From: "Anthony G. Basile" <blueness@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-patchset:master commit in: 4.7.5/, 4.7.4/
Date: Wed, 28 Sep 2016 08:51:40 +0000 (UTC) [thread overview]
Message-ID: <1475052665.e4d3fa8f47469ab0c22a1ce0f78725f0d482c550.blueness@gentoo> (raw)
commit: e4d3fa8f47469ab0c22a1ce0f78725f0d482c550
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 08:51:05 2016 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 08:51:05 2016 +0000
URL: https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=e4d3fa8f
grsecurity-3.1-4.7.5-201609261522
4.7.4/1000_linux-4.7.1.patch | 1141 ---
4.7.4/1001_linux-4.7.2.patch | 7668 --------------------
4.7.4/1002_linux-4.7.3.patch | 4418 -----------
4.7.4/1003_linux-4.7.4.patch | 2424 -------
{4.7.4 => 4.7.5}/0000_README | 18 +-
.../4420_grsecurity-3.1-4.7.5-201609261522.patch | 1100 ++-
{4.7.4 => 4.7.5}/4425_grsec_remove_EI_PAX.patch | 0
{4.7.4 => 4.7.5}/4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{4.7.4 => 4.7.5}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{4.7.4 => 4.7.5}/4470_disable-compat_vdso.patch | 0
{4.7.4 => 4.7.5}/4475_emutramp_default_on.patch | 0
15 files changed, 731 insertions(+), 16038 deletions(-)
diff --git a/4.7.4/1000_linux-4.7.1.patch b/4.7.4/1000_linux-4.7.1.patch
deleted file mode 100644
index 79c652a..0000000
--- a/4.7.4/1000_linux-4.7.1.patch
+++ /dev/null
@@ -1,1141 +0,0 @@
-diff --git a/Documentation/cpu-freq/pcc-cpufreq.txt b/Documentation/cpu-freq/pcc-cpufreq.txt
-index 0a94224..9e3c3b3 100644
---- a/Documentation/cpu-freq/pcc-cpufreq.txt
-+++ b/Documentation/cpu-freq/pcc-cpufreq.txt
-@@ -159,8 +159,8 @@ to be strictly associated with a P-state.
-
- 2.2 cpuinfo_transition_latency:
- -------------------------------
--The cpuinfo_transition_latency field is CPUFREQ_ETERNAL. The PCC specification
--does not include a field to expose this value currently.
-+The cpuinfo_transition_latency field is 0. The PCC specification does
-+not include a field to expose this value currently.
-
- 2.3 cpuinfo_cur_freq:
- ---------------------
-diff --git a/Makefile b/Makefile
-index 66da9a3..84335c0 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 0
-+SUBLEVEL = 1
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
-index 087acb5..5f221ac 100644
---- a/arch/arm/kernel/sys_oabi-compat.c
-+++ b/arch/arm/kernel/sys_oabi-compat.c
-@@ -279,8 +279,12 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
- mm_segment_t fs;
- long ret, err, i;
-
-- if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
-+ if (maxevents <= 0 ||
-+ maxevents > (INT_MAX/sizeof(*kbuf)) ||
-+ maxevents > (INT_MAX/sizeof(*events)))
- return -EINVAL;
-+ if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
-+ return -EFAULT;
- kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
- if (!kbuf)
- return -ENOMEM;
-@@ -317,6 +321,8 @@ asmlinkage long sys_oabi_semtimedop(int semid,
-
- if (nsops < 1 || nsops > SEMOPM)
- return -EINVAL;
-+ if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
-+ return -EFAULT;
- sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
- if (!sops)
- return -ENOMEM;
-diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
-index 9c0b387..51d3988 100644
---- a/arch/mips/kernel/scall64-n32.S
-+++ b/arch/mips/kernel/scall64-n32.S
-@@ -348,7 +348,7 @@ EXPORT(sysn32_call_table)
- PTR sys_ni_syscall /* available, was setaltroot */
- PTR sys_add_key
- PTR sys_request_key
-- PTR sys_keyctl /* 6245 */
-+ PTR compat_sys_keyctl /* 6245 */
- PTR sys_set_thread_area
- PTR sys_inotify_init
- PTR sys_inotify_add_watch
-diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index f4f28b1..6efa713 100644
---- a/arch/mips/kernel/scall64-o32.S
-+++ b/arch/mips/kernel/scall64-o32.S
-@@ -504,7 +504,7 @@ EXPORT(sys32_call_table)
- PTR sys_ni_syscall /* available, was setaltroot */
- PTR sys_add_key /* 4280 */
- PTR sys_request_key
-- PTR sys_keyctl
-+ PTR compat_sys_keyctl
- PTR sys_set_thread_area
- PTR sys_inotify_init
- PTR sys_inotify_add_watch /* 4285 */
-diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
-index 4cddd17..f848572 100644
---- a/arch/x86/entry/syscalls/syscall_32.tbl
-+++ b/arch/x86/entry/syscalls/syscall_32.tbl
-@@ -294,7 +294,7 @@
- # 285 sys_setaltroot
- 286 i386 add_key sys_add_key
- 287 i386 request_key sys_request_key
--288 i386 keyctl sys_keyctl
-+288 i386 keyctl sys_keyctl compat_sys_keyctl
- 289 i386 ioprio_set sys_ioprio_set
- 290 i386 ioprio_get sys_ioprio_get
- 291 i386 inotify_init sys_inotify_init
-diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
-index 9d3a96c..01c2d14 100644
---- a/arch/x86/include/asm/microcode.h
-+++ b/arch/x86/include/asm/microcode.h
-@@ -133,13 +133,11 @@ static inline unsigned int x86_cpuid_family(void)
- #ifdef CONFIG_MICROCODE
- extern void __init load_ucode_bsp(void);
- extern void load_ucode_ap(void);
--extern int __init save_microcode_in_initrd(void);
- void reload_early_microcode(void);
- extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
- #else
- static inline void __init load_ucode_bsp(void) { }
- static inline void load_ucode_ap(void) { }
--static inline int __init save_microcode_in_initrd(void) { return 0; }
- static inline void reload_early_microcode(void) { }
- static inline bool
- get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; }
-diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
-index ac360bf..12823b6 100644
---- a/arch/x86/kernel/cpu/microcode/core.c
-+++ b/arch/x86/kernel/cpu/microcode/core.c
-@@ -175,7 +175,7 @@ void load_ucode_ap(void)
- }
- }
-
--int __init save_microcode_in_initrd(void)
-+static int __init save_microcode_in_initrd(void)
- {
- struct cpuinfo_x86 *c = &boot_cpu_data;
-
-@@ -691,4 +691,5 @@ int __init microcode_init(void)
- return error;
-
- }
-+fs_initcall(save_microcode_in_initrd);
- late_initcall(microcode_init);
-diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 372aad2..dffd162 100644
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -696,13 +696,6 @@ void free_initmem(void)
- void __init free_initrd_mem(unsigned long start, unsigned long end)
- {
- /*
-- * Remember, initrd memory may contain microcode or other useful things.
-- * Before we lose initrd mem, we need to find a place to hold them
-- * now that normal virtual memory is enabled.
-- */
-- save_microcode_in_initrd();
--
-- /*
- * end could be not aligned, and We can not align that,
- * decompresser could be confused by aligned initrd_end
- * We already reserve the end partial page before in
-diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
-index 3177c2b..8eee0e9 100644
---- a/arch/x86/power/hibernate_asm_64.S
-+++ b/arch/x86/power/hibernate_asm_64.S
-@@ -24,7 +24,6 @@
- #include <asm/frame.h>
-
- ENTRY(swsusp_arch_suspend)
-- FRAME_BEGIN
- movq $saved_context, %rax
- movq %rsp, pt_regs_sp(%rax)
- movq %rbp, pt_regs_bp(%rax)
-@@ -48,6 +47,7 @@ ENTRY(swsusp_arch_suspend)
- movq %cr3, %rax
- movq %rax, restore_cr3(%rip)
-
-+ FRAME_BEGIN
- call swsusp_save
- FRAME_END
- ret
-@@ -104,7 +104,6 @@ ENTRY(core_restore_code)
- /* code below belongs to the image kernel */
- .align PAGE_SIZE
- ENTRY(restore_registers)
-- FRAME_BEGIN
- /* go back to the original page tables */
- movq %r9, %cr3
-
-@@ -145,6 +144,5 @@ ENTRY(restore_registers)
- /* tell the hibernation core that we've just restored the memory */
- movq %rax, in_suspend(%rip)
-
-- FRAME_END
- ret
- ENDPROC(restore_registers)
-diff --git a/block/genhd.c b/block/genhd.c
-index 9f42526..3eebd25 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -856,6 +856,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v)
- if (iter) {
- class_dev_iter_exit(iter);
- kfree(iter);
-+ seqf->private = NULL;
- }
- }
-
-diff --git a/crypto/gcm.c b/crypto/gcm.c
-index bec329b..d9ea5f9 100644
---- a/crypto/gcm.c
-+++ b/crypto/gcm.c
-@@ -639,7 +639,9 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl,
-
- ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type,
- CRYPTO_ALG_TYPE_HASH,
-- CRYPTO_ALG_TYPE_AHASH_MASK);
-+ CRYPTO_ALG_TYPE_AHASH_MASK |
-+ crypto_requires_sync(algt->type,
-+ algt->mask));
- if (IS_ERR(ghash_alg))
- return PTR_ERR(ghash_alg);
-
-diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
-index ea5815c..bc769c4 100644
---- a/crypto/scatterwalk.c
-+++ b/crypto/scatterwalk.c
-@@ -72,7 +72,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
-
- void scatterwalk_done(struct scatter_walk *walk, int out, int more)
- {
-- if (!(scatterwalk_pagelen(walk) & (PAGE_SIZE - 1)) || !more)
-+ if (!more || walk->offset >= walk->sg->offset + walk->sg->length ||
-+ !(walk->offset & (PAGE_SIZE - 1)))
- scatterwalk_pagedone(walk, out, more);
- }
- EXPORT_SYMBOL_GPL(scatterwalk_done);
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 0158d3b..87ab9f6 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -723,15 +723,18 @@ retry:
- }
- }
-
--static void credit_entropy_bits_safe(struct entropy_store *r, int nbits)
-+static int credit_entropy_bits_safe(struct entropy_store *r, int nbits)
- {
- const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1));
-
-+ if (nbits < 0)
-+ return -EINVAL;
-+
- /* Cap the value to avoid overflows */
- nbits = min(nbits, nbits_max);
-- nbits = max(nbits, -nbits_max);
-
- credit_entropy_bits(r, nbits);
-+ return 0;
- }
-
- /*********************************************************************
-@@ -1543,8 +1546,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
- return -EPERM;
- if (get_user(ent_count, p))
- return -EFAULT;
-- credit_entropy_bits_safe(&input_pool, ent_count);
-- return 0;
-+ return credit_entropy_bits_safe(&input_pool, ent_count);
- case RNDADDENTROPY:
- if (!capable(CAP_SYS_ADMIN))
- return -EPERM;
-@@ -1558,8 +1560,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
- size);
- if (retval < 0)
- return retval;
-- credit_entropy_bits_safe(&input_pool, ent_count);
-- return 0;
-+ return credit_entropy_bits_safe(&input_pool, ent_count);
- case RNDZAPENTCNT:
- case RNDCLEARPOOL:
- /*
-diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
-index a7ecb9a..3f0ce2a 100644
---- a/drivers/cpufreq/pcc-cpufreq.c
-+++ b/drivers/cpufreq/pcc-cpufreq.c
-@@ -555,8 +555,6 @@ static int pcc_cpufreq_cpu_init(struct cpufreq_policy *policy)
- policy->min = policy->cpuinfo.min_freq =
- ioread32(&pcch_hdr->minimum_frequency) * 1000;
-
-- policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
--
- pr_debug("init: policy->max is %d, policy->min is %d\n",
- policy->max, policy->min);
- out:
-diff --git a/drivers/infiniband/hw/hfi1/Kconfig b/drivers/infiniband/hw/hfi1/Kconfig
-index a925fb0..f846fd5 100644
---- a/drivers/infiniband/hw/hfi1/Kconfig
-+++ b/drivers/infiniband/hw/hfi1/Kconfig
-@@ -3,7 +3,6 @@ config INFINIBAND_HFI1
- depends on X86_64 && INFINIBAND_RDMAVT
- select MMU_NOTIFIER
- select CRC32
-- default m
- ---help---
- This is a low-level driver for Intel OPA Gen1 adapter.
- config HFI1_DEBUG_SDMA_ORDER
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index a2afa3b..4d79819 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -1422,7 +1422,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
- return -EINVAL;
- }
-
-- if (slave_ops->ndo_set_mac_address == NULL) {
-+ if (slave_dev->type == ARPHRD_INFINIBAND &&
-+ BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
-+ netdev_warn(bond_dev, "Type (%d) supports only active-backup mode\n",
-+ slave_dev->type);
-+ res = -EOPNOTSUPP;
-+ goto err_undo_flags;
-+ }
-+
-+ if (!slave_ops->ndo_set_mac_address ||
-+ slave_dev->type == ARPHRD_INFINIBAND) {
- netdev_warn(bond_dev, "The slave device specified does not support setting the MAC address\n");
- if (BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP &&
- bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
-diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
-index b122f60..03601df 100644
---- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
-+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
-@@ -809,13 +809,12 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
- * in a bitmap and increasing the chain consumer only
- * for the first successive completed entries.
- */
-- bitmap_set(p_spq->p_comp_bitmap, pos, SPQ_RING_SIZE);
-+ __set_bit(pos, p_spq->p_comp_bitmap);
-
- while (test_bit(p_spq->comp_bitmap_idx,
- p_spq->p_comp_bitmap)) {
-- bitmap_clear(p_spq->p_comp_bitmap,
-- p_spq->comp_bitmap_idx,
-- SPQ_RING_SIZE);
-+ __clear_bit(p_spq->comp_bitmap_idx,
-+ p_spq->p_comp_bitmap);
- p_spq->comp_bitmap_idx++;
- qed_chain_return_produced(&p_spq->chain);
- }
-diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
-index 8bcd78f..a70b6c4 100644
---- a/drivers/net/macsec.c
-+++ b/drivers/net/macsec.c
-@@ -942,7 +942,6 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
- }
-
- macsec_skb_cb(skb)->req = req;
-- macsec_skb_cb(skb)->rx_sa = rx_sa;
- skb->dev = dev;
- aead_request_set_callback(req, 0, macsec_decrypt_done, skb);
-
-@@ -1169,6 +1168,8 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
- }
- }
-
-+ macsec_skb_cb(skb)->rx_sa = rx_sa;
-+
- /* Disabled && !changed text => skip validation */
- if (hdr->tci_an & MACSEC_TCI_C ||
- secy->validate_frames != MACSEC_VALIDATE_DISABLED)
-diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
-index ce362bd..45b57c2 100644
---- a/drivers/tty/serial/mvebu-uart.c
-+++ b/drivers/tty/serial/mvebu-uart.c
-@@ -300,6 +300,8 @@ static int mvebu_uart_startup(struct uart_port *port)
- static void mvebu_uart_shutdown(struct uart_port *port)
- {
- writel(0, port->membase + UART_CTRL);
-+
-+ free_irq(port->irq, port);
- }
-
- static void mvebu_uart_set_termios(struct uart_port *port,
-diff --git a/fs/dcache.c b/fs/dcache.c
-index d6847d7..1ed81bb 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -622,7 +622,6 @@ static struct dentry *dentry_kill(struct dentry *dentry)
-
- failed:
- spin_unlock(&dentry->d_lock);
-- cpu_relax();
- return dentry; /* try again with same dentry */
- }
-
-@@ -796,6 +795,8 @@ void dput(struct dentry *dentry)
- return;
-
- repeat:
-+ might_sleep();
-+
- rcu_read_lock();
- if (likely(fast_dput(dentry))) {
- rcu_read_unlock();
-@@ -829,8 +830,10 @@ repeat:
-
- kill_it:
- dentry = dentry_kill(dentry);
-- if (dentry)
-+ if (dentry) {
-+ cond_resched();
- goto repeat;
-+ }
- }
- EXPORT_SYMBOL(dput);
-
-diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
-index 3020fd7..1ea5054 100644
---- a/fs/ext4/balloc.c
-+++ b/fs/ext4/balloc.c
-@@ -208,6 +208,9 @@ static int ext4_init_block_bitmap(struct super_block *sb,
- memset(bh->b_data, 0, sb->s_blocksize);
-
- bit_max = ext4_num_base_meta_clusters(sb, block_group);
-+ if ((bit_max >> 3) >= bh->b_size)
-+ return -EFSCORRUPTED;
-+
- for (bit = 0; bit < bit_max; bit++)
- ext4_set_bit(bit, bh->b_data);
-
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index 2a2eef9..d7ccb7f 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -381,9 +381,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
- ext4_fsblk_t block = ext4_ext_pblock(ext);
- int len = ext4_ext_get_actual_len(ext);
- ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
-- ext4_lblk_t last = lblock + len - 1;
-
-- if (len == 0 || lblock > last)
-+ /*
-+ * We allow neither:
-+ * - zero length
-+ * - overflow/wrap-around
-+ */
-+ if (lblock + len <= lblock)
- return 0;
- return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
- }
-@@ -474,6 +478,10 @@ static int __ext4_ext_check(const char *function, unsigned int line,
- error_msg = "invalid extent entries";
- goto corrupted;
- }
-+ if (unlikely(depth > 32)) {
-+ error_msg = "too large eh_depth";
-+ goto corrupted;
-+ }
- /* Verify checksum on non-root extent tree nodes */
- if (ext_depth(inode) != depth &&
- !ext4_extent_block_csum_verify(inode, eh)) {
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index f7140ca..b747ec0 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -205,9 +205,9 @@ void ext4_evict_inode(struct inode *inode)
- * Note that directories do not have this problem because they
- * don't use page cache.
- */
-- if (ext4_should_journal_data(inode) &&
-- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
-- inode->i_ino != EXT4_JOURNAL_INO) {
-+ if (inode->i_ino != EXT4_JOURNAL_INO &&
-+ ext4_should_journal_data(inode) &&
-+ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
- journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
- tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
-
-@@ -2748,13 +2748,36 @@ retry:
- done = true;
- }
- }
-- ext4_journal_stop(handle);
-+ /*
-+ * Caution: If the handle is synchronous,
-+ * ext4_journal_stop() can wait for transaction commit
-+ * to finish which may depend on writeback of pages to
-+ * complete or on page lock to be released. In that
-+ * case, we have to wait until after after we have
-+ * submitted all the IO, released page locks we hold,
-+ * and dropped io_end reference (for extent conversion
-+ * to be able to complete) before stopping the handle.
-+ */
-+ if (!ext4_handle_valid(handle) || handle->h_sync == 0) {
-+ ext4_journal_stop(handle);
-+ handle = NULL;
-+ }
- /* Submit prepared bio */
- ext4_io_submit(&mpd.io_submit);
- /* Unlock pages we didn't use */
- mpage_release_unused_pages(&mpd, give_up_on_write);
-- /* Drop our io_end reference we got from init */
-- ext4_put_io_end(mpd.io_submit.io_end);
-+ /*
-+ * Drop our io_end reference we got from init. We have
-+ * to be careful and use deferred io_end finishing if
-+ * we are still holding the transaction as we can
-+ * release the last reference to io_end which may end
-+ * up doing unwritten extent conversion.
-+ */
-+ if (handle) {
-+ ext4_put_io_end_defer(mpd.io_submit.io_end);
-+ ext4_journal_stop(handle);
-+ } else
-+ ext4_put_io_end(mpd.io_submit.io_end);
-
- if (ret == -ENOSPC && sbi->s_journal) {
- /*
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index c1ab3ec..7f42eda 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -2939,7 +2939,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
- "fs metadata", block, block+len);
- /* File system mounted not to panic on error
-- * Fix the bitmap and repeat the block allocation
-+ * Fix the bitmap and return EFSCORRUPTED
- * We leak some of the blocks here.
- */
- ext4_lock_group(sb, ac->ac_b_ex.fe_group);
-@@ -2948,7 +2948,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
- err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
- if (!err)
-- err = -EAGAIN;
-+ err = -EFSCORRUPTED;
- goto out_err;
- }
-
-@@ -4513,18 +4513,7 @@ repeat:
- }
- if (likely(ac->ac_status == AC_STATUS_FOUND)) {
- *errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs);
-- if (*errp == -EAGAIN) {
-- /*
-- * drop the reference that we took
-- * in ext4_mb_use_best_found
-- */
-- ext4_mb_release_context(ac);
-- ac->ac_b_ex.fe_group = 0;
-- ac->ac_b_ex.fe_start = 0;
-- ac->ac_b_ex.fe_len = 0;
-- ac->ac_status = AC_STATUS_CONTINUE;
-- goto repeat;
-- } else if (*errp) {
-+ if (*errp) {
- ext4_discard_allocated_blocks(ac);
- goto errout;
- } else {
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 3822a5a..639bd756 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2278,6 +2278,16 @@ static void ext4_orphan_cleanup(struct super_block *sb,
- while (es->s_last_orphan) {
- struct inode *inode;
-
-+ /*
-+ * We may have encountered an error during cleanup; if
-+ * so, skip the rest.
-+ */
-+ if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) {
-+ jbd_debug(1, "Skipping orphan recovery on fs with errors.\n");
-+ es->s_last_orphan = 0;
-+ break;
-+ }
-+
- inode = ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan));
- if (IS_ERR(inode)) {
- es->s_last_orphan = 0;
-@@ -3416,6 +3426,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- goto failed_mount;
- }
-
-+ if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
-+ ext4_msg(sb, KERN_ERR,
-+ "Number of reserved GDT blocks insanely large: %d",
-+ le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks));
-+ goto failed_mount;
-+ }
-+
- if (sbi->s_mount_opt & EXT4_MOUNT_DAX) {
- err = bdev_dax_supported(sb, blocksize);
- if (err)
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 9154f86..6cac3dc 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -417,6 +417,15 @@ static int fuse_flush(struct file *file, fl_owner_t id)
- fuse_sync_writes(inode);
- inode_unlock(inode);
-
-+ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
-+ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
-+ err = -ENOSPC;
-+ if (test_bit(AS_EIO, &file->f_mapping->flags) &&
-+ test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
-+ err = -EIO;
-+ if (err)
-+ return err;
-+
- req = fuse_get_req_nofail_nopages(fc, file);
- memset(&inarg, 0, sizeof(inarg));
- inarg.fh = ff->fh;
-@@ -462,6 +471,21 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
- goto out;
-
- fuse_sync_writes(inode);
-+
-+ /*
-+ * Due to implementation of fuse writeback
-+ * filemap_write_and_wait_range() does not catch errors.
-+ * We have to do this directly after fuse_sync_writes()
-+ */
-+ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
-+ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
-+ err = -ENOSPC;
-+ if (test_bit(AS_EIO, &file->f_mapping->flags) &&
-+ test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
-+ err = -EIO;
-+ if (err)
-+ goto out;
-+
- err = sync_inode_metadata(inode, 1);
- if (err)
- goto out;
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 9961d843..9b7cb37 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -942,7 +942,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
- arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
- FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
- FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
-- FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
-+ FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
- FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
- FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT |
- FUSE_PARALLEL_DIROPS;
-diff --git a/fs/inode.c b/fs/inode.c
-index 4ccbc21..9ea4219 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -345,7 +345,7 @@ EXPORT_SYMBOL(inc_nlink);
- void address_space_init_once(struct address_space *mapping)
- {
- memset(mapping, 0, sizeof(*mapping));
-- INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
-+ INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC | __GFP_ACCOUNT);
- spin_lock_init(&mapping->tree_lock);
- init_rwsem(&mapping->i_mmap_rwsem);
- INIT_LIST_HEAD(&mapping->private_list);
-@@ -1740,8 +1740,8 @@ static int __remove_privs(struct dentry *dentry, int kill)
- */
- int file_remove_privs(struct file *file)
- {
-- struct dentry *dentry = file->f_path.dentry;
-- struct inode *inode = d_inode(dentry);
-+ struct dentry *dentry = file_dentry(file);
-+ struct inode *inode = file_inode(file);
- int kill;
- int error = 0;
-
-@@ -1749,7 +1749,7 @@ int file_remove_privs(struct file *file)
- if (IS_NOSEC(inode))
- return 0;
-
-- kill = file_needs_remove_privs(file);
-+ kill = dentry_needs_remove_privs(dentry);
- if (kill < 0)
- return kill;
- if (kill)
-diff --git a/fs/ioctl.c b/fs/ioctl.c
-index 116a333..0f56deb 100644
---- a/fs/ioctl.c
-+++ b/fs/ioctl.c
-@@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
- goto out;
- }
-
-+ same->dest_count = count;
- ret = vfs_dedupe_file_range(file, same);
- if (ret)
- goto out;
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 1471db9..c6521c2 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -680,7 +680,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
- rcu_read_lock();
- ipc_lock_object(&msq->q_perm);
-
-- ipc_rcu_putref(msq, ipc_rcu_free);
-+ ipc_rcu_putref(msq, msg_rcu_free);
- /* raced with RMID? */
- if (!ipc_valid_object(&msq->q_perm)) {
- err = -EIDRM;
-diff --git a/ipc/sem.c b/ipc/sem.c
-index b3757ea..5d2f875 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -449,7 +449,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns
- static inline void sem_lock_and_putref(struct sem_array *sma)
- {
- sem_lock(sma, NULL, -1);
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- }
-
- static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
-@@ -1392,7 +1392,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- rcu_read_unlock();
- sem_io = ipc_alloc(sizeof(ushort)*nsems);
- if (sem_io == NULL) {
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- return -ENOMEM;
- }
-
-@@ -1426,20 +1426,20 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- if (nsems > SEMMSL_FAST) {
- sem_io = ipc_alloc(sizeof(ushort)*nsems);
- if (sem_io == NULL) {
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- return -ENOMEM;
- }
- }
-
- if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- err = -EFAULT;
- goto out_free;
- }
-
- for (i = 0; i < nsems; i++) {
- if (sem_io[i] > SEMVMX) {
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- err = -ERANGE;
- goto out_free;
- }
-@@ -1731,7 +1731,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
- /* step 2: allocate new undo structure */
- new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
- if (!new) {
-- ipc_rcu_putref(sma, ipc_rcu_free);
-+ ipc_rcu_putref(sma, sem_rcu_free);
- return ERR_PTR(-ENOMEM);
- }
-
-diff --git a/lib/radix-tree.c b/lib/radix-tree.c
-index 8b7d845..bc7852f 100644
---- a/lib/radix-tree.c
-+++ b/lib/radix-tree.c
-@@ -274,10 +274,11 @@ radix_tree_node_alloc(struct radix_tree_root *root)
-
- /*
- * Even if the caller has preloaded, try to allocate from the
-- * cache first for the new node to get accounted.
-+ * cache first for the new node to get accounted to the memory
-+ * cgroup.
- */
- ret = kmem_cache_alloc(radix_tree_node_cachep,
-- gfp_mask | __GFP_ACCOUNT | __GFP_NOWARN);
-+ gfp_mask | __GFP_NOWARN);
- if (ret)
- goto out;
-
-@@ -300,8 +301,7 @@ radix_tree_node_alloc(struct radix_tree_root *root)
- kmemleak_update_trace(ret);
- goto out;
- }
-- ret = kmem_cache_alloc(radix_tree_node_cachep,
-- gfp_mask | __GFP_ACCOUNT);
-+ ret = kmem_cache_alloc(radix_tree_node_cachep, gfp_mask);
- out:
- BUG_ON(radix_tree_is_internal_node(ret));
- return ret;
-@@ -348,6 +348,12 @@ static int __radix_tree_preload(gfp_t gfp_mask)
- struct radix_tree_node *node;
- int ret = -ENOMEM;
-
-+ /*
-+ * Nodes preloaded by one cgroup can be be used by another cgroup, so
-+ * they should never be accounted to any particular memory cgroup.
-+ */
-+ gfp_mask &= ~__GFP_ACCOUNT;
-+
- preempt_disable();
- rtp = this_cpu_ptr(&radix_tree_preloads);
- while (rtp->nr < RADIX_TREE_PRELOAD_SIZE) {
-diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 5339c89..ca847d9 100644
---- a/mm/memcontrol.c
-+++ b/mm/memcontrol.c
-@@ -4083,14 +4083,32 @@ static struct cftype mem_cgroup_legacy_files[] = {
-
- static DEFINE_IDR(mem_cgroup_idr);
-
--static void mem_cgroup_id_get(struct mem_cgroup *memcg)
-+static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
- {
-- atomic_inc(&memcg->id.ref);
-+ atomic_add(n, &memcg->id.ref);
- }
-
--static void mem_cgroup_id_put(struct mem_cgroup *memcg)
-+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
- {
-- if (atomic_dec_and_test(&memcg->id.ref)) {
-+ while (!atomic_inc_not_zero(&memcg->id.ref)) {
-+ /*
-+ * The root cgroup cannot be destroyed, so it's refcount must
-+ * always be >= 1.
-+ */
-+ if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
-+ VM_BUG_ON(1);
-+ break;
-+ }
-+ memcg = parent_mem_cgroup(memcg);
-+ if (!memcg)
-+ memcg = root_mem_cgroup;
-+ }
-+ return memcg;
-+}
-+
-+static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
-+{
-+ if (atomic_sub_and_test(n, &memcg->id.ref)) {
- idr_remove(&mem_cgroup_idr, memcg->id.id);
- memcg->id.id = 0;
-
-@@ -4099,6 +4117,16 @@ static void mem_cgroup_id_put(struct mem_cgroup *memcg)
- }
- }
-
-+static inline void mem_cgroup_id_get(struct mem_cgroup *memcg)
-+{
-+ mem_cgroup_id_get_many(memcg, 1);
-+}
-+
-+static inline void mem_cgroup_id_put(struct mem_cgroup *memcg)
-+{
-+ mem_cgroup_id_put_many(memcg, 1);
-+}
-+
- /**
- * mem_cgroup_from_id - look up a memcg from a memcg id
- * @id: the memcg id to look up
-@@ -4736,6 +4764,8 @@ static void __mem_cgroup_clear_mc(void)
- if (!mem_cgroup_is_root(mc.from))
- page_counter_uncharge(&mc.from->memsw, mc.moved_swap);
-
-+ mem_cgroup_id_put_many(mc.from, mc.moved_swap);
-+
- /*
- * we charged both to->memory and to->memsw, so we
- * should uncharge to->memory.
-@@ -4743,9 +4773,9 @@ static void __mem_cgroup_clear_mc(void)
- if (!mem_cgroup_is_root(mc.to))
- page_counter_uncharge(&mc.to->memory, mc.moved_swap);
-
-- css_put_many(&mc.from->css, mc.moved_swap);
-+ mem_cgroup_id_get_many(mc.to, mc.moved_swap);
-+ css_put_many(&mc.to->css, mc.moved_swap);
-
-- /* we've already done css_get(mc.to) */
- mc.moved_swap = 0;
- }
- memcg_oom_recover(from);
-@@ -5805,7 +5835,7 @@ subsys_initcall(mem_cgroup_init);
- */
- void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
- {
-- struct mem_cgroup *memcg;
-+ struct mem_cgroup *memcg, *swap_memcg;
- unsigned short oldid;
-
- VM_BUG_ON_PAGE(PageLRU(page), page);
-@@ -5820,16 +5850,27 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
- if (!memcg)
- return;
-
-- mem_cgroup_id_get(memcg);
-- oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
-+ /*
-+ * In case the memcg owning these pages has been offlined and doesn't
-+ * have an ID allocated to it anymore, charge the closest online
-+ * ancestor for the swap instead and transfer the memory+swap charge.
-+ */
-+ swap_memcg = mem_cgroup_id_get_online(memcg);
-+ oldid = swap_cgroup_record(entry, mem_cgroup_id(swap_memcg));
- VM_BUG_ON_PAGE(oldid, page);
-- mem_cgroup_swap_statistics(memcg, true);
-+ mem_cgroup_swap_statistics(swap_memcg, true);
-
- page->mem_cgroup = NULL;
-
- if (!mem_cgroup_is_root(memcg))
- page_counter_uncharge(&memcg->memory, 1);
-
-+ if (memcg != swap_memcg) {
-+ if (!mem_cgroup_is_root(swap_memcg))
-+ page_counter_charge(&swap_memcg->memsw, 1);
-+ page_counter_uncharge(&memcg->memsw, 1);
-+ }
-+
- /*
- * Interrupts should be disabled here because the caller holds the
- * mapping->tree_lock lock which is taken with interrupts-off. It is
-@@ -5868,11 +5909,14 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry)
- if (!memcg)
- return 0;
-
-+ memcg = mem_cgroup_id_get_online(memcg);
-+
- if (!mem_cgroup_is_root(memcg) &&
-- !page_counter_try_charge(&memcg->swap, 1, &counter))
-+ !page_counter_try_charge(&memcg->swap, 1, &counter)) {
-+ mem_cgroup_id_put(memcg);
- return -ENOMEM;
-+ }
-
-- mem_cgroup_id_get(memcg);
- oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
- VM_BUG_ON_PAGE(oldid, page);
- mem_cgroup_swap_statistics(memcg, true);
-diff --git a/mm/mempool.c b/mm/mempool.c
-index 8f65464..47a659d 100644
---- a/mm/mempool.c
-+++ b/mm/mempool.c
-@@ -306,7 +306,7 @@ EXPORT_SYMBOL(mempool_resize);
- * returns NULL. Note that due to preallocation, this function
- * *never* fails when called from process contexts. (it might
- * fail if called from an IRQ context.)
-- * Note: neither __GFP_NOMEMALLOC nor __GFP_ZERO are supported.
-+ * Note: using __GFP_ZERO is not supported.
- */
- void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
- {
-@@ -315,27 +315,16 @@ void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
- wait_queue_t wait;
- gfp_t gfp_temp;
-
-- /* If oom killed, memory reserves are essential to prevent livelock */
-- VM_WARN_ON_ONCE(gfp_mask & __GFP_NOMEMALLOC);
-- /* No element size to zero on allocation */
- VM_WARN_ON_ONCE(gfp_mask & __GFP_ZERO);
--
- might_sleep_if(gfp_mask & __GFP_DIRECT_RECLAIM);
-
-+ gfp_mask |= __GFP_NOMEMALLOC; /* don't allocate emergency reserves */
- gfp_mask |= __GFP_NORETRY; /* don't loop in __alloc_pages */
- gfp_mask |= __GFP_NOWARN; /* failures are OK */
-
- gfp_temp = gfp_mask & ~(__GFP_DIRECT_RECLAIM|__GFP_IO);
-
- repeat_alloc:
-- if (likely(pool->curr_nr)) {
-- /*
-- * Don't allocate from emergency reserves if there are
-- * elements available. This check is racy, but it will
-- * be rechecked each loop.
-- */
-- gfp_temp |= __GFP_NOMEMALLOC;
-- }
-
- element = pool->alloc(gfp_temp, pool->pool_data);
- if (likely(element != NULL))
-@@ -359,12 +348,11 @@ repeat_alloc:
- * We use gfp mask w/o direct reclaim or IO for the first round. If
- * alloc failed with that and @pool was empty, retry immediately.
- */
-- if ((gfp_temp & ~__GFP_NOMEMALLOC) != gfp_mask) {
-+ if (gfp_temp != gfp_mask) {
- spin_unlock_irqrestore(&pool->lock, flags);
- gfp_temp = gfp_mask;
- goto repeat_alloc;
- }
-- gfp_temp = gfp_mask;
-
- /* We must not sleep if !__GFP_DIRECT_RECLAIM */
- if (!(gfp_mask & __GFP_DIRECT_RECLAIM)) {
-diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index 43d2cd8..28d5ec2 100644
---- a/net/bridge/br_input.c
-+++ b/net/bridge/br_input.c
-@@ -288,6 +288,14 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
- case 0x01: /* IEEE MAC (Pause) */
- goto drop;
-
-+ case 0x0E: /* 802.1AB LLDP */
-+ fwd_mask |= p->br->group_fwd_mask;
-+ if (fwd_mask & (1u << dest[5]))
-+ goto forward;
-+ *pskb = skb;
-+ __br_handle_local_finish(skb);
-+ return RX_HANDLER_PASS;
-+
- default:
- /* Allow selective forwarding for most other protocols */
- fwd_mask |= p->br->group_fwd_mask;
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index e00e972..700b72c 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -236,7 +236,8 @@ void tcp_select_initial_window(int __space, __u32 mss,
- /* Set window scaling on max possible window
- * See RFC1323 for an explanation of the limit to 14
- */
-- space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
-+ space = max_t(u32, space, sysctl_tcp_rmem[2]);
-+ space = max_t(u32, space, sysctl_rmem_max);
- space = min_t(u32, space, *window_clamp);
- while (space > 65535 && (*rcv_wscale) < 14) {
- space >>= 1;
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 4aed8fc..e61f7cd 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- udp_lib_checksum_complete(skb))
- goto csum_error;
-
-- if (sk_filter(sk, skb))
-- goto drop;
-- if (unlikely(skb->len < sizeof(struct udphdr)))
-+ if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
- goto drop;
-
- udp_csum_pull_header(skb);
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 47f837a..047c75a 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -3562,6 +3562,10 @@ restart:
- if (state != INET6_IFADDR_STATE_DEAD) {
- __ipv6_ifa_notify(RTM_DELADDR, ifa);
- inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
-+ } else {
-+ if (idev->cnf.forwarding)
-+ addrconf_leave_anycast(ifa);
-+ addrconf_leave_solict(ifa->idev, &ifa->addr);
- }
-
- write_lock_bh(&idev->lock);
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index acc09705..42a2edf 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- udp_lib_checksum_complete(skb))
- goto csum_error;
-
-- if (sk_filter(sk, skb))
-- goto drop;
-- if (unlikely(skb->len < sizeof(struct udphdr)))
-+ if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
- goto drop;
-
- udp_csum_pull_header(skb);
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index 923abd6..8d2f7c9 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -1024,8 +1024,11 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
- }
-
- /* Check if we have opened a local TSAP */
-- if (!self->tsap)
-- irda_open_tsap(self, LSAP_ANY, addr->sir_name);
-+ if (!self->tsap) {
-+ err = irda_open_tsap(self, LSAP_ANY, addr->sir_name);
-+ if (err)
-+ goto out;
-+ }
-
- /* Move to connecting socket, start sending Connect Requests */
- sock->state = SS_CONNECTING;
-diff --git a/net/sctp/input.c b/net/sctp/input.c
-index 47cf460..f093322 100644
---- a/net/sctp/input.c
-+++ b/net/sctp/input.c
-@@ -328,6 +328,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- */
-
- sk = rcvr->sk;
-+ local_bh_disable();
- bh_lock_sock(sk);
-
- if (sock_owned_by_user(sk)) {
-@@ -339,6 +340,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- sctp_inq_push(inqueue, chunk);
-
- bh_unlock_sock(sk);
-+ local_bh_enable();
-
- /* If the chunk was backloged again, don't drop refs */
- if (backloged)
-diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
-index 9d87bba..b335ffc 100644
---- a/net/sctp/inqueue.c
-+++ b/net/sctp/inqueue.c
-@@ -89,12 +89,10 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
- * Eventually, we should clean up inqueue to not rely
- * on the BH related data structures.
- */
-- local_bh_disable();
- list_add_tail(&chunk->list, &q->in_chunk_list);
- if (chunk->asoc)
- chunk->asoc->stats.ipackets++;
- q->immediate.func(&q->immediate);
-- local_bh_enable();
- }
-
- /* Peek at the next chunk on the inqeue. */
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 67154b8..7f5689a 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4301,6 +4301,7 @@ int sctp_transport_walk_start(struct rhashtable_iter *iter)
-
- err = rhashtable_walk_start(iter);
- if (err && err != -EAGAIN) {
-+ rhashtable_walk_stop(iter);
- rhashtable_walk_exit(iter);
- return err;
- }
-diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
-index ad4fa49..9068369 100644
---- a/security/apparmor/apparmorfs.c
-+++ b/security/apparmor/apparmorfs.c
-@@ -331,6 +331,7 @@ static int aa_fs_seq_hash_show(struct seq_file *seq, void *v)
- seq_printf(seq, "%.2x", profile->hash[i]);
- seq_puts(seq, "\n");
- }
-+ aa_put_profile(profile);
-
- return 0;
- }
diff --git a/4.7.4/1001_linux-4.7.2.patch b/4.7.4/1001_linux-4.7.2.patch
deleted file mode 100644
index d0ef798..0000000
--- a/4.7.4/1001_linux-4.7.2.patch
+++ /dev/null
@@ -1,7668 +0,0 @@
-diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt
-index 696d5ca..f0e3361 100644
---- a/Documentation/module-signing.txt
-+++ b/Documentation/module-signing.txt
-@@ -271,3 +271,9 @@ Since the private key is used to sign modules, viruses and malware could use
- the private key to sign modules and compromise the operating system. The
- private key must be either destroyed or moved to a secure location and not kept
- in the root node of the kernel source tree.
-+
-+If you use the same private key to sign modules for multiple kernel
-+configurations, you must ensure that the module version information is
-+sufficient to prevent loading a module into a different kernel. Either
-+set CONFIG_MODVERSIONS=y or ensure that each configuration has a different
-+kernel release string by changing EXTRAVERSION or CONFIG_LOCALVERSION.
-diff --git a/Makefile b/Makefile
-index 84335c0..bb98f1c 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 1
-+SUBLEVEL = 2
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
-index 858f98e..0f92d97 100644
---- a/arch/arc/include/asm/pgtable.h
-+++ b/arch/arc/include/asm/pgtable.h
-@@ -110,7 +110,7 @@
- #define ___DEF (_PAGE_PRESENT | _PAGE_CACHEABLE)
-
- /* Set of bits not changed in pte_modify */
--#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY)
-+#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_SPECIAL)
-
- /* More Abbrevaited helpers */
- #define PAGE_U_NONE __pgprot(___DEF)
-diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
-index 73d7e4c..ab74b5d 100644
---- a/arch/arc/mm/dma.c
-+++ b/arch/arc/mm/dma.c
-@@ -92,7 +92,8 @@ static void *arc_dma_alloc(struct device *dev, size_t size,
- static void arc_dma_free(struct device *dev, size_t size, void *vaddr,
- dma_addr_t dma_handle, struct dma_attrs *attrs)
- {
-- struct page *page = virt_to_page(dma_handle);
-+ phys_addr_t paddr = plat_dma_to_phys(dev, dma_handle);
-+ struct page *page = virt_to_page(paddr);
- int is_non_coh = 1;
-
- is_non_coh = dma_get_attr(DMA_ATTR_NON_CONSISTENT, attrs) ||
-diff --git a/arch/arm/boot/dts/arm-realview-pbx-a9.dts b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-index db808f9..90d00b4 100644
---- a/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-+++ b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-@@ -70,13 +70,12 @@
- * associativity as these may be erroneously set
- * up by boot loader(s).
- */
-- cache-size = <1048576>; // 1MB
-- cache-sets = <4096>;
-+ cache-size = <131072>; // 128KB
-+ cache-sets = <512>;
- cache-line-size = <32>;
- arm,parity-disable;
-- arm,tag-latency = <1>;
-- arm,data-latency = <1 1>;
-- arm,dirty-latency = <1>;
-+ arm,tag-latency = <1 1 1>;
-+ arm,data-latency = <1 1 1>;
- };
-
- scu: scu@1f000000 {
-diff --git a/arch/arm/boot/dts/sun4i-a10-a1000.dts b/arch/arm/boot/dts/sun4i-a10-a1000.dts
-index c92a1ae..fa70b8f 100644
---- a/arch/arm/boot/dts/sun4i-a10-a1000.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-a1000.dts
-@@ -84,6 +84,7 @@
- regulator-name = "emac-3v3";
- regulator-min-microvolt = <3300000>;
- regulator-max-microvolt = <3300000>;
-+ startup-delay-us = <20000>;
- enable-active-high;
- gpio = <&pio 7 15 GPIO_ACTIVE_HIGH>;
- };
-diff --git a/arch/arm/boot/dts/sun4i-a10-hackberry.dts b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-index 2b17c51..6de83a6 100644
---- a/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-@@ -66,6 +66,7 @@
- regulator-name = "emac-3v3";
- regulator-min-microvolt = <3300000>;
- regulator-max-microvolt = <3300000>;
-+ startup-delay-us = <20000>;
- enable-active-high;
- gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>;
- };
-diff --git a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-index 7afc7a6..e28f080 100644
---- a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-@@ -80,6 +80,7 @@
- regulator-name = "emac-3v3";
- regulator-min-microvolt = <3300000>;
- regulator-max-microvolt = <3300000>;
-+ startup-delay-us = <20000>;
- enable-active-high;
- gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>; /* PH19 */
- };
-diff --git a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-index 9fea918..39731a7 100644
---- a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-+++ b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-@@ -79,6 +79,7 @@
- regulator-name = "emac-3v3";
- regulator-min-microvolt = <3300000>;
- regulator-max-microvolt = <3300000>;
-+ startup-delay-us = <20000>;
- enable-active-high;
- gpio = <&pio 0 2 GPIO_ACTIVE_HIGH>;
- };
-diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-index 941f362..f4d8125 100644
---- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-@@ -1386,7 +1386,7 @@
- * Pin 41: BR_UART1_TXD
- * Pin 44: BR_UART1_RXD
- */
-- serial@70006000 {
-+ serial@0,70006000 {
- compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
- status = "okay";
- };
-@@ -1398,7 +1398,7 @@
- * Pin 71: UART2_CTS_L
- * Pin 74: UART2_RTS_L
- */
-- serial@70006040 {
-+ serial@0,70006040 {
- compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
- status = "okay";
- };
-diff --git a/arch/arm/configs/aspeed_g4_defconfig b/arch/arm/configs/aspeed_g4_defconfig
-index b6e54ee..ca39c04 100644
---- a/arch/arm/configs/aspeed_g4_defconfig
-+++ b/arch/arm/configs/aspeed_g4_defconfig
-@@ -58,7 +58,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
- # CONFIG_IOMMU_SUPPORT is not set
- CONFIG_FIRMWARE_MEMMAP=y
- CONFIG_FANOTIFY=y
--CONFIG_PRINTK_TIME=1
-+CONFIG_PRINTK_TIME=y
- CONFIG_DYNAMIC_DEBUG=y
- CONFIG_STRIP_ASM_SYMS=y
- CONFIG_PAGE_POISONING=y
-diff --git a/arch/arm/configs/aspeed_g5_defconfig b/arch/arm/configs/aspeed_g5_defconfig
-index 8926051..4f366b0 100644
---- a/arch/arm/configs/aspeed_g5_defconfig
-+++ b/arch/arm/configs/aspeed_g5_defconfig
-@@ -59,7 +59,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
- # CONFIG_IOMMU_SUPPORT is not set
- CONFIG_FIRMWARE_MEMMAP=y
- CONFIG_FANOTIFY=y
--CONFIG_PRINTK_TIME=1
-+CONFIG_PRINTK_TIME=y
- CONFIG_DYNAMIC_DEBUG=y
- CONFIG_STRIP_ASM_SYMS=y
- CONFIG_PAGE_POISONING=y
-diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
-index ff7ed56..d2485c7 100644
---- a/arch/arm/mm/dma-mapping.c
-+++ b/arch/arm/mm/dma-mapping.c
-@@ -49,6 +49,7 @@ struct arm_dma_alloc_args {
- pgprot_t prot;
- const void *caller;
- bool want_vaddr;
-+ int coherent_flag;
- };
-
- struct arm_dma_free_args {
-@@ -59,6 +60,9 @@ struct arm_dma_free_args {
- bool want_vaddr;
- };
-
-+#define NORMAL 0
-+#define COHERENT 1
-+
- struct arm_dma_allocator {
- void *(*alloc)(struct arm_dma_alloc_args *args,
- struct page **ret_page);
-@@ -272,7 +276,7 @@ static u64 get_coherent_dma_mask(struct device *dev)
- return mask;
- }
-
--static void __dma_clear_buffer(struct page *page, size_t size)
-+static void __dma_clear_buffer(struct page *page, size_t size, int coherent_flag)
- {
- /*
- * Ensure that the allocated pages are zeroed, and that any data
-@@ -284,17 +288,21 @@ static void __dma_clear_buffer(struct page *page, size_t size)
- while (size > 0) {
- void *ptr = kmap_atomic(page);
- memset(ptr, 0, PAGE_SIZE);
-- dmac_flush_range(ptr, ptr + PAGE_SIZE);
-+ if (coherent_flag != COHERENT)
-+ dmac_flush_range(ptr, ptr + PAGE_SIZE);
- kunmap_atomic(ptr);
- page++;
- size -= PAGE_SIZE;
- }
-- outer_flush_range(base, end);
-+ if (coherent_flag != COHERENT)
-+ outer_flush_range(base, end);
- } else {
- void *ptr = page_address(page);
- memset(ptr, 0, size);
-- dmac_flush_range(ptr, ptr + size);
-- outer_flush_range(__pa(ptr), __pa(ptr) + size);
-+ if (coherent_flag != COHERENT) {
-+ dmac_flush_range(ptr, ptr + size);
-+ outer_flush_range(__pa(ptr), __pa(ptr) + size);
-+ }
- }
- }
-
-@@ -302,7 +310,8 @@ static void __dma_clear_buffer(struct page *page, size_t size)
- * Allocate a DMA buffer for 'dev' of size 'size' using the
- * specified gfp mask. Note that 'size' must be page aligned.
- */
--static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gfp)
-+static struct page *__dma_alloc_buffer(struct device *dev, size_t size,
-+ gfp_t gfp, int coherent_flag)
- {
- unsigned long order = get_order(size);
- struct page *page, *p, *e;
-@@ -318,7 +327,7 @@ static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gf
- for (p = page + (size >> PAGE_SHIFT), e = page + (1 << order); p < e; p++)
- __free_page(p);
-
-- __dma_clear_buffer(page, size);
-+ __dma_clear_buffer(page, size, coherent_flag);
-
- return page;
- }
-@@ -340,7 +349,8 @@ static void __dma_free_buffer(struct page *page, size_t size)
-
- static void *__alloc_from_contiguous(struct device *dev, size_t size,
- pgprot_t prot, struct page **ret_page,
-- const void *caller, bool want_vaddr);
-+ const void *caller, bool want_vaddr,
-+ int coherent_flag);
-
- static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp,
- pgprot_t prot, struct page **ret_page,
-@@ -405,10 +415,13 @@ static int __init atomic_pool_init(void)
- atomic_pool = gen_pool_create(PAGE_SHIFT, -1);
- if (!atomic_pool)
- goto out;
--
-+ /*
-+ * The atomic pool is only used for non-coherent allocations
-+ * so we must pass NORMAL for coherent_flag.
-+ */
- if (dev_get_cma_area(NULL))
- ptr = __alloc_from_contiguous(NULL, atomic_pool_size, prot,
-- &page, atomic_pool_init, true);
-+ &page, atomic_pool_init, true, NORMAL);
- else
- ptr = __alloc_remap_buffer(NULL, atomic_pool_size, gfp, prot,
- &page, atomic_pool_init, true);
-@@ -522,7 +535,11 @@ static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp,
- {
- struct page *page;
- void *ptr = NULL;
-- page = __dma_alloc_buffer(dev, size, gfp);
-+ /*
-+ * __alloc_remap_buffer is only called when the device is
-+ * non-coherent
-+ */
-+ page = __dma_alloc_buffer(dev, size, gfp, NORMAL);
- if (!page)
- return NULL;
- if (!want_vaddr)
-@@ -577,7 +594,8 @@ static int __free_from_pool(void *start, size_t size)
-
- static void *__alloc_from_contiguous(struct device *dev, size_t size,
- pgprot_t prot, struct page **ret_page,
-- const void *caller, bool want_vaddr)
-+ const void *caller, bool want_vaddr,
-+ int coherent_flag)
- {
- unsigned long order = get_order(size);
- size_t count = size >> PAGE_SHIFT;
-@@ -588,7 +606,7 @@ static void *__alloc_from_contiguous(struct device *dev, size_t size,
- if (!page)
- return NULL;
-
-- __dma_clear_buffer(page, size);
-+ __dma_clear_buffer(page, size, coherent_flag);
-
- if (!want_vaddr)
- goto out;
-@@ -638,7 +656,7 @@ static inline pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot)
- #define __get_dma_pgprot(attrs, prot) __pgprot(0)
- #define __alloc_remap_buffer(dev, size, gfp, prot, ret, c, wv) NULL
- #define __alloc_from_pool(size, ret_page) NULL
--#define __alloc_from_contiguous(dev, size, prot, ret, c, wv) NULL
-+#define __alloc_from_contiguous(dev, size, prot, ret, c, wv, coherent_flag) NULL
- #define __free_from_pool(cpu_addr, size) do { } while (0)
- #define __free_from_contiguous(dev, page, cpu_addr, size, wv) do { } while (0)
- #define __dma_free_remap(cpu_addr, size) do { } while (0)
-@@ -649,7 +667,8 @@ static void *__alloc_simple_buffer(struct device *dev, size_t size, gfp_t gfp,
- struct page **ret_page)
- {
- struct page *page;
-- page = __dma_alloc_buffer(dev, size, gfp);
-+ /* __alloc_simple_buffer is only called when the device is coherent */
-+ page = __dma_alloc_buffer(dev, size, gfp, COHERENT);
- if (!page)
- return NULL;
-
-@@ -679,7 +698,7 @@ static void *cma_allocator_alloc(struct arm_dma_alloc_args *args,
- {
- return __alloc_from_contiguous(args->dev, args->size, args->prot,
- ret_page, args->caller,
-- args->want_vaddr);
-+ args->want_vaddr, args->coherent_flag);
- }
-
- static void cma_allocator_free(struct arm_dma_free_args *args)
-@@ -746,6 +765,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
- .prot = prot,
- .caller = caller,
- .want_vaddr = !dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs),
-+ .coherent_flag = is_coherent ? COHERENT : NORMAL,
- };
-
- #ifdef CONFIG_DMA_API_DEBUG
-@@ -1253,7 +1273,8 @@ static inline void __free_iova(struct dma_iommu_mapping *mapping,
- static const int iommu_order_array[] = { 9, 8, 4, 0 };
-
- static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
-- gfp_t gfp, struct dma_attrs *attrs)
-+ gfp_t gfp, struct dma_attrs *attrs,
-+ int coherent_flag)
- {
- struct page **pages;
- int count = size >> PAGE_SHIFT;
-@@ -1277,7 +1298,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
- if (!page)
- goto error;
-
-- __dma_clear_buffer(page, size);
-+ __dma_clear_buffer(page, size, coherent_flag);
-
- for (i = 0; i < count; i++)
- pages[i] = page + i;
-@@ -1327,7 +1348,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
- pages[i + j] = pages[i] + j;
- }
-
-- __dma_clear_buffer(pages[i], PAGE_SIZE << order);
-+ __dma_clear_buffer(pages[i], PAGE_SIZE << order, coherent_flag);
- i += 1 << order;
- count -= 1 << order;
- }
-@@ -1505,7 +1526,8 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
- */
- gfp &= ~(__GFP_COMP);
-
-- pages = __iommu_alloc_buffer(dev, size, gfp, attrs);
-+ /* For now always consider we are in a non-coherent case */
-+ pages = __iommu_alloc_buffer(dev, size, gfp, attrs, NORMAL);
- if (!pages)
- return NULL;
-
-diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
-index 5a0a691..2038492 100644
---- a/arch/arm64/Kconfig
-+++ b/arch/arm64/Kconfig
-@@ -872,7 +872,7 @@ config RELOCATABLE
-
- config RANDOMIZE_BASE
- bool "Randomize the address of the kernel image"
-- select ARM64_MODULE_PLTS
-+ select ARM64_MODULE_PLTS if MODULES
- select RELOCATABLE
- help
- Randomizes the virtual address at which the kernel image is
-diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-index 8b4a7c9..080203e 100644
---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-@@ -670,7 +670,7 @@
- #address-cells = <0>;
-
- reg = <0x0 0xffb71000 0x0 0x1000>,
-- <0x0 0xffb72000 0x0 0x1000>,
-+ <0x0 0xffb72000 0x0 0x2000>,
- <0x0 0xffb74000 0x0 0x2000>,
- <0x0 0xffb76000 0x0 0x2000>;
- interrupts = <GIC_PPI 9
-diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
-index 4fbf3c5..0800d23 100644
---- a/arch/arm64/kernel/debug-monitors.c
-+++ b/arch/arm64/kernel/debug-monitors.c
-@@ -151,7 +151,6 @@ static int debug_monitors_init(void)
- /* Clear the OS lock. */
- on_each_cpu(clear_os_lock, NULL, 1);
- isb();
-- local_dbg_enable();
-
- /* Register hotplug handler. */
- __register_cpu_notifier(&os_lock_nb);
-diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
-index 21ab5df..65d81f9 100644
---- a/arch/arm64/kernel/hibernate.c
-+++ b/arch/arm64/kernel/hibernate.c
-@@ -35,6 +35,7 @@
- #include <asm/sections.h>
- #include <asm/smp.h>
- #include <asm/suspend.h>
-+#include <asm/sysreg.h>
- #include <asm/virt.h>
-
- /*
-@@ -217,12 +218,22 @@ static int create_safe_exec_page(void *src_start, size_t length,
- set_pte(pte, __pte(virt_to_phys((void *)dst) |
- pgprot_val(PAGE_KERNEL_EXEC)));
-
-- /* Load our new page tables */
-- asm volatile("msr ttbr0_el1, %0;"
-- "isb;"
-- "tlbi vmalle1is;"
-- "dsb ish;"
-- "isb" : : "r"(virt_to_phys(pgd)));
-+ /*
-+ * Load our new page tables. A strict BBM approach requires that we
-+ * ensure that TLBs are free of any entries that may overlap with the
-+ * global mappings we are about to install.
-+ *
-+ * For a real hibernate/resume cycle TTBR0 currently points to a zero
-+ * page, but TLBs may contain stale ASID-tagged entries (e.g. for EFI
-+ * runtime services), while for a userspace-driven test_resume cycle it
-+ * points to userspace page tables (and we must point it at a zero page
-+ * ourselves). Elsewhere we only (un)install the idmap with preemption
-+ * disabled, so T0SZ should be as required regardless.
-+ */
-+ cpu_set_reserved_ttbr0();
-+ local_flush_tlb_all();
-+ write_sysreg(virt_to_phys(pgd), ttbr0_el1);
-+ isb();
-
- *phys_dst_addr = virt_to_phys((void *)dst);
-
-@@ -394,6 +405,38 @@ int swsusp_arch_resume(void)
- void *, phys_addr_t, phys_addr_t);
-
- /*
-+ * Restoring the memory image will overwrite the ttbr1 page tables.
-+ * Create a second copy of just the linear map, and use this when
-+ * restoring.
-+ */
-+ tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
-+ if (!tmp_pg_dir) {
-+ pr_err("Failed to allocate memory for temporary page tables.");
-+ rc = -ENOMEM;
-+ goto out;
-+ }
-+ rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
-+ if (rc)
-+ goto out;
-+
-+ /*
-+ * Since we only copied the linear map, we need to find restore_pblist's
-+ * linear map address.
-+ */
-+ lm_restore_pblist = LMADDR(restore_pblist);
-+
-+ /*
-+ * We need a zero page that is zero before & after resume in order to
-+ * to break before make on the ttbr1 page tables.
-+ */
-+ zero_page = (void *)get_safe_page(GFP_ATOMIC);
-+ if (!zero_page) {
-+ pr_err("Failed to allocate zero page.");
-+ rc = -ENOMEM;
-+ goto out;
-+ }
-+
-+ /*
- * Locate the exit code in the bottom-but-one page, so that *NULL
- * still has disastrous affects.
- */
-@@ -419,27 +462,6 @@ int swsusp_arch_resume(void)
- __flush_dcache_area(hibernate_exit, exit_size);
-
- /*
-- * Restoring the memory image will overwrite the ttbr1 page tables.
-- * Create a second copy of just the linear map, and use this when
-- * restoring.
-- */
-- tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
-- if (!tmp_pg_dir) {
-- pr_err("Failed to allocate memory for temporary page tables.");
-- rc = -ENOMEM;
-- goto out;
-- }
-- rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
-- if (rc)
-- goto out;
--
-- /*
-- * Since we only copied the linear map, we need to find restore_pblist's
-- * linear map address.
-- */
-- lm_restore_pblist = LMADDR(restore_pblist);
--
-- /*
- * KASLR will cause the el2 vectors to be in a different location in
- * the resumed kernel. Load hibernate's temporary copy into el2.
- *
-@@ -453,12 +475,6 @@ int swsusp_arch_resume(void)
- __hyp_set_vectors(el2_vectors);
- }
-
-- /*
-- * We need a zero page that is zero before & after resume in order to
-- * to break before make on the ttbr1 page tables.
-- */
-- zero_page = (void *)get_safe_page(GFP_ATOMIC);
--
- hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1,
- resume_hdr.reenter_kernel, lm_restore_pblist,
- resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page));
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 62ff3c0..490db85 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -267,7 +267,6 @@ asmlinkage void secondary_start_kernel(void)
- set_cpu_online(cpu, true);
- complete(&cpu_running);
-
-- local_dbg_enable();
- local_irq_enable();
- local_async_enable();
-
-@@ -437,9 +436,9 @@ void __init smp_cpus_done(unsigned int max_cpus)
-
- void __init smp_prepare_boot_cpu(void)
- {
-+ set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
- cpuinfo_store_boot_cpu();
- save_boot_cpu_run_el();
-- set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
- }
-
- static u64 __init of_get_cpu_mpidr(struct device_node *dn)
-@@ -694,6 +693,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
- smp_store_cpu_info(smp_processor_id());
-
- /*
-+ * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set
-+ * secondary CPUs present.
-+ */
-+ if (max_cpus == 0)
-+ return;
-+
-+ /*
- * Initialise the present map (which describes the set of CPUs
- * actually populated at the present time) and release the
- * secondaries from the bootloader.
-diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
-index 435e820..e564d45 100644
---- a/arch/arm64/kernel/vmlinux.lds.S
-+++ b/arch/arm64/kernel/vmlinux.lds.S
-@@ -181,9 +181,9 @@ SECTIONS
- *(.hash)
- }
-
-- __rela_offset = ADDR(.rela) - KIMAGE_VADDR;
-+ __rela_offset = ABSOLUTE(ADDR(.rela) - KIMAGE_VADDR);
- __rela_size = SIZEOF(.rela);
-- __dynsym_offset = ADDR(.dynsym) - KIMAGE_VADDR;
-+ __dynsym_offset = ABSOLUTE(ADDR(.dynsym) - KIMAGE_VADDR);
-
- . = ALIGN(SEGMENT_ALIGN);
- __init_end = .;
-diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
-index 0f7c40e..9341376 100644
---- a/arch/arm64/kvm/hyp/sysreg-sr.c
-+++ b/arch/arm64/kvm/hyp/sysreg-sr.c
-@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothing(struct kvm_cpu_context *ctxt) { }
- /*
- * Non-VHE: Both host and guest must save everything.
- *
-- * VHE: Host must save tpidr*_el[01], actlr_el1, sp0, pc, pstate, and
-- * guest must save everything.
-+ * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc,
-+ * pstate, and guest must save everything.
- */
-
- static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
-@@ -37,6 +37,7 @@ static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
- ctxt->sys_regs[TPIDR_EL0] = read_sysreg(tpidr_el0);
- ctxt->sys_regs[TPIDRRO_EL0] = read_sysreg(tpidrro_el0);
- ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1);
-+ ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1);
- ctxt->gp_regs.regs.sp = read_sysreg(sp_el0);
- ctxt->gp_regs.regs.pc = read_sysreg_el2(elr);
- ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr);
-@@ -61,7 +62,6 @@ static void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt)
- ctxt->sys_regs[AMAIR_EL1] = read_sysreg_el1(amair);
- ctxt->sys_regs[CNTKCTL_EL1] = read_sysreg_el1(cntkctl);
- ctxt->sys_regs[PAR_EL1] = read_sysreg(par_el1);
-- ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1);
-
- ctxt->gp_regs.sp_el1 = read_sysreg(sp_el1);
- ctxt->gp_regs.elr_el1 = read_sysreg_el1(elr);
-@@ -90,6 +90,7 @@ static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctx
- write_sysreg(ctxt->sys_regs[TPIDR_EL0], tpidr_el0);
- write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0);
- write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1);
-+ write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1);
- write_sysreg(ctxt->gp_regs.regs.sp, sp_el0);
- write_sysreg_el2(ctxt->gp_regs.regs.pc, elr);
- write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr);
-@@ -114,7 +115,6 @@ static void __hyp_text __sysreg_restore_state(struct kvm_cpu_context *ctxt)
- write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1], amair);
- write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], cntkctl);
- write_sysreg(ctxt->sys_regs[PAR_EL1], par_el1);
-- write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1);
-
- write_sysreg(ctxt->gp_regs.sp_el1, sp_el1);
- write_sysreg_el1(ctxt->gp_regs.elr_el1, elr);
-diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
-index e9e0e6d..898c0e6 100644
---- a/arch/arm64/kvm/inject_fault.c
-+++ b/arch/arm64/kvm/inject_fault.c
-@@ -132,16 +132,14 @@ static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type)
- static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
- {
- unsigned long cpsr = *vcpu_cpsr(vcpu);
-- bool is_aarch32;
-+ bool is_aarch32 = vcpu_mode_is_32bit(vcpu);
- u32 esr = 0;
-
-- is_aarch32 = vcpu_mode_is_32bit(vcpu);
--
-- *vcpu_spsr(vcpu) = cpsr;
- *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
--
- *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
-+
- *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-+ *vcpu_spsr(vcpu) = cpsr;
-
- vcpu_sys_reg(vcpu, FAR_EL1) = addr;
-
-@@ -172,11 +170,11 @@ static void inject_undef64(struct kvm_vcpu *vcpu)
- unsigned long cpsr = *vcpu_cpsr(vcpu);
- u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT);
-
-- *vcpu_spsr(vcpu) = cpsr;
- *vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
--
- *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
-+
- *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-+ *vcpu_spsr(vcpu) = cpsr;
-
- /*
- * Build an unknown exception, depending on the instruction
-diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
-index 0f85a46..3e90a2c 100644
---- a/arch/arm64/mm/mmu.c
-+++ b/arch/arm64/mm/mmu.c
-@@ -748,9 +748,9 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
- /*
- * Check whether the physical FDT address is set and meets the minimum
- * alignment requirement. Since we are relying on MIN_FDT_ALIGN to be
-- * at least 8 bytes so that we can always access the size field of the
-- * FDT header after mapping the first chunk, double check here if that
-- * is indeed the case.
-+ * at least 8 bytes so that we can always access the magic and size
-+ * fields of the FDT header after mapping the first chunk, double check
-+ * here if that is indeed the case.
- */
- BUILD_BUG_ON(MIN_FDT_ALIGN < 8);
- if (!dt_phys || dt_phys % MIN_FDT_ALIGN)
-@@ -778,7 +778,7 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
- create_mapping_noalloc(round_down(dt_phys, SWAPPER_BLOCK_SIZE),
- dt_virt_base, SWAPPER_BLOCK_SIZE, prot);
-
-- if (fdt_check_header(dt_virt) != 0)
-+ if (fdt_magic(dt_virt) != FDT_MAGIC)
- return NULL;
-
- *size = fdt_totalsize(dt_virt);
-diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
-index c431787..5bb61de 100644
---- a/arch/arm64/mm/proc.S
-+++ b/arch/arm64/mm/proc.S
-@@ -180,6 +180,8 @@ ENTRY(__cpu_setup)
- msr cpacr_el1, x0 // Enable FP/ASIMD
- mov x0, #1 << 12 // Reset mdscr_el1 and disable
- msr mdscr_el1, x0 // access to the DCC from EL0
-+ isb // Unmask debug exceptions now,
-+ enable_dbg // since this is per-cpu
- reset_pmuserenr_el0 x0 // Disable PMU access from EL0
- /*
- * Memory region attributes for LPAE:
-diff --git a/arch/metag/include/asm/cmpxchg_lnkget.h b/arch/metag/include/asm/cmpxchg_lnkget.h
-index 0154e28..2369ad3 100644
---- a/arch/metag/include/asm/cmpxchg_lnkget.h
-+++ b/arch/metag/include/asm/cmpxchg_lnkget.h
-@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u32(volatile int *m, unsigned long old,
- " DCACHE [%2], %0\n"
- #endif
- "2:\n"
-- : "=&d" (temp), "=&da" (retval)
-+ : "=&d" (temp), "=&d" (retval)
- : "da" (m), "bd" (old), "da" (new)
- : "cc"
- );
-diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c
-index e4c21bb..804d2a2 100644
---- a/arch/mips/kernel/cevt-r4k.c
-+++ b/arch/mips/kernel/cevt-r4k.c
-@@ -276,12 +276,7 @@ int r4k_clockevent_init(void)
- CLOCK_EVT_FEAT_C3STOP |
- CLOCK_EVT_FEAT_PERCPU;
-
-- clockevent_set_clock(cd, mips_hpt_frequency);
--
-- /* Calculate the min / max delta */
-- cd->max_delta_ns = clockevent_delta2ns(0x7fffffff, cd);
- min_delta = calculate_min_delta();
-- cd->min_delta_ns = clockevent_delta2ns(min_delta, cd);
-
- cd->rating = 300;
- cd->irq = irq;
-@@ -289,7 +284,7 @@ int r4k_clockevent_init(void)
- cd->set_next_event = mips_next_event;
- cd->event_handler = mips_event_handler;
-
-- clockevents_register_device(cd);
-+ clockevents_config_and_register(cd, mips_hpt_frequency, min_delta, 0x7fffffff);
-
- if (cp0_timer_irq_installed)
- return 0;
-diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c
-index 1f91056..d76275d 100644
---- a/arch/mips/kernel/csrc-r4k.c
-+++ b/arch/mips/kernel/csrc-r4k.c
-@@ -23,7 +23,7 @@ static struct clocksource clocksource_mips = {
- .flags = CLOCK_SOURCE_IS_CONTINUOUS,
- };
-
--static u64 notrace r4k_read_sched_clock(void)
-+static u64 __maybe_unused notrace r4k_read_sched_clock(void)
- {
- return read_c0_count();
- }
-@@ -82,7 +82,9 @@ int __init init_r4k_clocksource(void)
-
- clocksource_register_hz(&clocksource_mips, mips_hpt_frequency);
-
-+#ifndef CONFIG_CPU_FREQ
- sched_clock_register(r4k_read_sched_clock, 32, mips_hpt_frequency);
-+#endif
-
- return 0;
- }
-diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
-index 645c8a1..2b42a74 100644
---- a/arch/mips/kvm/emulate.c
-+++ b/arch/mips/kvm/emulate.c
-@@ -1615,8 +1615,14 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
-
- preempt_disable();
- if (KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG0) {
-- if (kvm_mips_host_tlb_lookup(vcpu, va) < 0)
-- kvm_mips_handle_kseg0_tlb_fault(va, vcpu);
-+ if (kvm_mips_host_tlb_lookup(vcpu, va) < 0 &&
-+ kvm_mips_handle_kseg0_tlb_fault(va, vcpu)) {
-+ kvm_err("%s: handling mapped kseg0 tlb fault for %lx, vcpu: %p, ASID: %#lx\n",
-+ __func__, va, vcpu, read_c0_entryhi());
-+ er = EMULATE_FAIL;
-+ preempt_enable();
-+ goto done;
-+ }
- } else if ((KVM_GUEST_KSEGX(va) < KVM_GUEST_KSEG0) ||
- KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG23) {
- int index;
-@@ -1654,14 +1660,19 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
- run, vcpu);
- preempt_enable();
- goto dont_update_pc;
-- } else {
-- /*
-- * We fault an entry from the guest tlb to the
-- * shadow host TLB
-- */
-- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
-- NULL,
-- NULL);
-+ }
-+ /*
-+ * We fault an entry from the guest tlb to the
-+ * shadow host TLB
-+ */
-+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
-+ NULL, NULL)) {
-+ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
-+ __func__, va, index, vcpu,
-+ read_c0_entryhi());
-+ er = EMULATE_FAIL;
-+ preempt_enable();
-+ goto done;
- }
- }
- } else {
-@@ -2625,8 +2636,13 @@ enum emulation_result kvm_mips_handle_tlbmiss(unsigned long cause,
- * OK we have a Guest TLB entry, now inject it into the
- * shadow host TLB
- */
-- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, NULL,
-- NULL);
-+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
-+ NULL, NULL)) {
-+ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
-+ __func__, va, index, vcpu,
-+ read_c0_entryhi());
-+ er = EMULATE_FAIL;
-+ }
- }
- }
-
-diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
-index ed021ae..ad2270f 100644
---- a/arch/mips/kvm/tlb.c
-+++ b/arch/mips/kvm/tlb.c
-@@ -284,7 +284,7 @@ int kvm_mips_handle_kseg0_tlb_fault(unsigned long badvaddr,
- }
-
- gfn = (KVM_GUEST_CPHYSADDR(badvaddr) >> PAGE_SHIFT);
-- if (gfn >= kvm->arch.guest_pmap_npages) {
-+ if ((gfn | 1) >= kvm->arch.guest_pmap_npages) {
- kvm_err("%s: Invalid gfn: %#llx, BadVaddr: %#lx\n", __func__,
- gfn, badvaddr);
- kvm_mips_dump_host_tlbs();
-@@ -373,26 +373,40 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
- unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
- struct kvm *kvm = vcpu->kvm;
- kvm_pfn_t pfn0, pfn1;
-+ gfn_t gfn0, gfn1;
-+ long tlb_lo[2];
- int ret;
-
-- if ((tlb->tlb_hi & VPN2_MASK) == 0) {
-- pfn0 = 0;
-- pfn1 = 0;
-- } else {
-- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0)
-- >> PAGE_SHIFT) < 0)
-- return -1;
--
-- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1)
-- >> PAGE_SHIFT) < 0)
-- return -1;
--
-- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0)
-- >> PAGE_SHIFT];
-- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1)
-- >> PAGE_SHIFT];
-+ tlb_lo[0] = tlb->tlb_lo0;
-+ tlb_lo[1] = tlb->tlb_lo1;
-+
-+ /*
-+ * The commpage address must not be mapped to anything else if the guest
-+ * TLB contains entries nearby, or commpage accesses will break.
-+ */
-+ if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &
-+ VPN2_MASK & (PAGE_MASK << 1)))
-+ tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
-+
-+ gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;
-+ gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;
-+ if (gfn0 >= kvm->arch.guest_pmap_npages ||
-+ gfn1 >= kvm->arch.guest_pmap_npages) {
-+ kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n",
-+ __func__, gfn0, gfn1, tlb->tlb_hi);
-+ kvm_mips_dump_guest_tlbs(vcpu);
-+ return -1;
- }
-
-+ if (kvm_mips_map_page(kvm, gfn0) < 0)
-+ return -1;
-+
-+ if (kvm_mips_map_page(kvm, gfn1) < 0)
-+ return -1;
-+
-+ pfn0 = kvm->arch.guest_pmap[gfn0];
-+ pfn1 = kvm->arch.guest_pmap[gfn1];
-+
- if (hpa0)
- *hpa0 = pfn0 << PAGE_SHIFT;
-
-@@ -401,9 +415,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
-
- /* Get attributes from the Guest TLB */
- entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) |
-- (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V);
-+ (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V);
- entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) |
-- (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V);
-+ (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V);
-
- kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc,
- tlb->tlb_lo0, tlb->tlb_lo1);
-@@ -776,10 +790,16 @@ uint32_t kvm_get_inst(uint32_t *opc, struct kvm_vcpu *vcpu)
- local_irq_restore(flags);
- return KVM_INVALID_INST;
- }
-- kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
-- &vcpu->arch.
