be beneficial, and -- * effectively assumes total congestion which reduces the -- * window by half. -- */ -- ca->dctcp_alpha = DCTCP_MAX_ALPHA; -- } -+ ca->loss_cwnd = tp->snd_cwnd; -+ tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U); -+} -+ -+static void dctcp_state(struct sock *sk, u8 new_state) -+{ -+ if (new_state == TCP_CA_Recovery && -+ new_state != inet_csk(sk)->icsk_ca_state) -+ dctcp_react_to_loss(sk); -+ /* We handle RTO in dctcp_cwnd_event to ensure that we perform only -+ * one loss-adjustment per RTT. -+ */ - } - - static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) -@@ -237,6 +234,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev) - case CA_EVENT_ECN_NO_CE: - dctcp_ce_state_1_to_0(sk); - break; -+ case CA_EVENT_LOSS: -+ dctcp_react_to_loss(sk); -+ break; - default: - /* Don't care for the rest. */ - break; -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index aff90b0ddb63..44a3aa7a41e2 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -365,11 +365,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb) - static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb) - { - struct tcp_sock *tp = tcp_sk(sk); -+ int room; -+ -+ room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh; - - /* Check #1 */ -- if (tp->rcv_ssthresh < tp->window_clamp && -- (int)tp->rcv_ssthresh < tcp_space(sk) && -- !tcp_under_memory_pressure(sk)) { -+ if (room > 0 && !tcp_under_memory_pressure(sk)) { - int incr; - - /* Check #2. Increase window, if skb with such overhead -@@ -382,8 +383,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb) - - if (incr) { - incr = max_t(int, incr, 2 * skb->len); -- tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr, -- tp->window_clamp); -+ tp->rcv_ssthresh += min(room, incr); - inet_csk(sk)->icsk_ack.quick |= 1; - } - } -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index f8cca81d66f2..e39dc94486b2 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -575,7 +575,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - inet6_sk(skb->sk) : NULL; - struct ipv6hdr *tmp_hdr; - struct frag_hdr *fh; -- unsigned int mtu, hlen, left, len; -+ unsigned int mtu, hlen, left, len, nexthdr_offset; - int hroom, troom; - __be32 frag_id; - int ptr, offset = 0, err = 0; -@@ -586,6 +586,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - goto fail; - hlen = err; - nexthdr = *prevhdr; -+ nexthdr_offset = prevhdr - skb_network_header(skb); - - mtu = ip6_skb_dst_mtu(skb); - -@@ -620,6 +621,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - (err = skb_checksum_help(skb))) - goto fail; - -+ prevhdr = skb_network_header(skb) + nexthdr_offset; - hroom = LL_RESERVED_SPACE(rt->dst.dev); - if (skb_has_frag_list(skb)) { - int first_len = skb_pagelen(skb); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 7c7a74ea2b0d..f072a4c4575c 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -622,7 +622,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - IPPROTO_IPIP, - RT_TOS(eiph->tos), 0); - if (IS_ERR(rt) || -- rt->dst.dev->type != ARPHRD_TUNNEL) { -+ rt->dst.dev->type != ARPHRD_TUNNEL6) { - if (!IS_ERR(rt)) - ip_rt_put(rt); - goto out; -@@ -632,7 +632,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - ip_rt_put(rt); - if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, - skb2->dev) || -- skb_dst(skb2)->dev->type != ARPHRD_TUNNEL) -+ skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6) - goto out; - } - -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 96582ec9c807..77736190dc15 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -693,6 +693,10 @@ static int ipip6_rcv(struct sk_buff *skb) - if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6))) - goto out; - -+ /* skb can be uncloned in iptunnel_pull_header, so -+ * old iph is no longer valid -+ */ -+ iph = (const struct iphdr *)skb_mac_header(skb); - err = IP_ECN_decapsulate(iph, skb); - if (unlikely(err)) { - if (log_ecn_error) -diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h -index 18b0d65baff0..6019988bfb84 100644 ---- a/net/mac80211/driver-ops.h -+++ b/net/mac80211/driver-ops.h -@@ -1157,6 +1157,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local, - { - struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif); - -+ if (local->in_reconfig) -+ return; -+ - if (!check_sdata_in_driver(sdata)) - return; - -diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c -index 1caaccbc306c..7e4063621960 100644 ---- a/net/netfilter/xt_physdev.c -+++ b/net/netfilter/xt_physdev.c -@@ -96,8 +96,7 @@ match_outdev: - static int physdev_mt_check(const struct xt_mtchk_param *par) - { - const struct xt_physdev_info *info = par->matchinfo; -- -- br_netfilter_enable(); -+ static bool brnf_probed __read_mostly; - - if (!(info->bitmask & XT_PHYSDEV_OP_MASK) || - info->bitmask & ~XT_PHYSDEV_OP_MASK) -@@ -113,6 +112,12 @@ static int physdev_mt_check(const struct xt_mtchk_param *par) - if (par->hook_mask & (1 << NF_INET_LOCAL_OUT)) - return -EINVAL; - } -+ -+ if (!brnf_probed) { -+ brnf_probed = true; -+ request_module("br_netfilter"); -+ } -+ - return 0; - } - -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index 537917dfa83a..9b676f8fc16f 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -1736,14 +1736,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, - - struct sw_flow_actions *acts; - int new_acts_size; -- int req_size = NLA_ALIGN(attr_len); -+ size_t req_size = NLA_ALIGN(attr_len); - int next_offset = offsetof(struct sw_flow_actions, actions) + - (*sfa)->actions_len; - - if (req_size <= (ksize(*sfa) - next_offset)) - goto out; - -- new_acts_size = ksize(*sfa) * 2; -+ new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2); - - if (new_acts_size > MAX_ACTIONS_BUFSIZE) { - if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { -diff --git a/net/rds/tcp.c b/net/rds/tcp.c -index 18e50a8fc05f..554d4b461983 100644 ---- a/net/rds/tcp.c -+++ b/net/rds/tcp.c -@@ -346,7 +346,7 @@ static void rds_tcp_kill_sock(struct net *net) - list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) { - struct net *c_net = read_pnet(&tc->conn->c_net); - -- if (net != c_net || !tc->t_sock) -+ if (net != c_net) - continue; - list_move_tail(&tc->t_tcp_node, &tmp_list); - } -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index 9f2f3c48b7b6..247d1888c386 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -598,6 +598,7 @@ out: - static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr) - { - /* No address mapping for V4 sockets */ -+ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); - return sizeof(struct sockaddr_in); - } - -diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c -index 9f5cdd49ff0b..4250d3d6f391 100644 ---- a/scripts/mod/file2alias.c -+++ b/scripts/mod/file2alias.c -@@ -47,49 +47,9 @@ typedef struct { - struct devtable { - const char *device_id; /* name of table, __mod___*_device_table. */ - unsigned long id_size; -- void *function; -+ int (*do_entry)(const char *filename, void *symval, char *alias); - }; - --#define ___cat(a,b) a ## b --#define __cat(a,b) ___cat(a,b) -- --/* we need some special handling for this host tool running eventually on -- * Darwin. The Mach-O section handling is a bit different than ELF section -- * handling. The differnces in detail are: -- * a) we have segments which have sections -- * b) we need a API call to get the respective section symbols */ --#if defined(__MACH__) --#include -- --#define INIT_SECTION(name) do { \ -- unsigned long name ## _len; \ -- char *__cat(pstart_,name) = getsectdata("__TEXT", \ -- #name, &__cat(name,_len)); \ -- char *__cat(pstop_,name) = __cat(pstart_,name) + \ -- __cat(name, _len); \ -- __cat(__start_,name) = (void *)__cat(pstart_,name); \ -- __cat(__stop_,name) = (void *)__cat(pstop_,name); \ -- } while (0) --#define SECTION(name) __attribute__((section("__TEXT, " #name))) -- --struct devtable **__start___devtable, **__stop___devtable; --#else --#define INIT_SECTION(name) /* no-op for ELF */ --#define SECTION(name) __attribute__((section(#name))) -- --/* We construct a table of pointers in an ELF section (pointers generally -- * go unpadded by gcc). ld creates boundary syms for us. */ --extern struct devtable *__start___devtable[], *__stop___devtable[]; --#endif /* __MACH__ */ -- --#if !defined(__used) --# if __GNUC__ == 3 && __GNUC_MINOR__ < 3 --# define __used __attribute__((__unused__)) --# else --# define __used __attribute__((__used__)) --# endif --#endif -- - /* Define a variable f that holds the value of field f of struct devid - * based at address m. - */ -@@ -102,16 +62,6 @@ extern struct devtable *__start___devtable[], *__stop___devtable[]; - #define DEF_FIELD_ADDR(m, devid, f) \ - typeof(((struct devid *)0)->f) *f = ((m) + OFF_##devid##_##f) - --/* Add a table entry. We test function type matches while we're here. */ --#define ADD_TO_DEVTABLE(device_id, type, function) \ -- static struct devtable __cat(devtable,__LINE__) = { \ -- device_id + 0*sizeof((function)((const char *)NULL, \ -- (void *)NULL, \ -- (char *)NULL)), \ -- SIZE_##type, (function) }; \ -- static struct devtable *SECTION(__devtable) __used \ -- __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__) -- - #define ADD(str, sep, cond, field) \ - do { \ - strcat(str, sep); \ -@@ -388,7 +338,6 @@ static int do_hid_entry(const char *filename, - - return 1; - } --ADD_TO_DEVTABLE("hid", hid_device_id, do_hid_entry); - - /* Looks like: ieee1394:venNmoNspNverN */ - static int do_ieee1394_entry(const char *filename, -@@ -413,7 +362,6 @@ static int do_ieee1394_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("ieee1394", ieee1394_device_id, do_ieee1394_entry); - - /* Looks like: pci:vNdNsvNsdNbcNscNiN. */ - static int do_pci_entry(const char *filename, -@@ -457,7 +405,6 @@ static int do_pci_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("pci", pci_device_id, do_pci_entry); - - /* looks like: "ccw:tNmNdtNdmN" */ - static int do_ccw_entry(const char *filename, -@@ -481,7 +428,6 @@ static int do_ccw_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("ccw", ccw_device_id, do_ccw_entry); - - /* looks like: "ap:tN" */ - static int do_ap_entry(const char *filename, -@@ -492,7 +438,6 @@ static int do_ap_entry(const char *filename, - sprintf(alias, "ap:t%02X*", dev_type); - return 1; - } --ADD_TO_DEVTABLE("ap", ap_device_id, do_ap_entry); - - /* looks like: "css:tN" */ - static int do_css_entry(const char *filename, -@@ -503,7 +448,6 @@ static int do_css_entry(const char *filename, - sprintf(alias, "css:t%01X", type); - return 1; - } --ADD_TO_DEVTABLE("css", css_device_id, do_css_entry); - - /* Looks like: "serio:tyNprNidNexN" */ - static int do_serio_entry(const char *filename, -@@ -523,7 +467,6 @@ static int do_serio_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("serio", serio_device_id, do_serio_entry); - - /* looks like: "acpi:ACPI0003" or "acpi:PNP0C0B" or "acpi:LNXVIDEO" or - * "acpi:bbsspp" (bb=base-class, ss=sub-class, pp=prog-if) -@@ -561,7 +504,6 @@ static int do_acpi_entry(const char *filename, - } - return 1; - } --ADD_TO_DEVTABLE("acpi", acpi_device_id, do_acpi_entry); - - /* looks like: "pnp:dD" */ - static void do_pnp_device_entry(void *symval, unsigned long size, -@@ -682,7 +624,6 @@ static int do_pcmcia_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("pcmcia", pcmcia_device_id, do_pcmcia_entry); - - static int do_of_entry (const char *filename, void *symval, char *alias) - { -@@ -707,7 +648,6 @@ static int do_of_entry (const char *filename, void *symval, char *alias) - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("of", of_device_id, do_of_entry); - - static int do_vio_entry(const char *filename, void *symval, - char *alias) -@@ -727,7 +667,6 @@ static int do_vio_entry(const char *filename, void *symval, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("vio", vio_device_id, do_vio_entry); - - #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) - -@@ -800,7 +739,6 @@ static int do_input_entry(const char *filename, void *symval, - do_input(alias, *swbit, 0, INPUT_DEVICE_ID_SW_MAX); - return 1; - } --ADD_TO_DEVTABLE("input", input_device_id, do_input_entry); - - static int do_eisa_entry(const char *filename, void *symval, - char *alias) -@@ -812,7 +750,6 @@ static int do_eisa_entry(const char *filename, void *symval, - strcat(alias, "*"); - return 1; - } --ADD_TO_DEVTABLE("eisa", eisa_device_id, do_eisa_entry); - - /* Looks like: parisc:tNhvNrevNsvN */ - static int do_parisc_entry(const char *filename, void *symval, -@@ -832,7 +769,6 @@ static int do_parisc_entry(const char *filename, void *symval, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("parisc", parisc_device_id, do_parisc_entry); - - /* Looks like: sdio:cNvNdN. */ - static int do_sdio_entry(const char *filename, -@@ -849,7 +785,6 @@ static int do_sdio_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("sdio", sdio_device_id, do_sdio_entry); - - /* Looks like: ssb:vNidNrevN. */ - static int do_ssb_entry(const char *filename, -@@ -866,7 +801,6 @@ static int do_ssb_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("ssb", ssb_device_id, do_ssb_entry); - - /* Looks like: bcma:mNidNrevNclN. */ - static int do_bcma_entry(const char *filename, -@@ -885,7 +819,6 @@ static int do_bcma_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("bcma", bcma_device_id, do_bcma_entry); - - /* Looks like: virtio:dNvN */ - static int do_virtio_entry(const char *filename, void *symval, -@@ -901,7 +834,6 @@ static int do_virtio_entry(const char *filename, void *symval, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("virtio", virtio_device_id, do_virtio_entry); - - /* - * Looks like: vmbus:guid -@@ -924,7 +856,6 @@ static int do_vmbus_entry(const char *filename, void *symval, - - return 1; - } --ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry); - - /* Looks like: i2c:S */ - static int do_i2c_entry(const char *filename, void *symval, -@@ -935,7 +866,6 @@ static int do_i2c_entry(const char *filename, void *symval, - - return 1; - } --ADD_TO_DEVTABLE("i2c", i2c_device_id, do_i2c_entry); - - /* Looks like: spi:S */ - static int do_spi_entry(const char *filename, void *symval, -@@ -946,7 +876,6 @@ static int do_spi_entry(const char *filename, void *symval, - - return 1; - } --ADD_TO_DEVTABLE("spi", spi_device_id, do_spi_entry); - - static const struct dmifield { - const char *prefix; -@@ -1001,7 +930,6 @@ static int do_dmi_entry(const char *filename, void *symval, - strcat(alias, ":"); - return 1; - } --ADD_TO_DEVTABLE("dmi", dmi_system_id, do_dmi_entry); - - static int do_platform_entry(const char *filename, - void *symval, char *alias) -@@ -1010,7 +938,6 @@ static int do_platform_entry(const char *filename, - sprintf(alias, PLATFORM_MODULE_PREFIX "%s", *name); - return 1; - } --ADD_TO_DEVTABLE("platform", platform_device_id, do_platform_entry); - - static int do_mdio_entry(const char *filename, - void *symval, char *alias) -@@ -1035,7 +962,6 @@ static int do_mdio_entry(const char *filename, - - return 1; - } --ADD_TO_DEVTABLE("mdio", mdio_device_id, do_mdio_entry); - - /* Looks like: zorro:iN. */ - static int do_zorro_entry(const char *filename, void *symval, -@@ -1046,7 +972,6 @@ static int do_zorro_entry(const char *filename, void *symval, - ADD(alias, "i", id != ZORRO_WILDCARD, id); - return 1; - } --ADD_TO_DEVTABLE("zorro", zorro_device_id, do_zorro_entry); - - /* looks like: "pnp:dD" */ - static int do_isapnp_entry(const char *filename, -@@ -1062,7 +987,6 @@ static int do_isapnp_entry(const char *filename, - (function >> 12) & 0x0f, (function >> 8) & 0x0f); - return 1; - } --ADD_TO_DEVTABLE("isapnp", isapnp_device_id, do_isapnp_entry); - - /* Looks like: "ipack:fNvNdN". */ - static int do_ipack_entry(const char *filename, -@@ -1078,7 +1002,6 @@ static int do_ipack_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("ipack", ipack_device_id, do_ipack_entry); - - /* - * Append a match expression for a single masked hex digit. -@@ -1149,7 +1072,6 @@ static int do_amba_entry(const char *filename, - - return 1; - } --ADD_TO_DEVTABLE("amba", amba_id, do_amba_entry); - - /* - * looks like: "mipscdmm:tN" -@@ -1165,7 +1087,6 @@ static int do_mips_cdmm_entry(const char *filename, - sprintf(alias, "mipscdmm:t%02X*", type); - return 1; - } --ADD_TO_DEVTABLE("mipscdmm", mips_cdmm_device_id, do_mips_cdmm_entry); - - /* LOOKS like cpu:type:x86,venVVVVfamFFFFmodMMMM:feature:*,FEAT,* - * All fields are numbers. It would be nicer to use strings for vendor -@@ -1190,7 +1111,6 @@ static int do_x86cpu_entry(const char *filename, void *symval, - sprintf(alias + strlen(alias), "%04X*", feature); - return 1; - } --ADD_TO_DEVTABLE("x86cpu", x86_cpu_id, do_x86cpu_entry); - - /* LOOKS like cpu:type:*:feature:*FEAT* */ - static int do_cpu_entry(const char *filename, void *symval, char *alias) -@@ -1200,7 +1120,6 @@ static int do_cpu_entry(const char *filename, void *symval, char *alias) - sprintf(alias, "cpu:type:*:feature:*%04X*", feature); - return 1; - } --ADD_TO_DEVTABLE("cpu", cpu_feature, do_cpu_entry); - - /* Looks like: mei:S:uuid:N:* */ - static int do_mei_entry(const char *filename, void *symval, -@@ -1219,7 +1138,6 @@ static int do_mei_entry(const char *filename, void *symval, - - return 1; - } --ADD_TO_DEVTABLE("mei", mei_cl_device_id, do_mei_entry); - - /* Looks like: rapidio:vNdNavNadN */ - static int do_rio_entry(const char *filename, -@@ -1239,7 +1157,6 @@ static int do_rio_entry(const char *filename, - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("rapidio", rio_device_id, do_rio_entry); - - /* Looks like: ulpi:vNpN */ - static int do_ulpi_entry(const char *filename, void *symval, -@@ -1252,7 +1169,6 @@ static int do_ulpi_entry(const char *filename, void *symval, - - return 1; - } --ADD_TO_DEVTABLE("ulpi", ulpi_device_id, do_ulpi_entry); - - /* Looks like: hdaudio:vNrNaN */ - static int do_hda_entry(const char *filename, void *symval, char *alias) -@@ -1269,7 +1185,6 @@ static int do_hda_entry(const char *filename, void *symval, char *alias) - add_wildcard(alias); - return 1; - } --ADD_TO_DEVTABLE("hdaudio", hda_device_id, do_hda_entry); - - /* Does namelen bytes of name exactly match the symbol? */ - static bool sym_is(const char *name, unsigned namelen, const char *symbol) -@@ -1283,12 +1198,11 @@ static bool sym_is(const char *name, unsigned namelen, const char *symbol) - static void do_table(void *symval, unsigned long size, - unsigned long id_size, - const char *device_id, -- void *function, -+ int (*do_entry)(const char *filename, void *symval, char *alias), - struct module *mod) - { - unsigned int i; - char alias[500]; -- int (*do_entry)(const char *, void *entry, char *alias) = function; - - device_id_check(mod->name, device_id, size, id_size, symval); - /* Leave last one: it's the terminator. */ -@@ -1302,6 +1216,44 @@ static void do_table(void *symval, unsigned long size, - } - } - -+static const struct devtable devtable[] = { -+ {"hid", SIZE_hid_device_id, do_hid_entry}, -+ {"ieee1394", SIZE_ieee1394_device_id, do_ieee1394_entry}, -+ {"pci", SIZE_pci_device_id, do_pci_entry}, -+ {"ccw", SIZE_ccw_device_id, do_ccw_entry}, -+ {"ap", SIZE_ap_device_id, do_ap_entry}, -+ {"css", SIZE_css_device_id, do_css_entry}, -+ {"serio", SIZE_serio_device_id, do_serio_entry}, -+ {"acpi", SIZE_acpi_device_id, do_acpi_entry}, -+ {"pcmcia", SIZE_pcmcia_device_id, do_pcmcia_entry}, -+ {"vio", SIZE_vio_device_id, do_vio_entry}, -+ {"input", SIZE_input_device_id, do_input_entry}, -+ {"eisa", SIZE_eisa_device_id, do_eisa_entry}, -+ {"parisc", SIZE_parisc_device_id, do_parisc_entry}, -+ {"sdio", SIZE_sdio_device_id, do_sdio_entry}, -+ {"ssb", SIZE_ssb_device_id, do_ssb_entry}, -+ {"bcma", SIZE_bcma_device_id, do_bcma_entry}, -+ {"virtio", SIZE_virtio_device_id, do_virtio_entry}, -+ {"vmbus", SIZE_hv_vmbus_device_id, do_vmbus_entry}, -+ {"i2c", SIZE_i2c_device_id, do_i2c_entry}, -+ {"spi", SIZE_spi_device_id, do_spi_entry}, -+ {"dmi", SIZE_dmi_system_id, do_dmi_entry}, -+ {"platform", SIZE_platform_device_id, do_platform_entry}, -+ {"mdio", SIZE_mdio_device_id, do_mdio_entry}, -+ {"zorro", SIZE_zorro_device_id, do_zorro_entry}, -+ {"isapnp", SIZE_isapnp_device_id, do_isapnp_entry}, -+ {"ipack", SIZE_ipack_device_id, do_ipack_entry}, -+ {"amba", SIZE_amba_id, do_amba_entry}, -+ {"mipscdmm", SIZE_mips_cdmm_device_id, do_mips_cdmm_entry}, -+ {"x86cpu", SIZE_x86_cpu_id, do_x86cpu_entry}, -+ {"cpu", SIZE_cpu_feature, do_cpu_entry}, -+ {"mei", SIZE_mei_cl_device_id, do_mei_entry}, -+ {"rapidio", SIZE_rio_device_id, do_rio_entry}, -+ {"ulpi", SIZE_ulpi_device_id, do_ulpi_entry}, -+ {"hdaudio", SIZE_hda_device_id, do_hda_entry}, -+ {"of", SIZE_of_device_id, do_of_entry}, -+}; -+ - /* Create MODULE_ALIAS() statements. - * At this time, we cannot write the actual output C source yet, - * so we write into the mod->dev_table_buf buffer. */ -@@ -1354,13 +1306,14 @@ void handle_moddevtable(struct module *mod, struct elf_info *info, - else if (sym_is(name, namelen, "pnp_card")) - do_pnp_card_entries(symval, sym->st_size, mod); - else { -- struct devtable **p; -- INIT_SECTION(__devtable); -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(devtable); i++) { -+ const struct devtable *p = &devtable[i]; - -- for (p = __start___devtable; p < __stop___devtable; p++) { -- if (sym_is(name, namelen, (*p)->device_id)) { -- do_table(symval, sym->st_size, (*p)->id_size, -- (*p)->device_id, (*p)->function, mod); -+ if (sym_is(name, namelen, p->device_id)) { -+ do_table(symval, sym->st_size, p->id_size, -+ p->device_id, p->do_entry, mod); - break; - } - } -diff --git a/security/device_cgroup.c b/security/device_cgroup.c -index 03c1652c9a1f..db3bdc91c520 100644 ---- a/security/device_cgroup.c -+++ b/security/device_cgroup.c -@@ -568,7 +568,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root, - devcg->behavior == DEVCG_DEFAULT_ALLOW) { - rc = dev_exception_add(devcg, ex); - if (rc) -- break; -+ return rc; - } else { - /* - * in the other possible cases: -diff --git a/sound/core/info.c b/sound/core/info.c -index 8ab72e0f5932..358a6947342d 100644 ---- a/sound/core/info.c -+++ b/sound/core/info.c -@@ -724,8 +724,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent) - INIT_LIST_HEAD(&entry->children); - INIT_LIST_HEAD(&entry->list); - entry->parent = parent; -- if (parent) -+ if (parent) { -+ mutex_lock(&parent->access); - list_add_tail(&entry->list, &parent->children); -+ mutex_unlock(&parent->access); -+ } - return entry; - } - -@@ -809,7 +812,12 @@ void snd_info_free_entry(struct snd_info_entry * entry) - list_for_each_entry_safe(p, n, &entry->children, list) - snd_info_free_entry(p); - -- list_del(&entry->list); -+ p = entry->parent; -+ if (p) { -+ mutex_lock(&p->access); -+ list_del(&entry->list); -+ mutex_unlock(&p->access); -+ } - kfree(entry->name); - if (entry->private_free) - entry->private_free(entry); -diff --git a/sound/core/init.c b/sound/core/init.c -index 20f37fb3800e..67765c61e5d5 100644 ---- a/sound/core/init.c -+++ b/sound/core/init.c -@@ -405,14 +405,7 @@ int snd_card_disconnect(struct snd_card *card) - card->shutdown = 1; - spin_unlock(&card->files_lock); - -- /* phase 1: disable fops (user space) operations for ALSA API */ -- mutex_lock(&snd_card_mutex); -- snd_cards[card->number] = NULL; -- clear_bit(card->number, snd_cards_lock); -- mutex_unlock(&snd_card_mutex); -- -- /* phase 2: replace file->f_op with special dummy operations */ -- -+ /* replace file->f_op with special dummy operations */ - spin_lock(&card->files_lock); - list_for_each_entry(mfile, &card->files_list, list) { - /* it's critical part, use endless loop */ -@@ -428,7 +421,7 @@ int snd_card_disconnect(struct snd_card *card) - } - spin_unlock(&card->files_lock); - -- /* phase 3: notify all connected devices about disconnection */ -+ /* notify all connected devices about disconnection */ - /* at this point, they cannot respond to any calls except release() */ - - #if IS_ENABLED(CONFIG_SND_MIXER_OSS) -@@ -444,6 +437,13 @@ int snd_card_disconnect(struct snd_card *card) - device_del(&card->card_dev); - card->registered = false; - } -+ -+ /* disable fops (user space) operations for ALSA API */ -+ mutex_lock(&snd_card_mutex); -+ snd_cards[card->number] = NULL; -+ clear_bit(card->number, snd_cards_lock); -+ mutex_unlock(&snd_card_mutex); -+ - #ifdef CONFIG_PM - wake_up(&card->power_sleep); - #endif -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 4d6f0f56d54a..252392abd1b9 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -1342,6 +1342,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm) - /* FIXME: the open/close code should lock this as well */ - if (substream->runtime == NULL) - continue; -+ -+ /* -+ * Skip BE dai link PCM's that are internal and may -+ * not have their substream ops set. -+ */ -+ if (!substream->ops) -+ continue; -+ - err = snd_pcm_suspend(substream); - if (err < 0 && err != -EBUSY) - return err; -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 73ee8476584d..0d0e0c2651c2 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1249,7 +1249,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client, - - /* fill the info fields */ - if (client_info.name[0]) -- strlcpy(client->name, client_info.name, sizeof(client->name)); -+ strscpy(client->name, client_info.name, sizeof(client->name)); - - client->filter = client_info.filter; - client->event_lost = client_info.event_lost; -@@ -1558,7 +1558,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, - /* set queue name */ - if (! info.name[0]) - snprintf(info.name, sizeof(info.name), "Queue-%d", q->queue); -- strlcpy(q->name, info.name, sizeof(q->name)); -+ strscpy(q->name, info.name, sizeof(q->name)); - snd_use_lock_free(&q->use_lock); - - if (copy_to_user(arg, &info, sizeof(info))) -@@ -1636,7 +1636,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client, - queuefree(q); - return -EPERM; - } -- strlcpy(q->name, info.name, sizeof(q->name)); -+ strscpy(q->name, info.name, sizeof(q->name)); - queuefree(q); - - return 0; -diff --git a/sound/drivers/opl3/opl3_voice.h b/sound/drivers/opl3/opl3_voice.h -index a371c075ac87..e26702559f61 100644 ---- a/sound/drivers/opl3/opl3_voice.h -+++ b/sound/drivers/opl3/opl3_voice.h -@@ -41,7 +41,7 @@ void snd_opl3_timer_func(unsigned long data); - - /* Prototypes for opl3_drums.c */ - void snd_opl3_load_drums(struct snd_opl3 *opl3); --void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int on_off, int vel, struct snd_midi_channel *chan); -+void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int vel, int on_off, struct snd_midi_channel *chan); - - /* Prototypes for opl3_oss.c */ - #ifdef CONFIG_SND_SEQUENCER_OSS -diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c -index b8e2391c33ff..0c7fe1418447 100644 ---- a/sound/isa/sb/sb8.c -+++ b/sound/isa/sb/sb8.c -@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) - - /* block the 0x388 port to avoid PnP conflicts */ - acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); -+ if (!acard->fm_res) { -+ err = -EBUSY; -+ goto _err; -+ } - - if (port[dev] != SNDRV_AUTO_PORT) { - if ((err = snd_sbdsp_create(card, port[dev], irq[dev], -diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c -index 286f5e3686a3..d73ee11a32bd 100644 ---- a/sound/pci/echoaudio/echoaudio.c -+++ b/sound/pci/echoaudio/echoaudio.c -@@ -1953,6 +1953,11 @@ static int snd_echo_create(struct snd_card *card, - } - chip->dsp_registers = (volatile u32 __iomem *) - ioremap_nocache(chip->dsp_registers_phys, sz); -+ if (!chip->dsp_registers) { -+ dev_err(chip->card->dev, "ioremap failed\n"); -+ snd_echo_free(chip); -+ return -ENOMEM; -+ } - - if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, - KBUILD_MODNAME, chip)) { -diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c -index 1b05d1c5d9fd..a32fe14b4687 100644 ---- a/sound/soc/fsl/fsl-asoc-card.c -+++ b/sound/soc/fsl/fsl-asoc-card.c -@@ -659,6 +659,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) - asrc_fail: - of_node_put(asrc_np); - of_node_put(codec_np); -+ put_device(&cpu_pdev->dev); - fail: - of_node_put(cpu_np); - -diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c -index a87836d4de15..40075b9afb79 100644 ---- a/sound/soc/fsl/fsl_esai.c -+++ b/sound/soc/fsl/fsl_esai.c -@@ -57,6 +57,8 @@ struct fsl_esai { - u32 fifo_depth; - u32 slot_width; - u32 slots; -+ u32 tx_mask; -+ u32 rx_mask; - u32 hck_rate[2]; - u32 sck_rate[2]; - bool hck_dir[2]; -@@ -357,21 +359,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask, - regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, - ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); - -- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA, -- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask)); -- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB, -- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask)); -- - regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, - ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); - -- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA, -- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask)); -- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB, -- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask)); -- - esai_priv->slot_width = slot_width; - esai_priv->slots = slots; -+ esai_priv->tx_mask = tx_mask; -+ esai_priv->rx_mask = rx_mask; - - return 0; - } -@@ -582,6 +576,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, - bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; - u8 i, channels = substream->runtime->channels; - u32 pins = DIV_ROUND_UP(channels, esai_priv->slots); -+ u32 mask; - - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: -@@ -594,15 +589,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, - for (i = 0; tx && i < channels; i++) - regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0); - -+ /* -+ * When set the TE/RE in the end of enablement flow, there -+ * will be channel swap issue for multi data line case. -+ * In order to workaround this issue, we switch the bit -+ * enablement sequence to below sequence -+ * 1) clear the xSMB & xSMA: which is done in probe and -+ * stop state. -+ * 2) set TE/RE -+ * 3) set xSMB -+ * 4) set xSMA: xSMA is the last one in this flow, which -+ * will trigger esai to start. -+ */ - regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), - tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, - tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins)); -+ mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask; -+ -+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), -+ ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask)); -+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), -+ ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask)); -+ - break; - case SNDRV_PCM_TRIGGER_SUSPEND: - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_PAUSE_PUSH: - regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), - tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0); -+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), -+ ESAI_xSMA_xS_MASK, 0); -+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), -+ ESAI_xSMB_xS_MASK, 0); - - /* Disable and reset FIFO */ - regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx), -@@ -887,6 +905,15 @@ static int fsl_esai_probe(struct platform_device *pdev) - return ret; - } - -+ esai_priv->tx_mask = 0xFFFFFFFF; -+ esai_priv->rx_mask = 0xFFFFFFFF; -+ -+ /* Clear the TSMA, TSMB, RSMA, RSMB */ -+ regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0); -+ regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0); -+ regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0); -+ regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0); -+ - ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component, - &fsl_esai_dai, 1); - if (ret) { -diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c -index b99e0b5e00e9..8e525f7ac08d 100644 ---- a/sound/soc/fsl/imx-sgtl5000.c -+++ b/sound/soc/fsl/imx-sgtl5000.c -@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) - ret = -EPROBE_DEFER; - goto fail; - } -+ put_device(&ssi_pdev->dev); - codec_dev = of_find_i2c_device_by_node(codec_np); - if (!codec_dev) { - dev_err(&pdev->dev, "failed to find codec platform device\n"); -diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c -index 6e4a10fe9dd0..743746a3c50d 100644 ---- a/tools/lib/traceevent/event-parse.c -+++ b/tools/lib/traceevent/event-parse.c -@@ -2419,7 +2419,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val) - static char *arg_eval (struct print_arg *arg) - { - long long val; -- static char buf[20]; -+ static char buf[24]; - - switch (arg->type) { - case PRINT_ATOM: -diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c -index 47719bde34c6..4e64ba8163bb 100644 ---- a/tools/perf/builtin-top.c -+++ b/tools/perf/builtin-top.c -@@ -1320,8 +1320,9 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused) - symbol_conf.priv_size = sizeof(struct annotation); - - symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL); -- if (symbol__init(NULL) < 0) -- return -1; -+ status = symbol__init(NULL); -+ if (status < 0) -+ goto out_delete_evlist; - - sort__setup_elide(stdout); - -diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c -index da474d743b6a..ea3161170f9e 100644 ---- a/tools/perf/tests/evsel-tp-sched.c -+++ b/tools/perf/tests/evsel-tp-sched.c -@@ -42,7 +42,7 @@ int test__perf_evsel__tp_sched_test(void) - return -1; - } - -- if (perf_evsel__test_field(evsel, "prev_comm", 16, true)) -+ if (perf_evsel__test_field(evsel, "prev_comm", 16, false)) - ret = -1; - - if (perf_evsel__test_field(evsel, "prev_pid", 4, true)) -@@ -54,7 +54,7 @@ int test__perf_evsel__tp_sched_test(void) - if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true)) - ret = -1; - -- if (perf_evsel__test_field(evsel, "next_comm", 16, true)) -+ if (perf_evsel__test_field(evsel, "next_comm", 16, false)) - ret = -1; - - if (perf_evsel__test_field(evsel, "next_pid", 4, true)) -@@ -72,7 +72,7 @@ int test__perf_evsel__tp_sched_test(void) - return -1; - } - -- if (perf_evsel__test_field(evsel, "comm", 16, true)) -+ if (perf_evsel__test_field(evsel, "comm", 16, false)) - ret = -1; - - if (perf_evsel__test_field(evsel, "pid", 4, true)) -@@ -84,5 +84,6 @@ int test__perf_evsel__tp_sched_test(void) - if (perf_evsel__test_field(evsel, "target_cpu", 4, true)) - ret = -1; - -+ perf_evsel__delete(evsel); - return ret; - } -diff --git a/tools/perf/tests/openat-syscall-all-cpus.c b/tools/perf/tests/openat-syscall-all-cpus.c -index 2006485a2859..3848d5ab378d 100644 ---- a/tools/perf/tests/openat-syscall-all-cpus.c -+++ b/tools/perf/tests/openat-syscall-all-cpus.c -@@ -35,7 +35,7 @@ int test__openat_syscall_event_on_all_cpus(void) - if (IS_ERR(evsel)) { - tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "syscalls", "sys_enter_openat"); - pr_debug("%s\n", errbuf); -- goto out_thread_map_delete; -+ goto out_cpu_map_delete; - } - - if (perf_evsel__open(evsel, cpus, threads) < 0) { -@@ -109,6 +109,8 @@ out_close_fd: - perf_evsel__close_fd(evsel, 1, threads->nr); - out_evsel_delete: - perf_evsel__delete(evsel); -+out_cpu_map_delete: -+ cpu_map__put(cpus); - out_thread_map_delete: - thread_map__put(threads); - return err; -diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c -index f0bd4825f95a..97fde9275f42 100644 ---- a/tools/perf/util/evsel.c -+++ b/tools/perf/util/evsel.c -@@ -1051,6 +1051,7 @@ void perf_evsel__exit(struct perf_evsel *evsel) - { - assert(list_empty(&evsel->node)); - assert(evsel->evlist == NULL); -+ perf_evsel__free_counts(evsel); - perf_evsel__free_fd(evsel); - perf_evsel__free_id(evsel); - perf_evsel__free_config_terms(evsel); -diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c -index 33c79e415075..532e7bf06868 100644 ---- a/tools/power/x86/turbostat/turbostat.c -+++ b/tools/power/x86/turbostat/turbostat.c -@@ -3089,6 +3089,9 @@ int fork_it(char **argv) - signal(SIGQUIT, SIG_IGN); - if (waitpid(child_pid, &status, 0) == -1) - err(status, "waitpid"); -+ -+ if (WIFEXITED(status)) -+ status = WEXITSTATUS(status); - } - /* - * n.b. fork_it() does not check for errors from for_all_cpus() diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.179-180.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.179-180.patch deleted file mode 100644 index d147c7679877..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.179-180.patch +++ /dev/null @@ -1,5154 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index 50f95689ab38..e4cd3be77663 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -277,6 +277,8 @@ What: /sys/devices/system/cpu/vulnerabilities - /sys/devices/system/cpu/vulnerabilities/spectre_v1 - /sys/devices/system/cpu/vulnerabilities/spectre_v2 - /sys/devices/system/cpu/vulnerabilities/spec_store_bypass -+ /sys/devices/system/cpu/vulnerabilities/l1tf -+ /sys/devices/system/cpu/vulnerabilities/mds - Date: January 2018 - Contact: Linux kernel mailing list - Description: Information about CPU vulnerabilities -diff --git a/Documentation/hw-vuln/mds.rst b/Documentation/hw-vuln/mds.rst -new file mode 100644 -index 000000000000..3f92728be021 ---- /dev/null -+++ b/Documentation/hw-vuln/mds.rst -@@ -0,0 +1,305 @@ -+MDS - Microarchitectural Data Sampling -+====================================== -+ -+Microarchitectural Data Sampling is a hardware vulnerability which allows -+unprivileged speculative access to data which is available in various CPU -+internal buffers. -+ -+Affected processors -+------------------- -+ -+This vulnerability affects a wide range of Intel processors. The -+vulnerability is not present on: -+ -+ - Processors from AMD, Centaur and other non Intel vendors -+ -+ - Older processor models, where the CPU family is < 6 -+ -+ - Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus) -+ -+ - Intel processors which have the ARCH_CAP_MDS_NO bit set in the -+ IA32_ARCH_CAPABILITIES MSR. -+ -+Whether a processor is affected or not can be read out from the MDS -+vulnerability file in sysfs. See :ref:`mds_sys_info`. -+ -+Not all processors are affected by all variants of MDS, but the mitigation -+is identical for all of them so the kernel treats them as a single -+vulnerability. -+ -+Related CVEs -+------------ -+ -+The following CVE entries are related to the MDS vulnerability: -+ -+ ============== ===== =================================================== -+ CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling -+ CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling -+ CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling -+ CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory -+ ============== ===== =================================================== -+ -+Problem -+------- -+ -+When performing store, load, L1 refill operations, processors write data -+into temporary microarchitectural structures (buffers). The data in the -+buffer can be forwarded to load operations as an optimization. -+ -+Under certain conditions, usually a fault/assist caused by a load -+operation, data unrelated to the load memory address can be speculatively -+forwarded from the buffers. Because the load operation causes a fault or -+assist and its result will be discarded, the forwarded data will not cause -+incorrect program execution or state changes. But a malicious operation -+may be able to forward this speculative data to a disclosure gadget which -+allows in turn to infer the value via a cache side channel attack. -+ -+Because the buffers are potentially shared between Hyper-Threads cross -+Hyper-Thread attacks are possible. -+ -+Deeper technical information is available in the MDS specific x86 -+architecture section: :ref:`Documentation/x86/mds.rst `. -+ -+ -+Attack scenarios -+---------------- -+ -+Attacks against the MDS vulnerabilities can be mounted from malicious non -+priviledged user space applications running on hosts or guest. Malicious -+guest OSes can obviously mount attacks as well. -+ -+Contrary to other speculation based vulnerabilities the MDS vulnerability -+does not allow the attacker to control the memory target address. As a -+consequence the attacks are purely sampling based, but as demonstrated with -+the TLBleed attack samples can be postprocessed successfully. -+ -+Web-Browsers -+^^^^^^^^^^^^ -+ -+ It's unclear whether attacks through Web-Browsers are possible at -+ all. The exploitation through Java-Script is considered very unlikely, -+ but other widely used web technologies like Webassembly could possibly be -+ abused. -+ -+ -+.. _mds_sys_info: -+ -+MDS system information -+----------------------- -+ -+The Linux kernel provides a sysfs interface to enumerate the current MDS -+status of the system: whether the system is vulnerable, and which -+mitigations are active. The relevant sysfs file is: -+ -+/sys/devices/system/cpu/vulnerabilities/mds -+ -+The possible values in this file are: -+ -+ .. list-table:: -+ -+ * - 'Not affected' -+ - The processor is not vulnerable -+ * - 'Vulnerable' -+ - The processor is vulnerable, but no mitigation enabled -+ * - 'Vulnerable: Clear CPU buffers attempted, no microcode' -+ - The processor is vulnerable but microcode is not updated. -+ -+ The mitigation is enabled on a best effort basis. See :ref:`vmwerv` -+ * - 'Mitigation: Clear CPU buffers' -+ - The processor is vulnerable and the CPU buffer clearing mitigation is -+ enabled. -+ -+If the processor is vulnerable then the following information is appended -+to the above information: -+ -+ ======================== ============================================ -+ 'SMT vulnerable' SMT is enabled -+ 'SMT mitigated' SMT is enabled and mitigated -+ 'SMT disabled' SMT is disabled -+ 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown -+ ======================== ============================================ -+ -+.. _vmwerv: -+ -+Best effort mitigation mode -+^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ If the processor is vulnerable, but the availability of the microcode based -+ mitigation mechanism is not advertised via CPUID the kernel selects a best -+ effort mitigation mode. This mode invokes the mitigation instructions -+ without a guarantee that they clear the CPU buffers. -+ -+ This is done to address virtualization scenarios where the host has the -+ microcode update applied, but the hypervisor is not yet updated to expose -+ the CPUID to the guest. If the host has updated microcode the protection -+ takes effect otherwise a few cpu cycles are wasted pointlessly. -+ -+ The state in the mds sysfs file reflects this situation accordingly. -+ -+ -+Mitigation mechanism -+------------------------- -+ -+The kernel detects the affected CPUs and the presence of the microcode -+which is required. -+ -+If a CPU is affected and the microcode is available, then the kernel -+enables the mitigation by default. The mitigation can be controlled at boot -+time via a kernel command line option. See -+:ref:`mds_mitigation_control_command_line`. -+ -+.. _cpu_buffer_clear: -+ -+CPU buffer clearing -+^^^^^^^^^^^^^^^^^^^ -+ -+ The mitigation for MDS clears the affected CPU buffers on return to user -+ space and when entering a guest. -+ -+ If SMT is enabled it also clears the buffers on idle entry when the CPU -+ is only affected by MSBDS and not any other MDS variant, because the -+ other variants cannot be protected against cross Hyper-Thread attacks. -+ -+ For CPUs which are only affected by MSBDS the user space, guest and idle -+ transition mitigations are sufficient and SMT is not affected. -+ -+.. _virt_mechanism: -+ -+Virtualization mitigation -+^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ The protection for host to guest transition depends on the L1TF -+ vulnerability of the CPU: -+ -+ - CPU is affected by L1TF: -+ -+ If the L1D flush mitigation is enabled and up to date microcode is -+ available, the L1D flush mitigation is automatically protecting the -+ guest transition. -+ -+ If the L1D flush mitigation is disabled then the MDS mitigation is -+ invoked explicit when the host MDS mitigation is enabled. -+ -+ For details on L1TF and virtualization see: -+ :ref:`Documentation/hw-vuln//l1tf.rst `. -+ -+ - CPU is not affected by L1TF: -+ -+ CPU buffers are flushed before entering the guest when the host MDS -+ mitigation is enabled. -+ -+ The resulting MDS protection matrix for the host to guest transition: -+ -+ ============ ===== ============= ============ ================= -+ L1TF MDS VMX-L1FLUSH Host MDS MDS-State -+ -+ Don't care No Don't care N/A Not affected -+ -+ Yes Yes Disabled Off Vulnerable -+ -+ Yes Yes Disabled Full Mitigated -+ -+ Yes Yes Enabled Don't care Mitigated -+ -+ No Yes N/A Off Vulnerable -+ -+ No Yes N/A Full Mitigated -+ ============ ===== ============= ============ ================= -+ -+ This only covers the host to guest transition, i.e. prevents leakage from -+ host to guest, but does not protect the guest internally. Guests need to -+ have their own protections. -+ -+.. _xeon_phi: -+ -+XEON PHI specific considerations -+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ The XEON PHI processor family is affected by MSBDS which can be exploited -+ cross Hyper-Threads when entering idle states. Some XEON PHI variants allow -+ to use MWAIT in user space (Ring 3) which opens an potential attack vector -+ for malicious user space. The exposure can be disabled on the kernel -+ command line with the 'ring3mwait=disable' command line option. -+ -+ XEON PHI is not affected by the other MDS variants and MSBDS is mitigated -+ before the CPU enters a idle state. As XEON PHI is not affected by L1TF -+ either disabling SMT is not required for full protection. -+ -+.. _mds_smt_control: -+ -+SMT control -+^^^^^^^^^^^ -+ -+ All MDS variants except MSBDS can be attacked cross Hyper-Threads. That -+ means on CPUs which are affected by MFBDS or MLPDS it is necessary to -+ disable SMT for full protection. These are most of the affected CPUs; the -+ exception is XEON PHI, see :ref:`xeon_phi`. -+ -+ Disabling SMT can have a significant performance impact, but the impact -+ depends on the type of workloads. -+ -+ See the relevant chapter in the L1TF mitigation documentation for details: -+ :ref:`Documentation/hw-vuln/l1tf.rst `. -+ -+ -+.. _mds_mitigation_control_command_line: -+ -+Mitigation control on the kernel command line -+--------------------------------------------- -+ -+The kernel command line allows to control the MDS mitigations at boot -+time with the option "mds=". The valid arguments for this option are: -+ -+ ============ ============================================================= -+ full If the CPU is vulnerable, enable all available mitigations -+ for the MDS vulnerability, CPU buffer clearing on exit to -+ userspace and when entering a VM. Idle transitions are -+ protected as well if SMT is enabled. -+ -+ It does not automatically disable SMT. -+ -+ off Disables MDS mitigations completely. -+ -+ ============ ============================================================= -+ -+Not specifying this option is equivalent to "mds=full". -+ -+ -+Mitigation selection guide -+-------------------------- -+ -+1. Trusted userspace -+^^^^^^^^^^^^^^^^^^^^ -+ -+ If all userspace applications are from a trusted source and do not -+ execute untrusted code which is supplied externally, then the mitigation -+ can be disabled. -+ -+ -+2. Virtualization with trusted guests -+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ The same considerations as above versus trusted user space apply. -+ -+3. Virtualization with untrusted guests -+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ The protection depends on the state of the L1TF mitigations. -+ See :ref:`virt_mechanism`. -+ -+ If the MDS mitigation is enabled and SMT is disabled, guest to host and -+ guest to guest attacks are prevented. -+ -+.. _mds_default_mitigations: -+ -+Default mitigations -+------------------- -+ -+ The kernel default mitigations for vulnerable processors are: -+ -+ - Enable CPU buffer clearing -+ -+ The kernel does not by default enforce the disabling of SMT, which leaves -+ SMT systems vulnerable when running untrusted code. The same rationale as -+ for L1TF applies. -+ See :ref:`Documentation/hw-vuln//l1tf.rst `. -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index da515c535e62..175d57049168 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2035,6 +2035,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - Format: , - Specifies range of consoles to be captured by the MDA. - -+ mds= [X86,INTEL] -+ Control mitigation for the Micro-architectural Data -+ Sampling (MDS) vulnerability. -+ -+ Certain CPUs are vulnerable to an exploit against CPU -+ internal buffers which can forward information to a -+ disclosure gadget under certain conditions. -+ -+ In vulnerable processors, the speculatively -+ forwarded data can be used in a cache side channel -+ attack, to access data to which the attacker does -+ not have direct access. -+ -+ This parameter controls the MDS mitigation. The -+ options are: -+ -+ full - Enable MDS mitigation on vulnerable CPUs -+ off - Unconditionally disable MDS mitigation -+ -+ Not specifying this option is equivalent to -+ mds=full. -+ -+ For details see: Documentation/hw-vuln/mds.rst -+ - mem=nn[KMG] [KNL,BOOT] Force usage of a specific amount of memory - Amount of memory to be used when the kernel is not able - to see the whole system memory or for test. -@@ -2149,6 +2173,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - in the "bleeding edge" mini2440 support kernel at - http://repo.or.cz/w/linux-2.6/mini2440.git - -+ mitigations= -+ [X86] Control optional mitigations for CPU -+ vulnerabilities. This is a set of curated, -+ arch-independent options, each of which is an -+ aggregation of existing arch-specific options. -+ -+ off -+ Disable all optional CPU mitigations. This -+ improves system performance, but it may also -+ expose users to several CPU vulnerabilities. -+ Equivalent to: nopti [X86] -+ nospectre_v2 [X86] -+ spectre_v2_user=off [X86] -+ spec_store_bypass_disable=off [X86] -+ mds=off [X86] -+ -+ auto (default) -+ Mitigate all CPU vulnerabilities, but leave SMT -+ enabled, even if it's vulnerable. This is for -+ users who don't want to be surprised by SMT -+ getting disabled across kernel upgrades, or who -+ have other ways of avoiding SMT-based attacks. -+ Equivalent to: (default behavior) -+ - mminit_loglevel= - [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this - parameter allows control of the logging verbosity for -@@ -2450,7 +2498,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nohugeiomap [KNL,x86] Disable kernel huge I/O mappings. - -- nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2 -+ nospectre_v1 [PPC] Disable mitigations for Spectre Variant 1 (bounds -+ check bypass). With this option data leaks are possible -+ in the system. -+ -+ nospectre_v2 [X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2 - (indirect branch prediction) vulnerability. System may - allow data leaks with this option, which is equivalent - to spectre_v2=off. -@@ -3600,9 +3652,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - spectre_v2= [X86] Control mitigation of Spectre variant 2 - (indirect branch speculation) vulnerability. -+ The default operation protects the kernel from -+ user space attacks. - -- on - unconditionally enable -- off - unconditionally disable -+ on - unconditionally enable, implies -+ spectre_v2_user=on -+ off - unconditionally disable, implies -+ spectre_v2_user=off - auto - kernel detects whether your CPU model is - vulnerable - -@@ -3612,6 +3668,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - CONFIG_RETPOLINE configuration option, and the - compiler with which the kernel was built. - -+ Selecting 'on' will also enable the mitigation -+ against user space to user space task attacks. -+ -+ Selecting 'off' will disable both the kernel and -+ the user space protections. -+ - Specific mitigations can also be selected manually: - - retpoline - replace indirect branches -@@ -3621,6 +3683,48 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - Not specifying this option is equivalent to - spectre_v2=auto. - -+ spectre_v2_user= -+ [X86] Control mitigation of Spectre variant 2 -+ (indirect branch speculation) vulnerability between -+ user space tasks -+ -+ on - Unconditionally enable mitigations. Is -+ enforced by spectre_v2=on -+ -+ off - Unconditionally disable mitigations. Is -+ enforced by spectre_v2=off -+ -+ prctl - Indirect branch speculation is enabled, -+ but mitigation can be enabled via prctl -+ per thread. The mitigation control state -+ is inherited on fork. -+ -+ prctl,ibpb -+ - Like "prctl" above, but only STIBP is -+ controlled per thread. IBPB is issued -+ always when switching between different user -+ space processes. -+ -+ seccomp -+ - Same as "prctl" above, but all seccomp -+ threads will enable the mitigation unless -+ they explicitly opt out. -+ -+ seccomp,ibpb -+ - Like "seccomp" above, but only STIBP is -+ controlled per thread. IBPB is issued -+ always when switching between different -+ user space processes. -+ -+ auto - Kernel selects the mitigation depending on -+ the available CPU features and vulnerability. -+ -+ Default mitigation: -+ If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl" -+ -+ Not specifying this option is equivalent to -+ spectre_v2_user=auto. -+ - spec_store_bypass_disable= - [HW] Control Speculative Store Bypass (SSB) Disable mitigation - (Speculative Store Bypass vulnerability) -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 2fb35658d151..709d24b4b533 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -387,6 +387,7 @@ tcp_min_rtt_wlen - INTEGER - minimum RTT when it is moved to a longer path (e.g., due to traffic - engineering). A longer window makes the filter more resistant to RTT - inflations such as transient congestion. The unit is seconds. -+ Possible values: 0 - 86400 (1 day) - Default: 300 - - tcp_moderate_rcvbuf - BOOLEAN -diff --git a/Documentation/spec_ctrl.txt b/Documentation/spec_ctrl.txt -index 32f3d55c54b7..c4dbe6f7cdae 100644 ---- a/Documentation/spec_ctrl.txt -+++ b/Documentation/spec_ctrl.txt -@@ -92,3 +92,12 @@ Speculation misfeature controls - * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0); - * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); - * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0); -+ -+- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes -+ (Mitigate Spectre V2 style attacks against user processes) -+ -+ Invocations: -+ * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0); -+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0); -+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0); -+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0); -diff --git a/Documentation/usb/power-management.txt b/Documentation/usb/power-management.txt -index 0a94ffe17ab6..b13e031beaa6 100644 ---- a/Documentation/usb/power-management.txt -+++ b/Documentation/usb/power-management.txt -@@ -365,11 +365,15 @@ autosuspend the interface's device. When the usage counter is = 0 - then the interface is considered to be idle, and the kernel may - autosuspend the device. - --Drivers need not be concerned about balancing changes to the usage --counter; the USB core will undo any remaining "get"s when a driver --is unbound from its interface. As a corollary, drivers must not call --any of the usb_autopm_* functions after their disconnect() routine has --returned. -+Drivers must be careful to balance their overall changes to the usage -+counter. Unbalanced "get"s will remain in effect when a driver is -+unbound from its interface, preventing the device from going into -+runtime suspend should the interface be bound to a driver again. On -+the other hand, drivers are allowed to achieve this balance by calling -+the ``usb_autopm_*`` functions even after their ``disconnect`` routine -+has returned -- say from within a work-queue routine -- provided they -+retain an active reference to the interface (via ``usb_get_intf`` and -+``usb_put_intf``). - - Drivers using the async routines are responsible for their own - synchronization and mutual exclusion. -diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst -new file mode 100644 -index 000000000000..534e9baa4e1d ---- /dev/null -+++ b/Documentation/x86/mds.rst -@@ -0,0 +1,225 @@ -+Microarchitectural Data Sampling (MDS) mitigation -+================================================= -+ -+.. _mds: -+ -+Overview -+-------- -+ -+Microarchitectural Data Sampling (MDS) is a family of side channel attacks -+on internal buffers in Intel CPUs. The variants are: -+ -+ - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126) -+ - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130) -+ - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127) -+ - Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091) -+ -+MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a -+dependent load (store-to-load forwarding) as an optimization. The forward -+can also happen to a faulting or assisting load operation for a different -+memory address, which can be exploited under certain conditions. Store -+buffers are partitioned between Hyper-Threads so cross thread forwarding is -+not possible. But if a thread enters or exits a sleep state the store -+buffer is repartitioned which can expose data from one thread to the other. -+ -+MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage -+L1 miss situations and to hold data which is returned or sent in response -+to a memory or I/O operation. Fill buffers can forward data to a load -+operation and also write data to the cache. When the fill buffer is -+deallocated it can retain the stale data of the preceding operations which -+can then be forwarded to a faulting or assisting load operation, which can -+be exploited under certain conditions. Fill buffers are shared between -+Hyper-Threads so cross thread leakage is possible. -+ -+MLPDS leaks Load Port Data. Load ports are used to perform load operations -+from memory or I/O. The received data is then forwarded to the register -+file or a subsequent operation. In some implementations the Load Port can -+contain stale data from a previous operation which can be forwarded to -+faulting or assisting loads under certain conditions, which again can be -+exploited eventually. Load ports are shared between Hyper-Threads so cross -+thread leakage is possible. -+ -+MDSUM is a special case of MSBDS, MFBDS and MLPDS. An uncacheable load from -+memory that takes a fault or assist can leave data in a microarchitectural -+structure that may later be observed using one of the same methods used by -+MSBDS, MFBDS or MLPDS. -+ -+Exposure assumptions -+-------------------- -+ -+It is assumed that attack code resides in user space or in a guest with one -+exception. The rationale behind this assumption is that the code construct -+needed for exploiting MDS requires: -+ -+ - to control the load to trigger a fault or assist -+ -+ - to have a disclosure gadget which exposes the speculatively accessed -+ data for consumption through a side channel. -+ -+ - to control the pointer through which the disclosure gadget exposes the -+ data -+ -+The existence of such a construct in the kernel cannot be excluded with -+100% certainty, but the complexity involved makes it extremly unlikely. -+ -+There is one exception, which is untrusted BPF. The functionality of -+untrusted BPF is limited, but it needs to be thoroughly investigated -+whether it can be used to create such a construct. -+ -+ -+Mitigation strategy -+------------------- -+ -+All variants have the same mitigation strategy at least for the single CPU -+thread case (SMT off): Force the CPU to clear the affected buffers. -+ -+This is achieved by using the otherwise unused and obsolete VERW -+instruction in combination with a microcode update. The microcode clears -+the affected CPU buffers when the VERW instruction is executed. -+ -+For virtualization there are two ways to achieve CPU buffer -+clearing. Either the modified VERW instruction or via the L1D Flush -+command. The latter is issued when L1TF mitigation is enabled so the extra -+VERW can be avoided. If the CPU is not affected by L1TF then VERW needs to -+be issued. -+ -+If the VERW instruction with the supplied segment selector argument is -+executed on a CPU without the microcode update there is no side effect -+other than a small number of pointlessly wasted CPU cycles. -+ -+This does not protect against cross Hyper-Thread attacks except for MSBDS -+which is only exploitable cross Hyper-thread when one of the Hyper-Threads -+enters a C-state. -+ -+The kernel provides a function to invoke the buffer clearing: -+ -+ mds_clear_cpu_buffers() -+ -+The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state -+(idle) transitions. -+ -+As a special quirk to address virtualization scenarios where the host has -+the microcode updated, but the hypervisor does not (yet) expose the -+MD_CLEAR CPUID bit to guests, the kernel issues the VERW instruction in the -+hope that it might actually clear the buffers. The state is reflected -+accordingly. -+ -+According to current knowledge additional mitigations inside the kernel -+itself are not required because the necessary gadgets to expose the leaked -+data cannot be controlled in a way which allows exploitation from malicious -+user space or VM guests. -+ -+Kernel internal mitigation modes -+-------------------------------- -+ -+ ======= ============================================================ -+ off Mitigation is disabled. Either the CPU is not affected or -+ mds=off is supplied on the kernel command line -+ -+ full Mitigation is enabled. CPU is affected and MD_CLEAR is -+ advertised in CPUID. -+ -+ vmwerv Mitigation is enabled. CPU is affected and MD_CLEAR is not -+ advertised in CPUID. That is mainly for virtualization -+ scenarios where the host has the updated microcode but the -+ hypervisor does not expose MD_CLEAR in CPUID. It's a best -+ effort approach without guarantee. -+ ======= ============================================================ -+ -+If the CPU is affected and mds=off is not supplied on the kernel command -+line then the kernel selects the appropriate mitigation mode depending on -+the availability of the MD_CLEAR CPUID bit. -+ -+Mitigation points -+----------------- -+ -+1. Return to user space -+^^^^^^^^^^^^^^^^^^^^^^^ -+ -+ When transitioning from kernel to user space the CPU buffers are flushed -+ on affected CPUs when the mitigation is not disabled on the kernel -+ command line. The migitation is enabled through the static key -+ mds_user_clear. -+ -+ The mitigation is invoked in prepare_exit_to_usermode() which covers -+ most of the kernel to user space transitions. There are a few exceptions -+ which are not invoking prepare_exit_to_usermode() on return to user -+ space. These exceptions use the paranoid exit code. -+ -+ - Non Maskable Interrupt (NMI): -+ -+ Access to sensible data like keys, credentials in the NMI context is -+ mostly theoretical: The CPU can do prefetching or execute a -+ misspeculated code path and thereby fetching data which might end up -+ leaking through a buffer. -+ -+ But for mounting other attacks the kernel stack address of the task is -+ already valuable information. So in full mitigation mode, the NMI is -+ mitigated on the return from do_nmi() to provide almost complete -+ coverage. -+ -+ - Double fault (#DF): -+ -+ A double fault is usually fatal, but the ESPFIX workaround, which can -+ be triggered from user space through modify_ldt(2) is a recoverable -+ double fault. #DF uses the paranoid exit path, so explicit mitigation -+ in the double fault handler is required. -+ -+ - Machine Check Exception (#MC): -+ -+ Another corner case is a #MC which hits between the CPU buffer clear -+ invocation and the actual return to user. As this still is in kernel -+ space it takes the paranoid exit path which does not clear the CPU -+ buffers. So the #MC handler repopulates the buffers to some -+ extent. Machine checks are not reliably controllable and the window is -+ extremly small so mitigation would just tick a checkbox that this -+ theoretical corner case is covered. To keep the amount of special -+ cases small, ignore #MC. -+ -+ - Debug Exception (#DB): -+ -+ This takes the paranoid exit path only when the INT1 breakpoint is in -+ kernel space. #DB on a user space address takes the regular exit path, -+ so no extra mitigation required. -+ -+ -+2. C-State transition -+^^^^^^^^^^^^^^^^^^^^^ -+ -+ When a CPU goes idle and enters a C-State the CPU buffers need to be -+ cleared on affected CPUs when SMT is active. This addresses the -+ repartitioning of the store buffer when one of the Hyper-Threads enters -+ a C-State. -+ -+ When SMT is inactive, i.e. either the CPU does not support it or all -+ sibling threads are offline CPU buffer clearing is not required. -+ -+ The idle clearing is enabled on CPUs which are only affected by MSBDS -+ and not by any other MDS variant. The other MDS variants cannot be -+ protected against cross Hyper-Thread attacks because the Fill Buffer and -+ the Load Ports are shared. So on CPUs affected by other variants, the -+ idle clearing would be a window dressing exercise and is therefore not -+ activated. -+ -+ The invocation is controlled by the static key mds_idle_clear which is -+ switched depending on the chosen mitigation mode and the SMT state of -+ the system. -+ -+ The buffer clear is only invoked before entering the C-State to prevent -+ that stale data from the idling CPU from spilling to the Hyper-Thread -+ sibling after the store buffer got repartitioned and all entries are -+ available to the non idle sibling. -+ -+ When coming out of idle the store buffer is partitioned again so each -+ sibling has half of it available. The back from idle CPU could be then -+ speculatively exposed to contents of the sibling. The buffers are -+ flushed either on exit to user space or on VMENTER so malicious code -+ in user space or the guest cannot speculatively access them. -+ -+ The mitigation is hooked into all variants of halt()/mwait(), but does -+ not cover the legacy ACPI IO-Port mechanism because the ACPI idle driver -+ has been superseded by the intel_idle driver around 2010 and is -+ preferred on all affected CPUs which are expected to gain the MD_CLEAR -+ functionality in microcode. Aside of that the IO-Port mechanism is a -+ legacy interface which is only used on older systems which are either -+ not affected or do not receive microcode updates anymore. -diff --git a/Makefile b/Makefile -index ee0a50b871b9..6023a9dbad59 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 179 -+SUBLEVEL = 180 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -index d6d98d426384..cae04e806036 100644 ---- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi -@@ -90,6 +90,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_enet>; - phy-mode = "rgmii"; -+ phy-reset-duration = <10>; /* in msecs */ - phy-reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>; - phy-supply = <&vdd_eth_io_reg>; - status = "disabled"; -diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c -index 53c316f7301e..fe4932fda01d 100644 ---- a/arch/arm/mach-iop13xx/setup.c -+++ b/arch/arm/mach-iop13xx/setup.c -@@ -300,7 +300,7 @@ static struct resource iop13xx_adma_2_resources[] = { - } - }; - --static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(64); -+static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(32); - static struct iop_adma_platform_data iop13xx_adma_0_data = { - .hw_id = 0, - .pool_size = PAGE_SIZE, -@@ -324,7 +324,7 @@ static struct platform_device iop13xx_adma_0_channel = { - .resource = iop13xx_adma_0_resources, - .dev = { - .dma_mask = &iop13xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop13xx_adma_0_data, - }, - }; -@@ -336,7 +336,7 @@ static struct platform_device iop13xx_adma_1_channel = { - .resource = iop13xx_adma_1_resources, - .dev = { - .dma_mask = &iop13xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop13xx_adma_1_data, - }, - }; -@@ -348,7 +348,7 @@ static struct platform_device iop13xx_adma_2_channel = { - .resource = iop13xx_adma_2_resources, - .dev = { - .dma_mask = &iop13xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop13xx_adma_2_data, - }, - }; -diff --git a/arch/arm/mach-iop13xx/tpmi.c b/arch/arm/mach-iop13xx/tpmi.c -index db511ec2b1df..116feb6b261e 100644 ---- a/arch/arm/mach-iop13xx/tpmi.c -+++ b/arch/arm/mach-iop13xx/tpmi.c -@@ -152,7 +152,7 @@ static struct resource iop13xx_tpmi_3_resources[] = { - } - }; - --u64 iop13xx_tpmi_mask = DMA_BIT_MASK(64); -+u64 iop13xx_tpmi_mask = DMA_BIT_MASK(32); - static struct platform_device iop13xx_tpmi_0_device = { - .name = "iop-tpmi", - .id = 0, -@@ -160,7 +160,7 @@ static struct platform_device iop13xx_tpmi_0_device = { - .resource = iop13xx_tpmi_0_resources, - .dev = { - .dma_mask = &iop13xx_tpmi_mask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - }, - }; - -@@ -171,7 +171,7 @@ static struct platform_device iop13xx_tpmi_1_device = { - .resource = iop13xx_tpmi_1_resources, - .dev = { - .dma_mask = &iop13xx_tpmi_mask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - }, - }; - -@@ -182,7 +182,7 @@ static struct platform_device iop13xx_tpmi_2_device = { - .resource = iop13xx_tpmi_2_resources, - .dev = { - .dma_mask = &iop13xx_tpmi_mask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - }, - }; - -@@ -193,7 +193,7 @@ static struct platform_device iop13xx_tpmi_3_device = { - .resource = iop13xx_tpmi_3_resources, - .dev = { - .dma_mask = &iop13xx_tpmi_mask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - }, - }; - -diff --git a/arch/arm/plat-iop/adma.c b/arch/arm/plat-iop/adma.c -index a4d1f8de3b5b..d9612221e484 100644 ---- a/arch/arm/plat-iop/adma.c -+++ b/arch/arm/plat-iop/adma.c -@@ -143,7 +143,7 @@ struct platform_device iop3xx_dma_0_channel = { - .resource = iop3xx_dma_0_resources, - .dev = { - .dma_mask = &iop3xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop3xx_dma_0_data, - }, - }; -@@ -155,7 +155,7 @@ struct platform_device iop3xx_dma_1_channel = { - .resource = iop3xx_dma_1_resources, - .dev = { - .dma_mask = &iop3xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop3xx_dma_1_data, - }, - }; -@@ -167,7 +167,7 @@ struct platform_device iop3xx_aau_channel = { - .resource = iop3xx_aau_resources, - .dev = { - .dma_mask = &iop3xx_adma_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = (void *) &iop3xx_aau_data, - }, - }; -diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c -index 8861c367d061..51c3737ddba7 100644 ---- a/arch/arm/plat-orion/common.c -+++ b/arch/arm/plat-orion/common.c -@@ -645,7 +645,7 @@ static struct platform_device orion_xor0_shared = { - .resource = orion_xor0_shared_resources, - .dev = { - .dma_mask = &orion_xor_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = &orion_xor0_pdata, - }, - }; -@@ -706,7 +706,7 @@ static struct platform_device orion_xor1_shared = { - .resource = orion_xor1_shared_resources, - .dev = { - .dma_mask = &orion_xor_dmamask, -- .coherent_dma_mask = DMA_BIT_MASK(64), -+ .coherent_dma_mask = DMA_BIT_MASK(32), - .platform_data = &orion_xor1_pdata, - }, - }; -diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S -index 87c697181d25..4faff3e77b25 100644 ---- a/arch/mips/kernel/scall64-o32.S -+++ b/arch/mips/kernel/scall64-o32.S -@@ -126,7 +126,7 @@ trace_a_syscall: - subu t1, v0, __NR_O32_Linux - move a1, v0 - bnez t1, 1f /* __NR_syscall at offset 0 */ -- lw a1, PT_R4(sp) /* Arg1 for __NR_syscall case */ -+ ld a1, PT_R4(sp) /* Arg1 for __NR_syscall case */ - .set pop - - 1: jal syscall_trace_enter -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 4598d087dec2..4d1262cf630c 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -893,13 +893,7 @@ config NR_CPUS - approximately eight kilobytes to the kernel image. - - config SCHED_SMT -- bool "SMT (Hyperthreading) scheduler support" -- depends on SMP -- ---help--- -- SMT scheduler support improves the CPU scheduler's decision making -- when dealing with Intel Pentium 4 chips with HyperThreading at a -- cost of slightly increased overhead in some places. If unsure say -- N here. -+ def_bool y if SMP - - config SCHED_MC - def_bool y -diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c -index 071582a3b5c0..57be07f27f37 100644 ---- a/arch/x86/entry/common.c -+++ b/arch/x86/entry/common.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - #define CREATE_TRACE_POINTS - #include -@@ -295,6 +296,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) - #endif - - user_enter(); -+ -+ mds_user_clear_cpu_buffers(); - } - - #define SYSCALL_EXIT_WORK_FLAGS \ -diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c -index 0ad96c647541..7017a81d53cf 100644 ---- a/drivers/ata/libata-zpodd.c -+++ b/drivers/ata/libata-zpodd.c -@@ -51,38 +51,52 @@ static int eject_tray(struct ata_device *dev) - /* Per the spec, only slot type and drawer type ODD can be supported */ - static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev) - { -- char buf[16]; -+ char *buf; - unsigned int ret; -- struct rm_feature_desc *desc = (void *)(buf + 8); -+ struct rm_feature_desc *desc; - struct ata_taskfile tf; - static const char cdb[] = { GPCMD_GET_CONFIGURATION, - 2, /* only 1 feature descriptor requested */ - 0, 3, /* 3, removable medium feature */ - 0, 0, 0,/* reserved */ -- 0, sizeof(buf), -+ 0, 16, - 0, 0, 0, - }; - -+ buf = kzalloc(16, GFP_KERNEL); -+ if (!buf) -+ return ODD_MECH_TYPE_UNSUPPORTED; -+ desc = (void *)(buf + 8); -+ - ata_tf_init(dev, &tf); - tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; - tf.command = ATA_CMD_PACKET; - tf.protocol = ATAPI_PROT_PIO; -- tf.lbam = sizeof(buf); -+ tf.lbam = 16; - - ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE, -- buf, sizeof(buf), 0); -- if (ret) -+ buf, 16, 0); -+ if (ret) { -+ kfree(buf); - return ODD_MECH_TYPE_UNSUPPORTED; -+ } - -- if (be16_to_cpu(desc->feature_code) != 3) -+ if (be16_to_cpu(desc->feature_code) != 3) { -+ kfree(buf); - return ODD_MECH_TYPE_UNSUPPORTED; -+ } - -- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) -+ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) { -+ kfree(buf); - return ODD_MECH_TYPE_SLOT; -- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1) -+ } else if (desc->mech_type == 1 && desc->load == 0 && -+ desc->eject == 1) { -+ kfree(buf); - return ODD_MECH_TYPE_DRAWER; -- else -+ } else { -+ kfree(buf); - return ODD_MECH_TYPE_UNSUPPORTED; -+ } - } - - /* Test if ODD is zero power ready by sense code */ -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index 41090ef5facb..3934aaf9d157 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -530,11 +530,18 @@ ssize_t __weak cpu_show_l1tf(struct device *dev, - return sprintf(buf, "Not affected\n"); - } - -+ssize_t __weak cpu_show_mds(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); - static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); - static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL); - static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL); -+static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -542,6 +549,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_spectre_v2.attr, - &dev_attr_spec_store_bypass.attr, - &dev_attr_l1tf.attr, -+ &dev_attr_mds.attr, - NULL - }; - -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index ae361ee90587..da3902ac16c8 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -82,7 +82,6 @@ - - static DEFINE_IDR(loop_index_idr); - static DEFINE_MUTEX(loop_index_mutex); --static DEFINE_MUTEX(loop_ctl_mutex); - - static int max_part; - static int part_shift; -@@ -1045,7 +1044,7 @@ static int loop_clr_fd(struct loop_device *lo) - */ - if (atomic_read(&lo->lo_refcnt) > 1) { - lo->lo_flags |= LO_FLAGS_AUTOCLEAR; -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - return 0; - } - -@@ -1094,12 +1093,12 @@ static int loop_clr_fd(struct loop_device *lo) - if (!part_shift) - lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN; - loop_unprepare_queue(lo); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - /* -- * Need not hold loop_ctl_mutex to fput backing file. -- * Calling fput holding loop_ctl_mutex triggers a circular -+ * Need not hold lo_ctl_mutex to fput backing file. -+ * Calling fput holding lo_ctl_mutex triggers a circular - * lock dependency possibility warning as fput can take -- * bd_mutex which is usually taken before loop_ctl_mutex. -+ * bd_mutex which is usually taken before lo_ctl_mutex. - */ - fput(filp); - return 0; -@@ -1362,7 +1361,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - struct loop_device *lo = bdev->bd_disk->private_data; - int err; - -- mutex_lock_nested(&loop_ctl_mutex, 1); -+ mutex_lock_nested(&lo->lo_ctl_mutex, 1); - switch (cmd) { - case LOOP_SET_FD: - err = loop_set_fd(lo, mode, bdev, arg); -@@ -1371,7 +1370,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - err = loop_change_fd(lo, bdev, arg); - break; - case LOOP_CLR_FD: -- /* loop_clr_fd would have unlocked loop_ctl_mutex on success */ -+ /* loop_clr_fd would have unlocked lo_ctl_mutex on success */ - err = loop_clr_fd(lo); - if (!err) - goto out_unlocked; -@@ -1407,7 +1406,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, - default: - err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL; - } -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - - out_unlocked: - return err; -@@ -1540,16 +1539,16 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, - - switch(cmd) { - case LOOP_SET_STATUS: -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&lo->lo_ctl_mutex); - err = loop_set_status_compat( - lo, (const struct compat_loop_info __user *) arg); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - break; - case LOOP_GET_STATUS: -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&lo->lo_ctl_mutex); - err = loop_get_status_compat( - lo, (struct compat_loop_info __user *) arg); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - break; - case LOOP_SET_CAPACITY: - case LOOP_CLR_FD: -@@ -1593,7 +1592,7 @@ static void __lo_release(struct loop_device *lo) - if (atomic_dec_return(&lo->lo_refcnt)) - return; - -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&lo->lo_ctl_mutex); - if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) { - /* - * In autoclear mode, stop the loop thread -@@ -1610,7 +1609,7 @@ static void __lo_release(struct loop_device *lo) - loop_flush(lo); - } - -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - } - - static void lo_release(struct gendisk *disk, fmode_t mode) -@@ -1656,10 +1655,10 @@ static int unregister_transfer_cb(int id, void *ptr, void *data) - struct loop_device *lo = ptr; - struct loop_func_table *xfer = data; - -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&lo->lo_ctl_mutex); - if (lo->lo_encryption == xfer) - loop_release_xfer(lo); -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - return 0; - } - -@@ -1821,6 +1820,7 @@ static int loop_add(struct loop_device **l, int i) - if (!part_shift) - disk->flags |= GENHD_FL_NO_PART_SCAN; - disk->flags |= GENHD_FL_EXT_DEVT; -+ mutex_init(&lo->lo_ctl_mutex); - atomic_set(&lo->lo_refcnt, 0); - lo->lo_number = i; - spin_lock_init(&lo->lo_lock); -@@ -1933,19 +1933,19 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd, - ret = loop_lookup(&lo, parm); - if (ret < 0) - break; -- mutex_lock(&loop_ctl_mutex); -+ mutex_lock(&lo->lo_ctl_mutex); - if (lo->lo_state != Lo_unbound) { - ret = -EBUSY; -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - break; - } - if (atomic_read(&lo->lo_refcnt) > 0) { - ret = -EBUSY; -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - break; - } - lo->lo_disk->private_data = NULL; -- mutex_unlock(&loop_ctl_mutex); -+ mutex_unlock(&lo->lo_ctl_mutex); - idr_remove(&loop_index_idr, lo->lo_number); - loop_remove(lo); - break; -diff --git a/drivers/block/loop.h b/drivers/block/loop.h -index a923e74495ce..60f0fd2c0c65 100644 ---- a/drivers/block/loop.h -+++ b/drivers/block/loop.h -@@ -55,6 +55,7 @@ struct loop_device { - - spinlock_t lo_lock; - int lo_state; -+ struct mutex lo_ctl_mutex; - struct kthread_worker worker; - struct task_struct *worker_task; - bool use_dio; -diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c -index c4328d9d9981..f838119d12b2 100644 ---- a/drivers/block/xsysace.c -+++ b/drivers/block/xsysace.c -@@ -1062,6 +1062,8 @@ static int ace_setup(struct ace_device *ace) - return 0; - - err_read: -+ /* prevent double queue cleanup */ -+ ace->gd->queue = NULL; - put_disk(ace->gd); - err_alloc_disk: - blk_cleanup_queue(ace->queue); -diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c -index 98686edbcdbb..33de3a1bac49 100644 ---- a/drivers/gpu/ipu-v3/ipu-dp.c -+++ b/drivers/gpu/ipu-v3/ipu-dp.c -@@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp, - ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs, - DP_COM_CONF_CSC_DEF_BOTH); - } else { -- if (flow->foreground.in_cs == flow->out_cs) -+ if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN || -+ flow->foreground.in_cs == flow->out_cs) - /* - * foreground identical to output, apply color - * conversion on background -@@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp) - struct ipu_dp_priv *priv = flow->priv; - u32 reg, csc; - -+ dp->in_cs = IPUV3_COLORSPACE_UNKNOWN; -+ - if (!dp->foreground) - return; - -@@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp) - - reg = readl(flow->base + DP_COM_CONF); - csc = reg & DP_COM_CONF_CSC_DEF_MASK; -- if (csc == DP_COM_CONF_CSC_DEF_FG) -- reg &= ~DP_COM_CONF_CSC_DEF_MASK; -+ reg &= ~DP_COM_CONF_CSC_DEF_MASK; -+ if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG) -+ reg |= DP_COM_CONF_CSC_DEF_BG; - - reg &= ~DP_COM_CONF_FG_EN; - writel(reg, flow->base + DP_COM_CONF); -@@ -350,6 +354,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base) - mutex_init(&priv->mutex); - - for (i = 0; i < IPUV3_NUM_FLOWS; i++) { -+ priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN; -+ priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN; - priv->flow[i].foreground.foreground = true; - priv->flow[i].base = priv->base + ipu_dp_flow_base[i]; - priv->flow[i].priv = priv; -diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c -index d7179dd3c9ef..3cafa1d28fed 100644 ---- a/drivers/hid/hid-debug.c -+++ b/drivers/hid/hid-debug.c -@@ -1058,10 +1058,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p) - seq_printf(f, "\n\n"); - - /* dump parsed data and input mappings */ -+ if (down_interruptible(&hdev->driver_input_lock)) -+ return 0; -+ - hid_dump_device(hdev, f); - seq_printf(f, "\n"); - hid_dump_input_mapping(hdev, f); - -+ up(&hdev->driver_input_lock); -+ - return 0; - } - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 8d74e691ac90..ee3c66c02043 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -783,6 +783,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case 0x074: map_key_clear(KEY_BRIGHTNESS_MAX); break; - case 0x075: map_key_clear(KEY_BRIGHTNESS_AUTO); break; - -+ case 0x079: map_key_clear(KEY_KBDILLUMUP); break; -+ case 0x07a: map_key_clear(KEY_KBDILLUMDOWN); break; -+ case 0x07c: map_key_clear(KEY_KBDILLUMTOGGLE); break; -+ - case 0x082: map_key_clear(KEY_VIDEO_NEXT); break; - case 0x083: map_key_clear(KEY_LAST); break; - case 0x084: map_key_clear(KEY_ENTER); break; -@@ -913,6 +917,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT); break; - case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL); break; - -+ case 0x29f: map_key_clear(KEY_SCALE); break; -+ - default: map_key_clear(KEY_UNKNOWN); - } - break; -diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c -index eb43943cdf07..189eb6269971 100644 ---- a/drivers/hwtracing/intel_th/gth.c -+++ b/drivers/hwtracing/intel_th/gth.c -@@ -597,7 +597,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, - othdev->output.port = -1; - othdev->output.active = false; - gth->output[port].output = NULL; -- for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++) -+ for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++) - if (gth->master[master] == port) - gth->master[master] = -1; - spin_unlock(>h->gth_lock); -diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c -index 475c5a74f2d1..6398e86a272b 100644 ---- a/drivers/iio/adc/xilinx-xadc-core.c -+++ b/drivers/iio/adc/xilinx-xadc-core.c -@@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev) - } - free_irq(irq, indio_dev); - clk_disable_unprepare(xadc->clk); -- cancel_delayed_work(&xadc->zynq_unmask_work); -+ cancel_delayed_work_sync(&xadc->zynq_unmask_work); - kfree(xadc->data); - kfree(indio_dev->channels); - -diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c -index 9adf13a5864a..57143365e945 100644 ---- a/drivers/input/keyboard/snvs_pwrkey.c -+++ b/drivers/input/keyboard/snvs_pwrkey.c -@@ -156,6 +156,9 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev) - return error; - } - -+ pdata->input = input; -+ platform_set_drvdata(pdev, pdata); -+ - error = devm_request_irq(&pdev->dev, pdata->irq, - imx_snvs_pwrkey_interrupt, - 0, pdev->name, pdev); -@@ -172,9 +175,6 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev) - return error; - } - -- pdata->input = input; -- platform_set_drvdata(pdev, pdata); -- - device_init_wakeup(&pdev->dev, pdata->wakeup); - - return 0; -diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c -index 94f1bf772ec9..db85cc5791dc 100644 ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -295,7 +295,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val) - static void iommu_set_exclusion_range(struct amd_iommu *iommu) - { - u64 start = iommu->exclusion_start & PAGE_MASK; -- u64 limit = (start + iommu->exclusion_length) & PAGE_MASK; -+ u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK; - u64 entry; - - if (!iommu->exclusion_start) -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 5e65dc6def7e..17517889d46b 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3897,26 +3897,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh, - case check_state_check_result: - sh->check_state = check_state_idle; - -+ if (s->failed > 1) -+ break; - /* handle a successful check operation, if parity is correct - * we are done. Otherwise update the mismatch count and repair - * parity if !MD_RECOVERY_CHECK - */ - if (sh->ops.zero_sum_result == 0) { -- /* both parities are correct */ -- if (!s->failed) -- set_bit(STRIPE_INSYNC, &sh->state); -- else { -- /* in contrast to the raid5 case we can validate -- * parity, but still have a failure to write -- * back -- */ -- sh->check_state = check_state_compute_result; -- /* Returning at this point means that we may go -- * off and bring p and/or q uptodate again so -- * we make sure to check zero_sum_result again -- * to verify if p or q need writeback -- */ -- } -+ /* Any parity checked was correct */ -+ set_bit(STRIPE_INSYNC, &sh->state); - } else { - atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches); - if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) -diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c -index e1b5dc84c14e..24a0c21a3d8d 100644 ---- a/drivers/media/i2c/ov7670.c -+++ b/drivers/media/i2c/ov7670.c -@@ -155,10 +155,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-1)"); - #define REG_GFIX 0x69 /* Fix gain control */ - - #define REG_DBLV 0x6b /* PLL control an debugging */ --#define DBLV_BYPASS 0x00 /* Bypass PLL */ --#define DBLV_X4 0x01 /* clock x4 */ --#define DBLV_X6 0x10 /* clock x6 */ --#define DBLV_X8 0x11 /* clock x8 */ -+#define DBLV_BYPASS 0x0a /* Bypass PLL */ -+#define DBLV_X4 0x4a /* clock x4 */ -+#define DBLV_X6 0x8a /* clock x6 */ -+#define DBLV_X8 0xca /* clock x8 */ - - #define REG_REG76 0x76 /* OV's name */ - #define R76_BLKPCOR 0x80 /* Black pixel correction enable */ -@@ -833,7 +833,7 @@ static int ov7675_set_framerate(struct v4l2_subdev *sd, - if (ret < 0) - return ret; - -- return ov7670_write(sd, REG_DBLV, DBLV_X4); -+ return 0; - } - - static void ov7670_get_framerate_legacy(struct v4l2_subdev *sd, -@@ -1578,11 +1578,7 @@ static int ov7670_probe(struct i2c_client *client, - if (config->clock_speed) - info->clock_speed = config->clock_speed; - -- /* -- * It should be allowed for ov7670 too when it is migrated to -- * the new frame rate formula. -- */ -- if (config->pll_bypass && id->driver_data != MODEL_OV7670) -+ if (config->pll_bypass) - info->pll_bypass = true; - - if (config->pclk_hb_disable) -diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c -index 66560a8fcfa2..1022e80aaf97 100644 ---- a/drivers/net/bonding/bond_options.c -+++ b/drivers/net/bonding/bond_options.c -@@ -1066,13 +1066,6 @@ static int bond_option_arp_validate_set(struct bonding *bond, - { - netdev_info(bond->dev, "Setting arp_validate to %s (%llu)\n", - newval->string, newval->value); -- -- if (bond->dev->flags & IFF_UP) { -- if (!newval->value) -- bond->recv_probe = NULL; -- else if (bond->params.arp_interval) -- bond->recv_probe = bond_arp_rcv; -- } - bond->params.arp_validate = newval->value; - - return 0; -diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c -index 7d16c51e6913..641a532b67cb 100644 ---- a/drivers/net/bonding/bond_sysfs_slave.c -+++ b/drivers/net/bonding/bond_sysfs_slave.c -@@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count); - - static ssize_t perm_hwaddr_show(struct slave *slave, char *buf) - { -- return sprintf(buf, "%pM\n", slave->perm_hwaddr); -+ return sprintf(buf, "%*phC\n", -+ slave->dev->addr_len, -+ slave->perm_hwaddr); - } - static SLAVE_ATTR_RO(perm_hwaddr); - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 00bd7be85679..d9ab970dcbe9 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -4957,8 +4957,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp) - - skip_uc: - rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); -+ if (rc && vnic->mc_list_count) { -+ netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n", -+ rc); -+ vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST; -+ vnic->mc_list_count = 0; -+ rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0); -+ } - if (rc) -- netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n", -+ netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n", - rc); - - return rc; -diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c -index 89714f5e0dfc..c8b9a73d6b1b 100644 ---- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c -+++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c -@@ -253,14 +253,12 @@ uec_set_ringparam(struct net_device *netdev, - return -EINVAL; - } - -+ if (netif_running(netdev)) -+ return -EBUSY; -+ - ug_info->bdRingLenRx[queue] = ring->rx_pending; - ug_info->bdRingLenTx[queue] = ring->tx_pending; - -- if (netif_running(netdev)) { -- /* FIXME: restart automatically */ -- netdev_info(netdev, "Please re-open the interface\n"); -- } -- - return ret; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c -index b3645297477e..3ce41efe8a94 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hnae.c -+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c -@@ -144,7 +144,6 @@ out_buffer_fail: - /* free desc along with its attached buffer */ - static void hnae_free_desc(struct hnae_ring *ring) - { -- hnae_free_buffers(ring); - dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr, - ring->desc_num * sizeof(ring->desc[0]), - ring_to_dma_dir(ring)); -@@ -177,6 +176,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring) - /* fini ring, also free the buffer for the ring */ - static void hnae_fini_ring(struct hnae_ring *ring) - { -+ if (is_rx_ring(ring)) -+ hnae_free_buffers(ring); -+ - hnae_free_desc(ring); - kfree(ring->desc_cb); - ring->desc_cb = NULL; -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -index 2fa54b0b0679..6d649e7b45a9 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -@@ -28,9 +28,6 @@ - - #define SERVICE_TIMER_HZ (1 * HZ) - --#define NIC_TX_CLEAN_MAX_NUM 256 --#define NIC_RX_CLEAN_MAX_NUM 64 -- - #define RCB_IRQ_NOT_INITED 0 - #define RCB_IRQ_INITED 1 - -@@ -1408,7 +1405,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv) - rd->fini_process = hns_nic_tx_fini_pro; - - netif_napi_add(priv->netdev, &rd->napi, -- hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM); -+ hns_nic_common_poll, NAPI_POLL_WEIGHT); - rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED; - } - for (i = h->q_num; i < h->q_num * 2; i++) { -@@ -1420,7 +1417,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv) - rd->fini_process = hns_nic_rx_fini_pro; - - netif_napi_add(priv->netdev, &rd->napi, -- hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM); -+ hns_nic_common_poll, NAPI_POLL_WEIGHT); - rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED; - } - -diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c -index 2a0dc127df3f..1a56de06b014 100644 ---- a/drivers/net/ethernet/ibm/ehea/ehea_main.c -+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c -@@ -3183,6 +3183,7 @@ static ssize_t ehea_probe_port(struct device *dev, - - if (ehea_add_adapter_mr(adapter)) { - pr_err("creating MR failed\n"); -+ of_node_put(eth_dn); - return -EIO; - } - -diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h -index b1915043bc0c..7b9fb71137da 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_defines.h -+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h -@@ -193,6 +193,8 @@ - /* enable link status from external LINK_0 and LINK_1 pins */ - #define E1000_CTRL_SWDPIN0 0x00040000 /* SWDPIN 0 value */ - #define E1000_CTRL_SWDPIN1 0x00080000 /* SWDPIN 1 value */ -+#define E1000_CTRL_ADVD3WUC 0x00100000 /* D3 WUC */ -+#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */ - #define E1000_CTRL_SDP0_DIR 0x00400000 /* SDP0 Data direction */ - #define E1000_CTRL_SDP1_DIR 0x00800000 /* SDP1 Data direction */ - #define E1000_CTRL_RST 0x04000000 /* Global reset */ -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index c1796aa2dde5..70ed5e5c3514 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -7325,9 +7325,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - struct e1000_hw *hw = &adapter->hw; - u32 ctrl, rctl, status; - u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol; --#ifdef CONFIG_PM -- int retval = 0; --#endif -+ bool wake; - - rtnl_lock(); - netif_device_detach(netdev); -@@ -7338,14 +7336,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - igb_clear_interrupt_scheme(adapter); - rtnl_unlock(); - --#ifdef CONFIG_PM -- if (!runtime) { -- retval = pci_save_state(pdev); -- if (retval) -- return retval; -- } --#endif -- - status = rd32(E1000_STATUS); - if (status & E1000_STATUS_LU) - wufc &= ~E1000_WUFC_LNKC; -@@ -7362,10 +7352,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - } - - ctrl = rd32(E1000_CTRL); -- /* advertise wake from D3Cold */ -- #define E1000_CTRL_ADVD3WUC 0x00100000 -- /* phy power management enable */ -- #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 - ctrl |= E1000_CTRL_ADVD3WUC; - wr32(E1000_CTRL, ctrl); - -@@ -7379,12 +7365,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - wr32(E1000_WUFC, 0); - } - -- *enable_wake = wufc || adapter->en_mng_pt; -- if (!*enable_wake) -+ wake = wufc || adapter->en_mng_pt; -+ if (!wake) - igb_power_down_link(adapter); - else - igb_power_up_link(adapter); - -+ if (enable_wake) -+ *enable_wake = wake; -+ - /* Release control of h/w to f/w. If f/w is AMT enabled, this - * would have already happened in close and is redundant. - */ -@@ -7399,22 +7388,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - #ifdef CONFIG_PM_SLEEP - static int igb_suspend(struct device *dev) - { -- int retval; -- bool wake; -- struct pci_dev *pdev = to_pci_dev(dev); -- -- retval = __igb_shutdown(pdev, &wake, 0); -- if (retval) -- return retval; -- -- if (wake) { -- pci_prepare_to_sleep(pdev); -- } else { -- pci_wake_from_d3(pdev, false); -- pci_set_power_state(pdev, PCI_D3hot); -- } -- -- return 0; -+ return __igb_shutdown(to_pci_dev(dev), NULL, 0); - } - #endif /* CONFIG_PM_SLEEP */ - -@@ -7483,22 +7457,7 @@ static int igb_runtime_idle(struct device *dev) - - static int igb_runtime_suspend(struct device *dev) - { -- struct pci_dev *pdev = to_pci_dev(dev); -- int retval; -- bool wake; -- -- retval = __igb_shutdown(pdev, &wake, 1); -- if (retval) -- return retval; -- -- if (wake) { -- pci_prepare_to_sleep(pdev); -- } else { -- pci_wake_from_d3(pdev, false); -- pci_set_power_state(pdev, PCI_D3hot); -- } -- -- return 0; -+ return __igb_shutdown(to_pci_dev(dev), NULL, 1); - } - - static int igb_runtime_resume(struct device *dev) -diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c -index 1edc973df4c4..7377dca6eb57 100644 ---- a/drivers/net/ethernet/micrel/ks8851.c -+++ b/drivers/net/ethernet/micrel/ks8851.c -@@ -547,9 +547,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) - /* set dma read address */ - ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00); - -- /* start the packet dma process, and set auto-dequeue rx */ -- ks8851_wrreg16(ks, KS_RXQCR, -- ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE); -+ /* start DMA access */ -+ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); - - if (rxlen > 4) { - unsigned int rxalign; -@@ -580,7 +579,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) - } - } - -- ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr); -+ /* end DMA access and dequeue packet */ -+ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_RRXEF); - } - } - -@@ -797,6 +797,15 @@ static void ks8851_tx_work(struct work_struct *work) - static int ks8851_net_open(struct net_device *dev) - { - struct ks8851_net *ks = netdev_priv(dev); -+ int ret; -+ -+ ret = request_threaded_irq(dev->irq, NULL, ks8851_irq, -+ IRQF_TRIGGER_LOW | IRQF_ONESHOT, -+ dev->name, ks); -+ if (ret < 0) { -+ netdev_err(dev, "failed to get irq\n"); -+ return ret; -+ } - - /* lock the card, even if we may not actually be doing anything - * else at the moment */ -@@ -861,6 +870,7 @@ static int ks8851_net_open(struct net_device *dev) - netif_dbg(ks, ifup, ks->netdev, "network device up\n"); - - mutex_unlock(&ks->lock); -+ mii_check_link(&ks->mii); - return 0; - } - -@@ -911,6 +921,8 @@ static int ks8851_net_stop(struct net_device *dev) - dev_kfree_skb(txb); - } - -+ free_irq(dev->irq, ks); -+ - return 0; - } - -@@ -1516,6 +1528,7 @@ static int ks8851_probe(struct spi_device *spi) - - spi_set_drvdata(spi, ks); - -+ netif_carrier_off(ks->netdev); - ndev->if_port = IF_PORT_100BASET; - ndev->netdev_ops = &ks8851_netdev_ops; - ndev->irq = spi->irq; -@@ -1542,14 +1555,6 @@ static int ks8851_probe(struct spi_device *spi) - ks8851_read_selftest(ks); - ks8851_init_mac(ks); - -- ret = request_threaded_irq(spi->irq, NULL, ks8851_irq, -- IRQF_TRIGGER_LOW | IRQF_ONESHOT, -- ndev->name, ks); -- if (ret < 0) { -- dev_err(&spi->dev, "failed to get irq\n"); -- goto err_irq; -- } -- - ret = register_netdev(ndev); - if (ret) { - dev_err(&spi->dev, "failed to register network device\n"); -@@ -1562,14 +1567,10 @@ static int ks8851_probe(struct spi_device *spi) - - return 0; - -- - err_netdev: -- free_irq(ndev->irq, ks); -- --err_irq: -+err_id: - if (gpio_is_valid(gpio)) - gpio_set_value(gpio, 0); --err_id: - regulator_disable(ks->vdd_reg); - err_reg: - regulator_disable(ks->vdd_io); -@@ -1587,7 +1588,6 @@ static int ks8851_remove(struct spi_device *spi) - dev_info(&spi->dev, "remove\n"); - - unregister_netdev(priv->netdev); -- free_irq(spi->irq, priv); - if (gpio_is_valid(priv->gpio)) - gpio_set_value(priv->gpio, 0); - regulator_disable(priv->vdd_reg); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -index 0a2318cad34d..63ebc491057b 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c -@@ -1038,6 +1038,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) - - for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { - skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); -+ if (!skb) -+ break; - qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); - skb_put(skb, QLCNIC_ILB_PKT_SIZE); - adapter->ahw->diag_cnt = 0; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 059113dce6e0..f4d6512f066c 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1792,8 +1792,6 @@ static int stmmac_open(struct net_device *dev) - struct stmmac_priv *priv = netdev_priv(dev); - int ret; - -- stmmac_check_ether_addr(priv); -- - if (priv->pcs != STMMAC_PCS_RGMII && priv->pcs != STMMAC_PCS_TBI && - priv->pcs != STMMAC_PCS_RTBI) { - ret = stmmac_init_phy(dev); -@@ -2929,6 +2927,8 @@ int stmmac_dvr_probe(struct device *device, - if (ret) - goto error_hw_init; - -+ stmmac_check_ether_addr(priv); -+ - ndev->netdev_ops = &stmmac_netdev_ops; - - ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | -diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c -index 4e70e7586a09..a5732edc8437 100644 ---- a/drivers/net/ethernet/ti/netcp_ethss.c -+++ b/drivers/net/ethernet/ti/netcp_ethss.c -@@ -3122,12 +3122,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev, - - ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device, - gbe_dev->dma_chan_name, gbe_dev->tx_queue_id); -- if (ret) -+ if (ret) { -+ of_node_put(interfaces); - return ret; -+ } - - ret = netcp_txpipe_open(&gbe_dev->tx_pipe); -- if (ret) -+ if (ret) { -+ of_node_put(interfaces); - return ret; -+ } - - /* Create network interfaces */ - INIT_LIST_HEAD(&gbe_dev->gbe_intf_head); -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index 4684644703cc..58ba579793f8 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -1595,12 +1595,14 @@ static int axienet_probe(struct platform_device *pdev) - ret = of_address_to_resource(np, 0, &dmares); - if (ret) { - dev_err(&pdev->dev, "unable to get DMA resource\n"); -+ of_node_put(np); - goto free_netdev; - } - lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares); - if (IS_ERR(lp->dma_regs)) { - dev_err(&pdev->dev, "could not map DMA regs\n"); - ret = PTR_ERR(lp->dma_regs); -+ of_node_put(np); - goto free_netdev; - } - lp->rx_irq = irq_of_parse_and_map(np, 1); -diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c -index cfd81eb1b532..ddceed3c5a4a 100644 ---- a/drivers/net/slip/slhc.c -+++ b/drivers/net/slip/slhc.c -@@ -153,7 +153,7 @@ out_fail: - void - slhc_free(struct slcompress *comp) - { -- if ( comp == NULLSLCOMPR ) -+ if ( IS_ERR_OR_NULL(comp) ) - return; - - if ( comp->tstate != NULLSLSTATE ) -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 267a90423154..7b3ef6dc45a4 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -1136,6 +1136,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev) - return -EINVAL; - } - -+ if (netdev_has_upper_dev(dev, port_dev)) { -+ netdev_err(dev, "Device %s is already an upper device of the team interface\n", -+ portname); -+ return -EBUSY; -+ } -+ - if (port_dev->features & NETIF_F_VLAN_CHALLENGED && - vlan_uses_dev(dev)) { - netdev_err(dev, "Device %s is VLAN challenged and team device has VLAN set up\n", -diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c -index f1f8227e7342..01f95d192d25 100644 ---- a/drivers/net/usb/ipheth.c -+++ b/drivers/net/usb/ipheth.c -@@ -148,6 +148,7 @@ struct ipheth_device { - u8 bulk_in; - u8 bulk_out; - struct delayed_work carrier_work; -+ bool confirmed_pairing; - }; - - static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags); -@@ -259,7 +260,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb) - - dev->net->stats.rx_packets++; - dev->net->stats.rx_bytes += len; -- -+ dev->confirmed_pairing = true; - netif_rx(skb); - ipheth_rx_submit(dev, GFP_ATOMIC); - } -@@ -280,14 +281,24 @@ static void ipheth_sndbulk_callback(struct urb *urb) - dev_err(&dev->intf->dev, "%s: urb status: %d\n", - __func__, status); - -- netif_wake_queue(dev->net); -+ if (status == 0) -+ netif_wake_queue(dev->net); -+ else -+ // on URB error, trigger immediate poll -+ schedule_delayed_work(&dev->carrier_work, 0); - } - - static int ipheth_carrier_set(struct ipheth_device *dev) - { -- struct usb_device *udev = dev->udev; -+ struct usb_device *udev; - int retval; - -+ if (!dev) -+ return 0; -+ if (!dev->confirmed_pairing) -+ return 0; -+ -+ udev = dev->udev; - retval = usb_control_msg(udev, - usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP), - IPHETH_CMD_CARRIER_CHECK, /* request */ -@@ -302,11 +313,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev) - return retval; - } - -- if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) -+ if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) { - netif_carrier_on(dev->net); -- else -+ if (dev->tx_urb->status != -EINPROGRESS) -+ netif_wake_queue(dev->net); -+ } else { - netif_carrier_off(dev->net); -- -+ netif_stop_queue(dev->net); -+ } - return 0; - } - -@@ -386,7 +400,6 @@ static int ipheth_open(struct net_device *net) - return retval; - - schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT); -- netif_start_queue(net); - return retval; - } - -@@ -489,7 +502,7 @@ static int ipheth_probe(struct usb_interface *intf, - dev->udev = udev; - dev->net = netdev; - dev->intf = intf; -- -+ dev->confirmed_pairing = false; - /* Set up endpoints */ - hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM); - if (hintf == NULL) { -@@ -540,7 +553,9 @@ static int ipheth_probe(struct usb_interface *intf, - retval = -EIO; - goto err_register_netdev; - } -- -+ // carrier down and transmit queues stopped until packet from device -+ netif_carrier_off(netdev); -+ netif_tx_stop_all_queues(netdev); - dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n"); - return 0; - -diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c -index 9f1037e7e55c..2ce0193614f2 100644 ---- a/drivers/net/wireless/cw1200/scan.c -+++ b/drivers/net/wireless/cw1200/scan.c -@@ -84,8 +84,11 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, - - frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0, - req->ie_len); -- if (!frame.skb) -+ if (!frame.skb) { -+ mutex_unlock(&priv->conf_mutex); -+ up(&priv->scan.lock); - return -ENOMEM; -+ } - - if (req->ie_len) - memcpy(skb_put(frame.skb, req->ie_len), req->ie, req->ie_len); -diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c -index cb477518dd0e..4c129450495d 100644 ---- a/drivers/nvdimm/btt_devs.c -+++ b/drivers/nvdimm/btt_devs.c -@@ -170,14 +170,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region, - return NULL; - - nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL); -- if (nd_btt->id < 0) { -- kfree(nd_btt); -- return NULL; -- } -+ if (nd_btt->id < 0) -+ goto out_nd_btt; - - nd_btt->lbasize = lbasize; -- if (uuid) -+ if (uuid) { - uuid = kmemdup(uuid, 16, GFP_KERNEL); -+ if (!uuid) -+ goto out_put_id; -+ } - nd_btt->uuid = uuid; - dev = &nd_btt->dev; - dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id); -@@ -192,6 +193,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region, - return NULL; - } - return dev; -+ -+out_put_id: -+ ida_simple_remove(&nd_region->btt_ida, nd_btt->id); -+ -+out_nd_btt: -+ kfree(nd_btt); -+ return NULL; - } - - struct device *nd_btt_create(struct nd_region *nd_region) -diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c -index f73c29558cd3..c54ff94c491d 100644 ---- a/drivers/platform/x86/sony-laptop.c -+++ b/drivers/platform/x86/sony-laptop.c -@@ -4394,14 +4394,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context) - } - return AE_OK; - } -+ -+ case ACPI_RESOURCE_TYPE_END_TAG: -+ return AE_OK; -+ - default: - dprintk("Resource %d isn't an IRQ nor an IO port\n", - resource->type); -+ return AE_CTRL_TERMINATE; - -- case ACPI_RESOURCE_TYPE_END_TAG: -- return AE_OK; - } -- return AE_CTRL_TERMINATE; - } - - static int sony_pic_possible_resources(struct acpi_device *device) -diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c -index d6c853bbfa9f..e93beecd5010 100644 ---- a/drivers/rtc/rtc-da9063.c -+++ b/drivers/rtc/rtc-da9063.c -@@ -491,6 +491,13 @@ static int da9063_rtc_probe(struct platform_device *pdev) - da9063_data_to_tm(data, &rtc->alarm_time, rtc); - rtc->rtc_sync = false; - -+ /* -+ * TODO: some models have alarms on a minute boundary but still support -+ * real hardware interrupts. Add this once the core supports it. -+ */ -+ if (config->rtc_data_start != RTC_SEC) -+ rtc->rtc_dev->uie_unsupported = 1; -+ - irq_alarm = platform_get_irq_byname(pdev, "ALARM"); - ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL, - da9063_alarm_event, -diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c -index 2b81dd4baf17..104c854d6a8a 100644 ---- a/drivers/rtc/rtc-sh.c -+++ b/drivers/rtc/rtc-sh.c -@@ -455,7 +455,7 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm) - static inline int sh_rtc_read_alarm_value(struct sh_rtc *rtc, int reg_off) - { - unsigned int byte; -- int value = 0xff; /* return 0xff for ignored values */ -+ int value = -1; /* return -1 for ignored values */ - - byte = readb(rtc->regbase + reg_off); - if (byte & AR_ENB) { -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 80a43074c2f9..c530610f61ac 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -2066,14 +2066,14 @@ static int dasd_eckd_end_analysis(struct dasd_block *block) - blk_per_trk = recs_per_track(&private->rdc_data, 0, block->bp_block); - - raw: -- block->blocks = (private->real_cyl * -+ block->blocks = ((unsigned long) private->real_cyl * - private->rdc_data.trk_per_cyl * - blk_per_trk); - - dev_info(&device->cdev->dev, -- "DASD with %d KB/block, %d KB total size, %d KB/track, " -+ "DASD with %u KB/block, %lu KB total size, %u KB/track, " - "%s\n", (block->bp_block >> 10), -- ((private->real_cyl * -+ (((unsigned long) private->real_cyl * - private->rdc_data.trk_per_cyl * - blk_per_trk * (block->bp_block >> 9)) >> 1), - ((blk_per_trk * block->bp_block) >> 10), -diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c -index bae98521c808..3e5a7912044f 100644 ---- a/drivers/s390/char/con3270.c -+++ b/drivers/s390/char/con3270.c -@@ -627,7 +627,7 @@ con3270_init(void) - (void (*)(unsigned long)) con3270_read_tasklet, - (unsigned long) condev->read); - -- raw3270_add_view(&condev->view, &con3270_fn, 1); -+ raw3270_add_view(&condev->view, &con3270_fn, 1, RAW3270_VIEW_LOCK_IRQ); - - INIT_LIST_HEAD(&condev->freemem); - for (i = 0; i < CON3270_STRING_PAGES; i++) { -diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c -index 71e974738014..f0c86bcbe316 100644 ---- a/drivers/s390/char/fs3270.c -+++ b/drivers/s390/char/fs3270.c -@@ -463,7 +463,8 @@ fs3270_open(struct inode *inode, struct file *filp) - - init_waitqueue_head(&fp->wait); - fp->fs_pid = get_pid(task_pid(current)); -- rc = raw3270_add_view(&fp->view, &fs3270_fn, minor); -+ rc = raw3270_add_view(&fp->view, &fs3270_fn, minor, -+ RAW3270_VIEW_LOCK_BH); - if (rc) { - fs3270_free_view(&fp->view); - goto out; -diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c -index 220acb4cbee5..9c350e6d75bf 100644 ---- a/drivers/s390/char/raw3270.c -+++ b/drivers/s390/char/raw3270.c -@@ -956,7 +956,7 @@ raw3270_deactivate_view(struct raw3270_view *view) - * Add view to device with minor "minor". - */ - int --raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor) -+raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor, int subclass) - { - unsigned long flags; - struct raw3270 *rp; -@@ -978,6 +978,7 @@ raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor) - view->cols = rp->cols; - view->ascebc = rp->ascebc; - spin_lock_init(&view->lock); -+ lockdep_set_subclass(&view->lock, subclass); - list_add(&view->list, &rp->view_list); - rc = 0; - spin_unlock_irqrestore(get_ccwdev_lock(rp->cdev), flags); -diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h -index e1e41c2861fb..5ae54317857a 100644 ---- a/drivers/s390/char/raw3270.h -+++ b/drivers/s390/char/raw3270.h -@@ -155,6 +155,8 @@ struct raw3270_fn { - struct raw3270_view { - struct list_head list; - spinlock_t lock; -+#define RAW3270_VIEW_LOCK_IRQ 0 -+#define RAW3270_VIEW_LOCK_BH 1 - atomic_t ref_count; - struct raw3270 *dev; - struct raw3270_fn *fn; -@@ -163,7 +165,7 @@ struct raw3270_view { - unsigned char *ascebc; /* ascii -> ebcdic table */ - }; - --int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int); -+int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int, int); - int raw3270_activate_view(struct raw3270_view *); - void raw3270_del_view(struct raw3270_view *); - void raw3270_deactivate_view(struct raw3270_view *); -diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c -index e96fc7fd9498..ab95d24b991b 100644 ---- a/drivers/s390/char/tty3270.c -+++ b/drivers/s390/char/tty3270.c -@@ -937,7 +937,8 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty) - return PTR_ERR(tp); - - rc = raw3270_add_view(&tp->view, &tty3270_fn, -- tty->index + RAW3270_FIRSTMINOR); -+ tty->index + RAW3270_FIRSTMINOR, -+ RAW3270_VIEW_LOCK_BH); - if (rc) { - tty3270_free_view(tp); - return rc; -diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c -index 05c37d6d4afe..a31821d94677 100644 ---- a/drivers/s390/net/ctcm_main.c -+++ b/drivers/s390/net/ctcm_main.c -@@ -1595,6 +1595,7 @@ static int ctcm_new_device(struct ccwgroup_device *cgdev) - if (priv->channel[direction] == NULL) { - if (direction == CTCM_WRITE) - channel_free(priv->channel[CTCM_READ]); -+ result = -ENODEV; - goto out_dev; - } - priv->channel[direction]->netdev = dev; -diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c -index 237688af179b..f7630cf581cd 100644 ---- a/drivers/s390/scsi/zfcp_fc.c -+++ b/drivers/s390/scsi/zfcp_fc.c -@@ -238,10 +238,6 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, - list_for_each_entry(port, &adapter->port_list, list) { - if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range)) - zfcp_fc_test_link(port); -- if (!port->d_id) -- zfcp_erp_port_reopen(port, -- ZFCP_STATUS_COMMON_ERP_FAILED, -- "fcrscn1"); - } - read_unlock_irqrestore(&adapter->port_list_lock, flags); - } -@@ -249,6 +245,7 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, - static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) - { - struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data; -+ struct zfcp_adapter *adapter = fsf_req->adapter; - struct fc_els_rscn *head; - struct fc_els_rscn_page *page; - u16 i; -@@ -261,6 +258,22 @@ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) - /* see FC-FS */ - no_entries = head->rscn_plen / sizeof(struct fc_els_rscn_page); - -+ if (no_entries > 1) { -+ /* handle failed ports */ -+ unsigned long flags; -+ struct zfcp_port *port; -+ -+ read_lock_irqsave(&adapter->port_list_lock, flags); -+ list_for_each_entry(port, &adapter->port_list, list) { -+ if (port->d_id) -+ continue; -+ zfcp_erp_port_reopen(port, -+ ZFCP_STATUS_COMMON_ERP_FAILED, -+ "fcrscn1"); -+ } -+ read_unlock_irqrestore(&adapter->port_list_lock, flags); -+ } -+ - for (i = 1; i < no_entries; i++) { - /* skip head and start with 1st element */ - page++; -diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c -index c2a6f9f29427..ddbdaade654d 100644 ---- a/drivers/scsi/csiostor/csio_scsi.c -+++ b/drivers/scsi/csiostor/csio_scsi.c -@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req) - } - - out: -- if (req->nsge > 0) -+ if (req->nsge > 0) { - scsi_dma_unmap(cmnd); -+ if (req->dcopy && (host_status == DID_OK)) -+ host_status = csio_scsi_copy_to_sgl(hw, req); -+ } - - cmnd->result = (((host_status) << 16) | scsi_status); - cmnd->scsi_done(cmnd); -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 7be581f7c35d..1a6f65db615e 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -47,17 +47,16 @@ static void smp_task_timedout(unsigned long _task) - unsigned long flags; - - spin_lock_irqsave(&task->task_state_lock, flags); -- if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) -+ if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { - task->task_state_flags |= SAS_TASK_STATE_ABORTED; -+ complete(&task->slow_task->completion); -+ } - spin_unlock_irqrestore(&task->task_state_lock, flags); -- -- complete(&task->slow_task->completion); - } - - static void smp_task_done(struct sas_task *task) - { -- if (!del_timer(&task->slow_task->timer)) -- return; -+ del_timer(&task->slow_task->timer); - complete(&task->slow_task->completion); - } - -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index ac12ee844bfc..31c29a5d1f38 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -431,7 +431,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj, - } - - ha->optrom_region_start = start; -- ha->optrom_region_size = start + size; -+ ha->optrom_region_size = size; - - ha->optrom_state = QLA_SREADING; - ha->optrom_buffer = vmalloc(ha->optrom_region_size); -@@ -504,7 +504,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj, - } - - ha->optrom_region_start = start; -- ha->optrom_region_size = start + size; -+ ha->optrom_region_size = size; - - ha->optrom_state = QLA_SWRITING; - ha->optrom_buffer = vmalloc(ha->optrom_region_size); -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index f9f899ec9427..c158967b59d7 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -3207,6 +3207,8 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session, - if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) - return -EINVAL; - ep = iscsi_lookup_endpoint(transport_fd); -+ if (!ep) -+ return -EINVAL; - conn = cls_conn->dd_data; - qla_conn = conn->dd_data; - qla_conn->qla_ep = ep->dd_data; -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 44b7a69d022a..45cd4cf93af3 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -613,13 +613,22 @@ static void handle_sc_creation(struct vmbus_channel *new_sc) - static void handle_multichannel_storage(struct hv_device *device, int max_chns) - { - struct storvsc_device *stor_device; -- int num_cpus = num_online_cpus(); - int num_sc; - struct storvsc_cmd_request *request; - struct vstor_packet *vstor_packet; - int ret, t; - -- num_sc = ((max_chns > num_cpus) ? num_cpus : max_chns); -+ /* -+ * If the number of CPUs is artificially restricted, such as -+ * with maxcpus=1 on the kernel boot line, Hyper-V could offer -+ * sub-channels >= the number of CPUs. These sub-channels -+ * should not be created. The primary channel is already created -+ * and assigned to one CPU, so check against # CPUs - 1. -+ */ -+ num_sc = min((int)(num_online_cpus() - 1), max_chns); -+ if (!num_sc) -+ return; -+ - stor_device = get_out_stor_device(device); - if (!stor_device) - return; -diff --git a/drivers/staging/iio/addac/adt7316.c b/drivers/staging/iio/addac/adt7316.c -index 3adc4516918c..8c5cfb9400d0 100644 ---- a/drivers/staging/iio/addac/adt7316.c -+++ b/drivers/staging/iio/addac/adt7316.c -@@ -47,6 +47,8 @@ - #define ADT7516_MSB_AIN3 0xA - #define ADT7516_MSB_AIN4 0xB - #define ADT7316_DA_DATA_BASE 0x10 -+#define ADT7316_DA_10_BIT_LSB_SHIFT 6 -+#define ADT7316_DA_12_BIT_LSB_SHIFT 4 - #define ADT7316_DA_MSB_DATA_REGS 4 - #define ADT7316_LSB_DAC_A 0x10 - #define ADT7316_MSB_DAC_A 0x11 -@@ -1092,7 +1094,7 @@ static ssize_t adt7316_store_DAC_internal_Vref(struct device *dev, - ldac_config = chip->ldac_config & (~ADT7516_DAC_IN_VREF_MASK); - if (data & 0x1) - ldac_config |= ADT7516_DAC_AB_IN_VREF; -- else if (data & 0x2) -+ if (data & 0x2) - ldac_config |= ADT7516_DAC_CD_IN_VREF; - } else { - ret = kstrtou8(buf, 16, &data); -@@ -1414,7 +1416,7 @@ static IIO_DEVICE_ATTR(ex_analog_temp_offset, S_IRUGO | S_IWUSR, - static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, - int channel, char *buf) - { -- u16 data; -+ u16 data = 0; - u8 msb, lsb, offset; - int ret; - -@@ -1439,7 +1441,11 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, - if (ret) - return -EIO; - -- data = (msb << offset) + (lsb & ((1 << offset) - 1)); -+ if (chip->dac_bits == 12) -+ data = lsb >> ADT7316_DA_12_BIT_LSB_SHIFT; -+ else if (chip->dac_bits == 10) -+ data = lsb >> ADT7316_DA_10_BIT_LSB_SHIFT; -+ data |= msb << offset; - - return sprintf(buf, "%d\n", data); - } -@@ -1447,7 +1453,7 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip, - static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, - int channel, const char *buf, size_t len) - { -- u8 msb, lsb, offset; -+ u8 msb, lsb, lsb_reg, offset; - u16 data; - int ret; - -@@ -1465,9 +1471,13 @@ static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip, - return -EINVAL; - - if (chip->dac_bits > 8) { -- lsb = data & (1 << offset); -+ lsb = data & ((1 << offset) - 1); -+ if (chip->dac_bits == 12) -+ lsb_reg = lsb << ADT7316_DA_12_BIT_LSB_SHIFT; -+ else -+ lsb_reg = lsb << ADT7316_DA_10_BIT_LSB_SHIFT; - ret = chip->bus.write(chip->bus.client, -- ADT7316_DA_DATA_BASE + channel * 2, lsb); -+ ADT7316_DA_DATA_BASE + channel * 2, lsb_reg); - if (ret) - return -EIO; - } -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 17a22073d226..032f3c13b8c4 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -1448,7 +1448,7 @@ static int __init sc16is7xx_init(void) - ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver); - if (ret < 0) { - pr_err("failed to init sc16is7xx i2c --> %d\n", ret); -- return ret; -+ goto err_i2c; - } - #endif - -@@ -1456,10 +1456,18 @@ static int __init sc16is7xx_init(void) - ret = spi_register_driver(&sc16is7xx_spi_uart_driver); - if (ret < 0) { - pr_err("failed to init sc16is7xx spi --> %d\n", ret); -- return ret; -+ goto err_spi; - } - #endif - return ret; -+ -+err_spi: -+#ifdef CONFIG_SERIAL_SC16IS7XX_I2C -+ i2c_del_driver(&sc16is7xx_i2c_uart_driver); -+#endif -+err_i2c: -+ uart_unregister_driver(&sc16is7xx_uart); -+ return ret; - } - module_init(sc16is7xx_init); - -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index e9d6cf146fcc..654199c6a36c 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -470,11 +470,6 @@ static int usb_unbind_interface(struct device *dev) - pm_runtime_disable(dev); - pm_runtime_set_suspended(dev); - -- /* Undo any residual pm_autopm_get_interface_* calls */ -- for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r) -- usb_autopm_put_interface_no_suspend(intf); -- atomic_set(&intf->pm_usage_cnt, 0); -- - if (!error) - usb_autosuspend_device(udev); - -@@ -1625,7 +1620,6 @@ void usb_autopm_put_interface(struct usb_interface *intf) - int status; - - usb_mark_last_busy(udev); -- atomic_dec(&intf->pm_usage_cnt); - status = pm_runtime_put_sync(&intf->dev); - dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", - __func__, atomic_read(&intf->dev.power.usage_count), -@@ -1654,7 +1648,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf) - int status; - - usb_mark_last_busy(udev); -- atomic_dec(&intf->pm_usage_cnt); - status = pm_runtime_put(&intf->dev); - dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", - __func__, atomic_read(&intf->dev.power.usage_count), -@@ -1676,7 +1669,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf) - struct usb_device *udev = interface_to_usbdev(intf); - - usb_mark_last_busy(udev); -- atomic_dec(&intf->pm_usage_cnt); - pm_runtime_put_noidle(&intf->dev); - } - EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend); -@@ -1707,8 +1699,6 @@ int usb_autopm_get_interface(struct usb_interface *intf) - status = pm_runtime_get_sync(&intf->dev); - if (status < 0) - pm_runtime_put_sync(&intf->dev); -- else -- atomic_inc(&intf->pm_usage_cnt); - dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", - __func__, atomic_read(&intf->dev.power.usage_count), - status); -@@ -1742,8 +1732,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf) - status = pm_runtime_get(&intf->dev); - if (status < 0 && status != -EINPROGRESS) - pm_runtime_put_noidle(&intf->dev); -- else -- atomic_inc(&intf->pm_usage_cnt); - dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n", - __func__, atomic_read(&intf->dev.power.usage_count), - status); -@@ -1767,7 +1755,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf) - struct usb_device *udev = interface_to_usbdev(intf); - - usb_mark_last_busy(udev); -- atomic_inc(&intf->pm_usage_cnt); - pm_runtime_get_noresume(&intf->dev); - } - EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume); -@@ -1888,14 +1875,11 @@ int usb_runtime_idle(struct device *dev) - return -EBUSY; - } - --int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable) -+static int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable) - { - struct usb_hcd *hcd = bus_to_hcd(udev->bus); - int ret = -EPERM; - -- if (enable && !udev->usb2_hw_lpm_allowed) -- return 0; -- - if (hcd->driver->set_usb2_hw_lpm) { - ret = hcd->driver->set_usb2_hw_lpm(hcd, udev, enable); - if (!ret) -@@ -1905,6 +1889,24 @@ int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable) - return ret; - } - -+int usb_enable_usb2_hardware_lpm(struct usb_device *udev) -+{ -+ if (!udev->usb2_hw_lpm_capable || -+ !udev->usb2_hw_lpm_allowed || -+ udev->usb2_hw_lpm_enabled) -+ return 0; -+ -+ return usb_set_usb2_hardware_lpm(udev, 1); -+} -+ -+int usb_disable_usb2_hardware_lpm(struct usb_device *udev) -+{ -+ if (!udev->usb2_hw_lpm_enabled) -+ return 0; -+ -+ return usb_set_usb2_hardware_lpm(udev, 0); -+} -+ - #endif /* CONFIG_PM */ - - struct bus_type usb_bus_type = { -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 3a6978458d95..7c87c0b38bcf 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -3116,8 +3116,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg) - } - - /* disable USB2 hardware LPM */ -- if (udev->usb2_hw_lpm_enabled == 1) -- usb_set_usb2_hardware_lpm(udev, 0); -+ usb_disable_usb2_hardware_lpm(udev); - - if (usb_disable_ltm(udev)) { - dev_err(&udev->dev, "Failed to disable LTM before suspend\n."); -@@ -3163,8 +3162,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg) - usb_enable_ltm(udev); - err_ltm: - /* Try to enable USB2 hardware LPM again */ -- if (udev->usb2_hw_lpm_capable == 1) -- usb_set_usb2_hardware_lpm(udev, 1); -+ usb_enable_usb2_hardware_lpm(udev); - - if (udev->do_remote_wakeup) - (void) usb_disable_remote_wakeup(udev); -@@ -3443,8 +3441,7 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) - hub_port_logical_disconnect(hub, port1); - } else { - /* Try to enable USB2 hardware LPM */ -- if (udev->usb2_hw_lpm_capable == 1) -- usb_set_usb2_hardware_lpm(udev, 1); -+ usb_enable_usb2_hardware_lpm(udev); - - /* Try to enable USB3 LTM and LPM */ - usb_enable_ltm(udev); -@@ -4270,7 +4267,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev) - if ((udev->bos->ext_cap->bmAttributes & cpu_to_le32(USB_BESL_SUPPORT)) || - connect_type == USB_PORT_CONNECT_TYPE_HARD_WIRED) { - udev->usb2_hw_lpm_allowed = 1; -- usb_set_usb2_hardware_lpm(udev, 1); -+ usb_enable_usb2_hardware_lpm(udev); - } - } - -@@ -5415,8 +5412,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - /* Disable USB2 hardware LPM. - * It will be re-enabled by the enumeration process. - */ -- if (udev->usb2_hw_lpm_enabled == 1) -- usb_set_usb2_hardware_lpm(udev, 0); -+ usb_disable_usb2_hardware_lpm(udev); - - /* Disable LPM and LTM while we reset the device and reinstall the alt - * settings. Device-initiated LPM settings, and system exit latency -@@ -5526,7 +5522,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - - done: - /* Now that the alt settings are re-installed, enable LTM and LPM. */ -- usb_set_usb2_hardware_lpm(udev, 1); -+ usb_enable_usb2_hardware_lpm(udev); - usb_unlocked_enable_lpm(udev); - usb_enable_ltm(udev); - usb_release_bos_descriptor(udev); -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index 08cba309eb78..adc696a76b20 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size) - - if (dev->state == USB_STATE_SUSPENDED) - return -EHOSTUNREACH; -- if (size <= 0 || !buf || !index) -+ if (size <= 0 || !buf) - return -EINVAL; - buf[0] = 0; -+ if (index <= 0 || index >= 256) -+ return -EINVAL; - tbuf = kmalloc(256, GFP_NOIO); - if (!tbuf) - return -ENOMEM; -@@ -1184,8 +1186,7 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0) - dev->actconfig->interface[i] = NULL; - } - -- if (dev->usb2_hw_lpm_enabled == 1) -- usb_set_usb2_hardware_lpm(dev, 0); -+ usb_disable_usb2_hardware_lpm(dev); - usb_unlocked_disable_lpm(dev); - usb_disable_ltm(dev); - -diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c -index 65b6e6b84043..6dc0f4e25cf3 100644 ---- a/drivers/usb/core/sysfs.c -+++ b/drivers/usb/core/sysfs.c -@@ -472,7 +472,10 @@ static ssize_t usb2_hardware_lpm_store(struct device *dev, - - if (!ret) { - udev->usb2_hw_lpm_allowed = value; -- ret = usb_set_usb2_hardware_lpm(udev, value); -+ if (value) -+ ret = usb_enable_usb2_hardware_lpm(udev); -+ else -+ ret = usb_disable_usb2_hardware_lpm(udev); - } - - usb_unlock_device(udev); -diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h -index 53318126ed91..6b2f11544283 100644 ---- a/drivers/usb/core/usb.h -+++ b/drivers/usb/core/usb.h -@@ -84,7 +84,8 @@ extern int usb_remote_wakeup(struct usb_device *dev); - extern int usb_runtime_suspend(struct device *dev); - extern int usb_runtime_resume(struct device *dev); - extern int usb_runtime_idle(struct device *dev); --extern int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable); -+extern int usb_enable_usb2_hardware_lpm(struct usb_device *udev); -+extern int usb_disable_usb2_hardware_lpm(struct usb_device *udev); - - #else - -@@ -104,7 +105,12 @@ static inline int usb_autoresume_device(struct usb_device *udev) - return 0; - } - --static inline int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable) -+static inline int usb_enable_usb2_hardware_lpm(struct usb_device *udev) -+{ -+ return 0; -+} -+ -+static inline int usb_disable_usb2_hardware_lpm(struct usb_device *udev) - { - return 0; - } -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 22b4797383cd..4378e758baef 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -867,7 +867,7 @@ static int dwc3_probe(struct platform_device *pdev) - dwc->regs_size = resource_size(res); - - /* default to highest possible threshold */ -- lpm_nyet_threshold = 0xff; -+ lpm_nyet_threshold = 0xf; - - /* default to -3.5dB de-emphasis */ - tx_de_emphasis = 1; -diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c -index 3b6e34fc032b..553922c3be85 100644 ---- a/drivers/usb/gadget/udc/net2272.c -+++ b/drivers/usb/gadget/udc/net2272.c -@@ -962,6 +962,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req) - break; - } - if (&req->req != _req) { -+ ep->stopped = stopped; - spin_unlock_irqrestore(&ep->dev->lock, flags); - return -EINVAL; - } -diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c -index 8efeadf30b4d..3a8d056a5d16 100644 ---- a/drivers/usb/gadget/udc/net2280.c -+++ b/drivers/usb/gadget/udc/net2280.c -@@ -870,9 +870,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma) - (void) readl(&ep->dev->pci->pcimstctl); - - writel(BIT(DMA_START), &dma->dmastat); -- -- if (!ep->is_in) -- stop_out_naking(ep); - } - - static void start_dma(struct net2280_ep *ep, struct net2280_request *req) -@@ -911,6 +908,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req) - writel(BIT(DMA_START), &dma->dmastat); - return; - } -+ stop_out_naking(ep); - } - - tmp = dmactl_default; -@@ -1272,9 +1270,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req) - break; - } - if (&req->req != _req) { -+ ep->stopped = stopped; - spin_unlock_irqrestore(&ep->dev->lock, flags); -- dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n", -- __func__); -+ ep_dbg(ep->dev, "%s: Request mismatch\n", __func__); - return -EINVAL; - } - -diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c -index d5434e7a3b2e..86f9944f337d 100644 ---- a/drivers/usb/host/u132-hcd.c -+++ b/drivers/usb/host/u132-hcd.c -@@ -3214,6 +3214,9 @@ static int __init u132_hcd_init(void) - printk(KERN_INFO "driver %s\n", hcd_name); - workqueue = create_singlethread_workqueue("u132"); - retval = platform_driver_register(&u132_platform_driver); -+ if (retval) -+ destroy_workqueue(workqueue); -+ - return retval; - } - -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index 5594a4a4a83f..a8b6d0036e5d 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -332,6 +332,7 @@ static void yurex_disconnect(struct usb_interface *interface) - usb_deregister_dev(interface, &yurex_class); - - /* prevent more I/O from starting */ -+ usb_poison_urb(dev->urb); - mutex_lock(&dev->io_mutex); - dev->interface = NULL; - mutex_unlock(&dev->io_mutex); -diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c -index 54e170dd3dad..faead4f32b1c 100644 ---- a/drivers/usb/serial/generic.c -+++ b/drivers/usb/serial/generic.c -@@ -350,39 +350,59 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb) - struct usb_serial_port *port = urb->context; - unsigned char *data = urb->transfer_buffer; - unsigned long flags; -+ bool stopped = false; -+ int status = urb->status; - int i; - - for (i = 0; i < ARRAY_SIZE(port->read_urbs); ++i) { - if (urb == port->read_urbs[i]) - break; - } -- set_bit(i, &port->read_urbs_free); - - dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i, - urb->actual_length); -- switch (urb->status) { -+ switch (status) { - case 0: -+ usb_serial_debug_data(&port->dev, __func__, urb->actual_length, -+ data); -+ port->serial->type->process_read_urb(urb); - break; - case -ENOENT: - case -ECONNRESET: - case -ESHUTDOWN: - dev_dbg(&port->dev, "%s - urb stopped: %d\n", -- __func__, urb->status); -- return; -+ __func__, status); -+ stopped = true; -+ break; - case -EPIPE: - dev_err(&port->dev, "%s - urb stopped: %d\n", -- __func__, urb->status); -- return; -+ __func__, status); -+ stopped = true; -+ break; - default: - dev_dbg(&port->dev, "%s - nonzero urb status: %d\n", -- __func__, urb->status); -- goto resubmit; -+ __func__, status); -+ break; - } - -- usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data); -- port->serial->type->process_read_urb(urb); -+ /* -+ * Make sure URB processing is done before marking as free to avoid -+ * racing with unthrottle() on another CPU. Matches the barriers -+ * implied by the test_and_clear_bit() in -+ * usb_serial_generic_submit_read_urb(). -+ */ -+ smp_mb__before_atomic(); -+ set_bit(i, &port->read_urbs_free); -+ /* -+ * Make sure URB is marked as free before checking the throttled flag -+ * to avoid racing with unthrottle() on another CPU. Matches the -+ * smp_mb() in unthrottle(). -+ */ -+ smp_mb__after_atomic(); -+ -+ if (stopped) -+ return; - --resubmit: - /* Throttle the device if requested by tty */ - spin_lock_irqsave(&port->lock, flags); - port->throttled = port->throttle_req; -@@ -399,6 +419,7 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb) - { - unsigned long flags; - struct usb_serial_port *port = urb->context; -+ int status = urb->status; - int i; - - for (i = 0; i < ARRAY_SIZE(port->write_urbs); ++i) { -@@ -410,22 +431,22 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb) - set_bit(i, &port->write_urbs_free); - spin_unlock_irqrestore(&port->lock, flags); - -- switch (urb->status) { -+ switch (status) { - case 0: - break; - case -ENOENT: - case -ECONNRESET: - case -ESHUTDOWN: - dev_dbg(&port->dev, "%s - urb stopped: %d\n", -- __func__, urb->status); -+ __func__, status); - return; - case -EPIPE: - dev_err_console(port, "%s - urb stopped: %d\n", -- __func__, urb->status); -+ __func__, status); - return; - default: - dev_err_console(port, "%s - nonzero urb status: %d\n", -- __func__, urb->status); -+ __func__, status); - goto resubmit; - } - -@@ -456,6 +477,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty) - port->throttled = port->throttle_req = 0; - spin_unlock_irq(&port->lock); - -+ /* -+ * Matches the smp_mb__after_atomic() in -+ * usb_serial_generic_read_bulk_callback(). -+ */ -+ smp_mb(); -+ - if (was_throttled) - usb_serial_generic_submit_read_urbs(port, GFP_KERNEL); - } -diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c -index 20433563a601..be432bec0c5b 100644 ---- a/drivers/usb/storage/realtek_cr.c -+++ b/drivers/usb/storage/realtek_cr.c -@@ -772,18 +772,16 @@ static void rts51x_suspend_timer_fn(unsigned long data) - break; - case RTS51X_STAT_IDLE: - case RTS51X_STAT_SS: -- usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n", -- atomic_read(&us->pusb_intf->pm_usage_cnt), -+ usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n", - atomic_read(&us->pusb_intf->dev.power.usage_count)); - -- if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) { -+ if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) { - usb_stor_dbg(us, "Ready to enter SS state\n"); - rts51x_set_stat(chip, RTS51X_STAT_SS); - /* ignore mass storage interface's children */ - pm_suspend_ignore_children(&us->pusb_intf->dev, true); - usb_autopm_put_interface_async(us->pusb_intf); -- usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n", -- atomic_read(&us->pusb_intf->pm_usage_cnt), -+ usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n", - atomic_read(&us->pusb_intf->dev.power.usage_count)); - } - break; -@@ -816,11 +814,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) - int ret; - - if (working_scsi(srb)) { -- usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n", -- atomic_read(&us->pusb_intf->pm_usage_cnt), -+ usb_stor_dbg(us, "working scsi, power.usage:%d\n", - atomic_read(&us->pusb_intf->dev.power.usage_count)); - -- if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) { -+ if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) { - ret = usb_autopm_get_interface(us->pusb_intf); - usb_stor_dbg(us, "working scsi, ret=%d\n", ret); - } -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index 6cac8f26b97a..e657b111b320 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -772,23 +772,33 @@ static int uas_slave_alloc(struct scsi_device *sdev) - { - struct uas_dev_info *devinfo = - (struct uas_dev_info *)sdev->host->hostdata; -+ int maxp; - - sdev->hostdata = devinfo; - -- /* USB has unusual DMA-alignment requirements: Although the -- * starting address of each scatter-gather element doesn't matter, -- * the length of each element except the last must be divisible -- * by the Bulk maxpacket value. There's currently no way to -- * express this by block-layer constraints, so we'll cop out -- * and simply require addresses to be aligned at 512-byte -- * boundaries. This is okay since most block I/O involves -- * hardware sectors that are multiples of 512 bytes in length, -- * and since host controllers up through USB 2.0 have maxpacket -- * values no larger than 512. -- * -- * But it doesn't suffice for Wireless USB, where Bulk maxpacket -- * values can be as large as 2048. To make that work properly -- * will require changes to the block layer. -+ /* -+ * We have two requirements here. We must satisfy the requirements -+ * of the physical HC and the demands of the protocol, as we -+ * definitely want no additional memory allocation in this path -+ * ruling out using bounce buffers. -+ * -+ * For a transmission on USB to continue we must never send -+ * a package that is smaller than maxpacket. Hence the length of each -+ * scatterlist element except the last must be divisible by the -+ * Bulk maxpacket value. -+ * If the HC does not ensure that through SG, -+ * the upper layer must do that. We must assume nothing -+ * about the capabilities off the HC, so we use the most -+ * pessimistic requirement. -+ */ -+ -+ maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0); -+ blk_queue_virt_boundary(sdev->request_queue, maxp - 1); -+ -+ /* -+ * The protocol has no requirements on alignment in the strict sense. -+ * Controllers may or may not have alignment restrictions. -+ * As this is not exported, we use an extremely conservative guess. - */ - blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1)); - -diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c -index 56cacb68040c..808e3a317954 100644 ---- a/drivers/usb/usbip/stub_rx.c -+++ b/drivers/usb/usbip/stub_rx.c -@@ -380,22 +380,10 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu) - } - - if (usb_endpoint_xfer_isoc(epd)) { -- /* validate packet size and number of packets */ -- unsigned int maxp, packets, bytes; -- --#define USB_EP_MAXP_MULT_SHIFT 11 --#define USB_EP_MAXP_MULT_MASK (3 << USB_EP_MAXP_MULT_SHIFT) --#define USB_EP_MAXP_MULT(m) \ -- (((m) & USB_EP_MAXP_MULT_MASK) >> USB_EP_MAXP_MULT_SHIFT) -- -- maxp = usb_endpoint_maxp(epd); -- maxp *= (USB_EP_MAXP_MULT( -- __le16_to_cpu(epd->wMaxPacketSize)) + 1); -- bytes = pdu->u.cmd_submit.transfer_buffer_length; -- packets = DIV_ROUND_UP(bytes, maxp); -- -+ /* validate number of packets */ - if (pdu->u.cmd_submit.number_of_packets < 0 || -- pdu->u.cmd_submit.number_of_packets > packets) { -+ pdu->u.cmd_submit.number_of_packets > -+ USBIP_MAX_ISO_PACKETS) { - dev_err(&sdev->udev->dev, - "CMD_SUBMIT: isoc invalid num packets %d\n", - pdu->u.cmd_submit.number_of_packets); -diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h -index 0fc5ace57c0e..af903aa4ad90 100644 ---- a/drivers/usb/usbip/usbip_common.h -+++ b/drivers/usb/usbip/usbip_common.h -@@ -134,6 +134,13 @@ extern struct device_attribute dev_attr_usbip_debug; - #define USBIP_DIR_OUT 0x00 - #define USBIP_DIR_IN 0x01 - -+/* -+ * Arbitrary limit for the maximum number of isochronous packets in an URB, -+ * compare for example the uhci_submit_isochronous function in -+ * drivers/usb/host/uhci-q.c -+ */ -+#define USBIP_MAX_ISO_PACKETS 1024 -+ - /** - * struct usbip_header_basic - data pertinent to every request - * @command: the usbip request type -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index b31b84f56e8f..47b229fa5e8e 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -1191,11 +1191,11 @@ static void __init vfio_pci_fill_ids(void) - rc = pci_add_dynid(&vfio_pci_driver, vendor, device, - subvendor, subdevice, class, class_mask, 0); - if (rc) -- pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n", -+ pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n", - vendor, device, subvendor, subdevice, - class, class_mask, rc); - else -- pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n", -+ pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n", - vendor, device, subvendor, subdevice, - class, class_mask); - } -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index 2fa280671c1e..875634d0d020 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -53,10 +53,16 @@ module_param_named(disable_hugepages, - MODULE_PARM_DESC(disable_hugepages, - "Disable VFIO IOMMU support for IOMMU hugepages."); - -+static unsigned int dma_entry_limit __read_mostly = U16_MAX; -+module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644); -+MODULE_PARM_DESC(dma_entry_limit, -+ "Maximum number of user DMA mappings per container (65535)."); -+ - struct vfio_iommu { - struct list_head domain_list; - struct mutex lock; - struct rb_root dma_list; -+ unsigned int dma_avail; - bool v2; - bool nesting; - }; -@@ -382,6 +388,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma) - vfio_unmap_unpin(iommu, dma); - vfio_unlink_dma(iommu, dma); - kfree(dma); -+ iommu->dma_avail++; - } - - static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu) -@@ -582,12 +589,18 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, - return -EEXIST; - } - -+ if (!iommu->dma_avail) { -+ mutex_unlock(&iommu->lock); -+ return -ENOSPC; -+ } -+ - dma = kzalloc(sizeof(*dma), GFP_KERNEL); - if (!dma) { - mutex_unlock(&iommu->lock); - return -ENOMEM; - } - -+ iommu->dma_avail--; - dma->iova = iova; - dma->vaddr = vaddr; - dma->prot = prot; -@@ -903,6 +916,7 @@ static void *vfio_iommu_type1_open(unsigned long arg) - - INIT_LIST_HEAD(&iommu->domain_list); - iommu->dma_list = RB_ROOT; -+ iommu->dma_avail = dma_entry_limit; - mutex_init(&iommu->lock); - - return iommu; -diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c -index 590a0f51a249..9f96c7e61387 100644 ---- a/drivers/virt/fsl_hypervisor.c -+++ b/drivers/virt/fsl_hypervisor.c -@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - * hypervisor. - */ - lb_offset = param.local_vaddr & (PAGE_SIZE - 1); -+ if (param.count == 0 || -+ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1) -+ return -EINVAL; - num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT; - - /* Allocate the buffers we need */ -@@ -335,8 +338,8 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set) - struct fsl_hv_ioctl_prop param; - char __user *upath, *upropname; - void __user *upropval; -- char *path = NULL, *propname = NULL; -- void *propval = NULL; -+ char *path, *propname; -+ void *propval; - int ret = 0; - - /* Get the parameters from the user. */ -@@ -348,32 +351,30 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set) - upropval = (void __user *)(uintptr_t)param.propval; - - path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN); -- if (IS_ERR(path)) { -- ret = PTR_ERR(path); -- goto out; -- } -+ if (IS_ERR(path)) -+ return PTR_ERR(path); - - propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN); - if (IS_ERR(propname)) { - ret = PTR_ERR(propname); -- goto out; -+ goto err_free_path; - } - - if (param.proplen > FH_DTPROP_MAX_PROPLEN) { - ret = -EINVAL; -- goto out; -+ goto err_free_propname; - } - - propval = kmalloc(param.proplen, GFP_KERNEL); - if (!propval) { - ret = -ENOMEM; -- goto out; -+ goto err_free_propname; - } - - if (set) { - if (copy_from_user(propval, upropval, param.proplen)) { - ret = -EFAULT; -- goto out; -+ goto err_free_propval; - } - - param.ret = fh_partition_set_dtprop(param.handle, -@@ -392,7 +393,7 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set) - if (copy_to_user(upropval, propval, param.proplen) || - put_user(param.proplen, &p->proplen)) { - ret = -EFAULT; -- goto out; -+ goto err_free_propval; - } - } - } -@@ -400,10 +401,12 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set) - if (put_user(param.ret, &p->ret)) - ret = -EFAULT; - --out: -- kfree(path); -+err_free_propval: - kfree(propval); -+err_free_propname: - kfree(propname); -+err_free_path: -+ kfree(path); - - return ret; - } -diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c -index 59d74d1b47a8..2287e1be0e55 100644 ---- a/drivers/w1/masters/ds2490.c -+++ b/drivers/w1/masters/ds2490.c -@@ -1039,15 +1039,15 @@ static int ds_probe(struct usb_interface *intf, - /* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */ - alt = 3; - err = usb_set_interface(dev->udev, -- intf->altsetting[alt].desc.bInterfaceNumber, alt); -+ intf->cur_altsetting->desc.bInterfaceNumber, alt); - if (err) { - dev_err(&dev->udev->dev, "Failed to set alternative setting %d " - "for %d interface: err=%d.\n", alt, -- intf->altsetting[alt].desc.bInterfaceNumber, err); -+ intf->cur_altsetting->desc.bInterfaceNumber, err); - goto err_out_clear; - } - -- iface_desc = &intf->altsetting[alt]; -+ iface_desc = intf->cur_altsetting; - if (iface_desc->desc.bNumEndpoints != NUM_EP-1) { - pr_info("Num endpoints=%d. It is not DS9490R.\n", - iface_desc->desc.bNumEndpoints); -diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c -index be7d187d53fd..d636e2660e62 100644 ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -1288,6 +1288,7 @@ void ceph_dentry_lru_del(struct dentry *dn) - unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn) - { - struct ceph_inode_info *dci = ceph_inode(dir); -+ unsigned hash; - - switch (dci->i_dir_layout.dl_dir_hash) { - case 0: /* for backward compat */ -@@ -1295,8 +1296,11 @@ unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn) - return dn->d_name.hash; - - default: -- return ceph_str_hash(dci->i_dir_layout.dl_dir_hash, -+ spin_lock(&dn->d_lock); -+ hash = ceph_str_hash(dci->i_dir_layout.dl_dir_hash, - dn->d_name.name, dn->d_name.len); -+ spin_unlock(&dn->d_lock); -+ return hash; - } - } - -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index 9f0d99094cc1..a663b676d566 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -474,6 +474,7 @@ static void ceph_i_callback(struct rcu_head *head) - struct inode *inode = container_of(head, struct inode, i_rcu); - struct ceph_inode_info *ci = ceph_inode(inode); - -+ kfree(ci->i_symlink); - kmem_cache_free(ceph_inode_cachep, ci); - } - -@@ -505,7 +506,6 @@ void ceph_destroy_inode(struct inode *inode) - ceph_put_snap_realm(mdsc, realm); - } - -- kfree(ci->i_symlink); - while ((n = rb_first(&ci->i_fragtree)) != NULL) { - frag = rb_entry(n, struct ceph_inode_frag, node); - rb_erase(n, &ci->i_fragtree); -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index 35e6e0b2cf34..a5de8e22629b 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -1198,6 +1198,15 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap, - list_add(&ci->i_prealloc_cap_flush->list, &to_remove); - ci->i_prealloc_cap_flush = NULL; - } -+ -+ if (drop && -+ ci->i_wrbuffer_ref_head == 0 && -+ ci->i_wr_ref == 0 && -+ ci->i_dirty_caps == 0 && -+ ci->i_flushing_caps == 0) { -+ ceph_put_snap_context(ci->i_head_snapc); -+ ci->i_head_snapc = NULL; -+ } - } - spin_unlock(&ci->i_ceph_lock); - while (!list_empty(&to_remove)) { -diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c -index a485d0cdc559..3d876a1cf567 100644 ---- a/fs/ceph/snap.c -+++ b/fs/ceph/snap.c -@@ -567,7 +567,12 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci) - capsnap = NULL; - - update_snapc: -- if (ci->i_head_snapc) { -+ if (ci->i_wrbuffer_ref_head == 0 && -+ ci->i_wr_ref == 0 && -+ ci->i_dirty_caps == 0 && -+ ci->i_flushing_caps == 0) { -+ ci->i_head_snapc = NULL; -+ } else { - ci->i_head_snapc = ceph_get_snap_context(new_snapc); - dout(" new snapc is %p\n", new_snapc); - } -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index d8bd8dd36211..0f210cb5038a 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -1669,6 +1669,10 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, - if (rc == 0 || rc != -EBUSY) - goto do_rename_exit; - -+ /* Don't fall back to using SMB on SMB 2+ mount */ -+ if (server->vals->protocol_id != 0) -+ goto do_rename_exit; -+ - /* open-file renames don't work across directories */ - if (to_dentry->d_parent != from_dentry->d_parent) - goto do_rename_exit; -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 22fe11baef2b..3530e1c3ff56 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -164,19 +164,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root) - return 0; - } - --static void debugfs_evict_inode(struct inode *inode) -+static void debugfs_i_callback(struct rcu_head *head) - { -- truncate_inode_pages_final(&inode->i_data); -- clear_inode(inode); -+ struct inode *inode = container_of(head, struct inode, i_rcu); - if (S_ISLNK(inode->i_mode)) - kfree(inode->i_link); -+ free_inode_nonrcu(inode); -+} -+ -+static void debugfs_destroy_inode(struct inode *inode) -+{ -+ call_rcu(&inode->i_rcu, debugfs_i_callback); - } - - static const struct super_operations debugfs_super_operations = { - .statfs = simple_statfs, - .remount_fs = debugfs_remount, - .show_options = debugfs_show_options, -- .evict_inode = debugfs_evict_inode, -+ .destroy_inode = debugfs_destroy_inode, - }; - - static struct vfsmount *debugfs_automount(struct path *path) -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index cefae2350da5..27c4e2ac39a9 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -745,11 +745,17 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, - umode_t mode, dev_t dev) - { - struct inode *inode; -- struct resv_map *resv_map; -+ struct resv_map *resv_map = NULL; - -- resv_map = resv_map_alloc(); -- if (!resv_map) -- return NULL; -+ /* -+ * Reserve maps are only needed for inodes that can have associated -+ * page allocations. -+ */ -+ if (S_ISREG(mode) || S_ISLNK(mode)) { -+ resv_map = resv_map_alloc(); -+ if (!resv_map) -+ return NULL; -+ } - - inode = new_inode(sb); - if (inode) { -@@ -790,8 +796,10 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, - break; - } - lockdep_annotate_inode_mutex_key(inode); -- } else -- kref_put(&resv_map->refs, resv_map_release); -+ } else { -+ if (resv_map) -+ kref_put(&resv_map->refs, resv_map_release); -+ } - - return inode; - } -diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c -index bfebbf13698c..5b52ea41b84f 100644 ---- a/fs/jffs2/readinode.c -+++ b/fs/jffs2/readinode.c -@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f) - - jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL); - -- if (f->target) { -- kfree(f->target); -- f->target = NULL; -- } -- - fds = f->dents; - while(fds) { - fd = fds; -diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c -index 023e7f32ee1b..9fc297df8c75 100644 ---- a/fs/jffs2/super.c -+++ b/fs/jffs2/super.c -@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb) - static void jffs2_i_callback(struct rcu_head *head) - { - struct inode *inode = container_of(head, struct inode, i_rcu); -- kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode)); -+ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); -+ -+ kfree(f->target); -+ kmem_cache_free(jffs2_inode_cachep, f); - } - - static void jffs2_destroy_inode(struct inode *inode) -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index 9b42139a479b..dced329a8584 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -2020,7 +2020,8 @@ static int nfs23_validate_mount_data(void *options, - memcpy(sap, &data->addr, sizeof(data->addr)); - args->nfs_server.addrlen = sizeof(data->addr); - args->nfs_server.port = ntohs(data->addr.sin_port); -- if (!nfs_verify_server_address(sap)) -+ if (sap->sa_family != AF_INET || -+ !nfs_verify_server_address(sap)) - goto out_no_address; - - if (!(data->flags & NFS_MOUNT_TCP)) -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 24ace275160c..4fa3f0ba9ab3 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -874,8 +874,9 @@ static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata) - cb->cb_seq_status = 1; - cb->cb_status = 0; - if (minorversion) { -- if (!nfsd41_cb_get_slot(clp, task)) -+ if (!cb->cb_holds_slot && !nfsd41_cb_get_slot(clp, task)) - return; -+ cb->cb_holds_slot = true; - } - rpc_call_start(task); - } -@@ -902,6 +903,9 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback - return true; - } - -+ if (!cb->cb_holds_slot) -+ goto need_restart; -+ - switch (cb->cb_seq_status) { - case 0: - /* -@@ -939,6 +943,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback - cb->cb_seq_status); - } - -+ cb->cb_holds_slot = false; - clear_bit(0, &clp->cl_cb_slot_busy); - rpc_wake_up_next(&clp->cl_cb_waitq); - dprintk("%s: freed slot, new seqid=%d\n", __func__, -@@ -1146,6 +1151,7 @@ void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp, - cb->cb_seq_status = 1; - cb->cb_status = 0; - cb->cb_need_restart = false; -+ cb->cb_holds_slot = false; - } - - void nfsd4_run_cb(struct nfsd4_callback *cb) -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index 86af697c21d3..2c26bedda7be 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -70,6 +70,7 @@ struct nfsd4_callback { - int cb_seq_status; - int cb_status; - bool cb_need_restart; -+ bool cb_holds_slot; - }; - - struct nfsd4_callback_ops { -diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c -index c7e32a891502..2eea16a81500 100644 ---- a/fs/proc/proc_sysctl.c -+++ b/fs/proc/proc_sysctl.c -@@ -1550,9 +1550,11 @@ static void drop_sysctl_table(struct ctl_table_header *header) - if (--header->nreg) - return; - -- if (parent) -+ if (parent) { - put_links(header); -- start_unregistering(header); -+ start_unregistering(header); -+ } -+ - if (!--header->count) - kfree_rcu(header, rcu); - -diff --git a/include/linux/bitops.h b/include/linux/bitops.h -index defeaac0745f..e76d03f44c80 100644 ---- a/include/linux/bitops.h -+++ b/include/linux/bitops.h -@@ -1,28 +1,9 @@ - #ifndef _LINUX_BITOPS_H - #define _LINUX_BITOPS_H - #include -+#include - --#ifdef __KERNEL__ --#define BIT(nr) (1UL << (nr)) --#define BIT_ULL(nr) (1ULL << (nr)) --#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG)) --#define BIT_WORD(nr) ((nr) / BITS_PER_LONG) --#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG)) --#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG) --#define BITS_PER_BYTE 8 - #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long)) --#endif -- --/* -- * Create a contiguous bitmask starting at bit position @l and ending at -- * position @h. For example -- * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000. -- */ --#define GENMASK(h, l) \ -- (((~0UL) << (l)) & (~0UL >> (BITS_PER_LONG - 1 - (h)))) -- --#define GENMASK_ULL(h, l) \ -- (((~0ULL) << (l)) & (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h)))) - - extern unsigned int __sw_hweight8(unsigned int w); - extern unsigned int __sw_hweight16(unsigned int w); -diff --git a/include/linux/bits.h b/include/linux/bits.h -new file mode 100644 -index 000000000000..2b7b532c1d51 ---- /dev/null -+++ b/include/linux/bits.h -@@ -0,0 +1,26 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef __LINUX_BITS_H -+#define __LINUX_BITS_H -+#include -+ -+#define BIT(nr) (1UL << (nr)) -+#define BIT_ULL(nr) (1ULL << (nr)) -+#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG)) -+#define BIT_WORD(nr) ((nr) / BITS_PER_LONG) -+#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG)) -+#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG) -+#define BITS_PER_BYTE 8 -+ -+/* -+ * Create a contiguous bitmask starting at bit position @l and ending at -+ * position @h. For example -+ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000. -+ */ -+#define GENMASK(h, l) \ -+ (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h)))) -+ -+#define GENMASK_ULL(h, l) \ -+ (((~0ULL) - (1ULL << (l)) + 1) & \ -+ (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h)))) -+ -+#endif /* __LINUX_BITS_H */ -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index 063c73ed6d78..664f892d6e73 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -50,6 +50,8 @@ extern ssize_t cpu_show_spec_store_bypass(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_l1tf(struct device *dev, - struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_mds(struct device *dev, -+ struct device_attribute *attr, char *buf); - - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, -@@ -294,4 +296,21 @@ bool cpu_wait_death(unsigned int cpu, int seconds); - bool cpu_report_death(void); - #endif /* #ifdef CONFIG_HOTPLUG_CPU */ - -+/* -+ * These are used for a global "mitigations=" cmdline option for toggling -+ * optional CPU mitigations. -+ */ -+enum cpu_mitigations { -+ CPU_MITIGATIONS_OFF, -+ CPU_MITIGATIONS_AUTO, -+}; -+ -+extern enum cpu_mitigations cpu_mitigations; -+ -+/* mitigations=off */ -+static inline bool cpu_mitigations_off(void) -+{ -+ return cpu_mitigations == CPU_MITIGATIONS_OFF; -+} -+ - #endif /* _LINUX_CPU_H_ */ -diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h -index 68904469fba1..2209eb0740b0 100644 ---- a/include/linux/jump_label.h -+++ b/include/linux/jump_label.h -@@ -267,9 +267,15 @@ struct static_key_false { - #define DEFINE_STATIC_KEY_TRUE(name) \ - struct static_key_true name = STATIC_KEY_TRUE_INIT - -+#define DECLARE_STATIC_KEY_TRUE(name) \ -+ extern struct static_key_true name -+ - #define DEFINE_STATIC_KEY_FALSE(name) \ - struct static_key_false name = STATIC_KEY_FALSE_INIT - -+#define DECLARE_STATIC_KEY_FALSE(name) \ -+ extern struct static_key_false name -+ - extern bool ____wrong_branch_error(void); - - #define static_key_enabled(x) \ -diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h -index 81fdf4b8aba4..8b1e2bd46bb7 100644 ---- a/include/linux/ptrace.h -+++ b/include/linux/ptrace.h -@@ -57,14 +57,17 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); - #define PTRACE_MODE_READ 0x01 - #define PTRACE_MODE_ATTACH 0x02 - #define PTRACE_MODE_NOAUDIT 0x04 --#define PTRACE_MODE_FSCREDS 0x08 --#define PTRACE_MODE_REALCREDS 0x10 -+#define PTRACE_MODE_FSCREDS 0x08 -+#define PTRACE_MODE_REALCREDS 0x10 -+#define PTRACE_MODE_SCHED 0x20 -+#define PTRACE_MODE_IBPB 0x40 - - /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */ - #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS) - #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS) - #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS) - #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS) -+#define PTRACE_MODE_SPEC_IBPB (PTRACE_MODE_ATTACH_REALCREDS | PTRACE_MODE_IBPB) - - /** - * ptrace_may_access - check whether the caller is permitted to access -@@ -82,6 +85,20 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); - */ - extern bool ptrace_may_access(struct task_struct *task, unsigned int mode); - -+/** -+ * ptrace_may_access - check whether the caller is permitted to access -+ * a target task. -+ * @task: target task -+ * @mode: selects type of access and caller credentials -+ * -+ * Returns true on success, false on denial. -+ * -+ * Similar to ptrace_may_access(). Only to be called from context switch -+ * code. Does not call into audit and the regular LSM hooks due to locking -+ * constraints. -+ */ -+extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode); -+ - static inline int ptrace_reparented(struct task_struct *child) - { - return !same_thread_group(child->real_parent, child->parent); -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 48a59f731406..a0b540f800d9 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -2169,6 +2169,8 @@ static inline void memalloc_noio_restore(unsigned int flags) - #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */ - #define PFA_SPEC_SSB_DISABLE 4 /* Speculative Store Bypass disabled */ - #define PFA_SPEC_SSB_FORCE_DISABLE 5 /* Speculative Store Bypass force disabled*/ -+#define PFA_SPEC_IB_DISABLE 6 /* Indirect branch speculation restricted */ -+#define PFA_SPEC_IB_FORCE_DISABLE 7 /* Indirect branch speculation permanently restricted */ - - - #define TASK_PFA_TEST(name, func) \ -@@ -2199,6 +2201,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ssb_disable) - TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) - TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) - -+TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable) -+TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable) -+TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable) -+ -+TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) -+TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) -+ - /* - * task->jobctl flags - */ -diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h -new file mode 100644 -index 000000000000..559ac4590593 ---- /dev/null -+++ b/include/linux/sched/smt.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef _LINUX_SCHED_SMT_H -+#define _LINUX_SCHED_SMT_H -+ -+#include -+ -+#ifdef CONFIG_SCHED_SMT -+extern atomic_t sched_smt_present; -+ -+static __always_inline bool sched_smt_active(void) -+{ -+ return atomic_read(&sched_smt_present); -+} -+#else -+static inline bool sched_smt_active(void) { return false; } -+#endif -+ -+void arch_smt_update(void); -+ -+#endif -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 5c03ebc6dfa0..02bffcc611c3 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -127,7 +127,6 @@ enum usb_interface_condition { - * @dev: driver model's view of this device - * @usb_dev: if an interface is bound to the USB major, this will point - * to the sysfs representation for that device. -- * @pm_usage_cnt: PM usage counter for this interface - * @reset_ws: Used for scheduling resets from atomic context. - * @resetting_device: USB core reset the device, so use alt setting 0 as - * current; needs bandwidth alloc after reset. -@@ -184,7 +183,6 @@ struct usb_interface { - - struct device dev; /* interface specific device info */ - struct device *usb_dev; -- atomic_t pm_usage_cnt; /* usage counter for autosuspend */ - struct work_struct reset_ws; /* for resets in atomic context */ - }; - #define to_usb_interface(d) container_of(d, struct usb_interface, dev) -diff --git a/include/net/addrconf.h b/include/net/addrconf.h -index 18dd7a3caf2f..af032e5405f6 100644 ---- a/include/net/addrconf.h -+++ b/include/net/addrconf.h -@@ -162,6 +162,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, - const struct in6_addr *addr); - int ipv6_sock_mc_drop(struct sock *sk, int ifindex, - const struct in6_addr *addr); -+void __ipv6_sock_mc_close(struct sock *sk); - void ipv6_sock_mc_close(struct sock *sk); - bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr, - const struct in6_addr *src_addr); -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 876688b5a356..7c0c83dfe86e 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -174,6 +174,9 @@ struct adv_info { - - #define HCI_MAX_SHORT_NAME_LENGTH 10 - -+/* Min encryption key size to match with SMP */ -+#define HCI_MIN_ENC_KEY_SIZE 7 -+ - /* Default LE RPA expiry time, 15 minutes */ - #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60) - -diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h -index 64776b72e1eb..64ec0d62e5f5 100644 ---- a/include/uapi/linux/prctl.h -+++ b/include/uapi/linux/prctl.h -@@ -202,6 +202,7 @@ struct prctl_mm_map { - #define PR_SET_SPECULATION_CTRL 53 - /* Speculation control variants */ - # define PR_SPEC_STORE_BYPASS 0 -+# define PR_SPEC_INDIRECT_BRANCH 1 - /* Return and control values for PR_SET/GET_SPECULATION_CTRL */ - # define PR_SPEC_NOT_AFFECTED 0 - # define PR_SPEC_PRCTL (1UL << 0) -diff --git a/init/main.c b/init/main.c -index 49926d95442f..e88c8cdef6a7 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -538,6 +538,8 @@ asmlinkage __visible void __init start_kernel(void) - } - #else - pr_notice("Kernel command line: %s\n", boot_command_line); - #endif -+ /* parameters may set static keys */ -+ jump_label_init(); - parse_early_param(); - after_dashes = parse_args("Booting kernel", - static_command_line, __start___param, -@@ -547,8 +549,6 @@ asmlinkage __visible void __init start_kernel(void) - parse_args("Setting init args", after_dashes, NULL, 0, -1, -1, - NULL, set_init_arg); - -- jump_label_init(); -- - /* - * These use large bootmem allocations and must precede - * kmem_cache_init() -diff --git a/kernel/cpu.c b/kernel/cpu.c -index 42ce0b0ae5c5..3225c3a9d028 100644 ---- a/kernel/cpu.c -+++ b/kernel/cpu.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -199,6 +200,12 @@ void cpu_hotplug_enable(void) - EXPORT_SYMBOL_GPL(cpu_hotplug_enable); - #endif /* CONFIG_HOTPLUG_CPU */ - -+/* -+ * Architectures that need SMT-specific errata handling during SMT hotplug -+ * should override this. -+ */ -+void __weak arch_smt_update(void) { } -+ - /* Need to know about CPUs going up/down? */ - int register_cpu_notifier(struct notifier_block *nb) - { -@@ -434,6 +441,7 @@ out_release: - cpu_hotplug_done(); - if (!err) - cpu_notify_nofail(CPU_POST_DEAD | mod, hcpu); -+ arch_smt_update(); - return err; - } - -@@ -537,8 +545,8 @@ out_notify: - __cpu_notify(CPU_UP_CANCELED | mod, hcpu, nr_calls, NULL); - out: - cpu_hotplug_done(); - trace_sched_cpu_hotplug(cpu, ret, 1); -- -+ arch_smt_update(); - return ret; - } - -@@ -834,5 +842,18 @@ void init_cpu_online(const struct cpumask *src) - { - cpumask_copy(to_cpumask(cpu_online_bits), src); - } -+ -+enum cpu_mitigations cpu_mitigations = CPU_MITIGATIONS_AUTO; -+ -+static int __init mitigations_parse_cmdline(char *arg) -+{ -+ if (!strcmp(arg, "off")) -+ cpu_mitigations = CPU_MITIGATIONS_OFF; -+ else if (!strcmp(arg, "auto")) -+ cpu_mitigations = CPU_MITIGATIONS_AUTO; -+ -+ return 0; -+} -+early_param("mitigations", mitigations_parse_cmdline); - - static ATOMIC_NOTIFIER_HEAD(idle_notifier); -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 83cea913983c..92c7eb1aeded 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -319,8 +319,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify) - desc->affinity_notify = notify; - raw_spin_unlock_irqrestore(&desc->lock, flags); - -- if (old_notify) -+ if (old_notify) { -+ cancel_work_sync(&old_notify->work); - kref_put(&old_notify->kref, old_notify->release); -+ } - - return 0; - } -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index 5e2cd1030702..8303874c2a06 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -228,6 +228,9 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state) - - static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode) - { -+ if (mode & PTRACE_MODE_SCHED) -+ return false; -+ - if (mode & PTRACE_MODE_NOAUDIT) - return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE); - else -@@ -295,9 +298,16 @@ ok: - !ptrace_has_cap(mm->user_ns, mode))) - return -EPERM; - -+ if (mode & PTRACE_MODE_SCHED) -+ return 0; - return security_ptrace_access_check(task, mode); - } - -+bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode) -+{ -+ return __ptrace_may_access(task, mode | PTRACE_MODE_SCHED); -+} -+ - bool ptrace_may_access(struct task_struct *task, unsigned int mode) - { - int err; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index d0618951014b..d35a7d528ea6 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -5610,6 +5610,10 @@ static void set_cpu_rq_start_time(void) - rq->age_stamp = sched_clock_cpu(cpu); - } - -+#ifdef CONFIG_SCHED_SMT -+atomic_t sched_smt_present = ATOMIC_INIT(0); -+#endif -+ - static int sched_cpu_active(struct notifier_block *nfb, - unsigned long action, void *hcpu) - { -@@ -5626,11 +5630,23 @@ static int sched_cpu_active(struct notifier_block *nfb, - * set_cpu_online(). But it might not yet have marked itself - * as active, which is essential from here on. - */ -+#ifdef CONFIG_SCHED_SMT -+ /* -+ * When going up, increment the number of cores with SMT present. -+ */ -+ if (cpumask_weight(cpu_smt_mask(cpu)) == 2) -+ atomic_inc(&sched_smt_present); -+#endif - set_cpu_active(cpu, true); - stop_machine_unpark(cpu); - return NOTIFY_OK; - - case CPU_DOWN_FAILED: -+#ifdef CONFIG_SCHED_SMT -+ /* Same as for CPU_ONLINE */ -+ if (cpumask_weight(cpu_smt_mask(cpu)) == 2) -+ atomic_inc(&sched_smt_present); -+#endif - set_cpu_active(cpu, true); - return NOTIFY_OK; - -@@ -5645,7 +5661,15 @@ static int sched_cpu_inactive(struct notifier_block *nfb, - switch (action & ~CPU_TASKS_FROZEN) { - case CPU_DOWN_PREPARE: - set_cpu_active((long)hcpu, false); -+#ifdef CONFIG_SCHED_SMT -+ /* -+ * When going down, decrement the number of cores with SMT present. -+ */ -+ if (cpumask_weight(cpu_smt_mask((long)hcpu)) == 2) -+ atomic_dec(&sched_smt_present); -+#endif - return NOTIFY_OK; -+ - default: - return NOTIFY_DONE; - } -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index d706cf4fda99..75bfa23f97b4 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -1722,6 +1722,10 @@ static u64 numa_get_avg_runtime(struct task_struct *p, u64 *period) - if (p->last_task_numa_placement) { - delta = runtime - p->last_sum_exec_runtime; - *period = now - p->last_task_numa_placement; -+ -+ /* Avoid time going backwards, prevent potential divide error: */ -+ if (unlikely((s64)*period < 0)) -+ *period = 0; - } else { - delta = p->se.avg.load_sum / p->se.load.weight; - *period = LOAD_AVG_MAX; -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 6893ee31df4d..8b96df04ba78 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c -index 1adecb4b87c8..7e4d715f9c22 100644 ---- a/kernel/time/timer_stats.c -+++ b/kernel/time/timer_stats.c -@@ -417,7 +417,7 @@ static int __init init_tstats_procfs(void) - { - struct proc_dir_entry *pe; - -- pe = proc_create("timer_stats", 0644, NULL, &tstats_fops); -+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops); - if (!pe) - return -ENOMEM; - return 0; -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 5e091614fe39..1cf2402c6922 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -701,7 +701,7 @@ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu) - - preempt_disable_notrace(); - time = rb_time_stamp(buffer); -- preempt_enable_no_resched_notrace(); -+ preempt_enable_notrace(); - - return time; - } -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index ac9791dd4768..5139c4ebb96b 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -363,10 +363,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - ifrr.ifr_ifru = ifr->ifr_ifru; - - switch (cmd) { -+ case SIOCSHWTSTAMP: -+ if (!net_eq(dev_net(dev), &init_net)) -+ break; - case SIOCGMIIPHY: - case SIOCGMIIREG: - case SIOCSMIIREG: -- case SIOCSHWTSTAMP: - case SIOCGHWTSTAMP: - if (netif_device_present(real_dev) && ops->ndo_do_ioctl) - err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 80be0ee17ff3..83d4d574fa44 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1177,6 +1177,14 @@ int hci_conn_check_link_mode(struct hci_conn *conn) - !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) - return 0; - -+ /* The minimum encryption key size needs to be enforced by the -+ * host stack before establishing any L2CAP connections. The -+ * specification in theory allows a minimum of 1, but to align -+ * BR/EDR and LE transports, a minimum of 7 is chosen. -+ */ -+ if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE) -+ return 0; -+ - return 1; - } - -diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c -index 008ba439bd62..cc80c76177b6 100644 ---- a/net/bluetooth/hidp/sock.c -+++ b/net/bluetooth/hidp/sock.c -@@ -76,6 +76,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long - sockfd_put(csock); - return err; - } -+ ca.name[sizeof(ca.name)-1] = 0; - - err = hidp_connection_add(&ca, csock, isock); - if (!err && copy_to_user(argp, &ca, sizeof(ca))) -diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c -index 50e84e634dfe..c7a281549d91 100644 ---- a/net/bridge/br_if.c -+++ b/net/bridge/br_if.c -@@ -471,13 +471,15 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) - call_netdevice_notifiers(NETDEV_JOIN, dev); - - err = dev_set_allmulti(dev, 1); -- if (err) -- goto put_back; -+ if (err) { -+ kfree(p); /* kobject not yet init'd, manually free */ -+ goto err1; -+ } - - err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj), - SYSFS_BRIDGE_PORT_ATTR); - if (err) -- goto err1; -+ goto err2; - - err = br_sysfs_addif(p); - if (err) -@@ -551,12 +553,9 @@ err3: - sysfs_remove_link(br->ifobj, p->dev->name); - err2: - kobject_put(&p->kobj); -- p = NULL; /* kobject_put frees */ --err1: - dev_set_allmulti(dev, -1); --put_back: -+err1: - dev_put(dev); -- kfree(p); - return err; - } - -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 93b5525bcccf..2ae0451fd634 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -507,6 +507,7 @@ static unsigned int br_nf_pre_routing(void *priv, - nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr; - - skb->protocol = htons(ETH_P_IP); -+ skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4; - - NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb, - skb->dev, NULL, -diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c -index 69dfd212e50d..f94c83f5cc37 100644 ---- a/net/bridge/br_netfilter_ipv6.c -+++ b/net/bridge/br_netfilter_ipv6.c -@@ -237,6 +237,8 @@ unsigned int br_nf_pre_routing_ipv6(void *priv, - nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; - - skb->protocol = htons(ETH_P_IPV6); -+ skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); -+ - NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, - skb->dev, NULL, - br_nf_pre_routing_finish_ipv6); -diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c -index f13402d407e4..1a87cf78fadc 100644 ---- a/net/bridge/netfilter/ebtables.c -+++ b/net/bridge/netfilter/ebtables.c -@@ -2046,7 +2046,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, - if (match_kern) - match_kern->match_size = ret; - -- if (WARN_ON(type == EBT_COMPAT_TARGET && size_left)) -+ /* rule should have no remaining data after target */ -+ if (type == EBT_COMPAT_TARGET && size_left) - return -EINVAL; - - match32 = (struct compat_ebt_entry_mwt *) buf; -diff --git a/net/core/filter.c b/net/core/filter.c -index 1a9ded6af138..3c5f51198c41 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -742,6 +742,17 @@ static bool chk_code_allowed(u16 code_to_probe) - return codes[code_to_probe]; - } - -+static bool bpf_check_basics_ok(const struct sock_filter *filter, -+ unsigned int flen) -+{ -+ if (filter == NULL) -+ return false; -+ if (flen == 0 || flen > BPF_MAXINSNS) -+ return false; -+ -+ return true; -+} -+ - /** - * bpf_check_classic - verify socket filter code - * @filter: filter to verify -@@ -762,9 +773,6 @@ static int bpf_check_classic(const struct sock_filter *filter, - bool anc_found; - int pc; - -- if (flen == 0 || flen > BPF_MAXINSNS) -- return -EINVAL; -- - /* Check the filter code now */ - for (pc = 0; pc < flen; pc++) { - const struct sock_filter *ftest = &filter[pc]; -@@ -1057,7 +1065,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog) - struct bpf_prog *fp; - - /* Make sure new filter is there and in the right amounts. */ -- if (fprog->filter == NULL) -+ if (!bpf_check_basics_ok(fprog->filter, fprog->len)) - return -EINVAL; - - fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0); -@@ -1104,7 +1112,7 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog, - int err; - - /* Make sure new filter is there and in the right amounts. */ -- if (fprog->filter == NULL) -+ if (!bpf_check_basics_ok(fprog->filter, fprog->len)) - return -EINVAL; - - fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0); -@@ -1184,7 +1192,6 @@ int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, - bool locked) - { - unsigned int fsize = bpf_classic_proglen(fprog); -- unsigned int bpf_fsize = bpf_prog_size(fprog->len); - struct bpf_prog *prog; - int err; - -@@ -1192,10 +1199,10 @@ int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, - return -EPERM; - - /* Make sure new filter is there and in the right amounts. */ -- if (fprog->filter == NULL) -+ if (!bpf_check_basics_ok(fprog->filter, fprog->len)) - return -EINVAL; - -- prog = bpf_prog_alloc(bpf_fsize, 0); -+ prog = bpf_prog_alloc(bpf_prog_size(fprog->len), 0); - if (!prog) - return -ENOMEM; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index c11bb6d2d00a..6d5a0a7ebe10 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -475,6 +475,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) - to->pkt_type = from->pkt_type; - to->priority = from->priority; - to->protocol = from->protocol; -+ to->skb_iif = from->skb_iif; - skb_dst_drop(to); - skb_dst_copy(to, from); - to->dev = from->dev; -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index 4d3d4291c82f..e742323d69e1 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -167,6 +167,7 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb) - */ - static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) - { -+ int dif = inet_iif(skb); - struct sock *sk; - struct hlist_head *head; - int delivered = 0; -@@ -179,8 +180,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) - - net = dev_net(skb->dev); - sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol, -- iph->saddr, iph->daddr, -- skb->dev->ifindex); -+ iph->saddr, iph->daddr, dif); - - while (sk) { - delivered = 1; -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 1d580d290054..a58effba760a 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1162,25 +1162,39 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie) - return dst; - } - --static void ipv4_link_failure(struct sk_buff *skb) -+static void ipv4_send_dest_unreach(struct sk_buff *skb) - { - struct ip_options opt; -- struct rtable *rt; - int res; - - /* Recompile ip options since IPCB may not be valid anymore. -+ * Also check we have a reasonable ipv4 header. - */ -- memset(&opt, 0, sizeof(opt)); -- opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); -+ if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) || -+ ip_hdr(skb)->version != 4 || ip_hdr(skb)->ihl < 5) -+ return; - -- rcu_read_lock(); -- res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); -- rcu_read_unlock(); -+ memset(&opt, 0, sizeof(opt)); -+ if (ip_hdr(skb)->ihl > 5) { -+ if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4)) -+ return; -+ opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr); - -- if (res) -- return; -+ rcu_read_lock(); -+ res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL); -+ rcu_read_unlock(); - -+ if (res) -+ return; -+ } - __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt); -+} -+ -+static void ipv4_link_failure(struct sk_buff *skb) -+{ -+ struct rtable *rt; -+ -+ ipv4_send_dest_unreach(skb); - - rt = skb_rtable(skb); - if (rt) -diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c -index da90c74d12ef..167ca0fddf9e 100644 ---- a/net/ipv4/sysctl_net_ipv4.c -+++ b/net/ipv4/sysctl_net_ipv4.c -@@ -42,6 +42,7 @@ static int tcp_syn_retries_min = 1; - static int tcp_syn_retries_max = MAX_TCP_SYNCNT; - static int ip_ping_group_range_min[] = { 0, 0 }; - static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX }; -+static int one_day_secs = 24 * 3600; - - /* Update system visible IP port range */ - static void set_local_port_range(struct net *net, int range[2]) -@@ -597,7 +598,9 @@ static struct ctl_table ipv4_table[] = { - .data = &sysctl_tcp_min_rtt_wlen, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &zero, -+ .extra2 = &one_day_secs - }, - { - .procname = "tcp_low_latency", -diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c -index f3a0a9c0f61e..c6061f7343f1 100644 ---- a/net/ipv6/ip6_flowlabel.c -+++ b/net/ipv6/ip6_flowlabel.c -@@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label) - return fl; - } - -+static void fl_free_rcu(struct rcu_head *head) -+{ -+ struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu); -+ -+ if (fl->share == IPV6_FL_S_PROCESS) -+ put_pid(fl->owner.pid); -+ kfree(fl->opt); -+ kfree(fl); -+} -+ - - static void fl_free(struct ip6_flowlabel *fl) - { -- if (fl) { -- if (fl->share == IPV6_FL_S_PROCESS) -- put_pid(fl->owner.pid); -- kfree(fl->opt); -- kfree_rcu(fl, rcu); -- } -+ if (fl) -+ call_rcu(&fl->rcu, fl_free_rcu); - } - - static void fl_release(struct ip6_flowlabel *fl) -@@ -633,9 +639,9 @@ recheck: - if (fl1->share == IPV6_FL_S_EXCL || - fl1->share != fl->share || - ((fl1->share == IPV6_FL_S_PROCESS) && -- (fl1->owner.pid == fl->owner.pid)) || -+ (fl1->owner.pid != fl->owner.pid)) || - ((fl1->share == IPV6_FL_S_USER) && -- uid_eq(fl1->owner.uid, fl->owner.uid))) -+ !uid_eq(fl1->owner.uid, fl->owner.uid))) - goto release; - - err = -ENOMEM; -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 8d11a034ca3f..71263754b19b 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -121,6 +121,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk, - static bool setsockopt_needs_rtnl(int optname) - { - switch (optname) { -+ case IPV6_ADDRFORM: - case IPV6_ADD_MEMBERSHIP: - case IPV6_DROP_MEMBERSHIP: - case IPV6_JOIN_ANYCAST: -@@ -199,7 +200,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, - } - - fl6_free_socklist(sk); -- ipv6_sock_mc_close(sk); -+ __ipv6_sock_mc_close(sk); - - /* - * Sock is moving from IPv6 to IPv4 (sk_prot), so -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index a5ec9a0cbb80..976c8133a281 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -276,16 +276,14 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net, - return idev; - } - --void ipv6_sock_mc_close(struct sock *sk) -+void __ipv6_sock_mc_close(struct sock *sk) - { - struct ipv6_pinfo *np = inet6_sk(sk); - struct ipv6_mc_socklist *mc_lst; - struct net *net = sock_net(sk); - -- if (!rcu_access_pointer(np->ipv6_mc_list)) -- return; -+ ASSERT_RTNL(); - -- rtnl_lock(); - while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) { - struct net_device *dev; - -@@ -303,8 +301,17 @@ void ipv6_sock_mc_close(struct sock *sk) - - atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc); - kfree_rcu(mc_lst, rcu); -- - } -+} -+ -+void ipv6_sock_mc_close(struct sock *sk) -+{ -+ struct ipv6_pinfo *np = inet6_sk(sk); -+ -+ if (!rcu_access_pointer(np->ipv6_mc_list)) -+ return; -+ rtnl_lock(); -+ __ipv6_sock_mc_close(sk); - rtnl_unlock(); - } - -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 77736190dc15..5039486c4f86 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1076,7 +1076,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev) - if (!tdev && tunnel->parms.link) - tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link); - -- if (tdev) { -+ if (tdev && !netif_is_l3_master(tdev)) { - int t_hlen = tunnel->hlen + sizeof(struct iphdr); - - dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr); -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index ac212542a217..c4509a10ce52 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -1484,7 +1484,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, - if (!cp) { - int v; - -- if (!sysctl_schedule_icmp(ipvs)) -+ if (ipip || !sysctl_schedule_icmp(ipvs)) - return NF_ACCEPT; - - if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph)) -diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index b6e72af15237..cdafbd38a456 100644 ---- a/net/netfilter/x_tables.c -+++ b/net/netfilter/x_tables.c -@@ -1699,7 +1699,7 @@ static int __init xt_init(void) - seqcount_init(&per_cpu(xt_recseq, i)); - } - -- xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL); -+ xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL); - if (!xt) - return -ENOMEM; - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 7d93228ba1e1..c78bcc13ebab 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2490,8 +2490,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - void *ph; - DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name); - bool need_wait = !(msg->msg_flags & MSG_DONTWAIT); -+ unsigned char *addr = NULL; - int tp_len, size_max; -- unsigned char *addr; - int len_sum = 0; - int status = TP_STATUS_AVAILABLE; - int hlen, tlen; -@@ -2511,10 +2511,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - sll_addr))) - goto out; - proto = saddr->sll_protocol; -- addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); -- if (addr && dev && saddr->sll_halen < dev->addr_len) -- goto out_put; -+ if (po->sk.sk_socket->type == SOCK_DGRAM) { -+ if (dev && msg->msg_namelen < dev->addr_len + -+ offsetof(struct sockaddr_ll, sll_addr)) -+ goto out_put; -+ addr = saddr->sll_addr; -+ } - } - - err = -ENXIO; -@@ -2652,7 +2655,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - struct sk_buff *skb; - struct net_device *dev; - __be16 proto; -- unsigned char *addr; -+ unsigned char *addr = NULL; - int err, reserve = 0; - struct sockcm_cookie sockc; - struct virtio_net_hdr vnet_hdr = { 0 }; -@@ -2672,7 +2675,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - if (likely(saddr == NULL)) { - dev = packet_cached_dev_get(po); - proto = po->num; -- addr = NULL; - } else { - err = -EINVAL; - if (msg->msg_namelen < sizeof(struct sockaddr_ll)) -@@ -2680,10 +2682,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) - goto out; - proto = saddr->sll_protocol; -- addr = saddr->sll_halen ? saddr->sll_addr : NULL; - dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); -- if (addr && dev && saddr->sll_halen < dev->addr_len) -- goto out_unlock; -+ if (sock->type == SOCK_DGRAM) { -+ if (dev && msg->msg_namelen < dev->addr_len + -+ offsetof(struct sockaddr_ll, sll_addr)) -+ goto out_unlock; -+ addr = saddr->sll_addr; -+ } - } - - err = -ENXIO; -@@ -4518,14 +4523,29 @@ static void __exit packet_exit(void) - - static int __init packet_init(void) - { -- int rc = proto_register(&packet_proto, 0); -+ int rc; - -- if (rc != 0) -+ rc = proto_register(&packet_proto, 0); -+ if (rc) - goto out; -+ rc = sock_register(&packet_family_ops); -+ if (rc) -+ goto out_proto; -+ rc = register_pernet_subsys(&packet_net_ops); -+ if (rc) -+ goto out_sock; -+ rc = register_netdevice_notifier(&packet_netdev_notifier); -+ if (rc) -+ goto out_pernet; - -- sock_register(&packet_family_ops); -- register_pernet_subsys(&packet_net_ops); -- register_netdevice_notifier(&packet_netdev_notifier); -+ return 0; -+ -+out_pernet: -+ unregister_pernet_subsys(&packet_net_ops); -+out_sock: -+ sock_unregister(PF_PACKET); -+out_proto: -+ proto_unregister(&packet_proto); - out: - return rc; - } -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index af17b00145e1..a8ab98b53a3a 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) - h->last_refresh = now; - } - -+static inline int cache_is_valid(struct cache_head *h); - static void cache_fresh_locked(struct cache_head *head, time_t expiry, - struct cache_detail *detail); - static void cache_fresh_unlocked(struct cache_head *head, -@@ -100,6 +101,8 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, - if (cache_is_expired(detail, tmp)) { - hlist_del_init(&tmp->cache_list); - detail->entries --; -+ if (cache_is_valid(tmp) == -EAGAIN) -+ set_bit(CACHE_NEGATIVE, &tmp->flags); - cache_fresh_locked(tmp, 0, detail); - freeme = tmp; - break; -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index e9653c42cdd1..8400211537a2 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -262,8 +262,14 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - if (msg->rep_type) - tipc_tlv_init(msg->rep, msg->rep_type); - -- if (cmd->header) -- (*cmd->header)(msg); -+ if (cmd->header) { -+ err = (*cmd->header)(msg); -+ if (err) { -+ kfree_skb(msg->rep); -+ msg->rep = NULL; -+ return err; -+ } -+ } - - arg = nlmsg_new(0, GFP_KERNEL); - if (!arg) { -@@ -382,7 +388,12 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd, - if (!bearer) - return -EMSGSIZE; - -- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); -+ len = TLV_GET_DATA_LEN(msg->req); -+ len -= offsetof(struct tipc_bearer_config, name); -+ if (len <= 0) -+ return -EINVAL; -+ -+ len = min_t(int, len, TIPC_MAX_BEARER_NAME); - if (!string_is_valid(b->name, len)) - return -EINVAL; - -@@ -727,7 +738,12 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd, - - lc = (struct tipc_link_config *)TLV_DATA(msg->req); - -- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ len = TLV_GET_DATA_LEN(msg->req); -+ len -= offsetof(struct tipc_link_config, name); -+ if (len <= 0) -+ return -EINVAL; -+ -+ len = min_t(int, len, TIPC_MAX_LINK_NAME); - if (!string_is_valid(lc->name, len)) - return -EINVAL; - -diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c -index d58de1dc5360..510049a7bd1d 100644 ---- a/scripts/kconfig/lxdialog/inputbox.c -+++ b/scripts/kconfig/lxdialog/inputbox.c -@@ -126,7 +126,8 @@ do_resize: - case KEY_DOWN: - break; - case KEY_BACKSPACE: -- case 127: -+ case 8: /* ^H */ -+ case 127: /* ^? */ - if (pos) { - wattrset(dialog, dlg.inputbox.atr); - if (input_x == 0) { -diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c -index d42d534a66cd..f7049e288e93 100644 ---- a/scripts/kconfig/nconf.c -+++ b/scripts/kconfig/nconf.c -@@ -1046,7 +1046,7 @@ static int do_match(int key, struct match_state *state, int *ans) - state->match_direction = FIND_NEXT_MATCH_UP; - *ans = get_mext_match(state->pattern, - state->match_direction); -- } else if (key == KEY_BACKSPACE || key == 127) { -+ } else if (key == KEY_BACKSPACE || key == 8 || key == 127) { - state->pattern[strlen(state->pattern)-1] = '\0'; - adj_match_dir(&state->match_direction); - } else -diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c -index 4b2f44c20caf..9a65035cf787 100644 ---- a/scripts/kconfig/nconf.gui.c -+++ b/scripts/kconfig/nconf.gui.c -@@ -439,7 +439,8 @@ int dialog_inputbox(WINDOW *main_window, - case KEY_F(F_EXIT): - case KEY_F(F_BACK): - break; -- case 127: -+ case 8: /* ^H */ -+ case 127: /* ^? */ - case KEY_BACKSPACE: - if (cursor_position > 0) { - memmove(&result[cursor_position-1], -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 99212ff6a568..ab2759d88bc6 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -396,22 +396,44 @@ static int may_context_mount_inode_relabel(u32 sid, - return rc; - } - --static int selinux_is_sblabel_mnt(struct super_block *sb) -+static int selinux_is_genfs_special_handling(struct super_block *sb) - { -- struct superblock_security_struct *sbsec = sb->s_security; -- -- return sbsec->behavior == SECURITY_FS_USE_XATTR || -- sbsec->behavior == SECURITY_FS_USE_TRANS || -- sbsec->behavior == SECURITY_FS_USE_TASK || -- sbsec->behavior == SECURITY_FS_USE_NATIVE || -- /* Special handling. Genfs but also in-core setxattr handler */ -- !strcmp(sb->s_type->name, "sysfs") || -+ /* Special handling. Genfs but also in-core setxattr handler */ -+ return !strcmp(sb->s_type->name, "sysfs") || - !strcmp(sb->s_type->name, "pstore") || - !strcmp(sb->s_type->name, "debugfs") || - !strcmp(sb->s_type->name, "tracefs") || - !strcmp(sb->s_type->name, "rootfs"); - } - -+static int selinux_is_sblabel_mnt(struct super_block *sb) -+{ -+ struct superblock_security_struct *sbsec = sb->s_security; -+ -+ /* -+ * IMPORTANT: Double-check logic in this function when adding a new -+ * SECURITY_FS_USE_* definition! -+ */ -+ BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7); -+ -+ switch (sbsec->behavior) { -+ case SECURITY_FS_USE_XATTR: -+ case SECURITY_FS_USE_TRANS: -+ case SECURITY_FS_USE_TASK: -+ case SECURITY_FS_USE_NATIVE: -+ return 1; -+ -+ case SECURITY_FS_USE_GENFS: -+ return selinux_is_genfs_special_handling(sb); -+ -+ /* Never allow relabeling on context mounts */ -+ case SECURITY_FS_USE_MNTPOINT: -+ case SECURITY_FS_USE_NONE: -+ default: -+ return 0; -+ } -+} -+ - static int sb_finish_set_opts(struct super_block *sb) - { - struct superblock_security_struct *sbsec = sb->s_security; -diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c -index 3670086b9227..f273533c6653 100644 ---- a/sound/soc/codecs/cs4270.c -+++ b/sound/soc/codecs/cs4270.c -@@ -641,6 +641,7 @@ static const struct regmap_config cs4270_regmap = { - .reg_defaults = cs4270_reg_defaults, - .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults), - .cache_type = REGCACHE_RBTREE, -+ .write_flag_mask = CS4270_I2C_INCR, - - .readable_reg = cs4270_reg_is_readable, - .volatile_reg = cs4270_reg_is_volatile, -diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c -index f2d3191961e1..714bd0e3fc71 100644 ---- a/sound/soc/codecs/tlv320aic32x4.c -+++ b/sound/soc/codecs/tlv320aic32x4.c -@@ -234,6 +234,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = { - SND_SOC_DAPM_INPUT("IN2_R"), - SND_SOC_DAPM_INPUT("IN3_L"), - SND_SOC_DAPM_INPUT("IN3_R"), -+ SND_SOC_DAPM_INPUT("CM_L"), -+ SND_SOC_DAPM_INPUT("CM_R"), - }; - - static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = { -diff --git a/sound/soc/intel/common/sst-dsp.c b/sound/soc/intel/common/sst-dsp.c -index c9452e02e0dd..c0a50ecb6dbd 100644 ---- a/sound/soc/intel/common/sst-dsp.c -+++ b/sound/soc/intel/common/sst-dsp.c -@@ -463,11 +463,15 @@ struct sst_dsp *sst_dsp_new(struct device *dev, - goto irq_err; - - err = sst_dma_new(sst); -- if (err) -- dev_warn(dev, "sst_dma_new failed %d\n", err); -+ if (err) { -+ dev_err(dev, "sst_dma_new failed %d\n", err); -+ goto dma_err; -+ } - - return sst; - -+dma_err: -+ free_irq(sst->irq, sst); - irq_err: - if (sst->ops->free) - sst->ops->free(sst); -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index f99eb8f44282..1c0d44c86c01 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -882,10 +882,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream, - codec_params = *params; - - /* fixup params based on TDM slot masks */ -- if (codec_dai->tx_mask) -+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && -+ codec_dai->tx_mask) - soc_pcm_codec_params_fixup(&codec_params, - codec_dai->tx_mask); -- if (codec_dai->rx_mask) -+ -+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE && -+ codec_dai->rx_mask) - soc_pcm_codec_params_fixup(&codec_params, - codec_dai->rx_mask); - -diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index be78078a10ba..954dc4423cb0 100644 ---- a/sound/usb/line6/driver.c -+++ b/sound/usb/line6/driver.c -@@ -307,12 +307,16 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - { - struct usb_device *usbdev = line6->usbdev; - int ret; -- unsigned char len; -+ unsigned char *len; - unsigned count; - - if (address > 0xffff || datalen > 0xff) - return -EINVAL; - -+ len = kmalloc(sizeof(*len), GFP_KERNEL); -+ if (!len) -+ return -ENOMEM; -+ - /* query the serial number: */ - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -@@ -321,7 +325,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - - if (ret < 0) { - dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); -- return ret; -+ goto exit; - } - - /* Wait for data length. We'll get 0xff until length arrives. */ -@@ -331,28 +335,29 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | - USB_DIR_IN, -- 0x0012, 0x0000, &len, 1, -+ 0x0012, 0x0000, len, 1, - LINE6_TIMEOUT * HZ); - if (ret < 0) { - dev_err(line6->ifcdev, - "receive length failed (error %d)\n", ret); -- return ret; -+ goto exit; - } - -- if (len != 0xff) -+ if (*len != 0xff) - break; - } - -- if (len == 0xff) { -+ ret = -EIO; -+ if (*len == 0xff) { - dev_err(line6->ifcdev, "read failed after %d retries\n", - count); -- return -EIO; -- } else if (len != datalen) { -+ goto exit; -+ } else if (*len != datalen) { - /* should be equal or something went wrong */ - dev_err(line6->ifcdev, - "length mismatch (expected %d, got %d)\n", -- (int)datalen, (int)len); -- return -EIO; -+ (int)datalen, (int)*len); -+ goto exit; - } - - /* receive the result: */ -@@ -361,12 +366,12 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - 0x0013, 0x0000, data, datalen, - LINE6_TIMEOUT * HZ); - -- if (ret < 0) { -+ if (ret < 0) - dev_err(line6->ifcdev, "read failed (error %d)\n", ret); -- return ret; -- } - -- return 0; -+exit: -+ kfree(len); -+ return ret; - } - EXPORT_SYMBOL_GPL(line6_read_data); - -@@ -378,12 +383,16 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, - { - struct usb_device *usbdev = line6->usbdev; - int ret; -- unsigned char status; -+ unsigned char *status; - int count; - - if (address > 0xffff || datalen > 0xffff) - return -EINVAL; - -+ status = kmalloc(sizeof(*status), GFP_KERNEL); -+ if (!status) -+ return -ENOMEM; -+ - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - 0x0022, address, data, datalen, -@@ -392,7 +401,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, - if (ret < 0) { - dev_err(line6->ifcdev, - "write request failed (error %d)\n", ret); -- return ret; -+ goto exit; - } - - for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) { -@@ -403,28 +412,29 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | - USB_DIR_IN, - 0x0012, 0x0000, -- &status, 1, LINE6_TIMEOUT * HZ); -+ status, 1, LINE6_TIMEOUT * HZ); - - if (ret < 0) { - dev_err(line6->ifcdev, - "receiving status failed (error %d)\n", ret); -- return ret; -+ goto exit; - } - -- if (status != 0xff) -+ if (*status != 0xff) - break; - } - -- if (status == 0xff) { -+ if (*status == 0xff) { - dev_err(line6->ifcdev, "write failed after %d retries\n", - count); -- return -EIO; -- } else if (status != 0) { -+ ret = -EIO; -+ } else if (*status != 0) { - dev_err(line6->ifcdev, "write failed (error %d)\n", ret); -- return -EIO; -+ ret = -EIO; - } -- -- return 0; -+exit: -+ kfree(status); -+ return ret; - } - EXPORT_SYMBOL_GPL(line6_write_data); - -diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c -index 6d4c50c9b17d..5512b3d532e7 100644 ---- a/sound/usb/line6/toneport.c -+++ b/sound/usb/line6/toneport.c -@@ -365,15 +365,20 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport) - /* - Setup Toneport device. - */ --static void toneport_setup(struct usb_line6_toneport *toneport) -+static int toneport_setup(struct usb_line6_toneport *toneport) - { -- int ticks; -+ int *ticks; - struct usb_line6 *line6 = &toneport->line6; - struct usb_device *usbdev = line6->usbdev; - -+ ticks = kmalloc(sizeof(*ticks), GFP_KERNEL); -+ if (!ticks) -+ return -ENOMEM; -+ - /* sync time on device with host: */ -- ticks = (int)get_seconds(); -- line6_write_data(line6, 0x80c6, &ticks, 4); -+ *ticks = (int)get_seconds(); -+ line6_write_data(line6, 0x80c6, ticks, 4); -+ kfree(ticks); - - /* enable device: */ - toneport_send_cmd(usbdev, 0x0301, 0x0000); -@@ -388,6 +393,7 @@ static void toneport_setup(struct usb_line6_toneport *toneport) - toneport_update_led(toneport); - - mod_timer(&toneport->timer, jiffies + TONEPORT_PCM_DELAY * HZ); -+ return 0; - } - - /* -@@ -451,7 +457,9 @@ static int toneport_init(struct usb_line6 *line6, - return err; - } - -- toneport_setup(toneport); -+ err = toneport_setup(toneport); -+ if (err) -+ return err; - - /* register audio system: */ - return snd_card_register(line6->card); -@@ -463,7 +471,11 @@ static int toneport_init(struct usb_line6 *line6, - */ - static int toneport_reset_resume(struct usb_interface *interface) - { -- toneport_setup(usb_get_intfdata(interface)); -+ int err; -+ -+ err = toneport_setup(usb_get_intfdata(interface)); -+ if (err) -+ return err; - return line6_resume(interface); - } - #endif -diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c -index 743746a3c50d..df3c73e9dea4 100644 ---- a/tools/lib/traceevent/event-parse.c -+++ b/tools/lib/traceevent/event-parse.c -@@ -2201,7 +2201,7 @@ eval_type_str(unsigned long long val, const char *type, int pointer) - return val & 0xffffffff; - - if (strcmp(type, "u64") == 0 || -- strcmp(type, "s64")) -+ strcmp(type, "s64") == 0) - return val; - - if (strcmp(type, "s8") == 0) -diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile -index e367b1a85d70..3c04e2a85599 100644 ---- a/tools/power/x86/turbostat/Makefile -+++ b/tools/power/x86/turbostat/Makefile -@@ -8,7 +8,7 @@ ifeq ("$(origin O)", "command line") - endif - - turbostat : turbostat.c --CFLAGS += -Wall -+CFLAGS += -Wall -I../../../include - CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"' - - %: %.c -diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests -index 16058bbea7a8..c195b4478662 100755 ---- a/tools/testing/selftests/net/run_netsocktests -+++ b/tools/testing/selftests/net/run_netsocktests -@@ -6,7 +6,7 @@ echo "--------------------" - ./socket - if [ $? -ne 0 ]; then - echo "[FAIL]" -+ exit 1 - else - echo "[PASS]" - fi -- diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.180-181.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.180-181.patch deleted file mode 100644 index 2d29576fab7b..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.180-181.patch +++ /dev/null @@ -1,8285 +0,0 @@ -diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst -index 534e9baa4e1d..5d4330be200f 100644 ---- a/Documentation/x86/mds.rst -+++ b/Documentation/x86/mds.rst -@@ -142,45 +142,13 @@ Mitigation points - mds_user_clear. - - The mitigation is invoked in prepare_exit_to_usermode() which covers -- most of the kernel to user space transitions. There are a few exceptions -- which are not invoking prepare_exit_to_usermode() on return to user -- space. These exceptions use the paranoid exit code. -+ all but one of the kernel to user space transitions. The exception -+ is when we return from a Non Maskable Interrupt (NMI), which is -+ handled directly in do_nmi(). - -- - Non Maskable Interrupt (NMI): -- -- Access to sensible data like keys, credentials in the NMI context is -- mostly theoretical: The CPU can do prefetching or execute a -- misspeculated code path and thereby fetching data which might end up -- leaking through a buffer. -- -- But for mounting other attacks the kernel stack address of the task is -- already valuable information. So in full mitigation mode, the NMI is -- mitigated on the return from do_nmi() to provide almost complete -- coverage. -- -- - Double fault (#DF): -- -- A double fault is usually fatal, but the ESPFIX workaround, which can -- be triggered from user space through modify_ldt(2) is a recoverable -- double fault. #DF uses the paranoid exit path, so explicit mitigation -- in the double fault handler is required. -- -- - Machine Check Exception (#MC): -- -- Another corner case is a #MC which hits between the CPU buffer clear -- invocation and the actual return to user. As this still is in kernel -- space it takes the paranoid exit path which does not clear the CPU -- buffers. So the #MC handler repopulates the buffers to some -- extent. Machine checks are not reliably controllable and the window is -- extremly small so mitigation would just tick a checkbox that this -- theoretical corner case is covered. To keep the amount of special -- cases small, ignore #MC. -- -- - Debug Exception (#DB): -- -- This takes the paranoid exit path only when the INT1 breakpoint is in -- kernel space. #DB on a user space address takes the regular exit path, -- so no extra mitigation required. -+ (The reason that NMI is special is that prepare_exit_to_usermode() can -+ enable IRQs. In NMI context, NMIs are blocked, and we don't want to -+ enable IRQs with NMIs blocked.) - - - 2. C-State transition -diff --git a/Makefile b/Makefile -index 6023a9dbad59..b33f3ecf84fc 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 180 -+SUBLEVEL = 181 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/crypto/aesbs-glue.c b/arch/arm/crypto/aesbs-glue.c -index 648d5fac9cbf..3271c836e1a1 100644 ---- a/arch/arm/crypto/aesbs-glue.c -+++ b/arch/arm/crypto/aesbs-glue.c -@@ -259,6 +259,8 @@ static int aesbs_xts_encrypt(struct blkcipher_desc *desc, - - blkcipher_walk_init(&walk, dst, src, nbytes); - err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE); -+ if (err) -+ return err; - - /* generate the initial tweak */ - AES_encrypt(walk.iv, walk.iv, &ctx->twkey); -@@ -283,6 +285,8 @@ static int aesbs_xts_decrypt(struct blkcipher_desc *desc, - - blkcipher_walk_init(&walk, dst, src, nbytes); - err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE); -+ if (err) -+ return err; - - /* generate the initial tweak */ - AES_encrypt(walk.iv, walk.iv, &ctx->twkey); -diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c -index d7bef2144760..e96ddc599c30 100644 ---- a/arch/arm/kvm/arm.c -+++ b/arch/arm/kvm/arm.c -@@ -744,7 +744,7 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_level, - static int kvm_vcpu_set_target(struct kvm_vcpu *vcpu, - const struct kvm_vcpu_init *init) - { -- unsigned int i; -+ unsigned int i, ret; - int phys_target = kvm_target_cpu(); - - if (init->target != phys_target) -@@ -779,9 +779,14 @@ static int kvm_vcpu_set_target(struct kvm_vcpu *vcpu, - vcpu->arch.target = phys_target; - - /* Now we know what it is, we can reset it. */ -- return kvm_reset_vcpu(vcpu); --} -+ ret = kvm_reset_vcpu(vcpu); -+ if (ret) { -+ vcpu->arch.target = -1; -+ bitmap_zero(vcpu->arch.features, KVM_VCPU_MAX_FEATURES); -+ } - -+ return ret; -+} - - static int kvm_arch_vcpu_ioctl_vcpu_init(struct kvm_vcpu *vcpu, - struct kvm_vcpu_init *init) -diff --git a/arch/arm/mach-exynos/firmware.c b/arch/arm/mach-exynos/firmware.c -index 111cfbf66fdb..7bfe2bd17400 100644 ---- a/arch/arm/mach-exynos/firmware.c -+++ b/arch/arm/mach-exynos/firmware.c -@@ -207,6 +207,7 @@ void __init exynos_firmware_init(void) - return; - - addr = of_get_address(nd, 0, NULL, NULL); -+ of_node_put(nd); - if (!addr) { - pr_err("%s: No address specified.\n", __func__); - return; -diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c -index e8adb428dddb..a003833ac112 100644 ---- a/arch/arm/mach-exynos/suspend.c -+++ b/arch/arm/mach-exynos/suspend.c -@@ -725,8 +725,10 @@ void __init exynos_pm_init(void) - - if (WARN_ON(!of_find_property(np, "interrupt-controller", NULL))) { - pr_warn("Outdated DT detected, suspend/resume will NOT work\n"); -+ of_node_put(np); - return; - } -+ of_node_put(np); - - pm_data = (const struct exynos_pm_data *) match->data; - -diff --git a/arch/arm64/kernel/cpu_ops.c b/arch/arm64/kernel/cpu_ops.c -index b6bd7d447768..fbd6aead48e1 100644 ---- a/arch/arm64/kernel/cpu_ops.c -+++ b/arch/arm64/kernel/cpu_ops.c -@@ -73,6 +73,7 @@ static const char *__init cpu_read_enable_method(int cpu) - pr_err("%s: missing enable-method property\n", - dn->full_name); - } -+ of_node_put(dn); - } else { - enable_method = acpi_get_enable_method(cpu); - if (!enable_method) -diff --git a/arch/mips/pistachio/Platform b/arch/mips/pistachio/Platform -index d80cd612df1f..c3592b374ad2 100644 ---- a/arch/mips/pistachio/Platform -+++ b/arch/mips/pistachio/Platform -@@ -6,3 +6,4 @@ cflags-$(CONFIG_MACH_PISTACHIO) += \ - -I$(srctree)/arch/mips/include/asm/mach-pistachio - load-$(CONFIG_MACH_PISTACHIO) += 0xffffffff80400000 - zload-$(CONFIG_MACH_PISTACHIO) += 0xffffffff81000000 -+all-$(CONFIG_MACH_PISTACHIO) := uImage.gz -diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c -index 9d9f6f334d3c..3da3e2b1b51b 100644 ---- a/arch/powerpc/boot/addnote.c -+++ b/arch/powerpc/boot/addnote.c -@@ -223,7 +223,11 @@ main(int ac, char **av) - PUT_16(E_PHNUM, np + 2); - - /* write back */ -- lseek(fd, (long) 0, SEEK_SET); -+ i = lseek(fd, (long) 0, SEEK_SET); -+ if (i < 0) { -+ perror("lseek"); -+ exit(1); -+ } - i = write(fd, buf, n); - if (i < 0) { - perror("write"); -diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c -index bb3df222ae71..215bff2b8470 100644 ---- a/arch/powerpc/mm/numa.c -+++ b/arch/powerpc/mm/numa.c -@@ -1611,6 +1611,9 @@ int start_topology_update(void) - { - int rc = 0; - -+ if (!topology_updates_enabled) -+ return 0; -+ - if (firmware_has_feature(FW_FEATURE_PRRN)) { - if (!prrn_enabled) { - prrn_enabled = 1; -@@ -1640,6 +1643,9 @@ int stop_topology_update(void) - { - int rc = 0; - -+ if (!topology_updates_enabled) -+ return 0; -+ - if (prrn_enabled) { - prrn_enabled = 0; - #ifdef CONFIG_SMP -@@ -1685,11 +1691,13 @@ static ssize_t topology_write(struct file *file, const char __user *buf, - - kbuf[read_len] = '\0'; - -- if (!strncmp(kbuf, "on", 2)) -+ if (!strncmp(kbuf, "on", 2)) { -+ topology_updates_enabled = true; - start_topology_update(); -- else if (!strncmp(kbuf, "off", 3)) -+ } else if (!strncmp(kbuf, "off", 3)) { - stop_topology_update(); -- else -+ topology_updates_enabled = false; -+ } else - return -EINVAL; - - return count; -@@ -1704,9 +1712,7 @@ static const struct file_operations topology_ops = { - - static int topology_update_init(void) - { -- /* Do not poll for changes if disabled at boot */ -- if (topology_updates_enabled) -- start_topology_update(); -+ start_topology_update(); - - if (!proc_create("powerpc/topology_updates", 0644, NULL, &topology_ops)) - return -ENOMEM; -diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S -index fcf4d27a38fb..e09f7b440b8c 100644 ---- a/arch/sparc/mm/ultra.S -+++ b/arch/sparc/mm/ultra.S -@@ -586,7 +586,7 @@ xcall_flush_tlb_kernel_range: /* 44 insns */ - sub %g7, %g1, %g3 - srlx %g3, 18, %g2 - brnz,pn %g2, 2f -- add %g2, 1, %g2 -+ sethi %hi(PAGE_SIZE), %g2 - sub %g3, %g2, %g3 - or %g1, 0x20, %g1 ! Nucleus - 1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP -@@ -750,7 +750,7 @@ __cheetah_xcall_flush_tlb_kernel_range: /* 44 insns */ - sub %g7, %g1, %g3 - srlx %g3, 18, %g2 - brnz,pn %g2, 2f -- add %g2, 1, %g2 -+ sethi %hi(PAGE_SIZE), %g2 - sub %g3, %g2, %g3 - or %g1, 0x20, %g1 ! Nucleus - 1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP -diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index e26560cd1844..00e0226634fa 100644 ---- a/arch/x86/Makefile -+++ b/arch/x86/Makefile -@@ -47,7 +47,7 @@ export REALMODE_CFLAGS - export BITS - - ifdef CONFIG_X86_NEED_RELOCS -- LDFLAGS_vmlinux := --emit-relocs -+ LDFLAGS_vmlinux := --emit-relocs --discard-none - endif - - # -diff --git a/arch/x86/crypto/crct10dif-pclmul_glue.c b/arch/x86/crypto/crct10dif-pclmul_glue.c -index cd4df9322501..7bbfe7d35da7 100644 ---- a/arch/x86/crypto/crct10dif-pclmul_glue.c -+++ b/arch/x86/crypto/crct10dif-pclmul_glue.c -@@ -76,15 +76,14 @@ static int chksum_final(struct shash_desc *desc, u8 *out) - return 0; - } - --static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len, -- u8 *out) -+static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out) - { - if (irq_fpu_usable()) { - kernel_fpu_begin(); -- *(__u16 *)out = crc_t10dif_pcl(*crcp, data, len); -+ *(__u16 *)out = crc_t10dif_pcl(crc, data, len); - kernel_fpu_end(); - } else -- *(__u16 *)out = crc_t10dif_generic(*crcp, data, len); -+ *(__u16 *)out = crc_t10dif_generic(crc, data, len); - return 0; - } - -@@ -93,15 +92,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data, - { - struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); - -- return __chksum_finup(&ctx->crc, data, len, out); -+ return __chksum_finup(ctx->crc, data, len, out); - } - - static int chksum_digest(struct shash_desc *desc, const u8 *data, - unsigned int length, u8 *out) - { -- struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); -- -- return __chksum_finup(&ctx->crc, data, length, out); -+ return __chksum_finup(0, data, length, out); - } - - static struct shash_alg alg = { -diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c -index 0552884da18d..a7b9acd709db 100644 ---- a/arch/x86/ia32/ia32_signal.c -+++ b/arch/x86/ia32/ia32_signal.c -@@ -60,9 +60,8 @@ - } while (0) - - #define RELOAD_SEG(seg) { \ -- unsigned int pre = GET_SEG(seg); \ -+ unsigned int pre = (seg) | 3; \ - unsigned int cur = get_user_seg(seg); \ -- pre |= 3; \ - if (pre != cur) \ - set_user_seg(seg, pre); \ - } -@@ -71,6 +70,7 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, - struct sigcontext_32 __user *sc) - { - unsigned int tmpflags, err = 0; -+ u16 gs, fs, es, ds; - void __user *buf; - u32 tmp; - -@@ -78,16 +78,10 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, - current->restart_block.fn = do_no_restart_syscall; - - get_user_try { -- /* -- * Reload fs and gs if they have changed in the signal -- * handler. This does not handle long fs/gs base changes in -- * the handler, but does not clobber them at least in the -- * normal case. -- */ -- RELOAD_SEG(gs); -- RELOAD_SEG(fs); -- RELOAD_SEG(ds); -- RELOAD_SEG(es); -+ gs = GET_SEG(gs); -+ fs = GET_SEG(fs); -+ ds = GET_SEG(ds); -+ es = GET_SEG(es); - - COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx); - COPY(dx); COPY(cx); COPY(ip); COPY(ax); -@@ -105,6 +99,17 @@ static int ia32_restore_sigcontext(struct pt_regs *regs, - buf = compat_ptr(tmp); - } get_user_catch(err); - -+ /* -+ * Reload fs and gs if they have changed in the signal -+ * handler. This does not handle long fs/gs base changes in -+ * the handler, but does not clobber them at least in the -+ * normal case. -+ */ -+ RELOAD_SEG(gs); -+ RELOAD_SEG(fs); -+ RELOAD_SEG(ds); -+ RELOAD_SEG(es); -+ - err |= fpu__restore_sig(buf, 1); - - force_iret(); -diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c -index 206d0b90a3ab..e39d7197f9fb 100644 ---- a/arch/x86/kernel/irq_64.c -+++ b/arch/x86/kernel/irq_64.c -@@ -25,9 +25,18 @@ int sysctl_panic_on_stackoverflow; - /* - * Probabilistic stack overflow check: - * -- * Only check the stack in process context, because everything else -- * runs on the big interrupt stacks. Checking reliably is too expensive, -- * so we just check from interrupts. -+ * Regular device interrupts can enter on the following stacks: -+ * -+ * - User stack -+ * -+ * - Kernel task stack -+ * -+ * - Interrupt stack if a device driver reenables interrupts -+ * which should only happen in really old drivers. -+ * -+ * - Debug IST stack -+ * -+ * All other contexts are invalid. - */ - static inline void stack_overflow_check(struct pt_regs *regs) - { -@@ -53,8 +62,8 @@ static inline void stack_overflow_check(struct pt_regs *regs) - return; - - oist = this_cpu_ptr(&orig_ist); -- estack_top = (u64)oist->ist[0] - EXCEPTION_STKSZ + STACK_TOP_MARGIN; -- estack_bottom = (u64)oist->ist[N_EXCEPTION_STACKS - 1]; -+ estack_bottom = (u64)oist->ist[DEBUG_STACK]; -+ estack_top = estack_bottom - DEBUG_STKSZ + STACK_TOP_MARGIN; - if (regs->sp >= estack_top && regs->sp <= estack_bottom) - return; - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index d830a0d60ba4..516d8b1562c8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -990,11 +990,8 @@ static u32 emulated_msrs[] = { - - static unsigned num_emulated_msrs; - --bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) -+static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) - { -- if (efer & efer_reserved_bits) -- return false; -- - if (efer & EFER_FFXSR) { - struct kvm_cpuid_entry2 *feat; - -@@ -1012,19 +1009,33 @@ bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) - } - - return true; -+ -+} -+bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) -+{ -+ if (efer & efer_reserved_bits) -+ return false; -+ -+ return __kvm_valid_efer(vcpu, efer); - } - EXPORT_SYMBOL_GPL(kvm_valid_efer); - --static int set_efer(struct kvm_vcpu *vcpu, u64 efer) -+static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - { - u64 old_efer = vcpu->arch.efer; -+ u64 efer = msr_info->data; - -- if (!kvm_valid_efer(vcpu, efer)) -+ if (efer & efer_reserved_bits) - return 1; - -- if (is_paging(vcpu) -- && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) -- return 1; -+ if (!msr_info->host_initiated) { -+ if (!__kvm_valid_efer(vcpu, efer)) -+ return 1; -+ -+ if (is_paging(vcpu) && -+ (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME)) -+ return 1; -+ } - - efer &= ~EFER_LMA; - efer |= vcpu->arch.efer & EFER_LMA; -@@ -2055,7 +2066,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - break; - - case MSR_EFER: -- return set_efer(vcpu, data); -+ return set_efer(vcpu, msr_info); - case MSR_K7_HWCR: - data &= ~(u64)0x40; /* ignore flush filter disable */ - data &= ~(u64)0x100; /* ignore ignne emulation enable */ -diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index c4dffae5d939..462c5c30b9a2 100644 ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -373,8 +373,6 @@ static noinline int vmalloc_fault(unsigned long address) - if (!(address >= VMALLOC_START && address < VMALLOC_END)) - return -1; - -- WARN_ON_ONCE(in_nmi()); -- - /* - * Copy kernel mappings over when needed. This can also - * happen within a race in page table update. In the later -diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c -index 0214600ba071..6c4724222e3a 100644 ---- a/crypto/chacha20poly1305.c -+++ b/crypto/chacha20poly1305.c -@@ -637,8 +637,8 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, - - err = -ENAMETOOLONG; - if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, -- "%s(%s,%s)", name, chacha_name, -- poly_name) >= CRYPTO_MAX_ALG_NAME) -+ "%s(%s,%s)", name, chacha->cra_name, -+ poly->cra_name) >= CRYPTO_MAX_ALG_NAME) - goto out_drop_chacha; - if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, - "%s(%s,%s)", name, chacha->cra_driver_name, -diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c -index c1229614c7e3..eed577714975 100644 ---- a/crypto/crct10dif_generic.c -+++ b/crypto/crct10dif_generic.c -@@ -65,10 +65,9 @@ static int chksum_final(struct shash_desc *desc, u8 *out) - return 0; - } - --static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len, -- u8 *out) -+static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out) - { -- *(__u16 *)out = crc_t10dif_generic(*crcp, data, len); -+ *(__u16 *)out = crc_t10dif_generic(crc, data, len); - return 0; - } - -@@ -77,15 +76,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data, - { - struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); - -- return __chksum_finup(&ctx->crc, data, len, out); -+ return __chksum_finup(ctx->crc, data, len, out); - } - - static int chksum_digest(struct shash_desc *desc, const u8 *data, - unsigned int length, u8 *out) - { -- struct chksum_desc_ctx *ctx = shash_desc_ctx(desc); -- -- return __chksum_finup(&ctx->crc, data, length, out); -+ return __chksum_finup(0, data, length, out); - } - - static struct shash_alg alg = { -diff --git a/crypto/gcm.c b/crypto/gcm.c -index 0a12c09d7cb2..9d3bffc0238f 100644 ---- a/crypto/gcm.c -+++ b/crypto/gcm.c -@@ -616,7 +616,6 @@ static void crypto_gcm_free(struct aead_instance *inst) - - static int crypto_gcm_create_common(struct crypto_template *tmpl, - struct rtattr **tb, -- const char *full_name, - const char *ctr_name, - const char *ghash_name) - { -@@ -657,7 +656,8 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl, - goto err_free_inst; - - err = -EINVAL; -- if (ghash->digestsize != 16) -+ if (strcmp(ghash->base.cra_name, "ghash") != 0 || -+ ghash->digestsize != 16) - goto err_drop_ghash; - - crypto_set_skcipher_spawn(&ctx->ctr, aead_crypto_instance(inst)); -@@ -669,24 +669,24 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl, - - ctr = crypto_skcipher_spawn_alg(&ctx->ctr); - -- /* We only support 16-byte blocks. */ -- if (ctr->cra_ablkcipher.ivsize != 16) -- goto out_put_ctr; -- -- /* Not a stream cipher? */ -+ /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */ - err = -EINVAL; -- if (ctr->cra_blocksize != 1) -+ if (strncmp(ctr->cra_name, "ctr(", 4) != 0 || -+ ctr->cra_ablkcipher.ivsize != 16 || -+ ctr->cra_blocksize != 1) - goto out_put_ctr; - - err = -ENAMETOOLONG; -+ if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME, -+ "gcm(%s", ctr->cra_name + 4) >= CRYPTO_MAX_ALG_NAME) -+ goto out_put_ctr; -+ - if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME, - "gcm_base(%s,%s)", ctr->cra_driver_name, - ghash_alg->cra_driver_name) >= - CRYPTO_MAX_ALG_NAME) - goto out_put_ctr; - -- memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME); -- - inst->alg.base.cra_flags = (ghash->base.cra_flags | ctr->cra_flags) & - CRYPTO_ALG_ASYNC; - inst->alg.base.cra_priority = (ghash->base.cra_priority + -@@ -727,7 +727,6 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb) - { - const char *cipher_name; - char ctr_name[CRYPTO_MAX_ALG_NAME]; -- char full_name[CRYPTO_MAX_ALG_NAME]; - - cipher_name = crypto_attr_alg_name(tb[1]); - if (IS_ERR(cipher_name)) -@@ -737,12 +736,7 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb) - CRYPTO_MAX_ALG_NAME) - return -ENAMETOOLONG; - -- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm(%s)", cipher_name) >= -- CRYPTO_MAX_ALG_NAME) -- return -ENAMETOOLONG; -- -- return crypto_gcm_create_common(tmpl, tb, full_name, -- ctr_name, "ghash"); -+ return crypto_gcm_create_common(tmpl, tb, ctr_name, "ghash"); - } - - static struct crypto_template crypto_gcm_tmpl = { -@@ -756,7 +750,6 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl, - { - const char *ctr_name; - const char *ghash_name; -- char full_name[CRYPTO_MAX_ALG_NAME]; - - ctr_name = crypto_attr_alg_name(tb[1]); - if (IS_ERR(ctr_name)) -@@ -766,12 +759,7 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl, - if (IS_ERR(ghash_name)) - return PTR_ERR(ghash_name); - -- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)", -- ctr_name, ghash_name) >= CRYPTO_MAX_ALG_NAME) -- return -ENAMETOOLONG; -- -- return crypto_gcm_create_common(tmpl, tb, full_name, -- ctr_name, ghash_name); -+ return crypto_gcm_create_common(tmpl, tb, ctr_name, ghash_name); - } - - static struct crypto_template crypto_gcm_base_tmpl = { -diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c -index d7da0eea5622..319d9962552e 100644 ---- a/crypto/salsa20_generic.c -+++ b/crypto/salsa20_generic.c -@@ -186,7 +186,7 @@ static int encrypt(struct blkcipher_desc *desc, - blkcipher_walk_init(&walk, dst, src, nbytes); - err = blkcipher_walk_virt_block(desc, &walk, 64); - -- salsa20_ivsetup(ctx, walk.iv); -+ salsa20_ivsetup(ctx, desc->info); - - while (walk.nbytes >= 64) { - salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 05409141ec07..8efdb823826c 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1378,6 +1378,10 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) - if (dev->power.syscore) - goto Complete; - -+ /* Avoid direct_complete to let wakeup_path propagate. */ -+ if (device_may_wakeup(dev) || dev->power.wakeup_path) -+ dev->power.direct_complete = false; -+ - if (dev->power.direct_complete) { - if (pm_runtime_status_suspended(dev)) { - pm_runtime_disable(dev); -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index b2da2382d544..67d23ed2d1a0 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -695,12 +695,16 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - /* End of read */ - len = ssif_info->multi_len; - data = ssif_info->data; -- } else if (blocknum != ssif_info->multi_pos) { -+ } else if (blocknum + 1 != ssif_info->multi_pos) { - /* - * Out of sequence block, just abort. Block - * numbers start at zero for the second block, - * but multi_pos starts at one, so the +1. - */ -+ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) -+ dev_dbg(&ssif_info->client->dev, -+ "Received message out of sequence, expected %u, got %u\n", -+ ssif_info->multi_pos - 1, blocknum); - result = -EIO; - } else { - ssif_inc_stat(ssif_info, received_message_parts); -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 2aca689061e1..df9eab91c2d2 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -76,7 +76,7 @@ struct ports_driver_data { - /* All the console devices handled by this driver */ - struct list_head consoles; - }; --static struct ports_driver_data pdrvdata; -+static struct ports_driver_data pdrvdata = { .next_vtermno = 1}; - - static DEFINE_SPINLOCK(pdrvdata_lock); - static DECLARE_COMPLETION(early_console_added); -@@ -1419,6 +1419,7 @@ static int add_port(struct ports_device *portdev, u32 id) - port->async_queue = NULL; - - port->cons.ws.ws_row = port->cons.ws.ws_col = 0; -+ port->cons.vtermno = 0; - - port->host_connected = port->guest_connected = false; - port->stats = (struct port_stats) { 0 }; -diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c -index d6d4ecb88e94..311f6e62264f 100644 ---- a/drivers/clk/tegra/clk-pll.c -+++ b/drivers/clk/tegra/clk-pll.c -@@ -492,8 +492,8 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll, - pll_override_writel(val, params->pmc_divp_reg, pll); - - val = pll_override_readl(params->pmc_divnm_reg, pll); -- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) | -- ~(divn_mask(pll) << div_nmp->override_divn_shift); -+ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) | -+ (divn_mask(pll) << div_nmp->override_divn_shift)); - val |= (cfg->m << div_nmp->override_divm_shift) | - (cfg->n << div_nmp->override_divn_shift); - pll_override_writel(val, params->pmc_divnm_reg, pll); -diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c -index 35dd4d7ffee0..58c933f48300 100644 ---- a/drivers/cpufreq/pasemi-cpufreq.c -+++ b/drivers/cpufreq/pasemi-cpufreq.c -@@ -146,6 +146,7 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) - - cpu = of_get_cpu_node(policy->cpu, NULL); - -+ of_node_put(cpu); - if (!cpu) - goto out; - -diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c -index 1f49d97a70ea..14928e0dc326 100644 ---- a/drivers/cpufreq/pmac32-cpufreq.c -+++ b/drivers/cpufreq/pmac32-cpufreq.c -@@ -549,6 +549,7 @@ static int pmac_cpufreq_init_7447A(struct device_node *cpunode) - volt_gpio_np = of_find_node_by_name(NULL, "cpu-vcore-select"); - if (volt_gpio_np) - voltage_gpio = read_gpio(volt_gpio_np); -+ of_node_put(volt_gpio_np); - if (!voltage_gpio){ - printk(KERN_ERR "cpufreq: missing cpu-vcore-select gpio\n"); - return 1; -@@ -585,6 +586,7 @@ static int pmac_cpufreq_init_750FX(struct device_node *cpunode) - if (volt_gpio_np) - voltage_gpio = read_gpio(volt_gpio_np); - -+ of_node_put(volt_gpio_np); - pvr = mfspr(SPRN_PVR); - has_cpu_l2lve = !