-- guest_tlb[index],
-- NULL, NULL);
-+ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
-+ &vcpu->arch.guest_tlb[index],
-+ NULL, NULL)) {
-+ kvm_err("%s: handling mapped seg tlb fault failed for %p, index: %u, vcpu: %p, ASID: %#lx\n",
-+ __func__, opc, index, vcpu,
-+ read_c0_entryhi());
-+ kvm_mips_dump_guest_tlbs(vcpu);
-+ local_irq_restore(flags);
-+ return KVM_INVALID_INST;
-+ }
- inst = *(opc);
- }
- local_irq_restore(flags);
-diff --git a/arch/mips/loongson64/loongson-3/hpet.c b/arch/mips/loongson64/loongson-3/hpet.c
-index 249039a..4788bea 100644
---- a/arch/mips/loongson64/loongson-3/hpet.c
-+++ b/arch/mips/loongson64/loongson-3/hpet.c
-@@ -13,8 +13,8 @@
- #define SMBUS_PCI_REG64 0x64
- #define SMBUS_PCI_REGB4 0xb4
-
--#define HPET_MIN_CYCLES 64
--#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
-+#define HPET_MIN_CYCLES 16
-+#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES * 12)
-
- static DEFINE_SPINLOCK(hpet_lock);
- DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device);
-@@ -157,14 +157,14 @@ static int hpet_tick_resume(struct clock_event_device *evt)
- static int hpet_next_event(unsigned long delta,
- struct clock_event_device *evt)
- {
-- unsigned int cnt;
-- int res;
-+ u32 cnt;
-+ s32 res;
-
- cnt = hpet_read(HPET_COUNTER);
-- cnt += delta;
-+ cnt += (u32) delta;
- hpet_write(HPET_T0_CMP, cnt);
-
-- res = (int)(cnt - hpet_read(HPET_COUNTER));
-+ res = (s32)(cnt - hpet_read(HPET_COUNTER));
-
- return res < HPET_MIN_CYCLES ? -ETIME : 0;
- }
-@@ -230,7 +230,7 @@ void __init setup_hpet_timer(void)
-
- cd = &per_cpu(hpet_clockevent_device, cpu);
- cd->name = "hpet";
-- cd->rating = 320;
-+ cd->rating = 100;
- cd->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
- cd->set_state_shutdown = hpet_set_state_shutdown;
- cd->set_state_periodic = hpet_set_state_periodic;
-diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
-index 9c2220a..45e3b87 100644
---- a/arch/mips/mm/uasm-mips.c
-+++ b/arch/mips/mm/uasm-mips.c
-@@ -65,7 +65,7 @@ static struct insn insn_table[] = {
- #ifndef CONFIG_CPU_MIPSR6
- { insn_cache, M(cache_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
- #else
-- { insn_cache, M6(cache_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 },
-+ { insn_cache, M6(spec3_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 },
- #endif
- { insn_daddiu, M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
- { insn_daddu, M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD },
-diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
-index b7019b5..298afcf 100644
---- a/arch/powerpc/kernel/tm.S
-+++ b/arch/powerpc/kernel/tm.S
-@@ -338,8 +338,6 @@ _GLOBAL(__tm_recheckpoint)
- */
- subi r7, r7, STACK_FRAME_OVERHEAD
-
-- SET_SCRATCH0(r1)
--
- mfmsr r6
- /* R4 = original MSR to indicate whether thread used FP/Vector etc. */
-
-@@ -468,6 +466,7 @@ restore_gprs:
- * until we turn MSR RI back on.
- */
-
-+ SET_SCRATCH0(r1)
- ld r5, -8(r1)
- ld r1, -16(r1)
-
-diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-index e571ad2..38e108e 100644
---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-@@ -655,112 +655,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-
- #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
- BEGIN_FTR_SECTION
-- b skip_tm
--END_FTR_SECTION_IFCLR(CPU_FTR_TM)
--
-- /* Turn on TM/FP/VSX/VMX so we can restore them. */
-- mfmsr r5
-- li r6, MSR_TM >> 32
-- sldi r6, r6, 32
-- or r5, r5, r6
-- ori r5, r5, MSR_FP
-- oris r5, r5, (MSR_VEC | MSR_VSX)@h
-- mtmsrd r5
--
-- /*
-- * The user may change these outside of a transaction, so they must
-- * always be context switched.
-- */
-- ld r5, VCPU_TFHAR(r4)
-- ld r6, VCPU_TFIAR(r4)
-- ld r7, VCPU_TEXASR(r4)
-- mtspr SPRN_TFHAR, r5
-- mtspr SPRN_TFIAR, r6
-- mtspr SPRN_TEXASR, r7
--
-- ld r5, VCPU_MSR(r4)
-- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-- beq skip_tm /* TM not active in guest */
--
-- /* Make sure the failure summary is set, otherwise we'll program check
-- * when we trechkpt. It's possible that this might have been not set
-- * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
-- * host.
-- */
-- oris r7, r7, (TEXASR_FS)@h
-- mtspr SPRN_TEXASR, r7
--
-- /*
-- * We need to load up the checkpointed state for the guest.
-- * We need to do this early as it will blow away any GPRs, VSRs and
-- * some SPRs.
-- */
--
-- mr r31, r4
-- addi r3, r31, VCPU_FPRS_TM
-- bl load_fp_state
-- addi r3, r31, VCPU_VRS_TM
-- bl load_vr_state
-- mr r4, r31
-- lwz r7, VCPU_VRSAVE_TM(r4)
-- mtspr SPRN_VRSAVE, r7
--
-- ld r5, VCPU_LR_TM(r4)
-- lwz r6, VCPU_CR_TM(r4)
-- ld r7, VCPU_CTR_TM(r4)
-- ld r8, VCPU_AMR_TM(r4)
-- ld r9, VCPU_TAR_TM(r4)
-- mtlr r5
-- mtcr r6
-- mtctr r7
-- mtspr SPRN_AMR, r8
-- mtspr SPRN_TAR, r9
--
-- /*
-- * Load up PPR and DSCR values but don't put them in the actual SPRs
-- * till the last moment to avoid running with userspace PPR and DSCR for
-- * too long.
-- */
-- ld r29, VCPU_DSCR_TM(r4)
-- ld r30, VCPU_PPR_TM(r4)
--
-- std r2, PACATMSCRATCH(r13) /* Save TOC */
--
-- /* Clear the MSR RI since r1, r13 are all going to be foobar. */
-- li r5, 0
-- mtmsrd r5, 1
--
-- /* Load GPRs r0-r28 */
-- reg = 0
-- .rept 29
-- ld reg, VCPU_GPRS_TM(reg)(r31)
-- reg = reg + 1
-- .endr
--
-- mtspr SPRN_DSCR, r29
-- mtspr SPRN_PPR, r30
--
-- /* Load final GPRs */
-- ld 29, VCPU_GPRS_TM(29)(r31)
-- ld 30, VCPU_GPRS_TM(30)(r31)
-- ld 31, VCPU_GPRS_TM(31)(r31)
--
-- /* TM checkpointed state is now setup. All GPRs are now volatile. */
-- TRECHKPT
--
-- /* Now let's get back the state we need. */
-- HMT_MEDIUM
-- GET_PACA(r13)
-- ld r29, HSTATE_DSCR(r13)
-- mtspr SPRN_DSCR, r29
-- ld r4, HSTATE_KVM_VCPU(r13)
-- ld r1, HSTATE_HOST_R1(r13)
-- ld r2, PACATMSCRATCH(r13)
--
-- /* Set the MSR RI since we have our registers back. */
-- li r5, MSR_RI
-- mtmsrd r5, 1
--skip_tm:
-+ bl kvmppc_restore_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
- #endif
-
- /* Load guest PMU registers */
-@@ -841,12 +737,6 @@ BEGIN_FTR_SECTION
- /* Skip next section on POWER7 */
- b 8f
- END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-- /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
-- mfmsr r8
-- li r0, 1
-- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-- mtmsrd r8
--
- /* Load up POWER8-specific registers */
- ld r5, VCPU_IAMR(r4)
- lwz r6, VCPU_PSPB(r4)
-@@ -1436,106 +1326,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
-
- #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
- BEGIN_FTR_SECTION
-- b 2f
--END_FTR_SECTION_IFCLR(CPU_FTR_TM)
-- /* Turn on TM. */
-- mfmsr r8
-- li r0, 1
-- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-- mtmsrd r8
--
-- ld r5, VCPU_MSR(r9)
-- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-- beq 1f /* TM not active in guest. */
--
-- li r3, TM_CAUSE_KVM_RESCHED
--
-- /* Clear the MSR RI since r1, r13 are all going to be foobar. */
-- li r5, 0
-- mtmsrd r5, 1
--
-- /* All GPRs are volatile at this point. */
-- TRECLAIM(R3)
--
-- /* Temporarily store r13 and r9 so we have some regs to play with */
-- SET_SCRATCH0(r13)
-- GET_PACA(r13)
-- std r9, PACATMSCRATCH(r13)
-- ld r9, HSTATE_KVM_VCPU(r13)
--
-- /* Get a few more GPRs free. */
-- std r29, VCPU_GPRS_TM(29)(r9)
-- std r30, VCPU_GPRS_TM(30)(r9)
-- std r31, VCPU_GPRS_TM(31)(r9)
--
-- /* Save away PPR and DSCR soon so don't run with user values. */
-- mfspr r31, SPRN_PPR
-- HMT_MEDIUM
-- mfspr r30, SPRN_DSCR
-- ld r29, HSTATE_DSCR(r13)
-- mtspr SPRN_DSCR, r29
--
-- /* Save all but r9, r13 & r29-r31 */
-- reg = 0
-- .rept 29
-- .if (reg != 9) && (reg != 13)
-- std reg, VCPU_GPRS_TM(reg)(r9)
-- .endif
-- reg = reg + 1
-- .endr
-- /* ... now save r13 */
-- GET_SCRATCH0(r4)
-- std r4, VCPU_GPRS_TM(13)(r9)
-- /* ... and save r9 */
-- ld r4, PACATMSCRATCH(r13)
-- std r4, VCPU_GPRS_TM(9)(r9)
--
-- /* Reload stack pointer and TOC. */
-- ld r1, HSTATE_HOST_R1(r13)
-- ld r2, PACATOC(r13)
--
-- /* Set MSR RI now we have r1 and r13 back. */
-- li r5, MSR_RI
-- mtmsrd r5, 1
--
-- /* Save away checkpinted SPRs. */
-- std r31, VCPU_PPR_TM(r9)
-- std r30, VCPU_DSCR_TM(r9)
-- mflr r5
-- mfcr r6
-- mfctr r7
-- mfspr r8, SPRN_AMR
-- mfspr r10, SPRN_TAR
-- std r5, VCPU_LR_TM(r9)
-- stw r6, VCPU_CR_TM(r9)
-- std r7, VCPU_CTR_TM(r9)
-- std r8, VCPU_AMR_TM(r9)
-- std r10, VCPU_TAR_TM(r9)
--
-- /* Restore r12 as trap number. */
-- lwz r12, VCPU_TRAP(r9)
--
-- /* Save FP/VSX. */
-- addi r3, r9, VCPU_FPRS_TM
-- bl store_fp_state
-- addi r3, r9, VCPU_VRS_TM
-- bl store_vr_state
-- mfspr r6, SPRN_VRSAVE
-- stw r6, VCPU_VRSAVE_TM(r9)
--1:
-- /*
-- * We need to save these SPRs after the treclaim so that the software
-- * error code is recorded correctly in the TEXASR. Also the user may
-- * change these outside of a transaction, so they must always be
-- * context switched.
-- */
-- mfspr r5, SPRN_TFHAR
-- mfspr r6, SPRN_TFIAR
-- mfspr r7, SPRN_TEXASR
-- std r5, VCPU_TFHAR(r9)
-- std r6, VCPU_TFIAR(r9)
-- std r7, VCPU_TEXASR(r9)
--2:
-+ bl kvmppc_save_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
- #endif
-
- /* Increment yield count if they have a VPA */
-@@ -2245,6 +2037,13 @@ _GLOBAL(kvmppc_h_cede) /* r3 = vcpu pointer, r11 = msr, r13 = paca */
- /* save FP state */
- bl kvmppc_save_fp
-
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+BEGIN_FTR_SECTION
-+ ld r9, HSTATE_KVM_VCPU(r13)
-+ bl kvmppc_save_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
-+#endif
-+
- /*
- * Set DEC to the smaller of DEC and HDEC, so that we wake
- * no later than the end of our timeslice (HDEC interrupts
-@@ -2321,6 +2120,12 @@ kvm_end_cede:
- bl kvmhv_accumulate_time
- #endif
-
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+BEGIN_FTR_SECTION
-+ bl kvmppc_restore_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
-+#endif
-+
- /* load up FP state */
- bl kvmppc_load_fp
-
-@@ -2631,6 +2436,239 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
- mr r4,r31
- blr
-
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+/*
-+ * Save transactional state and TM-related registers.
-+ * Called with r9 pointing to the vcpu struct.
-+ * This can modify all checkpointed registers, but
-+ * restores r1, r2 and r9 (vcpu pointer) before exit.
-+ */
-+kvmppc_save_tm:
-+ mflr r0
-+ std r0, PPC_LR_STKOFF(r1)
-+
-+ /* Turn on TM. */
-+ mfmsr r8
-+ li r0, 1
-+ rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-+ mtmsrd r8
-+
-+ ld r5, VCPU_MSR(r9)
-+ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-+ beq 1f /* TM not active in guest. */
-+
-+ std r1, HSTATE_HOST_R1(r13)
-+ li r3, TM_CAUSE_KVM_RESCHED
-+
-+ /* Clear the MSR RI since r1, r13 are all going to be foobar. */
-+ li r5, 0
-+ mtmsrd r5, 1
-+
-+ /* All GPRs are volatile at this point. */
-+ TRECLAIM(R3)
-+
-+ /* Temporarily store r13 and r9 so we have some regs to play with */
-+ SET_SCRATCH0(r13)
-+ GET_PACA(r13)
-+ std r9, PACATMSCRATCH(r13)
-+ ld r9, HSTATE_KVM_VCPU(r13)
-+
-+ /* Get a few more GPRs free. */
-+ std r29, VCPU_GPRS_TM(29)(r9)
-+ std r30, VCPU_GPRS_TM(30)(r9)
-+ std r31, VCPU_GPRS_TM(31)(r9)
-+
-+ /* Save away PPR and DSCR soon so don't run with user values. */
-+ mfspr r31, SPRN_PPR
-+ HMT_MEDIUM
-+ mfspr r30, SPRN_DSCR
-+ ld r29, HSTATE_DSCR(r13)
-+ mtspr SPRN_DSCR, r29
-+
-+ /* Save all but r9, r13 & r29-r31 */
-+ reg = 0
-+ .rept 29
-+ .if (reg != 9) && (reg != 13)
-+ std reg, VCPU_GPRS_TM(reg)(r9)
-+ .endif
-+ reg = reg + 1
-+ .endr
-+ /* ... now save r13 */
-+ GET_SCRATCH0(r4)
-+ std r4, VCPU_GPRS_TM(13)(r9)
-+ /* ... and save r9 */
-+ ld r4, PACATMSCRATCH(r13)
-+ std r4, VCPU_GPRS_TM(9)(r9)
-+
-+ /* Reload stack pointer and TOC. */
-+ ld r1, HSTATE_HOST_R1(r13)
-+ ld r2, PACATOC(r13)
-+
-+ /* Set MSR RI now we have r1 and r13 back. */
-+ li r5, MSR_RI
-+ mtmsrd r5, 1
-+
-+ /* Save away checkpinted SPRs. */
-+ std r31, VCPU_PPR_TM(r9)
-+ std r30, VCPU_DSCR_TM(r9)
-+ mflr r5
-+ mfcr r6
-+ mfctr r7
-+ mfspr r8, SPRN_AMR
-+ mfspr r10, SPRN_TAR
-+ std r5, VCPU_LR_TM(r9)
-+ stw r6, VCPU_CR_TM(r9)
-+ std r7, VCPU_CTR_TM(r9)
-+ std r8, VCPU_AMR_TM(r9)
-+ std r10, VCPU_TAR_TM(r9)
-+
-+ /* Restore r12 as trap number. */
-+ lwz r12, VCPU_TRAP(r9)
-+
-+ /* Save FP/VSX. */
-+ addi r3, r9, VCPU_FPRS_TM
-+ bl store_fp_state
-+ addi r3, r9, VCPU_VRS_TM
-+ bl store_vr_state
-+ mfspr r6, SPRN_VRSAVE
-+ stw r6, VCPU_VRSAVE_TM(r9)
-+1:
-+ /*
-+ * We need to save these SPRs after the treclaim so that the software
-+ * error code is recorded correctly in the TEXASR. Also the user may
-+ * change these outside of a transaction, so they must always be
-+ * context switched.
-+ */
-+ mfspr r5, SPRN_TFHAR
-+ mfspr r6, SPRN_TFIAR
-+ mfspr r7, SPRN_TEXASR
-+ std r5, VCPU_TFHAR(r9)
-+ std r6, VCPU_TFIAR(r9)
-+ std r7, VCPU_TEXASR(r9)
-+
-+ ld r0, PPC_LR_STKOFF(r1)
-+ mtlr r0
-+ blr
-+
-+/*
-+ * Restore transactional state and TM-related registers.
-+ * Called with r4 pointing to the vcpu struct.
-+ * This potentially modifies all checkpointed registers.
-+ * It restores r1, r2, r4 from the PACA.
-+ */
-+kvmppc_restore_tm:
-+ mflr r0
-+ std r0, PPC_LR_STKOFF(r1)
-+
-+ /* Turn on TM/FP/VSX/VMX so we can restore them. */
-+ mfmsr r5
-+ li r6, MSR_TM >> 32
-+ sldi r6, r6, 32
-+ or r5, r5, r6
-+ ori r5, r5, MSR_FP
-+ oris r5, r5, (MSR_VEC | MSR_VSX)@h
-+ mtmsrd r5
-+
-+ /*
-+ * The user may change these outside of a transaction, so they must
-+ * always be context switched.
-+ */
-+ ld r5, VCPU_TFHAR(r4)
-+ ld r6, VCPU_TFIAR(r4)
-+ ld r7, VCPU_TEXASR(r4)
-+ mtspr SPRN_TFHAR, r5
-+ mtspr SPRN_TFIAR, r6
-+ mtspr SPRN_TEXASR, r7
-+
-+ ld r5, VCPU_MSR(r4)
-+ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-+ beqlr /* TM not active in guest */
-+ std r1, HSTATE_HOST_R1(r13)
-+
-+ /* Make sure the failure summary is set, otherwise we'll program check
-+ * when we trechkpt. It's possible that this might have been not set
-+ * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
-+ * host.
-+ */
-+ oris r7, r7, (TEXASR_FS)@h
-+ mtspr SPRN_TEXASR, r7
-+
-+ /*
-+ * We need to load up the checkpointed state for the guest.
-+ * We need to do this early as it will blow away any GPRs, VSRs and
-+ * some SPRs.
-+ */
-+
-+ mr r31, r4
-+ addi r3, r31, VCPU_FPRS_TM
-+ bl load_fp_state
-+ addi r3, r31, VCPU_VRS_TM
-+ bl load_vr_state
-+ mr r4, r31
-+ lwz r7, VCPU_VRSAVE_TM(r4)
-+ mtspr SPRN_VRSAVE, r7
-+
-+ ld r5, VCPU_LR_TM(r4)
-+ lwz r6, VCPU_CR_TM(r4)
-+ ld r7, VCPU_CTR_TM(r4)
-+ ld r8, VCPU_AMR_TM(r4)
-+ ld r9, VCPU_TAR_TM(r4)
-+ mtlr r5
-+ mtcr r6
-+ mtctr r7
-+ mtspr SPRN_AMR, r8
-+ mtspr SPRN_TAR, r9
-+
-+ /*
-+ * Load up PPR and DSCR values but don't put them in the actual SPRs
-+ * till the last moment to avoid running with userspace PPR and DSCR for
-+ * too long.
-+ */
-+ ld r29, VCPU_DSCR_TM(r4)
-+ ld r30, VCPU_PPR_TM(r4)
-+
-+ std r2, PACATMSCRATCH(r13) /* Save TOC */
-+
-+ /* Clear the MSR RI since r1, r13 are all going to be foobar. */
-+ li r5, 0
-+ mtmsrd r5, 1
-+
-+ /* Load GPRs r0-r28 */
-+ reg = 0
-+ .rept 29
-+ ld reg, VCPU_GPRS_TM(reg)(r31)
-+ reg = reg + 1
-+ .endr
-+
-+ mtspr SPRN_DSCR, r29
-+ mtspr SPRN_PPR, r30
-+
-+ /* Load final GPRs */
-+ ld 29, VCPU_GPRS_TM(29)(r31)
-+ ld 30, VCPU_GPRS_TM(30)(r31)
-+ ld 31, VCPU_GPRS_TM(31)(r31)
-+
-+ /* TM checkpointed state is now setup. All GPRs are now volatile. */
-+ TRECHKPT
-+
-+ /* Now let's get back the state we need. */
-+ HMT_MEDIUM
-+ GET_PACA(r13)
-+ ld r29, HSTATE_DSCR(r13)
-+ mtspr SPRN_DSCR, r29
-+ ld r4, HSTATE_KVM_VCPU(r13)
-+ ld r1, HSTATE_HOST_R1(r13)
-+ ld r2, PACATMSCRATCH(r13)
-+
-+ /* Set the MSR RI since we have our registers back. */
-+ li r5, MSR_RI
-+ mtmsrd r5, 1
-+
-+ ld r0, PPC_LR_STKOFF(r1)
-+ mtlr r0
-+ blr
-+#endif
-+
- /*
- * We come here if we get any exception or interrupt while we are
- * executing host real mode code while in guest MMU context.
-diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
-index 18d2beb..42b968a8 100644
---- a/arch/s390/include/asm/pgtable.h
-+++ b/arch/s390/include/asm/pgtable.h
-@@ -893,7 +893,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
- bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long address);
- int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
- unsigned char key, bool nq);
--unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr);
-+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr);
-
- /*
- * Certain architectures need to do special things when PTEs
-diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
-index a2e6ef3..0a20316 100644
---- a/arch/s390/include/asm/tlbflush.h
-+++ b/arch/s390/include/asm/tlbflush.h
-@@ -81,7 +81,8 @@ static inline void __tlb_flush_full(struct mm_struct *mm)
- }
-
- /*
-- * Flush TLB entries for a specific ASCE on all CPUs.
-+ * Flush TLB entries for a specific ASCE on all CPUs. Should never be used
-+ * when more than one asce (e.g. gmap) ran on this mm.
- */
- static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce)
- {
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index cace818..313c3b8 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -85,7 +85,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc);
- static void gmap_flush_tlb(struct gmap *gmap)
- {
- if (MACHINE_HAS_IDTE)
-- __tlb_flush_asce(gmap->mm, gmap->asce);
-+ __tlb_flush_idte(gmap->asce);
- else
- __tlb_flush_global();
- }
-@@ -124,7 +124,7 @@ void gmap_free(struct gmap *gmap)
-
- /* Flush tlb. */
- if (MACHINE_HAS_IDTE)
-- __tlb_flush_asce(gmap->mm, gmap->asce);
-+ __tlb_flush_idte(gmap->asce);
- else
- __tlb_flush_global();
-
-diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
-index 9f0ce0e..ebb4f87 100644
---- a/arch/s390/mm/pgtable.c
-+++ b/arch/s390/mm/pgtable.c
-@@ -543,7 +543,7 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
- }
- EXPORT_SYMBOL(set_guest_storage_key);
-
--unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr)
-+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr)
- {
- unsigned char key;
- spinlock_t *ptl;
-diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
-index 8acaf4e..a86d7cc 100644
---- a/arch/um/os-Linux/signal.c
-+++ b/arch/um/os-Linux/signal.c
-@@ -15,6 +15,7 @@
- #include <kern_util.h>
- #include <os.h>
- #include <sysdep/mcontext.h>
-+#include <um_malloc.h>
-
- void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = {
- [SIGTRAP] = relay_signal,
-@@ -32,7 +33,7 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
- struct uml_pt_regs *r;
- int save_errno = errno;
-
-- r = malloc(sizeof(struct uml_pt_regs));
-+ r = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC);
- if (!r)
- panic("out of memory");
-
-@@ -91,7 +92,7 @@ static void timer_real_alarm_handler(mcontext_t *mc)
- {
- struct uml_pt_regs *regs;
-
-- regs = malloc(sizeof(struct uml_pt_regs));
-+ regs = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC);
- if (!regs)
- panic("out of memory");
-
-diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h
-index e35632e..62dfc64 100644
---- a/arch/unicore32/include/asm/mmu_context.h
-+++ b/arch/unicore32/include/asm/mmu_context.h
-@@ -98,7 +98,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
- }
-
- static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
-- bool write, bool foreign)
-+ bool write, bool execute, bool foreign)
- {
- /* by default, allow everything */
- return true;
-diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
-index 874e8bd..bd136ac 100644
---- a/arch/x86/events/intel/uncore_snbep.c
-+++ b/arch/x86/events/intel/uncore_snbep.c
-@@ -2546,7 +2546,7 @@ void hswep_uncore_cpu_init(void)
-
- static struct intel_uncore_type hswep_uncore_ha = {
- .name = "ha",
-- .num_counters = 5,
-+ .num_counters = 4,
- .num_boxes = 2,
- .perf_ctr_bits = 48,
- SNBEP_UNCORE_PCI_COMMON_INIT(),
-@@ -2565,7 +2565,7 @@ static struct uncore_event_desc hswep_uncore_imc_events[] = {
-
- static struct intel_uncore_type hswep_uncore_imc = {
- .name = "imc",
-- .num_counters = 5,
-+ .num_counters = 4,
- .num_boxes = 8,
- .perf_ctr_bits = 48,
- .fixed_ctr_bits = 48,
-@@ -2611,7 +2611,7 @@ static struct intel_uncore_type hswep_uncore_irp = {
-
- static struct intel_uncore_type hswep_uncore_qpi = {
- .name = "qpi",
-- .num_counters = 5,
-+ .num_counters = 4,
- .num_boxes = 3,
- .perf_ctr_bits = 48,
- .perf_ctr = SNBEP_PCI_PMON_CTR0,
-@@ -2693,7 +2693,7 @@ static struct event_constraint hswep_uncore_r3qpi_constraints[] = {
-
- static struct intel_uncore_type hswep_uncore_r3qpi = {
- .name = "r3qpi",
-- .num_counters = 4,
-+ .num_counters = 3,
- .num_boxes = 3,
- .perf_ctr_bits = 44,
- .constraints = hswep_uncore_r3qpi_constraints,
-@@ -2892,7 +2892,7 @@ static struct intel_uncore_type bdx_uncore_ha = {
-
- static struct intel_uncore_type bdx_uncore_imc = {
- .name = "imc",
-- .num_counters = 5,
-+ .num_counters = 4,
- .num_boxes = 8,
- .perf_ctr_bits = 48,
- .fixed_ctr_bits = 48,
-diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
-index c146f3c..0149ac5 100644
---- a/arch/x86/kvm/mtrr.c
-+++ b/arch/x86/kvm/mtrr.c
-@@ -539,6 +539,7 @@ static void mtrr_lookup_var_start(struct mtrr_iter *iter)
-
- iter->fixed = false;
- iter->start_max = iter->start;
-+ iter->range = NULL;
- iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node);
-
- __mtrr_lookup_var_next(iter);
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 64a79f2..8326d68 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -8224,6 +8224,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
- if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
- (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
- exit_reason != EXIT_REASON_EPT_VIOLATION &&
-+ exit_reason != EXIT_REASON_PML_FULL &&
- exit_reason != EXIT_REASON_TASK_SWITCH)) {
- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
-@@ -8854,6 +8855,22 @@ static void vmx_load_vmcs01(struct kvm_vcpu *vcpu)
- put_cpu();
- }
-
-+/*
-+ * Ensure that the current vmcs of the logical processor is the
-+ * vmcs01 of the vcpu before calling free_nested().
-+ */
-+static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
-+{
-+ struct vcpu_vmx *vmx = to_vmx(vcpu);
-+ int r;
-+
-+ r = vcpu_load(vcpu);
-+ BUG_ON(r);
-+ vmx_load_vmcs01(vcpu);
-+ free_nested(vmx);
-+ vcpu_put(vcpu);
-+}
-+
- static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
- {
- struct vcpu_vmx *vmx = to_vmx(vcpu);
-@@ -8862,8 +8879,7 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
- vmx_destroy_pml_buffer(vmx);
- free_vpid(vmx->vpid);
- leave_guest_mode(vcpu);
-- vmx_load_vmcs01(vcpu);
-- free_nested(vmx);
-+ vmx_free_vcpu_nested(vcpu);
- free_loaded_vmcs(vmx->loaded_vmcs);
- kfree(vmx->guest_msrs);
- kvm_vcpu_uninit(vcpu);
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 7da5dd2..fea2c57 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -91,6 +91,7 @@ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
-
- static void update_cr8_intercept(struct kvm_vcpu *vcpu);
- static void process_nmi(struct kvm_vcpu *vcpu);
-+static void process_smi(struct kvm_vcpu *vcpu);
- static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
-
- struct kvm_x86_ops *kvm_x86_ops __read_mostly;
-@@ -5296,13 +5297,8 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu)
- /* This is a good place to trace that we are exiting SMM. */
- trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, false);
-
-- if (unlikely(vcpu->arch.smi_pending)) {
-- kvm_make_request(KVM_REQ_SMI, vcpu);
-- vcpu->arch.smi_pending = 0;
-- } else {
-- /* Process a latched INIT, if any. */
-- kvm_make_request(KVM_REQ_EVENT, vcpu);
-- }
-+ /* Process a latched INIT or SMI, if any. */
-+ kvm_make_request(KVM_REQ_EVENT, vcpu);
- }
-
- kvm_mmu_reset_context(vcpu);
-@@ -6102,7 +6098,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
- }
-
- /* try to inject new event if pending */
-- if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
-+ if (vcpu->arch.smi_pending && !is_smm(vcpu)) {
-+ vcpu->arch.smi_pending = false;
-+ process_smi(vcpu);
-+ } else if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
- --vcpu->arch.nmi_pending;
- vcpu->arch.nmi_injected = true;
- kvm_x86_ops->set_nmi(vcpu);
-@@ -6312,11 +6311,6 @@ static void process_smi(struct kvm_vcpu *vcpu)
- char buf[512];
- u32 cr0;
-
-- if (is_smm(vcpu)) {
-- vcpu->arch.smi_pending = true;
-- return;
-- }
--
- trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
- vcpu->arch.hflags |= HF_SMM_MASK;
- memset(buf, 0, 512);
-@@ -6379,6 +6373,12 @@ static void process_smi(struct kvm_vcpu *vcpu)
- kvm_mmu_reset_context(vcpu);
- }
-
-+static void process_smi_request(struct kvm_vcpu *vcpu)
-+{
-+ vcpu->arch.smi_pending = true;
-+ kvm_make_request(KVM_REQ_EVENT, vcpu);
-+}
-+
- void kvm_make_scan_ioapic_request(struct kvm *kvm)
- {
- kvm_make_all_cpus_request(kvm, KVM_REQ_SCAN_IOAPIC);
-@@ -6500,7 +6500,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
- if (kvm_check_request(KVM_REQ_STEAL_UPDATE, vcpu))
- record_steal_time(vcpu);
- if (kvm_check_request(KVM_REQ_SMI, vcpu))
-- process_smi(vcpu);
-+ process_smi_request(vcpu);
- if (kvm_check_request(KVM_REQ_NMI, vcpu))
- process_nmi(vcpu);
- if (kvm_check_request(KVM_REQ_PMU, vcpu))
-@@ -6573,8 +6573,18 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
-
- if (inject_pending_event(vcpu, req_int_win) != 0)
- req_immediate_exit = true;
-- /* enable NMI/IRQ window open exits if needed */
- else {
-+ /* Enable NMI/IRQ window open exits if needed.
-+ *
-+ * SMIs have two cases: 1) they can be nested, and
-+ * then there is nothing to do here because RSM will
-+ * cause a vmexit anyway; 2) or the SMI can be pending
-+ * because inject_pending_event has completed the
-+ * injection of an IRQ or NMI from the previous vmexit,
-+ * and then we request an immediate exit to inject the SMI.
-+ */
-+ if (vcpu->arch.smi_pending && !is_smm(vcpu))
-+ req_immediate_exit = true;
- if (vcpu->arch.nmi_pending)
- kvm_x86_ops->enable_nmi_window(vcpu);
- if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
-@@ -6625,8 +6635,10 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
-
- kvm_load_guest_xcr0(vcpu);
-
-- if (req_immediate_exit)
-+ if (req_immediate_exit) {
-+ kvm_make_request(KVM_REQ_EVENT, vcpu);
- smp_send_reschedule(vcpu->cpu);
-+ }
-
- trace_kvm_entry(vcpu->vcpu_id);
- wait_lapic_expire(vcpu);
-@@ -7427,6 +7439,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
- {
- vcpu->arch.hflags = 0;
-
-+ vcpu->arch.smi_pending = 0;
- atomic_set(&vcpu->arch.nmi_queued, 0);
- vcpu->arch.nmi_pending = 0;
- vcpu->arch.nmi_injected = false;
-diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
-index 8b93e63..ae97f24 100644
---- a/arch/x86/pci/intel_mid_pci.c
-+++ b/arch/x86/pci/intel_mid_pci.c
-@@ -37,6 +37,7 @@
-
- /* Quirks for the listed devices */
- #define PCI_DEVICE_ID_INTEL_MRFL_MMC 0x1190
-+#define PCI_DEVICE_ID_INTEL_MRFL_HSU 0x1191
-
- /* Fixed BAR fields */
- #define PCIE_VNDR_CAP_ID_FIXED_BAR 0x00 /* Fixed BAR (TBD) */
-@@ -225,13 +226,20 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
- /* Special treatment for IRQ0 */
- if (dev->irq == 0) {
- /*
-+ * Skip HS UART common registers device since it has
-+ * IRQ0 assigned and not used by the kernel.
-+ */
-+ if (dev->device == PCI_DEVICE_ID_INTEL_MRFL_HSU)
-+ return -EBUSY;
-+ /*
- * TNG has IRQ0 assigned to eMMC controller. But there
- * are also other devices with bogus PCI configuration
- * that have IRQ0 assigned. This check ensures that
-- * eMMC gets it.
-+ * eMMC gets it. The rest of devices still could be
-+ * enabled without interrupt line being allocated.
- */
- if (dev->device != PCI_DEVICE_ID_INTEL_MRFL_MMC)
-- return -EBUSY;
-+ return 0;
- }
- break;
- default:
-diff --git a/block/bio.c b/block/bio.c
-index 0e4aa42..4623869 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -579,6 +579,8 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
- bio->bi_rw = bio_src->bi_rw;
- bio->bi_iter = bio_src->bi_iter;
- bio->bi_io_vec = bio_src->bi_io_vec;
-+
-+ bio_clone_blkcg_association(bio, bio_src);
- }
- EXPORT_SYMBOL(__bio_clone_fast);
-
-@@ -684,6 +686,8 @@ integrity_clone:
- }
- }
-
-+ bio_clone_blkcg_association(bio, bio_src);
-+
- return bio;
- }
- EXPORT_SYMBOL(bio_clone_bioset);
-@@ -2005,6 +2009,17 @@ void bio_disassociate_task(struct bio *bio)
- }
- }
-
-+/**
-+ * bio_clone_blkcg_association - clone blkcg association from src to dst bio
-+ * @dst: destination bio
-+ * @src: source bio
-+ */
-+void bio_clone_blkcg_association(struct bio *dst, struct bio *src)
-+{
-+ if (src->bi_css)
-+ WARN_ON(bio_associate_blkcg(dst, src->bi_css));
-+}
-+
- #endif /* CONFIG_BLK_CGROUP */
-
- static void __init biovec_init_slabs(void)
-diff --git a/block/genhd.c b/block/genhd.c
-index 3eebd25..086f1a3 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -613,7 +613,7 @@ void add_disk(struct gendisk *disk)
-
- /* Register BDI before referencing it from bdev */
- bdi = &disk->queue->backing_dev_info;
-- bdi_register_dev(bdi, disk_devt(disk));
-+ bdi_register_owner(bdi, disk_to_dev(disk));
-
- blk_register_region(disk_devt(disk), disk->minors, NULL,
- exact_match, exact_lock, disk);
-diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index 290d6f5..f4218df 100644
---- a/drivers/acpi/ec.c
-+++ b/drivers/acpi/ec.c
-@@ -101,6 +101,7 @@ enum ec_command {
- #define ACPI_EC_UDELAY_POLL 550 /* Wait 1ms for EC transaction polling */
- #define ACPI_EC_CLEAR_MAX 100 /* Maximum number of events to query
- * when trying to clear the EC */
-+#define ACPI_EC_MAX_QUERIES 16 /* Maximum number of parallel queries */
-
- enum {
- EC_FLAGS_QUERY_PENDING, /* Query is pending */
-@@ -121,6 +122,10 @@ static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY;
- module_param(ec_delay, uint, 0644);
- MODULE_PARM_DESC(ec_delay, "Timeout(ms) waited until an EC command completes");
-
-+static unsigned int ec_max_queries __read_mostly = ACPI_EC_MAX_QUERIES;
-+module_param(ec_max_queries, uint, 0644);
-+MODULE_PARM_DESC(ec_max_queries, "Maximum parallel _Qxx evaluations");
-+
- static bool ec_busy_polling __read_mostly;
- module_param(ec_busy_polling, bool, 0644);
- MODULE_PARM_DESC(ec_busy_polling, "Use busy polling to advance EC transaction");
-@@ -174,6 +179,7 @@ static void acpi_ec_event_processor(struct work_struct *work);
-
- struct acpi_ec *boot_ec, *first_ec;
- EXPORT_SYMBOL(first_ec);
-+static struct workqueue_struct *ec_query_wq;
-
- static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
- static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
-@@ -1098,7 +1104,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
- * work queue execution.
- */
- ec_dbg_evt("Query(0x%02x) scheduled", value);
-- if (!schedule_work(&q->work)) {
-+ if (!queue_work(ec_query_wq, &q->work)) {
- ec_dbg_evt("Query(0x%02x) overlapped", value);
- result = -EBUSY;
- }
-@@ -1660,15 +1666,41 @@ static struct acpi_driver acpi_ec_driver = {
- },
- };
-
-+static inline int acpi_ec_query_init(void)
-+{
-+ if (!ec_query_wq) {
-+ ec_query_wq = alloc_workqueue("kec_query", 0,
-+ ec_max_queries);
-+ if (!ec_query_wq)
-+ return -ENODEV;
-+ }
-+ return 0;
-+}
-+
-+static inline void acpi_ec_query_exit(void)
-+{
-+ if (ec_query_wq) {
-+ destroy_workqueue(ec_query_wq);
-+ ec_query_wq = NULL;
-+ }
-+}
-+
- int __init acpi_ec_init(void)
- {
-- int result = 0;
-+ int result;
-
-+ /* register workqueue for _Qxx evaluations */
-+ result = acpi_ec_query_init();
-+ if (result)
-+ goto err_exit;
- /* Now register the driver for the EC */
- result = acpi_bus_register_driver(&acpi_ec_driver);
-- if (result < 0)
-- return -ENODEV;
-+ if (result)
-+ goto err_exit;
-
-+err_exit:
-+ if (result)
-+ acpi_ec_query_exit();
- return result;
- }
-
-@@ -1678,5 +1710,6 @@ static void __exit acpi_ec_exit(void)
- {
-
- acpi_bus_unregister_driver(&acpi_ec_driver);
-+ acpi_ec_query_exit();
- }
- #endif /* 0 */
-diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
-index cae5385..bd46569 100644
---- a/drivers/bcma/host_pci.c
-+++ b/drivers/bcma/host_pci.c
-@@ -295,6 +295,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
- { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
- { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
- { PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
-+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_FOXCONN, 0xe092) },
- { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
- { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
- { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 84708a5..a1dcf12 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
-
- opened_bdev[drive] = bdev;
-
-- if (!(mode & (FMODE_READ|FMODE_WRITE))) {
-- res = -EINVAL;
-- goto out;
-- }
--
- res = -ENXIO;
-
- if (!floppy_track_buffer) {
-@@ -3711,13 +3706,15 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- if (UFDCS->rawcmd == 1)
- UFDCS->rawcmd = 2;
-
-- UDRS->last_checked = 0;
-- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-- check_disk_change(bdev);
-- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-- goto out;
-- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-- goto out;
-+ if (mode & (FMODE_READ|FMODE_WRITE)) {
-+ UDRS->last_checked = 0;
-+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+ check_disk_change(bdev);
-+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+ goto out;
-+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+ goto out;
-+ }
-
- res = -EROFS;
-
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 2589468..fadba88 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -123,6 +123,7 @@ static const struct usb_device_id ath3k_table[] = {
- { USB_DEVICE(0x13d3, 0x3472) },
- { USB_DEVICE(0x13d3, 0x3474) },
- { USB_DEVICE(0x13d3, 0x3487) },
-+ { USB_DEVICE(0x13d3, 0x3490) },
-
- /* Atheros AR5BBU12 with sflash firmware */
- { USB_DEVICE(0x0489, 0xE02C) },
-@@ -190,6 +191,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
- { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
-+ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
-
- /* Atheros AR5BBU22 with sflash firmware */
- { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index a3be65e..9f40c34 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -237,6 +237,7 @@ static const struct usb_device_id blacklist_table[] = {
- { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
-+ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
-
- /* Atheros AR5BBU12 with sflash firmware */
- { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 87ab9f6..d72c6d1 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -949,6 +949,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
- /* award one bit for the contents of the fast pool */
- credit_entropy_bits(r, credit + 1);
- }
-+EXPORT_SYMBOL_GPL(add_interrupt_randomness);
-
- #ifdef CONFIG_BLOCK
- void add_disk_randomness(struct gendisk *disk)
-@@ -1461,12 +1462,16 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
- static ssize_t
- urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
- {
-+ static int maxwarn = 10;
- int ret;
-
-- if (unlikely(nonblocking_pool.initialized == 0))
-- printk_once(KERN_NOTICE "random: %s urandom read "
-- "with %d bits of entropy available\n",
-- current->comm, nonblocking_pool.entropy_total);
-+ if (unlikely(nonblocking_pool.initialized == 0) &&
-+ maxwarn > 0) {
-+ maxwarn--;
-+ printk(KERN_NOTICE "random: %s: uninitialized urandom read "
-+ "(%zd bytes read, %d bits of entropy available)\n",
-+ current->comm, nbytes, nonblocking_pool.entropy_total);
-+ }
-
- nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
- ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
-@@ -1774,13 +1779,15 @@ int random_int_secret_init(void)
- return 0;
- }
-
-+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-+ __aligned(sizeof(unsigned long));
-+
- /*
- * Get a random word for internal kernel use only. Similar to urandom but
- * with the goal of minimal entropy pool depletion. As a result, the random
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
- */
--static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
- unsigned int get_random_int(void)
- {
- __u32 *hash;
-@@ -1850,12 +1857,18 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
- {
- struct entropy_store *poolp = &input_pool;
-
-- /* Suspend writing if we're above the trickle threshold.
-- * We'll be woken up again once below random_write_wakeup_thresh,
-- * or when the calling thread is about to terminate.
-- */
-- wait_event_interruptible(random_write_wait, kthread_should_stop() ||
-+ if (unlikely(nonblocking_pool.initialized == 0))
-+ poolp = &nonblocking_pool;
-+ else {
-+ /* Suspend writing if we're above the trickle
-+ * threshold. We'll be woken up again once below
-+ * random_write_wakeup_thresh, or when the calling
-+ * thread is about to terminate.
-+ */
-+ wait_event_interruptible(random_write_wait,
-+ kthread_should_stop() ||
- ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
-+ }
- mix_pool_bytes(poolp, buffer, count);
- credit_entropy_bits(poolp, entropy);
- }
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index a12b319..e9fd1d8 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -246,7 +246,7 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
-
- /* Detect a 64 bit address on a 32 bit system */
- if (start != new_res.start)
-- return ERR_PTR(-EINVAL);
-+ return (void __iomem *) ERR_PTR(-EINVAL);
-
- if (!resource_contains(&priv->res, &new_res))
- return devm_ioremap_resource(dev, &new_res);
-diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
-index 8059a8d..31b77f7 100644
---- a/drivers/clk/rockchip/clk-rk3399.c
-+++ b/drivers/clk/rockchip/clk-rk3399.c
-@@ -586,7 +586,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
- RK3399_CLKGATE_CON(8), 15, GFLAGS),
-
- COMPOSITE(SCLK_SPDIF_REC_DPTX, "clk_spdif_rec_dptx", mux_pll_src_cpll_gpll_p, 0,
-- RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 0, 5, DFLAGS,
-+ RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 8, 5, DFLAGS,
- RK3399_CLKGATE_CON(10), 6, GFLAGS),
- /* i2s */
- COMPOSITE(0, "clk_i2s0_div", mux_pll_src_cpll_gpll_p, 0,
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 1fa1a32..1b15917 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -944,7 +944,7 @@ static int core_get_max_pstate(void)
- if (err)
- goto skip_tar;
-
-- tdp_msr = MSR_CONFIG_TDP_NOMINAL + tdp_ctrl;
-+ tdp_msr = MSR_CONFIG_TDP_NOMINAL + (tdp_ctrl & 0x3);
- err = rdmsrl_safe(tdp_msr, &tdp_ratio);
- if (err)
- goto skip_tar;
-diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
-index 10c305b..4e0f8e7 100644
---- a/drivers/edac/edac_mc_sysfs.c
-+++ b/drivers/edac/edac_mc_sysfs.c
-@@ -313,7 +313,6 @@ static struct device_type csrow_attr_type = {
- * possible dynamic channel DIMM Label attribute files
- *
- */
--
- DEVICE_CHANNEL(ch0_dimm_label, S_IRUGO | S_IWUSR,
- channel_dimm_label_show, channel_dimm_label_store, 0);
- DEVICE_CHANNEL(ch1_dimm_label, S_IRUGO | S_IWUSR,
-@@ -326,6 +325,10 @@ DEVICE_CHANNEL(ch4_dimm_label, S_IRUGO | S_IWUSR,
- channel_dimm_label_show, channel_dimm_label_store, 4);
- DEVICE_CHANNEL(ch5_dimm_label, S_IRUGO | S_IWUSR,
- channel_dimm_label_show, channel_dimm_label_store, 5);
-+DEVICE_CHANNEL(ch6_dimm_label, S_IRUGO | S_IWUSR,
-+ channel_dimm_label_show, channel_dimm_label_store, 6);
-+DEVICE_CHANNEL(ch7_dimm_label, S_IRUGO | S_IWUSR,
-+ channel_dimm_label_show, channel_dimm_label_store, 7);
-
- /* Total possible dynamic DIMM Label attribute file table */
- static struct attribute *dynamic_csrow_dimm_attr[] = {
-@@ -335,6 +338,8 @@ static struct attribute *dynamic_csrow_dimm_attr[] = {
- &dev_attr_legacy_ch3_dimm_label.attr.attr,
- &dev_attr_legacy_ch4_dimm_label.attr.attr,
- &dev_attr_legacy_ch5_dimm_label.attr.attr,
-+ &dev_attr_legacy_ch6_dimm_label.attr.attr,
-+ &dev_attr_legacy_ch7_dimm_label.attr.attr,
- NULL
- };
-
-@@ -351,6 +356,10 @@ DEVICE_CHANNEL(ch4_ce_count, S_IRUGO,
- channel_ce_count_show, NULL, 4);
- DEVICE_CHANNEL(ch5_ce_count, S_IRUGO,
- channel_ce_count_show, NULL, 5);
-+DEVICE_CHANNEL(ch6_ce_count, S_IRUGO,
-+ channel_ce_count_show, NULL, 6);
-+DEVICE_CHANNEL(ch7_ce_count, S_IRUGO,
-+ channel_ce_count_show, NULL, 7);
-
- /* Total possible dynamic ce_count attribute file table */
- static struct attribute *dynamic_csrow_ce_count_attr[] = {
-@@ -360,6 +369,8 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = {
- &dev_attr_legacy_ch3_ce_count.attr.attr,
- &dev_attr_legacy_ch4_ce_count.attr.attr,
- &dev_attr_legacy_ch5_ce_count.attr.attr,
-+ &dev_attr_legacy_ch6_ce_count.attr.attr,
-+ &dev_attr_legacy_ch7_ce_count.attr.attr,
- NULL
- };
-
-@@ -371,9 +382,16 @@ static umode_t csrow_dev_is_visible(struct kobject *kobj,
-
- if (idx >= csrow->nr_channels)
- return 0;
-+
-+ if (idx >= ARRAY_SIZE(dynamic_csrow_ce_count_attr) - 1) {
-+ WARN_ONCE(1, "idx: %d\n", idx);
-+ return 0;
-+ }
-+
- /* Only expose populated DIMMs */
- if (!csrow->channels[idx]->dimm->nr_pages)
- return 0;
-+
- return attr->mode;
- }
-
-diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c
-index cdaba13..c0f7cce 100644
---- a/drivers/gpio/gpio-intel-mid.c
-+++ b/drivers/gpio/gpio-intel-mid.c
-@@ -17,7 +17,6 @@
- * Moorestown platform Langwell chip.
- * Medfield platform Penwell chip.
- * Clovertrail platform Cloverview chip.
-- * Merrifield platform Tangier chip.
- */
-
- #include <linux/module.h>
-@@ -64,10 +63,6 @@ enum GPIO_REG {
- /* intel_mid gpio driver data */
- struct intel_mid_gpio_ddata {
- u16 ngpio; /* number of gpio pins */
-- u32 gplr_offset; /* offset of first GPLR register from base */
-- u32 flis_base; /* base address of FLIS registers */
-- u32 flis_len; /* length of FLIS registers */
-- u32 (*get_flis_offset)(int gpio);
- u32 chip_irq_type; /* chip interrupt type */
- };
-
-@@ -252,15 +247,6 @@ static const struct intel_mid_gpio_ddata gpio_cloverview_core = {
- .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
- };
-
--static const struct intel_mid_gpio_ddata gpio_tangier = {
-- .ngpio = 192,
-- .gplr_offset = 4,
-- .flis_base = 0xff0c0000,
-- .flis_len = 0x8000,
-- .get_flis_offset = NULL,
-- .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
--};
--
- static const struct pci_device_id intel_gpio_ids[] = {
- {
- /* Lincroft */
-@@ -287,11 +273,6 @@ static const struct pci_device_id intel_gpio_ids[] = {
- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x08f7),
- .driver_data = (kernel_ulong_t)&gpio_cloverview_core,
- },
-- {
-- /* Tangier */
-- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1199),
-- .driver_data = (kernel_ulong_t)&gpio_tangier,
-- },
- { 0 }
- };
- MODULE_DEVICE_TABLE(pci, intel_gpio_ids);
-@@ -401,7 +382,7 @@ static int intel_gpio_probe(struct pci_dev *pdev,
- spin_lock_init(&priv->lock);
-
- pci_set_drvdata(pdev, priv);
-- retval = gpiochip_add_data(&priv->chip, priv);
-+ retval = devm_gpiochip_add_data(&pdev->dev, &priv->chip, priv);
- if (retval) {
- dev_err(&pdev->dev, "gpiochip_add error %d\n", retval);
- return retval;
-diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
-index 5e3be32..3745de6 100644
---- a/drivers/gpio/gpio-pca953x.c
-+++ b/drivers/gpio/gpio-pca953x.c
-@@ -90,7 +90,7 @@ MODULE_DEVICE_TABLE(acpi, pca953x_acpi_ids);
- #define MAX_BANK 5
- #define BANK_SZ 8
-
--#define NBANK(chip) (chip->gpio_chip.ngpio / BANK_SZ)
-+#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ)
-
- struct pca953x_chip {
- unsigned gpio_start;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-index 9df1bcb..9831753 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-@@ -551,28 +551,19 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev)
- le16_to_cpu(firmware_info->info.usReferenceClock);
- ppll->reference_div = 0;
-
-- if (crev < 2)
-- ppll->pll_out_min =
-- le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
-- else
-- ppll->pll_out_min =
-- le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output);
-+ ppll->pll_out_min =
-+ le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output);
- ppll->pll_out_max =
- le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
-
-- if (crev >= 4) {
-- ppll->lcd_pll_out_min =
-- le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
-- if (ppll->lcd_pll_out_min == 0)
-- ppll->lcd_pll_out_min = ppll->pll_out_min;
-- ppll->lcd_pll_out_max =
-- le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100;
-- if (ppll->lcd_pll_out_max == 0)
-- ppll->lcd_pll_out_max = ppll->pll_out_max;
-- } else {
-+ ppll->lcd_pll_out_min =
-+ le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
-+ if (ppll->lcd_pll_out_min == 0)
- ppll->lcd_pll_out_min = ppll->pll_out_min;
-+ ppll->lcd_pll_out_max =
-+ le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100;
-+ if (ppll->lcd_pll_out_max == 0)
- ppll->lcd_pll_out_max = ppll->pll_out_max;
-- }
-
- if (ppll->pll_out_min == 0)
- ppll->pll_out_min = 64800;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-index 35a1248..1b4c069 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-@@ -10,6 +10,7 @@
- #include <linux/slab.h>
- #include <linux/acpi.h>
- #include <linux/pci.h>
-+#include <linux/delay.h>
-
- #include "amd_acpi.h"
-
-@@ -259,6 +260,10 @@ static int amdgpu_atpx_set_discrete_state(struct amdgpu_atpx *atpx, u8 state)
- if (!info)
- return -EIO;
- kfree(info);
-+
-+ /* 200ms delay is required after off */
-+ if (state == 0)
-+ msleep(200);
- }
- return 0;
- }
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-index cb07da4..ff0b55a 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-@@ -1690,7 +1690,6 @@ amdgpu_connector_add(struct amdgpu_device *adev,
- DRM_MODE_SCALE_NONE);
- /* no HPD on analog connectors */
- amdgpu_connector->hpd.hpd = AMDGPU_HPD_NONE;
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- connector->interlace_allowed = true;
- connector->doublescan_allowed = true;
- break;
-@@ -1893,8 +1892,10 @@ amdgpu_connector_add(struct amdgpu_device *adev,
- }
-
- if (amdgpu_connector->hpd.hpd == AMDGPU_HPD_NONE) {
-- if (i2c_bus->valid)
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+ if (i2c_bus->valid) {
-+ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+ DRM_CONNECTOR_POLL_DISCONNECT;
-+ }
- } else
- connector->polled = DRM_CONNECTOR_POLL_HPD;
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-index 6e92008..b7f5650 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-@@ -1841,7 +1841,23 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
- }
-
- drm_kms_helper_poll_enable(dev);
-+
-+ /*
-+ * Most of the connector probing functions try to acquire runtime pm
-+ * refs to ensure that the GPU is powered on when connector polling is
-+ * performed. Since we're calling this from a runtime PM callback,
-+ * trying to acquire rpm refs will cause us to deadlock.
-+ *
-+ * Since we're guaranteed to be holding the rpm lock, it's safe to
-+ * temporarily disable the rpm helpers so this doesn't deadlock us.
-+ */
-+#ifdef CONFIG_PM
-+ dev->dev->power.disable_depth++;
-+#endif
- drm_helper_hpd_irq_event(dev);
-+#ifdef CONFIG_PM
-+ dev->dev->power.disable_depth--;
-+#endif
-
- if (fbcon) {
- amdgpu_fbdev_set_suspend(adev, 0);
-diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-index 48b6bd6..c32eca2 100644
---- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-@@ -98,6 +98,7 @@ amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encode
- case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
- case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
- if (dig->backlight_level == 0)
- amdgpu_atombios_encoder_setup_dig_transmitter(encoder,
- ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0);
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-index 1feb643..9269548 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-@@ -167,6 +167,7 @@ static int gmc_v7_0_init_microcode(struct amdgpu_device *adev)
- break;
- case CHIP_KAVERI:
- case CHIP_KABINI:
-+ case CHIP_MULLINS:
- return 0;
- default: BUG();
- }
-diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-index 90b35c5..ffc7c0d 100644
---- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-@@ -592,12 +592,12 @@ bool atomctrl_get_pp_assign_pin(
- const uint32_t pinId,
- pp_atomctrl_gpio_pin_assignment *gpio_pin_assignment)
- {
-- bool bRet = 0;
-+ bool bRet = false;
- ATOM_GPIO_PIN_LUT *gpio_lookup_table =
- get_gpio_lookup_table(hwmgr->device);
-
- PP_ASSERT_WITH_CODE((NULL != gpio_lookup_table),
-- "Could not find GPIO lookup Table in BIOS.", return -1);
-+ "Could not find GPIO lookup Table in BIOS.", return false);
-
- bRet = atomctrl_lookup_gpio_pin(gpio_lookup_table, pinId,
- gpio_pin_assignment);
-diff --git a/drivers/gpu/drm/drm_cache.c b/drivers/gpu/drm/drm_cache.c
-index 059f7c3..a7916e5 100644
---- a/drivers/gpu/drm/drm_cache.c
-+++ b/drivers/gpu/drm/drm_cache.c
-@@ -136,6 +136,7 @@ drm_clflush_virt_range(void *addr, unsigned long length)
- mb();
- for (; addr < end; addr += size)
- clflushopt(addr);
-+ clflushopt(end - 1); /* force serialisation */
- mb();
- return;
- }
-diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
-index eeaf5a7..67b28f8 100644
---- a/drivers/gpu/drm/drm_dp_helper.c
-+++ b/drivers/gpu/drm/drm_dp_helper.c
-@@ -203,7 +203,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
-
- ret = aux->transfer(aux, &msg);
-
-- if (ret > 0) {
-+ if (ret >= 0) {
- native_reply = msg.reply & DP_AUX_NATIVE_REPLY_MASK;
- if (native_reply == DP_AUX_NATIVE_REPLY_ACK) {
- if (ret == size)
-diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
-index 7df26d4..2cb472b 100644
---- a/drivers/gpu/drm/drm_edid.c
-+++ b/drivers/gpu/drm/drm_edid.c
-@@ -74,6 +74,8 @@
- #define EDID_QUIRK_FORCE_8BPC (1 << 8)
- /* Force 12bpc */
- #define EDID_QUIRK_FORCE_12BPC (1 << 9)
-+/* Force 6bpc */
-+#define EDID_QUIRK_FORCE_6BPC (1 << 10)
-
- struct detailed_mode_closure {
- struct drm_connector *connector;
-@@ -100,6 +102,9 @@ static struct edid_quirk {
- /* Unknown Acer */
- { "ACR", 2423, EDID_QUIRK_FIRST_DETAILED_PREFERRED },
-
-+ /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
-+ { "AEO", 0, EDID_QUIRK_FORCE_6BPC },
-+
- /* Belinea 10 15 55 */
- { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
- { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
-@@ -4082,6 +4087,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
-
- drm_add_display_info(edid, &connector->display_info, connector);
-
-+ if (quirks & EDID_QUIRK_FORCE_6BPC)
-+ connector->display_info.bpc = 6;
-+
- if (quirks & EDID_QUIRK_FORCE_8BPC)
- connector->display_info.bpc = 8;
-
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index bc3f2e6..227a63e 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -2591,6 +2591,8 @@ struct drm_i915_cmd_table {
- #define SKL_REVID_D0 0x3
- #define SKL_REVID_E0 0x4
- #define SKL_REVID_F0 0x5
-+#define SKL_REVID_G0 0x6
-+#define SKL_REVID_H0 0x7
-
- #define IS_SKL_REVID(p, since, until) (IS_SKYLAKE(p) && IS_REVID(p, since, until))
-
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 3fcf7dd..bc3b6dd 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -1672,6 +1672,9 @@ enum skl_disp_power_wells {
-
- #define GEN7_TLB_RD_ADDR _MMIO(0x4700)
-
-+#define GEN9_GAMT_ECO_REG_RW_IA _MMIO(0x4ab0)
-+#define GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS (1<<18)
-+
- #define GAMT_CHKN_BIT_REG _MMIO(0x4ab8)
- #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1<<28)
-
-@@ -7538,6 +7541,8 @@ enum skl_disp_power_wells {
-
- #define CDCLK_FREQ _MMIO(0x46200)
-
-+#define CDCLK_FREQ _MMIO(0x46200)
-+
- #define _TRANSA_MSA_MISC 0x60410
- #define _TRANSB_MSA_MISC 0x61410
- #define _TRANSC_MSA_MISC 0x62410
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 3074c56..3289319 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -9700,6 +9700,8 @@ static void broadwell_set_cdclk(struct drm_device *dev, int cdclk)
-
- I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1);
-
-+ I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1);
-+
- intel_update_cdclk(dev);
-
- WARN(cdclk != dev_priv->cdclk_freq,
-@@ -12095,21 +12097,11 @@ connected_sink_compute_bpp(struct intel_connector *connector,
- pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
- }
-
-- /* Clamp bpp to default limit on screens without EDID 1.4 */
-- if (connector->base.display_info.bpc == 0) {
-- int type = connector->base.connector_type;
-- int clamp_bpp = 24;
--
-- /* Fall back to 18 bpp when DP sink capability is unknown. */
-- if (type == DRM_MODE_CONNECTOR_DisplayPort ||
-- type == DRM_MODE_CONNECTOR_eDP)
-- clamp_bpp = 18;
--
-- if (bpp > clamp_bpp) {
-- DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
-- bpp, clamp_bpp);
-- pipe_config->pipe_bpp = clamp_bpp;
-- }
-+ /* Clamp bpp to 8 on screens without EDID 1.4 */
-+ if (connector->base.display_info.bpc == 0 && bpp > 24) {
-+ DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
-+ bpp);
-+ pipe_config->pipe_bpp = 24;
- }
- }
-
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index 2863b92..c1ca5a7 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -4563,7 +4563,8 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
- else
- gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq);
- dev_priv->rps.last_adj = 0;
-- I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
-+ I915_WRITE(GEN6_PMINTRMSK,
-+ gen6_sanitize_rps_pm_mask(dev_priv, ~0));
- }
- mutex_unlock(&dev_priv->rps.hw_lock);
-
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
-index 68c5af0..9d778f3 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.c
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
-@@ -1135,6 +1135,11 @@ static int skl_init_workarounds(struct intel_engine_cs *engine)
- /* WaDisableGafsUnitClkGating:skl */
- WA_SET_BIT(GEN7_UCGCTL4, GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
-
-+ /* WaInPlaceDecompressionHang:skl */
-+ if (IS_SKL_REVID(dev_priv, SKL_REVID_H0, REVID_FOREVER))
-+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- /* WaDisableLSQCROPERFforOCL:skl */
- ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
- if (ret)
-@@ -1194,6 +1199,11 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
- WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
- GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
-
-+ /* WaInPlaceDecompressionHang:bxt */
-+ if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER))
-+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- return 0;
- }
-
-@@ -1241,6 +1251,10 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
- GEN7_HALF_SLICE_CHICKEN1,
- GEN7_SBE_SS_CACHE_DISPATCH_PORT_SHARING_DISABLE);
-
-+ /* WaInPlaceDecompressionHang:kbl */
-+ WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+ GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- /* WaDisableLSQCROPERFforOCL:kbl */
- ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
- if (ret)
-diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
-index 11f8dd9..d6c134b 100644
---- a/drivers/gpu/drm/nouveau/nouveau_drm.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
-@@ -324,7 +324,16 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
- !vga_switcheroo_handler_flags())
- return -EPROBE_DEFER;
-
-- /* remove conflicting drivers (vesafb, efifb etc) */
-+ /* We need to check that the chipset is supported before booting
-+ * fbdev off the hardware, as there's no way to put it back.
-+ */
-+ ret = nvkm_device_pci_new(pdev, NULL, "error", true, false, 0, &device);
-+ if (ret)
-+ return ret;
-+
-+ nvkm_device_del(&device);
-+
-+ /* Remove conflicting drivers (vesafb, efifb etc). */
- aper = alloc_apertures(3);
- if (!aper)
- return -ENOMEM;
-diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-index 7d9248b..da8fd5f 100644
---- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- ((image->dx + image->width) & 0xffff));
- OUT_RING(chan, bg);
- OUT_RING(chan, fg);
-- OUT_RING(chan, (image->height << 16) | image->width);
-+ OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8));
- OUT_RING(chan, (image->height << 16) | image->width);
- OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
-
-- dsize = ALIGN(image->width * image->height, 32) >> 5;
-+ dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- while (dsize) {
- int iter_len = dsize > 128 ? 128 : dsize;
-
-diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-index 1aeb698..af3d3c4 100644
---- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- OUT_RING(chan, 0);
- OUT_RING(chan, image->dy);
-
-- dwords = ALIGN(image->width * image->height, 32) >> 5;
-+ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- while (dwords) {
- int push = dwords > 2047 ? 2047 : dwords;
-
-diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-index 839f4c8..054b6a0 100644
---- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- OUT_RING (chan, 0);
- OUT_RING (chan, image->dy);
-
-- dwords = ALIGN(image->width * image->height, 32) >> 5;
-+ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- while (dwords) {
- int push = dwords > 2047 ? 2047 : dwords;
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-index 69de8c6..f1e15a4 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-@@ -76,8 +76,8 @@ nv30_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch,
- nvkm_wo32(chan->inst, i, 0x00040004);
- for (i = 0x1f18; i <= 0x3088 ; i += 16) {
- nvkm_wo32(chan->inst, i + 0, 0x10700ff9);
-- nvkm_wo32(chan->inst, i + 1, 0x0436086c);
-- nvkm_wo32(chan->inst, i + 2, 0x000c001b);
-+ nvkm_wo32(chan->inst, i + 4, 0x0436086c);
-+ nvkm_wo32(chan->inst, i + 8, 0x000c001b);
- }
- for (i = 0x30b8; i < 0x30c8; i += 4)
- nvkm_wo32(chan->inst, i, 0x0000ffff);
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-index 2207dac2..300f5ed 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-@@ -75,8 +75,8 @@ nv34_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch,
- nvkm_wo32(chan->inst, i, 0x00040004);
- for (i = 0x15ac; i <= 0x271c ; i += 16) {
- nvkm_wo32(chan->inst, i + 0, 0x10700ff9);
-- nvkm_wo32(chan->inst, i + 1, 0x0436086c);
-- nvkm_wo32(chan->inst, i + 2, 0x000c001b);
-+ nvkm_wo32(chan->inst, i + 4, 0x0436086c);
-+ nvkm_wo32(chan->inst, i + 8, 0x000c001b);
- }
- for (i = 0x274c; i < 0x275c; i += 4)
- nvkm_wo32(chan->inst, i, 0x0000ffff);
-diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 587cae4..56bb758 100644
---- a/drivers/gpu/drm/radeon/atombios_encoders.c
-+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
-@@ -120,6 +120,7 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level)
- case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
- case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
- if (dig->backlight_level == 0)
- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0);
- else {
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index f8097a0..5df3ec7 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -1155,7 +1155,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
- le16_to_cpu(firmware_info->info.usReferenceClock);
- p1pll->reference_div = 0;
-
-- if (crev < 2)
-+ if ((frev < 2) && (crev < 2))
- p1pll->pll_out_min =
- le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
- else
-@@ -1164,7 +1164,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
- p1pll->pll_out_max =
- le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
-
-- if (crev >= 4) {
-+ if (((frev < 2) && (crev >= 4)) || (frev >= 2)) {
- p1pll->lcd_pll_out_min =
- le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
- if (p1pll->lcd_pll_out_min == 0)
-diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-index 95f4fea..1b3f4e5 100644
---- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-@@ -10,6 +10,7 @@
- #include <linux/slab.h>
- #include <linux/acpi.h>
- #include <linux/pci.h>
-+#include <linux/delay.h>
-
- #include "radeon_acpi.h"
-
-@@ -258,6 +259,10 @@ static int radeon_atpx_set_discrete_state(struct radeon_atpx *atpx, u8 state)
- if (!info)
- return -EIO;
- kfree(info);
-+
-+ /* 200ms delay is required after off */
-+ if (state == 0)
-+ msleep(200);
- }
- return 0;
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 81a63d7..b79f3b0 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -2064,7 +2064,6 @@ radeon_add_atom_connector(struct drm_device *dev,
- RADEON_OUTPUT_CSC_BYPASS);
- /* no HPD on analog connectors */
- radeon_connector->hpd.hpd = RADEON_HPD_NONE;
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- connector->interlace_allowed = true;
- connector->doublescan_allowed = true;
- break;
-@@ -2314,8 +2313,10 @@ radeon_add_atom_connector(struct drm_device *dev,
- }
-
- if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
-- if (i2c_bus->valid)
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+ if (i2c_bus->valid) {
-+ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+ DRM_CONNECTOR_POLL_DISCONNECT;
-+ }
- } else
- connector->polled = DRM_CONNECTOR_POLL_HPD;
-
-@@ -2391,7 +2392,6 @@ radeon_add_legacy_connector(struct drm_device *dev,
- 1);
- /* no HPD on analog connectors */
- radeon_connector->hpd.hpd = RADEON_HPD_NONE;
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- connector->interlace_allowed = true;
- connector->doublescan_allowed = true;
- break;
-@@ -2476,10 +2476,13 @@ radeon_add_legacy_connector(struct drm_device *dev,
- }
-
- if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
-- if (i2c_bus->valid)
-- connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+ if (i2c_bus->valid) {
-+ connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+ DRM_CONNECTOR_POLL_DISCONNECT;
-+ }
- } else
- connector->polled = DRM_CONNECTOR_POLL_HPD;
-+
- connector->display_info.subpixel_order = subpixel_order;
- drm_connector_register(connector);
- }
-diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-index 1c4d5b5..b167323 100644
---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-@@ -1048,6 +1048,17 @@ static void vop_crtc_destroy(struct drm_crtc *crtc)
- drm_crtc_cleanup(crtc);
- }
-
-+static void vop_crtc_reset(struct drm_crtc *crtc)
-+{
-+ if (crtc->state)
-+ __drm_atomic_helper_crtc_destroy_state(crtc->state);
-+ kfree(crtc->state);
-+
-+ crtc->state = kzalloc(sizeof(struct rockchip_crtc_state), GFP_KERNEL);
-+ if (crtc->state)
-+ crtc->state->crtc = crtc;
-+}
-+
- static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc)
- {
- struct rockchip_crtc_state *rockchip_state;
-@@ -1073,7 +1084,7 @@ static const struct drm_crtc_funcs vop_crtc_funcs = {
- .set_config = drm_atomic_helper_set_config,
- .page_flip = drm_atomic_helper_page_flip,
- .destroy = vop_crtc_destroy,
-- .reset = drm_atomic_helper_crtc_reset,
-+ .reset = vop_crtc_reset,
- .atomic_duplicate_state = vop_crtc_duplicate_state,
- .atomic_destroy_state = vop_crtc_destroy_state,
- };
-diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
-index 16b6f11..99ec3ff 100644
---- a/drivers/hid/uhid.c
-+++ b/drivers/hid/uhid.c
-@@ -51,10 +51,26 @@ struct uhid_device {
- u32 report_id;
- u32 report_type;
- struct uhid_event report_buf;
-+ struct work_struct worker;
- };
-
- static struct miscdevice uhid_misc;
-
-+static void uhid_device_add_worker(struct work_struct *work)
-+{
-+ struct uhid_device *uhid = container_of(work, struct uhid_device, worker);
-+ int ret;
-+
-+ ret = hid_add_device(uhid->hid);
-+ if (ret) {
-+ hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
-+
-+ hid_destroy_device(uhid->hid);
-+ uhid->hid = NULL;
-+ uhid->running = false;
-+ }
-+}
-+
- static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
- {
- __u8 newhead;
-@@ -498,18 +514,14 @@ static int uhid_dev_create2(struct uhid_device *uhid,
- uhid->hid = hid;
- uhid->running = true;
-
-- ret = hid_add_device(hid);
-- if (ret) {
-- hid_err(hid, "Cannot register HID device\n");
-- goto err_hid;
-- }
-+ /* Adding of a HID device is done through a worker, to allow HID drivers
-+ * which use feature requests during .probe to work, without they would
-+ * be blocked on devlock, which is held by uhid_char_write.
-+ */
-+ schedule_work(&uhid->worker);
-
- return 0;
-
--err_hid:
-- hid_destroy_device(hid);
-- uhid->hid = NULL;
-- uhid->running = false;
- err_free:
- kfree(uhid->rd_data);
- uhid->rd_data = NULL;
-@@ -550,6 +562,8 @@ static int uhid_dev_destroy(struct uhid_device *uhid)
- uhid->running = false;
- wake_up_interruptible(&uhid->report_wait);
-
-+ cancel_work_sync(&uhid->worker);
-+
- hid_destroy_device(uhid->hid);
- kfree(uhid->rd_data);
-
-@@ -612,6 +626,7 @@ static int uhid_char_open(struct inode *inode, struct file *file)
- init_waitqueue_head(&uhid->waitq);
- init_waitqueue_head(&uhid->report_wait);
- uhid->running = false;
-+ INIT_WORK(&uhid->worker, uhid_device_add_worker);
-
- file->private_data = uhid;
- nonseekable_open(inode, file);
-diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
-index 952f20f..e82f7e1 100644
---- a/drivers/hv/vmbus_drv.c
-+++ b/drivers/hv/vmbus_drv.c
-@@ -42,6 +42,7 @@
- #include <linux/screen_info.h>
- #include <linux/kdebug.h>
- #include <linux/efi.h>
-+#include <linux/random.h>
- #include "hyperv_vmbus.h"
-
- static struct acpi_device *hv_acpi_dev;
-@@ -806,6 +807,8 @@ static void vmbus_isr(void)
- else
- tasklet_schedule(hv_context.msg_dpc[cpu]);
- }
-+
-+ add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR, 0);
- }
-
-
-diff --git a/drivers/i2c/busses/i2c-efm32.c b/drivers/i2c/busses/i2c-efm32.c
-index 8eff627..e253598 100644
---- a/drivers/i2c/busses/i2c-efm32.c
-+++ b/drivers/i2c/busses/i2c-efm32.c
-@@ -433,7 +433,7 @@ static int efm32_i2c_probe(struct platform_device *pdev)
- ret = request_irq(ddata->irq, efm32_i2c_irq, 0, DRIVER_NAME, ddata);
- if (ret < 0) {
- dev_err(&pdev->dev, "failed to request irq (%d)\n", ret);
-- return ret;
-+ goto err_disable_clk;
- }
-
- ret = i2c_add_adapter(&ddata->adapter);
-diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
-index 1eb9b12..dbfd854 100644
---- a/drivers/infiniband/core/rw.c
-+++ b/drivers/infiniband/core/rw.c
-@@ -58,19 +58,13 @@ static inline bool rdma_rw_io_needs_mr(struct ib_device *dev, u8 port_num,
- return false;
- }
-
--static inline u32 rdma_rw_max_sge(struct ib_device *dev,
-- enum dma_data_direction dir)
--{
-- return dir == DMA_TO_DEVICE ?
-- dev->attrs.max_sge : dev->attrs.max_sge_rd;
--}
--
- static inline u32 rdma_rw_fr_page_list_len(struct ib_device *dev)
- {
- /* arbitrary limit to avoid allocating gigantic resources */
- return min_t(u32, dev->attrs.max_fast_reg_page_list_len, 256);
- }
-
-+/* Caller must have zero-initialized *reg. */
- static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
- struct rdma_rw_reg_ctx *reg, struct scatterlist *sg,
- u32 sg_cnt, u32 offset)
-@@ -114,6 +108,7 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- u8 port_num, struct scatterlist *sg, u32 sg_cnt, u32 offset,
- u64 remote_addr, u32 rkey, enum dma_data_direction dir)
- {
-+ struct rdma_rw_reg_ctx *prev = NULL;
- u32 pages_per_mr = rdma_rw_fr_page_list_len(qp->pd->device);
- int i, j, ret = 0, count = 0;
-
-@@ -125,7 +120,6 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- }
-
- for (i = 0; i < ctx->nr_ops; i++) {
-- struct rdma_rw_reg_ctx *prev = i ? &ctx->reg[i - 1] : NULL;
- struct rdma_rw_reg_ctx *reg = &ctx->reg[i];
- u32 nents = min(sg_cnt, pages_per_mr);
-
-@@ -162,9 +156,13 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- sg_cnt -= nents;
- for (j = 0; j < nents; j++)
- sg = sg_next(sg);
-+ prev = reg;
- offset = 0;
- }
-
-+ if (prev)
-+ prev->wr.wr.next = NULL;
-+
- ctx->type = RDMA_RW_MR;
- return count;
-
-@@ -181,7 +179,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- u64 remote_addr, u32 rkey, enum dma_data_direction dir)
- {
- struct ib_device *dev = qp->pd->device;
-- u32 max_sge = rdma_rw_max_sge(dev, dir);
-+ u32 max_sge = dir == DMA_TO_DEVICE ? qp->max_write_sge :
-+ qp->max_read_sge;
- struct ib_sge *sge;
- u32 total_len = 0, i, j;
-
-@@ -205,11 +204,10 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- rdma_wr->wr.opcode = IB_WR_RDMA_READ;
- rdma_wr->remote_addr = remote_addr + total_len;
- rdma_wr->rkey = rkey;
-+ rdma_wr->wr.num_sge = nr_sge;
- rdma_wr->wr.sg_list = sge;
-
- for (j = 0; j < nr_sge; j++, sg = sg_next(sg)) {
-- rdma_wr->wr.num_sge++;
--
- sge->addr = ib_sg_dma_address(dev, sg) + offset;
- sge->length = ib_sg_dma_len(dev, sg) - offset;
- sge->lkey = qp->pd->local_dma_lkey;
-@@ -220,8 +218,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- offset = 0;
- }
-
-- if (i + 1 < ctx->nr_ops)
-- rdma_wr->wr.next = &ctx->map.wrs[i + 1].wr;
-+ rdma_wr->wr.next = i + 1 < ctx->nr_ops ?
-+ &ctx->map.wrs[i + 1].wr : NULL;
- }
-
- ctx->type = RDMA_RW_MULTI_WR;
-diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
-index 6298f54..e39a0b5 100644
---- a/drivers/infiniband/core/verbs.c
-+++ b/drivers/infiniband/core/verbs.c
-@@ -814,6 +814,15 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
- }
- }
-
-+ /*
-+ * Note: all hw drivers guarantee that max_send_sge is lower than
-+ * the device RDMA WRITE SGE limit but not all hw drivers ensure that
-+ * max_send_sge <= max_sge_rd.
-+ */
-+ qp->max_write_sge = qp_init_attr->cap.max_send_sge;
-+ qp->max_read_sge = min_t(u32, qp_init_attr->cap.max_send_sge,
-+ device->attrs.max_sge_rd);
-+
- return qp;
- }
- EXPORT_SYMBOL(ib_create_qp);
-diff --git a/drivers/infiniband/hw/mlx5/gsi.c b/drivers/infiniband/hw/mlx5/gsi.c
-index 53e03c8..79e6309 100644
---- a/drivers/infiniband/hw/mlx5/gsi.c
-+++ b/drivers/infiniband/hw/mlx5/gsi.c
-@@ -69,15 +69,6 @@ static bool mlx5_ib_deth_sqpn_cap(struct mlx5_ib_dev *dev)
- return MLX5_CAP_GEN(dev->mdev, set_deth_sqpn);
- }
-
--static u32 next_outstanding(struct mlx5_ib_gsi_qp *gsi, u32 index)
--{
-- return ++index % gsi->cap.max_send_wr;
--}
--
--#define for_each_outstanding_wr(gsi, index) \
-- for (index = gsi->outstanding_ci; index != gsi->outstanding_pi; \
-- index = next_outstanding(gsi, index))
--
- /* Call with gsi->lock locked */
- static void generate_completions(struct mlx5_ib_gsi_qp *gsi)
- {
-@@ -85,8 +76,9 @@ static void generate_completions(struct mlx5_ib_gsi_qp *gsi)
- struct mlx5_ib_gsi_wr *wr;
- u32 index;
-
-- for_each_outstanding_wr(gsi, index) {
-- wr = &gsi->outstanding_wrs[index];
-+ for (index = gsi->outstanding_ci; index != gsi->outstanding_pi;
-+ index++) {
-+ wr = &gsi->outstanding_wrs[index % gsi->cap.max_send_wr];
-
- if (!wr->completed)
- break;
-@@ -430,8 +422,9 @@ static int mlx5_ib_add_outstanding_wr(struct mlx5_ib_gsi_qp *gsi,
- return -ENOMEM;
- }
-
-- gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi];
-- gsi->outstanding_pi = next_outstanding(gsi, gsi->outstanding_pi);
-+ gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi %
-+ gsi->cap.max_send_wr];
-+ gsi->outstanding_pi++;
-
- if (!wc) {
- memset(&gsi_wr->wc, 0, sizeof(gsi_wr->wc));
-diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
-index 11aa6a3..1da8d01 100644
---- a/drivers/infiniband/sw/rdmavt/Kconfig
-+++ b/drivers/infiniband/sw/rdmavt/Kconfig
-@@ -1,6 +1,5 @@
- config INFINIBAND_RDMAVT
- tristate "RDMA verbs transport library"
- depends on 64BIT
-- default m
- ---help---
- This is a common software verbs provider for RDMA networks.
-diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c
-index 6ca6fa8..f2f229e 100644
---- a/drivers/infiniband/sw/rdmavt/cq.c
-+++ b/drivers/infiniband/sw/rdmavt/cq.c
-@@ -510,6 +510,7 @@ int rvt_driver_cq_init(struct rvt_dev_info *rdi)
-
- if (rdi->worker)
- return 0;
-+ spin_lock_init(&rdi->n_cqs_lock);
- rdi->worker = kzalloc(sizeof(*rdi->worker), GFP_KERNEL);
- if (!rdi->worker)
- return -ENOMEM;
-diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
-index 4a41556..9a3b954 100644
---- a/drivers/infiniband/ulp/srpt/ib_srpt.c
-+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
-@@ -1601,6 +1601,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
- struct ib_qp_init_attr *qp_init;
- struct srpt_port *sport = ch->sport;
- struct srpt_device *sdev = sport->sdev;
-+ const struct ib_device_attr *attrs = &sdev->device->attrs;
- u32 srp_sq_size = sport->port_attrib.srp_sq_size;
- int ret;
-
-@@ -1638,7 +1639,7 @@ retry:
- */
- qp_init->cap.max_send_wr = srp_sq_size / 2;
- qp_init->cap.max_rdma_ctxs = srp_sq_size / 2;
-- qp_init->cap.max_send_sge = SRPT_DEF_SG_PER_WQE;
-+ qp_init->cap.max_send_sge = min(attrs->max_sge, SRPT_MAX_SG_PER_WQE);
- qp_init->port_num = ch->sport->port;
-
- ch->qp = ib_create_qp(sdev->pd, qp_init);
-diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h
-index 3890304..5818787 100644
---- a/drivers/infiniband/ulp/srpt/ib_srpt.h
-+++ b/drivers/infiniband/ulp/srpt/ib_srpt.h
-@@ -106,7 +106,11 @@ enum {
- SRP_LOGIN_RSP_MULTICHAN_MAINTAINED = 0x2,
-
- SRPT_DEF_SG_TABLESIZE = 128,
-- SRPT_DEF_SG_PER_WQE = 16,
-+ /*
-+ * An experimentally determined value that avoids that QP creation
-+ * fails due to "swiotlb buffer is full" on systems using the swiotlb.
-+ */
-+ SRPT_MAX_SG_PER_WQE = 16,
-
- MIN_SRPT_SQ_SIZE = 16,
- DEF_SRPT_SQ_SIZE = 4096,
-diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
-index 2f58985..d15b338 100644
---- a/drivers/input/mouse/elan_i2c_core.c
-+++ b/drivers/input/mouse/elan_i2c_core.c
-@@ -4,7 +4,8 @@
- * Copyright (c) 2013 ELAN Microelectronics Corp.
- *
- * Author: 林政維 (Duson Lin) <dusonlin@emc.com.tw>
-- * Version: 1.6.0
-+ * Author: KT Liao <kt.liao@emc.com.tw>
-+ * Version: 1.6.2
- *
- * Based on cyapa driver:
- * copyright (c) 2011-2012 Cypress Semiconductor, Inc.
-@@ -40,7 +41,7 @@
- #include "elan_i2c.h"
-
- #define DRIVER_NAME "elan_i2c"
--#define ELAN_DRIVER_VERSION "1.6.1"
-+#define ELAN_DRIVER_VERSION "1.6.2"
- #define ELAN_VENDOR_ID 0x04f3
- #define ETP_MAX_PRESSURE 255
- #define ETP_FWIDTH_REDUCE 90
-@@ -199,9 +200,41 @@ static int elan_sleep(struct elan_tp_data *data)
- return error;
- }
-
-+static int elan_query_product(struct elan_tp_data *data)
-+{
-+ int error;
-+
-+ error = data->ops->get_product_id(data->client, &data->product_id);
-+ if (error)
-+ return error;
-+
-+ error = data->ops->get_sm_version(data->client, &data->ic_type,
-+ &data->sm_version);
-+ if (error)
-+ return error;
-+
-+ return 0;
-+}
-+
-+static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
-+{
-+ if (data->ic_type != 0x0E)
-+ return false;
-+
-+ switch (data->product_id) {
-+ case 0x05 ... 0x07:
-+ case 0x09:
-+ case 0x13:
-+ return true;
-+ default:
-+ return false;
-+ }
-+}
-+
- static int __elan_initialize(struct elan_tp_data *data)
- {
- struct i2c_client *client = data->client;
-+ bool woken_up = false;
- int error;
-
- error = data->ops->initialize(client);
-@@ -210,6 +243,27 @@ static int __elan_initialize(struct elan_tp_data *data)
- return error;
- }
-
-+ error = elan_query_product(data);
-+ if (error)
-+ return error;
-+
-+ /*
-+ * Some ASUS devices were shipped with firmware that requires
-+ * touchpads to be woken up first, before attempting to switch
-+ * them into absolute reporting mode.
-+ */
-+ if (elan_check_ASUS_special_fw(data)) {
-+ error = data->ops->sleep_control(client, false);
-+ if (error) {
-+ dev_err(&client->dev,
-+ "failed to wake device up: %d\n", error);
-+ return error;
-+ }
-+
-+ msleep(200);
-+ woken_up = true;
-+ }
-+
- data->mode |= ETP_ENABLE_ABS;
- error = data->ops->set_mode(client, data->mode);
- if (error) {
-@@ -218,11 +272,13 @@ static int __elan_initialize(struct elan_tp_data *data)
- return error;
- }
-
-- error = data->ops->sleep_control(client, false);
-- if (error) {
-- dev_err(&client->dev,
-- "failed to wake device up: %d\n", error);
-- return error;
-+ if (!woken_up) {
-+ error = data->ops->sleep_control(client, false);
-+ if (error) {
-+ dev_err(&client->dev,
-+ "failed to wake device up: %d\n", error);
-+ return error;
-+ }
- }
-
- return 0;
-@@ -248,10 +304,6 @@ static int elan_query_device_info(struct elan_tp_data *data)
- {
- int error;
-
-- error = data->ops->get_product_id(data->client, &data->product_id);
-- if (error)
-- return error;
--
- error = data->ops->get_version(data->client, false, &data->fw_version);
- if (error)
- return error;
-@@ -261,11 +313,6 @@ static int elan_query_device_info(struct elan_tp_data *data)
- if (error)
- return error;
-
-- error = data->ops->get_sm_version(data->client, &data->ic_type,
-- &data->sm_version);
-- if (error)
-- return error;
--
- error = data->ops->get_version(data->client, true, &data->iap_version);
- if (error)
- return error;
-diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
-index 880c40b..b7e8c11 100644
---- a/drivers/input/touchscreen/sur40.c
-+++ b/drivers/input/touchscreen/sur40.c
-@@ -126,7 +126,7 @@ struct sur40_image_header {
- #define VIDEO_PACKET_SIZE 16384
-
- /* polling interval (ms) */
--#define POLL_INTERVAL 4
-+#define POLL_INTERVAL 1
-
- /* maximum number of contacts FIXME: this is a guess? */
- #define MAX_CONTACTS 64
-@@ -448,7 +448,7 @@ static void sur40_process_video(struct sur40_state *sur40)
-
- /* return error if streaming was stopped in the meantime */
- if (sur40->sequence == -1)
-- goto err_poll;
-+ return;
-
- /* mark as finished */
- new_buf->vb.vb2_buf.timestamp = ktime_get_ns();
-@@ -736,6 +736,7 @@ static int sur40_start_streaming(struct vb2_queue *vq, unsigned int count)
- static void sur40_stop_streaming(struct vb2_queue *vq)
- {
- struct sur40_state *sur40 = vb2_get_drv_priv(vq);
-+ vb2_wait_for_all_buffers(vq);
- sur40->sequence = -1;
-
- /* Release all active buffers */
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 634f636..2511c8b 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -466,9 +466,11 @@ static void init_iommu_group(struct device *dev)
- if (!domain)
- goto out;
-
-- dma_domain = to_pdomain(domain)->priv;
-+ if (to_pdomain(domain)->flags == PD_DMA_OPS_MASK) {
-+ dma_domain = to_pdomain(domain)->priv;
-+ init_unity_mappings_for_device(dev, dma_domain);
-+ }
-
-- init_unity_mappings_for_device(dev, dma_domain);
- out:
- iommu_group_put(group);
- }
-@@ -2512,8 +2514,15 @@ static void update_device_table(struct protection_domain *domain)
- {
- struct iommu_dev_data *dev_data;
-
-- list_for_each_entry(dev_data, &domain->dev_list, list)
-+ list_for_each_entry(dev_data, &domain->dev_list, list) {
- set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled);
-+
-+ if (dev_data->devid == dev_data->alias)
-+ continue;
-+
-+ /* There is an alias, update device table entry for it */
-+ set_dte_entry(dev_data->alias, domain, dev_data->ats.enabled);
-+ }
- }
-
- static void update_domain(struct protection_domain *domain)
-@@ -3103,9 +3112,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
- static void amd_iommu_domain_free(struct iommu_domain *dom)
- {
- struct protection_domain *domain;
--
-- if (!dom)
-- return;
-+ struct dma_ops_domain *dma_dom;
-
- domain = to_pdomain(dom);
-
-@@ -3114,13 +3121,24 @@ static void amd_iommu_domain_free(struct iommu_domain *dom)
-
- BUG_ON(domain->dev_cnt != 0);
-
-- if (domain->mode != PAGE_MODE_NONE)
-- free_pagetable(domain);
-+ if (!dom)
-+ return;
-+
-+ switch (dom->type) {
-+ case IOMMU_DOMAIN_DMA:
-+ dma_dom = domain->priv;
-+ dma_ops_domain_free(dma_dom);
-+ break;
-+ default:
-+ if (domain->mode != PAGE_MODE_NONE)
-+ free_pagetable(domain);
-
-- if (domain->flags & PD_IOMMUV2_MASK)
-- free_gcr3_table(domain);
-+ if (domain->flags & PD_IOMMUV2_MASK)
-+ free_gcr3_table(domain);
-
-- protection_domain_free(domain);
-+ protection_domain_free(domain);
-+ break;
-+ }
- }
-
- static void amd_iommu_detach_device(struct iommu_domain *dom,
-diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
-index 5ecc86c..e27e3b7df 100644
---- a/drivers/iommu/exynos-iommu.c
-+++ b/drivers/iommu/exynos-iommu.c
-@@ -709,6 +709,7 @@ static struct platform_driver exynos_sysmmu_driver __refdata = {
- .name = "exynos-sysmmu",
- .of_match_table = sysmmu_of_match,
- .pm = &sysmmu_pm_ops,
-+ .suppress_bind_attrs = true,
- }
- };
-
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 323dac9..d416242 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -2076,7 +2076,7 @@ out_unlock:
- spin_unlock(&iommu->lock);
- spin_unlock_irqrestore(&device_domain_lock, flags);
-
-- return 0;
-+ return ret;
- }
-
- struct domain_context_mapping_data {
-diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
-index a1ed1b7..f5c90e1 100644
---- a/drivers/iommu/io-pgtable-arm.c
-+++ b/drivers/iommu/io-pgtable-arm.c
-@@ -576,7 +576,7 @@ static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable_ops *ops,
- return 0;
-
- found_translation:
-- iova &= (ARM_LPAE_GRANULE(data) - 1);
-+ iova &= (ARM_LPAE_BLOCK_SIZE(lvl, data) - 1);
- return ((phys_addr_t)iopte_to_pfn(pte,data) << data->pg_shift) | iova;
- }
-
-diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
-index b7341de..4bb49cd 100644
---- a/drivers/md/dm-flakey.c
-+++ b/drivers/md/dm-flakey.c
-@@ -289,10 +289,16 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
- pb->bio_submitted = true;
-
- /*
-- * Map reads as normal.
-+ * Map reads as normal only if corrupt_bio_byte set.
- */
-- if (bio_data_dir(bio) == READ)
-- goto map_bio;
-+ if (bio_data_dir(bio) == READ) {
-+ /* If flags were specified, only corrupt those that match. */
-+ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
-+ all_corrupt_bio_flags_match(bio, fc))
-+ goto map_bio;
-+ else
-+ return -EIO;
-+ }
-
- /*
- * Drop writes?
-@@ -330,12 +336,13 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
-
- /*
- * Corrupt successful READs while in down state.
-- * If flags were specified, only corrupt those that match.
- */
-- if (fc->corrupt_bio_byte && !error && pb->bio_submitted &&
-- (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
-- all_corrupt_bio_flags_match(bio, fc))
-- corrupt_bio_data(bio, fc);
-+ if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
-+ if (fc->corrupt_bio_byte)
-+ corrupt_bio_data(bio, fc);
-+ else
-+ return -EIO;
-+ }
-
- return error;
- }
-diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
-index 459a9f8..0f0eb8a 100644
---- a/drivers/md/dm-verity-fec.c
-+++ b/drivers/md/dm-verity-fec.c
-@@ -453,9 +453,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
- */
-
- offset = block << v->data_dev_block_bits;
--
-- res = offset;
-- div64_u64(res, v->fec->rounds << v->data_dev_block_bits);
-+ res = div64_u64(offset, v->fec->rounds << v->data_dev_block_bits);
-
- /*
- * The base RS block we can feed to the interleaver to find out all
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 1b2f962..fd40bcb 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -2175,7 +2175,7 @@ static void dm_request_fn(struct request_queue *q)
- md_in_flight(md) && rq->bio && rq->bio->bi_vcnt == 1 &&
- md->last_rq_pos == pos && md->last_rq_rw == rq_data_dir(rq)) ||
- (ti->type->busy && ti->type->busy(ti))) {
-- blk_delay_queue(q, HZ / 100);
-+ blk_delay_queue(q, 10);
- return;
- }
-
-@@ -3128,7 +3128,8 @@ static void unlock_fs(struct mapped_device *md)
- * Caller must hold md->suspend_lock
- */
- static int __dm_suspend(struct mapped_device *md, struct dm_table *map,
-- unsigned suspend_flags, int interruptible)
-+ unsigned suspend_flags, int interruptible,
-+ int dmf_suspended_flag)
- {
- bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
- bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
-@@ -3195,6 +3196,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map,
- * to finish.
- */
- r = dm_wait_for_completion(md, interruptible);
-+ if (!r)
-+ set_bit(dmf_suspended_flag, &md->flags);
-
- if (noflush)
- clear_bit(DMF_NOFLUSH_SUSPENDING, &md->flags);
-@@ -3256,12 +3259,10 @@ retry:
-
- map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock));
-
-- r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE);
-+ r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE, DMF_SUSPENDED);
- if (r)
- goto out_unlock;
-
-- set_bit(DMF_SUSPENDED, &md->flags);
--
- dm_table_postsuspend_targets(map);
-
- out_unlock:
-@@ -3355,9 +3356,8 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
- * would require changing .presuspend to return an error -- avoid this
- * until there is a need for more elaborate variants of internal suspend.
- */
-- (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE);
--
-- set_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
-+ (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE,
-+ DMF_SUSPENDED_INTERNALLY);
-
- dm_table_postsuspend_targets(map);
- }
-diff --git a/drivers/media/dvb-core/dvb_ringbuffer.c b/drivers/media/dvb-core/dvb_ringbuffer.c
-index 1100e98..7df7fb3 100644
---- a/drivers/media/dvb-core/dvb_ringbuffer.c
-+++ b/drivers/media/dvb-core/dvb_ringbuffer.c
-@@ -55,7 +55,13 @@ void dvb_ringbuffer_init(struct dvb_ringbuffer *rbuf, void *data, size_t len)
-
- int dvb_ringbuffer_empty(struct dvb_ringbuffer *rbuf)
- {
-- return (rbuf->pread==rbuf->pwrite);
-+ /* smp_load_acquire() to load write pointer on reader side
-+ * this pairs with smp_store_release() in dvb_ringbuffer_write(),
-+ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
-+ *
-+ * for memory barriers also see Documentation/circular-buffers.txt
-+ */
-+ return (rbuf->pread == smp_load_acquire(&rbuf->pwrite));
- }
-
-
-@@ -64,7 +70,12 @@ ssize_t dvb_ringbuffer_free(struct dvb_ringbuffer *rbuf)
- {
- ssize_t free;
-
-- free = rbuf->pread - rbuf->pwrite;
-+ /* ACCESS_ONCE() to load read pointer on writer side
-+ * this pairs with smp_store_release() in dvb_ringbuffer_read(),
-+ * dvb_ringbuffer_read_user(), dvb_ringbuffer_flush(),
-+ * or dvb_ringbuffer_reset()
-+ */
-+ free = ACCESS_ONCE(rbuf->pread) - rbuf->pwrite;
- if (free <= 0)
- free += rbuf->size;
- return free-1;
-@@ -76,7 +87,11 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
- {
- ssize_t avail;
-
-- avail = rbuf->pwrite - rbuf->pread;
-+ /* smp_load_acquire() to load write pointer on reader side
-+ * this pairs with smp_store_release() in dvb_ringbuffer_write(),
-+ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
-+ */
-+ avail = smp_load_acquire(&rbuf->pwrite) - rbuf->pread;
- if (avail < 0)
- avail += rbuf->size;
- return avail;
-@@ -86,14 +101,25 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
-
- void dvb_ringbuffer_flush(struct dvb_ringbuffer *rbuf)
- {
-- rbuf->pread = rbuf->pwrite;
-+ /* dvb_ringbuffer_flush() counts as read operation
-+ * smp_load_acquire() to load write pointer
-+ * smp_store_release() to update read pointer, this ensures that the
-+ * correct pointer is visible for subsequent dvb_ringbuffer_free()
-+ * calls on other cpu cores
-+ */
-+ smp_store_release(&rbuf->pread, smp_load_acquire(&rbuf->pwrite));
- rbuf->error = 0;
- }
- EXPORT_SYMBOL(dvb_ringbuffer_flush);
-
- void dvb_ringbuffer_reset(struct dvb_ringbuffer *rbuf)
- {
-- rbuf->pread = rbuf->pwrite = 0;
-+ /* dvb_ringbuffer_reset() counts as read and write operation
-+ * smp_store_release() to update read pointer
-+ */
-+ smp_store_release(&rbuf->pread, 0);
-+ /* smp_store_release() to update write pointer */
-+ smp_store_release(&rbuf->pwrite, 0);
- rbuf->error = 0;
- }
-
-@@ -119,12 +145,17 @@ ssize_t dvb_ringbuffer_read_user(struct dvb_ringbuffer *rbuf, u8 __user *buf, si
- return -EFAULT;
- buf += split;
- todo -= split;
-- rbuf->pread = 0;
-+ /* smp_store_release() for read pointer update to ensure
-+ * that buf is not overwritten until read is complete,
-+ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
-+ */
-+ smp_store_release(&rbuf->pread, 0);
- }
- if (copy_to_user(buf, rbuf->data+rbuf->pread, todo))
- return -EFAULT;
-
-- rbuf->pread = (rbuf->pread + todo) % rbuf->size;
-+ /* smp_store_release() to update read pointer, see above */
-+ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
-
- return len;
- }
-@@ -139,11 +170,16 @@ void dvb_ringbuffer_read(struct dvb_ringbuffer *rbuf, u8 *buf, size_t len)
- memcpy(buf, rbuf->data+rbuf->pread, split);
- buf += split;
- todo -= split;
-- rbuf->pread = 0;
-+ /* smp_store_release() for read pointer update to ensure
-+ * that buf is not overwritten until read is complete,
-+ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
-+ */
-+ smp_store_release(&rbuf->pread, 0);
- }
- memcpy(buf, rbuf->data+rbuf->pread, todo);
-
-- rbuf->pread = (rbuf->pread + todo) % rbuf->size;
-+ /* smp_store_release() to update read pointer, see above */
-+ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
- }
-
-
-@@ -158,10 +194,16 @@ ssize_t dvb_ringbuffer_write(struct dvb_ringbuffer *rbuf, const u8 *buf, size_t
- memcpy(rbuf->data+rbuf->pwrite, buf, split);
- buf += split;
- todo -= split;
-- rbuf->pwrite = 0;
-+ /* smp_store_release() for write pointer update to ensure that
-+ * written data is visible on other cpu cores before the pointer
-+ * update, this pairs with smp_load_acquire() in
-+ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
-+ */
-+ smp_store_release(&rbuf->pwrite, 0);
- }
- memcpy(rbuf->data+rbuf->pwrite, buf, todo);
-- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
-+ /* smp_store_release() for write pointer update, see above */
-+ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
-
- return len;
- }
-@@ -181,12 +223,18 @@ ssize_t dvb_ringbuffer_write_user(struct dvb_ringbuffer *rbuf,
- return len - todo;
- buf += split;
- todo -= split;
-- rbuf->pwrite = 0;
-+ /* smp_store_release() for write pointer update to ensure that
-+ * written data is visible on other cpu cores before the pointer
-+ * update, this pairs with smp_load_acquire() in
-+ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
-+ */
-+ smp_store_release(&rbuf->pwrite, 0);
- }
- status = copy_from_user(rbuf->data+rbuf->pwrite, buf, todo);
- if (status)
- return len - todo;
-- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
-+ /* smp_store_release() for write pointer update, see above */
-+ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
-
- return len;
- }
-diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
-index b16466f..beb4fd5 100644
---- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
-+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
-@@ -1050,6 +1050,11 @@ static int match_child(struct device *dev, void *data)
- return !strcmp(dev_name(dev), (char *)data);
- }
-
-+static void s5p_mfc_memdev_release(struct device *dev)
-+{
-+ dma_release_declared_memory(dev);
-+}
-+
- static void *mfc_get_drv_data(struct platform_device *pdev);
-
- static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
-@@ -1062,6 +1067,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
- mfc_err("Not enough memory\n");
- return -ENOMEM;
- }
-+
-+ dev_set_name(dev->mem_dev_l, "%s", "s5p-mfc-l");
-+ dev->mem_dev_l->release = s5p_mfc_memdev_release;
- device_initialize(dev->mem_dev_l);
- of_property_read_u32_array(dev->plat_dev->dev.of_node,
- "samsung,mfc-l", mem_info, 2);
-@@ -1079,6 +1087,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
- mfc_err("Not enough memory\n");
- return -ENOMEM;
- }
-+
-+ dev_set_name(dev->mem_dev_r, "%s", "s5p-mfc-r");
-+ dev->mem_dev_r->release = s5p_mfc_memdev_release;
- device_initialize(dev->mem_dev_r);
- of_property_read_u32_array(dev->plat_dev->dev.of_node,
- "samsung,mfc-r", mem_info, 2);
-diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
-index 6ffe776..a0fd4e6 100644
---- a/drivers/media/rc/ir-rc5-decoder.c
-+++ b/drivers/media/rc/ir-rc5-decoder.c
-@@ -29,7 +29,7 @@
- #define RC5_BIT_START (1 * RC5_UNIT)
- #define RC5_BIT_END (1 * RC5_UNIT)
- #define RC5X_SPACE (4 * RC5_UNIT)
--#define RC5_TRAILER (10 * RC5_UNIT) /* In reality, approx 100 */
-+#define RC5_TRAILER (6 * RC5_UNIT) /* In reality, approx 100 */
-
- enum rc5_state {
- STATE_INACTIVE,
-diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
-index 99b303b..e8ceb0e 100644
---- a/drivers/media/rc/nuvoton-cir.c
-+++ b/drivers/media/rc/nuvoton-cir.c
-@@ -401,6 +401,7 @@ static int nvt_hw_detect(struct nvt_dev *nvt)
- /* Check if we're wired for the alternate EFER setup */
- nvt->chip_major = nvt_cr_read(nvt, CR_CHIP_ID_HI);
- if (nvt->chip_major == 0xff) {
-+ nvt_efm_disable(nvt);
- nvt->cr_efir = CR_EFIR2;
- nvt->cr_efdr = CR_EFDR2;
- nvt_efm_enable(nvt);
-diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c
-index 78c12d2..5dab024 100644
---- a/drivers/media/usb/usbtv/usbtv-audio.c
-+++ b/drivers/media/usb/usbtv/usbtv-audio.c
-@@ -278,6 +278,9 @@ static void snd_usbtv_trigger(struct work_struct *work)
- {
- struct usbtv *chip = container_of(work, struct usbtv, snd_trigger);
-
-+ if (!chip->snd)
-+ return;
-+
- if (atomic_read(&chip->snd_stream))
- usbtv_audio_start(chip);
- else
-@@ -378,6 +381,8 @@ err:
-
- void usbtv_audio_free(struct usbtv *usbtv)
- {
-+ cancel_work_sync(&usbtv->snd_trigger);
-+
- if (usbtv->snd && usbtv->udev) {
- snd_card_free(usbtv->snd);
- usbtv->snd = NULL;
-diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
-index 9fbcb67..633fc1a 100644
---- a/drivers/media/v4l2-core/videobuf2-core.c
-+++ b/drivers/media/v4l2-core/videobuf2-core.c
-@@ -1648,7 +1648,7 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
- void *pb, int nonblocking)
- {
- unsigned long flags;
-- int ret;
-+ int ret = 0;
-
- /*
- * Wait for at least one buffer to become available on the done_list.
-@@ -1664,10 +1664,12 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
- spin_lock_irqsave(&q->done_lock, flags);
- *vb = list_first_entry(&q->done_list, struct vb2_buffer, done_entry);
- /*
-- * Only remove the buffer from done_list if v4l2_buffer can handle all
-- * the planes.
-+ * Only remove the buffer from done_list if all planes can be
-+ * handled. Some cases such as V4L2 file I/O and DVB have pb
-+ * == NULL; skip the check then as there's nothing to verify.
- */
-- ret = call_bufop(q, verify_planes_array, *vb, pb);
-+ if (pb)
-+ ret = call_bufop(q, verify_planes_array, *vb, pb);
- if (!ret)
- list_del(&(*vb)->done_entry);
- spin_unlock_irqrestore(&q->done_lock, flags);
-diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
-index 0b1b8c7..7f366f1 100644
---- a/drivers/media/v4l2-core/videobuf2-v4l2.c
-+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
-@@ -74,6 +74,11 @@ static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer
- return 0;
- }
-
-+static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
-+{
-+ return __verify_planes_array(vb, pb);
-+}
-+
- /**
- * __verify_length() - Verify that the bytesused value for each plane fits in
- * the plane length and that the data offset doesn't exceed the bytesused value.
-@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb,
- }
-
- static const struct vb2_buf_ops v4l2_buf_ops = {
-+ .verify_planes_array = __verify_planes_array_core,
- .fill_user_buffer = __fill_v4l2_buffer,
- .fill_vb2_buffer = __fill_vb2_buffer,
- .copy_timestamp = __copy_timestamp,
-diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
-index 1be47ad..880d469 100644
---- a/drivers/mfd/qcom_rpm.c
-+++ b/drivers/mfd/qcom_rpm.c
-@@ -34,7 +34,13 @@ struct qcom_rpm_resource {
- struct qcom_rpm_data {
- u32 version;
- const struct qcom_rpm_resource *resource_table;
-- unsigned n_resources;
-+ unsigned int n_resources;
-+ unsigned int req_ctx_off;
-+ unsigned int req_sel_off;
-+ unsigned int ack_ctx_off;
-+ unsigned int ack_sel_off;
-+ unsigned int req_sel_size;
-+ unsigned int ack_sel_size;
- };
-
- struct qcom_rpm {
-@@ -61,11 +67,7 @@ struct qcom_rpm {
-
- #define RPM_REQUEST_TIMEOUT (5 * HZ)
-
--#define RPM_REQUEST_CONTEXT 3
--#define RPM_REQ_SELECT 11
--#define RPM_ACK_CONTEXT 15
--#define RPM_ACK_SELECTOR 23
--#define RPM_SELECT_SIZE 7
-+#define RPM_MAX_SEL_SIZE 7
-
- #define RPM_NOTIFICATION BIT(30)
- #define RPM_REJECTED BIT(31)
-@@ -157,6 +159,12 @@ static const struct qcom_rpm_data apq8064_template = {
- .version = 3,
- .resource_table = apq8064_rpm_resource_table,
- .n_resources = ARRAY_SIZE(apq8064_rpm_resource_table),
-+ .req_ctx_off = 3,
-+ .req_sel_off = 11,
-+ .ack_ctx_off = 15,
-+ .ack_sel_off = 23,
-+ .req_sel_size = 4,
-+ .ack_sel_size = 7,
- };
-
- static const struct qcom_rpm_resource msm8660_rpm_resource_table[] = {
-@@ -240,6 +248,12 @@ static const struct qcom_rpm_data msm8660_template = {
- .version = 2,
- .resource_table = msm8660_rpm_resource_table,
- .n_resources = ARRAY_SIZE(msm8660_rpm_resource_table),
-+ .req_ctx_off = 3,
-+ .req_sel_off = 11,
-+ .ack_ctx_off = 19,
-+ .ack_sel_off = 27,
-+ .req_sel_size = 7,
-+ .ack_sel_size = 7,
- };
-
- static const struct qcom_rpm_resource msm8960_rpm_resource_table[] = {
-@@ -322,6 +336,12 @@ static const struct qcom_rpm_data msm8960_template = {
- .version = 3,
- .resource_table = msm8960_rpm_resource_table,
- .n_resources = ARRAY_SIZE(msm8960_rpm_resource_table),
-+ .req_ctx_off = 3,
-+ .req_sel_off = 11,
-+ .ack_ctx_off = 15,
-+ .ack_sel_off = 23,
-+ .req_sel_size = 4,
-+ .ack_sel_size = 7,
- };
-
- static const struct qcom_rpm_resource ipq806x_rpm_resource_table[] = {
-@@ -362,6 +382,12 @@ static const struct qcom_rpm_data ipq806x_template = {
- .version = 3,
- .resource_table = ipq806x_rpm_resource_table,
- .n_resources = ARRAY_SIZE(ipq806x_rpm_resource_table),
-+ .req_ctx_off = 3,
-+ .req_sel_off = 11,
-+ .ack_ctx_off = 15,
-+ .ack_sel_off = 23,
-+ .req_sel_size = 4,
-+ .ack_sel_size = 7,
- };
-
- static const struct of_device_id qcom_rpm_of_match[] = {
-@@ -380,7 +406,7 @@ int qcom_rpm_write(struct qcom_rpm *rpm,
- {
- const struct qcom_rpm_resource *res;
- const struct qcom_rpm_data *data = rpm->data;
-- u32 sel_mask[RPM_SELECT_SIZE] = { 0 };
-+ u32 sel_mask[RPM_MAX_SEL_SIZE] = { 0 };
- int left;
- int ret = 0;
- int i;
-@@ -398,12 +424,12 @@ int qcom_rpm_write(struct qcom_rpm *rpm,
- writel_relaxed(buf[i], RPM_REQ_REG(rpm, res->target_id + i));
-
- bitmap_set((unsigned long *)sel_mask, res->select_id, 1);
-- for (i = 0; i < ARRAY_SIZE(sel_mask); i++) {
-+ for (i = 0; i < rpm->data->req_sel_size; i++) {
- writel_relaxed(sel_mask[i],
-- RPM_CTRL_REG(rpm, RPM_REQ_SELECT + i));
-+ RPM_CTRL_REG(rpm, rpm->data->req_sel_off + i));
- }
-
-- writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, RPM_REQUEST_CONTEXT));
-+ writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, rpm->data->req_ctx_off));
-
- reinit_completion(&rpm->ack);
- regmap_write(rpm->ipc_regmap, rpm->ipc_offset, BIT(rpm->ipc_bit));
-@@ -426,10 +452,11 @@ static irqreturn_t qcom_rpm_ack_interrupt(int irq, void *dev)
- u32 ack;
- int i;
-
-- ack = readl_relaxed(RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT));
-- for (i = 0; i < RPM_SELECT_SIZE; i++)
-- writel_relaxed(0, RPM_CTRL_REG(rpm, RPM_ACK_SELECTOR + i));
-- writel(0, RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT));
-+ ack = readl_relaxed(RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off));
-+ for (i = 0; i < rpm->data->ack_sel_size; i++)
-+ writel_relaxed(0,
-+ RPM_CTRL_REG(rpm, rpm->data->ack_sel_off + i));
-+ writel(0, RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off));
-
- if (ack & RPM_NOTIFICATION) {
- dev_warn(rpm->dev, "ignoring notification!\n");
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 0b0dc29..77533f7 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
- int cached = writelen > bytes && page != blockmask;
- uint8_t *wbuf = buf;
- int use_bufpoi;
-- int part_pagewr = (column || writelen < (mtd->writesize - 1));
-+ int part_pagewr = (column || writelen < mtd->writesize);
-
- if (part_pagewr)
- use_bufpoi = 1;
-diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
-index ef36182..0680516 100644
---- a/drivers/mtd/ubi/build.c
-+++ b/drivers/mtd/ubi/build.c
-@@ -874,7 +874,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- for (i = 0; i < UBI_MAX_DEVICES; i++) {
- ubi = ubi_devices[i];
- if (ubi && mtd->index == ubi->mtd->index) {
-- ubi_err(ubi, "mtd%d is already attached to ubi%d",
-+ pr_err("ubi: mtd%d is already attached to ubi%d",
- mtd->index, i);
- return -EEXIST;
- }
-@@ -889,7 +889,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- * no sense to attach emulated MTD devices, so we prohibit this.
- */
- if (mtd->type == MTD_UBIVOLUME) {
-- ubi_err(ubi, "refuse attaching mtd%d - it is already emulated on top of UBI",
-+ pr_err("ubi: refuse attaching mtd%d - it is already emulated on top of UBI",
- mtd->index);
- return -EINVAL;
- }
-@@ -900,7 +900,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- if (!ubi_devices[ubi_num])
- break;
- if (ubi_num == UBI_MAX_DEVICES) {
-- ubi_err(ubi, "only %d UBI devices may be created",
-+ pr_err("ubi: only %d UBI devices may be created",
- UBI_MAX_DEVICES);
- return -ENFILE;
- }
-@@ -910,7 +910,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
-
- /* Make sure ubi_num is not busy */
- if (ubi_devices[ubi_num]) {
-- ubi_err(ubi, "already exists");
-+ pr_err("ubi: ubi%i already exists", ubi_num);
- return -EEXIST;
- }
- }
-@@ -992,6 +992,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- goto out_detach;
- }
-
-+ /* Make device "available" before it becomes accessible via sysfs */
-+ ubi_devices[ubi_num] = ubi;
-+
- err = uif_init(ubi, &ref);
- if (err)
- goto out_detach;
-@@ -1036,7 +1039,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- wake_up_process(ubi->bgt_thread);
- spin_unlock(&ubi->wl_lock);
-
-- ubi_devices[ubi_num] = ubi;
- ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
- return ubi_num;
-
-@@ -1047,6 +1049,7 @@ out_uif:
- ubi_assert(ref);
- uif_close(ubi);
- out_detach:
-+ ubi_devices[ubi_num] = NULL;
- ubi_wl_close(ubi);
- ubi_free_internal_volumes(ubi);
- vfree(ubi->vtbl);
-diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
-index 10059df..0138f52 100644
---- a/drivers/mtd/ubi/vmt.c
-+++ b/drivers/mtd/ubi/vmt.c
-@@ -488,13 +488,6 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
- spin_unlock(&ubi->volumes_lock);
- }
-
-- /* Change volume table record */
-- vtbl_rec = ubi->vtbl[vol_id];
-- vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
-- err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
-- if (err)
-- goto out_acc;
--
- if (pebs < 0) {
- for (i = 0; i < -pebs; i++) {
- err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i);
-@@ -512,6 +505,24 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
- spin_unlock(&ubi->volumes_lock);
- }
-
-+ /*
-+ * When we shrink a volume we have to flush all pending (erase) work.
-+ * Otherwise it can happen that upon next attach UBI finds a LEB with
-+ * lnum > highest_lnum and refuses to attach.
-+ */
-+ if (pebs < 0) {
-+ err = ubi_wl_flush(ubi, vol_id, UBI_ALL);
-+ if (err)
-+ goto out_acc;
-+ }
-+
-+ /* Change volume table record */
-+ vtbl_rec = ubi->vtbl[vol_id];
-+ vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
-+ err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
-+ if (err)
-+ goto out_acc;
-+
- vol->reserved_pebs = reserved_pebs;
- if (vol->vol_type == UBI_DYNAMIC_VOLUME) {
- vol->used_ebs = reserved_pebs;
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-index 5b30922..2ce3199 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2469,10 +2469,22 @@ void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
- void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
- {
- struct brcmf_fws_info *fws = drvr->fws;
-+ struct brcmf_if *ifp;
-+ int i;
-
-- fws->bus_flow_blocked = flow_blocked;
-- if (!flow_blocked)
-- brcmf_fws_schedule_deq(fws);
-- else
-- fws->stats.bus_flow_block++;
-+ if (fws->avoid_queueing) {
-+ for (i = 0; i < BRCMF_MAX_IFS; i++) {
-+ ifp = drvr->iflist[i];
-+ if (!ifp || !ifp->ndev)
-+ continue;
-+ brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
-+ flow_blocked);
-+ }
-+ } else {
-+ fws->bus_flow_blocked = flow_blocked;
-+ if (!flow_blocked)
-+ brcmf_fws_schedule_deq(fws);
-+ else
-+ fws->stats.bus_flow_block++;
-+ }
- }
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-index a588b05..6f020e4 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-@@ -433,6 +433,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- /* 8000 Series */
- {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24F3, 0x10B0, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)},
-@@ -454,6 +455,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- {IWL_PCI_DEVICE(0x24F3, 0xD010, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24F3, 0xD0B0, iwl8260_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24F3, 0xB0B0, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)},
-@@ -481,6 +484,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- {IWL_PCI_DEVICE(0x24FD, 0x0010, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x0110, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x1110, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x1130, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x0130, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x1010, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x0050, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x0150, iwl8265_2ac_cfg)},
-@@ -491,6 +496,10 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- {IWL_PCI_DEVICE(0x24FD, 0x0810, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x9110, iwl8265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x24FD, 0x8130, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x0910, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x0930, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x0950, iwl8265_2ac_cfg)},
-+ {IWL_PCI_DEVICE(0x24FD, 0x0850, iwl8265_2ac_cfg)},
-
- /* 9000 Series */
- {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-index de6974f..2d8cce2 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-@@ -496,7 +496,7 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans);
- /*****************************************************
- * Helpers
- ******************************************************/
--static inline void iwl_disable_interrupts(struct iwl_trans *trans)
-+static inline void _iwl_disable_interrupts(struct iwl_trans *trans)
- {
- struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-@@ -519,7 +519,16 @@ static inline void iwl_disable_interrupts(struct iwl_trans *trans)
- IWL_DEBUG_ISR(trans, "Disabled interrupts\n");
- }
-
--static inline void iwl_enable_interrupts(struct iwl_trans *trans)
-+static inline void iwl_disable_interrupts(struct iwl_trans *trans)
-+{
-+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-+
-+ spin_lock(&trans_pcie->irq_lock);
-+ _iwl_disable_interrupts(trans);
-+ spin_unlock(&trans_pcie->irq_lock);
-+}
-+
-+static inline void _iwl_enable_interrupts(struct iwl_trans *trans)
- {
- struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-@@ -542,6 +551,14 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
- }
- }
-
-+static inline void iwl_enable_interrupts(struct iwl_trans *trans)
-+{
-+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-+
-+ spin_lock(&trans_pcie->irq_lock);
-+ _iwl_enable_interrupts(trans);
-+ spin_unlock(&trans_pcie->irq_lock);
-+}
- static inline void iwl_enable_hw_int_msk_msix(struct iwl_trans *trans, u32 msk)
- {
- struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-index 0a4a3c5..aaaf2ad 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-@@ -1507,7 +1507,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
- * have anything to service
- */
- if (test_bit(STATUS_INT_ENABLED, &trans->status))
-- iwl_enable_interrupts(trans);
-+ _iwl_enable_interrupts(trans);
- spin_unlock(&trans_pcie->irq_lock);
- lock_map_release(&trans->sync_cmd_lockdep_map);
- return IRQ_NONE;
-@@ -1699,15 +1699,17 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
- inta & ~trans_pcie->inta_mask);
- }
-
-+ spin_lock(&trans_pcie->irq_lock);
-+ /* only Re-enable all interrupt if disabled by irq */
-+ if (test_bit(STATUS_INT_ENABLED, &trans->status))
-+ _iwl_enable_interrupts(trans);
- /* we are loading the firmware, enable FH_TX interrupt only */
-- if (handled & CSR_INT_BIT_FH_TX)
-+ else if (handled & CSR_INT_BIT_FH_TX)
- iwl_enable_fw_load_int(trans);
-- /* only Re-enable all interrupt if disabled by irq */
-- else if (test_bit(STATUS_INT_ENABLED, &trans->status))
-- iwl_enable_interrupts(trans);
- /* Re-enable RF_KILL if it occurred */
- else if (handled & CSR_INT_BIT_RF_KILL)
- iwl_enable_rfkill_int(trans);
-+ spin_unlock(&trans_pcie->irq_lock);
-
- out:
- lock_map_release(&trans->sync_cmd_lockdep_map);
-@@ -1771,7 +1773,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
- return;
-
- spin_lock(&trans_pcie->irq_lock);
-- iwl_disable_interrupts(trans);
-+ _iwl_disable_interrupts(trans);
-
- memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
-
-@@ -1787,7 +1789,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
- trans_pcie->use_ict = true;
- trans_pcie->ict_index = 0;
- iwl_write32(trans, CSR_INT, trans_pcie->inta_mask);
-- iwl_enable_interrupts(trans);
-+ _iwl_enable_interrupts(trans);
- spin_unlock(&trans_pcie->irq_lock);
- }
-
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-index f603d78..d9f1394 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-@@ -801,6 +801,8 @@ static int iwl_pcie_load_cpu_sections_8000(struct iwl_trans *trans,
-
- *first_ucode_section = last_read_idx;
-
-+ iwl_enable_interrupts(trans);
-+
- if (cpu == 1)
- iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
- else
-@@ -980,6 +982,8 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
- iwl_pcie_apply_destination(trans);
- }
-
-+ iwl_enable_interrupts(trans);
-+
- /* release CPU reset */
- iwl_write32(trans, CSR_RESET, 0);
-
-@@ -1033,9 +1037,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
- was_hw_rfkill = iwl_is_rfkill_set(trans);
-
- /* tell the device to stop sending interrupts */
-- spin_lock(&trans_pcie->irq_lock);
- iwl_disable_interrupts(trans);
-- spin_unlock(&trans_pcie->irq_lock);
-
- /* device going down, Stop using ICT table */
- iwl_pcie_disable_ict(trans);
-@@ -1079,9 +1081,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
- * the time, unless the interrupt is ACKed even if the interrupt
- * should be masked. Re-ACK all the interrupts here.
- */
-- spin_lock(&trans_pcie->irq_lock);
- iwl_disable_interrupts(trans);
-- spin_unlock(&trans_pcie->irq_lock);
-
- /* clear all status bits */
- clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
-@@ -1215,7 +1215,6 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
- ret = iwl_pcie_load_given_ucode_8000(trans, fw);
- else
- ret = iwl_pcie_load_given_ucode(trans, fw);
-- iwl_enable_interrupts(trans);
-
- /* re-check RF-Kill state since we may have missed the interrupt */
- hw_rfkill = iwl_is_rfkill_set(trans);
-@@ -1567,15 +1566,11 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
- mutex_lock(&trans_pcie->mutex);
-
- /* disable interrupts - don't enable HW RF kill interrupt */
-- spin_lock(&trans_pcie->irq_lock);
- iwl_disable_interrupts(trans);
-- spin_unlock(&trans_pcie->irq_lock);
-
- iwl_pcie_apm_stop(trans, true);
-
-- spin_lock(&trans_pcie->irq_lock);
- iwl_disable_interrupts(trans);
-- spin_unlock(&trans_pcie->irq_lock);
-
- iwl_pcie_disable_ict(trans);
-
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index ebf84e3..8bb3d1a 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -112,6 +112,7 @@ static ssize_t of_node_property_read(struct file *filp, struct kobject *kobj,
- return memory_read_from_buffer(buf, count, &offset, pp->value, pp->length);
- }
-
-+/* always return newly allocated name, caller must free after use */
- static const char *safe_name(struct kobject *kobj, const char *orig_name)
- {
- const char *name = orig_name;
-@@ -126,9 +127,12 @@ static const char *safe_name(struct kobject *kobj, const char *orig_name)
- name = kasprintf(GFP_KERNEL, "%s#%i", orig_name, ++i);
- }
-
-- if (name != orig_name)
-+ if (name == orig_name) {
-+ name = kstrdup(orig_name, GFP_KERNEL);
-+ } else {
- pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n",
- kobject_name(kobj), name);
-+ }
- return name;
- }
-
-@@ -159,6 +163,7 @@ int __of_add_property_sysfs(struct device_node *np, struct property *pp)
- int __of_attach_node_sysfs(struct device_node *np)
- {
- const char *name;
-+ struct kobject *parent;
- struct property *pp;
- int rc;
-
-@@ -171,15 +176,16 @@ int __of_attach_node_sysfs(struct device_node *np)
- np->kobj.kset = of_kset;
- if (!np->parent) {
- /* Nodes without parents are new top level trees */
-- rc = kobject_add(&np->kobj, NULL, "%s",
-- safe_name(&of_kset->kobj, "base"));
-+ name = safe_name(&of_kset->kobj, "base");
-+ parent = NULL;
- } else {
- name = safe_name(&np->parent->kobj, kbasename(np->full_name));
-- if (!name || !name[0])
-- return -EINVAL;
--
-- rc = kobject_add(&np->kobj, &np->parent->kobj, "%s", name);
-+ parent = &np->parent->kobj;
- }
-+ if (!name)
-+ return -ENOMEM;
-+ rc = kobject_add(&np->kobj, parent, "%s", name);
-+ kfree(name);
- if (rc)
- return rc;
-
-@@ -1815,6 +1821,12 @@ int __of_remove_property(struct device_node *np, struct property *prop)
- return 0;
- }
-
-+void __of_sysfs_remove_bin_file(struct device_node *np, struct property *prop)
-+{
-+ sysfs_remove_bin_file(&np->kobj, &prop->attr);
-+ kfree(prop->attr.attr.name);
-+}
-+
- void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
- {
- if (!IS_ENABLED(CONFIG_SYSFS))
-@@ -1822,7 +1834,7 @@ void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
-
- /* at early boot, bail here and defer setup to of_init() */
- if (of_kset && of_node_is_attached(np))
-- sysfs_remove_bin_file(&np->kobj, &prop->attr);
-+ __of_sysfs_remove_bin_file(np, prop);
- }
-
- /**
-@@ -1895,7 +1907,7 @@ void __of_update_property_sysfs(struct device_node *np, struct property *newprop
- return;
-
- if (oldprop)
-- sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
-+ __of_sysfs_remove_bin_file(np, oldprop);
- __of_add_property_sysfs(np, newprop);
- }
-
-diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
-index 3033fa3..a201559 100644
---- a/drivers/of/dynamic.c
-+++ b/drivers/of/dynamic.c
-@@ -55,7 +55,7 @@ void __of_detach_node_sysfs(struct device_node *np)
- /* only remove properties if on sysfs */
- if (of_node_is_attached(np)) {
- for_each_property_of_node(np, pp)
-- sysfs_remove_bin_file(&np->kobj, &pp->attr);
-+ __of_sysfs_remove_bin_file(np, pp);
- kobject_del(&np->kobj);
- }
-
-diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
-index 829469f..18bbb451 100644
---- a/drivers/of/of_private.h
-+++ b/drivers/of/of_private.h
-@@ -83,6 +83,9 @@ extern int __of_attach_node_sysfs(struct device_node *np);
- extern void __of_detach_node(struct device_node *np);
- extern void __of_detach_node_sysfs(struct device_node *np);
-
-+extern void __of_sysfs_remove_bin_file(struct device_node *np,
-+ struct property *prop);
-+
- /* iterators for transactions, used for overlays */
- /* forward iterator */
- #define for_each_transaction_entry(_oft, _te) \
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index ee72ebe..7902fbf 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -3189,13 +3189,15 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
- }
-
- /*
-- * Atheros AR93xx chips do not behave after a bus reset. The device will
-- * throw a Link Down error on AER-capable systems and regardless of AER,
-- * config space of the device is never accessible again and typically
-- * causes the system to hang or reset when access is attempted.
-+ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset.
-+ * The device will throw a Link Down error on AER-capable systems and
-+ * regardless of AER, config space of the device is never accessible again
-+ * and typically causes the system to hang or reset when access is attempted.
- * http://www.spinics.net/lists/linux-pci/msg34797.html
- */
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
-
- static void quirk_no_pm_reset(struct pci_dev *dev)
- {
-diff --git a/drivers/phy/phy-rcar-gen3-usb2.c b/drivers/phy/phy-rcar-gen3-usb2.c
-index 4be3f5d..31156c9 100644
---- a/drivers/phy/phy-rcar-gen3-usb2.c
-+++ b/drivers/phy/phy-rcar-gen3-usb2.c
-@@ -21,6 +21,7 @@
- #include <linux/phy/phy.h>
- #include <linux/platform_device.h>
- #include <linux/regulator/consumer.h>
-+#include <linux/workqueue.h>
-
- /******* USB2.0 Host registers (original offset is +0x200) *******/
- #define USB2_INT_ENABLE 0x000
-@@ -81,9 +82,25 @@ struct rcar_gen3_chan {
- struct extcon_dev *extcon;
- struct phy *phy;
- struct regulator *vbus;
-+ struct work_struct work;
-+ bool extcon_host;
- bool has_otg;
- };
-
-+static void rcar_gen3_phy_usb2_work(struct work_struct *work)
-+{
-+ struct rcar_gen3_chan *ch = container_of(work, struct rcar_gen3_chan,
-+ work);
-+
-+ if (ch->extcon_host) {
-+ extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true);
-+ extcon_set_cable_state_(ch->extcon, EXTCON_USB, false);
-+ } else {
-+ extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false);
-+ extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
-+ }
-+}
-+
- static void rcar_gen3_set_host_mode(struct rcar_gen3_chan *ch, int host)
- {
- void __iomem *usb2_base = ch->base;
-@@ -130,8 +147,8 @@ static void rcar_gen3_init_for_host(struct rcar_gen3_chan *ch)
- rcar_gen3_set_host_mode(ch, 1);
- rcar_gen3_enable_vbus_ctrl(ch, 1);
-
-- extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true);
-- extcon_set_cable_state_(ch->extcon, EXTCON_USB, false);
-+ ch->extcon_host = true;
-+ schedule_work(&ch->work);
- }
-
- static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
-@@ -140,8 +157,8 @@ static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
- rcar_gen3_set_host_mode(ch, 0);
- rcar_gen3_enable_vbus_ctrl(ch, 0);
-
-- extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false);
-- extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
-+ ch->extcon_host = false;
-+ schedule_work(&ch->work);
- }
-
- static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
-@@ -301,6 +318,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
- if (irq >= 0) {
- int ret;
-
-+ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
- irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq,
- IRQF_SHARED, dev_name(dev), channel);
- if (irq < 0)
-diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
-index ac4f564..bf65c94 100644
---- a/drivers/pinctrl/intel/pinctrl-cherryview.c
-+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
-@@ -160,7 +160,6 @@ struct chv_pin_context {
- * @pctldev: Pointer to the pin controller device
- * @chip: GPIO chip in this pin controller
- * @regs: MMIO registers
-- * @lock: Lock to serialize register accesses
- * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
- * offset (in GPIO number space)
- * @community: Community this pinctrl instance represents
-@@ -174,7 +173,6 @@ struct chv_pinctrl {
- struct pinctrl_dev *pctldev;
- struct gpio_chip chip;
- void __iomem *regs;
-- raw_spinlock_t lock;
- unsigned intr_lines[16];
- const struct chv_community *community;
- u32 saved_intmask;
-@@ -657,6 +655,17 @@ static const struct chv_community *chv_communities[] = {
- &southeast_community,
- };
-
-+/*
-+ * Lock to serialize register accesses
-+ *
-+ * Due to a silicon issue, a shared lock must be used to prevent
-+ * concurrent accesses across the 4 GPIO controllers.
-+ *
-+ * See Intel Atom Z8000 Processor Series Specification Update (Rev. 005),
-+ * errata #CHT34, for further information.
-+ */
-+static DEFINE_RAW_SPINLOCK(chv_lock);
-+
- static void __iomem *chv_padreg(struct chv_pinctrl *pctrl, unsigned offset,
- unsigned reg)
- {
-@@ -718,13 +727,13 @@ static void chv_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
- u32 ctrl0, ctrl1;
- bool locked;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- ctrl0 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0));
- ctrl1 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL1));
- locked = chv_pad_locked(pctrl, offset);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- if (ctrl0 & CHV_PADCTRL0_GPIOEN) {
- seq_puts(s, "GPIO ");
-@@ -787,14 +796,14 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
-
- grp = &pctrl->community->groups[group];
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- /* Check first that the pad is not locked */
- for (i = 0; i < grp->npins; i++) {
- if (chv_pad_locked(pctrl, grp->pins[i])) {
- dev_warn(pctrl->dev, "unable to set mode for locked pin %u\n",
- grp->pins[i]);
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- return -EBUSY;
- }
- }
-@@ -837,7 +846,7 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
- pin, altfunc->mode, altfunc->invert_oe ? "" : "not ");
- }
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- return 0;
- }
-@@ -851,13 +860,13 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev,
- void __iomem *reg;
- u32 value;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- if (chv_pad_locked(pctrl, offset)) {
- value = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0));
- if (!(value & CHV_PADCTRL0_GPIOEN)) {
- /* Locked so cannot enable */
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- return -EBUSY;
- }
- } else {
-@@ -897,7 +906,7 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev,
- chv_writel(value, reg);
- }
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- return 0;
- }
-@@ -911,13 +920,13 @@ static void chv_gpio_disable_free(struct pinctrl_dev *pctldev,
- void __iomem *reg;
- u32 value;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- reg = chv_padreg(pctrl, offset, CHV_PADCTRL0);
- value = readl(reg) & ~CHV_PADCTRL0_GPIOEN;
- chv_writel(value, reg);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
-
- static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
-@@ -929,7 +938,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
- unsigned long flags;
- u32 ctrl0;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- ctrl0 = readl(reg) & ~CHV_PADCTRL0_GPIOCFG_MASK;
- if (input)
-@@ -938,7 +947,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
- ctrl0 |= CHV_PADCTRL0_GPIOCFG_GPO << CHV_PADCTRL0_GPIOCFG_SHIFT;
- chv_writel(ctrl0, reg);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- return 0;
- }
-@@ -963,10 +972,10 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin,
- u16 arg = 0;
- u32 term;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
- ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- ctrl1 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL1));
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- term = (ctrl0 & CHV_PADCTRL0_TERM_MASK) >> CHV_PADCTRL0_TERM_SHIFT;
-
-@@ -1040,7 +1049,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- unsigned long flags;
- u32 ctrl0, pull;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
- ctrl0 = readl(reg);
-
- switch (param) {
-@@ -1063,7 +1072,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT;
- break;
- default:
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- return -EINVAL;
- }
-
-@@ -1081,7 +1090,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT;
- break;
- default:
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- return -EINVAL;
- }
-
-@@ -1089,12 +1098,12 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- break;
-
- default:
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- return -EINVAL;
- }
-
- chv_writel(ctrl0, reg);
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- return 0;
- }
-@@ -1160,9 +1169,9 @@ static int chv_gpio_get(struct gpio_chip *chip, unsigned offset)
- unsigned long flags;
- u32 ctrl0, cfg;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
- ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- cfg = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK;
- cfg >>= CHV_PADCTRL0_GPIOCFG_SHIFT;
-@@ -1180,7 +1189,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- void __iomem *reg;
- u32 ctrl0;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- reg = chv_padreg(pctrl, pin, CHV_PADCTRL0);
- ctrl0 = readl(reg);
-@@ -1192,7 +1201,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-
- chv_writel(ctrl0, reg);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
-
- static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
-@@ -1202,9 +1211,9 @@ static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
- u32 ctrl0, direction;
- unsigned long flags;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
- ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- direction = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK;
- direction >>= CHV_PADCTRL0_GPIOCFG_SHIFT;
-@@ -1242,14 +1251,14 @@ static void chv_gpio_irq_ack(struct irq_data *d)
- int pin = chv_gpio_offset_to_pin(pctrl, irqd_to_hwirq(d));
- u32 intr_line;
-
-- raw_spin_lock(&pctrl->lock);
-+ raw_spin_lock(&chv_lock);
-
- intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- intr_line &= CHV_PADCTRL0_INTSEL_MASK;
- intr_line >>= CHV_PADCTRL0_INTSEL_SHIFT;
- chv_writel(BIT(intr_line), pctrl->regs + CHV_INTSTAT);
-
-- raw_spin_unlock(&pctrl->lock);
-+ raw_spin_unlock(&chv_lock);
- }
-
- static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
-@@ -1260,7 +1269,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
- u32 value, intr_line;
- unsigned long flags;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- intr_line &= CHV_PADCTRL0_INTSEL_MASK;
-@@ -1273,7 +1282,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
- value |= BIT(intr_line);
- chv_writel(value, pctrl->regs + CHV_INTMASK);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
-
- static void chv_gpio_irq_mask(struct irq_data *d)
-@@ -1307,7 +1316,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d)
- unsigned long flags;
- u32 intsel, value;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
- intsel = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- intsel &= CHV_PADCTRL0_INTSEL_MASK;
- intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
-@@ -1322,7 +1331,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d)
- irq_set_handler_locked(d, handler);
- pctrl->intr_lines[intsel] = offset;
- }
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
-
- chv_gpio_irq_unmask(d);
-@@ -1338,7 +1347,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
- unsigned long flags;
- u32 value;
-
-- raw_spin_lock_irqsave(&pctrl->lock, flags);
-+ raw_spin_lock_irqsave(&chv_lock, flags);
-
- /*
- * Pins which can be used as shared interrupt are configured in
-@@ -1387,7 +1396,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
- else if (type & IRQ_TYPE_LEVEL_MASK)
- irq_set_handler_locked(d, handle_level_irq);
-
-- raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+ raw_spin_unlock_irqrestore(&chv_lock, flags);
-
- return 0;
- }
-@@ -1499,7 +1508,6 @@ static int chv_pinctrl_probe(struct platform_device *pdev)
- if (i == ARRAY_SIZE(chv_communities))
- return -ENODEV;
-
-- raw_spin_lock_init(&pctrl->lock);
- pctrl->dev = &pdev->dev;
-
- #ifdef CONFIG_PM_SLEEP
-diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
-index 6f145f2..96ffda4 100644
---- a/drivers/platform/x86/hp-wmi.c
-+++ b/drivers/platform/x86/hp-wmi.c
-@@ -718,6 +718,11 @@ static int __init hp_wmi_rfkill_setup(struct platform_device *device)
- if (err)
- return err;
-
-+ err = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, &wireless,
-+ sizeof(wireless), 0);
-+ if (err)
-+ return err;
-+
- if (wireless & 0x1) {
- wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
- RFKILL_TYPE_WLAN,
-@@ -882,7 +887,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
- wwan_rfkill = NULL;
- rfkill2_count = 0;
-
-- if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device))
-+ if (hp_wmi_rfkill_setup(device))
- hp_wmi_rfkill2_setup(device);
-
- err = device_create_file(&device->dev, &dev_attr_display);
-diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
-index 02fb6b4..d838e77 100644
---- a/drivers/regulator/s2mps11.c
-+++ b/drivers/regulator/s2mps11.c
-@@ -750,7 +750,7 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges3[] = {
-
- /* voltage range for s2mps15 LDO 7, 8, 9 and 10 */
- static const struct regulator_linear_range s2mps15_ldo_voltage_ranges4[] = {
-- REGULATOR_LINEAR_RANGE(700000, 0xc, 0x18, 25000),
-+ REGULATOR_LINEAR_RANGE(700000, 0x10, 0x20, 25000),
- };
-
- /* voltage range for s2mps15 LDO 1 */
-@@ -760,12 +760,12 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges5[] = {
-
- /* voltage range for s2mps15 BUCK 1, 2, 3, 4, 5, 6 and 7 */
- static const struct regulator_linear_range s2mps15_buck_voltage_ranges1[] = {
-- REGULATOR_LINEAR_RANGE(500000, 0x20, 0xb0, 6250),
-+ REGULATOR_LINEAR_RANGE(500000, 0x20, 0xc0, 6250),
- };
-
- /* voltage range for s2mps15 BUCK 8, 9 and 10 */
- static const struct regulator_linear_range s2mps15_buck_voltage_ranges2[] = {
-- REGULATOR_LINEAR_RANGE(1000000, 0x20, 0xc0, 12500),
-+ REGULATOR_LINEAR_RANGE(1000000, 0x20, 0x78, 12500),
- };
-
- static const struct regulator_desc s2mps15_regulators[] = {
-diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
-index db3958b..fe0539e 100644
---- a/drivers/remoteproc/remoteproc_core.c
-+++ b/drivers/remoteproc/remoteproc_core.c
-@@ -1264,11 +1264,6 @@ int rproc_add(struct rproc *rproc)
- if (ret < 0)
- return ret;
-
-- /* expose to rproc_get_by_phandle users */
-- mutex_lock(&rproc_list_mutex);
-- list_add(&rproc->node, &rproc_list);
-- mutex_unlock(&rproc_list_mutex);
--
- dev_info(dev, "%s is available\n", rproc->name);
-
- dev_info(dev, "Note: remoteproc is still under development and considered experimental.\n");
-@@ -1276,8 +1271,16 @@ int rproc_add(struct rproc *rproc)
-
- /* create debugfs entries */
- rproc_create_debug_dir(rproc);
-+ ret = rproc_add_virtio_devices(rproc);
-+ if (ret < 0)
-+ return ret;
-
-- return rproc_add_virtio_devices(rproc);
-+ /* expose to rproc_get_by_phandle users */
-+ mutex_lock(&rproc_list_mutex);
-+ list_add(&rproc->node, &rproc_list);
-+ mutex_unlock(&rproc_list_mutex);
-+
-+ return 0;
- }
- EXPORT_SYMBOL(rproc_add);
-
-diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
-index d01ad7e..4e823c4 100644
---- a/drivers/rtc/rtc-s3c.c
-+++ b/drivers/rtc/rtc-s3c.c
-@@ -149,12 +149,14 @@ static int s3c_rtc_setfreq(struct s3c_rtc *info, int freq)
- if (!is_power_of_2(freq))
- return -EINVAL;
-
-+ s3c_rtc_enable_clk(info);
- spin_lock_irq(&info->pie_lock);
-
- if (info->data->set_freq)
- info->data->set_freq(info, freq);
-
- spin_unlock_irq(&info->pie_lock);
-+ s3c_rtc_disable_clk(info);
-
- return 0;
- }
-diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
-index b2afad5..2a34eb5 100644
---- a/drivers/s390/cio/cmf.c
-+++ b/drivers/s390/cio/cmf.c
-@@ -753,6 +753,17 @@ static void reset_cmb(struct ccw_device *cdev)
- cmf_generic_reset(cdev);
- }
-
-+static int cmf_enabled(struct ccw_device *cdev)
-+{
-+ int enabled;
-+
-+ spin_lock_irq(cdev->ccwlock);
-+ enabled = !!cdev->private->cmb;
-+ spin_unlock_irq(cdev->ccwlock);
-+
-+ return enabled;
-+}
-+
- static struct attribute_group cmf_attr_group;
-
- static struct cmb_operations cmbops_basic = {
-@@ -1153,13 +1164,8 @@ static ssize_t cmb_enable_show(struct device *dev,
- char *buf)
- {
- struct ccw_device *cdev = to_ccwdev(dev);
-- int enabled;
-
-- spin_lock_irq(cdev->ccwlock);
-- enabled = !!cdev->private->cmb;
-- spin_unlock_irq(cdev->ccwlock);
--
-- return sprintf(buf, "%d\n", enabled);
-+ return sprintf(buf, "%d\n", cmf_enabled(cdev));
- }
-
- static ssize_t cmb_enable_store(struct device *dev,
-@@ -1199,15 +1205,20 @@ int ccw_set_cmf(struct ccw_device *cdev, int enable)
- * @cdev: The ccw device to be enabled
- *
- * Returns %0 for success or a negative error value.
-- *
-+ * Note: If this is called on a device for which channel measurement is already
-+ * enabled a reset of the measurement data is triggered.
- * Context:
- * non-atomic
- */
- int enable_cmf(struct ccw_device *cdev)
- {
-- int ret;
-+ int ret = 0;
-
- device_lock(&cdev->dev);
-+ if (cmf_enabled(cdev)) {
-+ cmbops->reset(cdev);
-+ goto out_unlock;
-+ }
- get_device(&cdev->dev);
- ret = cmbops->alloc(cdev);
- if (ret)
-@@ -1226,7 +1237,7 @@ int enable_cmf(struct ccw_device *cdev)
- out:
- if (ret)
- put_device(&cdev->dev);
--
-+out_unlock:
- device_unlock(&cdev->dev);
- return ret;
- }
-diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
-index 3bd0be6..c7e5695 100644
---- a/drivers/scsi/lpfc/lpfc_scsi.c
-+++ b/drivers/scsi/lpfc/lpfc_scsi.c
-@@ -3874,7 +3874,7 @@ int lpfc_sli4_scmd_to_wqidx_distr(struct lpfc_hba *phba,
- uint32_t tag;
- uint16_t hwq;
-
-- if (shost_use_blk_mq(cmnd->device->host)) {
-+ if (cmnd && shost_use_blk_mq(cmnd->device->host)) {
- tag = blk_mq_unique_tag(cmnd->request);
- hwq = blk_mq_unique_tag_to_hwq(tag);
-
-diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
-index f4b0690..2dab3dc 100644
---- a/drivers/scsi/megaraid/megaraid_sas_base.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
-@@ -4079,6 +4079,12 @@ megasas_get_pd_list(struct megasas_instance *instance)
- struct MR_PD_ADDRESS *pd_addr;
- dma_addr_t ci_h = 0;
-
-+ if (instance->pd_list_not_supported) {
-+ dev_info(&instance->pdev->dev, "MR_DCMD_PD_LIST_QUERY "
-+ "not supported by firmware\n");
-+ return ret;
-+ }
-+
- cmd = megasas_get_cmd(instance);
-
- if (!cmd) {
-diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
-index f1eed7f..9c2788b 100644
---- a/drivers/soc/qcom/smp2p.c
-+++ b/drivers/soc/qcom/smp2p.c
-@@ -344,11 +344,12 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p,
- /* Allocate an entry from the smem item */
- strlcpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME);
- memcpy_toio(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME);
-- out->valid_entries++;
-
- /* Make the logical entry reference the physical value */
- entry->value = &out->entries[out->valid_entries].value;
-
-+ out->valid_entries++;
-+
- entry->state = qcom_smem_state_register(node, &smp2p_state_ops, entry);
- if (IS_ERR(entry->state)) {
- dev_err(smp2p->dev, "failed to register qcom_smem_state\n");
-diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
-index fe07c05..daf2844 100644
---- a/drivers/spi/spi-pxa2xx.c
-+++ b/drivers/spi/spi-pxa2xx.c
-@@ -585,7 +585,14 @@ static void reset_sccr1(struct driver_data *drv_data)
- u32 sccr1_reg;
-
- sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1) & ~drv_data->int_cr1;
-- sccr1_reg &= ~SSCR1_RFT;
-+ switch (drv_data->ssp_type) {
-+ case QUARK_X1000_SSP:
-+ sccr1_reg &= ~QUARK_X1000_SSCR1_RFT;
-+ break;
-+ default:
-+ sccr1_reg &= ~SSCR1_RFT;
-+ break;
-+ }
- sccr1_reg |= chip->threshold;
- pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg);
- }
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 50f3d3a..39b928c 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -492,7 +492,8 @@ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
- bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
-
- spin_lock_bh(&conn->cmd_lock);
-- if (!list_empty(&cmd->i_conn_node))
-+ if (!list_empty(&cmd->i_conn_node) &&
-+ !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
- list_del_init(&cmd->i_conn_node);
- spin_unlock_bh(&conn->cmd_lock);
-
-@@ -4034,6 +4035,7 @@ int iscsi_target_rx_thread(void *arg)
-
- static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
- {
-+ LIST_HEAD(tmp_list);
- struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL;
- struct iscsi_session *sess = conn->sess;
- /*
-@@ -4042,18 +4044,26 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
- * has been reset -> returned sleeping pre-handler state.
- */
- spin_lock_bh(&conn->cmd_lock);
-- list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
-+ list_splice_init(&conn->conn_cmd_list, &tmp_list);
-
-+ list_for_each_entry(cmd, &tmp_list, i_conn_node) {
-+ struct se_cmd *se_cmd = &cmd->se_cmd;
-+
-+ if (se_cmd->se_tfo != NULL) {
-+ spin_lock(&se_cmd->t_state_lock);
-+ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
-+ spin_unlock(&se_cmd->t_state_lock);
-+ }
-+ }
-+ spin_unlock_bh(&conn->cmd_lock);
-+
-+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
- list_del_init(&cmd->i_conn_node);
-- spin_unlock_bh(&conn->cmd_lock);
-
- iscsit_increment_maxcmdsn(cmd, sess);
--
- iscsit_free_cmd(cmd, true);
-
-- spin_lock_bh(&conn->cmd_lock);
- }
-- spin_unlock_bh(&conn->cmd_lock);
- }
-
- static void iscsit_stop_timers_for_cmds(
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index b5212f0..adf419f 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -1371,8 +1371,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
- }
- login->zero_tsih = zero_tsih;
-
-- conn->sess->se_sess->sup_prot_ops =
-- conn->conn_transport->iscsit_get_sup_prot_ops(conn);
-+ if (conn->sess)
-+ conn->sess->se_sess->sup_prot_ops =
-+ conn->conn_transport->iscsit_get_sup_prot_ops(conn);
-
- tpg = conn->tpg;
- if (!tpg) {
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index a4046ca..6b42348 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -821,13 +821,15 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
- * in ATA and we need to set TPE=1
- */
- bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
-- struct request_queue *q, int block_size)
-+ struct request_queue *q)
- {
-+ int block_size = queue_logical_block_size(q);
-+
- if (!blk_queue_discard(q))
- return false;
-
-- attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
-- block_size;
-+ attrib->max_unmap_lba_count =
-+ q->limits.max_discard_sectors >> (ilog2(block_size) - 9);
- /*
- * Currently hardcoded to 1 in Linux/SCSI code..