((pvr & 0xf00) == 0x100); - -diff --git a/drivers/cpufreq/ppc_cbe_cpufreq.c b/drivers/cpufreq/ppc_cbe_cpufreq.c -index 5a4c5a639f61..2eaeebcc93af 100644 ---- a/drivers/cpufreq/ppc_cbe_cpufreq.c -+++ b/drivers/cpufreq/ppc_cbe_cpufreq.c -@@ -86,6 +86,7 @@ static int cbe_cpufreq_cpu_init(struct cpufreq_policy *policy) - if (!cbe_get_cpu_pmd_regs(policy->cpu) || - !cbe_get_cpu_mic_tm_regs(policy->cpu)) { - pr_info("invalid CBE regs pointers for cpufreq\n"); -+ of_node_put(cpu); - return -EINVAL; - } - -diff --git a/drivers/crypto/vmx/aesp8-ppc.pl b/drivers/crypto/vmx/aesp8-ppc.pl -index 228053921b3f..4277fdd037bb 100644 ---- a/drivers/crypto/vmx/aesp8-ppc.pl -+++ b/drivers/crypto/vmx/aesp8-ppc.pl -@@ -1298,7 +1298,7 @@ Loop_ctr32_enc: - addi $idx,$idx,16 - bdnz Loop_ctr32_enc - -- vadduwm $ivec,$ivec,$one -+ vadduqm $ivec,$ivec,$one - vmr $dat,$inptail - lvx $inptail,0,$inp - addi $inp,$inp,16 -@@ -1795,7 +1795,7 @@ Lctr32_enc8x_three: - stvx_u $out1,$x10,$out - stvx_u $out2,$x20,$out - addi $out,$out,0x30 -- b Lcbc_dec8x_done -+ b Lctr32_enc8x_done - - .align 5 - Lctr32_enc8x_two: -@@ -1807,7 +1807,7 @@ Lctr32_enc8x_two: - stvx_u $out0,$x00,$out - stvx_u $out1,$x10,$out - addi $out,$out,0x20 -- b Lcbc_dec8x_done -+ b Lctr32_enc8x_done - - .align 5 - Lctr32_enc8x_one: -diff --git a/drivers/crypto/vmx/ghash.c b/drivers/crypto/vmx/ghash.c -index 84b9389bf1ed..d6b68cf7bba7 100644 ---- a/drivers/crypto/vmx/ghash.c -+++ b/drivers/crypto/vmx/ghash.c -@@ -1,22 +1,14 @@ -+// SPDX-License-Identifier: GPL-2.0 - /** - * GHASH routines supporting VMX instructions on the Power 8 - * -- * Copyright (C) 2015 International Business Machines Inc. -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License as published by -- * the Free Software Foundation; version 2 only. -- * -- * This program is distributed in the hope that it will be useful, -- * but WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -- * GNU General Public License for more details. -- * -- * You should have received a copy of the GNU General Public License -- * along with this program; if not, write to the Free Software -- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -+ * Copyright (C) 2015, 2019 International Business Machines Inc. - * - * Author: Marcelo Henrique Cerri -+ * -+ * Extended by Daniel Axtens to replace the fallback -+ * mechanism. The new approach is based on arm64 code, which is: -+ * Copyright (C) 2014 - 2018 Linaro Ltd. - */ - - #include -@@ -39,71 +31,25 @@ void gcm_ghash_p8(u64 Xi[2], const u128 htable[16], - const u8 *in, size_t len); - - struct p8_ghash_ctx { -+ /* key used by vector asm */ - u128 htable[16]; -- struct crypto_shash *fallback; -+ /* key used by software fallback */ -+ be128 key; - }; - - struct p8_ghash_desc_ctx { - u64 shash[2]; - u8 buffer[GHASH_DIGEST_SIZE]; - int bytes; -- struct shash_desc fallback_desc; - }; - --static int p8_ghash_init_tfm(struct crypto_tfm *tfm) --{ -- const char *alg = "ghash-generic"; -- struct crypto_shash *fallback; -- struct crypto_shash *shash_tfm = __crypto_shash_cast(tfm); -- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(tfm); -- -- fallback = crypto_alloc_shash(alg, 0, CRYPTO_ALG_NEED_FALLBACK); -- if (IS_ERR(fallback)) { -- printk(KERN_ERR -- "Failed to allocate transformation for '%s': %ld\n", -- alg, PTR_ERR(fallback)); -- return PTR_ERR(fallback); -- } -- -- crypto_shash_set_flags(fallback, -- crypto_shash_get_flags((struct crypto_shash -- *) tfm)); -- -- /* Check if the descsize defined in the algorithm is still enough. */ -- if (shash_tfm->descsize < sizeof(struct p8_ghash_desc_ctx) -- + crypto_shash_descsize(fallback)) { -- printk(KERN_ERR -- "Desc size of the fallback implementation (%s) does not match the expected value: %lu vs %u\n", -- alg, -- shash_tfm->descsize - sizeof(struct p8_ghash_desc_ctx), -- crypto_shash_descsize(fallback)); -- return -EINVAL; -- } -- ctx->fallback = fallback; -- -- return 0; --} -- --static void p8_ghash_exit_tfm(struct crypto_tfm *tfm) --{ -- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(tfm); -- -- if (ctx->fallback) { -- crypto_free_shash(ctx->fallback); -- ctx->fallback = NULL; -- } --} -- - static int p8_ghash_init(struct shash_desc *desc) - { -- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm)); - struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc); - - dctx->bytes = 0; - memset(dctx->shash, 0, GHASH_DIGEST_SIZE); -- dctx->fallback_desc.tfm = ctx->fallback; -- dctx->fallback_desc.flags = desc->flags; -- return crypto_shash_init(&dctx->fallback_desc); -+ return 0; - } - - static int p8_ghash_setkey(struct crypto_shash *tfm, const u8 *key, -@@ -122,7 +68,53 @@ static int p8_ghash_setkey(struct crypto_shash *tfm, const u8 *key, - gcm_init_p8(ctx->htable, (const u64 *) key); - pagefault_enable(); - preempt_enable(); -- return crypto_shash_setkey(ctx->fallback, key, keylen); -+ -+ memcpy(&ctx->key, key, GHASH_BLOCK_SIZE); -+ -+ return 0; -+} -+ -+static inline void __ghash_block(struct p8_ghash_ctx *ctx, -+ struct p8_ghash_desc_ctx *dctx) -+{ -+ if (!IN_INTERRUPT) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_altivec(); -+ enable_kernel_vsx(); -+ enable_kernel_fp(); -+ gcm_ghash_p8(dctx->shash, ctx->htable, -+ dctx->buffer, GHASH_DIGEST_SIZE); -+ pagefault_enable(); -+ preempt_enable(); -+ } else { -+ crypto_xor((u8 *)dctx->shash, dctx->buffer, GHASH_BLOCK_SIZE); -+ gf128mul_lle((be128 *)dctx->shash, &ctx->key); -+ } -+} -+ -+static inline void __ghash_blocks(struct p8_ghash_ctx *ctx, -+ struct p8_ghash_desc_ctx *dctx, -+ const u8 *src, unsigned int srclen) -+{ -+ if (!IN_INTERRUPT) { -+ preempt_disable(); -+ pagefault_disable(); -+ enable_kernel_altivec(); -+ enable_kernel_vsx(); -+ enable_kernel_fp(); -+ gcm_ghash_p8(dctx->shash, ctx->htable, -+ src, srclen); -+ pagefault_enable(); -+ preempt_enable(); -+ } else { -+ while (srclen >= GHASH_BLOCK_SIZE) { -+ crypto_xor((u8 *)dctx->shash, src, GHASH_BLOCK_SIZE); -+ gf128mul_lle((be128 *)dctx->shash, &ctx->key); -+ srclen -= GHASH_BLOCK_SIZE; -+ src += GHASH_BLOCK_SIZE; -+ } -+ } - } - - static int p8_ghash_update(struct shash_desc *desc, -@@ -132,51 +124,33 @@ static int p8_ghash_update(struct shash_desc *desc, - struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm)); - struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc); - -- if (IN_INTERRUPT) { -- return crypto_shash_update(&dctx->fallback_desc, src, -- srclen); -- } else { -- if (dctx->bytes) { -- if (dctx->bytes + srclen < GHASH_DIGEST_SIZE) { -- memcpy(dctx->buffer + dctx->bytes, src, -- srclen); -- dctx->bytes += srclen; -- return 0; -- } -+ if (dctx->bytes) { -+ if (dctx->bytes + srclen < GHASH_DIGEST_SIZE) { - memcpy(dctx->buffer + dctx->bytes, src, -- GHASH_DIGEST_SIZE - dctx->bytes); -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_altivec(); -- enable_kernel_vsx(); -- enable_kernel_fp(); -- gcm_ghash_p8(dctx->shash, ctx->htable, -- dctx->buffer, GHASH_DIGEST_SIZE); -- pagefault_enable(); -- preempt_enable(); -- src += GHASH_DIGEST_SIZE - dctx->bytes; -- srclen -= GHASH_DIGEST_SIZE - dctx->bytes; -- dctx->bytes = 0; -- } -- len = srclen & ~(GHASH_DIGEST_SIZE - 1); -- if (len) { -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_altivec(); -- enable_kernel_vsx(); -- enable_kernel_fp(); -- gcm_ghash_p8(dctx->shash, ctx->htable, src, len); -- pagefault_enable(); -- preempt_enable(); -- src += len; -- srclen -= len; -- } -- if (srclen) { -- memcpy(dctx->buffer, src, srclen); -- dctx->bytes = srclen; -+ srclen); -+ dctx->bytes += srclen; -+ return 0; - } -- return 0; -+ memcpy(dctx->buffer + dctx->bytes, src, -+ GHASH_DIGEST_SIZE - dctx->bytes); -+ -+ __ghash_block(ctx, dctx); -+ -+ src += GHASH_DIGEST_SIZE - dctx->bytes; -+ srclen -= GHASH_DIGEST_SIZE - dctx->bytes; -+ dctx->bytes = 0; -+ } -+ len = srclen & ~(GHASH_DIGEST_SIZE - 1); -+ if (len) { -+ __ghash_blocks(ctx, dctx, src, len); -+ src += len; -+ srclen -= len; - } -+ if (srclen) { -+ memcpy(dctx->buffer, src, srclen); -+ dctx->bytes = srclen; -+ } -+ return 0; - } - - static int p8_ghash_final(struct shash_desc *desc, u8 *out) -@@ -185,26 +159,14 @@ static int p8_ghash_final(struct shash_desc *desc, u8 *out) - struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm)); - struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc); - -- if (IN_INTERRUPT) { -- return crypto_shash_final(&dctx->fallback_desc, out); -- } else { -- if (dctx->bytes) { -- for (i = dctx->bytes; i < GHASH_DIGEST_SIZE; i++) -- dctx->buffer[i] = 0; -- preempt_disable(); -- pagefault_disable(); -- enable_kernel_altivec(); -- enable_kernel_vsx(); -- enable_kernel_fp(); -- gcm_ghash_p8(dctx->shash, ctx->htable, -- dctx->buffer, GHASH_DIGEST_SIZE); -- pagefault_enable(); -- preempt_enable(); -- dctx->bytes = 0; -- } -- memcpy(out, dctx->shash, GHASH_DIGEST_SIZE); -- return 0; -+ if (dctx->bytes) { -+ for (i = dctx->bytes; i < GHASH_DIGEST_SIZE; i++) -+ dctx->buffer[i] = 0; -+ __ghash_block(ctx, dctx); -+ dctx->bytes = 0; - } -+ memcpy(out, dctx->shash, GHASH_DIGEST_SIZE); -+ return 0; - } - - struct shash_alg p8_ghash_alg = { -@@ -219,11 +181,9 @@ struct shash_alg p8_ghash_alg = { - .cra_name = "ghash", - .cra_driver_name = "p8_ghash", - .cra_priority = 1000, -- .cra_flags = CRYPTO_ALG_TYPE_SHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_TYPE_SHASH, - .cra_blocksize = GHASH_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct p8_ghash_ctx), - .cra_module = THIS_MODULE, -- .cra_init = p8_ghash_init_tfm, -- .cra_exit = p8_ghash_exit_tfm, - }, - }; -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index af24c5bf32d6..8aa3ccf42e55 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -1608,7 +1608,11 @@ static void at_xdmac_tasklet(unsigned long data) - struct at_xdmac_desc, - xfer_node); - dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); -- BUG_ON(!desc->active_xfer); -+ if (!desc->active_xfer) { -+ dev_err(chan2dev(&atchan->chan), "Xfer not active: exiting"); -+ spin_unlock_bh(&atchan->lock); -+ return; -+ } - - txd = &desc->tx_dma_desc; - -diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c -index e4890dd4fefd..38fb212e58ee 100644 ---- a/drivers/extcon/extcon-arizona.c -+++ b/drivers/extcon/extcon-arizona.c -@@ -1616,6 +1616,16 @@ static int arizona_extcon_remove(struct platform_device *pdev) - struct arizona_extcon_info *info = platform_get_drvdata(pdev); - struct arizona *arizona = info->arizona; - int jack_irq_rise, jack_irq_fall; -+ bool change; -+ -+ regmap_update_bits_check(arizona->regmap, ARIZONA_MIC_DETECT_1, -+ ARIZONA_MICD_ENA, 0, -+ &change); -+ -+ if (change) { -+ regulator_disable(info->micvdd); -+ pm_runtime_put(info->dev); -+ } - - gpiod_put(info->micd_pol_gpio); - -diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c -index 211069b2b951..010fe3fc5ecf 100644 ---- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c -+++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c -@@ -620,6 +620,9 @@ void cdv_intel_lvds_init(struct drm_device *dev, - int pipe; - u8 pin; - -+ if (!dev_priv->lvds_enabled_in_vbt) -+ return; -+ - pin = GMBUS_PORT_PANEL; - if (!lvds_is_present_in_vbt(dev, &pin)) { - DRM_DEBUG_KMS("LVDS is not present in VBT\n"); -diff --git a/drivers/gpu/drm/gma500/intel_bios.c b/drivers/gpu/drm/gma500/intel_bios.c -index 63bde4e86c6a..e019ea271ffc 100644 ---- a/drivers/gpu/drm/gma500/intel_bios.c -+++ b/drivers/gpu/drm/gma500/intel_bios.c -@@ -436,6 +436,9 @@ parse_driver_features(struct drm_psb_private *dev_priv, - if (driver->lvds_config == BDB_DRIVER_FEATURE_EDP) - dev_priv->edp.support = 1; - -+ dev_priv->lvds_enabled_in_vbt = driver->lvds_config != 0; -+ DRM_DEBUG_KMS("LVDS VBT config bits: 0x%x\n", driver->lvds_config); -+ - /* This bit means to use 96Mhz for DPLL_A or not */ - if (driver->primary_lfp_id) - dev_priv->dplla_96mhz = true; -diff --git a/drivers/gpu/drm/gma500/psb_drv.h b/drivers/gpu/drm/gma500/psb_drv.h -index e21726ecac32..4c7cc8a5edbd 100644 ---- a/drivers/gpu/drm/gma500/psb_drv.h -+++ b/drivers/gpu/drm/gma500/psb_drv.h -@@ -536,6 +536,7 @@ struct drm_psb_private { - int lvds_ssc_freq; - bool is_lvds_on; - bool is_mipi_on; -+ bool lvds_enabled_in_vbt; - u32 mipi_ctrl_display; - - unsigned int core_freq; -diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h -index 6b6224dbd5bb..943eb2971c3e 100644 ---- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h -+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h -@@ -37,6 +37,7 @@ struct nvkm_i2c_bus { - struct mutex mutex; - struct list_head head; - struct i2c_adapter i2c; -+ u8 enabled; - }; - - int nvkm_i2c_bus_acquire(struct nvkm_i2c_bus *); -@@ -56,6 +57,7 @@ struct nvkm_i2c_aux { - struct mutex mutex; - struct list_head head; - struct i2c_adapter i2c; -+ u8 enabled; - - u32 intr; - }; -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c -index f0851d57df2f..f89692cb2bc7 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c -@@ -105,9 +105,15 @@ nvkm_i2c_aux_acquire(struct nvkm_i2c_aux *aux) - { - struct nvkm_i2c_pad *pad = aux->pad; - int ret; -+ - AUX_TRACE(aux, "acquire"); - mutex_lock(&aux->mutex); -- ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_AUX); -+ -+ if (aux->enabled) -+ ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_AUX); -+ else -+ ret = -EIO; -+ - if (ret) - mutex_unlock(&aux->mutex); - return ret; -@@ -141,6 +147,24 @@ nvkm_i2c_aux_del(struct nvkm_i2c_aux **paux) - } - } - -+void -+nvkm_i2c_aux_init(struct nvkm_i2c_aux *aux) -+{ -+ AUX_TRACE(aux, "init"); -+ mutex_lock(&aux->mutex); -+ aux->enabled = true; -+ mutex_unlock(&aux->mutex); -+} -+ -+void -+nvkm_i2c_aux_fini(struct nvkm_i2c_aux *aux) -+{ -+ AUX_TRACE(aux, "fini"); -+ mutex_lock(&aux->mutex); -+ aux->enabled = false; -+ mutex_unlock(&aux->mutex); -+} -+ - int - nvkm_i2c_aux_ctor(const struct nvkm_i2c_aux_func *func, - struct nvkm_i2c_pad *pad, int id, -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h -index 35a892e4a4c3..04885c097a32 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h -@@ -14,6 +14,8 @@ int nvkm_i2c_aux_ctor(const struct nvkm_i2c_aux_func *, struct nvkm_i2c_pad *, - int nvkm_i2c_aux_new_(const struct nvkm_i2c_aux_func *, struct nvkm_i2c_pad *, - int id, struct nvkm_i2c_aux **); - void nvkm_i2c_aux_del(struct nvkm_i2c_aux **); -+void nvkm_i2c_aux_init(struct nvkm_i2c_aux *); -+void nvkm_i2c_aux_fini(struct nvkm_i2c_aux *); - int nvkm_i2c_aux_xfer(struct nvkm_i2c_aux *, bool retry, u8 type, - u32 addr, u8 *data, u8 size); - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -index 243a71ff0a0d..2acc5cbcb6fb 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -@@ -160,8 +160,18 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend) - { - struct nvkm_i2c *i2c = nvkm_i2c(subdev); - struct nvkm_i2c_pad *pad; -+ struct nvkm_i2c_bus *bus; -+ struct nvkm_i2c_aux *aux; - u32 mask; - -+ list_for_each_entry(aux, &i2c->aux, head) { -+ nvkm_i2c_aux_fini(aux); -+ } -+ -+ list_for_each_entry(bus, &i2c->bus, head) { -+ nvkm_i2c_bus_fini(bus); -+ } -+ - if ((mask = (1 << i2c->func->aux) - 1), i2c->func->aux_stat) { - i2c->func->aux_mask(i2c, NVKM_I2C_ANY, mask, 0); - i2c->func->aux_stat(i2c, &mask, &mask, &mask, &mask); -@@ -180,6 +190,7 @@ nvkm_i2c_init(struct nvkm_subdev *subdev) - struct nvkm_i2c *i2c = nvkm_i2c(subdev); - struct nvkm_i2c_bus *bus; - struct nvkm_i2c_pad *pad; -+ struct nvkm_i2c_aux *aux; - - list_for_each_entry(pad, &i2c->pad, head) { - nvkm_i2c_pad_init(pad); -@@ -189,6 +200,10 @@ nvkm_i2c_init(struct nvkm_subdev *subdev) - nvkm_i2c_bus_init(bus); - } - -+ list_for_each_entry(aux, &i2c->aux, head) { -+ nvkm_i2c_aux_init(aux); -+ } -+ - return 0; - } - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c -index 807a2b67bd64..ed50cc3736b9 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c -@@ -110,6 +110,19 @@ nvkm_i2c_bus_init(struct nvkm_i2c_bus *bus) - BUS_TRACE(bus, "init"); - if (bus->func->init) - bus->func->init(bus); -+ -+ mutex_lock(&bus->mutex); -+ bus->enabled = true; -+ mutex_unlock(&bus->mutex); -+} -+ -+void -+nvkm_i2c_bus_fini(struct nvkm_i2c_bus *bus) -+{ -+ BUS_TRACE(bus, "fini"); -+ mutex_lock(&bus->mutex); -+ bus->enabled = false; -+ mutex_unlock(&bus->mutex); - } - - void -@@ -126,9 +139,15 @@ nvkm_i2c_bus_acquire(struct nvkm_i2c_bus *bus) - { - struct nvkm_i2c_pad *pad = bus->pad; - int ret; -+ - BUS_TRACE(bus, "acquire"); - mutex_lock(&bus->mutex); -- ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_I2C); -+ -+ if (bus->enabled) -+ ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_I2C); -+ else -+ ret = -EIO; -+ - if (ret) - mutex_unlock(&bus->mutex); - return ret; -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h -index e1be14c23e54..2fdb1b8e7164 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h -@@ -17,6 +17,7 @@ int nvkm_i2c_bus_new_(const struct nvkm_i2c_bus_func *, struct nvkm_i2c_pad *, - int id, struct nvkm_i2c_bus **); - void nvkm_i2c_bus_del(struct nvkm_i2c_bus **); - void nvkm_i2c_bus_init(struct nvkm_i2c_bus *); -+void nvkm_i2c_bus_fini(struct nvkm_i2c_bus *); - - int nvkm_i2c_bit_xfer(struct nvkm_i2c_bus *, struct i2c_msg *, int); - -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 4564ecf71181..9b2b41d683de 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -200,13 +200,14 @@ static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type) - * Add a usage to the temporary parser table. - */ - --static int hid_add_usage(struct hid_parser *parser, unsigned usage) -+static int hid_add_usage(struct hid_parser *parser, unsigned usage, u8 size) - { - if (parser->local.usage_index >= HID_MAX_USAGES) { - hid_err(parser->device, "usage index exceeded\n"); - return -1; - } - parser->local.usage[parser->local.usage_index] = usage; -+ parser->local.usage_size[parser->local.usage_index] = size; - parser->local.collection_index[parser->local.usage_index] = - parser->collection_stack_ptr ? - parser->collection_stack[parser->collection_stack_ptr - 1] : 0; -@@ -463,10 +464,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - return 0; - } - -- if (item->size <= 2) -- data = (parser->global.usage_page << 16) + data; -- -- return hid_add_usage(parser, data); -+ return hid_add_usage(parser, data, item->size); - - case HID_LOCAL_ITEM_TAG_USAGE_MINIMUM: - -@@ -475,9 +473,6 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - return 0; - } - -- if (item->size <= 2) -- data = (parser->global.usage_page << 16) + data; -- - parser->local.usage_minimum = data; - return 0; - -@@ -488,9 +483,6 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - return 0; - } - -- if (item->size <= 2) -- data = (parser->global.usage_page << 16) + data; -- - count = data - parser->local.usage_minimum; - if (count + parser->local.usage_index >= HID_MAX_USAGES) { - /* -@@ -510,7 +502,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - } - - for (n = parser->local.usage_minimum; n <= data; n++) -- if (hid_add_usage(parser, n)) { -+ if (hid_add_usage(parser, n, item->size)) { - dbg_hid("hid_add_usage failed\n"); - return -1; - } -@@ -524,6 +516,22 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - return 0; - } - -+/* -+ * Concatenate Usage Pages into Usages where relevant: -+ * As per specification, 6.2.2.8: "When the parser encounters a main item it -+ * concatenates the last declared Usage Page with a Usage to form a complete -+ * usage value." -+ */ -+ -+static void hid_concatenate_usage_page(struct hid_parser *parser) -+{ -+ int i; -+ -+ for (i = 0; i < parser->local.usage_index; i++) -+ if (parser->local.usage_size[i] <= 2) -+ parser->local.usage[i] += parser->global.usage_page << 16; -+} -+ - /* - * Process a main item. - */ -@@ -533,6 +541,8 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item) - __u32 data; - int ret; - -+ hid_concatenate_usage_page(parser); -+ - data = item_udata(item); - - switch (item->tag) { -@@ -746,6 +756,8 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item) - __u32 data; - int i; - -+ hid_concatenate_usage_page(parser); -+ - data = item_udata(item); - - switch (item->tag) { -diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c -index 5fd97860aec4..3666e5064d0d 100644 ---- a/drivers/hid/hid-logitech-hidpp.c -+++ b/drivers/hid/hid-logitech-hidpp.c -@@ -414,13 +414,16 @@ static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature, - - static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp) - { -+ const u8 ping_byte = 0x5a; -+ u8 ping_data[3] = { 0, 0, ping_byte }; - struct hidpp_report response; - int ret; - -- ret = hidpp_send_fap_command_sync(hidpp, -+ ret = hidpp_send_rap_command_sync(hidpp, -+ REPORT_ID_HIDPP_SHORT, - HIDPP_PAGE_ROOT_IDX, - CMD_ROOT_GET_PROTOCOL_VERSION, -- NULL, 0, &response); -+ ping_data, sizeof(ping_data), &response); - - if (ret == HIDPP_ERROR_INVALID_SUBID) { - hidpp->protocol_major = 1; -@@ -440,8 +443,14 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp) - if (ret) - return ret; - -- hidpp->protocol_major = response.fap.params[0]; -- hidpp->protocol_minor = response.fap.params[1]; -+ if (response.rap.params[2] != ping_byte) { -+ hid_err(hidpp->hid_dev, "%s: ping mismatch 0x%02x != 0x%02x\n", -+ __func__, response.rap.params[2], ping_byte); -+ return -EPROTO; -+ } -+ -+ hidpp->protocol_major = response.rap.params[0]; -+ hidpp->protocol_minor = response.rap.params[1]; - - return ret; - } -diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c -index facd05cda26d..e8c089886427 100644 ---- a/drivers/hwmon/f71805f.c -+++ b/drivers/hwmon/f71805f.c -@@ -96,17 +96,23 @@ superio_select(int base, int ld) - outb(ld, base + 1); - } - --static inline void -+static inline int - superio_enter(int base) - { -+ if (!request_muxed_region(base, 2, DRVNAME)) -+ return -EBUSY; -+ - outb(0x87, base); - outb(0x87, base); -+ -+ return 0; - } - - static inline void - superio_exit(int base) - { - outb(0xaa, base); -+ release_region(base, 2); - } - - /* -@@ -1561,7 +1567,7 @@ exit: - static int __init f71805f_find(int sioaddr, unsigned short *address, - struct f71805f_sio_data *sio_data) - { -- int err = -ENODEV; -+ int err; - u16 devid; - - static const char * const names[] = { -@@ -1569,8 +1575,11 @@ static int __init f71805f_find(int sioaddr, unsigned short *address, - "F71872F/FG or F71806F/FG", - }; - -- superio_enter(sioaddr); -+ err = superio_enter(sioaddr); -+ if (err) -+ return err; - -+ err = -ENODEV; - devid = superio_inw(sioaddr, SIO_REG_MANID); - if (devid != SIO_FINTEK_ID) - goto exit; -diff --git a/drivers/hwmon/pc87427.c b/drivers/hwmon/pc87427.c -index cb9fdd37bd0d..2b5b8c3de8fc 100644 ---- a/drivers/hwmon/pc87427.c -+++ b/drivers/hwmon/pc87427.c -@@ -106,6 +106,13 @@ static const char *logdev_str[2] = { DRVNAME " FMC", DRVNAME " HMC" }; - #define LD_IN 1 - #define LD_TEMP 1 - -+static inline int superio_enter(int sioaddr) -+{ -+ if (!request_muxed_region(sioaddr, 2, DRVNAME)) -+ return -EBUSY; -+ return 0; -+} -+ - static inline void superio_outb(int sioaddr, int reg, int val) - { - outb(reg, sioaddr); -@@ -122,6 +129,7 @@ static inline void superio_exit(int sioaddr) - { - outb(0x02, sioaddr); - outb(0x02, sioaddr + 1); -+ release_region(sioaddr, 2); - } - - /* -@@ -1220,7 +1228,11 @@ static int __init pc87427_find(int sioaddr, struct pc87427_sio_data *sio_data) - { - u16 val; - u8 cfg, cfg_b; -- int i, err = 0; -+ int i, err; -+ -+ err = superio_enter(sioaddr); -+ if (err) -+ return err; - - /* Identify device */ - val = force_id ? force_id : superio_inb(sioaddr, SIOREG_DEVID); -diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c -index 6bd200756560..cbdb5c4991ae 100644 ---- a/drivers/hwmon/smsc47b397.c -+++ b/drivers/hwmon/smsc47b397.c -@@ -72,14 +72,19 @@ static inline void superio_select(int ld) - superio_outb(0x07, ld); - } - --static inline void superio_enter(void) -+static inline int superio_enter(void) - { -+ if (!request_muxed_region(REG, 2, DRVNAME)) -+ return -EBUSY; -+ - outb(0x55, REG); -+ return 0; - } - - static inline void superio_exit(void) - { - outb(0xAA, REG); -+ release_region(REG, 2); - } - - #define SUPERIO_REG_DEVID 0x20 -@@ -300,8 +305,12 @@ static int __init smsc47b397_find(void) - u8 id, rev; - char *name; - unsigned short addr; -+ int err; -+ -+ err = superio_enter(); -+ if (err) -+ return err; - -- superio_enter(); - id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID); - - switch (id) { -diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c -index 5d323186d2c1..d24df0c50bea 100644 ---- a/drivers/hwmon/smsc47m1.c -+++ b/drivers/hwmon/smsc47m1.c -@@ -73,16 +73,21 @@ superio_inb(int reg) - /* logical device for fans is 0x0A */ - #define superio_select() superio_outb(0x07, 0x0A) - --static inline void -+static inline int - superio_enter(void) - { -+ if (!request_muxed_region(REG, 2, DRVNAME)) -+ return -EBUSY; -+ - outb(0x55, REG); -+ return 0; - } - - static inline void - superio_exit(void) - { - outb(0xAA, REG); -+ release_region(REG, 2); - } - - #define SUPERIO_REG_ACT 0x30 -@@ -531,8 +536,12 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data) - { - u8 val; - unsigned short addr; -+ int err; -+ -+ err = superio_enter(); -+ if (err) -+ return err; - -- superio_enter(); - val = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID); - - /* -@@ -608,13 +617,14 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data) - static void smsc47m1_restore(const struct smsc47m1_sio_data *sio_data) - { - if ((sio_data->activate & 0x01) == 0) { -- superio_enter(); -- superio_select(); -- -- pr_info("Disabling device\n"); -- superio_outb(SUPERIO_REG_ACT, sio_data->activate); -- -- superio_exit(); -+ if (!superio_enter()) { -+ superio_select(); -+ pr_info("Disabling device\n"); -+ superio_outb(SUPERIO_REG_ACT, sio_data->activate); -+ superio_exit(); -+ } else { -+ pr_warn("Failed to disable device\n"); -+ } - } - } - -diff --git a/drivers/hwmon/vt1211.c b/drivers/hwmon/vt1211.c -index 3a6bfa51cb94..95d5e8ec8b7f 100644 ---- a/drivers/hwmon/vt1211.c -+++ b/drivers/hwmon/vt1211.c -@@ -226,15 +226,21 @@ static inline void superio_select(int sio_cip, int ldn) - outb(ldn, sio_cip + 1); - } - --static inline void superio_enter(int sio_cip) -+static inline int superio_enter(int sio_cip) - { -+ if (!request_muxed_region(sio_cip, 2, DRVNAME)) -+ return -EBUSY; -+ - outb(0x87, sio_cip); - outb(0x87, sio_cip); -+ -+ return 0; - } - - static inline void superio_exit(int sio_cip) - { - outb(0xaa, sio_cip); -+ release_region(sio_cip, 2); - } - - /* --------------------------------------------------------------------- -@@ -1282,11 +1288,14 @@ EXIT: - - static int __init vt1211_find(int sio_cip, unsigned short *address) - { -- int err = -ENODEV; -+ int err; - int devid; - -- superio_enter(sio_cip); -+ err = superio_enter(sio_cip); -+ if (err) -+ return err; - -+ err = -ENODEV; - devid = force_id ? force_id : superio_inb(sio_cip, SIO_VT1211_DEVID); - if (devid != SIO_VT1211_ID) - goto EXIT; -diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c -index 9d9e47eb0842..7d5c53a1abe4 100644 ---- a/drivers/hwtracing/intel_th/msu.c -+++ b/drivers/hwtracing/intel_th/msu.c -@@ -90,6 +90,7 @@ struct msc_iter { - * @reg_base: register window base address - * @thdev: intel_th_device pointer - * @win_list: list of windows in multiblock mode -+ * @single_sgt: single mode buffer - * @nr_pages: total number of pages allocated for this buffer - * @single_sz: amount of data in single mode - * @single_wrap: single mode wrap occurred -@@ -110,6 +111,7 @@ struct msc { - struct intel_th_device *thdev; - - struct list_head win_list; -+ struct sg_table single_sgt; - unsigned long nr_pages; - unsigned long single_sz; - unsigned int single_wrap : 1; -@@ -610,22 +612,45 @@ static void intel_th_msc_deactivate(struct intel_th_device *thdev) - */ - static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size) - { -+ unsigned long nr_pages = size >> PAGE_SHIFT; - unsigned int order = get_order(size); - struct page *page; -+ int ret; - - if (!size) - return 0; - -+ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL); -+ if (ret) -+ goto err_out; -+ -+ ret = -ENOMEM; - page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); - if (!page) -- return -ENOMEM; -+ goto err_free_sgt; - - split_page(page, order); -- msc->nr_pages = size >> PAGE_SHIFT; -+ sg_set_buf(msc->single_sgt.sgl, page_address(page), size); -+ -+ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1, -+ DMA_FROM_DEVICE); -+ if (ret < 0) -+ goto err_free_pages; -+ -+ msc->nr_pages = nr_pages; - msc->base = page_address(page); -- msc->base_addr = page_to_phys(page); -+ msc->base_addr = sg_dma_address(msc->single_sgt.sgl); - - return 0; -+ -+err_free_pages: -+ __free_pages(page, order); -+ -+err_free_sgt: -+ sg_free_table(&msc->single_sgt); -+ -+err_out: -+ return ret; - } - - /** -@@ -636,6 +661,10 @@ static void msc_buffer_contig_free(struct msc *msc) - { - unsigned long off; - -+ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, -+ 1, DMA_FROM_DEVICE); -+ sg_free_table(&msc->single_sgt); -+ - for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) { - struct page *page = virt_to_page(msc->base + off); - -diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c -index b6cc841de79d..e880702a3784 100644 ---- a/drivers/hwtracing/stm/core.c -+++ b/drivers/hwtracing/stm/core.c -@@ -210,8 +210,8 @@ stm_output_disclaim(struct stm_device *stm, struct stm_output *output) - bitmap_release_region(&master->chan_map[0], output->channel, - ilog2(output->nr_chans)); - -- output->nr_chans = 0; - master->nr_free += output->nr_chans; -+ output->nr_chans = 0; - } - - /* -diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c -index a1d072ecb717..30f200ad6b97 100644 ---- a/drivers/iio/adc/ad_sigma_delta.c -+++ b/drivers/iio/adc/ad_sigma_delta.c -@@ -62,7 +62,7 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, - struct spi_transfer t = { - .tx_buf = data, - .len = size + 1, -- .cs_change = sigma_delta->bus_locked, -+ .cs_change = sigma_delta->keep_cs_asserted, - }; - struct spi_message m; - int ret; -@@ -217,6 +217,7 @@ static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, - - spi_bus_lock(sigma_delta->spi->master); - sigma_delta->bus_locked = true; -+ sigma_delta->keep_cs_asserted = true; - reinit_completion(&sigma_delta->completion); - - ret = ad_sigma_delta_set_mode(sigma_delta, mode); -@@ -234,9 +235,10 @@ static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, - ret = 0; - } - out: -+ sigma_delta->keep_cs_asserted = false; -+ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); - sigma_delta->bus_locked = false; - spi_bus_unlock(sigma_delta->spi->master); -- ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); - - return ret; - } -@@ -288,6 +290,7 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, - - spi_bus_lock(sigma_delta->spi->master); - sigma_delta->bus_locked = true; -+ sigma_delta->keep_cs_asserted = true; - reinit_completion(&sigma_delta->completion); - - ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_SINGLE); -@@ -297,9 +300,6 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, - ret = wait_for_completion_interruptible_timeout( - &sigma_delta->completion, HZ); - -- sigma_delta->bus_locked = false; -- spi_bus_unlock(sigma_delta->spi->master); -- - if (ret == 0) - ret = -EIO; - if (ret < 0) -@@ -315,7 +315,10 @@ out: - sigma_delta->irq_dis = true; - } - -+ sigma_delta->keep_cs_asserted = false; - ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); -+ sigma_delta->bus_locked = false; -+ spi_bus_unlock(sigma_delta->spi->master); - mutex_unlock(&indio_dev->mlock); - - if (ret) -@@ -352,6 +355,8 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev) - - spi_bus_lock(sigma_delta->spi->master); - sigma_delta->bus_locked = true; -+ sigma_delta->keep_cs_asserted = true; -+ - ret = ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_CONTINUOUS); - if (ret) - goto err_unlock; -@@ -380,6 +385,7 @@ static int ad_sd_buffer_postdisable(struct iio_dev *indio_dev) - sigma_delta->irq_dis = true; - } - -+ sigma_delta->keep_cs_asserted = false; - ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); - - sigma_delta->bus_locked = false; -diff --git a/drivers/iio/common/ssp_sensors/ssp_iio.c b/drivers/iio/common/ssp_sensors/ssp_iio.c -index a3ae165f8d9f..16180e6321bd 100644 ---- a/drivers/iio/common/ssp_sensors/ssp_iio.c -+++ b/drivers/iio/common/ssp_sensors/ssp_iio.c -@@ -80,7 +80,7 @@ int ssp_common_process_data(struct iio_dev *indio_dev, void *buf, - unsigned int len, int64_t timestamp) - { - __le32 time; -- int64_t calculated_time; -+ int64_t calculated_time = 0; - struct ssp_sensor_data *spd = iio_priv(indio_dev); - - if (indio_dev->scan_bytes == 0) -diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c -index c9cffced00ca..54fd4d81a3f1 100644 ---- a/drivers/infiniband/hw/cxgb4/cm.c -+++ b/drivers/infiniband/hw/cxgb4/cm.c -@@ -360,6 +360,8 @@ static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp) - skb_reset_transport_header(skb); - } else { - skb = alloc_skb(len, gfp); -+ if (!skb) -+ return NULL; - } - t4_set_arp_err_handler(skb, NULL, NULL); - return skb; -diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c -index 9305964250ac..c4eb293b1524 100644 ---- a/drivers/iommu/tegra-smmu.c -+++ b/drivers/iommu/tegra-smmu.c -@@ -91,7 +91,6 @@ static inline u32 smmu_readl(struct tegra_smmu *smmu, unsigned long offset) - #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0) - #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0) - #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0) --#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24) - #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \ - SMMU_TLB_FLUSH_VA_MATCH_SECTION) - #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \ -@@ -194,8 +193,12 @@ static inline void smmu_flush_tlb_asid(struct tegra_smmu *smmu, - { - u32 value; - -- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | -- SMMU_TLB_FLUSH_VA_MATCH_ALL; -+ if (smmu->soc->num_asids == 4) -+ value = (asid & 0x3) << 29; -+ else -+ value = (asid & 0x7f) << 24; -+ -+ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL; - smmu_writel(smmu, value, SMMU_TLB_FLUSH); - } - -@@ -205,8 +208,12 @@ static inline void smmu_flush_tlb_section(struct tegra_smmu *smmu, - { - u32 value; - -- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | -- SMMU_TLB_FLUSH_VA_SECTION(iova); -+ if (smmu->soc->num_asids == 4) -+ value = (asid & 0x3) << 29; -+ else -+ value = (asid & 0x7f) << 24; -+ -+ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova); - smmu_writel(smmu, value, SMMU_TLB_FLUSH); - } - -@@ -216,8 +223,12 @@ static inline void smmu_flush_tlb_group(struct tegra_smmu *smmu, - { - u32 value; - -- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) | -- SMMU_TLB_FLUSH_VA_GROUP(iova); -+ if (smmu->soc->num_asids == 4) -+ value = (asid & 0x3) << 29; -+ else -+ value = (asid & 0x7f) << 24; -+ -+ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova); - smmu_writel(smmu, value, SMMU_TLB_FLUSH); - } - -diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c -index 16c3390e5d9f..d82ae445c9ee 100644 ---- a/drivers/md/bcache/alloc.c -+++ b/drivers/md/bcache/alloc.c -@@ -324,10 +324,11 @@ static int bch_allocator_thread(void *arg) - * possibly issue discards to them, then we add the bucket to - * the free list: - */ -- while (!fifo_empty(&ca->free_inc)) { -+ while (1) { - long bucket; - -- fifo_pop(&ca->free_inc, bucket); -+ if (!fifo_pop(&ca->free_inc, bucket)) -+ break; - - if (ca->discard) { - mutex_unlock(&ca->set->bucket_lock); -diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c -index 6ed066a0e7c0..6f9db98f2dfd 100644 ---- a/drivers/md/bcache/journal.c -+++ b/drivers/md/bcache/journal.c -@@ -309,6 +309,18 @@ void bch_journal_mark(struct cache_set *c, struct list_head *list) - } - } - -+bool is_discard_enabled(struct cache_set *s) -+{ -+ struct cache *ca; -+ unsigned int i; -+ -+ for_each_cache(ca, s, i) -+ if (ca->discard) -+ return true; -+ -+ return false; -+} -+ - int bch_journal_replay(struct cache_set *s, struct list_head *list) - { - int ret = 0, keys = 0, entries = 0; -@@ -322,9 +334,17 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list) - list_for_each_entry(i, list, list) { - BUG_ON(i->pin && atomic_read(i->pin) != 1); - -- cache_set_err_on(n != i->j.seq, s, --"bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)", -- n, i->j.seq - 1, start, end); -+ if (n != i->j.seq) { -+ if (n == start && is_discard_enabled(s)) -+ pr_info("bcache: journal entries %llu-%llu may be discarded! (replaying %llu-%llu)", -+ n, i->j.seq - 1, start, end); -+ else { -+ pr_err("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)", -+ n, i->j.seq - 1, start, end); -+ ret = -EIO; -+ goto err; -+ } -+ } - - for (k = i->j.start; - k < bset_bkey_last(&i->j); -@@ -513,11 +533,11 @@ static void journal_reclaim(struct cache_set *c) - ca->sb.nr_this_dev); - } - -- bkey_init(k); -- SET_KEY_PTRS(k, n); -- -- if (n) -+ if (n) { -+ bkey_init(k); -+ SET_KEY_PTRS(k, n); - c->journal.blocks_free = c->sb.bucket_size >> c->block_bits; -+ } - out: - if (!journal_full(&c->journal)) - __closure_wake_up(&c->journal.wait); -@@ -641,6 +661,9 @@ static void journal_write_unlocked(struct closure *cl) - ca->journal.seq[ca->journal.cur_idx] = w->data->seq; - } - -+ /* If KEY_PTRS(k) == 0, this jset gets lost in air */ -+ BUG_ON(i == 0); -+ - atomic_dec_bug(&fifo_back(&c->journal.pin)); - bch_journal_next(&c->journal); - journal_reclaim(c); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index ef28ddfff7c6..02757b90e402 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1355,6 +1355,7 @@ static void cache_set_free(struct closure *cl) - bch_btree_cache_free(c); - bch_journal_free(c); - -+ mutex_lock(&bch_register_lock); - for_each_cache(ca, c, i) - if (ca) { - ca->set = NULL; -@@ -1377,7 +1378,6 @@ static void cache_set_free(struct closure *cl) - mempool_destroy(c->search); - kfree(c->devices); - -- mutex_lock(&bch_register_lock); - list_del(&c->list); - mutex_unlock(&bch_register_lock); - -@@ -1558,7 +1558,7 @@ err: - return NULL; - } - --static void run_cache_set(struct cache_set *c) -+static int run_cache_set(struct cache_set *c) - { - const char *err = "cannot allocate memory"; - struct cached_dev *dc, *t; -@@ -1650,7 +1650,9 @@ static void run_cache_set(struct cache_set *c) - if (j->version < BCACHE_JSET_VERSION_UUID) - __uuid_write(c); - -- bch_journal_replay(c, &journal); -+ err = "bcache: replay journal failed"; -+ if (bch_journal_replay(c, &journal)) -+ goto err; - } else { - pr_notice("invalidating existing data"); - -@@ -1718,11 +1720,13 @@ static void run_cache_set(struct cache_set *c) - flash_devs_run(c); - - set_bit(CACHE_SET_RUNNING, &c->flags); -- return; -+ return 0; - err: - closure_sync(&cl); - /* XXX: test this, it's broken */ - bch_cache_set_error(c, "%s", err); -+ -+ return -EIO; - } - - static bool can_attach_cache(struct cache *ca, struct cache_set *c) -@@ -1786,8 +1790,11 @@ found: - ca->set->cache[ca->sb.nr_this_dev] = ca; - c->cache_by_alloc[c->caches_loaded++] = ca; - -- if (c->caches_loaded == c->sb.nr_in_set) -- run_cache_set(c); -+ if (c->caches_loaded == c->sb.nr_in_set) { -+ err = "failed to run cache set"; -+ if (run_cache_set(c) < 0) -+ goto err; -+ } - - return NULL; - err: -diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c -index b4c356a21123..e789a4aae4e7 100644 ---- a/drivers/md/dm-delay.c -+++ b/drivers/md/dm-delay.c -@@ -222,7 +222,8 @@ static void delay_dtr(struct dm_target *ti) - { - struct delay_c *dc = ti->private; - -- destroy_workqueue(dc->kdelayd_wq); -+ if (dc->kdelayd_wq) -+ destroy_workqueue(dc->kdelayd_wq); - - dm_put_device(ti, dc->dev_read); - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 07f307402351..f71cca28ddda 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -2690,8 +2690,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len) - err = 0; - } - } else if (cmd_match(buf, "re-add")) { -- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && -- rdev->saved_raid_disk >= 0) { -+ if (!rdev->mddev->pers) -+ err = -EINVAL; -+ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && -+ rdev->saved_raid_disk >= 0) { - /* clear_bit is performed _after_ all the devices - * have their local Faulty bit cleared. If any writes - * happen in the meantime in the local node, they -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 17517889d46b..764e0e155ae2 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3861,7 +3861,7 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh, - /* now write out any block on a failed drive, - * or P or Q if they were recomputed - */ -- BUG_ON(s->uptodate < disks - 1); /* We don't need Q to recover */ -+ dev = NULL; - if (s->failed == 2) { - dev = &sh->dev[s->failed_num[1]]; - s->locked++; -@@ -3886,6 +3886,14 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh, - set_bit(R5_LOCKED, &dev->flags); - set_bit(R5_Wantwrite, &dev->flags); - } -+ if (WARN_ONCE(dev && !test_bit(R5_UPTODATE, &dev->flags), -+ "%s: disk%td not up to date\n", -+ mdname(conf->mddev), -+ dev - (struct r5dev *) &sh->dev)) { -+ clear_bit(R5_LOCKED, &dev->flags); -+ clear_bit(R5_Wantwrite, &dev->flags); -+ s->locked--; -+ } - clear_bit(STRIPE_DEGRADED, &sh->state); - - set_bit(STRIPE_INSYNC, &sh->state); -@@ -3897,15 +3905,26 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh, - case check_state_check_result: - sh->check_state = check_state_idle; - -- if (s->failed > 1) -- break; - /* handle a successful check operation, if parity is correct - * we are done. Otherwise update the mismatch count and repair - * parity if !MD_RECOVERY_CHECK - */ - if (sh->ops.zero_sum_result == 0) { -- /* Any parity checked was correct */ -- set_bit(STRIPE_INSYNC, &sh->state); -+ /* both parities are correct */ -+ if (!s->failed) -+ set_bit(STRIPE_INSYNC, &sh->state); -+ else { -+ /* in contrast to the raid5 case we can validate -+ * parity, but still have a failure to write -+ * back -+ */ -+ sh->check_state = check_state_compute_result; -+ /* Returning at this point means that we may go -+ * off and bring p and/or q uptodate again so -+ * we make sure to check zero_sum_result again -+ * to verify if p or q need writeback -+ */ -+ } - } else { - atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches); - if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) -diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c -index d14d075ab1d6..9f0956e739a4 100644 ---- a/drivers/media/dvb-frontends/m88ds3103.c -+++ b/drivers/media/dvb-frontends/m88ds3103.c -@@ -309,6 +309,9 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe) - u16 u16tmp, divide_ratio = 0; - u32 tuner_frequency, target_mclk; - s32 s32tmp; -+ static const struct reg_sequence reset_buf[] = { -+ {0x07, 0x80}, {0x07, 0x00} -+ }; - - dev_dbg(&client->dev, - "delivery_system=%d modulation=%d frequency=%u symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n", -@@ -321,11 +324,7 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe) - } - - /* reset */ -- ret = regmap_write(dev->regmap, 0x07, 0x80); -- if (ret) -- goto err; -- -- ret = regmap_write(dev->regmap, 0x07, 0x00); -+ ret = regmap_multi_reg_write(dev->regmap, reset_buf, 2); - if (ret) - goto err; - -diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c -index 49109f4f5bb4..fadec1d70582 100644 ---- a/drivers/media/i2c/ov2659.c -+++ b/drivers/media/i2c/ov2659.c -@@ -1117,8 +1117,10 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd, - if (ov2659_formats[index].code == mf->code) - break; - -- if (index < 0) -- return -EINVAL; -+ if (index < 0) { -+ index = 0; -+ mf->code = ov2659_formats[index].code; -+ } - - mf->colorspace = V4L2_COLORSPACE_SRGB; - mf->code = ov2659_formats[index].code; -diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c -index 1e4783b51a35..4e19f5e5d8cf 100644 ---- a/drivers/media/i2c/soc_camera/ov6650.c -+++ b/drivers/media/i2c/soc_camera/ov6650.c -@@ -839,9 +839,18 @@ static int ov6650_video_probe(struct i2c_client *client) - u8 pidh, pidl, midh, midl; - int ret; - -+ priv->clk = v4l2_clk_get(&client->dev, NULL); -+ if (IS_ERR(priv->clk)) { -+ ret = PTR_ERR(priv->clk); -+ dev_err(&client->dev, "v4l2_clk request err: %d\n", ret); -+ return ret; -+ } -+ - ret = ov6650_s_power(&priv->subdev, 1); - if (ret < 0) -- return ret; -+ goto eclkput; -+ -+ msleep(20); - - /* - * check and show product ID and manufacturer ID -@@ -876,6 +885,11 @@ static int ov6650_video_probe(struct i2c_client *client) - - done: - ov6650_s_power(&priv->subdev, 0); -+ if (!ret) -+ return 0; -+eclkput: -+ v4l2_clk_put(priv->clk); -+ - return ret; - } - -@@ -1033,18 +1047,9 @@ static int ov6650_probe(struct i2c_client *client, - priv->code = MEDIA_BUS_FMT_YUYV8_2X8; - priv->colorspace = V4L2_COLORSPACE_JPEG; - -- priv->clk = v4l2_clk_get(&client->dev, NULL); -- if (IS_ERR(priv->clk)) { -- ret = PTR_ERR(priv->clk); -- goto eclkget; -- } -- - ret = ov6650_video_probe(client); -- if (ret) { -- v4l2_clk_put(priv->clk); --eclkget: -+ if (ret) - v4l2_ctrl_handler_free(&priv->hdl); -- } - - return ret; - } -diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c -index 03cbcd2095c6..d4b3ce828285 100644 ---- a/drivers/media/pci/saa7146/hexium_gemini.c -+++ b/drivers/media/pci/saa7146/hexium_gemini.c -@@ -270,9 +270,8 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d - /* enable i2c-port pins */ - saa7146_write(dev, MC1, (MASK_08 | MASK_24 | MASK_10 | MASK_26)); - -- hexium->i2c_adapter = (struct i2c_adapter) { -- .name = "hexium gemini", -- }; -+ strscpy(hexium->i2c_adapter.name, "hexium gemini", -+ sizeof(hexium->i2c_adapter.name)); - saa7146_i2c_adapter_prepare(dev, &hexium->i2c_adapter, SAA7146_I2C_BUS_BIT_RATE_480); - if (i2c_add_adapter(&hexium->i2c_adapter) < 0) { - DEB_S("cannot register i2c-device. skipping.\n"); -diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/saa7146/hexium_orion.c -index 15f0d66ff78a..214396b1ca73 100644 ---- a/drivers/media/pci/saa7146/hexium_orion.c -+++ b/drivers/media/pci/saa7146/hexium_orion.c -@@ -232,9 +232,8 @@ static int hexium_probe(struct saa7146_dev *dev) - saa7146_write(dev, DD1_STREAM_B, 0x00000000); - saa7146_write(dev, MC2, (MASK_09 | MASK_25 | MASK_10 | MASK_26)); - -- hexium->i2c_adapter = (struct i2c_adapter) { -- .name = "hexium orion", -- }; -+ strscpy(hexium->i2c_adapter.name, "hexium orion", -+ sizeof(hexium->i2c_adapter.name)); - saa7146_i2c_adapter_prepare(dev, &hexium->i2c_adapter, SAA7146_I2C_BUS_BIT_RATE_480); - if (i2c_add_adapter(&hexium->i2c_adapter) < 0) { - DEB_S("cannot register i2c-device. skipping.\n"); -diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c -index d76511c1c1e3..a4639813cf35 100644 ---- a/drivers/media/platform/coda/coda-bit.c -+++ b/drivers/media/platform/coda/coda-bit.c -@@ -1829,6 +1829,9 @@ static int coda_prepare_decode(struct coda_ctx *ctx) - /* Clear decode success flag */ - coda_write(dev, 0, CODA_RET_DEC_PIC_SUCCESS); - -+ /* Clear error return value */ -+ coda_write(dev, 0, CODA_RET_DEC_PIC_ERR_MB); -+ - trace_coda_dec_pic_run(ctx, meta); - - coda_command_async(ctx, CODA_COMMAND_PIC_RUN); -diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c -index a84954f1be34..9eb0bc4a8d97 100644 ---- a/drivers/media/platform/vivid/vivid-vid-cap.c -+++ b/drivers/media/platform/vivid/vivid-vid-cap.c -@@ -993,7 +993,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection - rect_map_inside(&s->r, &dev->fmt_cap_rect); - if (dev->bitmap_cap && (compose->width != s->r.width || - compose->height != s->r.height)) { -- kfree(dev->bitmap_cap); -+ vfree(dev->bitmap_cap); - dev->bitmap_cap = NULL; - } - *compose = s->r; -diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c -index ebc73b034249..51639a3f7abe 100644 ---- a/drivers/media/radio/wl128x/fmdrv_common.c -+++ b/drivers/media/radio/wl128x/fmdrv_common.c -@@ -494,7 +494,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, - return -EIO; - } - /* Send response data to caller */ -- if (response != NULL && response_len != NULL && evt_hdr->dlen) { -+ if (response != NULL && response_len != NULL && evt_hdr->dlen && -+ evt_hdr->dlen <= payload_len) { - /* Skip header info and copy only response data */ - skb_pull(skb, sizeof(struct fm_event_msg_hdr)); - memcpy(response, skb->data, evt_hdr->dlen); -@@ -590,6 +591,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev) - return; - - fm_evt_hdr = (void *)skb->data; -+ if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag)) -+ return; - - /* Skip header info and copy only response data */ - skb_pull(skb, sizeof(struct fm_event_msg_hdr)); -@@ -1315,7 +1318,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev) - static int fm_power_up(struct fmdev *fmdev, u8 mode) - { - u16 payload; -- __be16 asic_id, asic_ver; -+ __be16 asic_id = 0, asic_ver = 0; - int resp_len, ret; - u8 fw_name[50]; - -diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c -index 7b2fe1b56039..1df23c01ad37 100644 ---- a/drivers/media/usb/au0828/au0828-video.c -+++ b/drivers/media/usb/au0828/au0828-video.c -@@ -711,6 +711,9 @@ static int au0828_analog_stream_enable(struct au0828_dev *d) - - dprintk(1, "au0828_analog_stream_enable called\n"); - -+ if (test_bit(DEV_DISCONNECTED, &d->dev_state)) -+ return -ENODEV; -+ - iface = usb_ifnum_to_if(d->usbdev, 0); - if (iface && iface->cur_altsetting->desc.bAlternateSetting != 5) { - dprintk(1, "Changing intf#0 to alt 5\n"); -@@ -799,9 +802,9 @@ int au0828_start_analog_streaming(struct vb2_queue *vq, unsigned int count) - return rc; - } - -+ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 1); -+ - if (vq->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) { -- v4l2_device_call_all(&dev->v4l2_dev, 0, video, -- s_stream, 1); - dev->vid_timeout_running = 1; - mod_timer(&dev->vid_timeout, jiffies + (HZ / 10)); - } else if (vq->type == V4L2_BUF_TYPE_VBI_CAPTURE) { -@@ -821,10 +824,11 @@ static void au0828_stop_streaming(struct vb2_queue *vq) - - dprintk(1, "au0828_stop_streaming called %d\n", dev->streaming_users); - -- if (dev->streaming_users-- == 1) -+ if (dev->streaming_users-- == 1) { - au0828_uninit_isoc(dev); -+ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0); -+ } - -- v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0); - dev->vid_timeout_running = 0; - del_timer_sync(&dev->vid_timeout); - -@@ -853,8 +857,10 @@ void au0828_stop_vbi_streaming(struct vb2_queue *vq) - dprintk(1, "au0828_stop_vbi_streaming called %d\n", - dev->streaming_users); - -- if (dev->streaming_users-- == 1) -+ if (dev->streaming_users-- == 1) { - au0828_uninit_isoc(dev); -+ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0); -+ } - - spin_lock_irqsave(&dev->slock, flags); - if (dev->isoc_ctl.vbi_buf != NULL) { -diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c -index d793c630f1dd..05e7edb213de 100644 ---- a/drivers/media/usb/cpia2/cpia2_v4l.c -+++ b/drivers/media/usb/cpia2/cpia2_v4l.c -@@ -1248,8 +1248,7 @@ static int __init cpia2_init(void) - LOG("%s v%s\n", - ABOUT, CPIA_VERSION); - check_parameters(); -- cpia2_usb_init(); -- return 0; -+ return cpia2_usb_init(); - } - - -diff --git a/drivers/media/usb/go7007/go7007-fw.c b/drivers/media/usb/go7007/go7007-fw.c -index 60bf5f0644d1..a5efcd4f7b4f 100644 ---- a/drivers/media/usb/go7007/go7007-fw.c -+++ b/drivers/media/usb/go7007/go7007-fw.c -@@ -1499,8 +1499,8 @@ static int modet_to_package(struct go7007 *go, __le16 *code, int space) - return cnt; - } - --static int do_special(struct go7007 *go, u16 type, __le16 *code, int space, -- int *framelen) -+static noinline_for_stack int do_special(struct go7007 *go, u16 type, -+ __le16 *code, int space, int *framelen) - { - switch (type) { - case SPECIAL_FRM_HEAD: -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -index 0533ef20decf..232b0fd3e478 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c -@@ -670,6 +670,8 @@ static int ctrl_get_input(struct pvr2_ctrl *cptr,int *vp) - - static int ctrl_check_input(struct pvr2_ctrl *cptr,int v) - { -+ if (v < 0 || v > PVR2_CVAL_INPUT_MAX) -+ return 0; - return ((1 << v) & cptr->hdw->input_allowed_mask) != 0; - } - -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h -index a82a00dd7329..80869990ffbb 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h -+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h -@@ -54,6 +54,7 @@ - #define PVR2_CVAL_INPUT_COMPOSITE 2 - #define PVR2_CVAL_INPUT_SVIDEO 3 - #define PVR2_CVAL_INPUT_RADIO 4 -+#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIO - - enum pvr2_config { - pvr2_config_empty, /* No configuration */ -diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c -index ec30a004f319..e8f7a1f56be5 100644 ---- a/drivers/media/usb/siano/smsusb.c -+++ b/drivers/media/usb/siano/smsusb.c -@@ -391,6 +391,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) - struct smsusb_device_t *dev; - void *mdev; - int i, rc; -+ int align = 0; - - /* create device object */ - dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL); -@@ -402,6 +403,24 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) - dev->udev = interface_to_usbdev(intf); - dev->state = SMSUSB_DISCONNECTED; - -+ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { -+ struct usb_endpoint_descriptor *desc = -+ &intf->cur_altsetting->endpoint[i].desc; -+ -+ if (desc->bEndpointAddress & USB_DIR_IN) { -+ dev->in_ep = desc->bEndpointAddress; -+ align = usb_endpoint_maxp(desc) - sizeof(struct sms_msg_hdr); -+ } else { -+ dev->out_ep = desc->bEndpointAddress; -+ } -+ } -+ -+ pr_debug("in_ep = %02x, out_ep = %02x\n", dev->in_ep, dev->out_ep); -+ if (!dev->in_ep || !dev->out_ep || align < 0) { /* Missing endpoints? */ -+ smsusb_term_device(intf); -+ return -ENODEV; -+ } -+ - params.device_type = sms_get_board(board_id)->type; - - switch (params.device_type) { -@@ -416,24 +435,12 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) - /* fall-thru */ - default: - dev->buffer_size = USB2_BUFFER_SIZE; -- dev->response_alignment = -- le16_to_cpu(dev->udev->ep_in[1]->desc.wMaxPacketSize) - -- sizeof(struct sms_msg_hdr); -+ dev->response_alignment = align; - - params.flags |= SMS_DEVICE_FAMILY2; - break; - } - -- for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { -- if (intf->cur_altsetting->endpoint[i].desc. bEndpointAddress & USB_DIR_IN) -- dev->in_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress; -- else -- dev->out_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress; -- } -- -- pr_debug("in_ep = %02x, out_ep = %02x\n", -- dev->in_ep, dev->out_ep); -- - params.device = &dev->udev->dev; - params.buffer_size = dev->buffer_size; - params.num_buffers = MAX_BUFFERS; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index f2e3fdf385cc..ebd1b882556d 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -868,7 +868,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id, - unsigned int size; - unsigned int i; - -- extra_size = ALIGN(extra_size, sizeof(*entity->pads)); -+ extra_size = roundup(extra_size, sizeof(*entity->pads)); - num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1; - size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads - + num_inputs; -diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c -index 6ab481ee8ece..8ac02b6c162f 100644 ---- a/drivers/memory/tegra/mc.c -+++ b/drivers/memory/tegra/mc.c -@@ -72,7 +72,7 @@ static int tegra_mc_setup_latency_allowance(struct tegra_mc *mc) - u32 value; - - /* compute the number of MC clock cycles per tick */ -- tick = mc->tick * clk_get_rate(mc->clk); -+ tick = (unsigned long long)mc->tick * clk_get_rate(mc->clk); - do_div(tick, NSEC_PER_SEC); - - value = readl(mc->regs + MC_EMEM_ARB_CFG); -diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c -index c0012ca4229e..74923ffb0df1 100644 ---- a/drivers/misc/genwqe/card_dev.c -+++ b/drivers/misc/genwqe/card_dev.c -@@ -782,6 +782,8 @@ static int genwqe_pin_mem(struct genwqe_file *cfile, struct genwqe_mem *m) - - if ((m->addr == 0x0) || (m->size == 0)) - return -EINVAL; -+ if (m->size > ULONG_MAX - PAGE_SIZE - (m->addr & ~PAGE_MASK)) -+ return -EINVAL; - - map_addr = (m->addr & PAGE_MASK); - map_size = round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE); -diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c -index 0c15ba21fa54..d4c719683a8a 100644 ---- a/drivers/misc/genwqe/card_utils.c -+++ b/drivers/misc/genwqe/card_utils.c -@@ -582,6 +582,10 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr, - /* determine space needed for page_list. */ - data = (unsigned long)uaddr; - offs = offset_in_page(data); -+ if (size > ULONG_MAX - PAGE_SIZE - offs) { -+ m->size = 0; /* mark unused and not added */ -+ return -EINVAL; -+ } - m->nr_pages = DIV_ROUND_UP(offs + size, PAGE_SIZE); - - m->page_list = kcalloc(m->nr_pages, -diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c -index 967535d76e34..fb8741f18c1f 100644 ---- a/drivers/mmc/core/sd.c -+++ b/drivers/mmc/core/sd.c -@@ -216,6 +216,14 @@ static int mmc_decode_scr(struct mmc_card *card) - - if (scr->sda_spec3) - scr->cmds = UNSTUFF_BITS(resp, 32, 2); -+ -+ /* SD Spec says: any SD Card shall set at least bits 0 and 2 */ -+ if (!(scr->bus_widths & SD_SCR_BUS_WIDTH_1) || -+ !(scr->bus_widths & SD_SCR_BUS_WIDTH_4)) { -+ pr_err("%s: invalid bus width\n", mmc_hostname(card->host)); -+ return -EINVAL; -+ } -+ - return 0; - } - -diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c -index e03ec74f3fb0..40a369c7005a 100644 ---- a/drivers/mmc/host/mmc_spi.c -+++ b/drivers/mmc/host/mmc_spi.c -@@ -819,6 +819,10 @@ mmc_spi_readblock(struct mmc_spi_host *host, struct spi_transfer *t, - } - - status = spi_sync_locked(spi, &host->m); -+ if (status < 0) { -+ dev_dbg(&spi->dev, "read error %d\n", status); -+ return status; -+ } - - if (host->dma_dev) { - dma_sync_single_for_cpu(host->dma_dev, -diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c -index ac66c61d9433..356b294c93c9 100644 ---- a/drivers/mmc/host/sdhci-of-esdhc.c -+++ b/drivers/mmc/host/sdhci-of-esdhc.c -@@ -624,6 +624,11 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) - if (esdhc->vendor_ver > VENDOR_V_22) - host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; - -+ if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { -+ host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; -+ host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; -+ } -+ - if (of_device_is_compatible(np, "fsl,p5040-esdhc") || - of_device_is_compatible(np, "fsl,p5020-esdhc") || - of_device_is_compatible(np, "fsl,p4080-esdhc") || -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index 403fa8d98aa3..d450d8b3708c 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -12824,6 +12824,24 @@ static netdev_features_t bnx2x_features_check(struct sk_buff *skb, - struct net_device *dev, - netdev_features_t features) - { -+ /* -+ * A skb with gso_size + header length > 9700 will cause a -+ * firmware panic. Drop GSO support. -+ * -+ * Eventually the upper layer should not pass these packets down. -+ * -+ * For speed, if the gso_size is <= 9000, assume there will -+ * not be 700 bytes of headers and pass it through. Only do a -+ * full (slow) validation if the gso_size is > 9000. -+ * -+ * (Due to the way SKB_BY_FRAGS works this will also do a full -+ * validation in that case.) -+ */ -+ if (unlikely(skb_is_gso(skb) && -+ (skb_shinfo(skb)->gso_size > 9000) && -+ !skb_gso_validate_mac_len(skb, 9700))) -+ features &= ~NETIF_F_GSO_MASK; -+ - features = vlan_features_check(skb, features); - return vxlan_features_check(skb, features); - } -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index d9ab970dcbe9..81282b811a6c 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -1140,6 +1140,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, - skb = bnxt_copy_skb(bnapi, data, len, dma_addr); - bnxt_reuse_rx_data(rxr, cons, data); - if (!skb) { -+ if (agg_bufs) -+ bnxt_reuse_rx_agg_bufs(bnapi, cp_cons, agg_bufs); - rc = -ENOMEM; - goto next_rx; - } -diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h -index 8cffcdfd5678..38b5858c335a 100644 ---- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h -+++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h -@@ -75,8 +75,8 @@ struct l2t_data { - struct l2t_entry *rover; /* starting point for next allocation */ - atomic_t nfree; /* number of free entries */ - rwlock_t lock; -- struct l2t_entry l2tab[0]; - struct rcu_head rcu_head; /* to handle rcu cleanup */ -+ struct l2t_entry l2tab[]; - }; - - typedef void (*arp_failure_handler_func)(struct t3cdev * dev, -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -index a3e1498ca67c..3b96622de8ff 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -@@ -5061,15 +5061,24 @@ static int __init cxgb4_init_module(void) - - ret = pci_register_driver(&cxgb4_driver); - if (ret < 0) -- debugfs_remove(cxgb4_debugfs_root); -+ goto err_pci; - - #if IS_ENABLED(CONFIG_IPV6) - if (!inet6addr_registered) { -- register_inet6addr_notifier(&cxgb4_inet6addr_notifier); -- inet6addr_registered = true; -+ ret = register_inet6addr_notifier(&cxgb4_inet6addr_notifier); -+ if (ret) -+ pci_unregister_driver(&cxgb4_driver); -+ else -+ inet6addr_registered = true; - } - #endif - -+ if (ret == 0) -+ return ret; -+ -+err_pci: -+ debugfs_remove(cxgb4_debugfs_root); -+ - return ret; - } - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 06b38f50980c..22c43a776c6c 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -2263,6 +2263,10 @@ void i40e_vlan_stripping_enable(struct i40e_vsi *vsi) - struct i40e_vsi_context ctxt; - i40e_status ret; - -+ /* Don't modify stripping options if a port VLAN is active */ -+ if (vsi->info.pvid) -+ return; -+ - if ((vsi->info.valid_sections & - cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID)) && - ((vsi->info.port_vlan_flags & I40E_AQ_VSI_PVLAN_MODE_MASK) == 0)) -@@ -2293,6 +2297,10 @@ void i40e_vlan_stripping_disable(struct i40e_vsi *vsi) - struct i40e_vsi_context ctxt; - i40e_status ret; - -+ /* Don't modify stripping options if a port VLAN is active */ -+ if (vsi->info.pvid) -+ return; -+ - if ((vsi->info.valid_sections & - cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID)) && - ((vsi->info.port_vlan_flags & I40E_AQ_VSI_PVLAN_EMOD_MASK) == -diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c -index 42305f3234ff..03f0d20aa08b 100644 ---- a/drivers/net/ethernet/marvell/mvpp2.c -+++ b/drivers/net/ethernet/marvell/mvpp2.c -@@ -3940,7 +3940,7 @@ static inline void mvpp2_gmac_max_rx_size_set(struct mvpp2_port *port) - /* Set defaults to the MVPP2 port */ - static void mvpp2_defaults_set(struct mvpp2_port *port) - { -- int tx_port_num, val, queue, ptxq, lrxq; -+ int tx_port_num, val, queue, lrxq; - - /* Configure port to loopback if needed */ - if (port->flags & MVPP2_F_LOOPBACK) -@@ -3960,11 +3960,9 @@ static void mvpp2_defaults_set(struct mvpp2_port *port) - mvpp2_write(port->priv, MVPP2_TXP_SCHED_CMD_1_REG, 0); - - /* Close bandwidth for all queues */ -- for (queue = 0; queue < MVPP2_MAX_TXQ; queue++) { -- ptxq = mvpp2_txq_phys(port->id, queue); -+ for (queue = 0; queue < MVPP2_MAX_TXQ; queue++) - mvpp2_write(port->priv, -- MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(ptxq), 0); -- } -+ MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(queue), 0); - - /* Set refill period to 1 usec, refill tokens - * and bucket size to maximum -@@ -4722,7 +4720,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port, - txq->descs_phys = 0; - - /* Set minimum bandwidth for disabled TXQs */ -- mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->id), 0); -+ mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->log_id), 0); - - /* Set Tx descriptors queue starting address and size */ - mvpp2_write(port->priv, MVPP2_TXQ_NUM_REG, txq->id); -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -index bcfac000199e..fcd1e6b3950d 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -@@ -1906,6 +1906,8 @@ static int mlx4_en_set_tunable(struct net_device *dev, - return ret; - } - -+#define MLX4_EEPROM_PAGE_LEN 256 -+ - static int mlx4_en_get_module_info(struct net_device *dev, - struct ethtool_modinfo *modinfo) - { -@@ -1940,7 +1942,7 @@ static int mlx4_en_get_module_info(struct net_device *dev, - break; - case MLX4_MODULE_ID_SFP: - modinfo->type = ETH_MODULE_SFF_8472; -- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; -+ modinfo->eeprom_len = MLX4_EEPROM_PAGE_LEN; - break; - default: - return -ENOSYS; -diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c -index 897d061e4f03..3bf63de3a725 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mcg.c -+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c -@@ -1485,7 +1485,7 @@ int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port, - rule.port = port; - rule.qpn = qpn; - INIT_LIST_HEAD(&rule.list); -- mlx4_err(dev, "going promisc on %x\n", port); -+ mlx4_info(dev, "going promisc on %x\n", port); - - return mlx4_flow_attach(dev, &rule, regid_p); - } -diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c -index c2b21313dba7..a9c4818448f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/port.c -+++ b/drivers/net/ethernet/mellanox/mlx4/port.c -@@ -1398,11 +1398,6 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port, - size -= offset + size - I2C_PAGE_SIZE; - - i2c_addr = I2C_ADDR_LOW; -- if (offset >= I2C_PAGE_SIZE) { -- /* Reset offset to high page */ -- i2c_addr = I2C_ADDR_HIGH; -- offset -= I2C_PAGE_SIZE; -- } - - cable_info = (struct mlx4_cable_info *)inmad->data; - cable_info->dev_mem_address = cpu_to_be16(offset); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -index 90d95b3654f5..6bdde92869fb 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c -@@ -154,7 +154,8 @@ int stmmac_mdio_reset(struct mii_bus *bus) - of_property_read_u32_array(np, - "snps,reset-delays-us", data->delays, 3); - -- if (gpio_request(data->reset_gpio, "mdio-reset")) -+ if (devm_gpio_request(priv->device, data->reset_gpio, -+ "mdio-reset")) - return 0; - } - -diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c -index b5edc7f96a39..685e875f5164 100644 ---- a/drivers/net/ppp/ppp_deflate.c -+++ b/drivers/net/ppp/ppp_deflate.c -@@ -610,12 +610,20 @@ static struct compressor ppp_deflate_draft = { - - static int __init deflate_init(void) - { -- int answer = ppp_register_compressor(&ppp_deflate); -- if (answer == 0) -- printk(KERN_INFO -- "PPP Deflate Compression module registered\n"); -- ppp_register_compressor(&ppp_deflate_draft); -- return answer; -+ int rc; -+ -+ rc = ppp_register_compressor(&ppp_deflate); -+ if (rc) -+ return rc; -+ -+ rc = ppp_register_compressor(&ppp_deflate_draft); -+ if (rc) { -+ ppp_unregister_compressor(&ppp_deflate); -+ return rc; -+ } -+ -+ pr_info("PPP Deflate Compression module registered\n"); -+ return 0; - } - - static void __exit deflate_cleanup(void) -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index 36e1377fc954..1e921e5eddc7 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -727,7 +727,7 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - int err; - u8 iface_no; - struct usb_cdc_parsed_header hdr; -- u16 curr_ntb_format; -+ __le16 curr_ntb_format; - - ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); - if (!ctx) -@@ -841,7 +841,7 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - goto error2; - } - -- if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) { -+ if (curr_ntb_format == cpu_to_le16(USB_CDC_NCM_NTB32_FORMAT)) { - dev_info(&intf->dev, "resetting NTB format to 16-bit"); - err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT, - USB_TYPE_CLASS | USB_DIR_OUT -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 9710cf71054a..2502681369cd 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -499,6 +499,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) - - if (netif_running (dev->net) && - netif_device_present (dev->net) && -+ test_bit(EVENT_DEV_OPEN, &dev->flags) && - !test_bit (EVENT_RX_HALT, &dev->flags) && - !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) { - switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) { -@@ -1385,6 +1386,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, - spin_unlock_irqrestore(&dev->txq.lock, flags); - goto drop; - } -+ if (netif_queue_stopped(net)) { -+ usb_autopm_put_interface_async(dev->intf); -+ spin_unlock_irqrestore(&dev->txq.lock, flags); -+ goto drop; -+ } - - #ifdef CONFIG_PM - /* if this triggers the device is still a sleep */ -diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c -index dab25136214a..da14eca2aa2c 100644 ---- a/drivers/net/wireless/at76c50x-usb.c -+++ b/drivers/net/wireless/at76c50x-usb.c -@@ -2582,8 +2582,8 @@ static int __init at76_mod_init(void) - if (result < 0) - printk(KERN_ERR DRIVER_NAME - ": usb_register failed (status %d)\n", result); -- -- led_trigger_register_simple("at76_usb-tx", &ledtrig_tx); -+ else -+ led_trigger_register_simple("at76_usb-tx", &ledtrig_tx); - return result; - } - -diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c -index 058a9f232050..55cb07693ae8 100644 ---- a/drivers/net/wireless/b43/phy_lp.c -+++ b/drivers/net/wireless/b43/phy_lp.c -@@ -1834,7 +1834,7 @@ static void lpphy_papd_cal(struct b43_wldev *dev, struct lpphy_tx_gains gains, - static void lpphy_papd_cal_txpwr(struct b43_wldev *dev) - { - struct b43_phy_lp *lpphy = dev->phy.lp; -- struct lpphy_tx_gains gains, oldgains; -+ struct lpphy_tx_gains oldgains; - int old_txpctl, old_afe_ovr, old_rf, old_bbmult; - - lpphy_read_tx_pctl_mode_from_hardware(dev); -@@ -1848,9 +1848,9 @@ static void lpphy_papd_cal_txpwr(struct b43_wldev *dev) - lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF); - - if (dev->dev->chip_id == 0x4325 && dev->dev->chip_rev == 0) -- lpphy_papd_cal(dev, gains, 0, 1, 30); -+ lpphy_papd_cal(dev, oldgains, 0, 1, 30); - else -- lpphy_papd_cal(dev, gains, 0, 1, 65); -+ lpphy_papd_cal(dev, oldgains, 0, 1, 65); - - if (old_afe_ovr) - lpphy_set_tx_gains(dev, oldgains); -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/brcm80211/brcmfmac/bus.h -index 230cad788ace..84b8b1eaa22c 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/bus.h -+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h -@@ -214,7 +214,9 @@ bool brcmf_c_prec_enq(struct device *dev, struct pktq *q, struct sk_buff *pkt, - int prec); - - /* Receive frame for delivery to OS. Callee disposes of rxp. */ --void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp); -+void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp, bool handle_event); -+/* Receive async event packet from firmware. Callee disposes of rxp. */ -+void brcmf_rx_event(struct device *dev, struct sk_buff *rxp); - - /* Indication from bus module regarding presence/insertion of dongle. */ - int brcmf_attach(struct device *dev); -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -index ad35e760ed3f..231c0ba6acb9 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -@@ -3328,9 +3328,15 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp, - struct brcmf_pno_scanresults_le *pfn_result; - u32 result_count; - u32 status; -+ u32 datalen; - - brcmf_dbg(SCAN, "Enter\n"); - -+ if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) { -+ brcmf_dbg(SCAN, "Event data to small. Ignore\n"); -+ return 0; -+ } -+ - if (e->event_code == BRCMF_E_PFN_NET_LOST) { - brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n"); - return 0; -@@ -3349,6 +3355,14 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp, - if (result_count > 0) { - int i; - -+ data += sizeof(struct brcmf_pno_scanresults_le); -+ netinfo_start = (struct brcmf_pno_net_info_le *)data; -+ datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result); -+ if (datalen < result_count * sizeof(*netinfo)) { -+ brcmf_err("insufficient event data\n"); -+ goto out_err; -+ } -+ - request = kzalloc(sizeof(*request), GFP_KERNEL); - ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL); - channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL); -@@ -3358,9 +3372,6 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp, - } - - request->wiphy = wiphy; -- data += sizeof(struct brcmf_pno_scanresults_le); -- netinfo_start = (struct brcmf_pno_net_info_le *)data; -- - for (i = 0; i < result_count; i++) { - netinfo = &netinfo_start[i]; - if (!netinfo) { -@@ -3370,6 +3381,8 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp, - goto out_err; - } - -+ if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN) -+ netinfo->SSID_len = IEEE80211_MAX_SSID_LEN; - brcmf_dbg(SCAN, "SSID:%s Channel:%d\n", - netinfo->SSID, netinfo->channel); - memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len); -@@ -4836,6 +4849,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, - conn_info->req_ie = - kmemdup(cfg->extra_buf, conn_info->req_ie_len, - GFP_KERNEL); -+ if (!conn_info->req_ie) -+ conn_info->req_ie_len = 0; - } else { - conn_info->req_ie_len = 0; - conn_info->req_ie = NULL; -@@ -4852,6 +4867,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, - conn_info->resp_ie = - kmemdup(cfg->extra_buf, conn_info->resp_ie_len, - GFP_KERNEL); -+ if (!conn_info->resp_ie) -+ conn_info->resp_ie_len = 0; - } else { - conn_info->resp_ie_len = 0; - conn_info->resp_ie = NULL; -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c -index 82753e7c7e7c..3082391c3062 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c -@@ -303,15 +303,9 @@ void brcmf_txflowblock(struct device *dev, bool state) - - void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb) - { -- skb->dev = ifp->ndev; -- skb->protocol = eth_type_trans(skb, skb->dev); -- - if (skb->pkt_type == PACKET_MULTICAST) - ifp->stats.multicast++; - -- /* Process special event packets */ -- brcmf_fweh_process_skb(ifp->drvr, skb); -- - if (!(ifp->ndev->flags & IFF_UP)) { - brcmu_pkt_buf_free_skb(skb); - return; -@@ -526,7 +520,7 @@ netif_rx: - } - } - --void brcmf_rx_frame(struct device *dev, struct sk_buff *skb) -+void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event) - { - struct brcmf_if *ifp; - struct brcmf_bus *bus_if = dev_get_drvdata(dev); -@@ -546,11 +540,44 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb) - return; - } - -+ skb->protocol = eth_type_trans(skb, ifp->ndev); -+ - rd = (struct brcmf_skb_reorder_data *)skb->cb; -- if (rd->reorder) -+ if (rd->reorder) { - brcmf_rxreorder_process_info(ifp, rd->reorder, skb); -- else -+ } else { -+ /* Process special event packets */ -+ if (handle_event) -+ brcmf_fweh_process_skb(ifp->drvr, skb, -+ BCMILCP_SUBTYPE_VENDOR_LONG); -+ - brcmf_netif_rx(ifp, skb); -+ } -+} -+ -+void brcmf_rx_event(struct device *dev, struct sk_buff *skb) -+{ -+ struct brcmf_if *ifp; -+ struct brcmf_bus *bus_if = dev_get_drvdata(dev); -+ struct brcmf_pub *drvr = bus_if->drvr; -+ int ret; -+ -+ brcmf_dbg(EVENT, "Enter: %s: rxp=%p\n", dev_name(dev), skb); -+ -+ /* process and remove protocol-specific header */ -+ ret = brcmf_proto_hdrpull(drvr, true, skb, &ifp); -+ -+ if (ret || !ifp || !ifp->ndev) { -+ if (ret != -ENODATA && ifp) -+ ifp->stats.rx_errors++; -+ brcmu_pkt_buf_free_skb(skb); -+ return; -+ } -+ -+ skb->protocol = eth_type_trans(skb, ifp->ndev); -+ -+ brcmf_fweh_process_skb(ifp->drvr, skb, 0); -+ brcmu_pkt_buf_free_skb(skb); - } - - void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success) -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c -index 3878b6f6cfce..f9aa37032c2d 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c -@@ -25,50 +25,6 @@ - #include "fweh.h" - #include "fwil.h" - --/** -- * struct brcm_ethhdr - broadcom specific ether header. -- * -- * @subtype: subtype for this packet. -- * @length: TODO: length of appended data. -- * @version: version indication. -- * @oui: OUI of this packet. -- * @usr_subtype: subtype for this OUI. -- */ --struct brcm_ethhdr { -- __be16 subtype; -- __be16 length; -- u8 version; -- u8 oui[3]; -- __be16 usr_subtype; --} __packed; -- --struct brcmf_event_msg_be { -- __be16 version; -- __be16 flags; -- __be32 event_type; -- __be32 status; -- __be32 reason; -- __be32 auth_type; -- __be32 datalen; -- u8 addr[ETH_ALEN]; -- char ifname[IFNAMSIZ]; -- u8 ifidx; -- u8 bsscfgidx; --} __packed; -- --/** -- * struct brcmf_event - contents of broadcom event packet. -- * -- * @eth: standard ether header. -- * @hdr: broadcom specific ether header. -- * @msg: common part of the actual event message. -- */ --struct brcmf_event { -- struct ethhdr eth; -- struct brcm_ethhdr hdr; -- struct brcmf_event_msg_be msg; --} __packed; -- - /** - * struct brcmf_fweh_queue_item - event item on event queue. - * -@@ -85,6 +41,7 @@ struct brcmf_fweh_queue_item { - u8 ifidx; - u8 ifaddr[ETH_ALEN]; - struct brcmf_event_msg_be emsg; -+ u32 datalen; - u8 data[0]; - }; - -@@ -294,6 +251,11 @@ static void brcmf_fweh_event_worker(struct work_struct *work) - brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data, - min_t(u32, emsg.datalen, 64), - "event payload, len=%d\n", emsg.datalen); -+ if (emsg.datalen > event->datalen) { -+ brcmf_err("event invalid length header=%d, msg=%d\n", -+ event->datalen, emsg.datalen); -+ goto event_free; -+ } - - /* special handling of interface event */ - if (event->code == BRCMF_E_IF) { -@@ -439,7 +401,8 @@ int brcmf_fweh_activate_events(struct brcmf_if *ifp) - * dispatch the event to a registered handler (using worker). - */ - void brcmf_fweh_process_event(struct brcmf_pub *drvr, -- struct brcmf_event *event_packet) -+ struct brcmf_event *event_packet, -+ u32 packet_len) - { - enum brcmf_fweh_event_code code; - struct brcmf_fweh_info *fweh = &drvr->fweh; -@@ -459,6 +422,9 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, - if (code != BRCMF_E_IF && !fweh->evt_handler[code]) - return; - -+ if (datalen > BRCMF_DCMD_MAXLEN) -+ return; -+ - if (in_interrupt()) - alloc_flag = GFP_ATOMIC; - -@@ -472,6 +438,7 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, - /* use memcpy to get aligned event message */ - memcpy(&event->emsg, &event_packet->msg, sizeof(event->emsg)); - memcpy(event->data, data, datalen); -+ event->datalen = datalen; - memcpy(event->ifaddr, event_packet->eth.h_dest, ETH_ALEN); - - brcmf_fweh_queue_event(fweh, event); -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h -index d9a942842382..b53db92341ce 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h -+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h -@@ -27,7 +27,6 @@ - struct brcmf_pub; - struct brcmf_if; - struct brcmf_cfg80211_info; --struct brcmf_event; - - /* list of firmware events */ - #define BRCMF_FWEH_EVENT_ENUM_DEFLIST \ -@@ -180,11 +179,53 @@ enum brcmf_fweh_event_code { - /** - * definitions for event packet validation. - */ --#define BRCMF_EVENT_OUI_OFFSET 19 --#define BRCM_OUI "\x00\x10\x18" --#define DOT11_OUI_LEN 3 --#define BCMILCP_BCM_SUBTYPE_EVENT 1 -+#define BRCM_OUI "\x00\x10\x18" -+#define BCMILCP_BCM_SUBTYPE_EVENT 1 -+#define BCMILCP_SUBTYPE_VENDOR_LONG 32769 - -+/** -+ * struct brcm_ethhdr - broadcom specific ether header. -+ * -+ * @subtype: subtype for this packet. -+ * @length: TODO: length of appended data. -+ * @version: version indication. -+ * @oui: OUI of this packet. -+ * @usr_subtype: subtype for this OUI. -+ */ -+struct brcm_ethhdr { -+ __be16 subtype; -+ __be16 length; -+ u8 version; -+ u8 oui[3]; -+ __be16 usr_subtype; -+} __packed; -+ -+struct brcmf_event_msg_be { -+ __be16 version; -+ __be16 flags; -+ __be32 event_type; -+ __be32 status; -+ __be32 reason; -+ __be32 auth_type; -+ __be32 datalen; -+ u8 addr[ETH_ALEN]; -+ char ifname[IFNAMSIZ]; -+ u8 ifidx; -+ u8 bsscfgidx; -+} __packed; -+ -+/** -+ * struct brcmf_event - contents of broadcom event packet. -+ * -+ * @eth: standard ether header. -+ * @hdr: broadcom specific ether header. -+ * @msg: common part of the actual event message. -+ */ -+struct brcmf_event { -+ struct ethhdr eth; -+ struct brcm_ethhdr hdr; -+ struct brcmf_event_msg_be msg; -+} __packed; - - /** - * struct brcmf_event_msg - firmware event message. -@@ -256,34 +297,43 @@ void brcmf_fweh_unregister(struct brcmf_pub *drvr, - enum brcmf_fweh_event_code code); - int brcmf_fweh_activate_events(struct brcmf_if *ifp); - void brcmf_fweh_process_event(struct brcmf_pub *drvr, -- struct brcmf_event *event_packet); -+ struct brcmf_event *event_packet, -+ u32 packet_len); - void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing); - - static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr, -- struct sk_buff *skb) -+ struct sk_buff *skb, u16 stype) - { - struct brcmf_event *event_packet; -- u8 *data; -- u16 usr_stype; -+ u16 subtype, usr_stype; - - /* only process events when protocol matches */ - if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL)) - return; - -- /* check for BRCM oui match */ -+ if ((skb->len + ETH_HLEN) < sizeof(*event_packet)) -+ return; -+ - event_packet = (struct brcmf_event *)skb_mac_header(skb); -- data = (u8 *)event_packet; -- data += BRCMF_EVENT_OUI_OFFSET; -- if (memcmp(BRCM_OUI, data, DOT11_OUI_LEN)) -+ -+ /* check subtype if needed */ -+ if (unlikely(stype)) { -+ subtype = get_unaligned_be16(&event_packet->hdr.subtype); -+ if (subtype != stype) -+ return; -+ } -+ -+ /* check for BRCM oui match */ -+ if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0], -+ sizeof(event_packet->hdr.oui))) - return; - - /* final match on usr_subtype */ -- data += DOT11_OUI_LEN; -- usr_stype = get_unaligned_be16(data); -+ usr_stype = get_unaligned_be16(&event_packet->hdr.usr_subtype); - if (usr_stype != BCMILCP_BCM_SUBTYPE_EVENT) - return; - -- brcmf_fweh_process_event(drvr, event_packet); -+ brcmf_fweh_process_event(drvr, event_packet, skb->len + ETH_HLEN); - } - - #endif /* FWEH_H_ */ -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -index 44e618f9d890..6f7138cea555 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c -@@ -20,6 +20,7 @@ - - #include - #include -+#include - - #include - #include -@@ -1076,28 +1077,13 @@ static void brcmf_msgbuf_rxbuf_event_post(struct brcmf_msgbuf *msgbuf) - } - - --static void --brcmf_msgbuf_rx_skb(struct brcmf_msgbuf *msgbuf, struct sk_buff *skb, -- u8 ifidx) --{ -- struct brcmf_if *ifp; -- -- ifp = brcmf_get_ifp(msgbuf->drvr, ifidx); -- if (!ifp || !ifp->ndev) { -- brcmf_err("Received pkt for invalid ifidx %d\n", ifidx); -- brcmu_pkt_buf_free_skb(skb); -- return; -- } -- brcmf_netif_rx(ifp, skb); --} -- -- - static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf) - { - struct msgbuf_rx_event *event; - u32 idx; - u16 buflen; - struct sk_buff *skb; -+ struct brcmf_if *ifp; - - event = (struct msgbuf_rx_event *)buf; - idx = le32_to_cpu(event->msg.request_id); -@@ -1117,7 +1103,19 @@ static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf) - - skb_trim(skb, buflen); - -- brcmf_msgbuf_rx_skb(msgbuf, skb, event->msg.ifidx); -+ ifp = brcmf_get_ifp(msgbuf->drvr, event->msg.ifidx); -+ if (!ifp || !ifp->ndev) { -+ brcmf_err("Received pkt for invalid ifidx %d\n", -+ event->msg.ifidx); -+ goto exit; -+ } -+ -+ skb->protocol = eth_type_trans(skb, ifp->ndev); -+ -+ brcmf_fweh_process_skb(ifp->drvr, skb, 0); -+ -+exit: -+ brcmu_pkt_buf_free_skb(skb); - } - - -@@ -1129,6 +1127,7 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf) - u16 data_offset; - u16 buflen; - u32 idx; -+ struct brcmf_if *ifp; - - brcmf_msgbuf_update_rxbufpost_count(msgbuf, 1); - -@@ -1149,7 +1148,14 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf) - - skb_trim(skb, buflen); - -- brcmf_msgbuf_rx_skb(msgbuf, skb, rx_complete->msg.ifidx); -+ ifp = brcmf_get_ifp(msgbuf->drvr, rx_complete->msg.ifidx); -+ if (!ifp || !ifp->ndev) { -+ brcmf_err("Received pkt for invalid ifidx %d\n", -+ rx_complete->msg.ifidx); -+ brcmu_pkt_buf_free_skb(skb); -+ return; -+ } -+ brcmf_netif_rx(ifp, skb); - } - - -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -index 3196245ab820..e6c8b0d5afe0 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -@@ -1365,6 +1365,11 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp, - u16 mgmt_type; - u8 action; - -+ if (e->datalen < sizeof(*rxframe)) { -+ brcmf_dbg(SCAN, "Event data to small. Ignore\n"); -+ return 0; -+ } -+ - ch.chspec = be16_to_cpu(rxframe->chanspec); - cfg->d11inf.decchspec(&ch); - /* Check if wpa_supplicant has registered for this frame */ -@@ -1862,6 +1867,11 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp, - brcmf_dbg(INFO, "Enter: event %d reason %d\n", e->event_code, - e->reason); - -+ if (e->datalen < sizeof(*rxframe)) { -+ brcmf_dbg(SCAN, "Event data to small. Ignore\n"); -+ return 0; -+ } -+ - ch.chspec = be16_to_cpu(rxframe->chanspec); - cfg->d11inf.decchspec(&ch); - -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c -index 35f62b00f1df..9954e641c943 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c -@@ -1394,6 +1394,17 @@ static inline u8 brcmf_sdio_getdatoffset(u8 *swheader) - return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT); - } - -+static inline bool brcmf_sdio_fromevntchan(u8 *swheader) -+{ -+ u32 hdrvalue; -+ u8 ret; -+ -+ hdrvalue = *(u32 *)swheader; -+ ret = (u8)((hdrvalue & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT); -+ -+ return (ret == SDPCM_EVENT_CHANNEL); -+} -+ - static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header, - struct brcmf_sdio_hdrinfo *rd, - enum brcmf_sdio_frmtype type) -@@ -1754,7 +1765,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf_sdio *bus, u8 rxseq) - pfirst->len, pfirst->next, - pfirst->prev); - skb_unlink(pfirst, &bus->glom); -- brcmf_rx_frame(bus->sdiodev->dev, pfirst); -+ if (brcmf_sdio_fromevntchan(&dptr[SDPCM_HWHDR_LEN])) -+ brcmf_rx_event(bus->sdiodev->dev, pfirst); -+ else -+ brcmf_rx_frame(bus->sdiodev->dev, pfirst, -+ false); - bus->sdcnt.rxglompkts++; - } - -@@ -2081,18 +2096,19 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes) - __skb_trim(pkt, rd->len); - skb_pull(pkt, rd->dat_offset); - -+ if (pkt->len == 0) -+ brcmu_pkt_buf_free_skb(pkt); -+ else if (rd->channel == SDPCM_EVENT_CHANNEL) -+ brcmf_rx_event(bus->sdiodev->dev, pkt); -+ else -+ brcmf_rx_frame(bus->sdiodev->dev, pkt, -+ false); -+ - /* prepare the descriptor for the next read */ - rd->len = rd->len_nxtfrm << 4; - rd->len_nxtfrm = 0; - /* treat all packet as event if we don't know */ - rd->channel = SDPCM_EVENT_CHANNEL; -- -- if (pkt->len == 0) { -- brcmu_pkt_buf_free_skb(pkt); -- continue; -- } -- -- brcmf_rx_frame(bus->sdiodev->dev, pkt); - } - - rxcount = maxframes - rxleft; -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c -index 689e64d004bc..3002268e57f3 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c -@@ -144,7 +144,7 @@ struct brcmf_usbdev_info { - - struct usb_device *usbdev; - struct device *dev; -- struct mutex dev_init_lock; -+ struct completion dev_init_done; - - int ctl_in_pipe, ctl_out_pipe; - struct urb *ctl_urb; /* URB for control endpoint */ -@@ -502,7 +502,7 @@ static void brcmf_usb_rx_complete(struct urb *urb) - - if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) { - skb_put(skb, urb->actual_length); -- brcmf_rx_frame(devinfo->dev, skb); -+ brcmf_rx_frame(devinfo->dev, skb, true); - brcmf_usb_rx_refill(devinfo, req); - } else { - brcmu_pkt_buf_free_skb(skb); -@@ -669,12 +669,18 @@ static int brcmf_usb_up(struct device *dev) - - static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo) - { -+ int i; -+ - if (devinfo->ctl_urb) - usb_kill_urb(devinfo->ctl_urb); - if (devinfo->bulk_urb) - usb_kill_urb(devinfo->bulk_urb); -- brcmf_usb_free_q(&devinfo->tx_postq, true); -- brcmf_usb_free_q(&devinfo->rx_postq, true); -+ if (devinfo->tx_reqs) -+ for (i = 0; i < devinfo->bus_pub.ntxq; i++) -+ usb_kill_urb(devinfo->tx_reqs[i].urb); -+ if (devinfo->rx_reqs) -+ for (i = 0; i < devinfo->bus_pub.nrxq; i++) -+ usb_kill_urb(devinfo->rx_reqs[i].urb); - } - - static void brcmf_usb_down(struct device *dev) -@@ -1226,11 +1232,11 @@ static void brcmf_usb_probe_phase2(struct device *dev, - if (ret) - goto error; - -- mutex_unlock(&devinfo->dev_init_lock); -+ complete(&devinfo->dev_init_done); - return; - error: - brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret); -- mutex_unlock(&devinfo->dev_init_lock); -+ complete(&devinfo->dev_init_done); - device_release_driver(dev); - } - -@@ -1268,7 +1274,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo) - if (ret) - goto fail; - /* we are done */ -- mutex_unlock(&devinfo->dev_init_lock); -+ complete(&devinfo->dev_init_done); - return 0; - } - bus->chip = bus_pub->devid; -@@ -1322,11 +1328,10 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) - - devinfo->usbdev = usb; - devinfo->dev = &usb->dev; -- /* Take an init lock, to protect for disconnect while still loading. -+ /* Init completion, to protect for disconnect while still loading. - * Necessary because of the asynchronous firmware load construction - */ -- mutex_init(&devinfo->dev_init_lock); -- mutex_lock(&devinfo->dev_init_lock); -+ init_completion(&devinfo->dev_init_done); - - usb_set_intfdata(intf, devinfo); - -@@ -1402,7 +1407,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) - return 0; - - fail: -- mutex_unlock(&devinfo->dev_init_lock); -+ complete(&devinfo->dev_init_done); - kfree(devinfo); - usb_set_intfdata(intf, NULL); - return ret; -@@ -1417,7 +1422,7 @@ brcmf_usb_disconnect(struct usb_interface *intf) - devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf); - - if (devinfo) { -- mutex_lock(&devinfo->dev_init_lock); -+ wait_for_completion(&devinfo->dev_init_done); - /* Make sure that devinfo still exists. Firmware probe routines - * may have released the device and cleared the intfdata. - */ -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c -index 8eff2753abad..d493021f6031 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c -@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, - struct brcmf_if *ifp; - const struct brcmf_vndr_dcmd_hdr *cmdhdr = data; - struct sk_buff *reply; -- int ret, payload, ret_len; -+ unsigned int payload, ret_len; - void *dcmd_buf = NULL, *wr_pointer; - u16 msglen, maxmsglen = PAGE_SIZE - 0x100; -+ int ret; - - if (len < sizeof(*cmdhdr)) { - brcmf_err("vendor command too short: %d\n", len); -@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, - brcmf_err("oversize return buffer %d\n", ret_len); - ret_len = BRCMF_DCMD_MAXLEN; - } -- payload = max(ret_len, len) + 1; -+ payload = max_t(unsigned int, ret_len, len) + 1; - dcmd_buf = vzalloc(payload); - if (NULL == dcmd_buf) - return -ENOMEM; -diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c -index 0e51e27d2e3f..317daa968e03 100644 ---- a/drivers/net/wireless/cw1200/main.c -+++ b/drivers/net/wireless/cw1200/main.c -@@ -345,6 +345,11 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, - mutex_init(&priv->wsm_cmd_mux); - mutex_init(&priv->conf_mutex); - priv->workqueue = create_singlethread_workqueue("cw1200_wq"); -+ if (!priv->workqueue) { -+ ieee80211_free_hw(hw); -+ return NULL; -+ } -+ - sema_init(&priv->scan.lock, 1); - INIT_WORK(&priv->scan.work, cw1200_scan_work); - INIT_DELAYED_WORK(&priv->scan.probe_work, cw1200_probe_work); -diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c -index 3ddb8ec676ed..6dd331dfb517 100644 ---- a/drivers/net/wireless/mwifiex/cfp.c -+++ b/drivers/net/wireless/mwifiex/cfp.c -@@ -533,5 +533,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv, - rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ? - rx_rate - 1 : rx_rate; - -+ if (rate_index >= MWIFIEX_MAX_AC_RX_RATES) -+ rate_index = MWIFIEX_MAX_AC_RX_RATES - 1; -+ - return rate_index; - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c -index aab752328c26..5013d8c1d4a6 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/base.c -+++ b/drivers/net/wireless/realtek/rtlwifi/base.c -@@ -466,6 +466,11 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) - /* <2> work queue */ - rtlpriv->works.hw = hw; - rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); -+ if (unlikely(!rtlpriv->works.rtl_wq)) { -+ pr_err("Failed to allocate work queue\n"); -+ return; -+ } -+ - INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, - (void *)rtl_watchdog_wq_callback); - INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq, -diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c -index 34f1d6b41fb9..cc3708ea8084 100644 ---- a/drivers/parisc/ccio-dma.c -+++ b/drivers/parisc/ccio-dma.c -@@ -563,8 +563,6 @@ ccio_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba, - /* We currently only support kernel addresses */ - BUG_ON(sid != KERNEL_SPACE); - -- mtsp(sid,1); -- - /* - ** WORD 1 - low order word - ** "hints" parm includes the VALID bit! -@@ -595,7 +593,7 @@ ccio_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba, - ** Grab virtual index [0:11] - ** Deposit virt_idx bits into I/O PDIR word - */ -- asm volatile ("lci %%r0(%%sr1, %1), %0" : "=r" (ci) : "r" (vba)); -+ asm volatile ("lci %%r0(%1), %0" : "=r" (ci) : "r" (vba)); - asm volatile ("extru %1,19,12,%0" : "+r" (ci) : "r" (ci)); - asm volatile ("depw %1,15,12,%0" : "+r" (pa) : "r" (ci)); - -diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c -index d6326144ce01..f3b9746157f8 100644 ---- a/drivers/parisc/sba_iommu.c -+++ b/drivers/parisc/sba_iommu.c -@@ -573,8 +573,7 @@ sba_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba, - pa = virt_to_phys(vba); - pa &= IOVP_MASK; - -- mtsp(sid,1); -- asm("lci 0(%%sr1, %1), %0" : "=r" (ci) : "r" (vba)); -+ asm("lci 0(%1), %0" : "=r" (ci) : "r" (vba)); - pa |= (ci >> PAGE_SHIFT) & 0xff; /* move CI (8 bits) into lowest byte */ - - pa |= SBA_PDIR_VALID_BIT; /* set "valid" bit */ -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index d85010ebac5a..36c6f3702167 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3141,6 +3141,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); - - static void quirk_no_pm_reset(struct pci_dev *dev) - { -diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c -index 98a459b1c095..86e8d989092c 100644 ---- a/drivers/pinctrl/pinctrl-pistachio.c -+++ b/drivers/pinctrl/pinctrl-pistachio.c -@@ -1373,6 +1373,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) - if (!of_find_property(child, "gpio-controller", NULL)) { - dev_err(pctl->dev, - "No gpio-controller property for bank %u\n", i); -+ of_node_put(child); - ret = -ENODEV; - goto err; - } -@@ -1380,6 +1381,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) - irq = irq_of_parse_and_map(child, 0); - if (irq < 0) { - dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); -+ of_node_put(child); - ret = irq; - goto err; - } -diff --git a/drivers/power/power_supply_sysfs.c b/drivers/power/power_supply_sysfs.c -index ed2d7fd0c734..488dd7eb0aeb 100644 ---- a/drivers/power/power_supply_sysfs.c -+++ b/drivers/power/power_supply_sysfs.c -@@ -277,15 +277,11 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env) - char *prop_buf; - char *attrname; - -- dev_dbg(dev, "uevent\n"); -- - if (!psy || !psy->desc) { - dev_dbg(dev, "No power supply yet\n"); - return ret; - } - -- dev_dbg(dev, "POWER_SUPPLY_NAME=%s\n", psy->desc->name); -- - ret = add_uevent_var(env, "POWER_SUPPLY_NAME=%s", psy->desc->name); - if (ret) - return ret; -@@ -321,8 +317,6 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env) - goto out; - } - -- dev_dbg(dev, "prop %s=%s\n", attrname, prop_buf); -- - ret = add_uevent_var(env, "POWER_SUPPLY_%s=%s", attrname, prop_buf); - kfree(attrname); - if (ret) -diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c -index 19e53b3b8e00..166faae3a59c 100644 ---- a/drivers/rtc/rtc-88pm860x.c -+++ b/drivers/rtc/rtc-88pm860x.c -@@ -414,7 +414,7 @@ static int pm860x_rtc_remove(struct platform_device *pdev) - struct pm860x_rtc_info *info = platform_get_drvdata(pdev); - - #ifdef VRTC_CALIBRATION -- flush_scheduled_work(); -+ cancel_delayed_work_sync(&info->calib_work); - /* disable measurement */ - pm860x_set_bits(info->i2c, PM8607_MEAS_EN2, MEAS2_VRTC, 0); - #endif /* VRTC_CALIBRATION */ -diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h -index a01376ae1749..fdb87520543f 100644 ---- a/drivers/s390/cio/cio.h -+++ b/drivers/s390/cio/cio.h -@@ -102,7 +102,7 @@ struct subchannel { - struct schib_config config; - } __attribute__ ((aligned(8))); - --DECLARE_PER_CPU(struct irb, cio_irb); -+DECLARE_PER_CPU_ALIGNED(struct irb, cio_irb); - - #define to_subchannel(n) container_of(n, struct subchannel, dev) - -diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h -index a39a74500e23..aeb93478482f 100644 ---- a/drivers/s390/scsi/zfcp_ext.h -+++ b/drivers/s390/scsi/zfcp_ext.h -@@ -161,6 +161,7 @@ extern const struct attribute_group *zfcp_port_attr_groups[]; - extern struct mutex zfcp_sysfs_port_units_mutex; - extern struct device_attribute *zfcp_sysfs_sdev_attrs[]; - extern struct device_attribute *zfcp_sysfs_shost_attrs[]; -+bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port); - - /* zfcp_unit.c */ - extern int zfcp_unit_add(struct zfcp_port *, u64); -diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c -index bdb257eaa2e5..68146b398603 100644 ---- a/drivers/s390/scsi/zfcp_scsi.c -+++ b/drivers/s390/scsi/zfcp_scsi.c -@@ -124,6 +124,15 @@ static int zfcp_scsi_slave_alloc(struct scsi_device *sdev) - - zfcp_sdev->erp_action.port = port; - -+ mutex_lock(&zfcp_sysfs_port_units_mutex); -+ if (zfcp_sysfs_port_is_removing(port)) { -+ /* port is already gone */ -+ mutex_unlock(&zfcp_sysfs_port_units_mutex); -+ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */ -+ return -ENXIO; -+ } -+ mutex_unlock(&zfcp_sysfs_port_units_mutex); -+ - unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev)); - if (unit) - put_device(&unit->dev); -diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c -index 96a0be13e841..5df597d1b978 100644 ---- a/drivers/s390/scsi/zfcp_sysfs.c -+++ b/drivers/s390/scsi/zfcp_sysfs.c -@@ -237,6 +237,53 @@ static ZFCP_DEV_ATTR(adapter, port_rescan, S_IWUSR, NULL, - - DEFINE_MUTEX(zfcp_sysfs_port_units_mutex); - -+static void zfcp_sysfs_port_set_removing(struct zfcp_port *const port) -+{ -+ lockdep_assert_held(&zfcp_sysfs_port_units_mutex); -+ atomic_set(&port->units, -1); -+} -+ -+bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port) -+{ -+ lockdep_assert_held(&zfcp_sysfs_port_units_mutex); -+ return atomic_read(&port->units) == -1; -+} -+ -+static bool zfcp_sysfs_port_in_use(struct zfcp_port *const port) -+{ -+ struct zfcp_adapter *const adapter = port->adapter; -+ unsigned long flags; -+ struct scsi_device *sdev; -+ bool in_use = true; -+ -+ mutex_lock(&zfcp_sysfs_port_units_mutex); -+ if (atomic_read(&port->units) > 0) -+ goto unlock_port_units_mutex; /* zfcp_unit(s) under port */ -+ -+ spin_lock_irqsave(adapter->scsi_host->host_lock, flags); -+ __shost_for_each_device(sdev, adapter->scsi_host) { -+ const struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev); -+ -+ if (sdev->sdev_state == SDEV_DEL || -+ sdev->sdev_state == SDEV_CANCEL) -+ continue; -+ if (zsdev->port != port) -+ continue; -+ /* alive scsi_device under port of interest */ -+ goto unlock_host_lock; -+ } -+ -+ /* port is about to be removed, so no more unit_add or slave_alloc */ -+ zfcp_sysfs_port_set_removing(port); -+ in_use = false; -+ -+unlock_host_lock: -+ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags); -+unlock_port_units_mutex: -+ mutex_unlock(&zfcp_sysfs_port_units_mutex); -+ return in_use; -+} -+ - static ssize_t zfcp_sysfs_port_remove_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -@@ -259,15 +306,11 @@ static ssize_t zfcp_sysfs_port_remove_store(struct device *dev, - else - retval = 0; - -- mutex_lock(&zfcp_sysfs_port_units_mutex); -- if (atomic_read(&port->units) > 0) { -+ if (zfcp_sysfs_port_in_use(port)) { - retval = -EBUSY; -- mutex_unlock(&zfcp_sysfs_port_units_mutex); -+ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */ - goto out; - } -- /* port is about to be removed, so no more unit_add */ -- atomic_set(&port->units, -1); -- mutex_unlock(&zfcp_sysfs_port_units_mutex); - - write_lock_irq(&adapter->port_list_lock); - list_del(&port->list); -diff --git a/drivers/s390/scsi/zfcp_unit.c b/drivers/s390/scsi/zfcp_unit.c -index 157d3d203ba1..f00693698abc 100644 ---- a/drivers/s390/scsi/zfcp_unit.c -+++ b/drivers/s390/scsi/zfcp_unit.c -@@ -122,7 +122,7 @@ int zfcp_unit_add(struct zfcp_port *port, u64 fcp_lun) - int retval = 0; - - mutex_lock(&zfcp_sysfs_port_units_mutex); -- if (atomic_read(&port->units) == -1) { -+ if (zfcp_sysfs_port_is_removing(port)) { - /* port is already gone */ - retval = -ENODEV; - goto out; -@@ -166,8 +166,14 @@ int zfcp_unit_add(struct zfcp_port *port, u64 fcp_lun) - write_lock_irq(&port->unit_list_lock); - list_add_tail(&unit->list, &port->unit_list); - write_unlock_irq(&port->unit_list_lock); -+ /* -+ * lock order: shost->scan_mutex before zfcp_sysfs_port_units_mutex -+ * due to zfcp_unit_scsi_scan() => zfcp_scsi_slave_alloc() -+ */ -+ mutex_unlock(&zfcp_sysfs_port_units_mutex); - - zfcp_unit_scsi_scan(unit); -+ return retval; - - out: - mutex_unlock(&zfcp_sysfs_port_units_mutex); -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 1a6f65db615e..ee1f9ee995e5 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -2027,6 +2027,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last) - if ((SAS_ADDR(sas_addr) == 0) || (res == -ECOMM)) { - phy->phy_state = PHY_EMPTY; - sas_unregister_devs_sas_addr(dev, phy_id, last); -+ /* -+ * Even though the PHY is empty, for convenience we discover -+ * the PHY to update the PHY info, like negotiated linkrate. -+ */ -+ sas_ex_phy_discover(dev, phy_id); - return res; - } else if (SAS_ADDR(sas_addr) == SAS_ADDR(phy->attached_sas_addr) && - dev_type_flutter(type, phy->attached_dev_type)) { -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 4131addfb872..a67950908db1 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -902,7 +902,11 @@ lpfc_linkdown(struct lpfc_hba *phba) - lpfc_linkdown_port(vports[i]); - } - lpfc_destroy_vport_work_array(phba, vports); -- /* Clean up any firmware default rpi's */ -+ -+ /* Clean up any SLI3 firmware default rpi's */ -+ if (phba->sli_rev > LPFC_SLI_REV3) -+ goto skip_unreg_did; -+ - mb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); - if (mb) { - lpfc_unreg_did(phba, 0xffff, LPFC_UNREG_ALL_DFLT_RPIS, mb); -@@ -914,6 +918,7 @@ lpfc_linkdown(struct lpfc_hba *phba) - } - } - -+ skip_unreg_did: - /* Setup myDID for link up if we are in pt2pt mode */ - if (phba->pport->fc_flag & FC_PT2PT) { - phba->pport->fc_myDID = 0; -@@ -4647,6 +4652,10 @@ lpfc_unreg_default_rpis(struct lpfc_vport *vport) - LPFC_MBOXQ_t *mbox; - int rc; - -+ /* Unreg DID is an SLI3 operation. */ -+ if (phba->sli_rev > LPFC_SLI_REV3) -+ return; -+ - mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); - if (mbox) { - lpfc_unreg_did(phba, vport->vpi, LPFC_UNREG_ALL_DFLT_RPIS, -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index c158967b59d7..d220b4f691c7 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -5939,7 +5939,7 @@ static int get_fw_boot_info(struct scsi_qla_host *ha, uint16_t ddb_index[]) - val = rd_nvram_byte(ha, sec_addr); - if (val & BIT_7) - ddb_index[1] = (val & 0x7f); -- -+ goto exit_boot_info; - } else if (is_qla80XX(ha)) { - buf = dma_alloc_coherent(&ha->pdev->dev, size, - &buf_dma, GFP_KERNEL); -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 62adaca8fb97..91b9eca75b75 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2396,7 +2396,6 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer) - int res; - struct scsi_device *sdp = sdkp->device; - struct scsi_mode_data data; -- int disk_ro = get_disk_ro(sdkp->disk); - int old_wp = sdkp->write_prot; - - set_disk_ro(sdkp->disk, 0); -@@ -2437,7 +2436,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer) - "Test WP failed, assume Write Enabled\n"); - } else { - sdkp->write_prot = ((data.device_specific & 0x80) != 0); -- set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro); -+ set_disk_ro(sdkp->disk, sdkp->write_prot); - if (sdkp->first_scan || old_wp != sdkp->write_prot) { - sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n", - sdkp->write_prot ? "on" : "off"); -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index c94d465de941..7322a17660d1 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -4144,19 +4144,19 @@ static u32 ufshcd_find_max_sup_active_icc_level(struct ufs_hba *hba, - goto out; - } - -- if (hba->vreg_info.vcc) -+ if (hba->vreg_info.vcc && hba->vreg_info.vcc->max_uA) - icc_level = ufshcd_get_max_icc_level( - hba->vreg_info.vcc->max_uA, - POWER_DESC_MAX_ACTV_ICC_LVLS - 1, - &desc_buf[PWR_DESC_ACTIVE_LVLS_VCC_0]); - -- if (hba->vreg_info.vccq) -+ if (hba->vreg_info.vccq && hba->vreg_info.vccq->max_uA) - icc_level = ufshcd_get_max_icc_level( - hba->vreg_info.vccq->max_uA, - icc_level, - &desc_buf[PWR_DESC_ACTIVE_LVLS_VCCQ_0]); - -- if (hba->vreg_info.vccq2) -+ if (hba->vreg_info.vccq2 && hba->vreg_info.vccq2->max_uA) - icc_level = ufshcd_get_max_icc_level( - hba->vreg_info.vccq2->max_uA, - icc_level, -@@ -4390,6 +4390,15 @@ static int ufshcd_config_vreg_load(struct device *dev, struct ufs_vreg *vreg, - if (!vreg) - return 0; - -+ /* -+ * "set_load" operation shall be required on those regulators -+ * which specifically configured current limitation. Otherwise -+ * zero max_uA may cause unexpected behavior when regulator is -+ * enabled or set as high power mode. -+ */ -+ if (!vreg->max_uA) -+ return 0; -+ - ret = regulator_set_load(vreg->reg, ua); - if (ret < 0) { - dev_err(dev, "%s: %s set load (ua=%d) failed, err=%d\n", -@@ -4425,12 +4434,15 @@ static int ufshcd_config_vreg(struct device *dev, - name = vreg->name; - - if (regulator_count_voltages(reg) > 0) { -- min_uV = on ? vreg->min_uV : 0; -- ret = regulator_set_voltage(reg, min_uV, vreg->max_uV); -- if (ret) { -- dev_err(dev, "%s: %s set voltage failed, err=%d\n", -+ if (vreg->min_uV && vreg->max_uV) { -+ min_uV = on ? vreg->min_uV : 0; -+ ret = regulator_set_voltage(reg, min_uV, vreg->max_uV); -+ if (ret) { -+ dev_err(dev, -+ "%s: %s set voltage failed, err=%d\n", - __func__, name, ret); -- goto out; -+ goto out; -+ } - } - - uA_load = on ? vreg->max_uA : 0; -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index 3cac73e4c3e4..e87b6fc9f4c6 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -859,10 +859,14 @@ static unsigned int ssp_get_clk_div(struct driver_data *drv_data, int rate) - - rate = min_t(int, ssp_clk, rate); - -+ /* -+ * Calculate the divisor for the SCR (Serial Clock Rate), avoiding -+ * that the SSP transmission rate can be greater than the device rate -+ */ - if (ssp->type == PXA25x_SSP || ssp->type == CE4100_SSP) -- return (ssp_clk / (2 * rate) - 1) & 0xff; -+ return (DIV_ROUND_UP(ssp_clk, 2 * rate) - 1) & 0xff; - else -- return (ssp_clk / rate - 1) & 0xfff; -+ return (DIV_ROUND_UP(ssp_clk, rate) - 1) & 0xfff; - } - - static unsigned int pxa2xx_ssp_get_clk_div(struct driver_data *drv_data, -diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c -index 9882d93e7566..0556259377f7 100644 ---- a/drivers/spi/spi-rspi.c -+++ b/drivers/spi/spi-rspi.c -@@ -279,7 +279,8 @@ static int rspi_set_config_register(struct rspi_data *rspi, int access_size) - /* Sets parity, interrupt mask */ - rspi_write8(rspi, 0x00, RSPI_SPCR2); - -- /* Sets SPCMD */ -+ /* Resets sequencer */ -+ rspi_write8(rspi, 0, RSPI_SPSCR); - rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size); - rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0); - -@@ -313,7 +314,8 @@ static int rspi_rz_set_config_register(struct rspi_data *rspi, int access_size) - rspi_write8(rspi, 0x00, RSPI_SSLND); - rspi_write8(rspi, 0x00, RSPI_SPND); - -- /* Sets SPCMD */ -+ /* Resets sequencer */ -+ rspi_write8(rspi, 0, RSPI_SPSCR); - rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size); - rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0); - -@@ -364,7 +366,8 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size) - /* Sets buffer to allow normal operation */ - rspi_write8(rspi, 0x00, QSPI_SPBFCR); - -- /* Sets SPCMD */ -+ /* Resets sequencer */ -+ rspi_write8(rspi, 0, RSPI_SPSCR); - rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0); - - /* Enables SPI function in master mode */ -diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c -index 73779cecc3bb..705f515863d4 100644 ---- a/drivers/spi/spi-tegra114.c -+++ b/drivers/spi/spi-tegra114.c -@@ -1067,27 +1067,19 @@ static int tegra_spi_probe(struct platform_device *pdev) - - spi_irq = platform_get_irq(pdev, 0); - tspi->irq = spi_irq; -- ret = request_threaded_irq(tspi->irq, tegra_spi_isr, -- tegra_spi_isr_thread, IRQF_ONESHOT, -- dev_name(&pdev->dev), tspi); -- if (ret < 0) { -- dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n", -- tspi->irq); -- goto exit_free_master; -- } - - tspi->clk = devm_clk_get(&pdev->dev, "spi"); - if (IS_ERR(tspi->clk)) { - dev_err(&pdev->dev, "can not get clock\n"); - ret = PTR_ERR(tspi->clk); -- goto exit_free_irq; -+ goto exit_free_master; - } - - tspi->rst = devm_reset_control_get(&pdev->dev, "spi"); - if (IS_ERR(tspi->rst)) { - dev_err(&pdev->dev, "can not get reset\n"); - ret = PTR_ERR(tspi->rst); -- goto exit_free_irq; -+ goto exit_free_master; - } - - tspi->max_buf_size = SPI_FIFO_DEPTH << 2; -@@ -1095,7 +1087,7 @@ static int tegra_spi_probe(struct platform_device *pdev) - - ret = tegra_spi_init_dma_param(tspi, true); - if (ret < 0) -- goto exit_free_irq; -+ goto exit_free_master; - ret = tegra_spi_init_dma_param(tspi, false); - if (ret < 0) - goto exit_rx_dma_free; -@@ -1117,18 +1109,32 @@ static int tegra_spi_probe(struct platform_device *pdev) - dev_err(&pdev->dev, "pm runtime get failed, e = %d\n", ret); - goto exit_pm_disable; - } -+ -+ reset_control_assert(tspi->rst); -+ udelay(2); -+ reset_control_deassert(tspi->rst); - tspi->def_command1_reg = SPI_M_S; - tegra_spi_writel(tspi, tspi->def_command1_reg, SPI_COMMAND1); - pm_runtime_put(&pdev->dev); -+ ret = request_threaded_irq(tspi->irq, tegra_spi_isr, -+ tegra_spi_isr_thread, IRQF_ONESHOT, -+ dev_name(&pdev->dev), tspi); -+ if (ret < 0) { -+ dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n", -+ tspi->irq); -+ goto exit_pm_disable; -+ } - - master->dev.of_node = pdev->dev.of_node; - ret = devm_spi_register_master(&pdev->dev, master); - if (ret < 0) { - dev_err(&pdev->dev, "can not register to master err %d\n", ret); -- goto exit_pm_disable; -+ goto exit_free_irq; - } - return ret; - -+exit_free_irq: -+ free_irq(spi_irq, tspi); - exit_pm_disable: - pm_runtime_disable(&pdev->dev); - if (!pm_runtime_status_suspended(&pdev->dev)) -@@ -1136,8 +1142,6 @@ exit_pm_disable: - tegra_spi_deinit_dma_param(tspi, false); - exit_rx_dma_free: - tegra_spi_deinit_dma_param(tspi, true); --exit_free_irq: -- free_irq(spi_irq, tspi); - exit_free_master: - spi_master_put(master); - return ret; -diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c -index 93dfcee0f987..9f30a4ab2004 100644 ---- a/drivers/spi/spi-topcliff-pch.c -+++ b/drivers/spi/spi-topcliff-pch.c -@@ -1326,18 +1326,27 @@ static void pch_free_dma_buf(struct pch_spi_board_data *board_dat, - return; - } - --static void pch_alloc_dma_buf(struct pch_spi_board_data *board_dat, -+static int pch_alloc_dma_buf(struct pch_spi_board_data *board_dat, - struct pch_spi_data *data) - { - struct pch_spi_dma_ctrl *dma; -+ int ret; - - dma = &data->dma; -+ ret = 0; - /* Get Consistent memory for Tx DMA */ - dma->tx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev, - PCH_BUF_SIZE, &dma->tx_buf_dma, GFP_KERNEL); -+ if (!dma->tx_buf_virt) -+ ret = -ENOMEM; -+ - /* Get Consistent memory for Rx DMA */ - dma->rx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev, - PCH_BUF_SIZE, &dma->rx_buf_dma, GFP_KERNEL); -+ if (!dma->rx_buf_virt) -+ ret = -ENOMEM; -+ -+ return ret; - } - - static int pch_spi_pd_probe(struct platform_device *plat_dev) -@@ -1414,7 +1423,9 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev) - - if (use_dma) { - dev_info(&plat_dev->dev, "Use DMA for data transfers\n"); -- pch_alloc_dma_buf(board_dat, data); -+ ret = pch_alloc_dma_buf(board_dat, data); -+ if (ret) -+ goto err_spi_register_master; - } - - ret = spi_register_master(master); -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 04fd651f9e3e..c132c676df3a 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -903,6 +903,8 @@ static int spi_map_msg(struct spi_master *master, struct spi_message *msg) - if (max_tx || max_rx) { - list_for_each_entry(xfer, &msg->transfers, - transfer_list) { -+ if (!xfer->len) -+ continue; - if (!xfer->tx_buf) - xfer->tx_buf = master->dummy_tx; - if (!xfer->rx_buf) -diff --git a/drivers/ssb/bridge_pcmcia_80211.c b/drivers/ssb/bridge_pcmcia_80211.c -index d70568ea02d5..2ff7d90e166a 100644 ---- a/drivers/ssb/bridge_pcmcia_80211.c -+++ b/drivers/ssb/bridge_pcmcia_80211.c -@@ -113,16 +113,21 @@ static struct pcmcia_driver ssb_host_pcmcia_driver = { - .resume = ssb_host_pcmcia_resume, - }; - -+static int pcmcia_init_failed; -+ - /* - * These are not module init/exit functions! - * The module_pcmcia_driver() helper cannot be used here. - */ - int ssb_host_pcmcia_init(void) - { -- return pcmcia_register_driver(&ssb_host_pcmcia_driver); -+ pcmcia_init_failed = pcmcia_register_driver(&ssb_host_pcmcia_driver); -+ -+ return pcmcia_init_failed; - } - - void ssb_host_pcmcia_exit(void) - { -- pcmcia_unregister_driver(&ssb_host_pcmcia_driver); -+ if (!pcmcia_init_failed) -+ pcmcia_unregister_driver(&ssb_host_pcmcia_driver); - } -diff --git a/drivers/staging/iio/magnetometer/hmc5843_i2c.c b/drivers/staging/iio/magnetometer/hmc5843_i2c.c -index 3e06ceb32059..676a8e329eeb 100644 ---- a/drivers/staging/iio/magnetometer/hmc5843_i2c.c -+++ b/drivers/staging/iio/magnetometer/hmc5843_i2c.c -@@ -59,8 +59,13 @@ static const struct regmap_config hmc5843_i2c_regmap_config = { - static int hmc5843_i2c_probe(struct i2c_client *cli, - const struct i2c_device_id *id) - { -+ struct regmap *regmap = devm_regmap_init_i2c(cli, -+ &hmc5843_i2c_regmap_config); -+ if (IS_ERR(regmap)) -+ return PTR_ERR(regmap); -+ - return hmc5843_common_probe(&cli->dev, -- devm_regmap_init_i2c(cli, &hmc5843_i2c_regmap_config), -+ regmap, - id->driver_data, id->name); - } - -diff --git a/drivers/staging/iio/magnetometer/hmc5843_spi.c b/drivers/staging/iio/magnetometer/hmc5843_spi.c -index 8be198058ea2..fded442a3c1d 100644 ---- a/drivers/staging/iio/magnetometer/hmc5843_spi.c -+++ b/drivers/staging/iio/magnetometer/hmc5843_spi.c -@@ -59,6 +59,7 @@ static const struct regmap_config hmc5843_spi_regmap_config = { - static int hmc5843_spi_probe(struct spi_device *spi) - { - int ret; -+ struct regmap *regmap; - const struct spi_device_id *id = spi_get_device_id(spi); - - spi->mode = SPI_MODE_3; -@@ -68,8 +69,12 @@ static int hmc5843_spi_probe(struct spi_device *spi) - if (ret) - return ret; - -+ regmap = devm_regmap_init_spi(spi, &hmc5843_spi_regmap_config); -+ if (IS_ERR(regmap)) -+ return PTR_ERR(regmap); -+ - return hmc5843_common_probe(&spi->dev, -- devm_regmap_init_spi(spi, &hmc5843_spi_regmap_config), -+ regmap, - id->driver_data, id->name); - } - -diff --git a/drivers/tty/ipwireless/main.c b/drivers/tty/ipwireless/main.c -index 655c7948261c..2fa4f9123469 100644 ---- a/drivers/tty/ipwireless/main.c -+++ b/drivers/tty/ipwireless/main.c -@@ -113,6 +113,10 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data) - - ipw->common_memory = ioremap(p_dev->resource[2]->start, - resource_size(p_dev->resource[2])); -+ if (!ipw->common_memory) { -+ ret = -ENOMEM; -+ goto exit1; -+ } - if (!request_mem_region(p_dev->resource[2]->start, - resource_size(p_dev->resource[2]), - IPWIRELESS_PCCARD_NAME)) { -@@ -133,6 +137,10 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data) - - ipw->attr_memory = ioremap(p_dev->resource[3]->start, - resource_size(p_dev->resource[3])); -+ if (!ipw->attr_memory) { -+ ret = -ENOMEM; -+ goto exit3; -+ } - if (!request_mem_region(p_dev->resource[3]->start, - resource_size(p_dev->resource[3]), - IPWIRELESS_PCCARD_NAME)) { -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index be55fb6def89..0ac0c618954e 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -571,7 +571,7 @@ static int max310x_set_ref_clk(struct max310x_port *s, unsigned long freq, - } - - /* Configure clock source */ -- clksrc = xtal ? MAX310X_CLKSRC_CRYST_BIT : MAX310X_CLKSRC_EXTCLK_BIT; -+ clksrc = MAX310X_CLKSRC_EXTCLK_BIT | (xtal ? MAX310X_CLKSRC_CRYST_BIT : 0); - - /* Configure PLL */ - if (pllcfg) { -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index 8c4707d5778e..5f0ded6fc4e9 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -703,6 +703,7 @@ static void msm_handle_tx(struct uart_port *port) - struct circ_buf *xmit = &msm_port->uart.state->xmit; - struct msm_dma *dma = &msm_port->tx_dma; - unsigned int pio_count, dma_count, dma_min; -+ char buf[4] = { 0 }; - void __iomem *tf; - int err = 0; - -@@ -712,10 +713,12 @@ static void msm_handle_tx(struct uart_port *port) - else - tf = port->membase + UART_TF; - -+ buf[0] = port->x_char; -+ - if (msm_port->is_uartdm) - msm_reset_dm_count(port, 1); - -- iowrite8_rep(tf, &port->x_char, 1); -+ iowrite32_rep(tf, buf, 1); - port->icount.tx++; - port->x_char = 0; - return; -diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c -index 988c564b61a8..fd92c842504d 100644 ---- a/drivers/tty/vt/keyboard.c -+++ b/drivers/tty/vt/keyboard.c -@@ -121,6 +121,7 @@ static const int NR_TYPES = ARRAY_SIZE(max_vals); - static struct input_handler kbd_handler; - static DEFINE_SPINLOCK(kbd_event_lock); - static DEFINE_SPINLOCK(led_lock); -+static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */ - static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */ - static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ - static bool dead_key_next; -@@ -1969,11 +1970,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - char *p; - u_char *q; - u_char __user *up; -- int sz; -+ int sz, fnw_sz; - int delta; - char *first_free, *fj, *fnw; - int i, j, k; - int ret; -+ unsigned long flags; - - if (!capable(CAP_SYS_TTY_CONFIG)) - perm = 0; -@@ -2016,7 +2018,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - goto reterr; - } - -+ fnw = NULL; -+ fnw_sz = 0; -+ /* race aginst other writers */ -+ again: -+ spin_lock_irqsave(&func_buf_lock, flags); - q = func_table[i]; -+ -+ /* fj pointer to next entry after 'q' */ - first_free = funcbufptr + (funcbufsize - funcbufleft); - for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) - ; -@@ -2024,10 +2033,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - fj = func_table[j]; - else - fj = first_free; -- -+ /* buffer usage increase by new entry */ - delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string); -+ - if (delta <= funcbufleft) { /* it fits in current buf */ - if (j < MAX_NR_FUNC) { -+ /* make enough space for new entry at 'fj' */ - memmove(fj + delta, fj, first_free - fj); - for (k = j; k < MAX_NR_FUNC; k++) - if (func_table[k]) -@@ -2040,20 +2051,28 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - sz = 256; - while (sz < funcbufsize - funcbufleft + delta) - sz <<= 1; -- fnw = kmalloc(sz, GFP_KERNEL); -- if(!fnw) { -- ret = -ENOMEM; -- goto reterr; -+ if (fnw_sz != sz) { -+ spin_unlock_irqrestore(&func_buf_lock, flags); -+ kfree(fnw); -+ fnw = kmalloc(sz, GFP_KERNEL); -+ fnw_sz = sz; -+ if (!fnw) { -+ ret = -ENOMEM; -+ goto reterr; -+ } -+ goto again; - } - - if (!q) - func_table[i] = fj; -+ /* copy data before insertion point to new location */ - if (fj > funcbufptr) - memmove(fnw, funcbufptr, fj - funcbufptr); - for (k = 0; k < j; k++) - if (func_table[k]) - func_table[k] = fnw + (func_table[k] - funcbufptr); - -+ /* copy data after insertion point to new location */ - if (first_free > fj) { - memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj); - for (k = j; k < MAX_NR_FUNC; k++) -@@ -2066,7 +2085,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) - funcbufleft = funcbufleft - delta + sz - funcbufsize; - funcbufsize = sz; - } -+ /* finally insert item itself */ - strcpy(func_table[i], kbs->kb_string); -+ spin_unlock_irqrestore(&func_buf_lock, flags); - break; - } - ret = 0; -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 6a287c81a7be..aef208585544 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -902,8 +902,8 @@ int usb_get_bos_descriptor(struct usb_device *dev) - - /* Get BOS descriptor */ - ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE); -- if (ret < USB_DT_BOS_SIZE) { -- dev_err(ddev, "unable to get BOS descriptor\n"); -+ if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) { -+ dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n"); - if (ret >= 0) - ret = -ENOMSG; - kfree(bos); -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 9c4f9b6e57e2..99c146f4b6b5 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -3007,6 +3007,9 @@ usb_hcd_platform_shutdown(struct platform_device *dev) - { - struct usb_hcd *hcd = platform_get_drvdata(dev); - -+ /* No need for pm_runtime_put(), we're shutting down */ -+ pm_runtime_get_sync(&dev->dev); -+ - if (hcd->driver->shutdown) - hcd->driver->shutdown(hcd); - } -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 7c87c0b38bcf..6e307de25163 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -5637,7 +5637,10 @@ int usb_reset_device(struct usb_device *udev) - cintf->needs_binding = 1; - } - } -- usb_unbind_and_rebind_marked_interfaces(udev); -+ -+ /* If the reset failed, hub_wq will unbind drivers later */ -+ if (ret == 0) -+ usb_unbind_and_rebind_marked_interfaces(udev); - } - - usb_autosuspend_device(udev); -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 733479ddf8a7..38c7676e7a82 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -64,6 +64,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Microsoft LifeCam-VX700 v2.0 */ - { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Microsoft Surface Dock Ethernet (RTL8153 GigE) */ -+ { USB_DEVICE(0x045e, 0x07c6), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */ - { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index e3fdc799ad6e..ed152b8ea645 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -21,6 +21,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -46,7 +47,6 @@ static unsigned int quirks; - module_param(quirks, uint, S_IRUGO); - MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default"); - --/* TODO: copied from ehci-hcd.c - can this be refactored? */ - /* - * xhci_handshake - spin reading hc until handshake completes or fails - * @ptr: address of hc register to be read -@@ -63,18 +63,16 @@ MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default"); - int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) - { - u32 result; -+ int ret; - -- do { -- result = readl(ptr); -- if (result == ~(u32)0) /* card removed */ -- return -ENODEV; -- result &= mask; -- if (result == done) -- return 0; -- udelay(1); -- usec--; -- } while (usec > 0); -- return -ETIMEDOUT; -+ ret = readl_poll_timeout_atomic(ptr, result, -+ (result & mask) == done || -+ result == U32_MAX, -+ 1, usec); -+ if (result == U32_MAX) /* card removed */ -+ return -ENODEV; -+ -+ return ret; - } - - /* -@@ -4193,7 +4191,6 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd, - pm_addr = port_array[port_num] + PORTPMSC; - pm_val = readl(pm_addr); - hlpm_addr = port_array[port_num] + PORTHLPMC; -- field = le32_to_cpu(udev->bos->ext_cap->bmAttributes); - - xhci_dbg(xhci, "%s port %d USB2 hardware LPM\n", - enable ? "enable" : "disable", port_num + 1); -@@ -4205,6 +4202,7 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd, - * default one which works with mixed HIRD and BESL - * systems. See XHCI_DEFAULT_BESL definition in xhci.h - */ -+ field = le32_to_cpu(udev->bos->ext_cap->bmAttributes); - if ((field & USB_BESL_SUPPORT) && - (field & USB_BESL_BASELINE_VALID)) - hird = USB_GET_BESL_BASELINE(field); -diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c -index 13731d512624..6e761fabffca 100644 ---- a/drivers/usb/misc/rio500.c -+++ b/drivers/usb/misc/rio500.c -@@ -103,9 +103,22 @@ static int close_rio(struct inode *inode, struct file *file) - { - struct rio_usb_data *rio = &rio_instance; - -- rio->isopen = 0; -+ /* against disconnect() */ -+ mutex_lock(&rio500_mutex); -+ mutex_lock(&(rio->lock)); - -- dev_info(&rio->rio_dev->dev, "Rio closed.\n"); -+ rio->isopen = 0; -+ if (!rio->present) { -+ /* cleanup has been delayed */ -+ kfree(rio->ibuf); -+ kfree(rio->obuf); -+ rio->ibuf = NULL; -+ rio->obuf = NULL; -+ } else { -+ dev_info(&rio->rio_dev->dev, "Rio closed.\n"); -+ } -+ mutex_unlock(&(rio->lock)); -+ mutex_unlock(&rio500_mutex); - return 0; - } - -@@ -464,15 +477,23 @@ static int probe_rio(struct usb_interface *intf, - { - struct usb_device *dev = interface_to_usbdev(intf); - struct rio_usb_data *rio = &rio_instance; -- int retval; -+ int retval = 0; - -- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum); -+ mutex_lock(&rio500_mutex); -+ if (rio->present) { -+ dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum); -+ retval = -EBUSY; -+ goto bail_out; -+ } else { -+ dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum); -+ } - - retval = usb_register_dev(intf, &usb_rio_class); - if (retval) { - dev_err(&dev->dev, - "Not able to get a minor for this device.\n"); -- return -ENOMEM; -+ retval = -ENOMEM; -+ goto bail_out; - } - - rio->rio_dev = dev; -@@ -481,7 +502,8 @@ static int probe_rio(struct usb_interface *intf, - dev_err(&dev->dev, - "probe_rio: Not enough memory for the output buffer\n"); - usb_deregister_dev(intf, &usb_rio_class); -- return -ENOMEM; -+ retval = -ENOMEM; -+ goto bail_out; - } - dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf); - -@@ -490,7 +512,8 @@ static int probe_rio(struct usb_interface *intf, - "probe_rio: Not enough memory for the input buffer\n"); - usb_deregister_dev(intf, &usb_rio_class); - kfree(rio->obuf); -- return -ENOMEM; -+ retval = -ENOMEM; -+ goto bail_out; - } - dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf); - -@@ -498,8 +521,10 @@ static int probe_rio(struct usb_interface *intf, - - usb_set_intfdata (intf, rio); - rio->present = 1; -+bail_out: -+ mutex_unlock(&rio500_mutex); - -- return 0; -+ return retval; - } - - static void disconnect_rio(struct usb_interface *intf) -diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c -index 306d6852ebc7..b9d50020c684 100644 ---- a/drivers/usb/misc/sisusbvga/sisusb.c -+++ b/drivers/usb/misc/sisusbvga/sisusb.c -@@ -3103,6 +3103,13 @@ static int sisusb_probe(struct usb_interface *intf, - - mutex_init(&(sisusb->lock)); - -+ sisusb->sisusb_dev = dev; -+ sisusb->vrambase = SISUSB_PCI_MEMBASE; -+ sisusb->mmiobase = SISUSB_PCI_MMIOBASE; -+ sisusb->mmiosize = SISUSB_PCI_MMIOSIZE; -+ sisusb->ioportbase = SISUSB_PCI_IOPORTBASE; -+ /* Everything else is zero */ -+ - /* Register device */ - retval = usb_register_dev(intf, &usb_sisusb_class); - if (retval) { -@@ -3112,13 +3119,7 @@ static int sisusb_probe(struct usb_interface *intf, - goto error_1; - } - -- sisusb->sisusb_dev = dev; -- sisusb->minor = intf->minor; -- sisusb->vrambase = SISUSB_PCI_MEMBASE; -- sisusb->mmiobase = SISUSB_PCI_MMIOBASE; -- sisusb->mmiosize = SISUSB_PCI_MMIOSIZE; -- sisusb->ioportbase = SISUSB_PCI_IOPORTBASE; -- /* Everything else is zero */ -+ sisusb->minor = intf->minor; - - /* Allocate buffers */ - sisusb->ibufsize = SISUSB_IBUF_SIZE; -diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c -index 68a113594808..2811c4afde01 100644 ---- a/drivers/video/fbdev/core/fbcmap.c -+++ b/drivers/video/fbdev/core/fbcmap.c -@@ -94,6 +94,8 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags) - int size = len * sizeof(u16); - int ret = -ENOMEM; - -+ flags |= __GFP_NOWARN; -+ - if (cmap->len != len) { - fb_dealloc_cmap(cmap); - if (!len) -diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c -index de119f11b78f..455a15f70172 100644 ---- a/drivers/video/fbdev/core/modedb.c -+++ b/drivers/video/fbdev/core/modedb.c -@@ -933,6 +933,9 @@ void fb_var_to_videomode(struct fb_videomode *mode, - if (var->vmode & FB_VMODE_DOUBLE) - vtotal *= 2; - -+ if (!htotal || !vtotal) -+ return; -+ - hfreq = pixclock/htotal; - mode->refresh = hfreq/vtotal; - } -diff --git a/drivers/video/fbdev/sm712.h b/drivers/video/fbdev/sm712.h -index aad1cc4be34a..c7ebf03b8d53 100644 ---- a/drivers/video/fbdev/sm712.h -+++ b/drivers/video/fbdev/sm712.h -@@ -15,14 +15,10 @@ - - #define FB_ACCEL_SMI_LYNX 88 - --#define SCREEN_X_RES 1024 --#define SCREEN_Y_RES 600 --#define SCREEN_BPP 16 -- --/*Assume SM712 graphics chip has 4MB VRAM */ --#define SM712_VIDEOMEMORYSIZE 0x00400000 --/*Assume SM722 graphics chip has 8MB VRAM */ --#define SM722_VIDEOMEMORYSIZE 0x00800000 -+#define SCREEN_X_RES 1024 -+#define SCREEN_Y_RES_PC 768 -+#define SCREEN_Y_RES_NETBOOK 600 -+#define SCREEN_BPP 16 - - #define dac_reg (0x3c8) - #define dac_val (0x3c9) -diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c -index 86ae1d4556fc..589ac7e75413 100644 ---- a/drivers/video/fbdev/sm712fb.c -+++ b/drivers/video/fbdev/sm712fb.c -@@ -530,6 +530,65 @@ static const struct modeinit vgamode[] = { - 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03, - }, - }, -+ { /* 1024 x 768 16Bpp 60Hz */ -+ 1024, 768, 16, 60, -+ /* Init_MISC */ -+ 0xEB, -+ { /* Init_SR0_SR4 */ -+ 0x03, 0x01, 0x0F, 0x03, 0x0E, -+ }, -+ { /* Init_SR10_SR24 */ -+ 0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C, -+ 0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0xC4, 0x30, 0x02, 0x01, 0x01, -+ }, -+ { /* Init_SR30_SR75 */ -+ 0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A, -+ 0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF, -+ 0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC, -+ 0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A, -+ 0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03, -+ 0x0F, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A, -+ 0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00, -+ 0x50, 0x03, 0x74, 0x14, 0x3B, 0x0D, 0x09, 0x02, -+ 0x04, 0x45, 0x30, 0x30, 0x40, 0x20, -+ }, -+ { /* Init_SR80_SR93 */ -+ 0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A, -+ 0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A, -+ 0x00, 0x00, 0x00, 0x00, -+ }, -+ { /* Init_SRA0_SRAF */ -+ 0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED, -+ 0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF, -+ }, -+ { /* Init_GR00_GR08 */ -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F, -+ 0xFF, -+ }, -+ { /* Init_AR00_AR14 */ -+ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, -+ 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, -+ 0x41, 0x00, 0x0F, 0x00, 0x00, -+ }, -+ { /* Init_CR00_CR18 */ -+ 0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5, -+ 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3, -+ 0xFF, -+ }, -+ { /* Init_CR30_CR4D */ -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20, -+ 0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF, -+ 0xA3, 0x7F, 0x00, 0x86, 0x15, 0x24, 0xFF, 0x00, -+ 0x01, 0x07, 0xE5, 0x20, 0x7F, 0xFF, -+ }, -+ { /* Init_CR90_CRA7 */ -+ 0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26, -+ 0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00, -+ 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03, -+ }, -+ }, - { /* mode#5: 1024 x 768 24Bpp 60Hz */ - 1024, 768, 24, 60, - /* Init_MISC */ -@@ -827,67 +886,80 @@ static inline unsigned int chan_to_field(unsigned int chan, - - static int smtc_blank(int blank_mode, struct fb_info *info) - { -+ struct smtcfb_info *sfb = info->par; -+ - /* clear DPMS setting */ - switch (blank_mode) { - case FB_BLANK_UNBLANK: - /* Screen On: HSync: On, VSync : On */ -+ -+ switch (sfb->chip_id) { -+ case 0x710: -+ case 0x712: -+ smtc_seqw(0x6a, 0x16); -+ smtc_seqw(0x6b, 0x02); -+ break; -+ case 0x720: -+ smtc_seqw(0x6a, 0x0d); -+ smtc_seqw(0x6b, 0x02); -+ break; -+ } -+ -+ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0))); - smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20))); -- smtc_seqw(0x6a, 0x16); -- smtc_seqw(0x6b, 0x02); - smtc_seqw(0x21, (smtc_seqr(0x21) & 0x77)); - smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30))); -- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0))); -- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01)); - smtc_seqw(0x31, (smtc_seqr(0x31) | 0x03)); -+ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01)); - break; - case FB_BLANK_NORMAL: - /* Screen Off: HSync: On, VSync : On Soft blank */ -+ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01)); -+ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); -+ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0))); - smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20))); -+ smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30))); - smtc_seqw(0x6a, 0x16); - smtc_seqw(0x6b, 0x02); -- smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30))); -- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0))); -- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01)); -- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); - break; - case FB_BLANK_VSYNC_SUSPEND: - /* Screen On: HSync: On, VSync : Off */ -+ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -+ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); -+ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20)); - smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20)); -- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); -- smtc_seqw(0x6a, 0x0c); -- smtc_seqw(0x6b, 0x02); - smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88)); -+ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); - smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x20)); -- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20)); -- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); - smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80)); -+ smtc_seqw(0x6a, 0x0c); -+ smtc_seqw(0x6b, 0x02); - break; - case FB_BLANK_HSYNC_SUSPEND: - /* Screen On: HSync: Off, VSync : On */ -+ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -+ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); -+ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8)); - smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20)); -- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); -- smtc_seqw(0x6a, 0x0c); -- smtc_seqw(0x6b, 0x02); - smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88)); -+ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); - smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x10)); -- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8)); -- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); - smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80)); -+ smtc_seqw(0x6a, 0x0c); -+ smtc_seqw(0x6b, 0x02); - break; - case FB_BLANK_POWERDOWN: - /* Screen On: HSync: Off, VSync : Off */ -+ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -+ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); -+ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8)); - smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20)); -- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); -- smtc_seqw(0x6a, 0x0c); -- smtc_seqw(0x6b, 0x02); - smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88)); -+ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0))); - smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x30)); -- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8)); -- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01))); -- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00)); - smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80)); -+ smtc_seqw(0x6a, 0x0c); -+ smtc_seqw(0x6b, 0x02); - break; - default: - return -EINVAL; -@@ -1144,8 +1216,10 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb) - - /* init SEQ register SR30 - SR75 */ - for (i = 0; i < SIZE_SR30_SR75; i++) -- if ((i + 0x30) != 0x62 && (i + 0x30) != 0x6a && -- (i + 0x30) != 0x6b) -+ if ((i + 0x30) != 0x30 && (i + 0x30) != 0x62 && -+ (i + 0x30) != 0x6a && (i + 0x30) != 0x6b && -+ (i + 0x30) != 0x70 && (i + 0x30) != 0x71 && -+ (i + 0x30) != 0x74 && (i + 0x30) != 0x75) - smtc_seqw(i + 0x30, - vgamode[j].init_sr30_sr75[i]); - -@@ -1170,8 +1244,12 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb) - smtc_crtcw(i, vgamode[j].init_cr00_cr18[i]); - - /* init CRTC register CR30 - CR4D */ -- for (i = 0; i < SIZE_CR30_CR4D; i++) -+ for (i = 0; i < SIZE_CR30_CR4D; i++) { -+ if ((i + 0x30) >= 0x3B && (i + 0x30) <= 0x3F) -+ /* side-effect, don't write to CR3B-CR3F */ -+ continue; - smtc_crtcw(i + 0x30, vgamode[j].init_cr30_cr4d[i]); -+ } - - /* init CRTC register CR90 - CRA7 */ - for (i = 0; i < SIZE_CR90_CRA7; i++) -@@ -1322,6 +1400,11 @@ static int smtc_map_smem(struct smtcfb_info *sfb, - { - sfb->fb->fix.smem_start = pci_resource_start(pdev, 0); - -+ if (sfb->chip_id == 0x720) -+ /* on SM720, the framebuffer starts at the 1 MB offset */ -+ sfb->fb->fix.smem_start += 0x00200000; -+ -+ /* XXX: is it safe for SM720 on Big-Endian? */ - if (sfb->fb->var.bits_per_pixel == 32) - sfb->fb->fix.smem_start += big_addr; - -@@ -1359,12 +1442,82 @@ static inline void sm7xx_init_hw(void) - outb_p(0x11, 0x3c5); - } - -+static u_long sm7xx_vram_probe(struct smtcfb_info *sfb) -+{ -+ u8 vram; -+ -+ switch (sfb->chip_id) { -+ case 0x710: -+ case 0x712: -+ /* -+ * Assume SM712 graphics chip has 4MB VRAM. -+ * -+ * FIXME: SM712 can have 2MB VRAM, which is used on earlier -+ * laptops, such as IBM Thinkpad 240X. This driver would -+ * probably crash on those machines. If anyone gets one of -+ * those and is willing to help, run "git blame" and send me -+ * an E-mail. -+ */ -+ return 0x00400000; -+ case 0x720: -+ outb_p(0x76, 0x3c4); -+ vram = inb_p(0x3c5) >> 6; -+ -+ if (vram == 0x00) -+ return 0x00800000; /* 8 MB */ -+ else if (vram == 0x01) -+ return 0x01000000; /* 16 MB */ -+ else if (vram == 0x02) -+ return 0x00400000; /* illegal, fallback to 4 MB */ -+ else if (vram == 0x03) -+ return 0x00400000; /* 4 MB */ -+ } -+ return 0; /* unknown hardware */ -+} -+ -+static void sm7xx_resolution_probe(struct smtcfb_info *sfb) -+{ -+ /* get mode parameter from smtc_scr_info */ -+ if (smtc_scr_info.lfb_width != 0) { -+ sfb->fb->var.xres = smtc_scr_info.lfb_width; -+ sfb->fb->var.yres = smtc_scr_info.lfb_height; -+ sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth; -+ goto final; -+ } -+ -+ /* -+ * No parameter, default resolution is 1024x768-16. -+ * -+ * FIXME: earlier laptops, such as IBM Thinkpad 240X, has a 800x600 -+ * panel, also see the comments about Thinkpad 240X above. -+ */ -+ sfb->fb->var.xres = SCREEN_X_RES; -+ sfb->fb->var.yres = SCREEN_Y_RES_PC; -+ sfb->fb->var.bits_per_pixel = SCREEN_BPP; -+ -+#ifdef CONFIG_MIPS -+ /* -+ * Loongson MIPS netbooks use 1024x600 LCD panels, which is the original -+ * target platform of this driver, but nearly all old x86 laptops have -+ * 1024x768. Lighting 768 panels using 600's timings would partially -+ * garble the display, so we don't want that. But it's not possible to -+ * distinguish them reliably. -+ * -+ * So we change the default to 768, but keep 600 as-is on MIPS. -+ */ -+ sfb->fb->var.yres = SCREEN_Y_RES_NETBOOK; -+#endif -+ -+final: -+ big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth); -+} -+ - static int smtcfb_pci_probe(struct pci_dev *pdev, - const struct pci_device_id *ent) - { - struct smtcfb_info *sfb; - struct fb_info *info; -- u_long smem_size = 0x00800000; /* default 8MB */ -+ u_long smem_size; - int err; - unsigned long mmio_base; - -@@ -1404,29 +1557,19 @@ static int smtcfb_pci_probe(struct pci_dev *pdev, - - sm7xx_init_hw(); - -- /* get mode parameter from smtc_scr_info */ -- if (smtc_scr_info.lfb_width != 0) { -- sfb->fb->var.xres = smtc_scr_info.lfb_width; -- sfb->fb->var.yres = smtc_scr_info.lfb_height; -- sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth; -- } else { -- /* default resolution 1024x600 16bit mode */ -- sfb->fb->var.xres = SCREEN_X_RES; -- sfb->fb->var.yres = SCREEN_Y_RES; -- sfb->fb->var.bits_per_pixel = SCREEN_BPP; -- } -- -- big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth); - /* Map address and memory detection */ - mmio_base = pci_resource_start(pdev, 0); - pci_read_config_byte(pdev, PCI_REVISION_ID, &sfb->chip_rev_id); - -+ smem_size = sm7xx_vram_probe(sfb); -+ dev_info(&pdev->dev, "%lu MiB of VRAM detected.\n", -+ smem_size / 1048576); -+ - switch (sfb->chip_id) { - case 0x710: - case 0x712: - sfb->fb->fix.mmio_start = mmio_base + 0x00400000; - sfb->fb->fix.mmio_len = 0x00400000; -- smem_size = SM712_VIDEOMEMORYSIZE; - sfb->lfb = ioremap(mmio_base, mmio_addr); - if (!sfb->lfb) { - dev_err(&pdev->dev, -@@ -1458,8 +1601,7 @@ static int smtcfb_pci_probe(struct pci_dev *pdev, - case 0x720: - sfb->fb->fix.mmio_start = mmio_base; - sfb->fb->fix.mmio_len = 0x00200000; -- smem_size = SM722_VIDEOMEMORYSIZE; -- sfb->dp_regs = ioremap(mmio_base, 0x00a00000); -+ sfb->dp_regs = ioremap(mmio_base, 0x00200000 + smem_size); - sfb->lfb = sfb->dp_regs + 0x00200000; - sfb->mmio = (smtc_regbaseaddress = - sfb->dp_regs + 0x000c0000); -@@ -1476,6 +1618,9 @@ static int smtcfb_pci_probe(struct pci_dev *pdev, - goto failed_fb; - } - -+ /* probe and decide resolution */ -+ sm7xx_resolution_probe(sfb); -+ - /* can support 32 bpp */ - if (15 == sfb->fb->var.bits_per_pixel) - sfb->fb->var.bits_per_pixel = 16; -@@ -1486,7 +1631,11 @@ static int smtcfb_pci_probe(struct pci_dev *pdev, - if (err) - goto failed; - -- smtcfb_setmode(sfb); -+ /* -+ * The screen would be temporarily garbled when sm712fb takes over -+ * vesafb or VGA text mode. Zero the framebuffer. -+ */ -+ memset_io(sfb->lfb, 0, sfb->fb->fix.smem_len); - - err = register_framebuffer(info); - if (err < 0) -diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c -index 282092421cc9..1a9d9ec8db4d 100644 ---- a/drivers/w1/w1_io.c -+++ b/drivers/w1/w1_io.c -@@ -437,8 +437,7 @@ int w1_reset_resume_command(struct w1_master *dev) - if (w1_reset_bus(dev)) - return -1; - -- /* This will make only the last matched slave perform a skip ROM. */ -- w1_write_8(dev, W1_RESUME_CMD); -+ w1_write_8(dev, dev->slave_count > 1 ? W1_RESUME_CMD : W1_SKIP_ROM); - return 0; - } - EXPORT_SYMBOL_GPL(w1_reset_resume_command); -diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c -index fb0221434f81..49c5f0e9600a 100644 ---- a/drivers/xen/xen-pciback/pciback_ops.c -+++ b/drivers/xen/xen-pciback/pciback_ops.c -@@ -126,8 +126,6 @@ void xen_pcibk_reset_device(struct pci_dev *dev) - if (pci_is_enabled(dev)) - pci_disable_device(dev); - -- pci_write_config_word(dev, PCI_COMMAND, 0); -- - dev->is_busmaster = 0; - } else { - pci_read_config_word(dev, PCI_COMMAND, &cmd); -diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c -index 816a0e08ef10..d7591efa7775 100644 ---- a/drivers/xen/xenbus/xenbus_dev_frontend.c -+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c -@@ -536,7 +536,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp) - if (xen_store_evtchn == 0) - return -ENOENT; - -- nonseekable_open(inode, filp); -+ stream_open(inode, filp); - - u = kzalloc(sizeof(*u), GFP_KERNEL); - if (u == NULL) -diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c -index e2f659dc5745..81c5d07a2af1 100644 ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1685,13 +1685,19 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info, - extent_item_objectid); - - if (!search_commit_root) { -- trans = btrfs_join_transaction(fs_info->extent_root); -- if (IS_ERR(trans)) -- return PTR_ERR(trans); -+ trans = btrfs_attach_transaction(fs_info->extent_root); -+ if (IS_ERR(trans)) { -+ if (PTR_ERR(trans) != -ENOENT && -+ PTR_ERR(trans) != -EROFS) -+ return PTR_ERR(trans); -+ trans = NULL; -+ } -+ } -+ -+ if (trans) - btrfs_get_tree_mod_seq(fs_info, &tree_mod_seq_elem); -- } else { -+ else - down_read(&fs_info->commit_root_sem); -- } - - ret = btrfs_find_all_leafs(trans, fs_info, extent_item_objectid, - tree_mod_seq_elem.seq, &refs, -@@ -1721,7 +1727,7 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info, - - free_leaf_list(refs); - out: -- if (!search_commit_root) { -+ if (trans) { - btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem); - btrfs_end_transaction(trans, fs_info->extent_root); - } else { -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 978bbfed5a2c..df2bb4b61a00 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -10730,9 +10730,9 @@ int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end) - * transaction. - */ - static int btrfs_trim_free_extents(struct btrfs_device *device, -- u64 minlen, u64 *trimmed) -+ struct fstrim_range *range, u64 *trimmed) - { -- u64 start = 0, len = 0; -+ u64 start = range->start, len = 0; - int ret; - - *trimmed = 0; -@@ -10768,8 +10768,8 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, - atomic_inc(&trans->use_count); - spin_unlock(&fs_info->trans_lock); - -- ret = find_free_dev_extent_start(trans, device, minlen, start, -- &start, &len); -+ ret = find_free_dev_extent_start(trans, device, range->minlen, -+ start, &start, &len); - if (trans) - btrfs_put_transaction(trans); - -@@ -10781,6 +10781,16 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, - break; - } - -+ /* If we are out of the passed range break */ -+ if (start > range->start + range->len - 1) { -+ mutex_unlock(&fs_info->chunk_mutex); -+ ret = 0; -+ break; -+ } -+ -+ start = max(range->start, start); -+ len = min(range->len, len); -+ - ret = btrfs_issue_discard(device->bdev, start, len, &bytes); - up_read(&fs_info->commit_root_sem); - mutex_unlock(&fs_info->chunk_mutex); -@@ -10791,6 +10801,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device, - start += len; - *trimmed += bytes; - -+ /* We've trimmed enough */ -+ if (*trimmed >= range->len) -+ break; -+ - if (fatal_signal_pending(current)) { - ret = -ERESTARTSYS; - break; -@@ -10857,8 +10871,7 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) - mutex_lock(&root->fs_info->fs_devices->device_list_mutex); - devices = &root->fs_info->fs_devices->devices; - list_for_each_entry(device, devices, dev_list) { -- ret = btrfs_trim_free_extents(device, range->minlen, -- &group_trimmed); -+ ret = btrfs_trim_free_extents(device, range, &group_trimmed); - if (ret) - break; - -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 052973620595..d056060529f8 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1900,6 +1900,18 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) - bool full_sync = 0; - u64 len; - -+ /* -+ * If the inode needs a full sync, make sure we use a full range to -+ * avoid log tree corruption, due to hole detection racing with ordered -+ * extent completion for adjacent ranges, and assertion failures during -+ * hole detection. -+ */ -+ if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, -+ &BTRFS_I(inode)->runtime_flags)) { -+ start = 0; -+ end = LLONG_MAX; -+ } -+ - /* - * The range length can be represented by u64, we have to do the typecasts - * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync() -diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c -index e0ac85949067..e6aaa15505c5 100644 ---- a/fs/btrfs/sysfs.c -+++ b/fs/btrfs/sysfs.c -@@ -733,7 +733,12 @@ int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs, - fs_devs->fsid_kobj.kset = btrfs_kset; - error = kobject_init_and_add(&fs_devs->fsid_kobj, - &btrfs_ktype, parent, "%pU", fs_devs->fsid); -- return error; -+ if (error) { -+ kobject_put(&fs_devs->fsid_kobj); -+ return error; -+ } -+ -+ return 0; - } - - int btrfs_sysfs_add_mounted(struct btrfs_fs_info *fs_info) -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index c7190f322576..57a46093656a 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -2808,6 +2808,12 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, - root->log_transid++; - log->log_transid = root->log_transid; - root->log_start_pid = 0; -+ /* -+ * Update or create log root item under the root's log_mutex to prevent -+ * races with concurrent log syncs that can lead to failure to update -+ * log root item because it was not created yet. -+ */ -+ ret = update_log_root(trans, log); - /* - * IO has been started, blocks of the log tree have WRITTEN flag set - * in their headers. new modifications of the log will be written to -@@ -2827,8 +2833,6 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, - - mutex_unlock(&log_root_tree->log_mutex); - -- ret = update_log_root(trans, log); -- - mutex_lock(&log_root_tree->log_mutex); - if (atomic_dec_and_test(&log_root_tree->log_writers)) { - /* -diff --git a/fs/ceph/super.c b/fs/ceph/super.c -index f446afada328..ab8a8c9c74f2 100644 ---- a/fs/ceph/super.c -+++ b/fs/ceph/super.c -@@ -712,6 +712,12 @@ static void ceph_umount_begin(struct super_block *sb) - return; - } - -+static int ceph_remount(struct super_block *sb, int *flags, char *data) -+{ -+ sync_filesystem(sb); -+ return 0; -+} -+ - static const struct super_operations ceph_super_ops = { - .alloc_inode = ceph_alloc_inode, - .destroy_inode = ceph_destroy_inode, -@@ -719,6 +725,7 @@ static const struct super_operations ceph_super_ops = { - .drop_inode = ceph_drop_inode, - .sync_fs = ceph_sync_fs, - .put_super = ceph_put_super, -+ .remount_fs = ceph_remount, - .show_options = ceph_show_options, - .statfs = ceph_statfs, - .umount_begin = ceph_umount_begin, -diff --git a/fs/char_dev.c b/fs/char_dev.c -index 24b142569ca9..d0655ca89481 100644 ---- a/fs/char_dev.c -+++ b/fs/char_dev.c -@@ -130,6 +130,12 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor, - ret = -EBUSY; - goto out; - } -+ -+ if (new_min < old_min && new_max > old_max) { -+ ret = -EBUSY; -+ goto out; -+ } -+ - } - - cd->next = *cp; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 23a8374fa97f..309c134fb66f 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2829,7 +2829,9 @@ cifs_read_allocate_pages(struct cifs_readdata *rdata, unsigned int nr_pages) - } - - if (rc) { -- for (i = 0; i < nr_pages; i++) { -+ unsigned int nr_page_failed = i; -+ -+ for (i = 0; i < nr_page_failed; i++) { - put_page(rdata->pages[i]); - rdata->pages[i] = NULL; - } -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index eae3cdffaf7f..591c93de8c20 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1329,26 +1329,28 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, - unsigned int epoch, bool *purge_cache) - { - char message[5] = {0}; -+ unsigned int new_oplock = 0; - - oplock &= 0xFF; - if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE) - return; - -- cinode->oplock = 0; - if (oplock & SMB2_LEASE_READ_CACHING_HE) { -- cinode->oplock |= CIFS_CACHE_READ_FLG; -+ new_oplock |= CIFS_CACHE_READ_FLG; - strcat(message, "R"); - } - if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) { -- cinode->oplock |= CIFS_CACHE_HANDLE_FLG; -+ new_oplock |= CIFS_CACHE_HANDLE_FLG; - strcat(message, "H"); - } - if (oplock & SMB2_LEASE_WRITE_CACHING_HE) { -- cinode->oplock |= CIFS_CACHE_WRITE_FLG; -+ new_oplock |= CIFS_CACHE_WRITE_FLG; - strcat(message, "W"); - } -- if (!cinode->oplock) -- strcat(message, "None"); -+ if (!new_oplock) -+ strncpy(message, "None", sizeof(message)); -+ -+ cinode->oplock = new_oplock; - cifs_dbg(FYI, "%s Lease granted on inode %p\n", message, - &cinode->vfs_inode); - } -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 1708597659a1..8d98c9ac9205 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -1049,6 +1049,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, - __le32 border; - ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */ - int err = 0; -+ size_t ext_size = 0; - - /* make decision: where to split? */ - /* FIXME: now decision is simplest: at current extent */ -@@ -1140,6 +1141,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, - le16_add_cpu(&neh->eh_entries, m); - } - -+ /* zero out unused area in the extent block */ -+ ext_size = sizeof(struct ext4_extent_header) + -+ sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries); -+ memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size); - ext4_extent_block_csum_set(inode, neh); - set_buffer_uptodate(bh); - unlock_buffer(bh); -@@ -1219,6 +1224,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode, - sizeof(struct ext4_extent_idx) * m); - le16_add_cpu(&neh->eh_entries, m); - } -+ /* zero out unused area in the extent block */ -+ ext_size = sizeof(struct ext4_extent_header) + -+ (sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries)); -+ memset(bh->b_data + ext_size, 0, -+ inode->i_sb->s_blocksize - ext_size); - ext4_extent_block_csum_set(inode, neh); - set_buffer_uptodate(bh); - unlock_buffer(bh); -@@ -1284,6 +1294,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, - ext4_fsblk_t newblock, goal = 0; - struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es; - int err = 0; -+ size_t ext_size = 0; - - /* Try to prepend new index to old one */ - if (ext_depth(inode)) -@@ -1309,9 +1320,11 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode, - goto out; - } - -+ ext_size = sizeof(EXT4_I(inode)->i_data); - /* move top-level index/leaf into new block */ -- memmove(bh->b_data, EXT4_I(inode)->i_data, -- sizeof(EXT4_I(inode)->i_data)); -+ memmove(bh->b_data, EXT4_I(inode)->i_data, ext_size); -+ /* zero out unused area in the extent block */ -+ memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size); - - /* set size of new block */ - neh = ext_block_hdr(bh); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 181db3c7f5d1..063c5991f095 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4944,7 +4944,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr) - up_write(&EXT4_I(inode)->i_data_sem); - ext4_journal_stop(handle); - if (error) { -- if (orphan) -+ if (orphan && inode->i_nlink) - ext4_orphan_del(NULL, inode); - goto err_out; - } -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index e44e3cd738b6..b02f210ea617 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -577,7 +577,7 @@ group_add_out: - if (err == 0) - err = err2; - mnt_drop_write_file(filp); -- if (!err && (o_group > EXT4_SB(sb)->s_groups_count) && -+ if (!err && (o_group < EXT4_SB(sb)->s_groups_count) && - ext4_has_group_desc_csum(sb) && - test_opt(sb, INIT_INODE_TABLE)) - err = ext4_register_li_request(sb, o_group); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 6a7df72cb3da..6f00388a1471 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3867,7 +3867,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - "data=, fs mounted w/o journal"); - goto failed_mount_wq; - } -- sbi->s_def_mount_opt &= EXT4_MOUNT_JOURNAL_CHECKSUM; -+ sbi->s_def_mount_opt &= ~EXT4_MOUNT_JOURNAL_CHECKSUM; - clear_opt(sb, JOURNAL_CHECKSUM); - clear_opt(sb, DATA_FLAGS); - sbi->s_journal = NULL; -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index cfb75dbb96f5..76597dd8cfe8 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -331,11 +331,22 @@ struct inode_switch_wbs_context { - struct work_struct work; - }; - -+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) -+{ -+ down_write(&bdi->wb_switch_rwsem); -+} -+ -+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) -+{ -+ up_write(&bdi->wb_switch_rwsem); -+} -+ - static void inode_switch_wbs_work_fn(struct work_struct *work) - { - struct inode_switch_wbs_context *isw = - container_of(work, struct inode_switch_wbs_context, work); - struct inode *inode = isw->inode; -+ struct backing_dev_info *bdi = inode_to_bdi(inode); - struct address_space *mapping = inode->i_mapping; - struct bdi_writeback *old_wb = inode->i_wb; - struct bdi_writeback *new_wb = isw->new_wb; -@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) - bool switched = false; - void **slot; - -+ /* -+ * If @inode switches cgwb membership while sync_inodes_sb() is -+ * being issued, sync_inodes_sb() might miss it. Synchronize. -+ */ -+ down_read(&bdi->wb_switch_rwsem); -+ - /* - * By the time control reaches here, RCU grace period has passed - * since I_WB_SWITCH assertion and all wb stat update transactions -@@ -435,6 +452,8 @@ skip_switch: - spin_unlock(&new_wb->list_lock); - spin_unlock(&old_wb->list_lock); - -+ up_read(&bdi->wb_switch_rwsem); -+ - if (switched) { - wb_wakeup(new_wb); - wb_put(old_wb); -@@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) - if (inode->i_state & I_WB_SWITCH) - return; - -+ /* -+ * Avoid starting new switches while sync_inodes_sb() is in -+ * progress. Otherwise, if the down_write protected issue path -+ * blocks heavily, we might end up starting a large number of -+ * switches which will block on the rwsem. -+ */ -+ if (!down_read_trylock(&bdi->wb_switch_rwsem)) -+ return; -+ - isw = kzalloc(sizeof(*isw), GFP_ATOMIC); - if (!isw) -- return; -+ goto out_unlock; - - /* find and pin the new wb */ - rcu_read_lock(); -@@ -502,8 +530,6 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) - ihold(inode); - isw->inode = inode; - -- atomic_inc(&isw_nr_in_flight); -- - /* - * In addition to synchronizing among switchers, I_WB_SWITCH tells - * the RCU protected stat update paths to grab the mapping's -@@ -511,12 +537,17 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) - * Let's continue after I_WB_SWITCH is guaranteed to be visible. - */ - call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); -- return; -+ -+ atomic_inc(&isw_nr_in_flight); -+ -+ goto out_unlock; - - out_free: - if (isw->new_wb) - wb_put(isw->new_wb); - kfree(isw); -+out_unlock: -+ up_read(&bdi->wb_switch_rwsem); - } - - /** -@@ -880,7 +911,11 @@ restart: - void cgroup_writeback_umount(void) - { - if (atomic_read(&isw_nr_in_flight)) { -- synchronize_rcu(); -+ /* -+ * Use rcu_barrier() to wait for all pending callbacks to -+ * ensure that all in-flight wb switches are in the workqueue. -+ */ -+ rcu_barrier(); - flush_workqueue(isw_wq); - } - } -@@ -896,6 +931,9 @@ fs_initcall(cgroup_writeback_init); - - #else /* CONFIG_CGROUP_WRITEBACK */ - -+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } -+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } -+ - static struct bdi_writeback * - locked_inode_to_wb_and_lock_list(struct inode *inode) - __releases(&inode->i_lock) -@@ -2341,8 +2379,11 @@ void sync_inodes_sb(struct super_block *sb) - return; - WARN_ON(!rwsem_is_locked(&sb->s_umount)); - -+ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */ -+ bdi_down_write_wb_switch_rwsem(bdi); - bdi_split_work_to_wbs(bdi, &work, false); - wb_wait_for_completion(bdi, &done); -+ bdi_up_write_wb_switch_rwsem(bdi); - - wait_sb_inodes(sb); - } -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index d40c2451487c..ab93c4591f8c 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -178,7 +178,9 @@ void fuse_finish_open(struct inode *inode, struct file *file) - file->f_op = &fuse_direct_io_file_operations; - if (!(ff->open_flags & FOPEN_KEEP_CACHE)) - invalidate_inode_pages2(inode->i_mapping); -- if (ff->open_flags & FOPEN_NONSEEKABLE) -+ if (ff->open_flags & FOPEN_STREAM) -+ stream_open(inode, file); -+ else if (ff->open_flags & FOPEN_NONSEEKABLE) - nonseekable_open(inode, file); - if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) { - struct fuse_inode *fi = get_fuse_inode(inode); -@@ -1533,7 +1535,7 @@ __acquires(fc->lock) - { - struct fuse_conn *fc = get_fuse_conn(inode); - struct fuse_inode *fi = get_fuse_inode(inode); -- size_t crop = i_size_read(inode); -+ loff_t crop = i_size_read(inode); - struct fuse_req *req; - - while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) { -@@ -2947,6 +2949,13 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset, - } - } - -+ if (!(mode & FALLOC_FL_KEEP_SIZE) && -+ offset + length > i_size_read(inode)) { -+ err = inode_newsize_ok(inode, offset + length); -+ if (err) -+ goto out; -+ } -+ - if (!(mode & FALLOC_FL_KEEP_SIZE)) - set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); - -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 09a0cf5f3dd8..1eb737c466dd 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -136,22 +136,26 @@ static int demote_ok(const struct gfs2_glock *gl) - - void gfs2_glock_add_to_lru(struct gfs2_glock *gl) - { -+ if (!(gl->gl_ops->go_flags & GLOF_LRU)) -+ return; -+ - spin_lock(&lru_lock); - -- if (!list_empty(&gl->gl_lru)) -- list_del_init(&gl->gl_lru); -- else -+ list_del(&gl->gl_lru); -+ list_add_tail(&gl->gl_lru, &lru_list); -+ -+ if (!test_bit(GLF_LRU, &gl->gl_flags)) { -+ set_bit(GLF_LRU, &gl->gl_flags); - atomic_inc(&lru_count); -+ } - -- list_add_tail(&gl->gl_lru, &lru_list); -- set_bit(GLF_LRU, &gl->gl_flags); - spin_unlock(&lru_lock); - } - - static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl) - { - spin_lock(&lru_lock); -- if (!list_empty(&gl->gl_lru)) { -+ if (test_bit(GLF_LRU, &gl->gl_flags)) { - list_del_init(&gl->gl_lru); - atomic_dec(&lru_count); - clear_bit(GLF_LRU, &gl->gl_flags); -@@ -1040,8 +1044,7 @@ void gfs2_glock_dq(struct gfs2_holder *gh) - !test_bit(GLF_DEMOTE, &gl->gl_flags)) - fast_path = 1; - } -- if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl) && -- (glops->go_flags & GLOF_LRU)) -+ if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl)) - gfs2_glock_add_to_lru(gl); - - trace_gfs2_glock_queue(gh, 0); -@@ -1341,6 +1344,7 @@ __acquires(&lru_lock) - if (!spin_trylock(&gl->gl_lockref.lock)) { - add_back_to_lru: - list_add(&gl->gl_lru, &lru_list); -+ set_bit(GLF_LRU, &gl->gl_flags); - atomic_inc(&lru_count); - continue; - } -@@ -1348,7 +1352,6 @@ add_back_to_lru: - spin_unlock(&gl->gl_lockref.lock); - goto add_back_to_lru; - } -- clear_bit(GLF_LRU, &gl->gl_flags); - gl->gl_lockref.count++; - if (demote_ok(gl)) - handle_callback(gl, LM_ST_UNLOCKED, 0, false); -@@ -1384,6 +1387,7 @@ static long gfs2_scan_glock_lru(int nr) - if (!test_bit(GLF_LOCK, &gl->gl_flags)) { - list_move(&gl->gl_lru, &dispose); - atomic_dec(&lru_count); -+ clear_bit(GLF_LRU, &gl->gl_flags); - freed++; - continue; - } -diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c -index 8b907c5cc913..3c3d037df824 100644 ---- a/fs/gfs2/lock_dlm.c -+++ b/fs/gfs2/lock_dlm.c -@@ -32,9 +32,10 @@ extern struct workqueue_struct *gfs2_control_wq; - * @delta is the difference between the current rtt sample and the - * running average srtt. We add 1/8 of that to the srtt in order to - * update the current srtt estimate. The variance estimate is a bit -- * more complicated. We subtract the abs value of the @delta from -- * the current variance estimate and add 1/4 of that to the running -- * total. -+ * more complicated. We subtract the current variance estimate from -+ * the abs value of the @delta and add 1/4 of that to the running -+ * total. That's equivalent to 3/4 of the current variance -+ * estimate plus 1/4 of the abs of @delta. - * - * Note that the index points at the array entry containing the smoothed - * mean value, and the variance is always in the following entry -@@ -50,7 +51,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index, - s64 delta = sample - s->stats[index]; - s->stats[index] += (delta >> 3); - index++; -- s->stats[index] += ((abs(delta) - s->stats[index]) >> 2); -+ s->stats[index] += (s64)(abs(delta) - s->stats[index]) >> 2; - } - - /** -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 27c4e2ac39a9..937c6ee1786f 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -414,9 +414,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart, - if (next >= end) - break; - -- hash = hugetlb_fault_mutex_hash(h, current->mm, -- &pseudo_vma, -- mapping, next, 0); -+ hash = hugetlb_fault_mutex_hash(h, mapping, next, 0); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - lock_page(page); -@@ -569,7 +567,6 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, - struct address_space *mapping = inode->i_mapping; - struct hstate *h = hstate_inode(inode); - struct vm_area_struct pseudo_vma; -- struct mm_struct *mm = current->mm; - loff_t hpage_size = huge_page_size(h); - unsigned long hpage_shift = huge_page_shift(h); - pgoff_t start, index, end; -@@ -633,8 +630,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset, - addr = index * hpage_size; - - /* mutex taken here, fault path and hole punch */ -- hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping, -- index, addr); -+ hash = hugetlb_fault_mutex_hash(h, mapping, index, addr); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - /* See if already present in mapping to avoid alloc/free */ -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 44f5cea49699..5be61affeefd 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -140,6 +140,10 @@ int nfs40_discover_server_trunking(struct nfs_client *clp, - /* Sustain the lease, even if it's empty. If the clientid4 - * goes stale it's of no use for trunking discovery. */ - nfs4_schedule_state_renewal(*result); -+ -+ /* If the client state need to recover, do it. */ -+ if (clp->cl_state) -+ nfs4_schedule_state_manager(clp); - } - out: - return status; -diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c -index 3494e220b510..bed15dec3c16 100644 ---- a/fs/ocfs2/export.c -+++ b/fs/ocfs2/export.c -@@ -148,16 +148,24 @@ static struct dentry *ocfs2_get_parent(struct dentry *child) - u64 blkno; - struct dentry *parent; - struct inode *dir = d_inode(child); -+ int set; - - trace_ocfs2_get_parent(child, child->d_name.len, child->d_name.name, - (unsigned long long)OCFS2_I(dir)->ip_blkno); - -+ status = ocfs2_nfs_sync_lock(OCFS2_SB(dir->i_sb), 1); -+ if (status < 0) { -+ mlog(ML_ERROR, "getting nfs sync lock(EX) failed %d\n", status); -+ parent = ERR_PTR(status); -+ goto bail; -+ } -+ - status = ocfs2_inode_lock(dir, NULL, 0); - if (status < 0) { - if (status != -ENOENT) - mlog_errno(status); - parent = ERR_PTR(status); -- goto bail; -+ goto unlock_nfs_sync; - } - - status = ocfs2_lookup_ino_from_name(dir, "..", 2, &blkno); -@@ -166,11 +174,31 @@ static struct dentry *ocfs2_get_parent(struct dentry *child) - goto bail_unlock; - } - -+ status = ocfs2_test_inode_bit(OCFS2_SB(dir->i_sb), blkno, &set); -+ if (status < 0) { -+ if (status == -EINVAL) { -+ status = -ESTALE; -+ } else -+ mlog(ML_ERROR, "test inode bit failed %d\n", status); -+ parent = ERR_PTR(status); -+ goto bail_unlock; -+ } -+ -+ trace_ocfs2_get_dentry_test_bit(status, set); -+ if (!set) { -+ status = -ESTALE; -+ parent = ERR_PTR(status); -+ goto bail_unlock; -+ } -+ - parent = d_obtain_alias(ocfs2_iget(OCFS2_SB(dir->i_sb), blkno, 0, 0)); - - bail_unlock: - ocfs2_inode_unlock(dir, 0); - -+unlock_nfs_sync: -+ ocfs2_nfs_sync_unlock(OCFS2_SB(dir->i_sb), 1); -+ - bail: - trace_ocfs2_get_parent_end(parent); - -diff --git a/fs/open.c b/fs/open.c -index fbc5c7b230b3..6cf516156111 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1152,3 +1152,21 @@ int nonseekable_open(struct inode *inode, struct file *filp) - } - - EXPORT_SYMBOL(nonseekable_open); -+ -+/* -+ * stream_open is used by subsystems that want stream-like file descriptors. -+ * Such file descriptors are not seekable and don't have notion of position -+ * (file.f_pos is always 0). Contrary to file descriptors of other regular -+ * files, .read() and .write() can run simultaneously. -+ * -+ * stream_open never fails and is marked to return int so that it could be -+ * directly used as file_operations.open . -+ */ -+int stream_open(struct inode *inode, struct file *filp) -+{ -+ filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); -+ filp->f_mode |= FMODE_STREAM; -+ return 0; -+} -+ -+EXPORT_SYMBOL(stream_open); -diff --git a/fs/read_write.c b/fs/read_write.c -index 16e554ba885d..7b175b9134ec 100644 ---- a/fs/read_write.c -+++ b/fs/read_write.c -@@ -553,12 +553,13 @@ EXPORT_SYMBOL(vfs_write); - - static inline loff_t file_pos_read(struct file *file) - { -- return file->f_pos; -+ return file->f_mode & FMODE_STREAM ? 0 : file->f_pos; - } - - static inline void file_pos_write(struct file *file, loff_t pos) - { -- file->f_pos = pos; -+ if ((file->f_mode & FMODE_STREAM) == 0) -+ file->f_pos = pos; - } - - SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count) -diff --git a/fs/ufs/util.h b/fs/ufs/util.h -index 3f9463f8cf2f..f877d5cadd98 100644 ---- a/fs/ufs/util.h -+++ b/fs/ufs/util.h -@@ -228,7 +228,7 @@ ufs_get_inode_gid(struct super_block *sb, struct ufs_inode *inode) - case UFS_UID_44BSD: - return fs32_to_cpu(sb, inode->ui_u3.ui_44.ui_gid); - case UFS_UID_EFT: -- if (inode->ui_u1.oldids.ui_suid == 0xFFFF) -+ if (inode->ui_u1.oldids.ui_sgid == 0xFFFF) - return fs32_to_cpu(sb, inode->ui_u3.ui_sun.ui_gid); - /* Fall through */ - default: -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index 59d58bdad7d3..e93541282aa1 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -137,7 +137,7 @@ static void userfaultfd_ctx_put(struct userfaultfd_ctx *ctx) - VM_BUG_ON(waitqueue_active(&ctx->fault_wqh)); - VM_BUG_ON(spin_is_locked(&ctx->fd_wqh.lock)); - VM_BUG_ON(waitqueue_active(&ctx->fd_wqh)); -- mmput(ctx->mm); -+ mmdrop(ctx->mm); - kmem_cache_free(userfaultfd_ctx_cachep, ctx); - } - } -@@ -434,6 +434,9 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - - ACCESS_ONCE(ctx->released) = true; - -+ if (!mmget_not_zero(mm)) -+ goto wakeup; -+ - /* - * Flush page faults out of all CPUs. NOTE: all page faults - * must be retried without returning VM_FAULT_SIGBUS if -@@ -466,7 +469,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; - } - up_write(&mm->mmap_sem); -- -+ mmput(mm); -+wakeup: - /* - * After no new page faults can wait on this fault_*wqh, flush - * the last page faults that may have been already waiting on -@@ -760,10 +764,12 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, - start = uffdio_register.range.start; - end = start + uffdio_register.range.len; - -+ ret = -ENOMEM; -+ if (!mmget_not_zero(mm)) -+ goto out; -+ - down_write(&mm->mmap_sem); - vma = find_vma_prev(mm, start, &prev); -- -- ret = -ENOMEM; - if (!vma) - goto out_unlock; - -@@ -864,6 +870,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, - } while (vma && vma->vm_start < end); - out_unlock: - up_write(&mm->mmap_sem); -+ mmput(mm); - if (!ret) { - /* - * Now that we scanned all vmas we can already tell -@@ -902,10 +909,12 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, - start = uffdio_unregister.start; - end = start + uffdio_unregister.len; - -+ ret = -ENOMEM; -+ if (!mmget_not_zero(mm)) -+ goto out; -+ - down_write(&mm->mmap_sem); - vma = find_vma_prev(mm, start, &prev); -- -- ret = -ENOMEM; - if (!vma) - goto out_unlock; - -@@ -998,6 +1007,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, - } while (vma && vma->vm_start < end); - out_unlock: - up_write(&mm->mmap_sem); -+ mmput(mm); - out: - return ret; - } -@@ -1067,9 +1077,11 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx, - goto out; - if (uffdio_copy.mode & ~UFFDIO_COPY_MODE_DONTWAKE) - goto out; -- -- ret = mcopy_atomic(ctx->mm, uffdio_copy.dst, uffdio_copy.src, -- uffdio_copy.len); -+ if (mmget_not_zero(ctx->mm)) { -+ ret = mcopy_atomic(ctx->mm, uffdio_copy.dst, uffdio_copy.src, -+ uffdio_copy.len); -+ mmput(ctx->mm); -+ } - if (unlikely(put_user(ret, &user_uffdio_copy->copy))) - return -EFAULT; - if (ret < 0) -@@ -1110,8 +1122,11 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx, - if (uffdio_zeropage.mode & ~UFFDIO_ZEROPAGE_MODE_DONTWAKE) - goto out; - -- ret = mfill_zeropage(ctx->mm, uffdio_zeropage.range.start, -- uffdio_zeropage.range.len); -+ if (mmget_not_zero(ctx->mm)) { -+ ret = mfill_zeropage(ctx->mm, uffdio_zeropage.range.start, -+ uffdio_zeropage.range.len); -+ mmput(ctx->mm); -+ } - if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage))) - return -EFAULT; - if (ret < 0) -@@ -1289,12 +1304,12 @@ static struct file *userfaultfd_file_create(int flags) - ctx->released = false; - ctx->mm = current->mm; - /* prevent the mm struct to be freed */ -- atomic_inc(&ctx->mm->mm_users); -+ atomic_inc(&ctx->mm->mm_count); - - file = anon_inode_getfile("[userfaultfd]", &userfaultfd_fops, ctx, - O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS)); - if (IS_ERR(file)) { -- mmput(ctx->mm); -+ mmdrop(ctx->mm); - kmem_cache_free(userfaultfd_ctx_cachep, ctx); - } - out: -diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h -index 072501a0ac86..dfa6d4f08b99 100644 ---- a/include/linux/backing-dev-defs.h -+++ b/include/linux/backing-dev-defs.h -@@ -157,6 +157,7 @@ struct backing_dev_info { - struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ - struct rb_root cgwb_congested_tree; /* their congested states */ - atomic_t usage_cnt; /* counts both cgwbs and cgwb_contested's */ -+ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */ - #else - struct bdi_writeback_congested *wb_congested; - #endif -diff --git a/include/linux/bio.h b/include/linux/bio.h -index 42e4e3cbb001..0ffb9a397620 100644 ---- a/include/linux/bio.h -+++ b/include/linux/bio.h -@@ -290,7 +290,7 @@ static inline void bio_cnt_set(struct bio *bio, unsigned int count) - { - if (count != 1) { - bio->bi_flags |= (1 << BIO_REFFED); -- smp_mb__before_atomic(); -+ smp_mb(); - } - atomic_set(&bio->__bi_cnt, count); - } -diff --git a/include/linux/bitops.h b/include/linux/bitops.h -index e76d03f44c80..83edade218fa 100644 ---- a/include/linux/bitops.h -+++ b/include/linux/bitops.h -@@ -68,7 +68,7 @@ static __always_inline unsigned long hweight_long(unsigned long w) - */ - static inline __u64 rol64(__u64 word, unsigned int shift) - { -- return (word << shift) | (word >> (64 - shift)); -+ return (word << (shift & 63)) | (word >> ((-shift) & 63)); - } - - /** -@@ -78,7 +78,7 @@ static inline __u64 rol64(__u64 word, unsigned int shift) - */ - static inline __u64 ror64(__u64 word, unsigned int shift) - { -- return (word >> shift) | (word << (64 - shift)); -+ return (word >> (shift & 63)) | (word << ((-shift) & 63)); - } - - /** -@@ -88,7 +88,7 @@ static inline __u64 ror64(__u64 word, unsigned int shift) - */ - static inline __u32 rol32(__u32 word, unsigned int shift) - { -- return (word << shift) | (word >> ((-shift) & 31)); -+ return (word << (shift & 31)) | (word >> ((-shift) & 31)); - } - - /** -@@ -98,7 +98,7 @@ static inline __u32 rol32(__u32 word, unsigned int shift) - */ - static inline __u32 ror32(__u32 word, unsigned int shift) - { -- return (word >> shift) | (word << (32 - shift)); -+ return (word >> (shift & 31)) | (word << ((-shift) & 31)); - } - - /** -@@ -108,7 +108,7 @@ static inline __u32 ror32(__u32 word, unsigned int shift) - */ - static inline __u16 rol16(__u16 word, unsigned int shift) - { -- return (word << shift) | (word >> (16 - shift)); -+ return (word << (shift & 15)) | (word >> ((-shift) & 15)); - } - - /** -@@ -118,7 +118,7 @@ static inline __u16 rol16(__u16 word, unsigned int shift) - */ - static inline __u16 ror16(__u16 word, unsigned int shift) - { -- return (word >> shift) | (word << (16 - shift)); -+ return (word >> (shift & 15)) | (word << ((-shift) & 15)); - } - - /** -@@ -128,7 +128,7 @@ static inline __u16 ror16(__u16 word, unsigned int shift) - */ - static inline __u8 rol8(__u8 word, unsigned int shift) - { -- return (word << shift) | (word >> (8 - shift)); -+ return (word << (shift & 7)) | (word >> ((-shift) & 7)); - } - - /** -@@ -138,7 +138,7 @@ static inline __u8 rol8(__u8 word, unsigned int shift) - */ - static inline __u8 ror8(__u8 word, unsigned int shift) - { -- return (word >> shift) | (word << (8 - shift)); -+ return (word >> (shift & 7)) | (word << ((-shift) & 7)); - } - - /** -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 13277d2715df..26c4bf47cc99 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -140,6 +140,9 @@ typedef void (dax_iodone_t)(struct buffer_head *bh_map, int uptodate); - /* Has write method(s) */ - #define FMODE_CAN_WRITE ((__force fmode_t)0x40000) - -+/* File is stream-like */ -+#define FMODE_STREAM ((__force fmode_t)0x200000) -+ - /* File was opened by fanotify and shouldn't generate fanotify events */ - #define FMODE_NONOTIFY ((__force fmode_t)0x4000000) - -@@ -2706,6 +2709,7 @@ extern loff_t fixed_size_llseek(struct file *file, loff_t offset, - int whence, loff_t size); - extern int generic_file_open(struct inode * inode, struct file * filp); - extern int nonseekable_open(struct inode * inode, struct file * filp); -+extern int stream_open(struct inode * inode, struct file * filp); - - #ifdef CONFIG_BLOCK - typedef void (dio_submit_t)(int rw, struct bio *bio, struct inode *inode, -diff --git a/include/linux/hid.h b/include/linux/hid.h -index fd86687f8119..5f3131885136 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -372,6 +372,7 @@ struct hid_global { - - struct hid_local { - unsigned usage[HID_MAX_USAGES]; /* usage array */ -+ u8 usage_size[HID_MAX_USAGES]; /* usage size array */ - unsigned collection_index[HID_MAX_USAGES]; /* collection index array */ - unsigned usage_index; - unsigned usage_minimum; -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index 3957d99e66ea..cc185525a94b 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -91,9 +91,7 @@ void putback_active_hugepage(struct page *page); - void free_huge_page(struct page *page); - void hugetlb_fix_reserve_counts(struct inode *inode, bool restore_reserve); - extern struct mutex *hugetlb_fault_mutex_table; --u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm, -- struct vm_area_struct *vma, -- struct address_space *mapping, -+u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, - pgoff_t idx, unsigned long address); - - #ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE -diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h -index 6cc48ac55fd2..40b14736c73d 100644 ---- a/include/linux/iio/adc/ad_sigma_delta.h -+++ b/include/linux/iio/adc/ad_sigma_delta.h -@@ -66,6 +66,7 @@ struct ad_sigma_delta { - bool irq_dis; - - bool bus_locked; -+ bool keep_cs_asserted; - - uint8_t comm; - -diff --git a/include/linux/list_lru.h b/include/linux/list_lru.h -index 743b34f56f2b..f9a8889e134a 100644 ---- a/include/linux/list_lru.h -+++ b/include/linux/list_lru.h -@@ -51,6 +51,7 @@ struct list_lru { - struct list_lru_node *node; - #ifdef CONFIG_MEMCG_KMEM - struct list_head list; -+ bool memcg_aware; - #endif - }; - -diff --git a/include/linux/mfd/da9063/registers.h b/include/linux/mfd/da9063/registers.h -index 2e0ba6d5fbc3..f97173bef581 100644 ---- a/include/linux/mfd/da9063/registers.h -+++ b/include/linux/mfd/da9063/registers.h -@@ -215,9 +215,9 @@ - - /* DA9063 Configuration registers */ - /* OTP */ --#define DA9063_REG_OPT_COUNT 0x101 --#define DA9063_REG_OPT_ADDR 0x102 --#define DA9063_REG_OPT_DATA 0x103 -+#define DA9063_REG_OTP_CONT 0x101 -+#define DA9063_REG_OTP_ADDR 0x102 -+#define DA9063_REG_OTP_DATA 0x103 - - /* Customer Trim and Configuration */ - #define DA9063_REG_T_OFFSET 0x104 -diff --git a/include/linux/of.h b/include/linux/of.h -index d9371c9cd88a..2772f027f88f 100644 ---- a/include/linux/of.h -+++ b/include/linux/of.h -@@ -199,8 +199,8 @@ extern struct device_node *of_find_all_nodes(struct device_node *prev); - static inline u64 of_read_number(const __be32 *cell, int size) - { - u64 r = 0; -- while (size--) -- r = (r << 32) | be32_to_cpu(*(cell++)); -+ for (; size--; cell++) -+ r = (r << 32) | be32_to_cpu(*cell); - return r; - } - -diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h -index a0189ba67fde..addd03641e1a 100644 ---- a/include/linux/rcupdate.h -+++ b/include/linux/rcupdate.h -@@ -297,14 +297,12 @@ void synchronize_rcu(void); - - static inline void __rcu_read_lock(void) - { -- if (IS_ENABLED(CONFIG_PREEMPT_COUNT)) -- preempt_disable(); -+ preempt_disable(); - } - - static inline void __rcu_read_unlock(void) - { -- if (IS_ENABLED(CONFIG_PREEMPT_COUNT)) -- preempt_enable(); -+ preempt_enable(); - } - - static inline void synchronize_rcu(void) -diff --git a/include/linux/sched.h b/include/linux/sched.h -index a0b540f800d9..315df144c156 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -2614,12 +2614,17 @@ extern struct mm_struct * mm_alloc(void); - - /* mmdrop drops the mm and the page tables */ - extern void __mmdrop(struct mm_struct *); --static inline void mmdrop(struct mm_struct * mm) -+static inline void mmdrop(struct mm_struct *mm) - { - if (unlikely(atomic_dec_and_test(&mm->mm_count))) - __mmdrop(mm); - } - -+static inline bool mmget_not_zero(struct mm_struct *mm) -+{ -+ return atomic_inc_not_zero(&mm->mm_users); -+} -+ - /* mmput gets rid of the mappings and all user-space */ - extern void mmput(struct mm_struct *); - /* Grab a reference to a task's mm, if it is not already going away */ -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 502787c29ce9..a2f12d377d23 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -3664,5 +3664,35 @@ static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb) - return hdr_len + skb_gso_transport_seglen(skb); - } - -+/** -+ * skb_gso_mac_seglen - Return length of individual segments of a gso packet -+ * -+ * @skb: GSO skb -+ * -+ * skb_gso_mac_seglen is used to determine the real size of the -+ * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4 -+ * headers (TCP/UDP). -+ */ -+static inline unsigned int skb_gso_mac_seglen(const struct sk_buff *skb) -+{ -+ unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb); -+ return hdr_len + skb_gso_transport_seglen(skb); -+} -+ -+/** -+ * skb_gso_validate_mac_len - Will a split GSO skb fit in a given length? -+ * -+ * @skb: GSO skb -+ * @len: length to validate against -+ * -+ * skb_gso_validate_mac_len validates if a given skb will fit a wanted -+ * length once split, including L2, L3 and L4 headers and the payload. -+ */ -+static inline bool -+skb_gso_validate_mac_len(const struct sk_buff *skb, unsigned int len) -+{ -+ return skb_gso_mac_seglen(skb) <= len; -+} -+ - #endif /* __KERNEL__ */ - #endif /* _LINUX_SKBUFF_H */ -diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h -index 12910cf19869..12a4b09f4d08 100644 ---- a/include/linux/smpboot.h -+++ b/include/linux/smpboot.h -@@ -30,7 +30,7 @@ struct smpboot_thread_data; - * @thread_comm: The base name of the thread - */ - struct smp_hotplug_thread { -- struct task_struct __percpu **store; -+ struct task_struct * __percpu *store; - struct list_head list; - int (*thread_should_run)(unsigned int cpu); - void (*thread_fn)(unsigned int cpu); -diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h -index 7e84aac39ade..667e7f9fd877 100644 ---- a/include/linux/usb/gadget.h -+++ b/include/linux/usb/gadget.h -@@ -671,7 +671,9 @@ static inline struct usb_gadget *dev_to_usb_gadget(struct device *dev) - */ - static inline size_t usb_ep_align(struct usb_ep *ep, size_t len) - { -- return round_up(len, (size_t)le16_to_cpu(ep->desc->wMaxPacketSize)); -+ int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc) & 0x7ff; -+ -+ return round_up(len, max_packet_size); - } - - /** -diff --git a/include/net/arp.h b/include/net/arp.h -index 1b3f86981757..92d2f7d7d1cb 100644 ---- a/include/net/arp.h -+++ b/include/net/arp.h -@@ -17,6 +17,7 @@ static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32 - return val * hash_rnd[0]; - } - -+#ifdef CONFIG_INET - static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key) - { - if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT)) -@@ -24,6 +25,13 @@ static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev - - return ___neigh_lookup_noref(&arp_tbl, neigh_key_eq32, arp_hashfn, &key, dev); - } -+#else -+static inline -+struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key) -+{ -+ return NULL; -+} -+#endif - - static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key) - { -diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h -index c9aca042e61d..d3a5cf3b5446 100644 ---- a/include/uapi/linux/fuse.h -+++ b/include/uapi/linux/fuse.h -@@ -205,10 +205,12 @@ struct fuse_file_lock { - * FOPEN_DIRECT_IO: bypass page cache for this open file - * FOPEN_KEEP_CACHE: don't invalidate the data cache on open - * FOPEN_NONSEEKABLE: the file is not seekable -+ * FOPEN_STREAM: the file is stream-like (no file position at all) - */ - #define FOPEN_DIRECT_IO (1 << 0) - #define FOPEN_KEEP_CACHE (1 << 1) - #define FOPEN_NONSEEKABLE (1 << 2) -+#define FOPEN_STREAM (1 << 4) - - /** - * INIT request/reply flags -diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h -index 087b0ef82c07..bbebd258cf07 100644 ---- a/include/uapi/linux/tipc_config.h -+++ b/include/uapi/linux/tipc_config.h -@@ -301,8 +301,10 @@ static inline int TLV_SET(void *tlv, __u16 type, void *data, __u16 len) - tlv_ptr = (struct tlv_desc *)tlv; - tlv_ptr->tlv_type = htons(type); - tlv_ptr->tlv_len = htons(tlv_len); -- if (len && data) -- memcpy(TLV_DATA(tlv_ptr), data, tlv_len); -+ if (len && data) { -+ memcpy(TLV_DATA(tlv_ptr), data, len); -+ memset(TLV_DATA(tlv_ptr) + len, 0, TLV_SPACE(len) - tlv_len); -+ } - return TLV_SPACE(len); - } - -@@ -399,8 +401,10 @@ static inline int TCM_SET(void *msg, __u16 cmd, __u16 flags, - tcm_hdr->tcm_len = htonl(msg_len); - tcm_hdr->tcm_type = htons(cmd); - tcm_hdr->tcm_flags = htons(flags); -- if (data_len && data) -+ if (data_len && data) { - memcpy(TCM_DATA(msg), data, data_len); -+ memset(TCM_DATA(msg) + data_len, 0, TCM_SPACE(data_len) - msg_len); -+ } - return TCM_SPACE(data_len); - } - -diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c -index b57f929f1b46..cf7aa656b308 100644 ---- a/kernel/auditfilter.c -+++ b/kernel/auditfilter.c -@@ -1095,22 +1095,24 @@ int audit_rule_change(int type, __u32 portid, int seq, void *data, - int err = 0; - struct audit_entry *entry; - -- entry = audit_data_to_entry(data, datasz); -- if (IS_ERR(entry)) -- return PTR_ERR(entry); -- - switch (type) { - case AUDIT_ADD_RULE: -+ entry = audit_data_to_entry(data, datasz); -+ if (IS_ERR(entry)) -+ return PTR_ERR(entry); - err = audit_add_rule(entry); - audit_log_rule_change("add_rule", &entry->rule, !err); - break; - case AUDIT_DEL_RULE: -+ entry = audit_data_to_entry(data, datasz); -+ if (IS_ERR(entry)) -+ return PTR_ERR(entry); - err = audit_del_rule(entry); - audit_log_rule_change("remove_rule", &entry->rule, !err); - break; - default: -- err = -EINVAL; - WARN_ON(1); -+ return -EINVAL; - } - - if (err || type == AUDIT_DEL_RULE) { -diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c -index d89328e260df..041a02b334d7 100644 ---- a/kernel/rcu/rcutorture.c -+++ b/kernel/rcu/rcutorture.c -@@ -1603,6 +1603,10 @@ rcu_torture_cleanup(void) - cur_ops->cb_barrier(); - return; - } -+ if (!cur_ops) { -+ torture_cleanup_end(); -+ return; -+ } - - rcu_torture_barrier_cleanup(); - torture_stop_kthread(rcu_torture_stall, stall_task); -@@ -1741,6 +1745,7 @@ rcu_torture_init(void) - pr_alert(" %s", torture_ops[i]->name); - pr_alert("\n"); - firsterr = -EINVAL; -+ cur_ops = NULL; - goto unwind; - } - if (cur_ops->fqs == NULL && fqs_duration != 0) { -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index d35a7d528ea6..0e70bfeded7f 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -8361,6 +8361,8 @@ static void cpu_cgroup_attach(struct cgroup_taskset *tset) - static int cpu_shares_write_u64(struct cgroup_subsys_state *css, - struct cftype *cftype, u64 shareval) - { -+ if (shareval > scale_load_down(ULONG_MAX)) -+ shareval = MAX_SHARES; - return sched_group_set_shares(css_tg(css), scale_load(shareval)); - } - -@@ -8460,8 +8462,10 @@ int tg_set_cfs_quota(struct task_group *tg, long cfs_quota_us) - period = ktime_to_ns(tg->cfs_bandwidth.period); - if (cfs_quota_us < 0) - quota = RUNTIME_INF; -- else -+ else if ((u64)cfs_quota_us <= U64_MAX / NSEC_PER_USEC) - quota = (u64)cfs_quota_us * NSEC_PER_USEC; -+ else -+ return -EINVAL; - - return tg_set_cfs_bandwidth(tg, period, quota); - } -@@ -8483,6 +8487,9 @@ int tg_set_cfs_period(struct task_group *tg, long cfs_period_us) - { - u64 quota, period; - -+ if ((u64)cfs_period_us > U64_MAX / NSEC_PER_USEC) -+ return -EINVAL; -+ - period = (u64)cfs_period_us * NSEC_PER_USEC; - quota = tg->cfs_bandwidth.quota; - -diff --git a/kernel/signal.c b/kernel/signal.c -index 96e8c3cbfa38..072fd152ab01 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -2244,6 +2244,8 @@ relock: - if (signal_group_exit(signal)) { - ksig->info.si_signo = signr = SIGKILL; - sigdelset(¤t->pending.signal, SIGKILL); -+ trace_signal_deliver(SIGKILL, SEND_SIG_NOINFO, -+ &sighand->action[SIGKILL - 1]); - recalc_sigpending(); - goto fatal; - } -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index ba5392807912..bd4c0bb61ad7 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -1288,9 +1288,6 @@ event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos) - char buf[32]; - int len; - -- if (*ppos) -- return 0; -- - if (unlikely(!id)) - return -ENODEV; - -diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c -index e0af6ff73d14..f8b1e3cb716b 100644 ---- a/lib/strncpy_from_user.c -+++ b/lib/strncpy_from_user.c -@@ -20,10 +20,11 @@ - * hit it), 'max' is the address space maximum (and we return - * -EFAULT if we hit it). - */ --static inline long do_strncpy_from_user(char *dst, const char __user *src, long count, unsigned long max) -+static inline long do_strncpy_from_user(char *dst, const char __user *src, -+ unsigned long count, unsigned long max) - { - const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; -- long res = 0; -+ unsigned long res = 0; - - /* - * Truncate 'max' to the user-specified limit, so that -diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c -index 3a5f2b366d84..1c87bfa63db7 100644 ---- a/lib/strnlen_user.c -+++ b/lib/strnlen_user.c -@@ -27,7 +27,7 @@ - static inline long do_strnlen_user(const char __user *src, unsigned long count, unsigned long max) - { - const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS; -- long align, res = 0; -+ unsigned long align, res = 0; - unsigned long c; - - /* -@@ -41,7 +41,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count, - * Do everything aligned. But that means that we - * need to also expand the maximum.. - */ -- align = (sizeof(long) - 1) & (unsigned long)src; -+ align = (sizeof(unsigned long) - 1) & (unsigned long)src; - src -= align; - max += align; - -diff --git a/mm/backing-dev.c b/mm/backing-dev.c -index 7f80b1a1bc34..07e3b3b8e846 100644 ---- a/mm/backing-dev.c -+++ b/mm/backing-dev.c -@@ -669,6 +669,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) - INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); - bdi->cgwb_congested_tree = RB_ROOT; - atomic_set(&bdi->usage_cnt, 1); -+ init_rwsem(&bdi->wb_switch_rwsem); - - ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); - if (!ret) { -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 324b2953e57e..d7f65a8c629b 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3703,21 +3703,14 @@ backout_unlocked: - } - - #ifdef CONFIG_SMP --u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm, -- struct vm_area_struct *vma, -- struct address_space *mapping, -+u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, - pgoff_t idx, unsigned long address) - { - unsigned long key[2]; - u32 hash; - -- if (vma->vm_flags & VM_SHARED) { -- key[0] = (unsigned long) mapping; -- key[1] = idx; -- } else { -- key[0] = (unsigned long) mm; -- key[1] = address >> huge_page_shift(h); -- } -+ key[0] = (unsigned long) mapping; -+ key[1] = idx; - - hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0); - -@@ -3728,9 +3721,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm, - * For uniprocesor systems we always use a single mutex, so just - * return 0 and avoid the hashing overhead. - */ --u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm, -- struct vm_area_struct *vma, -- struct address_space *mapping, -+u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, - pgoff_t idx, unsigned long address) - { - return 0; -@@ -3776,7 +3767,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, - * get spurious allocation failures if two CPUs race to instantiate - * the same page in the page cache. - */ -- hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, address); -+ hash = hugetlb_fault_mutex_hash(h, mapping, idx, address); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - entry = huge_ptep_get(ptep); -diff --git a/mm/list_lru.c b/mm/list_lru.c -index 786176b1a0ee..732a066e3d3a 100644 ---- a/mm/list_lru.c -+++ b/mm/list_lru.c -@@ -42,11 +42,7 @@ static void list_lru_unregister(struct list_lru *lru) - #ifdef CONFIG_MEMCG_KMEM - static inline bool list_lru_memcg_aware(struct list_lru *lru) - { -- /* -- * This needs node 0 to be always present, even -- * in the systems supporting sparse numa ids. -- */ -- return !!lru->node[0].memcg_lrus; -+ return lru->memcg_aware; - } - - static inline struct list_lru_one * -@@ -389,6 +385,8 @@ static int memcg_init_list_lru(struct list_lru *lru, bool memcg_aware) - { - int i; - -+ lru->memcg_aware = memcg_aware; -+ - if (!memcg_aware) - return 0; - -diff --git a/mm/mincore.c b/mm/mincore.c -index 14bb9fb37f0c..9700c2303941 100644 ---- a/mm/mincore.c -+++ b/mm/mincore.c -@@ -165,6 +165,22 @@ out: - return 0; - } - -+static inline bool can_do_mincore(struct vm_area_struct *vma) -+{ -+ if (vma_is_anonymous(vma)) -+ return true; -+ if (!vma->vm_file) -+ return false; -+ /* -+ * Reveal pagecache information only for non-anonymous mappings that -+ * correspond to the files the calling process could (if tried) open -+ * for writing; otherwise we'd be including shared non-exclusive -+ * mappings, which opens a side channel. -+ */ -+ return inode_owner_or_capable(file_inode(vma->vm_file)) || -+ inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0; -+} -+ - /* - * Do a chunk of "sys_mincore()". We've already checked - * all the arguments, we hold the mmap semaphore: we should -@@ -185,8 +201,13 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v - vma = find_vma(current->mm, addr); - if (!vma || addr < vma->vm_start) - return -ENOMEM; -- mincore_walk.mm = vma->vm_mm; - end = min(vma->vm_end, addr + (pages << PAGE_SHIFT)); -+ if (!can_do_mincore(vma)) { -+ unsigned long pages = DIV_ROUND_UP(end - addr, PAGE_SIZE); -+ memset(vec, 1, pages); -+ return pages; -+ } -+ mincore_walk.mm = vma->vm_mm; - err = walk_page_range(addr, end, &mincore_walk); - if (err < 0) - return err; -diff --git a/net/core/dev.c b/net/core/dev.c -index 49f78bce5795..db5345f5f7b0 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4550,7 +4550,6 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi) - skb_reset_mac_header(skb); - skb_gro_reset_offset(skb); - -- eth = skb_gro_header_fast(skb, 0); - if (unlikely(skb_gro_header_hard(skb, hlen))) { - eth = skb_gro_header_slow(skb, hlen, 0); - if (unlikely(!eth)) { -@@ -4558,6 +4557,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi) - return NULL; - } - } else { -+ eth = (const struct ethhdr *)skb->data; - gro_pull_from_frag0(skb, hlen); - NAPI_GRO_CB(skb)->frag0 += hlen; - NAPI_GRO_CB(skb)->frag0_len -= hlen; -@@ -6986,7 +6986,7 @@ static void netdev_wait_allrefs(struct net_device *dev) - - refcnt = netdev_refcnt_read(dev); - -- if (time_after(jiffies, warning_time + 10 * HZ)) { -+ if (refcnt && time_after(jiffies, warning_time + 10 * HZ)) { - pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n", - dev->name, refcnt); - warning_time = jiffies; -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index 9a53c66deb64..66428c0eb663 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -428,8 +428,13 @@ static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev, - if (rc >= 0) - info.n_priv_flags = rc; - } -- if (ops->get_regs_len) -- info.regdump_len = ops->get_regs_len(dev); -+ if (ops->get_regs_len) { -+ int ret = ops->get_regs_len(dev); -+ -+ if (ret > 0) -+ info.regdump_len = ret; -+ } -+ - if (ops->get_eeprom_len) - info.eedump_len = ops->get_eeprom_len(dev); - -@@ -883,6 +888,9 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr) - return -EFAULT; - - reglen = ops->get_regs_len(dev); -+ if (reglen <= 0) -+ return reglen; -+ - if (regs.len > reglen) - regs.len = reglen; - -@@ -893,13 +901,16 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr) - return -ENOMEM; - } - -+ if (regs.len < reglen) -+ reglen = regs.len; -+ - ops->get_regs(dev, ®s, regbuf); - - ret = -EFAULT; - if (copy_to_user(useraddr, ®s, sizeof(regs))) - goto out; - useraddr += offsetof(struct ethtool_regs, data); -- if (regbuf && copy_to_user(useraddr, regbuf, regs.len)) -+ if (copy_to_user(useraddr, regbuf, reglen)) - goto out; - ret = 0; - -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 78dc184072e8..9d812ba38ff2 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -2490,7 +2491,13 @@ int neigh_xmit(int index, struct net_device *dev, - if (!tbl) - goto out; - rcu_read_lock_bh(); -- neigh = __neigh_lookup_noref(tbl, addr, dev); -+ if (index == NEIGH_ARP_TABLE) { -+ u32 key = *((u32 *)addr); -+ -+ neigh = __ipv4_neigh_lookup_noref(dev, key); -+ } else { -+ neigh = __neigh_lookup_noref(tbl, addr, dev); -+ } - if (!neigh) - neigh = __neigh_create(tbl, addr, dev, false); - err = PTR_ERR(neigh); -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index b6327601f979..4ea957c1e7ee 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -3139,7 +3139,13 @@ static int pktgen_wait_thread_run(struct pktgen_thread *t) - { - while (thread_is_running(t)) { - -+ /* note: 't' will still be around even after the unlock/lock -+ * cycle because pktgen_thread threads are only cleared at -+ * net exit -+ */ -+ mutex_unlock(&pktgen_thread_lock); - msleep_interruptible(100); -+ mutex_lock(&pktgen_thread_lock); - - if (signal_pending(current)) - goto signal; -@@ -3154,6 +3160,10 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn) - struct pktgen_thread *t; - int sig = 1; - -+ /* prevent from racing with rmmod */ -+ if (!try_module_get(THIS_MODULE)) -+ return sig; -+ - mutex_lock(&pktgen_thread_lock); - - list_for_each_entry(t, &pn->pktgen_threads, th_list) { -@@ -3167,6 +3177,7 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn) - t->control |= (T_STOP); - - mutex_unlock(&pktgen_thread_lock); -+ module_put(THIS_MODULE); - return sig; - } - -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index fcf327ebd134..bbcbbc1cc2cc 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -648,9 +648,9 @@ static int __init vti_init(void) - return err; - - rtnl_link_failed: -- xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); --xfrm_tunnel_failed: - xfrm4_tunnel_deregister(&ipip_handler, AF_INET); -+xfrm_tunnel_failed: -+ xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); - xfrm_proto_comp_failed: - xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); - xfrm_proto_ah_failed: -@@ -666,6 +666,7 @@ pernet_dev_failed: - static void __exit vti_fini(void) - { - rtnl_link_unregister(&vti_link_ops); -+ xfrm4_tunnel_deregister(&ipip_handler, AF_INET); - xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP); - xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); - xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP); -diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c -index fddae0164b91..d9758ecdcba6 100644 ---- a/net/ipv4/xfrm4_policy.c -+++ b/net/ipv4/xfrm4_policy.c -@@ -108,7 +108,8 @@ static void - _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - { - const struct iphdr *iph = ip_hdr(skb); -- u8 *xprth = skb_network_header(skb) + iph->ihl * 4; -+ int ihl = iph->ihl; -+ u8 *xprth = skb_network_header(skb) + ihl * 4; - struct flowi4 *fl4 = &fl->u.ip4; - int oif = 0; - -@@ -119,6 +120,11 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - fl4->flowi4_mark = skb->mark; - fl4->flowi4_oif = reverse ? skb->skb_iif : oif; - -+ fl4->flowi4_proto = iph->protocol; -+ fl4->daddr = reverse ? iph->saddr : iph->daddr; -+ fl4->saddr = reverse ? iph->daddr : iph->saddr; -+ fl4->flowi4_tos = iph->tos; -+ - if (!ip_is_fragment(iph)) { - switch (iph->protocol) { - case IPPROTO_UDP: -@@ -130,7 +136,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - pskb_may_pull(skb, xprth + 4 - skb->data)) { - __be16 *ports; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - ports = (__be16 *)xprth; - - fl4->fl4_sport = ports[!!reverse]; -@@ -143,7 +149,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - pskb_may_pull(skb, xprth + 2 - skb->data)) { - u8 *icmp; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - icmp = xprth; - - fl4->fl4_icmp_type = icmp[0]; -@@ -156,7 +162,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - pskb_may_pull(skb, xprth + 4 - skb->data)) { - __be32 *ehdr; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - ehdr = (__be32 *)xprth; - - fl4->fl4_ipsec_spi = ehdr[0]; -@@ -168,7 +174,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - pskb_may_pull(skb, xprth + 8 - skb->data)) { - __be32 *ah_hdr; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - ah_hdr = (__be32 *)xprth; - - fl4->fl4_ipsec_spi = ah_hdr[1]; -@@ -180,7 +186,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - pskb_may_pull(skb, xprth + 4 - skb->data)) { - __be16 *ipcomp_hdr; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - ipcomp_hdr = (__be16 *)xprth; - - fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); -@@ -193,7 +199,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - __be16 *greflags; - __be32 *gre_hdr; - -- xprth = skb_network_header(skb) + iph->ihl * 4; -+ xprth = skb_network_header(skb) + ihl * 4; - greflags = (__be16 *)xprth; - gre_hdr = (__be32 *)xprth; - -@@ -210,10 +216,6 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - break; - } - } -- fl4->flowi4_proto = iph->protocol; -- fl4->daddr = reverse ? iph->saddr : iph->daddr; -- fl4->saddr = reverse ? iph->daddr : iph->saddr; -- fl4->flowi4_tos = iph->tos; - } - - static inline int xfrm4_garbage_collect(struct dst_ops *ops) -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index 4d52a0e2f60d..55953c5804c3 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -283,7 +283,9 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - /* Binding to link-local address requires an interface */ - if (!sk->sk_bound_dev_if) - goto out_unlock; -+ } - -+ if (sk->sk_bound_dev_if) { - err = -ENODEV; - dev = dev_get_by_index_rcu(sock_net(sk), - sk->sk_bound_dev_if); -diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c -index 56b72cada346..f9d493c59d6c 100644 ---- a/net/ipv6/xfrm6_tunnel.c -+++ b/net/ipv6/xfrm6_tunnel.c -@@ -391,6 +391,10 @@ static void __exit xfrm6_tunnel_fini(void) - xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); - xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); - unregister_pernet_subsys(&xfrm6_tunnel_net_ops); -+ /* Someone maybe has gotten the xfrm6_tunnel_spi. -+ * So need to wait it. -+ */ -+ rcu_barrier(); - kmem_cache_destroy(xfrm6_tunnel_spi_kmem); - } - -diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c -index 94425e421213..9e4b6bcf6920 100644 ---- a/net/llc/llc_output.c -+++ b/net/llc/llc_output.c -@@ -72,6 +72,8 @@ int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb, - rc = llc_mac_hdr_init(skb, skb->dev->dev_addr, dmac); - if (likely(!rc)) - rc = dev_queue_xmit(skb); -+ else -+ kfree_skb(skb); - return rc; - } - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index ed4fef32b394..08384dbf426c 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -1104,9 +1104,6 @@ static void ieee80211_chswitch_work(struct work_struct *work) - goto out; - } - -- /* XXX: shouldn't really modify cfg80211-owned data! */ -- ifmgd->associated->channel = sdata->csa_chandef.chan; -- - ifmgd->csa_waiting_bcn = true; - - ieee80211_sta_reset_beacon_monitor(sdata); -diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c -index a2340748ec86..d7888924166e 100644 ---- a/net/rds/ib_rdma.c -+++ b/net/rds/ib_rdma.c -@@ -725,12 +725,14 @@ static int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool, - wait_clean_list_grace(); - - list_to_llist_nodes(pool, &unmap_list, &clean_nodes, &clean_tail); -- if (ibmr_ret) -+ if (ibmr_ret) { - *ibmr_ret = llist_entry(clean_nodes, struct rds_ib_mr, llnode); -- -+ clean_nodes = clean_nodes->next; -+ } - /* more than one entry in llist nodes */ -- if (clean_nodes->next) -- llist_add_batch(clean_nodes->next, clean_tail, &pool->clean_list); -+ if (clean_nodes) -+ llist_add_batch(clean_nodes, clean_tail, -+ &pool->clean_list); - - } - -diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c -index a06c9d6bfc9c..05c7a66f64da 100644 ---- a/net/sched/sch_tbf.c -+++ b/net/sched/sch_tbf.c -@@ -142,16 +142,6 @@ static u64 psched_ns_t2l(const struct psched_ratecfg *r, - return len; - } - --/* -- * Return length of individual segments of a gso packet, -- * including all headers (MAC, IP, TCP/UDP) -- */ --static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb) --{ -- unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb); -- return hdr_len + skb_gso_transport_seglen(skb); --} -- - /* GSO packet is too big, segment it so that tbf can transmit - * each segment in time - */ -diff --git a/net/tipc/core.c b/net/tipc/core.c -index e2bdb07a49a2..c306e9bc1621 100644 ---- a/net/tipc/core.c -+++ b/net/tipc/core.c -@@ -70,9 +70,6 @@ static int __net_init tipc_init_net(struct net *net) - goto out_nametbl; - - INIT_LIST_HEAD(&tn->dist_queue); -- err = tipc_topsrv_start(net); -- if (err) -- goto out_subscr; - - err = tipc_bcast_init(net); - if (err) -@@ -81,8 +78,6 @@ static int __net_init tipc_init_net(struct net *net) - return 0; - - out_bclink: -- tipc_bcast_stop(net); --out_subscr: - tipc_nametbl_stop(net); - out_nametbl: - tipc_sk_rht_destroy(net); -@@ -92,7 +87,6 @@ out_sk_rht: - - static void __net_exit tipc_exit_net(struct net *net) - { -- tipc_topsrv_stop(net); - tipc_net_stop(net); - tipc_bcast_stop(net); - tipc_nametbl_stop(net); -@@ -106,6 +100,11 @@ static struct pernet_operations tipc_net_ops = { - .size = sizeof(struct tipc_net), - }; - -+static struct pernet_operations tipc_topsrv_net_ops = { -+ .init = tipc_topsrv_init_net, -+ .exit = tipc_topsrv_exit_net, -+}; -+ - static int __init tipc_init(void) - { - int err; -@@ -126,10 +125,6 @@ static int __init tipc_init(void) - if (err) - goto out_netlink_compat; - -- err = tipc_socket_init(); -- if (err) -- goto out_socket; -- - err = tipc_register_sysctl(); - if (err) - goto out_sysctl; -@@ -138,6 +133,14 @@ static int __init tipc_init(void) - if (err) - goto out_pernet; - -+ err = tipc_socket_init(); -+ if (err) -+ goto out_socket; -+ -+ err = register_pernet_subsys(&tipc_topsrv_net_ops); -+ if (err) -+ goto out_pernet_topsrv; -+ - err = tipc_bearer_setup(); - if (err) - goto out_bearer; -@@ -145,12 +148,14 @@ static int __init tipc_init(void) - pr_info("Started in single node mode\n"); - return 0; - out_bearer: -+ unregister_pernet_subsys(&tipc_topsrv_net_ops); -+out_pernet_topsrv: -+ tipc_socket_stop(); -+out_socket: - unregister_pernet_subsys(&tipc_net_ops); - out_pernet: - tipc_unregister_sysctl(); - out_sysctl: -- tipc_socket_stop(); --out_socket: - tipc_netlink_compat_stop(); - out_netlink_compat: - tipc_netlink_stop(); -@@ -162,10 +167,11 @@ out_netlink: - static void __exit tipc_exit(void) - { - tipc_bearer_cleanup(); -+ unregister_pernet_subsys(&tipc_topsrv_net_ops); -+ tipc_socket_stop(); - unregister_pernet_subsys(&tipc_net_ops); - tipc_netlink_stop(); - tipc_netlink_compat_stop(); -- tipc_socket_stop(); - tipc_unregister_sysctl(); - - pr_info("Deactivated\n"); -diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c -index 500c9e614a06..4f80f00cd8f9 100644 ---- a/net/tipc/subscr.c -+++ b/net/tipc/subscr.c -@@ -306,7 +306,7 @@ static void *tipc_subscrb_connect_cb(int conid) - return (void *)tipc_subscrb_create(conid); - } - --int tipc_topsrv_start(struct net *net) -+static int tipc_topsrv_start(struct net *net) - { - struct tipc_net *tn = net_generic(net, tipc_net_id); - const char name[] = "topology_server"; -@@ -344,7 +344,7 @@ int tipc_topsrv_start(struct net *net) - return tipc_server_start(topsrv); - } - --void tipc_topsrv_stop(struct net *net) -+static void tipc_topsrv_stop(struct net *net) - { - struct tipc_net *tn = net_generic(net, tipc_net_id); - struct tipc_server *topsrv = tn->topsrv; -@@ -353,3 +353,13 @@ void tipc_topsrv_stop(struct net *net) - kfree(topsrv->saddr); - kfree(topsrv); - } -+ -+int __net_init tipc_topsrv_init_net(struct net *net) -+{ -+ return tipc_topsrv_start(net); -+} -+ -+void __net_exit tipc_topsrv_exit_net(struct net *net) -+{ -+ tipc_topsrv_stop(net); -+} -diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h -index 92ee18cc5fe6..e9aa8c7a6fec 100644 ---- a/net/tipc/subscr.h -+++ b/net/tipc/subscr.h -@@ -77,7 +77,8 @@ int tipc_subscrp_check_overlap(struct tipc_subscription *sub, u32 found_lower, - void tipc_subscrp_report_overlap(struct tipc_subscription *sub, - u32 found_lower, u32 found_upper, u32 event, - u32 port_ref, u32 node, int must); --int tipc_topsrv_start(struct net *net); --void tipc_topsrv_stop(struct net *net); -+ -+int __net_init tipc_topsrv_init_net(struct net *net); -+void __net_exit tipc_topsrv_exit_net(struct net *net); - - #endif -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 81013490a99f..1968998e6c6c 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -12788,6 +12788,11 @@ void cfg80211_ch_switch_notify(struct net_device *dev, - - wdev->chandef = *chandef; - wdev->preset_chandef = *chandef; -+ -+ if (wdev->iftype == NL80211_IFTYPE_STATION && -+ !WARN_ON(!wdev->current_bss)) -+ wdev->current_bss->pub.channel = chandef->chan; -+ - nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, - NL80211_CMD_CH_SWITCH_NOTIFY, 0); - } -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 177a6c75f136..b04c03043976 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -1340,7 +1340,7 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) - ret = verify_policy_dir(p->dir); - if (ret) - return ret; -- if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir)) -+ if (p->index && (xfrm_policy_id2dir(p->index) != p->dir)) - return -EINVAL; - - return 0; -diff --git a/scripts/coccinelle/api/stream_open.cocci b/scripts/coccinelle/api/stream_open.cocci -new file mode 100644 -index 000000000000..350145da7669 ---- /dev/null -+++ b/scripts/coccinelle/api/stream_open.cocci -@@ -0,0 +1,363 @@ -+// SPDX-License-Identifier: GPL-2.0 -+// Author: Kirill Smelkov (kirr@nexedi.com) -+// -+// Search for stream-like files that are using nonseekable_open and convert -+// them to stream_open. A stream-like file is a file that does not use ppos in -+// its read and write. Rationale for the conversion is to avoid deadlock in -+// between read and write. -+ -+virtual report -+virtual patch -+virtual explain // explain decisions in the patch (SPFLAGS="-D explain") -+ -+// stream-like reader & writer - ones that do not depend on f_pos. -+@ stream_reader @ -+identifier readstream, ppos; -+identifier f, buf, len; -+type loff_t; -+@@ -+ ssize_t readstream(struct file *f, char *buf, size_t len, loff_t *ppos) -+ { -+ ... when != ppos -+ } -+ -+@ stream_writer @ -+identifier writestream, ppos; -+identifier f, buf, len; -+type loff_t; -+@@ -+ ssize_t writestream(struct file *f, const char *buf, size_t len, loff_t *ppos) -+ { -+ ... when != ppos -+ } -+ -+ -+// a function that blocks -+@ blocks @ -+identifier block_f; -+identifier wait_event =~ "^wait_event_.*"; -+@@ -+ block_f(...) { -+ ... when exists -+ wait_event(...) -+ ... when exists -+ } -+ -+// stream_reader that can block inside. -+// -+// XXX wait_* can be called not directly from current function (e.g. func -> f -> g -> wait()) -+// XXX currently reader_blocks supports only direct and 1-level indirect cases. -+@ reader_blocks_direct @ -+identifier stream_reader.readstream; -+identifier wait_event =~ "^wait_event_.*"; -+@@ -+ readstream(...) -+ { -+ ... when exists -+ wait_event(...) -+ ... when exists -+ } -+ -+@ reader_blocks_1 @ -+identifier stream_reader.readstream; -+identifier blocks.block_f; -+@@ -+ readstream(...) -+ { -+ ... when exists -+ block_f(...) -+ ... when exists -+ } -+ -+@ reader_blocks depends on reader_blocks_direct || reader_blocks_1 @ -+identifier stream_reader.readstream; -+@@ -+ readstream(...) { -+ ... -+ } -+ -+ -+// file_operations + whether they have _any_ .read, .write, .llseek ... at all. -+// -+// XXX add support for file_operations xxx[N] = ... (sound/core/pcm_native.c) -+@ fops0 @ -+identifier fops; -+@@ -+ struct file_operations fops = { -+ ... -+ }; -+ -+@ has_read @ -+identifier fops0.fops; -+identifier read_f; -+@@ -+ struct file_operations fops = { -+ .read = read_f, -+ }; -+ -+@ has_read_iter @ -+identifier fops0.fops; -+identifier read_iter_f; -+@@ -+ struct file_operations fops = { -+ .read_iter = read_iter_f, -+ }; -+ -+@ has_write @ -+identifier fops0.fops; -+identifier write_f; -+@@ -+ struct file_operations fops = { -+ .write = write_f, -+ }; -+ -+@ has_write_iter @ -+identifier fops0.fops; -+identifier write_iter_f; -+@@ -+ struct file_operations fops = { -+ .write_iter = write_iter_f, -+ }; -+ -+@ has_llseek @ -+identifier fops0.fops; -+identifier llseek_f; -+@@ -+ struct file_operations fops = { -+ .llseek = llseek_f, -+ }; -+ -+@ has_no_llseek @ -+identifier fops0.fops; -+@@ -+ struct file_operations fops = { -+ .llseek = no_llseek, -+ }; -+ -+@ has_mmap @ -+identifier fops0.fops; -+identifier mmap_f; -+@@ -+ struct file_operations fops = { -+ .mmap = mmap_f, -+ }; -+ -+@ has_copy_file_range @ -+identifier fops0.fops; -+identifier copy_file_range_f; -+@@ -+ struct file_operations fops = { -+ .copy_file_range = copy_file_range_f, -+ }; -+ -+@ has_remap_file_range @ -+identifier fops0.fops; -+identifier remap_file_range_f; -+@@ -+ struct file_operations fops = { -+ .remap_file_range = remap_file_range_f, -+ }; -+ -+@ has_splice_read @ -+identifier fops0.fops; -+identifier splice_read_f; -+@@ -+ struct file_operations fops = { -+ .splice_read = splice_read_f, -+ }; -+ -+@ has_splice_write @ -+identifier fops0.fops; -+identifier splice_write_f; -+@@ -+ struct file_operations fops = { -+ .splice_write = splice_write_f, -+ }; -+ -+ -+// file_operations that is candidate for stream_open conversion - it does not -+// use mmap and other methods that assume @offset access to file. -+// -+// XXX for simplicity require no .{read/write}_iter and no .splice_{read/write} for now. -+// XXX maybe_steam.fops cannot be used in other rules - it gives "bad rule maybe_stream or bad variable fops". -+@ maybe_stream depends on (!has_llseek || has_no_llseek) && !has_mmap && !has_copy_file_range && !has_remap_file_range && !has_read_iter && !has_write_iter && !has_splice_read && !has_splice_write @ -+identifier fops0.fops; -+@@ -+ struct file_operations fops = { -+ }; -+ -+ -+// ---- conversions ---- -+ -+// XXX .open = nonseekable_open -> .open = stream_open -+// XXX .open = func -> openfunc -> nonseekable_open -+ -+// read & write -+// -+// if both are used in the same file_operations together with an opener - -+// under that conditions we can use stream_open instead of nonseekable_open. -+@ fops_rw depends on maybe_stream @ -+identifier fops0.fops, openfunc; -+identifier stream_reader.readstream; -+identifier stream_writer.writestream; -+@@ -+ struct file_operations fops = { -+ .open = openfunc, -+ .read = readstream, -+ .write = writestream, -+ }; -+ -+@ report_rw depends on report @ -+identifier fops_rw.openfunc; -+position p1; -+@@ -+ openfunc(...) { -+ <... -+ nonseekable_open@p1 -+ ...> -+ } -+ -+@ script:python depends on report && reader_blocks @ -+fops << fops0.fops; -+p << report_rw.p1; -+@@ -+coccilib.report.print_report(p[0], -+ "ERROR: %s: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix." % (fops,)) -+ -+@ script:python depends on report && !reader_blocks @ -+fops << fops0.fops; -+p << report_rw.p1; -+@@ -+coccilib.report.print_report(p[0], -+ "WARNING: %s: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) -+ -+ -+@ explain_rw_deadlocked depends on explain && reader_blocks @ -+identifier fops_rw.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ nonseekable_open /* read & write (was deadlock) */ -+ ...> -+ } -+ -+ -+@ explain_rw_nodeadlock depends on explain && !reader_blocks @ -+identifier fops_rw.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ nonseekable_open /* read & write (no direct deadlock) */ -+ ...> -+ } -+ -+@ patch_rw depends on patch @ -+identifier fops_rw.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ stream_open -+ ...> -+ } -+ -+ -+// read, but not write -+@ fops_r depends on maybe_stream && !has_write @ -+identifier fops0.fops, openfunc; -+identifier stream_reader.readstream; -+@@ -+ struct file_operations fops = { -+ .open = openfunc, -+ .read = readstream, -+ }; -+ -+@ report_r depends on report @ -+identifier fops_r.openfunc; -+position p1; -+@@ -+ openfunc(...) { -+ <... -+ nonseekable_open@p1 -+ ...> -+ } -+ -+@ script:python depends on report @ -+fops << fops0.fops; -+p << report_r.p1; -+@@ -+coccilib.report.print_report(p[0], -+ "WARNING: %s: .read() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) -+ -+@ explain_r depends on explain @ -+identifier fops_r.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ nonseekable_open /* read only */ -+ ...> -+ } -+ -+@ patch_r depends on patch @ -+identifier fops_r.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ stream_open -+ ...> -+ } -+ -+ -+// write, but not read -+@ fops_w depends on maybe_stream && !has_read @ -+identifier fops0.fops, openfunc; -+identifier stream_writer.writestream; -+@@ -+ struct file_operations fops = { -+ .open = openfunc, -+ .write = writestream, -+ }; -+ -+@ report_w depends on report @ -+identifier fops_w.openfunc; -+position p1; -+@@ -+ openfunc(...) { -+ <... -+ nonseekable_open@p1 -+ ...> -+ } -+ -+@ script:python depends on report @ -+fops << fops0.fops; -+p << report_w.p1; -+@@ -+coccilib.report.print_report(p[0], -+ "WARNING: %s: .write() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,)) -+ -+@ explain_w depends on explain @ -+identifier fops_w.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ nonseekable_open /* write only */ -+ ...> -+ } -+ -+@ patch_w depends on patch @ -+identifier fops_w.openfunc; -+@@ -+ openfunc(...) { -+ <... -+- nonseekable_open -++ stream_open -+ ...> -+ } -+ -+ -+// no read, no write - don't change anything -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index a8045b8a2a18..b249b1b85746 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -1636,9 +1636,11 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll) - ret = !repoll || !pin_eld->monitor_present || pin_eld->eld_valid; - - jack = snd_hda_jack_tbl_get(codec, pin_nid); -- if (jack) -+ if (jack) { - jack->block_report = !ret; -- -+ jack->pin_sense = (eld->monitor_present && eld->eld_valid) ? -+ AC_PINSENSE_PRESENCE : 0; -+ } - mutex_unlock(&per_pin->lock); - snd_hda_power_down_pm(codec); - return ret; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5d8ac2d798df..68d96c2e8cde 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -772,11 +772,10 @@ static int alc_init(struct hda_codec *codec) - if (spec->init_hook) - spec->init_hook(codec); - -+ snd_hda_gen_init(codec); - alc_fix_pll(codec); - alc_auto_init_amp(codec, spec->init_amp); - -- snd_hda_gen_init(codec); -- - snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT); - - return 0; -@@ -5779,7 +5778,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), - SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), -- SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), -+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), - SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), - SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC), - SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK), -@@ -6237,7 +6236,7 @@ static int patch_alc269(struct hda_codec *codec) - - spec = codec->spec; - spec->gen.shared_mic_vref_pin = 0x18; -- codec->power_save_node = 1; -+ codec->power_save_node = 0; - - #ifdef CONFIG_PM - codec->patch_ops.suspend = alc269_suspend; -diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c -index 584aab83e478..3e65dc74eb33 100644 ---- a/sound/soc/codecs/max98090.c -+++ b/sound/soc/codecs/max98090.c -@@ -1209,14 +1209,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = { - &max98090_right_rcv_mixer_controls[0], - ARRAY_SIZE(max98090_right_rcv_mixer_controls)), - -- SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER, -- M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux), -+ SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0, -+ &max98090_linmod_mux), - -- SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL, -- M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux), -+ SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0, -+ &max98090_mixhplsel_mux), - -- SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL, -- M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux), -+ SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0, -+ &max98090_mixhprsel_mux), - - SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE, - M98090_HPLEN_SHIFT, 0, NULL, 0), -diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c -index 91879ea95415..01aa75cde571 100644 ---- a/sound/soc/codecs/rt5677-spi.c -+++ b/sound/soc/codecs/rt5677-spi.c -@@ -60,13 +60,15 @@ static DEFINE_MUTEX(spi_mutex); - * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes - * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes - * -- * For example, reading 260 bytes at 0x60030002 uses the following commands: -- * 0x60030002 RT5677_SPI_READ_16 2 bytes -+ * Note: -+ * 16 Bit writes and reads are restricted to the address range -+ * 0x18020000 ~ 0x18021000 -+ * -+ * For example, reading 256 bytes at 0x60030004 uses the following commands: - * 0x60030004 RT5677_SPI_READ_32 4 bytes - * 0x60030008 RT5677_SPI_READ_BURST 240 bytes - * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes - * 0x60030100 RT5677_SPI_READ_32 4 bytes -- * 0x60030104 RT5677_SPI_READ_16 2 bytes - * - * Input: - * @read: true for read commands; false for write commands -@@ -81,15 +83,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len) - { - u8 cmd; - -- if (align == 2 || align == 6 || remain == 2) { -- cmd = RT5677_SPI_READ_16; -- *len = 2; -- } else if (align == 4 || remain <= 6) { -+ if (align == 4 || remain <= 4) { - cmd = RT5677_SPI_READ_32; - *len = 4; - } else { - cmd = RT5677_SPI_READ_BURST; -- *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN); -+ *len = (((remain - 1) >> 3) + 1) << 3; -+ *len = min_t(u32, *len, RT5677_SPI_BURST_LEN); - } - return read ? cmd : cmd + 1; - } -@@ -110,7 +110,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen) - } - } - --/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */ -+/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */ - int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) - { - u32 offset; -@@ -126,7 +126,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) - if (!g_spi) - return -ENODEV; - -- if ((addr & 1) || (len & 1)) { -+ if ((addr & 3) || (len & 3)) { - dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len); - return -EACCES; - } -@@ -161,13 +161,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) - } - EXPORT_SYMBOL_GPL(rt5677_spi_read); - --/* Write DSP address space using SPI. addr has to be 2-byte aligned. -- * If len is not 2-byte aligned, an extra byte of zero is written at the end -+/* Write DSP address space using SPI. addr has to be 4-byte aligned. -+ * If len is not 4-byte aligned, then extra zeros are written at the end - * as padding. - */ - int rt5677_spi_write(u32 addr, const void *txbuf, size_t len) - { -- u32 offset, len_with_pad = len; -+ u32 offset; - int status = 0; - struct spi_transfer t; - struct spi_message m; -@@ -180,22 +180,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len) - if (!g_spi) - return -ENODEV; - -- if (addr & 1) { -+ if (addr & 3) { - dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len); - return -EACCES; - } - -- if (len & 1) -- len_with_pad = len + 1; -- - memset(&t, 0, sizeof(t)); - t.tx_buf = buf; - t.speed_hz = RT5677_SPI_FREQ; - spi_message_init_with_transfers(&m, &t, 1); - -- for (offset = 0; offset < len_with_pad;) { -+ for (offset = 0; offset < len;) { - spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7, -- len_with_pad - offset, &t.len); -+ len - offset, &t.len); - - /* Construct SPI message header */ - buf[0] = spi_cmd; -diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c -index 2ccb8bccc9d4..512ec25c9ead 100644 ---- a/sound/soc/davinci/davinci-mcasp.c -+++ b/sound/soc/davinci/davinci-mcasp.c -@@ -43,6 +43,7 @@ - - #define MCASP_MAX_AFIFO_DEPTH 64 - -+#ifdef CONFIG_PM - static u32 context_regs[] = { - DAVINCI_MCASP_TXFMCTL_REG, - DAVINCI_MCASP_RXFMCTL_REG, -@@ -65,6 +66,7 @@ struct davinci_mcasp_context { - u32 *xrsr_regs; /* for serializer configuration */ - bool pm_state; - }; -+#endif - - struct davinci_mcasp_ruledata { - struct davinci_mcasp *mcasp; -diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig -index 3066e068aae5..d420995ed45b 100644 ---- a/sound/soc/fsl/Kconfig -+++ b/sound/soc/fsl/Kconfig -@@ -171,16 +171,17 @@ config SND_MPC52xx_SOC_EFIKA - - endif # SND_POWERPC_SOC - -+config SND_SOC_IMX_PCM_FIQ -+ tristate -+ default y if SND_SOC_IMX_SSI=y && (SND_SOC_FSL_SSI=m || SND_SOC_FSL_SPDIF=m) && (MXC_TZIC || MXC_AVIC) -+ select FIQ -+ - if SND_IMX_SOC - - config SND_SOC_IMX_SSI - tristate - select SND_SOC_FSL_UTILS - --config SND_SOC_IMX_PCM_FIQ -- tristate -- select FIQ -- - comment "SoC Audio support for Freescale i.MX boards:" - - config SND_MXC_SOC_WM1133_EV1 -diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c -index 883087f2b092..38132143b7d5 100644 ---- a/sound/soc/fsl/eukrea-tlv320.c -+++ b/sound/soc/fsl/eukrea-tlv320.c -@@ -119,13 +119,13 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) - if (ret) { - dev_err(&pdev->dev, - "fsl,mux-int-port node missing or invalid.\n"); -- return ret; -+ goto err; - } - ret = of_property_read_u32(np, "fsl,mux-ext-port", &ext_port); - if (ret) { - dev_err(&pdev->dev, - "fsl,mux-ext-port node missing or invalid.\n"); -- return ret; -+ goto err; - } - - /* -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index 08b460ba06ef..61d2d955f26a 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -260,12 +260,14 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, - case SND_SOC_DAIFMT_CBS_CFS: - val_cr2 |= FSL_SAI_CR2_BCD_MSTR; - val_cr4 |= FSL_SAI_CR4_FSD_MSTR; -+ sai->is_slave_mode = false; - break; - case SND_SOC_DAIFMT_CBM_CFM: - sai->is_slave_mode = true; - break; - case SND_SOC_DAIFMT_CBS_CFM: - val_cr2 |= FSL_SAI_CR2_BCD_MSTR; -+ sai->is_slave_mode = false; - break; - case SND_SOC_DAIFMT_CBM_CFS: - val_cr4 |= FSL_SAI_CR4_FSD_MSTR; -diff --git a/sound/soc/fsl/fsl_utils.c b/sound/soc/fsl/fsl_utils.c -index b9e42b503a37..4f8bdb7650e8 100644 ---- a/sound/soc/fsl/fsl_utils.c -+++ b/sound/soc/fsl/fsl_utils.c -@@ -75,6 +75,7 @@ int fsl_asoc_get_dma_channel(struct device_node *ssi_np, - iprop = of_get_property(dma_np, "cell-index", NULL); - if (!iprop) { - of_node_put(dma_np); -+ of_node_put(dma_channel_np); - return -EINVAL; - } - *dma_id = be32_to_cpup(iprop); -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index f7eb0d2f797b..1f7eb3816cd7 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -2112,6 +2112,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, - kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval); - if (! kctl) { - usb_audio_err(state->chip, "cannot malloc kcontrol\n"); -+ for (i = 0; i < desc->bNrInPins; i++) -+ kfree(namelist[i]); - kfree(namelist); - kfree(cval); - return -ENOMEM; -diff --git a/tools/include/linux/bitops.h b/tools/include/linux/bitops.h -index 5ad9ee1dd7f6..57187d6790c1 100644 ---- a/tools/include/linux/bitops.h -+++ b/tools/include/linux/bitops.h -@@ -3,17 +3,14 @@ - - #include - #include --#include -- - #ifndef __WORDSIZE - #define __WORDSIZE (__SIZEOF_LONG__ * 8) - #endif - - #define BITS_PER_LONG __WORDSIZE -+#include -+#include - --#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG)) --#define BIT_WORD(nr) ((nr) / BITS_PER_LONG) --#define BITS_PER_BYTE 8 - #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long)) - #define BITS_TO_U64(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(u64)) - #define BITS_TO_U32(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(u32)) -diff --git a/tools/include/linux/bits.h b/tools/include/linux/bits.h -new file mode 100644 -index 000000000000..2b7b532c1d51 ---- /dev/null -+++ b/tools/include/linux/bits.h -@@ -0,0 +1,26 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+#ifndef __LINUX_BITS_H -+#define __LINUX_BITS_H -+#include -+ -+#define BIT(nr) (1UL << (nr)) -+#define BIT_ULL(nr) (1ULL << (nr)) -+#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG)) -+#define BIT_WORD(nr) ((nr) / BITS_PER_LONG) -+#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG)) -+#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG) -+#define BITS_PER_BYTE 8 -+ -+/* -+ * Create a contiguous bitmask starting at bit position @l and ending at -+ * position @h. For example -+ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000. -+ */ -+#define GENMASK(h, l) \ -+ (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h)))) -+ -+#define GENMASK_ULL(h, l) \ -+ (((~0ULL) - (1ULL << (l)) + 1) & \ -+ (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h)))) -+ -+#endif /* __LINUX_BITS_H */ -diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c -index 73d192f57dc3..df41deed0320 100644 ---- a/tools/perf/bench/numa.c -+++ b/tools/perf/bench/numa.c -@@ -32,6 +32,10 @@ - #include - #include - -+#ifndef RUSAGE_THREAD -+# define RUSAGE_THREAD 1 -+#endif -+ - /* - * Regular printout to the terminal, supressed if -q is specified: - */ -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index 62b38f2ff60d..c1944765533c 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -58,6 +58,7 @@ enum intel_pt_pkt_state { - INTEL_PT_STATE_NO_IP, - INTEL_PT_STATE_ERR_RESYNC, - INTEL_PT_STATE_IN_SYNC, -+ INTEL_PT_STATE_TNT_CONT, - INTEL_PT_STATE_TNT, - INTEL_PT_STATE_TIP, - INTEL_PT_STATE_TIP_PGD, -@@ -72,8 +73,9 @@ static inline bool intel_pt_sample_time(enum intel_pt_pkt_state pkt_state) - case INTEL_PT_STATE_NO_IP: - case INTEL_PT_STATE_ERR_RESYNC: - case INTEL_PT_STATE_IN_SYNC: -- case INTEL_PT_STATE_TNT: -+ case INTEL_PT_STATE_TNT_CONT: - return true; -+ case INTEL_PT_STATE_TNT: - case INTEL_PT_STATE_TIP: - case INTEL_PT_STATE_TIP_PGD: - case INTEL_PT_STATE_FUP: -@@ -854,16 +856,20 @@ static uint64_t intel_pt_next_period(struct intel_pt_decoder *decoder) - timestamp = decoder->timestamp + decoder->timestamp_insn_cnt; - masked_timestamp = timestamp & decoder->period_mask; - if (decoder->continuous_period) { -- if (masked_timestamp != decoder->last_masked_timestamp) -+ if (masked_timestamp > decoder->last_masked_timestamp) - return 1; - } else { - timestamp += 1; - masked_timestamp = timestamp & decoder->period_mask; -- if (masked_timestamp != decoder->last_masked_timestamp) { -+ if (masked_timestamp > decoder->last_masked_timestamp) { - decoder->last_masked_timestamp = masked_timestamp; - decoder->continuous_period = true; - } - } -+ -+ if (masked_timestamp < decoder->last_masked_timestamp) -+ return decoder->period_ticks; -+ - return decoder->period_ticks - (timestamp - masked_timestamp); - } - -@@ -892,7 +898,10 @@ static void intel_pt_sample_insn(struct intel_pt_decoder *decoder) - case INTEL_PT_PERIOD_TICKS: - timestamp = decoder->timestamp + decoder->timestamp_insn_cnt; - masked_timestamp = timestamp & decoder->period_mask; -- decoder->last_masked_timestamp = masked_timestamp; -+ if (masked_timestamp > decoder->last_masked_timestamp) -+ decoder->last_masked_timestamp = masked_timestamp; -+ else -+ decoder->last_masked_timestamp += decoder->period_ticks; - break; - case INTEL_PT_PERIOD_NONE: - case INTEL_PT_PERIOD_MTC: -@@ -1141,7 +1150,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder) - return -ENOENT; - } - decoder->tnt.count -= 1; -- if (!decoder->tnt.count) -+ if (decoder->tnt.count) -+ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT; -+ else - decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; - decoder->tnt.payload <<= 1; - decoder->state.from_ip = decoder->ip; -@@ -1172,7 +1183,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder) - - if (intel_pt_insn.branch == INTEL_PT_BR_CONDITIONAL) { - decoder->tnt.count -= 1; -- if (!decoder->tnt.count) -+ if (decoder->tnt.count) -+ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT; -+ else - decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; - if (decoder->tnt.payload & BIT63) { - decoder->tnt.payload <<= 1; -@@ -1192,8 +1205,11 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder) - return 0; - } - decoder->ip += intel_pt_insn.length; -- if (!decoder->tnt.count) -+ if (!decoder->tnt.count) { -+ decoder->sample_timestamp = decoder->timestamp; -+ decoder->sample_insn_cnt = decoder->timestamp_insn_cnt; - return -EAGAIN; -+ } - decoder->tnt.payload <<= 1; - continue; - } -@@ -2116,6 +2132,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) - err = intel_pt_walk_trace(decoder); - break; - case INTEL_PT_STATE_TNT: -+ case INTEL_PT_STATE_TNT_CONT: - err = intel_pt_walk_tnt(decoder); - if (err == -EAGAIN) - err = intel_pt_walk_trace(decoder); -diff --git a/tools/perf/util/string.c b/tools/perf/util/string.c -index accb7ece1d3c..3d7af024c73f 100644 ---- a/tools/perf/util/string.c -+++ b/tools/perf/util/string.c -@@ -1,4 +1,5 @@ - #include "util.h" -+#include - #include "linux/string.h" - - #define K 1024LL -diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h -index dcc659017976..ee5d1dfe13da 100644 ---- a/tools/perf/util/util.h -+++ b/tools/perf/util/util.h -@@ -76,7 +76,6 @@ - #include - #include - #include --#include - #include - - extern const char *graph_line; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.181-182.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.181-182.patch deleted file mode 100644 index 71d7fee47994..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.181-182.patch +++ /dev/null @@ -1,251 +0,0 @@ -diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt -index 709d24b4b533..21ad4f3cece8 100644 ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -220,6 +220,14 @@ tcp_base_mss - INTEGER - Path MTU discovery (MTU probing). If MTU probing is enabled, - this is the initial MSS used by the connection. - -+tcp_min_snd_mss - INTEGER -+ TCP SYN and SYNACK messages usually advertise an ADVMSS option, -+ as described in RFC 1122 and RFC 6691. -+ If this ADVMSS option is smaller than tcp_min_snd_mss, -+ it is silently capped to tcp_min_snd_mss. -+ -+ Default : 48 (at least 8 bytes of payload per segment) -+ - tcp_congestion_control - STRING - Set the congestion control algorithm to be used for new - connections. The algorithm "reno" is always available, but -diff --git a/Makefile b/Makefile -index b33f3ecf84fc..fcfede5e39de 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 181 -+SUBLEVEL = 182 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index 747404dbe506..085da1707cea 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -419,4 +419,7 @@ static inline void tcp_saved_syn_free(struct tcp_sock *tp) - tp->saved_syn = NULL; - } - -+int tcp_skb_shift(struct sk_buff *to, struct sk_buff *from, int pcount, -+ int shiftlen); -+ - #endif /* _LINUX_TCP_H */ -diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h -index c68926b4899c..61c38f87ea07 100644 ---- a/include/net/netns/ipv4.h -+++ b/include/net/netns/ipv4.h -@@ -88,6 +88,7 @@ struct netns_ipv4 { - int sysctl_tcp_fwmark_accept; - int sysctl_tcp_mtu_probing; - int sysctl_tcp_base_mss; -+ int sysctl_tcp_min_snd_mss; - int sysctl_tcp_probe_threshold; - u32 sysctl_tcp_probe_interval; - -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 14ec97309581..bf8a0dae977a 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -54,6 +54,8 @@ void tcp_time_wait(struct sock *sk, int state, int timeo); - - #define MAX_TCP_HEADER (128 + MAX_HEADER) - #define MAX_TCP_OPTION_SPACE 40 -+#define TCP_MIN_SND_MSS 48 -+#define TCP_MIN_GSO_SIZE (TCP_MIN_SND_MSS - MAX_TCP_OPTION_SPACE) - - /* - * Never offer a window over 32767 without using window scaling. Some -diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h -index 9de808ebce05..422183f396d5 100644 ---- a/include/uapi/linux/snmp.h -+++ b/include/uapi/linux/snmp.h -@@ -281,6 +281,7 @@ enum - LINUX_MIB_TCPKEEPALIVE, /* TCPKeepAlive */ - LINUX_MIB_TCPMTUPFAIL, /* TCPMTUPFail */ - LINUX_MIB_TCPMTUPSUCCESS, /* TCPMTUPSuccess */ -+ LINUX_MIB_TCPWQUEUETOOBIG, /* TCPWqueueTooBig */ - __LINUX_MIB_MAX - }; - -diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c -index b001ad668108..555586fc7840 100644 ---- a/net/ipv4/proc.c -+++ b/net/ipv4/proc.c -@@ -303,6 +303,7 @@ static const struct snmp_mib snmp4_net_list[] = { - SNMP_MIB_ITEM("TCPKeepAlive", LINUX_MIB_TCPKEEPALIVE), - SNMP_MIB_ITEM("TCPMTUPFail", LINUX_MIB_TCPMTUPFAIL), - SNMP_MIB_ITEM("TCPMTUPSuccess", LINUX_MIB_TCPMTUPSUCCESS), -+ SNMP_MIB_ITEM("TCPWqueueTooBig", LINUX_MIB_TCPWQUEUETOOBIG), - SNMP_MIB_SENTINEL - }; - -diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c -index 167ca0fddf9e..6413e36d639d 100644 ---- a/net/ipv4/sysctl_net_ipv4.c -+++ b/net/ipv4/sysctl_net_ipv4.c -@@ -36,6 +36,8 @@ static int ip_local_port_range_min[] = { 1, 1 }; - static int ip_local_port_range_max[] = { 65535, 65535 }; - static int tcp_adv_win_scale_min = -31; - static int tcp_adv_win_scale_max = 31; -+static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; -+static int tcp_min_snd_mss_max = 65535; - static int ip_ttl_min = 1; - static int ip_ttl_max = 255; - static int tcp_syn_retries_min = 1; -@@ -941,6 +943,15 @@ static struct ctl_table ipv4_net_table[] = { - .mode = 0644, - .proc_handler = proc_dointvec, - }, -+ { -+ .procname = "tcp_min_snd_mss", -+ .data = &init_net.ipv4.sysctl_tcp_min_snd_mss, -+ .maxlen = sizeof(int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &tcp_min_snd_mss_min, -+ .extra2 = &tcp_min_snd_mss_max, -+ }, - { - .procname = "tcp_probe_threshold", - .data = &init_net.ipv4.sysctl_tcp_probe_threshold, -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index f3a4d2dcbf7a..303be2b76855 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3144,6 +3144,7 @@ void __init tcp_init(void) - int max_rshare, max_wshare, cnt; - unsigned int i; - -+ BUILD_BUG_ON(TCP_MIN_SND_MSS <= MAX_TCP_OPTION_SPACE); - sock_skb_cb_check_size(sizeof(struct tcp_skb_cb)); - - percpu_counter_init(&tcp_sockets_allocated, 0, GFP_KERNEL); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 44a3aa7a41e2..30c5500b0899 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1275,7 +1275,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, - TCP_SKB_CB(skb)->seq += shifted; - - tcp_skb_pcount_add(prev, pcount); -- BUG_ON(tcp_skb_pcount(skb) < pcount); -+ WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount); - tcp_skb_pcount_add(skb, -pcount); - - /* When we're adding to gso_segs == 1, gso_size will be zero, -@@ -1337,6 +1337,21 @@ static int skb_can_shift(const struct sk_buff *skb) - return !skb_headlen(skb) && skb_is_nonlinear(skb); - } - -+int tcp_skb_shift(struct sk_buff *to, struct sk_buff *from, -+ int pcount, int shiftlen) -+{ -+ /* TCP min gso_size is 8 bytes (TCP_MIN_GSO_SIZE) -+ * Since TCP_SKB_CB(skb)->tcp_gso_segs is 16 bits, we need -+ * to make sure not storing more than 65535 * 8 bytes per skb, -+ * even if current MSS is bigger. -+ */ -+ if (unlikely(to->len + shiftlen >= 65535 * TCP_MIN_GSO_SIZE)) -+ return 0; -+ if (unlikely(tcp_skb_pcount(to) + pcount > 65535)) -+ return 0; -+ return skb_shift(to, from, shiftlen); -+} -+ - /* Try collapsing SACK blocks spanning across multiple skbs to a single - * skb. - */ -@@ -1348,6 +1363,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb, - struct tcp_sock *tp = tcp_sk(sk); - struct sk_buff *prev; - int mss; -+ int next_pcount; - int pcount = 0; - int len; - int in_sack; -@@ -1442,7 +1458,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb, - if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una)) - goto fallback; - -- if (!skb_shift(prev, skb, len)) -+ if (!tcp_skb_shift(prev, skb, pcount, len)) - goto fallback; - if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack)) - goto out; -@@ -1461,11 +1477,11 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb, - goto out; - - len = skb->len; -- if (skb_shift(prev, skb, len)) { -- pcount += tcp_skb_pcount(skb); -- tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0); -+ next_pcount = tcp_skb_pcount(skb); -+ if (tcp_skb_shift(prev, skb, next_pcount, len)) { -+ pcount += next_pcount; -+ tcp_shifted_skb(sk, skb, state, next_pcount, len, mss, 0); - } -- - out: - state->fack_count += pcount; - return prev; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index b3d6b8e77300..744afb4fbf84 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -2419,6 +2419,7 @@ static int __net_init tcp_sk_init(struct net *net) - net->ipv4.sysctl_tcp_ecn_fallback = 1; - - net->ipv4.sysctl_tcp_base_mss = TCP_BASE_MSS; -+ net->ipv4.sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS; - net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD; - net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL; - -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index b55b8954dae5..bed83990847a 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1161,6 +1161,11 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, - if (nsize < 0) - nsize = 0; - -+ if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) { -+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG); -+ return -ENOMEM; -+ } -+ - if (skb_unclone(skb, gfp)) - return -ENOMEM; - -@@ -1327,8 +1332,7 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu) - mss_now -= icsk->icsk_ext_hdr_len; - - /* Then reserve room for full set of TCP options and 8 bytes of data */ -- if (mss_now < 48) -- mss_now = 48; -+ mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss); - return mss_now; - } - -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index 35f638cfc675..61359944acc7 100644 ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -132,6 +132,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) - mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1; - mss = min(net->ipv4.sysctl_tcp_base_mss, mss); - mss = max(mss, 68 - tp->tcp_header_len); -+ mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss); - icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss); - tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.182-183.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.182-183.patch deleted file mode 100644 index e578fa5e2837..