- */
-diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
-index 75f0f08..7929186 100644
---- a/drivers/target/target_core_file.c
-+++ b/drivers/target/target_core_file.c
-@@ -161,8 +161,7 @@ static int fd_configure_device(struct se_device *dev)
- dev_size, div_u64(dev_size, fd_dev->fd_block_size),
- fd_dev->fd_block_size);
-
-- if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-- fd_dev->fd_block_size))
-+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
- pr_debug("IFILE: BLOCK Discard support available,"
- " disabled by default\n");
- /*
-diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
-index 7c4efb4..2077bc2 100644
---- a/drivers/target/target_core_iblock.c
-+++ b/drivers/target/target_core_iblock.c
-@@ -121,8 +121,7 @@ static int iblock_configure_device(struct se_device *dev)
- dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
- dev->dev_attrib.hw_queue_depth = q->nr_requests;
-
-- if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-- dev->dev_attrib.hw_block_size))
-+ if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
- pr_debug("IBLOCK: BLOCK Discard support available,"
- " disabled by default\n");
-
-diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
-index fc91e85..e2c970a 100644
---- a/drivers/target/target_core_internal.h
-+++ b/drivers/target/target_core_internal.h
-@@ -146,6 +146,7 @@ sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
- void target_qf_do_work(struct work_struct *work);
- bool target_check_wce(struct se_device *dev);
- bool target_check_fua(struct se_device *dev);
-+void __target_execute_cmd(struct se_cmd *, bool);
-
- /* target_core_stat.c */
- void target_stat_setup_dev_default_groups(struct se_device *);
-diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
-index a9057aa..04f616b 100644
---- a/drivers/target/target_core_sbc.c
-+++ b/drivers/target/target_core_sbc.c
-@@ -602,7 +602,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
- cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT;
- spin_unlock_irq(&cmd->t_state_lock);
-
-- __target_execute_cmd(cmd);
-+ __target_execute_cmd(cmd, false);
-
- kfree(buf);
- return ret;
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 5ab3967..42c2a44 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -1303,23 +1303,6 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
-
- trace_target_sequencer_start(cmd);
-
-- /*
-- * Check for an existing UNIT ATTENTION condition
-- */
-- ret = target_scsi3_ua_check(cmd);
-- if (ret)
-- return ret;
--
-- ret = target_alua_state_check(cmd);
-- if (ret)
-- return ret;
--
-- ret = target_check_reservation(cmd);
-- if (ret) {
-- cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
-- return ret;
-- }
--
- ret = dev->transport->parse_cdb(cmd);
- if (ret == TCM_UNSUPPORTED_SCSI_OPCODE)
- pr_warn_ratelimited("%s/%s: Unsupported SCSI Opcode 0x%02x, sending CHECK_CONDITION.\n",
-@@ -1761,20 +1744,45 @@ queue_full:
- }
- EXPORT_SYMBOL(transport_generic_request_failure);
-
--void __target_execute_cmd(struct se_cmd *cmd)
-+void __target_execute_cmd(struct se_cmd *cmd, bool do_checks)
- {
- sense_reason_t ret;
-
-- if (cmd->execute_cmd) {
-- ret = cmd->execute_cmd(cmd);
-- if (ret) {
-- spin_lock_irq(&cmd->t_state_lock);
-- cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT);
-- spin_unlock_irq(&cmd->t_state_lock);
-+ if (!cmd->execute_cmd) {
-+ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-+ goto err;
-+ }
-+ if (do_checks) {
-+ /*
-+ * Check for an existing UNIT ATTENTION condition after
-+ * target_handle_task_attr() has done SAM task attr
-+ * checking, and possibly have already defered execution
-+ * out to target_restart_delayed_cmds() context.
-+ */
-+ ret = target_scsi3_ua_check(cmd);
-+ if (ret)
-+ goto err;
-+
-+ ret = target_alua_state_check(cmd);
-+ if (ret)
-+ goto err;
-
-- transport_generic_request_failure(cmd, ret);
-+ ret = target_check_reservation(cmd);
-+ if (ret) {
-+ cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
-+ goto err;
- }
- }
-+
-+ ret = cmd->execute_cmd(cmd);
-+ if (!ret)
-+ return;
-+err:
-+ spin_lock_irq(&cmd->t_state_lock);
-+ cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT);
-+ spin_unlock_irq(&cmd->t_state_lock);
-+
-+ transport_generic_request_failure(cmd, ret);
- }
-
- static int target_write_prot_action(struct se_cmd *cmd)
-@@ -1819,6 +1827,8 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
- if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
- return false;
-
-+ cmd->se_cmd_flags |= SCF_TASK_ATTR_SET;
-+
- /*
- * Check for the existence of HEAD_OF_QUEUE, and if true return 1
- * to allow the passed struct se_cmd list of tasks to the front of the list.
-@@ -1899,7 +1909,7 @@ void target_execute_cmd(struct se_cmd *cmd)
- return;
- }
-
-- __target_execute_cmd(cmd);
-+ __target_execute_cmd(cmd, true);
- }
- EXPORT_SYMBOL(target_execute_cmd);
-
-@@ -1923,7 +1933,7 @@ static void target_restart_delayed_cmds(struct se_device *dev)
- list_del(&cmd->se_delayed_node);
- spin_unlock(&dev->delayed_cmd_lock);
-
-- __target_execute_cmd(cmd);
-+ __target_execute_cmd(cmd, true);
-
- if (cmd->sam_task_attr == TCM_ORDERED_TAG)
- break;
-@@ -1941,6 +1951,9 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
- if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
- return;
-
-+ if (!(cmd->se_cmd_flags & SCF_TASK_ATTR_SET))
-+ goto restart;
-+
- if (cmd->sam_task_attr == TCM_SIMPLE_TAG) {
- atomic_dec_mb(&dev->simple_cmds);
- dev->dev_cur_ordered_id++;
-@@ -1957,7 +1970,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
- pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
- dev->dev_cur_ordered_id);
- }
--
-+restart:
- target_restart_delayed_cmds(dev);
- }
-
-@@ -2557,15 +2570,10 @@ static void target_release_cmd_kref(struct kref *kref)
- bool fabric_stop;
-
- spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
-- if (list_empty(&se_cmd->se_cmd_list)) {
-- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-- target_free_cmd_mem(se_cmd);
-- se_cmd->se_tfo->release_cmd(se_cmd);
-- return;
-- }
-
- spin_lock(&se_cmd->t_state_lock);
-- fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
-+ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP) &&
-+ (se_cmd->transport_state & CMD_T_ABORTED);
- spin_unlock(&se_cmd->t_state_lock);
-
- if (se_cmd->cmd_wait_set || fabric_stop) {
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 954941d..f9c798c 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -482,19 +482,21 @@ static void atmel_start_tx(struct uart_port *port)
- {
- struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
-
-- if (atmel_use_pdc_tx(port)) {
-- if (atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN)
-- /* The transmitter is already running. Yes, we
-- really need this.*/
-- return;
-+ if (atmel_use_pdc_tx(port) && (atmel_uart_readl(port, ATMEL_PDC_PTSR)
-+ & ATMEL_PDC_TXTEN))
-+ /* The transmitter is already running. Yes, we
-+ really need this.*/
-+ return;
-
-+ if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
- if ((port->rs485.flags & SER_RS485_ENABLED) &&
- !(port->rs485.flags & SER_RS485_RX_DURING_TX))
- atmel_stop_rx(port);
-
-+ if (atmel_use_pdc_tx(port))
- /* re-enable PDC transmit */
- atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN);
-- }
-+
- /* Enable interrupts */
- atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask);
- }
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index b7d80bd..7d62610 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -726,7 +726,7 @@ static void msm_handle_tx(struct uart_port *port)
- return;
- }
-
-- pio_count = CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE);
-+ pio_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
- dma_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
-
- dma_min = 1; /* Always DMA */
-diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
-index 99bb231..f0bd2ec 100644
---- a/drivers/tty/serial/samsung.c
-+++ b/drivers/tty/serial/samsung.c
-@@ -1684,7 +1684,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
- return -ENODEV;
-
- if (port->mapbase != 0)
-- return 0;
-+ return -EINVAL;
-
- /* setup info for port */
- port->dev = &platdev->dev;
-@@ -1738,22 +1738,25 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
- ourport->dma = devm_kzalloc(port->dev,
- sizeof(*ourport->dma),
- GFP_KERNEL);
-- if (!ourport->dma)
-- return -ENOMEM;
-+ if (!ourport->dma) {
-+ ret = -ENOMEM;
-+ goto err;
-+ }
- }
-
- ourport->clk = clk_get(&platdev->dev, "uart");
- if (IS_ERR(ourport->clk)) {
- pr_err("%s: Controller clock not found\n",
- dev_name(&platdev->dev));
-- return PTR_ERR(ourport->clk);
-+ ret = PTR_ERR(ourport->clk);
-+ goto err;
- }
-
- ret = clk_prepare_enable(ourport->clk);
- if (ret) {
- pr_err("uart: clock failed to prepare+enable: %d\n", ret);
- clk_put(ourport->clk);
-- return ret;
-+ goto err;
- }
-
- /* Keep all interrupts masked and cleared */
-@@ -1769,7 +1772,12 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
-
- /* reset the fifos (and setup the uart) */
- s3c24xx_serial_resetport(port, cfg);
-+
- return 0;
-+
-+err:
-+ port->mapbase = 0;
-+ return ret;
- }
-
- /* Device driver serial port probe */
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index 944a6dc..d2e50a2 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -128,6 +128,9 @@ static const struct usb_device_id usb_quirk_list[] = {
- { USB_DEVICE(0x04f3, 0x016f), .driver_info =
- USB_QUIRK_DEVICE_QUALIFIER },
-
-+ { USB_DEVICE(0x04f3, 0x0381), .driver_info =
-+ USB_QUIRK_NO_LPM },
-+
- { USB_DEVICE(0x04f3, 0x21b8), .driver_info =
- USB_QUIRK_DEVICE_QUALIFIER },
-
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 07248ff..716f4f0 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -258,11 +258,13 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- * We will also set SUSPHY bit to what it was before returning as stated
- * by the same section on Synopsys databook.
- */
-- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
-- if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
-- susphy = true;
-- reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
-- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
-+ if (dwc->gadget.speed <= USB_SPEED_HIGH) {
-+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
-+ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
-+ susphy = true;
-+ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
-+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
-+ }
- }
-
- if (cmd == DWC3_DEPCMD_STARTTRANSFER) {
-@@ -2023,6 +2025,10 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- return 1;
- }
-
-+ if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
-+ if ((event->status & DEPEVT_STATUS_IOC) &&
-+ (trb->ctrl & DWC3_TRB_CTRL_IOC))
-+ return 0;
- return 1;
- }
-
-diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
-index 18569de..bb1f6c8 100644
---- a/drivers/usb/gadget/udc/atmel_usba_udc.c
-+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
-@@ -1920,6 +1920,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
-
- udc->errata = match->data;
- udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
-+ if (IS_ERR(udc->pmc))
-+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
- if (udc->errata && IS_ERR(udc->pmc))
- return ERR_CAST(udc->pmc);
-
-diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
-index ebc51ec..7175142 100644
---- a/drivers/usb/gadget/udc/pch_udc.c
-+++ b/drivers/usb/gadget/udc/pch_udc.c
-@@ -1477,11 +1477,11 @@ static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req,
- req->dma_mapped = 0;
- }
- ep->halted = 1;
-- spin_lock(&dev->lock);
-+ spin_unlock(&dev->lock);
- if (!ep->in)
- pch_udc_ep_clear_rrdy(ep);
- usb_gadget_giveback_request(&ep->ep, &req->req);
-- spin_unlock(&dev->lock);
-+ spin_lock(&dev->lock);
- ep->halted = halted;
- }
-
-@@ -2573,9 +2573,9 @@ static void pch_udc_svc_ur_interrupt(struct pch_udc_dev *dev)
- empty_req_queue(ep);
- }
- if (dev->driver) {
-- spin_lock(&dev->lock);
-- usb_gadget_udc_reset(&dev->gadget, dev->driver);
- spin_unlock(&dev->lock);
-+ usb_gadget_udc_reset(&dev->gadget, dev->driver);
-+ spin_lock(&dev->lock);
- }
- }
-
-@@ -2654,9 +2654,9 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
- dev->ep[i].halted = 0;
- }
- dev->stall = 0;
-- spin_lock(&dev->lock);
-- dev->driver->setup(&dev->gadget, &dev->setup_data);
- spin_unlock(&dev->lock);
-+ dev->driver->setup(&dev->gadget, &dev->setup_data);
-+ spin_lock(&dev->lock);
- }
-
- /**
-@@ -2691,9 +2691,9 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
- dev->stall = 0;
-
- /* call gadget zero with setup data received */
-- spin_lock(&dev->lock);
-- dev->driver->setup(&dev->gadget, &dev->setup_data);
- spin_unlock(&dev->lock);
-+ dev->driver->setup(&dev->gadget, &dev->setup_data);
-+ spin_lock(&dev->lock);
- }
-
- /**
-diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
-index 7be4e7d..280ed5f 100644
---- a/drivers/usb/renesas_usbhs/fifo.c
-+++ b/drivers/usb/renesas_usbhs/fifo.c
-@@ -810,20 +810,27 @@ static void xfer_work(struct work_struct *work)
- {
- struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
- struct usbhs_pipe *pipe = pkt->pipe;
-- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe);
-+ struct usbhs_fifo *fifo;
- struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
- struct dma_async_tx_descriptor *desc;
-- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt);
-+ struct dma_chan *chan;
- struct device *dev = usbhs_priv_to_dev(priv);
- enum dma_transfer_direction dir;
-+ unsigned long flags;
-
-+ usbhs_lock(priv, flags);
-+ fifo = usbhs_pipe_to_fifo(pipe);
-+ if (!fifo)
-+ goto xfer_work_end;
-+
-+ chan = usbhsf_dma_chan_get(fifo, pkt);
- dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
-
- desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual,
- pkt->trans, dir,
- DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
- if (!desc)
-- return;
-+ goto xfer_work_end;
-
- desc->callback = usbhsf_dma_complete;
- desc->callback_param = pipe;
-@@ -831,7 +838,7 @@ static void xfer_work(struct work_struct *work)
- pkt->cookie = dmaengine_submit(desc);
- if (pkt->cookie < 0) {
- dev_err(dev, "Failed to submit dma descriptor\n");
-- return;
-+ goto xfer_work_end;
- }
-
- dev_dbg(dev, " %s %d (%d/ %d)\n",
-@@ -842,6 +849,9 @@ static void xfer_work(struct work_struct *work)
- usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
- dma_async_issue_pending(chan);
- usbhs_pipe_enable(pipe);
-+
-+xfer_work_end:
-+ usbhs_unlock(priv, flags);
- }
-
- /*
-diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
-index 30345c2..50f3363 100644
---- a/drivers/usb/renesas_usbhs/mod_gadget.c
-+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
-@@ -585,6 +585,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
- struct usbhs_pipe *pipe;
- int ret = -EIO;
-+ unsigned long flags;
-+
-+ usbhs_lock(priv, flags);
-
- /*
- * if it already have pipe,
-@@ -593,7 +596,8 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- if (uep->pipe) {
- usbhs_pipe_clear(uep->pipe);
- usbhs_pipe_sequence_data0(uep->pipe);
-- return 0;
-+ ret = 0;
-+ goto usbhsg_ep_enable_end;
- }
-
- pipe = usbhs_pipe_malloc(priv,
-@@ -621,6 +625,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- ret = 0;
- }
-
-+usbhsg_ep_enable_end:
-+ usbhs_unlock(priv, flags);
-+
- return ret;
- }
-
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index d96d423..8e07536 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -273,6 +273,7 @@ static void option_instat_callback(struct urb *urb);
- #define TELIT_PRODUCT_LE922_USBCFG5 0x1045
- #define TELIT_PRODUCT_LE920 0x1200
- #define TELIT_PRODUCT_LE910 0x1201
-+#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
-
- /* ZTE PRODUCTS */
- #define ZTE_VENDOR_ID 0x19d2
-@@ -1198,6 +1199,8 @@ static const struct usb_device_id option_ids[] = {
- .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
- { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
- .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
-+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
- .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
-diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
-index 476c0e3..f6ea8f4 100644
---- a/drivers/virtio/virtio_balloon.c
-+++ b/drivers/virtio/virtio_balloon.c
-@@ -202,6 +202,8 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
- num = min(num, ARRAY_SIZE(vb->pfns));
-
- mutex_lock(&vb->balloon_lock);
-+ /* We can't release more pages than taken */
-+ num = min(num, (size_t)vb->num_pages);
- for (vb->num_pfns = 0; vb->num_pfns < num;
- vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
- page = balloon_page_dequeue(vb_dev_info);
-diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
-index a2eec97..bb09de6 100644
---- a/drivers/w1/masters/omap_hdq.c
-+++ b/drivers/w1/masters/omap_hdq.c
-@@ -390,8 +390,6 @@ static int hdq_read_byte(struct hdq_data *hdq_data, u8 *val)
- goto out;
- }
-
-- hdq_data->hdq_irqstatus = 0;
--
- if (!(hdq_data->hdq_irqstatus & OMAP_HDQ_INT_STATUS_RXCOMPLETE)) {
- hdq_reg_merge(hdq_data, OMAP_HDQ_CTRL_STATUS,
- OMAP_HDQ_CTRL_STATUS_DIR | OMAP_HDQ_CTRL_STATUS_GO,
-diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index 75533ad..92fe3f8 100644
---- a/fs/btrfs/extent_io.c
-+++ b/fs/btrfs/extent_io.c
-@@ -2696,12 +2696,6 @@ struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask)
- btrfs_bio->csum = NULL;
- btrfs_bio->csum_allocated = NULL;
- btrfs_bio->end_io = NULL;
--
--#ifdef CONFIG_BLK_CGROUP
-- /* FIXME, put this into bio_clone_bioset */
-- if (bio->bi_css)
-- bio_associate_blkcg(new, bio->bi_css);
--#endif
- }
- return new;
- }
-diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 2234e88..b56887b 100644
---- a/fs/btrfs/file.c
-+++ b/fs/btrfs/file.c
-@@ -1629,13 +1629,11 @@ again:
- * managed to copy.
- */
- if (num_sectors > dirty_sectors) {
-- /*
-- * we round down because we don't want to count
-- * any partial blocks actually sent through the
-- * IO machines
-- */
-- release_bytes = round_down(release_bytes - copied,
-- root->sectorsize);
-+
-+ /* release everything except the sectors we dirtied */
-+ release_bytes -= dirty_sectors <<
-+ root->fs_info->sb->s_blocksize_bits;
-+
- if (copied > 0) {
- spin_lock(&BTRFS_I(inode)->lock);
- BTRFS_I(inode)->outstanding_extents++;
-diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
-index 4ae7500..3f7c2cd 100644
---- a/fs/cachefiles/namei.c
-+++ b/fs/cachefiles/namei.c
-@@ -263,6 +263,8 @@ requeue:
- void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
- struct cachefiles_object *object)
- {
-+ blkcnt_t i_blocks = d_backing_inode(object->dentry)->i_blocks;
-+
- write_lock(&cache->active_lock);
- rb_erase(&object->active_node, &cache->active_nodes);
- clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
-@@ -273,8 +275,7 @@ void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
- /* This object can now be culled, so we need to let the daemon know
- * that there is something it can remove if it needs to.
- */
-- atomic_long_add(d_backing_inode(object->dentry)->i_blocks,
-- &cache->b_released);
-+ atomic_long_add(i_blocks, &cache->b_released);
- if (atomic_inc_return(&cache->f_released))
- cachefiles_state_changed(cache);
- }
-diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
-index 3182273..1418daa 100644
---- a/fs/cifs/cifs_fs_sb.h
-+++ b/fs/cifs/cifs_fs_sb.h
-@@ -46,6 +46,9 @@
- #define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */
- #define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */
- #define CIFS_MOUNT_MAP_SFM_CHR 0x800000 /* SFM/MAC mapping for illegal chars */
-+#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible
-+ * root mountable
-+ */
-
- struct cifs_sb_info {
- struct rb_root tlink_tree;
-@@ -67,5 +70,6 @@ struct cifs_sb_info {
- struct backing_dev_info bdi;
- struct delayed_work prune_tlinks;
- struct rcu_head rcu;
-+ char *prepath;
- };
- #endif /* _CIFS_FS_SB_H */
-diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
-index 6aeb8d4..8347c90 100644
---- a/fs/cifs/cifsencrypt.c
-+++ b/fs/cifs/cifsencrypt.c
-@@ -743,24 +743,26 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
-
- memcpy(ses->auth_key.response + baselen, tiblob, tilen);
-
-+ mutex_lock(&ses->server->srv_mutex);
-+
- rc = crypto_hmacmd5_alloc(ses->server);
- if (rc) {
- cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- /* calculate ntlmv2_hash */
- rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp);
- if (rc) {
- cifs_dbg(VFS, "could not get v2 hash rc %d\n", rc);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- /* calculate first part of the client response (CR1) */
- rc = CalcNTLMv2_response(ses, ntlmv2_hash);
- if (rc) {
- cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- /* now calculate the session key for NTLMv2 */
-@@ -769,13 +771,13 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- if (rc) {
- cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n",
- __func__);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash);
- if (rc) {
- cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
-@@ -783,7 +785,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- CIFS_HMAC_MD5_HASH_SIZE);
- if (rc) {
- cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
-- goto setup_ntlmv2_rsp_ret;
-+ goto unlock;
- }
-
- rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash,
-@@ -791,6 +793,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- if (rc)
- cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
-
-+unlock:
-+ mutex_unlock(&ses->server->srv_mutex);
- setup_ntlmv2_rsp_ret:
- kfree(tiblob);
-
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 5d841f3..6bbec5e 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -689,6 +689,14 @@ cifs_do_mount(struct file_system_type *fs_type,
- goto out_cifs_sb;
- }
-
-+ if (volume_info->prepath) {
-+ cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
-+ if (cifs_sb->prepath == NULL) {
-+ root = ERR_PTR(-ENOMEM);
-+ goto out_cifs_sb;
-+ }
-+ }
-+
- cifs_setup_cifs_sb(volume_info, cifs_sb);
-
- rc = cifs_mount(cifs_sb, volume_info);
-@@ -727,7 +735,11 @@ cifs_do_mount(struct file_system_type *fs_type,
- sb->s_flags |= MS_ACTIVE;
- }
-
-- root = cifs_get_root(volume_info, sb);
-+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+ root = dget(sb->s_root);
-+ else
-+ root = cifs_get_root(volume_info, sb);
-+
- if (IS_ERR(root))
- goto out_super;
-
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 7d2b15c..7ae0328 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -1228,6 +1228,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
- vol->ops = &smb1_operations;
- vol->vals = &smb1_values;
-
-+ vol->echo_interval = SMB_ECHO_INTERVAL_DEFAULT;
-+
- if (!mountdata)
- goto cifs_parse_mount_err;
-
-@@ -2049,7 +2051,7 @@ static int match_server(struct TCP_Server_Info *server, struct smb_vol *vol)
- if (!match_security(server, vol))
- return 0;
-
-- if (server->echo_interval != vol->echo_interval)
-+ if (server->echo_interval != vol->echo_interval * HZ)
- return 0;
-
- return 1;
-@@ -3483,6 +3485,44 @@ cifs_get_volume_info(char *mount_data, const char *devname)
- return volume_info;
- }
-
-+static int
-+cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
-+ unsigned int xid,
-+ struct cifs_tcon *tcon,
-+ struct cifs_sb_info *cifs_sb,
-+ char *full_path)
-+{
-+ int rc;
-+ char *s;
-+ char sep, tmp;
-+
-+ sep = CIFS_DIR_SEP(cifs_sb);
-+ s = full_path;
-+
-+ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
-+ while (rc == 0) {
-+ /* skip separators */
-+ while (*s == sep)
-+ s++;
-+ if (!*s)
-+ break;
-+ /* next separator */
-+ while (*s && *s != sep)
-+ s++;
-+
-+ /*
-+ * temporarily null-terminate the path at the end of
-+ * the current component
-+ */
-+ tmp = *s;
-+ *s = 0;
-+ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
-+ full_path);
-+ *s = tmp;
-+ }
-+ return rc;
-+}
-+
- int
- cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
- {
-@@ -3620,6 +3660,16 @@ remote_path_check:
- kfree(full_path);
- goto mount_fail_check;
- }
-+
-+ rc = cifs_are_all_path_components_accessible(server,
-+ xid, tcon, cifs_sb,
-+ full_path);
-+ if (rc != 0) {
-+ cifs_dbg(VFS, "cannot query dirs between root and final path, "
-+ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
-+ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
-+ rc = 0;
-+ }
- kfree(full_path);
- }
-
-@@ -3889,6 +3939,7 @@ cifs_umount(struct cifs_sb_info *cifs_sb)
-
- bdi_destroy(&cifs_sb->bdi);
- kfree(cifs_sb->mountdata);
-+ kfree(cifs_sb->prepath);
- call_rcu(&cifs_sb->rcu, delayed_free);
- }
-
-diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
-index fb0903f..6f7333d 100644
---- a/fs/cifs/dir.c
-+++ b/fs/cifs/dir.c
-@@ -84,6 +84,7 @@ build_path_from_dentry(struct dentry *direntry)
- struct dentry *temp;
- int namelen;
- int dfsplen;
-+ int pplen = 0;
- char *full_path;
- char dirsep;
- struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
-@@ -95,8 +96,12 @@ build_path_from_dentry(struct dentry *direntry)
- dfsplen = strnlen(tcon->treeName, MAX_TREE_SIZE + 1);
- else
- dfsplen = 0;
-+
-+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+ pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0;
-+
- cifs_bp_rename_retry:
-- namelen = dfsplen;
-+ namelen = dfsplen + pplen;
- seq = read_seqbegin(&rename_lock);
- rcu_read_lock();
- for (temp = direntry; !IS_ROOT(temp);) {
-@@ -137,7 +142,7 @@ cifs_bp_rename_retry:
- }
- }
- rcu_read_unlock();
-- if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
-+ if (namelen != dfsplen + pplen || read_seqretry(&rename_lock, seq)) {
- cifs_dbg(FYI, "did not end path lookup where expected. namelen=%ddfsplen=%d\n",
- namelen, dfsplen);
- /* presumably this is only possible if racing with a rename
-@@ -153,6 +158,17 @@ cifs_bp_rename_retry:
- those safely to '/' if any are found in the middle of the prepath */
- /* BB test paths to Windows with '/' in the midst of prepath */
-
-+ if (pplen) {
-+ int i;
-+
-+ cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
-+ memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
-+ full_path[dfsplen] = '\\';
-+ for (i = 0; i < pplen-1; i++)
-+ if (full_path[dfsplen+1+i] == '/')
-+ full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
-+ }
-+
- if (dfsplen) {
- strncpy(full_path, tcon->treeName, dfsplen);
- if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
-@@ -229,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
- goto cifs_create_get_file_info;
- }
-
-+ if (S_ISDIR(newinode->i_mode)) {
-+ CIFSSMBClose(xid, tcon, fid->netfid);
-+ iput(newinode);
-+ rc = -EISDIR;
-+ goto out;
-+ }
-+
- if (!S_ISREG(newinode->i_mode)) {
- /*
- * The server may allow us to open things like
-@@ -399,10 +422,14 @@ cifs_create_set_dentry:
- if (rc != 0) {
- cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n",
- rc);
-- if (server->ops->close)
-- server->ops->close(xid, tcon, fid);
-- goto out;
-+ goto out_err;
- }
-+
-+ if (S_ISDIR(newinode->i_mode)) {
-+ rc = -EISDIR;
-+ goto out_err;
-+ }
-+
- d_drop(direntry);
- d_add(direntry, newinode);
-
-@@ -410,6 +437,13 @@ out:
- kfree(buf);
- kfree(full_path);
- return rc;
-+
-+out_err:
-+ if (server->ops->close)
-+ server->ops->close(xid, tcon, fid);
-+ if (newinode)
-+ iput(newinode);
-+ goto out;
- }
-
- int
-diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
-index 514dadb..b87efd0 100644
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -1002,10 +1002,26 @@ struct inode *cifs_root_iget(struct super_block *sb)
- struct inode *inode = NULL;
- long rc;
- struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
-+ char *path = NULL;
-+ int len;
-+
-+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+ && cifs_sb->prepath) {
-+ len = strlen(cifs_sb->prepath);
-+ path = kzalloc(len + 2 /* leading sep + null */, GFP_KERNEL);
-+ if (path == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ path[0] = '/';
-+ memcpy(path+1, cifs_sb->prepath, len);
-+ } else {
-+ path = kstrdup("", GFP_KERNEL);
-+ if (path == NULL)
-+ return ERR_PTR(-ENOMEM);
-+ }
-
- xid = get_xid();
- if (tcon->unix_ext) {
-- rc = cifs_get_inode_info_unix(&inode, "", sb, xid);
-+ rc = cifs_get_inode_info_unix(&inode, path, sb, xid);
- /* some servers mistakenly claim POSIX support */
- if (rc != -EOPNOTSUPP)
- goto iget_no_retry;
-@@ -1013,7 +1029,8 @@ struct inode *cifs_root_iget(struct super_block *sb)
- tcon->unix_ext = false;
- }
-
-- rc = cifs_get_inode_info(&inode, "", NULL, sb, xid, NULL);
-+ convert_delimiter(path, CIFS_DIR_SEP(cifs_sb));
-+ rc = cifs_get_inode_info(&inode, path, NULL, sb, xid, NULL);
-
- iget_no_retry:
- if (!inode) {
-@@ -1042,6 +1059,7 @@ iget_no_retry:
- }
-
- out:
-+ kfree(path);
- /* can not call macro free_xid here since in a void func
- * TODO: This is no longer true
- */
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 3525ed7..505e6d6 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -1044,6 +1044,9 @@ smb2_new_lease_key(struct cifs_fid *fid)
- get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
- }
-
-+#define SMB2_SYMLINK_STRUCT_SIZE \
-+ (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))
-+
- static int
- smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- const char *full_path, char **target_path,
-@@ -1056,7 +1059,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- struct cifs_fid fid;
- struct smb2_err_rsp *err_buf = NULL;
- struct smb2_symlink_err_rsp *symlink;
-- unsigned int sub_len, sub_offset;
-+ unsigned int sub_len;
-+ unsigned int sub_offset;
-+ unsigned int print_len;
-+ unsigned int print_offset;
-
- cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
-
-@@ -1077,11 +1083,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- kfree(utf16_path);
- return -ENOENT;
- }
-+
-+ if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) ||
-+ get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) {
-+ kfree(utf16_path);
-+ return -ENOENT;
-+ }
-+
- /* open must fail on symlink - reset rc */
- rc = 0;
- symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData;
- sub_len = le16_to_cpu(symlink->SubstituteNameLength);
- sub_offset = le16_to_cpu(symlink->SubstituteNameOffset);
-+ print_len = le16_to_cpu(symlink->PrintNameLength);
-+ print_offset = le16_to_cpu(symlink->PrintNameOffset);
-+
-+ if (get_rfc1002_length(err_buf) + 4 <
-+ SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) {
-+ kfree(utf16_path);
-+ return -ENOENT;
-+ }
-+
-+ if (get_rfc1002_length(err_buf) + 4 <
-+ SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) {
-+ kfree(utf16_path);
-+ return -ENOENT;
-+ }
-+
- *target_path = cifs_strndup_from_utf16(
- (char *)symlink->PathBuffer + sub_offset,
- sub_len, true, cifs_sb->local_nls);
-diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
-index 7007809..78313ad 100644
---- a/fs/jbd2/commit.c
-+++ b/fs/jbd2/commit.c
-@@ -124,7 +124,7 @@ static int journal_submit_commit_record(journal_t *journal,
- struct commit_header *tmp;
- struct buffer_head *bh;
- int ret;
-- struct timespec now = current_kernel_time();
-+ struct timespec64 now = current_kernel_time64();
-
- *cbh = NULL;
-
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index ff416d0..7796bea 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -427,6 +427,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
- case -NFS4ERR_DELAY:
- nfs_inc_server_stats(server, NFSIOS_DELAY);
- case -NFS4ERR_GRACE:
-+ case -NFS4ERR_LAYOUTTRYLATER:
- case -NFS4ERR_RECALLCONFLICT:
- exception->delay = 1;
- return 0;
-@@ -7869,11 +7870,13 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
- struct inode *inode = lgp->args.inode;
- struct nfs_server *server = NFS_SERVER(inode);
- struct pnfs_layout_hdr *lo;
-- int status = task->tk_status;
-+ int nfs4err = task->tk_status;
-+ int err, status = 0;
-+ LIST_HEAD(head);
-
- dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
-
-- switch (status) {
-+ switch (nfs4err) {
- case 0:
- goto out;
-
-@@ -7905,45 +7908,43 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
- status = -EOVERFLOW;
- goto out;
- }
-- /* Fallthrough */
-+ status = -EBUSY;
-+ break;
- case -NFS4ERR_RECALLCONFLICT:
-- nfs4_handle_exception(server, -NFS4ERR_RECALLCONFLICT,
-- exception);
- status = -ERECALLCONFLICT;
-- goto out;
-+ break;
- case -NFS4ERR_EXPIRED:
- case -NFS4ERR_BAD_STATEID:
- exception->timeout = 0;
- spin_lock(&inode->i_lock);
-- if (nfs4_stateid_match(&lgp->args.stateid,
-+ lo = NFS_I(inode)->layout;
-+ /* If the open stateid was bad, then recover it. */
-+ if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
-+ nfs4_stateid_match_other(&lgp->args.stateid,
- &lgp->args.ctx->state->stateid)) {
- spin_unlock(&inode->i_lock);
-- /* If the open stateid was bad, then recover it. */
- exception->state = lgp->args.ctx->state;
- break;
- }
-- lo = NFS_I(inode)->layout;
-- if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) &&
-- nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
-- LIST_HEAD(head);
--
-- /*
-- * Mark the bad layout state as invalid, then retry
-- * with the current stateid.
-- */
-- set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-- pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
-- spin_unlock(&inode->i_lock);
-- pnfs_free_lseg_list(&head);
-- status = -EAGAIN;
-- goto out;
-- } else
-- spin_unlock(&inode->i_lock);
-- }
-
-- status = nfs4_handle_exception(server, status, exception);
-- if (exception->retry)
-+ /*
-+ * Mark the bad layout state as invalid, then retry
-+ */
-+ set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-+ pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
-+ spin_unlock(&inode->i_lock);
-+ pnfs_free_lseg_list(&head);
- status = -EAGAIN;
-+ goto out;
-+ }
-+
-+ err = nfs4_handle_exception(server, nfs4err, exception);
-+ if (!status) {
-+ if (exception->retry)
-+ status = -EAGAIN;
-+ else
-+ status = err;
-+ }
- out:
- dprintk("<-- %s\n", __func__);
- return status;
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index 0fbe734..7d99236 100644
---- a/fs/nfs/pnfs.c
-+++ b/fs/nfs/pnfs.c
-@@ -1505,7 +1505,7 @@ pnfs_update_layout(struct inode *ino,
- struct pnfs_layout_segment *lseg = NULL;
- nfs4_stateid stateid;
- long timeout = 0;
-- unsigned long giveup = jiffies + rpc_get_timeout(server->client);
-+ unsigned long giveup = jiffies + (clp->cl_lease_time << 1);
- bool first;
-
- if (!pnfs_enabled_sb(NFS_SERVER(ino))) {
-@@ -1645,33 +1645,44 @@ lookup_again:
- lseg = send_layoutget(lo, ctx, &stateid, &arg, &timeout, gfp_flags);
- trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
- PNFS_UPDATE_LAYOUT_SEND_LAYOUTGET);
-+ atomic_dec(&lo->plh_outstanding);
- if (IS_ERR(lseg)) {
- switch(PTR_ERR(lseg)) {
-- case -ERECALLCONFLICT:
-+ case -EBUSY:
- if (time_after(jiffies, giveup))
- lseg = NULL;
-- /* Fallthrough */
-- case -EAGAIN:
-- pnfs_put_layout_hdr(lo);
-- if (first)
-- pnfs_clear_first_layoutget(lo);
-- if (lseg) {
-- trace_pnfs_update_layout(ino, pos, count,
-- iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY);
-- goto lookup_again;
-+ break;
-+ case -ERECALLCONFLICT:
-+ /* Huh? We hold no layouts, how is there a recall? */
-+ if (first) {
-+ lseg = NULL;
-+ break;
- }
-+ /* Destroy the existing layout and start over */
-+ if (time_after(jiffies, giveup))
-+ pnfs_destroy_layout(NFS_I(ino));
- /* Fallthrough */
-+ case -EAGAIN:
-+ break;
- default:
- if (!nfs_error_is_fatal(PTR_ERR(lseg))) {
- pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
- lseg = NULL;
- }
-+ goto out_put_layout_hdr;
-+ }
-+ if (lseg) {
-+ if (first)
-+ pnfs_clear_first_layoutget(lo);
-+ trace_pnfs_update_layout(ino, pos, count,
-+ iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY);
-+ pnfs_put_layout_hdr(lo);
-+ goto lookup_again;
- }
- } else {
- pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
- }
-
-- atomic_dec(&lo->plh_outstanding);
- out_put_layout_hdr:
- if (first)
- pnfs_clear_first_layoutget(lo);
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index e1c74d3..649fa5e 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -1289,6 +1289,9 @@ int nfs_updatepage(struct file *file, struct page *page,
- dprintk("NFS: nfs_updatepage(%pD2 %d@%lld)\n",
- file, count, (long long)(page_file_offset(page) + offset));
-
-+ if (!count)
-+ goto out;
-+
- if (nfs_can_extend_write(file, page, inode)) {
- count = max(count + offset, nfs_page_length(page));
- offset = 0;
-@@ -1299,7 +1302,7 @@ int nfs_updatepage(struct file *file, struct page *page,
- nfs_set_pageerror(page);
- else
- __set_page_dirty_nobuffers(page);
--
-+out:
- dprintk("NFS: nfs_updatepage returns %d (isize %lld)\n",
- status, (long long)i_size_read(inode));
- return status;
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 70d0b9b..806eda1 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -4906,6 +4906,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- return nfs_ok;
- }
-
-+static __be32
-+nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
-+{
-+ struct nfs4_ol_stateid *stp = openlockstateid(s);
-+ __be32 ret;
-+
-+ mutex_lock(&stp->st_mutex);
-+
-+ ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
-+ if (ret)
-+ goto out;
-+
-+ ret = nfserr_locks_held;
-+ if (check_for_locks(stp->st_stid.sc_file,
-+ lockowner(stp->st_stateowner)))
-+ goto out;
-+
-+ release_lock_stateid(stp);
-+ ret = nfs_ok;
-+
-+out:
-+ mutex_unlock(&stp->st_mutex);
-+ nfs4_put_stid(s);
-+ return ret;
-+}
-+
- __be32
- nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- struct nfsd4_free_stateid *free_stateid)
-@@ -4913,7 +4939,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- stateid_t *stateid = &free_stateid->fr_stateid;
- struct nfs4_stid *s;
- struct nfs4_delegation *dp;
-- struct nfs4_ol_stateid *stp;
- struct nfs4_client *cl = cstate->session->se_client;
- __be32 ret = nfserr_bad_stateid;
-
-@@ -4932,18 +4957,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- ret = nfserr_locks_held;
- break;
- case NFS4_LOCK_STID:
-- ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
-- if (ret)
-- break;
-- stp = openlockstateid(s);
-- ret = nfserr_locks_held;
-- if (check_for_locks(stp->st_stid.sc_file,
-- lockowner(stp->st_stateowner)))
-- break;
-- WARN_ON(!unhash_lock_stateid(stp));
-+ atomic_inc(&s->sc_count);
- spin_unlock(&cl->cl_lock);
-- nfs4_put_stid(s);
-- ret = nfs_ok;
-+ ret = nfsd4_free_lock_stateid(stateid, s);
- goto out;
- case NFS4_REVOKED_DELEG_STID:
- dp = delegstateid(s);
-@@ -5510,7 +5526,7 @@ static __be32
- lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- struct nfs4_ol_stateid *ost,
- struct nfsd4_lock *lock,
-- struct nfs4_ol_stateid **lst, bool *new)
-+ struct nfs4_ol_stateid **plst, bool *new)
- {
- __be32 status;
- struct nfs4_file *fi = ost->st_stid.sc_file;
-@@ -5518,7 +5534,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- struct nfs4_client *cl = oo->oo_owner.so_client;
- struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
- struct nfs4_lockowner *lo;
-+ struct nfs4_ol_stateid *lst;
- unsigned int strhashval;
-+ bool hashed;
-
- lo = find_lockowner_str(cl, &lock->lk_new_owner);
- if (!lo) {
-@@ -5534,12 +5552,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- goto out;
- }
-
-- *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
-- if (*lst == NULL) {
-+retry:
-+ lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
-+ if (lst == NULL) {
- status = nfserr_jukebox;
- goto out;
- }
-+
-+ mutex_lock(&lst->st_mutex);
-+
-+ /* See if it's still hashed to avoid race with FREE_STATEID */
-+ spin_lock(&cl->cl_lock);
-+ hashed = !list_empty(&lst->st_perfile);
-+ spin_unlock(&cl->cl_lock);
-+
-+ if (!hashed) {
-+ mutex_unlock(&lst->st_mutex);
-+ nfs4_put_stid(&lst->st_stid);
-+ goto retry;
-+ }
- status = nfs_ok;
-+ *plst = lst;
- out:
- nfs4_put_stateowner(&lo->lo_owner);
- return status;
-@@ -5606,8 +5639,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- goto out;
- status = lookup_or_create_lock_state(cstate, open_stp, lock,
- &lock_stp, &new);
-- if (status == nfs_ok)
-- mutex_lock(&lock_stp->st_mutex);
- } else {
- status = nfs4_preprocess_seqid_op(cstate,
- lock->lk_old_lock_seqid,
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 9a7693d..6db75cb 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -404,7 +404,8 @@ static struct ovl_entry *ovl_alloc_entry(unsigned int numlower)
- static bool ovl_dentry_remote(struct dentry *dentry)
- {
- return dentry->d_flags &
-- (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
-+ (DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE |
-+ DCACHE_OP_REAL);
- }
-
- static bool ovl_dentry_weird(struct dentry *dentry)
-diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
-index 4c463b9..a36a5a4 100644
---- a/fs/xfs/xfs_aops.c
-+++ b/fs/xfs/xfs_aops.c
-@@ -87,6 +87,12 @@ xfs_find_bdev_for_inode(
- * We're now finished for good with this page. Update the page state via the
- * associated buffer_heads, paying attention to the start and end offsets that
- * we need to process on the page.
-+ *
-+ * Landmine Warning: bh->b_end_io() will call end_page_writeback() on the last
-+ * buffer in the IO. Once it does this, it is unsafe to access the bufferhead or
-+ * the page at all, as we may be racing with memory reclaim and it can free both
-+ * the bufferhead chain and the page as it will see the page as clean and
-+ * unused.
- */
- static void
- xfs_finish_page_writeback(
-@@ -95,8 +101,9 @@ xfs_finish_page_writeback(
- int error)
- {
- unsigned int end = bvec->bv_offset + bvec->bv_len - 1;
-- struct buffer_head *head, *bh;
-+ struct buffer_head *head, *bh, *next;
- unsigned int off = 0;
-+ unsigned int bsize;
-
- ASSERT(bvec->bv_offset < PAGE_SIZE);
- ASSERT((bvec->bv_offset & ((1 << inode->i_blkbits) - 1)) == 0);
-@@ -105,15 +112,17 @@ xfs_finish_page_writeback(
-
- bh = head = page_buffers(bvec->bv_page);
-
-+ bsize = bh->b_size;
- do {
-+ next = bh->b_this_page;
- if (off < bvec->bv_offset)
- goto next_bh;
- if (off > end)
- break;
- bh->b_end_io(bh, !error);
- next_bh:
-- off += bh->b_size;
-- } while ((bh = bh->b_this_page) != head);
-+ off += bsize;
-+ } while ((bh = next) != head);
- }
-
- /*
-diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
-index 3f10307..c357f27 100644
---- a/include/linux/backing-dev-defs.h
-+++ b/include/linux/backing-dev-defs.h
-@@ -163,6 +163,7 @@ struct backing_dev_info {
- wait_queue_head_t wb_waitq;
-
- struct device *dev;
-+ struct device *owner;
-
- struct timer_list laptop_mode_wb_timer;
-
-diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
-index c82794f..89d3de3 100644
---- a/include/linux/backing-dev.h
-+++ b/include/linux/backing-dev.h
-@@ -24,6 +24,7 @@ __printf(3, 4)
- int bdi_register(struct backing_dev_info *bdi, struct device *parent,
- const char *fmt, ...);
- int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
-+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner);
- void bdi_unregister(struct backing_dev_info *bdi);
-
- int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
-diff --git a/include/linux/bio.h b/include/linux/bio.h
-index 9faebf7..75fadd2 100644
---- a/include/linux/bio.h
-+++ b/include/linux/bio.h
-@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigned short idx);
- int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css);
- int bio_associate_current(struct bio *bio);
- void bio_disassociate_task(struct bio *bio);
-+void bio_clone_blkcg_association(struct bio *dst, struct bio *src);
- #else /* CONFIG_BLK_CGROUP */
- static inline int bio_associate_blkcg(struct bio *bio,
- struct cgroup_subsys_state *blkcg_css) { return 0; }
- static inline int bio_associate_current(struct bio *bio) { return -ENOENT; }
- static inline void bio_disassociate_task(struct bio *bio) { }
-+static inline void bio_clone_blkcg_association(struct bio *dst,
-+ struct bio *src) { }
- #endif /* CONFIG_BLK_CGROUP */
-
- #ifdef CONFIG_HIGHMEM
-diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
-index ab31081..7879bf4 100644
---- a/include/linux/mlx5/qp.h
-+++ b/include/linux/mlx5/qp.h
-@@ -556,9 +556,9 @@ struct mlx5_destroy_qp_mbox_out {
- struct mlx5_modify_qp_mbox_in {
- struct mlx5_inbox_hdr hdr;
- __be32 qpn;
-- u8 rsvd1[4];
-- __be32 optparam;
- u8 rsvd0[4];
-+ __be32 optparam;
-+ u8 rsvd1[4];
- struct mlx5_qp_context ctx;
- u8 rsvd2[16];
- };
-diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
-index 7e440d4..e694f02 100644
---- a/include/rdma/ib_verbs.h
-+++ b/include/rdma/ib_verbs.h
-@@ -1428,6 +1428,10 @@ struct ib_srq {
- } ext;
- };
-
-+/*
-+ * @max_write_sge: Maximum SGE elements per RDMA WRITE request.
-+ * @max_read_sge: Maximum SGE elements per RDMA READ request.
-+ */
- struct ib_qp {
- struct ib_device *device;
- struct ib_pd *pd;
-@@ -1449,6 +1453,8 @@ struct ib_qp {
- void (*event_handler)(struct ib_event *, void *);
- void *qp_context;
- u32 qp_num;
-+ u32 max_write_sge;
-+ u32 max_read_sge;
- enum ib_qp_type qp_type;
- };
-
-diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
-index d8ab510..f6f3bc5 100644
---- a/include/target/target_core_backend.h
-+++ b/include/target/target_core_backend.h
-@@ -95,6 +95,6 @@ sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd,
- bool target_sense_desc_format(struct se_device *dev);
- sector_t target_to_linux_sector(struct se_device *dev, sector_t lb);
- bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
-- struct request_queue *q, int block_size);
-+ struct request_queue *q);
-
- #endif /* TARGET_CORE_BACKEND_H */
-diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index b316b44..fb8e3b6 100644
---- a/include/target/target_core_base.h
-+++ b/include/target/target_core_base.h
-@@ -142,6 +142,7 @@ enum se_cmd_flags_table {
- SCF_PASSTHROUGH_PROT_SG_TO_MEM_NOALLOC = 0x00200000,
- SCF_ACK_KREF = 0x00400000,
- SCF_USE_CPUID = 0x00800000,
-+ SCF_TASK_ATTR_SET = 0x01000000,
- };
-
- /*
-diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
-index de44462..5cd6faa 100644
---- a/include/target/target_core_fabric.h
-+++ b/include/target/target_core_fabric.h
-@@ -163,7 +163,6 @@ int core_tmr_alloc_req(struct se_cmd *, void *, u8, gfp_t);
- void core_tmr_release_req(struct se_tmr_req *);
- int transport_generic_handle_tmr(struct se_cmd *);
- void transport_generic_request_failure(struct se_cmd *, sense_reason_t);
--void __target_execute_cmd(struct se_cmd *);
- int transport_lookup_tmr_lun(struct se_cmd *, u64);
- void core_allocate_nexus_loss_ua(struct se_node_acl *acl);
-
-diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
-index 003dca9..5664ca0 100644
---- a/include/trace/events/sunrpc.h
-+++ b/include/trace/events/sunrpc.h
-@@ -529,20 +529,27 @@ TRACE_EVENT(svc_xprt_do_enqueue,
-
- TP_STRUCT__entry(
- __field(struct svc_xprt *, xprt)
-- __field_struct(struct sockaddr_storage, ss)
- __field(int, pid)
- __field(unsigned long, flags)
-+ __dynamic_array(unsigned char, addr, xprt != NULL ?
-+ xprt->xpt_remotelen : 0)
- ),
-
- TP_fast_assign(
- __entry->xprt = xprt;
-- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
- __entry->pid = rqst? rqst->rq_task->pid : 0;
-- __entry->flags = xprt ? xprt->xpt_flags : 0;
-+ if (xprt) {
-+ memcpy(__get_dynamic_array(addr),
-+ &xprt->xpt_remote,
-+ xprt->xpt_remotelen);
-+ __entry->flags = xprt->xpt_flags;
-+ } else
-+ __entry->flags = 0;
- ),
-
- TP_printk("xprt=0x%p addr=%pIScp pid=%d flags=%s", __entry->xprt,
-- (struct sockaddr *)&__entry->ss,
-+ __get_dynamic_array_len(addr) != 0 ?
-+ (struct sockaddr *)__get_dynamic_array(addr) : NULL,
- __entry->pid, show_svc_xprt_flags(__entry->flags))
- );
-
-@@ -553,18 +560,25 @@ TRACE_EVENT(svc_xprt_dequeue,
-
- TP_STRUCT__entry(
- __field(struct svc_xprt *, xprt)
-- __field_struct(struct sockaddr_storage, ss)
- __field(unsigned long, flags)
-+ __dynamic_array(unsigned char, addr, xprt != NULL ?
-+ xprt->xpt_remotelen : 0)
- ),
-
- TP_fast_assign(
-- __entry->xprt = xprt,
-- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
-- __entry->flags = xprt ? xprt->xpt_flags : 0;
-+ __entry->xprt = xprt;
-+ if (xprt) {
-+ memcpy(__get_dynamic_array(addr),
-+ &xprt->xpt_remote,
-+ xprt->xpt_remotelen);
-+ __entry->flags = xprt->xpt_flags;
-+ } else
-+ __entry->flags = 0;
- ),
-
- TP_printk("xprt=0x%p addr=%pIScp flags=%s", __entry->xprt,
-- (struct sockaddr *)&__entry->ss,
-+ __get_dynamic_array_len(addr) != 0 ?
-+ (struct sockaddr *)__get_dynamic_array(addr) : NULL,
- show_svc_xprt_flags(__entry->flags))
- );
-
-@@ -592,19 +606,26 @@ TRACE_EVENT(svc_handle_xprt,
- TP_STRUCT__entry(
- __field(struct svc_xprt *, xprt)
- __field(int, len)
-- __field_struct(struct sockaddr_storage, ss)
- __field(unsigned long, flags)
-+ __dynamic_array(unsigned char, addr, xprt != NULL ?
-+ xprt->xpt_remotelen : 0)
- ),
-
- TP_fast_assign(
- __entry->xprt = xprt;
-- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
- __entry->len = len;
-- __entry->flags = xprt ? xprt->xpt_flags : 0;
-+ if (xprt) {
-+ memcpy(__get_dynamic_array(addr),
-+ &xprt->xpt_remote,
-+ xprt->xpt_remotelen);
-+ __entry->flags = xprt->xpt_flags;
-+ } else
-+ __entry->flags = 0;
- ),
-
- TP_printk("xprt=0x%p addr=%pIScp len=%d flags=%s", __entry->xprt,
-- (struct sockaddr *)&__entry->ss,
-+ __get_dynamic_array_len(addr) != 0 ?
-+ (struct sockaddr *)__get_dynamic_array(addr) : NULL,
- __entry->len, show_svc_xprt_flags(__entry->flags))
- );
- #endif /* _TRACE_SUNRPC_H */
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 2672d10..b334128 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -72,6 +72,7 @@
- #include <linux/compat.h>
- #include <linux/ctype.h>
- #include <linux/string.h>
-+#include <linux/uaccess.h>
- #include <uapi/linux/limits.h>
-
- #include "audit.h"
-@@ -81,7 +82,8 @@
- #define AUDITSC_SUCCESS 1
- #define AUDITSC_FAILURE 2
-
--/* no execve audit message should be longer than this (userspace limits) */
-+/* no execve audit message should be longer than this (userspace limits),
-+ * see the note near the top of audit_log_execve_info() about this value */
- #define MAX_EXECVE_AUDIT_LEN 7500
-
- /* max length to print of cmdline/proctitle value during audit */
-@@ -987,184 +989,178 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
- return rc;
- }
-
--/*
-- * to_send and len_sent accounting are very loose estimates. We aren't
-- * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being
-- * within about 500 bytes (next page boundary)
-- *
-- * why snprintf? an int is up to 12 digits long. if we just assumed when
-- * logging that a[%d]= was going to be 16 characters long we would be wasting
-- * space in every audit message. In one 7500 byte message we can log up to
-- * about 1000 min size arguments. That comes down to about 50% waste of space
-- * if we didn't do the snprintf to find out how long arg_num_len was.
-- */
--static int audit_log_single_execve_arg(struct audit_context *context,
-- struct audit_buffer **ab,
-- int arg_num,
-- size_t *len_sent,
-- const char __user *p,
-- char *buf)
-+static void audit_log_execve_info(struct audit_context *context,
-+ struct audit_buffer **ab)
- {
-- char arg_num_len_buf[12];
-- const char __user *tmp_p = p;
-- /* how many digits are in arg_num? 5 is the length of ' a=""' */
-- size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5;
-- size_t len, len_left, to_send;
-- size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
-- unsigned int i, has_cntl = 0, too_long = 0;
-- int ret;
--
-- /* strnlen_user includes the null we don't want to send */
-- len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1;
--
-- /*
-- * We just created this mm, if we can't find the strings
-- * we just copied into it something is _very_ wrong. Similar
-- * for strings that are too long, we should not have created
-- * any.
-- */
-- if (WARN_ON_ONCE(len < 0 || len > MAX_ARG_STRLEN - 1)) {
-- send_sig(SIGKILL, current, 0);
-- return -1;
-+ long len_max;
-+ long len_rem;
-+ long len_full;
-+ long len_buf;
-+ long len_abuf;
-+ long len_tmp;
-+ bool require_data;
-+ bool encode;
-+ unsigned int iter;
-+ unsigned int arg;
-+ char *buf_head;
-+ char *buf;
-+ const char __user *p = (const char __user *)current->mm->arg_start;
-+
-+ /* NOTE: this buffer needs to be large enough to hold all the non-arg
-+ * data we put in the audit record for this argument (see the
-+ * code below) ... at this point in time 96 is plenty */
-+ char abuf[96];
-+
-+ /* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
-+ * current value of 7500 is not as important as the fact that it
-+ * is less than 8k, a setting of 7500 gives us plenty of wiggle
-+ * room if we go over a little bit in the logging below */
-+ WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
-+ len_max = MAX_EXECVE_AUDIT_LEN;
-+
-+ /* scratch buffer to hold the userspace args */
-+ buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
-+ if (!buf_head) {
-+ audit_panic("out of memory for argv string");
-+ return;
- }
-+ buf = buf_head;
-
-- /* walk the whole argument looking for non-ascii chars */
-+ audit_log_format(*ab, "argc=%d", context->execve.argc);
-+
-+ len_rem = len_max;
-+ len_buf = 0;
-+ len_full = 0;
-+ require_data = true;
-+ encode = false;
-+ iter = 0;
-+ arg = 0;
- do {
-- if (len_left > MAX_EXECVE_AUDIT_LEN)
-- to_send = MAX_EXECVE_AUDIT_LEN;
-- else
-- to_send = len_left;
-- ret = copy_from_user(buf, tmp_p, to_send);
-- /*
-- * There is no reason for this copy to be short. We just
-- * copied them here, and the mm hasn't been exposed to user-
-- * space yet.
-- */
-- if (ret) {
-- WARN_ON(1);
-- send_sig(SIGKILL, current, 0);
-- return -1;
-- }
-- buf[to_send] = '\0';
-- has_cntl = audit_string_contains_control(buf, to_send);
-- if (has_cntl) {
-- /*
-- * hex messages get logged as 2 bytes, so we can only
-- * send half as much in each message
-- */
-- max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2;
-- break;
-- }
-- len_left -= to_send;
-- tmp_p += to_send;
-- } while (len_left > 0);
--
-- len_left = len;
--
-- if (len > max_execve_audit_len)
-- too_long = 1;
--
-- /* rewalk the argument actually logging the message */
-- for (i = 0; len_left > 0; i++) {
-- int room_left;
--
-- if (len_left > max_execve_audit_len)
-- to_send = max_execve_audit_len;
-- else
-- to_send = len_left;
--
-- /* do we have space left to send this argument in this ab? */
-- room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent;
-- if (has_cntl)
-- room_left -= (to_send * 2);
-- else
-- room_left -= to_send;
-- if (room_left < 0) {
-- *len_sent = 0;
-- audit_log_end(*ab);
-- *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE);
-- if (!*ab)
-- return 0;
-- }
-+ /* NOTE: we don't ever want to trust this value for anything
-+ * serious, but the audit record format insists we
-+ * provide an argument length for really long arguments,
-+ * e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
-+ * to use strncpy_from_user() to obtain this value for
-+ * recording in the log, although we don't use it
-+ * anywhere here to avoid a double-fetch problem */
-+ if (len_full == 0)
-+ len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
-+
-+ /* read more data from userspace */
-+ if (require_data) {
-+ /* can we make more room in the buffer? */
-+ if (buf != buf_head) {
-+ memmove(buf_head, buf, len_buf);
-+ buf = buf_head;
-+ }
-+
-+ /* fetch as much as we can of the argument */
-+ len_tmp = strncpy_from_user(&buf_head[len_buf], p,
-+ len_max - len_buf);
-+ if (len_tmp == -EFAULT) {
-+ /* unable to copy from userspace */
-+ send_sig(SIGKILL, current, 0);
-+ goto out;
-+ } else if (len_tmp == (len_max - len_buf)) {
-+ /* buffer is not large enough */
-+ require_data = true;
-+ /* NOTE: if we are going to span multiple
-+ * buffers force the encoding so we stand
-+ * a chance at a sane len_full value and
-+ * consistent record encoding */
-+ encode = true;
-+ len_full = len_full * 2;
-+ p += len_tmp;
-+ } else {
-+ require_data = false;
-+ if (!encode)
-+ encode = audit_string_contains_control(
-+ buf, len_tmp);
-+ /* try to use a trusted value for len_full */
-+ if (len_full < len_max)
-+ len_full = (encode ?
-+ len_tmp * 2 : len_tmp);
-+ p += len_tmp + 1;
-+ }
-+ len_buf += len_tmp;
-+ buf_head[len_buf] = '\0';
-
-- /*
-- * first record needs to say how long the original string was
-- * so we can be sure nothing was lost.
-- */
-- if ((i == 0) && (too_long))
-- audit_log_format(*ab, " a%d_len=%zu", arg_num,
-- has_cntl ? 2*len : len);
--
-- /*
-- * normally arguments are small enough to fit and we already
-- * filled buf above when we checked for control characters
-- * so don't bother with another copy_from_user
-- */
-- if (len >= max_execve_audit_len)
-- ret = copy_from_user(buf, p, to_send);
-- else
-- ret = 0;
-- if (ret) {
-- WARN_ON(1);
-- send_sig(SIGKILL, current, 0);
-- return -1;
-+ /* length of the buffer in the audit record? */
-+ len_abuf = (encode ? len_buf * 2 : len_buf + 2);
- }
-- buf[to_send] = '\0';
--
-- /* actually log it */
-- audit_log_format(*ab, " a%d", arg_num);
-- if (too_long)
-- audit_log_format(*ab, "[%d]", i);
-- audit_log_format(*ab, "=");
-- if (has_cntl)
-- audit_log_n_hex(*ab, buf, to_send);
-- else
-- audit_log_string(*ab, buf);
--
-- p += to_send;
-- len_left -= to_send;
-- *len_sent += arg_num_len;
-- if (has_cntl)
-- *len_sent += to_send * 2;
-- else
-- *len_sent += to_send;
-- }
-- /* include the null we didn't log */
-- return len + 1;
--}
-
--static void audit_log_execve_info(struct audit_context *context,
-- struct audit_buffer **ab)
--{
-- int i, len;
-- size_t len_sent = 0;
-- const char __user *p;
-- char *buf;
-+ /* write as much as we can to the audit log */
-+ if (len_buf > 0) {
-+ /* NOTE: some magic numbers here - basically if we
-+ * can't fit a reasonable amount of data into the
-+ * existing audit buffer, flush it and start with
-+ * a new buffer */
-+ if ((sizeof(abuf) + 8) > len_rem) {
-+ len_rem = len_max;
-+ audit_log_end(*ab);
-+ *ab = audit_log_start(context,
-+ GFP_KERNEL, AUDIT_EXECVE);
-+ if (!*ab)
-+ goto out;
-+ }
-
-- p = (const char __user *)current->mm->arg_start;
-+ /* create the non-arg portion of the arg record */
-+ len_tmp = 0;
-+ if (require_data || (iter > 0) ||
-+ ((len_abuf + sizeof(abuf)) > len_rem)) {
-+ if (iter == 0) {
-+ len_tmp += snprintf(&abuf[len_tmp],
-+ sizeof(abuf) - len_tmp,
-+ " a%d_len=%lu",
-+ arg, len_full);
-+ }
-+ len_tmp += snprintf(&abuf[len_tmp],
-+ sizeof(abuf) - len_tmp,
-+ " a%d[%d]=", arg, iter++);
-+ } else
-+ len_tmp += snprintf(&abuf[len_tmp],
-+ sizeof(abuf) - len_tmp,
-+ " a%d=", arg);
-+ WARN_ON(len_tmp >= sizeof(abuf));
-+ abuf[sizeof(abuf) - 1] = '\0';
-+
-+ /* log the arg in the audit record */
-+ audit_log_format(*ab, "%s", abuf);
-+ len_rem -= len_tmp;
-+ len_tmp = len_buf;
-+ if (encode) {
-+ if (len_abuf > len_rem)
-+ len_tmp = len_rem / 2; /* encoding */
-+ audit_log_n_hex(*ab, buf, len_tmp);
-+ len_rem -= len_tmp * 2;
-+ len_abuf -= len_tmp * 2;
-+ } else {
-+ if (len_abuf > len_rem)
-+ len_tmp = len_rem - 2; /* quotes */
-+ audit_log_n_string(*ab, buf, len_tmp);
-+ len_rem -= len_tmp + 2;
-+ /* don't subtract the "2" because we still need
-+ * to add quotes to the remaining string */
-+ len_abuf -= len_tmp;
-+ }
-+ len_buf -= len_tmp;
-+ buf += len_tmp;
-+ }
-
-- audit_log_format(*ab, "argc=%d", context->execve.argc);
-+ /* ready to move to the next argument? */
-+ if ((len_buf == 0) && !require_data) {
-+ arg++;
-+ iter = 0;
-+ len_full = 0;
-+ require_data = true;
-+ encode = false;
-+ }
-+ } while (arg < context->execve.argc);
-
-- /*
-- * we need some kernel buffer to hold the userspace args. Just
-- * allocate one big one rather than allocating one of the right size
-- * for every single argument inside audit_log_single_execve_arg()
-- * should be <8k allocation so should be pretty safe.
-- */
-- buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
-- if (!buf) {
-- audit_panic("out of memory for argv string");
-- return;
-- }
-+ /* NOTE: the caller handles the final audit_log_end() call */
-
-- for (i = 0; i < context->execve.argc; i++) {
-- len = audit_log_single_execve_arg(context, ab, i,
-- &len_sent, p, buf);
-- if (len <= 0)
-- break;
-- p += len;
-- }
-- kfree(buf);
-+out:
-+ kfree(buf_head);
- }
-
- static void show_special(struct audit_context *context, int *call_panic)
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 75c0ff0..e0be49f 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -2215,12 +2215,8 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
- goto out_unlock;
- }
-
-- /*
-- * We know this subsystem has not yet been bound. Users in a non-init
-- * user namespace may only mount hierarchies with no bound subsystems,
-- * i.e. 'none,name=user1'
-- */
-- if (!opts.none && !capable(CAP_SYS_ADMIN)) {
-+ /* Hierarchies may only be created in the initial cgroup namespace. */
-+ if (ns != &init_cgroup_ns) {
- ret = -EPERM;
- goto out_unlock;
- }
-@@ -2962,6 +2958,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
- int retval = 0;
-
- mutex_lock(&cgroup_mutex);
-+ percpu_down_write(&cgroup_threadgroup_rwsem);
- for_each_root(root) {
- struct cgroup *from_cgrp;
-
-@@ -2976,6 +2973,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
- if (retval)
- break;
- }
-+ percpu_up_write(&cgroup_threadgroup_rwsem);
- mutex_unlock(&cgroup_mutex);
-
- return retval;
-@@ -4343,6 +4341,8 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
-
- mutex_lock(&cgroup_mutex);
-
-+ percpu_down_write(&cgroup_threadgroup_rwsem);
-+
- /* all tasks in @from are being moved, all csets are source */
- spin_lock_irq(&css_set_lock);
- list_for_each_entry(link, &from->cset_links, cset_link)
-@@ -4371,6 +4371,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
- } while (task && !ret);
- out_err:
- cgroup_migrate_finish(&preloaded_csets);
-+ percpu_up_write(&cgroup_threadgroup_rwsem);
- mutex_unlock(&cgroup_mutex);
- return ret;
- }
-@@ -6309,14 +6310,11 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags,
- if (!ns_capable(user_ns, CAP_SYS_ADMIN))
- return ERR_PTR(-EPERM);
-
-- mutex_lock(&cgroup_mutex);
-+ /* It is not safe to take cgroup_mutex here */
- spin_lock_irq(&css_set_lock);
--
- cset = task_css_set(current);
- get_css_set(cset);
--
- spin_unlock_irq(&css_set_lock);
-- mutex_unlock(&cgroup_mutex);
-
- new_ns = alloc_cgroup_ns();
- if (IS_ERR(new_ns)) {
-diff --git a/kernel/module.c b/kernel/module.c
-index 5f71aa6..6458a2f 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -2687,13 +2687,18 @@ static inline void kmemleak_load_module(const struct module *mod,
- #endif
-
- #ifdef CONFIG_MODULE_SIG
--static int module_sig_check(struct load_info *info)
-+static int module_sig_check(struct load_info *info, int flags)
- {
- int err = -ENOKEY;
- const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
- const void *mod = info->hdr;
-
-- if (info->len > markerlen &&
-+ /*
-+ * Require flags == 0, as a module with version information
-+ * removed is no longer the module that was signed
-+ */
-+ if (flags == 0 &&
-+ info->len > markerlen &&
- memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
- /* We truncate the module to discard the signature */
- info->len -= markerlen;
-@@ -2712,7 +2717,7 @@ static int module_sig_check(struct load_info *info)
- return err;
- }
- #else /* !CONFIG_MODULE_SIG */
--static int module_sig_check(struct load_info *info)
-+static int module_sig_check(struct load_info *info, int flags)
- {
- return 0;
- }
-@@ -3498,7 +3503,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
- long err;
- char *after_dashes;
-
-- err = module_sig_check(info);
-+ err = module_sig_check(info, flags);
- if (err)
- goto free_copy;
-
-diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index ed173b8..9269911 100644
---- a/mm/backing-dev.c
-+++ b/mm/backing-dev.c
-@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev)
- }
- EXPORT_SYMBOL(bdi_register_dev);
-
-+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
-+{
-+ int rc;
-+
-+ rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt),
-+ MINOR(owner->devt));
-+ if (rc)
-+ return rc;
-+ bdi->owner = owner;
-+ get_device(owner);
-+ return 0;
-+}
-+EXPORT_SYMBOL(bdi_register_owner);
-+
- /*
- * Remove bdi from bdi_list, and ensure that it is no longer visible
- */
-@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_info *bdi)
- device_unregister(bdi->dev);
- bdi->dev = NULL;
- }
-+
-+ if (bdi->owner) {
-+ put_device(bdi->owner);
-+ bdi->owner = NULL;
-+ }
- }
-
- void bdi_exit(struct backing_dev_info *bdi)
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index addfe4ac..d9ec1a5 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2214,6 +2214,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
- * and reducing the surplus.
- */
- spin_unlock(&hugetlb_lock);
-+
-+ /* yield cpu to avoid soft lockup */
-+ cond_resched();
-+
- if (hstate_is_gigantic(h))
- ret = alloc_fresh_gigantic_page(h, nodes_allowed);
- else
-diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index 388ee8b..1842141 100644
---- a/net/bluetooth/l2cap_sock.c
-+++ b/net/bluetooth/l2cap_sock.c
-@@ -927,7 +927,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
- break;
- }
-
-- if (get_user(opt, (u32 __user *) optval)) {
-+ if (get_user(opt, (u16 __user *) optval)) {
- err = -EFAULT;
- break;
- }
-diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
-index 1325776..bd007a9 100644
---- a/net/netlabel/netlabel_kapi.c
-+++ b/net/netlabel/netlabel_kapi.c
-@@ -824,7 +824,11 @@ socket_setattr_return:
- */
- void netlbl_sock_delattr(struct sock *sk)
- {
-- cipso_v4_sock_delattr(sk);
-+ switch (sk->sk_family) {
-+ case AF_INET:
-+ cipso_v4_sock_delattr(sk);
-+ break;
-+ }
- }
-
- /**
-@@ -987,7 +991,11 @@ req_setattr_return:
- */
- void netlbl_req_delattr(struct request_sock *req)
- {
-- cipso_v4_req_delattr(req);
-+ switch (req->rsk_ops->family) {
-+ case AF_INET:
-+ cipso_v4_req_delattr(req);
-+ break;
-+ }
- }
-
- /**
-diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
-index e1675927..42396a7 100644
---- a/scripts/recordmcount.c
-+++ b/scripts/recordmcount.c
-@@ -33,10 +33,17 @@
- #include <string.h>
- #include <unistd.h>
-
-+/*
-+ * glibc synced up and added the metag number but didn't add the relocations.
-+ * Work around this in a crude manner for now.
-+ */
- #ifndef EM_METAG
--/* Remove this when these make it to the standard system elf.h. */
- #define EM_METAG 174
-+#endif
-+#ifndef R_METAG_ADDR32
- #define R_METAG_ADDR32 2
-+#endif
-+#ifndef R_METAG_NONE
- #define R_METAG_NONE 3
- #endif
-
-diff --git a/sound/hda/array.c b/sound/hda/array.c
-index 516795b..5dfa610 100644
---- a/sound/hda/array.c
-+++ b/sound/hda/array.c
-@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *array)
- return NULL;
- if (array->used >= array->alloced) {
- int num = array->alloced + array->alloc_align;
-+ int oldsize = array->alloced * array->elem_size;
- int size = (num + 1) * array->elem_size;
- void *nlist;
- if (snd_BUG_ON(num >= 4096))
- return NULL;
-- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
-+ nlist = krealloc(array->list, size, GFP_KERNEL);
- if (!nlist)
- return NULL;
-+ memset(nlist + oldsize, 0, size - oldsize);
- array->list = nlist;
- array->alloced = num;
- }
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 6f8ea13..89dacf9 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -2265,6 +2265,8 @@ static const struct pci_device_id azx_ids[] = {
- { PCI_DEVICE(0x1022, 0x780d),
- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
- /* ATI HDMI */
-+ { PCI_DEVICE(0x1002, 0x0002),
-+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
- { PCI_DEVICE(0x1002, 0x1308),
- .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
- { PCI_DEVICE(0x1002, 0x157a),
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index abcb5a6..f25479b 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
- }
- }
-
-+static void alc298_fixup_speaker_volume(struct hda_codec *codec,
-+ const struct hda_fixup *fix, int action)
-+{
-+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-+ /* The speaker is routed to the Node 0x06 by a mistake, as a result
-+ we can't adjust the speaker's volume since this node does not has
-+ Amp-out capability. we change the speaker's route to:
-+ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 (
-+ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust
-+ speaker's volume now. */
-+
-+ hda_nid_t conn1[1] = { 0x0c };
-+ snd_hda_override_conn_list(codec, 0x17, 1, conn1);
-+ }
-+}
-+
- /* Hook to update amp GPIO4 for automute */
- static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
- struct hda_jack_callback *jack)
-@@ -4823,6 +4839,7 @@ enum {
- ALC280_FIXUP_HP_HEADSET_MIC,
- ALC221_FIXUP_HP_FRONT_MIC,
- ALC292_FIXUP_TPT460,
-+ ALC298_FIXUP_SPK_VOLUME,
- };
-
- static const struct hda_fixup alc269_fixups[] = {
-@@ -5478,6 +5495,12 @@ static const struct hda_fixup alc269_fixups[] = {
- .chained = true,
- .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
- },
-+ [ALC298_FIXUP_SPK_VOLUME] = {
-+ .type = HDA_FIXUP_FUNC,
-+ .v.func = alc298_fixup_speaker_volume,
-+ .chained = true,
-+ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ },
- };
-
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-@@ -5524,6 +5547,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
- SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
-+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
- SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
-@@ -5799,6 +5823,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- {0x1b, 0x01014020},
- {0x21, 0x0221103f}),
- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ {0x14, 0x90170130},
-+ {0x1b, 0x02011020},
-+ {0x21, 0x0221103f}),
-+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- {0x14, 0x90170150},
- {0x1b, 0x02011020},
- {0x21, 0x0221105f}),
-diff --git a/tools/objtool/.gitignore b/tools/objtool/.gitignore
-index a0b3128..d3102c8 100644
---- a/tools/objtool/.gitignore
-+++ b/tools/objtool/.gitignore
-@@ -1,2 +1,3 @@
- arch/x86/insn/inat-tables.c
- objtool
-+fixdep
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 48bd520..dd25346 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -148,6 +148,7 @@ int vcpu_load(struct kvm_vcpu *vcpu)
- put_cpu();
- return 0;
- }
-+EXPORT_SYMBOL_GPL(vcpu_load);
-
- void vcpu_put(struct kvm_vcpu *vcpu)
- {
-@@ -157,6 +158,7 @@ void vcpu_put(struct kvm_vcpu *vcpu)
- preempt_enable();
- mutex_unlock(&vcpu->mutex);
- }
-+EXPORT_SYMBOL_GPL(vcpu_put);
-
- static void ack_flush(void *_completed)
- {
diff --git a/4.7.4/1002_linux-4.7.3.patch b/4.7.4/1002_linux-4.7.3.patch
deleted file mode 100644
index caac684..0000000
--- a/4.7.4/1002_linux-4.7.3.patch
+++ /dev/null
@@ -1,4418 +0,0 @@
-diff --git a/Makefile b/Makefile
-index bb98f1c..4afff18 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
-index ad7860c..51597f3 100644
---- a/arch/arc/include/asm/entry.h
-+++ b/arch/arc/include/asm/entry.h
-@@ -142,7 +142,7 @@
-
- #ifdef CONFIG_ARC_CURR_IN_REG
- ; Retrieve orig r25 and save it with rest of callee_regs
-- ld.as r12, [r12, PT_user_r25]
-+ ld r12, [r12, PT_user_r25]
- PUSH r12
- #else
- PUSH r25
-@@ -198,7 +198,7 @@
-
- ; SP is back to start of pt_regs
- #ifdef CONFIG_ARC_CURR_IN_REG
-- st.as r12, [sp, PT_user_r25]
-+ st r12, [sp, PT_user_r25]
- #endif
- .endm
-
-diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h
-index c1d3645..4c6eed8 100644
---- a/arch/arc/include/asm/irqflags-compact.h
-+++ b/arch/arc/include/asm/irqflags-compact.h
-@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(void)
- .endm
-
- .macro IRQ_ENABLE scratch
-+ TRACE_ASM_IRQ_ENABLE
- lr \scratch, [status32]
- or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
- flag \scratch
-- TRACE_ASM_IRQ_ENABLE
- .endm
-
- #endif /* __ASSEMBLY__ */
-diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
-index 0f92d97..89eeb37 100644
---- a/arch/arc/include/asm/pgtable.h
-+++ b/arch/arc/include/asm/pgtable.h
-@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
-
- #define pte_page(pte) pfn_to_page(pte_pfn(pte))
- #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot)
--#define pfn_pte(pfn, prot) (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
-+#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
-
- /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
- #define pte_pfn(pte) (pte_val(pte) >> PAGE_SHIFT)
-diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
-index 5a294b2..0b10efe 100644
---- a/arch/arc/mm/cache.c
-+++ b/arch/arc/mm/cache.c
-@@ -921,6 +921,15 @@ void arc_cache_init(void)
-
- printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
-
-+ /*
-+ * Only master CPU needs to execute rest of function:
-+ * - Assume SMP so all cores will have same cache config so
-+ * any geomtry checks will be same for all
-+ * - IOC setup / dma callbacks only need to be setup once
-+ */
-+ if (cpu)
-+ return;
-+
- if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
- struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
-
-diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-index 080203e..dc7f3bc 100644
---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-@@ -270,6 +270,8 @@
- #io-channel-cells = <1>;
- clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
- clock-names = "saradc", "apb_pclk";
-+ resets = <&cru SRST_SARADC>;
-+ reset-names = "saradc-apb";
- status = "disabled";
- };
-
-diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
-index 579b6e6..a55384f 100644
---- a/arch/arm64/include/asm/elf.h
-+++ b/arch/arm64/include/asm/elf.h
-@@ -140,6 +140,7 @@ typedef struct user_fpsimd_state elf_fpregset_t;
-
- #define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
-
-+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
- #define ARCH_DLINFO \
- do { \
- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
-diff --git a/arch/arm64/include/uapi/asm/auxvec.h b/arch/arm64/include/uapi/asm/auxvec.h
-index 22d6d88..4cf0c17 100644
---- a/arch/arm64/include/uapi/asm/auxvec.h
-+++ b/arch/arm64/include/uapi/asm/auxvec.h
-@@ -19,4 +19,6 @@
- /* vDSO location */
- #define AT_SYSINFO_EHDR 33
-
-+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
-+
- #endif
-diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
-index 2c6e598..aa68aad 100644
---- a/arch/arm64/kernel/head.S
-+++ b/arch/arm64/kernel/head.S
-@@ -757,6 +757,9 @@ ENTRY(__enable_mmu)
- isb
- bl __create_page_tables // recreate kernel mapping
-
-+ tlbi vmalle1 // Remove any stale TLB entries
-+ dsb nsh
-+
- msr sctlr_el1, x19 // re-enable the MMU
- isb
- ic iallu // flush instructions fetched
-diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
-index 9a3aec9..ccf79d8 100644
---- a/arch/arm64/kernel/sleep.S
-+++ b/arch/arm64/kernel/sleep.S
-@@ -101,12 +101,20 @@ ENTRY(cpu_resume)
- bl el2_setup // if in EL2 drop to EL1 cleanly
- /* enable the MMU early - so we can access sleep_save_stash by va */
- adr_l lr, __enable_mmu /* __cpu_setup will return here */
-- ldr x27, =_cpu_resume /* __enable_mmu will branch here */
-+ adr_l x27, _resume_switched /* __enable_mmu will branch here */
- adrp x25, idmap_pg_dir
- adrp x26, swapper_pg_dir
- b __cpu_setup
- ENDPROC(cpu_resume)
-
-+ .pushsection ".idmap.text", "ax"
-+_resume_switched:
-+ ldr x8, =_cpu_resume
-+ br x8
-+ENDPROC(_resume_switched)
-+ .ltorg
-+ .popsection
-+
- ENTRY(_cpu_resume)
- mrs x1, mpidr_el1
- adrp x8, mpidr_hash
-diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
-index 5bb61de..9d37e96 100644
---- a/arch/arm64/mm/proc.S
-+++ b/arch/arm64/mm/proc.S
-@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
-
- msr tcr_el1, x8
- msr vbar_el1, x9
-+
-+ /*
-+ * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
-+ * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
-+ * exception. Mask them until local_dbg_restore() in cpu_suspend()
-+ * resets them.
-+ */
-+ disable_dbg
- msr mdscr_el1, x10
-+
- msr sctlr_el1, x12
- /*
- * Restore oslsr_el1 by writing oslar_el1
-diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
-index c0ae625..274d5bc 100644
---- a/arch/parisc/include/uapi/asm/errno.h
-+++ b/arch/parisc/include/uapi/asm/errno.h
-@@ -97,10 +97,10 @@
- #define ENOTCONN 235 /* Transport endpoint is not connected */
- #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */
- #define ETOOMANYREFS 237 /* Too many references: cannot splice */
--#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
- #define ETIMEDOUT 238 /* Connection timed out */
- #define ECONNREFUSED 239 /* Connection refused */
--#define EREMOTERELEASE 240 /* Remote peer released connection */
-+#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
-+#define EREMOTERELEASE 240 /* Remote peer released connection */
- #define EHOSTDOWN 241 /* Host is down */
- #define EHOSTUNREACH 242 /* No route to host */
-
-diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
-index 5adc339..0c2a94a 100644
---- a/arch/parisc/kernel/processor.c
-+++ b/arch/parisc/kernel/processor.c
-@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency);
-
- DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data);
-
--extern int update_cr16_clocksource(void); /* from time.c */
--
- /*
- ** PARISC CPU driver - claim "device" and initialize CPU data structures.
- **
-@@ -228,12 +226,6 @@ static int processor_probe(struct parisc_device *dev)
- }
- #endif
-
-- /* If we've registered more than one cpu,
-- * we'll use the jiffies clocksource since cr16
-- * is not synchronized between CPUs.
-- */
-- update_cr16_clocksource();
--
- return 0;
- }
-
-diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
-index 31ec99a..5eea7dc 100644
---- a/arch/parisc/kernel/time.c
-+++ b/arch/parisc/kernel/time.c
-@@ -220,18 +220,6 @@ static struct clocksource clocksource_cr16 = {
- .flags = CLOCK_SOURCE_IS_CONTINUOUS,
- };
-
--int update_cr16_clocksource(void)
--{
-- /* since the cr16 cycle counters are not synchronized across CPUs,
-- we'll check if we should switch to a safe clocksource: */
-- if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) {
-- clocksource_change_rating(&clocksource_cr16, 0);
-- return 1;
-- }
--
-- return 0;
--}
--
- void __init start_cpu_itimer(void)
- {
- unsigned int cpu = smp_processor_id();
-diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S
-index 1dd5bd8..1330553 100644
---- a/arch/um/include/asm/common.lds.S
-+++ b/arch/um/include/asm/common.lds.S
-@@ -81,7 +81,7 @@
- .altinstr_replacement : { *(.altinstr_replacement) }
- /* .exit.text is discard at runtime, not link time, to deal with references
- from .altinstructions and .eh_frame */
-- .exit.text : { *(.exit.text) }
-+ .exit.text : { EXIT_TEXT }
- .exit.data : { *(.exit.data) }
-
- .preinit_array : {
-diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index 4e5be94..6fa8594 100644
---- a/arch/x86/include/asm/tlbflush.h
-+++ b/arch/x86/include/asm/tlbflush.h
-@@ -135,7 +135,14 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
-
- static inline void __native_flush_tlb(void)
- {
-+ /*
-+ * If current->mm == NULL then we borrow a mm which may change during a
-+ * task switch and therefore we must not be preempted while we write CR3
-+ * back:
-+ */
-+ preempt_disable();
- native_write_cr3(native_read_cr3());
-+ preempt_enable();
- }
-
- static inline void __native_flush_tlb_global_irq_disabled(void)
-diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
-index 6c1ff31..495c776 100644
---- a/arch/x86/kernel/uprobes.c
-+++ b/arch/x86/kernel/uprobes.c
-@@ -357,20 +357,22 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
- *cursor &= 0xfe;
- }
- /*
-- * Similar treatment for VEX3 prefix.
-- * TODO: add XOP/EVEX treatment when insn decoder supports them
-+ * Similar treatment for VEX3/EVEX prefix.
-+ * TODO: add XOP treatment when insn decoder supports them
- */
-- if (insn->vex_prefix.nbytes == 3) {
-+ if (insn->vex_prefix.nbytes >= 3) {
- /*
- * vex2: c5 rvvvvLpp (has no b bit)
- * vex3/xop: c4/8f rxbmmmmm wvvvvLpp
- * evex: 62 rxbR00mm wvvvv1pp zllBVaaa
-- * (evex will need setting of both b and x since
-- * in non-sib encoding evex.x is 4th bit of MODRM.rm)
-- * Setting VEX3.b (setting because it has inverted meaning):
-+ * Setting VEX3.b (setting because it has inverted meaning).
-+ * Setting EVEX.x since (in non-SIB encoding) EVEX.x
-+ * is the 4th bit of MODRM.rm, and needs the same treatment.
-+ * For VEX3-encoded insns, VEX3.x value has no effect in
-+ * non-SIB encoding, the change is superfluous but harmless.
- */
- cursor = auprobe->insn + insn_offset_vex_prefix(insn) + 1;
-- *cursor |= 0x20;
-+ *cursor |= 0x60;
- }
-
- /*
-@@ -415,12 +417,10 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
-
- reg = MODRM_REG(insn); /* Fetch modrm.reg */
- reg2 = 0xff; /* Fetch vex.vvvv */
-- if (insn->vex_prefix.nbytes == 2)
-- reg2 = insn->vex_prefix.bytes[1];
-- else if (insn->vex_prefix.nbytes == 3)
-+ if (insn->vex_prefix.nbytes)
- reg2 = insn->vex_prefix.bytes[2];
- /*
-- * TODO: add XOP, EXEV vvvv reading.
-+ * TODO: add XOP vvvv reading.
- *
- * vex.vvvv field is in bits 6-3, bits are inverted.
- * But in 32-bit mode, high-order bit may be ignored.
-diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
-index 815fec6..17943a8 100644
---- a/arch/x86/platform/uv/bios_uv.c
-+++ b/arch/x86/platform/uv/bios_uv.c
-@@ -188,7 +188,8 @@ EXPORT_SYMBOL_GPL(uv_bios_set_legacy_vga_target);
- void uv_bios_init(void)
- {
- uv_systab = NULL;
-- if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || !efi.uv_systab) {
-+ if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) ||
-+ !efi.uv_systab || efi_runtime_disabled()) {
- pr_crit("UV: UVsystab: missing\n");
- return;
- }
-diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
-index 8adac69..2e98173 100644
---- a/drivers/acpi/cppc_acpi.c
-+++ b/drivers/acpi/cppc_acpi.c
-@@ -299,8 +299,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- continue;
-
- cpc_ptr = per_cpu(cpc_desc_ptr, i);
-- if (!cpc_ptr)
-- continue;
-+ if (!cpc_ptr) {
-+ retval = -EFAULT;
-+ goto err_ret;
-+ }
-
- pdomain = &(cpc_ptr->domain_info);
- cpumask_set_cpu(i, pr->shared_cpu_map);
-@@ -322,8 +324,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- continue;
-
- match_cpc_ptr = per_cpu(cpc_desc_ptr, j);
-- if (!match_cpc_ptr)
-- continue;
-+ if (!match_cpc_ptr) {
-+ retval = -EFAULT;
-+ goto err_ret;
-+ }
-
- match_pdomain = &(match_cpc_ptr->domain_info);
- if (match_pdomain->domain != pdomain->domain)
-@@ -353,8 +357,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- continue;
-
- match_cpc_ptr = per_cpu(cpc_desc_ptr, j);
-- if (!match_cpc_ptr)
-- continue;
-+ if (!match_cpc_ptr) {
-+ retval = -EFAULT;
-+ goto err_ret;
-+ }
-
- match_pdomain = &(match_cpc_ptr->domain_info);
- if (match_pdomain->domain != pdomain->domain)
-@@ -595,9 +601,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
- /* Store CPU Logical ID */
- cpc_ptr->cpu_id = pr->id;
-
-- /* Plug it into this CPUs CPC descriptor. */
-- per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
--
- /* Parse PSD data for this CPU */
- ret = acpi_get_psd(cpc_ptr, handle);
- if (ret)
-@@ -610,6 +613,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
- goto out_free;
- }
-
-+ /* Plug PSD data into this CPUs CPC descriptor. */
-+ per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
-+
- /* Everything looks okay */
- pr_debug("Parsed CPC struct for CPU: %d\n", pr->id);
-
-diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
-index 1f0e060..375c10f 100644
---- a/drivers/acpi/nfit.c
-+++ b/drivers/acpi/nfit.c
-@@ -1396,11 +1396,12 @@ static u32 read_blk_stat(struct nfit_blk *nfit_blk, unsigned int bw)
- {
- struct nfit_blk_mmio *mmio = &nfit_blk->mmio[DCR];
- u64 offset = nfit_blk->stat_offset + mmio->size * bw;
-+ const u32 STATUS_MASK = 0x80000037;
-
- if (mmio->num_lines)
- offset = to_interleave_offset(offset, mmio);
-
-- return readl(mmio->addr.base + offset);
-+ return readl(mmio->addr.base + offset) & STATUS_MASK;
- }
-
- static void write_blk_ctl(struct nfit_blk *nfit_blk, unsigned int bw,
-diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
-index 5f28cf7..f3c0222 100644
---- a/drivers/acpi/scan.c
-+++ b/drivers/acpi/scan.c
-@@ -1967,7 +1967,7 @@ int __init acpi_scan_init(void)
-
- static struct acpi_probe_entry *ape;
- static int acpi_probe_count;
--static DEFINE_SPINLOCK(acpi_probe_lock);
-+static DEFINE_MUTEX(acpi_probe_mutex);
-
- static int __init acpi_match_madt(struct acpi_subtable_header *header,
- const unsigned long end)
-@@ -1986,7 +1986,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
- if (acpi_disabled)
- return 0;
-
-- spin_lock(&acpi_probe_lock);
-+ mutex_lock(&acpi_probe_mutex);
- for (ape = ap_head; nr; ape++, nr--) {
- if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
- acpi_probe_count = 0;
-@@ -1999,7 +1999,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
- count++;
- }
- }
-- spin_unlock(&acpi_probe_lock);
-+ mutex_unlock(&acpi_probe_mutex);
-
- return count;
- }
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index a1dcf12..84708a5 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,6 +3663,11 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
-
- opened_bdev[drive] = bdev;
-
-+ if (!(mode & (FMODE_READ|FMODE_WRITE))) {
-+ res = -EINVAL;
-+ goto out;
-+ }
-+
- res = -ENXIO;
-
- if (!floppy_track_buffer) {
-@@ -3706,15 +3711,13 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- if (UFDCS->rawcmd == 1)
- UFDCS->rawcmd = 2;
-
-- if (mode & (FMODE_READ|FMODE_WRITE)) {
-- UDRS->last_checked = 0;
-- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-- check_disk_change(bdev);
-- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-- goto out;
-- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-- goto out;
-- }
-+ UDRS->last_checked = 0;
-+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+ check_disk_change(bdev);
-+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+ goto out;
-+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+ goto out;
-
- res = -EROFS;
-
-diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
-index ca5519c..e7b98c4 100644
---- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
-+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
-@@ -91,6 +91,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
- DEF_FIXED(".s1", CLK_S1, CLK_PLL1_DIV2, 3, 1),
- DEF_FIXED(".s2", CLK_S2, CLK_PLL1_DIV2, 4, 1),
- DEF_FIXED(".s3", CLK_S3, CLK_PLL1_DIV2, 6, 1),
-+ DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1_DIV2, 2, 1),
-
- /* Core Clock Outputs */
- DEF_FIXED("ztr", R8A7795_CLK_ZTR, CLK_PLL1_DIV2, 6, 1),
-@@ -109,10 +110,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
- DEF_FIXED("s3d2", R8A7795_CLK_S3D2, CLK_S3, 2, 1),
- DEF_FIXED("s3d4", R8A7795_CLK_S3D4, CLK_S3, 4, 1),
-
-- DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_PLL1_DIV2, 0x0074),
-- DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_PLL1_DIV2, 0x0078),
-- DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_PLL1_DIV2, 0x0268),
-- DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_PLL1_DIV2, 0x026c),
-+ DEF_GEN3_SD("sd0", R8A7795_CLK_SD0, CLK_SDSRC, 0x0074),
-+ DEF_GEN3_SD("sd1", R8A7795_CLK_SD1, CLK_SDSRC, 0x0078),
-+ DEF_GEN3_SD("sd2", R8A7795_CLK_SD2, CLK_SDSRC, 0x0268),
-+ DEF_GEN3_SD("sd3", R8A7795_CLK_SD3, CLK_SDSRC, 0x026c),
-
- DEF_FIXED("cl", R8A7795_CLK_CL, CLK_PLL1_DIV2, 48, 1),
- DEF_FIXED("cp", R8A7795_CLK_CP, CLK_EXTAL, 2, 1),
-diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
-index ea8189f..6dc5971 100644
---- a/drivers/crypto/caam/caamalg.c
-+++ b/drivers/crypto/caam/caamalg.c
-@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
- OP_ALG_AAI_CTR_MOD128);
- const bool is_rfc3686 = alg->caam.rfc3686;
-
-+ if (!ctx->authsize)
-+ return 0;
-+
- /* NULL encryption / decryption */
- if (!ctx->enckeylen)
- return aead_null_set_sh_desc(aead);
-@@ -614,7 +617,7 @@ skip_enc:
- keys_fit_inline = true;
-
- /* aead_givencrypt shared descriptor */
-- desc = ctx->sh_desc_givenc;
-+ desc = ctx->sh_desc_enc;
-
- /* Note: Context registers are saved. */
- init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686);
-@@ -645,13 +648,13 @@ copy_iv:
- append_operation(desc, ctx->class2_alg_type |
- OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT);
-
-- /* ivsize + cryptlen = seqoutlen - authsize */
-- append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
--
- /* Read and write assoclen bytes */
- append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
- append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
-
-+ /* ivsize + cryptlen = seqoutlen - authsize */
-+ append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
-+
- /* Skip assoc data */
- append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
-
-@@ -697,7 +700,7 @@ copy_iv:
- ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc,
- desc_bytes(desc),
- DMA_TO_DEVICE);
-- if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) {
-+ if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) {
- dev_err(jrdev, "unable to map shared descriptor\n");
- return -ENOMEM;
- }
-diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
-index 5845d4a..e9703f9 100644
---- a/drivers/crypto/caam/caamhash.c
-+++ b/drivers/crypto/caam/caamhash.c
-@@ -1897,6 +1897,7 @@ caam_hash_alloc(struct caam_hash_template *template,
- template->name);
- snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
- template->driver_name);
-+ t_alg->ahash_alg.setkey = NULL;
- }
- alg->cra_module = THIS_MODULE;
- alg->cra_init = caam_hash_cra_init;
-diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
-index 0794f1c..42f0f22 100644
---- a/drivers/crypto/nx/nx.c
-+++ b/drivers/crypto/nx/nx.c
-@@ -392,7 +392,7 @@ static void nx_of_update_msc(struct device *dev,
- ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) &&
- i < msc->triplets;
- i++) {
-- if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) {
-+ if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) {
- dev_err(dev, "unknown function code/mode "
- "combo: %d/%d (ignored)\n", msc->fc,
- msc->mode);
-diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
-index 1e8852a8..4c9deef 100644
---- a/drivers/crypto/qat/qat_common/qat_algs.c
-+++ b/drivers/crypto/qat/qat_common/qat_algs.c
-@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
- .setkey = qat_alg_ablkcipher_xts_setkey,
- .decrypt = qat_alg_ablkcipher_decrypt,
- .encrypt = qat_alg_ablkcipher_encrypt,
-- .min_keysize = AES_MIN_KEY_SIZE,
-- .max_keysize = AES_MAX_KEY_SIZE,
-+ .min_keysize = 2 * AES_MIN_KEY_SIZE,
-+ .max_keysize = 2 * AES_MAX_KEY_SIZE,
- .ivsize = AES_BLOCK_SIZE,
- },
- },
-diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
-index 55d510e..82e6743 100644
---- a/drivers/dax/pmem.c
-+++ b/drivers/dax/pmem.c
-@@ -118,6 +118,9 @@ static int dax_pmem_probe(struct device *dev)
- return rc;
- }
-
-+ /* adjust the dax_region resource to the start of data */
-+ res.start += le64_to_cpu(pfn_sb->dataoff);
-+
- nd_region = to_nd_region(dev->parent);
- dax_region = alloc_dax_region(dev, nd_region->id, &res,
- le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
-diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
-index 749f1bd..06ecdc3 100644
---- a/drivers/dma/sh/usb-dmac.c
-+++ b/drivers/dma/sh/usb-dmac.c
-@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
- {
- struct usb_dmac_chan *chan = dev;
- irqreturn_t ret = IRQ_NONE;
-- u32 mask = USB_DMACHCR_TE;
-- u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
-+ u32 mask = 0;
- u32 chcr;
-+ bool xfer_end = false;
-
- spin_lock(&chan->vc.lock);
-
- chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
-- if (chcr & check_bits)
-- mask |= USB_DMACHCR_DE | check_bits;
-+ if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
-+ mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
-+ if (chcr & USB_DMACHCR_DE)
-+ xfer_end = true;
-+ ret |= IRQ_HANDLED;
-+ }
- if (chcr & USB_DMACHCR_NULL) {
- /* An interruption of TE will happen after we set FTE */
- mask |= USB_DMACHCR_NULL;
- chcr |= USB_DMACHCR_FTE;
- ret |= IRQ_HANDLED;
- }
-- usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
-+ if (mask)
-+ usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
-
-- if (chcr & check_bits) {
-+ if (xfer_end)
- usb_dmac_isr_transfer_end(chan);
-- ret |= IRQ_HANDLED;
-- }
-
- spin_unlock(&chan->vc.lock);
-
-diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index 4fb2eb7..ce0067b 100644
---- a/drivers/edac/sb_edac.c
-+++ b/drivers/edac/sb_edac.c
-@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = {
- /* Knight's Landing Support */
- /*
- * KNL's memory channels are swizzled between memory controllers.
-- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
-+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
- */
--#define knl_channel_remap(channel) ((channel + 3) % 6)
-+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
-
- /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
- #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC 0x7840
-@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg)
- mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
- chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
-
-- return knl_channel_remap(mc*3 + chan);
-+ return knl_channel_remap(mc, chan);
- }
-
- /*
-@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
- } else {
- char A = *("A");
-
-- channel = knl_channel_remap(channel);
-+ /*
-+ * Reported channel is in range 0-2, so we can't map it
-+ * back to mc. To figure out mc we check machine check
-+ * bank register that reported this error.
-+ * bank15 means mc0 and bank16 means mc1.
-+ */
-+ channel = knl_channel_remap(m->bank == 16, channel);
- channel_mask = 1 << channel;
-+
- snprintf(msg, sizeof(msg),
- "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
- overflow ? " OVERFLOW" : "",
-diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
-index c99c24b..9ae6c11 100644
---- a/drivers/firmware/efi/capsule-loader.c
-+++ b/drivers/firmware/efi/capsule-loader.c
-@@ -16,6 +16,7 @@
- #include <linux/slab.h>
- #include <linux/mutex.h>
- #include <linux/efi.h>
-+#include <linux/vmalloc.h>
-
- #define NO_FURTHER_WRITE_ACTION -1
-
-@@ -108,14 +109,15 @@ static ssize_t efi_capsule_submit_update(struct capsule_info *cap_info)
- int ret;
- void *cap_hdr_temp;
-
-- cap_hdr_temp = kmap(cap_info->pages[0]);
-+ cap_hdr_temp = vmap(cap_info->pages, cap_info->index,
-+ VM_MAP, PAGE_KERNEL);
- if (!cap_hdr_temp) {
-- pr_debug("%s: kmap() failed\n", __func__);
-+ pr_debug("%s: vmap() failed\n", __func__);
- return -EFAULT;
- }
-
- ret = efi_capsule_update(cap_hdr_temp, cap_info->pages);
-- kunmap(cap_info->pages[0]);
-+ vunmap(cap_hdr_temp);
- if (ret) {
- pr_err("%s: efi_capsule_update() failed\n", __func__);
- return ret;
-diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c
-index 53b9fd2..6eedff4 100644
---- a/drivers/firmware/efi/capsule.c
-+++ b/drivers/firmware/efi/capsule.c
-@@ -190,9 +190,9 @@ efi_capsule_update_locked(efi_capsule_header_t *capsule,
- * map the capsule described by @capsule with its data in @pages and
- * send it to the firmware via the UpdateCapsule() runtime service.
- *
-- * @capsule must be a virtual mapping of the first page in @pages
-- * (@pages[0]) in the kernel address space. That is, a
-- * capsule_header_t that describes the entire contents of the capsule
-+ * @capsule must be a virtual mapping of the complete capsule update in the
-+ * kernel address space, as the capsule can be consumed immediately.
-+ * A capsule_header_t that describes the entire contents of the capsule
- * must be at the start of the first data page.
- *
- * Even though this function will validate that the firmware supports
-diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
-index d786061..5d457ff 100644
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -50,6 +50,7 @@ config GPIO_DEVRES
- config OF_GPIO
- def_bool y
- depends on OF
-+ depends on HAS_IOMEM
-
- config GPIO_ACPI
- def_bool y
-diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c
-index 0880736..946d091 100644
---- a/drivers/gpio/gpio-max730x.c
-+++ b/drivers/gpio/gpio-max730x.c
-@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
- ts->chip.parent = dev;
- ts->chip.owner = THIS_MODULE;
-
-+ ret = gpiochip_add_data(&ts->chip, ts);
-+ if (ret)
-+ goto exit_destroy;
-+
- /*
- * initialize pullups according to platform data and cache the
- * register values for later use.
-@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
- }
- }
-
-- ret = gpiochip_add_data(&ts->chip, ts);
-- if (ret)
-- goto exit_destroy;
--
- return ret;
-
- exit_destroy:
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-index e055d5be..56475b1 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-@@ -415,6 +415,8 @@ struct amdgpu_mman {
-
- /* custom LRU management */
- struct amdgpu_mman_lru log2_size[AMDGPU_TTM_LRU_SIZE];
-+ /* guard for log2_size array, don't add anything in between */
-+ struct amdgpu_mman_lru guard;
- };
-
- int amdgpu_copy_buffer(struct amdgpu_ring *ring,
-@@ -637,9 +639,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev);
- void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
- int amdgpu_gart_init(struct amdgpu_device *adev);
- void amdgpu_gart_fini(struct amdgpu_device *adev);
--void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
-+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
- int pages);
--int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
-+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
- int pages, struct page **pagelist,
- dma_addr_t *dma_addr, uint32_t flags);
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-index 9831753..fe872b8 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-@@ -321,6 +321,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
- (le16_to_cpu(path->usConnObjectId) &
- OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
-
-+ /* Skip TV/CV support */
-+ if ((le16_to_cpu(path->usDeviceTag) ==
-+ ATOM_DEVICE_TV1_SUPPORT) ||
-+ (le16_to_cpu(path->usDeviceTag) ==
-+ ATOM_DEVICE_CV_SUPPORT))
-+ continue;
-+
-+ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
-+ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
-+ con_obj_id, le16_to_cpu(path->usDeviceTag));
-+ continue;
-+ }
-+
- connector_type =
- object_connector_convert[con_obj_id];
- connector_object_id = con_obj_id;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-index 921bce2..0feea34 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev)
- * Unbinds the requested pages from the gart page table and
- * replaces them with the dummy page (all asics).
- */
--void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
-+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
- int pages)
- {
- unsigned t;
-@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
- * (all asics).
- * Returns 0 for success, -EINVAL for failure.
- */
--int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
-+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
- int pages, struct page **pagelist, dma_addr_t *dma_addr,
- uint32_t flags)
- {
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-index 34e3542..194cfc1 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-@@ -288,7 +288,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
- int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
- {
- unsigned i;
-- int r;
-+ int r, ret = 0;
-
- for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
- struct amdgpu_ring *ring = adev->rings[i];
-@@ -309,10 +309,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
- } else {
- /* still not good, but we can live with it */
- DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
-+ ret = r;
- }
- }
- }
-- return 0;
-+ return ret;
- }
-
- /*
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-index 3b9053a..46c5297 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
-
- adev = amdgpu_get_adev(bo->bdev);
- ring = adev->mman.buffer_funcs_ring;
-- old_start = old_mem->start << PAGE_SHIFT;
-- new_start = new_mem->start << PAGE_SHIFT;
-+ old_start = (u64)old_mem->start << PAGE_SHIFT;
-+ new_start = (u64)new_mem->start << PAGE_SHIFT;
-
- switch (old_mem->mem_type) {
- case TTM_PL_VRAM:
-@@ -943,6 +943,8 @@ static struct list_head *amdgpu_ttm_lru_tail(struct ttm_buffer_object *tbo)
- struct list_head *res = lru->lru[tbo->mem.mem_type];
-
- lru->lru[tbo->mem.mem_type] = &tbo->lru;
-+ while ((++lru)->lru[tbo->mem.mem_type] == res)
-+ lru->lru[tbo->mem.mem_type] = &tbo->lru;
-
- return res;
- }
-@@ -953,6 +955,8 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo)
- struct list_head *res = lru->swap_lru;
-
- lru->swap_lru = &tbo->swap;
-+ while ((++lru)->swap_lru == res)
-+ lru->swap_lru = &tbo->swap;
-
- return res;
- }
-@@ -1004,6 +1008,10 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
- lru->swap_lru = &adev->mman.bdev.glob->swap_lru;
- }
-
-+ for (j = 0; j < TTM_NUM_MEM_TYPES; ++j)
-+ adev->mman.guard.lru[j] = NULL;
-+ adev->mman.guard.swap_lru = NULL;
-+
- adev->mman.initialized = true;
- r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM,
- adev->mc.real_vram_size >> PAGE_SHIFT);
-diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-index 9dc4e24..3a1bbe2 100644
---- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
-+static int cik_sdma_soft_reset(void *handle);
-
- MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
- MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
-@@ -1051,6 +1052,8 @@ static int cik_sdma_resume(void *handle)
- {
- struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
-+ cik_sdma_soft_reset(handle);
-+
- return cik_sdma_hw_init(adev);
- }
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-index fc8ff4d..6b40809 100644
---- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-@@ -2777,8 +2777,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
- u64 wb_gpu_addr;
- u32 *buf;
- struct bonaire_mqd *mqd;
--
-- gfx_v7_0_cp_compute_enable(adev, true);
-+ struct amdgpu_ring *ring;
-
- /* fix up chicken bits */
- tmp = RREG32(mmCP_CPF_DEBUG);
-@@ -2813,7 +2812,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
-
- /* init the queues. Just two for now. */
- for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-- struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
-+ ring = &adev->gfx.compute_ring[i];
-
- if (ring->mqd_obj == NULL) {
- r = amdgpu_bo_create(adev,
-@@ -2992,6 +2991,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
- amdgpu_bo_unreserve(ring->mqd_obj);
-
- ring->ready = true;
-+ }
-+
-+ gfx_v7_0_cp_compute_enable(adev, true);
-+
-+ for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-+ ring = &adev->gfx.compute_ring[i];
-+
- r = amdgpu_ring_test_ring(ring);
- if (r)
- ring->ready = false;
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 85c4deb..fd3553b 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -1578,6 +1578,9 @@ static int intel_runtime_suspend(struct device *device)
-
- assert_forcewakes_inactive(dev_priv);
-
-+ if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
-+ intel_hpd_poll_init(dev_priv);
-+
- DRM_DEBUG_KMS("Device suspended\n");
- return 0;
- }
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 227a63e..0ed5fd3 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -281,6 +281,9 @@ struct i915_hotplug {
- u32 short_port_mask;
- struct work_struct dig_port_work;
-
-+ struct work_struct poll_init_work;
-+ bool poll_enabled;
-+
- /*
- * if we get a HPD irq from DP and a HPD irq from non-DP
- * the non-DP HPD could block the workqueue on a mode config
-@@ -2791,6 +2794,8 @@ void intel_hpd_init(struct drm_i915_private *dev_priv);
- void intel_hpd_init_work(struct drm_i915_private *dev_priv);
- void intel_hpd_cancel_work(struct drm_i915_private *dev_priv);
- bool intel_hpd_pin_to_port(enum hpd_pin pin, enum port *port);
-+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
-+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
-
- /* i915_irq.c */
- void i915_queue_hangcheck(struct drm_device *dev);
-diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
-index 92acdff..e856f79 100644
---- a/drivers/gpu/drm/i915/i915_gem_gtt.c
-+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
-@@ -2826,6 +2826,7 @@ void i915_ggtt_cleanup_hw(struct drm_device *dev)
- struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
-
- ppgtt->base.cleanup(&ppgtt->base);
-+ kfree(ppgtt);
- }
-
- i915_gem_cleanup_stolen(dev);
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index bc3b6dd..5369a6d 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -1522,6 +1522,7 @@ enum skl_disp_power_wells {
- #define BALANCE_LEG_MASK(port) (7<<(8+3*(port)))
- /* Balance leg disable bits */
- #define BALANCE_LEG_DISABLE_SHIFT 23
-+#define BALANCE_LEG_DISABLE(port) (1 << (23 + (port)))
-
- /*
- * Fence registers
-diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
-index 02a7527..74eca43 100644
---- a/drivers/gpu/drm/i915/intel_audio.c
-+++ b/drivers/gpu/drm/i915/intel_audio.c
-@@ -600,6 +600,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
- if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
- return;
-
-+ i915_audio_component_get_power(dev);
-+
- /*
- * Enable/disable generating the codec wake signal, overriding the
- * internal logic to generate the codec wake to controller.
-@@ -615,6 +617,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
- I915_WRITE(HSW_AUD_CHICKENBIT, tmp);
- usleep_range(1000, 1500);
- }
-+
-+ i915_audio_component_put_power(dev);
- }
-
- /* Get CDCLK in kHz */
-@@ -654,6 +658,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
- !IS_HASWELL(dev_priv))
- return 0;
-
-+ i915_audio_component_get_power(dev);
- mutex_lock(&dev_priv->av_mutex);
- /* 1. get the pipe */
- intel_encoder = dev_priv->dig_port_map[port];
-@@ -704,6 +709,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
-
- unlock:
- mutex_unlock(&dev_priv->av_mutex);
-+ i915_audio_component_put_power(dev);
- return err;
- }
-
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index 3fbb6fc..a3f87d6 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -327,10 +327,25 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector)
- struct drm_device *dev = connector->dev;
- struct intel_crt *crt = intel_attached_crt(connector);
- struct drm_i915_private *dev_priv = dev->dev_private;
-+ bool reenable_hpd;
- u32 adpa;
- bool ret;
- u32 save_adpa;
-
-+ /*
-+ * Doing a force trigger causes a hpd interrupt to get sent, which can
-+ * get us stuck in a loop if we're polling:
-+ * - We enable power wells and reset the ADPA
-+ * - output_poll_exec does force probe on VGA, triggering a hpd
-+ * - HPD handler waits for poll to unlock dev->mode_config.mutex
-+ * - output_poll_exec shuts off the ADPA, unlocks
-+ * dev->mode_config.mutex
-+ * - HPD handler runs, resets ADPA and brings us back to the start
-+ *
-+ * Just disable HPD interrupts here to prevent this
-+ */
-+ reenable_hpd = intel_hpd_disable(dev_priv, crt->base.hpd_pin);
-+
- save_adpa = adpa = I915_READ(crt->adpa_reg);
- DRM_DEBUG_KMS("trigger hotplug detect cycle: adpa=0x%x\n", adpa);
-
-@@ -353,6 +368,9 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector)
-
- DRM_DEBUG_KMS("valleyview hotplug adpa=0x%x, result %d\n", adpa, ret);
-
-+ if (reenable_hpd)
-+ intel_hpd_enable(dev_priv, crt->base.hpd_pin);
-+
- return ret;
- }
-
-@@ -713,11 +731,11 @@ static int intel_crt_set_property(struct drm_connector *connector,
- return 0;
- }
-
--static void intel_crt_reset(struct drm_connector *connector)
-+void intel_crt_reset(struct drm_encoder *encoder)
- {
-- struct drm_device *dev = connector->dev;
-+ struct drm_device *dev = encoder->dev;
- struct drm_i915_private *dev_priv = dev->dev_private;
-- struct intel_crt *crt = intel_attached_crt(connector);
-+ struct intel_crt *crt = intel_encoder_to_crt(to_intel_encoder(encoder));
-
- if (INTEL_INFO(dev)->gen >= 5) {
- u32 adpa;
-@@ -739,7 +757,6 @@ static void intel_crt_reset(struct drm_connector *connector)
- */
-
- static const struct drm_connector_funcs intel_crt_connector_funcs = {
-- .reset = intel_crt_reset,
- .dpms = drm_atomic_helper_connector_dpms,
- .detect = intel_crt_detect,
- .fill_modes = drm_helper_probe_single_connector_modes,
-@@ -757,6 +774,7 @@ static const struct drm_connector_helper_funcs intel_crt_connector_helper_funcs
- };
-
- static const struct drm_encoder_funcs intel_crt_enc_funcs = {
-+ .reset = intel_crt_reset,
- .destroy = intel_encoder_destroy,
- };
-
-@@ -902,5 +920,5 @@ void intel_crt_init(struct drm_device *dev)
- dev_priv->fdi_rx_config = I915_READ(FDI_RX_CTL(PIPE_A)) & fdi_config;
- }
-
-- intel_crt_reset(connector);
-+ intel_crt_reset(&crt->base.base);
- }
-diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
-index 01e523d..12c4f43 100644
---- a/drivers/gpu/drm/i915/intel_ddi.c
-+++ b/drivers/gpu/drm/i915/intel_ddi.c
-@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_ddi_translations_dp[] = {
- static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
- { 0x0000201B, 0x000000A2, 0x0 },
- { 0x00005012, 0x00000088, 0x0 },
-- { 0x80007011, 0x000000CD, 0x0 },
-+ { 0x80007011, 0x000000CD, 0x1 },
- { 0x80009010, 0x000000C0, 0x1 },
- { 0x0000201B, 0x0000009D, 0x0 },
- { 0x80005012, 0x000000C0, 0x1 },
-@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
- static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = {
- { 0x00000018, 0x000000A2, 0x0 },
- { 0x00005012, 0x00000088, 0x0 },
-- { 0x80007011, 0x000000CD, 0x0 },
-+ { 0x80007011, 0x000000CD, 0x3 },
- { 0x80009010, 0x000000C0, 0x3 },
- { 0x00000018, 0x0000009D, 0x0 },
- { 0x80005012, 0x000000C0, 0x3 },
-@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_private *dev_priv, int *n_entries)
- }
- }
-
-+static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
-+{
-+ int n_hdmi_entries;
-+ int hdmi_level;
-+ int hdmi_default_entry;
-+
-+ hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
-+
-+ if (IS_BROXTON(dev_priv))
-+ return hdmi_level;
-+
-+ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
-+ skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
-+ hdmi_default_entry = 8;
-+ } else if (IS_BROADWELL(dev_priv)) {
-+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-+ hdmi_default_entry = 7;
-+ } else if (IS_HASWELL(dev_priv)) {
-+ n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
-+ hdmi_default_entry = 6;
-+ } else {
-+ WARN(1, "ddi translation table missing\n");
-+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-+ hdmi_default_entry = 7;
-+ }
-+
-+ /* Choose a good default if VBT is badly populated */
-+ if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
-+ hdmi_level >= n_hdmi_entries)
-+ hdmi_level = hdmi_default_entry;
-+
-+ return hdmi_level;
-+}
-+
- /*
- * Starting with Haswell, DDI port buffers must be programmed with correct
- * values in advance. The buffer values are different for FDI and DP modes,
-@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- {
- struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
- u32 iboost_bit = 0;
-- int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry,
-+ int i, n_hdmi_entries, n_dp_entries, n_edp_entries,
- size;
- int hdmi_level;
- enum port port;
-@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- const struct ddi_buf_trans *ddi_translations;
-
- port = intel_ddi_get_encoder_port(encoder);
-- hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
-+ hdmi_level = intel_ddi_hdmi_level(dev_priv, port);
-
- if (IS_BROXTON(dev_priv)) {
- if (encoder->type != INTEL_OUTPUT_HDMI)
-@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- skl_get_buf_trans_edp(dev_priv, &n_edp_entries);
- ddi_translations_hdmi =
- skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
-- hdmi_default_entry = 8;
- /* If we're boosting the current, set bit 31 of trans1 */
- if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level ||
- dev_priv->vbt.ddi_port_info[port].dp_boost_level)
-@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
-
- n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
- n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-- hdmi_default_entry = 7;
- } else if (IS_HASWELL(dev_priv)) {
- ddi_translations_fdi = hsw_ddi_translations_fdi;
- ddi_translations_dp = hsw_ddi_translations_dp;
-@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- ddi_translations_hdmi = hsw_ddi_translations_hdmi;
- n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp);
- n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
-- hdmi_default_entry = 6;
- } else {
- WARN(1, "ddi translation table missing\n");
- ddi_translations_edp = bdw_ddi_translations_dp;
-@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
- n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
- n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-- hdmi_default_entry = 7;
- }
-
- switch (encoder->type) {
-@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- if (encoder->type != INTEL_OUTPUT_HDMI)
- return;
-
-- /* Choose a good default if VBT is badly populated */
-- if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
-- hdmi_level >= n_hdmi_entries)
-- hdmi_level = hdmi_default_entry;
--
- /* Entry 9 is for HDMI: */
- I915_WRITE(DDI_BUF_TRANS_LO(port, i),
- ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit);
-@@ -1371,14 +1396,30 @@ void intel_ddi_disable_pipe_clock(struct intel_crtc *intel_crtc)
- TRANS_CLK_SEL_DISABLED);
- }
-
--static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
-- u32 level, enum port port, int type)
-+static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
-+ enum port port, uint8_t iboost)
- {
-+ u32 tmp;
-+
-+ tmp = I915_READ(DISPIO_CR_TX_BMU_CR0);
-+ tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port));
-+ if (iboost)
-+ tmp |= iboost << BALANCE_LEG_SHIFT(port);
-+ else
-+ tmp |= BALANCE_LEG_DISABLE(port);
-+ I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp);
-+}
-+
-+static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level)
-+{
-+ struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base);
-+ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
-+ enum port port = intel_dig_port->port;
-+ int type = encoder->type;
- const struct ddi_buf_trans *ddi_translations;
- uint8_t iboost;
- uint8_t dp_iboost, hdmi_iboost;
- int n_entries;
-- u32 reg;
-
- /* VBT may override standard boost values */
- dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level;
-@@ -1420,16 +1461,10 @@ static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
- return;
- }
-
-- reg = I915_READ(DISPIO_CR_TX_BMU_CR0);
-- reg &= ~BALANCE_LEG_MASK(port);
-- reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port));
--
-- if (iboost)
-- reg |= iboost << BALANCE_LEG_SHIFT(port);
-- else
-- reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port);
-+ _skl_ddi_set_iboost(dev_priv, port, iboost);
-
-- I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg);
-+ if (port == PORT_A && intel_dig_port->max_lanes == 4)
-+ _skl_ddi_set_iboost(dev_priv, PORT_E, iboost);
- }
-
- static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv,
-@@ -1560,7 +1595,7 @@ uint32_t ddi_signal_levels(struct intel_dp *intel_dp)
- level = translate_signal_level(signal_levels);
-
- if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-- skl_ddi_set_iboost(dev_priv, level, port, encoder->type);
-+ skl_ddi_set_iboost(encoder, level);
- else if (IS_BROXTON(dev_priv))
- bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type);
-
-@@ -1629,6 +1664,10 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder)
- intel_dp_stop_link_train(intel_dp);
- } else if (type == INTEL_OUTPUT_HDMI) {
- struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
-+ int level = intel_ddi_hdmi_level(dev_priv, port);
-+
-+ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-+ skl_ddi_set_iboost(intel_encoder, level);
-
- intel_hdmi->set_infoframes(encoder,
- crtc->config->has_hdmi_sink,
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index f7f0f01..94144a7 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -1052,7 +1052,7 @@ void gen8_irq_power_well_pre_disable(struct drm_i915_private *dev_priv,
-
- /* intel_crt.c */
- void intel_crt_init(struct drm_device *dev);
--
-+void intel_crt_reset(struct drm_encoder *encoder);
-
- /* intel_ddi.c */
- void intel_ddi_clk_select(struct intel_encoder *encoder,
-@@ -1346,6 +1346,8 @@ void intel_dsi_init(struct drm_device *dev);
-
- /* intel_dvo.c */
- void intel_dvo_init(struct drm_device *dev);
-+/* intel_hotplug.c */
-+void intel_hpd_poll_init(struct drm_i915_private *dev_priv);
-
-
- /* legacy fbdev emulation in intel_fbdev.c */
-diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
-index bee6730..2c49458 100644
---- a/drivers/gpu/drm/i915/intel_hotplug.c
-+++ b/drivers/gpu/drm/i915/intel_hotplug.c
-@@ -453,20 +453,47 @@ void intel_hpd_irq_handler(struct drm_device *dev,
- *
- * This is a separate step from interrupt enabling to simplify the locking rules
- * in the driver load and resume code.
-+ *
-+ * Also see: intel_hpd_poll_init(), which enables connector polling
- */
- void intel_hpd_init(struct drm_i915_private *dev_priv)
- {
-- struct drm_device *dev = dev_priv->dev;
-- struct drm_mode_config *mode_config = &dev->mode_config;
-- struct drm_connector *connector;
- int i;
-
- for_each_hpd_pin(i) {
- dev_priv->hotplug.stats[i].count = 0;
- dev_priv->hotplug.stats[i].state = HPD_ENABLED;
- }
-+
-+ WRITE_ONCE(dev_priv->hotplug.poll_enabled, false);
-+ schedule_work(&dev_priv->hotplug.poll_init_work);
-+
-+ /*
-+ * Interrupt setup is already guaranteed to be single-threaded, this is
-+ * just to make the assert_spin_locked checks happy.
-+ */
-+ spin_lock_irq(&dev_priv->irq_lock);
-+ if (dev_priv->display.hpd_irq_setup)
-+ dev_priv->display.hpd_irq_setup(dev_priv->dev);
-+ spin_unlock_irq(&dev_priv->irq_lock);
-+}
-+
-+void i915_hpd_poll_init_work(struct work_struct *work) {
-+ struct drm_i915_private *dev_priv =
-+ container_of(work, struct drm_i915_private,
-+ hotplug.poll_init_work);
-+ struct drm_device *dev = dev_priv->dev;
-+ struct drm_mode_config *mode_config = &dev->mode_config;
-+ struct drm_connector *connector;
-+ bool enabled;
-+
-+ mutex_lock(&dev->mode_config.mutex);
-+
-+ enabled = READ_ONCE(dev_priv->hotplug.poll_enabled);
-+
- list_for_each_entry(connector, &mode_config->connector_list, head) {
-- struct intel_connector *intel_connector = to_intel_connector(connector);
-+ struct intel_connector *intel_connector =
-+ to_intel_connector(connector);
- connector->polled = intel_connector->polled;
-
- /* MST has a dynamic intel_connector->encoder and it's reprobing
-@@ -475,24 +502,62 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
- continue;
-
- if (!connector->polled && I915_HAS_HOTPLUG(dev) &&
-- intel_connector->encoder->hpd_pin > HPD_NONE)
-- connector->polled = DRM_CONNECTOR_POLL_HPD;
-+ intel_connector->encoder->hpd_pin > HPD_NONE) {
-+ connector->polled = enabled ?
-+ DRM_CONNECTOR_POLL_CONNECT |
-+ DRM_CONNECTOR_POLL_DISCONNECT :
-+ DRM_CONNECTOR_POLL_HPD;
-+ }
- }
-
-+ if (enabled)
-+ drm_kms_helper_poll_enable_locked(dev);
-+
-+ mutex_unlock(&dev->mode_config.mutex);
-+
- /*
-- * Interrupt setup is already guaranteed to be single-threaded, this is
-- * just to make the assert_spin_locked checks happy.
-+ * We might have missed any hotplugs that happened while we were
-+ * in the middle of disabling polling
- */
-- spin_lock_irq(&dev_priv->irq_lock);
-- if (dev_priv->display.hpd_irq_setup)
-- dev_priv->display.hpd_irq_setup(dev);
-- spin_unlock_irq(&dev_priv->irq_lock);
-+ if (!enabled)
-+ drm_helper_hpd_irq_event(dev);
-+}
-+
-+/**
-+ * intel_hpd_poll_init - enables/disables polling for connectors with hpd
-+ * @dev_priv: i915 device instance
-+ * @enabled: Whether to enable or disable polling
-+ *
-+ * This function enables polling for all connectors, regardless of whether or
-+ * not they support hotplug detection. Under certain conditions HPD may not be
-+ * functional. On most Intel GPUs, this happens when we enter runtime suspend.
-+ * On Valleyview and Cherryview systems, this also happens when we shut off all
-+ * of the powerwells.
-+ *
-+ * Since this function can get called in contexts where we're already holding
-+ * dev->mode_config.mutex, we do the actual hotplug enabling in a seperate
-+ * worker.
-+ *
-+ * Also see: intel_hpd_init(), which restores hpd handling.
-+ */
-+void intel_hpd_poll_init(struct drm_i915_private *dev_priv)
-+{
-+ WRITE_ONCE(dev_priv->hotplug.poll_enabled, true);
-+
-+ /*
-+ * We might already be holding dev->mode_config.mutex, so do this in a
-+ * seperate worker
-+ * As well, there's no issue if we race here since we always reschedule
-+ * this worker anyway
-+ */
-+ schedule_work(&dev_priv->hotplug.poll_init_work);
- }
-
- void intel_hpd_init_work(struct drm_i915_private *dev_priv)
- {
- INIT_WORK(&dev_priv->hotplug.hotplug_work, i915_hotplug_work_func);
- INIT_WORK(&dev_priv->hotplug.dig_port_work, i915_digport_work_func);
-+ INIT_WORK(&dev_priv->hotplug.poll_init_work, i915_hpd_poll_init_work);
- INIT_DELAYED_WORK(&dev_priv->hotplug.reenable_work,
- intel_hpd_irq_storm_reenable_work);
- }
-@@ -509,5 +574,33 @@ void intel_hpd_cancel_work(struct drm_i915_private *dev_priv)
-
- cancel_work_sync(&dev_priv->hotplug.dig_port_work);
- cancel_work_sync(&dev_priv->hotplug.hotplug_work);
-+ cancel_work_sync(&dev_priv->hotplug.poll_init_work);
- cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work);
- }
-+
-+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
-+{
-+ bool ret = false;
-+
-+ if (pin == HPD_NONE)
-+ return false;
-+
-+ spin_lock_irq(&dev_priv->irq_lock);
-+ if (dev_priv->hotplug.stats[pin].state == HPD_ENABLED) {
-+ dev_priv->hotplug.stats[pin].state = HPD_DISABLED;
-+ ret = true;
-+ }
-+ spin_unlock_irq(&dev_priv->irq_lock);
-+
-+ return ret;
-+}
-+
-+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
-+{
-+ if (pin == HPD_NONE)
-+ return;
-+
-+ spin_lock_irq(&dev_priv->irq_lock);
-+ dev_priv->hotplug.stats[pin].state = HPD_ENABLED;
-+ spin_unlock_irq(&dev_priv->irq_lock);
-+}
-diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
-index 7fb1da4..2592b39 100644
---- a/drivers/gpu/drm/i915/intel_runtime_pm.c
-+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
-@@ -952,6 +952,7 @@ static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv)
-
- static void vlv_display_power_well_init(struct drm_i915_private *dev_priv)
- {
-+ struct intel_encoder *encoder;
- enum pipe pipe;
-
- /*
-@@ -987,6 +988,12 @@ static void vlv_display_power_well_init(struct drm_i915_private *dev_priv)
-
- intel_hpd_init(dev_priv);
-
-+ /* Re-enable the ADPA, if we have one */
-+ for_each_intel_encoder(dev_priv->dev, encoder) {
-+ if (encoder->type == INTEL_OUTPUT_ANALOG)
-+ intel_crt_reset(&encoder->base);
-+ }
-+
- i915_redisable_vga_power_on(dev_priv->dev);
- }
-
-@@ -1000,6 +1007,8 @@ static void vlv_display_power_well_deinit(struct drm_i915_private *dev_priv)
- synchronize_irq(dev_priv->dev->irq);
-
- vlv_power_sequencer_reset(dev_priv);
-+
-+ intel_hpd_poll_init(dev_priv);
- }
-
- static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv,
-diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c
-index b550ba5..8944987 100644
---- a/drivers/hwmon/iio_hwmon.c
-+++ b/drivers/hwmon/iio_hwmon.c
-@@ -110,24 +110,24 @@ static int iio_hwmon_probe(struct platform_device *pdev)
-
- switch (type) {
- case IIO_VOLTAGE:
-- a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
-- "in%d_input",
-- in_i++);
-+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+ "in%d_input",
-+ in_i++);
- break;
- case IIO_TEMP:
-- a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
-- "temp%d_input",
-- temp_i++);
-+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+ "temp%d_input",
-+ temp_i++);
- break;
- case IIO_CURRENT:
-- a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
-- "curr%d_input",
-- curr_i++);
-+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+ "curr%d_input",
-+ curr_i++);
- break;
- case IIO_HUMIDITYRELATIVE:
-- a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
-- "humidity%d_input",
-- humidity_i++);
-+ a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+ "humidity%d_input",
-+ humidity_i++);
- break;
- default:
- ret = -EINVAL;
-diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
-index 730d840..55bf479 100644
---- a/drivers/hwmon/it87.c
-+++ b/drivers/hwmon/it87.c
-@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
- &sensor_dev_attr_in10_input.dev_attr.attr, /* 41 */
- &sensor_dev_attr_in11_input.dev_attr.attr, /* 41 */
- &sensor_dev_attr_in12_input.dev_attr.attr, /* 41 */
-+ NULL
- };
-
- static const struct attribute_group it87_group_in = {
-diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-index a0d95ff..2d5ff863 100644
---- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
- msg->outsize = request_len;
- msg->insize = response_len;
-
-- result = cros_ec_cmd_xfer(bus->ec, msg);
-+ result = cros_ec_cmd_xfer_status(bus->ec, msg);
- if (result < 0) {
- dev_err(dev, "Error transferring EC i2c message %d\n", result);
- goto exit;
-diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-index 8de073a..215ac87 100644
---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
-+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
- adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
- if (!adap) {
- ret = -ENODEV;
-- goto err;
-+ goto err_with_revert;
- }
-
- p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
-@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
-
- err_with_put:
- i2c_put_adapter(adap);
-+ err_with_revert:
-+ of_changeset_revert(&priv->chan[new_chan].chgset);
- err:
- dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
- return ret;
-diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
-index 90462fc..49bf9c5 100644
---- a/drivers/iio/industrialio-buffer.c
-+++ b/drivers/iio/industrialio-buffer.c
-@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
- {
- struct iio_dev *indio_dev = filp->private_data;
- struct iio_buffer *rb = indio_dev->buffer;
-+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
- size_t datum_size;
- size_t to_wait;
- int ret;
-@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
- else
- to_wait = min_t(size_t, n / datum_size, rb->watermark);
-
-+ add_wait_queue(&rb->pollq, &wait);
- do {
-- ret = wait_event_interruptible(rb->pollq,
-- iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
-- if (ret)
-- return ret;
-+ if (!indio_dev->info) {
-+ ret = -ENODEV;
-+ break;
-+ }
-
-- if (!indio_dev->info)
-- return -ENODEV;
-+ if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
-+ if (signal_pending(current)) {
-+ ret = -ERESTARTSYS;
-+ break;
-+ }
-+
-+ wait_woken(&wait, TASK_INTERRUPTIBLE,
-+ MAX_SCHEDULE_TIMEOUT);
-+ continue;
-+ }
-
- ret = rb->access->read_first_n(rb, n, buf);
- if (ret == 0 && (filp->f_flags & O_NONBLOCK))
- ret = -EAGAIN;
- } while (ret == 0);
-+ remove_wait_queue(&rb->pollq, &wait);
-
- return ret;
- }
-diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
-index acc5394..29485bc 100644
---- a/drivers/input/keyboard/tegra-kbc.c
-+++ b/drivers/input/keyboard/tegra-kbc.c
-@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
- /* Reset the KBC controller to clear all previous status.*/
- reset_control_assert(kbc->rst);
- udelay(100);
-- reset_control_assert(kbc->rst);
-+ reset_control_deassert(kbc->rst);
- udelay(100);
-
- tegra_kbc_config_pins(kbc);
-diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
-index faa295e..c83bce8 100644
---- a/drivers/input/rmi4/rmi_driver.c
-+++ b/drivers/input/rmi4/rmi_driver.c
-@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- goto free_struct_buff;
-
- reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
-- map_offset = 0;
- for (i = 0; i < rdesc->num_registers; i++) {
- struct rmi_register_desc_item *item = &rdesc->registers[i];
- int reg_size = struct_buf[offset];
-@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- item->reg = reg;
- item->reg_size = reg_size;
-
-+ map_offset = 0;
-+
- do {
- for (b = 0; b < 7; b++) {
- if (struct_buf[offset] & (0x1 << b))
-diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
-index 4541957..405252a 100644
---- a/drivers/input/serio/i8042.c
-+++ b/drivers/input/serio/i8042.c
-@@ -1277,6 +1277,7 @@ static int __init i8042_create_kbd_port(void)
- serio->start = i8042_start;
- serio->stop = i8042_stop;
- serio->close = i8042_port_close;
-+ serio->ps2_cmd_mutex = &i8042_mutex;
- serio->port_data = port;
- serio->dev.parent = &i8042_platform_device->dev;
- strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
-@@ -1304,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx)
- serio->write = i8042_aux_write;
- serio->start = i8042_start;
- serio->stop = i8042_stop;
-+ serio->ps2_cmd_mutex = &i8042_mutex;
- serio->port_data = port;
- serio->dev.parent = &i8042_platform_device->dev;
- if (idx < 0) {
-@@ -1373,21 +1375,6 @@ static void i8042_unregister_ports(void)
- }
- }
-
--/*
-- * Checks whether port belongs to i8042 controller.
-- */
--bool i8042_check_port_owner(const struct serio *port)
--{
-- int i;
--
-- for (i = 0; i < I8042_NUM_PORTS; i++)
-- if (i8042_ports[i].serio == port)
-- return true;
--
-- return false;
--}
--EXPORT_SYMBOL(i8042_check_port_owner);
--
- static void i8042_free_irqs(void)
- {
- if (i8042_aux_irq_registered)
-diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
-index 316f2c8..83e9c66 100644
---- a/drivers/input/serio/libps2.c
-+++ b/drivers/input/serio/libps2.c
-@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte);
-
- void ps2_begin_command(struct ps2dev *ps2dev)
- {
-- mutex_lock(&ps2dev->cmd_mutex);
-+ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
-
-- if (i8042_check_port_owner(ps2dev->serio))
-- i8042_lock_chip();
-+ mutex_lock(m);
- }
- EXPORT_SYMBOL(ps2_begin_command);
-
- void ps2_end_command(struct ps2dev *ps2dev)
- {
-- if (i8042_check_port_owner(ps2dev->serio))
-- i8042_unlock_chip();
-+ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
-
-- mutex_unlock(&ps2dev->cmd_mutex);
-+ mutex_unlock(m);
- }
- EXPORT_SYMBOL(ps2_end_command);
-
-diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
-index 5f6b3bc..46ba2b6 100644
---- a/drivers/iommu/arm-smmu-v3.c
-+++ b/drivers/iommu/arm-smmu-v3.c
-@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
- * We may have concurrent producers, so we need to be careful
- * not to touch any of the shadow cmdq state.
- */
-- queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
-+ queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
- dev_err(smmu->dev, "skipping command in error state:\n");
- for (i = 0; i < ARRAY_SIZE(cmd); ++i)
- dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
-@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
- return;
- }
-
-- queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
-+ queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
- }
-
- static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
-@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
- case STRTAB_STE_0_CFG_S2_TRANS:
- ste_live = true;
- break;
-+ case STRTAB_STE_0_CFG_ABORT:
-+ if (disable_bypass)
-+ break;
- default:
- BUG(); /* STE corruption */
- }
-diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
-index 9345a3f..31422d4 100644
---- a/drivers/iommu/arm-smmu.c
-+++ b/drivers/iommu/arm-smmu.c
-@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = {
-
- static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
- {
-- int flags, ret;
-- u32 fsr, fsynr, resume;
-+ u32 fsr, fsynr;
- unsigned long iova;
- struct iommu_domain *domain = dev;
- struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
-@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
- if (!(fsr & FSR_FAULT))
- return IRQ_NONE;
-
-- if (fsr & FSR_IGN)
-- dev_err_ratelimited(smmu->dev,
-- "Unexpected context fault (fsr 0x%x)\n",
-- fsr);
--
- fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
-- flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
--
- iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
-- if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
-- ret = IRQ_HANDLED;
-- resume = RESUME_RETRY;
-- } else {
-- dev_err_ratelimited(smmu->dev,
-- "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-- iova, fsynr, cfg->cbndx);
-- ret = IRQ_NONE;
-- resume = RESUME_TERMINATE;
-- }
--
-- /* Clear the faulting FSR */
-- writel(fsr, cb_base + ARM_SMMU_CB_FSR);
-
-- /* Retry or terminate any stalled transactions */
-- if (fsr & FSR_SS)
-- writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
-+ dev_err_ratelimited(smmu->dev,
-+ "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-+ fsr, iova, fsynr, cfg->cbndx);
-
-- return ret;
-+ writel(fsr, cb_base + ARM_SMMU_CB_FSR);
-+ return IRQ_HANDLED;
- }
-
- static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
-@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain,
- }
-
- /* SCTLR */
-- reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
-+ reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
- if (stage1)
- reg |= SCTLR_S1_ASIDPNE;
- #ifdef __BIG_ENDIAN
-diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
-index ea5a9eb..97a2308 100644
---- a/drivers/iommu/dma-iommu.c
-+++ b/drivers/iommu/dma-iommu.c
-@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain)
- if (!iovad)
- return;
-
-- put_iova_domain(iovad);
-+ if (iovad->granule)
-+ put_iova_domain(iovad);
- kfree(iovad);
- domain->iova_cookie = NULL;
- }
-diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
-index 8c61399..def8ca1 100644
---- a/drivers/iommu/io-pgtable-arm-v7s.c
-+++ b/drivers/iommu/io-pgtable-arm-v7s.c
-@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl)
- int prot = IOMMU_READ;
- arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
-
-- if (attr & ARM_V7S_PTE_AP_RDONLY)
-+ if (!(attr & ARM_V7S_PTE_AP_RDONLY))
- prot |= IOMMU_WRITE;
- if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
- prot |= IOMMU_MMIO;
- else if (pte & ARM_V7S_ATTR_C)
- prot |= IOMMU_CACHE;
-+ if (pte & ARM_V7S_ATTR_XN(lvl))
-+ prot |= IOMMU_NOEXEC;
-
- return prot;
- }
-diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
-index 4ace1da..6c25213 100644
---- a/drivers/md/dm-round-robin.c
-+++ b/drivers/md/dm-round-robin.c
-@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes)
- struct path_info *pi = NULL;
- struct dm_path *current_path = NULL;
-
-+ local_irq_save(flags);
- current_path = *this_cpu_ptr(s->current_path);
- if (current_path) {
- percpu_counter_dec(&s->repeat_count);
-- if (percpu_counter_read_positive(&s->repeat_count) > 0)
-+ if (percpu_counter_read_positive(&s->repeat_count) > 0) {
-+ local_irq_restore(flags);
- return current_path;
-+ }
- }
-
-- spin_lock_irqsave(&s->lock, flags);
-+ spin_lock(&s->lock);
- if (!list_empty(&s->valid_paths)) {
- pi = list_entry(s->valid_paths.next, struct path_info, list);
- list_move_tail(&pi->list, &s->valid_paths);
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 8bb3d1a..c6a8f47 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -2318,20 +2318,13 @@ struct device_node *of_graph_get_endpoint_by_regs(
- const struct device_node *parent, int port_reg, int reg)
- {
- struct of_endpoint endpoint;
-- struct device_node *node, *prev_node = NULL;
--
-- while (1) {
-- node = of_graph_get_next_endpoint(parent, prev_node);
-- of_node_put(prev_node);
-- if (!node)
-- break;
-+ struct device_node *node = NULL;
-
-+ for_each_endpoint_of_node(parent, node) {
- of_graph_parse_endpoint(node, &endpoint);
- if (((port_reg == -1) || (endpoint.port == port_reg)) &&
- ((reg == -1) || (endpoint.id == reg)))
- return node;
--
-- prev_node = node;
- }
-
- return NULL;
-diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
-index a080f44..565e2a4 100644
---- a/drivers/pci/msi.c
-+++ b/drivers/pci/msi.c
-@@ -1277,6 +1277,8 @@ struct irq_domain *pci_msi_create_irq_domain(struct fwnode_handle *fwnode,
- if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS)
- pci_msi_domain_update_chip_ops(info);
-
-+ info->flags |= MSI_FLAG_ACTIVATE_EARLY;
-+
- domain = msi_create_irq_domain(fwnode, info, parent);
- if (!domain)
- return NULL;
-diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
-index 11623c6..44e69c9 100644
---- a/drivers/pinctrl/meson/pinctrl-meson.c
-+++ b/drivers/pinctrl/meson/pinctrl-meson.c
-@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev)
- return PTR_ERR(pc->pcdev);
- }
-
-- ret = meson_gpiolib_register(pc);
-- if (ret) {
-- pinctrl_unregister(pc->pcdev);
-- return ret;
-- }
--
-- return 0;
-+ return meson_gpiolib_register(pc);
- }
-
- static struct platform_driver meson_pinctrl_driver = {
-diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
-index 634b4d3..b3e7723 100644
---- a/drivers/pinctrl/pinctrl-amd.c
-+++ b/drivers/pinctrl/pinctrl-amd.c
-@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
-
- spin_lock_irqsave(&gpio_dev->lock, flags);
- pin_reg = readl(gpio_dev->base + offset * 4);
-- /*
-- * Suppose BIOS or Bootloader sets specific debounce for the
-- * GPIO. if not, set debounce to be 2.75ms and remove glitch.
-- */
-- if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-- pin_reg |= 0xf;
-- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
-- pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-- }
--
- pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
- writel(pin_reg, gpio_dev->base + offset * 4);
- spin_unlock_irqrestore(&gpio_dev->lock, flags);
-@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d)
-
- spin_lock_irqsave(&gpio_dev->lock, flags);
- pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
-- /*
-- Suppose BIOS or Bootloader sets specific debounce for the
-- GPIO. if not, set debounce to be 2.75ms.
-- */
-- if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-- pin_reg |= 0xf;
-- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-- pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-- }
- pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
- pin_reg |= BIT(INTERRUPT_MASK_OFF);
- writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
-diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
-index b6e161f..6c084b2 100644
---- a/drivers/platform/chrome/cros_ec_proto.c
-+++ b/drivers/platform/chrome/cros_ec_proto.c
-@@ -380,3 +380,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
- return ret;
- }
- EXPORT_SYMBOL(cros_ec_cmd_xfer);
-+
-+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
-+ struct cros_ec_command *msg)
-+{
-+ int ret;
-+
-+ ret = cros_ec_cmd_xfer(ec_dev, msg);
-+ if (ret < 0) {
-+ dev_err(ec_dev->dev, "Command xfer error (err:%d)\n", ret);
-+ } else if (msg->result != EC_RES_SUCCESS) {
-+ dev_dbg(ec_dev->dev, "Command result (err: %d)\n", msg->result);
-+ return -EPROTO;
-+ }
-+
-+ return ret;
-+}
-+EXPORT_SYMBOL(cros_ec_cmd_xfer_status);
-diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
-index 8973d34..fb1b56a 100644
---- a/drivers/s390/block/dasd.c
-+++ b/drivers/s390/block/dasd.c
-@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
- u8 *sense = NULL;
- int expires;
-
-+ cqr = (struct dasd_ccw_req *) intparm;
- if (IS_ERR(irb)) {
- switch (PTR_ERR(irb)) {
- case -EIO:
-+ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
-+ device = (struct dasd_device *) cqr->startdev;
-+ cqr->status = DASD_CQR_CLEARED;
-+ dasd_device_clear_timer(device);
-+ wake_up(&dasd_flush_wq);
-+ dasd_schedule_device_bh(device);
-+ return;
-+ }
- break;
- case -ETIMEDOUT:
- DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
-@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
- }
-
- now = get_tod_clock();
-- cqr = (struct dasd_ccw_req *) intparm;
- /* check for conditions that should be handled immediately */
- if (!cqr ||
- !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
-diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
-index 4b3bb52..c424e8b 100644
---- a/drivers/scsi/aacraid/commctrl.c
-+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- struct fib *fibptr;
- struct hw_fib * hw_fib = (struct hw_fib *)0;
- dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
-- unsigned size;
-+ unsigned int size, osize;
- int retval;
-
- if (dev->in_reset) {
-@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- * will not overrun the buffer when we copy the memory. Return
- * an error if we would.
- */
-- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
-+ osize = size = le16_to_cpu(kfib->header.Size) +
-+ sizeof(struct aac_fibhdr);
- if (size < le16_to_cpu(kfib->header.SenderSize))
- size = le16_to_cpu(kfib->header.SenderSize);
- if (size > dev->max_fib_size) {
-@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- goto cleanup;
- }
-
-+ /* Sanity check the second copy */
-+ if ((osize != le16_to_cpu(kfib->header.Size) +
-+ sizeof(struct aac_fibhdr))
-+ || (size < le16_to_cpu(kfib->header.SenderSize))) {
-+ retval = -EINVAL;
-+ goto cleanup;
-+ }
-+
- if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
- aac_adapter_interrupt(dev);
- /*
-diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
-index 2dab3dc..c1ed25a 100644
---- a/drivers/scsi/megaraid/megaraid_sas_base.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
-@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
- /* Find first memory bar */
- bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
- instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
-- if (pci_request_selected_regions(instance->pdev, instance->bar,
-+ if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
- "megasas: LSI")) {
- dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
- return -EBUSY;
-@@ -5339,7 +5339,7 @@ fail_ready_state:
- iounmap(instance->reg_set);
-
- fail_ioremap:
-- pci_release_selected_regions(instance->pdev, instance->bar);
-+ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
-
- return -EINVAL;
- }
-@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
-
- iounmap(instance->reg_set);
-
-- pci_release_selected_regions(instance->pdev, instance->bar);
-+ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
- }
-
- /**
-diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
-index ec83754..52d8bbf 100644
---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
-@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
-
- iounmap(instance->reg_set);
-
-- pci_release_selected_regions(instance->pdev, instance->bar);
-+ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
- }
-
- /**
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
-index 751f13e..750f82c 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_base.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
-@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
- } else
- ioc->msix96_vector = 0;
-
-+ if (ioc->is_warpdrive) {
-+ ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-+ &ioc->chip->ReplyPostHostIndex;
-+
-+ for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-+ ioc->reply_post_host_index[i] =
-+ (resource_size_t __iomem *)
-+ ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-+ * 4)));
-+ }
-+
- list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
- pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
- reply_q->name, ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
-@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
- if (r)
- goto out_free_resources;
-
-- if (ioc->is_warpdrive) {
-- ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-- &ioc->chip->ReplyPostHostIndex;
--
-- for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-- ioc->reply_post_host_index[i] =
-- (resource_size_t __iomem *)
-- ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-- * 4)));
-- }
--
- pci_set_drvdata(ioc->pdev, ioc->shost);
- r = _base_get_ioc_facts(ioc, CAN_SLEEP);
- if (r)
-diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
-index 4ab1866..ec5b9a2 100644
---- a/drivers/staging/comedi/drivers/comedi_test.c
-+++ b/drivers/staging/comedi/drivers/comedi_test.c
-@@ -56,11 +56,6 @@
-
- #define N_CHANS 8
-
--enum waveform_state_bits {
-- WAVEFORM_AI_RUNNING,
-- WAVEFORM_AO_RUNNING
--};
--
- /* Data unique to this driver */
- struct waveform_private {
- struct timer_list ai_timer; /* timer for AI commands */
-@@ -68,7 +63,6 @@ struct waveform_private {
- unsigned int wf_amplitude; /* waveform amplitude in microvolts */
- unsigned int wf_period; /* waveform period in microseconds */
- unsigned int wf_current; /* current time in waveform period */
-- unsigned long state_bits;
- unsigned int ai_scan_period; /* AI scan period in usec */
- unsigned int ai_convert_period; /* AI conversion period in usec */
- struct timer_list ao_timer; /* timer for AO commands */
-@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
- unsigned int nsamples;
- unsigned int time_increment;
-
-- /* check command is still active */
-- if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
-- return;
--
- now = ktime_to_us(ktime_get());
- nsamples = comedi_nsamples_left(s, UINT_MAX);
-
-@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
- */
- devpriv->ai_timer.expires =
- jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
--
-- /* mark command as active */
-- smp_mb__before_atomic();
-- set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-- smp_mb__after_atomic();
- add_timer(&devpriv->ai_timer);
- return 0;
- }
-@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
- {
- struct waveform_private *devpriv = dev->private;
-
-- /* mark command as no longer active */
-- clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-- smp_mb__after_atomic();
-- /* cannot call del_timer_sync() as may be called from timer routine */
-- del_timer(&devpriv->ai_timer);
-+ if (in_softirq()) {
-+ /* Assume we were called from the timer routine itself. */
-+ del_timer(&devpriv->ai_timer);
-+ } else {
-+ del_timer_sync(&devpriv->ai_timer);
-+ }
- return 0;
- }
-
-@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
- u64 scans_since;
- unsigned int scans_avail = 0;
-
-- /* check command is still active */
-- if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
-- return;
--
- /* determine number of scan periods since last time */
- now = ktime_to_us(ktime_get());
- scans_since = now - devpriv->ao_last_scan_time;
-@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
- devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
- devpriv->ao_timer.expires =
- jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
--
-- /* mark command as active */
-- smp_mb__before_atomic();
-- set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-- smp_mb__after_atomic();
- add_timer(&devpriv->ao_timer);
-
- return 1;
-@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
- struct waveform_private *devpriv = dev->private;
-
- s->async->inttrig = NULL;
-- /* mark command as no longer active */
-- clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-- smp_mb__after_atomic();
-- /* cannot call del_timer_sync() as may be called from timer routine */
-- del_timer(&devpriv->ao_timer);
-+ if (in_softirq()) {
-+ /* Assume we were called from the timer routine itself. */
-+ del_timer(&devpriv->ao_timer);
-+ } else {
-+ del_timer_sync(&devpriv->ao_timer);
-+ }
- return 0;
- }
-
-diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
-index a536a15..a91ea02 100644
---- a/drivers/staging/comedi/drivers/daqboard2000.c
-+++ b/drivers/staging/comedi/drivers/daqboard2000.c
-@@ -636,7 +636,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
- const struct daq200_boardtype *board;
- int i;
-
-- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
-+ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
- return NULL;
-
- for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
-diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
-index 8dabb19..0f97d7b 100644
---- a/drivers/staging/comedi/drivers/ni_mio_common.c
-+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
-@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
- int i;
- static const int timeout = 1000;
-
-- if (trig_num != cmd->start_arg)
-+ /*
-+ * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
-+ * For backwards compatibility, also allow trig_num == 0 when
-+ * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
-+ * in that case, the internal trigger is being used as a pre-trigger
-+ * before the external trigger.
-+ */
-+ if (!(trig_num == cmd->start_arg ||
-+ (trig_num == 0 && cmd->start_src != TRIG_INT)))
- return -EINVAL;
-
- /*
-@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
- s->maxdata = (devpriv->is_m_series) ? 0xffffffff
- : 0x00ffffff;
- s->insn_read = ni_tio_insn_read;
-- s->insn_write = ni_tio_insn_read;
-+ s->insn_write = ni_tio_insn_write;
- s->insn_config = ni_tio_insn_config;
- #ifdef PCIDMA
- if (dev->irq && devpriv->mite) {
-diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
-index 5eba0eb..86e40ce 100644
---- a/drivers/staging/lustre/lustre/llite/namei.c
-+++ b/drivers/staging/lustre/lustre/llite/namei.c
-@@ -391,6 +391,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
- struct inode *inode = NULL;
- __u64 bits = 0;
- int rc = 0;
-+ struct dentry *alias;
-
- /* NB 1 request reference will be taken away by ll_intent_lock()
- * when I return
-@@ -415,26 +416,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
- */
- }
-
-- /* Only hash *de if it is unhashed (new dentry).