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.182-183.patch +++ /dev/null @@ -1,2186 +0,0 @@ -diff --git a/Makefile b/Makefile -index fcfede5e39de..4ac762e01e60 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 182 -+SUBLEVEL = 183 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts -index 4ecef6981d5c..b54c0b8a5b34 100644 ---- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts -+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts -@@ -97,6 +97,7 @@ - regulator-name = "PVDD_APIO_1V8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -+ regulator-always-on; - }; - - ldo3_reg: LDO3 { -@@ -135,6 +136,7 @@ - regulator-name = "PVDD_ABB_1V8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; -+ regulator-always-on; - }; - - ldo9_reg: LDO9 { -diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi -index e6af41c4bbc1..3992b8ea1c48 100644 ---- a/arch/arm/boot/dts/imx6qdl.dtsi -+++ b/arch/arm/boot/dts/imx6qdl.dtsi -@@ -853,7 +853,7 @@ - compatible = "fsl,imx6q-sdma", "fsl,imx35-sdma"; - reg = <0x020ec000 0x4000>; - interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>; -- clocks = <&clks IMX6QDL_CLK_SDMA>, -+ clocks = <&clks IMX6QDL_CLK_IPG>, - <&clks IMX6QDL_CLK_SDMA>; - clock-names = "ipg", "ahb"; - #dma-cells = <3>; -diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi -index d8ba99f1d87b..ac820dfef977 100644 ---- a/arch/arm/boot/dts/imx6sl.dtsi -+++ b/arch/arm/boot/dts/imx6sl.dtsi -@@ -657,7 +657,7 @@ - reg = <0x020ec000 0x4000>; - interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clks IMX6SL_CLK_SDMA>, -- <&clks IMX6SL_CLK_SDMA>; -+ <&clks IMX6SL_CLK_AHB>; - clock-names = "ipg", "ahb"; - #dma-cells = <3>; - /* imx6sl reuses imx6q sdma firmware */ -diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi -index 6963dff815dc..5783eb8541ed 100644 ---- a/arch/arm/boot/dts/imx6sx.dtsi -+++ b/arch/arm/boot/dts/imx6sx.dtsi -@@ -732,7 +732,7 @@ - compatible = "fsl,imx6sx-sdma", "fsl,imx6q-sdma"; - reg = <0x020ec000 0x4000>; - interrupts = ; -- clocks = <&clks IMX6SX_CLK_SDMA>, -+ clocks = <&clks IMX6SX_CLK_IPG>, - <&clks IMX6SX_CLK_SDMA>; - clock-names = "ipg", "ahb"; - #dma-cells = <3>; -diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c -index a003833ac112..013f4d55ede8 100644 ---- a/arch/arm/mach-exynos/suspend.c -+++ b/arch/arm/mach-exynos/suspend.c -@@ -508,8 +508,27 @@ early_wakeup: - - static void exynos5420_prepare_pm_resume(void) - { -+ unsigned int mpidr, cluster; -+ -+ mpidr = read_cpuid_mpidr(); -+ cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1); -+ - if (IS_ENABLED(CONFIG_EXYNOS5420_MCPM)) - WARN_ON(mcpm_cpu_powered_up()); -+ -+ if (IS_ENABLED(CONFIG_HW_PERF_EVENTS) && cluster != 0) { -+ /* -+ * When system is resumed on the LITTLE/KFC core (cluster 1), -+ * the DSCR is not properly updated until the power is turned -+ * on also for the cluster 0. Enable it for a while to -+ * propagate the SPNIDEN and SPIDEN signals from Secure JTAG -+ * block and avoid undefined instruction issue on CP14 reset. -+ */ -+ pmu_raw_writel(S5P_CORE_LOCAL_PWR_EN, -+ EXYNOS_COMMON_CONFIGURATION(0)); -+ pmu_raw_writel(0, -+ EXYNOS_COMMON_CONFIGURATION(0)); -+ } - } - - static void exynos5420_pm_resume(void) -diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c -index aa19b7ac8222..476c7b4be378 100644 ---- a/arch/ia64/mm/numa.c -+++ b/arch/ia64/mm/numa.c -@@ -49,6 +49,7 @@ paddr_to_nid(unsigned long paddr) - - return (i < num_node_memblks) ? node_memblk[i].nid : (num_node_memblks ? -1 : 0); - } -+EXPORT_SYMBOL(paddr_to_nid); - - #if defined(CONFIG_SPARSEMEM) && defined(CONFIG_NUMA) - /* -diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h -index a92d95aee42d..1883627eb12c 100644 ---- a/arch/powerpc/include/asm/kvm_host.h -+++ b/arch/powerpc/include/asm/kvm_host.h -@@ -250,6 +250,7 @@ struct kvm_arch { - #ifdef CONFIG_PPC_BOOK3S_64 - struct list_head spapr_tce_tables; - struct list_head rtas_tokens; -+ struct mutex rtas_token_lock; - DECLARE_BITMAP(enabled_hcalls, MAX_HCALL_OPCODE/4 + 1); - #endif - #ifdef CONFIG_KVM_MPIC -diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c -index 099c79d8c160..4aab1c9c83e1 100644 ---- a/arch/powerpc/kvm/book3s.c -+++ b/arch/powerpc/kvm/book3s.c -@@ -809,6 +809,7 @@ int kvmppc_core_init_vm(struct kvm *kvm) - #ifdef CONFIG_PPC64 - INIT_LIST_HEAD(&kvm->arch.spapr_tce_tables); - INIT_LIST_HEAD(&kvm->arch.rtas_tokens); -+ mutex_init(&kvm->arch.rtas_token_lock); - #endif - - return kvm->arch.kvm_ops->init_vm(kvm); -diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c -index ef27fbd5d9c5..b1b2273d1f6d 100644 ---- a/arch/powerpc/kvm/book3s_rtas.c -+++ b/arch/powerpc/kvm/book3s_rtas.c -@@ -133,7 +133,7 @@ static int rtas_token_undefine(struct kvm *kvm, char *name) - { - struct rtas_token_definition *d, *tmp; - -- lockdep_assert_held(&kvm->lock); -+ lockdep_assert_held(&kvm->arch.rtas_token_lock); - - list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) { - if (rtas_name_matches(d->handler->name, name)) { -@@ -154,7 +154,7 @@ static int rtas_token_define(struct kvm *kvm, char *name, u64 token) - bool found; - int i; - -- lockdep_assert_held(&kvm->lock); -+ lockdep_assert_held(&kvm->arch.rtas_token_lock); - - list_for_each_entry(d, &kvm->arch.rtas_tokens, list) { - if (d->token == token) -@@ -193,14 +193,14 @@ int kvm_vm_ioctl_rtas_define_token(struct kvm *kvm, void __user *argp) - if (copy_from_user(&args, argp, sizeof(args))) - return -EFAULT; - -- mutex_lock(&kvm->lock); -+ mutex_lock(&kvm->arch.rtas_token_lock); - - if (args.token) - rc = rtas_token_define(kvm, args.name, args.token); - else - rc = rtas_token_undefine(kvm, args.name); - -- mutex_unlock(&kvm->lock); -+ mutex_unlock(&kvm->arch.rtas_token_lock); - - return rc; - } -@@ -232,7 +232,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu) - orig_rets = args.rets; - args.rets = &args.args[be32_to_cpu(args.nargs)]; - -- mutex_lock(&vcpu->kvm->lock); -+ mutex_lock(&vcpu->kvm->arch.rtas_token_lock); - - rc = -ENOENT; - list_for_each_entry(d, &vcpu->kvm->arch.rtas_tokens, list) { -@@ -243,7 +243,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu) - } - } - -- mutex_unlock(&vcpu->kvm->lock); -+ mutex_unlock(&vcpu->kvm->arch.rtas_token_lock); - - if (rc == 0) { - args.rets = orig_rets; -@@ -269,8 +269,6 @@ void kvmppc_rtas_tokens_free(struct kvm *kvm) - { - struct rtas_token_definition *d, *tmp; - -- lockdep_assert_held(&kvm->lock); -- - list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) { - list_del(&d->list); - kfree(d); -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 5ddb1debba95..23911ecfbad6 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -2721,21 +2721,28 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, - const struct kvm_memory_slot *new, - enum kvm_mr_change change) - { -- int rc; -- -- /* If the basics of the memslot do not change, we do not want -- * to update the gmap. Every update causes several unnecessary -- * segment translation exceptions. This is usually handled just -- * fine by the normal fault handler + gmap, but it will also -- * cause faults on the prefix page of running guest CPUs. -- */ -- if (old->userspace_addr == mem->userspace_addr && -- old->base_gfn * PAGE_SIZE == mem->guest_phys_addr && -- old->npages * PAGE_SIZE == mem->memory_size) -- return; -+ int rc = 0; - -- rc = gmap_map_segment(kvm->arch.gmap, mem->userspace_addr, -- mem->guest_phys_addr, mem->memory_size); -+ switch (change) { -+ case KVM_MR_DELETE: -+ rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE, -+ old->npages * PAGE_SIZE); -+ break; -+ case KVM_MR_MOVE: -+ rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE, -+ old->npages * PAGE_SIZE); -+ if (rc) -+ break; -+ /* FALLTHROUGH */ -+ case KVM_MR_CREATE: -+ rc = gmap_map_segment(kvm->arch.gmap, mem->userspace_addr, -+ mem->guest_phys_addr, mem->memory_size); -+ break; -+ case KVM_MR_FLAGS_ONLY: -+ break; -+ default: -+ WARN(1, "Unknown KVM MR CHANGE: %d\n", change); -+ } - if (rc) - pr_warn("failed to commit memory region\n"); - return; -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index e94e6f16172b..6f2483292de0 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -717,8 +717,11 @@ static void init_amd_zn(struct cpuinfo_x86 *c) - { - set_cpu_cap(c, X86_FEATURE_ZEN); - -- /* Fix erratum 1076: CPB feature bit not being set in CPUID. */ -- if (!cpu_has(c, X86_FEATURE_CPB)) -+ /* -+ * Fix erratum 1076: CPB feature bit not being set in CPUID. -+ * Always set it, except when running under a hypervisor. -+ */ -+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_CPB)) - set_cpu_cap(c, X86_FEATURE_CPB); - } - -diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c -index 23a7c7ba377a..8fc07ea23344 100644 ---- a/arch/x86/kvm/pmu_intel.c -+++ b/arch/x86/kvm/pmu_intel.c -@@ -235,11 +235,14 @@ static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - } - break; - default: -- if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0)) || -- (pmc = get_fixed_pmc(pmu, msr))) { -- if (!msr_info->host_initiated) -- data = (s64)(s32)data; -- pmc->counter += data - pmc_read_counter(pmc); -+ if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) { -+ if (msr_info->host_initiated) -+ pmc->counter = data; -+ else -+ pmc->counter = (s32)data; -+ return 0; -+ } else if ((pmc = get_fixed_pmc(pmu, msr))) { -+ pmc->counter = data; - return 0; - } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) { - if (data == pmc->eventsel) -diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c -index 9bd115484745..5f0e596b0519 100644 ---- a/arch/x86/pci/irq.c -+++ b/arch/x86/pci/irq.c -@@ -1117,6 +1117,8 @@ static struct dmi_system_id __initdata pciirq_dmi_table[] = { - - void __init pcibios_irq_init(void) - { -+ struct irq_routing_table *rtable = NULL; -+ - DBG(KERN_DEBUG "PCI: IRQ init\n"); - - if (raw_pci_ops == NULL) -@@ -1127,8 +1129,10 @@ void __init pcibios_irq_init(void) - pirq_table = pirq_find_routing_table(); - - #ifdef CONFIG_PCI_BIOS -- if (!pirq_table && (pci_probe & PCI_BIOS_IRQ_SCAN)) -+ if (!pirq_table && (pci_probe & PCI_BIOS_IRQ_SCAN)) { - pirq_table = pcibios_get_irq_routing_table(); -+ rtable = pirq_table; -+ } - #endif - if (pirq_table) { - pirq_peer_trick(); -@@ -1143,8 +1147,10 @@ void __init pcibios_irq_init(void) - * If we're using the I/O APIC, avoid using the PCI IRQ - * routing table - */ -- if (io_apic_assign_pci_irqs) -+ if (io_apic_assign_pci_irqs) { -+ kfree(rtable); - pirq_table = NULL; -+ } - } - - x86_init.pci.fixup_irqs(); -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index d543172b20b3..a352f09baef6 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4176,9 +4176,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | - ATA_HORKAGE_FIRMWARE_WARN }, - -- /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ -- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, -- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, -+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) -+ the ST disks also have LPM issues */ -+ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA | -+ ATA_HORKAGE_NOLPM, }, -+ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA | -+ ATA_HORKAGE_NOLPM, }, - { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, - - /* Blacklist entries taken from Silicon Image 3124/3132 -diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c -index 9040878e3e2b..a6cda84b67da 100644 ---- a/drivers/clk/rockchip/clk-rk3288.c -+++ b/drivers/clk/rockchip/clk-rk3288.c -@@ -797,6 +797,9 @@ static const int rk3288_saved_cru_reg_ids[] = { - RK3288_CLKSEL_CON(10), - RK3288_CLKSEL_CON(33), - RK3288_CLKSEL_CON(37), -+ -+ /* We turn aclk_dmac1 on for suspend; this will restore it */ -+ RK3288_CLKGATE_CON(10), - }; - - static u32 rk3288_saved_cru_regs[ARRAY_SIZE(rk3288_saved_cru_reg_ids)]; -@@ -812,6 +815,14 @@ static int rk3288_clk_suspend(void) - readl_relaxed(rk3288_cru_base + reg_id); - } - -+ /* -+ * Going into deep sleep (specifically setting PMU_CLR_DMA in -+ * RK3288_PMU_PWRMODE_CON1) appears to fail unless -+ * "aclk_dmac1" is on. -+ */ -+ writel_relaxed(1 << (12 + 16), -+ rk3288_cru_base + RK3288_CLKGATE_CON(10)); -+ - /* - * Switch PLLs other than DPLL (for SDRAM) to slow mode to - * avoid crashes on resume. The Mask ROM on the system will -diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c -index e3b8bebfdd30..4afca3968773 100644 ---- a/drivers/crypto/amcc/crypto4xx_alg.c -+++ b/drivers/crypto/amcc/crypto4xx_alg.c -@@ -138,8 +138,7 @@ static int crypto4xx_setkey_aes(struct crypto_ablkcipher *cipher, - sa = (struct dynamic_sa_ctl *) ctx->sa_in; - ctx->hash_final = 0; - -- set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ? -- SA_SAVE_IV : SA_NOT_SAVE_IV), -+ set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV, - SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE, - SA_NO_HEADER_PROC, SA_HASH_ALG_NULL, - SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO, -diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c -index 1e810f5f03fa..78d0722feacb 100644 ---- a/drivers/crypto/amcc/crypto4xx_core.c -+++ b/drivers/crypto/amcc/crypto4xx_core.c -@@ -645,15 +645,6 @@ static u32 crypto4xx_ablkcipher_done(struct crypto4xx_device *dev, - addr = dma_map_page(dev->core_dev->device, sg_page(dst), - dst->offset, dst->length, DMA_FROM_DEVICE); - } -- -- if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { -- struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); -- -- crypto4xx_memcpy_from_le32((u32 *)req->iv, -- pd_uinfo->sr_va->save_iv, -- crypto_skcipher_ivsize(skcipher)); -- } -- - crypto4xx_ret_sg_desc(dev, pd_uinfo); - if (ablk_req->base.complete != NULL) - ablk_req->base.complete(&ablk_req->base, 0); -diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c -index 7d56b47e4fcf..25e25b64bc89 100644 ---- a/drivers/dma/idma64.c -+++ b/drivers/dma/idma64.c -@@ -594,7 +594,7 @@ static int idma64_probe(struct idma64_chip *chip) - idma64->dma.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); - idma64->dma.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST; - -- idma64->dma.dev = chip->dev; -+ idma64->dma.dev = chip->sysdev; - - ret = dma_async_device_register(&idma64->dma); - if (ret) -@@ -632,6 +632,7 @@ static int idma64_platform_probe(struct platform_device *pdev) - { - struct idma64_chip *chip; - struct device *dev = &pdev->dev; -+ struct device *sysdev = dev->parent; - struct resource *mem; - int ret; - -@@ -648,11 +649,12 @@ static int idma64_platform_probe(struct platform_device *pdev) - if (IS_ERR(chip->regs)) - return PTR_ERR(chip->regs); - -- ret = dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); -+ ret = dma_coerce_mask_and_coherent(sysdev, DMA_BIT_MASK(64)); - if (ret) - return ret; - - chip->dev = dev; -+ chip->sysdev = sysdev; - - ret = idma64_probe(chip); - if (ret) -diff --git a/drivers/dma/idma64.h b/drivers/dma/idma64.h -index f6aeff0af8a5..e40c69bd1fb5 100644 ---- a/drivers/dma/idma64.h -+++ b/drivers/dma/idma64.h -@@ -215,12 +215,14 @@ static inline void idma64_writel(struct idma64 *idma64, int offset, u32 value) - /** - * struct idma64_chip - representation of iDMA 64-bit controller hardware - * @dev: struct device of the DMA controller -+ * @sysdev: struct device of the physical device that does DMA - * @irq: irq line - * @regs: memory mapped I/O space - * @idma64: struct idma64 that is filed by idma64_probe() - */ - struct idma64_chip { - struct device *dev; -+ struct device *sysdev; - int irq; - void __iomem *regs; - struct idma64 *idma64; -diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig -index 469dc378adeb..aaae6040b4c8 100644 ---- a/drivers/gpio/Kconfig -+++ b/drivers/gpio/Kconfig -@@ -579,6 +579,7 @@ config GPIO_ADP5588 - config GPIO_ADP5588_IRQ - bool "Interrupt controller support for ADP5588" - depends on GPIO_ADP5588=y -+ select GPIOLIB_IRQCHIP - help - Say yes here to enable the adp5588 to be used as an interrupt - controller. It requires the driver to be built in the kernel. -diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c -index 9943273ec981..c8c49b1d5f9f 100644 ---- a/drivers/gpio/gpio-omap.c -+++ b/drivers/gpio/gpio-omap.c -@@ -292,6 +292,22 @@ static void omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned offset) - } - } - -+/* -+ * Off mode wake-up capable GPIOs in bank(s) that are in the wakeup domain. -+ * See TRM section for GPIO for "Wake-Up Generation" for the list of GPIOs -+ * in wakeup domain. If bank->non_wakeup_gpios is not configured, assume none -+ * are capable waking up the system from off mode. -+ */ -+static bool omap_gpio_is_off_wakeup_capable(struct gpio_bank *bank, u32 gpio_mask) -+{ -+ u32 no_wake = bank->non_wakeup_gpios; -+ -+ if (no_wake) -+ return !!(~no_wake & gpio_mask); -+ -+ return false; -+} -+ - static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio, - unsigned trigger) - { -@@ -323,13 +339,7 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio, - } - - /* This part needs to be executed always for OMAP{34xx, 44xx} */ -- if (!bank->regs->irqctrl) { -- /* On omap24xx proceed only when valid GPIO bit is set */ -- if (bank->non_wakeup_gpios) { -- if (!(bank->non_wakeup_gpios & gpio_bit)) -- goto exit; -- } -- -+ if (!bank->regs->irqctrl && !omap_gpio_is_off_wakeup_capable(bank, gpio)) { - /* - * Log the edge gpio and manually trigger the IRQ - * after resume if the input level changes -@@ -342,7 +352,6 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio, - bank->enabled_non_wakeup_gpios &= ~gpio_bit; - } - --exit: - bank->level_mask = - readl_relaxed(bank->base + bank->regs->leveldetect0) | - readl_relaxed(bank->base + bank->regs->leveldetect1); -diff --git a/drivers/gpu/drm/i2c/adv7511.c b/drivers/gpu/drm/i2c/adv7511.c -index c7c243e9b808..4300e27ed113 100644 ---- a/drivers/gpu/drm/i2c/adv7511.c -+++ b/drivers/gpu/drm/i2c/adv7511.c -@@ -781,11 +781,11 @@ static void adv7511_encoder_mode_set(struct drm_encoder *encoder, - vsync_polarity = 1; - } - -- if (mode->vrefresh <= 24000) -+ if (drm_mode_vrefresh(mode) <= 24) - low_refresh_rate = ADV7511_LOW_REFRESH_RATE_24HZ; -- else if (mode->vrefresh <= 25000) -+ else if (drm_mode_vrefresh(mode) <= 25) - low_refresh_rate = ADV7511_LOW_REFRESH_RATE_25HZ; -- else if (mode->vrefresh <= 30000) -+ else if (drm_mode_vrefresh(mode) <= 30) - low_refresh_rate = ADV7511_LOW_REFRESH_RATE_30HZ; - else - low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index ad0dd566aded..8dba10135d53 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -2442,7 +2442,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv, - - cmd = container_of(header, typeof(*cmd), header); - -- if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) { -+ if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX || -+ cmd->body.type < SVGA3D_SHADERTYPE_MIN) { - DRM_ERROR("Illegal shader type %u.\n", - (unsigned) cmd->body.type); - return -EINVAL; -@@ -2681,6 +2682,10 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, - if (view_type == vmw_view_max) - return -EINVAL; - cmd = container_of(header, typeof(*cmd), header); -+ if (unlikely(cmd->sid == SVGA3D_INVALID_ID)) { -+ DRM_ERROR("Invalid surface id.\n"); -+ return -EINVAL; -+ } - ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, - user_surface_converter, - &cmd->sid, &srf_node); -diff --git a/drivers/i2c/busses/i2c-acorn.c b/drivers/i2c/busses/i2c-acorn.c -index 9d7be5af2bf2..6618db75fa25 100644 ---- a/drivers/i2c/busses/i2c-acorn.c -+++ b/drivers/i2c/busses/i2c-acorn.c -@@ -83,6 +83,7 @@ static struct i2c_algo_bit_data ioc_data = { - - static struct i2c_adapter ioc_ops = { - .nr = 0, -+ .name = "ioc", - .algo_data = &ioc_data, - }; - -diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c -index 57e3790c87b1..e56b774e7cf9 100644 ---- a/drivers/i2c/i2c-dev.c -+++ b/drivers/i2c/i2c-dev.c -@@ -295,6 +295,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client, - rdwr_pa[i].buf[0] < 1 || - rdwr_pa[i].len < rdwr_pa[i].buf[0] + - I2C_SMBUS_BLOCK_MAX) { -+ i++; - res = -EINVAL; - break; - } -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 67c4c73343d4..6968154a073e 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -1042,6 +1042,8 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) - * mlx4_ib_vma_close(). - */ - down_write(&owning_mm->mmap_sem); -+ if (!mmget_still_valid(owning_mm)) -+ goto skip_mm; - for (i = 0; i < HW_BAR_COUNT; i++) { - vma = context->hw_bar_info[i].vma; - if (!vma) -@@ -1061,6 +1063,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) - context->hw_bar_info[i].vma->vm_ops = NULL; - } - -+skip_mm: - up_write(&owning_mm->mmap_sem); - mmput(owning_mm); - put_task_struct(owning_process); -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 3e97c4b2ebed..b965561a4162 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -3983,9 +3983,7 @@ static void __init init_no_remapping_devices(void) - - /* This IOMMU has *only* gfx devices. Either bypass it or - set the gfx_mapped flag, as appropriate */ -- if (dmar_map_gfx) { -- intel_iommu_gfx_mapped = 1; -- } else { -+ if (!dmar_map_gfx) { - drhd->ignored = 1; - for_each_active_dev_scope(drhd->devices, - drhd->devices_cnt, i, dev) -@@ -4694,6 +4692,9 @@ int __init intel_iommu_init(void) - goto out_free_reserved_range; - } - -+ if (dmar_map_gfx) -+ intel_iommu_gfx_mapped = 1; -+ - init_no_remapping_devices(); - - ret = init_dmars(); -diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c -index 0d29b5a6356d..8cbb75d09a1d 100644 ---- a/drivers/isdn/mISDN/socket.c -+++ b/drivers/isdn/mISDN/socket.c -@@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - memcpy(di.channelmap, dev->channelmap, - sizeof(di.channelmap)); - di.nrbchan = dev->nrbchan; -- strcpy(di.name, dev_name(&dev->dev)); -+ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); - if (copy_to_user((void __user *)arg, &di, sizeof(di))) - err = -EFAULT; - } else -@@ -678,7 +678,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - memcpy(di.channelmap, dev->channelmap, - sizeof(di.channelmap)); - di.nrbchan = dev->nrbchan; -- strcpy(di.name, dev_name(&dev->dev)); -+ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); - if (copy_to_user((void __user *)arg, &di, sizeof(di))) - err = -EFAULT; - } else -@@ -692,6 +692,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - err = -EFAULT; - break; - } -+ dn.name[sizeof(dn.name) - 1] = '\0'; - dev = get_mdevice(dn.id); - if (dev) - err = device_rename(&dev->dev, dn.name); -diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c -index 646fe85261c1..158eae17031c 100644 ---- a/drivers/md/bcache/bset.c -+++ b/drivers/md/bcache/bset.c -@@ -823,12 +823,22 @@ unsigned bch_btree_insert_key(struct btree_keys *b, struct bkey *k, - struct bset *i = bset_tree_last(b)->data; - struct bkey *m, *prev = NULL; - struct btree_iter iter; -+ struct bkey preceding_key_on_stack = ZERO_KEY; -+ struct bkey *preceding_key_p = &preceding_key_on_stack; - - BUG_ON(b->ops->is_extents && !KEY_SIZE(k)); - -- m = bch_btree_iter_init(b, &iter, b->ops->is_extents -- ? PRECEDING_KEY(&START_KEY(k)) -- : PRECEDING_KEY(k)); -+ /* -+ * If k has preceding key, preceding_key_p will be set to address -+ * of k's preceding key; otherwise preceding_key_p will be set -+ * to NULL inside preceding_key(). -+ */ -+ if (b->ops->is_extents) -+ preceding_key(&START_KEY(k), &preceding_key_p); -+ else -+ preceding_key(k, &preceding_key_p); -+ -+ m = bch_btree_iter_init(b, &iter, preceding_key_p); - - if (b->ops->insert_fixup(b, k, &iter, replace_key)) - return status; -diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h -index ae964624efb2..b935839ab79c 100644 ---- a/drivers/md/bcache/bset.h -+++ b/drivers/md/bcache/bset.h -@@ -417,20 +417,26 @@ static inline bool bch_cut_back(const struct bkey *where, struct bkey *k) - return __bch_cut_back(where, k); - } - --#define PRECEDING_KEY(_k) \ --({ \ -- struct bkey *_ret = NULL; \ -- \ -- if (KEY_INODE(_k) || KEY_OFFSET(_k)) { \ -- _ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0); \ -- \ -- if (!_ret->low) \ -- _ret->high--; \ -- _ret->low--; \ -- } \ -- \ -- _ret; \ --}) -+/* -+ * Pointer '*preceding_key_p' points to a memory object to store preceding -+ * key of k. If the preceding key does not exist, set '*preceding_key_p' to -+ * NULL. So the caller of preceding_key() needs to take care of memory -+ * which '*preceding_key_p' pointed to before calling preceding_key(). -+ * Currently the only caller of preceding_key() is bch_btree_insert_key(), -+ * and it points to an on-stack variable, so the memory release is handled -+ * by stackframe itself. -+ */ -+static inline void preceding_key(struct bkey *k, struct bkey **preceding_key_p) -+{ -+ if (KEY_INODE(k) || KEY_OFFSET(k)) { -+ (**preceding_key_p) = KEY(KEY_INODE(k), KEY_OFFSET(k), 0); -+ if (!(*preceding_key_p)->low) -+ (*preceding_key_p)->high--; -+ (*preceding_key_p)->low--; -+ } else { -+ (*preceding_key_p) = NULL; -+ } -+} - - static inline bool bch_ptr_invalid(struct btree_keys *b, const struct bkey *k) - { -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index ac867489b5a9..498875193386 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -267,6 +267,9 @@ static void intel_lpss_init_dev(const struct intel_lpss *lpss) - { - u32 value = LPSS_PRIV_SSP_REG_DIS_DMA_FIN; - -+ /* Set the device in reset state */ -+ writel(0, lpss->priv + LPSS_PRIV_RESETS); -+ - intel_lpss_deassert_reset(lpss); - - intel_lpss_set_remap_addr(lpss); -diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c -index 72aab60ae846..db8684430f02 100644 ---- a/drivers/mfd/twl6040.c -+++ b/drivers/mfd/twl6040.c -@@ -316,8 +316,19 @@ int twl6040_power(struct twl6040 *twl6040, int on) - } - } - -+ /* -+ * Register access can produce errors after power-up unless we -+ * wait at least 8ms based on measurements on duovero. -+ */ -+ usleep_range(10000, 12000); -+ - /* Sync with the HW */ -- regcache_sync(twl6040->regmap); -+ ret = regcache_sync(twl6040->regmap); -+ if (ret) { -+ dev_err(twl6040->dev, "Failed to sync with the HW: %i\n", -+ ret); -+ goto out; -+ } - - /* Default PLL configuration after power up */ - twl6040->pll = TWL6040_SYSCLK_SEL_LPPLL; -diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c -index 99635dd9dbac..bb3a76ad80da 100644 ---- a/drivers/misc/kgdbts.c -+++ b/drivers/misc/kgdbts.c -@@ -1132,7 +1132,7 @@ static void kgdbts_put_char(u8 chr) - - static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp) - { -- int len = strlen(kmessage); -+ size_t len = strlen(kmessage); - - if (len >= MAX_CONFIG_LEN) { - printk(KERN_ERR "kgdbts: config string too long\n"); -@@ -1152,7 +1152,7 @@ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp) - - strcpy(config, kmessage); - /* Chop out \n char as a result of echo */ -- if (config[len - 1] == '\n') -+ if (len && config[len - 1] == '\n') - config[len - 1] = '\0'; - - /* Go and configure with the new params. */ -diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c -index 3acde3b9b767..7799cf33cc6e 100644 ---- a/drivers/net/ethernet/dec/tulip/de4x5.c -+++ b/drivers/net/ethernet/dec/tulip/de4x5.c -@@ -2106,7 +2106,6 @@ static struct eisa_driver de4x5_eisa_driver = { - .remove = de4x5_eisa_remove, - } - }; --MODULE_DEVICE_TABLE(eisa, de4x5_eisa_ids); - #endif - - #ifdef CONFIG_PCI -diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c -index 734f655c99c1..51bfe74be8d4 100644 ---- a/drivers/net/ethernet/emulex/benet/be_ethtool.c -+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c -@@ -1050,7 +1050,7 @@ static int be_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd, - cmd->data = be_get_rss_hash_opts(adapter, cmd->flow_type); - break; - case ETHTOOL_GRXRINGS: -- cmd->data = adapter->num_rx_qs - 1; -+ cmd->data = adapter->num_rx_qs; - break; - default: - return -EINVAL; -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index afaf79b8761f..2d9f4ed9a65e 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -1408,6 +1408,10 @@ static void sh_eth_dev_exit(struct net_device *ndev) - sh_eth_get_stats(ndev); - sh_eth_reset(ndev); - -+ /* Set the RMII mode again if required */ -+ if (mdp->cd->rmiimode) -+ sh_eth_write(ndev, 0x1, RMIIMODE); -+ - /* Set MAC address again */ - update_mac_address(ndev); - } -diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c -index 01f95d192d25..2b16a5fed9de 100644 ---- a/drivers/net/usb/ipheth.c -+++ b/drivers/net/usb/ipheth.c -@@ -437,17 +437,18 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) - dev); - dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; - -+ netif_stop_queue(net); - retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC); - if (retval) { - dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n", - __func__, retval); - dev->net->stats.tx_errors++; - dev_kfree_skb_any(skb); -+ netif_wake_queue(net); - } else { - dev->net->stats.tx_packets++; - dev->net->stats.tx_bytes += skb->len; - dev_consume_skb_any(skb); -- netif_stop_queue(net); - } - - return NETDEV_TX_OK; -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 6fd4e5a5ef4a..931cc33e46f0 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -789,7 +789,7 @@ static inline void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, - void *buf) - { - u8 *p, *b; -- int i, bit_offset = cell->bit_offset; -+ int i, extra, bit_offset = cell->bit_offset; - - p = b = buf; - if (bit_offset) { -@@ -804,11 +804,16 @@ static inline void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, - p = b; - *b++ >>= bit_offset; - } -- -- /* result fits in less bytes */ -- if (cell->bytes != DIV_ROUND_UP(cell->nbits, BITS_PER_BYTE)) -- *p-- = 0; -+ } else { -+ /* point to the msb */ -+ p += cell->bytes - 1; - } -+ -+ /* result fits in less bytes */ -+ extra = cell->bytes - DIV_ROUND_UP(cell->nbits, BITS_PER_BYTE); -+ while (--extra >= 0) -+ *p-- = 0; -+ - /* clear msb bits if any leftover in the last byte */ - *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); - } -diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c -index 414c33686621..b18cf12731ee 100644 ---- a/drivers/pci/host/pcie-rcar.c -+++ b/drivers/pci/host/pcie-rcar.c -@@ -737,6 +737,10 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie) - - /* setup MSI data target */ - msi->pages = __get_free_pages(GFP_KERNEL, 0); -+ if (!msi->pages) { -+ err = -ENOMEM; -+ goto err; -+ } - base = virt_to_phys((void *)msi->pages); - - rcar_pci_write_reg(pcie, base | MSIFE, PCIEMSIALR); -diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c -index 4cfa46360d12..6a2499f4d610 100644 ---- a/drivers/pci/host/pcie-xilinx.c -+++ b/drivers/pci/host/pcie-xilinx.c -@@ -349,14 +349,19 @@ static const struct irq_domain_ops msi_domain_ops = { - * xilinx_pcie_enable_msi - Enable MSI support - * @port: PCIe port information - */ --static void xilinx_pcie_enable_msi(struct xilinx_pcie_port *port) -+static int xilinx_pcie_enable_msi(struct xilinx_pcie_port *port) - { - phys_addr_t msg_addr; - - port->msi_pages = __get_free_pages(GFP_KERNEL, 0); -+ if (!port->msi_pages) -+ return -ENOMEM; -+ - msg_addr = virt_to_phys((void *)port->msi_pages); - pcie_write(port, 0x0, XILINX_PCIE_REG_MSIBASE1); - pcie_write(port, msg_addr, XILINX_PCIE_REG_MSIBASE2); -+ -+ return 0; - } - - /* INTx Functions */ -@@ -555,6 +560,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port) - struct device *dev = port->dev; - struct device_node *node = dev->of_node; - struct device_node *pcie_intc_node; -+ int ret; - - /* Setup INTx */ - pcie_intc_node = of_get_next_child(node, NULL); -@@ -582,7 +588,9 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port) - return PTR_ERR(port->irq_domain); - } - -- xilinx_pcie_enable_msi(port); -+ ret = xilinx_pcie_enable_msi(port); -+ if (ret) -+ return ret; - } - - return 0; -diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c -index f2fcbe944d94..aae295708ea7 100644 ---- a/drivers/pci/hotplug/rpadlpar_core.c -+++ b/drivers/pci/hotplug/rpadlpar_core.c -@@ -55,6 +55,7 @@ static struct device_node *find_vio_slot_node(char *drc_name) - if ((rc == 0) && (!strcmp(drc_name, name))) - break; - } -+ of_node_put(parent); - - return dn; - } -@@ -78,6 +79,7 @@ static struct device_node *find_php_slot_pci_node(char *drc_name, - return np; - } - -+/* Returns a device_node with its reference count incremented */ - static struct device_node *find_dlpar_node(char *drc_name, int *node_type) - { - struct device_node *dn; -@@ -314,6 +316,7 @@ int dlpar_add_slot(char *drc_name) - rc = dlpar_add_phb(drc_name, dn); - break; - } -+ of_node_put(dn); - - printk(KERN_INFO "%s: slot %s added\n", DLPAR_MODULE_NAME, drc_name); - exit: -@@ -447,6 +450,7 @@ int dlpar_remove_slot(char *drc_name) - rc = dlpar_remove_pci_slot(drc_name, dn); - break; - } -+ of_node_put(dn); - vm_unmap_aliases(); - - printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name); -diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c -index a0b8c8a8c323..5c285f2b3a65 100644 ---- a/drivers/platform/chrome/cros_ec_proto.c -+++ b/drivers/platform/chrome/cros_ec_proto.c -@@ -66,6 +66,17 @@ static int send_command(struct cros_ec_device *ec_dev, - else - xfer_fxn = ec_dev->cmd_xfer; - -+ if (!xfer_fxn) { -+ /* -+ * This error can happen if a communication error happened and -+ * the EC is trying to use protocol v2, on an underlying -+ * communication mechanism that does not support v2. -+ */ -+ dev_err_once(ec_dev->dev, -+ "missing EC transfer API, cannot send command\n"); -+ return -EIO; -+ } -+ - ret = (*xfer_fxn)(ec_dev, msg); - if (msg->result == EC_RES_IN_PROGRESS) { - int i; -diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c -index ec84ff8ad1b4..6911f9662300 100644 ---- a/drivers/pwm/core.c -+++ b/drivers/pwm/core.c -@@ -284,10 +284,12 @@ int pwmchip_add_with_polarity(struct pwm_chip *chip, - if (IS_ENABLED(CONFIG_OF)) - of_pwmchip_add(chip); - -- pwmchip_sysfs_export(chip); -- - out: - mutex_unlock(&pwm_lock); -+ -+ if (!ret) -+ pwmchip_sysfs_export(chip); -+ - return ret; - } - EXPORT_SYMBOL_GPL(pwmchip_add_with_polarity); -@@ -321,7 +323,7 @@ int pwmchip_remove(struct pwm_chip *chip) - unsigned int i; - int ret = 0; - -- pwmchip_sysfs_unexport_children(chip); -+ pwmchip_sysfs_unexport(chip); - - mutex_lock(&pwm_lock); - -@@ -341,8 +343,6 @@ int pwmchip_remove(struct pwm_chip *chip) - - free_pwms(chip); - -- pwmchip_sysfs_unexport(chip); -- - out: - mutex_unlock(&pwm_lock); - return ret; -diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c -index 062dff1c902d..ede17f89d57f 100644 ---- a/drivers/pwm/pwm-tiehrpwm.c -+++ b/drivers/pwm/pwm-tiehrpwm.c -@@ -385,6 +385,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) - } - - /* Update shadow register first before modifying active register */ -+ ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK, -+ AQSFRC_RLDCSF_ZRO); - ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); - /* - * Changes to immediate action on Action Qualifier. This puts -diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c -index 375008e2be20..199370e41da9 100644 ---- a/drivers/pwm/sysfs.c -+++ b/drivers/pwm/sysfs.c -@@ -338,19 +338,6 @@ void pwmchip_sysfs_export(struct pwm_chip *chip) - } - - void pwmchip_sysfs_unexport(struct pwm_chip *chip) --{ -- struct device *parent; -- -- parent = class_find_device(&pwm_class, NULL, chip, -- pwmchip_sysfs_match); -- if (parent) { -- /* for class_find_device() */ -- put_device(parent); -- device_unregister(parent); -- } --} -- --void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) - { - struct device *parent; - unsigned int i; -@@ -368,6 +355,7 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) - } - - put_device(parent); -+ device_unregister(parent); - } - - static int __init pwm_sysfs_init(void) -diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c -index 28c671b609b2..0c71b69b9f88 100644 ---- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c -+++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c -@@ -829,7 +829,7 @@ ret_err_rqe: - ((u64)err_entry->data.err_warn_bitmap_hi << 32) | - (u64)err_entry->data.err_warn_bitmap_lo; - for (i = 0; i < BNX2FC_NUM_ERR_BITS; i++) { -- if (err_warn_bit_map & (u64) (1 << i)) { -+ if (err_warn_bit_map & ((u64)1 << i)) { - err_warn = i; - break; - } -diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c -index f3bb7af4e984..5eaf14c15590 100644 ---- a/drivers/scsi/cxgbi/libcxgbi.c -+++ b/drivers/scsi/cxgbi/libcxgbi.c -@@ -634,6 +634,10 @@ static struct cxgbi_sock *cxgbi_check_route(struct sockaddr *dst_addr) - - if (ndev->flags & IFF_LOOPBACK) { - ndev = ip_dev_find(&init_net, daddr->sin_addr.s_addr); -+ if (!ndev) { -+ err = -ENETUNREACH; -+ goto rel_neigh; -+ } - mtu = ndev->mtu; - pr_info("rt dev %s, loopback -> %s, mtu %u.\n", - n->dev->name, ndev->name, mtu); -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index ee1f9ee995e5..400eee9d7783 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -978,6 +978,8 @@ static struct domain_device *sas_ex_discover_expander( - list_del(&child->dev_list_node); - spin_unlock_irq(&parent->port->dev_list_lock); - sas_put_device(child); -+ sas_port_delete(phy->port); -+ phy->port = NULL; - return NULL; - } - list_add_tail(&child->siblings, &parent->ex_dev.children); -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 398c9a0a5ade..82a690924f5e 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -6498,7 +6498,10 @@ int - lpfc_send_rrq(struct lpfc_hba *phba, struct lpfc_node_rrq *rrq) - { - struct lpfc_nodelist *ndlp = lpfc_findnode_did(rrq->vport, -- rrq->nlp_DID); -+ rrq->nlp_DID); -+ if (!ndlp) -+ return 1; -+ - if (lpfc_test_rrq_active(phba, ndlp, rrq->xritag)) - return lpfc_issue_els_rrq(rrq->vport, ndlp, - rrq->nlp_DID, rrq); -diff --git a/drivers/soc/mediatek/mtk-pmic-wrap.c b/drivers/soc/mediatek/mtk-pmic-wrap.c -index 105597a885cb..33b10dd7d87e 100644 ---- a/drivers/soc/mediatek/mtk-pmic-wrap.c -+++ b/drivers/soc/mediatek/mtk-pmic-wrap.c -@@ -591,7 +591,7 @@ static bool pwrap_is_pmic_cipher_ready(struct pmic_wrapper *wrp) - static int pwrap_init_cipher(struct pmic_wrapper *wrp) - { - int ret; -- u32 rdata; -+ u32 rdata = 0; - - pwrap_writel(wrp, 0x1, PWRAP_CIPHER_SWRST); - pwrap_writel(wrp, 0x0, PWRAP_CIPHER_SWRST); -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index e87b6fc9f4c6..193aa3da5033 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -1371,12 +1371,7 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = { - - static bool pxa2xx_spi_idma_filter(struct dma_chan *chan, void *param) - { -- struct device *dev = param; -- -- if (dev != chan->device->dev->parent) -- return false; -- -- return true; -+ return param == chan->device->dev; - } - - static struct pxa2xx_spi_master * -diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c -index a30d68c4b689..039837db65fc 100644 ---- a/drivers/tty/serial/8250/8250_dw.c -+++ b/drivers/tty/serial/8250/8250_dw.c -@@ -258,7 +258,7 @@ static bool dw8250_fallback_dma_filter(struct dma_chan *chan, void *param) - - static bool dw8250_idma_filter(struct dma_chan *chan, void *param) - { -- return param == chan->device->dev->parent; -+ return param == chan->device->dev; - } - - static void dw8250_quirks(struct uart_port *p, struct dw8250_data *data) -@@ -290,7 +290,7 @@ static void dw8250_quirks(struct uart_port *p, struct dw8250_data *data) - data->uart_16550_compatible = true; - } - -- /* Platforms with iDMA */ -+ /* Platforms with iDMA 64-bit */ - if (platform_get_resource_byname(to_platform_device(p->dev), - IORESOURCE_MEM, "lpss_priv")) { - p->set_termios = dw8250_set_termios; -diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c -index 59828d819145..5ad978acd90c 100644 ---- a/drivers/tty/serial/sunhv.c -+++ b/drivers/tty/serial/sunhv.c -@@ -392,7 +392,7 @@ static struct uart_ops sunhv_pops = { - static struct uart_driver sunhv_reg = { - .owner = THIS_MODULE, - .driver_name = "sunhv", -- .dev_name = "ttyS", -+ .dev_name = "ttyHV", - .major = TTY_MAJOR, - }; - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 38c7676e7a82..19e819aa2419 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -70,6 +70,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */ - { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Logitech HD Webcam C270 */ -+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, -+ - /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 9f96dd274370..1effe74ec638 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1166,6 +1166,10 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */ - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ -@@ -1767,6 +1771,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), - .driver_info = RSVD(5) | RSVD(6) }, - { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ -+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ -+ .driver_info = RSVD(7) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, - { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 9706d214c409..8fd5e19846ef 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -101,6 +101,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) }, - { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) }, - { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, -+ { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index d84c3b3d477b..496cbccbf26c 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -159,3 +159,6 @@ - #define SMART_VENDOR_ID 0x0b8c - #define SMART_PRODUCT_ID 0x2303 - -+/* Allied Telesis VT-Kit3 */ -+#define AT_VENDOR_ID 0x0caa -+#define AT_VTKIT3_PRODUCT_ID 0x3001 -diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h -index f5fc3271e19c..e2c5491a411b 100644 ---- a/drivers/usb/storage/unusual_realtek.h -+++ b/drivers/usb/storage/unusual_realtek.h -@@ -28,6 +28,11 @@ UNUSUAL_DEV(0x0bda, 0x0138, 0x0000, 0x9999, - "USB Card Reader", - USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), - -+UNUSUAL_DEV(0x0bda, 0x0153, 0x0000, 0x9999, -+ "Realtek", -+ "USB Card Reader", -+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), -+ - UNUSUAL_DEV(0x0bda, 0x0158, 0x0000, 0x9999, - "Realtek", - "USB Card Reader", -diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c -index 15d3ccff2965..4a397c7c1b56 100644 ---- a/drivers/video/fbdev/hgafb.c -+++ b/drivers/video/fbdev/hgafb.c -@@ -285,6 +285,8 @@ static int hga_card_detect(void) - hga_vram_len = 0x08000; - - hga_vram = ioremap(0xb0000, hga_vram_len); -+ if (!hga_vram) -+ goto error; - - if (request_region(0x3b0, 12, "hgafb")) - release_io_ports = 1; -diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c -index 9b167f7ef6c6..4994a540f680 100644 ---- a/drivers/video/fbdev/imsttfb.c -+++ b/drivers/video/fbdev/imsttfb.c -@@ -1517,6 +1517,11 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - info->fix.smem_start = addr; - info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? - 0x400000 : 0x800000); -+ if (!info->screen_base) { -+ release_mem_region(addr, size); -+ framebuffer_release(info); -+ return -ENOMEM; -+ } - info->fix.mmio_start = addr + 0x800000; - par->dc_regs = ioremap(addr + 0x800000, 0x1000); - par->cmap_regs_phys = addr + 0x840000; -diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c -index a7a1b218f308..8e709b641b55 100644 ---- a/fs/configfs/dir.c -+++ b/fs/configfs/dir.c -@@ -58,15 +58,13 @@ static void configfs_d_iput(struct dentry * dentry, - if (sd) { - /* Coordinate with configfs_readdir */ - spin_lock(&configfs_dirent_lock); -- /* Coordinate with configfs_attach_attr where will increase -- * sd->s_count and update sd->s_dentry to new allocated one. -- * Only set sd->dentry to null when this dentry is the only -- * sd owner. -- * If not do so, configfs_d_iput may run just after -- * configfs_attach_attr and set sd->s_dentry to null -- * even it's still in use. -+ /* -+ * Set sd->s_dentry to null only when this dentry is the one -+ * that is going to be killed. Otherwise configfs_d_iput may -+ * run just after configfs_attach_attr and set sd->s_dentry to -+ * NULL even it's still in use. - */ -- if (atomic_read(&sd->s_count) <= 2) -+ if (sd->s_dentry == dentry) - sd->s_dentry = NULL; - - spin_unlock(&configfs_dirent_lock); -diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c -index 2878be3e448f..410354c334d7 100644 ---- a/fs/f2fs/recovery.c -+++ b/fs/f2fs/recovery.c -@@ -413,7 +413,15 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, - - get_node_info(sbi, dn.nid, &ni); - f2fs_bug_on(sbi, ni.ino != ino_of_node(page)); -- f2fs_bug_on(sbi, ofs_of_node(dn.node_page) != ofs_of_node(page)); -+ -+ if (ofs_of_node(dn.node_page) != ofs_of_node(page)) { -+ f2fs_msg(sbi->sb, KERN_WARNING, -+ "Inconsistent ofs_of_node, ino:%lu, ofs:%u, %u", -+ inode->i_ino, ofs_of_node(dn.node_page), -+ ofs_of_node(page)); -+ err = -EFAULT; -+ goto err; -+ } - - for (; start < end; start++, dn.ofs_in_node++) { - block_t src, dest; -diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h -index 08b08ae6ba9d..f461fecf0e54 100644 ---- a/fs/f2fs/segment.h -+++ b/fs/f2fs/segment.h -@@ -598,7 +598,6 @@ static inline void verify_block_addr(struct f2fs_io_info *fio, block_t blk_addr) - static inline int check_block_count(struct f2fs_sb_info *sbi, - int segno, struct f2fs_sit_entry *raw_sit) - { --#ifdef CONFIG_F2FS_CHECK_FS - bool is_valid = test_bit_le(0, raw_sit->valid_map) ? true : false; - int valid_blocks = 0; - int cur_pos = 0, next_pos; -@@ -625,7 +624,7 @@ static inline int check_block_count(struct f2fs_sb_info *sbi, - set_sbi_flag(sbi, SBI_NEED_FSCK); - return -EINVAL; - } --#endif -+ - /* check segment usage, and check boundary of a given segment number */ - if (unlikely(GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg - || segno > TOTAL_SEGS(sbi) - 1)) { -diff --git a/fs/fat/file.c b/fs/fat/file.c -index a08f1039909a..d3f655ae020b 100644 ---- a/fs/fat/file.c -+++ b/fs/fat/file.c -@@ -156,12 +156,17 @@ static int fat_file_release(struct inode *inode, struct file *filp) - int fat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync) - { - struct inode *inode = filp->f_mapping->host; -- int res, err; -+ int err; -+ -+ err = __generic_file_fsync(filp, start, end, datasync); -+ if (err) -+ return err; - -- res = generic_file_fsync(filp, start, end, datasync); - err = sync_mapping_buffers(MSDOS_SB(inode->i_sb)->fat_inode->i_mapping); -+ if (err) -+ return err; - -- return res ? res : err; -+ return blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL); - } - - -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 341196338e48..f5d2d2340b44 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -1724,7 +1724,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, - offset = outarg->offset & ~PAGE_CACHE_MASK; - file_size = i_size_read(inode); - -- num = outarg->size; -+ num = min(outarg->size, fc->max_write); - if (outarg->offset > file_size) - num = 0; - else if (outarg->offset + num > file_size) -diff --git a/fs/inode.c b/fs/inode.c -index b5c3a6473aaa..00ec6db1cad5 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -1744,8 +1744,13 @@ int file_remove_privs(struct file *file) - int kill; - int error = 0; - -- /* Fast path for nothing security related */ -- if (IS_NOSEC(inode)) -+ /* -+ * Fast path for nothing security related. -+ * As well for non-regular files, e.g. blkdev inodes. -+ * For example, blkdev_write_iter() might get here -+ * trying to remove privs which it is not allowed to. -+ */ -+ if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode)) - return 0; - - kill = dentry_needs_remove_privs(dentry); -diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h -index fcfc48cbe136..128d6e216fd7 100644 ---- a/fs/nfsd/vfs.h -+++ b/fs/nfsd/vfs.h -@@ -109,8 +109,11 @@ void nfsd_put_raparams(struct file *file, struct raparms *ra); - - static inline int fh_want_write(struct svc_fh *fh) - { -- int ret = mnt_want_write(fh->fh_export->ex_path.mnt); -+ int ret; - -+ if (fh->fh_want_write) -+ return 0; -+ ret = mnt_want_write(fh->fh_export->ex_path.mnt); - if (!ret) - fh->fh_want_write = true; - return ret; -diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c -index 290373024d9d..e8ace3b54e9c 100644 ---- a/fs/ocfs2/dcache.c -+++ b/fs/ocfs2/dcache.c -@@ -310,6 +310,18 @@ int ocfs2_dentry_attach_lock(struct dentry *dentry, - - out_attach: - spin_lock(&dentry_attach_lock); -+ if (unlikely(dentry->d_fsdata && !alias)) { -+ /* d_fsdata is set by a racing thread which is doing -+ * the same thing as this thread is doing. Leave the racing -+ * thread going ahead and we return here. -+ */ -+ spin_unlock(&dentry_attach_lock); -+ iput(dl->dl_inode); -+ ocfs2_lock_res_free(&dl->dl_lockres); -+ kfree(dl); -+ return 0; -+ } -+ - dentry->d_fsdata = dl; - dl->dl_count++; - spin_unlock(&dentry_attach_lock); -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 75691a20313c..ad1ccdcef74e 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -947,6 +947,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, - continue; - up_read(&mm->mmap_sem); - down_write(&mm->mmap_sem); -+ /* -+ * Avoid to modify vma->vm_flags -+ * without locked ops while the -+ * coredump reads the vm_flags. -+ */ -+ if (!mmget_still_valid(mm)) { -+ /* -+ * Silently return "count" -+ * like if get_task_mm() -+ * failed. FIXME: should this -+ * function have returned -+ * -ESRCH if get_task_mm() -+ * failed like if -+ * get_proc_task() fails? -+ */ -+ up_write(&mm->mmap_sem); -+ goto out_mm; -+ } - for (vma = mm->mmap; vma; vma = vma->vm_next) { - vma->vm_flags &= ~VM_SOFTDIRTY; - vma_set_page_prot(vma); -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index e93541282aa1..f187e02d267e 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -446,6 +446,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - * taking the mmap_sem for writing. - */ - down_write(&mm->mmap_sem); -+ if (!mmget_still_valid(mm)) -+ goto skip_mm; - prev = NULL; - for (vma = mm->mmap; vma; vma = vma->vm_next) { - cond_resched(); -@@ -468,6 +470,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - vma->vm_flags = new_flags; - vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; - } -+skip_mm: - up_write(&mm->mmap_sem); - mmput(mm); - wakeup: -@@ -769,6 +772,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, - goto out; - - down_write(&mm->mmap_sem); -+ if (!mmget_still_valid(mm)) -+ goto out_unlock; - vma = find_vma_prev(mm, start, &prev); - if (!vma) - goto out_unlock; -@@ -914,6 +919,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, - goto out; - - down_write(&mm->mmap_sem); -+ if (!mmget_still_valid(mm)) -+ goto out_unlock; - vma = find_vma_prev(mm, start, &prev); - if (!vma) - goto out_unlock; -diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h -index 210ccc4ea44b..8607c937145f 100644 ---- a/include/linux/cgroup.h -+++ b/include/linux/cgroup.h -@@ -453,7 +453,7 @@ static inline struct cgroup_subsys_state *task_css(struct task_struct *task, - * - * Find the css for the (@task, @subsys_id) combination, increment a - * reference on and return it. This function is guaranteed to return a -- * valid css. -+ * valid css. The returned css may already have been offlined. - */ - static inline struct cgroup_subsys_state * - task_get_css(struct task_struct *task, int subsys_id) -@@ -463,7 +463,13 @@ task_get_css(struct task_struct *task, int subsys_id) - rcu_read_lock(); - while (true) { - css = task_css(task, subsys_id); -- if (likely(css_tryget_online(css))) -+ /* -+ * Can't use css_tryget_online() here. A task which has -+ * PF_EXITING set may stay associated with an offline css. -+ * If such task calls this function, css_tryget_online() -+ * will keep failing. -+ */ -+ if (likely(css_tryget(css))) - break; - cpu_relax(); - } -diff --git a/include/linux/mm.h b/include/linux/mm.h -index 251adf4d8a71..ed653ba47c46 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1098,6 +1098,27 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long address, - void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma, - unsigned long start, unsigned long end); - -+/* -+ * This has to be called after a get_task_mm()/mmget_not_zero() -+ * followed by taking the mmap_sem for writing before modifying the -+ * vmas or anything the coredump pretends not to change from under it. -+ * -+ * NOTE: find_extend_vma() called from GUP context is the only place -+ * that can modify the "mm" (notably the vm_start/end) under mmap_sem -+ * for reading and outside the context of the process, so it is also -+ * the only case that holds the mmap_sem for reading that must call -+ * this function. Generally if the mmap_sem is hold for reading -+ * there's no need of this check after get_task_mm()/mmget_not_zero(). -+ * -+ * This function can be obsoleted and the check can be removed, after -+ * the coredump code will hold the mmap_sem for writing before -+ * invoking the ->core_dump methods. -+ */ -+static inline bool mmget_still_valid(struct mm_struct *mm) -+{ -+ return likely(!mm->core_state); -+} -+ - /** - * mm_walk - callbacks for walk_page_range - * @pmd_entry: if set, called for each non-empty PMD (3rd-level) entry -diff --git a/include/linux/pwm.h b/include/linux/pwm.h -index aa8736d5b2f3..cfc3ed46cad2 100644 ---- a/include/linux/pwm.h -+++ b/include/linux/pwm.h -@@ -331,7 +331,6 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num) - #ifdef CONFIG_PWM_SYSFS - void pwmchip_sysfs_export(struct pwm_chip *chip); - void pwmchip_sysfs_unexport(struct pwm_chip *chip); --void pwmchip_sysfs_unexport_children(struct pwm_chip *chip); - #else - static inline void pwmchip_sysfs_export(struct pwm_chip *chip) - { -@@ -340,10 +339,6 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip) - static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip) - { - } -- --static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) --{ --} - #endif /* CONFIG_PWM_SYSFS */ - - #endif /* __LINUX_PWM_H */ -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 7c0c83dfe86e..876688b5a356 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -174,9 +174,6 @@ struct adv_info { - - #define HCI_MAX_SHORT_NAME_LENGTH 10 - --/* Min encryption key size to match with SMP */ --#define HCI_MIN_ENC_KEY_SIZE 7 -- - /* Default LE RPA expiry time, 15 minutes */ - #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60) - -diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index 5e24eb0ab5dd..6ed74825ab54 100644 ---- a/ipc/mqueue.c -+++ b/ipc/mqueue.c -@@ -373,7 +373,8 @@ static void mqueue_evict_inode(struct inode *inode) - struct user_struct *user; - unsigned long mq_bytes, mq_treesize; - struct ipc_namespace *ipc_ns; -- struct msg_msg *msg; -+ struct msg_msg *msg, *nmsg; -+ LIST_HEAD(tmp_msg); - - clear_inode(inode); - -@@ -384,10 +385,15 @@ static void mqueue_evict_inode(struct inode *inode) - info = MQUEUE_I(inode); - spin_lock(&info->lock); - while ((msg = msg_get(info)) != NULL) -- free_msg(msg); -+ list_add_tail(&msg->m_list, &tmp_msg); - kfree(info->node_cache); - spin_unlock(&info->lock); - -+ list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) { -+ list_del(&msg->m_list); -+ free_msg(msg); -+ } -+ - /* Total amount of bytes accounted for the mqueue */ - mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) + - min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) * -diff --git a/ipc/msgutil.c b/ipc/msgutil.c -index ed81aafd2392..9467307487f7 100644 ---- a/ipc/msgutil.c -+++ b/ipc/msgutil.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - - #include "util.h" - -@@ -66,6 +67,9 @@ static struct msg_msg *alloc_msg(size_t len) - pseg = &msg->next; - while (len > 0) { - struct msg_msgseg *seg; -+ -+ cond_resched(); -+ - alen = min(len, DATALEN_SEG); - seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL); - if (seg == NULL) -@@ -178,6 +182,8 @@ void free_msg(struct msg_msg *msg) - kfree(msg); - while (seg != NULL) { - struct msg_msgseg *tmp = seg->next; -+ -+ cond_resched(); - kfree(seg); - seg = tmp; - } -diff --git a/kernel/cred.c b/kernel/cred.c -index ff8606f77d90..098af0bc0b7e 100644 ---- a/kernel/cred.c -+++ b/kernel/cred.c -@@ -447,6 +447,15 @@ int commit_creds(struct cred *new) - if (task->mm) - set_dumpable(task->mm, suid_dumpable); - task->pdeath_signal = 0; -+ /* -+ * If a task drops privileges and becomes nondumpable, -+ * the dumpability change must become visible before -+ * the credential change; otherwise, a __ptrace_may_access() -+ * racing with this change may be able to attach to a task it -+ * shouldn't be able to attach to (as if the task had dropped -+ * privileges without becoming nondumpable). -+ * Pairs with a read barrier in __ptrace_may_access(). -+ */ - smp_wmb(); - } - -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index 7324d83d6bd8..410f83cad06c 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -49,14 +49,30 @@ static void perf_output_put_handle(struct perf_output_handle *handle) - unsigned long head; - - again: -+ /* -+ * In order to avoid publishing a head value that goes backwards, -+ * we must ensure the load of @rb->head happens after we've -+ * incremented @rb->nest. -+ * -+ * Otherwise we can observe a @rb->head value before one published -+ * by an IRQ/NMI happening between the load and the increment. -+ */ -+ barrier(); - head = local_read(&rb->head); - - /* -- * IRQ/NMI can happen here, which means we can miss a head update. -+ * IRQ/NMI can happen here and advance @rb->head, causing our -+ * load above to be stale. - */ - -- if (!local_dec_and_test(&rb->nest)) -+ /* -+ * If this isn't the outermost nesting, we don't have to update -+ * @rb->user_page->data_head. -+ */ -+ if (local_read(&rb->nest) > 1) { -+ local_dec(&rb->nest); - goto out; -+ } - - /* - * Since the mmap() consumer (userspace) can run on a different CPU: -@@ -88,9 +104,18 @@ again: - rb->user_page->data_head = head; - - /* -- * Now check if we missed an update -- rely on previous implied -- * compiler barriers to force a re-read. -+ * We must publish the head before decrementing the nest count, -+ * otherwise an IRQ/NMI can publish a more recent head value and our -+ * write will (temporarily) publish a stale value. -+ */ -+ barrier(); -+ local_set(&rb->nest, 0); -+ -+ /* -+ * Ensure we decrement @rb->nest before we validate the @rb->head. -+ * Otherwise we cannot be sure we caught the 'last' nested update. - */ -+ barrier(); - if (unlikely(head != local_read(&rb->head))) { - local_inc(&rb->nest); - goto again; -diff --git a/kernel/futex.c b/kernel/futex.c -index ec9df5ba040b..15d850ffbe29 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -593,8 +593,8 @@ again: - * applies. If this is really a shmem page then the page lock - * will prevent unexpected transitions. - */ -- lock_page(page); -- shmem_swizzled = PageSwapCache(page) || page->mapping; -+ lock_page(page_head); -+ shmem_swizzled = PageSwapCache(page_head) || page_head->mapping; - unlock_page(page_head); - put_page(page_head); - -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index 8303874c2a06..1aa33fe37aa8 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -292,6 +292,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - return -EPERM; - ok: - rcu_read_unlock(); -+ /* -+ * If a task drops privileges and becomes nondumpable (through a syscall -+ * like setresuid()) while we are trying to access it, we must ensure -+ * that the dumpability is read after the credentials; otherwise, -+ * we may be able to attach to a task that we shouldn't be able to -+ * attach to (as if the task had dropped privileges without becoming -+ * nondumpable). -+ * Pairs with a write barrier in commit_creds(). -+ */ -+ smp_rmb(); - mm = task->mm; - if (mm && - ((get_dumpable(mm) != SUID_DUMP_USER) && -@@ -673,6 +683,10 @@ static int ptrace_peek_siginfo(struct task_struct *child, - if (arg.nr < 0) - return -EINVAL; - -+ /* Ensure arg.off fits in an unsigned long */ -+ if (arg.off > ULONG_MAX) -+ return 0; -+ - if (arg.flags & PTRACE_PEEKSIGINFO_SHARED) - pending = &child->signal->shared_pending; - else -@@ -680,18 +694,20 @@ static int ptrace_peek_siginfo(struct task_struct *child, - - for (i = 0; i < arg.nr; ) { - siginfo_t info; -- s32 off = arg.off + i; -+ unsigned long off = arg.off + i; -+ bool found = false; - - spin_lock_irq(&child->sighand->siglock); - list_for_each_entry(q, &pending->list, list) { - if (!off--) { -+ found = true; - copy_siginfo(&info, &q->info); - break; - } - } - spin_unlock_irq(&child->sighand->siglock); - -- if (off >= 0) /* beyond the end of the list */ -+ if (!found) /* beyond the end of the list */ - break; - - #ifdef CONFIG_COMPAT -diff --git a/kernel/sys.c b/kernel/sys.c -index e2446ade79ba..1855f1bf113e 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -1762,7 +1762,7 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map) - ((unsigned long)prctl_map->__m1 __op \ - (unsigned long)prctl_map->__m2) ? 0 : -EINVAL - error = __prctl_check_order(start_code, <, end_code); -- error |= __prctl_check_order(start_data, <, end_data); -+ error |= __prctl_check_order(start_data,<=, end_data); - error |= __prctl_check_order(start_brk, <=, brk); - error |= __prctl_check_order(arg_start, <=, arg_end); - error |= __prctl_check_order(env_start, <=, env_end); -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index c140659db669..24c7fe8608d0 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -2461,8 +2461,10 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int - if (neg) - continue; - val = convmul * val / convdiv; -- if ((min && val < *min) || (max && val > *max)) -- continue; -+ if ((min && val < *min) || (max && val > *max)) { -+ err = -EINVAL; -+ break; -+ } - *i = val; - } else { - val = convdiv * (*i) / convmul; -diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c -index ab861771e37f..0e0dc5d89911 100644 ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -633,7 +633,7 @@ static inline void process_adjtimex_modes(struct timex *txc, - time_constant = max(time_constant, 0l); - } - -- if (txc->modes & ADJ_TAI && txc->constant > 0) -+ if (txc->modes & ADJ_TAI && txc->constant >= 0) - *time_tai = txc->constant; - - if (txc->modes & ADJ_OFFSET) -diff --git a/mm/cma.c b/mm/cma.c -index f0d91aca5a4c..5ae4452656cd 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -100,8 +100,10 @@ static int __init cma_activate_area(struct cma *cma) - - cma->bitmap = kzalloc(bitmap_size, GFP_KERNEL); - -- if (!cma->bitmap) -+ if (!cma->bitmap) { -+ cma->count = 0; - return -ENOMEM; -+ } - - WARN_ON_ONCE(!pfn_valid(pfn)); - zone = page_zone(pfn_to_page(pfn)); -diff --git a/mm/cma_debug.c b/mm/cma_debug.c -index f8e4b60db167..da50dab56b70 100644 ---- a/mm/cma_debug.c -+++ b/mm/cma_debug.c -@@ -57,7 +57,7 @@ static int cma_maxchunk_get(void *data, u64 *val) - mutex_lock(&cma->lock); - for (;;) { - start = find_next_zero_bit(cma->bitmap, bitmap_maxno, end); -- if (start >= cma->count) -+ if (start >= bitmap_maxno) - break; - end = find_next_bit(cma->bitmap, bitmap_maxno, start); - maxchunk = max(end - start, maxchunk); -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index d7f65a8c629b..fd932e7a25dd 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -1221,12 +1221,23 @@ void free_huge_page(struct page *page) - ClearPagePrivate(page); - - /* -- * A return code of zero implies that the subpool will be under its -- * minimum size if the reservation is not restored after page is free. -- * Therefore, force restore_reserve operation. -+ * If PagePrivate() was set on page, page allocation consumed a -+ * reservation. If the page was associated with a subpool, there -+ * would have been a page reserved in the subpool before allocation -+ * via hugepage_subpool_get_pages(). Since we are 'restoring' the -+ * reservtion, do not call hugepage_subpool_put_pages() as this will -+ * remove the reserved page from the subpool. - */ -- if (hugepage_subpool_put_pages(spool, 1) == 0) -- restore_reserve = true; -+ if (!restore_reserve) { -+ /* -+ * A return code of zero implies that the subpool will be -+ * under its minimum size if the reservation is not restored -+ * after page is free. Therefore, force restore_reserve -+ * operation. -+ */ -+ if (hugepage_subpool_put_pages(spool, 1) == 0) -+ restore_reserve = true; -+ } - - spin_lock(&hugetlb_lock); - clear_page_huge_active(page); -diff --git a/mm/list_lru.c b/mm/list_lru.c -index 732a066e3d3a..4aa714db2fcf 100644 ---- a/mm/list_lru.c -+++ b/mm/list_lru.c -@@ -313,7 +313,7 @@ static int __memcg_init_list_lru_node(struct list_lru_memcg *memcg_lrus, - } - return 0; - fail: -- __memcg_destroy_list_lru_node(memcg_lrus, begin, i - 1); -+ __memcg_destroy_list_lru_node(memcg_lrus, begin, i); - return -ENOMEM; - } - -diff --git a/mm/mmap.c b/mm/mmap.c -index baa4c1280bff..a24e42477001 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -42,6 +42,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -2398,7 +2399,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) - vma = find_vma_prev(mm, addr, &prev); - if (vma && (vma->vm_start <= addr)) - return vma; -- if (!prev || expand_stack(prev, addr)) -+ /* don't alter vm_end if the coredump is running */ -+ if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr)) - return NULL; - if (prev->vm_flags & VM_LOCKED) - populate_vma_page_range(prev, addr, prev->vm_end, NULL); -@@ -2424,6 +2426,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) - return vma; - if (!(vma->vm_flags & VM_GROWSDOWN)) - return NULL; -+ /* don't alter vm_start if the coredump is running */ -+ if (!mmget_still_valid(mm)) -+ return NULL; - start = vma->vm_start; - if (expand_stack(vma, addr)) - return NULL; -diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c -index 149f82bd83fd..6ba56f215229 100644 ---- a/net/ax25/ax25_route.c -+++ b/net/ax25/ax25_route.c -@@ -443,9 +443,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr) - } - - if (ax25->sk != NULL) { -+ local_bh_disable(); - bh_lock_sock(ax25->sk); - sock_reset_flag(ax25->sk, SOCK_ZAPPED); - bh_unlock_sock(ax25->sk); -+ local_bh_enable(); - } - - put: -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 83d4d574fa44..80be0ee17ff3 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1177,14 +1177,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn) - !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) - return 0; - -- /* The minimum encryption key size needs to be enforced by the -- * host stack before establishing any L2CAP connections. The -- * specification in theory allows a minimum of 1, but to align -- * BR/EDR and LE transports, a minimum of 7 is chosen. -- */ -- if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE) -- return 0; -- - return 1; - } - -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 9d812ba38ff2..8b0908c7e9cc 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -2705,6 +2705,7 @@ static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos) - } - - void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags) -+ __acquires(tbl->lock) - __acquires(rcu_bh) - { - struct neigh_seq_state *state = seq->private; -@@ -2715,6 +2716,7 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl - - rcu_read_lock_bh(); - state->nht = rcu_dereference_bh(tbl->nht); -+ read_lock(&tbl->lock); - - return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN; - } -@@ -2748,8 +2750,13 @@ out: - EXPORT_SYMBOL(neigh_seq_next); - - void neigh_seq_stop(struct seq_file *seq, void *v) -+ __releases(tbl->lock) - __releases(rcu_bh) - { -+ struct neigh_seq_state *state = seq->private; -+ struct neigh_table *tbl = state->tbl; -+ -+ read_unlock(&tbl->lock); - rcu_read_unlock_bh(); - } - EXPORT_SYMBOL(neigh_seq_stop); -diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c -index c6061f7343f1..8a6c682bfc22 100644 ---- a/net/ipv6/ip6_flowlabel.c -+++ b/net/ipv6/ip6_flowlabel.c -@@ -254,9 +254,9 @@ struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label) - rcu_read_lock_bh(); - for_each_sk_fl_rcu(np, sfl) { - struct ip6_flowlabel *fl = sfl->fl; -- if (fl->label == label) { -+ -+ if (fl->label == label && atomic_inc_not_zero(&fl->users)) { - fl->lastuse = jiffies; -- atomic_inc(&fl->users); - rcu_read_unlock_bh(); - return fl; - } -@@ -622,7 +622,8 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen) - goto done; - } - fl1 = sfl->fl; -- atomic_inc(&fl1->users); -+ if (!atomic_inc_not_zero(&fl1->users)) -+ fl1 = NULL; - break; - } - } -diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c -index fc60d9d738b5..cdb913e7627e 100644 ---- a/net/lapb/lapb_iface.c -+++ b/net/lapb/lapb_iface.c -@@ -182,6 +182,7 @@ int lapb_unregister(struct net_device *dev) - lapb = __lapb_devtostruct(dev); - if (!lapb) - goto out; -+ lapb_put(lapb); - - lapb_stop_t1timer(lapb); - lapb_stop_t2timer(lapb); -diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c -index f04714d70bf7..a42e2ce4a726 100644 ---- a/sound/core/seq/seq_ports.c -+++ b/sound/core/seq/seq_ports.c -@@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, - list_del_init(list); - grp->exclusive = 0; - write_unlock_irq(&grp->list_lock); -- up_write(&grp->list_mutex); - - if (!empty) - unsubscribe_port(client, port, grp, &subs->info, ack); -+ up_write(&grp->list_mutex); - } - - /* connect two ports */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 74c9600876d6..ef8955abd918 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1707,9 +1707,6 @@ static int azx_first_init(struct azx *chip) - chip->msi = 0; - } - -- if (azx_acquire_irq(chip, 0) < 0) -- return -EBUSY; -- - pci_set_master(pci); - synchronize_irq(bus->irq); - -@@ -1820,6 +1817,9 @@ static int azx_first_init(struct azx *chip) - return -ENODEV; - } - -+ if (azx_acquire_irq(chip, 0) < 0) -+ return -EBUSY; -+ - strcpy(card->driver, "HDA-Intel"); - strlcpy(card->shortname, driver_short_names[chip->driver_type], - sizeof(card->shortname)); -diff --git a/sound/soc/codecs/cs42xx8.c b/sound/soc/codecs/cs42xx8.c -index d562e1b9a5d1..5b079709ec8a 100644 ---- a/sound/soc/codecs/cs42xx8.c -+++ b/sound/soc/codecs/cs42xx8.c -@@ -561,6 +561,7 @@ static int cs42xx8_runtime_resume(struct device *dev) - msleep(5); - - regcache_cache_only(cs42xx8->regmap, false); -+ regcache_mark_dirty(cs42xx8->regmap); - - ret = regcache_sync(cs42xx8->regmap); - if (ret) { diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.183-184.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.183-184.patch deleted file mode 100644 index 3f085a56f6f6..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.183-184.patch +++ /dev/null @@ -1,25 +0,0 @@ -diff --git a/Makefile b/Makefile -index 4ac762e01e60..f098274d3ac3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 183 -+SUBLEVEL = 184 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index bed83990847a..53edd60fd381 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1161,7 +1161,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, - if (nsize < 0) - nsize = 0; - -- if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) { -+ if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf + 0x20000)) { - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG); - return -ENOMEM; - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.184-185.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.184-185.patch deleted file mode 100644 index 55f8172542ec..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.184-185.patch +++ /dev/null @@ -1,1860 +0,0 @@ -diff --git a/Makefile b/Makefile -index f098274d3ac3..9618663c445a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 184 -+SUBLEVEL = 185 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -636,6 +636,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) - KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) - KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) - KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) -+KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) - KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) - - ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE -@@ -712,8 +713,6 @@ ifeq ($(cc-name),clang) - KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) - KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) - KBUILD_CFLAGS += $(call cc-disable-warning, gnu) --KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) --KBUILD_CFLAGS += $(call cc-disable-warning, duplicate-decl-specifier) - # Quiet clang warning: comparison of unsigned expression < 0 is always false - KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare) - # CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the -diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig -index e983f410135a..a5d8bef65911 100644 ---- a/arch/arc/Kconfig -+++ b/arch/arc/Kconfig -@@ -278,14 +278,6 @@ config ARC_DCCM_BASE - default "0xA0000000" - depends on ARC_HAS_DCCM - --config ARC_HAS_HW_MPY -- bool "Use Hardware Multiplier (Normal or Faster XMAC)" -- default y -- help -- Influences how gcc generates code for MPY operations. -- If enabled, MPYxx insns are generated, provided by Standard/XMAC -- Multipler. Otherwise software multipy lib is used -- - choice - prompt "MMU Version" - default ARC_MMU_V3 if ARC_CPU_770 -diff --git a/arch/arc/Makefile b/arch/arc/Makefile -index fffaff9c7b2c..8f8d53f08141 100644 ---- a/arch/arc/Makefile -+++ b/arch/arc/Makefile -@@ -72,10 +72,6 @@ ldflags-$(CONFIG_CPU_BIG_ENDIAN) += -EB - # --build-id w/o "-marclinux". Default arc-elf32-ld is OK - ldflags-$(upto_gcc44) += -marclinux - --ifndef CONFIG_ARC_HAS_HW_MPY -- cflags-y += -mno-mpy --endif -- - LIBGCC := $(shell $(CC) $(cflags-y) --print-libgcc-file-name) - - # Modules with short calls might break for calls into builtin-kernel -diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h -index ea022d47896c..21ec82466d62 100644 ---- a/arch/arc/include/asm/bug.h -+++ b/arch/arc/include/asm/bug.h -@@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address); - - #define BUG() do { \ - pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ -- dump_stack(); \ -+ barrier_before_unreachable(); \ -+ __builtin_trap(); \ - } while (0) - - #define HAVE_ARCH_BUG -diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h -index 51a99e25fe33..8ee9113b2f8b 100644 ---- a/arch/arc/include/asm/elf.h -+++ b/arch/arc/include/asm/elf.h -@@ -55,7 +55,7 @@ extern int elf_check_arch(const struct elf32_hdr *); - * the loader. We need to make sure that it is out of the way of the program - * that it will "exec", and that there is sufficient room for the brk. - */ --#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3) -+#define ELF_ET_DYN_BASE (2UL * TASK_SIZE / 3) - - /* - * When the program starts, a1 contains a pointer to a function to be -diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c -index 05131805aa33..3013f3f82b95 100644 ---- a/arch/arc/kernel/setup.c -+++ b/arch/arc/kernel/setup.c -@@ -232,8 +232,6 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len) - - n += scnprintf(buf + n, len - n, "mpy[opt %d] ", opt); - } -- n += scnprintf(buf + n, len - n, "%s", -- IS_USED_CFG(CONFIG_ARC_HAS_HW_MPY)); - } - - n += scnprintf(buf + n, len - n, "%s%s%s%s%s%s%s%s\n", -diff --git a/arch/arc/kernel/traps.c b/arch/arc/kernel/traps.c -index c927aa84e652..2fb0cd39a31c 100644 ---- a/arch/arc/kernel/traps.c -+++ b/arch/arc/kernel/traps.c -@@ -155,3 +155,11 @@ void do_insterror_or_kprobe(unsigned long address, struct pt_regs *regs) - - insterror_is_error(address, regs); - } -+ -+/* -+ * abort() call generated by older gcc for __builtin_trap() -+ */ -+void abort(void) -+{ -+ __asm__ __volatile__("trap_s 5\n"); -+} -diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c -index 7f5df8992008..1127e500bea3 100644 ---- a/arch/arm/mach-imx/cpuidle-imx6sx.c -+++ b/arch/arm/mach-imx/cpuidle-imx6sx.c -@@ -14,6 +14,7 @@ - - #include "common.h" - #include "cpuidle.h" -+#include "hardware.h" - - static int imx6sx_idle_finish(unsigned long val) - { -@@ -97,7 +98,7 @@ int __init imx6sx_cpuidle_init(void) - * except for power up sw2iso which need to be - * larger than LDO ramp up time. - */ -- imx_gpc_set_arm_power_up_timing(0xf, 1); -+ imx_gpc_set_arm_power_up_timing(cpu_is_imx6sx() ? 0xf : 0x2, 1); - imx_gpc_set_arm_power_down_timing(1, 1); - - return cpuidle_register(&imx6sx_cpuidle_driver, NULL); -diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h -index 823616b5020b..19067821249f 100644 ---- a/arch/ia64/include/asm/bug.h -+++ b/arch/ia64/include/asm/bug.h -@@ -3,7 +3,11 @@ - - #ifdef CONFIG_BUG - #define ia64_abort() __builtin_trap() --#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0) -+#define BUG() do { \ -+ printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ -+ barrier_before_unreachable(); \ -+ ia64_abort(); \ -+} while (0) - - /* should this BUG be made generic? */ - #define HAVE_ARCH_BUG -diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h -index ef9a2e47352f..21ddbf925e22 100644 ---- a/arch/m68k/include/asm/bug.h -+++ b/arch/m68k/include/asm/bug.h -@@ -7,16 +7,19 @@ - #ifndef CONFIG_SUN3 - #define BUG() do { \ - printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ -+ barrier_before_unreachable(); \ - __builtin_trap(); \ - } while (0) - #else - #define BUG() do { \ - printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ -+ barrier_before_unreachable(); \ - panic("BUG!"); \ - } while (0) - #endif - #else - #define BUG() do { \ -+ barrier_before_unreachable(); \ - __builtin_trap(); \ - } while (0) - #endif -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 333ea0389adb..687a3eb8d4d9 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -13,6 +13,7 @@ config MIPS - select HAVE_OPROFILE - select HAVE_PERF_EVENTS - select PERF_USE_VMALLOC -+ select HAVE_ARCH_COMPILER_H - select HAVE_ARCH_KGDB - select HAVE_ARCH_SECCOMP_FILTER - select HAVE_ARCH_TRACEHOOK -diff --git a/arch/mips/include/asm/compiler.h b/arch/mips/include/asm/compiler.h -index e081a265f422..cc2eb1b06050 100644 ---- a/arch/mips/include/asm/compiler.h -+++ b/arch/mips/include/asm/compiler.h -@@ -8,6 +8,41 @@ - #ifndef _ASM_COMPILER_H - #define _ASM_COMPILER_H - -+/* -+ * With GCC 4.5 onwards we can use __builtin_unreachable to indicate to the -+ * compiler that a particular code path will never be hit. This allows it to be -+ * optimised out of the generated binary. -+ * -+ * Unfortunately at least GCC 4.6.3 through 7.3.0 inclusive suffer from a bug -+ * that can lead to instructions from beyond an unreachable statement being -+ * incorrectly reordered into earlier delay slots if the unreachable statement -+ * is the only content of a case in a switch statement. This can lead to -+ * seemingly random behaviour, such as invalid memory accesses from incorrectly -+ * reordered loads or stores. See this potential GCC fix for details: -+ * -+ * https://gcc.gnu.org/ml/gcc-patches/2015-09/msg00360.html -+ * -+ * It is unclear whether GCC 8 onwards suffer from the same issue - nothing -+ * relevant is mentioned in GCC 8 release notes and nothing obviously relevant -+ * stands out in GCC commit logs, but these newer GCC versions generate very -+ * different code for the testcase which doesn't exhibit the bug. -+ * -+ * GCC also handles stack allocation suboptimally when calling noreturn -+ * functions or calling __builtin_unreachable(): -+ * -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 -+ * -+ * We work around both of these issues by placing a volatile asm statement, -+ * which GCC is prevented from reordering past, prior to __builtin_unreachable -+ * calls. -+ * -+ * The .insn statement is required to ensure that any branches to the -+ * statement, which sadly must be kept due to the asm statement, are known to -+ * be branches to code and satisfy linker requirements for microMIPS kernels. -+ */ -+#undef barrier_before_unreachable -+#define barrier_before_unreachable() asm volatile(".insn") -+ - #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4) - #define GCC_IMM_ASM() "n" - #define GCC_REG_ACCUM "$0" -diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c -index 4e7b89f2e244..1363d705cc8c 100644 ---- a/arch/mips/kernel/uprobes.c -+++ b/arch/mips/kernel/uprobes.c -@@ -164,9 +164,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs) - */ - aup->resume_epc = regs->cp0_epc + 4; - if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) { -- unsigned long epc; -- -- epc = regs->cp0_epc; - __compute_return_epc_for_insn(regs, - (union mips_instruction) aup->insn[0]); - aup->resume_epc = regs->cp0_epc; -diff --git a/arch/parisc/math-emu/cnv_float.h b/arch/parisc/math-emu/cnv_float.h -index 933423fa5144..b0db61188a61 100644 ---- a/arch/parisc/math-emu/cnv_float.h -+++ b/arch/parisc/math-emu/cnv_float.h -@@ -60,19 +60,19 @@ - ((exponent < (SGL_P - 1)) ? \ - (Sall(sgl_value) << (SGL_EXP_LENGTH + 1 + exponent)) : FALSE) - --#define Int_isinexact_to_sgl(int_value) (int_value << 33 - SGL_EXP_LENGTH) -+#define Int_isinexact_to_sgl(int_value) ((int_value << 33 - SGL_EXP_LENGTH) != 0) - - #define Sgl_roundnearest_from_int(int_value,sgl_value) \ - if (int_value & 1<<(SGL_EXP_LENGTH - 2)) /* round bit */ \ -- if ((int_value << 34 - SGL_EXP_LENGTH) || Slow(sgl_value)) \ -+ if (((int_value << 34 - SGL_EXP_LENGTH) != 0) || Slow(sgl_value)) \ - Sall(sgl_value)++ - - #define Dint_isinexact_to_sgl(dint_valueA,dint_valueB) \ -- ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB)) -+ (((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) != 0) || Dintp2(dint_valueB)) - - #define Sgl_roundnearest_from_dint(dint_valueA,dint_valueB,sgl_value) \ - if (Dintp1(dint_valueA) & 1<<(SGL_EXP_LENGTH - 2)) \ -- if ((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) || \ -+ if (((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) != 0) || \ - Dintp2(dint_valueB) || Slow(sgl_value)) Sall(sgl_value)++ - - #define Dint_isinexact_to_dbl(dint_value) \ -diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h -index eaa8f8d38125..fa85cac0285c 100644 ---- a/arch/sparc/include/asm/bug.h -+++ b/arch/sparc/include/asm/bug.h -@@ -8,10 +8,14 @@ - void do_BUG(const char *file, int line); - #define BUG() do { \ - do_BUG(__FILE__, __LINE__); \ -+ barrier_before_unreachable(); \ - __builtin_trap(); \ - } while (0) - #else --#define BUG() __builtin_trap() -+#define BUG() do { \ -+ barrier_before_unreachable(); \ -+ __builtin_trap(); \ -+} while (0) - #endif - - #define HAVE_ARCH_BUG -diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c -index a5d0c2f08110..815352d501f0 100644 ---- a/arch/sparc/kernel/perf_event.c -+++ b/arch/sparc/kernel/perf_event.c -@@ -889,6 +889,10 @@ static int sparc_perf_event_set_period(struct perf_event *event, - s64 period = hwc->sample_period; - int ret = 0; - -+ /* The period may have been changed by PERF_EVENT_IOC_PERIOD */ -+ if (unlikely(period != hwc->last_period)) -+ left = period - (hwc->last_period - left); -+ - if (unlikely(left <= -period)) { - left = period; - local64_set(&hwc->period_left, left); -diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c -index 26e0164895e4..6e6f6d28d54b 100644 ---- a/arch/um/os-Linux/file.c -+++ b/arch/um/os-Linux/file.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c -index 56648f4f8b41..5da50451d372 100644 ---- a/arch/um/os-Linux/signal.c -+++ b/arch/um/os-Linux/signal.c -@@ -14,7 +14,9 @@ - #include - #include - #include -+#include - #include -+#include - - void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = { - [SIGTRAP] = relay_signal, -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 2017fa20611c..310e279be0d8 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -806,6 +806,16 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) - break; - } - -+ /* -+ * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper -+ * bit in the mask to allow guests to use the mitigation even in the -+ * case where the host does not enable it. -+ */ -+ if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) || -+ static_cpu_has(X86_FEATURE_AMD_SSBD)) { -+ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; -+ } -+ - /* - * We have three CPU feature flags that are in play here: - * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible. -@@ -823,7 +833,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void) - x86_amd_ssb_disable(); - } else { - x86_spec_ctrl_base |= SPEC_CTRL_SSBD; -- x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; - wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); - } - } -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 516d8b1562c8..66adcd00b3dd 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1293,7 +1293,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) - vcpu->arch.tsc_always_catchup = 1; - return 0; - } else { -- WARN(1, "user requested TSC rate below hardware speed\n"); -+ pr_warn_ratelimited("user requested TSC rate below hardware speed\n"); - return -1; - } - } -@@ -1303,8 +1303,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale) - user_tsc_khz, tsc_khz); - - if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) { -- WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", -- user_tsc_khz); -+ pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n", -+ user_tsc_khz); - return -1; - } - -@@ -6409,7 +6409,8 @@ static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu) - kvm_scan_ioapic_routes(vcpu, vcpu->arch.eoi_exit_bitmap); - else { - kvm_x86_ops->sync_pir_to_irr(vcpu); -- kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap); -+ if (ioapic_in_kernel(vcpu->kvm)) -+ kvm_ioapic_scan_entry(vcpu, vcpu->arch.eoi_exit_bitmap); - } - kvm_x86_ops->load_eoi_exitmap(vcpu); - } -diff --git a/arch/x86/um/stub_segv.c b/arch/x86/um/stub_segv.c -index fd6825537b97..27361cbb7ca9 100644 ---- a/arch/x86/um/stub_segv.c -+++ b/arch/x86/um/stub_segv.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - - void __attribute__ ((__section__ (".__syscall_stub"))) - stub_segv_handler(int sig, siginfo_t *info, void *p) -diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c -index 7097a3395b25..b93c6db18ed3 100644 ---- a/crypto/crypto_user.c -+++ b/crypto/crypto_user.c -@@ -54,6 +54,9 @@ static struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact) - list_for_each_entry(q, &crypto_alg_list, cra_list) { - int match = 0; - -+ if (crypto_is_larval(q)) -+ continue; -+ - if ((q->cra_flags ^ p->cru_type) & p->cru_mask) - continue; - -diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c -index 48d4dddf4941..4054747af0cb 100644 ---- a/drivers/dma/imx-sdma.c -+++ b/drivers/dma/imx-sdma.c -@@ -614,7 +614,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size, - spin_lock_irqsave(&sdma->channel_0_lock, flags); - - bd0->mode.command = C0_SETPM; -- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; -+ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; - bd0->mode.count = size / 2; - bd0->buffer_addr = buf_phys; - bd0->ext_buffer_addr = address; -@@ -883,7 +883,7 @@ static int sdma_load_context(struct sdma_channel *sdmac) - context->gReg[7] = sdmac->watermark_level; - - bd0->mode.command = C0_SETDM; -- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD; -+ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD; - bd0->mode.count = sizeof(*context) / 4; - bd0->buffer_addr = sdma->context_phys; - bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel; -diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c -index c00bad02761a..0d75bc7b5065 100644 ---- a/drivers/hwmon/pmbus/pmbus_core.c -+++ b/drivers/hwmon/pmbus/pmbus_core.c -@@ -1028,14 +1028,15 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, - const struct pmbus_driver_info *info, - const char *name, - int index, int page, -- const struct pmbus_sensor_attr *attr) -+ const struct pmbus_sensor_attr *attr, -+ bool paged) - { - struct pmbus_sensor *base; - int ret; - - if (attr->label) { - ret = pmbus_add_label(data, name, index, attr->label, -- attr->paged ? page + 1 : 0); -+ paged ? page + 1 : 0); - if (ret) - return ret; - } -@@ -1067,6 +1068,30 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, - return 0; - } - -+static bool pmbus_sensor_is_paged(const struct pmbus_driver_info *info, -+ const struct pmbus_sensor_attr *attr) -+{ -+ int p; -+ -+ if (attr->paged) -+ return true; -+ -+ /* -+ * Some attributes may be present on more than one page despite -+ * not being marked with the paged attribute. If that is the case, -+ * then treat the sensor as being paged and add the page suffix to the -+ * attribute name. -+ * We don't just add the paged attribute to all such attributes, in -+ * order to maintain the un-suffixed labels in the case where the -+ * attribute is only on page 0. -+ */ -+ for (p = 1; p < info->pages; p++) { -+ if (info->func[p] & attr->func) -+ return true; -+ } -+ return false; -+} -+ - static int pmbus_add_sensor_attrs(struct i2c_client *client, - struct pmbus_data *data, - const char *name, -@@ -1080,14 +1105,15 @@ static int pmbus_add_sensor_attrs(struct i2c_client *client, - index = 1; - for (i = 0; i < nattrs; i++) { - int page, pages; -+ bool paged = pmbus_sensor_is_paged(info, attrs); - -- pages = attrs->paged ? info->pages : 1; -+ pages = paged ? info->pages : 1; - for (page = 0; page < pages; page++) { - if (!(info->func[page] & attrs->func)) - continue; - ret = pmbus_add_sensor_attrs_one(client, data, info, - name, index, page, -- attrs); -+ attrs, paged); - if (ret) - return ret; - index++; -diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c -index 2bb4c8633d3b..7cffff22a1ca 100644 ---- a/drivers/input/misc/uinput.c -+++ b/drivers/input/misc/uinput.c -@@ -894,13 +894,31 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - - #ifdef CONFIG_COMPAT - --#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) -+/* -+ * These IOCTLs change their size and thus their numbers between -+ * 32 and 64 bits. -+ */ -+#define UI_SET_PHYS_COMPAT \ -+ _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) -+#define UI_BEGIN_FF_UPLOAD_COMPAT \ -+ _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat) -+#define UI_END_FF_UPLOAD_COMPAT \ -+ _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat) - - static long uinput_compat_ioctl(struct file *file, - unsigned int cmd, unsigned long arg) - { -- if (cmd == UI_SET_PHYS_COMPAT) -+ switch (cmd) { -+ case UI_SET_PHYS_COMPAT: - cmd = UI_SET_PHYS; -+ break; -+ case UI_BEGIN_FF_UPLOAD_COMPAT: -+ cmd = UI_BEGIN_FF_UPLOAD; -+ break; -+ case UI_END_FF_UPLOAD_COMPAT: -+ cmd = UI_END_FF_UPLOAD; -+ break; -+ } - - return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); - } -diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c -index fe51e9709210..1093d8ad232b 100644 ---- a/drivers/mfd/omap-usb-tll.c -+++ b/drivers/mfd/omap-usb-tll.c -@@ -129,12 +129,12 @@ static inline u32 usbtll_read(void __iomem *base, u32 reg) - return readl_relaxed(base + reg); - } - --static inline void usbtll_writeb(void __iomem *base, u8 reg, u8 val) -+static inline void usbtll_writeb(void __iomem *base, u32 reg, u8 val) - { - writeb_relaxed(val, base + reg); - } - --static inline u8 usbtll_readb(void __iomem *base, u8 reg) -+static inline u8 usbtll_readb(void __iomem *base, u32 reg) - { - return readb_relaxed(base + reg); - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index fde7f5efc47d..0397afccf3a2 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -4164,13 +4164,13 @@ void bond_setup(struct net_device *bond_dev) - bond_dev->features |= NETIF_F_NETNS_LOCAL; - - bond_dev->hw_features = BOND_VLAN_FEATURES | -- NETIF_F_HW_VLAN_CTAG_TX | - NETIF_F_HW_VLAN_CTAG_RX | - NETIF_F_HW_VLAN_CTAG_FILTER; - - bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM); - bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL; - bond_dev->features |= bond_dev->hw_features; -+ bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX; - } - - /* Destroy a bonding device. -diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c -index 47f43bdecd51..baef09b9449f 100644 ---- a/drivers/net/can/flexcan.c -+++ b/drivers/net/can/flexcan.c -@@ -171,7 +171,7 @@ - #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16) - #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff) - --#define FLEXCAN_TIMEOUT_US (50) -+#define FLEXCAN_TIMEOUT_US (250) - - /* FLEXCAN hardware feature flags - * -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c -index 4b91eb70c683..a2f2db58b5ab 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c -@@ -351,6 +351,7 @@ static int __lb_setup(struct net_device *ndev, - static int __lb_up(struct net_device *ndev, - enum hnae_loop loop_mode) - { -+#define NIC_LB_TEST_WAIT_PHY_LINK_TIME 300 - struct hns_nic_priv *priv = netdev_priv(ndev); - struct hnae_handle *h = priv->ae_handle; - int speed, duplex; -@@ -389,6 +390,9 @@ static int __lb_up(struct net_device *ndev, - - h->dev->ops->adjust_link(h, speed, duplex); - -+ /* wait adjust link done and phy ready */ -+ msleep(NIC_LB_TEST_WAIT_PHY_LINK_TIME); -+ - return 0; - } - -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index 7b3ef6dc45a4..285d376f53ef 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -2091,12 +2091,12 @@ static void team_setup(struct net_device *dev) - dev->features |= NETIF_F_NETNS_LOCAL; - - dev->hw_features = TEAM_VLAN_FEATURES | -- NETIF_F_HW_VLAN_CTAG_TX | - NETIF_F_HW_VLAN_CTAG_RX | - NETIF_F_HW_VLAN_CTAG_FILTER; - - dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM); - dev->features |= dev->hw_features; -+ dev->features |= NETIF_F_HW_VLAN_CTAG_TX; - } - - static int team_newlink(struct net *src_net, struct net_device *dev, -diff --git a/drivers/parport/share.c b/drivers/parport/share.c -index 754f21fd9768..f26af0214ab3 100644 ---- a/drivers/parport/share.c -+++ b/drivers/parport/share.c -@@ -892,6 +892,7 @@ parport_register_dev_model(struct parport *port, const char *name, - par_dev->devmodel = true; - ret = device_register(&par_dev->dev); - if (ret) { -+ kfree(par_dev->state); - put_device(&par_dev->dev); - goto err_put_port; - } -@@ -909,6 +910,7 @@ parport_register_dev_model(struct parport *port, const char *name, - spin_unlock(&port->physport->pardevice_lock); - pr_debug("%s: cannot grant exclusive access for device %s\n", - port->name, name); -+ kfree(par_dev->state); - device_unregister(&par_dev->dev); - goto err_put_port; - } -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index 34d3b7aff513..22045e7d78ac 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -2112,7 +2112,7 @@ static void qeth_bridgeport_an_set_cb(void *priv, - - l2entry = (struct qdio_brinfo_entry_l2 *)entry; - code = IPA_ADDR_CHANGE_CODE_MACADDR; -- if (l2entry->addr_lnid.lnid) -+ if (l2entry->addr_lnid.lnid < VLAN_N_VID) - code |= IPA_ADDR_CHANGE_CODE_VLANID; - qeth_bridge_emit_host_event(card, anev_reg_unreg, code, - (struct net_if_token *)&l2entry->nit, -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 910b795fc5eb..e0952882e132 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -4562,7 +4562,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, - curr_sg->reserved[0] = 0; - curr_sg->reserved[1] = 0; - curr_sg->reserved[2] = 0; -- curr_sg->chain_indicator = 0x80; -+ curr_sg->chain_indicator = IOACCEL2_CHAIN; - - curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex]; - } -@@ -4579,6 +4579,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h, - curr_sg++; - } - -+ /* -+ * Set the last s/g element bit -+ */ -+ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG; -+ - switch (cmd->sc_data_direction) { - case DMA_TO_DEVICE: - cp->direction &= ~IOACCEL2_DIRECTION_MASK; -diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h -index 26488e2a7f02..7ffde12d57d4 100644 ---- a/drivers/scsi/hpsa_cmd.h -+++ b/drivers/scsi/hpsa_cmd.h -@@ -513,6 +513,7 @@ struct ioaccel2_sg_element { - u8 reserved[3]; - u8 chain_indicator; - #define IOACCEL2_CHAIN 0x80 -+#define IOACCEL2_LAST_SG 0x40 - }; - - /* -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 7322a17660d1..b140e81c4f7d 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -853,7 +853,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) - memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE); - - /* Get the descriptor */ -- if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { -+ if (hba->dev_cmd.query.descriptor && -+ lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) { - u8 *descp = (u8 *)lrbp->ucd_rsp_ptr + - GENERAL_UPIU_REQUEST_SIZE; - u16 resp_len; -diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c -index 23081ed8f1e3..3f2a5d6c437b 100644 ---- a/drivers/scsi/vmw_pvscsi.c -+++ b/drivers/scsi/vmw_pvscsi.c -@@ -733,6 +733,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd - struct pvscsi_adapter *adapter = shost_priv(host); - struct pvscsi_ctx *ctx; - unsigned long flags; -+ unsigned char op; - - spin_lock_irqsave(&adapter->hw_lock, flags); - -@@ -745,13 +746,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd - } - - cmd->scsi_done = done; -+ op = cmd->cmnd[0]; - - dev_dbg(&cmd->device->sdev_gendev, -- "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]); -+ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op); - - spin_unlock_irqrestore(&adapter->hw_lock, flags); - -- pvscsi_kick_io(adapter, cmd->cmnd[0]); -+ pvscsi_kick_io(adapter, op); - - return 0; - } -diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c -index 3aa9e6e3dac8..4ef54436b9d4 100644 ---- a/drivers/spi/spi-bitbang.c -+++ b/drivers/spi/spi-bitbang.c -@@ -392,7 +392,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang) - if (ret) - spi_master_put(master); - -- return 0; -+ return ret; - } - EXPORT_SYMBOL_GPL(spi_bitbang_start); - -diff --git a/drivers/staging/rdma/hfi1/chip.c b/drivers/staging/rdma/hfi1/chip.c -index e48981994b10..e1531feb6c5d 100644 ---- a/drivers/staging/rdma/hfi1/chip.c -+++ b/drivers/staging/rdma/hfi1/chip.c -@@ -5906,6 +5906,7 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd) - - /* disable the port */ - clear_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK); -+ cancel_work_sync(&ppd->freeze_work); - } - - static inline int init_cpu_counters(struct hfi1_devdata *dd) -diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c -index 2b8f2e0a4224..ec6d20f25e8b 100644 ---- a/drivers/tty/rocket.c -+++ b/drivers/tty/rocket.c -@@ -279,7 +279,7 @@ MODULE_PARM_DESC(pc104_3, "set interface types for ISA(PC104) board #3 (e.g. pc1 - module_param_array(pc104_4, ulong, NULL, 0); - MODULE_PARM_DESC(pc104_4, "set interface types for ISA(PC104) board #4 (e.g. pc104_4=232,232,485,485,..."); - --static int rp_init(void); -+static int __init rp_init(void); - static void rp_cleanup_module(void); - - module_init(rp_init); -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index aff086ca97e4..6b06efcfd4b2 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -1614,6 +1614,25 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on) - static int ci_udc_start(struct usb_gadget *gadget, - struct usb_gadget_driver *driver); - static int ci_udc_stop(struct usb_gadget *gadget); -+ -+/* Match ISOC IN from the highest endpoint */ -+static struct usb_ep *ci_udc_match_ep(struct usb_gadget *gadget, -+ struct usb_endpoint_descriptor *desc, -+ struct usb_ss_ep_comp_descriptor *comp_desc) -+{ -+ struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget); -+ struct usb_ep *ep; -+ -+ if (usb_endpoint_xfer_isoc(desc) && usb_endpoint_dir_in(desc)) { -+ list_for_each_entry_reverse(ep, &ci->gadget.ep_list, ep_list) { -+ if (ep->caps.dir_in && !ep->claimed) -+ return ep; -+ } -+ } -+ -+ return NULL; -+} -+ - /** - * Device operations part of the API to the USB controller hardware, - * which don't involve endpoints (or i/o) -@@ -1627,6 +1646,7 @@ static const struct usb_gadget_ops usb_gadget_ops = { - .vbus_draw = ci_udc_vbus_draw, - .udc_start = ci_udc_start, - .udc_stop = ci_udc_stop, -+ .match_ep = ci_udc_match_ep, - }; - - static int init_eps(struct ci_hdrc *ci) -diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c -index 948845c90e47..351012c498c5 100644 ---- a/drivers/usb/gadget/udc/fusb300_udc.c -+++ b/drivers/usb/gadget/udc/fusb300_udc.c -@@ -1345,12 +1345,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = { - static int fusb300_remove(struct platform_device *pdev) - { - struct fusb300 *fusb300 = platform_get_drvdata(pdev); -+ int i; - - usb_del_gadget_udc(&fusb300->gadget); - iounmap(fusb300->reg); - free_irq(platform_get_irq(pdev, 0), fusb300); - - fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); -+ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) -+ kfree(fusb300->ep[i]); - kfree(fusb300); - - return 0; -@@ -1494,6 +1497,8 @@ clean_up: - if (fusb300->ep0_req) - fusb300_free_request(&fusb300->ep[0]->ep, - fusb300->ep0_req); -+ for (i = 0; i < FUSB300_MAX_NUM_EP; i++) -+ kfree(fusb300->ep[i]); - kfree(fusb300); - } - if (reg) -diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c -index 00b5006baf15..90d24f62bd81 100644 ---- a/drivers/usb/gadget/udc/lpc32xx_udc.c -+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c -@@ -964,8 +964,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc) - dma_addr_t dma; - struct lpc32xx_usbd_dd_gad *dd; - -- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc( -- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma); -+ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma); - if (dd) - dd->this_dma = dma; - -diff --git a/fs/9p/acl.c b/fs/9p/acl.c -index c30c6ceac2c4..d02ee4026e32 100644 ---- a/fs/9p/acl.c -+++ b/fs/9p/acl.c -@@ -282,7 +282,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, - switch (handler->flags) { - case ACL_TYPE_ACCESS: - if (acl) { -- struct iattr iattr; -+ struct iattr iattr = { 0 }; - struct posix_acl *old_acl = acl; - - retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); -diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c -index f723cd3a455c..cc7bf84ef77c 100644 ---- a/fs/binfmt_flat.c -+++ b/fs/binfmt_flat.c -@@ -808,9 +808,14 @@ err: - - static int load_flat_shared_library(int id, struct lib_info *libs) - { -+ /* -+ * This is a fake bprm struct; only the members "buf", "file" and -+ * "filename" are actually used. -+ */ - struct linux_binprm bprm; - int res; - char buf[16]; -+ loff_t pos = 0; - - memset(&bprm, 0, sizeof(bprm)); - -@@ -824,25 +829,10 @@ static int load_flat_shared_library(int id, struct lib_info *libs) - if (IS_ERR(bprm.file)) - return res; - -- bprm.cred = prepare_exec_creds(); -- res = -ENOMEM; -- if (!bprm.cred) -- goto out; -- -- /* We don't really care about recalculating credentials at this point -- * as we're past the point of no return and are dealing with shared -- * libraries. -- */ -- bprm.cred_prepared = 1; -- -- res = prepare_binprm(&bprm); -- -- if (!IS_ERR_VALUE(res)) -+ res = kernel_read(bprm.file, pos, bprm.buf, BINPRM_BUF_SIZE); -+ if (res >= 0) - res = load_flat_file(&bprm, libs, id, NULL); - -- abort_creds(bprm.cred); -- --out: - allow_write_access(bprm.file); - fput(bprm.file); - -diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c -index 81e5bc62e8e3..1414a99b3ab4 100644 ---- a/fs/btrfs/dev-replace.c -+++ b/fs/btrfs/dev-replace.c -@@ -495,18 +495,27 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, - } - btrfs_wait_ordered_roots(root->fs_info, -1); - -- trans = btrfs_start_transaction(root, 0); -- if (IS_ERR(trans)) { -- mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); -- return PTR_ERR(trans); -+ while (1) { -+ trans = btrfs_start_transaction(root, 0); -+ if (IS_ERR(trans)) { -+ mutex_unlock(&dev_replace->lock_finishing_cancel_unmount); -+ return PTR_ERR(trans); -+ } -+ ret = btrfs_commit_transaction(trans, root); -+ WARN_ON(ret); -+ mutex_lock(&uuid_mutex); -+ /* keep away write_all_supers() during the finishing procedure */ -+ mutex_lock(&root->fs_info->fs_devices->device_list_mutex); -+ mutex_lock(&root->fs_info->chunk_mutex); -+ if (src_device->has_pending_chunks) { -+ mutex_unlock(&root->fs_info->chunk_mutex); -+ mutex_unlock(&root->fs_info->fs_devices->device_list_mutex); -+ mutex_unlock(&uuid_mutex); -+ } else { -+ break; -+ } - } -- ret = btrfs_commit_transaction(trans, root); -- WARN_ON(ret); - -- mutex_lock(&uuid_mutex); -- /* keep away write_all_supers() during the finishing procedure */ -- mutex_lock(&root->fs_info->fs_devices->device_list_mutex); -- mutex_lock(&root->fs_info->chunk_mutex); - btrfs_dev_replace_lock(dev_replace); - dev_replace->replace_state = - scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED -diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c -index 619f92963e27..f2af1f3d4aa8 100644 ---- a/fs/btrfs/reada.c -+++ b/fs/btrfs/reada.c -@@ -762,16 +762,23 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info) - u64 total = 0; - int i; - -+again: - do { - enqueued = 0; -+ mutex_lock(&fs_devices->device_list_mutex); - list_for_each_entry(device, &fs_devices->devices, dev_list) { - if (atomic_read(&device->reada_in_flight) < - MAX_IN_FLIGHT) - enqueued += reada_start_machine_dev(fs_info, - device); - } -+ mutex_unlock(&fs_devices->device_list_mutex); - total += enqueued; - } while (enqueued && total < 10000); -+ if (fs_devices->seed) { -+ fs_devices = fs_devices->seed; -+ goto again; -+ } - - if (enqueued == 0) - return; -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index d1cca19b29d3..4eb7a6ba7e47 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -4760,6 +4760,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, - for (i = 0; i < map->num_stripes; i++) { - num_bytes = map->stripes[i].dev->bytes_used + stripe_size; - btrfs_device_set_bytes_used(map->stripes[i].dev, num_bytes); -+ map->stripes[i].dev->has_pending_chunks = true; - } - - spin_lock(&extent_root->fs_info->free_chunk_lock); -@@ -7064,6 +7065,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_root *root, - for (i = 0; i < map->num_stripes; i++) { - dev = map->stripes[i].dev; - dev->commit_bytes_used = dev->bytes_used; -+ dev->has_pending_chunks = false; - } - } - unlock_chunks(root); -diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h -index 3c651df420be..7feac2d9da56 100644 ---- a/fs/btrfs/volumes.h -+++ b/fs/btrfs/volumes.h -@@ -62,6 +62,11 @@ struct btrfs_device { - - spinlock_t io_lock ____cacheline_aligned; - int running_pending; -+ /* When true means this device has pending chunk alloc in -+ * current transaction. Protected by chunk_mutex. -+ */ -+ bool has_pending_chunks; -+ - /* regular prio bios */ - struct btrfs_pending_bios pending_bios; - /* WRITE_SYNC bios */ -diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c -index 7e93d5706bf6..4d0d4076de5a 100644 ---- a/fs/cifs/smb2maperror.c -+++ b/fs/cifs/smb2maperror.c -@@ -455,7 +455,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = { - {STATUS_FILE_INVALID, -EIO, "STATUS_FILE_INVALID"}, - {STATUS_ALLOTTED_SPACE_EXCEEDED, -EIO, - "STATUS_ALLOTTED_SPACE_EXCEEDED"}, -- {STATUS_INSUFFICIENT_RESOURCES, -EREMOTEIO, -+ {STATUS_INSUFFICIENT_RESOURCES, -EAGAIN, - "STATUS_INSUFFICIENT_RESOURCES"}, - {STATUS_DFS_EXIT_PATH_FOUND, -EIO, "STATUS_DFS_EXIT_PATH_FOUND"}, - {STATUS_DEVICE_DATA_ERROR, -EIO, "STATUS_DEVICE_DATA_ERROR"}, -diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c -index 985a4cdae06d..9aff8178aa8c 100644 ---- a/fs/overlayfs/inode.c -+++ b/fs/overlayfs/inode.c -@@ -9,6 +9,7 @@ - - #include - #include -+#include - #include - #include "overlayfs.h" - -@@ -91,6 +92,7 @@ int ovl_permission(struct inode *inode, int mask) - struct ovl_entry *oe; - struct dentry *alias = NULL; - struct inode *realinode; -+ const struct cred *old_cred; - struct dentry *realdentry; - bool is_upper; - int err; -@@ -143,7 +145,18 @@ int ovl_permission(struct inode *inode, int mask) - goto out_dput; - } - -+ /* -+ * Check overlay inode with the creds of task and underlying inode -+ * with creds of mounter -+ */ -+ err = generic_permission(inode, mask); -+ if (err) -+ goto out_dput; -+ -+ old_cred = ovl_override_creds(inode->i_sb); - err = __inode_permission(realinode, mask); -+ revert_creds(old_cred); -+ - out_dput: - dput(alias); - return err; -diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h -index 630dd2372238..09aa521a0085 100644 ---- a/include/asm-generic/bug.h -+++ b/include/asm-generic/bug.h -@@ -47,6 +47,7 @@ struct bug_entry { - #ifndef HAVE_ARCH_BUG - #define BUG() do { \ - printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ -+ barrier_before_unreachable(); \ - panic("BUG!"); \ - } while (0) - #endif -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 143d40e8a1ea..af8b4a879934 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -206,6 +206,15 @@ - #endif /* GCC_VERSION >= 40300 */ - - #if GCC_VERSION >= 40500 -+/* -+ * calling noreturn functions, __builtin_unreachable() and __builtin_trap() -+ * confuse the stack allocation in gcc, leading to overly large stack -+ * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 -+ * -+ * Adding an empty inline assembly before it works around the problem -+ */ -+#define barrier_before_unreachable() asm volatile("") -+ - /* - * Mark a position in code as unreachable. This can be used to - * suppress control flow warnings after asm blocks that transfer -@@ -215,7 +224,11 @@ - * this in the preprocessor, but we can live with this because they're - * unreleased. Really, we need to have autoconf for the kernel. - */ --#define unreachable() __builtin_unreachable() -+#define unreachable() \ -+ do { \ -+ barrier_before_unreachable(); \ -+ __builtin_unreachable(); \ -+ } while (0) - - /* Mark a function definition as prohibited from being cloned. */ - #define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index 0db1fa621d8a..ed772311ec1f 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -175,6 +175,11 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); - # define barrier_data(ptr) barrier() - #endif - -+/* workaround for GCC PR82365 if needed */ -+#ifndef barrier_before_unreachable -+# define barrier_before_unreachable() do { } while (0) -+#endif -+ - /* Unreachable code */ - #ifndef unreachable - # define unreachable() do { } while (1) -diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h -index e7a018eaf3a2..017fced60242 100644 ---- a/include/linux/swiotlb.h -+++ b/include/linux/swiotlb.h -@@ -1,10 +1,13 @@ - #ifndef __LINUX_SWIOTLB_H - #define __LINUX_SWIOTLB_H - -+#include -+#include - #include - - struct device; - struct dma_attrs; -+struct page; - struct scatterlist; - - extern int swiotlb_force; -diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 876688b5a356..7c0c83dfe86e 100644 ---- a/include/net/bluetooth/hci_core.h -+++ b/include/net/bluetooth/hci_core.h -@@ -174,6 +174,9 @@ struct adv_info { - - #define HCI_MAX_SHORT_NAME_LENGTH 10 - -+/* Min encryption key size to match with SMP */ -+#define HCI_MIN_ENC_KEY_SIZE 7 -+ - /* Default LE RPA expiry time, 15 minutes */ - #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60) - -diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h -index 1d67fb6b23a0..6d238506d49b 100644 ---- a/include/net/busy_poll.h -+++ b/include/net/busy_poll.h -@@ -93,7 +93,7 @@ static inline bool sk_busy_loop(struct sock *sk, int nonblock) - goto out; - - ops = napi->dev->netdev_ops; -- if (!ops->ndo_busy_poll) -+ if (!ops || !ops->ndo_busy_poll) - goto out; - - do { -diff --git a/kernel/cpu.c b/kernel/cpu.c -index 3225c3a9d028..985195bd03e4 100644 ---- a/kernel/cpu.c -+++ b/kernel/cpu.c -@@ -851,6 +851,9 @@ static int __init mitigations_parse_cmdline(char *arg) - cpu_mitigations = CPU_MITIGATIONS_OFF; - else if (!strcmp(arg, "auto")) - cpu_mitigations = CPU_MITIGATIONS_AUTO; -+ else -+ pr_crit("Unsupported mitigations=%s, system may still be vulnerable\n", -+ arg); - - return 0; - } -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index 1aa33fe37aa8..da8c358930fb 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -45,9 +45,7 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, - */ - static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) - { -- rcu_read_lock(); -- __ptrace_link(child, new_parent, __task_cred(new_parent)); -- rcu_read_unlock(); -+ __ptrace_link(child, new_parent, current_cred()); - } - - /** -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index ae00e68ceae3..cab210695f66 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -7189,12 +7189,8 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) - - cnt++; - -- /* reset all but tr, trace, and overruns */ -- memset(&iter.seq, 0, -- sizeof(struct trace_iterator) - -- offsetof(struct trace_iterator, seq)); -+ trace_iterator_reset(&iter); - iter.iter_flags |= TRACE_FILE_LAT_FMT; -- iter.pos = -1; - - if (trace_find_next_entry_inc(&iter) != NULL) { - int ret; -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 919d9d07686f..12a82a7ad5a6 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -1381,4 +1381,22 @@ static inline void trace_event_enum_update(struct trace_enum_map **map, int len) - - extern struct trace_iterator *tracepoint_print_iter; - -+/* -+ * Reset the state of the trace_iterator so that it can read consumed data. -+ * Normally, the trace_iterator is used for reading the data when it is not -+ * consumed, and must retain state. -+ */ -+static __always_inline void trace_iterator_reset(struct trace_iterator *iter) -+{ -+ const size_t offset = offsetof(struct trace_iterator, seq); -+ -+ /* -+ * Keep gcc from complaining about overwriting more than just one -+ * member in the structure. -+ */ -+ memset((char *)iter + offset, 0, sizeof(struct trace_iterator) - offset); -+ -+ iter->pos = -1; -+} -+ - #endif /* _LINUX_KERNEL_TRACE_H */ -diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c -index 896458285fdd..cf6337dc41f4 100644 ---- a/kernel/trace/trace_kdb.c -+++ b/kernel/trace/trace_kdb.c -@@ -40,12 +40,8 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file) - - kdb_printf("Dumping ftrace buffer:\n"); - -- /* reset all but tr, trace, and overruns */ -- memset(&iter.seq, 0, -- sizeof(struct trace_iterator) - -- offsetof(struct trace_iterator, seq)); -+ trace_iterator_reset(&iter); - iter.iter_flags |= TRACE_FILE_LAT_FMT; -- iter.pos = -1; - - if (cpu_file == RING_BUFFER_ALL_CPUS) { - for_each_tracing_cpu(cpu) { -diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c -index 468fb7cd1221..edf345b7f06b 100644 ---- a/lib/mpi/mpi-pow.c -+++ b/lib/mpi/mpi-pow.c -@@ -37,6 +37,7 @@ - int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - { - mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL; -+ struct karatsuba_ctx karactx = {}; - mpi_ptr_t xp_marker = NULL; - mpi_ptr_t tspace = NULL; - mpi_ptr_t rp, ep, mp, bp; -@@ -164,13 +165,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - int c; - mpi_limb_t e; - mpi_limb_t carry_limb; -- struct karatsuba_ctx karactx; - - xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1)); - if (!xp) - goto enomem; - -- memset(&karactx, 0, sizeof karactx); - negative_result = (ep[0] & 1) && base->sign; - - i = esize - 1; -@@ -295,8 +294,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - if (mod_shift_cnt) - mpihelp_rshift(rp, rp, rsize, mod_shift_cnt); - MPN_NORMALIZE(rp, rsize); -- -- mpihelp_release_karatsuba_ctx(&karactx); - } - - if (negative_result && rsize) { -@@ -313,6 +310,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - leave: - rc = 0; - enomem: -+ mpihelp_release_karatsuba_ctx(&karactx); - if (assign_rp) - mpi_assign_limb_space(res, rp, size); - if (mp_marker) -diff --git a/mm/page_idle.c b/mm/page_idle.c -index d5dd79041484..fd75ae838f42 100644 ---- a/mm/page_idle.c -+++ b/mm/page_idle.c -@@ -130,7 +130,7 @@ static ssize_t page_idle_bitmap_read(struct file *file, struct kobject *kobj, - - end_pfn = pfn + count * BITS_PER_BYTE; - if (end_pfn > max_pfn) -- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); -+ end_pfn = max_pfn; - - for (; pfn < end_pfn; pfn++) { - bit = pfn % BITMAP_CHUNK_BITS; -@@ -175,7 +175,7 @@ static ssize_t page_idle_bitmap_write(struct file *file, struct kobject *kobj, - - end_pfn = pfn + count * BITS_PER_BYTE; - if (end_pfn > max_pfn) -- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS); -+ end_pfn = max_pfn; - - for (; pfn < end_pfn; pfn++) { - bit = pfn % BITMAP_CHUNK_BITS; -diff --git a/net/9p/protocol.c b/net/9p/protocol.c -index 7f1b45c082c9..ed1e39ccaebf 100644 ---- a/net/9p/protocol.c -+++ b/net/9p/protocol.c -@@ -622,13 +622,19 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len, - if (ret) { - p9_debug(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret); - trace_9p_protocol_dump(clnt, &fake_pdu); -- goto out; -+ return ret; - } - -- strcpy(dirent->d_name, nameptr); -+ ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name)); -+ if (ret < 0) { -+ p9_debug(P9_DEBUG_ERROR, -+ "On the wire dirent name too long: %s\n", -+ nameptr); -+ kfree(nameptr); -+ return ret; -+ } - kfree(nameptr); - --out: - return fake_pdu.offset; - } - EXPORT_SYMBOL(p9dirent_read); -diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c -index 38aa6345bdfa..9c0c894b56f8 100644 ---- a/net/9p/trans_common.c -+++ b/net/9p/trans_common.c -@@ -14,6 +14,7 @@ - - #include - #include -+#include "trans_common.h" - - /** - * p9_release_req_pages - Release pages after the transaction. -diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c -index f42550dd3560..83d2e7722ebf 100644 ---- a/net/9p/trans_rdma.c -+++ b/net/9p/trans_rdma.c -@@ -255,8 +255,7 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) - case RDMA_CM_EVENT_DISCONNECTED: - if (rdma) - rdma->state = P9_RDMA_CLOSED; -- if (c) -- c->status = Disconnected; -+ c->status = Disconnected; - break; - - case RDMA_CM_EVENT_TIMEWAIT_EXIT: -@@ -476,7 +475,7 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) - - err = post_recv(client, rpl_context); - if (err) { -- p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n"); -+ p9_debug(P9_DEBUG_ERROR, "POST RECV failed: %d\n", err); - goto recv_error; - } - /* remove posted receive buffer from request structure */ -@@ -544,7 +543,7 @@ dont_need_post_recv: - recv_error: - kfree(rpl_context); - spin_lock_irqsave(&rdma->req_lock, flags); -- if (rdma->state < P9_RDMA_CLOSING) { -+ if (err != -EINTR && rdma->state < P9_RDMA_CLOSING) { - rdma->state = P9_RDMA_CLOSING; - spin_unlock_irqrestore(&rdma->req_lock, flags); - rdma_disconnect(rdma->cm_id); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 80be0ee17ff3..114bcf6ea916 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1293,8 +1293,16 @@ auth: - return 0; - - encrypt: -- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) -+ if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) { -+ /* Ensure that the encryption key size has been read, -+ * otherwise stall the upper layer responses. -+ */ -+ if (!conn->enc_key_size) -+ return 0; -+ -+ /* Nothing else needed, all requirements are met */ - return 1; -+ } - - hci_conn_encrypt(conn); - return 0; -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index f76e9c1e9f17..46afd560f242 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -1329,6 +1329,21 @@ static void l2cap_request_info(struct l2cap_conn *conn) - sizeof(req), &req); - } - -+static bool l2cap_check_enc_key_size(struct hci_conn *hcon) -+{ -+ /* The minimum encryption key size needs to be enforced by the -+ * host stack before establishing any L2CAP connections. The -+ * specification in theory allows a minimum of 1, but to align -+ * BR/EDR and LE transports, a minimum of 7 is chosen. -+ * -+ * This check might also be called for unencrypted connections -+ * that have no key size requirements. Ensure that the link is -+ * actually encrypted before enforcing a key size. -+ */ -+ return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || -+ hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE); -+} -+ - static void l2cap_do_start(struct l2cap_chan *chan) - { - struct l2cap_conn *conn = chan->conn; -@@ -1346,9 +1361,14 @@ static void l2cap_do_start(struct l2cap_chan *chan) - if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) - return; - -- if (l2cap_chan_check_security(chan, true) && -- __l2cap_no_conn_pending(chan)) -+ if (!l2cap_chan_check_security(chan, true) || -+ !__l2cap_no_conn_pending(chan)) -+ return; -+ -+ if (l2cap_check_enc_key_size(conn->hcon)) - l2cap_start_connection(chan); -+ else -+ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); - } - - static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) -@@ -1427,7 +1447,10 @@ static void l2cap_conn_start(struct l2cap_conn *conn) - continue; - } - -- l2cap_start_connection(chan); -+ if (l2cap_check_enc_key_size(conn->hcon)) -+ l2cap_start_connection(chan); -+ else -+ l2cap_chan_close(chan, ECONNREFUSED); - - } else if (chan->state == BT_CONNECT2) { - struct l2cap_conn_rsp rsp; -@@ -7432,7 +7455,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - } - - if (chan->state == BT_CONNECT) { -- if (!status) -+ if (!status && l2cap_check_enc_key_size(hcon)) - l2cap_start_connection(chan); - else - __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); -@@ -7441,7 +7464,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - struct l2cap_conn_rsp rsp; - __u16 res, stat; - -- if (!status) { -+ if (!status && l2cap_check_enc_key_size(hcon)) { - if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { - res = L2CAP_CR_PEND; - stat = L2CAP_CS_AUTHOR_PEND; -diff --git a/net/can/af_can.c b/net/can/af_can.c -index c866e761651a..b06ab2f05991 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -113,6 +113,7 @@ EXPORT_SYMBOL(can_ioctl); - static void can_sock_destruct(struct sock *sk) - { - skb_queue_purge(&sk->sk_receive_queue); -+ skb_queue_purge(&sk->sk_error_queue); - } - - static const struct can_proto *can_get_proto(int protocol) -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index e742323d69e1..3fb4aeeabf00 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -195,7 +195,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash) - } - sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol, - iph->saddr, iph->daddr, -- skb->dev->ifindex); -+ dif); - } - out: - read_unlock(&raw_v4_hashinfo.lock); -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 833ad779659c..3b8e2f97d815 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -3324,6 +3324,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) - case NL80211_IFTYPE_STATION: - if (!bssid && !sdata->u.mgd.use_4addr) - return false; -+ if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta) -+ return false; - if (multicast) - return true; - return ether_addr_equal(sdata->vif.addr, hdr->addr1); -diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c -index 9da76ba4d10f..3550f0784306 100644 ---- a/net/sctp/endpointola.c -+++ b/net/sctp/endpointola.c -@@ -126,10 +126,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, - /* Initialize the bind addr area */ - sctp_bind_addr_init(&ep->base.bind_addr, 0); - -- /* Remember who we are attached to. */ -- ep->base.sk = sk; -- sock_hold(ep->base.sk); -- - /* Create the lists of associations. */ - INIT_LIST_HEAD(&ep->asocs); - -@@ -165,6 +161,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, - ep->auth_hmacs_list = auth_hmacs; - ep->auth_chunk_list = auth_chunks; - -+ /* Remember who we are attached to. */ -+ ep->base.sk = sk; -+ sock_hold(ep->base.sk); -+ - return ep; - - nomem_hmacs: -diff --git a/net/tipc/core.c b/net/tipc/core.c -index c306e9bc1621..35b376f58f21 100644 ---- a/net/tipc/core.c -+++ b/net/tipc/core.c -@@ -129,7 +129,7 @@ static int __init tipc_init(void) - if (err) - goto out_sysctl; - -- err = register_pernet_subsys(&tipc_net_ops); -+ err = register_pernet_device(&tipc_net_ops); - if (err) - goto out_pernet; - -@@ -137,7 +137,7 @@ static int __init tipc_init(void) - if (err) - goto out_socket; - -- err = register_pernet_subsys(&tipc_topsrv_net_ops); -+ err = register_pernet_device(&tipc_topsrv_net_ops); - if (err) - goto out_pernet_topsrv; - -@@ -148,11 +148,11 @@ static int __init tipc_init(void) - pr_info("Started in single node mode\n"); - return 0; - out_bearer: -- unregister_pernet_subsys(&tipc_topsrv_net_ops); -+ unregister_pernet_device(&tipc_topsrv_net_ops); - out_pernet_topsrv: - tipc_socket_stop(); - out_socket: -- unregister_pernet_subsys(&tipc_net_ops); -+ unregister_pernet_device(&tipc_net_ops); - out_pernet: - tipc_unregister_sysctl(); - out_sysctl: -@@ -167,9 +167,9 @@ out_netlink: - static void __exit tipc_exit(void) - { - tipc_bearer_cleanup(); -- unregister_pernet_subsys(&tipc_topsrv_net_ops); -+ unregister_pernet_device(&tipc_topsrv_net_ops); - tipc_socket_stop(); -- unregister_pernet_subsys(&tipc_net_ops); -+ unregister_pernet_device(&tipc_net_ops); - tipc_netlink_stop(); - tipc_netlink_compat_stop(); - tipc_unregister_sysctl(); -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index 8400211537a2..9a65664f749c 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -430,7 +430,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd, - if (!bearer) - return -EMSGSIZE; - -- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME); -+ len = TLV_GET_DATA_LEN(msg->req); -+ if (len <= 0) -+ return -EINVAL; -+ -+ len = min_t(int, len, TIPC_MAX_BEARER_NAME); - if (!string_is_valid(name, len)) - return -EINVAL; - -@@ -505,7 +509,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, - - name = (char *)TLV_DATA(msg->req); - -- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ len = TLV_GET_DATA_LEN(msg->req); -+ if (len <= 0) -+ return -EINVAL; -+ -+ len = min_t(int, len, TIPC_MAX_BEARER_NAME); - if (!string_is_valid(name, len)) - return -EINVAL; - -@@ -776,7 +784,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, - if (!link) - return -EMSGSIZE; - -- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME); -+ len = TLV_GET_DATA_LEN(msg->req); -+ if (len <= 0) -+ return -EINVAL; -+ -+ len = min_t(int, len, TIPC_MAX_BEARER_NAME); - if (!string_is_valid(name, len)) - return -EINVAL; - -diff --git a/net/wireless/core.c b/net/wireless/core.c -index a1e909ae0f78..ded9d6d04dee 100644 ---- a/net/wireless/core.c -+++ b/net/wireless/core.c -@@ -447,7 +447,7 @@ use_default_name: - &rdev->rfkill_ops, rdev); - - if (!rdev->rfkill) { -- kfree(rdev); -+ wiphy_free(&rdev->wiphy); - return NULL; - } - -diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl -index 12a6940741fe..b8f616545277 100755 ---- a/scripts/checkstack.pl -+++ b/scripts/checkstack.pl -@@ -45,7 +45,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre); - $x = "[0-9a-f]"; # hex character - $xs = "[0-9a-f ]"; # hex character or space - $funcre = qr/^$x* <(.*)>:$/; -- if ($arch eq 'aarch64') { -+ if ($arch =~ '^(aarch|arm)64$') { - #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]! - $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o; - } elsif ($arch eq 'arm') { -diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c -index a689f10930b5..26db63168284 100644 ---- a/security/apparmor/policy_unpack.c -+++ b/security/apparmor/policy_unpack.c -@@ -177,7 +177,7 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name) - char *tag = NULL; - size_t size = unpack_u16_chunk(e, &tag); - /* if a name is specified it must match. otherwise skip tag */ -- if (name && (!size || strcmp(name, tag))) -+ if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag))) - goto fail; - } else if (name) { - /* if a name is specified and there is no name tag fail */ -diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c -index 5b8520177b0e..7d72e3d48ad5 100644 ---- a/sound/core/seq/oss/seq_oss_ioctl.c -+++ b/sound/core/seq/oss/seq_oss_ioctl.c -@@ -62,7 +62,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg) - if (copy_from_user(ev, arg, 8)) - return -EFAULT; - memset(&tmpev, 0, sizeof(tmpev)); -- snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client); -+ snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port); - tmpev.time.tick = 0; - if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) { - snd_seq_oss_dispatch(dp, &tmpev, 0, 0); -diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c -index 6a7b6aceeca9..499f3e8f4949 100644 ---- a/sound/core/seq/oss/seq_oss_rw.c -+++ b/sound/core/seq/oss/seq_oss_rw.c -@@ -174,7 +174,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt) - memset(&event, 0, sizeof(event)); - /* set dummy -- to be sure */ - event.type = SNDRV_SEQ_EVENT_NOTEOFF; -- snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client); -+ snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port); - - if (snd_seq_oss_process_event(dp, rec, &event)) - return 0; /* invalid event - no need to insert queue */ -diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c -index bebddc60fde8..99654e7eb2d4 100644 ---- a/sound/firewire/amdtp-am824.c -+++ b/sound/firewire/amdtp-am824.c -@@ -388,7 +388,7 @@ static void read_midi_messages(struct amdtp_stream *s, - u8 *b; - - for (f = 0; f < frames; f++) { -- port = (s->data_block_counter + f) % 8; -+ port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8; - b = (u8 *)&buffer[p->midi_position]; - - len = b[0] - 0x80; -diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c -index 93b02be3a90e..6edec2387861 100644 ---- a/sound/soc/codecs/cs4265.c -+++ b/sound/soc/codecs/cs4265.c -@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = { - static bool cs4265_readable_register(struct device *dev, unsigned int reg) - { - switch (reg) { -- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2: -+ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER: - return true; - default: - return false; -diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c -index 3e65dc74eb33..e7aef841f87d 100644 ---- a/sound/soc/codecs/max98090.c -+++ b/sound/soc/codecs/max98090.c -@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090, - return 0; - } - -+static int max98090_dai_startup(struct snd_pcm_substream *substream, -+ struct snd_soc_dai *dai) -+{ -+ struct snd_soc_component *component = dai->component; -+ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component); -+ unsigned int fmt = max98090->dai_fmt; -+ -+ /* Remove 24-bit format support if it is not in right justified mode. */ -+ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) { -+ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; -+ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16); -+ } -+ return 0; -+} -+ - static int max98090_dai_hw_params(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params, - struct snd_soc_dai *dai) -@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect); - #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE) - - static const struct snd_soc_dai_ops max98090_dai_ops = { -+ .startup = max98090_dai_startup, - .set_sysclk = max98090_dai_set_sysclk, - .set_fmt = max98090_dai_set_fmt, - .set_tdm_slot = max98090_set_tdm_slot, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 5d2fc5f58bfe..f4fd9548c529 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -753,7 +753,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer, - return err; - } - -- kctl->private_value |= (value << 24); -+ kctl->private_value |= ((unsigned int)value << 24); - return 0; - } - -@@ -914,7 +914,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer, - if (err < 0) - return err; - -- kctl->private_value |= value[0] << 24; -+ kctl->private_value |= (unsigned int)value[0] << 24; - return 0; - } - -diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c -index a7d588bf3cdd..ea5f73dd7581 100644 ---- a/tools/perf/builtin-help.c -+++ b/tools/perf/builtin-help.c -@@ -179,7 +179,7 @@ static void add_man_viewer(const char *name) - while (*p) - p = &((*p)->next); - *p = zalloc(sizeof(**p) + len + 1); -- strncpy((*p)->name, name, len); -+ strcpy((*p)->name, name); - } - - static int supported_man_viewer(const char *name, size_t len) -diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c -index 88f5143a5981..3c97e27383a9 100644 ---- a/tools/perf/ui/tui/helpline.c -+++ b/tools/perf/ui/tui/helpline.c -@@ -23,7 +23,7 @@ static void tui_helpline__push(const char *msg) - SLsmg_set_color(0); - SLsmg_write_nstring((char *)msg, SLtt_Screen_Cols); - SLsmg_refresh(); -- strncpy(ui_helpline__current, msg, sz)[sz - 1] = '\0'; -+ strlcpy(ui_helpline__current, msg, sz); - } - - static int tui_helpline__show(const char *format, va_list ap) diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.185-186.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.185-186.patch deleted file mode 100644 index 11dd99c879ca..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.185-186.patch +++ /dev/null @@ -1,1919 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt -index ee3723beb701..33b38716b77f 100644 ---- a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt -+++ b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt -@@ -4,6 +4,7 @@ Required properties: - - compatible: Should be one of the following: - - "microchip,mcp2510" for MCP2510. - - "microchip,mcp2515" for MCP2515. -+ - "microchip,mcp25625" for MCP25625. - - reg: SPI chip select. - - clocks: The clock feeding the CAN controller. - - interrupt-parent: The parent interrupt controller. -diff --git a/Makefile b/Makefile -index 9618663c445a..0e3ec0053eb3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 185 -+SUBLEVEL = 186 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c -index 5eb707640e9c..60b41d018227 100644 ---- a/arch/arc/kernel/unwind.c -+++ b/arch/arc/kernel/unwind.c -@@ -183,11 +183,6 @@ static void *__init unw_hdr_alloc_early(unsigned long sz) - MAX_DMA_ADDRESS); - } - --static void *unw_hdr_alloc(unsigned long sz) --{ -- return kmalloc(sz, GFP_KERNEL); --} -- - static void init_unwind_table(struct unwind_table *table, const char *name, - const void *core_start, unsigned long core_size, - const void *init_start, unsigned long init_size, -@@ -368,6 +363,10 @@ ret_err: - } - - #ifdef CONFIG_MODULES -+static void *unw_hdr_alloc(unsigned long sz) -+{ -+ return kmalloc(sz, GFP_KERNEL); -+} - - static struct unwind_table *last_table; - -diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c -index 1ed545cc2b83..99356e23776d 100644 ---- a/arch/arm/mach-davinci/board-da850-evm.c -+++ b/arch/arm/mach-davinci/board-da850-evm.c -@@ -1479,6 +1479,8 @@ static __init void da850_evm_init(void) - if (ret) - pr_warn("%s: dsp/rproc registration failed: %d\n", - __func__, ret); -+ -+ regulator_has_full_constraints(); - } - - #ifdef CONFIG_SERIAL_8250_CONSOLE -diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c -index 78d325f3245a..4728d0974849 100644 ---- a/arch/arm/mach-davinci/devices-da8xx.c -+++ b/arch/arm/mach-davinci/devices-da8xx.c -@@ -660,6 +660,9 @@ static struct platform_device da8xx_lcdc_device = { - .id = 0, - .num_resources = ARRAY_SIZE(da8xx_lcdc_resources), - .resource = da8xx_lcdc_resources, -+ .dev = { -+ .coherent_dma_mask = DMA_BIT_MASK(32), -+ } - }; - - int __init da8xx_register_lcdc(struct da8xx_lcdc_platform_data *pdata) -diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c -index 62680aad2126..b5ce9ca76336 100644 ---- a/arch/arm/mach-omap2/prm3xxx.c -+++ b/arch/arm/mach-omap2/prm3xxx.c -@@ -430,7 +430,7 @@ static void omap3_prm_reconfigure_io_chain(void) - * registers, and omap3xxx_prm_reconfigure_io_chain() must be called. - * No return value. - */ --static void __init omap3xxx_prm_enable_io_wakeup(void) -+static void omap3xxx_prm_enable_io_wakeup(void) - { - if (prm_features & PRM_HAS_IO_WAKEUP) - omap2_prm_set_mod_reg_bits(OMAP3430_EN_IO_MASK, WKUP_MOD, -diff --git a/arch/mips/include/uapi/asm/sgidefs.h b/arch/mips/include/uapi/asm/sgidefs.h -index 876442fcfb32..5be81f8fd479 100644 ---- a/arch/mips/include/uapi/asm/sgidefs.h -+++ b/arch/mips/include/uapi/asm/sgidefs.h -@@ -10,14 +10,6 @@ - #ifndef __ASM_SGIDEFS_H - #define __ASM_SGIDEFS_H - --/* -- * Using a Linux compiler for building Linux seems logic but not to -- * everybody. -- */ --#ifndef __linux__ --#error Use a Linux compiler or give up. --#endif -- - /* - * Definitions for the ISA levels - * -diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h -index 155fcc7bcba6..cd62de502aee 100644 ---- a/arch/s390/include/asm/facility.h -+++ b/arch/s390/include/asm/facility.h -@@ -51,6 +51,18 @@ static inline int test_facility(unsigned long nr) - return __test_facility(nr, &S390_lowcore.stfle_fac_list); - } - -+static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size) -+{ -+ register unsigned long reg0 asm("0") = size - 1; -+ -+ asm volatile( -+ ".insn s,0xb2b00000,0(%1)" /* stfle */ -+ : "+d" (reg0) -+ : "a" (stfle_fac_list) -+ : "memory", "cc"); -+ return reg0; -+} -+ - /** - * stfle - Store facility list extended - * @stfle_fac_list: array where facility list can be stored -@@ -70,13 +82,8 @@ static inline void stfle(u64 *stfle_fac_list, int size) - memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4); - if (S390_lowcore.stfl_fac_list & 0x01000000) { - /* More facility bits available with stfle */ -- register unsigned long reg0 asm("0") = size - 1; -- -- asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */ -- : "+d" (reg0) -- : "a" (stfle_fac_list) -- : "memory", "cc"); -- nr = (reg0 + 1) * 8; /* # bytes stored by stfle */ -+ nr = __stfle_asm(stfle_fac_list, size); -+ nr = min_t(unsigned long, (nr + 1) * 8, size * 8); - } - memset((char *) stfle_fac_list + nr, 0, size * 8 - nr); - preempt_enable(); -diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c -index 479a409ddac8..1ca929767a1b 100644 ---- a/arch/x86/kernel/ptrace.c -+++ b/arch/x86/kernel/ptrace.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -697,9 +698,11 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) - { - struct thread_struct *thread = &tsk->thread; - unsigned long val = 0; -+ int index = n; - - if (n < HBP_NUM) { -- struct perf_event *bp = thread->ptrace_bps[n]; -+ struct perf_event *bp = thread->ptrace_bps[index]; -+ index = array_index_nospec(index, HBP_NUM); - - if (bp) - val = bp->hw.info.address; -diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c -index 7fc5e843f247..9f03c7e07a2b 100644 ---- a/arch/x86/kernel/tls.c -+++ b/arch/x86/kernel/tls.c -@@ -4,6 +4,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -177,6 +178,7 @@ int do_get_thread_area(struct task_struct *p, int idx, - struct user_desc __user *u_info) - { - struct user_desc info; -+ int index; - - if (idx == -1 && get_user(idx, &u_info->entry_number)) - return -EFAULT; -@@ -184,8 +186,11 @@ int do_get_thread_area(struct task_struct *p, int idx, - if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX) - return -EINVAL; - -- fill_user_desc(&info, idx, -- &p->thread.tls_array[idx - GDT_ENTRY_TLS_MIN]); -+ index = idx - GDT_ENTRY_TLS_MIN; -+ index = array_index_nospec(index, -+ GDT_ENTRY_TLS_MAX - GDT_ENTRY_TLS_MIN + 1); -+ -+ fill_user_desc(&info, idx, &p->thread.tls_array[index]); - - if (copy_to_user(u_info, &info, sizeof(info))) - return -EFAULT; -diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c -index ab5318727579..ef56d70d1026 100644 ---- a/arch/x86/kvm/i8254.c -+++ b/arch/x86/kvm/i8254.c -@@ -678,7 +678,6 @@ static const struct kvm_io_device_ops speaker_dev_ops = { - .write = speaker_ioport_write, - }; - --/* Caller must hold slots_lock */ - struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) - { - struct kvm_pit *pit; -@@ -733,6 +732,7 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) - pit->mask_notifier.func = pit_mask_notifer; - kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier); - -+ mutex_lock(&kvm->slots_lock); - kvm_iodevice_init(&pit->dev, &pit_dev_ops); - ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS, - KVM_PIT_MEM_LENGTH, &pit->dev); -@@ -747,13 +747,14 @@ struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags) - if (ret < 0) - goto fail_unregister; - } -+ mutex_unlock(&kvm->slots_lock); - - return pit; - - fail_unregister: - kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev); -- - fail: -+ mutex_unlock(&kvm->slots_lock); - kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier); - kvm_unregister_irq_ack_notifier(kvm, &pit_state->irq_ack_notifier); - kvm_free_irq_source_id(kvm, pit->irq_source_id); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 66adcd00b3dd..8613422660b6 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -3867,7 +3867,7 @@ long kvm_arch_vm_ioctl(struct file *filp, - sizeof(struct kvm_pit_config))) - goto out; - create_pit: -- mutex_lock(&kvm->slots_lock); -+ mutex_lock(&kvm->lock); - r = -EEXIST; - if (kvm->arch.vpit) - goto create_pit_unlock; -@@ -3876,7 +3876,7 @@ long kvm_arch_vm_ioctl(struct file *filp, - if (kvm->arch.vpit) - r = 0; - create_pit_unlock: -- mutex_unlock(&kvm->slots_lock); -+ mutex_unlock(&kvm->lock); - break; - case KVM_GET_IRQCHIP: { - /* 0: PIC master, 1: PIC slave, 2: IOAPIC */ -@@ -7799,7 +7799,7 @@ int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - - slot = id_to_memslot(slots, id); - if (size) { -- if (WARN_ON(slot->npages)) -+ if (slot->npages) - return -EEXIST; - - /* -diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c -index 2165f3dd328b..842c0235471d 100644 ---- a/drivers/input/keyboard/imx_keypad.c -+++ b/drivers/input/keyboard/imx_keypad.c -@@ -530,11 +530,12 @@ static int imx_keypad_probe(struct platform_device *pdev) - return 0; - } - --static int __maybe_unused imx_kbd_suspend(struct device *dev) -+static int __maybe_unused imx_kbd_noirq_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct imx_keypad *kbd = platform_get_drvdata(pdev); - struct input_dev *input_dev = kbd->input_dev; -+ unsigned short reg_val = readw(kbd->mmio_base + KPSR); - - /* imx kbd can wake up system even clock is disabled */ - mutex_lock(&input_dev->mutex); -@@ -544,13 +545,20 @@ static int __maybe_unused imx_kbd_suspend(struct device *dev) - - mutex_unlock(&input_dev->mutex); - -- if (device_may_wakeup(&pdev->dev)) -+ if (device_may_wakeup(&pdev->dev)) { -+ if (reg_val & KBD_STAT_KPKD) -+ reg_val |= KBD_STAT_KRIE; -+ if (reg_val & KBD_STAT_KPKR) -+ reg_val |= KBD_STAT_KDIE; -+ writew(reg_val, kbd->mmio_base + KPSR); -+ - enable_irq_wake(kbd->irq); -+ } - - return 0; - } - --static int __maybe_unused imx_kbd_resume(struct device *dev) -+static int __maybe_unused imx_kbd_noirq_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct imx_keypad *kbd = platform_get_drvdata(pdev); -@@ -574,7 +582,9 @@ err_clk: - return ret; - } - --static SIMPLE_DEV_PM_OPS(imx_kbd_pm_ops, imx_kbd_suspend, imx_kbd_resume); -+static const struct dev_pm_ops imx_kbd_pm_ops = { -+ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(imx_kbd_noirq_suspend, imx_kbd_noirq_resume) -+}; - - static struct platform_driver imx_keypad_driver = { - .driver = { -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 4c1e527f14a5..7b942ee364b6 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1191,6 +1191,8 @@ static const char * const middle_button_pnp_ids[] = { - "LEN2132", /* ThinkPad P52 */ - "LEN2133", /* ThinkPad P72 w/ NFC */ - "LEN2134", /* ThinkPad P72 */ -+ "LEN0407", -+ "LEN0408", - NULL - }; - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index f71cca28ddda..067af77bb729 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -7226,9 +7226,9 @@ static void status_unused(struct seq_file *seq) - static int status_resync(struct seq_file *seq, struct mddev *mddev) - { - sector_t max_sectors, resync, res; -- unsigned long dt, db; -- sector_t rt; -- int scale; -+ unsigned long dt, db = 0; -+ sector_t rt, curr_mark_cnt, resync_mark_cnt; -+ int scale, recovery_active; - unsigned int per_milli; - - if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) || -@@ -7298,22 +7298,30 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev) - * db: blocks written from mark until now - * rt: remaining time - * -- * rt is a sector_t, so could be 32bit or 64bit. -- * So we divide before multiply in case it is 32bit and close -- * to the limit. -- * We scale the divisor (db) by 32 to avoid losing precision -- * near the end of resync when the number of remaining sectors -- * is close to 'db'. -- * We then divide rt by 32 after multiplying by db to compensate. -- * The '+1' avoids division by zero if db is very small. -+ * rt is a sector_t, which is always 64bit now. We are keeping -+ * the original algorithm, but it is not really necessary. -+ * -+ * Original algorithm: -+ * So we divide before multiply in case it is 32bit and close -+ * to the limit. -+ * We scale the divisor (db) by 32 to avoid losing precision -+ * near the end of resync when the number of remaining sectors -+ * is close to 'db'. -+ * We then divide rt by 32 after multiplying by db to compensate. -+ * The '+1' avoids division by zero if db is very small. - */ - dt = ((jiffies - mddev->resync_mark) / HZ); - if (!dt) dt++; -- db = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active)) -- - mddev->resync_mark_cnt; -+ -+ curr_mark_cnt = mddev->curr_mark_cnt; -+ recovery_active = atomic_read(&mddev->recovery_active); -+ resync_mark_cnt = mddev->resync_mark_cnt; -+ -+ if (curr_mark_cnt >= (recovery_active + resync_mark_cnt)) -+ db = curr_mark_cnt - (recovery_active + resync_mark_cnt); - - rt = max_sectors - resync; /* number of remaining sectors */ -- sector_div(rt, db/32+1); -+ rt = div64_u64(rt, db/32+1); - rt *= dt; - rt >>= 5; - -diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c -index f866a4baecb5..b9da2c6cc981 100644 ---- a/drivers/misc/vmw_vmci/vmci_context.c -+++ b/drivers/misc/vmw_vmci/vmci_context.c -@@ -28,6 +28,9 @@ - #include "vmci_driver.h" - #include "vmci_event.h" - -+/* Use a wide upper bound for the maximum contexts. */ -+#define VMCI_MAX_CONTEXTS 2000 -+ - /* - * List of current VMCI contexts. Contexts can be added by - * vmci_ctx_create() and removed via vmci_ctx_destroy(). -@@ -124,19 +127,22 @@ struct vmci_ctx *vmci_ctx_create(u32 cid, u32 priv_flags, - /* Initialize host-specific VMCI context. */ - init_waitqueue_head(&context->host_context.wait_queue); - -- context->queue_pair_array = vmci_handle_arr_create(0); -+ context->queue_pair_array = -+ vmci_handle_arr_create(0, VMCI_MAX_GUEST_QP_COUNT); - if (!context->queue_pair_array) { - error = -ENOMEM; - goto err_free_ctx; - } - -- context->doorbell_array = vmci_handle_arr_create(0); -+ context->doorbell_array = -+ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT); - if (!context->doorbell_array) { - error = -ENOMEM; - goto err_free_qp_array; - } - -- context->pending_doorbell_array = vmci_handle_arr_create(0); -+ context->pending_doorbell_array = -+ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT); - if (!context->pending_doorbell_array) { - error = -ENOMEM; - goto err_free_db_array; -@@ -211,7 +217,7 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags) - * We create an array to hold the subscribers we find when - * scanning through all contexts. - */ -- subscriber_array = vmci_handle_arr_create(0); -+ subscriber_array = vmci_handle_arr_create(0, VMCI_MAX_CONTEXTS); - if (subscriber_array == NULL) - return VMCI_ERROR_NO_MEM; - -@@ -630,20 +636,26 @@ int vmci_ctx_add_notification(u32 context_id, u32 remote_cid) - - spin_lock(&context->lock); - -- list_for_each_entry(n, &context->notifier_list, node) { -- if (vmci_handle_is_equal(n->handle, notifier->handle)) { -- exists = true; -- break; -+ if (context->n_notifiers < VMCI_MAX_CONTEXTS) { -+ list_for_each_entry(n, &context->notifier_list, node) { -+ if (vmci_handle_is_equal(n->handle, notifier->handle)) { -+ exists = true; -+ break; -+ } - } -- } - -- if (exists) { -- kfree(notifier); -- result = VMCI_ERROR_ALREADY_EXISTS; -+ if (exists) { -+ kfree(notifier); -+ result = VMCI_ERROR_ALREADY_EXISTS; -+ } else { -+ list_add_tail_rcu(¬ifier->node, -+ &context->notifier_list); -+ context->n_notifiers++; -+ result = VMCI_SUCCESS; -+ } - } else { -- list_add_tail_rcu(¬ifier->node, &context->notifier_list); -- context->n_notifiers++; -- result = VMCI_SUCCESS; -+ kfree(notifier); -+ result = VMCI_ERROR_NO_MEM; - } - - spin_unlock(&context->lock); -@@ -728,8 +740,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context, - u32 *buf_size, void **pbuf) - { - struct dbell_cpt_state *dbells; -- size_t n_doorbells; -- int i; -+ u32 i, n_doorbells; - - n_doorbells = vmci_handle_arr_get_size(context->doorbell_array); - if (n_doorbells > 0) { -@@ -867,7 +878,8 @@ int vmci_ctx_rcv_notifications_get(u32 context_id, - spin_lock(&context->lock); - - *db_handle_array = context->pending_doorbell_array; -- context->pending_doorbell_array = vmci_handle_arr_create(0); -+ context->pending_doorbell_array = -+ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT); - if (!context->pending_doorbell_array) { - context->pending_doorbell_array = *db_handle_array; - *db_handle_array = NULL; -@@ -949,12 +961,11 @@ int vmci_ctx_dbell_create(u32 context_id, struct vmci_handle handle) - return VMCI_ERROR_NOT_FOUND; - - spin_lock(&context->lock); -- if (!vmci_handle_arr_has_entry(context->doorbell_array, handle)) { -- vmci_handle_arr_append_entry(&context->doorbell_array, handle); -- result = VMCI_SUCCESS; -- } else { -+ if (!vmci_handle_arr_has_entry(context->doorbell_array, handle)) -+ result = vmci_handle_arr_append_entry(&context->doorbell_array, -+ handle); -+ else - result = VMCI_ERROR_DUPLICATE_ENTRY; -- } - - spin_unlock(&context->lock); - vmci_ctx_put(context); -@@ -1090,15 +1101,16 @@ int vmci_ctx_notify_dbell(u32 src_cid, - if (!vmci_handle_arr_has_entry( - dst_context->pending_doorbell_array, - handle)) { -- vmci_handle_arr_append_entry( -+ result = vmci_handle_arr_append_entry( - &dst_context->pending_doorbell_array, - handle); -- -- ctx_signal_notify(dst_context); -- wake_up(&dst_context->host_context.wait_queue); -- -+ if (result == VMCI_SUCCESS) { -+ ctx_signal_notify(dst_context); -+ wake_up(&dst_context->host_context.wait_queue); -+ } -+ } else { -+ result = VMCI_SUCCESS; - } -- result = VMCI_SUCCESS; - } - spin_unlock(&dst_context->lock); - } -@@ -1125,13 +1137,11 @@ int vmci_ctx_qp_create(struct vmci_ctx *context, struct vmci_handle handle) - if (context == NULL || vmci_handle_is_invalid(handle)) - return VMCI_ERROR_INVALID_ARGS; - -- if (!vmci_handle_arr_has_entry(context->queue_pair_array, handle)) { -- vmci_handle_arr_append_entry(&context->queue_pair_array, -- handle); -- result = VMCI_SUCCESS; -- } else { -+ if (!vmci_handle_arr_has_entry(context->queue_pair_array, handle)) -+ result = vmci_handle_arr_append_entry( -+ &context->queue_pair_array, handle); -+ else - result = VMCI_ERROR_DUPLICATE_ENTRY; -- } - - return result; - } -diff --git a/drivers/misc/vmw_vmci/vmci_handle_array.c b/drivers/misc/vmw_vmci/vmci_handle_array.c -index 344973a0fb0a..917e18a8af95 100644 ---- a/drivers/misc/vmw_vmci/vmci_handle_array.c -+++ b/drivers/misc/vmw_vmci/vmci_handle_array.c -@@ -16,24 +16,29 @@ - #include - #include "vmci_handle_array.h" - --static size_t handle_arr_calc_size(size_t capacity) -+static size_t handle_arr_calc_size(u32 capacity) - { -- return sizeof(struct vmci_handle_arr) + -+ return VMCI_HANDLE_ARRAY_HEADER_SIZE + - capacity * sizeof(struct vmci_handle); - } - --struct vmci_handle_arr *vmci_handle_arr_create(size_t capacity) -+struct vmci_handle_arr *vmci_handle_arr_create(u32 capacity, u32 max_capacity) - { - struct vmci_handle_arr *array; - -+ if (max_capacity == 0 || capacity > max_capacity) -+ return NULL; -+ - if (capacity == 0) -- capacity = VMCI_HANDLE_ARRAY_DEFAULT_SIZE; -+ capacity = min((u32)VMCI_HANDLE_ARRAY_DEFAULT_CAPACITY, -+ max_capacity); - - array = kmalloc(handle_arr_calc_size(capacity), GFP_ATOMIC); - if (!array) - return NULL; - - array->capacity = capacity; -+ array->max_capacity = max_capacity; - array->size = 0; - - return array; -@@ -44,27 +49,34 @@ void vmci_handle_arr_destroy(struct vmci_handle_arr *array) - kfree(array); - } - --void vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr, -- struct vmci_handle handle) -+int vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr, -+ struct vmci_handle handle) - { - struct vmci_handle_arr *array = *array_ptr; - - if (unlikely(array->size >= array->capacity)) { - /* reallocate. */ - struct vmci_handle_arr *new_array; -- size_t new_capacity = array->capacity * VMCI_ARR_CAP_MULT; -- size_t new_size = handle_arr_calc_size(new_capacity); -+ u32 capacity_bump = min(array->max_capacity - array->capacity, -+ array->capacity); -+ size_t new_size = handle_arr_calc_size(array->capacity + -+ capacity_bump); -+ -+ if (array->size >= array->max_capacity) -+ return VMCI_ERROR_NO_MEM; - - new_array = krealloc(array, new_size, GFP_ATOMIC); - if (!new_array) -- return; -+ return VMCI_ERROR_NO_MEM; - -- new_array->capacity = new_capacity; -+ new_array->capacity += capacity_bump; - *array_ptr = array = new_array; - } - - array->entries[array->size] = handle; - array->size++; -+ -+ return VMCI_SUCCESS; - } - - /* -@@ -74,7 +86,7 @@ struct vmci_handle vmci_handle_arr_remove_entry(struct vmci_handle_arr *array, - struct vmci_handle entry_handle) - { - struct vmci_handle handle = VMCI_INVALID_HANDLE; -- size_t i; -+ u32 i; - - for (i = 0; i < array->size; i++) { - if (vmci_handle_is_equal(array->entries[i], entry_handle)) { -@@ -109,7 +121,7 @@ struct vmci_handle vmci_handle_arr_remove_tail(struct vmci_handle_arr *array) - * Handle at given index, VMCI_INVALID_HANDLE if invalid index. - */ - struct vmci_handle --vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index) -+vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, u32 index) - { - if (unlikely(index >= array->size)) - return VMCI_INVALID_HANDLE; -@@ -120,7 +132,7 @@ vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index) - bool vmci_handle_arr_has_entry(const struct vmci_handle_arr *array, - struct vmci_handle entry_handle) - { -- size_t i; -+ u32 i; - - for (i = 0; i < array->size; i++) - if (vmci_handle_is_equal(array->entries[i], entry_handle)) -diff --git a/drivers/misc/vmw_vmci/vmci_handle_array.h b/drivers/misc/vmw_vmci/vmci_handle_array.h -index b5f3a7f98cf1..0fc58597820e 100644 ---- a/drivers/misc/vmw_vmci/vmci_handle_array.h -+++ b/drivers/misc/vmw_vmci/vmci_handle_array.h -@@ -17,32 +17,41 @@ - #define _VMCI_HANDLE_ARRAY_H_ - - #include -+#include - #include - --#define VMCI_HANDLE_ARRAY_DEFAULT_SIZE 4 --#define VMCI_ARR_CAP_MULT 2 /* Array capacity multiplier */ -- - struct vmci_handle_arr { -- size_t capacity; -- size_t size; -+ u32 capacity; -+ u32 max_capacity; -+ u32 size; -+ u32 pad; - struct vmci_handle entries[]; - }; - --struct vmci_handle_arr *vmci_handle_arr_create(size_t capacity); -+#define VMCI_HANDLE_ARRAY_HEADER_SIZE \ -+ offsetof(struct vmci_handle_arr, entries) -+/* Select a default capacity that results in a 64 byte sized array */ -+#define VMCI_HANDLE_ARRAY_DEFAULT_CAPACITY 6 -+/* Make sure that the max array size can be expressed by a u32 */ -+#define VMCI_HANDLE_ARRAY_MAX_CAPACITY \ -+ ((U32_MAX - VMCI_HANDLE_ARRAY_HEADER_SIZE - 1) / \ -+ sizeof(struct vmci_handle)) -+ -+struct vmci_handle_arr *vmci_handle_arr_create(u32 capacity, u32 max_capacity); - void vmci_handle_arr_destroy(struct vmci_handle_arr *array); --void vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr, -- struct vmci_handle handle); -+int vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr, -+ struct vmci_handle handle); - struct vmci_handle vmci_handle_arr_remove_entry(struct vmci_handle_arr *array, - struct vmci_handle - entry_handle); - struct vmci_handle vmci_handle_arr_remove_tail(struct vmci_handle_arr *array); - struct vmci_handle --vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index); -+vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, u32 index); - bool vmci_handle_arr_has_entry(const struct vmci_handle_arr *array, - struct vmci_handle entry_handle); - struct vmci_handle *vmci_handle_arr_get_handles(struct vmci_handle_arr *array); - --static inline size_t vmci_handle_arr_get_size( -+static inline u32 vmci_handle_arr_get_size( - const struct vmci_handle_arr *array) - { - return array->size; -diff --git a/drivers/net/can/spi/Kconfig b/drivers/net/can/spi/Kconfig -index 148cae5871a6..249d2db7d600 100644 ---- a/drivers/net/can/spi/Kconfig -+++ b/drivers/net/can/spi/Kconfig -@@ -2,9 +2,10 @@ menu "CAN SPI interfaces" - depends on SPI - - config CAN_MCP251X -- tristate "Microchip MCP251x SPI CAN controllers" -+ tristate "Microchip MCP251x and MCP25625 SPI CAN controllers" - depends on HAS_DMA - ---help--- -- Driver for the Microchip MCP251x SPI CAN controllers. -+ Driver for the Microchip MCP251x and MCP25625 SPI CAN -+ controllers. - - endmenu -diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c -index 575790e8a75a..3bcbfcf0455a 100644 ---- a/drivers/net/can/spi/mcp251x.c -+++ b/drivers/net/can/spi/mcp251x.c -@@ -1,5 +1,5 @@ - /* -- * CAN bus driver for Microchip 251x CAN Controller with SPI Interface -+ * CAN bus driver for Microchip 251x/25625 CAN Controller with SPI Interface - * - * MCP2510 support and bug fixes by Christian Pellegrin - * -@@ -41,7 +41,7 @@ - * static struct spi_board_info spi_board_info[] = { - * { - * .modalias = "mcp2510", -- * // or "mcp2515" depending on your controller -+ * // "mcp2515" or "mcp25625" depending on your controller - * .platform_data = &mcp251x_info, - * .irq = IRQ_EINT13, - * .max_speed_hz = 2*1000*1000, -@@ -238,6 +238,7 @@ static const struct can_bittiming_const mcp251x_bittiming_const = { - enum mcp251x_model { - CAN_MCP251X_MCP2510 = 0x2510, - CAN_MCP251X_MCP2515 = 0x2515, -+ CAN_MCP251X_MCP25625 = 0x25625, - }; - - struct mcp251x_priv { -@@ -280,7 +281,6 @@ static inline int mcp251x_is_##_model(struct spi_device *spi) \ - } - - MCP251X_IS(2510); --MCP251X_IS(2515); - - static void mcp251x_clean(struct net_device *net) - { -@@ -640,7 +640,7 @@ static int mcp251x_hw_reset(struct spi_device *spi) - - /* Wait for oscillator startup timer after reset */ - mdelay(MCP251X_OST_DELAY_MS); -- -+ - reg = mcp251x_read_reg(spi, CANSTAT); - if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF) - return -ENODEV; -@@ -821,9 +821,8 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id) - /* receive buffer 0 */ - if (intf & CANINTF_RX0IF) { - mcp251x_hw_rx(spi, 0); -- /* -- * Free one buffer ASAP -- * (The MCP2515 does this automatically.) -+ /* Free one buffer ASAP -+ * (The MCP2515/25625 does this automatically.) - */ - if (mcp251x_is_2510(spi)) - mcp251x_write_bits(spi, CANINTF, CANINTF_RX0IF, 0x00); -@@ -832,7 +831,7 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id) - /* receive buffer 1 */ - if (intf & CANINTF_RX1IF) { - mcp251x_hw_rx(spi, 1); -- /* the MCP2515 does this automatically */ -+ /* The MCP2515/25625 does this automatically. */ - if (mcp251x_is_2510(spi)) - clear_intf |= CANINTF_RX1IF; - } -@@ -1006,6 +1005,10 @@ static const struct of_device_id mcp251x_of_match[] = { - .compatible = "microchip,mcp2515", - .data = (void *)CAN_MCP251X_MCP2515, - }, -+ { -+ .compatible = "microchip,mcp25625", -+ .data = (void *)CAN_MCP251X_MCP25625, -+ }, - { } - }; - MODULE_DEVICE_TABLE(of, mcp251x_of_match); -@@ -1019,6 +1022,10 @@ static const struct spi_device_id mcp251x_id_table[] = { - .name = "mcp2515", - .driver_data = (kernel_ulong_t)CAN_MCP251X_MCP2515, - }, -+ { -+ .name = "mcp25625", -+ .driver_data = (kernel_ulong_t)CAN_MCP251X_MCP25625, -+ }, - { } - }; - MODULE_DEVICE_TABLE(spi, mcp251x_id_table); -@@ -1254,5 +1261,5 @@ module_spi_driver(mcp251x_can_driver); - - MODULE_AUTHOR("Chris Elston , " - "Christian Pellegrin "); --MODULE_DESCRIPTION("Microchip 251x CAN driver"); -+MODULE_DESCRIPTION("Microchip 251x/25625 CAN driver"); - MODULE_LICENSE("GPL v2"); -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c -index c56b61dce2d1..f4e83c86d643 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c -@@ -1559,7 +1559,8 @@ static int bnx2x_get_module_info(struct net_device *dev, - } - - if (!sff8472_comp || -- (diag_type & SFP_EEPROM_DIAG_ADDR_CHANGE_REQ)) { -+ (diag_type & SFP_EEPROM_DIAG_ADDR_CHANGE_REQ) || -+ !(diag_type & SFP_EEPROM_DDM_IMPLEMENTED)) { - modinfo->type = ETH_MODULE_SFF_8079; - modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN; - } else { -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h -index b7d251108c19..7115f5025664 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h -@@ -62,6 +62,7 @@ - #define SFP_EEPROM_DIAG_TYPE_ADDR 0x5c - #define SFP_EEPROM_DIAG_TYPE_SIZE 1 - #define SFP_EEPROM_DIAG_ADDR_CHANGE_REQ (1<<2) -+#define SFP_EEPROM_DDM_IMPLEMENTED (1<<6) - #define SFP_EEPROM_SFF_8472_COMP_ADDR 0x5e - #define SFP_EEPROM_SFF_8472_COMP_SIZE 1 - -diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c -index 51bfe74be8d4..4e5646b3da09 100644 ---- a/drivers/net/ethernet/emulex/benet/be_ethtool.c -+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c -@@ -868,7 +868,7 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test, - u64 *data) - { - struct be_adapter *adapter = netdev_priv(netdev); -- int status; -+ int status, cnt; - u8 link_status = 0; - - if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC) { -@@ -879,6 +879,9 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test, - - memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM); - -+ /* check link status before offline tests */ -+ link_status = netif_carrier_ok(netdev); -+ - if (test->flags & ETH_TEST_FL_OFFLINE) { - if (be_loopback_test(adapter, BE_MAC_LOOPBACK, &data[0]) != 0) - test->flags |= ETH_TEST_FL_FAILED; -@@ -899,13 +902,26 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test, - test->flags |= ETH_TEST_FL_FAILED; - } - -- status = be_cmd_link_status_query(adapter, NULL, &link_status, 0); -- if (status) { -- test->flags |= ETH_TEST_FL_FAILED; -- data[4] = -1; -- } else if (!link_status) { -+ /* link status was down prior to test */ -+ if (!link_status) { - test->flags |= ETH_TEST_FL_FAILED; - data[4] = 1; -+ return; -+ } -+ -+ for (cnt = 10; cnt; cnt--) { -+ status = be_cmd_link_status_query(adapter, NULL, &link_status, -+ 0); -+ if (status) { -+ test->flags |= ETH_TEST_FL_FAILED; -+ data[4] = -1; -+ break; -+ } -+ -+ if (link_status) -+ break; -+ -+ msleep_interruptible(500); - } - } - -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index 6b1cacd86c6e..7d64edeb1830 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -4171,7 +4171,7 @@ int e1000e_up(struct e1000_adapter *adapter) - e1000_configure_msix(adapter); - e1000_irq_enable(adapter); - -- netif_start_queue(adapter->netdev); -+ /* Tx queue started by watchdog timer when link is up */ - - /* fire a link change interrupt to start the watchdog */ - if (adapter->msix_entries) -@@ -4539,6 +4539,7 @@ static int e1000_open(struct net_device *netdev) - pm_runtime_get_sync(&pdev->dev); - - netif_carrier_off(netdev); -+ netif_stop_queue(netdev); - - /* allocate transmit descriptors */ - err = e1000e_setup_tx_resources(adapter->tx_ring); -@@ -4599,7 +4600,6 @@ static int e1000_open(struct net_device *netdev) - e1000_irq_enable(adapter); - - adapter->tx_hang_recheck = false; -- netif_start_queue(netdev); - - hw->mac.get_link_status = true; - pm_runtime_put(&pdev->dev); -@@ -5226,6 +5226,7 @@ static void e1000_watchdog_task(struct work_struct *work) - if (phy->ops.cfg_on_link_up) - phy->ops.cfg_on_link_up(hw); - -+ netif_wake_queue(netdev); - netif_carrier_on(netdev); - - if (!test_bit(__E1000_DOWN, &adapter->state)) -@@ -5239,6 +5240,7 @@ static void e1000_watchdog_task(struct work_struct *work) - /* Link status message must follow this format */ - pr_info("%s NIC Link is Down\n", adapter->netdev->name); - netif_carrier_off(netdev); -+ netif_stop_queue(netdev); - if (!test_bit(__E1000_DOWN, &adapter->state)) - mod_timer(&adapter->phy_info_timer, - round_jiffies(jiffies + 2 * HZ)); -diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c -index fd812d2e5e1c..dff5b56738d3 100644 ---- a/drivers/net/ethernet/sis/sis900.c -+++ b/drivers/net/ethernet/sis/sis900.c -@@ -1058,7 +1058,7 @@ sis900_open(struct net_device *net_dev) - sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED); - - /* Enable all known interrupts by setting the interrupt mask. */ -- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE); -+ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC); - sw32(cr, RxENA | sr32(cr)); - sw32(ier, IE); - -@@ -1581,7 +1581,7 @@ static void sis900_tx_timeout(struct net_device *net_dev) - sw32(txdp, sis_priv->tx_ring_dma); - - /* Enable all known interrupts by setting the interrupt mask. */ -- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE); -+ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC); - } - - /** -@@ -1621,7 +1621,7 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev) - spin_unlock_irqrestore(&sis_priv->lock, flags); - return NETDEV_TX_OK; - } -- sis_priv->tx_ring[entry].cmdsts = (OWN | skb->len); -+ sis_priv->tx_ring[entry].cmdsts = (OWN | INTR | skb->len); - sw32(cr, TxENA | sr32(cr)); - - sis_priv->cur_tx ++; -@@ -1677,7 +1677,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance) - do { - status = sr32(isr); - -- if ((status & (HIBERR|TxURN|TxERR|TxIDLE|RxORN|RxERR|RxOK)) == 0) -+ if ((status & (HIBERR|TxURN|TxERR|TxIDLE|TxDESC|RxORN|RxERR|RxOK)) == 0) - /* nothing intresting happened */ - break; - handled = 1; -@@ -1687,7 +1687,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance) - /* Rx interrupt */ - sis900_rx(net_dev); - -- if (status & (TxURN | TxERR | TxIDLE)) -+ if (status & (TxURN | TxERR | TxIDLE | TxDESC)) - /* Tx interrupt */ - sis900_finish_xmit(net_dev); - -@@ -1899,8 +1899,8 @@ static void sis900_finish_xmit (struct net_device *net_dev) - - if (tx_status & OWN) { - /* The packet is not transmitted yet (owned by hardware) ! -- * Note: the interrupt is generated only when Tx Machine -- * is idle, so this is an almost impossible case */ -+ * Note: this is an almost impossible condition -+ * in case of TxDESC ('descriptor interrupt') */ - break; - } - -@@ -2476,7 +2476,7 @@ static int sis900_resume(struct pci_dev *pci_dev) - sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED); - - /* Enable all known interrupts by setting the interrupt mask. */ -- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE); -+ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC); - sw32(cr, RxENA | sr32(cr)); - sw32(ier, IE); - -diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c -index 05005c660d4d..6376edd89ceb 100644 ---- a/drivers/net/ppp/ppp_mppe.c -+++ b/drivers/net/ppp/ppp_mppe.c -@@ -62,6 +62,7 @@ MODULE_AUTHOR("Frank Cusack "); - MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support"); - MODULE_LICENSE("Dual BSD/GPL"); - MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE)); -+MODULE_SOFTDEP("pre: arc4"); - MODULE_VERSION("1.0.2"); - - static unsigned int -diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c -index 76842e6ca38e..b0f094f2f87f 100644 ---- a/drivers/net/wireless/ath/carl9170/usb.c -+++ b/drivers/net/wireless/ath/carl9170/usb.c -@@ -128,6 +128,8 @@ static struct usb_device_id carl9170_usb_ids[] = { - }; - MODULE_DEVICE_TABLE(usb, carl9170_usb_ids); - -+static struct usb_driver carl9170_driver; -+ - static void carl9170_usb_submit_data_urb(struct ar9170 *ar) - { - struct urb *urb; -@@ -968,32 +970,28 @@ err_out: - - static void carl9170_usb_firmware_failed(struct ar9170 *ar) - { -- struct device *parent = ar->udev->dev.parent; -- struct usb_device *udev; -- -- /* -- * Store a copy of the usb_device pointer locally. -- * This is because device_release_driver initiates -- * carl9170_usb_disconnect, which in turn frees our -- * driver context (ar). -+ /* Store a copies of the usb_interface and usb_device pointer locally. -+ * This is because release_driver initiates carl9170_usb_disconnect, -+ * which in turn frees our driver context (ar). - */ -- udev = ar->udev; -+ struct usb_interface *intf = ar->intf; -+ struct usb_device *udev = ar->udev; - - complete(&ar->fw_load_wait); -+ /* at this point 'ar' could be already freed. Don't use it anymore */ -+ ar = NULL; - - /* unbind anything failed */ -- if (parent) -- device_lock(parent); -- -- device_release_driver(&udev->dev); -- if (parent) -- device_unlock(parent); -+ usb_lock_device(udev); -+ usb_driver_release_interface(&carl9170_driver, intf); -+ usb_unlock_device(udev); - -- usb_put_dev(udev); -+ usb_put_intf(intf); - } - - static void carl9170_usb_firmware_finish(struct ar9170 *ar) - { -+ struct usb_interface *intf = ar->intf; - int err; - - err = carl9170_parse_firmware(ar); -@@ -1011,7 +1009,7 @@ static void carl9170_usb_firmware_finish(struct ar9170 *ar) - goto err_unrx; - - complete(&ar->fw_load_wait); -- usb_put_dev(ar->udev); -+ usb_put_intf(intf); - return; - - err_unrx: -@@ -1054,7 +1052,6 @@ static int carl9170_usb_probe(struct usb_interface *intf, - return PTR_ERR(ar); - - udev = interface_to_usbdev(intf); -- usb_get_dev(udev); - ar->udev = udev; - ar->intf = intf; - ar->features = id->driver_info; -@@ -1096,15 +1093,14 @@ static int carl9170_usb_probe(struct usb_interface *intf, - atomic_set(&ar->rx_anch_urbs, 0); - atomic_set(&ar->rx_pool_urbs, 0); - -- usb_get_dev(ar->udev); -+ usb_get_intf(intf); - - carl9170_set_state(ar, CARL9170_STOPPED); - - err = request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME, - &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2); - if (err) { -- usb_put_dev(udev); -- usb_put_dev(udev); -+ usb_put_intf(intf); - carl9170_free(ar); - } - return err; -@@ -1133,7 +1129,6 @@ static void carl9170_usb_disconnect(struct usb_interface *intf) - - carl9170_release_firmware(ar); - carl9170_free(ar); -- usb_put_dev(udev); - } - - #ifdef CONFIG_PM -diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h -index 1e1e81a0a8d4..9a5eb9ed8921 100644 ---- a/drivers/net/wireless/mwifiex/fw.h -+++ b/drivers/net/wireless/mwifiex/fw.h -@@ -1589,9 +1589,10 @@ struct mwifiex_ie_types_wmm_queue_status { - struct ieee_types_vendor_header { - u8 element_id; - u8 len; -- u8 oui[4]; /* 0~2: oui, 3: oui_type */ -- u8 oui_subtype; -- u8 version; -+ struct { -+ u8 oui[3]; -+ u8 oui_type; -+ } __packed oui; - } __packed; - - struct ieee_types_wmm_parameter { -@@ -1605,6 +1606,9 @@ struct ieee_types_wmm_parameter { - * Version [1] - */ - struct ieee_types_vendor_header vend_hdr; -+ u8 oui_subtype; -+ u8 version; -+ - u8 qos_info_bitmap; - u8 reserved; - struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS]; -@@ -1622,6 +1626,8 @@ struct ieee_types_wmm_info { - * Version [1] - */ - struct ieee_types_vendor_header vend_hdr; -+ u8 oui_subtype; -+ u8 version; - - u8 qos_info_bitmap; - } __packed; -diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c -index abf52d25b981..de8435709735 100644 ---- a/drivers/net/wireless/mwifiex/ie.c -+++ b/drivers/net/wireless/mwifiex/ie.c -@@ -328,6 +328,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, - struct ieee80211_vendor_ie *vendorhdr; - u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0; - int left_len, parsed_len = 0; -+ unsigned int token_len; -+ int err = 0; - - if (!info->tail || !info->tail_len) - return 0; -@@ -343,6 +345,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, - */ - while (left_len > sizeof(struct ieee_types_header)) { - hdr = (void *)(info->tail + parsed_len); -+ token_len = hdr->len + sizeof(struct ieee_types_header); -+ if (token_len > left_len) { -+ err = -EINVAL; -+ goto out; -+ } -+ - switch (hdr->element_id) { - case WLAN_EID_SSID: - case WLAN_EID_SUPP_RATES: -@@ -356,13 +364,16 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, - case WLAN_EID_VENDOR_SPECIFIC: - break; - default: -- memcpy(gen_ie->ie_buffer + ie_len, hdr, -- hdr->len + sizeof(struct ieee_types_header)); -- ie_len += hdr->len + sizeof(struct ieee_types_header); -+ if (ie_len + token_len > IEEE_MAX_IE_SIZE) { -+ err = -EINVAL; -+ goto out; -+ } -+ memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len); -+ ie_len += token_len; - break; - } -- left_len -= hdr->len + sizeof(struct ieee_types_header); -- parsed_len += hdr->len + sizeof(struct ieee_types_header); -+ left_len -= token_len; -+ parsed_len += token_len; - } - - /* parse only WPA vendor IE from tail, WMM IE is configured by -@@ -372,15 +383,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, - WLAN_OUI_TYPE_MICROSOFT_WPA, - info->tail, info->tail_len); - if (vendorhdr) { -- memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, -- vendorhdr->len + sizeof(struct ieee_types_header)); -- ie_len += vendorhdr->len + sizeof(struct ieee_types_header); -+ token_len = vendorhdr->len + sizeof(struct ieee_types_header); -+ if (ie_len + token_len > IEEE_MAX_IE_SIZE) { -+ err = -EINVAL; -+ goto out; -+ } -+ memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len); -+ ie_len += token_len; - } - -- if (!ie_len) { -- kfree(gen_ie); -- return 0; -- } -+ if (!ie_len) -+ goto out; - - gen_ie->ie_index = cpu_to_le16(gen_idx); - gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON | -@@ -390,13 +403,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, - - if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL, - NULL, NULL)) { -- kfree(gen_ie); -- return -1; -+ err = -EINVAL; -+ goto out; - } - - priv->gen_idx = gen_idx; -+ -+ out: - kfree(gen_ie); -- return 0; -+ return err; - } - - /* This function parses different IEs-head & tail IEs, beacon IEs, -diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c -index fb98f42cb5e7..673ca812bd4c 100644 ---- a/drivers/net/wireless/mwifiex/scan.c -+++ b/drivers/net/wireless/mwifiex/scan.c -@@ -1219,6 +1219,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - } - switch (element_id) { - case WLAN_EID_SSID: -+ if (element_len > IEEE80211_MAX_SSID_LEN) -+ return -EINVAL; - bss_entry->ssid.ssid_len = element_len; - memcpy(bss_entry->ssid.ssid, (current_ptr + 2), - element_len); -@@ -1228,6 +1230,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_SUPP_RATES: -+ if (element_len > MWIFIEX_SUPPORTED_RATES) -+ return -EINVAL; - memcpy(bss_entry->data_rates, current_ptr + 2, - element_len); - memcpy(bss_entry->supported_rates, current_ptr + 2, -@@ -1237,6 +1241,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_FH_PARAMS: -+ if (element_len + 2 < sizeof(*fh_param_set)) -+ return -EINVAL; - fh_param_set = - (struct ieee_types_fh_param_set *) current_ptr; - memcpy(&bss_entry->phy_param_set.fh_param_set, -@@ -1245,6 +1251,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_DS_PARAMS: -+ if (element_len + 2 < sizeof(*ds_param_set)) -+ return -EINVAL; - ds_param_set = - (struct ieee_types_ds_param_set *) current_ptr; - -@@ -1256,6 +1264,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_CF_PARAMS: -+ if (element_len + 2 < sizeof(*cf_param_set)) -+ return -EINVAL; - cf_param_set = - (struct ieee_types_cf_param_set *) current_ptr; - memcpy(&bss_entry->ss_param_set.cf_param_set, -@@ -1264,6 +1274,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_IBSS_PARAMS: -+ if (element_len + 2 < sizeof(*ibss_param_set)) -+ return -EINVAL; - ibss_param_set = - (struct ieee_types_ibss_param_set *) - current_ptr; -@@ -1273,10 +1285,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_ERP_INFO: -+ if (!element_len) -+ return -EINVAL; - bss_entry->erp_flags = *(current_ptr + 2); - break; - - case WLAN_EID_PWR_CONSTRAINT: -+ if (!element_len) -+ return -EINVAL; - bss_entry->local_constraint = *(current_ptr + 2); - bss_entry->sensed_11h = true; - break; -@@ -1319,15 +1335,22 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - vendor_ie = (struct ieee_types_vendor_specific *) - current_ptr; - -- if (!memcmp -- (vendor_ie->vend_hdr.oui, wpa_oui, -- sizeof(wpa_oui))) { -+ /* 802.11 requires at least 3-byte OUI. */ -+ if (element_len < sizeof(vendor_ie->vend_hdr.oui.oui)) -+ return -EINVAL; -+ -+ /* Not long enough for a match? Skip it. */ -+ if (element_len < sizeof(wpa_oui)) -+ break; -+ -+ if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui, -+ sizeof(wpa_oui))) { - bss_entry->bcn_wpa_ie = - (struct ieee_types_vendor_specific *) - current_ptr; - bss_entry->wpa_offset = (u16) - (current_ptr - bss_entry->beacon_buf); -- } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui, -+ } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui, - sizeof(wmm_oui))) { - if (total_ie_len == - sizeof(struct ieee_types_wmm_parameter) || -diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c -index 6cfa2969b123..12eedb33db7b 100644 ---- a/drivers/net/wireless/mwifiex/sta_ioctl.c -+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c -@@ -1305,7 +1305,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr, - pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr; - /* Test to see if it is a WPA IE, if not, then it is a gen IE */ - if (((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) && -- (!memcmp(pvendor_ie->oui, wpa_oui, sizeof(wpa_oui)))) || -+ (!memcmp(&pvendor_ie->oui, wpa_oui, sizeof(wpa_oui)))) || - (pvendor_ie->element_id == WLAN_EID_RSN)) { - - /* IE is a WPA/WPA2 IE so call set_wpa function */ -@@ -1330,7 +1330,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr, - */ - pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr; - if ((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) && -- (!memcmp(pvendor_ie->oui, wps_oui, sizeof(wps_oui)))) { -+ (!memcmp(&pvendor_ie->oui, wps_oui, sizeof(wps_oui)))) { - priv->wps.session_enable = true; - mwifiex_dbg(priv->adapter, INFO, - "info: WPS Session Enabled.\n"); -diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c -index ed8b69d1d65c..7015dfab49cf 100644 ---- a/drivers/net/wireless/mwifiex/wmm.c -+++ b/drivers/net/wireless/mwifiex/wmm.c -@@ -240,7 +240,7 @@ mwifiex_wmm_setup_queue_priorities(struct mwifiex_private *priv, - mwifiex_dbg(priv->adapter, INFO, - "info: WMM Parameter IE: version=%d,\t" - "qos_info Parameter Set Count=%d, Reserved=%#x\n", -- wmm_ie->vend_hdr.version, wmm_ie->qos_info_bitmap & -+ wmm_ie->version, wmm_ie->qos_info_bitmap & - IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK, - wmm_ie->reserved); - -diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c -index 35286907c636..d0090c5c88e7 100644 ---- a/drivers/s390/cio/qdio_setup.c -+++ b/drivers/s390/cio/qdio_setup.c -@@ -150,6 +150,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues) - return -ENOMEM; - } - irq_ptr_qs[i] = q; -+ INIT_LIST_HEAD(&q->entry); - } - return 0; - } -@@ -178,6 +179,7 @@ static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr, - q->mask = 1 << (31 - i); - q->nr = i; - q->handler = handler; -+ INIT_LIST_HEAD(&q->entry); - } - - static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr, -diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c -index 30e9fbbff051..debe69adfc70 100644 ---- a/drivers/s390/cio/qdio_thinint.c -+++ b/drivers/s390/cio/qdio_thinint.c -@@ -80,7 +80,6 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr) - mutex_lock(&tiq_list_lock); - list_add_rcu(&irq_ptr->input_qs[0]->entry, &tiq_list); - mutex_unlock(&tiq_list_lock); -- xchg(irq_ptr->dsci, 1 << 7); - } - - void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr) -@@ -88,14 +87,14 @@ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr) - struct qdio_q *q; - - q = irq_ptr->input_qs[0]; -- /* if establish triggered an error */ -- if (!q || !q->entry.prev || !q->entry.next) -+ if (!q) - return; - - mutex_lock(&tiq_list_lock); - list_del_rcu(&q->entry); - mutex_unlock(&tiq_list_lock); - synchronize_rcu(); -+ INIT_LIST_HEAD(&q->entry); - } - - static inline int has_multiple_inq_on_dsci(struct qdio_irq *irq_ptr) -diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c -index 4b39f6960c0a..bead4f645546 100644 ---- a/drivers/staging/comedi/drivers/amplc_pci230.c -+++ b/drivers/staging/comedi/drivers/amplc_pci230.c -@@ -2324,7 +2324,8 @@ static irqreturn_t pci230_interrupt(int irq, void *d) - devpriv->intr_running = false; - spin_unlock_irqrestore(&devpriv->isr_spinlock, irqflags); - -- comedi_handle_events(dev, s_ao); -+ if (s_ao) -+ comedi_handle_events(dev, s_ao); - comedi_handle_events(dev, s_ai); - - return IRQ_HANDLED; -diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c -index b63472de761a..c62a1cc2b223 100644 ---- a/drivers/staging/comedi/drivers/dt282x.c -+++ b/drivers/staging/comedi/drivers/dt282x.c -@@ -553,7 +553,8 @@ static irqreturn_t dt282x_interrupt(int irq, void *d) - } - #endif - comedi_handle_events(dev, s); -- comedi_handle_events(dev, s_ao); -+ if (s_ao) -+ comedi_handle_events(dev, s_ao); - - return IRQ_RETVAL(handled); - } -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 7413f89660f7..e69f20b2a3f4 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -207,11 +207,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) - out = dev->port_usb->out_ep; - else - out = NULL; -- spin_unlock_irqrestore(&dev->lock, flags); - - if (!out) -+ { -+ spin_unlock_irqrestore(&dev->lock, flags); - return -ENOTCONN; -- -+ } - - /* Padding up to RX_EXTRA handles minor disagreements with host. - * Normally we use the USB "terminate on short read" convention; -@@ -232,6 +233,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags) - - if (dev->port_usb->is_fixed) - size = max_t(size_t, size, dev->port_usb->fixed_out_len); -+ spin_unlock_irqrestore(&dev->lock, flags); - - skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags); - if (skb == NULL) { -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index 6f37966ea54b..5e2aa4f85c81 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -819,9 +819,8 @@ static int __usbhsf_dma_map_ctrl(struct usbhs_pkt *pkt, int map) - } - - static void usbhsf_dma_complete(void *arg); --static void xfer_work(struct work_struct *work) -+static void usbhsf_dma_xfer_preparing(struct usbhs_pkt *pkt) - { -- struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work); - struct usbhs_pipe *pipe = pkt->pipe; - struct usbhs_fifo *fifo; - struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); -@@ -829,12 +828,10 @@ static void xfer_work(struct work_struct *work) - struct dma_chan *chan; - struct device *dev = usbhs_priv_to_dev(priv); - enum dma_transfer_direction dir; -- unsigned long flags; - -- usbhs_lock(priv, flags); - fifo = usbhs_pipe_to_fifo(pipe); - if (!fifo) -- goto xfer_work_end; -+ return; - - chan = usbhsf_dma_chan_get(fifo, pkt); - dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV; -@@ -843,7 +840,7 @@ static void xfer_work(struct work_struct *work) - pkt->trans, dir, - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - if (!desc) -- goto xfer_work_end; -+ return; - - desc->callback = usbhsf_dma_complete; - desc->callback_param = pipe; -@@ -851,7 +848,7 @@ static void xfer_work(struct work_struct *work) - pkt->cookie = dmaengine_submit(desc); - if (pkt->cookie < 0) { - dev_err(dev, "Failed to submit dma descriptor\n"); -- goto xfer_work_end; -+ return; - } - - dev_dbg(dev, " %s %d (%d/ %d)\n", -@@ -862,8 +859,17 @@ static void xfer_work(struct work_struct *work) - dma_async_issue_pending(chan); - usbhsf_dma_start(pipe, fifo); - usbhs_pipe_enable(pipe); -+} -+ -+static void xfer_work(struct work_struct *work) -+{ -+ struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work); -+ struct usbhs_pipe *pipe = pkt->pipe; -+ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); -+ unsigned long flags; - --xfer_work_end: -+ usbhs_lock(priv, flags); -+ usbhsf_dma_xfer_preparing(pkt); - usbhs_unlock(priv, flags); - } - -@@ -916,8 +922,13 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) - pkt->trans = len; - - usbhsf_tx_irq_ctrl(pipe, 0); -- INIT_WORK(&pkt->work, xfer_work); -- schedule_work(&pkt->work); -+ /* FIXME: Workaound for usb dmac that driver can be used in atomic */ -+ if (usbhs_get_dparam(priv, has_usb_dmac)) { -+ usbhsf_dma_xfer_preparing(pkt); -+ } else { -+ INIT_WORK(&pkt->work, xfer_work); -+ schedule_work(&pkt->work); -+ } - - return 0; - -@@ -1023,8 +1034,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt, - - pkt->trans = pkt->length; - -- INIT_WORK(&pkt->work, xfer_work); -- schedule_work(&pkt->work); -+ usbhsf_dma_xfer_preparing(pkt); - - return 0; - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index af258bb632dd..7edcd5a8d175 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1024,6 +1024,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, - /* EZPrototypes devices */ - { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, -+ { USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 15d220eaf6e6..ed6b36674c15 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1542,3 +1542,9 @@ - #define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */ - #define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */ - #define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */ -+ -+/* -+ * Unjo AB -+ */ -+#define UNJO_VID 0x22B7 -+#define UNJO_ISODEBUG_V1_PID 0x150D -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 1effe74ec638..d7b31fdce94d 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1338,6 +1338,7 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0601, 0xff) }, /* GosunCn ZTE WeLink ME3630 (RNDIS mode) */ - { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), - .driver_info = RSVD(4) }, -diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c -index e4f4fc4e56ab..77bd7bfb6329 100644 ---- a/fs/ext4/crypto_policy.c -+++ b/fs/ext4/crypto_policy.c -@@ -111,6 +111,8 @@ int ext4_process_policy(const struct ext4_encryption_policy *policy, - if (!ext4_inode_has_encryption_context(inode)) { - if (!S_ISDIR(inode->i_mode)) - return -EINVAL; -+ if (IS_DEADDIR(inode)) -+ return -ENOENT; - if (!ext4_empty_dir(inode)) - return -ENOTEMPTY; - return ext4_create_encryption_context_from_policy(inode, -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 613193c6bb42..3876448ec0dc 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -479,13 +479,15 @@ static struct buffer_head *udf_getblk(struct inode *inode, long block, - return NULL; - } - --/* Extend the file by 'blocks' blocks, return the number of extents added */ -+/* Extend the file with new blocks totaling 'new_block_bytes', -+ * return the number of extents added -+ */ - static int udf_do_extend_file(struct inode *inode, - struct extent_position *last_pos, - struct kernel_long_ad *last_ext, -- sector_t blocks) -+ loff_t new_block_bytes) - { -- sector_t add; -+ uint32_t add; - int count = 0, fake = !(last_ext->extLength & UDF_EXTENT_LENGTH_MASK); - struct super_block *sb = inode->i_sb; - struct kernel_lb_addr prealloc_loc = {}; -@@ -495,7 +497,7 @@ static int udf_do_extend_file(struct inode *inode, - - /* The previous extent is fake and we should not extend by anything - * - there's nothing to do... */ -- if (!blocks && fake) -+ if (!new_block_bytes && fake) - return 0; - - iinfo = UDF_I(inode); -@@ -526,13 +528,12 @@ static int udf_do_extend_file(struct inode *inode, - /* Can we merge with the previous extent? */ - if ((last_ext->extLength & UDF_EXTENT_FLAG_MASK) == - EXT_NOT_RECORDED_NOT_ALLOCATED) { -- add = ((1 << 30) - sb->s_blocksize - -- (last_ext->extLength & UDF_EXTENT_LENGTH_MASK)) >> -- sb->s_blocksize_bits; -- if (add > blocks) -- add = blocks; -- blocks -= add; -- last_ext->extLength += add << sb->s_blocksize_bits; -+ add = (1 << 30) - sb->s_blocksize - -+ (last_ext->extLength & UDF_EXTENT_LENGTH_MASK); -+ if (add > new_block_bytes) -+ add = new_block_bytes; -+ new_block_bytes -= add; -+ last_ext->extLength += add; - } - - if (fake) { -@@ -544,28 +545,27 @@ static int udf_do_extend_file(struct inode *inode, - last_ext->extLength, 1); - - /* Managed to do everything necessary? */ -- if (!blocks) -+ if (!new_block_bytes) - goto out; - - /* All further extents will be NOT_RECORDED_NOT_ALLOCATED */ - last_ext->extLocation.logicalBlockNum = 0; - last_ext->extLocation.partitionReferenceNum = 0; -- add = (1 << (30-sb->s_blocksize_bits)) - 1; -- last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | -- (add << sb->s_blocksize_bits); -+ add = (1 << 30) - sb->s_blocksize; -+ last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | add; - - /* Create enough extents to cover the whole hole */ -- while (blocks > add) { -- blocks -= add; -+ while (new_block_bytes > add) { -+ new_block_bytes -= add; - err = udf_add_aext(inode, last_pos, &last_ext->extLocation, - last_ext->extLength, 1); - if (err) - return err; - count++; - } -- if (blocks) { -+ if (new_block_bytes) { - last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | -- (blocks << sb->s_blocksize_bits); -+ new_block_bytes; - err = udf_add_aext(inode, last_pos, &last_ext->extLocation, - last_ext->extLength, 1); - if (err) -@@ -596,6 +596,24 @@ out: - return count; - } - -+/* Extend the final block of the file to final_block_len bytes */ -+static void udf_do_extend_final_block(struct inode *inode, -+ struct extent_position *last_pos, -+ struct kernel_long_ad *last_ext, -+ uint32_t final_block_len) -+{ -+ struct super_block *sb = inode->i_sb; -+ uint32_t added_bytes; -+ -+ added_bytes = final_block_len - -+ (last_ext->extLength & (sb->s_blocksize - 1)); -+ last_ext->extLength += added_bytes; -+ UDF_I(inode)->i_lenExtents += added_bytes; -+ -+ udf_write_aext(inode, last_pos, &last_ext->extLocation, -+ last_ext->extLength, 1); -+} -+ - static int udf_extend_file(struct inode *inode, loff_t newsize) - { - -@@ -605,10 +623,12 @@ static int udf_extend_file(struct inode *inode, loff_t newsize) - int8_t etype; - struct super_block *sb = inode->i_sb; - sector_t first_block = newsize >> sb->s_blocksize_bits, offset; -+ unsigned long partial_final_block; - int adsize; - struct udf_inode_info *iinfo = UDF_I(inode); - struct kernel_long_ad extent; -- int err; -+ int err = 0; -+ int within_final_block; - - if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT) - adsize = sizeof(struct short_ad); -@@ -618,18 +638,8 @@ static int udf_extend_file(struct inode *inode, loff_t newsize) - BUG(); - - etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset); -+ within_final_block = (etype != -1); - -- /* File has extent covering the new size (could happen when extending -- * inside a block)? */ -- if (etype != -1) -- return 0; -- if (newsize & (sb->s_blocksize - 1)) -- offset++; -- /* Extended file just to the boundary of the last file block? */ -- if (offset == 0) -- return 0; -- -- /* Truncate is extending the file by 'offset' blocks */ - if ((!epos.bh && epos.offset == udf_file_entry_alloc_offset(inode)) || - (epos.bh && epos.offset == sizeof(struct allocExtDesc))) { - /* File has no extents at all or has empty last -@@ -643,7 +653,22 @@ static int udf_extend_file(struct inode *inode, loff_t newsize) - &extent.extLength, 0); - extent.extLength |= etype << 30; - } -- err = udf_do_extend_file(inode, &epos, &extent, offset); -+ -+ partial_final_block = newsize & (sb->s_blocksize - 1); -+ -+ /* File has extent covering the new size (could happen when extending -+ * inside a block)? -+ */ -+ if (within_final_block) { -+ /* Extending file within the last file block */ -+ udf_do_extend_final_block(inode, &epos, &extent, -+ partial_final_block); -+ } else { -+ loff_t add = ((loff_t)offset << sb->s_blocksize_bits) | -+ partial_final_block; -+ err = udf_do_extend_file(inode, &epos, &extent, add); -+ } -+ - if (err < 0) - goto out; - err = 0; -@@ -748,6 +773,7 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, - /* Are we beyond EOF? */ - if (etype == -1) { - int ret; -+ loff_t hole_len; - isBeyondEOF = true; - if (count) { - if (c) -@@ -763,7 +789,8 @@ static sector_t inode_getblk(struct inode *inode, sector_t block, - startnum = (offset > 0); - } - /* Create extents for the hole between EOF and offset */ -- ret = udf_do_extend_file(inode, &prev_epos, laarr, offset); -+ hole_len = (loff_t)offset << inode->i_blkbits; -+ ret = udf_do_extend_file(inode, &prev_epos, laarr, hole_len); - if (ret < 0) { - brelse(prev_epos.bh); - brelse(cur_epos.bh); -diff --git a/include/linux/vmw_vmci_defs.h b/include/linux/vmw_vmci_defs.h -index 65ac54c61c18..7023432013e8 100644 ---- a/include/linux/vmw_vmci_defs.h -+++ b/include/linux/vmw_vmci_defs.h -@@ -75,9 +75,18 @@ enum { - - /* - * A single VMCI device has an upper limit of 128MB on the amount of -- * memory that can be used for queue pairs. -+ * memory that can be used for queue pairs. Since each queue pair -+ * consists of at least two pages, the memory limit also dictates the -+ * number of queue pairs a guest can create. - */ - #define VMCI_MAX_GUEST_QP_MEMORY (128 * 1024 * 1024) -+#define VMCI_MAX_GUEST_QP_COUNT (VMCI_MAX_GUEST_QP_MEMORY / PAGE_SIZE / 2) -+ -+/* -+ * There can be at most PAGE_SIZE doorbells since there is one doorbell -+ * per byte in the doorbell bitmap page. -+ */ -+#define VMCI_MAX_GUEST_DOORBELL_COUNT PAGE_SIZE - - /* - * Queues with pre-mapped data pages must be small, so that we don't pin -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 17230ca00bd4..41fe80e3380f 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -5078,7 +5078,7 @@ static void perf_sample_regs_user(struct perf_regs *regs_user, - if (user_mode(regs)) { - regs_user->abi = perf_reg_abi(current); - regs_user->regs = regs; -- } else if (current->mm) { -+ } else if (!(current->flags & PF_KTHREAD)) { - perf_get_regs_user(regs_user, regs, regs_user_copy); - } else { - regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE; -diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c -index 1cbc7bd26de3..4bd8f3f056d8 100644 ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -1138,7 +1138,8 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata) - ifmsh->chsw_ttl = 0; - - /* Remove the CSA and MCSP elements from the beacon */ -- tmp_csa_settings = rcu_dereference(ifmsh->csa); -+ tmp_csa_settings = rcu_dereference_protected(ifmsh->csa, -+ lockdep_is_held(&sdata->wdev.mtx)); - RCU_INIT_POINTER(ifmsh->csa, NULL); - if (tmp_csa_settings) - kfree_rcu(tmp_csa_settings, rcu_head); -@@ -1160,6 +1161,8 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata, - struct mesh_csa_settings *tmp_csa_settings; - int ret = 0; - -+ lockdep_assert_held(&sdata->wdev.mtx); -+ - tmp_csa_settings = kmalloc(sizeof(*tmp_csa_settings), - GFP_ATOMIC); - if (!tmp_csa_settings) -diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c -index da86a8e0a95a..e836b5ff2060 100644 ---- a/samples/bpf/bpf_load.c -+++ b/samples/bpf/bpf_load.c -@@ -336,7 +336,7 @@ void read_trace_pipe(void) - static char buf[4096]; - ssize_t sz; - -- sz = read(trace_fd, buf, sizeof(buf)); -+ sz = read(trace_fd, buf, sizeof(buf) - 1); - if (sz > 0) { - buf[sz] = 0; - puts(buf); diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.186-187.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.186-187.patch deleted file mode 100644 index 65c2212341ec..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.186-187.patch +++ /dev/null @@ -1,8471 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0e3ec0053eb3..fdfe65eefa36 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 186 -+SUBLEVEL = 187 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c -index ea319c055f5d..1b7b4684c35b 100644 ---- a/arch/arm64/crypto/sha1-ce-glue.c -+++ b/arch/arm64/crypto/sha1-ce-glue.c -@@ -50,7 +50,7 @@ static int sha1_ce_finup(struct shash_desc *desc, const u8 *data, - unsigned int len, u8 *out) - { - struct sha1_ce_state *sctx = shash_desc_ctx(desc); -- bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE); -+ bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE) && len; - - /* - * Allow the asm code to perform the finalization if there is no -diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c -index 0ed9486f75dd..356ca9397a86 100644 ---- a/arch/arm64/crypto/sha2-ce-glue.c -+++ b/arch/arm64/crypto/sha2-ce-glue.c -@@ -52,7 +52,7 @@ static int sha256_ce_finup(struct shash_desc *desc, const u8 *data, - unsigned int len, u8 *out) - { - struct sha256_ce_state *sctx = shash_desc_ctx(desc); -- bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE); -+ bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE) && len; - - /* - * Allow the asm code to perform the finalization if there is no -diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c -index d1ce8e2f98b9..4d0577d09681 100644 ---- a/arch/arm64/kernel/acpi.c -+++ b/arch/arm64/kernel/acpi.c -@@ -141,10 +141,14 @@ static int __init acpi_fadt_sanity_check(void) - */ - if (table->revision < 5 || - (table->revision == 5 && fadt->minor_revision < 1)) { -- pr_err("Unsupported FADT revision %d.%d, should be 5.1+\n", -+ pr_err(FW_BUG "Unsupported FADT revision %d.%d, should be 5.1+\n", - table->revision, fadt->minor_revision); -- ret = -EINVAL; -- goto out; -+ -+ if (!fadt->arm_boot_flags) { -+ ret = -EINVAL; -+ goto out; -+ } -+ pr_err("FADT has ARM boot flags set, assuming 5.1\n"); - } - - if (!(fadt->flags & ACPI_FADT_HW_REDUCED)) { -diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile -index d5bdee115f22..d4918a2bca1b 100644 ---- a/arch/mips/boot/compressed/Makefile -+++ b/arch/mips/boot/compressed/Makefile -@@ -66,6 +66,8 @@ OBJCOPYFLAGS_piggy.o := --add-section=.image=$(obj)/vmlinux.bin.z \ - $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE - $(call if_changed,objcopy) - -+HOSTCFLAGS_calc_vmlinuz_load_addr.o += $(LINUXINCLUDE) -+ - # Calculate the load address of the compressed kernel image - hostprogs-y := calc_vmlinuz_load_addr - -diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -index 542c3ede9722..d14f75ec8273 100644 ---- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -+++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c -@@ -13,7 +13,7 @@ - #include - #include - #include --#include "../../../../include/linux/sizes.h" -+#include - - int main(int argc, char *argv[]) - { -diff --git a/arch/mips/include/asm/mach-ath79/ar933x_uart.h b/arch/mips/include/asm/mach-ath79/ar933x_uart.h -index c2917b39966b..bba2c8837951 100644 ---- a/arch/mips/include/asm/mach-ath79/ar933x_uart.h -+++ b/arch/mips/include/asm/mach-ath79/ar933x_uart.h -@@ -27,8 +27,8 @@ - #define AR933X_UART_CS_PARITY_S 0 - #define AR933X_UART_CS_PARITY_M 0x3 - #define AR933X_UART_CS_PARITY_NONE 0 --#define AR933X_UART_CS_PARITY_ODD 1 --#define AR933X_UART_CS_PARITY_EVEN 2 -+#define AR933X_UART_CS_PARITY_ODD 2 -+#define AR933X_UART_CS_PARITY_EVEN 3 - #define AR933X_UART_CS_IF_MODE_S 2 - #define AR933X_UART_CS_IF_MODE_M 0x3 - #define AR933X_UART_CS_IF_MODE_NONE 0 -diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c -index ce0b2b4075c7..c62522bda2db 100644 ---- a/arch/parisc/kernel/ptrace.c -+++ b/arch/parisc/kernel/ptrace.c -@@ -156,6 +156,9 @@ long arch_ptrace(struct task_struct *child, long request, - if ((addr & (sizeof(unsigned long)-1)) || - addr >= sizeof(struct pt_regs)) - break; -+ if (addr == PT_IAOQ0 || addr == PT_IAOQ1) { -+ data |= 3; /* ensure userspace privilege */ -+ } - if ((addr >= PT_GR1 && addr <= PT_GR31) || - addr == PT_IAOQ0 || addr == PT_IAOQ1 || - (addr >= PT_FR0 && addr <= PT_FR31 + 4) || -@@ -189,16 +192,18 @@ long arch_ptrace(struct task_struct *child, long request, - - static compat_ulong_t translate_usr_offset(compat_ulong_t offset) - { -- if (offset < 0) -- return sizeof(struct pt_regs); -- else if (offset <= 32*4) /* gr[0..31] */ -- return offset * 2 + 4; -- else if (offset <= 32*4+32*8) /* gr[0..31] + fr[0..31] */ -- return offset + 32*4; -- else if (offset < sizeof(struct pt_regs)/2 + 32*4) -- return offset * 2 + 4 - 32*8; -+ compat_ulong_t pos; -+ -+ if (offset < 32*4) /* gr[0..31] */ -+ pos = offset * 2 + 4; -+ else if (offset < 32*4+32*8) /* fr[0] ... fr[31] */ -+ pos = (offset - 32*4) + PT_FR0; -+ else if (offset < sizeof(struct pt_regs)/2 + 32*4) /* sr[0] ... ipsw */ -+ pos = (offset - 32*4 - 32*8) * 2 + PT_SR0 + 4; - else -- return sizeof(struct pt_regs); -+ pos = sizeof(struct pt_regs); -+ -+ return pos; - } - - long compat_arch_ptrace(struct task_struct *child, compat_long_t request, -@@ -242,9 +247,12 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, - addr = translate_usr_offset(addr); - if (addr >= sizeof(struct pt_regs)) - break; -+ if (addr == PT_IAOQ0+4 || addr == PT_IAOQ1+4) { -+ data |= 3; /* ensure userspace privilege */ -+ } - if (addr >= PT_FR0 && addr <= PT_FR31 + 4) { - /* Special case, fp regs are 64 bits anyway */ -- *(__u64 *) ((char *) task_regs(child) + addr) = data; -+ *(__u32 *) ((char *) task_regs(child) + addr) = data; - ret = 0; - } - else if ((addr >= PT_GR1+4 && addr <= PT_GR31+4) || -diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c -index 6696c1986844..16193d7b0635 100644 ---- a/arch/powerpc/kernel/eeh.c -+++ b/arch/powerpc/kernel/eeh.c -@@ -363,10 +363,19 @@ static inline unsigned long eeh_token_to_phys(unsigned long token) - NULL, &hugepage_shift); - if (!ptep) - return token; -- WARN_ON(hugepage_shift); -- pa = pte_pfn(*ptep) << PAGE_SHIFT; - -- return pa | (token & (PAGE_SIZE-1)); -+ pa = pte_pfn(*ptep); -+ -+ /* On radix we can do hugepage mappings for io, so handle that */ -+ if (hugepage_shift) { -+ pa <<= hugepage_shift; -+ pa |= token & ((1ul << hugepage_shift) - 1); -+ } else { -+ pa <<= PAGE_SHIFT; -+ pa |= token & (PAGE_SIZE - 1); -+ } -+ -+ return pa; - } - - /* -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 10e7cec9553d..a44f1755dc4b 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -1719,7 +1719,7 @@ handle_page_fault: - addi r3,r1,STACK_FRAME_OVERHEAD - bl do_page_fault - cmpdi r3,0 -- beq+ 12f -+ beq+ ret_from_except_lite - bl save_nvgprs - mr r5,r3 - addi r3,r1,STACK_FRAME_OVERHEAD -@@ -1734,7 +1734,12 @@ handle_dabr_fault: - ld r5,_DSISR(r1) - addi r3,r1,STACK_FRAME_OVERHEAD - bl do_break --12: b ret_from_except_lite -+ /* -+ * do_break() may have changed the NV GPRS while handling a breakpoint. -+ * If so, we need to restore them with their updated values. Don't use -+ * ret_from_except_lite here. -+ */ -+ b ret_from_except - - - /* We have a page fault that hash_page could handle but HV refused -diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c -index 2e710c15893f..a38d7293460d 100644 ---- a/arch/powerpc/kernel/pci_of_scan.c -+++ b/arch/powerpc/kernel/pci_of_scan.c -@@ -45,6 +45,8 @@ static unsigned int pci_parse_of_flags(u32 addr0, int bridge) - if (addr0 & 0x02000000) { - flags = IORESOURCE_MEM | PCI_BASE_ADDRESS_SPACE_MEMORY; - flags |= (addr0 >> 22) & PCI_BASE_ADDRESS_MEM_TYPE_64; -+ if (flags & PCI_BASE_ADDRESS_MEM_TYPE_64) -+ flags |= IORESOURCE_MEM_64; - flags |= (addr0 >> 28) & PCI_BASE_ADDRESS_MEM_TYPE_1M; - if (addr0 & 0x40000000) - flags |= IORESOURCE_PREFETCH -diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c -index ef7c24e84a62..46f8292e5212 100644 ---- a/arch/powerpc/kernel/signal_32.c -+++ b/arch/powerpc/kernel/signal_32.c -@@ -1261,6 +1261,9 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8, - goto bad; - - if (MSR_TM_ACTIVE(msr_hi<<32)) { -+ /* Trying to start TM on non TM system */ -+ if (!cpu_has_feature(CPU_FTR_TM)) -+ goto bad; - /* We only recheckpoint on return if we're - * transaction. - */ -diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c -index c676ecec0869..8be659db0319 100644 ---- a/arch/powerpc/kernel/signal_64.c -+++ b/arch/powerpc/kernel/signal_64.c -@@ -695,6 +695,11 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5, - if (MSR_TM_ACTIVE(msr)) { - /* We recheckpoint on return. */ - struct ucontext __user *uc_transact; -+ -+ /* Trying to start TM on non TM system */ -+ if (!cpu_has_feature(CPU_FTR_TM)) -+ goto badframe; -+ - if (__get_user(uc_transact, &uc->uc_link)) - goto badframe; - if (restore_tm_sigcontexts(regs, &uc->uc_mcontext, -diff --git a/arch/powerpc/kernel/swsusp_32.S b/arch/powerpc/kernel/swsusp_32.S -index ba4dee3d233f..884d1c3a187b 100644 ---- a/arch/powerpc/kernel/swsusp_32.S -+++ b/arch/powerpc/kernel/swsusp_32.S -@@ -23,11 +23,19 @@ - #define SL_IBAT2 0x48 - #define SL_DBAT3 0x50 - #define SL_IBAT3 0x58 --#define SL_TB 0x60 --#define SL_R2 0x68 --#define SL_CR 0x6c --#define SL_LR 0x70 --#define SL_R12 0x74 /* r12 to r31 */ -+#define SL_DBAT4 0x60 -+#define SL_IBAT4 0x68 -+#define SL_DBAT5 0x70 -+#define SL_IBAT5 0x78 -+#define SL_DBAT6 0x80 -+#define SL_IBAT6 0x88 -+#define SL_DBAT7 0x90 -+#define SL_IBAT7 0x98 -+#define SL_TB 0xa0 -+#define SL_R2 0xa8 -+#define SL_CR 0xac -+#define SL_LR 0xb0 -+#define SL_R12 0xb4 /* r12 to r31 */ - #define SL_SIZE (SL_R12 + 80) - - .section .data -@@ -112,6 +120,41 @@ _GLOBAL(swsusp_arch_suspend) - mfibatl r4,3 - stw r4,SL_IBAT3+4(r11) - -+BEGIN_MMU_FTR_SECTION -+ mfspr r4,SPRN_DBAT4U -+ stw r4,SL_DBAT4(r11) -+ mfspr r4,SPRN_DBAT4L -+ stw r4,SL_DBAT4+4(r11) -+ mfspr r4,SPRN_DBAT5U -+ stw r4,SL_DBAT5(r11) -+ mfspr r4,SPRN_DBAT5L -+ stw r4,SL_DBAT5+4(r11) -+ mfspr r4,SPRN_DBAT6U -+ stw r4,SL_DBAT6(r11) -+ mfspr r4,SPRN_DBAT6L -+ stw r4,SL_DBAT6+4(r11) -+ mfspr r4,SPRN_DBAT7U -+ stw r4,SL_DBAT7(r11) -+ mfspr r4,SPRN_DBAT7L -+ stw r4,SL_DBAT7+4(r11) -+ mfspr r4,SPRN_IBAT4U -+ stw r4,SL_IBAT4(r11) -+ mfspr r4,SPRN_IBAT4L -+ stw r4,SL_IBAT4+4(r11) -+ mfspr r4,SPRN_IBAT5U -+ stw r4,SL_IBAT5(r11) -+ mfspr r4,SPRN_IBAT5L -+ stw r4,SL_IBAT5+4(r11) -+ mfspr r4,SPRN_IBAT6U -+ stw r4,SL_IBAT6(r11) -+ mfspr r4,SPRN_IBAT6L -+ stw r4,SL_IBAT6+4(r11) -+ mfspr r4,SPRN_IBAT7U -+ stw r4,SL_IBAT7(r11) -+ mfspr r4,SPRN_IBAT7L -+ stw r4,SL_IBAT7+4(r11) -+END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) -+ - #if 0 - /* Backup various CPU config stuffs */ - bl __save_cpu_setup -@@ -277,27 +320,41 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) - mtibatu 3,r4 - lwz r4,SL_IBAT3+4(r11) - mtibatl 3,r4 --#endif -- - BEGIN_MMU_FTR_SECTION -- li r4,0 -+ lwz r4,SL_DBAT4(r11) - mtspr SPRN_DBAT4U,r4 -+ lwz r4,SL_DBAT4+4(r11) - mtspr SPRN_DBAT4L,r4 -+ lwz r4,SL_DBAT5(r11) - mtspr SPRN_DBAT5U,r4 -+ lwz r4,SL_DBAT5+4(r11) - mtspr SPRN_DBAT5L,r4 -+ lwz r4,SL_DBAT6(r11) - mtspr SPRN_DBAT6U,r4 -+ lwz r4,SL_DBAT6+4(r11) - mtspr SPRN_DBAT6L,r4 -+ lwz r4,SL_DBAT7(r11) - mtspr SPRN_DBAT7U,r4 -+ lwz r4,SL_DBAT7+4(r11) - mtspr SPRN_DBAT7L,r4 -+ lwz r4,SL_IBAT4(r11) - mtspr SPRN_IBAT4U,r4 -+ lwz r4,SL_IBAT4+4(r11) - mtspr SPRN_IBAT4L,r4 -+ lwz r4,SL_IBAT5(r11) - mtspr SPRN_IBAT5U,r4 -+ lwz r4,SL_IBAT5+4(r11) - mtspr SPRN_IBAT5L,r4 -+ lwz r4,SL_IBAT6(r11) - mtspr SPRN_IBAT6U,r4 -+ lwz r4,SL_IBAT6+4(r11) - mtspr SPRN_IBAT6L,r4 -+ lwz r4,SL_IBAT7(r11) - mtspr SPRN_IBAT7U,r4 -+ lwz r4,SL_IBAT7+4(r11) - mtspr SPRN_IBAT7L,r4 - END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) -+#endif - - /* Flush all TLBs */ - lis r4,0x1000 -diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S -index 1c2802fabd57..c856cd7fcdc4 100644 ---- a/arch/powerpc/platforms/powermac/sleep.S -+++ b/arch/powerpc/platforms/powermac/sleep.S -@@ -37,10 +37,18 @@ - #define SL_IBAT2 0x48 - #define SL_DBAT3 0x50 - #define SL_IBAT3 0x58 --#define SL_TB 0x60 --#define SL_R2 0x68 --#define SL_CR 0x6c --#define SL_R12 0x70 /* r12 to r31 */ -+#define SL_DBAT4 0x60 -+#define SL_IBAT4 0x68 -+#define SL_DBAT5 0x70 -+#define SL_IBAT5 0x78 -+#define SL_DBAT6 0x80 -+#define SL_IBAT6 0x88 -+#define SL_DBAT7 0x90 -+#define SL_IBAT7 0x98 -+#define SL_TB 0xa0 -+#define SL_R2 0xa8 -+#define SL_CR 0xac -+#define SL_R12 0xb0 /* r12 to r31 */ - #define SL_SIZE (SL_R12 + 80) - - .section .text -@@ -125,6 +133,41 @@ _GLOBAL(low_sleep_handler) - mfibatl r4,3 - stw r4,SL_IBAT3+4(r1) - -+BEGIN_MMU_FTR_SECTION -+ mfspr r4,SPRN_DBAT4U -+ stw r4,SL_DBAT4(r1) -+ mfspr r4,SPRN_DBAT4L -+ stw r4,SL_DBAT4+4(r1) -+ mfspr r4,SPRN_DBAT5U -+ stw r4,SL_DBAT5(r1) -+ mfspr r4,SPRN_DBAT5L -+ stw r4,SL_DBAT5+4(r1) -+ mfspr r4,SPRN_DBAT6U -+ stw r4,SL_DBAT6(r1) -+ mfspr r4,SPRN_DBAT6L -+ stw r4,SL_DBAT6+4(r1) -+ mfspr r4,SPRN_DBAT7U -+ stw r4,SL_DBAT7(r1) -+ mfspr r4,SPRN_DBAT7L -+ stw r4,SL_DBAT7+4(r1) -+ mfspr r4,SPRN_IBAT4U -+ stw r4,SL_IBAT4(r1) -+ mfspr r4,SPRN_IBAT4L -+ stw r4,SL_IBAT4+4(r1) -+ mfspr r4,SPRN_IBAT5U -+ stw r4,SL_IBAT5(r1) -+ mfspr r4,SPRN_IBAT5L -+ stw r4,SL_IBAT5+4(r1) -+ mfspr r4,SPRN_IBAT6U -+ stw r4,SL_IBAT6(r1) -+ mfspr r4,SPRN_IBAT6L -+ stw r4,SL_IBAT6+4(r1) -+ mfspr r4,SPRN_IBAT7U -+ stw r4,SL_IBAT7(r1) -+ mfspr r4,SPRN_IBAT7L -+ stw r4,SL_IBAT7+4(r1) -+END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) -+ - /* Backup various CPU config stuffs */ - bl __save_cpu_setup - -@@ -325,22 +368,37 @@ grackle_wake_up: - mtibatl 3,r4 - - BEGIN_MMU_FTR_SECTION -- li r4,0 -+ lwz r4,SL_DBAT4(r1) - mtspr SPRN_DBAT4U,r4 -+ lwz r4,SL_DBAT4+4(r1) - mtspr SPRN_DBAT4L,r4 -+ lwz r4,SL_DBAT5(r1) - mtspr SPRN_DBAT5U,r4 -+ lwz r4,SL_DBAT5+4(r1) - mtspr SPRN_DBAT5L,r4 -+ lwz r4,SL_DBAT6(r1) - mtspr SPRN_DBAT6U,r4 -+ lwz r4,SL_DBAT6+4(r1) - mtspr SPRN_DBAT6L,r4 -+ lwz r4,SL_DBAT7(r1) - mtspr SPRN_DBAT7U,r4 -+ lwz r4,SL_DBAT7+4(r1) - mtspr SPRN_DBAT7L,r4 -+ lwz r4,SL_IBAT4(r1) - mtspr SPRN_IBAT4U,r4 -+ lwz r4,SL_IBAT4+4(r1) - mtspr SPRN_IBAT4L,r4 -+ lwz r4,SL_IBAT5(r1) - mtspr SPRN_IBAT5U,r4 -+ lwz r4,SL_IBAT5+4(r1) - mtspr SPRN_IBAT5L,r4 -+ lwz r4,SL_IBAT6(r1) - mtspr SPRN_IBAT6U,r4 -+ lwz r4,SL_IBAT6+4(r1) - mtspr SPRN_IBAT6L,r4 -+ lwz r4,SL_IBAT7(r1) - mtspr SPRN_IBAT7U,r4 -+ lwz r4,SL_IBAT7+4(r1) - mtspr SPRN_IBAT7L,r4 - END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS) - -diff --git a/arch/powerpc/sysdev/uic.c b/arch/powerpc/sysdev/uic.c -index 6893d8f236df..225346dda151 100644 ---- a/arch/powerpc/sysdev/uic.c -+++ b/arch/powerpc/sysdev/uic.c -@@ -158,6 +158,7 @@ static int uic_set_irq_type(struct irq_data *d, unsigned int flow_type) - - mtdcr(uic->dcrbase + UIC_PR, pr); - mtdcr(uic->dcrbase + UIC_TR, tr); -+ mtdcr(uic->dcrbase + UIC_SR, ~mask); - - raw_spin_unlock_irqrestore(&uic->lock, flags); - -diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h -index 3280a6bfa503..b2592c3864ad 100644 ---- a/arch/sh/include/asm/io.h -+++ b/arch/sh/include/asm/io.h -@@ -370,7 +370,11 @@ static inline int iounmap_fixed(void __iomem *addr) { return -EINVAL; } - - #define ioremap_nocache ioremap - #define ioremap_uc ioremap --#define iounmap __iounmap -+ -+static inline void iounmap(void __iomem *addr) -+{ -+ __iounmap(addr); -+} - - /* - * Convert a physical pointer to a virtual kernel pointer for /dev/mem -diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h -index 941527e507f7..f618f45fc8e9 100644 ---- a/arch/um/include/asm/mmu_context.h -+++ b/arch/um/include/asm/mmu_context.h -@@ -42,7 +42,7 @@ static inline void activate_mm(struct mm_struct *old, struct mm_struct *new) - * when the new ->mm is used for the first time. - */ - __switch_mm(&new->context.id); -- down_write(&new->mmap_sem); -+ down_write_nested(&new->mmap_sem, 1); - uml_setup_stubs(new); - up_write(&new->mmap_sem); - } -diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh -index 6988c74409a8..711b74e0e623 100644 ---- a/arch/x86/kernel/cpu/mkcapflags.sh -+++ b/arch/x86/kernel/cpu/mkcapflags.sh -@@ -3,6 +3,8 @@ - # Generate the x86_cap/bug_flags[] arrays from include/asm/cpufeatures.h - # - -+set -e -+ - IN=$1 - OUT=$2 - -diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c -index 5da924bbf0a0..7cd61011ed26 100644 ---- a/arch/x86/kernel/sysfb_efi.c -+++ b/arch/x86/kernel/sysfb_efi.c -@@ -216,9 +216,55 @@ static const struct dmi_system_id efifb_dmi_system_table[] __initconst = { - {}, - }; - -+/* -+ * Some devices have a portrait LCD but advertise a landscape resolution (and -+ * pitch). We simply swap width and height for these devices so that we can -+ * correctly deal with some of them coming with multiple resolutions. -+ */ -+static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = { -+ { -+ /* -+ * Lenovo MIIX310-10ICR, only some batches have the troublesome -+ * 800x1280 portrait screen. Luckily the portrait version has -+ * its own BIOS version, so we match on that. -+ */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "MIIX 310-10ICR"), -+ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1HCN44WW"), -+ }, -+ }, -+ { -+ /* Lenovo MIIX 320-10ICR with 800x1280 portrait screen */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, -+ "Lenovo MIIX 320-10ICR"), -+ }, -+ }, -+ { -+ /* Lenovo D330 with 800x1280 or 1200x1920 portrait screen */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, -+ "Lenovo ideapad D330-10IGM"), -+ }, -+ }, -+ {}, -+}; -+ - __init void sysfb_apply_efi_quirks(void) - { - if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || - !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS)) - dmi_check_system(efifb_dmi_system_table); -+ -+ if (screen_info.orig_video_isVGA == VIDEO_TYPE_EFI && -+ dmi_check_system(efifb_dmi_swap_width_height)) { -+ u16 temp = screen_info.lfb_width; -+ -+ screen_info.lfb_width = screen_info.lfb_height; -+ screen_info.lfb_height = temp; -+ screen_info.lfb_linelength = 4 * screen_info.lfb_width; -+ } - } -diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c -index 31aa2c85dc97..f21d4df282fa 100644 ---- a/arch/x86/kvm/pmu.c -+++ b/arch/x86/kvm/pmu.c -@@ -124,8 +124,8 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type, - intr ? kvm_perf_overflow_intr : - kvm_perf_overflow, pmc); - if (IS_ERR(event)) { -- printk_once("kvm_pmu: event creation failed %ld\n", -- PTR_ERR(event)); -+ pr_debug_ratelimited("kvm_pmu: event creation failed %ld for pmc->idx = %d\n", -+ PTR_ERR(event), pmc->idx); - return; - } - -diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c -index f678c733df40..d2c46454ffa8 100644 ---- a/block/compat_ioctl.c -+++ b/block/compat_ioctl.c -@@ -4,7 +4,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -209,318 +208,6 @@ static int compat_blkpg_ioctl(struct block_device *bdev, fmode_t mode, - #define BLKBSZSET_32 _IOW(0x12, 113, int) - #define BLKGETSIZE64_32 _IOR(0x12, 114, int) - --struct compat_floppy_drive_params { -- char cmos; -- compat_ulong_t max_dtr; -- compat_ulong_t hlt; -- compat_ulong_t hut; -- compat_ulong_t srt; -- compat_ulong_t spinup; -- compat_ulong_t spindown; -- unsigned char spindown_offset; -- unsigned char select_delay; -- unsigned char rps; -- unsigned char tracks; -- compat_ulong_t timeout; -- unsigned char interleave_sect; -- struct floppy_max_errors max_errors; -- char flags; -- char read_track; -- short autodetect[8]; -- compat_int_t checkfreq; -- compat_int_t native_format; --}; -- --struct compat_floppy_drive_struct { -- signed char flags; -- compat_ulong_t spinup_date; -- compat_ulong_t select_date; -- compat_ulong_t first_read_date; -- short probed_format; -- short track; -- short maxblock; -- short maxtrack; -- compat_int_t generation; -- compat_int_t keep_data; -- compat_int_t fd_ref; -- compat_int_t fd_device; -- compat_int_t last_checked; -- compat_caddr_t dmabuf; -- compat_int_t bufblocks; --}; -- --struct compat_floppy_fdc_state { -- compat_int_t spec1; -- compat_int_t spec2; -- compat_int_t dtr; -- unsigned char version; -- unsigned char dor; -- compat_ulong_t address; -- unsigned int rawcmd:2; -- unsigned int reset:1; -- unsigned int need_configure:1; -- unsigned int perp_mode:2; -- unsigned int has_fifo:1; -- unsigned int driver_version; -- unsigned char track[4]; --}; -- --struct compat_floppy_write_errors { -- unsigned int write_errors; -- compat_ulong_t first_error_sector; -- compat_int_t first_error_generation; -- compat_ulong_t last_error_sector; -- compat_int_t last_error_generation; -- compat_uint_t badness; --}; -- --#define FDSETPRM32 _IOW(2, 0x42, struct compat_floppy_struct) --#define FDDEFPRM32 _IOW(2, 0x43, struct compat_floppy_struct) --#define FDSETDRVPRM32 _IOW(2, 0x90, struct compat_floppy_drive_params) --#define FDGETDRVPRM32 _IOR(2, 0x11, struct compat_floppy_drive_params) --#define FDGETDRVSTAT32 _IOR(2, 0x12, struct compat_floppy_drive_struct) --#define FDPOLLDRVSTAT32 _IOR(2, 0x13, struct compat_floppy_drive_struct) --#define FDGETFDCSTAT32 _IOR(2, 0x15, struct compat_floppy_fdc_state) --#define FDWERRORGET32 _IOR(2, 0x17, struct compat_floppy_write_errors) -- --static struct { -- unsigned int cmd32; -- unsigned int cmd; --} fd_ioctl_trans_table[] = { -- { FDSETPRM32, FDSETPRM }, -- { FDDEFPRM32, FDDEFPRM }, -- { FDGETPRM32, FDGETPRM }, -- { FDSETDRVPRM32, FDSETDRVPRM }, -- { FDGETDRVPRM32, FDGETDRVPRM }, -- { FDGETDRVSTAT32, FDGETDRVSTAT }, -- { FDPOLLDRVSTAT32, FDPOLLDRVSTAT }, -- { FDGETFDCSTAT32, FDGETFDCSTAT }, -- { FDWERRORGET32, FDWERRORGET } --}; -- --#define NR_FD_IOCTL_TRANS ARRAY_SIZE(fd_ioctl_trans_table) -- --static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode, -- unsigned int cmd, unsigned long arg) --{ -- mm_segment_t old_fs = get_fs(); -- void *karg = NULL; -- unsigned int kcmd = 0; -- int i, err; -- -- for (i = 0; i < NR_FD_IOCTL_TRANS; i++) -- if (cmd == fd_ioctl_trans_table[i].cmd32) { -- kcmd = fd_ioctl_trans_table[i].cmd; -- break; -- } -- if (!kcmd) -- return -EINVAL; -- -- switch (cmd) { -- case FDSETPRM32: -- case FDDEFPRM32: -- case FDGETPRM32: -- { -- compat_uptr_t name; -- struct compat_floppy_struct __user *uf; -- struct floppy_struct *f; -- -- uf = compat_ptr(arg); -- f = karg = kmalloc(sizeof(struct floppy_struct), GFP_KERNEL); -- if (!karg) -- return -ENOMEM; -- if (cmd == FDGETPRM32) -- break; -- err = __get_user(f->size, &uf->size); -- err |= __get_user(f->sect, &uf->sect); -- err |= __get_user(f->head, &uf->head); -- err |= __get_user(f->track, &uf->track); -- err |= __get_user(f->stretch, &uf->stretch); -- err |= __get_user(f->gap, &uf->gap); -- err |= __get_user(f->rate, &uf->rate); -- err |= __get_user(f->spec1, &uf->spec1); -- err |= __get_user(f->fmt_gap, &uf->fmt_gap); -- err |= __get_user(name, &uf->name); -- f->name = compat_ptr(name); -- if (err) { -- err = -EFAULT; -- goto out; -- } -- break; -- } -- case FDSETDRVPRM32: -- case FDGETDRVPRM32: -- { -- struct compat_floppy_drive_params __user *uf; -- struct floppy_drive_params *f; -- -- uf = compat_ptr(arg); -- f = karg = kmalloc(sizeof(struct floppy_drive_params), GFP_KERNEL); -- if (!karg) -- return -ENOMEM; -- if (cmd == FDGETDRVPRM32) -- break; -- err = __get_user(f->cmos, &uf->cmos); -- err |= __get_user(f->max_dtr, &uf->max_dtr); -- err |= __get_user(f->hlt, &uf->hlt); -- err |= __get_user(f->hut, &uf->hut); -- err |= __get_user(f->srt, &uf->srt); -- err |= __get_user(f->spinup, &uf->spinup); -- err |= __get_user(f->spindown, &uf->spindown); -- err |= __get_user(f->spindown_offset, &uf->spindown_offset); -- err |= __get_user(f->select_delay, &uf->select_delay); -- err |= __get_user(f->rps, &uf->rps); -- err |= __get_user(f->tracks, &uf->tracks); -- err |= __get_user(f->timeout, &uf->timeout); -- err |= __get_user(f->interleave_sect, &uf->interleave_sect); -- err |= __copy_from_user(&f->max_errors, &uf->max_errors, sizeof(f->max_errors)); -- err |= __get_user(f->flags, &uf->flags); -- err |= __get_user(f->read_track, &uf->read_track); -- err |= __copy_from_user(f->autodetect, uf->autodetect, sizeof(f->autodetect)); -- err |= __get_user(f->checkfreq, &uf->checkfreq); -- err |= __get_user(f->native_format, &uf->native_format); -- if (err) { -- err = -EFAULT; -- goto out; -- } -- break; -- } -- case FDGETDRVSTAT32: -- case FDPOLLDRVSTAT32: -- karg = kmalloc(sizeof(struct floppy_drive_struct), GFP_KERNEL); -- if (!karg) -- return -ENOMEM; -- break; -- case FDGETFDCSTAT32: -- karg = kmalloc(sizeof(struct floppy_fdc_state), GFP_KERNEL); -- if (!karg) -- return -ENOMEM; -- break; -- case FDWERRORGET32: -- karg = kmalloc(sizeof(struct floppy_write_errors), GFP_KERNEL); -- if (!karg) -- return -ENOMEM; -- break; -- default: -- return -EINVAL; -- } -- set_fs(KERNEL_DS); -- err = __blkdev_driver_ioctl(bdev, mode, kcmd, (unsigned long)karg); -- set_fs(old_fs); -- if (err) -- goto out; -- switch (cmd) { -- case FDGETPRM32: -- { -- struct floppy_struct *f = karg; -- struct compat_floppy_struct __user *uf = compat_ptr(arg); -- -- err = __put_user(f->size, &uf->size); -- err |= __put_user(f->sect, &uf->sect); -- err |= __put_user(f->head, &uf->head); -- err |= __put_user(f->track, &uf->track); -- err |= __put_user(f->stretch, &uf->stretch); -- err |= __put_user(f->gap, &uf->gap); -- err |= __put_user(f->rate, &uf->rate); -- err |= __put_user(f->spec1, &uf->spec1); -- err |= __put_user(f->fmt_gap, &uf->fmt_gap); -- err |= __put_user((u64)f->name, (compat_caddr_t __user *)&uf->name); -- break; -- } -- case FDGETDRVPRM32: -- { -- struct compat_floppy_drive_params __user *uf; -- struct floppy_drive_params *f = karg; -- -- uf = compat_ptr(arg); -- err = __put_user(f->cmos, &uf->cmos); -- err |= __put_user(f->max_dtr, &uf->max_dtr); -- err |= __put_user(f->hlt, &uf->hlt); -- err |= __put_user(f->hut, &uf->hut); -- err |= __put_user(f->srt, &uf->srt); -- err |= __put_user(f->spinup, &uf->spinup); -- err |= __put_user(f->spindown, &uf->spindown); -- err |= __put_user(f->spindown_offset, &uf->spindown_offset); -- err |= __put_user(f->select_delay, &uf->select_delay); -- err |= __put_user(f->rps, &uf->rps); -- err |= __put_user(f->tracks, &uf->tracks); -- err |= __put_user(f->timeout, &uf->timeout); -- err |= __put_user(f->interleave_sect, &uf->interleave_sect); -- err |= __copy_to_user(&uf->max_errors, &f->max_errors, sizeof(f->max_errors)); -- err |= __put_user(f->flags, &uf->flags); -- err |= __put_user(f->read_track, &uf->read_track); -- err |= __copy_to_user(uf->autodetect, f->autodetect, sizeof(f->autodetect)); -- err |= __put_user(f->checkfreq, &uf->checkfreq); -- err |= __put_user(f->native_format, &uf->native_format); -- break; -- } -- case FDGETDRVSTAT32: -- case FDPOLLDRVSTAT32: -- { -- struct compat_floppy_drive_struct __user *uf; -- struct floppy_drive_struct *f = karg; -- -- uf = compat_ptr(arg); -- err = __put_user(f->flags, &uf->flags); -- err |= __put_user(f->spinup_date, &uf->spinup_date); -- err |= __put_user(f->select_date, &uf->select_date); -- err |= __put_user(f->first_read_date, &uf->first_read_date); -- err |= __put_user(f->probed_format, &uf->probed_format); -- err |= __put_user(f->track, &uf->track); -- err |= __put_user(f->maxblock, &uf->maxblock); -- err |= __put_user(f->maxtrack, &uf->maxtrack); -- err |= __put_user(f->generation, &uf->generation); -- err |= __put_user(f->keep_data, &uf->keep_data); -- err |= __put_user(f->fd_ref, &uf->fd_ref); -- err |= __put_user(f->fd_device, &uf->fd_device); -- err |= __put_user(f->last_checked, &uf->last_checked); -- err |= __put_user((u64)f->dmabuf, &uf->dmabuf); -- err |= __put_user((u64)f->bufblocks, &uf->bufblocks); -- break; -- } -- case FDGETFDCSTAT32: -- { -- struct compat_floppy_fdc_state __user *uf; -- struct floppy_fdc_state *f = karg; -- -- uf = compat_ptr(arg); -- err = __put_user(f->spec1, &uf->spec1); -- err |= __put_user(f->spec2, &uf->spec2); -- err |= __put_user(f->dtr, &uf->dtr); -- err |= __put_user(f->version, &uf->version); -- err |= __put_user(f->dor, &uf->dor); -- err |= __put_user(f->address, &uf->address); -- err |= __copy_to_user((char __user *)&uf->address + sizeof(uf->address), -- (char *)&f->address + sizeof(f->address), sizeof(int)); -- err |= __put_user(f->driver_version, &uf->driver_version); -- err |= __copy_to_user(uf->track, f->track, sizeof(f->track)); -- break; -- } -- case FDWERRORGET32: -- { -- struct compat_floppy_write_errors __user *uf; -- struct floppy_write_errors *f = karg; -- -- uf = compat_ptr(arg); -- err = __put_user(f->write_errors, &uf->write_errors); -- err |= __put_user(f->first_error_sector, &uf->first_error_sector); -- err |= __put_user(f->first_error_generation, &uf->first_error_generation); -- err |= __put_user(f->last_error_sector, &uf->last_error_sector); -- err |= __put_user(f->last_error_generation, &uf->last_error_generation); -- err |= __put_user(f->badness, &uf->badness); -- break; -- } -- default: -- break; -- } -- if (err) -- err = -EFAULT; -- --out: -- kfree(karg); -- return err; --} -- - static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode, - unsigned cmd, unsigned long arg) - { -@@ -537,16 +224,6 @@ static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode, - case HDIO_GET_ADDRESS: - case HDIO_GET_BUSSTATE: - return compat_hdio_ioctl(bdev, mode, cmd, arg); -- case FDSETPRM32: -- case FDDEFPRM32: -- case FDGETPRM32: -- case FDSETDRVPRM32: -- case FDGETDRVPRM32: -- case FDGETDRVSTAT32: -- case FDPOLLDRVSTAT32: -- case FDGETFDCSTAT32: -- case FDWERRORGET32: -- return compat_fd_ioctl(bdev, mode, cmd, arg); - case CDROMREADAUDIO: - return compat_cdrom_read_audio(bdev, mode, cmd, arg); - case CDROM_SEND_PACKET: -@@ -566,23 +243,6 @@ static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode, - case HDIO_DRIVE_CMD: - /* 0x330 is reserved -- it used to be HDIO_GETGEO_BIG */ - case 0x330: -- /* 0x02 -- Floppy ioctls */ -- case FDMSGON: -- case FDMSGOFF: -- case FDSETEMSGTRESH: -- case FDFLUSH: -- case FDWERRORCLR: -- case FDSETMAXERRS: -- case FDGETMAXERRS: -- case FDGETDRVTYP: -- case FDEJECT: -- case FDCLRPRM: -- case FDFMTBEG: -- case FDFMTEND: -- case FDRESET: -- case FDTWADDLE: -- case FDFMTTRK: -- case FDRAWCMD: - /* CDROM stuff */ - case CDROMPAUSE: - case CDROMRESUME: -diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c -index 12ad3e3a84e3..73b56f2f44f1 100644 ---- a/crypto/ghash-generic.c -+++ b/crypto/ghash-generic.c -@@ -34,6 +34,7 @@ static int ghash_setkey(struct crypto_shash *tfm, - const u8 *key, unsigned int keylen) - { - struct ghash_ctx *ctx = crypto_shash_ctx(tfm); -+ be128 k; - - if (keylen != GHASH_BLOCK_SIZE) { - crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); -@@ -42,7 +43,12 @@ static int ghash_setkey(struct crypto_shash *tfm, - - if (ctx->gf128) - gf128mul_free_4k(ctx->gf128); -- ctx->gf128 = gf128mul_init_4k_lle((be128 *)key); -+ -+ BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE); -+ memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */ -+ ctx->gf128 = gf128mul_init_4k_lle(&k); -+ memzero_explicit(&k, GHASH_BLOCK_SIZE); -+ - if (!ctx->gf128) - return -ENOMEM; - -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index fd377b956199..77cabde977ed 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -1358,6 +1358,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg, - map->format.reg_bytes + - map->format.pad_bytes, - val, val_len); -+ else -+ ret = -ENOTSUPP; - - /* If that didn't work fall back on linearising by hand. */ - if (ret == -ENOTSUPP) { -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 2daa5b84abbc..a04810837234 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -192,6 +192,7 @@ static int print_unex = 1; - #include - #include - #include -+#include - - /* - * PS/2 floppies have much slower step rates than regular floppies. -@@ -2113,6 +2114,9 @@ static void setup_format_params(int track) - raw_cmd->kernel_data = floppy_track_buffer; - raw_cmd->length = 4 * F_SECT_PER_TRACK; - -+ if (!F_SECT_PER_TRACK) -+ return; -+ - /* allow for about 30ms for data transport per track */ - head_shift = (F_SECT_PER_TRACK + 5) / 6; - -@@ -3233,8 +3237,12 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g, - int cnt; - - /* sanity checking for parameters. */ -- if (g->sect <= 0 || -- g->head <= 0 || -+ if ((int)g->sect <= 0 || -+ (int)g->head <= 0 || -+ /* check for overflow in max_sector */ -+ (int)(g->sect * g->head) <= 0 || -+ /* check for zero in F_SECT_PER_TRACK */ -+ (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || - g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) || - /* check if reserved bits are set */ - (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0) -@@ -3378,6 +3386,24 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo) - return 0; - } - -+static bool valid_floppy_drive_params(const short autodetect[8], -+ int native_format) -+{ -+ size_t floppy_type_size = ARRAY_SIZE(floppy_type); -+ size_t i = 0; -+ -+ for (i = 0; i < 8; ++i) { -+ if (autodetect[i] < 0 || -+ autodetect[i] >= floppy_type_size) -+ return false; -+ } -+ -+ if (native_format < 0 || native_format >= floppy_type_size) -+ return false; -+ -+ return true; -+} -+ - static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd, - unsigned long param) - { -@@ -3504,6 +3530,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int - SUPBOUND(size, strlen((const char *)outparam) + 1); - break; - case FDSETDRVPRM: -+ if (!valid_floppy_drive_params(inparam.dp.autodetect, -+ inparam.dp.native_format)) -+ return -EINVAL; - *UDP = inparam.dp; - break; - case FDGETDRVPRM: -@@ -3569,6 +3598,332 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, - return ret; - } - -+#ifdef CONFIG_COMPAT -+ -+struct compat_floppy_drive_params { -+ char cmos; -+ compat_ulong_t max_dtr; -+ compat_ulong_t hlt; -+ compat_ulong_t hut; -+ compat_ulong_t srt; -+ compat_ulong_t spinup; -+ compat_ulong_t spindown; -+ unsigned char spindown_offset; -+ unsigned char select_delay; -+ unsigned char rps; -+ unsigned char tracks; -+ compat_ulong_t timeout; -+ unsigned char interleave_sect; -+ struct floppy_max_errors max_errors; -+ char flags; -+ char read_track; -+ short autodetect[8]; -+ compat_int_t checkfreq; -+ compat_int_t native_format; -+}; -+ -+struct compat_floppy_drive_struct { -+ signed char flags; -+ compat_ulong_t spinup_date; -+ compat_ulong_t select_date; -+ compat_ulong_t first_read_date; -+ short probed_format; -+ short track; -+ short maxblock; -+ short maxtrack; -+ compat_int_t generation; -+ compat_int_t keep_data; -+ compat_int_t fd_ref; -+ compat_int_t fd_device; -+ compat_int_t last_checked; -+ compat_caddr_t dmabuf; -+ compat_int_t bufblocks; -+}; -+ -+struct compat_floppy_fdc_state { -+ compat_int_t spec1; -+ compat_int_t spec2; -+ compat_int_t dtr; -+ unsigned char version; -+ unsigned char dor; -+ compat_ulong_t address; -+ unsigned int rawcmd:2; -+ unsigned int reset:1; -+ unsigned int need_configure:1; -+ unsigned int perp_mode:2; -+ unsigned int has_fifo:1; -+ unsigned int driver_version; -+ unsigned char track[4]; -+}; -+ -+struct compat_floppy_write_errors { -+ unsigned int write_errors; -+ compat_ulong_t first_error_sector; -+ compat_int_t first_error_generation; -+ compat_ulong_t last_error_sector; -+ compat_int_t last_error_generation; -+ compat_uint_t badness; -+}; -+ -+#define FDSETPRM32 _IOW(2, 0x42, struct compat_floppy_struct) -+#define FDDEFPRM32 _IOW(2, 0x43, struct compat_floppy_struct) -+#define FDSETDRVPRM32 _IOW(2, 0x90, struct compat_floppy_drive_params) -+#define FDGETDRVPRM32 _IOR(2, 0x11, struct compat_floppy_drive_params) -+#define FDGETDRVSTAT32 _IOR(2, 0x12, struct compat_floppy_drive_struct) -+#define FDPOLLDRVSTAT32 _IOR(2, 0x13, struct compat_floppy_drive_struct) -+#define FDGETFDCSTAT32 _IOR(2, 0x15, struct compat_floppy_fdc_state) -+#define FDWERRORGET32 _IOR(2, 0x17, struct compat_floppy_write_errors) -+ -+static int compat_set_geometry(struct block_device *bdev, fmode_t mode, unsigned int cmd, -+ struct compat_floppy_struct __user *arg) -+{ -+ struct floppy_struct v; -+ int drive, type; -+ int err; -+ -+ BUILD_BUG_ON(offsetof(struct floppy_struct, name) != -+ offsetof(struct compat_floppy_struct, name)); -+ -+ if (!