-- * Atoimc_open may passing hashed dentries for open.
-- */
-- if (d_unhashed(*de)) {
-- struct dentry *alias;
--
-- alias = ll_splice_alias(inode, *de);
-- if (IS_ERR(alias)) {
-- rc = PTR_ERR(alias);
-- goto out;
-- }
-- *de = alias;
-- } else if (!it_disposition(it, DISP_LOOKUP_NEG) &&
-- !it_disposition(it, DISP_OPEN_CREATE)) {
-- /* With DISP_OPEN_CREATE dentry will be
-- * instantiated in ll_create_it.
-- */
-- LASSERT(!d_inode(*de));
-- d_instantiate(*de, inode);
-+ alias = ll_splice_alias(inode, *de);
-+ if (IS_ERR(alias)) {
-+ rc = PTR_ERR(alias);
-+ goto out;
- }
-+ *de = alias;
-
- if (!it_disposition(it, DISP_LOOKUP_NEG)) {
- /* we have lookup look - unhide dentry */
-@@ -590,6 +577,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
- dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
- *opened);
-
-+ /* Only negative dentries enter here */
-+ LASSERT(!d_inode(dentry));
-+
-+ if (!d_in_lookup(dentry)) {
-+ /* A valid negative dentry that just passed revalidation,
-+ * there's little point to try and open it server-side,
-+ * even though there's a minuscle chance it might succeed.
-+ * Either way it's a valid race to just return -ENOENT here.
-+ */
-+ if (!(open_flags & O_CREAT))
-+ return -ENOENT;
-+
-+ /* Otherwise we just unhash it to be rehashed afresh via
-+ * lookup if necessary
-+ */
-+ d_drop(dentry);
-+ }
-+
- it = kzalloc(sizeof(*it), GFP_NOFS);
- if (!it)
- return -ENOMEM;
-diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
-index 065f5d9..dfec5a1 100644
---- a/drivers/usb/chipidea/udc.c
-+++ b/drivers/usb/chipidea/udc.c
-@@ -1596,8 +1596,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
- {
- struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
-
-- /* Data+ pullup controlled by OTG state machine in OTG fsm mode */
-- if (ci_otg_is_fsm_mode(ci))
-+ /*
-+ * Data+ pullup controlled by OTG state machine in OTG fsm mode;
-+ * and don't touch Data+ in host mode for dual role config.
-+ */
-+ if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
- return 0;
-
- pm_runtime_get_sync(&ci->gadget.dev);
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 94a14f5..0a4d54a 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1405,7 +1405,6 @@ made_compressed_probe:
- spin_lock_init(&acm->write_lock);
- spin_lock_init(&acm->read_lock);
- mutex_init(&acm->mutex);
-- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
- acm->is_int_ep = usb_endpoint_xfer_int(epread);
- if (acm->is_int_ep)
- acm->bInterval = epread->bInterval;
-@@ -1445,14 +1444,14 @@ made_compressed_probe:
- urb->transfer_dma = rb->dma;
- if (acm->is_int_ep) {
- usb_fill_int_urb(urb, acm->dev,
-- acm->rx_endpoint,
-+ usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
- rb->base,
- acm->readsize,
- acm_read_bulk_callback, rb,
- acm->bInterval);
- } else {
- usb_fill_bulk_urb(urb, acm->dev,
-- acm->rx_endpoint,
-+ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
- rb->base,
- acm->readsize,
- acm_read_bulk_callback, rb);
-diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
-index 05ce308..1f1eabf 100644
---- a/drivers/usb/class/cdc-acm.h
-+++ b/drivers/usb/class/cdc-acm.h
-@@ -96,7 +96,6 @@ struct acm {
- struct acm_rb read_buffers[ACM_NR];
- struct acm_wb *putbuffer; /* for acm_tty_put_char() */
- int rx_buflimit;
-- int rx_endpoint;
- spinlock_t read_lock;
- int write_used; /* number of non-empty write buffers */
- int transmitting;
-diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
-index 31ccdcc..15ce4ab 100644
---- a/drivers/usb/core/config.c
-+++ b/drivers/usb/core/config.c
-@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
- ep, buffer, size);
- }
-
-+static const unsigned short low_speed_maxpacket_maxes[4] = {
-+ [USB_ENDPOINT_XFER_CONTROL] = 8,
-+ [USB_ENDPOINT_XFER_ISOC] = 0,
-+ [USB_ENDPOINT_XFER_BULK] = 0,
-+ [USB_ENDPOINT_XFER_INT] = 8,
-+};
-+static const unsigned short full_speed_maxpacket_maxes[4] = {
-+ [USB_ENDPOINT_XFER_CONTROL] = 64,
-+ [USB_ENDPOINT_XFER_ISOC] = 1023,
-+ [USB_ENDPOINT_XFER_BULK] = 64,
-+ [USB_ENDPOINT_XFER_INT] = 64,
-+};
-+static const unsigned short high_speed_maxpacket_maxes[4] = {
-+ [USB_ENDPOINT_XFER_CONTROL] = 64,
-+ [USB_ENDPOINT_XFER_ISOC] = 1024,
-+ [USB_ENDPOINT_XFER_BULK] = 512,
-+ [USB_ENDPOINT_XFER_INT] = 1024,
-+};
-+static const unsigned short super_speed_maxpacket_maxes[4] = {
-+ [USB_ENDPOINT_XFER_CONTROL] = 512,
-+ [USB_ENDPOINT_XFER_ISOC] = 1024,
-+ [USB_ENDPOINT_XFER_BULK] = 1024,
-+ [USB_ENDPOINT_XFER_INT] = 1024,
-+};
-+
- static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- int asnum, struct usb_host_interface *ifp, int num_ep,
- unsigned char *buffer, int size)
-@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- struct usb_endpoint_descriptor *d;
- struct usb_host_endpoint *endpoint;
- int n, i, j, retval;
-+ unsigned int maxp;
-+ const unsigned short *maxpacket_maxes;
-
- d = (struct usb_endpoint_descriptor *) buffer;
- buffer += d->bLength;
-@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
- }
-
-+ /* Validate the wMaxPacketSize field */
-+ maxp = usb_endpoint_maxp(&endpoint->desc);
-+
-+ /* Find the highest legal maxpacket size for this endpoint */
-+ i = 0; /* additional transactions per microframe */
-+ switch (to_usb_device(ddev)->speed) {
-+ case USB_SPEED_LOW:
-+ maxpacket_maxes = low_speed_maxpacket_maxes;
-+ break;
-+ case USB_SPEED_FULL:
-+ maxpacket_maxes = full_speed_maxpacket_maxes;
-+ break;
-+ case USB_SPEED_HIGH:
-+ /* Bits 12..11 are allowed only for HS periodic endpoints */
-+ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
-+ i = maxp & (BIT(12) | BIT(11));
-+ maxp &= ~i;
-+ }
-+ /* fallthrough */
-+ default:
-+ maxpacket_maxes = high_speed_maxpacket_maxes;
-+ break;
-+ case USB_SPEED_SUPER:
-+ case USB_SPEED_SUPER_PLUS:
-+ maxpacket_maxes = super_speed_maxpacket_maxes;
-+ break;
-+ }
-+ j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
-+
-+ if (maxp > j) {
-+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
-+ cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
-+ maxp = j;
-+ endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
-+ }
-+
- /*
- * Some buggy high speed devices have bulk endpoints using
- * maxpacket sizes other than 512. High speed HCDs may not
-@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- */
- if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
- && usb_endpoint_xfer_bulk(d)) {
-- unsigned maxp;
--
-- maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
- if (maxp != 512)
- dev_warn(ddev, "config %d interface %d altsetting %d "
- "bulk endpoint 0x%X has invalid maxpacket %d\n",
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index e9f5043..50b6baa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
- goto error_decrease_mem;
- }
-
-- mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
-+ mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
-+ &dma_handle);
- if (!mem) {
- ret = -ENOMEM;
- goto error_free_usbm;
-@@ -1708,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
- as->urb->start_frame = uurb->start_frame;
- as->urb->number_of_packets = number_of_packets;
- as->urb->stream_id = stream_id;
-- if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-- ps->dev->speed == USB_SPEED_HIGH)
-- as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
-- else
-- as->urb->interval = ep->desc.bInterval;
-+
-+ if (ep->desc.bInterval) {
-+ if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-+ ps->dev->speed == USB_SPEED_HIGH ||
-+ ps->dev->speed >= USB_SPEED_SUPER)
-+ as->urb->interval = 1 <<
-+ min(15, ep->desc.bInterval - 1);
-+ else
-+ as->urb->interval = ep->desc.bInterval;
-+ }
-+
- as->urb->context = as;
- as->urb->complete = async_completed;
- for (totlen = u = 0; u < number_of_packets; u++) {
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index bee1351..1d5fc32 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
-
- /* Continue a partial initialization */
- if (type == HUB_INIT2 || type == HUB_INIT3) {
-- device_lock(hub->intfdev);
-+ device_lock(&hdev->dev);
-
- /* Was the hub disconnected while we were waiting? */
-- if (hub->disconnected) {
-- device_unlock(hub->intfdev);
-- kref_put(&hub->kref, hub_release);
-- return;
-- }
-+ if (hub->disconnected)
-+ goto disconnected;
- if (type == HUB_INIT2)
- goto init2;
- goto init3;
-@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
- queue_delayed_work(system_power_efficient_wq,
- &hub->init_work,
- msecs_to_jiffies(delay));
-- device_unlock(hub->intfdev);
-+ device_unlock(&hdev->dev);
- return; /* Continues at init3: below */
- } else {
- msleep(delay);
-@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
- /* Scan all ports that need attention */
- kick_hub_wq(hub);
-
-- /* Allow autosuspend if it was suppressed */
-- if (type <= HUB_INIT3)
-+ if (type == HUB_INIT2 || type == HUB_INIT3) {
-+ /* Allow autosuspend if it was suppressed */
-+ disconnected:
- usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
--
-- if (type == HUB_INIT2 || type == HUB_INIT3)
-- device_unlock(hub->intfdev);
-+ device_unlock(&hdev->dev);
-+ }
-
- kref_put(&hub->kref, hub_release);
- }
-@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
- struct usb_device *hdev = hub->hdev;
- int i;
-
-- cancel_delayed_work_sync(&hub->init_work);
--
- /* hub_wq and related activity won't re-trigger */
- hub->quiescing = 1;
-
-diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
-index 14196cd..2fd5057 100644
---- a/drivers/usb/dwc3/dwc3-pci.c
-+++ b/drivers/usb/dwc3/dwc3-pci.c
-@@ -37,6 +37,7 @@
- #define PCI_DEVICE_ID_INTEL_BXT 0x0aaa
- #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
- #define PCI_DEVICE_ID_INTEL_APL 0x5aaa
-+#define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
-
- static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
- static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
-@@ -214,6 +215,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
- { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
-+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
- { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
- { } /* Terminating Entry */
- };
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 716f4f0..05a5300 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -1897,7 +1897,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
-
- static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- struct dwc3_request *req, struct dwc3_trb *trb,
-- const struct dwc3_event_depevt *event, int status)
-+ const struct dwc3_event_depevt *event, int status,
-+ int chain)
- {
- unsigned int count;
- unsigned int s_pkt = 0;
-@@ -1905,6 +1906,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
-
- trace_dwc3_complete_trb(dep, trb);
-
-+ /*
-+ * If we're in the middle of series of chained TRBs and we
-+ * receive a short transfer along the way, DWC3 will skip
-+ * through all TRBs including the last TRB in the chain (the
-+ * where CHN bit is zero. DWC3 will also avoid clearing HWO
-+ * bit and SW has to do it manually.
-+ *
-+ * We're going to do that here to avoid problems of HW trying
-+ * to use bogus TRBs for transfers.
-+ */
-+ if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
-+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
-+
- if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
- /*
- * We continue despite the error. There is not much we
-@@ -1916,6 +1930,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- */
- dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
- dep->name, trb);
-+
- count = trb->size & DWC3_TRB_SIZE_MASK;
-
- if (dep->direction) {
-@@ -1954,15 +1969,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- s_pkt = 1;
- }
-
-- /*
-- * We assume here we will always receive the entire data block
-- * which we should receive. Meaning, if we program RX to
-- * receive 4K but we receive only 2K, we assume that's all we
-- * should receive and we simply bounce the request back to the
-- * gadget driver for further processing.
-- */
-- req->request.actual += req->request.length - count;
-- if (s_pkt)
-+ if (s_pkt && !chain)
- return 1;
- if ((event->status & DEPEVT_STATUS_LST) &&
- (trb->ctrl & (DWC3_TRB_CTRL_LST |
-@@ -1981,13 +1988,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- struct dwc3_trb *trb;
- unsigned int slot;
- unsigned int i;
-+ int count = 0;
- int ret;
-
- do {
-+ int chain;
-+
- req = next_request(&dep->started_list);
- if (WARN_ON_ONCE(!req))
- return 1;
-
-+ chain = req->request.num_mapped_sgs > 0;
- i = 0;
- do {
- slot = req->first_trb_index + i;
-@@ -1995,13 +2006,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- slot++;
- slot %= DWC3_TRB_NUM;
- trb = &dep->trb_pool[slot];
-+ count += trb->size & DWC3_TRB_SIZE_MASK;
-
- ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
-- event, status);
-+ event, status, chain);
- if (ret)
- break;
- } while (++i < req->request.num_mapped_sgs);
-
-+ /*
-+ * We assume here we will always receive the entire data block
-+ * which we should receive. Meaning, if we program RX to
-+ * receive 4K but we receive only 2K, we assume that's all we
-+ * should receive and we simply bounce the request back to the
-+ * gadget driver for further processing.
-+ */
-+ req->request.actual += req->request.length - count;
- dwc3_gadget_giveback(dep, req, status);
-
- if (ret)
-diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
-index aa3707b..be64798 100644
---- a/drivers/usb/gadget/legacy/inode.c
-+++ b/drivers/usb/gadget/legacy/inode.c
-@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
- */
- spin_lock_irq(&epdata->dev->lock);
- value = -ENODEV;
-- if (unlikely(epdata->ep))
-+ if (unlikely(epdata->ep == NULL))
- goto fail;
-
- req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 93d28cb..cf8819a 100644
---- a/drivers/usb/gadget/udc/fsl_qe_udc.c
-+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
- struct qe_ep *ep;
-
- if (wValue != 0 || wLength != 0
-- || pipe > USB_MAX_ENDPOINTS)
-+ || pipe >= USB_MAX_ENDPOINTS)
- break;
- ep = &udc->eps[pipe];
-
-diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
-index e1b2dce..bd46950 100644
---- a/drivers/usb/gadget/udc/udc-core.c
-+++ b/drivers/usb/gadget/udc/udc-core.c
-@@ -106,7 +106,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
- return;
-
- if (req->num_mapped_sgs) {
-- dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
-+ dma_unmap_sg(dev, req->sg, req->num_sgs,
- is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-
- req->num_mapped_sgs = 0;
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index a962b89..1e5f529 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
- int port = HCS_N_PORTS(ehci->hcs_params);
-
- while (port--) {
-- ehci_writel(ehci, PORT_RWC_BITS,
-- &ehci->regs->port_status[port]);
- spin_unlock_irq(&ehci->lock);
- ehci_port_power(ehci, port, false);
- spin_lock_irq(&ehci->lock);
-+ ehci_writel(ehci, PORT_RWC_BITS,
-+ &ehci->regs->port_status[port]);
- }
- }
-
-diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
-index d61fcc4..730b9fd 100644
---- a/drivers/usb/host/xhci-hub.c
-+++ b/drivers/usb/host/xhci-hub.c
-@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
-
- ret = 0;
- virt_dev = xhci->devs[slot_id];
-+ if (!virt_dev)
-+ return -ENODEV;
-+
- cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
- if (!cmd) {
- xhci_dbg(xhci, "Couldn't allocate command structure.\n");
-diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
-index c10972f..69f7fab 100644
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
- usb_remove_hcd(xhci->shared_hcd);
- usb_put_hcd(xhci->shared_hcd);
- }
-- usb_hcd_pci_remove(dev);
-
- /* Workaround for spurious wakeups at shutdown with HSW */
- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
- pci_set_power_state(dev, PCI_D3hot);
-+
-+ usb_hcd_pci_remove(dev);
- }
-
- #ifdef CONFIG_PM
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index d7d5025..bc17bcf 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -1325,12 +1325,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
-
- cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
-
-- if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-- xhci_err(xhci,
-- "Command completion event does not match command\n");
-- return;
-- }
--
- del_timer(&xhci->cmd_timer);
-
- trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
-@@ -1342,6 +1336,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
- xhci_handle_stopped_cmd_ring(xhci, cmd);
- return;
- }
-+
-+ if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-+ xhci_err(xhci,
-+ "Command completion event does not match command\n");
-+ return;
-+ }
-+
- /*
- * Host aborted the command ring, check if the current command was
- * supposed to be aborted, otherwise continue normally.
-diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
-index 6b978f0..5c8210d 100644
---- a/drivers/usb/misc/usbtest.c
-+++ b/drivers/usb/misc/usbtest.c
-@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req)
- {
- struct usb_sg_request *req = (struct usb_sg_request *) _req;
-
-- req->status = -ETIMEDOUT;
- usb_sg_cancel(req);
- }
-
-@@ -616,8 +615,10 @@ static int perform_sglist(
- mod_timer(&sg_timer, jiffies +
- msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
- usb_sg_wait(req);
-- del_timer_sync(&sg_timer);
-- retval = req->status;
-+ if (!del_timer_sync(&sg_timer))
-+ retval = -ETIMEDOUT;
-+ else
-+ retval = req->status;
-
- /* FIXME check resulting data pattern */
-
-@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
- ktime_get_ts64(&start);
-
- retval = usbtest_do_ioctl(intf, param_32);
-- if (retval)
-+ if (retval < 0)
- goto free_mutex;
-
- ktime_get_ts64(&end);
-diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
-index baeb7d2..8c81aac 100644
---- a/drivers/usb/renesas_usbhs/common.c
-+++ b/drivers/usb/renesas_usbhs/common.c
-@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
- if (gpio > 0)
- dparam->enable_gpio = gpio;
-
-- if (dparam->type == USBHS_TYPE_RCAR_GEN2)
-+ if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
-+ dparam->type == USBHS_TYPE_RCAR_GEN3)
- dparam->has_usb_dmac = 1;
-
- return info;
-diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
-index 280ed5f..857e783 100644
---- a/drivers/usb/renesas_usbhs/fifo.c
-+++ b/drivers/usb/renesas_usbhs/fifo.c
-@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
-
- /* use PIO if packet is less than pio_dma_border or pipe is DCP */
- if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
-- usbhs_pipe_is_dcp(pipe))
-+ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
- goto usbhsf_pio_prepare_push;
-
- /* check data length if this driver don't use USB-DMAC */
-@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
-
- /* use PIO if packet is less than pio_dma_border or pipe is DCP */
- if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
-- usbhs_pipe_is_dcp(pipe))
-+ usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
- goto usbhsf_pio_prepare_pop;
-
- fifo = usbhsf_get_dma_fifo(priv, pkt);
-diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
-index 50f3363..c4c6474 100644
---- a/drivers/usb/renesas_usbhs/mod_gadget.c
-+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
-@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- * use dmaengine if possible.
- * It will use pio handler if impossible.
- */
-- if (usb_endpoint_dir_in(desc))
-+ if (usb_endpoint_dir_in(desc)) {
- pipe->handler = &usbhs_fifo_dma_push_handler;
-- else
-+ } else {
- pipe->handler = &usbhs_fifo_dma_pop_handler;
-+ usbhs_xxxsts_clear(priv, BRDYSTS,
-+ usbhs_pipe_number(pipe));
-+ }
-
- ret = 0;
- }
-@@ -1073,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
-
- gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
- dev_info(dev, "%stransceiver found\n",
-- gpriv->transceiver ? "" : "no ");
-+ !IS_ERR(gpriv->transceiver) ? "" : "no ");
-
- /*
- * CAUTION
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 0082080..b2d767e 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
- { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
- { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
-+ { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
-+ { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
- { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
- { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
- { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
-@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
- { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
- { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
- { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
-+ { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
- { } /* Terminating entry */
- };
-
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index c5d6c1e..f87a938 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -406,6 +406,12 @@
- #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
-
- /*
-+ * Ivium Technologies product IDs
-+ */
-+#define FTDI_PALMSENS_PID 0xf440
-+#define FTDI_IVIUM_XSTAT_PID 0xf441
-+
-+/*
- * Linx Technologies product ids
- */
- #define LINX_SDMUSBQSS_PID 0xF448 /* Linx SDM-USB-QS-S */
-@@ -673,6 +679,12 @@
- #define INTREPID_NEOVI_PID 0x0701
-
- /*
-+ * WICED USB UART
-+ */
-+#define WICED_VID 0x0A5C
-+#define WICED_USB20706V2_PID 0x6422
-+
-+/*
- * Definitions for ID TECH (www.idt-net.com) devices
- */
- #define IDTECH_VID 0x0ACD /* ID TECH Vendor ID */
-diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
-index 5608af4..de9992b 100644
---- a/drivers/usb/serial/mos7720.c
-+++ b/drivers/usb/serial/mos7720.c
-@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
-
- if (urb->transfer_buffer == NULL) {
- urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-- GFP_KERNEL);
-+ GFP_ATOMIC);
- if (!urb->transfer_buffer)
- goto exit;
- }
-diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index ed378fb..57426d7 100644
---- a/drivers/usb/serial/mos7840.c
-+++ b/drivers/usb/serial/mos7840.c
-@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
- }
-
- if (urb->transfer_buffer == NULL) {
-- urb->transfer_buffer =
-- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
-+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-+ GFP_ATOMIC);
- if (!urb->transfer_buffer)
- goto exit;
- }
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8e07536..9894e34 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb);
- #define TELIT_PRODUCT_LE920 0x1200
- #define TELIT_PRODUCT_LE910 0x1201
- #define TELIT_PRODUCT_LE910_USBCFG4 0x1206
-+#define TELIT_PRODUCT_LE920A4_1207 0x1207
-+#define TELIT_PRODUCT_LE920A4_1208 0x1208
-+#define TELIT_PRODUCT_LE920A4_1211 0x1211
-+#define TELIT_PRODUCT_LE920A4_1212 0x1212
-+#define TELIT_PRODUCT_LE920A4_1213 0x1213
-+#define TELIT_PRODUCT_LE920A4_1214 0x1214
-
- /* ZTE PRODUCTS */
- #define ZTE_VENDOR_ID 0x19d2
-@@ -519,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
- #define VIATELECOM_VENDOR_ID 0x15eb
- #define VIATELECOM_PRODUCT_CDS7 0x0001
-
-+/* WeTelecom products */
-+#define WETELECOM_VENDOR_ID 0x22de
-+#define WETELECOM_PRODUCT_WMD200 0x6801
-+#define WETELECOM_PRODUCT_6802 0x6802
-+#define WETELECOM_PRODUCT_WMD300 0x6803
-+
- struct option_blacklist_info {
- /* bitmask of interface numbers blacklisted for send_setup */
- const unsigned long sendsetup;
-@@ -628,6 +640,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
- .reserved = BIT(1) | BIT(5),
- };
-
-+static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
-+ .sendsetup = BIT(0),
-+ .reserved = BIT(1),
-+};
-+
- static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
- .sendsetup = BIT(2),
- .reserved = BIT(0) | BIT(1) | BIT(3),
-@@ -1203,6 +1220,16 @@ static const struct usb_device_id option_ids[] = {
- .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
- .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
-+ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
-+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
-+ .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
-+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
-+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
-+ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
- .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
-@@ -1966,9 +1993,13 @@ static const struct usb_device_id option_ids[] = {
- .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
- { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
-+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
-+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
-+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
- { } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index b1b9bac..d213cf4 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
-
- rc = usb_register(udriver);
- if (rc)
-- return rc;
-+ goto failed_usb_register;
-
- for (sd = serial_drivers; *sd; ++sd) {
- (*sd)->usb_driver = udriver;
-@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
- while (sd-- > serial_drivers)
- usb_serial_deregister(*sd);
- usb_deregister(udriver);
-+failed_usb_register:
-+ kfree(udriver);
- return rc;
- }
- EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
-diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
-index 15ecfc9..152b438 100644
---- a/drivers/vfio/pci/vfio_pci_intrs.c
-+++ b/drivers/vfio/pci/vfio_pci_intrs.c
-@@ -564,67 +564,80 @@ static int vfio_pci_set_msi_trigger(struct vfio_pci_device *vdev,
- }
-
- static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
-- uint32_t flags, void *data)
-+ unsigned int count, uint32_t flags,
-+ void *data)
- {
-- int32_t fd = *(int32_t *)data;
--
-- if (!(flags & VFIO_IRQ_SET_DATA_TYPE_MASK))
-- return -EINVAL;
--
- /* DATA_NONE/DATA_BOOL enables loopback testing */
- if (flags & VFIO_IRQ_SET_DATA_NONE) {
-- if (*ctx)
-- eventfd_signal(*ctx, 1);
-- return 0;
-+ if (*ctx) {
-+ if (count) {
-+ eventfd_signal(*ctx, 1);
-+ } else {
-+ eventfd_ctx_put(*ctx);
-+ *ctx = NULL;
-+ }
-+ return 0;
-+ }
- } else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
-- uint8_t trigger = *(uint8_t *)data;
-+ uint8_t trigger;
-+
-+ if (!count)
-+ return -EINVAL;
-+
-+ trigger = *(uint8_t *)data;
- if (trigger && *ctx)
- eventfd_signal(*ctx, 1);
-- return 0;
-- }
-
-- /* Handle SET_DATA_EVENTFD */
-- if (fd == -1) {
-- if (*ctx)
-- eventfd_ctx_put(*ctx);
-- *ctx = NULL;
- return 0;
-- } else if (fd >= 0) {
-- struct eventfd_ctx *efdctx;
-- efdctx = eventfd_ctx_fdget(fd);
-- if (IS_ERR(efdctx))
-- return PTR_ERR(efdctx);
-- if (*ctx)
-- eventfd_ctx_put(*ctx);
-- *ctx = efdctx;
-+ } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
-+ int32_t fd;
-+
-+ if (!count)
-+ return -EINVAL;
-+
-+ fd = *(int32_t *)data;
-+ if (fd == -1) {
-+ if (*ctx)
-+ eventfd_ctx_put(*ctx);
-+ *ctx = NULL;
-+ } else if (fd >= 0) {
-+ struct eventfd_ctx *efdctx;
-+
-+ efdctx = eventfd_ctx_fdget(fd);
-+ if (IS_ERR(efdctx))
-+ return PTR_ERR(efdctx);
-+
-+ if (*ctx)
-+ eventfd_ctx_put(*ctx);
-+
-+ *ctx = efdctx;
-+ }
- return 0;
-- } else
-- return -EINVAL;
-+ }
-+
-+ return -EINVAL;
- }
-
- static int vfio_pci_set_err_trigger(struct vfio_pci_device *vdev,
- unsigned index, unsigned start,
- unsigned count, uint32_t flags, void *data)
- {
-- if (index != VFIO_PCI_ERR_IRQ_INDEX)
-+ if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1)
- return -EINVAL;
-
-- /*
-- * We should sanitize start & count, but that wasn't caught
-- * originally, so this IRQ index must forever ignore them :-(
-- */
--
-- return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger, flags, data);
-+ return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger,
-+ count, flags, data);
- }
-
- static int vfio_pci_set_req_trigger(struct vfio_pci_device *vdev,
- unsigned index, unsigned start,
- unsigned count, uint32_t flags, void *data)
- {
-- if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count != 1)
-+ if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count > 1)
- return -EINVAL;
-
-- return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger, flags, data);
-+ return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger,
-+ count, flags, data);
- }
-
- int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
-diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
-index ca6bfdd..2ebf30e 100644
---- a/drivers/virtio/virtio_ring.c
-+++ b/drivers/virtio/virtio_ring.c
-@@ -316,6 +316,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
- * host should service the ring ASAP. */
- if (out_sgs)
- vq->notify(&vq->vq);
-+ if (indirect)
-+ kfree(desc);
- END_USE(vq);
- return -ENOSPC;
- }
-diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 4274a7b..72f5048 100644
---- a/fs/btrfs/ctree.h
-+++ b/fs/btrfs/ctree.h
-@@ -1040,6 +1040,7 @@ struct btrfs_fs_info {
- struct btrfs_workqueue *qgroup_rescan_workers;
- struct completion qgroup_rescan_completion;
- struct btrfs_work qgroup_rescan_work;
-+ bool qgroup_rescan_running; /* protected by qgroup_rescan_lock */
-
- /* filesystem state */
- unsigned long fs_state;
-diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index 60ce119..864cf3b 100644
---- a/fs/btrfs/disk-io.c
-+++ b/fs/btrfs/disk-io.c
-@@ -1626,8 +1626,8 @@ fail:
- return ret;
- }
-
--static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-- u64 root_id)
-+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-+ u64 root_id)
- {
- struct btrfs_root *root;
-
-@@ -2306,6 +2306,7 @@ static void btrfs_init_qgroup(struct btrfs_fs_info *fs_info)
- fs_info->quota_enabled = 0;
- fs_info->pending_quota_state = 0;
- fs_info->qgroup_ulist = NULL;
-+ fs_info->qgroup_rescan_running = false;
- mutex_init(&fs_info->qgroup_rescan_lock);
- }
-
-@@ -3849,7 +3850,7 @@ void close_ctree(struct btrfs_root *root)
- smp_mb();
-
- /* wait for the qgroup rescan worker to stop */
-- btrfs_qgroup_wait_for_completion(fs_info);
-+ btrfs_qgroup_wait_for_completion(fs_info, false);
-
- /* wait for the uuid_scan task to finish */
- down(&fs_info->uuid_tree_rescan_sem);
-diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
-index acba821..355e31f 100644
---- a/fs/btrfs/disk-io.h
-+++ b/fs/btrfs/disk-io.h
-@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info,
- struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
- struct btrfs_key *location);
- int btrfs_init_fs_root(struct btrfs_root *root);
-+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-+ u64 root_id);
- int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
- struct btrfs_root *root);
- void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info);
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 0517356..3722a1f 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -5088,7 +5088,7 @@ static long btrfs_ioctl_quota_rescan_wait(struct file *file, void __user *arg)
- if (!capable(CAP_SYS_ADMIN))
- return -EPERM;
-
-- return btrfs_qgroup_wait_for_completion(root->fs_info);
-+ return btrfs_qgroup_wait_for_completion(root->fs_info, true);
- }
-
- static long _btrfs_ioctl_set_received_subvol(struct file *file,
-diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
-index 9d4c05b..4904ebe 100644
---- a/fs/btrfs/qgroup.c
-+++ b/fs/btrfs/qgroup.c
-@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
- goto out;
- fs_info->quota_enabled = 0;
- fs_info->pending_quota_state = 0;
-- btrfs_qgroup_wait_for_completion(fs_info);
-+ btrfs_qgroup_wait_for_completion(fs_info, false);
- spin_lock(&fs_info->qgroup_lock);
- quota_root = fs_info->quota_root;
- fs_info->quota_root = NULL;
-@@ -2302,6 +2302,10 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
- int err = -ENOMEM;
- int ret = 0;
-
-+ mutex_lock(&fs_info->qgroup_rescan_lock);
-+ fs_info->qgroup_rescan_running = true;
-+ mutex_unlock(&fs_info->qgroup_rescan_lock);
-+
- path = btrfs_alloc_path();
- if (!path)
- goto out;
-@@ -2368,6 +2372,9 @@ out:
- }
-
- done:
-+ mutex_lock(&fs_info->qgroup_rescan_lock);
-+ fs_info->qgroup_rescan_running = false;
-+ mutex_unlock(&fs_info->qgroup_rescan_lock);
- complete_all(&fs_info->qgroup_rescan_completion);
- }
-
-@@ -2486,20 +2493,26 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)
- return 0;
- }
-
--int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info)
-+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
-+ bool interruptible)
- {
- int running;
- int ret = 0;
-
- mutex_lock(&fs_info->qgroup_rescan_lock);
- spin_lock(&fs_info->qgroup_lock);
-- running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN;
-+ running = fs_info->qgroup_rescan_running;
- spin_unlock(&fs_info->qgroup_lock);
- mutex_unlock(&fs_info->qgroup_rescan_lock);
-
-- if (running)
-+ if (!running)
-+ return 0;
-+
-+ if (interruptible)
- ret = wait_for_completion_interruptible(
- &fs_info->qgroup_rescan_completion);
-+ else
-+ wait_for_completion(&fs_info->qgroup_rescan_completion);
-
- return ret;
- }
-diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
-index ecb2c14..3d73e4c 100644
---- a/fs/btrfs/qgroup.h
-+++ b/fs/btrfs/qgroup.h
-@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
- struct btrfs_fs_info *fs_info);
- int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info);
- void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info);
--int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info);
-+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
-+ bool interruptible);
- int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans,
- struct btrfs_fs_info *fs_info, u64 src, u64 dst);
- int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans,
-diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
-index f1c3086..3454aa4 100644
---- a/fs/btrfs/root-tree.c
-+++ b/fs/btrfs/root-tree.c
-@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
- root_key.objectid = key.offset;
- key.offset++;
-
-+ /*
-+ * The root might have been inserted already, as before we look
-+ * for orphan roots, log replay might have happened, which
-+ * triggers a transaction commit and qgroup accounting, which
-+ * in turn reads and inserts fs roots while doing backref
-+ * walking.
-+ */
-+ root = btrfs_lookup_fs_root(tree_root->fs_info,
-+ root_key.objectid);
-+ if (root) {
-+ WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED,
-+ &root->state));
-+ if (btrfs_root_refs(&root->root_item) == 0)
-+ btrfs_add_dead_root(root);
-+ continue;
-+ }
-+
- root = btrfs_read_fs_root(tree_root, &root_key);
- err = PTR_ERR_OR_ZERO(root);
- if (err && err != -ENOENT) {
-@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
- set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state);
-
- err = btrfs_insert_fs_root(root->fs_info, root);
-- /*
-- * The root might have been inserted already, as before we look
-- * for orphan roots, log replay might have happened, which
-- * triggers a transaction commit and qgroup accounting, which
-- * in turn reads and inserts fs roots while doing backref
-- * walking.
-- */
-- if (err == -EEXIST)
-- err = 0;
- if (err) {
-+ BUG_ON(err == -EEXIST);
- btrfs_free_fs_root(root);
- break;
- }
-diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 19f532e..6dc4296 100644
---- a/fs/seq_file.c
-+++ b/fs/seq_file.c
-@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- size -= n;
- buf += n;
- copied += n;
-- if (!m->count)
-+ if (!m->count) {
-+ m->from = 0;
- m->index++;
-+ }
- if (!size)
- goto Done;
- }
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index f35523d..b803213 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
- * If buf != of->prealloc_buf, we don't know how
- * large it is, so cannot safely pass it to ->show
- */
-- if (pos || WARN_ON_ONCE(buf != of->prealloc_buf))
-+ if (WARN_ON_ONCE(buf != of->prealloc_buf))
- return 0;
- len = ops->show(kobj, of->kn->priv, buf);
-+ if (pos) {
-+ if (len <= pos)
-+ return 0;
-+ len -= pos;
-+ memmove(buf, buf + pos, len);
-+ }
- return min(count, len);
- }
-
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 288fac5..47f95085 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -985,7 +985,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev,
- return NULL;
- }
-
--#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \
-+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \
- static const void * __acpi_table_##name[] \
- __attribute__((unused)) \
- = { (void *) table_id, \
-diff --git a/include/linux/i8042.h b/include/linux/i8042.h
-index 0f9bafa..d98780c 100644
---- a/include/linux/i8042.h
-+++ b/include/linux/i8042.h
-@@ -62,7 +62,6 @@ struct serio;
- void i8042_lock_chip(void);
- void i8042_unlock_chip(void);
- int i8042_command(unsigned char *param, int command);
--bool i8042_check_port_owner(const struct serio *);
- int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
- struct serio *serio));
- int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
-@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned char *param, int command)
- return -ENODEV;
- }
-
--static inline bool i8042_check_port_owner(const struct serio *serio)
--{
-- return false;
--}
--
- static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
- struct serio *serio))
- {
-diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
-index 64184d2..d641a18 100644
---- a/include/linux/mfd/cros_ec.h
-+++ b/include/linux/mfd/cros_ec.h
-@@ -226,6 +226,21 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
- struct cros_ec_command *msg);
-
- /**
-+ * cros_ec_cmd_xfer_status - Send a command to the ChromeOS EC
-+ *
-+ * This function is identical to cros_ec_cmd_xfer, except it returns success
-+ * status only if both the command was transmitted successfully and the EC
-+ * replied with success status. It's not necessary to check msg->result when
-+ * using this function.
-+ *
-+ * @ec_dev: EC device
-+ * @msg: Message to write
-+ * @return: Num. of bytes transferred on success, <0 on failure
-+ */
-+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
-+ struct cros_ec_command *msg);
-+
-+/**
- * cros_ec_remove - Remove a ChromeOS EC
- *
- * Call this to deregister a ChromeOS EC, then clean up any private data.
-diff --git a/include/linux/msi.h b/include/linux/msi.h
-index 8b425c6..ec39a08 100644
---- a/include/linux/msi.h
-+++ b/include/linux/msi.h
-@@ -264,12 +264,12 @@ enum {
- * callbacks.
- */
- MSI_FLAG_USE_DEF_CHIP_OPS = (1 << 1),
-- /* Build identity map between hwirq and irq */
-- MSI_FLAG_IDENTITY_MAP = (1 << 2),
- /* Support multiple PCI MSI interrupts */
-- MSI_FLAG_MULTI_PCI_MSI = (1 << 3),
-+ MSI_FLAG_MULTI_PCI_MSI = (1 << 2),
- /* Support PCI MSIX interrupts */
-- MSI_FLAG_PCI_MSIX = (1 << 4),
-+ MSI_FLAG_PCI_MSIX = (1 << 3),
-+ /* Needs early activate, required for PCI */
-+ MSI_FLAG_ACTIVATE_EARLY = (1 << 4),
- };
-
- int msi_domain_set_affinity(struct irq_data *data, const struct cpumask *mask,
-diff --git a/include/linux/serio.h b/include/linux/serio.h
-index df4ab5d..c733cff 100644
---- a/include/linux/serio.h
-+++ b/include/linux/serio.h
-@@ -31,7 +31,8 @@ struct serio {
-
- struct serio_device_id id;
-
-- spinlock_t lock; /* protects critical sections from port's interrupt handler */
-+ /* Protects critical sections from port's interrupt handler */
-+ spinlock_t lock;
-
- int (*write)(struct serio *, unsigned char);
- int (*open)(struct serio *);
-@@ -40,16 +41,29 @@ struct serio {
- void (*stop)(struct serio *);
-
- struct serio *parent;
-- struct list_head child_node; /* Entry in parent->children list */
-+ /* Entry in parent->children list */
-+ struct list_head child_node;
- struct list_head children;
-- unsigned int depth; /* level of nesting in serio hierarchy */
-+ /* Level of nesting in serio hierarchy */
-+ unsigned int depth;
-
-- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */
-- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */
-+ /*
-+ * serio->drv is accessed from interrupt handlers; when modifying
-+ * caller should acquire serio->drv_mutex and serio->lock.
-+ */
-+ struct serio_driver *drv;
-+ /* Protects serio->drv so attributes can pin current driver */
-+ struct mutex drv_mutex;
-
- struct device dev;
-
- struct list_head node;
-+
-+ /*
-+ * For use by PS/2 layer when several ports share hardware and
-+ * may get indigestion when exposed to concurrent access (i8042).
-+ */
-+ struct mutex *ps2_cmd_mutex;
- };
- #define to_serio_port(d) container_of(d, struct serio, dev)
-
-diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
-index 5144013..28c5da6 100644
---- a/include/trace/events/timer.h
-+++ b/include/trace/events/timer.h
-@@ -330,24 +330,32 @@ TRACE_EVENT(itimer_expire,
- #ifdef CONFIG_NO_HZ_COMMON
-
- #define TICK_DEP_NAMES \
-- tick_dep_name(NONE) \
-+ tick_dep_mask_name(NONE) \
- tick_dep_name(POSIX_TIMER) \
- tick_dep_name(PERF_EVENTS) \
- tick_dep_name(SCHED) \
- tick_dep_name_end(CLOCK_UNSTABLE)
-
- #undef tick_dep_name
-+#undef tick_dep_mask_name
- #undef tick_dep_name_end
-
--#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
--#define tick_dep_name_end(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+/* The MASK will convert to their bits and they need to be processed too */
-+#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
-+ TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+#define tick_dep_name_end(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
-+ TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+/* NONE only has a mask defined for it */
-+#define tick_dep_mask_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-
- TICK_DEP_NAMES
-
- #undef tick_dep_name
-+#undef tick_dep_mask_name
- #undef tick_dep_name_end
-
- #define tick_dep_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
-+#define tick_dep_mask_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
- #define tick_dep_name_end(sdep) { TICK_DEP_MASK_##sdep, #sdep }
-
- #define show_tick_dep_name(val) \
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 43d43a2d..e68c0a7 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -242,18 +242,6 @@ unlock:
- return ret;
- }
-
--static void event_function_local(struct perf_event *event, event_f func, void *data)
--{
-- struct event_function_struct efs = {
-- .event = event,
-- .func = func,
-- .data = data,
-- };
--
-- int ret = event_function(&efs);
-- WARN_ON_ONCE(ret);
--}
--
- static void event_function_call(struct perf_event *event, event_f func, void *data)
- {
- struct perf_event_context *ctx = event->ctx;
-@@ -303,6 +291,54 @@ again:
- raw_spin_unlock_irq(&ctx->lock);
- }
-
-+/*
-+ * Similar to event_function_call() + event_function(), but hard assumes IRQs
-+ * are already disabled and we're on the right CPU.
-+ */
-+static void event_function_local(struct perf_event *event, event_f func, void *data)
-+{
-+ struct perf_event_context *ctx = event->ctx;
-+ struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
-+ struct task_struct *task = READ_ONCE(ctx->task);
-+ struct perf_event_context *task_ctx = NULL;
-+
-+ WARN_ON_ONCE(!irqs_disabled());
-+
-+ if (task) {
-+ if (task == TASK_TOMBSTONE)
-+ return;
-+
-+ task_ctx = ctx;
-+ }
-+
-+ perf_ctx_lock(cpuctx, task_ctx);
-+
-+ task = ctx->task;
-+ if (task == TASK_TOMBSTONE)
-+ goto unlock;
-+
-+ if (task) {
-+ /*
-+ * We must be either inactive or active and the right task,
-+ * otherwise we're screwed, since we cannot IPI to somewhere
-+ * else.
-+ */
-+ if (ctx->is_active) {
-+ if (WARN_ON_ONCE(task != current))
-+ goto unlock;
-+
-+ if (WARN_ON_ONCE(cpuctx->task_ctx != ctx))
-+ goto unlock;
-+ }
-+ } else {
-+ WARN_ON_ONCE(&cpuctx->ctx != ctx);
-+ }
-+
-+ func(event, cpuctx, ctx, data);
-+unlock:
-+ perf_ctx_unlock(cpuctx, task_ctx);
-+}
-+
- #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
- PERF_FLAG_FD_OUTPUT |\
- PERF_FLAG_PID_CGROUP |\
-diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
-index b7a525a..8c50276 100644
---- a/kernel/events/uprobes.c
-+++ b/kernel/events/uprobes.c
-@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
- mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
- err = -EAGAIN;
- ptep = page_check_address(page, mm, addr, &ptl, 0);
-- if (!ptep)
-+ if (!ptep) {
-+ mem_cgroup_cancel_charge(kpage, memcg, false);
- goto unlock;
-+ }
-
- get_page(kpage);
- page_add_new_anon_rmap(kpage, vma, addr, false);
-@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
-
- err = 0;
- unlock:
-- mem_cgroup_cancel_charge(kpage, memcg, false);
- mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
- unlock_page(page);
- return err;
-diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
-index 38e89ce..0afe671 100644
---- a/kernel/irq/msi.c
-+++ b/kernel/irq/msi.c
-@@ -324,7 +324,7 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
- struct msi_domain_ops *ops = info->ops;
- msi_alloc_info_t arg;
- struct msi_desc *desc;
-- int i, ret, virq = -1;
-+ int i, ret, virq;
-
- ret = msi_domain_prepare_irqs(domain, dev, nvec, &arg);
- if (ret)
-@@ -332,12 +332,8 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
-
- for_each_msi_entry(desc, dev) {
- ops->set_desc(&arg, desc);
-- if (info->flags & MSI_FLAG_IDENTITY_MAP)
-- virq = (int)ops->get_hwirq(info, &arg);
-- else
-- virq = -1;
-
-- virq = __irq_domain_alloc_irqs(domain, virq, desc->nvec_used,
-+ virq = __irq_domain_alloc_irqs(domain, -1, desc->nvec_used,
- dev_to_node(dev), &arg, false);
- if (virq < 0) {
- ret = -ENOSPC;
-@@ -361,6 +357,17 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
- else
- dev_dbg(dev, "irq [%d-%d] for MSI\n",
- virq, virq + desc->nvec_used - 1);
-+ /*
-+ * This flag is set by the PCI layer as we need to activate
-+ * the MSI entries before the PCI layer enables MSI in the
-+ * card. Otherwise the card latches a random msi message.
-+ */
-+ if (info->flags & MSI_FLAG_ACTIVATE_EARLY) {
-+ struct irq_data *irq_data;
-+
-+ irq_data = irq_domain_get_irq_data(domain, desc->irq);
-+ irq_domain_activate_irq(irq_data);
-+ }
- }
-
- return 0;
-diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
-index 75f98c5..a24cfb4 100644
---- a/kernel/sched/cputime.c
-+++ b/kernel/sched/cputime.c
-@@ -603,19 +603,25 @@ static void cputime_adjust(struct task_cputime *curr,
- stime = curr->stime;
- utime = curr->utime;
-
-- if (utime == 0) {
-- stime = rtime;
-+ /*
-+ * If either stime or both stime and utime are 0, assume all runtime is
-+ * userspace. Once a task gets some ticks, the monotonicy code at
-+ * 'update' will ensure things converge to the observed ratio.
-+ */
-+ if (stime == 0) {
-+ utime = rtime;
- goto update;
- }
-
-- if (stime == 0) {
-- utime = rtime;
-+ if (utime == 0) {
-+ stime = rtime;
- goto update;
- }
-
- stime = scale_stime((__force u64)stime, (__force u64)rtime,
- (__force u64)(stime + utime));
-
-+update:
- /*
- * Make sure stime doesn't go backwards; this preserves monotonicity
- * for utime because rtime is monotonic.
-@@ -638,7 +644,6 @@ static void cputime_adjust(struct task_cputime *curr,
- stime = rtime - utime;
- }
-
--update:
- prev->stime = stime;
- prev->utime = utime;
- out:
-diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index 343a2b7..07f2825 100644
---- a/mm/huge_memory.c
-+++ b/mm/huge_memory.c
-@@ -2872,7 +2872,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- struct page *page;
- pgtable_t pgtable;
- pmd_t _pmd;
-- bool young, write, dirty;
-+ bool young, write, dirty, soft_dirty;
- unsigned long addr;
- int i;
-
-@@ -2898,6 +2898,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- write = pmd_write(*pmd);
- young = pmd_young(*pmd);
- dirty = pmd_dirty(*pmd);
-+ soft_dirty = pmd_soft_dirty(*pmd);
-
- pmdp_huge_split_prepare(vma, haddr, pmd);
- pgtable = pgtable_trans_huge_withdraw(mm, pmd);
-@@ -2914,6 +2915,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- swp_entry_t swp_entry;
- swp_entry = make_migration_entry(page + i, write);
- entry = swp_entry_to_pte(swp_entry);
-+ if (soft_dirty)
-+ entry = pte_swp_mksoft_dirty(entry);
- } else {
- entry = mk_pte(page + i, vma->vm_page_prot);
- entry = maybe_mkwrite(entry, vma);
-@@ -2921,6 +2924,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- entry = pte_wrprotect(entry);
- if (!young)
- entry = pte_mkold(entry);
-+ if (soft_dirty)
-+ entry = pte_mksoft_dirty(entry);
- }
- if (dirty)
- SetPageDirty(page + i);
-diff --git a/mm/readahead.c b/mm/readahead.c
-index 40be3ae..7f9f8c3 100644
---- a/mm/readahead.c
-+++ b/mm/readahead.c
-@@ -8,6 +8,7 @@
- */
-
- #include <linux/kernel.h>
-+#include <linux/dax.h>
- #include <linux/gfp.h>
- #include <linux/export.h>
- #include <linux/blkdev.h>
-@@ -545,6 +546,14 @@ do_readahead(struct address_space *mapping, struct file *filp,
- if (!mapping || !mapping->a_ops)
- return -EINVAL;
-
-+ /*
-+ * Readahead doesn't make sense for DAX inodes, but we don't want it
-+ * to report a failure either. Instead, we just return success and
-+ * don't do any work.
-+ */
-+ if (dax_mapping(mapping))
-+ return 0;
-+
- return force_page_cache_readahead(mapping, filp, index, nr);
- }
-
-diff --git a/mm/slub.c b/mm/slub.c
-index 825ff45..7a6d268 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -3479,6 +3479,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
- */
- static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
- {
-+ LIST_HEAD(discard);
- struct page *page, *h;
-
- BUG_ON(irqs_disabled());
-@@ -3486,13 +3487,16 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
- list_for_each_entry_safe(page, h, &n->partial, lru) {
- if (!page->inuse) {
- remove_partial(n, page);
-- discard_slab(s, page);
-+ list_add(&page->lru, &discard);
- } else {
- list_slab_objects(s, page,
- "Objects remaining in %s on __kmem_cache_shutdown()");
- }
- }
- spin_unlock_irq(&n->list_lock);
-+
-+ list_for_each_entry_safe(page, h, &discard, lru)
-+ discard_slab(s, page);
- }
-
- /*
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0c12e40..8cc49c0 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
-
- /* free all potentially still buffered bcast frames */
- local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
-- skb_queue_purge(&sdata->u.ap.ps.bc_buf);
-+ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
-
- mutex_lock(&local->mtx);
- ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index 2030443..8bad2ad 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
- skb = skb_dequeue(&ps->bc_buf);
- if (skb) {
- purged++;
-- dev_kfree_skb(skb);
-+ ieee80211_free_txskb(&local->hw, skb);
- }
- total += skb_queue_len(&ps->bc_buf);
- }
-@@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
- if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
- ps_dbg(tx->sdata,
- "BC TX buffer full - dropping the oldest frame\n");
-- dev_kfree_skb(skb_dequeue(&ps->bc_buf));
-+ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
- } else
- tx->local->total_ps_buffered++;
-
-@@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
- sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
- if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
- break;
-- dev_kfree_skb_any(skb);
-+ ieee80211_free_txskb(hw, skb);
- }
-
- info = IEEE80211_SKB_CB(skb);
-diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
-index e64ae93..bf4b0e9 100644
---- a/net/sunrpc/auth_gss/auth_gss.c
-+++ b/net/sunrpc/auth_gss/auth_gss.c
-@@ -340,12 +340,14 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
- }
-
- static struct gss_upcall_msg *
--__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid)
-+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
- {
- struct gss_upcall_msg *pos;
- list_for_each_entry(pos, &pipe->in_downcall, list) {
- if (!uid_eq(pos->uid, uid))
- continue;
-+ if (auth && pos->auth->service != auth->service)
-+ continue;
- atomic_inc(&pos->count);
- dprintk("RPC: %s found msg %p\n", __func__, pos);
- return pos;
-@@ -365,7 +367,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg)
- struct gss_upcall_msg *old;
-
- spin_lock(&pipe->lock);
-- old = __gss_find_upcall(pipe, gss_msg->uid);
-+ old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
- if (old == NULL) {
- atomic_inc(&gss_msg->count);
- list_add(&gss_msg->list, &pipe->in_downcall);
-@@ -714,7 +716,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
- err = -ENOENT;
- /* Find a matching upcall */
- spin_lock(&pipe->lock);
-- gss_msg = __gss_find_upcall(pipe, uid);
-+ gss_msg = __gss_find_upcall(pipe, uid, NULL);
- if (gss_msg == NULL) {
- spin_unlock(&pipe->lock);
- goto err_put_ctx;
-diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
-index e7fd769..66c9d63 100644
---- a/net/sunrpc/xprtmultipath.c
-+++ b/net/sunrpc/xprtmultipath.c
-@@ -271,14 +271,12 @@ struct rpc_xprt *xprt_iter_next_entry_multiple(struct rpc_xprt_iter *xpi,
- xprt_switch_find_xprt_t find_next)
- {
- struct rpc_xprt_switch *xps = rcu_dereference(xpi->xpi_xpswitch);
-- struct list_head *head;
-
- if (xps == NULL)
- return NULL;
-- head = &xps->xps_xprt_list;
-- if (xps->xps_nxprts < 2)
-- return xprt_switch_find_first_entry(head);
-- return xprt_switch_set_next_cursor(head, &xpi->xpi_cursor, find_next);
-+ return xprt_switch_set_next_cursor(&xps->xps_xprt_list,
-+ &xpi->xpi_cursor,
-+ find_next);
- }
-
- static
-diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
-index 7e2b2fa..167cf59 100644
---- a/net/sunrpc/xprtsock.c
-+++ b/net/sunrpc/xprtsock.c
-@@ -2278,6 +2278,10 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
- /* SYN_SENT! */
- if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
- xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
-+ break;
-+ case -EADDRNOTAVAIL:
-+ /* Source port number is unavailable. Try a new one! */
-+ transport->srcport = 0;
- }
- out:
- return ret;
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 89dacf9..160c7f7 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -906,20 +906,23 @@ static int azx_resume(struct device *dev)
- struct snd_card *card = dev_get_drvdata(dev);
- struct azx *chip;
- struct hda_intel *hda;
-+ struct hdac_bus *bus;
-
- if (!card)
- return 0;
-
- chip = card->private_data;
- hda = container_of(chip, struct hda_intel, chip);
-+ bus = azx_bus(chip);
- if (chip->disabled || hda->init_failed || !chip->running)
- return 0;
-
-- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
-- && hda->need_i915_power) {
-- snd_hdac_display_power(azx_bus(chip), true);
-- snd_hdac_i915_set_bclk(azx_bus(chip));
-+ if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
-+ snd_hdac_display_power(bus, true);
-+ if (hda->need_i915_power)
-+ snd_hdac_i915_set_bclk(bus);
- }
-+
- if (chip->msi)
- if (pci_enable_msi(pci) < 0)
- chip->msi = 0;
-@@ -929,6 +932,11 @@ static int azx_resume(struct device *dev)
-
- hda_intel_init_chip(chip, true);
-
-+ /* power down again for link-controlled chips */
-+ if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
-+ !hda->need_i915_power)
-+ snd_hdac_display_power(bus, false);
-+
- snd_power_change_state(card, SNDRV_CTL_POWER_D0);
-
- trace_azx_resume(chip);
-@@ -1008,6 +1016,7 @@ static int azx_runtime_resume(struct device *dev)
-
- chip = card->private_data;
- hda = container_of(chip, struct hda_intel, chip);
-+ bus = azx_bus(chip);
- if (chip->disabled || hda->init_failed)
- return 0;
-
-@@ -1015,15 +1024,9 @@ static int azx_runtime_resume(struct device *dev)
- return 0;
-
- if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
-- bus = azx_bus(chip);
-- if (hda->need_i915_power) {
-- snd_hdac_display_power(bus, true);
-+ snd_hdac_display_power(bus, true);
-+ if (hda->need_i915_power)
- snd_hdac_i915_set_bclk(bus);
-- } else {
-- /* toggle codec wakeup bit for STATESTS read */
-- snd_hdac_set_codec_wakeup(bus, true);
-- snd_hdac_set_codec_wakeup(bus, false);
-- }
- }
-
- /* Read STATESTS before controller reset */
-@@ -1043,6 +1046,11 @@ static int azx_runtime_resume(struct device *dev)
- azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
- ~STATESTS_INT_MASK);
-
-+ /* power down again for link-controlled chips */
-+ if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
-+ !hda->need_i915_power)
-+ snd_hdac_display_power(bus, false);
-+
- trace_azx_runtime_resume(chip);
- return 0;
- }
-diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
-index 204cc07..41aa335 100644
---- a/sound/usb/line6/pcm.c
-+++ b/sound/usb/line6/pcm.c
-@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol,
- err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE);
- if (err < 0) {
- line6pcm->impulse_volume = 0;
-- line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE);
- return err;
- }
- } else {
-@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction,
- spin_lock_irqsave(&pstr->lock, flags);
- clear_bit(type, &pstr->running);
- if (!pstr->running) {
-+ spin_unlock_irqrestore(&pstr->lock, flags);
- line6_unlink_audio_urbs(line6pcm, pstr);
-+ spin_lock_irqsave(&pstr->lock, flags);
- if (direction == SNDRV_PCM_STREAM_CAPTURE) {
- line6pcm->prev_fbuf = NULL;
- line6pcm->prev_fsize = 0;
-diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
-index daf81d1..45dd348 100644
---- a/sound/usb/line6/pod.c
-+++ b/sound/usb/line6/pod.c
-@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value,
- static ssize_t serial_number_show(struct device *dev,
- struct device_attribute *attr, char *buf)
- {
-- struct usb_interface *interface = to_usb_interface(dev);
-- struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+ struct snd_card *card = dev_to_snd_card(dev);
-+ struct usb_line6_pod *pod = card->private_data;
-
- return sprintf(buf, "%u\n", pod->serial_number);
- }
-@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev,
- static ssize_t firmware_version_show(struct device *dev,
- struct device_attribute *attr, char *buf)
- {
-- struct usb_interface *interface = to_usb_interface(dev);
-- struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+ struct snd_card *card = dev_to_snd_card(dev);
-+ struct usb_line6_pod *pod = card->private_data;
-
- return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100,
- pod->firmware_version % 100);
-@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev,
- static ssize_t device_id_show(struct device *dev,
- struct device_attribute *attr, char *buf)
- {
-- struct usb_interface *interface = to_usb_interface(dev);
-- struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+ struct snd_card *card = dev_to_snd_card(dev);
-+ struct usb_line6_pod *pod = card->private_data;
-
- return sprintf(buf, "%d\n", pod->device_id);
- }
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 6adde45..6cf1f35 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -1128,6 +1128,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- {
- /* devices which do not support reading the sample rate. */
- switch (chip->usb_id) {
-+ case USB_ID(0x041E, 0x4080): /* Creative Live Cam VF0610 */
- case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
- case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
- case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */
-@@ -1138,6 +1139,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
- case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
- case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
-+ case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
- case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
- case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
- case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
-diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
-index a07b960..853b26d 100644
---- a/tools/perf/arch/x86/util/intel-pt.c
-+++ b/tools/perf/arch/x86/util/intel-pt.c
-@@ -501,7 +501,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- struct intel_pt_recording *ptr =
- container_of(itr, struct intel_pt_recording, itr);
- struct perf_pmu *intel_pt_pmu = ptr->intel_pt_pmu;
-- bool have_timing_info;
-+ bool have_timing_info, need_immediate = false;
- struct perf_evsel *evsel, *intel_pt_evsel = NULL;
- const struct cpu_map *cpus = evlist->cpus;
- bool privileged = geteuid() == 0 || perf_event_paranoid() < 0;
-@@ -655,6 +655,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- ptr->have_sched_switch = 3;
- } else {
- opts->record_switch_events = true;
-+ need_immediate = true;
- if (cpu_wide)
- ptr->have_sched_switch = 3;
- else
-@@ -700,6 +701,9 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- tracking_evsel->attr.freq = 0;
- tracking_evsel->attr.sample_period = 1;
-
-+ if (need_immediate)
-+ tracking_evsel->immediate = true;
-+
- /* In per-cpu case, always need the time of mmap events etc */
- if (!cpu_map__empty(cpus)) {
- perf_evsel__set_sample_bit(tracking_evsel, TIME);
-diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
-index 1dc140c..3f02bea10 100644
---- a/tools/perf/builtin-mem.c
-+++ b/tools/perf/builtin-mem.c
-@@ -87,6 +87,9 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
- if (mem->operation & MEM_OPERATION_LOAD)
- perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true;
-
-+ if (mem->operation & MEM_OPERATION_STORE)
-+ perf_mem_events[PERF_MEM_EVENTS__STORE].record = true;
-+
- if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record)
- rec_argv[i++] = "-W";
-
-diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
-index 87a297d..c33efb9 100644
---- a/tools/perf/util/symbol-elf.c
-+++ b/tools/perf/util/symbol-elf.c
-@@ -827,7 +827,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
- sec = syms_ss->symtab;
- shdr = syms_ss->symshdr;
-
-- if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
-+ if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr,
-+ ".text", NULL))
- dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
-
- if (runtime_ss->opdsec)
-diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
-index c919866..1bfacc8 100644
---- a/tools/testing/nvdimm/test/nfit.c
-+++ b/tools/testing/nvdimm/test/nfit.c
-@@ -13,6 +13,7 @@
- #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
- #include <linux/platform_device.h>
- #include <linux/dma-mapping.h>
-+#include <linux/workqueue.h>
- #include <linux/libnvdimm.h>
- #include <linux/vmalloc.h>
- #include <linux/device.h>
-@@ -1480,6 +1481,7 @@ static int nfit_test_probe(struct platform_device *pdev)
- if (nfit_test->setup != nfit_test0_setup)
- return 0;
-
-+ flush_work(&acpi_desc->work);
- nfit_test->setup_hotplug = 1;
- nfit_test->setup(nfit_test);
-
diff --git a/4.7.4/1003_linux-4.7.4.patch b/4.7.4/1003_linux-4.7.4.patch
deleted file mode 100644
index af6c1d4..0000000
--- a/4.7.4/1003_linux-4.7.4.patch
+++ /dev/null
@@ -1,2424 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4afff18..ec3bd11 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 60078a6..b15e1c1 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -1597,6 +1597,9 @@ void __init enable_IR_x2apic(void)
- unsigned long flags;
- int ret, ir_stat;
-
-+ if (skip_ioapic_setup)
-+ return;
-+
- ir_stat = irq_remapping_prepare();
- if (ir_stat < 0 && !x2apic_supported())
- return;
-diff --git a/block/blk-core.c b/block/blk-core.c
-index 2475b1c7..b993f88 100644
---- a/block/blk-core.c
-+++ b/block/blk-core.c
-@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
-
- void blk_set_queue_dying(struct request_queue *q)
- {
-- queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
-+ spin_lock_irq(q->queue_lock);
-+ queue_flag_set(QUEUE_FLAG_DYING, q);
-+ spin_unlock_irq(q->queue_lock);
-
- if (q->mq_ops)
- blk_mq_wake_waiters(q);
-diff --git a/block/blk-merge.c b/block/blk-merge.c
-index 2613531..bea9344 100644
---- a/block/blk-merge.c
-+++ b/block/blk-merge.c
-@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
- bool do_split = true;
- struct bio *new = NULL;
- const unsigned max_sectors = get_max_io_size(q, bio);
-+ unsigned bvecs = 0;
-
- bio_for_each_segment(bv, bio, iter) {
- /*
-+ * With arbitrary bio size, the incoming bio may be very
-+ * big. We have to split the bio into small bios so that
-+ * each holds at most BIO_MAX_PAGES bvecs because
-+ * bio_clone() can fail to allocate big bvecs.
-+ *
-+ * It should have been better to apply the limit per
-+ * request queue in which bio_clone() is involved,
-+ * instead of globally. The biggest blocker is the
-+ * bio_clone() in bio bounce.
-+ *
-+ * If bio is splitted by this reason, we should have
-+ * allowed to continue bios merging, but don't do
-+ * that now for making the change simple.
-+ *
-+ * TODO: deal with bio bounce's bio_clone() gracefully
-+ * and convert the global limit into per-queue limit.
-+ */
-+ if (bvecs++ >= BIO_MAX_PAGES)
-+ goto split;
-+
-+ /*
- * If the queue doesn't support SG gaps and adding this
- * offset would create a gap, disallow it.
- */
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 84708a5..b206115 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
-
- opened_bdev[drive] = bdev;
-
-- if (!(mode & (FMODE_READ|FMODE_WRITE))) {
-- res = -EINVAL;
-- goto out;
-- }
--
- res = -ENXIO;
-
- if (!floppy_track_buffer) {
-@@ -3711,20 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- if (UFDCS->rawcmd == 1)
- UFDCS->rawcmd = 2;
-
-- UDRS->last_checked = 0;
-- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-- check_disk_change(bdev);
-- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-- goto out;
-- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-- goto out;
--
-- res = -EROFS;
--
-- if ((mode & FMODE_WRITE) &&
-- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-- goto out;
--
-+ if (!(mode & FMODE_NDELAY)) {
-+ if (mode & (FMODE_READ|FMODE_WRITE)) {
-+ UDRS->last_checked = 0;
-+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+ check_disk_change(bdev);
-+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+ goto out;
-+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+ goto out;
-+ }
-+ res = -EROFS;
-+ if ((mode & FMODE_WRITE) &&
-+ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-+ goto out;
-+ }
- mutex_unlock(&open_lock);
- mutex_unlock(&floppy_mutex);
- return 0;
-diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
-index 0bb44d5..2ee40fd 100644
---- a/drivers/cpufreq/cpufreq-dt-platdev.c
-+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
- { .compatible = "ti,omap5", },
-
- { .compatible = "xlnx,zynq-7000", },
-+
-+ { }
- };
-
- static int __init cpufreq_dt_platdev_init(void)
-diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
-index 6dc5971..b304421 100644
---- a/drivers/crypto/caam/caamalg.c
-+++ b/drivers/crypto/caam/caamalg.c
-@@ -556,7 +556,10 @@ skip_enc:
-
- /* Read and write assoclen bytes */
- append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-- append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
-+ if (alg->caam.geniv)
-+ append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
-+ else
-+ append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
-
- /* Skip assoc data */
- append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
-@@ -565,6 +568,14 @@ skip_enc:
- append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
- KEY_VLF);
-
-+ if (alg->caam.geniv) {
-+ append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
-+ LDST_SRCDST_BYTE_CONTEXT |
-+ (ctx1_iv_off << LDST_OFFSET_SHIFT));
-+ append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
-+ (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
-+ }
-+
- /* Load Counter into CONTEXT1 reg */
- if (is_rfc3686)
- append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
-@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
-
- init_aead_job(req, edesc, all_contig, encrypt);
-
-- if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
-+ if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
- append_load_as_imm(desc, req->iv, ivsize,
- LDST_CLASS_1_CCB |
- LDST_SRCDST_BYTE_CONTEXT |
-@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
- return ret;
- }
-
--static int aead_givdecrypt(struct aead_request *req)
--{
-- struct crypto_aead *aead = crypto_aead_reqtfm(req);
-- unsigned int ivsize = crypto_aead_ivsize(aead);
--
-- if (req->cryptlen < ivsize)
-- return -EINVAL;
--
-- req->cryptlen -= ivsize;
-- req->assoclen += ivsize;
--
-- return aead_decrypt(req);
--}
--
- /*
- * allocate and map the ablkcipher extended descriptor for ablkcipher
- */
-@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = MD5_DIGEST_SIZE,
- },
-@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = SHA1_DIGEST_SIZE,
- },
-@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = SHA224_DIGEST_SIZE,
- },
-@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = SHA256_DIGEST_SIZE,
- },
-@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = SHA384_DIGEST_SIZE,
- },
-@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = AES_BLOCK_SIZE,
- .maxauthsize = SHA512_DIGEST_SIZE,
- },
-@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = MD5_DIGEST_SIZE,
- },
-@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = SHA1_DIGEST_SIZE,
- },
-@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = SHA224_DIGEST_SIZE,
- },
-@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = SHA256_DIGEST_SIZE,
- },
-@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = SHA384_DIGEST_SIZE,
- },
-@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES3_EDE_BLOCK_SIZE,
- .maxauthsize = SHA512_DIGEST_SIZE,
- },
-@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = MD5_DIGEST_SIZE,
- },
-@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = SHA1_DIGEST_SIZE,
- },
-@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = SHA224_DIGEST_SIZE,
- },
-@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = SHA256_DIGEST_SIZE,
- },
-@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = SHA384_DIGEST_SIZE,
- },
-@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = DES_BLOCK_SIZE,
- .maxauthsize = SHA512_DIGEST_SIZE,
- },
-@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = MD5_DIGEST_SIZE,
- },
-@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = SHA1_DIGEST_SIZE,
- },
-@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = SHA224_DIGEST_SIZE,
- },
-@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = SHA256_DIGEST_SIZE,
- },
-@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = SHA384_DIGEST_SIZE,
- },
-@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
- .setkey = aead_setkey,
- .setauthsize = aead_setauthsize,
- .encrypt = aead_encrypt,
-- .decrypt = aead_givdecrypt,
-+ .decrypt = aead_decrypt,
- .ivsize = CTR_RFC3686_IV_SIZE,
- .maxauthsize = SHA512_DIGEST_SIZE,
- },
-diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
-index 9bb99e2..79a05a3 100644
---- a/drivers/gpu/drm/drm_atomic.c
-+++ b/drivers/gpu/drm/drm_atomic.c
-@@ -465,7 +465,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- val,
- -1,
- &replaced);
-- state->color_mgmt_changed = replaced;
-+ state->color_mgmt_changed |= replaced;
- return ret;
- } else if (property == config->ctm_property) {
- ret = drm_atomic_replace_property_blob_from_id(crtc,
-@@ -473,7 +473,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- val,
- sizeof(struct drm_color_ctm),
- &replaced);
-- state->color_mgmt_changed = replaced;
-+ state->color_mgmt_changed |= replaced;
- return ret;
- } else if (property == config->gamma_lut_property) {
- ret = drm_atomic_replace_property_blob_from_id(crtc,
-@@ -481,7 +481,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- val,
- -1,
- &replaced);
-- state->color_mgmt_changed = replaced;
-+ state->color_mgmt_changed |= replaced;
- return ret;
- } else if (crtc->funcs->atomic_set_property)
- return crtc->funcs->atomic_set_property(crtc, state, property, val);
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 0e3cc66..a5cae1b 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -5312,6 +5312,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
- struct drm_pending_vblank_event *e = NULL;
- int ret = -EINVAL;
-
-+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
-+ return -EINVAL;
-+
- if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
- page_flip->reserved != 0)
- return -EINVAL;
-diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
-index eb4bb8b..eb515f0 100644
---- a/drivers/gpu/drm/msm/msm_gem_submit.c
-+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
-@@ -62,6 +62,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
- kfree(submit);
- }
-
-+static inline unsigned long __must_check
-+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
-+{
-+ if (access_ok(VERIFY_READ, from, n))
-+ return __copy_from_user_inatomic(to, from, n);
-+ return -EFAULT;
-+}
-+
- static int submit_lookup_objects(struct msm_gem_submit *submit,
- struct drm_msm_gem_submit *args, struct drm_file *file)
- {
-@@ -69,6 +77,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- int ret = 0;
-
- spin_lock(&file->table_lock);
-+ pagefault_disable();
-
- for (i = 0; i < args->nr_bos; i++) {
- struct drm_msm_gem_submit_bo submit_bo;
-@@ -82,10 +91,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- */
- submit->bos[i].flags = 0;
-
-- ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-- if (ret) {
-- ret = -EFAULT;
-- goto out_unlock;
-+ ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
-+ if (unlikely(ret)) {
-+ pagefault_enable();
-+ spin_unlock(&file->table_lock);
-+ ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-+ if (ret)
-+ goto out;
-+ spin_lock(&file->table_lock);
-+ pagefault_disable();
- }
-
- if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
-@@ -125,9 +139,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- }
-
- out_unlock:
-- submit->nr_bos = i;
-+ pagefault_enable();
- spin_unlock(&file->table_lock);
-
-+out:
-+ submit->nr_bos = i;
-+
- return ret;
- }
-
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 259cd6e..17e3454 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
- if (radeon_crtc->ss.refdiv) {
- radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
- radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
-- if (rdev->family >= CHIP_RV770)
-+ if (ASIC_IS_AVIVO(rdev) &&
-+ rdev->family != CHIP_RS780 &&
-+ rdev->family != CHIP_RS880)
- radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
- }
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 590b037..0ab76dd 100644
---- a/drivers/gpu/drm/radeon/radeon_ttm.c
-+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
-
- rdev = radeon_get_rdev(bo->bdev);
- ridx = radeon_copy_ring_index(rdev);
-- old_start = old_mem->start << PAGE_SHIFT;
-- new_start = new_mem->start << PAGE_SHIFT;
-+ old_start = (u64)old_mem->start << PAGE_SHIFT;
-+ new_start = (u64)new_mem->start << PAGE_SHIFT;
-
- switch (old_mem->mem_type) {
- case TTM_PL_VRAM:
-diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
-index 37cac59..2e24616 100644
---- a/drivers/gpu/drm/vc4/vc4_drv.h
-+++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
- struct vc4_exec_info, head);
- }
-
-+static inline struct vc4_exec_info *
-+vc4_last_render_job(struct vc4_dev *vc4)
-+{
-+ if (list_empty(&vc4->render_job_list))
-+ return NULL;
-+ return list_last_entry(&vc4->render_job_list,
-+ struct vc4_exec_info, head);
-+}
-+
- /**
- * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
- * setup parameters.
-diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
-index 46899d6..78ab08e 100644
---- a/drivers/gpu/drm/vc4/vc4_gem.c
-+++ b/drivers/gpu/drm/vc4/vc4_gem.c
-@@ -574,8 +574,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
- spin_unlock(&file_priv->table_lock);
-
- fail:
-- kfree(handles);
-- return 0;
-+ drm_free_large(handles);
-+ return ret;
- }
-
- static int
-diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
-index b0104a34..094bc6a 100644
---- a/drivers/gpu/drm/vc4/vc4_irq.c
-+++ b/drivers/gpu/drm/vc4/vc4_irq.c
-@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
-
- spin_lock_irqsave(&vc4->job_lock, irqflags);
- current_exec = vc4_first_bin_job(vc4);
-+ if (!current_exec)
-+ current_exec = vc4_last_render_job(vc4);
- if (current_exec) {
-- vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
-+ vc4->overflow_mem->seqno = current_exec->seqno;
- list_add_tail(&vc4->overflow_mem->unref_head,
- ¤t_exec->unref_list);
- vc4->overflow_mem = NULL;
-diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
-index 70ed1d0..d3ef0fc 100644
---- a/drivers/irqchip/irq-mips-gic.c
-+++ b/drivers/irqchip/irq-mips-gic.c
-@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
- unsigned long flags;
- int i;
-
-- irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-- handle_level_irq);
--
- spin_lock_irqsave(&gic_lock, flags);
- gic_map_to_pin(intr, gic_cpu_pin);
- gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
-@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
- {
- if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
- return gic_local_irq_domain_map(d, virq, hw);
-+
-+ irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-+ handle_level_irq);
-+
- return gic_shared_irq_domain_map(d, virq, hw, 0);
- }
-
-@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
- hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
-
- ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
-- &gic_edge_irq_controller,
-+ &gic_level_irq_controller,
- NULL);
- if (ret)
- goto error;
-
-+ irq_set_handler(virq + i, handle_level_irq);
-+
- ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
- if (ret)
- goto error;
-@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
- return;
- }
-
-+static void gic_dev_domain_activate(struct irq_domain *domain,
-+ struct irq_data *d)
-+{
-+ gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
-+}
-+
- static struct irq_domain_ops gic_dev_domain_ops = {
- .xlate = gic_dev_domain_xlate,
- .alloc = gic_dev_domain_alloc,
- .free = gic_dev_domain_free,
-+ .activate = gic_dev_domain_activate,
- };
-
- static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
-diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
-index f5dbb4e..5d3b231 100644
---- a/drivers/md/bcache/super.c
-+++ b/drivers/md/bcache/super.c
-@@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
- free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
-
- if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
-- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
-+ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
- !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
- !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
- !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) ||
-diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
-index e2fb44c..dc3a854 100644
---- a/drivers/misc/mei/hw-me.c
-+++ b/drivers/misc/mei/hw-me.c
-@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
- static bool mei_me_fw_type_sps(struct pci_dev *pdev)
- {
- u32 reg;
-- /* Read ME FW Status check for SPS Firmware */
-- pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®);
-+ unsigned int devfn;
-+
-+ /*
-+ * Read ME FW Status register to check for SPS Firmware
-+ * The SPS FW is only signaled in pci function 0
-+ */
-+ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
-+ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, ®);
- trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
- /* if bits [19:16] = 15, running SPS Firmware */
- return (reg & 0xf0000) == 0xf0000;
-diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
-index 64e64da..71cea9b 100644
---- a/drivers/misc/mei/pci-me.c
-+++ b/drivers/misc/mei/pci-me.c
-@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
-
- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
-- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
-- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
-+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
-+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
-
- {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
- {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
-diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
-index 83458f7..6dc96c8 100644
---- a/drivers/scsi/constants.c
-+++ b/drivers/scsi/constants.c
-@@ -361,8 +361,9 @@ static const char * const snstext[] = {
-
- /* Get sense key string or NULL if not available */
- const char *
--scsi_sense_key_string(unsigned char key) {
-- if (key <= 0xE)
-+scsi_sense_key_string(unsigned char key)
-+{
-+ if (key < ARRAY_SIZE(snstext))
- return snstext[key];
- return NULL;
- }
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 0a4d54a..591e520 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1196,6 +1196,8 @@ static int acm_probe(struct usb_interface *intf,
- }
-
- if (!buflen) {
-+ if (!intf->cur_altsetting || !intf->cur_altsetting->endpoint)
-+ return -EINVAL;
- if (intf->cur_altsetting->endpoint &&
- intf->cur_altsetting->endpoint->extralen &&
- intf->cur_altsetting->endpoint->extra) {
-@@ -1276,6 +1278,8 @@ next_desc:
- data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
- control_interface = intf;
- } else {
-+ if (!intf->cur_altsetting)
-+ return -ENODEV;
- if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
- dev_dbg(&intf->dev,"No union descriptor, giving up\n");
- return -ENODEV;
-@@ -1305,15 +1309,22 @@ next_desc:
- combined_interfaces = 1;
- /* a popular other OS doesn't use it */
- quirks |= NO_CAP_LINE;
-+ if (!data_interface->cur_altsetting)
-+ return -EINVAL;
- if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) {
- dev_err(&intf->dev, "This needs exactly 3 endpoints\n");
- return -EINVAL;
- }
- look_for_collapsed_interface:
-+ if (!data_interface->cur_altsetting)
-+ return -EINVAL;
- for (i = 0; i < 3; i++) {
- struct usb_endpoint_descriptor *ep;
- ep = &data_interface->cur_altsetting->endpoint[i].desc;
-
-+ if (!ep)
-+ return -ENODEV;
-+
- if (usb_endpoint_is_int_in(ep))
- epctrl = ep;
- else if (usb_endpoint_is_bulk_out(ep))
-@@ -1332,8 +1343,12 @@ look_for_collapsed_interface:
- skip_normal_probe:
-
- /*workaround for switched interfaces */
-+ if (!data_interface->cur_altsetting)
-+ return -EINVAL;
- if (data_interface->cur_altsetting->desc.bInterfaceClass
- != CDC_DATA_INTERFACE_TYPE) {
-+ if (!control_interface->cur_altsetting)
-+ return -EINVAL;
- if (control_interface->cur_altsetting->desc.bInterfaceClass
- == CDC_DATA_INTERFACE_TYPE) {
- dev_dbg(&intf->dev,
-@@ -1356,6 +1371,7 @@ skip_normal_probe:
-
-
- if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
-+ !control_interface->cur_altsetting ||
- control_interface->cur_altsetting->desc.bNumEndpoints == 0)
- return -EINVAL;
-
-@@ -1363,6 +1379,8 @@ skip_normal_probe:
- epread = &data_interface->cur_altsetting->endpoint[0].desc;
- epwrite = &data_interface->cur_altsetting->endpoint[1].desc;
-
-+ if (!epctrl || !epread || !epwrite)
-+ return -ENODEV;
-
- /* workaround for switched endpoints */
- if (!usb_endpoint_dir_in(epread)) {
-diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
-index 9d6320e..6e29d05 100644
---- a/drivers/vhost/scsi.c
-+++ b/drivers/vhost/scsi.c
-@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
- struct scatterlist *tvc_prot_sgl;
- struct page **tvc_upages;
- /* Pointer to response header iovec */
-- struct iovec *tvc_resp_iov;
-+ struct iovec tvc_resp_iov;
- /* Pointer to vhost_scsi for our device */
- struct vhost_scsi *tvc_vhost;
- /* Pointer to vhost_virtqueue for the cmd */
-@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
- memcpy(v_rsp.sense, cmd->tvc_sense_buf,
- se_cmd->scsi_sense_length);
-
-- iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
-+ iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
- cmd->tvc_in_iovs, sizeof(v_rsp));
- ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
- if (likely(ret == sizeof(v_rsp))) {
-@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
- }
- cmd->tvc_vhost = vs;
- cmd->tvc_vq = vq;
-- cmd->tvc_resp_iov = &vq->iov[out];
-+ cmd->tvc_resp_iov = vq->iov[out];
- cmd->tvc_in_iovs = in;
-
- pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
-diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
-index 7487971..c1010f01 100644
---- a/drivers/xen/xenbus/xenbus_dev_frontend.c
-+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
-@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
- rc = -ENOMEM;
- goto out;
- }
-- } else {
-+ } else if (msg_type == XS_TRANSACTION_END) {
- list_for_each_entry(trans, &u->transactions, list)
- if (trans->handle.id == u->u.msg.tx_id)
- break;
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 71ccab1..b1495fa 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -659,7 +659,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type,
- {
- struct dentry *dent;
- dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC);
-- if (dent)
-+ if (!IS_ERR(dent))
- dent->d_sb->s_iflags |= SB_I_CGROUPWB;
- return dent;
- }
-diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
-index 0f9961e..f96547f 100644
---- a/fs/crypto/policy.c
-+++ b/fs/crypto/policy.c
-@@ -95,10 +95,15 @@ static int create_encryption_context_from_policy(struct inode *inode,
- int fscrypt_process_policy(struct inode *inode,
- const struct fscrypt_policy *policy)
- {
-+ if (!inode_owner_or_capable(inode))
-+ return -EACCES;
-+
- if (policy->version != 0)
- return -EINVAL;
-
- if (!inode_has_encryption_context(inode)) {
-+ if (!S_ISDIR(inode->i_mode))
-+ return -EINVAL;
- if (!inode->i_sb->s_cop->empty_dir)
- return -EOPNOTSUPP;
- if (!inode->i_sb->s_cop->empty_dir(inode))
-diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
-index ad05069..8a9feb3 100644
---- a/fs/ext4/crypto_policy.c
-+++ b/fs/ext4/crypto_policy.c
-@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
- int ext4_process_policy(const struct ext4_encryption_policy *policy,
- struct inode *inode)
- {
-+ if (!inode_owner_or_capable(inode))
-+ return -EACCES;
-+
- if (policy->version != 0)
- return -EINVAL;
-
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index b747ec0..ea628af 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -51,25 +51,31 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
- struct ext4_inode_info *ei)
- {
- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-- __u16 csum_lo;
-- __u16 csum_hi = 0;
- __u32 csum;
-+ __u16 dummy_csum = 0;
-+ int offset = offsetof(struct ext4_inode, i_checksum_lo);
-+ unsigned int csum_size = sizeof(dummy_csum);
-
-- csum_lo = le16_to_cpu(raw->i_checksum_lo);
-- raw->i_checksum_lo = 0;
-- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
-- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
-- csum_hi = le16_to_cpu(raw->i_checksum_hi);
-- raw->i_checksum_hi = 0;
-- }
-+ csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset);
-+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size);
-+ offset += csum_size;
-+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+ EXT4_GOOD_OLD_INODE_SIZE - offset);
-
-- csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
-- EXT4_INODE_SIZE(inode->i_sb));
--
-- raw->i_checksum_lo = cpu_to_le16(csum_lo);
-- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
-- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
-- raw->i_checksum_hi = cpu_to_le16(csum_hi);
-+ if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
-+ offset = offsetof(struct ext4_inode, i_checksum_hi);
-+ csum = ext4_chksum(sbi, csum, (__u8 *)raw +
-+ EXT4_GOOD_OLD_INODE_SIZE,
-+ offset - EXT4_GOOD_OLD_INODE_SIZE);
-+ if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
-+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
-+ csum_size);
-+ offset += csum_size;
-+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+ EXT4_INODE_SIZE(inode->i_sb) -
-+ offset);
-+ }
-+ }
-
- return csum;
- }
-@@ -5460,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
- sbi->s_want_extra_isize,
- iloc, handle);
- if (ret) {
-- ext4_set_inode_state(inode,
-- EXT4_STATE_NO_EXPAND);
- if (mnt_count !=
- le16_to_cpu(sbi->s_es->s_mnt_count)) {
- ext4_warning(inode->i_sb,
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index ec4c399..5bb46b6 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent,
- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- struct ext4_inode_info *ei = EXT4_I(inode);
- __u32 csum;
-- __le32 save_csum;
- int size;
-+ __u32 dummy_csum = 0;
-+ int offset = offsetof(struct dx_tail, dt_checksum);
-
- size = count_offset + (count * sizeof(struct dx_entry));
-- save_csum = t->dt_checksum;
-- t->dt_checksum = 0;
- csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size);
-- csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail));
-- t->dt_checksum = save_csum;
-+ csum = ext4_chksum(sbi, csum, (__u8 *)t, offset);
-+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
-
- return cpu_to_le32(csum);
- }
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 639bd756..d4505f8 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2068,23 +2068,25 @@ failed:
- static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- struct ext4_group_desc *gdp)
- {
-- int offset;
-+ int offset = offsetof(struct ext4_group_desc, bg_checksum);
- __u16 crc = 0;
- __le32 le_group = cpu_to_le32(block_group);
- struct ext4_sb_info *sbi = EXT4_SB(sb);
-
- if (ext4_has_metadata_csum(sbi->s_sb)) {
- /* Use new metadata_csum algorithm */
-- __le16 save_csum;
- __u32 csum32;
-+ __u16 dummy_csum = 0;
-
-- save_csum = gdp->bg_checksum;
-- gdp->bg_checksum = 0;
- csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group,
- sizeof(le_group));
-- csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp,
-- sbi->s_desc_size);
-- gdp->bg_checksum = save_csum;
-+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset);
-+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum,
-+ sizeof(dummy_csum));
-+ offset += sizeof(dummy_csum);
-+ if (offset < sbi->s_desc_size)
-+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset,
-+ sbi->s_desc_size - offset);
-
- crc = csum32 & 0xFFFF;
- goto out;
-@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- if (!ext4_has_feature_gdt_csum(sb))
- return 0;
-
-- offset = offsetof(struct ext4_group_desc, bg_checksum);
--
- crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid));
- crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group));
- crc = crc16(crc, (__u8 *)gdp, offset);
-@@ -2131,6 +2131,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
-
- /* Called at mount-time, super-block is locked */
- static int ext4_check_descriptors(struct super_block *sb,
-+ ext4_fsblk_t sb_block,
- ext4_group_t *first_not_zeroed)
- {
- struct ext4_sb_info *sbi = EXT4_SB(sb);
-@@ -2161,6 +2162,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- grp = i;
-
- block_bitmap = ext4_block_bitmap(sb, gdp);
-+ if (block_bitmap == sb_block) {
-+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+ "Block bitmap for group %u overlaps "
-+ "superblock", i);
-+ }
- if (block_bitmap < first_block || block_bitmap > last_block) {
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- "Block bitmap for group %u not in group "
-@@ -2168,6 +2174,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- return 0;
- }
- inode_bitmap = ext4_inode_bitmap(sb, gdp);
-+ if (inode_bitmap == sb_block) {
-+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+ "Inode bitmap for group %u overlaps "
-+ "superblock", i);
-+ }
- if (inode_bitmap < first_block || inode_bitmap > last_block) {
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- "Inode bitmap for group %u not in group "
-@@ -2175,6 +2186,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- return 0;
- }
- inode_table = ext4_inode_table(sb, gdp);
-+ if (inode_table == sb_block) {
-+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+ "Inode table for group %u overlaps "
-+ "superblock", i);
-+ }
- if (inode_table < first_block ||
- inode_table + sbi->s_itb_per_group - 1 > last_block) {
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-@@ -3677,7 +3693,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- goto failed_mount2;
- }
- }
-- if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
-+ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
- ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
- ret = -EFSCORRUPTED;
- goto failed_mount2;
-diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
-index e79bd32..2eb935c 100644
---- a/fs/ext4/xattr.c
-+++ b/fs/ext4/xattr.c
-@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
- {
- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- __u32 csum;
-- __le32 save_csum;
- __le64 dsk_block_nr = cpu_to_le64(block_nr);
-+ __u32 dummy_csum = 0;
-+ int offset = offsetof(struct ext4_xattr_header, h_checksum);
-
-- save_csum = hdr->h_checksum;
-- hdr->h_checksum = 0;
- csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr,
- sizeof(dsk_block_nr));
-- csum = ext4_chksum(sbi, csum, (__u8 *)hdr,
-- EXT4_BLOCK_SIZE(inode->i_sb));
-+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset);
-+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
-+ offset += sizeof(dummy_csum);
-+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset,
-+ EXT4_BLOCK_SIZE(inode->i_sb) - offset);
-
-- hdr->h_checksum = save_csum;
- return cpu_to_le32(csum);
- }
-
-@@ -1352,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
- size_t min_offs, free;
- int total_ino;
- void *base, *start, *end;
-- int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
-+ int error = 0, tried_min_extra_isize = 0;
- int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
-+ int isize_diff; /* How much do we need to grow i_extra_isize */
-
- down_write(&EXT4_I(inode)->xattr_sem);
-+ /*
-+ * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
-+ */
-+ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
- retry:
-- if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
-- up_write(&EXT4_I(inode)->xattr_sem);
-- return 0;
-- }
-+ isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
-+ if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
-+ goto out;
-
- header = IHDR(inode, raw_inode);
- entry = IFIRST(header);
-@@ -1381,7 +1386,7 @@ retry:
- goto cleanup;
-
- free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
-- if (free >= new_extra_isize) {
-+ if (free >= isize_diff) {
- entry = IFIRST(header);
- ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize
- - new_extra_isize, (void *)raw_inode +
-@@ -1389,8 +1394,7 @@ retry:
- (void *)header, total_ino,
- inode->i_sb->s_blocksize);
- EXT4_I(inode)->i_extra_isize = new_extra_isize;
-- error = 0;
-- goto cleanup;
-+ goto out;
- }
-
- /*
-@@ -1413,7 +1417,7 @@ retry:
- end = bh->b_data + bh->b_size;
- min_offs = end - base;
- free = ext4_xattr_free_space(first, &min_offs, base, NULL);
-- if (free < new_extra_isize) {
-+ if (free < isize_diff) {
- if (!tried_min_extra_isize && s_min_extra_isize) {
- tried_min_extra_isize++;
- new_extra_isize = s_min_extra_isize;
-@@ -1427,7 +1431,7 @@ retry:
- free = inode->i_sb->s_blocksize;
- }
-
-- while (new_extra_isize > 0) {
-+ while (isize_diff > 0) {
- size_t offs, size, entry_size;
- struct ext4_xattr_entry *small_entry = NULL;
- struct ext4_xattr_info i = {
-@@ -1458,7 +1462,7 @@ retry:
- EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
- EXT4_XATTR_LEN(last->e_name_len);
- if (total_size <= free && total_size < min_total_size) {
-- if (total_size < new_extra_isize) {
-+ if (total_size < isize_diff) {
- small_entry = last;
- } else {
- entry = last;
-@@ -1513,22 +1517,22 @@ retry:
- error = ext4_xattr_ibody_set(handle, inode, &i, is);
- if (error)
- goto cleanup;
-+ total_ino -= entry_size;
-
- entry = IFIRST(header);
-- if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
-- shift_bytes = new_extra_isize;
-+ if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
-+ shift_bytes = isize_diff;
- else
-- shift_bytes = entry_size + size;
-+ shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
- /* Adjust the offsets and shift the remaining entries ahead */
-- ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
-- shift_bytes, (void *)raw_inode +
-- EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
-- (void *)header, total_ino - entry_size,
-- inode->i_sb->s_blocksize);
-+ ext4_xattr_shift_entries(entry, -shift_bytes,
-+ (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
-+ EXT4_I(inode)->i_extra_isize + shift_bytes,
-+ (void *)header, total_ino, inode->i_sb->s_blocksize);
-
-- extra_isize += shift_bytes;
-- new_extra_isize -= shift_bytes;
-- EXT4_I(inode)->i_extra_isize = extra_isize;
-+ isize_diff -= shift_bytes;
-+ EXT4_I(inode)->i_extra_isize += shift_bytes;
-+ header = IHDR(inode, raw_inode);
-
- i.name = b_entry_name;
- i.value = buffer;
-@@ -1550,6 +1554,8 @@ retry:
- kfree(bs);
- }
- brelse(bh);
-+out:
-+ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
- up_write(&EXT4_I(inode)->xattr_sem);
- return 0;
-
-@@ -1561,6 +1567,10 @@ cleanup:
- kfree(is);
- kfree(bs);
- brelse(bh);
-+ /*
-+ * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
-+ * size expansion failed.
-+ */
- up_write(&EXT4_I(inode)->xattr_sem);
- return error;
- }
-diff --git a/fs/namei.c b/fs/namei.c
-index 70580ab..9281b2b 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -901,6 +901,7 @@ static inline int may_follow_link(struct nameidata *nd)
- {
- const struct inode *inode;
- const struct inode *parent;
-+ kuid_t puid;
-
- if (!sysctl_protected_symlinks)
- return 0;
-@@ -916,7 +917,8 @@ static inline int may_follow_link(struct nameidata *nd)
- return 0;
-
- /* Allowed if parent directory and link owner match. */
-- if (uid_eq(parent->i_uid, inode->i_uid))
-+ puid = parent->i_uid;
-+ if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
- return 0;
-
- if (nd->flags & LOOKUP_RCU)
-diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
-index 80aa6f1..4133aa7 100644
---- a/fs/overlayfs/copy_up.c
-+++ b/fs/overlayfs/copy_up.c
-@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
- }
-
- for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
-+ if (ovl_is_private_xattr(name))
-+ continue;
- retry:
- size = vfs_getxattr(old, name, value, value_size);
- if (size == -ERANGE)
-diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index d1cdc60..ac98a71 100644
---- a/fs/overlayfs/inode.c
-+++ b/fs/overlayfs/inode.c
-@@ -231,7 +231,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
- }
-
-
--static bool ovl_is_private_xattr(const char *name)
-+bool ovl_is_private_xattr(const char *name)
- {
- return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0;
- }
-@@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
- {
- struct dentry *realdentry = ovl_dentry_real(dentry);
- ssize_t res;
-- int off;
-+ size_t len;
-+ char *s;
-
- res = vfs_listxattr(realdentry, list, size);
- if (res <= 0 || size == 0)
- return res;
-
- /* filter out private xattrs */
-- for (off = 0; off < res;) {
-- char *s = list + off;
-- size_t slen = strlen(s) + 1;
-+ for (s = list, len = res; len;) {
-+ size_t slen = strnlen(s, len) + 1;
-
-- BUG_ON(off + slen > res);
-+ /* underlying fs providing us with an broken xattr list? */
-+ if (WARN_ON(slen > len))
-+ return -EIO;
-
-+ len -= slen;
- if (ovl_is_private_xattr(s)) {
- res -= slen;
-- memmove(s, s + slen, res - off);
-+ memmove(s, s + slen, len);
- } else {
-- off += slen;
-+ s += slen;
- }
- }
-
-diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
-index cfbca53..d8ddc31 100644
---- a/fs/overlayfs/overlayfs.h
-+++ b/fs/overlayfs/overlayfs.h
-@@ -168,6 +168,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
- void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
- void ovl_cache_free(struct list_head *list);
- int ovl_check_d_type_supported(struct path *realpath);
-+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
-+ struct dentry *dentry, int level);
-
- /* inode.c */
- int ovl_setattr(struct dentry *dentry, struct iattr *attr);
-@@ -180,6 +182,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
- ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
- int ovl_removexattr(struct dentry *dentry, const char *name);
- struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
-+bool ovl_is_private_xattr(const char *name);
-
- struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
- struct ovl_entry *oe);
-diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
-index cf37fc7..f241b4e 100644
---- a/fs/overlayfs/readdir.c
-+++ b/fs/overlayfs/readdir.c
-@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
- err = rdd->err;
- } while (!err && rdd->count);
-
-- if (!err && rdd->first_maybe_whiteout)
-+ if (!err && rdd->first_maybe_whiteout && rdd->dentry)
- err = ovl_check_whiteouts(realpath->dentry, rdd);
-
- fput(realfile);
-@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
-
- return rdd.d_type_supported;
- }
-+
-+static void ovl_workdir_cleanup_recurse(struct path *path, int level)
-+{
-+ int err;
-+ struct inode *dir = path->dentry->d_inode;
-+ LIST_HEAD(list);
-+ struct ovl_cache_entry *p;
-+ struct ovl_readdir_data rdd = {
-+ .ctx.actor = ovl_fill_merge,
-+ .dentry = NULL,
-+ .list = &list,
-+ .root = RB_ROOT,
-+ .is_lowest = false,
-+ };
-+
-+ err = ovl_dir_read(path, &rdd);
-+ if (err)
-+ goto out;
-+
-+ inode_lock_nested(dir, I_MUTEX_PARENT);
-+ list_for_each_entry(p, &list, l_node) {
-+ struct dentry *dentry;
-+
-+ if (p->name[0] == '.') {
-+ if (p->len == 1)
-+ continue;
-+ if (p->len == 2 && p->name[1] == '.')
-+ continue;
-+ }
-+ dentry = lookup_one_len(p->name, path->dentry, p->len);
-+ if (IS_ERR(dentry))
-+ continue;
-+ if (dentry->d_inode)
-+ ovl_workdir_cleanup(dir, path->mnt, dentry, level);
-+ dput(dentry);
-+ }
-+ inode_unlock(dir);
-+out:
-+ ovl_cache_free(&list);
-+}
-+
-+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
-+ struct dentry *dentry, int level)
-+{
-+ int err;
-+
-+ if (!d_is_dir(dentry) || level > 1) {
-+ ovl_cleanup(dir, dentry);
-+ return;
-+ }
-+
-+ err = ovl_do_rmdir(dir, dentry);
-+ if (err) {
-+ struct path path = { .mnt = mnt, .dentry = dentry };
-+
-+ inode_unlock(dir);
-+ ovl_workdir_cleanup_recurse(&path, level + 1);
-+ inode_lock_nested(dir, I_MUTEX_PARENT);
-+ ovl_cleanup(dir, dentry);
-+ }
-+}
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 6db75cb..86f2025 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -798,6 +798,10 @@ retry:
- struct kstat stat = {
- .mode = S_IFDIR | 0,
- };
-+ struct iattr attr = {
-+ .ia_valid = ATTR_MODE,
-+ .ia_mode = stat.mode,
-+ };
-
- if (work->d_inode) {
- err = -EEXIST;
-@@ -805,7 +809,7 @@ retry:
- goto out_dput;
-
- retried = true;
-- ovl_cleanup(dir, work);
-+ ovl_workdir_cleanup(dir, mnt, work, 0);
- dput(work);
- goto retry;
- }
-@@ -813,6 +817,21 @@ retry:
- err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
- if (err)
- goto out_dput;
-+
-+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
-+ if (err && err != -ENODATA && err != -EOPNOTSUPP)
-+ goto out_dput;
-+
-+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
-+ if (err && err != -ENODATA && err != -EOPNOTSUPP)
-+ goto out_dput;
-+
-+ /* Clear any inherited mode bits */
-+ inode_lock(work->d_inode);
-+ err = notify_change(work, &attr, NULL);
-+ inode_unlock(work->d_inode);
-+ if (err)
-+ goto out_dput;
- }
- out_unlock:
- inode_unlock(dir);
-diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
-index b45345d..51157da 100644
---- a/fs/ubifs/tnc_commit.c
-+++ b/fs/ubifs/tnc_commit.c
-@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
-
- p = c->gap_lebs;
- do {
-- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
-+ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
- written = layout_leb_in_gaps(c, p);
- if (written < 0) {
- err = written;
-diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
-index b5fc279..c63710f 100644
---- a/fs/ubifs/xattr.c
-+++ b/fs/ubifs/xattr.c
-@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler,
- dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name,
- inode->i_ino, dentry, size);
-
-- return __ubifs_getxattr(inode, name, buffer, size);
-+ name = xattr_full_name(handler, name);
-+ return __ubifs_getxattr(inode, name, buffer, size);
- }
-
- static int ubifs_xattr_set(const struct xattr_handler *handler,
-@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler,
- dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd",
- name, inode->i_ino, dentry, size);
-
-+ name = xattr_full_name(handler, name);
-+
- if (value)
- return __ubifs_setxattr(inode, name, value, size, flags);
- else
-diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
-index 12ca867..85bdf3d 100644
---- a/fs/xfs/libxfs/xfs_sb.c
-+++ b/fs/xfs/libxfs/xfs_sb.c
-@@ -581,7 +581,8 @@ xfs_sb_verify(
- * Only check the in progress field for the primary superblock as
- * mkfs.xfs doesn't clear it from secondary superblocks.
- */
-- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
-+ return xfs_mount_validate_sb(mp, &sb,
-+ bp->b_maps[0].bm_bn == XFS_SB_DADDR,
- check_version);
- }
-
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 00690ff..5f3c63d 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t,
- struct user_namespace *ns, int cap);
- extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
-+extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
- #else
- static inline bool has_capability(struct task_struct *t, int cap)
- {
-@@ -233,6 +234,10 @@ static inline bool ns_capable(struct user_namespace *ns, int cap)
- {
- return true;
- }
-+static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
-+{
-+ return true;
-+}
- #endif /* CONFIG_MULTIUSER */
- extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
- extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 45432b5..00411c8 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
- return has_ns_capability_noaudit(t, &init_user_ns, cap);
- }
-
-+static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
-+{
-+ int capable;
-+
-+ if (unlikely(!cap_valid(cap))) {
-+ pr_crit("capable() called with invalid cap=%u\n", cap);
-+ BUG();
-+ }
-+
-+ capable = audit ? security_capable(current_cred(), ns, cap) :
-+ security_capable_noaudit(current_cred(), ns, cap);
-+ if (capable == 0) {
-+ current->flags |= PF_SUPERPRIV;
-+ return true;
-+ }
-+ return false;
-+}
-+
- /**
- * ns_capable - Determine if the current task has a superior capability in effect
- * @ns: The usernamespace we want the capability in
-@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
- */
- bool ns_capable(struct user_namespace *ns, int cap)
- {
-- if (unlikely(!cap_valid(cap))) {
-- pr_crit("capable() called with invalid cap=%u\n", cap);
-- BUG();
-- }
--
-- if (security_capable(current_cred(), ns, cap) == 0) {
-- current->flags |= PF_SUPERPRIV;
-- return true;
-- }
-- return false;
-+ return ns_capable_common(ns, cap, true);
- }
- EXPORT_SYMBOL(ns_capable);
-
-+/**
-+ * ns_capable_noaudit - Determine if the current task has a superior capability
-+ * (unaudited) in effect
-+ * @ns: The usernamespace we want the capability in
-+ * @cap: The capability to be tested for
-+ *
-+ * Return true if the current task has the given superior capability currently
-+ * available for use, false if not.
-+ *
-+ * This sets PF_SUPERPRIV on the task if the capability is available on the
-+ * assumption that it's about to be used.
-+ */
-+bool ns_capable_noaudit(struct user_namespace *ns, int cap)
-+{
-+ return ns_capable_common(ns, cap, false);
-+}
-+EXPORT_SYMBOL(ns_capable_noaudit);
-
- /**
- * capable - Determine if the current task has a superior capability in effect
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 0c0cd8a..5f264fb 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from_ctx);
- */
- int set_create_files_as(struct cred *new, struct inode *inode)
- {
-+ if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
-+ return -EINVAL;
- new->fsuid = inode->i_uid;
- new->fsgid = inode->i_gid;
- return security_kernel_create_files_as(new, inode);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 4a7ec0c..aea4f4d 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -1406,7 +1406,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- p->real_start_time = ktime_get_boot_ns();
- p->io_context = NULL;
- p->audit_context = NULL;
-- threadgroup_change_begin(current);
- cgroup_fork(p);
- #ifdef CONFIG_NUMA
- p->mempolicy = mpol_dup(p->mempolicy);
-@@ -1558,6 +1557,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- INIT_LIST_HEAD(&p->thread_group);
- p->task_works = NULL;
-
-+ threadgroup_change_begin(current);
- /*
- * Ensure that the cgroup subsystem policies allow the new process to be
- * forked. It should be noted the the new process's css_set can be changed
-@@ -1658,6 +1658,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- bad_fork_cancel_cgroup:
- cgroup_cancel_fork(p);
- bad_fork_free_pid:
-+ threadgroup_change_end(current);
- if (pid != &init_struct_pid)
- free_pid(pid);
- bad_fork_cleanup_thread:
-@@ -1690,7 +1691,6 @@ bad_fork_cleanup_policy:
- mpol_put(p->mempolicy);
- bad_fork_cleanup_threadgroup_lock:
- #endif
-- threadgroup_change_end(current);
- delayacct_tsk_free(p);
- bad_fork_cleanup_count:
- atomic_dec(&p->cred->user->processes);
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 479d25c..b6c3945 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
- do {
- seq = raw_read_seqcount_latch(&tkf->seq);
- tkr = tkf->base + (seq & 0x01);
-- now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr);
-+ now = ktime_to_ns(tkr->base);
-+
-+ now += clocksource_delta(tkr->read(tkr->clock),
-+ tkr->cycle_last, tkr->mask);
- } while (read_seqcount_retry(&tkf->seq, seq));
-
- return now;
-diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
-index f6bd652..107310a 100644
---- a/kernel/time/timekeeping_debug.c
-+++ b/kernel/time/timekeeping_debug.c
-@@ -23,7 +23,9 @@
-
- #include "timekeeping_internal.h"
-
--static unsigned int sleep_time_bin[32] = {0};
-+#define NUM_BINS 32
-+
-+static unsigned int sleep_time_bin[NUM_BINS] = {0};
-
- static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
- {
-@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
-
- void tk_debug_account_sleep_time(struct timespec64 *t)
- {
-- sleep_time_bin[fls(t->tv_sec)]++;
-+ /* Cap bin index so we don't overflow the array */
-+ int bin = min(fls(t->tv_sec), NUM_BINS-1);
-+
-+ sleep_time_bin[bin]++;
- }
-
-diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
-index c094754..f02ab80 100644
---- a/net/sunrpc/xprtrdma/frwr_ops.c
-+++ b/net/sunrpc/xprtrdma/frwr_ops.c
-@@ -125,17 +125,16 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r)
- }
-
- static void
--__frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
-+__frwr_reset_and_unmap(struct rpcrdma_mw *mw)
- {
-+ struct rpcrdma_xprt *r_xprt = mw->mw_xprt;
- struct rpcrdma_ia *ia = &r_xprt->rx_ia;
-- struct rpcrdma_frmr *f = &mw->frmr;
- int rc;
-
- rc = __frwr_reset_mr(ia, mw);
-- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir);
-+ ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir);
- if (rc)
- return;
--
- rpcrdma_put_mw(r_xprt, mw);
- }
-
-@@ -152,8 +151,7 @@ __frwr_recovery_worker(struct work_struct *work)
- struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw,
- mw_work);
-
-- __frwr_reset_and_unmap(r->mw_xprt, r);
-- return;
-+ __frwr_reset_and_unmap(r);
- }
-
- /* A broken MR was discovered in a context that can't sleep.
-@@ -167,8 +165,7 @@ __frwr_queue_recovery(struct rpcrdma_mw *r)
- }
-
- static int
--__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
-- unsigned int depth)
-+__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, unsigned int depth)
- {
- struct rpcrdma_frmr *f = &r->frmr;
- int rc;
-@@ -177,11 +174,11 @@ __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
- if (IS_ERR(f->fr_mr))
- goto out_mr_err;
-
-- f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL);
-- if (!f->fr_sg)
-+ r->mw_sg = kcalloc(depth, sizeof(*r->mw_sg), GFP_KERNEL);
-+ if (!r->mw_sg)
- goto out_list_err;
-
-- sg_init_table(f->fr_sg, depth);
-+ sg_init_table(r->mw_sg, depth);
-
- init_completion(&f->fr_linv_done);
-
-@@ -210,7 +207,7 @@ __frwr_release(struct rpcrdma_mw *r)
- if (rc)
- dprintk("RPC: %s: ib_dereg_mr status %i\n",
- __func__, rc);
-- kfree(r->frmr.fr_sg);
-+ kfree(r->mw_sg);
- }
-
- static int
-@@ -350,7 +347,6 @@ static int
- frwr_op_init(struct rpcrdma_xprt *r_xprt)
- {
- struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
-- struct ib_device *device = r_xprt->rx_ia.ri_device;
- unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth;
- struct ib_pd *pd = r_xprt->rx_ia.ri_pd;
- int i;
-@@ -372,7 +368,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
- if (!r)
- return -ENOMEM;
-
-- rc = __frwr_init(r, pd, device, depth);
-+ rc = __frwr_init(r, pd, depth);
- if (rc) {
- kfree(r);
- return rc;
-@@ -386,7 +382,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
- return 0;
- }
-
--/* Post a FAST_REG Work Request to register a memory region
-+/* Post a REG_MR Work Request to register a memory region
- * for remote access via RDMA READ or RDMA WRITE.
- */
- static int
-@@ -394,8 +390,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- int nsegs, bool writing)
- {
- struct rpcrdma_ia *ia = &r_xprt->rx_ia;
-- struct ib_device *device = ia->ri_device;
-- enum dma_data_direction direction = rpcrdma_data_dir(writing);
- struct rpcrdma_mr_seg *seg1 = seg;
- struct rpcrdma_mw *mw;
- struct rpcrdma_frmr *frmr;
-@@ -421,15 +415,14 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
-
- if (nsegs > ia->ri_max_frmr_depth)
- nsegs = ia->ri_max_frmr_depth;
--
- for (i = 0; i < nsegs;) {
- if (seg->mr_page)
-- sg_set_page(&frmr->fr_sg[i],
-+ sg_set_page(&mw->mw_sg[i],
- seg->mr_page,
- seg->mr_len,
- offset_in_page(seg->mr_offset));
- else
-- sg_set_buf(&frmr->fr_sg[i], seg->mr_offset,
-+ sg_set_buf(&mw->mw_sg[i], seg->mr_offset,
- seg->mr_len);
-
- ++seg;
-@@ -440,26 +433,20 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len))
- break;
- }
-- frmr->fr_nents = i;
-- frmr->fr_dir = direction;
--
-- dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction);
-- if (!dma_nents) {
-- pr_err("RPC: %s: failed to dma map sg %p sg_nents %u\n",
-- __func__, frmr->fr_sg, frmr->fr_nents);
-- return -ENOMEM;
-- }
-+ mw->mw_nents = i;
-+ mw->mw_dir = rpcrdma_data_dir(writing);
-
-- n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE);
-- if (unlikely(n != frmr->fr_nents)) {
-- pr_err("RPC: %s: failed to map mr %p (%u/%u)\n",
-- __func__, frmr->fr_mr, n, frmr->fr_nents);
-- rc = n < 0 ? n : -EINVAL;
-- goto out_senderr;
-- }
-+ dma_nents = ib_dma_map_sg(ia->ri_device,
-+ mw->mw_sg, mw->mw_nents, mw->mw_dir);
-+ if (!dma_nents)
-+ goto out_dmamap_err;
-+
-+ n = ib_map_mr_sg(mr, mw->mw_sg, mw->mw_nents, NULL, PAGE_SIZE);
-+ if (unlikely(n != mw->mw_nents))
-+ goto out_mapmr_err;
-
- dprintk("RPC: %s: Using frmr %p to map %u segments (%u bytes)\n",
-- __func__, mw, frmr->fr_nents, mr->length);
-+ __func__, mw, mw->mw_nents, mr->length);
-
- key = (u8)(mr->rkey & 0x000000FF);
- ib_update_fast_reg_key(mr, ++key);
-@@ -484,13 +471,25 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- seg1->rl_mw = mw;
- seg1->mr_rkey = mr->rkey;
- seg1->mr_base = mr->iova;
-- seg1->mr_nsegs = frmr->fr_nents;
-+ seg1->mr_nsegs = mw->mw_nents;
- seg1->mr_len = mr->length;
-
-- return frmr->fr_nents;
-+ return mw->mw_nents;
-+
-+out_dmamap_err:
-+ pr_err("rpcrdma: failed to dma map sg %p sg_nents %u\n",
-+ mw->mw_sg, mw->mw_nents);
-+ return -ENOMEM;
-+
-+out_mapmr_err:
-+ pr_err("rpcrdma: failed to map mr %p (%u/%u)\n",
-+ frmr->fr_mr, n, mw->mw_nents);
-+ rc = n < 0 ? n : -EIO;
-+ __frwr_queue_recovery(mw);
-+ return rc;
-
- out_senderr:
-- dprintk("RPC: %s: ib_post_send status %i\n", __func__, rc);
-+ pr_err("rpcrdma: ib_post_send status %i\n", rc);
- __frwr_queue_recovery(mw);
- return rc;
- }
-@@ -582,8 +581,8 @@ unmap:
- mw = seg->rl_mw;
- seg->rl_mw = NULL;
-
-- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents,
-- f->fr_dir);
-+ ib_dma_unmap_sg(ia->ri_device,
-+ mw->mw_sg, mw->mw_nents, mw->mw_dir);
- rpcrdma_put_mw(r_xprt, mw);
-
- i += seg->mr_nsegs;
-@@ -630,7 +629,7 @@ frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
- mw = seg->rl_mw;
-
- if (sync)
-- __frwr_reset_and_unmap(r_xprt, mw);
-+ __frwr_reset_and_unmap(mw);
- else
- __frwr_queue_recovery(mw);
-
-diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
-index 95cdc66..c53abd1 100644
---- a/net/sunrpc/xprtrdma/xprt_rdma.h
-+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
-@@ -221,9 +221,6 @@ enum rpcrdma_frmr_state {
- };
-
- struct rpcrdma_frmr {
-- struct scatterlist *fr_sg;
-- int fr_nents;
-- enum dma_data_direction fr_dir;
- struct ib_mr *fr_mr;
- struct ib_cqe fr_cqe;
- enum rpcrdma_frmr_state fr_state;
-@@ -240,13 +237,16 @@ struct rpcrdma_fmr {
- };
-
- struct rpcrdma_mw {
-+ struct list_head mw_list;
-+ struct scatterlist *mw_sg;
-+ int mw_nents;
-+ enum dma_data_direction mw_dir;
- union {
- struct rpcrdma_fmr fmr;
- struct rpcrdma_frmr frmr;
- };
- struct work_struct mw_work;
- struct rpcrdma_xprt *mw_xprt;
-- struct list_head mw_list;
- struct list_head mw_all;
- };
-
-diff --git a/net/sysctl_net.c b/net/sysctl_net.c
-index ed98c1f..46a71c7 100644
---- a/net/sysctl_net.c
-+++ b/net/sysctl_net.c
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
- kgid_t root_gid = make_kgid(net->user_ns, 0);
-
- /* Allow network administrator to have same access as root. */
-- if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-+ if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) ||
- uid_eq(root_uid, current_euid())) {
- int mode = (table->mode >> 6) & 7;
- return (mode << 6) | (mode << 3) | mode;
-diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
-index 705c287..7347fcc 100644
---- a/security/apparmor/policy.c
-+++ b/security/apparmor/policy.c
-@@ -766,7 +766,9 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
- struct aa_profile *profile;
-
- rcu_read_lock();
-- profile = aa_get_profile(__find_child(&parent->base.profiles, name));
-+ do {
-+ profile = __find_child(&parent->base.profiles, name);
-+ } while (profile && !aa_get_profile_not0(profile));
- rcu_read_unlock();
-
- /* refcount released by caller */
-diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
-index 795437b..b450a27 100644
---- a/sound/core/rawmidi.c
-+++ b/sound/core/rawmidi.c
-@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- return -EBUSY;
- }
- list_add_tail(&rmidi->list, &snd_rawmidi_devices);
-+ mutex_unlock(®ister_mutex);
- err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
- rmidi->card, rmidi->device,
- &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
- if (err < 0) {
- rmidi_err(rmidi, "unable to register\n");
-+ mutex_lock(®ister_mutex);
- list_del(&rmidi->list);
- mutex_unlock(®ister_mutex);
- return err;
-@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- if (rmidi->ops && rmidi->ops->dev_register &&
- (err = rmidi->ops->dev_register(rmidi)) < 0) {
- snd_unregister_device(&rmidi->dev);
-+ mutex_lock(®ister_mutex);
- list_del(&rmidi->list);
- mutex_unlock(®ister_mutex);
- return err;
-@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- }
- }
- #endif /* CONFIG_SND_OSSEMUL */
-- mutex_unlock(®ister_mutex);
- sprintf(name, "midi%d", rmidi->device);
- entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
- if (entry) {
-diff --git a/sound/core/timer.c b/sound/core/timer.c
-index 9a6157e..fc144f4 100644
---- a/sound/core/timer.c
-+++ b/sound/core/timer.c
-@@ -35,6 +35,9 @@
- #include <sound/initval.h>
- #include <linux/kmod.h>
-
-+/* internal flags */
-+#define SNDRV_TIMER_IFLG_PAUSED 0x00010000
-+
- #if IS_ENABLED(CONFIG_SND_HRTIMER)
- #define DEFAULT_TIMER_LIMIT 4
- #else
-@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
- get_device(&timer->card->card_dev);
- timeri->slave_class = tid->dev_sclass;
- timeri->slave_id = slave_id;
-- if (list_empty(&timer->open_list_head) && timer->hw.open)
-- timer->hw.open(timer);
-+
-+ if (list_empty(&timer->open_list_head) && timer->hw.open) {
-+ int err = timer->hw.open(timer);
-+ if (err) {
-+ kfree(timeri->owner);
-+ kfree(timeri);
-+
-+ if (timer->card)
-+ put_device(&timer->card->card_dev);
-+ module_put(timer->module);
-+ mutex_unlock(®ister_mutex);
-+ return err;
-+ }
-+ }
-+
- list_add_tail(&timeri->open_list, &timer->open_list_head);
- snd_timer_check_master(timeri);
- mutex_unlock(®ister_mutex);
-@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
- }
- }
- timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
-+ if (stop)
-+ timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
-+ else
-+ timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
- SNDRV_TIMER_EVENT_CONTINUE);
- unlock:
-@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
- */
- int snd_timer_continue(struct snd_timer_instance *timeri)
- {
-+ /* timer can continue only after pause */
-+ if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
-+ return -EINVAL;
-+
- if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
- return snd_timer_start_slave(timeri, false);
- else
-@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
- timer->tmr_subdevice = tid->subdevice;
- if (id)
- strlcpy(timer->id, id, sizeof(timer->id));
-+ timer->sticks = 1;
- INIT_LIST_HEAD(&timer->device_list);
- INIT_LIST_HEAD(&timer->open_list_head);
- INIT_LIST_HEAD(&timer->active_list_head);
-@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
- tu = file->private_data;
- if (!tu->timeri)
- return -EBADFD;
-+ /* start timer instead of continue if it's not used before */
-+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
-+ return snd_timer_user_start(file);
- tu->timeri->lost = 0;
- return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
- }
-@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
- tu->qused--;
- spin_unlock_irq(&tu->qlock);
-
-+ mutex_lock(&tu->ioctl_lock);
- if (tu->tread) {
- if (copy_to_user(buffer, &tu->tqueue[qhead],
- sizeof(struct snd_timer_tread)))
-@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
- sizeof(struct snd_timer_read)))
- err = -EFAULT;
- }
-+ mutex_unlock(&tu->ioctl_lock);
-
- spin_lock_irq(&tu->qlock);
- if (err < 0)
-diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
-index 03ed352..d73c12b 100644
---- a/sound/firewire/fireworks/fireworks.h
-+++ b/sound/firewire/fireworks/fireworks.h
-@@ -108,7 +108,6 @@ struct snd_efw {
- u8 *resp_buf;
- u8 *pull_ptr;
- u8 *push_ptr;
-- unsigned int resp_queues;
- };
-
- int snd_efw_transaction_cmd(struct fw_unit *unit,
-diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
-index 33df865..2e1d9a2 100644
---- a/sound/firewire/fireworks/fireworks_hwdep.c
-+++ b/sound/firewire/fireworks/fireworks_hwdep.c
-@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- {
- unsigned int length, till_end, type;
- struct snd_efw_transaction *t;
-+ u8 *pull_ptr;
- long count = 0;
-
- if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
-@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- buf += sizeof(type);
-
- /* write into buffer as many responses as possible */
-- while (efw->resp_queues > 0) {
-- t = (struct snd_efw_transaction *)(efw->pull_ptr);
-+ spin_lock_irq(&efw->lock);
-+
-+ /*
-+ * When another task reaches here during this task's access to user
-+ * space, it picks up current position in buffer and can read the same
-+ * series of responses.
-+ */
-+ pull_ptr = efw->pull_ptr;
-+
-+ while (efw->push_ptr != pull_ptr) {
-+ t = (struct snd_efw_transaction *)(pull_ptr);
- length = be32_to_cpu(t->length) * sizeof(__be32);
-
- /* confirm enough space for this response */
-@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- /* copy from ring buffer to user buffer */
- while (length > 0) {
- till_end = snd_efw_resp_buf_size -
-- (unsigned int)(efw->pull_ptr - efw->resp_buf);
-+ (unsigned int)(pull_ptr - efw->resp_buf);
- till_end = min_t(unsigned int, length, till_end);
-
-- if (copy_to_user(buf, efw->pull_ptr, till_end))
-+ spin_unlock_irq(&efw->lock);
-+
-+ if (copy_to_user(buf, pull_ptr, till_end))
- return -EFAULT;
-
-- efw->pull_ptr += till_end;
-- if (efw->pull_ptr >= efw->resp_buf +
-- snd_efw_resp_buf_size)
-- efw->pull_ptr -= snd_efw_resp_buf_size;
-+ spin_lock_irq(&efw->lock);
-+
-+ pull_ptr += till_end;
-+ if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
-+ pull_ptr -= snd_efw_resp_buf_size;
-
- length -= till_end;
- buf += till_end;
- count += till_end;
- remained -= till_end;
- }
--
-- efw->resp_queues--;
- }
-
-+ /*
-+ * All of tasks can read from the buffer nearly simultaneously, but the
-+ * last position for each task is different depending on the length of
-+ * given buffer. Here, for simplicity, a position of buffer is set by
-+ * the latest task. It's better for a listening application to allow one
-+ * thread to read from the buffer. Unless, each task can read different
-+ * sequence of responses depending on variation of buffer length.
-+ */
-+ efw->pull_ptr = pull_ptr;
-+
-+ spin_unlock_irq(&efw->lock);
-+
- return count;
- }
-
-@@ -76,14 +99,17 @@ static long
- hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
- loff_t *offset)
- {
-- union snd_firewire_event event;
-+ union snd_firewire_event event = {
-+ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
-+ };
-
-- memset(&event, 0, sizeof(event));
-+ spin_lock_irq(&efw->lock);
-
-- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
- event.lock_status.status = (efw->dev_lock_count > 0);
- efw->dev_lock_changed = false;
-
-+ spin_unlock_irq(&efw->lock);
-+
- count = min_t(long, count, sizeof(event.lock_status));
-
- if (copy_to_user(buf, &event, count))
-@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- {
- struct snd_efw *efw = hwdep->private_data;
- DEFINE_WAIT(wait);
-+ bool dev_lock_changed;
-+ bool queued;
-
- spin_lock_irq(&efw->lock);
-
-- while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
-+ dev_lock_changed = efw->dev_lock_changed;
-+ queued = efw->push_ptr != efw->pull_ptr;
-+
-+ while (!dev_lock_changed && !queued) {
- prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
- spin_unlock_irq(&efw->lock);
- schedule();
-@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- if (signal_pending(current))
- return -ERESTARTSYS;
- spin_lock_irq(&efw->lock);
-+ dev_lock_changed = efw->dev_lock_changed;
-+ queued = efw->push_ptr != efw->pull_ptr;
- }
-
-- if (efw->dev_lock_changed)
-+ spin_unlock_irq(&efw->lock);
-+
-+ if (dev_lock_changed)
- count = hwdep_read_locked(efw, buf, count, offset);
-- else if (efw->resp_queues > 0)
-+ else if (queued)
- count = hwdep_read_resp_buf(efw, buf, count, offset);
-
-- spin_unlock_irq(&efw->lock);
--
- return count;
- }
-
-@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
- poll_wait(file, &efw->hwdep_wait, wait);
-
- spin_lock_irq(&efw->lock);
-- if (efw->dev_lock_changed || (efw->resp_queues > 0))
-+ if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
- events = POLLIN | POLLRDNORM;
- else
- events = 0;
-diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
-index 0639dcb..beb0a0f 100644
---- a/sound/firewire/fireworks/fireworks_proc.c
-+++ b/sound/firewire/fireworks/fireworks_proc.c
-@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
- else
- consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
-
-- snd_iprintf(buffer, "%d %d/%d\n",
-- efw->resp_queues, consumed, snd_efw_resp_buf_size);
-+ snd_iprintf(buffer, "%d/%d\n",
-+ consumed, snd_efw_resp_buf_size);
- }
-
- static void
-diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
-index f550808..36a08ba 100644
---- a/sound/firewire/fireworks/fireworks_transaction.c
-+++ b/sound/firewire/fireworks/fireworks_transaction.c
-@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
- size_t capacity, till_end;
- struct snd_efw_transaction *t;
-
-- spin_lock_irq(&efw->lock);
--
- t = (struct snd_efw_transaction *)data;
- length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
-
-+ spin_lock_irq(&efw->lock);
-+
- if (efw->push_ptr < efw->pull_ptr)
- capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
- else
-@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
- }
-
- /* for hwdep */
-- efw->resp_queues++;
- wake_up(&efw->hwdep_wait);
-
- *rcode = RCODE_COMPLETE;
-diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
-index 131267c..106406c 100644
---- a/sound/firewire/tascam/tascam-hwdep.c
-+++ b/sound/firewire/tascam/tascam-hwdep.c
-@@ -16,31 +16,14 @@
-
- #include "tascam.h"
-
--static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
-- long count)
--{
-- union snd_firewire_event event;
--
-- memset(&event, 0, sizeof(event));
--
-- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
-- event.lock_status.status = (tscm->dev_lock_count > 0);
-- tscm->dev_lock_changed = false;
--
-- count = min_t(long, count, sizeof(event.lock_status));
--
-- if (copy_to_user(buf, &event, count))
-- return -EFAULT;
--
-- return count;
--}
--
- static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- loff_t *offset)
- {
- struct snd_tscm *tscm = hwdep->private_data;
- DEFINE_WAIT(wait);
-- union snd_firewire_event event;
-+ union snd_firewire_event event = {
-+ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
-+ };
-
- spin_lock_irq(&tscm->lock);
-
-@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- spin_lock_irq(&tscm->lock);
- }
-
-- memset(&event, 0, sizeof(event));
-- count = hwdep_read_locked(tscm, buf, count);
-+ event.lock_status.status = (tscm->dev_lock_count > 0);
-+ tscm->dev_lock_changed = false;
-+
- spin_unlock_irq(&tscm->lock);
-
-+ count = min_t(long, count, sizeof(event.lock_status));
-+
-+ if (copy_to_user(buf, &event, count))
-+ return -EFAULT;
-+
- return count;
- }
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index f25479b..eaee626 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4840,6 +4840,7 @@ enum {
- ALC221_FIXUP_HP_FRONT_MIC,
- ALC292_FIXUP_TPT460,
- ALC298_FIXUP_SPK_VOLUME,
-+ ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
- };
-
- static const struct hda_fixup alc269_fixups[] = {
-@@ -5501,6 +5502,15 @@ static const struct hda_fixup alc269_fixups[] = {
- .chained = true,
- .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
- },
-+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x1b, 0x90170151 },
-+ { }
-+ },
-+ .chained = true,
-+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
-+ },
- };
-
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-@@ -5545,6 +5555,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
- SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
-+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
- SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
- SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
-@@ -5879,6 +5890,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- {0x12, 0x90a60170},
- {0x14, 0x90170120},
- {0x21, 0x02211030}),
-+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ {0x12, 0x90a60180},
-+ {0x14, 0x90170120},
-+ {0x21, 0x02211030}),
- SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- ALC256_STANDARD_PINS),
- SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
-diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
-index 1267e1a..633d54ca 100644
---- a/sound/soc/atmel/atmel_ssc_dai.c
-+++ b/sound/soc/atmel/atmel_ssc_dai.c
-@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
- clk_enable(ssc_p->ssc->clk);
- ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
-
-- /* Reset the SSC to keep it at a clean status */
-- ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
-+ /* Reset the SSC unless initialized to keep it in a clean state */
-+ if (!ssc_p->initialized)
-+ ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
-
- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
- dir = 0;
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 6cf1f35..152292e 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
- case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
- case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
-+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
- case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
- case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
- case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
diff --git a/4.7.4/0000_README b/4.7.5/0000_README
similarity index 81%
rename from 4.7.4/0000_README
rename to 4.7.5/0000_README
index a9515bb..9104194 100644
--- a/4.7.4/0000_README
+++ b/4.7.5/0000_README
@@ -2,23 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1000_linux-4.7.1.patch
-From: http://www.kernel.org
-Desc: Linux 4.7.1
-
-Patch: 1001_linux-4.7.2.patch
-From: http://www.kernel.org
-Desc: Linux 4.7.2
-
-Patch: 1002_linux-4.7.3.patch
-From: http://www.kernel.org
-Desc: Linux 4.7.3
-
-Patch: 1003_linux-4.7.4.patch
-From: http://www.kernel.org
-Desc: Linux 4.7.4
-
-Patch: 4420_grsecurity-3.1-4.7.4-201609211951.patch
+Patch: 4420_grsecurity-3.1-4.7.5-201609261522.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
similarity index 99%
rename from 4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch
rename to 4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
index 5bddf8c..9169f89 100644
--- a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch
+++ b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
@@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index ec3bd11..35d4d88 100644
+index dd755d19..b480d63 100644
--- a/Makefile
+++ b/Makefile
@@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3219,7 +3219,7 @@ index e2c6da0..6155a88 100644
. = ALIGN(1<<SECTION_SHIFT);
#else
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index f1bde7c..6dc92ba 100644
+index 4e1b22a..10ef049 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -58,7 +58,7 @@ static unsigned long hyp_default_vectors;
@@ -3231,7 +3231,7 @@ index f1bde7c..6dc92ba 100644
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
static DEFINE_SPINLOCK(kvm_vmid_lock);
-@@ -389,7 +389,7 @@ void force_vm_exit(const cpumask_t *mask)
+@@ -387,7 +387,7 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
@@ -3240,7 +3240,7 @@ index f1bde7c..6dc92ba 100644
}
/**
-@@ -422,7 +422,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -420,7 +420,7 @@ static void update_vttbr(struct kvm *kvm)
/* First user of a new VMID generation? */
if (unlikely(kvm_next_vmid == 0)) {
@@ -3249,7 +3249,7 @@ index f1bde7c..6dc92ba 100644
kvm_next_vmid = 1;
/*
-@@ -439,7 +439,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -437,7 +437,7 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
@@ -5435,7 +5435,7 @@ index 45698cd..e8e2dbc 100644
static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 2189d5d..420134b 100644
+index ebcd8a1..dfa2f7a 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
@@ -70,6 +70,7 @@
@@ -5471,7 +5471,7 @@ index 2189d5d..420134b 100644
return __copy_user((__force void __user *) to, from, count);
}
-@@ -256,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -256,19 +269,22 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void __user *__cu_to = (to); \
const void *__cu_from = (from); \
@@ -5480,30 +5480,42 @@ index 2189d5d..420134b 100644
\
- if (__access_ok(__cu_to, __cu_len, get_fs())) \
+ if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_from, __cu_len, true); \
++ check_object_size(__cu_from, __cu_len, true); \
__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
+ } \
__cu_len; \
})
-@@ -267,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({ \
- void *__cu_to = (to); \
- const void __user *__cu_from = (from); \
-- long __cu_len = (n); \
-+ unsigned long __cu_len = (n); \
- \
- __chk_user_ptr(__cu_from); \
-- if (__access_ok(__cu_from, __cu_len, get_fs())) \
-+ if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \
-+ if (!__builtin_constant_p(n)) \
-+ check_object_size(__cu_to, __cu_len, false); \
- __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
-+ } \
- __cu_len; \
+ static inline unsigned long
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+- if (likely(__access_ok(from, n, get_fs())))
+- n = __copy_user((__force void __user *) to, from, n);
+- else
++ if (likely(__access_ok(from, n, get_fs()))) {
++ check_object_size(to, n, false);
++ n = __copy_user((void __force_user *) to, from, n);
++ } else if ((long)n > 0)
+ memset(to, 0, n);
+ return n;
+ }
+@@ -339,11 +355,13 @@ extern unsigned long __strnlen_user (const char __user *, long);
+ __su_ret; \
})
+-#define ARCH_HAS_RELATIVE_EXTABLE
++/* Generic code can't deal with the location-relative format that we use for compactness. */
++#define ARCH_HAS_SORT_EXTABLE
++#define ARCH_HAS_SEARCH_EXTABLE
+
+ struct exception_table_entry {
+- int insn; /* location-relative address of insn this fixup is for */
+- int fixup; /* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */
++ int addr; /* location-relative address of insn this fixup is for */
++ int cont; /* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */
+ };
+
+ extern void ia64_handle_exception (struct pt_regs *regs, const struct exception_table_entry *e);
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 6ab0ae7..88f1b60 100644
--- a/arch/ia64/kernel/module.c
@@ -6711,10 +6723,10 @@ index e309d8f..20eefec 100644
/*
* We stash processor id into a COP0 register to retrieve it fast
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
-index 7f109d4..40b1195 100644
+index b6e20f3..afabc54 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
-@@ -146,6 +146,7 @@ static inline bool eva_kernel_access(void)
+@@ -147,6 +147,7 @@ static inline bool eva_kernel_access(void)
__ok == 0; \
})
@@ -7469,22 +7481,217 @@ index 291cee2..2ac33db 100644
#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
#define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 0f59fd9..c502784 100644
+index 37a1bee..a3916f9 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
-@@ -220,10 +220,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
+@@ -41,29 +41,34 @@ static inline long access_ok(int type, const void __user * addr,
+ #define get_user __get_user
+
+ #if !defined(CONFIG_64BIT)
+-#define LDD_USER(ptr) __get_user_asm64(ptr)
++#define LDD_KERNEL(ptr) BUILD_BUG()
++#define LDD_USER(ptr) BUILD_BUG()
++#define STD_KERNEL(x, ptr) __put_kernel_asm64(x, ptr)
+ #define STD_USER(x, ptr) __put_user_asm64(x, ptr)
++#define ASM_WORD_INSN ".word\t"
+ #else
++#define LDD_KERNEL(ptr) __get_kernel_asm("ldd", ptr)
+ #define LDD_USER(ptr) __get_user_asm("ldd", ptr)
++#define STD_KERNEL(x, ptr) __put_kernel_asm("std", x, ptr)
+ #define STD_USER(x, ptr) __put_user_asm("std", x, ptr)
++#define ASM_WORD_INSN ".dword\t"
+ #endif
+
+ /*
+- * The exception table contains two values: the first is the relative offset to
+- * the address of the instruction that is allowed to fault, and the second is
+- * the relative offset to the address of the fixup routine. Since relative
+- * addresses are used, 32bit values are sufficient even on 64bit kernel.
++ * The exception table contains two values: the first is an address
++ * for an instruction that is allowed to fault, and the second is
++ * the address to the fixup routine. Even on a 64bit kernel we could
++ * use a 32bit (unsigned int) address here.
+ */
+
+-#define ARCH_HAS_RELATIVE_EXTABLE
+ struct exception_table_entry {
+- int insn; /* relative address of insn that is allowed to fault. */
+- int fixup; /* relative address of fixup routine */
++ unsigned long insn; /* address of insn that is allowed to fault. */
++ unsigned long fixup; /* fixup routine */
+ };
+
+ #define ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr )\
+ ".section __ex_table,\"aw\"\n" \
+- ".word (" #fault_addr " - .), (" #except_addr " - .)\n\t" \
++ ASM_WORD_INSN #fault_addr ", " #except_addr "\n\t" \
+ ".previous\n"
+
+ /*
+@@ -77,70 +82,70 @@ struct exception_data {
+ unsigned long fault_addr;
+ };
+
+-/*
+- * load_sr2() preloads the space register %%sr2 - based on the value of
+- * get_fs() - with either a value of 0 to access kernel space (KERNEL_DS which
+- * is 0), or with the current value of %%sr3 to access user space (USER_DS)
+- * memory. The following __get_user_asm() and __put_user_asm() functions have
+- * %%sr2 hard-coded to access the requested memory.
+- */
+-#define load_sr2() \
+- __asm__(" or,= %0,%%r0,%%r0\n\t" \
+- " mfsp %%sr3,%0\n\t" \
+- " mtsp %0,%%sr2\n\t" \
+- : : "r"(get_fs()) : )
+-
+ #define __get_user(x, ptr) \
+ ({ \
+ register long __gu_err __asm__ ("r8") = 0; \
+ register long __gu_val __asm__ ("r9") = 0; \
+ \
+- load_sr2(); \
+- switch (sizeof(*(ptr))) { \
++ if (segment_eq(get_fs(), KERNEL_DS)) { \
++ switch (sizeof(*(ptr))) { \
++ case 1: __get_kernel_asm("ldb", ptr); break; \
++ case 2: __get_kernel_asm("ldh", ptr); break; \
++ case 4: __get_kernel_asm("ldw", ptr); break; \
++ case 8: LDD_KERNEL(ptr); break; \
++ default: BUILD_BUG(); break; \
++ } \
++ } \
++ else { \
++ switch (sizeof(*(ptr))) { \
+ case 1: __get_user_asm("ldb", ptr); break; \
+ case 2: __get_user_asm("ldh", ptr); break; \
+ case 4: __get_user_asm("ldw", ptr); break; \
+ case 8: LDD_USER(ptr); break; \
+ default: BUILD_BUG(); break; \
++ } \
+ } \
+ \
+ (x) = (__force __typeof__(*(ptr))) __gu_val; \
+ __gu_err; \
+ })
+
++#define __get_kernel_asm(ldx, ptr) \
++ __asm__("\n1:\t" ldx "\t0(%2),%0\n\t" \
++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
++ : "=r"(__gu_val), "=r"(__gu_err) \
++ : "r"(ptr), "1"(__gu_err) \
++ : "r1");
++
+ #define __get_user_asm(ldx, ptr) \
+- __asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t" \
++ __asm__("\n1:\t" ldx "\t0(%%sr3,%2),%0\n\t" \
+ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
+ : "=r"(__gu_val), "=r"(__gu_err) \
+ : "r"(ptr), "1"(__gu_err) \
+ : "r1");
+
+-#if !defined(CONFIG_64BIT)
+-
+-#define __get_user_asm64(ptr) \
+- __asm__("\n1:\tldw 0(%%sr2,%2),%0" \
+- "\n2:\tldw 4(%%sr2,%2),%R0\n\t" \
+- ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
+- ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
+- : "=r"(__gu_val), "=r"(__gu_err) \
+- : "r"(ptr), "1"(__gu_err) \
+- : "r1");
+-
+-#endif /* !defined(CONFIG_64BIT) */
+-
+-
+ #define __put_user(x, ptr) \
+ ({ \
+ register long __pu_err __asm__ ("r8") = 0; \
+ __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x); \
+ \
+- load_sr2(); \
+- switch (sizeof(*(ptr))) { \
++ if (segment_eq(get_fs(), KERNEL_DS)) { \
++ switch (sizeof(*(ptr))) { \
++ case 1: __put_kernel_asm("stb", __x, ptr); break; \
++ case 2: __put_kernel_asm("sth", __x, ptr); break; \
++ case 4: __put_kernel_asm("stw", __x, ptr); break; \
++ case 8: STD_KERNEL(__x, ptr); break; \
++ default: BUILD_BUG(); break; \
++ } \
++ } \
++ else { \
++ switch (sizeof(*(ptr))) { \
+ case 1: __put_user_asm("stb", __x, ptr); break; \
+ case 2: __put_user_asm("sth", __x, ptr); break; \
+ case 4: __put_user_asm("stw", __x, ptr); break; \
+ case 8: STD_USER(__x, ptr); break; \
+ default: BUILD_BUG(); break; \
++ } \
+ } \
+ \
+ __pu_err; \
+@@ -156,9 +161,17 @@ struct exception_data {
+ * r8/r9 are already listed as err/val.
+ */
+
++#define __put_kernel_asm(stx, x, ptr) \
++ __asm__ __volatile__ ( \
++ "\n1:\t" stx "\t%2,0(%1)\n\t" \
++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
++ : "=r"(__pu_err) \
++ : "r"(ptr), "r"(x), "0"(__pu_err) \
++ : "r1")
++
+ #define __put_user_asm(stx, x, ptr) \
+ __asm__ __volatile__ ( \
+- "\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t" \
++ "\n1:\t" stx "\t%2,0(%%sr3,%1)\n\t" \
+ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
+ : "=r"(__pu_err) \
+ : "r"(ptr), "r"(x), "0"(__pu_err) \
+@@ -167,10 +180,21 @@ struct exception_data {
+
+ #if !defined(CONFIG_64BIT)
+
++#define __put_kernel_asm64(__val, ptr) do { \
++ __asm__ __volatile__ ( \
++ "\n1:\tstw %2,0(%1)" \
++ "\n2:\tstw %R2,4(%1)\n\t" \
++ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
++ ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
++ : "=r"(__pu_err) \
++ : "r"(ptr), "r"(__val), "0"(__pu_err) \
++ : "r1"); \
++} while (0)
++
+ #define __put_user_asm64(__val, ptr) do { \
+ __asm__ __volatile__ ( \
+- "\n1:\tstw %2,0(%%sr2,%1)" \
+- "\n2:\tstw %R2,4(%%sr2,%1)\n\t" \
++ "\n1:\tstw %2,0(%%sr3,%1)" \
++ "\n2:\tstw %R2,4(%%sr3,%1)\n\t" \
+ ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
+ ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
+ : "=r"(__pu_err) \
+@@ -221,14 +245,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
const void __user *from,
unsigned long n)
{
- int sz = __compiletime_object_size(to);
+ size_t sz = __compiletime_object_size(to);
- int ret = -EFAULT;
+ unsigned long ret = n;
- if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+ if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
ret = __copy_from_user(to, from, n);
else
copy_from_user_overflow();
+- if (unlikely(ret))
++ if (unlikely(ret && (long)ret > 0))
+ memset(to + (n - ret), 0, ret);
+ return ret;
+ }
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index a0ecdb4a..71d2069 100644
--- a/arch/parisc/kernel/module.c
@@ -8884,7 +9091,7 @@ index 8febc3f..a4614f3 100644
#define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
_TIF_NOTIFY_RESUME | _TIF_UPROBE | \
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index b7c20f0..4adc0f1 100644
+index 43888c8..e231600 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -58,6 +58,7 @@
@@ -8895,7 +9102,29 @@ index b7c20f0..4adc0f1 100644
#define access_ok(type, addr, size) \
(__chk_user_ptr(addr), \
__access_ok((__force unsigned long)(addr), (size), get_fs()))
-@@ -303,52 +304,6 @@ do { \
+@@ -274,6 +275,21 @@ do { \
+ __gu_err; \
+ })
+
++#ifndef __powerpc64__
++#define __get_user64_nocheck(x, ptr, size) \
++({ \
++ long __gu_err; \
++ long long __gu_val; \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __chk_user_ptr(ptr); \
++ if (!is_kernel_addr((unsigned long)__gu_addr)) \
++ might_fault(); \
++ __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ __gu_err; \
++})
++#endif /* __powerpc64__ */
++
+ #define __get_user_check(x, ptr, size) \
+ ({ \
+ long __gu_err = -EFAULT; \
+@@ -303,39 +319,6 @@ do { \
extern unsigned long __copy_tofrom_user(void __user *to,
const void __user *from, unsigned long size);
@@ -8904,30 +9133,17 @@ index b7c20f0..4adc0f1 100644
-static inline unsigned long copy_from_user(void *to,
- const void __user *from, unsigned long n)
-{
-- unsigned long over;
--
-- if (access_ok(VERIFY_READ, from, n))
+- if (likely(access_ok(VERIFY_READ, from, n)))
- return __copy_tofrom_user((__force void __user *)to, from, n);
-- if ((unsigned long)from < TASK_SIZE) {
-- over = (unsigned long)from + n - TASK_SIZE;
-- return __copy_tofrom_user((__force void __user *)to, from,
-- n - over) + over;
-- }
+- memset(to, 0, n);
- return n;
-}
-
-static inline unsigned long copy_to_user(void __user *to,
- const void *from, unsigned long n)
-{
-- unsigned long over;
--
- if (access_ok(VERIFY_WRITE, to, n))
- return __copy_tofrom_user(to, (__force void __user *)from, n);
-- if ((unsigned long)to < TASK_SIZE) {
-- over = (unsigned long)to + n - TASK_SIZE;
-- return __copy_tofrom_user(to, (__force void __user *)from,
-- n - over) + over;
-- }
- return n;
-}
-
@@ -8948,29 +9164,27 @@ index b7c20f0..4adc0f1 100644
static inline unsigned long __copy_from_user_inatomic(void *to,
const void __user *from, unsigned long n)
{
-@@ -372,6 +327,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
+@@ -359,6 +342,9 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
if (ret == 0)
return 0;
}
+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
++ check_object_size(to, n, false);
+
return __copy_tofrom_user((__force void __user *)to, from, n);
}
-@@ -398,6 +357,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
+@@ -385,6 +371,9 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
if (ret == 0)
return 0;
}
+
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
++ check_object_size(from, n, true);
+
return __copy_tofrom_user(to, (__force const void __user *)from, n);
}
-@@ -415,6 +378,92 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -402,6 +391,70 @@ static inline unsigned long __copy_to_user(void __user *to,
return __copy_to_user_inatomic(to, from, size);
}
@@ -8979,45 +9193,26 @@ index b7c20f0..4adc0f1 100644
+static inline unsigned long __must_check copy_from_user(void *to,
+ const void __user *from, unsigned long n)
+{
-+ unsigned long over;
-+
+ if ((long)n < 0)
+ return n;
+
-+ if (access_ok(VERIFY_READ, from, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(to, n, false);
-+ return __copy_tofrom_user((__force void __user *)to, from, n);
-+ }
-+ if ((unsigned long)from < TASK_SIZE) {
-+ over = (unsigned long)from + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n - over))
-+ check_object_size(to, n - over, false);
-+ return __copy_tofrom_user((__force void __user *)to, from,
-+ n - over) + over;
++ if (likely(access_ok(VERIFY_READ, from, n))) {
++ check_object_size(to, n, false);
++ return __copy_tofrom_user((void __force_user *)to, from, n);
+ }
++ memset(to, 0, n);
+ return n;
+}
+
+static inline unsigned long __must_check copy_to_user(void __user *to,
+ const void *from, unsigned long n)
+{
-+ unsigned long over;
-+
+ if ((long)n < 0)
+ return n;
+
-+ if (access_ok(VERIFY_WRITE, to, n)) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from, n);
-+ }
-+ if ((unsigned long)to < TASK_SIZE) {
-+ over = (unsigned long)to + n - TASK_SIZE;
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n - over, true);
-+ return __copy_tofrom_user(to, (__force void __user *)from,
-+ n - over) + over;
++ if (likely(access_ok(VERIFY_WRITE, to, n))) {
++ check_object_size(from, n, true);
++ return __copy_tofrom_user(to, (void __force_user *)from, n);
+ }
+ return n;
+}
@@ -9032,12 +9227,10 @@ index b7c20f0..4adc0f1 100644
+ if ((long)n < 0 || n > INT_MAX)
+ return n;
+
-+ if (!__builtin_constant_p(n))
++ if (likely(access_ok(VERIFY_READ, from, n))) {
+ check_object_size(to, n, false);
-+
-+ if (likely(access_ok(VERIFY_READ, from, n)))
+ n = __copy_from_user(to, from, n);
-+ else
++ } else
+ memset(to, 0, n);
+ return n;
+}
@@ -9048,8 +9241,7 @@ index b7c20f0..4adc0f1 100644
+ return n;
+
+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+ if (!__builtin_constant_p(n))
-+ check_object_size(from, n, true);
++ check_object_size(from, n, true);
+ n = __copy_to_user(to, from, n);
+ }
+ return n;
@@ -9712,7 +9904,7 @@ index c4a93d6..4d2a9b4 100644
#endif /* __ASM_EXEC_H */
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index e0900dd..72d683d 100644
+index 666fd8b..778a9b9 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
@@ -10591,7 +10783,7 @@ index bd56c28..4b63d83 100644
#include <asm/uaccess_64.h>
#else
diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
-index 57aca27..a87e6eb 100644
+index 3e8de69..d3d89a0 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -47,6 +47,7 @@
@@ -10602,7 +10794,92 @@ index 57aca27..a87e6eb 100644
#define access_ok(type, addr, size) \
({ (void)(type); __access_ok((unsigned long)(addr), size); })
-@@ -248,27 +249,46 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
+@@ -205,6 +206,31 @@ int __put_user_bad(void);
+ __gu_ret; \
+ })
+
++#define __get_user_check_ret(x, addr, size, type, retval) ({ \
++ register unsigned long __gu_val __asm__ ("l1"); \
++ if (__access_ok(addr, size)) { \
++ switch (size) { \
++ case 1: \
++ __get_user_asm_ret(__gu_val, ub, addr, retval); \
++ break; \
++ case 2: \
++ __get_user_asm_ret(__gu_val, uh, addr, retval); \
++ break; \
++ case 4: \
++ __get_user_asm_ret(__gu_val, , addr, retval); \
++ break; \
++ case 8: \
++ __get_user_asm_ret(__gu_val, d, addr, retval); \
++ break; \
++ default: \
++ if (__get_user_bad()) \
++ return retval; \
++ } \
++ x = (__force type) __gu_val; \
++ } else \
++ return retval; \
++})
++
+ #define __get_user_nocheck(x, addr, size, type) ({ \
+ register int __gu_ret; \
+ register unsigned long __gu_val; \
+@@ -222,6 +248,20 @@ int __put_user_bad(void);
+ __gu_ret; \
+ })
+
++#define __get_user_nocheck_ret(x, addr, size, type, retval) ({ \
++ register unsigned long __gu_val __asm__ ("l1"); \
++ switch (size) { \
++ case 1: __get_user_asm_ret(__gu_val, ub, addr, retval); break; \
++ case 2: __get_user_asm_ret(__gu_val, uh, addr, retval); break; \
++ case 4: __get_user_asm_ret(__gu_val, , addr, retval); break; \
++ case 8: __get_user_asm_ret(__gu_val, d, addr, retval); break; \
++ default: \
++ if (__get_user_bad()) \
++ return retval; \
++ } \
++ x = (__force type) __gu_val; \
++})
++
+ #define __get_user_asm(x, size, addr, ret) \
+ __asm__ __volatile__( \
+ "/* Get user asm, inline. */\n" \
+@@ -242,28 +282,70 @@ __asm__ __volatile__( \
+ : "=&r" (ret), "=&r" (x) : "m" (*__m(addr)), \
+ "i" (-EFAULT))
+
++#define __get_user_asm_ret(x, size, addr, retval) \
++if (__builtin_constant_p(retval) && retval == -EFAULT) \
++ __asm__ __volatile__( \
++ "/* Get user asm ret, inline. */\n" \
++ "1:\t" "ld"#size " %1, %0\n\n\t" \
++ ".section __ex_table,#alloc\n\t" \
++ ".align 4\n\t" \
++ ".word 1b,__ret_efault\n\n\t" \
++ ".previous\n\t" \
++ : "=&r" (x) : "m" (*__m(addr))); \
++else \
++ __asm__ __volatile__( \
++ "/* Get user asm ret, inline. */\n" \
++ "1:\t" "ld"#size " %1, %0\n\n\t" \
++ ".section .fixup,#alloc,#execinstr\n\t" \
++ ".align 4\n" \
++ "3:\n\t" \
++ "ret\n\t" \
++ " restore %%g0, %2, %%o0\n\n\t" \
++ ".previous\n\t" \
++ ".section __ex_table,#alloc\n\t" \
++ ".align 4\n\t" \
++ ".word 1b, 3b\n\n\t" \
++ ".previous\n\t" \
++ : "=&r" (x) : "m" (*__m(addr)), "i" (retval))
++
+ int __get_user_bad(void);
+
+ unsigned long __copy_user(void __user *to, const void __user *from, unsigned long size);
static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -10640,10 +10917,12 @@ index 57aca27..a87e6eb 100644
+ if (!__builtin_constant_p(n))
+ check_object_size(to, n, false);
return __copy_user((__force void __user *) to, from, n);
-- else
-+ } else
+- else {
++ } else {
+ memset(to, 0, n);
return n;
- }
+ }
+@@ -271,6 +353,9 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
{
@@ -18725,10 +19004,10 @@ index 9b4f9d3..ce64392 100644
intel_ds_init();
diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c
-index 7b5fd81..3ca58b5 100644
+index 4ff41ae..9303030 100644
--- a/arch/x86/events/intel/cqm.c
+++ b/arch/x86/events/intel/cqm.c
-@@ -1479,7 +1479,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = {
+@@ -1488,7 +1488,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = {
NULL,
};
@@ -18737,7 +19016,7 @@ index 7b5fd81..3ca58b5 100644
.name = "events",
.attrs = NULL,
};
-@@ -1737,7 +1737,9 @@ static int __init intel_cqm_init(void)
+@@ -1746,7 +1746,9 @@ static int __init intel_cqm_init(void)
goto out;
}
@@ -18748,7 +19027,7 @@ index 7b5fd81..3ca58b5 100644
ret = intel_cqm_setup_rmid_cache();
if (ret)
-@@ -1753,12 +1755,14 @@ static int __init intel_cqm_init(void)
+@@ -1762,12 +1764,14 @@ static int __init intel_cqm_init(void)
if (ret && !cqm_enabled)
goto out;
@@ -18789,7 +19068,7 @@ index 9ba4e41..f931fb9 100644
static ssize_t cstate_get_attr_cpumask(struct device *dev,
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
-index 7ce9f3f..dc9146c 100644
+index 9b983a4..b31c136 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -601,7 +601,7 @@ unlock:
@@ -18850,7 +19129,7 @@ index 9e2b40c..a9013c2 100644
if (!insn.opcode.got)
return X86_BR_ABORT;
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
-index 04bb5fb..69cbd32 100644
+index 861a7d9..2ff89b2 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -172,11 +172,9 @@ static const struct attribute_group *pt_attr_groups[] = {
@@ -24045,7 +24324,7 @@ index c3496619..3f3a7dc 100644
asmlinkage void smp_deferred_error_interrupt(void);
#endif
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 2982387..35d07f4 100644
+index 0328c2cc..35d07f4 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -8,6 +8,7 @@
@@ -24248,23 +24527,20 @@ index 2982387..35d07f4 100644
break; \
case 4: \
__get_user_asm_ex(x, ptr, "l", "k", "=r"); \
-@@ -412,9 +464,13 @@ do { \
+@@ -412,10 +464,10 @@ do { \
} while (0)
#define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
"2:\n" \
-- _ASM_EXTABLE_EX(1b, 2b) \
-+ ".section .fixup,\"ax\"\n" \
+ ".section .fixup,\"ax\"\n" \
+- "3:xor"itype" %"rtype"0,%"rtype"0\n" \
+ "3:xorl %k0,%k0\n" \
-+ " jmp 2b\n" \
-+ ".previous\n" \
-+ _ASM_EXTABLE_EX(1b, 3b) \
- : ltype(x) : "m" (__m(addr)))
-
- #define __put_user_nocheck(x, ptr, size) \
-@@ -433,13 +489,24 @@ do { \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_EX(1b, 3b) \
+@@ -437,13 +489,24 @@ do { \
__uaccess_begin(); \
__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
__uaccess_end(); \
@@ -24291,7 +24567,7 @@ index 2982387..35d07f4 100644
/*
* Tell gcc we read from memory instead of writing: this is because
-@@ -447,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -451,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; };
* aliasing issues.