(mode & (FMODE_WRITE | FMODE_WRITE_IOCTL))) -+ return -EPERM; -+ -+ memset(&v, 0, sizeof(struct floppy_struct)); -+ if (copy_from_user(&v, arg, offsetof(struct floppy_struct, name))) -+ return -EFAULT; -+ -+ mutex_lock(&floppy_mutex); -+ drive = (long)bdev->bd_disk->private_data; -+ type = ITYPE(UDRS->fd_device); -+ err = set_geometry(cmd == FDSETPRM32 ? FDSETPRM : FDDEFPRM, -+ &v, drive, type, bdev); -+ mutex_unlock(&floppy_mutex); -+ return err; -+} -+ -+static int compat_get_prm(int drive, -+ struct compat_floppy_struct __user *arg) -+{ -+ struct compat_floppy_struct v; -+ struct floppy_struct *p; -+ int err; -+ -+ memset(&v, 0, sizeof(v)); -+ mutex_lock(&floppy_mutex); -+ err = get_floppy_geometry(drive, ITYPE(UDRS->fd_device), &p); -+ if (err) { -+ mutex_unlock(&floppy_mutex); -+ return err; -+ } -+ memcpy(&v, p, offsetof(struct floppy_struct, name)); -+ mutex_unlock(&floppy_mutex); -+ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_struct))) -+ return -EFAULT; -+ return 0; -+} -+ -+static int compat_setdrvprm(int drive, -+ struct compat_floppy_drive_params __user *arg) -+{ -+ struct compat_floppy_drive_params v; -+ -+ if (!capable(CAP_SYS_ADMIN)) -+ return -EPERM; -+ if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params))) -+ return -EFAULT; -+ if (!valid_floppy_drive_params(v.autodetect, v.native_format)) -+ return -EINVAL; -+ mutex_lock(&floppy_mutex); -+ UDP->cmos = v.cmos; -+ UDP->max_dtr = v.max_dtr; -+ UDP->hlt = v.hlt; -+ UDP->hut = v.hut; -+ UDP->srt = v.srt; -+ UDP->spinup = v.spinup; -+ UDP->spindown = v.spindown; -+ UDP->spindown_offset = v.spindown_offset; -+ UDP->select_delay = v.select_delay; -+ UDP->rps = v.rps; -+ UDP->tracks = v.tracks; -+ UDP->timeout = v.timeout; -+ UDP->interleave_sect = v.interleave_sect; -+ UDP->max_errors = v.max_errors; -+ UDP->flags = v.flags; -+ UDP->read_track = v.read_track; -+ memcpy(UDP->autodetect, v.autodetect, sizeof(v.autodetect)); -+ UDP->checkfreq = v.checkfreq; -+ UDP->native_format = v.native_format; -+ mutex_unlock(&floppy_mutex); -+ return 0; -+} -+ -+static int compat_getdrvprm(int drive, -+ struct compat_floppy_drive_params __user *arg) -+{ -+ struct compat_floppy_drive_params v; -+ -+ memset(&v, 0, sizeof(struct compat_floppy_drive_params)); -+ mutex_lock(&floppy_mutex); -+ v.cmos = UDP->cmos; -+ v.max_dtr = UDP->max_dtr; -+ v.hlt = UDP->hlt; -+ v.hut = UDP->hut; -+ v.srt = UDP->srt; -+ v.spinup = UDP->spinup; -+ v.spindown = UDP->spindown; -+ v.spindown_offset = UDP->spindown_offset; -+ v.select_delay = UDP->select_delay; -+ v.rps = UDP->rps; -+ v.tracks = UDP->tracks; -+ v.timeout = UDP->timeout; -+ v.interleave_sect = UDP->interleave_sect; -+ v.max_errors = UDP->max_errors; -+ v.flags = UDP->flags; -+ v.read_track = UDP->read_track; -+ memcpy(v.autodetect, UDP->autodetect, sizeof(v.autodetect)); -+ v.checkfreq = UDP->checkfreq; -+ v.native_format = UDP->native_format; -+ mutex_unlock(&floppy_mutex); -+ -+ if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_params))) -+ return -EFAULT; -+ return 0; -+} -+ -+static int compat_getdrvstat(int drive, bool poll, -+ struct compat_floppy_drive_struct __user *arg) -+{ -+ struct compat_floppy_drive_struct v; -+ -+ memset(&v, 0, sizeof(struct compat_floppy_drive_struct)); -+ mutex_lock(&floppy_mutex); -+ -+ if (poll) { -+ if (lock_fdc(drive, true)) -+ goto Eintr; -+ if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR) -+ goto Eintr; -+ process_fd_request(); -+ } -+ v.spinup_date = UDRS->spinup_date; -+ v.select_date = UDRS->select_date; -+ v.first_read_date = UDRS->first_read_date; -+ v.probed_format = UDRS->probed_format; -+ v.track = UDRS->track; -+ v.maxblock = UDRS->maxblock; -+ v.maxtrack = UDRS->maxtrack; -+ v.generation = UDRS->generation; -+ v.keep_data = UDRS->keep_data; -+ v.fd_ref = UDRS->fd_ref; -+ v.fd_device = UDRS->fd_device; -+ v.last_checked = UDRS->last_checked; -+ v.dmabuf = (uintptr_t)UDRS->dmabuf; -+ v.bufblocks = UDRS->bufblocks; -+ mutex_unlock(&floppy_mutex); -+ -+ if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_struct))) -+ return -EFAULT; -+ return 0; -+Eintr: -+ mutex_unlock(&floppy_mutex); -+ return -EINTR; -+} -+ -+static int compat_getfdcstat(int drive, -+ struct compat_floppy_fdc_state __user *arg) -+{ -+ struct compat_floppy_fdc_state v32; -+ struct floppy_fdc_state v; -+ -+ mutex_lock(&floppy_mutex); -+ v = *UFDCS; -+ mutex_unlock(&floppy_mutex); -+ -+ memset(&v32, 0, sizeof(struct compat_floppy_fdc_state)); -+ v32.spec1 = v.spec1; -+ v32.spec2 = v.spec2; -+ v32.dtr = v.dtr; -+ v32.version = v.version; -+ v32.dor = v.dor; -+ v32.address = v.address; -+ v32.rawcmd = v.rawcmd; -+ v32.reset = v.reset; -+ v32.need_configure = v.need_configure; -+ v32.perp_mode = v.perp_mode; -+ v32.has_fifo = v.has_fifo; -+ v32.driver_version = v.driver_version; -+ memcpy(v32.track, v.track, 4); -+ if (copy_to_user(arg, &v32, sizeof(struct compat_floppy_fdc_state))) -+ return -EFAULT; -+ return 0; -+} -+ -+static int compat_werrorget(int drive, -+ struct compat_floppy_write_errors __user *arg) -+{ -+ struct compat_floppy_write_errors v32; -+ struct floppy_write_errors v; -+ -+ memset(&v32, 0, sizeof(struct compat_floppy_write_errors)); -+ mutex_lock(&floppy_mutex); -+ v = *UDRWE; -+ mutex_unlock(&floppy_mutex); -+ v32.write_errors = v.write_errors; -+ v32.first_error_sector = v.first_error_sector; -+ v32.first_error_generation = v.first_error_generation; -+ v32.last_error_sector = v.last_error_sector; -+ v32.last_error_generation = v.last_error_generation; -+ v32.badness = v.badness; -+ if (copy_to_user(arg, &v32, sizeof(struct compat_floppy_write_errors))) -+ return -EFAULT; -+ return 0; -+} -+ -+static int fd_compat_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd, -+ unsigned long param) -+{ -+ int drive = (long)bdev->bd_disk->private_data; -+ switch (cmd) { -+ case FDMSGON: -+ case FDMSGOFF: -+ case FDSETEMSGTRESH: -+ case FDFLUSH: -+ case FDWERRORCLR: -+ case FDEJECT: -+ case FDCLRPRM: -+ case FDFMTBEG: -+ case FDRESET: -+ case FDTWADDLE: -+ return fd_ioctl(bdev, mode, cmd, param); -+ case FDSETMAXERRS: -+ case FDGETMAXERRS: -+ case FDGETDRVTYP: -+ case FDFMTEND: -+ case FDFMTTRK: -+ case FDRAWCMD: -+ return fd_ioctl(bdev, mode, cmd, -+ (unsigned long)compat_ptr(param)); -+ case FDSETPRM32: -+ case FDDEFPRM32: -+ return compat_set_geometry(bdev, mode, cmd, compat_ptr(param)); -+ case FDGETPRM32: -+ return compat_get_prm(drive, compat_ptr(param)); -+ case FDSETDRVPRM32: -+ return compat_setdrvprm(drive, compat_ptr(param)); -+ case FDGETDRVPRM32: -+ return compat_getdrvprm(drive, compat_ptr(param)); -+ case FDPOLLDRVSTAT32: -+ return compat_getdrvstat(drive, true, compat_ptr(param)); -+ case FDGETDRVSTAT32: -+ return compat_getdrvstat(drive, false, compat_ptr(param)); -+ case FDGETFDCSTAT32: -+ return compat_getfdcstat(drive, compat_ptr(param)); -+ case FDWERRORGET32: -+ return compat_werrorget(drive, compat_ptr(param)); -+ } -+ return -EINVAL; -+} -+#endif -+ - static void __init config_types(void) - { - bool has_drive = false; -@@ -3885,6 +4240,9 @@ static const struct block_device_operations floppy_fops = { - .getgeo = fd_getgeo, - .check_events = floppy_check_events, - .revalidate_disk = floppy_revalidate, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = fd_compat_ioctl, -+#endif - }; - - /* -diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c -index d776dfd51478..16f2131687e5 100644 ---- a/drivers/bluetooth/hci_ath.c -+++ b/drivers/bluetooth/hci_ath.c -@@ -101,6 +101,9 @@ static int ath_open(struct hci_uart *hu) - - BT_DBG("hu %p", hu); - -+ if (!hci_uart_has_flow_control(hu)) -+ return -EOPNOTSUPP; -+ - ath = kzalloc(sizeof(*ath), GFP_KERNEL); - if (!ath) - return -ENOMEM; -diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c -index f9b569ef3dd7..20a1b4d1fd09 100644 ---- a/drivers/bluetooth/hci_bcm.c -+++ b/drivers/bluetooth/hci_bcm.c -@@ -279,6 +279,9 @@ static int bcm_open(struct hci_uart *hu) - - bt_dev_dbg(hu->hdev, "hu %p", hu); - -+ if (!hci_uart_has_flow_control(hu)) -+ return -EOPNOTSUPP; -+ - bcm = kzalloc(sizeof(*bcm), GFP_KERNEL); - if (!bcm) - return -ENOMEM; -diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c -index d0b615a932d1..9833b53a8b50 100644 ---- a/drivers/bluetooth/hci_bcsp.c -+++ b/drivers/bluetooth/hci_bcsp.c -@@ -729,6 +729,11 @@ static int bcsp_close(struct hci_uart *hu) - skb_queue_purge(&bcsp->rel); - skb_queue_purge(&bcsp->unrel); - -+ if (bcsp->rx_skb) { -+ kfree_skb(bcsp->rx_skb); -+ bcsp->rx_skb = NULL; -+ } -+ - kfree(bcsp); - return 0; - } -diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c -index 0c63fce0c1e0..929674e6663e 100644 ---- a/drivers/bluetooth/hci_intel.c -+++ b/drivers/bluetooth/hci_intel.c -@@ -407,6 +407,9 @@ static int intel_open(struct hci_uart *hu) - - BT_DBG("hu %p", hu); - -+ if (!hci_uart_has_flow_control(hu)) -+ return -EOPNOTSUPP; -+ - intel = kzalloc(sizeof(*intel), GFP_KERNEL); - if (!intel) - return -ENOMEM; -diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c -index 96bcec5598c2..d5db2332eb6f 100644 ---- a/drivers/bluetooth/hci_ldisc.c -+++ b/drivers/bluetooth/hci_ldisc.c -@@ -257,6 +257,15 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb) - return 0; - } - -+/* Check the underlying device or tty has flow control support */ -+bool hci_uart_has_flow_control(struct hci_uart *hu) -+{ -+ if (hu->tty->driver->ops->tiocmget && hu->tty->driver->ops->tiocmset) -+ return true; -+ -+ return false; -+} -+ - /* Flow control or un-flow control the device */ - void hci_uart_set_flow_control(struct hci_uart *hu, bool enable) - { -diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h -index 82c92f1b65b4..ce00c02eb63f 100644 ---- a/drivers/bluetooth/hci_uart.h -+++ b/drivers/bluetooth/hci_uart.h -@@ -105,6 +105,7 @@ int hci_uart_tx_wakeup(struct hci_uart *hu); - int hci_uart_init_ready(struct hci_uart *hu); - void hci_uart_init_tty(struct hci_uart *hu); - void hci_uart_set_baudrate(struct hci_uart *hu, unsigned int speed); -+bool hci_uart_has_flow_control(struct hci_uart *hu); - void hci_uart_set_flow_control(struct hci_uart *hu, bool enable); - void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed, - unsigned int oper_speed); -diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c -index 72e073895ed9..5b38d7a8202a 100644 ---- a/drivers/char/hpet.c -+++ b/drivers/char/hpet.c -@@ -569,8 +569,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets, - unsigned long long m; - - m = hpets->hp_tick_freq + (dis >> 1); -- do_div(m, dis); -- return (unsigned long)m; -+ return div64_ul(m, dis); - } - - static int -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 62ce93568e11..a000c2667392 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -1446,11 +1446,15 @@ static void ablkcipher_done(struct device *dev, - int err) - { - struct ablkcipher_request *areq = context; -+ struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq); -+ struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher); -+ unsigned int ivsize = crypto_ablkcipher_ivsize(cipher); - struct talitos_edesc *edesc; - - edesc = container_of(desc, struct talitos_edesc, desc); - - common_nonsnoop_unmap(dev, edesc, areq); -+ memcpy(areq->info, ctx->iv, ivsize); - - kfree(edesc); - -diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c -index 4054747af0cb..dd97dbf6618c 100644 ---- a/drivers/dma/imx-sdma.c -+++ b/drivers/dma/imx-sdma.c -@@ -1786,27 +1786,6 @@ static int sdma_probe(struct platform_device *pdev) - if (pdata && pdata->script_addrs) - sdma_add_scripts(sdma, pdata->script_addrs); - -- if (pdata) { -- ret = sdma_get_firmware(sdma, pdata->fw_name); -- if (ret) -- dev_warn(&pdev->dev, "failed to get firmware from platform data\n"); -- } else { -- /* -- * Because that device tree does not encode ROM script address, -- * the RAM script in firmware is mandatory for device tree -- * probe, otherwise it fails. -- */ -- ret = of_property_read_string(np, "fsl,sdma-ram-script-name", -- &fw_name); -- if (ret) -- dev_warn(&pdev->dev, "failed to get firmware name\n"); -- else { -- ret = sdma_get_firmware(sdma, fw_name); -- if (ret) -- dev_warn(&pdev->dev, "failed to get firmware from device tree\n"); -- } -- } -- - sdma->dma_device.dev = &pdev->dev; - - sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources; -@@ -1848,6 +1827,33 @@ static int sdma_probe(struct platform_device *pdev) - of_node_put(spba_bus); - } - -+ /* -+ * Kick off firmware loading as the very last step: -+ * attempt to load firmware only if we're not on the error path, because -+ * the firmware callback requires a fully functional and allocated sdma -+ * instance. -+ */ -+ if (pdata) { -+ ret = sdma_get_firmware(sdma, pdata->fw_name); -+ if (ret) -+ dev_warn(&pdev->dev, "failed to get firmware from platform data\n"); -+ } else { -+ /* -+ * Because that device tree does not encode ROM script address, -+ * the RAM script in firmware is mandatory for device tree -+ * probe, otherwise it fails. -+ */ -+ ret = of_property_read_string(np, "fsl,sdma-ram-script-name", -+ &fw_name); -+ if (ret) { -+ dev_warn(&pdev->dev, "failed to get firmware name\n"); -+ } else { -+ ret = sdma_get_firmware(sdma, fw_name); -+ if (ret) -+ dev_warn(&pdev->dev, "failed to get firmware from device tree\n"); -+ } -+ } -+ - return 0; - - err_register: -diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c -index 3c8f19f5ac81..d459cf4b8579 100644 ---- a/drivers/edac/edac_mc_sysfs.c -+++ b/drivers/edac/edac_mc_sysfs.c -@@ -26,7 +26,7 @@ - static int edac_mc_log_ue = 1; - static int edac_mc_log_ce = 1; - static int edac_mc_panic_on_ue; --static int edac_mc_poll_msec = 1000; -+static unsigned int edac_mc_poll_msec = 1000; - - /* Getter functions for above */ - int edac_mc_get_log_ue(void) -@@ -45,30 +45,30 @@ int edac_mc_get_panic_on_ue(void) - } - - /* this is temporary */ --int edac_mc_get_poll_msec(void) -+unsigned int edac_mc_get_poll_msec(void) - { - return edac_mc_poll_msec; - } - - static int edac_set_poll_msec(const char *val, struct kernel_param *kp) - { -- unsigned long l; -+ unsigned int i; - int ret; - - if (!val) - return -EINVAL; - -- ret = kstrtoul(val, 0, &l); -+ ret = kstrtouint(val, 0, &i); - if (ret) - return ret; - -- if (l < 1000) -+ if (i < 1000) - return -EINVAL; - -- *((unsigned long *)kp->arg) = l; -+ *((unsigned int *)kp->arg) = i; - - /* notify edac_mc engine to reset the poll period */ -- edac_mc_reset_delay_period(l); -+ edac_mc_reset_delay_period(i); - - return 0; - } -@@ -82,7 +82,7 @@ MODULE_PARM_DESC(edac_mc_log_ue, - module_param(edac_mc_log_ce, int, 0644); - MODULE_PARM_DESC(edac_mc_log_ce, - "Log correctable error to console: 0=off 1=on"); --module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_int, -+module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_uint, - &edac_mc_poll_msec, 0644); - MODULE_PARM_DESC(edac_mc_poll_msec, "Polling period in milliseconds"); - -@@ -426,6 +426,8 @@ static inline int nr_pages_per_csrow(struct csrow_info *csrow) - static int edac_create_csrow_object(struct mem_ctl_info *mci, - struct csrow_info *csrow, int index) - { -+ int err; -+ - csrow->dev.type = &csrow_attr_type; - csrow->dev.bus = mci->bus; - csrow->dev.groups = csrow_dev_groups; -@@ -438,7 +440,11 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci, - edac_dbg(0, "creating (virtual) csrow node %s\n", - dev_name(&csrow->dev)); - -- return device_add(&csrow->dev); -+ err = device_add(&csrow->dev); -+ if (err) -+ put_device(&csrow->dev); -+ -+ return err; - } - - /* Create a CSROW object under specifed edac_mc_device */ -diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h -index b95a48fc723d..c7a7a0891eb6 100644 ---- a/drivers/edac/edac_module.h -+++ b/drivers/edac/edac_module.h -@@ -33,7 +33,7 @@ extern int edac_mc_get_log_ue(void); - extern int edac_mc_get_log_ce(void); - extern int edac_mc_get_panic_on_ue(void); - extern int edac_get_poll_msec(void); --extern int edac_mc_get_poll_msec(void); -+extern unsigned int edac_mc_get_poll_msec(void); - - unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf, - unsigned len); -diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c -index c8c49b1d5f9f..6e65c02baad1 100644 ---- a/drivers/gpio/gpio-omap.c -+++ b/drivers/gpio/gpio-omap.c -@@ -821,9 +821,9 @@ static void omap_gpio_irq_shutdown(struct irq_data *d) - - raw_spin_lock_irqsave(&bank->lock, flags); - bank->irq_usage &= ~(BIT(offset)); -- omap_set_gpio_irqenable(bank, offset, 0); -- omap_clear_gpio_irqstatus(bank, offset); - omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE); -+ omap_clear_gpio_irqstatus(bank, offset); -+ omap_set_gpio_irqenable(bank, offset, 0); - if (!LINE_USED(bank->mod_usage, offset)) - omap_clear_gpio_debounce(bank, offset); - omap_disable_gpio_module(bank, offset); -@@ -865,8 +865,8 @@ static void omap_gpio_mask_irq(struct irq_data *d) - unsigned long flags; - - raw_spin_lock_irqsave(&bank->lock, flags); -- omap_set_gpio_irqenable(bank, offset, 0); - omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE); -+ omap_set_gpio_irqenable(bank, offset, 0); - raw_spin_unlock_irqrestore(&bank->lock, flags); - } - -@@ -878,9 +878,6 @@ static void omap_gpio_unmask_irq(struct irq_data *d) - unsigned long flags; - - raw_spin_lock_irqsave(&bank->lock, flags); -- if (trigger) -- omap_set_gpio_triggering(bank, offset, trigger); -- - omap_set_gpio_irqenable(bank, offset, 1); - - /* -@@ -888,9 +885,13 @@ static void omap_gpio_unmask_irq(struct irq_data *d) - * is cleared, thus after the handler has run. OMAP4 needs this done - * after enabing the interrupt to clear the wakeup status. - */ -- if (bank->level_mask & BIT(offset)) -+ if (bank->regs->leveldetect0 && bank->regs->wkup_en && -+ trigger & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW)) - omap_clear_gpio_irqstatus(bank, offset); - -+ if (trigger) -+ omap_set_gpio_triggering(bank, offset, trigger); -+ - raw_spin_unlock_irqrestore(&bank->lock, flags); - } - -@@ -1611,6 +1612,8 @@ static struct omap_gpio_reg_offs omap4_gpio_regs = { - .clr_dataout = OMAP4_GPIO_CLEARDATAOUT, - .irqstatus = OMAP4_GPIO_IRQSTATUS0, - .irqstatus2 = OMAP4_GPIO_IRQSTATUS1, -+ .irqstatus_raw0 = OMAP4_GPIO_IRQSTATUSRAW0, -+ .irqstatus_raw1 = OMAP4_GPIO_IRQSTATUSRAW1, - .irqenable = OMAP4_GPIO_IRQSTATUSSET0, - .irqenable2 = OMAP4_GPIO_IRQSTATUSSET1, - .set_irqenable = OMAP4_GPIO_IRQSTATUSSET0, -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -index 2acc5cbcb6fb..30864de2f148 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c -@@ -184,6 +184,25 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend) - return 0; - } - -+static int -+nvkm_i2c_preinit(struct nvkm_subdev *subdev) -+{ -+ struct nvkm_i2c *i2c = nvkm_i2c(subdev); -+ struct nvkm_i2c_bus *bus; -+ struct nvkm_i2c_pad *pad; -+ -+ /* -+ * We init our i2c busses as early as possible, since they may be -+ * needed by the vbios init scripts on some cards -+ */ -+ list_for_each_entry(pad, &i2c->pad, head) -+ nvkm_i2c_pad_init(pad); -+ list_for_each_entry(bus, &i2c->bus, head) -+ nvkm_i2c_bus_init(bus); -+ -+ return 0; -+} -+ - static int - nvkm_i2c_init(struct nvkm_subdev *subdev) - { -@@ -238,6 +257,7 @@ nvkm_i2c_dtor(struct nvkm_subdev *subdev) - static const struct nvkm_subdev_func - nvkm_i2c = { - .dtor = nvkm_i2c_dtor, -+ .preinit = nvkm_i2c_preinit, - .init = nvkm_i2c_init, - .fini = nvkm_i2c_fini, - .intr = nvkm_i2c_intr, -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index f418c002d323..ecad4d7c6cd1 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -1389,7 +1389,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi) - dsi->format = desc->format; - dsi->lanes = desc->lanes; - -- return mipi_dsi_attach(dsi); -+ err = mipi_dsi_attach(dsi); -+ if (err) { -+ struct panel_simple *panel = dev_get_drvdata(&dsi->dev); -+ -+ drm_panel_remove(&panel->base); -+ } -+ -+ return err; - } - - static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi) -diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c -index 6296e9f270ca..0b8f8c10f2ed 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c -+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c -@@ -535,6 +535,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, - ret = wait_event_timeout(vgdev->resp_wq, - atomic_read(&cache_ent->is_valid), 5 * HZ); - -+ /* is_valid check must proceed before copy of the cache entry. */ -+ smp_rmb(); -+ - ptr = cache_ent->caps_cache; - - copy_exit: -diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c -index 52436b3c01bb..a1b3ea1ccb65 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_vq.c -+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c -@@ -618,6 +618,8 @@ static void virtio_gpu_cmd_capset_cb(struct virtio_gpu_device *vgdev, - cache_ent->id == le32_to_cpu(cmd->capset_id)) { - memcpy(cache_ent->caps_cache, resp->capset_data, - cache_ent->size); -+ /* Copy must occur before is_valid is signalled. */ -+ smp_wmb(); - atomic_set(&cache_ent->is_valid, 1); - break; - } -diff --git a/drivers/gpu/ipu-v3/ipu-ic.c b/drivers/gpu/ipu-v3/ipu-ic.c -index 1dcb96ccda66..1f7b6023dcb4 100644 ---- a/drivers/gpu/ipu-v3/ipu-ic.c -+++ b/drivers/gpu/ipu-v3/ipu-ic.c -@@ -255,7 +255,7 @@ static int init_csc(struct ipu_ic *ic, - writel(param, base++); - - param = ((a[0] & 0x1fe0) >> 5) | (params->scale << 8) | -- (params->sat << 9); -+ (params->sat << 10); - writel(param, base++); - - param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) | -diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c -index 7d5c53a1abe4..5fcdb2dbce68 100644 ---- a/drivers/hwtracing/intel_th/msu.c -+++ b/drivers/hwtracing/intel_th/msu.c -@@ -625,7 +625,7 @@ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size) - goto err_out; - - ret = -ENOMEM; -- page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); -+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO | GFP_DMA32, order); - if (!page) - goto err_free_sgt; - -diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c -index 8b68a210277b..5a0e4cd86353 100644 ---- a/drivers/input/tablet/gtco.c -+++ b/drivers/input/tablet/gtco.c -@@ -78,6 +78,7 @@ Scott Hill shill@gtcocalcomp.com - - /* Max size of a single report */ - #define REPORT_MAX_SIZE 10 -+#define MAX_COLLECTION_LEVELS 10 - - - /* Bitmask whether pen is in range */ -@@ -224,8 +225,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, - char maintype = 'x'; - char globtype[12]; - int indent = 0; -- char indentstr[10] = ""; -- -+ char indentstr[MAX_COLLECTION_LEVELS + 1] = { 0 }; - - dev_dbg(ddev, "======>>>>>>PARSE<<<<<<======\n"); - -@@ -351,6 +351,13 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, - case TAG_MAIN_COL_START: - maintype = 'S'; - -+ if (indent == MAX_COLLECTION_LEVELS) { -+ dev_err(ddev, "Collection level %d would exceed limit of %d\n", -+ indent + 1, -+ MAX_COLLECTION_LEVELS); -+ break; -+ } -+ - if (data == 0) { - dev_dbg(ddev, "======>>>>>> Physical\n"); - strcpy(globtype, "Physical"); -@@ -370,8 +377,15 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, - break; - - case TAG_MAIN_COL_END: -- dev_dbg(ddev, "<<<<<<======\n"); - maintype = 'E'; -+ -+ if (indent == 0) { -+ dev_err(ddev, "Collection level already at zero\n"); -+ break; -+ } -+ -+ dev_dbg(ddev, "<<<<<<======\n"); -+ - indent--; - for (x = 0; x < indent; x++) - indentstr[x] = '-'; -diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c -index 114f3bcba1b0..c60c7998af17 100644 ---- a/drivers/isdn/hardware/mISDN/hfcsusb.c -+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c -@@ -1963,6 +1963,9 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) - - /* get endpoint base */ - idx = ((ep_addr & 0x7f) - 1) * 2; -+ if (idx > 15) -+ return -EIO; -+ - if (ep_addr & 0x80) - idx++; - attr = ep->desc.bmAttributes; -diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c -index 9cf826df89b1..b4ad85251cf7 100644 ---- a/drivers/mailbox/mailbox.c -+++ b/drivers/mailbox/mailbox.c -@@ -389,11 +389,13 @@ struct mbox_chan *mbox_request_channel_byname(struct mbox_client *cl, - - of_property_for_each_string(np, "mbox-names", prop, mbox_name) { - if (!strncmp(name, mbox_name, strlen(name))) -- break; -+ return mbox_request_channel(cl, index); - index++; - } - -- return mbox_request_channel(cl, index); -+ dev_err(cl->dev, "%s() could not locate channel named \"%s\"\n", -+ __func__, name); -+ return ERR_PTR(-EINVAL); - } - EXPORT_SYMBOL_GPL(mbox_request_channel_byname); - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 02757b90e402..e42092146083 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1403,7 +1403,7 @@ static void cache_set_flush(struct closure *cl) - kobject_put(&c->internal); - kobject_del(&c->kobj); - -- if (c->gc_thread) -+ if (!IS_ERR_OR_NULL(c->gc_thread)) - kthread_stop(c->gc_thread); - - if (!IS_ERR_OR_NULL(c->root)) -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index b1d5fa0bc8f7..8a6e7646e1c9 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -1561,9 +1561,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) - unsigned long freed; - - c = container_of(shrink, struct dm_bufio_client, shrinker); -- if (sc->gfp_mask & __GFP_FS) -- dm_bufio_lock(c); -- else if (!dm_bufio_trylock(c)) -+ if (!dm_bufio_trylock(c)) - return SHRINK_STOP; - - freed = __scan(c, sc->nr_to_scan, sc->gfp_mask); -diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c -index 029384d1fddd..7a3e91cda5df 100644 ---- a/drivers/media/dvb-frontends/tua6100.c -+++ b/drivers/media/dvb-frontends/tua6100.c -@@ -80,8 +80,8 @@ static int tua6100_set_params(struct dvb_frontend *fe) - struct i2c_msg msg1 = { .addr = priv->i2c_address, .flags = 0, .buf = reg1, .len = 4 }; - struct i2c_msg msg2 = { .addr = priv->i2c_address, .flags = 0, .buf = reg2, .len = 3 }; - --#define _R 4 --#define _P 32 -+#define _R_VAL 4 -+#define _P_VAL 32 - #define _ri 4000000 - - // setup register 0 -@@ -96,14 +96,14 @@ static int tua6100_set_params(struct dvb_frontend *fe) - else - reg1[1] = 0x0c; - -- if (_P == 64) -+ if (_P_VAL == 64) - reg1[1] |= 0x40; - if (c->frequency >= 1525000) - reg1[1] |= 0x80; - - // register 2 -- reg2[1] = (_R >> 8) & 0x03; -- reg2[2] = _R; -+ reg2[1] = (_R_VAL >> 8) & 0x03; -+ reg2[2] = _R_VAL; - if (c->frequency < 1455000) - reg2[1] |= 0x1c; - else if (c->frequency < 1630000) -@@ -115,18 +115,18 @@ static int tua6100_set_params(struct dvb_frontend *fe) - * The N divisor ratio (note: c->frequency is in kHz, but we - * need it in Hz) - */ -- prediv = (c->frequency * _R) / (_ri / 1000); -- div = prediv / _P; -+ prediv = (c->frequency * _R_VAL) / (_ri / 1000); -+ div = prediv / _P_VAL; - reg1[1] |= (div >> 9) & 0x03; - reg1[2] = div >> 1; - reg1[3] = (div << 7); -- priv->frequency = ((div * _P) * (_ri / 1000)) / _R; -+ priv->frequency = ((div * _P_VAL) * (_ri / 1000)) / _R_VAL; - - // Finally, calculate and store the value for A -- reg1[3] |= (prediv - (div*_P)) & 0x7f; -+ reg1[3] |= (prediv - (div*_P_VAL)) & 0x7f; - --#undef _R --#undef _P -+#undef _R_VAL -+#undef _P_VAL - #undef _ri - - if (fe->ops.i2c_gate_ctrl) -diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile -index 07db257abfc1..d5711def1fff 100644 ---- a/drivers/media/i2c/Makefile -+++ b/drivers/media/i2c/Makefile -@@ -28,7 +28,7 @@ obj-$(CONFIG_VIDEO_ADV7393) += adv7393.o - obj-$(CONFIG_VIDEO_ADV7604) += adv7604.o - obj-$(CONFIG_VIDEO_ADV7842) += adv7842.o - obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o --obj-$(CONFIG_VIDEO_ADV7511) += adv7511.o -+obj-$(CONFIG_VIDEO_ADV7511) += adv7511-v4l2.o - obj-$(CONFIG_VIDEO_VPX3220) += vpx3220.o - obj-$(CONFIG_VIDEO_VS6624) += vs6624.o - obj-$(CONFIG_VIDEO_BT819) += bt819.o -diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c -new file mode 100644 -index 000000000000..b35400e4e9af ---- /dev/null -+++ b/drivers/media/i2c/adv7511-v4l2.c -@@ -0,0 +1,1600 @@ -+/* -+ * Analog Devices ADV7511 HDMI Transmitter Device Driver -+ * -+ * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved. -+ * -+ * This program is free software; you may redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; version 2 of the License. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS -+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN -+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -+ * SOFTWARE. -+ */ -+ -+/* -+ * This file is named adv7511-v4l2.c so it doesn't conflict with the Analog -+ * Device ADV7511 (config fragment CONFIG_DRM_I2C_ADV7511). -+ */ -+ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+static int debug; -+module_param(debug, int, 0644); -+MODULE_PARM_DESC(debug, "debug level (0-2)"); -+ -+MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver"); -+MODULE_AUTHOR("Hans Verkuil"); -+MODULE_LICENSE("GPL v2"); -+ -+#define MASK_ADV7511_EDID_RDY_INT 0x04 -+#define MASK_ADV7511_MSEN_INT 0x40 -+#define MASK_ADV7511_HPD_INT 0x80 -+ -+#define MASK_ADV7511_HPD_DETECT 0x40 -+#define MASK_ADV7511_MSEN_DETECT 0x20 -+#define MASK_ADV7511_EDID_RDY 0x10 -+ -+#define EDID_MAX_RETRIES (8) -+#define EDID_DELAY 250 -+#define EDID_MAX_SEGM 8 -+ -+#define ADV7511_MAX_WIDTH 1920 -+#define ADV7511_MAX_HEIGHT 1200 -+#define ADV7511_MIN_PIXELCLOCK 20000000 -+#define ADV7511_MAX_PIXELCLOCK 225000000 -+ -+/* -+********************************************************************** -+* -+* Arrays with configuration parameters for the ADV7511 -+* -+********************************************************************** -+*/ -+ -+struct i2c_reg_value { -+ unsigned char reg; -+ unsigned char value; -+}; -+ -+struct adv7511_state_edid { -+ /* total number of blocks */ -+ u32 blocks; -+ /* Number of segments read */ -+ u32 segments; -+ u8 data[EDID_MAX_SEGM * 256]; -+ /* Number of EDID read retries left */ -+ unsigned read_retries; -+ bool complete; -+}; -+ -+struct adv7511_state { -+ struct adv7511_platform_data pdata; -+ struct v4l2_subdev sd; -+ struct media_pad pad; -+ struct v4l2_ctrl_handler hdl; -+ int chip_revision; -+ u8 i2c_edid_addr; -+ u8 i2c_cec_addr; -+ u8 i2c_pktmem_addr; -+ /* Is the adv7511 powered on? */ -+ bool power_on; -+ /* Did we receive hotplug and rx-sense signals? */ -+ bool have_monitor; -+ /* timings from s_dv_timings */ -+ struct v4l2_dv_timings dv_timings; -+ u32 fmt_code; -+ u32 colorspace; -+ u32 ycbcr_enc; -+ u32 quantization; -+ u32 xfer_func; -+ /* controls */ -+ struct v4l2_ctrl *hdmi_mode_ctrl; -+ struct v4l2_ctrl *hotplug_ctrl; -+ struct v4l2_ctrl *rx_sense_ctrl; -+ struct v4l2_ctrl *have_edid0_ctrl; -+ struct v4l2_ctrl *rgb_quantization_range_ctrl; -+ struct i2c_client *i2c_edid; -+ struct i2c_client *i2c_pktmem; -+ struct adv7511_state_edid edid; -+ /* Running counter of the number of detected EDIDs (for debugging) */ -+ unsigned edid_detect_counter; -+ struct workqueue_struct *work_queue; -+ struct delayed_work edid_handler; /* work entry */ -+}; -+ -+static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd); -+static bool adv7511_check_edid_status(struct v4l2_subdev *sd); -+static void adv7511_setup(struct v4l2_subdev *sd); -+static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq); -+static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq); -+ -+ -+static const struct v4l2_dv_timings_cap adv7511_timings_cap = { -+ .type = V4L2_DV_BT_656_1120, -+ /* keep this initialization for compatibility with GCC < 4.4.6 */ -+ .reserved = { 0 }, -+ V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT, -+ ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK, -+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | -+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, -+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | -+ V4L2_DV_BT_CAP_CUSTOM) -+}; -+ -+static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd) -+{ -+ return container_of(sd, struct adv7511_state, sd); -+} -+ -+static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl) -+{ -+ return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd; -+} -+ -+/* ------------------------ I2C ----------------------------------------------- */ -+ -+static s32 adv_smbus_read_byte_data_check(struct i2c_client *client, -+ u8 command, bool check) -+{ -+ union i2c_smbus_data data; -+ -+ if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags, -+ I2C_SMBUS_READ, command, -+ I2C_SMBUS_BYTE_DATA, &data)) -+ return data.byte; -+ if (check) -+ v4l_err(client, "error reading %02x, %02x\n", -+ client->addr, command); -+ return -1; -+} -+ -+static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command) -+{ -+ int i; -+ for (i = 0; i < 3; i++) { -+ int ret = adv_smbus_read_byte_data_check(client, command, true); -+ if (ret >= 0) { -+ if (i) -+ v4l_err(client, "read ok after %d retries\n", i); -+ return ret; -+ } -+ } -+ v4l_err(client, "read failed\n"); -+ return -1; -+} -+ -+static int adv7511_rd(struct v4l2_subdev *sd, u8 reg) -+{ -+ struct i2c_client *client = v4l2_get_subdevdata(sd); -+ -+ return adv_smbus_read_byte_data(client, reg); -+} -+ -+static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val) -+{ -+ struct i2c_client *client = v4l2_get_subdevdata(sd); -+ int ret; -+ int i; -+ -+ for (i = 0; i < 3; i++) { -+ ret = i2c_smbus_write_byte_data(client, reg, val); -+ if (ret == 0) -+ return 0; -+ } -+ v4l2_err(sd, "%s: i2c write error\n", __func__); -+ return ret; -+} -+ -+/* To set specific bits in the register, a clear-mask is given (to be AND-ed), -+ and then the value-mask (to be OR-ed). */ -+static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask) -+{ -+ adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask); -+} -+ -+static int adv_smbus_read_i2c_block_data(struct i2c_client *client, -+ u8 command, unsigned length, u8 *values) -+{ -+ union i2c_smbus_data data; -+ int ret; -+ -+ if (length > I2C_SMBUS_BLOCK_MAX) -+ length = I2C_SMBUS_BLOCK_MAX; -+ data.block[0] = length; -+ -+ ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags, -+ I2C_SMBUS_READ, command, -+ I2C_SMBUS_I2C_BLOCK_DATA, &data); -+ memcpy(values, data.block + 1, length); -+ return ret; -+} -+ -+static inline void adv7511_edid_rd(struct v4l2_subdev *sd, u16 len, u8 *buf) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ int i; -+ int err = 0; -+ -+ v4l2_dbg(1, debug, sd, "%s:\n", __func__); -+ -+ for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX) -+ err = adv_smbus_read_i2c_block_data(state->i2c_edid, i, -+ I2C_SMBUS_BLOCK_MAX, buf + i); -+ if (err) -+ v4l2_err(sd, "%s: i2c read error\n", __func__); -+} -+ -+static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ return adv_smbus_read_byte_data(state->i2c_pktmem, reg); -+} -+ -+static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ int ret; -+ int i; -+ -+ for (i = 0; i < 3; i++) { -+ ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val); -+ if (ret == 0) -+ return 0; -+ } -+ v4l2_err(sd, "%s: i2c write error\n", __func__); -+ return ret; -+} -+ -+/* To set specific bits in the register, a clear-mask is given (to be AND-ed), -+ and then the value-mask (to be OR-ed). */ -+static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask) -+{ -+ adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask); -+} -+ -+static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd) -+{ -+ return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT; -+} -+ -+static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd) -+{ -+ return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT; -+} -+ -+static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode) -+{ -+ adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5); -+} -+ -+static void adv7511_csc_coeff(struct v4l2_subdev *sd, -+ u16 A1, u16 A2, u16 A3, u16 A4, -+ u16 B1, u16 B2, u16 B3, u16 B4, -+ u16 C1, u16 C2, u16 C3, u16 C4) -+{ -+ /* A */ -+ adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8); -+ adv7511_wr(sd, 0x19, A1); -+ adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8); -+ adv7511_wr(sd, 0x1B, A2); -+ adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8); -+ adv7511_wr(sd, 0x1d, A3); -+ adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8); -+ adv7511_wr(sd, 0x1f, A4); -+ -+ /* B */ -+ adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8); -+ adv7511_wr(sd, 0x21, B1); -+ adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8); -+ adv7511_wr(sd, 0x23, B2); -+ adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8); -+ adv7511_wr(sd, 0x25, B3); -+ adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8); -+ adv7511_wr(sd, 0x27, B4); -+ -+ /* C */ -+ adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8); -+ adv7511_wr(sd, 0x29, C1); -+ adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8); -+ adv7511_wr(sd, 0x2B, C2); -+ adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8); -+ adv7511_wr(sd, 0x2D, C3); -+ adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8); -+ adv7511_wr(sd, 0x2F, C4); -+} -+ -+static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable) -+{ -+ if (enable) { -+ u8 csc_mode = 0; -+ adv7511_csc_conversion_mode(sd, csc_mode); -+ adv7511_csc_coeff(sd, -+ 4096-564, 0, 0, 256, -+ 0, 4096-564, 0, 256, -+ 0, 0, 4096-564, 256); -+ /* enable CSC */ -+ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80); -+ /* AVI infoframe: Limited range RGB (16-235) */ -+ adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04); -+ } else { -+ /* disable CSC */ -+ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0); -+ /* AVI infoframe: Full range RGB (0-255) */ -+ adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08); -+ } -+} -+ -+static void adv7511_set_IT_content_AVI_InfoFrame(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) { -+ /* CE format, not IT */ -+ adv7511_wr_and_or(sd, 0x57, 0x7f, 0x00); -+ } else { -+ /* IT format */ -+ adv7511_wr_and_or(sd, 0x57, 0x7f, 0x80); -+ } -+} -+ -+static int adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl) -+{ -+ switch (ctrl->val) { -+ default: -+ return -EINVAL; -+ break; -+ case V4L2_DV_RGB_RANGE_AUTO: { -+ /* automatic */ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) { -+ /* CE format, RGB limited range (16-235) */ -+ adv7511_csc_rgb_full2limit(sd, true); -+ } else { -+ /* not CE format, RGB full range (0-255) */ -+ adv7511_csc_rgb_full2limit(sd, false); -+ } -+ } -+ break; -+ case V4L2_DV_RGB_RANGE_LIMITED: -+ /* RGB limited range (16-235) */ -+ adv7511_csc_rgb_full2limit(sd, true); -+ break; -+ case V4L2_DV_RGB_RANGE_FULL: -+ /* RGB full range (0-255) */ -+ adv7511_csc_rgb_full2limit(sd, false); -+ break; -+ } -+ return 0; -+} -+ -+/* ------------------------------ CTRL OPS ------------------------------ */ -+ -+static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl) -+{ -+ struct v4l2_subdev *sd = to_sd(ctrl); -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val); -+ -+ if (state->hdmi_mode_ctrl == ctrl) { -+ /* Set HDMI or DVI-D */ -+ adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00); -+ return 0; -+ } -+ if (state->rgb_quantization_range_ctrl == ctrl) -+ return adv7511_set_rgb_quantization_mode(sd, ctrl); -+ -+ return -EINVAL; -+} -+ -+static const struct v4l2_ctrl_ops adv7511_ctrl_ops = { -+ .s_ctrl = adv7511_s_ctrl, -+}; -+ -+/* ---------------------------- CORE OPS ------------------------------------------- */ -+ -+#ifdef CONFIG_VIDEO_ADV_DEBUG -+static void adv7511_inv_register(struct v4l2_subdev *sd) -+{ -+ v4l2_info(sd, "0x000-0x0ff: Main Map\n"); -+} -+ -+static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) -+{ -+ reg->size = 1; -+ switch (reg->reg >> 8) { -+ case 0: -+ reg->val = adv7511_rd(sd, reg->reg & 0xff); -+ break; -+ default: -+ v4l2_info(sd, "Register %03llx not supported\n", reg->reg); -+ adv7511_inv_register(sd); -+ break; -+ } -+ return 0; -+} -+ -+static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg) -+{ -+ switch (reg->reg >> 8) { -+ case 0: -+ adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff); -+ break; -+ default: -+ v4l2_info(sd, "Register %03llx not supported\n", reg->reg); -+ adv7511_inv_register(sd); -+ break; -+ } -+ return 0; -+} -+#endif -+ -+struct adv7511_cfg_read_infoframe { -+ const char *desc; -+ u8 present_reg; -+ u8 present_mask; -+ u8 header[3]; -+ u16 payload_addr; -+}; -+ -+static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size) -+{ -+ u8 csum = 0; -+ size_t i; -+ -+ /* compute checksum */ -+ for (i = 0; i < size; i++) -+ csum += ptr[i]; -+ -+ return 256 - csum; -+} -+ -+static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri) -+{ -+ struct i2c_client *client = v4l2_get_subdevdata(sd); -+ struct device *dev = &client->dev; -+ union hdmi_infoframe frame; -+ u8 buffer[32]; -+ u8 len; -+ int i; -+ -+ if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) { -+ v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc); -+ return; -+ } -+ -+ memcpy(buffer, cri->header, sizeof(cri->header)); -+ -+ len = buffer[2]; -+ -+ if (len + 4 > sizeof(buffer)) { -+ v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len); -+ return; -+ } -+ -+ if (cri->payload_addr >= 0x100) { -+ for (i = 0; i < len; i++) -+ buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100); -+ } else { -+ for (i = 0; i < len; i++) -+ buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i); -+ } -+ buffer[3] = 0; -+ buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); -+ -+ if (hdmi_infoframe_unpack(&frame, buffer) < 0) { -+ v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); -+ return; -+ } -+ -+ hdmi_infoframe_log(KERN_INFO, dev, &frame); -+} -+ -+static void adv7511_log_infoframes(struct v4l2_subdev *sd) -+{ -+ static const struct adv7511_cfg_read_infoframe cri[] = { -+ { "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 }, -+ { "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 }, -+ { "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 }, -+ }; -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(cri); i++) -+ log_infoframe(sd, &cri[i]); -+} -+ -+static int adv7511_log_status(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ struct adv7511_state_edid *edid = &state->edid; -+ -+ static const char * const states[] = { -+ "in reset", -+ "reading EDID", -+ "idle", -+ "initializing HDCP", -+ "HDCP enabled", -+ "initializing HDCP repeater", -+ "6", "7", "8", "9", "A", "B", "C", "D", "E", "F" -+ }; -+ static const char * const errors[] = { -+ "no error", -+ "bad receiver BKSV", -+ "Ri mismatch", -+ "Pj mismatch", -+ "i2c error", -+ "timed out", -+ "max repeater cascade exceeded", -+ "hash check failed", -+ "too many devices", -+ "9", "A", "B", "C", "D", "E", "F" -+ }; -+ -+ v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off"); -+ v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n", -+ (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no", -+ (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no", -+ edid->segments ? "found" : "no", -+ edid->blocks); -+ v4l2_info(sd, "%s output %s\n", -+ (adv7511_rd(sd, 0xaf) & 0x02) ? -+ "HDMI" : "DVI-D", -+ (adv7511_rd(sd, 0xa1) & 0x3c) ? -+ "disabled" : "enabled"); -+ v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n", -+ states[adv7511_rd(sd, 0xc8) & 0xf], -+ errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter, -+ adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96)); -+ v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full"); -+ if (adv7511_rd(sd, 0xaf) & 0x02) { -+ /* HDMI only */ -+ u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80; -+ u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 | -+ adv7511_rd(sd, 0x02) << 8 | -+ adv7511_rd(sd, 0x03); -+ u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2; -+ u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f; -+ u32 CTS; -+ -+ if (manual_cts) -+ CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 | -+ adv7511_rd(sd, 0x08) << 8 | -+ adv7511_rd(sd, 0x09); -+ else -+ CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 | -+ adv7511_rd(sd, 0x05) << 8 | -+ adv7511_rd(sd, 0x06); -+ v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n", -+ manual_cts ? "manual" : "automatic", N, CTS); -+ v4l2_info(sd, "VIC: detected %d, sent %d\n", -+ vic_detect, vic_sent); -+ adv7511_log_infoframes(sd); -+ } -+ if (state->dv_timings.type == V4L2_DV_BT_656_1120) -+ v4l2_print_dv_timings(sd->name, "timings: ", -+ &state->dv_timings, false); -+ else -+ v4l2_info(sd, "no timings set\n"); -+ v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr); -+ v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr); -+ v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr); -+ return 0; -+} -+ -+/* Power up/down adv7511 */ -+static int adv7511_s_power(struct v4l2_subdev *sd, int on) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ const int retries = 20; -+ int i; -+ -+ v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off"); -+ -+ state->power_on = on; -+ -+ if (!on) { -+ /* Power down */ -+ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40); -+ return true; -+ } -+ -+ /* Power up */ -+ /* The adv7511 does not always come up immediately. -+ Retry multiple times. */ -+ for (i = 0; i < retries; i++) { -+ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0); -+ if ((adv7511_rd(sd, 0x41) & 0x40) == 0) -+ break; -+ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40); -+ msleep(10); -+ } -+ if (i == retries) { -+ v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__); -+ adv7511_s_power(sd, 0); -+ return false; -+ } -+ if (i > 1) -+ v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i); -+ -+ /* Reserved registers that must be set */ -+ adv7511_wr(sd, 0x98, 0x03); -+ adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70); -+ adv7511_wr(sd, 0x9c, 0x30); -+ adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01); -+ adv7511_wr(sd, 0xa2, 0xa4); -+ adv7511_wr(sd, 0xa3, 0xa4); -+ adv7511_wr(sd, 0xe0, 0xd0); -+ adv7511_wr(sd, 0xf9, 0x00); -+ -+ adv7511_wr(sd, 0x43, state->i2c_edid_addr); -+ adv7511_wr(sd, 0x45, state->i2c_pktmem_addr); -+ -+ /* Set number of attempts to read the EDID */ -+ adv7511_wr(sd, 0xc9, 0xf); -+ return true; -+} -+ -+/* Enable interrupts */ -+static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable) -+{ -+ u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT; -+ u8 irqs_rd; -+ int retries = 100; -+ -+ v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable"); -+ -+ /* The datasheet says that the EDID ready interrupt should be -+ disabled if there is no hotplug. */ -+ if (!enable) -+ irqs = 0; -+ else if (adv7511_have_hotplug(sd)) -+ irqs |= MASK_ADV7511_EDID_RDY_INT; -+ -+ /* -+ * This i2c write can fail (approx. 1 in 1000 writes). But it -+ * is essential that this register is correct, so retry it -+ * multiple times. -+ * -+ * Note that the i2c write does not report an error, but the readback -+ * clearly shows the wrong value. -+ */ -+ do { -+ adv7511_wr(sd, 0x94, irqs); -+ irqs_rd = adv7511_rd(sd, 0x94); -+ } while (retries-- && irqs_rd != irqs); -+ -+ if (irqs_rd == irqs) -+ return; -+ v4l2_err(sd, "Could not set interrupts: hw failure?\n"); -+} -+ -+/* Interrupt handler */ -+static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled) -+{ -+ u8 irq_status; -+ -+ /* disable interrupts to prevent a race condition */ -+ adv7511_set_isr(sd, false); -+ irq_status = adv7511_rd(sd, 0x96); -+ /* clear detected interrupts */ -+ adv7511_wr(sd, 0x96, irq_status); -+ -+ v4l2_dbg(1, debug, sd, "%s: irq 0x%x\n", __func__, irq_status); -+ -+ if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT)) -+ adv7511_check_monitor_present_status(sd); -+ if (irq_status & MASK_ADV7511_EDID_RDY_INT) -+ adv7511_check_edid_status(sd); -+ -+ /* enable interrupts */ -+ adv7511_set_isr(sd, true); -+ -+ if (handled) -+ *handled = true; -+ return 0; -+} -+ -+static const struct v4l2_subdev_core_ops adv7511_core_ops = { -+ .log_status = adv7511_log_status, -+#ifdef CONFIG_VIDEO_ADV_DEBUG -+ .g_register = adv7511_g_register, -+ .s_register = adv7511_s_register, -+#endif -+ .s_power = adv7511_s_power, -+ .interrupt_service_routine = adv7511_isr, -+}; -+ -+/* ------------------------------ VIDEO OPS ------------------------------ */ -+ -+/* Enable/disable adv7511 output */ -+static int adv7511_s_stream(struct v4l2_subdev *sd, int enable) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis")); -+ adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c)); -+ if (enable) { -+ adv7511_check_monitor_present_status(sd); -+ } else { -+ adv7511_s_power(sd, 0); -+ state->have_monitor = false; -+ } -+ return 0; -+} -+ -+static int adv7511_s_dv_timings(struct v4l2_subdev *sd, -+ struct v4l2_dv_timings *timings) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ v4l2_dbg(1, debug, sd, "%s:\n", __func__); -+ -+ /* quick sanity check */ -+ if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL)) -+ return -EINVAL; -+ -+ /* Fill the optional fields .standards and .flags in struct v4l2_dv_timings -+ if the format is one of the CEA or DMT timings. */ -+ v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL); -+ -+ timings->bt.flags &= ~V4L2_DV_FL_REDUCED_FPS; -+ -+ /* save timings */ -+ state->dv_timings = *timings; -+ -+ /* update quantization range based on new dv_timings */ -+ adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl); -+ -+ /* update AVI infoframe */ -+ adv7511_set_IT_content_AVI_InfoFrame(sd); -+ -+ return 0; -+} -+ -+static int adv7511_g_dv_timings(struct v4l2_subdev *sd, -+ struct v4l2_dv_timings *timings) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ v4l2_dbg(1, debug, sd, "%s:\n", __func__); -+ -+ if (!timings) -+ return -EINVAL; -+ -+ *timings = state->dv_timings; -+ -+ return 0; -+} -+ -+static int adv7511_enum_dv_timings(struct v4l2_subdev *sd, -+ struct v4l2_enum_dv_timings *timings) -+{ -+ if (timings->pad != 0) -+ return -EINVAL; -+ -+ return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL); -+} -+ -+static int adv7511_dv_timings_cap(struct v4l2_subdev *sd, -+ struct v4l2_dv_timings_cap *cap) -+{ -+ if (cap->pad != 0) -+ return -EINVAL; -+ -+ *cap = adv7511_timings_cap; -+ return 0; -+} -+ -+static const struct v4l2_subdev_video_ops adv7511_video_ops = { -+ .s_stream = adv7511_s_stream, -+ .s_dv_timings = adv7511_s_dv_timings, -+ .g_dv_timings = adv7511_g_dv_timings, -+}; -+ -+/* ------------------------------ AUDIO OPS ------------------------------ */ -+static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable) -+{ -+ v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis")); -+ -+ if (enable) -+ adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80); -+ else -+ adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40); -+ -+ return 0; -+} -+ -+static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq) -+{ -+ u32 N; -+ -+ switch (freq) { -+ case 32000: N = 4096; break; -+ case 44100: N = 6272; break; -+ case 48000: N = 6144; break; -+ case 88200: N = 12544; break; -+ case 96000: N = 12288; break; -+ case 176400: N = 25088; break; -+ case 192000: N = 24576; break; -+ default: -+ return -EINVAL; -+ } -+ -+ /* Set N (used with CTS to regenerate the audio clock) */ -+ adv7511_wr(sd, 0x01, (N >> 16) & 0xf); -+ adv7511_wr(sd, 0x02, (N >> 8) & 0xff); -+ adv7511_wr(sd, 0x03, N & 0xff); -+ -+ return 0; -+} -+ -+static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq) -+{ -+ u32 i2s_sf; -+ -+ switch (freq) { -+ case 32000: i2s_sf = 0x30; break; -+ case 44100: i2s_sf = 0x00; break; -+ case 48000: i2s_sf = 0x20; break; -+ case 88200: i2s_sf = 0x80; break; -+ case 96000: i2s_sf = 0xa0; break; -+ case 176400: i2s_sf = 0xc0; break; -+ case 192000: i2s_sf = 0xe0; break; -+ default: -+ return -EINVAL; -+ } -+ -+ /* Set sampling frequency for I2S audio to 48 kHz */ -+ adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf); -+ -+ return 0; -+} -+ -+static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config) -+{ -+ /* Only 2 channels in use for application */ -+ adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1); -+ /* Speaker mapping */ -+ adv7511_wr(sd, 0x76, 0x00); -+ -+ /* 16 bit audio word length */ -+ adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02); -+ -+ return 0; -+} -+ -+static const struct v4l2_subdev_audio_ops adv7511_audio_ops = { -+ .s_stream = adv7511_s_audio_stream, -+ .s_clock_freq = adv7511_s_clock_freq, -+ .s_i2s_clock_freq = adv7511_s_i2s_clock_freq, -+ .s_routing = adv7511_s_routing, -+}; -+ -+/* ---------------------------- PAD OPS ------------------------------------- */ -+ -+static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ memset(edid->reserved, 0, sizeof(edid->reserved)); -+ -+ if (edid->pad != 0) -+ return -EINVAL; -+ -+ if (edid->start_block == 0 && edid->blocks == 0) { -+ edid->blocks = state->edid.segments * 2; -+ return 0; -+ } -+ -+ if (state->edid.segments == 0) -+ return -ENODATA; -+ -+ if (edid->start_block >= state->edid.segments * 2) -+ return -EINVAL; -+ -+ if (edid->start_block + edid->blocks > state->edid.segments * 2) -+ edid->blocks = state->edid.segments * 2 - edid->start_block; -+ -+ memcpy(edid->edid, &state->edid.data[edid->start_block * 128], -+ 128 * edid->blocks); -+ -+ return 0; -+} -+ -+static int adv7511_enum_mbus_code(struct v4l2_subdev *sd, -+ struct v4l2_subdev_pad_config *cfg, -+ struct v4l2_subdev_mbus_code_enum *code) -+{ -+ if (code->pad != 0) -+ return -EINVAL; -+ -+ switch (code->index) { -+ case 0: -+ code->code = MEDIA_BUS_FMT_RGB888_1X24; -+ break; -+ case 1: -+ code->code = MEDIA_BUS_FMT_YUYV8_1X16; -+ break; -+ case 2: -+ code->code = MEDIA_BUS_FMT_UYVY8_1X16; -+ break; -+ default: -+ return -EINVAL; -+ } -+ return 0; -+} -+ -+static void adv7511_fill_format(struct adv7511_state *state, -+ struct v4l2_mbus_framefmt *format) -+{ -+ memset(format, 0, sizeof(*format)); -+ -+ format->width = state->dv_timings.bt.width; -+ format->height = state->dv_timings.bt.height; -+ format->field = V4L2_FIELD_NONE; -+} -+ -+static int adv7511_get_fmt(struct v4l2_subdev *sd, -+ struct v4l2_subdev_pad_config *cfg, -+ struct v4l2_subdev_format *format) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ if (format->pad != 0) -+ return -EINVAL; -+ -+ adv7511_fill_format(state, &format->format); -+ -+ if (format->which == V4L2_SUBDEV_FORMAT_TRY) { -+ struct v4l2_mbus_framefmt *fmt; -+ -+ fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad); -+ format->format.code = fmt->code; -+ format->format.colorspace = fmt->colorspace; -+ format->format.ycbcr_enc = fmt->ycbcr_enc; -+ format->format.quantization = fmt->quantization; -+ format->format.xfer_func = fmt->xfer_func; -+ } else { -+ format->format.code = state->fmt_code; -+ format->format.colorspace = state->colorspace; -+ format->format.ycbcr_enc = state->ycbcr_enc; -+ format->format.quantization = state->quantization; -+ format->format.xfer_func = state->xfer_func; -+ } -+ -+ return 0; -+} -+ -+static int adv7511_set_fmt(struct v4l2_subdev *sd, -+ struct v4l2_subdev_pad_config *cfg, -+ struct v4l2_subdev_format *format) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ /* -+ * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary -+ * Video Information (AVI) InfoFrame Format" -+ * -+ * c = Colorimetry -+ * ec = Extended Colorimetry -+ * y = RGB or YCbCr -+ * q = RGB Quantization Range -+ * yq = YCC Quantization Range -+ */ -+ u8 c = HDMI_COLORIMETRY_NONE; -+ u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -+ u8 y = HDMI_COLORSPACE_RGB; -+ u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT; -+ u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED; -+ -+ if (format->pad != 0) -+ return -EINVAL; -+ switch (format->format.code) { -+ case MEDIA_BUS_FMT_UYVY8_1X16: -+ case MEDIA_BUS_FMT_YUYV8_1X16: -+ case MEDIA_BUS_FMT_RGB888_1X24: -+ break; -+ default: -+ return -EINVAL; -+ } -+ -+ adv7511_fill_format(state, &format->format); -+ if (format->which == V4L2_SUBDEV_FORMAT_TRY) { -+ struct v4l2_mbus_framefmt *fmt; -+ -+ fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad); -+ fmt->code = format->format.code; -+ fmt->colorspace = format->format.colorspace; -+ fmt->ycbcr_enc = format->format.ycbcr_enc; -+ fmt->quantization = format->format.quantization; -+ fmt->xfer_func = format->format.xfer_func; -+ return 0; -+ } -+ -+ switch (format->format.code) { -+ case MEDIA_BUS_FMT_UYVY8_1X16: -+ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01); -+ adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8); -+ y = HDMI_COLORSPACE_YUV422; -+ break; -+ case MEDIA_BUS_FMT_YUYV8_1X16: -+ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01); -+ adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc); -+ y = HDMI_COLORSPACE_YUV422; -+ break; -+ case MEDIA_BUS_FMT_RGB888_1X24: -+ default: -+ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00); -+ adv7511_wr_and_or(sd, 0x16, 0x03, 0x00); -+ break; -+ } -+ state->fmt_code = format->format.code; -+ state->colorspace = format->format.colorspace; -+ state->ycbcr_enc = format->format.ycbcr_enc; -+ state->quantization = format->format.quantization; -+ state->xfer_func = format->format.xfer_func; -+ -+ switch (format->format.colorspace) { -+ case V4L2_COLORSPACE_ADOBERGB: -+ c = HDMI_COLORIMETRY_EXTENDED; -+ ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 : -+ HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB; -+ break; -+ case V4L2_COLORSPACE_SMPTE170M: -+ c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE; -+ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) { -+ c = HDMI_COLORIMETRY_EXTENDED; -+ ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -+ } -+ break; -+ case V4L2_COLORSPACE_REC709: -+ c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE; -+ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) { -+ c = HDMI_COLORIMETRY_EXTENDED; -+ ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; -+ } -+ break; -+ case V4L2_COLORSPACE_SRGB: -+ c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE; -+ ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 : -+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -+ break; -+ case V4L2_COLORSPACE_BT2020: -+ c = HDMI_COLORIMETRY_EXTENDED; -+ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM) -+ ec = 5; /* Not yet available in hdmi.h */ -+ else -+ ec = 6; /* Not yet available in hdmi.h */ -+ break; -+ default: -+ break; -+ } -+ -+ /* -+ * CEA-861-F says that for RGB formats the YCC range must match the -+ * RGB range, although sources should ignore the YCC range. -+ * -+ * The RGB quantization range shouldn't be non-zero if the EDID doesn't -+ * have the Q bit set in the Video Capabilities Data Block, however this -+ * isn't checked at the moment. The assumption is that the application -+ * knows the EDID and can detect this. -+ * -+ * The same is true for the YCC quantization range: non-standard YCC -+ * quantization ranges should only be sent if the EDID has the YQ bit -+ * set in the Video Capabilities Data Block. -+ */ -+ switch (format->format.quantization) { -+ case V4L2_QUANTIZATION_FULL_RANGE: -+ q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT : -+ HDMI_QUANTIZATION_RANGE_FULL; -+ yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL; -+ break; -+ case V4L2_QUANTIZATION_LIM_RANGE: -+ q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT : -+ HDMI_QUANTIZATION_RANGE_LIMITED; -+ yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED; -+ break; -+ } -+ -+ adv7511_wr_and_or(sd, 0x4a, 0xbf, 0); -+ adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5); -+ adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6); -+ adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2)); -+ adv7511_wr_and_or(sd, 0x59, 0x0f, yq << 4); -+ adv7511_wr_and_or(sd, 0x4a, 0xff, 1); -+ -+ return 0; -+} -+ -+static const struct v4l2_subdev_pad_ops adv7511_pad_ops = { -+ .get_edid = adv7511_get_edid, -+ .enum_mbus_code = adv7511_enum_mbus_code, -+ .get_fmt = adv7511_get_fmt, -+ .set_fmt = adv7511_set_fmt, -+ .enum_dv_timings = adv7511_enum_dv_timings, -+ .dv_timings_cap = adv7511_dv_timings_cap, -+}; -+ -+/* --------------------- SUBDEV OPS --------------------------------------- */ -+ -+static const struct v4l2_subdev_ops adv7511_ops = { -+ .core = &adv7511_core_ops, -+ .pad = &adv7511_pad_ops, -+ .video = &adv7511_video_ops, -+ .audio = &adv7511_audio_ops, -+}; -+ -+/* ----------------------------------------------------------------------- */ -+static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf) -+{ -+ if (debug >= lvl) { -+ int i, j; -+ v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment); -+ for (i = 0; i < 256; i += 16) { -+ u8 b[128]; -+ u8 *bp = b; -+ if (i == 128) -+ v4l2_dbg(lvl, debug, sd, "\n"); -+ for (j = i; j < i + 16; j++) { -+ sprintf(bp, "0x%02x, ", buf[j]); -+ bp += 6; -+ } -+ bp[0] = '\0'; -+ v4l2_dbg(lvl, debug, sd, "%s\n", b); -+ } -+ } -+} -+ -+static void adv7511_notify_no_edid(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ struct adv7511_edid_detect ed; -+ -+ /* We failed to read the EDID, so send an event for this. */ -+ ed.present = false; -+ ed.segment = adv7511_rd(sd, 0xc4); -+ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -+ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0); -+} -+ -+static void adv7511_edid_handler(struct work_struct *work) -+{ -+ struct delayed_work *dwork = to_delayed_work(work); -+ struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler); -+ struct v4l2_subdev *sd = &state->sd; -+ -+ v4l2_dbg(1, debug, sd, "%s:\n", __func__); -+ -+ if (adv7511_check_edid_status(sd)) { -+ /* Return if we received the EDID. */ -+ return; -+ } -+ -+ if (adv7511_have_hotplug(sd)) { -+ /* We must retry reading the EDID several times, it is possible -+ * that initially the EDID couldn't be read due to i2c errors -+ * (DVI connectors are particularly prone to this problem). */ -+ if (state->edid.read_retries) { -+ state->edid.read_retries--; -+ v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__); -+ state->have_monitor = false; -+ adv7511_s_power(sd, false); -+ adv7511_s_power(sd, true); -+ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -+ return; -+ } -+ } -+ -+ /* We failed to read the EDID, so send an event for this. */ -+ adv7511_notify_no_edid(sd); -+ v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__); -+} -+ -+static void adv7511_audio_setup(struct v4l2_subdev *sd) -+{ -+ v4l2_dbg(1, debug, sd, "%s\n", __func__); -+ -+ adv7511_s_i2s_clock_freq(sd, 48000); -+ adv7511_s_clock_freq(sd, 48000); -+ adv7511_s_routing(sd, 0, 0, 0); -+} -+ -+/* Configure hdmi transmitter. */ -+static void adv7511_setup(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ v4l2_dbg(1, debug, sd, "%s\n", __func__); -+ -+ /* Input format: RGB 4:4:4 */ -+ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0); -+ /* Output format: RGB 4:4:4 */ -+ adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0); -+ /* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */ -+ adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06); -+ /* Disable pixel repetition */ -+ adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0); -+ /* Disable CSC */ -+ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0); -+ /* Output format: RGB 4:4:4, Active Format Information is valid, -+ * underscanned */ -+ adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12); -+ /* AVI Info frame packet enable, Audio Info frame disable */ -+ adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10); -+ /* Colorimetry, Active format aspect ratio: same as picure. */ -+ adv7511_wr(sd, 0x56, 0xa8); -+ /* No encryption */ -+ adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0); -+ -+ /* Positive clk edge capture for input video clock */ -+ adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60); -+ -+ adv7511_audio_setup(sd); -+ -+ v4l2_ctrl_handler_setup(&state->hdl); -+} -+ -+static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd) -+{ -+ struct adv7511_monitor_detect mdt; -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ mdt.present = state->have_monitor; -+ v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt); -+} -+ -+static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ /* read hotplug and rx-sense state */ -+ u8 status = adv7511_rd(sd, 0x42); -+ -+ v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n", -+ __func__, -+ status, -+ status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "", -+ status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : ""); -+ -+ /* update read only ctrls */ -+ v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0); -+ v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0); -+ -+ if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) { -+ v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__); -+ if (!state->have_monitor) { -+ v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__); -+ state->have_monitor = true; -+ adv7511_set_isr(sd, true); -+ if (!adv7511_s_power(sd, true)) { -+ v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__); -+ return; -+ } -+ adv7511_setup(sd); -+ adv7511_notify_monitor_detect(sd); -+ state->edid.read_retries = EDID_MAX_RETRIES; -+ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -+ } -+ } else if (status & MASK_ADV7511_HPD_DETECT) { -+ v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__); -+ state->edid.read_retries = EDID_MAX_RETRIES; -+ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -+ } else if (!(status & MASK_ADV7511_HPD_DETECT)) { -+ v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__); -+ if (state->have_monitor) { -+ v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__); -+ state->have_monitor = false; -+ adv7511_notify_monitor_detect(sd); -+ } -+ adv7511_s_power(sd, false); -+ memset(&state->edid, 0, sizeof(struct adv7511_state_edid)); -+ adv7511_notify_no_edid(sd); -+ } -+} -+ -+static bool edid_block_verify_crc(u8 *edid_block) -+{ -+ u8 sum = 0; -+ int i; -+ -+ for (i = 0; i < 128; i++) -+ sum += edid_block[i]; -+ return sum == 0; -+} -+ -+static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ u32 blocks = state->edid.blocks; -+ u8 *data = state->edid.data; -+ -+ if (!edid_block_verify_crc(&data[segment * 256])) -+ return false; -+ if ((segment + 1) * 2 <= blocks) -+ return edid_block_verify_crc(&data[segment * 256 + 128]); -+ return true; -+} -+ -+static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment) -+{ -+ static const u8 hdmi_header[] = { -+ 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00 -+ }; -+ struct adv7511_state *state = get_adv7511_state(sd); -+ u8 *data = state->edid.data; -+ -+ if (segment != 0) -+ return true; -+ return !memcmp(data, hdmi_header, sizeof(hdmi_header)); -+} -+ -+static bool adv7511_check_edid_status(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ u8 edidRdy = adv7511_rd(sd, 0xc5); -+ -+ v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n", -+ __func__, EDID_MAX_RETRIES - state->edid.read_retries); -+ -+ if (state->edid.complete) -+ return true; -+ -+ if (edidRdy & MASK_ADV7511_EDID_RDY) { -+ int segment = adv7511_rd(sd, 0xc4); -+ struct adv7511_edid_detect ed; -+ -+ if (segment >= EDID_MAX_SEGM) { -+ v4l2_err(sd, "edid segment number too big\n"); -+ return false; -+ } -+ v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment); -+ adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]); -+ adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]); -+ if (segment == 0) { -+ state->edid.blocks = state->edid.data[0x7e] + 1; -+ v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks); -+ } -+ if (!edid_verify_crc(sd, segment) || -+ !edid_verify_header(sd, segment)) { -+ /* edid crc error, force reread of edid segment */ -+ v4l2_err(sd, "%s: edid crc or header error\n", __func__); -+ state->have_monitor = false; -+ adv7511_s_power(sd, false); -+ adv7511_s_power(sd, true); -+ return false; -+ } -+ /* one more segment read ok */ -+ state->edid.segments = segment + 1; -+ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1); -+ if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) { -+ /* Request next EDID segment */ -+ v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments); -+ adv7511_wr(sd, 0xc9, 0xf); -+ adv7511_wr(sd, 0xc4, state->edid.segments); -+ state->edid.read_retries = EDID_MAX_RETRIES; -+ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -+ return false; -+ } -+ -+ v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments); -+ state->edid.complete = true; -+ -+ /* report when we have all segments -+ but report only for segment 0 -+ */ -+ ed.present = true; -+ ed.segment = 0; -+ state->edid_detect_counter++; -+ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -+ return ed.present; -+ } -+ -+ return false; -+} -+ -+/* ----------------------------------------------------------------------- */ -+/* Setup ADV7511 */ -+static void adv7511_init_setup(struct v4l2_subdev *sd) -+{ -+ struct adv7511_state *state = get_adv7511_state(sd); -+ struct adv7511_state_edid *edid = &state->edid; -+ -+ v4l2_dbg(1, debug, sd, "%s\n", __func__); -+ -+ /* clear all interrupts */ -+ adv7511_wr(sd, 0x96, 0xff); -+ /* -+ * Stop HPD from resetting a lot of registers. -+ * It might leave the chip in a partly un-initialized state, -+ * in particular with regards to hotplug bounces. -+ */ -+ adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0); -+ memset(edid, 0, sizeof(struct adv7511_state_edid)); -+ state->have_monitor = false; -+ adv7511_set_isr(sd, false); -+ adv7511_s_stream(sd, false); -+ adv7511_s_audio_stream(sd, false); -+} -+ -+static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id) -+{ -+ struct adv7511_state *state; -+ struct adv7511_platform_data *pdata = client->dev.platform_data; -+ struct v4l2_ctrl_handler *hdl; -+ struct v4l2_subdev *sd; -+ u8 chip_id[2]; -+ int err = -EIO; -+ -+ /* Check if the adapter supports the needed features */ -+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA)) -+ return -EIO; -+ -+ state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL); -+ if (!state) -+ return -ENOMEM; -+ -+ /* Platform data */ -+ if (!pdata) { -+ v4l_err(client, "No platform data!\n"); -+ return -ENODEV; -+ } -+ memcpy(&state->pdata, pdata, sizeof(state->pdata)); -+ state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24; -+ state->colorspace = V4L2_COLORSPACE_SRGB; -+ -+ sd = &state->sd; -+ -+ v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n", -+ client->addr << 1); -+ -+ v4l2_i2c_subdev_init(sd, client, &adv7511_ops); -+ -+ hdl = &state->hdl; -+ v4l2_ctrl_handler_init(hdl, 10); -+ /* add in ascending ID order */ -+ state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops, -+ V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI, -+ 0, V4L2_DV_TX_MODE_DVI_D); -+ state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL, -+ V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0); -+ state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL, -+ V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0); -+ state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL, -+ V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0); -+ state->rgb_quantization_range_ctrl = -+ v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops, -+ V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL, -+ 0, V4L2_DV_RGB_RANGE_AUTO); -+ sd->ctrl_handler = hdl; -+ if (hdl->error) { -+ err = hdl->error; -+ goto err_hdl; -+ } -+ state->hdmi_mode_ctrl->is_private = true; -+ state->hotplug_ctrl->is_private = true; -+ state->rx_sense_ctrl->is_private = true; -+ state->have_edid0_ctrl->is_private = true; -+ state->rgb_quantization_range_ctrl->is_private = true; -+ -+ state->pad.flags = MEDIA_PAD_FL_SINK; -+ err = media_entity_init(&sd->entity, 1, &state->pad, 0); -+ if (err) -+ goto err_hdl; -+ -+ /* EDID and CEC i2c addr */ -+ state->i2c_edid_addr = state->pdata.i2c_edid << 1; -+ state->i2c_cec_addr = state->pdata.i2c_cec << 1; -+ state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1; -+ -+ state->chip_revision = adv7511_rd(sd, 0x0); -+ chip_id[0] = adv7511_rd(sd, 0xf5); -+ chip_id[1] = adv7511_rd(sd, 0xf6); -+ if (chip_id[0] != 0x75 || chip_id[1] != 0x11) { -+ v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0], chip_id[1]); -+ err = -EIO; -+ goto err_entity; -+ } -+ -+ state->i2c_edid = i2c_new_dummy(client->adapter, state->i2c_edid_addr >> 1); -+ if (state->i2c_edid == NULL) { -+ v4l2_err(sd, "failed to register edid i2c client\n"); -+ err = -ENOMEM; -+ goto err_entity; -+ } -+ -+ state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1); -+ if (state->i2c_pktmem == NULL) { -+ v4l2_err(sd, "failed to register pktmem i2c client\n"); -+ err = -ENOMEM; -+ goto err_unreg_edid; -+ } -+ -+ adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */ -+ state->work_queue = create_singlethread_workqueue(sd->name); -+ if (state->work_queue == NULL) { -+ v4l2_err(sd, "could not create workqueue\n"); -+ err = -ENOMEM; -+ goto err_unreg_pktmem; -+ } -+ -+ INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler); -+ -+ adv7511_init_setup(sd); -+ adv7511_set_isr(sd, true); -+ adv7511_check_monitor_present_status(sd); -+ -+ v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name, -+ client->addr << 1, client->adapter->name); -+ return 0; -+ -+err_unreg_pktmem: -+ i2c_unregister_device(state->i2c_pktmem); -+err_unreg_edid: -+ i2c_unregister_device(state->i2c_edid); -+err_entity: -+ media_entity_cleanup(&sd->entity); -+err_hdl: -+ v4l2_ctrl_handler_free(&state->hdl); -+ return err; -+} -+ -+/* ----------------------------------------------------------------------- */ -+ -+static int adv7511_remove(struct i2c_client *client) -+{ -+ struct v4l2_subdev *sd = i2c_get_clientdata(client); -+ struct adv7511_state *state = get_adv7511_state(sd); -+ -+ state->chip_revision = -1; -+ -+ v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name, -+ client->addr << 1, client->adapter->name); -+ -+ adv7511_init_setup(sd); -+ cancel_delayed_work(&state->edid_handler); -+ i2c_unregister_device(state->i2c_edid); -+ i2c_unregister_device(state->i2c_pktmem); -+ destroy_workqueue(state->work_queue); -+ v4l2_device_unregister_subdev(sd); -+ media_entity_cleanup(&sd->entity); -+ v4l2_ctrl_handler_free(sd->ctrl_handler); -+ return 0; -+} -+ -+/* ----------------------------------------------------------------------- */ -+ -+static struct i2c_device_id adv7511_id[] = { -+ { "adv7511", 0 }, -+ { } -+}; -+MODULE_DEVICE_TABLE(i2c, adv7511_id); -+ -+static struct i2c_driver adv7511_driver = { -+ .driver = { -+ .name = "adv7511", -+ }, -+ .probe = adv7511_probe, -+ .remove = adv7511_remove, -+ .id_table = adv7511_id, -+}; -+ -+module_i2c_driver(adv7511_driver); -diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c -deleted file mode 100644 -index c24839cfcc35..000000000000 ---- a/drivers/media/i2c/adv7511.c -+++ /dev/null -@@ -1,1595 +0,0 @@ --/* -- * Analog Devices ADV7511 HDMI Transmitter Device Driver -- * -- * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved. -- * -- * This program is free software; you may redistribute it and/or modify -- * it under the terms of the GNU General Public License as published by -- * the Free Software Foundation; version 2 of the License. -- * -- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS -- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN -- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -- * SOFTWARE. -- */ -- -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --static int debug; --module_param(debug, int, 0644); --MODULE_PARM_DESC(debug, "debug level (0-2)"); -- --MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver"); --MODULE_AUTHOR("Hans Verkuil"); --MODULE_LICENSE("GPL v2"); -- --#define MASK_ADV7511_EDID_RDY_INT 0x04 --#define MASK_ADV7511_MSEN_INT 0x40 --#define MASK_ADV7511_HPD_INT 0x80 -- --#define MASK_ADV7511_HPD_DETECT 0x40 --#define MASK_ADV7511_MSEN_DETECT 0x20 --#define MASK_ADV7511_EDID_RDY 0x10 -- --#define EDID_MAX_RETRIES (8) --#define EDID_DELAY 250 --#define EDID_MAX_SEGM 8 -- --#define ADV7511_MAX_WIDTH 1920 --#define ADV7511_MAX_HEIGHT 1200 --#define ADV7511_MIN_PIXELCLOCK 20000000 --#define ADV7511_MAX_PIXELCLOCK 225000000 -- --/* --********************************************************************** --* --* Arrays with configuration parameters for the ADV7511 --* --********************************************************************** --*/ -- --struct i2c_reg_value { -- unsigned char reg; -- unsigned char value; --}; -- --struct adv7511_state_edid { -- /* total number of blocks */ -- u32 blocks; -- /* Number of segments read */ -- u32 segments; -- u8 data[EDID_MAX_SEGM * 256]; -- /* Number of EDID read retries left */ -- unsigned read_retries; -- bool complete; --}; -- --struct adv7511_state { -- struct adv7511_platform_data pdata; -- struct v4l2_subdev sd; -- struct media_pad pad; -- struct v4l2_ctrl_handler hdl; -- int chip_revision; -- u8 i2c_edid_addr; -- u8 i2c_cec_addr; -- u8 i2c_pktmem_addr; -- /* Is the adv7511 powered on? */ -- bool power_on; -- /* Did we receive hotplug and rx-sense signals? */ -- bool have_monitor; -- /* timings from s_dv_timings */ -- struct v4l2_dv_timings dv_timings; -- u32 fmt_code; -- u32 colorspace; -- u32 ycbcr_enc; -- u32 quantization; -- u32 xfer_func; -- /* controls */ -- struct v4l2_ctrl *hdmi_mode_ctrl; -- struct v4l2_ctrl *hotplug_ctrl; -- struct v4l2_ctrl *rx_sense_ctrl; -- struct v4l2_ctrl *have_edid0_ctrl; -- struct v4l2_ctrl *rgb_quantization_range_ctrl; -- struct i2c_client *i2c_edid; -- struct i2c_client *i2c_pktmem; -- struct adv7511_state_edid edid; -- /* Running counter of the number of detected EDIDs (for debugging) */ -- unsigned edid_detect_counter; -- struct workqueue_struct *work_queue; -- struct delayed_work edid_handler; /* work entry */ --}; -- --static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd); --static bool adv7511_check_edid_status(struct v4l2_subdev *sd); --static void adv7511_setup(struct v4l2_subdev *sd); --static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq); --static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq); -- -- --static const struct v4l2_dv_timings_cap adv7511_timings_cap = { -- .type = V4L2_DV_BT_656_1120, -- /* keep this initialization for compatibility with GCC < 4.4.6 */ -- .reserved = { 0 }, -- V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT, -- ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK, -- V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | -- V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, -- V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | -- V4L2_DV_BT_CAP_CUSTOM) --}; -- --static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd) --{ -- return container_of(sd, struct adv7511_state, sd); --} -- --static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl) --{ -- return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd; --} -- --/* ------------------------ I2C ----------------------------------------------- */ -- --static s32 adv_smbus_read_byte_data_check(struct i2c_client *client, -- u8 command, bool check) --{ -- union i2c_smbus_data data; -- -- if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags, -- I2C_SMBUS_READ, command, -- I2C_SMBUS_BYTE_DATA, &data)) -- return data.byte; -- if (check) -- v4l_err(client, "error reading %02x, %02x\n", -- client->addr, command); -- return -1; --} -- --static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command) --{ -- int i; -- for (i = 0; i < 3; i++) { -- int ret = adv_smbus_read_byte_data_check(client, command, true); -- if (ret >= 0) { -- if (i) -- v4l_err(client, "read ok after %d retries\n", i); -- return ret; -- } -- } -- v4l_err(client, "read failed\n"); -- return -1; --} -- --static int adv7511_rd(struct v4l2_subdev *sd, u8 reg) --{ -- struct i2c_client *client = v4l2_get_subdevdata(sd); -- -- return adv_smbus_read_byte_data(client, reg); --} -- --static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val) --{ -- struct i2c_client *client = v4l2_get_subdevdata(sd); -- int ret; -- int i; -- -- for (i = 0; i < 3; i++) { -- ret = i2c_smbus_write_byte_data(client, reg, val); -- if (ret == 0) -- return 0; -- } -- v4l2_err(sd, "%s: i2c write error\n", __func__); -- return ret; --} -- --/* To set specific bits in the register, a clear-mask is given (to be AND-ed), -- and then the value-mask (to be OR-ed). */ --static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask) --{ -- adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask); --} -- --static int adv_smbus_read_i2c_block_data(struct i2c_client *client, -- u8 command, unsigned length, u8 *values) --{ -- union i2c_smbus_data data; -- int ret; -- -- if (length > I2C_SMBUS_BLOCK_MAX) -- length = I2C_SMBUS_BLOCK_MAX; -- data.block[0] = length; -- -- ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags, -- I2C_SMBUS_READ, command, -- I2C_SMBUS_I2C_BLOCK_DATA, &data); -- memcpy(values, data.block + 1, length); -- return ret; --} -- --static inline void adv7511_edid_rd(struct v4l2_subdev *sd, u16 len, u8 *buf) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- int i; -- int err = 0; -- -- v4l2_dbg(1, debug, sd, "%s:\n", __func__); -- -- for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX) -- err = adv_smbus_read_i2c_block_data(state->i2c_edid, i, -- I2C_SMBUS_BLOCK_MAX, buf + i); -- if (err) -- v4l2_err(sd, "%s: i2c read error\n", __func__); --} -- --static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- return adv_smbus_read_byte_data(state->i2c_pktmem, reg); --} -- --static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- int ret; -- int i; -- -- for (i = 0; i < 3; i++) { -- ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val); -- if (ret == 0) -- return 0; -- } -- v4l2_err(sd, "%s: i2c write error\n", __func__); -- return ret; --} -- --/* To set specific bits in the register, a clear-mask is given (to be AND-ed), -- and then the value-mask (to be OR-ed). */ --static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask) --{ -- adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask); --} -- --static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd) --{ -- return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT; --} -- --static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd) --{ -- return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT; --} -- --static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode) --{ -- adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5); --} -- --static void adv7511_csc_coeff(struct v4l2_subdev *sd, -- u16 A1, u16 A2, u16 A3, u16 A4, -- u16 B1, u16 B2, u16 B3, u16 B4, -- u16 C1, u16 C2, u16 C3, u16 C4) --{ -- /* A */ -- adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8); -- adv7511_wr(sd, 0x19, A1); -- adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8); -- adv7511_wr(sd, 0x1B, A2); -- adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8); -- adv7511_wr(sd, 0x1d, A3); -- adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8); -- adv7511_wr(sd, 0x1f, A4); -- -- /* B */ -- adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8); -- adv7511_wr(sd, 0x21, B1); -- adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8); -- adv7511_wr(sd, 0x23, B2); -- adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8); -- adv7511_wr(sd, 0x25, B3); -- adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8); -- adv7511_wr(sd, 0x27, B4); -- -- /* C */ -- adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8); -- adv7511_wr(sd, 0x29, C1); -- adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8); -- adv7511_wr(sd, 0x2B, C2); -- adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8); -- adv7511_wr(sd, 0x2D, C3); -- adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8); -- adv7511_wr(sd, 0x2F, C4); --} -- --static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable) --{ -- if (enable) { -- u8 csc_mode = 0; -- adv7511_csc_conversion_mode(sd, csc_mode); -- adv7511_csc_coeff(sd, -- 4096-564, 0, 0, 256, -- 0, 4096-564, 0, 256, -- 0, 0, 4096-564, 256); -- /* enable CSC */ -- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80); -- /* AVI infoframe: Limited range RGB (16-235) */ -- adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04); -- } else { -- /* disable CSC */ -- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0); -- /* AVI infoframe: Full range RGB (0-255) */ -- adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08); -- } --} -- --static void adv7511_set_IT_content_AVI_InfoFrame(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) { -- /* CE format, not IT */ -- adv7511_wr_and_or(sd, 0x57, 0x7f, 0x00); -- } else { -- /* IT format */ -- adv7511_wr_and_or(sd, 0x57, 0x7f, 0x80); -- } --} -- --static int adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl) --{ -- switch (ctrl->val) { -- default: -- return -EINVAL; -- break; -- case V4L2_DV_RGB_RANGE_AUTO: { -- /* automatic */ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) { -- /* CE format, RGB limited range (16-235) */ -- adv7511_csc_rgb_full2limit(sd, true); -- } else { -- /* not CE format, RGB full range (0-255) */ -- adv7511_csc_rgb_full2limit(sd, false); -- } -- } -- break; -- case V4L2_DV_RGB_RANGE_LIMITED: -- /* RGB limited range (16-235) */ -- adv7511_csc_rgb_full2limit(sd, true); -- break; -- case V4L2_DV_RGB_RANGE_FULL: -- /* RGB full range (0-255) */ -- adv7511_csc_rgb_full2limit(sd, false); -- break; -- } -- return 0; --} -- --/* ------------------------------ CTRL OPS ------------------------------ */ -- --static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl) --{ -- struct v4l2_subdev *sd = to_sd(ctrl); -- struct adv7511_state *state = get_adv7511_state(sd); -- -- v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val); -- -- if (state->hdmi_mode_ctrl == ctrl) { -- /* Set HDMI or DVI-D */ -- adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00); -- return 0; -- } -- if (state->rgb_quantization_range_ctrl == ctrl) -- return adv7511_set_rgb_quantization_mode(sd, ctrl); -- -- return -EINVAL; --} -- --static const struct v4l2_ctrl_ops adv7511_ctrl_ops = { -- .s_ctrl = adv7511_s_ctrl, --}; -- --/* ---------------------------- CORE OPS ------------------------------------------- */ -- --#ifdef CONFIG_VIDEO_ADV_DEBUG --static void adv7511_inv_register(struct v4l2_subdev *sd) --{ -- v4l2_info(sd, "0x000-0x0ff: Main Map\n"); --} -- --static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) --{ -- reg->size = 1; -- switch (reg->reg >> 8) { -- case 0: -- reg->val = adv7511_rd(sd, reg->reg & 0xff); -- break; -- default: -- v4l2_info(sd, "Register %03llx not supported\n", reg->reg); -- adv7511_inv_register(sd); -- break; -- } -- return 0; --} -- --static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg) --{ -- switch (reg->reg >> 8) { -- case 0: -- adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff); -- break; -- default: -- v4l2_info(sd, "Register %03llx not supported\n", reg->reg); -- adv7511_inv_register(sd); -- break; -- } -- return 0; --} --#endif -- --struct adv7511_cfg_read_infoframe { -- const char *desc; -- u8 present_reg; -- u8 present_mask; -- u8 header[3]; -- u16 payload_addr; --}; -- --static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size) --{ -- u8 csum = 0; -- size_t i; -- -- /* compute checksum */ -- for (i = 0; i < size; i++) -- csum += ptr[i]; -- -- return 256 - csum; --} -- --static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri) --{ -- struct i2c_client *client = v4l2_get_subdevdata(sd); -- struct device *dev = &client->dev; -- union hdmi_infoframe frame; -- u8 buffer[32]; -- u8 len; -- int i; -- -- if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) { -- v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc); -- return; -- } -- -- memcpy(buffer, cri->header, sizeof(cri->header)); -- -- len = buffer[2]; -- -- if (len + 4 > sizeof(buffer)) { -- v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len); -- return; -- } -- -- if (cri->payload_addr >= 0x100) { -- for (i = 0; i < len; i++) -- buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100); -- } else { -- for (i = 0; i < len; i++) -- buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i); -- } -- buffer[3] = 0; -- buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); -- -- if (hdmi_infoframe_unpack(&frame, buffer) < 0) { -- v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); -- return; -- } -- -- hdmi_infoframe_log(KERN_INFO, dev, &frame); --} -- --static void adv7511_log_infoframes(struct v4l2_subdev *sd) --{ -- static const struct adv7511_cfg_read_infoframe cri[] = { -- { "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 }, -- { "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 }, -- { "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 }, -- }; -- int i; -- -- for (i = 0; i < ARRAY_SIZE(cri); i++) -- log_infoframe(sd, &cri[i]); --} -- --static int adv7511_log_status(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- struct adv7511_state_edid *edid = &state->edid; -- -- static const char * const states[] = { -- "in reset", -- "reading EDID", -- "idle", -- "initializing HDCP", -- "HDCP enabled", -- "initializing HDCP repeater", -- "6", "7", "8", "9", "A", "B", "C", "D", "E", "F" -- }; -- static const char * const errors[] = { -- "no error", -- "bad receiver BKSV", -- "Ri mismatch", -- "Pj mismatch", -- "i2c error", -- "timed out", -- "max repeater cascade exceeded", -- "hash check failed", -- "too many devices", -- "9", "A", "B", "C", "D", "E", "F" -- }; -- -- v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off"); -- v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n", -- (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no", -- (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no", -- edid->segments ? "found" : "no", -- edid->blocks); -- v4l2_info(sd, "%s output %s\n", -- (adv7511_rd(sd, 0xaf) & 0x02) ? -- "HDMI" : "DVI-D", -- (adv7511_rd(sd, 0xa1) & 0x3c) ? -- "disabled" : "enabled"); -- v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n", -- states[adv7511_rd(sd, 0xc8) & 0xf], -- errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter, -- adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96)); -- v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full"); -- if (adv7511_rd(sd, 0xaf) & 0x02) { -- /* HDMI only */ -- u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80; -- u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 | -- adv7511_rd(sd, 0x02) << 8 | -- adv7511_rd(sd, 0x03); -- u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2; -- u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f; -- u32 CTS; -- -- if (manual_cts) -- CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 | -- adv7511_rd(sd, 0x08) << 8 | -- adv7511_rd(sd, 0x09); -- else -- CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 | -- adv7511_rd(sd, 0x05) << 8 | -- adv7511_rd(sd, 0x06); -- v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n", -- manual_cts ? "manual" : "automatic", N, CTS); -- v4l2_info(sd, "VIC: detected %d, sent %d\n", -- vic_detect, vic_sent); -- adv7511_log_infoframes(sd); -- } -- if (state->dv_timings.type == V4L2_DV_BT_656_1120) -- v4l2_print_dv_timings(sd->name, "timings: ", -- &state->dv_timings, false); -- else -- v4l2_info(sd, "no timings set\n"); -- v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr); -- v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr); -- v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr); -- return 0; --} -- --/* Power up/down adv7511 */ --static int adv7511_s_power(struct v4l2_subdev *sd, int on) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- const int retries = 20; -- int i; -- -- v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off"); -- -- state->power_on = on; -- -- if (!on) { -- /* Power down */ -- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40); -- return true; -- } -- -- /* Power up */ -- /* The adv7511 does not always come up immediately. -- Retry multiple times. */ -- for (i = 0; i < retries; i++) { -- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0); -- if ((adv7511_rd(sd, 0x41) & 0x40) == 0) -- break; -- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40); -- msleep(10); -- } -- if (i == retries) { -- v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__); -- adv7511_s_power(sd, 0); -- return false; -- } -- if (i > 1) -- v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i); -- -- /* Reserved registers that must be set */ -- adv7511_wr(sd, 0x98, 0x03); -- adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70); -- adv7511_wr(sd, 0x9c, 0x30); -- adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01); -- adv7511_wr(sd, 0xa2, 0xa4); -- adv7511_wr(sd, 0xa3, 0xa4); -- adv7511_wr(sd, 0xe0, 0xd0); -- adv7511_wr(sd, 0xf9, 0x00); -- -- adv7511_wr(sd, 0x43, state->i2c_edid_addr); -- adv7511_wr(sd, 0x45, state->i2c_pktmem_addr); -- -- /* Set number of attempts to read the EDID */ -- adv7511_wr(sd, 0xc9, 0xf); -- return true; --} -- --/* Enable interrupts */ --static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable) --{ -- u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT; -- u8 irqs_rd; -- int retries = 100; -- -- v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable"); -- -- /* The datasheet says that the EDID ready interrupt should be -- disabled if there is no hotplug. */ -- if (!enable) -- irqs = 0; -- else if (adv7511_have_hotplug(sd)) -- irqs |= MASK_ADV7511_EDID_RDY_INT; -- -- /* -- * This i2c write can fail (approx. 1 in 1000 writes). But it -- * is essential that this register is correct, so retry it -- * multiple times. -- * -- * Note that the i2c write does not report an error, but the readback -- * clearly shows the wrong value. -- */ -- do { -- adv7511_wr(sd, 0x94, irqs); -- irqs_rd = adv7511_rd(sd, 0x94); -- } while (retries-- && irqs_rd != irqs); -- -- if (irqs_rd == irqs) -- return; -- v4l2_err(sd, "Could not set interrupts: hw failure?\n"); --} -- --/* Interrupt handler */ --static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled) --{ -- u8 irq_status; -- -- /* disable interrupts to prevent a race condition */ -- adv7511_set_isr(sd, false); -- irq_status = adv7511_rd(sd, 0x96); -- /* clear detected interrupts */ -- adv7511_wr(sd, 0x96, irq_status); -- -- v4l2_dbg(1, debug, sd, "%s: irq 0x%x\n", __func__, irq_status); -- -- if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT)) -- adv7511_check_monitor_present_status(sd); -- if (irq_status & MASK_ADV7511_EDID_RDY_INT) -- adv7511_check_edid_status(sd); -- -- /* enable interrupts */ -- adv7511_set_isr(sd, true); -- -- if (handled) -- *handled = true; -- return 0; --} -- --static const struct v4l2_subdev_core_ops adv7511_core_ops = { -- .log_status = adv7511_log_status, --#ifdef CONFIG_VIDEO_ADV_DEBUG -- .g_register = adv7511_g_register, -- .s_register = adv7511_s_register, --#endif -- .s_power = adv7511_s_power, -- .interrupt_service_routine = adv7511_isr, --}; -- --/* ------------------------------ VIDEO OPS ------------------------------ */ -- --/* Enable/disable adv7511 output */ --static int adv7511_s_stream(struct v4l2_subdev *sd, int enable) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis")); -- adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c)); -- if (enable) { -- adv7511_check_monitor_present_status(sd); -- } else { -- adv7511_s_power(sd, 0); -- state->have_monitor = false; -- } -- return 0; --} -- --static int adv7511_s_dv_timings(struct v4l2_subdev *sd, -- struct v4l2_dv_timings *timings) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- v4l2_dbg(1, debug, sd, "%s:\n", __func__); -- -- /* quick sanity check */ -- if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL)) -- return -EINVAL; -- -- /* Fill the optional fields .standards and .flags in struct v4l2_dv_timings -- if the format is one of the CEA or DMT timings. */ -- v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL); -- -- timings->bt.flags &= ~V4L2_DV_FL_REDUCED_FPS; -- -- /* save timings */ -- state->dv_timings = *timings; -- -- /* update quantization range based on new dv_timings */ -- adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl); -- -- /* update AVI infoframe */ -- adv7511_set_IT_content_AVI_InfoFrame(sd); -- -- return 0; --} -- --static int adv7511_g_dv_timings(struct v4l2_subdev *sd, -- struct v4l2_dv_timings *timings) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- v4l2_dbg(1, debug, sd, "%s:\n", __func__); -- -- if (!timings) -- return -EINVAL; -- -- *timings = state->dv_timings; -- -- return 0; --} -- --static int adv7511_enum_dv_timings(struct v4l2_subdev *sd, -- struct v4l2_enum_dv_timings *timings) --{ -- if (timings->pad != 0) -- return -EINVAL; -- -- return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL); --} -- --static int adv7511_dv_timings_cap(struct v4l2_subdev *sd, -- struct v4l2_dv_timings_cap *cap) --{ -- if (cap->pad != 0) -- return -EINVAL; -- -- *cap = adv7511_timings_cap; -- return 0; --} -- --static const struct v4l2_subdev_video_ops adv7511_video_ops = { -- .s_stream = adv7511_s_stream, -- .s_dv_timings = adv7511_s_dv_timings, -- .g_dv_timings = adv7511_g_dv_timings, --}; -- --/* ------------------------------ AUDIO OPS ------------------------------ */ --static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable) --{ -- v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis")); -- -- if (enable) -- adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80); -- else -- adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40); -- -- return 0; --} -- --static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq) --{ -- u32 N; -- -- switch (freq) { -- case 32000: N = 4096; break; -- case 44100: N = 6272; break; -- case 48000: N = 6144; break; -- case 88200: N = 12544; break; -- case 96000: N = 12288; break; -- case 176400: N = 25088; break; -- case 192000: N = 24576; break; -- default: -- return -EINVAL; -- } -- -- /* Set N (used with CTS to regenerate the audio clock) */ -- adv7511_wr(sd, 0x01, (N >> 16) & 0xf); -- adv7511_wr(sd, 0x02, (N >> 8) & 0xff); -- adv7511_wr(sd, 0x03, N & 0xff); -- -- return 0; --} -- --static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq) --{ -- u32 i2s_sf; -- -- switch (freq) { -- case 32000: i2s_sf = 0x30; break; -- case 44100: i2s_sf = 0x00; break; -- case 48000: i2s_sf = 0x20; break; -- case 88200: i2s_sf = 0x80; break; -- case 96000: i2s_sf = 0xa0; break; -- case 176400: i2s_sf = 0xc0; break; -- case 192000: i2s_sf = 0xe0; break; -- default: -- return -EINVAL; -- } -- -- /* Set sampling frequency for I2S audio to 48 kHz */ -- adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf); -- -- return 0; --} -- --static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config) --{ -- /* Only 2 channels in use for application */ -- adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1); -- /* Speaker mapping */ -- adv7511_wr(sd, 0x76, 0x00); -- -- /* 16 bit audio word length */ -- adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02); -- -- return 0; --} -- --static const struct v4l2_subdev_audio_ops adv7511_audio_ops = { -- .s_stream = adv7511_s_audio_stream, -- .s_clock_freq = adv7511_s_clock_freq, -- .s_i2s_clock_freq = adv7511_s_i2s_clock_freq, -- .s_routing = adv7511_s_routing, --}; -- --/* ---------------------------- PAD OPS ------------------------------------- */ -- --static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- memset(edid->reserved, 0, sizeof(edid->reserved)); -- -- if (edid->pad != 0) -- return -EINVAL; -- -- if (edid->start_block == 0 && edid->blocks == 0) { -- edid->blocks = state->edid.segments * 2; -- return 0; -- } -- -- if (state->edid.segments == 0) -- return -ENODATA; -- -- if (edid->start_block >= state->edid.segments * 2) -- return -EINVAL; -- -- if (edid->start_block + edid->blocks > state->edid.segments * 2) -- edid->blocks = state->edid.segments * 2 - edid->start_block; -- -- memcpy(edid->edid, &state->edid.data[edid->start_block * 128], -- 128 * edid->blocks); -- -- return 0; --} -- --static int adv7511_enum_mbus_code(struct v4l2_subdev *sd, -- struct v4l2_subdev_pad_config *cfg, -- struct v4l2_subdev_mbus_code_enum *code) --{ -- if (code->pad != 0) -- return -EINVAL; -- -- switch (code->index) { -- case 0: -- code->code = MEDIA_BUS_FMT_RGB888_1X24; -- break; -- case 1: -- code->code = MEDIA_BUS_FMT_YUYV8_1X16; -- break; -- case 2: -- code->code = MEDIA_BUS_FMT_UYVY8_1X16; -- break; -- default: -- return -EINVAL; -- } -- return 0; --} -- --static void adv7511_fill_format(struct adv7511_state *state, -- struct v4l2_mbus_framefmt *format) --{ -- memset(format, 0, sizeof(*format)); -- -- format->width = state->dv_timings.bt.width; -- format->height = state->dv_timings.bt.height; -- format->field = V4L2_FIELD_NONE; --} -- --static int adv7511_get_fmt(struct v4l2_subdev *sd, -- struct v4l2_subdev_pad_config *cfg, -- struct v4l2_subdev_format *format) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- -- if (format->pad != 0) -- return -EINVAL; -- -- adv7511_fill_format(state, &format->format); -- -- if (format->which == V4L2_SUBDEV_FORMAT_TRY) { -- struct v4l2_mbus_framefmt *fmt; -- -- fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad); -- format->format.code = fmt->code; -- format->format.colorspace = fmt->colorspace; -- format->format.ycbcr_enc = fmt->ycbcr_enc; -- format->format.quantization = fmt->quantization; -- format->format.xfer_func = fmt->xfer_func; -- } else { -- format->format.code = state->fmt_code; -- format->format.colorspace = state->colorspace; -- format->format.ycbcr_enc = state->ycbcr_enc; -- format->format.quantization = state->quantization; -- format->format.xfer_func = state->xfer_func; -- } -- -- return 0; --} -- --static int adv7511_set_fmt(struct v4l2_subdev *sd, -- struct v4l2_subdev_pad_config *cfg, -- struct v4l2_subdev_format *format) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- /* -- * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary -- * Video Information (AVI) InfoFrame Format" -- * -- * c = Colorimetry -- * ec = Extended Colorimetry -- * y = RGB or YCbCr -- * q = RGB Quantization Range -- * yq = YCC Quantization Range -- */ -- u8 c = HDMI_COLORIMETRY_NONE; -- u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -- u8 y = HDMI_COLORSPACE_RGB; -- u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT; -- u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED; -- -- if (format->pad != 0) -- return -EINVAL; -- switch (format->format.code) { -- case MEDIA_BUS_FMT_UYVY8_1X16: -- case MEDIA_BUS_FMT_YUYV8_1X16: -- case MEDIA_BUS_FMT_RGB888_1X24: -- break; -- default: -- return -EINVAL; -- } -- -- adv7511_fill_format(state, &format->format); -- if (format->which == V4L2_SUBDEV_FORMAT_TRY) { -- struct v4l2_mbus_framefmt *fmt; -- -- fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad); -- fmt->code = format->format.code; -- fmt->colorspace = format->format.colorspace; -- fmt->ycbcr_enc = format->format.ycbcr_enc; -- fmt->quantization = format->format.quantization; -- fmt->xfer_func = format->format.xfer_func; -- return 0; -- } -- -- switch (format->format.code) { -- case MEDIA_BUS_FMT_UYVY8_1X16: -- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01); -- adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8); -- y = HDMI_COLORSPACE_YUV422; -- break; -- case MEDIA_BUS_FMT_YUYV8_1X16: -- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01); -- adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc); -- y = HDMI_COLORSPACE_YUV422; -- break; -- case MEDIA_BUS_FMT_RGB888_1X24: -- default: -- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00); -- adv7511_wr_and_or(sd, 0x16, 0x03, 0x00); -- break; -- } -- state->fmt_code = format->format.code; -- state->colorspace = format->format.colorspace; -- state->ycbcr_enc = format->format.ycbcr_enc; -- state->quantization = format->format.quantization; -- state->xfer_func = format->format.xfer_func; -- -- switch (format->format.colorspace) { -- case V4L2_COLORSPACE_ADOBERGB: -- c = HDMI_COLORIMETRY_EXTENDED; -- ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 : -- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB; -- break; -- case V4L2_COLORSPACE_SMPTE170M: -- c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE; -- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) { -- c = HDMI_COLORIMETRY_EXTENDED; -- ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -- } -- break; -- case V4L2_COLORSPACE_REC709: -- c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE; -- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) { -- c = HDMI_COLORIMETRY_EXTENDED; -- ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709; -- } -- break; -- case V4L2_COLORSPACE_SRGB: -- c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE; -- ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 : -- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601; -- break; -- case V4L2_COLORSPACE_BT2020: -- c = HDMI_COLORIMETRY_EXTENDED; -- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM) -- ec = 5; /* Not yet available in hdmi.h */ -- else -- ec = 6; /* Not yet available in hdmi.h */ -- break; -- default: -- break; -- } -- -- /* -- * CEA-861-F says that for RGB formats the YCC range must match the -- * RGB range, although sources should ignore the YCC range. -- * -- * The RGB quantization range shouldn't be non-zero if the EDID doesn't -- * have the Q bit set in the Video Capabilities Data Block, however this -- * isn't checked at the moment. The assumption is that the application -- * knows the EDID and can detect this. -- * -- * The same is true for the YCC quantization range: non-standard YCC -- * quantization ranges should only be sent if the EDID has the YQ bit -- * set in the Video Capabilities Data Block. -- */ -- switch (format->format.quantization) { -- case V4L2_QUANTIZATION_FULL_RANGE: -- q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT : -- HDMI_QUANTIZATION_RANGE_FULL; -- yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL; -- break; -- case V4L2_QUANTIZATION_LIM_RANGE: -- q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT : -- HDMI_QUANTIZATION_RANGE_LIMITED; -- yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED; -- break; -- } -- -- adv7511_wr_and_or(sd, 0x4a, 0xbf, 0); -- adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5); -- adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6); -- adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2)); -- adv7511_wr_and_or(sd, 0x59, 0x0f, yq << 4); -- adv7511_wr_and_or(sd, 0x4a, 0xff, 1); -- -- return 0; --} -- --static const struct v4l2_subdev_pad_ops adv7511_pad_ops = { -- .get_edid = adv7511_get_edid, -- .enum_mbus_code = adv7511_enum_mbus_code, -- .get_fmt = adv7511_get_fmt, -- .set_fmt = adv7511_set_fmt, -- .enum_dv_timings = adv7511_enum_dv_timings, -- .dv_timings_cap = adv7511_dv_timings_cap, --}; -- --/* --------------------- SUBDEV OPS --------------------------------------- */ -- --static const struct v4l2_subdev_ops adv7511_ops = { -- .core = &adv7511_core_ops, -- .pad = &adv7511_pad_ops, -- .video = &adv7511_video_ops, -- .audio = &adv7511_audio_ops, --}; -- --/* ----------------------------------------------------------------------- */ --static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf) --{ -- if (debug >= lvl) { -- int i, j; -- v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment); -- for (i = 0; i < 256; i += 16) { -- u8 b[128]; -- u8 *bp = b; -- if (i == 128) -- v4l2_dbg(lvl, debug, sd, "\n"); -- for (j = i; j < i + 16; j++) { -- sprintf(bp, "0x%02x, ", buf[j]); -- bp += 6; -- } -- bp[0] = '\0'; -- v4l2_dbg(lvl, debug, sd, "%s\n", b); -- } -- } --} -- --static void adv7511_notify_no_edid(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- struct adv7511_edid_detect ed; -- -- /* We failed to read the EDID, so send an event for this. */ -- ed.present = false; -- ed.segment = adv7511_rd(sd, 0xc4); -- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0); --} -- --static void adv7511_edid_handler(struct work_struct *work) --{ -- struct delayed_work *dwork = to_delayed_work(work); -- struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler); -- struct v4l2_subdev *sd = &state->sd; -- -- v4l2_dbg(1, debug, sd, "%s:\n", __func__); -- -- if (adv7511_check_edid_status(sd)) { -- /* Return if we received the EDID. */ -- return; -- } -- -- if (adv7511_have_hotplug(sd)) { -- /* We must retry reading the EDID several times, it is possible -- * that initially the EDID couldn't be read due to i2c errors -- * (DVI connectors are particularly prone to this problem). */ -- if (state->edid.read_retries) { -- state->edid.read_retries--; -- v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__); -- state->have_monitor = false; -- adv7511_s_power(sd, false); -- adv7511_s_power(sd, true); -- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -- return; -- } -- } -- -- /* We failed to read the EDID, so send an event for this. */ -- adv7511_notify_no_edid(sd); -- v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__); --} -- --static void adv7511_audio_setup(struct v4l2_subdev *sd) --{ -- v4l2_dbg(1, debug, sd, "%s\n", __func__); -- -- adv7511_s_i2s_clock_freq(sd, 48000); -- adv7511_s_clock_freq(sd, 48000); -- adv7511_s_routing(sd, 0, 0, 0); --} -- --/* Configure hdmi transmitter. */ --static void adv7511_setup(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- v4l2_dbg(1, debug, sd, "%s\n", __func__); -- -- /* Input format: RGB 4:4:4 */ -- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0); -- /* Output format: RGB 4:4:4 */ -- adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0); -- /* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */ -- adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06); -- /* Disable pixel repetition */ -- adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0); -- /* Disable CSC */ -- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0); -- /* Output format: RGB 4:4:4, Active Format Information is valid, -- * underscanned */ -- adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12); -- /* AVI Info frame packet enable, Audio Info frame disable */ -- adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10); -- /* Colorimetry, Active format aspect ratio: same as picure. */ -- adv7511_wr(sd, 0x56, 0xa8); -- /* No encryption */ -- adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0); -- -- /* Positive clk edge capture for input video clock */ -- adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60); -- -- adv7511_audio_setup(sd); -- -- v4l2_ctrl_handler_setup(&state->hdl); --} -- --static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd) --{ -- struct adv7511_monitor_detect mdt; -- struct adv7511_state *state = get_adv7511_state(sd); -- -- mdt.present = state->have_monitor; -- v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt); --} -- --static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- /* read hotplug and rx-sense state */ -- u8 status = adv7511_rd(sd, 0x42); -- -- v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n", -- __func__, -- status, -- status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "", -- status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : ""); -- -- /* update read only ctrls */ -- v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0); -- v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0); -- -- if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) { -- v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__); -- if (!state->have_monitor) { -- v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__); -- state->have_monitor = true; -- adv7511_set_isr(sd, true); -- if (!adv7511_s_power(sd, true)) { -- v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__); -- return; -- } -- adv7511_setup(sd); -- adv7511_notify_monitor_detect(sd); -- state->edid.read_retries = EDID_MAX_RETRIES; -- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -- } -- } else if (status & MASK_ADV7511_HPD_DETECT) { -- v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__); -- state->edid.read_retries = EDID_MAX_RETRIES; -- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -- } else if (!(status & MASK_ADV7511_HPD_DETECT)) { -- v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__); -- if (state->have_monitor) { -- v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__); -- state->have_monitor = false; -- adv7511_notify_monitor_detect(sd); -- } -- adv7511_s_power(sd, false); -- memset(&state->edid, 0, sizeof(struct adv7511_state_edid)); -- adv7511_notify_no_edid(sd); -- } --} -- --static bool edid_block_verify_crc(u8 *edid_block) --{ -- u8 sum = 0; -- int i; -- -- for (i = 0; i < 128; i++) -- sum += edid_block[i]; -- return sum == 0; --} -- --static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- u32 blocks = state->edid.blocks; -- u8 *data = state->edid.data; -- -- if (!edid_block_verify_crc(&data[segment * 256])) -- return false; -- if ((segment + 1) * 2 <= blocks) -- return edid_block_verify_crc(&data[segment * 256 + 128]); -- return true; --} -- --static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment) --{ -- static const u8 hdmi_header[] = { -- 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00 -- }; -- struct adv7511_state *state = get_adv7511_state(sd); -- u8 *data = state->edid.data; -- -- if (segment != 0) -- return true; -- return !memcmp(data, hdmi_header, sizeof(hdmi_header)); --} -- --static bool adv7511_check_edid_status(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- u8 edidRdy = adv7511_rd(sd, 0xc5); -- -- v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n", -- __func__, EDID_MAX_RETRIES - state->edid.read_retries); -- -- if (state->edid.complete) -- return true; -- -- if (edidRdy & MASK_ADV7511_EDID_RDY) { -- int segment = adv7511_rd(sd, 0xc4); -- struct adv7511_edid_detect ed; -- -- if (segment >= EDID_MAX_SEGM) { -- v4l2_err(sd, "edid segment number too big\n"); -- return false; -- } -- v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment); -- adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]); -- adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]); -- if (segment == 0) { -- state->edid.blocks = state->edid.data[0x7e] + 1; -- v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks); -- } -- if (!edid_verify_crc(sd, segment) || -- !edid_verify_header(sd, segment)) { -- /* edid crc error, force reread of edid segment */ -- v4l2_err(sd, "%s: edid crc or header error\n", __func__); -- state->have_monitor = false; -- adv7511_s_power(sd, false); -- adv7511_s_power(sd, true); -- return false; -- } -- /* one more segment read ok */ -- state->edid.segments = segment + 1; -- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1); -- if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) { -- /* Request next EDID segment */ -- v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments); -- adv7511_wr(sd, 0xc9, 0xf); -- adv7511_wr(sd, 0xc4, state->edid.segments); -- state->edid.read_retries = EDID_MAX_RETRIES; -- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY); -- return false; -- } -- -- v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments); -- state->edid.complete = true; -- -- /* report when we have all segments -- but report only for segment 0 -- */ -- ed.present = true; -- ed.segment = 0; -- state->edid_detect_counter++; -- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); -- return ed.present; -- } -- -- return false; --} -- --/* ----------------------------------------------------------------------- */ --/* Setup ADV7511 */ --static void adv7511_init_setup(struct v4l2_subdev *sd) --{ -- struct adv7511_state *state = get_adv7511_state(sd); -- struct adv7511_state_edid *edid = &state->edid; -- -- v4l2_dbg(1, debug, sd, "%s\n", __func__); -- -- /* clear all interrupts */ -- adv7511_wr(sd, 0x96, 0xff); -- /* -- * Stop HPD from resetting a lot of registers. -- * It might leave the chip in a partly un-initialized state, -- * in particular with regards to hotplug bounces. -- */ -- adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0); -- memset(edid, 0, sizeof(struct adv7511_state_edid)); -- state->have_monitor = false; -- adv7511_set_isr(sd, false); -- adv7511_s_stream(sd, false); -- adv7511_s_audio_stream(sd, false); --} -- --static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id) --{ -- struct adv7511_state *state; -- struct adv7511_platform_data *pdata = client->dev.platform_data; -- struct v4l2_ctrl_handler *hdl; -- struct v4l2_subdev *sd; -- u8 chip_id[2]; -- int err = -EIO; -- -- /* Check if the adapter supports the needed features */ -- if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA)) -- return -EIO; -- -- state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL); -- if (!state) -- return -ENOMEM; -- -- /* Platform data */ -- if (!pdata) { -- v4l_err(client, "No platform data!\n"); -- return -ENODEV; -- } -- memcpy(&state->pdata, pdata, sizeof(state->pdata)); -- state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24; -- state->colorspace = V4L2_COLORSPACE_SRGB; -- -- sd = &state->sd; -- -- v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n", -- client->addr << 1); -- -- v4l2_i2c_subdev_init(sd, client, &adv7511_ops); -- -- hdl = &state->hdl; -- v4l2_ctrl_handler_init(hdl, 10); -- /* add in ascending ID order */ -- state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops, -- V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI, -- 0, V4L2_DV_TX_MODE_DVI_D); -- state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL, -- V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0); -- state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL, -- V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0); -- state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL, -- V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0); -- state->rgb_quantization_range_ctrl = -- v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops, -- V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL, -- 0, V4L2_DV_RGB_RANGE_AUTO); -- sd->ctrl_handler = hdl; -- if (hdl->error) { -- err = hdl->error; -- goto err_hdl; -- } -- state->hdmi_mode_ctrl->is_private = true; -- state->hotplug_ctrl->is_private = true; -- state->rx_sense_ctrl->is_private = true; -- state->have_edid0_ctrl->is_private = true; -- state->rgb_quantization_range_ctrl->is_private = true; -- -- state->pad.flags = MEDIA_PAD_FL_SINK; -- err = media_entity_init(&sd->entity, 1, &state->pad, 0); -- if (err) -- goto err_hdl; -- -- /* EDID and CEC i2c addr */ -- state->i2c_edid_addr = state->pdata.i2c_edid << 1; -- state->i2c_cec_addr = state->pdata.i2c_cec << 1; -- state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1; -- -- state->chip_revision = adv7511_rd(sd, 0x0); -- chip_id[0] = adv7511_rd(sd, 0xf5); -- chip_id[1] = adv7511_rd(sd, 0xf6); -- if (chip_id[0] != 0x75 || chip_id[1] != 0x11) { -- v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0], chip_id[1]); -- err = -EIO; -- goto err_entity; -- } -- -- state->i2c_edid = i2c_new_dummy(client->adapter, state->i2c_edid_addr >> 1); -- if (state->i2c_edid == NULL) { -- v4l2_err(sd, "failed to register edid i2c client\n"); -- err = -ENOMEM; -- goto err_entity; -- } -- -- state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1); -- if (state->i2c_pktmem == NULL) { -- v4l2_err(sd, "failed to register pktmem i2c client\n"); -- err = -ENOMEM; -- goto err_unreg_edid; -- } -- -- adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */ -- state->work_queue = create_singlethread_workqueue(sd->name); -- if (state->work_queue == NULL) { -- v4l2_err(sd, "could not create workqueue\n"); -- err = -ENOMEM; -- goto err_unreg_pktmem; -- } -- -- INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler); -- -- adv7511_init_setup(sd); -- adv7511_set_isr(sd, true); -- adv7511_check_monitor_present_status(sd); -- -- v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name, -- client->addr << 1, client->adapter->name); -- return 0; -- --err_unreg_pktmem: -- i2c_unregister_device(state->i2c_pktmem); --err_unreg_edid: -- i2c_unregister_device(state->i2c_edid); --err_entity: -- media_entity_cleanup(&sd->entity); --err_hdl: -- v4l2_ctrl_handler_free(&state->hdl); -- return err; --} -- --/* ----------------------------------------------------------------------- */ -- --static int adv7511_remove(struct i2c_client *client) --{ -- struct v4l2_subdev *sd = i2c_get_clientdata(client); -- struct adv7511_state *state = get_adv7511_state(sd); -- -- state->chip_revision = -1; -- -- v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name, -- client->addr << 1, client->adapter->name); -- -- adv7511_init_setup(sd); -- cancel_delayed_work(&state->edid_handler); -- i2c_unregister_device(state->i2c_edid); -- i2c_unregister_device(state->i2c_pktmem); -- destroy_workqueue(state->work_queue); -- v4l2_device_unregister_subdev(sd); -- media_entity_cleanup(&sd->entity); -- v4l2_ctrl_handler_free(sd->ctrl_handler); -- return 0; --} -- --/* ----------------------------------------------------------------------- */ -- --static struct i2c_device_id adv7511_id[] = { -- { "adv7511", 0 }, -- { } --}; --MODULE_DEVICE_TABLE(i2c, adv7511_id); -- --static struct i2c_driver adv7511_driver = { -- .driver = { -- .name = "adv7511", -- }, -- .probe = adv7511_probe, -- .remove = adv7511_remove, -- .id_table = adv7511_id, --}; -- --module_i2c_driver(adv7511_driver); -diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c -index a4639813cf35..439cb76d8e6f 100644 ---- a/drivers/media/platform/coda/coda-bit.c -+++ b/drivers/media/platform/coda/coda-bit.c -@@ -1581,6 +1581,7 @@ static int __coda_start_decoding(struct coda_ctx *ctx) - coda_write(dev, 0, CODA_REG_BIT_BIT_STREAM_PARAM); - return -ETIMEDOUT; - } -+ ctx->sequence_offset = ~0U; - ctx->initialized = 1; - - /* Update kfifo out pointer from coda bitstream read pointer */ -@@ -1966,12 +1967,17 @@ static void coda_finish_decode(struct coda_ctx *ctx) - else if (ctx->display_idx < 0) - ctx->hold = true; - } else if (decoded_idx == -2) { -+ if (ctx->display_idx >= 0 && -+ ctx->display_idx < ctx->num_internal_frames) -+ ctx->sequence_offset++; - /* no frame was decoded, we still return remaining buffers */ - } else if (decoded_idx < 0 || decoded_idx >= ctx->num_internal_frames) { - v4l2_err(&dev->v4l2_dev, - "decoded frame index out of range: %d\n", decoded_idx); - } else { -- val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1; -+ val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM); -+ if (ctx->sequence_offset == -1) -+ ctx->sequence_offset = val; - val -= ctx->sequence_offset; - spin_lock_irqsave(&ctx->buffer_meta_lock, flags); - if (!list_empty(&ctx->buffer_meta_list)) { -@@ -2101,7 +2107,6 @@ irqreturn_t coda_irq_handler(int irq, void *data) - if (ctx == NULL) { - v4l2_err(&dev->v4l2_dev, - "Instance released before the end of transaction\n"); -- mutex_unlock(&dev->coda_mutex); - return IRQ_HANDLED; - } - -diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c -index fce86f17dffc..c2c68988e38a 100644 ---- a/drivers/media/platform/davinci/vpss.c -+++ b/drivers/media/platform/davinci/vpss.c -@@ -523,6 +523,11 @@ static int __init vpss_init(void) - return -EBUSY; - - oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4); -+ if (unlikely(!oper_cfg.vpss_regs_base2)) { -+ release_mem_region(VPSS_CLK_CTRL, 4); -+ return -ENOMEM; -+ } -+ - writel(VPSS_CLK_CTRL_VENCCLKEN | - VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); - -diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c -index aa2b44041d3f..22fe771d4dd2 100644 ---- a/drivers/media/platform/marvell-ccic/mcam-core.c -+++ b/drivers/media/platform/marvell-ccic/mcam-core.c -@@ -209,7 +209,6 @@ struct mcam_vb_buffer { - struct list_head queue; - struct mcam_dma_desc *dma_desc; /* Descriptor virtual address */ - dma_addr_t dma_desc_pa; /* Descriptor physical address */ -- int dma_desc_nent; /* Number of mapped descriptors */ - }; - - static inline struct mcam_vb_buffer *vb_to_mvb(struct vb2_v4l2_buffer *vb) -@@ -616,9 +615,11 @@ static void mcam_dma_contig_done(struct mcam_camera *cam, int frame) - static void mcam_sg_next_buffer(struct mcam_camera *cam) - { - struct mcam_vb_buffer *buf; -+ struct sg_table *sg_table; - - buf = list_first_entry(&cam->buffers, struct mcam_vb_buffer, queue); - list_del_init(&buf->queue); -+ sg_table = vb2_dma_sg_plane_desc(&buf->vb_buf.vb2_buf, 0); - /* - * Very Bad Not Good Things happen if you don't clear - * C1_DESC_ENA before making any descriptor changes. -@@ -626,7 +627,7 @@ static void mcam_sg_next_buffer(struct mcam_camera *cam) - mcam_reg_clear_bit(cam, REG_CTRL1, C1_DESC_ENA); - mcam_reg_write(cam, REG_DMA_DESC_Y, buf->dma_desc_pa); - mcam_reg_write(cam, REG_DESC_LEN_Y, -- buf->dma_desc_nent*sizeof(struct mcam_dma_desc)); -+ sg_table->nents * sizeof(struct mcam_dma_desc)); - mcam_reg_write(cam, REG_DESC_LEN_U, 0); - mcam_reg_write(cam, REG_DESC_LEN_V, 0); - mcam_reg_set_bit(cam, REG_CTRL1, C1_DESC_ENA); -diff --git a/drivers/media/radio/radio-raremono.c b/drivers/media/radio/radio-raremono.c -index bfb3a6d051ba..10958bac0ad9 100644 ---- a/drivers/media/radio/radio-raremono.c -+++ b/drivers/media/radio/radio-raremono.c -@@ -283,6 +283,14 @@ static int vidioc_g_frequency(struct file *file, void *priv, - return 0; - } - -+static void raremono_device_release(struct v4l2_device *v4l2_dev) -+{ -+ struct raremono_device *radio = to_raremono_dev(v4l2_dev); -+ -+ kfree(radio->buffer); -+ kfree(radio); -+} -+ - /* File system interface */ - static const struct v4l2_file_operations usb_raremono_fops = { - .owner = THIS_MODULE, -@@ -307,12 +315,14 @@ static int usb_raremono_probe(struct usb_interface *intf, - struct raremono_device *radio; - int retval = 0; - -- radio = devm_kzalloc(&intf->dev, sizeof(struct raremono_device), GFP_KERNEL); -- if (radio) -- radio->buffer = devm_kmalloc(&intf->dev, BUFFER_LENGTH, GFP_KERNEL); -- -- if (!radio || !radio->buffer) -+ radio = kzalloc(sizeof(*radio), GFP_KERNEL); -+ if (!radio) -+ return -ENOMEM; -+ radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL); -+ if (!radio->buffer) { -+ kfree(radio); - return -ENOMEM; -+ } - - radio->usbdev = interface_to_usbdev(intf); - radio->intf = intf; -@@ -336,7 +346,8 @@ static int usb_raremono_probe(struct usb_interface *intf, - if (retval != 3 || - (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) { - dev_info(&intf->dev, "this is not Thanko's Raremono.\n"); -- return -ENODEV; -+ retval = -ENODEV; -+ goto free_mem; - } - - dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n", -@@ -345,7 +356,7 @@ static int usb_raremono_probe(struct usb_interface *intf, - retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev); - if (retval < 0) { - dev_err(&intf->dev, "couldn't register v4l2_device\n"); -- return retval; -+ goto free_mem; - } - - mutex_init(&radio->lock); -@@ -357,6 +368,7 @@ static int usb_raremono_probe(struct usb_interface *intf, - radio->vdev.ioctl_ops = &usb_raremono_ioctl_ops; - radio->vdev.lock = &radio->lock; - radio->vdev.release = video_device_release_empty; -+ radio->v4l2_dev.release = raremono_device_release; - - usb_set_intfdata(intf, &radio->v4l2_dev); - -@@ -372,6 +384,10 @@ static int usb_raremono_probe(struct usb_interface *intf, - } - dev_err(&intf->dev, "could not register video device\n"); - v4l2_device_unregister(&radio->v4l2_dev); -+ -+free_mem: -+ kfree(radio->buffer); -+ kfree(radio); - return retval; - } - -diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c -index fb42f0fd0c1f..add26eac1677 100644 ---- a/drivers/media/radio/wl128x/fmdrv_v4l2.c -+++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c -@@ -553,6 +553,7 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr) - - /* Register with V4L2 subsystem as RADIO device */ - if (video_register_device(&gradio_dev, VFL_TYPE_RADIO, radio_nr)) { -+ v4l2_device_unregister(&fmdev->v4l2_dev); - fmerr("Could not register video device\n"); - return -ENOMEM; - } -@@ -566,6 +567,8 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr) - if (ret < 0) { - fmerr("(fmdev): Can't init ctrl handler\n"); - v4l2_ctrl_handler_free(&fmdev->ctrl_handler); -+ video_unregister_device(fmdev->radio_dev); -+ v4l2_device_unregister(&fmdev->v4l2_dev); - return -EBUSY; - } - -diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c -index 351a78a84c3d..41ea00ac3a87 100644 ---- a/drivers/media/usb/cpia2/cpia2_usb.c -+++ b/drivers/media/usb/cpia2/cpia2_usb.c -@@ -884,7 +884,6 @@ static void cpia2_usb_disconnect(struct usb_interface *intf) - cpia2_unregister_camera(cam); - v4l2_device_disconnect(&cam->v4l2_dev); - mutex_unlock(&cam->v4l2_lock); -- v4l2_device_put(&cam->v4l2_dev); - - if(cam->buffers) { - DBG("Wakeup waiting processes\n"); -@@ -897,6 +896,8 @@ static void cpia2_usb_disconnect(struct usb_interface *intf) - DBG("Releasing interface\n"); - usb_driver_release_interface(&cpia2_driver, intf); - -+ v4l2_device_put(&cam->v4l2_dev); -+ - LOG("CPiA2 camera disconnected.\n"); - } - -diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c -index 1adf325012f7..97a89ef7e4c1 100644 ---- a/drivers/media/usb/dvb-usb/dvb-usb-init.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c -@@ -286,12 +286,15 @@ EXPORT_SYMBOL(dvb_usb_device_init); - void dvb_usb_device_exit(struct usb_interface *intf) - { - struct dvb_usb_device *d = usb_get_intfdata(intf); -- const char *name = "generic DVB-USB module"; -+ const char *default_name = "generic DVB-USB module"; -+ char name[40]; - - usb_set_intfdata(intf, NULL); - if (d != NULL && d->desc != NULL) { -- name = d->desc->name; -+ strscpy(name, d->desc->name, sizeof(name)); - dvb_usb_exit(d); -+ } else { -+ strscpy(name, default_name, sizeof(name)); - } - info("%s successfully deinitialized and disconnected.", name); - -diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c -index 70097cc3a35d..3140ffbb1e67 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls.c -@@ -2073,16 +2073,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl, - v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step, - &def, &flags); - -- is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU || -- cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU); -+ is_menu = (type == V4L2_CTRL_TYPE_MENU || -+ type == V4L2_CTRL_TYPE_INTEGER_MENU); - if (is_menu) - WARN_ON(step); - else - WARN_ON(cfg->menu_skip_mask); -- if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) -+ if (type == V4L2_CTRL_TYPE_MENU && !qmenu) { - qmenu = v4l2_ctrl_get_menu(cfg->id); -- else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU && -- qmenu_int == NULL) { -+ } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) { - handler_set_err(hdl, -EINVAL); - return NULL; - } -diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c -index 4d673a626db4..1041eb7a6167 100644 ---- a/drivers/memstick/core/memstick.c -+++ b/drivers/memstick/core/memstick.c -@@ -629,13 +629,18 @@ static int __init memstick_init(void) - return -ENOMEM; - - rc = bus_register(&memstick_bus_type); -- if (!rc) -- rc = class_register(&memstick_host_class); -+ if (rc) -+ goto error_destroy_workqueue; - -- if (!rc) -- return 0; -+ rc = class_register(&memstick_host_class); -+ if (rc) -+ goto error_bus_unregister; -+ -+ return 0; - -+error_bus_unregister: - bus_unregister(&memstick_bus_type); -+error_destroy_workqueue: - destroy_workqueue(workqueue); - - return rc; -diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c -index d474732cc65c..fb54de5c1aba 100644 ---- a/drivers/mfd/arizona-core.c -+++ b/drivers/mfd/arizona-core.c -@@ -967,7 +967,7 @@ int arizona_dev_init(struct arizona *arizona) - unsigned int reg, val, mask; - int (*apply_patch)(struct arizona *) = NULL; - const struct mfd_cell *subdevs = NULL; -- int n_subdevs, ret, i; -+ int n_subdevs = 0, ret, i; - - dev_set_drvdata(arizona->dev, arizona); - mutex_init(&arizona->clk_lock); -diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c -index 022c9374ce8b..215bb5eeb5ac 100644 ---- a/drivers/mfd/mfd-core.c -+++ b/drivers/mfd/mfd-core.c -@@ -178,6 +178,7 @@ static int mfd_add_device(struct device *parent, int id, - for_each_child_of_node(parent->of_node, np) { - if (of_device_is_compatible(np, cell->of_compatible)) { - pdev->dev.of_node = np; -+ pdev->dev.fwnode = &np->fwnode; - break; - } - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 0397afccf3a2..ed80c973f546 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3714,8 +3714,8 @@ static u32 bond_rr_gen_slave_id(struct bonding *bond) - static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev) - { - struct bonding *bond = netdev_priv(bond_dev); -- struct iphdr *iph = ip_hdr(skb); - struct slave *slave; -+ int slave_cnt; - u32 slave_id; - - /* Start with the curr_active_slave that joined the bond as the -@@ -3724,23 +3724,32 @@ static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev - * send the join/membership reports. The curr_active_slave found - * will send all of this type of traffic. - */ -- if (iph->protocol == IPPROTO_IGMP && skb->protocol == htons(ETH_P_IP)) { -- slave = rcu_dereference(bond->curr_active_slave); -- if (slave) -- bond_dev_queue_xmit(bond, skb, slave->dev); -- else -- bond_xmit_slave_id(bond, skb, 0); -- } else { -- int slave_cnt = ACCESS_ONCE(bond->slave_cnt); -+ if (skb->protocol == htons(ETH_P_IP)) { -+ int noff = skb_network_offset(skb); -+ struct iphdr *iph; - -- if (likely(slave_cnt)) { -- slave_id = bond_rr_gen_slave_id(bond); -- bond_xmit_slave_id(bond, skb, slave_id % slave_cnt); -- } else { -- bond_tx_drop(bond_dev, skb); -+ if (unlikely(!pskb_may_pull(skb, noff + sizeof(*iph)))) -+ goto non_igmp; -+ -+ iph = ip_hdr(skb); -+ if (iph->protocol == IPPROTO_IGMP) { -+ slave = rcu_dereference(bond->curr_active_slave); -+ if (slave) -+ bond_dev_queue_xmit(bond, skb, slave->dev); -+ else -+ bond_xmit_slave_id(bond, skb, 0); -+ return NETDEV_TX_OK; - } - } - -+non_igmp: -+ slave_cnt = ACCESS_ONCE(bond->slave_cnt); -+ if (likely(slave_cnt)) { -+ slave_id = bond_rr_gen_slave_id(bond); -+ bond_xmit_slave_id(bond, skb, slave_id % slave_cnt); -+ } else { -+ bond_tx_drop(bond_dev, skb); -+ } - return NETDEV_TX_OK; - } - -diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c -index 615c65da39be..055a4015ec3b 100644 ---- a/drivers/net/caif/caif_hsi.c -+++ b/drivers/net/caif/caif_hsi.c -@@ -1467,7 +1467,7 @@ static void __exit cfhsi_exit_module(void) - rtnl_lock(); - list_for_each_safe(list_node, n, &cfhsi_list) { - cfhsi = list_entry(list_node, struct cfhsi, list); -- unregister_netdev(cfhsi->ndev); -+ unregister_netdevice(cfhsi->ndev); - } - rtnl_unlock(); - } -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -index ebc4518d598a..4dc5e12dbfce 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -@@ -288,6 +288,9 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata) - hw_cons = le16_to_cpu(*txdata->tx_cons_sb); - sw_cons = txdata->tx_pkt_cons; - -+ /* Ensure subsequent loads occur after hw_cons */ -+ smp_rmb(); -+ - while (sw_cons != hw_cons) { - u16 pkt_cons; - -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 74dd48f2bd89..04fe570275cd 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -3090,39 +3090,42 @@ static void bcmgenet_timeout(struct net_device *dev) - netif_tx_wake_all_queues(dev); - } - --#define MAX_MC_COUNT 16 -+#define MAX_MDF_FILTER 17 - - static inline void bcmgenet_set_mdf_addr(struct bcmgenet_priv *priv, - unsigned char *addr, -- int *i, -- int *mc) -+ int *i) - { -- u32 reg; -- - bcmgenet_umac_writel(priv, addr[0] << 8 | addr[1], - UMAC_MDF_ADDR + (*i * 4)); - bcmgenet_umac_writel(priv, addr[2] << 24 | addr[3] << 16 | - addr[4] << 8 | addr[5], - UMAC_MDF_ADDR + ((*i + 1) * 4)); -- reg = bcmgenet_umac_readl(priv, UMAC_MDF_CTRL); -- reg |= (1 << (MAX_MC_COUNT - *mc)); -- bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL); - *i += 2; -- (*mc)++; - } - - static void bcmgenet_set_rx_mode(struct net_device *dev) - { - struct bcmgenet_priv *priv = netdev_priv(dev); - struct netdev_hw_addr *ha; -- int i, mc; -+ int i, nfilter; - u32 reg; - - netif_dbg(priv, hw, dev, "%s: %08X\n", __func__, dev->flags); - -- /* Promiscuous mode */ -+ /* Number of filters needed */ -+ nfilter = netdev_uc_count(dev) + netdev_mc_count(dev) + 2; -+ -+ /* -+ * Turn on promicuous mode for three scenarios -+ * 1. IFF_PROMISC flag is set -+ * 2. IFF_ALLMULTI flag is set -+ * 3. The number of filters needed exceeds the number filters -+ * supported by the hardware. -+ */ - reg = bcmgenet_umac_readl(priv, UMAC_CMD); -- if (dev->flags & IFF_PROMISC) { -+ if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) || -+ (nfilter > MAX_MDF_FILTER)) { - reg |= CMD_PROMISC; - bcmgenet_umac_writel(priv, reg, UMAC_CMD); - bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL); -@@ -3132,32 +3135,24 @@ static void bcmgenet_set_rx_mode(struct net_device *dev) - bcmgenet_umac_writel(priv, reg, UMAC_CMD); - } - -- /* UniMac doesn't support ALLMULTI */ -- if (dev->flags & IFF_ALLMULTI) { -- netdev_warn(dev, "ALLMULTI is not supported\n"); -- return; -- } -- - /* update MDF filter */ - i = 0; -- mc = 0; - /* Broadcast */ -- bcmgenet_set_mdf_addr(priv, dev->broadcast, &i, &mc); -+ bcmgenet_set_mdf_addr(priv, dev->broadcast, &i); - /* my own address.*/ -- bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i, &mc); -- /* Unicast list*/ -- if (netdev_uc_count(dev) > (MAX_MC_COUNT - mc)) -- return; -+ bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i); - -- if (!netdev_uc_empty(dev)) -- netdev_for_each_uc_addr(ha, dev) -- bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc); -- /* Multicast */ -- if (netdev_mc_empty(dev) || netdev_mc_count(dev) >= (MAX_MC_COUNT - mc)) -- return; -+ /* Unicast */ -+ netdev_for_each_uc_addr(ha, dev) -+ bcmgenet_set_mdf_addr(priv, ha->addr, &i); - -+ /* Multicast */ - netdev_for_each_mc_addr(ha, dev) -- bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc); -+ bcmgenet_set_mdf_addr(priv, ha->addr, &i); -+ -+ /* Enable filters */ -+ reg = GENMASK(MAX_MDF_FILTER - 1, MAX_MDF_FILTER - nfilter); -+ bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL); - } - - /* Set the hardware MAC address. */ -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index ae8e4fc22e7b..0ee164d09f39 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1699,10 +1699,10 @@ static void fec_get_mac(struct net_device *ndev) - */ - if (!is_valid_ether_addr(iap)) { - /* Report it and use a random ethernet address instead */ -- netdev_err(ndev, "Invalid MAC address: %pM\n", iap); -+ dev_err(&fep->pdev->dev, "Invalid MAC address: %pM\n", iap); - eth_hw_addr_random(ndev); -- netdev_info(ndev, "Using random MAC address: %pM\n", -- ndev->dev_addr); -+ dev_info(&fep->pdev->dev, "Using random MAC address: %pM\n", -+ ndev->dev_addr); - return; - } - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -index d681273bd39d..9d38634071a4 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c -@@ -3133,7 +3133,8 @@ static int ixgbe_get_module_info(struct net_device *dev, - page_swap = true; - } - -- if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap) { -+ if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap || -+ !(addr_mode & IXGBE_SFF_DDM_IMPLEMENTED)) { - /* We have a SFP, but it does not support SFF-8472 */ - modinfo->type = ETH_MODULE_SFF_8079; - modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN; -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -index 5abd66c84d00..7b7dc6d7d159 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h -@@ -70,6 +70,7 @@ - #define IXGBE_SFF_SOFT_RS_SELECT_10G 0x8 - #define IXGBE_SFF_SOFT_RS_SELECT_1G 0x0 - #define IXGBE_SFF_ADDRESSING_MODE 0x4 -+#define IXGBE_SFF_DDM_IMPLEMENTED 0x40 - #define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE 0x1 - #define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE 0x8 - #define IXGBE_SFF_QSFP_CONNECTOR_NOT_SEPARABLE 0x23 -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 5cc05df69a86..dcd72b2a3715 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -4939,6 +4939,13 @@ static const struct dmi_system_id msi_blacklist[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "P-79"), - }, - }, -+ { -+ .ident = "ASUS P6T", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "P6T"), -+ }, -+ }, - {} - }; - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -index 371a669d69fd..1df84c8de9d7 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -@@ -187,6 +187,12 @@ static void dwmac1000_set_filter(struct mac_device_info *hw, - GMAC_ADDR_LOW(reg)); - reg++; - } -+ -+ while (reg <= perfect_addr_number) { -+ writel(0, ioaddr + GMAC_ADDR_HIGH(reg)); -+ writel(0, ioaddr + GMAC_ADDR_LOW(reg)); -+ reg++; -+ } - } - - #ifdef FRAME_FILTER_DEBUG -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index 58ba579793f8..f1e969128a4e 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -613,6 +613,10 @@ static void axienet_start_xmit_done(struct net_device *ndev) - - ndev->stats.tx_packets += packets; - ndev->stats.tx_bytes += size; -+ -+ /* Matches barrier in axienet_start_xmit */ -+ smp_mb(); -+ - netif_wake_queue(ndev); - } - -@@ -667,9 +671,19 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) - cur_p = &lp->tx_bd_v[lp->tx_bd_tail]; - - if (axienet_check_tx_bd_space(lp, num_frag)) { -- if (!netif_queue_stopped(ndev)) -- netif_stop_queue(ndev); -- return NETDEV_TX_BUSY; -+ if (netif_queue_stopped(ndev)) -+ return NETDEV_TX_BUSY; -+ -+ netif_stop_queue(ndev); -+ -+ /* Matches barrier in axienet_start_xmit_done */ -+ smp_mb(); -+ -+ /* Space might have just been freed - check again */ -+ if (axienet_check_tx_bd_space(lp, num_frag)) -+ return NETDEV_TX_BUSY; -+ -+ netif_wake_queue(ndev); - } - - if (skb->ip_summed == CHECKSUM_PARTIAL) { -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 70f26b30729c..c6a87834723d 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -472,6 +472,9 @@ int phy_connect_direct(struct net_device *dev, struct phy_device *phydev, - { - int rc; - -+ if (!dev) -+ return -EINVAL; -+ - rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface); - if (rc) - return rc; -@@ -704,6 +707,9 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id, - struct device *d; - int rc; - -+ if (!dev) -+ return ERR_PTR(-EINVAL); -+ - /* Search the list of PHY devices on the mdio bus for the - * PHY with the requested name - */ -diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c -index 7b84d08a5154..12d6549e45a1 100644 ---- a/drivers/net/wireless/ath/ath10k/hw.c -+++ b/drivers/net/wireless/ath/ath10k/hw.c -@@ -128,7 +128,7 @@ const struct ath10k_hw_values qca6174_values = { - }; - - const struct ath10k_hw_values qca99x0_values = { -- .rtc_state_val_on = 5, -+ .rtc_state_val_on = 7, - .ce_count = 12, - .msi_assign_ce_max = 12, - .num_target_ce_config_wlan = 10, -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 398068ad0b62..5a0138c1c045 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -1502,6 +1502,10 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif) - if (arvif->vdev_type != WMI_VDEV_TYPE_AP) - return 0; - -+ /* For mesh, probe response and beacon share the same template */ -+ if (ieee80211_vif_is_mesh(vif)) -+ return 0; -+ - prb = ieee80211_proberesp_get(hw, vif); - if (!prb) { - ath10k_warn(ar, "failed to get probe resp template from mac80211\n"); -diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c -index a5e1de75a4a3..b2ec254f154e 100644 ---- a/drivers/net/wireless/ath/ath6kl/wmi.c -+++ b/drivers/net/wireless/ath/ath6kl/wmi.c -@@ -1178,6 +1178,10 @@ static int ath6kl_wmi_pstream_timeout_event_rx(struct wmi *wmi, u8 *datap, - return -EINVAL; - - ev = (struct wmi_pstream_timeout_event *) datap; -+ if (ev->traffic_class >= WMM_NUM_AC) { -+ ath6kl_err("invalid traffic class: %d\n", ev->traffic_class); -+ return -EINVAL; -+ } - - /* - * When the pstream (fat pipe == AC) timesout, it means there were -@@ -1519,6 +1523,10 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len, - return -EINVAL; - - reply = (struct wmi_cac_event *) datap; -+ if (reply->ac >= WMM_NUM_AC) { -+ ath6kl_err("invalid AC: %d\n", reply->ac); -+ return -EINVAL; -+ } - - if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) && - (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) { -@@ -2631,7 +2639,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, - u16 active_tsids = 0; - int ret; - -- if (traffic_class > 3) { -+ if (traffic_class >= WMM_NUM_AC) { - ath6kl_err("invalid traffic class: %d\n", traffic_class); - return -EINVAL; - } -diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c -index 4435c7bbb625..d50e2e8bd998 100644 ---- a/drivers/net/wireless/ath/ath9k/hw.c -+++ b/drivers/net/wireless/ath/ath9k/hw.c -@@ -250,8 +250,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah, - /* Chip Revisions */ - /******************/ - --static void ath9k_hw_read_revisions(struct ath_hw *ah) -+static bool ath9k_hw_read_revisions(struct ath_hw *ah) - { -+ u32 srev; - u32 val; - - if (ah->get_mac_revision) -@@ -267,25 +268,33 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah) - val = REG_READ(ah, AR_SREV); - ah->hw_version.macRev = MS(val, AR_SREV_REVISION2); - } -- return; -+ return true; - case AR9300_DEVID_AR9340: - ah->hw_version.macVersion = AR_SREV_VERSION_9340; -- return; -+ return true; - case AR9300_DEVID_QCA955X: - ah->hw_version.macVersion = AR_SREV_VERSION_9550; -- return; -+ return true; - case AR9300_DEVID_AR953X: - ah->hw_version.macVersion = AR_SREV_VERSION_9531; -- return; -+ return true; - case AR9300_DEVID_QCA956X: - ah->hw_version.macVersion = AR_SREV_VERSION_9561; -- return; -+ return true; - } - -- val = REG_READ(ah, AR_SREV) & AR_SREV_ID; -+ srev = REG_READ(ah, AR_SREV); -+ -+ if (srev == -EIO) { -+ ath_err(ath9k_hw_common(ah), -+ "Failed to read SREV register"); -+ return false; -+ } -+ -+ val = srev & AR_SREV_ID; - - if (val == 0xFF) { -- val = REG_READ(ah, AR_SREV); -+ val = srev; - ah->hw_version.macVersion = - (val & AR_SREV_VERSION2) >> AR_SREV_TYPE2_S; - ah->hw_version.macRev = MS(val, AR_SREV_REVISION2); -@@ -304,6 +313,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah) - if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCIE) - ah->is_pciexpress = true; - } -+ -+ return true; - } - - /************************************/ -@@ -556,7 +567,10 @@ static int __ath9k_hw_init(struct ath_hw *ah) - struct ath_common *common = ath9k_hw_common(ah); - int r = 0; - -- ath9k_hw_read_revisions(ah); -+ if (!ath9k_hw_read_revisions(ah)) { -+ ath_err(common, "Could not read hardware revisions"); -+ return -EOPNOTSUPP; -+ } - - switch (ah->hw_version.macVersion) { - case AR_SREV_VERSION_5416_PCI: -diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c -index 2303ef96299d..0835828ffed7 100644 ---- a/drivers/net/wireless/ath/dfs_pattern_detector.c -+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c -@@ -111,7 +111,7 @@ static const struct radar_detector_specs jp_radar_ref_types[] = { - JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18, 29, false), - JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18, 29, false), - JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18, 50, false), -- JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18, 50, false), -+ JP_PATTERN(3, 0, 4, 4000, 4000, 1, 18, 50, false), - JP_PATTERN(4, 0, 5, 150, 230, 1, 23, 50, false), - JP_PATTERN(5, 6, 10, 200, 500, 1, 16, 50, false), - JP_PATTERN(6, 11, 20, 200, 500, 1, 12, 50, false), -diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c -index 57a80cfa39b1..3d0b9324d5bf 100644 ---- a/drivers/net/wireless/mediatek/mt7601u/dma.c -+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c -@@ -193,10 +193,23 @@ static void mt7601u_complete_rx(struct urb *urb) - struct mt7601u_rx_queue *q = &dev->rx_q; - unsigned long flags; - -- spin_lock_irqsave(&dev->rx_lock, flags); -+ /* do no schedule rx tasklet if urb has been unlinked -+ * or the device has been removed -+ */ -+ switch (urb->status) { -+ case -ECONNRESET: -+ case -ESHUTDOWN: -+ case -ENOENT: -+ return; -+ default: -+ dev_err_ratelimited(dev->dev, "rx urb failed: %d\n", -+ urb->status); -+ /* fall through */ -+ case 0: -+ break; -+ } - -- if (mt7601u_urb_has_error(urb)) -- dev_err(dev->dev, "Error: RX urb failed:%d\n", urb->status); -+ spin_lock_irqsave(&dev->rx_lock, flags); - if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch")) - goto out; - -@@ -228,14 +241,25 @@ static void mt7601u_complete_tx(struct urb *urb) - struct sk_buff *skb; - unsigned long flags; - -- spin_lock_irqsave(&dev->tx_lock, flags); -+ switch (urb->status) { -+ case -ECONNRESET: -+ case -ESHUTDOWN: -+ case -ENOENT: -+ return; -+ default: -+ dev_err_ratelimited(dev->dev, "tx urb failed: %d\n", -+ urb->status); -+ /* fall through */ -+ case 0: -+ break; -+ } - -- if (mt7601u_urb_has_error(urb)) -- dev_err(dev->dev, "Error: TX urb failed:%d\n", urb->status); -+ spin_lock_irqsave(&dev->tx_lock, flags); - if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch")) - goto out; - - skb = q->e[q->start].skb; -+ q->e[q->start].skb = NULL; - trace_mt_tx_dma_done(dev, skb); - - __skb_queue_tail(&dev->tx_skb_done, skb); -@@ -363,19 +387,9 @@ int mt7601u_dma_enqueue_tx(struct mt7601u_dev *dev, struct sk_buff *skb, - static void mt7601u_kill_rx(struct mt7601u_dev *dev) - { - int i; -- unsigned long flags; -- -- spin_lock_irqsave(&dev->rx_lock, flags); -- -- for (i = 0; i < dev->rx_q.entries; i++) { -- int next = dev->rx_q.end; - -- spin_unlock_irqrestore(&dev->rx_lock, flags); -- usb_poison_urb(dev->rx_q.e[next].urb); -- spin_lock_irqsave(&dev->rx_lock, flags); -- } -- -- spin_unlock_irqrestore(&dev->rx_lock, flags); -+ for (i = 0; i < dev->rx_q.entries; i++) -+ usb_poison_urb(dev->rx_q.e[i].urb); - } - - static int mt7601u_submit_rx_buf(struct mt7601u_dev *dev, -@@ -445,10 +459,10 @@ static void mt7601u_free_tx_queue(struct mt7601u_tx_queue *q) - { - int i; - -- WARN_ON(q->used); -- - for (i = 0; i < q->entries; i++) { - usb_poison_urb(q->e[i].urb); -+ if (q->e[i].skb) -+ mt7601u_tx_status(q->dev, q->e[i].skb); - usb_free_urb(q->e[i].urb); - } - } -diff --git a/drivers/net/wireless/mediatek/mt7601u/tx.c b/drivers/net/wireless/mediatek/mt7601u/tx.c -index a0a33dc8f6bc..a1b6db2a8937 100644 ---- a/drivers/net/wireless/mediatek/mt7601u/tx.c -+++ b/drivers/net/wireless/mediatek/mt7601u/tx.c -@@ -117,9 +117,9 @@ void mt7601u_tx_status(struct mt7601u_dev *dev, struct sk_buff *skb) - info->status.rates[0].idx = -1; - info->flags |= IEEE80211_TX_STAT_ACK; - -- spin_lock(&dev->mac_lock); -+ spin_lock_bh(&dev->mac_lock); - ieee80211_tx_status(dev->hw, skb); -- spin_unlock(&dev->mac_lock); -+ spin_unlock_bh(&dev->mac_lock); - } - - static int mt7601u_skb_rooms(struct mt7601u_dev *dev, struct sk_buff *skb) -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 5fb4ed6ea322..6ac6618c1c10 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -371,7 +371,7 @@ static ssize_t remove_store(struct device *dev, struct device_attribute *attr, - pci_stop_and_remove_bus_device_locked(to_pci_dev(dev)); - return count; - } --static struct device_attribute dev_remove_attr = __ATTR(remove, -+static struct device_attribute dev_remove_attr = __ATTR_IGNORE_LOCKDEP(remove, - (S_IWUSR|S_IWGRP), - NULL, remove_store); - -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 5073ab023123..82b0c2cc2fd3 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1736,6 +1736,13 @@ static void pci_pme_list_scan(struct work_struct *work) - */ - if (bridge && bridge->current_state != PCI_D0) - continue; -+ /* -+ * If the device is in D3cold it should not be -+ * polled either. -+ */ -+ if (pme_dev->dev->current_state == PCI_D3cold) -+ continue; -+ - pci_pme_wakeup(pme_dev->dev, NULL); - } else { - list_del(&pme_dev->list); -diff --git a/drivers/phy/phy-rcar-gen2.c b/drivers/phy/phy-rcar-gen2.c -index c7a05996d5c1..99d2b73654f4 100644 ---- a/drivers/phy/phy-rcar-gen2.c -+++ b/drivers/phy/phy-rcar-gen2.c -@@ -287,6 +287,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev) - error = of_property_read_u32(np, "reg", &channel_num); - if (error || channel_num > 2) { - dev_err(dev, "Invalid \"reg\" property\n"); -+ of_node_put(np); - return error; - } - channel->select_mask = select_mask[channel_num]; -@@ -302,6 +303,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev) - &rcar_gen2_phy_ops); - if (IS_ERR(phy->phy)) { - dev_err(dev, "Failed to create PHY\n"); -+ of_node_put(np); - return PTR_ERR(phy->phy); - } - phy_set_drvdata(phy->phy, phy); -diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c -index a0651128e23a..616055b5e996 100644 ---- a/drivers/pinctrl/pinctrl-rockchip.c -+++ b/drivers/pinctrl/pinctrl-rockchip.c -@@ -1837,6 +1837,7 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank, - base, - &rockchip_regmap_config); - } -+ of_node_put(node); - } - - bank->irq = irq_of_parse_and_map(bank->of_node, 0); -diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c -index 2f07cd615665..76ae38450aea 100644 ---- a/drivers/pps/pps.c -+++ b/drivers/pps/pps.c -@@ -129,6 +129,14 @@ static long pps_cdev_ioctl(struct file *file, - pps->params.mode |= PPS_CANWAIT; - pps->params.api_version = PPS_API_VERS; - -+ /* -+ * Clear unused fields of pps_kparams to avoid leaking -+ * uninitialized data of the PPS_SETPARAMS caller via -+ * PPS_GETPARAMS -+ */ -+ pps->params.assert_off_tu.flags = 0; -+ pps->params.clear_off_tu.flags = 0; -+ - spin_unlock_irq(&pps->lock); - - break; -diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c -index 47694dd515ab..fa3a1243ff09 100644 ---- a/drivers/regulator/s2mps11.c -+++ b/drivers/regulator/s2mps11.c -@@ -382,8 +382,8 @@ static const struct regulator_desc s2mps11_regulators[] = { - regulator_desc_s2mps11_buck1_4(4), - regulator_desc_s2mps11_buck5, - regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV), -- regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV), -- regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV), -+ regulator_desc_s2mps11_buck67810(7, MIN_750_MV, STEP_12_5_MV), -+ regulator_desc_s2mps11_buck67810(8, MIN_750_MV, STEP_12_5_MV), - regulator_desc_s2mps11_buck9, - regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), - }; -diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c -index d64b401f3d05..8d7fc3b6ca63 100644 ---- a/drivers/s390/cio/qdio_main.c -+++ b/drivers/s390/cio/qdio_main.c -@@ -752,6 +752,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q) - - switch (state) { - case SLSB_P_OUTPUT_EMPTY: -+ case SLSB_P_OUTPUT_PENDING: - /* the adapter got it */ - DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, - "out empty:%1d %02x", q->nr, count); -diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c -index 0fdff91624fd..43474f562b43 100644 ---- a/drivers/staging/media/davinci_vpfe/vpfe_video.c -+++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c -@@ -406,6 +406,9 @@ static int vpfe_open(struct file *file) - /* If decoder is not initialized. initialize it */ - if (!video->initialized && vpfe_update_pipe_state(video)) { - mutex_unlock(&video->lock); -+ v4l2_fh_del(&handle->vfh); -+ v4l2_fh_exit(&handle->vfh); -+ kfree(handle); - return -ENODEV; - } - /* Increment device users counter */ -diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c -index 0040c29f651a..b9e137c03fe3 100644 ---- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c -+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c -@@ -421,7 +421,16 @@ static int cpm_uart_startup(struct uart_port *port) - clrbits16(&pinfo->sccp->scc_sccm, UART_SCCM_RX); - } - cpm_uart_initbd(pinfo); -- cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX); -+ if (IS_SMC(pinfo)) { -+ out_be32(&pinfo->smcup->smc_rstate, 0); -+ out_be32(&pinfo->smcup->smc_tstate, 0); -+ out_be16(&pinfo->smcup->smc_rbptr, -+ in_be16(&pinfo->smcup->smc_rbase)); -+ out_be16(&pinfo->smcup->smc_tbptr, -+ in_be16(&pinfo->smcup->smc_tbase)); -+ } else { -+ cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX); -+ } - } - /* Install interrupt handler. */ - retval = request_irq(port->irq, cpm_uart_int, 0, "cpm_uart", port); -@@ -875,16 +884,14 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo) - (u8 __iomem *)pinfo->tx_bd_base - DPRAM_BASE); - - /* -- * In case SMC1 is being relocated... -+ * In case SMC is being relocated... - */ --#if defined (CONFIG_I2C_SPI_SMC1_UCODE_PATCH) - out_be16(&up->smc_rbptr, in_be16(&pinfo->smcup->smc_rbase)); - out_be16(&up->smc_tbptr, in_be16(&pinfo->smcup->smc_tbase)); - out_be32(&up->smc_rstate, 0); - out_be32(&up->smc_tstate, 0); - out_be16(&up->smc_brkcr, 1); /* number of break chars */ - out_be16(&up->smc_brkec, 0); --#endif - - /* Set up the uart parameters in the - * parameter ram. -@@ -898,8 +905,6 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo) - out_be16(&up->smc_brkec, 0); - out_be16(&up->smc_brkcr, 1); - -- cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX); -- - /* Set UART mode, 8 bit, no parity, one stop. - * Enable receive and transmit. - */ -diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c -index a80cdad114f3..d8cb94997487 100644 ---- a/drivers/tty/serial/digicolor-usart.c -+++ b/drivers/tty/serial/digicolor-usart.c -@@ -544,7 +544,11 @@ static int __init digicolor_uart_init(void) - if (ret) - return ret; - -- return platform_driver_register(&digicolor_uart_platform); -+ ret = platform_driver_register(&digicolor_uart_platform); -+ if (ret) -+ uart_unregister_driver(&digicolor_uart); -+ -+ return ret; - } - module_init(digicolor_uart_init); - -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index 0ac0c618954e..a66fb7afecc7 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -486,37 +486,48 @@ static bool max310x_reg_precious(struct device *dev, unsigned int reg) - - static int max310x_set_baud(struct uart_port *port, int baud) - { -- unsigned int mode = 0, clk = port->uartclk, div = clk / baud; -+ unsigned int mode = 0, div = 0, frac = 0, c = 0, F = 0; - -- /* Check for minimal value for divider */ -- if (div < 16) -- div = 16; -- -- if (clk % baud && (div / 16) < 0x8000) { -+ /* -+ * Calculate the integer divisor first. Select a proper mode -+ * in case if the requested baud is too high for the pre-defined -+ * clocks frequency. -+ */ -+ div = port->uartclk / baud; -+ if (div < 8) { -+ /* Mode x4 */ -+ c = 4; -+ mode = MAX310X_BRGCFG_4XMODE_BIT; -+ } else if (div < 16) { - /* Mode x2 */ -+ c = 8; - mode = MAX310X_BRGCFG_2XMODE_BIT; -- clk = port->uartclk * 2; -- div = clk / baud; -- -- if (clk % baud && (div / 16) < 0x8000) { -- /* Mode x4 */ -- mode = MAX310X_BRGCFG_4XMODE_BIT; -- clk = port->uartclk * 4; -- div = clk / baud; -- } -+ } else { -+ c = 16; - } - -- max310x_port_write(port, MAX310X_BRGDIVMSB_REG, (div / 16) >> 8); -- max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div / 16); -- max310x_port_write(port, MAX310X_BRGCFG_REG, (div % 16) | mode); -+ /* Calculate the divisor in accordance with the fraction coefficient */ -+ div /= c; -+ F = c*baud; -+ -+ /* Calculate the baud rate fraction */ -+ if (div > 0) -+ frac = (16*(port->uartclk % F)) / F; -+ else -+ div = 1; -+ -+ max310x_port_write(port, MAX310X_BRGDIVMSB_REG, div >> 8); -+ max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div); -+ max310x_port_write(port, MAX310X_BRGCFG_REG, frac | mode); - -- return DIV_ROUND_CLOSEST(clk, div); -+ /* Return the actual baud rate we just programmed */ -+ return (16*port->uartclk) / (c*(16*div + frac)); - } - - static int max310x_update_best_err(unsigned long f, long *besterr) - { - /* Use baudrate 115200 for calculate error */ -- long err = f % (115200 * 16); -+ long err = f % (460800 * 16); - - if ((*besterr < 0) || (*besterr > err)) { - *besterr = err; -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index 5f0ded6fc4e9..eaeb098b5d6a 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -222,10 +222,14 @@ no_rx: - - static inline void msm_wait_for_xmitr(struct uart_port *port) - { -+ unsigned int timeout = 500000; -+ - while (!(msm_read(port, UART_SR) & UART_SR_TX_EMPTY)) { - if (msm_read(port, UART_ISR) & UART_ISR_TX_READY) - break; - udelay(1); -+ if (!timeout--) -+ break; - } - msm_write(port, UART_CR_CMD_RESET_TX_READY, UART_CR); - } -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 669134e27ed9..c450e32c153d 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -1203,6 +1203,7 @@ static void work_fn_tx(struct work_struct *work) - struct uart_port *port = &s->port; - struct circ_buf *xmit = &port->state->xmit; - dma_addr_t buf; -+ int head, tail; - - /* - * DMA is idle now. -@@ -1212,16 +1213,23 @@ static void work_fn_tx(struct work_struct *work) - * consistent xmit buffer state. - */ - spin_lock_irq(&port->lock); -- buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1)); -+ head = xmit->head; -+ tail = xmit->tail; -+ buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1)); - s->tx_dma_len = min_t(unsigned int, -- CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE), -- CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE)); -- spin_unlock_irq(&port->lock); -+ CIRC_CNT(head, tail, UART_XMIT_SIZE), -+ CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE)); -+ if (!s->tx_dma_len) { -+ /* Transmit buffer has been flushed */ -+ spin_unlock_irq(&port->lock); -+ return; -+ } - - desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len, - DMA_MEM_TO_DEV, - DMA_PREP_INTERRUPT | DMA_CTRL_ACK); - if (!desc) { -+ spin_unlock_irq(&port->lock); - dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n"); - /* switch to PIO */ - sci_tx_dma_release(s, true); -@@ -1231,20 +1239,20 @@ static void work_fn_tx(struct work_struct *work) - dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len, - DMA_TO_DEVICE); - -- spin_lock_irq(&port->lock); - desc->callback = sci_dma_tx_complete; - desc->callback_param = s; -- spin_unlock_irq(&port->lock); - s->cookie_tx = dmaengine_submit(desc); - if (dma_submit_error(s->cookie_tx)) { -+ spin_unlock_irq(&port->lock); - dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n"); - /* switch to PIO */ - sci_tx_dma_release(s, true); - return; - } - -+ spin_unlock_irq(&port->lock); - dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n", -- __func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx); -+ __func__, xmit->buf, tail, head, s->cookie_tx); - - dma_async_issue_pending(chan); - } -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 6e307de25163..5c274c5440da 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -3479,6 +3479,7 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port, - struct usb_device *hdev; - struct usb_device *udev; - int connect_change = 0; -+ u16 link_state; - int ret; - - hdev = hub->hdev; -@@ -3488,9 +3489,11 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port, - return 0; - usb_clear_port_feature(hdev, port, USB_PORT_FEAT_C_SUSPEND); - } else { -+ link_state = portstatus & USB_PORT_STAT_LINK_STATE; - if (!udev || udev->state != USB_STATE_SUSPENDED || -- (portstatus & USB_PORT_STAT_LINK_STATE) != -- USB_SS_PORT_LS_U0) -+ (link_state != USB_SS_PORT_LS_U0 && -+ link_state != USB_SS_PORT_LS_U1 && -+ link_state != USB_SS_PORT_LS_U2)) - return 0; - } - -@@ -3820,6 +3823,9 @@ static int usb_set_lpm_timeout(struct usb_device *udev, - * control transfers to set the hub timeout or enable device-initiated U1/U2 - * will be successful. - * -+ * If the control transfer to enable device-initiated U1/U2 entry fails, then -+ * hub-initiated U1/U2 will be disabled. -+ * - * If we cannot set the parent hub U1/U2 timeout, we attempt to let the xHCI - * driver know about it. If that call fails, it should be harmless, and just - * take up more slightly more bus bandwidth for unnecessary U1/U2 exit latency. -@@ -3874,23 +3880,24 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev, - * host know that this link state won't be enabled. - */ - hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state); -- } else { -- /* Only a configured device will accept the Set Feature -- * U1/U2_ENABLE -- */ -- if (udev->actconfig) -- usb_set_device_initiated_lpm(udev, state, true); -+ return; -+ } - -- /* As soon as usb_set_lpm_timeout(timeout) returns 0, the -- * hub-initiated LPM is enabled. Thus, LPM is enabled no -- * matter the result of usb_set_device_initiated_lpm(). -- * The only difference is whether device is able to initiate -- * LPM. -- */ -+ /* Only a configured device will accept the Set Feature -+ * U1/U2_ENABLE -+ */ -+ if (udev->actconfig && -+ usb_set_device_initiated_lpm(udev, state, true) == 0) { - if (state == USB3_LPM_U1) - udev->usb3_lpm_u1_enabled = 1; - else if (state == USB3_LPM_U2) - udev->usb3_lpm_u2_enabled = 1; -+ } else { -+ /* Don't request U1/U2 entry if the device -+ * cannot transition to U1/U2. -+ */ -+ usb_set_lpm_timeout(udev, state, 0); -+ hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state); - } - } - -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 4800bb22cdd6..4cb1355271ec 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -912,11 +912,12 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) - ENTER(); - - if (!is_sync_kiocb(kiocb)) { -- p = kmalloc(sizeof(io_data), GFP_KERNEL); -+ p = kzalloc(sizeof(io_data), GFP_KERNEL); - if (unlikely(!p)) - return -ENOMEM; - p->aio = true; - } else { -+ memset(p, 0, sizeof(*p)); - p->aio = false; - } - -@@ -948,11 +949,12 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) - ENTER(); - - if (!is_sync_kiocb(kiocb)) { -- p = kmalloc(sizeof(io_data), GFP_KERNEL); -+ p = kzalloc(sizeof(io_data), GFP_KERNEL); - if (unlikely(!p)) - return -ENOMEM; - p->aio = true; - } else { -+ memset(p, 0, sizeof(*p)); - p->aio = false; - } - -diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c -index 97750f162f01..c14e4a64b0e8 100644 ---- a/drivers/usb/host/hwa-hc.c -+++ b/drivers/usb/host/hwa-hc.c -@@ -173,7 +173,7 @@ out: - return result; - - error_set_cluster_id: -- wusb_cluster_id_put(wusbhc->cluster_id); -+ wusb_cluster_id_put(addr); - error_cluster_id_get: - goto out; - -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index 89e9494c3245..3ea435c2d1b7 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -178,7 +178,7 @@ int usb_amd_find_chipset_info(void) - { - unsigned long flags; - struct amd_chipset_info info; -- int ret; -+ int need_pll_quirk = 0; - - spin_lock_irqsave(&amd_lock, flags); - -@@ -192,21 +192,28 @@ int usb_amd_find_chipset_info(void) - spin_unlock_irqrestore(&amd_lock, flags); - - if (!amd_chipset_sb_type_init(&info)) { -- ret = 0; - goto commit; - } - -- /* Below chipset generations needn't enable AMD PLL quirk */ -- if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN || -- info.sb_type.gen == AMD_CHIPSET_SB600 || -- info.sb_type.gen == AMD_CHIPSET_YANGTZE || -- (info.sb_type.gen == AMD_CHIPSET_SB700 && -- info.sb_type.rev > 0x3b)) { -+ switch (info.sb_type.gen) { -+ case AMD_CHIPSET_SB700: -+ need_pll_quirk = info.sb_type.rev <= 0x3B; -+ break; -+ case AMD_CHIPSET_SB800: -+ case AMD_CHIPSET_HUDSON2: -+ case AMD_CHIPSET_BOLTON: -+ need_pll_quirk = 1; -+ break; -+ default: -+ need_pll_quirk = 0; -+ break; -+ } -+ -+ if (!need_pll_quirk) { - if (info.smbus_dev) { - pci_dev_put(info.smbus_dev); - info.smbus_dev = NULL; - } -- ret = 0; - goto commit; - } - -@@ -225,7 +232,7 @@ int usb_amd_find_chipset_info(void) - } - } - -- ret = info.probe_result = 1; -+ need_pll_quirk = info.probe_result = 1; - printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n"); - - commit: -@@ -236,7 +243,7 @@ commit: - - /* Mark that we where here */ - amd_chipset.probe_count++; -- ret = amd_chipset.probe_result; -+ need_pll_quirk = amd_chipset.probe_result; - - spin_unlock_irqrestore(&amd_lock, flags); - -@@ -250,7 +257,7 @@ commit: - spin_unlock_irqrestore(&amd_lock, flags); - } - -- return ret; -+ return need_pll_quirk; - } - EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info); - -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index 645b2197930e..f46317135224 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -30,7 +30,7 @@ - - #include "vhost.h" - --static int experimental_zcopytx = 1; -+static int experimental_zcopytx = 0; - module_param(experimental_zcopytx, int, 0444); - MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;" - " 1 -Enable; 0 - Disable"); -diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c -index e9e04376c52c..e80ad0c7c2a9 100644 ---- a/fs/9p/vfs_addr.c -+++ b/fs/9p/vfs_addr.c -@@ -49,8 +49,9 @@ - * @page: structure to page - * - */ --static int v9fs_fid_readpage(struct p9_fid *fid, struct page *page) -+static int v9fs_fid_readpage(void *data, struct page *page) - { -+ struct p9_fid *fid = data; - struct inode *inode = page->mapping->host; - struct bio_vec bvec = {.bv_page = page, .bv_len = PAGE_SIZE}; - struct iov_iter to; -@@ -121,7 +122,8 @@ static int v9fs_vfs_readpages(struct file *filp, struct address_space *mapping, - if (ret == 0) - return ret; - -- ret = read_cache_pages(mapping, pages, (void *)v9fs_vfs_readpage, filp); -+ ret = read_cache_pages(mapping, pages, v9fs_fid_readpage, -+ filp->private_data); - p9_debug(P9_DEBUG_VFS, " = %d\n", ret); - return ret; - } -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index e7b54514d99a..e137ff6cd9da 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -1072,20 +1072,23 @@ static int send_cap_msg(struct ceph_mds_session *session, - } - - /* -- * Queue cap releases when an inode is dropped from our cache. Since -- * inode is about to be destroyed, there is no need for i_ceph_lock. -+ * Queue cap releases when an inode is dropped from our cache. - */ - void ceph_queue_caps_release(struct inode *inode) - { - struct ceph_inode_info *ci = ceph_inode(inode); - struct rb_node *p; - -+ /* lock i_ceph_lock, because ceph_d_revalidate(..., LOOKUP_RCU) -+ * may call __ceph_caps_issued_mask() on a freeing inode. */ -+ spin_lock(&ci->i_ceph_lock); - p = rb_first(&ci->i_caps); - while (p) { - struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node); - p = rb_next(p); - __ceph_remove_cap(cap, true); - } -+ spin_unlock(&ci->i_ceph_lock); - } - - /* -diff --git a/fs/coda/file.c b/fs/coda/file.c -index 1da3805f3ddc..cbbd76f4098e 100644 ---- a/fs/coda/file.c -+++ b/fs/coda/file.c -@@ -81,6 +81,41 @@ coda_file_write_iter(struct kiocb *iocb, struct iov_iter *to) - return ret; - } - -+struct coda_vm_ops { -+ atomic_t refcnt; -+ struct file *coda_file; -+ const struct vm_operations_struct *host_vm_ops; -+ struct vm_operations_struct vm_ops; -+}; -+ -+static void -+coda_vm_open(struct vm_area_struct *vma) -+{ -+ struct coda_vm_ops *cvm_ops = -+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops); -+ -+ atomic_inc(&cvm_ops->refcnt); -+ -+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open) -+ cvm_ops->host_vm_ops->open(vma); -+} -+ -+static void -+coda_vm_close(struct vm_area_struct *vma) -+{ -+ struct coda_vm_ops *cvm_ops = -+ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops); -+ -+ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close) -+ cvm_ops->host_vm_ops->close(vma); -+ -+ if (atomic_dec_and_test(&cvm_ops->refcnt)) { -+ vma->vm_ops = cvm_ops->host_vm_ops; -+ fput(cvm_ops->coda_file); -+ kfree(cvm_ops); -+ } -+} -+ - static int - coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) - { -@@ -88,6 +123,8 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) - struct coda_inode_info *cii; - struct file *host_file; - struct inode *coda_inode, *host_inode; -+ struct coda_vm_ops *cvm_ops; -+ int ret; - - cfi = CODA_FTOC(coda_file); - BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC); -@@ -96,6 +133,13 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) - if (!host_file->f_op->mmap) - return -ENODEV; - -+ if (WARN_ON(coda_file != vma->vm_file)) -+ return -EIO; -+ -+ cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL); -+ if (!cvm_ops) -+ return -ENOMEM; -+ - coda_inode = file_inode(coda_file); - host_inode = file_inode(host_file); - -@@ -109,6 +153,7 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) - * the container file on us! */ - else if (coda_inode->i_mapping != host_inode->i_mapping) { - spin_unlock(&cii->c_lock); -+ kfree(cvm_ops); - return -EBUSY; - } - -@@ -117,7 +162,29 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma) - cfi->cfi_mapcount++; - spin_unlock(&cii->c_lock); - -- return host_file->f_op->mmap(host_file, vma); -+ vma->vm_file = get_file(host_file); -+ ret = host_file->f_op->mmap(host_file, vma); -+ -+ if (ret) { -+ /* if call_mmap fails, our caller will put coda_file so we -+ * should drop the reference to the host_file that we got. -+ */ -+ fput(host_file); -+ kfree(cvm_ops); -+ } else { -+ /* here we add redirects for the open/close vm_operations */ -+ cvm_ops->host_vm_ops = vma->vm_ops; -+ if (vma->vm_ops) -+ cvm_ops->vm_ops = *vma->vm_ops; -+ -+ cvm_ops->vm_ops.open = coda_vm_open; -+ cvm_ops->vm_ops.close = coda_vm_close; -+ cvm_ops->coda_file = coda_file; -+ atomic_set(&cvm_ops->refcnt, 1); -+ -+ vma->vm_ops = &cvm_ops->vm_ops; -+ } -+ return ret; - } - - int coda_open(struct inode *coda_inode, struct file *coda_file) -diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c -index 80d6901493cf..f246f1760ba2 100644 ---- a/fs/ecryptfs/crypto.c -+++ b/fs/ecryptfs/crypto.c -@@ -1041,8 +1041,10 @@ int ecryptfs_read_and_validate_header_region(struct inode *inode) - - rc = ecryptfs_read_lower(file_size, 0, ECRYPTFS_SIZE_AND_MARKER_BYTES, - inode); -- if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES) -- return rc >= 0 ? -EINVAL : rc; -+ if (rc < 0) -+ return rc; -+ else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES) -+ return -EINVAL; - rc = ecryptfs_validate_marker(marker); - if (!rc) - ecryptfs_i_size_init(file_size, inode); -@@ -1400,8 +1402,10 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry, - rc = ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), - ECRYPTFS_XATTR_NAME, file_size, - ECRYPTFS_SIZE_AND_MARKER_BYTES); -- if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES) -- return rc >= 0 ? -EINVAL : rc; -+ if (rc < 0) -+ return rc; -+ else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES) -+ return -EINVAL; - rc = ecryptfs_validate_marker(marker); - if (!rc) - ecryptfs_i_size_init(file_size, inode); -diff --git a/fs/exec.c b/fs/exec.c -index 3dad755b7048..bb70472d7cee 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1642,7 +1642,7 @@ static int do_execveat_common(int fd, struct filename *filename, - current->fs->in_exec = 0; - current->in_execve = 0; - acct_update_integrals(current); -- task_numa_free(current); -+ task_numa_free(current, false); - free_bprm(bprm); - kfree(pathbuf); - putname(filename); -diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c -index 6802cd754eda..014bee5c0e75 100644 ---- a/fs/f2fs/segment.c -+++ b/fs/f2fs/segment.c -@@ -1510,6 +1510,11 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi) - seg_i = CURSEG_I(sbi, i); - segno = le32_to_cpu(ckpt->cur_data_segno[i]); - blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]); -+ if (blk_off > ENTRIES_IN_SUM) { -+ f2fs_bug_on(sbi, 1); -+ f2fs_put_page(page, 1); -+ return -EFAULT; -+ } - seg_i->next_segno = segno; - reset_curseg(sbi, i, 0); - seg_i->alloc_type = ckpt->alloc_type[i]; -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index 668ac19af58f..d25b55ceb9d5 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -935,6 +935,7 @@ int nfs_open(struct inode *inode, struct file *filp) - nfs_fscache_open_file(inode, filp); - return 0; - } -+EXPORT_SYMBOL_GPL(nfs_open); - - /* - * This function is called whenever some part of NFS notices that -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index 679e003818b1..d3e3761eacfa 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) - return err; - - if ((openflags & O_ACCMODE) == 3) -- openflags--; -+ return nfs_open(inode, filp); - - /* We can't create new files here */ - openflags &= ~(O_CREAT|O_EXCL); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 41c8ddbc80dc..d1816ee0c11b 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -997,6 +997,12 @@ struct nfs4_opendata { - int cancelled; - }; - -+struct nfs4_open_createattrs { -+ struct nfs4_label *label; -+ struct iattr *sattr; -+ const __u32 verf[2]; -+}; -+ - static bool nfs4_clear_cap_atomic_open_v1(struct nfs_server *server, - int err, struct nfs4_exception *exception) - { -@@ -1066,8 +1072,7 @@ static void nfs4_init_opendata_res(struct nfs4_opendata *p) - - static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry, - struct nfs4_state_owner *sp, fmode_t fmode, int flags, -- const struct iattr *attrs, -- struct nfs4_label *label, -+ const struct nfs4_open_createattrs *c, - enum open_claim_type4 claim, - gfp_t gfp_mask) - { -@@ -1075,6 +1080,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry, - struct inode *dir = d_inode(parent); - struct nfs_server *server = NFS_SERVER(dir); - struct nfs_seqid *(*alloc_seqid)(struct nfs_seqid_counter *, gfp_t); -+ struct nfs4_label *label = (c != NULL) ? c->label : NULL; - struct nfs4_opendata *p; - - p = kzalloc(sizeof(*p), gfp_mask); -@@ -1131,15 +1137,11 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry, - case NFS4_OPEN_CLAIM_DELEG_PREV_FH: - p->o_arg.fh = NFS_FH(d_inode(dentry)); - } -- if (attrs != NULL && attrs->ia_valid != 0) { -- __u32 verf[2]; -- -+ if (c != NULL && c->sattr != NULL && c->sattr->ia_valid != 0) { - p->o_arg.u.attrs = &p->attrs; -- memcpy(&p->attrs, attrs, sizeof(p->attrs)); -+ memcpy(&p->attrs, c->sattr, sizeof(p->attrs)); - -- verf[0] = jiffies; -- verf[1] = current->pid; -- memcpy(p->o_arg.u.verifier.data, verf, -+ memcpy(p->o_arg.u.verifier.data, c->verf, - sizeof(p->o_arg.u.verifier.data)); - } - p->c_arg.fh = &p->o_res.fh; -@@ -1653,7 +1655,7 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context - struct nfs4_opendata *opendata; - - opendata = nfs4_opendata_alloc(ctx->dentry, state->owner, 0, 0, -- NULL, NULL, claim, GFP_NOFS); -+ NULL, claim, GFP_NOFS); - if (opendata == NULL) - return ERR_PTR(-ENOMEM); - opendata->state = state; -@@ -2488,8 +2490,7 @@ out: - static int _nfs4_do_open(struct inode *dir, - struct nfs_open_context *ctx, - int flags, -- struct iattr *sattr, -- struct nfs4_label *label, -+ const struct nfs4_open_createattrs *c, - int *opened) - { - struct nfs4_state_owner *sp; -@@ -2501,6 +2502,8 @@ static int _nfs4_do_open(struct inode *dir, - struct nfs4_threshold **ctx_th = &ctx->mdsthreshold; - fmode_t fmode = ctx->mode & (FMODE_READ|FMODE_WRITE|FMODE_EXEC); - enum open_claim_type4 claim = NFS4_OPEN_CLAIM_NULL; -+ struct iattr *sattr = c->sattr; -+ struct nfs4_label *label = c->label; - struct nfs4_label *olabel = NULL; - int status; - -@@ -2519,8 +2522,8 @@ static int _nfs4_do_open(struct inode *dir, - status = -ENOMEM; - if (d_really_is_positive(dentry)) - claim = NFS4_OPEN_CLAIM_FH; -- opendata = nfs4_opendata_alloc(dentry, sp, fmode, flags, sattr, -- label, claim, GFP_KERNEL); -+ opendata = nfs4_opendata_alloc(dentry, sp, fmode, flags, -+ c, claim, GFP_KERNEL); - if (opendata == NULL) - goto err_put_state_owner; - -@@ -2596,10 +2599,18 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir, - struct nfs_server *server = NFS_SERVER(dir); - struct nfs4_exception exception = { }; - struct nfs4_state *res; -+ struct nfs4_open_createattrs c = { -+ .label = label, -+ .sattr = sattr, -+ .verf = { -+ [0] = (__u32)jiffies, -+ [1] = (__u32)current->pid, -+ }, -+ }; - int status; - - do { -- status = _nfs4_do_open(dir, ctx, flags, sattr, label, opened); -+ status = _nfs4_do_open(dir, ctx, flags, &c, opened); - res = ctx->state; - trace_nfs4_open_file(ctx, flags, status); - if (status == 0) -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index ba27a5ff8677..ea5cb1ba282f 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1391,11 +1391,16 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca) - { - u32 slotsize = slot_bytes(ca); - u32 num = ca->maxreqs; -- int avail; -+ unsigned long avail, total_avail; - - spin_lock(&nfsd_drc_lock); -- avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, -- nfsd_drc_max_mem - nfsd_drc_mem_used); -+ total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used; -+ avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail); -+ /* -+ * Never use more than a third of the remaining memory, -+ * unless it's the only way to give this client a slot: -+ */ -+ avail = clamp_t(unsigned long, avail, slotsize, total_avail/3); - num = min_t(int, num, avail / slotsize); - nfsd_drc_mem_used += num * slotsize; - spin_unlock(&nfsd_drc_lock); -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index b6eb56d18568..0fa990f08daf 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -360,7 +360,7 @@ void nfsd_reset_versions(void) - */ - static void set_max_drc(void) - { -- #define NFSD_DRC_SIZE_SHIFT 10 -+ #define NFSD_DRC_SIZE_SHIFT 7 - nfsd_drc_max_mem = (nr_free_buffer_pages() - >> NFSD_DRC_SIZE_SHIFT) * PAGE_SIZE; - nfsd_drc_mem_used = 0; -diff --git a/fs/open.c b/fs/open.c -index 6cf516156111..5ba3fca9886b 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -363,6 +363,25 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) - override_cred->cap_permitted; - } - -+ /* -+ * The new set of credentials can *only* be used in -+ * task-synchronous circumstances, and does not need -+ * RCU freeing, unless somebody then takes a separate -+ * reference to it. -+ * -+ * NOTE! This is _only_ true because this credential -+ * is used purely for override_creds() that installs -+ * it as the subjective cred. Other threads will be -+ * accessing ->real_cred, not the subjective cred. -+ * -+ * If somebody _does_ make a copy of this (using the -+ * 'get_current_cred()' function), that will clear the -+ * non_rcu field, because now that other user may be -+ * expecting RCU freeing. But normal thread-synchronous -+ * cred accesses will keep things non-RCY. -+ */ -+ override_cred->non_rcu = 1; -+ - old_cred = override_creds(override_cred); - retry: - res = user_path_at(dfd, filename, lookup_flags, &path); -diff --git a/include/linux/cred.h b/include/linux/cred.h -index 9e120c92551b..d2db1da3036c 100644 ---- a/include/linux/cred.h -+++ b/include/linux/cred.h -@@ -153,7 +153,11 @@ struct cred { - struct user_struct *user; /* real user ID subscription */ - struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ - struct group_info *group_info; /* supplementary groups for euid/fsgid */ -- struct rcu_head rcu; /* RCU deletion hook */ -+ /* RCU deletion */ -+ union { -+ int non_rcu; /* Can we skip RCU deletion? */ -+ struct rcu_head rcu; /* RCU deletion hook */ -+ }; - }; - - extern void __put_cred(struct cred *); -@@ -251,6 +255,7 @@ static inline const struct cred *get_cred(const struct cred *cred) - { - struct cred *nonconst_cred = (struct cred *) cred; - validate_creds(cred); -+ nonconst_cred->non_rcu = 0; - return get_new_cred(nonconst_cred); - } - -diff --git a/include/linux/elevator.h b/include/linux/elevator.h -index 638b324f0291..92ad08a29884 100644 ---- a/include/linux/elevator.h -+++ b/include/linux/elevator.h -@@ -97,7 +97,7 @@ struct elevator_type - struct module *elevator_owner; - - /* managed by elevator core */ -- char icq_cache_name[ELV_NAME_MAX + 5]; /* elvname + "_io_cq" */ -+ char icq_cache_name[ELV_NAME_MAX + 6]; /* elvname + "_io_cq" */ - struct list_head list; - }; - -diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h -index addd03641e1a..0a93e9d1708e 100644 ---- a/include/linux/rcupdate.h -+++ b/include/linux/rcupdate.h -@@ -852,7 +852,7 @@ static inline void rcu_preempt_sleep_check(void) - * read-side critical sections may be preempted and they may also block, but - * only when acquiring spinlocks that are subject to priority inheritance. - */ --static inline void rcu_read_lock(void) -+static __always_inline void rcu_read_lock(void) - { - __rcu_read_lock(); - __acquire(RCU); -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 315df144c156..1218980f53de 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1860,7 +1860,7 @@ extern int arch_task_struct_size __read_mostly; - extern void task_numa_fault(int last_node, int node, int pages, int flags); - extern pid_t task_numa_group_id(struct task_struct *p); - extern void set_numabalancing_state(bool enabled); --extern void task_numa_free(struct task_struct *p); -+extern void task_numa_free(struct task_struct *p, bool final); - extern bool should_numa_migrate_memory(struct task_struct *p, struct page *page, - int src_nid, int dst_cpu); - #else -@@ -1875,7 +1875,7 @@ static inline pid_t task_numa_group_id(struct task_struct *p) - static inline void set_numabalancing_state(bool enabled) - { - } --static inline void task_numa_free(struct task_struct *p) -+static inline void task_numa_free(struct task_struct *p, bool final) - { - } - static inline bool should_numa_migrate_memory(struct task_struct *p, -diff --git a/include/net/tcp.h b/include/net/tcp.h -index bf8a0dae977a..77438a8406ec 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1443,6 +1443,11 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, - void tcp_fastopen_init_key_once(bool publish); - #define TCP_FASTOPEN_KEY_LENGTH 16 - -+static inline void tcp_init_send_head(struct sock *sk) -+{ -+ sk->sk_send_head = NULL; -+} -+ - /* Fastopen key context */ - struct tcp_fastopen_context { - struct crypto_cipher *tfm; -@@ -1459,6 +1464,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) - sk_wmem_free_skb(sk, skb); - sk_mem_reclaim(sk); - tcp_clear_all_retrans_hints(tcp_sk(sk)); -+ tcp_init_send_head(sk); - inet_csk(sk)->icsk_backoff = 0; - } - -@@ -1520,11 +1526,6 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli - tcp_sk(sk)->highest_sack = NULL; - } - --static inline void tcp_init_send_head(struct sock *sk) --{ -- sk->sk_send_head = NULL; --} -- - static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb) - { - __skb_queue_tail(&sk->sk_write_queue, skb); -diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile -index 13272582eee0..677991f29d66 100644 ---- a/kernel/bpf/Makefile -+++ b/kernel/bpf/Makefile -@@ -1,4 +1,5 @@ - obj-y := core.o -+CFLAGS_core.o += $(call cc-disable-warning, override-init) - - obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o - obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o -diff --git a/kernel/cred.c b/kernel/cred.c -index 098af0bc0b7e..a2e06b05a90c 100644 ---- a/kernel/cred.c -+++ b/kernel/cred.c -@@ -146,7 +146,10 @@ void __put_cred(struct cred *cred) - BUG_ON(cred == current->cred); - BUG_ON(cred == current->real_cred); - -- call_rcu(&cred->rcu, put_cred_rcu); -+ if (cred->non_rcu) -+ put_cred_rcu(&cred->rcu); -+ else -+ call_rcu(&cred->rcu, put_cred_rcu); - } - EXPORT_SYMBOL(__put_cred); - -@@ -257,6 +260,7 @@ struct cred *prepare_creds(void) - old = task->cred; - memcpy(new, old, sizeof(struct cred)); - -+ new->non_rcu = 0; - atomic_set(&new->usage, 1); - set_cred_subscribers(new, 0); - get_group_info(new->group_info); -@@ -536,7 +540,19 @@ const struct cred *override_creds(const struct cred *new) - - validate_creds(old); - validate_creds(new); -- get_cred(new); -+ -+ /* -+ * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'. -+ * -+ * That means that we do not clear the 'non_rcu' flag, since -+ * we are only installing the cred into the thread-synchronous -+ * '->cred' pointer, not the '->real_cred' pointer that is -+ * visible to other threads under RCU. -+ * -+ * Also note that we did validate_creds() manually, not depending -+ * on the validation in 'get_cred()'. -+ */ -+ get_new_cred((struct cred *)new); - alter_cred_subscribers(new, 1); - rcu_assign_pointer(current->cred, new); - alter_cred_subscribers(old, -1); -@@ -619,6 +635,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) - validate_creds(old); - - *new = *old; -+ new->non_rcu = 0; - atomic_set(&new->usage, 1); - set_cred_subscribers(new, 0); - get_uid(new->user); -diff --git a/kernel/fork.c b/kernel/fork.c -index e4b81913a998..bd6aad92819a 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -254,7 +254,7 @@ void __put_task_struct(struct task_struct *tsk) - WARN_ON(tsk == current); - - cgroup_free(tsk); -- task_numa_free(tsk); -+ task_numa_free(tsk, true); - security_task_free(tsk); - exit_creds(tsk); - delayacct_tsk_free(tsk); -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 774ab79d3ec7..f2df5f86af28 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3128,17 +3128,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass, - if (depth) { - hlock = curr->held_locks + depth - 1; - if (hlock->class_idx == class_idx && nest_lock) { -- if (hlock->references) { -- /* -- * Check: unsigned int references:12, overflow. -- */ -- if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1)) -- return 0; -+ if (!references) -+ references++; - -+ if (!hlock->references) - hlock->references++; -- } else { -- hlock->references = 2; -- } -+ -+ hlock->references += references; -+ -+ /* Overflow */ -+ if (DEBUG_LOCKS_WARN_ON(hlock->references < references)) -+ return 0; - - return 1; - } -diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c -index dbb61a302548..35b34eccdd10 100644 ---- a/kernel/locking/lockdep_proc.c -+++ b/kernel/locking/lockdep_proc.c -@@ -217,7 +217,6 @@ static void lockdep_stats_debug_show(struct seq_file *m) - - static int lockdep_stats_show(struct seq_file *m, void *v) - { -- struct lock_class *class; - unsigned long nr_unused = 0, nr_uncategorized = 0, - nr_irq_safe = 0, nr_irq_unsafe = 0, - nr_softirq_safe = 0, nr_softirq_unsafe = 0, -@@ -227,6 +226,9 @@ static int lockdep_stats_show(struct seq_file *m, void *v) - nr_hardirq_read_safe = 0, nr_hardirq_read_unsafe = 0, - sum_forward_deps = 0; - -+#ifdef CONFIG_PROVE_LOCKING -+ struct lock_class *class; -+ - list_for_each_entry(class, &all_lock_classes, lock_entry) { - - if (class->usage_mask == 0) -@@ -258,12 +260,12 @@ static int lockdep_stats_show(struct seq_file *m, void *v) - if (class->usage_mask & LOCKF_ENABLED_HARDIRQ_READ) - nr_hardirq_read_unsafe++; - --#ifdef CONFIG_PROVE_LOCKING - sum_forward_deps += lockdep_count_forward_deps(class); --#endif - } - #ifdef CONFIG_DEBUG_LOCKDEP - DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused); -+#endif -+ - #endif - seq_printf(m, " lock-classes: %11lu [max: %lu]\n", - nr_lock_classes, MAX_LOCKDEP_KEYS); -diff --git a/kernel/padata.c b/kernel/padata.c -index ecc7b3f452c7..282b489a286d 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -273,7 +273,12 @@ static void padata_reorder(struct parallel_data *pd) - * The next object that needs serialization might have arrived to - * the reorder queues in the meantime, we will be called again - * from the timer function if no one else cares for it. -+ * -+ * Ensure reorder_objects is read after pd->lock is dropped so we see -+ * an increment from another task in padata_do_serial. Pairs with -+ * smp_mb__after_atomic in padata_do_serial. - */ -+ smp_mb(); - if (atomic_read(&pd->reorder_objects) - && !(pinst->flags & PADATA_RESET)) - mod_timer(&pd->timer, jiffies + HZ); -@@ -342,6 +347,13 @@ void padata_do_serial(struct padata_priv *padata) - list_add_tail(&padata->list, &pqueue->reorder.list); - spin_unlock(&pqueue->reorder.lock); - -+ /* -+ * Ensure the atomic_inc of reorder_objects above is ordered correctly -+ * with the trylock of pd->lock in padata_reorder. Pairs with smp_mb -+ * in padata_reorder. -+ */ -+ smp_mb__after_atomic(); -+ - put_cpu(); - - padata_reorder(pd); -diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c -index 567ecc826bc8..6353372801f2 100644 ---- a/kernel/pid_namespace.c -+++ b/kernel/pid_namespace.c -@@ -325,7 +325,7 @@ int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd) - } - - read_lock(&tasklist_lock); -- force_sig(SIGKILL, pid_ns->child_reaper); -+ send_sig(SIGKILL, pid_ns->child_reaper, 1); - read_unlock(&tasklist_lock); - - do_exit(0); -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 75bfa23f97b4..19d735ab44db 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -2054,13 +2054,23 @@ no_join: - return; - } - --void task_numa_free(struct task_struct *p) -+/* -+ * Get rid of NUMA staticstics associated with a task (either current or dead). -+ * If @final is set, the task is dead and has reached refcount zero, so we can -+ * safely free all relevant data structures. Otherwise, there might be -+ * concurrent reads from places like load balancing and procfs, and we should -+ * reset the data back to default state without freeing ->numa_faults. -+ */ -+void task_numa_free(struct task_struct *p, bool final) - { - struct numa_group *grp = p->numa_group; -- void *numa_faults = p->numa_faults; -+ unsigned long *numa_faults = p->numa_faults; - unsigned long flags; - int i; - -+ if (!numa_faults) -+ return; -+ - if (grp) { - spin_lock_irqsave(&grp->lock, flags); - for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++) -@@ -2073,8 +2083,14 @@ void task_numa_free(struct task_struct *p) - put_numa_group(grp); - } - -- p->numa_faults = NULL; -- kfree(numa_faults); -+ if (final) { -+ p->numa_faults = NULL; -+ kfree(numa_faults); -+ } else { -+ p->total_numa_faults = 0; -+ for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++) -+ numa_faults[i] = 0; -+ } - } - - /* -diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c -index 0e0dc5d89911..bbe767b1f454 100644 ---- a/kernel/time/ntp.c -+++ b/kernel/time/ntp.c -@@ -39,6 +39,7 @@ static u64 tick_length_base; - #define MAX_TICKADJ 500LL /* usecs */ - #define MAX_TICKADJ_SCALED \ - (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ) -+#define MAX_TAI_OFFSET 100000 - - /* - * phase-lock loop variables -@@ -633,7 +634,8 @@ static inline void process_adjtimex_modes(struct timex *txc, - time_constant = max(time_constant, 0l); - } - -- if (txc->modes & ADJ_TAI && txc->constant >= 0) -+ if (txc->modes & ADJ_TAI && -+ txc->constant >= 0 && txc->constant <= MAX_TAI_OFFSET) - *time_tai = txc->constant; - - if (txc->modes & ADJ_OFFSET) -diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c -index 1407ed20ea93..b7c5d230b4b2 100644 ---- a/kernel/time/timer_list.c -+++ b/kernel/time/timer_list.c -@@ -299,23 +299,6 @@ static inline void timer_list_header(struct seq_file *m, u64 now) - SEQ_printf(m, "\n"); - } - --static int timer_list_show(struct seq_file *m, void *v) --{ -- struct timer_list_iter *iter = v; -- -- if (iter->cpu == -1 && !iter->second_pass) -- timer_list_header(m, iter->now); -- else if (!iter->second_pass) -- print_cpu(m, iter->cpu, iter->now); --#ifdef CONFIG_GENERIC_CLOCKEVENTS -- else if (iter->cpu == -1 && iter->second_pass) -- timer_list_show_tickdevices_header(m); -- else -- print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu); --#endif -- return 0; --} -- - void sysrq_timer_list_show(void) - { - u64 now = ktime_to_ns(ktime_get()); -@@ -334,6 +317,24 @@ void sysrq_timer_list_show(void) - return; - } - -+#ifdef CONFIG_PROC_FS -+static int timer_list_show(struct seq_file *m, void *v) -+{ -+ struct timer_list_iter *iter = v; -+ -+ if (iter->cpu == -1 && !iter->second_pass) -+ timer_list_header(m, iter->now); -+ else if (!iter->second_pass) -+ print_cpu(m, iter->cpu, iter->now); -+#ifdef CONFIG_GENERIC_CLOCKEVENTS -+ else if (iter->cpu == -1 && iter->second_pass) -+ timer_list_show_tickdevices_header(m); -+ else -+ print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu); -+#endif -+ return 0; -+} -+ - static void *move_iter(struct timer_list_iter *iter, loff_t offset) - { - for (; offset; offset--) { -@@ -405,3 +406,4 @@ static int __init init_timer_list_procfs(void) - return 0; - } - __initcall(init_timer_list_procfs); -+#endif -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index cab210695f66..c82ebd11414a 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -5406,11 +5406,15 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, - break; - } - #endif -- if (!tr->allocated_snapshot) { -+ if (!tr->allocated_snapshot) -+ ret = resize_buffer_duplicate_size(&tr->max_buffer, -+ &tr->trace_buffer, iter->cpu_file); -+ else - ret = alloc_snapshot(tr); -- if (ret < 0) -- break; -- } -+ -+ if (ret < 0) -+ break; -+ - local_irq_disable(); - /* Now, we're going to swap */ - if (iter->cpu_file == RING_BUFFER_ALL_CPUS) -diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c -index 0ec3f257ffdf..a5d313381539 100644 ---- a/lib/reed_solomon/decode_rs.c -+++ b/lib/reed_solomon/decode_rs.c -@@ -42,8 +42,18 @@ - BUG_ON(pad < 0 || pad >= nn); - - /* Does the caller provide the syndrome ? */ -- if (s != NULL) -- goto decode; -+ if (s != NULL) { -+ for (i = 0; i < nroots; i++) { -+ /* The syndrome is in index form, -+ * so nn represents zero -+ */ -+ if (s[i] != nn) -+ goto decode; -+ } -+ -+ /* syndrome is zero, no errors to correct */ -+ return 0; -+ } - - /* form the syndromes; i.e., evaluate data(x) at roots of - * g(x) */ -@@ -99,9 +109,9 @@ - if (no_eras > 0) { - /* Init lambda to be the erasure locator polynomial */ - lambda[1] = alpha_to[rs_modnn(rs, -- prim * (nn - 1 - eras_pos[0]))]; -+ prim * (nn - 1 - (eras_pos[0] + pad)))]; - for (i = 1; i < no_eras; i++) { -- u = rs_modnn(rs, prim * (nn - 1 - eras_pos[i])); -+ u = rs_modnn(rs, prim * (nn - 1 - (eras_pos[i] + pad))); - for (j = i + 1; j > 0; j--) { - tmp = index_of[lambda[j - 1]]; - if (tmp != nn) { -diff --git a/lib/scatterlist.c b/lib/scatterlist.c -index bafa9933fa76..0b86b7992f93 100644 ---- a/lib/scatterlist.c -+++ b/lib/scatterlist.c -@@ -496,17 +496,18 @@ static bool sg_miter_get_next_page(struct sg_mapping_iter *miter) - { - if (!miter->__remaining) { - struct scatterlist *sg; -- unsigned long pgoffset; - - if (!__sg_page_iter_next(&miter->piter)) - return false; - - sg = miter->piter.sg; -- pgoffset = miter->piter.sg_pgoffset; - -- miter->__offset = pgoffset ? 0 : sg->offset; -+ miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset; -+ miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT; -+ miter->__offset &= PAGE_SIZE - 1; - miter->__remaining = sg->offset + sg->length - -- (pgoffset << PAGE_SHIFT) - miter->__offset; -+ (miter->piter.sg_pgoffset << PAGE_SHIFT) - -+ miter->__offset; - miter->__remaining = min_t(unsigned long, miter->__remaining, - PAGE_SIZE - miter->__offset); - } -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 84c93879aa5d..4d675318754e 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -566,7 +566,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size, - if (in_irq()) { - object->pid = 0; - strncpy(object->comm, "hardirq", sizeof(object->comm)); -- } else if (in_softirq()) { -+ } else if (in_serving_softirq()) { - object->pid = 0; - strncpy(object->comm, "softirq", sizeof(object->comm)); - } else { -diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c -index 5fbdd367bbed..ad90b8f85223 100644 ---- a/mm/mmu_notifier.c -+++ b/mm/mmu_notifier.c -@@ -286,7 +286,7 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn, - * thanks to mm_take_all_locks(). - */ - spin_lock(&mm->mmu_notifier_mm->lock); -- hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list); -+ hlist_add_head_rcu(&mn->hlist, &mm->mmu_notifier_mm->list); - spin_unlock(&mm->mmu_notifier_mm->lock); - - mm_drop_all_locks(mm); -diff --git a/mm/vmstat.c b/mm/vmstat.c -index dd0a13013cb4..59e131e82b81 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1395,10 +1395,15 @@ static void vmstat_update(struct work_struct *w) - * Counters were updated so we expect more updates - * to occur in the future. Keep on running the - * update worker thread. -+ * If we were marked on cpu_stat_off clear the flag -+ * so that vmstat_shepherd doesn't schedule us again. - */ -- queue_delayed_work_on(smp_processor_id(), vmstat_wq, -- this_cpu_ptr(&vmstat_work), -- round_jiffies_relative(sysctl_stat_interval)); -+ if (!cpumask_test_and_clear_cpu(smp_processor_id(), -+ cpu_stat_off)) { -+ queue_delayed_work_on(smp_processor_id(), vmstat_wq, -+ this_cpu_ptr(&vmstat_work), -+ round_jiffies_relative(sysctl_stat_interval)); -+ } - } else { - /* - * We did not update any counters so the app may be in -@@ -1407,17 +1412,7 @@ static void vmstat_update(struct work_struct *w) - * Defer the checking for differentials to the - * shepherd thread on a different processor. - */ -- int r; -- /* -- * Shepherd work thread does not race since it never -- * changes the bit if its zero but the cpu -- * online / off line code may race if -- * worker threads are still allowed during -- * shutdown / startup. -- */ -- r = cpumask_test_and_set_cpu(smp_processor_id(), -- cpu_stat_off); -- VM_BUG_ON(r); -+ cpumask_set_cpu(smp_processor_id(), cpu_stat_off); - } - } - -@@ -1426,18 +1421,6 @@ static void vmstat_update(struct work_struct *w) - * until the diffs stay at zero. The function is used by NOHZ and can only be - * invoked when tick processing is not active. - */ --void quiet_vmstat(void) --{ -- if (system_state != SYSTEM_RUNNING) -- return; -- -- do { -- if (!cpumask_test_and_set_cpu(smp_processor_id(), cpu_stat_off)) -- cancel_delayed_work(this_cpu_ptr(&vmstat_work)); -- -- } while (refresh_cpu_vm_stats(false)); --} -- - /* - * Check if the diffs for a certain cpu indicate that - * an update is needed. -@@ -1461,6 +1444,30 @@ static bool need_update(int cpu) - return false; - } - -+void quiet_vmstat(void) -+{ -+ if (system_state != SYSTEM_RUNNING) -+ return; -+ -+ /* -+ * If we are already in hands of the shepherd then there -+ * is nothing for us to do here. -+ */ -+ if (cpumask_test_and_set_cpu(smp_processor_id(), cpu_stat_off)) -+ return; -+ -+ if (!need_update(smp_processor_id())) -+ return; -+ -+ /* -+ * Just refresh counters and do not care about the pending delayed -+ * vmstat_update. It doesn't fire that often to matter and canceling -+ * it would be too expensive from this path. -+ * vmstat_shepherd will take care about that for us. -+ */ -+ refresh_cpu_vm_stats(false); -+} -+ - - /* - * Shepherd worker thread that checks the -@@ -1478,18 +1485,25 @@ static void vmstat_shepherd(struct work_struct *w) - - get_online_cpus(); - /* Check processors whose vmstat worker threads have been disabled */ -- for_each_cpu(cpu, cpu_stat_off) -- if (need_update(cpu) && -- cpumask_test_and_clear_cpu(cpu, cpu_stat_off)) -- -- queue_delayed_work_on(cpu, vmstat_wq, -- &per_cpu(vmstat_work, cpu), 0); -+ for_each_cpu(cpu, cpu_stat_off) { -+ struct delayed_work *dw = &per_cpu(vmstat_work, cpu); - -+ if (need_update(cpu)) { -+ if (cpumask_test_and_clear_cpu(cpu, cpu_stat_off)) -+ queue_delayed_work_on(cpu, vmstat_wq, dw, 0); -+ } else { -+ /* -+ * Cancel the work if quiet_vmstat has put this -+ * cpu on cpu_stat_off because the work item might -+ * be still scheduled -+ */ -+ cancel_delayed_work(dw); -+ } -+ } - put_online_cpus(); - - schedule_delayed_work(&shepherd, - round_jiffies_relative(sysctl_stat_interval)); -- - } - - static void __init start_shepherd_timer(void) -diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c -index 2a15b6aa9cdd..5892bd1457d4 100644 ---- a/net/9p/trans_virtio.c -+++ b/net/9p/trans_virtio.c -@@ -767,10 +767,16 @@ static struct p9_trans_module p9_virtio_trans = { - /* The standard init function */ - static int __init p9_virtio_init(void) - { -+ int rc; -+ - INIT_LIST_HEAD(&virtio_chan_list); - - v9fs_register_trans(&p9_virtio_trans); -- return register_virtio_driver(&p9_virtio_drv); -+ rc = register_virtio_driver(&p9_virtio_drv); -+ if (rc) -+ v9fs_unregister_trans(&p9_virtio_trans); -+ -+ return rc; - } - - static void __exit p9_virtio_cleanup(void) -diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c -index f2079acb555d..ffd49b40e76a 100644 ---- a/net/batman-adv/translation-table.c -+++ b/net/batman-adv/translation-table.c -@@ -3158,6 +3158,8 @@ static void batadv_tt_purge(struct work_struct *work) - - void batadv_tt_free(struct batadv_priv *bat_priv) - { -+ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1); -+ - batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1); - batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1); - -diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c -index 795ddd8b2f77..4cd6b8d811ff 100644 ---- a/net/bluetooth/6lowpan.c -+++ b/net/bluetooth/6lowpan.c -@@ -184,10 +184,16 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_dev *dev, - } - - if (!rt) { -- nexthop = &lowpan_cb(skb)->gw; -- -- if (ipv6_addr_any(nexthop)) -- return NULL; -+ if (ipv6_addr_any(&lowpan_cb(skb)->gw)) { -+ /* There is neither route nor gateway, -+ * probably the destination is a direct peer. -+ */ -+ nexthop = daddr; -+ } else { -+ /* There is a known gateway -+ */ -+ nexthop = &lowpan_cb(skb)->gw; -+ } - } else { - nexthop = rt6_nexthop(rt, daddr); - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 37fe2b158c2a..c4e94f34d048 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5062,6 +5062,11 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, - return send_conn_param_neg_reply(hdev, handle, - HCI_ERROR_UNKNOWN_CONN_ID); - -+ if (min < hcon->le_conn_min_interval || -+ max > hcon->le_conn_max_interval) -+ return send_conn_param_neg_reply(hdev, handle, -+ HCI_ERROR_INVALID_LL_PARAMS); -+ - if (hci_check_conn_params(min, max, latency, timeout)) - return send_conn_param_neg_reply(hdev, handle, - HCI_ERROR_INVALID_LL_PARAMS); -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 46afd560f242..8cfba78d26f6 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -4363,6 +4363,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, - - l2cap_chan_lock(chan); - -+ if (chan->state != BT_DISCONN) { -+ l2cap_chan_unlock(chan); -+ mutex_unlock(&conn->chan_lock); -+ return 0; -+ } -+ - l2cap_chan_hold(chan); - l2cap_chan_del(chan, 0); - -@@ -5260,7 +5266,14 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, - - memset(&rsp, 0, sizeof(rsp)); - -- err = hci_check_conn_params(min, max, latency, to_multiplier); -+ if (min < hcon->le_conn_min_interval || -+ max > hcon->le_conn_max_interval) { -+ BT_DBG("requested connection interval exceeds current bounds."); -+ err = -EINVAL; -+ } else { -+ err = hci_check_conn_params(min, max, latency, to_multiplier); -+ } -+ - if (err) - rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); - else -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index bedfaef2c59e..a19822be0e56 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -2532,6 +2532,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn, - goto distribute; - } - -+ /* Drop IRK if peer is using identity address during pairing but is -+ * providing different address as identity information. -+ * -+ * Microsoft Surface Precision Mouse is known to have this bug. -+ */ -+ if (hci_is_identity_address(&hcon->dst, hcon->dst_type) && -+ (bacmp(&info->bdaddr, &hcon->dst) || -+ info->addr_type != hcon->dst_type)) { -+ bt_dev_err(hcon->hdev, -+ "ignoring IRK with invalid identity address"); -+ goto distribute; -+ } -+ - bacpy(&smp->id_addr, &info->bdaddr); - smp->id_addr_type = info->addr_type; - -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index a52b4ffe30f4..0298bfd9e1d7 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -1011,6 +1011,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, - int type; - int err = 0; - __be32 group; -+ u16 nsrcs; - - ih = igmpv3_report_hdr(skb); - num = ntohs(ih->ngrec); -@@ -1024,8 +1025,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, - grec = (void *)(skb->data + len - sizeof(*grec)); - group = grec->grec_mca; - type = grec->grec_type; -+ nsrcs = ntohs(grec->grec_nsrcs); - -- len += ntohs(grec->grec_nsrcs) * 4; -+ len += nsrcs * 4; - if (!pskb_may_pull(skb, len)) - return -EINVAL; - -@@ -1045,7 +1047,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br, - - if ((type == IGMPV3_CHANGE_TO_INCLUDE || - type == IGMPV3_MODE_IS_INCLUDE) && -- ntohs(grec->grec_nsrcs) == 0) { -+ nsrcs == 0) { - br_ip4_multicast_leave_group(br, port, group, vid); - } else { - err = br_ip4_multicast_add_group(br, port, group, vid); -@@ -1078,23 +1080,26 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, - len = skb_transport_offset(skb) + sizeof(*icmp6h); - - for (i = 0; i < num; i++) { -- __be16 *nsrcs, _nsrcs; -- -- nsrcs = skb_header_pointer(skb, -- len + offsetof(struct mld2_grec, -- grec_nsrcs), -- sizeof(_nsrcs), &_nsrcs); -- if (!nsrcs) -+ __be16 *_nsrcs, __nsrcs; -+ u16 nsrcs; -+ -+ _nsrcs = skb_header_pointer(skb, -+ len + offsetof(struct mld2_grec, -+ grec_nsrcs), -+ sizeof(__nsrcs), &__nsrcs); -+ if (!_nsrcs) - return -EINVAL; - -+ nsrcs = ntohs(*_nsrcs); -+ - if (!pskb_may_pull(skb, - len + sizeof(*grec) + -- sizeof(struct in6_addr) * ntohs(*nsrcs))) -+ sizeof(struct in6_addr) * nsrcs)) - return -EINVAL; - - grec = (struct mld2_grec *)(skb->data + len); - len += sizeof(*grec) + -- sizeof(struct in6_addr) * ntohs(*nsrcs); -+ sizeof(struct in6_addr) * nsrcs; - - /* We treat these as MLDv1 reports for now. */ - switch (grec->grec_type) { -@@ -1112,7 +1117,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, - - if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE || - grec->grec_type == MLD2_MODE_IS_INCLUDE) && -- ntohs(*nsrcs) == 0) { -+ nsrcs == 0) { - br_ip6_multicast_leave_group(br, port, &grec->grec_mca, - vid); - } else { -@@ -1348,7 +1353,6 @@ static int br_ip6_multicast_query(struct net_bridge *br, - struct sk_buff *skb, - u16 vid) - { -- const struct ipv6hdr *ip6h = ipv6_hdr(skb); - struct mld_msg *mld; - struct net_bridge_mdb_entry *mp; - struct mld2_query *mld2q; -@@ -1392,7 +1396,7 @@ static int br_ip6_multicast_query(struct net_bridge *br, - - if (is_general_query) { - saddr.proto = htons(ETH_P_IPV6); -- saddr.u.ip6 = ip6h->saddr; -+ saddr.u.ip6 = ipv6_hdr(skb)->saddr; - - br_multicast_query_received(br, port, &br->ip6_other_query, - &saddr, max_delay); -diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c -index 5881fbc114a9..36282eb3492d 100644 ---- a/net/bridge/br_stp_bpdu.c -+++ b/net/bridge/br_stp_bpdu.c -@@ -147,7 +147,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p) - void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, - struct net_device *dev) - { -- const unsigned char *dest = eth_hdr(skb)->h_dest; - struct net_bridge_port *p; - struct net_bridge *br; - const unsigned char *buf; -@@ -176,7 +175,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, - if (p->state == BR_STATE_DISABLED) - goto out; - -- if (!ether_addr_equal(dest, br->group_addr)) -+ if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr)) - goto out; - - if (p->flags & BR_BPDU_GUARD) { -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 8b0908c7e9cc..b3b242f7ecfd 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -982,6 +982,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) - - atomic_set(&neigh->probes, - NEIGH_VAR(neigh->parms, UCAST_PROBES)); -+ neigh_del_timer(neigh); - neigh->nud_state = NUD_INCOMPLETE; - neigh->updated = now; - next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME), -@@ -998,6 +999,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) - } - } else if (neigh->nud_state & NUD_STALE) { - neigh_dbg(2, "neigh %p is delayed\n", neigh); -+ neigh_del_timer(neigh); - neigh->nud_state = NUD_DELAY; - neigh->updated = jiffies; - neigh_add_timer(neigh, jiffies + -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 63f99e9a821b..4472329f5f47 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -67,6 +67,11 @@ - - #include "fib_lookup.h" - -+#define IPV6ONLY_FLAGS \ -+ (IFA_F_NODAD | IFA_F_OPTIMISTIC | IFA_F_DADFAILED | \ -+ IFA_F_HOMEADDRESS | IFA_F_TENTATIVE | \ -+ IFA_F_MANAGETEMPADDR | IFA_F_STABLE_PRIVACY) -+ - static struct ipv4_devconf ipv4_devconf = { - .data = { - [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1, -@@ -453,6 +458,9 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh, - ifa->ifa_flags &= ~IFA_F_SECONDARY; - last_primary = &in_dev->ifa_list; - -+ /* Don't set IPv6 only flags to IPv4 addresses */ -+ ifa->ifa_flags &= ~IPV6ONLY_FLAGS; -+ - for (ifap = &in_dev->ifa_list; (ifa1 = *ifap) != NULL; - ifap = &ifa1->ifa_next) { - if (!(ifa1->ifa_flags & IFA_F_SECONDARY) && -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 303be2b76855..8e303cd7e2de 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2272,6 +2272,8 @@ int tcp_disconnect(struct sock *sk, int flags) - dst_release(sk->sk_rx_dst); - sk->sk_rx_dst = NULL; - tcp_saved_syn_free(tp); -+ tp->bytes_acked = 0; -+ tp->bytes_received = 0; - - WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); - -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index e348a140e540..91f16e679f63 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -1666,6 +1666,10 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns - struct net *net = sock_net(sk); - struct mr6_table *mrt; - -+ if (sk->sk_type != SOCK_RAW || -+ inet_sk(sk)->inet_num != IPPROTO_ICMPV6) -+ return -EOPNOTSUPP; -+ - mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); - if (!mrt) - return -ENOENT; -@@ -1677,9 +1681,6 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns - - switch (optname) { - case MRT6_INIT: -- if (sk->sk_type != SOCK_RAW || -- inet_sk(sk)->inet_num != IPPROTO_ICMPV6) -- return -EOPNOTSUPP; - if (optlen < sizeof(int)) - return -EINVAL; - -@@ -1816,6 +1817,10 @@ int ip6_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, - struct net *net = sock_net(sk); - struct mr6_table *mrt; - -+ if (sk->sk_type != SOCK_RAW || -+ inet_sk(sk)->inet_num != IPPROTO_ICMPV6) -+ return -EOPNOTSUPP; -+ - mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); - if (!mrt) - return -ENOENT; -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 3ba903ff2bb0..36db179d848e 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -2463,8 +2463,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc - goto out; - } - err = pfkey_xfrm_policy2msg(out_skb, xp, dir); -- if (err < 0) -+ if (err < 0) { -+ kfree_skb(out_skb); - goto out; -+ } - - out_hdr = (struct sadb_msg *) out_skb->data; - out_hdr->sadb_msg_version = hdr->sadb_msg_version; -@@ -2717,8 +2719,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) - return PTR_ERR(out_skb); - - err = pfkey_xfrm_policy2msg(out_skb, xp, dir); -- if (err < 0) -+ if (err < 0) { -+ kfree_skb(out_skb); - return err; -+ } - - out_hdr = (struct sadb_msg *) out_skb->data; - out_hdr->sadb_msg_version = pfk->dump.msg_version; -diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c -index 046ae1caecea..e5888983bec4 100644 ---- a/net/netrom/af_netrom.c -+++ b/net/netrom/af_netrom.c -@@ -870,7 +870,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - unsigned short frametype, flags, window, timeout; - int ret; - -- skb->sk = NULL; /* Initially we don't know who it's for */ -+ skb_orphan(skb); - - /* - * skb->data points to the netrom frame start -@@ -968,7 +968,9 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) - - window = skb->data[20]; - -+ sock_hold(make); - skb->sk = make; -+ skb->destructor = sock_efree; - make->sk_state = TCP_ESTABLISHED; - - /* Fill in his circuit details */ -diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c -index dbd24254412a..d20383779710 100644 ---- a/net/nfc/nci/data.c -+++ b/net/nfc/nci/data.c -@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, - conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id); - if (!conn_info) { - rc = -EPROTO; -- goto free_exit; -+ goto exit; - } - - __skb_queue_head_init(&frags_q); -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index b04c03043976..8cc2a9df84fd 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -150,6 +150,25 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, - - err = -EINVAL; - switch (p->family) { -+ case AF_INET: -+ break; -+ -+ case AF_INET6: -+#if IS_ENABLED(CONFIG_IPV6) -+ break; -+#else -+ err = -EAFNOSUPPORT; -+ goto out; -+#endif -+ -+ default: -+ goto out; -+ } -+ -+ switch (p->sel.family) { -+ case AF_UNSPEC: -+ break; -+ - case AF_INET: - if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) - goto out; -diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c -index 8fa81e84e295..d117c68d1607 100644 ---- a/scripts/kallsyms.c -+++ b/scripts/kallsyms.c -@@ -158,6 +158,9 @@ static int read_symbol(FILE *in, struct sym_entry *s) - /* exclude debugging symbols */ - else if (stype == 'N') - return -1; -+ /* exclude s390 kasan local symbols */ -+ else if (!strncmp(sym, ".LASANPC", 8)) -+ return -1; - - /* include the type field in the symbol name, so that it gets - * compressed together */ -diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h -index b9897e2be404..04151ede8043 100644 ---- a/scripts/recordmcount.h -+++ b/scripts/recordmcount.h -@@ -326,7 +326,8 @@ static uint_t *sift_rel_mcount(uint_t *mlocp, - if (!mcountsym) - mcountsym = get_mcountsym(sym0, relp, str0); - -- if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) { -+ if (mcountsym && mcountsym == Elf_r_sym(relp) && -+ !is_fake_mcount(relp)) { - uint_t const addend = - _w(_w(relp->r_offset) - recval + mcount_adjust); - mrelp->r_offset = _w(offbase -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 0d0e0c2651c2..7fa0219c9758 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1014,7 +1014,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, - { - struct snd_seq_client *client = file->private_data; - int written = 0, len; -- int err; -+ int err, handled; - struct snd_seq_event event; - - if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT)) -@@ -1027,6 +1027,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, - if (!client->accept_output || client->pool == NULL) - return -ENXIO; - -+ repeat: -+ handled = 0; - /* allocate the pool now if the pool is not allocated yet */ - mutex_lock(&client->ioctl_mutex); - if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { -@@ -1086,12 +1088,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, - 0, 0, &client->ioctl_mutex); - if (err < 0) - break; -+ handled++; - - __skip_event: - /* Update pointers and counts */ - count -= len; - buf += len; - written += len; -+ -+ /* let's have a coffee break if too many events are queued */ -+ if (++handled >= 200) { -+ mutex_unlock(&client->ioctl_mutex); -+ goto repeat; -+ } - } - - out: -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 40dd46556452..05e745e2f427 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -1008,6 +1008,7 @@ static int patch_conexant_auto(struct hda_codec *codec) - */ - - static const struct hda_device_id snd_hda_id_conexant[] = { -+ HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto), - HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto), - HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto), - HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto), -diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c -index 63dcaef41ac3..7fa37bae1f37 100644 ---- a/sound/usb/line6/podhd.c -+++ b/sound/usb/line6/podhd.c -@@ -155,7 +155,7 @@ static const struct line6_properties podhd_properties_table[] = { - .capabilities = LINE6_CAP_CONTROL - | LINE6_CAP_PCM - | LINE6_CAP_HWMON, -- .altsetting = 1, -+ .altsetting = 0, - .ep_ctrl_r = 0x81, - .ep_ctrl_w = 0x01, - .ep_audio_r = 0x86, -diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c -index 5eb6793f3972..2d0dcd6fc64c 100644 ---- a/tools/iio/iio_utils.c -+++ b/tools/iio/iio_utils.c -@@ -163,9 +163,9 @@ int iioutils_get_type(unsigned *is_signed, unsigned *bytes, unsigned *bits_used, - *be = (endianchar == 'b'); - *bytes = padint / 8; - if (*bits_used == 64) -- *mask = ~0; -+ *mask = ~(0ULL); - else -- *mask = (1ULL << *bits_used) - 1; -+ *mask = (1ULL << *bits_used) - 1ULL; - - *is_signed = (signchar == 's'); - if (fclose(sysfsfp)) { -diff --git a/tools/perf/tests/mmap-thread-lookup.c b/tools/perf/tests/mmap-thread-lookup.c -index 145050e2e544..195ba31e2f35 100644 ---- a/tools/perf/tests/mmap-thread-lookup.c -+++ b/tools/perf/tests/mmap-thread-lookup.c -@@ -49,7 +49,7 @@ static void *thread_fn(void *arg) - { - struct thread_data *td = arg; - ssize_t ret; -- int go; -+ int go = 0; - - if (thread_init(td)) - return NULL; -diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c -index 54af2f2e2ee4..1a35ab044c11 100644 ---- a/tools/perf/tests/parse-events.c -+++ b/tools/perf/tests/parse-events.c -@@ -12,6 +12,32 @@ - #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \ - PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD) - -+#if defined(__s390x__) -+/* Return true if kvm module is available and loaded. Test this -+ * and retun success when trace point kvm_s390_create_vm -+ * exists. Otherwise this test always fails. -+ */ -+static bool kvm_s390_create_vm_valid(void) -+{ -+ char *eventfile; -+ bool rc = false; -+ -+ eventfile = get_events_file("kvm-s390"); -+ -+ if (eventfile) { -+ DIR *mydir = opendir(eventfile); -+ -+ if (mydir) { -+ rc = true; -+ closedir(mydir); -+ } -+ put_events_file(eventfile); -+ } -+ -+ return rc; -+} -+#endif -+ - static int test__checkevent_tracepoint(struct perf_evlist *evlist) - { - struct perf_evsel *evsel = perf_evlist__first(evlist); -@@ -1561,6 +1587,7 @@ static struct evlist_test test__events[] = { - { - .name = "kvm-s390:kvm_s390_create_vm", - .check = test__checkevent_tracepoint, -+ .valid = kvm_s390_create_vm_valid, - .id = 100, - }, - #endif -diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c -index 97fde9275f42..a8507fee654b 100644 ---- a/tools/perf/util/evsel.c -+++ b/tools/perf/util/evsel.c -@@ -491,6 +491,9 @@ const char *perf_evsel__name(struct perf_evsel *evsel) - { - char bf[128]; - -+ if (!evsel) -+ goto out_unknown; -+ - if (evsel->name) - return evsel->name; - -@@ -527,7 +530,10 @@ const char *perf_evsel__name(struct perf_evsel *evsel) - - evsel->name = strdup(bf); - -- return evsel->name ?: "unknown"; -+ if (evsel->name) -+ return evsel->name; -+out_unknown: -+ return "unknown"; - } - - const char *perf_evsel__group_name(struct perf_evsel *evsel) -diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c -index 0fbd1a22c0a9..2f86935094ca 100644 ---- a/tools/power/cpupower/utils/cpufreq-set.c -+++ b/tools/power/cpupower/utils/cpufreq-set.c -@@ -306,6 +306,8 @@ int cmd_freq_set(int argc, char **argv) - bitmask_setbit(cpus_chosen, cpus->cpu); - cpus = cpus->next; - } -+ /* Set the last cpu in related cpus list */ -+ bitmask_setbit(cpus_chosen, cpus->cpu); - cpufreq_put_related_cpus(cpus); - } - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.187-188.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.187-188.patch deleted file mode 100644 index fce2f644cfe8..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.187-188.patch +++ /dev/null @@ -1,543 +0,0 @@ -diff --git a/Makefile b/Makefile -index fdfe65eefa36..87d663191986 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 187 -+SUBLEVEL = 188 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi -index 04ea209f1737..98abb053b7da 100644 ---- a/arch/arm/boot/dts/rk3288.dtsi -+++ b/arch/arm/boot/dts/rk3288.dtsi -@@ -205,6 +205,7 @@ - , - ; - clock-frequency = <24000000>; -+ arm,no-tick-in-suspend; - }; - - timer: timer@ff810000 { -diff --git a/arch/arm/mach-rpc/dma.c b/arch/arm/mach-rpc/dma.c -index 6d3517dc4772..82aac38fa2cf 100644 ---- a/arch/arm/mach-rpc/dma.c -+++ b/arch/arm/mach-rpc/dma.c -@@ -131,7 +131,7 @@ static irqreturn_t iomd_dma_handle(int irq, void *dev_id) - } while (1); - - idma->state = ~DMA_ST_AB; -- disable_irq(irq); -+ disable_irq_nosync(irq); - - return IRQ_HANDLED; - } -@@ -174,6 +174,9 @@ static void iomd_enable_dma(unsigned int chan, dma_t *dma) - DMA_FROM_DEVICE : DMA_TO_DEVICE); - } - -+ idma->dma_addr = idma->dma.sg->dma_address; -+ idma->dma_len = idma->dma.sg->length; -+ - iomd_writeb(DMA_CR_C, dma_base + CR); - idma->state = DMA_ST_AB; - } -diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c -index 2e7f60c9fc5d..a7057a06c096 100644 ---- a/arch/mips/lantiq/irq.c -+++ b/arch/mips/lantiq/irq.c -@@ -160,8 +160,9 @@ static int ltq_eiu_settype(struct irq_data *d, unsigned int type) - if (edge) - irq_set_handler(d->hwirq, handle_edge_irq); - -- ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_C) | -- (val << (i * 4)), LTQ_EIU_EXIN_C); -+ ltq_eiu_w32((ltq_eiu_r32(LTQ_EIU_EXIN_C) & -+ (~(7 << (i * 4)))) | (val << (i * 4)), -+ LTQ_EIU_EXIN_C); - } - } - -diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h -index fd810a57ab1b..3328a37ddc75 100644 ---- a/arch/x86/include/asm/apic.h -+++ b/arch/x86/include/asm/apic.h -@@ -44,7 +44,7 @@ static inline void generic_apic_probe(void) - - #ifdef CONFIG_X86_LOCAL_APIC - --extern unsigned int apic_verbosity; -+extern int apic_verbosity; - extern int local_apic_timer_c2_ok; - - extern int disable_apic; -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 2cb49ac1b2b2..39f202462029 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1184,25 +1184,29 @@ enum { - #define kvm_arch_vcpu_memslots_id(vcpu) ((vcpu)->arch.hflags & HF_SMM_MASK ? 1 : 0) - #define kvm_memslots_for_spte_role(kvm, role) __kvm_memslots(kvm, (role).smm) - -+asmlinkage void __noreturn kvm_spurious_fault(void); -+ - /* - * Hardware virtualization extension instructions may fault if a - * reboot turns off virtualization while processes are running. -- * Trap the fault and ignore the instruction if that happens. -+ * Usually after catching the fault we just panic; during reboot -+ * instead the instruction is ignored. - */ --asmlinkage void kvm_spurious_fault(void); -- --#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn) \ -- "666: " insn "\n\t" \ -- "668: \n\t" \ -- ".pushsection .fixup, \"ax\" \n" \ -- "667: \n\t" \ -- cleanup_insn "\n\t" \ -- "cmpb $0, kvm_rebooting \n\t" \ -- "jne 668b \n\t" \ -- __ASM_SIZE(push) " $666b \n\t" \ -- "jmp kvm_spurious_fault \n\t" \ -- ".popsection \n\t" \ -- _ASM_EXTABLE(666b, 667b) -+#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn) \ -+ "666: \n\t" \ -+ insn "\n\t" \ -+ "jmp 668f \n\t" \ -+ "667: \n\t" \ -+ "call kvm_spurious_fault \n\t" \ -+ "668: \n\t" \ -+ ".pushsection .fixup, \"ax\" \n\t" \ -+ "700: \n\t" \ -+ cleanup_insn "\n\t" \ -+ "cmpb $0, kvm_rebooting\n\t" \ -+ "je 667b \n\t" \ -+ "jmp 668b \n\t" \ -+ ".popsection \n\t" \ -+ _ASM_EXTABLE(666b, 700b) - - #define __kvm_handle_fault_on_reboot(insn) \ - ____kvm_handle_fault_on_reboot(insn, "") -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index deddc9b93299..cc6c33249850 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -171,7 +171,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR; - /* - * Debug level, exported for io_apic.c - */ --unsigned int apic_verbosity; -+int apic_verbosity; - - int pic_mode; - -diff --git a/arch/x86/math-emu/fpu_emu.h b/arch/x86/math-emu/fpu_emu.h -index afbc4d805d66..df5aee5402c4 100644 ---- a/arch/x86/math-emu/fpu_emu.h -+++ b/arch/x86/math-emu/fpu_emu.h -@@ -176,7 +176,7 @@ static inline void reg_copy(FPU_REG const *x, FPU_REG *y) - #define setexponentpos(x,y) { (*(short *)&((x)->exp)) = \ - ((y) + EXTENDED_Ebias) & 0x7fff; } - #define exponent16(x) (*(short *)&((x)->exp)) --#define setexponent16(x,y) { (*(short *)&((x)->exp)) = (y); } -+#define setexponent16(x,y) { (*(short *)&((x)->exp)) = (u16)(y); } - #define addexponent(x,y) { (*(short *)&((x)->exp)) += (y); } - #define stdexp(x) { (*(short *)&((x)->exp)) += EXTENDED_Ebias; } - -diff --git a/arch/x86/math-emu/reg_constant.c b/arch/x86/math-emu/reg_constant.c -index 00548354912f..382093c5072b 100644 ---- a/arch/x86/math-emu/reg_constant.c -+++ b/arch/x86/math-emu/reg_constant.c -@@ -17,7 +17,7 @@ - #include "control_w.h" - - #define MAKE_REG(s, e, l, h) { l, h, \ -- ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) } -+ (u16)((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) } - - FPU_REG const CONST_1 = MAKE_REG(POS, 0, 0x00000000, 0x80000000); - #if 0 -diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c -index 2b36d1c63aa5..956189a1ba81 100644 ---- a/drivers/dma/sh/rcar-dmac.c -+++ b/drivers/dma/sh/rcar-dmac.c -@@ -1030,7 +1030,7 @@ rcar_dmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, - dma_addr_t dev_addr; - - /* Someone calling slave DMA on a generic channel? */ -- if (rchan->mid_rid < 0 || !sg_len) { -+ if (rchan->mid_rid < 0 || !sg_len || !sg_dma_len(sgl)) { - dev_warn(chan->device->dev, - "%s: bad parameter: len=%d, id=%d\n", - __func__, sg_len, rchan->mid_rid); -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 26255862d1cf..7524a33b7032 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -4307,8 +4307,12 @@ int be_update_queues(struct be_adapter *adapter) - struct net_device *netdev = adapter->netdev; - int status; - -- if (netif_running(netdev)) -+ if (netif_running(netdev)) { -+ /* device cannot transmit now, avoid dev_watchdog timeouts */ -+ netif_carrier_off(netdev); -+ - be_close(netdev); -+ } - - be_cancel_worker(adapter); - -diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c -index 286782c60da4..6601047d4b65 100644 ---- a/drivers/s390/block/dasd_alias.c -+++ b/drivers/s390/block/dasd_alias.c -@@ -396,6 +396,20 @@ suborder_not_supported(struct dasd_ccw_req *cqr) - char msg_format; - char msg_no; - -+ /* -+ * intrc values ENODEV, ENOLINK and EPERM -+ * will be optained from sleep_on to indicate that no -+ * IO operation can be started -+ */ -+ if (cqr->intrc == -ENODEV) -+ return 1; -+ -+ if (cqr->intrc == -ENOLINK) -+ return 1; -+ -+ if (cqr->intrc == -EPERM) -+ return 1; -+ - sense = dasd_get_sense(&cqr->irb); - if (!sense) - return 0; -@@ -460,12 +474,8 @@ static int read_unit_address_configuration(struct dasd_device *device, - lcu->flags &= ~NEED_UAC_UPDATE; - spin_unlock_irqrestore(&lcu->lock, flags); - -- do { -- rc = dasd_sleep_on(cqr); -- if (rc && suborder_not_supported(cqr)) -- return -EOPNOTSUPP; -- } while (rc && (cqr->retries > 0)); -- if (rc) { -+ rc = dasd_sleep_on(cqr); -+ if (rc && !suborder_not_supported(cqr)) { - spin_lock_irqsave(&lcu->lock, flags); - lcu->flags |= NEED_UAC_UPDATE; - spin_unlock_irqrestore(&lcu->lock, flags); -diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c -index abe460eac712..cc62d8cc8cfd 100644 ---- a/drivers/s390/scsi/zfcp_erp.c -+++ b/drivers/s390/scsi/zfcp_erp.c -@@ -10,6 +10,7 @@ - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt - - #include -+#include - #include "zfcp_ext.h" - #include "zfcp_reqlist.h" - -@@ -244,6 +245,12 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status, - struct zfcp_erp_action *erp_action; - struct zfcp_scsi_dev *zfcp_sdev; - -+ if (WARN_ON_ONCE(need != ZFCP_ERP_ACTION_REOPEN_LUN && -+ need != ZFCP_ERP_ACTION_REOPEN_PORT && -+ need != ZFCP_ERP_ACTION_REOPEN_PORT_FORCED && -+ need != ZFCP_ERP_ACTION_REOPEN_ADAPTER)) -+ return NULL; -+ - switch (need) { - case ZFCP_ERP_ACTION_REOPEN_LUN: - zfcp_sdev = sdev_to_zfcp(sdev); -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index a8a388382347..80e292227cef 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -365,8 +365,8 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, - /* Convert the size to actually allocated. */ - size = 1UL << (order + XEN_PAGE_SHIFT); - -- if (((dev_addr + size - 1 <= dma_mask)) || -- range_straddles_page_boundary(phys, size)) -+ if (!WARN_ON((dev_addr + size - 1 > dma_mask) || -+ range_straddles_page_boundary(phys, size))) - xen_destroy_contiguous_region(phys, order); - - xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs); -diff --git a/fs/adfs/super.c b/fs/adfs/super.c -index 4d4a0df8344f..b00ae922ece2 100644 ---- a/fs/adfs/super.c -+++ b/fs/adfs/super.c -@@ -368,6 +368,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent) - struct buffer_head *bh; - struct object_info root_obj; - unsigned char *b_data; -+ unsigned int blocksize; - struct adfs_sb_info *asb; - struct inode *root; - int ret = -EINVAL; -@@ -419,8 +420,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent) - goto error_free_bh; - } - -+ blocksize = 1 << dr->log2secsize; - brelse(bh); -- if (sb_set_blocksize(sb, 1 << dr->log2secsize)) { -+ -+ if (sb_set_blocksize(sb, blocksize)) { - bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize); - if (!bh) { - adfs_error(sb, "couldn't read superblock on " -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 4eb7a6ba7e47..55ce6543050d 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -4942,8 +4942,7 @@ static inline int btrfs_chunk_max_errors(struct map_lookup *map) - - if (map->type & (BTRFS_BLOCK_GROUP_RAID1 | - BTRFS_BLOCK_GROUP_RAID10 | -- BTRFS_BLOCK_GROUP_RAID5 | -- BTRFS_BLOCK_GROUP_DUP)) { -+ BTRFS_BLOCK_GROUP_RAID5)) { - max_errors = 1; - } else if (map->type & BTRFS_BLOCK_GROUP_RAID6) { - max_errors = 2; -diff --git a/fs/ceph/super.h b/fs/ceph/super.h -index 8c8cb8fe3d32..5d05c77c158d 100644 ---- a/fs/ceph/super.h -+++ b/fs/ceph/super.h -@@ -474,7 +474,12 @@ static inline void __ceph_dir_set_complete(struct ceph_inode_info *ci, - long long release_count, - long long ordered_count) - { -- smp_mb__before_atomic(); -+ /* -+ * Makes sure operations that setup readdir cache (update page -+ * cache and i_size) are strongly ordered w.r.t. the following -+ * atomic64_set() operations. -+ */ -+ smp_mb(); - atomic64_set(&ci->i_complete_seq[0], release_count); - atomic64_set(&ci->i_complete_seq[1], ordered_count); - } -diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c -index 822629126e89..ff9b5cf8ff01 100644 ---- a/fs/coda/psdev.c -+++ b/fs/coda/psdev.c -@@ -187,8 +187,11 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf, - if (req->uc_opcode == CODA_OPEN_BY_FD) { - struct coda_open_by_fd_out *outp = - (struct coda_open_by_fd_out *)req->uc_data; -- if (!outp->oh.result) -+ if (!outp->oh.result) { - outp->fh = fget(outp->fd); -+ if (!outp->fh) -+ return -EBADF; -+ } - } - - wake_up(&req->uc_sleep); -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index 3672893b275e..6a30f1e03aa9 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -226,7 +226,10 @@ void acpi_set_irq_model(enum acpi_irq_model_id model, - #ifdef CONFIG_X86_IO_APIC - extern int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity); - #else --#define acpi_get_override_irq(gsi, trigger, polarity) (-1) -+static inline int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity) -+{ -+ return -1; -+} - #endif - /* - * This function undoes the effect of one call to acpi_register_gsi(). -diff --git a/include/linux/coda.h b/include/linux/coda.h -index d30209b9cef8..0ca0c83fdb1c 100644 ---- a/include/linux/coda.h -+++ b/include/linux/coda.h -@@ -58,8 +58,7 @@ Mellon the rights to redistribute these changes without encumbrance. - #ifndef _CODA_HEADER_ - #define _CODA_HEADER_ - --#if defined(__linux__) - typedef unsigned long long u_quad_t; --#endif -+ - #include - #endif -diff --git a/include/linux/coda_psdev.h b/include/linux/coda_psdev.h -index 5b8721efa948..fe1466daf291 100644 ---- a/include/linux/coda_psdev.h -+++ b/include/linux/coda_psdev.h -@@ -19,6 +19,17 @@ struct venus_comm { - struct mutex vc_mutex; - }; - -+/* messages between coda filesystem in kernel and Venus */ -+struct upc_req { -+ struct list_head uc_chain; -+ caddr_t uc_data; -+ u_short uc_flags; -+ u_short uc_inSize; /* Size is at most 5000 bytes */ -+ u_short uc_outSize; -+ u_short uc_opcode; /* copied from data to save lookup */ -+ int uc_unique; -+ wait_queue_head_t uc_sleep; /* process' wait queue */ -+}; - - static inline struct venus_comm *coda_vcp(struct super_block *sb) - { -diff --git a/include/uapi/linux/coda_psdev.h b/include/uapi/linux/coda_psdev.h -index 79d05981fc4b..e2c44d2f7d5b 100644 ---- a/include/uapi/linux/coda_psdev.h -+++ b/include/uapi/linux/coda_psdev.h -@@ -6,19 +6,6 @@ - #define CODA_PSDEV_MAJOR 67 - #define MAX_CODADEVS 5 /* how many do we allow */ - -- --/* messages between coda filesystem in kernel and Venus */ --struct upc_req { -- struct list_head uc_chain; -- caddr_t uc_data; -- u_short uc_flags; -- u_short uc_inSize; /* Size is at most 5000 bytes */ -- u_short uc_outSize; -- u_short uc_opcode; /* copied from data to save lookup */ -- int uc_unique; -- wait_queue_head_t uc_sleep; /* process' wait queue */ --}; -- - #define CODA_REQ_ASYNC 0x1 - #define CODA_REQ_READ 0x2 - #define CODA_REQ_WRITE 0x4 -diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index 6ed74825ab54..2a39784d5704 100644 ---- a/ipc/mqueue.c -+++ b/ipc/mqueue.c -@@ -371,7 +371,6 @@ static void mqueue_evict_inode(struct inode *inode) - { - struct mqueue_inode_info *info; - struct user_struct *user; -- unsigned long mq_bytes, mq_treesize; - struct ipc_namespace *ipc_ns; - struct msg_msg *msg, *nmsg; - LIST_HEAD(tmp_msg); -@@ -394,16 +393,18 @@ static void mqueue_evict_inode(struct inode *inode) - free_msg(msg); - } - -- /* Total amount of bytes accounted for the mqueue */ -- mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) + -- min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) * -- sizeof(struct posix_msg_tree_node); -- -- mq_bytes = mq_treesize + (info->attr.mq_maxmsg * -- info->attr.mq_msgsize); -- - user = info->user; - if (user) { -+ unsigned long mq_bytes, mq_treesize; -+ -+ /* Total amount of bytes accounted for the mqueue */ -+ mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) + -+ min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) * -+ sizeof(struct posix_msg_tree_node); -+ -+ mq_bytes = mq_treesize + (info->attr.mq_maxmsg * -+ info->attr.mq_msgsize); -+ - spin_lock(&mq_lock); - user->mq_bytes -= mq_bytes; - /* -diff --git a/kernel/module.c b/kernel/module.c -index bcc78f4c15e9..b940b2825b7b 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -3225,8 +3225,7 @@ static bool finished_loading(const char *name) - sched_annotate_sleep(); - mutex_lock(&module_mutex); - mod = find_module_all(name, strlen(name), true); -- ret = !mod || mod->state == MODULE_STATE_LIVE -- || mod->state == MODULE_STATE_GOING; -+ ret = !mod || mod->state == MODULE_STATE_LIVE; - mutex_unlock(&module_mutex); - - return ret; -@@ -3385,8 +3384,7 @@ again: - mutex_lock(&module_mutex); - old = find_module_all(mod->name, strlen(mod->name), true); - if (old != NULL) { -- if (old->state == MODULE_STATE_COMING -- || old->state == MODULE_STATE_UNFORMED) { -+ if (old->state != MODULE_STATE_LIVE) { - /* Wait in case it fails to load. */ - mutex_unlock(&module_mutex); - err = wait_event_interruptible(module_wq, -diff --git a/mm/cma.c b/mm/cma.c -index 5ae4452656cd..65c7aa419048 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -268,6 +268,12 @@ int __init cma_declare_contiguous(phys_addr_t base, - */ - alignment = max(alignment, (phys_addr_t)PAGE_SIZE << - max_t(unsigned long, MAX_ORDER - 1, pageblock_order)); -+ if (fixed && base & (alignment - 1)) { -+ ret = -EINVAL; -+ pr_err("Region at %pa must be aligned to %pa bytes\n", -+ &base, &alignment); -+ goto err; -+ } - base = ALIGN(base, alignment); - size = ALIGN(size, alignment); - limit &= ~(alignment - 1); -@@ -298,6 +304,13 @@ int __init cma_declare_contiguous(phys_addr_t base, - if (limit == 0 || limit > memblock_end) - limit = memblock_end; - -+ if (base + size > limit) { -+ ret = -EINVAL; -+ pr_err("Size (%pa) of region at %pa exceeds limit (%pa)\n", -+ &size, &base, &limit); -+ goto err; -+ } -+ - /* Reserve memory */ - if (fixed) { - if (memblock_is_region_reserved(base, size) || -diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c -index 965a55eacaba..01fbbbf89f41 100644 ---- a/security/selinux/ss/policydb.c -+++ b/security/selinux/ss/policydb.c -@@ -266,6 +266,8 @@ static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2) - return v; - } - -+static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap); -+ - /* - * Initialize a policy database structure. - */ -@@ -313,8 +315,10 @@ static int policydb_init(struct policydb *p) - out: - hashtab_destroy(p->filename_trans); - hashtab_destroy(p->range_tr); -- for (i = 0; i < SYM_NUM; i++) -+ for (i = 0; i < SYM_NUM; i++) { -+ hashtab_map(p->symtab[i].table, destroy_f[i], NULL); - hashtab_destroy(p->symtab[i].table); -+ } - return rc; - } - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.188-189.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.188-189.patch deleted file mode 100644 index e1ec653dcafe..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.188-189.patch +++ /dev/null @@ -1,584 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 175d57049168..7a9fd54a0186 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2184,6 +2184,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - improves system performance, but it may also - expose users to several CPU vulnerabilities. - Equivalent to: nopti [X86] -+ nospectre_v1 [X86] - nospectre_v2 [X86] - spectre_v2_user=off [X86] - spec_store_bypass_disable=off [X86] -@@ -2498,9 +2499,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nohugeiomap [KNL,x86] Disable kernel huge I/O mappings. - -- nospectre_v1 [PPC] Disable mitigations for Spectre Variant 1 (bounds -- check bypass). With this option data leaks are possible -- in the system. -+ nospectre_v1 [X86,PPC] Disable mitigations for Spectre Variant 1 -+ (bounds check bypass). With this option data leaks are -+ possible in the system. - - nospectre_v2 [X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2 - (indirect branch prediction) vulnerability. System may -diff --git a/Makefile b/Makefile -index 87d663191986..81a0ada6536f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 188 -+SUBLEVEL = 189 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h -index ad83c245781c..0a66f8241f18 100644 ---- a/arch/arm64/include/asm/cpufeature.h -+++ b/arch/arm64/include/asm/cpufeature.h -@@ -41,9 +41,10 @@ - - /* CPU feature register tracking */ - enum ftr_type { -- FTR_EXACT, /* Use a predefined safe value */ -- FTR_LOWER_SAFE, /* Smaller value is safe */ -- FTR_HIGHER_SAFE,/* Bigger value is safe */ -+ FTR_EXACT, /* Use a predefined safe value */ -+ FTR_LOWER_SAFE, /* Smaller value is safe */ -+ FTR_HIGHER_SAFE, /* Bigger value is safe */ -+ FTR_HIGHER_OR_ZERO_SAFE, /* Bigger value is safe, but 0 is biggest */ - }; - - #define FTR_STRICT true /* SANITY check strict matching required */ -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index c1eddc07d996..062484d34450 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -126,10 +126,12 @@ static struct arm64_ftr_bits ftr_id_aa64mmfr1[] = { - }; - - static struct arm64_ftr_bits ftr_ctr[] = { -- U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RAO */ -- ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 28, 3, 0), -- U_ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0), /* CWG */ -- U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0), /* ERG */ -+ U_ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RES1 */ -+ ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 30, 1, 0), -+ U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 29, 1, 1), /* DIC */ -+ U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 28, 1, 1), /* IDC */ -+ U_ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, 24, 4, 0), /* CWG */ -+ U_ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, 20, 4, 0), /* ERG */ - U_ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1), /* DminLine */ - /* - * Linux can handle differing I-cache policies. Userspace JITs will -@@ -339,6 +341,10 @@ static s64 arm64_ftr_safe_value(struct arm64_ftr_bits *ftrp, s64 new, s64 cur) - case FTR_LOWER_SAFE: - ret = new < cur ? new : cur; - break; -+ case FTR_HIGHER_OR_ZERO_SAFE: -+ if (!cur || !new) -+ break; -+ /* Fallthrough */ - case FTR_HIGHER_SAFE: - ret = new > cur ? new : cur; - break; -diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h -index 3c71dd947c7b..5e24cd248728 100644 ---- a/arch/x86/entry/calling.h -+++ b/arch/x86/entry/calling.h -@@ -1,3 +1,5 @@ -+#include -+ - /* - - x86 function call convention, 64-bit: -@@ -199,6 +201,23 @@ For 32-bit we have the following conventions - kernel is built with - .byte 0xf1 - .endm - -+/* -+ * Mitigate Spectre v1 for conditional swapgs code paths. -+ * -+ * FENCE_SWAPGS_USER_ENTRY is used in the user entry swapgs code path, to -+ * prevent a speculative swapgs when coming from kernel space. -+ * -+ * FENCE_SWAPGS_KERNEL_ENTRY is used in the kernel entry non-swapgs code path, -+ * to prevent the swapgs from getting speculatively skipped when coming from -+ * user space. -+ */ -+.macro FENCE_SWAPGS_USER_ENTRY -+ ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_USER -+.endm -+.macro FENCE_SWAPGS_KERNEL_ENTRY -+ ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_KERNEL -+.endm -+ - #else /* CONFIG_X86_64 */ - - /* -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 375ed605c83d..afb805b0148b 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -551,6 +551,7 @@ END(irq_entries_start) - * tracking that we're in kernel mode. - */ - SWAPGS -+ FENCE_SWAPGS_USER_ENTRY - SWITCH_KERNEL_CR3 - - /* -@@ -566,8 +567,10 @@ END(irq_entries_start) - #ifdef CONFIG_CONTEXT_TRACKING - call enter_from_user_mode - #endif -- -+ jmp 2f - 1: -+ FENCE_SWAPGS_KERNEL_ENTRY -+2: - /* - * Save previous stack pointer, optionally switch to interrupt stack. - * irq_count is used to check if a CPU is already on an interrupt stack -@@ -1077,6 +1080,13 @@ ENTRY(paranoid_entry) - movq %rax, %cr3 - 2: - #endif -+ /* -+ * The above doesn't do an unconditional CR3 write, even in the PTI -+ * case. So do an lfence to prevent GS speculation, regardless of -+ * whether PTI is enabled. -+ */ -+ FENCE_SWAPGS_KERNEL_ENTRY -+ - ret - END(paranoid_entry) - -@@ -1133,12 +1143,12 @@ ENTRY(error_entry) - testb $3, CS+8(%rsp) - jz .Lerror_kernelspace - --.Lerror_entry_from_usermode_swapgs: - /* - * We entered from user mode or we're pretending to have entered - * from user mode due to an IRET fault. - */ - SWAPGS -+ FENCE_SWAPGS_USER_ENTRY - - .Lerror_entry_from_usermode_after_swapgs: - /* -@@ -1152,6 +1162,8 @@ ENTRY(error_entry) - #endif - ret - -+.Lerror_entry_done_lfence: -+ FENCE_SWAPGS_KERNEL_ENTRY - .Lerror_entry_done: - TRACE_IRQS_OFF - ret -@@ -1170,14 +1182,16 @@ ENTRY(error_entry) - cmpq %rax, RIP+8(%rsp) - je .Lbstep_iret - cmpq $gs_change, RIP+8(%rsp) -- jne .Lerror_entry_done -+ jne .Lerror_entry_done_lfence - - /* - * hack: gs_change can fail with user gsbase. If this happens, fix up - * gsbase and proceed. We'll fix up the exception and land in - * gs_change's error handler with kernel gsbase. - */ -- jmp .Lerror_entry_from_usermode_swapgs -+ SWAPGS -+ FENCE_SWAPGS_USER_ENTRY -+ jmp .Lerror_entry_done - - .Lbstep_iret: - /* Fix truncated RIP */ -@@ -1190,6 +1204,7 @@ ENTRY(error_entry) - * Switch to kernel gsbase: - */ - SWAPGS -+ FENCE_SWAPGS_USER_ENTRY - - /* - * Pretend that the exception came from user mode: set up pt_regs -@@ -1286,6 +1301,7 @@ ENTRY(nmi) - * to switch CR3 here. - */ - cld -+ FENCE_SWAPGS_USER_ENTRY - movq %rsp, %rdx - movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp - pushq 5*8(%rdx) /* pt_regs->ss */ -@@ -1574,6 +1590,7 @@ end_repeat_nmi: - movq %rax, %cr3 - 2: - #endif -+ FENCE_SWAPGS_KERNEL_ENTRY - - /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ - call do_nmi -diff --git a/block/blk-core.c b/block/blk-core.c -index 50d77c90070d..7662f97dded6 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -870,6 +870,7 @@ blk_init_allocated_queue(struct request_queue *q, request_fn_proc *rfn, - - fail: - blk_free_flush_queue(q->fq); -+ q->fq = NULL; - return NULL; - } - EXPORT_SYMBOL(blk_init_allocated_queue); -diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c -index 7d00f2994738..860a33a90ebf 100644 ---- a/drivers/atm/iphase.c -+++ b/drivers/atm/iphase.c -@@ -63,6 +63,7 @@ - #include - #include - #include -+#include - #include "iphase.h" - #include "suni.h" - #define swap_byte_order(x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8)) -@@ -2755,8 +2756,11 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg) - } - if (copy_from_user(&ia_cmds, arg, sizeof ia_cmds)) return -EFAULT; - board = ia_cmds.status; -- if ((board < 0) || (board > iadev_count)) -- board = 0; -+ -+ if ((board < 0) || (board > iadev_count)) -+ board = 0; -+ board = array_index_nospec(board, iadev_count + 1); -+ - iadev = ia_dev[board]; - switch (ia_cmds.cmd) { - case MEMDUMP: -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 00d8366a614e..e1807296a1a0 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -470,6 +470,7 @@ - #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a - #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a - #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a -+#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641 - - #define USB_VENDOR_ID_HUION 0x256c - #define USB_DEVICE_ID_HUION_TABLET 0x006e -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index c9a11315493b..5dcdfdca4fd7 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -82,6 +82,7 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, -+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL }, -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -index 4dc5e12dbfce..13de5ce3facf 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -@@ -1957,7 +1957,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, - } - - /* select a non-FCoE queue */ -- return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos); -+ return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp)); - } - - void bnx2x_set_num_queues(struct bnx2x *bp) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 7c42be586be8..35bcc6dbada9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -778,7 +778,7 @@ static void mlx5_unregister_device(struct mlx5_core_dev *dev) - struct mlx5_interface *intf; - - mutex_lock(&intf_mutex); -- list_for_each_entry(intf, &intf_list, list) -+ list_for_each_entry_reverse(intf, &intf_list, list) - mlx5_remove_device(intf, priv); - list_del(&priv->dev_list); - mutex_unlock(&intf_mutex); -diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c -index 02327e6c4819..39976892b312 100644 ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -1152,6 +1152,9 @@ static const struct proto_ops pppoe_ops = { - .recvmsg = pppoe_recvmsg, - .mmap = sock_no_mmap, - .ioctl = pppox_ioctl, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = pppox_compat_ioctl, -+#endif - }; - - static const struct pppox_proto pppoe_proto = { -diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c -index 0e1b30622477..011fbd10cb73 100644 ---- a/drivers/net/ppp/pppox.c -+++ b/drivers/net/ppp/pppox.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -103,6 +104,18 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) - - EXPORT_SYMBOL(pppox_ioctl); - -+#ifdef CONFIG_COMPAT -+int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) -+{ -+ if (cmd == PPPOEIOCSFWD32) -+ cmd = PPPOEIOCSFWD; -+ -+ return pppox_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); -+} -+ -+EXPORT_SYMBOL(pppox_compat_ioctl); -+#endif -+ - static int pppox_create(struct net *net, struct socket *sock, int protocol, - int kern) - { -diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c -index 53c1f2bd0f24..19d0692a2d2f 100644 ---- a/drivers/net/ppp/pptp.c -+++ b/drivers/net/ppp/pptp.c -@@ -674,6 +674,9 @@ static const struct proto_ops pptp_ops = { - .recvmsg = sock_no_recvmsg, - .mmap = sock_no_mmap, - .ioctl = pppox_ioctl, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = pppox_compat_ioctl, -+#endif - }; - - static const struct pppox_proto pppox_pptp_proto = { -diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c -index 1a1368f5863c..25daebd6f410 100644 ---- a/drivers/spi/spi-bcm2835.c -+++ b/drivers/spi/spi-bcm2835.c -@@ -554,7 +554,8 @@ static int bcm2835_spi_transfer_one(struct spi_master *master, - bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv); - - /* handle all the 3-wire mode */ -- if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf)) -+ if (spi->mode & SPI_3WIRE && tfr->rx_buf && -+ tfr->rx_buf != master->dummy_rx) - cs |= BCM2835_SPI_CS_REN; - else - cs &= ~BCM2835_SPI_CS_REN; -diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index a52ca5cba015..5af973621c73 100644 ---- a/fs/compat_ioctl.c -+++ b/fs/compat_ioctl.c -@@ -1016,9 +1016,6 @@ COMPATIBLE_IOCTL(PPPIOCDISCONN) - COMPATIBLE_IOCTL(PPPIOCATTCHAN) - COMPATIBLE_IOCTL(PPPIOCGCHAN) - COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS) --/* PPPOX */ --COMPATIBLE_IOCTL(PPPOEIOCSFWD) --COMPATIBLE_IOCTL(PPPOEIOCDFWD) - /* ppdev */ - COMPATIBLE_IOCTL(PPSETMODE) - COMPATIBLE_IOCTL(PPRSTATUS) -diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h -index b49cf923becc..93ef387eadb1 100644 ---- a/include/linux/if_pppox.h -+++ b/include/linux/if_pppox.h -@@ -84,6 +84,9 @@ extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp); - extern void unregister_pppox_proto(int proto_num); - extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */ - extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); -+extern int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); -+ -+#define PPPOEIOCSFWD32 _IOW(0xB1 ,0, compat_size_t) - - /* PPPoX socket states */ - enum { -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 77438a8406ec..0410fd29d569 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1526,6 +1526,23 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli - tcp_sk(sk)->highest_sack = NULL; - } - -+static inline struct sk_buff *tcp_rtx_queue_head(const struct sock *sk) -+{ -+ struct sk_buff *skb = tcp_write_queue_head(sk); -+ -+ if (skb == tcp_send_head(sk)) -+ skb = NULL; -+ -+ return skb; -+} -+ -+static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk) -+{ -+ struct sk_buff *skb = tcp_send_head(sk); -+ -+ return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk); -+} -+ - static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb) - { - __skb_queue_tail(&sk->sk_write_queue, skb); -diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c -index 1394da63614a..a7953962112a 100644 ---- a/net/bridge/br_vlan.c -+++ b/net/bridge/br_vlan.c -@@ -580,6 +580,11 @@ void br_vlan_flush(struct net_bridge *br) - - ASSERT_RTNL(); - -+ /* delete auto-added default pvid local fdb before flushing vlans -+ * otherwise it will be leaked on bridge device init failure -+ */ -+ br_fdb_delete_by_port(br, NULL, 0, 1); -+ - vg = br_vlan_group(br); - __vlan_flush(vg); - RCU_INIT_POINTER(br->vlgrp, NULL); -diff --git a/net/core/dev.c b/net/core/dev.c -index db5345f5f7b0..152e1e6316e6 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -7768,6 +7768,8 @@ static void __net_exit default_device_exit(struct net *net) - - /* Push remaining network devices to init_net */ - snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex); -+ if (__dev_get_by_name(&init_net, fb_name)) -+ snprintf(fb_name, IFNAMSIZ, "dev%%d"); - err = dev_change_net_namespace(dev, &init_net, fb_name); - if (err) { - pr_emerg("%s: failed to move %s to init_net: %d\n", -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 53edd60fd381..76ffce0c18ae 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1151,6 +1151,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, - struct tcp_sock *tp = tcp_sk(sk); - struct sk_buff *buff; - int nsize, old_factor; -+ long limit; - int nlen; - u8 flags; - -@@ -1161,7 +1162,15 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, - if (nsize < 0) - nsize = 0; - -- if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf + 0x20000)) { -+ /* tcp_sendmsg() can overshoot sk_wmem_queued by one full size skb. -+ * We need some allowance to not penalize applications setting small -+ * SO_SNDBUF values. -+ * Also allow first and last skb in retransmit queue to be split. -+ */ -+ limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE); -+ if (unlikely((sk->sk_wmem_queued >> 1) > limit && -+ skb != tcp_rtx_queue_head(sk) && -+ skb != tcp_rtx_queue_tail(sk))) { - NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG); - return -ENOMEM; - } -diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c -index 2764c4bd072c..d3f1222c1a8c 100644 ---- a/net/l2tp/l2tp_ppp.c -+++ b/net/l2tp/l2tp_ppp.c -@@ -1805,6 +1805,9 @@ static const struct proto_ops pppol2tp_ops = { - .recvmsg = pppol2tp_recvmsg, - .mmap = sock_no_mmap, - .ioctl = pppox_ioctl, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = pppox_compat_ioctl, -+#endif - }; - - static const struct pppox_proto pppol2tp_proto = { -diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c -index 088e8da06b00..0f3cb410e42e 100644 ---- a/net/netfilter/nfnetlink_acct.c -+++ b/net/netfilter/nfnetlink_acct.c -@@ -97,6 +97,8 @@ nfnl_acct_new(struct sock *nfnl, struct sk_buff *skb, - return -EINVAL; - if (flags & NFACCT_F_OVERQUOTA) - return -EINVAL; -+ if ((flags & NFACCT_F_QUOTA) && !tb[NFACCT_QUOTA]) -+ return -EINVAL; - - size += sizeof(u64); - } -diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c -index 9b7e2980ee5c..3bc5dec3b17b 100644 ---- a/net/sched/sch_codel.c -+++ b/net/sched/sch_codel.c -@@ -68,7 +68,8 @@ static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch) - { - struct sk_buff *skb = __skb_dequeue(&sch->q); - -- prefetch(&skb->end); /* we'll need skb_shinfo() */ -+ if (skb) -+ prefetch(&skb->end); /* we'll need skb_shinfo() */ - return skb; - } - -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index 9a65664f749c..d2bf92e71150 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -55,6 +55,7 @@ struct tipc_nl_compat_msg { - int rep_type; - int rep_size; - int req_type; -+ int req_size; - struct net *net; - struct sk_buff *rep; - struct tlv_desc *req; -@@ -252,7 +253,8 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - int err; - struct sk_buff *arg; - -- if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type)) -+ if (msg->req_type && (!msg->req_size || -+ !TLV_CHECK_TYPE(msg->req, msg->req_type))) - return -EINVAL; - - msg->rep = tipc_tlv_alloc(msg->rep_size); -@@ -345,7 +347,8 @@ static int tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd, - { - int err; - -- if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type)) -+ if (msg->req_type && (!msg->req_size || -+ !TLV_CHECK_TYPE(msg->req, msg->req_type))) - return -EINVAL; - - err = __tipc_nl_compat_doit(cmd, msg); -@@ -1192,8 +1195,8 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info) - goto send; - } - -- len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN); -- if (!len || !TLV_OK(msg.req, len)) { -+ msg.req_size = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN); -+ if (msg.req_size && !TLV_OK(msg.req, msg.req_size)) { - msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED); - err = -EOPNOTSUPP; - goto send; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.189-190.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.189-190.patch deleted file mode 100644 index 49f617239057..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.189-190.patch +++ /dev/null @@ -1,1939 +0,0 @@ -diff --git a/Makefile b/Makefile -index 81a0ada6536f..83acf2d6c55e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 189 -+SUBLEVEL = 190 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S -index a5336a5e2739..459d081caf79 100644 ---- a/arch/arm/mach-davinci/sleep.S -+++ b/arch/arm/mach-davinci/sleep.S -@@ -37,6 +37,7 @@ - #define DEEPSLEEP_SLEEPENABLE_BIT BIT(31) - - .text -+ .arch armv5te - /* - * Move DaVinci into deep sleep state - * -diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c -index eeebfc315526..036fbb959821 100644 ---- a/arch/arm64/kernel/hw_breakpoint.c -+++ b/arch/arm64/kernel/hw_breakpoint.c -@@ -504,13 +504,14 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp) - /* Aligned */ - break; - case 1: -- /* Allow single byte watchpoint. */ -- if (info->ctrl.len == ARM_BREAKPOINT_LEN_1) -- break; - case 2: - /* Allow halfword watchpoints and breakpoints. */ - if (info->ctrl.len == ARM_BREAKPOINT_LEN_2) - break; -+ case 3: -+ /* Allow single byte watchpoint. */ -+ if (info->ctrl.len == ARM_BREAKPOINT_LEN_1) -+ break; - default: - return -EINVAL; - } -diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c -index 2197fc584186..000cc3343867 100644 ---- a/arch/sh/kernel/hw_breakpoint.c -+++ b/arch/sh/kernel/hw_breakpoint.c -@@ -160,6 +160,7 @@ int arch_bp_generic_fields(int sh_len, int sh_type, - switch (sh_type) { - case SH_BREAKPOINT_READ: - *gen_type = HW_BREAKPOINT_R; -+ break; - case SH_BREAKPOINT_WRITE: - *gen_type = HW_BREAKPOINT_W; - break; -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index efa6073ffa7e..bf0c7b6b00c3 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -30,6 +30,7 @@ KBUILD_CFLAGS += $(cflags-y) - KBUILD_CFLAGS += -mno-mmx -mno-sse - KBUILD_CFLAGS += $(call cc-option,-ffreestanding) - KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector) -+KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) - - KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ - GCOV_PROFILE := n -diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c -index 049327ee8868..6badfe41dbe0 100644 ---- a/arch/x86/entry/vdso/vclock_gettime.c -+++ b/arch/x86/entry/vdso/vclock_gettime.c -@@ -13,7 +13,6 @@ - - #include - #include --#include - #include - #include - #include -@@ -26,16 +25,6 @@ extern int __vdso_clock_gettime(clockid_t clock, struct timespec *ts); - extern int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz); - extern time_t __vdso_time(time_t *t); - --#ifdef CONFIG_HPET_TIMER --extern u8 hpet_page -- __attribute__((visibility("hidden"))); -- --static notrace cycle_t vread_hpet(void) --{ -- return *(const volatile u32 *)(&hpet_page + HPET_COUNTER); --} --#endif -- - #ifdef CONFIG_PARAVIRT_CLOCK - extern u8 pvclock_page - __attribute__((visibility("hidden"))); -@@ -209,10 +198,6 @@ notrace static inline u64 vgetsns(int *mode) - - if (gtod->vclock_mode == VCLOCK_TSC) - cycles = vread_tsc(); --#ifdef CONFIG_HPET_TIMER -- else if (gtod->vclock_mode == VCLOCK_HPET) -- cycles = vread_hpet(); --#endif - #ifdef CONFIG_PARAVIRT_CLOCK - else if (gtod->vclock_mode == VCLOCK_PVCLOCK) - cycles = vread_pvclock(mode); -diff --git a/arch/x86/entry/vdso/vdso-layout.lds.S b/arch/x86/entry/vdso/vdso-layout.lds.S -index 4158acc17df0..a708aa90b507 100644 ---- a/arch/x86/entry/vdso/vdso-layout.lds.S -+++ b/arch/x86/entry/vdso/vdso-layout.lds.S -@@ -25,7 +25,7 @@ SECTIONS - * segment. - */ - -- vvar_start = . - 3 * PAGE_SIZE; -+ vvar_start = . - 2 * PAGE_SIZE; - vvar_page = vvar_start; - - /* Place all vvars at the offsets in asm/vvar.h. */ -@@ -35,8 +35,7 @@ SECTIONS - #undef __VVAR_KERNEL_LDS - #undef EMIT_VVAR - -- hpet_page = vvar_start + PAGE_SIZE; -- pvclock_page = vvar_start + 2 * PAGE_SIZE; -+ pvclock_page = vvar_start + PAGE_SIZE; - - . = SIZEOF_HEADERS; - -diff --git a/arch/x86/include/asm/clocksource.h b/arch/x86/include/asm/clocksource.h -index eda81dc0f4ae..c843fed8fc5e 100644 ---- a/arch/x86/include/asm/clocksource.h -+++ b/arch/x86/include/asm/clocksource.h -@@ -5,8 +5,7 @@ - - #define VCLOCK_NONE 0 /* No vDSO clock available. */ - #define VCLOCK_TSC 1 /* vDSO should use vread_tsc. */ --#define VCLOCK_HPET 2 /* vDSO should use vread_hpet. */ --#define VCLOCK_PVCLOCK 3 /* vDSO should use vread_pvclock. */ -+#define VCLOCK_PVCLOCK 2 /* vDSO should use vread_pvclock. */ - - struct arch_clocksource_data { - int vclock_mode; -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index 9cce5504a5c7..e8d20336f398 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -774,7 +774,6 @@ static struct clocksource clocksource_hpet = { - .mask = HPET_MASK, - .flags = CLOCK_SOURCE_IS_CONTINUOUS, - .resume = hpet_resume_counter, -- .archdata = { .vclock_mode = VCLOCK_HPET }, - }; - - static int hpet_clocksource_register(void) -diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h -index 0ec94c6b4757..0a187b9607ba 100644 ---- a/arch/x86/kvm/trace.h -+++ b/arch/x86/kvm/trace.h -@@ -809,8 +809,7 @@ TRACE_EVENT(kvm_write_tsc_offset, - - #define host_clocks \ - {VCLOCK_NONE, "none"}, \ -- {VCLOCK_TSC, "tsc"}, \ -- {VCLOCK_HPET, "hpet"} \ -+ {VCLOCK_TSC, "tsc"} \ - - TRACE_EVENT(kvm_update_master_clock, - TP_PROTO(bool use_master_clock, unsigned int host_clock, bool offset_matched), -diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index 462c5c30b9a2..0e498683295b 100644 ---- a/arch/x86/mm/fault.c -+++ b/arch/x86/mm/fault.c -@@ -216,13 +216,14 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address) - - pmd = pmd_offset(pud, address); - pmd_k = pmd_offset(pud_k, address); -- if (!pmd_present(*pmd_k)) -- return NULL; - -- if (!pmd_present(*pmd)) -+ if (pmd_present(*pmd) != pmd_present(*pmd_k)) - set_pmd(pmd, *pmd_k); -+ -+ if (!pmd_present(*pmd_k)) -+ return NULL; - else -- BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k)); -+ BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k)); - - return pmd_k; - } -@@ -242,17 +243,13 @@ void vmalloc_sync_all(void) - spin_lock(&pgd_lock); - list_for_each_entry(page, &pgd_list, lru) { - spinlock_t *pgt_lock; -- pmd_t *ret; - - /* the pgt_lock only for Xen */ - pgt_lock = &pgd_page_get_mm(page)->page_table_lock; - - spin_lock(pgt_lock); -- ret = vmalloc_sync_one(page_address(page), address); -+ vmalloc_sync_one(page_address(page), address); - spin_unlock(pgt_lock); -- -- if (!ret) -- break; - } - spin_unlock(&pgd_lock); - } -diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c -index cd2eab6aa92e..65371e1befe8 100644 ---- a/drivers/ata/libahci_platform.c -+++ b/drivers/ata/libahci_platform.c -@@ -300,6 +300,9 @@ static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port, - hpriv->phys[port] = NULL; - rc = 0; - break; -+ case -EPROBE_DEFER: -+ /* Do not complain yet */ -+ break; - - default: - dev_err(dev, -diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c -index 7017a81d53cf..083856272e92 100644 ---- a/drivers/ata/libata-zpodd.c -+++ b/drivers/ata/libata-zpodd.c -@@ -55,7 +55,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev) - unsigned int ret; - struct rm_feature_desc *desc; - struct ata_taskfile tf; -- static const char cdb[] = { GPCMD_GET_CONFIGURATION, -+ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_GET_CONFIGURATION, - 2, /* only 1 feature descriptor requested */ - 0, 3, /* 3, removable medium feature */ - 0, 0, 0,/* reserved */ -diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c -index 58c933f48300..991b6a3062c4 100644 ---- a/drivers/cpufreq/pasemi-cpufreq.c -+++ b/drivers/cpufreq/pasemi-cpufreq.c -@@ -145,10 +145,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) - int err = -ENODEV; - - cpu = of_get_cpu_node(policy->cpu, NULL); -+ if (!cpu) -+ goto out; - -+ max_freqp = of_get_property(cpu, "clock-frequency", NULL); - of_node_put(cpu); -- if (!cpu) -+ if (!max_freqp) { -+ err = -EINVAL; - goto out; -+ } -+ -+ /* we need the freq in kHz */ -+ max_freq = *max_freqp / 1000; - - dn = of_find_compatible_node(NULL, NULL, "1682m-sdc"); - if (!dn) -@@ -185,16 +193,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) - } - - pr_debug("init cpufreq on CPU %d\n", policy->cpu); -- -- max_freqp = of_get_property(cpu, "clock-frequency", NULL); -- if (!max_freqp) { -- err = -EINVAL; -- goto out_unmap_sdcpwr; -- } -- -- /* we need the freq in kHz */ -- max_freq = *max_freqp / 1000; -- - pr_debug("max clock-frequency is at %u kHz\n", max_freq); - pr_debug("initializing frequency table\n"); - -@@ -212,9 +210,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy) - - return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency()); - --out_unmap_sdcpwr: -- iounmap(sdcpwr_mapbase); -- - out_unmap_sdcasr: - iounmap(sdcasr_mapbase); - out: -diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig -index cf478fe6b335..b0d42234fba0 100644 ---- a/drivers/firmware/Kconfig -+++ b/drivers/firmware/Kconfig -@@ -135,7 +135,7 @@ config DMI_SCAN_MACHINE_NON_EFI_FALLBACK - - config ISCSI_IBFT_FIND - bool "iSCSI Boot Firmware Table Attributes" -- depends on X86 && ACPI -+ depends on X86 && ISCSI_IBFT - default n - help - This option enables the kernel to find the region of memory -@@ -146,7 +146,8 @@ config ISCSI_IBFT_FIND - config ISCSI_IBFT - tristate "iSCSI Boot Firmware Table Attributes module" - select ISCSI_BOOT_SYSFS -- depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL -+ select ISCSI_IBFT_FIND if X86 -+ depends on ACPI && SCSI && SCSI_LOWLEVEL - default n - help - This option enables support for detection and exposing of iSCSI -diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c -index 437c8ef90643..30d67fbe00c7 100644 ---- a/drivers/firmware/iscsi_ibft.c -+++ b/drivers/firmware/iscsi_ibft.c -@@ -93,6 +93,10 @@ MODULE_DESCRIPTION("sysfs interface to BIOS iBFT information"); - MODULE_LICENSE("GPL"); - MODULE_VERSION(IBFT_ISCSI_VERSION); - -+#ifndef CONFIG_ISCSI_IBFT_FIND -+struct acpi_table_ibft *ibft_addr; -+#endif -+ - struct ibft_hdr { - u8 id; - u8 version; -diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c -index 6e1a4a4fc0c1..ab9da597106f 100644 ---- a/drivers/hid/hid-holtek-kbd.c -+++ b/drivers/hid/hid-holtek-kbd.c -@@ -126,9 +126,14 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type, - - /* Locate the boot interface, to receive the LED change events */ - struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0); -+ struct hid_device *boot_hid; -+ struct hid_input *boot_hid_input; - -- struct hid_device *boot_hid = usb_get_intfdata(boot_interface); -- struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs, -+ if (unlikely(boot_interface == NULL)) -+ return -ENODEV; -+ -+ boot_hid = usb_get_intfdata(boot_interface); -+ boot_hid_input = list_first_entry(&boot_hid->inputs, - struct hid_input, list); - - return boot_hid_input->input->event(boot_hid_input->input, type, code, -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index 308d8432fea3..8903ea09ac58 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -308,6 +308,14 @@ static int hiddev_open(struct inode *inode, struct file *file) - spin_unlock_irq(&list->hiddev->list_lock); - - mutex_lock(&hiddev->existancelock); -+ /* -+ * recheck exist with existance lock held to -+ * avoid opening a disconnected device -+ */ -+ if (!list->hiddev->exist) { -+ res = -ENODEV; -+ goto bail_unlock; -+ } - if (!list->hiddev->open++) - if (list->hiddev->exist) { - struct hid_device *hid = hiddev->hid; -@@ -322,6 +330,10 @@ static int hiddev_open(struct inode *inode, struct file *file) - return 0; - bail_unlock: - mutex_unlock(&hiddev->existancelock); -+ -+ spin_lock_irq(&list->hiddev->list_lock); -+ list_del(&list->node); -+ spin_unlock_irq(&list->hiddev->list_lock); - bail: - file->private_data = NULL; - vfree(list); -diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c -index d3c6115f16b9..db38dff3f986 100644 ---- a/drivers/hwmon/nct6775.c -+++ b/drivers/hwmon/nct6775.c -@@ -696,7 +696,7 @@ static const u16 NCT6106_REG_TARGET[] = { 0x111, 0x121, 0x131 }; - static const u16 NCT6106_REG_WEIGHT_TEMP_SEL[] = { 0x168, 0x178, 0x188 }; - static const u16 NCT6106_REG_WEIGHT_TEMP_STEP[] = { 0x169, 0x179, 0x189 }; - static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL[] = { 0x16a, 0x17a, 0x18a }; --static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x17c }; -+static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x18b }; - static const u16 NCT6106_REG_WEIGHT_TEMP_BASE[] = { 0x16c, 0x17c, 0x18c }; - static const u16 NCT6106_REG_WEIGHT_DUTY_BASE[] = { 0x16d, 0x17d, 0x18d }; - -@@ -3478,6 +3478,7 @@ static int nct6775_probe(struct platform_device *pdev) - data->REG_FAN_TIME[0] = NCT6106_REG_FAN_STOP_TIME; - data->REG_FAN_TIME[1] = NCT6106_REG_FAN_STEP_UP_TIME; - data->REG_FAN_TIME[2] = NCT6106_REG_FAN_STEP_DOWN_TIME; -+ data->REG_TOLERANCE_H = NCT6106_REG_TOLERANCE_H; - data->REG_PWM[0] = NCT6106_REG_PWM; - data->REG_PWM[1] = NCT6106_REG_FAN_START_OUTPUT; - data->REG_PWM[2] = NCT6106_REG_FAN_STOP_OUTPUT; -diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c -index 12b94b094c0d..7f8738a83cb9 100644 ---- a/drivers/hwmon/nct7802.c -+++ b/drivers/hwmon/nct7802.c -@@ -768,7 +768,7 @@ static struct attribute *nct7802_in_attrs[] = { - &sensor_dev_attr_in3_alarm.dev_attr.attr, - &sensor_dev_attr_in3_beep.dev_attr.attr, - -- &sensor_dev_attr_in4_input.dev_attr.attr, /* 17 */ -+ &sensor_dev_attr_in4_input.dev_attr.attr, /* 16 */ - &sensor_dev_attr_in4_min.dev_attr.attr, - &sensor_dev_attr_in4_max.dev_attr.attr, - &sensor_dev_attr_in4_alarm.dev_attr.attr, -@@ -794,9 +794,9 @@ static umode_t nct7802_in_is_visible(struct kobject *kobj, - - if (index >= 6 && index < 11 && (reg & 0x03) != 0x03) /* VSEN1 */ - return 0; -- if (index >= 11 && index < 17 && (reg & 0x0c) != 0x0c) /* VSEN2 */ -+ if (index >= 11 && index < 16 && (reg & 0x0c) != 0x0c) /* VSEN2 */ - return 0; -- if (index >= 17 && (reg & 0x30) != 0x30) /* VSEN3 */ -+ if (index >= 16 && (reg & 0x30) != 0x30) /* VSEN3 */ - return 0; - - return attr->mode; -diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c -index 864a7c8d82d3..68835de07e07 100644 ---- a/drivers/infiniband/core/addr.c -+++ b/drivers/infiniband/core/addr.c -@@ -481,14 +481,13 @@ int rdma_addr_find_dmac_by_grh(const union ib_gid *sgid, const union ib_gid *dgi - struct net_device *dev; - - union { -- struct sockaddr _sockaddr; - struct sockaddr_in _sockaddr_in; - struct sockaddr_in6 _sockaddr_in6; - } sgid_addr, dgid_addr; - - -- rdma_gid2ip(&sgid_addr._sockaddr, sgid); -- rdma_gid2ip(&dgid_addr._sockaddr, dgid); -+ rdma_gid2ip((struct sockaddr *)&sgid_addr, sgid); -+ rdma_gid2ip((struct sockaddr *)&dgid_addr, dgid); - - memset(&dev_addr, 0, sizeof(dev_addr)); - dev_addr.bound_dev_if = if_index; -@@ -496,8 +495,9 @@ int rdma_addr_find_dmac_by_grh(const union ib_gid *sgid, const union ib_gid *dgi - - ctx.addr = &dev_addr; - init_completion(&ctx.comp); -- ret = rdma_resolve_ip(&self, &sgid_addr._sockaddr, &dgid_addr._sockaddr, -- &dev_addr, 1000, resolve_cb, &ctx); -+ ret = rdma_resolve_ip(&self, (struct sockaddr *)&sgid_addr, -+ (struct sockaddr *)&dgid_addr, &dev_addr, 1000, -+ resolve_cb, &ctx); - if (ret) - return ret; - -@@ -519,16 +519,15 @@ int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id) - int ret = 0; - struct rdma_dev_addr dev_addr; - union { -- struct sockaddr _sockaddr; - struct sockaddr_in _sockaddr_in; - struct sockaddr_in6 _sockaddr_in6; - } gid_addr; - -- rdma_gid2ip(&gid_addr._sockaddr, sgid); -+ rdma_gid2ip((struct sockaddr *)&gid_addr, sgid); - - memset(&dev_addr, 0, sizeof(dev_addr)); - dev_addr.net = &init_net; -- ret = rdma_translate_ip(&gid_addr._sockaddr, &dev_addr, vlan_id); -+ ret = rdma_translate_ip((struct sockaddr *)&gid_addr, &dev_addr, vlan_id); - if (ret) - return ret; - -diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c -index 57f281f8d686..e9e75f40714c 100644 ---- a/drivers/infiniband/core/user_mad.c -+++ b/drivers/infiniband/core/user_mad.c -@@ -49,6 +49,7 @@ - #include - #include - #include -+#include - - #include - -@@ -842,11 +843,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg) - - if (get_user(id, arg)) - return -EFAULT; -+ if (id >= IB_UMAD_MAX_AGENTS) -+ return -EINVAL; - - mutex_lock(&file->port->file_mutex); - mutex_lock(&file->mutex); - -- if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) { -+ id = array_index_nospec(id, IB_UMAD_MAX_AGENTS); -+ if (!__get_agent(file, id)) { - ret = -EINVAL; - goto out; - } -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index 3399271c235b..170368bb7c1d 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -792,7 +792,7 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem, - struct device *ddev = dev->ib_dev.dma_device; - struct umr_common *umrc = &dev->umrc; - struct mlx5_ib_umr_context umr_context; -- struct mlx5_umr_wr umrwr; -+ struct mlx5_umr_wr umrwr = {}; - struct ib_send_wr *bad; - struct mlx5_ib_mr *mr; - struct ib_sge sg; -@@ -839,7 +839,6 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem, - goto free_pas; - } - -- memset(&umrwr, 0, sizeof(umrwr)); - umrwr.wr.wr_id = (u64)(unsigned long)&umr_context; - prep_umr_reg_wqe(pd, &umrwr.wr, &sg, dma, npages, mr->mmr.key, - page_shift, virt_addr, len, access_flags); -@@ -1163,11 +1162,10 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr) - { - struct umr_common *umrc = &dev->umrc; - struct mlx5_ib_umr_context umr_context; -- struct mlx5_umr_wr umrwr; -+ struct mlx5_umr_wr umrwr = {}; - struct ib_send_wr *bad; - int err; - -- memset(&umrwr.wr, 0, sizeof(umrwr)); - umrwr.wr.wr_id = (u64)(unsigned long)&umr_context; - prep_umr_unreg_wqe(dev, &umrwr.wr, mr->mmr.key); - -diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c -index db64adfbe1af..3e1ea912b41d 100644 ---- a/drivers/input/joystick/iforce/iforce-usb.c -+++ b/drivers/input/joystick/iforce/iforce-usb.c -@@ -145,7 +145,12 @@ static int iforce_usb_probe(struct usb_interface *intf, - return -ENODEV; - - epirq = &interface->endpoint[0].desc; -+ if (!usb_endpoint_is_int_in(epirq)) -+ return -ENODEV; -+ - epout = &interface->endpoint[1].desc; -+ if (!usb_endpoint_is_int_out(epout)) -+ return -ENODEV; - - if (!(iforce = kzalloc(sizeof(struct iforce) + 32, GFP_KERNEL))) - goto fail; -diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h -index 88055755f82e..821b446a85dd 100644 ---- a/drivers/input/mouse/trackpoint.h -+++ b/drivers/input/mouse/trackpoint.h -@@ -153,7 +153,8 @@ struct trackpoint_data - #ifdef CONFIG_MOUSE_PS2_TRACKPOINT - int trackpoint_detect(struct psmouse *psmouse, bool set_properties); - #else --inline int trackpoint_detect(struct psmouse *psmouse, bool set_properties) -+static inline int trackpoint_detect(struct psmouse *psmouse, -+ bool set_properties) - { - return -ENOSYS; - } -diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c -index 2812f9236b7d..0ccc120a0f14 100644 ---- a/drivers/input/tablet/kbtab.c -+++ b/drivers/input/tablet/kbtab.c -@@ -125,6 +125,10 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i - if (intf->cur_altsetting->desc.bNumEndpoints < 1) - return -ENODEV; - -+ endpoint = &intf->cur_altsetting->endpoint[0].desc; -+ if (!usb_endpoint_is_int_in(endpoint)) -+ return -ENODEV; -+ - kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); - input_dev = input_allocate_device(); - if (!kbtab || !input_dev) -@@ -164,8 +168,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i - input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); - input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); - -- endpoint = &intf->cur_altsetting->endpoint[0].desc; -- - usb_fill_int_urb(kbtab->irq, dev, - usb_rcvintpipe(dev, endpoint->bEndpointAddress), - kbtab->data, 8, -diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c -index db85cc5791dc..6a69b5bb231f 100644 ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -1223,7 +1223,7 @@ static const struct attribute_group *amd_iommu_groups[] = { - NULL, - }; - --static int iommu_init_pci(struct amd_iommu *iommu) -+static int __init iommu_init_pci(struct amd_iommu *iommu) - { - int cap_ptr = iommu->cap_ptr; - u32 range, misc, low, high; -diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c -index 2d203b422129..c56da0b13da5 100644 ---- a/drivers/irqchip/irq-imx-gpcv2.c -+++ b/drivers/irqchip/irq-imx-gpcv2.c -@@ -145,6 +145,7 @@ static struct irq_chip gpcv2_irqchip_data_chip = { - .irq_unmask = imx_gpcv2_irq_unmask, - .irq_set_wake = imx_gpcv2_irq_set_wake, - .irq_retrigger = irq_chip_retrigger_hierarchy, -+ .irq_set_type = irq_chip_set_type_parent, - #ifdef CONFIG_SMP - .irq_set_affinity = irq_chip_set_affinity_parent, - #endif -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index ed80c973f546..168f2331194f 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1111,7 +1111,9 @@ static void bond_compute_features(struct bonding *bond) - - done: - bond_dev->vlan_features = vlan_features; -- bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL; -+ bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL | -+ NETIF_F_HW_VLAN_CTAG_TX | -+ NETIF_F_HW_VLAN_STAG_TX; - bond_dev->gso_max_segs = gso_max_segs; - netif_set_gso_max_size(bond_dev, gso_max_size); - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index 91be4575b524..e13bc27b4291 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -592,16 +592,16 @@ static int peak_usb_ndo_stop(struct net_device *netdev) - dev->state &= ~PCAN_USB_STATE_STARTED; - netif_stop_queue(netdev); - -+ close_candev(netdev); -+ -+ dev->can.state = CAN_STATE_STOPPED; -+ - /* unlink all pending urbs and free used memory */ - peak_usb_unlink_all_urbs(dev); - - if (dev->adapter->dev_stop) - dev->adapter->dev_stop(dev); - -- close_candev(netdev); -- -- dev->can.state = CAN_STATE_STOPPED; -- - /* can set bus off now */ - if (dev->adapter->dev_set_bus) { - int err = dev->adapter->dev_set_bus(dev, 0); -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -index 64cc86a82b2d..1b75d5304a2c 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -@@ -851,7 +851,7 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev) - goto err_out; - - /* allocate command buffer once for all for the interface */ -- pdev->cmd_buffer_addr = kmalloc(PCAN_UFD_CMD_BUFFER_SIZE, -+ pdev->cmd_buffer_addr = kzalloc(PCAN_UFD_CMD_BUFFER_SIZE, - GFP_KERNEL); - if (!pdev->cmd_buffer_addr) - goto err_out_1; -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c -index bbdd6058cd2f..d85fdc6949c6 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c -@@ -500,7 +500,7 @@ static int pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded) - u8 *buffer; - int err; - -- buffer = kmalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL); -+ buffer = kzalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 7ee301310817..c1dd75fe935f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -855,6 +855,9 @@ static int mlx5e_set_pauseparam(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - int err; - -+ if (!MLX5_CAP_GEN(mdev, vport_group_manager)) -+ return -EOPNOTSUPP; -+ - if (pauseparam->autoneg) - return -EINVAL; - -diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c -index 17fac0121e56..4f505eb4f422 100644 ---- a/drivers/net/usb/pegasus.c -+++ b/drivers/net/usb/pegasus.c -@@ -285,7 +285,7 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val) - static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata) - { - int i; -- __u8 tmp; -+ __u8 tmp = 0; - __le16 retdatai; - int ret; - -diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h -index 3959f1c97f4e..466ea4e551a6 100644 ---- a/drivers/net/wireless/mwifiex/main.h -+++ b/drivers/net/wireless/mwifiex/main.h -@@ -108,6 +108,7 @@ enum { - - #define MWIFIEX_MAX_TOTAL_SCAN_TIME (MWIFIEX_TIMER_10S - MWIFIEX_TIMER_1S) - -+#define WPA_GTK_OUI_OFFSET 2 - #define RSN_GTK_OUI_OFFSET 2 - - #define MWIFIEX_OUI_NOT_PRESENT 0 -diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c -index 673ca812bd4c..b3fa3e4bed05 100644 ---- a/drivers/net/wireless/mwifiex/scan.c -+++ b/drivers/net/wireless/mwifiex/scan.c -@@ -151,7 +151,8 @@ mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher) - if (((bss_desc->bcn_wpa_ie) && - ((*(bss_desc->bcn_wpa_ie)).vend_hdr.element_id == - WLAN_EID_VENDOR_SPECIFIC))) { -- iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data; -+ iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data + -+ WPA_GTK_OUI_OFFSET); - oui = &mwifiex_wpa_oui[cipher][0]; - ret = mwifiex_search_oui_in_ie(iebody, oui); - if (ret) -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index d324ac308e6d..65d37257e033 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -1421,6 +1421,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, - skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS; - nskb = xenvif_alloc_skb(0); - if (unlikely(nskb == NULL)) { -+ skb_shinfo(skb)->nr_frags = 0; - kfree_skb(skb); - xenvif_tx_err(queue, &txreq, idx); - if (net_ratelimit()) -@@ -1436,6 +1437,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, - - if (xenvif_set_skb_gso(queue->vif, skb, gso)) { - /* Failure in xenvif_set_skb_gso is fatal. */ -+ skb_shinfo(skb)->nr_frags = 0; - kfree_skb(skb); - kfree_skb(nskb); - break; -diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c -index 8d7fc3b6ca63..adf322a86a01 100644 ---- a/drivers/s390/cio/qdio_main.c -+++ b/drivers/s390/cio/qdio_main.c -@@ -1576,13 +1576,13 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags, - rc = qdio_kick_outbound_q(q, phys_aob); - } else if (need_siga_sync(q)) { - rc = qdio_siga_sync_q(q); -+ } else if (count < QDIO_MAX_BUFFERS_PER_Q && -+ get_buf_state(q, prev_buf(bufnr), &state, 0) > 0 && -+ state == SLSB_CU_OUTPUT_PRIMED) { -+ /* The previous buffer is not processed yet, tack on. */ -+ qperf_inc(q, fast_requeue); - } else { -- /* try to fast requeue buffers */ -- get_buf_state(q, prev_buf(bufnr), &state, 0); -- if (state != SLSB_CU_OUTPUT_PRIMED) -- rc = qdio_kick_outbound_q(q, 0); -- else -- qperf_inc(q, fast_requeue); -+ rc = qdio_kick_outbound_q(q, 0); - } - - /* in case of SIGA errors we must process the error immediately */ -diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c -index d5184aa1ace4..3bc610d160f5 100644 ---- a/drivers/scsi/fcoe/fcoe_ctlr.c -+++ b/drivers/scsi/fcoe/fcoe_ctlr.c -@@ -1973,7 +1973,7 @@ EXPORT_SYMBOL_GPL(fcoe_wwn_from_mac); - */ - static inline struct fcoe_rport *fcoe_ctlr_rport(struct fc_rport_priv *rdata) - { -- return (struct fcoe_rport *)(rdata + 1); -+ return container_of(rdata, struct fcoe_rport, rdata); - } - - /** -@@ -2233,7 +2233,7 @@ static void fcoe_ctlr_vn_start(struct fcoe_ctlr *fip) - */ - static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip, - struct sk_buff *skb, -- struct fc_rport_priv *rdata) -+ struct fcoe_rport *frport) - { - struct fip_header *fiph; - struct fip_desc *desc = NULL; -@@ -2241,16 +2241,12 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip, - struct fip_wwn_desc *wwn = NULL; - struct fip_vn_desc *vn = NULL; - struct fip_size_desc *size = NULL; -- struct fcoe_rport *frport; - size_t rlen; - size_t dlen; - u32 desc_mask = 0; - u32 dtype; - u8 sub; - -- memset(rdata, 0, sizeof(*rdata) + sizeof(*frport)); -- frport = fcoe_ctlr_rport(rdata); -- - fiph = (struct fip_header *)skb->data; - frport->flags = ntohs(fiph->fip_flags); - -@@ -2313,15 +2309,17 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip, - if (dlen != sizeof(struct fip_wwn_desc)) - goto len_err; - wwn = (struct fip_wwn_desc *)desc; -- rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn); -+ frport->rdata.ids.node_name = -+ get_unaligned_be64(&wwn->fd_wwn); - break; - case FIP_DT_VN_ID: - if (dlen != sizeof(struct fip_vn_desc)) - goto len_err; - vn = (struct fip_vn_desc *)desc; - memcpy(frport->vn_mac, vn->fd_mac, ETH_ALEN); -- rdata->ids.port_id = ntoh24(vn->fd_fc_id); -- rdata->ids.port_name = get_unaligned_be64(&vn->fd_wwpn); -+ frport->rdata.ids.port_id = ntoh24(vn->fd_fc_id); -+ frport->rdata.ids.port_name = -+ get_unaligned_be64(&vn->fd_wwpn); - break; - case FIP_DT_FC4F: - if (dlen != sizeof(struct fip_fc4_feat)) -@@ -2664,16 +2662,13 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb) - { - struct fip_header *fiph; - enum fip_vn2vn_subcode sub; -- struct { -- struct fc_rport_priv rdata; -- struct fcoe_rport frport; -- } buf; -+ struct fcoe_rport frport = { }; - int rc; - - fiph = (struct fip_header *)skb->data; - sub = fiph->fip_subcode; - -- rc = fcoe_ctlr_vn_parse(fip, skb, &buf.rdata); -+ rc = fcoe_ctlr_vn_parse(fip, skb, &frport); - if (rc) { - LIBFCOE_FIP_DBG(fip, "vn_recv vn_parse error %d\n", rc); - goto drop; -@@ -2682,19 +2677,19 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb) - mutex_lock(&fip->ctlr_mutex); - switch (sub) { - case FIP_SC_VN_PROBE_REQ: -- fcoe_ctlr_vn_probe_req(fip, &buf.rdata); -+ fcoe_ctlr_vn_probe_req(fip, &frport.rdata); - break; - case FIP_SC_VN_PROBE_REP: -- fcoe_ctlr_vn_probe_reply(fip, &buf.rdata); -+ fcoe_ctlr_vn_probe_reply(fip, &frport.rdata); - break; - case FIP_SC_VN_CLAIM_NOTIFY: -- fcoe_ctlr_vn_claim_notify(fip, &buf.rdata); -+ fcoe_ctlr_vn_claim_notify(fip, &frport.rdata); - break; - case FIP_SC_VN_CLAIM_REP: -- fcoe_ctlr_vn_claim_resp(fip, &buf.rdata); -+ fcoe_ctlr_vn_claim_resp(fip, &frport.rdata); - break; - case FIP_SC_VN_BEACON: -- fcoe_ctlr_vn_beacon(fip, &buf.rdata); -+ fcoe_ctlr_vn_beacon(fip, &frport.rdata); - break; - default: - LIBFCOE_FIP_DBG(fip, "vn_recv unknown subcode %d\n", sub); -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index e0952882e132..fcce3ae119fa 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -2153,6 +2153,8 @@ static int handle_ioaccel_mode2_error(struct ctlr_info *h, - case IOACCEL2_SERV_RESPONSE_COMPLETE: - switch (c2->error_data.status) { - case IOACCEL2_STATUS_SR_TASK_COMP_GOOD: -+ if (cmd) -+ cmd->result = 0; - break; - case IOACCEL2_STATUS_SR_TASK_COMP_CHK_COND: - cmd->result |= SAM_STAT_CHECK_CONDITION; -@@ -2320,8 +2322,10 @@ static void process_ioaccel2_completion(struct ctlr_info *h, - - /* check for good status */ - if (likely(c2->error_data.serv_response == 0 && -- c2->error_data.status == 0)) -+ c2->error_data.status == 0)) { -+ cmd->result = 0; - return hpsa_cmd_free_and_done(h, c, cmd); -+ } - - /* - * Any RAID offload error results in retry which will use -@@ -5236,6 +5240,12 @@ static int hpsa_scsi_queue_command(struct Scsi_Host *sh, struct scsi_cmnd *cmd) - } - c = cmd_tagged_alloc(h, cmd); - -+ /* -+ * This is necessary because the SML doesn't zero out this field during -+ * error recovery. -+ */ -+ cmd->result = 0; -+ - /* - * Call alternate submit routine for I/O accelerated commands. - * Retries always go down the normal I/O path. -diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c -index 1f9f9e5af207..0526a47e30a3 100644 ---- a/drivers/scsi/ibmvscsi/ibmvfc.c -+++ b/drivers/scsi/ibmvscsi/ibmvfc.c -@@ -4869,8 +4869,8 @@ static int ibmvfc_remove(struct vio_dev *vdev) - - spin_lock_irqsave(vhost->host->host_lock, flags); - ibmvfc_purge_requests(vhost, DID_ERROR); -- ibmvfc_free_event_pool(vhost); - spin_unlock_irqrestore(vhost->host->host_lock, flags); -+ ibmvfc_free_event_pool(vhost); - - ibmvfc_free_mem(vhost); - spin_lock(&ibmvfc_driver_lock); -diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c -index 589ff9aedd31..e69940eefe4b 100644 ---- a/drivers/scsi/libfc/fc_rport.c -+++ b/drivers/scsi/libfc/fc_rport.c -@@ -121,12 +121,15 @@ static struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, - u32 port_id) - { - struct fc_rport_priv *rdata; -+ size_t rport_priv_size = sizeof(*rdata); - - rdata = lport->tt.rport_lookup(lport, port_id); - if (rdata) - return rdata; - -- rdata = kzalloc(sizeof(*rdata) + lport->rport_priv_size, GFP_KERNEL); -+ if (lport->rport_priv_size > 0) -+ rport_priv_size = lport->rport_priv_size; -+ rdata = kzalloc(rport_priv_size, GFP_KERNEL); - if (!rdata) - return NULL; - -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 2422094f1f15..5e0bac8de638 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -2752,6 +2752,7 @@ megasas_fw_crash_buffer_show(struct device *cdev, - u32 size; - unsigned long buff_addr; - unsigned long dmachunk = CRASH_DMA_BUF_SIZE; -+ unsigned long chunk_left_bytes; - unsigned long src_addr; - unsigned long flags; - u32 buff_offset; -@@ -2777,6 +2778,8 @@ megasas_fw_crash_buffer_show(struct device *cdev, - } - - size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset; -+ chunk_left_bytes = dmachunk - (buff_offset % dmachunk); -+ size = (size > chunk_left_bytes) ? chunk_left_bytes : size; - size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size; - - src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] + -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 9b5367294116..7af7a0859478 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -1686,9 +1686,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) - { - struct sysinfo s; - u64 consistent_dma_mask; -+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -+ int dma_mask = (ioc->hba_mpi_version_belonged > MPI2_VERSION) ? 63 : 64; - - if (ioc->dma_mask) -- consistent_dma_mask = DMA_BIT_MASK(64); -+ consistent_dma_mask = DMA_BIT_MASK(dma_mask); - else - consistent_dma_mask = DMA_BIT_MASK(32); - -@@ -1696,11 +1698,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) - const uint64_t required_mask = - dma_get_required_mask(&pdev->dev); - if ((required_mask > DMA_BIT_MASK(32)) && -- !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && -+ !pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_mask)) && - !pci_set_consistent_dma_mask(pdev, consistent_dma_mask)) { - ioc->base_add_sg_single = &_base_add_sg_single_64; - ioc->sge_size = sizeof(Mpi2SGESimple64_t); -- ioc->dma_mask = 64; -+ ioc->dma_mask = dma_mask; - goto out; - } - } -@@ -1726,7 +1728,7 @@ static int - _base_change_consistent_dma_mask(struct MPT3SAS_ADAPTER *ioc, - struct pci_dev *pdev) - { -- if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) { -+ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(ioc->dma_mask))) { - if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) - return -ENODEV; - } -@@ -3325,7 +3327,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) - total_sz += sz; - } while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count)); - -- if (ioc->dma_mask == 64) { -+ if (ioc->dma_mask > 32) { - if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) { - pr_warn(MPT3SAS_FMT - "no suitable consistent DMA mask for %s\n", -diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c -index ab7a332fbcc4..6404cd4687b9 100644 ---- a/drivers/staging/comedi/drivers/dt3000.c -+++ b/drivers/staging/comedi/drivers/dt3000.c -@@ -351,9 +351,9 @@ static irqreturn_t dt3k_interrupt(int irq, void *d) - static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec, - unsigned int flags) - { -- int divider, base, prescale; -+ unsigned int divider, base, prescale; - -- /* This function needs improvment */ -+ /* This function needs improvement */ - /* Don't know if divider==0 works. */ - - for (prescale = 0; prescale < 16; prescale++) { -@@ -367,7 +367,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec, - divider = (*nanosec) / base; - break; - case CMDF_ROUND_UP: -- divider = (*nanosec) / base; -+ divider = DIV_ROUND_UP(*nanosec, base); - break; - } - if (divider < 65536) { -@@ -377,7 +377,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec, - } - - prescale = 15; -- base = timer_base * (1 << prescale); -+ base = timer_base * (prescale + 1); - divider = 65535; - *nanosec = divider * base; - return (prescale << 16) | (divider); -diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c -index 34234c233851..656c2ade6a43 100644 ---- a/drivers/tty/tty_ldsem.c -+++ b/drivers/tty/tty_ldsem.c -@@ -137,8 +137,7 @@ static void __ldsem_wake_readers(struct ld_semaphore *sem) - - list_for_each_entry_safe(waiter, next, &sem->read_wait, list) { - tsk = waiter->task; -- smp_mb(); -- waiter->task = NULL; -+ smp_store_release(&waiter->task, NULL); - wake_up_process(tsk); - put_task_struct(tsk); - } -@@ -234,7 +233,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout) - for (;;) { - set_task_state(tsk, TASK_UNINTERRUPTIBLE); - -- if (!waiter.task) -+ if (!smp_load_acquire(&waiter.task)) - break; - if (!timeout) - break; -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 736de1021d8b..1930a8ec4b67 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1319,13 +1319,6 @@ made_compressed_probe: - if (acm == NULL) - goto alloc_fail; - -- minor = acm_alloc_minor(acm); -- if (minor < 0) { -- dev_err(&intf->dev, "no more free acm devices\n"); -- kfree(acm); -- return -ENODEV; -- } -- - ctrlsize = usb_endpoint_maxp(epctrl); - readsize = usb_endpoint_maxp(epread) * - (quirks == SINGLE_RX_URB ? 1 : 2); -@@ -1333,6 +1326,16 @@ made_compressed_probe: - acm->writesize = usb_endpoint_maxp(epwrite) * 20; - acm->control = control_interface; - acm->data = data_interface; -+ -+ usb_get_intf(acm->control); /* undone in destruct() */ -+ -+ minor = acm_alloc_minor(acm); -+ if (minor < 0) { -+ dev_err(&intf->dev, "no more free acm devices\n"); -+ kfree(acm); -+ return -ENODEV; -+ } -+ - acm->minor = minor; - acm->dev = usb_dev; - acm->ctrl_caps = ac_management_function; -@@ -1474,7 +1477,6 @@ skip_countries: - usb_driver_claim_interface(&acm_driver, data_interface, acm); - usb_set_intfdata(data_interface, acm); - -- usb_get_intf(control_interface); - tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor, - &control_interface->dev); - if (IS_ERR(tty_dev)) { -diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c -index b3de806085f0..097977c0359f 100644 ---- a/drivers/usb/core/file.c -+++ b/drivers/usb/core/file.c -@@ -191,9 +191,10 @@ int usb_register_dev(struct usb_interface *intf, - intf->minor = minor; - break; - } -- up_write(&minor_rwsem); -- if (intf->minor < 0) -+ if (intf->minor < 0) { -+ up_write(&minor_rwsem); - return -EXFULL; -+ } - - /* create a usb class device for this usb interface */ - snprintf(name, sizeof(name), class_driver->name, minor - minor_base); -@@ -206,12 +207,11 @@ int usb_register_dev(struct usb_interface *intf, - MKDEV(USB_MAJOR, minor), class_driver, - "%s", temp); - if (IS_ERR(intf->usb_dev)) { -- down_write(&minor_rwsem); - usb_minors[minor] = NULL; - intf->minor = -1; -- up_write(&minor_rwsem); - retval = PTR_ERR(intf->usb_dev); - } -+ up_write(&minor_rwsem); - return retval; - } - EXPORT_SYMBOL_GPL(usb_register_dev); -@@ -237,12 +237,12 @@ void usb_deregister_dev(struct usb_interface *intf, - return; - - dev_dbg(&intf->dev, "removing %d minor\n", intf->minor); -+ device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); - - down_write(&minor_rwsem); - usb_minors[intf->minor] = NULL; - up_write(&minor_rwsem); - -- device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); - intf->usb_dev = NULL; - intf->minor = -1; - destroy_usb_class(); -diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c -index 5ead414586a1..8232850f7b80 100644 ---- a/drivers/usb/gadget/function/f_midi.c -+++ b/drivers/usb/gadget/function/f_midi.c -@@ -364,9 +364,11 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - req->complete = f_midi_complete; - err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); - if (err) { -- ERROR(midi, "%s queue req: %d\n", -+ ERROR(midi, "%s: couldn't enqueue request: %d\n", - midi->out_ep->name, err); -- free_ep_req(midi->out_ep, req); -+ if (req->buf != NULL) -+ free_ep_req(midi->out_ep, req); -+ return err; - } - } - -diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h -index 69a1d10df04f..3ee365fbc2e2 100644 ---- a/drivers/usb/gadget/u_f.h -+++ b/drivers/usb/gadget/u_f.h -@@ -65,7 +65,9 @@ struct usb_request *alloc_ep_req(struct usb_ep *ep, size_t len, int default_len) - /* Frees a usb_request previously allocated by alloc_ep_req() */ - static inline void free_ep_req(struct usb_ep *ep, struct usb_request *req) - { -+ WARN_ON(req->buf == NULL); - kfree(req->buf); -+ req->buf = NULL; - usb_ep_free_request(ep, req); - } - -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index 5e43fd881a9c..836fb65c3c72 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -898,19 +898,20 @@ static void iowarrior_disconnect(struct usb_interface *interface) - dev = usb_get_intfdata(interface); - mutex_lock(&iowarrior_open_disc_lock); - usb_set_intfdata(interface, NULL); -+ /* prevent device read, write and ioctl */ -+ dev->present = 0; - - minor = dev->minor; -+ mutex_unlock(&iowarrior_open_disc_lock); -+ /* give back our minor - this will call close() locks need to be dropped at this point*/ - -- /* give back our minor */ - usb_deregister_dev(interface, &iowarrior_class); - - mutex_lock(&dev->mutex); - - /* prevent device read, write and ioctl */ -- dev->present = 0; - - mutex_unlock(&dev->mutex); -- mutex_unlock(&iowarrior_open_disc_lock); - - if (dev->opened) { - /* There is a process that holds a filedescriptor to the device , -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index a8b6d0036e5d..2222ec2275fc 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -96,7 +96,6 @@ static void yurex_delete(struct kref *kref) - - dev_dbg(&dev->interface->dev, "%s\n", __func__); - -- usb_put_dev(dev->udev); - if (dev->cntl_urb) { - usb_kill_urb(dev->cntl_urb); - kfree(dev->cntl_req); -@@ -112,6 +111,7 @@ static void yurex_delete(struct kref *kref) - dev->int_buffer, dev->urb->transfer_dma); - usb_free_urb(dev->urb); - } -+ usb_put_dev(dev->udev); - kfree(dev); - } - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index d7b31fdce94d..1bceb11f3782 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -967,6 +967,11 @@ static const struct usb_device_id option_ids[] = { - { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) }, - { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) }, - -+ /* Motorola devices */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) }, /* mdm6600 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) }, /* mdm9600 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) }, /* mdm ram dl */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) }, /* mdm qc dl */ - - { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, - { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, -@@ -1544,6 +1549,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ - .driver_info = RSVD(2) }, - { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */ -+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) }, -@@ -1949,11 +1955,15 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ - .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff), /* D-Link DWM-222 A2 */ -+ .driver_info = RSVD(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ - .driver_info = RSVD(4) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ -+ .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ - { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, - { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, -diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c -index 7f83e9083e9d..b1a1d7de0894 100644 ---- a/drivers/xen/xen-pciback/conf_space_capability.c -+++ b/drivers/xen/xen-pciback/conf_space_capability.c -@@ -115,13 +115,12 @@ static int pm_ctrl_write(struct pci_dev *dev, int offset, u16 new_value, - { - int err; - u16 old_value; -- pci_power_t new_state, old_state; -+ pci_power_t new_state; - - err = pci_read_config_word(dev, offset, &old_value); - if (err) - goto out; - -- old_state = (pci_power_t)(old_value & PCI_PM_CTRL_STATE_MASK); - new_state = (pci_power_t)(new_value & PCI_PM_CTRL_STATE_MASK); - - new_value &= PM_OK_BITS; -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 5e21d58c49ef..84e60b3a5c7c 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -171,7 +171,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) - if (tcon == NULL) - return 0; - -- if (smb2_command == SMB2_TREE_CONNECT) -+ if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) - return 0; - - if (tcon->tidStatus == CifsExiting) { -@@ -677,7 +677,12 @@ ssetup_ntlmssp_authenticate: - else - req->SecurityMode = 0; - -+#ifdef CONFIG_CIFS_DFS_UPCALL -+ req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS); -+#else - req->Capabilities = 0; -+#endif /* DFS_UPCALL */ -+ - req->Channel = 0; /* MBZ */ - - iov[0].iov_base = (char *)req; -diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c -index 4f0788232f2f..06faa608e562 100644 ---- a/fs/ocfs2/xattr.c -+++ b/fs/ocfs2/xattr.c -@@ -3808,7 +3808,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode, - u16 blk_per_bucket = ocfs2_blocks_per_xattr_bucket(inode->i_sb); - int low_bucket = 0, bucket, high_bucket; - struct ocfs2_xattr_bucket *search; -- u32 last_hash; - u64 blkno, lower_blkno = 0; - - search = ocfs2_xattr_bucket_new(inode); -@@ -3852,8 +3851,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode, - if (xh->xh_count) - xe = &xh->xh_entries[le16_to_cpu(xh->xh_count) - 1]; - -- last_hash = le32_to_cpu(xe->xe_name_hash); -- - /* record lower_blkno which may be the insert place. */ - lower_blkno = blkno; - -diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h -index 09aa521a0085..af2c3d4a6e6f 100644 ---- a/include/asm-generic/bug.h -+++ b/include/asm-generic/bug.h -@@ -143,7 +143,7 @@ extern void warn_slowpath_null(const char *file, const int line); - #endif - - #ifndef HAVE_ARCH_BUG_ON --#define BUG_ON(condition) do { if (condition) ; } while (0) -+#define BUG_ON(condition) do { if (condition) BUG(); } while (0) - #endif - - #ifndef HAVE_ARCH_WARN_ON -diff --git a/include/asm-generic/getorder.h b/include/asm-generic/getorder.h -index 65e4468ac53d..52fbf236a90e 100644 ---- a/include/asm-generic/getorder.h -+++ b/include/asm-generic/getorder.h -@@ -6,24 +6,6 @@ - #include - #include - --/* -- * Runtime evaluation of get_order() -- */ --static inline __attribute_const__ --int __get_order(unsigned long size) --{ -- int order; -- -- size--; -- size >>= PAGE_SHIFT; --#if BITS_PER_LONG == 32 -- order = fls(size); --#else -- order = fls64(size); --#endif -- return order; --} -- - /** - * get_order - Determine the allocation order of a memory size - * @size: The size for which to get the order -@@ -42,19 +24,27 @@ int __get_order(unsigned long size) - * to hold an object of the specified size. - * - * The result is undefined if the size is 0. -- * -- * This function may be used to initialise variables with compile time -- * evaluations of constants. - */ --#define get_order(n) \ --( \ -- __builtin_constant_p(n) ? ( \ -- ((n) == 0UL) ? BITS_PER_LONG - PAGE_SHIFT : \ -- (((n) < (1UL << PAGE_SHIFT)) ? 0 : \ -- ilog2((n) - 1) - PAGE_SHIFT + 1) \ -- ) : \ -- __get_order(n) \ --) -+static inline __attribute_const__ int get_order(unsigned long size) -+{ -+ if (__builtin_constant_p(size)) { -+ if (!size) -+ return BITS_PER_LONG - PAGE_SHIFT; -+ -+ if (size < (1UL << PAGE_SHIFT)) -+ return 0; -+ -+ return ilog2((size) - 1) - PAGE_SHIFT + 1; -+ } -+ -+ size--; -+ size >>= PAGE_SHIFT; -+#if BITS_PER_LONG == 32 -+ return fls(size); -+#else -+ return fls64(size); -+#endif -+} - - #endif /* __ASSEMBLY__ */ - -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index ed772311ec1f..5508011cc0c7 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -52,6 +52,22 @@ extern void __chk_io_ptr(const volatile void __iomem *); - - #ifdef __KERNEL__ - -+/* -+ * Minimal backport of compiler_attributes.h to add support for __copy -+ * to v4.9.y so that we can use it in init/exit_module to avoid -+ * -Werror=missing-attributes errors on GCC 9. -+ */ -+#ifndef __has_attribute -+# define __has_attribute(x) __GCC4_has_attribute_##x -+# define __GCC4_has_attribute___copy__ 0 -+#endif -+ -+#if __has_attribute(__copy__) -+# define __copy(symbol) __attribute__((__copy__(symbol))) -+#else -+# define __copy(symbol) -+#endif -+ - #ifdef __GNUC__ - #include - #endif -diff --git a/include/linux/module.h b/include/linux/module.h -index dfe5c2e25ba1..d237d0574179 100644 ---- a/include/linux/module.h -+++ b/include/linux/module.h -@@ -127,13 +127,13 @@ extern void cleanup_module(void); - #define module_init(initfn) \ - static inline initcall_t __maybe_unused __inittest(void) \ - { return initfn; } \ -- int init_module(void) __attribute__((alias(#initfn))); -+ int init_module(void) __copy(initfn) __attribute__((alias(#initfn))); - - /* This is only required if you want to be unloadable. */ - #define module_exit(exitfn) \ - static inline exitcall_t __maybe_unused __exittest(void) \ - { return exitfn; } \ -- void cleanup_module(void) __attribute__((alias(#exitfn))); -+ void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn))); - - #endif - -diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h -index de7e3ee60f0c..e59180264591 100644 ---- a/include/scsi/libfcoe.h -+++ b/include/scsi/libfcoe.h -@@ -236,6 +236,7 @@ struct fcoe_fcf { - * @vn_mac: VN_Node assigned MAC address for data - */ - struct fcoe_rport { -+ struct fc_rport_priv rdata; - unsigned long time; - u16 fcoe_len; - u16 flags; -diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h -index 85ff3181e6f1..a5c6e6da3d3d 100644 ---- a/include/sound/compress_driver.h -+++ b/include/sound/compress_driver.h -@@ -178,10 +178,7 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) - if (snd_BUG_ON(!stream)) - return; - -- if (stream->direction == SND_COMPRESS_PLAYBACK) -- stream->runtime->state = SNDRV_PCM_STATE_SETUP; -- else -- stream->runtime->state = SNDRV_PCM_STATE_PREPARED; -+ stream->runtime->state = SNDRV_PCM_STATE_SETUP; - - wake_up(&stream->runtime->sleep); - } -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 41fe80e3380f..a7014f854e67 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -8757,7 +8757,7 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu, - goto err_free; - } - -- perf_install_in_context(ctx, event, cpu); -+ perf_install_in_context(ctx, event, event->cpu); - perf_unpin_context(ctx); - mutex_unlock(&ctx->mutex); - -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 9a8e688724b1..a84eb0f8c5db 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -988,28 +988,47 @@ void mem_cgroup_iter_break(struct mem_cgroup *root, - css_put(&prev->css); - } - --static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg) -+static void __invalidate_reclaim_iterators(struct mem_cgroup *from, -+ struct mem_cgroup *dead_memcg) - { -- struct mem_cgroup *memcg = dead_memcg; - struct mem_cgroup_reclaim_iter *iter; - struct mem_cgroup_per_zone *mz; - int nid, zid; - int i; - -- for (; memcg; memcg = parent_mem_cgroup(memcg)) { -- for_each_node(nid) { -- for (zid = 0; zid < MAX_NR_ZONES; zid++) { -- mz = &memcg->nodeinfo[nid]->zoneinfo[zid]; -- for (i = 0; i <= DEF_PRIORITY; i++) { -- iter = &mz->iter[i]; -- cmpxchg(&iter->position, -- dead_memcg, NULL); -- } -+ for_each_node(nid) { -+ for (zid = 0; zid < MAX_NR_ZONES; zid++) { -+ mz = &from->nodeinfo[nid]->zoneinfo[zid]; -+ for (i = 0; i <= DEF_PRIORITY; i++) { -+ iter = &mz->iter[i]; -+ cmpxchg(&iter->position, -+ dead_memcg, NULL); - } - } - } - } - -+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg) -+{ -+ struct mem_cgroup *memcg = dead_memcg; -+ struct mem_cgroup *last; -+ -+ do { -+ __invalidate_reclaim_iterators(memcg, dead_memcg); -+ last = memcg; -+ } while ((memcg = parent_mem_cgroup(memcg))); -+ -+ /* -+ * When cgruop1 non-hierarchy mode is used, -+ * parent_mem_cgroup() does not walk all the way up to the -+ * cgroup root (root_mem_cgroup). So we have to handle -+ * dead_memcg from cgroup root separately. -+ */ -+ if (last != root_mem_cgroup) -+ __invalidate_reclaim_iterators(root_mem_cgroup, -+ dead_memcg); -+} -+ - /* - * Iteration constructs for visiting all cgroups (under a tree). If - * loops are exited prematurely (break), mem_cgroup_iter_break() must -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 7c556b59f0ec..d118e59a2bef 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -1677,6 +1677,12 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, - if (!addr) - return NULL; - -+ /* -+ * First make sure the mappings are removed from all page-tables -+ * before they are freed. -+ */ -+ vmalloc_sync_all(); -+ - /* - * In this function, newly allocated vm_struct has VM_UNINITIALIZED - * flag. It means that vm_struct is not fully initialized. -@@ -2214,6 +2220,9 @@ EXPORT_SYMBOL(remap_vmalloc_range); - /* - * Implement a stub for vmalloc_sync_all() if the architecture chose not to - * have one. -+ * -+ * The purpose of this function is to make sure the vmalloc area -+ * mappings are identical in all page-tables in the system. - */ - void __weak vmalloc_sync_all(void) - { -diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c -index c258f1041d33..df2e4e311217 100644 ---- a/net/mac80211/driver-ops.c -+++ b/net/mac80211/driver-ops.c -@@ -169,11 +169,16 @@ int drv_conf_tx(struct ieee80211_local *local, - if (!check_sdata_in_driver(sdata)) - return -EIO; - -- if (WARN_ONCE(params->cw_min == 0 || -- params->cw_min > params->cw_max, -- "%s: invalid CW_min/CW_max: %d/%d\n", -- sdata->name, params->cw_min, params->cw_max)) -+ if (params->cw_min == 0 || params->cw_min > params->cw_max) { -+ /* -+ * If we can't configure hardware anyway, don't warn. We may -+ * never have initialized the CW parameters. -+ */ -+ WARN_ONCE(local->ops->conf_tx, -+ "%s: invalid CW_min/CW_max: %d/%d\n", -+ sdata->name, params->cw_min, params->cw_max); - return -EINVAL; -+ } - - trace_drv_conf_tx(local, sdata, ac, params); - if (local->ops->conf_tx) -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 08384dbf426c..ae5387b93df3 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -1892,6 +1892,16 @@ static bool ieee80211_sta_wmm_params(struct ieee80211_local *local, - } - } - -+ /* WMM specification requires all 4 ACIs. */ -+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { -+ if (params[ac].cw_min == 0) { -+ sdata_info(sdata, -+ "AP has invalid WMM params (missing AC %d), using defaults\n", -+ ac); -+ return false; -+ } -+ } -+ - for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) { - mlme_dbg(sdata, - "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n", -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index 9adedba78eea..044559c10e98 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -495,7 +495,7 @@ static int nfnetlink_bind(struct net *net, int group) - ss = nfnetlink_get_subsys(type << 8); - rcu_read_unlock(); - if (!ss) -- request_module("nfnetlink-subsys-%d", type); -+ request_module_nowait("nfnetlink-subsys-%d", type); - return 0; - } - #endif -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index c78bcc13ebab..5d8988185c59 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2498,6 +2498,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) - - mutex_lock(&po->pg_vec_lock); - -+ /* packet_sendmsg() check on tx_ring.pg_vec was lockless, -+ * we need to confirm it under protection of pg_vec_lock. -+ */ -+ if (unlikely(!po->tx_ring.pg_vec)) { -+ err = -EBUSY; -+ goto out; -+ } - if (likely(saddr == NULL)) { - dev = packet_cached_dev_get(po); - proto = po->num; -diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c -index 6098d4c42fa9..e5cd14307aa5 100644 ---- a/net/sctp/sm_sideeffect.c -+++ b/net/sctp/sm_sideeffect.c -@@ -504,7 +504,7 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands, - * see SCTP Quick Failover Draft, section 5.1 - */ - if ((transport->state == SCTP_ACTIVE) && -- (asoc->pf_retrans < transport->pathmaxrxt) && -+ (transport->error_count < transport->pathmaxrxt) && - (transport->error_count > asoc->pf_retrans)) { - - sctp_assoc_control_transport(asoc, transport, -diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost -index 1366a94b6c39..7718a64b1cd1 100644 ---- a/scripts/Makefile.modpost -+++ b/scripts/Makefile.modpost -@@ -74,7 +74,7 @@ modpost = scripts/mod/modpost \ - $(if $(CONFIG_MODULE_SRCVERSION_ALL),-a,) \ - $(if $(KBUILD_EXTMOD),-i,-o) $(kernelsymfile) \ - $(if $(KBUILD_EXTMOD),-I $(modulesymfile)) \ -- $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \ -+ $(if $(KBUILD_EXTMOD),$(addprefix -e ,$(KBUILD_EXTRA_SYMBOLS))) \ - $(if $(KBUILD_EXTMOD),-o $(modulesymfile)) \ - $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S) \ - $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E) \ -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 3c88a3384064..771d7b334ad8 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -551,10 +551,7 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) - stream->metadata_set = false; - stream->next_track = false; - -- if (stream->direction == SND_COMPRESS_PLAYBACK) -- stream->runtime->state = SNDRV_PCM_STATE_SETUP; -- else -- stream->runtime->state = SNDRV_PCM_STATE_PREPARED; -+ stream->runtime->state = SNDRV_PCM_STATE_SETUP; - } else { - return -EPERM; - } -@@ -670,8 +667,17 @@ static int snd_compr_start(struct snd_compr_stream *stream) - { - int retval; - -- if (stream->runtime->state != SNDRV_PCM_STATE_PREPARED) -+ switch (stream->runtime->state) { -+ case SNDRV_PCM_STATE_SETUP: -+ if (stream->direction != SND_COMPRESS_CAPTURE) -+ return -EPERM; -+ break; -+ case SNDRV_PCM_STATE_PREPARED: -+ break; -+ default: - return -EPERM; -+ } -+ - retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_START); - if (!retval) - stream->runtime->state = SNDRV_PCM_STATE_RUNNING; -@@ -682,9 +688,15 @@ static int snd_compr_stop(struct snd_compr_stream *stream) - { - int retval; - -- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || -- stream->runtime->state == SNDRV_PCM_STATE_SETUP) -+ switch (stream->runtime->state) { -+ case SNDRV_PCM_STATE_OPEN: -+ case SNDRV_PCM_STATE_SETUP: -+ case SNDRV_PCM_STATE_PREPARED: - return -EPERM; -+ default: -+ break; -+ } -+ - retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); - if (!retval) { - snd_compr_drain_notify(stream); -@@ -733,9 +745,17 @@ static int snd_compr_drain(struct snd_compr_stream *stream) - { - int retval; - -- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || -- stream->runtime->state == SNDRV_PCM_STATE_SETUP) -+ switch (stream->runtime->state) { -+ case SNDRV_PCM_STATE_OPEN: -+ case SNDRV_PCM_STATE_SETUP: -+ case SNDRV_PCM_STATE_PREPARED: -+ case SNDRV_PCM_STATE_PAUSED: - return -EPERM; -+ case SNDRV_PCM_STATE_XRUN: -+ return -EPIPE; -+ default: -+ break; -+ } - - retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN); - if (retval) { -@@ -772,9 +792,19 @@ static int snd_compr_next_track(struct snd_compr_stream *stream) - static int snd_compr_partial_drain(struct snd_compr_stream *stream) - { - int retval; -- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED || -- stream->runtime->state == SNDRV_PCM_STATE_SETUP) -+ -+ switch (stream->runtime->state) { -+ case SNDRV_PCM_STATE_OPEN: -+ case SNDRV_PCM_STATE_SETUP: -+ case SNDRV_PCM_STATE_PREPARED: -+ case SNDRV_PCM_STATE_PAUSED: - return -EPERM; -+ case SNDRV_PCM_STATE_XRUN: -+ return -EPIPE; -+ default: -+ break; -+ } -+ - /* stream can be drained only when next track has been signalled */ - if (stream->next_track == false) - return -EPERM; -diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c -index ea1506679c66..3b09b8ef3a09 100644 ---- a/sound/firewire/packets-buffer.c -+++ b/sound/firewire/packets-buffer.c -@@ -37,7 +37,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit, - packets_per_page = PAGE_SIZE / packet_size; - if (WARN_ON(!packets_per_page)) { - err = -EINVAL; -- goto error; -+ goto err_packets; - } - pages = DIV_ROUND_UP(count, packets_per_page); - -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 689df78f640a..142549bbeb53 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -5917,7 +5917,7 @@ static int snd_hda_parse_generic_codec(struct hda_codec *codec) - - err = snd_hda_parse_pin_defcfg(codec, &spec->autocfg, NULL, 0); - if (err < 0) -- return err; -+ goto error; - - err = snd_hda_gen_parse_auto_config(codec, &spec->autocfg); - if (err < 0) -diff --git a/sound/sound_core.c b/sound/sound_core.c -index 99b73c675743..20d4e2e1bacf 100644 ---- a/sound/sound_core.c -+++ b/sound/sound_core.c -@@ -287,7 +287,8 @@ retry: - goto retry; - } - spin_unlock(&sound_loader_lock); -- return -EBUSY; -+ r = -EBUSY; -+ goto fail; - } - } - -diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c -index 9d4ac90ca87e..66fb1d53d0f0 100644 ---- a/tools/perf/builtin-probe.c -+++ b/tools/perf/builtin-probe.c -@@ -613,6 +613,16 @@ __cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused) - - ret = perf_add_probe_events(params.events, params.nevents); - if (ret < 0) { -+ -+ /* -+ * When perf_add_probe_events() fails it calls -+ * cleanup_perf_probe_events(pevs, npevs), i.e. -+ * cleanup_perf_probe_events(params.events, params.nevents), which -+ * will call clear_perf_probe_event(), so set nevents to zero -+ * to avoid cleanup_params() to call clear_perf_probe_event() again -+ * on the same pevs. -+ */ -+ params.nevents = 0; - pr_err_with_code(" Error: Failed to add events.", ret); - return ret; - } -diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c -index 304f5d710143..81ceb4ace88d 100644 ---- a/tools/perf/util/header.c -+++ b/tools/perf/util/header.c -@@ -2591,6 +2591,13 @@ int perf_session__read_header(struct perf_session *session) - file->path); - } - -+ if (f_header.attr_size == 0) { -+ pr_err("ERROR: The %s file's attr size field is 0 which is unexpected.\n" -+ "Was the 'perf record' command properly terminated?\n", -+ file->path); -+ return -EINVAL; -+ } -+ - nr_attrs = f_header.attrs.size / f_header.attr_size; - lseek(fd, f_header.attrs.offset, SEEK_SET); - -@@ -2673,7 +2680,7 @@ int perf_event__synthesize_attr(struct perf_tool *tool, - size += sizeof(struct perf_event_header); - size += ids * sizeof(u64); - -- ev = malloc(size); -+ ev = zalloc(size); - - if (ev == NULL) - return -ENOMEM; -diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c -index 829508a21448..45c19b443f2f 100644 ---- a/tools/perf/util/thread.c -+++ b/tools/perf/util/thread.c -@@ -110,14 +110,24 @@ struct comm *thread__comm(const struct thread *thread) - - struct comm *thread__exec_comm(const struct thread *thread) - { -- struct comm *comm, *last = NULL; -+ struct comm *comm, *last = NULL, *second_last = NULL; - - list_for_each_entry(comm, &thread->comm_list, list) { - if (comm->exec) - return comm; -+ second_last = last; - last = comm; - } - -+ /* -+ * 'last' with no start time might be the parent's comm of a synthesized -+ * thread (created by processing a synthesized fork event). For a main -+ * thread, that is very probably wrong. Prefer a later comm to avoid -+ * that case. -+ */ -+ if (second_last && !last->start && thread->pid_ == thread->tid) -+ return second_last; -+ - return last; - } - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.190-191.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.190-191.patch deleted file mode 100644 index 5e1c4670139d..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.190-191.patch +++ /dev/null @@ -1,3758 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 7a9fd54a0186..5b94c0bfba85 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -3415,6 +3415,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - Run specified binary instead of /init from the ramdisk, - used for early userspace startup. See initrd. - -+ rdrand= [X86] -+ force - Override the decision by the kernel to hide the -+ advertisement of RDRAND support (this affects -+ certain AMD processors because of buggy BIOS -+ support, specifically around the suspend/resume -+ path). -+ - reboot= [KNL] - Format (x86 or x86_64): - [w[arm] | c[old] | h[ard] | s[oft] | g[pio]] \ -diff --git a/Documentation/siphash.txt b/Documentation/siphash.txt -new file mode 100644 -index 000000000000..908d348ff777 ---- /dev/null -+++ b/Documentation/siphash.txt -@@ -0,0 +1,175 @@ -+ SipHash - a short input PRF -+----------------------------------------------- -+Written by Jason A. Donenfeld -+ -+SipHash is a cryptographically secure PRF -- a keyed hash function -- that -+performs very well for short inputs, hence the name. It was designed by -+cryptographers Daniel J. Bernstein and Jean-Philippe Aumasson. It is intended -+as a replacement for some uses of: `jhash`, `md5_transform`, `sha_transform`, -+and so forth. -+ -+SipHash takes a secret key filled with randomly generated numbers and either -+an input buffer or several input integers. It spits out an integer that is -+indistinguishable from random. You may then use that integer as part of secure -+sequence numbers, secure cookies, or mask it off for use in a hash table. -+ -+1. Generating a key -+ -+Keys should always be generated from a cryptographically secure source of -+random numbers, either using get_random_bytes or get_random_once: -+ -+siphash_key_t key; -+get_random_bytes(&key, sizeof(key)); -+ -+If you're not deriving your key from here, you're doing it wrong. -+ -+2. Using the functions -+ -+There are two variants of the function, one that takes a list of integers, and -+one that takes a buffer: -+ -+u64 siphash(const void *data, size_t len, const siphash_key_t *key); -+ -+And: -+ -+u64 siphash_1u64(u64, const siphash_key_t *key); -+u64 siphash_2u64(u64, u64, const siphash_key_t *key); -+u64 siphash_3u64(u64, u64, u64, const siphash_key_t *key); -+u64 siphash_4u64(u64, u64, u64, u64, const siphash_key_t *key); -+u64 siphash_1u32(u32, const siphash_key_t *key); -+u64 siphash_2u32(u32, u32, const siphash_key_t *key); -+u64 siphash_3u32(u32, u32, u32, const siphash_key_t *key); -+u64 siphash_4u32(u32, u32, u32, u32, const siphash_key_t *key); -+ -+If you pass the generic siphash function something of a constant length, it -+will constant fold at compile-time and automatically choose one of the -+optimized functions. -+ -+3. Hashtable key function usage: -+ -+struct some_hashtable { -+ DECLARE_HASHTABLE(hashtable, 8); -+ siphash_key_t key; -+}; -+ -+void init_hashtable(struct some_hashtable *table) -+{ -+ get_random_bytes(&table->key, sizeof(table->key)); -+} -+ -+static inline hlist_head *some_hashtable_bucket(struct some_hashtable *table, struct interesting_input *input) -+{ -+ return &table->hashtable[siphash(input, sizeof(*input), &table->key) & (HASH_SIZE(table->hashtable) - 1)]; -+} -+ -+You may then iterate like usual over the returned hash bucket. -+ -+4. Security -+ -+SipHash has a very high security margin, with its 128-bit key. So long as the -+key is kept secret, it is impossible for an attacker to guess the outputs of -+the function, even if being able to observe many outputs, since 2^128 outputs -+is significant. -+ -+Linux implements the "2-4" variant of SipHash. -+ -+5. Struct-passing Pitfalls -+ -+Often times the XuY functions will not be large enough, and instead you'll -+want to pass a pre-filled struct to siphash. When doing this, it's important -+to always ensure the struct has no padding holes. The easiest way to do this -+is to simply arrange the members of the struct in descending order of size, -+and to use offsetendof() instead of sizeof() for getting the size. For -+performance reasons, if possible, it's probably a good thing to align the -+struct to the right boundary. Here's an example: -+ -+const struct { -+ struct in6_addr saddr; -+ u32 counter; -+ u16 dport; -+} __aligned(SIPHASH_ALIGNMENT) combined = { -+ .saddr = *(struct in6_addr *)saddr, -+ .counter = counter, -+ .dport = dport -+}; -+u64 h = siphash(&combined, offsetofend(typeof(combined), dport), &secret); -+ -+6. Resources -+ -+Read the SipHash paper if you're interested in learning more: -+https://131002.net/siphash/siphash.pdf -+ -+ -+~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ -+ -+HalfSipHash - SipHash's insecure younger cousin -+----------------------------------------------- -+Written by Jason A. Donenfeld -+ -+On the off-chance that SipHash is not fast enough for your needs, you might be -+able to justify using HalfSipHash, a terrifying but potentially useful -+possibility. HalfSipHash cuts SipHash's rounds down from "2-4" to "1-3" and, -+even scarier, uses an easily brute-forcable 64-bit key (with a 32-bit output) -+instead of SipHash's 128-bit key. However, this may appeal to some -+high-performance `jhash` users. -+ -+Danger! -+ -+Do not ever use HalfSipHash except for as a hashtable key function, and only -+then when you can be absolutely certain that the outputs will never be -+transmitted out of the kernel. This is only remotely useful over `jhash` as a -+means of mitigating hashtable flooding denial of service attacks. -+ -+1. Generating a key -+ -+Keys should always be generated from a cryptographically secure source of -+random numbers, either using get_random_bytes or get_random_once: -+ -+hsiphash_key_t key; -+get_random_bytes(&key, sizeof(key)); -+ -+If you're not deriving your key from here, you're doing it wrong. -+ -+2. Using the functions -+ -+There are two variants of the function, one that takes a list of integers, and -+one that takes a buffer: -+ -+u32 hsiphash(const void *data, size_t len, const hsiphash_key_t *key); -+ -+And: -+ -+u32 hsiphash_1u32(u32, const hsiphash_key_t *key); -+u32 hsiphash_2u32(u32, u32, const hsiphash_key_t *key); -+u32 hsiphash_3u32(u32, u32, u32, const hsiphash_key_t *key); -+u32 hsiphash_4u32(u32, u32, u32, u32, const hsiphash_key_t *key); -+ -+If you pass the generic hsiphash function something of a constant length, it -+will constant fold at compile-time and automatically choose one of the -+optimized functions. -+ -+3. Hashtable key function usage: -+ -+struct some_hashtable { -+ DECLARE_HASHTABLE(hashtable, 8); -+ hsiphash_key_t key; -+}; -+ -+void init_hashtable(struct some_hashtable *table) -+{ -+ get_random_bytes(&table->key, sizeof(table->key)); -+} -+ -+static inline hlist_head *some_hashtable_bucket(struct some_hashtable *table, struct interesting_input *input) -+{ -+ return &table->hashtable[hsiphash(input, sizeof(*input), &table->key) & (HASH_SIZE(table->hashtable) - 1)]; -+} -+ -+You may then iterate like usual over the returned hash bucket. -+ -+4. Performance -+ -+HalfSipHash is roughly 3 times slower than JenkinsHash. For many replacements, -+this will not be a problem, as the hashtable lookup isn't the bottleneck. And -+in general, this is probably a good sacrifice to make for the security and DoS -+resistance of HalfSipHash. -diff --git a/MAINTAINERS b/MAINTAINERS -index f4d4a5544dc1..20a31b357929 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -9749,6 +9749,13 @@ F: arch/arm/mach-s3c24xx/mach-bast.c - F: arch/arm/mach-s3c24xx/bast-ide.c - F: arch/arm/mach-s3c24xx/bast-irq.c - -+SIPHASH PRF ROUTINES -+M: Jason A. Donenfeld -+S: Maintained -+F: lib/siphash.c -+F: lib/test_siphash.c -+F: include/linux/siphash.h -+ - TI DAVINCI MACHINE SUPPORT - M: Sekhar Nori - M: Kevin Hilman -diff --git a/Makefile b/Makefile -index 83acf2d6c55e..266c3d7e0120 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 190 -+SUBLEVEL = 191 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c -index c5bc344fc745..73039746ae36 100644 ---- a/arch/mips/kernel/i8253.c -+++ b/arch/mips/kernel/i8253.c -@@ -31,7 +31,8 @@ void __init setup_pit_timer(void) - - static int __init init_pit_clocksource(void) - { -- if (num_possible_cpus() > 1) /* PIT does not scale! */ -+ if (num_possible_cpus() > 1 || /* PIT does not scale! */ -+ !clockevent_state_periodic(&i8253_clockevent)) - return 0; - - return clocksource_i8253_init(); -diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h -index 4a8cb8d7cbd5..0232b5a2a2d9 100644 ---- a/arch/x86/include/asm/bootparam_utils.h -+++ b/arch/x86/include/asm/bootparam_utils.h -@@ -17,6 +17,20 @@ - * Note: efi_info is commonly left uninitialized, but that field has a - * private magic, so it is better to leave it unchanged. - */ -+ -+#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); }) -+ -+#define BOOT_PARAM_PRESERVE(struct_member) \ -+ { \ -+ .start = offsetof(struct boot_params, struct_member), \ -+ .len = sizeof_mbr(struct boot_params, struct_member), \ -+ } -+ -+struct boot_params_to_save { -+ unsigned int start; -+ unsigned int len; -+}; -+ - static void sanitize_boot_params(struct boot_params *boot_params) - { - /* -@@ -35,19 +49,39 @@ static void sanitize_boot_params(struct boot_params *boot_params) - */ - if (boot_params->sentinel) { - /* fields in boot_params are left uninitialized, clear them */ -- memset(&boot_params->ext_ramdisk_image, 0, -- (char *)&boot_params->efi_info - -- (char *)&boot_params->ext_ramdisk_image); -- memset(&boot_params->kbd_status, 0, -- (char *)&boot_params->hdr - -- (char *)&boot_params->kbd_status); -- memset(&boot_params->_pad7[0], 0, -- (char *)&boot_params->edd_mbr_sig_buffer[0] - -- (char *)&boot_params->_pad7[0]); -- memset(&boot_params->_pad8[0], 0, -- (char *)&boot_params->eddbuf[0] - -- (char *)&boot_params->_pad8[0]); -- memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9)); -+ static struct boot_params scratch; -+ char *bp_base = (char *)boot_params; -+ char *save_base = (char *)&scratch; -+ int i; -+ -+ const struct boot_params_to_save to_save[] = { -+ BOOT_PARAM_PRESERVE(screen_info), -+ BOOT_PARAM_PRESERVE(apm_bios_info), -+ BOOT_PARAM_PRESERVE(tboot_addr), -+ BOOT_PARAM_PRESERVE(ist_info), -+ BOOT_PARAM_PRESERVE(hd0_info), -+ BOOT_PARAM_PRESERVE(hd1_info), -+ BOOT_PARAM_PRESERVE(sys_desc_table), -+ BOOT_PARAM_PRESERVE(olpc_ofw_header), -+ BOOT_PARAM_PRESERVE(efi_info), -+ BOOT_PARAM_PRESERVE(alt_mem_k), -+ BOOT_PARAM_PRESERVE(scratch), -+ BOOT_PARAM_PRESERVE(e820_entries), -+ BOOT_PARAM_PRESERVE(eddbuf_entries), -+ BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), -+ BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), -+ BOOT_PARAM_PRESERVE(hdr), -+ BOOT_PARAM_PRESERVE(eddbuf), -+ }; -+ -+ memset(&scratch, 0, sizeof(scratch)); -+ -+ for (i = 0; i < ARRAY_SIZE(to_save); i++) { -+ memcpy(save_base + to_save[i].start, -+ bp_base + to_save[i].start, to_save[i].len); -+ } -+ -+ memcpy(boot_params, save_base, sizeof(*boot_params)); - } - } - -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index d4f5b8209393..30183770132a 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -311,6 +311,7 @@ - #define MSR_AMD64_PATCH_LEVEL 0x0000008b - #define MSR_AMD64_TSC_RATIO 0xc0000104 - #define MSR_AMD64_NB_CFG 0xc001001f -+#define MSR_AMD64_CPUID_FN_1 0xc0011004 - #define MSR_AMD64_PATCH_LOADER 0xc0010020 - #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140 - #define MSR_AMD64_OSVW_STATUS 0xc0010141 -diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h -index 5a10ac8c131e..20f822fec8af 100644 ---- a/arch/x86/include/asm/msr.h -+++ b/arch/x86/include/asm/msr.h -@@ -32,6 +32,16 @@ struct msr_regs_info { - int err; - }; - -+struct saved_msr { -+ bool valid; -+ struct msr_info info; -+}; -+ -+struct saved_msrs { -+ unsigned int num; -+ struct saved_msr *array; -+}; -+ - static inline unsigned long long native_read_tscp(unsigned int *aux) - { - unsigned long low, high; -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index e58c078f3d96..c3138ac80db2 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -151,7 +151,7 @@ - " lfence;\n" \ - " jmp 902b;\n" \ - " .align 16\n" \ -- "903: addl $4, %%esp;\n" \ -+ "903: lea 4(%%esp), %%esp;\n" \ - " pushl %[thunk_target];\n" \ - " ret;\n" \ - " .align 16\n" \ -diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h -index 6271281f947d..0d8e0831b1a0 100644 ---- a/arch/x86/include/asm/ptrace.h -+++ b/arch/x86/include/asm/ptrace.h -@@ -121,9 +121,9 @@ static inline int v8086_mode(struct pt_regs *regs) - #endif - } - --#ifdef CONFIG_X86_64 - static inline bool user_64bit_mode(struct pt_regs *regs) - { -+#ifdef CONFIG_X86_64 - #ifndef CONFIG_PARAVIRT - /* - * On non-paravirt systems, this is the only long mode CPL 3 -@@ -134,8 +134,12 @@ static inline bool user_64bit_mode(struct pt_regs *regs) - /* Headers are too twisted for this to go in paravirt.h. */ - return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs; - #endif -+#else /* !CONFIG_X86_64 */ -+ return false; -+#endif - } - -+#ifdef CONFIG_X86_64 - #define current_user_stack_pointer() current_pt_regs()->sp - #define compat_user_stack_pointer() current_pt_regs()->sp - #endif -diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h -index d1793f06854d..8e9dbe7b73a1 100644 ---- a/arch/x86/include/asm/suspend_32.h -+++ b/arch/x86/include/asm/suspend_32.h -@@ -15,6 +15,7 @@ struct saved_context { - unsigned long cr0, cr2, cr3, cr4; - u64 misc_enable; - bool misc_enable_saved; -+ struct saved_msrs saved_msrs; - struct desc_ptr gdt_desc; - struct desc_ptr idt; - u16 ldt; -diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h -index 7ebf0ebe4e68..6136a18152af 100644 ---- a/arch/x86/include/asm/suspend_64.h -+++ b/arch/x86/include/asm/suspend_64.h -@@ -24,6 +24,7 @@ struct saved_context { - unsigned long cr0, cr2, cr3, cr4, cr8; - u64 misc_enable; - bool misc_enable_saved; -+ struct saved_msrs saved_msrs; - unsigned long efer; - u16 gdt_pad; /* Unused */ - struct desc_ptr gdt_desc; -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index cc6c33249850..80c94fc8ad5a 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -593,7 +593,7 @@ static __initdata unsigned long lapic_cal_pm1, lapic_cal_pm2; - static __initdata unsigned long lapic_cal_j1, lapic_cal_j2; - - /* -- * Temporary interrupt handler. -+ * Temporary interrupt handler and polled calibration function. - */ - static void __init lapic_cal_handler(struct clock_event_device *dev) - { -@@ -677,7 +677,8 @@ calibrate_by_pmtimer(long deltapm, long *delta, long *deltatsc) - static int __init calibrate_APIC_clock(void) - { - struct clock_event_device *levt = this_cpu_ptr(&lapic_events); -- void (*real_handler)(struct clock_event_device *dev); -+ u64 tsc_perj = 0, tsc_start = 0; -+ unsigned long jif_start; - unsigned long deltaj; - long delta, deltatsc; - int pm_referenced = 0; -@@ -706,28 +707,64 @@ static int __init calibrate_APIC_clock(void) - apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n" - "calibrating APIC timer ...\n"); - -+ /* -+ * There are platforms w/o global clockevent devices. Instead of -+ * making the calibration conditional on that, use a polling based -+ * approach everywhere. -+ */ - local_irq_disable(); - -- /* Replace the global interrupt handler */ -- real_handler = global_clock_event->event_handler; -- global_clock_event->event_handler = lapic_cal_handler; -- - /* - * Setup the APIC counter to maximum. There is no way the lapic - * can underflow in the 100ms detection time frame - */ - __setup_APIC_LVTT(0xffffffff, 0, 0); - -- /* Let the interrupts run */ -+ /* -+ * Methods to terminate the calibration loop: -+ * 1) Global clockevent if available (jiffies) -+ * 2) TSC if available and frequency is known -+ */ -+ jif_start = READ_ONCE(jiffies); -+ -+ if (tsc_khz) { -+ tsc_start = rdtsc(); -+ tsc_perj = div_u64((u64)tsc_khz * 1000, HZ); -+ } -+ -+ /* -+ * Enable interrupts so the tick can fire, if a global -+ * clockevent device is available -+ */ - local_irq_enable(); - -- while (lapic_cal_loops <= LAPIC_CAL_LOOPS) -- cpu_relax(); -+ while (lapic_cal_loops <= LAPIC_CAL_LOOPS) { -+ /* Wait for a tick to elapse */ -+ while (1) { -+ if (tsc_khz) { -+ u64 tsc_now = rdtsc(); -+ if ((tsc_now - tsc_start) >= tsc_perj) { -+ tsc_start += tsc_perj; -+ break; -+ } -+ } else { -+ unsigned long jif_now = READ_ONCE(jiffies); - -- local_irq_disable(); -+ if (time_after(jif_now, jif_start)) { -+ jif_start = jif_now; -+ break; -+ } -+ } -+ cpu_relax(); -+ } - -- /* Restore the real event handler */ -- global_clock_event->event_handler = real_handler; -+ /* Invoke the calibration routine */ -+ local_irq_disable(); -+ lapic_cal_handler(NULL); -+ local_irq_enable(); -+ } -+ -+ local_irq_disable(); - - /* Build delta t1-t2 as apic timer counts down */ - delta = lapic_cal_t1 - lapic_cal_t2; -@@ -778,10 +815,11 @@ static int __init calibrate_APIC_clock(void) - levt->features &= ~CLOCK_EVT_FEAT_DUMMY; - - /* -- * PM timer calibration failed or not turned on -- * so lets try APIC timer based calibration -+ * PM timer calibration failed or not turned on so lets try APIC -+ * timer based calibration, if a global clockevent device is -+ * available. - */ -- if (!pm_referenced) { -+ if (!pm_referenced && global_clock_event) { - apic_printk(APIC_VERBOSE, "... verify APIC timer\n"); - - /* -@@ -993,6 +1031,10 @@ void clear_local_APIC(void) - apic_write(APIC_LVT0, v | APIC_LVT_MASKED); - v = apic_read(APIC_LVT1); - apic_write(APIC_LVT1, v | APIC_LVT_MASKED); -+ if (!x2apic_enabled()) { -+ v = apic_read(APIC_LDR) & ~APIC_LDR_MASK; -+ apic_write(APIC_LDR, v); -+ } - if (maxlvt >= 4) { - v = apic_read(APIC_LVTPC); - apic_write(APIC_LVTPC, v | APIC_LVT_MASKED); -diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c -index 971cf8875939..d75f665dd022 100644 ---- a/arch/x86/kernel/apic/bigsmp_32.c -+++ b/arch/x86/kernel/apic/bigsmp_32.c -@@ -37,32 +37,12 @@ static int bigsmp_early_logical_apicid(int cpu) - return early_per_cpu(x86_cpu_to_apicid, cpu); - } - --static inline unsigned long calculate_ldr(int cpu) --{ -- unsigned long val, id; -- -- val = apic_read(APIC_LDR) & ~APIC_LDR_MASK; -- id = per_cpu(x86_bios_cpu_apicid, cpu); -- val |= SET_APIC_LOGICAL_ID(id); -- -- return val; --} -- - /* -- * Set up the logical destination ID. -- * -- * Intel recommends to set DFR, LDR and TPR before enabling -- * an APIC. See e.g. "AP-388 82489DX User's Manual" (Intel -- * document number 292116). So here it goes... -+ * bigsmp enables physical destination mode -+ * and doesn't use LDR and DFR - */ - static void bigsmp_init_apic_ldr(void) - { -- unsigned long val; -- int cpu = smp_processor_id(); -- -- apic_write(APIC_DFR, APIC_DFR_FLAT); -- val = calculate_ldr(cpu); -- apic_write(APIC_LDR, val); - } - - static void bigsmp_setup_apic_routing(void) -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 6f2483292de0..424d8a636615 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -684,6 +684,64 @@ static void init_amd_ln(struct cpuinfo_x86 *c) - msr_set_bit(MSR_AMD64_DE_CFG, 31); - } - -+static bool rdrand_force; -+ -+static int __init rdrand_cmdline(char *str) -+{ -+ if (!str) -+ return -EINVAL; -+ -+ if (!strcmp(str, "force")) -+ rdrand_force = true; -+ else -+ return -EINVAL; -+ -+ return 0; -+} -+early_param("rdrand", rdrand_cmdline); -+ -+static void clear_rdrand_cpuid_bit(struct cpuinfo_x86 *c) -+{ -+ /* -+ * Saving of the MSR used to hide the RDRAND support during -+ * suspend/resume is done by arch/x86/power/cpu.c, which is -+ * dependent on CONFIG_PM_SLEEP. -+ */ -+ if (!IS_ENABLED(CONFIG_PM_SLEEP)) -+ return; -+ -+ /* -+ * The nordrand option can clear X86_FEATURE_RDRAND, so check for -+ * RDRAND support using the CPUID function directly. -+ */ -+ if (!(cpuid_ecx(1) & BIT(30)) || rdrand_force) -+ return; -+ -+ msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62); -+ -+ /* -+ * Verify that the CPUID change has occurred in case the kernel is -+ * running virtualized and the hypervisor doesn't support the MSR. -+ */ -+ if (cpuid_ecx(1) & BIT(30)) { -+ pr_info_once("BIOS may not properly restore RDRAND after suspend, but hypervisor does not support hiding RDRAND via CPUID.\n"); -+ return; -+ } -+ -+ clear_cpu_cap(c, X86_FEATURE_RDRAND); -+ pr_info_once("BIOS may not properly restore RDRAND after suspend, hiding RDRAND via CPUID. Use rdrand=force to reenable.\n"); -+} -+ -+static void init_amd_jg(struct cpuinfo_x86 *c) -+{ -+ /* -+ * Some BIOS implementations do not restore proper RDRAND support -+ * across suspend and resume. Check on whether to hide the RDRAND -+ * instruction support via CPUID. -+ */ -+ clear_rdrand_cpuid_bit(c); -+} -+ - static void init_amd_bd(struct cpuinfo_x86 *c) - { - u64 value; -@@ -711,6 +769,13 @@ static void init_amd_bd(struct cpuinfo_x86 *c) - wrmsrl_safe(0xc0011021, value); - } - } -+ -+ /* -+ * Some BIOS implementations do not restore proper RDRAND support -+ * across suspend and resume. Check on whether to hide the RDRAND -+ * instruction support via CPUID. -+ */ -+ clear_rdrand_cpuid_bit(c); - } - - static void init_amd_zn(struct cpuinfo_x86 *c) -@@ -755,6 +820,7 @@ static void init_amd(struct cpuinfo_x86 *c) - case 0x10: init_amd_gh(c); break; - case 0x12: init_amd_ln(c); break; - case 0x15: init_amd_bd(c); break; -+ case 0x16: init_amd_jg(c); break; - case 0x17: init_amd_zn(c); break; - } - -diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c -index 1ca929767a1b..0b6d27dfc234 100644 ---- a/arch/x86/kernel/ptrace.c -+++ b/arch/x86/kernel/ptrace.c -@@ -698,11 +698,10 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) - { - struct thread_struct *thread = &tsk->thread; - unsigned long val = 0; -- int index = n; - - if (n < HBP_NUM) { -+ int index = array_index_nospec(n, HBP_NUM); - struct perf_event *bp = thread->ptrace_bps[index]; -- index = array_index_nospec(index, HBP_NUM); - - if (bp) - val = bp->hw.info.address; -diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c -index b8105289c60b..178d63cac321 100644 ---- a/arch/x86/kernel/uprobes.c -+++ b/arch/x86/kernel/uprobes.c -@@ -514,9 +514,12 @@ struct uprobe_xol_ops { - void (*abort)(struct arch_uprobe *, struct pt_regs *); - }; - --static inline int sizeof_long(void) -+static inline int sizeof_long(struct pt_regs *regs) - { -- return is_ia32_task() ? 4 : 8; -+ /* -+ * Check registers for mode as in_xxx_syscall() does not apply here. -+ */ -+ return user_64bit_mode(regs) ? 8 : 4; - } - - static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs) -@@ -527,9 +530,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs) - - static int push_ret_address(struct pt_regs *regs, unsigned long ip) - { -- unsigned long new_sp = regs->sp - sizeof_long(); -+ unsigned long new_sp = regs->sp - sizeof_long(regs); - -- if (copy_to_user((void __user *)new_sp, &ip, sizeof_long())) -+ if (copy_to_user((void __user *)new_sp, &ip, sizeof_long(regs))) - return -EFAULT; - - regs->sp = new_sp; -@@ -562,7 +565,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs - long correction = utask->vaddr - utask->xol_vaddr; - regs->ip += correction; - } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) { -- regs->sp += sizeof_long(); /* Pop incorrect return address */ -+ regs->sp += sizeof_long(regs); /* Pop incorrect return address */ - if (push_ret_address(regs, utask->vaddr + auprobe->defparam.ilen)) - return -ERESTART; - } -@@ -671,7 +674,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs) - * "call" insn was executed out-of-line. Just restore ->sp and restart. - * We could also restore ->ip and try to call branch_emulate_op() again. - */ -- regs->sp += sizeof_long(); -+ regs->sp += sizeof_long(regs); - return -ERESTART; - } - -@@ -962,7 +965,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs) - unsigned long - arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs) - { -- int rasize = sizeof_long(), nleft; -+ int rasize = sizeof_long(regs), nleft; - unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */ - - if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize)) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 8613422660b6..9f70de2ca0e2 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5545,12 +5545,13 @@ restart: - unsigned long rflags = kvm_x86_ops->get_rflags(vcpu); - toggle_interruptibility(vcpu, ctxt->interruptibility); - vcpu->arch.emulate_regs_need_sync_to_vcpu = false; -- kvm_rip_write(vcpu, ctxt->eip); -- if (r == EMULATE_DONE && ctxt->tf) -- kvm_vcpu_do_singlestep(vcpu, &r); - if (!ctxt->have_exception || -- exception_type(ctxt->exception.vector) == EXCPT_TRAP) -+ exception_type(ctxt->exception.vector) == EXCPT_TRAP) { -+ kvm_rip_write(vcpu, ctxt->eip); -+ if (r == EMULATE_DONE && ctxt->tf) -+ kvm_vcpu_do_singlestep(vcpu, &r); - __kvm_set_rflags(vcpu, ctxt->eflags); -+ } - - /* - * For STI, interrupts are shadowed; so KVM_REQ_EVENT will -diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c -index 9ab52791fed5..2e5052b2d238 100644 ---- a/arch/x86/power/cpu.c -+++ b/arch/x86/power/cpu.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -23,6 +24,7 @@ - #include - #include - #include -+#include - - #ifdef CONFIG_X86_32 - __visible unsigned long saved_context_ebx; -@@ -32,6 +34,29 @@ __visible unsigned long saved_context_eflags; - #endif - struct saved_context saved_context; - -+static void msr_save_context(struct saved_context *ctxt) -+{ -+ struct saved_msr *msr = ctxt->saved_msrs.array; -+ struct saved_msr *end = msr + ctxt->saved_msrs.num; -+ -+ while (msr < end) { -+ msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); -+ msr++; -+ } -+} -+ -+static void msr_restore_context(struct saved_context *ctxt) -+{ -+ struct saved_msr *msr = ctxt->saved_msrs.array; -+ struct saved_msr *end = msr + ctxt->saved_msrs.num; -+ -+ while (msr < end) { -+ if (msr->valid) -+ wrmsrl(msr->info.msr_no, msr->info.reg.q); -+ msr++; -+ } -+} -+ - /** - * __save_processor_state - save CPU registers before creating a - * hibernation image and before restoring the memory state from it -@@ -111,6 +136,7 @@ static void __save_processor_state(struct saved_context *ctxt) - #endif - ctxt->misc_enable_saved = !rdmsrl_safe(MSR_IA32_MISC_ENABLE, - &ctxt->misc_enable); -+ msr_save_context(ctxt); - } - - /* Needed by apm.c */ -@@ -229,6 +255,7 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) - x86_platform.restore_sched_clock_state(); - mtrr_bp_restore(); - perf_restore_debug_store(); -+ msr_restore_context(ctxt); - } - - /* Needed by apm.c */ -@@ -320,3 +347,128 @@ static int __init bsp_pm_check_init(void) - } - - core_initcall(bsp_pm_check_init); -+ -+static int msr_build_context(const u32 *msr_id, const int num) -+{ -+ struct saved_msrs *saved_msrs = &saved_context.saved_msrs; -+ struct saved_msr *msr_array; -+ int total_num; -+ int i, j; -+ -+ total_num = saved_msrs->num + num; -+ -+ msr_array = kmalloc_array(total_num, sizeof(struct saved_msr), GFP_KERNEL); -+ if (!msr_array) { -+ pr_err("x86/pm: Can not allocate memory to save/restore MSRs during suspend.\n"); -+ return -ENOMEM; -+ } -+ -+ if (saved_msrs->array) { -+ /* -+ * Multiple callbacks can invoke this function, so copy any -+ * MSR save requests from previous invocations. -+ */ -+ memcpy(msr_array, saved_msrs->array, -+ sizeof(struct saved_msr) * saved_msrs->num); -+ -+ kfree(saved_msrs->array); -+ } -+ -+ for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { -+ msr_array[i].info.msr_no = msr_id[j]; -+ msr_array[i].valid = false; -+ msr_array[i].info.reg.q = 0; -+ } -+ saved_msrs->num = total_num; -+ saved_msrs->array = msr_array; -+ -+ return 0; -+} -+ -+/* -+ * The following sections are a quirk framework for problematic BIOSen: -+ * Sometimes MSRs are modified by the BIOSen after suspended to -+ * RAM, this might cause unexpected behavior after wakeup. -+ * Thus we save/restore these specified MSRs across suspend/resume -+ * in order to work around it. -+ * -+ * For any further problematic BIOSen/platforms, -+ * please add your own function similar to msr_initialize_bdw. -+ */ -+static int msr_initialize_bdw(const struct dmi_system_id *d) -+{ -+ /* Add any extra MSR ids into this array. */ -+ u32 bdw_msr_id[] = { MSR_IA32_THERM_CONTROL }; -+ -+ pr_info("x86/pm: %s detected, MSR saving is needed during suspending.\n", d->ident); -+ return msr_build_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id)); -+} -+ -+static struct dmi_system_id msr_save_dmi_table[] = { -+ { -+ .callback = msr_initialize_bdw, -+ .ident = "BROADWELL BDX_EP", -+ .matches = { -+ DMI_MATCH(DMI_PRODUCT_NAME, "GRANTLEY"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "E63448-400"), -+ }, -+ }, -+ {} -+}; -+ -+static int msr_save_cpuid_features(const struct x86_cpu_id *c) -+{ -+ u32 cpuid_msr_id[] = { -+ MSR_AMD64_CPUID_FN_1, -+ }; -+ -+ pr_info("x86/pm: family %#hx cpu detected, MSR saving is needed during suspending.\n", -+ c->family); -+ -+ return msr_build_context(cpuid_msr_id, ARRAY_SIZE(cpuid_msr_id)); -+} -+ -+static const struct x86_cpu_id msr_save_cpu_table[] = { -+ { -+ .vendor = X86_VENDOR_AMD, -+ .family = 0x15, -+ .model = X86_MODEL_ANY, -+ .feature = X86_FEATURE_ANY, -+ .driver_data = (kernel_ulong_t)msr_save_cpuid_features, -+ }, -+ { -+ .vendor = X86_VENDOR_AMD, -+ .family = 0x16, -+ .model = X86_MODEL_ANY, -+ .feature = X86_FEATURE_ANY, -+ .driver_data = (kernel_ulong_t)msr_save_cpuid_features, -+ }, -+ {} -+}; -+ -+typedef int (*pm_cpu_match_t)(const struct x86_cpu_id *); -+static int pm_cpu_check(const struct x86_cpu_id *c) -+{ -+ const struct x86_cpu_id *m; -+ int ret = 0; -+ -+ m = x86_match_cpu(msr_save_cpu_table); -+ if (m) { -+ pm_cpu_match_t fn; -+ -+ fn = (pm_cpu_match_t)m->driver_data; -+ ret = fn(m); -+ } -+ -+ return ret; -+} -+ -+static int pm_check_save_msr(void) -+{ -+ dmi_check_system(msr_save_dmi_table); -+ pm_cpu_check(msr_save_cpu_table); -+ -+ return 0; -+} -+ -+device_initcall(pm_check_save_msr); -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 18de4c457068..1d8901fc0bfa 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -703,6 +703,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) - unsigned int offset; - unsigned char *buf; - -+ if (!qc->cursg) { -+ qc->curbytes = qc->nbytes; -+ return; -+ } - if (qc->curbytes == qc->nbytes - qc->sect_size) - ap->hsm_task_state = HSM_ST_LAST; - -@@ -742,6 +746,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) - - if (qc->cursg_ofs == qc->cursg->length) { - qc->cursg = sg_next(qc->cursg); -+ if (!qc->cursg) -+ ap->hsm_task_state = HSM_ST_LAST; - qc->cursg_ofs = 0; - } - } -diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c -index dd3e7ba273ad..0fede051f4e1 100644 ---- a/drivers/dma/ste_dma40.c -+++ b/drivers/dma/ste_dma40.c -@@ -142,7 +142,7 @@ enum d40_events { - * when the DMA hw is powered off. - * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works. - */ --static u32 d40_backup_regs[] = { -+static __maybe_unused u32 d40_backup_regs[] = { - D40_DREG_LCPA, - D40_DREG_LCLA, - D40_DREG_PRMSE, -@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = { - - #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b) - --static u32 d40_backup_regs_chan[] = { -+static __maybe_unused u32 d40_backup_regs_chan[] = { - D40_CHAN_REG_SSCFG, - D40_CHAN_REG_SSELT, - D40_CHAN_REG_SSPTR, -diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c -index b83376077d72..cfa0cb22c9b3 100644 ---- a/drivers/hid/hid-tmff.c -+++ b/drivers/hid/hid-tmff.c -@@ -34,6 +34,8 @@ - - #include "hid-ids.h" - -+#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320 -+ - static const signed short ff_rumble[] = { - FF_RUMBLE, - -1 -@@ -88,6 +90,7 @@ static int tmff_play(struct input_dev *dev, void *data, - struct hid_field *ff_field = tmff->ff_field; - int x, y; - int left, right; /* Rumbling */ -+ int motor_swap; - - switch (effect->type) { - case FF_CONSTANT: -@@ -112,6 +115,13 @@ static int tmff_play(struct input_dev *dev, void *data, - ff_field->logical_minimum, - ff_field->logical_maximum); - -+ /* 2-in-1 strong motor is left */ -+ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) { -+ motor_swap = left; -+ left = right; -+ right = motor_swap; -+ } -+ - dbg_hid("(left,right)=(%08x, %08x)\n", left, right); - ff_field->value[0] = left; - ff_field->value[1] = right; -@@ -238,6 +248,8 @@ static const struct hid_device_id tm_devices[] = { - .driver_data = (unsigned long)ff_rumble }, - { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */ - .driver_data = (unsigned long)ff_rumble }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */ -+ .driver_data = (unsigned long)ff_rumble }, - { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */ - .driver_data = (unsigned long)ff_rumble }, - { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */ -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index b184956bd430..72a1fdd529be 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -674,7 +674,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len) - input_report_key(input, BTN_BASE2, (data[11] & 0x02)); - - if (data[12] & 0x80) -- input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f)); -+ input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1); - else - input_report_abs(input, ABS_WHEEL, 0); - -diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c -index e880702a3784..5eb9c3bba216 100644 ---- a/drivers/hwtracing/stm/core.c -+++ b/drivers/hwtracing/stm/core.c -@@ -1020,7 +1020,6 @@ int stm_source_register_device(struct device *parent, - - err: - put_device(&src->dev); -- kfree(src); - - return err; - } -diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c -index c60c7998af17..726fba452f5f 100644 ---- a/drivers/isdn/hardware/mISDN/hfcsusb.c -+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c -@@ -1402,6 +1402,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb, - printk(KERN_DEBUG - "%s: %s: alloc urb for fifo %i failed", - hw->name, __func__, fifo->fifonum); -+ continue; - } - fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo; - fifo->iso[i].indx = i; -@@ -1700,13 +1701,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel) - static int - setup_hfcsusb(struct hfcsusb *hw) - { -+ void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL); - u_char b; -+ int ret; - - if (debug & DBG_HFC_CALL_TRACE) - printk(KERN_DEBUG "%s: %s\n", hw->name, __func__); - -+ if (!dmabuf) -+ return -ENOMEM; -+ -+ ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf); -+ -+ memcpy(&b, dmabuf, sizeof(u_char)); -+ kfree(dmabuf); -+ - /* check the chip id */ -- if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) { -+ if (ret != 1) { - printk(KERN_DEBUG "%s: %s: cannot read chip id\n", - hw->name, __func__); - return 1; -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 8a6e7646e1c9..b1d5fa0bc8f7 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -1561,7 +1561,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) - unsigned long freed; - - c = container_of(shrink, struct dm_bufio_client, shrinker); -- if (!dm_bufio_trylock(c)) -+ if (sc->gfp_mask & __GFP_FS) -+ dm_bufio_lock(c); -+ else if (!dm_bufio_trylock(c)) - return SHRINK_STOP; - - freed = __scan(c, sc->nr_to_scan, sc->gfp_mask); -diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c -index cb5d0daf53bb..466158d06ab1 100644 ---- a/drivers/md/dm-table.c -+++ b/drivers/md/dm-table.c -@@ -1167,7 +1167,7 @@ void dm_table_event(struct dm_table *t) - } - EXPORT_SYMBOL(dm_table_event); - --sector_t dm_table_get_size(struct dm_table *t) -+inline sector_t dm_table_get_size(struct dm_table *t) - { - return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0; - } -@@ -1192,6 +1192,9 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector) - unsigned int l, n = 0, k = 0; - sector_t *node; - -+ if (unlikely(sector >= dm_table_get_size(t))) -+ return &t->targets[t->num_targets]; -+ - for (l = 0; l < t->depth; l++) { - n = get_child(n, k); - node = get_node(t, l, n); -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index 880b7dee9c52..fa9039a53ae5 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -616,39 +616,40 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) - - new_parent = shadow_current(s); - -+ pn = dm_block_data(new_parent); -+ size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ? -+ sizeof(__le64) : s->info->value_type.size; -+ -+ /* create & init the left block */ - r = new_block(s->info, &left); - if (r < 0) - return r; - -+ ln = dm_block_data(left); -+ nr_left = le32_to_cpu(pn->header.nr_entries) / 2; -+ -+ ln->header.flags = pn->header.flags; -+ ln->header.nr_entries = cpu_to_le32(nr_left); -+ ln->header.max_entries = pn->header.max_entries; -+ ln->header.value_size = pn->header.value_size; -+ memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0])); -+ memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size); -+ -+ /* create & init the right block */ - r = new_block(s->info, &right); - if (r < 0) { - unlock_block(s->info, left); - return r; - } - -- pn = dm_block_data(new_parent); -- ln = dm_block_data(left); - rn = dm_block_data(right); -- -- nr_left = le32_to_cpu(pn->header.nr_entries) / 2; - nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left; - -- ln->header.flags = pn->header.flags; -- ln->header.nr_entries = cpu_to_le32(nr_left); -- ln->header.max_entries = pn->header.max_entries; -- ln->header.value_size = pn->header.value_size; -- - rn->header.flags = pn->header.flags; - rn->header.nr_entries = cpu_to_le32(nr_right); - rn->header.max_entries = pn->header.max_entries; - rn->header.value_size = pn->header.value_size; -- -- memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0])); - memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0])); -- -- size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ? -- sizeof(__le64) : s->info->value_type.size; -- memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size); - memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left), - nr_right * size); - -diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c -index 20557e2c60c6..1d29771af380 100644 ---- a/drivers/md/persistent-data/dm-space-map-metadata.c -+++ b/drivers/md/persistent-data/dm-space-map-metadata.c -@@ -248,7 +248,7 @@ static int out(struct sm_metadata *smm) - } - - if (smm->recursion_count == 1) -- apply_bops(smm); -+ r = apply_bops(smm); - - smm->recursion_count--; - -diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c -index a8cee33ae8d2..305a3449e946 100644 ---- a/drivers/misc/vmw_vmci/vmci_doorbell.c -+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c -@@ -318,7 +318,8 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle) - - entry = container_of(resource, struct dbell_entry, resource); - if (entry->run_delayed) { -- schedule_work(&entry->work); -+ if (!schedule_work(&entry->work)) -+ vmci_resource_put(resource); - } else { - entry->notify_cb(entry->client_data); - vmci_resource_put(resource); -@@ -366,7 +367,8 @@ static void dbell_fire_entries(u32 notify_idx) - atomic_read(&dbell->active) == 1) { - if (dbell->run_delayed) { - vmci_resource_get(&dbell->resource); -- schedule_work(&dbell->work); -+ if (!schedule_work(&dbell->work)) -+ vmci_resource_put(&dbell->resource); - } else { - dbell->notify_cb(dbell->client_data); - } -diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c -index fb8741f18c1f..54ba1abb5460 100644 ---- a/drivers/mmc/core/sd.c -+++ b/drivers/mmc/core/sd.c -@@ -1232,6 +1232,12 @@ int mmc_attach_sd(struct mmc_host *host) - goto err; - } - -+ /* -+ * Some SD cards claims an out of spec VDD voltage range. Let's treat -+ * these bits as being in-valid and especially also bit7. -+ */ -+ ocr &= ~0x7FFF; -+ - rocr = mmc_select_voltage(host, ocr); - - /* -diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c -index 06d0b50dfe71..4e374a05319c 100644 ---- a/drivers/mmc/host/sdhci-of-at91.c -+++ b/drivers/mmc/host/sdhci-of-at91.c -@@ -144,6 +144,9 @@ static int sdhci_at91_probe(struct platform_device *pdev) - - sdhci_get_of_property(pdev); - -+ /* HS200 is broken at this moment */ -+ host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200; -+ - ret = sdhci_add_host(host); - if (ret) - goto clocks_disable_unprepare; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 168f2331194f..fd6aff9f0052 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2081,6 +2081,15 @@ static void bond_miimon_commit(struct bonding *bond) - bond_for_each_slave(bond, slave, iter) { - switch (slave->new_link) { - case BOND_LINK_NOCHANGE: -+ /* For 802.3ad mode, check current slave speed and -+ * duplex again in case its port was disabled after -+ * invalid speed/duplex reporting but recovered before -+ * link monitoring could make a decision on the actual -+ * link status -+ */ -+ if (BOND_MODE(bond) == BOND_MODE_8023AD && -+ slave->link == BOND_LINK_UP) -+ bond_3ad_adapter_speed_duplex_changed(slave); - continue; - - case BOND_LINK_UP: -diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c -index 8b7c6425b681..9dd968ee792e 100644 ---- a/drivers/net/can/dev.c -+++ b/drivers/net/can/dev.c -@@ -1065,6 +1065,8 @@ static struct rtnl_link_ops can_link_ops __read_mostly = { - int register_candev(struct net_device *dev) - { - dev->rtnl_link_ops = &can_link_ops; -+ netif_carrier_off(dev); -+ - return register_netdev(dev); - } - EXPORT_SYMBOL_GPL(register_candev); -diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c -index dd56133cc461..fc9f8b01ecae 100644 ---- a/drivers/net/can/sja1000/peak_pcmcia.c -+++ b/drivers/net/can/sja1000/peak_pcmcia.c -@@ -487,7 +487,7 @@ static void pcan_free_channels(struct pcan_pccard *card) - if (!netdev) - continue; - -- strncpy(name, netdev->name, IFNAMSIZ); -+ strlcpy(name, netdev->name, IFNAMSIZ); - - unregister_sja1000dev(netdev); - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index e13bc27b4291..b1d68f49b398 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -881,7 +881,7 @@ static void peak_usb_disconnect(struct usb_interface *intf) - - dev_prev_siblings = dev->prev_siblings; - dev->state &= ~PCAN_USB_STATE_CONNECTED; -- strncpy(name, netdev->name, IFNAMSIZ); -+ strlcpy(name, netdev->name, IFNAMSIZ); - - unregister_netdev(netdev); - -diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -index 3dd4c39640dc..bee615cddbdd 100644 ---- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c -@@ -3260,7 +3260,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!adapter->regs) { - dev_err(&pdev->dev, "cannot map device registers\n"); - err = -ENOMEM; -- goto out_free_adapter; -+ goto out_free_adapter_nofail; - } - - adapter->pdev = pdev; -@@ -3378,6 +3378,9 @@ out_free_dev: - if (adapter->port[i]) - free_netdev(adapter->port[i]); - -+out_free_adapter_nofail: -+ kfree_skb(adapter->nofail_skb); -+ - out_free_adapter: - kfree(adapter); - -diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c -index 60c727b0b7ab..def831c89d35 100644 ---- a/drivers/net/ethernet/hisilicon/hip04_eth.c -+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c -@@ -157,6 +157,7 @@ struct hip04_priv { - unsigned int reg_inten; - - struct napi_struct napi; -+ struct device *dev; - struct net_device *ndev; - - struct tx_desc *tx_desc; -@@ -185,7 +186,7 @@ struct hip04_priv { - - static inline unsigned int tx_count(unsigned int head, unsigned int tail) - { -- return (head - tail) % (TX_DESC_NUM - 1); -+ return (head - tail) % TX_DESC_NUM; - } - - static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex) -@@ -387,7 +388,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force) - } - - if (priv->tx_phys[tx_tail]) { -- dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail], -+ dma_unmap_single(priv->dev, priv->tx_phys[tx_tail], - priv->tx_skb[tx_tail]->len, - DMA_TO_DEVICE); - priv->tx_phys[tx_tail] = 0; -@@ -437,8 +438,8 @@ static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) - return NETDEV_TX_BUSY; - } - -- phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE); -- if (dma_mapping_error(&ndev->dev, phys)) { -+ phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE); -+ if (dma_mapping_error(priv->dev, phys)) { - dev_kfree_skb(skb); - return NETDEV_TX_OK; - } -@@ -497,13 +498,16 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - u16 len; - u32 err; - -+ /* clean up tx descriptors */ -+ tx_remaining = hip04_tx_reclaim(ndev, false); -+ - while (cnt && !last) { - buf = priv->rx_buf[priv->rx_head]; - skb = build_skb(buf, priv->rx_buf_size); - if (unlikely(!skb)) - net_dbg_ratelimited("build_skb failed\n"); - -- dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head], -+ dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head], - RX_BUF_SIZE, DMA_FROM_DEVICE); - priv->rx_phys[priv->rx_head] = 0; - -@@ -531,9 +535,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - buf = netdev_alloc_frag(priv->rx_buf_size); - if (!buf) - goto done; -- phys = dma_map_single(&ndev->dev, buf, -+ phys = dma_map_single(priv->dev, buf, - RX_BUF_SIZE, DMA_FROM_DEVICE); -- if (dma_mapping_error(&ndev->dev, phys)) -+ if (dma_mapping_error(priv->dev, phys)) - goto done; - priv->rx_buf[priv->rx_head] = buf; - priv->rx_phys[priv->rx_head] = phys; -@@ -554,8 +558,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - } - napi_complete(napi); - done: -- /* clean up tx descriptors and start a new timer if necessary */ -- tx_remaining = hip04_tx_reclaim(ndev, false); -+ /* start a new timer if necessary */ - if (rx < budget && tx_remaining) - hip04_start_tx_timer(priv); - -@@ -637,9 +640,9 @@ static int hip04_mac_open(struct net_device *ndev) - for (i = 0; i < RX_DESC_NUM; i++) { - dma_addr_t phys; - -- phys = dma_map_single(&ndev->dev, priv->rx_buf[i], -+ phys = dma_map_single(priv->dev, priv->rx_buf[i], - RX_BUF_SIZE, DMA_FROM_DEVICE); -- if (dma_mapping_error(&ndev->dev, phys)) -+ if (dma_mapping_error(priv->dev, phys)) - return -EIO; - - priv->rx_phys[i] = phys; -@@ -673,7 +676,7 @@ static int hip04_mac_stop(struct net_device *ndev) - - for (i = 0; i < RX_DESC_NUM; i++) { - if (priv->rx_phys[i]) { -- dma_unmap_single(&ndev->dev, priv->rx_phys[i], -+ dma_unmap_single(priv->dev, priv->rx_phys[i], - RX_BUF_SIZE, DMA_FROM_DEVICE); - priv->rx_phys[i] = 0; - } -@@ -824,6 +827,7 @@ static int hip04_mac_probe(struct platform_device *pdev) - return -ENOMEM; - - priv = netdev_priv(ndev); -+ priv->dev = d; - priv->ndev = ndev; - platform_set_drvdata(pdev, ndev); - -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index ee6fefe92af4..4391430e2527 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -719,6 +719,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ - {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ - {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ -+ {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ - {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ - {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ - {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ -diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c -index dbab722a0654..6f9d9b90ac64 100644 ---- a/drivers/nfc/st-nci/se.c -+++ b/drivers/nfc/st-nci/se.c -@@ -346,6 +346,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev, - - transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, - skb->len - 2, GFP_KERNEL); -+ if (!transaction) -+ return -ENOMEM; - - transaction->aid_len = skb->data[1]; - memcpy(transaction->aid, &skb->data[2], transaction->aid_len); -diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c -index c79d99b24c96..f1b96b5255e0 100644 ---- a/drivers/nfc/st21nfca/se.c -+++ b/drivers/nfc/st21nfca/se.c -@@ -327,6 +327,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, - - transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, - skb->len - 2, GFP_KERNEL); -+ if (!transaction) -+ return -ENOMEM; - - transaction->aid_len = skb->data[1]; - memcpy(transaction->aid, &skb->data[2], -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index b140e81c4f7d..fd8bbd2b5d0e 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -4418,6 +4418,9 @@ static inline int ufshcd_config_vreg_lpm(struct ufs_hba *hba, - static inline int ufshcd_config_vreg_hpm(struct ufs_hba *hba, - struct ufs_vreg *vreg) - { -+ if (!vreg) -+ return 0; -+ - return ufshcd_config_vreg_load(hba->dev, vreg, vreg->max_uA); - } - -diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c -index 61ea87917433..71ad04d54212 100644 ---- a/drivers/usb/class/cdc-wdm.c -+++ b/drivers/usb/class/cdc-wdm.c -@@ -577,10 +577,20 @@ static int wdm_flush(struct file *file, fl_owner_t id) - { - struct wdm_device *desc = file->private_data; - -- wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags)); -+ wait_event(desc->wait, -+ /* -+ * needs both flags. We cannot do with one -+ * because resetting it would cause a race -+ * with write() yet we need to signal -+ * a disconnect -+ */ -+ !test_bit(WDM_IN_USE, &desc->flags) || -+ test_bit(WDM_DISCONNECTING, &desc->flags)); - - /* cannot dereference desc->intf if WDM_DISCONNECTING */ -- if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags)) -+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) -+ return -ENODEV; -+ if (desc->werr < 0) - dev_err(&desc->intf->dev, "Error in flush path: %d\n", - desc->werr); - -@@ -968,8 +978,6 @@ static void wdm_disconnect(struct usb_interface *intf) - spin_lock_irqsave(&desc->iuspin, flags); - set_bit(WDM_DISCONNECTING, &desc->flags); - set_bit(WDM_READ, &desc->flags); -- /* to terminate pending flushes */ -- clear_bit(WDM_IN_USE, &desc->flags); - spin_unlock_irqrestore(&desc->iuspin, flags); - wake_up_all(&desc->wait); - mutex_lock(&desc->rlock); -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 8bf54477f472..351a406b97af 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1889,6 +1889,7 @@ void composite_disconnect(struct usb_gadget *gadget) - * disconnect callbacks? - */ - spin_lock_irqsave(&cdev->lock, flags); -+ cdev->suspended = 0; - if (cdev->config) - reset_config(cdev); - if (cdev->driver->disconnect) -diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c -index 2341af4f3490..11b3a8c57eab 100644 ---- a/drivers/usb/host/fotg210-hcd.c -+++ b/drivers/usb/host/fotg210-hcd.c -@@ -1653,6 +1653,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - /* see what we found out */ - temp = check_reset_complete(fotg210, wIndex, status_reg, - fotg210_readl(fotg210, status_reg)); -+ -+ /* restart schedule */ -+ fotg210->command |= CMD_RUN; -+ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command); - } - - if (!(temp & (PORT_RESUME|PORT_RESET))) { -diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c -index 602c6e42c34d..27bd3e49fe8e 100644 ---- a/drivers/usb/host/ohci-hcd.c -+++ b/drivers/usb/host/ohci-hcd.c -@@ -415,8 +415,7 @@ static void ohci_usb_reset (struct ohci_hcd *ohci) - * other cases where the next software may expect clean state from the - * "firmware". this is bus-neutral, unlike shutdown() methods. - */ --static void --ohci_shutdown (struct usb_hcd *hcd) -+static void _ohci_shutdown(struct usb_hcd *hcd) - { - struct ohci_hcd *ohci; - -@@ -432,6 +431,16 @@ ohci_shutdown (struct usb_hcd *hcd) - ohci->rh_state = OHCI_RH_HALTED; - } - -+static void ohci_shutdown(struct usb_hcd *hcd) -+{ -+ struct ohci_hcd *ohci = hcd_to_ohci(hcd); -+ unsigned long flags; -+ -+ spin_lock_irqsave(&ohci->lock, flags); -+ _ohci_shutdown(hcd); -+ spin_unlock_irqrestore(&ohci->lock, flags); -+} -+ - /*-------------------------------------------------------------------------* - * HC functions - *-------------------------------------------------------------------------*/ -@@ -750,7 +759,7 @@ static void io_watchdog_func(unsigned long _ohci) - died: - usb_hc_died(ohci_to_hcd(ohci)); - ohci_dump(ohci); -- ohci_shutdown(ohci_to_hcd(ohci)); -+ _ohci_shutdown(ohci_to_hcd(ohci)); - goto done; - } else { - /* No write back because the done queue was empty */ -diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c -index be432bec0c5b..f0ca9feaea1d 100644 ---- a/drivers/usb/storage/realtek_cr.c -+++ b/drivers/usb/storage/realtek_cr.c -@@ -50,7 +50,7 @@ MODULE_VERSION("1.03"); - - static int auto_delink_en = 1; - module_param(auto_delink_en, int, S_IRUGO | S_IWUSR); --MODULE_PARM_DESC(auto_delink_en, "enable auto delink"); -+MODULE_PARM_DESC(auto_delink_en, "auto delink mode (0=firmware, 1=software [default])"); - - #ifdef CONFIG_REALTEK_AUTOPM - static int ss_en = 1; -@@ -1006,12 +1006,15 @@ static int init_realtek_cr(struct us_data *us) - goto INIT_FAIL; - } - -- if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) || -- CHECK_FW_VER(chip, 0x5901)) -- SET_AUTO_DELINK(chip); -- if (STATUS_LEN(chip) == 16) { -- if (SUPPORT_AUTO_DELINK(chip)) -+ if (CHECK_PID(chip, 0x0138) || CHECK_PID(chip, 0x0158) || -+ CHECK_PID(chip, 0x0159)) { -+ if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) || -+ CHECK_FW_VER(chip, 0x5901)) - SET_AUTO_DELINK(chip); -+ if (STATUS_LEN(chip) == 16) { -+ if (SUPPORT_AUTO_DELINK(chip)) -+ SET_AUTO_DELINK(chip); -+ } - } - #ifdef CONFIG_REALTEK_AUTOPM - if (ss_en) -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index d92b974f0635..a98259e136dd 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2006,7 +2006,7 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201, - US_FL_IGNORE_RESIDUE ), - - /* Reported by Michael Büsch */ --UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116, -+UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0117, - "JMicron", - "USB to ATA/ATAPI Bridge", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index f46317135224..1459dc9fd701 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -39,6 +39,12 @@ MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;" - * Using this limit prevents one virtqueue from starving others. */ - #define VHOST_NET_WEIGHT 0x80000 - -+/* Max number of packets transferred before requeueing the job. -+ * Using this limit prevents one virtqueue from starving others with small -+ * pkts. -+ */ -+#define VHOST_NET_PKT_WEIGHT 256 -+ - /* MAX number of TX used buffers for outstanding zerocopy */ - #define VHOST_MAX_PEND 128 - #define VHOST_GOODCOPY_LEN 256 -@@ -308,6 +314,7 @@ static void handle_tx(struct vhost_net *net) - struct socket *sock; - struct vhost_net_ubuf_ref *uninitialized_var(ubufs); - bool zcopy, zcopy_used; -+ int sent_pkts = 0; - - mutex_lock(&vq->mutex); - sock = vq->private_data; -@@ -319,7 +326,7 @@ static void handle_tx(struct vhost_net *net) - hdr_size = nvq->vhost_hlen; - zcopy = nvq->ubufs; - -- for (;;) { -+ do { - /* Release DMAs done buffers first */ - if (zcopy) - vhost_zerocopy_signal_used(net, vq); -@@ -408,11 +415,7 @@ static void handle_tx(struct vhost_net *net) - vhost_zerocopy_signal_used(net, vq); - total_len += len; - vhost_net_tx_packet(net); -- if (unlikely(total_len >= VHOST_NET_WEIGHT)) { -- vhost_poll_queue(&vq->poll); -- break; -- } -- } -+ } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len))); - out: - mutex_unlock(&vq->mutex); - } -@@ -539,6 +542,7 @@ static void handle_rx(struct vhost_net *net) - struct socket *sock; - struct iov_iter fixup; - __virtio16 num_buffers; -+ int recv_pkts = 0; - - mutex_lock(&vq->mutex); - sock = vq->private_data; -@@ -553,7 +557,10 @@ static void handle_rx(struct vhost_net *net) - vq->log : NULL; - mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF); - -- while ((sock_len = peek_head_len(sock->sk))) { -+ do { -+ sock_len = peek_head_len(sock->sk); -+ if (!sock_len) -+ break; - sock_len += sock_hlen; - vhost_len = sock_len + vhost_hlen; - headcount = get_rx_bufs(vq, vq->heads, vhost_len, -@@ -631,11 +638,8 @@ static void handle_rx(struct vhost_net *net) - if (unlikely(vq_log)) - vhost_log_write(vq, vq_log, log, vhost_len); - total_len += vhost_len; -- if (unlikely(total_len >= VHOST_NET_WEIGHT)) { -- vhost_poll_queue(&vq->poll); -- break; -- } -- } -+ } while (likely(!vhost_exceeds_weight(vq, ++recv_pkts, total_len))); -+ - out: - mutex_unlock(&vq->mutex); - } -@@ -704,7 +708,8 @@ static int vhost_net_open(struct inode *inode, struct file *f) - n->vqs[i].vhost_hlen = 0; - n->vqs[i].sock_hlen = 0; - } -- vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX); -+ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX, -+ VHOST_NET_PKT_WEIGHT, VHOST_NET_WEIGHT); - - vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev); - vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev); -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index 8fc62a03637a..269cfdd2958d 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -58,6 +58,12 @@ - #define VHOST_SCSI_PREALLOC_UPAGES 2048 - #define VHOST_SCSI_PREALLOC_PROT_SGLS 512 - -+/* Max number of requests before requeueing the job. -+ * Using this limit prevents one virtqueue from starving others with -+ * request. -+ */ -+#define VHOST_SCSI_WEIGHT 256 -+ - struct vhost_scsi_inflight { - /* Wait for the flush operation to finish */ - struct completion comp; -@@ -855,7 +861,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - u64 tag; - u32 exp_data_len, data_direction; - unsigned out, in; -- int head, ret, prot_bytes; -+ int head, ret, prot_bytes, c = 0; - size_t req_size, rsp_size = sizeof(struct virtio_scsi_cmd_resp); - size_t out_size, in_size; - u16 lun; -@@ -874,7 +880,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - - vhost_disable_notify(&vs->dev, vq); - -- for (;;) { -+ do { - head = vhost_get_vq_desc(vq, vq->iov, - ARRAY_SIZE(vq->iov), &out, &in, - NULL, NULL); -@@ -1090,7 +1096,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) - */ - INIT_WORK(&cmd->work, vhost_scsi_submission_work); - queue_work(vhost_scsi_workqueue, &cmd->work); -- } -+ } while (likely(!vhost_exceeds_weight(vq, ++c, 0))); - out: - mutex_unlock(&vq->mutex); - } -@@ -1443,7 +1449,8 @@ static int vhost_scsi_open(struct inode *inode, struct file *f) - vqs[i] = &vs->vqs[i].vq; - vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick; - } -- vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ); -+ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, -+ VHOST_SCSI_WEIGHT, 0); - - vhost_scsi_init_inflight(vs, NULL); - -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index 2ed0a356d1d3..0f653f314876 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -370,8 +370,24 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev) - vhost_vq_free_iovecs(dev->vqs[i]); - } - -+bool vhost_exceeds_weight(struct vhost_virtqueue *vq, -+ int pkts, int total_len) -+{ -+ struct vhost_dev *dev = vq->dev; -+ -+ if ((dev->byte_weight && total_len >= dev->byte_weight) || -+ pkts >= dev->weight) { -+ vhost_poll_queue(&vq->poll); -+ return true; -+ } -+ -+ return false; -+} -+EXPORT_SYMBOL_GPL(vhost_exceeds_weight); -+ - void vhost_dev_init(struct vhost_dev *dev, -- struct vhost_virtqueue **vqs, int nvqs) -+ struct vhost_virtqueue **vqs, int nvqs, -+ int weight, int byte_weight) - { - struct vhost_virtqueue *vq; - int i; -@@ -386,6 +402,8 @@ void vhost_dev_init(struct vhost_dev *dev, - spin_lock_init(&dev->work_lock); - INIT_LIST_HEAD(&dev->work_list); - dev->worker = NULL; -+ dev->weight = weight; -+ dev->byte_weight = byte_weight; - - for (i = 0; i < dev->nvqs; ++i) { - vq = dev->vqs[i]; -diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h -index d3f767448a72..5ac486970569 100644 ---- a/drivers/vhost/vhost.h -+++ b/drivers/vhost/vhost.h -@@ -127,9 +127,13 @@ struct vhost_dev { - spinlock_t work_lock; - struct list_head work_list; - struct task_struct *worker; -+ int weight; -+ int byte_weight; - }; - --void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs); -+bool vhost_exceeds_weight(struct vhost_virtqueue *vq, int pkts, int total_len); -+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, -+ int nvqs, int weight, int byte_weight); - long vhost_dev_set_owner(struct vhost_dev *dev); - bool vhost_dev_has_owner(struct vhost_dev *dev); - long vhost_dev_check_owner(struct vhost_dev *); -diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c -index 8a5ce5b5a0b6..199b1fb3669c 100644 ---- a/drivers/watchdog/bcm2835_wdt.c -+++ b/drivers/watchdog/bcm2835_wdt.c -@@ -248,6 +248,7 @@ module_param(nowayout, bool, 0); - MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" - __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); - -+MODULE_ALIAS("platform:bcm2835-wdt"); - MODULE_AUTHOR("Lubomir Rintel "); - MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer"); - MODULE_LICENSE("GPL"); -diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c -index ef24894edecc..9c159e6ad116 100644 ---- a/fs/gfs2/rgrp.c -+++ b/fs/gfs2/rgrp.c -@@ -739,6 +739,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) - - gfs2_free_clones(rgd); - kfree(rgd->rd_bits); -+ rgd->rd_bits = NULL; - return_all_reservations(rgd); - kmem_cache_free(gfs2_rgrpd_cachep, rgd); - } -@@ -933,10 +934,6 @@ static int read_rindex_entry(struct gfs2_inode *ip) - if (error) - goto fail; - -- rgd->rd_gl->gl_object = rgd; -- rgd->rd_gl->gl_vm.start = (rgd->rd_addr * bsize) & PAGE_CACHE_MASK; -- rgd->rd_gl->gl_vm.end = PAGE_CACHE_ALIGN((rgd->rd_addr + -- rgd->rd_length) * bsize) - 1; - rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr; - rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED); - if (rgd->rd_data > sdp->sd_max_rg_data) -@@ -944,14 +941,20 @@ static int read_rindex_entry(struct gfs2_inode *ip) - spin_lock(&sdp->sd_rindex_spin); - error = rgd_insert(rgd); - spin_unlock(&sdp->sd_rindex_spin); -- if (!error) -+ if (!error) { -+ rgd->rd_gl->gl_object = rgd; -+ rgd->rd_gl->gl_vm.start = (rgd->rd_addr * bsize) & PAGE_MASK; -+ rgd->rd_gl->gl_vm.end = PAGE_ALIGN((rgd->rd_addr + -+ rgd->rd_length) * bsize) - 1; - return 0; -+ } - - error = 0; /* someone else read in the rgrp; free it and ignore it */ - gfs2_glock_put(rgd->rd_gl); - - fail: - kfree(rgd->rd_bits); -+ rgd->rd_bits = NULL; - kmem_cache_free(gfs2_rgrpd_cachep, rgd); - return error; - } -diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h -index 4afdee420d25..9f15696f55b9 100644 ---- a/fs/nfs/nfs4_fs.h -+++ b/fs/nfs/nfs4_fs.h -@@ -416,7 +416,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session, - - extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, struct rpc_cred *, gfp_t); - extern void nfs4_put_state_owner(struct nfs4_state_owner *); --extern void nfs4_purge_state_owners(struct nfs_server *); -+extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *); -+extern void nfs4_free_state_owners(struct list_head *head); - extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *); - extern void nfs4_put_open_state(struct nfs4_state *); - extern void nfs4_close_state(struct nfs4_state *, fmode_t); -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index ae91d1e450be..dac20f31f01f 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -685,9 +685,12 @@ found: - - static void nfs4_destroy_server(struct nfs_server *server) - { -+ LIST_HEAD(freeme); -+ - nfs_server_return_all_delegations(server); - unset_pnfs_layoutdriver(server); -- nfs4_purge_state_owners(server); -+ nfs4_purge_state_owners(server, &freeme); -+ nfs4_free_state_owners(&freeme); - } - - /* -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 5be61affeefd..ef3ed2b1fd27 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -611,24 +611,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp) - /** - * nfs4_purge_state_owners - Release all cached state owners - * @server: nfs_server with cached state owners to release -+ * @head: resulting list of state owners - * - * Called at umount time. Remaining state owners will be on - * the LRU with ref count of zero. -+ * Note that the state owners are not freed, but are added -+ * to the list @head, which can later be used as an argument -+ * to nfs4_free_state_owners. - */ --void nfs4_purge_state_owners(struct nfs_server *server) -+void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head) - { - struct nfs_client *clp = server->nfs_client; - struct nfs4_state_owner *sp, *tmp; -- LIST_HEAD(doomed); - - spin_lock(&clp->cl_lock); - list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) { -- list_move(&sp->so_lru, &doomed); -+ list_move(&sp->so_lru, head); - nfs4_remove_state_owner_locked(sp); - } - spin_unlock(&clp->cl_lock); -+} - -- list_for_each_entry_safe(sp, tmp, &doomed, so_lru) { -+/** -+ * nfs4_purge_state_owners - Release all cached state owners -+ * @head: resulting list of state owners -+ * -+ * Frees a list of state owners that was generated by -+ * nfs4_purge_state_owners -+ */ -+void nfs4_free_state_owners(struct list_head *head) -+{ -+ struct nfs4_state_owner *sp, *tmp; -+ -+ list_for_each_entry_safe(sp, tmp, head, so_lru) { - list_del(&sp->so_lru); - nfs4_free_state_owner(sp); - } -@@ -1724,12 +1739,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov - struct nfs4_state_owner *sp; - struct nfs_server *server; - struct rb_node *pos; -+ LIST_HEAD(freeme); - int status = 0; - - restart: - rcu_read_lock(); - list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { -- nfs4_purge_state_owners(server); -+ nfs4_purge_state_owners(server, &freeme); - spin_lock(&clp->cl_lock); - for (pos = rb_first(&server->state_owners); - pos != NULL; -@@ -1758,6 +1774,7 @@ restart: - spin_unlock(&clp->cl_lock); - } - rcu_read_unlock(); -+ nfs4_free_state_owners(&freeme); - return 0; - } - -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index f187e02d267e..fe1c146f4032 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -431,6 +431,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - /* len == 0 means wake all */ - struct userfaultfd_wake_range range = { .len = 0, }; - unsigned long new_flags; -+ bool still_valid; - - ACCESS_ONCE(ctx->released) = true; - -@@ -446,8 +447,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - * taking the mmap_sem for writing. - */ - down_write(&mm->mmap_sem); -- if (!mmget_still_valid(mm)) -- goto skip_mm; -+ still_valid = mmget_still_valid(mm); - prev = NULL; - for (vma = mm->mmap; vma; vma = vma->vm_next) { - cond_resched(); -@@ -458,20 +458,21 @@ static int userfaultfd_release(struct inode *inode, struct file *file) - continue; - } - new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP); -- prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end, -- new_flags, vma->anon_vma, -- vma->vm_file, vma->vm_pgoff, -- vma_policy(vma), -- NULL_VM_UFFD_CTX, -- vma_get_anon_name(vma)); -- if (prev) -- vma = prev; -- else -- prev = vma; -+ if (still_valid) { -+ prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end, -+ new_flags, vma->anon_vma, -+ vma->vm_file, vma->vm_pgoff, -+ vma_policy(vma), -+ NULL_VM_UFFD_CTX, -+ vma_get_anon_name(vma)); -+ if (prev) -+ vma = prev; -+ else -+ prev = vma; -+ } - vma->vm_flags = new_flags; - vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; - } --skip_mm: - up_write(&mm->mmap_sem); - mmput(mm); - wakeup: -diff --git a/include/linux/siphash.h b/include/linux/siphash.h -new file mode 100644 -index 000000000000..bf21591a9e5e ---- /dev/null -+++ b/include/linux/siphash.h -@@ -0,0 +1,145 @@ -+/* Copyright (C) 2016 Jason A. Donenfeld . All Rights Reserved. -+ * -+ * This file is provided under a dual BSD/GPLv2 license. -+ * -+ * SipHash: a fast short-input PRF -+ * https://131002.net/siphash/ -+ * -+ * This implementation is specifically for SipHash2-4 for a secure PRF -+ * and HalfSipHash1-3/SipHash1-3 for an insecure PRF only suitable for -+ * hashtables. -+ */ -+ -+#ifndef _LINUX_SIPHASH_H -+#define _LINUX_SIPHASH_H -+ -+#include -+#include -+ -+#define SIPHASH_ALIGNMENT __alignof__(u64) -+typedef struct { -+ u64 key[2]; -+} siphash_key_t; -+ -+static inline bool siphash_key_is_zero(const siphash_key_t *key) -+{ -+ return !(key->key[0] | key->key[1]); -+} -+ -+u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key); -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key); -+#endif -+ -+u64 siphash_1u64(const u64 a, const siphash_key_t *key); -+u64 siphash_2u64(const u64 a, const u64 b, const siphash_key_t *key); -+u64 siphash_3u64(const u64 a, const u64 b, const u64 c, -+ const siphash_key_t *key); -+u64 siphash_4u64(const u64 a, const u64 b, const u64 c, const u64 d, -+ const siphash_key_t *key); -+u64 siphash_1u32(const u32 a, const siphash_key_t *key); -+u64 siphash_3u32(const u32 a, const u32 b, const u32 c, -+ const siphash_key_t *key); -+ -+static inline u64 siphash_2u32(const u32 a, const u32 b, -+ const siphash_key_t *key) -+{ -+ return siphash_1u64((u64)b << 32 | a, key); -+} -+static inline u64 siphash_4u32(const u32 a, const u32 b, const u32 c, -+ const u32 d, const siphash_key_t *key) -+{ -+ return siphash_2u64((u64)b << 32 | a, (u64)d << 32 | c, key); -+} -+ -+ -+static inline u64 ___siphash_aligned(const __le64 *data, size_t len, -+ const siphash_key_t *key) -+{ -+ if (__builtin_constant_p(len) && len == 4) -+ return siphash_1u32(le32_to_cpup((const __le32 *)data), key); -+ if (__builtin_constant_p(len) && len == 8) -+ return siphash_1u64(le64_to_cpu(data[0]), key); -+ if (__builtin_constant_p(len) && len == 16) -+ return siphash_2u64(le64_to_cpu(data[0]), le64_to_cpu(data[1]), -+ key); -+ if (__builtin_constant_p(len) && len == 24) -+ return siphash_3u64(le64_to_cpu(data[0]), le64_to_cpu(data[1]), -+ le64_to_cpu(data[2]), key); -+ if (__builtin_constant_p(len) && len == 32) -+ return siphash_4u64(le64_to_cpu(data[0]), le64_to_cpu(data[1]), -+ le64_to_cpu(data[2]), le64_to_cpu(data[3]), -+ key); -+ return __siphash_aligned(data, len, key); -+} -+ -+/** -+ * siphash - compute 64-bit siphash PRF value -+ * @data: buffer to hash -+ * @size: size of @data -+ * @key: the siphash key -+ */ -+static inline u64 siphash(const void *data, size_t len, -+ const siphash_key_t *key) -+{ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ if (!IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT)) -+ return __siphash_unaligned(data, len, key); -+#endif -+ return ___siphash_aligned(data, len, key); -+} -+ -+#define HSIPHASH_ALIGNMENT __alignof__(unsigned long) -+typedef struct { -+ unsigned long key[2]; -+} hsiphash_key_t; -+ -+u32 __hsiphash_aligned(const void *data, size_t len, -+ const hsiphash_key_t *key); -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+u32 __hsiphash_unaligned(const void *data, size_t len, -+ const hsiphash_key_t *key); -+#endif -+ -+u32 hsiphash_1u32(const u32 a, const hsiphash_key_t *key); -+u32 hsiphash_2u32(const u32 a, const u32 b, const hsiphash_key_t *key); -+u32 hsiphash_3u32(const u32 a, const u32 b, const u32 c, -+ const hsiphash_key_t *key); -+u32 hsiphash_4u32(const u32 a, const u32 b, const u32 c, const u32 d, -+ const hsiphash_key_t *key); -+ -+static inline u32 ___hsiphash_aligned(const __le32 *data, size_t len, -+ const hsiphash_key_t *key) -+{ -+ if (__builtin_constant_p(len) && len == 4) -+ return hsiphash_1u32(le32_to_cpu(data[0]), key); -+ if (__builtin_constant_p(len) && len == 8) -+ return hsiphash_2u32(le32_to_cpu(data[0]), le32_to_cpu(data[1]), -+ key); -+ if (__builtin_constant_p(len) && len == 12) -+ return hsiphash_3u32(le32_to_cpu(data[0]), le32_to_cpu(data[1]), -+ le32_to_cpu(data[2]), key); -+ if (__builtin_constant_p(len) && len == 16) -+ return hsiphash_4u32(le32_to_cpu(data[0]), le32_to_cpu(data[1]), -+ le32_to_cpu(data[2]), le32_to_cpu(data[3]), -+ key); -+ return __hsiphash_aligned(data, len, key); -+} -+ -+/** -+ * hsiphash - compute 32-bit hsiphash PRF value -+ * @data: buffer to hash -+ * @size: size of @data -+ * @key: the hsiphash key -+ */ -+static inline u32 hsiphash(const void *data, size_t len, -+ const hsiphash_key_t *key) -+{ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+ if (!IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT)) -+ return __hsiphash_unaligned(data, len, key); -+#endif -+ return ___hsiphash_aligned(data, len, key); -+} -+ -+#endif /* _LINUX_SIPHASH_H */ -diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h -index fde4068eec0b..636e9e11bd5f 100644 ---- a/include/net/netfilter/nf_conntrack.h -+++ b/include/net/netfilter/nf_conntrack.h -@@ -297,6 +297,8 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net, - gfp_t flags); - void nf_ct_tmpl_free(struct nf_conn *tmpl); - -+u32 nf_ct_get_id(const struct nf_conn *ct); -+ - #define NF_CT_STAT_INC(net, count) __this_cpu_inc((net)->ct.stat->count) - #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count) - -diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h -index 61c38f87ea07..e6f49f22e006 100644 ---- a/include/net/netns/ipv4.h -+++ b/include/net/netns/ipv4.h -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - - struct tcpm_hash_bucket; - struct ctl_table_header; -@@ -109,5 +110,6 @@ struct netns_ipv4 { - #endif - #endif - atomic_t rt_genid; -+ siphash_key_t ip_id_key; - }; - #endif -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 0410fd29d569..4447195a0cd4 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1540,6 +1540,10 @@ static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk) - { - struct sk_buff *skb = tcp_send_head(sk); - -+ /* empty retransmit queue, for example due to zero window */ -+ if (skb == tcp_write_queue_head(sk)) -+ return NULL; -+ - return skb ? tcp_write_queue_prev(sk, skb) : tcp_write_queue_tail(sk); - } - -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index f0602beeba26..fd1205a3dbdb 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -1706,6 +1706,16 @@ config TEST_RHASHTABLE - - If unsure, say N. - -+config TEST_HASH -+ tristate "Perform selftest on hash functions" -+ default n -+ help -+ Enable this option to test the kernel's siphash () -+ hash functions on boot (or module load). -+ -+ This is intended to help people writing architecture-specific -+ optimized versions. If unsure, say N. -+ - endmenu # runtime tests - - config PROVIDE_OHCI1394_DMA_INIT -diff --git a/lib/Makefile b/lib/Makefile -index cb4f6aa95013..6c6c1fb2fa04 100644 ---- a/lib/Makefile -+++ b/lib/Makefile -@@ -13,7 +13,7 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \ - sha1.o md5.o irq_regs.o argv_split.o \ - proportions.o flex_proportions.o ratelimit.o show_mem.o \ - is_single_threaded.o plist.o decompress.o kobject_uevent.o \ -- earlycpio.o seq_buf.o nmi_backtrace.o -+ earlycpio.o seq_buf.o siphash.o nmi_backtrace.o - - obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o - lib-$(CONFIG_MMU) += ioremap.o -@@ -35,6 +35,7 @@ obj-$(CONFIG_TEST_HEXDUMP) += test-hexdump.o - obj-y += kstrtox.o - obj-$(CONFIG_TEST_BPF) += test_bpf.o - obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o -+obj-$(CONFIG_TEST_HASH) += test_siphash.o - obj-$(CONFIG_TEST_KASAN) += test_kasan.o - obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o - obj-$(CONFIG_TEST_LKM) += test_module.o -diff --git a/lib/siphash.c b/lib/siphash.c -new file mode 100644 -index 000000000000..3ae58b4edad6 ---- /dev/null -+++ b/lib/siphash.c -@@ -0,0 +1,551 @@ -+/* Copyright (C) 2016 Jason A. Donenfeld . All Rights Reserved. -+ * -+ * This file is provided under a dual BSD/GPLv2 license. -+ * -+ * SipHash: a fast short-input PRF -+ * https://131002.net/siphash/ -+ * -+ * This implementation is specifically for SipHash2-4 for a secure PRF -+ * and HalfSipHash1-3/SipHash1-3 for an insecure PRF only suitable for -+ * hashtables. -+ */ -+ -+#include -+#include -+ -+#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64 -+#include -+#include -+#endif -+ -+#define SIPROUND \ -+ do { \ -+ v0 += v1; v1 = rol64(v1, 13); v1 ^= v0; v0 = rol64(v0, 32); \ -+ v2 += v3; v3 = rol64(v3, 16); v3 ^= v2; \ -+ v0 += v3; v3 = rol64(v3, 21); v3 ^= v0; \ -+ v2 += v1; v1 = rol64(v1, 17); v1 ^= v2; v2 = rol64(v2, 32); \ -+ } while (0) -+ -+#define PREAMBLE(len) \ -+ u64 v0 = 0x736f6d6570736575ULL; \ -+ u64 v1 = 0x646f72616e646f6dULL; \ -+ u64 v2 = 0x6c7967656e657261ULL; \ -+ u64 v3 = 0x7465646279746573ULL; \ -+ u64 b = ((u64)(len)) << 56; \ -+ v3 ^= key->key[1]; \ -+ v2 ^= key->key[0]; \ -+ v1 ^= key->key[1]; \ -+ v0 ^= key->key[0]; -+ -+#define POSTAMBLE \ -+ v3 ^= b; \ -+ SIPROUND; \ -+ SIPROUND; \ -+ v0 ^= b; \ -+ v2 ^= 0xff; \ -+ SIPROUND; \ -+ SIPROUND; \ -+ SIPROUND; \ -+ SIPROUND; \ -+ return (v0 ^ v1) ^ (v2 ^ v3); -+ -+u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u64)); -+ const u8 left = len & (sizeof(u64) - 1); -+ u64 m; -+ PREAMBLE(len) -+ for (; data != end; data += sizeof(u64)) { -+ m = le64_to_cpup(data); -+ v3 ^= m; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= m; -+ } -+#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64 -+ if (left) -+ b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) & -+ bytemask_from_count(left))); -+#else -+ switch (left) { -+ case 7: b |= ((u64)end[6]) << 48; -+ case 6: b |= ((u64)end[5]) << 40; -+ case 5: b |= ((u64)end[4]) << 32; -+ case 4: b |= le32_to_cpup(data); break; -+ case 3: b |= ((u64)end[2]) << 16; -+ case 2: b |= le16_to_cpup(data); break; -+ case 1: b |= end[0]; -+ } -+#endif -+ POSTAMBLE -+} -+EXPORT_SYMBOL(__siphash_aligned); -+ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u64)); -+ const u8 left = len & (sizeof(u64) - 1); -+ u64 m; -+ PREAMBLE(len) -+ for (; data != end; data += sizeof(u64)) { -+ m = get_unaligned_le64(data); -+ v3 ^= m; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= m; -+ } -+#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64 -+ if (left) -+ b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) & -+ bytemask_from_count(left))); -+#else -+ switch (left) { -+ case 7: b |= ((u64)end[6]) << 48; -+ case 6: b |= ((u64)end[5]) << 40; -+ case 5: b |= ((u64)end[4]) << 32; -+ case 4: b |= get_unaligned_le32(end); break; -+ case 3: b |= ((u64)end[2]) << 16; -+ case 2: b |= get_unaligned_le16(end); break; -+ case 1: b |= end[0]; -+ } -+#endif -+ POSTAMBLE -+} -+EXPORT_SYMBOL(__siphash_unaligned); -+#endif -+ -+/** -+ * siphash_1u64 - compute 64-bit siphash PRF value of a u64 -+ * @first: first u64 -+ * @key: the siphash key -+ */ -+u64 siphash_1u64(const u64 first, const siphash_key_t *key) -+{ -+ PREAMBLE(8) -+ v3 ^= first; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= first; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_1u64); -+ -+/** -+ * siphash_2u64 - compute 64-bit siphash PRF value of 2 u64 -+ * @first: first u64 -+ * @second: second u64 -+ * @key: the siphash key -+ */ -+u64 siphash_2u64(const u64 first, const u64 second, const siphash_key_t *key) -+{ -+ PREAMBLE(16) -+ v3 ^= first; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= second; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_2u64); -+ -+/** -+ * siphash_3u64 - compute 64-bit siphash PRF value of 3 u64 -+ * @first: first u64 -+ * @second: second u64 -+ * @third: third u64 -+ * @key: the siphash key -+ */ -+u64 siphash_3u64(const u64 first, const u64 second, const u64 third, -+ const siphash_key_t *key) -+{ -+ PREAMBLE(24) -+ v3 ^= first; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= second; -+ v3 ^= third; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= third; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_3u64); -+ -+/** -+ * siphash_4u64 - compute 64-bit siphash PRF value of 4 u64 -+ * @first: first u64 -+ * @second: second u64 -+ * @third: third u64 -+ * @forth: forth u64 -+ * @key: the siphash key -+ */ -+u64 siphash_4u64(const u64 first, const u64 second, const u64 third, -+ const u64 forth, const siphash_key_t *key) -+{ -+ PREAMBLE(32) -+ v3 ^= first; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= second; -+ v3 ^= third; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= third; -+ v3 ^= forth; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= forth; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_4u64); -+ -+u64 siphash_1u32(const u32 first, const siphash_key_t *key) -+{ -+ PREAMBLE(4) -+ b |= first; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_1u32); -+ -+u64 siphash_3u32(const u32 first, const u32 second, const u32 third, -+ const siphash_key_t *key) -+{ -+ u64 combined = (u64)second << 32 | first; -+ PREAMBLE(12) -+ v3 ^= combined; -+ SIPROUND; -+ SIPROUND; -+ v0 ^= combined; -+ b |= third; -+ POSTAMBLE -+} -+EXPORT_SYMBOL(siphash_3u32); -+ -+#if BITS_PER_LONG == 64 -+/* Note that on 64-bit, we make HalfSipHash1-3 actually be SipHash1-3, for -+ * performance reasons. On 32-bit, below, we actually implement HalfSipHash1-3. -+ */ -+ -+#define HSIPROUND SIPROUND -+#define HPREAMBLE(len) PREAMBLE(len) -+#define HPOSTAMBLE \ -+ v3 ^= b; \ -+ HSIPROUND; \ -+ v0 ^= b; \ -+ v2 ^= 0xff; \ -+ HSIPROUND; \ -+ HSIPROUND; \ -+ HSIPROUND; \ -+ return (v0 ^ v1) ^ (v2 ^ v3); -+ -+u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u64)); -+ const u8 left = len & (sizeof(u64) - 1); -+ u64 m; -+ HPREAMBLE(len) -+ for (; data != end; data += sizeof(u64)) { -+ m = le64_to_cpup(data); -+ v3 ^= m; -+ HSIPROUND; -+ v0 ^= m; -+ } -+#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64 -+ if (left) -+ b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) & -+ bytemask_from_count(left))); -+#else -+ switch (left) { -+ case 7: b |= ((u64)end[6]) << 48; -+ case 6: b |= ((u64)end[5]) << 40; -+ case 5: b |= ((u64)end[4]) << 32; -+ case 4: b |= le32_to_cpup(data); break; -+ case 3: b |= ((u64)end[2]) << 16; -+ case 2: b |= le16_to_cpup(data); break; -+ case 1: b |= end[0]; -+ } -+#endif -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(__hsiphash_aligned); -+ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+u32 __hsiphash_unaligned(const void *data, size_t len, -+ const hsiphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u64)); -+ const u8 left = len & (sizeof(u64) - 1); -+ u64 m; -+ HPREAMBLE(len) -+ for (; data != end; data += sizeof(u64)) { -+ m = get_unaligned_le64(data); -+ v3 ^= m; -+ HSIPROUND; -+ v0 ^= m; -+ } -+#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64 -+ if (left) -+ b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) & -+ bytemask_from_count(left))); -+#else -+ switch (left) { -+ case 7: b |= ((u64)end[6]) << 48; -+ case 6: b |= ((u64)end[5]) << 40; -+ case 5: b |= ((u64)end[4]) << 32; -+ case 4: b |= get_unaligned_le32(end); break; -+ case 3: b |= ((u64)end[2]) << 16; -+ case 2: b |= get_unaligned_le16(end); break; -+ case 1: b |= end[0]; -+ } -+#endif -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(__hsiphash_unaligned); -+#endif -+ -+/** -+ * hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32 -+ * @first: first u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_1u32(const u32 first, const hsiphash_key_t *key) -+{ -+ HPREAMBLE(4) -+ b |= first; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_1u32); -+ -+/** -+ * hsiphash_2u32 - compute 32-bit hsiphash PRF value of 2 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_2u32(const u32 first, const u32 second, const hsiphash_key_t *key) -+{ -+ u64 combined = (u64)second << 32 | first; -+ HPREAMBLE(8) -+ v3 ^= combined; -+ HSIPROUND; -+ v0 ^= combined; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_2u32); -+ -+/** -+ * hsiphash_3u32 - compute 32-bit hsiphash PRF value of 3 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @third: third u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_3u32(const u32 first, const u32 second, const u32 third, -+ const hsiphash_key_t *key) -+{ -+ u64 combined = (u64)second << 32 | first; -+ HPREAMBLE(12) -+ v3 ^= combined; -+ HSIPROUND; -+ v0 ^= combined; -+ b |= third; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_3u32); -+ -+/** -+ * hsiphash_4u32 - compute 32-bit hsiphash PRF value of 4 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @third: third u32 -+ * @forth: forth u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_4u32(const u32 first, const u32 second, const u32 third, -+ const u32 forth, const hsiphash_key_t *key) -+{ -+ u64 combined = (u64)second << 32 | first; -+ HPREAMBLE(16) -+ v3 ^= combined; -+ HSIPROUND; -+ v0 ^= combined; -+ combined = (u64)forth << 32 | third; -+ v3 ^= combined; -+ HSIPROUND; -+ v0 ^= combined; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_4u32); -+#else -+#define HSIPROUND \ -+ do { \ -+ v0 += v1; v1 = rol32(v1, 5); v1 ^= v0; v0 = rol32(v0, 16); \ -+ v2 += v3; v3 = rol32(v3, 8); v3 ^= v2; \ -+ v0 += v3; v3 = rol32(v3, 7); v3 ^= v0; \ -+ v2 += v1; v1 = rol32(v1, 13); v1 ^= v2; v2 = rol32(v2, 16); \ -+ } while (0) -+ -+#define HPREAMBLE(len) \ -+ u32 v0 = 0; \ -+ u32 v1 = 0; \ -+ u32 v2 = 0x6c796765U; \ -+ u32 v3 = 0x74656462U; \ -+ u32 b = ((u32)(len)) << 24; \ -+ v3 ^= key->key[1]; \ -+ v2 ^= key->key[0]; \ -+ v1 ^= key->key[1]; \ -+ v0 ^= key->key[0]; -+ -+#define HPOSTAMBLE \ -+ v3 ^= b; \ -+ HSIPROUND; \ -+ v0 ^= b; \ -+ v2 ^= 0xff; \ -+ HSIPROUND; \ -+ HSIPROUND; \ -+ HSIPROUND; \ -+ return v1 ^ v3; -+ -+u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u32)); -+ const u8 left = len & (sizeof(u32) - 1); -+ u32 m; -+ HPREAMBLE(len) -+ for (; data != end; data += sizeof(u32)) { -+ m = le32_to_cpup(data); -+ v3 ^= m; -+ HSIPROUND; -+ v0 ^= m; -+ } -+ switch (left) { -+ case 3: b |= ((u32)end[2]) << 16; -+ case 2: b |= le16_to_cpup(data); break; -+ case 1: b |= end[0]; -+ } -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(__hsiphash_aligned); -+ -+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS -+u32 __hsiphash_unaligned(const void *data, size_t len, -+ const hsiphash_key_t *key) -+{ -+ const u8 *end = data + len - (len % sizeof(u32)); -+ const u8 left = len & (sizeof(u32) - 1); -+ u32 m; -+ HPREAMBLE(len) -+ for (; data != end; data += sizeof(u32)) { -+ m = get_unaligned_le32(data); -+ v3 ^= m; -+ HSIPROUND; -+ v0 ^= m; -+ } -+ switch (left) { -+ case 3: b |= ((u32)end[2]) << 16; -+ case 2: b |= get_unaligned_le16(end); break; -+ case 1: b |= end[0]; -+ } -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(__hsiphash_unaligned); -+#endif -+ -+/** -+ * hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32 -+ * @first: first u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_1u32(const u32 first, const hsiphash_key_t *key) -+{ -+ HPREAMBLE(4) -+ v3 ^= first; -+ HSIPROUND; -+ v0 ^= first; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_1u32); -+ -+/** -+ * hsiphash_2u32 - compute 32-bit hsiphash PRF value of 2 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_2u32(const u32 first, const u32 second, const hsiphash_key_t *key) -+{ -+ HPREAMBLE(8) -+ v3 ^= first; -+ HSIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ HSIPROUND; -+ v0 ^= second; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_2u32); -+ -+/** -+ * hsiphash_3u32 - compute 32-bit hsiphash PRF value of 3 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @third: third u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_3u32(const u32 first, const u32 second, const u32 third, -+ const hsiphash_key_t *key) -+{ -+ HPREAMBLE(12) -+ v3 ^= first; -+ HSIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ HSIPROUND; -+ v0 ^= second; -+ v3 ^= third; -+ HSIPROUND; -+ v0 ^= third; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_3u32); -+ -+/** -+ * hsiphash_4u32 - compute 32-bit hsiphash PRF value of 4 u32 -+ * @first: first u32 -+ * @second: second u32 -+ * @third: third u32 -+ * @forth: forth u32 -+ * @key: the hsiphash key -+ */ -+u32 hsiphash_4u32(const u32 first, const u32 second, const u32 third, -+ const u32 forth, const hsiphash_key_t *key) -+{ -+ HPREAMBLE(16) -+ v3 ^= first; -+ HSIPROUND; -+ v0 ^= first; -+ v3 ^= second; -+ HSIPROUND; -+ v0 ^= second; -+ v3 ^= third; -+ HSIPROUND; -+ v0 ^= third; -+ v3 ^= forth; -+ HSIPROUND; -+ v0 ^= forth; -+ HPOSTAMBLE -+} -+EXPORT_SYMBOL(hsiphash_4u32); -+#endif -diff --git a/lib/test_siphash.c b/lib/test_siphash.c -new file mode 100644 -index 000000000000..a6d854d933bf ---- /dev/null -+++ b/lib/test_siphash.c -@@ -0,0 +1,223 @@ -+/* Test cases for siphash.c -+ * -+ * Copyright (C) 2016 Jason A. Donenfeld . All Rights Reserved. -+ * -+ * This file is provided under a dual BSD/GPLv2 license. -+ * -+ * SipHash: a fast short-input PRF -+ * https://131002.net/siphash/ -+ * -+ * This implementation is specifically for SipHash2-4 for a secure PRF -+ * and HalfSipHash1-3/SipHash1-3 for an insecure PRF only suitable for -+ * hashtables. -+ */ -+ -+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt -+ -+#include -+#include -+#include -+#include -+#include -+ -+/* Test vectors taken from reference source available at: -+ * https://github.com/veorq/SipHash -+ */ -+ -+static const siphash_key_t test_key_siphash = -+ {{ 0x0706050403020100ULL, 0x0f0e0d0c0b0a0908ULL }}; -+ -+static const u64 test_vectors_siphash[64] = { -+ 0x726fdb47dd0e0e31ULL, 0x74f839c593dc67fdULL, 0x0d6c8009d9a94f5aULL, -+ 0x85676696d7fb7e2dULL, 0xcf2794e0277187b7ULL, 0x18765564cd99a68dULL, -+ 0xcbc9466e58fee3ceULL, 0xab0200f58b01d137ULL, 0x93f5f5799a932462ULL, -+ 0x9e0082df0ba9e4b0ULL, 0x7a5dbbc594ddb9f3ULL, 0xf4b32f46226bada7ULL, -+ 0x751e8fbc860ee5fbULL, 0x14ea5627c0843d90ULL, 0xf723ca908e7af2eeULL, -+ 0xa129ca6149be45e5ULL, 0x3f2acc7f57c29bdbULL, 0x699ae9f52cbe4794ULL, -+ 0x4bc1b3f0968dd39cULL, 0xbb6dc91da77961bdULL, 0xbed65cf21aa2ee98ULL, -+ 0xd0f2cbb02e3b67c7ULL, 0x93536795e3a33e88ULL, 0xa80c038ccd5ccec8ULL, -+ 0xb8ad50c6f649af94ULL, 0xbce192de8a85b8eaULL, 0x17d835b85bbb15f3ULL, -+ 0x2f2e6163076bcfadULL, 0xde4daaaca71dc9a5ULL, 0xa6a2506687956571ULL, -+ 0xad87a3535c49ef28ULL, 0x32d892fad841c342ULL, 0x7127512f72f27cceULL, -+ 0xa7f32346f95978e3ULL, 0x12e0b01abb051238ULL, 0x15e034d40fa197aeULL, -+ 0x314dffbe0815a3b4ULL, 0x027990f029623981ULL, 0xcadcd4e59ef40c4dULL, -+ 0x9abfd8766a33735cULL, 0x0e3ea96b5304a7d0ULL, 0xad0c42d6fc585992ULL, -+ 0x187306c89bc215a9ULL, 0xd4a60abcf3792b95ULL, 0xf935451de4f21df2ULL, -+ 0xa9538f0419755787ULL, 0xdb9acddff56ca510ULL, 0xd06c98cd5c0975ebULL, -+ 0xe612a3cb9ecba951ULL, 0xc766e62cfcadaf96ULL, 0xee64435a9752fe72ULL, -+ 0xa192d576b245165aULL, 0x0a8787bf8ecb74b2ULL, 0x81b3e73d20b49b6fULL, -+ 0x7fa8220ba3b2eceaULL, 0x245731c13ca42499ULL, 0xb78dbfaf3a8d83bdULL, -+ 0xea1ad565322a1a0bULL, 0x60e61c23a3795013ULL, 0x6606d7e446282b93ULL, -+ 0x6ca4ecb15c5f91e1ULL, 0x9f626da15c9625f3ULL, 0xe51b38608ef25f57ULL, -+ 0x958a324ceb064572ULL -+}; -+ -+#if BITS_PER_LONG == 64 -+static const hsiphash_key_t test_key_hsiphash = -+ {{ 0x0706050403020100ULL, 0x0f0e0d0c0b0a0908ULL }}; -+ -+static const u32 test_vectors_hsiphash[64] = { -+ 0x050fc4dcU, 0x7d57ca93U, 0x4dc7d44dU, -+ 0xe7ddf7fbU, 0x88d38328U, 0x49533b67U, -+ 0xc59f22a7U, 0x9bb11140U, 0x8d299a8eU, -+ 0x6c063de4U, 0x92ff097fU, 0xf94dc352U, -+ 0x57b4d9a2U, 0x1229ffa7U, 0xc0f95d34U, -+ 0x2a519956U, 0x7d908b66U, 0x63dbd80cU, -+ 0xb473e63eU, 0x8d297d1cU, 0xa6cce040U, -+ 0x2b45f844U, 0xa320872eU, 0xdae6c123U, -+ 0x67349c8cU, 0x705b0979U, 0xca9913a5U, -+ 0x4ade3b35U, 0xef6cd00dU, 0x4ab1e1f4U, -+ 0x43c5e663U, 0x8c21d1bcU, 0x16a7b60dU, -+ 0x7a8ff9bfU, 0x1f2a753eU, 0xbf186b91U, -+ 0xada26206U, 0xa3c33057U, 0xae3a36a1U, -+ 0x7b108392U, 0x99e41531U, 0x3f1ad944U, -+ 0xc8138825U, 0xc28949a6U, 0xfaf8876bU, -+ 0x9f042196U, 0x68b1d623U, 0x8b5114fdU, -+ 0xdf074c46U, 0x12cc86b3U, 0x0a52098fU, -+ 0x9d292f9aU, 0xa2f41f12U, 0x43a71ed0U, -+ 0x73f0bce6U, 0x70a7e980U, 0x243c6d75U, -+ 0xfdb71513U, 0xa67d8a08U, 0xb7e8f148U, -+ 0xf7a644eeU, 0x0f1837f2U, 0x4b6694e0U, -+ 0xb7bbb3a8U -+}; -+#else -+static const hsiphash_key_t test_key_hsiphash = -+ {{ 0x03020100U, 0x07060504U }}; -+ -+static const u32 test_vectors_hsiphash[64] = { -+ 0x5814c896U, 0xe7e864caU, 0xbc4b0e30U, -+ 0x01539939U, 0x7e059ea6U, 0x88e3d89bU, -+ 0xa0080b65U, 0x9d38d9d6U, 0x577999b1U, -+ 0xc839caedU, 0xe4fa32cfU, 0x959246eeU, -+ 0x6b28096cU, 0x66dd9cd6U, 0x16658a7cU, -+ 0xd0257b04U, 0x8b31d501U, 0x2b1cd04bU, -+ 0x06712339U, 0x522aca67U, 0x911bb605U, -+ 0x90a65f0eU, 0xf826ef7bU, 0x62512debU, -+ 0x57150ad7U, 0x5d473507U, 0x1ec47442U, -+ 0xab64afd3U, 0x0a4100d0U, 0x6d2ce652U, -+ 0x2331b6a3U, 0x08d8791aU, 0xbc6dda8dU, -+ 0xe0f6c934U, 0xb0652033U, 0x9b9851ccU, -+ 0x7c46fb7fU, 0x732ba8cbU, 0xf142997aU, -+ 0xfcc9aa1bU, 0x05327eb2U, 0xe110131cU, -+ 0xf9e5e7c0U, 0xa7d708a6U, 0x11795ab1U, -+ 0x65671619U, 0x9f5fff91U, 0xd89c5267U, -+ 0x007783ebU, 0x95766243U, 0xab639262U, -+ 0x9c7e1390U, 0xc368dda6U, 0x38ddc455U, -+ 0xfa13d379U, 0x979ea4e8U, 0x53ecd77eU, -+ 0x2ee80657U, 0x33dbb66aU, 0xae3f0577U, -+ 0x88b4c4ccU, 0x3e7f480bU, 0x74c1ebf8U, -+ 0x87178304U -+}; -+#endif -+ -+static int __init siphash_test_init(void) -+{ -+ u8 in[64] __aligned(SIPHASH_ALIGNMENT); -+ u8 in_unaligned[65] __aligned(SIPHASH_ALIGNMENT); -+ u8 i; -+ int ret = 0; -+ -+ for (i = 0; i < 64; ++i) { -+ in[i] = i; -+ in_unaligned[i + 1] = i; -+ if (siphash(in, i, &test_key_siphash) != -+ test_vectors_siphash[i]) { -+ pr_info("siphash self-test aligned %u: FAIL\n", i + 1); -+ ret = -EINVAL; -+ } -+ if (siphash(in_unaligned + 1, i, &test_key_siphash) != -+ test_vectors_siphash[i]) { -+ pr_info("siphash self-test unaligned %u: FAIL\n", i + 1); -+ ret = -EINVAL; -+ } -+ if (hsiphash(in, i, &test_key_hsiphash) != -+ test_vectors_hsiphash[i]) { -+ pr_info("hsiphash self-test aligned %u: FAIL\n", i + 1); -+ ret = -EINVAL; -+ } -+ if (hsiphash(in_unaligned + 1, i, &test_key_hsiphash) != -+ test_vectors_hsiphash[i]) { -+ pr_info("hsiphash self-test unaligned %u: FAIL\n", i + 1); -+ ret = -EINVAL; -+ } -+ } -+ if (siphash_1u64(0x0706050403020100ULL, &test_key_siphash) != -+ test_vectors_siphash[8]) { -+ pr_info("siphash self-test 1u64: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_2u64(0x0706050403020100ULL, 0x0f0e0d0c0b0a0908ULL, -+ &test_key_siphash) != test_vectors_siphash[16]) { -+ pr_info("siphash self-test 2u64: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_3u64(0x0706050403020100ULL, 0x0f0e0d0c0b0a0908ULL, -+ 0x1716151413121110ULL, &test_key_siphash) != -+ test_vectors_siphash[24]) { -+ pr_info("siphash self-test 3u64: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_4u64(0x0706050403020100ULL, 0x0f0e0d0c0b0a0908ULL, -+ 0x1716151413121110ULL, 0x1f1e1d1c1b1a1918ULL, -+ &test_key_siphash) != test_vectors_siphash[32]) { -+ pr_info("siphash self-test 4u64: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_1u32(0x03020100U, &test_key_siphash) != -+ test_vectors_siphash[4]) { -+ pr_info("siphash self-test 1u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_2u32(0x03020100U, 0x07060504U, &test_key_siphash) != -+ test_vectors_siphash[8]) { -+ pr_info("siphash self-test 2u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_3u32(0x03020100U, 0x07060504U, -+ 0x0b0a0908U, &test_key_siphash) != -+ test_vectors_siphash[12]) { -+ pr_info("siphash self-test 3u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (siphash_4u32(0x03020100U, 0x07060504U, -+ 0x0b0a0908U, 0x0f0e0d0cU, &test_key_siphash) != -+ test_vectors_siphash[16]) { -+ pr_info("siphash self-test 4u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (hsiphash_1u32(0x03020100U, &test_key_hsiphash) != -+ test_vectors_hsiphash[4]) { -+ pr_info("hsiphash self-test 1u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (hsiphash_2u32(0x03020100U, 0x07060504U, &test_key_hsiphash) != -+ test_vectors_hsiphash[8]) { -+ pr_info("hsiphash self-test 2u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (hsiphash_3u32(0x03020100U, 0x07060504U, -+ 0x0b0a0908U, &test_key_hsiphash) != -+ test_vectors_hsiphash[12]) { -+ pr_info("hsiphash self-test 3u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (hsiphash_4u32(0x03020100U, 0x07060504U, -+ 0x0b0a0908U, 0x0f0e0d0cU, &test_key_hsiphash) != -+ test_vectors_hsiphash[16]) { -+ pr_info("hsiphash self-test 4u32: FAIL\n"); -+ ret = -EINVAL; -+ } -+ if (!ret) -+ pr_info("self-tests: pass\n"); -+ return ret; -+} -+ -+static void __exit siphash_test_exit(void) -+{ -+} -+ -+module_init(siphash_test_init); -+module_exit(siphash_test_exit); -+ -+MODULE_AUTHOR("Jason A. Donenfeld "); -+MODULE_LICENSE("Dual BSD/GPL"); -diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c -index 1a87cf78fadc..d9471e3ef216 100644 ---- a/net/bridge/netfilter/ebtables.c -+++ b/net/bridge/netfilter/ebtables.c -@@ -2280,8 +2280,10 @@ static int compat_do_replace(struct net *net, void __user *user, - state.buf_kern_len = size64; - - ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); -- if (WARN_ON(ret < 0)) -+ if (WARN_ON(ret < 0)) { -+ vfree(entries_tmp); - goto out_unlock; -+ } - - vfree(entries_tmp); - tmp.entries_size = size64; -diff --git a/net/core/stream.c b/net/core/stream.c -index b96f7a79e544..3089b014bb53 100644 ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -119,7 +119,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p) - int err = 0; - long vm_wait = 0; - long current_timeo = *timeo_p; -- bool noblock = (*timeo_p ? false : true); - DEFINE_WAIT(wait); - - if (sk_stream_memory_free(sk)) -@@ -132,11 +131,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p) - - if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) - goto do_error; -- if (!*timeo_p) { -- if (noblock) -- set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); -- goto do_nonblock; -- } -+ if (!*timeo_p) -+ goto do_eagain; - if (signal_pending(current)) - goto do_interrupted; - sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); -@@ -168,7 +164,13 @@ out: - do_error: - err = -EPIPE; - goto out; --do_nonblock: -+do_eagain: -+ /* Make sure that whenever EAGAIN is returned, EPOLLOUT event can -+ * be generated later. -+ * When TCP receives ACK packets that make room, tcp_check_space() -+ * only calls tcp_new_space() if SOCK_NOSPACE is set. -+ */ -+ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); - err = -EAGAIN; - goto out; - do_interrupted: -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index a58effba760a..3c605a788ba1 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -490,15 +490,17 @@ EXPORT_SYMBOL(ip_idents_reserve); - - void __ip_select_ident(struct net *net, struct iphdr *iph, int segs) - { -- static u32 ip_idents_hashrnd __read_mostly; - u32 hash, id; - -- net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd)); -+ /* Note the following code is not safe, but this is okay. */ -+ if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key))) -+ get_random_bytes(&net->ipv4.ip_id_key, -+ sizeof(net->ipv4.ip_id_key)); - -- hash = jhash_3words((__force u32)iph->daddr, -+ hash = siphash_3u32((__force u32)iph->daddr, - (__force u32)iph->saddr, -- iph->protocol ^ net_hash_mix(net), -- ip_idents_hashrnd); -+ iph->protocol, -+ &net->ipv4.ip_id_key); - id = ip_idents_reserve(hash, segs); - iph->id = htons(id); - } -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index f99a04674419..6b896cc9604e 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -10,15 +10,25 @@ - #include - #include - --static u32 __ipv6_select_ident(struct net *net, u32 hashrnd, -+static u32 __ipv6_select_ident(struct net *net, - const struct in6_addr *dst, - const struct in6_addr *src) - { -+ const struct { -+ struct in6_addr dst; -+ struct in6_addr src; -+ } __aligned(SIPHASH_ALIGNMENT) combined = { -+ .dst = *dst, -+ .src = *src, -+ }; - u32 hash, id; - -- hash = __ipv6_addr_jhash(dst, hashrnd); -- hash = __ipv6_addr_jhash(src, hash); -- hash ^= net_hash_mix(net); -+ /* Note the following code is not safe, but this is okay. */ -+ if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key))) -+ get_random_bytes(&net->ipv4.ip_id_key, -+ sizeof(net->ipv4.ip_id_key)); -+ -+ hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key); - - /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve, - * set the hight order instead thus minimizing possible future -@@ -41,7 +51,6 @@ static u32 __ipv6_select_ident(struct net *net, u32 hashrnd, - */ - void ipv6_proxy_select_ident(struct net *net, struct sk_buff *skb) - { -- static u32 ip6_proxy_idents_hashrnd __read_mostly; - struct in6_addr buf[2]; - struct in6_addr *addrs; - u32 id; -@@ -53,11 +62,7 @@ void ipv6_proxy_select_ident(struct net *net, struct sk_buff *skb) - if (!addrs) - return; - -- net_get_random_once(&ip6_proxy_idents_hashrnd, -- sizeof(ip6_proxy_idents_hashrnd)); -- -- id = __ipv6_select_ident(net, ip6_proxy_idents_hashrnd, -- &addrs[1], &addrs[0]); -+ id = __ipv6_select_ident(net, &addrs[1], &addrs[0]); - skb_shinfo(skb)->ip6_frag_id = htonl(id); - } - EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); -@@ -66,12 +71,9 @@ __be32 ipv6_select_ident(struct net *net, - const struct in6_addr *daddr, - const struct in6_addr *saddr) - { -- static u32 ip6_idents_hashrnd __read_mostly; - u32 id; - -- net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd)); -- -- id = __ipv6_select_ident(net, ip6_idents_hashrnd, daddr, saddr); -+ id = __ipv6_select_ident(net, daddr, saddr); - return htonl(id); - } - EXPORT_SYMBOL(ipv6_select_ident); -diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c -index 7349bf26ae7b..1999a7eaa692 100644 ---- a/net/mac80211/cfg.c -+++ b/net/mac80211/cfg.c -@@ -1211,6 +1211,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, - if (is_multicast_ether_addr(mac)) - return -EINVAL; - -+ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) && -+ sdata->vif.type == NL80211_IFTYPE_STATION && -+ !sdata->u.mgd.associated) -+ return -EINVAL; -+ - sta = sta_info_alloc(sdata, mac, GFP_KERNEL); - if (!sta) - return -ENOMEM; -@@ -1228,10 +1233,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, - if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) - sta->sta.tdls = true; - -- if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && -- !sdata->u.mgd.associated) -- return -EINVAL; -- - err = sta_apply_parameters(local, sta, params); - if (err) { - sta_info_free(local, sta); -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 5f747089024f..de0aad12b91d 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -234,6 +235,40 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse, - } - EXPORT_SYMBOL_GPL(nf_ct_invert_tuple); - -+/* Generate a almost-unique pseudo-id for a given conntrack. -+ * -+ * intentionally doesn't re-use any of the seeds used for hash -+ * table location, we assume id gets exposed to userspace. -+ * -+ * Following nf_conn items do not change throughout lifetime -+ * of the nf_conn: -+ * -+ * 1. nf_conn address -+ * 2. nf_conn->master address (normally NULL) -+ * 3. the associated net namespace -+ * 4. the original direction tuple -+ */ -+u32 nf_ct_get_id(const struct nf_conn *ct) -+{ -+ static __read_mostly siphash_key_t ct_id_seed; -+ unsigned long a, b, c, d; -+ -+ net_get_random_once(&ct_id_seed, sizeof(ct_id_seed)); -+ -+ a = (unsigned long)ct; -+ b = (unsigned long)ct->master; -+ c = (unsigned long)nf_ct_net(ct); -+ d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, -+ sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple), -+ &ct_id_seed); -+#ifdef CONFIG_64BIT -+ return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed); -+#else -+ return siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &ct_id_seed); -+#endif -+} -+EXPORT_SYMBOL_GPL(nf_ct_get_id); -+ - static void - clean_from_lists(struct nf_conn *ct) - { -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index c68e020427ab..3a24c01cb909 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -451,7 +452,9 @@ ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, const struct nf_conn *ct) - static inline int - ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct) - { -- if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct))) -+ __be32 id = (__force __be32)nf_ct_get_id(ct); -+ -+ if (nla_put_be32(skb, CTA_ID, id)) - goto nla_put_failure; - return 0; - -@@ -1159,8 +1162,9 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb, - ct = nf_ct_tuplehash_to_ctrack(h); - - if (cda[CTA_ID]) { -- u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID])); -- if (id != (u32)(unsigned long)ct) { -+ __be32 id = nla_get_be32(cda[CTA_ID]); -+ -+ if (id != (__force __be32)nf_ct_get_id(ct)) { - nf_ct_put(ct); - return -ENOENT; - } -@@ -2480,6 +2484,25 @@ nla_put_failure: - - static const union nf_inet_addr any_addr; - -+static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp) -+{ -+ static __read_mostly siphash_key_t exp_id_seed; -+ unsigned long a, b, c, d; -+ -+ net_get_random_once(&exp_id_seed, sizeof(exp_id_seed)); -+ -+ a = (unsigned long)exp; -+ b = (unsigned long)exp->helper; -+ c = (unsigned long)exp->master; -+ d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed); -+ -+#ifdef CONFIG_64BIT -+ return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed); -+#else -+ return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed); -+#endif -+} -+ - static int - ctnetlink_exp_dump_expect(struct sk_buff *skb, - const struct nf_conntrack_expect *exp) -@@ -2527,7 +2550,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, - } - #endif - if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) || -- nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) || -+ nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) || - nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) || - nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class))) - goto nla_put_failure; -@@ -2824,7 +2847,8 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb, - - if (cda[CTA_EXPECT_ID]) { - __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); -- if (ntohl(id) != (u32)(unsigned long)exp) { -+ -+ if (id != nf_expect_get_id(exp)) { - nf_ct_expect_put(exp); - return -ENOENT; - } -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 429abf421906..6a670a373e29 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -2234,7 +2234,7 @@ static void reg_process_pending_hints(void) - - /* When last_request->processed becomes true this will be rescheduled */ - if (lr && !lr->processed) { -- reg_process_hint(lr); -+ pr_debug("Pending regulatory request, waiting for it to be processed...\n"); - return; - } - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 7fa0219c9758..331a2b00e53f 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1906,8 +1906,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client, - if (cptr->type == USER_CLIENT) { - info.input_pool = cptr->data.user.fifo_pool_size; - info.input_free = info.input_pool; -- if (cptr->data.user.fifo) -- info.input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool); -+ info.input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo); - } else { - info.input_pool = 0; - info.input_free = 0; -diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c -index 9acbed1ac982..d9f5428ee995 100644 ---- a/sound/core/seq/seq_fifo.c -+++ b/sound/core/seq/seq_fifo.c -@@ -278,3 +278,20 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize) - - return 0; - } -+ -+/* get the number of unused cells safely */ -+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f) -+{ -+ unsigned long flags; -+ int cells; -+ -+ if (!f) -+ return 0; -+ -+ snd_use_lock_use(&f->use_lock); -+ spin_lock_irqsave(&f->lock, flags); -+ cells = snd_seq_unused_cells(f->pool); -+ spin_unlock_irqrestore(&f->lock, flags); -+ snd_use_lock_free(&f->use_lock); -+ return cells; -+} -diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h -index 062c446e7867..5d38a0d7f0cd 100644 ---- a/sound/core/seq/seq_fifo.h -+++ b/sound/core/seq/seq_fifo.h -@@ -68,5 +68,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file, poll_table - /* resize pool in fifo */ - int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize); - -+/* get the number of unused cells safely */ -+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f); - - #endif -diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c -index 512ec25c9ead..2f7be6cee98e 100644 ---- a/sound/soc/davinci/davinci-mcasp.c -+++ b/sound/soc/davinci/davinci-mcasp.c -@@ -1128,6 +1128,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream, - return ret; - } - -+static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params, -+ struct snd_pcm_hw_rule *rule) -+{ -+ struct davinci_mcasp_ruledata *rd = rule->private; -+ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); -+ struct snd_mask nfmt; -+ int i, slot_width; -+ -+ snd_mask_none(&nfmt); -+ slot_width = rd->mcasp->slot_width; -+ -+ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) { -+ if (snd_mask_test(fmt, i)) { -+ if (snd_pcm_format_width(i) <= slot_width) { -+ snd_mask_set(&nfmt, i); -+ } -+ } -+ } -+ -+ return snd_mask_refine(fmt, &nfmt); -+} -+ - static const unsigned int davinci_mcasp_dai_rates[] = { - 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, - 88200, 96000, 176400, 192000, -@@ -1219,7 +1241,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, - struct davinci_mcasp_ruledata *ruledata = - &mcasp->ruledata[substream->stream]; - u32 max_channels = 0; -- int i, dir; -+ int i, dir, ret; - int tdm_slots = mcasp->tdm_slots; - - if (mcasp->tdm_mask[substream->stream]) -@@ -1244,6 +1266,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, - max_channels++; - } - ruledata->serializers = max_channels; -+ ruledata->mcasp = mcasp; - max_channels *= tdm_slots; - /* - * If the already active stream has less channels than the calculated -@@ -1269,20 +1292,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, - 0, SNDRV_PCM_HW_PARAM_CHANNELS, - &mcasp->chconstr[substream->stream]); - -- if (mcasp->slot_width) -- snd_pcm_hw_constraint_minmax(substream->runtime, -- SNDRV_PCM_HW_PARAM_SAMPLE_BITS, -- 8, mcasp->slot_width); -+ if (mcasp->slot_width) { -+ /* Only allow formats require <= slot_width bits on the bus */ -+ ret = snd_pcm_hw_rule_add(substream->runtime, 0, -+ SNDRV_PCM_HW_PARAM_FORMAT, -+ davinci_mcasp_hw_rule_slot_width, -+ ruledata, -+ SNDRV_PCM_HW_PARAM_FORMAT, -1); -+ if (ret) -+ return ret; -+ } - - /* - * If we rely on implicit BCLK divider setting we should - * set constraints based on what we can provide. - */ - if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) { -- int ret; -- -- ruledata->mcasp = mcasp; -- - ret = snd_pcm_hw_rule_add(substream->runtime, 0, - SNDRV_PCM_HW_PARAM_RATE, - davinci_mcasp_hw_rule_rate, -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 1f7eb3816cd7..e24572fd6e30 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -81,6 +81,7 @@ struct mixer_build { - unsigned char *buffer; - unsigned int buflen; - DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); -+ DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); - struct usb_audio_term oterm; - const struct usbmix_name_map *map; - const struct usbmix_selector_map *selector_map; -@@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm - * parse the source unit recursively until it reaches to a terminal - * or a branched unit. - */ --static int check_input_term(struct mixer_build *state, int id, -+static int __check_input_term(struct mixer_build *state, int id, - struct usb_audio_term *term) - { - int err; - void *p1; -+ unsigned char *hdr; - - memset(term, 0, sizeof(*term)); -- while ((p1 = find_audio_control_unit(state, id)) != NULL) { -- unsigned char *hdr = p1; -+ for (;;) { -+ /* a loop in the terminal chain? */ -+ if (test_and_set_bit(id, state->termbitmap)) -+ return -EINVAL; -+ -+ p1 = find_audio_control_unit(state, id); -+ if (!p1) -+ break; -+ -+ hdr = p1; - term->id = id; - switch (hdr[2]) { - case UAC_INPUT_TERMINAL: -@@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, - - /* call recursively to verify that the - * referenced clock entity is valid */ -- err = check_input_term(state, d->bCSourceID, term); -+ err = __check_input_term(state, d->bCSourceID, term); - if (err < 0) - return err; - -@@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, - case UAC2_CLOCK_SELECTOR: { - struct uac_selector_unit_descriptor *d = p1; - /* call recursively to retrieve the channel info */ -- err = check_input_term(state, d->baSourceID[0], term); -+ err = __check_input_term(state, d->baSourceID[0], term); - if (err < 0) - return err; - term->type = d->bDescriptorSubtype << 16; /* virtual type */ -@@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, - return -ENODEV; - } - -+ -+static int check_input_term(struct mixer_build *state, int id, -+ struct usb_audio_term *term) -+{ -+ memset(term, 0, sizeof(*term)); -+ memset(state->termbitmap, 0, sizeof(state->termbitmap)); -+ return __check_input_term(state, id, term); -+} -+ - /* - * Feature Unit - */ -@@ -1628,6 +1647,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, - int pin, ich, err; - - if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) || -+ desc->bLength < sizeof(*desc) + desc->bNrInPins || - !(num_outs = uac_mixer_unit_bNrChannels(desc))) { - usb_audio_err(state->chip, - "invalid MIXER UNIT descriptor %d\n", -diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c -index 177480066816..fffc7c418459 100644 ---- a/tools/hv/hv_kvp_daemon.c -+++ b/tools/hv/hv_kvp_daemon.c -@@ -1379,6 +1379,8 @@ int main(int argc, char *argv[]) - daemonize = 0; - break; - case 'h': -+ print_usage(argv); -+ exit(0); - default: - print_usage(argv); - exit(EXIT_FAILURE); -diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c -index 5d51d6ff08e6..b5465f92ed50 100644 ---- a/tools/hv/hv_vss_daemon.c -+++ b/tools/hv/hv_vss_daemon.c -@@ -164,6 +164,8 @@ int main(int argc, char *argv[]) - daemonize = 0; - break; - case 'h': -+ print_usage(argv); -+ exit(0); - default: - print_usage(argv); - exit(EXIT_FAILURE); -diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c -index df41deed0320..3bfba81d1911 100644 ---- a/tools/perf/bench/numa.c -+++ b/tools/perf/bench/numa.c -@@ -370,8 +370,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags, - - /* Allocate and initialize all memory on CPU#0: */ - if (init_cpu0) { -- orig_mask = bind_to_node(0); -- bind_to_memnode(0); -+ int node = numa_node_of_cpu(0); -+ -+ orig_mask = bind_to_node(node); -+ bind_to_memnode(node); - } - - bytes = bytes0 + HPSIZE; -diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c -index 1a35ab044c11..54af2f2e2ee4 100644 ---- a/tools/perf/tests/parse-events.c -+++ b/tools/perf/tests/parse-events.c -@@ -12,32 +12,6 @@ - #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \ - PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD) - --#if defined(__s390x__) --/* Return true if kvm module is available and loaded. Test this -- * and retun success when trace point kvm_s390_create_vm -- * exists. Otherwise this test always fails. -- */ --static bool kvm_s390_create_vm_valid(void) --{ -- char *eventfile; -- bool rc = false; -- -- eventfile = get_events_file("kvm-s390"); -- -- if (eventfile) { -- DIR *mydir = opendir(eventfile); -- -- if (mydir) { -- rc = true; -- closedir(mydir); -- } -- put_events_file(eventfile); -- } -- -- return rc; --} --#endif -- - static int test__checkevent_tracepoint(struct perf_evlist *evlist) - { - struct perf_evsel *evsel = perf_evlist__first(evlist); -@@ -1587,7 +1561,6 @@ static struct evlist_test test__events[] = { - { - .name = "kvm-s390:kvm_s390_create_vm", - .check = test__checkevent_tracepoint, -- .valid = kvm_s390_create_vm_valid, - .id = 100, - }, - #endif -diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config -new file mode 100644 -index 000000000000..63ed533f73d6 ---- /dev/null -+++ b/tools/testing/selftests/kvm/config -@@ -0,0 +1,3 @@ -+CONFIG_KVM=y -+CONFIG_KVM_INTEL=y -+CONFIG_KVM_AMD=y diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.191-192.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.191-192.patch deleted file mode 100644 index 7cff433f66a4..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.191-192.patch +++ /dev/null @@ -1,539 +0,0 @@ -diff --git a/Makefile b/Makefile -index 266c3d7e0120..18889fbbebb1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 191 -+SUBLEVEL = 192 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c -index ae61e2ea7255..d2efc033ef8b 100644 ---- a/arch/arm/kvm/mmio.c -+++ b/arch/arm/kvm/mmio.c -@@ -98,6 +98,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) - unsigned int len; - int mask; - -+ /* Detect an already handled MMIO return */ -+ if (unlikely(!vcpu->mmio_needed)) -+ return 0; -+ -+ vcpu->mmio_needed = 0; -+ - if (!run->mmio.is_write) { - len = run->mmio.len; - if (len > sizeof(unsigned long)) -@@ -206,6 +212,7 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run, - run->mmio.is_write = is_write; - run->mmio.phys_addr = fault_ipa; - run->mmio.len = len; -+ vcpu->mmio_needed = 1; - - if (!ret) { - /* We handled the access successfully in the kernel. */ -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 80c94fc8ad5a..834d1b5b4355 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1031,10 +1031,6 @@ void clear_local_APIC(void) - apic_write(APIC_LVT0, v | APIC_LVT_MASKED); - v = apic_read(APIC_LVT1); - apic_write(APIC_LVT1, v | APIC_LVT_MASKED); -- if (!x2apic_enabled()) { -- v = apic_read(APIC_LDR) & ~APIC_LDR_MASK; -- apic_write(APIC_LDR, v); -- } - if (maxlvt >= 4) { - v = apic_read(APIC_LVTPC); - apic_write(APIC_LVTPC, v | APIC_LVT_MASKED); -diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c -index 4a6208168850..593fc2a5be0f 100644 ---- a/drivers/bluetooth/btqca.c -+++ b/drivers/bluetooth/btqca.c -@@ -363,6 +363,9 @@ int qca_uart_setup_rome(struct hci_dev *hdev, uint8_t baudrate) - return err; - } - -+ /* Give the controller some time to get ready to receive the NVM */ -+ msleep(10); -+ - /* Download NVM configuration */ - config.type = TLV_TYPE_NVM; - snprintf(config.fwname, sizeof(config.fwname), "qca/nvm_%08x.bin", -diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c -index 199a9cdd0d12..531c985f6fd7 100644 ---- a/drivers/infiniband/hw/mlx4/mad.c -+++ b/drivers/infiniband/hw/mlx4/mad.c -@@ -1526,8 +1526,6 @@ tx_err: - tx_buf_size, DMA_TO_DEVICE); - kfree(tun_qp->tx_ring[i].buf.addr); - } -- kfree(tun_qp->tx_ring); -- tun_qp->tx_ring = NULL; - i = MLX4_NUM_TUNNEL_BUFS; - err: - while (i > 0) { -@@ -1536,6 +1534,8 @@ err: - rx_buf_size, DMA_FROM_DEVICE); - kfree(tun_qp->ring[i].addr); - } -+ kfree(tun_qp->tx_ring); -+ tun_qp->tx_ring = NULL; - kfree(tun_qp->ring); - tun_qp->ring = NULL; - return -ENOMEM; -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c -index 4269944c5db5..129d6095749a 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c -@@ -2673,8 +2673,10 @@ static ssize_t blocked_fl_write(struct file *filp, const char __user *ubuf, - return -ENOMEM; - - err = bitmap_parse_user(ubuf, count, t, adap->sge.egr_sz); -- if (err) -+ if (err) { -+ kvfree(t); - return err; -+ } - - bitmap_copy(adap->sge.blocked_fl, t, adap->sge.egr_sz); - t4_free_mem(t); -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 70b3253e7ed5..b46fc37c1a94 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1555,7 +1555,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) - struct net_device *netdev; - struct ibmveth_adapter *adapter; - unsigned char *mac_addr_p; -- unsigned int *mcastFilterSize_p; -+ __be32 *mcastFilterSize_p; - long ret; - unsigned long ret_attr; - -@@ -1577,8 +1577,9 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) - return -EINVAL; - } - -- mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev, -- VETH_MCAST_FILTER_SIZE, NULL); -+ mcastFilterSize_p = (__be32 *)vio_get_attribute(dev, -+ VETH_MCAST_FILTER_SIZE, -+ NULL); - if (!mcastFilterSize_p) { - dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE " - "attribute\n"); -@@ -1595,7 +1596,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) - - adapter->vdev = dev; - adapter->netdev = netdev; -- adapter->mcastFilterSize = *mcastFilterSize_p; -+ adapter->mcastFilterSize = be32_to_cpu(*mcastFilterSize_p); - adapter->pool_config = 0; - - netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16); -diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c -index 83651ac8ddb9..8ebf3611aba3 100644 ---- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c -+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c -@@ -4114,7 +4114,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - * setup (if available). */ - status = myri10ge_request_irq(mgp); - if (status != 0) -- goto abort_with_firmware; -+ goto abort_with_slices; - myri10ge_free_irq(mgp); - - /* Save configuration space to be restored if the -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 29d31eb995d7..fedfd94699cb 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1,6 +1,6 @@ - /* Renesas Ethernet AVB device driver - * -- * Copyright (C) 2014-2015 Renesas Electronics Corporation -+ * Copyright (C) 2014-2019 Renesas Electronics Corporation - * Copyright (C) 2015 Renesas Solutions Corp. - * Copyright (C) 2015 Cogent Embedded, Inc. - * -@@ -501,7 +501,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev) - kfree(ts_skb); - if (tag == tfa_tag) { - skb_tstamp_tx(skb, &shhwtstamps); -+ dev_consume_skb_any(skb); - break; -+ } else { -+ dev_kfree_skb_any(skb); - } - } - ravb_write(ndev, ravb_read(ndev, TCCR) | TCCR_TFR, TCCR); -@@ -1382,7 +1385,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - DMA_TO_DEVICE); - goto unmap; - } -- ts_skb->skb = skb; -+ ts_skb->skb = skb_get(skb); - ts_skb->tag = priv->ts_skb_tag++; - priv->ts_skb_tag &= 0x3ff; - list_add_tail(&ts_skb->list, &priv->ts_skb_list); -@@ -1514,6 +1517,7 @@ static int ravb_close(struct net_device *ndev) - /* Clear the timestamp list */ - list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) { - list_del(&ts_skb->list); -+ kfree_skb(ts_skb->skb); - kfree(ts_skb); - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -index 398b08e07149..68a58333bd74 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c -@@ -429,10 +429,8 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable) - int ret; - struct device *dev = &bsp_priv->pdev->dev; - -- if (!ldo) { -- dev_err(dev, "no regulator found\n"); -- return -1; -- } -+ if (!ldo) -+ return 0; - - if (enable) { - ret = regulator_enable(ldo); -diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c -index 45ac38d29ed8..868fb6306df0 100644 ---- a/drivers/net/ethernet/toshiba/tc35815.c -+++ b/drivers/net/ethernet/toshiba/tc35815.c -@@ -1528,7 +1528,7 @@ tc35815_rx(struct net_device *dev, int limit) - pci_unmap_single(lp->pci_dev, - lp->rx_skbs[cur_bd].skb_dma, - RX_BUF_SIZE, PCI_DMA_FROMDEVICE); -- if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN) -+ if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN != 0) - memmove(skb->data, skb->data - NET_IP_ALIGN, - pkt_len); - data = skb_put(skb, pkt_len); -diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c -index 520cf50a3d5a..93fe0da0f15e 100644 ---- a/drivers/net/ethernet/tundra/tsi108_eth.c -+++ b/drivers/net/ethernet/tundra/tsi108_eth.c -@@ -379,9 +379,10 @@ tsi108_stat_carry_one(int carry, int carry_bit, int carry_shift, - static void tsi108_stat_carry(struct net_device *dev) - { - struct tsi108_prv_data *data = netdev_priv(dev); -+ unsigned long flags; - u32 carry1, carry2; - -- spin_lock_irq(&data->misclock); -+ spin_lock_irqsave(&data->misclock, flags); - - carry1 = TSI_READ(TSI108_STAT_CARRY1); - carry2 = TSI_READ(TSI108_STAT_CARRY2); -@@ -449,7 +450,7 @@ static void tsi108_stat_carry(struct net_device *dev) - TSI108_STAT_TXPAUSEDROP_CARRY, - &data->tx_pause_drop); - -- spin_unlock_irq(&data->misclock); -+ spin_unlock_irqrestore(&data->misclock, flags); - } - - /* Read a stat counter atomically with respect to carries. -diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c -index 947bea81d924..dfbdea22fbad 100644 ---- a/drivers/net/usb/cx82310_eth.c -+++ b/drivers/net/usb/cx82310_eth.c -@@ -175,7 +175,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf) - } - if (!timeout) { - dev_err(&udev->dev, "firmware not ready in time\n"); -- return -ETIMEDOUT; -+ ret = -ETIMEDOUT; -+ goto err; - } - - /* enable ethernet mode (?) */ -diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c -index 5662babf0583..d385b67258c7 100644 ---- a/drivers/net/usb/kalmia.c -+++ b/drivers/net/usb/kalmia.c -@@ -117,16 +117,16 @@ kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr) - status = kalmia_send_init_packet(dev, usb_buf, sizeof(init_msg_1) - / sizeof(init_msg_1[0]), usb_buf, 24); - if (status != 0) -- return status; -+ goto out; - - memcpy(usb_buf, init_msg_2, 12); - status = kalmia_send_init_packet(dev, usb_buf, sizeof(init_msg_2) - / sizeof(init_msg_2[0]), usb_buf, 28); - if (status != 0) -- return status; -+ goto out; - - memcpy(ethernet_addr, usb_buf + 10, ETH_ALEN); -- -+out: - kfree(usb_buf); - return status; - } -diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c -index c9c711dcd0e6..0e6c665a4de8 100644 ---- a/drivers/net/wimax/i2400m/fw.c -+++ b/drivers/net/wimax/i2400m/fw.c -@@ -351,13 +351,15 @@ int i2400m_barker_db_init(const char *_options) - } - result = i2400m_barker_db_add(barker); - if (result < 0) -- goto error_add; -+ goto error_parse_add; - } - kfree(options_orig); - } - return 0; - -+error_parse_add: - error_parse: -+ kfree(options_orig); - error_add: - kfree(i2400m_barker_db); - return result; -diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c -index 7de6f8472a81..ca655593c5e0 100644 ---- a/drivers/spi/spi-bcm2835aux.c -+++ b/drivers/spi/spi-bcm2835aux.c -@@ -181,19 +181,14 @@ static void bcm2835aux_spi_reset_hw(struct bcm2835aux_spi *bs) - BCM2835_AUX_SPI_CNTL0_CLEARFIFO); - } - --static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -+static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) - { -- struct spi_master *master = dev_id; -- struct bcm2835aux_spi *bs = spi_master_get_devdata(master); -- irqreturn_t ret = IRQ_NONE; -+ u32 stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT); - - /* check if we have data to read */ -- while (bs->rx_len && -- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & -- BCM2835_AUX_SPI_STAT_RX_EMPTY))) { -+ for (; bs->rx_len && (stat & BCM2835_AUX_SPI_STAT_RX_LVL); -+ stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT)) - bcm2835aux_rd_fifo(bs); -- ret = IRQ_HANDLED; -- } - - /* check if we have data to write */ - while (bs->tx_len && -@@ -201,16 +196,21 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_TX_FULL))) { - bcm2835aux_wr_fifo(bs); -- ret = IRQ_HANDLED; - } -+} - -- /* and check if we have reached "done" */ -- while (bs->rx_len && -- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & -- BCM2835_AUX_SPI_STAT_BUSY))) { -- bcm2835aux_rd_fifo(bs); -- ret = IRQ_HANDLED; -- } -+static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -+{ -+ struct spi_master *master = dev_id; -+ struct bcm2835aux_spi *bs = spi_master_get_devdata(master); -+ -+ /* IRQ may be shared, so return if our interrupts are disabled */ -+ if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) & -+ (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE))) -+ return IRQ_NONE; -+ -+ /* do common fifo handling */ -+ bcm2835aux_spi_transfer_helper(bs); - - /* and if rx_len is 0 then wake up completion and disable spi */ - if (!bs->rx_len) { -@@ -218,8 +218,7 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) - complete(&master->xfer_completion); - } - -- /* and return */ -- return ret; -+ return IRQ_HANDLED; - } - - static int __bcm2835aux_spi_transfer_one_irq(struct spi_master *master, -@@ -265,7 +264,6 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master, - { - struct bcm2835aux_spi *bs = spi_master_get_devdata(master); - unsigned long timeout; -- u32 stat; - - /* configure spi */ - bcm2835aux_wr(bs, BCM2835_AUX_SPI_CNTL1, bs->cntl[1]); -@@ -276,24 +274,9 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master, - - /* loop until finished the transfer */ - while (bs->rx_len) { -- /* read status */ -- stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT); - -- /* fill in tx fifo with remaining data */ -- if ((bs->tx_len) && (!(stat & BCM2835_AUX_SPI_STAT_TX_FULL))) { -- bcm2835aux_wr_fifo(bs); -- continue; -- } -- -- /* read data from fifo for both cases */ -- if (!(stat & BCM2835_AUX_SPI_STAT_RX_EMPTY)) { -- bcm2835aux_rd_fifo(bs); -- continue; -- } -- if (!(stat & BCM2835_AUX_SPI_STAT_BUSY)) { -- bcm2835aux_rd_fifo(bs); -- continue; -- } -+ /* do common fifo handling */ -+ bcm2835aux_spi_transfer_helper(bs); - - /* there is still data pending to read check the timeout */ - if (bs->rx_len && time_after(jiffies, timeout)) { -diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c -index b24275ef97f7..22e5f3432abb 100644 ---- a/fs/ceph/xattr.c -+++ b/fs/ceph/xattr.c -@@ -916,6 +916,7 @@ int __ceph_setxattr(struct dentry *dentry, const char *name, - struct ceph_inode_info *ci = ceph_inode(inode); - struct ceph_mds_client *mdsc = ceph_sb_to_client(dentry->d_sb)->mdsc; - struct ceph_cap_flush *prealloc_cf = NULL; -+ struct ceph_buffer *old_blob = NULL; - int issued; - int err; - int dirty = 0; -@@ -984,13 +985,15 @@ retry: - struct ceph_buffer *blob; - - spin_unlock(&ci->i_ceph_lock); -- dout(" preaallocating new blob size=%d\n", required_blob_size); -+ ceph_buffer_put(old_blob); /* Shouldn't be required */ -+ dout(" pre-allocating new blob size=%d\n", required_blob_size); - blob = ceph_buffer_new(required_blob_size, GFP_NOFS); - if (!blob) - goto do_sync_unlocked; - spin_lock(&ci->i_ceph_lock); -+ /* prealloc_blob can't be released while holding i_ceph_lock */ - if (ci->i_xattrs.prealloc_blob) -- ceph_buffer_put(ci->i_xattrs.prealloc_blob); -+ old_blob = ci->i_xattrs.prealloc_blob; - ci->i_xattrs.prealloc_blob = blob; - goto retry; - } -@@ -1006,6 +1009,7 @@ retry: - } - - spin_unlock(&ci->i_ceph_lock); -+ ceph_buffer_put(old_blob); - if (lock_snap_rwsem) - up_read(&mdsc->snap_rwsem); - if (dirty) -diff --git a/include/linux/ceph/buffer.h b/include/linux/ceph/buffer.h -index 07ca15e76100..dada47a4360f 100644 ---- a/include/linux/ceph/buffer.h -+++ b/include/linux/ceph/buffer.h -@@ -29,7 +29,8 @@ static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b) - - static inline void ceph_buffer_put(struct ceph_buffer *b) - { -- kref_put(&b->kref, ceph_buffer_release); -+ if (b) -+ kref_put(&b->kref, ceph_buffer_release); - } - - extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end); -diff --git a/include/linux/gpio.h b/include/linux/gpio.h -index d12b5d566e4b..11555bd821b7 100644 ---- a/include/linux/gpio.h -+++ b/include/linux/gpio.h -@@ -229,30 +229,6 @@ static inline int irq_to_gpio(unsigned irq) - return -EINVAL; - } - --static inline int --gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, -- unsigned int gpio_offset, unsigned int pin_offset, -- unsigned int npins) --{ -- WARN_ON(1); -- return -EINVAL; --} -- --static inline int --gpiochip_add_pingroup_range(struct gpio_chip *chip, -- struct pinctrl_dev *pctldev, -- unsigned int gpio_offset, const char *pin_group) --{ -- WARN_ON(1); -- return -EINVAL; --} -- --static inline void --gpiochip_remove_pin_ranges(struct gpio_chip *chip) --{ -- WARN_ON(1); --} -- - static inline int devm_gpio_request(struct device *dev, unsigned gpio, - const char *label) - { -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 440aa9f6e0a8..0d7c2cc1ff09 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work) - txq = netdev_get_tx_queue(dev, q_index); - HARD_TX_LOCK(dev, txq, smp_processor_id()); - if (netif_xmit_frozen_or_stopped(txq) || -- netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) { -+ !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) { - skb_queue_head(&npinfo->txq, skb); - HARD_TX_UNLOCK(dev, txq); - local_irq_restore(flags); -@@ -357,7 +357,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb, - - HARD_TX_UNLOCK(dev, txq); - -- if (status == NETDEV_TX_OK) -+ if (dev_xmit_complete(status)) - break; - - } -@@ -374,7 +374,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb, - - } - -- if (status != NETDEV_TX_OK) { -+ if (!dev_xmit_complete(status)) { - skb_queue_tail(&npinfo->txq, skb); - schedule_delayed_work(&npinfo->tx_work,0); - } -diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c -index fffc7c418459..834008639c4b 100644 ---- a/tools/hv/hv_kvp_daemon.c -+++ b/tools/hv/hv_kvp_daemon.c -@@ -878,7 +878,7 @@ kvp_get_ip_info(int family, char *if_name, int op, - int sn_offset = 0; - int error = 0; - char *buffer; -- struct hv_kvp_ipaddr_value *ip_buffer; -+ struct hv_kvp_ipaddr_value *ip_buffer = NULL; - char cidr_mask[5]; /* /xyz */ - int weight; - int i; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.192-193.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.192-193.patch deleted file mode 100644 index 38e950eb4216..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.192-193.patch +++ /dev/null @@ -1,283 +0,0 @@ -diff --git a/Makefile b/Makefile -index 18889fbbebb1..34d2be9c8459 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 192 -+SUBLEVEL = 193 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index 16df89c30c20..1e5b68228aff 100644 ---- a/arch/x86/boot/compressed/misc.c -+++ b/arch/x86/boot/compressed/misc.c -@@ -11,6 +11,7 @@ - - #include "misc.h" - #include "../string.h" -+#include - - /* WARNING!! - * This code is compiled with -fPIC and it is relocated dynamically -diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h -index 4abb284a5b9c..bce182708814 100644 ---- a/arch/x86/boot/compressed/misc.h -+++ b/arch/x86/boot/compressed/misc.h -@@ -19,7 +19,6 @@ - #include - #include - #include --#include - - #define BOOT_BOOT_H - #include "../ctype.h" -diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c -index 785864893f9a..14af5c916c9c 100644 ---- a/drivers/clk/clk-s2mps11.c -+++ b/drivers/clk/clk-s2mps11.c -@@ -307,7 +307,7 @@ MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); - * This requires of_device_id table. In the same time this will not change the - * actual *device* matching so do not add .of_match_table. - */ --static const struct of_device_id s2mps11_dt_match[] = { -+static const struct of_device_id s2mps11_dt_match[] __used = { - { - .compatible = "samsung,s2mps11-clk", - .data = (void *)S2MPS11X, -diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c -index f2882ac98726..6666ca451452 100644 ---- a/drivers/vhost/test.c -+++ b/drivers/vhost/test.c -@@ -23,6 +23,12 @@ - * Using this limit prevents one virtqueue from starving others. */ - #define VHOST_TEST_WEIGHT 0x80000 - -+/* Max number of packets transferred before requeueing the job. -+ * Using this limit prevents one virtqueue from starving others with -+ * pkts. -+ */ -+#define VHOST_TEST_PKT_WEIGHT 256 -+ - enum { - VHOST_TEST_VQ = 0, - VHOST_TEST_VQ_MAX = 1, -@@ -81,10 +87,8 @@ static void handle_vq(struct vhost_test *n) - } - vhost_add_used_and_signal(&n->dev, vq, head, 0); - total_len += len; -- if (unlikely(total_len >= VHOST_TEST_WEIGHT)) { -- vhost_poll_queue(&vq->poll); -+ if (unlikely(vhost_exceeds_weight(vq, 0, total_len))) - break; -- } - } - - mutex_unlock(&vq->mutex); -@@ -116,7 +120,8 @@ static int vhost_test_open(struct inode *inode, struct file *f) - dev = &n->dev; - vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ]; - n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick; -- vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX); -+ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, -+ VHOST_TEST_PKT_WEIGHT, VHOST_TEST_WEIGHT); - - f->private_data = n; - -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index 0f653f314876..eb7a4df69e2b 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -1324,7 +1324,7 @@ static int get_indirect(struct vhost_virtqueue *vq, - /* If this is an input descriptor, increment that count. */ - if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_WRITE)) { - *in_num += ret; -- if (unlikely(log)) { -+ if (unlikely(log && ret)) { - log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); - log[*log_num].len = vhost32_to_cpu(vq, desc.len); - ++*log_num; -@@ -1453,7 +1453,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, - /* If this is an input descriptor, - * increment that count. */ - *in_num += ret; -- if (unlikely(log)) { -+ if (unlikely(log && ret)) { - log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); - log[*log_num].len = vhost32_to_cpu(vq, desc.len); - ++*log_num; -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 185fb037b332..631614856afc 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -1301,6 +1301,23 @@ static inline int xfrm_state_kern(const struct xfrm_state *x) - return atomic_read(&x->tunnel_users); - } - -+static inline bool xfrm_id_proto_valid(u8 proto) -+{ -+ switch (proto) { -+ case IPPROTO_AH: -+ case IPPROTO_ESP: -+ case IPPROTO_COMP: -+#if IS_ENABLED(CONFIG_IPV6) -+ case IPPROTO_ROUTING: -+ case IPPROTO_DSTOPTS: -+#endif -+ return true; -+ default: -+ return false; -+ } -+} -+ -+/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */ - static inline int xfrm_id_proto_match(u8 proto, u8 userproto) - { - return (!userproto || proto == userproto || -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 36db179d848e..d2ec620319d7 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -1969,8 +1969,10 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) - - if (rq->sadb_x_ipsecrequest_mode == 0) - return -EINVAL; -+ if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto)) -+ return -EINVAL; - -- t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */ -+ t->id.proto = rq->sadb_x_ipsecrequest_proto; - if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0) - return -EINVAL; - t->mode = mode; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 5d8988185c59..0dd9fc3f57e8 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4176,7 +4176,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { -- WARN(1, "Tx-ring is not supported.\n"); -+ net_warn_ratelimited("Tx-ring is not supported.\n"); - goto out; - } - -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 13f261feb75c..787f2cac18c5 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -2133,7 +2133,7 @@ void xfrm_state_fini(struct net *net) - unsigned int sz; - - flush_work(&net->xfrm.state_hash_work); -- xfrm_state_flush(net, IPSEC_PROTO_ANY, false); -+ xfrm_state_flush(net, 0, false); - flush_work(&net->xfrm.state_gc_work); - - WARN_ON(!list_empty(&net->xfrm.state_all)); -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 8cc2a9df84fd..4dbe6ebeabf8 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -1448,20 +1448,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) - return -EINVAL; - } - -- switch (ut[i].id.proto) { -- case IPPROTO_AH: -- case IPPROTO_ESP: -- case IPPROTO_COMP: --#if IS_ENABLED(CONFIG_IPV6) -- case IPPROTO_ROUTING: -- case IPPROTO_DSTOPTS: --#endif -- case IPSEC_PROTO_ANY: -- break; -- default: -+ if (!xfrm_id_proto_valid(ut[i].id.proto)) - return -EINVAL; -- } -- - } - - return 0; -diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh -index ffc46c7c3afb..4f5e76f76b9d 100755 ---- a/scripts/decode_stacktrace.sh -+++ b/scripts/decode_stacktrace.sh -@@ -64,7 +64,7 @@ parse_symbol() { - fi - - # Strip out the base of the path -- code=${code//^$basepath/""} -+ code=${code#$basepath/} - - # In the case of inlines, move everything to same line - code=${code//$'\n'/' '} -diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c -index a03cf68d0bcd..12d87204e373 100644 ---- a/sound/pci/hda/hda_auto_parser.c -+++ b/sound/pci/hda/hda_auto_parser.c -@@ -827,6 +827,8 @@ static void apply_fixup(struct hda_codec *codec, int id, int action, int depth) - while (id >= 0) { - const struct hda_fixup *fix = codec->fixup_list + id; - -+ if (++depth > 10) -+ break; - if (fix->chained_before) - apply_fixup(codec, fix->chain_id, action, depth + 1); - -@@ -866,8 +868,6 @@ static void apply_fixup(struct hda_codec *codec, int id, int action, int depth) - } - if (!fix->chained || fix->chained_before) - break; -- if (++depth > 10) -- break; - id = fix->chain_id; - } - } -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 142549bbeb53..869c322ddae3 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -5826,7 +5826,8 @@ int snd_hda_gen_init(struct hda_codec *codec) - if (spec->init_hook) - spec->init_hook(codec); - -- snd_hda_apply_verbs(codec); -+ if (!spec->skip_verbs) -+ snd_hda_apply_verbs(codec); - - init_multi_out(codec); - init_extra_out(codec); -diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h -index 56e4139b9032..25f2397c29f7 100644 ---- a/sound/pci/hda/hda_generic.h -+++ b/sound/pci/hda/hda_generic.h -@@ -236,6 +236,7 @@ struct hda_gen_spec { - unsigned int indep_hp_enabled:1; /* independent HP enabled */ - unsigned int have_aamix_ctl:1; - unsigned int hp_mic_jack_modes:1; -+ unsigned int skip_verbs:1; /* don't apply verbs at snd_hda_gen_init() */ - - /* additional mute flags (only effective with auto_mute_via_amp=1) */ - u64 mute_bits; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 68d96c2e8cde..d5ca16048ce0 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -772,9 +772,11 @@ static int alc_init(struct hda_codec *codec) - if (spec->init_hook) - spec->init_hook(codec); - -+ spec->gen.skip_verbs = 1; /* applied in below */ - snd_hda_gen_init(codec); - alc_fix_pll(codec); - alc_auto_init_amp(codec, spec->init_amp); -+ snd_hda_apply_verbs(codec); /* apply verbs here after own init */ - - snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT); - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.193-194.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.193-194.patch deleted file mode 100644 index 6c2331d35c83..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.193-194.patch +++ /dev/null @@ -1,1390 +0,0 @@ -diff --git a/Makefile b/Makefile -index 34d2be9c8459..bea8f3f591c4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 193 -+SUBLEVEL = 194 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig -index 3023f91c77c2..9843e52bbb13 100644 ---- a/arch/arc/configs/axs101_defconfig -+++ b/arch/arc/configs/axs101_defconfig -@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" - CONFIG_EMBEDDED=y - CONFIG_PERF_EVENTS=y - # CONFIG_VM_EVENT_COUNTERS is not set -diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig -index f18107185f53..27c6cb573686 100644 ---- a/arch/arc/configs/axs103_defconfig -+++ b/arch/arc/configs/axs103_defconfig -@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" - CONFIG_EMBEDDED=y - CONFIG_PERF_EVENTS=y - # CONFIG_VM_EVENT_COUNTERS is not set -diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig -index 6e1dd8521d2a..72f34534983f 100644 ---- a/arch/arc/configs/axs103_smp_defconfig -+++ b/arch/arc/configs/axs103_smp_defconfig -@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" - CONFIG_EMBEDDED=y - CONFIG_PERF_EVENTS=y - # CONFIG_VM_EVENT_COUNTERS is not set -diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig -index 86e5a62556a8..c93370cc840a 100644 ---- a/arch/arc/configs/nsim_700_defconfig -+++ b/arch/arc/configs/nsim_700_defconfig -@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" - CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set -diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig -index f68838e8068a..27c73028b798 100644 ---- a/arch/arc/configs/nsim_hs_defconfig -+++ b/arch/arc/configs/nsim_hs_defconfig -@@ -12,7 +12,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" - CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set -diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig -index 96bd1c20fb0b..c3605874487b 100644 ---- a/arch/arc/configs/nsim_hs_smp_defconfig -+++ b/arch/arc/configs/nsim_hs_smp_defconfig -@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" - CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set -diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig -index a4d7b919224a..b7dbb20cd28b 100644 ---- a/arch/arc/configs/nsimosci_defconfig -+++ b/arch/arc/configs/nsimosci_defconfig -@@ -12,7 +12,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" - CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set -diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig -index b3fb49c8bd14..ce22594bb0c7 100644 ---- a/arch/arc/configs/nsimosci_hs_defconfig -+++ b/arch/arc/configs/nsimosci_hs_defconfig -@@ -12,7 +12,6 @@ CONFIG_NAMESPACES=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" - CONFIG_KALLSYMS_ALL=y - CONFIG_EMBEDDED=y - # CONFIG_SLUB_DEBUG is not set -diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig -index 710c167bbdd8..f9e5aef7e04e 100644 ---- a/arch/arc/configs/nsimosci_hs_smp_defconfig -+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig -@@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y - # CONFIG_UTS_NS is not set - # CONFIG_PID_NS is not set - CONFIG_BLK_DEV_INITRD=y --CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" - # CONFIG_COMPAT_BRK is not set - CONFIG_KPROBES=y - CONFIG_MODULES=y -diff --git a/arch/arc/kernel/traps.c b/arch/arc/kernel/traps.c -index 2fb0cd39a31c..cd6e3615e3d1 100644 ---- a/arch/arc/kernel/traps.c -+++ b/arch/arc/kernel/traps.c -@@ -163,3 +163,4 @@ void abort(void) - { - __asm__ __volatile__("trap_s 5\n"); - } -+EXPORT_SYMBOL(abort); -diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c -index 949696b6f17b..511fd08c784b 100644 ---- a/arch/arm/mach-omap2/omap4-common.c -+++ b/arch/arm/mach-omap2/omap4-common.c -@@ -131,6 +131,9 @@ static int __init omap4_sram_init(void) - struct device_node *np; - struct gen_pool *sram_pool; - -+ if (!soc_is_omap44xx() && !soc_is_omap54xx()) -+ return 0; -+ - np = of_find_compatible_node(NULL, NULL, "ti,omap4-mpu"); - if (!np) - pr_warn("%s:Unable to allocate sram needed to handle errata I688\n", -diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c -index a9f6705aea23..731b7e64715b 100644 ---- a/arch/arm/mm/init.c -+++ b/arch/arm/mm/init.c -@@ -691,7 +691,8 @@ static void update_sections_early(struct section_perm perms[], int n) - if (t->flags & PF_KTHREAD) - continue; - for_each_thread(t, s) -- set_section_perms(perms, n, true, s->mm); -+ if (s->mm) -+ set_section_perms(perms, n, true, s->mm); - } - read_unlock(&tasklist_lock); - set_section_perms(perms, n, true, current->active_mm); -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 687a3eb8d4d9..422624ca0132 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -761,7 +761,6 @@ config SIBYTE_SWARM - select SYS_SUPPORTS_HIGHMEM - select SYS_SUPPORTS_LITTLE_ENDIAN - select ZONE_DMA32 if 64BIT -- select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SIBYTE_LITTLESUR - bool "Sibyte BCM91250C2-LittleSur" -@@ -784,7 +783,6 @@ config SIBYTE_SENTOSA - select SYS_HAS_CPU_SB1 - select SYS_SUPPORTS_BIG_ENDIAN - select SYS_SUPPORTS_LITTLE_ENDIAN -- select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SIBYTE_BIGSUR - bool "Sibyte BCM91480B-BigSur" -@@ -798,7 +796,6 @@ config SIBYTE_BIGSUR - select SYS_SUPPORTS_HIGHMEM - select SYS_SUPPORTS_LITTLE_ENDIAN - select ZONE_DMA32 if 64BIT -- select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI - - config SNI_RM - bool "SNI RM200/300/400" -diff --git a/arch/mips/include/asm/netlogic/xlr/fmn.h b/arch/mips/include/asm/netlogic/xlr/fmn.h -index 5604db3d1836..d79c68fa78d9 100644 ---- a/arch/mips/include/asm/netlogic/xlr/fmn.h -+++ b/arch/mips/include/asm/netlogic/xlr/fmn.h -@@ -301,8 +301,6 @@ static inline int nlm_fmn_send(unsigned int size, unsigned int code, - for (i = 0; i < 8; i++) { - nlm_msgsnd(dest); - status = nlm_read_c2_status0(); -- if ((status & 0x2) == 1) -- pr_info("Send pending fail!\n"); - if ((status & 0x4) == 0) - return 0; - } -diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h -index 03722d4326a1..82852dfd8dab 100644 ---- a/arch/mips/include/asm/smp.h -+++ b/arch/mips/include/asm/smp.h -@@ -25,7 +25,17 @@ extern cpumask_t cpu_sibling_map[]; - extern cpumask_t cpu_core_map[]; - extern cpumask_t cpu_foreign_map; - --#define raw_smp_processor_id() (current_thread_info()->cpu) -+static inline int raw_smp_processor_id(void) -+{ -+#if defined(__VDSO__) -+ extern int vdso_smp_processor_id(void) -+ __compiletime_error("VDSO should not call smp_processor_id()"); -+ return vdso_smp_processor_id(); -+#else -+ return current_thread_info()->cpu; -+#endif -+} -+#define raw_smp_processor_id raw_smp_processor_id - - /* Map from cpu id to sequential logical cpu number. This will only - not be idempotent when cpus failed to come on-line. */ -diff --git a/arch/mips/sibyte/common/Makefile b/arch/mips/sibyte/common/Makefile -index 3ef3fb658136..b3d6bf23a662 100644 ---- a/arch/mips/sibyte/common/Makefile -+++ b/arch/mips/sibyte/common/Makefile -@@ -1,5 +1,4 @@ - obj-y := cfe.o --obj-$(CONFIG_SWIOTLB) += dma.o - obj-$(CONFIG_SIBYTE_BUS_WATCHER) += bus_watcher.o - obj-$(CONFIG_SIBYTE_CFE_CONSOLE) += cfe_console.o - obj-$(CONFIG_SIBYTE_TBPROF) += sb_tbprof.o -diff --git a/arch/mips/sibyte/common/dma.c b/arch/mips/sibyte/common/dma.c -deleted file mode 100644 -index eb47a94f3583..000000000000 ---- a/arch/mips/sibyte/common/dma.c -+++ /dev/null -@@ -1,14 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0+ --/* -- * DMA support for Broadcom SiByte platforms. -- * -- * Copyright (c) 2018 Maciej W. Rozycki -- */ -- --#include --#include -- --void __init plat_swiotlb_setup(void) --{ -- swiotlb_init(1); --} -diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile -index 886005b1e87d..dfd082eb86f8 100644 ---- a/arch/mips/vdso/Makefile -+++ b/arch/mips/vdso/Makefile -@@ -6,7 +6,9 @@ ccflags-vdso := \ - $(filter -I%,$(KBUILD_CFLAGS)) \ - $(filter -E%,$(KBUILD_CFLAGS)) \ - $(filter -mmicromips,$(KBUILD_CFLAGS)) \ -- $(filter -march=%,$(KBUILD_CFLAGS)) -+ $(filter -march=%,$(KBUILD_CFLAGS)) \ -+ $(filter -m%-float,$(KBUILD_CFLAGS)) \ -+ -D__VDSO__ - cflags-vdso := $(ccflags-vdso) \ - $(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \ - -O2 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \ -diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c -index 6a75352f453c..950b0c00a092 100644 ---- a/arch/s390/kvm/interrupt.c -+++ b/arch/s390/kvm/interrupt.c -@@ -1487,6 +1487,16 @@ int s390int_to_s390irq(struct kvm_s390_interrupt *s390int, - case KVM_S390_MCHK: - irq->u.mchk.mcic = s390int->parm64; - break; -+ case KVM_S390_INT_PFAULT_INIT: -+ irq->u.ext.ext_params = s390int->parm; -+ irq->u.ext.ext_params2 = s390int->parm64; -+ break; -+ case KVM_S390_RESTART: -+ case KVM_S390_INT_CLOCK_COMP: -+ case KVM_S390_INT_CPU_TIMER: -+ break; -+ default: -+ return -EINVAL; - } - return 0; - } -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 23911ecfbad6..14d2ca9c779e 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -2541,7 +2541,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - } - case KVM_S390_INTERRUPT: { - struct kvm_s390_interrupt s390int; -- struct kvm_s390_irq s390irq; -+ struct kvm_s390_irq s390irq = {}; - - r = -EFAULT; - if (copy_from_user(&s390int, argp, sizeof(s390int))) -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 727693e283da..bcf409997d6d 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -886,7 +886,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i - break; - case BPF_ALU64 | BPF_NEG: /* dst = -dst */ - /* lcgr %dst,%dst */ -- EMIT4(0xb9130000, dst_reg, dst_reg); -+ EMIT4(0xb9030000, dst_reg, dst_reg); - break; - /* - * BPF_FROM_BE/LE -@@ -1067,8 +1067,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i - /* llgf %w1,map.max_entries(%b2) */ - EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2, - offsetof(struct bpf_array, map.max_entries)); -- /* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */ -- EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3, -+ /* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */ -+ EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3, - REG_W1, 0, 0xa); - - /* -@@ -1094,8 +1094,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i - * goto out; - */ - -- /* sllg %r1,%b3,3: %r1 = index * 8 */ -- EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3); -+ /* llgfr %r1,%b3: %r1 = (u32) index */ -+ EMIT4(0xb9160000, REG_1, BPF_REG_3); -+ /* sllg %r1,%r1,3: %r1 *= 8 */ -+ EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3); - /* lg %r1,prog(%b2,%r1) */ - EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2, - REG_1, offsetof(struct bpf_array, ptrs)); -diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index 00e0226634fa..8b4d022ce0cb 100644 ---- a/arch/x86/Makefile -+++ b/arch/x86/Makefile -@@ -38,6 +38,7 @@ REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -D__KERNEL__ \ - - REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding) - REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector) -+REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member) - REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4)) - export REALMODE_CFLAGS - -diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h -index 0232b5a2a2d9..588d8fbd1e6d 100644 ---- a/arch/x86/include/asm/bootparam_utils.h -+++ b/arch/x86/include/asm/bootparam_utils.h -@@ -71,6 +71,7 @@ static void sanitize_boot_params(struct boot_params *boot_params) - BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries), - BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer), - BOOT_PARAM_PRESERVE(hdr), -+ BOOT_PARAM_PRESERVE(e820_map), - BOOT_PARAM_PRESERVE(eddbuf), - }; - -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index fd945099fc95..4d5e8ff3b5e5 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2344,7 +2344,13 @@ unsigned int arch_dynirq_lower_bound(unsigned int from) - * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use - * gsi_top if ioapic_dynirq_base hasn't been initialized yet. - */ -- return ioapic_initialized ? ioapic_dynirq_base : gsi_top; -+ if (!ioapic_initialized) -+ return gsi_top; -+ /* -+ * For DT enabled machines ioapic_dynirq_base is irrelevant and not -+ * updated. So simply return @from if ioapic_dynirq_base == 0. -+ */ -+ return ioapic_dynirq_base ? : from; - } - - #ifdef CONFIG_X86_32 -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 098be61a6b4c..343c8ddad86a 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -7247,6 +7247,7 @@ static int handle_vmread(struct kvm_vcpu *vcpu) - unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION); - u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO); - gva_t gva = 0; -+ struct x86_exception e; - - if (!nested_vmx_check_permission(vcpu) || - !nested_vmx_check_vmcs12(vcpu)) -@@ -7273,8 +7274,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu) - vmx_instruction_info, true, &gva)) - return 1; - /* _system ok, as nested_vmx_check_permission verified cpl=0 */ -- kvm_write_guest_virt_system(vcpu, gva, &field_value, -- (is_long_mode(vcpu) ? 8 : 4), NULL); -+ if (kvm_write_guest_virt_system(vcpu, gva, &field_value, -+ (is_long_mode(vcpu) ? 8 : 4), -+ NULL)) -+ kvm_inject_page_fault(vcpu, &e); - } - - nested_vmx_succeed(vcpu); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 9f70de2ca0e2..74674a6e4827 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -4337,6 +4337,13 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v - if (!system && kvm_x86_ops->get_cpl(vcpu) == 3) - access |= PFERR_USER_MASK; - -+ /* -+ * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED -+ * is returned, but our callers are not ready for that and they blindly -+ * call kvm_inject_page_fault. Ensure that they at least do not leak -+ * uninitialized kernel stack memory into cr2 and error code. -+ */ -+ memset(exception, 0, sizeof(*exception)); - return kvm_write_guest_virt_helper(addr, val, bytes, vcpu, - access, exception); - } -diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig -index 31c60101a69a..7fa840170151 100644 ---- a/drivers/atm/Kconfig -+++ b/drivers/atm/Kconfig -@@ -199,7 +199,7 @@ config ATM_NICSTAR_USE_SUNI - make the card work). - - config ATM_NICSTAR_USE_IDT77105 -- bool "Use IDT77015 PHY driver (25Mbps)" -+ bool "Use IDT77105 PHY driver (25Mbps)" - depends on ATM_NICSTAR - help - Support for the PHYsical layer chip in ForeRunner LE25 cards. In -diff --git a/drivers/base/core.c b/drivers/base/core.c -index cb5718d2669e..af948fedd232 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -857,12 +857,63 @@ static inline struct kobject *get_glue_dir(struct device *dev) - */ - static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir) - { -+ unsigned int ref; -+ - /* see if we live in a "glue" directory */ - if (!live_in_glue_dir(glue_dir, dev)) - return; - - mutex_lock(&gdp_mutex); -- if (!kobject_has_children(glue_dir)) -+ /** -+ * There is a race condition between removing glue directory -+ * and adding a new device under the glue directory. -+ * -+ * CPU1: CPU2: -+ * -+ * device_add() -+ * get_device_parent() -+ * class_dir_create_and_add() -+ * kobject_add_internal() -+ * create_dir() // create glue_dir -+ * -+ * device_add() -+ * get_device_parent() -+ * kobject_get() // get glue_dir -+ * -+ * device_del() -+ * cleanup_glue_dir() -+ * kobject_del(glue_dir) -+ * -+ * kobject_add() -+ * kobject_add_internal() -+ * create_dir() // in glue_dir -+ * sysfs_create_dir_ns() -+ * kernfs_create_dir_ns(sd) -+ * -+ * sysfs_remove_dir() // glue_dir->sd=NULL -+ * sysfs_put() // free glue_dir->sd -+ * -+ * // sd is freed -+ * kernfs_new_node(sd) -+ * kernfs_get(glue_dir) -+ * kernfs_add_one() -+ * kernfs_put() -+ * -+ * Before CPU1 remove last child device under glue dir, if CPU2 add -+ * a new device under glue dir, the glue_dir kobject reference count -+ * will be increase to 2 in kobject_get(k). And CPU2 has been called -+ * kernfs_create_dir_ns(). Meanwhile, CPU1 call sysfs_remove_dir() -+ * and sysfs_put(). This result in glue_dir->sd is freed. -+ * -+ * Then the CPU2 will see a stale "empty" but still potentially used -+ * glue dir around in kernfs_new_node(). -+ * -+ * In order to avoid this happening, we also should make sure that -+ * kernfs_node for glue_dir is released in CPU1 only when refcount -+ * for glue_dir kobj is 1. -+ */ -+ ref = atomic_read(&glue_dir->kref.refcount); -+ if (!kobject_has_children(glue_dir) && !--ref) - kobject_del(glue_dir); - kobject_put(glue_dir); - mutex_unlock(&gdp_mutex); -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index a04810837234..a12a163c6e6d 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -3784,7 +3784,7 @@ static int compat_getdrvprm(int drive, - v.native_format = UDP->native_format; - mutex_unlock(&floppy_mutex); - -- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_params))) -+ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_params))) - return -EFAULT; - return 0; - } -@@ -3820,7 +3820,7 @@ static int compat_getdrvstat(int drive, bool poll, - v.bufblocks = UDRS->bufblocks; - mutex_unlock(&floppy_mutex); - -- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_struct))) -+ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_struct))) - return -EFAULT; - return 0; - Eintr: -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index a000c2667392..014745271bb4 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -1426,6 +1426,18 @@ static void unmap_sg_talitos_ptr(struct device *dev, struct scatterlist *src, - } - } - -+static int ablkcipher_aes_setkey(struct crypto_ablkcipher *cipher, -+ const u8 *key, unsigned int keylen) -+{ -+ if (keylen == AES_KEYSIZE_128 || keylen == AES_KEYSIZE_192 || -+ keylen == AES_KEYSIZE_256) -+ return ablkcipher_setkey(cipher, key, keylen); -+ -+ crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN); -+ -+ return -EINVAL; -+} -+ - static void common_nonsnoop_unmap(struct device *dev, - struct talitos_edesc *edesc, - struct ablkcipher_request *areq) -@@ -1629,6 +1641,14 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq) - struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq); - struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher); - struct talitos_edesc *edesc; -+ unsigned int blocksize = -+ crypto_tfm_alg_blocksize(crypto_ablkcipher_tfm(cipher)); -+ -+ if (!areq->nbytes) -+ return 0; -+ -+ if (areq->nbytes % blocksize) -+ return -EINVAL; - - /* allocate extended descriptor */ - edesc = ablkcipher_edesc_alloc(areq, true); -@@ -1646,6 +1666,14 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq) - struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq); - struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher); - struct talitos_edesc *edesc; -+ unsigned int blocksize = -+ crypto_tfm_alg_blocksize(crypto_ablkcipher_tfm(cipher)); -+ -+ if (!areq->nbytes) -+ return 0; -+ -+ if (areq->nbytes % blocksize) -+ return -EINVAL; - - /* allocate extended descriptor */ - edesc = ablkcipher_edesc_alloc(areq, false); -@@ -2379,6 +2407,7 @@ static struct talitos_alg_template driver_algs[] = { - .min_keysize = AES_MIN_KEY_SIZE, - .max_keysize = AES_MAX_KEY_SIZE, - .ivsize = AES_BLOCK_SIZE, -+ .setkey = ablkcipher_aes_setkey, - } - }, - .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU | -diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c -index 1dfc71c90123..57b6e6ca14a8 100644 ---- a/drivers/dma/omap-dma.c -+++ b/drivers/dma/omap-dma.c -@@ -1199,8 +1199,10 @@ static int omap_dma_probe(struct platform_device *pdev) - - rc = devm_request_irq(&pdev->dev, irq, omap_dma_irq, - IRQF_SHARED, "omap-dma-engine", od); -- if (rc) -+ if (rc) { -+ omap_dma_free(od); - return rc; -+ } - } - - rc = dma_async_device_register(&od->ddev); -diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c -index 6a2df3297e77..691ad069444d 100644 ---- a/drivers/isdn/capi/capi.c -+++ b/drivers/isdn/capi/capi.c -@@ -687,6 +687,9 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos - if (!cdev->ap.applid) - return -ENODEV; - -+ if (count < CAPIMSG_BASELEN) -+ return -EINVAL; -+ - skb = alloc_skb(count, GFP_USER); - if (!skb) - return -ENOMEM; -@@ -697,7 +700,8 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos - } - mlen = CAPIMSG_LEN(skb->data); - if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) { -- if ((size_t)(mlen + CAPIMSG_DATALEN(skb->data)) != count) { -+ if (count < CAPI_DATA_B3_REQ_LEN || -+ (size_t)(mlen + CAPIMSG_DATALEN(skb->data)) != count) { - kfree_skb(skb); - return -EINVAL; - } -@@ -710,6 +714,10 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos - CAPIMSG_SETAPPID(skb->data, cdev->ap.applid); - - if (CAPIMSG_CMD(skb->data) == CAPI_DISCONNECT_B3_RESP) { -+ if (count < CAPI_DISCONNECT_B3_RESP_LEN) { -+ kfree_skb(skb); -+ return -EINVAL; -+ } - mutex_lock(&cdev->lock); - capincci_free(cdev, CAPIMSG_NCCI(skb->data)); - mutex_unlock(&cdev->lock); -diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c -index 6c3c47722955..30a8c21ed736 100644 ---- a/drivers/media/usb/dvb-usb/technisat-usb2.c -+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c -@@ -594,9 +594,9 @@ static int technisat_usb2_frontend_attach(struct dvb_usb_adapter *a) - - static int technisat_usb2_get_ir(struct dvb_usb_device *d) - { -- u8 buf[62], *b; -- int ret; -+ u8 buf[62]; - struct ir_raw_event ev; -+ int i, ret; - - buf[0] = GET_IR_DATA_VENDOR_REQUEST; - buf[1] = 0x08; -@@ -632,26 +632,25 @@ unlock: - return 0; /* no key pressed */ - - /* decoding */ -- b = buf+1; - - #if 0 - deb_rc("RC: %d ", ret); -- debug_dump(b, ret, deb_rc); -+ debug_dump(buf + 1, ret, deb_rc); - #endif - - ev.pulse = 0; -- while (1) { -- ev.pulse = !ev.pulse; -- ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000; -- ir_raw_event_store(d->rc_dev, &ev); -- -- b++; -- if (*b == 0xff) { -+ for (i = 1; i < ARRAY_SIZE(buf); i++) { -+ if (buf[i] == 0xff) { - ev.pulse = 0; - ev.duration = 888888*2; - ir_raw_event_store(d->rc_dev, &ev); - break; - } -+ -+ ev.pulse = !ev.pulse; -+ ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR * -+ FIRMWARE_CLOCK_TICK) / 1000; -+ ir_raw_event_store(d->rc_dev, &ev); - } - - ir_raw_event_handle(d->rc_dev); -diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c -index 4f317e2686e9..87401b18d85a 100644 ---- a/drivers/media/usb/tm6000/tm6000-dvb.c -+++ b/drivers/media/usb/tm6000/tm6000-dvb.c -@@ -111,6 +111,7 @@ static void tm6000_urb_received(struct urb *urb) - printk(KERN_ERR "tm6000: error %s\n", __func__); - kfree(urb->transfer_buffer); - usb_free_urb(urb); -+ dev->dvb->bulk_urb = NULL; - } - } - } -@@ -143,6 +144,7 @@ static int tm6000_start_stream(struct tm6000_core *dev) - dvb->bulk_urb->transfer_buffer = kzalloc(size, GFP_KERNEL); - if (dvb->bulk_urb->transfer_buffer == NULL) { - usb_free_urb(dvb->bulk_urb); -+ dvb->bulk_urb = NULL; - printk(KERN_ERR "tm6000: couldn't allocate transfer buffer!\n"); - return -ENOMEM; - } -@@ -170,6 +172,7 @@ static int tm6000_start_stream(struct tm6000_core *dev) - - kfree(dvb->bulk_urb->transfer_buffer); - usb_free_urb(dvb->bulk_urb); -+ dvb->bulk_urb = NULL; - return ret; - } - -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index dcd72b2a3715..8ba9eadc2079 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -4946,6 +4946,13 @@ static const struct dmi_system_id msi_blacklist[] = { - DMI_MATCH(DMI_BOARD_NAME, "P6T"), - }, - }, -+ { -+ .ident = "ASUS P6X", -+ .matches = { -+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), -+ DMI_MATCH(DMI_BOARD_NAME, "P6X"), -+ }, -+ }, - {} - }; - -diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c -index ca7336605748..2e5f7bbd30bf 100644 ---- a/drivers/net/ethernet/seeq/sgiseeq.c -+++ b/drivers/net/ethernet/seeq/sgiseeq.c -@@ -792,15 +792,16 @@ static int sgiseeq_probe(struct platform_device *pdev) - printk(KERN_ERR "Sgiseeq: Cannot register net device, " - "aborting.\n"); - err = -ENODEV; -- goto err_out_free_page; -+ goto err_out_free_attrs; - } - - printk(KERN_INFO "%s: %s %pM\n", dev->name, sgiseeqstr, dev->dev_addr); - - return 0; - --err_out_free_page: -- free_page((unsigned long) sp->srings); -+err_out_free_attrs: -+ dma_free_attrs(&pdev->dev, sizeof(*sp->srings), sp->srings, -+ sp->srings_dma, DMA_ATTR_NON_CONSISTENT); - err_out_free_dev: - free_netdev(dev); - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index fd9ff9eff237..2b7a3631b882 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -597,7 +597,8 @@ static void tun_detach_all(struct net_device *dev) - module_put(THIS_MODULE); - } - --static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filter) -+static int tun_attach(struct tun_struct *tun, struct file *file, -+ bool skip_filter, bool publish_tun) - { - struct tun_file *tfile = file->private_data; - int err; -@@ -630,7 +631,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte - } - tfile->queue_index = tun->numqueues; - tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN; -- rcu_assign_pointer(tfile->tun, tun); -+ if (publish_tun) -+ rcu_assign_pointer(tfile->tun, tun); - rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile); - tun->numqueues++; - -@@ -1641,7 +1643,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) - if (err < 0) - return err; - -- err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER); -+ err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER, true); - if (err < 0) - return err; - -@@ -1722,13 +1724,17 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) - NETIF_F_HW_VLAN_STAG_TX); - - INIT_LIST_HEAD(&tun->disabled); -- err = tun_attach(tun, file, false); -+ err = tun_attach(tun, file, false, false); - if (err < 0) - goto err_free_flow; - - err = register_netdevice(tun->dev); - if (err < 0) - goto err_detach; -+ /* free_netdev() won't check refcnt, to aovid race -+ * with dev_put() we need publish tun after registration. -+ */ -+ rcu_assign_pointer(tfile->tun, tun); - } - - netif_carrier_on(tun->dev); -@@ -1867,7 +1873,7 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr) - ret = security_tun_dev_attach_queue(tun->security); - if (ret < 0) - goto unlock; -- ret = tun_attach(tun, file, false); -+ ret = tun_attach(tun, file, false, true); - } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) { - tun = rtnl_dereference(tfile->tun); - if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached) -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index f71abe50ea6f..3707aab2423b 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -212,9 +212,16 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) - goto bad_desc; - } - skip: -- if ( rndis && -- header.usb_cdc_acm_descriptor && -- header.usb_cdc_acm_descriptor->bmCapabilities) { -+ /* Communcation class functions with bmCapabilities are not -+ * RNDIS. But some Wireless class RNDIS functions use -+ * bmCapabilities for their own purpose. The failsafe is -+ * therefore applied only to Communication class RNDIS -+ * functions. The rndis test is redundant, but a cheap -+ * optimization. -+ */ -+ if (rndis && is_rndis(&intf->cur_altsetting->desc) && -+ header.usb_cdc_acm_descriptor && -+ header.usb_cdc_acm_descriptor->bmCapabilities) { - dev_dbg(&intf->dev, - "ACM capabilities %02x, not really RNDIS?\n", - header.usb_cdc_acm_descriptor->bmCapabilities); -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 2d83689374bb..10dd307593e8 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -671,8 +671,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) - ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), - RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, - value, index, tmp, size, 500); -+ if (ret < 0) -+ memset(data, 0xff, size); -+ else -+ memcpy(data, tmp, size); - -- memcpy(data, tmp, size); - kfree(tmp); - - return ret; -diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c -index de8435709735..4255fb8dd58a 100644 ---- a/drivers/net/wireless/mwifiex/ie.c -+++ b/drivers/net/wireless/mwifiex/ie.c -@@ -240,6 +240,9 @@ static int mwifiex_update_vs_ie(const u8 *ies, int ies_len, - } - - vs_ie = (struct ieee_types_header *)vendor_ie; -+ if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 > -+ IEEE_MAX_IE_SIZE) -+ return -EINVAL; - memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length), - vs_ie, vs_ie->len + 2); - le16_add_cpu(&ie->ie_length, vs_ie->len + 2); -diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c -index 759a6ada5b0f..60bba1ca24e6 100644 ---- a/drivers/net/wireless/mwifiex/uap_cmd.c -+++ b/drivers/net/wireless/mwifiex/uap_cmd.c -@@ -286,6 +286,8 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg, - - rate_ie = (void *)cfg80211_find_ie(WLAN_EID_SUPP_RATES, var_pos, len); - if (rate_ie) { -+ if (rate_ie->len > MWIFIEX_SUPPORTED_RATES) -+ return; - memcpy(bss_cfg->rates, rate_ie + 1, rate_ie->len); - rate_len = rate_ie->len; - } -@@ -293,8 +295,11 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg, - rate_ie = (void *)cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, - params->beacon.tail, - params->beacon.tail_len); -- if (rate_ie) -+ if (rate_ie) { -+ if (rate_ie->len > MWIFIEX_SUPPORTED_RATES - rate_len) -+ return; - memcpy(bss_cfg->rates + rate_len, rate_ie + 1, rate_ie->len); -+ } - - return; - } -@@ -412,6 +417,8 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv, - params->beacon.tail_len); - if (vendor_ie) { - wmm_ie = (struct ieee_types_header *)vendor_ie; -+ if (*(vendor_ie + 1) > sizeof(struct mwifiex_types_wmm_info)) -+ return; - memcpy(&bss_cfg->wmm_info, wmm_ie + 1, - sizeof(bss_cfg->wmm_info)); - priv->wmm_enabled = 1; -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 6f55ab4f7959..574c93a24180 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -893,7 +893,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, - __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); - } - if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { -- queue->rx.rsp_cons = ++cons; -+ queue->rx.rsp_cons = ++cons + skb_queue_len(list); - kfree_skb(nskb); - return ~0U; - } -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index fc46c8cf5fcd..3bd19de7df71 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -1275,7 +1275,6 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) - - atmel_port->hd_start_rx = false; - atmel_start_rx(port); -- return; - } - - tasklet_schedule(&atmel_port->tasklet); -diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c -index c894eca57e73..82e00ac6f7e3 100644 ---- a/drivers/tty/serial/sprd_serial.c -+++ b/drivers/tty/serial/sprd_serial.c -@@ -240,7 +240,7 @@ static inline void sprd_rx(struct uart_port *port) - - if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE | - SPRD_LSR_FE | SPRD_LSR_OE)) -- if (handle_lsr_errors(port, &lsr, &flag)) -+ if (handle_lsr_errors(port, &flag, &lsr)) - continue; - if (uart_handle_sysrq_char(port, ch)) - continue; -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index aef208585544..5abc4e5434ec 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -891,7 +891,7 @@ int usb_get_bos_descriptor(struct usb_device *dev) - struct usb_bos_descriptor *bos; - struct usb_dev_cap_header *cap; - struct usb_ssp_cap_descriptor *ssp_cap; -- unsigned char *buffer; -+ unsigned char *buffer, *buffer0; - int length, total_len, num, i, ssac; - __u8 cap_type; - int ret; -@@ -936,10 +936,12 @@ int usb_get_bos_descriptor(struct usb_device *dev) - ret = -ENOMSG; - goto err; - } -+ -+ buffer0 = buffer; - total_len -= length; -+ buffer += length; - - for (i = 0; i < num; i++) { -- buffer += length; - cap = (struct usb_dev_cap_header *)buffer; - - if (total_len < sizeof(*cap) || total_len < cap->bLength) { -@@ -953,8 +955,6 @@ int usb_get_bos_descriptor(struct usb_device *dev) - break; - } - -- total_len -= length; -- - if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { - dev_warn(ddev, "descriptor type invalid, skip\n"); - continue; -@@ -989,7 +989,11 @@ int usb_get_bos_descriptor(struct usb_device *dev) - default: - break; - } -+ -+ total_len -= length; -+ buffer += length; - } -+ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0); - - return 0; - -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 57a46093656a..f9c3907bf159 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -5133,7 +5133,7 @@ process_leaf: - } - - if (btrfs_inode_in_log(di_inode, trans->transid)) { -- iput(di_inode); -+ btrfs_add_delayed_iput(di_inode); - continue; - } - -@@ -5143,7 +5143,7 @@ process_leaf: - btrfs_release_path(path); - ret = btrfs_log_inode(trans, root, di_inode, - log_mode, 0, LLONG_MAX, ctx); -- iput(di_inode); -+ btrfs_add_delayed_iput(di_inode); - if (ret) - goto next_dir_inode; - if (ctx->log_new_dentries) { -@@ -5281,7 +5281,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, - - ret = btrfs_log_inode(trans, root, dir_inode, - LOG_INODE_ALL, 0, LLONG_MAX, ctx); -- iput(dir_inode); -+ btrfs_add_delayed_iput(dir_inode); - if (ret) - goto out; - } -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 9cb72fd40eff..63108343124a 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -2466,6 +2466,7 @@ static int - cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) - { - int rc = 0; -+ int is_domain = 0; - const char *delim, *payload; - char *desc; - ssize_t len; -@@ -2513,6 +2514,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) - rc = PTR_ERR(key); - goto out_err; - } -+ is_domain = 1; - } - - down_read(&key->sem); -@@ -2570,6 +2572,26 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses) - goto out_key_put; - } - -+ /* -+ * If we have a domain key then we must set the domainName in the -+ * for the request. -+ */ -+ if (is_domain && ses->domainName) { -+ vol->domainname = kstrndup(ses->domainName, -+ strlen(ses->domainName), -+ GFP_KERNEL); -+ if (!vol->domainname) { -+ cifs_dbg(FYI, "Unable to allocate %zd bytes for " -+ "domain\n", len); -+ rc = -ENOMEM; -+ kfree(vol->username); -+ vol->username = NULL; -+ kzfree(vol->password); -+ vol->password = NULL; -+ goto out_key_put; -+ } -+ } -+ - out_key_put: - up_read(&key->sem); - key_put(key); -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index d3e3761eacfa..c5e884585c23 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -73,13 +73,13 @@ nfs4_file_open(struct inode *inode, struct file *filp) - if (IS_ERR(inode)) { - err = PTR_ERR(inode); - switch (err) { -- case -EPERM: -- case -EACCES: -- case -EDQUOT: -- case -ENOSPC: -- case -EROFS: -- goto out_put_ctx; - default: -+ goto out_put_ctx; -+ case -ENOENT: -+ case -ESTALE: -+ case -EISDIR: -+ case -ENOTDIR: -+ case -ELOOP: - goto out_drop; - } - } -diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c -index 8a2077408ab0..af1bb7353792 100644 ---- a/fs/nfs/pagelist.c -+++ b/fs/nfs/pagelist.c -@@ -593,7 +593,7 @@ static void nfs_pgio_rpcsetup(struct nfs_pgio_header *hdr, - } - - hdr->res.fattr = &hdr->fattr; -- hdr->res.count = count; -+ hdr->res.count = 0; - hdr->res.eof = 0; - hdr->res.verf = &hdr->verf; - nfs_fattr_init(&hdr->fattr); -diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c -index b417bbcd9704..b83e14ad13c4 100644 ---- a/fs/nfs/proc.c -+++ b/fs/nfs/proc.c -@@ -588,7 +588,8 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr) - /* Emulate the eof flag, which isn't normally needed in NFSv2 - * as it is guaranteed to always return the file attributes - */ -- if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size) -+ if ((hdr->res.count == 0 && hdr->args.count > 0) || -+ hdr->args.offset + hdr->res.count >= hdr->res.fattr->size) - hdr->res.eof = 1; - } - return 0; -@@ -609,8 +610,10 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task, - - static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr) - { -- if (task->tk_status >= 0) -+ if (task->tk_status >= 0) { -+ hdr->res.count = hdr->args.count; - nfs_writeback_update_inode(hdr); -+ } - return 0; - } - -diff --git a/include/uapi/linux/isdn/capicmd.h b/include/uapi/linux/isdn/capicmd.h -index b58635f722da..ae1e1fba2e13 100644 ---- a/include/uapi/linux/isdn/capicmd.h -+++ b/include/uapi/linux/isdn/capicmd.h -@@ -15,6 +15,7 @@ - #define CAPI_MSG_BASELEN 8 - #define CAPI_DATA_B3_REQ_LEN (CAPI_MSG_BASELEN+4+4+2+2+2) - #define CAPI_DATA_B3_RESP_LEN (CAPI_MSG_BASELEN+4+2) -+#define CAPI_DISCONNECT_B3_RESP_LEN (CAPI_MSG_BASELEN+4) - - /*----- CAPI commands -----*/ - #define CAPI_ALERT 0x01 -diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c -index b86886beee4f..867fb0ed4aa6 100644 ---- a/kernel/irq/resend.c -+++ b/kernel/irq/resend.c -@@ -37,6 +37,8 @@ static void resend_irqs(unsigned long arg) - irq = find_first_bit(irqs_resend, nr_irqs); - clear_bit(irq, irqs_resend); - desc = irq_to_desc(irq); -+ if (!desc) -+ continue; - local_irq_disable(); - desc->handle_irq(desc); - local_irq_enable(); -diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c -index cd8deea2d074..db6b65a5f811 100644 ---- a/net/bridge/br_mdb.c -+++ b/net/bridge/br_mdb.c -@@ -256,7 +256,7 @@ static int nlmsg_populate_rtr_fill(struct sk_buff *skb, - struct nlmsghdr *nlh; - struct nlattr *nest; - -- nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), NLM_F_MULTI); -+ nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), 0); - if (!nlh) - return -EMSGSIZE; - -diff --git a/net/core/dev.c b/net/core/dev.c -index 152e1e6316e6..18a5154e2f25 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6837,6 +6837,8 @@ int register_netdevice(struct net_device *dev) - ret = notifier_to_errno(ret); - if (ret) { - rollback_registered(dev); -+ rcu_barrier(); -+ - dev->reg_state = NETREG_UNREGISTERED; - } - /* -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 30c5500b0899..b0677b265b48 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -225,7 +225,7 @@ static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb) - - static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp) - { -- tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR; -+ tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR; - } - - static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb) -diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c -index a830b68e63c9..c846cff26933 100644 ---- a/net/ipv6/ping.c -+++ b/net/ipv6/ping.c -@@ -234,7 +234,7 @@ static int __net_init ping_v6_proc_init_net(struct net *net) - return ping_proc_register(net, &ping_v6_seq_afinfo); - } - --static void __net_init ping_v6_proc_exit_net(struct net *net) -+static void __net_exit ping_v6_proc_exit_net(struct net *net) - { - return ping_proc_unregister(net, &ping_v6_seq_afinfo); - } -diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c -index b666959f17c0..b7c13179fa40 100644 ---- a/net/netfilter/nf_conntrack_ftp.c -+++ b/net/netfilter/nf_conntrack_ftp.c -@@ -334,7 +334,7 @@ static int find_pattern(const char *data, size_t dlen, - i++; - } - -- pr_debug("Skipped up to `%c'!\n", skip); -+ pr_debug("Skipped up to 0x%hhx delimiter!\n", skip); - - *numoff = i; - *numlen = getnum(data + i, dlen - i, cmd, term, numoff); -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index aa4725038f94..eec6dc2d3152 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -671,7 +671,11 @@ static void qdisc_rcu_free(struct rcu_head *head) - - void qdisc_destroy(struct Qdisc *qdisc) - { -- const struct Qdisc_ops *ops = qdisc->ops; -+ const struct Qdisc_ops *ops; -+ -+ if (!qdisc) -+ return; -+ ops = qdisc->ops; - - if (qdisc->flags & TCQ_F_BUILTIN || - !atomic_dec_and_test(&qdisc->refcnt)) -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index aff2a1b46f7f..dc68dccc6b0c 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -552,7 +552,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt) - new_hhf_non_hh_weight = nla_get_u32(tb[TCA_HHF_NON_HH_WEIGHT]); - - non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight; -- if (non_hh_quantum > INT_MAX) -+ if (non_hh_quantum == 0 || non_hh_quantum > INT_MAX) - return -EINVAL; - - sch_tree_lock(sch); -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index 247d1888c386..07c54b212cd7 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -1331,7 +1331,7 @@ static int __net_init sctp_ctrlsock_init(struct net *net) - return status; - } - --static void __net_init sctp_ctrlsock_exit(struct net *net) -+static void __net_exit sctp_ctrlsock_exit(struct net *net) - { - /* Free the control endpoint. */ - inet_ctl_sock_destroy(net->sctp.ctl_sock); -diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c -index e5cd14307aa5..7c220e905168 100644 ---- a/net/sctp/sm_sideeffect.c -+++ b/net/sctp/sm_sideeffect.c -@@ -505,7 +505,7 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands, - */ - if ((transport->state == SCTP_ACTIVE) && - (transport->error_count < transport->pathmaxrxt) && -- (transport->error_count > asoc->pf_retrans)) { -+ (transport->error_count > transport->pf_retrans)) { - - sctp_assoc_control_transport(asoc, transport, - SCTP_TRANSPORT_PF, -diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c -index c4c151bc000c..b57675f81ceb 100644 ---- a/net/tipc/name_distr.c -+++ b/net/tipc/name_distr.c -@@ -284,7 +284,8 @@ static void tipc_publ_purge(struct net *net, struct publication *publ, u32 addr) - publ->key); - } - -- kfree_rcu(p, rcu); -+ if (p) -+ kfree_rcu(p, rcu); - } - - void tipc_publ_notify(struct net *net, struct list_head *nsub_list, u32 addr) -diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c -index 8882b729924d..976deea0569e 100644 ---- a/security/keys/request_key_auth.c -+++ b/security/keys/request_key_auth.c -@@ -71,6 +71,9 @@ static void request_key_auth_describe(const struct key *key, - { - struct request_key_auth *rka = key->payload.data[0]; - -+ if (!rka) -+ return; -+ - seq_puts(m, "key:"); - seq_puts(m, key->description); - if (key_is_positive(key)) -@@ -88,6 +91,9 @@ static long request_key_auth_read(const struct key *key, - size_t datalen; - long ret; - -+ if (!rka) -+ return -EKEYREVOKED; -+ - datalen = rka->callout_len; - ret = datalen; - -diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c -index 532e7bf06868..58cf16188722 100644 ---- a/tools/power/x86/turbostat/turbostat.c -+++ b/tools/power/x86/turbostat/turbostat.c -@@ -3014,7 +3014,7 @@ int initialize_counters(int cpu_id) - - void allocate_output_buffer() - { -- output_buffer = calloc(1, (1 + topo.num_cpus) * 1024); -+ output_buffer = calloc(1, (1 + topo.num_cpus) * 2048); - outp = output_buffer; - if (outp == NULL) - err(-1, "calloc output buffer"); -diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c -index 571c1ce37d15..5c1efb869df2 100644 ---- a/virt/kvm/coalesced_mmio.c -+++ b/virt/kvm/coalesced_mmio.c -@@ -39,7 +39,7 @@ static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev, - return 1; - } - --static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev) -+static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last) - { - struct kvm_coalesced_mmio_ring *ring; - unsigned avail; -@@ -51,7 +51,7 @@ static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev) - * there is always one unused entry in the buffer - */ - ring = dev->kvm->coalesced_mmio_ring; -- avail = (ring->first - ring->last - 1) % KVM_COALESCED_MMIO_MAX; -+ avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX; - if (avail == 0) { - /* full */ - return 0; -@@ -66,24 +66,27 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu, - { - struct kvm_coalesced_mmio_dev *dev = to_mmio(this); - struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring; -+ __u32 insert; - - if (!coalesced_mmio_in_range(dev, addr, len)) - return -EOPNOTSUPP; - - spin_lock(&dev->kvm->ring_lock); - -- if (!coalesced_mmio_has_room(dev)) { -+ insert = READ_ONCE(ring->last); -+ if (!coalesced_mmio_has_room(dev, insert) || -+ insert >= KVM_COALESCED_MMIO_MAX) { - spin_unlock(&dev->kvm->ring_lock); - return -EOPNOTSUPP; - } - - /* copy data in first free entry of the ring */ - -- ring->coalesced_mmio[ring->last].phys_addr = addr; -- ring->coalesced_mmio[ring->last].len = len; -- memcpy(ring->coalesced_mmio[ring->last].data, val, len); -+ ring->coalesced_mmio[insert].phys_addr = addr; -+ ring->coalesced_mmio[insert].len = len; -+ memcpy(ring->coalesced_mmio[insert].data, val, len); - smp_wmb(); -- ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX; -+ ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX; - spin_unlock(&dev->kvm->ring_lock); - return 0; - } diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.194-195.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.194-195.patch deleted file mode 100644 index 2d1b9501c3ce..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.194-195.patch +++ /dev/null @@ -1,2648 +0,0 @@ -diff --git a/Makefile b/Makefile -index bea8f3f591c4..721fa569a680 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 194 -+SUBLEVEL = 195 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-zynq/platsmp.c b/arch/arm/mach-zynq/platsmp.c -index f66816c49186..dabe33ac988e 100644 ---- a/arch/arm/mach-zynq/platsmp.c -+++ b/arch/arm/mach-zynq/platsmp.c -@@ -65,7 +65,7 @@ int zynq_cpun_start(u32 address, int cpu) - * 0x4: Jump by mov instruction - * 0x8: Jumping address - */ -- memcpy((__force void *)zero, &zynq_secondary_trampoline, -+ memcpy_toio(zero, &zynq_secondary_trampoline, - trampoline_size); - writel(address, zero + trampoline_size); - -diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c -index 36b2c94a8eb5..14c7184daaf6 100644 ---- a/arch/ia64/kernel/module.c -+++ b/arch/ia64/kernel/module.c -@@ -912,8 +912,12 @@ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mo - void - module_arch_cleanup (struct module *mod) - { -- if (mod->arch.init_unw_table) -+ if (mod->arch.init_unw_table) { - unw_remove_unwind_table(mod->arch.init_unw_table); -- if (mod->arch.core_unw_table) -+ mod->arch.init_unw_table = NULL; -+ } -+ if (mod->arch.core_unw_table) { - unw_remove_unwind_table(mod->arch.core_unw_table); -+ mod->arch.core_unw_table = NULL; -+ } - } -diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 834d1b5b4355..be3d4dcf3a10 100644 ---- a/arch/x86/kernel/apic/apic.c -+++ b/arch/x86/kernel/apic/apic.c -@@ -1265,6 +1265,14 @@ void setup_local_APIC(void) - return; - } - -+ /* -+ * If this comes from kexec/kcrash the APIC might be enabled in -+ * SPIV. Soft disable it before doing further initialization. -+ */ -+ value = apic_read(APIC_SPIV); -+ value &= ~APIC_SPIV_APIC_ENABLED; -+ apic_write(APIC_SPIV, value); -+ - #ifdef CONFIG_X86_32 - /* Pound the ESR really hard over the head with a big hammer - mbligh */ - if (lapic_is_integrated() && apic->disable_esr) { -diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c -index 12c8286206ce..6a0ba9d09b0e 100644 ---- a/arch/x86/kernel/smp.c -+++ b/arch/x86/kernel/smp.c -@@ -176,6 +176,12 @@ asmlinkage __visible void smp_reboot_interrupt(void) - irq_exit(); - } - -+static int register_stop_handler(void) -+{ -+ return register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, -+ NMI_FLAG_FIRST, "smp_stop"); -+} -+ - static void native_stop_other_cpus(int wait) - { - unsigned long flags; -@@ -209,39 +215,41 @@ static void native_stop_other_cpus(int wait) - apic->send_IPI_allbutself(REBOOT_VECTOR); - - /* -- * Don't wait longer than a second if the caller -- * didn't ask us to wait. -+ * Don't wait longer than a second for IPI completion. The -+ * wait request is not checked here because that would -+ * prevent an NMI shutdown attempt in case that not all -+ * CPUs reach shutdown state. - */ - timeout = USEC_PER_SEC; -- while (num_online_cpus() > 1 && (wait || timeout--)) -+ while (num_online_cpus() > 1 && timeout--) - udelay(1); - } -- -- /* if the REBOOT_VECTOR didn't work, try with the NMI */ -- if ((num_online_cpus() > 1) && (!smp_no_nmi_ipi)) { -- if (register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback, -- NMI_FLAG_FIRST, "smp_stop")) -- /* Note: we ignore failures here */ -- /* Hope the REBOOT_IRQ is good enough */ -- goto finish; -- -- /* sync above data before sending IRQ */ -- wmb(); - -- pr_emerg("Shutting down cpus with NMI\n"); -+ /* if the REBOOT_VECTOR didn't work, try with the NMI */ -+ if (num_online_cpus() > 1) { -+ /* -+ * If NMI IPI is enabled, try to register the stop handler -+ * and send the IPI. In any case try to wait for the other -+ * CPUs to stop. -+ */ -+ if (!smp_no_nmi_ipi && !register_stop_handler()) { -+ /* Sync above data before sending IRQ */ -+ wmb(); - -- apic->send_IPI_allbutself(NMI_VECTOR); -+ pr_emerg("Shutting down cpus with NMI\n"); - -+ apic->send_IPI_allbutself(NMI_VECTOR); -+ } - /* -- * Don't wait longer than a 10 ms if the caller -- * didn't ask us to wait. -+ * Don't wait longer than 10 ms if the caller didn't -+ * reqeust it. If wait is true, the machine hangs here if -+ * one or more CPUs do not reach shutdown state. - */ - timeout = USEC_PER_MSEC * 10; - while (num_online_cpus() > 1 && (wait || timeout--)) - udelay(1); - } - --finish: - local_irq_save(flags); - disable_local_APIC(); - mcheck_cpu_clear(this_cpu_ptr(&cpu_info)); -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 5dd56e3517f3..6c7847b3aa2d 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -5245,6 +5245,8 @@ done_prefixes: - ctxt->memopp->addr.mem.ea + ctxt->_eip); - - done: -+ if (rc == X86EMUL_PROPAGATE_FAULT) -+ ctxt->have_exception = true; - return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK; - } - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 74674a6e4827..2b47fd3d4b8c 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -523,8 +523,14 @@ static int kvm_read_nested_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, - data, offset, len, access); - } - -+static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu) -+{ -+ return rsvd_bits(cpuid_maxphyaddr(vcpu), 63) | rsvd_bits(5, 8) | -+ rsvd_bits(1, 2); -+} -+ - /* -- * Load the pae pdptrs. Return true is they are all valid. -+ * Load the pae pdptrs. Return 1 if they are all valid, 0 otherwise. - */ - int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3) - { -@@ -543,8 +549,7 @@ int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3) - } - for (i = 0; i < ARRAY_SIZE(pdpte); ++i) { - if (is_present_gpte(pdpte[i]) && -- (pdpte[i] & -- vcpu->arch.mmu.guest_rsvd_check.rsvd_bits_mask[0][2])) { -+ (pdpte[i] & pdptr_rsvd_bits(vcpu))) { - ret = 0; - goto out; - } -@@ -5486,8 +5491,16 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, - if (reexecute_instruction(vcpu, cr2, write_fault_to_spt, - emulation_type)) - return EMULATE_DONE; -- if (ctxt->have_exception && inject_emulated_exception(vcpu)) -+ if (ctxt->have_exception) { -+ /* -+ * #UD should result in just EMULATION_FAILED, and trap-like -+ * exception should not be encountered during decode. -+ */ -+ WARN_ON_ONCE(ctxt->exception.vector == UD_VECTOR || -+ exception_type(ctxt->exception.vector) == EXCPT_TRAP); -+ inject_emulated_exception(vcpu); - return EMULATE_DONE; -+ } - if (emulation_type & EMULTYPE_SKIP) - return EMULATE_FAIL; - return handle_emulation_failure(vcpu); -diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c -index 0afd1981e350..43c27c04c40a 100644 ---- a/drivers/acpi/cppc_acpi.c -+++ b/drivers/acpi/cppc_acpi.c -@@ -137,8 +137,10 @@ static int acpi_get_psd(struct cpc_desc *cpc_ptr, acpi_handle handle) - union acpi_object *psd = NULL; - struct acpi_psd_package *pdomain; - -- status = acpi_evaluate_object_typed(handle, "_PSD", NULL, &buffer, -- ACPI_TYPE_PACKAGE); -+ status = acpi_evaluate_object_typed(handle, "_PSD", NULL, -+ &buffer, ACPI_TYPE_PACKAGE); -+ if (status == AE_NOT_FOUND) /* _PSD is optional */ -+ return 0; - if (ACPI_FAILURE(status)) - return -ENODEV; - -diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c -index c68e72414a67..435bd0ffc8c0 100644 ---- a/drivers/acpi/custom_method.c -+++ b/drivers/acpi/custom_method.c -@@ -48,8 +48,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, - if ((*ppos > max_size) || - (*ppos + count > max_size) || - (*ppos + count < count) || -- (count > uncopied_bytes)) -+ (count > uncopied_bytes)) { -+ kfree(buf); - return -EINVAL; -+ } - - if (copy_from_user(buf + (*ppos), user_buf, count)) { - kfree(buf); -@@ -69,6 +71,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, - add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); - } - -+ kfree(buf); - return count; - } - -diff --git a/drivers/base/soc.c b/drivers/base/soc.c -index 75b98aad6faf..84242e6b2897 100644 ---- a/drivers/base/soc.c -+++ b/drivers/base/soc.c -@@ -146,6 +146,7 @@ out2: - out1: - return ERR_PTR(ret); - } -+EXPORT_SYMBOL_GPL(soc_device_register); - - /* Ensure soc_dev->attr is freed prior to calling soc_device_unregister. */ - void soc_device_unregister(struct soc_device *soc_dev) -@@ -154,6 +155,7 @@ void soc_device_unregister(struct soc_device *soc_dev) - - device_unregister(&soc_dev->dev); - } -+EXPORT_SYMBOL_GPL(soc_device_unregister); - - static int __init soc_bus_register(void) - { -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index b0a12e6dae43..fcc12c879659 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -353,6 +353,9 @@ static const struct usb_device_id blacklist_table[] = { - /* Additional Realtek 8822BE Bluetooth devices */ - { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK }, - -+ /* Additional Realtek 8822CE Bluetooth devices */ -+ { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK }, -+ - /* Silicon Wave based devices */ - { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, - -diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c -index 340f96e44642..bba54422d2ca 100644 ---- a/drivers/char/hw_random/core.c -+++ b/drivers/char/hw_random/core.c -@@ -88,7 +88,7 @@ static void add_early_randomness(struct hwrng *rng) - size_t size = min_t(size_t, 16, rng_buffer_size()); - - mutex_lock(&reading_mutex); -- bytes_read = rng_get_data(rng, rng_buffer, size, 1); -+ bytes_read = rng_get_data(rng, rng_buffer, size, 0); - mutex_unlock(&reading_mutex); - if (bytes_read > 0) - add_device_randomness(rng_buffer, bytes_read); -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 23f52a897283..6ebe2b86d8eb 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -95,6 +95,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr) - } - #endif - -+static inline bool should_stop_iteration(void) -+{ -+ if (need_resched()) -+ cond_resched(); -+ return fatal_signal_pending(current); -+} -+ - /* - * This funcion reads the *physical* memory. The f_pos points directly to the - * memory location. -@@ -161,6 +168,8 @@ static ssize_t read_mem(struct file *file, char __user *buf, - p += sz; - count -= sz; - read += sz; -+ if (should_stop_iteration()) -+ break; - } - - *ppos += read; -@@ -232,6 +241,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf, - p += sz; - count -= sz; - written += sz; -+ if (should_stop_iteration()) -+ break; - } - - *ppos += written; -@@ -443,6 +454,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf, - read += sz; - low_count -= sz; - count -= sz; -+ if (should_stop_iteration()) { -+ count = 0; -+ break; -+ } - } - } - -@@ -467,6 +482,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf, - buf += sz; - read += sz; - p += sz; -+ if (should_stop_iteration()) -+ break; - } - free_page((unsigned long)kbuf); - } -@@ -517,6 +534,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf, - p += sz; - count -= sz; - written += sz; -+ if (should_stop_iteration()) -+ break; - } - - *ppos += written; -@@ -568,6 +587,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf, - buf += sz; - virtr += sz; - p += sz; -+ if (should_stop_iteration()) -+ break; - } - free_page((unsigned long)kbuf); - } -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 014745271bb4..1c8857e7db89 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -2730,6 +2730,7 @@ static int talitos_remove(struct platform_device *ofdev) - break; - case CRYPTO_ALG_TYPE_AEAD: - crypto_unregister_aead(&t_alg->algt.alg.aead); -+ break; - case CRYPTO_ALG_TYPE_AHASH: - crypto_unregister_ahash(&t_alg->algt.alg.hash); - break; -diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c -index 996c4b00d323..d6cdc3be03fc 100644 ---- a/drivers/dma/bcm2835-dma.c -+++ b/drivers/dma/bcm2835-dma.c -@@ -595,8 +595,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev) - pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask; - - rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); -- if (rc) -+ if (rc) { -+ dev_err(&pdev->dev, "Unable to set DMA mask\n"); - return rc; -+ } - - od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL); - if (!od) -diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c -index 85674a8d0436..e508c8c5f3fd 100644 ---- a/drivers/dma/edma.c -+++ b/drivers/dma/edma.c -@@ -2218,9 +2218,6 @@ static int edma_probe(struct platform_device *pdev) - - ecc->default_queue = info->default_queue; - -- for (i = 0; i < ecc->num_slots; i++) -- edma_write_slot(ecc, i, &dummy_paramset); -- - if (info->rsv) { - /* Set the reserved slots in inuse list */ - rsv_slots = info->rsv->rsv_slots; -@@ -2233,6 +2230,12 @@ static int edma_probe(struct platform_device *pdev) - } - } - -+ for (i = 0; i < ecc->num_slots; i++) { -+ /* Reset only unused - not reserved - paRAM slots */ -+ if (!test_bit(i, ecc->slot_inuse)) -+ edma_write_slot(ecc, i, &dummy_paramset); -+ } -+ - /* Clear the xbar mapped channels in unused list */ - xbar_chans = info->xbar_chans; - if (xbar_chans) { -diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c -index e4f43125e0fb..a390415c97a8 100644 ---- a/drivers/dma/iop-adma.c -+++ b/drivers/dma/iop-adma.c -@@ -126,9 +126,9 @@ static void __iop_adma_slot_cleanup(struct iop_adma_chan *iop_chan) - list_for_each_entry_safe(iter, _iter, &iop_chan->chain, - chain_node) { - pr_debug("\tcookie: %d slot: %d busy: %d " -- "this_desc: %#x next_desc: %#x ack: %d\n", -+ "this_desc: %#x next_desc: %#llx ack: %d\n", - iter->async_tx.cookie, iter->idx, busy, -- iter->async_tx.phys, iop_desc_get_next_desc(iter), -+ iter->async_tx.phys, (u64)iop_desc_get_next_desc(iter), - async_tx_test_ack(&iter->async_tx)); - prefetch(_iter); - prefetch(&_iter->async_tx); -@@ -316,9 +316,9 @@ retry: - int i; - dev_dbg(iop_chan->device->common.dev, - "allocated slot: %d " -- "(desc %p phys: %#x) slots_per_op %d\n", -+ "(desc %p phys: %#llx) slots_per_op %d\n", - iter->idx, iter->hw_desc, -- iter->async_tx.phys, slots_per_op); -+ (u64)iter->async_tx.phys, slots_per_op); - - /* pre-ack all but the last descriptor */ - if (num_slots != slots_per_op) -@@ -526,7 +526,7 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest, - return NULL; - BUG_ON(len > IOP_ADMA_MAX_BYTE_COUNT); - -- dev_dbg(iop_chan->device->common.dev, "%s len: %u\n", -+ dev_dbg(iop_chan->device->common.dev, "%s len: %zu\n", - __func__, len); - - spin_lock_bh(&iop_chan->lock); -@@ -559,7 +559,7 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest, - BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); - - dev_dbg(iop_chan->device->common.dev, -- "%s src_cnt: %d len: %u flags: %lx\n", -+ "%s src_cnt: %d len: %zu flags: %lx\n", - __func__, src_cnt, len, flags); - - spin_lock_bh(&iop_chan->lock); -@@ -592,7 +592,7 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src, - if (unlikely(!len)) - return NULL; - -- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", -+ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", - __func__, src_cnt, len); - - spin_lock_bh(&iop_chan->lock); -@@ -630,7 +630,7 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src, - BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); - - dev_dbg(iop_chan->device->common.dev, -- "%s src_cnt: %d len: %u flags: %lx\n", -+ "%s src_cnt: %d len: %zu flags: %lx\n", - __func__, src_cnt, len, flags); - - if (dmaf_p_disabled_continue(flags)) -@@ -693,7 +693,7 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src, - return NULL; - BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT); - -- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n", -+ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n", - __func__, src_cnt, len); - - spin_lock_bh(&iop_chan->lock); -diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c -index d42537425438..f40f7df4b734 100644 ---- a/drivers/firmware/efi/cper.c -+++ b/drivers/firmware/efi/cper.c -@@ -384,6 +384,21 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie, - printk( - "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n", - pfx, pcie->bridge.secondary_status, pcie->bridge.control); -+ -+ /* Fatal errors call __ghes_panic() before AER handler prints this */ -+ if ((pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) && -+ (gdata->error_severity & CPER_SEV_FATAL)) { -+ struct aer_capability_regs *aer; -+ -+ aer = (struct aer_capability_regs *)pcie->aer_info; -+ printk("%saer_uncor_status: 0x%08x, aer_uncor_mask: 0x%08x\n", -+ pfx, aer->uncor_status, aer->uncor_mask); -+ printk("%saer_uncor_severity: 0x%08x\n", -+ pfx, aer->uncor_severity); -+ printk("%sTLP Header: %08x %08x %08x %08x\n", pfx, -+ aer->header_log.dw0, aer->header_log.dw1, -+ aer->header_log.dw2, aer->header_log.dw3); -+ } - } - - static void cper_estatus_print_section( -diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c -index 1fe4b8e6596b..de1797b3a746 100644 ---- a/drivers/gpu/drm/drm_probe_helper.c -+++ b/drivers/gpu/drm/drm_probe_helper.c -@@ -338,6 +338,9 @@ static void output_poll_execute(struct work_struct *work) - enum drm_connector_status old_status; - bool repoll = false, changed; - -+ if (!dev->mode_config.poll_enabled) -+ return; -+ - /* Pick up any changes detected by the probe functions. */ - changed = dev->mode_config.delayed_event; - dev->mode_config.delayed_event = false; -@@ -501,7 +504,11 @@ EXPORT_SYMBOL(drm_kms_helper_poll_init); - */ - void drm_kms_helper_poll_fini(struct drm_device *dev) - { -- drm_kms_helper_poll_disable(dev); -+ if (!dev->mode_config.poll_enabled) -+ return; -+ -+ dev->mode_config.poll_enabled = false; -+ cancel_delayed_work_sync(&dev->mode_config.output_poll_work); - } - EXPORT_SYMBOL(drm_kms_helper_poll_fini); - -diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c -index c690fae02cf8..0fd9fc135f3d 100644 ---- a/drivers/hid/hid-lg.c -+++ b/drivers/hid/hid-lg.c -@@ -701,11 +701,16 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) - - /* Setup wireless link with Logitech Wii wheel */ - if (hdev->product == USB_DEVICE_ID_LOGITECH_WII_WHEEL) { -- unsigned char buf[] = { 0x00, 0xAF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -+ const unsigned char cbuf[] = { 0x00, 0xAF, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -+ u8 *buf = kmemdup(cbuf, sizeof(cbuf), GFP_KERNEL); - -- ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf), -- HID_FEATURE_REPORT, HID_REQ_SET_REPORT); -+ if (!buf) { -+ ret = -ENOMEM; -+ goto err_stop; -+ } - -+ ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf), -+ HID_FEATURE_REPORT, HID_REQ_SET_REPORT); - if (ret >= 0) { - /* insert a little delay of 10 jiffies ~ 40ms */ - wait_queue_head_t wait; -@@ -717,9 +722,10 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) - buf[1] = 0xB2; - get_random_bytes(&buf[2], 2); - -- ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(buf), -+ ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf), - HID_FEATURE_REPORT, HID_REQ_SET_REPORT); - } -+ kfree(buf); - } - - if (drv_data->quirks & LG_FF) -@@ -732,9 +738,12 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) - ret = lg4ff_init(hdev); - - if (ret) -- goto err_free; -+ goto err_stop; - - return 0; -+ -+err_stop: -+ hid_hw_stop(hdev); - err_free: - kfree(drv_data); - return ret; -@@ -745,8 +754,7 @@ static void lg_remove(struct hid_device *hdev) - struct lg_drv_data *drv_data = hid_get_drvdata(hdev); - if (drv_data->quirks & LG_FF4) - lg4ff_deinit(hdev); -- else -- hid_hw_stop(hdev); -+ hid_hw_stop(hdev); - kfree(drv_data); - } - -diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c -index fbddcb37ae98..dae1b9cdd2e5 100644 ---- a/drivers/hid/hid-lg4ff.c -+++ b/drivers/hid/hid-lg4ff.c -@@ -1378,7 +1378,6 @@ int lg4ff_deinit(struct hid_device *hid) - } - } - #endif -- hid_hw_stop(hid); - drv_data->device_props = NULL; - - kfree(entry); -diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c -index 3a207c0ac0e3..cba15edd47c2 100644 ---- a/drivers/hid/hid-prodikeys.c -+++ b/drivers/hid/hid-prodikeys.c -@@ -556,10 +556,14 @@ static void pcmidi_setup_extra_keys( - - static int pcmidi_set_operational(struct pcmidi_snd *pm) - { -+ int rc; -+ - if (pm->ifnum != 1) - return 0; /* only set up ONCE for interace 1 */ - -- pcmidi_get_output_report(pm); -+ rc = pcmidi_get_output_report(pm); -+ if (rc < 0) -+ return rc; - pcmidi_submit_output_report(pm, 0xc1); - return 0; - } -@@ -688,7 +692,11 @@ static int pcmidi_snd_initialise(struct pcmidi_snd *pm) - spin_lock_init(&pm->rawmidi_in_lock); - - init_sustain_timers(pm); -- pcmidi_set_operational(pm); -+ err = pcmidi_set_operational(pm); -+ if (err < 0) { -+ pk_error("failed to find output report\n"); -+ goto fail_register; -+ } - - /* register it */ - err = snd_card_register(card); -diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c -index c0c4df198725..627a24d3ea7c 100644 ---- a/drivers/hid/hidraw.c -+++ b/drivers/hid/hidraw.c -@@ -383,7 +383,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, - - mutex_lock(&minors_lock); - dev = hidraw_table[minor]; -- if (!dev) { -+ if (!dev || !dev->exist) { - ret = -ENODEV; - goto out; - } -diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c -index 579bdf93be43..e27f7e12c05b 100644 ---- a/drivers/hwmon/acpi_power_meter.c -+++ b/drivers/hwmon/acpi_power_meter.c -@@ -693,8 +693,8 @@ static int setup_attrs(struct acpi_power_meter_resource *resource) - - if (resource->caps.flags & POWER_METER_CAN_CAP) { - if (!can_cap_in_hardware()) { -- dev_err(&resource->acpi_dev->dev, -- "Ignoring unsafe software power cap!\n"); -+ dev_warn(&resource->acpi_dev->dev, -+ "Ignoring unsafe software power cap!\n"); - goto skip_unsafe_cap; - } - -diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c -index 16833365475f..a4eceb994f7e 100644 ---- a/drivers/i2c/busses/i2c-riic.c -+++ b/drivers/i2c/busses/i2c-riic.c -@@ -212,6 +212,7 @@ static irqreturn_t riic_tend_isr(int irq, void *data) - if (readb(riic->base + RIIC_ICSR2) & ICSR2_NACKF) { - /* We got a NACKIE */ - readb(riic->base + RIIC_ICDRR); /* dummy read */ -+ riic_clear_set_bit(riic, ICSR2_NACKF, 0, RIIC_ICSR2); - riic->err = -ENXIO; - } else if (riic->bytes_left) { - return IRQ_NONE; -diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c -index 114d5883d497..cf11d43ce241 100644 ---- a/drivers/irqchip/irq-gic-v3-its.c -+++ b/drivers/irqchip/irq-gic-v3-its.c -@@ -1372,14 +1372,13 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq, - struct its_device *its_dev = irq_data_get_irq_chip_data(d); - int i; - -+ bitmap_release_region(its_dev->event_map.lpi_map, -+ its_get_event_id(irq_domain_get_irq_data(domain, virq)), -+ get_count_order(nr_irqs)); -+ - for (i = 0; i < nr_irqs; i++) { - struct irq_data *data = irq_domain_get_irq_data(domain, - virq + i); -- u32 event = its_get_event_id(data); -- -- /* Mark interrupt index as unused */ -- clear_bit(event, its_dev->event_map.lpi_map); -- - /* Nuke the entry in the domain */ - irq_domain_reset_irq_data(data); - } -diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c -index 8cbb75d09a1d..75962c62304d 100644 ---- a/drivers/isdn/mISDN/socket.c -+++ b/drivers/isdn/mISDN/socket.c -@@ -763,6 +763,8 @@ base_sock_create(struct net *net, struct socket *sock, int protocol, int kern) - - if (sock->type != SOCK_RAW) - return -ESOCKTNOSUPPORT; -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - - sk = sk_alloc(net, PF_ISDN, GFP_KERNEL, &mISDN_proto, kern); - if (!sk) -diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c -index 0360c59dbdc9..fc8b2e7bcfef 100644 ---- a/drivers/leds/leds-lp5562.c -+++ b/drivers/leds/leds-lp5562.c -@@ -263,7 +263,11 @@ static void lp5562_firmware_loaded(struct lp55xx_chip *chip) - { - const struct firmware *fw = chip->fw; - -- if (fw->size > LP5562_PROGRAM_LENGTH) { -+ /* -+ * the firmware is encoded in ascii hex character, with 2 chars -+ * per byte -+ */ -+ if (fw->size > (LP5562_PROGRAM_LENGTH * 2)) { - dev_err(&chip->cl->dev, "firmware data size overflow: %zu\n", - fw->size); - return; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 067af77bb729..d59d79b77fd6 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -1667,8 +1667,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev) - if (!(le32_to_cpu(sb->feature_map) & - MD_FEATURE_RECOVERY_BITMAP)) - rdev->saved_raid_disk = -1; -- } else -- set_bit(In_sync, &rdev->flags); -+ } else { -+ /* -+ * If the array is FROZEN, then the device can't -+ * be in_sync with rest of array. -+ */ -+ if (!test_bit(MD_RECOVERY_FROZEN, -+ &mddev->recovery)) -+ set_bit(In_sync, &rdev->flags); -+ } - rdev->raid_disk = role; - break; - } -@@ -8445,7 +8452,8 @@ void md_reap_sync_thread(struct mddev *mddev) - /* resync has finished, collect result */ - md_unregister_thread(&mddev->sync_thread); - if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) && -- !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) { -+ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) && -+ mddev->degraded != mddev->raid_disks) { - /* success...*/ - /* activate any spares */ - if (mddev->pers->spare_active(mddev)) { -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 82e284d2b202..abb99515068b 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -2958,6 +2958,13 @@ static int run(struct mddev *mddev) - !test_bit(In_sync, &conf->mirrors[i].rdev->flags) || - test_bit(Faulty, &conf->mirrors[i].rdev->flags)) - mddev->degraded++; -+ /* -+ * RAID1 needs at least one disk in active -+ */ -+ if (conf->raid_disks - mddev->degraded < 1) { -+ ret = -EINVAL; -+ goto abort; -+ } - - if (conf->raid_disks - mddev->degraded == 1) - mddev->recovery_cp = MaxSector; -@@ -2992,8 +2999,12 @@ static int run(struct mddev *mddev) - ret = md_integrity_register(mddev); - if (ret) { - md_unregister_thread(&mddev->thread); -- raid1_free(mddev, conf); -+ goto abort; - } -+ return 0; -+ -+abort: -+ raid1_free(mddev, conf); - return ret; - } - -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 764e0e155ae2..f061c81e15e1 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -2394,7 +2394,9 @@ static void raid5_end_read_request(struct bio * bi) - && !test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) - retry = 1; - if (retry) -- if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) { -+ if (sh->qd_idx >= 0 && sh->pd_idx == i) -+ set_bit(R5_ReadError, &sh->dev[i].flags); -+ else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) { - set_bit(R5_ReadError, &sh->dev[i].flags); - clear_bit(R5_ReadNoMerge, &sh->dev[i].flags); - } else -diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c -index 1ee6a5527c38..d11de02ecb63 100644 ---- a/drivers/media/i2c/ov9650.c -+++ b/drivers/media/i2c/ov9650.c -@@ -707,6 +707,11 @@ static int ov965x_set_gain(struct ov965x *ov965x, int auto_gain) - for (m = 6; m >= 0; m--) - if (gain >= (1 << m) * 16) - break; -+ -+ /* Sanity check: don't adjust the gain with a negative value */ -+ if (m < 0) -+ return -EINVAL; -+ - rgain = (gain - ((1 << m) * 16)) / (1 << m); - rgain |= (((1 << m) - 1) << 4); - -diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c -index bc957528f69f..e636fca36e3d 100644 ---- a/drivers/media/pci/saa7134/saa7134-i2c.c -+++ b/drivers/media/pci/saa7134/saa7134-i2c.c -@@ -355,7 +355,11 @@ static struct i2c_client saa7134_client_template = { - - /* ----------------------------------------------------------- */ - --/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */ -+/* -+ * On Medion 7134 reading the SAA7134 chip config EEPROM needs DVB-T -+ * demod i2c gate closed due to an address clash between this EEPROM -+ * and the demod one. -+ */ - static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) - { - u8 subaddr = 0x7, dmdregval; -@@ -372,14 +376,14 @@ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) - - ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2); - if ((ret == 2) && (dmdregval & 0x2)) { -- pr_debug("%s: DVB-T demod i2c gate was left closed\n", -+ pr_debug("%s: DVB-T demod i2c gate was left open\n", - dev->name); - - data[0] = subaddr; - data[1] = (dmdregval & ~0x2); - if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1) -- pr_err("%s: EEPROM i2c gate open failure\n", -- dev->name); -+ pr_err("%s: EEPROM i2c gate close failure\n", -+ dev->name); - } - } - -diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c -index d4b3ce828285..343cd75fcd8d 100644 ---- a/drivers/media/pci/saa7146/hexium_gemini.c -+++ b/drivers/media/pci/saa7146/hexium_gemini.c -@@ -304,6 +304,9 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d - ret = saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER); - if (ret < 0) { - pr_err("cannot register capture v4l2 device. skipping.\n"); -+ saa7146_vv_release(dev); -+ i2c_del_adapter(&hexium->i2c_adapter); -+ kfree(hexium); - return ret; - } - -diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c -index 136ea1848701..f41e0d08de93 100644 ---- a/drivers/media/platform/omap3isp/isp.c -+++ b/drivers/media/platform/omap3isp/isp.c -@@ -917,6 +917,10 @@ static int isp_pipeline_enable(struct isp_pipeline *pipe, - s_stream, mode); - pipe->do_propagation = true; - } -+ -+ /* Stop at the first external sub-device. */ -+ if (subdev->dev != isp->dev) -+ break; - } - - return 0; -@@ -1031,6 +1035,10 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe) - isp->crashed |= 1U << subdev->entity.id; - failure = -ETIMEDOUT; - } -+ -+ /* Stop at the first external sub-device. */ -+ if (subdev->dev != isp->dev) -+ break; - } - - return failure; -diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c -index a6a61cce43dd..e349f5d990b7 100644 ---- a/drivers/media/platform/omap3isp/ispccdc.c -+++ b/drivers/media/platform/omap3isp/ispccdc.c -@@ -2603,6 +2603,7 @@ int omap3isp_ccdc_register_entities(struct isp_ccdc_device *ccdc, - int ret; - - /* Register the subdev and video node. */ -+ ccdc->subdev.dev = vdev->mdev->dev; - ret = v4l2_device_register_subdev(vdev, &ccdc->subdev); - if (ret < 0) - goto error; -diff --git a/drivers/media/platform/omap3isp/ispccp2.c b/drivers/media/platform/omap3isp/ispccp2.c -index 38e6a974c5b1..e6b19b785c2f 100644 ---- a/drivers/media/platform/omap3isp/ispccp2.c -+++ b/drivers/media/platform/omap3isp/ispccp2.c -@@ -1025,6 +1025,7 @@ int omap3isp_ccp2_register_entities(struct isp_ccp2_device *ccp2, - int ret; - - /* Register the subdev and video nodes. */ -+ ccp2->subdev.dev = vdev->mdev->dev; - ret = v4l2_device_register_subdev(vdev, &ccp2->subdev); - if (ret < 0) - goto error; -diff --git a/drivers/media/platform/omap3isp/ispcsi2.c b/drivers/media/platform/omap3isp/ispcsi2.c -index a78338d012b4..029b434b7609 100644 ---- a/drivers/media/platform/omap3isp/ispcsi2.c -+++ b/drivers/media/platform/omap3isp/ispcsi2.c -@@ -1201,6 +1201,7 @@ int omap3isp_csi2_register_entities(struct isp_csi2_device *csi2, - int ret; - - /* Register the subdev and video nodes. */ -+ csi2->subdev.dev = vdev->mdev->dev; - ret = v4l2_device_register_subdev(vdev, &csi2->subdev); - if (ret < 0) - goto error; -diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c -index 13803270d104..c9e8845de1b1 100644 ---- a/drivers/media/platform/omap3isp/isppreview.c -+++ b/drivers/media/platform/omap3isp/isppreview.c -@@ -2223,6 +2223,7 @@ int omap3isp_preview_register_entities(struct isp_prev_device *prev, - int ret; - - /* Register the subdev and video nodes. */ -+ prev->subdev.dev = vdev->mdev->dev; - ret = v4l2_device_register_subdev(vdev, &prev->subdev); - if (ret < 0) - goto error; -diff --git a/drivers/media/platform/omap3isp/ispresizer.c b/drivers/media/platform/omap3isp/ispresizer.c -index 7cfb43dc0ffd..d4e53cbe9193 100644 ---- a/drivers/media/platform/omap3isp/ispresizer.c -+++ b/drivers/media/platform/omap3isp/ispresizer.c -@@ -1679,6 +1679,7 @@ int omap3isp_resizer_register_entities(struct isp_res_device *res, - int ret; - - /* Register the subdev and video nodes. */ -+ res->subdev.dev = vdev->mdev->dev; - ret = v4l2_device_register_subdev(vdev, &res->subdev); - if (ret < 0) - goto error; -diff --git a/drivers/media/platform/omap3isp/ispstat.c b/drivers/media/platform/omap3isp/ispstat.c -index 94d4c295d3d0..c54c5c494b75 100644 ---- a/drivers/media/platform/omap3isp/ispstat.c -+++ b/drivers/media/platform/omap3isp/ispstat.c -@@ -1010,6 +1010,8 @@ void omap3isp_stat_unregister_entities(struct ispstat *stat) - int omap3isp_stat_register_entities(struct ispstat *stat, - struct v4l2_device *vdev) - { -+ stat->subdev.dev = vdev->mdev->dev; -+ - return v4l2_device_register_subdev(vdev, &stat->subdev); - } - -diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c -index 091d793f6583..c9347d5aac04 100644 ---- a/drivers/media/radio/si470x/radio-si470x-usb.c -+++ b/drivers/media/radio/si470x/radio-si470x-usb.c -@@ -743,7 +743,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, - /* start radio */ - retval = si470x_start_usb(radio); - if (retval < 0) -- goto err_all; -+ goto err_buf; - - /* set initial frequency */ - si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ -@@ -758,6 +758,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, - - return 0; - err_all: -+ usb_kill_urb(radio->int_in_urb); -+err_buf: - kfree(radio->buffer); - err_ctrl: - v4l2_ctrl_handler_free(&radio->hdl); -@@ -831,6 +833,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) - mutex_lock(&radio->lock); - v4l2_device_disconnect(&radio->v4l2_dev); - video_unregister_device(&radio->videodev); -+ usb_kill_urb(radio->int_in_urb); - usb_set_intfdata(intf, NULL); - mutex_unlock(&radio->lock); - v4l2_device_put(&radio->v4l2_dev); -diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c -index ee60e17fba05..cda4ce612dcf 100644 ---- a/drivers/media/rc/iguanair.c -+++ b/drivers/media/rc/iguanair.c -@@ -430,6 +430,10 @@ static int iguanair_probe(struct usb_interface *intf, - int ret, pipein, pipeout; - struct usb_host_interface *idesc; - -+ idesc = intf->altsetting; -+ if (idesc->desc.bNumEndpoints < 2) -+ return -ENODEV; -+ - ir = kzalloc(sizeof(*ir), GFP_KERNEL); - rc = rc_allocate_device(); - if (!ir || !rc) { -@@ -444,18 +448,13 @@ static int iguanair_probe(struct usb_interface *intf, - ir->urb_in = usb_alloc_urb(0, GFP_KERNEL); - ir->urb_out = usb_alloc_urb(0, GFP_KERNEL); - -- if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) { -+ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out || -+ !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) || -+ !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) { - ret = -ENOMEM; - goto out; - } - -- idesc = intf->altsetting; -- -- if (idesc->desc.bNumEndpoints < 2) { -- ret = -ENODEV; -- goto out; -- } -- - ir->rc = rc; - ir->dev = &intf->dev; - ir->udev = udev; -diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c -index 41ea00ac3a87..76b9cb940b87 100644 ---- a/drivers/media/usb/cpia2/cpia2_usb.c -+++ b/drivers/media/usb/cpia2/cpia2_usb.c -@@ -665,6 +665,10 @@ static int submit_urbs(struct camera_data *cam) - ERR("%s: usb_alloc_urb error!\n", __func__); - for (j = 0; j < i; j++) - usb_free_urb(cam->sbuf[j].urb); -+ for (j = 0; j < NUM_SBUF; j++) { -+ kfree(cam->sbuf[j].data); -+ cam->sbuf[j].data = NULL; -+ } - return -ENOMEM; - } - -diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c -index 38c03283a441..e1316c7b7c2e 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_devices.c -+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c -@@ -2418,9 +2418,13 @@ static int dib9090_tuner_attach(struct dvb_usb_adapter *adap) - 8, 0x0486, - }; - -+ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) -+ return -ENODEV; - if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &dib9090_dib0090_config) == NULL) - return -ENODEV; - i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); -+ if (!i2c) -+ return -ENODEV; - if (dib01x0_pmu_update(i2c, data_dib190, 10) != 0) - return -ENODEV; - dib0700_set_i2c_speed(adap->dev, 1500); -@@ -2496,10 +2500,14 @@ static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap) - 0, 0x00ef, - 8, 0x0406, - }; -+ if (!IS_ENABLED(CONFIG_DVB_DIB9000)) -+ return -ENODEV; - i2c = dib9000_get_tuner_interface(adap->fe_adap[0].fe); - if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &nim9090md_dib0090_config[0]) == NULL) - return -ENODEV; - i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0); -+ if (!i2c) -+ return -ENODEV; - if (dib01x0_pmu_update(i2c, data_dib190, 10) < 0) - return -ENODEV; - -diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c -index 0f6d57fbf91b..624b4d24716d 100644 ---- a/drivers/media/usb/gspca/konica.c -+++ b/drivers/media/usb/gspca/konica.c -@@ -127,6 +127,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index) - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, 2); - } - } - -diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c -index 599f755e75b8..7ebeee98dc1b 100644 ---- a/drivers/media/usb/gspca/nw80x.c -+++ b/drivers/media/usb/gspca/nw80x.c -@@ -1584,6 +1584,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - return; - } - if (len == 1) -diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c -index c95f32a0c02b..c7aafdbb5738 100644 ---- a/drivers/media/usb/gspca/ov519.c -+++ b/drivers/media/usb/gspca/ov519.c -@@ -2116,6 +2116,11 @@ static int reg_r(struct sd *sd, u16 index) - } else { - PERR("reg_r %02x failed %d\n", index, ret); - sd->gspca_dev.usb_err = ret; -+ /* -+ * Make sure the result is zeroed to avoid uninitialized -+ * values. -+ */ -+ gspca_dev->usb_buf[0] = 0; - } - - return ret; -@@ -2142,6 +2147,11 @@ static int reg_r8(struct sd *sd, - } else { - PERR("reg_r8 %02x failed %d\n", index, ret); - sd->gspca_dev.usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, 8); - } - - return ret; -diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c -index bfff1d1c70ab..466f984312dd 100644 ---- a/drivers/media/usb/gspca/ov534.c -+++ b/drivers/media/usb/gspca/ov534.c -@@ -644,6 +644,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg) - if (ret < 0) { - pr_err("read failed %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the result is zeroed to avoid uninitialized -+ * values. -+ */ -+ gspca_dev->usb_buf[0] = 0; - } - return gspca_dev->usb_buf[0]; - } -diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c -index 47085cf2d723..f2dca0606935 100644 ---- a/drivers/media/usb/gspca/ov534_9.c -+++ b/drivers/media/usb/gspca/ov534_9.c -@@ -1157,6 +1157,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg) - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ return 0; - } - return gspca_dev->usb_buf[0]; - } -diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c -index 5102cea50471..6adbb0eca71f 100644 ---- a/drivers/media/usb/gspca/se401.c -+++ b/drivers/media/usb/gspca/se401.c -@@ -115,6 +115,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent) - pr_err("read req failed req %#04x error %d\n", - req, err); - gspca_dev->usb_err = err; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE); - } - } - -diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c -index d0ee899584a9..6136eb683306 100644 ---- a/drivers/media/usb/gspca/sn9c20x.c -+++ b/drivers/media/usb/gspca/sn9c20x.c -@@ -138,6 +138,13 @@ static const struct dmi_system_id flip_dmi_table[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "0341") - } - }, -+ { -+ .ident = "MSI MS-1039", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "MS-1039"), -+ } -+ }, - { - .ident = "MSI MS-1632", - .matches = { -@@ -924,6 +931,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length) - if (unlikely(result < 0 || result != length)) { - pr_err("Read register %02x failed %d\n", reg, result); - gspca_dev->usb_err = result; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - -diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c -index 6696b2ec34e9..83e98b85ab6a 100644 ---- a/drivers/media/usb/gspca/sonixb.c -+++ b/drivers/media/usb/gspca/sonixb.c -@@ -466,6 +466,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - dev_err(gspca_dev->v4l2_dev.dev, - "Error reading register %02x: %d\n", value, res); - gspca_dev->usb_err = res; -+ /* -+ * Make sure the result is zeroed to avoid uninitialized -+ * values. -+ */ -+ gspca_dev->usb_buf[0] = 0; - } - } - -diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c -index fd1c8706d86a..67e23557a1a9 100644 ---- a/drivers/media/usb/gspca/sonixj.c -+++ b/drivers/media/usb/gspca/sonixj.c -@@ -1175,6 +1175,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - -diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c -index f38fd8949609..ee93bd443df5 100644 ---- a/drivers/media/usb/gspca/spca1528.c -+++ b/drivers/media/usb/gspca/spca1528.c -@@ -84,6 +84,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - -diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c -index e274cf19a3ea..b236e9dcd468 100644 ---- a/drivers/media/usb/gspca/sq930x.c -+++ b/drivers/media/usb/gspca/sq930x.c -@@ -438,6 +438,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r %04x failed %d\n", value, ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - -diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c -index 46c9f2229a18..cc3e1478c5a0 100644 ---- a/drivers/media/usb/gspca/sunplus.c -+++ b/drivers/media/usb/gspca/sunplus.c -@@ -268,6 +268,11 @@ static void reg_r(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - -diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c -index b4efb2fb36fa..5032b9d7d9bb 100644 ---- a/drivers/media/usb/gspca/vc032x.c -+++ b/drivers/media/usb/gspca/vc032x.c -@@ -2919,6 +2919,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev, - if (ret < 0) { - pr_err("reg_r err %d\n", ret); - gspca_dev->usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ); - } - } - static void reg_r(struct gspca_dev *gspca_dev, -diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c -index fb9fe2ef3a6f..a74ac595656f 100644 ---- a/drivers/media/usb/gspca/w996Xcf.c -+++ b/drivers/media/usb/gspca/w996Xcf.c -@@ -139,6 +139,11 @@ static int w9968cf_read_sb(struct sd *sd) - } else { - pr_err("Read SB reg [01] failed\n"); - sd->gspca_dev.usb_err = ret; -+ /* -+ * Make sure the buffer is zeroed to avoid uninitialized -+ * values. -+ */ -+ memset(sd->gspca_dev.usb_buf, 0, 2); - } - - udelay(W9968CF_I2C_BUS_DELAY); -diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c -index 08f0ca7aa012..7b5c493f02b0 100644 ---- a/drivers/media/usb/hdpvr/hdpvr-core.c -+++ b/drivers/media/usb/hdpvr/hdpvr-core.c -@@ -143,6 +143,7 @@ static int device_authorization(struct hdpvr_device *dev) - - dev->fw_ver = dev->usbc_buf[1]; - -+ dev->usbc_buf[46] = '\0'; - v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n", - dev->fw_ver, &dev->usbc_buf[2]); - -@@ -278,6 +279,7 @@ static int hdpvr_probe(struct usb_interface *interface, - #endif - size_t buffer_size; - int i; -+ int dev_num; - int retval = -ENOMEM; - - /* allocate memory for our device state and initialize it */ -@@ -386,8 +388,17 @@ static int hdpvr_probe(struct usb_interface *interface, - } - #endif - -+ dev_num = atomic_inc_return(&dev_nr); -+ if (dev_num >= HDPVR_MAX) { -+ v4l2_err(&dev->v4l2_dev, -+ "max device number reached, device register failed\n"); -+ atomic_dec(&dev_nr); -+ retval = -ENODEV; -+ goto reg_fail; -+ } -+ - retval = hdpvr_register_videodev(dev, &interface->dev, -- video_nr[atomic_inc_return(&dev_nr)]); -+ video_nr[dev_num]); - if (retval < 0) { - v4l2_err(&dev->v4l2_dev, "registering videodev failed\n"); - goto reg_fail; -diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c -index a5de46f04247..f9b5de7ace01 100644 ---- a/drivers/media/usb/ttusb-dec/ttusb_dec.c -+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c -@@ -272,7 +272,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command, - - dprintk("%s\n", __func__); - -- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); -+ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL); - if (!b) - return -ENOMEM; - -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 62d37d2ac557..1d6dfde1104d 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1452,7 +1452,9 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) - ctrl_2 |= SDHCI_CTRL_UHS_SDR104; - else if (timing == MMC_TIMING_UHS_SDR12) - ctrl_2 |= SDHCI_CTRL_UHS_SDR12; -- else if (timing == MMC_TIMING_UHS_SDR25) -+ else if (timing == MMC_TIMING_SD_HS || -+ timing == MMC_TIMING_MMC_HS || -+ timing == MMC_TIMING_UHS_SDR25) - ctrl_2 |= SDHCI_CTRL_UHS_SDR25; - else if (timing == MMC_TIMING_UHS_SDR50) - ctrl_2 |= SDHCI_CTRL_UHS_SDR50; -diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c -index fb5a3052f144..7589d891b311 100644 ---- a/drivers/mtd/chips/cfi_cmdset_0002.c -+++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -1626,29 +1626,35 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip, - continue; - } - -- if (time_after(jiffies, timeo) && !chip_ready(map, adr)){ -+ /* -+ * We check "time_after" and "!chip_good" before checking -+ * "chip_good" to avoid the failure due to scheduling. -+ */ -+ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) { - xip_enable(map, chip, adr); - printk(KERN_WARNING "MTD %s(): software timeout\n", __func__); - xip_disable(map, chip, adr); -+ ret = -EIO; - break; - } - -- if (chip_ready(map, adr)) -+ if (chip_good(map, adr, datum)) - break; - - /* Latency issues. Drop the lock, wait a while and retry */ - UDELAY(map, chip, adr, 1); - } -+ - /* Did we succeed? */ -- if (!chip_good(map, adr, datum)) { -+ if (ret) { - /* reset on all failures. */ - map_write( map, CMD(0xF0), chip->start ); - /* FIXME - should have reset delay before continuing */ - -- if (++retry_cnt <= MAX_RETRIES) -+ if (++retry_cnt <= MAX_RETRIES) { -+ ret = 0; - goto retry; -- -- ret = -EIO; -+ } - } - xip_enable(map, chip, adr); - op_done: -diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c -index 6ea963e3b89a..85ffd0561827 100644 ---- a/drivers/net/arcnet/arcnet.c -+++ b/drivers/net/arcnet/arcnet.c -@@ -1009,31 +1009,34 @@ EXPORT_SYMBOL(arcnet_interrupt); - static void arcnet_rx(struct net_device *dev, int bufnum) - { - struct arcnet_local *lp = netdev_priv(dev); -- struct archdr pkt; -+ union { -+ struct archdr pkt; -+ char buf[512]; -+ } rxdata; - struct arc_rfc1201 *soft; - int length, ofs; - -- soft = &pkt.soft.rfc1201; -+ soft = &rxdata.pkt.soft.rfc1201; - -- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE); -- if (pkt.hard.offset[0]) { -- ofs = pkt.hard.offset[0]; -+ lp->hw.copy_from_card(dev, bufnum, 0, &rxdata.pkt, ARC_HDR_SIZE); -+ if (rxdata.pkt.hard.offset[0]) { -+ ofs = rxdata.pkt.hard.offset[0]; - length = 256 - ofs; - } else { -- ofs = pkt.hard.offset[1]; -+ ofs = rxdata.pkt.hard.offset[1]; - length = 512 - ofs; - } - - /* get the full header, if possible */ -- if (sizeof(pkt.soft) <= length) { -- lp->hw.copy_from_card(dev, bufnum, ofs, soft, sizeof(pkt.soft)); -+ if (sizeof(rxdata.pkt.soft) <= length) { -+ lp->hw.copy_from_card(dev, bufnum, ofs, soft, sizeof(rxdata.pkt.soft)); - } else { -- memset(&pkt.soft, 0, sizeof(pkt.soft)); -+ memset(&rxdata.pkt.soft, 0, sizeof(rxdata.pkt.soft)); - lp->hw.copy_from_card(dev, bufnum, ofs, soft, length); - } - - arc_printk(D_DURING, dev, "Buffer #%d: received packet from %02Xh to %02Xh (%d+4 bytes)\n", -- bufnum, pkt.hard.source, pkt.hard.dest, length); -+ bufnum, rxdata.pkt.hard.source, rxdata.pkt.hard.dest, length); - - dev->stats.rx_packets++; - dev->stats.rx_bytes += length + ARC_HDR_SIZE; -@@ -1042,13 +1045,13 @@ static void arcnet_rx(struct net_device *dev, int bufnum) - if (arc_proto_map[soft->proto]->is_ip) { - if (BUGLVL(D_PROTO)) { - struct ArcProto -- *oldp = arc_proto_map[lp->default_proto[pkt.hard.source]], -+ *oldp = arc_proto_map[lp->default_proto[rxdata.pkt.hard.source]], - *newp = arc_proto_map[soft->proto]; - - if (oldp != newp) { - arc_printk(D_PROTO, dev, - "got protocol %02Xh; encap for host %02Xh is now '%c' (was '%c')\n", -- soft->proto, pkt.hard.source, -+ soft->proto, rxdata.pkt.hard.source, - newp->suffix, oldp->suffix); - } - } -@@ -1057,10 +1060,10 @@ static void arcnet_rx(struct net_device *dev, int bufnum) - lp->default_proto[0] = soft->proto; - - /* in striking contrast, the following isn't a hack. */ -- lp->default_proto[pkt.hard.source] = soft->proto; -+ lp->default_proto[rxdata.pkt.hard.source] = soft->proto; - } - /* call the protocol-specific receiver. */ -- arc_proto_map[soft->proto]->rx(dev, bufnum, &pkt, length); -+ arc_proto_map[soft->proto]->rx(dev, bufnum, &rxdata.pkt, length); - } - - static void null_rx(struct net_device *dev, int bufnum, -diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c -index c9f4b5412844..b97a070074b7 100644 ---- a/drivers/net/ethernet/marvell/skge.c -+++ b/drivers/net/ethernet/marvell/skge.c -@@ -3114,7 +3114,7 @@ static struct sk_buff *skge_rx_get(struct net_device *dev, - skb_put(skb, len); - - if (dev->features & NETIF_F_RXCSUM) { -- skb->csum = csum; -+ skb->csum = le16_to_cpu(csum); - skb->ip_summed = CHECKSUM_COMPLETE; - } - -diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c -index 057665180f13..ba14bad81a21 100644 ---- a/drivers/net/ethernet/nxp/lpc_eth.c -+++ b/drivers/net/ethernet/nxp/lpc_eth.c -@@ -1417,13 +1417,14 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) - pldat->dma_buff_base_p = dma_handle; - - netdev_dbg(ndev, "IO address space :%pR\n", res); -- netdev_dbg(ndev, "IO address size :%d\n", resource_size(res)); -+ netdev_dbg(ndev, "IO address size :%zd\n", -+ (size_t)resource_size(res)); - netdev_dbg(ndev, "IO address (mapped) :0x%p\n", - pldat->net_base); - netdev_dbg(ndev, "IRQ number :%d\n", ndev->irq); -- netdev_dbg(ndev, "DMA buffer size :%d\n", pldat->dma_buff_size); -- netdev_dbg(ndev, "DMA buffer P address :0x%08x\n", -- pldat->dma_buff_base_p); -+ netdev_dbg(ndev, "DMA buffer size :%zd\n", pldat->dma_buff_size); -+ netdev_dbg(ndev, "DMA buffer P address :%pad\n", -+ &pldat->dma_buff_base_p); - netdev_dbg(ndev, "DMA buffer V address :0x%p\n", - pldat->dma_buff_base_v); - -@@ -1470,8 +1471,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev) - if (ret) - goto err_out_unregister_netdev; - -- netdev_info(ndev, "LPC mac at 0x%08x irq %d\n", -- res->start, ndev->irq); -+ netdev_info(ndev, "LPC mac at 0x%08lx irq %d\n", -+ (unsigned long)res->start, ndev->irq); - - phydev = pldat->phy_dev; - -diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c -index 0a7b9c7f09a2..5c40655ec808 100644 ---- a/drivers/net/phy/national.c -+++ b/drivers/net/phy/national.c -@@ -110,14 +110,17 @@ static void ns_giga_speed_fallback(struct phy_device *phydev, int mode) - - static void ns_10_base_t_hdx_loopack(struct phy_device *phydev, int disable) - { -+ u16 lb_dis = BIT(1); -+ - if (disable) -- ns_exp_write(phydev, 0x1c0, ns_exp_read(phydev, 0x1c0) | 1); -+ ns_exp_write(phydev, 0x1c0, -+ ns_exp_read(phydev, 0x1c0) | lb_dis); - else - ns_exp_write(phydev, 0x1c0, -- ns_exp_read(phydev, 0x1c0) & 0xfffe); -+ ns_exp_read(phydev, 0x1c0) & ~lb_dis); - - pr_debug("10BASE-T HDX loopback %s\n", -- (ns_exp_read(phydev, 0x1c0) & 0x0001) ? "off" : "on"); -+ (ns_exp_read(phydev, 0x1c0) & lb_dis) ? "off" : "on"); - } - - static int ns_config_init(struct phy_device *phydev) -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index 1e921e5eddc7..442efbccd005 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -636,8 +636,12 @@ cdc_ncm_find_endpoints(struct usbnet *dev, struct usb_interface *intf) - u8 ep; - - for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) { -- - e = intf->cur_altsetting->endpoint + ep; -+ -+ /* ignore endpoints which cannot transfer data */ -+ if (!usb_endpoint_maxp(&e->desc)) -+ continue; -+ - switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) { - case USB_ENDPOINT_XFER_INT: - if (usb_endpoint_dir_in(&e->desc)) { -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index 2502681369cd..5a09aff4155a 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -115,6 +115,11 @@ int usbnet_get_endpoints(struct usbnet *dev, struct usb_interface *intf) - int intr = 0; - - e = alt->endpoint + ep; -+ -+ /* ignore endpoints which cannot transfer data */ -+ if (!usb_endpoint_maxp(&e->desc)) -+ continue; -+ - switch (e->desc.bmAttributes) { - case USB_ENDPOINT_XFER_INT: - if (!usb_endpoint_dir_in(&e->desc)) -@@ -347,6 +352,8 @@ void usbnet_update_max_qlen(struct usbnet *dev) - { - enum usb_device_speed speed = dev->udev->speed; - -+ if (!dev->rx_urb_size || !dev->hard_mtu) -+ goto insanity; - switch (speed) { - case USB_SPEED_HIGH: - dev->rx_qlen = MAX_QUEUE_MEMORY / dev->rx_urb_size; -@@ -362,6 +369,7 @@ void usbnet_update_max_qlen(struct usbnet *dev) - dev->tx_qlen = 5 * MAX_QUEUE_MEMORY / dev->hard_mtu; - break; - default: -+insanity: - dev->rx_qlen = dev->tx_qlen = 4; - } - } -diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c -index dff08a2896a3..d271eaf1f949 100644 ---- a/drivers/net/wireless/libertas/if_usb.c -+++ b/drivers/net/wireless/libertas/if_usb.c -@@ -49,7 +49,8 @@ static const struct lbs_fw_table fw_table[] = { - { MODEL_8388, "libertas/usb8388_v5.bin", NULL }, - { MODEL_8388, "libertas/usb8388.bin", NULL }, - { MODEL_8388, "usb8388.bin", NULL }, -- { MODEL_8682, "libertas/usb8682.bin", NULL } -+ { MODEL_8682, "libertas/usb8682.bin", NULL }, -+ { 0, NULL, NULL } - }; - - static struct usb_device_id if_usb_table[] = { -diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c -index 005ea632ba53..8524faf28acb 100644 ---- a/drivers/parisc/dino.c -+++ b/drivers/parisc/dino.c -@@ -160,6 +160,15 @@ struct dino_device - (struct dino_device *)__pdata; }) - - -+/* Check if PCI device is behind a Card-mode Dino. */ -+static int pci_dev_is_behind_card_dino(struct pci_dev *dev) -+{ -+ struct dino_device *dino_dev; -+ -+ dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge)); -+ return is_card_dino(&dino_dev->hba.dev->id); -+} -+ - /* - * Dino Configuration Space Accessor Functions - */ -@@ -442,6 +451,21 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev) - } - DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus ); - -+#ifdef CONFIG_TULIP -+static void pci_fixup_tulip(struct pci_dev *dev) -+{ -+ if (!pci_dev_is_behind_card_dino(dev)) -+ return; -+ if (!(pci_resource_flags(dev, 1) & IORESOURCE_MEM)) -+ return; -+ pr_warn("%s: HP HSC-PCI Cards with card-mode Dino not yet supported.\n", -+ pci_name(dev)); -+ /* Disable this card by zeroing the PCI resources */ -+ memset(&dev->resource[0], 0, sizeof(dev->resource[0])); -+ memset(&dev->resource[1], 0, sizeof(dev->resource[1])); -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_DEC, PCI_ANY_ID, pci_fixup_tulip); -+#endif /* CONFIG_TULIP */ - - static void __init - dino_bios_init(void) -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 8f4baa3cb992..51a0409e1b84 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -1418,6 +1418,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - struct tree_mod_elem *tm; - struct extent_buffer *eb = NULL; - struct extent_buffer *eb_root; -+ u64 eb_root_owner = 0; - struct extent_buffer *old; - struct tree_mod_root *old_root = NULL; - u64 old_generation = 0; -@@ -1451,6 +1452,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - free_extent_buffer(old); - } - } else if (old_root) { -+ eb_root_owner = btrfs_header_owner(eb_root); - btrfs_tree_read_unlock(eb_root); - free_extent_buffer(eb_root); - eb = alloc_dummy_extent_buffer(root->fs_info, logical); -@@ -1468,7 +1470,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - if (old_root) { - btrfs_set_header_bytenr(eb, eb->start); - btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV); -- btrfs_set_header_owner(eb, btrfs_header_owner(eb_root)); -+ btrfs_set_header_owner(eb, eb_root_owner); - btrfs_set_header_level(eb, old_root->level); - btrfs_set_header_generation(eb, old_generation); - } -@@ -5433,6 +5435,7 @@ int btrfs_compare_trees(struct btrfs_root *left_root, - advance_left = advance_right = 0; - - while (1) { -+ cond_resched(); - if (advance_left && !left_end_reached) { - ret = tree_advance(left_root, left_path, &left_level, - left_root_level, -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index df2bb4b61a00..4c316ca3ee78 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -7168,6 +7168,14 @@ search: - */ - if ((flags & extra) && !(block_group->flags & extra)) - goto loop; -+ -+ /* -+ * This block group has different flags than we want. -+ * It's possible that we have MIXED_GROUP flag but no -+ * block group is mixed. Just skip such block group. -+ */ -+ btrfs_release_block_group(block_group, delalloc); -+ continue; - } - - have_block_group: -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index 90e29d40aa82..734babb6626c 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -2328,9 +2328,6 @@ out: - btrfs_free_path(path); - - mutex_lock(&fs_info->qgroup_rescan_lock); -- if (!btrfs_fs_closing(fs_info)) -- fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN; -- - if (err > 0 && - fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT) { - fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT; -@@ -2346,16 +2343,30 @@ out: - trans = btrfs_start_transaction(fs_info->quota_root, 1); - if (IS_ERR(trans)) { - err = PTR_ERR(trans); -+ trans = NULL; - btrfs_err(fs_info, - "fail to start transaction for status update: %d\n", - err); -- goto done; - } -- ret = update_qgroup_status_item(trans, fs_info, fs_info->quota_root); -- if (ret < 0) { -- err = ret; -- btrfs_err(fs_info, "fail to update qgroup status: %d\n", err); -+ -+ mutex_lock(&fs_info->qgroup_rescan_lock); -+ if (!btrfs_fs_closing(fs_info)) -+ fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN; -+ if (trans) { -+ ret = update_qgroup_status_item(trans, fs_info, fs_info->quota_root); -+ if (ret < 0) { -+ err = ret; -+ btrfs_err(fs_info, "fail to update qgroup status: %d", -+ err); -+ } - } -+ fs_info->qgroup_rescan_running = false; -+ complete_all(&fs_info->qgroup_rescan_completion); -+ mutex_unlock(&fs_info->qgroup_rescan_lock); -+ -+ if (!trans) -+ return; -+ - btrfs_end_transaction(trans, fs_info->quota_root); - - if (btrfs_fs_closing(fs_info)) { -@@ -2366,12 +2377,6 @@ out: - } else { - btrfs_err(fs_info, "qgroup scan failed with %d", err); - } -- --done: -- mutex_lock(&fs_info->qgroup_rescan_lock); -- fs_info->qgroup_rescan_running = false; -- mutex_unlock(&fs_info->qgroup_rescan_lock); -- complete_all(&fs_info->qgroup_rescan_completion); - } - - /* -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 591c93de8c20..0fcf42401a5d 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1335,6 +1335,11 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, - if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE) - return; - -+ /* Check if the server granted an oplock rather than a lease */ -+ if (oplock & SMB2_OPLOCK_LEVEL_EXCLUSIVE) -+ return smb2_set_oplock_level(cinode, oplock, epoch, -+ purge_cache); -+ - if (oplock & SMB2_LEASE_READ_CACHING_HE) { - new_oplock |= CIFS_CACHE_READ_FLG; - strcat(message, "R"); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 063c5991f095..3557c5717c8d 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3705,6 +3705,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - - trace_ext4_punch_hole(inode, offset, length, 0); - -+ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); -+ if (ext4_has_inline_data(inode)) { -+ down_write(&EXT4_I(inode)->i_mmap_sem); -+ ret = ext4_convert_inline_data(inode); -+ up_write(&EXT4_I(inode)->i_mmap_sem); -+ if (ret) -+ return ret; -+ } -+ - /* - * Write out all dirty pages to avoid race conditions - * Then release them. -diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c -index 014bee5c0e75..e482cca005a6 100644 ---- a/fs/f2fs/segment.c -+++ b/fs/f2fs/segment.c -@@ -1510,11 +1510,6 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi) - seg_i = CURSEG_I(sbi, i); - segno = le32_to_cpu(ckpt->cur_data_segno[i]); - blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]); -- if (blk_off > ENTRIES_IN_SUM) { -- f2fs_bug_on(sbi, 1); -- f2fs_put_page(page, 1); -- return -EFAULT; -- } - seg_i->next_segno = segno; - reset_curseg(sbi, i, 0); - seg_i->alloc_type = ckpt->alloc_type[i]; -@@ -2267,6 +2262,41 @@ static int build_dirty_segmap(struct f2fs_sb_info *sbi) - return init_victim_secmap(sbi); - } - -+static int sanity_check_curseg(struct f2fs_sb_info *sbi) -+{ -+ int i; -+ -+ /* -+ * In LFS/SSR curseg, .next_blkoff should point to an unused blkaddr; -+ * In LFS curseg, all blkaddr after .next_blkoff should be unused. -+ */ -+ for (i = 0; i < NO_CHECK_TYPE; i++) { -+ struct curseg_info *curseg = CURSEG_I(sbi, i); -+ struct seg_entry *se = get_seg_entry(sbi, curseg->segno); -+ unsigned int blkofs = curseg->next_blkoff; -+ -+ if (f2fs_test_bit(blkofs, se->cur_valid_map)) -+ goto out; -+ -+ if (curseg->alloc_type == SSR) -+ continue; -+ -+ for (blkofs += 1; blkofs < sbi->blocks_per_seg; blkofs++) { -+ if (!f2fs_test_bit(blkofs, se->cur_valid_map)) -+ continue; -+out: -+ f2fs_msg(sbi->sb, KERN_ERR, -+ "Current segment's next free block offset is " -+ "inconsistent with bitmap, logtype:%u, " -+ "segno:%u, type:%u, next_blkoff:%u, blkofs:%u", -+ i, curseg->segno, curseg->alloc_type, -+ curseg->next_blkoff, blkofs); -+ return -EINVAL; -+ } -+ } -+ return 0; -+} -+ - /* - * Update min, max modified time for cost-benefit GC algorithm - */ -@@ -2355,6 +2385,10 @@ int build_segment_manager(struct f2fs_sb_info *sbi) - if (err) - return err; - -+ err = sanity_check_curseg(sbi); -+ if (err) -+ return err; -+ - init_min_max_mtime(sbi); - return 0; - } -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index ab93c4591f8c..e0ec8b80c873 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1706,6 +1706,7 @@ static int fuse_writepage(struct page *page, struct writeback_control *wbc) - WARN_ON(wbc->sync_mode == WB_SYNC_ALL); - - redirty_page_for_writepage(wbc, page); -+ unlock_page(page); - return 0; - } - -diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c -index 9aff8178aa8c..060482e349ef 100644 ---- a/fs/overlayfs/inode.c -+++ b/fs/overlayfs/inode.c -@@ -292,7 +292,8 @@ static bool ovl_can_list(const char *s) - return true; - - /* Never list trusted.overlay, list other trusted for superuser only */ -- return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN); -+ return !ovl_is_private_xattr(s) && -+ ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); - } - - ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) -diff --git a/include/linux/bug.h b/include/linux/bug.h -index 7f4818673c41..581a53dfbd31 100644 ---- a/include/linux/bug.h -+++ b/include/linux/bug.h -@@ -102,6 +102,11 @@ int is_valid_bugaddr(unsigned long addr); - - #else /* !CONFIG_GENERIC_BUG */ - -+static inline void *find_bug(unsigned long bugaddr) -+{ -+ return NULL; -+} -+ - static inline enum bug_trap_type report_bug(unsigned long bug_addr, - struct pt_regs *regs) - { -diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h -index 7a57c28eb5e7..1f350238445c 100644 ---- a/include/linux/quotaops.h -+++ b/include/linux/quotaops.h -@@ -21,7 +21,7 @@ static inline struct quota_info *sb_dqopt(struct super_block *sb) - /* i_mutex must being held */ - static inline bool is_quota_modification(struct inode *inode, struct iattr *ia) - { -- return (ia->ia_valid & ATTR_SIZE && ia->ia_size != inode->i_size) || -+ return (ia->ia_valid & ATTR_SIZE) || - (ia->ia_valid & ATTR_UID && !uid_eq(ia->ia_uid, inode->i_uid)) || - (ia->ia_valid & ATTR_GID && !gid_eq(ia->ia_gid, inode->i_gid)); - } -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index a53998cba804..fdde50d39a46 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -1454,7 +1454,8 @@ static int check_kprobe_address_safe(struct kprobe *p, - /* Ensure it is not in reserved area nor out of text */ - if (!kernel_text_address((unsigned long) p->addr) || - within_kprobe_blacklist((unsigned long) p->addr) || -- jump_label_text_reserved(p->addr, p->addr)) { -+ jump_label_text_reserved(p->addr, p->addr) || -+ find_bug((unsigned long)p->addr)) { - ret = -EINVAL; - goto out; - } -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index f2df5f86af28..a419696709a1 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3314,6 +3314,9 @@ __lock_set_class(struct lockdep_map *lock, const char *name, - unsigned int depth; - int i; - -+ if (unlikely(!debug_locks)) -+ return 0; -+ - depth = curr->lockdep_depth; - /* - * This function is about (re)setting the class of a held lock, -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index dd689ab22806..5a1b2a914b4e 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -3048,7 +3048,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog, - seq = dumper->cur_seq; - idx = dumper->cur_idx; - prev = 0; -- while (l > size && seq < dumper->next_seq) { -+ while (l >= size && seq < dumper->next_seq) { - struct printk_log *msg = log_from_idx(idx); - - l -= msg_print_text(msg, prev, true, NULL, 0); -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 0e70bfeded7f..d81bcc6362ff 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -8339,10 +8339,6 @@ static int cpu_cgroup_can_attach(struct cgroup_taskset *tset) - #ifdef CONFIG_RT_GROUP_SCHED - if (!sched_rt_can_attach(css_tg(css), task)) - return -EINVAL; --#else -- /* We don't support RT-tasks being in separate groups */ -- if (task->sched_class != &fair_sched_class) -- return -EINVAL; - #endif - } - return 0; -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 19d735ab44db..cd2fb8384fbe 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -7313,9 +7313,10 @@ more_balance: - out_balanced: - /* - * We reach balance although we may have faced some affinity -- * constraints. Clear the imbalance flag if it was set. -+ * constraints. Clear the imbalance flag only if other tasks got -+ * a chance to move and fix the imbalance. - */ -- if (sd_parent) { -+ if (sd_parent && !(env.flags & LBF_ALL_PINNED)) { - int *group_imbalance = &sd_parent->groups->sgc->imbalance; - - if (*group_imbalance) -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index e78480b81f8d..70aef327b6e8 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -530,7 +530,7 @@ static int alarm_timer_create(struct k_itimer *new_timer) - struct alarm_base *base; - - if (!alarmtimer_get_rtcdev()) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - if (!capable(CAP_WAKE_ALARM)) - return -EPERM; -@@ -759,7 +759,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, - struct restart_block *restart; - - if (!alarmtimer_get_rtcdev()) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - if (flags & ~TIMER_ABSTIME) - return -EINVAL; -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index 4246df3b7ae8..e23bf739492c 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -1029,6 +1029,11 @@ static int atalk_create(struct net *net, struct socket *sock, int protocol, - */ - if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) - goto out; -+ -+ rc = -EPERM; -+ if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) -+ goto out; -+ - rc = -ENOMEM; - sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto, kern); - if (!sk) -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 2772f6a13fcb..de55a3f001dc 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -859,6 +859,8 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, - break; - - case SOCK_RAW: -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - break; - default: - return -ESOCKTNOSUPPORT; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index c4e94f34d048..37fe2b158c2a 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5062,11 +5062,6 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, - return send_conn_param_neg_reply(hdev, handle, - HCI_ERROR_UNKNOWN_CONN_ID); - -- if (min < hcon->le_conn_min_interval || -- max > hcon->le_conn_max_interval) -- return send_conn_param_neg_reply(hdev, handle, -- HCI_ERROR_INVALID_LL_PARAMS); -- - if (hci_check_conn_params(min, max, latency, timeout)) - return send_conn_param_neg_reply(hdev, handle, - HCI_ERROR_INVALID_LL_PARAMS); -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 8cfba78d26f6..c25f1e4846cd 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -5266,14 +5266,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, - - memset(&rsp, 0, sizeof(rsp)); - -- if (min < hcon->le_conn_min_interval || -- max > hcon->le_conn_max_interval) { -- BT_DBG("requested connection interval exceeds current bounds."); -- err = -EINVAL; -- } else { -- err = hci_check_conn_params(min, max, latency, to_multiplier); -- } -- -+ err = hci_check_conn_params(min, max, latency, to_multiplier); - if (err) - rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); - else -diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c -index 47b397264f24..cb6c0772ea36 100644 ---- a/net/ieee802154/socket.c -+++ b/net/ieee802154/socket.c -@@ -999,6 +999,9 @@ static int ieee802154_create(struct net *net, struct socket *sock, - - switch (sock->type) { - case SOCK_RAW: -+ rc = -EPERM; -+ if (!capable(CAP_NET_RAW)) -+ goto out; - proto = &ieee802154_raw_prot; - ops = &ieee802154_raw_ops; - break; -diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index 7b271f3ded6b..72f76da88912 100644 ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -2059,6 +2059,9 @@ void ieee80211_tdls_cancel_channel_switch(struct wiphy *wiphy, - const u8 *addr); - void ieee80211_teardown_tdls_peers(struct ieee80211_sub_if_data *sdata); - void ieee80211_tdls_chsw_work(struct work_struct *wk); -+void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata, -+ const u8 *peer, u16 reason); -+const char *ieee80211_get_reason_code_string(u16 reason_code); - - extern const struct ethtool_ops ieee80211_ethtool_ops; - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index ae5387b93df3..24eec3cb922d 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -2743,7 +2743,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata, - #define case_WLAN(type) \ - case WLAN_REASON_##type: return #type - --static const char *ieee80211_get_reason_code_string(u16 reason_code) -+const char *ieee80211_get_reason_code_string(u16 reason_code) - { - switch (reason_code) { - case_WLAN(UNSPECIFIED); -@@ -2808,6 +2808,11 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata, - if (len < 24 + 2) - return; - -+ if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { -+ ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); -+ return; -+ } -+ - if (ifmgd->associated && - ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) { - const u8 *bssid = ifmgd->associated->bssid; -@@ -2857,8 +2862,14 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata, - - reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); - -- sdata_info(sdata, "disassociated from %pM (Reason: %u)\n", -- mgmt->sa, reason_code); -+ if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) { -+ ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code); -+ return; -+ } -+ -+ sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n", -+ mgmt->sa, reason_code, -+ ieee80211_get_reason_code_string(reason_code)); - - ieee80211_set_disassoc(sdata, 0, 0, false, NULL); - -diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c -index c9eeb3f12808..ce2ece424384 100644 ---- a/net/mac80211/tdls.c -+++ b/net/mac80211/tdls.c -@@ -1963,3 +1963,26 @@ void ieee80211_tdls_chsw_work(struct work_struct *wk) - } - rtnl_unlock(); - } -+ -+void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata, -+ const u8 *peer, u16 reason) -+{ -+ struct ieee80211_sta *sta; -+ -+ rcu_read_lock(); -+ sta = ieee80211_find_sta(&sdata->vif, peer); -+ if (!sta || !sta->tdls) { -+ rcu_read_unlock(); -+ return; -+ } -+ rcu_read_unlock(); -+ -+ tdls_dbg(sdata, "disconnected from TDLS peer %pM (Reason: %u=%s)\n", -+ peer, reason, -+ ieee80211_get_reason_code_string(reason)); -+ -+ ieee80211_tdls_oper_request(&sdata->vif, peer, -+ NL80211_TDLS_TEARDOWN, -+ WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE, -+ GFP_ATOMIC); -+} -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index 9c222a106c7f..2dfd1c815203 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -1005,10 +1005,13 @@ static int llcp_sock_create(struct net *net, struct socket *sock, - sock->type != SOCK_RAW) - return -ESOCKTNOSUPPORT; - -- if (sock->type == SOCK_RAW) -+ if (sock->type == SOCK_RAW) { -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - sock->ops = &llcp_rawsock_ops; -- else -+ } else { - sock->ops = &llcp_sock_ops; -+ } - - sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern); - if (sk == NULL) -diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c -index deadfdab1bc3..caa23ee913f0 100644 ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -2152,7 +2152,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = { - [OVS_VPORT_ATTR_STATS] = { .len = sizeof(struct ovs_vport_stats) }, - [OVS_VPORT_ATTR_PORT_NO] = { .type = NLA_U32 }, - [OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 }, -- [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_U32 }, -+ [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_UNSPEC }, - [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED }, - }; - -diff --git a/net/rds/tcp.c b/net/rds/tcp.c -index 554d4b461983..c10622a9321c 100644 ---- a/net/rds/tcp.c -+++ b/net/rds/tcp.c -@@ -352,9 +352,11 @@ static void rds_tcp_kill_sock(struct net *net) - } - spin_unlock_irq(&rds_tcp_conn_lock); - list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) { -- sk = tc->t_sock->sk; -- sk->sk_prot->disconnect(sk, 0); -- tcp_done(sk); -+ if (tc->t_sock) { -+ sk = tc->t_sock->sk; -+ sk->sk_prot->disconnect(sk, 0); -+ tcp_done(sk); -+ } - if (tc->conn->c_passive) - rds_conn_destroy(tc->conn->c_passive); - rds_conn_destroy(tc->conn); -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 7acf1f2b8dfc..2a431628af59 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -713,7 +713,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr) - int i; - size_t s; - -- if (n > NETEM_DIST_MAX) -+ if (!n || n > NETEM_DIST_MAX) - return -EINVAL; - - s = sizeof(struct disttable) + n * sizeof(s16); -diff --git a/net/wireless/util.c b/net/wireless/util.c -index 1d239564baa3..405388772fc4 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -974,6 +974,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, - } - - cfg80211_process_rdev_events(rdev); -+ cfg80211_mlme_purge_registrations(dev->ieee80211_ptr); - } - - err = rdev_change_virtual_intf(rdev, dev, ntype, flags, params); -diff --git a/sound/firewire/tascam/tascam-pcm.c b/sound/firewire/tascam/tascam-pcm.c -index 380d3db969a5..64edb44d74f6 100644 ---- a/sound/firewire/tascam/tascam-pcm.c -+++ b/sound/firewire/tascam/tascam-pcm.c -@@ -81,6 +81,9 @@ static int pcm_open(struct snd_pcm_substream *substream) - goto err_locked; - - err = snd_tscm_stream_get_clock(tscm, &clock); -+ if (err < 0) -+ goto err_locked; -+ - if (clock != SND_TSCM_CLOCK_INTERNAL || - amdtp_stream_pcm_running(&tscm->rx_stream) || - amdtp_stream_pcm_running(&tscm->tx_stream)) { -diff --git a/sound/firewire/tascam/tascam-stream.c b/sound/firewire/tascam/tascam-stream.c -index e4c306398b35..d8a9e313eae6 100644 ---- a/sound/firewire/tascam/tascam-stream.c -+++ b/sound/firewire/tascam/tascam-stream.c -@@ -9,20 +9,37 @@ - #include - #include "tascam.h" - -+#define CLOCK_STATUS_MASK 0xffff0000 -+#define CLOCK_CONFIG_MASK 0x0000ffff -+ - #define CALLBACK_TIMEOUT 500 - - static int get_clock(struct snd_tscm *tscm, u32 *data) - { -+ int trial = 0; - __be32 reg; - int err; - -- err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST, -- TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS, -- ®, sizeof(reg), 0); -- if (err >= 0) -+ while (trial++ < 5) { -+ err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST, -+ TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS, -+ ®, sizeof(reg), 0); -+ if (err < 0) -+ return err; -+ - *data = be32_to_cpu(reg); -+ if (*data & CLOCK_STATUS_MASK) -+ break; - -- return err; -+ // In intermediate state after changing clock status. -+ msleep(50); -+ } -+ -+ // Still in the intermediate state. -+ if (trial >= 5) -+ return -EAGAIN; -+ -+ return 0; - } - - static int set_clock(struct snd_tscm *tscm, unsigned int rate, -@@ -35,7 +52,7 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate, - err = get_clock(tscm, &data); - if (err < 0) - return err; -- data &= 0x0000ffff; -+ data &= CLOCK_CONFIG_MASK; - - if (rate > 0) { - data &= 0x000000ff; -@@ -80,17 +97,14 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate, - - int snd_tscm_stream_get_rate(struct snd_tscm *tscm, unsigned int *rate) - { -- u32 data = 0x0; -- unsigned int trials = 0; -+ u32 data; - int err; - -- while (data == 0x0 || trials++ < 5) { -- err = get_clock(tscm, &data); -- if (err < 0) -- return err; -+ err = get_clock(tscm, &data); -+ if (err < 0) -+ return err; - -- data = (data & 0xff000000) >> 24; -- } -+ data = (data & 0xff000000) >> 24; - - /* Check base rate. */ - if ((data & 0x0f) == 0x01) -diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c -index 4727f5b80e76..acc2c7dbfb15 100644 ---- a/sound/hda/hdac_controller.c -+++ b/sound/hda/hdac_controller.c -@@ -340,6 +340,8 @@ static void azx_int_disable(struct hdac_bus *bus) - list_for_each_entry(azx_dev, &bus->stream_list, list) - snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); - -+ synchronize_irq(bus->irq); -+ - /* disable SIE for all streams */ - snd_hdac_chip_writeb(bus, INTCTL, 0); - -diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c -index bf377dc192aa..d33e02c31712 100644 ---- a/sound/i2c/other/ak4xxx-adda.c -+++ b/sound/i2c/other/ak4xxx-adda.c -@@ -789,11 +789,12 @@ static int build_adc_controls(struct snd_akm4xxx *ak) - return err; - - memset(&knew, 0, sizeof(knew)); -- knew.name = ak->adc_info[mixer_ch].selector_name; -- if (!knew.name) { -+ if (!ak->adc_info || -+ !ak->adc_info[mixer_ch].selector_name) { - knew.name = "Capture Channel"; - knew.index = mixer_ch + ak->idx_offset * 2; -- } -+ } else -+ knew.name = ak->adc_info[mixer_ch].selector_name; - - knew.iface = SNDRV_CTL_ELEM_IFACE_MIXER; - knew.info = ak4xxx_capture_source_info; -diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c -index 273364c39171..9cdf86f04e03 100644 ---- a/sound/pci/hda/hda_controller.c -+++ b/sound/pci/hda/hda_controller.c -@@ -667,10 +667,13 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, - */ - if (hbus->allow_bus_reset && !hbus->response_reset && !hbus->in_reset) { - hbus->response_reset = 1; -+ dev_err(chip->card->dev, -+ "No response from codec, resetting bus: last cmd=0x%08x\n", -+ bus->last_cmd[addr]); - return -EAGAIN; /* give a chance to retry */ - } - -- dev_err(chip->card->dev, -+ dev_WARN(chip->card->dev, - "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", - bus->last_cmd[addr]); - chip->single_cmd = 1; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index ef8955abd918..96ccab15da83 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1274,9 +1274,9 @@ static int azx_free(struct azx *chip) - } - - if (bus->chip_init) { -+ azx_stop_chip(chip); - azx_clear_irq_pending(chip); - azx_stop_all_streams(chip); -- azx_stop_chip(chip); - } - - if (bus->irq >= 0) -diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c -index e0fb8c6d1bc2..7d65c6df9aa8 100644 ---- a/sound/pci/hda/patch_analog.c -+++ b/sound/pci/hda/patch_analog.c -@@ -370,6 +370,7 @@ static const struct hda_fixup ad1986a_fixups[] = { - - static const struct snd_pci_quirk ad1986a_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC), -+ SND_PCI_QUIRK(0x1043, 0x1153, "ASUS M9V", AD1986A_FIXUP_LAPTOP_IMIC), - SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD), - SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD), - SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d5ca16048ce0..55bae9e6de27 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -977,6 +977,9 @@ static const struct snd_pci_quirk beep_white_list[] = { - SND_PCI_QUIRK(0x1043, 0x834a, "EeePC", 1), - SND_PCI_QUIRK(0x1458, 0xa002, "GA-MA790X", 1), - SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1), -+ /* blacklist -- no beep available */ -+ SND_PCI_QUIRK(0x17aa, 0x309e, "Lenovo ThinkCentre M73", 0), -+ SND_PCI_QUIRK(0x17aa, 0x30a3, "Lenovo ThinkCentre M93", 0), - {} - }; - -diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c -index 08b40460663c..549f853c4092 100644 ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -1166,12 +1166,17 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) - SGTL5000_INT_OSC_EN); - /* Enable VDDC charge pump */ - ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP; -- } else if (vddio >= 3100 && vdda >= 3100) { -+ } else { - ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP; -- /* VDDC use VDDIO rail */ -- lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; -- lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << -- SGTL5000_VDDC_MAN_ASSN_SHIFT; -+ /* -+ * if vddio == vdda the source of charge pump should be -+ * assigned manually to VDDIO -+ */ -+ if (vddio == vdda) { -+ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD; -+ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO << -+ SGTL5000_VDDC_MAN_ASSN_SHIFT; -+ } - } - - snd_soc_write(codec, SGTL5000_CHIP_LINREG_CTRL, lreg_ctrl); -diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c -index 7ca67613e0d4..d46e9ad600b4 100644 ---- a/sound/soc/fsl/fsl_ssi.c -+++ b/sound/soc/fsl/fsl_ssi.c -@@ -1374,6 +1374,7 @@ static int fsl_ssi_probe(struct platform_device *pdev) - struct fsl_ssi_private *ssi_private; - int ret = 0; - struct device_node *np = pdev->dev.of_node; -+ struct device_node *root; - const struct of_device_id *of_id; - const char *p, *sprop; - const uint32_t *iprop; -@@ -1510,7 +1511,9 @@ static int fsl_ssi_probe(struct platform_device *pdev) - * device tree. We also pass the address of the CPU DAI driver - * structure. - */ -- sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL); -+ root = of_find_node_by_path("/"); -+ sprop = of_get_property(root, "compatible", NULL); -+ of_node_put(root); - /* Sometimes the compatible name has a "fsl," prefix, so we strip it. */ - p = strrchr(sprop, ','); - if (p) -diff --git a/sound/soc/intel/common/sst-ipc.c b/sound/soc/intel/common/sst-ipc.c -index a12c7bb08d3b..b96bf44be2d5 100644 ---- a/sound/soc/intel/common/sst-ipc.c -+++ b/sound/soc/intel/common/sst-ipc.c -@@ -211,6 +211,8 @@ struct ipc_message *sst_ipc_reply_find_msg(struct sst_generic_ipc *ipc, - - if (ipc->ops.reply_msg_match != NULL) - header = ipc->ops.reply_msg_match(header, &mask); -+ else -+ mask = (u64)-1; - - if (list_empty(&ipc->rx_list)) { - dev_err(ipc->dev, "error: rx list empty but received 0x%llx\n", -diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c -index 6fd1906af387..fe65754c2e50 100644 ---- a/sound/soc/soc-generic-dmaengine-pcm.c -+++ b/sound/soc/soc-generic-dmaengine-pcm.c -@@ -301,6 +301,12 @@ static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd) - - if (!dmaengine_pcm_can_report_residue(dev, pcm->chan[i])) - pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE; -+ -+ if (rtd->pcm->streams[i].pcm->name[0] == '\0') { -+ strncpy(rtd->pcm->streams[i].pcm->name, -+ rtd->pcm->streams[i].pcm->id, -+ sizeof(rtd->pcm->streams[i].pcm->name)); -+ } - } - - return 0; -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index 1ea1384bc236..f84c55ecd0fb 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -460,6 +460,7 @@ static int set_sync_endpoint(struct snd_usb_substream *subs, - } - ep = get_endpoint(alts, 1)->bEndpointAddress; - if (get_endpoint(alts, 0)->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE && -+ get_endpoint(alts, 0)->bSynchAddress != 0 && - ((is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress | USB_DIR_IN)) || - (!is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress & ~USB_DIR_IN)))) { - dev_err(&dev->dev, -diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile -index 7851df1490e0..cc3315da6dc3 100644 ---- a/tools/lib/traceevent/Makefile -+++ b/tools/lib/traceevent/Makefile -@@ -54,15 +54,15 @@ set_plugin_dir := 1 - - # Set plugin_dir to preffered global plugin location - # If we install under $HOME directory we go under --# $(HOME)/.traceevent/plugins -+# $(HOME)/.local/lib/traceevent/plugins - # - # We dont set PLUGIN_DIR in case we install under $HOME - # directory, because by default the code looks under: --# $(HOME)/.traceevent/plugins by default. -+# $(HOME)/.local/lib/traceevent/plugins by default. - # - ifeq ($(plugin_dir),) - ifeq ($(prefix),$(HOME)) --override plugin_dir = $(HOME)/.traceevent/plugins -+override plugin_dir = $(HOME)/.local/lib/traceevent/plugins - set_plugin_dir := 0 - else - override plugin_dir = $(libdir)/traceevent/plugins -diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c -index a16756ae3526..5fe7889606a2 100644 ---- a/tools/lib/traceevent/event-plugin.c -+++ b/tools/lib/traceevent/event-plugin.c -@@ -30,7 +30,7 @@ - #include "event-parse.h" - #include "event-utils.h" - --#define LOCAL_PLUGIN_DIR ".traceevent/plugins" -+#define LOCAL_PLUGIN_DIR ".local/lib/traceevent/plugins/" - - static struct registered_plugin_options { - struct registered_plugin_options *next; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.195-196.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.195-196.patch deleted file mode 100644 index c878cdeef0ae..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.195-196.patch +++ /dev/null @@ -1,1010 +0,0 @@ -diff --git a/Makefile b/Makefile -index 721fa569a680..9eaf50527883 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 195 -+SUBLEVEL = 196 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index 0d20cd594017..702a5542b11a 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -211,7 +211,7 @@ static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma) - { - unsigned int mask = VM_READ | VM_WRITE | VM_EXEC; - -- if (fsr & FSR_WRITE) -+ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM)) - mask = VM_WRITE; - if (fsr & FSR_LNX_PF) - mask = VM_EXEC; -@@ -281,7 +281,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs) - - if (user_mode(regs)) - flags |= FAULT_FLAG_USER; -- if (fsr & FSR_WRITE) -+ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM)) - flags |= FAULT_FLAG_WRITE; - - /* -diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h -index 78830657cab3..b014e5724804 100644 ---- a/arch/arm/mm/fault.h -+++ b/arch/arm/mm/fault.h -@@ -5,6 +5,7 @@ - * Fault status register encodings. We steal bit 31 for our own purposes. - */ - #define FSR_LNX_PF (1 << 31) -+#define FSR_CM (1 << 13) - #define FSR_WRITE (1 << 11) - #define FSR_FS4 (1 << 10) - #define FSR_FS3_0 (15) -diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h -index f4c7467f7465..b73ab8a7ebc3 100644 ---- a/arch/powerpc/include/asm/futex.h -+++ b/arch/powerpc/include/asm/futex.h -@@ -60,8 +60,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, - - pagefault_enable(); - -- if (!ret) -- *oval = oldval; -+ *oval = oldval; - - return ret; - } -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index a44f1755dc4b..536718ed033f 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -1465,6 +1465,10 @@ machine_check_handle_early: - RFI_TO_USER_OR_KERNEL - 9: - /* Deliver the machine check to host kernel in V mode. */ -+BEGIN_FTR_SECTION -+ ld r10,ORIG_GPR3(r1) -+ mtspr SPRN_CFAR,r10 -+END_FTR_SECTION_IFSET(CPU_FTR_CFAR) - MACHINE_CHECK_HANDLER_WINDUP - b machine_check_pSeries - -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index 5a753fae8265..0c42e872d548 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -857,15 +857,17 @@ static int rtas_cpu_state_change_mask(enum rtas_cpu_state state, - return 0; - - for_each_cpu(cpu, cpus) { -+ struct device *dev = get_cpu_device(cpu); -+ - switch (state) { - case DOWN: -- cpuret = cpu_down(cpu); -+ cpuret = device_offline(dev); - break; - case UP: -- cpuret = cpu_up(cpu); -+ cpuret = device_online(dev); - break; - } -- if (cpuret) { -+ if (cpuret < 0) { - pr_debug("%s: cpu_%s for cpu#%d returned %d.\n", - __func__, - ((state == UP) ? "up" : "down"), -@@ -954,6 +956,8 @@ int rtas_ibm_suspend_me(u64 handle) - data.token = rtas_token("ibm,suspend-me"); - data.complete = &done; - -+ lock_device_hotplug(); -+ - /* All present CPUs must be online */ - cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask); - cpuret = rtas_online_cpus_mask(offline_mask); -@@ -985,6 +989,7 @@ int rtas_ibm_suspend_me(u64 handle) - __func__); - - out: -+ unlock_device_hotplug(); - free_cpumask_var(offline_mask); - return atomic_read(&data.error); - } -diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c -index c773396d0969..8d30a425a88a 100644 ---- a/arch/powerpc/platforms/pseries/mobility.c -+++ b/arch/powerpc/platforms/pseries/mobility.c -@@ -11,6 +11,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -206,7 +207,11 @@ static int update_dt_node(__be32 phandle, s32 scope) - - prop_data += vd; - } -+ -+ cond_resched(); - } -+ -+ cond_resched(); - } while (rtas_rc == 1); - - of_node_put(dn); -@@ -282,8 +287,12 @@ int pseries_devicetree_update(s32 scope) - add_dt_node(phandle, drc_index); - break; - } -+ -+ cond_resched(); - } - } -+ -+ cond_resched(); - } while (rc == 1); - - kfree(rtas_buf); -diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c -index 9cc976ff7fec..88fcf6a95fa6 100644 ---- a/arch/powerpc/platforms/pseries/setup.c -+++ b/arch/powerpc/platforms/pseries/setup.c -@@ -369,6 +369,9 @@ static void pseries_lpar_idle(void) - * low power mode by cedeing processor to hypervisor - */ - -+ if (!prep_irq_for_idle()) -+ return; -+ - /* Indicate to hypervisor that we are idle. */ - get_lppaca()->idle = 1; - -diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c -index c670279b33f0..1de3fdfc3537 100644 ---- a/arch/s390/hypfs/inode.c -+++ b/arch/s390/hypfs/inode.c -@@ -267,7 +267,7 @@ static int hypfs_show_options(struct seq_file *s, struct dentry *root) - static int hypfs_fill_super(struct super_block *sb, void *data, int silent) - { - struct inode *root_inode; -- struct dentry *root_dentry; -+ struct dentry *root_dentry, *update_file; - int rc = 0; - struct hypfs_sb_info *sbi; - -@@ -298,9 +298,10 @@ static int hypfs_fill_super(struct super_block *sb, void *data, int silent) - rc = hypfs_diag_create_files(root_dentry); - if (rc) - return rc; -- sbi->update_file = hypfs_create_update_file(root_dentry); -- if (IS_ERR(sbi->update_file)) -- return PTR_ERR(sbi->update_file); -+ update_file = hypfs_create_update_file(root_dentry); -+ if (IS_ERR(update_file)) -+ return PTR_ERR(update_file); -+ sbi->update_file = update_file; - hypfs_update_update(sb); - pr_info("Hypervisor filesystem mounted\n"); - return 0; -diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c -index 2f9abe0d04dc..2f8ff63bbbe4 100644 ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -281,6 +281,9 @@ struct smi_info { - */ - bool irq_enable_broken; - -+ /* Is the driver in maintenance mode? */ -+ bool in_maintenance_mode; -+ - /* - * Did we get an attention that we did not handle? - */ -@@ -1091,11 +1094,20 @@ static int ipmi_thread(void *data) - spin_unlock_irqrestore(&(smi_info->si_lock), flags); - busy_wait = ipmi_thread_busy_wait(smi_result, smi_info, - &busy_until); -- if (smi_result == SI_SM_CALL_WITHOUT_DELAY) -+ if (smi_result == SI_SM_CALL_WITHOUT_DELAY) { - ; /* do nothing */ -- else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) -- schedule(); -- else if (smi_result == SI_SM_IDLE) { -+ } else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) { -+ /* -+ * In maintenance mode we run as fast as -+ * possible to allow firmware updates to -+ * complete as fast as possible, but normally -+ * don't bang on the scheduler. -+ */ -+ if (smi_info->in_maintenance_mode) -+ schedule(); -+ else -+ usleep_range(100, 200); -+ } else if (smi_result == SI_SM_IDLE) { - if (atomic_read(&smi_info->need_watch)) { - schedule_timeout_interruptible(100); - } else { -@@ -1103,8 +1115,9 @@ static int ipmi_thread(void *data) - __set_current_state(TASK_INTERRUPTIBLE); - schedule(); - } -- } else -+ } else { - schedule_timeout_interruptible(1); -+ } - } - return 0; - } -@@ -1283,6 +1296,7 @@ static void set_maintenance_mode(void *send_info, bool enable) - - if (!enable) - atomic_set(&smi_info->req_events, 0); -+ smi_info->in_maintenance_mode = enable; - } - - static const struct ipmi_smi_handlers handlers = { -diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c -index a5070f9cb0d4..7244a621c61b 100644 ---- a/drivers/clk/clk-qoriq.c -+++ b/drivers/clk/clk-qoriq.c -@@ -540,7 +540,7 @@ static const struct clockgen_chipinfo chipinfo[] = { - .guts_compat = "fsl,qoriq-device-config-1.0", - .init_periph = p5020_init_periph, - .cmux_groups = { -- &p2041_cmux_grp1, &p2041_cmux_grp2 -+ &p5020_cmux_grp1, &p5020_cmux_grp2 - }, - .cmux_to_group = { - 0, 1, -1 -diff --git a/drivers/clk/sirf/clk-common.c b/drivers/clk/sirf/clk-common.c -index 77e1e2491689..edb7197cc4b4 100644 ---- a/drivers/clk/sirf/clk-common.c -+++ b/drivers/clk/sirf/clk-common.c -@@ -298,9 +298,10 @@ static u8 dmn_clk_get_parent(struct clk_hw *hw) - { - struct clk_dmn *clk = to_dmnclk(hw); - u32 cfg = clkc_readl(clk->regofs); -+ const char *name = clk_hw_get_name(hw); - - /* parent of io domain can only be pll3 */ -- if (strcmp(hw->init->name, "io") == 0) -+ if (strcmp(name, "io") == 0) - return 4; - - WARN_ON((cfg & (BIT(3) - 1)) > 4); -@@ -312,9 +313,10 @@ static int dmn_clk_set_parent(struct clk_hw *hw, u8 parent) - { - struct clk_dmn *clk = to_dmnclk(hw); - u32 cfg = clkc_readl(clk->regofs); -+ const char *name = clk_hw_get_name(hw); - - /* parent of io domain can only be pll3 */ -- if (strcmp(hw->init->name, "io") == 0) -+ if (strcmp(name, "io") == 0) - return -EINVAL; - - cfg &= ~(BIT(3) - 1); -@@ -354,7 +356,8 @@ static long dmn_clk_round_rate(struct clk_hw *hw, unsigned long rate, - { - unsigned long fin; - unsigned ratio, wait, hold; -- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4; -+ const char *name = clk_hw_get_name(hw); -+ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4; - - fin = *parent_rate; - ratio = fin / rate; -@@ -376,7 +379,8 @@ static int dmn_clk_set_rate(struct clk_hw *hw, unsigned long rate, - struct clk_dmn *clk = to_dmnclk(hw); - unsigned long fin; - unsigned ratio, wait, hold, reg; -- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4; -+ const char *name = clk_hw_get_name(hw); -+ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4; - - fin = parent_rate; - ratio = fin / rate; -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index c6bf378534f8..bebcef2ce6b8 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -758,7 +758,7 @@ static int radeon_connector_set_property(struct drm_connector *connector, struct - - radeon_encoder->output_csc = val; - -- if (connector->encoder->crtc) { -+ if (connector->encoder && connector->encoder->crtc) { - struct drm_crtc *crtc = connector->encoder->crtc; - const struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private; - struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); -diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index 884d82f9190e..8af87dc05f2a 100644 ---- a/drivers/hid/hid-apple.c -+++ b/drivers/hid/hid-apple.c -@@ -55,7 +55,6 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") - struct apple_sc { - unsigned long quirks; - unsigned int fn_on; -- DECLARE_BITMAP(pressed_fn, KEY_CNT); - DECLARE_BITMAP(pressed_numlock, KEY_CNT); - }; - -@@ -182,6 +181,8 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, - { - struct apple_sc *asc = hid_get_drvdata(hid); - const struct apple_key_translation *trans, *table; -+ bool do_translate; -+ u16 code = 0; - - if (usage->code == KEY_FN) { - asc->fn_on = !!value; -@@ -190,8 +191,6 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, - } - - if (fnmode) { -- int do_translate; -- - if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI && - hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) - table = macbookair_fn_keys; -@@ -203,25 +202,33 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, - trans = apple_find_translation (table, usage->code); - - if (trans) { -- if (test_bit(usage->code, asc->pressed_fn)) -- do_translate = 1; -- else if (trans->flags & APPLE_FLAG_FKEY) -- do_translate = (fnmode == 2 && asc->fn_on) || -- (fnmode == 1 && !asc->fn_on); -- else -- do_translate = asc->fn_on; -- -- if (do_translate) { -- if (value) -- set_bit(usage->code, asc->pressed_fn); -- else -- clear_bit(usage->code, asc->pressed_fn); -- -- input_event(input, usage->type, trans->to, -- value); -- -- return 1; -+ if (test_bit(trans->from, input->key)) -+ code = trans->from; -+ else if (test_bit(trans->to, input->key)) -+ code = trans->to; -+ -+ if (!code) { -+ if (trans->flags & APPLE_FLAG_FKEY) { -+ switch (fnmode) { -+ case 1: -+ do_translate = !asc->fn_on; -+ break; -+ case 2: -+ do_translate = asc->fn_on; -+ break; -+ default: -+ /* should never happen */ -+ do_translate = false; -+ } -+ } else { -+ do_translate = asc->fn_on; -+ } -+ -+ code = do_translate ? trans->to : trans->from; - } -+ -+ input_event(input, usage->type, code, value); -+ return 1; - } - - if (asc->quirks & APPLE_NUMLOCK_EMULATION && -diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c -index 5bfdfccbb9a1..032c95157497 100644 ---- a/drivers/mfd/intel-lpss-pci.c -+++ b/drivers/mfd/intel-lpss-pci.c -@@ -38,6 +38,8 @@ static int intel_lpss_pci_probe(struct pci_dev *pdev, - info->mem = &pdev->resource[0]; - info->irq = pdev->irq; - -+ pdev->d3cold_delay = 0; -+ - /* Probably it is enough to set this for iDMA capable devices only */ - pci_set_master(pdev); - -diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index 355c5fb802cd..c653b97d84d5 100644 ---- a/drivers/net/ethernet/qlogic/qla3xxx.c -+++ b/drivers/net/ethernet/qlogic/qla3xxx.c -@@ -2783,6 +2783,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) - netdev_err(qdev->ndev, - "PCI mapping failed with error: %d\n", - err); -+ dev_kfree_skb_irq(skb); - ql_free_large_buffers(qdev); - return -ENOMEM; - } -diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c -index 79cede19e0c4..cbbff16d438f 100644 ---- a/drivers/net/usb/hso.c -+++ b/drivers/net/usb/hso.c -@@ -2650,14 +2650,18 @@ static struct hso_device *hso_create_bulk_serial_device( - */ - if (serial->tiocmget) { - tiocmget = serial->tiocmget; -+ tiocmget->endp = hso_get_ep(interface, -+ USB_ENDPOINT_XFER_INT, -+ USB_DIR_IN); -+ if (!tiocmget->endp) { -+ dev_err(&interface->dev, "Failed to find INT IN ep\n"); -+ goto exit; -+ } -+ - tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL); - if (tiocmget->urb) { - mutex_init(&tiocmget->mutex); - init_waitqueue_head(&tiocmget->waitq); -- tiocmget->endp = hso_get_ep( -- interface, -- USB_ENDPOINT_XFER_INT, -- USB_DIR_IN); - } else - hso_free_tiomget(serial); - } -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 574c93a24180..89eec6fead75 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -874,9 +874,9 @@ static int xennet_set_skb_gso(struct sk_buff *skb, - return 0; - } - --static RING_IDX xennet_fill_frags(struct netfront_queue *queue, -- struct sk_buff *skb, -- struct sk_buff_head *list) -+static int xennet_fill_frags(struct netfront_queue *queue, -+ struct sk_buff *skb, -+ struct sk_buff_head *list) - { - RING_IDX cons = queue->rx.rsp_cons; - struct sk_buff *nskb; -@@ -895,7 +895,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, - if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { - queue->rx.rsp_cons = ++cons + skb_queue_len(list); - kfree_skb(nskb); -- return ~0U; -+ return -ENOENT; - } - - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, -@@ -906,7 +906,9 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, - kfree_skb(nskb); - } - -- return cons; -+ queue->rx.rsp_cons = cons; -+ -+ return 0; - } - - static int checksum_setup(struct net_device *dev, struct sk_buff *skb) -@@ -1032,8 +1034,7 @@ err: - skb->data_len = rx->status; - skb->len += rx->status; - -- i = xennet_fill_frags(queue, skb, &tmpq); -- if (unlikely(i == ~0U)) -+ if (unlikely(xennet_fill_frags(queue, skb, &tmpq))) - goto err; - - if (rx->flags & XEN_NETRXF_csum_blank) -@@ -1043,7 +1044,7 @@ err: - - __skb_queue_tail(&rxq, skb); - -- queue->rx.rsp_cons = ++i; -+ i = ++queue->rx.rsp_cons; - work_done++; - } - -diff --git a/drivers/pinctrl/pinctrl-tegra.c b/drivers/pinctrl/pinctrl-tegra.c -index 0fd7fd2b0f72..a30e967d75c2 100644 ---- a/drivers/pinctrl/pinctrl-tegra.c -+++ b/drivers/pinctrl/pinctrl-tegra.c -@@ -52,7 +52,9 @@ static inline u32 pmx_readl(struct tegra_pmx *pmx, u32 bank, u32 reg) - - static inline void pmx_writel(struct tegra_pmx *pmx, u32 val, u32 bank, u32 reg) - { -- writel(val, pmx->regs[bank] + reg); -+ writel_relaxed(val, pmx->regs[bank] + reg); -+ /* make sure pinmux register write completed */ -+ pmx_readl(pmx, bank, reg); - } - - static int tegra_pinctrl_get_groups_count(struct pinctrl_dev *pctldev) -diff --git a/drivers/scsi/scsi_logging.c b/drivers/scsi/scsi_logging.c -index bd70339c1242..03d9855a6afd 100644 ---- a/drivers/scsi/scsi_logging.c -+++ b/drivers/scsi/scsi_logging.c -@@ -16,57 +16,15 @@ - #include - #include - --#define SCSI_LOG_SPOOLSIZE 4096 -- --#if (SCSI_LOG_SPOOLSIZE / SCSI_LOG_BUFSIZE) > BITS_PER_LONG --#warning SCSI logging bitmask too large --#endif -- --struct scsi_log_buf { -- char buffer[SCSI_LOG_SPOOLSIZE]; -- unsigned long map; --}; -- --static DEFINE_PER_CPU(struct scsi_log_buf, scsi_format_log); -- - static char *scsi_log_reserve_buffer(size_t *len) - { -- struct scsi_log_buf *buf; -- unsigned long map_bits = sizeof(buf->buffer) / SCSI_LOG_BUFSIZE; -- unsigned long idx = 0; -- -- preempt_disable(); -- buf = this_cpu_ptr(&scsi_format_log); -- idx = find_first_zero_bit(&buf->map, map_bits); -- if (likely(idx < map_bits)) { -- while (test_and_set_bit(idx, &buf->map)) { -- idx = find_next_zero_bit(&buf->map, map_bits, idx); -- if (idx >= map_bits) -- break; -- } -- } -- if (WARN_ON(idx >= map_bits)) { -- preempt_enable(); -- return NULL; -- } -- *len = SCSI_LOG_BUFSIZE; -- return buf->buffer + idx * SCSI_LOG_BUFSIZE; -+ *len = 128; -+ return kmalloc(*len, GFP_ATOMIC); - } - - static void scsi_log_release_buffer(char *bufptr) - { -- struct scsi_log_buf *buf; -- unsigned long idx; -- int ret; -- -- buf = this_cpu_ptr(&scsi_format_log); -- if (bufptr >= buf->buffer && -- bufptr < buf->buffer + SCSI_LOG_SPOOLSIZE) { -- idx = (bufptr - buf->buffer) / SCSI_LOG_BUFSIZE; -- ret = test_and_clear_bit(idx, &buf->map); -- WARN_ON(!ret); -- } -- preempt_enable(); -+ kfree(bufptr); - } - - static inline const char *scmd_name(const struct scsi_cmnd *scmd) -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 47b229fa5e8e..4b62eb3b5923 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -221,11 +221,20 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev) - pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE); - - /* -- * Try to reset the device. The success of this is dependent on -- * being able to lock the device, which is not always possible. -+ * Try to get the locks ourselves to prevent a deadlock. The -+ * success of this is dependent on being able to lock the device, -+ * which is not always possible. -+ * We can not use the "try" reset interface here, which will -+ * overwrite the previously restored configuration information. - */ -- if (vdev->reset_works && !pci_try_reset_function(pdev)) -- vdev->needs_reset = false; -+ if (vdev->reset_works && pci_cfg_access_trylock(pdev)) { -+ if (device_trylock(&pdev->dev)) { -+ if (!__pci_reset_function_locked(pdev)) -+ vdev->needs_reset = false; -+ device_unlock(&pdev->dev); -+ } -+ pci_cfg_access_unlock(pdev); -+ } - - pci_restore_state(pdev); - out: -diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c -index fa3480815cdb..88e0763edcc7 100644 ---- a/drivers/video/fbdev/ssd1307fb.c -+++ b/drivers/video/fbdev/ssd1307fb.c -@@ -421,7 +421,7 @@ static int ssd1307fb_init(struct ssd1307fb_par *par) - if (ret < 0) - return ret; - -- ret = ssd1307fb_write_cmd(par->client, 0x0); -+ ret = ssd1307fb_write_cmd(par->client, par->page_offset); - if (ret < 0) - return ret; - -diff --git a/fs/fat/dir.c b/fs/fat/dir.c -index 8b2127ffb226..9b77e2ad2b59 100644 ---- a/fs/fat/dir.c -+++ b/fs/fat/dir.c -@@ -1097,8 +1097,11 @@ static int fat_zeroed_cluster(struct inode *dir, sector_t blknr, int nr_used, - err = -ENOMEM; - goto error; - } -+ /* Avoid race with userspace read via bdev */ -+ lock_buffer(bhs[n]); - memset(bhs[n]->b_data, 0, sb->s_blocksize); - set_buffer_uptodate(bhs[n]); -+ unlock_buffer(bhs[n]); - mark_buffer_dirty_inode(bhs[n], dir); - - n++; -@@ -1155,6 +1158,8 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec *ts) - fat_time_unix2fat(sbi, ts, &time, &date, &time_cs); - - de = (struct msdos_dir_entry *)bhs[0]->b_data; -+ /* Avoid race with userspace read via bdev */ -+ lock_buffer(bhs[0]); - /* filling the new directory slots ("." and ".." entries) */ - memcpy(de[0].name, MSDOS_DOT, MSDOS_NAME); - memcpy(de[1].name, MSDOS_DOTDOT, MSDOS_NAME); -@@ -1177,6 +1182,7 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec *ts) - de[0].size = de[1].size = 0; - memset(de + 2, 0, sb->s_blocksize - 2 * sizeof(*de)); - set_buffer_uptodate(bhs[0]); -+ unlock_buffer(bhs[0]); - mark_buffer_dirty_inode(bhs[0], dir); - - err = fat_zeroed_cluster(dir, blknr, 1, bhs, MAX_BUF_PER_PAGE); -@@ -1234,11 +1240,14 @@ static int fat_add_new_entries(struct inode *dir, void *slots, int nr_slots, - - /* fill the directory entry */ - copy = min(size, sb->s_blocksize); -+ /* Avoid race with userspace read via bdev */ -+ lock_buffer(bhs[n]); - memcpy(bhs[n]->b_data, slots, copy); -- slots += copy; -- size -= copy; - set_buffer_uptodate(bhs[n]); -+ unlock_buffer(bhs[n]); - mark_buffer_dirty_inode(bhs[n], dir); -+ slots += copy; -+ size -= copy; - if (!size) - break; - n++; -diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c -index e3fc477728b3..be8529739d23 100644 ---- a/fs/fat/fatent.c -+++ b/fs/fat/fatent.c -@@ -389,8 +389,11 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs, - err = -ENOMEM; - goto error; - } -+ /* Avoid race with userspace read via bdev */ -+ lock_buffer(c_bh); - memcpy(c_bh->b_data, bhs[n]->b_data, sb->s_blocksize); - set_buffer_uptodate(c_bh); -+ unlock_buffer(c_bh); - mark_buffer_dirty_inode(c_bh, sbi->fat_inode); - if (sb->s_flags & MS_SYNCHRONOUS) - err = sync_dirty_buffer(c_bh); -diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c -index 2e3c9dbab68c..d137d4692b91 100644 ---- a/fs/ocfs2/dlm/dlmunlock.c -+++ b/fs/ocfs2/dlm/dlmunlock.c -@@ -105,7 +105,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm, - enum dlm_status status; - int actions = 0; - int in_use; -- u8 owner; -+ u8 owner; -+ int recovery_wait = 0; - - mlog(0, "master_node = %d, valblk = %d\n", master_node, - flags & LKM_VALBLK); -@@ -208,9 +209,12 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm, - } - if (flags & LKM_CANCEL) - lock->cancel_pending = 0; -- else -- lock->unlock_pending = 0; -- -+ else { -+ if (!lock->unlock_pending) -+ recovery_wait = 1; -+ else -+ lock->unlock_pending = 0; -+ } - } - - /* get an extra ref on lock. if we are just switching -@@ -244,6 +248,17 @@ leave: - spin_unlock(&res->spinlock); - wake_up(&res->wq); - -+ if (recovery_wait) { -+ spin_lock(&res->spinlock); -+ /* Unlock request will directly succeed after owner dies, -+ * and the lock is already removed from grant list. We have to -+ * wait for RECOVERING done or we miss the chance to purge it -+ * since the removement is much faster than RECOVERING proc. -+ */ -+ __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_RECOVERING); -+ spin_unlock(&res->spinlock); -+ } -+ - /* let the caller's final dlm_lock_put handle the actual kfree */ - if (actions & DLM_UNLOCK_FREE_LOCK) { - /* this should always be coupled with list removal */ -diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h -index f8170e90b49d..bbe71a6361db 100644 ---- a/include/scsi/scsi_dbg.h -+++ b/include/scsi/scsi_dbg.h -@@ -5,8 +5,6 @@ struct scsi_cmnd; - struct scsi_device; - struct scsi_sense_hdr; - --#define SCSI_LOG_BUFSIZE 128 -- - extern void scsi_print_command(struct scsi_cmnd *); - extern size_t __scsi_format_command(char *, size_t, - const unsigned char *, size_t); -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index fd1205a3dbdb..7b9d7328f189 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -521,7 +521,7 @@ config DEBUG_KMEMLEAK_EARLY_LOG_SIZE - int "Maximum kmemleak early log entries" - depends on DEBUG_KMEMLEAK - range 200 40000 -- default 400 -+ default 16000 - help - Kmemleak must track all the memory allocations to avoid - reporting false positives. Since memory may be allocated or -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 3c605a788ba1..a60078de1191 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -897,16 +897,15 @@ void ip_rt_send_redirect(struct sk_buff *skb) - if (peer->rate_tokens == 0 || - time_after(jiffies, - (peer->rate_last + -- (ip_rt_redirect_load << peer->rate_tokens)))) { -+ (ip_rt_redirect_load << peer->n_redirects)))) { - __be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr); - - icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw); - peer->rate_last = jiffies; -- ++peer->rate_tokens; - ++peer->n_redirects; - #ifdef CONFIG_IP_ROUTE_VERBOSE - if (log_martians && -- peer->rate_tokens == ip_rt_redirect_number) -+ peer->n_redirects == ip_rt_redirect_number) - net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n", - &ip_hdr(skb)->saddr, inet_iif(skb), - &ip_hdr(skb)->daddr, &gw); -diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c -index 9075acf081dd..c83c0faf5ae9 100644 ---- a/net/ipv6/ip6_input.c -+++ b/net/ipv6/ip6_input.c -@@ -151,6 +151,16 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt - if (ipv6_addr_is_multicast(&hdr->saddr)) - goto err; - -+ /* While RFC4291 is not explicit about v4mapped addresses -+ * in IPv6 headers, it seems clear linux dual-stack -+ * model can not deal properly with these. -+ * Security models could be fooled by ::ffff:127.0.0.1 for example. -+ * -+ * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02 -+ */ -+ if (ipv6_addr_v4mapped(&hdr->saddr)) -+ goto err; -+ - skb->transport_header = skb->network_header + sizeof(*hdr); - IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); - -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index 2dfd1c815203..44d6b8355eab 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -118,9 +118,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) - llcp_sock->service_name = kmemdup(llcp_addr.service_name, - llcp_sock->service_name_len, - GFP_KERNEL); -- -+ if (!llcp_sock->service_name) { -+ ret = -ENOMEM; -+ goto put_dev; -+ } - llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock); - if (llcp_sock->ssap == LLCP_SAP_MAX) { -+ kfree(llcp_sock->service_name); -+ llcp_sock->service_name = NULL; - ret = -EADDRINUSE; - goto put_dev; - } -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index 32cb0c87e852..80def98c9dba 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -936,7 +936,8 @@ static int nfc_genl_dep_link_down(struct sk_buff *skb, struct genl_info *info) - int rc; - u32 idx; - -- if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) -+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || -+ !info->attrs[NFC_ATTR_TARGET_INDEX]) - return -EINVAL; - - idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); -@@ -985,7 +986,8 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info) - struct sk_buff *msg = NULL; - u32 idx; - -- if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) -+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || -+ !info->attrs[NFC_ATTR_FIRMWARE_NAME]) - return -EINVAL; - - idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); -diff --git a/net/rds/ib.c b/net/rds/ib.c -index ed51ccc84b3a..aa5f75d4880c 100644 ---- a/net/rds/ib.c -+++ b/net/rds/ib.c -@@ -146,6 +146,9 @@ static void rds_ib_add_one(struct ib_device *device) - atomic_set(&rds_ibdev->refcount, 1); - INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free); - -+ INIT_LIST_HEAD(&rds_ibdev->ipaddr_list); -+ INIT_LIST_HEAD(&rds_ibdev->conn_list); -+ - rds_ibdev->max_wrs = dev_attr->max_qp_wr; - rds_ibdev->max_sge = min(dev_attr->max_sge, RDS_IB_MAX_SGE); - -@@ -187,9 +190,6 @@ static void rds_ib_add_one(struct ib_device *device) - rds_ibdev->fmr_max_remaps, rds_ibdev->max_1m_fmrs, - rds_ibdev->max_8k_fmrs); - -- INIT_LIST_HEAD(&rds_ibdev->ipaddr_list); -- INIT_LIST_HEAD(&rds_ibdev->conn_list); -- - down_write(&rds_ib_devices_lock); - list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices); - up_write(&rds_ib_devices_lock); -diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c -index baafddf229ce..8182f9bc197c 100644 ---- a/net/sched/sch_cbq.c -+++ b/net/sched/sch_cbq.c -@@ -1340,6 +1340,26 @@ static const struct nla_policy cbq_policy[TCA_CBQ_MAX + 1] = { - [TCA_CBQ_POLICE] = { .len = sizeof(struct tc_cbq_police) }, - }; - -+static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1], struct nlattr *opt) -+{ -+ int err; -+ -+ if (!opt) -+ return -EINVAL; -+ -+ err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy); -+ if (err < 0) -+ return err; -+ -+ if (tb[TCA_CBQ_WRROPT]) { -+ const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]); -+ -+ if (wrr->priority > TC_CBQ_MAXPRIO) -+ err = -EINVAL; -+ } -+ return err; -+} -+ - static int cbq_init(struct Qdisc *sch, struct nlattr *opt) - { - struct cbq_sched_data *q = qdisc_priv(sch); -@@ -1347,7 +1367,7 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt) - struct tc_ratespec *r; - int err; - -- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy); -+ err = cbq_opt_parse(tb, opt); - if (err < 0) - return err; - -@@ -1728,10 +1748,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t - struct cbq_class *parent; - struct qdisc_rate_table *rtab = NULL; - -- if (opt == NULL) -- return -EINVAL; -- -- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy); -+ err = cbq_opt_parse(tb, opt); - if (err < 0) - return err; - -diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c -index cce4e6ada7fa..5f8f6d94336c 100644 ---- a/net/sched/sch_dsmark.c -+++ b/net/sched/sch_dsmark.c -@@ -362,6 +362,8 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr *opt) - goto errout; - - err = -EINVAL; -+ if (!tb[TCA_DSMARK_INDICES]) -+ goto errout; - indices = nla_get_u16(tb[TCA_DSMARK_INDICES]); - - if (hweight32(indices) != 1) -diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c -index a283f9e796c1..0df316c62005 100644 ---- a/security/smack/smack_access.c -+++ b/security/smack/smack_access.c -@@ -474,7 +474,7 @@ char *smk_parse_smack(const char *string, int len) - if (i == 0 || i >= SMK_LONGLABEL) - return ERR_PTR(-EINVAL); - -- smack = kzalloc(i + 1, GFP_KERNEL); -+ smack = kzalloc(i + 1, GFP_NOFS); - if (smack == NULL) - return ERR_PTR(-ENOMEM); - -@@ -545,7 +545,7 @@ struct smack_known *smk_import_entry(const char *string, int len) - if (skp != NULL) - goto freeout; - -- skp = kzalloc(sizeof(*skp), GFP_KERNEL); -+ skp = kzalloc(sizeof(*skp), GFP_NOFS); - if (skp == NULL) { - skp = ERR_PTR(-ENOMEM); - goto freeout; -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 9db7c80a74aa..716433e63052 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -268,7 +268,7 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip, - if (ip->i_op->getxattr == NULL) - return ERR_PTR(-EOPNOTSUPP); - -- buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL); -+ buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS); - if (buffer == NULL) - return ERR_PTR(-ENOMEM); - -@@ -932,7 +932,8 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) - - if (rc != 0) - return rc; -- } else if (bprm->unsafe) -+ } -+ if (bprm->unsafe & ~LSM_UNSAFE_PTRACE) - return -EPERM; - - bsp->smk_task = isp->smk_task; -@@ -3986,6 +3987,8 @@ access_check: - skp = smack_ipv6host_label(&sadd); - if (skp == NULL) - skp = smack_net_ambient; -+ if (skb == NULL) -+ break; - #ifdef CONFIG_AUDIT - smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); - ad.a.u.net->family = sk->sk_family; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.196-197.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.196-197.patch deleted file mode 100644 index 6b7b0e1afe8f..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.196-197.patch +++ /dev/null @@ -1,3427 +0,0 @@ -diff --git a/Documentation/usb/rio.txt b/Documentation/usb/rio.txt -deleted file mode 100644 -index aee715af7db7..000000000000 ---- a/Documentation/usb/rio.txt -+++ /dev/null -@@ -1,138 +0,0 @@ --Copyright (C) 1999, 2000 Bruce Tenison --Portions Copyright (C) 1999, 2000 David Nelson --Thanks to David Nelson for guidance and the usage of the scanner.txt --and scanner.c files to model our driver and this informative file. -- --Mar. 2, 2000 -- --CHANGES -- --- Initial Revision -- -- --OVERVIEW -- --This README will address issues regarding how to configure the kernel --to access a RIO 500 mp3 player. --Before I explain how to use this to access the Rio500 please be warned: -- --W A R N I N G: ---------------- -- --Please note that this software is still under development. The authors --are in no way responsible for any damage that may occur, no matter how --inconsequential. -- --It seems that the Rio has a problem when sending .mp3 with low batteries. --I suggest when the batteries are low and you want to transfer stuff that you --replace it with a fresh one. In my case, what happened is I lost two 16kb --blocks (they are no longer usable to store information to it). But I don't --know if that's normal or not; it could simply be a problem with the flash --memory. -- --In an extreme case, I left my Rio playing overnight and the batteries wore --down to nothing and appear to have corrupted the flash memory. My RIO --needed to be replaced as a result. Diamond tech support is aware of the --problem. Do NOT allow your batteries to wear down to nothing before --changing them. It appears RIO 500 firmware does not handle low battery --power well at all. -- --On systems with OHCI controllers, the kernel OHCI code appears to have --power on problems with some chipsets. If you are having problems --connecting to your RIO 500, try turning it on first and then plugging it --into the USB cable. -- --Contact information: ---------------------- -- -- The main page for the project is hosted at sourceforge.net in the following -- URL: . You can also go to the project's -- sourceforge home page at: . -- There is also a mailing list: rio500-users@lists.sourceforge.net -- --Authors: --------- -- --Most of the code was written by Cesar Miquel . Keith --Clayton is incharge of the PPC port and making sure --things work there. Bruce Tenison is adding support --for .fon files and also does testing. The program will mostly sure be --re-written and Pete Ikusz along with the rest will re-design it. I would --also like to thank Tri Nguyen who provided use --with some important information regarding the communication with the Rio. -- --ADDITIONAL INFORMATION and Userspace tools -- --http://rio500.sourceforge.net/ -- -- --REQUIREMENTS -- --A host with a USB port. Ideally, either a UHCI (Intel) or OHCI --(Compaq and others) hardware port should work. -- --A Linux development kernel (2.3.x) with USB support enabled or a --backported version to linux-2.2.x. See http://www.linux-usb.org for --more information on accomplishing this. -- --A Linux kernel with RIO 500 support enabled. -- --'lspci' which is only needed to determine the type of USB hardware --available in your machine. -- --CONFIGURATION -- --Using `lspci -v`, determine the type of USB hardware available. -- -- If you see something like: -- -- USB Controller: ...... -- Flags: ..... -- I/O ports at .... -- -- Then you have a UHCI based controller. -- -- If you see something like: -- -- USB Controller: ..... -- Flags: .... -- Memory at ..... -- -- Then you have a OHCI based controller. -- --Using `make menuconfig` or your preferred method for configuring the --kernel, select 'Support for USB', 'OHCI/UHCI' depending on your --hardware (determined from the steps above), 'USB Diamond Rio500 support', and --'Preliminary USB device filesystem'. Compile and install the modules --(you may need to execute `depmod -a` to update the module --dependencies). -- --Add a device for the USB rio500: -- `mknod /dev/usb/rio500 c 180 64` -- --Set appropriate permissions for /dev/usb/rio500 (don't forget about --group and world permissions). Both read and write permissions are --required for proper operation. -- --Load the appropriate modules (if compiled as modules): -- -- OHCI: -- modprobe usbcore -- modprobe usb-ohci -- modprobe rio500 -- -- UHCI: -- modprobe usbcore -- modprobe usb-uhci (or uhci) -- modprobe rio500 -- --That's it. The Rio500 Utils at: http://rio500.sourceforge.net should --be able to access the rio500. -- --BUGS -- --If you encounter any problems feel free to drop me an email. -- --Bruce Tenison --btenison@dibbs.net -- -diff --git a/MAINTAINERS b/MAINTAINERS -index 20a31b357929..e1a15f7507fa 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -11100,13 +11100,6 @@ W: http://www.linux-usb.org/usbnet - S: Maintained - F: drivers/net/usb/dm9601.c - --USB DIAMOND RIO500 DRIVER --M: Cesar Miquel --L: rio500-users@lists.sourceforge.net --W: http://rio500.sourceforge.net --S: Maintained --F: drivers/usb/misc/rio500* -- - USB EHCI DRIVER - M: Alan Stern - L: linux-usb@vger.kernel.org -diff --git a/Makefile b/Makefile -index 9eaf50527883..5c150d32cae7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 196 -+SUBLEVEL = 197 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/configs/badge4_defconfig b/arch/arm/configs/badge4_defconfig -index d59009878312..067d73e3b28b 100644 ---- a/arch/arm/configs/badge4_defconfig -+++ b/arch/arm/configs/badge4_defconfig -@@ -97,7 +97,6 @@ CONFIG_USB_SERIAL_PL2303=m - CONFIG_USB_SERIAL_CYBERJACK=m - CONFIG_USB_SERIAL_XIRCOM=m - CONFIG_USB_SERIAL_OMNINET=m --CONFIG_USB_RIO500=m - CONFIG_EXT2_FS=m - CONFIG_EXT3_FS=m - CONFIG_MSDOS_FS=y -diff --git a/arch/arm/configs/corgi_defconfig b/arch/arm/configs/corgi_defconfig -index c1470a00f55a..031d9d3549b9 100644 ---- a/arch/arm/configs/corgi_defconfig -+++ b/arch/arm/configs/corgi_defconfig -@@ -207,7 +207,6 @@ CONFIG_USB_SERIAL_XIRCOM=m - CONFIG_USB_SERIAL_OMNINET=m - CONFIG_USB_EMI62=m - CONFIG_USB_EMI26=m --CONFIG_USB_RIO500=m - CONFIG_USB_LEGOTOWER=m - CONFIG_USB_LCD=m - CONFIG_USB_LED=m -diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig -index 01116ee1284b..a199b0e1a6ea 100644 ---- a/arch/arm/configs/s3c2410_defconfig -+++ b/arch/arm/configs/s3c2410_defconfig -@@ -354,7 +354,6 @@ CONFIG_USB_EMI62=m - CONFIG_USB_EMI26=m - CONFIG_USB_ADUTUX=m - CONFIG_USB_SEVSEG=m --CONFIG_USB_RIO500=m - CONFIG_USB_LEGOTOWER=m - CONFIG_USB_LCD=m - CONFIG_USB_LED=m -diff --git a/arch/arm/configs/spitz_defconfig b/arch/arm/configs/spitz_defconfig -index a1ede1966baf..7d9aa284cb6f 100644 ---- a/arch/arm/configs/spitz_defconfig -+++ b/arch/arm/configs/spitz_defconfig -@@ -202,7 +202,6 @@ CONFIG_USB_SERIAL_XIRCOM=m - CONFIG_USB_SERIAL_OMNINET=m - CONFIG_USB_EMI62=m - CONFIG_USB_EMI26=m --CONFIG_USB_RIO500=m - CONFIG_USB_LEGOTOWER=m - CONFIG_USB_LCD=m - CONFIG_USB_LED=m -diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h -index 0a66f8241f18..518eaa63e633 100644 ---- a/arch/arm64/include/asm/cpufeature.h -+++ b/arch/arm64/include/asm/cpufeature.h -@@ -88,9 +88,10 @@ struct arm64_cpu_capabilities { - - struct { /* Feature register checking */ - u32 sys_reg; -- int field_pos; -- int min_field_value; -- int hwcap_type; -+ u8 field_pos; -+ u8 min_field_value; -+ u8 hwcap_type; -+ bool sign; - unsigned long hwcap; - }; - }; -@@ -120,15 +121,15 @@ static inline void cpus_set_cap(unsigned int num) - } - - static inline int __attribute_const__ --cpuid_feature_extract_field_width(u64 features, int field, int width) -+cpuid_feature_extract_signed_field_width(u64 features, int field, int width) - { - return (s64)(features << (64 - width - field)) >> (64 - width); - } - - static inline int __attribute_const__ --cpuid_feature_extract_field(u64 features, int field) -+cpuid_feature_extract_signed_field(u64 features, int field) - { -- return cpuid_feature_extract_field_width(features, field, 4); -+ return cpuid_feature_extract_signed_field_width(features, field, 4); - } - - static inline unsigned int __attribute_const__ -@@ -148,17 +149,23 @@ static inline u64 arm64_ftr_mask(struct arm64_ftr_bits *ftrp) - return (u64)GENMASK(ftrp->shift + ftrp->width - 1, ftrp->shift); - } - -+static inline int __attribute_const__ -+cpuid_feature_extract_field(u64 features, int field, bool sign) -+{ -+ return (sign) ? -+ cpuid_feature_extract_signed_field(features, field) : -+ cpuid_feature_extract_unsigned_field(features, field); -+} -+ - static inline s64 arm64_ftr_value(struct arm64_ftr_bits *ftrp, u64 val) - { -- return ftrp->sign ? -- cpuid_feature_extract_field_width(val, ftrp->shift, ftrp->width) : -- cpuid_feature_extract_unsigned_field_width(val, ftrp->shift, ftrp->width); -+ return (s64)cpuid_feature_extract_field(val, ftrp->shift, ftrp->sign); - } - - static inline bool id_aa64mmfr0_mixed_endian_el0(u64 mmfr0) - { -- return cpuid_feature_extract_field(mmfr0, ID_AA64MMFR0_BIGENDEL_SHIFT) == 0x1 || -- cpuid_feature_extract_field(mmfr0, ID_AA64MMFR0_BIGENDEL0_SHIFT) == 0x1; -+ return cpuid_feature_extract_unsigned_field(mmfr0, ID_AA64MMFR0_BIGENDEL_SHIFT) == 0x1 || -+ cpuid_feature_extract_unsigned_field(mmfr0, ID_AA64MMFR0_BIGENDEL0_SHIFT) == 0x1; - } - - void __init setup_cpu_features(void); -diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c -index c8875b64be90..8e7675e5ce4a 100644 ---- a/arch/arm64/kernel/debug-monitors.c -+++ b/arch/arm64/kernel/debug-monitors.c -@@ -34,7 +34,7 @@ - /* Determine debug architecture. */ - u8 debug_monitors_arch(void) - { -- return cpuid_feature_extract_field(read_system_reg(SYS_ID_AA64DFR0_EL1), -+ return cpuid_feature_extract_unsigned_field(read_system_reg(SYS_ID_AA64DFR0_EL1), - ID_AA64DFR0_DEBUGVER_SHIFT); - } - -diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c -index c2489f62c4fb..0a587e7b9b6e 100644 ---- a/arch/arm64/kvm/sys_regs.c -+++ b/arch/arm64/kvm/sys_regs.c -@@ -687,7 +687,7 @@ static bool trap_dbgidr(struct kvm_vcpu *vcpu, - } else { - u64 dfr = read_system_reg(SYS_ID_AA64DFR0_EL1); - u64 pfr = read_system_reg(SYS_ID_AA64PFR0_EL1); -- u32 el3 = !!cpuid_feature_extract_field(pfr, ID_AA64PFR0_EL3_SHIFT); -+ u32 el3 = !!cpuid_feature_extract_unsigned_field(pfr, ID_AA64PFR0_EL3_SHIFT); - - p->regval = ((((dfr >> ID_AA64DFR0_WRPS_SHIFT) & 0xf) << 28) | - (((dfr >> ID_AA64DFR0_BRPS_SHIFT) & 0xf) << 24) | -diff --git a/arch/mips/configs/mtx1_defconfig b/arch/mips/configs/mtx1_defconfig -index 9b6926d6bb32..6ac662afd5c1 100644 ---- a/arch/mips/configs/mtx1_defconfig -+++ b/arch/mips/configs/mtx1_defconfig -@@ -638,7 +638,6 @@ CONFIG_USB_SERIAL_OMNINET=m - CONFIG_USB_EMI62=m - CONFIG_USB_EMI26=m - CONFIG_USB_ADUTUX=m --CONFIG_USB_RIO500=m - CONFIG_USB_LEGOTOWER=m - CONFIG_USB_LCD=m - CONFIG_USB_LED=m -diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig -index db029f4ff759..4acaa3fb4818 100644 ---- a/arch/mips/configs/rm200_defconfig -+++ b/arch/mips/configs/rm200_defconfig -@@ -351,7 +351,6 @@ CONFIG_USB_SERIAL_SAFE_PADDED=y - CONFIG_USB_SERIAL_CYBERJACK=m - CONFIG_USB_SERIAL_XIRCOM=m - CONFIG_USB_SERIAL_OMNINET=m --CONFIG_USB_RIO500=m - CONFIG_USB_LEGOTOWER=m - CONFIG_USB_LCD=m - CONFIG_USB_LED=m -diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c -index b40606051efe..d3787618315f 100644 ---- a/arch/powerpc/platforms/powernv/opal.c -+++ b/arch/powerpc/platforms/powernv/opal.c -@@ -580,7 +580,10 @@ static ssize_t symbol_map_read(struct file *fp, struct kobject *kobj, - bin_attr->size); - } - --static BIN_ATTR_RO(symbol_map, 0); -+static struct bin_attribute symbol_map_attr = { -+ .attr = {.name = "symbol_map", .mode = 0400}, -+ .read = symbol_map_read -+}; - - static void opal_export_symmap(void) - { -@@ -597,10 +600,10 @@ static void opal_export_symmap(void) - return; - - /* Setup attributes */ -- bin_attr_symbol_map.private = __va(be64_to_cpu(syms[0])); -- bin_attr_symbol_map.size = be64_to_cpu(syms[1]); -+ symbol_map_attr.private = __va(be64_to_cpu(syms[0])); -+ symbol_map_attr.size = be64_to_cpu(syms[1]); - -- rc = sysfs_create_bin_file(opal_kobj, &bin_attr_symbol_map); -+ rc = sysfs_create_bin_file(opal_kobj, &symbol_map_attr); - if (rc) - pr_warn("Error %d creating OPAL symbols file\n", rc); - } -diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c -index 40b8102fdadb..ff95ddd031d1 100644 ---- a/arch/s390/kernel/topology.c -+++ b/arch/s390/kernel/topology.c -@@ -291,7 +291,8 @@ int arch_update_cpu_topology(void) - topology_update_polarization_simple(); - for_each_online_cpu(cpu) { - dev = get_cpu_device(cpu); -- kobject_uevent(&dev->kobj, KOBJ_CHANGE); -+ if (dev) -+ kobject_uevent(&dev->kobj, KOBJ_CHANGE); - } - return rc; - } -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 14d2ca9c779e..3e46f62d32ad 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -2471,7 +2471,7 @@ static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu, - const u64 supported_flags = KVM_S390_MEMOP_F_INJECT_EXCEPTION - | KVM_S390_MEMOP_F_CHECK_ONLY; - -- if (mop->flags & ~supported_flags) -+ if (mop->flags & ~supported_flags || mop->ar >= NUM_ACRS || !mop->size) - return -EINVAL; - - if (mop->size > MEM_OP_MAX_SIZE) -diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h -index b98dbdaee8ac..1ab7f37150d2 100644 ---- a/arch/x86/include/asm/mwait.h -+++ b/arch/x86/include/asm/mwait.h -@@ -19,7 +19,7 @@ - #define MWAIT_ECX_INTERRUPT_BREAK 0x1 - #define MWAITX_ECX_TIMER_ENABLE BIT(1) - #define MWAITX_MAX_LOOPS ((u32)-1) --#define MWAITX_DISABLE_CSTATES 0xf -+#define MWAITX_DISABLE_CSTATES 0xf0 - - static inline void __monitor(const void *eax, unsigned long ecx, - unsigned long edx) -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 343c8ddad86a..f8f9d1b368bf 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -7276,7 +7276,7 @@ static int handle_vmread(struct kvm_vcpu *vcpu) - /* _system ok, as nested_vmx_check_permission verified cpl=0 */ - if (kvm_write_guest_virt_system(vcpu, gva, &field_value, - (is_long_mode(vcpu) ? 8 : 4), -- NULL)) -+ &e)) - kvm_inject_page_fault(vcpu, &e); - } - -diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c -index 45772560aceb..fc0cc6d08157 100644 ---- a/arch/x86/lib/delay.c -+++ b/arch/x86/lib/delay.c -@@ -112,8 +112,8 @@ static void delay_mwaitx(unsigned long __loops) - __monitorx(this_cpu_ptr(&cpu_tss), 0, 0); - - /* -- * AMD, like Intel, supports the EAX hint and EAX=0xf -- * means, do not enter any deep C-state and we use it -+ * AMD, like Intel's MWAIT version, supports the EAX hint and -+ * EAX=0xf0 means, do not enter any deep C-state and we use it - * here in delay() to minimize wakeup latency. - */ - __mwaitx(MWAITX_DISABLE_CSTATES, delay, MWAITX_ECX_TIMER_ENABLE); -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index f2d1fea23fbf..492432dd5cd6 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -75,7 +75,7 @@ - #define DESC_AEAD_BASE (4 * CAAM_CMD_SZ) - #define DESC_AEAD_ENC_LEN (DESC_AEAD_BASE + 11 * CAAM_CMD_SZ) - #define DESC_AEAD_DEC_LEN (DESC_AEAD_BASE + 15 * CAAM_CMD_SZ) --#define DESC_AEAD_GIVENC_LEN (DESC_AEAD_ENC_LEN + 9 * CAAM_CMD_SZ) -+#define DESC_AEAD_GIVENC_LEN (DESC_AEAD_ENC_LEN + 10 * CAAM_CMD_SZ) - - /* Note: Nonce is counted in enckeylen */ - #define DESC_AEAD_CTR_RFC3686_LEN (4 * CAAM_CMD_SZ) -@@ -437,6 +437,7 @@ static int aead_set_sh_desc(struct crypto_aead *aead) - u32 geniv, moveiv; - u32 ctx1_iv_off = 0; - u32 *desc; -+ u32 *wait_cmd; - const bool ctr_mode = ((ctx->class1_alg_type & OP_ALG_AAI_MASK) == - OP_ALG_AAI_CTR_MOD128); - const bool is_rfc3686 = alg->caam.rfc3686; -@@ -702,6 +703,14 @@ copy_iv: - - /* Will read cryptlen */ - append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ); -+ -+ /* -+ * Wait for IV transfer (ofifo -> class2) to finish before starting -+ * ciphertext transfer (ofifo -> external memory). -+ */ -+ wait_cmd = append_jump(desc, JUMP_JSL | JUMP_TEST_ALL | JUMP_COND_NIFP); -+ set_jump_tgt_here(desc, wait_cmd); -+ - append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF | - FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH); - append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF); -diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h -index aa1dbeaa9b49..5358162018dd 100644 ---- a/drivers/crypto/qat/qat_common/adf_common_drv.h -+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h -@@ -95,7 +95,7 @@ struct service_hndl { - - static inline int get_current_node(void) - { -- return topology_physical_package_id(smp_processor_id()); -+ return topology_physical_package_id(raw_smp_processor_id()); - } - - int adf_service_register(struct service_hndl *service); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index a5c824078472..e35e603710b4 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -406,6 +406,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) - sh_num = 0xffffffff; - -+ if (info->read_mmr_reg.count > 128) -+ return -EINVAL; -+ - regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); - if (!regs) - return -ENOMEM; -diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c -index ba82de25a797..46681e399e22 100644 ---- a/drivers/iio/adc/ad799x.c -+++ b/drivers/iio/adc/ad799x.c -@@ -822,10 +822,10 @@ static int ad799x_probe(struct i2c_client *client, - - ret = ad799x_write_config(st, st->chip_config->default_config); - if (ret < 0) -- goto error_disable_reg; -+ goto error_disable_vref; - ret = ad799x_read_config(st); - if (ret < 0) -- goto error_disable_reg; -+ goto error_disable_vref; - st->config = ret; - - ret = iio_triggered_buffer_setup(indio_dev, NULL, -diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c -index 01e111e72d4b..eecdc50ed282 100644 ---- a/drivers/iio/light/opt3001.c -+++ b/drivers/iio/light/opt3001.c -@@ -646,6 +646,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) - struct iio_dev *iio = _iio; - struct opt3001 *opt = iio_priv(iio); - int ret; -+ bool wake_result_ready_queue = false; - - if (!opt->ok_to_ignore_lock) - mutex_lock(&opt->lock); -@@ -680,13 +681,16 @@ static irqreturn_t opt3001_irq(int irq, void *_iio) - } - opt->result = ret; - opt->result_ready = true; -- wake_up(&opt->result_ready_queue); -+ wake_result_ready_queue = true; - } - - out: - if (!opt->ok_to_ignore_lock) - mutex_unlock(&opt->lock); - -+ if (wake_result_ready_queue) -+ wake_up(&opt->result_ready_queue); -+ - return IRQ_HANDLED; - } - -diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c -index c21c4c004f97..17ee9cde4156 100644 ---- a/drivers/media/usb/stkwebcam/stk-webcam.c -+++ b/drivers/media/usb/stkwebcam/stk-webcam.c -@@ -642,8 +642,7 @@ static int v4l_stk_release(struct file *fp) - dev->owner = NULL; - } - -- if (is_present(dev)) -- usb_autopm_put_interface(dev->interface); -+ usb_autopm_put_interface(dev->interface); - mutex_unlock(&dev->lock); - return v4l2_fh_release(fp); - } -diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c -index 3bcbfcf0455a..83ddb7d8214a 100644 ---- a/drivers/net/can/spi/mcp251x.c -+++ b/drivers/net/can/spi/mcp251x.c -@@ -627,7 +627,7 @@ static int mcp251x_setup(struct net_device *net, struct mcp251x_priv *priv, - static int mcp251x_hw_reset(struct spi_device *spi) - { - struct mcp251x_priv *priv = spi_get_drvdata(spi); -- u8 reg; -+ unsigned long timeout; - int ret; - - /* Wait for oscillator startup timer after power up */ -@@ -641,10 +641,19 @@ static int mcp251x_hw_reset(struct spi_device *spi) - /* Wait for oscillator startup timer after reset */ - mdelay(MCP251X_OST_DELAY_MS); - -- reg = mcp251x_read_reg(spi, CANSTAT); -- if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF) -- return -ENODEV; -- -+ /* Wait for reset to finish */ -+ timeout = jiffies + HZ; -+ while ((mcp251x_read_reg(spi, CANSTAT) & CANCTRL_REQOP_MASK) != -+ CANCTRL_REQOP_CONF) { -+ usleep_range(MCP251X_OST_DELAY_MS * 1000, -+ MCP251X_OST_DELAY_MS * 1000 * 2); -+ -+ if (time_after(jiffies, timeout)) { -+ dev_err(&spi->dev, -+ "MCP251x didn't enter in conf mode after reset\n"); -+ return -EBUSY; -+ } -+ } - return 0; - } - -diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c -index 3a429f1a8002..d5e0e2aedc55 100644 ---- a/drivers/net/ieee802154/atusb.c -+++ b/drivers/net/ieee802154/atusb.c -@@ -756,10 +756,11 @@ static void atusb_disconnect(struct usb_interface *interface) - - ieee802154_unregister_hw(atusb->hw); - -+ usb_put_dev(atusb->usb_dev); -+ - ieee802154_free_hw(atusb->hw); - - usb_set_intfdata(interface, NULL); -- usb_put_dev(atusb->usb_dev); - - pr_debug("atusb_disconnect done\n"); - } -diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c -index e443b0d0b236..0d59c128f734 100644 ---- a/drivers/s390/cio/ccwgroup.c -+++ b/drivers/s390/cio/ccwgroup.c -@@ -369,7 +369,7 @@ int ccwgroup_create_dev(struct device *parent, struct ccwgroup_driver *gdrv, - goto error; - } - /* Check for trailing stuff. */ -- if (i == num_devices && strlen(buf) > 0) { -+ if (i == num_devices && buf && strlen(buf) > 0) { - rc = -EINVAL; - goto error; - } -diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c -index 489e703dc82d..8ecc956ecb59 100644 ---- a/drivers/s390/cio/css.c -+++ b/drivers/s390/cio/css.c -@@ -1120,6 +1120,8 @@ device_initcall(cio_settle_init); - - int sch_is_pseudo_sch(struct subchannel *sch) - { -+ if (!sch->dev.parent) -+ return 0; - return sch == to_css(sch->dev.parent)->pseudo_subchannel; - } - -diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c -index 18c2b6daf588..15937e0ef4d9 100644 ---- a/drivers/staging/fbtft/fbtft-core.c -+++ b/drivers/staging/fbtft/fbtft-core.c -@@ -813,7 +813,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, - if (par->gamma.curves && gamma) { - if (fbtft_gamma_parse_str(par, - par->gamma.curves, gamma, strlen(gamma))) -- goto alloc_fail; -+ goto release_framebuf; - } - - /* Transmit buffer */ -@@ -836,7 +836,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, - txbuf = devm_kzalloc(par->info->device, txbuflen, GFP_KERNEL); - } - if (!txbuf) -- goto alloc_fail; -+ goto release_framebuf; - par->txbuf.buf = txbuf; - par->txbuf.len = txbuflen; - } -@@ -872,6 +872,9 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, - - return info; - -+release_framebuf: -+ framebuffer_release(info); -+ - alloc_fail: - vfree(vmem); - -diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c -index 58b6403458b7..2f3c9217d650 100644 ---- a/drivers/staging/vt6655/device_main.c -+++ b/drivers/staging/vt6655/device_main.c -@@ -1668,8 +1668,10 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent) - - priv->hw->max_signal = 100; - -- if (vnt_init(priv)) -+ if (vnt_init(priv)) { -+ device_free_info(priv); - return -ENODEV; -+ } - - device_print_info(priv); - pci_set_drvdata(pcid, priv); -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index 3d5f8f432b5b..929092fc25ef 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -402,7 +402,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz, - mod_delayed_work(system_freezable_wq, &tz->poll_queue, - msecs_to_jiffies(delay)); - else -- cancel_delayed_work(&tz->poll_queue); -+ cancel_delayed_work_sync(&tz->poll_queue); - } - - static void monitor_thermal_zone(struct thermal_zone_device *tz) -diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c -index b1c6bd3d483f..c27db21b71ba 100644 ---- a/drivers/tty/serial/uartlite.c -+++ b/drivers/tty/serial/uartlite.c -@@ -701,7 +701,8 @@ err_uart: - static void __exit ulite_exit(void) - { - platform_driver_unregister(&ulite_platform_driver); -- uart_unregister_driver(&ulite_uart_driver); -+ if (ulite_uart_driver.state) -+ uart_unregister_driver(&ulite_uart_driver); - } - - module_init(ulite_init); -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index 071964c7847f..0669fbb0ec25 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -474,10 +474,12 @@ static int usblp_release(struct inode *inode, struct file *file) - - mutex_lock(&usblp_mutex); - usblp->used = 0; -- if (usblp->present) { -+ if (usblp->present) - usblp_unlink_urbs(usblp); -- usb_autopm_put_interface(usblp->intf); -- } else /* finish cleanup from disconnect */ -+ -+ usb_autopm_put_interface(usblp->intf); -+ -+ if (!usblp->present) /* finish cleanup from disconnect */ - usblp_cleanup(usblp); - mutex_unlock(&usblp_mutex); - return 0; -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index 85f1f282c1d5..0321b9ce9faf 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -50,6 +50,7 @@ - #define DRIVER_VERSION "02 May 2005" - - #define POWER_BUDGET 500 /* in mA; use 8 for low-power port testing */ -+#define POWER_BUDGET_3 900 /* in mA */ - - static const char driver_name[] = "dummy_hcd"; - static const char driver_desc[] = "USB Host+Gadget Emulator"; -@@ -2435,7 +2436,7 @@ static int dummy_start_ss(struct dummy_hcd *dum_hcd) - dum_hcd->rh_state = DUMMY_RH_RUNNING; - dum_hcd->stream_en_ep = 0; - INIT_LIST_HEAD(&dum_hcd->urbp_list); -- dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET; -+ dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET_3; - dummy_hcd_to_hcd(dum_hcd)->state = HC_STATE_RUNNING; - dummy_hcd_to_hcd(dum_hcd)->uses_new_polling = 1; - #ifdef CONFIG_USB_OTG -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index ed152b8ea645..202c806b972a 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -981,7 +981,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) - command |= CMD_CSS; - writel(command, &xhci->op_regs->command); - if (xhci_handshake(&xhci->op_regs->status, -- STS_SAVE, 0, 10 * 1000)) { -+ STS_SAVE, 0, 20 * 1000)) { - xhci_warn(xhci, "WARN: xHC save state timeout\n"); - spin_unlock_irq(&xhci->lock); - return -ETIMEDOUT; -@@ -1041,6 +1041,18 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) - hibernated = true; - - if (!hibernated) { -+ /* -+ * Some controllers might lose power during suspend, so wait -+ * for controller not ready bit to clear, just as in xHC init. -+ */ -+ retval = xhci_handshake(&xhci->op_regs->status, -+ STS_CNR, 0, 10 * 1000 * 1000); -+ if (retval) { -+ xhci_warn(xhci, "Controller not ready at resume %d\n", -+ retval); -+ spin_unlock_irq(&xhci->lock); -+ return retval; -+ } - /* step 1: restore register */ - xhci_restore_registers(xhci); - /* step 2: initialize command ring buffer */ -@@ -4529,12 +4541,12 @@ static int xhci_update_timeout_for_endpoint(struct xhci_hcd *xhci, - alt_timeout = xhci_call_host_update_timeout_for_endpoint(xhci, udev, - desc, state, timeout); - -- /* If we found we can't enable hub-initiated LPM, or -+ /* If we found we can't enable hub-initiated LPM, and - * the U1 or U2 exit latency was too high to allow -- * device-initiated LPM as well, just stop searching. -+ * device-initiated LPM as well, then we will disable LPM -+ * for this device, so stop searching any further. - */ -- if (alt_timeout == USB3_LPM_DISABLED || -- alt_timeout == USB3_LPM_DEVICE_INITIATED) { -+ if (alt_timeout == USB3_LPM_DISABLED) { - *timeout = alt_timeout; - return -E2BIG; - } -@@ -4645,10 +4657,12 @@ static u16 xhci_calculate_lpm_timeout(struct usb_hcd *hcd, - if (intf->dev.driver) { - driver = to_usb_driver(intf->dev.driver); - if (driver && driver->disable_hub_initiated_lpm) { -- dev_dbg(&udev->dev, "Hub-initiated %s disabled " -- "at request of driver %s\n", -- state_name, driver->name); -- return xhci_get_timeout_no_hub_lpm(udev, state); -+ dev_dbg(&udev->dev, "Hub-initiated %s disabled at request of driver %s\n", -+ state_name, driver->name); -+ timeout = xhci_get_timeout_no_hub_lpm(udev, -+ state); -+ if (timeout == USB3_LPM_DISABLED) -+ return timeout; - } - } - -diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c -index a4dbb0cd80da..0fecc002fa9f 100644 ---- a/drivers/usb/image/microtek.c -+++ b/drivers/usb/image/microtek.c -@@ -724,6 +724,10 @@ static int mts_usb_probe(struct usb_interface *intf, - - } - -+ if (ep_in_current != &ep_in_set[2]) { -+ MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n"); -+ return -ENODEV; -+ } - - if ( ep_out == -1 ) { - MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" ); -diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig -index f7a7fc21be8a..c7383c41c90e 100644 ---- a/drivers/usb/misc/Kconfig -+++ b/drivers/usb/misc/Kconfig -@@ -46,16 +46,6 @@ config USB_SEVSEG - To compile this driver as a module, choose M here: the - module will be called usbsevseg. - --config USB_RIO500 -- tristate "USB Diamond Rio500 support" -- help -- Say Y here if you want to connect a USB Rio500 mp3 player to your -- computer's USB port. Please read -- for more information. -- -- To compile this driver as a module, choose M here: the -- module will be called rio500. -- - config USB_LEGOTOWER - tristate "USB Lego Infrared Tower support" - help -diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile -index 45fd4ac39d3e..0cbdd77363f2 100644 ---- a/drivers/usb/misc/Makefile -+++ b/drivers/usb/misc/Makefile -@@ -17,7 +17,6 @@ obj-$(CONFIG_USB_LCD) += usblcd.o - obj-$(CONFIG_USB_LD) += ldusb.o - obj-$(CONFIG_USB_LED) += usbled.o - obj-$(CONFIG_USB_LEGOTOWER) += legousbtower.o --obj-$(CONFIG_USB_RIO500) += rio500.o - obj-$(CONFIG_USB_TEST) += usbtest.o - obj-$(CONFIG_USB_EHSET_TEST_FIXTURE) += ehset.o - obj-$(CONFIG_USB_TRANCEVIBRATOR) += trancevibrator.o -diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c -index 3071c0ef909b..6d849e7dc842 100644 ---- a/drivers/usb/misc/adutux.c -+++ b/drivers/usb/misc/adutux.c -@@ -80,6 +80,7 @@ struct adu_device { - char serial_number[8]; - - int open_count; /* number of times this port has been opened */ -+ unsigned long disconnected:1; - - char *read_buffer_primary; - int read_buffer_length; -@@ -121,7 +122,7 @@ static void adu_abort_transfers(struct adu_device *dev) - { - unsigned long flags; - -- if (dev->udev == NULL) -+ if (dev->disconnected) - return; - - /* shutdown transfer */ -@@ -151,6 +152,7 @@ static void adu_delete(struct adu_device *dev) - kfree(dev->read_buffer_secondary); - kfree(dev->interrupt_in_buffer); - kfree(dev->interrupt_out_buffer); -+ usb_put_dev(dev->udev); - kfree(dev); - } - -@@ -244,7 +246,7 @@ static int adu_open(struct inode *inode, struct file *file) - } - - dev = usb_get_intfdata(interface); -- if (!dev || !dev->udev) { -+ if (!dev) { - retval = -ENODEV; - goto exit_no_device; - } -@@ -327,7 +329,7 @@ static int adu_release(struct inode *inode, struct file *file) - } - - adu_release_internal(dev); -- if (dev->udev == NULL) { -+ if (dev->disconnected) { - /* the device was unplugged before the file was released */ - if (!dev->open_count) /* ... and we're the last user */ - adu_delete(dev); -@@ -356,7 +358,7 @@ static ssize_t adu_read(struct file *file, __user char *buffer, size_t count, - return -ERESTARTSYS; - - /* verify that the device wasn't unplugged */ -- if (dev->udev == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - pr_err("No device or device unplugged %d\n", retval); - goto exit; -@@ -525,7 +527,7 @@ static ssize_t adu_write(struct file *file, const __user char *buffer, - goto exit_nolock; - - /* verify that the device wasn't unplugged */ -- if (dev->udev == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - pr_err("No device or device unplugged %d\n", retval); - goto exit; -@@ -680,7 +682,7 @@ static int adu_probe(struct usb_interface *interface, - - mutex_init(&dev->mtx); - spin_lock_init(&dev->buflock); -- dev->udev = udev; -+ dev->udev = usb_get_dev(udev); - init_waitqueue_head(&dev->read_wait); - init_waitqueue_head(&dev->write_wait); - -@@ -800,19 +802,21 @@ error: - static void adu_disconnect(struct usb_interface *interface) - { - struct adu_device *dev; -- int minor; - - dev = usb_get_intfdata(interface); - -- mutex_lock(&dev->mtx); /* not interruptible */ -- dev->udev = NULL; /* poison */ -- minor = dev->minor; - usb_deregister_dev(interface, &adu_class); -- mutex_unlock(&dev->mtx); -+ -+ usb_poison_urb(dev->interrupt_in_urb); -+ usb_poison_urb(dev->interrupt_out_urb); - - mutex_lock(&adutux_mutex); - usb_set_intfdata(interface, NULL); - -+ mutex_lock(&dev->mtx); /* not interruptible */ -+ dev->disconnected = 1; -+ mutex_unlock(&dev->mtx); -+ - /* if the device is not opened, then we clean up right now */ - if (!dev->open_count) - adu_delete(dev); -diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c -index 23c794813e6a..a3692811248b 100644 ---- a/drivers/usb/misc/chaoskey.c -+++ b/drivers/usb/misc/chaoskey.c -@@ -96,6 +96,7 @@ static void chaoskey_free(struct chaoskey *dev) - usb_dbg(dev->interface, "free"); - kfree(dev->name); - kfree(dev->buf); -+ usb_put_intf(dev->interface); - kfree(dev); - } - -@@ -144,6 +145,8 @@ static int chaoskey_probe(struct usb_interface *interface, - if (dev == NULL) - return -ENOMEM; - -+ dev->interface = usb_get_intf(interface); -+ - dev->buf = kmalloc(size, GFP_KERNEL); - - if (dev->buf == NULL) { -@@ -169,8 +172,6 @@ static int chaoskey_probe(struct usb_interface *interface, - strcat(dev->name, udev->serial); - } - -- dev->interface = interface; -- - dev->in_ep = in_ep; - - dev->size = size; -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index 836fb65c3c72..83342e579233 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -89,6 +89,7 @@ struct iowarrior { - char chip_serial[9]; /* the serial number string of the chip connected */ - int report_size; /* number of bytes in a report */ - u16 product_id; -+ struct usb_anchor submitted; - }; - - /*--------------*/ -@@ -248,6 +249,7 @@ static inline void iowarrior_delete(struct iowarrior *dev) - kfree(dev->int_in_buffer); - usb_free_urb(dev->int_in_urb); - kfree(dev->read_queue); -+ usb_put_intf(dev->interface); - kfree(dev); - } - -@@ -436,11 +438,13 @@ static ssize_t iowarrior_write(struct file *file, - retval = -EFAULT; - goto error; - } -+ usb_anchor_urb(int_out_urb, &dev->submitted); - retval = usb_submit_urb(int_out_urb, GFP_KERNEL); - if (retval) { - dev_dbg(&dev->interface->dev, - "submit error %d for urb nr.%d\n", - retval, atomic_read(&dev->write_busy)); -+ usb_unanchor_urb(int_out_urb); - goto error; - } - /* submit was ok */ -@@ -782,11 +786,13 @@ static int iowarrior_probe(struct usb_interface *interface, - init_waitqueue_head(&dev->write_wait); - - dev->udev = udev; -- dev->interface = interface; -+ dev->interface = usb_get_intf(interface); - - iface_desc = interface->cur_altsetting; - dev->product_id = le16_to_cpu(udev->descriptor.idProduct); - -+ init_usb_anchor(&dev->submitted); -+ - /* set up the endpoint information */ - for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { - endpoint = &iface_desc->endpoint[i].desc; -@@ -898,8 +904,6 @@ static void iowarrior_disconnect(struct usb_interface *interface) - dev = usb_get_intfdata(interface); - mutex_lock(&iowarrior_open_disc_lock); - usb_set_intfdata(interface, NULL); -- /* prevent device read, write and ioctl */ -- dev->present = 0; - - minor = dev->minor; - mutex_unlock(&iowarrior_open_disc_lock); -@@ -910,8 +914,7 @@ static void iowarrior_disconnect(struct usb_interface *interface) - mutex_lock(&dev->mutex); - - /* prevent device read, write and ioctl */ -- -- mutex_unlock(&dev->mutex); -+ dev->present = 0; - - if (dev->opened) { - /* There is a process that holds a filedescriptor to the device , -@@ -919,10 +922,13 @@ static void iowarrior_disconnect(struct usb_interface *interface) - Deleting the device is postponed until close() was called. - */ - usb_kill_urb(dev->int_in_urb); -+ usb_kill_anchored_urbs(&dev->submitted); - wake_up_interruptible(&dev->read_wait); - wake_up_interruptible(&dev->write_wait); -+ mutex_unlock(&dev->mutex); - } else { - /* no process is using the device, cleanup now */ -+ mutex_unlock(&dev->mutex); - iowarrior_delete(dev); - } - -diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c -index e9113238d9e3..84f12c1bf9e6 100644 ---- a/drivers/usb/misc/ldusb.c -+++ b/drivers/usb/misc/ldusb.c -@@ -158,6 +158,7 @@ MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in - struct ld_usb { - struct mutex mutex; /* locks this structure */ - struct usb_interface* intf; /* save off the usb interface pointer */ -+ unsigned long disconnected:1; - - int open_count; /* number of times this port has been opened */ - -@@ -197,12 +198,10 @@ static void ld_usb_abort_transfers(struct ld_usb *dev) - /* shutdown transfer */ - if (dev->interrupt_in_running) { - dev->interrupt_in_running = 0; -- if (dev->intf) -- usb_kill_urb(dev->interrupt_in_urb); -+ usb_kill_urb(dev->interrupt_in_urb); - } - if (dev->interrupt_out_busy) -- if (dev->intf) -- usb_kill_urb(dev->interrupt_out_urb); -+ usb_kill_urb(dev->interrupt_out_urb); - } - - /** -@@ -210,8 +209,6 @@ static void ld_usb_abort_transfers(struct ld_usb *dev) - */ - static void ld_usb_delete(struct ld_usb *dev) - { -- ld_usb_abort_transfers(dev); -- - /* free data structures */ - usb_free_urb(dev->interrupt_in_urb); - usb_free_urb(dev->interrupt_out_urb); -@@ -267,7 +264,7 @@ static void ld_usb_interrupt_in_callback(struct urb *urb) - - resubmit: - /* resubmit if we're still running */ -- if (dev->interrupt_in_running && !dev->buffer_overflow && dev->intf) { -+ if (dev->interrupt_in_running && !dev->buffer_overflow) { - retval = usb_submit_urb(dev->interrupt_in_urb, GFP_ATOMIC); - if (retval) { - dev_err(&dev->intf->dev, -@@ -396,7 +393,7 @@ static int ld_usb_release(struct inode *inode, struct file *file) - retval = -ENODEV; - goto unlock_exit; - } -- if (dev->intf == NULL) { -+ if (dev->disconnected) { - /* the device was unplugged before the file was released */ - mutex_unlock(&dev->mutex); - /* unlock here as ld_usb_delete frees dev */ -@@ -427,7 +424,7 @@ static unsigned int ld_usb_poll(struct file *file, poll_table *wait) - - dev = file->private_data; - -- if (!dev->intf) -+ if (dev->disconnected) - return POLLERR | POLLHUP; - - poll_wait(file, &dev->read_wait, wait); -@@ -466,7 +463,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count, - } - - /* verify that the device wasn't unplugged */ -- if (dev->intf == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval); - goto unlock_exit; -@@ -546,7 +543,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer, - } - - /* verify that the device wasn't unplugged */ -- if (dev->intf == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval); - goto unlock_exit; -@@ -782,6 +779,9 @@ static void ld_usb_disconnect(struct usb_interface *intf) - /* give back our minor */ - usb_deregister_dev(intf, &ld_usb_class); - -+ usb_poison_urb(dev->interrupt_in_urb); -+ usb_poison_urb(dev->interrupt_out_urb); -+ - mutex_lock(&dev->mutex); - - /* if the device is not opened, then we clean up right now */ -@@ -789,7 +789,7 @@ static void ld_usb_disconnect(struct usb_interface *intf) - mutex_unlock(&dev->mutex); - ld_usb_delete(dev); - } else { -- dev->intf = NULL; -+ dev->disconnected = 1; - /* wake up pollers */ - wake_up_interruptible_all(&dev->read_wait); - wake_up_interruptible_all(&dev->write_wait); -diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c -index 0ec9ee573ffa..20e3d577ae5d 100644 ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -185,7 +185,6 @@ static const struct usb_device_id tower_table[] = { - }; - - MODULE_DEVICE_TABLE (usb, tower_table); --static DEFINE_MUTEX(open_disc_mutex); - - #define LEGO_USB_TOWER_MINOR_BASE 160 - -@@ -197,6 +196,7 @@ struct lego_usb_tower { - unsigned char minor; /* the starting minor number for this device */ - - int open_count; /* number of times this port has been opened */ -+ unsigned long disconnected:1; - - char* read_buffer; - size_t read_buffer_length; /* this much came in */ -@@ -296,14 +296,13 @@ static inline void lego_usb_tower_debug_data(struct device *dev, - */ - static inline void tower_delete (struct lego_usb_tower *dev) - { -- tower_abort_transfers (dev); -- - /* free data structures */ - usb_free_urb(dev->interrupt_in_urb); - usb_free_urb(dev->interrupt_out_urb); - kfree (dev->read_buffer); - kfree (dev->interrupt_in_buffer); - kfree (dev->interrupt_out_buffer); -+ usb_put_dev(dev->udev); - kfree (dev); - } - -@@ -338,18 +337,14 @@ static int tower_open (struct inode *inode, struct file *file) - goto exit; - } - -- mutex_lock(&open_disc_mutex); - dev = usb_get_intfdata(interface); -- - if (!dev) { -- mutex_unlock(&open_disc_mutex); - retval = -ENODEV; - goto exit; - } - - /* lock this device */ - if (mutex_lock_interruptible(&dev->lock)) { -- mutex_unlock(&open_disc_mutex); - retval = -ERESTARTSYS; - goto exit; - } -@@ -357,12 +352,9 @@ static int tower_open (struct inode *inode, struct file *file) - - /* allow opening only once */ - if (dev->open_count) { -- mutex_unlock(&open_disc_mutex); - retval = -EBUSY; - goto unlock_exit; - } -- dev->open_count = 1; -- mutex_unlock(&open_disc_mutex); - - /* reset the tower */ - result = usb_control_msg (dev->udev, -@@ -402,13 +394,14 @@ static int tower_open (struct inode *inode, struct file *file) - dev_err(&dev->udev->dev, - "Couldn't submit interrupt_in_urb %d\n", retval); - dev->interrupt_in_running = 0; -- dev->open_count = 0; - goto unlock_exit; - } - - /* save device in the file's private structure */ - file->private_data = dev; - -+ dev->open_count = 1; -+ - unlock_exit: - mutex_unlock(&dev->lock); - -@@ -429,10 +422,9 @@ static int tower_release (struct inode *inode, struct file *file) - - if (dev == NULL) { - retval = -ENODEV; -- goto exit_nolock; -+ goto exit; - } - -- mutex_lock(&open_disc_mutex); - if (mutex_lock_interruptible(&dev->lock)) { - retval = -ERESTARTSYS; - goto exit; -@@ -444,7 +436,8 @@ static int tower_release (struct inode *inode, struct file *file) - retval = -ENODEV; - goto unlock_exit; - } -- if (dev->udev == NULL) { -+ -+ if (dev->disconnected) { - /* the device was unplugged before the file was released */ - - /* unlock here as tower_delete frees dev */ -@@ -462,10 +455,7 @@ static int tower_release (struct inode *inode, struct file *file) - - unlock_exit: - mutex_unlock(&dev->lock); -- - exit: -- mutex_unlock(&open_disc_mutex); --exit_nolock: - return retval; - } - -@@ -483,10 +473,9 @@ static void tower_abort_transfers (struct lego_usb_tower *dev) - if (dev->interrupt_in_running) { - dev->interrupt_in_running = 0; - mb(); -- if (dev->udev) -- usb_kill_urb (dev->interrupt_in_urb); -+ usb_kill_urb(dev->interrupt_in_urb); - } -- if (dev->interrupt_out_busy && dev->udev) -+ if (dev->interrupt_out_busy) - usb_kill_urb(dev->interrupt_out_urb); - } - -@@ -522,7 +511,7 @@ static unsigned int tower_poll (struct file *file, poll_table *wait) - - dev = file->private_data; - -- if (!dev->udev) -+ if (dev->disconnected) - return POLLERR | POLLHUP; - - poll_wait(file, &dev->read_wait, wait); -@@ -569,7 +558,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, - } - - /* verify that the device wasn't unplugged */ -- if (dev->udev == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - pr_err("No device or device unplugged %d\n", retval); - goto unlock_exit; -@@ -655,7 +644,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t - } - - /* verify that the device wasn't unplugged */ -- if (dev->udev == NULL) { -+ if (dev->disconnected) { - retval = -ENODEV; - pr_err("No device or device unplugged %d\n", retval); - goto unlock_exit; -@@ -764,7 +753,7 @@ static void tower_interrupt_in_callback (struct urb *urb) - - resubmit: - /* resubmit if we're still running */ -- if (dev->interrupt_in_running && dev->udev) { -+ if (dev->interrupt_in_running) { - retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC); - if (retval) - dev_err(&dev->udev->dev, -@@ -832,8 +821,9 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - - mutex_init(&dev->lock); - -- dev->udev = udev; -+ dev->udev = usb_get_dev(udev); - dev->open_count = 0; -+ dev->disconnected = 0; - - dev->read_buffer = NULL; - dev->read_buffer_length = 0; -@@ -923,8 +913,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - get_version_reply, - sizeof(*get_version_reply), - 1000); -- if (result < 0) { -- dev_err(idev, "LEGO USB Tower get version control request failed\n"); -+ if (result < sizeof(*get_version_reply)) { -+ if (result >= 0) -+ result = -EIO; -+ dev_err(idev, "get version request failed: %d\n", result); - retval = result; - goto error; - } -@@ -942,7 +934,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - if (retval) { - /* something prevented us from registering this driver */ - dev_err(idev, "Not able to get a minor for this device.\n"); -- usb_set_intfdata (interface, NULL); - goto error; - } - dev->minor = interface->minor; -@@ -974,23 +965,24 @@ static void tower_disconnect (struct usb_interface *interface) - int minor; - - dev = usb_get_intfdata (interface); -- mutex_lock(&open_disc_mutex); -- usb_set_intfdata (interface, NULL); - - minor = dev->minor; - -- /* give back our minor */ -+ /* give back our minor and prevent further open() */ - usb_deregister_dev (interface, &tower_class); - -+ /* stop I/O */ -+ usb_poison_urb(dev->interrupt_in_urb); -+ usb_poison_urb(dev->interrupt_out_urb); -+ - mutex_lock(&dev->lock); -- mutex_unlock(&open_disc_mutex); - - /* if the device is not opened, then we clean up right now */ - if (!dev->open_count) { - mutex_unlock(&dev->lock); - tower_delete (dev); - } else { -- dev->udev = NULL; -+ dev->disconnected = 1; - /* wake up pollers */ - wake_up_interruptible_all(&dev->read_wait); - wake_up_interruptible_all(&dev->write_wait); -diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c -deleted file mode 100644 -index 6e761fabffca..000000000000 ---- a/drivers/usb/misc/rio500.c -+++ /dev/null -@@ -1,578 +0,0 @@ --/* -*- linux-c -*- */ -- --/* -- * Driver for USB Rio 500 -- * -- * Cesar Miquel (miquel@df.uba.ar) -- * -- * based on hp_scanner.c by David E. Nelson (dnelson@jump.net) -- * -- * This program is free software; you can redistribute it and/or -- * modify it under the terms of the GNU General Public License as -- * published by the Free Software Foundation; either version 2 of the -- * License, or (at your option) any later version. -- * -- * This program is distributed in the hope that it will be useful, but -- * WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -- * General Public License for more details. -- * -- * You should have received a copy of the GNU General Public License -- * along with this program; if not, write to the Free Software -- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -- * -- * Based upon mouse.c (Brad Keryan) and printer.c (Michael Gee). -- * -- * Changelog: -- * 30/05/2003 replaced lock/unlock kernel with up/down -- * Daniele Bellucci bellucda@tiscali.it -- * */ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "rio500_usb.h" -- --/* -- * Version Information -- */ --#define DRIVER_VERSION "v1.1" --#define DRIVER_AUTHOR "Cesar Miquel " --#define DRIVER_DESC "USB Rio 500 driver" -- --#define RIO_MINOR 64 -- --/* stall/wait timeout for rio */ --#define NAK_TIMEOUT (HZ) -- --#define IBUF_SIZE 0x1000 -- --/* Size of the rio buffer */ --#define OBUF_SIZE 0x10000 -- --struct rio_usb_data { -- struct usb_device *rio_dev; /* init: probe_rio */ -- unsigned int ifnum; /* Interface number of the USB device */ -- int isopen; /* nz if open */ -- int present; /* Device is present on the bus */ -- char *obuf, *ibuf; /* transfer buffers */ -- char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */ -- wait_queue_head_t wait_q; /* for timeouts */ -- struct mutex lock; /* general race avoidance */ --}; -- --static DEFINE_MUTEX(rio500_mutex); --static struct rio_usb_data rio_instance; -- --static int open_rio(struct inode *inode, struct file *file) --{ -- struct rio_usb_data *rio = &rio_instance; -- -- /* against disconnect() */ -- mutex_lock(&rio500_mutex); -- mutex_lock(&(rio->lock)); -- -- if (rio->isopen || !rio->present) { -- mutex_unlock(&(rio->lock)); -- mutex_unlock(&rio500_mutex); -- return -EBUSY; -- } -- rio->isopen = 1; -- -- init_waitqueue_head(&rio->wait_q); -- -- mutex_unlock(&(rio->lock)); -- -- dev_info(&rio->rio_dev->dev, "Rio opened.\n"); -- mutex_unlock(&rio500_mutex); -- -- return 0; --} -- --static int close_rio(struct inode *inode, struct file *file) --{ -- struct rio_usb_data *rio = &rio_instance; -- -- /* against disconnect() */ -- mutex_lock(&rio500_mutex); -- mutex_lock(&(rio->lock)); -- -- rio->isopen = 0; -- if (!rio->present) { -- /* cleanup has been delayed */ -- kfree(rio->ibuf); -- kfree(rio->obuf); -- rio->ibuf = NULL; -- rio->obuf = NULL; -- } else { -- dev_info(&rio->rio_dev->dev, "Rio closed.\n"); -- } -- mutex_unlock(&(rio->lock)); -- mutex_unlock(&rio500_mutex); -- return 0; --} -- --static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg) --{ -- struct RioCommand rio_cmd; -- struct rio_usb_data *rio = &rio_instance; -- void __user *data; -- unsigned char *buffer; -- int result, requesttype; -- int retries; -- int retval=0; -- -- mutex_lock(&(rio->lock)); -- /* Sanity check to make sure rio is connected, powered, etc */ -- if (rio->present == 0 || rio->rio_dev == NULL) { -- retval = -ENODEV; -- goto err_out; -- } -- -- switch (cmd) { -- case RIO_RECV_COMMAND: -- data = (void __user *) arg; -- if (data == NULL) -- break; -- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) { -- retval = -EFAULT; -- goto err_out; -- } -- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) { -- retval = -EINVAL; -- goto err_out; -- } -- buffer = (unsigned char *) __get_free_page(GFP_KERNEL); -- if (buffer == NULL) { -- retval = -ENOMEM; -- goto err_out; -- } -- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) { -- retval = -EFAULT; -- free_page((unsigned long) buffer); -- goto err_out; -- } -- -- requesttype = rio_cmd.requesttype | USB_DIR_IN | -- USB_TYPE_VENDOR | USB_RECIP_DEVICE; -- dev_dbg(&rio->rio_dev->dev, -- "sending command:reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n", -- requesttype, rio_cmd.request, rio_cmd.value, -- rio_cmd.index, rio_cmd.length); -- /* Send rio control message */ -- retries = 3; -- while (retries) { -- result = usb_control_msg(rio->rio_dev, -- usb_rcvctrlpipe(rio-> rio_dev, 0), -- rio_cmd.request, -- requesttype, -- rio_cmd.value, -- rio_cmd.index, buffer, -- rio_cmd.length, -- jiffies_to_msecs(rio_cmd.timeout)); -- if (result == -ETIMEDOUT) -- retries--; -- else if (result < 0) { -- dev_err(&rio->rio_dev->dev, -- "Error executing ioctrl. code = %d\n", -- result); -- retries = 0; -- } else { -- dev_dbg(&rio->rio_dev->dev, -- "Executed ioctl. Result = %d (data=%02x)\n", -- result, buffer[0]); -- if (copy_to_user(rio_cmd.buffer, buffer, -- rio_cmd.length)) { -- free_page((unsigned long) buffer); -- retval = -EFAULT; -- goto err_out; -- } -- retries = 0; -- } -- -- /* rio_cmd.buffer contains a raw stream of single byte -- data which has been returned from rio. Data is -- interpreted at application level. For data that -- will be cast to data types longer than 1 byte, data -- will be little_endian and will potentially need to -- be swapped at the app level */ -- -- } -- free_page((unsigned long) buffer); -- break; -- -- case RIO_SEND_COMMAND: -- data = (void __user *) arg; -- if (data == NULL) -- break; -- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) { -- retval = -EFAULT; -- goto err_out; -- } -- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) { -- retval = -EINVAL; -- goto err_out; -- } -- buffer = (unsigned char *) __get_free_page(GFP_KERNEL); -- if (buffer == NULL) { -- retval = -ENOMEM; -- goto err_out; -- } -- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) { -- free_page((unsigned long)buffer); -- retval = -EFAULT; -- goto err_out; -- } -- -- requesttype = rio_cmd.requesttype | USB_DIR_OUT | -- USB_TYPE_VENDOR | USB_RECIP_DEVICE; -- dev_dbg(&rio->rio_dev->dev, -- "sending command: reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n", -- requesttype, rio_cmd.request, rio_cmd.value, -- rio_cmd.index, rio_cmd.length); -- /* Send rio control message */ -- retries = 3; -- while (retries) { -- result = usb_control_msg(rio->rio_dev, -- usb_sndctrlpipe(rio-> rio_dev, 0), -- rio_cmd.request, -- requesttype, -- rio_cmd.value, -- rio_cmd.index, buffer, -- rio_cmd.length, -- jiffies_to_msecs(rio_cmd.timeout)); -- if (result == -ETIMEDOUT) -- retries--; -- else if (result < 0) { -- dev_err(&rio->rio_dev->dev, -- "Error executing ioctrl. code = %d\n", -- result); -- retries = 0; -- } else { -- dev_dbg(&rio->rio_dev->dev, -- "Executed ioctl. Result = %d\n", result); -- retries = 0; -- -- } -- -- } -- free_page((unsigned long) buffer); -- break; -- -- default: -- retval = -ENOTTY; -- break; -- } -- -- --err_out: -- mutex_unlock(&(rio->lock)); -- return retval; --} -- --static ssize_t --write_rio(struct file *file, const char __user *buffer, -- size_t count, loff_t * ppos) --{ -- DEFINE_WAIT(wait); -- struct rio_usb_data *rio = &rio_instance; -- -- unsigned long copy_size; -- unsigned long bytes_written = 0; -- unsigned int partial; -- -- int result = 0; -- int maxretry; -- int errn = 0; -- int intr; -- -- intr = mutex_lock_interruptible(&(rio->lock)); -- if (intr) -- return -EINTR; -- /* Sanity check to make sure rio is connected, powered, etc */ -- if (rio->present == 0 || rio->rio_dev == NULL) { -- mutex_unlock(&(rio->lock)); -- return -ENODEV; -- } -- -- -- -- do { -- unsigned long thistime; -- char *obuf = rio->obuf; -- -- thistime = copy_size = -- (count >= OBUF_SIZE) ? OBUF_SIZE : count; -- if (copy_from_user(rio->obuf, buffer, copy_size)) { -- errn = -EFAULT; -- goto error; -- } -- maxretry = 5; -- while (thistime) { -- if (!rio->rio_dev) { -- errn = -ENODEV; -- goto error; -- } -- if (signal_pending(current)) { -- mutex_unlock(&(rio->lock)); -- return bytes_written ? bytes_written : -EINTR; -- } -- -- result = usb_bulk_msg(rio->rio_dev, -- usb_sndbulkpipe(rio->rio_dev, 2), -- obuf, thistime, &partial, 5000); -- -- dev_dbg(&rio->rio_dev->dev, -- "write stats: result:%d thistime:%lu partial:%u\n", -- result, thistime, partial); -- -- if (result == -ETIMEDOUT) { /* NAK - so hold for a while */ -- if (!maxretry--) { -- errn = -ETIME; -- goto error; -- } -- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE); -- schedule_timeout(NAK_TIMEOUT); -- finish_wait(&rio->wait_q, &wait); -- continue; -- } else if (!result && partial) { -- obuf += partial; -- thistime -= partial; -- } else -- break; -- } -- if (result) { -- dev_err(&rio->rio_dev->dev, "Write Whoops - %x\n", -- result); -- errn = -EIO; -- goto error; -- } -- bytes_written += copy_size; -- count -= copy_size; -- buffer += copy_size; -- } while (count > 0); -- -- mutex_unlock(&(rio->lock)); -- -- return bytes_written ? bytes_written : -EIO; -- --error: -- mutex_unlock(&(rio->lock)); -- return errn; --} -- --static ssize_t --read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos) --{ -- DEFINE_WAIT(wait); -- struct rio_usb_data *rio = &rio_instance; -- ssize_t read_count; -- unsigned int partial; -- int this_read; -- int result; -- int maxretry = 10; -- char *ibuf; -- int intr; -- -- intr = mutex_lock_interruptible(&(rio->lock)); -- if (intr) -- return -EINTR; -- /* Sanity check to make sure rio is connected, powered, etc */ -- if (rio->present == 0 || rio->rio_dev == NULL) { -- mutex_unlock(&(rio->lock)); -- return -ENODEV; -- } -- -- ibuf = rio->ibuf; -- -- read_count = 0; -- -- -- while (count > 0) { -- if (signal_pending(current)) { -- mutex_unlock(&(rio->lock)); -- return read_count ? read_count : -EINTR; -- } -- if (!rio->rio_dev) { -- mutex_unlock(&(rio->lock)); -- return -ENODEV; -- } -- this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count; -- -- result = usb_bulk_msg(rio->rio_dev, -- usb_rcvbulkpipe(rio->rio_dev, 1), -- ibuf, this_read, &partial, -- 8000); -- -- dev_dbg(&rio->rio_dev->dev, -- "read stats: result:%d this_read:%u partial:%u\n", -- result, this_read, partial); -- -- if (partial) { -- count = this_read = partial; -- } else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */ -- if (!maxretry--) { -- mutex_unlock(&(rio->lock)); -- dev_err(&rio->rio_dev->dev, -- "read_rio: maxretry timeout\n"); -- return -ETIME; -- } -- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE); -- schedule_timeout(NAK_TIMEOUT); -- finish_wait(&rio->wait_q, &wait); -- continue; -- } else if (result != -EREMOTEIO) { -- mutex_unlock(&(rio->lock)); -- dev_err(&rio->rio_dev->dev, -- "Read Whoops - result:%u partial:%u this_read:%u\n", -- result, partial, this_read); -- return -EIO; -- } else { -- mutex_unlock(&(rio->lock)); -- return (0); -- } -- -- if (this_read) { -- if (copy_to_user(buffer, ibuf, this_read)) { -- mutex_unlock(&(rio->lock)); -- return -EFAULT; -- } -- count -= this_read; -- read_count += this_read; -- buffer += this_read; -- } -- } -- mutex_unlock(&(rio->lock)); -- return read_count; --} -- --static const struct file_operations usb_rio_fops = { -- .owner = THIS_MODULE, -- .read = read_rio, -- .write = write_rio, -- .unlocked_ioctl = ioctl_rio, -- .open = open_rio, -- .release = close_rio, -- .llseek = noop_llseek, --}; -- --static struct usb_class_driver usb_rio_class = { -- .name = "rio500%d", -- .fops = &usb_rio_fops, -- .minor_base = RIO_MINOR, --}; -- --static int probe_rio(struct usb_interface *intf, -- const struct usb_device_id *id) --{ -- struct usb_device *dev = interface_to_usbdev(intf); -- struct rio_usb_data *rio = &rio_instance; -- int retval = 0; -- -- mutex_lock(&rio500_mutex); -- if (rio->present) { -- dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum); -- retval = -EBUSY; -- goto bail_out; -- } else { -- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum); -- } -- -- retval = usb_register_dev(intf, &usb_rio_class); -- if (retval) { -- dev_err(&dev->dev, -- "Not able to get a minor for this device.\n"); -- retval = -ENOMEM; -- goto bail_out; -- } -- -- rio->rio_dev = dev; -- -- if (!(rio->obuf = kmalloc(OBUF_SIZE, GFP_KERNEL))) { -- dev_err(&dev->dev, -- "probe_rio: Not enough memory for the output buffer\n"); -- usb_deregister_dev(intf, &usb_rio_class); -- retval = -ENOMEM; -- goto bail_out; -- } -- dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf); -- -- if (!(rio->ibuf = kmalloc(IBUF_SIZE, GFP_KERNEL))) { -- dev_err(&dev->dev, -- "probe_rio: Not enough memory for the input buffer\n"); -- usb_deregister_dev(intf, &usb_rio_class); -- kfree(rio->obuf); -- retval = -ENOMEM; -- goto bail_out; -- } -- dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf); -- -- mutex_init(&(rio->lock)); -- -- usb_set_intfdata (intf, rio); -- rio->present = 1; --bail_out: -- mutex_unlock(&rio500_mutex); -- -- return retval; --} -- --static void disconnect_rio(struct usb_interface *intf) --{ -- struct rio_usb_data *rio = usb_get_intfdata (intf); -- -- usb_set_intfdata (intf, NULL); -- mutex_lock(&rio500_mutex); -- if (rio) { -- usb_deregister_dev(intf, &usb_rio_class); -- -- mutex_lock(&(rio->lock)); -- if (rio->isopen) { -- rio->isopen = 0; -- /* better let it finish - the release will do whats needed */ -- rio->rio_dev = NULL; -- mutex_unlock(&(rio->lock)); -- mutex_unlock(&rio500_mutex); -- return; -- } -- kfree(rio->ibuf); -- kfree(rio->obuf); -- -- dev_info(&intf->dev, "USB Rio disconnected.\n"); -- -- rio->present = 0; -- mutex_unlock(&(rio->lock)); -- } -- mutex_unlock(&rio500_mutex); --} -- --static const struct usb_device_id rio_table[] = { -- { USB_DEVICE(0x0841, 1) }, /* Rio 500 */ -- { } /* Terminating entry */ --}; -- --MODULE_DEVICE_TABLE (usb, rio_table); -- --static struct usb_driver rio_driver = { -- .name = "rio500", -- .probe = probe_rio, -- .disconnect = disconnect_rio, -- .id_table = rio_table, --}; -- --module_usb_driver(rio_driver); -- --MODULE_AUTHOR( DRIVER_AUTHOR ); --MODULE_DESCRIPTION( DRIVER_DESC ); --MODULE_LICENSE("GPL"); -- -diff --git a/drivers/usb/misc/rio500_usb.h b/drivers/usb/misc/rio500_usb.h -deleted file mode 100644 -index 359abc98e706..000000000000 ---- a/drivers/usb/misc/rio500_usb.h -+++ /dev/null -@@ -1,37 +0,0 @@ --/* ---------------------------------------------------------------------- -- -- Copyright (C) 2000 Cesar Miquel (miquel@df.uba.ar) -- -- This program is free software; you can redistribute it and/or modify -- it under the terms of the GNU General Public License as published by -- the Free Software Foundation; either version 2 of the License, or -- (at your option) any later version. -- -- This program is distributed in the hope that it will be useful, -- but WITHOUT ANY WARRANTY; without even the implied warranty of -- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -- GNU General Public License for more details. -- -- You should have received a copy of the GNU General Public License -- along with this program; if not, write to the Free Software -- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -- -- ---------------------------------------------------------------------- */ -- -- -- --#define RIO_SEND_COMMAND 0x1 --#define RIO_RECV_COMMAND 0x2 -- --#define RIO_DIR_OUT 0x0 --#define RIO_DIR_IN 0x1 -- --struct RioCommand { -- short length; -- int request; -- int requesttype; -- int value; -- int index; -- void __user *buffer; -- int timeout; --}; -diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c -index 1184390508e9..c77974fab29d 100644 ---- a/drivers/usb/misc/usblcd.c -+++ b/drivers/usb/misc/usblcd.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -56,6 +57,8 @@ struct usb_lcd { - using up all RAM */ - struct usb_anchor submitted; /* URBs to wait for - before suspend */ -+ struct rw_semaphore io_rwsem; -+ unsigned long disconnected:1; - }; - #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref) - -@@ -141,6 +144,13 @@ static ssize_t lcd_read(struct file *file, char __user * buffer, - - dev = file->private_data; - -+ down_read(&dev->io_rwsem); -+ -+ if (dev->disconnected) { -+ retval = -ENODEV; -+ goto out_up_io; -+ } -+ - /* do a blocking bulk read to get data from the device */ - retval = usb_bulk_msg(dev->udev, - usb_rcvbulkpipe(dev->udev, -@@ -157,6 +167,9 @@ static ssize_t lcd_read(struct file *file, char __user * buffer, - retval = bytes_read; - } - -+out_up_io: -+ up_read(&dev->io_rwsem); -+ - return retval; - } - -@@ -236,11 +249,18 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, - if (r < 0) - return -EINTR; - -+ down_read(&dev->io_rwsem); -+ -+ if (dev->disconnected) { -+ retval = -ENODEV; -+ goto err_up_io; -+ } -+ - /* create a urb, and a buffer for it, and copy the data to the urb */ - urb = usb_alloc_urb(0, GFP_KERNEL); - if (!urb) { - retval = -ENOMEM; -- goto err_no_buf; -+ goto err_up_io; - } - - buf = usb_alloc_coherent(dev->udev, count, GFP_KERNEL, -@@ -277,6 +297,7 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, - the USB core will eventually free it entirely */ - usb_free_urb(urb); - -+ up_read(&dev->io_rwsem); - exit: - return count; - error_unanchor: -@@ -284,7 +305,8 @@ error_unanchor: - error: - usb_free_coherent(dev->udev, count, buf, urb->transfer_dma); - usb_free_urb(urb); --err_no_buf: -+err_up_io: -+ up_read(&dev->io_rwsem); - up(&dev->limit_sem); - return retval; - } -@@ -327,6 +349,7 @@ static int lcd_probe(struct usb_interface *interface, - } - kref_init(&dev->kref); - sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES); -+ init_rwsem(&dev->io_rwsem); - init_usb_anchor(&dev->submitted); - - dev->udev = usb_get_dev(interface_to_usbdev(interface)); -@@ -437,6 +460,12 @@ static void lcd_disconnect(struct usb_interface *interface) - /* give back our minor */ - usb_deregister_dev(interface, &lcd_class); - -+ down_write(&dev->io_rwsem); -+ dev->disconnected = 1; -+ up_write(&dev->io_rwsem); -+ -+ usb_kill_anchored_urbs(&dev->submitted); -+ - /* decrement our usage count */ - kref_put(&dev->kref, lcd_delete); - -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index 2222ec2275fc..44c6ced5d442 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -64,6 +64,7 @@ struct usb_yurex { - - struct kref kref; - struct mutex io_mutex; -+ unsigned long disconnected:1; - struct fasync_struct *async_queue; - wait_queue_head_t waitq; - -@@ -111,6 +112,7 @@ static void yurex_delete(struct kref *kref) - dev->int_buffer, dev->urb->transfer_dma); - usb_free_urb(dev->urb); - } -+ usb_put_intf(dev->interface); - usb_put_dev(dev->udev); - kfree(dev); - } -@@ -136,6 +138,7 @@ static void yurex_interrupt(struct urb *urb) - switch (status) { - case 0: /*success*/ - break; -+ /* The device is terminated or messed up, give up */ - case -EOVERFLOW: - dev_err(&dev->interface->dev, - "%s - overflow with length %d, actual length is %d\n", -@@ -144,12 +147,13 @@ static void yurex_interrupt(struct urb *urb) - case -ENOENT: - case -ESHUTDOWN: - case -EILSEQ: -- /* The device is terminated, clean up */ -+ case -EPROTO: -+ case -ETIME: - return; - default: - dev_err(&dev->interface->dev, - "%s - unknown status received: %d\n", __func__, status); -- goto exit; -+ return; - } - - /* handle received message */ -@@ -181,7 +185,6 @@ static void yurex_interrupt(struct urb *urb) - break; - } - --exit: - retval = usb_submit_urb(dev->urb, GFP_ATOMIC); - if (retval) { - dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n", -@@ -210,7 +213,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_ - init_waitqueue_head(&dev->waitq); - - dev->udev = usb_get_dev(interface_to_usbdev(interface)); -- dev->interface = interface; -+ dev->interface = usb_get_intf(interface); - - /* set up the endpoint information */ - iface_desc = interface->cur_altsetting; -@@ -333,8 +336,9 @@ static void yurex_disconnect(struct usb_interface *interface) - - /* prevent more I/O from starting */ - usb_poison_urb(dev->urb); -+ usb_poison_urb(dev->cntl_urb); - mutex_lock(&dev->io_mutex); -- dev->interface = NULL; -+ dev->disconnected = 1; - mutex_unlock(&dev->io_mutex); - - /* wakeup waiters */ -@@ -422,7 +426,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, - dev = file->private_data; - - mutex_lock(&dev->io_mutex); -- if (!dev->interface) { /* already disconnected */ -+ if (dev->disconnected) { /* already disconnected */ - mutex_unlock(&dev->io_mutex); - return -ENODEV; - } -@@ -457,7 +461,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, - goto error; - - mutex_lock(&dev->io_mutex); -- if (!dev->interface) { /* already disconnected */ -+ if (dev->disconnected) { /* already disconnected */ - mutex_unlock(&dev->io_mutex); - retval = -ENODEV; - goto error; -diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h -index 8c5fc12ad778..b8620aa6b72e 100644 ---- a/drivers/usb/renesas_usbhs/common.h -+++ b/drivers/usb/renesas_usbhs/common.h -@@ -213,6 +213,7 @@ struct usbhs_priv; - /* DCPCTR */ - #define BSTS (1 << 15) /* Buffer Status */ - #define SUREQ (1 << 14) /* Sending SETUP Token */ -+#define INBUFM (1 << 14) /* (PIPEnCTR) Transfer Buffer Monitor */ - #define CSSTS (1 << 12) /* CSSTS Status */ - #define ACLRM (1 << 9) /* Buffer Auto-Clear Mode */ - #define SQCLR (1 << 8) /* Toggle Bit Clear */ -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index 5e2aa4f85c81..79efb367e5ce 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -98,7 +98,7 @@ static void __usbhsf_pkt_del(struct usbhs_pkt *pkt) - list_del_init(&pkt->node); - } - --static struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe) -+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe) - { - if (list_empty(&pipe->list)) - return NULL; -diff --git a/drivers/usb/renesas_usbhs/fifo.h b/drivers/usb/renesas_usbhs/fifo.h -index c7d9b86d51bf..3640340e94d6 100644 ---- a/drivers/usb/renesas_usbhs/fifo.h -+++ b/drivers/usb/renesas_usbhs/fifo.h -@@ -106,5 +106,6 @@ void usbhs_pkt_push(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt, - void *buf, int len, int zero, int sequence); - struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt); - void usbhs_pkt_start(struct usbhs_pipe *pipe); -+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe); - - #endif /* RENESAS_USB_FIFO_H */ -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index c5553028e616..efe8d815cf2c 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -731,8 +731,7 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge) - struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv); - struct device *dev = usbhsg_gpriv_to_dev(gpriv); - unsigned long flags; -- -- usbhsg_pipe_disable(uep); -+ int ret = 0; - - dev_dbg(dev, "set halt %d (pipe %d)\n", - halt, usbhs_pipe_number(pipe)); -@@ -740,6 +739,18 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge) - /******************** spin lock ********************/ - usbhs_lock(priv, flags); - -+ /* -+ * According to usb_ep_set_halt()'s description, this function should -+ * return -EAGAIN if the IN endpoint has any queue or data. Note -+ * that the usbhs_pipe_is_dir_in() returns false if the pipe is an -+ * IN endpoint in the gadget mode. -+ */ -+ if (!usbhs_pipe_is_dir_in(pipe) && (__usbhsf_pkt_get(pipe) || -+ usbhs_pipe_contains_transmittable_data(pipe))) { -+ ret = -EAGAIN; -+ goto out; -+ } -+ - if (halt) - usbhs_pipe_stall(pipe); - else -@@ -750,10 +761,11 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge) - else - usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE); - -+out: - usbhs_unlock(priv, flags); - /******************** spin unlock ******************/ - -- return 0; -+ return ret; - } - - static int usbhsg_ep_set_halt(struct usb_ep *ep, int value) -diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c -index 4f9c3356127a..75fb41d4e9fc 100644 ---- a/drivers/usb/renesas_usbhs/pipe.c -+++ b/drivers/usb/renesas_usbhs/pipe.c -@@ -279,6 +279,21 @@ int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe) - return -EBUSY; - } - -+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe) -+{ -+ u16 val; -+ -+ /* Do not support for DCP pipe */ -+ if (usbhs_pipe_is_dcp(pipe)) -+ return false; -+ -+ val = usbhsp_pipectrl_get(pipe); -+ if (val & INBUFM) -+ return true; -+ -+ return false; -+} -+ - /* - * PID ctrl - */ -diff --git a/drivers/usb/renesas_usbhs/pipe.h b/drivers/usb/renesas_usbhs/pipe.h -index b0bc7b603016..b7925d363bb4 100644 ---- a/drivers/usb/renesas_usbhs/pipe.h -+++ b/drivers/usb/renesas_usbhs/pipe.h -@@ -89,6 +89,7 @@ void usbhs_pipe_init(struct usbhs_priv *priv, - int usbhs_pipe_get_maxpacket(struct usbhs_pipe *pipe); - void usbhs_pipe_clear(struct usbhs_pipe *pipe); - int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe); -+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe); - void usbhs_pipe_enable(struct usbhs_pipe *pipe); - void usbhs_pipe_disable(struct usbhs_pipe *pipe); - void usbhs_pipe_stall(struct usbhs_pipe *pipe); -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 7edcd5a8d175..2998da6bd901 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1025,6 +1025,9 @@ static const struct usb_device_id id_table_combined[] = { - /* EZPrototypes devices */ - { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, - { USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) }, -+ /* Sienna devices */ -+ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, -+ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index ed6b36674c15..2e8161f79b49 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -38,6 +38,9 @@ - - #define FTDI_LUMEL_PD12_PID 0x6002 - -+/* Sienna Serial Interface by Secyourit GmbH */ -+#define FTDI_SIENNA_PID 0x8348 -+ - /* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */ - #define CYBER_CORTEX_AV_PID 0x8698 - -@@ -687,6 +690,12 @@ - #define BANDB_TTL3USB9M_PID 0xAC50 - #define BANDB_ZZ_PROG1_USB_PID 0xBA02 - -+/* -+ * Echelon USB Serial Interface -+ */ -+#define ECHELON_VID 0x0920 -+#define ECHELON_U20_PID 0x7500 -+ - /* - * Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI - */ -diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c -index 7faa901ee47f..38112be0dbae 100644 ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -1249,8 +1249,8 @@ static struct urb *keyspan_setup_urb(struct usb_serial *serial, int endpoint, - - ep_desc = find_ep(serial, endpoint); - if (!ep_desc) { -- /* leak the urb, something's wrong and the callers don't care */ -- return urb; -+ usb_free_urb(urb); -+ return NULL; - } - if (usb_endpoint_xfer_int(ep_desc)) { - ep_type_name = "INT"; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 1bceb11f3782..00a6e62a68a8 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -421,6 +421,7 @@ static void option_instat_callback(struct urb *urb); - #define CINTERION_PRODUCT_PH8_AUDIO 0x0083 - #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 - #define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 -+#define CINTERION_PRODUCT_CLS8 0x00b0 - - /* Olivetti products */ - #define OLIVETTI_VENDOR_ID 0x0b3c -@@ -1149,6 +1150,14 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), - .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1050, 0xff), /* Telit FN980 (rmnet) */ -+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1051, 0xff), /* Telit FN980 (MBIM) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1052, 0xff), /* Telit FN980 (RNDIS) */ -+ .driver_info = NCTRL(2) | RSVD(3) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */ -+ .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -1842,6 +1851,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, - { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, -+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff), -+ .driver_info = RSVD(0) | RSVD(4) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, - { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, -diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c -index e7e29c797824..80ba818d3a21 100644 ---- a/drivers/usb/serial/usb-serial.c -+++ b/drivers/usb/serial/usb-serial.c -@@ -314,10 +314,7 @@ static void serial_cleanup(struct tty_struct *tty) - serial = port->serial; - owner = serial->type->driver.owner; - -- mutex_lock(&serial->disc_mutex); -- if (!serial->disconnected) -- usb_autopm_put_interface(serial->interface); -- mutex_unlock(&serial->disc_mutex); -+ usb_autopm_put_interface(serial->interface); - - usb_serial_put(serial); - module_put(owner); -diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c -index 545d09b8081d..871c366d9229 100644 ---- a/drivers/usb/usb-skeleton.c -+++ b/drivers/usb/usb-skeleton.c -@@ -63,6 +63,7 @@ struct usb_skel { - spinlock_t err_lock; /* lock for errors */ - struct kref kref; - struct mutex io_mutex; /* synchronize I/O with disconnect */ -+ unsigned long disconnected:1; - wait_queue_head_t bulk_in_wait; /* to wait for an ongoing read */ - }; - #define to_skel_dev(d) container_of(d, struct usb_skel, kref) -@@ -75,6 +76,7 @@ static void skel_delete(struct kref *kref) - struct usb_skel *dev = to_skel_dev(kref); - - usb_free_urb(dev->bulk_in_urb); -+ usb_put_intf(dev->interface); - usb_put_dev(dev->udev); - kfree(dev->bulk_in_buffer); - kfree(dev); -@@ -126,10 +128,7 @@ static int skel_release(struct inode *inode, struct file *file) - return -ENODEV; - - /* allow the device to be autosuspended */ -- mutex_lock(&dev->io_mutex); -- if (dev->interface) -- usb_autopm_put_interface(dev->interface); -- mutex_unlock(&dev->io_mutex); -+ usb_autopm_put_interface(dev->interface); - - /* decrement the count on our device */ - kref_put(&dev->kref, skel_delete); -@@ -241,7 +240,7 @@ static ssize_t skel_read(struct file *file, char *buffer, size_t count, - if (rv < 0) - return rv; - -- if (!dev->interface) { /* disconnect() was called */ -+ if (dev->disconnected) { /* disconnect() was called */ - rv = -ENODEV; - goto exit; - } -@@ -422,7 +421,7 @@ static ssize_t skel_write(struct file *file, const char *user_buffer, - - /* this lock makes sure we don't submit URBs to gone devices */ - mutex_lock(&dev->io_mutex); -- if (!dev->interface) { /* disconnect() was called */ -+ if (dev->disconnected) { /* disconnect() was called */ - mutex_unlock(&dev->io_mutex); - retval = -ENODEV; - goto error; -@@ -511,7 +510,7 @@ static int skel_probe(struct usb_interface *interface, - init_waitqueue_head(&dev->bulk_in_wait); - - dev->udev = usb_get_dev(interface_to_usbdev(interface)); -- dev->interface = interface; -+ dev->interface = usb_get_intf(interface); - - /* set up the endpoint information */ - /* use only the first bulk-in and bulk-out endpoints */ -@@ -590,7 +589,7 @@ static void skel_disconnect(struct usb_interface *interface) - - /* prevent more I/O from starting */ - mutex_lock(&dev->io_mutex); -- dev->interface = NULL; -+ dev->disconnected = 1; - mutex_unlock(&dev->io_mutex); - - usb_kill_anchored_urbs(&dev->submitted); -diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c -index 7494dbeb4409..db58aaa4dc59 100644 ---- a/drivers/xen/pci.c -+++ b/drivers/xen/pci.c -@@ -29,6 +29,8 @@ - #include "../pci/pci.h" - #ifdef CONFIG_PCI_MMCONFIG - #include -+ -+static int xen_mcfg_late(void); - #endif - - static bool __read_mostly pci_seg_supported = true; -@@ -40,7 +42,18 @@ static int xen_add_device(struct device *dev) - #ifdef CONFIG_PCI_IOV - struct pci_dev *physfn = pci_dev->physfn; - #endif -- -+#ifdef CONFIG_PCI_MMCONFIG -+ static bool pci_mcfg_reserved = false; -+ /* -+ * Reserve MCFG areas in Xen on first invocation due to this being -+ * potentially called from inside of acpi_init immediately after -+ * MCFG table has been finally parsed. -+ */ -+ if (!pci_mcfg_reserved) { -+ xen_mcfg_late(); -+ pci_mcfg_reserved = true; -+ } -+#endif - if (pci_seg_supported) { - struct { - struct physdev_pci_device_add add; -@@ -213,7 +226,7 @@ static int __init register_xen_pci_notifier(void) - arch_initcall(register_xen_pci_notifier); - - #ifdef CONFIG_PCI_MMCONFIG --static int __init xen_mcfg_late(void) -+static int xen_mcfg_late(void) - { - struct pci_mmcfg_region *cfg; - int rc; -@@ -252,8 +265,4 @@ static int __init xen_mcfg_late(void) - } - return 0; - } --/* -- * Needs to be done after acpi_init which are subsys_initcall. -- */ --subsys_initcall_sync(xen_mcfg_late); - #endif -diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c -index 373cc50544e9..9dbf37147126 100644 ---- a/fs/9p/vfs_file.c -+++ b/fs/9p/vfs_file.c -@@ -528,6 +528,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma) - v9inode = V9FS_I(inode); - mutex_lock(&v9inode->v_mutex); - if (!v9inode->writeback_fid && -+ (vma->vm_flags & VM_SHARED) && - (vma->vm_flags & VM_WRITE)) { - /* - * clone a fid and add it to writeback_fid -@@ -629,6 +630,8 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma) - (vma->vm_end - vma->vm_start - 1), - }; - -+ if (!(vma->vm_flags & VM_SHARED)) -+ return; - - p9_debug(P9_DEBUG_VFS, "9p VMA close, %p, flushing", vma); - -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index a663b676d566..2ad3f4ab4dcf 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -725,7 +725,12 @@ static int fill_inode(struct inode *inode, struct page *locked_page, - ci->i_version = le64_to_cpu(info->version); - inode->i_version++; - inode->i_rdev = le32_to_cpu(info->rdev); -- inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1; -+ /* directories have fl_stripe_unit set to zero */ -+ if (le32_to_cpu(info->layout.fl_stripe_unit)) -+ inode->i_blkbits = -+ fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1; -+ else -+ inode->i_blkbits = CEPH_BLOCK_SHIFT; - - if ((new_version || (new_issued & CEPH_CAP_AUTH_SHARED)) && - (issued & CEPH_CAP_AUTH_EXCL) == 0) { -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index afd317eb9db9..be16da31cbcc 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -830,10 +830,16 @@ lookup_out: - static int - cifs_d_revalidate(struct dentry *direntry, unsigned int flags) - { -+ struct inode *inode; -+ - if (flags & LOOKUP_RCU) - return -ECHILD; - - if (d_really_is_positive(direntry)) { -+ inode = d_inode(direntry); -+ if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode))) -+ CIFS_I(inode)->time = 0; /* force reval */ -+ - if (cifs_revalidate_dentry(direntry)) - return 0; - else { -@@ -844,7 +850,7 @@ cifs_d_revalidate(struct dentry *direntry, unsigned int flags) - * attributes will have been updated by - * cifs_revalidate_dentry(). - */ -- if (IS_AUTOMOUNT(d_inode(direntry)) && -+ if (IS_AUTOMOUNT(inode) && - !(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) { - spin_lock(&direntry->d_lock); - direntry->d_flags |= DCACHE_NEED_AUTOMOUNT; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 309c134fb66f..737cff7bc08a 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -252,6 +252,12 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb, - rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb, - xid, fid); - -+ if (rc) { -+ server->ops->close(xid, tcon, fid); -+ if (rc == -ESTALE) -+ rc = -EOPENSTALE; -+ } -+ - out: - kfree(buf); - return rc; -diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c -index 0f210cb5038a..0a219545940d 100644 ---- a/fs/cifs/inode.c -+++ b/fs/cifs/inode.c -@@ -405,6 +405,7 @@ int cifs_get_inode_info_unix(struct inode **pinode, - /* if uniqueid is different, return error */ - if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM && - CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) { -+ CIFS_I(*pinode)->time = 0; /* force reval */ - rc = -ESTALE; - goto cgiiu_exit; - } -@@ -412,6 +413,7 @@ int cifs_get_inode_info_unix(struct inode **pinode, - /* if filetype is different, return error */ - if (unlikely(((*pinode)->i_mode & S_IFMT) != - (fattr.cf_mode & S_IFMT))) { -+ CIFS_I(*pinode)->time = 0; /* force reval */ - rc = -ESTALE; - goto cgiiu_exit; - } -@@ -829,8 +831,21 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, - } - } else - fattr.cf_uniqueid = iunique(sb, ROOT_I); -- } else -- fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; -+ } else { -+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) && -+ validinum == false && server->ops->get_srv_inum) { -+ /* -+ * Pass a NULL tcon to ensure we don't make a round -+ * trip to the server. This only works for SMB2+. -+ */ -+ tmprc = server->ops->get_srv_inum(xid, -+ NULL, cifs_sb, full_path, -+ &fattr.cf_uniqueid, data); -+ if (tmprc) -+ fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; -+ } else -+ fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; -+ } - - /* query for SFU type info if supported and needed */ - if (fattr.cf_cifsattrs & ATTR_SYSTEM && -@@ -871,9 +886,18 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, - } else { - /* we already have inode, update it */ - -+ /* if uniqueid is different, return error */ -+ if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM && -+ CIFS_I(*inode)->uniqueid != fattr.cf_uniqueid)) { -+ CIFS_I(*inode)->time = 0; /* force reval */ -+ rc = -ESTALE; -+ goto cgii_exit; -+ } -+ - /* if filetype is different, return error */ - if (unlikely(((*inode)->i_mode & S_IFMT) != - (fattr.cf_mode & S_IFMT))) { -+ CIFS_I(*inode)->time = 0; /* force reval */ - rc = -ESTALE; - goto cgii_exit; - } -diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c -index c5b6b7165489..d9aba9700726 100644 ---- a/fs/fuse/cuse.c -+++ b/fs/fuse/cuse.c -@@ -513,6 +513,7 @@ static int cuse_channel_open(struct inode *inode, struct file *file) - rc = cuse_send_init(cc); - if (rc) { - fuse_dev_free(fud); -+ fuse_conn_put(&cc->fc); - return rc; - } - file->private_data = fud; -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 1cb50bb898b0..15cd9db6d616 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -1123,7 +1123,7 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, - } else - *p++ = cpu_to_be32(NFS4_SET_TO_SERVER_TIME); - } -- if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) { -+ if (label && (bmval[2] & FATTR4_WORD2_SECURITY_LABEL)) { - *p++ = cpu_to_be32(label->lfs); - *p++ = cpu_to_be32(label->pi); - *p++ = cpu_to_be32(label->len); -diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c -index ef64a1e1a66a..ff3f5812c0fd 100644 ---- a/fs/xfs/xfs_super.c -+++ b/fs/xfs/xfs_super.c -@@ -1572,6 +1572,7 @@ xfs_fs_fill_super( - out_close_devices: - xfs_close_devices(mp); - out_free_fsname: -+ sb->s_fs_info = NULL; - xfs_free_fsname(mp); - kfree(mp); - out: -@@ -1589,6 +1590,10 @@ xfs_fs_put_super( - { - struct xfs_mount *mp = XFS_M(sb); - -+ /* if ->fill_super failed, we have no mount to tear down */ -+ if (!sb->s_fs_info) -+ return; -+ - xfs_notice(mp, "Unmounting Filesystem"); - xfs_filestream_unmount(mp); - xfs_unmountfs(mp); -@@ -1598,6 +1603,8 @@ xfs_fs_put_super( - xfs_destroy_percpu_counters(mp); - xfs_destroy_mount_workqueues(mp); - xfs_close_devices(mp); -+ -+ sb->s_fs_info = NULL; - xfs_free_fsname(mp); - kfree(mp); - } -@@ -1617,6 +1624,9 @@ xfs_fs_nr_cached_objects( - struct super_block *sb, - struct shrink_control *sc) - { -+ /* Paranoia: catch incorrect calls during mount setup or teardown */ -+ if (WARN_ON_ONCE(!sb->s_fs_info)) -+ return 0; - return xfs_reclaim_inodes_count(XFS_M(sb)); - } - -diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h -index 452c0b0d2f32..149a7a6687e9 100644 ---- a/include/linux/ieee80211.h -+++ b/include/linux/ieee80211.h -@@ -2550,4 +2550,57 @@ static inline bool ieee80211_action_contains_tpc(struct sk_buff *skb) - return true; - } - -+struct element { -+ u8 id; -+ u8 datalen; -+ u8 data[]; -+} __packed; -+ -+/* element iteration helpers */ -+#define for_each_element(_elem, _data, _datalen) \ -+ for (_elem = (const struct element *)(_data); \ -+ (const u8 *)(_data) + (_datalen) - (const u8 *)_elem >= \ -+ (int)sizeof(*_elem) && \ -+ (const u8 *)(_data) + (_datalen) - (const u8 *)_elem >= \ -+ (int)sizeof(*_elem) + _elem->datalen; \ -+ _elem = (const struct element *)(_elem->data + _elem->datalen)) -+ -+#define for_each_element_id(element, _id, data, datalen) \ -+ for_each_element(element, data, datalen) \ -+ if (element->id == (_id)) -+ -+#define for_each_element_extid(element, extid, data, datalen) \ -+ for_each_element(element, data, datalen) \ -+ if (element->id == WLAN_EID_EXTENSION && \ -+ element->datalen > 0 && \ -+ element->data[0] == (extid)) -+ -+#define for_each_subelement(sub, element) \ -+ for_each_element(sub, (element)->data, (element)->datalen) -+ -+#define for_each_subelement_id(sub, id, element) \ -+ for_each_element_id(sub, id, (element)->data, (element)->datalen) -+ -+#define for_each_subelement_extid(sub, extid, element) \ -+ for_each_element_extid(sub, extid, (element)->data, (element)->datalen) -+ -+/** -+ * for_each_element_completed - determine if element parsing consumed all data -+ * @element: element pointer after for_each_element() or friends -+ * @data: same data pointer as passed to for_each_element() or friends -+ * @datalen: same data length as passed to for_each_element() or friends -+ * -+ * This function returns %true if all the data was parsed or considered -+ * while walking the elements. Only use this if your for_each_element() -+ * loop cannot be broken out of, otherwise it always returns %false. -+ * -+ * If some data was malformed, this returns %false since the last parsed -+ * element will not fill the whole remaining data. -+ */ -+static inline bool for_each_element_completed(const struct element *element, -+ const void *data, size_t datalen) -+{ -+ return (const u8 *)element == (const u8 *)data + datalen; -+} -+ - #endif /* LINUX_IEEE80211_H */ -diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h -index 95a937eafb79..2fc28324351d 100644 ---- a/include/sound/soc-dapm.h -+++ b/include/sound/soc-dapm.h -@@ -335,6 +335,8 @@ struct device; - #define SND_SOC_DAPM_WILL_PMD 0x80 /* called at start of sequence */ - #define SND_SOC_DAPM_PRE_POST_PMD \ - (SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD) -+#define SND_SOC_DAPM_PRE_POST_PMU \ -+ (SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU) - - /* convenience event type detection */ - #define SND_SOC_DAPM_EVENT_ON(e) \ -diff --git a/kernel/elfcore.c b/kernel/elfcore.c -index e556751d15d9..a2b29b9bdfcb 100644 ---- a/kernel/elfcore.c -+++ b/kernel/elfcore.c -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - - Elf_Half __weak elf_core_extra_phdrs(void) - { -diff --git a/kernel/fork.c b/kernel/fork.c -index bd6aad92819a..a6dc6b3f6a01 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -2152,7 +2152,7 @@ int sysctl_max_threads(struct ctl_table *table, int write, - struct ctl_table t; - int ret; - int threads = max_threads; -- int min = MIN_THREADS; -+ int min = 1; - int max = MAX_THREADS; - - t = *table; -@@ -2164,7 +2164,7 @@ int sysctl_max_threads(struct ctl_table *table, int write, - if (ret || !write) - return ret; - -- set_max_threads(threads); -+ max_threads = threads; - - return 0; - } -diff --git a/kernel/panic.c b/kernel/panic.c -index 1d07cf9af849..dde00886c896 100644 ---- a/kernel/panic.c -+++ b/kernel/panic.c -@@ -84,6 +84,7 @@ void panic(const char *fmt, ...) - * after the panic_lock is acquired) from invoking panic again. - */ - local_irq_disable(); -+ preempt_disable_notrace(); - - /* - * It's possible to come here directly from a panic-assertion and -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index c82ebd11414a..c6e4e3e7f685 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3370,9 +3370,14 @@ static int show_traces_open(struct inode *inode, struct file *file) - if (tracing_disabled) - return -ENODEV; - -+ if (trace_array_get(tr) < 0) -+ return -ENODEV; -+ - ret = seq_open(file, &show_traces_seq_ops); -- if (ret) -+ if (ret) { -+ trace_array_put(tr); - return ret; -+ } - - m = file->private_data; - m->private = tr; -@@ -3380,6 +3385,14 @@ static int show_traces_open(struct inode *inode, struct file *file) - return 0; - } - -+static int show_traces_release(struct inode *inode, struct file *file) -+{ -+ struct trace_array *tr = inode->i_private; -+ -+ trace_array_put(tr); -+ return seq_release(inode, file); -+} -+ - static ssize_t - tracing_write_stub(struct file *filp, const char __user *ubuf, - size_t count, loff_t *ppos) -@@ -3410,8 +3423,8 @@ static const struct file_operations tracing_fops = { - static const struct file_operations show_traces_fops = { - .open = show_traces_open, - .read = seq_read, -- .release = seq_release, - .llseek = seq_lseek, -+ .release = show_traces_release, - }; - - static ssize_t -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 1968998e6c6c..95c8e682b491 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -210,6 +210,36 @@ cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) - return __cfg80211_rdev_from_attrs(netns, info->attrs); - } - -+static int validate_beacon_head(const struct nlattr *attr) -+{ -+ const u8 *data = nla_data(attr); -+ unsigned int len = nla_len(attr); -+ const struct element *elem; -+ const struct ieee80211_mgmt *mgmt = (void *)data; -+ unsigned int fixedlen = offsetof(struct ieee80211_mgmt, -+ u.beacon.variable); -+ -+ if (len < fixedlen) -+ goto err; -+ -+ if (ieee80211_hdrlen(mgmt->frame_control) != -+ offsetof(struct ieee80211_mgmt, u.beacon)) -+ goto err; -+ -+ data += fixedlen; -+ len -= fixedlen; -+ -+ for_each_element(elem, data, len) { -+ /* nothing */ -+ } -+ -+ if (for_each_element_completed(elem, data, len)) -+ return 0; -+ -+err: -+ return -EINVAL; -+} -+ - /* policy for the attributes */ - static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, -@@ -1934,6 +1964,8 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, - - control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]); - -+ memset(chandef, 0, sizeof(*chandef)); -+ - chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); - chandef->width = NL80211_CHAN_WIDTH_20_NOHT; - chandef->center_freq1 = control_freq; -@@ -2402,7 +2434,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag - - if (rdev->ops->get_channel) { - int ret; -- struct cfg80211_chan_def chandef; -+ struct cfg80211_chan_def chandef = {}; - - ret = rdev_get_channel(rdev, wdev, &chandef); - if (ret == 0) { -@@ -3212,6 +3244,11 @@ static int nl80211_parse_beacon(struct nlattr *attrs[], - memset(bcn, 0, sizeof(*bcn)); - - if (attrs[NL80211_ATTR_BEACON_HEAD]) { -+ int ret = validate_beacon_head(attrs[NL80211_ATTR_BEACON_HEAD]); -+ -+ if (ret) -+ return ret; -+ - bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); - bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); - if (!bcn->head_len) -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 6a670a373e29..437ec52d5e71 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -1604,7 +1604,7 @@ static void reg_call_notifier(struct wiphy *wiphy, - - static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev) - { -- struct cfg80211_chan_def chandef; -+ struct cfg80211_chan_def chandef = {}; - struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); - enum nl80211_iftype iftype; - -diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c -index fd682832a0e3..cd119943612b 100644 ---- a/net/wireless/wext-compat.c -+++ b/net/wireless/wext-compat.c -@@ -821,7 +821,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev, - { - struct wireless_dev *wdev = dev->ieee80211_ptr; - struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); -- struct cfg80211_chan_def chandef; -+ struct cfg80211_chan_def chandef = {}; - int ret; - - switch (wdev->iftype) { -diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c -index a29209fa5674..5c87baaefafb 100644 ---- a/security/integrity/ima/ima_crypto.c -+++ b/security/integrity/ima/ima_crypto.c -@@ -298,8 +298,11 @@ static int ima_calc_file_hash_atfm(struct file *file, - rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]); - rc = integrity_kernel_read(file, offset, rbuf[active], - rbuf_len); -- if (rc != rbuf_len) -+ if (rc != rbuf_len) { -+ if (rc >= 0) -+ rc = -EINVAL; - goto out3; -+ } - - if (rbuf[1] && offset) { - /* Using two buffers, and it is not the first -diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c -index 549f853c4092..4808b70ec12c 100644 ---- a/sound/soc/codecs/sgtl5000.c -+++ b/sound/soc/codecs/sgtl5000.c -@@ -35,6 +35,13 @@ - #define SGTL5000_DAP_REG_OFFSET 0x0100 - #define SGTL5000_MAX_REG_OFFSET 0x013A - -+/* Delay for the VAG ramp up */ -+#define SGTL5000_VAG_POWERUP_DELAY 500 /* ms */ -+/* Delay for the VAG ramp down */ -+#define SGTL5000_VAG_POWERDOWN_DELAY 500 /* ms */ -+ -+#define SGTL5000_OUTPUTS_MUTE (SGTL5000_HP_MUTE | SGTL5000_LINE_OUT_MUTE) -+ - /* default value of sgtl5000 registers */ - static const struct reg_default sgtl5000_reg_defaults[] = { - { SGTL5000_CHIP_DIG_POWER, 0x0000 }, -@@ -129,6 +136,13 @@ enum sgtl5000_micbias_resistor { - SGTL5000_MICBIAS_8K = 8, - }; - -+enum { -+ HP_POWER_EVENT, -+ DAC_POWER_EVENT, -+ ADC_POWER_EVENT, -+ LAST_POWER_EVENT = ADC_POWER_EVENT -+}; -+ - /* sgtl5000 private structure in codec */ - struct sgtl5000_priv { - int sysclk; /* sysclk rate */ -@@ -141,8 +155,117 @@ struct sgtl5000_priv { - int revision; - u8 micbias_resistor; - u8 micbias_voltage; -+ u16 mute_state[LAST_POWER_EVENT + 1]; - }; - -+static inline int hp_sel_input(struct snd_soc_component *component) -+{ -+ unsigned int ana_reg = 0; -+ -+ snd_soc_component_read(component, SGTL5000_CHIP_ANA_CTRL, &ana_reg); -+ -+ return (ana_reg & SGTL5000_HP_SEL_MASK) >> SGTL5000_HP_SEL_SHIFT; -+} -+ -+static inline u16 mute_output(struct snd_soc_component *component, -+ u16 mute_mask) -+{ -+ unsigned int mute_reg = 0; -+ -+ snd_soc_component_read(component, SGTL5000_CHIP_ANA_CTRL, &mute_reg); -+ -+ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL, -+ mute_mask, mute_mask); -+ return mute_reg; -+} -+ -+static inline void restore_output(struct snd_soc_component *component, -+ u16 mute_mask, u16 mute_reg) -+{ -+ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL, -+ mute_mask, mute_reg); -+} -+ -+static void vag_power_on(struct snd_soc_component *component, u32 source) -+{ -+ unsigned int ana_reg = 0; -+ -+ snd_soc_component_read(component, SGTL5000_CHIP_ANA_POWER, &ana_reg); -+ -+ if (ana_reg & SGTL5000_VAG_POWERUP) -+ return; -+ -+ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER, -+ SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP); -+ -+ /* When VAG powering on to get local loop from Line-In, the sleep -+ * is required to avoid loud pop. -+ */ -+ if (hp_sel_input(component) == SGTL5000_HP_SEL_LINE_IN && -+ source == HP_POWER_EVENT) -+ msleep(SGTL5000_VAG_POWERUP_DELAY); -+} -+ -+static int vag_power_consumers(struct snd_soc_component *component, -+ u16 ana_pwr_reg, u32 source) -+{ -+ int consumers = 0; -+ -+ /* count dac/adc consumers unconditional */ -+ if (ana_pwr_reg & SGTL5000_DAC_POWERUP) -+ consumers++; -+ if (ana_pwr_reg & SGTL5000_ADC_POWERUP) -+ consumers++; -+ -+ /* -+ * If the event comes from HP and Line-In is selected, -+ * current action is 'DAC to be powered down'. -+ * As HP_POWERUP is not set when HP muxed to line-in, -+ * we need to keep VAG power ON. -+ */ -+ if (source == HP_POWER_EVENT) { -+ if (hp_sel_input(component) == SGTL5000_HP_SEL_LINE_IN) -+ consumers++; -+ } else { -+ if (ana_pwr_reg & SGTL5000_HP_POWERUP) -+ consumers++; -+ } -+ -+ return consumers; -+} -+ -+static void vag_power_off(struct snd_soc_component *component, u32 source) -+{ -+ unsigned int ana_pwr = SGTL5000_VAG_POWERUP; -+ -+ snd_soc_component_read(component, SGTL5000_CHIP_ANA_POWER, &ana_pwr); -+ -+ if (!(ana_pwr & SGTL5000_VAG_POWERUP)) -+ return; -+ -+ /* -+ * This function calls when any of VAG power consumers is disappearing. -+ * Thus, if there is more than one consumer at the moment, as minimum -+ * one consumer will definitely stay after the end of the current -+ * event. -+ * Don't clear VAG_POWERUP if 2 or more consumers of VAG present: -+ * - LINE_IN (for HP events) / HP (for DAC/ADC events) -+ * - DAC -+ * - ADC -+ * (the current consumer is disappearing right now) -+ */ -+ if (vag_power_consumers(component, ana_pwr, source) >= 2) -+ return; -+ -+ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER, -+ SGTL5000_VAG_POWERUP, 0); -+ /* In power down case, we need wait 400-1000 ms -+ * when VAG fully ramped down. -+ * As longer we wait, as smaller pop we've got. -+ */ -+ msleep(SGTL5000_VAG_POWERDOWN_DELAY); -+} -+ - /* - * mic_bias power on/off share the same register bits with - * output impedance of mic bias, when power on mic bias, we -@@ -174,36 +297,46 @@ static int mic_bias_event(struct snd_soc_dapm_widget *w, - return 0; - } - --/* -- * As manual described, ADC/DAC only works when VAG powerup, -- * So enabled VAG before ADC/DAC up. -- * In power down case, we need wait 400ms when vag fully ramped down. -- */ --static int power_vag_event(struct snd_soc_dapm_widget *w, -- struct snd_kcontrol *kcontrol, int event) -+static int vag_and_mute_control(struct snd_soc_component *component, -+ int event, int event_source) - { -- struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm); -- const u32 mask = SGTL5000_DAC_POWERUP | SGTL5000_ADC_POWERUP; -+ static const u16 mute_mask[] = { -+ /* -+ * Mask for HP_POWER_EVENT. -+ * Muxing Headphones have to be wrapped with mute/unmute -+ * headphones only. -+ */ -+ SGTL5000_HP_MUTE, -+ /* -+ * Masks for DAC_POWER_EVENT/ADC_POWER_EVENT. -+ * Muxing DAC or ADC block have to be wrapped with mute/unmute -+ * both headphones and line-out. -+ */ -+ SGTL5000_OUTPUTS_MUTE, -+ SGTL5000_OUTPUTS_MUTE -+ }; -+ -+ struct sgtl5000_priv *sgtl5000 = -+ snd_soc_component_get_drvdata(component); - - switch (event) { -+ case SND_SOC_DAPM_PRE_PMU: -+ sgtl5000->mute_state[event_source] = -+ mute_output(component, mute_mask[event_source]); -+ break; - case SND_SOC_DAPM_POST_PMU: -- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, -- SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP); -- msleep(400); -+ vag_power_on(component, event_source); -+ restore_output(component, mute_mask[event_source], -+ sgtl5000->mute_state[event_source]); - break; -- - case SND_SOC_DAPM_PRE_PMD: -- /* -- * Don't clear VAG_POWERUP, when both DAC and ADC are -- * operational to prevent inadvertently starving the -- * other one of them. -- */ -- if ((snd_soc_read(codec, SGTL5000_CHIP_ANA_POWER) & -- mask) != mask) { -- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, -- SGTL5000_VAG_POWERUP, 0); -- msleep(400); -- } -+ sgtl5000->mute_state[event_source] = -+ mute_output(component, mute_mask[event_source]); -+ vag_power_off(component, event_source); -+ break; -+ case SND_SOC_DAPM_POST_PMD: -+ restore_output(component, mute_mask[event_source], -+ sgtl5000->mute_state[event_source]); - break; - default: - break; -@@ -212,6 +345,41 @@ static int power_vag_event(struct snd_soc_dapm_widget *w, - return 0; - } - -+/* -+ * Mute Headphone when power it up/down. -+ * Control VAG power on HP power path. -+ */ -+static int headphone_pga_event(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_component *component = -+ snd_soc_dapm_to_component(w->dapm); -+ -+ return vag_and_mute_control(component, event, HP_POWER_EVENT); -+} -+ -+/* As manual describes, ADC/DAC powering up/down requires -+ * to mute outputs to avoid pops. -+ * Control VAG power on ADC/DAC power path. -+ */ -+static int adc_updown_depop(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_component *component = -+ snd_soc_dapm_to_component(w->dapm); -+ -+ return vag_and_mute_control(component, event, ADC_POWER_EVENT); -+} -+ -+static int dac_updown_depop(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_component *component = -+ snd_soc_dapm_to_component(w->dapm); -+ -+ return vag_and_mute_control(component, event, DAC_POWER_EVENT); -+} -+ - /* input sources for ADC */ - static const char *adc_mux_text[] = { - "MIC_IN", "LINE_IN" -@@ -247,7 +415,10 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = { - mic_bias_event, - SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), - -- SND_SOC_DAPM_PGA("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0), -+ SND_SOC_DAPM_PGA_E("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0, -+ headphone_pga_event, -+ SND_SOC_DAPM_PRE_POST_PMU | -+ SND_SOC_DAPM_PRE_POST_PMD), - SND_SOC_DAPM_PGA("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0), - - SND_SOC_DAPM_MUX("Capture Mux", SND_SOC_NOPM, 0, 0, &adc_mux), -@@ -263,11 +434,12 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = { - 0, SGTL5000_CHIP_DIG_POWER, - 1, 0), - -- SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0), -- SND_SOC_DAPM_DAC("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0), -- -- SND_SOC_DAPM_PRE("VAG_POWER_PRE", power_vag_event), -- SND_SOC_DAPM_POST("VAG_POWER_POST", power_vag_event), -+ SND_SOC_DAPM_ADC_E("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0, -+ adc_updown_depop, SND_SOC_DAPM_PRE_POST_PMU | -+ SND_SOC_DAPM_PRE_POST_PMD), -+ SND_SOC_DAPM_DAC_E("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0, -+ dac_updown_depop, SND_SOC_DAPM_PRE_POST_PMU | -+ SND_SOC_DAPM_PRE_POST_PMD), - }; - - /* routes for sgtl5000 */ -diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c -index df3c73e9dea4..9954b069b3ca 100644 ---- a/tools/lib/traceevent/event-parse.c -+++ b/tools/lib/traceevent/event-parse.c -@@ -265,10 +265,10 @@ static int add_new_comm(struct pevent *pevent, const char *comm, int pid) - errno = ENOMEM; - return -1; - } -+ pevent->cmdlines = cmdlines; - - cmdlines[pevent->cmdline_count].comm = strdup(comm); - if (!cmdlines[pevent->cmdline_count].comm) { -- free(cmdlines); - errno = ENOMEM; - return -1; - } -@@ -279,7 +279,6 @@ static int add_new_comm(struct pevent *pevent, const char *comm, int pid) - pevent->cmdline_count++; - - qsort(cmdlines, pevent->cmdline_count, sizeof(*cmdlines), cmdline_cmp); -- pevent->cmdlines = cmdlines; - - return 0; - } -diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c -index e77880b5094d..65a6922db722 100644 ---- a/tools/perf/builtin-stat.c -+++ b/tools/perf/builtin-stat.c -@@ -1416,7 +1416,7 @@ int cmd_stat(int argc, const char **argv, const char *prefix __maybe_unused) - run_idx + 1); - - status = run_perf_stat(argc, argv); -- if (forever && status != -1) { -+ if (forever && status != -1 && !interval) { - print_counters(NULL, argc, argv); - perf_stat__reset_stats(); - } -diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c -index 62f6d7dc2dda..9d02aa93ef90 100644 ---- a/tools/perf/util/llvm-utils.c -+++ b/tools/perf/util/llvm-utils.c -@@ -214,14 +214,14 @@ static int detect_kbuild_dir(char **kbuild_dir) - const char *prefix_dir = ""; - const char *suffix_dir = ""; - -+ /* _UTSNAME_LENGTH is 65 */ -+ char release[128]; -+ - char *autoconf_path; - - int err; - - if (!test_dir) { -- /* _UTSNAME_LENGTH is 65 */ -- char release[128]; -- - err = fetch_kernel_version(NULL, release, - sizeof(release)); - if (err) diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.197-198.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.197-198.patch deleted file mode 100644 index 14f4fd1238bb..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.197-198.patch +++ /dev/null @@ -1,1004 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5c150d32cae7..3de38e5e93d1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 197 -+SUBLEVEL = 198 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi -index 3ef1d5a26389..3bb5254a227a 100644 ---- a/arch/arm/boot/dts/am4372.dtsi -+++ b/arch/arm/boot/dts/am4372.dtsi -@@ -1002,6 +1002,8 @@ - ti,hwmods = "dss_dispc"; - clocks = <&disp_clk>; - clock-names = "fck"; -+ -+ max-memory-bandwidth = <230000000>; - }; - - rfbi: rfbi@4832a800 { -diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c -index b31ad596be79..6b09debcf484 100644 ---- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c -+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c -@@ -1020,7 +1020,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = { - .rev_offs = 0x0000, - .sysc_offs = 0x0010, - .syss_offs = 0x0014, -- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET), -+ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET | -+ SYSC_HAS_RESET_STATUS, - .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART | - SIDLE_SMART_WKUP), - .sysc_fields = &omap_hwmod_sysc_type2, -diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c -index ffefc1cb2612..98c3a7feb10f 100644 ---- a/arch/mips/loongson64/common/serial.c -+++ b/arch/mips/loongson64/common/serial.c -@@ -110,7 +110,7 @@ static int __init serial_init(void) - } - module_init(serial_init); - --static void __init serial_exit(void) -+static void __exit serial_exit(void) - { - platform_device_unregister(&uart8250_device); - } -diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c -index 838d0259cd27..3741f91fc186 100644 ---- a/arch/parisc/mm/ioremap.c -+++ b/arch/parisc/mm/ioremap.c -@@ -2,7 +2,7 @@ - * arch/parisc/mm/ioremap.c - * - * (C) Copyright 1995 1996 Linus Torvalds -- * (C) Copyright 2001-2006 Helge Deller -+ * (C) Copyright 2001-2019 Helge Deller - * (C) Copyright 2005 Kyle McMartin - */ - -@@ -83,7 +83,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l - addr = (void __iomem *) area->addr; - if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size, - phys_addr, pgprot)) { -- vfree(addr); -+ vunmap(addr); - return NULL; - } - -@@ -91,9 +91,11 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l - } - EXPORT_SYMBOL(__ioremap); - --void iounmap(const volatile void __iomem *addr) -+void iounmap(const volatile void __iomem *io_addr) - { -- if (addr > high_memory) -- return vfree((void *) (PAGE_MASK & (unsigned long __force) addr)); -+ unsigned long addr = (unsigned long)io_addr & PAGE_MASK; -+ -+ if (is_vmalloc_addr((void *)addr)) -+ vunmap((void *)addr); - } - EXPORT_SYMBOL(iounmap); -diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c -index 4d2872fd9bb5..e2dd9109df63 100644 ---- a/arch/xtensa/kernel/xtensa_ksyms.c -+++ b/arch/xtensa/kernel/xtensa_ksyms.c -@@ -116,13 +116,6 @@ EXPORT_SYMBOL(__invalidate_icache_range); - // FIXME EXPORT_SYMBOL(screen_info); - #endif - --EXPORT_SYMBOL(outsb); --EXPORT_SYMBOL(outsw); --EXPORT_SYMBOL(outsl); --EXPORT_SYMBOL(insb); --EXPORT_SYMBOL(insw); --EXPORT_SYMBOL(insl); -- - extern long common_exception_return; - EXPORT_SYMBOL(common_exception_return); - -diff --git a/drivers/base/core.c b/drivers/base/core.c -index af948fedd232..64b59552e744 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -10,6 +10,7 @@ - * - */ - -+#include - #include - #include - #include -@@ -2124,6 +2125,8 @@ void device_shutdown(void) - { - struct device *dev, *parent; - -+ cpufreq_suspend(); -+ - spin_lock(&devices_kset->list_lock); - /* - * Walk the devices list backward, shutting down each in turn. -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index da3902ac16c8..8aadd4d0c3a8 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1557,6 +1557,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, - arg = (unsigned long) compat_ptr(arg); - case LOOP_SET_FD: - case LOOP_CHANGE_FD: -+ case LOOP_SET_DIRECT_IO: - err = lo_ioctl(bdev, mode, cmd, arg); - break; - default: -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 205df72ee873..0836d2939c7a 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -2512,14 +2512,6 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver) - } - EXPORT_SYMBOL_GPL(cpufreq_unregister_driver); - --/* -- * Stop cpufreq at shutdown to make sure it isn't holding any locks -- * or mutexes when secondary CPUs are halted. -- */ --static struct syscore_ops cpufreq_syscore_ops = { -- .shutdown = cpufreq_suspend, --}; -- - struct kobject *cpufreq_global_kobject; - EXPORT_SYMBOL(cpufreq_global_kobject); - -@@ -2531,8 +2523,6 @@ static int __init cpufreq_core_init(void) - cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj); - BUG_ON(!cpufreq_global_kobject); - -- register_syscore_ops(&cpufreq_syscore_ops); -- - return 0; - } - core_initcall(cpufreq_core_init); -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index 724f7cf52253..b439e2f8ee00 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -150,6 +150,9 @@ static struct edid_quirk { - /* Medion MD 30217 PG */ - { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 }, - -+ /* Lenovo G50 */ -+ { "SDC", 18514, EDID_QUIRK_FORCE_6BPC }, -+ - /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */ - { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC }, - -diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c -index 8218d714fa01..4b682375f465 100644 ---- a/drivers/infiniband/hw/cxgb4/mem.c -+++ b/drivers/infiniband/hw/cxgb4/mem.c -@@ -254,13 +254,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, - u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr) - { - int err; -- struct fw_ri_tpte tpt; -+ struct fw_ri_tpte *tpt; - u32 stag_idx; - static atomic_t key; - - if (c4iw_fatal_error(rdev)) - return -EIO; - -+ tpt = kmalloc(sizeof(*tpt), GFP_KERNEL); -+ if (!tpt) -+ return -ENOMEM; -+ - stag_state = stag_state > 0; - stag_idx = (*stag) >> 8; - -@@ -270,6 +274,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, - mutex_lock(&rdev->stats.lock); - rdev->stats.stag.fail++; - mutex_unlock(&rdev->stats.lock); -+ kfree(tpt); - return -ENOMEM; - } - mutex_lock(&rdev->stats.lock); -@@ -284,28 +289,28 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, - - /* write TPT entry */ - if (reset_tpt_entry) -- memset(&tpt, 0, sizeof(tpt)); -+ memset(tpt, 0, sizeof(*tpt)); - else { -- tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | -+ tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | - FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) | - FW_RI_TPTE_STAGSTATE_V(stag_state) | - FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid)); -- tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | -+ tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | - (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) | - FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO : - FW_RI_VA_BASED_TO))| - FW_RI_TPTE_PS_V(page_size)); -- tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( -+ tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( - FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3)); -- tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); -- tpt.va_hi = cpu_to_be32((u32)(to >> 32)); -- tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); -- tpt.dca_mwbcnt_pstag = cpu_to_be32(0); -- tpt.len_hi = cpu_to_be32((u32)(len >> 32)); -+ tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); -+ tpt->va_hi = cpu_to_be32((u32)(to >> 32)); -+ tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); -+ tpt->dca_mwbcnt_pstag = cpu_to_be32(0); -+ tpt->len_hi = cpu_to_be32((u32)(len >> 32)); - } - err = write_adapter_mem(rdev, stag_idx + - (rdev->lldi.vr->stag.start >> 5), -- sizeof(tpt), &tpt); -+ sizeof(*tpt), tpt); - - if (reset_tpt_entry) { - c4iw_put_resource(&rdev->resource.tpt_table, stag_idx); -@@ -313,6 +318,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, - rdev->stats.stag.cur -= 32; - mutex_unlock(&rdev->stats.lock); - } -+ kfree(tpt); - return err; - } - -diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c -index 48db922075e2..08fa6400d255 100644 ---- a/drivers/memstick/host/jmb38x_ms.c -+++ b/drivers/memstick/host/jmb38x_ms.c -@@ -947,7 +947,7 @@ static int jmb38x_ms_probe(struct pci_dev *pdev, - if (!cnt) { - rc = -ENODEV; - pci_dev_busy = 1; -- goto err_out; -+ goto err_out_int; - } - - jm = kzalloc(sizeof(struct jmb38x_ms) -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -index ce20bc939b38..e651845c6605 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -@@ -362,6 +362,7 @@ struct bcmgenet_mib_counters { - #define EXT_ENERGY_DET_MASK (1 << 12) - - #define EXT_RGMII_OOB_CTRL 0x0C -+#define RGMII_MODE_EN_V123 (1 << 0) - #define RGMII_LINK (1 << 4) - #define OOB_DISABLE (1 << 5) - #define RGMII_MODE_EN (1 << 6) -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index 0565efad6e6e..3ad016f500b5 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -328,7 +328,11 @@ int bcmgenet_mii_config(struct net_device *dev) - */ - if (priv->ext_phy) { - reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL); -- reg |= RGMII_MODE_EN | id_mode_dis; -+ reg |= id_mode_dis; -+ if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv)) -+ reg |= RGMII_MODE_EN_V123; -+ else -+ reg |= RGMII_MODE_EN; - bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL); - } - -@@ -342,11 +346,12 @@ int bcmgenet_mii_probe(struct net_device *dev) - struct bcmgenet_priv *priv = netdev_priv(dev); - struct device_node *dn = priv->pdev->dev.of_node; - struct phy_device *phydev; -- u32 phy_flags; -+ u32 phy_flags = 0; - int ret; - - /* Communicate the integrated PHY revision */ -- phy_flags = priv->gphy_rev; -+ if (priv->internal_phy) -+ phy_flags = priv->gphy_rev; - - /* Initialize link state variables that bcmgenet_mii_setup() uses */ - priv->old_link = -1; -diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c -index 6ff13c559e52..09fcc821b7da 100644 ---- a/drivers/net/ethernet/hisilicon/hns_mdio.c -+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c -@@ -156,11 +156,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev, - { - u32 time_cnt; - u32 reg_value; -+ int ret; - - regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val); - - for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) { -- regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value); -+ ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value); -+ if (ret) -+ return ret; -+ - reg_value &= st_msk; - if ((!!check_st) == (!!reg_value)) - break; -diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c -index 60b26f32d31d..2008c6a02b8a 100644 ---- a/drivers/net/xen-netback/interface.c -+++ b/drivers/net/xen-netback/interface.c -@@ -620,7 +620,6 @@ err_tx_unbind: - err_unmap: - xenvif_unmap_frontend_rings(queue); - err: -- module_put(THIS_MODULE); - return err; - } - -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 82b0c2cc2fd3..b7f65fc54dc2 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -703,19 +703,6 @@ void pci_update_current_state(struct pci_dev *dev, pci_power_t state) - } - } - --/** -- * pci_power_up - Put the given device into D0 forcibly -- * @dev: PCI device to power up -- */ --void pci_power_up(struct pci_dev *dev) --{ -- if (platform_pci_power_manageable(dev)) -- platform_pci_set_power_state(dev, PCI_D0); -- -- pci_raw_set_power_state(dev, PCI_D0); -- pci_update_current_state(dev, PCI_D0); --} -- - /** - * pci_platform_power_transition - Use platform to change device power state - * @dev: PCI device to handle. -@@ -891,6 +878,17 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state) - } - EXPORT_SYMBOL(pci_set_power_state); - -+/** -+ * pci_power_up - Put the given device into D0 forcibly -+ * @dev: PCI device to power up -+ */ -+void pci_power_up(struct pci_dev *dev) -+{ -+ __pci_start_power_transition(dev, PCI_D0); -+ pci_raw_set_power_state(dev, PCI_D0); -+ pci_update_current_state(dev, PCI_D0); -+} -+ - /** - * pci_choose_state - Choose the power state of a PCI device - * @dev: PCI device to be suspended -diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c -index 1964391db904..a3aaef4c53a3 100644 ---- a/drivers/s390/scsi/zfcp_fsf.c -+++ b/drivers/s390/scsi/zfcp_fsf.c -@@ -20,6 +20,11 @@ - - struct kmem_cache *zfcp_fsf_qtcb_cache; - -+static bool ber_stop = true; -+module_param(ber_stop, bool, 0600); -+MODULE_PARM_DESC(ber_stop, -+ "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)"); -+ - static void zfcp_fsf_request_timeout_handler(unsigned long data) - { - struct zfcp_adapter *adapter = (struct zfcp_adapter *) data; -@@ -231,10 +236,15 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req) - case FSF_STATUS_READ_SENSE_DATA_AVAIL: - break; - case FSF_STATUS_READ_BIT_ERROR_THRESHOLD: -- dev_warn(&adapter->ccw_device->dev, -- "The error threshold for checksum statistics " -- "has been exceeded\n"); - zfcp_dbf_hba_bit_err("fssrh_3", req); -+ if (ber_stop) { -+ dev_warn(&adapter->ccw_device->dev, -+ "All paths over this FCP device are disused because of excessive bit errors\n"); -+ zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b"); -+ } else { -+ dev_warn(&adapter->ccw_device->dev, -+ "The error threshold for checksum statistics has been exceeded\n"); -+ } - break; - case FSF_STATUS_READ_LINK_DOWN: - zfcp_fsf_status_read_link_down(req); -diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c -index 19bffe0b2cc0..2cbfec6a7466 100644 ---- a/drivers/scsi/megaraid.c -+++ b/drivers/scsi/megaraid.c -@@ -4219,11 +4219,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - */ - if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ && - pdev->subsystem_device == 0xC000) -- return -ENODEV; -+ goto out_disable_device; - /* Now check the magic signature byte */ - pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic); - if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE) -- return -ENODEV; -+ goto out_disable_device; - /* Ok it is probably a megaraid */ - } - -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 824e27eec7a1..6c4f54aa60df 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -437,6 +437,7 @@ static void qlt_free_session_done(struct work_struct *work) - - if (logout_started) { - bool traced = false; -+ u16 cnt = 0; - - while (!ACCESS_ONCE(sess->logout_completed)) { - if (!traced) { -@@ -446,6 +447,9 @@ static void qlt_free_session_done(struct work_struct *work) - traced = true; - } - msleep(100); -+ cnt++; -+ if (cnt > 200) -+ break; - } - - ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087, -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 085e470d1c49..b89af3841e44 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -679,6 +679,14 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) - { - struct kernfs_node *kn; -+ struct scsi_device *sdev = to_scsi_device(dev); -+ -+ /* -+ * We need to try to get module, avoiding the module been removed -+ * during delete. -+ */ -+ if (scsi_device_get(sdev)) -+ return -ENODEV; - - kn = sysfs_break_active_protection(&dev->kobj, &attr->attr); - WARN_ON_ONCE(!kn); -@@ -693,9 +701,10 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr, - * state into SDEV_DEL. - */ - device_remove_file(dev, attr); -- scsi_remove_device(to_scsi_device(dev)); -+ scsi_remove_device(sdev); - if (kn) - sysfs_unbreak_active_protection(kn); -+ scsi_device_put(sdev); - return count; - }; - static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete); -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index fd8bbd2b5d0e..504d36796152 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -5371,6 +5371,9 @@ int ufshcd_shutdown(struct ufs_hba *hba) - { - int ret = 0; - -+ if (!hba->is_powered) -+ goto out; -+ - if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) - goto out; - -diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c -index 0669fbb0ec25..07c3c3449147 100644 ---- a/drivers/usb/class/usblp.c -+++ b/drivers/usb/class/usblp.c -@@ -458,6 +458,7 @@ static void usblp_cleanup(struct usblp *usblp) - kfree(usblp->readbuf); - kfree(usblp->device_id_string); - kfree(usblp->statusbuf); -+ usb_put_intf(usblp->intf); - kfree(usblp); - } - -@@ -1120,7 +1121,7 @@ static int usblp_probe(struct usb_interface *intf, - init_waitqueue_head(&usblp->wwait); - init_usb_anchor(&usblp->urbs); - usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; -- usblp->intf = intf; -+ usblp->intf = usb_get_intf(intf); - - /* Malloc device ID string buffer to the largest expected length, - * since we can re-query it on an ioctl and a dynamic string -@@ -1209,6 +1210,7 @@ abort: - kfree(usblp->readbuf); - kfree(usblp->statusbuf); - kfree(usblp->device_id_string); -+ usb_put_intf(usblp->intf); - kfree(usblp); - abort_ret: - return retval; -diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c -index 90d24f62bd81..ea43cb74a6f2 100644 ---- a/drivers/usb/gadget/udc/lpc32xx_udc.c -+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c -@@ -1225,11 +1225,11 @@ static void udc_pop_fifo(struct lpc32xx_udc *udc, u8 *data, u32 bytes) - tmp = readl(USBD_RXDATA(udc->udp_baseaddr)); - - bl = bytes - n; -- if (bl > 3) -- bl = 3; -+ if (bl > 4) -+ bl = 4; - - for (i = 0; i < bl; i++) -- data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF); -+ data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF); - } - break; - -diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c -index 84f12c1bf9e6..7da242bbe37b 100644 ---- a/drivers/usb/misc/ldusb.c -+++ b/drivers/usb/misc/ldusb.c -@@ -384,10 +384,7 @@ static int ld_usb_release(struct inode *inode, struct file *file) - goto exit; - } - -- if (mutex_lock_interruptible(&dev->mutex)) { -- retval = -ERESTARTSYS; -- goto exit; -- } -+ mutex_lock(&dev->mutex); - - if (dev->open_count != 1) { - retval = -ENODEV; -@@ -471,7 +468,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count, - - /* wait for data */ - spin_lock_irq(&dev->rbsl); -- if (dev->ring_head == dev->ring_tail) { -+ while (dev->ring_head == dev->ring_tail) { - dev->interrupt_in_done = 0; - spin_unlock_irq(&dev->rbsl); - if (file->f_flags & O_NONBLOCK) { -@@ -481,12 +478,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count, - retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done); - if (retval < 0) - goto unlock_exit; -- } else { -- spin_unlock_irq(&dev->rbsl); -+ -+ spin_lock_irq(&dev->rbsl); - } -+ spin_unlock_irq(&dev->rbsl); - - /* actual_buffer contains actual_length + interrupt_in_buffer */ - actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_tail*(sizeof(size_t)+dev->interrupt_in_endpoint_size)); -+ if (*actual_buffer > dev->interrupt_in_endpoint_size) { -+ retval = -EIO; -+ goto unlock_exit; -+ } - bytes_to_read = min(count, *actual_buffer); - if (bytes_to_read < *actual_buffer) - dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n", -@@ -706,7 +708,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id * - dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n"); - - dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint); -- dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL); -+ dev->ring_buffer = kcalloc(ring_buffer_size, -+ sizeof(size_t) + dev->interrupt_in_endpoint_size, -+ GFP_KERNEL); - if (!dev->ring_buffer) { - dev_err(&intf->dev, "Couldn't allocate ring_buffer\n"); - goto error; -diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c -index 20e3d577ae5d..32b41eb07f00 100644 ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -425,10 +425,7 @@ static int tower_release (struct inode *inode, struct file *file) - goto exit; - } - -- if (mutex_lock_interruptible(&dev->lock)) { -- retval = -ERESTARTSYS; -- goto exit; -- } -+ mutex_lock(&dev->lock); - - if (dev->open_count != 1) { - dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n", -diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c -index fe7f5ace6064..a33acb8c16d3 100644 ---- a/drivers/usb/serial/ti_usb_3410_5052.c -+++ b/drivers/usb/serial/ti_usb_3410_5052.c -@@ -542,7 +542,6 @@ static void ti_close(struct usb_serial_port *port) - struct ti_port *tport; - int port_number; - int status; -- int do_unlock; - unsigned long flags; - - tdev = usb_get_serial_data(port->serial); -@@ -569,16 +568,13 @@ static void ti_close(struct usb_serial_port *port) - "%s - cannot send close port command, %d\n" - , __func__, status); - -- /* if mutex_lock is interrupted, continue anyway */ -- do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock); -+ mutex_lock(&tdev->td_open_close_lock); - --tport->tp_tdev->td_open_port_count; -- if (tport->tp_tdev->td_open_port_count <= 0) { -+ if (tport->tp_tdev->td_open_port_count == 0) { - /* last port is closed, shut down interrupt urb */ - usb_kill_urb(port->serial->port[0]->interrupt_in_urb); -- tport->tp_tdev->td_open_port_count = 0; - } -- if (do_unlock) -- mutex_unlock(&tdev->td_open_close_lock); -+ mutex_unlock(&tdev->td_open_close_lock); - } - - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 4c316ca3ee78..34ffc125763f 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -9905,6 +9905,7 @@ int btrfs_read_block_groups(struct btrfs_root *root) - btrfs_err(info, - "bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups", - cache->key.objectid); -+ btrfs_put_block_group(cache); - ret = -EINVAL; - goto error; - } -diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c -index f7a9adab0b84..6f5d78b172ba 100644 ---- a/fs/cifs/smb1ops.c -+++ b/fs/cifs/smb1ops.c -@@ -180,6 +180,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server) - /* we do not want to loop forever */ - last_mid = cur_mid; - cur_mid++; -+ /* avoid 0xFFFF MID */ -+ if (cur_mid == 0xffff) -+ cur_mid++; - - /* - * This nested loop looks more expensive than it is. -diff --git a/mm/shmem.c b/mm/shmem.c -index f11aec40f2e1..62668379623b 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -1854,11 +1854,12 @@ static void shmem_tag_pins(struct address_space *mapping) - void **slot; - pgoff_t start; - struct page *page; -+ unsigned int tagged = 0; - - lru_add_drain(); - start = 0; -- rcu_read_lock(); - -+ spin_lock_irq(&mapping->tree_lock); - restart: - radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) { - page = radix_tree_deref_slot(slot); -@@ -1866,19 +1867,20 @@ restart: - if (radix_tree_deref_retry(page)) - goto restart; - } else if (page_count(page) - page_mapcount(page) > 1) { -- spin_lock_irq(&mapping->tree_lock); - radix_tree_tag_set(&mapping->page_tree, iter.index, - SHMEM_TAG_PINNED); -- spin_unlock_irq(&mapping->tree_lock); - } - -- if (need_resched()) { -- cond_resched_rcu(); -- start = iter.index + 1; -- goto restart; -- } -+ if (++tagged % 1024) -+ continue; -+ -+ spin_unlock_irq(&mapping->tree_lock); -+ cond_resched(); -+ start = iter.index + 1; -+ spin_lock_irq(&mapping->tree_lock); -+ goto restart; - } -- rcu_read_unlock(); -+ spin_unlock_irq(&mapping->tree_lock); - } - - /* -diff --git a/mm/slub.c b/mm/slub.c -index c33b0e13cca7..8f5dcb0ac24f 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -4522,7 +4522,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s, - } - } - -- get_online_mems(); -+ /* -+ * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex" -+ * already held which will conflict with an existing lock order: -+ * -+ * mem_hotplug_lock->slab_mutex->kernfs_mutex -+ * -+ * We don't really need mem_hotplug_lock (to hold off -+ * slab_mem_going_offline_callback) here because slab's memory hot -+ * unplug code doesn't destroy the kmem_cache->node[] data. -+ */ -+ - #ifdef CONFIG_SLUB_DEBUG - if (flags & SO_ALL) { - struct kmem_cache_node *n; -@@ -4563,7 +4573,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s, - x += sprintf(buf + x, " N%d=%lu", - node, nodes[node]); - #endif -- put_online_mems(); - kfree(nodes); - return x + sprintf(buf + x, "\n"); - } -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index a60078de1191..42132ac2c497 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2209,7 +2209,7 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4, - struct fib_result res; - struct rtable *rth; - int orig_oif; -- int err = -ENETUNREACH; -+ int err; - - res.tclassid = 0; - res.fi = NULL; -@@ -2224,11 +2224,14 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4, - - rcu_read_lock(); - if (fl4->saddr) { -- rth = ERR_PTR(-EINVAL); - if (ipv4_is_multicast(fl4->saddr) || - ipv4_is_lbcast(fl4->saddr) || -- ipv4_is_zeronet(fl4->saddr)) -+ ipv4_is_zeronet(fl4->saddr)) { -+ rth = ERR_PTR(-EINVAL); - goto out; -+ } -+ -+ rth = ERR_PTR(-ENETUNREACH); - - /* I removed check for oif == dev_out->oif here. - It was wrong for two reasons: -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index 24eec3cb922d..031fbfd36d58 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -2431,7 +2431,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw, - - rcu_read_lock(); - ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID); -- if (WARN_ON_ONCE(ssid == NULL)) -+ if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN, -+ "invalid SSID element (len=%d)", ssid ? ssid[1] : -1)) - ssid_len = 0; - else - ssid_len = ssid[1]; -@@ -4669,7 +4670,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata, - - rcu_read_lock(); - ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID); -- if (!ssidie) { -+ if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) { - rcu_read_unlock(); - kfree(assoc_data); - return -EINVAL; -diff --git a/net/sched/act_api.c b/net/sched/act_api.c -index f44fea22d69c..b3a165cb63ee 100644 ---- a/net/sched/act_api.c -+++ b/net/sched/act_api.c -@@ -946,10 +946,15 @@ static int - tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n, - u32 portid, int ovr) - { -- int ret = 0; -+ int loop, ret; - LIST_HEAD(actions); - -- ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions); -+ for (loop = 0; loop < 10; loop++) { -+ ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions); -+ if (ret != -EAGAIN) -+ break; -+ } -+ - if (ret) - goto done; - -@@ -992,10 +997,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n) - */ - if (n->nlmsg_flags & NLM_F_REPLACE) - ovr = 1; --replay: - ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr); -- if (ret == -EAGAIN) -- goto replay; - break; - case RTM_DELACTION: - ret = tca_action_gd(net, tca[TCA_ACT_TAB], n, -diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c -index 4fbb67430ce4..4d745a2efd20 100644 ---- a/net/sched/cls_u32.c -+++ b/net/sched/cls_u32.c -@@ -734,6 +734,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, - struct nlattr *opt = tca[TCA_OPTIONS]; - struct nlattr *tb[TCA_U32_MAX + 1]; - u32 htid; -+ size_t sel_size; - int err; - #ifdef CONFIG_CLS_U32_PERF - size_t size; -@@ -827,8 +828,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, - return -EINVAL; - - s = nla_data(tb[TCA_U32_SEL]); -+ sel_size = sizeof(*s) + sizeof(*s->keys) * s->nkeys; -+ if (nla_len(tb[TCA_U32_SEL]) < sel_size) -+ return -EINVAL; - -- n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL); -+ n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL); - if (n == NULL) - return -ENOBUFS; - -@@ -841,7 +845,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, - } - #endif - -- memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key)); -+ memcpy(&n->sel, s, sel_size); - RCU_INIT_POINTER(n->ht_up, ht); - n->handle = handle; - n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0; -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 53f1b33bca4e..191fd251e8a0 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -7443,7 +7443,7 @@ struct proto sctp_prot = { - .backlog_rcv = sctp_backlog_rcv, - .hash = sctp_hash, - .unhash = sctp_unhash, -- .get_port = sctp_get_port, -+ .no_autobind = true, - .obj_size = sizeof(struct sctp_sock), - .sysctl_mem = sysctl_sctp_mem, - .sysctl_rmem = sysctl_sctp_rmem, -@@ -7482,7 +7482,7 @@ struct proto sctpv6_prot = { - .backlog_rcv = sctp_backlog_rcv, - .hash = sctp_hash, - .unhash = sctp_unhash, -- .get_port = sctp_get_port, -+ .no_autobind = true, - .obj_size = sizeof(struct sctp6_sock), - .sysctl_mem = sysctl_sctp_mem, - .sysctl_rmem = sysctl_sctp_rmem, -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 95c8e682b491..2023802b6c77 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -4816,6 +4816,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) - if (!rdev->ops->del_mpath) - return -EOPNOTSUPP; - -+ if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) -+ return -EOPNOTSUPP; -+ - return rdev_del_mpath(rdev, dev, dst); - } - -diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c -index a4e8af3321d2..98ff9d9e1aa9 100644 ---- a/net/wireless/wext-sme.c -+++ b/net/wireless/wext-sme.c -@@ -225,6 +225,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev, - struct iw_point *data, char *ssid) - { - struct wireless_dev *wdev = dev->ieee80211_ptr; -+ int ret = 0; - - /* call only for station! */ - if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION)) -@@ -242,7 +243,10 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev, - if (ie) { - data->flags = 1; - data->length = ie[1]; -- memcpy(ssid, ie + 2, data->length); -+ if (data->length > IW_ESSID_MAX_SIZE) -+ ret = -EINVAL; -+ else -+ memcpy(ssid, ie + 2, data->length); - } - rcu_read_unlock(); - } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) { -@@ -252,7 +256,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev, - } - wdev_unlock(wdev); - -- return 0; -+ return ret; - } - - int cfg80211_mgd_wext_siwap(struct net_device *dev, -diff --git a/scripts/namespace.pl b/scripts/namespace.pl -index a71be6b7cdec..9a2a32ce8a3b 100755 ---- a/scripts/namespace.pl -+++ b/scripts/namespace.pl -@@ -65,13 +65,14 @@ - require 5; # at least perl 5 - use strict; - use File::Find; -+use File::Spec; - - my $nm = ($ENV{'NM'} || "nm") . " -p"; - my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment"; --my $srctree = ""; --my $objtree = ""; --$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'})); --$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'})); -+my $srctree = File::Spec->curdir(); -+my $objtree = File::Spec->curdir(); -+$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'})); -+$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'})); - - if ($#ARGV != -1) { - print STDERR "usage: $0 takes no parameters\n"; -@@ -229,9 +230,9 @@ sub do_nm - } - ($source = $basename) =~ s/\.o$//; - if (-e "$source.c" || -e "$source.S") { -- $source = "$objtree$File::Find::dir/$source"; -+ $source = File::Spec->catfile($objtree, $File::Find::dir, $source) - } else { -- $source = "$srctree$File::Find::dir/$source"; -+ $source = File::Spec->catfile($srctree, $File::Find::dir, $source) - } - if (! -e "$source.c" && ! -e "$source.S") { - # No obvious source, exclude the object if it is conglomerate -diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c -index e00dfbec22c5..f18485c6a5d8 100644 ---- a/sound/soc/sh/rcar/core.c -+++ b/sound/soc/sh/rcar/core.c -@@ -524,6 +524,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - } - - /* set format */ -+ rdai->bit_clk_inv = 0; - switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { - case SND_SOC_DAIFMT_I2S: - rdai->sys_delay = 0; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.198-199.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.198-199.patch deleted file mode 100644 index 0993f95c753c..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.198-199.patch +++ /dev/null @@ -1,2218 +0,0 @@ -diff --git a/Makefile b/Makefile -index 3de38e5e93d1..6b09890b170c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 198 -+SUBLEVEL = 199 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/fw/sni/sniprom.c b/arch/mips/fw/sni/sniprom.c -index 6aa264b9856a..7c6151d412bd 100644 ---- a/arch/mips/fw/sni/sniprom.c -+++ b/arch/mips/fw/sni/sniprom.c -@@ -42,7 +42,7 @@ - - /* O32 stack has to be 8-byte aligned. */ - static u64 o32_stk[4096]; --#define O32_STK &o32_stk[sizeof(o32_stk)] -+#define O32_STK (&o32_stk[ARRAY_SIZE(o32_stk)]) - - #define __PROM_O32(fun, arg) fun arg __asm__(#fun); \ - __asm__(#fun " = call_o32") -diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c -index 79ddd580d605..ca6fab51eea1 100644 ---- a/arch/s390/mm/cmm.c -+++ b/arch/s390/mm/cmm.c -@@ -306,16 +306,16 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write, - } - - if (write) { -- len = *lenp; -- if (copy_from_user(buf, buffer, -- len > sizeof(buf) ? sizeof(buf) : len)) -+ len = min(*lenp, sizeof(buf)); -+ if (copy_from_user(buf, buffer, len)) - return -EFAULT; -- buf[sizeof(buf) - 1] = '\0'; -+ buf[len - 1] = '\0'; - cmm_skip_blanks(buf, &p); - nr = simple_strtoul(p, &p, 0); - cmm_skip_blanks(p, &p); - seconds = simple_strtoul(p, &p, 0); - cmm_set_timeout(nr, seconds); -+ *ppos += *lenp; - } else { - len = sprintf(buf, "%ld %ld\n", - cmm_timeout_pages, cmm_timeout_seconds); -@@ -323,9 +323,9 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write, - len = *lenp; - if (copy_to_user(buffer, buf, len)) - return -EFAULT; -+ *lenp = len; -+ *ppos += len; - } -- *lenp = len; -- *ppos += len; - return 0; - } - -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index ad285404ea7f..4bc352fc08f1 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -859,9 +859,6 @@ static void __init kexec_enter_virtual_mode(void) - - if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX)) - runtime_code_page_mkexec(); -- -- /* clean DUMMY object */ -- efi_delete_dummy_variable(); - #endif - } - -diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c -index f40f7df4b734..c0e54396f250 100644 ---- a/drivers/firmware/efi/cper.c -+++ b/drivers/firmware/efi/cper.c -@@ -375,7 +375,7 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie, - printk("%s""vendor_id: 0x%04x, device_id: 0x%04x\n", pfx, - pcie->device_id.vendor_id, pcie->device_id.device_id); - p = pcie->device_id.class_code; -- printk("%s""class_code: %02x%02x%02x\n", pfx, p[0], p[1], p[2]); -+ printk("%s""class_code: %02x%02x%02x\n", pfx, p[2], p[1], p[0]); - } - if (pcie->validation_bits & CPER_PCIE_VALID_SERIAL_NUMBER) - printk("%s""serial number: 0x%04x, 0x%04x\n", pfx, -diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c -index a594e478a1e2..843aed4dec80 100644 ---- a/drivers/hid/hid-axff.c -+++ b/drivers/hid/hid-axff.c -@@ -75,13 +75,20 @@ static int axff_init(struct hid_device *hid) - { - struct axff_device *axff; - struct hid_report *report; -- struct hid_input *hidinput = list_first_entry(&hid->inputs, struct hid_input, list); -+ struct hid_input *hidinput; - struct list_head *report_list =&hid->report_enum[HID_OUTPUT_REPORT].report_list; -- struct input_dev *dev = hidinput->input; -+ struct input_dev *dev; - int field_count = 0; - int i, j; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); -+ dev = hidinput->input; -+ - if (list_empty(report_list)) { - hid_err(hid, "no output reports found\n"); - return -ENODEV; -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 9b2b41d683de..8c61a35c160d 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -959,6 +959,7 @@ int hid_open_report(struct hid_device *device) - __u8 *start; - __u8 *buf; - __u8 *end; -+ __u8 *next; - int ret; - static int (*dispatch_type[])(struct hid_parser *parser, - struct hid_item *item) = { -@@ -1012,7 +1013,8 @@ int hid_open_report(struct hid_device *device) - device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; - - ret = -EINVAL; -- while ((start = fetch_item(start, end, &item)) != NULL) { -+ while ((next = fetch_item(start, end, &item)) != NULL) { -+ start = next; - - if (item.format != HID_ITEM_FORMAT_SHORT) { - hid_err(device, "unexpected long global item\n"); -@@ -1041,7 +1043,8 @@ int hid_open_report(struct hid_device *device) - } - } - -- hid_err(device, "item fetching failed at offset %d\n", (int)(end - start)); -+ hid_err(device, "item fetching failed at offset %u/%u\n", -+ size - (unsigned int)(end - start), size); - err: - vfree(parser); - hid_close_report(device); -diff --git a/drivers/hid/hid-dr.c b/drivers/hid/hid-dr.c -index 1d78ba3b799e..fac829d2b19a 100644 ---- a/drivers/hid/hid-dr.c -+++ b/drivers/hid/hid-dr.c -@@ -87,13 +87,19 @@ static int drff_init(struct hid_device *hid) - { - struct drff_device *drff; - struct hid_report *report; -- struct hid_input *hidinput = list_first_entry(&hid->inputs, -- struct hid_input, list); -+ struct hid_input *hidinput; - struct list_head *report_list = - &hid->report_enum[HID_OUTPUT_REPORT].report_list; -- struct input_dev *dev = hidinput->input; -+ struct input_dev *dev; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); -+ dev = hidinput->input; -+ - if (list_empty(report_list)) { - hid_err(hid, "no output reports found\n"); - return -ENODEV; -diff --git a/drivers/hid/hid-emsff.c b/drivers/hid/hid-emsff.c -index d82d75bb11f7..80f9a02dfa69 100644 ---- a/drivers/hid/hid-emsff.c -+++ b/drivers/hid/hid-emsff.c -@@ -59,13 +59,19 @@ static int emsff_init(struct hid_device *hid) - { - struct emsff_device *emsff; - struct hid_report *report; -- struct hid_input *hidinput = list_first_entry(&hid->inputs, -- struct hid_input, list); -+ struct hid_input *hidinput; - struct list_head *report_list = - &hid->report_enum[HID_OUTPUT_REPORT].report_list; -- struct input_dev *dev = hidinput->input; -+ struct input_dev *dev; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); -+ dev = hidinput->input; -+ - if (list_empty(report_list)) { - hid_err(hid, "no output reports found\n"); - return -ENODEV; -diff --git a/drivers/hid/hid-gaff.c b/drivers/hid/hid-gaff.c -index 2d8cead3adca..5a02c50443cb 100644 ---- a/drivers/hid/hid-gaff.c -+++ b/drivers/hid/hid-gaff.c -@@ -77,14 +77,20 @@ static int gaff_init(struct hid_device *hid) - { - struct gaff_device *gaff; - struct hid_report *report; -- struct hid_input *hidinput = list_entry(hid->inputs.next, -- struct hid_input, list); -+ struct hid_input *hidinput; - struct list_head *report_list = - &hid->report_enum[HID_OUTPUT_REPORT].report_list; - struct list_head *report_ptr = report_list; -- struct input_dev *dev = hidinput->input; -+ struct input_dev *dev; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - if (list_empty(report_list)) { - hid_err(hid, "no output reports found\n"); - return -ENODEV; -diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c -index 9325545fc3ae..3e84551cca9c 100644 ---- a/drivers/hid/hid-holtekff.c -+++ b/drivers/hid/hid-holtekff.c -@@ -140,13 +140,19 @@ static int holtekff_init(struct hid_device *hid) - { - struct holtekff_device *holtekff; - struct hid_report *report; -- struct hid_input *hidinput = list_entry(hid->inputs.next, -- struct hid_input, list); -+ struct hid_input *hidinput; - struct list_head *report_list = - &hid->report_enum[HID_OUTPUT_REPORT].report_list; -- struct input_dev *dev = hidinput->input; -+ struct input_dev *dev; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - if (list_empty(report_list)) { - hid_err(hid, "no output report found\n"); - return -ENODEV; -diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c -index 0e3fb1a7e421..6909d9c2fc67 100644 ---- a/drivers/hid/hid-lg2ff.c -+++ b/drivers/hid/hid-lg2ff.c -@@ -62,11 +62,17 @@ int lg2ff_init(struct hid_device *hid) - { - struct lg2ff_device *lg2ff; - struct hid_report *report; -- struct hid_input *hidinput = list_entry(hid->inputs.next, -- struct hid_input, list); -- struct input_dev *dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *dev; - int error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - /* Check that the report looks ok */ - report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7); - if (!report) -diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c -index 8c2da183d3bc..acf739fc4060 100644 ---- a/drivers/hid/hid-lg3ff.c -+++ b/drivers/hid/hid-lg3ff.c -@@ -129,12 +129,19 @@ static const signed short ff3_joystick_ac[] = { - - int lg3ff_init(struct hid_device *hid) - { -- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); -- struct input_dev *dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *dev; - const signed short *ff_bits = ff3_joystick_ac; - int error; - int i; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - /* Check that the report looks ok */ - if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35)) - return -ENODEV; -diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c -index dae1b9cdd2e5..d8432d9f10f0 100644 ---- a/drivers/hid/hid-lg4ff.c -+++ b/drivers/hid/hid-lg4ff.c -@@ -1158,8 +1158,8 @@ static int lg4ff_handle_multimode_wheel(struct hid_device *hid, u16 *real_produc - - int lg4ff_init(struct hid_device *hid) - { -- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); -- struct input_dev *dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *dev; - struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; - struct hid_report *report = list_entry(report_list->next, struct hid_report, list); - const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor); -@@ -1171,6 +1171,13 @@ int lg4ff_init(struct hid_device *hid) - int mmode_ret, mmode_idx = -1; - u16 real_product_id; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - /* Check that the report looks ok */ - if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) - return -1; -diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c -index e1394af0ae7b..1871cdcd1e0a 100644 ---- a/drivers/hid/hid-lgff.c -+++ b/drivers/hid/hid-lgff.c -@@ -127,12 +127,19 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude) - - int lgff_init(struct hid_device* hid) - { -- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); -- struct input_dev *dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *dev; - const signed short *ff_bits = ff_joystick; - int error; - int i; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - /* Check that the report looks ok */ - if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) - return -ENODEV; -diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c -index 6f3d47185bf0..ce89077942f0 100644 ---- a/drivers/hid/hid-sony.c -+++ b/drivers/hid/hid-sony.c -@@ -1960,9 +1960,15 @@ static int sony_play_effect(struct input_dev *dev, void *data, - - static int sony_init_ff(struct sony_sc *sc) - { -- struct hid_input *hidinput = list_entry(sc->hdev->inputs.next, -- struct hid_input, list); -- struct input_dev *input_dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *input_dev; -+ -+ if (list_empty(&sc->hdev->inputs)) { -+ hid_err(sc->hdev, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(sc->hdev->inputs.next, struct hid_input, list); -+ input_dev = hidinput->input; - - input_set_capability(input_dev, EV_FF, FF_RUMBLE); - return input_ff_create_memless(input_dev, NULL, sony_play_effect); -diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c -index cfa0cb22c9b3..d98e471a5f7b 100644 ---- a/drivers/hid/hid-tmff.c -+++ b/drivers/hid/hid-tmff.c -@@ -136,12 +136,18 @@ static int tmff_init(struct hid_device *hid, const signed short *ff_bits) - struct tmff_device *tmff; - struct hid_report *report; - struct list_head *report_list; -- struct hid_input *hidinput = list_entry(hid->inputs.next, -- struct hid_input, list); -- struct input_dev *input_dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *input_dev; - int error; - int i; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ input_dev = hidinput->input; -+ - tmff = kzalloc(sizeof(struct tmff_device), GFP_KERNEL); - if (!tmff) - return -ENOMEM; -diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c -index a29756c6ca02..4e7e01be99b1 100644 ---- a/drivers/hid/hid-zpff.c -+++ b/drivers/hid/hid-zpff.c -@@ -66,11 +66,17 @@ static int zpff_init(struct hid_device *hid) - { - struct zpff_device *zpff; - struct hid_report *report; -- struct hid_input *hidinput = list_entry(hid->inputs.next, -- struct hid_input, list); -- struct input_dev *dev = hidinput->input; -+ struct hid_input *hidinput; -+ struct input_dev *dev; - int i, error; - -+ if (list_empty(&hid->inputs)) { -+ hid_err(hid, "no inputs found\n"); -+ return -ENODEV; -+ } -+ hidinput = list_entry(hid->inputs.next, struct hid_input, list); -+ dev = hidinput->input; -+ - for (i = 0; i < 4; i++) { - report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1); - if (!report) -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index c7122919a8c0..ec7ddf867349 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -126,7 +126,7 @@ - #define BMC150_ACCEL_SLEEP_1_SEC 0x0F - - #define BMC150_ACCEL_REG_TEMP 0x08 --#define BMC150_ACCEL_TEMP_CENTER_VAL 24 -+#define BMC150_ACCEL_TEMP_CENTER_VAL 23 - - #define BMC150_ACCEL_AXIS_TO_REG(axis) (BMC150_ACCEL_REG_XOUT_L + (axis * 2)) - #define BMC150_AUTO_SUSPEND_DELAY_MS 2000 -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 1454290078de..8ad9c6b04769 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -1976,9 +1976,10 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id, - conn_id->cm_id.iw = NULL; - cma_exch(conn_id, RDMA_CM_DESTROYING); - mutex_unlock(&conn_id->handler_mutex); -+ mutex_unlock(&listen_id->handler_mutex); - cma_deref_id(conn_id); - rdma_destroy_id(&conn_id->id); -- goto out; -+ return ret; - } - - mutex_unlock(&conn_id->handler_mutex); -diff --git a/drivers/md/dm-bio-prison.c b/drivers/md/dm-bio-prison.c -index 03af174485d3..fa2432a89bac 100644 ---- a/drivers/md/dm-bio-prison.c -+++ b/drivers/md/dm-bio-prison.c -@@ -32,7 +32,7 @@ static struct kmem_cache *_cell_cache; - */ - struct dm_bio_prison *dm_bio_prison_create(void) - { -- struct dm_bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL); -+ struct dm_bio_prison *prison = kzalloc(sizeof(*prison), GFP_KERNEL); - - if (!prison) - return NULL; -diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c -index 1b84d2890fbf..ad9a470e5382 100644 ---- a/drivers/md/dm-io.c -+++ b/drivers/md/dm-io.c -@@ -50,7 +50,7 @@ struct dm_io_client *dm_io_client_create(void) - struct dm_io_client *client; - unsigned min_ios = dm_get_reserved_bio_based_ios(); - -- client = kmalloc(sizeof(*client), GFP_KERNEL); -+ client = kzalloc(sizeof(*client), GFP_KERNEL); - if (!client) - return ERR_PTR(-ENOMEM); - -diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c -index 04248394843e..09df2c688ba9 100644 ---- a/drivers/md/dm-kcopyd.c -+++ b/drivers/md/dm-kcopyd.c -@@ -827,7 +827,7 @@ struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *thro - int r = -ENOMEM; - struct dm_kcopyd_client *kc; - -- kc = kmalloc(sizeof(*kc), GFP_KERNEL); -+ kc = kzalloc(sizeof(*kc), GFP_KERNEL); - if (!kc) - return ERR_PTR(-ENOMEM); - -diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c -index 74cb7b991d41..a93a4e683999 100644 ---- a/drivers/md/dm-region-hash.c -+++ b/drivers/md/dm-region-hash.c -@@ -179,7 +179,7 @@ struct dm_region_hash *dm_region_hash_create( - ; - nr_buckets >>= 1; - -- rh = kmalloc(sizeof(*rh), GFP_KERNEL); -+ rh = kzalloc(sizeof(*rh), GFP_KERNEL); - if (!rh) { - DMERR("unable to allocate region hash memory"); - return ERR_PTR(-ENOMEM); -diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c -index 5d3797728b9c..510b0cf430a8 100644 ---- a/drivers/md/dm-snap.c -+++ b/drivers/md/dm-snap.c -@@ -19,7 +19,6 @@ - #include - #include - #include --#include - - #include "dm.h" - -@@ -48,7 +47,7 @@ struct dm_exception_table { - }; - - struct dm_snapshot { -- struct rw_semaphore lock; -+ struct mutex lock; - - struct dm_dev *origin; - struct dm_dev *cow; -@@ -106,8 +105,8 @@ struct dm_snapshot { - /* The on disk metadata handler */ - struct dm_exception_store *store; - -- /* Maximum number of in-flight COW jobs. */ -- struct semaphore cow_count; -+ unsigned in_progress; -+ wait_queue_head_t in_progress_wait; - - struct dm_kcopyd_client *kcopyd_client; - -@@ -158,8 +157,8 @@ struct dm_snapshot { - */ - #define DEFAULT_COW_THRESHOLD 2048 - --static int cow_threshold = DEFAULT_COW_THRESHOLD; --module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644); -+static unsigned cow_threshold = DEFAULT_COW_THRESHOLD; -+module_param_named(snapshot_cow_threshold, cow_threshold, uint, 0644); - MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write"); - - DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle, -@@ -457,9 +456,9 @@ static int __find_snapshots_sharing_cow(struct dm_snapshot *snap, - if (!bdev_equal(s->cow->bdev, snap->cow->bdev)) - continue; - -- down_read(&s->lock); -+ mutex_lock(&s->lock); - active = s->active; -- up_read(&s->lock); -+ mutex_unlock(&s->lock); - - if (active) { - if (snap_src) -@@ -927,7 +926,7 @@ static int remove_single_exception_chunk(struct dm_snapshot *s) - int r; - chunk_t old_chunk = s->first_merging_chunk + s->num_merging_chunks - 1; - -- down_write(&s->lock); -+ mutex_lock(&s->lock); - - /* - * Process chunks (and associated exceptions) in reverse order -@@ -942,7 +941,7 @@ static int remove_single_exception_chunk(struct dm_snapshot *s) - b = __release_queued_bios_after_merge(s); - - out: -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - if (b) - flush_bios(b); - -@@ -1001,9 +1000,9 @@ static void snapshot_merge_next_chunks(struct dm_snapshot *s) - if (linear_chunks < 0) { - DMERR("Read error in exception store: " - "shutting down merge"); -- down_write(&s->lock); -+ mutex_lock(&s->lock); - s->merge_failed = 1; -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - } - goto shut; - } -@@ -1044,10 +1043,10 @@ static void snapshot_merge_next_chunks(struct dm_snapshot *s) - previous_count = read_pending_exceptions_done_count(); - } - -- down_write(&s->lock); -+ mutex_lock(&s->lock); - s->first_merging_chunk = old_chunk; - s->num_merging_chunks = linear_chunks; -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - - /* Wait until writes to all 'linear_chunks' drain */ - for (i = 0; i < linear_chunks; i++) -@@ -1089,10 +1088,10 @@ static void merge_callback(int read_err, unsigned long write_err, void *context) - return; - - shut: -- down_write(&s->lock); -+ mutex_lock(&s->lock); - s->merge_failed = 1; - b = __release_queued_bios_after_merge(s); -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - error_bios(b); - - merge_shutdown(s); -@@ -1138,7 +1137,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - origin_mode = FMODE_WRITE; - } - -- s = kmalloc(sizeof(*s), GFP_KERNEL); -+ s = kzalloc(sizeof(*s), GFP_KERNEL); - if (!s) { - ti->error = "Cannot allocate private snapshot structure"; - r = -ENOMEM; -@@ -1191,7 +1190,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - s->exception_start_sequence = 0; - s->exception_complete_sequence = 0; - INIT_LIST_HEAD(&s->out_of_order_list); -- init_rwsem(&s->lock); -+ mutex_init(&s->lock); - INIT_LIST_HEAD(&s->list); - spin_lock_init(&s->pe_lock); - s->state_bits = 0; -@@ -1207,7 +1206,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) - goto bad_hash_tables; - } - -- sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX); -+ init_waitqueue_head(&s->in_progress_wait); - - s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle); - if (IS_ERR(s->kcopyd_client)) { -@@ -1358,9 +1357,9 @@ static void snapshot_dtr(struct dm_target *ti) - /* Check whether exception handover must be cancelled */ - (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL); - if (snap_src && snap_dest && (s == snap_src)) { -- down_write(&snap_dest->lock); -+ mutex_lock(&snap_dest->lock); - snap_dest->valid = 0; -- up_write(&snap_dest->lock); -+ mutex_unlock(&snap_dest->lock); - DMERR("Cancelling snapshot handover."); - } - up_read(&_origins_lock); -@@ -1391,13 +1390,62 @@ static void snapshot_dtr(struct dm_target *ti) - - dm_exception_store_destroy(s->store); - -+ mutex_destroy(&s->lock); -+ - dm_put_device(ti, s->cow); - - dm_put_device(ti, s->origin); - -+ WARN_ON(s->in_progress); -+ - kfree(s); - } - -+static void account_start_copy(struct dm_snapshot *s) -+{ -+ spin_lock(&s->in_progress_wait.lock); -+ s->in_progress++; -+ spin_unlock(&s->in_progress_wait.lock); -+} -+ -+static void account_end_copy(struct dm_snapshot *s) -+{ -+ spin_lock(&s->in_progress_wait.lock); -+ BUG_ON(!s->in_progress); -+ s->in_progress--; -+ if (likely(s->in_progress <= cow_threshold) && -+ unlikely(waitqueue_active(&s->in_progress_wait))) -+ wake_up_locked(&s->in_progress_wait); -+ spin_unlock(&s->in_progress_wait.lock); -+} -+ -+static bool wait_for_in_progress(struct dm_snapshot *s, bool unlock_origins) -+{ -+ if (unlikely(s->in_progress > cow_threshold)) { -+ spin_lock(&s->in_progress_wait.lock); -+ if (likely(s->in_progress > cow_threshold)) { -+ /* -+ * NOTE: this throttle doesn't account for whether -+ * the caller is servicing an IO that will trigger a COW -+ * so excess throttling may result for chunks not required -+ * to be COW'd. But if cow_threshold was reached, extra -+ * throttling is unlikely to negatively impact performance. -+ */ -+ DECLARE_WAITQUEUE(wait, current); -+ __add_wait_queue(&s->in_progress_wait, &wait); -+ __set_current_state(TASK_UNINTERRUPTIBLE); -+ spin_unlock(&s->in_progress_wait.lock); -+ if (unlock_origins) -+ up_read(&_origins_lock); -+ io_schedule(); -+ remove_wait_queue(&s->in_progress_wait, &wait); -+ return false; -+ } -+ spin_unlock(&s->in_progress_wait.lock); -+ } -+ return true; -+} -+ - /* - * Flush a list of buffers. - */ -@@ -1413,7 +1461,7 @@ static void flush_bios(struct bio *bio) - } - } - --static int do_origin(struct dm_dev *origin, struct bio *bio); -+static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit); - - /* - * Flush a list of buffers. -@@ -1426,7 +1474,7 @@ static void retry_origin_bios(struct dm_snapshot *s, struct bio *bio) - while (bio) { - n = bio->bi_next; - bio->bi_next = NULL; -- r = do_origin(s->origin, bio); -+ r = do_origin(s->origin, bio, false); - if (r == DM_MAPIO_REMAPPED) - generic_make_request(bio); - bio = n; -@@ -1478,7 +1526,7 @@ static void pending_complete(void *context, int success) - - if (!success) { - /* Read/write error - snapshot is unusable */ -- down_write(&s->lock); -+ mutex_lock(&s->lock); - __invalidate_snapshot(s, -EIO); - error = 1; - goto out; -@@ -1486,14 +1534,14 @@ static void pending_complete(void *context, int success) - - e = alloc_completed_exception(GFP_NOIO); - if (!e) { -- down_write(&s->lock); -+ mutex_lock(&s->lock); - __invalidate_snapshot(s, -ENOMEM); - error = 1; - goto out; - } - *e = pe->e; - -- down_write(&s->lock); -+ mutex_lock(&s->lock); - if (!s->valid) { - free_completed_exception(e); - error = 1; -@@ -1520,7 +1568,7 @@ out: - } - increment_pending_exceptions_done_count(); - -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - - /* Submit any pending write bios */ - if (error) { -@@ -1582,7 +1630,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context) - } - list_add(&pe->out_of_order_entry, lh); - } -- up(&s->cow_count); -+ account_end_copy(s); - } - - /* -@@ -1606,7 +1654,7 @@ static void start_copy(struct dm_snap_pending_exception *pe) - dest.count = src.count; - - /* Hand over to kcopyd */ -- down(&s->cow_count); -+ account_start_copy(s); - dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe); - } - -@@ -1627,7 +1675,7 @@ static void start_full_bio(struct dm_snap_pending_exception *pe, - pe->full_bio_end_io = bio->bi_end_io; - pe->full_bio_private = bio->bi_private; - -- down(&s->cow_count); -+ account_start_copy(s); - callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client, - copy_callback, pe); - -@@ -1718,9 +1766,12 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) - if (!s->valid) - return -EIO; - -- /* FIXME: should only take write lock if we need -- * to copy an exception */ -- down_write(&s->lock); -+ if (bio_data_dir(bio) == WRITE) { -+ while (unlikely(!wait_for_in_progress(s, false))) -+ ; /* wait_for_in_progress() has slept */ -+ } -+ -+ mutex_lock(&s->lock); - - if (!s->valid || (unlikely(s->snapshot_overflowed) && bio_rw(bio) == WRITE)) { - r = -EIO; -@@ -1742,9 +1793,9 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) - if (bio_rw(bio) == WRITE) { - pe = __lookup_pending_exception(s, chunk); - if (!pe) { -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - pe = alloc_pending_exception(s); -- down_write(&s->lock); -+ mutex_lock(&s->lock); - - if (!s->valid || s->snapshot_overflowed) { - free_pending_exception(pe); -@@ -1779,7 +1830,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) - bio->bi_iter.bi_size == - (s->store->chunk_size << SECTOR_SHIFT)) { - pe->started = 1; -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - start_full_bio(pe, bio); - goto out; - } -@@ -1789,7 +1840,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) - if (!pe->started) { - /* this is protected by snap->lock */ - pe->started = 1; -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - start_copy(pe); - goto out; - } -@@ -1799,7 +1850,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) - } - - out_unlock: -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - out: - return r; - } -@@ -1835,7 +1886,7 @@ static int snapshot_merge_map(struct dm_target *ti, struct bio *bio) - - chunk = sector_to_chunk(s->store, bio->bi_iter.bi_sector); - -- down_write(&s->lock); -+ mutex_lock(&s->lock); - - /* Full merging snapshots are redirected to the origin */ - if (!s->valid) -@@ -1866,12 +1917,12 @@ redirect_to_origin: - bio->bi_bdev = s->origin->bdev; - - if (bio_rw(bio) == WRITE) { -- up_write(&s->lock); -- return do_origin(s->origin, bio); -+ mutex_unlock(&s->lock); -+ return do_origin(s->origin, bio, false); - } - - out_unlock: -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - - return r; - } -@@ -1902,7 +1953,7 @@ static int snapshot_preresume(struct dm_target *ti) - down_read(&_origins_lock); - (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL); - if (snap_src && snap_dest) { -- down_read(&snap_src->lock); -+ mutex_lock(&snap_src->lock); - if (s == snap_src) { - DMERR("Unable to resume snapshot source until " - "handover completes."); -@@ -1912,7 +1963,7 @@ static int snapshot_preresume(struct dm_target *ti) - "source is suspended."); - r = -EINVAL; - } -- up_read(&snap_src->lock); -+ mutex_unlock(&snap_src->lock); - } - up_read(&_origins_lock); - -@@ -1958,11 +2009,11 @@ static void snapshot_resume(struct dm_target *ti) - - (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL); - if (snap_src && snap_dest) { -- down_write(&snap_src->lock); -- down_write_nested(&snap_dest->lock, SINGLE_DEPTH_NESTING); -+ mutex_lock(&snap_src->lock); -+ mutex_lock_nested(&snap_dest->lock, SINGLE_DEPTH_NESTING); - __handover_exceptions(snap_src, snap_dest); -- up_write(&snap_dest->lock); -- up_write(&snap_src->lock); -+ mutex_unlock(&snap_dest->lock); -+ mutex_unlock(&snap_src->lock); - } - - up_read(&_origins_lock); -@@ -1977,9 +2028,9 @@ static void snapshot_resume(struct dm_target *ti) - /* Now we have correct chunk size, reregister */ - reregister_snapshot(s); - -- down_write(&s->lock); -+ mutex_lock(&s->lock); - s->active = 1; -- up_write(&s->lock); -+ mutex_unlock(&s->lock); - } - - static uint32_t get_origin_minimum_chunksize(struct block_device *bdev) -@@ -2019,7 +2070,7 @@ static void snapshot_status(struct dm_target *ti, status_type_t type, - switch (type) { - case STATUSTYPE_INFO: - -- down_write(&snap->lock); -+ mutex_lock(&snap->lock); - - if (!snap->valid) - DMEMIT("Invalid"); -@@ -2044,7 +2095,7 @@ static void snapshot_status(struct dm_target *ti, status_type_t type, - DMEMIT("Unknown"); - } - -- up_write(&snap->lock); -+ mutex_unlock(&snap->lock); - - break; - -@@ -2110,7 +2161,7 @@ static int __origin_write(struct list_head *snapshots, sector_t sector, - if (dm_target_is_snapshot_merge(snap->ti)) - continue; - -- down_write(&snap->lock); -+ mutex_lock(&snap->lock); - - /* Only deal with valid and active snapshots */ - if (!snap->valid || !snap->active) -@@ -2137,9 +2188,9 @@ static int __origin_write(struct list_head *snapshots, sector_t sector, - - pe = __lookup_pending_exception(snap, chunk); - if (!pe) { -- up_write(&snap->lock); -+ mutex_unlock(&snap->lock); - pe = alloc_pending_exception(snap); -- down_write(&snap->lock); -+ mutex_lock(&snap->lock); - - if (!snap->valid) { - free_pending_exception(pe); -@@ -2182,7 +2233,7 @@ static int __origin_write(struct list_head *snapshots, sector_t sector, - } - - next_snapshot: -- up_write(&snap->lock); -+ mutex_unlock(&snap->lock); - - if (pe_to_start_now) { - start_copy(pe_to_start_now); -@@ -2203,15 +2254,24 @@ next_snapshot: - /* - * Called on a write from the origin driver. - */ --static int do_origin(struct dm_dev *origin, struct bio *bio) -+static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit) - { - struct origin *o; - int r = DM_MAPIO_REMAPPED; - -+again: - down_read(&_origins_lock); - o = __lookup_origin(origin->bdev); -- if (o) -+ if (o) { -+ if (limit) { -+ struct dm_snapshot *s; -+ list_for_each_entry(s, &o->snapshots, list) -+ if (unlikely(!wait_for_in_progress(s, true))) -+ goto again; -+ } -+ - r = __origin_write(&o->snapshots, bio->bi_iter.bi_sector, bio); -+ } - up_read(&_origins_lock); - - return r; -@@ -2324,7 +2384,7 @@ static int origin_map(struct dm_target *ti, struct bio *bio) - dm_accept_partial_bio(bio, available_sectors); - - /* Only tell snapshots if this is a write */ -- return do_origin(o->dev, bio); -+ return do_origin(o->dev, bio, true); - } - - /* -diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c -index d52ea584e0bc..4d7eae3d32b0 100644 ---- a/drivers/md/dm-thin.c -+++ b/drivers/md/dm-thin.c -@@ -2882,7 +2882,7 @@ static struct pool *pool_create(struct mapped_device *pool_md, - return (struct pool *)pmd; - } - -- pool = kmalloc(sizeof(*pool), GFP_KERNEL); -+ pool = kzalloc(sizeof(*pool), GFP_KERNEL); - if (!pool) { - *error = "Error allocating memory for pool"; - err_p = ERR_PTR(-ENOMEM); -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index fd6aff9f0052..1bf4f54c2bef 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3889,7 +3889,7 @@ out: - * this to-be-skipped slave to send a packet out. - */ - old_arr = rtnl_dereference(bond->slave_arr); -- for (idx = 0; idx < old_arr->count; idx++) { -+ for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) { - if (skipslave == old_arr->arr[idx]) { - old_arr->arr[idx] = - old_arr->arr[old_arr->count-1]; -diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c -index 004c955c1fd1..da0ae16f5c74 100644 ---- a/drivers/net/usb/sr9800.c -+++ b/drivers/net/usb/sr9800.c -@@ -336,7 +336,7 @@ static void sr_set_multicast(struct net_device *net) - static int sr_mdio_read(struct net_device *net, int phy_id, int loc) - { - struct usbnet *dev = netdev_priv(net); -- __le16 res; -+ __le16 res = 0; - - mutex_lock(&dev->phy_mutex); - sr_set_sw_mii(dev); -diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c -index 9da3594fd010..fc22c5f47927 100644 ---- a/drivers/net/wireless/ath/ath6kl/usb.c -+++ b/drivers/net/wireless/ath/ath6kl/usb.c -@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe) - struct ath6kl_urb_context *urb_context = NULL; - unsigned long flags; - -+ /* bail if this pipe is not initialized */ -+ if (!pipe->ar_usb) -+ return NULL; -+ - spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); - if (!list_empty(&pipe->urb_list_head)) { - urb_context = -@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe, - { - unsigned long flags; - -+ /* bail if this pipe is not initialized */ -+ if (!pipe->ar_usb) -+ return; -+ - spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); - pipe->urb_cnt++; - -diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c -index 626ff300352b..1fd3f22796a7 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/ps.c -+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c -@@ -781,6 +781,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, - return; - } else { - noa_num = (noa_len - 2) / 13; -+ if (noa_num > P2P_MAX_NOA_NUM) -+ noa_num = P2P_MAX_NOA_NUM; -+ - } - noa_index = ie[3]; - if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == -@@ -875,6 +878,9 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, - return; - } else { - noa_num = (noa_len - 2) / 13; -+ if (noa_num > P2P_MAX_NOA_NUM) -+ noa_num = P2P_MAX_NOA_NUM; -+ - } - noa_index = ie[3]; - if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == -diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c -index 6713fd1958e7..3a39d7d0175a 100644 ---- a/drivers/thunderbolt/nhi.c -+++ b/drivers/thunderbolt/nhi.c -@@ -94,9 +94,20 @@ static void __iomem *ring_options_base(struct tb_ring *ring) - return io; - } - --static void ring_iowrite16desc(struct tb_ring *ring, u32 value, u32 offset) -+static void ring_iowrite_cons(struct tb_ring *ring, u16 cons) - { -- iowrite16(value, ring_desc_base(ring) + offset); -+ /* -+ * The other 16-bits in the register is read-only and writes to it -+ * are ignored by the hardware so we can save one ioread32() by -+ * filling the read-only bits with zeroes. -+ */ -+ iowrite32(cons, ring_desc_base(ring) + 8); -+} -+ -+static void ring_iowrite_prod(struct tb_ring *ring, u16 prod) -+{ -+ /* See ring_iowrite_cons() above for explanation */ -+ iowrite32(prod << 16, ring_desc_base(ring) + 8); - } - - static void ring_iowrite32desc(struct tb_ring *ring, u32 value, u32 offset) -@@ -148,7 +159,10 @@ static void ring_write_descriptors(struct tb_ring *ring) - descriptor->sof = frame->sof; - } - ring->head = (ring->head + 1) % ring->size; -- ring_iowrite16desc(ring, ring->head, ring->is_tx ? 10 : 8); -+ if (ring->is_tx) -+ ring_iowrite_prod(ring, ring->head); -+ else -+ ring_iowrite_cons(ring, ring->head); - } - } - -@@ -368,7 +382,7 @@ void ring_stop(struct tb_ring *ring) - - ring_iowrite32options(ring, 0, 0); - ring_iowrite64desc(ring, 0, 0); -- ring_iowrite16desc(ring, 0, ring->is_tx ? 10 : 8); -+ ring_iowrite32desc(ring, 0, 8); - ring_iowrite32desc(ring, 0, 12); - ring->head = 0; - ring->tail = 0; -diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c -index 032f3c13b8c4..a3dfefa33e3c 100644 ---- a/drivers/tty/serial/sc16is7xx.c -+++ b/drivers/tty/serial/sc16is7xx.c -@@ -332,6 +332,7 @@ struct sc16is7xx_port { - struct kthread_worker kworker; - struct task_struct *kworker_task; - struct kthread_work irq_work; -+ struct mutex efr_lock; - struct sc16is7xx_one p[0]; - }; - -@@ -496,6 +497,21 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - div /= 4; - } - -+ /* In an amazing feat of design, the Enhanced Features Register shares -+ * the address of the Interrupt Identification Register, and is -+ * switched in by writing a magic value (0xbf) to the Line Control -+ * Register. Any interrupt firing during this time will see the EFR -+ * where it expects the IIR to be, leading to "Unexpected interrupt" -+ * messages. -+ * -+ * Prevent this possibility by claiming a mutex while accessing the -+ * EFR, and claiming the same mutex from within the interrupt handler. -+ * This is similar to disabling the interrupt, but that doesn't work -+ * because the bulk of the interrupt processing is run as a workqueue -+ * job in thread context. -+ */ -+ mutex_lock(&s->efr_lock); -+ - lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); - - /* Open the LCR divisors for configuration */ -@@ -511,6 +527,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) - /* Put LCR back to the normal mode */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - -+ mutex_unlock(&s->efr_lock); -+ - sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, - SC16IS7XX_MCR_CLKSEL_BIT, - prescaler); -@@ -693,6 +711,8 @@ static void sc16is7xx_ist(struct kthread_work *ws) - { - struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); - -+ mutex_lock(&s->efr_lock); -+ - while (1) { - bool keep_polling = false; - int i; -@@ -702,6 +722,8 @@ static void sc16is7xx_ist(struct kthread_work *ws) - if (!keep_polling) - break; - } -+ -+ mutex_unlock(&s->efr_lock); - } - - static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) -@@ -888,6 +910,9 @@ static void sc16is7xx_set_termios(struct uart_port *port, - if (!(termios->c_cflag & CREAD)) - port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK; - -+ /* As above, claim the mutex while accessing the EFR. */ -+ mutex_lock(&s->efr_lock); -+ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, - SC16IS7XX_LCR_CONF_MODE_B); - -@@ -909,6 +934,8 @@ static void sc16is7xx_set_termios(struct uart_port *port, - /* Update LCR register */ - sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); - -+ mutex_unlock(&s->efr_lock); -+ - /* Get baud rate generator configuration */ - baud = uart_get_baud_rate(port, termios, old, - port->uartclk / 16 / 4 / 0xffff, -@@ -1172,6 +1199,7 @@ static int sc16is7xx_probe(struct device *dev, - s->regmap = regmap; - s->devtype = devtype; - dev_set_drvdata(dev, s); -+ mutex_init(&s->efr_lock); - - init_kthread_worker(&s->kworker); - init_kthread_work(&s->irq_work, sc16is7xx_ist); -diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c -index 02147361eaa9..2b5329a3d716 100644 ---- a/drivers/tty/serial/serial_mctrl_gpio.c -+++ b/drivers/tty/serial/serial_mctrl_gpio.c -@@ -67,6 +67,9 @@ EXPORT_SYMBOL_GPL(mctrl_gpio_set); - struct gpio_desc *mctrl_gpio_to_gpiod(struct mctrl_gpios *gpios, - enum mctrl_gpio_idx gidx) - { -+ if (gpios == NULL) -+ return NULL; -+ - return gpios->gpio[gidx]; - } - EXPORT_SYMBOL_GPL(mctrl_gpio_to_gpiod); -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 5c274c5440da..11881c5a1fb0 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -102,6 +102,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem); - static void hub_release(struct kref *kref); - static int usb_reset_and_verify_device(struct usb_device *udev); - static int hub_port_disable(struct usb_hub *hub, int port1, int set_state); -+static bool hub_port_warm_reset_required(struct usb_hub *hub, int port1, -+ u16 portstatus); - - static inline char *portspeed(struct usb_hub *hub, int portstatus) - { -@@ -1092,6 +1094,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - USB_PORT_FEAT_ENABLE); - } - -+ /* Make sure a warm-reset request is handled by port_event */ -+ if (type == HUB_RESUME && -+ hub_port_warm_reset_required(hub, port1, portstatus)) -+ set_bit(port1, hub->event_bits); -+ - /* - * Add debounce if USB3 link is in polling/link training state. - * Link will automatically transition to Enabled state after -diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c -index 7da242bbe37b..8f5f8ad98632 100644 ---- a/drivers/usb/misc/ldusb.c -+++ b/drivers/usb/misc/ldusb.c -@@ -499,11 +499,11 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count, - retval = -EFAULT; - goto unlock_exit; - } -- dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size; -- - retval = bytes_to_read; - - spin_lock_irq(&dev->rbsl); -+ dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size; -+ - if (dev->buffer_overflow) { - dev->buffer_overflow = 0; - spin_unlock_irq(&dev->rbsl); -@@ -584,7 +584,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer, - 1 << 8, 0, - dev->interrupt_out_buffer, - bytes_to_write, -- USB_CTRL_SET_TIMEOUT * HZ); -+ USB_CTRL_SET_TIMEOUT); - if (retval < 0) - dev_err(&dev->intf->dev, - "Couldn't submit HID_REQ_SET_REPORT %d\n", -diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c -index 32b41eb07f00..8350ecfbcf21 100644 ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -910,7 +910,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - get_version_reply, - sizeof(*get_version_reply), - 1000); -- if (result < sizeof(*get_version_reply)) { -+ if (result != sizeof(*get_version_reply)) { - if (result >= 0) - result = -EIO; - dev_err(idev, "get version request failed: %d\n", result); -diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c -index d3ea90bef84d..345211f1a491 100644 ---- a/drivers/usb/serial/whiteheat.c -+++ b/drivers/usb/serial/whiteheat.c -@@ -604,6 +604,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command, - - command_port = port->serial->port[COMMAND_PORT]; - command_info = usb_get_serial_port_data(command_port); -+ -+ if (command_port->bulk_out_size < datasize + 1) -+ return -EIO; -+ - mutex_lock(&command_info->mutex); - command_info->command_finished = false; - -@@ -677,6 +681,7 @@ static void firm_setup_port(struct tty_struct *tty) - struct device *dev = &port->dev; - struct whiteheat_port_settings port_settings; - unsigned int cflag = tty->termios.c_cflag; -+ speed_t baud; - - port_settings.port = port->port_number + 1; - -@@ -737,11 +742,13 @@ static void firm_setup_port(struct tty_struct *tty) - dev_dbg(dev, "%s - XON = %2x, XOFF = %2x\n", __func__, port_settings.xon, port_settings.xoff); - - /* get the baud rate wanted */ -- port_settings.baud = tty_get_baud_rate(tty); -- dev_dbg(dev, "%s - baud rate = %d\n", __func__, port_settings.baud); -+ baud = tty_get_baud_rate(tty); -+ port_settings.baud = cpu_to_le32(baud); -+ dev_dbg(dev, "%s - baud rate = %u\n", __func__, baud); - - /* fixme: should set validated settings */ -- tty_encode_baud_rate(tty, port_settings.baud, port_settings.baud); -+ tty_encode_baud_rate(tty, baud, baud); -+ - /* handle any settings that aren't specified in the tty structure */ - port_settings.lloop = 0; - -diff --git a/drivers/usb/serial/whiteheat.h b/drivers/usb/serial/whiteheat.h -index 38065df4d2d8..30169c859a74 100644 ---- a/drivers/usb/serial/whiteheat.h -+++ b/drivers/usb/serial/whiteheat.h -@@ -91,7 +91,7 @@ struct whiteheat_simple { - - struct whiteheat_port_settings { - __u8 port; /* port number (1 to N) */ -- __u32 baud; /* any value 7 - 460800, firmware calculates -+ __le32 baud; /* any value 7 - 460800, firmware calculates - best fit; arrives little endian */ - __u8 bits; /* 5, 6, 7, or 8 */ - __u8 stop; /* 1 or 2, default 1 (2 = 1.5 if bits = 5) */ -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index e657b111b320..a7cc0bc68deb 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -772,29 +772,9 @@ static int uas_slave_alloc(struct scsi_device *sdev) - { - struct uas_dev_info *devinfo = - (struct uas_dev_info *)sdev->host->hostdata; -- int maxp; - - sdev->hostdata = devinfo; - -- /* -- * We have two requirements here. We must satisfy the requirements -- * of the physical HC and the demands of the protocol, as we -- * definitely want no additional memory allocation in this path -- * ruling out using bounce buffers. -- * -- * For a transmission on USB to continue we must never send -- * a package that is smaller than maxpacket. Hence the length of each -- * scatterlist element except the last must be divisible by the -- * Bulk maxpacket value. -- * If the HC does not ensure that through SG, -- * the upper layer must do that. We must assume nothing -- * about the capabilities off the HC, so we use the most -- * pessimistic requirement. -- */ -- -- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0); -- blk_queue_virt_boundary(sdev->request_queue, maxp - 1); -- - /* - * The protocol has no requirements on alignment in the strict sense. - * Controllers may or may not have alignment restrictions. -diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c -index afdf4e3cafc2..37c2093a24d3 100644 ---- a/fs/binfmt_script.c -+++ b/fs/binfmt_script.c -@@ -14,14 +14,31 @@ - #include - #include - -+static inline bool spacetab(char c) { return c == ' ' || c == '\t'; } -+static inline char *next_non_spacetab(char *first, const char *last) -+{ -+ for (; first <= last; first++) -+ if (!spacetab(*first)) -+ return first; -+ return NULL; -+} -+static inline char *next_terminator(char *first, const char *last) -+{ -+ for (; first <= last; first++) -+ if (spacetab(*first) || !*first) -+ return first; -+ return NULL; -+} -+ - static int load_script(struct linux_binprm *bprm) - { - const char *i_arg, *i_name; -- char *cp; -+ char *cp, *buf_end; - struct file *file; - char interp[BINPRM_BUF_SIZE]; - int retval; - -+ /* Not ours to exec if we don't start with "#!". */ - if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!')) - return -ENOEXEC; - -@@ -34,18 +51,40 @@ static int load_script(struct linux_binprm *bprm) - if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE) - return -ENOENT; - -- /* -- * This section does the #! interpretation. -- * Sorta complicated, but hopefully it will work. -TYT -- */ -- -+ /* Release since we are not mapping a binary into memory. */ - allow_write_access(bprm->file); - fput(bprm->file); - bprm->file = NULL; - -- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0'; -- if ((cp = strchr(bprm->buf, '\n')) == NULL) -- cp = bprm->buf+BINPRM_BUF_SIZE-1; -+ /* -+ * This section handles parsing the #! line into separate -+ * interpreter path and argument strings. We must be careful -+ * because bprm->buf is not yet guaranteed to be NUL-terminated -+ * (though the buffer will have trailing NUL padding when the -+ * file size was smaller than the buffer size). -+ * -+ * We do not want to exec a truncated interpreter path, so either -+ * we find a newline (which indicates nothing is truncated), or -+ * we find a space/tab/NUL after the interpreter path (which -+ * itself may be preceded by spaces/tabs). Truncating the -+ * arguments is fine: the interpreter can re-read the script to -+ * parse them on its own. -+ */ -+ buf_end = bprm->buf + sizeof(bprm->buf) - 1; -+ cp = strnchr(bprm->buf, sizeof(bprm->buf), '\n'); -+ if (!cp) { -+ cp = next_non_spacetab(bprm->buf + 2, buf_end); -+ if (!cp) -+ return -ENOEXEC; /* Entire buf is spaces/tabs */ -+ /* -+ * If there is no later space/tab/NUL we must assume the -+ * interpreter path is truncated. -+ */ -+ if (!next_terminator(cp, buf_end)) -+ return -ENOEXEC; -+ cp = buf_end; -+ } -+ /* NUL-terminate the buffer and any trailing spaces/tabs. */ - *cp = '\0'; - while (cp > bprm->buf) { - cp--; -diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c -index cc88f4f0325e..bed973330227 100644 ---- a/fs/cifs/netmisc.c -+++ b/fs/cifs/netmisc.c -@@ -130,10 +130,6 @@ static const struct smb_to_posix_error mapping_table_ERRSRV[] = { - {0, 0} - }; - --static const struct smb_to_posix_error mapping_table_ERRHRD[] = { -- {0, 0} --}; -- - /* - * Convert a string containing text IPv4 or IPv6 address to binary form. - * -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 49b7b40f7598..7d7081619f6e 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1628,6 +1628,19 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr, - if (attr->ia_valid & ATTR_SIZE) - is_truncate = true; - -+ /* Flush dirty data/metadata before non-truncate SETATTR */ -+ if (is_wb && S_ISREG(inode->i_mode) && -+ attr->ia_valid & -+ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET | -+ ATTR_TIMES_SET)) { -+ err = write_inode_now(inode, true); -+ if (err) -+ return err; -+ -+ fuse_set_nowrite(inode); -+ fuse_release_nowrite(inode); -+ } -+ - if (is_truncate) { - fuse_set_nowrite(inode); - set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index e0ec8b80c873..6ce6754168e0 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -201,7 +201,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) - { - struct fuse_conn *fc = get_fuse_conn(inode); - int err; -- bool lock_inode = (file->f_flags & O_TRUNC) && -+ bool is_wb_truncate = (file->f_flags & O_TRUNC) && - fc->atomic_o_trunc && - fc->writeback_cache; - -@@ -209,16 +209,20 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) - if (err) - return err; - -- if (lock_inode) -+ if (is_wb_truncate) { - mutex_lock(&inode->i_mutex); -+ fuse_set_nowrite(inode); -+ } - - err = fuse_do_open(fc, get_node_id(inode), file, isdir); - - if (!err) - fuse_finish_open(inode, file); - -- if (lock_inode) -+ if (is_wb_truncate) { -+ fuse_release_nowrite(inode); - mutex_unlock(&inode->i_mutex); -+ } - - return err; - } -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index d1816ee0c11b..900a62a9ad4e 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -5255,6 +5255,7 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, - } - status = task->tk_status; - if (setclientid.sc_cred) { -+ kfree(clp->cl_acceptor); - clp->cl_acceptor = rpcauth_stringify_acceptor(setclientid.sc_cred); - put_rpccred(setclientid.sc_cred); - } -diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c -index 3cb097ccce60..79232296b7d2 100644 ---- a/fs/ocfs2/ioctl.c -+++ b/fs/ocfs2/ioctl.c -@@ -289,7 +289,7 @@ static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb, - if (inode_alloc) - mutex_lock(&inode_alloc->i_mutex); - -- if (o2info_coherent(&fi->ifi_req)) { -+ if (inode_alloc && o2info_coherent(&fi->ifi_req)) { - status = ocfs2_inode_lock(inode_alloc, &bh, 0); - if (status < 0) { - mlog_errno(status); -diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c -index 06faa608e562..dfa6d45dc4dc 100644 ---- a/fs/ocfs2/xattr.c -+++ b/fs/ocfs2/xattr.c -@@ -1475,18 +1475,6 @@ static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc, - return loc->xl_ops->xlo_check_space(loc, xi); - } - --static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash) --{ -- loc->xl_ops->xlo_add_entry(loc, name_hash); -- loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash); -- /* -- * We can't leave the new entry's xe_name_offset at zero or -- * add_namevalue() will go nuts. We set it to the size of our -- * storage so that it can never be less than any other entry. -- */ -- loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size); --} -- - static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc, - struct ocfs2_xattr_info *xi) - { -@@ -2118,29 +2106,31 @@ static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc, - if (rc) - goto out; - -- if (loc->xl_entry) { -- if (ocfs2_xa_can_reuse_entry(loc, xi)) { -- orig_value_size = loc->xl_entry->xe_value_size; -- rc = ocfs2_xa_reuse_entry(loc, xi, ctxt); -- if (rc) -- goto out; -- goto alloc_value; -- } -+ if (!loc->xl_entry) { -+ rc = -EINVAL; -+ goto out; -+ } - -- if (!ocfs2_xattr_is_local(loc->xl_entry)) { -- orig_clusters = ocfs2_xa_value_clusters(loc); -- rc = ocfs2_xa_value_truncate(loc, 0, ctxt); -- if (rc) { -- mlog_errno(rc); -- ocfs2_xa_cleanup_value_truncate(loc, -- "overwriting", -- orig_clusters); -- goto out; -- } -+ if (ocfs2_xa_can_reuse_entry(loc, xi)) { -+ orig_value_size = loc->xl_entry->xe_value_size; -+ rc = ocfs2_xa_reuse_entry(loc, xi, ctxt); -+ if (rc) -+ goto out; -+ goto alloc_value; -+ } -+ -+ if (!ocfs2_xattr_is_local(loc->xl_entry)) { -+ orig_clusters = ocfs2_xa_value_clusters(loc); -+ rc = ocfs2_xa_value_truncate(loc, 0, ctxt); -+ if (rc) { -+ mlog_errno(rc); -+ ocfs2_xa_cleanup_value_truncate(loc, -+ "overwriting", -+ orig_clusters); -+ goto out; - } -- ocfs2_xa_wipe_namevalue(loc); -- } else -- ocfs2_xa_add_entry(loc, name_hash); -+ } -+ ocfs2_xa_wipe_namevalue(loc); - - /* - * If we get here, we have a blank entry. Fill it. We grow our -diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c -index dcb70969ff1c..44d65939ed18 100644 ---- a/fs/xfs/xfs_buf.c -+++ b/fs/xfs/xfs_buf.c -@@ -1584,7 +1584,7 @@ xfs_buftarg_isolate( - * zero. If the value is already zero, we need to reclaim the - * buffer, otherwise it gets another trip through the LRU. - */ -- if (!atomic_add_unless(&bp->b_lru_ref, -1, 0)) { -+ if (atomic_add_unless(&bp->b_lru_ref, -1, 0)) { - spin_unlock(&bp->b_lock); - return LRU_ROTATE; - } -diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h -index df528a623548..ea985aa7a6c5 100644 ---- a/include/net/llc_conn.h -+++ b/include/net/llc_conn.h -@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk); - - /* Access to a connection */ - int llc_conn_state_process(struct sock *sk, struct sk_buff *skb); --int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); -+void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); - void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb); - void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit); - void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit); -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 7a5d6a073165..ccd2a964dad7 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -289,6 +289,11 @@ static inline struct Qdisc *qdisc_root(const struct Qdisc *qdisc) - return q; - } - -+static inline struct Qdisc *qdisc_root_bh(const struct Qdisc *qdisc) -+{ -+ return rcu_dereference_bh(qdisc->dev_queue->qdisc); -+} -+ - static inline struct Qdisc *qdisc_root_sleeping(const struct Qdisc *qdisc) - { - return qdisc->dev_queue->qdisc_sleeping; -diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h -index d33b17ba51d2..8a71f4d42c62 100644 ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -98,6 +98,8 @@ void sctp_addr_wq_mgmt(struct net *, struct sctp_sockaddr_entry *, int); - /* - * sctp/socket.c - */ -+int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr, -+ int addr_len, int flags); - int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb); - int sctp_inet_listen(struct socket *sock, int backlog); - void sctp_write_space(struct sock *sk); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index c6e4e3e7f685..6176dc89b32c 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4803,6 +4803,7 @@ waitagain: - sizeof(struct trace_iterator) - - offsetof(struct trace_iterator, seq)); - cpumask_clear(iter->started); -+ trace_seq_init(&iter->seq); - iter->pos = -1; - - trace_event_read_lock(); -diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c -index 4b60f68cb492..8354ae40ec85 100644 ---- a/net/llc/llc_c_ac.c -+++ b/net/llc/llc_c_ac.c -@@ -372,6 +372,7 @@ int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb) - llc_pdu_init_as_i_cmd(skb, 1, llc->vS, llc->vR); - rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); - if (likely(!rc)) { -+ skb_get(skb); - llc_conn_send_pdu(sk, skb); - llc_conn_ac_inc_vs_by_1(sk, skb); - } -@@ -389,7 +390,8 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb) - llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR); - rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); - if (likely(!rc)) { -- rc = llc_conn_send_pdu(sk, skb); -+ skb_get(skb); -+ llc_conn_send_pdu(sk, skb); - llc_conn_ac_inc_vs_by_1(sk, skb); - } - return rc; -@@ -406,6 +408,7 @@ int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb) - llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR); - rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); - if (likely(!rc)) { -+ skb_get(skb); - llc_conn_send_pdu(sk, skb); - llc_conn_ac_inc_vs_by_1(sk, skb); - } -@@ -916,7 +919,8 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk, - llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR); - rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); - if (likely(!rc)) { -- rc = llc_conn_send_pdu(sk, skb); -+ skb_get(skb); -+ llc_conn_send_pdu(sk, skb); - llc_conn_ac_inc_vs_by_1(sk, skb); - } - return rc; -diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c -index 79c346fd859b..d861b74ad068 100644 ---- a/net/llc/llc_conn.c -+++ b/net/llc/llc_conn.c -@@ -30,7 +30,7 @@ - #endif - - static int llc_find_offset(int state, int ev_type); --static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb); -+static void llc_conn_send_pdus(struct sock *sk); - static int llc_conn_service(struct sock *sk, struct sk_buff *skb); - static int llc_exec_conn_trans_actions(struct sock *sk, - struct llc_conn_state_trans *trans, -@@ -193,11 +193,11 @@ out_skb_put: - return rc; - } - --int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) -+void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) - { - /* queue PDU to send to MAC layer */ - skb_queue_tail(&sk->sk_write_queue, skb); -- return llc_conn_send_pdus(sk, skb); -+ llc_conn_send_pdus(sk); - } - - /** -@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit) - if (howmany_resend > 0) - llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; - /* any PDUs to re-send are queued up; start sending to MAC */ -- llc_conn_send_pdus(sk, NULL); -+ llc_conn_send_pdus(sk); - out:; - } - -@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit) - if (howmany_resend > 0) - llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; - /* any PDUs to re-send are queued up; start sending to MAC */ -- llc_conn_send_pdus(sk, NULL); -+ llc_conn_send_pdus(sk); - out:; - } - -@@ -340,16 +340,12 @@ out: - /** - * llc_conn_send_pdus - Sends queued PDUs - * @sk: active connection -- * @hold_skb: the skb held by caller, or NULL if does not care - * -- * Sends queued pdus to MAC layer for transmission. When @hold_skb is -- * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent -- * successfully, or 1 for failure. -+ * Sends queued pdus to MAC layer for transmission. - */ --static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb) -+static void llc_conn_send_pdus(struct sock *sk) - { - struct sk_buff *skb; -- int ret = 0; - - while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) { - struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb); -@@ -361,20 +357,10 @@ static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb) - skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb); - if (!skb2) - break; -- dev_queue_xmit(skb2); -- } else { -- bool is_target = skb == hold_skb; -- int rc; -- -- if (is_target) -- skb_get(skb); -- rc = dev_queue_xmit(skb); -- if (is_target) -- ret = rc; -+ skb = skb2; - } -+ dev_queue_xmit(skb); - } -- -- return ret; - } - - /** -diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c -index a94bd56bcac6..7ae4cc684d3a 100644 ---- a/net/llc/llc_s_ac.c -+++ b/net/llc/llc_s_ac.c -@@ -58,8 +58,10 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb) - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_ui_cmd(skb); - rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) -+ if (likely(!rc)) { -+ skb_get(skb); - rc = dev_queue_xmit(skb); -+ } - return rc; - } - -@@ -81,8 +83,10 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb) - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); - rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) -+ if (likely(!rc)) { -+ skb_get(skb); - rc = dev_queue_xmit(skb); -+ } - return rc; - } - -@@ -135,8 +139,10 @@ int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb) - ev->daddr.lsap, LLC_PDU_CMD); - llc_pdu_init_as_test_cmd(skb); - rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); -- if (likely(!rc)) -+ if (likely(!rc)) { -+ skb_get(skb); - rc = dev_queue_xmit(skb); -+ } - return rc; - } - -diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c -index 5404d0d195cc..d51ff9df9c95 100644 ---- a/net/llc/llc_sap.c -+++ b/net/llc/llc_sap.c -@@ -197,29 +197,22 @@ out: - * After executing actions of the event, upper layer will be indicated - * if needed(on receiving an UI frame). sk can be null for the - * datalink_proto case. -+ * -+ * This function always consumes a reference to the skb. - */ - static void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb) - { - struct llc_sap_state_ev *ev = llc_sap_ev(skb); - -- /* -- * We have to hold the skb, because llc_sap_next_state -- * will kfree it in the sending path and we need to -- * look at the skb->cb, where we encode llc_sap_state_ev. -- */ -- skb_get(skb); - ev->ind_cfm_flag = 0; - llc_sap_next_state(sap, skb); -- if (ev->ind_cfm_flag == LLC_IND) { -- if (skb->sk->sk_state == TCP_LISTEN) -- kfree_skb(skb); -- else { -- llc_save_primitive(skb->sk, skb, ev->prim); - -- /* queue skb to the user. */ -- if (sock_queue_rcv_skb(skb->sk, skb)) -- kfree_skb(skb); -- } -+ if (ev->ind_cfm_flag == LLC_IND && skb->sk->sk_state != TCP_LISTEN) { -+ llc_save_primitive(skb->sk, skb, ev->prim); -+ -+ /* queue skb to the user. */ -+ if (sock_queue_rcv_skb(skb->sk, skb) == 0) -+ return; - } - kfree_skb(skb); - } -diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c -index 2a431628af59..caf33af4f9a7 100644 ---- a/net/sched/sch_netem.c -+++ b/net/sched/sch_netem.c -@@ -464,7 +464,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) - * skb will be queued. - */ - if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) { -- struct Qdisc *rootq = qdisc_root(sch); -+ struct Qdisc *rootq = qdisc_root_bh(sch); - u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ - - q->duplicate = 0; -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 9fa0b0dc3868..ae619cffc3a9 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -970,7 +970,7 @@ static const struct proto_ops inet6_seqpacket_ops = { - .owner = THIS_MODULE, - .release = inet6_release, - .bind = inet6_bind, -- .connect = inet_dgram_connect, -+ .connect = sctp_inet_connect, - .socketpair = sock_no_socketpair, - .accept = inet_accept, - .getname = sctp_getname, -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index 07c54b212cd7..8816e49fd88b 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -1012,7 +1012,7 @@ static const struct proto_ops inet_seqpacket_ops = { - .owner = THIS_MODULE, - .release = inet_release, /* Needs to be wrapped... */ - .bind = inet_bind, -- .connect = inet_dgram_connect, -+ .connect = sctp_inet_connect, - .socketpair = sock_no_socketpair, - .accept = inet_accept, - .getname = inet_getname, /* Semantics are different. */ -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 191fd251e8a0..7add261dd626 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1072,7 +1072,7 @@ out: - */ - static int __sctp_connect(struct sock *sk, - struct sockaddr *kaddrs, -- int addrs_size, -+ int addrs_size, int flags, - sctp_assoc_t *assoc_id) - { - struct net *net = sock_net(sk); -@@ -1090,7 +1090,6 @@ static int __sctp_connect(struct sock *sk, - union sctp_addr *sa_addr = NULL; - void *addr_buf; - unsigned short port; -- unsigned int f_flags = 0; - - sp = sctp_sk(sk); - ep = sp->ep; -@@ -1238,13 +1237,7 @@ static int __sctp_connect(struct sock *sk, - sp->pf->to_sk_daddr(sa_addr, sk); - sk->sk_err = 0; - -- /* in-kernel sockets don't generally have a file allocated to them -- * if all they do is call sock_create_kern(). -- */ -- if (sk->sk_socket->file) -- f_flags = sk->sk_socket->file->f_flags; -- -- timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK); -+ timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); - - if (assoc_id) - *assoc_id = asoc->assoc_id; -@@ -1340,7 +1333,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk, - { - struct sockaddr *kaddrs; - gfp_t gfp = GFP_KERNEL; -- int err = 0; -+ int err = 0, flags = 0; - - pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n", - __func__, sk, addrs, addrs_size); -@@ -1360,11 +1353,18 @@ static int __sctp_setsockopt_connectx(struct sock *sk, - return -ENOMEM; - - if (__copy_from_user(kaddrs, addrs, addrs_size)) { -- err = -EFAULT; -- } else { -- err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id); -+ kfree(kaddrs); -+ return -EFAULT; - } - -+ /* in-kernel sockets don't generally have a file allocated to them -+ * if all they do is call sock_create_kern(). -+ */ -+ if (sk->sk_socket->file) -+ flags = sk->sk_socket->file->f_flags; -+ -+ err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id); -+ - kfree(kaddrs); - - return err; -@@ -3895,31 +3895,36 @@ out_nounlock: - * len: the size of the address. - */ - static int sctp_connect(struct sock *sk, struct sockaddr *addr, -- int addr_len) -+ int addr_len, int flags) - { -- int err = 0; - struct sctp_af *af; -+ int err = -EINVAL; - - lock_sock(sk); -- - pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk, - addr, addr_len); - - /* Validate addr_len before calling common connect/connectx routine. */ - af = sctp_get_af_specific(addr->sa_family); -- if (!af || addr_len < af->sockaddr_len) { -- err = -EINVAL; -- } else { -- /* Pass correct addr len to common routine (so it knows there -- * is only one address being passed. -- */ -- err = __sctp_connect(sk, addr, af->sockaddr_len, NULL); -- } -+ if (af && addr_len >= af->sockaddr_len) -+ err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL); - - release_sock(sk); - return err; - } - -+int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr, -+ int addr_len, int flags) -+{ -+ if (addr_len < sizeof(uaddr->sa_family)) -+ return -EINVAL; -+ -+ if (uaddr->sa_family == AF_UNSPEC) -+ return -EOPNOTSUPP; -+ -+ return sctp_connect(sock->sk, uaddr, addr_len, flags); -+} -+ - /* FIXME: Write comments. */ - static int sctp_disconnect(struct sock *sk, int flags) - { -@@ -7428,7 +7433,6 @@ struct proto sctp_prot = { - .name = "SCTP", - .owner = THIS_MODULE, - .close = sctp_close, -- .connect = sctp_connect, - .disconnect = sctp_disconnect, - .accept = sctp_accept, - .ioctl = sctp_ioctl, -@@ -7467,7 +7471,6 @@ struct proto sctpv6_prot = { - .name = "SCTPv6", - .owner = THIS_MODULE, - .close = sctp_close, -- .connect = sctp_connect, - .disconnect = sctp_disconnect, - .accept = sctp_accept, - .ioctl = sctp_ioctl, -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 2023802b6c77..4de66dbd5bb6 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -292,7 +292,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, - [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, - .len = IEEE80211_MAX_MESH_ID_LEN }, -- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, -+ [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY, -+ .len = ETH_ALEN }, - - [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, - [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, -diff --git a/scripts/setlocalversion b/scripts/setlocalversion -index 966dd3924ea9..aa28c3f29809 100755 ---- a/scripts/setlocalversion -+++ b/scripts/setlocalversion -@@ -72,8 +72,16 @@ scm_version() - printf -- '-svn%s' "`git svn find-rev $head`" - fi - -- # Check for uncommitted changes -- if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then -+ # Check for uncommitted changes. -+ # First, with git-status, but --no-optional-locks is only -+ # supported in git >= 2.14, so fall back to git-diff-index if -+ # it fails. Note that git-diff-index does not refresh the -+ # index, so it may give misleading results. See -+ # git-update-index(1), git-diff-index(1), and git-status(1). -+ if { -+ git --no-optional-locks status -uno --porcelain 2>/dev/null || -+ git diff-index --name-only HEAD -+ } | grep -qvE '^(.. )?scripts/package'; then - printf '%s' -dirty - fi - -diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c -index 5022c9b97ddf..15009ecf259d 100644 ---- a/sound/firewire/bebob/bebob_stream.c -+++ b/sound/firewire/bebob/bebob_stream.c -@@ -253,8 +253,7 @@ end: - return err; - } - --static unsigned int --map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) -+static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) - { - unsigned int sec, sections, ch, channels; - unsigned int pcm, midi, location; -diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c -index acc2c7dbfb15..4727f5b80e76 100644 ---- a/sound/hda/hdac_controller.c -+++ b/sound/hda/hdac_controller.c -@@ -340,8 +340,6 @@ static void azx_int_disable(struct hdac_bus *bus) - list_for_each_entry(azx_dev, &bus->stream_list, list) - snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); - -- synchronize_irq(bus->irq); -- - /* disable SIE for all streams */ - snd_hdac_chip_writeb(bus, INTCTL, 0); - -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 96ccab15da83..ef8955abd918 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1274,9 +1274,9 @@ static int azx_free(struct azx *chip) - } - - if (bus->chip_init) { -- azx_stop_chip(chip); - azx_clear_irq_pending(chip); - azx_stop_all_streams(chip); -+ azx_stop_chip(chip); - } - - if (bus->irq >= 0) -diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c -index afc6b56cf749..97c0684588d9 100644 ---- a/tools/perf/util/map.c -+++ b/tools/perf/util/map.c -@@ -1,4 +1,5 @@ - #include "symbol.h" -+#include - #include - #include - #include -@@ -702,6 +703,8 @@ static int maps__fixup_overlappings(struct maps *maps, struct map *map, FILE *fp - } - - after->start = map->end; -+ after->pgoff += map->end - pos->start; -+ assert(pos->map_ip(pos, map->end) == after->map_ip(after, map->end)); - __map_groups__insert(pos->groups, after); - if (verbose >= 2) - map__fprintf(after, fp); diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.199-200.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.199-200.patch deleted file mode 100644 index 1bf5a29a4552..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.199-200.patch +++ /dev/null @@ -1,3347 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6b09890b170c..8715489f3462 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 199 -+SUBLEVEL = 200 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -823,6 +823,12 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=strict-prototypes) - # Prohibit date/time macros, which would make the build non-deterministic - KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) - -+# ensure -fcf-protection is disabled when using retpoline as it is -+# incompatible with -mindirect-branch=thunk-extern -+ifdef CONFIG_RETPOLINE -+KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) -+endif -+ - # use the deterministic mode of AR if available - KBUILD_ARFLAGS := $(call ar-option,D) - -diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi -index e05670423d8b..a6c59bf698b3 100644 ---- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi -+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi -@@ -169,3 +169,7 @@ - &twl_gpio { - ti,use-leds; - }; -+ -+&twl_keypad { -+ status = "disabled"; -+}; -diff --git a/arch/arm/include/asm/arch_gicv3.h b/arch/arm/include/asm/arch_gicv3.h -index e08d15184056..af25c32b1ccc 100644 ---- a/arch/arm/include/asm/arch_gicv3.h -+++ b/arch/arm/include/asm/arch_gicv3.h -@@ -22,9 +22,7 @@ - - #include - #include -- --#define __ACCESS_CP15(CRn, Op1, CRm, Op2) p15, Op1, %0, CRn, CRm, Op2 --#define __ACCESS_CP15_64(Op1, CRm) p15, Op1, %Q0, %R0, CRm -+#include - - #define ICC_EOIR1 __ACCESS_CP15(c12, 0, c12, 1) - #define ICC_DIR __ACCESS_CP15(c12, 0, c11, 1) -@@ -102,58 +100,55 @@ - - static inline void gic_write_eoir(u32 irq) - { -- asm volatile("mcr " __stringify(ICC_EOIR1) : : "r" (irq)); -+ write_sysreg(irq, ICC_EOIR1); - isb(); - } - - static inline void gic_write_dir(u32 val) - { -- asm volatile("mcr " __stringify(ICC_DIR) : : "r" (val)); -+ write_sysreg(val, ICC_DIR); - isb(); - } - - static inline u32 gic_read_iar(void) - { -- u32 irqstat; -+ u32 irqstat = read_sysreg(ICC_IAR1); - -- asm volatile("mrc " __stringify(ICC_IAR1) : "=r" (irqstat)); - dsb(sy); -+ - return irqstat; - } - - static inline void gic_write_pmr(u32 val) - { -- asm volatile("mcr " __stringify(ICC_PMR) : : "r" (val)); -+ write_sysreg(val, ICC_PMR); - } - - static inline void gic_write_ctlr(u32 val) - { -- asm volatile("mcr " __stringify(ICC_CTLR) : : "r" (val)); -+ write_sysreg(val, ICC_CTLR); - isb(); - } - - static inline void gic_write_grpen1(u32 val) - { -- asm volatile("mcr " __stringify(ICC_IGRPEN1) : : "r" (val)); -+ write_sysreg(val, ICC_IGRPEN1); - isb(); - } - - static inline void gic_write_sgi1r(u64 val) - { -- asm volatile("mcrr " __stringify(ICC_SGI1R) : : "r" (val)); -+ write_sysreg(val, ICC_SGI1R); - } - - static inline u32 gic_read_sre(void) - { -- u32 val; -- -- asm volatile("mrc " __stringify(ICC_SRE) : "=r" (val)); -- return val; -+ return read_sysreg(ICC_SRE); - } - - static inline void gic_write_sre(u32 val) - { -- asm volatile("mcr " __stringify(ICC_SRE) : : "r" (val)); -+ write_sysreg(val, ICC_SRE); - isb(); - } - -diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h -index 4a275fba6059..f2624fbd0336 100644 ---- a/arch/arm/include/asm/assembler.h -+++ b/arch/arm/include/asm/assembler.h -@@ -441,11 +441,34 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) - .size \name , . - \name - .endm - -+ .macro csdb -+#ifdef CONFIG_THUMB2_KERNEL -+ .inst.w 0xf3af8014 -+#else -+ .inst 0xe320f014 -+#endif -+ .endm -+ - .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req - #ifndef CONFIG_CPU_USE_DOMAINS - adds \tmp, \addr, #\size - 1 - sbcccs \tmp, \tmp, \limit - bcs \bad -+#ifdef CONFIG_CPU_SPECTRE -+ movcs \addr, #0 -+ csdb -+#endif -+#endif -+ .endm -+ -+ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req -+#ifdef CONFIG_CPU_SPECTRE -+ sub \tmp, \limit, #1 -+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr -+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) { -+ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) } -+ movlo \addr, #0 @ if (tmp < 0) addr = NULL -+ csdb - #endif - .endm - -diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h -index 27c1d26b05b5..8514b70704de 100644 ---- a/arch/arm/include/asm/barrier.h -+++ b/arch/arm/include/asm/barrier.h -@@ -18,6 +18,12 @@ - #define isb(option) __asm__ __volatile__ ("isb " #option : : : "memory") - #define dsb(option) __asm__ __volatile__ ("dsb " #option : : : "memory") - #define dmb(option) __asm__ __volatile__ ("dmb " #option : : : "memory") -+#ifdef CONFIG_THUMB2_KERNEL -+#define CSDB ".inst.w 0xf3af8014" -+#else -+#define CSDB ".inst 0xe320f014" -+#endif -+#define csdb() __asm__ __volatile__(CSDB : : : "memory") - #elif defined(CONFIG_CPU_XSC3) || __LINUX_ARM_ARCH__ == 6 - #define isb(x) __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \ - : : "r" (0) : "memory") -@@ -38,6 +44,13 @@ - #define dmb(x) __asm__ __volatile__ ("" : : : "memory") - #endif - -+#ifndef CSDB -+#define CSDB -+#endif -+#ifndef csdb -+#define csdb() -+#endif -+ - #ifdef CONFIG_ARM_HEAVY_MB - extern void (*soc_mb)(void); - extern void arm_heavy_mb(void); -@@ -95,5 +108,26 @@ do { \ - #define smp_mb__before_atomic() smp_mb() - #define smp_mb__after_atomic() smp_mb() - -+#ifdef CONFIG_CPU_SPECTRE -+static inline unsigned long array_index_mask_nospec(unsigned long idx, -+ unsigned long sz) -+{ -+ unsigned long mask; -+ -+ asm volatile( -+ "cmp %1, %2\n" -+ " sbc %0, %1, %1\n" -+ CSDB -+ : "=r" (mask) -+ : "r" (idx), "Ir" (sz) -+ : "cc"); -+ -+ return mask; -+} -+#define array_index_mask_nospec array_index_mask_nospec -+#endif -+ -+#include -+ - #endif /* !__ASSEMBLY__ */ - #endif /* __ASM_BARRIER_H */ -diff --git a/arch/arm/include/asm/bugs.h b/arch/arm/include/asm/bugs.h -index a97f1ea708d1..73a99c72a930 100644 ---- a/arch/arm/include/asm/bugs.h -+++ b/arch/arm/include/asm/bugs.h -@@ -10,12 +10,14 @@ - #ifndef __ASM_BUGS_H - #define __ASM_BUGS_H - --#ifdef CONFIG_MMU - extern void check_writebuffer_bugs(void); - --#define check_bugs() check_writebuffer_bugs() -+#ifdef CONFIG_MMU -+extern void check_bugs(void); -+extern void check_other_bugs(void); - #else - #define check_bugs() do { } while (0) -+#define check_other_bugs() do { } while (0) - #endif - - #endif -diff --git a/arch/arm/include/asm/cp15.h b/arch/arm/include/asm/cp15.h -index c3f11524f10c..b74b174ac9fc 100644 ---- a/arch/arm/include/asm/cp15.h -+++ b/arch/arm/include/asm/cp15.h -@@ -49,6 +49,24 @@ - - #ifdef CONFIG_CPU_CP15 - -+#define __ACCESS_CP15(CRn, Op1, CRm, Op2) \ -+ "mrc", "mcr", __stringify(p15, Op1, %0, CRn, CRm, Op2), u32 -+#define __ACCESS_CP15_64(Op1, CRm) \ -+ "mrrc", "mcrr", __stringify(p15, Op1, %Q0, %R0, CRm), u64 -+ -+#define __read_sysreg(r, w, c, t) ({ \ -+ t __val; \ -+ asm volatile(r " " c : "=r" (__val)); \ -+ __val; \ -+}) -+#define read_sysreg(...) __read_sysreg(__VA_ARGS__) -+ -+#define __write_sysreg(v, r, w, c, t) asm volatile(w " " c : : "r" ((t)(v))) -+#define write_sysreg(v, ...) __write_sysreg(v, __VA_ARGS__) -+ -+#define BPIALL __ACCESS_CP15(c7, 0, c5, 6) -+#define ICIALLU __ACCESS_CP15(c7, 0, c5, 0) -+ - extern unsigned long cr_alignment; /* defined in entry-armv.S */ - - static inline unsigned long get_cr(void) -diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h -index e9d04f475929..53125dad6edd 100644 ---- a/arch/arm/include/asm/cputype.h -+++ b/arch/arm/include/asm/cputype.h -@@ -74,8 +74,16 @@ - #define ARM_CPU_PART_CORTEX_A12 0x4100c0d0 - #define ARM_CPU_PART_CORTEX_A17 0x4100c0e0 - #define ARM_CPU_PART_CORTEX_A15 0x4100c0f0 -+#define ARM_CPU_PART_CORTEX_A53 0x4100d030 -+#define ARM_CPU_PART_CORTEX_A57 0x4100d070 -+#define ARM_CPU_PART_CORTEX_A72 0x4100d080 -+#define ARM_CPU_PART_CORTEX_A73 0x4100d090 -+#define ARM_CPU_PART_CORTEX_A75 0x4100d0a0 - #define ARM_CPU_PART_MASK 0xff00fff0 - -+/* Broadcom cores */ -+#define ARM_CPU_PART_BRAHMA_B15 0x420000f0 -+ - #define ARM_CPU_XSCALE_ARCH_MASK 0xe000 - #define ARM_CPU_XSCALE_ARCH_V1 0x2000 - #define ARM_CPU_XSCALE_ARCH_V2 0x4000 -@@ -85,6 +93,7 @@ - #define ARM_CPU_PART_SCORPION 0x510002d0 - - extern unsigned int processor_id; -+struct proc_info_list *lookup_processor(u32 midr); - - #ifdef CONFIG_CPU_CP15 - #define read_cpuid(reg) \ -diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h -index 8877ad5ffe10..1bfcc3bcfc6d 100644 ---- a/arch/arm/include/asm/proc-fns.h -+++ b/arch/arm/include/asm/proc-fns.h -@@ -23,7 +23,7 @@ struct mm_struct; - /* - * Don't change this structure - ASM code relies on it. - */ --extern struct processor { -+struct processor { - /* MISC - * get data abort address/flags - */ -@@ -36,6 +36,10 @@ extern struct processor { - * Set up any processor specifics - */ - void (*_proc_init)(void); -+ /* -+ * Check for processor bugs -+ */ -+ void (*check_bugs)(void); - /* - * Disable any processor specifics - */ -@@ -75,9 +79,13 @@ extern struct processor { - unsigned int suspend_size; - void (*do_suspend)(void *); - void (*do_resume)(void *); --} processor; -+}; - - #ifndef MULTI_CPU -+static inline void init_proc_vtable(const struct processor *p) -+{ -+} -+ - extern void cpu_proc_init(void); - extern void cpu_proc_fin(void); - extern int cpu_do_idle(void); -@@ -94,17 +102,50 @@ extern void cpu_reset(unsigned long addr) __attribute__((noreturn)); - extern void cpu_do_suspend(void *); - extern void cpu_do_resume(void *); - #else --#define cpu_proc_init processor._proc_init --#define cpu_proc_fin processor._proc_fin --#define cpu_reset processor.reset --#define cpu_do_idle processor._do_idle --#define cpu_dcache_clean_area processor.dcache_clean_area --#define cpu_set_pte_ext processor.set_pte_ext --#define cpu_do_switch_mm processor.switch_mm - --/* These three are private to arch/arm/kernel/suspend.c */ --#define cpu_do_suspend processor.do_suspend --#define cpu_do_resume processor.do_resume -+extern struct processor processor; -+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) -+#include -+/* -+ * This can't be a per-cpu variable because we need to access it before -+ * per-cpu has been initialised. We have a couple of functions that are -+ * called in a pre-emptible context, and so can't use smp_processor_id() -+ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the -+ * function pointers for these are identical across all CPUs. -+ */ -+extern struct processor *cpu_vtable[]; -+#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f -+#define PROC_TABLE(f) cpu_vtable[0]->f -+static inline void init_proc_vtable(const struct processor *p) -+{ -+ unsigned int cpu = smp_processor_id(); -+ *cpu_vtable[cpu] = *p; -+ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area != -+ cpu_vtable[0]->dcache_clean_area); -+ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext != -+ cpu_vtable[0]->set_pte_ext); -+} -+#else -+#define PROC_VTABLE(f) processor.f -+#define PROC_TABLE(f) processor.f -+static inline void init_proc_vtable(const struct processor *p) -+{ -+ processor = *p; -+} -+#endif -+ -+#define cpu_proc_init PROC_VTABLE(_proc_init) -+#define cpu_check_bugs PROC_VTABLE(check_bugs) -+#define cpu_proc_fin PROC_VTABLE(_proc_fin) -+#define cpu_reset PROC_VTABLE(reset) -+#define cpu_do_idle PROC_VTABLE(_do_idle) -+#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area) -+#define cpu_set_pte_ext PROC_TABLE(set_pte_ext) -+#define cpu_do_switch_mm PROC_VTABLE(switch_mm) -+ -+/* These two are private to arch/arm/kernel/suspend.c */ -+#define cpu_do_suspend PROC_VTABLE(do_suspend) -+#define cpu_do_resume PROC_VTABLE(do_resume) - #endif - - extern void cpu_resume(void); -diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h -index a3d61ad984af..1fed41440af9 100644 ---- a/arch/arm/include/asm/system_misc.h -+++ b/arch/arm/include/asm/system_misc.h -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - - extern void cpu_init(void); - -@@ -14,6 +15,20 @@ void soft_restart(unsigned long); - extern void (*arm_pm_restart)(enum reboot_mode reboot_mode, const char *cmd); - extern void (*arm_pm_idle)(void); - -+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR -+typedef void (*harden_branch_predictor_fn_t)(void); -+DECLARE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn); -+static inline void harden_branch_predictor(void) -+{ -+ harden_branch_predictor_fn_t fn = per_cpu(harden_branch_predictor_fn, -+ smp_processor_id()); -+ if (fn) -+ fn(); -+} -+#else -+#define harden_branch_predictor() do { } while (0) -+#endif -+ - #define UDBG_UNDEFINED (1 << 0) - #define UDBG_SYSCALL (1 << 1) - #define UDBG_BADABORT (1 << 2) -diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h -index 776757d1604a..df8420672c7e 100644 ---- a/arch/arm/include/asm/thread_info.h -+++ b/arch/arm/include/asm/thread_info.h -@@ -124,10 +124,10 @@ extern void vfp_flush_hwstate(struct thread_info *); - struct user_vfp; - struct user_vfp_exc; - --extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *, -- struct user_vfp_exc __user *); --extern int vfp_restore_user_hwstate(struct user_vfp __user *, -- struct user_vfp_exc __user *); -+extern int vfp_preserve_user_clear_hwstate(struct user_vfp *, -+ struct user_vfp_exc *); -+extern int vfp_restore_user_hwstate(struct user_vfp *, -+ struct user_vfp_exc *); - #endif - - /* -diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h -index cd8b589111ba..9ae610bf5234 100644 ---- a/arch/arm/include/asm/uaccess.h -+++ b/arch/arm/include/asm/uaccess.h -@@ -99,6 +99,14 @@ extern int __put_user_bad(void); - static inline void set_fs(mm_segment_t fs) - { - current_thread_info()->addr_limit = fs; -+ -+ /* -+ * Prevent a mispredicted conditional call to set_fs from forwarding -+ * the wrong address limit to access_ok under speculation. -+ */ -+ dsb(nsh); -+ isb(); -+ - modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER); - } - -@@ -122,6 +130,39 @@ static inline void set_fs(mm_segment_t fs) - : "cc"); \ - flag; }) - -+/* -+ * This is a type: either unsigned long, if the argument fits into -+ * that type, or otherwise unsigned long long. -+ */ -+#define __inttype(x) \ -+ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL)) -+ -+/* -+ * Sanitise a uaccess pointer such that it becomes NULL if addr+size -+ * is above the current addr_limit. -+ */ -+#define uaccess_mask_range_ptr(ptr, size) \ -+ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size)) -+static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr, -+ size_t size) -+{ -+ void __user *safe_ptr = (void __user *)ptr; -+ unsigned long tmp; -+ -+ asm volatile( -+ " sub %1, %3, #1\n" -+ " subs %1, %1, %0\n" -+ " addhs %1, %1, #1\n" -+ " subhss %1, %1, %2\n" -+ " movlo %0, #0\n" -+ : "+r" (safe_ptr), "=&r" (tmp) -+ : "r" (size), "r" (current_thread_info()->addr_limit) -+ : "cc"); -+ -+ csdb(); -+ return safe_ptr; -+} -+ - /* - * Single-value transfer routines. They automatically use the right - * size if we just have the right pointer type. Note that the functions -@@ -191,7 +232,7 @@ extern int __get_user_64t_4(void *); - ({ \ - unsigned long __limit = current_thread_info()->addr_limit - 1; \ - register const typeof(*(p)) __user *__p asm("r0") = (p);\ -- register typeof(x) __r2 asm("r2"); \ -+ register __inttype(x) __r2 asm("r2"); \ - register unsigned long __l asm("r1") = __limit; \ - register int __e asm("r0"); \ - unsigned int __ua_flags = uaccess_save_and_enable(); \ -@@ -238,49 +279,23 @@ extern int __put_user_2(void *, unsigned int); - extern int __put_user_4(void *, unsigned int); - extern int __put_user_8(void *, unsigned long long); - --#define __put_user_x(__r2, __p, __e, __l, __s) \ -- __asm__ __volatile__ ( \ -- __asmeq("%0", "r0") __asmeq("%2", "r2") \ -- __asmeq("%3", "r1") \ -- "bl __put_user_" #__s \ -- : "=&r" (__e) \ -- : "0" (__p), "r" (__r2), "r" (__l) \ -- : "ip", "lr", "cc") -- --#define __put_user_check(x, p) \ -+#define __put_user_check(__pu_val, __ptr, __err, __s) \ - ({ \ - unsigned long __limit = current_thread_info()->addr_limit - 1; \ -- const typeof(*(p)) __user *__tmp_p = (p); \ -- register typeof(*(p)) __r2 asm("r2") = (x); \ -- register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \ -+ register typeof(__pu_val) __r2 asm("r2") = __pu_val; \ -+ register const void __user *__p asm("r0") = __ptr; \ - register unsigned long __l asm("r1") = __limit; \ - register int __e asm("r0"); \ -- unsigned int __ua_flags = uaccess_save_and_enable(); \ -- switch (sizeof(*(__p))) { \ -- case 1: \ -- __put_user_x(__r2, __p, __e, __l, 1); \ -- break; \ -- case 2: \ -- __put_user_x(__r2, __p, __e, __l, 2); \ -- break; \ -- case 4: \ -- __put_user_x(__r2, __p, __e, __l, 4); \ -- break; \ -- case 8: \ -- __put_user_x(__r2, __p, __e, __l, 8); \ -- break; \ -- default: __e = __put_user_bad(); break; \ -- } \ -- uaccess_restore(__ua_flags); \ -- __e; \ -+ __asm__ __volatile__ ( \ -+ __asmeq("%0", "r0") __asmeq("%2", "r2") \ -+ __asmeq("%3", "r1") \ -+ "bl __put_user_" #__s \ -+ : "=&r" (__e) \ -+ : "0" (__p), "r" (__r2), "r" (__l) \ -+ : "ip", "lr", "cc"); \ -+ __err = __e; \ - }) - --#define put_user(x, p) \ -- ({ \ -- might_fault(); \ -- __put_user_check(x, p); \ -- }) -- - #else /* CONFIG_MMU */ - - /* -@@ -298,7 +313,7 @@ static inline void set_fs(mm_segment_t fs) - } - - #define get_user(x, p) __get_user(x, p) --#define put_user(x, p) __put_user(x, p) -+#define __put_user_check __put_user_nocheck - - #endif /* CONFIG_MMU */ - -@@ -307,6 +322,16 @@ static inline void set_fs(mm_segment_t fs) - #define user_addr_max() \ - (segment_eq(get_fs(), KERNEL_DS) ? ~0UL : get_fs()) - -+#ifdef CONFIG_CPU_SPECTRE -+/* -+ * When mitigating Spectre variant 1, it is not worth fixing the non- -+ * verifying accessors, because we need to add verification of the -+ * address space there. Force these to use the standard get_user() -+ * version instead. -+ */ -+#define __get_user(x, ptr) get_user(x, ptr) -+#else -+ - /* - * The "__xxx" versions of the user access functions do not verify the - * address space - it must have been done previously with a separate -@@ -323,12 +348,6 @@ static inline void set_fs(mm_segment_t fs) - __gu_err; \ - }) - --#define __get_user_error(x, ptr, err) \ --({ \ -- __get_user_err((x), (ptr), err); \ -- (void) 0; \ --}) -- - #define __get_user_err(x, ptr, err) \ - do { \ - unsigned long __gu_addr = (unsigned long)(ptr); \ -@@ -388,37 +407,58 @@ do { \ - - #define __get_user_asm_word(x, addr, err) \ - __get_user_asm(x, addr, err, ldr) -+#endif - --#define __put_user(x, ptr) \ -+ -+#define __put_user_switch(x, ptr, __err, __fn) \ -+ do { \ -+ const __typeof__(*(ptr)) __user *__pu_ptr = (ptr); \ -+ __typeof__(*(ptr)) __pu_val = (x); \ -+ unsigned int __ua_flags; \ -+ might_fault(); \ -+ __ua_flags = uaccess_save_and_enable(); \ -+ switch (sizeof(*(ptr))) { \ -+ case 1: __fn(__pu_val, __pu_ptr, __err, 1); break; \ -+ case 2: __fn(__pu_val, __pu_ptr, __err, 2); break; \ -+ case 4: __fn(__pu_val, __pu_ptr, __err, 4); break; \ -+ case 8: __fn(__pu_val, __pu_ptr, __err, 8); break; \ -+ default: __err = __put_user_bad(); break; \ -+ } \ -+ uaccess_restore(__ua_flags); \ -+ } while (0) -+ -+#define put_user(x, ptr) \ - ({ \ -- long __pu_err = 0; \ -- __put_user_err((x), (ptr), __pu_err); \ -+ int __pu_err = 0; \ -+ __put_user_switch((x), (ptr), __pu_err, __put_user_check); \ - __pu_err; \ - }) - --#define __put_user_error(x, ptr, err) \ -+#ifdef CONFIG_CPU_SPECTRE -+/* -+ * When mitigating Spectre variant 1.1, all accessors need to include -+ * verification of the address space. -+ */ -+#define __put_user(x, ptr) put_user(x, ptr) -+ -+#else -+#define __put_user(x, ptr) \ - ({ \ -- __put_user_err((x), (ptr), err); \ -- (void) 0; \ -+ long __pu_err = 0; \ -+ __put_user_switch((x), (ptr), __pu_err, __put_user_nocheck); \ -+ __pu_err; \ - }) - --#define __put_user_err(x, ptr, err) \ --do { \ -- unsigned long __pu_addr = (unsigned long)(ptr); \ -- unsigned int __ua_flags; \ -- __typeof__(*(ptr)) __pu_val = (x); \ -- __chk_user_ptr(ptr); \ -- might_fault(); \ -- __ua_flags = uaccess_save_and_enable(); \ -- switch (sizeof(*(ptr))) { \ -- case 1: __put_user_asm_byte(__pu_val, __pu_addr, err); break; \ -- case 2: __put_user_asm_half(__pu_val, __pu_addr, err); break; \ -- case 4: __put_user_asm_word(__pu_val, __pu_addr, err); break; \ -- case 8: __put_user_asm_dword(__pu_val, __pu_addr, err); break; \ -- default: __put_user_bad(); \ -- } \ -- uaccess_restore(__ua_flags); \ --} while (0) -+#define __put_user_nocheck(x, __pu_ptr, __err, __size) \ -+ do { \ -+ unsigned long __pu_addr = (unsigned long)__pu_ptr; \ -+ __put_user_nocheck_##__size(x, __pu_addr, __err); \ -+ } while (0) -+ -+#define __put_user_nocheck_1 __put_user_asm_byte -+#define __put_user_nocheck_2 __put_user_asm_half -+#define __put_user_nocheck_4 __put_user_asm_word -+#define __put_user_nocheck_8 __put_user_asm_dword - - #define __put_user_asm(x, __pu_addr, err, instr) \ - __asm__ __volatile__( \ -@@ -488,6 +528,7 @@ do { \ - : "r" (x), "i" (-EFAULT) \ - : "cc") - -+#endif /* !CONFIG_CPU_SPECTRE */ - - #ifdef CONFIG_MMU - extern unsigned long __must_check -diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile -index 3c789496297f..649bc3300c93 100644 ---- a/arch/arm/kernel/Makefile -+++ b/arch/arm/kernel/Makefile -@@ -30,6 +30,7 @@ else - obj-y += entry-armv.o - endif - -+obj-$(CONFIG_MMU) += bugs.o - obj-$(CONFIG_CPU_IDLE) += cpuidle.o - obj-$(CONFIG_ISA_DMA_API) += dma.o - obj-$(CONFIG_FIQ) += fiq.o fiqasm.o -diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c -new file mode 100644 -index 000000000000..d41d3598e5e5 ---- /dev/null -+++ b/arch/arm/kernel/bugs.c -@@ -0,0 +1,18 @@ -+// SPDX-Identifier: GPL-2.0 -+#include -+#include -+#include -+ -+void check_other_bugs(void) -+{ -+#ifdef MULTI_CPU -+ if (cpu_check_bugs) -+ cpu_check_bugs(); -+#endif -+} -+ -+void __init check_bugs(void) -+{ -+ check_writebuffer_bugs(); -+ check_other_bugs(); -+} -diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S -index 30a7228eaceb..e969b18d9ff9 100644 ---- a/arch/arm/kernel/entry-common.S -+++ b/arch/arm/kernel/entry-common.S -@@ -223,9 +223,7 @@ local_restart: - tst r10, #_TIF_SYSCALL_WORK @ are we tracing syscalls? - bne __sys_trace - -- cmp scno, #NR_syscalls @ check upper syscall limit -- badr lr, ret_fast_syscall @ return address -- ldrcc pc, [tbl, scno, lsl #2] @ call sys_* routine -+ invoke_syscall tbl, scno, r10, ret_fast_syscall - - add r1, sp, #S_OFF - 2: cmp scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE) -@@ -258,14 +256,8 @@ __sys_trace: - mov r1, scno - add r0, sp, #S_OFF - bl syscall_trace_enter -- -- badr lr, __sys_trace_return @ return address -- mov scno, r0 @ syscall number (possibly new) -- add r1, sp, #S_R0 + S_OFF @ pointer to regs -- cmp scno, #NR_syscalls @ check upper syscall limit -- ldmccia r1, {r0 - r6} @ have to reload r0 - r6 -- stmccia sp, {r4, r5} @ and update the stack args -- ldrcc pc, [tbl, scno, lsl #2] @ call sys_* routine -+ mov scno, r0 -+ invoke_syscall tbl, scno, r10, __sys_trace_return, reload=1 - cmp scno, #-1 @ skip the syscall? - bne 2b - add sp, sp, #S_OFF @ restore stack -@@ -317,6 +309,10 @@ sys_syscall: - bic scno, r0, #__NR_OABI_SYSCALL_BASE - cmp scno, #__NR_syscall - __NR_SYSCALL_BASE - cmpne scno, #NR_syscalls @ check range -+#ifdef CONFIG_CPU_SPECTRE -+ movhs scno, #0 -+ csdb -+#endif - stmloia sp, {r5, r6} @ shuffle args - movlo r0, r1 - movlo r1, r2 -diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S -index 6d243e830516..86dfee487e24 100644 ---- a/arch/arm/kernel/entry-header.S -+++ b/arch/arm/kernel/entry-header.S -@@ -373,6 +373,31 @@ - #endif - .endm - -+ .macro invoke_syscall, table, nr, tmp, ret, reload=0 -+#ifdef CONFIG_CPU_SPECTRE -+ mov \tmp, \nr -+ cmp \tmp, #NR_syscalls @ check upper syscall limit -+ movcs \tmp, #0 -+ csdb -+ badr lr, \ret @ return address -+ .if \reload -+ add r1, sp, #S_R0 + S_OFF @ pointer to regs -+ ldmccia r1, {r0 - r6} @ reload r0-r6 -+ stmccia sp, {r4, r5} @ update stack arguments -+ .endif -+ ldrcc pc, [\table, \tmp, lsl #2] @ call sys_* routine -+#else -+ cmp \nr, #NR_syscalls @ check upper syscall limit -+ badr lr, \ret @ return address -+ .if \reload -+ add r1, sp, #S_R0 + S_OFF @ pointer to regs -+ ldmccia r1, {r0 - r6} @ reload r0-r6 -+ stmccia sp, {r4, r5} @ update stack arguments -+ .endif -+ ldrcc pc, [\table, \nr, lsl #2] @ call sys_* routine -+#endif -+ .endm -+ - /* - * These are the registers used in the syscall handler, and allow us to - * have in theory up to 7 arguments to a function - r0 to r6. -diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S -index 8733012d231f..7e662bdd5cb3 100644 ---- a/arch/arm/kernel/head-common.S -+++ b/arch/arm/kernel/head-common.S -@@ -122,6 +122,9 @@ __mmap_switched_data: - .long init_thread_union + THREAD_START_SP @ sp - .size __mmap_switched_data, . - __mmap_switched_data - -+ __FINIT -+ .text -+ - /* - * This provides a C-API version of __lookup_processor_type - */ -@@ -133,9 +136,6 @@ ENTRY(lookup_processor_type) - ldmfd sp!, {r4 - r6, r9, pc} - ENDPROC(lookup_processor_type) - -- __FINIT -- .text -- - /* - * Read processor ID register (CP#15, CR0), and look up in the linker-built - * supported processor list. Note that we can't use the absolute addresses -diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c -index 20edd349d379..e9c3d38d995d 100644 ---- a/arch/arm/kernel/setup.c -+++ b/arch/arm/kernel/setup.c -@@ -113,6 +113,11 @@ EXPORT_SYMBOL(elf_hwcap2); - - #ifdef MULTI_CPU - struct processor processor __read_mostly; -+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) -+struct processor *cpu_vtable[NR_CPUS] = { -+ [0] = &processor, -+}; -+#endif - #endif - #ifdef MULTI_TLB - struct cpu_tlb_fns cpu_tlb __read_mostly; -@@ -599,28 +604,33 @@ static void __init smp_build_mpidr_hash(void) - } - #endif - --static void __init setup_processor(void) -+/* -+ * locate processor in the list of supported processor types. The linker -+ * builds this table for us from the entries in arch/arm/mm/proc-*.S -+ */ -+struct proc_info_list *lookup_processor(u32 midr) - { -- struct proc_info_list *list; -+ struct proc_info_list *list = lookup_processor_type(midr); - -- /* -- * locate processor in the list of supported processor -- * types. The linker builds this table for us from the -- * entries in arch/arm/mm/proc-*.S -- */ -- list = lookup_processor_type(read_cpuid_id()); - if (!list) { -- pr_err("CPU configuration botched (ID %08x), unable to continue.\n", -- read_cpuid_id()); -- while (1); -+ pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n", -+ smp_processor_id(), midr); -+ while (1) -+ /* can't use cpu_relax() here as it may require MMU setup */; - } - -+ return list; -+} -+ -+static void __init setup_processor(void) -+{ -+ unsigned int midr = read_cpuid_id(); -+ struct proc_info_list *list = lookup_processor(midr); -+ - cpu_name = list->cpu_name; - __cpu_architecture = __get_cpu_architecture(); - --#ifdef MULTI_CPU -- processor = *list->proc; --#endif -+ init_proc_vtable(list->proc); - #ifdef MULTI_TLB - cpu_tlb = *list->tlb; - #endif -@@ -632,7 +642,7 @@ static void __init setup_processor(void) - #endif - - pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n", -- cpu_name, read_cpuid_id(), read_cpuid_id() & 15, -+ list->cpu_name, midr, midr & 15, - proc_arch[cpu_architecture()], get_cr()); - - snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c", -diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c -index 7b8f2141427b..0a066f03b5ec 100644 ---- a/arch/arm/kernel/signal.c -+++ b/arch/arm/kernel/signal.c -@@ -94,34 +94,34 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame) - - static int preserve_vfp_context(struct vfp_sigframe __user *frame) - { -- const unsigned long magic = VFP_MAGIC; -- const unsigned long size = VFP_STORAGE_SIZE; -+ struct vfp_sigframe kframe; - int err = 0; - -- __put_user_error(magic, &frame->magic, err); -- __put_user_error(size, &frame->size, err); -+ memset(&kframe, 0, sizeof(kframe)); -+ kframe.magic = VFP_MAGIC; -+ kframe.size = VFP_STORAGE_SIZE; - -+ err = vfp_preserve_user_clear_hwstate(&kframe.ufp, &kframe.ufp_exc); - if (err) -- return -EFAULT; -+ return err; - -- return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc); -+ return __copy_to_user(frame, &kframe, sizeof(kframe)); - } - --static int restore_vfp_context(struct vfp_sigframe __user *frame) -+static int restore_vfp_context(struct vfp_sigframe __user *auxp) - { -- unsigned long magic; -- unsigned long size; -- int err = 0; -+ struct vfp_sigframe frame; -+ int err; - -- __get_user_error(magic, &frame->magic, err); -- __get_user_error(size, &frame->size, err); -+ err = __copy_from_user(&frame, (char __user *) auxp, sizeof(frame)); - - if (err) -- return -EFAULT; -- if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE) -+ return err; -+ -+ if (frame.magic != VFP_MAGIC || frame.size != VFP_STORAGE_SIZE) - return -EINVAL; - -- return vfp_restore_user_hwstate(&frame->ufp, &frame->ufp_exc); -+ return vfp_restore_user_hwstate(&frame.ufp, &frame.ufp_exc); - } - - #endif -@@ -141,6 +141,7 @@ struct rt_sigframe { - - static int restore_sigframe(struct pt_regs *regs, struct sigframe __user *sf) - { -+ struct sigcontext context; - struct aux_sigframe __user *aux; - sigset_t set; - int err; -@@ -149,23 +150,26 @@ static int restore_sigframe(struct pt_regs *regs, struct sigframe __user *sf) - if (err == 0) - set_current_blocked(&set); - -- __get_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err); -- __get_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err); -- __get_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err); -- __get_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err); -- __get_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err); -- __get_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err); -- __get_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err); -- __get_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err); -- __get_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err); -- __get_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err); -- __get_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err); -- __get_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err); -- __get_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err); -- __get_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err); -- __get_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err); -- __get_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err); -- __get_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err); -+ err |= __copy_from_user(&context, &sf->uc.uc_mcontext, sizeof(context)); -+ if (err == 0) { -+ regs->ARM_r0 = context.arm_r0; -+ regs->ARM_r1 = context.arm_r1; -+ regs->ARM_r2 = context.arm_r2; -+ regs->ARM_r3 = context.arm_r3; -+ regs->ARM_r4 = context.arm_r4; -+ regs->ARM_r5 = context.arm_r5; -+ regs->ARM_r6 = context.arm_r6; -+ regs->ARM_r7 = context.arm_r7; -+ regs->ARM_r8 = context.arm_r8; -+ regs->ARM_r9 = context.arm_r9; -+ regs->ARM_r10 = context.arm_r10; -+ regs->ARM_fp = context.arm_fp; -+ regs->ARM_ip = context.arm_ip; -+ regs->ARM_sp = context.arm_sp; -+ regs->ARM_lr = context.arm_lr; -+ regs->ARM_pc = context.arm_pc; -+ regs->ARM_cpsr = context.arm_cpsr; -+ } - - err |= !valid_user_regs(regs); - -@@ -253,30 +257,35 @@ static int - setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set) - { - struct aux_sigframe __user *aux; -+ struct sigcontext context; - int err = 0; - -- __put_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err); -- __put_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err); -- __put_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err); -- __put_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err); -- __put_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err); -- __put_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err); -- __put_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err); -- __put_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err); -- __put_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err); -- __put_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err); -- __put_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err); -- __put_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err); -- __put_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err); -- __put_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err); -- __put_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err); -- __put_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err); -- __put_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err); -- -- __put_user_error(current->thread.trap_no, &sf->uc.uc_mcontext.trap_no, err); -- __put_user_error(current->thread.error_code, &sf->uc.uc_mcontext.error_code, err); -- __put_user_error(current->thread.address, &sf->uc.uc_mcontext.fault_address, err); -- __put_user_error(set->sig[0], &sf->uc.uc_mcontext.oldmask, err); -+ context = (struct sigcontext) { -+ .arm_r0 = regs->ARM_r0, -+ .arm_r1 = regs->ARM_r1, -+ .arm_r2 = regs->ARM_r2, -+ .arm_r3 = regs->ARM_r3, -+ .arm_r4 = regs->ARM_r4, -+ .arm_r5 = regs->ARM_r5, -+ .arm_r6 = regs->ARM_r6, -+ .arm_r7 = regs->ARM_r7, -+ .arm_r8 = regs->ARM_r8, -+ .arm_r9 = regs->ARM_r9, -+ .arm_r10 = regs->ARM_r10, -+ .arm_fp = regs->ARM_fp, -+ .arm_ip = regs->ARM_ip, -+ .arm_sp = regs->ARM_sp, -+ .arm_lr = regs->ARM_lr, -+ .arm_pc = regs->ARM_pc, -+ .arm_cpsr = regs->ARM_cpsr, -+ -+ .trap_no = current->thread.trap_no, -+ .error_code = current->thread.error_code, -+ .fault_address = current->thread.address, -+ .oldmask = set->sig[0], -+ }; -+ -+ err |= __copy_to_user(&sf->uc.uc_mcontext, &context, sizeof(context)); - - err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(*set)); - -@@ -293,7 +302,7 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set) - if (err == 0) - err |= preserve_vfp_context(&aux->vfp); - #endif -- __put_user_error(0, &aux->end_magic, err); -+ err |= __put_user(0, &aux->end_magic); - - return err; - } -@@ -425,7 +434,7 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs) - /* - * Set uc.uc_flags to a value which sc.trap_no would never have. - */ -- __put_user_error(0x5ac3c35a, &frame->uc.uc_flags, err); -+ err = __put_user(0x5ac3c35a, &frame->uc.uc_flags); - - err |= setup_sigframe(frame, regs, set); - if (err == 0) -@@ -445,8 +454,8 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs) - - err |= copy_siginfo_to_user(&frame->info, &ksig->info); - -- __put_user_error(0, &frame->sig.uc.uc_flags, err); -- __put_user_error(NULL, &frame->sig.uc.uc_link, err); -+ err |= __put_user(0, &frame->sig.uc.uc_flags); -+ err |= __put_user(NULL, &frame->sig.uc.uc_link); - - err |= __save_altstack(&frame->sig.uc.uc_stack, regs->ARM_sp); - err |= setup_sigframe(&frame->sig, regs, set); -diff --git a/arch/arm/kernel/smccc-call.S b/arch/arm/kernel/smccc-call.S -new file mode 100644 -index 000000000000..2e48b674aab1 ---- /dev/null -+++ b/arch/arm/kernel/smccc-call.S -@@ -0,0 +1,62 @@ -+/* -+ * Copyright (c) 2015, Linaro Limited -+ * -+ * This software is licensed under the terms of the GNU General Public -+ * License version 2, as published by the Free Software Foundation, and -+ * may be copied, distributed, and modified under those terms. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ */ -+#include -+ -+#include -+#include -+#include -+ -+ /* -+ * Wrap c macros in asm macros to delay expansion until after the -+ * SMCCC asm macro is expanded. -+ */ -+ .macro SMCCC_SMC -+ __SMC(0) -+ .endm -+ -+ .macro SMCCC_HVC -+ __HVC(0) -+ .endm -+ -+ .macro SMCCC instr -+UNWIND( .fnstart) -+ mov r12, sp -+ push {r4-r7} -+UNWIND( .save {r4-r7}) -+ ldm r12, {r4-r7} -+ \instr -+ pop {r4-r7} -+ ldr r12, [sp, #(4 * 4)] -+ stm r12, {r0-r3} -+ bx lr -+UNWIND( .fnend) -+ .endm -+ -+/* -+ * void smccc_smc(unsigned long a0, unsigned long a1, unsigned long a2, -+ * unsigned long a3, unsigned long a4, unsigned long a5, -+ * unsigned long a6, unsigned long a7, struct arm_smccc_res *res) -+ */ -+ENTRY(arm_smccc_smc) -+ SMCCC SMCCC_SMC -+ENDPROC(arm_smccc_smc) -+ -+/* -+ * void smccc_hvc(unsigned long a0, unsigned long a1, unsigned long a2, -+ * unsigned long a3, unsigned long a4, unsigned long a5, -+ * unsigned long a6, unsigned long a7, struct arm_smccc_res *res) -+ */ -+ENTRY(arm_smccc_hvc) -+ SMCCC SMCCC_HVC -+ENDPROC(arm_smccc_hvc) -diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c -index 0f1c11861147..d2033d09125f 100644 ---- a/arch/arm/kernel/smp.c -+++ b/arch/arm/kernel/smp.c -@@ -27,8 +27,10 @@ - #include - #include - #include -+#include - - #include -+#include - #include - #include - #include -@@ -39,6 +41,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -95,6 +98,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd) - #endif - } - -+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) -+static int secondary_biglittle_prepare(unsigned int cpu) -+{ -+ if (!cpu_vtable[cpu]) -+ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL); -+ -+ return cpu_vtable[cpu] ? 0 : -ENOMEM; -+} -+ -+static void secondary_biglittle_init(void) -+{ -+ init_proc_vtable(lookup_processor(read_cpuid_id())->proc); -+} -+#else -+static int secondary_biglittle_prepare(unsigned int cpu) -+{ -+ return 0; -+} -+ -+static void secondary_biglittle_init(void) -+{ -+} -+#endif -+ - int __cpu_up(unsigned int cpu, struct task_struct *idle) - { - int ret; -@@ -102,6 +129,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) - if (!smp_ops.smp_boot_secondary) - return -ENOSYS; - -+ ret = secondary_biglittle_prepare(cpu); -+ if (ret) -+ return ret; -+ - /* - * We need to tell the secondary core where to find - * its stack and the page tables. -@@ -353,6 +384,8 @@ asmlinkage void secondary_start_kernel(void) - struct mm_struct *mm = &init_mm; - unsigned int cpu; - -+ secondary_biglittle_init(); -+ - /* - * The identity mapping is uncached (strongly ordered), so - * switch away from it before attempting any exclusive accesses. -@@ -396,6 +429,9 @@ asmlinkage void secondary_start_kernel(void) - * before we continue - which happens after __cpu_up returns. - */ - set_cpu_online(cpu, true); -+ -+ check_other_bugs(); -+ - complete(&cpu_running); - - local_irq_enable(); -diff --git a/arch/arm/kernel/suspend.c b/arch/arm/kernel/suspend.c -index 9a2f882a0a2d..134f0d432610 100644 ---- a/arch/arm/kernel/suspend.c -+++ b/arch/arm/kernel/suspend.c -@@ -1,6 +1,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -34,6 +35,7 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long)) - cpu_switch_mm(mm->pgd, mm); - local_flush_bp_all(); - local_flush_tlb_all(); -+ check_other_bugs(); - } - - return ret; -diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c -index 5f221acd21ae..d844c5c9364b 100644 ---- a/arch/arm/kernel/sys_oabi-compat.c -+++ b/arch/arm/kernel/sys_oabi-compat.c -@@ -276,6 +276,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, - int maxevents, int timeout) - { - struct epoll_event *kbuf; -+ struct oabi_epoll_event e; - mm_segment_t fs; - long ret, err, i; - -@@ -294,8 +295,11 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, - set_fs(fs); - err = 0; - for (i = 0; i < ret; i++) { -- __put_user_error(kbuf[i].events, &events->events, err); -- __put_user_error(kbuf[i].data, &events->data, err); -+ e.events = kbuf[i].events; -+ e.data = kbuf[i].data; -+ err = __copy_to_user(events, &e, sizeof(e)); -+ if (err) -+ break; - events++; - } - kfree(kbuf); -@@ -328,9 +332,11 @@ asmlinkage long sys_oabi_semtimedop(int semid, - return -ENOMEM; - err = 0; - for (i = 0; i < nsops; i++) { -- __get_user_error(sops[i].sem_num, &tsops->sem_num, err); -- __get_user_error(sops[i].sem_op, &tsops->sem_op, err); -- __get_user_error(sops[i].sem_flg, &tsops->sem_flg, err); -+ struct oabi_sembuf osb; -+ err |= __copy_from_user(&osb, tsops, sizeof(osb)); -+ sops[i].sem_num = osb.sem_num; -+ sops[i].sem_op = osb.sem_op; -+ sops[i].sem_flg = osb.sem_flg; - tsops++; - } - if (timeout) { -diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S -index 1512bebfbf1b..e32b51838439 100644 ---- a/arch/arm/lib/copy_from_user.S -+++ b/arch/arm/lib/copy_from_user.S -@@ -90,6 +90,11 @@ - .text - - ENTRY(arm_copy_from_user) -+#ifdef CONFIG_CPU_SPECTRE -+ get_thread_info r3 -+ ldr r3, [r3, #TI_ADDR_LIMIT] -+ uaccess_mask_range_ptr r1, r2, r3, ip -+#endif - - #include "copy_template.S" - -diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index 41218867a9a6..71115afb71a0 100644 ---- a/arch/arm/mm/Kconfig -+++ b/arch/arm/mm/Kconfig -@@ -396,6 +396,7 @@ config CPU_V7 - select CPU_CP15_MPU if !MMU - select CPU_HAS_ASID if MMU - select CPU_PABRT_V7 -+ select CPU_SPECTRE if MMU - select CPU_TLB_V7 if MMU - - # ARMv7M -@@ -793,6 +794,28 @@ config CPU_BPREDICT_DISABLE - help - Say Y here to disable branch prediction. If unsure, say N. - -+config CPU_SPECTRE -+ bool -+ -+config HARDEN_BRANCH_PREDICTOR -+ bool "Harden the branch predictor against aliasing attacks" if EXPERT -+ depends on CPU_SPECTRE -+ default y -+ help -+ Speculation attacks against some high-performance processors rely -+ on being able to manipulate the branch predictor for a victim -+ context by executing aliasing branches in the attacker context. -+ Such attacks can be partially mitigated against by clearing -+ internal branch predictor state and limiting the prediction -+ logic in some situations. -+ -+ This config option will take CPU-specific actions to harden -+ the branch predictor against aliasing attacks and may rely on -+ specific instruction sequences or control bits being set by -+ the system firmware. -+ -+ If unsure, say Y. -+ - config TLS_REG_EMUL - bool - select NEED_KUSER_HELPERS -diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile -index 7f76d96ce546..35307176e46c 100644 ---- a/arch/arm/mm/Makefile -+++ b/arch/arm/mm/Makefile -@@ -92,7 +92,7 @@ obj-$(CONFIG_CPU_MOHAWK) += proc-mohawk.o - obj-$(CONFIG_CPU_FEROCEON) += proc-feroceon.o - obj-$(CONFIG_CPU_V6) += proc-v6.o - obj-$(CONFIG_CPU_V6K) += proc-v6.o --obj-$(CONFIG_CPU_V7) += proc-v7.o -+obj-$(CONFIG_CPU_V7) += proc-v7.o proc-v7-bugs.o - obj-$(CONFIG_CPU_V7M) += proc-v7m.o - - AFLAGS_proc-v6.o :=-Wa,-march=armv6 -diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c -index 7d5f4c736a16..cd18eda014c2 100644 ---- a/arch/arm/mm/alignment.c -+++ b/arch/arm/mm/alignment.c -@@ -767,6 +767,36 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs, - return NULL; - } - -+static int alignment_get_arm(struct pt_regs *regs, u32 *ip, unsigned long *inst) -+{ -+ u32 instr = 0; -+ int fault; -+ -+ if (user_mode(regs)) -+ fault = get_user(instr, ip); -+ else -+ fault = probe_kernel_address(ip, instr); -+ -+ *inst = __mem_to_opcode_arm(instr); -+ -+ return fault; -+} -+ -+static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst) -+{ -+ u16 instr = 0; -+ int fault; -+ -+ if (user_mode(regs)) -+ fault = get_user(instr, ip); -+ else -+ fault = probe_kernel_address(ip, instr); -+ -+ *inst = __mem_to_opcode_thumb16(instr); -+ -+ return fault; -+} -+ - static int - do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) - { -@@ -774,10 +804,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) - unsigned long instr = 0, instrptr; - int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs); - unsigned int type; -- unsigned int fault; - u16 tinstr = 0; - int isize = 4; - int thumb2_32b = 0; -+ int fault; - - if (interrupts_enabled(regs)) - local_irq_enable(); -@@ -786,15 +816,14 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) - - if (thumb_mode(regs)) { - u16 *ptr = (u16 *)(instrptr & ~1); -- fault = probe_kernel_address(ptr, tinstr); -- tinstr = __mem_to_opcode_thumb16(tinstr); -+ -+ fault = alignment_get_thumb(regs, ptr, &tinstr); - if (!fault) { - if (cpu_architecture() >= CPU_ARCH_ARMv7 && - IS_T32(tinstr)) { - /* Thumb-2 32-bit */ -- u16 tinst2 = 0; -- fault = probe_kernel_address(ptr + 1, tinst2); -- tinst2 = __mem_to_opcode_thumb16(tinst2); -+ u16 tinst2; -+ fault = alignment_get_thumb(regs, ptr + 1, &tinst2); - instr = __opcode_thumb32_compose(tinstr, tinst2); - thumb2_32b = 1; - } else { -@@ -803,8 +832,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) - } - } - } else { -- fault = probe_kernel_address((void *)instrptr, instr); -- instr = __mem_to_opcode_arm(instr); -+ fault = alignment_get_arm(regs, (void *)instrptr, &instr); - } - - if (fault) { -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index 702a5542b11a..20172b6fa773 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -163,6 +163,9 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr, - { - struct siginfo si; - -+ if (addr > TASK_SIZE) -+ harden_branch_predictor(); -+ - #ifdef CONFIG_DEBUG_USER - if (((user_debug & UDBG_SEGV) && (sig == SIGSEGV)) || - ((user_debug & UDBG_BUS) && (sig == SIGBUS))) { -diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S -index c671f345266a..e6bfdcc381f8 100644 ---- a/arch/arm/mm/proc-macros.S -+++ b/arch/arm/mm/proc-macros.S -@@ -258,13 +258,21 @@ - mcr p15, 0, ip, c7, c10, 4 @ data write barrier - .endm - --.macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0 -+.macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0 -+/* -+ * If we are building for big.Little with branch predictor hardening, -+ * we need the processor function tables to remain available after boot. -+ */ -+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) -+ .section ".rodata" -+#endif - .type \name\()_processor_functions, #object - .align 2 - ENTRY(\name\()_processor_functions) - .word \dabort - .word \pabort - .word cpu_\name\()_proc_init -+ .word \bugs - .word cpu_\name\()_proc_fin - .word cpu_\name\()_reset - .word cpu_\name\()_do_idle -@@ -293,6 +301,9 @@ ENTRY(\name\()_processor_functions) - .endif - - .size \name\()_processor_functions, . - \name\()_processor_functions -+#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) -+ .previous -+#endif - .endm - - .macro define_cache_functions name:req -diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c -new file mode 100644 -index 000000000000..9a07916af8dd ---- /dev/null -+++ b/arch/arm/mm/proc-v7-bugs.c -@@ -0,0 +1,161 @@ -+// SPDX-License-Identifier: GPL-2.0 -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+ -+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR -+DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn); -+ -+extern void cpu_v7_iciallu_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm); -+extern void cpu_v7_bpiall_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm); -+extern void cpu_v7_smc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm); -+extern void cpu_v7_hvc_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm); -+ -+static void harden_branch_predictor_bpiall(void) -+{ -+ write_sysreg(0, BPIALL); -+} -+ -+static void harden_branch_predictor_iciallu(void) -+{ -+ write_sysreg(0, ICIALLU); -+} -+ -+static void __maybe_unused call_smc_arch_workaround_1(void) -+{ -+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL); -+} -+ -+static void __maybe_unused call_hvc_arch_workaround_1(void) -+{ -+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL); -+} -+ -+static void cpu_v7_spectre_init(void) -+{ -+ const char *spectre_v2_method = NULL; -+ int cpu = smp_processor_id(); -+ -+ if (per_cpu(harden_branch_predictor_fn, cpu)) -+ return; -+ -+ switch (read_cpuid_part()) { -+ case ARM_CPU_PART_CORTEX_A8: -+ case ARM_CPU_PART_CORTEX_A9: -+ case ARM_CPU_PART_CORTEX_A12: -+ case ARM_CPU_PART_CORTEX_A17: -+ case ARM_CPU_PART_CORTEX_A73: -+ case ARM_CPU_PART_CORTEX_A75: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ harden_branch_predictor_bpiall; -+ spectre_v2_method = "BPIALL"; -+ break; -+ -+ case ARM_CPU_PART_CORTEX_A15: -+ case ARM_CPU_PART_BRAHMA_B15: -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ harden_branch_predictor_iciallu; -+ spectre_v2_method = "ICIALLU"; -+ break; -+ -+#ifdef CONFIG_ARM_PSCI -+ default: -+ /* Other ARM CPUs require no workaround */ -+ if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) -+ break; -+ /* fallthrough */ -+ /* Cortex A57/A72 require firmware workaround */ -+ case ARM_CPU_PART_CORTEX_A57: -+ case ARM_CPU_PART_CORTEX_A72: { -+ struct arm_smccc_res res; -+ -+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0) -+ break; -+ -+ switch (psci_ops.conduit) { -+ case PSCI_CONDUIT_HVC: -+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, -+ ARM_SMCCC_ARCH_WORKAROUND_1, &res); -+ if ((int)res.a0 != 0) -+ break; -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ call_hvc_arch_workaround_1; -+ cpu_do_switch_mm = cpu_v7_hvc_switch_mm; -+ spectre_v2_method = "hypervisor"; -+ break; -+ -+ case PSCI_CONDUIT_SMC: -+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, -+ ARM_SMCCC_ARCH_WORKAROUND_1, &res); -+ if ((int)res.a0 != 0) -+ break; -+ per_cpu(harden_branch_predictor_fn, cpu) = -+ call_smc_arch_workaround_1; -+ cpu_do_switch_mm = cpu_v7_smc_switch_mm; -+ spectre_v2_method = "firmware"; -+ break; -+ -+ default: -+ break; -+ } -+ } -+#endif -+ } -+ -+ if (spectre_v2_method) -+ pr_info("CPU%u: Spectre v2: using %s workaround\n", -+ smp_processor_id(), spectre_v2_method); -+} -+#else -+static void cpu_v7_spectre_init(void) -+{ -+} -+#endif -+ -+static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned, -+ u32 mask, const char *msg) -+{ -+ u32 aux_cr; -+ -+ asm("mrc p15, 0, %0, c1, c0, 1" : "=r" (aux_cr)); -+ -+ if ((aux_cr & mask) != mask) { -+ if (!*warned) -+ pr_err("CPU%u: %s", smp_processor_id(), msg); -+ *warned = true; -+ return false; -+ } -+ return true; -+} -+ -+static DEFINE_PER_CPU(bool, spectre_warned); -+ -+static bool check_spectre_auxcr(bool *warned, u32 bit) -+{ -+ return IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR) && -+ cpu_v7_check_auxcr_set(warned, bit, -+ "Spectre v2: firmware did not set auxiliary control register IBE bit, system vulnerable\n"); -+} -+ -+void cpu_v7_ca8_ibe(void) -+{ -+ if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6))) -+ cpu_v7_spectre_init(); -+} -+ -+void cpu_v7_ca15_ibe(void) -+{ -+ if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) -+ cpu_v7_spectre_init(); -+} -+ -+void cpu_v7_bugs_init(void) -+{ -+ cpu_v7_spectre_init(); -+} -diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c -index 2a61e4b04600..f9392fb060ea 100644 ---- a/arch/arm/vfp/vfpmodule.c -+++ b/arch/arm/vfp/vfpmodule.c -@@ -558,12 +558,11 @@ void vfp_flush_hwstate(struct thread_info *thread) - * Save the current VFP state into the provided structures and prepare - * for entry into a new function (signal handler). - */ --int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp, -- struct user_vfp_exc __user *ufp_exc) -+int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp, -+ struct user_vfp_exc *ufp_exc) - { - struct thread_info *thread = current_thread_info(); - struct vfp_hard_struct *hwstate = &thread->vfpstate.hard; -- int err = 0; - - /* Ensure that the saved hwstate is up-to-date. */ - vfp_sync_hwstate(thread); -@@ -572,22 +571,19 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp, - * Copy the floating point registers. There can be unused - * registers see asm/hwcap.h for details. - */ -- err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs, -- sizeof(hwstate->fpregs)); -+ memcpy(&ufp->fpregs, &hwstate->fpregs, sizeof(hwstate->fpregs)); -+ - /* - * Copy the status and control register. - */ -- __put_user_error(hwstate->fpscr, &ufp->fpscr, err); -+ ufp->fpscr = hwstate->fpscr; - - /* - * Copy the exception registers. - */ -- __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err); -- __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err); -- __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err); -- -- if (err) -- return -EFAULT; -+ ufp_exc->fpexc = hwstate->fpexc; -+ ufp_exc->fpinst = hwstate->fpinst; -+ ufp_exc->fpinst2 = hwstate->fpinst2; - - /* Ensure that VFP is disabled. */ - vfp_flush_hwstate(thread); -@@ -601,13 +597,11 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp, - } - - /* Sanitise and restore the current VFP state from the provided structures. */ --int vfp_restore_user_hwstate(struct user_vfp __user *ufp, -- struct user_vfp_exc __user *ufp_exc) -+int vfp_restore_user_hwstate(struct user_vfp *ufp, struct user_vfp_exc *ufp_exc) - { - struct thread_info *thread = current_thread_info(); - struct vfp_hard_struct *hwstate = &thread->vfpstate.hard; - unsigned long fpexc; -- int err = 0; - - /* Disable VFP to avoid corrupting the new thread state. */ - vfp_flush_hwstate(thread); -@@ -616,17 +610,16 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp, - * Copy the floating point registers. There can be unused - * registers see asm/hwcap.h for details. - */ -- err |= __copy_from_user(&hwstate->fpregs, &ufp->fpregs, -- sizeof(hwstate->fpregs)); -+ memcpy(&hwstate->fpregs, &ufp->fpregs, sizeof(hwstate->fpregs)); - /* - * Copy the status and control register. - */ -- __get_user_error(hwstate->fpscr, &ufp->fpscr, err); -+ hwstate->fpscr = ufp->fpscr; - - /* - * Sanitise and restore the exception registers. - */ -- __get_user_error(fpexc, &ufp_exc->fpexc, err); -+ fpexc = ufp_exc->fpexc; - - /* Ensure the VFP is enabled. */ - fpexc |= FPEXC_EN; -@@ -635,10 +628,10 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp, - fpexc &= ~(FPEXC_EX | FPEXC_FP2V); - hwstate->fpexc = fpexc; - -- __get_user_error(hwstate->fpinst, &ufp_exc->fpinst, err); -- __get_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err); -+ hwstate->fpinst = ufp_exc->fpinst; -+ hwstate->fpinst2 = ufp_exc->fpinst2; - -- return err ? -EFAULT : 0; -+ return 0; - } - - /* -diff --git a/arch/arm64/kernel/smccc-call.S b/arch/arm64/kernel/smccc-call.S -new file mode 100644 -index 000000000000..ae0496fa4235 ---- /dev/null -+++ b/arch/arm64/kernel/smccc-call.S -@@ -0,0 +1,43 @@ -+/* -+ * Copyright (c) 2015, Linaro Limited -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License Version 2 as -+ * published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ */ -+#include -+#include -+ -+ .macro SMCCC instr -+ .cfi_startproc -+ \instr #0 -+ ldr x4, [sp] -+ stp x0, x1, [x4, #ARM_SMCCC_RES_X0_OFFS] -+ stp x2, x3, [x4, #ARM_SMCCC_RES_X2_OFFS] -+ ret -+ .cfi_endproc -+ .endm -+ -+/* -+ * void arm_smccc_smc(unsigned long a0, unsigned long a1, unsigned long a2, -+ * unsigned long a3, unsigned long a4, unsigned long a5, -+ * unsigned long a6, unsigned long a7, struct arm_smccc_res *res) -+ */ -+ENTRY(arm_smccc_smc) -+ SMCCC smc -+ENDPROC(arm_smccc_smc) -+ -+/* -+ * void arm_smccc_hvc(unsigned long a0, unsigned long a1, unsigned long a2, -+ * unsigned long a3, unsigned long a4, unsigned long a5, -+ * unsigned long a6, unsigned long a7, struct arm_smccc_res *res) -+ */ -+ENTRY(arm_smccc_hvc) -+ SMCCC hvc -+ENDPROC(arm_smccc_hvc) -diff --git a/arch/mips/bcm63xx/prom.c b/arch/mips/bcm63xx/prom.c -index 7019e2967009..bbbf8057565b 100644 ---- a/arch/mips/bcm63xx/prom.c -+++ b/arch/mips/bcm63xx/prom.c -@@ -84,7 +84,7 @@ void __init prom_init(void) - * Here we will start up CPU1 in the background and ask it to - * reconfigure itself then go back to sleep. - */ -- memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20); -+ memcpy((void *)0xa0000200, bmips_smp_movevec, 0x20); - __sync(); - set_c0_cause(C_SW0); - cpumask_set_cpu(1, &bmips_booted_mask); -diff --git a/arch/mips/include/asm/bmips.h b/arch/mips/include/asm/bmips.h -index 6d25ad33ec78..860e4cef61be 100644 ---- a/arch/mips/include/asm/bmips.h -+++ b/arch/mips/include/asm/bmips.h -@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops(void) - #endif - } - --extern char bmips_reset_nmi_vec; --extern char bmips_reset_nmi_vec_end; --extern char bmips_smp_movevec; --extern char bmips_smp_int_vec; --extern char bmips_smp_int_vec_end; -+extern char bmips_reset_nmi_vec[]; -+extern char bmips_reset_nmi_vec_end[]; -+extern char bmips_smp_movevec[]; -+extern char bmips_smp_int_vec[]; -+extern char bmips_smp_int_vec_end[]; - - extern int bmips_smp_enabled; - extern int bmips_cpu_offset; -diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c -index 4874712b475e..a62d24169d75 100644 ---- a/arch/mips/kernel/smp-bmips.c -+++ b/arch/mips/kernel/smp-bmips.c -@@ -451,10 +451,10 @@ static void bmips_wr_vec(unsigned long dst, char *start, char *end) - - static inline void bmips_nmi_handler_setup(void) - { -- bmips_wr_vec(BMIPS_NMI_RESET_VEC, &bmips_reset_nmi_vec, -- &bmips_reset_nmi_vec_end); -- bmips_wr_vec(BMIPS_WARM_RESTART_VEC, &bmips_smp_int_vec, -- &bmips_smp_int_vec_end); -+ bmips_wr_vec(BMIPS_NMI_RESET_VEC, bmips_reset_nmi_vec, -+ bmips_reset_nmi_vec_end); -+ bmips_wr_vec(BMIPS_WARM_RESTART_VEC, bmips_smp_int_vec, -+ bmips_smp_int_vec_end); - } - - struct reset_vec_info { -diff --git a/drivers/dma/qcom_bam_dma.c b/drivers/dma/qcom_bam_dma.c -index 5a250cdc8376..eca5b106d7d4 100644 ---- a/drivers/dma/qcom_bam_dma.c -+++ b/drivers/dma/qcom_bam_dma.c -@@ -671,7 +671,21 @@ static int bam_dma_terminate_all(struct dma_chan *chan) - - /* remove all transactions, including active transaction */ - spin_lock_irqsave(&bchan->vc.lock, flag); -+ /* -+ * If we have transactions queued, then some might be committed to the -+ * hardware in the desc fifo. The only way to reset the desc fifo is -+ * to do a hardware reset (either by pipe or the entire block). -+ * bam_chan_init_hw() will trigger a pipe reset, and also reinit the -+ * pipe. If the pipe is left disabled (default state after pipe reset) -+ * and is accessed by a connected hardware engine, a fatal error in -+ * the BAM will occur. There is a small window where this could happen -+ * with bam_chan_init_hw(), but it is assumed that the caller has -+ * stopped activity on any attached hardware engine. Make sure to do -+ * this first so that the BAM hardware doesn't cause memory corruption -+ * by accessing freed resources. -+ */ - if (bchan->curr_txd) { -+ bam_chan_init_hw(bchan, bchan->curr_txd->dir); - list_add(&bchan->curr_txd->vd.node, &bchan->vc.desc_issued); - bchan->curr_txd = NULL; - } -diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig -index b0d42234fba0..cc5e79dc4cda 100644 ---- a/drivers/firmware/Kconfig -+++ b/drivers/firmware/Kconfig -@@ -174,6 +174,9 @@ config QCOM_SCM_64 - def_bool y - depends on QCOM_SCM && ARM64 - -+config HAVE_ARM_SMCCC -+ bool -+ - source "drivers/firmware/broadcom/Kconfig" - source "drivers/firmware/google/Kconfig" - source "drivers/firmware/efi/Kconfig" -diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c -index 1066146abd47..c825e3981b1c 100644 ---- a/drivers/firmware/psci.c -+++ b/drivers/firmware/psci.c -@@ -59,7 +59,10 @@ bool psci_tos_resident_on(int cpu) - return cpu == resident_cpu; - } - --struct psci_operations psci_ops; -+struct psci_operations psci_ops = { -+ .conduit = PSCI_CONDUIT_NONE, -+ .smccc_version = SMCCC_VERSION_1_0, -+}; - - typedef unsigned long (psci_fn)(unsigned long, unsigned long, - unsigned long, unsigned long); -@@ -210,6 +213,22 @@ static unsigned long psci_migrate_info_up_cpu(void) - 0, 0, 0); - } - -+static void set_conduit(enum psci_conduit conduit) -+{ -+ switch (conduit) { -+ case PSCI_CONDUIT_HVC: -+ invoke_psci_fn = __invoke_psci_fn_hvc; -+ break; -+ case PSCI_CONDUIT_SMC: -+ invoke_psci_fn = __invoke_psci_fn_smc; -+ break; -+ default: -+ WARN(1, "Unexpected PSCI conduit %d\n", conduit); -+ } -+ -+ psci_ops.conduit = conduit; -+} -+ - static int get_set_conduit_method(struct device_node *np) - { - const char *method; -@@ -222,9 +241,9 @@ static int get_set_conduit_method(struct device_node *np) - } - - if (!strcmp("hvc", method)) { -- invoke_psci_fn = __invoke_psci_fn_hvc; -+ set_conduit(PSCI_CONDUIT_HVC); - } else if (!strcmp("smc", method)) { -- invoke_psci_fn = __invoke_psci_fn_smc; -+ set_conduit(PSCI_CONDUIT_SMC); - } else { - pr_warn("invalid \"method\" property: %s\n", method); - return -EINVAL; -@@ -458,6 +477,31 @@ static void __init psci_init_migrate(void) - pr_info("Trusted OS resident on physical CPU 0x%lx\n", cpuid); - } - -+static void __init psci_init_smccc(void) -+{ -+ u32 ver = ARM_SMCCC_VERSION_1_0; -+ int feature; -+ -+ feature = psci_features(ARM_SMCCC_VERSION_FUNC_ID); -+ -+ if (feature != PSCI_RET_NOT_SUPPORTED) { -+ u32 ret; -+ ret = invoke_psci_fn(ARM_SMCCC_VERSION_FUNC_ID, 0, 0, 0); -+ if (ret == ARM_SMCCC_VERSION_1_1) { -+ psci_ops.smccc_version = SMCCC_VERSION_1_1; -+ ver = ret; -+ } -+ } -+ -+ /* -+ * Conveniently, the SMCCC and PSCI versions are encoded the -+ * same way. No, this isn't accidental. -+ */ -+ pr_info("SMC Calling Convention v%d.%d\n", -+ PSCI_VERSION_MAJOR(ver), PSCI_VERSION_MINOR(ver)); -+ -+} -+ - static void __init psci_0_2_set_functions(void) - { - pr_info("Using standard PSCI v0.2 function IDs\n"); -@@ -504,6 +548,7 @@ static int __init psci_probe(void) - psci_init_migrate(); - - if (PSCI_VERSION_MAJOR(ver) >= 1) { -+ psci_init_smccc(); - psci_init_cpu_suspend(); - psci_init_system_suspend(); - } -@@ -617,9 +662,9 @@ int __init psci_acpi_init(void) - pr_info("probing for conduit method from ACPI.\n"); - - if (acpi_psci_use_hvc()) -- invoke_psci_fn = __invoke_psci_fn_hvc; -+ set_conduit(PSCI_CONDUIT_HVC); - else -- invoke_psci_fn = __invoke_psci_fn_smc; -+ set_conduit(PSCI_CONDUIT_SMC); - - return psci_probe(); - } -diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c -index def831c89d35..e8b7dc1bcfa6 100644 ---- a/drivers/net/ethernet/hisilicon/hip04_eth.c -+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c -@@ -174,6 +174,7 @@ struct hip04_priv { - dma_addr_t rx_phys[RX_DESC_NUM]; - unsigned int rx_head; - unsigned int rx_buf_size; -+ unsigned int rx_cnt_remaining; - - struct device_node *phy_node; - struct phy_device *phy; -@@ -487,7 +488,6 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - struct hip04_priv *priv = container_of(napi, struct hip04_priv, napi); - struct net_device *ndev = priv->ndev; - struct net_device_stats *stats = &ndev->stats; -- unsigned int cnt = hip04_recv_cnt(priv); - struct rx_desc *desc; - struct sk_buff *skb; - unsigned char *buf; -@@ -500,8 +500,8 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - - /* clean up tx descriptors */ - tx_remaining = hip04_tx_reclaim(ndev, false); -- -- while (cnt && !last) { -+ priv->rx_cnt_remaining += hip04_recv_cnt(priv); -+ while (priv->rx_cnt_remaining && !last) { - buf = priv->rx_buf[priv->rx_head]; - skb = build_skb(buf, priv->rx_buf_size); - if (unlikely(!skb)) -@@ -544,11 +544,13 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) - hip04_set_recv_desc(priv, phys); - - priv->rx_head = RX_NEXT(priv->rx_head); -- if (rx >= budget) -+ if (rx >= budget) { -+ --priv->rx_cnt_remaining; - goto done; -+ } - -- if (--cnt == 0) -- cnt = hip04_recv_cnt(priv); -+ if (--priv->rx_cnt_remaining == 0) -+ priv->rx_cnt_remaining += hip04_recv_cnt(priv); - } - - if (!(priv->reg_inten & RCV_INT)) { -@@ -633,6 +635,7 @@ static int hip04_mac_open(struct net_device *ndev) - int i; - - priv->rx_head = 0; -+ priv->rx_cnt_remaining = 0; - priv->tx_head = 0; - priv->tx_tail = 0; - hip04_reset_ppe(priv); -diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -index 37dfdb1329f4..170a49a6803e 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -@@ -463,12 +463,31 @@ void mlx4_init_quotas(struct mlx4_dev *dev) - priv->mfunc.master.res_tracker.res_alloc[RES_MPT].quota[pf]; - } - --static int get_max_gauranteed_vfs_counter(struct mlx4_dev *dev) -+static int -+mlx4_calc_res_counter_guaranteed(struct mlx4_dev *dev, -+ struct resource_allocator *res_alloc, -+ int vf) - { -- /* reduce the sink counter */ -- return (dev->caps.max_counters - 1 - -- (MLX4_PF_COUNTERS_PER_PORT * MLX4_MAX_PORTS)) -- / MLX4_MAX_PORTS; -+ struct mlx4_active_ports actv_ports; -+ int ports, counters_guaranteed; -+ -+ /* For master, only allocate according to the number of phys ports */ -+ if (vf == mlx4_master_func_num(dev)) -+ return MLX4_PF_COUNTERS_PER_PORT * dev->caps.num_ports; -+ -+ /* calculate real number of ports for the VF */ -+ actv_ports = mlx4_get_active_ports(dev, vf); -+ ports = bitmap_weight(actv_ports.ports, dev->caps.num_ports); -+ counters_guaranteed = ports * MLX4_VF_COUNTERS_PER_PORT; -+ -+ /* If we do not have enough counters for this VF, do not -+ * allocate any for it. '-1' to reduce the sink counter. -+ */ -+ if ((res_alloc->res_reserved + counters_guaranteed) > -+ (dev->caps.max_counters - 1)) -+ return 0; -+ -+ return counters_guaranteed; - } - - int mlx4_init_resource_tracker(struct mlx4_dev *dev) -@@ -476,7 +495,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev) - struct mlx4_priv *priv = mlx4_priv(dev); - int i, j; - int t; -- int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev); - - priv->mfunc.master.res_tracker.slave_list = - kzalloc(dev->num_slaves * sizeof(struct slave_list), -@@ -593,16 +611,8 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev) - break; - case RES_COUNTER: - res_alloc->quota[t] = dev->caps.max_counters; -- if (t == mlx4_master_func_num(dev)) -- res_alloc->guaranteed[t] = -- MLX4_PF_COUNTERS_PER_PORT * -- MLX4_MAX_PORTS; -- else if (t <= max_vfs_guarantee_counter) -- res_alloc->guaranteed[t] = -- MLX4_VF_COUNTERS_PER_PORT * -- MLX4_MAX_PORTS; -- else -- res_alloc->guaranteed[t] = 0; -+ res_alloc->guaranteed[t] = -+ mlx4_calc_res_counter_guaranteed(dev, res_alloc, t); - res_alloc->res_free -= res_alloc->guaranteed[t]; - break; - default: -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 835129152fc4..536fee1e4b70 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2006,8 +2006,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - ttl = info->key.ttl; - tos = info->key.tos; - -- if (info->options_len) -+ if (info->options_len) { -+ if (info->options_len < sizeof(*md)) -+ goto drop; - md = ip_tunnel_info_opts(info); -+ } - } else { - md->gbp = skb->mark; - } -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 2eac3df7dd29..af9e4785b7a6 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -924,6 +924,7 @@ static int __init unittest_data_add(void) - of_fdt_unflatten_tree(unittest_data, &unittest_data_node); - if (!unittest_data_node) { - pr_warn("%s: No tree to attach; not running tests\n", __func__); -+ kfree(unittest_data); - return -ENODATA; - } - of_node_set_flag(unittest_data_node, OF_DETACHED); -diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c -index c68556bf6f39..ec185502dceb 100644 ---- a/drivers/regulator/pfuze100-regulator.c -+++ b/drivers/regulator/pfuze100-regulator.c -@@ -609,7 +609,13 @@ static int pfuze100_regulator_probe(struct i2c_client *client, - - /* SW2~SW4 high bit check and modify the voltage value table */ - if (i >= sw_check_start && i <= sw_check_end) { -- regmap_read(pfuze_chip->regmap, desc->vsel_reg, &val); -+ ret = regmap_read(pfuze_chip->regmap, -+ desc->vsel_reg, &val); -+ if (ret) { -+ dev_err(&client->dev, "Fails to read from the register.\n"); -+ return ret; -+ } -+ - if (val & sw_hi) { - if (pfuze_chip->chip_id == PFUZE3000) { - desc->volt_table = pfuze3000_sw2hi; -diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c -index d2f994298753..6d17357b3a24 100644 ---- a/drivers/regulator/ti-abb-regulator.c -+++ b/drivers/regulator/ti-abb-regulator.c -@@ -173,19 +173,14 @@ static int ti_abb_wait_txdone(struct device *dev, struct ti_abb *abb) - while (timeout++ <= abb->settling_time) { - status = ti_abb_check_txdone(abb); - if (status) -- break; -+ return 0; - - udelay(1); - } - -- if (timeout > abb->settling_time) { -- dev_warn_ratelimited(dev, -- "%s:TRANXDONE timeout(%duS) int=0x%08x\n", -- __func__, timeout, readl(abb->int_base)); -- return -ETIMEDOUT; -- } -- -- return 0; -+ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n", -+ __func__, timeout, readl(abb->int_base)); -+ return -ETIMEDOUT; - } - - /** -@@ -205,19 +200,14 @@ static int ti_abb_clear_all_txdone(struct device *dev, const struct ti_abb *abb) - - status = ti_abb_check_txdone(abb); - if (!status) -- break; -+ return 0; - - udelay(1); - } - -- if (timeout > abb->settling_time) { -- dev_warn_ratelimited(dev, -- "%s:TRANXDONE timeout(%duS) int=0x%08x\n", -- __func__, timeout, readl(abb->int_base)); -- return -ETIMEDOUT; -- } -- -- return 0; -+ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n", -+ __func__, timeout, readl(abb->int_base)); -+ return -ETIMEDOUT; - } - - /** -diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig -index 433c5e3d5733..070359a7eea1 100644 ---- a/drivers/scsi/Kconfig -+++ b/drivers/scsi/Kconfig -@@ -1013,7 +1013,7 @@ config SCSI_SNI_53C710 - - config 53C700_LE_ON_BE - bool -- depends on SCSI_LASI700 -+ depends on SCSI_LASI700 || SCSI_SNI_53C710 - default y - - config SCSI_STEX -diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c -index 76278072147e..b0f5220ae23a 100644 ---- a/drivers/scsi/sni_53c710.c -+++ b/drivers/scsi/sni_53c710.c -@@ -78,10 +78,8 @@ static int snirm710_probe(struct platform_device *dev) - - base = res->start; - hostdata = kzalloc(sizeof(*hostdata), GFP_KERNEL); -- if (!hostdata) { -- dev_printk(KERN_ERR, dev, "Failed to allocate host data\n"); -+ if (!hostdata) - return -ENOMEM; -- } - - hostdata->dev = &dev->dev; - dma_set_mask(&dev->dev, DMA_BIT_MASK(32)); -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index bb6a6c35324a..4198ed4ac607 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -1056,27 +1056,6 @@ passthrough_parse_cdb(struct se_cmd *cmd, - { - unsigned char *cdb = cmd->t_task_cdb; - -- /* -- * Clear a lun set in the cdb if the initiator talking to use spoke -- * and old standards version, as we can't assume the underlying device -- * won't choke up on it. -- */ -- switch (cdb[0]) { -- case READ_10: /* SBC - RDProtect */ -- case READ_12: /* SBC - RDProtect */ -- case READ_16: /* SBC - RDProtect */ -- case SEND_DIAGNOSTIC: /* SPC - SELF-TEST Code */ -- case VERIFY: /* SBC - VRProtect */ -- case VERIFY_16: /* SBC - VRProtect */ -- case WRITE_VERIFY: /* SBC - VRProtect */ -- case WRITE_VERIFY_12: /* SBC - VRProtect */ -- case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */ -- break; -- default: -- cdb[1] &= 0x1f; /* clear logical unit number */ -- break; -- } -- - /* - * For REPORT LUNS we always need to emulate the response, for everything - * else, pass it up. -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index 8225de3c9743..6b61d4ad30b5 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -1152,6 +1152,11 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file); - struct cifsInodeInfo { - bool can_cache_brlcks; - struct list_head llist; /* locks helb by this inode */ -+ /* -+ * NOTE: Some code paths call down_read(lock_sem) twice, so -+ * we must always use use cifs_down_write() instead of down_write() -+ * for this semaphore to avoid deadlocks. -+ */ - struct rw_semaphore lock_sem; /* protect the fields above */ - /* BB add in lists for dirty pages i.e. write caching info for oplock */ - struct list_head openFileList; -diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h -index 54590fd33df1..257c06c6a6c2 100644 ---- a/fs/cifs/cifsproto.h -+++ b/fs/cifs/cifsproto.h -@@ -138,6 +138,7 @@ extern int cifs_unlock_range(struct cifsFileInfo *cfile, - struct file_lock *flock, const unsigned int xid); - extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile); - -+extern void cifs_down_write(struct rw_semaphore *sem); - extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, - struct file *file, - struct tcon_link *tlink, -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 737cff7bc08a..c6bd820f9409 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -280,6 +280,13 @@ cifs_has_mand_locks(struct cifsInodeInfo *cinode) - return has_locks; - } - -+void -+cifs_down_write(struct rw_semaphore *sem) -+{ -+ while (!down_write_trylock(sem)) -+ msleep(10); -+} -+ - struct cifsFileInfo * - cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, - struct tcon_link *tlink, __u32 oplock) -@@ -305,7 +312,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, - INIT_LIST_HEAD(&fdlocks->locks); - fdlocks->cfile = cfile; - cfile->llist = fdlocks; -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - list_add(&fdlocks->llist, &cinode->llist); - up_write(&cinode->lock_sem); - -@@ -438,7 +445,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file) - * Delete any outstanding lock records. We'll lose them when the file - * is closed anyway. - */ -- down_write(&cifsi->lock_sem); -+ cifs_down_write(&cifsi->lock_sem); - list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { - list_del(&li->llist); - cifs_del_lock_waiters(li); -@@ -947,7 +954,7 @@ static void - cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock) - { - struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - list_add_tail(&lock->llist, &cfile->llist->locks); - up_write(&cinode->lock_sem); - } -@@ -969,7 +976,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock, - - try_again: - exist = false; -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - - exist = cifs_find_lock_conflict(cfile, lock->offset, lock->length, - lock->type, &conf_lock, CIFS_LOCK_OP); -@@ -991,7 +998,7 @@ try_again: - (lock->blist.next == &lock->blist)); - if (!rc) - goto try_again; -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - list_del_init(&lock->blist); - } - -@@ -1044,7 +1051,7 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock) - return rc; - - try_again: -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - if (!cinode->can_cache_brlcks) { - up_write(&cinode->lock_sem); - return rc; -@@ -1242,7 +1249,7 @@ cifs_push_locks(struct cifsFileInfo *cfile) - int rc = 0; - - /* we are going to update can_cache_brlcks here - need a write access */ -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - if (!cinode->can_cache_brlcks) { - up_write(&cinode->lock_sem); - return rc; -@@ -1430,7 +1437,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - if (!buf) - return -ENOMEM; - -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - for (i = 0; i < 2; i++) { - cur = buf; - num = 0; -diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c -index dee5250701de..41f1a5dd33a5 100644 ---- a/fs/cifs/smb2file.c -+++ b/fs/cifs/smb2file.c -@@ -138,7 +138,7 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, - - cur = buf; - -- down_write(&cinode->lock_sem); -+ cifs_down_write(&cinode->lock_sem); - list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) { - if (flock->fl_start > li->offset || - (flock->fl_start + length) < -diff --git a/fs/dcache.c b/fs/dcache.c -index cb554e406545..dae84332534d 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1903,7 +1903,6 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode) - BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); - BUG_ON(!inode); - lockdep_annotate_inode_mutex_key(inode); -- security_d_instantiate(entry, inode); - spin_lock(&inode->i_lock); - __d_instantiate(entry, inode); - WARN_ON(!(inode->i_state & I_NEW)); -@@ -1911,6 +1910,7 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode) - smp_mb(); - wake_up_bit(&inode->i_state, __I_NEW); - spin_unlock(&inode->i_lock); -+ security_d_instantiate(entry, inode); - } - EXPORT_SYMBOL(d_instantiate_new); - -diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h -new file mode 100644 -index 000000000000..78b8e0a61f3f ---- /dev/null -+++ b/include/linux/arm-smccc.h -@@ -0,0 +1,283 @@ -+/* -+ * Copyright (c) 2015, Linaro Limited -+ * -+ * This software is licensed under the terms of the GNU General Public -+ * License version 2, as published by the Free Software Foundation, and -+ * may be copied, distributed, and modified under those terms. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ */ -+#ifndef __LINUX_ARM_SMCCC_H -+#define __LINUX_ARM_SMCCC_H -+ -+#include -+ -+/* -+ * This file provides common defines for ARM SMC Calling Convention as -+ * specified in -+ * http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html -+ */ -+ -+#define ARM_SMCCC_STD_CALL _AC(0,U) -+#define ARM_SMCCC_FAST_CALL _AC(1,U) -+#define ARM_SMCCC_TYPE_SHIFT 31 -+ -+#define ARM_SMCCC_SMC_32 0 -+#define ARM_SMCCC_SMC_64 1 -+#define ARM_SMCCC_CALL_CONV_SHIFT 30 -+ -+#define ARM_SMCCC_OWNER_MASK 0x3F -+#define ARM_SMCCC_OWNER_SHIFT 24 -+ -+#define ARM_SMCCC_FUNC_MASK 0xFFFF -+ -+#define ARM_SMCCC_IS_FAST_CALL(smc_val) \ -+ ((smc_val) & (ARM_SMCCC_FAST_CALL << ARM_SMCCC_TYPE_SHIFT)) -+#define ARM_SMCCC_IS_64(smc_val) \ -+ ((smc_val) & (ARM_SMCCC_SMC_64 << ARM_SMCCC_CALL_CONV_SHIFT)) -+#define ARM_SMCCC_FUNC_NUM(smc_val) ((smc_val) & ARM_SMCCC_FUNC_MASK) -+#define ARM_SMCCC_OWNER_NUM(smc_val) \ -+ (((smc_val) >> ARM_SMCCC_OWNER_SHIFT) & ARM_SMCCC_OWNER_MASK) -+ -+#define ARM_SMCCC_CALL_VAL(type, calling_convention, owner, func_num) \ -+ (((type) << ARM_SMCCC_TYPE_SHIFT) | \ -+ ((calling_convention) << ARM_SMCCC_CALL_CONV_SHIFT) | \ -+ (((owner) & ARM_SMCCC_OWNER_MASK) << ARM_SMCCC_OWNER_SHIFT) | \ -+ ((func_num) & ARM_SMCCC_FUNC_MASK)) -+ -+#define ARM_SMCCC_OWNER_ARCH 0 -+#define ARM_SMCCC_OWNER_CPU 1 -+#define ARM_SMCCC_OWNER_SIP 2 -+#define ARM_SMCCC_OWNER_OEM 3 -+#define ARM_SMCCC_OWNER_STANDARD 4 -+#define ARM_SMCCC_OWNER_TRUSTED_APP 48 -+#define ARM_SMCCC_OWNER_TRUSTED_APP_END 49 -+#define ARM_SMCCC_OWNER_TRUSTED_OS 50 -+#define ARM_SMCCC_OWNER_TRUSTED_OS_END 63 -+ -+#define ARM_SMCCC_VERSION_1_0 0x10000 -+#define ARM_SMCCC_VERSION_1_1 0x10001 -+ -+#define ARM_SMCCC_VERSION_FUNC_ID \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_32, \ -+ 0, 0) -+ -+#define ARM_SMCCC_ARCH_FEATURES_FUNC_ID \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_32, \ -+ 0, 1) -+ -+#define ARM_SMCCC_ARCH_WORKAROUND_1 \ -+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ -+ ARM_SMCCC_SMC_32, \ -+ 0, 0x8000) -+ -+#ifndef __ASSEMBLY__ -+ -+#include -+#include -+ -+/** -+ * struct arm_smccc_res - Result from SMC/HVC call -+ * @a0-a3 result values from registers 0 to 3 -+ */ -+struct arm_smccc_res { -+ unsigned long a0; -+ unsigned long a1; -+ unsigned long a2; -+ unsigned long a3; -+}; -+ -+/** -+ * arm_smccc_smc() - make SMC calls -+ * @a0-a7: arguments passed in registers 0 to 7 -+ * @res: result values from registers 0 to 3 -+ * -+ * This function is used to make SMC calls following SMC Calling Convention. -+ * The content of the supplied param are copied to registers 0 to 7 prior -+ * to the SMC instruction. The return values are updated with the content -+ * from register 0 to 3 on return from the SMC instruction. -+ */ -+asmlinkage void arm_smccc_smc(unsigned long a0, unsigned long a1, -+ unsigned long a2, unsigned long a3, unsigned long a4, -+ unsigned long a5, unsigned long a6, unsigned long a7, -+ struct arm_smccc_res *res); -+ -+/** -+ * arm_smccc_hvc() - make HVC calls -+ * @a0-a7: arguments passed in registers 0 to 7 -+ * @res: result values from registers 0 to 3 -+ * -+ * This function is used to make HVC calls following SMC Calling -+ * Convention. The content of the supplied param are copied to registers 0 -+ * to 7 prior to the HVC instruction. The return values are updated with -+ * the content from register 0 to 3 on return from the HVC instruction. -+ */ -+asmlinkage void arm_smccc_hvc(unsigned long a0, unsigned long a1, -+ unsigned long a2, unsigned long a3, unsigned long a4, -+ unsigned long a5, unsigned long a6, unsigned long a7, -+ struct arm_smccc_res *res); -+ -+/* SMCCC v1.1 implementation madness follows */ -+#ifdef CONFIG_ARM64 -+ -+#define SMCCC_SMC_INST "smc #0" -+#define SMCCC_HVC_INST "hvc #0" -+ -+#elif defined(CONFIG_ARM) -+#include -+#include -+ -+#define SMCCC_SMC_INST __SMC(0) -+#define SMCCC_HVC_INST __HVC(0) -+ -+#endif -+ -+#define ___count_args(_0, _1, _2, _3, _4, _5, _6, _7, _8, x, ...) x -+ -+#define __count_args(...) \ -+ ___count_args(__VA_ARGS__, 7, 6, 5, 4, 3, 2, 1, 0) -+ -+#define __constraint_write_0 \ -+ "+r" (r0), "=&r" (r1), "=&r" (r2), "=&r" (r3) -+#define __constraint_write_1 \ -+ "+r" (r0), "+r" (r1), "=&r" (r2), "=&r" (r3) -+#define __constraint_write_2 \ -+ "+r" (r0), "+r" (r1), "+r" (r2), "=&r" (r3) -+#define __constraint_write_3 \ -+ "+r" (r0), "+r" (r1), "+r" (r2), "+r" (r3) -+#define __constraint_write_4 __constraint_write_3 -+#define __constraint_write_5 __constraint_write_4 -+#define __constraint_write_6 __constraint_write_5 -+#define __constraint_write_7 __constraint_write_6 -+ -+#define __constraint_read_0 -+#define __constraint_read_1 -+#define __constraint_read_2 -+#define __constraint_read_3 -+#define __constraint_read_4 "r" (r4) -+#define __constraint_read_5 __constraint_read_4, "r" (r5) -+#define __constraint_read_6 __constraint_read_5, "r" (r6) -+#define __constraint_read_7 __constraint_read_6, "r" (r7) -+ -+#define __declare_arg_0(a0, res) \ -+ struct arm_smccc_res *___res = res; \ -+ register unsigned long r0 asm("r0") = (u32)a0; \ -+ register unsigned long r1 asm("r1"); \ -+ register unsigned long r2 asm("r2"); \ -+ register unsigned long r3 asm("r3") -+ -+#define __declare_arg_1(a0, a1, res) \ -+ typeof(a1) __a1 = a1; \ -+ struct arm_smccc_res *___res = res; \ -+ register unsigned long r0 asm("r0") = (u32)a0; \ -+ register unsigned long r1 asm("r1") = __a1; \ -+ register unsigned long r2 asm("r2"); \ -+ register unsigned long r3 asm("r3") -+ -+#define __declare_arg_2(a0, a1, a2, res) \ -+ typeof(a1) __a1 = a1; \ -+ typeof(a2) __a2 = a2; \ -+ struct arm_smccc_res *___res = res; \ -+ register unsigned long r0 asm("r0") = (u32)a0; \ -+ register unsigned long r1 asm("r1") = __a1; \ -+ register unsigned long r2 asm("r2") = __a2; \ -+ register unsigned long r3 asm("r3") -+ -+#define __declare_arg_3(a0, a1, a2, a3, res) \ -+ typeof(a1) __a1 = a1; \ -+ typeof(a2) __a2 = a2; \ -+ typeof(a3) __a3 = a3; \ -+ struct arm_smccc_res *___res = res; \ -+ register unsigned long r0 asm("r0") = (u32)a0; \ -+ register unsigned long r1 asm("r1") = __a1; \ -+ register unsigned long r2 asm("r2") = __a2; \ -+ register unsigned long r3 asm("r3") = __a3 -+ -+#define __declare_arg_4(a0, a1, a2, a3, a4, res) \ -+ typeof(a4) __a4 = a4; \ -+ __declare_arg_3(a0, a1, a2, a3, res); \ -+ register unsigned long r4 asm("r4") = __a4 -+ -+#define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \ -+ typeof(a5) __a5 = a5; \ -+ __declare_arg_4(a0, a1, a2, a3, a4, res); \ -+ register unsigned long r5 asm("r5") = __a5 -+ -+#define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \ -+ typeof(a6) __a6 = a6; \ -+ __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \ -+ register unsigned long r6 asm("r6") = __a6 -+ -+#define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \ -+ typeof(a7) __a7 = a7; \ -+ __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \ -+ register unsigned long r7 asm("r7") = __a7 -+ -+#define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) -+#define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) -+ -+#define ___constraints(count) \ -+ : __constraint_write_ ## count \ -+ : __constraint_read_ ## count \ -+ : "memory" -+#define __constraints(count) ___constraints(count) -+ -+/* -+ * We have an output list that is not necessarily used, and GCC feels -+ * entitled to optimise the whole sequence away. "volatile" is what -+ * makes it stick. -+ */ -+#define __arm_smccc_1_1(inst, ...) \ -+ do { \ -+ __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \ -+ asm volatile(inst "\n" \ -+ __constraints(__count_args(__VA_ARGS__))); \ -+ if (___res) \ -+ *___res = (typeof(*___res)){r0, r1, r2, r3}; \ -+ } while (0) -+ -+/* -+ * arm_smccc_1_1_smc() - make an SMCCC v1.1 compliant SMC call -+ * -+ * This is a variadic macro taking one to eight source arguments, and -+ * an optional return structure. -+ * -+ * @a0-a7: arguments passed in registers 0 to 7 -+ * @res: result values from registers 0 to 3 -+ * -+ * This macro is used to make SMC calls following SMC Calling Convention v1.1. -+ * The content of the supplied param are copied to registers 0 to 7 prior -+ * to the SMC instruction. The return values are updated with the content -+ * from register 0 to 3 on return from the SMC instruction if not NULL. -+ */ -+#define arm_smccc_1_1_smc(...) __arm_smccc_1_1(SMCCC_SMC_INST, __VA_ARGS__) -+ -+/* -+ * arm_smccc_1_1_hvc() - make an SMCCC v1.1 compliant HVC call -+ * -+ * This is a variadic macro taking one to eight source arguments, and -+ * an optional return structure. -+ * -+ * @a0-a7: arguments passed in registers 0 to 7 -+ * @res: result values from registers 0 to 3 -+ * -+ * This macro is used to make HVC calls following SMC Calling Convention v1.1. -+ * The content of the supplied param are copied to registers 0 to 7 prior -+ * to the HVC instruction. The return values are updated with the content -+ * from register 0 to 3 on return from the HVC instruction if not NULL. -+ */ -+#define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) -+ -+/* Return codes defined in ARM DEN 0070A */ -+#define SMCCC_RET_SUCCESS 0 -+#define SMCCC_RET_NOT_SUPPORTED -1 -+#define SMCCC_RET_NOT_REQUIRED -2 -+ -+#endif /*__ASSEMBLY__*/ -+#endif /*__LINUX_ARM_SMCCC_H*/ -diff --git a/include/linux/gfp.h b/include/linux/gfp.h -index 8942af0813e3..824bd16ae408 100644 ---- a/include/linux/gfp.h -+++ b/include/linux/gfp.h -@@ -274,6 +274,29 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags) - return (bool __force)(gfp_flags & __GFP_DIRECT_RECLAIM); - } - -+/** -+ * gfpflags_normal_context - is gfp_flags a normal sleepable context? -+ * @gfp_flags: gfp_flags to test -+ * -+ * Test whether @gfp_flags indicates that the allocation is from the -+ * %current context and allowed to sleep. -+ * -+ * An allocation being allowed to block doesn't mean it owns the %current -+ * context. When direct reclaim path tries to allocate memory, the -+ * allocation context is nested inside whatever %current was doing at the -+ * time of the original allocation. The nested allocation may be allowed -+ * to block but modifying anything %current owns can corrupt the outer -+ * context's expectations. -+ * -+ * %true result from this function indicates that the allocation context -+ * can sleep and use anything that's associated with %current. -+ */ -+static inline bool gfpflags_normal_context(const gfp_t gfp_flags) -+{ -+ return (gfp_flags & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC)) == -+ __GFP_DIRECT_RECLAIM; -+} -+ - #ifdef CONFIG_HIGHMEM - #define OPT_ZONE_HIGHMEM ZONE_HIGHMEM - #else -diff --git a/include/linux/psci.h b/include/linux/psci.h -index 12c4865457ad..f78438214a59 100644 ---- a/include/linux/psci.h -+++ b/include/linux/psci.h -@@ -24,6 +24,17 @@ bool psci_tos_resident_on(int cpu); - bool psci_power_state_loses_context(u32 state); - bool psci_power_state_is_valid(u32 state); - -+enum psci_conduit { -+ PSCI_CONDUIT_NONE, -+ PSCI_CONDUIT_SMC, -+ PSCI_CONDUIT_HVC, -+}; -+ -+enum smccc_version { -+ SMCCC_VERSION_1_0, -+ SMCCC_VERSION_1_1, -+}; -+ - struct psci_operations { - int (*cpu_suspend)(u32 state, unsigned long entry_point); - int (*cpu_off)(u32 state); -@@ -32,6 +43,8 @@ struct psci_operations { - int (*affinity_info)(unsigned long target_affinity, - unsigned long lowest_affinity_level); - int (*migrate_info_type)(void); -+ enum psci_conduit conduit; -+ enum smccc_version smccc_version; - }; - - extern struct psci_operations psci_ops; -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index a2f12d377d23..735ff1525f48 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -1073,7 +1073,8 @@ static inline __u32 skb_get_hash_flowi4(struct sk_buff *skb, const struct flowi4 - return skb->hash; - } - --__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb); -+__u32 skb_get_hash_perturb(const struct sk_buff *skb, -+ const siphash_key_t *perturb); - - static inline __u32 skb_get_hash_raw(const struct sk_buff *skb) - { -diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h -index 8c8548cf5888..62a462413081 100644 ---- a/include/net/flow_dissector.h -+++ b/include/net/flow_dissector.h -@@ -3,6 +3,7 @@ - - #include - #include -+#include - #include - - /** -@@ -146,7 +147,7 @@ struct flow_dissector { - struct flow_keys { - struct flow_dissector_key_control control; - #define FLOW_KEYS_HASH_START_FIELD basic -- struct flow_dissector_key_basic basic; -+ struct flow_dissector_key_basic basic __aligned(SIPHASH_ALIGNMENT); - struct flow_dissector_key_tags tags; - struct flow_dissector_key_keyid keyid; - struct flow_dissector_key_ports ports; -diff --git a/include/net/sock.h b/include/net/sock.h -index 0aadd3b03ced..1571ab68de16 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -2077,12 +2077,17 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp, - * sk_page_frag - return an appropriate page_frag - * @sk: socket - * -- * If socket allocation mode allows current thread to sleep, it means its -- * safe to use the per task page_frag instead of the per socket one. -+ * Use the per task page_frag instead of the per socket one for -+ * optimization when we know that we're in the normal context and owns -+ * everything that's associated with %current. -+ * -+ * gfpflags_allow_blocking() isn't enough here as direct reclaim may nest -+ * inside other socket operations and end up recursing into sk_page_frag() -+ * while it's already in use. - */ - static inline struct page_frag *sk_page_frag(struct sock *sk) - { -- if (gfpflags_allow_blocking(sk->sk_allocation)) -+ if (gfpflags_normal_context(sk->sk_allocation)) - return ¤t->task_frag; - - return &sk->sk_frag; -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index 70aef327b6e8..015d432bcb08 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -573,7 +573,7 @@ static void alarm_timer_get(struct k_itimer *timr, - static int alarm_timer_del(struct k_itimer *timr) - { - if (!rtcdev) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - if (alarm_try_to_cancel(&timr->it.alarm.alarmtimer) < 0) - return TIMER_RETRY; -@@ -597,7 +597,7 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, - ktime_t exp; - - if (!rtcdev) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - if (flags & ~TIMER_ABSTIME) - return -EINVAL; -diff --git a/net/core/datagram.c b/net/core/datagram.c -index d62af69ad844..ba8af8b55f1f 100644 ---- a/net/core/datagram.c -+++ b/net/core/datagram.c -@@ -96,7 +96,7 @@ static int wait_for_more_packets(struct sock *sk, int *err, long *timeo_p, - if (error) - goto out_err; - -- if (sk->sk_receive_queue.prev != skb) -+ if (READ_ONCE(sk->sk_receive_queue.prev) != skb) - goto out; - - /* Socket shut down? */ -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index 66428c0eb663..7e4e7deb2542 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -941,11 +941,13 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr) - - static int ethtool_get_wol(struct net_device *dev, char __user *useraddr) - { -- struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL }; -+ struct ethtool_wolinfo wol; - - if (!dev->ethtool_ops->get_wol) - return -EOPNOTSUPP; - -+ memset(&wol, 0, sizeof(struct ethtool_wolinfo)); -+ wol.cmd = ETHTOOL_GWOL; - dev->ethtool_ops->get_wol(dev, &wol); - - if (copy_to_user(useraddr, &wol, sizeof(wol))) -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 697c4212129a..496bfcb787e7 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -505,45 +505,34 @@ out_bad: - } - EXPORT_SYMBOL(__skb_flow_dissect); - --static u32 hashrnd __read_mostly; -+static siphash_key_t hashrnd __read_mostly; - static __always_inline void __flow_hash_secret_init(void) - { - net_get_random_once(&hashrnd, sizeof(hashrnd)); - } - --static __always_inline u32 __flow_hash_words(const u32 *words, u32 length, -- u32 keyval) -+static const void *flow_keys_hash_start(const struct flow_keys *flow) - { -- return jhash2(words, length, keyval); --} -- --static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow) --{ -- const void *p = flow; -- -- BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32)); -- return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET); -+ BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT); -+ return &flow->FLOW_KEYS_HASH_START_FIELD; - } - - static inline size_t flow_keys_hash_length(const struct flow_keys *flow) - { -- size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs); -- BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32)); -- BUILD_BUG_ON(offsetof(typeof(*flow), addrs) != -- sizeof(*flow) - sizeof(flow->addrs)); -+ size_t len = offsetof(typeof(*flow), addrs) - FLOW_KEYS_HASH_OFFSET; - - switch (flow->control.addr_type) { - case FLOW_DISSECTOR_KEY_IPV4_ADDRS: -- diff -= sizeof(flow->addrs.v4addrs); -+ len += sizeof(flow->addrs.v4addrs); - break; - case FLOW_DISSECTOR_KEY_IPV6_ADDRS: -- diff -= sizeof(flow->addrs.v6addrs); -+ len += sizeof(flow->addrs.v6addrs); - break; - case FLOW_DISSECTOR_KEY_TIPC_ADDRS: -- diff -= sizeof(flow->addrs.tipcaddrs); -+ len += sizeof(flow->addrs.tipcaddrs); - break; - } -- return (sizeof(*flow) - diff) / sizeof(u32); -+ return len; - } - - __be32 flow_get_u32_src(const struct flow_keys *flow) -@@ -609,14 +598,15 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys) - } - } - --static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval) -+static inline u32 __flow_hash_from_keys(struct flow_keys *keys, -+ const siphash_key_t *keyval) - { - u32 hash; - - __flow_hash_consistentify(keys); - -- hash = __flow_hash_words(flow_keys_hash_start(keys), -- flow_keys_hash_length(keys), keyval); -+ hash = siphash(flow_keys_hash_start(keys), -+ flow_keys_hash_length(keys), keyval); - if (!hash) - hash = 1; - -@@ -626,12 +616,13 @@ static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval) - u32 flow_hash_from_keys(struct flow_keys *keys) - { - __flow_hash_secret_init(); -- return __flow_hash_from_keys(keys, hashrnd); -+ return __flow_hash_from_keys(keys, &hashrnd); - } - EXPORT_SYMBOL(flow_hash_from_keys); - - static inline u32 ___skb_get_hash(const struct sk_buff *skb, -- struct flow_keys *keys, u32 keyval) -+ struct flow_keys *keys, -+ const siphash_key_t *keyval) - { - skb_flow_dissect_flow_keys(skb, keys, - FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL); -@@ -679,7 +670,7 @@ u32 __skb_get_hash_symmetric(struct sk_buff *skb) - NULL, 0, 0, 0, - FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL); - -- return __flow_hash_from_keys(&keys, hashrnd); -+ return __flow_hash_from_keys(&keys, &hashrnd); - } - EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric); - -@@ -698,12 +689,13 @@ void __skb_get_hash(struct sk_buff *skb) - - __flow_hash_secret_init(); - -- __skb_set_sw_hash(skb, ___skb_get_hash(skb, &keys, hashrnd), -+ __skb_set_sw_hash(skb, ___skb_get_hash(skb, &keys, &hashrnd), - flow_keys_have_l4(&keys)); - } - EXPORT_SYMBOL(__skb_get_hash); - --__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb) -+__u32 skb_get_hash_perturb(const struct sk_buff *skb, -+ const siphash_key_t *perturb) - { - struct flow_keys keys; - -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index b0a577a79a6a..ef4c44d46293 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -121,7 +121,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - inet->inet_daddr, - inet->inet_sport, - inet->inet_dport); -- inet->inet_id = dp->dccps_iss ^ jiffies; -+ inet->inet_id = prandom_u32(); - - err = dccp_connect(sk); - rt = NULL; -@@ -417,7 +417,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk, - RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt)); - newinet->mc_index = inet_iif(skb); - newinet->mc_ttl = ip_hdr(skb)->ttl; -- newinet->inet_id = jiffies; -+ newinet->inet_id = prandom_u32(); - - if (dst == NULL && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL) - goto put_and_exit; -diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c -index f915abff1350..d3eddfd13875 100644 ---- a/net/ipv4/datagram.c -+++ b/net/ipv4/datagram.c -@@ -75,7 +75,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len - inet->inet_dport = usin->sin_port; - sk->sk_state = TCP_ESTABLISHED; - sk_set_txhash(sk); -- inet->inet_id = jiffies; -+ inet->inet_id = prandom_u32(); - - sk_dst_set(sk, &rt->dst); - err = 0; -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 744afb4fbf84..12d4d2758caf 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -241,7 +241,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) - inet->inet_sport, - usin->sin_port); - -- inet->inet_id = tp->write_seq ^ jiffies; -+ inet->inet_id = prandom_u32(); - - err = tcp_connect(sk); - -@@ -1302,7 +1302,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - inet_csk(newsk)->icsk_ext_hdr_len = 0; - if (inet_opt) - inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen; -- newinet->inet_id = newtp->write_seq ^ jiffies; -+ newinet->inet_id = prandom_u32(); - - if (!dst) { - dst = inet_csk_route_child_sock(sk, newsk, req); -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index d3fc8f9dd3d4..1800f7977595 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -55,7 +55,7 @@ struct fq_codel_sched_data { - struct fq_codel_flow *flows; /* Flows table [flows_cnt] */ - u32 *backlogs; /* backlog table [flows_cnt] */ - u32 flows_cnt; /* number of flows */ -- u32 perturbation; /* hash perturbation */ -+ siphash_key_t perturbation; /* hash perturbation */ - u32 quantum; /* psched_mtu(qdisc_dev(sch)); */ - struct codel_params cparams; - struct codel_stats cstats; -@@ -69,7 +69,7 @@ struct fq_codel_sched_data { - static unsigned int fq_codel_hash(const struct fq_codel_sched_data *q, - struct sk_buff *skb) - { -- u32 hash = skb_get_hash_perturb(skb, q->perturbation); -+ u32 hash = skb_get_hash_perturb(skb, &q->perturbation); - - return reciprocal_scale(hash, q->flows_cnt); - } -@@ -420,7 +420,7 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt) - sch->limit = 10*1024; - q->flows_cnt = 1024; - q->quantum = psched_mtu(qdisc_dev(sch)); -- q->perturbation = prandom_u32(); -+ get_random_bytes(&q->perturbation, sizeof(q->perturbation)); - INIT_LIST_HEAD(&q->new_flows); - INIT_LIST_HEAD(&q->old_flows); - codel_params_init(&q->cparams, sch); -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index dc68dccc6b0c..40ec5b280eb6 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -4,11 +4,11 @@ - * Copyright (C) 2013 Nandita Dukkipati - */ - --#include - #include - #include - #include - #include -+#include - #include - #include - -@@ -125,7 +125,7 @@ struct wdrr_bucket { - - struct hhf_sched_data { - struct wdrr_bucket buckets[WDRR_BUCKET_CNT]; -- u32 perturbation; /* hash perturbation */ -+ siphash_key_t perturbation; /* hash perturbation */ - u32 quantum; /* psched_mtu(qdisc_dev(sch)); */ - u32 drop_overlimit; /* number of times max qdisc packet - * limit was hit -@@ -263,7 +263,7 @@ static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch) - } - - /* Get hashed flow-id of the skb. */ -- hash = skb_get_hash_perturb(skb, q->perturbation); -+ hash = skb_get_hash_perturb(skb, &q->perturbation); - - /* Check if this packet belongs to an already established HH flow. */ - flow_pos = hash & HHF_BIT_MASK; -@@ -602,7 +602,7 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt) - - sch->limit = 1000; - q->quantum = psched_mtu(qdisc_dev(sch)); -- q->perturbation = prandom_u32(); -+ get_random_bytes(&q->perturbation, sizeof(q->perturbation)); - INIT_LIST_HEAD(&q->new_buckets); - INIT_LIST_HEAD(&q->old_buckets); - -diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c -index c69611640fa5..10c0b184cdbe 100644 ---- a/net/sched/sch_sfb.c -+++ b/net/sched/sch_sfb.c -@@ -22,7 +22,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -48,7 +48,7 @@ struct sfb_bucket { - * (Section 4.4 of SFB reference : moving hash functions) - */ - struct sfb_bins { -- u32 perturbation; /* jhash perturbation */ -+ siphash_key_t perturbation; /* siphash key */ - struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS]; - }; - -@@ -219,7 +219,8 @@ static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_da - - static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q) - { -- q->bins[slot].perturbation = prandom_u32(); -+ get_random_bytes(&q->bins[slot].perturbation, -+ sizeof(q->bins[slot].perturbation)); - } - - static void sfb_swap_slot(struct sfb_sched_data *q) -@@ -313,9 +314,9 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch) - /* If using external classifiers, get result and record it. */ - if (!sfb_classify(skb, fl, &ret, &salt)) - goto other_drop; -- sfbhash = jhash_1word(salt, q->bins[slot].perturbation); -+ sfbhash = siphash_1u32(salt, &q->bins[slot].perturbation); - } else { -- sfbhash = skb_get_hash_perturb(skb, q->bins[slot].perturbation); -+ sfbhash = skb_get_hash_perturb(skb, &q->bins[slot].perturbation); - } - - -@@ -351,7 +352,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch) - /* Inelastic flow */ - if (q->double_buffering) { - sfbhash = skb_get_hash_perturb(skb, -- q->bins[slot].perturbation); -+ &q->bins[slot].perturbation); - if (!sfbhash) - sfbhash = 1; - sfb_skb_cb(skb)->hashes[slot] = sfbhash; -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 8b8c084b32cd..e2e4ebc0c4c3 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -18,7 +18,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -120,7 +120,7 @@ struct sfq_sched_data { - u8 headdrop; - u8 maxdepth; /* limit of packets per flow */ - -- u32 perturbation; -+ siphash_key_t perturbation; - u8 cur_depth; /* depth of longest slot */ - u8 flags; - unsigned short scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */ -@@ -158,7 +158,7 @@ static inline struct sfq_head *sfq_dep_head(struct sfq_sched_data *q, sfq_index - static unsigned int sfq_hash(const struct sfq_sched_data *q, - const struct sk_buff *skb) - { -- return skb_get_hash_perturb(skb, q->perturbation) & (q->divisor - 1); -+ return skb_get_hash_perturb(skb, &q->perturbation) & (q->divisor - 1); - } - - static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch, -@@ -607,9 +607,11 @@ static void sfq_perturbation(unsigned long arg) - struct Qdisc *sch = (struct Qdisc *)arg; - struct sfq_sched_data *q = qdisc_priv(sch); - spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch)); -+ siphash_key_t nkey; - -+ get_random_bytes(&nkey, sizeof(nkey)); - spin_lock(root_lock); -- q->perturbation = prandom_u32(); -+ q->perturbation = nkey; - if (!q->filter_list && q->tail) - sfq_rehash(sch); - spin_unlock(root_lock); -@@ -681,7 +683,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) - del_timer(&q->perturb_timer); - if (q->perturb_period) { - mod_timer(&q->perturb_timer, jiffies + q->perturb_period); -- q->perturbation = prandom_u32(); -+ get_random_bytes(&q->perturbation, sizeof(q->perturbation)); - } - sch_tree_unlock(sch); - kfree(p); -@@ -737,7 +739,7 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) - q->quantum = psched_mtu(qdisc_dev(sch)); - q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum); - q->perturb_period = 0; -- q->perturbation = prandom_u32(); -+ get_random_bytes(&q->perturbation, sizeof(q->perturbation)); - - if (opt) { - int err = sfq_change(sch, opt); -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 7add261dd626..2b6c88b9a038 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -7267,7 +7267,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, - newinet->inet_rcv_saddr = inet->inet_rcv_saddr; - newinet->inet_dport = htons(asoc->peer.port); - newinet->pmtudisc = inet->pmtudisc; -- newinet->inet_id = asoc->next_tsn ^ jiffies; -+ newinet->inet_id = prandom_u32(); - - newinet->uc_ttl = inet->uc_ttl; - newinet->mc_loop = 1; -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index 58ee64594f07..f583f317644a 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -530,7 +530,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev) - ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0); - if (ret) { - dev_err(&pdev->dev, "Could not register PCM\n"); -- return ret; -+ goto err_suspend; - } - - return 0; -diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c -index 93ce665f976f..b62f2f139edf 100644 ---- a/tools/perf/builtin-kmem.c -+++ b/tools/perf/builtin-kmem.c -@@ -664,6 +664,7 @@ static char *compact_gfp_flags(char *gfp_flags) - new = realloc(new_flags, len + strlen(cpt) + 2); - if (new == NULL) { - free(new_flags); -+ free(orig_flags); - return NULL; - } - diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.200-201.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.200-201.patch deleted file mode 100644 index 806769510c23..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.200-201.patch +++ /dev/null @@ -1,2818 +0,0 @@ -From edf95db1d177e4e44eede134d80debd80dad506a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= -Date: Sat, 23 Nov 2019 14:01:40 +0100 -Subject: [PATCH] PATCH: kernel 4.4.200-201 - ---- - Makefile | 2 +- - arch/x86/kernel/cpu/perf_event_amd_ibs.c | 2 +- - drivers/gpu/drm/i915/i915_cmd_parser.c | 418 ++++++++++++------ - drivers/gpu/drm/i915/i915_dma.c | 4 +- - drivers/gpu/drm/i915/i915_drv.c | 4 + - drivers/gpu/drm/i915/i915_drv.h | 31 +- - drivers/gpu/drm/i915/i915_gem_context.c | 5 + - drivers/gpu/drm/i915/i915_gem_execbuffer.c | 118 +++-- - drivers/gpu/drm/i915/i915_gem_gtt.c | 53 ++- - drivers/gpu/drm/i915/i915_gem_gtt.h | 3 + - drivers/gpu/drm/i915/i915_reg.h | 11 + - drivers/gpu/drm/i915/intel_display.c | 9 + - drivers/gpu/drm/i915/intel_drv.h | 3 + - drivers/gpu/drm/i915/intel_pm.c | 173 +++++++- - drivers/gpu/drm/i915/intel_ringbuffer.c | 10 +- - drivers/gpu/drm/i915/intel_ringbuffer.h | 3 +- - drivers/gpu/drm/radeon/si_dpm.c | 1 + - drivers/iio/imu/adis16480.c | 5 +- - drivers/net/bonding/bond_main.c | 6 +- - drivers/net/can/c_can/c_can.c | 25 +- - drivers/net/can/c_can/c_can.h | 1 + - drivers/net/can/flexcan.c | 1 + - drivers/net/can/usb/gs_usb.c | 1 + - drivers/net/can/usb/peak_usb/pcan_usb.c | 17 +- - drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +- - drivers/net/can/usb/usb_8dev.c | 3 +- - drivers/net/ethernet/hisilicon/hip04_eth.c | 1 - - .../net/ethernet/intel/e1000/e1000_ethtool.c | 7 +- - drivers/net/ethernet/intel/igb/igb_main.c | 3 +- - drivers/net/ethernet/qlogic/qede/qede_main.c | 12 +- - drivers/net/usb/cdc_ncm.c | 6 +- - drivers/nfc/fdp/i2c.c | 2 +- - drivers/nfc/st21nfca/core.c | 1 + - drivers/pci/host/pci-tegra.c | 7 +- - drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +- - drivers/scsi/qla2xxx/qla_bsg.c | 6 +- - drivers/scsi/qla2xxx/qla_os.c | 4 + - drivers/usb/core/config.c | 5 + - drivers/usb/gadget/composite.c | 2 + - drivers/usb/gadget/configfs.c | 112 ++++- - drivers/usb/gadget/udc/atmel_usba_udc.c | 6 +- - drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- - drivers/usb/usbip/vhci_hcd.c | 1 + - fs/ceph/caps.c | 10 +- - fs/configfs/symlink.c | 33 +- - fs/fs-writeback.c | 9 +- - fs/nfs/delegation.c | 10 + - fs/nfs/delegation.h | 1 + - fs/nfs/nfs4proc.c | 7 +- - include/net/ip_vs.h | 1 + - include/net/neighbour.h | 4 +- - include/net/netfilter/nf_tables.h | 3 +- - include/net/sock.h | 4 +- - lib/dump_stack.c | 7 +- - mm/filemap.c | 3 +- - mm/vmstat.c | 2 +- - net/netfilter/ipset/ip_set_core.c | 8 +- - net/netfilter/ipvs/ip_vs_ctl.c | 15 +- - net/nfc/netlink.c | 2 - - sound/firewire/bebob/bebob_focusrite.c | 3 + - sound/pci/hda/patch_ca0132.c | 2 +- - tools/perf/util/hist.c | 2 +- - 62 files changed, 928 insertions(+), 290 deletions(-) - -diff --git a/Makefile b/Makefile -index 4ec657792181..0a360d57afd5 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 200 -+SUBLEVEL = 201 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c -index 989d3c215d2b..66ca6ec09bd4 100644 ---- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c -+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c -@@ -555,7 +555,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) - if (event->attr.sample_type & PERF_SAMPLE_RAW) - offset_max = perf_ibs->offset_max; - else if (check_rip) -- offset_max = 2; -+ offset_max = 3; - else - offset_max = 1; - do { -diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c -index db58c8d664c2..6188b70c2790 100644 ---- a/drivers/gpu/drm/i915/i915_cmd_parser.c -+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c -@@ -50,13 +50,11 @@ - * granting userspace undue privileges. There are three categories of privilege. - * - * First, commands which are explicitly defined as privileged or which should -- * only be used by the kernel driver. The parser generally rejects such -- * commands, though it may allow some from the drm master process. -+ * only be used by the kernel driver. The parser rejects such commands - * - * Second, commands which access registers. To support correct/enhanced - * userspace functionality, particularly certain OpenGL extensions, the parser -- * provides a whitelist of registers which userspace may safely access (for both -- * normal and drm master processes). -+ * provides a whitelist of registers which userspace may safely access - * - * Third, commands which access privileged memory (i.e. GGTT, HWS page, etc). - * The parser always rejects such commands. -@@ -81,9 +79,9 @@ - * in the per-ring command tables. - * - * Other command table entries map fairly directly to high level categories -- * mentioned above: rejected, master-only, register whitelist. The parser -- * implements a number of checks, including the privileged memory checks, via a -- * general bitmasking mechanism. -+ * mentioned above: rejected, register whitelist. The parser implements a number -+ * of checks, including the privileged memory checks, via a general bitmasking -+ * mechanism. - */ - - #define STD_MI_OPCODE_MASK 0xFF800000 -@@ -94,7 +92,7 @@ - #define CMD(op, opm, f, lm, fl, ...) \ - { \ - .flags = (fl) | ((f) ? CMD_DESC_FIXED : 0), \ -- .cmd = { (op), (opm) }, \ -+ .cmd = { (op) & (opm), (opm) }, \ - .length = { (lm) }, \ - __VA_ARGS__ \ - } -@@ -109,14 +107,13 @@ - #define R CMD_DESC_REJECT - #define W CMD_DESC_REGISTER - #define B CMD_DESC_BITMASK --#define M CMD_DESC_MASTER - - /* Command Mask Fixed Len Action - ---------------------------------------------------------- */ --static const struct drm_i915_cmd_descriptor common_cmds[] = { -+static const struct drm_i915_cmd_descriptor gen7_common_cmds[] = { - CMD( MI_NOOP, SMI, F, 1, S ), - CMD( MI_USER_INTERRUPT, SMI, F, 1, R ), -- CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, M ), -+ CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, R ), - CMD( MI_ARB_CHECK, SMI, F, 1, S ), - CMD( MI_REPORT_HEAD, SMI, F, 1, S ), - CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ), -@@ -146,7 +143,7 @@ static const struct drm_i915_cmd_descriptor common_cmds[] = { - CMD( MI_BATCH_BUFFER_START, SMI, !F, 0xFF, S ), - }; - --static const struct drm_i915_cmd_descriptor render_cmds[] = { -+static const struct drm_i915_cmd_descriptor gen7_render_cmds[] = { - CMD( MI_FLUSH, SMI, F, 1, S ), - CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), - CMD( MI_PREDICATE, SMI, F, 1, S ), -@@ -213,7 +210,7 @@ static const struct drm_i915_cmd_descriptor hsw_render_cmds[] = { - CMD( MI_URB_ATOMIC_ALLOC, SMI, F, 1, S ), - CMD( MI_SET_APPID, SMI, F, 1, S ), - CMD( MI_RS_CONTEXT, SMI, F, 1, S ), -- CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ), -+ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ), - CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ), - CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, R ), - CMD( MI_RS_STORE_DATA_IMM, SMI, !F, 0xFF, S ), -@@ -229,7 +226,7 @@ static const struct drm_i915_cmd_descriptor hsw_render_cmds[] = { - CMD( GFX_OP_3DSTATE_BINDING_TABLE_EDIT_PS, S3D, !F, 0x1FF, S ), - }; - --static const struct drm_i915_cmd_descriptor video_cmds[] = { -+static const struct drm_i915_cmd_descriptor gen7_video_cmds[] = { - CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), - CMD( MI_SET_APPID, SMI, F, 1, S ), - CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B, -@@ -273,7 +270,7 @@ static const struct drm_i915_cmd_descriptor video_cmds[] = { - CMD( MFX_WAIT, SMFX, F, 1, S ), - }; - --static const struct drm_i915_cmd_descriptor vecs_cmds[] = { -+static const struct drm_i915_cmd_descriptor gen7_vecs_cmds[] = { - CMD( MI_ARB_ON_OFF, SMI, F, 1, R ), - CMD( MI_SET_APPID, SMI, F, 1, S ), - CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B, -@@ -311,7 +308,7 @@ static const struct drm_i915_cmd_descriptor vecs_cmds[] = { - }}, ), - }; - --static const struct drm_i915_cmd_descriptor blt_cmds[] = { -+static const struct drm_i915_cmd_descriptor gen7_blt_cmds[] = { - CMD( MI_DISPLAY_FLIP, SMI, !F, 0xFF, R ), - CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, B, - .bits = {{ -@@ -345,10 +342,62 @@ static const struct drm_i915_cmd_descriptor blt_cmds[] = { - }; - - static const struct drm_i915_cmd_descriptor hsw_blt_cmds[] = { -- CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ), -+ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ), - CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ), - }; - -+/* -+ * For Gen9 we can still rely on the h/w to enforce cmd security, and only -+ * need to re-enforce the register access checks. We therefore only need to -+ * teach the cmdparser how to find the end of each command, and identify -+ * register accesses. The table doesn't need to reject any commands, and so -+ * the only commands listed here are: -+ * 1) Those that touch registers -+ * 2) Those that do not have the default 8-bit length -+ * -+ * Note that the default MI length mask chosen for this table is 0xFF, not -+ * the 0x3F used on older devices. This is because the vast majority of MI -+ * cmds on Gen9 use a standard 8-bit Length field. -+ * All the Gen9 blitter instructions are standard 0xFF length mask, and -+ * none allow access to non-general registers, so in fact no BLT cmds are -+ * included in the table at all. -+ * -+ */ -+static const struct drm_i915_cmd_descriptor gen9_blt_cmds[] = { -+ CMD( MI_NOOP, SMI, F, 1, S ), -+ CMD( MI_USER_INTERRUPT, SMI, F, 1, S ), -+ CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, S ), -+ CMD( MI_FLUSH, SMI, F, 1, S ), -+ CMD( MI_ARB_CHECK, SMI, F, 1, S ), -+ CMD( MI_REPORT_HEAD, SMI, F, 1, S ), -+ CMD( MI_ARB_ON_OFF, SMI, F, 1, S ), -+ CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ), -+ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, S ), -+ CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, S ), -+ CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, S ), -+ CMD( MI_LOAD_REGISTER_IMM(1), SMI, !F, 0xFF, W, -+ .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 2 } ), -+ CMD( MI_UPDATE_GTT, SMI, !F, 0x3FF, S ), -+ CMD( MI_STORE_REGISTER_MEM_GEN8, SMI, F, 4, W, -+ .reg = { .offset = 1, .mask = 0x007FFFFC } ), -+ CMD( MI_FLUSH_DW, SMI, !F, 0x3F, S ), -+ CMD( MI_LOAD_REGISTER_MEM_GEN8, SMI, F, 4, W, -+ .reg = { .offset = 1, .mask = 0x007FFFFC } ), -+ CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, W, -+ .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 1 } ), -+ -+ /* -+ * We allow BB_START but apply further checks. We just sanitize the -+ * basic fields here. -+ */ -+ CMD( MI_BATCH_BUFFER_START_GEN8, SMI, !F, 0xFF, B, -+ .bits = {{ -+ .offset = 0, -+ .mask = ~SMI, -+ .expected = (MI_BATCH_PPGTT_HSW | 1), -+ }}, ), -+}; -+ - #undef CMD - #undef SMI - #undef S3D -@@ -359,40 +408,44 @@ static const struct drm_i915_cmd_descriptor hsw_blt_cmds[] = { - #undef R - #undef W - #undef B --#undef M - --static const struct drm_i915_cmd_table gen7_render_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { render_cmds, ARRAY_SIZE(render_cmds) }, -+static const struct drm_i915_cmd_table gen7_render_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) }, - }; - --static const struct drm_i915_cmd_table hsw_render_ring_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { render_cmds, ARRAY_SIZE(render_cmds) }, -+static const struct drm_i915_cmd_table hsw_render_ring_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) }, - { hsw_render_cmds, ARRAY_SIZE(hsw_render_cmds) }, - }; - --static const struct drm_i915_cmd_table gen7_video_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { video_cmds, ARRAY_SIZE(video_cmds) }, -+static const struct drm_i915_cmd_table gen7_video_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_video_cmds, ARRAY_SIZE(gen7_video_cmds) }, - }; - --static const struct drm_i915_cmd_table hsw_vebox_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { vecs_cmds, ARRAY_SIZE(vecs_cmds) }, -+static const struct drm_i915_cmd_table hsw_vebox_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_vecs_cmds, ARRAY_SIZE(gen7_vecs_cmds) }, - }; - --static const struct drm_i915_cmd_table gen7_blt_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { blt_cmds, ARRAY_SIZE(blt_cmds) }, -+static const struct drm_i915_cmd_table gen7_blt_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) }, - }; - --static const struct drm_i915_cmd_table hsw_blt_ring_cmds[] = { -- { common_cmds, ARRAY_SIZE(common_cmds) }, -- { blt_cmds, ARRAY_SIZE(blt_cmds) }, -+static const struct drm_i915_cmd_table hsw_blt_ring_cmd_table[] = { -+ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) }, -+ { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) }, - { hsw_blt_cmds, ARRAY_SIZE(hsw_blt_cmds) }, - }; - -+static const struct drm_i915_cmd_table gen9_blt_cmd_table[] = { -+ { gen9_blt_cmds, ARRAY_SIZE(gen9_blt_cmds) }, -+}; -+ -+ - /* - * Register whitelists, sorted by increasing register offset. - */ -@@ -426,6 +479,10 @@ struct drm_i915_reg_descriptor { - #define REG64(addr) \ - REG32(addr), REG32(addr + sizeof(u32)) - -+#define REG64_IDX(_reg, idx) \ -+ { .addr = _reg(idx) }, \ -+ { .addr = _reg ## _UDW(idx) } -+ - static const struct drm_i915_reg_descriptor gen7_render_regs[] = { - REG64(GPGPU_THREADS_DISPATCHED), - REG64(HS_INVOCATION_COUNT), -@@ -479,17 +536,27 @@ static const struct drm_i915_reg_descriptor gen7_blt_regs[] = { - REG32(BCS_SWCTRL), - }; - --static const struct drm_i915_reg_descriptor ivb_master_regs[] = { -- REG32(FORCEWAKE_MT), -- REG32(DERRMR), -- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_A)), -- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_B)), -- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_C)), --}; -- --static const struct drm_i915_reg_descriptor hsw_master_regs[] = { -- REG32(FORCEWAKE_MT), -- REG32(DERRMR), -+static const struct drm_i915_reg_descriptor gen9_blt_regs[] = { -+ REG64_IDX(RING_TIMESTAMP, RENDER_RING_BASE), -+ REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE), -+ REG32(BCS_SWCTRL), -+ REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE), -+ REG64_IDX(BCS_GPR, 0), -+ REG64_IDX(BCS_GPR, 1), -+ REG64_IDX(BCS_GPR, 2), -+ REG64_IDX(BCS_GPR, 3), -+ REG64_IDX(BCS_GPR, 4), -+ REG64_IDX(BCS_GPR, 5), -+ REG64_IDX(BCS_GPR, 6), -+ REG64_IDX(BCS_GPR, 7), -+ REG64_IDX(BCS_GPR, 8), -+ REG64_IDX(BCS_GPR, 9), -+ REG64_IDX(BCS_GPR, 10), -+ REG64_IDX(BCS_GPR, 11), -+ REG64_IDX(BCS_GPR, 12), -+ REG64_IDX(BCS_GPR, 13), -+ REG64_IDX(BCS_GPR, 14), -+ REG64_IDX(BCS_GPR, 15), - }; - - #undef REG64 -@@ -550,6 +617,17 @@ static u32 gen7_blt_get_cmd_length_mask(u32 cmd_header) - return 0; - } - -+static u32 gen9_blt_get_cmd_length_mask(u32 cmd_header) -+{ -+ u32 client = (cmd_header & INSTR_CLIENT_MASK) >> INSTR_CLIENT_SHIFT; -+ -+ if (client == INSTR_MI_CLIENT || client == INSTR_BC_CLIENT) -+ return 0xFF; -+ -+ DRM_DEBUG_DRIVER("CMD: Abnormal blt cmd length! 0x%08X\n", cmd_header); -+ return 0; -+} -+ - static bool validate_cmds_sorted(struct intel_engine_cs *ring, - const struct drm_i915_cmd_table *cmd_tables, - int cmd_table_count) -@@ -608,9 +686,7 @@ static bool check_sorted(int ring_id, - - static bool validate_regs_sorted(struct intel_engine_cs *ring) - { -- return check_sorted(ring->id, ring->reg_table, ring->reg_count) && -- check_sorted(ring->id, ring->master_reg_table, -- ring->master_reg_count); -+ return check_sorted(ring->id, ring->reg_table, ring->reg_count); - } - - struct cmd_node { -@@ -691,63 +767,61 @@ int i915_cmd_parser_init_ring(struct intel_engine_cs *ring) - int cmd_table_count; - int ret; - -- if (!IS_GEN7(ring->dev)) -+ if (!IS_GEN7(ring->dev) && !(IS_GEN9(ring->dev) && ring->id == BCS)) - return 0; - - switch (ring->id) { - case RCS: - if (IS_HASWELL(ring->dev)) { -- cmd_tables = hsw_render_ring_cmds; -+ cmd_tables = hsw_render_ring_cmd_table; - cmd_table_count = -- ARRAY_SIZE(hsw_render_ring_cmds); -+ ARRAY_SIZE(hsw_render_ring_cmd_table); - } else { -- cmd_tables = gen7_render_cmds; -- cmd_table_count = ARRAY_SIZE(gen7_render_cmds); -+ cmd_tables = gen7_render_cmd_table; -+ cmd_table_count = ARRAY_SIZE(gen7_render_cmd_table); - } - - ring->reg_table = gen7_render_regs; - ring->reg_count = ARRAY_SIZE(gen7_render_regs); - -- if (IS_HASWELL(ring->dev)) { -- ring->master_reg_table = hsw_master_regs; -- ring->master_reg_count = ARRAY_SIZE(hsw_master_regs); -- } else { -- ring->master_reg_table = ivb_master_regs; -- ring->master_reg_count = ARRAY_SIZE(ivb_master_regs); -- } -- - ring->get_cmd_length_mask = gen7_render_get_cmd_length_mask; - break; - case VCS: -- cmd_tables = gen7_video_cmds; -- cmd_table_count = ARRAY_SIZE(gen7_video_cmds); -+ cmd_tables = gen7_video_cmd_table; -+ cmd_table_count = ARRAY_SIZE(gen7_video_cmd_table); - ring->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask; - break; - case BCS: -- if (IS_HASWELL(ring->dev)) { -- cmd_tables = hsw_blt_ring_cmds; -- cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmds); -+ ring->get_cmd_length_mask = gen7_blt_get_cmd_length_mask; -+ if (IS_GEN9(ring->dev)) { -+ cmd_tables = gen9_blt_cmd_table; -+ cmd_table_count = ARRAY_SIZE(gen9_blt_cmd_table); -+ ring->get_cmd_length_mask = -+ gen9_blt_get_cmd_length_mask; -+ -+ /* BCS Engine unsafe without parser */ -+ ring->requires_cmd_parser = 1; -+ } -+ else if (IS_HASWELL(ring->dev)) { -+ cmd_tables = hsw_blt_ring_cmd_table; -+ cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmd_table); - } else { -- cmd_tables = gen7_blt_cmds; -- cmd_table_count = ARRAY_SIZE(gen7_blt_cmds); -+ cmd_tables = gen7_blt_cmd_table; -+ cmd_table_count = ARRAY_SIZE(gen7_blt_cmd_table); - } - -- ring->reg_table = gen7_blt_regs; -- ring->reg_count = ARRAY_SIZE(gen7_blt_regs); -- -- if (IS_HASWELL(ring->dev)) { -- ring->master_reg_table = hsw_master_regs; -- ring->master_reg_count = ARRAY_SIZE(hsw_master_regs); -+ if (IS_GEN9(ring->dev)) { -+ ring->reg_table = gen9_blt_regs; -+ ring->reg_count = ARRAY_SIZE(gen9_blt_regs); - } else { -- ring->master_reg_table = ivb_master_regs; -- ring->master_reg_count = ARRAY_SIZE(ivb_master_regs); -+ ring->reg_table = gen7_blt_regs; -+ ring->reg_count = ARRAY_SIZE(gen7_blt_regs); - } - -- ring->get_cmd_length_mask = gen7_blt_get_cmd_length_mask; - break; - case VECS: -- cmd_tables = hsw_vebox_cmds; -- cmd_table_count = ARRAY_SIZE(hsw_vebox_cmds); -+ cmd_tables = hsw_vebox_cmd_table; -+ cmd_table_count = ARRAY_SIZE(hsw_vebox_cmd_table); - /* VECS can use the same length_mask function as VCS */ - ring->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask; - break; -@@ -769,7 +843,7 @@ int i915_cmd_parser_init_ring(struct intel_engine_cs *ring) - return ret; - } - -- ring->needs_cmd_parser = true; -+ ring->using_cmd_parser = true; - - return 0; - } -@@ -783,7 +857,7 @@ int i915_cmd_parser_init_ring(struct intel_engine_cs *ring) - */ - void i915_cmd_parser_fini_ring(struct intel_engine_cs *ring) - { -- if (!ring->needs_cmd_parser) -+ if (!ring->using_cmd_parser) - return; - - fini_hash_table(ring); -@@ -949,30 +1023,9 @@ static u32 *copy_batch(struct drm_i915_gem_object *dest_obj, - return ret ? ERR_PTR(ret) : dst; - } - --/** -- * i915_needs_cmd_parser() - should a given ring use software command parsing? -- * @ring: the ring in question -- * -- * Only certain platforms require software batch buffer command parsing, and -- * only when enabled via module parameter. -- * -- * Return: true if the ring requires software command parsing -- */ --bool i915_needs_cmd_parser(struct intel_engine_cs *ring) --{ -- if (!ring->needs_cmd_parser) -- return false; -- -- if (!USES_PPGTT(ring->dev)) -- return false; -- -- return (i915.enable_cmd_parser == 1); --} -- --static bool check_cmd(const struct intel_engine_cs *ring, -+static int check_cmd(const struct intel_engine_cs *ring, - const struct drm_i915_cmd_descriptor *desc, - const u32 *cmd, u32 length, -- const bool is_master, - bool *oacontrol_set) - { - if (desc->flags & CMD_DESC_REJECT) { -@@ -980,12 +1033,6 @@ static bool check_cmd(const struct intel_engine_cs *ring, - return false; - } - -- if ((desc->flags & CMD_DESC_MASTER) && !is_master) { -- DRM_DEBUG_DRIVER("CMD: Rejected master-only command: 0x%08X\n", -- *cmd); -- return false; -- } -- - if (desc->flags & CMD_DESC_REGISTER) { - /* - * Get the distance between individual register offset -@@ -1002,11 +1049,6 @@ static bool check_cmd(const struct intel_engine_cs *ring, - find_reg(ring->reg_table, ring->reg_count, - reg_addr); - -- if (!reg && is_master) -- reg = find_reg(ring->master_reg_table, -- ring->master_reg_count, -- reg_addr); -- - if (!reg) { - DRM_DEBUG_DRIVER("CMD: Rejected register 0x%08X in command: 0x%08X (ring=%d)\n", - reg_addr, *cmd, ring->id); -@@ -1091,16 +1133,113 @@ static bool check_cmd(const struct intel_engine_cs *ring, - return true; - } - -+static int check_bbstart(struct intel_context *ctx, -+ u32 *cmd, u64 offset, u32 length, -+ u32 batch_len, -+ u64 batch_start, -+ u64 shadow_batch_start) -+{ -+ -+ u64 jump_offset, jump_target; -+ u32 target_cmd_offset, target_cmd_index; -+ -+ /* For igt compatibility on older platforms */ -+ if (CMDPARSER_USES_GGTT(ctx->i915)) { -+ DRM_DEBUG("CMD: Rejecting BB_START for ggtt based submission\n"); -+ return -EACCES; -+ } -+ -+ if (length != 3) { -+ DRM_DEBUG("CMD: Recursive BB_START with bad length(%u)\n", -+ length); -+ return -EINVAL; -+ } -+ -+ jump_target = *(u64*)(cmd+1); -+ jump_offset = jump_target - batch_start; -+ -+ /* -+ * Any underflow of jump_target is guaranteed to be outside the range -+ * of a u32, so >= test catches both too large and too small -+ */ -+ if (jump_offset >= batch_len) { -+ DRM_DEBUG("CMD: BB_START to 0x%llx jumps out of BB\n", -+ jump_target); -+ return -EINVAL; -+ } -+ -+ /* -+ * This cannot overflow a u32 because we already checked jump_offset -+ * is within the BB, and the batch_len is a u32 -+ */ -+ target_cmd_offset = lower_32_bits(jump_offset); -+ target_cmd_index = target_cmd_offset / sizeof(u32); -+ -+ *(u64*)(cmd + 1) = shadow_batch_start + target_cmd_offset; -+ -+ if (target_cmd_index == offset) -+ return 0; -+ -+ if (ctx->jump_whitelist_cmds <= target_cmd_index) { -+ DRM_DEBUG("CMD: Rejecting BB_START - truncated whitelist array\n"); -+ return -EINVAL; -+ } else if (!test_bit(target_cmd_index, ctx->jump_whitelist)) { -+ DRM_DEBUG("CMD: BB_START to 0x%llx not a previously executed cmd\n", -+ jump_target); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ -+static void init_whitelist(struct intel_context *ctx, u32 batch_len) -+{ -+ const u32 batch_cmds = DIV_ROUND_UP(batch_len, sizeof(u32)); -+ const u32 exact_size = BITS_TO_LONGS(batch_cmds); -+ u32 next_size = BITS_TO_LONGS(roundup_pow_of_two(batch_cmds)); -+ unsigned long *next_whitelist; -+ -+ if (CMDPARSER_USES_GGTT(ctx->i915)) -+ return; -+ -+ if (batch_cmds <= ctx->jump_whitelist_cmds) { -+ bitmap_zero(ctx->jump_whitelist, batch_cmds); -+ return; -+ } -+ -+again: -+ next_whitelist = kcalloc(next_size, sizeof(long), GFP_KERNEL); -+ if (next_whitelist) { -+ kfree(ctx->jump_whitelist); -+ ctx->jump_whitelist = next_whitelist; -+ ctx->jump_whitelist_cmds = -+ next_size * BITS_PER_BYTE * sizeof(long); -+ return; -+ } -+ -+ if (next_size > exact_size) { -+ next_size = exact_size; -+ goto again; -+ } -+ -+ DRM_DEBUG("CMD: Failed to extend whitelist. BB_START may be disallowed\n"); -+ bitmap_zero(ctx->jump_whitelist, ctx->jump_whitelist_cmds); -+ -+ return; -+} -+ - #define LENGTH_BIAS 2 - - /** - * i915_parse_cmds() - parse a submitted batch buffer for privilege violations -+ * @ctx: the context in which the batch is to execute - * @ring: the ring on which the batch is to execute - * @batch_obj: the batch buffer in question -- * @shadow_batch_obj: copy of the batch buffer in question -+ * @user_batch_start: Canonical base address of original user batch - * @batch_start_offset: byte offset in the batch at which execution starts - * @batch_len: length of the commands in batch_obj -- * @is_master: is the submitting process the drm master? -+ * @shadow_batch_obj: copy of the batch buffer in question -+ * @shadow_batch_start: Canonical base address of shadow_batch_obj - * - * Parses the specified batch buffer looking for privilege violations as - * described in the overview. -@@ -1108,14 +1247,16 @@ static bool check_cmd(const struct intel_engine_cs *ring, - * Return: non-zero if the parser finds violations or otherwise fails; -EACCES - * if the batch appears legal but should use hardware parsing - */ --int i915_parse_cmds(struct intel_engine_cs *ring, -+int i915_parse_cmds(struct intel_context *ctx, -+ struct intel_engine_cs *ring, - struct drm_i915_gem_object *batch_obj, -- struct drm_i915_gem_object *shadow_batch_obj, -+ u64 user_batch_start, - u32 batch_start_offset, - u32 batch_len, -- bool is_master) -+ struct drm_i915_gem_object *shadow_batch_obj, -+ u64 shadow_batch_start) - { -- u32 *cmd, *batch_base, *batch_end; -+ u32 *cmd, *batch_base, *batch_end, offset = 0; - struct drm_i915_cmd_descriptor default_desc = { 0 }; - bool oacontrol_set = false; /* OACONTROL tracking. See check_cmd() */ - int ret = 0; -@@ -1127,6 +1268,8 @@ int i915_parse_cmds(struct intel_engine_cs *ring, - return PTR_ERR(batch_base); - } - -+ init_whitelist(ctx, batch_len); -+ - /* - * We use the batch length as size because the shadow object is as - * large or larger and copy_batch() will write MI_NOPs to the extra -@@ -1150,16 +1293,6 @@ int i915_parse_cmds(struct intel_engine_cs *ring, - break; - } - -- /* -- * If the batch buffer contains a chained batch, return an -- * error that tells the caller to abort and dispatch the -- * workload as a non-secure batch. -- */ -- if (desc->cmd.value == MI_BATCH_BUFFER_START) { -- ret = -EACCES; -- break; -- } -- - if (desc->flags & CMD_DESC_FIXED) - length = desc->length.fixed; - else -@@ -1174,13 +1307,23 @@ int i915_parse_cmds(struct intel_engine_cs *ring, - break; - } - -- if (!check_cmd(ring, desc, cmd, length, is_master, -- &oacontrol_set)) { -- ret = -EINVAL; -+ if (!check_cmd(ring, desc, cmd, length, &oacontrol_set)) { -+ ret = CMDPARSER_USES_GGTT(ring->dev) ? -EINVAL : -EACCES; - break; - } - -+ if (desc->cmd.value == MI_BATCH_BUFFER_START) { -+ ret = check_bbstart(ctx, cmd, offset, length, -+ batch_len, user_batch_start, -+ shadow_batch_start); -+ break; -+ } -+ -+ if (ctx->jump_whitelist_cmds > offset) -+ set_bit(offset, ctx->jump_whitelist); -+ - cmd += length; -+ offset += length; - } - - if (oacontrol_set) { -@@ -1206,7 +1349,7 @@ int i915_parse_cmds(struct intel_engine_cs *ring, - * - * Return: the current version number of the cmd parser - */ --int i915_cmd_parser_get_version(void) -+int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv) - { - /* - * Command parser version history -@@ -1218,6 +1361,7 @@ int i915_cmd_parser_get_version(void) - * 3. Allow access to the GPGPU_THREADS_DISPATCHED register. - * 4. L3 atomic chicken bits of HSW_SCRATCH1 and HSW_ROW_CHICKEN3. - * 5. GPGPU dispatch compute indirect registers. -+ * 10. Gen9 only - Supports the new ppgtt based BLIT parser - */ -- return 5; -+ return CMDPARSER_USES_GGTT(dev_priv) ? 5 : 10; - } -diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c -index 61fcb3b22297..7b61078c2330 100644 ---- a/drivers/gpu/drm/i915/i915_dma.c -+++ b/drivers/gpu/drm/i915/i915_dma.c -@@ -133,7 +133,7 @@ static int i915_getparam(struct drm_device *dev, void *data, - value = 1; - break; - case I915_PARAM_HAS_SECURE_BATCHES: -- value = capable(CAP_SYS_ADMIN); -+ value = HAS_SECURE_BATCHES(dev_priv) && capable(CAP_SYS_ADMIN); - break; - case I915_PARAM_HAS_PINNED_BATCHES: - value = 1; -@@ -145,7 +145,7 @@ static int i915_getparam(struct drm_device *dev, void *data, - value = 1; - break; - case I915_PARAM_CMD_PARSER_VERSION: -- value = i915_cmd_parser_get_version(); -+ value = i915_cmd_parser_get_version(dev_priv); - break; - case I915_PARAM_HAS_COHERENT_PHYS_GTT: - value = 1; -diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c -index a6ad938f44a6..697b2499c7a1 100644 ---- a/drivers/gpu/drm/i915/i915_drv.c -+++ b/drivers/gpu/drm/i915/i915_drv.c -@@ -698,6 +698,8 @@ static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation) - return ret; - } - -+ i915_rc6_ctx_wa_suspend(dev_priv); -+ - pci_disable_device(drm_dev->pdev); - /* - * During hibernation on some platforms the BIOS may try to access -@@ -849,6 +851,8 @@ static int i915_drm_resume_early(struct drm_device *dev) - intel_uncore_sanitize(dev); - intel_power_domains_init_hw(dev_priv); - -+ i915_rc6_ctx_wa_resume(dev_priv); -+ - return ret; - } - -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index 6fca39e1c419..5799356f6b6b 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -891,6 +891,12 @@ struct intel_context { - int pin_count; - } engine[I915_NUM_RINGS]; - -+ /* jump_whitelist: Bit array for tracking cmds during cmdparsing */ -+ unsigned long *jump_whitelist; -+ -+ /* jump_whitelist_cmds: No of cmd slots available */ -+ uint32_t jump_whitelist_cmds; -+ - struct list_head link; - }; - -@@ -1153,6 +1159,7 @@ struct intel_gen6_power_mgmt { - bool client_boost; - - bool enabled; -+ bool ctx_corrupted; - struct delayed_work delayed_resume_work; - unsigned boosts; - -@@ -2539,6 +2546,9 @@ struct drm_i915_cmd_table { - #define HAS_BSD2(dev) (INTEL_INFO(dev)->ring_mask & BSD2_RING) - #define HAS_BLT(dev) (INTEL_INFO(dev)->ring_mask & BLT_RING) - #define HAS_VEBOX(dev) (INTEL_INFO(dev)->ring_mask & VEBOX_RING) -+ -+#define HAS_SECURE_BATCHES(dev_priv) (INTEL_INFO(dev_priv)->gen < 6) -+ - #define HAS_LLC(dev) (INTEL_INFO(dev)->has_llc) - #define HAS_WT(dev) ((IS_HASWELL(dev) || IS_BROADWELL(dev)) && \ - __I915__(dev)->ellc_size) -@@ -2553,8 +2563,18 @@ struct drm_i915_cmd_table { - #define HAS_OVERLAY(dev) (INTEL_INFO(dev)->has_overlay) - #define OVERLAY_NEEDS_PHYSICAL(dev) (INTEL_INFO(dev)->overlay_needs_physical) - -+/* -+ * The Gen7 cmdparser copies the scanned buffer to the ggtt for execution -+ * All later gens can run the final buffer from the ppgtt -+ */ -+#define CMDPARSER_USES_GGTT(dev_priv) IS_GEN7(dev_priv) -+ - /* Early gen2 have a totally busted CS tlb and require pinned batches. */ - #define HAS_BROKEN_CS_TLB(dev) (IS_I830(dev) || IS_845G(dev)) -+ -+#define NEEDS_RC6_CTX_CORRUPTION_WA(dev) \ -+ (IS_BROADWELL(dev) || INTEL_INFO(dev)->gen == 9) -+ - /* - * dp aux and gmbus irq on gen4 seems to be able to generate legacy interrupts - * even when in MSI mode. This results in spurious interrupt warnings if the -@@ -3276,16 +3296,19 @@ void i915_get_extra_instdone(struct drm_device *dev, uint32_t *instdone); - const char *i915_cache_level_str(struct drm_i915_private *i915, int type); - - /* i915_cmd_parser.c */ --int i915_cmd_parser_get_version(void); -+int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv); - int i915_cmd_parser_init_ring(struct intel_engine_cs *ring); - void i915_cmd_parser_fini_ring(struct intel_engine_cs *ring); - bool i915_needs_cmd_parser(struct intel_engine_cs *ring); --int i915_parse_cmds(struct intel_engine_cs *ring, -+int i915_parse_cmds(struct intel_context *cxt, -+ struct intel_engine_cs *ring, - struct drm_i915_gem_object *batch_obj, -- struct drm_i915_gem_object *shadow_batch_obj, -+ u64 user_batch_start, - u32 batch_start_offset, - u32 batch_len, -- bool is_master); -+ struct drm_i915_gem_object *shadow_batch_obj, -+ u64 shadow_batch_start); -+ - - /* i915_suspend.c */ - extern int i915_save_state(struct drm_device *dev); -diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c -index 0433d25f9d23..20fb0ee1df4f 100644 ---- a/drivers/gpu/drm/i915/i915_gem_context.c -+++ b/drivers/gpu/drm/i915/i915_gem_context.c -@@ -157,6 +157,8 @@ void i915_gem_context_free(struct kref *ctx_ref) - if (i915.enable_execlists) - intel_lr_context_free(ctx); - -+ kfree(ctx->jump_whitelist); -+ - /* - * This context is going away and we need to remove all VMAs still - * around. This is to handle imported shared objects for which -@@ -246,6 +248,9 @@ __create_hw_context(struct drm_device *dev, - - ctx->hang_stats.ban_period_seconds = DRM_I915_CTX_BAN_PERIOD; - -+ ctx->jump_whitelist = NULL; -+ ctx->jump_whitelist_cmds = 0; -+ - return ctx; - - err_out: -diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index 8800f410b2d2..56f6f5c5941e 100644 ---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -@@ -1121,17 +1121,52 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev, - return 0; - } - -+static struct i915_vma* -+shadow_batch_pin(struct drm_i915_gem_object *obj, struct i915_address_space *vm) -+{ -+ struct drm_i915_private *dev_priv = to_i915(obj->base.dev); -+ struct i915_address_space *pin_vm = vm; -+ u64 flags; -+ int ret; -+ -+ /* -+ * PPGTT backed shadow buffers must be mapped RO, to prevent -+ * post-scan tampering -+ */ -+ if (CMDPARSER_USES_GGTT(dev_priv)) { -+ flags = PIN_GLOBAL; -+ pin_vm = &dev_priv->gtt.base; -+ } else if (vm->has_read_only) { -+ flags = PIN_USER; -+ obj->gt_ro = 1; -+ } else { -+ DRM_DEBUG("Cannot prevent post-scan tampering without RO capable vm\n"); -+ return ERR_PTR(-EINVAL); -+ } -+ -+ ret = i915_gem_object_pin(obj, pin_vm, 0, flags); -+ if (ret) -+ return ERR_PTR(ret); -+ else -+ return i915_gem_obj_to_vma(obj, pin_vm); -+} -+ - static struct drm_i915_gem_object* --i915_gem_execbuffer_parse(struct intel_engine_cs *ring, -+i915_gem_execbuffer_parse(struct intel_context *ctx, -+ struct intel_engine_cs *ring, - struct drm_i915_gem_exec_object2 *shadow_exec_entry, - struct eb_vmas *eb, -+ struct i915_address_space *vm, - struct drm_i915_gem_object *batch_obj, - u32 batch_start_offset, -- u32 batch_len, -- bool is_master) -+ u32 batch_len) - { - struct drm_i915_gem_object *shadow_batch_obj; - struct i915_vma *vma; -+ struct i915_vma *user_vma = list_entry(eb->vmas.prev, -+ typeof(*user_vma), exec_list); -+ u64 batch_start; -+ u64 shadow_batch_start; - int ret; - - shadow_batch_obj = i915_gem_batch_pool_get(&ring->batch_pool, -@@ -1139,24 +1174,34 @@ i915_gem_execbuffer_parse(struct intel_engine_cs *ring, - if (IS_ERR(shadow_batch_obj)) - return shadow_batch_obj; - -- ret = i915_parse_cmds(ring, -+ vma = shadow_batch_pin(shadow_batch_obj, vm); -+ if (IS_ERR(vma)) { -+ ret = PTR_ERR(vma); -+ goto err; -+ } -+ -+ batch_start = user_vma->node.start + batch_start_offset; -+ -+ shadow_batch_start = vma->node.start; -+ -+ ret = i915_parse_cmds(ctx, -+ ring, - batch_obj, -- shadow_batch_obj, -+ batch_start, - batch_start_offset, - batch_len, -- is_master); -- if (ret) -- goto err; -- -- ret = i915_gem_obj_ggtt_pin(shadow_batch_obj, 0, 0); -- if (ret) -+ shadow_batch_obj, -+ shadow_batch_start); -+ if (ret) { -+ WARN_ON(vma->pin_count == 0); -+ vma->pin_count--; - goto err; -+ } - - i915_gem_object_unpin_pages(shadow_batch_obj); - - memset(shadow_exec_entry, 0, sizeof(*shadow_exec_entry)); - -- vma = i915_gem_obj_to_ggtt(shadow_batch_obj); - vma->exec_entry = shadow_exec_entry; - vma->exec_entry->flags = __EXEC_OBJECT_HAS_PIN; - drm_gem_object_reference(&shadow_batch_obj->base); -@@ -1168,7 +1213,14 @@ i915_gem_execbuffer_parse(struct intel_engine_cs *ring, - - err: - i915_gem_object_unpin_pages(shadow_batch_obj); -- if (ret == -EACCES) /* unhandled chained batch */ -+ -+ /* -+ * Unsafe GGTT-backed buffers can still be submitted safely -+ * as non-secure. -+ * For PPGTT backing however, we have no choice but to forcibly -+ * reject unsafe buffers -+ */ -+ if (CMDPARSER_USES_GGTT(batch_obj->base.dev) && (ret == -EACCES)) - return batch_obj; - else - return ERR_PTR(ret); -@@ -1320,6 +1372,13 @@ eb_get_batch(struct eb_vmas *eb) - return vma->obj; - } - -+static inline bool use_cmdparser(const struct intel_engine_cs *ring, -+ u32 batch_len) -+{ -+ return ring->requires_cmd_parser || -+ (ring->using_cmd_parser && batch_len && USES_PPGTT(ring->dev)); -+} -+ - static int - i915_gem_do_execbuffer(struct drm_device *dev, void *data, - struct drm_file *file, -@@ -1349,6 +1408,10 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - - dispatch_flags = 0; - if (args->flags & I915_EXEC_SECURE) { -+ /* Return -EPERM to trigger fallback code on old binaries. */ -+ if (!HAS_SECURE_BATCHES(dev_priv)) -+ return -EPERM; -+ - if (!file->is_master || !capable(CAP_SYS_ADMIN)) - return -EPERM; - -@@ -1487,16 +1550,20 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - } - - params->args_batch_start_offset = args->batch_start_offset; -- if (i915_needs_cmd_parser(ring) && args->batch_len) { -+ if (use_cmdparser(ring, args->batch_len)) { - struct drm_i915_gem_object *parsed_batch_obj; - -- parsed_batch_obj = i915_gem_execbuffer_parse(ring, -+ u32 batch_off = args->batch_start_offset; -+ u32 batch_len = args->batch_len; -+ if (batch_len == 0) -+ batch_len = batch_obj->base.size - batch_off; -+ -+ parsed_batch_obj = i915_gem_execbuffer_parse(ctx, ring, - &shadow_exec_entry, -- eb, -+ eb, vm, - batch_obj, -- args->batch_start_offset, -- args->batch_len, -- file->is_master); -+ batch_off, -+ batch_len); - if (IS_ERR(parsed_batch_obj)) { - ret = PTR_ERR(parsed_batch_obj); - goto err; -@@ -1506,18 +1573,9 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - * parsed_batch_obj == batch_obj means batch not fully parsed: - * Accept, but don't promote to secure. - */ -- - if (parsed_batch_obj != batch_obj) { -- /* -- * Batch parsed and accepted: -- * -- * Set the DISPATCH_SECURE bit to remove the NON_SECURE -- * bit from MI_BATCH_BUFFER_START commands issued in -- * the dispatch_execbuffer implementations. We -- * specifically don't want that set on batches the -- * command parser has accepted. -- */ -- dispatch_flags |= I915_DISPATCH_SECURE; -+ if (CMDPARSER_USES_GGTT(dev_priv)) -+ dispatch_flags |= I915_DISPATCH_SECURE; - params->args_batch_start_offset = 0; - batch_obj = parsed_batch_obj; - } -diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c -index b37fe0df743e..65a53ee398b8 100644 ---- a/drivers/gpu/drm/i915/i915_gem_gtt.c -+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c -@@ -119,7 +119,8 @@ static int sanitize_enable_ppgtt(struct drm_device *dev, int enable_ppgtt) - (enable_ppgtt == 0 || !has_aliasing_ppgtt)) - return 0; - -- if (enable_ppgtt == 1) -+ /* Full PPGTT is required by the Gen9 cmdparser */ -+ if (enable_ppgtt == 1 && INTEL_INFO(dev)->gen != 9) - return 1; - - if (enable_ppgtt == 2 && has_full_ppgtt) -@@ -152,7 +153,8 @@ static int ppgtt_bind_vma(struct i915_vma *vma, - { - u32 pte_flags = 0; - -- /* Currently applicable only to VLV */ -+ /* Applicable to VLV, and gen8+ */ -+ pte_flags = 0; - if (vma->obj->gt_ro) - pte_flags |= PTE_READ_ONLY; - -@@ -172,11 +174,14 @@ static void ppgtt_unbind_vma(struct i915_vma *vma) - - static gen8_pte_t gen8_pte_encode(dma_addr_t addr, - enum i915_cache_level level, -- bool valid) -+ bool valid, u32 flags) - { - gen8_pte_t pte = valid ? _PAGE_PRESENT | _PAGE_RW : 0; - pte |= addr; - -+ if (unlikely(flags & PTE_READ_ONLY)) -+ pte &= ~_PAGE_RW; -+ - switch (level) { - case I915_CACHE_NONE: - pte |= PPAT_UNCACHED_INDEX; -@@ -460,7 +465,7 @@ static void gen8_initialize_pt(struct i915_address_space *vm, - gen8_pte_t scratch_pte; - - scratch_pte = gen8_pte_encode(px_dma(vm->scratch_page), -- I915_CACHE_LLC, true); -+ I915_CACHE_LLC, true, 0); - - fill_px(vm->dev, pt, scratch_pte); - } -@@ -757,8 +762,9 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm, - { - struct i915_hw_ppgtt *ppgtt = - container_of(vm, struct i915_hw_ppgtt, base); -- gen8_pte_t scratch_pte = gen8_pte_encode(px_dma(vm->scratch_page), -- I915_CACHE_LLC, use_scratch); -+ gen8_pte_t scratch_pte = -+ gen8_pte_encode(px_dma(vm->scratch_page), -+ I915_CACHE_LLC, use_scratch, 0); - - if (!USES_FULL_48BIT_PPGTT(vm->dev)) { - gen8_ppgtt_clear_pte_range(vm, &ppgtt->pdp, start, length, -@@ -779,7 +785,8 @@ gen8_ppgtt_insert_pte_entries(struct i915_address_space *vm, - struct i915_page_directory_pointer *pdp, - struct sg_page_iter *sg_iter, - uint64_t start, -- enum i915_cache_level cache_level) -+ enum i915_cache_level cache_level, -+ u32 flags) - { - struct i915_hw_ppgtt *ppgtt = - container_of(vm, struct i915_hw_ppgtt, base); -@@ -799,7 +806,7 @@ gen8_ppgtt_insert_pte_entries(struct i915_address_space *vm, - - pt_vaddr[pte] = - gen8_pte_encode(sg_page_iter_dma_address(sg_iter), -- cache_level, true); -+ cache_level, true, flags); - if (++pte == GEN8_PTES) { - kunmap_px(ppgtt, pt_vaddr); - pt_vaddr = NULL; -@@ -820,7 +827,7 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm, - struct sg_table *pages, - uint64_t start, - enum i915_cache_level cache_level, -- u32 unused) -+ u32 flags) - { - struct i915_hw_ppgtt *ppgtt = - container_of(vm, struct i915_hw_ppgtt, base); -@@ -830,7 +837,7 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm, - - if (!USES_FULL_48BIT_PPGTT(vm->dev)) { - gen8_ppgtt_insert_pte_entries(vm, &ppgtt->pdp, &sg_iter, start, -- cache_level); -+ cache_level, flags); - } else { - struct i915_page_directory_pointer *pdp; - uint64_t templ4, pml4e; -@@ -838,7 +845,7 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm, - - gen8_for_each_pml4e(pdp, &ppgtt->pml4, start, length, templ4, pml4e) { - gen8_ppgtt_insert_pte_entries(vm, pdp, &sg_iter, -- start, cache_level); -+ start, cache_level, flags); - } - } - } -@@ -1447,7 +1454,7 @@ static void gen8_dump_ppgtt(struct i915_hw_ppgtt *ppgtt, struct seq_file *m) - uint64_t start = ppgtt->base.start; - uint64_t length = ppgtt->base.total; - gen8_pte_t scratch_pte = gen8_pte_encode(px_dma(vm->scratch_page), -- I915_CACHE_LLC, true); -+ I915_CACHE_LLC, true, 0); - - if (!USES_FULL_48BIT_PPGTT(vm->dev)) { - gen8_dump_pdp(&ppgtt->pdp, start, length, scratch_pte, m); -@@ -1515,6 +1522,14 @@ static int gen8_ppgtt_init(struct i915_hw_ppgtt *ppgtt) - ppgtt->base.clear_range = gen8_ppgtt_clear_range; - ppgtt->base.unbind_vma = ppgtt_unbind_vma; - ppgtt->base.bind_vma = ppgtt_bind_vma; -+ -+ /* -+ * From bdw, there is support for read-only pages in the PPGTT. -+ * -+ * XXX GVT is not honouring the lack of RW in the PTE bits. -+ */ -+ ppgtt->base.has_read_only = !intel_vgpu_active(ppgtt->base.dev); -+ - ppgtt->debug_dump = gen8_dump_ppgtt; - - if (USES_FULL_48BIT_PPGTT(ppgtt->base.dev)) { -@@ -2343,7 +2358,7 @@ static void gen8_set_pte(void __iomem *addr, gen8_pte_t pte) - static void gen8_ggtt_insert_entries(struct i915_address_space *vm, - struct sg_table *st, - uint64_t start, -- enum i915_cache_level level, u32 unused) -+ enum i915_cache_level level, u32 flags) - { - struct drm_i915_private *dev_priv = vm->dev->dev_private; - unsigned first_entry = start >> PAGE_SHIFT; -@@ -2357,7 +2372,7 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm, - addr = sg_dma_address(sg_iter.sg) + - (sg_iter.sg_pgoffset << PAGE_SHIFT); - gen8_set_pte(>t_entries[i], -- gen8_pte_encode(addr, level, true)); -+ gen8_pte_encode(addr, level, true, flags)); - i++; - } - -@@ -2370,7 +2385,7 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm, - */ - if (i != 0) - WARN_ON(readq(>t_entries[i-1]) -- != gen8_pte_encode(addr, level, true)); -+ != gen8_pte_encode(addr, level, true, flags)); - - /* This next bit makes the above posting read even more important. We - * want to flush the TLBs only after we're certain all the PTE updates -@@ -2444,7 +2459,7 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm, - - scratch_pte = gen8_pte_encode(px_dma(vm->scratch_page), - I915_CACHE_LLC, -- use_scratch); -+ use_scratch, 0); - for (i = 0; i < num_entries; i++) - gen8_set_pte(>t_base[i], scratch_pte); - readl(gtt_base); -@@ -2510,7 +2525,8 @@ static int ggtt_bind_vma(struct i915_vma *vma, - if (ret) - return ret; - -- /* Currently applicable only to VLV */ -+ /* Applicable to VLV (gen8+ do not support RO in the GGTT) */ -+ pte_flags = 0; - if (obj->gt_ro) - pte_flags |= PTE_READ_ONLY; - -@@ -2653,6 +2669,9 @@ static int i915_gem_setup_global_gtt(struct drm_device *dev, - i915_address_space_init(ggtt_vm, dev_priv); - ggtt_vm->total += PAGE_SIZE; - -+ /* Only VLV supports read-only GGTT mappings */ -+ ggtt_vm->has_read_only = IS_VALLEYVIEW(dev_priv); -+ - if (intel_vgpu_active(dev)) { - ret = intel_vgt_balloon(dev); - if (ret) -diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h -index a216397ead52..d36f2d77576a 100644 ---- a/drivers/gpu/drm/i915/i915_gem_gtt.h -+++ b/drivers/gpu/drm/i915/i915_gem_gtt.h -@@ -307,6 +307,9 @@ struct i915_address_space { - */ - struct list_head inactive_list; - -+ /* Some systems support read-only mappings for GGTT and/or PPGTT */ -+ bool has_read_only:1; -+ - /* FIXME: Need a more generic return type */ - gen6_pte_t (*pte_encode)(dma_addr_t addr, - enum i915_cache_level level, -diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h -index cace154bbdc0..603d8cdfc5f1 100644 ---- a/drivers/gpu/drm/i915/i915_reg.h -+++ b/drivers/gpu/drm/i915/i915_reg.h -@@ -170,6 +170,8 @@ - #define ECOCHK_PPGTT_WT_HSW (0x2<<3) - #define ECOCHK_PPGTT_WB_HSW (0x3<<3) - -+#define GEN8_RC6_CTX_INFO 0x8504 -+ - #define GAC_ECO_BITS 0x14090 - #define ECOBITS_SNB_BIT (1<<13) - #define ECOBITS_PPGTT_CACHE64B (3<<8) -@@ -511,6 +513,10 @@ - */ - #define BCS_SWCTRL 0x22200 - -+/* There are 16 GPR registers */ -+#define BCS_GPR(n) (0x22600 + (n) * 8) -+#define BCS_GPR_UDW(n) (0x22600 + (n) * 8 + 4) -+ - #define GPGPU_THREADS_DISPATCHED 0x2290 - #define HS_INVOCATION_COUNT 0x2300 - #define DS_INVOCATION_COUNT 0x2308 -@@ -1567,6 +1573,7 @@ enum skl_disp_power_wells { - #define RING_IMR(base) ((base)+0xa8) - #define RING_HWSTAM(base) ((base)+0x98) - #define RING_TIMESTAMP(base) ((base)+0x358) -+#define RING_TIMESTAMP_UDW(base) ((base) + 0x358 + 4) - #define TAIL_ADDR 0x001FFFF8 - #define HEAD_WRAP_COUNT 0xFFE00000 - #define HEAD_WRAP_ONE 0x00200000 -@@ -5704,6 +5711,10 @@ enum skl_disp_power_wells { - #define GAMMA_MODE_MODE_12BIT (2 << 0) - #define GAMMA_MODE_MODE_SPLIT (3 << 0) - -+/* Display Internal Timeout Register */ -+#define RM_TIMEOUT 0x42060 -+#define MMIO_TIMEOUT_US(us) ((us) << 0) -+ - /* interrupts */ - #define DE_MASTER_IRQ_CONTROL (1 << 31) - #define DE_SPRITEB_FLIP_DONE (1 << 29) -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index d489a04c47cc..1567f119bdfc 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -10747,6 +10747,10 @@ void intel_mark_busy(struct drm_device *dev) - return; - - intel_runtime_pm_get(dev_priv); -+ -+ if (NEEDS_RC6_CTX_CORRUPTION_WA(dev_priv)) -+ intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL); -+ - i915_update_gfx_val(dev_priv); - if (INTEL_INFO(dev)->gen >= 6) - gen6_rps_busy(dev_priv); -@@ -10765,6 +10769,11 @@ void intel_mark_idle(struct drm_device *dev) - if (INTEL_INFO(dev)->gen >= 6) - gen6_rps_idle(dev->dev_private); - -+ if (NEEDS_RC6_CTX_CORRUPTION_WA(dev_priv)) { -+ i915_rc6_ctx_wa_check(dev_priv); -+ intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL); -+ } -+ - intel_runtime_pm_put(dev_priv); - } - -diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h -index 722aa159cd28..78503e481313 100644 ---- a/drivers/gpu/drm/i915/intel_drv.h -+++ b/drivers/gpu/drm/i915/intel_drv.h -@@ -1410,6 +1410,9 @@ void intel_enable_gt_powersave(struct drm_device *dev); - void intel_disable_gt_powersave(struct drm_device *dev); - void intel_suspend_gt_powersave(struct drm_device *dev); - void intel_reset_gt_powersave(struct drm_device *dev); -+bool i915_rc6_ctx_wa_check(struct drm_i915_private *i915); -+void i915_rc6_ctx_wa_suspend(struct drm_i915_private *i915); -+void i915_rc6_ctx_wa_resume(struct drm_i915_private *i915); - void gen6_update_ring_freq(struct drm_device *dev); - void gen6_rps_busy(struct drm_i915_private *dev_priv); - void gen6_rps_reset_ei(struct drm_i915_private *dev_priv); -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index fd4690ed93c0..81bd84f9156b 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -66,6 +66,14 @@ static void bxt_init_clock_gating(struct drm_device *dev) - */ - I915_WRITE(GEN8_UCGCTL6, I915_READ(GEN8_UCGCTL6) | - GEN8_HDCUNIT_CLOCK_GATE_DISABLE_HDCREQ); -+ -+ /* -+ * Lower the display internal timeout. -+ * This is needed to avoid any hard hangs when DSI port PLL -+ * is off and a MMIO access is attempted by any privilege -+ * application, using batch buffers or any other means. -+ */ -+ I915_WRITE(RM_TIMEOUT, MMIO_TIMEOUT_US(950)); - } - - static void i915_pineview_get_mem_freq(struct drm_device *dev) -@@ -4591,30 +4599,42 @@ void intel_set_rps(struct drm_device *dev, u8 val) - gen6_set_rps(dev, val); - } - --static void gen9_disable_rps(struct drm_device *dev) -+static void gen9_disable_rc6(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; - - I915_WRITE(GEN6_RC_CONTROL, 0); -+} -+ -+static void gen9_disable_rps(struct drm_device *dev) -+{ -+ struct drm_i915_private *dev_priv = dev->dev_private; -+ - I915_WRITE(GEN9_PG_ENABLE, 0); - } - --static void gen6_disable_rps(struct drm_device *dev) -+static void gen6_disable_rc6(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; - - I915_WRITE(GEN6_RC_CONTROL, 0); -+} -+ -+static void gen6_disable_rps(struct drm_device *dev) -+{ -+ struct drm_i915_private *dev_priv = dev->dev_private; -+ - I915_WRITE(GEN6_RPNSWREQ, 1 << 31); - } - --static void cherryview_disable_rps(struct drm_device *dev) -+static void cherryview_disable_rc6(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; - - I915_WRITE(GEN6_RC_CONTROL, 0); - } - --static void valleyview_disable_rps(struct drm_device *dev) -+static void valleyview_disable_rc6(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; - -@@ -4818,7 +4838,8 @@ static void gen9_enable_rc6(struct drm_device *dev) - I915_WRITE(GEN9_RENDER_PG_IDLE_HYSTERESIS, 25); - - /* 3a: Enable RC6 */ -- if (intel_enable_rc6(dev) & INTEL_RC6_ENABLE) -+ if (!dev_priv->rps.ctx_corrupted && -+ intel_enable_rc6(dev) & INTEL_RC6_ENABLE) - rc6_mask = GEN6_RC_CTL_RC6_ENABLE; - DRM_INFO("RC6 %s\n", (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? - "on" : "off"); -@@ -4841,7 +4862,7 @@ static void gen9_enable_rc6(struct drm_device *dev) - * WaRsDisableCoarsePowerGating:skl,bxt - Render/Media PG need to be disabled with RC6. - */ - if ((IS_BROXTON(dev) && (INTEL_REVID(dev) < BXT_REVID_B0)) || -- ((IS_SKL_GT3(dev) || IS_SKL_GT4(dev)) && (INTEL_REVID(dev) <= SKL_REVID_F0))) -+ INTEL_INFO(dev)->gen == 9) - I915_WRITE(GEN9_PG_ENABLE, 0); - else - I915_WRITE(GEN9_PG_ENABLE, (rc6_mask & GEN6_RC_CTL_RC6_ENABLE) ? -@@ -4884,7 +4905,8 @@ static void gen8_enable_rps(struct drm_device *dev) - I915_WRITE(GEN6_RC6_THRESHOLD, 50000); /* 50/125ms per EI */ - - /* 3: Enable RC6 */ -- if (intel_enable_rc6(dev) & INTEL_RC6_ENABLE) -+ if (!dev_priv->rps.ctx_corrupted && -+ intel_enable_rc6(dev) & INTEL_RC6_ENABLE) - rc6_mask = GEN6_RC_CTL_RC6_ENABLE; - intel_print_rc6_info(dev, rc6_mask); - if (IS_BROADWELL(dev)) -@@ -6128,10 +6150,101 @@ static void intel_init_emon(struct drm_device *dev) - dev_priv->ips.corr = (lcfuse & LCFUSE_HIV_MASK); - } - -+static bool i915_rc6_ctx_corrupted(struct drm_i915_private *dev_priv) -+{ -+ return !I915_READ(GEN8_RC6_CTX_INFO); -+} -+ -+static void i915_rc6_ctx_wa_init(struct drm_i915_private *i915) -+{ -+ if (!NEEDS_RC6_CTX_CORRUPTION_WA(i915)) -+ return; -+ -+ if (i915_rc6_ctx_corrupted(i915)) { -+ DRM_INFO("RC6 context corrupted, disabling runtime power management\n"); -+ i915->rps.ctx_corrupted = true; -+ intel_runtime_pm_get(i915); -+ } -+} -+ -+static void i915_rc6_ctx_wa_cleanup(struct drm_i915_private *i915) -+{ -+ if (i915->rps.ctx_corrupted) { -+ intel_runtime_pm_put(i915); -+ i915->rps.ctx_corrupted = false; -+ } -+} -+ -+/** -+ * i915_rc6_ctx_wa_suspend - system suspend sequence for the RC6 CTX WA -+ * @i915: i915 device -+ * -+ * Perform any steps needed to clean up the RC6 CTX WA before system suspend. -+ */ -+void i915_rc6_ctx_wa_suspend(struct drm_i915_private *i915) -+{ -+ if (i915->rps.ctx_corrupted) -+ intel_runtime_pm_put(i915); -+} -+ -+/** -+ * i915_rc6_ctx_wa_resume - system resume sequence for the RC6 CTX WA -+ * @i915: i915 device -+ * -+ * Perform any steps needed to re-init the RC6 CTX WA after system resume. -+ */ -+void i915_rc6_ctx_wa_resume(struct drm_i915_private *i915) -+{ -+ if (!i915->rps.ctx_corrupted) -+ return; -+ -+ if (i915_rc6_ctx_corrupted(i915)) { -+ intel_runtime_pm_get(i915); -+ return; -+ } -+ -+ DRM_INFO("RC6 context restored, re-enabling runtime power management\n"); -+ i915->rps.ctx_corrupted = false; -+} -+ -+static void intel_disable_rc6(struct drm_device *dev); -+ -+/** -+ * i915_rc6_ctx_wa_check - check for a new RC6 CTX corruption -+ * @i915: i915 device -+ * -+ * Check if an RC6 CTX corruption has happened since the last check and if so -+ * disable RC6 and runtime power management. -+ * -+ * Return false if no context corruption has happened since the last call of -+ * this function, true otherwise. -+*/ -+bool i915_rc6_ctx_wa_check(struct drm_i915_private *i915) -+{ -+ if (!NEEDS_RC6_CTX_CORRUPTION_WA(i915)) -+ return false; -+ -+ if (i915->rps.ctx_corrupted) -+ return false; -+ -+ if (!i915_rc6_ctx_corrupted(i915)) -+ return false; -+ -+ DRM_NOTE("RC6 context corruption, disabling runtime power management\n"); -+ -+ intel_disable_rc6(i915->dev); -+ i915->rps.ctx_corrupted = true; -+ intel_runtime_pm_get_noresume(i915); -+ -+ return true; -+} -+ - void intel_init_gt_powersave(struct drm_device *dev) - { - i915.enable_rc6 = sanitize_rc6_option(dev, i915.enable_rc6); - -+ i915_rc6_ctx_wa_init(to_i915(dev)); -+ - if (IS_CHERRYVIEW(dev)) - cherryview_init_gt_powersave(dev); - else if (IS_VALLEYVIEW(dev)) -@@ -6144,6 +6257,8 @@ void intel_cleanup_gt_powersave(struct drm_device *dev) - return; - else if (IS_VALLEYVIEW(dev)) - valleyview_cleanup_gt_powersave(dev); -+ -+ i915_rc6_ctx_wa_cleanup(to_i915(dev)); - } - - static void gen6_suspend_rps(struct drm_device *dev) -@@ -6176,6 +6291,38 @@ void intel_suspend_gt_powersave(struct drm_device *dev) - gen6_rps_idle(dev_priv); - } - -+static void __intel_disable_rc6(struct drm_device *dev) -+{ -+ if (INTEL_INFO(dev)->gen >= 9) -+ gen9_disable_rc6(dev); -+ else if (IS_CHERRYVIEW(dev)) -+ cherryview_disable_rc6(dev); -+ else if (IS_VALLEYVIEW(dev)) -+ valleyview_disable_rc6(dev); -+ else -+ gen6_disable_rc6(dev); -+} -+ -+static void intel_disable_rc6(struct drm_device *dev) -+{ -+ struct drm_i915_private *dev_priv = to_i915(dev); -+ -+ mutex_lock(&dev_priv->rps.hw_lock); -+ __intel_disable_rc6(dev); -+ mutex_unlock(&dev_priv->rps.hw_lock); -+} -+ -+static void intel_disable_rps(struct drm_device *dev) -+{ -+ if (IS_CHERRYVIEW(dev) || IS_VALLEYVIEW(dev)) -+ return; -+ -+ if (INTEL_INFO(dev)->gen >= 9) -+ gen9_disable_rps(dev); -+ else -+ gen6_disable_rps(dev); -+} -+ - void intel_disable_gt_powersave(struct drm_device *dev) - { - struct drm_i915_private *dev_priv = dev->dev_private; -@@ -6186,16 +6333,12 @@ void intel_disable_gt_powersave(struct drm_device *dev) - intel_suspend_gt_powersave(dev); - - mutex_lock(&dev_priv->rps.hw_lock); -- if (INTEL_INFO(dev)->gen >= 9) -- gen9_disable_rps(dev); -- else if (IS_CHERRYVIEW(dev)) -- cherryview_disable_rps(dev); -- else if (IS_VALLEYVIEW(dev)) -- valleyview_disable_rps(dev); -- else -- gen6_disable_rps(dev); -+ -+ __intel_disable_rc6(dev); -+ intel_disable_rps(dev); - - dev_priv->rps.enabled = false; -+ - mutex_unlock(&dev_priv->rps.hw_lock); - } - } -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c -index 9d48443bca2e..df6547f60a5c 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.c -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c -@@ -2058,6 +2058,8 @@ static void intel_destroy_ringbuffer_obj(struct intel_ringbuffer *ringbuf) - static int intel_alloc_ringbuffer_obj(struct drm_device *dev, - struct intel_ringbuffer *ringbuf) - { -+ struct drm_i915_private *dev_priv = to_i915(dev); -+ struct i915_address_space *vm = &dev_priv->gtt.base; - struct drm_i915_gem_object *obj; - - obj = NULL; -@@ -2068,8 +2070,12 @@ static int intel_alloc_ringbuffer_obj(struct drm_device *dev, - if (obj == NULL) - return -ENOMEM; - -- /* mark ring buffers as read-only from GPU side by default */ -- obj->gt_ro = 1; -+ /* -+ * Mark ring buffers as read-only from GPU side (so no stray overwrites) -+ * if supported by the platform's GGTT. -+ */ -+ if (vm->has_read_only) -+ obj->gt_ro = 1; - - ringbuf->obj = obj; - -diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h -index 49fa41dc0eb6..56c872b89a92 100644 ---- a/drivers/gpu/drm/i915/intel_ringbuffer.h -+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h -@@ -314,7 +314,8 @@ struct intel_engine_cs { - volatile u32 *cpu_page; - } scratch; - -- bool needs_cmd_parser; -+ bool using_cmd_parser; -+ bool requires_cmd_parser; - - /* - * Table of commands the command parser needs to know about -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 892d0a71d766..57724a3afe78 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -1956,6 +1956,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev) - case 0x682C: - si_pi->cac_weights = cac_weights_cape_verde_pro; - si_pi->dte_data = dte_data_sun_xt; -+ update_dte_from_pl2 = true; - break; - case 0x6825: - case 0x6827: -diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c -index 1880105cc8c4..778a46247f8d 100644 ---- a/drivers/iio/imu/adis16480.c -+++ b/drivers/iio/imu/adis16480.c -@@ -266,8 +266,11 @@ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2) - struct adis16480 *st = iio_priv(indio_dev); - unsigned int t; - -+ if (val < 0 || val2 < 0) -+ return -EINVAL; -+ - t = val * 1000 + val2 / 1000; -- if (t <= 0) -+ if (t == 0) - return -EINVAL; - - t = 2460000 / t; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 1bf4f54c2bef..e31b4c7d2522 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1719,7 +1719,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) - slave_disable_netpoll(new_slave); - - err_close: -- slave_dev->priv_flags &= ~IFF_BONDING; -+ if (!netif_is_bond_master(slave_dev)) -+ slave_dev->priv_flags &= ~IFF_BONDING; - dev_close(slave_dev); - - err_restore_mac: -@@ -1915,7 +1916,8 @@ static int __bond_release_one(struct net_device *bond_dev, - - dev_set_mtu(slave_dev, slave->original_mtu); - -- slave_dev->priv_flags &= ~IFF_BONDING; -+ if (!netif_is_bond_master(slave_dev)) -+ slave_dev->priv_flags &= ~IFF_BONDING; - - bond_free_slave(slave); - -diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c -index e3dccd3200d5..7d35f6737499 100644 ---- a/drivers/net/can/c_can/c_can.c -+++ b/drivers/net/can/c_can/c_can.c -@@ -97,6 +97,9 @@ - #define BTR_TSEG2_SHIFT 12 - #define BTR_TSEG2_MASK (0x7 << BTR_TSEG2_SHIFT) - -+/* interrupt register */ -+#define INT_STS_PENDING 0x8000 -+ - /* brp extension register */ - #define BRP_EXT_BRPE_MASK 0x0f - #define BRP_EXT_BRPE_SHIFT 0 -@@ -1029,10 +1032,16 @@ static int c_can_poll(struct napi_struct *napi, int quota) - u16 curr, last = priv->last_status; - int work_done = 0; - -- priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG); -- /* Ack status on C_CAN. D_CAN is self clearing */ -- if (priv->type != BOSCH_D_CAN) -- priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED); -+ /* Only read the status register if a status interrupt was pending */ -+ if (atomic_xchg(&priv->sie_pending, 0)) { -+ priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG); -+ /* Ack status on C_CAN. D_CAN is self clearing */ -+ if (priv->type != BOSCH_D_CAN) -+ priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED); -+ } else { -+ /* no change detected ... */ -+ curr = last; -+ } - - /* handle state changes */ - if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) { -@@ -1083,10 +1092,16 @@ static irqreturn_t c_can_isr(int irq, void *dev_id) - { - struct net_device *dev = (struct net_device *)dev_id; - struct c_can_priv *priv = netdev_priv(dev); -+ int reg_int; - -- if (!priv->read_reg(priv, C_CAN_INT_REG)) -+ reg_int = priv->read_reg(priv, C_CAN_INT_REG); -+ if (!reg_int) - return IRQ_NONE; - -+ /* save for later use */ -+ if (reg_int & INT_STS_PENDING) -+ atomic_set(&priv->sie_pending, 1); -+ - /* disable all interrupts and schedule the NAPI */ - c_can_irq_control(priv, false); - napi_schedule(&priv->napi); -diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h -index 8acdc7fa4792..d5567a7c1c6d 100644 ---- a/drivers/net/can/c_can/c_can.h -+++ b/drivers/net/can/c_can/c_can.h -@@ -198,6 +198,7 @@ struct c_can_priv { - struct net_device *dev; - struct device *device; - atomic_t tx_active; -+ atomic_t sie_pending; - unsigned long tx_dir; - int last_status; - u16 (*read_reg) (const struct c_can_priv *priv, enum reg index); -diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c -index baef09b9449f..6b866d0451b2 100644 ---- a/drivers/net/can/flexcan.c -+++ b/drivers/net/can/flexcan.c -@@ -923,6 +923,7 @@ static int flexcan_chip_start(struct net_device *dev) - reg_mecr = flexcan_read(®s->mecr); - reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS; - flexcan_write(reg_mecr, ®s->mecr); -+ reg_mecr |= FLEXCAN_MECR_ECCDIS; - reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK | - FLEXCAN_MECR_FANCEI_MSK); - flexcan_write(reg_mecr, ®s->mecr); -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index b227f81e4a7e..6982ab8777b7 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -617,6 +617,7 @@ static int gs_can_open(struct net_device *netdev) - rc); - - usb_unanchor_urb(urb); -+ usb_free_urb(urb); - break; - } - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c -index 838545ce468d..e626c2afbbb1 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c -@@ -108,7 +108,7 @@ struct pcan_usb_msg_context { - u8 *end; - u8 rec_cnt; - u8 rec_idx; -- u8 rec_data_idx; -+ u8 rec_ts_idx; - struct net_device *netdev; - struct pcan_usb *pdev; - }; -@@ -552,10 +552,15 @@ static int pcan_usb_decode_status(struct pcan_usb_msg_context *mc, - mc->ptr += PCAN_USB_CMD_ARGS; - - if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) { -- int err = pcan_usb_decode_ts(mc, !mc->rec_idx); -+ int err = pcan_usb_decode_ts(mc, !mc->rec_ts_idx); - - if (err) - return err; -+ -+ /* Next packet in the buffer will have a timestamp on a single -+ * byte -+ */ -+ mc->rec_ts_idx++; - } - - switch (f) { -@@ -638,10 +643,13 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len) - - cf->can_dlc = get_can_dlc(rec_len); - -- /* first data packet timestamp is a word */ -- if (pcan_usb_decode_ts(mc, !mc->rec_data_idx)) -+ /* Only first packet timestamp is a word */ -+ if (pcan_usb_decode_ts(mc, !mc->rec_ts_idx)) - goto decode_failed; - -+ /* Next packet in the buffer will have a timestamp on a single byte */ -+ mc->rec_ts_idx++; -+ - /* read data */ - memset(cf->data, 0x0, sizeof(cf->data)); - if (status_len & PCAN_USB_STATUSLEN_RTR) { -@@ -695,7 +703,6 @@ static int pcan_usb_decode_msg(struct peak_usb_device *dev, u8 *ibuf, u32 lbuf) - /* handle normal can frames here */ - } else { - err = pcan_usb_decode_data(&mc, sl); -- mc.rec_data_idx++; - } - } - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -index b1d68f49b398..8c47cc8dc896 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c -@@ -776,7 +776,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, - dev = netdev_priv(netdev); - - /* allocate a buffer large enough to send commands */ -- dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL); -+ dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL); - if (!dev->cmd_buf) { - err = -ENOMEM; - goto lbl_free_candev; -diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c -index 522286cc0f9c..50d9b945089e 100644 ---- a/drivers/net/can/usb/usb_8dev.c -+++ b/drivers/net/can/usb/usb_8dev.c -@@ -1010,9 +1010,8 @@ static void usb_8dev_disconnect(struct usb_interface *intf) - netdev_info(priv->netdev, "device disconnected\n"); - - unregister_netdev(priv->netdev); -- free_candev(priv->netdev); -- - unlink_all_urbs(priv); -+ free_candev(priv->netdev); - } - - } -diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c -index e8b7dc1bcfa6..2a7dfac20546 100644 ---- a/drivers/net/ethernet/hisilicon/hip04_eth.c -+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c -@@ -950,7 +950,6 @@ static int hip04_remove(struct platform_device *pdev) - - hip04_free_ring(ndev, d); - unregister_netdev(ndev); -- free_irq(ndev->irq, ndev); - of_node_put(priv->phy_node); - cancel_work_sync(&priv->tx_timeout_task); - free_netdev(ndev); -diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -index d70b2e5d5222..cbb0bdf85177 100644 ---- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c -@@ -628,6 +628,7 @@ static int e1000_set_ringparam(struct net_device *netdev, - for (i = 0; i < adapter->num_rx_queues; i++) - rxdr[i].count = rxdr->count; - -+ err = 0; - if (netif_running(adapter->netdev)) { - /* Try to get new resources before deleting old */ - err = e1000_setup_all_rx_resources(adapter); -@@ -648,14 +649,13 @@ static int e1000_set_ringparam(struct net_device *netdev, - adapter->rx_ring = rxdr; - adapter->tx_ring = txdr; - err = e1000_up(adapter); -- if (err) -- goto err_setup; - } - kfree(tx_old); - kfree(rx_old); - - clear_bit(__E1000_RESETTING, &adapter->flags); -- return 0; -+ return err; -+ - err_setup_tx: - e1000_free_all_rx_resources(adapter); - err_setup_rx: -@@ -667,7 +667,6 @@ static int e1000_set_ringparam(struct net_device *netdev, - err_alloc_tx: - if (netif_running(adapter->netdev)) - e1000_up(adapter); --err_setup: - clear_bit(__E1000_RESETTING, &adapter->flags); - return err; - } -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 70ed5e5c3514..9404f38d9d0d 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -1673,7 +1673,8 @@ static void igb_check_swap_media(struct igb_adapter *adapter) - if ((hw->phy.media_type == e1000_media_type_copper) && - (!(connsw & E1000_CONNSW_AUTOSENSE_EN))) { - swap_now = true; -- } else if (!(connsw & E1000_CONNSW_SERDESD)) { -+ } else if ((hw->phy.media_type != e1000_media_type_copper) && -+ !(connsw & E1000_CONNSW_SERDESD)) { - /* copper signal takes time to appear */ - if (adapter->copper_tries < 4) { - adapter->copper_tries++; -diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c -index f4657a2e730a..8b63c9d183a2 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_main.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c -@@ -1465,8 +1465,16 @@ enum qede_remove_mode { - static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode) - { - struct net_device *ndev = pci_get_drvdata(pdev); -- struct qede_dev *edev = netdev_priv(ndev); -- struct qed_dev *cdev = edev->cdev; -+ struct qede_dev *edev; -+ struct qed_dev *cdev; -+ -+ if (!ndev) { -+ dev_info(&pdev->dev, "Device has already been removed\n"); -+ return; -+ } -+ -+ edev = netdev_priv(ndev); -+ cdev = edev->cdev; - - DP_INFO(edev, "Starting qede_remove\n"); - -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index 442efbccd005..71ef895b4dca 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -533,8 +533,8 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size) - /* read current mtu value from device */ - err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE, - USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE, -- 0, iface_no, &max_datagram_size, 2); -- if (err < 0) { -+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size)); -+ if (err < sizeof(max_datagram_size)) { - dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n"); - goto out; - } -@@ -545,7 +545,7 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size) - max_datagram_size = cpu_to_le16(ctx->max_datagram_size); - err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE, - USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE, -- 0, iface_no, &max_datagram_size, 2); -+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size)); - if (err < 0) - dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n"); - -diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c -index 2d043415f326..dc2f3d5b2a36 100644 ---- a/drivers/nfc/fdp/i2c.c -+++ b/drivers/nfc/fdp/i2c.c -@@ -278,7 +278,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, - *fw_vsc_cfg, len); - - if (r) { -- devm_kfree(dev, fw_vsc_cfg); -+ devm_kfree(dev, *fw_vsc_cfg); - goto vsc_read_err; - } - } else { -diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c -index dd8b150fbffa..1826cd330468 100644 ---- a/drivers/nfc/st21nfca/core.c -+++ b/drivers/nfc/st21nfca/core.c -@@ -726,6 +726,7 @@ static int st21nfca_hci_complete_target_discovered(struct nfc_hci_dev *hdev, - NFC_PROTO_FELICA_MASK; - } else { - kfree_skb(nfcid_skb); -+ nfcid_skb = NULL; - /* P2P in type A */ - r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_F_GATE, - ST21NFCA_RF_READER_F_NFCID1, -diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c -index 30323114c53c..9865793b538a 100644 ---- a/drivers/pci/host/pci-tegra.c -+++ b/drivers/pci/host/pci-tegra.c -@@ -586,12 +586,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_fixup_class); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_fixup_class); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_fixup_class); - --/* Tegra PCIE requires relaxed ordering */ -+/* Tegra20 and Tegra30 PCIE requires relaxed ordering */ - static void tegra_pcie_relax_enable(struct pci_dev *dev) - { - pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN); - } --DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, tegra_pcie_relax_enable); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf0, tegra_pcie_relax_enable); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_relax_enable); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_relax_enable); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_relax_enable); - - static int tegra_pcie_setup(int nr, struct pci_sys_data *sys) - { -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 193733e8c823..3a4613f9fb9f 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -759,9 +759,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) - - if (!(vport->fc_flag & FC_PT2PT)) { - /* Check config parameter use-adisc or FCP-2 */ -- if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) || -+ if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) || - ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) && -- (ndlp->nlp_type & NLP_FCP_TARGET))) { -+ (ndlp->nlp_type & NLP_FCP_TARGET)))) { - spin_lock_irq(shost->host_lock); - ndlp->nlp_flag |= NLP_NPR_ADISC; - spin_unlock_irq(shost->host_lock); -diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c -index c26acde797f0..2d5375d67736 100644 ---- a/drivers/scsi/qla2xxx/qla_bsg.c -+++ b/drivers/scsi/qla2xxx/qla_bsg.c -@@ -252,7 +252,7 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job) - srb_t *sp; - const char *type; - int req_sg_cnt, rsp_sg_cnt; -- int rval = (DRIVER_ERROR << 16); -+ int rval = (DID_ERROR << 16); - uint16_t nextlid = 0; - - if (bsg_job->request->msgcode == FC_BSG_RPT_ELS) { -@@ -426,7 +426,7 @@ qla2x00_process_ct(struct fc_bsg_job *bsg_job) - struct Scsi_Host *host = bsg_job->shost; - scsi_qla_host_t *vha = shost_priv(host); - struct qla_hw_data *ha = vha->hw; -- int rval = (DRIVER_ERROR << 16); -+ int rval = (DID_ERROR << 16); - int req_sg_cnt, rsp_sg_cnt; - uint16_t loop_id; - struct fc_port *fcport; -@@ -1910,7 +1910,7 @@ qlafx00_mgmt_cmd(struct fc_bsg_job *bsg_job) - struct Scsi_Host *host = bsg_job->shost; - scsi_qla_host_t *vha = shost_priv(host); - struct qla_hw_data *ha = vha->hw; -- int rval = (DRIVER_ERROR << 16); -+ int rval = (DID_ERROR << 16); - struct qla_mt_iocb_rqst_fx00 *piocb_rqst; - srb_t *sp; - int req_sg_cnt = 0, rsp_sg_cnt = 0; -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index ff5df33fc740..611a127f08d8 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2962,6 +2962,10 @@ qla2x00_shutdown(struct pci_dev *pdev) - /* Stop currently executing firmware. */ - qla2x00_try_to_stop_firmware(vha); - -+ /* Disable timer */ -+ if (vha->timer_active) -+ qla2x00_stop_timer(vha); -+ - /* Turn adapter off line */ - vha->flags.online = 0; - -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 5abc4e5434ec..cbd064fae23b 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -314,6 +314,11 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - - /* Validate the wMaxPacketSize field */ - maxp = usb_endpoint_maxp(&endpoint->desc); -+ if (maxp == 0) { -+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", -+ cfgno, inum, asnum, d->bEndpointAddress); -+ goto skip_to_next_endpoint_or_interface_descriptor; -+ } - - /* Find the highest legal maxpacket size for this endpoint */ - i = 0; /* additional transactions per microframe */ -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 26820742ffad..9da398ab58c4 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -2078,6 +2078,7 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev) - usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req); - - kfree(cdev->os_desc_req->buf); -+ cdev->os_desc_req->buf = NULL; - usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req); - cdev->os_desc_req = NULL; - } -@@ -2086,6 +2087,7 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev) - usb_ep_dequeue(cdev->gadget->ep0, cdev->req); - - kfree(cdev->req->buf); -+ cdev->req->buf = NULL; - usb_ep_free_request(cdev->gadget->ep0, cdev->req); - cdev->req = NULL; - } -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 567be635a458..ef05801a84db 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -87,6 +87,8 @@ struct gadget_info { - bool use_os_desc; - char b_vendor_code; - char qw_sign[OS_STRING_QW_SIGN_LEN]; -+ spinlock_t spinlock; -+ bool unbind; - #ifdef CONFIG_USB_CONFIGFS_UEVENT - bool connected; - bool sw_connected; -@@ -1280,6 +1282,7 @@ static int configfs_composite_bind(struct usb_gadget *gadget, - int ret; - - /* the gi->lock is hold by the caller */ -+ gi->unbind = 0; - cdev->gadget = gadget; - set_gadget_data(gadget, cdev); - ret = composite_dev_prepare(composite, cdev); -@@ -1466,19 +1469,118 @@ static void configfs_composite_unbind(struct usb_gadget *gadget) - { - struct usb_composite_dev *cdev; - struct gadget_info *gi; -+ unsigned long flags; - - /* the gi->lock is hold by the caller */ - - cdev = get_gadget_data(gadget); - gi = container_of(cdev, struct gadget_info, cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); -+ gi->unbind = 1; -+ spin_unlock_irqrestore(&gi->spinlock, flags); - - kfree(otg_desc[0]); - otg_desc[0] = NULL; - purge_configs_funcs(gi); - composite_dev_cleanup(cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); - usb_ep_autoconfig_reset(cdev->gadget); - cdev->gadget = NULL; - set_gadget_data(gadget, NULL); -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+} -+ -+#ifndef CONFIG_USB_CONFIGFS_UEVENT -+static int configfs_composite_setup(struct usb_gadget *gadget, -+ const struct usb_ctrlrequest *ctrl) -+{ -+ struct usb_composite_dev *cdev; -+ struct gadget_info *gi; -+ unsigned long flags; -+ int ret; -+ -+ cdev = get_gadget_data(gadget); -+ if (!cdev) -+ return 0; -+ -+ gi = container_of(cdev, struct gadget_info, cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); -+ cdev = get_gadget_data(gadget); -+ if (!cdev || gi->unbind) { -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+ return 0; -+ } -+ -+ ret = composite_setup(gadget, ctrl); -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+ return ret; -+} -+ -+static void configfs_composite_disconnect(struct usb_gadget *gadget) -+{ -+ struct usb_composite_dev *cdev; -+ struct gadget_info *gi; -+ unsigned long flags; -+ -+ cdev = get_gadget_data(gadget); -+ if (!cdev) -+ return; -+ -+ gi = container_of(cdev, struct gadget_info, cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); -+ cdev = get_gadget_data(gadget); -+ if (!cdev || gi->unbind) { -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+ return; -+ } -+ -+ composite_disconnect(gadget); -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+} -+#endif // CONFIG_USB_CONFIGFS_UEVENT -+ -+static void configfs_composite_suspend(struct usb_gadget *gadget) -+{ -+ struct usb_composite_dev *cdev; -+ struct gadget_info *gi; -+ unsigned long flags; -+ -+ cdev = get_gadget_data(gadget); -+ if (!cdev) -+ return; -+ -+ gi = container_of(cdev, struct gadget_info, cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); -+ cdev = get_gadget_data(gadget); -+ if (!cdev || gi->unbind) { -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+ return; -+ } -+ -+ composite_suspend(gadget); -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+} -+ -+static void configfs_composite_resume(struct usb_gadget *gadget) -+{ -+ struct usb_composite_dev *cdev; -+ struct gadget_info *gi; -+ unsigned long flags; -+ -+ cdev = get_gadget_data(gadget); -+ if (!cdev) -+ return; -+ -+ gi = container_of(cdev, struct gadget_info, cdev); -+ spin_lock_irqsave(&gi->spinlock, flags); -+ cdev = get_gadget_data(gadget); -+ if (!cdev || gi->unbind) { -+ spin_unlock_irqrestore(&gi->spinlock, flags); -+ return; -+ } -+ -+ composite_resume(gadget); -+ spin_unlock_irqrestore(&gi->spinlock, flags); - } - - #ifdef CONFIG_USB_CONFIGFS_UEVENT -@@ -1563,12 +1665,12 @@ static const struct usb_gadget_driver configfs_driver_template = { - .reset = android_disconnect, - .disconnect = android_disconnect, - #else -- .setup = composite_setup, -- .reset = composite_disconnect, -- .disconnect = composite_disconnect, -+ .setup = configfs_composite_setup, -+ .reset = configfs_composite_disconnect, -+ .disconnect = configfs_composite_disconnect, - #endif -- .suspend = composite_suspend, -- .resume = composite_resume, -+ .suspend = configfs_composite_suspend, -+ .resume = configfs_composite_resume, - - .max_speed = USB_SPEED_SUPER, - .driver = { -diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c -index 585cb8734f50..668ac5e8681b 100644 ---- a/drivers/usb/gadget/udc/atmel_usba_udc.c -+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c -@@ -403,9 +403,11 @@ static void submit_request(struct usba_ep *ep, struct usba_request *req) - next_fifo_transaction(ep, req); - if (req->last_transaction) { - usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY); -- usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE); -+ if (ep_is_control(ep)) -+ usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE); - } else { -- usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE); -+ if (ep_is_control(ep)) -+ usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE); - usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY); - } - } -diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c -index 8991a4070792..bd98557caa28 100644 ---- a/drivers/usb/gadget/udc/fsl_udc_core.c -+++ b/drivers/usb/gadget/udc/fsl_udc_core.c -@@ -2570,7 +2570,7 @@ static int fsl_udc_remove(struct platform_device *pdev) - dma_pool_destroy(udc_controller->td_pool); - free_irq(udc_controller->irq, udc_controller); - iounmap(dr_regs); -- if (pdata->operating_mode == FSL_USB2_DR_DEVICE) -+ if (res && (pdata->operating_mode == FSL_USB2_DR_DEVICE)) - release_mem_region(res->start, resource_size(res)); - - /* free udc --wait for the release() finished */ -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 4d68a1e9e878..3476d02967f7 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -303,6 +303,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - default: - break; - } -+ break; - default: - usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n", - wValue); -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index e137ff6cd9da..aa4df4a02252 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -926,6 +926,11 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release) - - dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode); - -+ /* remove from inode's cap rbtree, and clear auth cap */ -+ rb_erase(&cap->ci_node, &ci->i_caps); -+ if (ci->i_auth_cap == cap) -+ ci->i_auth_cap = NULL; -+ - /* remove from session list */ - spin_lock(&session->s_cap_lock); - if (session->s_cap_iterator == cap) { -@@ -961,11 +966,6 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release) - - spin_unlock(&session->s_cap_lock); - -- /* remove from inode list */ -- rb_erase(&cap->ci_node, &ci->i_caps); -- if (ci->i_auth_cap == cap) -- ci->i_auth_cap = NULL; -- - if (removed) - ceph_put_cap(mdsc, cap); - -diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c -index 66e8c5d58b21..3af565e8fd51 100644 ---- a/fs/configfs/symlink.c -+++ b/fs/configfs/symlink.c -@@ -157,11 +157,42 @@ int configfs_symlink(struct inode *dir, struct dentry *dentry, const char *symna - !type->ct_item_ops->allow_link) - goto out_put; - -+ /* -+ * This is really sick. What they wanted was a hybrid of -+ * link(2) and symlink(2) - they wanted the target resolved -+ * at syscall time (as link(2) would've done), be a directory -+ * (which link(2) would've refused to do) *AND* be a deep -+ * fucking magic, making the target busy from rmdir POV. -+ * symlink(2) is nothing of that sort, and the locking it -+ * gets matches the normal symlink(2) semantics. Without -+ * attempts to resolve the target (which might very well -+ * not even exist yet) done prior to locking the parent -+ * directory. This perversion, OTOH, needs to resolve -+ * the target, which would lead to obvious deadlocks if -+ * attempted with any directories locked. -+ * -+ * Unfortunately, that garbage is userland ABI and we should've -+ * said "no" back in 2005. Too late now, so we get to -+ * play very ugly games with locking. -+ * -+ * Try *ANYTHING* of that sort in new code, and you will -+ * really regret it. Just ask yourself - what could a BOFH -+ * do to me and do I want to find it out first-hand? -+ * -+ * AV, a thoroughly annoyed bastard. -+ */ -+ inode_unlock(dir); - ret = get_target(symname, &path, &target_item, dentry->d_sb); -+ inode_lock(dir); - if (ret) - goto out_put; - -- ret = type->ct_item_ops->allow_link(parent_item, target_item); -+ if (dentry->d_inode || d_unhashed(dentry)) -+ ret = -EEXIST; -+ else -+ ret = inode_permission(dir, MAY_WRITE | MAY_EXEC); -+ if (!ret) -+ ret = type->ct_item_ops->allow_link(parent_item, target_item); - if (!ret) { - mutex_lock(&configfs_symlink_mutex); - ret = create_link(parent_item, target_item, dentry); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index de1138e4b049..67fbe6837fdb 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -582,10 +582,13 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc, - spin_unlock(&inode->i_lock); - - /* -- * A dying wb indicates that the memcg-blkcg mapping has changed -- * and a new wb is already serving the memcg. Switch immediately. -+ * A dying wb indicates that either the blkcg associated with the -+ * memcg changed or the associated memcg is dying. In the first -+ * case, a replacement wb should already be available and we should -+ * refresh the wb immediately. In the second case, trying to -+ * refresh will keep failing. - */ -- if (unlikely(wb_dying(wbc->wb))) -+ if (unlikely(wb_dying(wbc->wb) && !css_is_dying(wbc->wb->memcg_css))) - inode_switch_wbs(inode, wbc->wb_id); - } - -diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c -index 7af5eeabc80e..5dac3382405c 100644 ---- a/fs/nfs/delegation.c -+++ b/fs/nfs/delegation.c -@@ -52,6 +52,16 @@ nfs4_is_valid_delegation(const struct nfs_delegation *delegation, - return false; - } - -+struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode) -+{ -+ struct nfs_delegation *delegation; -+ -+ delegation = rcu_dereference(NFS_I(inode)->delegation); -+ if (nfs4_is_valid_delegation(delegation, 0)) -+ return delegation; -+ return NULL; -+} -+ - static int - nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark) - { -diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h -index 333063e032f0..26a8af7bdca3 100644 ---- a/fs/nfs/delegation.h -+++ b/fs/nfs/delegation.h -@@ -58,6 +58,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state - int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, const nfs4_stateid *stateid); - bool nfs4_copy_delegation_stateid(nfs4_stateid *dst, struct inode *inode, fmode_t flags); - -+struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode); - void nfs_mark_delegation_referenced(struct nfs_delegation *delegation); - int nfs4_have_delegation(struct inode *inode, fmode_t flags); - int nfs4_check_delegation(struct inode *inode, fmode_t flags); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 900a62a9ad4e..08207001d475 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -1243,8 +1243,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode, - return 0; - if ((delegation->type & fmode) != fmode) - return 0; -- if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) -- return 0; - switch (claim) { - case NFS4_OPEN_CLAIM_NULL: - case NFS4_OPEN_CLAIM_FH: -@@ -1473,7 +1471,6 @@ static void nfs4_return_incompatible_delegation(struct inode *inode, fmode_t fmo - static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata) - { - struct nfs4_state *state = opendata->state; -- struct nfs_inode *nfsi = NFS_I(state->inode); - struct nfs_delegation *delegation; - int open_mode = opendata->o_arg.open_flags; - fmode_t fmode = opendata->o_arg.fmode; -@@ -1490,7 +1487,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata) - } - spin_unlock(&state->owner->so_lock); - rcu_read_lock(); -- delegation = rcu_dereference(nfsi->delegation); -+ delegation = nfs4_get_valid_delegation(state->inode); - if (!can_open_delegated(delegation, fmode, claim)) { - rcu_read_unlock(); - break; -@@ -1981,7 +1978,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata) - if (can_open_cached(data->state, data->o_arg.fmode, data->o_arg.open_flags)) - goto out_no_action; - rcu_read_lock(); -- delegation = rcu_dereference(NFS_I(data->state->inode)->delegation); -+ delegation = nfs4_get_valid_delegation(data->state->inode); - if (can_open_delegated(delegation, data->o_arg.fmode, claim)) - goto unlock_no_action; - rcu_read_unlock(); -diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h -index a6cc576fd467..b0156f8a9ab7 100644 ---- a/include/net/ip_vs.h -+++ b/include/net/ip_vs.h -@@ -880,6 +880,7 @@ struct netns_ipvs { - struct delayed_work defense_work; /* Work handler */ - int drop_rate; - int drop_counter; -+ int old_secure_tcp; - atomic_t dropentry; - /* locks in ctl.c */ - spinlock_t dropentry_lock; /* drop entry handling */ -diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index f6017ddc4ded..1c0d07376125 100644 ---- a/include/net/neighbour.h -+++ b/include/net/neighbour.h -@@ -425,8 +425,8 @@ static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) - { - unsigned long now = jiffies; - -- if (neigh->used != now) -- neigh->used = now; -+ if (READ_ONCE(neigh->used) != now) -+ WRITE_ONCE(neigh->used, now); - if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE))) - return __neigh_event_send(neigh, skb); - return 0; -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 4bd7508bedc9..b96df7499600 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -648,7 +648,8 @@ struct nft_expr_ops { - */ - struct nft_expr { - const struct nft_expr_ops *ops; -- unsigned char data[]; -+ unsigned char data[] -+ __attribute__((aligned(__alignof__(u64)))); - }; - - static inline void *nft_expr_priv(const struct nft_expr *expr) -diff --git a/include/net/sock.h b/include/net/sock.h -index 05052a864384..ffeea2fde415 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -2182,7 +2182,7 @@ static inline ktime_t sock_read_timestamp(struct sock *sk) - - return kt; - #else -- return sk->sk_stamp; -+ return READ_ONCE(sk->sk_stamp); - #endif - } - -@@ -2193,7 +2193,7 @@ static inline void sock_write_timestamp(struct sock *sk, ktime_t kt) - sk->sk_stamp = kt; - write_sequnlock(&sk->sk_stamp_seq); - #else -- sk->sk_stamp = kt; -+ WRITE_ONCE(sk->sk_stamp, kt); - #endif - } - -diff --git a/lib/dump_stack.c b/lib/dump_stack.c -index c30d07e99dba..72de6444934d 100644 ---- a/lib/dump_stack.c -+++ b/lib/dump_stack.c -@@ -44,7 +44,12 @@ asmlinkage __visible void dump_stack(void) - was_locked = 1; - } else { - local_irq_restore(flags); -- cpu_relax(); -+ /* -+ * Wait for the lock to release before jumping to -+ * atomic_cmpxchg() in order to mitigate the thundering herd -+ * problem. -+ */ -+ do { cpu_relax(); } while (atomic_read(&dump_lock) != -1); - goto retry; - } - -diff --git a/mm/filemap.c b/mm/filemap.c -index 38cacca05d77..2e5c8b4813fa 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -340,7 +340,8 @@ int __filemap_fdatawrite_range(struct address_space *mapping, loff_t start, - .range_end = end, - }; - -- if (!mapping_cap_writeback_dirty(mapping)) -+ if (!mapping_cap_writeback_dirty(mapping) || -+ !mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) - return 0; - - wbc_attach_fdatawrite_inode(&wbc, mapping->host); -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 59e131e82b81..9d8936c7b40d 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1589,7 +1589,7 @@ static int __init setup_vmstat(void) - #endif - #ifdef CONFIG_PROC_FS - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations); -- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops); -+ proc_create("pagetypeinfo", 0400, NULL, &pagetypeinfo_file_ops); - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations); - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations); - #endif -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index 54f3d7cb23e6..caa26184f7e3 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -1930,8 +1930,9 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) - } - - req_version->version = IPSET_PROTOCOL; -- ret = copy_to_user(user, req_version, -- sizeof(struct ip_set_req_version)); -+ if (copy_to_user(user, req_version, -+ sizeof(struct ip_set_req_version))) -+ ret = -EFAULT; - goto done; - } - case IP_SET_OP_GET_BYNAME: { -@@ -1988,7 +1989,8 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) - } /* end of switch(op) */ - - copy: -- ret = copy_to_user(user, data, copylen); -+ if (copy_to_user(user, data, copylen)) -+ ret = -EFAULT; - - done: - vfree(data); -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index 56c62b65923f..b176f76dfaa1 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -97,7 +97,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net, - static void update_defense_level(struct netns_ipvs *ipvs) - { - struct sysinfo i; -- static int old_secure_tcp = 0; - int availmem; - int nomem; - int to_change = -1; -@@ -178,35 +177,35 @@ static void update_defense_level(struct netns_ipvs *ipvs) - spin_lock(&ipvs->securetcp_lock); - switch (ipvs->sysctl_secure_tcp) { - case 0: -- if (old_secure_tcp >= 2) -+ if (ipvs->old_secure_tcp >= 2) - to_change = 0; - break; - case 1: - if (nomem) { -- if (old_secure_tcp < 2) -+ if (ipvs->old_secure_tcp < 2) - to_change = 1; - ipvs->sysctl_secure_tcp = 2; - } else { -- if (old_secure_tcp >= 2) -+ if (ipvs->old_secure_tcp >= 2) - to_change = 0; - } - break; - case 2: - if (nomem) { -- if (old_secure_tcp < 2) -+ if (ipvs->old_secure_tcp < 2) - to_change = 1; - } else { -- if (old_secure_tcp >= 2) -+ if (ipvs->old_secure_tcp >= 2) - to_change = 0; - ipvs->sysctl_secure_tcp = 1; - } - break; - case 3: -- if (old_secure_tcp < 2) -+ if (ipvs->old_secure_tcp < 2) - to_change = 1; - break; - } -- old_secure_tcp = ipvs->sysctl_secure_tcp; -+ ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp; - if (to_change >= 0) - ip_vs_protocol_timeout_change(ipvs, - ipvs->sysctl_secure_tcp > 1); -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index 80def98c9dba..04d4c388a7a8 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -1066,7 +1066,6 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info) - - local = nfc_llcp_find_local(dev); - if (!local) { -- nfc_put_device(dev); - rc = -ENODEV; - goto exit; - } -@@ -1126,7 +1125,6 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info) - - local = nfc_llcp_find_local(dev); - if (!local) { -- nfc_put_device(dev); - rc = -ENODEV; - goto exit; - } -diff --git a/sound/firewire/bebob/bebob_focusrite.c b/sound/firewire/bebob/bebob_focusrite.c -index f11090057949..d0a8736613a1 100644 ---- a/sound/firewire/bebob/bebob_focusrite.c -+++ b/sound/firewire/bebob/bebob_focusrite.c -@@ -28,6 +28,8 @@ - #define SAFFIRE_CLOCK_SOURCE_SPDIF 1 - - /* clock sources as returned from register of Saffire Pro 10 and 26 */ -+#define SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK 0x000000ff -+#define SAFFIREPRO_CLOCK_SOURCE_DETECT_MASK 0x0000ff00 - #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL 0 - #define SAFFIREPRO_CLOCK_SOURCE_SKIP 1 /* never used on hardware */ - #define SAFFIREPRO_CLOCK_SOURCE_SPDIF 2 -@@ -190,6 +192,7 @@ saffirepro_both_clk_src_get(struct snd_bebob *bebob, unsigned int *id) - map = saffirepro_clk_maps[1]; - - /* In a case that this driver cannot handle the value of register. */ -+ value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK; - if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) { - err = -EIO; - goto end; -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index c55c0131be0a..c0742ee11519 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -4440,7 +4440,7 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) - /* Delay enabling the HP amp, to let the mic-detection - * state machine run. - */ -- cancel_delayed_work_sync(&spec->unsol_hp_work); -+ cancel_delayed_work(&spec->unsol_hp_work); - schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500)); - tbl = snd_hda_jack_tbl_get(codec, cb->nid); - if (tbl) -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index f6720afa9f34..97ebd1d3646d 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -1080,7 +1080,7 @@ void hists__collapse_resort(struct hists *hists, struct ui_progress *prog) - } - } - --static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b) -+static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b) - { - struct perf_hpp_fmt *fmt; - int64_t cmp = 0; diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.201-202.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.201-202.patch deleted file mode 100644 index 43b649a5af7a..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.201-202.patch +++ /dev/null @@ -1,1159 +0,0 @@ -From fd44923862132546b4f797fbe0317205afc98b84 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Kamil=20Trzci=C5=84ski?= -Date: Sat, 23 Nov 2019 14:01:45 +0100 -Subject: [PATCH] PATCH: kernel 4.4.201-202 - ---- - .../ABI/testing/sysfs-devices-system-cpu | 2 + - Documentation/hw-vuln/tsx_async_abort.rst | 268 ++++++++++++++++++ - Documentation/kernel-parameters.txt | 62 ++++ - Documentation/x86/tsx_async_abort.rst | 117 ++++++++ - Makefile | 2 +- - arch/mips/bcm63xx/reset.c | 2 +- - arch/powerpc/Makefile | 31 +- - arch/powerpc/boot/wrapper | 24 +- - arch/x86/Kconfig | 45 +++ - arch/x86/include/asm/cpufeatures.h | 2 + - arch/x86/include/asm/kvm_host.h | 2 + - arch/x86/include/asm/msr-index.h | 16 ++ - arch/x86/include/asm/nospec-branch.h | 4 +- - arch/x86/include/asm/processor.h | 7 + - arch/x86/kernel/cpu/Makefile | 2 +- - arch/x86/kernel/cpu/bugs.c | 143 +++++++++- - arch/x86/kernel/cpu/common.c | 93 +++--- - arch/x86/kernel/cpu/cpu.h | 18 ++ - arch/x86/kernel/cpu/intel.c | 5 + - arch/x86/kernel/cpu/tsx.c | 140 +++++++++ - arch/x86/kvm/cpuid.c | 12 + - arch/x86/kvm/vmx.c | 15 - - arch/x86/kvm/x86.c | 53 +++- - drivers/base/cpu.c | 17 ++ - include/linux/cpu.h | 5 + - 25 files changed, 1018 insertions(+), 69 deletions(-) - create mode 100644 Documentation/hw-vuln/tsx_async_abort.rst - create mode 100644 Documentation/x86/tsx_async_abort.rst - create mode 100644 arch/x86/kernel/cpu/tsx.c - -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index e4cd3be77663..f97d1aaec1f9 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -279,6 +279,8 @@ What: /sys/devices/system/cpu/vulnerabilities - /sys/devices/system/cpu/vulnerabilities/spec_store_bypass - /sys/devices/system/cpu/vulnerabilities/l1tf - /sys/devices/system/cpu/vulnerabilities/mds -+ /sys/devices/system/cpu/vulnerabilities/tsx_async_abort -+ /sys/devices/system/cpu/vulnerabilities/itlb_multihit - Date: January 2018 - Contact: Linux kernel mailing list - Description: Information about CPU vulnerabilities -diff --git a/Documentation/hw-vuln/tsx_async_abort.rst b/Documentation/hw-vuln/tsx_async_abort.rst -new file mode 100644 -index 000000000000..38beda735f39 ---- /dev/null -+++ b/Documentation/hw-vuln/tsx_async_abort.rst -@@ -0,0 +1,268 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+TAA - TSX Asynchronous Abort -+====================================== -+ -+TAA is a hardware vulnerability that allows unprivileged speculative access to -+data which is available in various CPU internal buffers by using asynchronous -+aborts within an Intel TSX transactional region. -+ -+Affected processors -+------------------- -+ -+This vulnerability only affects Intel processors that support Intel -+Transactional Synchronization Extensions (TSX) when the TAA_NO bit (bit 8) -+is 0 in the IA32_ARCH_CAPABILITIES MSR. On processors where the MDS_NO bit -+(bit 5) is 0 in the IA32_ARCH_CAPABILITIES MSR, the existing MDS mitigations -+also mitigate against TAA. -+ -+Whether a processor is affected or not can be read out from the TAA -+vulnerability file in sysfs. See :ref:`tsx_async_abort_sys_info`. -+ -+Related CVEs -+------------ -+ -+The following CVE entry is related to this TAA issue: -+ -+ ============== ===== =================================================== -+ CVE-2019-11135 TAA TSX Asynchronous Abort (TAA) condition on some -+ microprocessors utilizing speculative execution may -+ allow an authenticated user to potentially enable -+ information disclosure via a side channel with -+ local access. -+ ============== ===== =================================================== -+ -+Problem -+------- -+ -+When performing store, load or L1 refill operations, processors write -+data into temporary microarchitectural structures (buffers). The data in -+those buffers can be forwarded to load operations as an optimization. -+ -+Intel TSX is an extension to the x86 instruction set architecture that adds -+hardware transactional memory support to improve performance of multi-threaded -+software. TSX lets the processor expose and exploit concurrency hidden in an -+application due to dynamically avoiding unnecessary synchronization. -+ -+TSX supports atomic memory transactions that are either committed (success) or -+aborted. During an abort, operations that happened within the transactional region -+are rolled back. An asynchronous abort takes place, among other options, when a -+different thread accesses a cache line that is also used within the transactional -+region when that access might lead to a data race. -+ -+Immediately after an uncompleted asynchronous abort, certain speculatively -+executed loads may read data from those internal buffers and pass it to dependent -+operations. This can be then used to infer the value via a cache side channel -+attack. -+ -+Because the buffers are potentially shared between Hyper-Threads cross -+Hyper-Thread attacks are possible. -+ -+The victim of a malicious actor does not need to make use of TSX. Only the -+attacker needs to begin a TSX transaction and raise an asynchronous abort -+which in turn potenitally leaks data stored in the buffers. -+ -+More detailed technical information is available in the TAA specific x86 -+architecture section: :ref:`Documentation/x86/tsx_async_abort.rst `. -+ -+ -+Attack scenarios -+---------------- -+ -+Attacks against the TAA vulnerability can be implemented from unprivileged -+applications running on hosts or guests. -+ -+As for MDS, the attacker has no control over the memory addresses that can -+be leaked. Only the victim is responsible for bringing data to the CPU. As -+a result, the malicious actor has to sample as much data as possible and -+then postprocess it to try to infer any useful information from it. -+ -+A potential attacker only has read access to the data. Also, there is no direct -+privilege escalation by using this technique. -+ -+ -+.. _tsx_async_abort_sys_info: -+ -+TAA system information -+----------------------- -+ -+The Linux kernel provides a sysfs interface to enumerate the current TAA status -+of mitigated systems. The relevant sysfs file is: -+ -+/sys/devices/system/cpu/vulnerabilities/tsx_async_abort -+ -+The possible values in this file are: -+ -+.. list-table:: -+ -+ * - 'Vulnerable' -+ - The CPU is affected by this vulnerability and the microcode and kernel mitigation are not applied. -+ * - 'Vulnerable: Clear CPU buffers attempted, no microcode' -+ - The system tries to clear the buffers but the microcode might not support the operation. -+ * - 'Mitigation: Clear CPU buffers' -+ - The microcode has been updated to clear the buffers. TSX is still enabled. -+ * - 'Mitigation: TSX disabled' -+ - TSX is disabled. -+ * - 'Not affected' -+ - The CPU is not affected by this issue. -+ -+.. _ucode_needed: -+ -+Best effort mitigation mode -+^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+If the processor is vulnerable, but the availability of the microcode-based -+mitigation mechanism is not advertised via CPUID the kernel selects a best -+effort mitigation mode. This mode invokes the mitigation instructions -+without a guarantee that they clear the CPU buffers. -+ -+This is done to address virtualization scenarios where the host has the -+microcode update applied, but the hypervisor is not yet updated to expose the -+CPUID to the guest. If the host has updated microcode the protection takes -+effect; otherwise a few CPU cycles are wasted pointlessly. -+ -+The state in the tsx_async_abort sysfs file reflects this situation -+accordingly. -+ -+ -+Mitigation mechanism -+-------------------- -+ -+The kernel detects the affected CPUs and the presence of the microcode which is -+required. If a CPU is affected and the microcode is available, then the kernel -+enables the mitigation by default. -+ -+ -+The mitigation can be controlled at boot time via a kernel command line option. -+See :ref:`taa_mitigation_control_command_line`. -+ -+.. _virt_mechanism: -+ -+Virtualization mitigation -+^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+Affected systems where the host has TAA microcode and TAA is mitigated by -+having disabled TSX previously, are not vulnerable regardless of the status -+of the VMs. -+ -+In all other cases, if the host either does not have the TAA microcode or -+the kernel is not mitigated, the system might be vulnerable. -+ -+ -+.. _taa_mitigation_control_command_line: -+ -+Mitigation control on the kernel command line -+--------------------------------------------- -+ -+The kernel command line allows to control the TAA mitigations at boot time with -+the option "tsx_async_abort=". The valid arguments for this option are: -+ -+ ============ ============================================================= -+ off This option disables the TAA mitigation on affected platforms. -+ If the system has TSX enabled (see next parameter) and the CPU -+ is affected, the system is vulnerable. -+ -+ full TAA mitigation is enabled. If TSX is enabled, on an affected -+ system it will clear CPU buffers on ring transitions. On -+ systems which are MDS-affected and deploy MDS mitigation, -+ TAA is also mitigated. Specifying this option on those -+ systems will have no effect. -+ ============ ============================================================= -+ -+Not specifying this option is equivalent to "tsx_async_abort=full". -+ -+The kernel command line also allows to control the TSX feature using the -+parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used -+to control the TSX feature and the enumeration of the TSX feature bits (RTM -+and HLE) in CPUID. -+ -+The valid options are: -+ -+ ============ ============================================================= -+ off Disables TSX on the system. -+ -+ Note that this option takes effect only on newer CPUs which are -+ not vulnerable to MDS, i.e., have MSR_IA32_ARCH_CAPABILITIES.MDS_NO=1 -+ and which get the new IA32_TSX_CTRL MSR through a microcode -+ update. This new MSR allows for the reliable deactivation of -+ the TSX functionality. -+ -+ on Enables TSX. -+ -+ Although there are mitigations for all known security -+ vulnerabilities, TSX has been known to be an accelerator for -+ several previous speculation-related CVEs, and so there may be -+ unknown security risks associated with leaving it enabled. -+ -+ auto Disables TSX if X86_BUG_TAA is present, otherwise enables TSX -+ on the system. -+ ============ ============================================================= -+ -+Not specifying this option is equivalent to "tsx=off". -+ -+The following combinations of the "tsx_async_abort" and "tsx" are possible. For -+affected platforms tsx=auto is equivalent to tsx=off and the result will be: -+ -+ ========= ========================== ========================================= -+ tsx=on tsx_async_abort=full The system will use VERW to clear CPU -+ buffers. Cross-thread attacks are still -+ possible on SMT machines. -+ tsx=on tsx_async_abort=off The system is vulnerable. -+ tsx=off tsx_async_abort=full TSX might be disabled if microcode -+ provides a TSX control MSR. If so, -+ system is not vulnerable. -+ tsx=off tsx_async_abort=off ditto -+ ========= ========================== ========================================= -+ -+ -+For unaffected platforms "tsx=on" and "tsx_async_abort=full" does not clear CPU -+buffers. For platforms without TSX control (MSR_IA32_ARCH_CAPABILITIES.MDS_NO=0) -+"tsx" command line argument has no effect. -+ -+For the affected platforms below table indicates the mitigation status for the -+combinations of CPUID bit MD_CLEAR and IA32_ARCH_CAPABILITIES MSR bits MDS_NO -+and TSX_CTRL_MSR. -+ -+ ======= ========= ============= ======================================== -+ MDS_NO MD_CLEAR TSX_CTRL_MSR Status -+ ======= ========= ============= ======================================== -+ 0 0 0 Vulnerable (needs microcode) -+ 0 1 0 MDS and TAA mitigated via VERW -+ 1 1 0 MDS fixed, TAA vulnerable if TSX enabled -+ because MD_CLEAR has no meaning and -+ VERW is not guaranteed to clear buffers -+ 1 X 1 MDS fixed, TAA can be mitigated by -+ VERW or TSX_CTRL_MSR -+ ======= ========= ============= ======================================== -+ -+Mitigation selection guide -+-------------------------- -+ -+1. Trusted userspace and guests -+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+If all user space applications are from a trusted source and do not execute -+untrusted code which is supplied externally, then the mitigation can be -+disabled. The same applies to virtualized environments with trusted guests. -+ -+ -+2. Untrusted userspace and guests -+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -+ -+If there are untrusted applications or guests on the system, enabling TSX -+might allow a malicious actor to leak data from the host or from other -+processes running on the same physical core. -+ -+If the microcode is available and the TSX is disabled on the host, attacks -+are prevented in a virtualized environment as well, even if the VMs do not -+explicitly enable the mitigation. -+ -+ -+.. _taa_default_mitigations: -+ -+Default mitigations -+------------------- -+ -+The kernel's default action for vulnerable processors is: -+ -+ - Deploy TSX disable mitigation (tsx_async_abort=full tsx=off). -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 3ba53bdf6a46..28624733074c 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2230,6 +2230,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - spectre_v2_user=off [X86] - spec_store_bypass_disable=off [X86] - mds=off [X86] -+ tsx_async_abort=off [X86] - - auto (default) - Mitigate all CPU vulnerabilities, but leave SMT -@@ -4130,6 +4131,67 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - platforms where RDTSC is slow and this accounting - can add overhead. - -+ tsx= [X86] Control Transactional Synchronization -+ Extensions (TSX) feature in Intel processors that -+ support TSX control. -+ -+ This parameter controls the TSX feature. The options are: -+ -+ on - Enable TSX on the system. Although there are -+ mitigations for all known security vulnerabilities, -+ TSX has been known to be an accelerator for -+ several previous speculation-related CVEs, and -+ so there may be unknown security risks associated -+ with leaving it enabled. -+ -+ off - Disable TSX on the system. (Note that this -+ option takes effect only on newer CPUs which are -+ not vulnerable to MDS, i.e., have -+ MSR_IA32_ARCH_CAPABILITIES.MDS_NO=1 and which get -+ the new IA32_TSX_CTRL MSR through a microcode -+ update. This new MSR allows for the reliable -+ deactivation of the TSX functionality.) -+ -+ auto - Disable TSX if X86_BUG_TAA is present, -+ otherwise enable TSX on the system. -+ -+ Not specifying this option is equivalent to tsx=off. -+ -+ See Documentation/hw-vuln/tsx_async_abort.rst -+ for more details. -+ -+ tsx_async_abort= [X86,INTEL] Control mitigation for the TSX Async -+ Abort (TAA) vulnerability. -+ -+ Similar to Micro-architectural Data Sampling (MDS) -+ certain CPUs that support Transactional -+ Synchronization Extensions (TSX) are vulnerable to an -+ exploit against CPU internal buffers which can forward -+ information to a disclosure gadget under certain -+ conditions. -+ -+ In vulnerable processors, the speculatively forwarded -+ data can be used in a cache side channel attack, to -+ access data to which the attacker does not have direct -+ access. -+ -+ This parameter controls the TAA mitigation. The -+ options are: -+ -+ full - Enable TAA mitigation on vulnerable CPUs -+ if TSX is enabled. -+ -+ off - Unconditionally disable TAA mitigation -+ -+ Not specifying this option is equivalent to -+ tsx_async_abort=full. On CPUs which are MDS affected -+ and deploy MDS mitigation, TAA mitigation is not -+ required and doesn't provide any additional -+ mitigation. -+ -+ For details see: -+ Documentation/hw-vuln/tsx_async_abort.rst -+ - turbografx.map[2|3]= [HW,JOY] - TurboGraFX parallel port interface - Format: -diff --git a/Documentation/x86/tsx_async_abort.rst b/Documentation/x86/tsx_async_abort.rst -new file mode 100644 -index 000000000000..4a4336a89372 ---- /dev/null -+++ b/Documentation/x86/tsx_async_abort.rst -@@ -0,0 +1,117 @@ -+.. SPDX-License-Identifier: GPL-2.0 -+ -+TSX Async Abort (TAA) mitigation -+================================ -+ -+.. _tsx_async_abort: -+ -+Overview -+-------- -+ -+TSX Async Abort (TAA) is a side channel attack on internal buffers in some -+Intel processors similar to Microachitectural Data Sampling (MDS). In this -+case certain loads may speculatively pass invalid data to dependent operations -+when an asynchronous abort condition is pending in a Transactional -+Synchronization Extensions (TSX) transaction. This includes loads with no -+fault or assist condition. Such loads may speculatively expose stale data from -+the same uarch data structures as in MDS, with same scope of exposure i.e. -+same-thread and cross-thread. This issue affects all current processors that -+support TSX. -+ -+Mitigation strategy -+------------------- -+ -+a) TSX disable - one of the mitigations is to disable TSX. A new MSR -+IA32_TSX_CTRL will be available in future and current processors after -+microcode update which can be used to disable TSX. In addition, it -+controls the enumeration of the TSX feature bits (RTM and HLE) in CPUID. -+ -+b) Clear CPU buffers - similar to MDS, clearing the CPU buffers mitigates this -+vulnerability. More details on this approach can be found in -+:ref:`Documentation/hw-vuln/mds.rst `. -+ -+Kernel internal mitigation modes -+-------------------------------- -+ -+ ============= ============================================================ -+ off Mitigation is disabled. Either the CPU is not affected or -+ tsx_async_abort=off is supplied on the kernel command line. -+ -+ tsx disabled Mitigation is enabled. TSX feature is disabled by default at -+ bootup on processors that support TSX control. -+ -+ verw Mitigation is enabled. CPU is affected and MD_CLEAR is -+ advertised in CPUID. -+ -+ ucode needed Mitigation is enabled. CPU is affected and MD_CLEAR is not -+ advertised in CPUID. That is mainly for virtualization -+ scenarios where the host has the updated microcode but the -+ hypervisor does not expose MD_CLEAR in CPUID. It's a best -+ effort approach without guarantee. -+ ============= ============================================================ -+ -+If the CPU is affected and the "tsx_async_abort" kernel command line parameter is -+not provided then the kernel selects an appropriate mitigation depending on the -+status of RTM and MD_CLEAR CPUID bits. -+ -+Below tables indicate the impact of tsx=on|off|auto cmdline options on state of -+TAA mitigation, VERW behavior and TSX feature for various combinations of -+MSR_IA32_ARCH_CAPABILITIES bits. -+ -+1. "tsx=off" -+ -+========= ========= ============ ============ ============== =================== ====================== -+MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=off -+---------------------------------- ------------------------------------------------------------------------- -+TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation -+ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full -+========= ========= ============ ============ ============== =================== ====================== -+ 0 0 0 HW default Yes Same as MDS Same as MDS -+ 0 0 1 Invalid case Invalid case Invalid case Invalid case -+ 0 1 0 HW default No Need ucode update Need ucode update -+ 0 1 1 Disabled Yes TSX disabled TSX disabled -+ 1 X 1 Disabled X None needed None needed -+========= ========= ============ ============ ============== =================== ====================== -+ -+2. "tsx=on" -+ -+========= ========= ============ ============ ============== =================== ====================== -+MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=on -+---------------------------------- ------------------------------------------------------------------------- -+TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation -+ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full -+========= ========= ============ ============ ============== =================== ====================== -+ 0 0 0 HW default Yes Same as MDS Same as MDS -+ 0 0 1 Invalid case Invalid case Invalid case Invalid case -+ 0 1 0 HW default No Need ucode update Need ucode update -+ 0 1 1 Enabled Yes None Same as MDS -+ 1 X 1 Enabled X None needed None needed -+========= ========= ============ ============ ============== =================== ====================== -+ -+3. "tsx=auto" -+ -+========= ========= ============ ============ ============== =================== ====================== -+MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=auto -+---------------------------------- ------------------------------------------------------------------------- -+TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation -+ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full -+========= ========= ============ ============ ============== =================== ====================== -+ 0 0 0 HW default Yes Same as MDS Same as MDS -+ 0 0 1 Invalid case Invalid case Invalid case Invalid case -+ 0 1 0 HW default No Need ucode update Need ucode update -+ 0 1 1 Disabled Yes TSX disabled TSX disabled -+ 1 X 1 Enabled X None needed None needed -+========= ========= ============ ============ ============== =================== ====================== -+ -+In the tables, TSX_CTRL_MSR is a new bit in MSR_IA32_ARCH_CAPABILITIES that -+indicates whether MSR_IA32_TSX_CTRL is supported. -+ -+There are two control bits in IA32_TSX_CTRL MSR: -+ -+ Bit 0: When set it disables the Restricted Transactional Memory (RTM) -+ sub-feature of TSX (will force all transactions to abort on the -+ XBEGIN instruction). -+ -+ Bit 1: When set it disables the enumeration of the RTM and HLE feature -+ (i.e. it will make CPUID(EAX=7).EBX{bit4} and -+ CPUID(EAX=7).EBX{bit11} read as 0). -diff --git a/Makefile b/Makefile -index 0a360d57afd5..4fb61874d20f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 201 -+SUBLEVEL = 202 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/bcm63xx/reset.c b/arch/mips/bcm63xx/reset.c -index d1fe51edf5e6..4d411da2497b 100644 ---- a/arch/mips/bcm63xx/reset.c -+++ b/arch/mips/bcm63xx/reset.c -@@ -119,7 +119,7 @@ - #define BCM6368_RESET_DSL 0 - #define BCM6368_RESET_SAR SOFTRESET_6368_SAR_MASK - #define BCM6368_RESET_EPHY SOFTRESET_6368_EPHY_MASK --#define BCM6368_RESET_ENETSW 0 -+#define BCM6368_RESET_ENETSW SOFTRESET_6368_ENETSW_MASK - #define BCM6368_RESET_PCM SOFTRESET_6368_PCM_MASK - #define BCM6368_RESET_MPI SOFTRESET_6368_MPI_MASK - #define BCM6368_RESET_PCIE 0 -diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile -index 96efd8213c1c..d7eb035a9c96 100644 ---- a/arch/powerpc/Makefile -+++ b/arch/powerpc/Makefile -@@ -66,29 +66,35 @@ endif - UTS_MACHINE := $(OLDARCH) - - ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) --override CC += -mlittle-endian --ifneq ($(cc-name),clang) --override CC += -mno-strict-align --endif --override AS += -mlittle-endian - override LD += -EL --override CROSS32CC += -mlittle-endian - override CROSS32AS += -mlittle-endian - LDEMULATION := lppc - GNUTARGET := powerpcle - MULTIPLEWORD := -mno-multiple - KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-save-toc-indirect) - else --ifeq ($(call cc-option-yn,-mbig-endian),y) --override CC += -mbig-endian --override AS += -mbig-endian --endif - override LD += -EB - LDEMULATION := ppc - GNUTARGET := powerpc - MULTIPLEWORD := -mmultiple - endif - -+ifdef CONFIG_PPC64 -+cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) -+cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc) -+aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1) -+aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2 -+endif -+ -+cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian -+cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mbig-endian) -+ifneq ($(cc-name),clang) -+ cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align -+endif -+ -+aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mbig-endian) -+aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian -+ - ifeq ($(HAS_BIARCH),y) - override AS += -a$(CONFIG_WORD_SIZE) - override LD += -m elf$(CONFIG_WORD_SIZE)$(LDEMULATION) -@@ -121,7 +127,9 @@ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) - CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc)) - AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2) - else -+CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) - CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc) -+AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1) - endif - CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc)) - CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions) -@@ -212,6 +220,9 @@ cpu-as-$(CONFIG_E200) += -Wa,-me200 - KBUILD_AFLAGS += $(cpu-as-y) - KBUILD_CFLAGS += $(cpu-as-y) - -+KBUILD_AFLAGS += $(aflags-y) -+KBUILD_CFLAGS += $(cflags-y) -+ - head-y := arch/powerpc/kernel/head_$(CONFIG_WORD_SIZE).o - head-$(CONFIG_8xx) := arch/powerpc/kernel/head_8xx.o - head-$(CONFIG_40x) := arch/powerpc/kernel/head_40x.o -diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper -index ceaa75d5a684..be4831acda22 100755 ---- a/arch/powerpc/boot/wrapper -+++ b/arch/powerpc/boot/wrapper -@@ -161,6 +161,28 @@ case "$elfformat" in - elf32-powerpc) format=elf32ppc ;; - esac - -+ld_version() -+{ -+ # Poached from scripts/ld-version.sh, but we don't want to call that because -+ # this script (wrapper) is distributed separately from the kernel source. -+ # Extract linker version number from stdin and turn into single number. -+ awk '{ -+ gsub(".*\\)", ""); -+ gsub(".*version ", ""); -+ gsub("-.*", ""); -+ split($1,a, "."); -+ print a[1]*100000000 + a[2]*1000000 + a[3]*10000; -+ exit -+ }' -+} -+ -+# Do not include PT_INTERP segment when linking pie. Non-pie linking -+# just ignores this option. -+LD_VERSION=$(${CROSS}ld --version | ld_version) -+LD_NO_DL_MIN_VERSION=$(echo 2.26 | ld_version) -+if [ "$LD_VERSION" -ge "$LD_NO_DL_MIN_VERSION" ] ; then -+ nodl="--no-dynamic-linker" -+fi - - platformo=$object/"$platform".o - lds=$object/zImage.lds -@@ -412,7 +434,7 @@ if [ "$platform" != "miboot" ]; then - if [ -n "$link_address" ] ; then - text_start="-Ttext $link_address" - fi -- ${CROSS}ld -m $format -T $lds $text_start $pie -o "$ofile" \ -+ ${CROSS}ld -m $format -T $lds $text_start $pie $nodl -o "$ofile" \ - $platformo $tmp $object/wrapper.a - rm $tmp - fi -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 3b89af3c4fe7..551ff6a49213 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1718,6 +1718,51 @@ config X86_INTEL_MPX - - If unsure, say N. - -+choice -+ prompt "TSX enable mode" -+ depends on CPU_SUP_INTEL -+ default X86_INTEL_TSX_MODE_OFF -+ help -+ Intel's TSX (Transactional Synchronization Extensions) feature -+ allows to optimize locking protocols through lock elision which -+ can lead to a noticeable performance boost. -+ -+ On the other hand it has been shown that TSX can be exploited -+ to form side channel attacks (e.g. TAA) and chances are there -+ will be more of those attacks discovered in the future. -+ -+ Therefore TSX is not enabled by default (aka tsx=off). An admin -+ might override this decision by tsx=on the command line parameter. -+ Even with TSX enabled, the kernel will attempt to enable the best -+ possible TAA mitigation setting depending on the microcode available -+ for the particular machine. -+ -+ This option allows to set the default tsx mode between tsx=on, =off -+ and =auto. See Documentation/kernel-parameters.txt for more -+ details. -+ -+ Say off if not sure, auto if TSX is in use but it should be used on safe -+ platforms or on if TSX is in use and the security aspect of tsx is not -+ relevant. -+ -+config X86_INTEL_TSX_MODE_OFF -+ bool "off" -+ help -+ TSX is disabled if possible - equals to tsx=off command line parameter. -+ -+config X86_INTEL_TSX_MODE_ON -+ bool "on" -+ help -+ TSX is always enabled on TSX capable HW - equals the tsx=on command -+ line parameter. -+ -+config X86_INTEL_TSX_MODE_AUTO -+ bool "auto" -+ help -+ TSX is enabled on TSX capable HW that is believed to be safe against -+ side channel attacks- equals the tsx=auto command line parameter. -+endchoice -+ - config EFI - bool "EFI runtime service support" - depends on ACPI -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 39f202462029..dac449879113 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -408,6 +408,7 @@ struct kvm_vcpu_arch { - u64 smbase; - bool tpr_access_reporting; - u64 ia32_xss; -+ u64 arch_capabilities; - - /* - * Paging state of the vcpu -@@ -1226,6 +1227,7 @@ void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu); - void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm, - unsigned long address); - -+u64 kvm_get_arch_capabilities(void); - void kvm_define_shared_msr(unsigned index, u32 msr); - int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); - -diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h -index 3b19d82f7932..c42cc1acd668 100644 ---- a/arch/x86/kernel/cpu/cpu.h -+++ b/arch/x86/kernel/cpu/cpu.h -@@ -44,9 +44,27 @@ struct _tlb_table { - extern const struct cpu_dev *const __x86_cpu_dev_start[], - *const __x86_cpu_dev_end[]; - -+#ifdef CONFIG_CPU_SUP_INTEL -+enum tsx_ctrl_states { -+ TSX_CTRL_ENABLE, -+ TSX_CTRL_DISABLE, -+ TSX_CTRL_NOT_SUPPORTED, -+}; -+ -+extern enum tsx_ctrl_states tsx_ctrl_state; -+ -+extern void __init tsx_init(void); -+extern void tsx_enable(void); -+extern void tsx_disable(void); -+#else -+static inline void tsx_init(void) { } -+#endif /* CONFIG_CPU_SUP_INTEL */ -+ - extern void get_cpu_cap(struct cpuinfo_x86 *c); - extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c); - - extern void x86_spec_ctrl_setup_ap(void); - -+extern u64 x86_read_arch_cap_msr(void); -+ - #endif /* ARCH_X86_CPU_H */ -diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index b0e0c7a12e61..7beef3da5904 100644 ---- a/arch/x86/kernel/cpu/intel.c -+++ b/arch/x86/kernel/cpu/intel.c -@@ -582,6 +582,11 @@ static void init_intel(struct cpuinfo_x86 *c) - detect_vmx_virtcap(c); - - init_intel_energy_perf(c); -+ -+ if (tsx_ctrl_state == TSX_CTRL_ENABLE) -+ tsx_enable(); -+ if (tsx_ctrl_state == TSX_CTRL_DISABLE) -+ tsx_disable(); - } - - #ifdef CONFIG_X86_32 -diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c -new file mode 100644 -index 000000000000..c2a9dd816c5c ---- /dev/null -+++ b/arch/x86/kernel/cpu/tsx.c -@@ -0,0 +1,140 @@ -+// SPDX-License-Identifier: GPL-2.0 -+/* -+ * Intel Transactional Synchronization Extensions (TSX) control. -+ * -+ * Copyright (C) 2019 Intel Corporation -+ * -+ * Author: -+ * Pawan Gupta -+ */ -+ -+#include -+ -+#include -+ -+#include "cpu.h" -+ -+enum tsx_ctrl_states tsx_ctrl_state = TSX_CTRL_NOT_SUPPORTED; -+ -+void tsx_disable(void) -+{ -+ u64 tsx; -+ -+ rdmsrl(MSR_IA32_TSX_CTRL, tsx); -+ -+ /* Force all transactions to immediately abort */ -+ tsx |= TSX_CTRL_RTM_DISABLE; -+ -+ /* -+ * Ensure TSX support is not enumerated in CPUID. -+ * This is visible to userspace and will ensure they -+ * do not waste resources trying TSX transactions that -+ * will always abort. -+ */ -+ tsx |= TSX_CTRL_CPUID_CLEAR; -+ -+ wrmsrl(MSR_IA32_TSX_CTRL, tsx); -+} -+ -+void tsx_enable(void) -+{ -+ u64 tsx; -+ -+ rdmsrl(MSR_IA32_TSX_CTRL, tsx); -+ -+ /* Enable the RTM feature in the cpu */ -+ tsx &= ~TSX_CTRL_RTM_DISABLE; -+ -+ /* -+ * Ensure TSX support is enumerated in CPUID. -+ * This is visible to userspace and will ensure they -+ * can enumerate and use the TSX feature. -+ */ -+ tsx &= ~TSX_CTRL_CPUID_CLEAR; -+ -+ wrmsrl(MSR_IA32_TSX_CTRL, tsx); -+} -+ -+static bool __init tsx_ctrl_is_supported(void) -+{ -+ u64 ia32_cap = x86_read_arch_cap_msr(); -+ -+ /* -+ * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this -+ * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES. -+ * -+ * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a -+ * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES -+ * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get -+ * MSR_IA32_TSX_CTRL support even after a microcode update. Thus, -+ * tsx= cmdline requests will do nothing on CPUs without -+ * MSR_IA32_TSX_CTRL support. -+ */ -+ return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR); -+} -+ -+static enum tsx_ctrl_states x86_get_tsx_auto_mode(void) -+{ -+ if (boot_cpu_has_bug(X86_BUG_TAA)) -+ return TSX_CTRL_DISABLE; -+ -+ return TSX_CTRL_ENABLE; -+} -+ -+void __init tsx_init(void) -+{ -+ char arg[5] = {}; -+ int ret; -+ -+ if (!tsx_ctrl_is_supported()) -+ return; -+ -+ ret = cmdline_find_option(boot_command_line, "tsx", arg, sizeof(arg)); -+ if (ret >= 0) { -+ if (!strcmp(arg, "on")) { -+ tsx_ctrl_state = TSX_CTRL_ENABLE; -+ } else if (!strcmp(arg, "off")) { -+ tsx_ctrl_state = TSX_CTRL_DISABLE; -+ } else if (!strcmp(arg, "auto")) { -+ tsx_ctrl_state = x86_get_tsx_auto_mode(); -+ } else { -+ tsx_ctrl_state = TSX_CTRL_DISABLE; -+ pr_err("tsx: invalid option, defaulting to off\n"); -+ } -+ } else { -+ /* tsx= not provided */ -+ if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_AUTO)) -+ tsx_ctrl_state = x86_get_tsx_auto_mode(); -+ else if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_OFF)) -+ tsx_ctrl_state = TSX_CTRL_DISABLE; -+ else -+ tsx_ctrl_state = TSX_CTRL_ENABLE; -+ } -+ -+ if (tsx_ctrl_state == TSX_CTRL_DISABLE) { -+ tsx_disable(); -+ -+ /* -+ * tsx_disable() will change the state of the -+ * RTM CPUID bit. Clear it here since it is now -+ * expected to be not set. -+ */ -+ setup_clear_cpu_cap(X86_FEATURE_RTM); -+ } else if (tsx_ctrl_state == TSX_CTRL_ENABLE) { -+ -+ /* -+ * HW defaults TSX to be enabled at bootup. -+ * We may still need the TSX enable support -+ * during init for special cases like -+ * kexec after TSX is disabled. -+ */ -+ tsx_enable(); -+ -+ /* -+ * tsx_enable() will change the state of the -+ * RTM CPUID bit. Force it here since it is now -+ * expected to be set. -+ */ -+ setup_force_cpu_cap(X86_FEATURE_RTM); -+ } -+} -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 53918abccbc3..40e415fedcee 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -447,6 +447,18 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - entry->ebx |= F(TSC_ADJUST); - entry->edx &= kvm_cpuid_7_0_edx_x86_features; - cpuid_mask(&entry->edx, CPUID_7_EDX); -+ if (boot_cpu_has(X86_FEATURE_IBPB) && -+ boot_cpu_has(X86_FEATURE_IBRS)) -+ entry->edx |= F(SPEC_CTRL); -+ if (boot_cpu_has(X86_FEATURE_STIBP)) -+ entry->edx |= F(INTEL_STIBP); -+ if (boot_cpu_has(X86_FEATURE_SSBD)) -+ entry->edx |= F(SPEC_CTRL_SSBD); -+ /* -+ * We emulate ARCH_CAPABILITIES in software even -+ * if the host doesn't support it. -+ */ -+ entry->edx |= F(ARCH_CAPABILITIES); - } else { - entry->ebx = 0; - entry->edx = 0; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index f8f9d1b368bf..1b3a432f6fd5 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -546,7 +546,6 @@ struct vcpu_vmx { - u64 msr_guest_kernel_gs_base; - #endif - -- u64 arch_capabilities; - u64 spec_ctrl; - - u32 vm_entry_controls_shadow; -@@ -2866,12 +2865,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - - msr_info->data = to_vmx(vcpu)->spec_ctrl; - break; -- case MSR_IA32_ARCH_CAPABILITIES: -- if (!msr_info->host_initiated && -- !guest_cpuid_has_arch_capabilities(vcpu)) -- return 1; -- msr_info->data = to_vmx(vcpu)->arch_capabilities; -- break; - case MSR_IA32_SYSENTER_CS: - msr_info->data = vmcs_read32(GUEST_SYSENTER_CS); - break; -@@ -3028,11 +3021,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, - MSR_TYPE_W); - break; -- case MSR_IA32_ARCH_CAPABILITIES: -- if (!msr_info->host_initiated) -- return 1; -- vmx->arch_capabilities = data; -- break; - case MSR_IA32_CR_PAT: - if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { - if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) -@@ -5079,9 +5067,6 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) - ++vmx->nmsrs; - } - -- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) -- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, vmx->arch_capabilities); -- - vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); - - /* 22.2.1, 20.8.1 */ -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 2b47fd3d4b8c..3b711cd261d7 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -575,7 +575,7 @@ static bool pdptrs_changed(struct kvm_vcpu *vcpu) - gfn_t gfn; - int r; - -- if (is_long_mode(vcpu) || !is_pae(vcpu)) -+ if (is_long_mode(vcpu) || !is_pae(vcpu) || !is_paging(vcpu)) - return false; - - if (!test_bit(VCPU_EXREG_PDPTR, -@@ -995,6 +995,43 @@ static u32 emulated_msrs[] = { - - static unsigned num_emulated_msrs; - -+u64 kvm_get_arch_capabilities(void) -+{ -+ u64 data; -+ -+ rdmsrl_safe(MSR_IA32_ARCH_CAPABILITIES, &data); -+ -+ if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN)) -+ data |= ARCH_CAP_RDCL_NO; -+ if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS)) -+ data |= ARCH_CAP_SSB_NO; -+ if (!boot_cpu_has_bug(X86_BUG_MDS)) -+ data |= ARCH_CAP_MDS_NO; -+ -+ /* -+ * On TAA affected systems, export MDS_NO=0 when: -+ * - TSX is enabled on the host, i.e. X86_FEATURE_RTM=1. -+ * - Updated microcode is present. This is detected by -+ * the presence of ARCH_CAP_TSX_CTRL_MSR and ensures -+ * that VERW clears CPU buffers. -+ * -+ * When MDS_NO=0 is exported, guests deploy clear CPU buffer -+ * mitigation and don't complain: -+ * -+ * "Vulnerable: Clear CPU buffers attempted, no microcode" -+ * -+ * If TSX is disabled on the system, guests are also mitigated against -+ * TAA and clear CPU buffer mitigation is not required for guests. -+ */ -+ if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && -+ (data & ARCH_CAP_TSX_CTRL_MSR)) -+ data &= ~ARCH_CAP_MDS_NO; -+ -+ return data; -+} -+ -+EXPORT_SYMBOL_GPL(kvm_get_arch_capabilities); -+ - static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) - { - if (efer & EFER_FFXSR) { -@@ -2070,6 +2107,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_AMD64_BU_CFG2: - break; - -+ case MSR_IA32_ARCH_CAPABILITIES: -+ if (!msr_info->host_initiated) -+ return 1; -+ vcpu->arch.arch_capabilities = data; -+ break; - case MSR_EFER: - return set_efer(vcpu, msr_info); - case MSR_K7_HWCR: -@@ -2344,6 +2386,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - case MSR_IA32_UCODE_REV: - msr_info->data = 0x100000000ULL; - break; -+ case MSR_IA32_ARCH_CAPABILITIES: -+ if (!msr_info->host_initiated && -+ !guest_cpuid_has_arch_capabilities(vcpu)) -+ return 1; -+ msr_info->data = vcpu->arch.arch_capabilities; -+ break; - case MSR_MTRRcap: - case 0x200 ... 0x2ff: - return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data); -@@ -7168,7 +7216,7 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, - kvm_update_cpuid(vcpu); - - idx = srcu_read_lock(&vcpu->kvm->srcu); -- if (!is_long_mode(vcpu) && is_pae(vcpu)) { -+ if (!is_long_mode(vcpu) && is_pae(vcpu) && is_paging(vcpu)) { - load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu)); - mmu_reset_needed = 1; - } -@@ -7392,6 +7440,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu) - { - int r; - -+ vcpu->arch.arch_capabilities = kvm_get_arch_capabilities(); - kvm_vcpu_mtrr_init(vcpu); - r = vcpu_load(vcpu); - if (r) -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index 3934aaf9d157..9666effc0799 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -536,12 +536,27 @@ ssize_t __weak cpu_show_mds(struct device *dev, - return sprintf(buf, "Not affected\n"); - } - -+ssize_t __weak cpu_show_tsx_async_abort(struct device *dev, -+ struct device_attribute *attr, -+ char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ -+ssize_t __weak cpu_show_itlb_multihit(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ - static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); - static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); - static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); - static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL); - static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL); - static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL); -+static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL); -+static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL); - - static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_meltdown.attr, -@@ -550,6 +565,8 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = { - &dev_attr_spec_store_bypass.attr, - &dev_attr_l1tf.attr, - &dev_attr_mds.attr, -+ &dev_attr_tsx_async_abort.attr, -+ &dev_attr_itlb_multihit.attr, - NULL - }; - -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index 22ebea3b5e24..d64567b703de 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -52,6 +52,11 @@ extern ssize_t cpu_show_l1tf(struct device *dev, - struct device_attribute *attr, char *buf); - extern ssize_t cpu_show_mds(struct device *dev, - struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_tsx_async_abort(struct device *dev, -+ struct device_attribute *attr, -+ char *buf); -+extern ssize_t cpu_show_itlb_multihit(struct device *dev, -+ struct device_attribute *attr, char *buf); - - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, diff --git a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.202-203.patch b/patch/kernel/archive/rockchip-4.4/04-patch-4.4.202-203.patch deleted file mode 100644 index 4a38ce0305ca..000000000000 --- a/patch/kernel/archive/rockchip-4.4/04-patch-4.4.202-203.patch +++ /dev/null @@ -1,6275 +0,0 @@ -diff --git a/Documentation/misc-devices/mei/mei-amt-version.c b/Documentation/misc-devices/mei/mei-amt-version.c -index 57d0d871dcf7..33e67bd1dc34 100644 ---- a/Documentation/misc-devices/mei/mei-amt-version.c -+++ b/Documentation/misc-devices/mei/mei-amt-version.c -@@ -370,7 +370,7 @@ static uint32_t amt_host_if_call(struct amt_host_if *acmd, - unsigned int expected_sz) - { - uint32_t in_buf_sz; -- uint32_t out_buf_sz; -+ ssize_t out_buf_sz; - ssize_t written; - uint32_t status; - struct amt_host_if_resp_header *msg_hdr; -diff --git a/Makefile b/Makefile -index e7fecd28672e..3163f289cb52 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 202 -+SUBLEVEL = 203 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h -index 17ae0f3efac8..005bf4ff1b4c 100644 ---- a/arch/arm/boot/compressed/libfdt_env.h -+++ b/arch/arm/boot/compressed/libfdt_env.h -@@ -5,6 +5,8 @@ - #include - #include - -+#define INT_MAX ((int)(~0U>>1)) -+ - typedef __be16 fdt16_t; - typedef __be32 fdt32_t; - typedef __be64 fdt64_t; -diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts -index d9d00ab863a2..2b8614e406f0 100644 ---- a/arch/arm/boot/dts/am335x-evm.dts -+++ b/arch/arm/boot/dts/am335x-evm.dts -@@ -697,6 +697,7 @@ - pinctrl-0 = <&cpsw_default>; - pinctrl-1 = <&cpsw_sleep>; - status = "okay"; -+ slaves = <1>; - }; - - &davinci_mdio { -@@ -704,15 +705,14 @@ - pinctrl-0 = <&davinci_mdio_default>; - pinctrl-1 = <&davinci_mdio_sleep>; - status = "okay"; --}; - --&cpsw_emac0 { -- phy_id = <&davinci_mdio>, <0>; -- phy-mode = "rgmii-txid"; -+ ethphy0: ethernet-phy@0 { -+ reg = <0>; -+ }; - }; - --&cpsw_emac1 { -- phy_id = <&davinci_mdio>, <1>; -+&cpsw_emac0 { -+ phy-handle = <ðphy0>; - phy-mode = "rgmii-txid"; - }; - -diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi -index af8b708ac312..53a5a0e311e9 100644 ---- a/arch/arm/boot/dts/at91sam9g45.dtsi -+++ b/arch/arm/boot/dts/at91sam9g45.dtsi -@@ -546,7 +546,7 @@ - }; - }; - -- uart1 { -+ usart1 { - pinctrl_usart1: usart1-0 { - atmel,pins = - ; -+ -+ cpu { -+ sound-dai = <&i2s0 0>; -+ }; -+ -+ codec { -+ sound-dai = <&max98090 0>, <&hdmi>; -+ }; - }; - }; - -@@ -34,6 +42,9 @@ - interrupt-parent = <&gpx0>; - pinctrl-names = "default"; - pinctrl-0 = <&max98090_irq>; -+ clocks = <&pmu_system_controller 0>; -+ clock-names = "mclk"; -+ #sound-dai-cells = <1>; - }; - }; - -diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi -index e14d15e5abc8..acd0a9deb116 100644 ---- a/arch/arm/boot/dts/omap3-gta04.dtsi -+++ b/arch/arm/boot/dts/omap3-gta04.dtsi -@@ -28,6 +28,7 @@ - - aliases { - display0 = &lcd; -+ display1 = &tv0; - }; - - gpio-keys { -@@ -70,7 +71,7 @@ - #sound-dai-cells = <0>; - }; - -- spi_lcd { -+ spi_lcd: spi_lcd { - compatible = "spi-gpio"; - #address-cells = <0x1>; - #size-cells = <0x0>; -@@ -459,6 +460,12 @@ - regulator-max-microvolt = <3150000>; - }; - -+/* Needed to power the DPI pins */ -+ -+&vpll2 { -+ regulator-always-on; -+}; -+ - &dss { - pinctrl-names = "default"; - pinctrl-0 = < &dss_dpi_pins >; -@@ -522,22 +529,22 @@ - - bootloaders@80000 { - label = "U-Boot"; -- reg = <0x80000 0x1e0000>; -+ reg = <0x80000 0x1c0000>; - }; - -- bootloaders_env@260000 { -+ bootloaders_env@240000 { - label = "U-Boot Env"; -- reg = <0x260000 0x20000>; -+ reg = <0x240000 0x40000>; - }; - - kernel@280000 { - label = "Kernel"; -- reg = <0x280000 0x400000>; -+ reg = <0x280000 0x600000>; - }; - -- filesystem@680000 { -+ filesystem@880000 { - label = "File System"; -- reg = <0x680000 0xf980000>; -+ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */ - }; - }; - }; -diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi -index 210192c38df3..4448505e34d3 100644 ---- a/arch/arm/boot/dts/pxa27x.dtsi -+++ b/arch/arm/boot/dts/pxa27x.dtsi -@@ -63,7 +63,7 @@ - clocks = <&clks CLK_PWM1>; - }; - -- pwri2c: i2c@40f000180 { -+ pwri2c: i2c@40f00180 { - compatible = "mrvl,pxa-i2c"; - reg = <0x40f00180 0x24>; - interrupts = <6>; -diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts -index 555e9caf21e1..7b8e1c4215b5 100644 ---- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts -+++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts -@@ -88,7 +88,7 @@ - status = "okay"; - speed-mode = <0>; - -- adxl345: adxl345@0 { -+ adxl345: adxl345@53 { - compatible = "adi,adxl345"; - reg = <0x53>; - -diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi -index 50f5e9d09203..b2b23ceb6d55 100644 ---- a/arch/arm/boot/dts/ste-dbx5x0.dtsi -+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi -@@ -186,7 +186,7 @@ - <0xa0410100 0x100>; - }; - -- scu@a04100000 { -+ scu@a0410000 { - compatible = "arm,cortex-a9-scu"; - reg = <0xa0410000 0x100>; - }; -@@ -894,7 +894,7 @@ - power-domains = <&pm_domains DOMAIN_VAPE>; - }; - -- ssp@80002000 { -+ spi@80002000 { - compatible = "arm,pl022", "arm,primecell"; - reg = <0x80002000 0x1000>; - interrupts = <0 14 IRQ_TYPE_LEVEL_HIGH>; -@@ -908,7 +908,7 @@ - power-domains = <&pm_domains DOMAIN_VAPE>; - }; - -- ssp@80003000 { -+ spi@80003000 { - compatible = "arm,pl022", "arm,primecell"; - reg = <0x80003000 0x1000>; - interrupts = <0 52 IRQ_TYPE_LEVEL_HIGH>; -diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi -index 5c5cea232743..1ec193b0c506 100644 ---- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi -+++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi -@@ -607,16 +607,20 @@ - - mcde { - lcd_default_mode: lcd_default { -- default_mux { -+ default_mux1 { - /* Mux in VSI0 and all the data lines */ - function = "lcd"; - groups = - "lcdvsi0_a_1", /* VSI0 for LCD */ - "lcd_d0_d7_a_1", /* Data lines */ - "lcd_d8_d11_a_1", /* TV-out */ -- "lcdaclk_b_1", /* Clock line for TV-out */ - "lcdvsi1_a_1"; /* VSI1 for HDMI */ - }; -+ default_mux2 { -+ function = "lcda"; -+ groups = -+ "lcdaclk_b_1"; /* Clock line for TV-out */ -+ }; - default_cfg1 { - pins = - "GPIO68_E1", /* VSI0 */ -diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi -index b0278f4c486c..55a6a1ac0337 100644 ---- a/arch/arm/boot/dts/ste-hrefprev60.dtsi -+++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi -@@ -57,7 +57,7 @@ - }; - }; - -- ssp@80002000 { -+ spi@80002000 { - /* - * On the first generation boards, this SSP/SPI port was connected - * to the AB8500. -diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts -index e80e42163883..bb1b64d6ab5e 100644 ---- a/arch/arm/boot/dts/ste-snowball.dts -+++ b/arch/arm/boot/dts/ste-snowball.dts -@@ -311,7 +311,7 @@ - pinctrl-1 = <&i2c3_sleep_mode>; - }; - -- ssp@80002000 { -+ spi@80002000 { - pinctrl-names = "default"; - pinctrl-0 = <&ssp0_snowball_mode>; - }; -diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts -index 82a661677e97..fb6ca7f86417 100644 ---- a/arch/arm/boot/dts/ste-u300.dts -+++ b/arch/arm/boot/dts/ste-u300.dts -@@ -451,7 +451,7 @@ - dma-names = "rx"; - }; - -- spi: ssp@c0006000 { -+ spi: spi@c0006000 { - compatible = "arm,pl022", "arm,primecell"; - reg = <0xc0006000 0x1000>; - interrupt-parent = <&vica>; -diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi -index bf361277fe10..9a8c20cd0688 100644 ---- a/arch/arm/boot/dts/tegra30-apalis.dtsi -+++ b/arch/arm/boot/dts/tegra30-apalis.dtsi -@@ -147,14 +147,14 @@ - - /* Apalis MMC1 */ - sdmmc3_clk_pa6 { -- nvidia,pins = "sdmmc3_clk_pa6", -- "sdmmc3_cmd_pa7"; -+ nvidia,pins = "sdmmc3_clk_pa6"; - nvidia,function = "sdmmc3"; - nvidia,pull = ; - nvidia,tristate = ; - }; - sdmmc3_dat0_pb7 { -- nvidia,pins = "sdmmc3_dat0_pb7", -+ nvidia,pins = "sdmmc3_cmd_pa7", -+ "sdmmc3_dat0_pb7", - "sdmmc3_dat1_pb6", - "sdmmc3_dat2_pb5", - "sdmmc3_dat3_pb4", -diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi -index 313e260529a3..e8f5a55c4b95 100644 ---- a/arch/arm/boot/dts/tegra30.dtsi -+++ b/arch/arm/boot/dts/tegra30.dtsi -@@ -823,7 +823,7 @@ - nvidia,elastic-limit = <16>; - nvidia,term-range-adj = <6>; - nvidia,xcvr-setup = <51>; -- nvidia.xcvr-setup-use-fuses; -+ nvidia,xcvr-setup-use-fuses; - nvidia,xcvr-lsfslew = <1>; - nvidia,xcvr-lsrslew = <1>; - nvidia,xcvr-hsslew = <32>; -@@ -860,7 +860,7 @@ - nvidia,elastic-limit = <16>; - nvidia,term-range-adj = <6>; - nvidia,xcvr-setup = <51>; -- nvidia.xcvr-setup-use-fuses; -+ nvidia,xcvr-setup-use-fuses; - nvidia,xcvr-lsfslew = <2>; - nvidia,xcvr-lsrslew = <2>; - nvidia,xcvr-hsslew = <32>; -@@ -896,7 +896,7 @@ - nvidia,elastic-limit = <16>; - nvidia,term-range-adj = <6>; - nvidia,xcvr-setup = <51>; -- nvidia.xcvr-setup-use-fuses; -+ nvidia,xcvr-setup-use-fuses; - nvidia,xcvr-lsfslew = <2>; - nvidia,xcvr-lsrslew = <2>; - nvidia,xcvr-hsslew = <32>; -diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S -index e969b18d9ff9..d31f0300d2c9 100644 ---- a/arch/arm/kernel/entry-common.S -+++ b/arch/arm/kernel/entry-common.S -@@ -261,16 +261,15 @@ __sys_trace: - cmp scno, #-1 @ skip the syscall? - bne 2b - add sp, sp, #S_OFF @ restore stack -- b ret_slow_syscall - --__sys_trace_return: -- str r0, [sp, #S_R0 + S_OFF]! @ save returned r0 -+__sys_trace_return_nosave: -+ enable_irq_notrace - mov r0, sp - bl syscall_trace_exit - b ret_slow_syscall - --__sys_trace_return_nosave: -- enable_irq_notrace -+__sys_trace_return: -+ str r0, [sp, #S_R0 + S_OFF]! @ save returned r0 - mov r0, sp - bl syscall_trace_exit - b ret_slow_syscall -diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c -index a19d20f23e71..fff529c5f9b3 100644 ---- a/arch/arm/mach-imx/pm-imx6.c -+++ b/arch/arm/mach-imx/pm-imx6.c -@@ -602,6 +602,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata - IMX6Q_GPR1_GINT); - } - -+static void imx6_pm_stby_poweroff(void) -+{ -+ imx6_set_lpm(STOP_POWER_OFF); -+ imx6q_suspend_finish(0); -+ -+ mdelay(1000); -+ -+ pr_emerg("Unable to poweroff system\n"); -+} -+ -+static int imx6_pm_stby_poweroff_probe(void) -+{ -+ if (pm_power_off) { -+ pr_warn("%s: pm_power_off already claimed %p %pf!\n", -+ __func__, pm_power_off, pm_power_off); -+ return -EBUSY; -+ } -+ -+ pm_power_off = imx6_pm_stby_poweroff; -+ return 0; -+} -+ - void __init imx6_pm_ccm_init(const char *ccm_compat) - { - struct device_node *np; -@@ -618,6 +640,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat) - val = readl_relaxed(ccm_base + CLPCR); - val &= ~BM_CLPCR_LPM; - writel_relaxed(val, ccm_base + CLPCR); -+ -+ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff")) -+ imx6_pm_stby_poweroff_probe(); - } - - void __init imx6q_pm_init(void) -diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi -index 2874d92881fd..a3030c868be5 100644 ---- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi -+++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi -@@ -84,7 +84,7 @@ - clock-names = "uartclk", "apb_pclk"; - }; - -- spi0: ssp@e1020000 { -+ spi0: spi@e1020000 { - status = "disabled"; - compatible = "arm,pl022", "arm,primecell"; - #gpio-cells = <2>; -@@ -95,7 +95,7 @@ - clock-names = "apb_pclk"; - }; - -- spi1: ssp@e1030000 { -+ spi1: spi@e1030000 { - status = "disabled"; - compatible = "arm,pl022", "arm,primecell"; - #gpio-cells = <2>; -diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S -index a9723c71c52b..8d330c30a6f9 100644 ---- a/arch/arm64/lib/clear_user.S -+++ b/arch/arm64/lib/clear_user.S -@@ -62,5 +62,7 @@ ENDPROC(__clear_user) - .section .fixup,"ax" - .align 2 - 9: mov x0, x2 // return the original size -+ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \ -+ CONFIG_ARM64_PAN) - ret - .previous -diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S -index 4699cd74f87e..b8c95ef13229 100644 ---- a/arch/arm64/lib/copy_from_user.S -+++ b/arch/arm64/lib/copy_from_user.S -@@ -85,5 +85,7 @@ ENDPROC(__copy_from_user) - strb wzr, [dst], #1 // zero remaining buffer space - cmp dst, end - b.lo 9999b -+ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \ -+ CONFIG_ARM64_PAN) - ret - .previous -diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S -index 81c8fc93c100..233703c84bcd 100644 ---- a/arch/arm64/lib/copy_in_user.S -+++ b/arch/arm64/lib/copy_in_user.S -@@ -81,5 +81,7 @@ ENDPROC(__copy_in_user) - .section .fixup,"ax" - .align 2 - 9998: sub x0, end, dst // bytes not copied -+ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \ -+ CONFIG_ARM64_PAN) - ret - .previous -diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S -index 7512bbbc07ac..62b179408b23 100644 ---- a/arch/arm64/lib/copy_to_user.S -+++ b/arch/arm64/lib/copy_to_user.S -@@ -79,5 +79,7 @@ ENDPROC(__copy_to_user) - .section .fixup,"ax" - .align 2 - 9998: sub x0, end, dst // bytes not copied -+ALTERNATIVE("nop", __stringify(SET_PSTATE_PAN(1)), ARM64_HAS_PAN, \ -+ CONFIG_ARM64_PAN) - ret - .previous -diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c -index e81ce4623070..06fb94370c7c 100644 ---- a/arch/mips/bcm47xx/workarounds.c -+++ b/arch/mips/bcm47xx/workarounds.c -@@ -4,9 +4,8 @@ - #include - #include - --static void __init bcm47xx_workarounds_netgear_wnr3500l(void) -+static void __init bcm47xx_workarounds_enable_usb_power(int usb_power) - { -- const int usb_power = 12; - int err; - - err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power"); -@@ -22,7 +21,10 @@ void __init bcm47xx_workarounds(void) - - switch (board) { - case BCM47XX_BOARD_NETGEAR_WNR3500L: -- bcm47xx_workarounds_netgear_wnr3500l(); -+ bcm47xx_workarounds_enable_usb_power(12); -+ break; -+ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3: -+ bcm47xx_workarounds_enable_usb_power(21); - break; - default: - /* No workaround(s) needed */ -diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h -index ee25ebbf2a28..b6a4d4aa548f 100644 ---- a/arch/mips/include/asm/kexec.h -+++ b/arch/mips/include/asm/kexec.h -@@ -12,11 +12,11 @@ - #include - - /* Maximum physical address we can use pages from */ --#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000) -+#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) - /* Maximum address we can reach in physical address mode */ --#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000) -+#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL) - /* Maximum address we can use for the control code buffer */ --#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000) -+#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL) - /* Reserve 3*4096 bytes for board-specific info */ - #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096) - -diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c -index 9d9962ab7d25..7dc97e944d5a 100644 ---- a/arch/mips/txx9/generic/setup.c -+++ b/arch/mips/txx9/generic/setup.c -@@ -961,12 +961,11 @@ void __init txx9_sramc_init(struct resource *r) - goto exit_put; - err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr); - if (err) { -- device_unregister(&dev->dev); - iounmap(dev->base); -- kfree(dev); -+ device_unregister(&dev->dev); - } - return; - exit_put: -+ iounmap(dev->base); - put_device(&dev->dev); -- return; - } -diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h -index 7e3789ea396b..0b3db6322c79 100644 ---- a/arch/powerpc/boot/libfdt_env.h -+++ b/arch/powerpc/boot/libfdt_env.h -@@ -4,6 +4,8 @@ - #include - #include - -+#define INT_MAX ((int)(~0U>>1)) -+ - #include "of.h" - - typedef u32 uint32_t; -diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c -index a8e3490b54e3..4c9b5970af37 100644 ---- a/arch/powerpc/kernel/iommu.c -+++ b/arch/powerpc/kernel/iommu.c -@@ -764,9 +764,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl, - - vaddr = page_address(page) + offset; - uaddr = (unsigned long)vaddr; -- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); - - if (tbl) { -+ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); - align = 0; - if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE && - ((unsigned long)vaddr & ~PAGE_MASK) == 0) -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index 0c42e872d548..4fcaa7d3d544 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -967,6 +967,7 @@ int rtas_ibm_suspend_me(u64 handle) - goto out; - } - -+ cpu_hotplug_disable(); - stop_topology_update(); - - /* Call function on all CPUs. One of us will make the -@@ -981,6 +982,7 @@ int rtas_ibm_suspend_me(u64 handle) - printk(KERN_ERR "Error doing global join\n"); - - start_topology_update(); -+ cpu_hotplug_enable(); - - /* Take down CPUs not online prior to suspend */ - cpuret = rtas_offline_cpus_mask(offline_mask); -diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S -index 59cf5f452879..9d112e1b31b8 100644 ---- a/arch/powerpc/kernel/vdso32/datapage.S -+++ b/arch/powerpc/kernel/vdso32/datapage.S -@@ -37,6 +37,7 @@ data_page_branch: - mtlr r0 - addi r3, r3, __kernel_datapage_offset-data_page_branch - lwz r0,0(r3) -+ .cfi_restore lr - add r3,r0,r3 - blr - .cfi_endproc -diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S -index 6b2b69616e77..7b341b86216c 100644 ---- a/arch/powerpc/kernel/vdso32/gettimeofday.S -+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S -@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) - */ - 99: - li r0,__NR_clock_gettime -+ .cfi_restore lr - sc - blr - .cfi_endproc -diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S -index 7612eeb31da1..6832e41c372b 100644 ---- a/arch/powerpc/kernel/vdso64/datapage.S -+++ b/arch/powerpc/kernel/vdso64/datapage.S -@@ -37,6 +37,7 @@ data_page_branch: - mtlr r0 - addi r3, r3, __kernel_datapage_offset-data_page_branch - lwz r0,0(r3) -+ .cfi_restore lr - add r3,r0,r3 - blr - .cfi_endproc -diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S -index 382021324883..09b2a49f6dd5 100644 ---- a/arch/powerpc/kernel/vdso64/gettimeofday.S -+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S -@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) - */ - 99: - li r0,__NR_clock_gettime -+ .cfi_restore lr - sc - blr - .cfi_endproc -diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c -index 4aab1c9c83e1..41ac54bfdfdd 100644 ---- a/arch/powerpc/kvm/book3s.c -+++ b/arch/powerpc/kvm/book3s.c -@@ -70,8 +70,11 @@ void kvmppc_unfixup_split_real(struct kvm_vcpu *vcpu) - { - if (vcpu->arch.hflags & BOOK3S_HFLAG_SPLIT_HACK) { - ulong pc = kvmppc_get_pc(vcpu); -+ ulong lr = kvmppc_get_lr(vcpu); - if ((pc & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS) - kvmppc_set_pc(vcpu, pc & ~SPLIT_HACK_MASK); -+ if ((lr & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS) -+ kvmppc_set_lr(vcpu, lr & ~SPLIT_HACK_MASK); - vcpu->arch.hflags &= ~BOOK3S_HFLAG_SPLIT_HACK; - } - } -diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c -index 309027208f7c..27f00a7c1085 100644 ---- a/arch/powerpc/mm/slb.c -+++ b/arch/powerpc/mm/slb.c -@@ -322,7 +322,7 @@ void slb_initialize(void) - #endif - } - -- get_paca()->stab_rr = SLB_NUM_BOLTED; -+ get_paca()->stab_rr = SLB_NUM_BOLTED - 1; - - lflags = SLB_VSID_KERNEL | linear_llp; - vflags = SLB_VSID_KERNEL | vmalloc_llp; -diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c -index 39049e4884fb..7a4d172c9376 100644 ---- a/arch/powerpc/platforms/pseries/dtl.c -+++ b/arch/powerpc/platforms/pseries/dtl.c -@@ -150,7 +150,7 @@ static int dtl_start(struct dtl *dtl) - - /* Register our dtl buffer with the hypervisor. The HV expects the - * buffer size to be passed in the second word of the buffer */ -- ((u32 *)dtl->buf)[1] = DISPATCH_LOG_BYTES; -+ ((u32 *)dtl->buf)[1] = cpu_to_be32(DISPATCH_LOG_BYTES); - - hwcpu = get_hard_smp_processor_id(dtl->cpu); - addr = __pa(dtl->buf); -@@ -185,7 +185,7 @@ static void dtl_stop(struct dtl *dtl) - - static u64 dtl_current_index(struct dtl *dtl) - { -- return lppaca_of(dtl->cpu).dtl_idx; -+ return be64_to_cpu(lppaca_of(dtl->cpu).dtl_idx); - } - #endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 53b429811aef..1bee1c6a9891 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2526,8 +2526,7 @@ config OLPC - - config OLPC_XO1_PM - bool "OLPC XO-1 Power Management" -- depends on OLPC && MFD_CS5535 && PM_SLEEP -- select MFD_CORE -+ depends on OLPC && MFD_CS5535=y && PM_SLEEP - ---help--- - Add support for poweroff and suspend of the OLPC XO-1 laptop. - -diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h -index 3e8674288198..249fa6b27557 100644 ---- a/arch/x86/include/asm/atomic.h -+++ b/arch/x86/include/asm/atomic.h -@@ -49,7 +49,7 @@ static __always_inline void atomic_add(int i, atomic_t *v) - { - asm volatile(LOCK_PREFIX "addl %1,%0" - : "+m" (v->counter) -- : "ir" (i)); -+ : "ir" (i) : "memory"); - } - - /** -@@ -63,7 +63,7 @@ static __always_inline void atomic_sub(int i, atomic_t *v) - { - asm volatile(LOCK_PREFIX "subl %1,%0" - : "+m" (v->counter) -- : "ir" (i)); -+ : "ir" (i) : "memory"); - } - - /** -@@ -89,7 +89,7 @@ static __always_inline int atomic_sub_and_test(int i, atomic_t *v) - static __always_inline void atomic_inc(atomic_t *v) - { - asm volatile(LOCK_PREFIX "incl %0" -- : "+m" (v->counter)); -+ : "+m" (v->counter) :: "memory"); - } - - /** -@@ -101,7 +101,7 @@ static __always_inline void atomic_inc(atomic_t *v) - static __always_inline void atomic_dec(atomic_t *v) - { - asm volatile(LOCK_PREFIX "decl %0" -- : "+m" (v->counter)); -+ : "+m" (v->counter) :: "memory"); - } - - /** -diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h -index 037351022f54..377fa50cc271 100644 ---- a/arch/x86/include/asm/atomic64_64.h -+++ b/arch/x86/include/asm/atomic64_64.h -@@ -44,7 +44,7 @@ static __always_inline void atomic64_add(long i, atomic64_t *v) - { - asm volatile(LOCK_PREFIX "addq %1,%0" - : "=m" (v->counter) -- : "er" (i), "m" (v->counter)); -+ : "er" (i), "m" (v->counter) : "memory"); - } - - /** -@@ -58,7 +58,7 @@ static inline void atomic64_sub(long i, atomic64_t *v) - { - asm volatile(LOCK_PREFIX "subq %1,%0" - : "=m" (v->counter) -- : "er" (i), "m" (v->counter)); -+ : "er" (i), "m" (v->counter) : "memory"); - } - - /** -@@ -85,7 +85,7 @@ static __always_inline void atomic64_inc(atomic64_t *v) - { - asm volatile(LOCK_PREFIX "incq %0" - : "=m" (v->counter) -- : "m" (v->counter)); -+ : "m" (v->counter) : "memory"); - } - - /** -@@ -98,7 +98,7 @@ static __always_inline void atomic64_dec(atomic64_t *v) - { - asm volatile(LOCK_PREFIX "decq %0" - : "=m" (v->counter) -- : "m" (v->counter)); -+ : "m" (v->counter) : "memory"); - } - - /** -diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h -index 7f5dcb64cedb..b2a5bef74282 100644 ---- a/arch/x86/include/asm/barrier.h -+++ b/arch/x86/include/asm/barrier.h -@@ -116,7 +116,7 @@ do { \ - #endif - - /* Atomic operations are already serializing on x86 */ --#define smp_mb__before_atomic() barrier() --#define smp_mb__after_atomic() barrier() -+#define smp_mb__before_atomic() do { } while (0) -+#define smp_mb__after_atomic() do { } while (0) - - #endif /* _ASM_X86_BARRIER_H */ -diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h -index e7814b74caf8..5a51fcbbe563 100644 ---- a/arch/x86/include/asm/insn.h -+++ b/arch/x86/include/asm/insn.h -@@ -198,4 +198,22 @@ static inline int insn_offset_immediate(struct insn *insn) - return insn_offset_displacement(insn) + insn->displacement.nbytes; - } - -+#define POP_SS_OPCODE 0x1f -+#define MOV_SREG_OPCODE 0x8e -+ -+/* -+ * Intel SDM Vol.3A 6.8.3 states; -+ * "Any single-step trap that would be delivered following the MOV to SS -+ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is -+ * suppressed." -+ * This function returns true if @insn is MOV SS or POP SS. On these -+ * instructions, single stepping is suppressed. -+ */ -+static inline int insn_masking_exception(struct insn *insn) -+{ -+ return insn->opcode.bytes[0] == POP_SS_OPCODE || -+ (insn->opcode.bytes[0] == MOV_SREG_OPCODE && -+ X86_MODRM_REG(insn->modrm.bytes[0]) == 2); -+} -+ - #endif /* _ASM_X86_INSN_H */ -diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h -index d2434c1cad05..414f9b52e58e 100644 ---- a/arch/x86/include/asm/kexec.h -+++ b/arch/x86/include/asm/kexec.h -@@ -66,7 +66,7 @@ struct kimage; - - /* Memory to backup during crash kdump */ - #define KEXEC_BACKUP_SRC_START (0UL) --#define KEXEC_BACKUP_SRC_END (640 * 1024UL) /* 640K */ -+#define KEXEC_BACKUP_SRC_END (640 * 1024UL - 1) /* 640K */ - - /* - * CPU does not save ss and sp on stack if execution is already -diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c -index 6e4e4191abb5..151625a83d9e 100644 ---- a/arch/x86/kernel/cpu/cyrix.c -+++ b/arch/x86/kernel/cpu/cyrix.c -@@ -433,7 +433,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c) - /* enable MAPEN */ - setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); - /* enable cpuid */ -- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80); -+ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80); - /* disable MAPEN */ - setCx86(CX86_CCR3, ccr3); - local_irq_restore(flags); -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index a9fc2292d9ce..7c48aa03fe77 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -372,6 +372,10 @@ int __copy_instruction(u8 *dest, u8 *src) - return 0; - memcpy(dest, insn.kaddr, length); - -+ /* We should not singlestep on the exception masking instructions */ -+ if (insn_masking_exception(&insn)) -+ return 0; -+ - #ifdef CONFIG_X86_64 - if (insn_rip_relative(&insn)) { - s64 newdisp; -diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c -index 178d63cac321..8c38784cf992 100644 ---- a/arch/x86/kernel/uprobes.c -+++ b/arch/x86/kernel/uprobes.c -@@ -296,6 +296,10 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool - if (is_prefix_bad(insn)) - return -ENOTSUPP; - -+ /* We should not singlestep on the exception masking instructions */ -+ if (insn_masking_exception(insn)) -+ return -ENOTSUPP; -+ - if (x86_64) - good_insns = good_insns_64; - else -@@ -983,7 +987,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs - pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, " - "%%ip=%#lx\n", current->pid, regs->sp, regs->ip); - -- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current); -+ force_sig(SIGSEGV, current); - } - - return -1; -diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index a000ecb995e6..e59f50576f2a 100644 ---- a/drivers/acpi/osl.c -+++ b/drivers/acpi/osl.c -@@ -1186,6 +1186,7 @@ void acpi_os_wait_events_complete(void) - flush_workqueue(kacpid_wq); - flush_workqueue(kacpi_notify_wq); - } -+EXPORT_SYMBOL(acpi_os_wait_events_complete); - - struct acpi_hp_work { - struct work_struct work; -diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c -index 3b0b4bd67b71..4031ec8024ce 100644 ---- a/drivers/acpi/pci_root.c -+++ b/drivers/acpi/pci_root.c -@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm) - decode_osc_support(root, "OS supports", support); - status = acpi_pci_osc_support(root, support); - if (ACPI_FAILURE(status)) { -- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n", -- acpi_format_exception(status)); -+ dev_info(&device->dev, "_OSC failed (%s)%s\n", -+ acpi_format_exception(status), -+ pcie_aspm_support_enabled() ? "; disabling ASPM" : ""); - *no_aspm = 1; - return; - } -diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c -index 7a3431018e0a..5008ead4609a 100644 ---- a/drivers/acpi/sbshc.c -+++ b/drivers/acpi/sbshc.c -@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc) - hc->callback = NULL; - hc->context = NULL; - mutex_unlock(&hc->lock); -+ acpi_os_wait_events_complete(); - return 0; - } - -@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device) - - hc = acpi_driver_data(device); - acpi_ec_remove_query_handler(hc->ec, hc->query_bit); -+ acpi_os_wait_events_complete(); - kfree(hc); - device->driver_data = NULL; - return 0; -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 4a267347a6d9..a44aeda57109 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -1654,6 +1654,21 @@ nothing_to_do: - return 1; - } - -+static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks) -+{ -+ struct request *rq = scmd->request; -+ u32 req_blocks; -+ -+ if (!blk_rq_is_passthrough(rq)) -+ return true; -+ -+ req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size; -+ if (n_blocks > req_blocks) -+ return false; -+ -+ return true; -+} -+ - /** - * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one - * @qc: Storage for translated ATA taskfile -@@ -1693,6 +1708,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) - scsi_10_lba_len(cdb, &block, &n_block); - if (cdb[1] & (1 << 3)) - tf_flags |= ATA_TFLAG_FUA; -+ if (!ata_check_nblocks(scmd, n_block)) -+ goto invalid_fld; - break; - case READ_6: - case WRITE_6: -@@ -1705,6 +1722,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) - */ - if (!n_block) - n_block = 256; -+ if (!ata_check_nblocks(scmd, n_block)) -+ goto invalid_fld; - break; - case READ_16: - case WRITE_16: -@@ -1713,6 +1732,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) - scsi_16_lba_len(cdb, &block, &n_block); - if (cdb[1] & (1 << 3)) - tf_flags |= ATA_TFLAG_FUA; -+ if (!ata_check_nblocks(scmd, n_block)) -+ goto invalid_fld; - break; - default: - DPRINTK("no-byte command\n"); -diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c -index bd6b089c67a3..634c814cbeda 100644 ---- a/drivers/ata/pata_ep93xx.c -+++ b/drivers/ata/pata_ep93xx.c -@@ -659,7 +659,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) - * start of new transfer. - */ - drv_data->dma_rx_data.port = EP93XX_DMA_IDE; -- drv_data->dma_rx_data.direction = DMA_FROM_DEVICE; -+ drv_data->dma_rx_data.direction = DMA_DEV_TO_MEM; - drv_data->dma_rx_data.name = "ep93xx-pata-rx"; - drv_data->dma_rx_channel = dma_request_channel(mask, - ep93xx_pata_dma_filter, &drv_data->dma_rx_data); -@@ -667,7 +667,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) - return; - - drv_data->dma_tx_data.port = EP93XX_DMA_IDE; -- drv_data->dma_tx_data.direction = DMA_TO_DEVICE; -+ drv_data->dma_tx_data.direction = DMA_MEM_TO_DEV; - drv_data->dma_tx_data.name = "ep93xx-pata-tx"; - drv_data->dma_tx_channel = dma_request_channel(mask, - ep93xx_pata_dma_filter, &drv_data->dma_tx_data); -@@ -678,7 +678,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) - - /* Configure receive channel direction and source address */ - memset(&conf, 0, sizeof(conf)); -- conf.direction = DMA_FROM_DEVICE; -+ conf.direction = DMA_DEV_TO_MEM; - conf.src_addr = drv_data->udma_in_phys; - conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; - if (dmaengine_slave_config(drv_data->dma_rx_channel, &conf)) { -@@ -689,7 +689,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) - - /* Configure transmit channel direction and destination address */ - memset(&conf, 0, sizeof(conf)); -- conf.direction = DMA_TO_DEVICE; -+ conf.direction = DMA_MEM_TO_DEV; - conf.dst_addr = drv_data->udma_out_phys; - conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; - if (dmaengine_slave_config(drv_data->dma_tx_channel, &conf)) { -diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c -index fe8cfe24c518..4b82cf9da0ba 100644 ---- a/drivers/crypto/mxs-dcp.c -+++ b/drivers/crypto/mxs-dcp.c -@@ -28,9 +28,24 @@ - - #define DCP_MAX_CHANS 4 - #define DCP_BUF_SZ PAGE_SIZE -+#define DCP_SHA_PAY_SZ 64 - - #define DCP_ALIGNMENT 64 - -+/* -+ * Null hashes to align with hw behavior on imx6sl and ull -+ * these are flipped for consistency with hw output -+ */ -+const uint8_t sha1_null_hash[] = -+ "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf" -+ "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda"; -+ -+const uint8_t sha256_null_hash[] = -+ "\x55\xb8\x52\x78\x1b\x99\x95\xa4" -+ "\x4c\x93\x9b\x64\xe4\x41\xae\x27" -+ "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a" -+ "\x14\x1c\xfc\x98\x42\xc4\xb0\xe3"; -+ - /* DCP DMA descriptor. */ - struct dcp_dma_desc { - uint32_t next_cmd_addr; -@@ -48,6 +63,7 @@ struct dcp_coherent_block { - uint8_t aes_in_buf[DCP_BUF_SZ]; - uint8_t aes_out_buf[DCP_BUF_SZ]; - uint8_t sha_in_buf[DCP_BUF_SZ]; -+ uint8_t sha_out_buf[DCP_SHA_PAY_SZ]; - - uint8_t aes_key[2 * AES_KEYSIZE_128]; - -@@ -209,6 +225,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, - dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, - DCP_BUF_SZ, DMA_FROM_DEVICE); - -+ if (actx->fill % AES_BLOCK_SIZE) { -+ dev_err(sdcp->dev, "Invalid block size!\n"); -+ ret = -EINVAL; -+ goto aes_done_run; -+ } -+ - /* Fill in the DMA descriptor. */ - desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE | - MXS_DCP_CONTROL0_INTERRUPT | -@@ -238,6 +260,7 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, - - ret = mxs_dcp_start_dma(actx); - -+aes_done_run: - dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128, - DMA_TO_DEVICE); - dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); -@@ -264,13 +287,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - - uint8_t *out_tmp, *src_buf, *dst_buf = NULL; - uint32_t dst_off = 0; -+ uint32_t last_out_len = 0; - - uint8_t *key = sdcp->coh->aes_key; - - int ret = 0; - int split = 0; -- unsigned int i, len, clen, rem = 0; -+ unsigned int i, len, clen, rem = 0, tlen = 0; - int init = 0; -+ bool limit_hit = false; - - actx->fill = 0; - -@@ -289,6 +314,11 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - for_each_sg(req->src, src, nents, i) { - src_buf = sg_virt(src); - len = sg_dma_len(src); -+ tlen += len; -+ limit_hit = tlen > req->nbytes; -+ -+ if (limit_hit) -+ len = req->nbytes - (tlen - len); - - do { - if (actx->fill + len > out_off) -@@ -305,13 +335,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - * If we filled the buffer or this is the last SG, - * submit the buffer. - */ -- if (actx->fill == out_off || sg_is_last(src)) { -+ if (actx->fill == out_off || sg_is_last(src) || -+ limit_hit) { - ret = mxs_dcp_run_aes(actx, req, init); - if (ret) - return ret; - init = 0; - - out_tmp = out_buf; -+ last_out_len = actx->fill; - while (dst && actx->fill) { - if (!split) { - dst_buf = sg_virt(dst); -@@ -334,6 +366,19 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - } - } - } while (len); -+ -+ if (limit_hit) -+ break; -+ } -+ -+ /* Copy the IV for CBC for chaining */ -+ if (!rctx->ecb) { -+ if (rctx->enc) -+ memcpy(req->info, out_buf+(last_out_len-AES_BLOCK_SIZE), -+ AES_BLOCK_SIZE); -+ else -+ memcpy(req->info, in_buf+(last_out_len-AES_BLOCK_SIZE), -+ AES_BLOCK_SIZE); - } - - return ret; -@@ -518,8 +563,6 @@ static int mxs_dcp_run_sha(struct ahash_request *req) - struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); - struct dcp_async_ctx *actx = crypto_ahash_ctx(tfm); - struct dcp_sha_req_ctx *rctx = ahash_request_ctx(req); -- struct hash_alg_common *halg = crypto_hash_alg_common(tfm); -- - struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; - - dma_addr_t digest_phys = 0; -@@ -541,10 +584,23 @@ static int mxs_dcp_run_sha(struct ahash_request *req) - desc->payload = 0; - desc->status = 0; - -+ /* -+ * Align driver with hw behavior when generating null hashes -+ */ -+ if (rctx->init && rctx->fini && desc->size == 0) { -+ struct hash_alg_common *halg = crypto_hash_alg_common(tfm); -+ const uint8_t *sha_buf = -+ (actx->alg == MXS_DCP_CONTROL1_HASH_SELECT_SHA1) ? -+ sha1_null_hash : sha256_null_hash; -+ memcpy(sdcp->coh->sha_out_buf, sha_buf, halg->digestsize); -+ ret = 0; -+ goto done_run; -+ } -+ - /* Set HASH_TERM bit for last transfer block. */ - if (rctx->fini) { -- digest_phys = dma_map_single(sdcp->dev, req->result, -- halg->digestsize, DMA_FROM_DEVICE); -+ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf, -+ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE); - desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM; - desc->payload = digest_phys; - } -@@ -552,9 +608,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) - ret = mxs_dcp_start_dma(actx); - - if (rctx->fini) -- dma_unmap_single(sdcp->dev, digest_phys, halg->digestsize, -+ dma_unmap_single(sdcp->dev, digest_phys, DCP_SHA_PAY_SZ, - DMA_FROM_DEVICE); - -+done_run: - dma_unmap_single(sdcp->dev, buf_phys, DCP_BUF_SZ, DMA_TO_DEVICE); - - return ret; -@@ -572,6 +629,7 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq) - const int nents = sg_nents(req->src); - - uint8_t *in_buf = sdcp->coh->sha_in_buf; -+ uint8_t *out_buf = sdcp->coh->sha_out_buf; - - uint8_t *src_buf; - -@@ -626,11 +684,9 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq) - - actx->fill = 0; - -- /* For some reason, the result is flipped. */ -- for (i = 0; i < halg->digestsize / 2; i++) { -- swap(req->result[i], -- req->result[halg->digestsize - i - 1]); -- } -+ /* For some reason the result is flipped */ -+ for (i = 0; i < halg->digestsize; i++) -+ req->result[i] = out_buf[halg->digestsize - i - 1]; - } - - return 0; -diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c -index 8344b7c91fe3..1d01e3805f9c 100644 ---- a/drivers/dma/dma-jz4780.c -+++ b/drivers/dma/dma-jz4780.c -@@ -576,7 +576,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, - to_jz4780_dma_desc(vdesc), 0); - } else if (cookie == jzchan->desc->vdesc.tx.cookie) { - txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc, -- (jzchan->curr_hwdesc + 1) % jzchan->desc->count); -+ jzchan->curr_hwdesc + 1); - } else - txstate->residue = 0; - -diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c -index 106fa9b327d9..92b0a7a042ee 100644 ---- a/drivers/dma/ioat/init.c -+++ b/drivers/dma/ioat/init.c -@@ -128,7 +128,7 @@ static void - ioat_init_channel(struct ioatdma_device *ioat_dma, - struct ioatdma_chan *ioat_chan, int idx); - static void ioat_intr_quirk(struct ioatdma_device *ioat_dma); --static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma); -+static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma); - static int ioat3_dma_self_test(struct ioatdma_device *ioat_dma); - - static int ioat_dca_enabled = 1; -@@ -593,7 +593,7 @@ static void ioat_dma_remove(struct ioatdma_device *ioat_dma) - * ioat_enumerate_channels - find and initialize the device's channels - * @ioat_dma: the ioat dma device to be enumerated - */ --static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) -+static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma) - { - struct ioatdma_chan *ioat_chan; - struct device *dev = &ioat_dma->pdev->dev; -@@ -612,7 +612,7 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) - xfercap_log = readb(ioat_dma->reg_base + IOAT_XFERCAP_OFFSET); - xfercap_log &= 0x1f; /* bits [4:0] valid */ - if (xfercap_log == 0) -- return 0; -+ return; - dev_dbg(dev, "%s: xfercap = %d\n", __func__, 1 << xfercap_log); - - for (i = 0; i < dma->chancnt; i++) { -@@ -629,7 +629,6 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) - } - } - dma->chancnt = i; -- return i; - } - - /** -diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c -index 559cd4073698..cf741187c9bb 100644 ---- a/drivers/dma/timb_dma.c -+++ b/drivers/dma/timb_dma.c -@@ -552,7 +552,7 @@ static struct dma_async_tx_descriptor *td_prep_slave_sg(struct dma_chan *chan, - } - - dma_sync_single_for_device(chan2dmadev(chan), td_desc->txd.phys, -- td_desc->desc_list_len, DMA_MEM_TO_DEV); -+ td_desc->desc_list_len, DMA_TO_DEVICE); - - return &td_desc->txd; - } -diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c -index 7b25fdf64802..f579938552cc 100644 ---- a/drivers/gpio/gpio-syscon.c -+++ b/drivers/gpio/gpio-syscon.c -@@ -127,7 +127,7 @@ static int syscon_gpio_dir_out(struct gpio_chip *chip, unsigned offset, int val) - BIT(offs % SYSCON_REG_BITS)); - } - -- priv->data->set(chip, offset, val); -+ chip->set(chip, offset, val); - - return 0; - } -diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c -index 3e23003f78b0..993c61e95d30 100644 ---- a/drivers/hwmon/pwm-fan.c -+++ b/drivers/hwmon/pwm-fan.c -@@ -227,8 +227,12 @@ static int pwm_fan_probe(struct platform_device *pdev) - - ctx->pwm = devm_of_pwm_get(&pdev->dev, pdev->dev.of_node, NULL); - if (IS_ERR(ctx->pwm)) { -- dev_err(&pdev->dev, "Could not get PWM\n"); -- return PTR_ERR(ctx->pwm); -+ ret = PTR_ERR(ctx->pwm); -+ -+ if (ret != -EPROBE_DEFER) -+ dev_err(&pdev->dev, "Could not get PWM: %d\n", ret); -+ -+ return ret; - } - - platform_set_drvdata(pdev, ctx); -diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c -index 3854d201a5d6..68dd0be1ac07 100644 ---- a/drivers/iio/dac/mcp4922.c -+++ b/drivers/iio/dac/mcp4922.c -@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev, - long mask) - { - struct mcp4922_state *state = iio_priv(indio_dev); -+ int ret; - - if (val2 != 0) - return -EINVAL; - - switch (mask) { - case IIO_CHAN_INFO_RAW: -- if (val > GENMASK(chan->scan_type.realbits-1, 0)) -+ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0)) - return -EINVAL; - val <<= chan->scan_type.shift; -- state->value[chan->channel] = val; -- return mcp4922_spi_write(state, chan->channel, val); -+ -+ ret = mcp4922_spi_write(state, chan->channel, val); -+ if (!ret) -+ state->value[chan->channel] = val; -+ return ret; -+ - default: - return -EINVAL; - } -diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c -index ded76c101dde..834b06aacc2b 100644 ---- a/drivers/infiniband/hw/mthca/mthca_main.c -+++ b/drivers/infiniband/hw/mthca/mthca_main.c -@@ -989,7 +989,8 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type) - goto err_free_dev; - } - -- if (mthca_cmd_init(mdev)) { -+ err = mthca_cmd_init(mdev); -+ if (err) { - mthca_err(mdev, "Failed to init command interface, aborting.\n"); - goto err_free_dev; - } -diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c -index fcc6c3368182..ea3f0f5eb534 100644 ---- a/drivers/input/ff-memless.c -+++ b/drivers/input/ff-memless.c -@@ -501,6 +501,15 @@ static void ml_ff_destroy(struct ff_device *ff) - { - struct ml_device *ml = ff->private; - -+ /* -+ * Even though we stop all playing effects when tearing down -+ * an input device (via input_device_flush() that calls into -+ * input_ff_flush() that stops and erases all effects), we -+ * do not actually stop the timer, and therefore we should -+ * do it here. -+ */ -+ del_timer_sync(&ml->timer); -+ - kfree(ml->private); - } - -diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c -index e943678ce54c..f1c574d6be17 100644 ---- a/drivers/input/touchscreen/st1232.c -+++ b/drivers/input/touchscreen/st1232.c -@@ -203,6 +203,7 @@ static int st1232_ts_probe(struct i2c_client *client, - input_dev->id.bustype = BUS_I2C; - input_dev->dev.parent = &client->dev; - -+ __set_bit(INPUT_PROP_DIRECT, input_dev->propbit); - __set_bit(EV_SYN, input_dev->evbit); - __set_bit(EV_KEY, input_dev->evbit); - __set_bit(EV_ABS, input_dev->evbit); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index e42092146083..df8f1e69077f 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -902,6 +902,7 @@ static void cached_dev_detach_finish(struct work_struct *w) - bch_write_bdev_super(dc, &cl); - closure_sync(&cl); - -+ calc_cached_dev_sectors(dc->disk.c); - bcache_device_detach(&dc->disk); - list_move(&dc->list, &uncached_devices); - -diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c -index 9cd995f418e0..1d67407ffbf6 100644 ---- a/drivers/media/pci/ivtv/ivtv-yuv.c -+++ b/drivers/media/pci/ivtv/ivtv-yuv.c -@@ -936,7 +936,7 @@ static void ivtv_yuv_init(struct ivtv *itv) - } - - /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */ -- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN); -+ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN); - if (yi->blanking_ptr) { - yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE); - } else { -diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c -index ba887e8e1b17..a85c5199ccd3 100644 ---- a/drivers/media/pci/meye/meye.c -+++ b/drivers/media/pci/meye/meye.c -@@ -1469,7 +1469,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma) - unsigned long page, pos; - - mutex_lock(&meye.lock); -- if (size > gbuffers * gbufsize) { -+ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) { - mutex_unlock(&meye.lock); - return -EINVAL; - } -diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c -index 99faea2e84c6..78e37cf3470f 100644 ---- a/drivers/media/platform/davinci/isif.c -+++ b/drivers/media/platform/davinci/isif.c -@@ -1106,7 +1106,8 @@ fail_nobase_res: - - while (i >= 0) { - res = platform_get_resource(pdev, IORESOURCE_MEM, i); -- release_mem_region(res->start, resource_size(res)); -+ if (res) -+ release_mem_region(res->start, resource_size(res)); - i--; - } - vpfe_unregister_ccdc_device(&isif_hw_dev); -diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c -index 6d91422c4e4c..a9cd8c7a7b34 100644 ---- a/drivers/media/platform/davinci/vpbe_display.c -+++ b/drivers/media/platform/davinci/vpbe_display.c -@@ -520,7 +520,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev, - else if (v_scale == 4) - layer_info->v_zoom = ZOOM_X4; - if (v_exp) -- layer_info->h_exp = V_EXP_6_OVER_5; -+ layer_info->v_exp = V_EXP_6_OVER_5; - } else { - /* no scaling, only cropping. Set display area to crop area */ - cfg->ysize = expected_ysize; -diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c -index d0d8f08e37c8..de80925ee4cb 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-video.c -+++ b/drivers/media/usb/cx231xx/cx231xx-video.c -@@ -1346,7 +1346,7 @@ int cx231xx_g_register(struct file *file, void *priv, - ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER, - (u16)reg->reg, value, 4); - reg->val = value[0] | value[1] << 8 | -- value[2] << 16 | value[3] << 24; -+ value[2] << 16 | (u32)value[3] << 24; - reg->size = 4; - break; - case 1: /* AFE - read byte */ -diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c -index d4c719683a8a..d8961f35a9ec 100644 ---- a/drivers/misc/genwqe/card_utils.c -+++ b/drivers/misc/genwqe/card_utils.c -@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages) - int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - void __user *user_addr, size_t user_size) - { -- int rc; -+ int ret = -ENOMEM; - struct pci_dev *pci_dev = cd->pci_dev; - - sgl->fpage_offs = offset_in_page((unsigned long)user_addr); -@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - if (get_order(sgl->sgl_size) > MAX_ORDER) { - dev_err(&pci_dev->dev, - "[%s] err: too much memory requested!\n", __func__); -- return -ENOMEM; -+ return ret; - } - - sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size, -@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - if (sgl->sgl == NULL) { - dev_err(&pci_dev->dev, - "[%s] err: no memory available!\n", __func__); -- return -ENOMEM; -+ return ret; - } - - /* Only use buffering on incomplete pages */ -@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - /* Sync with user memory */ - if (copy_from_user(sgl->fpage + sgl->fpage_offs, - user_addr, sgl->fpage_size)) { -- rc = -EFAULT; -+ ret = -EFAULT; - goto err_out; - } - } -@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - /* Sync with user memory */ - if (copy_from_user(sgl->lpage, user_addr + user_size - - sgl->lpage_size, sgl->lpage_size)) { -- rc = -EFAULT; -+ ret = -EFAULT; - goto err_out2; - } - } -@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - sgl->sgl = NULL; - sgl->sgl_dma_addr = 0; - sgl->sgl_size = 0; -- return -ENOMEM; -+ -+ return ret; - } - - int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, -diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c -index bb3a76ad80da..fc8cb855c6e6 100644 ---- a/drivers/misc/kgdbts.c -+++ b/drivers/misc/kgdbts.c -@@ -979,6 +979,12 @@ static void kgdbts_run_tests(void) - int nmi_sleep = 0; - int i; - -+ verbose = 0; -+ if (strstr(config, "V1")) -+ verbose = 1; -+ if (strstr(config, "V2")) -+ verbose = 2; -+ - ptr = strchr(config, 'F'); - if (ptr) - fork_test = simple_strtol(ptr + 1, NULL, 10); -@@ -1062,13 +1068,6 @@ static int kgdbts_option_setup(char *opt) - return -ENOSPC; - } - strcpy(config, opt); -- -- verbose = 0; -- if (strstr(config, "V1")) -- verbose = 1; -- if (strstr(config, "V2")) -- verbose = 2; -- - return 0; - } - -@@ -1080,9 +1079,6 @@ static int configure_kgdbts(void) - - if (!strlen(config) || isspace(config[0])) - goto noconfig; -- err = kgdbts_option_setup(config); -- if (err) -- goto noconfig; - - final_ack = 0; - run_plant_and_detach_test(1); -diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c -index 4e374a05319c..91d695ee60ac 100644 ---- a/drivers/mmc/host/sdhci-of-at91.c -+++ b/drivers/mmc/host/sdhci-of-at91.c -@@ -145,7 +145,7 @@ static int sdhci_at91_probe(struct platform_device *pdev) - sdhci_get_of_property(pdev); - - /* HS200 is broken at this moment */ -- host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200; -+ host->quirks2 |= SDHCI_QUIRK2_BROKEN_HS200; - - ret = sdhci_add_host(host); - if (ret) -diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c -index e46b4e983666..77e7542fa8e4 100644 ---- a/drivers/mtd/maps/physmap_of.c -+++ b/drivers/mtd/maps/physmap_of.c -@@ -28,7 +28,6 @@ - struct of_flash_list { - struct mtd_info *mtd; - struct map_info map; -- struct resource *res; - }; - - struct of_flash { -@@ -53,18 +52,10 @@ static int of_flash_remove(struct platform_device *dev) - mtd_concat_destroy(info->cmtd); - } - -- for (i = 0; i < info->list_size; i++) { -+ for (i = 0; i < info->list_size; i++) - if (info->list[i].mtd) - map_destroy(info->list[i].mtd); - -- if (info->list[i].map.virt) -- iounmap(info->list[i].map.virt); -- -- if (info->list[i].res) { -- release_resource(info->list[i].res); -- kfree(info->list[i].res); -- } -- } - return 0; - } - -@@ -223,10 +214,11 @@ static int of_flash_probe(struct platform_device *dev) - - err = -EBUSY; - res_size = resource_size(&res); -- info->list[i].res = request_mem_region(res.start, res_size, -- dev_name(&dev->dev)); -- if (!info->list[i].res) -+ info->list[i].map.virt = devm_ioremap_resource(&dev->dev, &res); -+ if (IS_ERR(info->list[i].map.virt)) { -+ err = PTR_ERR(info->list[i].map.virt); - goto err_out; -+ } - - err = -ENXIO; - width = of_get_property(dp, "bank-width", NULL); -@@ -242,15 +234,6 @@ static int of_flash_probe(struct platform_device *dev) - info->list[i].map.bankwidth = be32_to_cpup(width); - info->list[i].map.device_node = dp; - -- err = -ENOMEM; -- info->list[i].map.virt = ioremap(info->list[i].map.phys, -- info->list[i].map.size); -- if (!info->list[i].map.virt) { -- dev_err(&dev->dev, "Failed to ioremap() flash" -- " region\n"); -- goto err_out; -- } -- - simple_map_init(&info->list[i].map); - - /* -diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c -index 1f2785ee909f..c00a180306e5 100644 ---- a/drivers/mtd/nand/sh_flctl.c -+++ b/drivers/mtd/nand/sh_flctl.c -@@ -428,7 +428,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset) - - /* initiate DMA transfer */ - if (flctl->chan_fifo0_rx && rlen >= 32 && -- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0) -+ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) - goto convert; /* DMA success */ - - /* do polling transfer */ -@@ -487,7 +487,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen, - - /* initiate DMA transfer */ - if (flctl->chan_fifo0_tx && rlen >= 32 && -- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0) -+ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) - return; /* DMA success */ - - /* do polling transfer */ -diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c -index 9a3f15cb7ef4..9b9dfa167ffb 100644 ---- a/drivers/net/can/slcan.c -+++ b/drivers/net/can/slcan.c -@@ -613,6 +613,7 @@ err_free_chan: - sl->tty = NULL; - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); -+ free_netdev(sl->dev); - - err_exit: - rtnl_unlock(); -diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c -index 87e727b921dc..1ad401fed469 100644 ---- a/drivers/net/ethernet/amd/am79c961a.c -+++ b/drivers/net/ethernet/amd/am79c961a.c -@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev) - /* - * Transmit a packet - */ --static int -+static netdev_tx_t - am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev) - { - struct dev_priv *priv = netdev_priv(dev); -diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c -index b10964e8cb54..a1dc65136d9f 100644 ---- a/drivers/net/ethernet/amd/atarilance.c -+++ b/drivers/net/ethernet/amd/atarilance.c -@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr - *init_rec ); - static int lance_open( struct net_device *dev ); - static void lance_init_ring( struct net_device *dev ); --static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); -+static netdev_tx_t lance_start_xmit(struct sk_buff *skb, -+ struct net_device *dev); - static irqreturn_t lance_interrupt( int irq, void *dev_id ); - static int lance_rx( struct net_device *dev ); - static int lance_close( struct net_device *dev ); -@@ -770,7 +771,8 @@ static void lance_tx_timeout (struct net_device *dev) - - /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */ - --static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) -+static netdev_tx_t -+lance_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct lance_private *lp = netdev_priv(dev); - struct lance_ioreg *IO = lp->iobase; -diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c -index b584b78237df..5e994f981fea 100644 ---- a/drivers/net/ethernet/amd/declance.c -+++ b/drivers/net/ethernet/amd/declance.c -@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev) - netif_wake_queue(dev); - } - --static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct lance_private *lp = netdev_priv(dev); - volatile struct lance_regs *ll = lp->ll; -diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c -index 3d8c6b2cdea4..09271665712d 100644 ---- a/drivers/net/ethernet/amd/sun3lance.c -+++ b/drivers/net/ethernet/amd/sun3lance.c -@@ -235,7 +235,8 @@ struct lance_private { - static int lance_probe( struct net_device *dev); - static int lance_open( struct net_device *dev ); - static void lance_init_ring( struct net_device *dev ); --static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); -+static netdev_tx_t lance_start_xmit(struct sk_buff *skb, -+ struct net_device *dev); - static irqreturn_t lance_interrupt( int irq, void *dev_id); - static int lance_rx( struct net_device *dev ); - static int lance_close( struct net_device *dev ); -@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev ) - } - - --static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) -+static netdev_tx_t -+lance_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct lance_private *lp = netdev_priv(dev); - int entry, len; -diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c -index 8914170fccff..babb0a5fb8de 100644 ---- a/drivers/net/ethernet/amd/sunlance.c -+++ b/drivers/net/ethernet/amd/sunlance.c -@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev) - netif_wake_queue(dev); - } - --static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct lance_private *lp = netdev_priv(dev); - int entry, skblen, len; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index 64034ff081a0..23fc244eb8a4 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -1390,7 +1390,7 @@ static int xgbe_close(struct net_device *netdev) - return 0; - } - --static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) -+static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) - { - struct xgbe_prv_data *pdata = netdev_priv(netdev); - struct xgbe_hw_if *hw_if = &pdata->hw_if; -@@ -1399,7 +1399,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) - struct xgbe_ring *ring; - struct xgbe_packet_data *packet; - struct netdev_queue *txq; -- int ret; -+ netdev_tx_t ret; - - DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len); - -diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c -index ec5834087e4b..c01ab06863b3 100644 ---- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c -+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c -@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id) - /* - * tx request callback - */ --static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t -+bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct bcm_enet_priv *priv; - struct bcm_enet_desc *desc; - u32 len_stat; -- int ret; -+ netdev_tx_t ret; - - priv = netdev_priv(dev); - -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index d450d8b3708c..82960603da33 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -3532,6 +3532,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp) - */ - static void bnx2x_config_mf_bw(struct bnx2x *bp) - { -+ /* Workaround for MFW bug. -+ * MFW is not supposed to generate BW attention in -+ * single function mode. -+ */ -+ if (!IS_MF(bp)) { -+ DP(BNX2X_MSG_MCP, -+ "Ignoring MF BW config in single function mode\n"); -+ return; -+ } -+ - if (bp->link_vars.link_up) { - bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX); - bnx2x_link_sync_notify(bp); -diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c -index f557a2aaec23..73a7c8a50470 100644 ---- a/drivers/net/ethernet/broadcom/sb1250-mac.c -+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c -@@ -300,7 +300,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *, - static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff); - static uint64_t sbmac_addr2reg(unsigned char *ptr); - static irqreturn_t sbmac_intr(int irq, void *dev_instance); --static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); -+static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); - static void sbmac_setmulti(struct sbmac_softc *sc); - static int sbmac_init(struct platform_device *pldev, long long base); - static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed); -@@ -2033,7 +2033,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance) - * Return value: - * nothing - ********************************************************************* */ --static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) - { - struct sbmac_softc *sc = netdev_priv(dev); - unsigned long flags; -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c -index 052c660aca80..658609c1bdab 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c -@@ -266,8 +266,8 @@ void cxgb4_dcb_handle_fw_update(struct adapter *adap, - enum cxgb4_dcb_state_input input = - ((pcmd->u.dcb.control.all_syncd_pkd & - FW_PORT_CMD_ALL_SYNCD_F) -- ? CXGB4_DCB_STATE_FW_ALLSYNCED -- : CXGB4_DCB_STATE_FW_INCOMPLETE); -+ ? CXGB4_DCB_INPUT_FW_ALLSYNCED -+ : CXGB4_DCB_INPUT_FW_INCOMPLETE); - - if (dcb->dcb_version != FW_PORT_DCB_VER_UNKNOWN) { - dcb_running_version = FW_PORT_CMD_DCB_VERSION_G( -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h -index ccf24d3dc982..2c418c405c50 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h -@@ -67,7 +67,7 @@ - do { \ - if ((__dcb)->dcb_version == FW_PORT_DCB_VER_IEEE) \ - cxgb4_dcb_state_fsm((__dev), \ -- CXGB4_DCB_STATE_FW_ALLSYNCED); \ -+ CXGB4_DCB_INPUT_FW_ALLSYNCED); \ - } while (0) - - /* States we can be in for a port's Data Center Bridging. -diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -index de23f23b41de..832ad1bd1f29 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c -@@ -3482,7 +3482,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op) - c.param[0].mnem = - cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) | - FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE)); -- c.param[0].val = (__force __be32)op; -+ c.param[0].val = cpu_to_be32(op); - - return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL); - } -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 22c43a776c6c..756c4ea17655 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -10828,6 +10828,7 @@ static void i40e_remove(struct pci_dev *pdev) - mutex_destroy(&hw->aq.asq_mutex); - - /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */ -+ rtnl_lock(); - i40e_clear_interrupt_scheme(pf); - for (i = 0; i < pf->num_alloc_vsi; i++) { - if (pf->vsi[i]) { -@@ -10836,6 +10837,7 @@ static void i40e_remove(struct pci_dev *pdev) - pf->vsi[i] = NULL; - } - } -+ rtnl_unlock(); - - for (i = 0; i < I40E_MAX_VEB; i++) { - kfree(pf->veb[i]); -@@ -10982,7 +10984,13 @@ static void i40e_shutdown(struct pci_dev *pdev) - wr32(hw, I40E_PFPM_WUFC, - (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0)); - -+ /* Since we're going to destroy queues during the -+ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this -+ * whole section -+ */ -+ rtnl_lock(); - i40e_clear_interrupt_scheme(pf); -+ rtnl_unlock(); - - if (system_state == SYSTEM_POWER_OFF) { - pci_wake_from_d3(pdev, pf->wol_en); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c -index 565ca7c835bc..e22ebe460b13 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c -@@ -605,7 +605,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf) - if (!IS_ERR_OR_NULL(pf->ptp_clock)) - return 0; - -- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name)); -+ strncpy(pf->ptp_caps.name, i40e_driver_name, -+ sizeof(pf->ptp_caps.name) - 1); - pf->ptp_caps.owner = THIS_MODULE; - pf->ptp_caps.max_adj = 999999999; - pf->ptp_caps.n_ext_ts = 0; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index e116d9a99b8e..cdb263875efb 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -1677,6 +1677,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) - ret = I40E_ERR_INVALID_MAC_ADDR; - goto error_param; - } -+ -+ if (vf->pf_set_mac && -+ ether_addr_equal(al->list[i].addr, -+ vf->default_lan_addr.addr)) { -+ dev_err(&pf->pdev->dev, -+ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n", -+ vf->default_lan_addr.addr, vf->vf_id); -+ ret = I40E_ERR_PARAM; -+ goto error_param; -+ } - } - vsi = pf->vsi[vf->lan_vsi_idx]; - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index a5b443171b8b..4521181aa0ed 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -4532,6 +4532,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) - struct ixgbe_hw *hw = &adapter->hw; - struct hlist_node *node2; - struct ixgbe_fdir_filter *filter; -+ u64 action; - - spin_lock(&adapter->fdir_perfect_lock); - -@@ -4540,12 +4541,17 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) - - hlist_for_each_entry_safe(filter, node2, - &adapter->fdir_filter_list, fdir_node) { -+ action = filter->action; -+ if (action != IXGBE_FDIR_DROP_QUEUE && action != 0) -+ action = -+ (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1; -+ - ixgbe_fdir_write_perfect_filter_82599(hw, - &filter->filter, - filter->sw_idx, -- (filter->action == IXGBE_FDIR_DROP_QUEUE) ? -+ (action == IXGBE_FDIR_DROP_QUEUE) ? - IXGBE_FDIR_DROP_QUEUE : -- adapter->rx_ring[filter->action]->reg_idx); -+ adapter->rx_ring[action]->reg_idx); - } - - spin_unlock(&adapter->fdir_perfect_lock); -diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c -index a8522d8af95d..2126286b72e9 100644 ---- a/drivers/net/ethernet/micrel/ks8695net.c -+++ b/drivers/net/ethernet/micrel/ks8695net.c -@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev) - * sk_buff and adds it to the TX ring. It then kicks the TX DMA - * engine to ensure transmission begins. - */ --static int -+static netdev_tx_t - ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev) - { - struct ks8695_priv *ksp = netdev_priv(ndev); -diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c -index 2fc5cd56c0a8..8dc1f0277117 100644 ---- a/drivers/net/ethernet/micrel/ks8851_mll.c -+++ b/drivers/net/ethernet/micrel/ks8851_mll.c -@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len) - * spin_lock_irqsave is required because tx and rx should be mutual exclusive. - * So while tx is in-progress, prevent IRQ interrupt from happenning. - */ --static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) -+static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) - { -- int retv = NETDEV_TX_OK; -+ netdev_tx_t retv = NETDEV_TX_OK; - struct ks_net *ks = netdev_priv(netdev); - - disable_irq(netdev->irq); -diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c -index bd64eb982e52..37fb6dfc1087 100644 ---- a/drivers/net/ethernet/smsc/smc911x.c -+++ b/drivers/net/ethernet/smsc/smc911x.c -@@ -511,7 +511,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev) - * now, or set the card to generates an interrupt when ready - * for the packet. - */ --static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t -+smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct smc911x_local *lp = netdev_priv(dev); - unsigned int free; -diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c -index 23a038810083..7405f537beca 100644 ---- a/drivers/net/ethernet/smsc/smc91x.c -+++ b/drivers/net/ethernet/smsc/smc91x.c -@@ -637,7 +637,8 @@ done: if (!THROTTLE_TX_PKTS) - * now, or set the card to generates an interrupt when ready - * for the packet. - */ --static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t -+smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct smc_local *lp = netdev_priv(dev); - void __iomem *ioaddr = lp->base; -diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c -index 219a99b7a631..b62bf77a64f4 100644 ---- a/drivers/net/ethernet/smsc/smsc911x.c -+++ b/drivers/net/ethernet/smsc/smsc911x.c -@@ -1677,7 +1677,8 @@ static int smsc911x_stop(struct net_device *dev) - } - - /* Entry point for transmitting a packet */ --static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t -+smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct smsc911x_data *pdata = netdev_priv(dev); - unsigned int freespace; -diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c -index 79f0ec4e51ac..964df98b54ea 100644 ---- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c -+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c -@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card, - * @skb: packet to send out - * @netdev: interface device structure - * -- * returns 0 on success, <0 on failure -+ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure - */ --int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) -+netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) - { - struct gelic_card *card = netdev_card(netdev); - struct gelic_descr *descr; -diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h -index 8505196be9f5..d123644bd720 100644 ---- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h -+++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h -@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card); - void gelic_card_down(struct gelic_card *card); - int gelic_net_open(struct net_device *netdev); - int gelic_net_stop(struct net_device *netdev); --int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); -+netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); - void gelic_net_set_multi(struct net_device *netdev); - void gelic_net_tx_timeout(struct net_device *netdev); - int gelic_net_change_mtu(struct net_device *netdev, int new_mtu); -diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c -index 3c54a2cae5df..8e53211aedd8 100644 ---- a/drivers/net/ethernet/toshiba/spider_net.c -+++ b/drivers/net/ethernet/toshiba/spider_net.c -@@ -881,9 +881,9 @@ out: - * @skb: packet to send out - * @netdev: interface device structure - * -- * returns 0 on success, !0 on failure -+ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure - */ --static int -+static netdev_tx_t - spider_net_xmit(struct sk_buff *skb, struct net_device *netdev) - { - int cnt; -diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c -index 868fb6306df0..3e33c165a427 100644 ---- a/drivers/net/ethernet/toshiba/tc35815.c -+++ b/drivers/net/ethernet/toshiba/tc35815.c -@@ -475,7 +475,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_ - /* Index to functions, as function prototypes. */ - - static int tc35815_open(struct net_device *dev); --static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev); -+static netdev_tx_t tc35815_send_packet(struct sk_buff *skb, -+ struct net_device *dev); - static irqreturn_t tc35815_interrupt(int irq, void *dev_id); - static int tc35815_rx(struct net_device *dev, int limit); - static int tc35815_poll(struct napi_struct *napi, int budget); -@@ -1279,7 +1280,8 @@ tc35815_open(struct net_device *dev) - * invariant will hold if you make sure that the netif_*_queue() - * calls are done at the proper times. - */ --static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) -+static netdev_tx_t -+tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) - { - struct tc35815_local *lp = netdev_priv(dev); - struct TxFD *txfd; -diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index 5a1068df7038..ed6a88cf3281 100644 ---- a/drivers/net/ethernet/xilinx/ll_temac_main.c -+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -673,7 +673,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag) - return 0; - } - --static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) -+static netdev_tx_t -+temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) - { - struct temac_local *lp = netdev_priv(ndev); - struct cdmac_bd *cur_p; -diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -index f1e969128a4e..7f1a57bb2ab1 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c -@@ -656,7 +656,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp, - * start the transmission. Additionally if checksum offloading is supported, - * it populates AXI Stream Control fields with appropriate values. - */ --static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) -+static netdev_tx_t -+axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) - { - u32 ii; - u32 num_frag; -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index 4cb8b85cbf2c..909a008f9927 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -1008,9 +1008,10 @@ static int xemaclite_close(struct net_device *dev) - * deferred and the Tx queue is stopped so that the deferred socket buffer can - * be transmitted when the Emaclite device is free to transmit data. - * -- * Return: 0, always. -+ * Return: NETDEV_TX_OK, always. - */ --static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) -+static netdev_tx_t -+xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) - { - struct net_local *lp = netdev_priv(dev); - struct sk_buff *new_skb; -@@ -1031,7 +1032,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) - /* Take the time stamp now, since we can't do this in an ISR. */ - skb_tx_timestamp(new_skb); - spin_unlock_irqrestore(&lp->reset_lock, flags); -- return 0; -+ return NETDEV_TX_OK; - } - spin_unlock_irqrestore(&lp->reset_lock, flags); - -@@ -1040,7 +1041,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) - dev->stats.tx_bytes += len; - dev_consume_skb_any(new_skb); - -- return 0; -+ return NETDEV_TX_OK; - } - - /** -diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c -index a17d86a57734..d34bdd2f7ac7 100644 ---- a/drivers/net/slip/slip.c -+++ b/drivers/net/slip/slip.c -@@ -860,6 +860,7 @@ err_free_chan: - sl->tty = NULL; - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); -+ free_netdev(sl->dev); - - err_exit: - rtnl_unlock(); -diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c -index 5f18fcb8dcc7..6b1d03b73eeb 100644 ---- a/drivers/net/usb/ax88172a.c -+++ b/drivers/net/usb/ax88172a.c -@@ -243,7 +243,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) - - /* Get the MAC address */ - ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf); -- if (ret < 0) { -+ if (ret < ETH_ALEN) { - netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); - goto free; - } -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index 71ef895b4dca..bab13ccfb085 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -534,7 +534,7 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size) - err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE, - USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE, - 0, iface_no, &max_datagram_size, sizeof(max_datagram_size)); -- if (err < sizeof(max_datagram_size)) { -+ if (err != sizeof(max_datagram_size)) { - dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n"); - goto out; - } -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 45a6a7cae4bf..fc922f812280 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -2246,6 +2246,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) - int i; - - ret = lan78xx_get_endpoints(dev, intf); -+ if (ret) { -+ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n", -+ ret); -+ return ret; -+ } - - dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); - -diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h -index 257836a0cfbc..a7fab3b0a443 100644 ---- a/drivers/net/wireless/ath/ath10k/core.h -+++ b/drivers/net/wireless/ath/ath10k/core.h -@@ -755,6 +755,7 @@ struct ath10k { - - struct completion install_key_done; - -+ int last_wmi_vdev_start_status; - struct completion vdev_setup_done; - - struct workqueue_struct *workqueue; -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 5a0138c1c045..7fbf2abcfc43 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -850,7 +850,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar) - if (time_left == 0) - return -ETIMEDOUT; - -- return 0; -+ return ar->last_wmi_vdev_start_status; - } - - static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index b867875aa6e6..4d8cdbfc9d42 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -2294,7 +2294,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb) - status->freq, status->band, status->signal, - status->rate_idx); - -- ieee80211_rx(ar->hw, skb); -+ ieee80211_rx_ni(ar->hw, skb); -+ - return 0; - } - -@@ -2944,18 +2945,31 @@ void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb) - { - struct wmi_vdev_start_ev_arg arg = {}; - int ret; -+ u32 status; - - ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n"); - -+ ar->last_wmi_vdev_start_status = 0; -+ - ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg); - if (ret) { - ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret); -- return; -+ ar->last_wmi_vdev_start_status = ret; -+ goto out; - } - -- if (WARN_ON(__le32_to_cpu(arg.status))) -- return; -+ status = __le32_to_cpu(arg.status); -+ if (WARN_ON_ONCE(status)) { -+ ath10k_warn(ar, "vdev-start-response reports status error: %d (%s)\n", -+ status, (status == WMI_VDEV_START_CHAN_INVALID) ? -+ "chan-invalid" : "unknown"); -+ /* Setup is done one way or another though, so we should still -+ * do the completion, so don't return here. -+ */ -+ ar->last_wmi_vdev_start_status = -EINVAL; -+ } - -+out: - complete(&ar->vdev_setup_done); - } - -diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h -index a8b2553e8988..66148a82ad25 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.h -+++ b/drivers/net/wireless/ath/ath10k/wmi.h -@@ -5969,11 +5969,17 @@ struct wmi_ch_info_ev_arg { - __le32 rx_frame_count; - }; - -+/* From 10.4 firmware, not sure all have the same values. */ -+enum wmi_vdev_start_status { -+ WMI_VDEV_START_OK = 0, -+ WMI_VDEV_START_CHAN_INVALID, -+}; -+ - struct wmi_vdev_start_ev_arg { - __le32 vdev_id; - __le32 req_id; - __le32 resp_type; /* %WMI_VDEV_RESP_ */ -- __le32 status; -+ __le32 status; /* See wmi_vdev_start_status enum above */ - }; - - struct wmi_peer_kick_ev_arg { -diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c -index 03945731eb65..ec805fe6dddb 100644 ---- a/drivers/net/wireless/ath/ath9k/common-spectral.c -+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c -@@ -411,7 +411,7 @@ ath_cmn_process_ht20_40_fft(struct ath_rx_status *rs, - - ath_dbg(common, SPECTRAL_SCAN, - "Calculated new upper max 0x%X at %i\n", -- tmp_mag, i); -+ tmp_mag, fft_sample_40.upper_max_index); - } else - for (i = dc_pos; i < SPECTRAL_HT20_40_NUM_BINS; i++) { - if (fft_sample_40.data[i] == (upper_mag >> max_exp)) -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -index e6c8b0d5afe0..7dae935701a7 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c -@@ -1469,10 +1469,12 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, - return 0; - - if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) { -- if (e->status == BRCMF_E_STATUS_SUCCESS) -+ if (e->status == BRCMF_E_STATUS_SUCCESS) { - set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, - &p2p->status); -- else { -+ if (!p2p->wait_for_offchan_complete) -+ complete(&p2p->send_af_done); -+ } else { - set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status); - /* If there is no ack, we don't need to wait for - * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event -@@ -1523,6 +1525,17 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p, - p2p->af_sent_channel = le32_to_cpu(af_params->channel); - p2p->af_tx_sent_jiffies = jiffies; - -+ if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) && -+ p2p->af_sent_channel == -+ ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq)) -+ p2p->wait_for_offchan_complete = false; -+ else -+ p2p->wait_for_offchan_complete = true; -+ -+ brcmf_dbg(TRACE, "Waiting for %s tx completion event\n", -+ (p2p->wait_for_offchan_complete) ? -+ "off-channel" : "on-channel"); -+ - timeout = wait_for_completion_timeout(&p2p->send_af_done, - msecs_to_jiffies(P2P_AF_MAX_WAIT_TIME)); - -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h -index 5d49059021a9..59e902adfc08 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h -+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h -@@ -125,6 +125,7 @@ struct afx_hdl { - * @gon_req_action: about to send go negotiation requets frame. - * @block_gon_req_tx: drop tx go negotiation requets frame. - * @p2pdev_dynamically: is p2p device if created by module param or supplicant. -+ * @wait_for_offchan_complete: wait for off-channel tx completion event. - */ - struct brcmf_p2p_info { - struct brcmf_cfg80211_info *cfg; -@@ -146,6 +147,7 @@ struct brcmf_p2p_info { - bool gon_req_action; - bool block_gon_req_tx; - bool p2pdev_dynamically; -+ bool wait_for_offchan_complete; - }; - - s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced); -diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c -index c2d5b495c179..c089540116fa 100644 ---- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c -+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c -@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev, - led->dev = dev; - led->ledpin = ledpin; - led->is_radio = is_radio; -- strncpy(led->name, name, sizeof(led->name)); -+ strlcpy(led->name, name, sizeof(led->name)); - - led->led_dev.name = led->name; - led->led_dev.default_trigger = default_trigger; -diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c -index 931cc33e46f0..5d6d1bb4f110 100644 ---- a/drivers/nvmem/core.c -+++ b/drivers/nvmem/core.c -@@ -457,7 +457,7 @@ static struct nvmem_device *nvmem_find(const char *name) - d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match); - - if (!d) -- return NULL; -+ return ERR_PTR(-ENOENT); - - return to_nvmem_device(d); - } -diff --git a/drivers/of/base.c b/drivers/of/base.c -index c6e019208d17..27783223ca5c 100644 ---- a/drivers/of/base.c -+++ b/drivers/of/base.c -@@ -2125,7 +2125,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np) - /* OF on pmac has nodes instead of properties named "l2-cache" - * beneath CPU nodes. - */ -- if (!strcmp(np->type, "cpu")) -+ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu")) - for_each_child_of_node(np, child) - if (!strcmp(child->type, "cache")) - return child; -diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c -index 9aa82a4e9e25..b4420a0bf7d6 100644 ---- a/drivers/pinctrl/pinctrl-at91-pio4.c -+++ b/drivers/pinctrl/pinctrl-at91-pio4.c -@@ -477,7 +477,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - unsigned num_pins, num_configs, reserve; - unsigned long *configs; - struct property *pins; -- bool has_config; - u32 pinfunc; - int ret, i; - -@@ -493,9 +492,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - return ret; - } - -- if (num_configs) -- has_config = true; -- - num_pins = pins->length / sizeof(u32); - if (!num_pins) { - dev_err(pctldev->dev, "no pins found in node %s\n", -@@ -508,7 +504,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - * map for each pin. - */ - reserve = 1; -- if (has_config && num_pins >= 1) -+ if (num_configs) - reserve++; - reserve *= num_pins; - ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps, -@@ -531,7 +527,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps, - group, func); - -- if (has_config) { -+ if (num_configs) { - ret = pinctrl_utils_add_map_configs(pctldev, map, - reserved_maps, num_maps, group, - configs, num_configs, -diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c -index 0d2fc0cff35e..52bbd34f7d0d 100644 ---- a/drivers/pinctrl/pinctrl-at91.c -+++ b/drivers/pinctrl/pinctrl-at91.c -@@ -1556,16 +1556,6 @@ void at91_pinctrl_gpio_resume(void) - #define gpio_irq_set_wake NULL - #endif /* CONFIG_PM */ - --static struct irq_chip gpio_irqchip = { -- .name = "GPIO", -- .irq_ack = gpio_irq_ack, -- .irq_disable = gpio_irq_mask, -- .irq_mask = gpio_irq_mask, -- .irq_unmask = gpio_irq_unmask, -- /* .irq_set_type is set dynamically */ -- .irq_set_wake = gpio_irq_set_wake, --}; -- - static void gpio_irq_handler(struct irq_desc *desc) - { - struct irq_chip *chip = irq_desc_get_chip(desc); -@@ -1608,12 +1598,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, - struct gpio_chip *gpiochip_prev = NULL; - struct at91_gpio_chip *prev = NULL; - struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq); -+ struct irq_chip *gpio_irqchip; - int ret, i; - -+ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL); -+ if (!gpio_irqchip) -+ return -ENOMEM; -+ - at91_gpio->pioc_hwirq = irqd_to_hwirq(d); - -- /* Setup proper .irq_set_type function */ -- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type; -+ gpio_irqchip->name = "GPIO"; -+ gpio_irqchip->irq_ack = gpio_irq_ack; -+ gpio_irqchip->irq_disable = gpio_irq_mask; -+ gpio_irqchip->irq_mask = gpio_irq_mask; -+ gpio_irqchip->irq_unmask = gpio_irq_unmask; -+ gpio_irqchip->irq_set_wake = gpio_irq_set_wake, -+ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type; - - /* Disable irqs of this PIO controller */ - writel_relaxed(~0, at91_gpio->regbase + PIO_IDR); -@@ -1624,7 +1624,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, - * interrupt. - */ - ret = gpiochip_irqchip_add(&at91_gpio->chip, -- &gpio_irqchip, -+ gpio_irqchip, - 0, - handle_edge_irq, - IRQ_TYPE_EDGE_BOTH); -@@ -1642,7 +1642,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, - if (!gpiochip_prev) { - /* Then register the chain on the parent IRQ */ - gpiochip_set_chained_irqchip(&at91_gpio->chip, -- &gpio_irqchip, -+ gpio_irqchip, - at91_gpio->pioc_virq, - gpio_irq_handler); - return 0; -diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c -index 3830dade5d69..d91111200dde 100644 ---- a/drivers/power/ab8500_fg.c -+++ b/drivers/power/ab8500_fg.c -@@ -2447,17 +2447,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf, - size_t count) - { - unsigned long charge_full; -- ssize_t ret; -+ int ret; - - ret = kstrtoul(buf, 10, &charge_full); -+ if (ret) -+ return ret; - -- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full); -- -- if (!ret) { -- di->bat_cap.max_mah = (int) charge_full; -- ret = count; -- } -- return ret; -+ di->bat_cap.max_mah = (int) charge_full; -+ return count; - } - - static ssize_t charge_now_show(struct ab8500_fg *di, char *buf) -@@ -2469,20 +2466,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf, - size_t count) - { - unsigned long charge_now; -- ssize_t ret; -+ int ret; - - ret = kstrtoul(buf, 10, &charge_now); -+ if (ret) -+ return ret; - -- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d", -- ret, charge_now, di->bat_cap.prev_mah); -- -- if (!ret) { -- di->bat_cap.user_mah = (int) charge_now; -- di->flags.user_cap = true; -- ret = count; -- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); -- } -- return ret; -+ di->bat_cap.user_mah = (int) charge_now; -+ di->flags.user_cap = true; -+ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); -+ return count; - } - - static struct ab8500_fg_sysfs_entry charge_full_attr = -diff --git a/drivers/power/max8998_charger.c b/drivers/power/max8998_charger.c -index b64cf0f14142..66438029bdd0 100644 ---- a/drivers/power/max8998_charger.c -+++ b/drivers/power/max8998_charger.c -@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = { - static int max8998_battery_probe(struct platform_device *pdev) - { - struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent); -- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev); -+ struct max8998_platform_data *pdata = iodev->pdata; - struct power_supply_config psy_cfg = {}; - struct max8998_battery_data *max8998; - struct i2c_client *i2c; -diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c -index bcd4dc304f27..5b1f147b11cb 100644 ---- a/drivers/power/twl4030_charger.c -+++ b/drivers/power/twl4030_charger.c -@@ -449,7 +449,8 @@ static void twl4030_current_worker(struct work_struct *data) - - if (v < USB_MIN_VOLT) { - /* Back up and stop adjusting. */ -- bci->usb_cur -= USB_CUR_STEP; -+ if (bci->usb_cur >= USB_CUR_STEP) -+ bci->usb_cur -= USB_CUR_STEP; - bci->usb_cur_target = bci->usb_cur; - } else if (bci->usb_cur >= bci->usb_cur_target || - bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) { -@@ -468,6 +469,7 @@ static void twl4030_current_worker(struct work_struct *data) - static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) - { - int ret; -+ u32 reg; - - if (bci->usb_mode == CHARGE_OFF) - enable = false; -@@ -481,14 +483,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) - bci->usb_enabled = 1; - } - -- if (bci->usb_mode == CHARGE_AUTO) -+ if (bci->usb_mode == CHARGE_AUTO) { -+ /* Enable interrupts now. */ -+ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC | -+ TWL4030_TBATOR2 | TWL4030_TBATOR1 | -+ TWL4030_BATSTS); -+ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, -+ TWL4030_INTERRUPTS_BCIIMR1A); -+ if (ret < 0) { -+ dev_err(bci->dev, -+ "failed to unmask interrupts: %d\n", -+ ret); -+ return ret; -+ } - /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */ - ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB); -+ } - - /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */ - ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0, - TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4); - if (bci->usb_mode == CHARGE_LINEAR) { -+ /* Enable interrupts now. */ -+ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 | -+ TWL4030_TBATOR1 | TWL4030_BATSTS); -+ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, -+ TWL4030_INTERRUPTS_BCIIMR1A); -+ if (ret < 0) { -+ dev_err(bci->dev, -+ "failed to unmask interrupts: %d\n", -+ ret); -+ return ret; -+ } - twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0); - /* Watch dog key: WOVF acknowledge */ - ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33, -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index 22045e7d78ac..97211f7f0cf0 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -996,7 +996,10 @@ static int __qeth_l2_open(struct net_device *dev) - - if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { - napi_enable(&card->napi); -+ local_bh_disable(); - napi_schedule(&card->napi); -+ /* kick-start the NAPI softirq: */ -+ local_bh_enable(); - } else - rc = -EIO; - return rc; -diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c -index 2cc9bc1ef1e3..0d71d2e6419a 100644 ---- a/drivers/s390/net/qeth_l3_main.c -+++ b/drivers/s390/net/qeth_l3_main.c -@@ -3031,7 +3031,10 @@ static int __qeth_l3_open(struct net_device *dev) - - if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { - napi_enable(&card->napi); -+ local_bh_disable(); - napi_schedule(&card->napi); -+ /* kick-start the NAPI softirq: */ -+ local_bh_enable(); - } else - rc = -EIO; - return rc; -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 400eee9d7783..d44f18f773c0 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -2049,14 +2049,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last) - return res; - } - -- /* delete the old link */ -- if (SAS_ADDR(phy->attached_sas_addr) && -- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) { -- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", -- SAS_ADDR(dev->sas_addr), phy_id, -- SAS_ADDR(phy->attached_sas_addr)); -- sas_unregister_devs_sas_addr(dev, phy_id, last); -- } -+ /* we always have to delete the old device when we went here */ -+ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", -+ SAS_ADDR(dev->sas_addr), phy_id, -+ SAS_ADDR(phy->attached_sas_addr)); -+ sas_unregister_devs_sas_addr(dev, phy_id, last); - - return sas_discover_new(dev, phy_id); - } -diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c -index 04e67a190652..b3490b4a046a 100644 ---- a/drivers/scsi/pm8001/pm8001_hwi.c -+++ b/drivers/scsi/pm8001/pm8001_hwi.c -@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha, - } else { - u32 producer_index; - void *pi_virt = circularQ->pi_virt; -+ /* spurious interrupt during setup if -+ * kexec-ing and driver doing a doorbell access -+ * with the pre-kexec oq interrupt setup -+ */ -+ if (!pi_virt) -+ break; - /* Update the producer index from SPC */ - producer_index = pm8001_read_32(pi_virt); - circularQ->producer_index = cpu_to_le32(producer_index); -diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c -index 949198c01ced..3862d8b1defe 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.c -+++ b/drivers/scsi/pm8001/pm8001_sas.c -@@ -371,6 +371,13 @@ static int pm8001_task_exec(struct sas_task *task, - return 0; - } - pm8001_ha = pm8001_find_ha_by_dev(task->dev); -+ if (pm8001_ha->controller_fatal_error) { -+ struct task_status_struct *ts = &t->task_status; -+ -+ ts->resp = SAS_TASK_UNDELIVERED; -+ t->task_done(t); -+ return 0; -+ } - PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n ")); - spin_lock_irqsave(&pm8001_ha->lock, flags); - do { -@@ -463,7 +470,7 @@ err_out: - dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc); - if (!sas_protocol_ata(t->task_proto)) - if (n_elem) -- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem, -+ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter, - t->data_dir); - out_done: - spin_unlock_irqrestore(&pm8001_ha->lock, flags); -diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h -index 6628cc38316c..d8768ac41ebb 100644 ---- a/drivers/scsi/pm8001/pm8001_sas.h -+++ b/drivers/scsi/pm8001/pm8001_sas.h -@@ -531,6 +531,7 @@ struct pm8001_hba_info { - u32 logging_level; - u32 fw_status; - u32 smp_exp_mode; -+ bool controller_fatal_error; - const struct firmware *fw_image; - struct isr_param irq_vector[PM8001_MAX_MSIX_VEC]; - }; -diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c -index eb4fee61df72..9edd61c063a1 100644 ---- a/drivers/scsi/pm8001/pm80xx_hwi.c -+++ b/drivers/scsi/pm8001/pm80xx_hwi.c -@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha) - pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size); - pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION, - pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity); -+ /* Update Fatal error interrupt vector */ -+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |= -+ ((pm8001_ha->number_of_intr - 1) << 8); - pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT, - pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt); - pm8001_mw32(address, MAIN_EVENT_CRC_CHECK, -@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha) - return -EBUSY; - } - -+ /* Initialize the controller fatal error flag */ -+ pm8001_ha->controller_fatal_error = false; -+ - /* Initialize pci space address eg: mpi offset */ - init_pci_device_addresses(pm8001_ha); - init_default_table_values(pm8001_ha); -@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha) - u32 bootloader_state; - u32 ibutton0, ibutton1; - -- /* Check if MPI is in ready state to reset */ -- if (mpi_uninit_check(pm8001_ha) != 0) { -- PM8001_FAIL_DBG(pm8001_ha, -- pm8001_printk("MPI state is not ready\n")); -- return -1; -+ /* Process MPI table uninitialization only if FW is ready */ -+ if (!pm8001_ha->controller_fatal_error) { -+ /* Check if MPI is in ready state to reset */ -+ if (mpi_uninit_check(pm8001_ha) != 0) { -+ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); -+ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( -+ "MPI state is not ready scratch1 :0x%x\n", -+ regval)); -+ return -1; -+ } - } -- - /* checked for reset register normal state; 0x0 */ - regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET); - PM8001_INIT_DBG(pm8001_ha, -@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb) - } - } - -+static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha) -+{ -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6))); -+ PM8001_FAIL_DBG(pm8001_ha, -+ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n", -+ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7))); -+} -+ - static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) - { - struct outbound_queue_table *circularQ; -@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) - u8 uninitialized_var(bc); - u32 ret = MPI_IO_STATUS_FAIL; - unsigned long flags; -+ u32 regval; - -+ if (vec == (pm8001_ha->number_of_intr - 1)) { -+ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); -+ if ((regval & SCRATCH_PAD_MIPSALL_READY) != -+ SCRATCH_PAD_MIPSALL_READY) { -+ pm8001_ha->controller_fatal_error = true; -+ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( -+ "Firmware Fatal error! Regval:0x%x\n", regval)); -+ print_scratchpad_registers(pm8001_ha); -+ return ret; -+ } -+ } - spin_lock_irqsave(&pm8001_ha->lock, flags); - circularQ = &pm8001_ha->outbnd_q_tbl[vec]; - do { -+ /* spurious interrupt during setup if kexec-ing and -+ * driver doing a doorbell access w/ the pre-kexec oq -+ * interrupt setup. -+ */ -+ if (!circularQ->pi_virt) -+ break; - ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc); - if (MPI_IO_STATUS_SUCCESS == ret) { - /* process the outbound message */ -diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h -index 7a443bad6163..411b414a9a0e 100644 ---- a/drivers/scsi/pm8001/pm80xx_hwi.h -+++ b/drivers/scsi/pm8001/pm80xx_hwi.h -@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t; - #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0 - #define SCRATCH_PAD_IOP0_READY 0xC00 - #define SCRATCH_PAD_IOP1_READY 0x3000 -+#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \ -+ SCRATCH_PAD_IOP0_READY | \ -+ SCRATCH_PAD_RAAE_READY) - - /* boot loader state */ - #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */ -diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c -index c6425e3df5a0..f1c771437752 100644 ---- a/drivers/scsi/sym53c8xx_2/sym_hipd.c -+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c -@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym - OUTB(np, HS_PRT, HS_BUSY); - } - -+#define sym_printk(lvl, tp, cp, fmt, v...) do { \ -+ if (cp) \ -+ scmd_printk(lvl, cp->cmd, fmt, ##v); \ -+ else \ -+ starget_printk(lvl, tp->starget, fmt, ##v); \ -+} while (0) -+ - /* - * chip exception handler for programmed interrupts. - */ -@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np) - * been selected with ATN. We do not want to handle that. - */ - case SIR_SEL_ATN_NO_MSG_OUT: -- scmd_printk(KERN_WARNING, cp->cmd, -+ sym_printk(KERN_WARNING, tp, cp, - "No MSG OUT phase after selection with ATN\n"); - goto out_stuck; - /* -@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np) - * having reselected the initiator. - */ - case SIR_RESEL_NO_MSG_IN: -- scmd_printk(KERN_WARNING, cp->cmd, -+ sym_printk(KERN_WARNING, tp, cp, - "No MSG IN phase after reselection\n"); - goto out_stuck; - /* -@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np) - * an IDENTIFY. - */ - case SIR_RESEL_NO_IDENTIFY: -- scmd_printk(KERN_WARNING, cp->cmd, -+ sym_printk(KERN_WARNING, tp, cp, - "No IDENTIFY after reselection\n"); - goto out_stuck; - /* -@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np) - case SIR_RESEL_ABORTED: - np->lastmsg = np->msgout[0]; - np->msgout[0] = M_NOOP; -- scmd_printk(KERN_WARNING, cp->cmd, -+ sym_printk(KERN_WARNING, tp, cp, - "message %x sent on bad reselection\n", np->lastmsg); - goto out; - /* -diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c -index 035767c02072..f42ae9efb255 100644 ---- a/drivers/spi/spi-rockchip.c -+++ b/drivers/spi/spi-rockchip.c -@@ -444,6 +444,9 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs) - struct dma_slave_config rxconf, txconf; - struct dma_async_tx_descriptor *rxdesc, *txdesc; - -+ memset(&rxconf, 0, sizeof(rxconf)); -+ memset(&txconf, 0, sizeof(txconf)); -+ - spin_lock_irqsave(&rs->lock, flags); - rs->state &= ~RXBUSY; - rs->state &= ~TXBUSY; -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index d0e7dfc647cf..c5f1045561ac 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -713,11 +713,9 @@ static int spidev_probe(struct spi_device *spi) - * compatible string, it is a Linux implementation thing - * rather than a description of the hardware. - */ -- if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) { -- dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n"); -- WARN_ON(spi->dev.of_node && -- !of_match_device(spidev_dt_ids, &spi->dev)); -- } -+ WARN(spi->dev.of_node && -+ of_device_is_compatible(spi->dev.of_node, "spidev"), -+ "%pOF: buggy DT: spidev listed directly in DT\n", spi->dev.of_node); - - /* Allocate driver data */ - spidev = kzalloc(sizeof(*spidev), GFP_KERNEL); -diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c -index daa4a65ef6ff..fe870170db74 100644 ---- a/drivers/tty/serial/mxs-auart.c -+++ b/drivers/tty/serial/mxs-auart.c -@@ -1248,8 +1248,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) - - /* - * If something went wrong, rollback. -+ * Be careful: i may be unsigned. - */ -- while (err && (--i >= 0)) -+ while (err && (i-- > 0)) - if (irq[i] >= 0) - free_irq(irq[i], s); - -diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c -index f36a1ac3bfbd..b8650210be0f 100644 ---- a/drivers/usb/chipidea/otg.c -+++ b/drivers/usb/chipidea/otg.c -@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work) - } - - pm_runtime_get_sync(ci->dev); -+ - if (ci->id_event) { - ci->id_event = false; - ci_handle_id_switch(ci); -- } else if (ci->b_sess_valid_event) { -+ } -+ -+ if (ci->b_sess_valid_event) { - ci->b_sess_valid_event = false; - ci_handle_vbus_change(ci); -- } else -- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__); -+ } -+ - pm_runtime_put_sync(ci->dev); - - enable_irq(ci->irq); -diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c -index 01656f1c6d65..a49ff1f5c0f9 100644 ---- a/drivers/usb/gadget/function/uvc_configfs.c -+++ b/drivers/usb/gadget/function/uvc_configfs.c -@@ -564,6 +564,7 @@ static int uvcg_control_class_allow_link(struct config_item *src, - unlock: - mutex_unlock(&opts->lock); - out: -+ config_item_put(header); - mutex_unlock(su_mutex); - return ret; - } -@@ -605,6 +606,7 @@ static int uvcg_control_class_drop_link(struct config_item *src, - unlock: - mutex_unlock(&opts->lock); - out: -+ config_item_put(header); - mutex_unlock(su_mutex); - return ret; - } -@@ -805,6 +807,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src, - format_ptr->fmt = target_fmt; - list_add_tail(&format_ptr->entry, &src_hdr->formats); - ++src_hdr->num_fmt; -+ ++target_fmt->linked; - - out: - mutex_unlock(&opts->lock); -@@ -843,6 +846,8 @@ static int uvcg_streaming_header_drop_link(struct config_item *src, - break; - } - -+ --target_fmt->linked; -+ - out: - mutex_unlock(&opts->lock); - mutex_unlock(su_mutex); -@@ -2087,6 +2092,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, - unlock: - mutex_unlock(&opts->lock); - out: -+ config_item_put(header); - mutex_unlock(su_mutex); - return ret; - } -@@ -2131,6 +2137,7 @@ static int uvcg_streaming_class_drop_link(struct config_item *src, - unlock: - mutex_unlock(&opts->lock); - out: -+ config_item_put(header); - mutex_unlock(su_mutex); - return ret; - } -diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c -index 0f01c04d7cbd..d6bab12b0b47 100644 ---- a/drivers/usb/gadget/function/uvc_video.c -+++ b/drivers/usb/gadget/function/uvc_video.c -@@ -129,6 +129,21 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video, - * Request handling - */ - -+static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req) -+{ -+ int ret; -+ -+ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); -+ if (ret < 0) { -+ printk(KERN_INFO "Failed to queue request (%d).\n", ret); -+ /* Isochronous endpoints can't be halted. */ -+ if (usb_endpoint_xfer_bulk(video->ep->desc)) -+ usb_ep_set_halt(video->ep); -+ } -+ -+ return ret; -+} -+ - /* - * I somehow feel that synchronisation won't be easy to achieve here. We have - * three events that control USB requests submission: -@@ -193,14 +208,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) - - video->encode(req, video, buf); - -- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) { -- printk(KERN_INFO "Failed to queue request (%d).\n", ret); -- usb_ep_set_halt(ep); -- spin_unlock_irqrestore(&video->queue.irqlock, flags); -+ ret = uvcg_video_ep_queue(video, req); -+ spin_unlock_irqrestore(&video->queue.irqlock, flags); -+ -+ if (ret < 0) { - uvcg_queue_cancel(queue, 0); - goto requeue; - } -- spin_unlock_irqrestore(&video->queue.irqlock, flags); - - return; - -@@ -320,15 +334,13 @@ int uvcg_video_pump(struct uvc_video *video) - video->encode(req, video, buf); - - /* Queue the USB request */ -- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); -+ ret = uvcg_video_ep_queue(video, req); -+ spin_unlock_irqrestore(&queue->irqlock, flags); -+ - if (ret < 0) { -- printk(KERN_INFO "Failed to queue request (%d)\n", ret); -- usb_ep_set_halt(video->ep); -- spin_unlock_irqrestore(&queue->irqlock, flags); - uvcg_queue_cancel(queue, 0); - break; - } -- spin_unlock_irqrestore(&queue->irqlock, flags); - } - - spin_lock_irqsave(&video->req_lock, flags); -diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c -index 95df2b3bb6a1..76e991557116 100644 ---- a/drivers/usb/gadget/udc/fotg210-udc.c -+++ b/drivers/usb/gadget/udc/fotg210-udc.c -@@ -744,7 +744,7 @@ static void fotg210_get_status(struct fotg210_udc *fotg210, - fotg210->ep0_req->length = 2; - - spin_unlock(&fotg210->lock); -- fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_KERNEL); -+ fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC); - spin_lock(&fotg210->lock); - } - -diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c -index 244acb1299a9..e92cd1eceefa 100644 ---- a/drivers/usb/serial/cypress_m8.c -+++ b/drivers/usb/serial/cypress_m8.c -@@ -773,7 +773,7 @@ send: - - usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev, - usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress), -- port->interrupt_out_buffer, port->interrupt_out_size, -+ port->interrupt_out_buffer, actual_size, - cypress_write_int_callback, port, priv->write_urb_interval); - result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC); - if (result) { -diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c -index c55c632a3b24..ad5929fbceb1 100644 ---- a/drivers/vfio/pci/vfio_pci_config.c -+++ b/drivers/vfio/pci/vfio_pci_config.c -@@ -1130,8 +1130,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) - return -ENOMEM; - - ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); -- if (ret) -+ if (ret) { -+ kfree(vdev->msi_perm); - return ret; -+ } - - return len; - } -diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c -index cd50df5807ea..086611c7bc03 100644 ---- a/drivers/video/backlight/lm3639_bl.c -+++ b/drivers/video/backlight/lm3639_bl.c -@@ -400,10 +400,8 @@ static int lm3639_remove(struct i2c_client *client) - - regmap_write(pchip->regmap, REG_ENABLE, 0x00); - -- if (&pchip->cdev_torch) -- led_classdev_unregister(&pchip->cdev_torch); -- if (&pchip->cdev_flash) -- led_classdev_unregister(&pchip->cdev_flash); -+ led_classdev_unregister(&pchip->cdev_torch); -+ led_classdev_unregister(&pchip->cdev_flash); - if (pchip->bled) - device_remove_file(&(pchip->bled->dev), &dev_attr_bled_mode); - return 0; -diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig -index 3543e3e4cfb5..6873be034448 100644 ---- a/drivers/video/fbdev/Kconfig -+++ b/drivers/video/fbdev/Kconfig -@@ -1991,16 +1991,6 @@ config FB_SH_MOBILE_LCDC - ---help--- - Frame buffer driver for the on-chip SH-Mobile LCD controller. - --config FB_SH_MOBILE_HDMI -- tristate "SuperH Mobile HDMI controller support" -- depends on FB_SH_MOBILE_LCDC -- select FB_MODE_HELPERS -- select SOUND -- select SND -- select SND_SOC -- ---help--- -- Driver for the on-chip SH-Mobile HDMI controller. -- - config FB_TMIO - tristate "Toshiba Mobile IO FrameBuffer support" - depends on FB && (MFD_TMIO || COMPILE_TEST) -diff --git a/drivers/video/fbdev/Makefile b/drivers/video/fbdev/Makefile -index 50ed1b4fc2bf..65fb15075c8f 100644 ---- a/drivers/video/fbdev/Makefile -+++ b/drivers/video/fbdev/Makefile -@@ -118,7 +118,6 @@ obj-$(CONFIG_FB_UDL) += udlfb.o - obj-$(CONFIG_FB_SMSCUFX) += smscufx.o - obj-$(CONFIG_FB_XILINX) += xilinxfb.o - obj-$(CONFIG_SH_MIPI_DSI) += sh_mipi_dsi.o --obj-$(CONFIG_FB_SH_MOBILE_HDMI) += sh_mobile_hdmi.o - obj-$(CONFIG_FB_SH_MOBILE_MERAM) += sh_mobile_meram.o - obj-$(CONFIG_FB_SH_MOBILE_LCDC) += sh_mobile_lcdcfb.o - obj-$(CONFIG_FB_OMAP) += omap/ -diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c -index 47c3191ec313..0a5b3f844654 100644 ---- a/drivers/video/fbdev/core/fbmon.c -+++ b/drivers/video/fbdev/core/fbmon.c -@@ -997,97 +997,6 @@ void fb_edid_to_monspecs(unsigned char *edid, struct fb_monspecs *specs) - DPRINTK("========================================\n"); - } - --/** -- * fb_edid_add_monspecs() - add monitor video modes from E-EDID data -- * @edid: 128 byte array with an E-EDID block -- * @spacs: monitor specs to be extended -- */ --void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs) --{ -- unsigned char *block; -- struct fb_videomode *m; -- int num = 0, i; -- u8 svd[64], edt[(128 - 4) / DETAILED_TIMING_DESCRIPTION_SIZE]; -- u8 pos = 4, svd_n = 0; -- -- if (!edid) -- return; -- -- if (!edid_checksum(edid)) -- return; -- -- if (edid[0] != 0x2 || -- edid[2] < 4 || edid[2] > 128 - DETAILED_TIMING_DESCRIPTION_SIZE) -- return; -- -- DPRINTK(" Short Video Descriptors\n"); -- -- while (pos < edid[2]) { -- u8 len = edid[pos] & 0x1f, type = (edid[pos] >> 5) & 7; -- pr_debug("Data block %u of %u bytes\n", type, len); -- if (type == 2) { -- for (i = pos; i < pos + len; i++) { -- u8 idx = edid[pos + i] & 0x7f; -- svd[svd_n++] = idx; -- pr_debug("N%sative mode #%d\n", -- edid[pos + i] & 0x80 ? "" : "on-n", idx); -- } -- } else if (type == 3 && len >= 3) { -- /* Check Vendor Specific Data Block. For HDMI, -- it is always 00-0C-03 for HDMI Licensing, LLC. */ -- if (edid[pos + 1] == 3 && edid[pos + 2] == 0xc && -- edid[pos + 3] == 0) -- specs->misc |= FB_MISC_HDMI; -- } -- pos += len + 1; -- } -- -- block = edid + edid[2]; -- -- DPRINTK(" Extended Detailed Timings\n"); -- -- for (i = 0; i < (128 - edid[2]) / DETAILED_TIMING_DESCRIPTION_SIZE; -- i++, block += DETAILED_TIMING_DESCRIPTION_SIZE) -- if (PIXEL_CLOCK) -- edt[num++] = block - edid; -- -- /* Yikes, EDID data is totally useless */ -- if (!(num + svd_n)) -- return; -- -- m = kzalloc((specs->modedb_len + num + svd_n) * -- sizeof(struct fb_videomode), GFP_KERNEL); -- -- if (!m) -- return; -- -- memcpy(m, specs->modedb, specs->modedb_len * sizeof(struct fb_videomode)); -- -- for (i = specs->modedb_len; i < specs->modedb_len + num; i++) { -- get_detailed_timing(edid + edt[i - specs->modedb_len], &m[i]); -- if (i == specs->modedb_len) -- m[i].flag |= FB_MODE_IS_FIRST; -- pr_debug("Adding %ux%u@%u\n", m[i].xres, m[i].yres, m[i].refresh); -- } -- -- for (i = specs->modedb_len + num; i < specs->modedb_len + num + svd_n; i++) { -- int idx = svd[i - specs->modedb_len - num]; -- if (!idx || idx >= ARRAY_SIZE(cea_modes)) { -- pr_warning("Reserved SVD code %d\n", idx); -- } else if (!cea_modes[idx].xres) { -- pr_warning("Unimplemented SVD code %d\n", idx); -- } else { -- memcpy(&m[i], cea_modes + idx, sizeof(m[i])); -- pr_debug("Adding SVD #%d: %ux%u@%u\n", idx, -- m[i].xres, m[i].yres, m[i].refresh); -- } -- } -- -- kfree(specs->modedb); -- specs->modedb = m; -- specs->modedb_len = specs->modedb_len + num + svd_n; --} -- - /* - * VESA Generalized Timing Formula (GTF) - */ -@@ -1498,9 +1407,6 @@ void fb_edid_to_monspecs(unsigned char *edid, struct fb_monspecs *specs) - { - specs = NULL; - } --void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs) --{ --} - void fb_destroy_modedb(struct fb_videomode *modedb) - { - } -@@ -1608,7 +1514,6 @@ EXPORT_SYMBOL(fb_firmware_edid); - - EXPORT_SYMBOL(fb_parse_edid); - EXPORT_SYMBOL(fb_edid_to_monspecs); --EXPORT_SYMBOL(fb_edid_add_monspecs); - EXPORT_SYMBOL(fb_get_mode); - EXPORT_SYMBOL(fb_validate_mode); - EXPORT_SYMBOL(fb_destroy_modedb); -diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c -index 455a15f70172..a9d76e1b4378 100644 ---- a/drivers/video/fbdev/core/modedb.c -+++ b/drivers/video/fbdev/core/modedb.c -@@ -289,63 +289,6 @@ static const struct fb_videomode modedb[] = { - }; - - #ifdef CONFIG_FB_MODE_HELPERS --const struct fb_videomode cea_modes[65] = { -- /* #1: 640x480p@59.94/60Hz */ -- [1] = { -- NULL, 60, 640, 480, 39722, 48, 16, 33, 10, 96, 2, 0, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #3: 720x480p@59.94/60Hz */ -- [3] = { -- NULL, 60, 720, 480, 37037, 60, 16, 30, 9, 62, 6, 0, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #5: 1920x1080i@59.94/60Hz */ -- [5] = { -- NULL, 60, 1920, 1080, 13763, 148, 88, 15, 2, 44, 5, -- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -- FB_VMODE_INTERLACED, 0, -- }, -- /* #7: 720(1440)x480iH@59.94/60Hz */ -- [7] = { -- NULL, 60, 1440, 480, 18554/*37108*/, 114, 38, 15, 4, 124, 3, 0, -- FB_VMODE_INTERLACED, 0, -- }, -- /* #9: 720(1440)x240pH@59.94/60Hz */ -- [9] = { -- NULL, 60, 1440, 240, 18554, 114, 38, 16, 4, 124, 3, 0, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #18: 720x576pH@50Hz */ -- [18] = { -- NULL, 50, 720, 576, 37037, 68, 12, 39, 5, 64, 5, 0, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #19: 1280x720p@50Hz */ -- [19] = { -- NULL, 50, 1280, 720, 13468, 220, 440, 20, 5, 40, 5, -- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #20: 1920x1080i@50Hz */ -- [20] = { -- NULL, 50, 1920, 1080, 13480, 148, 528, 15, 5, 528, 5, -- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -- FB_VMODE_INTERLACED, 0, -- }, -- /* #32: 1920x1080p@23.98/24Hz */ -- [32] = { -- NULL, 24, 1920, 1080, 13468, 148, 638, 36, 4, 44, 5, -- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, -- FB_VMODE_NONINTERLACED, 0, -- }, -- /* #35: (2880)x480p4x@59.94/60Hz */ -- [35] = { -- NULL, 60, 2880, 480, 9250, 240, 64, 30, 9, 248, 6, 0, -- FB_VMODE_NONINTERLACED, 0, -- }, --}; -- - const struct fb_videomode vesa_modes[] = { - /* 0 640x350-85 VESA */ - { NULL, 85, 640, 350, 31746, 96, 32, 60, 32, 64, 3, -diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c -index 31c301d6be62..52e161dbd204 100644 ---- a/drivers/video/fbdev/sbuslib.c -+++ b/drivers/video/fbdev/sbuslib.c -@@ -105,11 +105,11 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, - struct fbtype __user *f = (struct fbtype __user *) arg; - - if (put_user(type, &f->fb_type) || -- __put_user(info->var.yres, &f->fb_height) || -- __put_user(info->var.xres, &f->fb_width) || -- __put_user(fb_depth, &f->fb_depth) || -- __put_user(0, &f->fb_cmsize) || -- __put_user(fb_size, &f->fb_cmsize)) -+ put_user(info->var.yres, &f->fb_height) || -+ put_user(info->var.xres, &f->fb_width) || -+ put_user(fb_depth, &f->fb_depth) || -+ put_user(0, &f->fb_cmsize) || -+ put_user(fb_size, &f->fb_cmsize)) - return -EFAULT; - return 0; - } -@@ -124,10 +124,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, - unsigned int index, count, i; - - if (get_user(index, &c->index) || -- __get_user(count, &c->count) || -- __get_user(ured, &c->red) || -- __get_user(ugreen, &c->green) || -- __get_user(ublue, &c->blue)) -+ get_user(count, &c->count) || -+ get_user(ured, &c->red) || -+ get_user(ugreen, &c->green) || -+ get_user(ublue, &c->blue)) - return -EFAULT; - - cmap.len = 1; -@@ -164,13 +164,13 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, - u8 red, green, blue; - - if (get_user(index, &c->index) || -- __get_user(count, &c->count) || -- __get_user(ured, &c->red) || -- __get_user(ugreen, &c->green) || -- __get_user(ublue, &c->blue)) -+ get_user(count, &c->count) || -+ get_user(ured, &c->red) || -+ get_user(ugreen, &c->green) || -+ get_user(ublue, &c->blue)) - return -EFAULT; - -- if (index + count > cmap->len) -+ if (index > cmap->len || count > cmap->len - index) - return -EINVAL; - - for (i = 0; i < count; i++) { -diff --git a/drivers/video/fbdev/sh_mobile_hdmi.c b/drivers/video/fbdev/sh_mobile_hdmi.c -deleted file mode 100644 -index 7c72a3f02056..000000000000 ---- a/drivers/video/fbdev/sh_mobile_hdmi.c -+++ /dev/null -@@ -1,1489 +0,0 @@ --/* -- * SH-Mobile High-Definition Multimedia Interface (HDMI) driver -- * for SLISHDMI13T and SLIPHDMIT IP cores -- * -- * Copyright (C) 2010, Guennadi Liakhovetski -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License version 2 as -- * published by the Free Software Foundation. -- */ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include