*/
#define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
@@ -24303,7 +24579,7 @@ index 2982387..35d07f4 100644
"2:\n" \
".section .fixup,\"ax\"\n" \
"3: mov %3,%0\n" \
-@@ -456,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -460,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; };
".previous\n" \
_ASM_EXTABLE(1b, 3b) \
: "=r"(err) \
@@ -24318,7 +24594,7 @@ index 2982387..35d07f4 100644
"2:\n" \
_ASM_EXTABLE_EX(1b, 2b) \
: : ltype(x), "m" (__m(addr)))
-@@ -469,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -473,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; };
*/
#define uaccess_try do { \
current_thread_info()->uaccess_err = 0; \
@@ -24332,7 +24608,7 @@ index 2982387..35d07f4 100644
(err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \
} while (0)
-@@ -499,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -503,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
* On error, the variable @x is set to zero.
*/
@@ -24345,7 +24621,7 @@ index 2982387..35d07f4 100644
/**
* __put_user: - Write a simple value into user space, with less checking.
-@@ -523,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -527,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; };
* Returns zero on success, or -EFAULT on error.
*/
@@ -24358,7 +24634,7 @@ index 2982387..35d07f4 100644
#define __get_user_unaligned __get_user
#define __put_user_unaligned __put_user
-@@ -542,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -546,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; };
#define get_user_ex(x, ptr) do { \
unsigned long __gue_val; \
__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
@@ -24367,7 +24643,7 @@ index 2982387..35d07f4 100644
} while (0)
#define put_user_try uaccess_try
-@@ -560,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str);
+@@ -564,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str);
extern __must_check long strnlen_user(const char __user *str, long n);
unsigned long __must_check clear_user(void __user *mem, unsigned long len);
@@ -24376,7 +24652,7 @@ index 2982387..35d07f4 100644
extern void __cmpxchg_wrong_size(void)
__compiletime_error("Bad argument size for cmpxchg");
-@@ -568,22 +649,23 @@ extern void __cmpxchg_wrong_size(void)
+@@ -572,22 +649,23 @@ extern void __cmpxchg_wrong_size(void)
#define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size) \
({ \
int __ret = 0; \
@@ -24405,7 +24681,7 @@ index 2982387..35d07f4 100644
: "i" (-EFAULT), "q" (__new), "1" (__old) \
: "memory" \
); \
-@@ -592,14 +674,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -596,14 +674,14 @@ extern void __cmpxchg_wrong_size(void)
case 2: \
{ \
asm volatile("\n" \
@@ -24422,7 +24698,7 @@ index 2982387..35d07f4 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -608,14 +690,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -612,14 +690,14 @@ extern void __cmpxchg_wrong_size(void)
case 4: \
{ \
asm volatile("\n" \
@@ -24439,7 +24715,7 @@ index 2982387..35d07f4 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -627,14 +709,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -631,14 +709,14 @@ extern void __cmpxchg_wrong_size(void)
__cmpxchg_wrong_size(); \
\
asm volatile("\n" \
@@ -24456,7 +24732,7 @@ index 2982387..35d07f4 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -644,6 +726,7 @@ extern void __cmpxchg_wrong_size(void)
+@@ -648,6 +726,7 @@ extern void __cmpxchg_wrong_size(void)
__cmpxchg_wrong_size(); \
} \
__uaccess_end(); \
@@ -24464,7 +24740,7 @@ index 2982387..35d07f4 100644
*__uval = __old; \
__ret; \
})
-@@ -667,17 +750,6 @@ extern struct movsl_mask {
+@@ -671,17 +750,6 @@ extern struct movsl_mask {
#define ARCH_HAS_NOCACHE_UACCESS 1
@@ -24482,7 +24758,7 @@ index 2982387..35d07f4 100644
#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
# define copy_user_diag __compiletime_error
#else
-@@ -687,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
+@@ -691,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
extern void copy_user_diag("copy_from_user() buffer size is too small")
copy_from_user_overflow(void);
extern void copy_user_diag("copy_to_user() buffer size is too small")
@@ -24491,7 +24767,7 @@ index 2982387..35d07f4 100644
#undef copy_user_diag
-@@ -700,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
+@@ -704,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
extern void
__compiletime_warning("copy_to_user() buffer size is not provably correct")
@@ -24500,7 +24776,7 @@ index 2982387..35d07f4 100644
#define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
#else
-@@ -715,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count)
+@@ -719,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count)
#endif
@@ -24518,7 +24794,7 @@ index 2982387..35d07f4 100644
might_fault();
-@@ -742,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -746,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
* case, and do only runtime checking for non-constant sizes.
*/
@@ -24540,7 +24816,7 @@ index 2982387..35d07f4 100644
return n;
}
-@@ -755,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -759,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
static inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -25776,10 +26052,10 @@ index 4a8697f..8a13428 100644
obj-y += common.o
obj-y += rdrand.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index f5c69d8..5eecf58 100644
+index b81fe2d..fa46eca 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
-@@ -780,7 +780,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+@@ -792,7 +792,7 @@ static void init_amd(struct cpuinfo_x86 *c)
static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
{
/* AMD errata T13 (order #21922) */
@@ -29478,10 +29754,10 @@ index 33ee3e0..6d23e5c 100644
#endif /* SMP */
};
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 7b3b3f2..68b5f72 100644
+index 078c933..c5d51dc 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
-@@ -64,6 +64,9 @@ u64 _paravirt_ident_64(u64 x)
+@@ -64,6 +64,9 @@ u64 notrace _paravirt_ident_64(u64 x)
{
return x;
}
@@ -31985,10 +32261,10 @@ index 7cc2360..6ae1236 100644
{
struct kvm_kpic_state *s = opaque;
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
-index 5f42d03..052f8a4 100644
+index c7220ba..4d0a181 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
-@@ -413,6 +413,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
+@@ -415,6 +415,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
#define IOAPIC_SUCCESSIVE_IRQ_MAX_COUNT 10000
static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
@@ -37189,7 +37465,7 @@ index 7a1f7bb..5b4b5cc 100644
while (numpages) {
/*
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index fb0604f..b9e0399 100644
+index 5431a32..137f092 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -633,7 +633,7 @@ int free_memtype(u64 start, u64 end)
@@ -40002,7 +40278,7 @@ index 058c8d7..55229dd 100644
__be32 *dst = (__be32 *)outbuf;
u32 block[4];
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 7921251..ba86330 100644
+index 90fefae..1a7cd2e 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
@@ -46652,7 +46928,7 @@ index 5d469b2..2a576b2 100644
else
type = types[map->type];
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 57676f8..020e7ca 100644
+index a628975..98c84f7 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -458,7 +458,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
@@ -46673,16 +46949,16 @@ index 57676f8..020e7ca 100644
if (__put_user(count, &request->count)
|| __put_user(list, &request->list))
-@@ -1072,7 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
- return 0;
+@@ -1074,7 +1074,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
}
+ #endif
-static drm_ioctl_compat_t *drm_compat_ioctls[] = {
+static drm_ioctl_compat_t drm_compat_ioctls[] = {
[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap,
-@@ -1119,7 +1119,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
+@@ -1123,7 +1123,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
unsigned int nr = DRM_IOCTL_NR(cmd);
@@ -46690,7 +46966,7 @@ index 57676f8..020e7ca 100644
int ret;
/* Assume that ioctls without an explicit compat routine will just
-@@ -1129,10 +1128,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+@@ -1133,10 +1132,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (nr >= ARRAY_SIZE(drm_compat_ioctls))
return drm_ioctl(filp, cmd, arg);
@@ -50151,10 +50427,10 @@ index c966492..4e66371 100644
/*
* intel_idle_state_table_update()
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
-index e6319a9..9e14f05 100644
+index 2e6a427..8b6cf88 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
-@@ -689,7 +689,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
+@@ -688,7 +688,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
}
static
@@ -56024,7 +56300,7 @@ index fd40bcb..13b3f293 100644
void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 866825f..0c08c28 100644
+index 0678a0a..90c7246 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -198,10 +198,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
@@ -56154,7 +56430,7 @@ index 866825f..0c08c28 100644
mask |= POLLERR | POLLPRI;
return mask;
}
-@@ -7637,7 +7638,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -7633,7 +7634,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
(int)part_stat_read(&disk->part0, sectors[1]) -
@@ -56163,7 +56439,7 @@ index 866825f..0c08c28 100644
/* sync IO will cause sync_io to increase before the disk_stats
* as sync_io is counted when a request starts, and
* disk_stats is counted when it completes.
-@@ -7901,7 +7902,7 @@ void md_do_sync(struct md_thread *thread)
+@@ -7897,7 +7898,7 @@ void md_do_sync(struct md_thread *thread)
* which defaults to physical size, but can be virtual size
*/
max_sectors = mddev->resync_max_sectors;
@@ -56172,7 +56448,7 @@ index 866825f..0c08c28 100644
/* we don't use the checkpoint if there's a bitmap */
if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
j = mddev->resync_min;
-@@ -8895,11 +8896,11 @@ static __exit void md_exit(void)
+@@ -8891,11 +8892,11 @@ static __exit void md_exit(void)
subsys_initcall(md_init);
module_exit(md_exit)
@@ -58406,7 +58682,7 @@ index 528390f..cacc274 100644
err = -EFAULT;
goto out_array_args;
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
-index 15508df..5f0ee4e 100644
+index 73ec320..a3ed597 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -234,7 +234,7 @@ struct omap3_gpmc_regs {
@@ -61675,7 +61951,7 @@ index 4048fc5..333809f 100644
/**
* bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
-index c777cde..7fa85f9 100644
+index e655b76..313a56d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6421,7 +6421,7 @@ init_err_free:
@@ -62735,7 +63011,7 @@ index 546fab0..8eeb822 100644
struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
-index 6695893..6abc392 100644
+index e782d0f..6591e56 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1384,7 +1384,7 @@ static void remove_one(struct pci_dev *pdev)
@@ -63239,7 +63515,7 @@ index cb49c96..c1498cc 100644
struct smc911x_local *lp = netdev_priv(dev);
unsigned int free;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
-index 18ac52d..5fd8ce3 100644
+index b69d0e1..718a393 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -637,7 +637,7 @@ done: if (!THROTTLE_TX_PKTS)
@@ -63994,10 +64270,10 @@ index fdee772..6c3ba123 100644
};
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index e16487c..c0987f1 100644
+index 34259bd..60c2692 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
-@@ -960,7 +960,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr)
+@@ -956,7 +956,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr)
{
struct tun_struct *tun = netdev_priv(dev);
@@ -64006,7 +64282,7 @@ index e16487c..c0987f1 100644
new_hr = NET_SKB_PAD;
tun->align = new_hr;
-@@ -1558,7 +1558,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
+@@ -1554,7 +1554,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
return -EINVAL;
}
@@ -64015,7 +64291,7 @@ index e16487c..c0987f1 100644
.kind = DRV_NAME,
.priv_size = sizeof(struct tun_struct),
.setup = tun_setup,
-@@ -1970,7 +1970,7 @@ unlock:
+@@ -1966,7 +1966,7 @@ unlock:
}
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -64024,7 +64300,7 @@ index e16487c..c0987f1 100644
{
struct tun_file *tfile = file->private_data;
struct tun_struct *tun;
-@@ -1984,6 +1984,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+@@ -1980,6 +1980,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
int le;
int ret;
@@ -64757,10 +65033,10 @@ index 9cbca12..eae7c79 100644
struct ath_nf_limits {
s16 max;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 8b63988..2fd4697 100644
+index 4b59a4c..14eb96d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -2589,16 +2589,18 @@ void ath9k_fill_chanctx_ops(void)
+@@ -2594,16 +2594,18 @@ void ath9k_fill_chanctx_ops(void)
if (!ath9k_is_chanctx_enabled())
return;
@@ -65413,7 +65689,7 @@ index 83770d2..3ec8a40 100644
if (modparam_pio)
wldev->__using_pio = true;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-index 62f475e..c5c90d3 100644
+index 121baba..80f9d55 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5077,6 +5077,50 @@ static struct cfg80211_ops brcmf_cfg80211_ops = {
@@ -77655,10 +77931,10 @@ index 0fbd7c0..66c6010 100644
if (share_irqs)
irqflag = IRQF_SHARED;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index 8dd250f..84599cb 100644
+index e67a463..c568cf1 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -5632,7 +5632,7 @@ static struct pci_device_id serial_pci_tbl[] = {
+@@ -5771,7 +5771,7 @@ static struct pci_device_id serial_pci_tbl[] = {
};
static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev,
@@ -79182,10 +79458,10 @@ index 69f7fab..05c4ff5 100644
/* Device for a quirk */
#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index bc17bcf..4480e4a 100644
+index e262ccc..43da57e 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
-@@ -1872,9 +1872,9 @@ td_cleanup:
+@@ -1876,9 +1876,9 @@ td_cleanup:
* unsigned). Play it safe and say we didn't transfer anything.
*/
if (urb->actual_length > urb->transfer_buffer_length) {
@@ -79197,7 +79473,7 @@ index bc17bcf..4480e4a 100644
urb->actual_length = 0;
if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
*status = -EREMOTEIO;
-@@ -1953,10 +1953,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -1957,10 +1957,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
return finish_td(xhci, td, event_trb, event, ep, status, false);
case COMP_STOP:
/* Did we stop at data stage? */
@@ -79217,7 +79493,7 @@ index bc17bcf..4480e4a 100644
/* fall through */
case COMP_STOP_INVAL:
return finish_td(xhci, td, event_trb, event, ep, status, false);
-@@ -1970,12 +1975,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -1974,12 +1979,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
/* else fall through */
case COMP_STALL:
/* Did we transfer part of the data (middle) phase? */
@@ -79239,7 +79515,7 @@ index bc17bcf..4480e4a 100644
td->urb->actual_length = 0;
return finish_td(xhci, td, event_trb, event, ep, status, false);
-@@ -2008,9 +2016,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2012,9 +2020,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
* the last TRB.
*/
td->urb_length_set = true;
@@ -79255,7 +79531,7 @@ index bc17bcf..4480e4a 100644
xhci_dbg(xhci, "Waiting for status "
"stage event\n");
return 0;
-@@ -2205,11 +2216,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2209,11 +2220,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
/* Fast path - was this the last TRB in the TD for this URB? */
} else if (event_trb == td->last_trb) {
if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
@@ -79268,7 +79544,7 @@ index bc17bcf..4480e4a 100644
xhci_warn(xhci, "HC gave bad length "
"of %d bytes left\n",
EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
-@@ -2218,7 +2225,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2222,7 +2229,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
*status = -EREMOTEIO;
else
*status = 0;
@@ -97635,7 +97911,7 @@ index 948aa18..ae3bc17 100644
spin_lock_init(&cur_trans->delayed_refs.lock);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index c05f69a..2469b31 100644
+index 542379f..054af97 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -173,7 +173,7 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
@@ -102351,7 +102627,7 @@ index cbece12..9b01171 100644
}
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 6cac3dc..e3ad955 100644
+index 76962a3..b0bdc86 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -849,9 +849,9 @@ struct fuse_fill_data {
@@ -102776,7 +103052,7 @@ index 8a65240..59ccf62 100644
}
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
-index e157400..1b16643 100644
+index 2bcb86e..b9fad5d 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -34,7 +34,7 @@ static DEFINE_MUTEX(kernfs_open_file_mutex);
@@ -104991,7 +105267,7 @@ index 5fe1cec..d0f4ac0 100644
#if IS_ENABLED(CONFIG_NFS_V4)
extern int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
-index aaa2e8d..deb6e76 100644
+index 8cfa21f..fc50292 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -19,10 +19,12 @@
@@ -105042,7 +105318,7 @@ index aaa2e8d..deb6e76 100644
int i;
__be32 res = 0;
struct nfs_client *clp = cps->clp;
-@@ -444,10 +448,12 @@ out:
+@@ -441,10 +445,12 @@ out:
return status;
}
@@ -105057,7 +105333,7 @@ index aaa2e8d..deb6e76 100644
struct nfs4_slot_table *tbl;
struct nfs4_slot *slot;
struct nfs_client *clp;
-@@ -549,9 +555,10 @@ validate_bitmap_values(unsigned long mask)
+@@ -546,9 +552,10 @@ validate_bitmap_values(unsigned long mask)
return (mask & ~RCA4_TYPE_MASK_ALL) == 0;
}
@@ -105069,7 +105345,7 @@ index aaa2e8d..deb6e76 100644
__be32 status;
fmode_t flags = 0;
-@@ -584,9 +591,10 @@ out:
+@@ -581,9 +588,10 @@ out:
}
/* Reduce the fore channel's max_slots to the target value */
@@ -110132,10 +110408,10 @@ index de1ff1d..bd4c347 100644
.pc_ressize = sizeof(struct nfsd4_compoundres),
.pc_release = nfsd4_release_compoundargs,
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 806eda1..125792c 100644
+index 6a23098..69c65ea 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
-@@ -2362,8 +2362,9 @@ static bool client_has_state(struct nfs4_client *clp)
+@@ -2341,8 +2341,9 @@ static bool client_has_state(struct nfs4_client *clp)
__be32
nfsd4_exchange_id(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110146,7 +110422,7 @@ index 806eda1..125792c 100644
struct nfs4_client *conf, *new;
struct nfs4_client *unconf = NULL;
__be32 status;
-@@ -2639,8 +2640,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
+@@ -2618,8 +2619,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
__be32
nfsd4_create_session(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110157,7 +110433,7 @@ index 806eda1..125792c 100644
struct sockaddr *sa = svc_addr(rqstp);
struct nfs4_client *conf, *unconf;
struct nfs4_client *old = NULL;
-@@ -2764,8 +2766,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir)
+@@ -2743,8 +2745,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir)
return nfserr_inval;
}
@@ -110168,7 +110444,7 @@ index 806eda1..125792c 100644
struct nfsd4_session *session = cstate->session;
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
__be32 status;
-@@ -2785,8 +2788,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state
+@@ -2764,8 +2767,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state
__be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110179,7 +110455,7 @@ index 806eda1..125792c 100644
__be32 status;
struct nfsd4_conn *conn;
struct nfsd4_session *session;
-@@ -2828,8 +2832,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4
+@@ -2807,8 +2811,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4
__be32
nfsd4_destroy_session(struct svc_rqst *r,
struct nfsd4_compound_state *cstate,
@@ -110190,7 +110466,7 @@ index 806eda1..125792c 100644
struct nfsd4_session *ses;
__be32 status;
int ref_held_by_me = 0;
-@@ -2925,8 +2930,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
+@@ -2904,8 +2909,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
__be32
nfsd4_sequence(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110201,7 +110477,7 @@ index 806eda1..125792c 100644
struct nfsd4_compoundres *resp = rqstp->rq_resp;
struct xdr_stream *xdr = &resp->xdr;
struct nfsd4_session *session;
-@@ -3060,8 +3066,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp)
+@@ -3039,8 +3045,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp)
}
__be32
@@ -110212,7 +110488,7 @@ index 806eda1..125792c 100644
struct nfs4_client *conf, *unconf;
struct nfs4_client *clp = NULL;
__be32 status = 0;
-@@ -3101,8 +3108,9 @@ out:
+@@ -3080,8 +3087,9 @@ out:
}
__be32
@@ -110223,7 +110499,7 @@ index 806eda1..125792c 100644
__be32 status = 0;
if (rc->rca_one_fs) {
-@@ -3139,8 +3147,9 @@ out:
+@@ -3118,8 +3126,9 @@ out:
__be32
nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110234,7 +110510,7 @@ index 806eda1..125792c 100644
struct xdr_netobj clname = setclid->se_name;
nfs4_verifier clverifier = setclid->se_verf;
struct nfs4_client *conf, *new;
-@@ -3198,8 +3207,9 @@ out:
+@@ -3177,8 +3186,9 @@ out:
__be32
nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110245,7 +110521,7 @@ index 806eda1..125792c 100644
struct nfs4_client *conf, *unconf;
struct nfs4_client *old = NULL;
nfs4_verifier confirm = setclientid_confirm->sc_confirm;
-@@ -4443,8 +4453,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
+@@ -4422,8 +4432,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
__be32
nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110256,7 +110532,7 @@ index 806eda1..125792c 100644
struct nfs4_client *clp;
__be32 status;
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
-@@ -4894,8 +4905,9 @@ out:
+@@ -4873,8 +4884,9 @@ out:
*/
__be32
nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110267,7 +110543,7 @@ index 806eda1..125792c 100644
struct nfsd4_test_stateid_id *stateid;
struct nfs4_client *cl = cstate->session->se_client;
-@@ -4934,8 +4946,9 @@ out:
+@@ -4913,8 +4925,9 @@ out:
__be32
nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110278,7 +110554,7 @@ index 806eda1..125792c 100644
stateid_t *stateid = &free_stateid->fr_stateid;
struct nfs4_stid *s;
struct nfs4_delegation *dp;
-@@ -5063,8 +5076,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
+@@ -5042,8 +5055,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
__be32
nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110289,7 +110565,7 @@ index 806eda1..125792c 100644
__be32 status;
struct nfs4_openowner *oo;
struct nfs4_ol_stateid *stp;
-@@ -5132,8 +5146,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac
+@@ -5111,8 +5125,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac
__be32
nfsd4_open_downgrade(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110300,7 +110576,7 @@ index 806eda1..125792c 100644
__be32 status;
struct nfs4_ol_stateid *stp;
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
-@@ -5201,8 +5216,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
+@@ -5180,8 +5195,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
*/
__be32
nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110311,7 +110587,7 @@ index 806eda1..125792c 100644
__be32 status;
struct nfs4_ol_stateid *stp;
struct net *net = SVC_NET(rqstp);
-@@ -5231,8 +5247,9 @@ out:
+@@ -5210,8 +5226,9 @@ out:
__be32
nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110322,7 +110598,7 @@ index 806eda1..125792c 100644
struct nfs4_delegation *dp;
stateid_t *stateid = &dr->dr_stateid;
struct nfs4_stid *s;
-@@ -5583,8 +5600,9 @@ out:
+@@ -5562,8 +5579,9 @@ out:
*/
__be32
nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110333,7 +110609,7 @@ index 806eda1..125792c 100644
struct nfs4_openowner *open_sop = NULL;
struct nfs4_lockowner *lock_sop = NULL;
struct nfs4_ol_stateid *lock_stp = NULL;
-@@ -5785,8 +5803,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
+@@ -5764,8 +5782,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
*/
__be32
nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110344,7 +110620,7 @@ index 806eda1..125792c 100644
struct file_lock *file_lock = NULL;
struct nfs4_lockowner *lo = NULL;
__be32 status;
-@@ -5858,8 +5877,9 @@ out:
+@@ -5837,8 +5856,9 @@ out:
__be32
nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110355,7 +110631,7 @@ index 806eda1..125792c 100644
struct nfs4_ol_stateid *stp;
struct file *filp = NULL;
struct file_lock *file_lock = NULL;
-@@ -5965,8 +5985,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
+@@ -5944,8 +5964,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
__be32
nfsd4_release_lockowner(struct svc_rqst *rqstp,
struct nfsd4_compound_state *cstate,
@@ -110366,7 +110642,7 @@ index 806eda1..125792c 100644
clientid_t *clid = &rlockowner->rl_clientid;
struct nfs4_stateowner *sop;
struct nfs4_lockowner *lo = NULL;
-@@ -6910,26 +6931,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate)
+@@ -6904,26 +6925,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate)
* functions to set current state id
*/
void
@@ -110405,7 +110681,7 @@ index 806eda1..125792c 100644
put_stateid(cstate, &lock->lk_resp_stateid);
}
-@@ -6938,49 +6967,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo
+@@ -6932,49 +6961,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo
*/
void
@@ -114098,7 +114374,7 @@ index 88c7de1..3e4b510 100644
static struct pid *
get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos)
diff --git a/fs/proc/base.c b/fs/proc/base.c
-index a11eb71..d48ca0e 100644
+index 7583df7..d0091f3 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -113,6 +113,14 @@ struct pid_entry {
@@ -114368,7 +114644,7 @@ index a11eb71..d48ca0e 100644
if (src >= (env_end - env_start))
break;
-@@ -1584,7 +1690,7 @@ static const char *proc_pid_get_link(struct dentry *dentry,
+@@ -1579,7 +1685,7 @@ static const char *proc_pid_get_link(struct dentry *dentry,
return ERR_PTR(-ECHILD);
/* Are we allowed to snoop on the tasks file descriptors? */
@@ -114377,7 +114653,7 @@ index a11eb71..d48ca0e 100644
goto out;
error = PROC_I(inode)->op.proc_get_link(dentry, &path);
-@@ -1628,8 +1734,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1623,8 +1729,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
struct path path;
/* Are we allowed to snoop on the tasks file descriptors? */
@@ -114398,7 +114674,7 @@ index a11eb71..d48ca0e 100644
error = PROC_I(inode)->op.proc_get_link(dentry, &path);
if (error)
-@@ -1679,7 +1795,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
+@@ -1674,7 +1790,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
rcu_read_lock();
cred = __task_cred(task);
inode->i_uid = cred->euid;
@@ -114410,7 +114686,7 @@ index a11eb71..d48ca0e 100644
rcu_read_unlock();
}
security_task_to_inode(task, inode);
-@@ -1715,10 +1835,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1710,10 +1830,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
return -ENOENT;
}
if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -114430,7 +114706,7 @@ index a11eb71..d48ca0e 100644
}
}
rcu_read_unlock();
-@@ -1756,11 +1885,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags)
+@@ -1751,11 +1880,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags)
if (task) {
if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -114451,7 +114727,7 @@ index a11eb71..d48ca0e 100644
rcu_read_unlock();
} else {
inode->i_uid = GLOBAL_ROOT_UID;
-@@ -2374,6 +2512,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2369,6 +2507,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
if (!task)
goto out_no_task;
@@ -114461,7 +114737,7 @@ index a11eb71..d48ca0e 100644
/*
* Yes, it does not scale. And it should not. Don't add
* new entries into /proc/<tgid>/ without very good reasons.
-@@ -2404,6 +2545,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
+@@ -2399,6 +2540,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
if (!task)
return -ENOENT;
@@ -114471,7 +114747,7 @@ index a11eb71..d48ca0e 100644
if (!dir_emit_dots(file, ctx))
goto out;
-@@ -2816,7 +2960,9 @@ static const struct inode_operations proc_task_inode_operations;
+@@ -2811,7 +2955,9 @@ static const struct inode_operations proc_task_inode_operations;
static const struct pid_entry tgid_base_stuff[] = {
DIR("task", S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
@@ -114481,7 +114757,7 @@ index a11eb71..d48ca0e 100644
DIR("fdinfo", S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
DIR("ns", S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
#ifdef CONFIG_NET
-@@ -2834,7 +2980,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2829,7 +2975,7 @@ static const struct pid_entry tgid_base_stuff[] = {
REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
#endif
REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -114490,7 +114766,7 @@ index a11eb71..d48ca0e 100644
ONE("syscall", S_IRUSR, proc_pid_syscall),
#endif
REG("cmdline", S_IRUGO, proc_pid_cmdline_ops),
-@@ -2859,10 +3005,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2854,10 +3000,10 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -114503,7 +114779,7 @@ index a11eb71..d48ca0e 100644
ONE("stack", S_IRUSR, proc_pid_stack),
#endif
#ifdef CONFIG_SCHED_INFO
-@@ -2896,6 +3042,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2891,6 +3037,9 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_HARDWALL
ONE("hardwall", S_IRUGO, proc_pid_hardwall),
#endif
@@ -114513,7 +114789,7 @@ index a11eb71..d48ca0e 100644
#ifdef CONFIG_USER_NS
REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations),
REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations),
-@@ -3029,7 +3178,14 @@ static int proc_pid_instantiate(struct inode *dir,
+@@ -3024,7 +3173,14 @@ static int proc_pid_instantiate(struct inode *dir,
if (!inode)
goto out;
@@ -114528,7 +114804,7 @@ index a11eb71..d48ca0e 100644
inode->i_op = &proc_tgid_base_inode_operations;
inode->i_fop = &proc_tgid_base_operations;
inode->i_flags|=S_IMMUTABLE;
-@@ -3067,7 +3223,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
+@@ -3062,7 +3218,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
if (!task)
goto out;
@@ -114540,7 +114816,7 @@ index a11eb71..d48ca0e 100644
put_task_struct(task);
out:
return ERR_PTR(result);
-@@ -3221,7 +3381,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3216,7 +3376,7 @@ static const struct pid_entry tid_base_stuff[] = {
NOD("comm", S_IFREG|S_IRUGO|S_IWUSR,
&proc_tid_comm_inode_operations,
&proc_pid_set_comm_operations, {}),
@@ -114549,7 +114825,7 @@ index a11eb71..d48ca0e 100644
ONE("syscall", S_IRUSR, proc_pid_syscall),
#endif
REG("cmdline", S_IRUGO, proc_pid_cmdline_ops),
-@@ -3248,10 +3408,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3243,10 +3403,10 @@ static const struct pid_entry tid_base_stuff[] = {
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -128944,10 +129220,10 @@ index af0254c..a4e4da3 100644
extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
extern char __kprobes_text_start[], __kprobes_text_end[];
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
-index 1bfa602..aab89b1 100644
+index 32901d1..5fa5a13 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
-@@ -345,4 +345,20 @@ clear_user(void __user *to, unsigned long n)
+@@ -351,4 +351,20 @@ clear_user(void __user *to, unsigned long n)
return __clear_user(to, n);
}
@@ -130502,10 +130778,10 @@ index 71c1b21..529a781 100644
extern struct dma_map_ops dma_noop_ops;
diff --git a/include/linux/efi.h b/include/linux/efi.h
-index f196dd0..bbcc416 100644
+index 17fd2c5..a48e2bb 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
-@@ -1184,6 +1184,7 @@ struct efivar_operations {
+@@ -1193,6 +1193,7 @@ struct efivar_operations {
efi_set_variable_t *set_variable_nonblocking;
efi_query_variable_store_t *query_variable_store;
};
@@ -132479,7 +132755,7 @@ index 1eee6bc..9cf4912 100644
extern struct ipc_namespace init_ipc_ns;
extern atomic_t nr_ipc_ns;
diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 4d758a7..f6ce482 100644
+index cbb5a2c..276804f 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -399,7 +399,10 @@ struct irq_chip {
@@ -133198,7 +133474,7 @@ index 093607f..9717227 100644
register_memory_notifier(&fn##_mem_nb); \
})
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
-index 4429d25..ae5ab54 100644
+index 5e5b296..629113f 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -91,6 +91,10 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
@@ -133212,7 +133488,7 @@ index 4429d25..ae5ab54 100644
static inline void mpol_get(struct mempolicy *pol)
{
-@@ -235,6 +239,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
+@@ -236,6 +240,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
}
#define vma_policy(vma) NULL
@@ -133223,7 +133499,7 @@ index 4429d25..ae5ab54 100644
static inline int
vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index ece042d..8115afb 100644
+index 317564b..3e200b9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -107,6 +107,7 @@ extern int mmap_rnd_compat_bits __read_mostly;
@@ -133416,7 +133692,7 @@ index ece042d..8115afb 100644
if (rlim < RLIM_INFINITY) {
if (((new - start) + (end_data - start_data)) > rlim)
return -ENOSPC;
-@@ -1996,6 +2012,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1997,6 +2013,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
unsigned long len, unsigned long prot, unsigned long flags,
vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate);
extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -133424,7 +133700,7 @@ index ece042d..8115afb 100644
static inline unsigned long
do_mmap_pgoff(struct file *file, unsigned long addr,
-@@ -2032,10 +2049,11 @@ struct vm_unmapped_area_info {
+@@ -2033,10 +2050,11 @@ struct vm_unmapped_area_info {
unsigned long high_limit;
unsigned long align_mask;
unsigned long align_offset;
@@ -133438,7 +133714,7 @@ index ece042d..8115afb 100644
/*
* Search for an unmapped address range.
-@@ -2047,7 +2065,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
+@@ -2048,7 +2066,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
* - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
*/
static inline unsigned long
@@ -133447,7 +133723,7 @@ index ece042d..8115afb 100644
{
if (info->flags & VM_UNMAPPED_AREA_TOPDOWN)
return unmapped_area_topdown(info);
-@@ -2107,6 +2125,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -2108,6 +2126,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
struct vm_area_struct **pprev);
@@ -133458,7 +133734,7 @@ index ece042d..8115afb 100644
/* Look up the first VMA which intersects the interval start_addr..end_addr-1,
NULL if none. Assume start_addr < end_addr. */
static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -2136,10 +2158,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -2137,10 +2159,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
}
#ifdef CONFIG_MMU
@@ -133471,7 +133747,7 @@ index ece042d..8115afb 100644
{
return __pgprot(0);
}
-@@ -2322,7 +2344,7 @@ extern int get_hwpoison_page(struct page *page);
+@@ -2323,7 +2345,7 @@ extern int get_hwpoison_page(struct page *page);
extern int sysctl_memory_failure_early_kill;
extern int sysctl_memory_failure_recovery;
extern void shake_page(struct page *p, int access);
@@ -133480,7 +133756,7 @@ index ece042d..8115afb 100644
extern int soft_offline_page(struct page *page, int flags);
-@@ -2410,5 +2432,11 @@ void __init setup_nr_node_ids(void);
+@@ -2411,5 +2433,11 @@ void __init setup_nr_node_ids(void);
static inline void setup_nr_node_ids(void) {}
#endif
@@ -133870,7 +134146,7 @@ index 25aa03b..9817031 100644
struct iovec;
struct kvec;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index da4b33b..0ae34af 100644
+index 4f0e6fb..2f980dd 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1290,6 +1290,7 @@ struct net_device_ops {
@@ -133903,7 +134179,7 @@ index da4b33b..0ae34af 100644
#ifdef CONFIG_WIRELESS_EXT
const struct iw_handler_def *wireless_handlers;
-@@ -4152,7 +4153,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
+@@ -4153,7 +4154,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
return dev->priv_flags & IFF_MACSEC;
}
@@ -137045,7 +137321,7 @@ index 5122b5e..598b440 100644
void v9fs_register_trans(struct p9_trans_module *m);
void v9fs_unregister_trans(struct p9_trans_module *m);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
-index 9b4c418..f3ff431 100644
+index fd60ecc..64e2a1e 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -36,7 +36,7 @@ struct unix_skb_parms {
@@ -137951,7 +138227,7 @@ index ff5be7e..598bf64 100644
void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 0bcc70f..5c46882 100644
+index 7254051..1f9ddac 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -543,7 +543,7 @@ void tcp_retransmit_timer(struct sock *sk);
@@ -137983,7 +138259,7 @@ index 0bcc70f..5c46882 100644
union {
struct {
/* There is space for up to 20 bytes */
-@@ -1869,7 +1869,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb)
+@@ -1871,7 +1871,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb)
*/
static inline void tcp_listendrop(const struct sock *sk)
{
@@ -140505,7 +140781,7 @@ index 8c50276..457c599 100644
pagefault_disable();
result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr);
diff --git a/kernel/exit.c b/kernel/exit.c
-index 9e6e135..4af378d 100644
+index 26a766a..b802979 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -170,6 +170,10 @@ void release_task(struct task_struct *p)
@@ -140566,7 +140842,7 @@ index 9e6e135..4af378d 100644
exit_mm(tsk);
if (group_dead)
-@@ -851,7 +860,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -846,7 +855,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
* Take down every thread in the group. This is called by fatal signals
* as well as by sys_exit_group (below).
*/
@@ -140575,7 +140851,7 @@ index 9e6e135..4af378d 100644
do_group_exit(int exit_code)
{
struct signal_struct *sig = current->signal;
-@@ -979,6 +988,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
+@@ -974,6 +983,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
* the lock and this task is uninteresting. If we return nonzero, we have
* released the lock and the system call should return.
*/
@@ -140583,7 +140859,7 @@ index 9e6e135..4af378d 100644
static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
{
int state, retval, status;
-@@ -995,6 +1005,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+@@ -990,6 +1000,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
get_task_struct(p);
read_unlock(&tasklist_lock);
@@ -140591,7 +140867,7 @@ index 9e6e135..4af378d 100644
sched_annotate_sleep();
if ((exit_code & 0x7f) == 0) {
-@@ -1017,6 +1028,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+@@ -1012,6 +1023,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
* We own this thread, nobody else can reap it.
*/
read_unlock(&tasklist_lock);
@@ -140599,7 +140875,7 @@ index 9e6e135..4af378d 100644
sched_annotate_sleep();
/*
-@@ -1159,6 +1171,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace)
+@@ -1154,6 +1166,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace)
* search should terminate.
*/
static int wait_task_stopped(struct wait_opts *wo,
@@ -140608,7 +140884,7 @@ index 9e6e135..4af378d 100644
int ptrace, struct task_struct *p)
{
struct siginfo __user *infop;
-@@ -1206,6 +1220,7 @@ unlock_sig:
+@@ -1201,6 +1215,7 @@ unlock_sig:
pid = task_pid_vnr(p);
why = ptrace ? CLD_TRAPPED : CLD_STOPPED;
read_unlock(&tasklist_lock);
@@ -140616,7 +140892,7 @@ index 9e6e135..4af378d 100644
sched_annotate_sleep();
if (unlikely(wo->wo_flags & WNOWAIT))
-@@ -1243,6 +1258,7 @@ unlock_sig:
+@@ -1238,6 +1253,7 @@ unlock_sig:
* the lock and this task is uninteresting. If we return nonzero, we have
* released the lock and the system call should return.
*/
@@ -140624,7 +140900,7 @@ index 9e6e135..4af378d 100644
static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
{
int retval;
-@@ -1269,6 +1285,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+@@ -1264,6 +1280,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
pid = task_pid_vnr(p);
get_task_struct(p);
read_unlock(&tasklist_lock);
@@ -140632,7 +140908,7 @@ index 9e6e135..4af378d 100644
sched_annotate_sleep();
if (!wo->wo_info) {
-@@ -1298,6 +1315,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+@@ -1293,6 +1310,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
* or another error from security_task_wait(), or still -ECHILD.
*/
static int wait_consider_task(struct wait_opts *wo, int ptrace,
@@ -140641,7 +140917,7 @@ index 9e6e135..4af378d 100644
struct task_struct *p)
{
/*
-@@ -1423,6 +1442,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+@@ -1418,6 +1437,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
* ->notask_error is 0 if there were any eligible children,
* or another error from security_task_wait(), or still -ECHILD.
*/
@@ -140649,7 +140925,7 @@ index 9e6e135..4af378d 100644
static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
{
struct task_struct *p;
-@@ -1437,6 +1457,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
+@@ -1432,6 +1452,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
return 0;
}
@@ -140657,7 +140933,7 @@ index 9e6e135..4af378d 100644
static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
{
struct task_struct *p;
-@@ -1500,12 +1521,16 @@ repeat:
+@@ -1495,12 +1516,16 @@ repeat:
tsk = current;
do {
retval = do_wait_thread(wo, tsk);
@@ -140714,7 +140990,7 @@ index e820cce..72195de 100644
/* Given an address, look for it in the exception tables. */
diff --git a/kernel/fork.c b/kernel/fork.c
-index aea4f4d..59d599e 100644
+index 74fd390..597bfcb 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -197,12 +197,55 @@ static void free_thread_stack(unsigned long *stack)
@@ -141054,7 +141330,7 @@ index aea4f4d..59d599e 100644
}
static inline int mm_alloc_pgd(struct mm_struct *mm)
-@@ -836,8 +940,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+@@ -859,8 +963,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
return ERR_PTR(err);
mm = get_task_mm(task);
@@ -141065,7 +141341,7 @@ index aea4f4d..59d599e 100644
mmput(mm);
mm = ERR_PTR(-EACCES);
}
-@@ -1038,13 +1142,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -1061,13 +1165,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
spin_unlock(&fs->lock);
return -EAGAIN;
}
@@ -141087,7 +141363,7 @@ index aea4f4d..59d599e 100644
return 0;
}
-@@ -1277,7 +1388,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
+@@ -1300,7 +1411,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
* parts of the process environment (as per the clone
* flags). The actual kick-off is left to the caller.
*/
@@ -141096,7 +141372,7 @@ index aea4f4d..59d599e 100644
unsigned long stack_start,
unsigned long stack_size,
int __user *child_tidptr,
-@@ -1349,6 +1460,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1372,6 +1483,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
#endif
retval = -EAGAIN;
@@ -141106,7 +141382,7 @@ index aea4f4d..59d599e 100644
if (atomic_read(&p->real_cred->user->processes) >=
task_rlimit(p, RLIMIT_NPROC)) {
if (p->real_cred->user != INIT_USER &&
-@@ -1607,6 +1721,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1630,6 +1744,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
goto bad_fork_cancel_cgroup;
}
@@ -141123,7 +141399,7 @@ index aea4f4d..59d599e 100644
if (likely(p->pid)) {
ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
-@@ -1698,6 +1822,8 @@ bad_fork_cleanup_count:
+@@ -1721,6 +1845,8 @@ bad_fork_cleanup_count:
bad_fork_free:
free_task(p);
fork_out:
@@ -141132,7 +141408,7 @@ index aea4f4d..59d599e 100644
return ERR_PTR(retval);
}
-@@ -1761,6 +1887,7 @@ long _do_fork(unsigned long clone_flags,
+@@ -1784,6 +1910,7 @@ long _do_fork(unsigned long clone_flags,
p = copy_process(clone_flags, stack_start, stack_size,
child_tidptr, NULL, trace, tls, NUMA_NO_NODE);
@@ -141140,7 +141416,7 @@ index aea4f4d..59d599e 100644
/*
* Do this prior waking up the new thread - the thread pointer
* might get invalid after that point, if the thread exits quickly.
-@@ -1777,6 +1904,8 @@ long _do_fork(unsigned long clone_flags,
+@@ -1800,6 +1927,8 @@ long _do_fork(unsigned long clone_flags,
if (clone_flags & CLONE_PARENT_SETTID)
put_user(nr, parent_tidptr);
@@ -141149,7 +141425,7 @@ index aea4f4d..59d599e 100644
if (clone_flags & CLONE_VFORK) {
p->vfork_done = &vfork;
init_completion(&vfork);
-@@ -1913,7 +2042,7 @@ void __init proc_caches_init(void)
+@@ -1936,7 +2065,7 @@ void __init proc_caches_init(void)
sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
NULL);
@@ -141158,7 +141434,7 @@ index aea4f4d..59d599e 100644
mmap_init();
nsproxy_cache_init();
}
-@@ -1961,7 +2090,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1984,7 +2113,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
return 0;
/* don't need lock here; in the worst case we'll do useless copy */
@@ -141167,7 +141443,7 @@ index aea4f4d..59d599e 100644
return 0;
*new_fsp = copy_fs_struct(fs);
-@@ -2074,7 +2203,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -2097,7 +2226,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
fs = current->fs;
spin_lock(&fs->lock);
current->fs = new_fs;
@@ -141177,7 +141453,7 @@ index aea4f4d..59d599e 100644
new_fs = NULL;
else
new_fs = fs;
-@@ -2138,7 +2268,7 @@ int unshare_files(struct files_struct **displaced)
+@@ -2161,7 +2291,7 @@ int unshare_files(struct files_struct **displaced)
int sysctl_max_threads(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -141267,7 +141543,7 @@ index ef0bc02..2c983f5 100644
irq_wake_secondary(desc, action);
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
-index 0afe671..244f89c 100644
+index 6143b2f..87ffe77 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -214,16 +214,18 @@ static void msi_domain_update_dom_ops(struct msi_domain_info *info)
@@ -143098,18 +143374,46 @@ index a65ba13..f600dbb 100644
if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN))
return -EPERM;
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 68d3ebc..82bb833 100644
+index 68d3ebc..554935d 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
-@@ -34,6 +34,8 @@ config HIBERNATE_CALLBACKS
+@@ -34,6 +34,7 @@ config HIBERNATE_CALLBACKS
config HIBERNATION
bool "Hibernation (aka 'suspend to disk')"
depends on SWAP && ARCH_HIBERNATION_POSSIBLE
+ depends on !GRKERNSEC_KMEM
-+ depends on !PAX_MEMORY_SANITIZE
select HIBERNATE_CALLBACKS
select LZO_COMPRESS
select LZO_DECOMPRESS
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index fca9254..a40591f 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -305,8 +305,10 @@ static int create_image(int platform_mode)
+ error);
+ /* Restore control flow magically appears here */
+ restore_processor_state();
+- if (!in_suspend)
++ if (!in_suspend) {
+ events_check_enabled = false;
++ clear_free_pages();
++ }
+
+ platform_leave(platform_mode);
+
+diff --git a/kernel/power/power.h b/kernel/power/power.h
+index efe1b3b..cd674b2 100644
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -101,6 +101,8 @@ extern int create_basic_memory_bitmaps(void);
+ extern void free_basic_memory_bitmaps(void);
+ extern int hibernate_preallocate_memory(void);
+
++extern void clear_free_pages(void);
++
+ /**
+ * Auxiliary structure used for reading the snapshot image data and
+ * metadata from and writing them to the list of page backup entries
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 0c2ee97..63229a6 100644
--- a/kernel/power/process.c
@@ -143153,6 +143457,37 @@ index 0c2ee97..63229a6 100644
break;
if (pm_wakeup_pending()) {
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 3a97060..12c1d4e 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1032,6 +1032,26 @@ void free_basic_memory_bitmaps(void)
+ pr_debug("PM: Basic memory bitmaps freed\n");
+ }
+
++void clear_free_pages(void)
++{
++ struct memory_bitmap *bm = free_pages_map;
++ unsigned long pfn;
++
++ if (WARN_ON(!(free_pages_map)))
++ return;
++
++ memory_bm_position_reset(bm);
++ pfn = memory_bm_next_pfn(bm);
++ while (pfn != BM_END_OF_MAP) {
++ if (pfn_valid(pfn))
++ clear_highpage(pfn_to_page(pfn));
++
++ pfn = memory_bm_next_pfn(bm);
++ }
++ memory_bm_position_reset(bm);
++ pr_info("PM: free pages cleared after restore\n");
++}
++
+ /**
+ * snapshot_additional_pages - estimate the number of additional pages
+ * be needed for setting up the suspend image data structures for given
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 60cdf63..eab5721 100644
--- a/kernel/printk/printk.c
@@ -143956,10 +144291,10 @@ index a5d966c..9c2d28b 100644
#ifdef CONFIG_RT_GROUP_SCHED
/*
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 97ee9ac..f8349adf 100644
+index 38eacc3..9f35d87 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
-@@ -2236,7 +2236,7 @@ void set_numabalancing_state(bool enabled)
+@@ -2258,7 +2258,7 @@ void set_numabalancing_state(bool enabled)
int sysctl_numa_balancing(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -143968,7 +144303,7 @@ index 97ee9ac..f8349adf 100644
int err;
int state = static_branch_likely(&sched_numa_balancing);
-@@ -2311,7 +2311,7 @@ static void __init init_schedstats(void)
+@@ -2333,7 +2333,7 @@ static void __init init_schedstats(void)
int sysctl_schedstats(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -143977,7 +144312,7 @@ index 97ee9ac..f8349adf 100644
int err;
int state = static_branch_likely(&sched_schedstats);
-@@ -2754,7 +2754,7 @@ static struct rq *finish_task_switch(struct task_struct *prev)
+@@ -2776,7 +2776,7 @@ static struct rq *finish_task_switch(struct task_struct *prev)
/* rq->lock is NOT held, but preemption is disabled */
static void __balance_callback(struct rq *rq)
{
@@ -143986,7 +144321,7 @@ index 97ee9ac..f8349adf 100644
void (*func)(struct rq *rq);
unsigned long flags;
-@@ -2762,7 +2762,7 @@ static void __balance_callback(struct rq *rq)
+@@ -2784,7 +2784,7 @@ static void __balance_callback(struct rq *rq)
head = rq->balance_callback;
rq->balance_callback = NULL;
while (head) {
@@ -143995,7 +144330,7 @@ index 97ee9ac..f8349adf 100644
next = head->next;
head->next = NULL;
head = next;
-@@ -3708,6 +3708,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -3730,6 +3730,8 @@ int can_nice(const struct task_struct *p, const int nice)
/* convert nice value [19,-20] to rlimit style value [1,40] */
int nice_rlim = nice_to_rlimit(nice);
@@ -144004,7 +144339,7 @@ index 97ee9ac..f8349adf 100644
return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
capable(CAP_SYS_NICE));
}
-@@ -3734,7 +3736,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -3756,7 +3758,8 @@ SYSCALL_DEFINE1(nice, int, increment)
nice = task_nice(current) + increment;
nice = clamp_val(nice, MIN_NICE, MAX_NICE);
@@ -144014,7 +144349,7 @@ index 97ee9ac..f8349adf 100644
return -EPERM;
retval = security_task_setnice(current, nice);
-@@ -4044,6 +4047,7 @@ recheck:
+@@ -4066,6 +4069,7 @@ recheck:
if (policy != p->policy && !rlim_rtprio)
return -EPERM;
@@ -144022,7 +144357,7 @@ index 97ee9ac..f8349adf 100644
/* can't increase priority */
if (attr->sched_priority > p->rt_priority &&
attr->sched_priority > rlim_rtprio)
-@@ -7529,7 +7533,7 @@ void __might_sleep(const char *file, int line, int preempt_offset)
+@@ -7551,7 +7555,7 @@ void __might_sleep(const char *file, int line, int preempt_offset)
*/
WARN_ONCE(current->state != TASK_RUNNING && current->task_state_change,
"do not call blocking ops when !TASK_RUNNING; "
@@ -149153,7 +149488,7 @@ index 9e04681..30759a2 100644
mm = get_task_mm(tsk);
if (!mm)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 297d685..388696f 100644
+index e682861..c92d0a8 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -730,6 +730,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -150992,7 +151327,7 @@ index e248194..ff005a8 100644
struct bdi_writeback *wb = dtc->wb;
unsigned long write_bw = wb->avg_write_bandwidth;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 8b3e134..d47200a 100644
+index 6e35419..3ebe533 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -63,6 +63,7 @@
@@ -151150,7 +151485,7 @@ index 8b3e134..d47200a 100644
clear_bit(ZONE_FAIR_DEPLETED, &zone->flags);
} while (zone++ != preferred_zone);
}
-@@ -6858,7 +6901,7 @@ static void __setup_per_zone_wmarks(void)
+@@ -6812,7 +6855,7 @@ static void __setup_per_zone_wmarks(void)
__mod_zone_page_state(zone, NR_ALLOC_BATCH,
high_wmark_pages(zone) - low_wmark_pages(zone) -
@@ -154582,7 +154917,7 @@ index b7de71f..808387d 100644
return err;
diff --git a/net/core/dev.c b/net/core/dev.c
-index 904ff43..050ec70 100644
+index 97fb3da..be181d7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1766,7 +1766,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -154630,7 +154965,7 @@ index 904ff43..050ec70 100644
{
struct softnet_data *sd = this_cpu_ptr(&softnet_data);
-@@ -4206,9 +4206,9 @@ ncls:
+@@ -4222,9 +4222,9 @@ ncls:
} else {
drop:
if (!deliver_exact)
@@ -154642,7 +154977,7 @@ index 904ff43..050ec70 100644
kfree_skb(skb);
/* Jamal, now you will not able to escape explaining
* me how you were going to use this. :-)
-@@ -5175,7 +5175,7 @@ out_unlock:
+@@ -5191,7 +5191,7 @@ out_unlock:
return work;
}
@@ -154651,7 +154986,7 @@ index 904ff43..050ec70 100644
{
struct softnet_data *sd = this_cpu_ptr(&softnet_data);
unsigned long time_limit = jiffies + 2;
-@@ -7390,9 +7390,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -7406,9 +7406,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
@@ -154664,7 +154999,7 @@ index 904ff43..050ec70 100644
return storage;
}
EXPORT_SYMBOL(dev_get_stats);
-@@ -8014,7 +8014,7 @@ static void __net_exit netdev_exit(struct net *net)
+@@ -8030,7 +8030,7 @@ static void __net_exit netdev_exit(struct net *net)
kfree(net->dev_index_head);
}
@@ -154673,7 +155008,7 @@ index 904ff43..050ec70 100644
.init = netdev_init,
.exit = netdev_exit,
};
-@@ -8114,7 +8114,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+@@ -8130,7 +8130,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
rtnl_unlock();
}
@@ -154702,7 +155037,7 @@ index b94b1d2..da3ed7c 100644
EXPORT_SYMBOL(dev_load);
diff --git a/net/core/filter.c b/net/core/filter.c
-index e759d90..daa69dc 100644
+index bca32d6..5a27650 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -590,7 +590,11 @@ do_pass:
@@ -156128,7 +156463,7 @@ index 71a52f4d..2bab905 100644
msg.msg_flags = flags;
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
-index a917903..b0bdff6 100644
+index cc701fa..473bb8c 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -44,7 +44,7 @@
@@ -156149,6 +156484,15 @@ index a917903..b0bdff6 100644
.kind = "vti",
.maxtype = IFLA_VTI_MAX,
.policy = vti_policy,
+@@ -580,7 +580,7 @@ static int vti_device_event(struct notifier_block *unused,
+ return NOTIFY_DONE;
+ }
+
+-static struct notifier_block vti_notifier_block __read_mostly = {
++static notifier_block_no_const vti_notifier_block __read_only = {
+ .notifier_call = vti_device_event,
+ };
+
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 1d71c40..3f8a6fa 100644
--- a/net/ipv4/ipconfig.c
@@ -156807,7 +157151,7 @@ index 42bf89a..adc7e6d 100644
write_pnet(&ireq->ireq_net, sock_net(sk_listener));
ireq->ireq_family = sk_listener->sk_family;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 3708de2..2b40e93 100644
+index ba7ce3f..b106df6 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -88,6 +88,10 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -156821,7 +157165,7 @@ index 3708de2..2b40e93 100644
#ifdef CONFIG_TCP_MD5SIG
static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
__be32 daddr, __be32 saddr, const struct tcphdr *th);
-@@ -1425,6 +1429,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1431,6 +1435,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
return 0;
reset:
@@ -156831,7 +157175,7 @@ index 3708de2..2b40e93 100644
tcp_v4_send_reset(rsk, skb);
discard:
kfree_skb(skb);
-@@ -1592,12 +1599,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1598,12 +1605,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
lookup:
sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source,
th->dest, &refcounted);
@@ -156854,7 +157198,7 @@ index 3708de2..2b40e93 100644
if (sk->sk_state == TCP_NEW_SYN_RECV) {
struct request_sock *req = inet_reqsk(sk);
-@@ -1687,6 +1701,10 @@ csum_error:
+@@ -1693,6 +1707,10 @@ csum_error:
bad_packet:
__TCP_INC_STATS(net, TCP_MIB_INERRS);
} else {
@@ -156865,7 +157209,7 @@ index 3708de2..2b40e93 100644
tcp_v4_send_reset(NULL, skb);
}
-@@ -2425,7 +2443,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+@@ -2431,7 +2449,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
}
@@ -156957,7 +157301,7 @@ index debdd8b..7bcef89 100644
syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
/* Has it gone just too far? */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index e61f7cd..8206e7a 100644
+index 00d18c5..3e65784 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -87,6 +87,7 @@
@@ -157008,7 +157352,7 @@ index e61f7cd..8206e7a 100644
daddr = inet->inet_daddr;
dport = inet->inet_dport;
/* Open fast path for connected socket.
-@@ -1199,7 +1216,7 @@ static unsigned int first_packet_length(struct sock *sk)
+@@ -1199,7 +1216,7 @@ static int first_packet_length(struct sock *sk)
IS_UDPLITE(sk));
__UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS,
IS_UDPLITE(sk));
@@ -157180,7 +157524,7 @@ index 542074c..648df74 100644
sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 047c75a..bc3f19c 100644
+index 82e367b..1b4ae5e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
@@ -157210,7 +157554,7 @@ index 047c75a..bc3f19c 100644
net->dev_base_seq;
hlist_for_each_entry_rcu(dev, head, index_hlist) {
if (idx < s_idx)
-@@ -2596,7 +2596,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
+@@ -2597,7 +2597,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
p.iph.ihl = 5;
p.iph.protocol = IPPROTO_IPV6;
p.iph.ttl = 64;
@@ -157219,7 +157563,7 @@ index 047c75a..bc3f19c 100644
if (ops->ndo_do_ioctl) {
mm_segment_t oldfs = get_fs();
-@@ -4029,16 +4029,23 @@ static const struct file_operations if6_fops = {
+@@ -4031,16 +4031,23 @@ static const struct file_operations if6_fops = {
.release = seq_release_net,
};
@@ -157244,7 +157588,7 @@ index 047c75a..bc3f19c 100644
}
static struct pernet_operations if6_proc_net_ops = {
-@@ -4657,7 +4664,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
+@@ -4659,7 +4666,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
s_ip_idx = ip_idx = cb->args[2];
rcu_read_lock();
@@ -157253,7 +157597,7 @@ index 047c75a..bc3f19c 100644
for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
idx = 0;
head = &net->dev_index_head[h];
-@@ -4870,7 +4877,7 @@ static inline size_t inet6_if_nlmsg_size(void)
+@@ -4872,7 +4879,7 @@ static inline size_t inet6_if_nlmsg_size(void)
+ nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
}
@@ -157262,7 +157606,7 @@ index 047c75a..bc3f19c 100644
int items, int bytes)
{
int i;
-@@ -4880,7 +4887,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
+@@ -4882,7 +4889,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
/* Use put_unaligned() because stats may not be aligned for u64. */
put_unaligned(items, &stats[0]);
for (i = 1; i < items; i++)
@@ -157271,7 +157615,7 @@ index 047c75a..bc3f19c 100644
memset(&stats[items], 0, pad);
}
-@@ -5337,7 +5344,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
+@@ -5339,7 +5346,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
rt_genid_bump_ipv6(net);
break;
}
@@ -157280,7 +157624,7 @@ index 047c75a..bc3f19c 100644
}
static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
-@@ -5357,7 +5364,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
+@@ -5359,7 +5366,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
int *valp = ctl->data;
int val = *valp;
loff_t pos = *ppos;
@@ -157289,7 +157633,7 @@ index 047c75a..bc3f19c 100644
int ret;
/*
-@@ -5380,7 +5387,7 @@ static
+@@ -5382,7 +5389,7 @@ static
int addrconf_sysctl_hop_limit(struct ctl_table *ctl, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -157298,7 +157642,7 @@ index 047c75a..bc3f19c 100644
int min_hl = 1, max_hl = 255;
lctl = *ctl;
-@@ -5396,7 +5403,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
+@@ -5398,7 +5405,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
{
struct inet6_dev *idev = ctl->extra1;
int min_mtu = IPV6_MIN_MTU;
@@ -157307,7 +157651,7 @@ index 047c75a..bc3f19c 100644
lctl = *ctl;
lctl.extra1 = &min_mtu;
-@@ -5471,7 +5478,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
+@@ -5473,7 +5480,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
int *valp = ctl->data;
int val = *valp;
loff_t pos = *ppos;
@@ -157316,7 +157660,7 @@ index 047c75a..bc3f19c 100644
int ret;
/*
-@@ -5536,7 +5543,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
+@@ -5538,7 +5545,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
int err;
struct in6_addr addr;
char str[IPV6_MAX_STRLEN];
@@ -157325,7 +157669,7 @@ index 047c75a..bc3f19c 100644
struct net *net = ctl->extra2;
struct ipv6_stable_secret *secret = ctl->data;
-@@ -5605,7 +5612,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
+@@ -5607,7 +5614,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
int *valp = ctl->data;
int val = *valp;
loff_t pos = *ppos;
@@ -157334,7 +157678,7 @@ index 047c75a..bc3f19c 100644
int ret;
/* ctl->data points to idev->cnf.ignore_routes_when_linkdown
-@@ -5945,7 +5952,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
+@@ -5947,7 +5954,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
struct inet6_dev *idev, struct ipv6_devconf *p)
{
int i;
@@ -157452,7 +157796,7 @@ index 776d145..69772ae 100644
.maxtype = IFLA_GRE_MAX,
.policy = ip6gre_policy,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 7b0481e..cd77386 100644
+index 888543d..bcc126c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -80,7 +80,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
@@ -157464,7 +157808,7 @@ index 7b0481e..cd77386 100644
static int ip6_tnl_net_id __read_mostly;
struct ip6_tnl_net {
-@@ -1992,7 +1992,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
+@@ -1994,7 +1994,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
[IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 },
};
@@ -157611,10 +157955,10 @@ index e4347ae..c7654e7 100644
return -ENOMEM;
}
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
-index 3ee3e44..2f70cc3 100644
+index 4086604..7a868ec 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
-@@ -242,6 +242,24 @@ static struct pernet_operations ping_v6_net_ops = {
+@@ -247,6 +247,24 @@ static struct pernet_operations ping_v6_net_ops = {
};
#endif
@@ -157639,7 +157983,7 @@ index 3ee3e44..2f70cc3 100644
int __init pingv6_init(void)
{
#ifdef CONFIG_PROC_FS
-@@ -249,13 +267,7 @@ int __init pingv6_init(void)
+@@ -254,13 +272,7 @@ int __init pingv6_init(void)
if (ret)
return ret;
#endif
@@ -157654,7 +157998,7 @@ index 3ee3e44..2f70cc3 100644
return inet6_register_protosw(&pingv6_protosw);
}
-@@ -264,14 +276,9 @@ int __init pingv6_init(void)
+@@ -269,14 +281,9 @@ int __init pingv6_init(void)
*/
void pingv6_exit(void)
{
@@ -157893,7 +158237,7 @@ index 45243bb..cdb398e 100644
struct ctl_table *ipv6_icmp_table;
int err;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 2255d2b..b1c03a4 100644
+index 889acc4..c4a32ab 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -101,6 +101,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -157907,7 +158251,7 @@ index 2255d2b..b1c03a4 100644
static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
{
return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
-@@ -1274,6 +1278,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1280,6 +1284,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
return 0;
reset:
@@ -157917,7 +158261,7 @@ index 2255d2b..b1c03a4 100644
tcp_v6_send_reset(sk, skb);
discard:
if (opt_skb)
-@@ -1386,12 +1393,20 @@ lookup:
+@@ -1392,12 +1399,20 @@ lookup:
sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
th->source, th->dest, inet6_iif(skb),
&refcounted);
@@ -157940,7 +158284,7 @@ index 2255d2b..b1c03a4 100644
if (sk->sk_state == TCP_NEW_SYN_RECV) {
struct request_sock *req = inet_reqsk(sk);
-@@ -1481,6 +1496,10 @@ csum_error:
+@@ -1487,6 +1502,10 @@ csum_error:
bad_packet:
__TCP_INC_STATS(net, TCP_MIB_INERRS);
} else {
@@ -158333,7 +158677,7 @@ index 8567366..7c8aa51 100644
irda_task_kick(task);
}
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
-index 4a7ae32a..bfe8e78 100644
+index 1138eaf..cb1900c 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -61,7 +61,7 @@ static const char *const ias_charset_types[] __maybe_unused = {
@@ -158365,7 +158709,7 @@ index 4a7ae32a..bfe8e78 100644
}
/*
-@@ -215,8 +215,10 @@ EXPORT_SYMBOL(iriap_open);
+@@ -219,8 +219,10 @@ EXPORT_SYMBOL(iriap_open);
* Removes (deallocates) the IrIAP instance
*
*/
@@ -158377,7 +158721,7 @@ index 4a7ae32a..bfe8e78 100644
IRDA_ASSERT(self != NULL, return;);
IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
-@@ -942,7 +944,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb)
+@@ -946,7 +948,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb)
* Query has taken too long time, so abort
*
*/
@@ -158800,27 +159144,6 @@ index 7eaa000..2fa7f35 100644
.notifier_call = iucv_cpu_notify,
};
-diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
-index 0b68ba7..48613f5 100644
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -13,6 +13,7 @@
- #include <linux/socket.h>
- #include <linux/uaccess.h>
- #include <linux/workqueue.h>
-+#include <linux/syscalls.h>
- #include <net/kcm.h>
- #include <net/netns/generic.h>
- #include <net/sock.h>
-@@ -2035,7 +2036,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- if (copy_to_user((void __user *)arg, &info,
- sizeof(info))) {
- err = -EFAULT;
-- sock_release(newsock);
-+ sys_close(info.fd);
- }
- }
-
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f9c9ecb..060751e 100644
--- a/net/key/af_key.c
@@ -161297,7 +161620,7 @@ index d3d50da..55e871e 100644
static int sctp_v4_protosw_init(void)
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
-index f69edcf..f015617 100644
+index 10bae22..1d96d9d 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -150,7 +150,7 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc,
@@ -161820,23 +162143,10 @@ index 9d88c62..53396b6 100644
#define gssx_dec_release_handle NULL
#define gssx_enc_get_mic NULL
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
-index e085f5a..c947fa5 100644
+index 4605dc7..c947fa5 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
-@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
- struct rsc *found;
-
- memset(&rsci, 0, sizeof(rsci));
-- rsci.handle.data = handle->data;
-- rsci.handle.len = handle->len;
-+ if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
-+ return NULL;
- found = rsc_lookup(cd, &rsci);
-+ rsc_free(&rsci);
- if (!found)
- return NULL;
- if (cache_check(cd, &found->h, NULL))
-@@ -1141,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+@@ -1142,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
uint64_t *handle)
{
struct rsc rsci, *rscp = NULL;
@@ -161845,7 +162155,7 @@ index e085f5a..c947fa5 100644
long long ctxh;
struct gss_api_mech *gm = NULL;
time_t expiry;
-@@ -1152,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+@@ -1153,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
status = -ENOMEM;
/* the handle needs to be just a unique id,
* use a static counter */
@@ -162384,10 +162694,10 @@ index 0dd0224..36a22a0 100644
sub->evt.event = htohl(event, sub->swap);
sub->evt.found_lower = htohl(found_lower, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 735362c..49c97c7 100644
+index e444fa4..1e5a065 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
-@@ -919,6 +919,12 @@ static struct sock *unix_find_other(struct net *net,
+@@ -920,6 +920,12 @@ static struct sock *unix_find_other(struct net *net,
err = -ECONNREFUSED;
if (!S_ISSOCK(inode->i_mode))
goto put_fail;
@@ -162400,7 +162710,7 @@ index 735362c..49c97c7 100644
u = unix_find_socket_byinode(inode);
if (!u)
goto put_fail;
-@@ -939,6 +945,13 @@ static struct sock *unix_find_other(struct net *net,
+@@ -940,6 +946,13 @@ static struct sock *unix_find_other(struct net *net,
if (u) {
struct dentry *dentry;
dentry = unix_sk(u)->path.dentry;
@@ -162414,27 +162724,27 @@ index 735362c..49c97c7 100644
if (dentry)
touch_atime(&unix_sk(u)->path);
} else
-@@ -960,13 +973,19 @@ static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mo
-
- err = security_path_mknod(path, dentry, mode, 0);
+@@ -973,12 +986,19 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
+ */
+ err = security_path_mknod(&path, dentry, mode, 0);
if (!err) {
-+ if (!gr_acl_handle_mknod(dentry, path->dentry, path->mnt, mode)) {
++ if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
+ err = -EACCES;
+ goto out;
+ }
- err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+ err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
if (!err) {
- res->mnt = mntget(path->mnt);
+ res->mnt = mntget(path.mnt);
res->dentry = dget(dentry);
-+ gr_handle_create(dentry, path->mnt);
++ gr_handle_create(dentry, path.mnt);
}
}
-
++
+out:
+ done_path_create(&path, dentry);
return err;
}
-
-@@ -2811,9 +2830,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2798,9 +2818,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_puts(seq, "Num RefCount Protocol Flags Type St "
"Inode Path\n");
else {
@@ -162449,7 +162759,7 @@ index 735362c..49c97c7 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2838,10 +2861,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2825,10 +2849,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_putc(seq, '@');
i++;
}
@@ -162995,7 +163305,7 @@ index 94c7405..499cca4 100644
int cfg80211_wext_freq(struct iw_freq *freq);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
-index dbb2738e..6a52210 100644
+index 6250b1c..91c4bc4 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -781,8 +781,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
@@ -214594,6 +214904,56 @@ index 552705d..9920f4fb 100644
key = ima_hash_key(entry->digest);
hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
return 0;
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 5adbfc3..17a0610 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -29,6 +29,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/scatterlist.h>
+ #include <linux/ctype.h>
++#include <crypto/aes.h>
+ #include <crypto/hash.h>
+ #include <crypto/sha.h>
+ #include <crypto/skcipher.h>
+@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ struct crypto_skcipher *tfm;
+ struct skcipher_request *req;
+ unsigned int encrypted_datalen;
++ u8 iv[AES_BLOCK_SIZE];
+ unsigned int padlen;
+ char pad[16];
+ int ret;
+@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ sg_init_table(sg_out, 1);
+ sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
+
+- skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+- epayload->iv);
++ memcpy(iv, epayload->iv, sizeof(iv));
++ skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ ret = crypto_skcipher_encrypt(req);
+ tfm = crypto_skcipher_reqtfm(req);
+ skcipher_request_free(req);
+@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ struct crypto_skcipher *tfm;
+ struct skcipher_request *req;
+ unsigned int encrypted_datalen;
++ u8 iv[AES_BLOCK_SIZE];
+ char pad[16];
+ int ret;
+
+@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ epayload->decrypted_datalen);
+ sg_set_buf(&sg_out[1], pad, sizeof pad);
+
+- skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+- epayload->iv);
++ memcpy(iv, epayload->iv, sizeof(iv));
++ skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ ret = crypto_skcipher_decrypt(req);
+ tfm = crypto_skcipher_reqtfm(req);
+ skcipher_request_free(req);
diff --git a/security/keys/internal.h b/security/keys/internal.h
index a705a7d..898c675 100644
--- a/security/keys/internal.h
diff --git a/4.7.4/4425_grsec_remove_EI_PAX.patch b/4.7.5/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.7.4/4425_grsec_remove_EI_PAX.patch
rename to 4.7.5/4425_grsec_remove_EI_PAX.patch
diff --git a/4.7.4/4427_force_XATTR_PAX_tmpfs.patch b/4.7.5/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 4.7.4/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.7.5/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.7.4/4430_grsec-remove-localversion-grsec.patch b/4.7.5/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.7.4/4430_grsec-remove-localversion-grsec.patch
rename to 4.7.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.7.4/4435_grsec-mute-warnings.patch b/4.7.5/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.7.4/4435_grsec-mute-warnings.patch
rename to 4.7.5/4435_grsec-mute-warnings.patch
diff --git a/4.7.4/4440_grsec-remove-protected-paths.patch b/4.7.5/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.7.4/4440_grsec-remove-protected-paths.patch
rename to 4.7.5/4440_grsec-remove-protected-paths.patch
diff --git a/4.7.4/4450_grsec-kconfig-default-gids.patch b/4.7.5/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.7.4/4450_grsec-kconfig-default-gids.patch
rename to 4.7.5/4450_grsec-kconfig-default-gids.patch
diff --git a/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.7.4/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.7.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.7.4/4470_disable-compat_vdso.patch b/4.7.5/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.7.4/4470_disable-compat_vdso.patch
rename to 4.7.5/4470_disable-compat_vdso.patch
diff --git a/4.7.4/4475_emutramp_default_on.patch b/4.7.5/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.7.4/4475_emutramp_default_on.patch
rename to 4.7.5/4475_emutramp_default_on.patch
reply other threads:[~2016-09-28 8:51 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1475052665.e4d3fa8f47469ab0c22a1ce0f78725f0d482c550.blueness@gentoo \
--to=blueness@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox