summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2016-11-16 06:33:25 -0500
committerAnthony G. Basile <blueness@gentoo.org>2016-11-16 06:33:25 -0500
commitfae64feb1320d6a5a606518663f9112458a95e90 (patch)
treeefffef16e3b2ce6a29d46ad69580c0b80d95dbb3
parentgrsecurity-3.1-4.8.7-201611102210 (diff)
downloadhardened-patchset-20161115.tar.gz
hardened-patchset-20161115.tar.bz2
hardened-patchset-20161115.zip
grsecurity-3.1-4.8.8-20161115075620161115
-rw-r--r--4.8.7/1001_linux-4.8.2.patch1841
-rw-r--r--4.8.7/1002_linux-4.8.3.patch125
-rw-r--r--4.8.7/1003_linux-4.8.4.patch2264
-rw-r--r--4.8.7/1004_linux-4.8.5.patch5397
-rw-r--r--4.8.7/1005_linux-4.8.6.patch5137
-rw-r--r--4.8.7/1006_linux-4.8.7.patch4331
-rw-r--r--4.8.8/0000_README (renamed from 4.8.7/0000_README)26
-rw-r--r--4.8.8/1007_linux-4.8.8.patch1846
-rw-r--r--4.8.8/4420_grsecurity-3.1-4.8.8-201611150756.patch (renamed from 4.8.7/4420_grsecurity-3.1-4.8.7-201611102210.patch)197
-rw-r--r--4.8.8/4425_grsec_remove_EI_PAX.patch (renamed from 4.8.7/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--4.8.8/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.8.7/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--4.8.8/4430_grsec-remove-localversion-grsec.patch (renamed from 4.8.7/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--4.8.8/4435_grsec-mute-warnings.patch (renamed from 4.8.7/4435_grsec-mute-warnings.patch)0
-rw-r--r--4.8.8/4440_grsec-remove-protected-paths.patch (renamed from 4.8.7/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--4.8.8/4450_grsec-kconfig-default-gids.patch (renamed from 4.8.7/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--4.8.8/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.8.7/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--4.8.8/4470_disable-compat_vdso.patch (renamed from 4.8.7/4470_disable-compat_vdso.patch)0
-rw-r--r--4.8.8/4475_emutramp_default_on.patch (renamed from 4.8.7/4475_emutramp_default_on.patch)0
18 files changed, 1942 insertions, 19222 deletions
diff --git a/4.8.7/1001_linux-4.8.2.patch b/4.8.7/1001_linux-4.8.2.patch
deleted file mode 100644
index 5e354b2..0000000
--- a/4.8.7/1001_linux-4.8.2.patch
+++ /dev/null
@@ -1,1841 +0,0 @@
-diff --git a/Documentation/virtual/kvm/devices/vcpu.txt b/Documentation/virtual/kvm/devices/vcpu.txt
-index c041658..02f5068 100644
---- a/Documentation/virtual/kvm/devices/vcpu.txt
-+++ b/Documentation/virtual/kvm/devices/vcpu.txt
-@@ -30,4 +30,6 @@ Returns: -ENODEV: PMUv3 not supported
- attribute
- -EBUSY: PMUv3 already initialized
-
--Request the initialization of the PMUv3.
-+Request the initialization of the PMUv3. This must be done after creating the
-+in-kernel irqchip. Creating a PMU with a userspace irqchip is currently not
-+supported.
-diff --git a/Makefile b/Makefile
-index 75db9f3..bf6e44a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 1
-+SUBLEVEL = 2
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arm/boot/dts/armada-390.dtsi b/arch/arm/boot/dts/armada-390.dtsi
-index 094e39c..6cd18d8 100644
---- a/arch/arm/boot/dts/armada-390.dtsi
-+++ b/arch/arm/boot/dts/armada-390.dtsi
-@@ -47,6 +47,8 @@
- #include "armada-39x.dtsi"
-
- / {
-+ compatible = "marvell,armada390";
-+
- soc {
- internal-regs {
- pinctrl@18000 {
-@@ -54,4 +56,5 @@
- reg = <0x18000 0x20>;
- };
- };
-+ };
- };
-diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
-index 74a9b6c..9dc83b0 100644
---- a/arch/arm/boot/dts/qcom-apq8064.dtsi
-+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
-@@ -5,6 +5,7 @@
- #include <dt-bindings/reset/qcom,gcc-msm8960.h>
- #include <dt-bindings/clock/qcom,mmcc-msm8960.h>
- #include <dt-bindings/soc/qcom,gsbi.h>
-+#include <dt-bindings/interrupt-controller/irq.h>
- #include <dt-bindings/interrupt-controller/arm-gic.h>
- / {
- model = "Qualcomm APQ8064";
-@@ -559,22 +560,50 @@
- compatible = "qcom,pm8921-gpio",
- "qcom,ssbi-gpio";
- reg = <0x150>;
-- interrupts = <192 1>, <193 1>, <194 1>,
-- <195 1>, <196 1>, <197 1>,
-- <198 1>, <199 1>, <200 1>,
-- <201 1>, <202 1>, <203 1>,
-- <204 1>, <205 1>, <206 1>,
-- <207 1>, <208 1>, <209 1>,
-- <210 1>, <211 1>, <212 1>,
-- <213 1>, <214 1>, <215 1>,
-- <216 1>, <217 1>, <218 1>,
-- <219 1>, <220 1>, <221 1>,
-- <222 1>, <223 1>, <224 1>,
-- <225 1>, <226 1>, <227 1>,
-- <228 1>, <229 1>, <230 1>,
-- <231 1>, <232 1>, <233 1>,
-- <234 1>, <235 1>;
--
-+ interrupts = <192 IRQ_TYPE_NONE>,
-+ <193 IRQ_TYPE_NONE>,
-+ <194 IRQ_TYPE_NONE>,
-+ <195 IRQ_TYPE_NONE>,
-+ <196 IRQ_TYPE_NONE>,
-+ <197 IRQ_TYPE_NONE>,
-+ <198 IRQ_TYPE_NONE>,
-+ <199 IRQ_TYPE_NONE>,
-+ <200 IRQ_TYPE_NONE>,
-+ <201 IRQ_TYPE_NONE>,
-+ <202 IRQ_TYPE_NONE>,
-+ <203 IRQ_TYPE_NONE>,
-+ <204 IRQ_TYPE_NONE>,
-+ <205 IRQ_TYPE_NONE>,
-+ <206 IRQ_TYPE_NONE>,
-+ <207 IRQ_TYPE_NONE>,
-+ <208 IRQ_TYPE_NONE>,
-+ <209 IRQ_TYPE_NONE>,
-+ <210 IRQ_TYPE_NONE>,
-+ <211 IRQ_TYPE_NONE>,
-+ <212 IRQ_TYPE_NONE>,
-+ <213 IRQ_TYPE_NONE>,
-+ <214 IRQ_TYPE_NONE>,
-+ <215 IRQ_TYPE_NONE>,
-+ <216 IRQ_TYPE_NONE>,
-+ <217 IRQ_TYPE_NONE>,
-+ <218 IRQ_TYPE_NONE>,
-+ <219 IRQ_TYPE_NONE>,
-+ <220 IRQ_TYPE_NONE>,
-+ <221 IRQ_TYPE_NONE>,
-+ <222 IRQ_TYPE_NONE>,
-+ <223 IRQ_TYPE_NONE>,
-+ <224 IRQ_TYPE_NONE>,
-+ <225 IRQ_TYPE_NONE>,
-+ <226 IRQ_TYPE_NONE>,
-+ <227 IRQ_TYPE_NONE>,
-+ <228 IRQ_TYPE_NONE>,
-+ <229 IRQ_TYPE_NONE>,
-+ <230 IRQ_TYPE_NONE>,
-+ <231 IRQ_TYPE_NONE>,
-+ <232 IRQ_TYPE_NONE>,
-+ <233 IRQ_TYPE_NONE>,
-+ <234 IRQ_TYPE_NONE>,
-+ <235 IRQ_TYPE_NONE>;
- gpio-controller;
- #gpio-cells = <2>;
-
-@@ -587,9 +616,18 @@
- gpio-controller;
- #gpio-cells = <2>;
- interrupts =
-- <128 1>, <129 1>, <130 1>, <131 1>,
-- <132 1>, <133 1>, <134 1>, <135 1>,
-- <136 1>, <137 1>, <138 1>, <139 1>;
-+ <128 IRQ_TYPE_NONE>,
-+ <129 IRQ_TYPE_NONE>,
-+ <130 IRQ_TYPE_NONE>,
-+ <131 IRQ_TYPE_NONE>,
-+ <132 IRQ_TYPE_NONE>,
-+ <133 IRQ_TYPE_NONE>,
-+ <134 IRQ_TYPE_NONE>,
-+ <135 IRQ_TYPE_NONE>,
-+ <136 IRQ_TYPE_NONE>,
-+ <137 IRQ_TYPE_NONE>,
-+ <138 IRQ_TYPE_NONE>,
-+ <139 IRQ_TYPE_NONE>;
- };
-
- rtc@11d {
-diff --git a/arch/arm/boot/dts/qcom-msm8660.dtsi b/arch/arm/boot/dts/qcom-msm8660.dtsi
-index acbe71f..8c65e0d 100644
---- a/arch/arm/boot/dts/qcom-msm8660.dtsi
-+++ b/arch/arm/boot/dts/qcom-msm8660.dtsi
-@@ -2,6 +2,7 @@
-
- /include/ "skeleton.dtsi"
-
-+#include <dt-bindings/interrupt-controller/irq.h>
- #include <dt-bindings/interrupt-controller/arm-gic.h>
- #include <dt-bindings/clock/qcom,gcc-msm8660.h>
- #include <dt-bindings/soc/qcom,gsbi.h>
-@@ -159,21 +160,50 @@
- "qcom,ssbi-gpio";
- reg = <0x150>;
- interrupt-parent = <&pmicintc>;
-- interrupts = <192 1>, <193 1>, <194 1>,
-- <195 1>, <196 1>, <197 1>,
-- <198 1>, <199 1>, <200 1>,
-- <201 1>, <202 1>, <203 1>,
-- <204 1>, <205 1>, <206 1>,
-- <207 1>, <208 1>, <209 1>,
-- <210 1>, <211 1>, <212 1>,
-- <213 1>, <214 1>, <215 1>,
-- <216 1>, <217 1>, <218 1>,
-- <219 1>, <220 1>, <221 1>,
-- <222 1>, <223 1>, <224 1>,
-- <225 1>, <226 1>, <227 1>,
-- <228 1>, <229 1>, <230 1>,
-- <231 1>, <232 1>, <233 1>,
-- <234 1>, <235 1>;
-+ interrupts = <192 IRQ_TYPE_NONE>,
-+ <193 IRQ_TYPE_NONE>,
-+ <194 IRQ_TYPE_NONE>,
-+ <195 IRQ_TYPE_NONE>,
-+ <196 IRQ_TYPE_NONE>,
-+ <197 IRQ_TYPE_NONE>,
-+ <198 IRQ_TYPE_NONE>,
-+ <199 IRQ_TYPE_NONE>,
-+ <200 IRQ_TYPE_NONE>,
-+ <201 IRQ_TYPE_NONE>,
-+ <202 IRQ_TYPE_NONE>,
-+ <203 IRQ_TYPE_NONE>,
-+ <204 IRQ_TYPE_NONE>,
-+ <205 IRQ_TYPE_NONE>,
-+ <206 IRQ_TYPE_NONE>,
-+ <207 IRQ_TYPE_NONE>,
-+ <208 IRQ_TYPE_NONE>,
-+ <209 IRQ_TYPE_NONE>,
-+ <210 IRQ_TYPE_NONE>,
-+ <211 IRQ_TYPE_NONE>,
-+ <212 IRQ_TYPE_NONE>,
-+ <213 IRQ_TYPE_NONE>,
-+ <214 IRQ_TYPE_NONE>,
-+ <215 IRQ_TYPE_NONE>,
-+ <216 IRQ_TYPE_NONE>,
-+ <217 IRQ_TYPE_NONE>,
-+ <218 IRQ_TYPE_NONE>,
-+ <219 IRQ_TYPE_NONE>,
-+ <220 IRQ_TYPE_NONE>,
-+ <221 IRQ_TYPE_NONE>,
-+ <222 IRQ_TYPE_NONE>,
-+ <223 IRQ_TYPE_NONE>,
-+ <224 IRQ_TYPE_NONE>,
-+ <225 IRQ_TYPE_NONE>,
-+ <226 IRQ_TYPE_NONE>,
-+ <227 IRQ_TYPE_NONE>,
-+ <228 IRQ_TYPE_NONE>,
-+ <229 IRQ_TYPE_NONE>,
-+ <230 IRQ_TYPE_NONE>,
-+ <231 IRQ_TYPE_NONE>,
-+ <232 IRQ_TYPE_NONE>,
-+ <233 IRQ_TYPE_NONE>,
-+ <234 IRQ_TYPE_NONE>,
-+ <235 IRQ_TYPE_NONE>;
- gpio-controller;
- #gpio-cells = <2>;
-
-@@ -187,9 +217,18 @@
- #gpio-cells = <2>;
- interrupt-parent = <&pmicintc>;
- interrupts =
-- <128 1>, <129 1>, <130 1>, <131 1>,
-- <132 1>, <133 1>, <134 1>, <135 1>,
-- <136 1>, <137 1>, <138 1>, <139 1>;
-+ <128 IRQ_TYPE_NONE>,
-+ <129 IRQ_TYPE_NONE>,
-+ <130 IRQ_TYPE_NONE>,
-+ <131 IRQ_TYPE_NONE>,
-+ <132 IRQ_TYPE_NONE>,
-+ <133 IRQ_TYPE_NONE>,
-+ <134 IRQ_TYPE_NONE>,
-+ <135 IRQ_TYPE_NONE>,
-+ <136 IRQ_TYPE_NONE>,
-+ <137 IRQ_TYPE_NONE>,
-+ <138 IRQ_TYPE_NONE>,
-+ <139 IRQ_TYPE_NONE>;
- };
-
- pwrkey@1c {
-diff --git a/arch/arm/include/asm/delay.h b/arch/arm/include/asm/delay.h
-index b7a4281..b1ce037 100644
---- a/arch/arm/include/asm/delay.h
-+++ b/arch/arm/include/asm/delay.h
-@@ -10,7 +10,7 @@
- #include <asm/param.h> /* HZ */
-
- #define MAX_UDELAY_MS 2
--#define UDELAY_MULT UL(2047 * HZ + 483648 * HZ / 1000000)
-+#define UDELAY_MULT UL(2147 * HZ + 483648 * HZ / 1000000)
- #define UDELAY_SHIFT 31
-
- #ifndef __ASSEMBLY__
-diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
-index d9751a4..d34fd72 100644
---- a/arch/arm64/kernel/stacktrace.c
-+++ b/arch/arm64/kernel/stacktrace.c
-@@ -43,6 +43,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
- unsigned long fp = frame->fp;
- unsigned long irq_stack_ptr;
-
-+ if (!tsk)
-+ tsk = current;
-+
- /*
- * Switching between stacks is valid when tracing current and in
- * non-preemptible context.
-@@ -67,7 +70,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
- frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8));
-
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-- if (tsk && tsk->ret_stack &&
-+ if (tsk->ret_stack &&
- (frame->pc == (unsigned long)return_to_handler)) {
- /*
- * This is a case where function graph tracer has
-diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index e04f838..df06750 100644
---- a/arch/arm64/kernel/traps.c
-+++ b/arch/arm64/kernel/traps.c
-@@ -142,6 +142,11 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
- unsigned long irq_stack_ptr;
- int skip;
-
-+ pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
-+
-+ if (!tsk)
-+ tsk = current;
-+
- /*
- * Switching between stacks is valid when tracing current and in
- * non-preemptible context.
-@@ -151,11 +156,6 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
- else
- irq_stack_ptr = 0;
-
-- pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
--
-- if (!tsk)
-- tsk = current;
--
- if (tsk == current) {
- frame.fp = (unsigned long)__builtin_frame_address(0);
- frame.sp = current_stack_pointer;
-diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
-index e788515..43853ec 100644
---- a/arch/mips/kvm/emulate.c
-+++ b/arch/mips/kvm/emulate.c
-@@ -846,6 +846,47 @@ enum emulation_result kvm_mips_emul_tlbr(struct kvm_vcpu *vcpu)
- return EMULATE_FAIL;
- }
-
-+/**
-+ * kvm_mips_invalidate_guest_tlb() - Indicates a change in guest MMU map.
-+ * @vcpu: VCPU with changed mappings.
-+ * @tlb: TLB entry being removed.
-+ *
-+ * This is called to indicate a single change in guest MMU mappings, so that we
-+ * can arrange TLB flushes on this and other CPUs.
-+ */
-+static void kvm_mips_invalidate_guest_tlb(struct kvm_vcpu *vcpu,
-+ struct kvm_mips_tlb *tlb)
-+{
-+ int cpu, i;
-+ bool user;
-+
-+ /* No need to flush for entries which are already invalid */
-+ if (!((tlb->tlb_lo[0] | tlb->tlb_lo[1]) & ENTRYLO_V))
-+ return;
-+ /* User address space doesn't need flushing for KSeg2/3 changes */
-+ user = tlb->tlb_hi < KVM_GUEST_KSEG0;
-+
-+ preempt_disable();
-+
-+ /*
-+ * Probe the shadow host TLB for the entry being overwritten, if one
-+ * matches, invalidate it
-+ */
-+ kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
-+
-+ /* Invalidate the whole ASID on other CPUs */
-+ cpu = smp_processor_id();
-+ for_each_possible_cpu(i) {
-+ if (i == cpu)
-+ continue;
-+ if (user)
-+ vcpu->arch.guest_user_asid[i] = 0;
-+ vcpu->arch.guest_kernel_asid[i] = 0;
-+ }
-+
-+ preempt_enable();
-+}
-+
- /* Write Guest TLB Entry @ Index */
- enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
- {
-@@ -865,11 +906,8 @@ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
- }
-
- tlb = &vcpu->arch.guest_tlb[index];
-- /*
-- * Probe the shadow host TLB for the entry being overwritten, if one
-- * matches, invalidate it
-- */
-- kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
-+
-+ kvm_mips_invalidate_guest_tlb(vcpu, tlb);
-
- tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
- tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
-@@ -898,11 +936,7 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
-
- tlb = &vcpu->arch.guest_tlb[index];
-
-- /*
-- * Probe the shadow host TLB for the entry being overwritten, if one
-- * matches, invalidate it
-- */
-- kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
-+ kvm_mips_invalidate_guest_tlb(vcpu, tlb);
-
- tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
- tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
-@@ -1026,6 +1060,7 @@ enum emulation_result kvm_mips_emulate_CP0(union mips_instruction inst,
- enum emulation_result er = EMULATE_DONE;
- u32 rt, rd, sel;
- unsigned long curr_pc;
-+ int cpu, i;
-
- /*
- * Update PC and hold onto current PC in case there is
-@@ -1135,8 +1170,16 @@ enum emulation_result kvm_mips_emulate_CP0(union mips_instruction inst,
- & KVM_ENTRYHI_ASID,
- nasid);
-
-+ preempt_disable();
- /* Blow away the shadow host TLBs */
- kvm_mips_flush_host_tlb(1);
-+ cpu = smp_processor_id();
-+ for_each_possible_cpu(i)
-+ if (i != cpu) {
-+ vcpu->arch.guest_user_asid[i] = 0;
-+ vcpu->arch.guest_kernel_asid[i] = 0;
-+ }
-+ preempt_enable();
- }
- kvm_write_c0_guest_entryhi(cop0,
- vcpu->arch.gprs[rt]);
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index f69f40f..978dada 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -737,6 +737,7 @@
- #define MMCR0_FCHV 0x00000001UL /* freeze conditions in hypervisor mode */
- #define SPRN_MMCR1 798
- #define SPRN_MMCR2 785
-+#define SPRN_UMMCR2 769
- #define SPRN_MMCRA 0x312
- #define MMCRA_SDSYNC 0x80000000UL /* SDAR synced with SIAR */
- #define MMCRA_SDAR_DCACHE_MISS 0x40000000UL
-diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
-index 2afdb9c..729f8fa 100644
---- a/arch/powerpc/kvm/book3s_emulate.c
-+++ b/arch/powerpc/kvm/book3s_emulate.c
-@@ -498,6 +498,7 @@ int kvmppc_core_emulate_mtspr_pr(struct kvm_vcpu *vcpu, int sprn, ulong spr_val)
- case SPRN_MMCR0:
- case SPRN_MMCR1:
- case SPRN_MMCR2:
-+ case SPRN_UMMCR2:
- #endif
- break;
- unprivileged:
-@@ -640,6 +641,7 @@ int kvmppc_core_emulate_mfspr_pr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val
- case SPRN_MMCR0:
- case SPRN_MMCR1:
- case SPRN_MMCR2:
-+ case SPRN_UMMCR2:
- case SPRN_TIR:
- #endif
- *spr_val = 0;
-diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
-index 02b4672..df3f270 100644
---- a/arch/powerpc/kvm/booke.c
-+++ b/arch/powerpc/kvm/booke.c
-@@ -2038,7 +2038,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
- if (type == KVMPPC_DEBUG_NONE)
- continue;
-
-- if (type & !(KVMPPC_DEBUG_WATCH_READ |
-+ if (type & ~(KVMPPC_DEBUG_WATCH_READ |
- KVMPPC_DEBUG_WATCH_WRITE |
- KVMPPC_DEBUG_BREAKPOINT))
- return -EINVAL;
-diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
-index ae55a43..19f30a8 100644
---- a/arch/x86/include/asm/fpu/xstate.h
-+++ b/arch/x86/include/asm/fpu/xstate.h
-@@ -27,11 +27,12 @@
- XFEATURE_MASK_YMM | \
- XFEATURE_MASK_OPMASK | \
- XFEATURE_MASK_ZMM_Hi256 | \
-- XFEATURE_MASK_Hi16_ZMM | \
-- XFEATURE_MASK_PKRU)
-+ XFEATURE_MASK_Hi16_ZMM)
-
- /* Supported features which require eager state saving */
--#define XFEATURE_MASK_EAGER (XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR)
-+#define XFEATURE_MASK_EAGER (XFEATURE_MASK_BNDREGS | \
-+ XFEATURE_MASK_BNDCSR | \
-+ XFEATURE_MASK_PKRU)
-
- /* All currently supported features */
- #define XCNTXT_MASK (XFEATURE_MASK_LAZY | XFEATURE_MASK_EAGER)
-diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
-index 6277194..9ae5ab8 100644
---- a/arch/x86/include/asm/intel-family.h
-+++ b/arch/x86/include/asm/intel-family.h
-@@ -56,8 +56,8 @@
- #define INTEL_FAM6_ATOM_SILVERMONT1 0x37 /* BayTrail/BYT / Valleyview */
- #define INTEL_FAM6_ATOM_SILVERMONT2 0x4D /* Avaton/Rangely */
- #define INTEL_FAM6_ATOM_AIRMONT 0x4C /* CherryTrail / Braswell */
--#define INTEL_FAM6_ATOM_MERRIFIELD1 0x4A /* Tangier */
--#define INTEL_FAM6_ATOM_MERRIFIELD2 0x5A /* Annidale */
-+#define INTEL_FAM6_ATOM_MERRIFIELD 0x4A /* Tangier */
-+#define INTEL_FAM6_ATOM_MOOREFIELD 0x5A /* Annidale */
- #define INTEL_FAM6_ATOM_GOLDMONT 0x5C
- #define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */
-
-diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
-index b07233b..c2f94dc 100644
---- a/arch/x86/include/asm/mpspec.h
-+++ b/arch/x86/include/asm/mpspec.h
-@@ -6,7 +6,6 @@
- #include <asm/x86_init.h>
- #include <asm/apicdef.h>
-
--extern int apic_version[];
- extern int pic_mode;
-
- #ifdef CONFIG_X86_32
-@@ -40,6 +39,7 @@ extern int mp_bus_id_to_type[MAX_MP_BUSSES];
- extern DECLARE_BITMAP(mp_bus_not_pci, MAX_MP_BUSSES);
-
- extern unsigned int boot_cpu_physical_apicid;
-+extern u8 boot_cpu_apic_version;
- extern unsigned long mp_lapic_addr;
-
- #ifdef CONFIG_X86_LOCAL_APIC
-diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 90d84c3..fbd1944 100644
---- a/arch/x86/kernel/acpi/boot.c
-+++ b/arch/x86/kernel/acpi/boot.c
-@@ -182,7 +182,7 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled)
- }
-
- if (boot_cpu_physical_apicid != -1U)
-- ver = apic_version[boot_cpu_physical_apicid];
-+ ver = boot_cpu_apic_version;
-
- cpu = generic_processor_info(id, ver);
- if (cpu >= 0)
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index f3e9b2d..076c315 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -64,6 +64,8 @@ unsigned disabled_cpus;
- unsigned int boot_cpu_physical_apicid = -1U;
- EXPORT_SYMBOL_GPL(boot_cpu_physical_apicid);
-
-+u8 boot_cpu_apic_version;
-+
- /*
- * The highest APIC ID seen during enumeration.
- */
-@@ -1816,8 +1818,7 @@ void __init init_apic_mappings(void)
- * since smp_sanity_check is prepared for such a case
- * and disable smp mode
- */
-- apic_version[new_apicid] =
-- GET_APIC_VERSION(apic_read(APIC_LVR));
-+ boot_cpu_apic_version = GET_APIC_VERSION(apic_read(APIC_LVR));
- }
- }
-
-@@ -1832,13 +1833,10 @@ void __init register_lapic_address(unsigned long address)
- }
- if (boot_cpu_physical_apicid == -1U) {
- boot_cpu_physical_apicid = read_apic_id();
-- apic_version[boot_cpu_physical_apicid] =
-- GET_APIC_VERSION(apic_read(APIC_LVR));
-+ boot_cpu_apic_version = GET_APIC_VERSION(apic_read(APIC_LVR));
- }
- }
-
--int apic_version[MAX_LOCAL_APIC];
--
- /*
- * Local APIC interrupts
- */
-@@ -2130,11 +2128,10 @@ int generic_processor_info(int apicid, int version)
- cpu, apicid);
- version = 0x10;
- }
-- apic_version[apicid] = version;
-
-- if (version != apic_version[boot_cpu_physical_apicid]) {
-+ if (version != boot_cpu_apic_version) {
- pr_warning("BIOS bug: APIC version mismatch, boot CPU: %x, CPU %d: version %x\n",
-- apic_version[boot_cpu_physical_apicid], cpu, version);
-+ boot_cpu_apic_version, cpu, version);
- }
-
- physid_set(apicid, phys_cpu_present_map);
-@@ -2277,7 +2274,7 @@ int __init APIC_init_uniprocessor(void)
- * Complain if the BIOS pretends there is one.
- */
- if (!boot_cpu_has(X86_FEATURE_APIC) &&
-- APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
-+ APIC_INTEGRATED(boot_cpu_apic_version)) {
- pr_err("BIOS bug, local APIC 0x%x not detected!...\n",
- boot_cpu_physical_apicid);
- return -1;
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 7491f41..48e6d84 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -1593,7 +1593,7 @@ void __init setup_ioapic_ids_from_mpc(void)
- * no meaning without the serial APIC bus.
- */
- if (!(boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
-- || APIC_XAPIC(apic_version[boot_cpu_physical_apicid]))
-+ || APIC_XAPIC(boot_cpu_apic_version))
- return;
- setup_ioapic_ids_from_mpc_nocheck();
- }
-@@ -2423,7 +2423,7 @@ static int io_apic_get_unique_id(int ioapic, int apic_id)
- static u8 io_apic_unique_id(int idx, u8 id)
- {
- if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
-- !APIC_XAPIC(apic_version[boot_cpu_physical_apicid]))
-+ !APIC_XAPIC(boot_cpu_apic_version))
- return io_apic_get_unique_id(idx, id);
- else
- return id;
-diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
-index 7c43e71..5630962 100644
---- a/arch/x86/kernel/apic/probe_32.c
-+++ b/arch/x86/kernel/apic/probe_32.c
-@@ -152,7 +152,7 @@ early_param("apic", parse_apic);
-
- void __init default_setup_apic_routing(void)
- {
-- int version = apic_version[boot_cpu_physical_apicid];
-+ int version = boot_cpu_apic_version;
-
- if (num_possible_cpus() > 8) {
- switch (boot_cpu_data.x86_vendor) {
-diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
-index 6066d94..5d30c5e 100644
---- a/arch/x86/kernel/apic/vector.c
-+++ b/arch/x86/kernel/apic/vector.c
-@@ -661,11 +661,28 @@ void irq_complete_move(struct irq_cfg *cfg)
- */
- void irq_force_complete_move(struct irq_desc *desc)
- {
-- struct irq_data *irqdata = irq_desc_get_irq_data(desc);
-- struct apic_chip_data *data = apic_chip_data(irqdata);
-- struct irq_cfg *cfg = data ? &data->cfg : NULL;
-+ struct irq_data *irqdata;
-+ struct apic_chip_data *data;
-+ struct irq_cfg *cfg;
- unsigned int cpu;
-
-+ /*
-+ * The function is called for all descriptors regardless of which
-+ * irqdomain they belong to. For example if an IRQ is provided by
-+ * an irq_chip as part of a GPIO driver, the chip data for that
-+ * descriptor is specific to the irq_chip in question.
-+ *
-+ * Check first that the chip_data is what we expect
-+ * (apic_chip_data) before touching it any further.
-+ */
-+ irqdata = irq_domain_get_irq_data(x86_vector_domain,
-+ irq_desc_get_irq(desc));
-+ if (!irqdata)
-+ return;
-+
-+ data = apic_chip_data(irqdata);
-+ cfg = data ? &data->cfg : NULL;
-+
- if (!cfg)
- return;
-
-diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
-index 621b501..8a90f15 100644
---- a/arch/x86/kernel/e820.c
-+++ b/arch/x86/kernel/e820.c
-@@ -348,7 +348,7 @@ int __init sanitize_e820_map(struct e820entry *biosmap, int max_nr_map,
- * continue building up new bios map based on this
- * information
- */
-- if (current_type != last_type || current_type == E820_PRAM) {
-+ if (current_type != last_type) {
- if (last_type != 0) {
- new_bios[new_bios_entry].size =
- change_point[chgidx]->addr - last_addr;
-@@ -754,7 +754,7 @@ u64 __init early_reserve_e820(u64 size, u64 align)
- /*
- * Find the highest page frame number we have available
- */
--static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
-+static unsigned long __init e820_end_pfn(unsigned long limit_pfn, unsigned type)
- {
- int i;
- unsigned long last_pfn = 0;
-@@ -765,11 +765,7 @@ static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
- unsigned long start_pfn;
- unsigned long end_pfn;
-
-- /*
-- * Persistent memory is accounted as ram for purposes of
-- * establishing max_pfn and mem_map.
-- */
-- if (ei->type != E820_RAM && ei->type != E820_PRAM)
-+ if (ei->type != type)
- continue;
-
- start_pfn = ei->addr >> PAGE_SHIFT;
-@@ -794,12 +790,12 @@ static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
- }
- unsigned long __init e820_end_of_ram_pfn(void)
- {
-- return e820_end_pfn(MAX_ARCH_PFN);
-+ return e820_end_pfn(MAX_ARCH_PFN, E820_RAM);
- }
-
- unsigned long __init e820_end_of_low_ram_pfn(void)
- {
-- return e820_end_pfn(1UL << (32-PAGE_SHIFT));
-+ return e820_end_pfn(1UL << (32 - PAGE_SHIFT), E820_RAM);
- }
-
- static void early_panic(char *msg)
-diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 63236d8..a21068e 100644
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -110,12 +110,13 @@ void __show_regs(struct pt_regs *regs, int all)
- get_debugreg(d7, 7);
-
- /* Only print out debug registers if they are in their non-default state. */
-- if ((d0 == 0) && (d1 == 0) && (d2 == 0) && (d3 == 0) &&
-- (d6 == DR6_RESERVED) && (d7 == 0x400))
-- return;
--
-- printk(KERN_DEFAULT "DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
-- printk(KERN_DEFAULT "DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
-+ if (!((d0 == 0) && (d1 == 0) && (d2 == 0) && (d3 == 0) &&
-+ (d6 == DR6_RESERVED) && (d7 == 0x400))) {
-+ printk(KERN_DEFAULT "DR0: %016lx DR1: %016lx DR2: %016lx\n",
-+ d0, d1, d2);
-+ printk(KERN_DEFAULT "DR3: %016lx DR6: %016lx DR7: %016lx\n",
-+ d3, d6, d7);
-+ }
-
- if (boot_cpu_has(X86_FEATURE_OSPKE))
- printk(KERN_DEFAULT "PKRU: %08x\n", read_pkru());
-diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index f79576a..a1606ea 100644
---- a/arch/x86/kernel/ptrace.c
-+++ b/arch/x86/kernel/ptrace.c
-@@ -173,8 +173,8 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
- return sp;
-
- prev_esp = (u32 *)(context);
-- if (prev_esp)
-- return (unsigned long)prev_esp;
-+ if (*prev_esp)
-+ return (unsigned long)*prev_esp;
-
- return (unsigned long)regs;
- }
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 4296beb..82b1737 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -690,7 +690,7 @@ wakeup_secondary_cpu_via_nmi(int apicid, unsigned long start_eip)
- * Give the other CPU some time to accept the IPI.
- */
- udelay(200);
-- if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
-+ if (APIC_INTEGRATED(boot_cpu_apic_version)) {
- maxlvt = lapic_get_maxlvt();
- if (maxlvt > 3) /* Due to the Pentium erratum 3AP. */
- apic_write(APIC_ESR, 0);
-@@ -717,7 +717,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
- /*
- * Be paranoid about clearing APIC errors.
- */
-- if (APIC_INTEGRATED(apic_version[phys_apicid])) {
-+ if (APIC_INTEGRATED(boot_cpu_apic_version)) {
- if (maxlvt > 3) /* Due to the Pentium erratum 3AP. */
- apic_write(APIC_ESR, 0);
- apic_read(APIC_ESR);
-@@ -756,7 +756,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
- * Determine this based on the APIC version.
- * If we don't have an integrated APIC, don't send the STARTUP IPIs.
- */
-- if (APIC_INTEGRATED(apic_version[phys_apicid]))
-+ if (APIC_INTEGRATED(boot_cpu_apic_version))
- num_starts = 2;
- else
- num_starts = 0;
-@@ -994,7 +994,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
- /*
- * Be paranoid about clearing APIC errors.
- */
-- if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
-+ if (APIC_INTEGRATED(boot_cpu_apic_version)) {
- apic_write(APIC_ESR, 0);
- apic_read(APIC_ESR);
- }
-@@ -1249,7 +1249,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
- /*
- * If we couldn't find a local APIC, then get out of here now!
- */
-- if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid]) &&
-+ if (APIC_INTEGRATED(boot_cpu_apic_version) &&
- !boot_cpu_has(X86_FEATURE_APIC)) {
- if (!disable_apic) {
- pr_err("BIOS bug, local APIC #%d not detected!...\n",
-@@ -1406,9 +1406,21 @@ __init void prefill_possible_map(void)
- {
- int i, possible;
-
-- /* no processor from mptable or madt */
-- if (!num_processors)
-- num_processors = 1;
-+ /* No boot processor was found in mptable or ACPI MADT */
-+ if (!num_processors) {
-+ int apicid = boot_cpu_physical_apicid;
-+ int cpu = hard_smp_processor_id();
-+
-+ pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
-+
-+ /* Make sure boot cpu is enumerated */
-+ if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
-+ apic->apic_id_valid(apicid))
-+ generic_processor_info(apicid, boot_cpu_apic_version);
-+
-+ if (!num_processors)
-+ num_processors = 1;
-+ }
-
- i = setup_max_cpus ?: 1;
- if (setup_possible_cpus == -1) {
-diff --git a/arch/x86/platform/atom/punit_atom_debug.c b/arch/x86/platform/atom/punit_atom_debug.c
-index 8ff7b93..d49d3be 100644
---- a/arch/x86/platform/atom/punit_atom_debug.c
-+++ b/arch/x86/platform/atom/punit_atom_debug.c
-@@ -155,7 +155,7 @@ static void punit_dbgfs_unregister(void)
-
- static const struct x86_cpu_id intel_punit_cpu_ids[] = {
- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, punit_device_byt),
-- ICPU(INTEL_FAM6_ATOM_MERRIFIELD1, punit_device_tng),
-+ ICPU(INTEL_FAM6_ATOM_MERRIFIELD, punit_device_tng),
- ICPU(INTEL_FAM6_ATOM_AIRMONT, punit_device_cht),
- {}
- };
-diff --git a/arch/x86/platform/intel-mid/pwr.c b/arch/x86/platform/intel-mid/pwr.c
-index c901a34..6eca0f6 100644
---- a/arch/x86/platform/intel-mid/pwr.c
-+++ b/arch/x86/platform/intel-mid/pwr.c
-@@ -354,7 +354,7 @@ static int mid_pwr_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- return 0;
- }
-
--static int mid_set_initial_state(struct mid_pwr *pwr)
-+static int mid_set_initial_state(struct mid_pwr *pwr, const u32 *states)
- {
- unsigned int i, j;
- int ret;
-@@ -379,10 +379,10 @@ static int mid_set_initial_state(struct mid_pwr *pwr)
- * NOTE: The actual device mapping is provided by a platform at run
- * time using vendor capability of PCI configuration space.
- */
-- mid_pwr_set_state(pwr, 0, 0xffffffff);
-- mid_pwr_set_state(pwr, 1, 0xffffffff);
-- mid_pwr_set_state(pwr, 2, 0xffffffff);
-- mid_pwr_set_state(pwr, 3, 0xffffffff);
-+ mid_pwr_set_state(pwr, 0, states[0]);
-+ mid_pwr_set_state(pwr, 1, states[1]);
-+ mid_pwr_set_state(pwr, 2, states[2]);
-+ mid_pwr_set_state(pwr, 3, states[3]);
-
- /* Send command to SCU */
- ret = mid_pwr_wait_for_cmd(pwr, CMD_SET_CFG);
-@@ -397,13 +397,41 @@ static int mid_set_initial_state(struct mid_pwr *pwr)
- return 0;
- }
-
--static const struct mid_pwr_device_info mid_info = {
-- .set_initial_state = mid_set_initial_state,
-+static int pnw_set_initial_state(struct mid_pwr *pwr)
-+{
-+ /* On Penwell SRAM must stay powered on */
-+ const u32 states[] = {
-+ 0xf00fffff, /* PM_SSC(0) */
-+ 0xffffffff, /* PM_SSC(1) */
-+ 0xffffffff, /* PM_SSC(2) */
-+ 0xffffffff, /* PM_SSC(3) */
-+ };
-+ return mid_set_initial_state(pwr, states);
-+}
-+
-+static int tng_set_initial_state(struct mid_pwr *pwr)
-+{
-+ const u32 states[] = {
-+ 0xffffffff, /* PM_SSC(0) */
-+ 0xffffffff, /* PM_SSC(1) */
-+ 0xffffffff, /* PM_SSC(2) */
-+ 0xffffffff, /* PM_SSC(3) */
-+ };
-+ return mid_set_initial_state(pwr, states);
-+}
-+
-+static const struct mid_pwr_device_info pnw_info = {
-+ .set_initial_state = pnw_set_initial_state,
-+};
-+
-+static const struct mid_pwr_device_info tng_info = {
-+ .set_initial_state = tng_set_initial_state,
- };
-
-+/* This table should be in sync with the one in drivers/pci/pci-mid.c */
- static const struct pci_device_id mid_pwr_pci_ids[] = {
-- { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PENWELL), (kernel_ulong_t)&mid_info },
-- { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_TANGIER), (kernel_ulong_t)&mid_info },
-+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PENWELL), (kernel_ulong_t)&pnw_info },
-+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_TANGIER), (kernel_ulong_t)&tng_info },
- {}
- };
-
-diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 0b4d04c..6228403 100644
---- a/arch/x86/xen/smp.c
-+++ b/arch/x86/xen/smp.c
-@@ -87,6 +87,12 @@ static void cpu_bringup(void)
- cpu_data(cpu).x86_max_cores = 1;
- set_cpu_sibling_map(cpu);
-
-+ /*
-+ * identify_cpu() may have set logical_pkg_id to -1 due
-+ * to incorrect phys_proc_id. Let's re-comupte it.
-+ */
-+ topology_update_package_map(apic->cpu_present_to_apicid(cpu), cpu);
-+
- xen_setup_cpu_clockevents();
-
- notify_cpu_starting(cpu);
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 811f9b9..d4d55f6 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -251,6 +251,7 @@ static const struct usb_device_id blacklist_table[] = {
- { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
- { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
- { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
-+ { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
-
- /* Broadcom BCM2035 */
- { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
-diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c
-index f5d4521..912ad30 100644
---- a/drivers/char/tpm/tpm-dev.c
-+++ b/drivers/char/tpm/tpm-dev.c
-@@ -145,7 +145,7 @@ static ssize_t tpm_write(struct file *file, const char __user *buf,
- return -EPIPE;
- }
- out_size = tpm_transmit(priv->chip, priv->data_buffer,
-- sizeof(priv->data_buffer));
-+ sizeof(priv->data_buffer), 0);
-
- tpm_put_ops(priv->chip);
- if (out_size < 0) {
-diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
-index 1abe2d7..aef20ee 100644
---- a/drivers/char/tpm/tpm-interface.c
-+++ b/drivers/char/tpm/tpm-interface.c
-@@ -330,8 +330,8 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
- /*
- * Internal kernel interface to transmit TPM commands
- */
--ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
-- size_t bufsiz)
-+ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
-+ unsigned int flags)
- {
- ssize_t rc;
- u32 count, ordinal;
-@@ -350,7 +350,8 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- return -E2BIG;
- }
-
-- mutex_lock(&chip->tpm_mutex);
-+ if (!(flags & TPM_TRANSMIT_UNLOCKED))
-+ mutex_lock(&chip->tpm_mutex);
-
- rc = chip->ops->send(chip, (u8 *) buf, count);
- if (rc < 0) {
-@@ -393,20 +394,21 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
- dev_err(&chip->dev,
- "tpm_transmit: tpm_recv: error %zd\n", rc);
- out:
-- mutex_unlock(&chip->tpm_mutex);
-+ if (!(flags & TPM_TRANSMIT_UNLOCKED))
-+ mutex_unlock(&chip->tpm_mutex);
- return rc;
- }
-
- #define TPM_DIGEST_SIZE 20
- #define TPM_RET_CODE_IDX 6
-
--ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd,
-- int len, const char *desc)
-+ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd,
-+ int len, unsigned int flags, const char *desc)
- {
-- struct tpm_output_header *header;
-+ const struct tpm_output_header *header;
- int err;
-
-- len = tpm_transmit(chip, (u8 *) cmd, len);
-+ len = tpm_transmit(chip, (const u8 *)cmd, len, flags);
- if (len < 0)
- return len;
- else if (len < TPM_HEADER_SIZE)
-@@ -453,7 +455,8 @@ ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap,
- tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
- tpm_cmd.params.getcap_in.subcap = subcap_id;
- }
-- rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);
-+ rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
-+ desc);
- if (!rc)
- *cap = tpm_cmd.params.getcap_out.cap;
- return rc;
-@@ -469,7 +472,7 @@ void tpm_gen_interrupt(struct tpm_chip *chip)
- tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
- tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
-
-- rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
- "attempting to determine the timeouts");
- }
- EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
-@@ -490,7 +493,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
- start_cmd.header.in = tpm_startup_header;
-
- start_cmd.params.startup_in.startup_type = startup_type;
-- return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE,
-+ return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
- "attempting to start the TPM");
- }
-
-@@ -521,7 +524,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
- tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
- tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
- tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
-- rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, NULL);
-+ rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
-+ NULL);
-
- if (rc == TPM_ERR_INVALID_POSTINIT) {
- /* The TPM is not started, we are the first to talk to it.
-@@ -535,7 +539,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
- tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
- tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
- rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
-- NULL);
-+ 0, NULL);
- }
- if (rc) {
- dev_err(&chip->dev,
-@@ -596,7 +600,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
- tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
- tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
-
-- rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
- "attempting to determine the durations");
- if (rc)
- return rc;
-@@ -652,7 +656,7 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
- struct tpm_cmd_t cmd;
-
- cmd.header.in = continue_selftest_header;
-- rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE, 0,
- "continue selftest");
- return rc;
- }
-@@ -672,7 +676,7 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
-
- cmd.header.in = pcrread_header;
- cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
-- rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, 0,
- "attempting to read a pcr value");
-
- if (rc == 0)
-@@ -770,7 +774,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
- cmd.header.in = pcrextend_header;
- cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
- memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
-- rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
- "attempting extend a PCR value");
-
- tpm_put_ops(chip);
-@@ -809,7 +813,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
- /* Attempt to read a PCR value */
- cmd.header.in = pcrread_header;
- cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);
-- rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE);
-+ rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE, 0);
- /* Some buggy TPMs will not respond to tpm_tis_ready() for
- * around 300ms while the self test is ongoing, keep trying
- * until the self test duration expires. */
-@@ -879,7 +883,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
- if (chip == NULL)
- return -ENODEV;
-
-- rc = tpm_transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");
-+ rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd");
-
- tpm_put_ops(chip);
- return rc;
-@@ -981,14 +985,15 @@ int tpm_pm_suspend(struct device *dev)
- cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
- memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
- TPM_DIGEST_SIZE);
-- rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
-+ rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
- "extending dummy pcr before suspend");
- }
-
- /* now do the actual savestate */
- for (try = 0; try < TPM_RETRY; try++) {
- cmd.header.in = savestate_header;
-- rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
-+ rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, 0,
-+ NULL);
-
- /*
- * If the TPM indicates that it is too busy to respond to
-@@ -1072,8 +1077,8 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
- tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
-
- err = tpm_transmit_cmd(chip, &tpm_cmd,
-- TPM_GETRANDOM_RESULT_SIZE + num_bytes,
-- "attempting get random");
-+ TPM_GETRANDOM_RESULT_SIZE + num_bytes,
-+ 0, "attempting get random");
- if (err)
- break;
-
-diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
-index b46cf70..e1f7236 100644
---- a/drivers/char/tpm/tpm-sysfs.c
-+++ b/drivers/char/tpm/tpm-sysfs.c
-@@ -39,7 +39,7 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
- struct tpm_chip *chip = to_tpm_chip(dev);
-
- tpm_cmd.header.in = tpm_readpubek_header;
-- err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
-+ err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
- "attempting to read the PUBEK");
- if (err)
- goto out;
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 3e32d5b..b0585e9 100644
---- a/drivers/char/tpm/tpm.h
-+++ b/drivers/char/tpm/tpm.h
-@@ -476,12 +476,16 @@ extern dev_t tpm_devt;
- extern const struct file_operations tpm_fops;
- extern struct idr dev_nums_idr;
-
-+enum tpm_transmit_flags {
-+ TPM_TRANSMIT_UNLOCKED = BIT(0),
-+};
-+
-+ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
-+ unsigned int flags);
-+ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,
-+ unsigned int flags, const char *desc);
- ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap,
- const char *desc);
--ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
-- size_t bufsiz);
--ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len,
-- const char *desc);
- extern int tpm_get_timeouts(struct tpm_chip *);
- extern void tpm_gen_interrupt(struct tpm_chip *);
- int tpm1_auto_startup(struct tpm_chip *chip);
-diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
-index 0c75c3f..ef5a58b 100644
---- a/drivers/char/tpm/tpm2-cmd.c
-+++ b/drivers/char/tpm/tpm2-cmd.c
-@@ -282,7 +282,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
- sizeof(cmd.params.pcrread_in.pcr_select));
- cmd.params.pcrread_in.pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
-
-- rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
-+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
- "attempting to read a pcr value");
- if (rc == 0) {
- buf = cmd.params.pcrread_out.digest;
-@@ -330,7 +330,7 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash)
- cmd.params.pcrextend_in.hash_alg = cpu_to_be16(TPM2_ALG_SHA1);
- memcpy(cmd.params.pcrextend_in.digest, hash, TPM_DIGEST_SIZE);
-
-- rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
-+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
- "attempting extend a PCR value");
-
- return rc;
-@@ -376,7 +376,7 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
- cmd.header.in = tpm2_getrandom_header;
- cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
-
-- err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
-+ err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
- "attempting get random");
- if (err)
- break;
-@@ -434,12 +434,12 @@ static void tpm2_buf_append_auth(struct tpm_buf *buf, u32 session_handle,
- }
-
- /**
-- * tpm2_seal_trusted() - seal a trusted key
-- * @chip_num: A specific chip number for the request or TPM_ANY_NUM
-- * @options: authentication values and other options
-+ * tpm2_seal_trusted() - seal the payload of a trusted key
-+ * @chip_num: TPM chip to use
- * @payload: the key data in clear and encrypted form
-+ * @options: authentication values and other options
- *
-- * Returns < 0 on error and 0 on success.
-+ * Return: < 0 on error and 0 on success.
- */
- int tpm2_seal_trusted(struct tpm_chip *chip,
- struct trusted_key_payload *payload,
-@@ -512,7 +512,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
- goto out;
- }
-
-- rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "sealing data");
-+ rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, "sealing data");
- if (rc)
- goto out;
-
-@@ -538,10 +538,18 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
- return rc;
- }
-
--static int tpm2_load(struct tpm_chip *chip,
-- struct trusted_key_payload *payload,
-- struct trusted_key_options *options,
-- u32 *blob_handle)
-+/**
-+ * tpm2_load_cmd() - execute a TPM2_Load command
-+ * @chip_num: TPM chip to use
-+ * @payload: the key data in clear and encrypted form
-+ * @options: authentication values and other options
-+ *
-+ * Return: same as with tpm_transmit_cmd
-+ */
-+static int tpm2_load_cmd(struct tpm_chip *chip,
-+ struct trusted_key_payload *payload,
-+ struct trusted_key_options *options,
-+ u32 *blob_handle, unsigned int flags)
- {
- struct tpm_buf buf;
- unsigned int private_len;
-@@ -576,7 +584,7 @@ static int tpm2_load(struct tpm_chip *chip,
- goto out;
- }
-
-- rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "loading blob");
-+ rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "loading blob");
- if (!rc)
- *blob_handle = be32_to_cpup(
- (__be32 *) &buf.data[TPM_HEADER_SIZE]);
-@@ -590,7 +598,16 @@ static int tpm2_load(struct tpm_chip *chip,
- return rc;
- }
-
--static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
-+/**
-+ * tpm2_flush_context_cmd() - execute a TPM2_FlushContext command
-+ * @chip_num: TPM chip to use
-+ * @payload: the key data in clear and encrypted form
-+ * @options: authentication values and other options
-+ *
-+ * Return: same as with tpm_transmit_cmd
-+ */
-+static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
-+ unsigned int flags)
- {
- struct tpm_buf buf;
- int rc;
-@@ -604,7 +621,8 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
-
- tpm_buf_append_u32(&buf, handle);
-
-- rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "flushing context");
-+ rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags,
-+ "flushing context");
- if (rc)
- dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle,
- rc);
-@@ -612,10 +630,18 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
- tpm_buf_destroy(&buf);
- }
-
--static int tpm2_unseal(struct tpm_chip *chip,
-- struct trusted_key_payload *payload,
-- struct trusted_key_options *options,
-- u32 blob_handle)
-+/**
-+ * tpm2_unseal_cmd() - execute a TPM2_Unload command
-+ * @chip_num: TPM chip to use
-+ * @payload: the key data in clear and encrypted form
-+ * @options: authentication values and other options
-+ *
-+ * Return: same as with tpm_transmit_cmd
-+ */
-+static int tpm2_unseal_cmd(struct tpm_chip *chip,
-+ struct trusted_key_payload *payload,
-+ struct trusted_key_options *options,
-+ u32 blob_handle, unsigned int flags)
- {
- struct tpm_buf buf;
- u16 data_len;
-@@ -635,7 +661,7 @@ static int tpm2_unseal(struct tpm_chip *chip,
- options->blobauth /* hmac */,
- TPM_DIGEST_SIZE);
-
-- rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "unsealing");
-+ rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "unsealing");
- if (rc > 0)
- rc = -EPERM;
-
-@@ -654,12 +680,12 @@ static int tpm2_unseal(struct tpm_chip *chip,
- }
-
- /**
-- * tpm_unseal_trusted() - unseal a trusted key
-- * @chip_num: A specific chip number for the request or TPM_ANY_NUM
-- * @options: authentication values and other options
-+ * tpm_unseal_trusted() - unseal the payload of a trusted key
-+ * @chip_num: TPM chip to use
- * @payload: the key data in clear and encrypted form
-+ * @options: authentication values and other options
- *
-- * Returns < 0 on error and 0 on success.
-+ * Return: < 0 on error and 0 on success.
- */
- int tpm2_unseal_trusted(struct tpm_chip *chip,
- struct trusted_key_payload *payload,
-@@ -668,14 +694,17 @@ int tpm2_unseal_trusted(struct tpm_chip *chip,
- u32 blob_handle;
- int rc;
-
-- rc = tpm2_load(chip, payload, options, &blob_handle);
-+ mutex_lock(&chip->tpm_mutex);
-+ rc = tpm2_load_cmd(chip, payload, options, &blob_handle,
-+ TPM_TRANSMIT_UNLOCKED);
- if (rc)
-- return rc;
--
-- rc = tpm2_unseal(chip, payload, options, blob_handle);
--
-- tpm2_flush_context(chip, blob_handle);
-+ goto out;
-
-+ rc = tpm2_unseal_cmd(chip, payload, options, blob_handle,
-+ TPM_TRANSMIT_UNLOCKED);
-+ tpm2_flush_context_cmd(chip, blob_handle, TPM_TRANSMIT_UNLOCKED);
-+out:
-+ mutex_unlock(&chip->tpm_mutex);
- return rc;
- }
-
-@@ -701,7 +730,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value,
- cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
- cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
-
-- rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
-+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, desc);
- if (!rc)
- *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
-
-@@ -735,7 +764,7 @@ static int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
- cmd.header.in = tpm2_startup_header;
-
- cmd.params.startup_in.startup_type = cpu_to_be16(startup_type);
-- return tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
-+ return tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
- "attempting to start the TPM");
- }
-
-@@ -763,7 +792,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
- cmd.header.in = tpm2_shutdown_header;
- cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
-
-- rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), "stopping the TPM");
-+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, "stopping the TPM");
-
- /* In places where shutdown command is sent there's no much we can do
- * except print the error code on a system failure.
-@@ -828,7 +857,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
- cmd.header.in = tpm2_selftest_header;
- cmd.params.selftest_in.full_test = full;
-
-- rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE,
-+ rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE, 0,
- "continue selftest");
-
- /* At least some prototype chips seem to give RC_TESTING error
-@@ -880,7 +909,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
- cmd.params.pcrread_in.pcr_select[1] = 0x00;
- cmd.params.pcrread_in.pcr_select[2] = 0x00;
-
-- rc = tpm_transmit_cmd(chip, (u8 *) &cmd, sizeof(cmd), NULL);
-+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, NULL);
- if (rc < 0)
- break;
-
-@@ -928,7 +957,7 @@ int tpm2_probe(struct tpm_chip *chip)
- cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
- cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
-
-- rc = tpm_transmit(chip, (const char *) &cmd, sizeof(cmd));
-+ rc = tpm_transmit(chip, (const u8 *)&cmd, sizeof(cmd), 0);
- if (rc < 0)
- return rc;
- else if (rc < TPM_HEADER_SIZE)
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index 018c3825..1801f38 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -142,6 +142,11 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t len)
- struct crb_priv *priv = dev_get_drvdata(&chip->dev);
- int rc = 0;
-
-+ /* Zero the cancel register so that the next command will not get
-+ * canceled.
-+ */
-+ iowrite32(0, &priv->cca->cancel);
-+
- if (len > ioread32(&priv->cca->cmd_size)) {
- dev_err(&chip->dev,
- "invalid command count value %x %zx\n",
-@@ -175,8 +180,6 @@ static void crb_cancel(struct tpm_chip *chip)
-
- if ((priv->flags & CRB_FL_ACPI_START) && crb_do_acpi_start(chip))
- dev_err(&chip->dev, "ACPI Start failed\n");
--
-- iowrite32(0, &priv->cca->cancel);
- }
-
- static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
-diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
-index 4ba3d3f..f440d38 100644
---- a/drivers/cpuidle/cpuidle-arm.c
-+++ b/drivers/cpuidle/cpuidle-arm.c
-@@ -121,6 +121,7 @@ static int __init arm_idle_init(void)
- dev = kzalloc(sizeof(*dev), GFP_KERNEL);
- if (!dev) {
- pr_err("Failed to allocate cpuidle device\n");
-+ ret = -ENOMEM;
- goto out_fail;
- }
- dev->cpu = cpu;
-diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
-index 2d1fb64..580f4f2 100644
---- a/drivers/mfd/Kconfig
-+++ b/drivers/mfd/Kconfig
-@@ -1549,6 +1549,7 @@ config MFD_WM8350
- config MFD_WM8350_I2C
- bool "Wolfson Microelectronics WM8350 with I2C"
- select MFD_WM8350
-+ select REGMAP_I2C
- depends on I2C=y
- help
- The WM8350 is an integrated audio and power management
-diff --git a/drivers/mfd/atmel-hlcdc.c b/drivers/mfd/atmel-hlcdc.c
-index eca7ea6..4b15b08 100644
---- a/drivers/mfd/atmel-hlcdc.c
-+++ b/drivers/mfd/atmel-hlcdc.c
-@@ -50,8 +50,9 @@ static int regmap_atmel_hlcdc_reg_write(void *context, unsigned int reg,
- if (reg <= ATMEL_HLCDC_DIS) {
- u32 status;
-
-- readl_poll_timeout(hregmap->regs + ATMEL_HLCDC_SR, status,
-- !(status & ATMEL_HLCDC_SIP), 1, 100);
-+ readl_poll_timeout_atomic(hregmap->regs + ATMEL_HLCDC_SR,
-+ status, !(status & ATMEL_HLCDC_SIP),
-+ 1, 100);
- }
-
- writel(val, hregmap->regs + reg);
-diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
-index dbd907d..691dab7 100644
---- a/drivers/mfd/rtsx_usb.c
-+++ b/drivers/mfd/rtsx_usb.c
-@@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsigned long data)
-
- dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__);
- usb_sg_cancel(&ucr->current_sg);
--
-- /* we know the cancellation is caused by time-out */
-- ucr->current_sg.status = -ETIMEDOUT;
- }
-
- static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
-@@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
- ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
- add_timer(&ucr->sg_timer);
- usb_sg_wait(&ucr->current_sg);
-- del_timer_sync(&ucr->sg_timer);
-+ if (!del_timer_sync(&ucr->sg_timer))
-+ ret = -ETIMEDOUT;
-+ else
-+ ret = ucr->current_sg.status;
-
- if (act_len)
- *act_len = ucr->current_sg.bytes;
-
-- return ucr->current_sg.status;
-+ return ret;
- }
-
- int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,
-diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
-index c878aa7..55f453d 100644
---- a/drivers/pci/pci-mid.c
-+++ b/drivers/pci/pci-mid.c
-@@ -60,8 +60,13 @@ static struct pci_platform_pm_ops mid_pci_platform_pm = {
-
- #define ICPU(model) { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
-
-+/*
-+ * This table should be in sync with the one in
-+ * arch/x86/platform/intel-mid/pwr.c.
-+ */
- static const struct x86_cpu_id lpss_cpu_ids[] = {
-- ICPU(INTEL_FAM6_ATOM_MERRIFIELD1),
-+ ICPU(INTEL_FAM6_ATOM_PENWELL),
-+ ICPU(INTEL_FAM6_ATOM_MERRIFIELD),
- {}
- };
-
-diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
-index 8c7eb33..4d74ca9 100644
---- a/drivers/phy/phy-sun4i-usb.c
-+++ b/drivers/phy/phy-sun4i-usb.c
-@@ -40,6 +40,7 @@
- #include <linux/power_supply.h>
- #include <linux/regulator/consumer.h>
- #include <linux/reset.h>
-+#include <linux/spinlock.h>
- #include <linux/usb/of.h>
- #include <linux/workqueue.h>
-
-@@ -112,7 +113,7 @@ struct sun4i_usb_phy_data {
- void __iomem *base;
- const struct sun4i_usb_phy_cfg *cfg;
- enum usb_dr_mode dr_mode;
-- struct mutex mutex;
-+ spinlock_t reg_lock; /* guard access to phyctl reg */
- struct sun4i_usb_phy {
- struct phy *phy;
- void __iomem *pmu;
-@@ -179,9 +180,10 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
- struct sun4i_usb_phy_data *phy_data = to_sun4i_usb_phy_data(phy);
- u32 temp, usbc_bit = BIT(phy->index * 2);
- void __iomem *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
-+ unsigned long flags;
- int i;
-
-- mutex_lock(&phy_data->mutex);
-+ spin_lock_irqsave(&phy_data->reg_lock, flags);
-
- if (phy_data->cfg->type == sun8i_a33_phy) {
- /* A33 needs us to set phyctl to 0 explicitly */
-@@ -218,7 +220,8 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
-
- data >>= 1;
- }
-- mutex_unlock(&phy_data->mutex);
-+
-+ spin_unlock_irqrestore(&phy_data->reg_lock, flags);
- }
-
- static void sun4i_usb_phy_passby(struct sun4i_usb_phy *phy, int enable)
-@@ -577,7 +580,7 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
- if (!data)
- return -ENOMEM;
-
-- mutex_init(&data->mutex);
-+ spin_lock_init(&data->reg_lock);
- INIT_DELAYED_WORK(&data->detect, sun4i_usb_phy0_id_vbus_det_scan);
- dev_set_drvdata(dev, data);
- data->cfg = of_device_get_match_data(dev);
-diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
-index fbab29d..243b233 100644
---- a/drivers/powercap/intel_rapl.c
-+++ b/drivers/powercap/intel_rapl.c
-@@ -1154,8 +1154,8 @@ static const struct x86_cpu_id rapl_ids[] __initconst = {
-
- RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT1, rapl_defaults_byt),
- RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT, rapl_defaults_cht),
-- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD1, rapl_defaults_tng),
-- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD2, rapl_defaults_ann),
-+ RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD, rapl_defaults_tng),
-+ RAPL_CPU(INTEL_FAM6_ATOM_MOOREFIELD, rapl_defaults_ann),
- RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT, rapl_defaults_core),
- RAPL_CPU(INTEL_FAM6_ATOM_DENVERTON, rapl_defaults_core),
-
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 122e64d..6854461 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -348,7 +348,8 @@ static int dwc3_send_clear_stall_ep_cmd(struct dwc3_ep *dep)
- * IN transfers due to a mishandled error condition. Synopsys
- * STAR 9000614252.
- */
-- if (dep->direction && (dwc->revision >= DWC3_REVISION_260A))
-+ if (dep->direction && (dwc->revision >= DWC3_REVISION_260A) &&
-+ (dwc->gadget.speed >= USB_SPEED_SUPER))
- cmd |= DWC3_DEPCMD_CLEARPENDIN;
-
- memset(&params, 0, sizeof(params));
-diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
-index ef2d8cd..8c5f011 100644
---- a/drivers/usb/storage/usb.c
-+++ b/drivers/usb/storage/usb.c
-@@ -1070,17 +1070,17 @@ int usb_stor_probe2(struct us_data *us)
- result = usb_stor_acquire_resources(us);
- if (result)
- goto BadDevice;
-+ usb_autopm_get_interface_no_resume(us->pusb_intf);
- snprintf(us->scsi_name, sizeof(us->scsi_name), "usb-storage %s",
- dev_name(&us->pusb_intf->dev));
- result = scsi_add_host(us_to_host(us), dev);
- if (result) {
- dev_warn(dev,
- "Unable to add the scsi host\n");
-- goto BadDevice;
-+ goto HostAddErr;
- }
-
- /* Submit the delayed_work for SCSI-device scanning */
-- usb_autopm_get_interface_no_resume(us->pusb_intf);
- set_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
-
- if (delay_use > 0)
-@@ -1090,6 +1090,8 @@ int usb_stor_probe2(struct us_data *us)
- return 0;
-
- /* We come here if there are any problems */
-+HostAddErr:
-+ usb_autopm_put_interface_no_suspend(us->pusb_intf);
- BadDevice:
- usb_stor_dbg(us, "storage_probe() failed\n");
- release_everything(us);
-diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h
-index d409ceb..c118a7e 100644
---- a/include/linux/mfd/88pm80x.h
-+++ b/include/linux/mfd/88pm80x.h
-@@ -350,7 +350,7 @@ static inline int pm80x_dev_suspend(struct device *dev)
- int irq = platform_get_irq(pdev, 0);
-
- if (device_may_wakeup(dev))
-- set_bit((1 << irq), &chip->wu_flag);
-+ set_bit(irq, &chip->wu_flag);
-
- return 0;
- }
-@@ -362,7 +362,7 @@ static inline int pm80x_dev_resume(struct device *dev)
- int irq = platform_get_irq(pdev, 0);
-
- if (device_may_wakeup(dev))
-- clear_bit((1 << irq), &chip->wu_flag);
-+ clear_bit(irq, &chip->wu_flag);
-
- return 0;
- }
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index e07fb09..37dec7e 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -403,8 +403,11 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
- tkr = tkf->base + (seq & 0x01);
- now = ktime_to_ns(tkr->base);
-
-- now += clocksource_delta(tkr->read(tkr->clock),
-- tkr->cycle_last, tkr->mask);
-+ now += timekeeping_delta_to_ns(tkr,
-+ clocksource_delta(
-+ tkr->read(tkr->clock),
-+ tkr->cycle_last,
-+ tkr->mask));
- } while (read_seqcount_retry(&tkf->seq, seq));
-
- return now;
-diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
-index 4b9b4a4..ef1e4e7 100644
---- a/security/integrity/ima/ima_appraise.c
-+++ b/security/integrity/ima/ima_appraise.c
-@@ -190,7 +190,7 @@ int ima_appraise_measurement(enum ima_hooks func,
- {
- static const char op[] = "appraise_data";
- char *cause = "unknown";
-- struct dentry *dentry = file->f_path.dentry;
-+ struct dentry *dentry = file_dentry(file);
- struct inode *inode = d_backing_inode(dentry);
- enum integrity_status status = INTEGRITY_UNKNOWN;
- int rc = xattr_len, hash_start = 0;
-@@ -295,7 +295,7 @@ int ima_appraise_measurement(enum ima_hooks func,
- */
- void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
- {
-- struct dentry *dentry = file->f_path.dentry;
-+ struct dentry *dentry = file_dentry(file);
- int rc = 0;
-
- /* do not collect and update hash for digital signatures */
-diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
-index 596ef61..423d111 100644
---- a/security/integrity/ima/ima_main.c
-+++ b/security/integrity/ima/ima_main.c
-@@ -228,7 +228,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
- if ((action & IMA_APPRAISE_SUBMASK) ||
- strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
- /* read 'security.ima' */
-- xattr_len = ima_read_xattr(file->f_path.dentry, &xattr_value);
-+ xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
-
- hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
-
-diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
-index 36470af..92b819e 100644
---- a/sound/pci/ali5451/ali5451.c
-+++ b/sound/pci/ali5451/ali5451.c
-@@ -1408,6 +1408,7 @@ snd_ali_playback_pointer(struct snd_pcm_substream *substream)
- spin_unlock(&codec->reg_lock);
- dev_dbg(codec->card->dev, "playback pointer returned cso=%xh.\n", cso);
-
-+ cso %= runtime->buffer_size;
- return cso;
- }
-
-@@ -1428,6 +1429,7 @@ static snd_pcm_uframes_t snd_ali_pointer(struct snd_pcm_substream *substream)
- cso = inw(ALI_REG(codec, ALI_CSO_ALPHA_FMS + 2));
- spin_unlock(&codec->reg_lock);
-
-+ cso %= runtime->buffer_size;
- return cso;
- }
-
-diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 81b7da8..183311c 100644
---- a/sound/usb/line6/driver.c
-+++ b/sound/usb/line6/driver.c
-@@ -29,7 +29,7 @@
- /*
- This is Line 6's MIDI manufacturer ID.
- */
--const unsigned char line6_midi_id[] = {
-+const unsigned char line6_midi_id[3] = {
- 0x00, 0x01, 0x0c
- };
- EXPORT_SYMBOL_GPL(line6_midi_id);
-diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
-index f6c3bf7..04991b0 100644
---- a/sound/usb/mixer_quirks.c
-+++ b/sound/usb/mixer_quirks.c
-@@ -1831,6 +1831,7 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
- }
-
- static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
-+ struct usb_mixer_elem_info *cval,
- struct snd_kcontrol *kctl)
- {
- /* Approximation using 10 ranges based on output measurement on hw v1.2.
-@@ -1848,10 +1849,19 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
- 41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
- );
-
-- usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
-- kctl->tlv.p = scale;
-- kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
-- kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
-+ if (cval->min == 0 && cval->max == 50) {
-+ usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk (0-50 variant)\n");
-+ kctl->tlv.p = scale;
-+ kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
-+ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
-+
-+ } else if (cval->min == 0 && cval->max <= 1000) {
-+ /* Some other clearly broken DragonFly variant.
-+ * At least a 0..53 variant (hw v1.0) exists.
-+ */
-+ usb_audio_info(mixer->chip, "ignoring too narrow dB range on a DragonFly device");
-+ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
-+ }
- }
-
- void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
-@@ -1860,8 +1870,8 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
- {
- switch (mixer->chip->usb_id) {
- case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
-- if (unitid == 7 && cval->min == 0 && cval->max == 50)
-- snd_dragonfly_quirk_db_scale(mixer, kctl);
-+ if (unitid == 7 && cval->control == UAC_FU_VOLUME)
-+ snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
- break;
- }
- }
-diff --git a/virt/kvm/arm/pmu.c b/virt/kvm/arm/pmu.c
-index a027569..6e9c40e 100644
---- a/virt/kvm/arm/pmu.c
-+++ b/virt/kvm/arm/pmu.c
-@@ -423,6 +423,14 @@ static int kvm_arm_pmu_v3_init(struct kvm_vcpu *vcpu)
- if (!kvm_arm_support_pmu_v3())
- return -ENODEV;
-
-+ /*
-+ * We currently require an in-kernel VGIC to use the PMU emulation,
-+ * because we do not support forwarding PMU overflow interrupts to
-+ * userspace yet.
-+ */
-+ if (!irqchip_in_kernel(vcpu->kvm) || !vgic_initialized(vcpu->kvm))
-+ return -ENODEV;
-+
- if (!test_bit(KVM_ARM_VCPU_PMU_V3, vcpu->arch.features) ||
- !kvm_arm_pmu_irq_initialized(vcpu))
- return -ENXIO;
-diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
-index e83b7fe..b465ac6 100644
---- a/virt/kvm/arm/vgic/vgic.c
-+++ b/virt/kvm/arm/vgic/vgic.c
-@@ -645,6 +645,9 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
- /* Sync back the hardware VGIC state into our emulation after a guest's run. */
- void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
- {
-+ if (unlikely(!vgic_initialized(vcpu->kvm)))
-+ return;
-+
- vgic_process_maintenance_interrupt(vcpu);
- vgic_fold_lr_state(vcpu);
- vgic_prune_ap_list(vcpu);
-@@ -653,6 +656,9 @@ void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
- /* Flush our emulation state into the GIC hardware before entering the guest. */
- void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
- {
-+ if (unlikely(!vgic_initialized(vcpu->kvm)))
-+ return;
-+
- spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
- vgic_flush_lr_state(vcpu);
- spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
diff --git a/4.8.7/1002_linux-4.8.3.patch b/4.8.7/1002_linux-4.8.3.patch
deleted file mode 100644
index 4b4c68a..0000000
--- a/4.8.7/1002_linux-4.8.3.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-diff --git a/Makefile b/Makefile
-index bf6e44a..42eb45c 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
-index ec6381e..258a3f9 100644
---- a/drivers/scsi/hosts.c
-+++ b/drivers/scsi/hosts.c
-@@ -246,10 +246,6 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
-
- shost->dma_dev = dma_dev;
-
-- error = device_add(&shost->shost_gendev);
-- if (error)
-- goto out_destroy_freelist;
--
- /*
- * Increase usage count temporarily here so that calling
- * scsi_autopm_put_host() will trigger runtime idle if there is
-@@ -260,6 +256,10 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
- pm_runtime_enable(&shost->shost_gendev);
- device_enable_async_suspend(&shost->shost_gendev);
-
-+ error = device_add(&shost->shost_gendev);
-+ if (error)
-+ goto out_destroy_freelist;
-+
- scsi_host_set_state(shost, SHOST_RUNNING);
- get_device(shost->shost_gendev.parent);
-
-@@ -309,6 +309,10 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
- out_del_gendev:
- device_del(&shost->shost_gendev);
- out_destroy_freelist:
-+ device_disable_async_suspend(&shost->shost_gendev);
-+ pm_runtime_disable(&shost->shost_gendev);
-+ pm_runtime_set_suspended(&shost->shost_gendev);
-+ pm_runtime_put_noidle(&shost->shost_gendev);
- scsi_destroy_command_freelist(shost);
- out_destroy_tags:
- if (shost_use_blk_mq(shost))
-diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c
-index ea62245..6290093 100644
---- a/fs/xfs/xfs_xattr.c
-+++ b/fs/xfs/xfs_xattr.c
-@@ -147,6 +147,7 @@ __xfs_xattr_put_listent(
- arraytop = context->count + prefix_len + namelen + 1;
- if (arraytop > context->firstu) {
- context->count = -1; /* insufficient space */
-+ context->seen_enough = 1;
- return 0;
- }
- offset = (char *)context->alist + context->count;
-diff --git a/include/linux/mm.h b/include/linux/mm.h
-index ef815b9..277cd39 100644
---- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -2234,6 +2234,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
- #define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
- #define FOLL_MLOCK 0x1000 /* lock present pages */
- #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */
-+#define FOLL_COW 0x4000 /* internal GUP flag */
-
- typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
- void *data);
-diff --git a/include/media/rcar-fcp.h b/include/media/rcar-fcp.h
-index 4c7fc77..8723f05 100644
---- a/include/media/rcar-fcp.h
-+++ b/include/media/rcar-fcp.h
-@@ -29,7 +29,7 @@ static inline struct rcar_fcp_device *rcar_fcp_get(const struct device_node *np)
- static inline void rcar_fcp_put(struct rcar_fcp_device *fcp) { }
- static inline int rcar_fcp_enable(struct rcar_fcp_device *fcp)
- {
-- return -ENOSYS;
-+ return 0;
- }
- static inline void rcar_fcp_disable(struct rcar_fcp_device *fcp) { }
- #endif
-diff --git a/mm/gup.c b/mm/gup.c
-index 96b2b2f..22cc22e 100644
---- a/mm/gup.c
-+++ b/mm/gup.c
-@@ -60,6 +60,16 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
- return -EEXIST;
- }
-
-+/*
-+ * FOLL_FORCE can write to even unwritable pte's, but only
-+ * after we've gone through a COW cycle and they are dirty.
-+ */
-+static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
-+{
-+ return pte_write(pte) ||
-+ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
-+}
-+
- static struct page *follow_page_pte(struct vm_area_struct *vma,
- unsigned long address, pmd_t *pmd, unsigned int flags)
- {
-@@ -95,7 +105,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
- }
- if ((flags & FOLL_NUMA) && pte_protnone(pte))
- goto no_page;
-- if ((flags & FOLL_WRITE) && !pte_write(pte)) {
-+ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
- pte_unmap_unlock(ptep, ptl);
- return NULL;
- }
-@@ -412,7 +422,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
- * reCOWed by userspace write).
- */
- if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
-- *flags &= ~FOLL_WRITE;
-+ *flags |= FOLL_COW;
- return 0;
- }
-
diff --git a/4.8.7/1003_linux-4.8.4.patch b/4.8.7/1003_linux-4.8.4.patch
deleted file mode 100644
index b326925..0000000
--- a/4.8.7/1003_linux-4.8.4.patch
+++ /dev/null
@@ -1,2264 +0,0 @@
-diff --git a/MAINTAINERS b/MAINTAINERS
-index f593300..babaf82 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -12951,11 +12951,10 @@ F: arch/x86/xen/*swiotlb*
- F: drivers/xen/*swiotlb*
-
- XFS FILESYSTEM
--P: Silicon Graphics Inc
- M: Dave Chinner <david@fromorbit.com>
--M: xfs@oss.sgi.com
--L: xfs@oss.sgi.com
--W: http://oss.sgi.com/projects/xfs
-+M: linux-xfs@vger.kernel.org
-+L: linux-xfs@vger.kernel.org
-+W: http://xfs.org/
- T: git git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs.git
- S: Supported
- F: Documentation/filesystems/xfs.txt
-diff --git a/Makefile b/Makefile
-index 42eb45c..82a36ab 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arc/include/asm/irqflags-arcv2.h b/arch/arc/include/asm/irqflags-arcv2.h
-index d1ec7f6..e880dfa 100644
---- a/arch/arc/include/asm/irqflags-arcv2.h
-+++ b/arch/arc/include/asm/irqflags-arcv2.h
-@@ -112,7 +112,7 @@ static inline long arch_local_save_flags(void)
- */
- temp = (1 << 5) |
- ((!!(temp & STATUS_IE_MASK)) << CLRI_STATUS_IE_BIT) |
-- (temp & CLRI_STATUS_E_MASK);
-+ ((temp >> 1) & CLRI_STATUS_E_MASK);
- return temp;
- }
-
-diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
-index 6c24faf..62b59409 100644
---- a/arch/arc/kernel/intc-arcv2.c
-+++ b/arch/arc/kernel/intc-arcv2.c
-@@ -74,7 +74,7 @@ void arc_init_IRQ(void)
- tmp = read_aux_reg(0xa);
- tmp |= STATUS_AD_MASK | (irq_prio << 1);
- tmp &= ~STATUS_IE_MASK;
-- asm volatile("flag %0 \n"::"r"(tmp));
-+ asm volatile("kflag %0 \n"::"r"(tmp));
- }
-
- static void arcv2_irq_mask(struct irq_data *data)
-diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
-index cc2f6db..5e24d88 100644
---- a/block/cfq-iosched.c
-+++ b/block/cfq-iosched.c
-@@ -3042,7 +3042,6 @@ static struct request *cfq_check_fifo(struct cfq_queue *cfqq)
- if (ktime_get_ns() < rq->fifo_time)
- rq = NULL;
-
-- cfq_log_cfqq(cfqq->cfqd, cfqq, "fifo=%p", rq);
- return rq;
- }
-
-@@ -3420,6 +3419,9 @@ static bool cfq_may_dispatch(struct cfq_data *cfqd, struct cfq_queue *cfqq)
- {
- unsigned int max_dispatch;
-
-+ if (cfq_cfqq_must_dispatch(cfqq))
-+ return true;
-+
- /*
- * Drain async requests before we start sync IO
- */
-@@ -3511,15 +3513,20 @@ static bool cfq_dispatch_request(struct cfq_data *cfqd, struct cfq_queue *cfqq)
-
- BUG_ON(RB_EMPTY_ROOT(&cfqq->sort_list));
-
-+ rq = cfq_check_fifo(cfqq);
-+ if (rq)
-+ cfq_mark_cfqq_must_dispatch(cfqq);
-+
- if (!cfq_may_dispatch(cfqd, cfqq))
- return false;
-
- /*
- * follow expired path, else get first next available
- */
-- rq = cfq_check_fifo(cfqq);
- if (!rq)
- rq = cfqq->next_rq;
-+ else
-+ cfq_log_cfqq(cfqq->cfqd, cfqq, "fifo=%p", rq);
-
- /*
- * insert request into driver dispatch list
-@@ -3989,7 +3996,7 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
- * if the new request is sync, but the currently running queue is
- * not, let the sync request have priority.
- */
-- if (rq_is_sync(rq) && !cfq_cfqq_sync(cfqq))
-+ if (rq_is_sync(rq) && !cfq_cfqq_sync(cfqq) && !cfq_cfqq_must_dispatch(cfqq))
- return true;
-
- /*
-diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
-index 08b3ac6..f83de99 100644
---- a/crypto/async_tx/async_pq.c
-+++ b/crypto/async_tx/async_pq.c
-@@ -368,8 +368,6 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
-
- dma_set_unmap(tx, unmap);
- async_tx_submit(chan, tx, submit);
--
-- return tx;
- } else {
- struct page *p_src = P(blocks, disks);
- struct page *q_src = Q(blocks, disks);
-@@ -424,9 +422,11 @@ async_syndrome_val(struct page **blocks, unsigned int offset, int disks,
- submit->cb_param = cb_param_orig;
- submit->flags = flags_orig;
- async_tx_sync_epilog(submit);
--
-- return NULL;
-+ tx = NULL;
- }
-+ dmaengine_unmap_put(unmap);
-+
-+ return tx;
- }
- EXPORT_SYMBOL_GPL(async_syndrome_val);
-
-diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
-index bac7099..12ad3e3 100644
---- a/crypto/ghash-generic.c
-+++ b/crypto/ghash-generic.c
-@@ -14,24 +14,13 @@
-
- #include <crypto/algapi.h>
- #include <crypto/gf128mul.h>
-+#include <crypto/ghash.h>
- #include <crypto/internal/hash.h>
- #include <linux/crypto.h>
- #include <linux/init.h>
- #include <linux/kernel.h>
- #include <linux/module.h>
-
--#define GHASH_BLOCK_SIZE 16
--#define GHASH_DIGEST_SIZE 16
--
--struct ghash_ctx {
-- struct gf128mul_4k *gf128;
--};
--
--struct ghash_desc_ctx {
-- u8 buffer[GHASH_BLOCK_SIZE];
-- u32 bytes;
--};
--
- static int ghash_init(struct shash_desc *desc)
- {
- struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
-diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
-index e1d5ea6..2accf78 100644
---- a/drivers/acpi/nfit/core.c
-+++ b/drivers/acpi/nfit/core.c
-@@ -2689,6 +2689,9 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
-
- dev_dbg(dev, "%s: event: %d\n", __func__, event);
-
-+ if (event != NFIT_NOTIFY_UPDATE)
-+ return;
-+
- device_lock(dev);
- if (!dev->driver) {
- /* dev->driver may be null if we're being removed */
-diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
-index e894ded..51d23f1 100644
---- a/drivers/acpi/nfit/nfit.h
-+++ b/drivers/acpi/nfit/nfit.h
-@@ -78,6 +78,10 @@ enum {
- NFIT_ARS_TIMEOUT = 90,
- };
-
-+enum nfit_root_notifiers {
-+ NFIT_NOTIFY_UPDATE = 0x80,
-+};
-+
- struct nfit_spa {
- struct list_head list;
- struct nd_region *nd_region;
-diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
-index d799662..261420d 100644
---- a/drivers/base/dma-mapping.c
-+++ b/drivers/base/dma-mapping.c
-@@ -334,7 +334,7 @@ void dma_common_free_remap(void *cpu_addr, size_t size, unsigned long vm_flags)
- return;
- }
-
-- unmap_kernel_range((unsigned long)cpu_addr, size);
-+ unmap_kernel_range((unsigned long)cpu_addr, PAGE_ALIGN(size));
- vunmap(cpu_addr);
- }
- #endif
-diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
-index 7fa42d6..f2303da 100644
---- a/drivers/clk/mvebu/cp110-system-controller.c
-+++ b/drivers/clk/mvebu/cp110-system-controller.c
-@@ -81,13 +81,6 @@ enum {
- #define CP110_GATE_EIP150 25
- #define CP110_GATE_EIP197 26
-
--static struct clk *cp110_clks[CP110_CLK_NUM];
--
--static struct clk_onecell_data cp110_clk_data = {
-- .clks = cp110_clks,
-- .clk_num = CP110_CLK_NUM,
--};
--
- struct cp110_gate_clk {
- struct clk_hw hw;
- struct regmap *regmap;
-@@ -142,6 +135,8 @@ static struct clk *cp110_register_gate(const char *name,
- if (!gate)
- return ERR_PTR(-ENOMEM);
-
-+ memset(&init, 0, sizeof(init));
-+
- init.name = name;
- init.ops = &cp110_gate_ops;
- init.parent_names = &parent_name;
-@@ -194,7 +189,8 @@ static int cp110_syscon_clk_probe(struct platform_device *pdev)
- struct regmap *regmap;
- struct device_node *np = pdev->dev.of_node;
- const char *ppv2_name, *apll_name, *core_name, *eip_name, *nand_name;
-- struct clk *clk;
-+ struct clk_onecell_data *cp110_clk_data;
-+ struct clk *clk, **cp110_clks;
- u32 nand_clk_ctrl;
- int i, ret;
-
-@@ -207,6 +203,20 @@ static int cp110_syscon_clk_probe(struct platform_device *pdev)
- if (ret)
- return ret;
-
-+ cp110_clks = devm_kcalloc(&pdev->dev, sizeof(struct clk *),
-+ CP110_CLK_NUM, GFP_KERNEL);
-+ if (!cp110_clks)
-+ return -ENOMEM;
-+
-+ cp110_clk_data = devm_kzalloc(&pdev->dev,
-+ sizeof(*cp110_clk_data),
-+ GFP_KERNEL);
-+ if (!cp110_clk_data)
-+ return -ENOMEM;
-+
-+ cp110_clk_data->clks = cp110_clks;
-+ cp110_clk_data->clk_num = CP110_CLK_NUM;
-+
- /* Register the APLL which is the root of the clk tree */
- of_property_read_string_index(np, "core-clock-output-names",
- CP110_CORE_APLL, &apll_name);
-@@ -334,10 +344,12 @@ static int cp110_syscon_clk_probe(struct platform_device *pdev)
- cp110_clks[CP110_MAX_CORE_CLOCKS + i] = clk;
- }
-
-- ret = of_clk_add_provider(np, cp110_of_clk_get, &cp110_clk_data);
-+ ret = of_clk_add_provider(np, cp110_of_clk_get, cp110_clk_data);
- if (ret)
- goto fail_clk_add;
-
-+ platform_set_drvdata(pdev, cp110_clks);
-+
- return 0;
-
- fail_clk_add:
-@@ -364,6 +376,7 @@ static int cp110_syscon_clk_probe(struct platform_device *pdev)
-
- static int cp110_syscon_clk_remove(struct platform_device *pdev)
- {
-+ struct clk **cp110_clks = platform_get_drvdata(pdev);
- int i;
-
- of_clk_del_provider(pdev->dev.of_node);
-diff --git a/drivers/crypto/vmx/ghash.c b/drivers/crypto/vmx/ghash.c
-index 6c999cb0..27a94a1 100644
---- a/drivers/crypto/vmx/ghash.c
-+++ b/drivers/crypto/vmx/ghash.c
-@@ -26,16 +26,13 @@
- #include <linux/hardirq.h>
- #include <asm/switch_to.h>
- #include <crypto/aes.h>
-+#include <crypto/ghash.h>
- #include <crypto/scatterwalk.h>
- #include <crypto/internal/hash.h>
- #include <crypto/b128ops.h>
-
- #define IN_INTERRUPT in_interrupt()
-
--#define GHASH_BLOCK_SIZE (16)
--#define GHASH_DIGEST_SIZE (16)
--#define GHASH_KEY_LEN (16)
--
- void gcm_init_p8(u128 htable[16], const u64 Xi[2]);
- void gcm_gmult_p8(u64 Xi[2], const u128 htable[16]);
- void gcm_ghash_p8(u64 Xi[2], const u128 htable[16],
-@@ -55,16 +52,11 @@ struct p8_ghash_desc_ctx {
-
- static int p8_ghash_init_tfm(struct crypto_tfm *tfm)
- {
-- const char *alg;
-+ const char *alg = "ghash-generic";
- struct crypto_shash *fallback;
- struct crypto_shash *shash_tfm = __crypto_shash_cast(tfm);
- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(tfm);
-
-- if (!(alg = crypto_tfm_alg_name(tfm))) {
-- printk(KERN_ERR "Failed to get algorithm name.\n");
-- return -ENOENT;
-- }
--
- fallback = crypto_alloc_shash(alg, 0, CRYPTO_ALG_NEED_FALLBACK);
- if (IS_ERR(fallback)) {
- printk(KERN_ERR
-@@ -78,10 +70,18 @@ static int p8_ghash_init_tfm(struct crypto_tfm *tfm)
- crypto_shash_set_flags(fallback,
- crypto_shash_get_flags((struct crypto_shash
- *) tfm));
-- ctx->fallback = fallback;
-
-- shash_tfm->descsize = sizeof(struct p8_ghash_desc_ctx)
-- + crypto_shash_descsize(fallback);
-+ /* Check if the descsize defined in the algorithm is still enough. */
-+ if (shash_tfm->descsize < sizeof(struct p8_ghash_desc_ctx)
-+ + crypto_shash_descsize(fallback)) {
-+ printk(KERN_ERR
-+ "Desc size of the fallback implementation (%s) does not match the expected value: %lu vs %u\n",
-+ alg,
-+ shash_tfm->descsize - sizeof(struct p8_ghash_desc_ctx),
-+ crypto_shash_descsize(fallback));
-+ return -EINVAL;
-+ }
-+ ctx->fallback = fallback;
-
- return 0;
- }
-@@ -113,7 +113,7 @@ static int p8_ghash_setkey(struct crypto_shash *tfm, const u8 *key,
- {
- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(tfm));
-
-- if (keylen != GHASH_KEY_LEN)
-+ if (keylen != GHASH_BLOCK_SIZE)
- return -EINVAL;
-
- preempt_disable();
-@@ -211,7 +211,8 @@ struct shash_alg p8_ghash_alg = {
- .update = p8_ghash_update,
- .final = p8_ghash_final,
- .setkey = p8_ghash_setkey,
-- .descsize = sizeof(struct p8_ghash_desc_ctx),
-+ .descsize = sizeof(struct p8_ghash_desc_ctx)
-+ + sizeof(struct ghash_desc_ctx),
- .base = {
- .cra_name = "ghash",
- .cra_driver_name = "p8_ghash",
-diff --git a/drivers/gpu/drm/virtio/virtgpu_drm_bus.c b/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
-index 7f0e93f87..88a3916 100644
---- a/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
-+++ b/drivers/gpu/drm/virtio/virtgpu_drm_bus.c
-@@ -27,6 +27,16 @@
-
- #include "virtgpu_drv.h"
-
-+int drm_virtio_set_busid(struct drm_device *dev, struct drm_master *master)
-+{
-+ struct pci_dev *pdev = dev->pdev;
-+
-+ if (pdev) {
-+ return drm_pci_set_busid(dev, master);
-+ }
-+ return 0;
-+}
-+
- static void virtio_pci_kick_out_firmware_fb(struct pci_dev *pci_dev)
- {
- struct apertures_struct *ap;
-diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
-index c13f70c..5820b702 100644
---- a/drivers/gpu/drm/virtio/virtgpu_drv.c
-+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
-@@ -117,6 +117,7 @@ static const struct file_operations virtio_gpu_driver_fops = {
-
- static struct drm_driver driver = {
- .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME | DRIVER_RENDER | DRIVER_ATOMIC,
-+ .set_busid = drm_virtio_set_busid,
- .load = virtio_gpu_driver_load,
- .unload = virtio_gpu_driver_unload,
- .open = virtio_gpu_driver_open,
-diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
-index b18ef31..acf556a 100644
---- a/drivers/gpu/drm/virtio/virtgpu_drv.h
-+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
-@@ -49,6 +49,7 @@
- #define DRIVER_PATCHLEVEL 1
-
- /* virtgpu_drm_bus.c */
-+int drm_virtio_set_busid(struct drm_device *dev, struct drm_master *master);
- int drm_virtio_init(struct drm_driver *driver, struct virtio_device *vdev);
-
- struct virtio_gpu_object {
-diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
-index 5da190e..bcf76c3 100644
---- a/drivers/infiniband/hw/hfi1/rc.c
-+++ b/drivers/infiniband/hw/hfi1/rc.c
-@@ -932,8 +932,10 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
- return;
-
- queue_ack:
-- this_cpu_inc(*ibp->rvp.rc_qacks);
- spin_lock_irqsave(&qp->s_lock, flags);
-+ if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK))
-+ goto unlock;
-+ this_cpu_inc(*ibp->rvp.rc_qacks);
- qp->s_flags |= RVT_S_ACK_PENDING | RVT_S_RESP_PENDING;
- qp->s_nak_state = qp->r_nak_state;
- qp->s_ack_psn = qp->r_ack_psn;
-@@ -942,6 +944,7 @@ void hfi1_send_rc_ack(struct hfi1_ctxtdata *rcd, struct rvt_qp *qp,
-
- /* Schedule the send tasklet. */
- hfi1_schedule_send(qp);
-+unlock:
- spin_unlock_irqrestore(&qp->s_lock, flags);
- }
-
-diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
-index a039a5d..fd9271b 100644
---- a/drivers/misc/mei/amthif.c
-+++ b/drivers/misc/mei/amthif.c
-@@ -67,8 +67,12 @@ int mei_amthif_host_init(struct mei_device *dev, struct mei_me_client *me_cl)
- struct mei_cl *cl = &dev->iamthif_cl;
- int ret;
-
-- if (mei_cl_is_connected(cl))
-- return 0;
-+ mutex_lock(&dev->device_lock);
-+
-+ if (mei_cl_is_connected(cl)) {
-+ ret = 0;
-+ goto out;
-+ }
-
- dev->iamthif_state = MEI_IAMTHIF_IDLE;
-
-@@ -77,11 +81,13 @@ int mei_amthif_host_init(struct mei_device *dev, struct mei_me_client *me_cl)
- ret = mei_cl_link(cl);
- if (ret < 0) {
- dev_err(dev->dev, "amthif: failed cl_link %d\n", ret);
-- return ret;
-+ goto out;
- }
-
- ret = mei_cl_connect(cl, me_cl, NULL);
-
-+out:
-+ mutex_unlock(&dev->device_lock);
- return ret;
- }
-
-diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
-index 1f33fea..e094df3 100644
---- a/drivers/misc/mei/bus.c
-+++ b/drivers/misc/mei/bus.c
-@@ -983,12 +983,10 @@ void mei_cl_bus_rescan_work(struct work_struct *work)
- container_of(work, struct mei_device, bus_rescan_work);
- struct mei_me_client *me_cl;
-
-- mutex_lock(&bus->device_lock);
- me_cl = mei_me_cl_by_uuid(bus, &mei_amthif_guid);
- if (me_cl)
- mei_amthif_host_init(bus, me_cl);
- mei_me_cl_put(me_cl);
-- mutex_unlock(&bus->device_lock);
-
- mei_cl_bus_rescan(bus);
- }
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index d0b3a1b..dad15b6 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -11360,6 +11360,12 @@ static pci_ers_result_t i40e_pci_error_detected(struct pci_dev *pdev,
-
- dev_info(&pdev->dev, "%s: error %d\n", __func__, error);
-
-+ if (!pf) {
-+ dev_info(&pdev->dev,
-+ "Cannot recover - error happened during device probe\n");
-+ return PCI_ERS_RESULT_DISCONNECT;
-+ }
-+
- /* shutdown all operations */
- if (!test_bit(__I40E_SUSPENDED, &pf->state)) {
- rtnl_lock();
-diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
-index 6808db4..ec3a64e 100644
---- a/drivers/net/wireless/ath/carl9170/debug.c
-+++ b/drivers/net/wireless/ath/carl9170/debug.c
-@@ -75,7 +75,8 @@ static ssize_t carl9170_debugfs_read(struct file *file, char __user *userbuf,
-
- if (!ar)
- return -ENODEV;
-- dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct carl9170_debugfs_fops, fops);
-
- if (!dfops->read)
- return -ENOSYS;
-@@ -127,7 +128,8 @@ static ssize_t carl9170_debugfs_write(struct file *file,
-
- if (!ar)
- return -ENODEV;
-- dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct carl9170_debugfs_fops, fops);
-
- if (!dfops->write)
- return -ENOSYS;
-diff --git a/drivers/net/wireless/broadcom/b43/debugfs.c b/drivers/net/wireless/broadcom/b43/debugfs.c
-index b4bcd94..7704638 100644
---- a/drivers/net/wireless/broadcom/b43/debugfs.c
-+++ b/drivers/net/wireless/broadcom/b43/debugfs.c
-@@ -524,7 +524,8 @@ static ssize_t b43_debugfs_read(struct file *file, char __user *userbuf,
- goto out_unlock;
- }
-
-- dfops = container_of(file->f_op, struct b43_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct b43_debugfs_fops, fops);
- if (!dfops->read) {
- err = -ENOSYS;
- goto out_unlock;
-@@ -585,7 +586,8 @@ static ssize_t b43_debugfs_write(struct file *file,
- goto out_unlock;
- }
-
-- dfops = container_of(file->f_op, struct b43_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct b43_debugfs_fops, fops);
- if (!dfops->write) {
- err = -ENOSYS;
- goto out_unlock;
-diff --git a/drivers/net/wireless/broadcom/b43legacy/debugfs.c b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
-index 090910e..82ef56e 100644
---- a/drivers/net/wireless/broadcom/b43legacy/debugfs.c
-+++ b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
-@@ -221,7 +221,8 @@ static ssize_t b43legacy_debugfs_read(struct file *file, char __user *userbuf,
- goto out_unlock;
- }
-
-- dfops = container_of(file->f_op, struct b43legacy_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct b43legacy_debugfs_fops, fops);
- if (!dfops->read) {
- err = -ENOSYS;
- goto out_unlock;
-@@ -287,7 +288,8 @@ static ssize_t b43legacy_debugfs_write(struct file *file,
- goto out_unlock;
- }
-
-- dfops = container_of(file->f_op, struct b43legacy_debugfs_fops, fops);
-+ dfops = container_of(debugfs_real_fops(file),
-+ struct b43legacy_debugfs_fops, fops);
- if (!dfops->write) {
- err = -ENOSYS;
- goto out_unlock;
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-index b8aec5e5..abaf003 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2533,7 +2533,7 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
- WL_BSS_INFO_MAX);
- if (err) {
- brcmf_err("Failed to get bss info (%d)\n", err);
-- return;
-+ goto out_kfree;
- }
- si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
- si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
-@@ -2545,6 +2545,9 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
- si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
- if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
- si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
-+
-+out_kfree:
-+ kfree(buf);
- }
-
- static s32
-@@ -3884,11 +3887,11 @@ brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
- if (!check_vif_up(ifp->vif))
- return -EIO;
-
-- brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", &pmksa->bssid);
-+ brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
-
- npmk = le32_to_cpu(cfg->pmk_list.npmk);
- for (i = 0; i < npmk; i++)
-- if (!memcmp(&pmksa->bssid, &pmk[i].bssid, ETH_ALEN))
-+ if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
- break;
-
- if ((npmk > 0) && (i < npmk)) {
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-index 7e269f9..6366444 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
-@@ -234,13 +234,20 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid,
-
- void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
- {
-+ struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev);
- struct brcmf_flowring_ring *ring;
-+ struct brcmf_if *ifp;
- u16 hash_idx;
-+ u8 ifidx;
- struct sk_buff *skb;
-
- ring = flow->rings[flowid];
- if (!ring)
- return;
-+
-+ ifidx = brcmf_flowring_ifidx_get(flow, flowid);
-+ ifp = brcmf_get_ifp(bus_if->drvr, ifidx);
-+
- brcmf_flowring_block(flow, flowid, false);
- hash_idx = ring->hash_id;
- flow->hash[hash_idx].ifidx = BRCMF_FLOWRING_INVALID_IFIDX;
-@@ -249,7 +256,7 @@ void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid)
-
- skb = skb_dequeue(&ring->skblist);
- while (skb) {
-- brcmu_pkt_buf_free_skb(skb);
-+ brcmf_txfinalize(ifp, skb, false);
- skb = skb_dequeue(&ring->skblist);
- }
-
-diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
-index 7640498..3d53d63 100644
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -2388,15 +2388,23 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
- }
- case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
- unsigned char *ver_addr;
-- int32_t user_len, cnt2end;
-+ uint32_t user_len;
-+ int32_t cnt2end;
- uint8_t *pQbuffer, *ptmpuserbuffer;
-+
-+ user_len = pcmdmessagefld->cmdmessage.Length;
-+ if (user_len > ARCMSR_API_DATA_BUFLEN) {
-+ retvalue = ARCMSR_MESSAGE_FAIL;
-+ goto message_out;
-+ }
-+
- ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
- if (!ver_addr) {
- retvalue = ARCMSR_MESSAGE_FAIL;
- goto message_out;
- }
- ptmpuserbuffer = ver_addr;
-- user_len = pcmdmessagefld->cmdmessage.Length;
-+
- memcpy(ptmpuserbuffer,
- pcmdmessagefld->messagedatabuffer, user_len);
- spin_lock_irqsave(&acb->wqbuffer_lock, flags);
-diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
-index ab67ec4..79c9860 100644
---- a/drivers/scsi/ibmvscsi/ibmvfc.c
-+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
-@@ -717,7 +717,6 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost)
- spin_lock_irqsave(vhost->host->host_lock, flags);
- vhost->state = IBMVFC_NO_CRQ;
- vhost->logged_in = 0;
-- ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_NONE);
-
- /* Clean out the queue */
- memset(crq->msgs, 0, PAGE_SIZE);
-diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
-index e199696..b022f5a 100644
---- a/drivers/tty/serial/8250/8250_dw.c
-+++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -462,7 +462,7 @@ static int dw8250_probe(struct platform_device *pdev)
- }
-
- data->pclk = devm_clk_get(&pdev->dev, "apb_pclk");
-- if (IS_ERR(data->clk) && PTR_ERR(data->clk) == -EPROBE_DEFER) {
-+ if (IS_ERR(data->pclk) && PTR_ERR(data->pclk) == -EPROBE_DEFER) {
- err = -EPROBE_DEFER;
- goto err_clk;
- }
-diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
-index bdfa659..858a546 100644
---- a/drivers/tty/serial/8250/8250_port.c
-+++ b/drivers/tty/serial/8250/8250_port.c
-@@ -1414,12 +1414,8 @@ static void __do_stop_tx_rs485(struct uart_8250_port *p)
- if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
- serial8250_clear_fifos(p);
-
-- serial8250_rpm_get(p);
--
- p->ier |= UART_IER_RLSI | UART_IER_RDI;
- serial_port_out(&p->port, UART_IER, p->ier);
--
-- serial8250_rpm_put(p);
- }
- }
-
-@@ -1429,6 +1425,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
- struct uart_8250_em485 *em485 = p->em485;
- unsigned long flags;
-
-+ serial8250_rpm_get(p);
- spin_lock_irqsave(&p->port.lock, flags);
- if (em485 &&
- em485->active_timer == &em485->stop_tx_timer) {
-@@ -1436,6 +1433,7 @@ static void serial8250_em485_handle_stop_tx(unsigned long arg)
- em485->active_timer = NULL;
- }
- spin_unlock_irqrestore(&p->port.lock, flags);
-+ serial8250_rpm_put(p);
- }
-
- static void __stop_tx_rs485(struct uart_8250_port *p)
-@@ -1475,7 +1473,7 @@ static inline void __stop_tx(struct uart_8250_port *p)
- unsigned char lsr = serial_in(p, UART_LSR);
- /*
- * To provide required timeing and allow FIFO transfer,
-- * __stop_tx_rs485 must be called only when both FIFO and
-+ * __stop_tx_rs485() must be called only when both FIFO and
- * shift register are empty. It is for device driver to enable
- * interrupt on TEMT.
- */
-@@ -1484,9 +1482,10 @@ static inline void __stop_tx(struct uart_8250_port *p)
-
- del_timer(&em485->start_tx_timer);
- em485->active_timer = NULL;
-+
-+ __stop_tx_rs485(p);
- }
- __do_stop_tx(p);
-- __stop_tx_rs485(p);
- }
-
- static void serial8250_stop_tx(struct uart_port *port)
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 2eaa18d..8bbde52 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -1929,6 +1929,9 @@ static void atmel_shutdown(struct uart_port *port)
- {
- struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
-
-+ /* Disable modem control lines interrupts */
-+ atmel_disable_ms(port);
-+
- /* Disable interrupts at device level */
- atmel_uart_writel(port, ATMEL_US_IDR, -1);
-
-@@ -1979,8 +1982,6 @@ static void atmel_shutdown(struct uart_port *port)
- */
- free_irq(port->irq, port);
-
-- atmel_port->ms_irq_enabled = false;
--
- atmel_flush_buffer(port);
- }
-
-diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
-index 0df2b1c..615c027 100644
---- a/drivers/tty/serial/imx.c
-+++ b/drivers/tty/serial/imx.c
-@@ -740,12 +740,13 @@ static unsigned int imx_get_hwmctrl(struct imx_port *sport)
- {
- unsigned int tmp = TIOCM_DSR;
- unsigned usr1 = readl(sport->port.membase + USR1);
-+ unsigned usr2 = readl(sport->port.membase + USR2);
-
- if (usr1 & USR1_RTSS)
- tmp |= TIOCM_CTS;
-
- /* in DCE mode DCDIN is always 0 */
-- if (!(usr1 & USR2_DCDIN))
-+ if (!(usr2 & USR2_DCDIN))
- tmp |= TIOCM_CAR;
-
- if (sport->dte_mode)
-diff --git a/fs/attr.c b/fs/attr.c
-index 42bb42b..3c42cab 100644
---- a/fs/attr.c
-+++ b/fs/attr.c
-@@ -202,6 +202,21 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
- return -EPERM;
- }
-
-+ /*
-+ * If utimes(2) and friends are called with times == NULL (or both
-+ * times are UTIME_NOW), then we need to check for write permission
-+ */
-+ if (ia_valid & ATTR_TOUCH) {
-+ if (IS_IMMUTABLE(inode))
-+ return -EPERM;
-+
-+ if (!inode_owner_or_capable(inode)) {
-+ error = inode_permission(inode, MAY_WRITE);
-+ if (error)
-+ return error;
-+ }
-+ }
-+
- if ((ia_valid & ATTR_MODE)) {
- umode_t amode = attr->ia_mode;
- /* Flag setting protected by i_mutex */
-diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 431fd7e..e44271d 100644
---- a/fs/autofs4/waitq.c
-+++ b/fs/autofs4/waitq.c
-@@ -431,8 +431,8 @@ int autofs4_wait(struct autofs_sb_info *sbi,
- memcpy(&wq->name, &qstr, sizeof(struct qstr));
- wq->dev = autofs4_get_dev(sbi);
- wq->ino = autofs4_get_ino(sbi);
-- wq->uid = current_uid();
-- wq->gid = current_gid();
-+ wq->uid = current_real_cred()->uid;
-+ wq->gid = current_real_cred()->gid;
- wq->pid = pid;
- wq->tgid = tgid;
- wq->status = -EINTR; /* Status return if interrupted */
-diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
-index 029db6e..60a850e 100644
---- a/fs/btrfs/compression.c
-+++ b/fs/btrfs/compression.c
-@@ -698,7 +698,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
-
- ret = btrfs_map_bio(root, comp_bio, mirror_num, 0);
- if (ret) {
-- bio->bi_error = ret;
-+ comp_bio->bi_error = ret;
- bio_endio(comp_bio);
- }
-
-@@ -728,7 +728,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
-
- ret = btrfs_map_bio(root, comp_bio, mirror_num, 0);
- if (ret) {
-- bio->bi_error = ret;
-+ comp_bio->bi_error = ret;
- bio_endio(comp_bio);
- }
-
-diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 33fe035..791e47c 100644
---- a/fs/btrfs/ctree.h
-+++ b/fs/btrfs/ctree.h
-@@ -251,7 +251,8 @@ struct btrfs_super_block {
- #define BTRFS_FEATURE_COMPAT_SAFE_CLEAR 0ULL
-
- #define BTRFS_FEATURE_COMPAT_RO_SUPP \
-- (BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE)
-+ (BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE | \
-+ BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE_VALID)
-
- #define BTRFS_FEATURE_COMPAT_RO_SAFE_SET 0ULL
- #define BTRFS_FEATURE_COMPAT_RO_SAFE_CLEAR 0ULL
-diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index 54bc8c7..3dede6d 100644
---- a/fs/btrfs/disk-io.c
-+++ b/fs/btrfs/disk-io.c
-@@ -2566,6 +2566,7 @@ int open_ctree(struct super_block *sb,
- int num_backups_tried = 0;
- int backup_index = 0;
- int max_active;
-+ int clear_free_space_tree = 0;
-
- tree_root = fs_info->tree_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
- chunk_root = fs_info->chunk_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
-@@ -3129,6 +3130,26 @@ int open_ctree(struct super_block *sb,
- if (sb->s_flags & MS_RDONLY)
- return 0;
-
-+ if (btrfs_test_opt(fs_info, CLEAR_CACHE) &&
-+ btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
-+ clear_free_space_tree = 1;
-+ } else if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) &&
-+ !btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID)) {
-+ btrfs_warn(fs_info, "free space tree is invalid");
-+ clear_free_space_tree = 1;
-+ }
-+
-+ if (clear_free_space_tree) {
-+ btrfs_info(fs_info, "clearing free space tree");
-+ ret = btrfs_clear_free_space_tree(fs_info);
-+ if (ret) {
-+ btrfs_warn(fs_info,
-+ "failed to clear free space tree: %d", ret);
-+ close_ctree(tree_root);
-+ return ret;
-+ }
-+ }
-+
- if (btrfs_test_opt(tree_root->fs_info, FREE_SPACE_TREE) &&
- !btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
- btrfs_info(fs_info, "creating free space tree");
-@@ -3166,18 +3187,6 @@ int open_ctree(struct super_block *sb,
-
- btrfs_qgroup_rescan_resume(fs_info);
-
-- if (btrfs_test_opt(tree_root->fs_info, CLEAR_CACHE) &&
-- btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE)) {
-- btrfs_info(fs_info, "clearing free space tree");
-- ret = btrfs_clear_free_space_tree(fs_info);
-- if (ret) {
-- btrfs_warn(fs_info,
-- "failed to clear free space tree: %d", ret);
-- close_ctree(tree_root);
-- return ret;
-- }
-- }
--
- if (!fs_info->uuid_root) {
- btrfs_info(fs_info, "creating UUID tree");
- ret = btrfs_create_uuid_tree(fs_info);
-diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index 44fe66b..c3ec30d 100644
---- a/fs/btrfs/extent_io.c
-+++ b/fs/btrfs/extent_io.c
-@@ -5524,17 +5524,45 @@ void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src,
- }
- }
-
--/*
-- * The extent buffer bitmap operations are done with byte granularity because
-- * bitmap items are not guaranteed to be aligned to a word and therefore a
-- * single word in a bitmap may straddle two pages in the extent buffer.
-- */
--#define BIT_BYTE(nr) ((nr) / BITS_PER_BYTE)
--#define BYTE_MASK ((1 << BITS_PER_BYTE) - 1)
--#define BITMAP_FIRST_BYTE_MASK(start) \
-- ((BYTE_MASK << ((start) & (BITS_PER_BYTE - 1))) & BYTE_MASK)
--#define BITMAP_LAST_BYTE_MASK(nbits) \
-- (BYTE_MASK >> (-(nbits) & (BITS_PER_BYTE - 1)))
-+void le_bitmap_set(u8 *map, unsigned int start, int len)
-+{
-+ u8 *p = map + BIT_BYTE(start);
-+ const unsigned int size = start + len;
-+ int bits_to_set = BITS_PER_BYTE - (start % BITS_PER_BYTE);
-+ u8 mask_to_set = BITMAP_FIRST_BYTE_MASK(start);
-+
-+ while (len - bits_to_set >= 0) {
-+ *p |= mask_to_set;
-+ len -= bits_to_set;
-+ bits_to_set = BITS_PER_BYTE;
-+ mask_to_set = ~(u8)0;
-+ p++;
-+ }
-+ if (len) {
-+ mask_to_set &= BITMAP_LAST_BYTE_MASK(size);
-+ *p |= mask_to_set;
-+ }
-+}
-+
-+void le_bitmap_clear(u8 *map, unsigned int start, int len)
-+{
-+ u8 *p = map + BIT_BYTE(start);
-+ const unsigned int size = start + len;
-+ int bits_to_clear = BITS_PER_BYTE - (start % BITS_PER_BYTE);
-+ u8 mask_to_clear = BITMAP_FIRST_BYTE_MASK(start);
-+
-+ while (len - bits_to_clear >= 0) {
-+ *p &= ~mask_to_clear;
-+ len -= bits_to_clear;
-+ bits_to_clear = BITS_PER_BYTE;
-+ mask_to_clear = ~(u8)0;
-+ p++;
-+ }
-+ if (len) {
-+ mask_to_clear &= BITMAP_LAST_BYTE_MASK(size);
-+ *p &= ~mask_to_clear;
-+ }
-+}
-
- /*
- * eb_bitmap_offset() - calculate the page and offset of the byte containing the
-@@ -5578,7 +5606,7 @@ static inline void eb_bitmap_offset(struct extent_buffer *eb,
- int extent_buffer_test_bit(struct extent_buffer *eb, unsigned long start,
- unsigned long nr)
- {
-- char *kaddr;
-+ u8 *kaddr;
- struct page *page;
- unsigned long i;
- size_t offset;
-@@ -5600,13 +5628,13 @@ int extent_buffer_test_bit(struct extent_buffer *eb, unsigned long start,
- void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
- unsigned long pos, unsigned long len)
- {
-- char *kaddr;
-+ u8 *kaddr;
- struct page *page;
- unsigned long i;
- size_t offset;
- const unsigned int size = pos + len;
- int bits_to_set = BITS_PER_BYTE - (pos % BITS_PER_BYTE);
-- unsigned int mask_to_set = BITMAP_FIRST_BYTE_MASK(pos);
-+ u8 mask_to_set = BITMAP_FIRST_BYTE_MASK(pos);
-
- eb_bitmap_offset(eb, start, pos, &i, &offset);
- page = eb->pages[i];
-@@ -5617,7 +5645,7 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
- kaddr[offset] |= mask_to_set;
- len -= bits_to_set;
- bits_to_set = BITS_PER_BYTE;
-- mask_to_set = ~0U;
-+ mask_to_set = ~(u8)0;
- if (++offset >= PAGE_SIZE && len > 0) {
- offset = 0;
- page = eb->pages[++i];
-@@ -5642,13 +5670,13 @@ void extent_buffer_bitmap_set(struct extent_buffer *eb, unsigned long start,
- void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
- unsigned long pos, unsigned long len)
- {
-- char *kaddr;
-+ u8 *kaddr;
- struct page *page;
- unsigned long i;
- size_t offset;
- const unsigned int size = pos + len;
- int bits_to_clear = BITS_PER_BYTE - (pos % BITS_PER_BYTE);
-- unsigned int mask_to_clear = BITMAP_FIRST_BYTE_MASK(pos);
-+ u8 mask_to_clear = BITMAP_FIRST_BYTE_MASK(pos);
-
- eb_bitmap_offset(eb, start, pos, &i, &offset);
- page = eb->pages[i];
-@@ -5659,7 +5687,7 @@ void extent_buffer_bitmap_clear(struct extent_buffer *eb, unsigned long start,
- kaddr[offset] &= ~mask_to_clear;
- len -= bits_to_clear;
- bits_to_clear = BITS_PER_BYTE;
-- mask_to_clear = ~0U;
-+ mask_to_clear = ~(u8)0;
- if (++offset >= PAGE_SIZE && len > 0) {
- offset = 0;
- page = eb->pages[++i];
-diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
-index 28cd88f..1cf4e42 100644
---- a/fs/btrfs/extent_io.h
-+++ b/fs/btrfs/extent_io.h
-@@ -59,6 +59,28 @@
- */
- #define EXTENT_PAGE_PRIVATE 1
-
-+/*
-+ * The extent buffer bitmap operations are done with byte granularity instead of
-+ * word granularity for two reasons:
-+ * 1. The bitmaps must be little-endian on disk.
-+ * 2. Bitmap items are not guaranteed to be aligned to a word and therefore a
-+ * single word in a bitmap may straddle two pages in the extent buffer.
-+ */
-+#define BIT_BYTE(nr) ((nr) / BITS_PER_BYTE)
-+#define BYTE_MASK ((1 << BITS_PER_BYTE) - 1)
-+#define BITMAP_FIRST_BYTE_MASK(start) \
-+ ((BYTE_MASK << ((start) & (BITS_PER_BYTE - 1))) & BYTE_MASK)
-+#define BITMAP_LAST_BYTE_MASK(nbits) \
-+ (BYTE_MASK >> (-(nbits) & (BITS_PER_BYTE - 1)))
-+
-+static inline int le_test_bit(int nr, const u8 *addr)
-+{
-+ return 1U & (addr[BIT_BYTE(nr)] >> (nr & (BITS_PER_BYTE-1)));
-+}
-+
-+extern void le_bitmap_set(u8 *map, unsigned int start, int len);
-+extern void le_bitmap_clear(u8 *map, unsigned int start, int len);
-+
- struct extent_state;
- struct btrfs_root;
- struct btrfs_io_bio;
-diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
-index 87e7e3d..ea605ff 100644
---- a/fs/btrfs/free-space-tree.c
-+++ b/fs/btrfs/free-space-tree.c
-@@ -151,7 +151,7 @@ static inline u32 free_space_bitmap_size(u64 size, u32 sectorsize)
- return DIV_ROUND_UP((u32)div_u64(size, sectorsize), BITS_PER_BYTE);
- }
-
--static unsigned long *alloc_bitmap(u32 bitmap_size)
-+static u8 *alloc_bitmap(u32 bitmap_size)
- {
- void *mem;
-
-@@ -180,8 +180,7 @@ int convert_free_space_to_bitmaps(struct btrfs_trans_handle *trans,
- struct btrfs_free_space_info *info;
- struct btrfs_key key, found_key;
- struct extent_buffer *leaf;
-- unsigned long *bitmap;
-- char *bitmap_cursor;
-+ u8 *bitmap, *bitmap_cursor;
- u64 start, end;
- u64 bitmap_range, i;
- u32 bitmap_size, flags, expected_extent_count;
-@@ -231,7 +230,7 @@ int convert_free_space_to_bitmaps(struct btrfs_trans_handle *trans,
- block_group->sectorsize);
- last = div_u64(found_key.objectid + found_key.offset - start,
- block_group->sectorsize);
-- bitmap_set(bitmap, first, last - first);
-+ le_bitmap_set(bitmap, first, last - first);
-
- extent_count++;
- nr++;
-@@ -269,7 +268,7 @@ int convert_free_space_to_bitmaps(struct btrfs_trans_handle *trans,
- goto out;
- }
-
-- bitmap_cursor = (char *)bitmap;
-+ bitmap_cursor = bitmap;
- bitmap_range = block_group->sectorsize * BTRFS_FREE_SPACE_BITMAP_BITS;
- i = start;
- while (i < end) {
-@@ -318,7 +317,7 @@ int convert_free_space_to_extents(struct btrfs_trans_handle *trans,
- struct btrfs_free_space_info *info;
- struct btrfs_key key, found_key;
- struct extent_buffer *leaf;
-- unsigned long *bitmap;
-+ u8 *bitmap;
- u64 start, end;
- /* Initialize to silence GCC. */
- u64 extent_start = 0;
-@@ -362,7 +361,7 @@ int convert_free_space_to_extents(struct btrfs_trans_handle *trans,
- break;
- } else if (found_key.type == BTRFS_FREE_SPACE_BITMAP_KEY) {
- unsigned long ptr;
-- char *bitmap_cursor;
-+ u8 *bitmap_cursor;
- u32 bitmap_pos, data_size;
-
- ASSERT(found_key.objectid >= start);
-@@ -372,7 +371,7 @@ int convert_free_space_to_extents(struct btrfs_trans_handle *trans,
- bitmap_pos = div_u64(found_key.objectid - start,
- block_group->sectorsize *
- BITS_PER_BYTE);
-- bitmap_cursor = ((char *)bitmap) + bitmap_pos;
-+ bitmap_cursor = bitmap + bitmap_pos;
- data_size = free_space_bitmap_size(found_key.offset,
- block_group->sectorsize);
-
-@@ -409,7 +408,7 @@ int convert_free_space_to_extents(struct btrfs_trans_handle *trans,
- offset = start;
- bitnr = 0;
- while (offset < end) {
-- bit = !!test_bit(bitnr, bitmap);
-+ bit = !!le_test_bit(bitnr, bitmap);
- if (prev_bit == 0 && bit == 1) {
- extent_start = offset;
- } else if (prev_bit == 1 && bit == 0) {
-@@ -1183,6 +1182,7 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
- }
-
- btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE);
-+ btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID);
- fs_info->creating_free_space_tree = 0;
-
- ret = btrfs_commit_transaction(trans, tree_root);
-@@ -1251,6 +1251,7 @@ int btrfs_clear_free_space_tree(struct btrfs_fs_info *fs_info)
- return PTR_ERR(trans);
-
- btrfs_clear_fs_compat_ro(fs_info, FREE_SPACE_TREE);
-+ btrfs_clear_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID);
- fs_info->free_space_root = NULL;
-
- ret = clear_free_space_tree(trans, free_space_root);
-diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
-index ce5f345..e7f16a7 100644
---- a/fs/cachefiles/interface.c
-+++ b/fs/cachefiles/interface.c
-@@ -253,6 +253,8 @@ static void cachefiles_drop_object(struct fscache_object *_object)
- struct cachefiles_object *object;
- struct cachefiles_cache *cache;
- const struct cred *saved_cred;
-+ struct inode *inode;
-+ blkcnt_t i_blocks = 0;
-
- ASSERT(_object);
-
-@@ -279,6 +281,10 @@ static void cachefiles_drop_object(struct fscache_object *_object)
- _object != cache->cache.fsdef
- ) {
- _debug("- retire object OBJ%x", object->fscache.debug_id);
-+ inode = d_backing_inode(object->dentry);
-+ if (inode)
-+ i_blocks = inode->i_blocks;
-+
- cachefiles_begin_secure(cache, &saved_cred);
- cachefiles_delete_object(cache, object);
- cachefiles_end_secure(cache, saved_cred);
-@@ -292,7 +298,7 @@ static void cachefiles_drop_object(struct fscache_object *_object)
-
- /* note that the object is now inactive */
- if (test_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags))
-- cachefiles_mark_object_inactive(cache, object);
-+ cachefiles_mark_object_inactive(cache, object, i_blocks);
-
- dput(object->dentry);
- object->dentry = NULL;
-diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
-index 2fcde1a..cd1effe 100644
---- a/fs/cachefiles/internal.h
-+++ b/fs/cachefiles/internal.h
-@@ -160,7 +160,8 @@ extern char *cachefiles_cook_key(const u8 *raw, int keylen, uint8_t type);
- * namei.c
- */
- extern void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
-- struct cachefiles_object *object);
-+ struct cachefiles_object *object,
-+ blkcnt_t i_blocks);
- extern int cachefiles_delete_object(struct cachefiles_cache *cache,
- struct cachefiles_object *object);
- extern int cachefiles_walk_to_object(struct cachefiles_object *parent,
-diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
-index 3f7c2cd..c6ee4b5 100644
---- a/fs/cachefiles/namei.c
-+++ b/fs/cachefiles/namei.c
-@@ -261,10 +261,9 @@ static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
- * Mark an object as being inactive.
- */
- void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
-- struct cachefiles_object *object)
-+ struct cachefiles_object *object,
-+ blkcnt_t i_blocks)
- {
-- blkcnt_t i_blocks = d_backing_inode(object->dentry)->i_blocks;
--
- write_lock(&cache->active_lock);
- rb_erase(&object->active_node, &cache->active_nodes);
- clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
-@@ -707,7 +706,8 @@ int cachefiles_walk_to_object(struct cachefiles_object *parent,
-
- check_error:
- _debug("check error %d", ret);
-- cachefiles_mark_object_inactive(cache, object);
-+ cachefiles_mark_object_inactive(
-+ cache, object, d_backing_inode(object->dentry)->i_blocks);
- release_dentry:
- dput(object->dentry);
- object->dentry = NULL;
-diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
-index 592059f..309f4e9 100644
---- a/fs/debugfs/file.c
-+++ b/fs/debugfs/file.c
-@@ -97,9 +97,6 @@ EXPORT_SYMBOL_GPL(debugfs_use_file_finish);
-
- #define F_DENTRY(filp) ((filp)->f_path.dentry)
-
--#define REAL_FOPS_DEREF(dentry) \
-- ((const struct file_operations *)(dentry)->d_fsdata)
--
- static int open_proxy_open(struct inode *inode, struct file *filp)
- {
- const struct dentry *dentry = F_DENTRY(filp);
-@@ -112,7 +109,7 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
- goto out;
- }
-
-- real_fops = REAL_FOPS_DEREF(dentry);
-+ real_fops = debugfs_real_fops(filp);
- real_fops = fops_get(real_fops);
- if (!real_fops) {
- /* Huh? Module did not clean up after itself at exit? */
-@@ -143,7 +140,7 @@ static ret_type full_proxy_ ## name(proto) \
- { \
- const struct dentry *dentry = F_DENTRY(filp); \
- const struct file_operations *real_fops = \
-- REAL_FOPS_DEREF(dentry); \
-+ debugfs_real_fops(filp); \
- int srcu_idx; \
- ret_type r; \
- \
-@@ -176,7 +173,7 @@ static unsigned int full_proxy_poll(struct file *filp,
- struct poll_table_struct *wait)
- {
- const struct dentry *dentry = F_DENTRY(filp);
-- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
-+ const struct file_operations *real_fops = debugfs_real_fops(filp);
- int srcu_idx;
- unsigned int r = 0;
-
-@@ -193,7 +190,7 @@ static unsigned int full_proxy_poll(struct file *filp,
- static int full_proxy_release(struct inode *inode, struct file *filp)
- {
- const struct dentry *dentry = F_DENTRY(filp);
-- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
-+ const struct file_operations *real_fops = debugfs_real_fops(filp);
- const struct file_operations *proxy_fops = filp->f_op;
- int r = 0;
-
-@@ -241,7 +238,7 @@ static int full_proxy_open(struct inode *inode, struct file *filp)
- goto out;
- }
-
-- real_fops = REAL_FOPS_DEREF(dentry);
-+ real_fops = debugfs_real_fops(filp);
- real_fops = fops_get(real_fops);
- if (!real_fops) {
- /* Huh? Module did not cleanup after itself at exit? */
-diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
-index 963016c..609998d 100644
---- a/fs/dlm/lowcomms.c
-+++ b/fs/dlm/lowcomms.c
-@@ -1656,16 +1656,12 @@ void dlm_lowcomms_stop(void)
- mutex_lock(&connections_lock);
- dlm_allow_conn = 0;
- foreach_conn(stop_conn);
-+ clean_writequeues();
-+ foreach_conn(free_conn);
- mutex_unlock(&connections_lock);
-
- work_stop();
-
-- mutex_lock(&connections_lock);
-- clean_writequeues();
--
-- foreach_conn(free_conn);
--
-- mutex_unlock(&connections_lock);
- kmem_cache_destroy(con_cache);
- }
-
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index d7ccb7f..7f69347 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -5734,6 +5734,9 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
- up_write(&EXT4_I(inode)->i_data_sem);
- goto out_stop;
- }
-+ } else {
-+ ext4_ext_drop_refs(path);
-+ kfree(path);
- }
-
- ret = ext4_es_remove_extent(inode, offset_lblk,
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index c6ea25a..f4cdc64 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -647,11 +647,19 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
- /*
- * We have to zeroout blocks before inserting them into extent
- * status tree. Otherwise someone could look them up there and
-- * use them before they are really zeroed.
-+ * use them before they are really zeroed. We also have to
-+ * unmap metadata before zeroing as otherwise writeback can
-+ * overwrite zeros with stale data from block device.
- */
- if (flags & EXT4_GET_BLOCKS_ZERO &&
- map->m_flags & EXT4_MAP_MAPPED &&
- map->m_flags & EXT4_MAP_NEW) {
-+ ext4_lblk_t i;
-+
-+ for (i = 0; i < map->m_len; i++) {
-+ unmap_underlying_metadata(inode->i_sb->s_bdev,
-+ map->m_pblk + i);
-+ }
- ret = ext4_issue_zeroout(inode, map->m_lblk,
- map->m_pblk, map->m_len);
- if (ret) {
-@@ -1649,6 +1657,8 @@ static void mpage_release_unused_pages(struct mpage_da_data *mpd,
- BUG_ON(!PageLocked(page));
- BUG_ON(PageWriteback(page));
- if (invalidate) {
-+ if (page_mapped(page))
-+ clear_page_dirty_for_io(page);
- block_invalidatepage(page, 0, PAGE_SIZE);
- ClearPageUptodate(page);
- }
-@@ -3890,7 +3900,7 @@ int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
- }
-
- /*
-- * ext4_punch_hole: punches a hole in a file by releaseing the blocks
-+ * ext4_punch_hole: punches a hole in a file by releasing the blocks
- * associated with the given offset and length
- *
- * @inode: File inode
-@@ -3919,7 +3929,7 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
- * Write out all dirty pages to avoid race conditions
- * Then release them.
- */
-- if (mapping->nrpages && mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) {
-+ if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY)) {
- ret = filemap_write_and_wait_range(mapping, offset,
- offset + length - 1);
- if (ret)
-@@ -4814,14 +4824,14 @@ static int ext4_do_update_inode(handle_t *handle,
- * Fix up interoperability with old kernels. Otherwise, old inodes get
- * re-used with the upper 16 bits of the uid/gid intact
- */
-- if (!ei->i_dtime) {
-+ if (ei->i_dtime && list_empty(&ei->i_orphan)) {
-+ raw_inode->i_uid_high = 0;
-+ raw_inode->i_gid_high = 0;
-+ } else {
- raw_inode->i_uid_high =
- cpu_to_le16(high_16_bits(i_uid));
- raw_inode->i_gid_high =
- cpu_to_le16(high_16_bits(i_gid));
-- } else {
-- raw_inode->i_uid_high = 0;
-- raw_inode->i_gid_high = 0;
- }
- } else {
- raw_inode->i_uid_low = cpu_to_le16(fs_high2lowuid(i_uid));
-diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
-index a920c5d..6fc14de 100644
---- a/fs/ext4/move_extent.c
-+++ b/fs/ext4/move_extent.c
-@@ -598,6 +598,13 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
- return -EOPNOTSUPP;
- }
-
-+ if (ext4_encrypted_inode(orig_inode) ||
-+ ext4_encrypted_inode(donor_inode)) {
-+ ext4_msg(orig_inode->i_sb, KERN_ERR,
-+ "Online defrag not supported for encrypted files");
-+ return -EOPNOTSUPP;
-+ }
-+
- /* Protect orig and donor inodes against a truncate */
- lock_two_nondirectories(orig_inode, donor_inode);
-
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index 34c0142..7e2f8c3 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -2044,33 +2044,31 @@ static int make_indexed_dir(handle_t *handle, struct ext4_filename *fname,
- frame->entries = entries;
- frame->at = entries;
- frame->bh = bh;
-- bh = bh2;
-
- retval = ext4_handle_dirty_dx_node(handle, dir, frame->bh);
- if (retval)
- goto out_frames;
-- retval = ext4_handle_dirty_dirent_node(handle, dir, bh);
-+ retval = ext4_handle_dirty_dirent_node(handle, dir, bh2);
- if (retval)
- goto out_frames;
-
-- de = do_split(handle,dir, &bh, frame, &fname->hinfo);
-+ de = do_split(handle,dir, &bh2, frame, &fname->hinfo);
- if (IS_ERR(de)) {
- retval = PTR_ERR(de);
- goto out_frames;
- }
-- dx_release(frames);
-
-- retval = add_dirent_to_buf(handle, fname, dir, inode, de, bh);
-- brelse(bh);
-- return retval;
-+ retval = add_dirent_to_buf(handle, fname, dir, inode, de, bh2);
- out_frames:
- /*
- * Even if the block split failed, we have to properly write
- * out all the changes we did so far. Otherwise we can end up
- * with corrupted filesystem.
- */
-- ext4_mark_inode_dirty(handle, dir);
-+ if (retval)
-+ ext4_mark_inode_dirty(handle, dir);
- dx_release(frames);
-+ brelse(bh2);
- return retval;
- }
-
-diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
-index 4d83d9e..04a7850 100644
---- a/fs/ext4/symlink.c
-+++ b/fs/ext4/symlink.c
-@@ -65,13 +65,12 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,
- res = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
- if (res)
- goto errout;
-+ paddr = pstr.name;
-
- res = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
- if (res < 0)
- goto errout;
-
-- paddr = pstr.name;
--
- /* Null-terminate the name */
- if (res <= pstr.len)
- paddr[res] = '\0';
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index c47b778..4ff9251 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -1702,14 +1702,46 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
- static int fuse_setattr(struct dentry *entry, struct iattr *attr)
- {
- struct inode *inode = d_inode(entry);
-+ struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
-+ int ret;
-
- if (!fuse_allow_current_process(get_fuse_conn(inode)))
- return -EACCES;
-
-- if (attr->ia_valid & ATTR_FILE)
-- return fuse_do_setattr(inode, attr, attr->ia_file);
-- else
-- return fuse_do_setattr(inode, attr, NULL);
-+ if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
-+ int kill;
-+
-+ attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
-+ ATTR_MODE);
-+ /*
-+ * ia_mode calculation may have used stale i_mode. Refresh and
-+ * recalculate.
-+ */
-+ ret = fuse_do_getattr(inode, NULL, file);
-+ if (ret)
-+ return ret;
-+
-+ attr->ia_mode = inode->i_mode;
-+ kill = should_remove_suid(entry);
-+ if (kill & ATTR_KILL_SUID) {
-+ attr->ia_valid |= ATTR_MODE;
-+ attr->ia_mode &= ~S_ISUID;
-+ }
-+ if (kill & ATTR_KILL_SGID) {
-+ attr->ia_valid |= ATTR_MODE;
-+ attr->ia_mode &= ~S_ISGID;
-+ }
-+ }
-+ if (!attr->ia_valid)
-+ return 0;
-+
-+ ret = fuse_do_setattr(inode, attr, file);
-+ if (!ret) {
-+ /* Directory mode changed, may need to revalidate access */
-+ if (d_is_dir(entry) && (attr->ia_valid & ATTR_MODE))
-+ fuse_invalidate_entry_cache(entry);
-+ }
-+ return ret;
- }
-
- static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
-@@ -1801,6 +1833,23 @@ static ssize_t fuse_getxattr(struct dentry *entry, struct inode *inode,
- return ret;
- }
-
-+static int fuse_verify_xattr_list(char *list, size_t size)
-+{
-+ size_t origsize = size;
-+
-+ while (size) {
-+ size_t thislen = strnlen(list, size);
-+
-+ if (!thislen || thislen == size)
-+ return -EIO;
-+
-+ size -= thislen + 1;
-+ list += thislen + 1;
-+ }
-+
-+ return origsize;
-+}
-+
- static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
- {
- struct inode *inode = d_inode(entry);
-@@ -1836,6 +1885,8 @@ static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
- ret = fuse_simple_request(fc, &args);
- if (!ret && !size)
- ret = outarg.size;
-+ if (ret > 0 && size)
-+ ret = fuse_verify_xattr_list(list, ret);
- if (ret == -ENOSYS) {
- fc->no_listxattr = 1;
- ret = -EOPNOTSUPP;
-diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
-index b5bc3e2..3d8246a 100644
---- a/fs/jbd2/transaction.c
-+++ b/fs/jbd2/transaction.c
-@@ -159,6 +159,7 @@ static void wait_transaction_locked(journal_t *journal)
- read_unlock(&journal->j_state_lock);
- if (need_to_start)
- jbd2_log_start_commit(journal, tid);
-+ jbd2_might_wait_for_commit(journal);
- schedule();
- finish_wait(&journal->j_wait_transaction_locked, &wait);
- }
-@@ -182,8 +183,6 @@ static int add_transaction_credits(journal_t *journal, int blocks,
- int needed;
- int total = blocks + rsv_blocks;
-
-- jbd2_might_wait_for_commit(journal);
--
- /*
- * If the current transaction is locked down for commit, wait
- * for the lock to be released.
-@@ -214,6 +213,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
- if (atomic_read(&journal->j_reserved_credits) + total >
- journal->j_max_transaction_buffers) {
- read_unlock(&journal->j_state_lock);
-+ jbd2_might_wait_for_commit(journal);
- wait_event(journal->j_wait_reserved,
- atomic_read(&journal->j_reserved_credits) + total <=
- journal->j_max_transaction_buffers);
-@@ -238,6 +238,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
- if (jbd2_log_space_left(journal) < jbd2_space_needed(journal)) {
- atomic_sub(total, &t->t_outstanding_credits);
- read_unlock(&journal->j_state_lock);
-+ jbd2_might_wait_for_commit(journal);
- write_lock(&journal->j_state_lock);
- if (jbd2_log_space_left(journal) < jbd2_space_needed(journal))
- __jbd2_log_wait_for_space(journal);
-@@ -255,6 +256,7 @@ static int add_transaction_credits(journal_t *journal, int blocks,
- sub_reserved_credits(journal, rsv_blocks);
- atomic_sub(total, &t->t_outstanding_credits);
- read_unlock(&journal->j_state_lock);
-+ jbd2_might_wait_for_commit(journal);
- wait_event(journal->j_wait_reserved,
- atomic_read(&journal->j_reserved_credits) + rsv_blocks
- <= journal->j_max_transaction_buffers / 2);
-diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
-index 7a4a85a..74d5ddd 100644
---- a/fs/reiserfs/super.c
-+++ b/fs/reiserfs/super.c
-@@ -190,7 +190,15 @@ static int remove_save_link_only(struct super_block *s,
- static int reiserfs_quota_on_mount(struct super_block *, int);
- #endif
-
--/* look for uncompleted unlinks and truncates and complete them */
-+/*
-+ * Look for uncompleted unlinks and truncates and complete them
-+ *
-+ * Called with superblock write locked. If quotas are enabled, we have to
-+ * release/retake lest we call dquot_quota_on_mount(), proceed to
-+ * schedule_on_each_cpu() in invalidate_bdev() and deadlock waiting for the per
-+ * cpu worklets to complete flush_async_commits() that in turn wait for the
-+ * superblock write lock.
-+ */
- static int finish_unfinished(struct super_block *s)
- {
- INITIALIZE_PATH(path);
-@@ -237,7 +245,9 @@ static int finish_unfinished(struct super_block *s)
- quota_enabled[i] = 0;
- continue;
- }
-+ reiserfs_write_unlock(s);
- ret = reiserfs_quota_on_mount(s, i);
-+ reiserfs_write_lock(s);
- if (ret < 0)
- reiserfs_warning(s, "reiserfs-2500",
- "cannot turn on journaled "
-diff --git a/fs/utimes.c b/fs/utimes.c
-index 794f5f5..ba54b9e 100644
---- a/fs/utimes.c
-+++ b/fs/utimes.c
-@@ -87,21 +87,7 @@ static int utimes_common(struct path *path, struct timespec *times)
- */
- newattrs.ia_valid |= ATTR_TIMES_SET;
- } else {
-- /*
-- * If times is NULL (or both times are UTIME_NOW),
-- * then we need to check permissions, because
-- * inode_change_ok() won't do it.
-- */
-- error = -EPERM;
-- if (IS_IMMUTABLE(inode))
-- goto mnt_drop_write_and_out;
--
-- error = -EACCES;
-- if (!inode_owner_or_capable(inode)) {
-- error = inode_permission(inode, MAY_WRITE);
-- if (error)
-- goto mnt_drop_write_and_out;
-- }
-+ newattrs.ia_valid |= ATTR_TOUCH;
- }
- retry_deleg:
- inode_lock(inode);
-@@ -113,7 +99,6 @@ static int utimes_common(struct path *path, struct timespec *times)
- goto retry_deleg;
- }
-
--mnt_drop_write_and_out:
- mnt_drop_write(path->mnt);
- out:
- return error;
-diff --git a/include/crypto/ghash.h b/include/crypto/ghash.h
-new file mode 100644
-index 0000000..2a61c9b
---- /dev/null
-+++ b/include/crypto/ghash.h
-@@ -0,0 +1,23 @@
-+/*
-+ * Common values for GHASH algorithms
-+ */
-+
-+#ifndef __CRYPTO_GHASH_H__
-+#define __CRYPTO_GHASH_H__
-+
-+#include <linux/types.h>
-+#include <crypto/gf128mul.h>
-+
-+#define GHASH_BLOCK_SIZE 16
-+#define GHASH_DIGEST_SIZE 16
-+
-+struct ghash_ctx {
-+ struct gf128mul_4k *gf128;
-+};
-+
-+struct ghash_desc_ctx {
-+ u8 buffer[GHASH_BLOCK_SIZE];
-+ u32 bytes;
-+};
-+
-+#endif
-diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
-index 1438e23..4d3f0d1 100644
---- a/include/linux/debugfs.h
-+++ b/include/linux/debugfs.h
-@@ -45,6 +45,23 @@ extern struct dentry *arch_debugfs_dir;
-
- extern struct srcu_struct debugfs_srcu;
-
-+/**
-+ * debugfs_real_fops - getter for the real file operation
-+ * @filp: a pointer to a struct file
-+ *
-+ * Must only be called under the protection established by
-+ * debugfs_use_file_start().
-+ */
-+static inline const struct file_operations *debugfs_real_fops(struct file *filp)
-+ __must_hold(&debugfs_srcu)
-+{
-+ /*
-+ * Neither the pointer to the struct file_operations, nor its
-+ * contents ever change -- srcu_dereference() is not needed here.
-+ */
-+ return filp->f_path.dentry->d_fsdata;
-+}
-+
- #if defined(CONFIG_DEBUG_FS)
-
- struct dentry *debugfs_create_file(const char *name, umode_t mode,
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 901e25d..7c39136 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -224,6 +224,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
- #define ATTR_KILL_PRIV (1 << 14)
- #define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */
- #define ATTR_TIMES_SET (1 << 16)
-+#define ATTR_TOUCH (1 << 17)
-
- /*
- * Whiteout is represented by a char device. The following constants define the
-diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
-index 4c45105..52b97db 100644
---- a/include/linux/radix-tree.h
-+++ b/include/linux/radix-tree.h
-@@ -280,9 +280,9 @@ bool __radix_tree_delete_node(struct radix_tree_root *root,
- struct radix_tree_node *node);
- void *radix_tree_delete_item(struct radix_tree_root *, unsigned long, void *);
- void *radix_tree_delete(struct radix_tree_root *, unsigned long);
--struct radix_tree_node *radix_tree_replace_clear_tags(
-- struct radix_tree_root *root,
-- unsigned long index, void *entry);
-+void radix_tree_clear_tags(struct radix_tree_root *root,
-+ struct radix_tree_node *node,
-+ void **slot);
- unsigned int radix_tree_gang_lookup(struct radix_tree_root *root,
- void **results, unsigned long first_index,
- unsigned int max_items);
-diff --git a/include/linux/sem.h b/include/linux/sem.h
-index 976ce3a..d0efd6e 100644
---- a/include/linux/sem.h
-+++ b/include/linux/sem.h
-@@ -21,6 +21,7 @@ struct sem_array {
- struct list_head list_id; /* undo requests on this array */
- int sem_nsems; /* no. of semaphores in array */
- int complex_count; /* pending complex operations */
-+ bool complex_mode; /* no parallel simple ops */
- };
-
- #ifdef CONFIG_SYSVIPC
-diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
-index ac5eacd..db4c253 100644
---- a/include/uapi/linux/btrfs.h
-+++ b/include/uapi/linux/btrfs.h
-@@ -239,7 +239,17 @@ struct btrfs_ioctl_fs_info_args {
- * Used by:
- * struct btrfs_ioctl_feature_flags
- */
--#define BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE (1ULL << 0)
-+#define BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE (1ULL << 0)
-+/*
-+ * Older kernels (< 4.9) on big-endian systems produced broken free space tree
-+ * bitmaps, and btrfs-progs also used to corrupt the free space tree (versions
-+ * < 4.7.3). If this bit is clear, then the free space tree cannot be trusted.
-+ * btrfs-progs can also intentionally clear this bit to ask the kernel to
-+ * rebuild the free space tree, however this might not work on older kernels
-+ * that do not know about this bit. If not sure, clear the cache manually on
-+ * first mount when booting older kernel versions.
-+ */
-+#define BTRFS_FEATURE_COMPAT_RO_FREE_SPACE_TREE_VALID (1ULL << 1)
-
- #define BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF (1ULL << 0)
- #define BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL (1ULL << 1)
-diff --git a/ipc/sem.c b/ipc/sem.c
-index 7c9d4f7..5e318c5 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -162,14 +162,21 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
-
- /*
- * Locking:
-+ * a) global sem_lock() for read/write
- * sem_undo.id_next,
- * sem_array.complex_count,
-- * sem_array.pending{_alter,_cont},
-- * sem_array.sem_undo: global sem_lock() for read/write
-- * sem_undo.proc_next: only "current" is allowed to read/write that field.
-+ * sem_array.complex_mode
-+ * sem_array.pending{_alter,_const},
-+ * sem_array.sem_undo
- *
-+ * b) global or semaphore sem_lock() for read/write:
- * sem_array.sem_base[i].pending_{const,alter}:
-- * global or semaphore sem_lock() for read/write
-+ * sem_array.complex_mode (for read)
-+ *
-+ * c) special:
-+ * sem_undo_list.list_proc:
-+ * * undo_list->lock for write
-+ * * rcu for read
- */
-
- #define sc_semmsl sem_ctls[0]
-@@ -260,30 +267,61 @@ static void sem_rcu_free(struct rcu_head *head)
- }
-
- /*
-- * Wait until all currently ongoing simple ops have completed.
-+ * Enter the mode suitable for non-simple operations:
- * Caller must own sem_perm.lock.
-- * New simple ops cannot start, because simple ops first check
-- * that sem_perm.lock is free.
-- * that a) sem_perm.lock is free and b) complex_count is 0.
- */
--static void sem_wait_array(struct sem_array *sma)
-+static void complexmode_enter(struct sem_array *sma)
- {
- int i;
- struct sem *sem;
-
-- if (sma->complex_count) {
-- /* The thread that increased sma->complex_count waited on
-- * all sem->lock locks. Thus we don't need to wait again.
-- */
-+ if (sma->complex_mode) {
-+ /* We are already in complex_mode. Nothing to do */
- return;
- }
-
-+ /* We need a full barrier after seting complex_mode:
-+ * The write to complex_mode must be visible
-+ * before we read the first sem->lock spinlock state.
-+ */
-+ smp_store_mb(sma->complex_mode, true);
-+
- for (i = 0; i < sma->sem_nsems; i++) {
- sem = sma->sem_base + i;
- spin_unlock_wait(&sem->lock);
- }
-+ /*
-+ * spin_unlock_wait() is not a memory barriers, it is only a
-+ * control barrier. The code must pair with spin_unlock(&sem->lock),
-+ * thus just the control barrier is insufficient.
-+ *
-+ * smp_rmb() is sufficient, as writes cannot pass the control barrier.
-+ */
-+ smp_rmb();
-+}
-+
-+/*
-+ * Try to leave the mode that disallows simple operations:
-+ * Caller must own sem_perm.lock.
-+ */
-+static void complexmode_tryleave(struct sem_array *sma)
-+{
-+ if (sma->complex_count) {
-+ /* Complex ops are sleeping.
-+ * We must stay in complex mode
-+ */
-+ return;
-+ }
-+ /*
-+ * Immediately after setting complex_mode to false,
-+ * a simple op can start. Thus: all memory writes
-+ * performed by the current operation must be visible
-+ * before we set complex_mode to false.
-+ */
-+ smp_store_release(&sma->complex_mode, false);
- }
-
-+#define SEM_GLOBAL_LOCK (-1)
- /*
- * If the request contains only one semaphore operation, and there are
- * no complex transactions pending, lock only the semaphore involved.
-@@ -300,56 +338,42 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
- /* Complex operation - acquire a full lock */
- ipc_lock_object(&sma->sem_perm);
-
-- /* And wait until all simple ops that are processed
-- * right now have dropped their locks.
-- */
-- sem_wait_array(sma);
-- return -1;
-+ /* Prevent parallel simple ops */
-+ complexmode_enter(sma);
-+ return SEM_GLOBAL_LOCK;
- }
-
- /*
- * Only one semaphore affected - try to optimize locking.
-- * The rules are:
-- * - optimized locking is possible if no complex operation
-- * is either enqueued or processed right now.
-- * - The test for enqueued complex ops is simple:
-- * sma->complex_count != 0
-- * - Testing for complex ops that are processed right now is
-- * a bit more difficult. Complex ops acquire the full lock
-- * and first wait that the running simple ops have completed.
-- * (see above)
-- * Thus: If we own a simple lock and the global lock is free
-- * and complex_count is now 0, then it will stay 0 and
-- * thus just locking sem->lock is sufficient.
-+ * Optimized locking is possible if no complex operation
-+ * is either enqueued or processed right now.
-+ *
-+ * Both facts are tracked by complex_mode.
- */
- sem = sma->sem_base + sops->sem_num;
-
-- if (sma->complex_count == 0) {
-+ /*
-+ * Initial check for complex_mode. Just an optimization,
-+ * no locking, no memory barrier.
-+ */
-+ if (!sma->complex_mode) {
- /*
- * It appears that no complex operation is around.
- * Acquire the per-semaphore lock.
- */
- spin_lock(&sem->lock);
-
-- /* Then check that the global lock is free */
-- if (!spin_is_locked(&sma->sem_perm.lock)) {
-- /*
-- * We need a memory barrier with acquire semantics,
-- * otherwise we can race with another thread that does:
-- * complex_count++;
-- * spin_unlock(sem_perm.lock);
-- */
-- smp_acquire__after_ctrl_dep();
-+ /*
-+ * See 51d7d5205d33
-+ * ("powerpc: Add smp_mb() to arch_spin_is_locked()"):
-+ * A full barrier is required: the write of sem->lock
-+ * must be visible before the read is executed
-+ */
-+ smp_mb();
-
-- /*
-- * Now repeat the test of complex_count:
-- * It can't change anymore until we drop sem->lock.
-- * Thus: if is now 0, then it will stay 0.
-- */
-- if (sma->complex_count == 0) {
-- /* fast path successful! */
-- return sops->sem_num;
-- }
-+ if (!smp_load_acquire(&sma->complex_mode)) {
-+ /* fast path successful! */
-+ return sops->sem_num;
- }
- spin_unlock(&sem->lock);
- }
-@@ -369,15 +393,16 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
- /* Not a false alarm, thus complete the sequence for a
- * full lock.
- */
-- sem_wait_array(sma);
-- return -1;
-+ complexmode_enter(sma);
-+ return SEM_GLOBAL_LOCK;
- }
- }
-
- static inline void sem_unlock(struct sem_array *sma, int locknum)
- {
-- if (locknum == -1) {
-+ if (locknum == SEM_GLOBAL_LOCK) {
- unmerge_queues(sma);
-+ complexmode_tryleave(sma);
- ipc_unlock_object(&sma->sem_perm);
- } else {
- struct sem *sem = sma->sem_base + locknum;
-@@ -529,6 +554,7 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
- }
-
- sma->complex_count = 0;
-+ sma->complex_mode = true; /* dropped by sem_unlock below */
- INIT_LIST_HEAD(&sma->pending_alter);
- INIT_LIST_HEAD(&sma->pending_const);
- INIT_LIST_HEAD(&sma->list_id);
-@@ -2184,10 +2210,10 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
- /*
- * The proc interface isn't aware of sem_lock(), it calls
- * ipc_lock_object() directly (in sysvipc_find_ipc).
-- * In order to stay compatible with sem_lock(), we must wait until
-- * all simple semop() calls have left their critical regions.
-+ * In order to stay compatible with sem_lock(), we must
-+ * enter / leave complex_mode.
- */
-- sem_wait_array(sma);
-+ complexmode_enter(sma);
-
- sem_otime = get_semotime(sma);
-
-@@ -2204,6 +2230,8 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
- sem_otime,
- sma->sem_ctime);
-
-+ complexmode_tryleave(sma);
-+
- return 0;
- }
- #endif
-diff --git a/lib/radix-tree.c b/lib/radix-tree.c
-index 91f0727..8e6d552 100644
---- a/lib/radix-tree.c
-+++ b/lib/radix-tree.c
-@@ -1583,15 +1583,10 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
- }
- EXPORT_SYMBOL(radix_tree_delete);
-
--struct radix_tree_node *radix_tree_replace_clear_tags(
-- struct radix_tree_root *root,
-- unsigned long index, void *entry)
-+void radix_tree_clear_tags(struct radix_tree_root *root,
-+ struct radix_tree_node *node,
-+ void **slot)
- {
-- struct radix_tree_node *node;
-- void **slot;
--
-- __radix_tree_lookup(root, index, &node, &slot);
--
- if (node) {
- unsigned int tag, offset = get_slot_offset(node, slot);
- for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++)
-@@ -1600,9 +1595,6 @@ struct radix_tree_node *radix_tree_replace_clear_tags(
- /* Clear root node tags */
- root->gfp_mask &= __GFP_BITS_MASK;
- }
--
-- radix_tree_replace_slot(slot, entry);
-- return node;
- }
-
- /**
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 2d0986a..ced9ef6 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -169,33 +169,35 @@ static int page_cache_tree_insert(struct address_space *mapping,
- static void page_cache_tree_delete(struct address_space *mapping,
- struct page *page, void *shadow)
- {
-- struct radix_tree_node *node;
- int i, nr = PageHuge(page) ? 1 : hpage_nr_pages(page);
-
- VM_BUG_ON_PAGE(!PageLocked(page), page);
- VM_BUG_ON_PAGE(PageTail(page), page);
- VM_BUG_ON_PAGE(nr != 1 && shadow, page);
-
-- if (shadow) {
-- mapping->nrexceptional += nr;
-- /*
-- * Make sure the nrexceptional update is committed before
-- * the nrpages update so that final truncate racing
-- * with reclaim does not see both counters 0 at the
-- * same time and miss a shadow entry.
-- */
-- smp_wmb();
-- }
-- mapping->nrpages -= nr;
--
- for (i = 0; i < nr; i++) {
-- node = radix_tree_replace_clear_tags(&mapping->page_tree,
-- page->index + i, shadow);
-+ struct radix_tree_node *node;
-+ void **slot;
-+
-+ __radix_tree_lookup(&mapping->page_tree, page->index + i,
-+ &node, &slot);
-+
-+ radix_tree_clear_tags(&mapping->page_tree, node, slot);
-+
- if (!node) {
- VM_BUG_ON_PAGE(nr != 1, page);
-- return;
-+ /*
-+ * We need a node to properly account shadow
-+ * entries. Don't plant any without. XXX
-+ */
-+ shadow = NULL;
- }
-
-+ radix_tree_replace_slot(slot, shadow);
-+
-+ if (!node)
-+ break;
-+
- workingset_node_pages_dec(node);
- if (shadow)
- workingset_node_shadows_inc(node);
-@@ -219,6 +221,18 @@ static void page_cache_tree_delete(struct address_space *mapping,
- &node->private_list);
- }
- }
-+
-+ if (shadow) {
-+ mapping->nrexceptional += nr;
-+ /*
-+ * Make sure the nrexceptional update is committed before
-+ * the nrpages update so that final truncate racing
-+ * with reclaim does not see both counters 0 at the
-+ * same time and miss a shadow entry.
-+ */
-+ smp_wmb();
-+ }
-+ mapping->nrpages -= nr;
- }
-
- /*
-@@ -619,7 +633,6 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
- __delete_from_page_cache(old, NULL);
- error = page_cache_tree_insert(mapping, new, NULL);
- BUG_ON(error);
-- mapping->nrpages++;
-
- /*
- * hugetlb pages do not participate in page cache accounting.
-@@ -1674,6 +1687,10 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
- unsigned int prev_offset;
- int error = 0;
-
-+ if (unlikely(*ppos >= inode->i_sb->s_maxbytes))
-+ return -EINVAL;
-+ iov_iter_truncate(iter, inode->i_sb->s_maxbytes);
-+
- index = *ppos >> PAGE_SHIFT;
- prev_index = ra->prev_pos >> PAGE_SHIFT;
- prev_offset = ra->prev_pos & (PAGE_SIZE-1);
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 87e11d8..603bdd0 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -1443,13 +1443,14 @@ static void dissolve_free_huge_page(struct page *page)
- {
- spin_lock(&hugetlb_lock);
- if (PageHuge(page) && !page_count(page)) {
-- struct hstate *h = page_hstate(page);
-- int nid = page_to_nid(page);
-- list_del(&page->lru);
-+ struct page *head = compound_head(page);
-+ struct hstate *h = page_hstate(head);
-+ int nid = page_to_nid(head);
-+ list_del(&head->lru);
- h->free_huge_pages--;
- h->free_huge_pages_node[nid]--;
- h->max_huge_pages--;
-- update_and_free_page(h, page);
-+ update_and_free_page(h, head);
- }
- spin_unlock(&hugetlb_lock);
- }
-@@ -1457,7 +1458,8 @@ static void dissolve_free_huge_page(struct page *page)
- /*
- * Dissolve free hugepages in a given pfn range. Used by memory hotplug to
- * make specified memory blocks removable from the system.
-- * Note that start_pfn should aligned with (minimum) hugepage size.
-+ * Note that this will dissolve a free gigantic hugepage completely, if any
-+ * part of it lies within the given range.
- */
- void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
- {
-@@ -1466,7 +1468,6 @@ void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
- if (!hugepages_supported())
- return;
-
-- VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
- dissolve_free_huge_page(pfn_to_page(pfn));
- }
-diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
-index 2e59a85..ff56637 100644
---- a/sound/soc/codecs/nau8825.c
-+++ b/sound/soc/codecs/nau8825.c
-@@ -1907,7 +1907,7 @@ static int nau8825_calc_fll_param(unsigned int fll_in, unsigned int fs,
- /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
- * input based on FDCO, FREF and FLL ratio.
- */
-- fvco = div_u64(fvco << 16, fref * fll_param->ratio);
-+ fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
- fll_param->fll_int = (fvco >> 16) & 0x3FF;
- fll_param->fll_frac = fvco & 0xFFFF;
- return 0;
-diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c
-index adb32fe..b1e6b8f 100644
---- a/sound/soc/intel/atom/sst/sst_pvt.c
-+++ b/sound/soc/intel/atom/sst/sst_pvt.c
-@@ -279,17 +279,15 @@ int sst_prepare_and_post_msg(struct intel_sst_drv *sst,
-
- if (response) {
- ret = sst_wait_timeout(sst, block);
-- if (ret < 0) {
-+ if (ret < 0)
- goto out;
-- } else if(block->data) {
-- if (!data)
-- goto out;
-- *data = kzalloc(block->size, GFP_KERNEL);
-- if (!(*data)) {
-+
-+ if (data && block->data) {
-+ *data = kmemdup(block->data, block->size, GFP_KERNEL);
-+ if (!*data) {
- ret = -ENOMEM;
- goto out;
-- } else
-- memcpy(data, (void *) block->data, block->size);
-+ }
- }
- }
- out:
diff --git a/4.8.7/1004_linux-4.8.5.patch b/4.8.7/1004_linux-4.8.5.patch
deleted file mode 100644
index b4a1ae0..0000000
--- a/4.8.7/1004_linux-4.8.5.patch
+++ /dev/null
@@ -1,5397 +0,0 @@
-diff --git a/Documentation/ABI/testing/sysfs-class-cxl b/Documentation/ABI/testing/sysfs-class-cxl
-index 4ba0a2a..640f65e 100644
---- a/Documentation/ABI/testing/sysfs-class-cxl
-+++ b/Documentation/ABI/testing/sysfs-class-cxl
-@@ -220,8 +220,11 @@ What: /sys/class/cxl/<card>/reset
- Date: October 2014
- Contact: linuxppc-dev@lists.ozlabs.org
- Description: write only
-- Writing 1 will issue a PERST to card which may cause the card
-- to reload the FPGA depending on load_image_on_perst.
-+ Writing 1 will issue a PERST to card provided there are no
-+ contexts active on any one of the card AFUs. This may cause
-+ the card to reload the FPGA depending on load_image_on_perst.
-+ Writing -1 will do a force PERST irrespective of any active
-+ contexts on the card AFUs.
- Users: https://github.com/ibm-capi/libcxl
-
- What: /sys/class/cxl/<card>/perst_reloads_same_image (not in a guest)
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index a4f4d69..46726d4 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1457,7 +1457,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- i8042.nopnp [HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
- controllers
- i8042.notimeout [HW] Ignore timeout condition signalled by controller
-- i8042.reset [HW] Reset the controller during init and cleanup
-+ i8042.reset [HW] Reset the controller during init, cleanup and
-+ suspend-to-ram transitions, only during s2r
-+ transitions, or never reset
-+ Format: { 1 | Y | y | 0 | N | n }
-+ 1, Y, y: always reset controller
-+ 0, N, n: don't ever reset controller
-+ Default: only on s2r transitions on x86; most other
-+ architectures force reset to be always executed
- i8042.unlock [HW] Unlock (ignore) the keylock
- i8042.kbdreset [HW] Reset device connected to KBD port
-
-diff --git a/Makefile b/Makefile
-index 82a36ab..daa3a01 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 4
-+SUBLEVEL = 5
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
-index 6cb3736..d347bbc 100644
---- a/arch/arc/kernel/signal.c
-+++ b/arch/arc/kernel/signal.c
-@@ -107,13 +107,13 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
- struct user_regs_struct uregs;
-
- err = __copy_from_user(&set, &sf->uc.uc_sigmask, sizeof(set));
-- if (!err)
-- set_current_blocked(&set);
--
- err |= __copy_from_user(&uregs.scratch,
- &(sf->uc.uc_mcontext.regs.scratch),
- sizeof(sf->uc.uc_mcontext.regs.scratch));
-+ if (err)
-+ return err;
-
-+ set_current_blocked(&set);
- regs->bta = uregs.scratch.bta;
- regs->lp_start = uregs.scratch.lp_start;
- regs->lp_end = uregs.scratch.lp_end;
-@@ -138,7 +138,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
- regs->r0 = uregs.scratch.r0;
- regs->sp = uregs.scratch.sp;
-
-- return err;
-+ return 0;
- }
-
- static inline int is_do_ss_needed(unsigned int magic)
-diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
-index 4cdeae3..948a9a8 100644
---- a/arch/arm64/include/asm/kvm_emulate.h
-+++ b/arch/arm64/include/asm/kvm_emulate.h
-@@ -167,11 +167,6 @@ static inline bool kvm_vcpu_dabt_isvalid(const struct kvm_vcpu *vcpu)
- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_ISV);
- }
-
--static inline bool kvm_vcpu_dabt_iswrite(const struct kvm_vcpu *vcpu)
--{
-- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_WNR);
--}
--
- static inline bool kvm_vcpu_dabt_issext(const struct kvm_vcpu *vcpu)
- {
- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SSE);
-@@ -192,6 +187,12 @@ static inline bool kvm_vcpu_dabt_iss1tw(const struct kvm_vcpu *vcpu)
- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_S1PTW);
- }
-
-+static inline bool kvm_vcpu_dabt_iswrite(const struct kvm_vcpu *vcpu)
-+{
-+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_WNR) ||
-+ kvm_vcpu_dabt_iss1tw(vcpu); /* AF/DBM update */
-+}
-+
- static inline bool kvm_vcpu_dabt_is_cm(const struct kvm_vcpu *vcpu)
- {
- return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_CM);
-diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
-index e12af67..06ff7fd 100644
---- a/arch/arm64/include/asm/module.h
-+++ b/arch/arm64/include/asm/module.h
-@@ -17,6 +17,7 @@
- #define __ASM_MODULE_H
-
- #include <asm-generic/module.h>
-+#include <asm/memory.h>
-
- #define MODULE_ARCH_VERMAGIC "aarch64"
-
-@@ -32,6 +33,10 @@ u64 module_emit_plt_entry(struct module *mod, const Elf64_Rela *rela,
- Elf64_Sym *sym);
-
- #ifdef CONFIG_RANDOMIZE_BASE
-+#ifdef CONFIG_MODVERSIONS
-+#define ARCH_RELOCATES_KCRCTAB
-+#define reloc_start (kimage_vaddr - KIMAGE_VADDR)
-+#endif
- extern u64 module_alloc_base;
- #else
- #define module_alloc_base ((u64)_etext - MODULES_VSIZE)
-diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
-index 2fee2f5..5394c84 100644
---- a/arch/arm64/include/asm/percpu.h
-+++ b/arch/arm64/include/asm/percpu.h
-@@ -44,48 +44,44 @@ static inline unsigned long __percpu_##op(void *ptr, \
- \
- switch (size) { \
- case 1: \
-- do { \
-- asm ("//__per_cpu_" #op "_1\n" \
-- "ldxrb %w[ret], %[ptr]\n" \
-+ asm ("//__per_cpu_" #op "_1\n" \
-+ "1: ldxrb %w[ret], %[ptr]\n" \
- #asm_op " %w[ret], %w[ret], %w[val]\n" \
-- "stxrb %w[loop], %w[ret], %[ptr]\n" \
-- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-- [ptr] "+Q"(*(u8 *)ptr) \
-- : [val] "Ir" (val)); \
-- } while (loop); \
-+ " stxrb %w[loop], %w[ret], %[ptr]\n" \
-+ " cbnz %w[loop], 1b" \
-+ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-+ [ptr] "+Q"(*(u8 *)ptr) \
-+ : [val] "Ir" (val)); \
- break; \
- case 2: \
-- do { \
-- asm ("//__per_cpu_" #op "_2\n" \
-- "ldxrh %w[ret], %[ptr]\n" \
-+ asm ("//__per_cpu_" #op "_2\n" \
-+ "1: ldxrh %w[ret], %[ptr]\n" \
- #asm_op " %w[ret], %w[ret], %w[val]\n" \
-- "stxrh %w[loop], %w[ret], %[ptr]\n" \
-- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-- [ptr] "+Q"(*(u16 *)ptr) \
-- : [val] "Ir" (val)); \
-- } while (loop); \
-+ " stxrh %w[loop], %w[ret], %[ptr]\n" \
-+ " cbnz %w[loop], 1b" \
-+ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-+ [ptr] "+Q"(*(u16 *)ptr) \
-+ : [val] "Ir" (val)); \
- break; \
- case 4: \
-- do { \
-- asm ("//__per_cpu_" #op "_4\n" \
-- "ldxr %w[ret], %[ptr]\n" \
-+ asm ("//__per_cpu_" #op "_4\n" \
-+ "1: ldxr %w[ret], %[ptr]\n" \
- #asm_op " %w[ret], %w[ret], %w[val]\n" \
-- "stxr %w[loop], %w[ret], %[ptr]\n" \
-- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-- [ptr] "+Q"(*(u32 *)ptr) \
-- : [val] "Ir" (val)); \
-- } while (loop); \
-+ " stxr %w[loop], %w[ret], %[ptr]\n" \
-+ " cbnz %w[loop], 1b" \
-+ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-+ [ptr] "+Q"(*(u32 *)ptr) \
-+ : [val] "Ir" (val)); \
- break; \
- case 8: \
-- do { \
-- asm ("//__per_cpu_" #op "_8\n" \
-- "ldxr %[ret], %[ptr]\n" \
-+ asm ("//__per_cpu_" #op "_8\n" \
-+ "1: ldxr %[ret], %[ptr]\n" \
- #asm_op " %[ret], %[ret], %[val]\n" \
-- "stxr %w[loop], %[ret], %[ptr]\n" \
-- : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-- [ptr] "+Q"(*(u64 *)ptr) \
-- : [val] "Ir" (val)); \
-- } while (loop); \
-+ " stxr %w[loop], %[ret], %[ptr]\n" \
-+ " cbnz %w[loop], 1b" \
-+ : [loop] "=&r" (loop), [ret] "=&r" (ret), \
-+ [ptr] "+Q"(*(u64 *)ptr) \
-+ : [val] "Ir" (val)); \
- break; \
- default: \
- BUILD_BUG(); \
-@@ -150,44 +146,40 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
-
- switch (size) {
- case 1:
-- do {
-- asm ("//__percpu_xchg_1\n"
-- "ldxrb %w[ret], %[ptr]\n"
-- "stxrb %w[loop], %w[val], %[ptr]\n"
-- : [loop] "=&r"(loop), [ret] "=&r"(ret),
-- [ptr] "+Q"(*(u8 *)ptr)
-- : [val] "r" (val));
-- } while (loop);
-+ asm ("//__percpu_xchg_1\n"
-+ "1: ldxrb %w[ret], %[ptr]\n"
-+ " stxrb %w[loop], %w[val], %[ptr]\n"
-+ " cbnz %w[loop], 1b"
-+ : [loop] "=&r"(loop), [ret] "=&r"(ret),
-+ [ptr] "+Q"(*(u8 *)ptr)
-+ : [val] "r" (val));
- break;
- case 2:
-- do {
-- asm ("//__percpu_xchg_2\n"
-- "ldxrh %w[ret], %[ptr]\n"
-- "stxrh %w[loop], %w[val], %[ptr]\n"
-- : [loop] "=&r"(loop), [ret] "=&r"(ret),
-- [ptr] "+Q"(*(u16 *)ptr)
-- : [val] "r" (val));
-- } while (loop);
-+ asm ("//__percpu_xchg_2\n"
-+ "1: ldxrh %w[ret], %[ptr]\n"
-+ " stxrh %w[loop], %w[val], %[ptr]\n"
-+ " cbnz %w[loop], 1b"
-+ : [loop] "=&r"(loop), [ret] "=&r"(ret),
-+ [ptr] "+Q"(*(u16 *)ptr)
-+ : [val] "r" (val));
- break;
- case 4:
-- do {
-- asm ("//__percpu_xchg_4\n"
-- "ldxr %w[ret], %[ptr]\n"
-- "stxr %w[loop], %w[val], %[ptr]\n"
-- : [loop] "=&r"(loop), [ret] "=&r"(ret),
-- [ptr] "+Q"(*(u32 *)ptr)
-- : [val] "r" (val));
-- } while (loop);
-+ asm ("//__percpu_xchg_4\n"
-+ "1: ldxr %w[ret], %[ptr]\n"
-+ " stxr %w[loop], %w[val], %[ptr]\n"
-+ " cbnz %w[loop], 1b"
-+ : [loop] "=&r"(loop), [ret] "=&r"(ret),
-+ [ptr] "+Q"(*(u32 *)ptr)
-+ : [val] "r" (val));
- break;
- case 8:
-- do {
-- asm ("//__percpu_xchg_8\n"
-- "ldxr %[ret], %[ptr]\n"
-- "stxr %w[loop], %[val], %[ptr]\n"
-- : [loop] "=&r"(loop), [ret] "=&r"(ret),
-- [ptr] "+Q"(*(u64 *)ptr)
-- : [val] "r" (val));
-- } while (loop);
-+ asm ("//__percpu_xchg_8\n"
-+ "1: ldxr %[ret], %[ptr]\n"
-+ " stxr %w[loop], %[val], %[ptr]\n"
-+ " cbnz %w[loop], 1b"
-+ : [loop] "=&r"(loop), [ret] "=&r"(ret),
-+ [ptr] "+Q"(*(u64 *)ptr)
-+ : [val] "r" (val));
- break;
- default:
- BUILD_BUG();
-diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
-index c47257c..db84983 100644
---- a/arch/arm64/include/asm/uaccess.h
-+++ b/arch/arm64/include/asm/uaccess.h
-@@ -21,6 +21,7 @@
- /*
- * User space memory access functions
- */
-+#include <linux/bitops.h>
- #include <linux/kasan-checks.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-@@ -102,6 +103,13 @@ static inline void set_fs(mm_segment_t fs)
- flag; \
- })
-
-+/*
-+ * When dealing with data aborts or instruction traps we may end up with
-+ * a tagged userland pointer. Clear the tag to get a sane pointer to pass
-+ * on to access_ok(), for instance.
-+ */
-+#define untagged_addr(addr) sign_extend64(addr, 55)
-+
- #define access_ok(type, addr, size) __range_ok(addr, size)
- #define user_addr_max get_fs
-
-diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
-index 42ffdb5..b0988bb 100644
---- a/arch/arm64/kernel/armv8_deprecated.c
-+++ b/arch/arm64/kernel/armv8_deprecated.c
-@@ -280,35 +280,43 @@ static void __init register_insn_emulation_sysctl(struct ctl_table *table)
- /*
- * Error-checking SWP macros implemented using ldxr{b}/stxr{b}
- */
--#define __user_swpX_asm(data, addr, res, temp, B) \
-+
-+/* Arbitrary constant to ensure forward-progress of the LL/SC loop */
-+#define __SWP_LL_SC_LOOPS 4
-+
-+#define __user_swpX_asm(data, addr, res, temp, temp2, B) \
- __asm__ __volatile__( \
-+ " mov %w3, %w7\n" \
- ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \
- CONFIG_ARM64_PAN) \
-- "0: ldxr"B" %w2, [%3]\n" \
-- "1: stxr"B" %w0, %w1, [%3]\n" \
-+ "0: ldxr"B" %w2, [%4]\n" \
-+ "1: stxr"B" %w0, %w1, [%4]\n" \
- " cbz %w0, 2f\n" \
-- " mov %w0, %w4\n" \
-+ " sub %w3, %w3, #1\n" \
-+ " cbnz %w3, 0b\n" \
-+ " mov %w0, %w5\n" \
- " b 3f\n" \
- "2:\n" \
- " mov %w1, %w2\n" \
- "3:\n" \
- " .pushsection .fixup,\"ax\"\n" \
- " .align 2\n" \
-- "4: mov %w0, %w5\n" \
-+ "4: mov %w0, %w6\n" \
- " b 3b\n" \
- " .popsection" \
- _ASM_EXTABLE(0b, 4b) \
- _ASM_EXTABLE(1b, 4b) \
- ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \
- CONFIG_ARM64_PAN) \
-- : "=&r" (res), "+r" (data), "=&r" (temp) \
-- : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \
-+ : "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2) \
-+ : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT), \
-+ "i" (__SWP_LL_SC_LOOPS) \
- : "memory")
-
--#define __user_swp_asm(data, addr, res, temp) \
-- __user_swpX_asm(data, addr, res, temp, "")
--#define __user_swpb_asm(data, addr, res, temp) \
-- __user_swpX_asm(data, addr, res, temp, "b")
-+#define __user_swp_asm(data, addr, res, temp, temp2) \
-+ __user_swpX_asm(data, addr, res, temp, temp2, "")
-+#define __user_swpb_asm(data, addr, res, temp, temp2) \
-+ __user_swpX_asm(data, addr, res, temp, temp2, "b")
-
- /*
- * Bit 22 of the instruction encoding distinguishes between
-@@ -328,12 +336,12 @@ static int emulate_swpX(unsigned int address, unsigned int *data,
- }
-
- while (1) {
-- unsigned long temp;
-+ unsigned long temp, temp2;
-
- if (type == TYPE_SWPB)
-- __user_swpb_asm(*data, address, res, temp);
-+ __user_swpb_asm(*data, address, res, temp, temp2);
- else
-- __user_swp_asm(*data, address, res, temp);
-+ __user_swp_asm(*data, address, res, temp, temp2);
-
- if (likely(res != -EAGAIN) || signal_pending(current))
- break;
-diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
-index 3e7b050..4d19508 100644
---- a/arch/arm64/kernel/head.S
-+++ b/arch/arm64/kernel/head.S
-@@ -578,8 +578,9 @@ CPU_LE( movk x0, #0x30d0, lsl #16 ) // Clear EE and E0E on LE systems
- b.lt 4f // Skip if no PMU present
- mrs x0, pmcr_el0 // Disable debug access traps
- ubfx x0, x0, #11, #5 // to EL2 and allow access to
-- msr mdcr_el2, x0 // all PMU counters from EL1
- 4:
-+ csel x0, xzr, x0, lt // all PMU counters from EL1
-+ msr mdcr_el2, x0 // (if they exist)
-
- /* Stage-2 translation */
- msr vttbr_el2, xzr
-diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index df06750..771a01a7f 100644
---- a/arch/arm64/kernel/traps.c
-+++ b/arch/arm64/kernel/traps.c
-@@ -434,18 +434,21 @@ void cpu_enable_cache_maint_trap(void *__unused)
- }
-
- #define __user_cache_maint(insn, address, res) \
-- asm volatile ( \
-- "1: " insn ", %1\n" \
-- " mov %w0, #0\n" \
-- "2:\n" \
-- " .pushsection .fixup,\"ax\"\n" \
-- " .align 2\n" \
-- "3: mov %w0, %w2\n" \
-- " b 2b\n" \
-- " .popsection\n" \
-- _ASM_EXTABLE(1b, 3b) \
-- : "=r" (res) \
-- : "r" (address), "i" (-EFAULT) )
-+ if (untagged_addr(address) >= user_addr_max()) \
-+ res = -EFAULT; \
-+ else \
-+ asm volatile ( \
-+ "1: " insn ", %1\n" \
-+ " mov %w0, #0\n" \
-+ "2:\n" \
-+ " .pushsection .fixup,\"ax\"\n" \
-+ " .align 2\n" \
-+ "3: mov %w0, %w2\n" \
-+ " b 2b\n" \
-+ " .popsection\n" \
-+ _ASM_EXTABLE(1b, 3b) \
-+ : "=r" (res) \
-+ : "r" (address), "i" (-EFAULT) )
-
- asmlinkage void __exception do_sysinstr(unsigned int esr, struct pt_regs *regs)
- {
-diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S
-index ce9e5e5..eaf08d3 100644
---- a/arch/arm64/kvm/hyp/entry.S
-+++ b/arch/arm64/kvm/hyp/entry.S
-@@ -98,6 +98,8 @@ ENTRY(__guest_exit)
- // x4-x29,lr: vcpu regs
- // vcpu x0-x3 on the stack
-
-+ ALTERNATIVE(nop, SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
-+
- add x2, x0, #VCPU_CONTEXT
-
- stp x4, x5, [x2, #CPU_XREG_OFFSET(4)]
-diff --git a/arch/metag/include/asm/atomic.h b/arch/metag/include/asm/atomic.h
-index 470e365..8ff0a70 100644
---- a/arch/metag/include/asm/atomic.h
-+++ b/arch/metag/include/asm/atomic.h
-@@ -39,11 +39,10 @@
- #define atomic_dec(v) atomic_sub(1, (v))
-
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-+#define atomic_dec_if_positive(v) atomic_sub_if_positive(1, v)
-
- #endif
-
--#define atomic_dec_if_positive(v) atomic_sub_if_positive(1, v)
--
- #include <asm-generic/atomic64.h>
-
- #endif /* __ASM_METAG_ATOMIC_H */
-diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
-index f6fc6aa..b657861 100644
---- a/arch/mips/include/asm/ptrace.h
-+++ b/arch/mips/include/asm/ptrace.h
-@@ -152,7 +152,7 @@ static inline int is_syscall_success(struct pt_regs *regs)
-
- static inline long regs_return_value(struct pt_regs *regs)
- {
-- if (is_syscall_success(regs))
-+ if (is_syscall_success(regs) || !user_mode(regs))
- return regs->regs[2];
- else
- return -regs->regs[2];
-diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
-index 3b4538e..de9e8836 100644
---- a/arch/mips/vdso/Makefile
-+++ b/arch/mips/vdso/Makefile
-@@ -82,7 +82,7 @@ obj-vdso := $(obj-vdso-y:%.o=$(obj)/%.o)
- $(obj-vdso): KBUILD_CFLAGS := $(cflags-vdso) $(native-abi)
- $(obj-vdso): KBUILD_AFLAGS := $(aflags-vdso) $(native-abi)
-
--$(obj)/vdso.lds: KBUILD_CPPFLAGS := $(native-abi)
-+$(obj)/vdso.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) $(native-abi)
-
- $(obj)/vdso.so.dbg.raw: $(obj)/vdso.lds $(obj-vdso) FORCE
- $(call if_changed,vdsold)
-diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 291cee2..c2c43f7 100644
---- a/arch/parisc/include/asm/pgtable.h
-+++ b/arch/parisc/include/asm/pgtable.h
-@@ -83,10 +83,10 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
- printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, (unsigned long)pgd_val(e))
-
- /* This is the size of the initially mapped kernel memory */
--#ifdef CONFIG_64BIT
--#define KERNEL_INITIAL_ORDER 25 /* 1<<25 = 32MB */
-+#if defined(CONFIG_64BIT)
-+#define KERNEL_INITIAL_ORDER 26 /* 1<<26 = 64MB */
- #else
--#define KERNEL_INITIAL_ORDER 24 /* 1<<24 = 16MB */
-+#define KERNEL_INITIAL_ORDER 25 /* 1<<25 = 32MB */
- #endif
- #define KERNEL_INITIAL_SIZE (1 << KERNEL_INITIAL_ORDER)
-
-diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
-index f7ea626..81d6f63 100644
---- a/arch/parisc/kernel/setup.c
-+++ b/arch/parisc/kernel/setup.c
-@@ -38,6 +38,7 @@
- #include <linux/export.h>
-
- #include <asm/processor.h>
-+#include <asm/sections.h>
- #include <asm/pdc.h>
- #include <asm/led.h>
- #include <asm/machdep.h> /* for pa7300lc_init() proto */
-@@ -140,6 +141,13 @@ void __init setup_arch(char **cmdline_p)
- #endif
- printk(KERN_CONT ".\n");
-
-+ /*
-+ * Check if initial kernel page mappings are sufficient.
-+ * panic early if not, else we may access kernel functions
-+ * and variables which can't be reached.
-+ */
-+ if (__pa((unsigned long) &_end) >= KERNEL_INITIAL_SIZE)
-+ panic("KERNEL_INITIAL_ORDER too small!");
-
- pdc_console_init();
-
-diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
-index 4b0b963..9b63b87 100644
---- a/arch/parisc/kernel/time.c
-+++ b/arch/parisc/kernel/time.c
-@@ -226,12 +226,6 @@ void __init start_cpu_itimer(void)
- unsigned int cpu = smp_processor_id();
- unsigned long next_tick = mfctl(16) + clocktick;
-
--#if defined(CONFIG_HAVE_UNSTABLE_SCHED_CLOCK) && defined(CONFIG_64BIT)
-- /* With multiple 64bit CPUs online, the cr16's are not syncronized. */
-- if (cpu != 0)
-- clear_sched_clock_stable();
--#endif
--
- mtctl(next_tick, 16); /* kick off Interval Timer (CR16) */
-
- per_cpu(cpu_data, cpu).it_value = next_tick;
-diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
-index f3ead0b..75304af 100644
---- a/arch/parisc/kernel/vmlinux.lds.S
-+++ b/arch/parisc/kernel/vmlinux.lds.S
-@@ -89,8 +89,9 @@ SECTIONS
- /* Start of data section */
- _sdata = .;
-
-- RO_DATA_SECTION(8)
--
-+ /* Architecturally we need to keep __gp below 0x1000000 and thus
-+ * in front of RO_DATA_SECTION() which stores lots of tracepoint
-+ * and ftrace symbols. */
- #ifdef CONFIG_64BIT
- . = ALIGN(16);
- /* Linkage tables */
-@@ -105,6 +106,8 @@ SECTIONS
- }
- #endif
-
-+ RO_DATA_SECTION(8)
-+
- /* unwind info */
- .PARISC.unwind : {
- __start___unwind = .;
-diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
-index 927d2ab..792cb17 100644
---- a/arch/powerpc/Kconfig
-+++ b/arch/powerpc/Kconfig
-@@ -637,7 +637,7 @@ config FORCE_MAX_ZONEORDER
- int "Maximum zone order"
- range 8 9 if PPC64 && PPC_64K_PAGES
- default "9" if PPC64 && PPC_64K_PAGES
-- range 9 13 if PPC64 && !PPC_64K_PAGES
-+ range 13 13 if PPC64 && !PPC_64K_PAGES
- default "13" if PPC64 && !PPC_64K_PAGES
- range 9 64 if PPC32 && PPC_16K_PAGES
- default "9" if PPC32 && PPC_16K_PAGES
-diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
-index 5f36e8a..29aa8d1 100644
---- a/arch/powerpc/kernel/eeh_driver.c
-+++ b/arch/powerpc/kernel/eeh_driver.c
-@@ -994,6 +994,14 @@ static void eeh_handle_special_event(void)
- /* Notify all devices to be down */
- eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
- bus = eeh_pe_bus_get(phb_pe);
-+ if (!bus) {
-+ pr_err("%s: Cannot find PCI bus for "
-+ "PHB#%d-PE#%x\n",
-+ __func__,
-+ pe->phb->global_number,
-+ pe->addr);
-+ break;
-+ }
- eeh_pe_dev_traverse(pe,
- eeh_report_failure, NULL);
- pci_hp_remove_devices(bus);
-diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
-index 184a6ba..abf17fe 100644
---- a/arch/powerpc/kernel/vdso64/datapage.S
-+++ b/arch/powerpc/kernel/vdso64/datapage.S
-@@ -59,7 +59,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map)
- bl V_LOCAL_FUNC(__get_datapage)
- mtlr r12
- addi r3,r3,CFG_SYSCALL_MAP64
-- cmpli cr0,r4,0
-+ cmpldi cr0,r4,0
- crclr cr0*4+so
- beqlr
- li r0,NR_syscalls
-diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
-index a76b4af..3820213 100644
---- a/arch/powerpc/kernel/vdso64/gettimeofday.S
-+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
-@@ -145,7 +145,7 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
- bne cr0,99f
-
- li r3,0
-- cmpli cr0,r4,0
-+ cmpldi cr0,r4,0
- crclr cr0*4+so
- beqlr
- lis r5,CLOCK_REALTIME_RES@h
-diff --git a/arch/powerpc/lib/copyuser_64.S b/arch/powerpc/lib/copyuser_64.S
-index f09899e..7b22624 100644
---- a/arch/powerpc/lib/copyuser_64.S
-+++ b/arch/powerpc/lib/copyuser_64.S
-@@ -359,6 +359,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
- addi r3,r3,8
- 171:
- 177:
-+179:
- addi r3,r3,8
- 370:
- 372:
-@@ -373,7 +374,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
- 173:
- 174:
- 175:
--179:
- 181:
- 184:
- 186:
-diff --git a/arch/powerpc/mm/copro_fault.c b/arch/powerpc/mm/copro_fault.c
-index bb03542..362954f 100644
---- a/arch/powerpc/mm/copro_fault.c
-+++ b/arch/powerpc/mm/copro_fault.c
-@@ -106,6 +106,8 @@ int copro_calculate_slb(struct mm_struct *mm, u64 ea, struct copro_slb *slb)
- switch (REGION_ID(ea)) {
- case USER_REGION_ID:
- pr_devel("%s: 0x%llx -- USER_REGION_ID\n", __func__, ea);
-+ if (mm == NULL)
-+ return 1;
- psize = get_slice_psize(mm, ea);
- ssize = user_segment_size(ea);
- vsid = get_vsid(mm->context.id, ea, ssize);
-diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
-index 0821556..28923b2 100644
---- a/arch/powerpc/mm/hash_utils_64.c
-+++ b/arch/powerpc/mm/hash_utils_64.c
-@@ -526,7 +526,7 @@ static bool might_have_hea(void)
- */
- #ifdef CONFIG_IBMEBUS
- return !cpu_has_feature(CPU_FTR_ARCH_207S) &&
-- !firmware_has_feature(FW_FEATURE_SPLPAR);
-+ firmware_has_feature(FW_FEATURE_SPLPAR);
- #else
- return false;
- #endif
-diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
-index 86544ea..ba17fdd 100644
---- a/arch/powerpc/platforms/powernv/eeh-powernv.c
-+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
-@@ -1091,6 +1091,11 @@ static int pnv_eeh_reset(struct eeh_pe *pe, int option)
- }
-
- bus = eeh_pe_bus_get(pe);
-+ if (!bus) {
-+ pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n",
-+ __func__, pe->phb->global_number, pe->addr);
-+ return -EIO;
-+ }
- if (pe->type & EEH_PE_VF)
- return pnv_eeh_reset_vf_pe(pe, option);
-
-@@ -1306,7 +1311,7 @@ static void pnv_eeh_get_and_dump_hub_diag(struct pci_controller *hose)
- return;
- }
-
-- switch (data->type) {
-+ switch (be16_to_cpu(data->type)) {
- case OPAL_P7IOC_DIAG_TYPE_RGC:
- pr_info("P7IOC diag-data for RGC\n\n");
- pnv_eeh_dump_hub_diag_common(data);
-@@ -1538,7 +1543,7 @@ static int pnv_eeh_next_error(struct eeh_pe **pe)
-
- /* Try best to clear it */
- opal_pci_eeh_freeze_clear(phb->opal_id,
-- frozen_pe_no,
-+ be64_to_cpu(frozen_pe_no),
- OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
- ret = EEH_NEXT_ERR_NONE;
- } else if ((*pe)->state & EEH_PE_ISOLATED ||
-diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
-index a21d831..0fe3520 100644
---- a/arch/powerpc/platforms/powernv/pci.c
-+++ b/arch/powerpc/platforms/powernv/pci.c
-@@ -309,8 +309,8 @@ static void pnv_pci_dump_p7ioc_diag_data(struct pci_controller *hose,
- be64_to_cpu(data->dma1ErrorLog1));
-
- for (i = 0; i < OPAL_P7IOC_NUM_PEST_REGS; i++) {
-- if ((data->pestA[i] >> 63) == 0 &&
-- (data->pestB[i] >> 63) == 0)
-+ if ((be64_to_cpu(data->pestA[i]) >> 63) == 0 &&
-+ (be64_to_cpu(data->pestB[i]) >> 63) == 0)
- continue;
-
- pr_info("PE[%3d] A/B: %016llx %016llx\n",
-diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
-index 86707e6..aa35245 100644
---- a/arch/powerpc/platforms/pseries/lpar.c
-+++ b/arch/powerpc/platforms/pseries/lpar.c
-@@ -393,7 +393,7 @@ static void __pSeries_lpar_hugepage_invalidate(unsigned long *slot,
- unsigned long *vpn, int count,
- int psize, int ssize)
- {
-- unsigned long param[8];
-+ unsigned long param[PLPAR_HCALL9_BUFSIZE];
- int i = 0, pix = 0, rc;
- unsigned long flags = 0;
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
-@@ -522,7 +522,7 @@ static void pSeries_lpar_flush_hash_range(unsigned long number, int local)
- unsigned long flags = 0;
- struct ppc64_tlb_batch *batch = this_cpu_ptr(&ppc64_tlb_batch);
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
-- unsigned long param[9];
-+ unsigned long param[PLPAR_HCALL9_BUFSIZE];
- unsigned long hash, index, shift, hidx, slot;
- real_pte_t pte;
- int psize, ssize;
-diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
-index 81d4947..82e8e2b 100644
---- a/arch/powerpc/sysdev/cpm1.c
-+++ b/arch/powerpc/sysdev/cpm1.c
-@@ -233,8 +233,6 @@ void __init cpm_reset(void)
- else
- out_be32(&siu_conf->sc_sdcr, 1);
- immr_unmap(siu_conf);
--
-- cpm_muram_init();
- }
-
- static DEFINE_SPINLOCK(cmd_lock);
-diff --git a/arch/powerpc/sysdev/cpm2.c b/arch/powerpc/sysdev/cpm2.c
-index 8dc1e24..f78ff84 100644
---- a/arch/powerpc/sysdev/cpm2.c
-+++ b/arch/powerpc/sysdev/cpm2.c
-@@ -66,10 +66,6 @@ void __init cpm2_reset(void)
- cpm2_immr = ioremap(get_immrbase(), CPM_MAP_SIZE);
- #endif
-
-- /* Reclaim the DP memory for our use.
-- */
-- cpm_muram_init();
--
- /* Tell everyone where the comm processor resides.
- */
- cpmp = &cpm2_immr->im_cpm;
-diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
-index 947f420..51bf749 100644
---- a/arch/powerpc/sysdev/cpm_common.c
-+++ b/arch/powerpc/sysdev/cpm_common.c
-@@ -37,6 +37,21 @@
- #include <linux/of_gpio.h>
- #endif
-
-+static int __init cpm_init(void)
-+{
-+ struct device_node *np;
-+
-+ np = of_find_compatible_node(NULL, NULL, "fsl,cpm1");
-+ if (!np)
-+ np = of_find_compatible_node(NULL, NULL, "fsl,cpm2");
-+ if (!np)
-+ return -ENODEV;
-+ cpm_muram_init();
-+ of_node_put(np);
-+ return 0;
-+}
-+subsys_initcall(cpm_init);
-+
- #ifdef CONFIG_PPC_EARLY_DEBUG_CPM
- static u32 __iomem *cpm_udbg_txdesc;
- static u8 __iomem *cpm_udbg_txbuf;
-diff --git a/arch/powerpc/xmon/spr_access.S b/arch/powerpc/xmon/spr_access.S
-index 84ad742..7d8b0e8 100644
---- a/arch/powerpc/xmon/spr_access.S
-+++ b/arch/powerpc/xmon/spr_access.S
-@@ -2,12 +2,12 @@
-
- /* unsigned long xmon_mfspr(sprn, default_value) */
- _GLOBAL(xmon_mfspr)
-- ld r5, .Lmfspr_table@got(r2)
-+ PPC_LL r5, .Lmfspr_table@got(r2)
- b xmon_mxspr
-
- /* void xmon_mtspr(sprn, new_value) */
- _GLOBAL(xmon_mtspr)
-- ld r5, .Lmtspr_table@got(r2)
-+ PPC_LL r5, .Lmtspr_table@got(r2)
- b xmon_mxspr
-
- /*
-diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
-index dfd0ca2..9746b78 100644
---- a/arch/s390/kvm/intercept.c
-+++ b/arch/s390/kvm/intercept.c
-@@ -118,8 +118,13 @@ static int handle_validity(struct kvm_vcpu *vcpu)
-
- vcpu->stat.exit_validity++;
- trace_kvm_s390_intercept_validity(vcpu, viwhy);
-- WARN_ONCE(true, "kvm: unhandled validity intercept 0x%x\n", viwhy);
-- return -EOPNOTSUPP;
-+ KVM_EVENT(3, "validity intercept 0x%x for pid %u (kvm 0x%pK)", viwhy,
-+ current->pid, vcpu->kvm);
-+
-+ /* do not warn on invalid runtime instrumentation mode */
-+ WARN_ONCE(viwhy != 0x44, "kvm: unhandled validity intercept 0x%x\n",
-+ viwhy);
-+ return -EINVAL;
- }
-
- static int handle_instruction(struct kvm_vcpu *vcpu)
-diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
-index 8a90f15..625eb69 100644
---- a/arch/x86/kernel/e820.c
-+++ b/arch/x86/kernel/e820.c
-@@ -348,7 +348,7 @@ int __init sanitize_e820_map(struct e820entry *biosmap, int max_nr_map,
- * continue building up new bios map based on this
- * information
- */
-- if (current_type != last_type) {
-+ if (current_type != last_type || current_type == E820_PRAM) {
- if (last_type != 0) {
- new_bios[new_bios_entry].size =
- change_point[chgidx]->addr - last_addr;
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 82b1737..9e152cd 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -1408,15 +1408,17 @@ __init void prefill_possible_map(void)
-
- /* No boot processor was found in mptable or ACPI MADT */
- if (!num_processors) {
-- int apicid = boot_cpu_physical_apicid;
-- int cpu = hard_smp_processor_id();
-+ if (boot_cpu_has(X86_FEATURE_APIC)) {
-+ int apicid = boot_cpu_physical_apicid;
-+ int cpu = hard_smp_processor_id();
-
-- pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
-+ pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
-
-- /* Make sure boot cpu is enumerated */
-- if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
-- apic->apic_id_valid(apicid))
-- generic_processor_info(apicid, boot_cpu_apic_version);
-+ /* Make sure boot cpu is enumerated */
-+ if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
-+ apic->apic_id_valid(apicid))
-+ generic_processor_info(apicid, boot_cpu_apic_version);
-+ }
-
- if (!num_processors)
- num_processors = 1;
-diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
-index c7220ba..1a22de7 100644
---- a/arch/x86/kvm/ioapic.c
-+++ b/arch/x86/kvm/ioapic.c
-@@ -594,7 +594,7 @@ static void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
- ioapic->irr = 0;
- ioapic->irr_delivered = 0;
- ioapic->id = 0;
-- memset(ioapic->irq_eoi, 0x00, IOAPIC_NUM_PINS);
-+ memset(ioapic->irq_eoi, 0x00, sizeof(ioapic->irq_eoi));
- rtc_irq_eoi_tracking_reset(ioapic);
- }
-
-diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
-index 23f2f3e..58e152b 100644
---- a/arch/x86/platform/uv/bios_uv.c
-+++ b/arch/x86/platform/uv/bios_uv.c
-@@ -40,7 +40,15 @@ s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
- */
- return BIOS_STATUS_UNIMPLEMENTED;
-
-- ret = efi_call_virt_pointer(tab, function, (u64)which, a1, a2, a3, a4, a5);
-+ /*
-+ * If EFI_OLD_MEMMAP is set, we need to fall back to using our old EFI
-+ * callback method, which uses efi_call() directly, with the kernel page tables:
-+ */
-+ if (unlikely(test_bit(EFI_OLD_MEMMAP, &efi.flags)))
-+ ret = efi_call((void *)__va(tab->function), (u64)which, a1, a2, a3, a4, a5);
-+ else
-+ ret = efi_call_virt_pointer(tab, function, (u64)which, a1, a2, a3, a4, a5);
-+
- return ret;
- }
- EXPORT_SYMBOL_GPL(uv_bios_call);
-diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index dd38e5c..b08ccbb 100644
---- a/block/blk-cgroup.c
-+++ b/block/blk-cgroup.c
-@@ -1340,10 +1340,8 @@ int blkcg_policy_register(struct blkcg_policy *pol)
- struct blkcg_policy_data *cpd;
-
- cpd = pol->cpd_alloc_fn(GFP_KERNEL);
-- if (!cpd) {
-- mutex_unlock(&blkcg_pol_mutex);
-+ if (!cpd)
- goto err_free_cpds;
-- }
-
- blkcg->cpd[pol->plid] = cpd;
- cpd->blkcg = blkcg;
-diff --git a/drivers/base/platform.c b/drivers/base/platform.c
-index 6482d47..d557229 100644
---- a/drivers/base/platform.c
-+++ b/drivers/base/platform.c
-@@ -97,7 +97,7 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
- int ret;
-
- ret = of_irq_get(dev->dev.of_node, num);
-- if (ret >= 0 || ret == -EPROBE_DEFER)
-+ if (ret > 0 || ret == -EPROBE_DEFER)
- return ret;
- }
-
-@@ -175,7 +175,7 @@ int platform_get_irq_byname(struct platform_device *dev, const char *name)
- int ret;
-
- ret = of_irq_get_byname(dev->dev.of_node, name);
-- if (ret >= 0 || ret == -EPROBE_DEFER)
-+ if (ret > 0 || ret == -EPROBE_DEFER)
- return ret;
- }
-
-diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
-index ba1c1ae..ce8ea10 100644
---- a/drivers/clk/imx/clk-imx6q.c
-+++ b/drivers/clk/imx/clk-imx6q.c
-@@ -318,11 +318,16 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
- clk[IMX6QDL_CLK_IPG_PER_SEL] = imx_clk_mux("ipg_per_sel", base + 0x1c, 6, 1, ipg_per_sels, ARRAY_SIZE(ipg_per_sels));
- clk[IMX6QDL_CLK_UART_SEL] = imx_clk_mux("uart_sel", base + 0x24, 6, 1, uart_sels, ARRAY_SIZE(uart_sels));
- clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels_2, ARRAY_SIZE(gpu2d_core_sels_2));
-+ } else if (clk_on_imx6dl()) {
-+ clk[IMX6QDL_CLK_MLB_SEL] = imx_clk_mux("mlb_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
- } else {
- clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
- }
- clk[IMX6QDL_CLK_GPU3D_CORE_SEL] = imx_clk_mux("gpu3d_core_sel", base + 0x18, 4, 2, gpu3d_core_sels, ARRAY_SIZE(gpu3d_core_sels));
-- clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
-+ if (clk_on_imx6dl())
-+ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
-+ else
-+ clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
- clk[IMX6QDL_CLK_IPU1_SEL] = imx_clk_mux("ipu1_sel", base + 0x3c, 9, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
- clk[IMX6QDL_CLK_IPU2_SEL] = imx_clk_mux("ipu2_sel", base + 0x3c, 14, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
- clk[IMX6QDL_CLK_LDB_DI0_SEL] = imx_clk_mux_flags("ldb_di0_sel", base + 0x2c, 9, 3, ldb_di_sels, ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT);
-@@ -400,9 +405,15 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
- clk[IMX6QDL_CLK_LDB_DI0_DIV_3_5] = imx_clk_fixed_factor("ldb_di0_div_3_5", "ldb_di0_sel", 2, 7);
- clk[IMX6QDL_CLK_LDB_DI1_DIV_3_5] = imx_clk_fixed_factor("ldb_di1_div_3_5", "ldb_di1_sel", 2, 7);
- }
-- clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
-+ if (clk_on_imx6dl())
-+ clk[IMX6QDL_CLK_MLB_PODF] = imx_clk_divider("mlb_podf", "mlb_sel", base + 0x18, 23, 3);
-+ else
-+ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
- clk[IMX6QDL_CLK_GPU3D_CORE_PODF] = imx_clk_divider("gpu3d_core_podf", "gpu3d_core_sel", base + 0x18, 26, 3);
-- clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
-+ if (clk_on_imx6dl())
-+ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 29, 3);
-+ else
-+ clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
- clk[IMX6QDL_CLK_IPU1_PODF] = imx_clk_divider("ipu1_podf", "ipu1_sel", base + 0x3c, 11, 3);
- clk[IMX6QDL_CLK_IPU2_PODF] = imx_clk_divider("ipu2_podf", "ipu2_sel", base + 0x3c, 16, 3);
- clk[IMX6QDL_CLK_LDB_DI0_PODF] = imx_clk_divider_flags("ldb_di0_podf", "ldb_di0_div_3_5", base + 0x20, 10, 1, 0);
-@@ -473,14 +484,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
- clk[IMX6QDL_CLK_ESAI_MEM] = imx_clk_gate2_shared("esai_mem", "ahb", base + 0x6c, 16, &share_count_esai);
- clk[IMX6QDL_CLK_GPT_IPG] = imx_clk_gate2("gpt_ipg", "ipg", base + 0x6c, 20);
- clk[IMX6QDL_CLK_GPT_IPG_PER] = imx_clk_gate2("gpt_ipg_per", "ipg_per", base + 0x6c, 22);
-- if (clk_on_imx6dl())
-- /*
-- * The multiplexer and divider of imx6q clock gpu3d_shader get
-- * redefined/reused as gpu2d_core_sel and gpu2d_core_podf on imx6dl.
-- */
-- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu3d_shader", base + 0x6c, 24);
-- else
-- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
-+ clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
- clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26);
- clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0);
- clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4);
-@@ -511,7 +515,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
- * The multiplexer and divider of the imx6q clock gpu2d get
- * redefined/reused as mlb_sys_sel and mlb_sys_clk_podf on imx6dl.
- */
-- clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "gpu2d_core_podf", base + 0x74, 18);
-+ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "mlb_podf", base + 0x74, 18);
- else
- clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "axi", base + 0x74, 18);
- clk[IMX6QDL_CLK_MMDC_CH0_AXI] = imx_clk_gate2("mmdc_ch0_axi", "mmdc_ch0_axi_podf", base + 0x74, 20);
-@@ -629,6 +633,24 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
- if (IS_ENABLED(CONFIG_PCI_IMX6))
- clk_set_parent(clk[IMX6QDL_CLK_LVDS1_SEL], clk[IMX6QDL_CLK_SATA_REF_100M]);
-
-+ /*
-+ * Initialize the GPU clock muxes, so that the maximum specified clock
-+ * rates for the respective SoC are not exceeded.
-+ */
-+ if (clk_on_imx6dl()) {
-+ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
-+ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
-+ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
-+ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
-+ } else if (clk_on_imx6q()) {
-+ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
-+ clk[IMX6QDL_CLK_MMDC_CH0_AXI]);
-+ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_SHADER_SEL],
-+ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
-+ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
-+ clk[IMX6QDL_CLK_PLL3_USB_OTG]);
-+ }
-+
- imx_register_uart_clocks(uart_clks);
- }
- CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init);
-diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
-index 2ee40fd..e1aa531 100644
---- a/drivers/cpufreq/cpufreq-dt-platdev.c
-+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -68,6 +68,8 @@ static const struct of_device_id machines[] __initconst = {
-
- { .compatible = "sigma,tango4" },
-
-+ { .compatible = "ti,am33xx", },
-+ { .compatible = "ti,dra7", },
- { .compatible = "ti,omap2", },
- { .compatible = "ti,omap3", },
- { .compatible = "ti,omap4", },
-diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
-index 18da4f8..1347589 100644
---- a/drivers/cpufreq/cpufreq_conservative.c
-+++ b/drivers/cpufreq/cpufreq_conservative.c
-@@ -17,6 +17,7 @@
- struct cs_policy_dbs_info {
- struct policy_dbs_info policy_dbs;
- unsigned int down_skip;
-+ unsigned int requested_freq;
- };
-
- static inline struct cs_policy_dbs_info *to_dbs_info(struct policy_dbs_info *policy_dbs)
-@@ -61,6 +62,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
- {
- struct policy_dbs_info *policy_dbs = policy->governor_data;
- struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy_dbs);
-+ unsigned int requested_freq = dbs_info->requested_freq;
- struct dbs_data *dbs_data = policy_dbs->dbs_data;
- struct cs_dbs_tuners *cs_tuners = dbs_data->tuners;
- unsigned int load = dbs_update(policy);
-@@ -72,10 +74,16 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
- if (cs_tuners->freq_step == 0)
- goto out;
-
-+ /*
-+ * If requested_freq is out of range, it is likely that the limits
-+ * changed in the meantime, so fall back to current frequency in that
-+ * case.
-+ */
-+ if (requested_freq > policy->max || requested_freq < policy->min)
-+ requested_freq = policy->cur;
-+
- /* Check for frequency increase */
- if (load > dbs_data->up_threshold) {
-- unsigned int requested_freq = policy->cur;
--
- dbs_info->down_skip = 0;
-
- /* if we are already at full speed then break out early */
-@@ -83,8 +91,11 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
- goto out;
-
- requested_freq += get_freq_target(cs_tuners, policy);
-+ if (requested_freq > policy->max)
-+ requested_freq = policy->max;
-
- __cpufreq_driver_target(policy, requested_freq, CPUFREQ_RELATION_H);
-+ dbs_info->requested_freq = requested_freq;
- goto out;
- }
-
-@@ -95,7 +106,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
-
- /* Check for frequency decrease */
- if (load < cs_tuners->down_threshold) {
-- unsigned int freq_target, requested_freq = policy->cur;
-+ unsigned int freq_target;
- /*
- * if we cannot reduce the frequency anymore, break out early
- */
-@@ -109,6 +120,7 @@ static unsigned int cs_dbs_timer(struct cpufreq_policy *policy)
- requested_freq = policy->min;
-
- __cpufreq_driver_target(policy, requested_freq, CPUFREQ_RELATION_L);
-+ dbs_info->requested_freq = requested_freq;
- }
-
- out:
-@@ -287,6 +299,7 @@ static void cs_start(struct cpufreq_policy *policy)
- struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy->governor_data);
-
- dbs_info->down_skip = 0;
-+ dbs_info->requested_freq = policy->cur;
- }
-
- static struct dbs_governor cs_governor = {
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index be9eade..b46547e 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -556,12 +556,12 @@ static void intel_pstate_hwp_set(const struct cpumask *cpumask)
- int min, hw_min, max, hw_max, cpu, range, adj_range;
- u64 value, cap;
-
-- rdmsrl(MSR_HWP_CAPABILITIES, cap);
-- hw_min = HWP_LOWEST_PERF(cap);
-- hw_max = HWP_HIGHEST_PERF(cap);
-- range = hw_max - hw_min;
--
- for_each_cpu(cpu, cpumask) {
-+ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
-+ hw_min = HWP_LOWEST_PERF(cap);
-+ hw_max = HWP_HIGHEST_PERF(cap);
-+ range = hw_max - hw_min;
-+
- rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
- adj_range = limits->min_perf_pct * range / 100;
- min = hw_min + adj_range;
-diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
-index 425501c..793518a 100644
---- a/drivers/gpio/gpio-mpc8xxx.c
-+++ b/drivers/gpio/gpio-mpc8xxx.c
-@@ -239,7 +239,7 @@ static int mpc8xxx_gpio_irq_map(struct irq_domain *h, unsigned int irq,
- irq_hw_number_t hwirq)
- {
- irq_set_chip_data(irq, h->host_data);
-- irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_level_irq);
-+ irq_set_chip_and_handler(irq, &mpc8xxx_irq_chip, handle_edge_irq);
-
- return 0;
- }
-diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
-index f2b776e..5f88ccd 100644
---- a/drivers/infiniband/core/verbs.c
-+++ b/drivers/infiniband/core/verbs.c
-@@ -821,7 +821,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
- if (ret) {
- pr_err("failed to init MR pool ret= %d\n", ret);
- ib_destroy_qp(qp);
-- qp = ERR_PTR(ret);
-+ return ERR_PTR(ret);
- }
- }
-
-diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
-index 3322ed7..6b07d4b 100644
---- a/drivers/infiniband/ulp/srp/ib_srp.c
-+++ b/drivers/infiniband/ulp/srp/ib_srp.c
-@@ -1400,7 +1400,9 @@ static int srp_map_sg_entry(struct srp_map_state *state,
-
- while (dma_len) {
- unsigned offset = dma_addr & ~dev->mr_page_mask;
-- if (state->npages == dev->max_pages_per_mr || offset != 0) {
-+
-+ if (state->npages == dev->max_pages_per_mr ||
-+ (state->npages > 0 && offset != 0)) {
- ret = srp_map_finish_fmr(state, ch);
- if (ret)
- return ret;
-@@ -1417,12 +1419,12 @@ static int srp_map_sg_entry(struct srp_map_state *state,
- }
-
- /*
-- * If the last entry of the MR wasn't a full page, then we need to
-+ * If the end of the MR is not on a page boundary then we need to
- * close it out and start a new one -- we can only merge at page
- * boundaries.
- */
- ret = 0;
-- if (len != dev->mr_page_size)
-+ if ((dma_addr & ~dev->mr_page_mask) != 0)
- ret = srp_map_finish_fmr(state, ch);
- return ret;
- }
-diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
-index 08e252a..ff8c107 100644
---- a/drivers/input/mouse/elantech.c
-+++ b/drivers/input/mouse/elantech.c
-@@ -1159,6 +1159,13 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
- DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
- },
- },
-+ {
-+ /* Fujitsu H760 also has a middle button */
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
-+ },
-+ },
- #endif
- { }
- };
-@@ -1503,10 +1510,10 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
- },
- },
- {
-- /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */
-+ /* Fujitsu H760 does not work with crc_enabled == 0 */
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
- },
- },
- {
-@@ -1517,6 +1524,20 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
- },
- },
- {
-+ /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E554"),
-+ },
-+ },
-+ {
-+ /* Fujitsu LIFEBOOK E556 does not work with crc_enabled == 0 */
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E556"),
-+ },
-+ },
-+ {
- /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
-diff --git a/drivers/input/serio/i8042-io.h b/drivers/input/serio/i8042-io.h
-index a5eed2a..34da81c 100644
---- a/drivers/input/serio/i8042-io.h
-+++ b/drivers/input/serio/i8042-io.h
-@@ -81,7 +81,7 @@ static inline int i8042_platform_init(void)
- return -EBUSY;
- #endif
-
-- i8042_reset = 1;
-+ i8042_reset = I8042_RESET_ALWAYS;
- return 0;
- }
-
-diff --git a/drivers/input/serio/i8042-ip22io.h b/drivers/input/serio/i8042-ip22io.h
-index ee1ad27..08a1c10 100644
---- a/drivers/input/serio/i8042-ip22io.h
-+++ b/drivers/input/serio/i8042-ip22io.h
-@@ -61,7 +61,7 @@ static inline int i8042_platform_init(void)
- return -EBUSY;
- #endif
-
-- i8042_reset = 1;
-+ i8042_reset = I8042_RESET_ALWAYS;
-
- return 0;
- }
-diff --git a/drivers/input/serio/i8042-ppcio.h b/drivers/input/serio/i8042-ppcio.h
-index f708c75..1aabea4 100644
---- a/drivers/input/serio/i8042-ppcio.h
-+++ b/drivers/input/serio/i8042-ppcio.h
-@@ -44,7 +44,7 @@ static inline void i8042_write_command(int val)
-
- static inline int i8042_platform_init(void)
- {
-- i8042_reset = 1;
-+ i8042_reset = I8042_RESET_ALWAYS;
- return 0;
- }
-
-diff --git a/drivers/input/serio/i8042-sparcio.h b/drivers/input/serio/i8042-sparcio.h
-index afcd1c1..6231d63 100644
---- a/drivers/input/serio/i8042-sparcio.h
-+++ b/drivers/input/serio/i8042-sparcio.h
-@@ -130,7 +130,7 @@ static int __init i8042_platform_init(void)
- }
- }
-
-- i8042_reset = 1;
-+ i8042_reset = I8042_RESET_ALWAYS;
-
- return 0;
- }
-diff --git a/drivers/input/serio/i8042-unicore32io.h b/drivers/input/serio/i8042-unicore32io.h
-index 73f5cc1..4557475 100644
---- a/drivers/input/serio/i8042-unicore32io.h
-+++ b/drivers/input/serio/i8042-unicore32io.h
-@@ -61,7 +61,7 @@ static inline int i8042_platform_init(void)
- if (!request_mem_region(I8042_REGION_START, I8042_REGION_SIZE, "i8042"))
- return -EBUSY;
-
-- i8042_reset = 1;
-+ i8042_reset = I8042_RESET_ALWAYS;
- return 0;
- }
-
-diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
-index 68f5f4a..f4bfb4b 100644
---- a/drivers/input/serio/i8042-x86ia64io.h
-+++ b/drivers/input/serio/i8042-x86ia64io.h
-@@ -510,6 +510,90 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
- { }
- };
-
-+/*
-+ * On some Asus laptops, just running self tests cause problems.
-+ */
-+static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "A455LD"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "K401LB"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "K501LB"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "K501LX"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "R409L"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "V502LX"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X302LA"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X450LD"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X455LAB"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X455LDB"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "X455LF"),
-+ },
-+ },
-+ {
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "Z450LA"),
-+ },
-+ },
-+ { }
-+};
- static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
- {
- /* MSI Wind U-100 */
-@@ -1072,12 +1156,18 @@ static int __init i8042_platform_init(void)
- return retval;
-
- #if defined(__ia64__)
-- i8042_reset = true;
-+ i8042_reset = I8042_RESET_ALWAYS;
- #endif
-
- #ifdef CONFIG_X86
-- if (dmi_check_system(i8042_dmi_reset_table))
-- i8042_reset = true;
-+ /* Honor module parameter when value is not default */
-+ if (i8042_reset == I8042_RESET_DEFAULT) {
-+ if (dmi_check_system(i8042_dmi_reset_table))
-+ i8042_reset = I8042_RESET_ALWAYS;
-+
-+ if (dmi_check_system(i8042_dmi_noselftest_table))
-+ i8042_reset = I8042_RESET_NEVER;
-+ }
-
- if (dmi_check_system(i8042_dmi_noloop_table))
- i8042_noloop = true;
-diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
-index 405252a..89abfdb 100644
---- a/drivers/input/serio/i8042.c
-+++ b/drivers/input/serio/i8042.c
-@@ -48,9 +48,39 @@ static bool i8042_unlock;
- module_param_named(unlock, i8042_unlock, bool, 0);
- MODULE_PARM_DESC(unlock, "Ignore keyboard lock.");
-
--static bool i8042_reset;
--module_param_named(reset, i8042_reset, bool, 0);
--MODULE_PARM_DESC(reset, "Reset controller during init and cleanup.");
-+enum i8042_controller_reset_mode {
-+ I8042_RESET_NEVER,
-+ I8042_RESET_ALWAYS,
-+ I8042_RESET_ON_S2RAM,
-+#define I8042_RESET_DEFAULT I8042_RESET_ON_S2RAM
-+};
-+static enum i8042_controller_reset_mode i8042_reset = I8042_RESET_DEFAULT;
-+static int i8042_set_reset(const char *val, const struct kernel_param *kp)
-+{
-+ enum i8042_controller_reset_mode *arg = kp->arg;
-+ int error;
-+ bool reset;
-+
-+ if (val) {
-+ error = kstrtobool(val, &reset);
-+ if (error)
-+ return error;
-+ } else {
-+ reset = true;
-+ }
-+
-+ *arg = reset ? I8042_RESET_ALWAYS : I8042_RESET_NEVER;
-+ return 0;
-+}
-+
-+static const struct kernel_param_ops param_ops_reset_param = {
-+ .flags = KERNEL_PARAM_OPS_FL_NOARG,
-+ .set = i8042_set_reset,
-+};
-+#define param_check_reset_param(name, p) \
-+ __param_check(name, p, enum i8042_controller_reset_mode)
-+module_param_named(reset, i8042_reset, reset_param, 0);
-+MODULE_PARM_DESC(reset, "Reset controller on resume, cleanup or both");
-
- static bool i8042_direct;
- module_param_named(direct, i8042_direct, bool, 0);
-@@ -1019,7 +1049,7 @@ static int i8042_controller_init(void)
- * Reset the controller and reset CRT to the original value set by BIOS.
- */
-
--static void i8042_controller_reset(bool force_reset)
-+static void i8042_controller_reset(bool s2r_wants_reset)
- {
- i8042_flush();
-
-@@ -1044,8 +1074,10 @@ static void i8042_controller_reset(bool force_reset)
- * Reset the controller if requested.
- */
-
-- if (i8042_reset || force_reset)
-+ if (i8042_reset == I8042_RESET_ALWAYS ||
-+ (i8042_reset == I8042_RESET_ON_S2RAM && s2r_wants_reset)) {
- i8042_controller_selftest();
-+ }
-
- /*
- * Restore the original control register setting.
-@@ -1110,7 +1142,7 @@ static void i8042_dritek_enable(void)
- * before suspending.
- */
-
--static int i8042_controller_resume(bool force_reset)
-+static int i8042_controller_resume(bool s2r_wants_reset)
- {
- int error;
-
-@@ -1118,7 +1150,8 @@ static int i8042_controller_resume(bool force_reset)
- if (error)
- return error;
-
-- if (i8042_reset || force_reset) {
-+ if (i8042_reset == I8042_RESET_ALWAYS ||
-+ (i8042_reset == I8042_RESET_ON_S2RAM && s2r_wants_reset)) {
- error = i8042_controller_selftest();
- if (error)
- return error;
-@@ -1195,7 +1228,7 @@ static int i8042_pm_resume_noirq(struct device *dev)
-
- static int i8042_pm_resume(struct device *dev)
- {
-- bool force_reset;
-+ bool want_reset;
- int i;
-
- for (i = 0; i < I8042_NUM_PORTS; i++) {
-@@ -1218,9 +1251,9 @@ static int i8042_pm_resume(struct device *dev)
- * off control to the platform firmware, otherwise we can simply restore
- * the mode.
- */
-- force_reset = pm_resume_via_firmware();
-+ want_reset = pm_resume_via_firmware();
-
-- return i8042_controller_resume(force_reset);
-+ return i8042_controller_resume(want_reset);
- }
-
- static int i8042_pm_thaw(struct device *dev)
-@@ -1482,7 +1515,7 @@ static int __init i8042_probe(struct platform_device *dev)
-
- i8042_platform_device = dev;
-
-- if (i8042_reset) {
-+ if (i8042_reset == I8042_RESET_ALWAYS) {
- error = i8042_controller_selftest();
- if (error)
- return error;
-diff --git a/drivers/irqchip/irq-eznps.c b/drivers/irqchip/irq-eznps.c
-index efbf0e4..ebc2b0b 100644
---- a/drivers/irqchip/irq-eznps.c
-+++ b/drivers/irqchip/irq-eznps.c
-@@ -85,7 +85,7 @@ static void nps400_irq_eoi_global(struct irq_data *irqd)
- nps_ack_gic();
- }
-
--static void nps400_irq_eoi(struct irq_data *irqd)
-+static void nps400_irq_ack(struct irq_data *irqd)
- {
- unsigned int __maybe_unused irq = irqd_to_hwirq(irqd);
-
-@@ -103,7 +103,7 @@ static struct irq_chip nps400_irq_chip_percpu = {
- .name = "NPS400 IC",
- .irq_mask = nps400_irq_mask,
- .irq_unmask = nps400_irq_unmask,
-- .irq_eoi = nps400_irq_eoi,
-+ .irq_ack = nps400_irq_ack,
- };
-
- static int nps400_irq_map(struct irq_domain *d, unsigned int virq,
-diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
-index da6c0ba..708a260 100644
---- a/drivers/irqchip/irq-gic-v3.c
-+++ b/drivers/irqchip/irq-gic-v3.c
-@@ -153,7 +153,7 @@ static void gic_enable_redist(bool enable)
- return; /* No PM support in this redistributor */
- }
-
-- while (count--) {
-+ while (--count) {
- val = readl_relaxed(rbase + GICR_WAKER);
- if (enable ^ (bool)(val & GICR_WAKER_ChildrenAsleep))
- break;
-diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
-index 8742957..6fc8923 100644
---- a/drivers/md/dm-crypt.c
-+++ b/drivers/md/dm-crypt.c
-@@ -113,8 +113,7 @@ struct iv_tcw_private {
- * and encrypts / decrypts at the same time.
- */
- enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID,
-- DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD,
-- DM_CRYPT_EXIT_THREAD};
-+ DM_CRYPT_SAME_CPU, DM_CRYPT_NO_OFFLOAD };
-
- /*
- * The fields in here must be read only after initialization.
-@@ -1207,18 +1206,20 @@ static int dmcrypt_write(void *data)
- if (!RB_EMPTY_ROOT(&cc->write_tree))
- goto pop_from_list;
-
-- if (unlikely(test_bit(DM_CRYPT_EXIT_THREAD, &cc->flags))) {
-- spin_unlock_irq(&cc->write_thread_wait.lock);
-- break;
-- }
--
-- __set_current_state(TASK_INTERRUPTIBLE);
-+ set_current_state(TASK_INTERRUPTIBLE);
- __add_wait_queue(&cc->write_thread_wait, &wait);
-
- spin_unlock_irq(&cc->write_thread_wait.lock);
-
-+ if (unlikely(kthread_should_stop())) {
-+ set_task_state(current, TASK_RUNNING);
-+ remove_wait_queue(&cc->write_thread_wait, &wait);
-+ break;
-+ }
-+
- schedule();
-
-+ set_task_state(current, TASK_RUNNING);
- spin_lock_irq(&cc->write_thread_wait.lock);
- __remove_wait_queue(&cc->write_thread_wait, &wait);
- goto continue_locked;
-@@ -1533,13 +1534,8 @@ static void crypt_dtr(struct dm_target *ti)
- if (!cc)
- return;
-
-- if (cc->write_thread) {
-- spin_lock_irq(&cc->write_thread_wait.lock);
-- set_bit(DM_CRYPT_EXIT_THREAD, &cc->flags);
-- wake_up_locked(&cc->write_thread_wait);
-- spin_unlock_irq(&cc->write_thread_wait.lock);
-+ if (cc->write_thread)
- kthread_stop(cc->write_thread);
-- }
-
- if (cc->io_queue)
- destroy_workqueue(cc->io_queue);
-diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
-index ac734e5..15db5e9 100644
---- a/drivers/md/dm-mpath.c
-+++ b/drivers/md/dm-mpath.c
-@@ -1521,10 +1521,10 @@ static void activate_path(struct work_struct *work)
- {
- struct pgpath *pgpath =
- container_of(work, struct pgpath, activate_path.work);
-+ struct request_queue *q = bdev_get_queue(pgpath->path.dev->bdev);
-
-- if (pgpath->is_active)
-- scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev),
-- pg_init_done, pgpath);
-+ if (pgpath->is_active && !blk_queue_dying(q))
-+ scsi_dh_activate(q, pg_init_done, pgpath);
- else
- pg_init_done(pgpath, SCSI_DH_DEV_OFFLINED);
- }
-diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
-index 1ca7463..5da86c8 100644
---- a/drivers/md/dm-rq.c
-+++ b/drivers/md/dm-rq.c
-@@ -73,15 +73,24 @@ static void dm_old_start_queue(struct request_queue *q)
- spin_unlock_irqrestore(q->queue_lock, flags);
- }
-
-+static void dm_mq_start_queue(struct request_queue *q)
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(q->queue_lock, flags);
-+ queue_flag_clear(QUEUE_FLAG_STOPPED, q);
-+ spin_unlock_irqrestore(q->queue_lock, flags);
-+
-+ blk_mq_start_stopped_hw_queues(q, true);
-+ blk_mq_kick_requeue_list(q);
-+}
-+
- void dm_start_queue(struct request_queue *q)
- {
- if (!q->mq_ops)
- dm_old_start_queue(q);
-- else {
-- queue_flag_clear_unlocked(QUEUE_FLAG_STOPPED, q);
-- blk_mq_start_stopped_hw_queues(q, true);
-- blk_mq_kick_requeue_list(q);
-- }
-+ else
-+ dm_mq_start_queue(q);
- }
-
- static void dm_old_stop_queue(struct request_queue *q)
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index fa9b1cb..0f2928b 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -1873,6 +1873,7 @@ EXPORT_SYMBOL_GPL(dm_device_name);
-
- static void __dm_destroy(struct mapped_device *md, bool wait)
- {
-+ struct request_queue *q = dm_get_md_queue(md);
- struct dm_table *map;
- int srcu_idx;
-
-@@ -1883,6 +1884,10 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
- set_bit(DMF_FREEING, &md->flags);
- spin_unlock(&_minor_lock);
-
-+ spin_lock_irq(q->queue_lock);
-+ queue_flag_set(QUEUE_FLAG_DYING, q);
-+ spin_unlock_irq(q->queue_lock);
-+
- if (dm_request_based(md) && md->kworker_task)
- flush_kthread_worker(&md->kworker);
-
-@@ -2249,10 +2254,11 @@ static int __dm_resume(struct mapped_device *md, struct dm_table *map)
-
- int dm_resume(struct mapped_device *md)
- {
-- int r = -EINVAL;
-+ int r;
- struct dm_table *map = NULL;
-
- retry:
-+ r = -EINVAL;
- mutex_lock_nested(&md->suspend_lock, SINGLE_DEPTH_NESTING);
-
- if (!dm_suspended_md(md))
-@@ -2276,8 +2282,6 @@ int dm_resume(struct mapped_device *md)
- goto out;
-
- clear_bit(DMF_SUSPENDED, &md->flags);
--
-- r = 0;
- out:
- mutex_unlock(&md->suspend_lock);
-
-diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
-index 4132532..fe79358 100644
---- a/drivers/media/dvb-frontends/mb86a20s.c
-+++ b/drivers/media/dvb-frontends/mb86a20s.c
-@@ -71,25 +71,27 @@ static struct regdata mb86a20s_init1[] = {
- };
-
- static struct regdata mb86a20s_init2[] = {
-- { 0x28, 0x22 }, { 0x29, 0x00 }, { 0x2a, 0x1f }, { 0x2b, 0xf0 },
-+ { 0x50, 0xd1 }, { 0x51, 0x22 },
-+ { 0x39, 0x01 },
-+ { 0x71, 0x00 },
- { 0x3b, 0x21 },
-- { 0x3c, 0x38 },
-+ { 0x3c, 0x3a },
- { 0x01, 0x0d },
-- { 0x04, 0x08 }, { 0x05, 0x03 },
-+ { 0x04, 0x08 }, { 0x05, 0x05 },
- { 0x04, 0x0e }, { 0x05, 0x00 },
-- { 0x04, 0x0f }, { 0x05, 0x37 },
-- { 0x04, 0x0b }, { 0x05, 0x78 },
-+ { 0x04, 0x0f }, { 0x05, 0x14 },
-+ { 0x04, 0x0b }, { 0x05, 0x8c },
- { 0x04, 0x00 }, { 0x05, 0x00 },
-- { 0x04, 0x01 }, { 0x05, 0x1e },
-- { 0x04, 0x02 }, { 0x05, 0x07 },
-- { 0x04, 0x03 }, { 0x05, 0xd0 },
-+ { 0x04, 0x01 }, { 0x05, 0x07 },
-+ { 0x04, 0x02 }, { 0x05, 0x0f },
-+ { 0x04, 0x03 }, { 0x05, 0xa0 },
- { 0x04, 0x09 }, { 0x05, 0x00 },
- { 0x04, 0x0a }, { 0x05, 0xff },
-- { 0x04, 0x27 }, { 0x05, 0x00 },
-+ { 0x04, 0x27 }, { 0x05, 0x64 },
- { 0x04, 0x28 }, { 0x05, 0x00 },
-- { 0x04, 0x1e }, { 0x05, 0x00 },
-- { 0x04, 0x29 }, { 0x05, 0x64 },
-- { 0x04, 0x32 }, { 0x05, 0x02 },
-+ { 0x04, 0x1e }, { 0x05, 0xff },
-+ { 0x04, 0x29 }, { 0x05, 0x0a },
-+ { 0x04, 0x32 }, { 0x05, 0x0a },
- { 0x04, 0x14 }, { 0x05, 0x02 },
- { 0x04, 0x04 }, { 0x05, 0x00 },
- { 0x04, 0x05 }, { 0x05, 0x22 },
-@@ -97,8 +99,6 @@ static struct regdata mb86a20s_init2[] = {
- { 0x04, 0x07 }, { 0x05, 0xd8 },
- { 0x04, 0x12 }, { 0x05, 0x00 },
- { 0x04, 0x13 }, { 0x05, 0xff },
-- { 0x04, 0x15 }, { 0x05, 0x4e },
-- { 0x04, 0x16 }, { 0x05, 0x20 },
-
- /*
- * On this demod, when the bit count reaches the count below,
-@@ -152,42 +152,36 @@ static struct regdata mb86a20s_init2[] = {
- { 0x50, 0x51 }, { 0x51, 0x04 }, /* MER symbol 4 */
- { 0x45, 0x04 }, /* CN symbol 4 */
- { 0x48, 0x04 }, /* CN manual mode */
--
-+ { 0x50, 0xd5 }, { 0x51, 0x01 },
- { 0x50, 0xd6 }, { 0x51, 0x1f },
- { 0x50, 0xd2 }, { 0x51, 0x03 },
-- { 0x50, 0xd7 }, { 0x51, 0xbf },
-- { 0x28, 0x74 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0xff },
-- { 0x28, 0x46 }, { 0x29, 0x00 }, { 0x2a, 0x1a }, { 0x2b, 0x0c },
--
-- { 0x04, 0x40 }, { 0x05, 0x00 },
-- { 0x28, 0x00 }, { 0x2b, 0x08 },
-- { 0x28, 0x05 }, { 0x2b, 0x00 },
-+ { 0x50, 0xd7 }, { 0x51, 0x3f },
- { 0x1c, 0x01 },
-- { 0x28, 0x06 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x1f },
-- { 0x28, 0x07 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x18 },
-- { 0x28, 0x08 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x12 },
-- { 0x28, 0x09 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x30 },
-- { 0x28, 0x0a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x37 },
-- { 0x28, 0x0b }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x02 },
-- { 0x28, 0x0c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x09 },
-- { 0x28, 0x0d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x06 },
-- { 0x28, 0x0e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x7b },
-- { 0x28, 0x0f }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x76 },
-- { 0x28, 0x10 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x7d },
-- { 0x28, 0x11 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x08 },
-- { 0x28, 0x12 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0b },
-- { 0x28, 0x13 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x00 },
-- { 0x28, 0x14 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xf2 },
-- { 0x28, 0x15 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xf3 },
-- { 0x28, 0x16 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x05 },
-- { 0x28, 0x17 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x16 },
-- { 0x28, 0x18 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0f },
-- { 0x28, 0x19 }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xef },
-- { 0x28, 0x1a }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xd8 },
-- { 0x28, 0x1b }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xf1 },
-- { 0x28, 0x1c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x3d },
-- { 0x28, 0x1d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x94 },
-- { 0x28, 0x1e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0xba },
-+ { 0x28, 0x06 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x03 },
-+ { 0x28, 0x07 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0d },
-+ { 0x28, 0x08 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x02 },
-+ { 0x28, 0x09 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x01 },
-+ { 0x28, 0x0a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x21 },
-+ { 0x28, 0x0b }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x29 },
-+ { 0x28, 0x0c }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x16 },
-+ { 0x28, 0x0d }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x31 },
-+ { 0x28, 0x0e }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0e },
-+ { 0x28, 0x0f }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x4e },
-+ { 0x28, 0x10 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x46 },
-+ { 0x28, 0x11 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x0f },
-+ { 0x28, 0x12 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x56 },
-+ { 0x28, 0x13 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x35 },
-+ { 0x28, 0x14 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xbe },
-+ { 0x28, 0x15 }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0x84 },
-+ { 0x28, 0x16 }, { 0x29, 0x00 }, { 0x2a, 0x03 }, { 0x2b, 0xee },
-+ { 0x28, 0x17 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x98 },
-+ { 0x28, 0x18 }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x9f },
-+ { 0x28, 0x19 }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0xb2 },
-+ { 0x28, 0x1a }, { 0x29, 0x00 }, { 0x2a, 0x06 }, { 0x2b, 0xc2 },
-+ { 0x28, 0x1b }, { 0x29, 0x00 }, { 0x2a, 0x07 }, { 0x2b, 0x4a },
-+ { 0x28, 0x1c }, { 0x29, 0x00 }, { 0x2a, 0x01 }, { 0x2b, 0xbc },
-+ { 0x28, 0x1d }, { 0x29, 0x00 }, { 0x2a, 0x04 }, { 0x2b, 0xba },
-+ { 0x28, 0x1e }, { 0x29, 0x00 }, { 0x2a, 0x06 }, { 0x2b, 0x14 },
- { 0x50, 0x1e }, { 0x51, 0x5d },
- { 0x50, 0x22 }, { 0x51, 0x00 },
- { 0x50, 0x23 }, { 0x51, 0xc8 },
-@@ -196,9 +190,7 @@ static struct regdata mb86a20s_init2[] = {
- { 0x50, 0x26 }, { 0x51, 0x00 },
- { 0x50, 0x27 }, { 0x51, 0xc3 },
- { 0x50, 0x39 }, { 0x51, 0x02 },
-- { 0xec, 0x0f },
-- { 0xeb, 0x1f },
-- { 0x28, 0x6a }, { 0x29, 0x00 }, { 0x2a, 0x00 }, { 0x2b, 0x00 },
-+ { 0x50, 0xd5 }, { 0x51, 0x01 },
- { 0xd0, 0x00 },
- };
-
-@@ -318,7 +310,11 @@ static int mb86a20s_read_status(struct dvb_frontend *fe, enum fe_status *status)
- if (val >= 7)
- *status |= FE_HAS_SYNC;
-
-- if (val >= 8) /* Maybe 9? */
-+ /*
-+ * Actually, on state S8, it starts receiving TS, but the TS
-+ * output is only on normal state after the transition to S9.
-+ */
-+ if (val >= 9)
- *status |= FE_HAS_LOCK;
-
- dev_dbg(&state->i2c->dev, "%s: Status = 0x%02x (state = %d)\n",
-@@ -2058,6 +2054,11 @@ static void mb86a20s_release(struct dvb_frontend *fe)
- kfree(state);
- }
-
-+static int mb86a20s_get_frontend_algo(struct dvb_frontend *fe)
-+{
-+ return DVBFE_ALGO_HW;
-+}
-+
- static struct dvb_frontend_ops mb86a20s_ops;
-
- struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config,
-@@ -2130,6 +2131,7 @@ static struct dvb_frontend_ops mb86a20s_ops = {
- .read_status = mb86a20s_read_status_and_stats,
- .read_signal_strength = mb86a20s_read_signal_strength_from_cache,
- .tune = mb86a20s_tune,
-+ .get_frontend_algo = mb86a20s_get_frontend_algo,
- };
-
- MODULE_DESCRIPTION("DVB Frontend module for Fujitsu mb86A20s hardware");
-diff --git a/drivers/media/usb/cx231xx/cx231xx-avcore.c b/drivers/media/usb/cx231xx/cx231xx-avcore.c
-index 4919137..2f52d66 100644
---- a/drivers/media/usb/cx231xx/cx231xx-avcore.c
-+++ b/drivers/media/usb/cx231xx/cx231xx-avcore.c
-@@ -1264,7 +1264,10 @@ int cx231xx_set_agc_analog_digital_mux_select(struct cx231xx *dev,
- dev->board.agc_analog_digital_select_gpio,
- analog_or_digital);
-
-- return status;
-+ if (status < 0)
-+ return status;
-+
-+ return 0;
- }
-
- int cx231xx_enable_i2c_port_3(struct cx231xx *dev, bool is_port_3)
-diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
-index c63248a..72c246b 100644
---- a/drivers/media/usb/cx231xx/cx231xx-cards.c
-+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
-@@ -486,7 +486,7 @@ struct cx231xx_board cx231xx_boards[] = {
- .output_mode = OUT_MODE_VIP11,
- .demod_xfer_mode = 0,
- .ctl_pin_status_mask = 0xFFFFFFC4,
-- .agc_analog_digital_select_gpio = 0x00, /* According with PV cxPolaris.inf file */
-+ .agc_analog_digital_select_gpio = 0x1c,
- .tuner_sif_gpio = -1,
- .tuner_scl_gpio = -1,
- .tuner_sda_gpio = -1,
-diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
-index 630f4fc..ea9a99e 100644
---- a/drivers/media/usb/cx231xx/cx231xx-core.c
-+++ b/drivers/media/usb/cx231xx/cx231xx-core.c
-@@ -712,6 +712,7 @@ int cx231xx_set_mode(struct cx231xx *dev, enum cx231xx_mode set_mode)
- break;
- case CX231XX_BOARD_CNXT_RDE_253S:
- case CX231XX_BOARD_CNXT_RDU_253S:
-+ case CX231XX_BOARD_PV_PLAYTV_USB_HYBRID:
- errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 1);
- break;
- case CX231XX_BOARD_HAUPPAUGE_EXETER:
-@@ -738,7 +739,7 @@ int cx231xx_set_mode(struct cx231xx *dev, enum cx231xx_mode set_mode)
- case CX231XX_BOARD_PV_PLAYTV_USB_HYBRID:
- case CX231XX_BOARD_HAUPPAUGE_USB2_FM_PAL:
- case CX231XX_BOARD_HAUPPAUGE_USB2_FM_NTSC:
-- errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 0);
-+ errCode = cx231xx_set_agc_analog_digital_mux_select(dev, 0);
- break;
- default:
- break;
-@@ -1301,15 +1302,29 @@ int cx231xx_dev_init(struct cx231xx *dev)
- dev->i2c_bus[2].i2c_reserve = 0;
-
- /* register I2C buses */
-- cx231xx_i2c_register(&dev->i2c_bus[0]);
-- cx231xx_i2c_register(&dev->i2c_bus[1]);
-- cx231xx_i2c_register(&dev->i2c_bus[2]);
-+ errCode = cx231xx_i2c_register(&dev->i2c_bus[0]);
-+ if (errCode < 0)
-+ return errCode;
-+ errCode = cx231xx_i2c_register(&dev->i2c_bus[1]);
-+ if (errCode < 0)
-+ return errCode;
-+ errCode = cx231xx_i2c_register(&dev->i2c_bus[2]);
-+ if (errCode < 0)
-+ return errCode;
-
- errCode = cx231xx_i2c_mux_create(dev);
-+ if (errCode < 0) {
-+ dev_err(dev->dev,
-+ "%s: Failed to create I2C mux\n", __func__);
-+ return errCode;
-+ }
-+ errCode = cx231xx_i2c_mux_register(dev, 0);
-+ if (errCode < 0)
-+ return errCode;
-+
-+ errCode = cx231xx_i2c_mux_register(dev, 1);
- if (errCode < 0)
- return errCode;
-- cx231xx_i2c_mux_register(dev, 0);
-- cx231xx_i2c_mux_register(dev, 1);
-
- /* scan the real bus segments in the order of physical port numbers */
- cx231xx_do_i2c_scan(dev, I2C_0);
-diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c
-index d34bc35..2e3cf01 100644
---- a/drivers/memstick/host/rtsx_usb_ms.c
-+++ b/drivers/memstick/host/rtsx_usb_ms.c
-@@ -524,6 +524,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
- int rc;
-
- if (!host->req) {
-+ pm_runtime_get_sync(ms_dev(host));
- do {
- rc = memstick_next_req(msh, &host->req);
- dev_dbg(ms_dev(host), "next req %d\n", rc);
-@@ -544,6 +545,7 @@ static void rtsx_usb_ms_handle_req(struct work_struct *work)
- host->req->error);
- }
- } while (!rc);
-+ pm_runtime_put(ms_dev(host));
- }
-
- }
-@@ -570,6 +572,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
- dev_dbg(ms_dev(host), "%s: param = %d, value = %d\n",
- __func__, param, value);
-
-+ pm_runtime_get_sync(ms_dev(host));
- mutex_lock(&ucr->dev_mutex);
-
- err = rtsx_usb_card_exclusive_check(ucr, RTSX_USB_MS_CARD);
-@@ -635,6 +638,7 @@ static int rtsx_usb_ms_set_param(struct memstick_host *msh,
- }
- out:
- mutex_unlock(&ucr->dev_mutex);
-+ pm_runtime_put(ms_dev(host));
-
- /* power-on delay */
- if (param == MEMSTICK_POWER && value == MEMSTICK_POWER_ON)
-@@ -681,6 +685,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
- int err;
-
- for (;;) {
-+ pm_runtime_get_sync(ms_dev(host));
- mutex_lock(&ucr->dev_mutex);
-
- /* Check pending MS card changes */
-@@ -703,6 +708,7 @@ static int rtsx_usb_detect_ms_card(void *__host)
- }
-
- poll_again:
-+ pm_runtime_put(ms_dev(host));
- if (host->eject)
- break;
-
-diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
-index f3d34b9..af23d7d 100644
---- a/drivers/misc/cxl/api.c
-+++ b/drivers/misc/cxl/api.c
-@@ -229,6 +229,14 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
- if (ctx->status == STARTED)
- goto out; /* already started */
-
-+ /*
-+ * Increment the mapped context count for adapter. This also checks
-+ * if adapter_context_lock is taken.
-+ */
-+ rc = cxl_adapter_context_get(ctx->afu->adapter);
-+ if (rc)
-+ goto out;
-+
- if (task) {
- ctx->pid = get_task_pid(task, PIDTYPE_PID);
- ctx->glpid = get_task_pid(task->group_leader, PIDTYPE_PID);
-@@ -240,6 +248,7 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
-
- if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
- put_pid(ctx->pid);
-+ cxl_adapter_context_put(ctx->afu->adapter);
- cxl_ctx_put();
- goto out;
- }
-diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
-index c466ee2..5e506c1 100644
---- a/drivers/misc/cxl/context.c
-+++ b/drivers/misc/cxl/context.c
-@@ -238,6 +238,9 @@ int __detach_context(struct cxl_context *ctx)
- put_pid(ctx->glpid);
-
- cxl_ctx_put();
-+
-+ /* Decrease the attached context count on the adapter */
-+ cxl_adapter_context_put(ctx->afu->adapter);
- return 0;
- }
-
-diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
-index 344a0ff..19aa2ac 100644
---- a/drivers/misc/cxl/cxl.h
-+++ b/drivers/misc/cxl/cxl.h
-@@ -615,6 +615,14 @@ struct cxl {
- bool perst_select_user;
- bool perst_same_image;
- bool psl_timebase_synced;
-+
-+ /*
-+ * number of contexts mapped on to this card. Possible values are:
-+ * >0: Number of contexts mapped and new one can be mapped.
-+ * 0: No active contexts and new ones can be mapped.
-+ * -1: No contexts mapped and new ones cannot be mapped.
-+ */
-+ atomic_t contexts_num;
- };
-
- int cxl_pci_alloc_one_irq(struct cxl *adapter);
-@@ -940,4 +948,20 @@ bool cxl_pci_is_vphb_device(struct pci_dev *dev);
-
- /* decode AFU error bits in the PSL register PSL_SERR_An */
- void cxl_afu_decode_psl_serr(struct cxl_afu *afu, u64 serr);
-+
-+/*
-+ * Increments the number of attached contexts on an adapter.
-+ * In case an adapter_context_lock is taken the return -EBUSY.
-+ */
-+int cxl_adapter_context_get(struct cxl *adapter);
-+
-+/* Decrements the number of attached contexts on an adapter */
-+void cxl_adapter_context_put(struct cxl *adapter);
-+
-+/* If no active contexts then prevents contexts from being attached */
-+int cxl_adapter_context_lock(struct cxl *adapter);
-+
-+/* Unlock the contexts-lock if taken. Warn and force unlock otherwise */
-+void cxl_adapter_context_unlock(struct cxl *adapter);
-+
- #endif
-diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
-index 5fb9894..d0b421f 100644
---- a/drivers/misc/cxl/file.c
-+++ b/drivers/misc/cxl/file.c
-@@ -205,11 +205,22 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
- ctx->pid = get_task_pid(current, PIDTYPE_PID);
- ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
-
-+ /*
-+ * Increment the mapped context count for adapter. This also checks
-+ * if adapter_context_lock is taken.
-+ */
-+ rc = cxl_adapter_context_get(ctx->afu->adapter);
-+ if (rc) {
-+ afu_release_irqs(ctx, ctx);
-+ goto out;
-+ }
-+
- trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
-
- if ((rc = cxl_ops->attach_process(ctx, false, work.work_element_descriptor,
- amr))) {
- afu_release_irqs(ctx, ctx);
-+ cxl_adapter_context_put(ctx->afu->adapter);
- goto out;
- }
-
-diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
-index 9aa58a7..3e102cd 100644
---- a/drivers/misc/cxl/guest.c
-+++ b/drivers/misc/cxl/guest.c
-@@ -1152,6 +1152,9 @@ struct cxl *cxl_guest_init_adapter(struct device_node *np, struct platform_devic
- if ((rc = cxl_sysfs_adapter_add(adapter)))
- goto err_put1;
-
-+ /* release the context lock as the adapter is configured */
-+ cxl_adapter_context_unlock(adapter);
-+
- return adapter;
-
- err_put1:
-diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
-index d9be23b2..62e0dfb 100644
---- a/drivers/misc/cxl/main.c
-+++ b/drivers/misc/cxl/main.c
-@@ -243,8 +243,10 @@ struct cxl *cxl_alloc_adapter(void)
- if (dev_set_name(&adapter->dev, "card%i", adapter->adapter_num))
- goto err2;
-
-- return adapter;
-+ /* start with context lock taken */
-+ atomic_set(&adapter->contexts_num, -1);
-
-+ return adapter;
- err2:
- cxl_remove_adapter_nr(adapter);
- err1:
-@@ -286,6 +288,44 @@ int cxl_afu_select_best_mode(struct cxl_afu *afu)
- return 0;
- }
-
-+int cxl_adapter_context_get(struct cxl *adapter)
-+{
-+ int rc;
-+
-+ rc = atomic_inc_unless_negative(&adapter->contexts_num);
-+ return rc >= 0 ? 0 : -EBUSY;
-+}
-+
-+void cxl_adapter_context_put(struct cxl *adapter)
-+{
-+ atomic_dec_if_positive(&adapter->contexts_num);
-+}
-+
-+int cxl_adapter_context_lock(struct cxl *adapter)
-+{
-+ int rc;
-+ /* no active contexts -> contexts_num == 0 */
-+ rc = atomic_cmpxchg(&adapter->contexts_num, 0, -1);
-+ return rc ? -EBUSY : 0;
-+}
-+
-+void cxl_adapter_context_unlock(struct cxl *adapter)
-+{
-+ int val = atomic_cmpxchg(&adapter->contexts_num, -1, 0);
-+
-+ /*
-+ * contexts lock taken -> contexts_num == -1
-+ * If not true then show a warning and force reset the lock.
-+ * This will happen when context_unlock was requested without
-+ * doing a context_lock.
-+ */
-+ if (val != -1) {
-+ atomic_set(&adapter->contexts_num, 0);
-+ WARN(1, "Adapter context unlocked with %d active contexts",
-+ val);
-+ }
-+}
-+
- static int __init init_cxl(void)
- {
- int rc = 0;
-diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
-index 6f0c4ac..8ad4e4f 100644
---- a/drivers/misc/cxl/pci.c
-+++ b/drivers/misc/cxl/pci.c
-@@ -1484,6 +1484,8 @@ static int cxl_configure_adapter(struct cxl *adapter, struct pci_dev *dev)
- if ((rc = cxl_native_register_psl_err_irq(adapter)))
- goto err;
-
-+ /* Release the context lock as adapter is configured */
-+ cxl_adapter_context_unlock(adapter);
- return 0;
-
- err:
-diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
-index b043c20..a8b6d6a 100644
---- a/drivers/misc/cxl/sysfs.c
-+++ b/drivers/misc/cxl/sysfs.c
-@@ -75,12 +75,31 @@ static ssize_t reset_adapter_store(struct device *device,
- int val;
-
- rc = sscanf(buf, "%i", &val);
-- if ((rc != 1) || (val != 1))
-+ if ((rc != 1) || (val != 1 && val != -1))
- return -EINVAL;
-
-- if ((rc = cxl_ops->adapter_reset(adapter)))
-- return rc;
-- return count;
-+ /*
-+ * See if we can lock the context mapping that's only allowed
-+ * when there are no contexts attached to the adapter. Once
-+ * taken this will also prevent any context from getting activated.
-+ */
-+ if (val == 1) {
-+ rc = cxl_adapter_context_lock(adapter);
-+ if (rc)
-+ goto out;
-+
-+ rc = cxl_ops->adapter_reset(adapter);
-+ /* In case reset failed release context lock */
-+ if (rc)
-+ cxl_adapter_context_unlock(adapter);
-+
-+ } else if (val == -1) {
-+ /* Perform a forced adapter reset */
-+ rc = cxl_ops->adapter_reset(adapter);
-+ }
-+
-+out:
-+ return rc ? rc : count;
- }
-
- static ssize_t load_image_on_perst_show(struct device *device,
-diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
-index fd9271b..cd01e34 100644
---- a/drivers/misc/mei/amthif.c
-+++ b/drivers/misc/mei/amthif.c
-@@ -139,7 +139,7 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
- return -ERESTARTSYS;
-
- if (!mei_cl_is_connected(cl)) {
-- rets = -EBUSY;
-+ rets = -ENODEV;
- goto out;
- }
-
-diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
-index e094df3..5b5b2e0 100644
---- a/drivers/misc/mei/bus.c
-+++ b/drivers/misc/mei/bus.c
-@@ -142,7 +142,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
- mutex_lock(&bus->device_lock);
-
- if (!mei_cl_is_connected(cl)) {
-- rets = -EBUSY;
-+ rets = -ENODEV;
- goto out;
- }
- }
-diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
-index 0dcb854..7ad15d6 100644
---- a/drivers/misc/mei/hw-me-regs.h
-+++ b/drivers/misc/mei/hw-me-regs.h
-@@ -125,6 +125,9 @@
- #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
- #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
-
-+#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
-+#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
-+
- /*
- * MEI HW Section
- */
-diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
-index 52635b0..080208d 100644
---- a/drivers/misc/mei/main.c
-+++ b/drivers/misc/mei/main.c
-@@ -202,7 +202,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
-
- mutex_lock(&dev->device_lock);
- if (!mei_cl_is_connected(cl)) {
-- rets = -EBUSY;
-+ rets = -ENODEV;
- goto out;
- }
- }
-diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
-index 71cea9b..5eb9b75 100644
---- a/drivers/misc/mei/pci-me.c
-+++ b/drivers/misc/mei/pci-me.c
-@@ -91,6 +91,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
- {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
- {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
-
-+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)},
-+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)},
-+
- /* required last entry */
- {0, }
- };
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 2206d44..17891f1 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -1778,7 +1778,7 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
- struct mmc_blk_data *md = mq->data;
- struct mmc_packed *packed = mqrq->packed;
- bool do_rel_wr, do_data_tag;
-- u32 *packed_cmd_hdr;
-+ __le32 *packed_cmd_hdr;
- u8 hdr_blocks;
- u8 i = 1;
-
-@@ -2303,7 +2303,8 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
- set_capacity(md->disk, size);
-
- if (mmc_host_cmd23(card->host)) {
-- if (mmc_card_mmc(card) ||
-+ if ((mmc_card_mmc(card) &&
-+ card->csd.mmca_vsn >= CSD_SPEC_VER_3) ||
- (mmc_card_sd(card) &&
- card->scr.cmds & SD_SCR_CMD23_SUPPORT))
- md->flags |= MMC_BLK_CMD23;
-diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
-index fee5e12..7f16709 100644
---- a/drivers/mmc/card/queue.h
-+++ b/drivers/mmc/card/queue.h
-@@ -31,7 +31,7 @@ enum mmc_packed_type {
-
- struct mmc_packed {
- struct list_head list;
-- u32 cmd_hdr[1024];
-+ __le32 cmd_hdr[1024];
- unsigned int blocks;
- u8 nr_entries;
- u8 retries;
-diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
-index f2d185c..c57eb32 100644
---- a/drivers/mmc/core/mmc.c
-+++ b/drivers/mmc/core/mmc.c
-@@ -1259,6 +1259,16 @@ static int mmc_select_hs400es(struct mmc_card *card)
- goto out_err;
- }
-
-+ if (card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_2V)
-+ err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_120);
-+
-+ if (err && card->mmc_avail_type & EXT_CSD_CARD_TYPE_HS400_1_8V)
-+ err = __mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180);
-+
-+ /* If fails try again during next card power cycle */
-+ if (err)
-+ goto out_err;
-+
- err = mmc_select_bus_width(card);
- if (err < 0)
- goto out_err;
-diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
-index 6c71fc9..da9f71b 100644
---- a/drivers/mmc/host/rtsx_usb_sdmmc.c
-+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
-@@ -1138,11 +1138,6 @@ static void sdmmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
- dev_dbg(sdmmc_dev(host), "%s\n", __func__);
- mutex_lock(&ucr->dev_mutex);
-
-- if (rtsx_usb_card_exclusive_check(ucr, RTSX_USB_SD_CARD)) {
-- mutex_unlock(&ucr->dev_mutex);
-- return;
-- }
--
- sd_set_power_mode(host, ios->power_mode);
- sd_set_bus_width(host, ios->bus_width);
- sd_set_timing(host, ios->timing, &host->ddr_mode);
-@@ -1314,6 +1309,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
- container_of(work, struct rtsx_usb_sdmmc, led_work);
- struct rtsx_ucr *ucr = host->ucr;
-
-+ pm_runtime_get_sync(sdmmc_dev(host));
- mutex_lock(&ucr->dev_mutex);
-
- if (host->led.brightness == LED_OFF)
-@@ -1322,6 +1318,7 @@ static void rtsx_usb_update_led(struct work_struct *work)
- rtsx_usb_turn_on_led(ucr);
-
- mutex_unlock(&ucr->dev_mutex);
-+ pm_runtime_put(sdmmc_dev(host));
- }
- #endif
-
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index cd65d47..a8a022a 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -687,7 +687,7 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
- * host->clock is in Hz. target_timeout is in us.
- * Hence, us = 1000000 * cycles / Hz. Round up.
- */
-- val = 1000000 * data->timeout_clks;
-+ val = 1000000ULL * data->timeout_clks;
- if (do_div(val, host->clock))
- target_timeout++;
- target_timeout += val;
-diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
-index f453326..b419c7c 100644
---- a/drivers/mtd/ubi/wl.c
-+++ b/drivers/mtd/ubi/wl.c
-@@ -644,7 +644,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
- int shutdown)
- {
- int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
-- int vol_id = -1, lnum = -1;
-+ int erase = 0, keep = 0, vol_id = -1, lnum = -1;
- #ifdef CONFIG_MTD_UBI_FASTMAP
- int anchor = wrk->anchor;
- #endif
-@@ -780,6 +780,16 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
- e1->pnum);
- scrubbing = 1;
- goto out_not_moved;
-+ } else if (ubi->fast_attach && err == UBI_IO_BAD_HDR_EBADMSG) {
-+ /*
-+ * While a full scan would detect interrupted erasures
-+ * at attach time we can face them here when attached from
-+ * Fastmap.
-+ */
-+ dbg_wl("PEB %d has ECC errors, maybe from an interrupted erasure",
-+ e1->pnum);
-+ erase = 1;
-+ goto out_not_moved;
- }
-
- ubi_err(ubi, "error %d while reading VID header from PEB %d",
-@@ -815,6 +825,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
- * Target PEB had bit-flips or write error - torture it.
- */
- torture = 1;
-+ keep = 1;
- goto out_not_moved;
- }
-
-@@ -901,7 +912,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
- ubi->erroneous_peb_count += 1;
- } else if (scrubbing)
- wl_tree_add(e1, &ubi->scrub);
-- else
-+ else if (keep)
- wl_tree_add(e1, &ubi->used);
- if (dst_leb_clean) {
- wl_tree_add(e2, &ubi->free);
-@@ -922,6 +933,12 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
- goto out_ro;
- }
-
-+ if (erase) {
-+ err = do_sync_erase(ubi, e1, vol_id, lnum, 1);
-+ if (err)
-+ goto out_ro;
-+ }
-+
- mutex_unlock(&ubi->move_mutex);
- return 0;
-
-diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
-index 9fb8d74..da9998e 100644
---- a/drivers/net/wireless/ath/ath10k/ce.c
-+++ b/drivers/net/wireless/ath/ath10k/ce.c
-@@ -433,6 +433,13 @@ void ath10k_ce_rx_update_write_idx(struct ath10k_ce_pipe *pipe, u32 nentries)
- unsigned int nentries_mask = dest_ring->nentries_mask;
- unsigned int write_index = dest_ring->write_index;
- u32 ctrl_addr = pipe->ctrl_addr;
-+ u32 cur_write_idx = ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
-+
-+ /* Prevent CE ring stuck issue that will occur when ring is full.
-+ * Make sure that write index is 1 less than read index.
-+ */
-+ if ((cur_write_idx + nentries) == dest_ring->sw_index)
-+ nentries -= 1;
-
- write_index = CE_RING_IDX_ADD(nentries_mask, write_index, nentries);
- ath10k_ce_dest_ring_write_index_set(ar, ctrl_addr, write_index);
-diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
-index 3524441..6ee6bf8 100644
---- a/drivers/net/wireless/realtek/rtlwifi/regd.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
-@@ -345,9 +345,9 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select(
- return &rtl_regdom_no_midband;
- case COUNTRY_CODE_IC:
- return &rtl_regdom_11;
-- case COUNTRY_CODE_ETSI:
- case COUNTRY_CODE_TELEC_NETGEAR:
- return &rtl_regdom_60_64;
-+ case COUNTRY_CODE_ETSI:
- case COUNTRY_CODE_SPAIN:
- case COUNTRY_CODE_FRANCE:
- case COUNTRY_CODE_ISRAEL:
-@@ -406,6 +406,8 @@ static u8 channel_plan_to_country_code(u8 channelplan)
- return COUNTRY_CODE_WORLD_WIDE_13;
- case 0x22:
- return COUNTRY_CODE_IC;
-+ case 0x25:
-+ return COUNTRY_CODE_ETSI;
- case 0x32:
- return COUNTRY_CODE_TELEC_NETGEAR;
- case 0x41:
-diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
-index 6de0757..84d650d 100644
---- a/drivers/pci/host/pci-tegra.c
-+++ b/drivers/pci/host/pci-tegra.c
-@@ -856,7 +856,7 @@ static int tegra_pcie_phy_disable(struct tegra_pcie *pcie)
- /* override IDDQ */
- value = pads_readl(pcie, PADS_CTL);
- value |= PADS_CTL_IDDQ_1L;
-- pads_writel(pcie, PADS_CTL, value);
-+ pads_writel(pcie, value, PADS_CTL);
-
- /* reset PLL */
- value = pads_readl(pcie, soc->pads_pll_ctl);
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 44e0ff3..4bf1a88 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -3198,6 +3198,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
-
- static void quirk_no_pm_reset(struct pci_dev *dev)
- {
-diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
-index d22a9fe..71bbeb9 100644
---- a/drivers/pinctrl/intel/pinctrl-baytrail.c
-+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
-@@ -1808,6 +1808,8 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
- return PTR_ERR(vg->pctl_dev);
- }
-
-+ raw_spin_lock_init(&vg->lock);
-+
- ret = byt_gpio_probe(vg);
- if (ret) {
- pinctrl_unregister(vg->pctl_dev);
-@@ -1815,7 +1817,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
- }
-
- platform_set_drvdata(pdev, vg);
-- raw_spin_lock_init(&vg->lock);
- pm_runtime_enable(&pdev->dev);
-
- return 0;
-diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
-index 257cab1..2b5b20bf 100644
---- a/drivers/pinctrl/intel/pinctrl-intel.c
-+++ b/drivers/pinctrl/intel/pinctrl-intel.c
-@@ -19,6 +19,7 @@
- #include <linux/pinctrl/pinconf.h>
- #include <linux/pinctrl/pinconf-generic.h>
-
-+#include "../core.h"
- #include "pinctrl-intel.h"
-
- /* Offset from regs */
-@@ -1079,6 +1080,26 @@ int intel_pinctrl_remove(struct platform_device *pdev)
- EXPORT_SYMBOL_GPL(intel_pinctrl_remove);
-
- #ifdef CONFIG_PM_SLEEP
-+static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
-+{
-+ const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin);
-+
-+ if (!pd || !intel_pad_usable(pctrl, pin))
-+ return false;
-+
-+ /*
-+ * Only restore the pin if it is actually in use by the kernel (or
-+ * by userspace). It is possible that some pins are used by the
-+ * BIOS during resume and those are not always locked down so leave
-+ * them alone.
-+ */
-+ if (pd->mux_owner || pd->gpio_owner ||
-+ gpiochip_line_is_irq(&pctrl->chip, pin))
-+ return true;
-+
-+ return false;
-+}
-+
- int intel_pinctrl_suspend(struct device *dev)
- {
- struct platform_device *pdev = to_platform_device(dev);
-@@ -1092,7 +1113,7 @@ int intel_pinctrl_suspend(struct device *dev)
- const struct pinctrl_pin_desc *desc = &pctrl->soc->pins[i];
- u32 val;
-
-- if (!intel_pad_usable(pctrl, desc->number))
-+ if (!intel_pinctrl_should_save(pctrl, desc->number))
- continue;
-
- val = readl(intel_get_padcfg(pctrl, desc->number, PADCFG0));
-@@ -1153,7 +1174,7 @@ int intel_pinctrl_resume(struct device *dev)
- void __iomem *padcfg;
- u32 val;
-
-- if (!intel_pad_usable(pctrl, desc->number))
-+ if (!intel_pinctrl_should_save(pctrl, desc->number))
- continue;
-
- padcfg = intel_get_padcfg(pctrl, desc->number, PADCFG0);
-diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
-index fb991ec..696116e 100644
---- a/drivers/regulator/tps65910-regulator.c
-+++ b/drivers/regulator/tps65910-regulator.c
-@@ -1111,6 +1111,12 @@ static int tps65910_probe(struct platform_device *pdev)
- pmic->num_regulators = ARRAY_SIZE(tps65910_regs);
- pmic->ext_sleep_control = tps65910_ext_sleep_control;
- info = tps65910_regs;
-+ /* Work around silicon erratum SWCZ010: output programmed
-+ * voltage level can go higher than expected or crash
-+ * Workaround: use no synchronization of DCDC clocks
-+ */
-+ tps65910_reg_clear_bits(pmic->mfd, TPS65910_DCDCCTRL,
-+ DCDCCTRL_DCDCCKSYNC_MASK);
- break;
- case TPS65911:
- pmic->get_ctrl_reg = &tps65911_get_ctrl_register;
-diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
-index 5d7fbe4..5810019 100644
---- a/drivers/s390/scsi/zfcp_dbf.c
-+++ b/drivers/s390/scsi/zfcp_dbf.c
-@@ -3,7 +3,7 @@
- *
- * Debug traces for zfcp.
- *
-- * Copyright IBM Corp. 2002, 2013
-+ * Copyright IBM Corp. 2002, 2016
- */
-
- #define KMSG_COMPONENT "zfcp"
-@@ -65,7 +65,7 @@ void zfcp_dbf_pl_write(struct zfcp_dbf *dbf, void *data, u16 length, char *area,
- * @tag: tag indicating which kind of unsolicited status has been received
- * @req: request for which a response was received
- */
--void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
-+void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
- {
- struct zfcp_dbf *dbf = req->adapter->dbf;
- struct fsf_qtcb_prefix *q_pref = &req->qtcb->prefix;
-@@ -85,6 +85,8 @@ void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
- rec->u.res.req_issued = req->issued;
- rec->u.res.prot_status = q_pref->prot_status;
- rec->u.res.fsf_status = q_head->fsf_status;
-+ rec->u.res.port_handle = q_head->port_handle;
-+ rec->u.res.lun_handle = q_head->lun_handle;
-
- memcpy(rec->u.res.prot_status_qual, &q_pref->prot_status_qual,
- FSF_PROT_STATUS_QUAL_SIZE);
-@@ -97,7 +99,7 @@ void zfcp_dbf_hba_fsf_res(char *tag, struct zfcp_fsf_req *req)
- rec->pl_len, "fsf_res", req->req_id);
- }
-
-- debug_event(dbf->hba, 1, rec, sizeof(*rec));
-+ debug_event(dbf->hba, level, rec, sizeof(*rec));
- spin_unlock_irqrestore(&dbf->hba_lock, flags);
- }
-
-@@ -241,7 +243,8 @@ static void zfcp_dbf_set_common(struct zfcp_dbf_rec *rec,
- if (sdev) {
- rec->lun_status = atomic_read(&sdev_to_zfcp(sdev)->status);
- rec->lun = zfcp_scsi_dev_lun(sdev);
-- }
-+ } else
-+ rec->lun = ZFCP_DBF_INVALID_LUN;
- }
-
- /**
-@@ -320,13 +323,48 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
- spin_unlock_irqrestore(&dbf->rec_lock, flags);
- }
-
-+/**
-+ * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
-+ * @tag: identifier for event
-+ * @wka_port: well known address port
-+ * @req_id: request ID to correlate with potential HBA trace record
-+ */
-+void zfcp_dbf_rec_run_wka(char *tag, struct zfcp_fc_wka_port *wka_port,
-+ u64 req_id)
-+{
-+ struct zfcp_dbf *dbf = wka_port->adapter->dbf;
-+ struct zfcp_dbf_rec *rec = &dbf->rec_buf;
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&dbf->rec_lock, flags);
-+ memset(rec, 0, sizeof(*rec));
-+
-+ rec->id = ZFCP_DBF_REC_RUN;
-+ memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN);
-+ rec->port_status = wka_port->status;
-+ rec->d_id = wka_port->d_id;
-+ rec->lun = ZFCP_DBF_INVALID_LUN;
-+
-+ rec->u.run.fsf_req_id = req_id;
-+ rec->u.run.rec_status = ~0;
-+ rec->u.run.rec_step = ~0;
-+ rec->u.run.rec_action = ~0;
-+ rec->u.run.rec_count = ~0;
-+
-+ debug_event(dbf->rec, 1, rec, sizeof(*rec));
-+ spin_unlock_irqrestore(&dbf->rec_lock, flags);
-+}
-+
- static inline
--void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf, void *data, u8 id, u16 len,
-- u64 req_id, u32 d_id)
-+void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf,
-+ char *paytag, struct scatterlist *sg, u8 id, u16 len,
-+ u64 req_id, u32 d_id, u16 cap_len)
- {
- struct zfcp_dbf_san *rec = &dbf->san_buf;
- u16 rec_len;
- unsigned long flags;
-+ struct zfcp_dbf_pay *payload = &dbf->pay_buf;
-+ u16 pay_sum = 0;
-
- spin_lock_irqsave(&dbf->san_lock, flags);
- memset(rec, 0, sizeof(*rec));
-@@ -334,10 +372,41 @@ void zfcp_dbf_san(char *tag, struct zfcp_dbf *dbf, void *data, u8 id, u16 len,
- rec->id = id;
- rec->fsf_req_id = req_id;
- rec->d_id = d_id;
-- rec_len = min(len, (u16)ZFCP_DBF_SAN_MAX_PAYLOAD);
-- memcpy(rec->payload, data, rec_len);
- memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN);
-+ rec->pl_len = len; /* full length even if we cap pay below */
-+ if (!sg)
-+ goto out;
-+ rec_len = min_t(unsigned int, sg->length, ZFCP_DBF_SAN_MAX_PAYLOAD);
-+ memcpy(rec->payload, sg_virt(sg), rec_len); /* part of 1st sg entry */
-+ if (len <= rec_len)
-+ goto out; /* skip pay record if full content in rec->payload */
-+
-+ /* if (len > rec_len):
-+ * dump data up to cap_len ignoring small duplicate in rec->payload
-+ */
-+ spin_lock(&dbf->pay_lock);
-+ memset(payload, 0, sizeof(*payload));
-+ memcpy(payload->area, paytag, ZFCP_DBF_TAG_LEN);
-+ payload->fsf_req_id = req_id;
-+ payload->counter = 0;
-+ for (; sg && pay_sum < cap_len; sg = sg_next(sg)) {
-+ u16 pay_len, offset = 0;
-+
-+ while (offset < sg->length && pay_sum < cap_len) {
-+ pay_len = min((u16)ZFCP_DBF_PAY_MAX_REC,
-+ (u16)(sg->length - offset));
-+ /* cap_len <= pay_sum < cap_len+ZFCP_DBF_PAY_MAX_REC */
-+ memcpy(payload->data, sg_virt(sg) + offset, pay_len);
-+ debug_event(dbf->pay, 1, payload,
-+ zfcp_dbf_plen(pay_len));
-+ payload->counter++;
-+ offset += pay_len;
-+ pay_sum += pay_len;
-+ }
-+ }
-+ spin_unlock(&dbf->pay_lock);
-
-+out:
- debug_event(dbf->san, 1, rec, sizeof(*rec));
- spin_unlock_irqrestore(&dbf->san_lock, flags);
- }
-@@ -354,9 +423,62 @@ void zfcp_dbf_san_req(char *tag, struct zfcp_fsf_req *fsf, u32 d_id)
- struct zfcp_fsf_ct_els *ct_els = fsf->data;
- u16 length;
-
-- length = (u16)(ct_els->req->length + FC_CT_HDR_LEN);
-- zfcp_dbf_san(tag, dbf, sg_virt(ct_els->req), ZFCP_DBF_SAN_REQ, length,
-- fsf->req_id, d_id);
-+ length = (u16)zfcp_qdio_real_bytes(ct_els->req);
-+ zfcp_dbf_san(tag, dbf, "san_req", ct_els->req, ZFCP_DBF_SAN_REQ,
-+ length, fsf->req_id, d_id, length);
-+}
-+
-+static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag,
-+ struct zfcp_fsf_req *fsf,
-+ u16 len)
-+{
-+ struct zfcp_fsf_ct_els *ct_els = fsf->data;
-+ struct fc_ct_hdr *reqh = sg_virt(ct_els->req);
-+ struct fc_ns_gid_ft *reqn = (struct fc_ns_gid_ft *)(reqh + 1);
-+ struct scatterlist *resp_entry = ct_els->resp;
-+ struct fc_gpn_ft_resp *acc;
-+ int max_entries, x, last = 0;
-+
-+ if (!(memcmp(tag, "fsscth2", 7) == 0
-+ && ct_els->d_id == FC_FID_DIR_SERV
-+ && reqh->ct_rev == FC_CT_REV
-+ && reqh->ct_in_id[0] == 0
-+ && reqh->ct_in_id[1] == 0
-+ && reqh->ct_in_id[2] == 0
-+ && reqh->ct_fs_type == FC_FST_DIR
-+ && reqh->ct_fs_subtype == FC_NS_SUBTYPE
-+ && reqh->ct_options == 0
-+ && reqh->_ct_resvd1 == 0
-+ && reqh->ct_cmd == FC_NS_GPN_FT
-+ /* reqh->ct_mr_size can vary so do not match but read below */
-+ && reqh->_ct_resvd2 == 0
-+ && reqh->ct_reason == 0
-+ && reqh->ct_explan == 0
-+ && reqh->ct_vendor == 0
-+ && reqn->fn_resvd == 0
-+ && reqn->fn_domain_id_scope == 0
-+ && reqn->fn_area_id_scope == 0
-+ && reqn->fn_fc4_type == FC_TYPE_FCP))
-+ return len; /* not GPN_FT response so do not cap */
-+
-+ acc = sg_virt(resp_entry);
-+ max_entries = (reqh->ct_mr_size * 4 / sizeof(struct fc_gpn_ft_resp))
-+ + 1 /* zfcp_fc_scan_ports: bytes correct, entries off-by-one
-+ * to account for header as 1st pseudo "entry" */;
-+
-+ /* the basic CT_IU preamble is the same size as one entry in the GPN_FT
-+ * response, allowing us to skip special handling for it - just skip it
-+ */
-+ for (x = 1; x < max_entries && !last; x++) {
-+ if (x % (ZFCP_FC_GPN_FT_ENT_PAGE + 1))
-+ acc++;
-+ else
-+ acc = sg_virt(++resp_entry);
-+
-+ last = acc->fp_flags & FC_NS_FID_LAST;
-+ }
-+ len = min(len, (u16)(x * sizeof(struct fc_gpn_ft_resp)));
-+ return len; /* cap after last entry */
- }
-
- /**
-@@ -370,9 +492,10 @@ void zfcp_dbf_san_res(char *tag, struct zfcp_fsf_req *fsf)
- struct zfcp_fsf_ct_els *ct_els = fsf->data;
- u16 length;
-
-- length = (u16)(ct_els->resp->length + FC_CT_HDR_LEN);
-- zfcp_dbf_san(tag, dbf, sg_virt(ct_els->resp), ZFCP_DBF_SAN_RES, length,
-- fsf->req_id, 0);
-+ length = (u16)zfcp_qdio_real_bytes(ct_els->resp);
-+ zfcp_dbf_san(tag, dbf, "san_res", ct_els->resp, ZFCP_DBF_SAN_RES,
-+ length, fsf->req_id, ct_els->d_id,
-+ zfcp_dbf_san_res_cap_len_if_gpn_ft(tag, fsf, length));
- }
-
- /**
-@@ -386,11 +509,13 @@ void zfcp_dbf_san_in_els(char *tag, struct zfcp_fsf_req *fsf)
- struct fsf_status_read_buffer *srb =
- (struct fsf_status_read_buffer *) fsf->data;
- u16 length;
-+ struct scatterlist sg;
-
- length = (u16)(srb->length -
- offsetof(struct fsf_status_read_buffer, payload));
-- zfcp_dbf_san(tag, dbf, srb->payload.data, ZFCP_DBF_SAN_ELS, length,
-- fsf->req_id, ntoh24(srb->d_id));
-+ sg_init_one(&sg, srb->payload.data, length);
-+ zfcp_dbf_san(tag, dbf, "san_els", &sg, ZFCP_DBF_SAN_ELS, length,
-+ fsf->req_id, ntoh24(srb->d_id), length);
- }
-
- /**
-@@ -399,7 +524,8 @@ void zfcp_dbf_san_in_els(char *tag, struct zfcp_fsf_req *fsf)
- * @sc: pointer to struct scsi_cmnd
- * @fsf: pointer to struct zfcp_fsf_req
- */
--void zfcp_dbf_scsi(char *tag, struct scsi_cmnd *sc, struct zfcp_fsf_req *fsf)
-+void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc,
-+ struct zfcp_fsf_req *fsf)
- {
- struct zfcp_adapter *adapter =
- (struct zfcp_adapter *) sc->device->host->hostdata[0];
-@@ -442,7 +568,7 @@ void zfcp_dbf_scsi(char *tag, struct scsi_cmnd *sc, struct zfcp_fsf_req *fsf)
- }
- }
-
-- debug_event(dbf->scsi, 1, rec, sizeof(*rec));
-+ debug_event(dbf->scsi, level, rec, sizeof(*rec));
- spin_unlock_irqrestore(&dbf->scsi_lock, flags);
- }
-
-diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
-index 0be3d48..36d0758 100644
---- a/drivers/s390/scsi/zfcp_dbf.h
-+++ b/drivers/s390/scsi/zfcp_dbf.h
-@@ -2,7 +2,7 @@
- * zfcp device driver
- * debug feature declarations
- *
-- * Copyright IBM Corp. 2008, 2010
-+ * Copyright IBM Corp. 2008, 2015
- */
-
- #ifndef ZFCP_DBF_H
-@@ -17,6 +17,11 @@
-
- #define ZFCP_DBF_INVALID_LUN 0xFFFFFFFFFFFFFFFFull
-
-+enum zfcp_dbf_pseudo_erp_act_type {
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD = 0xff,
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL = 0xfe,
-+};
-+
- /**
- * struct zfcp_dbf_rec_trigger - trace record for triggered recovery action
- * @ready: number of ready recovery actions
-@@ -110,6 +115,7 @@ struct zfcp_dbf_san {
- u32 d_id;
- #define ZFCP_DBF_SAN_MAX_PAYLOAD (FC_CT_HDR_LEN + 32)
- char payload[ZFCP_DBF_SAN_MAX_PAYLOAD];
-+ u16 pl_len;
- } __packed;
-
- /**
-@@ -126,6 +132,8 @@ struct zfcp_dbf_hba_res {
- u8 prot_status_qual[FSF_PROT_STATUS_QUAL_SIZE];
- u32 fsf_status;
- u8 fsf_status_qual[FSF_STATUS_QUALIFIER_SIZE];
-+ u32 port_handle;
-+ u32 lun_handle;
- } __packed;
-
- /**
-@@ -279,7 +287,7 @@ static inline
- void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
- {
- if (debug_level_enabled(req->adapter->dbf->hba, level))
-- zfcp_dbf_hba_fsf_res(tag, req);
-+ zfcp_dbf_hba_fsf_res(tag, level, req);
- }
-
- /**
-@@ -318,7 +326,7 @@ void _zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *scmd,
- scmd->device->host->hostdata[0];
-
- if (debug_level_enabled(adapter->dbf->scsi, level))
-- zfcp_dbf_scsi(tag, scmd, req);
-+ zfcp_dbf_scsi(tag, level, scmd, req);
- }
-
- /**
-diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
-index 3fb4109..a59d678 100644
---- a/drivers/s390/scsi/zfcp_erp.c
-+++ b/drivers/s390/scsi/zfcp_erp.c
-@@ -3,7 +3,7 @@
- *
- * Error Recovery Procedures (ERP).
- *
-- * Copyright IBM Corp. 2002, 2010
-+ * Copyright IBM Corp. 2002, 2015
- */
-
- #define KMSG_COMPONENT "zfcp"
-@@ -1217,8 +1217,14 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
- break;
-
- case ZFCP_ERP_ACTION_REOPEN_PORT:
-- if (result == ZFCP_ERP_SUCCEEDED)
-- zfcp_scsi_schedule_rport_register(port);
-+ /* This switch case might also happen after a forced reopen
-+ * was successfully done and thus overwritten with a new
-+ * non-forced reopen at `ersfs_2'. In this case, we must not
-+ * do the clean-up of the non-forced version.
-+ */
-+ if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
-+ if (result == ZFCP_ERP_SUCCEEDED)
-+ zfcp_scsi_schedule_rport_register(port);
- /* fall through */
- case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
- put_device(&port->dev);
-diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
-index 5b50065..c8fed9f 100644
---- a/drivers/s390/scsi/zfcp_ext.h
-+++ b/drivers/s390/scsi/zfcp_ext.h
-@@ -3,7 +3,7 @@
- *
- * External function declarations.
- *
-- * Copyright IBM Corp. 2002, 2010
-+ * Copyright IBM Corp. 2002, 2015
- */
-
- #ifndef ZFCP_EXT_H
-@@ -35,8 +35,9 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
- extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
- struct zfcp_port *, struct scsi_device *, u8, u8);
- extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
-+extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
- extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
--extern void zfcp_dbf_hba_fsf_res(char *, struct zfcp_fsf_req *);
-+extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
- extern void zfcp_dbf_hba_bit_err(char *, struct zfcp_fsf_req *);
- extern void zfcp_dbf_hba_berr(struct zfcp_dbf *, struct zfcp_fsf_req *);
- extern void zfcp_dbf_hba_def_err(struct zfcp_adapter *, u64, u16, void **);
-@@ -44,7 +45,8 @@ extern void zfcp_dbf_hba_basic(char *, struct zfcp_adapter *);
- extern void zfcp_dbf_san_req(char *, struct zfcp_fsf_req *, u32);
- extern void zfcp_dbf_san_res(char *, struct zfcp_fsf_req *);
- extern void zfcp_dbf_san_in_els(char *, struct zfcp_fsf_req *);
--extern void zfcp_dbf_scsi(char *, struct scsi_cmnd *, struct zfcp_fsf_req *);
-+extern void zfcp_dbf_scsi(char *, int, struct scsi_cmnd *,
-+ struct zfcp_fsf_req *);
-
- /* zfcp_erp.c */
- extern void zfcp_erp_set_adapter_status(struct zfcp_adapter *, u32);
-diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
-index 522a633..75f820ca 100644
---- a/drivers/s390/scsi/zfcp_fsf.c
-+++ b/drivers/s390/scsi/zfcp_fsf.c
-@@ -3,7 +3,7 @@
- *
- * Implementation of FSF commands.
- *
-- * Copyright IBM Corp. 2002, 2013
-+ * Copyright IBM Corp. 2002, 2015
- */
-
- #define KMSG_COMPONENT "zfcp"
-@@ -508,7 +508,10 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
- fc_host_port_type(shost) = FC_PORTTYPE_PTP;
- break;
- case FSF_TOPO_FABRIC:
-- fc_host_port_type(shost) = FC_PORTTYPE_NPORT;
-+ if (bottom->connection_features & FSF_FEATURE_NPIV_MODE)
-+ fc_host_port_type(shost) = FC_PORTTYPE_NPIV;
-+ else
-+ fc_host_port_type(shost) = FC_PORTTYPE_NPORT;
- break;
- case FSF_TOPO_AL:
- fc_host_port_type(shost) = FC_PORTTYPE_NLPORT;
-@@ -613,7 +616,6 @@ static void zfcp_fsf_exchange_port_evaluate(struct zfcp_fsf_req *req)
-
- if (adapter->connection_features & FSF_FEATURE_NPIV_MODE) {
- fc_host_permanent_port_name(shost) = bottom->wwpn;
-- fc_host_port_type(shost) = FC_PORTTYPE_NPIV;
- } else
- fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
- fc_host_maxframe_size(shost) = bottom->maximum_frame_size;
-@@ -982,8 +984,12 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
- if (zfcp_adapter_multi_buffer_active(adapter)) {
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_req))
- return -EIO;
-+ qtcb->bottom.support.req_buf_length =
-+ zfcp_qdio_real_bytes(sg_req);
- if (zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, sg_resp))
- return -EIO;
-+ qtcb->bottom.support.resp_buf_length =
-+ zfcp_qdio_real_bytes(sg_resp);
-
- zfcp_qdio_set_data_div(qdio, &req->qdio_req,
- zfcp_qdio_sbale_count(sg_req));
-@@ -1073,6 +1079,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
-
- req->handler = zfcp_fsf_send_ct_handler;
- req->qtcb->header.port_handle = wka_port->handle;
-+ ct->d_id = wka_port->d_id;
- req->data = ct;
-
- zfcp_dbf_san_req("fssct_1", req, wka_port->d_id);
-@@ -1169,6 +1176,7 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
-
- hton24(req->qtcb->bottom.support.d_id, d_id);
- req->handler = zfcp_fsf_send_els_handler;
-+ els->d_id = d_id;
- req->data = els;
-
- zfcp_dbf_san_req("fssels1", req, d_id);
-@@ -1575,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
- int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
- {
- struct zfcp_qdio *qdio = wka_port->adapter->qdio;
-- struct zfcp_fsf_req *req;
-+ struct zfcp_fsf_req *req = NULL;
- int retval = -EIO;
-
- spin_lock_irq(&qdio->req_q_lock);
-@@ -1604,6 +1612,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
- zfcp_fsf_req_free(req);
- out:
- spin_unlock_irq(&qdio->req_q_lock);
-+ if (req && !IS_ERR(req))
-+ zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
- return retval;
- }
-
-@@ -1628,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
- int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
- {
- struct zfcp_qdio *qdio = wka_port->adapter->qdio;
-- struct zfcp_fsf_req *req;
-+ struct zfcp_fsf_req *req = NULL;
- int retval = -EIO;
-
- spin_lock_irq(&qdio->req_q_lock);
-@@ -1657,6 +1667,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
- zfcp_fsf_req_free(req);
- out:
- spin_unlock_irq(&qdio->req_q_lock);
-+ if (req && !IS_ERR(req))
-+ zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
- return retval;
- }
-
-diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
-index 57ae3ae..be1c04b 100644
---- a/drivers/s390/scsi/zfcp_fsf.h
-+++ b/drivers/s390/scsi/zfcp_fsf.h
-@@ -3,7 +3,7 @@
- *
- * Interface to the FSF support functions.
- *
-- * Copyright IBM Corp. 2002, 2010
-+ * Copyright IBM Corp. 2002, 2015
- */
-
- #ifndef FSF_H
-@@ -436,6 +436,7 @@ struct zfcp_blk_drv_data {
- * @handler_data: data passed to handler function
- * @port: Optional pointer to port for zfcp internal ELS (only test link ADISC)
- * @status: used to pass error status to calling function
-+ * @d_id: Destination ID of either open WKA port for CT or of D_ID for ELS
- */
- struct zfcp_fsf_ct_els {
- struct scatterlist *req;
-@@ -444,6 +445,7 @@ struct zfcp_fsf_ct_els {
- void *handler_data;
- struct zfcp_port *port;
- int status;
-+ u32 d_id;
- };
-
- #endif /* FSF_H */
-diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
-index b3c6ff4..9069f98 100644
---- a/drivers/s390/scsi/zfcp_scsi.c
-+++ b/drivers/s390/scsi/zfcp_scsi.c
-@@ -3,7 +3,7 @@
- *
- * Interface to Linux SCSI midlayer.
- *
-- * Copyright IBM Corp. 2002, 2013
-+ * Copyright IBM Corp. 2002, 2015
- */
-
- #define KMSG_COMPONENT "zfcp"
-@@ -556,6 +556,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port)
- ids.port_id = port->d_id;
- ids.roles = FC_RPORT_ROLE_FCP_TARGET;
-
-+ zfcp_dbf_rec_trig("scpaddy", port->adapter, port, NULL,
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD,
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD);
- rport = fc_remote_port_add(port->adapter->scsi_host, 0, &ids);
- if (!rport) {
- dev_err(&port->adapter->ccw_device->dev,
-@@ -577,6 +580,9 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
- struct fc_rport *rport = port->rport;
-
- if (rport) {
-+ zfcp_dbf_rec_trig("scpdely", port->adapter, port, NULL,
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL,
-+ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL);
- fc_remote_port_delete(rport);
- port->rport = NULL;
- }
-diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
-index e0a78f5..bac8cdf 100644
---- a/drivers/scsi/scsi_scan.c
-+++ b/drivers/scsi/scsi_scan.c
-@@ -1472,12 +1472,12 @@ static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
- out_err:
- kfree(lun_data);
- out:
-- scsi_device_put(sdev);
- if (scsi_device_created(sdev))
- /*
- * the sdev we used didn't appear in the report luns scan
- */
- __scsi_remove_device(sdev);
-+ scsi_device_put(sdev);
- return ret;
- }
-
-diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
-index 333eb22..0aaf429 100644
---- a/drivers/soc/fsl/qe/gpio.c
-+++ b/drivers/soc/fsl/qe/gpio.c
-@@ -41,7 +41,8 @@ struct qe_gpio_chip {
-
- static void qe_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
- {
-- struct qe_gpio_chip *qe_gc = gpiochip_get_data(&mm_gc->gc);
-+ struct qe_gpio_chip *qe_gc =
-+ container_of(mm_gc, struct qe_gpio_chip, mm_gc);
- struct qe_pio_regs __iomem *regs = mm_gc->regs;
-
- qe_gc->cpdata = in_be32(&regs->cpdata);
-diff --git a/drivers/soc/fsl/qe/qe_common.c b/drivers/soc/fsl/qe/qe_common.c
-index 41eff80..104e68d 100644
---- a/drivers/soc/fsl/qe/qe_common.c
-+++ b/drivers/soc/fsl/qe/qe_common.c
-@@ -70,6 +70,11 @@ int cpm_muram_init(void)
- }
-
- muram_pool = gen_pool_create(0, -1);
-+ if (!muram_pool) {
-+ pr_err("Cannot allocate memory pool for CPM/QE muram");
-+ ret = -ENOMEM;
-+ goto out_muram;
-+ }
- muram_pbase = of_translate_address(np, zero);
- if (muram_pbase == (phys_addr_t)OF_BAD_ADDR) {
- pr_err("Cannot translate zero through CPM muram node");
-@@ -116,6 +121,9 @@ static unsigned long cpm_muram_alloc_common(unsigned long size,
- struct muram_block *entry;
- unsigned long start;
-
-+ if (!muram_pool && cpm_muram_init())
-+ goto out2;
-+
- start = gen_pool_alloc_algo(muram_pool, size, algo, data);
- if (!start)
- goto out2;
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 6094a6b..e825d58 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -754,15 +754,7 @@ EXPORT_SYMBOL(target_complete_cmd);
-
- void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
- {
-- if (scsi_status != SAM_STAT_GOOD) {
-- return;
-- }
--
-- /*
-- * Calculate new residual count based upon length of SCSI data
-- * transferred.
-- */
-- if (length < cmd->data_length) {
-+ if (scsi_status == SAM_STAT_GOOD && length < cmd->data_length) {
- if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
- cmd->residual_count += cmd->data_length - length;
- } else {
-@@ -771,12 +763,6 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
- }
-
- cmd->data_length = length;
-- } else if (length > cmd->data_length) {
-- cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
-- cmd->residual_count = length - cmd->data_length;
-- } else {
-- cmd->se_cmd_flags &= ~(SCF_OVERFLOW_BIT | SCF_UNDERFLOW_BIT);
-- cmd->residual_count = 0;
- }
-
- target_complete_cmd(cmd, scsi_status);
-@@ -1706,6 +1692,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
- case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
- case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
- case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
-+ case TCM_COPY_TARGET_DEVICE_NOT_REACHABLE:
- break;
- case TCM_OUT_OF_RESOURCES:
- sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-@@ -2547,8 +2534,10 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
- * fabric acknowledgement that requires two target_put_sess_cmd()
- * invocations before se_cmd descriptor release.
- */
-- if (ack_kref)
-+ if (ack_kref) {
- kref_get(&se_cmd->cmd_kref);
-+ se_cmd->se_cmd_flags |= SCF_ACK_KREF;
-+ }
-
- spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
- if (se_sess->sess_tearing_down) {
-@@ -2871,6 +2860,12 @@ static const struct sense_info sense_info_table[] = {
- .ascq = 0x03, /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
- .add_sector_info = true,
- },
-+ [TCM_COPY_TARGET_DEVICE_NOT_REACHABLE] = {
-+ .key = COPY_ABORTED,
-+ .asc = 0x0d,
-+ .ascq = 0x02, /* COPY TARGET DEVICE NOT REACHABLE */
-+
-+ },
- [TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE] = {
- /*
- * Returning ILLEGAL REQUEST would cause immediate IO errors on
-diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
-index 75cd854..094a144 100644
---- a/drivers/target/target_core_xcopy.c
-+++ b/drivers/target/target_core_xcopy.c
-@@ -104,7 +104,7 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
- }
- mutex_unlock(&g_device_mutex);
-
-- pr_err("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
-+ pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
- return -EINVAL;
- }
-
-@@ -185,7 +185,7 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
-
- static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
- struct xcopy_op *xop, unsigned char *p,
-- unsigned short tdll)
-+ unsigned short tdll, sense_reason_t *sense_ret)
- {
- struct se_device *local_dev = se_cmd->se_dev;
- unsigned char *desc = p;
-@@ -193,6 +193,8 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
- unsigned short start = 0;
- bool src = true;
-
-+ *sense_ret = TCM_INVALID_PARAMETER_LIST;
-+
- if (offset != 0) {
- pr_err("XCOPY target descriptor list length is not"
- " multiple of %d\n", XCOPY_TARGET_DESC_LEN);
-@@ -243,9 +245,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
- rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, true);
- else
- rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, false);
--
-- if (rc < 0)
-+ /*
-+ * If a matching IEEE NAA 0x83 descriptor for the requested device
-+ * is not located on this node, return COPY_ABORTED with ASQ/ASQC
-+ * 0x0d/0x02 - COPY_TARGET_DEVICE_NOT_REACHABLE to request the
-+ * initiator to fall back to normal copy method.
-+ */
-+ if (rc < 0) {
-+ *sense_ret = TCM_COPY_TARGET_DEVICE_NOT_REACHABLE;
- goto out;
-+ }
-
- pr_debug("XCOPY TGT desc: Source dev: %p NAA IEEE WWN: 0x%16phN\n",
- xop->src_dev, &xop->src_tid_wwn[0]);
-@@ -653,6 +662,7 @@ static int target_xcopy_read_source(
- rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
- remote_port, true);
- if (rc < 0) {
-+ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
- transport_generic_free_cmd(se_cmd, 0);
- return rc;
- }
-@@ -664,6 +674,7 @@ static int target_xcopy_read_source(
-
- rc = target_xcopy_issue_pt_cmd(xpt_cmd);
- if (rc < 0) {
-+ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
- transport_generic_free_cmd(se_cmd, 0);
- return rc;
- }
-@@ -714,6 +725,7 @@ static int target_xcopy_write_destination(
- remote_port, false);
- if (rc < 0) {
- struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd;
-+ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
- /*
- * If the failure happened before the t_mem_list hand-off in
- * target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that
-@@ -729,6 +741,7 @@ static int target_xcopy_write_destination(
-
- rc = target_xcopy_issue_pt_cmd(xpt_cmd);
- if (rc < 0) {
-+ ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status;
- se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC;
- transport_generic_free_cmd(se_cmd, 0);
- return rc;
-@@ -815,9 +828,14 @@ static void target_xcopy_do_work(struct work_struct *work)
- out:
- xcopy_pt_undepend_remotedev(xop);
- kfree(xop);
--
-- pr_warn("target_xcopy_do_work: Setting X-COPY CHECK_CONDITION -> sending response\n");
-- ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
-+ /*
-+ * Don't override an error scsi status if it has already been set
-+ */
-+ if (ec_cmd->scsi_status == SAM_STAT_GOOD) {
-+ pr_warn_ratelimited("target_xcopy_do_work: rc: %d, Setting X-COPY"
-+ " CHECK_CONDITION -> sending response\n", rc);
-+ ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
-+ }
- target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
- }
-
-@@ -875,7 +893,7 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
- " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
- tdll, sdll, inline_dl);
-
-- rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll);
-+ rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
- if (rc <= 0)
- goto out;
-
-diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
-index 216e18c..9a874a8 100644
---- a/drivers/target/tcm_fc/tfc_cmd.c
-+++ b/drivers/target/tcm_fc/tfc_cmd.c
-@@ -572,7 +572,7 @@ static void ft_send_work(struct work_struct *work)
- if (target_submit_cmd(&cmd->se_cmd, cmd->sess->se_sess, fcp->fc_cdb,
- &cmd->ft_sense_buffer[0], scsilun_to_int(&fcp->fc_lun),
- ntohl(fcp->fc_dl), task_attr, data_dir,
-- TARGET_SCF_ACK_KREF))
-+ TARGET_SCF_ACK_KREF | TARGET_SCF_USE_CPUID))
- goto err;
-
- pr_debug("r_ctl %x alloc target_submit_cmd\n", fh->fh_r_ctl);
-diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
-index 924bad4..37a37c4 100644
---- a/drivers/video/fbdev/efifb.c
-+++ b/drivers/video/fbdev/efifb.c
-@@ -50,9 +50,9 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
- return 1;
-
- if (regno < 16) {
-- red >>= 8;
-- green >>= 8;
-- blue >>= 8;
-+ red >>= 16 - info->var.red.length;
-+ green >>= 16 - info->var.green.length;
-+ blue >>= 16 - info->var.blue.length;
- ((u32 *)(info->pseudo_palette))[regno] =
- (red << info->var.red.offset) |
- (green << info->var.green.offset) |
-diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
-index 4a2290f..d5735c1 100644
---- a/drivers/watchdog/mt7621_wdt.c
-+++ b/drivers/watchdog/mt7621_wdt.c
-@@ -139,7 +139,6 @@ static int mt7621_wdt_probe(struct platform_device *pdev)
- if (!IS_ERR(mt7621_wdt_reset))
- reset_control_deassert(mt7621_wdt_reset);
-
-- mt7621_wdt_dev.dev = &pdev->dev;
- mt7621_wdt_dev.bootstatus = mt7621_wdt_bootcause();
-
- watchdog_init_timeout(&mt7621_wdt_dev, mt7621_wdt_dev.max_timeout,
-diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
-index 1967919..14b4fd4 100644
---- a/drivers/watchdog/rt2880_wdt.c
-+++ b/drivers/watchdog/rt2880_wdt.c
-@@ -158,7 +158,6 @@ static int rt288x_wdt_probe(struct platform_device *pdev)
-
- rt288x_wdt_freq = clk_get_rate(rt288x_wdt_clk) / RALINK_WDT_PRESCALE;
-
-- rt288x_wdt_dev.dev = &pdev->dev;
- rt288x_wdt_dev.bootstatus = rt288x_wdt_bootcause();
- rt288x_wdt_dev.max_timeout = (0xfffful / rt288x_wdt_freq);
- rt288x_wdt_dev.parent = &pdev->dev;
-diff --git a/fs/ceph/file.c b/fs/ceph/file.c
-index 0f5375d..eede975 100644
---- a/fs/ceph/file.c
-+++ b/fs/ceph/file.c
-@@ -1272,7 +1272,8 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to)
- statret = __ceph_do_getattr(inode, page,
- CEPH_STAT_CAP_INLINE_DATA, !!page);
- if (statret < 0) {
-- __free_page(page);
-+ if (page)
-+ __free_page(page);
- if (statret == -ENODATA) {
- BUG_ON(retry_op != READ_INLINE);
- goto again;
-diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
-index 6c58e13..3d03e48 100644
---- a/fs/cifs/cifs_debug.c
-+++ b/fs/cifs/cifs_debug.c
-@@ -152,6 +152,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
- list_for_each(tmp1, &cifs_tcp_ses_list) {
- server = list_entry(tmp1, struct TCP_Server_Info,
- tcp_ses_list);
-+ seq_printf(m, "\nNumber of credits: %d", server->credits);
- i++;
- list_for_each(tmp2, &server->smb_ses_list) {
- ses = list_entry(tmp2, struct cifs_ses,
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 14ae4b8..8c68d03 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -271,7 +271,7 @@ cifs_alloc_inode(struct super_block *sb)
- cifs_inode->createtime = 0;
- cifs_inode->epoch = 0;
- #ifdef CONFIG_CIFS_SMB2
-- get_random_bytes(cifs_inode->lease_key, SMB2_LEASE_KEY_SIZE);
-+ generate_random_uuid(cifs_inode->lease_key);
- #endif
- /*
- * Can not set i_flags here - they get immediately overwritten to zero
-@@ -1271,7 +1271,6 @@ init_cifs(void)
- GlobalTotalActiveXid = 0;
- GlobalMaxActiveXid = 0;
- spin_lock_init(&cifs_tcp_ses_lock);
-- spin_lock_init(&cifs_file_list_lock);
- spin_lock_init(&GlobalMid_Lock);
-
- get_random_bytes(&cifs_lock_secret, sizeof(cifs_lock_secret));
-diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 8f1d8c1..65f78b7 100644
---- a/fs/cifs/cifsglob.h
-+++ b/fs/cifs/cifsglob.h
-@@ -833,6 +833,7 @@ struct cifs_tcon {
- struct list_head tcon_list;
- int tc_count;
- struct list_head openFileList;
-+ spinlock_t open_file_lock; /* protects list above */
- struct cifs_ses *ses; /* pointer to session associated with */
- char treeName[MAX_TREE_SIZE + 1]; /* UNC name of resource in ASCII */
- char *nativeFileSystem;
-@@ -889,7 +890,7 @@ struct cifs_tcon {
- #endif /* CONFIG_CIFS_STATS2 */
- __u64 bytes_read;
- __u64 bytes_written;
-- spinlock_t stat_lock;
-+ spinlock_t stat_lock; /* protects the two fields above */
- #endif /* CONFIG_CIFS_STATS */
- FILE_SYSTEM_DEVICE_INFO fsDevInfo;
- FILE_SYSTEM_ATTRIBUTE_INFO fsAttrInfo; /* ok if fs name truncated */
-@@ -1040,8 +1041,10 @@ struct cifs_fid_locks {
- };
-
- struct cifsFileInfo {
-+ /* following two lists are protected by tcon->open_file_lock */
- struct list_head tlist; /* pointer to next fid owned by tcon */
- struct list_head flist; /* next fid (file instance) for this inode */
-+ /* lock list below protected by cifsi->lock_sem */
- struct cifs_fid_locks *llist; /* brlocks held by this fid */
- kuid_t uid; /* allows finding which FileInfo structure */
- __u32 pid; /* process id who opened file */
-@@ -1049,11 +1052,12 @@ struct cifsFileInfo {
- /* BB add lock scope info here if needed */ ;
- /* lock scope id (0 if none) */
- struct dentry *dentry;
-- unsigned int f_flags;
- struct tcon_link *tlink;
-+ unsigned int f_flags;
- bool invalidHandle:1; /* file closed via session abend */
- bool oplock_break_cancelled:1;
-- int count; /* refcount protected by cifs_file_list_lock */
-+ int count;
-+ spinlock_t file_info_lock; /* protects four flag/count fields above */
- struct mutex fh_mutex; /* prevents reopen race after dead ses*/
- struct cifs_search_info srch_inf;
- struct work_struct oplock_break; /* work for oplock breaks */
-@@ -1120,7 +1124,7 @@ struct cifs_writedata {
-
- /*
- * Take a reference on the file private data. Must be called with
-- * cifs_file_list_lock held.
-+ * cfile->file_info_lock held.
- */
- static inline void
- cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
-@@ -1514,8 +1518,10 @@ require use of the stronger protocol */
- * GlobalMid_Lock protects:
- * list operations on pending_mid_q and oplockQ
- * updates to XID counters, multiplex id and SMB sequence numbers
-- * cifs_file_list_lock protects:
-- * list operations on tcp and SMB session lists and tCon lists
-+ * tcp_ses_lock protects:
-+ * list operations on tcp and SMB session lists
-+ * tcon->open_file_lock protects the list of open files hanging off the tcon
-+ * cfile->file_info_lock protects counters and fields in cifs file struct
- * f_owner.lock protects certain per file struct operations
- * mapping->page_lock protects certain per page operations
- *
-@@ -1547,18 +1553,12 @@ GLOBAL_EXTERN struct list_head cifs_tcp_ses_list;
- * tcp session, and the list of tcon's per smb session. It also protects
- * the reference counters for the server, smb session, and tcon. Finally,
- * changes to the tcon->tidStatus should be done while holding this lock.
-+ * generally the locks should be taken in order tcp_ses_lock before
-+ * tcon->open_file_lock and that before file->file_info_lock since the
-+ * structure order is cifs_socket-->cifs_ses-->cifs_tcon-->cifs_file
- */
- GLOBAL_EXTERN spinlock_t cifs_tcp_ses_lock;
-
--/*
-- * This lock protects the cifs_file->llist and cifs_file->flist
-- * list operations, and updates to some flags (cifs_file->invalidHandle)
-- * It will be moved to either use the tcon->stat_lock or equivalent later.
-- * If cifs_tcp_ses_lock and the lock below are both needed to be held, then
-- * the cifs_tcp_ses_lock must be grabbed first and released last.
-- */
--GLOBAL_EXTERN spinlock_t cifs_file_list_lock;
--
- #ifdef CONFIG_CIFS_DNOTIFY_EXPERIMENTAL /* unused temporarily */
- /* Outstanding dir notify requests */
- GLOBAL_EXTERN struct list_head GlobalDnotifyReqList;
-diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
-index d47197e..7804605 100644
---- a/fs/cifs/cifssmb.c
-+++ b/fs/cifs/cifssmb.c
-@@ -98,13 +98,13 @@ cifs_mark_open_files_invalid(struct cifs_tcon *tcon)
- struct list_head *tmp1;
-
- /* list all files open on tree connection and mark them invalid */
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- list_for_each_safe(tmp, tmp1, &tcon->openFileList) {
- open_file = list_entry(tmp, struct cifsFileInfo, tlist);
- open_file->invalidHandle = true;
- open_file->oplock_break_cancelled = true;
- }
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- /*
- * BB Add call to invalidate_inodes(sb) for all superblocks mounted
- * to this tcon.
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 2e4f4ba..7b67179 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -2163,7 +2163,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
- memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
- sizeof(tcp_ses->dstaddr));
- #ifdef CONFIG_CIFS_SMB2
-- get_random_bytes(tcp_ses->client_guid, SMB2_CLIENT_GUID_SIZE);
-+ generate_random_uuid(tcp_ses->client_guid);
- #endif
- /*
- * at this point we are the only ones with the pointer
-@@ -3688,14 +3688,16 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
- goto mount_fail_check;
- }
-
-- rc = cifs_are_all_path_components_accessible(server,
-+ if (rc != -EREMOTE) {
-+ rc = cifs_are_all_path_components_accessible(server,
- xid, tcon, cifs_sb,
- full_path);
-- if (rc != 0) {
-- cifs_dbg(VFS, "cannot query dirs between root and final path, "
-- "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
-- cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
-- rc = 0;
-+ if (rc != 0) {
-+ cifs_dbg(VFS, "cannot query dirs between root and final path, "
-+ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
-+ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
-+ rc = 0;
-+ }
- }
- kfree(full_path);
- }
-diff --git a/fs/cifs/file.c b/fs/cifs/file.c
-index 579e41b..605438a 100644
---- a/fs/cifs/file.c
-+++ b/fs/cifs/file.c
-@@ -305,6 +305,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
- cfile->tlink = cifs_get_tlink(tlink);
- INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
- mutex_init(&cfile->fh_mutex);
-+ spin_lock_init(&cfile->file_info_lock);
-
- cifs_sb_active(inode->i_sb);
-
-@@ -317,7 +318,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
- oplock = 0;
- }
-
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock)
- oplock = fid->pending_open->oplock;
- list_del(&fid->pending_open->olist);
-@@ -326,12 +327,13 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
- server->ops->set_fid(cfile, fid, oplock);
-
- list_add(&cfile->tlist, &tcon->openFileList);
-+
- /* if readable file instance put first in list*/
- if (file->f_mode & FMODE_READ)
- list_add(&cfile->flist, &cinode->openFileList);
- else
- list_add_tail(&cfile->flist, &cinode->openFileList);
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
-
- if (fid->purge_cache)
- cifs_zap_mapping(inode);
-@@ -343,16 +345,16 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
- struct cifsFileInfo *
- cifsFileInfo_get(struct cifsFileInfo *cifs_file)
- {
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&cifs_file->file_info_lock);
- cifsFileInfo_get_locked(cifs_file);
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cifs_file->file_info_lock);
- return cifs_file;
- }
-
- /*
- * Release a reference on the file private data. This may involve closing
- * the filehandle out on the server. Must be called without holding
-- * cifs_file_list_lock.
-+ * tcon->open_file_lock and cifs_file->file_info_lock.
- */
- void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
- {
-@@ -367,11 +369,15 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
- struct cifs_pending_open open;
- bool oplock_break_cancelled;
-
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
-+
-+ spin_lock(&cifs_file->file_info_lock);
- if (--cifs_file->count > 0) {
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cifs_file->file_info_lock);
-+ spin_unlock(&tcon->open_file_lock);
- return;
- }
-+ spin_unlock(&cifs_file->file_info_lock);
-
- if (server->ops->get_lease_key)
- server->ops->get_lease_key(inode, &fid);
-@@ -395,7 +401,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
- set_bit(CIFS_INO_INVALID_MAPPING, &cifsi->flags);
- cifs_set_oplock_level(cifsi, 0);
- }
-- spin_unlock(&cifs_file_list_lock);
-+
-+ spin_unlock(&tcon->open_file_lock);
-
- oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
-
-@@ -772,10 +779,10 @@ int cifs_closedir(struct inode *inode, struct file *file)
- server = tcon->ses->server;
-
- cifs_dbg(FYI, "Freeing private data in close dir\n");
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&cfile->file_info_lock);
- if (server->ops->dir_needs_close(cfile)) {
- cfile->invalidHandle = true;
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cfile->file_info_lock);
- if (server->ops->close_dir)
- rc = server->ops->close_dir(xid, tcon, &cfile->fid);
- else
-@@ -784,7 +791,7 @@ int cifs_closedir(struct inode *inode, struct file *file)
- /* not much we can do if it fails anyway, ignore rc */
- rc = 0;
- } else
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cfile->file_info_lock);
-
- buf = cfile->srch_inf.ntwrk_buf_start;
- if (buf) {
-@@ -1728,12 +1735,13 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
- {
- struct cifsFileInfo *open_file = NULL;
- struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
-+ struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
-
- /* only filter by fsuid on multiuser mounts */
- if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
- fsuid_only = false;
-
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- /* we could simply get the first_list_entry since write-only entries
- are always at the end of the list but since the first entry might
- have a close pending, we go through the whole list */
-@@ -1744,8 +1752,8 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
- if (!open_file->invalidHandle) {
- /* found a good file */
- /* lock it so it will not be closed on us */
-- cifsFileInfo_get_locked(open_file);
-- spin_unlock(&cifs_file_list_lock);
-+ cifsFileInfo_get(open_file);
-+ spin_unlock(&tcon->open_file_lock);
- return open_file;
- } /* else might as well continue, and look for
- another, or simply have the caller reopen it
-@@ -1753,7 +1761,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
- } else /* write only file */
- break; /* write only files are last so must be done */
- }
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- return NULL;
- }
-
-@@ -1762,6 +1770,7 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
- {
- struct cifsFileInfo *open_file, *inv_file = NULL;
- struct cifs_sb_info *cifs_sb;
-+ struct cifs_tcon *tcon;
- bool any_available = false;
- int rc;
- unsigned int refind = 0;
-@@ -1777,15 +1786,16 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
- }
-
- cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
-+ tcon = cifs_sb_master_tcon(cifs_sb);
-
- /* only filter by fsuid on multiuser mounts */
- if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
- fsuid_only = false;
-
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- refind_writable:
- if (refind > MAX_REOPEN_ATT) {
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- return NULL;
- }
- list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
-@@ -1796,8 +1806,8 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
- if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
- if (!open_file->invalidHandle) {
- /* found a good writable file */
-- cifsFileInfo_get_locked(open_file);
-- spin_unlock(&cifs_file_list_lock);
-+ cifsFileInfo_get(open_file);
-+ spin_unlock(&tcon->open_file_lock);
- return open_file;
- } else {
- if (!inv_file)
-@@ -1813,24 +1823,24 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
-
- if (inv_file) {
- any_available = false;
-- cifsFileInfo_get_locked(inv_file);
-+ cifsFileInfo_get(inv_file);
- }
-
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
-
- if (inv_file) {
- rc = cifs_reopen_file(inv_file, false);
- if (!rc)
- return inv_file;
- else {
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- list_move_tail(&inv_file->flist,
- &cifs_inode->openFileList);
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- cifsFileInfo_put(inv_file);
-- spin_lock(&cifs_file_list_lock);
- ++refind;
- inv_file = NULL;
-+ spin_lock(&tcon->open_file_lock);
- goto refind_writable;
- }
- }
-@@ -3618,15 +3628,17 @@ static int cifs_readpage(struct file *file, struct page *page)
- static int is_inode_writable(struct cifsInodeInfo *cifs_inode)
- {
- struct cifsFileInfo *open_file;
-+ struct cifs_tcon *tcon =
-+ cifs_sb_master_tcon(CIFS_SB(cifs_inode->vfs_inode.i_sb));
-
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
- if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- return 1;
- }
- }
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- return 0;
- }
-
-diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
-index 813fe13..c672915 100644
---- a/fs/cifs/misc.c
-+++ b/fs/cifs/misc.c
-@@ -120,6 +120,7 @@ tconInfoAlloc(void)
- ++ret_buf->tc_count;
- INIT_LIST_HEAD(&ret_buf->openFileList);
- INIT_LIST_HEAD(&ret_buf->tcon_list);
-+ spin_lock_init(&ret_buf->open_file_lock);
- #ifdef CONFIG_CIFS_STATS
- spin_lock_init(&ret_buf->stat_lock);
- #endif
-@@ -465,7 +466,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
- continue;
-
- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- list_for_each(tmp2, &tcon->openFileList) {
- netfile = list_entry(tmp2, struct cifsFileInfo,
- tlist);
-@@ -495,11 +496,11 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
- &netfile->oplock_break);
- netfile->oplock_break_cancelled = false;
-
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- spin_unlock(&cifs_tcp_ses_lock);
- return true;
- }
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- spin_unlock(&cifs_tcp_ses_lock);
- cifs_dbg(FYI, "No matching file for oplock break\n");
- return true;
-@@ -613,9 +614,9 @@ backup_cred(struct cifs_sb_info *cifs_sb)
- void
- cifs_del_pending_open(struct cifs_pending_open *open)
- {
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tlink_tcon(open->tlink)->open_file_lock);
- list_del(&open->olist);
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tlink_tcon(open->tlink)->open_file_lock);
- }
-
- void
-@@ -635,7 +636,7 @@ void
- cifs_add_pending_open(struct cifs_fid *fid, struct tcon_link *tlink,
- struct cifs_pending_open *open)
- {
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tlink_tcon(tlink)->open_file_lock);
- cifs_add_pending_open_locked(fid, tlink, open);
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tlink_tcon(open->tlink)->open_file_lock);
- }
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index 65cf85d..8f6a2a5 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -597,14 +597,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
- is_dir_changed(file)) || (index_to_find < first_entry_in_buffer)) {
- /* close and restart search */
- cifs_dbg(FYI, "search backing up - close and restart search\n");
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&cfile->file_info_lock);
- if (server->ops->dir_needs_close(cfile)) {
- cfile->invalidHandle = true;
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cfile->file_info_lock);
- if (server->ops->close_dir)
- server->ops->close_dir(xid, tcon, &cfile->fid);
- } else
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&cfile->file_info_lock);
- if (cfile->srch_inf.ntwrk_buf_start) {
- cifs_dbg(FYI, "freeing SMB ff cache buf on search rewind\n");
- if (cfile->srch_inf.smallBuf)
-diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
-index 0ffa180..238759c 100644
---- a/fs/cifs/smb2glob.h
-+++ b/fs/cifs/smb2glob.h
-@@ -61,4 +61,14 @@
- /* Maximum buffer size value we can send with 1 credit */
- #define SMB2_MAX_BUFFER_SIZE 65536
-
-+/*
-+ * Maximum number of credits to keep available.
-+ * This value is chosen somewhat arbitrarily. The Windows client
-+ * defaults to 128 credits, the Windows server allows clients up to
-+ * 512 credits, and the NetApp server does not limit clients at all.
-+ * Choose a high enough value such that the client shouldn't limit
-+ * performance.
-+ */
-+#define SMB2_MAX_CREDITS_AVAILABLE 32000
-+
- #endif /* _SMB2_GLOB_H */
-diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
-index 4f0231e..1238cd3 100644
---- a/fs/cifs/smb2inode.c
-+++ b/fs/cifs/smb2inode.c
-@@ -266,9 +266,15 @@ smb2_set_file_info(struct inode *inode, const char *full_path,
- struct tcon_link *tlink;
- int rc;
-
-+ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
-+ (buf->LastWriteTime == 0) && (buf->ChangeTime) &&
-+ (buf->Attributes == 0))
-+ return 0; /* would be a no op, no sense sending this */
-+
- tlink = cifs_sb_tlink(cifs_sb);
- if (IS_ERR(tlink))
- return PTR_ERR(tlink);
-+
- rc = smb2_open_op_close(xid, tlink_tcon(tlink), cifs_sb, full_path,
- FILE_WRITE_ATTRIBUTES, FILE_OPEN, 0, buf,
- SMB2_OP_SET_INFO);
-diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
-index 389fb9f..3d38348 100644
---- a/fs/cifs/smb2misc.c
-+++ b/fs/cifs/smb2misc.c
-@@ -549,19 +549,19 @@ smb2_is_valid_lease_break(char *buffer)
- list_for_each(tmp1, &server->smb_ses_list) {
- ses = list_entry(tmp1, struct cifs_ses, smb_ses_list);
-
-- spin_lock(&cifs_file_list_lock);
- list_for_each(tmp2, &ses->tcon_list) {
- tcon = list_entry(tmp2, struct cifs_tcon,
- tcon_list);
-+ spin_lock(&tcon->open_file_lock);
- cifs_stats_inc(
- &tcon->stats.cifs_stats.num_oplock_brks);
- if (smb2_tcon_has_lease(tcon, rsp, lw)) {
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- spin_unlock(&cifs_tcp_ses_lock);
- return true;
- }
-+ spin_unlock(&tcon->open_file_lock);
- }
-- spin_unlock(&cifs_file_list_lock);
- }
- }
- spin_unlock(&cifs_tcp_ses_lock);
-@@ -603,7 +603,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
- tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
-
- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
-- spin_lock(&cifs_file_list_lock);
-+ spin_lock(&tcon->open_file_lock);
- list_for_each(tmp2, &tcon->openFileList) {
- cfile = list_entry(tmp2, struct cifsFileInfo,
- tlist);
-@@ -615,7 +615,7 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
-
- cifs_dbg(FYI, "file id match, oplock break\n");
- cinode = CIFS_I(d_inode(cfile->dentry));
--
-+ spin_lock(&cfile->file_info_lock);
- if (!CIFS_CACHE_WRITE(cinode) &&
- rsp->OplockLevel == SMB2_OPLOCK_LEVEL_NONE)
- cfile->oplock_break_cancelled = true;
-@@ -637,14 +637,14 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
- clear_bit(
- CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
- &cinode->flags);
--
-+ spin_unlock(&cfile->file_info_lock);
- queue_work(cifsiod_wq, &cfile->oplock_break);
-
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- spin_unlock(&cifs_tcp_ses_lock);
- return true;
- }
-- spin_unlock(&cifs_file_list_lock);
-+ spin_unlock(&tcon->open_file_lock);
- spin_unlock(&cifs_tcp_ses_lock);
- cifs_dbg(FYI, "No matching file for oplock break\n");
- return true;
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index d203c03..0e73cef 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -287,7 +287,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
- cifs_dbg(FYI, "Link Speed %lld\n",
- le64_to_cpu(out_buf->LinkSpeed));
- }
--
-+ kfree(out_buf);
- return rc;
- }
- #endif /* STATS2 */
-@@ -541,6 +541,7 @@ smb2_set_fid(struct cifsFileInfo *cfile, struct cifs_fid *fid, __u32 oplock)
- server->ops->set_oplock_level(cinode, oplock, fid->epoch,
- &fid->purge_cache);
- cinode->can_cache_brlcks = CIFS_CACHE_WRITE(cinode);
-+ memcpy(cfile->fid.create_guid, fid->create_guid, 16);
- }
-
- static void
-@@ -699,6 +700,7 @@ smb2_clone_range(const unsigned int xid,
-
- cchunk_out:
- kfree(pcchunk);
-+ kfree(retbuf);
- return rc;
- }
-
-@@ -823,7 +825,6 @@ smb2_duplicate_extents(const unsigned int xid,
- {
- int rc;
- unsigned int ret_data_len;
-- char *retbuf = NULL;
- struct duplicate_extents_to_file dup_ext_buf;
- struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink);
-
-@@ -849,7 +850,7 @@ smb2_duplicate_extents(const unsigned int xid,
- FSCTL_DUPLICATE_EXTENTS_TO_FILE,
- true /* is_fsctl */, (char *)&dup_ext_buf,
- sizeof(struct duplicate_extents_to_file),
-- (char **)&retbuf,
-+ NULL,
- &ret_data_len);
-
- if (ret_data_len > 0)
-@@ -872,7 +873,6 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
- struct cifsFileInfo *cfile)
- {
- struct fsctl_set_integrity_information_req integr_info;
-- char *retbuf = NULL;
- unsigned int ret_data_len;
-
- integr_info.ChecksumAlgorithm = cpu_to_le16(CHECKSUM_TYPE_UNCHANGED);
-@@ -884,7 +884,7 @@ smb3_set_integrity(const unsigned int xid, struct cifs_tcon *tcon,
- FSCTL_SET_INTEGRITY_INFORMATION,
- true /* is_fsctl */, (char *)&integr_info,
- sizeof(struct fsctl_set_integrity_information_req),
-- (char **)&retbuf,
-+ NULL,
- &ret_data_len);
-
- }
-@@ -1041,7 +1041,7 @@ smb2_set_lease_key(struct inode *inode, struct cifs_fid *fid)
- static void
- smb2_new_lease_key(struct cifs_fid *fid)
- {
-- get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
-+ generate_random_uuid(fid->lease_key);
- }
-
- #define SMB2_SYMLINK_STRUCT_SIZE \
-diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
-index 29e06db..3eec96c 100644
---- a/fs/cifs/smb2pdu.c
-+++ b/fs/cifs/smb2pdu.c
-@@ -100,7 +100,21 @@ smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
- hdr->ProtocolId = SMB2_PROTO_NUMBER;
- hdr->StructureSize = cpu_to_le16(64);
- hdr->Command = smb2_cmd;
-- hdr->CreditRequest = cpu_to_le16(2); /* BB make this dynamic */
-+ if (tcon && tcon->ses && tcon->ses->server) {
-+ struct TCP_Server_Info *server = tcon->ses->server;
-+
-+ spin_lock(&server->req_lock);
-+ /* Request up to 2 credits but don't go over the limit. */
-+ if (server->credits >= SMB2_MAX_CREDITS_AVAILABLE)
-+ hdr->CreditRequest = cpu_to_le16(0);
-+ else
-+ hdr->CreditRequest = cpu_to_le16(
-+ min_t(int, SMB2_MAX_CREDITS_AVAILABLE -
-+ server->credits, 2));
-+ spin_unlock(&server->req_lock);
-+ } else {
-+ hdr->CreditRequest = cpu_to_le16(2);
-+ }
- hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
-
- if (!tcon)
-@@ -590,6 +604,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
- char *security_blob = NULL;
- unsigned char *ntlmssp_blob = NULL;
- bool use_spnego = false; /* else use raw ntlmssp */
-+ u64 previous_session = ses->Suid;
-
- cifs_dbg(FYI, "Session Setup\n");
-
-@@ -627,6 +642,10 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
- return rc;
-
- req->hdr.SessionId = 0; /* First session, not a reauthenticate */
-+
-+ /* if reconnect, we need to send previous sess id, otherwise it is 0 */
-+ req->PreviousSessionId = previous_session;
-+
- req->Flags = 0; /* MBZ */
- /* to enable echos and oplocks */
- req->hdr.CreditRequest = cpu_to_le16(3);
-@@ -1164,7 +1183,7 @@ create_durable_v2_buf(struct cifs_fid *pfid)
-
- buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
- buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
-- get_random_bytes(buf->dcontext.CreateGuid, 16);
-+ generate_random_uuid(buf->dcontext.CreateGuid);
- memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
-
- /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
-@@ -2057,6 +2076,7 @@ smb2_async_readv(struct cifs_readdata *rdata)
- if (rdata->credits) {
- buf->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
- SMB2_MAX_BUFFER_SIZE));
-+ buf->CreditRequest = buf->CreditCharge;
- spin_lock(&server->req_lock);
- server->credits += rdata->credits -
- le16_to_cpu(buf->CreditCharge);
-@@ -2243,6 +2263,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
- if (wdata->credits) {
- req->hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
- SMB2_MAX_BUFFER_SIZE));
-+ req->hdr.CreditRequest = req->hdr.CreditCharge;
- spin_lock(&server->req_lock);
- server->credits += wdata->credits -
- le16_to_cpu(req->hdr.CreditCharge);
-diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
-index ff88d9f..fd3709e 100644
---- a/fs/cifs/smb2pdu.h
-+++ b/fs/cifs/smb2pdu.h
-@@ -276,7 +276,7 @@ struct smb2_sess_setup_req {
- __le32 Channel;
- __le16 SecurityBufferOffset;
- __le16 SecurityBufferLength;
-- __le64 PreviousSessionId;
-+ __u64 PreviousSessionId;
- __u8 Buffer[1]; /* variable length GSS security buffer */
- } __packed;
-
-diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
-index c502c11..55d64fb 100644
---- a/fs/crypto/crypto.c
-+++ b/fs/crypto/crypto.c
-@@ -152,7 +152,10 @@ static int do_page_crypto(struct inode *inode,
- struct page *src_page, struct page *dest_page,
- gfp_t gfp_flags)
- {
-- u8 xts_tweak[FS_XTS_TWEAK_SIZE];
-+ struct {
-+ __le64 index;
-+ u8 padding[FS_XTS_TWEAK_SIZE - sizeof(__le64)];
-+ } xts_tweak;
- struct skcipher_request *req = NULL;
- DECLARE_FS_COMPLETION_RESULT(ecr);
- struct scatterlist dst, src;
-@@ -172,17 +175,15 @@ static int do_page_crypto(struct inode *inode,
- req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
- fscrypt_complete, &ecr);
-
-- BUILD_BUG_ON(FS_XTS_TWEAK_SIZE < sizeof(index));
-- memcpy(xts_tweak, &index, sizeof(index));
-- memset(&xts_tweak[sizeof(index)], 0,
-- FS_XTS_TWEAK_SIZE - sizeof(index));
-+ BUILD_BUG_ON(sizeof(xts_tweak) != FS_XTS_TWEAK_SIZE);
-+ xts_tweak.index = cpu_to_le64(index);
-+ memset(xts_tweak.padding, 0, sizeof(xts_tweak.padding));
-
- sg_init_table(&dst, 1);
- sg_set_page(&dst, dest_page, PAGE_SIZE, 0);
- sg_init_table(&src, 1);
- sg_set_page(&src, src_page, PAGE_SIZE, 0);
-- skcipher_request_set_crypt(req, &src, &dst, PAGE_SIZE,
-- xts_tweak);
-+ skcipher_request_set_crypt(req, &src, &dst, PAGE_SIZE, &xts_tweak);
- if (rw == FS_DECRYPT)
- res = crypto_skcipher_decrypt(req);
- else
-diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
-index ed115ac..6865663 100644
---- a/fs/crypto/policy.c
-+++ b/fs/crypto/policy.c
-@@ -109,6 +109,8 @@ int fscrypt_process_policy(struct file *filp,
- if (ret)
- return ret;
-
-+ inode_lock(inode);
-+
- if (!inode_has_encryption_context(inode)) {
- if (!S_ISDIR(inode->i_mode))
- ret = -EINVAL;
-@@ -127,6 +129,8 @@ int fscrypt_process_policy(struct file *filp,
- ret = -EINVAL;
- }
-
-+ inode_unlock(inode);
-+
- mnt_drop_write_file(filp);
- return ret;
- }
-diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
-index 73bcfd4..42145be 100644
---- a/fs/ext4/sysfs.c
-+++ b/fs/ext4/sysfs.c
-@@ -223,14 +223,18 @@ static struct attribute *ext4_attrs[] = {
- EXT4_ATTR_FEATURE(lazy_itable_init);
- EXT4_ATTR_FEATURE(batched_discard);
- EXT4_ATTR_FEATURE(meta_bg_resize);
-+#ifdef CONFIG_EXT4_FS_ENCRYPTION
- EXT4_ATTR_FEATURE(encryption);
-+#endif
- EXT4_ATTR_FEATURE(metadata_csum_seed);
-
- static struct attribute *ext4_feat_attrs[] = {
- ATTR_LIST(lazy_itable_init),
- ATTR_LIST(batched_discard),
- ATTR_LIST(meta_bg_resize),
-+#ifdef CONFIG_EXT4_FS_ENCRYPTION
- ATTR_LIST(encryption),
-+#endif
- ATTR_LIST(metadata_csum_seed),
- NULL,
- };
-diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
-index ad0c745..871c8b3 100644
---- a/fs/isofs/inode.c
-+++ b/fs/isofs/inode.c
-@@ -687,6 +687,11 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
- pri_bh = NULL;
-
- root_found:
-+ /* We don't support read-write mounts */
-+ if (!(s->s_flags & MS_RDONLY)) {
-+ error = -EACCES;
-+ goto out_freebh;
-+ }
-
- if (joliet_level && (pri == NULL || !opt.rock)) {
- /* This is the case of Joliet with the norock mount flag.
-@@ -1501,9 +1506,6 @@ struct inode *__isofs_iget(struct super_block *sb,
- static struct dentry *isofs_mount(struct file_system_type *fs_type,
- int flags, const char *dev_name, void *data)
- {
-- /* We don't support read-write mounts */
-- if (!(flags & MS_RDONLY))
-- return ERR_PTR(-EACCES);
- return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
- }
-
-diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
-index 3d8246a..e165266 100644
---- a/fs/jbd2/transaction.c
-+++ b/fs/jbd2/transaction.c
-@@ -1149,6 +1149,7 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
- JBUFFER_TRACE(jh, "file as BJ_Reserved");
- spin_lock(&journal->j_list_lock);
- __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
-+ spin_unlock(&journal->j_list_lock);
- } else if (jh->b_transaction == journal->j_committing_transaction) {
- /* first access by this transaction */
- jh->b_modified = 0;
-@@ -1156,8 +1157,8 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
- JBUFFER_TRACE(jh, "set next transaction");
- spin_lock(&journal->j_list_lock);
- jh->b_next_transaction = transaction;
-+ spin_unlock(&journal->j_list_lock);
- }
-- spin_unlock(&journal->j_list_lock);
- jbd_unlock_bh_state(bh);
-
- /*
-diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
-index 2178476..2905479 100644
---- a/fs/nfs/blocklayout/blocklayout.c
-+++ b/fs/nfs/blocklayout/blocklayout.c
-@@ -344,9 +344,10 @@ static void bl_write_cleanup(struct work_struct *work)
- u64 start = hdr->args.offset & (loff_t)PAGE_MASK;
- u64 end = (hdr->args.offset + hdr->args.count +
- PAGE_SIZE - 1) & (loff_t)PAGE_MASK;
-+ u64 lwb = hdr->args.offset + hdr->args.count;
-
- ext_tree_mark_written(bl, start >> SECTOR_SHIFT,
-- (end - start) >> SECTOR_SHIFT, end);
-+ (end - start) >> SECTOR_SHIFT, lwb);
- }
-
- pnfs_ld_write_done(hdr);
-diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
-index 322c258..b9c6542 100644
---- a/fs/nfs/delegation.c
-+++ b/fs/nfs/delegation.c
-@@ -41,6 +41,17 @@ void nfs_mark_delegation_referenced(struct nfs_delegation *delegation)
- set_bit(NFS_DELEGATION_REFERENCED, &delegation->flags);
- }
-
-+static bool
-+nfs4_is_valid_delegation(const struct nfs_delegation *delegation,
-+ fmode_t flags)
-+{
-+ if (delegation != NULL && (delegation->type & flags) == flags &&
-+ !test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) &&
-+ !test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
-+ return true;
-+ return false;
-+}
-+
- static int
- nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
- {
-@@ -50,8 +61,7 @@ nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
- flags &= FMODE_READ|FMODE_WRITE;
- rcu_read_lock();
- delegation = rcu_dereference(NFS_I(inode)->delegation);
-- if (delegation != NULL && (delegation->type & flags) == flags &&
-- !test_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) {
-+ if (nfs4_is_valid_delegation(delegation, flags)) {
- if (mark)
- nfs_mark_delegation_referenced(delegation);
- ret = 1;
-@@ -893,7 +903,7 @@ bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags,
- flags &= FMODE_READ|FMODE_WRITE;
- rcu_read_lock();
- delegation = rcu_dereference(nfsi->delegation);
-- ret = (delegation != NULL && (delegation->type & flags) == flags);
-+ ret = nfs4_is_valid_delegation(delegation, flags);
- if (ret) {
- nfs4_stateid_copy(dst, &delegation->stateid);
- nfs_mark_delegation_referenced(delegation);
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 177fefb..6bc5a68 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -435,11 +435,11 @@ int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
- return 0;
-
- nfsi = NFS_I(inode);
-- if (entry->fattr->fileid == nfsi->fileid)
-- return 1;
-- if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
-- return 1;
-- return 0;
-+ if (entry->fattr->fileid != nfsi->fileid)
-+ return 0;
-+ if (entry->fh->size && nfs_compare_fh(entry->fh, &nfsi->fh) != 0)
-+ return 0;
-+ return 1;
- }
-
- static
-@@ -517,6 +517,8 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
- &entry->fattr->fsid))
- goto out;
- if (nfs_same_file(dentry, entry)) {
-+ if (!entry->fh->size)
-+ goto out;
- nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
- status = nfs_refresh_inode(d_inode(dentry), entry->fattr);
- if (!status)
-@@ -529,6 +531,10 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
- goto again;
- }
- }
-+ if (!entry->fh->size) {
-+ d_lookup_done(dentry);
-+ goto out;
-+ }
-
- inode = nfs_fhget(dentry->d_sb, entry->fh, entry->fattr, entry->label);
- alias = d_splice_alias(inode, dentry);
-diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
-index 64b43b4..6085019 100644
---- a/fs/nfs/nfs42proc.c
-+++ b/fs/nfs/nfs42proc.c
-@@ -443,6 +443,7 @@ int nfs42_proc_layoutstats_generic(struct nfs_server *server,
- task = rpc_run_task(&task_setup);
- if (IS_ERR(task))
- return PTR_ERR(task);
-+ rpc_put_task(task);
- return 0;
- }
-
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index cada00a..8353f33f 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1498,6 +1498,9 @@ static int nfs4_reclaim_open_state(struct nfs4_state_owner *sp, const struct nfs
- __func__, status);
- case -ENOENT:
- case -ENOMEM:
-+ case -EACCES:
-+ case -EROFS:
-+ case -EIO:
- case -ESTALE:
- /* Open state on this file cannot be recovered */
- nfs4_state_mark_recovery_failed(state, status);
-diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
-index 45007ac..a2b65fc 100644
---- a/fs/nfsd/nfssvc.c
-+++ b/fs/nfsd/nfssvc.c
-@@ -366,14 +366,21 @@ static struct notifier_block nfsd_inet6addr_notifier = {
- };
- #endif
-
-+/* Only used under nfsd_mutex, so this atomic may be overkill: */
-+static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0);
-+
- static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
- {
- struct nfsd_net *nn = net_generic(net, nfsd_net_id);
-
-- unregister_inetaddr_notifier(&nfsd_inetaddr_notifier);
-+ /* check if the notifier still has clients */
-+ if (atomic_dec_return(&nfsd_notifier_refcount) == 0) {
-+ unregister_inetaddr_notifier(&nfsd_inetaddr_notifier);
- #if IS_ENABLED(CONFIG_IPV6)
-- unregister_inet6addr_notifier(&nfsd_inet6addr_notifier);
-+ unregister_inet6addr_notifier(&nfsd_inet6addr_notifier);
- #endif
-+ }
-+
- /*
- * write_ports can create the server without actually starting
- * any threads--if we get shut down before any threads are
-@@ -488,10 +495,13 @@ int nfsd_create_serv(struct net *net)
- }
-
- set_max_drc();
-- register_inetaddr_notifier(&nfsd_inetaddr_notifier);
-+ /* check if the notifier is already set */
-+ if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
-+ register_inetaddr_notifier(&nfsd_inetaddr_notifier);
- #if IS_ENABLED(CONFIG_IPV6)
-- register_inet6addr_notifier(&nfsd_inet6addr_notifier);
-+ register_inet6addr_notifier(&nfsd_inet6addr_notifier);
- #endif
-+ }
- do_gettimeofday(&nn->nfssvc_boot); /* record boot time */
- return 0;
- }
-diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
-index 43fdc27..abadbc3 100644
---- a/fs/overlayfs/copy_up.c
-+++ b/fs/overlayfs/copy_up.c
-@@ -57,6 +57,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
- ssize_t list_size, size, value_size = 0;
- char *buf, *name, *value = NULL;
- int uninitialized_var(error);
-+ size_t slen;
-
- if (!old->d_inode->i_op->getxattr ||
- !new->d_inode->i_op->getxattr)
-@@ -79,7 +80,16 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
- goto out;
- }
-
-- for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
-+ for (name = buf; list_size; name += slen) {
-+ slen = strnlen(name, list_size) + 1;
-+
-+ /* underlying fs providing us with an broken xattr list? */
-+ if (WARN_ON(slen > list_size)) {
-+ error = -EIO;
-+ break;
-+ }
-+ list_size -= slen;
-+
- if (ovl_is_private_xattr(name))
- continue;
- retry:
-diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
-index 1560fdc..74e6964 100644
---- a/fs/overlayfs/dir.c
-+++ b/fs/overlayfs/dir.c
-@@ -14,6 +14,7 @@
- #include <linux/cred.h>
- #include <linux/posix_acl.h>
- #include <linux/posix_acl_xattr.h>
-+#include <linux/atomic.h>
- #include "overlayfs.h"
-
- void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
-@@ -37,8 +38,10 @@ struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry)
- {
- struct dentry *temp;
- char name[20];
-+ static atomic_t temp_id = ATOMIC_INIT(0);
-
-- snprintf(name, sizeof(name), "#%lx", (unsigned long) dentry);
-+ /* counter is allowed to wrap, since temp dentries are ephemeral */
-+ snprintf(name, sizeof(name), "#%x", atomic_inc_return(&temp_id));
-
- temp = lookup_one_len(name, workdir, strlen(name));
- if (!IS_ERR(temp) && temp->d_inode) {
-diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
-index 7a034d6..2340262 100644
---- a/fs/pstore/ram.c
-+++ b/fs/pstore/ram.c
-@@ -377,13 +377,14 @@ static void ramoops_free_przs(struct ramoops_context *cxt)
- {
- int i;
-
-- cxt->max_dump_cnt = 0;
- if (!cxt->przs)
- return;
-
-- for (i = 0; !IS_ERR_OR_NULL(cxt->przs[i]); i++)
-+ for (i = 0; i < cxt->max_dump_cnt; i++)
- persistent_ram_free(cxt->przs[i]);
-+
- kfree(cxt->przs);
-+ cxt->max_dump_cnt = 0;
- }
-
- static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
-@@ -408,7 +409,7 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
- GFP_KERNEL);
- if (!cxt->przs) {
- dev_err(dev, "failed to initialize a prz array for dumps\n");
-- goto fail_prz;
-+ goto fail_mem;
- }
-
- for (i = 0; i < cxt->max_dump_cnt; i++) {
-@@ -419,6 +420,11 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
- err = PTR_ERR(cxt->przs[i]);
- dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
- cxt->record_size, (unsigned long long)*paddr, err);
-+
-+ while (i > 0) {
-+ i--;
-+ persistent_ram_free(cxt->przs[i]);
-+ }
- goto fail_prz;
- }
- *paddr += cxt->record_size;
-@@ -426,7 +432,9 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
-
- return 0;
- fail_prz:
-- ramoops_free_przs(cxt);
-+ kfree(cxt->przs);
-+fail_mem:
-+ cxt->max_dump_cnt = 0;
- return err;
- }
-
-@@ -659,7 +667,6 @@ static int ramoops_remove(struct platform_device *pdev)
- struct ramoops_context *cxt = &oops_cxt;
-
- pstore_unregister(&cxt->pstore);
-- cxt->max_dump_cnt = 0;
-
- kfree(cxt->pstore.buf);
- cxt->pstore.bufsize = 0;
-diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
-index 76c3f80..364d2df 100644
---- a/fs/pstore/ram_core.c
-+++ b/fs/pstore/ram_core.c
-@@ -47,43 +47,10 @@ static inline size_t buffer_start(struct persistent_ram_zone *prz)
- return atomic_read(&prz->buffer->start);
- }
-
--/* increase and wrap the start pointer, returning the old value */
--static size_t buffer_start_add_atomic(struct persistent_ram_zone *prz, size_t a)
--{
-- int old;
-- int new;
--
-- do {
-- old = atomic_read(&prz->buffer->start);
-- new = old + a;
-- while (unlikely(new >= prz->buffer_size))
-- new -= prz->buffer_size;
-- } while (atomic_cmpxchg(&prz->buffer->start, old, new) != old);
--
-- return old;
--}
--
--/* increase the size counter until it hits the max size */
--static void buffer_size_add_atomic(struct persistent_ram_zone *prz, size_t a)
--{
-- size_t old;
-- size_t new;
--
-- if (atomic_read(&prz->buffer->size) == prz->buffer_size)
-- return;
--
-- do {
-- old = atomic_read(&prz->buffer->size);
-- new = old + a;
-- if (new > prz->buffer_size)
-- new = prz->buffer_size;
-- } while (atomic_cmpxchg(&prz->buffer->size, old, new) != old);
--}
--
- static DEFINE_RAW_SPINLOCK(buffer_lock);
-
- /* increase and wrap the start pointer, returning the old value */
--static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
-+static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a)
- {
- int old;
- int new;
-@@ -103,7 +70,7 @@ static size_t buffer_start_add_locked(struct persistent_ram_zone *prz, size_t a)
- }
-
- /* increase the size counter until it hits the max size */
--static void buffer_size_add_locked(struct persistent_ram_zone *prz, size_t a)
-+static void buffer_size_add(struct persistent_ram_zone *prz, size_t a)
- {
- size_t old;
- size_t new;
-@@ -124,9 +91,6 @@ static void buffer_size_add_locked(struct persistent_ram_zone *prz, size_t a)
- raw_spin_unlock_irqrestore(&buffer_lock, flags);
- }
-
--static size_t (*buffer_start_add)(struct persistent_ram_zone *, size_t) = buffer_start_add_atomic;
--static void (*buffer_size_add)(struct persistent_ram_zone *, size_t) = buffer_size_add_atomic;
--
- static void notrace persistent_ram_encode_rs8(struct persistent_ram_zone *prz,
- uint8_t *data, size_t len, uint8_t *ecc)
- {
-@@ -299,7 +263,7 @@ static void notrace persistent_ram_update(struct persistent_ram_zone *prz,
- const void *s, unsigned int start, unsigned int count)
- {
- struct persistent_ram_buffer *buffer = prz->buffer;
-- memcpy(buffer->data + start, s, count);
-+ memcpy_toio(buffer->data + start, s, count);
- persistent_ram_update_ecc(prz, start, count);
- }
-
-@@ -322,8 +286,8 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz)
- }
-
- prz->old_log_size = size;
-- memcpy(prz->old_log, &buffer->data[start], size - start);
-- memcpy(prz->old_log + size - start, &buffer->data[0], start);
-+ memcpy_fromio(prz->old_log, &buffer->data[start], size - start);
-+ memcpy_fromio(prz->old_log + size - start, &buffer->data[0], start);
- }
-
- int notrace persistent_ram_write(struct persistent_ram_zone *prz,
-@@ -426,9 +390,6 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
- return NULL;
- }
-
-- buffer_start_add = buffer_start_add_locked;
-- buffer_size_add = buffer_size_add_locked;
--
- if (memtype)
- va = ioremap(start, size);
- else
-diff --git a/fs/super.c b/fs/super.c
-index c2ff475..47d11e0 100644
---- a/fs/super.c
-+++ b/fs/super.c
-@@ -1379,8 +1379,8 @@ int freeze_super(struct super_block *sb)
- }
- }
- /*
-- * This is just for debugging purposes so that fs can warn if it
-- * sees write activity when frozen is set to SB_FREEZE_COMPLETE.
-+ * For debugging purposes so that fs can warn if it sees write activity
-+ * when frozen is set to SB_FREEZE_COMPLETE, and for thaw_super().
- */
- sb->s_writers.frozen = SB_FREEZE_COMPLETE;
- up_write(&sb->s_umount);
-@@ -1399,7 +1399,7 @@ int thaw_super(struct super_block *sb)
- int error;
-
- down_write(&sb->s_umount);
-- if (sb->s_writers.frozen == SB_UNFROZEN) {
-+ if (sb->s_writers.frozen != SB_FREEZE_COMPLETE) {
- up_write(&sb->s_umount);
- return -EINVAL;
- }
-diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
-index 11a0041..c9ee6f6 100644
---- a/fs/ubifs/xattr.c
-+++ b/fs/ubifs/xattr.c
-@@ -172,6 +172,7 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
- host_ui->xattr_cnt -= 1;
- host_ui->xattr_size -= CALC_DENT_SIZE(nm->len);
- host_ui->xattr_size -= CALC_XATTR_BYTES(size);
-+ host_ui->xattr_names -= nm->len;
- mutex_unlock(&host_ui->ui_mutex);
- out_free:
- make_bad_inode(inode);
-@@ -476,6 +477,7 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
- host_ui->xattr_cnt += 1;
- host_ui->xattr_size += CALC_DENT_SIZE(nm->len);
- host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
-+ host_ui->xattr_names += nm->len;
- mutex_unlock(&host_ui->ui_mutex);
- ubifs_release_budget(c, &req);
- make_bad_inode(inode);
-diff --git a/include/dt-bindings/clock/imx6qdl-clock.h b/include/dt-bindings/clock/imx6qdl-clock.h
-index 2905033..da59fd9 100644
---- a/include/dt-bindings/clock/imx6qdl-clock.h
-+++ b/include/dt-bindings/clock/imx6qdl-clock.h
-@@ -269,6 +269,8 @@
- #define IMX6QDL_CLK_PRG0_APB 256
- #define IMX6QDL_CLK_PRG1_APB 257
- #define IMX6QDL_CLK_PRE_AXI 258
--#define IMX6QDL_CLK_END 259
-+#define IMX6QDL_CLK_MLB_SEL 259
-+#define IMX6QDL_CLK_MLB_PODF 260
-+#define IMX6QDL_CLK_END 261
-
- #endif /* __DT_BINDINGS_CLOCK_IMX6QDL_H */
-diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
-index 631ba33b..32dc0cbd 100644
---- a/include/linux/cpufreq.h
-+++ b/include/linux/cpufreq.h
-@@ -639,19 +639,19 @@ static inline int cpufreq_table_find_index_al(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq >= target_freq)
-- return i;
-+ return pos - table;
-
-- best = i;
-+ best = pos;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Find lowest freq at or above target in a table in descending order */
-@@ -659,28 +659,28 @@ static inline int cpufreq_table_find_index_dl(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq == target_freq)
-- return i;
-+ return pos - table;
-
- if (freq > target_freq) {
-- best = i;
-+ best = pos;
- continue;
- }
-
- /* No freq found above target_freq */
-- if (best == -1)
-- return i;
-+ if (best == table - 1)
-+ return pos - table;
-
-- return best;
-+ return best - table;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Works only on sorted freq-tables */
-@@ -700,28 +700,28 @@ static inline int cpufreq_table_find_index_ah(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq == target_freq)
-- return i;
-+ return pos - table;
-
- if (freq < target_freq) {
-- best = i;
-+ best = pos;
- continue;
- }
-
- /* No freq found below target_freq */
-- if (best == -1)
-- return i;
-+ if (best == table - 1)
-+ return pos - table;
-
-- return best;
-+ return best - table;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Find highest freq at or below target in a table in descending order */
-@@ -729,19 +729,19 @@ static inline int cpufreq_table_find_index_dh(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq <= target_freq)
-- return i;
-+ return pos - table;
-
-- best = i;
-+ best = pos;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Works only on sorted freq-tables */
-@@ -761,32 +761,32 @@ static inline int cpufreq_table_find_index_ac(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq == target_freq)
-- return i;
-+ return pos - table;
-
- if (freq < target_freq) {
-- best = i;
-+ best = pos;
- continue;
- }
-
- /* No freq found below target_freq */
-- if (best == -1)
-- return i;
-+ if (best == table - 1)
-+ return pos - table;
-
- /* Choose the closest freq */
-- if (target_freq - table[best].frequency > freq - target_freq)
-- return i;
-+ if (target_freq - best->frequency > freq - target_freq)
-+ return pos - table;
-
-- return best;
-+ return best - table;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Find closest freq to target in a table in descending order */
-@@ -794,32 +794,32 @@ static inline int cpufreq_table_find_index_dc(struct cpufreq_policy *policy,
- unsigned int target_freq)
- {
- struct cpufreq_frequency_table *table = policy->freq_table;
-+ struct cpufreq_frequency_table *pos, *best = table - 1;
- unsigned int freq;
-- int i, best = -1;
-
-- for (i = 0; table[i].frequency != CPUFREQ_TABLE_END; i++) {
-- freq = table[i].frequency;
-+ cpufreq_for_each_valid_entry(pos, table) {
-+ freq = pos->frequency;
-
- if (freq == target_freq)
-- return i;
-+ return pos - table;
-
- if (freq > target_freq) {
-- best = i;
-+ best = pos;
- continue;
- }
-
- /* No freq found above target_freq */
-- if (best == -1)
-- return i;
-+ if (best == table - 1)
-+ return pos - table;
-
- /* Choose the closest freq */
-- if (table[best].frequency - target_freq > target_freq - freq)
-- return i;
-+ if (best->frequency - target_freq > target_freq - freq)
-+ return pos - table;
-
-- return best;
-+ return best - table;
- }
-
-- return best;
-+ return best - table;
- }
-
- /* Works only on sorted freq-tables */
-diff --git a/include/linux/devfreq-event.h b/include/linux/devfreq-event.h
-index 0a83a1e..4db00b0 100644
---- a/include/linux/devfreq-event.h
-+++ b/include/linux/devfreq-event.h
-@@ -148,11 +148,6 @@ static inline int devfreq_event_reset_event(struct devfreq_event_dev *edev)
- return -EINVAL;
- }
-
--static inline void *devfreq_event_get_drvdata(struct devfreq_event_dev *edev)
--{
-- return ERR_PTR(-EINVAL);
--}
--
- static inline struct devfreq_event_dev *devfreq_event_get_edev_by_phandle(
- struct device *dev, int index)
- {
-diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
-index 99ac022..3a8610e 100644
---- a/include/linux/irqchip/arm-gic-v3.h
-+++ b/include/linux/irqchip/arm-gic-v3.h
-@@ -290,7 +290,7 @@
- #define GITS_BASER_TYPE_SHIFT (56)
- #define GITS_BASER_TYPE(r) (((r) >> GITS_BASER_TYPE_SHIFT) & 7)
- #define GITS_BASER_ENTRY_SIZE_SHIFT (48)
--#define GITS_BASER_ENTRY_SIZE(r) ((((r) >> GITS_BASER_ENTRY_SIZE_SHIFT) & 0xff) + 1)
-+#define GITS_BASER_ENTRY_SIZE(r) ((((r) >> GITS_BASER_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
- #define GITS_BASER_SHAREABILITY_SHIFT (10)
- #define GITS_BASER_InnerShareable \
- GIC_BASER_SHAREABILITY(GITS_BASER, InnerShareable)
-diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index fb8e3b6..c211900 100644
---- a/include/target/target_core_base.h
-+++ b/include/target/target_core_base.h
-@@ -177,6 +177,7 @@ enum tcm_sense_reason_table {
- TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED = R(0x15),
- TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED = R(0x16),
- TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED = R(0x17),
-+ TCM_COPY_TARGET_DEVICE_NOT_REACHABLE = R(0x18),
- #undef R
- };
-
-diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
-index 039de34..8b3610c 100644
---- a/kernel/sched/fair.c
-+++ b/kernel/sched/fair.c
-@@ -456,17 +456,23 @@ static inline int entity_before(struct sched_entity *a,
-
- static void update_min_vruntime(struct cfs_rq *cfs_rq)
- {
-+ struct sched_entity *curr = cfs_rq->curr;
-+
- u64 vruntime = cfs_rq->min_vruntime;
-
-- if (cfs_rq->curr)
-- vruntime = cfs_rq->curr->vruntime;
-+ if (curr) {
-+ if (curr->on_rq)
-+ vruntime = curr->vruntime;
-+ else
-+ curr = NULL;
-+ }
-
- if (cfs_rq->rb_leftmost) {
- struct sched_entity *se = rb_entry(cfs_rq->rb_leftmost,
- struct sched_entity,
- run_node);
-
-- if (!cfs_rq->curr)
-+ if (!curr)
- vruntime = se->vruntime;
- else
- vruntime = min_vruntime(vruntime, se->vruntime);
-@@ -680,7 +686,14 @@ void init_entity_runnable_average(struct sched_entity *se)
- * will definitely be update (after enqueue).
- */
- sa->period_contrib = 1023;
-- sa->load_avg = scale_load_down(se->load.weight);
-+ /*
-+ * Tasks are intialized with full load to be seen as heavy tasks until
-+ * they get a chance to stabilize to their real load level.
-+ * Group entities are intialized with zero load to reflect the fact that
-+ * nothing has been attached to the task group yet.
-+ */
-+ if (entity_is_task(se))
-+ sa->load_avg = scale_load_down(se->load.weight);
- sa->load_sum = sa->load_avg * LOAD_AVG_MAX;
- /*
- * At this point, util_avg won't be used in select_task_rq_fair anyway
-@@ -3459,9 +3472,10 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
- account_entity_dequeue(cfs_rq, se);
-
- /*
-- * Normalize the entity after updating the min_vruntime because the
-- * update can refer to the ->curr item and we need to reflect this
-- * movement in our normalized position.
-+ * Normalize after update_curr(); which will also have moved
-+ * min_vruntime if @se is the one holding it back. But before doing
-+ * update_min_vruntime() again, which will discount @se's position and
-+ * can move min_vruntime forward still more.
- */
- if (!(flags & DEQUEUE_SLEEP))
- se->vruntime -= cfs_rq->min_vruntime;
-@@ -3469,8 +3483,16 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
- /* return excess runtime on last dequeue */
- return_cfs_rq_runtime(cfs_rq);
-
-- update_min_vruntime(cfs_rq);
- update_cfs_shares(cfs_rq);
-+
-+ /*
-+ * Now advance min_vruntime if @se was the entity holding it back,
-+ * except when: DEQUEUE_SAVE && !DEQUEUE_MOVE, in this case we'll be
-+ * put back on, and if we advance min_vruntime, we'll be placed back
-+ * further than we started -- ie. we'll be penalized.
-+ */
-+ if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) == DEQUEUE_SAVE)
-+ update_min_vruntime(cfs_rq);
- }
-
- /*
-diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
-index bf16883..e72581d 100644
---- a/net/sunrpc/xprtsock.c
-+++ b/net/sunrpc/xprtsock.c
-@@ -473,7 +473,16 @@ static int xs_nospace(struct rpc_task *task)
- spin_unlock_bh(&xprt->transport_lock);
-
- /* Race breaker in case memory is freed before above code is called */
-- sk->sk_write_space(sk);
-+ if (ret == -EAGAIN) {
-+ struct socket_wq *wq;
-+
-+ rcu_read_lock();
-+ wq = rcu_dereference(sk->sk_wq);
-+ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags);
-+ rcu_read_unlock();
-+
-+ sk->sk_write_space(sk);
-+ }
- return ret;
- }
-
-diff --git a/sound/pci/hda/dell_wmi_helper.c b/sound/pci/hda/dell_wmi_helper.c
-index 9c22f95..19d41da 100644
---- a/sound/pci/hda/dell_wmi_helper.c
-+++ b/sound/pci/hda/dell_wmi_helper.c
-@@ -49,7 +49,7 @@ static void alc_fixup_dell_wmi(struct hda_codec *codec,
- removefunc = true;
- if (dell_led_set_func(DELL_LED_MICMUTE, false) >= 0) {
- dell_led_value = 0;
-- if (spec->gen.num_adc_nids > 1)
-+ if (spec->gen.num_adc_nids > 1 && !spec->gen.dyn_adc_switch)
- codec_dbg(codec, "Skipping micmute LED control due to several ADCs");
- else {
- dell_old_cap_hook = spec->gen.cap_sync_hook;
-diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
-index f0955fd..6a23302 100644
---- a/sound/pci/hda/thinkpad_helper.c
-+++ b/sound/pci/hda/thinkpad_helper.c
-@@ -62,7 +62,7 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
- removefunc = false;
- }
- if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
-- if (spec->num_adc_nids > 1)
-+ if (spec->num_adc_nids > 1 && !spec->dyn_adc_switch)
- codec_dbg(codec,
- "Skipping micmute LED control due to several ADCs");
- else {
-diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
-index 8ff6c6a..c9c8dc3 100644
---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
-+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
-@@ -89,6 +89,7 @@ struct intel_pt_decoder {
- bool pge;
- bool have_tma;
- bool have_cyc;
-+ bool fixup_last_mtc;
- uint64_t pos;
- uint64_t last_ip;
- uint64_t ip;
-@@ -584,10 +585,31 @@ struct intel_pt_calc_cyc_to_tsc_info {
- uint64_t tsc_timestamp;
- uint64_t timestamp;
- bool have_tma;
-+ bool fixup_last_mtc;
- bool from_mtc;
- double cbr_cyc_to_tsc;
- };
-
-+/*
-+ * MTC provides a 8-bit slice of CTC but the TMA packet only provides the lower
-+ * 16 bits of CTC. If mtc_shift > 8 then some of the MTC bits are not in the CTC
-+ * provided by the TMA packet. Fix-up the last_mtc calculated from the TMA
-+ * packet by copying the missing bits from the current MTC assuming the least
-+ * difference between the two, and that the current MTC comes after last_mtc.
-+ */
-+static void intel_pt_fixup_last_mtc(uint32_t mtc, int mtc_shift,
-+ uint32_t *last_mtc)
-+{
-+ uint32_t first_missing_bit = 1U << (16 - mtc_shift);
-+ uint32_t mask = ~(first_missing_bit - 1);
-+
-+ *last_mtc |= mtc & mask;
-+ if (*last_mtc >= mtc) {
-+ *last_mtc -= first_missing_bit;
-+ *last_mtc &= 0xff;
-+ }
-+}
-+
- static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
- {
- struct intel_pt_decoder *decoder = pkt_info->decoder;
-@@ -617,6 +639,11 @@ static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
- return 0;
-
- mtc = pkt_info->packet.payload;
-+ if (decoder->mtc_shift > 8 && data->fixup_last_mtc) {
-+ data->fixup_last_mtc = false;
-+ intel_pt_fixup_last_mtc(mtc, decoder->mtc_shift,
-+ &data->last_mtc);
-+ }
- if (mtc > data->last_mtc)
- mtc_delta = mtc - data->last_mtc;
- else
-@@ -685,6 +712,7 @@ static int intel_pt_calc_cyc_cb(struct intel_pt_pkt_info *pkt_info)
-
- data->ctc_delta = 0;
- data->have_tma = true;
-+ data->fixup_last_mtc = true;
-
- return 0;
-
-@@ -751,6 +779,7 @@ static void intel_pt_calc_cyc_to_tsc(struct intel_pt_decoder *decoder,
- .tsc_timestamp = decoder->tsc_timestamp,
- .timestamp = decoder->timestamp,
- .have_tma = decoder->have_tma,
-+ .fixup_last_mtc = decoder->fixup_last_mtc,
- .from_mtc = from_mtc,
- .cbr_cyc_to_tsc = 0,
- };
-@@ -1241,6 +1270,7 @@ static void intel_pt_calc_tma(struct intel_pt_decoder *decoder)
- }
- decoder->ctc_delta = 0;
- decoder->have_tma = true;
-+ decoder->fixup_last_mtc = true;
- intel_pt_log("CTC timestamp " x64_fmt " last MTC %#x CTC rem %#x\n",
- decoder->ctc_timestamp, decoder->last_mtc, ctc_rem);
- }
-@@ -1255,6 +1285,12 @@ static void intel_pt_calc_mtc_timestamp(struct intel_pt_decoder *decoder)
-
- mtc = decoder->packet.payload;
-
-+ if (decoder->mtc_shift > 8 && decoder->fixup_last_mtc) {
-+ decoder->fixup_last_mtc = false;
-+ intel_pt_fixup_last_mtc(mtc, decoder->mtc_shift,
-+ &decoder->last_mtc);
-+ }
-+
- if (mtc > decoder->last_mtc)
- mtc_delta = mtc - decoder->last_mtc;
- else
-@@ -1323,6 +1359,8 @@ static void intel_pt_calc_cyc_timestamp(struct intel_pt_decoder *decoder)
- timestamp, decoder->timestamp);
- else
- decoder->timestamp = timestamp;
-+
-+ decoder->timestamp_insn_cnt = 0;
- }
-
- /* Walk PSB+ packets when already in sync. */
-diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
-index 551ff6f..b2878d2 100644
---- a/tools/perf/util/intel-pt.c
-+++ b/tools/perf/util/intel-pt.c
-@@ -241,7 +241,7 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
- }
-
- queue = &ptq->pt->queues.queue_array[ptq->queue_nr];
--
-+next:
- buffer = auxtrace_buffer__next(queue, buffer);
- if (!buffer) {
- if (old_buffer)
-@@ -264,9 +264,6 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
- intel_pt_do_fix_overlap(ptq->pt, old_buffer, buffer))
- return -ENOMEM;
-
-- if (old_buffer)
-- auxtrace_buffer__drop_data(old_buffer);
--
- if (buffer->use_data) {
- b->len = buffer->use_size;
- b->buf = buffer->use_data;
-@@ -276,6 +273,16 @@ static int intel_pt_get_trace(struct intel_pt_buffer *b, void *data)
- }
- b->ref_timestamp = buffer->reference;
-
-+ /*
-+ * If in snapshot mode and the buffer has no usable data, get next
-+ * buffer and again check overlap against old_buffer.
-+ */
-+ if (ptq->pt->snapshot_mode && !b->len)
-+ goto next;
-+
-+ if (old_buffer)
-+ auxtrace_buffer__drop_data(old_buffer);
-+
- if (!old_buffer || ptq->pt->sampling_mode || (ptq->pt->snapshot_mode &&
- !buffer->consecutive)) {
- b->consecutive = false;
-diff --git a/tools/spi/spidev_test.c b/tools/spi/spidev_test.c
-index 8a73d81..f3825b6 100644
---- a/tools/spi/spidev_test.c
-+++ b/tools/spi/spidev_test.c
-@@ -284,7 +284,7 @@ static void parse_opts(int argc, char *argv[])
-
- static void transfer_escaped_string(int fd, char *str)
- {
-- size_t size = strlen(str + 1);
-+ size_t size = strlen(str);
- uint8_t *tx;
- uint8_t *rx;
-
diff --git a/4.8.7/1005_linux-4.8.6.patch b/4.8.7/1005_linux-4.8.6.patch
deleted file mode 100644
index 641ba27..0000000
--- a/4.8.7/1005_linux-4.8.6.patch
+++ /dev/null
@@ -1,5137 +0,0 @@
-diff --git a/Makefile b/Makefile
-index daa3a01..b249529 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 5
-+SUBLEVEL = 6
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
-index 1c6a040..e2e9599 100644
---- a/arch/arm/boot/dts/arm-realview-eb.dtsi
-+++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
-@@ -51,14 +51,6 @@
- regulator-boot-on;
- };
-
-- veth: fixedregulator@0 {
-- compatible = "regulator-fixed";
-- regulator-name = "veth";
-- regulator-min-microvolt = <3300000>;
-- regulator-max-microvolt = <3300000>;
-- regulator-boot-on;
-- };
--
- xtal24mhz: xtal24mhz@24M {
- #clock-cells = <0>;
- compatible = "fixed-clock";
-@@ -134,16 +126,15 @@
- bank-width = <4>;
- };
-
-- /* SMSC 9118 ethernet with PHY and EEPROM */
-+ /* SMSC LAN91C111 ethernet with PHY and EEPROM */
- ethernet: ethernet@4e000000 {
-- compatible = "smsc,lan9118", "smsc,lan9115";
-+ compatible = "smsc,lan91c111";
- reg = <0x4e000000 0x10000>;
-- phy-mode = "mii";
-- reg-io-width = <4>;
-- smsc,irq-active-high;
-- smsc,irq-push-pull;
-- vdd33a-supply = <&veth>;
-- vddvario-supply = <&veth>;
-+ /*
-+ * This means the adapter can be accessed with 8, 16 or
-+ * 32 bit reads/writes.
-+ */
-+ reg-io-width = <7>;
- };
-
- usb: usb@4f000000 {
-diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
-index 03b8bbe..652418a 100644
---- a/arch/arm/boot/dts/bcm958625hr.dts
-+++ b/arch/arm/boot/dts/bcm958625hr.dts
-@@ -47,7 +47,8 @@
- };
-
- memory {
-- reg = <0x60000000 0x20000000>;
-+ device_type = "memory";
-+ reg = <0x60000000 0x80000000>;
- };
- };
-
-diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
-index ca86da6..854117d 100644
---- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
-+++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
-@@ -119,7 +119,7 @@
- pinctrl-names = "default";
- pinctrl-0 = <&mcspi1_pins>;
-
-- lcd0: display {
-+ lcd0: display@1 {
- compatible = "lgphilips,lb035q02";
- label = "lcd35";
-
-diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
-index f68b324..3f528a3 100644
---- a/arch/arm/boot/dts/sun9i-a80.dtsi
-+++ b/arch/arm/boot/dts/sun9i-a80.dtsi
-@@ -899,8 +899,7 @@
- resets = <&apbs_rst 0>;
- gpio-controller;
- interrupt-controller;
-- #address-cells = <1>;
-- #size-cells = <0>;
-+ #interrupt-cells = <3>;
- #gpio-cells = <3>;
-
- r_ir_pins: r_ir {
-diff --git a/arch/arm/crypto/ghash-ce-glue.c b/arch/arm/crypto/ghash-ce-glue.c
-index 1568cb5..b88364a 100644
---- a/arch/arm/crypto/ghash-ce-glue.c
-+++ b/arch/arm/crypto/ghash-ce-glue.c
-@@ -220,6 +220,27 @@ static int ghash_async_digest(struct ahash_request *req)
- }
- }
-
-+static int ghash_async_import(struct ahash_request *req, const void *in)
-+{
-+ struct ahash_request *cryptd_req = ahash_request_ctx(req);
-+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
-+ struct ghash_async_ctx *ctx = crypto_ahash_ctx(tfm);
-+ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
-+
-+ desc->tfm = cryptd_ahash_child(ctx->cryptd_tfm);
-+ desc->flags = req->base.flags;
-+
-+ return crypto_shash_import(desc, in);
-+}
-+
-+static int ghash_async_export(struct ahash_request *req, void *out)
-+{
-+ struct ahash_request *cryptd_req = ahash_request_ctx(req);
-+ struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
-+
-+ return crypto_shash_export(desc, out);
-+}
-+
- static int ghash_async_setkey(struct crypto_ahash *tfm, const u8 *key,
- unsigned int keylen)
- {
-@@ -268,7 +289,10 @@ static struct ahash_alg ghash_async_alg = {
- .final = ghash_async_final,
- .setkey = ghash_async_setkey,
- .digest = ghash_async_digest,
-+ .import = ghash_async_import,
-+ .export = ghash_async_export,
- .halg.digestsize = GHASH_DIGEST_SIZE,
-+ .halg.statesize = sizeof(struct ghash_desc_ctx),
- .halg.base = {
- .cra_name = "ghash",
- .cra_driver_name = "ghash-ce",
-diff --git a/arch/arm/mach-pxa/corgi_pm.c b/arch/arm/mach-pxa/corgi_pm.c
-index d920681..c71c483 100644
---- a/arch/arm/mach-pxa/corgi_pm.c
-+++ b/arch/arm/mach-pxa/corgi_pm.c
-@@ -131,16 +131,11 @@ static int corgi_should_wakeup(unsigned int resume_on_alarm)
- return is_resume;
- }
-
--static unsigned long corgi_charger_wakeup(void)
-+static bool corgi_charger_wakeup(void)
- {
-- unsigned long ret;
--
-- ret = (!gpio_get_value(CORGI_GPIO_AC_IN) << GPIO_bit(CORGI_GPIO_AC_IN))
-- | (!gpio_get_value(CORGI_GPIO_KEY_INT)
-- << GPIO_bit(CORGI_GPIO_KEY_INT))
-- | (!gpio_get_value(CORGI_GPIO_WAKEUP)
-- << GPIO_bit(CORGI_GPIO_WAKEUP));
-- return ret;
-+ return !gpio_get_value(CORGI_GPIO_AC_IN) ||
-+ !gpio_get_value(CORGI_GPIO_KEY_INT) ||
-+ !gpio_get_value(CORGI_GPIO_WAKEUP);
- }
-
- unsigned long corgipm_read_devdata(int type)
-diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c
-index 2385052..e362f86 100644
---- a/arch/arm/mach-pxa/pxa_cplds_irqs.c
-+++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
-@@ -41,30 +41,35 @@ static irqreturn_t cplds_irq_handler(int in_irq, void *d)
- unsigned long pending;
- unsigned int bit;
-
-- pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
-- for_each_set_bit(bit, &pending, CPLDS_NB_IRQ)
-- generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit));
-+ do {
-+ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
-+ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) {
-+ generic_handle_irq(irq_find_mapping(fpga->irqdomain,
-+ bit));
-+ }
-+ } while (pending);
-
- return IRQ_HANDLED;
- }
-
--static void cplds_irq_mask_ack(struct irq_data *d)
-+static void cplds_irq_mask(struct irq_data *d)
- {
- struct cplds *fpga = irq_data_get_irq_chip_data(d);
- unsigned int cplds_irq = irqd_to_hwirq(d);
-- unsigned int set, bit = BIT(cplds_irq);
-+ unsigned int bit = BIT(cplds_irq);
-
- fpga->irq_mask &= ~bit;
- writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
-- set = readl(fpga->base + FPGA_IRQ_SET_CLR);
-- writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
- }
-
- static void cplds_irq_unmask(struct irq_data *d)
- {
- struct cplds *fpga = irq_data_get_irq_chip_data(d);
- unsigned int cplds_irq = irqd_to_hwirq(d);
-- unsigned int bit = BIT(cplds_irq);
-+ unsigned int set, bit = BIT(cplds_irq);
-+
-+ set = readl(fpga->base + FPGA_IRQ_SET_CLR);
-+ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
-
- fpga->irq_mask |= bit;
- writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
-@@ -72,7 +77,8 @@ static void cplds_irq_unmask(struct irq_data *d)
-
- static struct irq_chip cplds_irq_chip = {
- .name = "pxa_cplds",
-- .irq_mask_ack = cplds_irq_mask_ack,
-+ .irq_ack = cplds_irq_mask,
-+ .irq_mask = cplds_irq_mask,
- .irq_unmask = cplds_irq_unmask,
- .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE,
- };
-diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
-index b80eab9..249b7bd 100644
---- a/arch/arm/mach-pxa/sharpsl_pm.c
-+++ b/arch/arm/mach-pxa/sharpsl_pm.c
-@@ -744,7 +744,7 @@ static int sharpsl_off_charge_battery(void)
- time = RCNR;
- while (1) {
- /* Check if any wakeup event had occurred */
-- if (sharpsl_pm.machinfo->charger_wakeup() != 0)
-+ if (sharpsl_pm.machinfo->charger_wakeup())
- return 0;
- /* Check for timeout */
- if ((RCNR - time) > SHARPSL_WAIT_CO_TIME)
-diff --git a/arch/arm/mach-pxa/sharpsl_pm.h b/arch/arm/mach-pxa/sharpsl_pm.h
-index 905be67..fa75b6d 100644
---- a/arch/arm/mach-pxa/sharpsl_pm.h
-+++ b/arch/arm/mach-pxa/sharpsl_pm.h
-@@ -34,7 +34,7 @@ struct sharpsl_charger_machinfo {
- #define SHARPSL_STATUS_LOCK 5
- #define SHARPSL_STATUS_CHRGFULL 6
- #define SHARPSL_STATUS_FATAL 7
-- unsigned long (*charger_wakeup)(void);
-+ bool (*charger_wakeup)(void);
- int (*should_wakeup)(unsigned int resume_on_alarm);
- void (*backlight_limit)(int);
- int (*backlight_get_status) (void);
-diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
-index ea9f903..4e64a14 100644
---- a/arch/arm/mach-pxa/spitz_pm.c
-+++ b/arch/arm/mach-pxa/spitz_pm.c
-@@ -165,13 +165,10 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
- return is_resume;
- }
-
--static unsigned long spitz_charger_wakeup(void)
-+static bool spitz_charger_wakeup(void)
- {
-- unsigned long ret;
-- ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
-- << GPIO_bit(SPITZ_GPIO_KEY_INT))
-- | gpio_get_value(SPITZ_GPIO_SYNC));
-- return ret;
-+ return !gpio_get_value(SPITZ_GPIO_KEY_INT) ||
-+ gpio_get_value(SPITZ_GPIO_SYNC);
- }
-
- unsigned long spitzpm_read_devdata(int type)
-diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
-index 263bf39..9bd84ba 100644
---- a/arch/powerpc/include/asm/book3s/64/pgtable.h
-+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
-@@ -6,6 +6,8 @@
- */
- #define _PAGE_BIT_SWAP_TYPE 0
-
-+#define _PAGE_RO 0
-+
- #define _PAGE_EXEC 0x00001 /* execute permission */
- #define _PAGE_WRITE 0x00002 /* write access allowed */
- #define _PAGE_READ 0x00004 /* read access allowed */
-diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
-index 64174bf..05a0a91 100644
---- a/arch/powerpc/kernel/nvram_64.c
-+++ b/arch/powerpc/kernel/nvram_64.c
-@@ -956,7 +956,7 @@ int __init nvram_remove_partition(const char *name, int sig,
-
- /* Make partition a free partition */
- part->header.signature = NVRAM_SIG_FREE;
-- strncpy(part->header.name, "wwwwwwwwwwww", 12);
-+ memset(part->header.name, 'w', 12);
- part->header.checksum = nvram_checksum(&part->header);
- rc = nvram_write_header(part);
- if (rc <= 0) {
-@@ -974,8 +974,8 @@ int __init nvram_remove_partition(const char *name, int sig,
- }
- if (prev) {
- prev->header.length += part->header.length;
-- prev->header.checksum = nvram_checksum(&part->header);
-- rc = nvram_write_header(part);
-+ prev->header.checksum = nvram_checksum(&prev->header);
-+ rc = nvram_write_header(prev);
- if (rc <= 0) {
- printk(KERN_ERR "nvram_remove_partition: nvram_write failed (%d)\n", rc);
- return rc;
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 9ee2623..ad37aa1 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -88,7 +88,13 @@ static void check_if_tm_restore_required(struct task_struct *tsk)
- set_thread_flag(TIF_RESTORE_TM);
- }
- }
-+
-+static inline bool msr_tm_active(unsigned long msr)
-+{
-+ return MSR_TM_ACTIVE(msr);
-+}
- #else
-+static inline bool msr_tm_active(unsigned long msr) { return false; }
- static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
- #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
-
-@@ -208,7 +214,7 @@ void enable_kernel_fp(void)
- EXPORT_SYMBOL(enable_kernel_fp);
-
- static int restore_fp(struct task_struct *tsk) {
-- if (tsk->thread.load_fp) {
-+ if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) {
- load_fp_state(&current->thread.fp_state);
- current->thread.load_fp++;
- return 1;
-@@ -278,7 +284,8 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
-
- static int restore_altivec(struct task_struct *tsk)
- {
-- if (cpu_has_feature(CPU_FTR_ALTIVEC) && tsk->thread.load_vec) {
-+ if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
-+ (tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) {
- load_vr_state(&tsk->thread.vr_state);
- tsk->thread.used_vr = 1;
- tsk->thread.load_vec++;
-@@ -438,6 +445,7 @@ void giveup_all(struct task_struct *tsk)
- return;
-
- msr_check_and_set(msr_all_available);
-+ check_if_tm_restore_required(tsk);
-
- #ifdef CONFIG_PPC_FPU
- if (usermsr & MSR_FP)
-@@ -464,7 +472,8 @@ void restore_math(struct pt_regs *regs)
- {
- unsigned long msr;
-
-- if (!current->thread.load_fp && !loadvec(current->thread))
-+ if (!msr_tm_active(regs->msr) &&
-+ !current->thread.load_fp && !loadvec(current->thread))
- return;
-
- msr = regs->msr;
-@@ -983,6 +992,13 @@ void restore_tm_state(struct pt_regs *regs)
- msr_diff = current->thread.ckpt_regs.msr & ~regs->msr;
- msr_diff &= MSR_FP | MSR_VEC | MSR_VSX;
-
-+ /* Ensure that restore_math() will restore */
-+ if (msr_diff & MSR_FP)
-+ current->thread.load_fp = 1;
-+#ifdef CONFIG_ALIVEC
-+ if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC)
-+ current->thread.load_vec = 1;
-+#endif
- restore_math(regs);
-
- regs->msr |= msr_diff;
-diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
-index 7372ee1..a5d3ecd 100644
---- a/arch/powerpc/mm/hugetlbpage.c
-+++ b/arch/powerpc/mm/hugetlbpage.c
-@@ -1019,8 +1019,15 @@ int gup_hugepte(pte_t *ptep, unsigned long sz, unsigned long addr,
-
- pte = READ_ONCE(*ptep);
- mask = _PAGE_PRESENT | _PAGE_READ;
-+
-+ /*
-+ * On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined
-+ * as 0 and _PAGE_RO has to be set when a page is not writable
-+ */
- if (write)
- mask |= _PAGE_WRITE;
-+ else
-+ mask |= _PAGE_RO;
-
- if ((pte_val(pte) & mask) != mask)
- return 0;
-diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
-index de7501e..8b8852b 100644
---- a/arch/x86/kernel/early-quirks.c
-+++ b/arch/x86/kernel/early-quirks.c
-@@ -317,16 +317,11 @@ static phys_addr_t __init i85x_stolen_base(int num, int slot, int func,
- static phys_addr_t __init i865_stolen_base(int num, int slot, int func,
- size_t stolen_size)
- {
-- u16 toud;
-+ u16 toud = 0;
-
-- /*
-- * FIXME is the graphics stolen memory region
-- * always at TOUD? Ie. is it always the last
-- * one to be allocated by the BIOS?
-- */
- toud = read_pci_config_16(0, 0, 0, I865_TOUD);
-
-- return (phys_addr_t)toud << 16;
-+ return (phys_addr_t)(toud << 16) + i845_tseg_size();
- }
-
- static phys_addr_t __init gen3_stolen_base(int num, int slot, int func,
-diff --git a/crypto/gcm.c b/crypto/gcm.c
-index 70a892e8..f624ac9 100644
---- a/crypto/gcm.c
-+++ b/crypto/gcm.c
-@@ -117,7 +117,7 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
- struct crypto_skcipher *ctr = ctx->ctr;
- struct {
- be128 hash;
-- u8 iv[8];
-+ u8 iv[16];
-
- struct crypto_gcm_setkey_result result;
-
-diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
-index 01d4be2..f5c26a5 100644
---- a/drivers/char/hw_random/omap-rng.c
-+++ b/drivers/char/hw_random/omap-rng.c
-@@ -385,7 +385,7 @@ static int omap_rng_probe(struct platform_device *pdev)
-
- pm_runtime_enable(&pdev->dev);
- ret = pm_runtime_get_sync(&pdev->dev);
-- if (ret) {
-+ if (ret < 0) {
- dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
- pm_runtime_put_noidle(&pdev->dev);
- goto err_ioremap;
-@@ -443,7 +443,7 @@ static int __maybe_unused omap_rng_resume(struct device *dev)
- int ret;
-
- ret = pm_runtime_get_sync(dev);
-- if (ret) {
-+ if (ret < 0) {
- dev_err(dev, "Failed to runtime_get device: %d\n", ret);
- pm_runtime_put_noidle(dev);
- return ret;
-diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
-index 7a79708..0fc71cb 100644
---- a/drivers/clk/bcm/clk-bcm2835.c
-+++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1006,16 +1006,28 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
- return 0;
- }
-
-+static bool
-+bcm2835_clk_is_pllc(struct clk_hw *hw)
-+{
-+ if (!hw)
-+ return false;
-+
-+ return strncmp(clk_hw_get_name(hw), "pllc", 4) == 0;
-+}
-+
- static int bcm2835_clock_determine_rate(struct clk_hw *hw,
- struct clk_rate_request *req)
- {
- struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
- struct clk_hw *parent, *best_parent = NULL;
-+ bool current_parent_is_pllc;
- unsigned long rate, best_rate = 0;
- unsigned long prate, best_prate = 0;
- size_t i;
- u32 div;
-
-+ current_parent_is_pllc = bcm2835_clk_is_pllc(clk_hw_get_parent(hw));
-+
- /*
- * Select parent clock that results in the closest but lower rate
- */
-@@ -1023,6 +1035,17 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
- parent = clk_hw_get_parent_by_index(hw, i);
- if (!parent)
- continue;
-+
-+ /*
-+ * Don't choose a PLLC-derived clock as our parent
-+ * unless it had been manually set that way. PLLC's
-+ * frequency gets adjusted by the firmware due to
-+ * over-temp or under-voltage conditions, without
-+ * prior notification to our clock consumer.
-+ */
-+ if (bcm2835_clk_is_pllc(parent) && !current_parent_is_pllc)
-+ continue;
-+
- prate = clk_hw_get_rate(parent);
- div = bcm2835_clock_choose_div(hw, req->rate, prate, true);
- rate = bcm2835_clock_rate_from_divisor(clock, prate, div);
-diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
-index a0f55bc..96386ff 100644
---- a/drivers/clk/clk-divider.c
-+++ b/drivers/clk/clk-divider.c
-@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
-
- /* if read only, just return current value */
- if (divider->flags & CLK_DIVIDER_READ_ONLY) {
-- bestdiv = readl(divider->reg) >> divider->shift;
-+ bestdiv = clk_readl(divider->reg) >> divider->shift;
- bestdiv &= div_mask(divider->width);
- bestdiv = _get_div(divider->table, bestdiv, divider->flags,
- divider->width);
-diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
-index 58566a17..20b1055 100644
---- a/drivers/clk/clk-qoriq.c
-+++ b/drivers/clk/clk-qoriq.c
-@@ -766,7 +766,11 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx)
- if (!hwc)
- return NULL;
-
-- hwc->reg = cg->regs + 0x20 * idx;
-+ if (cg->info.flags & CG_VER3)
-+ hwc->reg = cg->regs + 0x70000 + 0x20 * idx;
-+ else
-+ hwc->reg = cg->regs + 0x20 * idx;
-+
- hwc->info = cg->info.cmux_groups[cg->info.cmux_to_group[idx]];
-
- /*
-diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
-index 820a939..2877a4d 100644
---- a/drivers/clk/clk.c
-+++ b/drivers/clk/clk.c
-@@ -1908,10 +1908,6 @@ int clk_set_phase(struct clk *clk, int degrees)
-
- clk_prepare_lock();
-
-- /* bail early if nothing to do */
-- if (degrees == clk->core->phase)
-- goto out;
--
- trace_clk_set_phase(clk->core, degrees);
-
- if (clk->core->ops->set_phase)
-@@ -1922,7 +1918,6 @@ int clk_set_phase(struct clk *clk, int degrees)
- if (!ret)
- clk->core->phase = degrees;
-
--out:
- clk_prepare_unlock();
-
- return ret;
-@@ -3186,7 +3181,7 @@ struct clk *__of_clk_get_from_provider(struct of_phandle_args *clkspec,
- {
- struct of_clk_provider *provider;
- struct clk *clk = ERR_PTR(-EPROBE_DEFER);
-- struct clk_hw *hw = ERR_PTR(-EPROBE_DEFER);
-+ struct clk_hw *hw;
-
- if (!clkspec)
- return ERR_PTR(-EINVAL);
-@@ -3194,12 +3189,13 @@ struct clk *__of_clk_get_from_provider(struct of_phandle_args *clkspec,
- /* Check if we have such a provider in our array */
- mutex_lock(&of_clk_mutex);
- list_for_each_entry(provider, &of_clk_providers, link) {
-- if (provider->node == clkspec->np)
-+ if (provider->node == clkspec->np) {
- hw = __of_clk_get_hw_from_provider(provider, clkspec);
-- if (!IS_ERR(hw)) {
- clk = __clk_create_clk(hw, dev_id, con_id);
-+ }
-
-- if (!IS_ERR(clk) && !__clk_get(clk)) {
-+ if (!IS_ERR(clk)) {
-+ if (!__clk_get(clk)) {
- __clk_free_clk(clk);
- clk = ERR_PTR(-ENOENT);
- }
-diff --git a/drivers/clk/imx/clk-imx35.c b/drivers/clk/imx/clk-imx35.c
-index b0978d3..d302ed3 100644
---- a/drivers/clk/imx/clk-imx35.c
-+++ b/drivers/clk/imx/clk-imx35.c
-@@ -115,7 +115,7 @@ static void __init _mx35_clocks_init(void)
- }
-
- clk[ckih] = imx_clk_fixed("ckih", 24000000);
-- clk[ckil] = imx_clk_fixed("ckih", 32768);
-+ clk[ckil] = imx_clk_fixed("ckil", 32768);
- clk[mpll] = imx_clk_pllv1(IMX_PLLV1_IMX35, "mpll", "ckih", base + MX35_CCM_MPCTL);
- clk[ppll] = imx_clk_pllv1(IMX_PLLV1_IMX35, "ppll", "ckih", base + MX35_CCM_PPCTL);
-
-diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
-index 95e3b3e..98909b1 100644
---- a/drivers/clk/qcom/Kconfig
-+++ b/drivers/clk/qcom/Kconfig
-@@ -117,6 +117,7 @@ config MSM_MMCC_8974
-
- config MSM_GCC_8996
- tristate "MSM8996 Global Clock Controller"
-+ select QCOM_GDSC
- depends on COMMON_CLK_QCOM
- help
- Support for the global clock controller on msm8996 devices.
-@@ -126,6 +127,7 @@ config MSM_GCC_8996
- config MSM_MMCC_8996
- tristate "MSM8996 Multimedia Clock Controller"
- select MSM_GCC_8996
-+ select QCOM_GDSC
- depends on COMMON_CLK_QCOM
- help
- Support for the multimedia clock controller on msm8996 devices.
-diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
-index bbf732b..9f643cc 100644
---- a/drivers/clk/qcom/gcc-msm8996.c
-+++ b/drivers/clk/qcom/gcc-msm8996.c
-@@ -2592,9 +2592,9 @@ static struct clk_branch gcc_pcie_2_aux_clk = {
- };
-
- static struct clk_branch gcc_pcie_2_pipe_clk = {
-- .halt_reg = 0x6e108,
-+ .halt_reg = 0x6e018,
- .clkr = {
-- .enable_reg = 0x6e108,
-+ .enable_reg = 0x6e018,
- .enable_mask = BIT(0),
- .hw.init = &(struct clk_init_data){
- .name = "gcc_pcie_2_pipe_clk",
-diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
-index 94f77b0..32f645e 100644
---- a/drivers/crypto/ccp/ccp-dmaengine.c
-+++ b/drivers/crypto/ccp/ccp-dmaengine.c
-@@ -650,7 +650,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
- dma_desc_cache_name = devm_kasprintf(ccp->dev, GFP_KERNEL,
- "%s-dmaengine-desc-cache",
- ccp->name);
-- if (!dma_cmd_cache_name)
-+ if (!dma_desc_cache_name)
- return -ENOMEM;
- ccp->dma_desc_cache = kmem_cache_create(dma_desc_cache_name,
- sizeof(struct ccp_dma_desc),
-diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
-index d64af86..37dadb2 100644
---- a/drivers/crypto/marvell/cesa.c
-+++ b/drivers/crypto/marvell/cesa.c
-@@ -166,6 +166,7 @@ static irqreturn_t mv_cesa_int(int irq, void *priv)
- if (!req)
- break;
-
-+ ctx = crypto_tfm_ctx(req->tfm);
- mv_cesa_complete_req(ctx, req, 0);
- }
- }
-diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
-index 82e0f4e6..b111e14 100644
---- a/drivers/crypto/marvell/hash.c
-+++ b/drivers/crypto/marvell/hash.c
-@@ -805,13 +805,14 @@ static int mv_cesa_md5_init(struct ahash_request *req)
- struct mv_cesa_op_ctx tmpl = { };
-
- mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_MD5);
-+
-+ mv_cesa_ahash_init(req, &tmpl, true);
-+
- creq->state[0] = MD5_H0;
- creq->state[1] = MD5_H1;
- creq->state[2] = MD5_H2;
- creq->state[3] = MD5_H3;
-
-- mv_cesa_ahash_init(req, &tmpl, true);
--
- return 0;
- }
-
-@@ -873,14 +874,15 @@ static int mv_cesa_sha1_init(struct ahash_request *req)
- struct mv_cesa_op_ctx tmpl = { };
-
- mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_SHA1);
-+
-+ mv_cesa_ahash_init(req, &tmpl, false);
-+
- creq->state[0] = SHA1_H0;
- creq->state[1] = SHA1_H1;
- creq->state[2] = SHA1_H2;
- creq->state[3] = SHA1_H3;
- creq->state[4] = SHA1_H4;
-
-- mv_cesa_ahash_init(req, &tmpl, false);
--
- return 0;
- }
-
-@@ -942,6 +944,9 @@ static int mv_cesa_sha256_init(struct ahash_request *req)
- struct mv_cesa_op_ctx tmpl = { };
-
- mv_cesa_set_op_cfg(&tmpl, CESA_SA_DESC_CFG_MACM_SHA256);
-+
-+ mv_cesa_ahash_init(req, &tmpl, false);
-+
- creq->state[0] = SHA256_H0;
- creq->state[1] = SHA256_H1;
- creq->state[2] = SHA256_H2;
-@@ -951,8 +956,6 @@ static int mv_cesa_sha256_init(struct ahash_request *req)
- creq->state[6] = SHA256_H6;
- creq->state[7] = SHA256_H7;
-
-- mv_cesa_ahash_init(req, &tmpl, false);
--
- return 0;
- }
-
-diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c
-index 2bf37e6..dd184b5 100644
---- a/drivers/dma/ipu/ipu_irq.c
-+++ b/drivers/dma/ipu/ipu_irq.c
-@@ -286,22 +286,21 @@ static void ipu_irq_handler(struct irq_desc *desc)
- raw_spin_unlock(&bank_lock);
- while ((line = ffs(status))) {
- struct ipu_irq_map *map;
-- unsigned int irq = NO_IRQ;
-+ unsigned int irq;
-
- line--;
- status &= ~(1UL << line);
-
- raw_spin_lock(&bank_lock);
- map = src2map(32 * i + line);
-- if (map)
-- irq = map->irq;
-- raw_spin_unlock(&bank_lock);
--
- if (!map) {
-+ raw_spin_unlock(&bank_lock);
- pr_err("IPU: Interrupt on unmapped source %u bank %d\n",
- line, i);
- continue;
- }
-+ irq = map->irq;
-+ raw_spin_unlock(&bank_lock);
- generic_handle_irq(irq);
- }
- }
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
-index 17e1362..4e71a68 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
-@@ -43,6 +43,9 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx)
- ctx->rings[i].sequence = 1;
- ctx->rings[i].fences = &ctx->fences[amdgpu_sched_jobs * i];
- }
-+
-+ ctx->reset_counter = atomic_read(&adev->gpu_reset_counter);
-+
- /* create context entity for each ring */
- for (i = 0; i < adev->num_rings; i++) {
- struct amdgpu_ring *ring = adev->rings[i];
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
-index fe36caf..14f57d9 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dpm.c
-@@ -113,24 +113,26 @@ void amdgpu_dpm_print_ps_status(struct amdgpu_device *adev,
- printk("\n");
- }
-
-+
- u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
- {
- struct drm_device *dev = adev->ddev;
- struct drm_crtc *crtc;
- struct amdgpu_crtc *amdgpu_crtc;
-- u32 line_time_us, vblank_lines;
-+ u32 vblank_in_pixels;
- u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
-
- if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {
- list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
- amdgpu_crtc = to_amdgpu_crtc(crtc);
- if (crtc->enabled && amdgpu_crtc->enabled && amdgpu_crtc->hw_mode.clock) {
-- line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) /
-- amdgpu_crtc->hw_mode.clock;
-- vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end -
-+ vblank_in_pixels =
-+ amdgpu_crtc->hw_mode.crtc_htotal *
-+ (amdgpu_crtc->hw_mode.crtc_vblank_end -
- amdgpu_crtc->hw_mode.crtc_vdisplay +
-- (amdgpu_crtc->v_border * 2);
-- vblank_time_us = vblank_lines * line_time_us;
-+ (amdgpu_crtc->v_border * 2));
-+
-+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
- break;
- }
- }
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
-index d942654..e24a8af 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
-@@ -292,7 +292,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
- type = AMD_IP_BLOCK_TYPE_UVD;
- ring_mask = adev->uvd.ring.ready ? 1 : 0;
- ib_start_alignment = AMDGPU_GPU_PAGE_SIZE;
-- ib_size_alignment = 8;
-+ ib_size_alignment = 16;
- break;
- case AMDGPU_HW_IP_VCE:
- type = AMD_IP_BLOCK_TYPE_VCE;
-diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
-index c1b04e9..172bed9 100644
---- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
-@@ -425,16 +425,6 @@ static void dce_v10_0_hpd_init(struct amdgpu_device *adev)
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
-
-- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-- /* don't try to enable hpd on eDP or LVDS avoid breaking the
-- * aux dp channel on imac and help (but not completely fix)
-- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-- * also avoid interrupt storms during dpms.
-- */
-- continue;
-- }
--
- switch (amdgpu_connector->hpd.hpd) {
- case AMDGPU_HPD_1:
- idx = 0;
-@@ -458,6 +448,19 @@ static void dce_v10_0_hpd_init(struct amdgpu_device *adev)
- continue;
- }
-
-+ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-+ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-+ /* don't try to enable hpd on eDP or LVDS avoid breaking the
-+ * aux dp channel on imac and help (but not completely fix)
-+ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-+ * also avoid interrupt storms during dpms.
-+ */
-+ tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
-+ tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, DC_HPD_INT_EN, 0);
-+ WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
-+ continue;
-+ }
-+
- tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
- tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
- WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);
-diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
-index d4bf133..67c7c05 100644
---- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
-@@ -443,16 +443,6 @@ static void dce_v11_0_hpd_init(struct amdgpu_device *adev)
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
-
-- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-- /* don't try to enable hpd on eDP or LVDS avoid breaking the
-- * aux dp channel on imac and help (but not completely fix)
-- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-- * also avoid interrupt storms during dpms.
-- */
-- continue;
-- }
--
- switch (amdgpu_connector->hpd.hpd) {
- case AMDGPU_HPD_1:
- idx = 0;
-@@ -476,6 +466,19 @@ static void dce_v11_0_hpd_init(struct amdgpu_device *adev)
- continue;
- }
-
-+ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-+ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-+ /* don't try to enable hpd on eDP or LVDS avoid breaking the
-+ * aux dp channel on imac and help (but not completely fix)
-+ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-+ * also avoid interrupt storms during dpms.
-+ */
-+ tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
-+ tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, DC_HPD_INT_EN, 0);
-+ WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
-+ continue;
-+ }
-+
- tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
- tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
- WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);
-@@ -3109,6 +3112,7 @@ static int dce_v11_0_sw_fini(void *handle)
-
- dce_v11_0_afmt_fini(adev);
-
-+ drm_mode_config_cleanup(adev->ddev);
- adev->mode_info.mode_config_initialized = false;
-
- return 0;
-diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
-index 4fdfab1..ea07c50 100644
---- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
-@@ -395,15 +395,6 @@ static void dce_v8_0_hpd_init(struct amdgpu_device *adev)
- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
- struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
-
-- if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-- connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-- /* don't try to enable hpd on eDP or LVDS avoid breaking the
-- * aux dp channel on imac and help (but not completely fix)
-- * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-- * also avoid interrupt storms during dpms.
-- */
-- continue;
-- }
- switch (amdgpu_connector->hpd.hpd) {
- case AMDGPU_HPD_1:
- WREG32(mmDC_HPD1_CONTROL, tmp);
-@@ -426,6 +417,45 @@ static void dce_v8_0_hpd_init(struct amdgpu_device *adev)
- default:
- break;
- }
-+
-+ if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-+ connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-+ /* don't try to enable hpd on eDP or LVDS avoid breaking the
-+ * aux dp channel on imac and help (but not completely fix)
-+ * https://bugzilla.redhat.com/show_bug.cgi?id=726143
-+ * also avoid interrupt storms during dpms.
-+ */
-+ u32 dc_hpd_int_cntl_reg, dc_hpd_int_cntl;
-+
-+ switch (amdgpu_connector->hpd.hpd) {
-+ case AMDGPU_HPD_1:
-+ dc_hpd_int_cntl_reg = mmDC_HPD1_INT_CONTROL;
-+ break;
-+ case AMDGPU_HPD_2:
-+ dc_hpd_int_cntl_reg = mmDC_HPD2_INT_CONTROL;
-+ break;
-+ case AMDGPU_HPD_3:
-+ dc_hpd_int_cntl_reg = mmDC_HPD3_INT_CONTROL;
-+ break;
-+ case AMDGPU_HPD_4:
-+ dc_hpd_int_cntl_reg = mmDC_HPD4_INT_CONTROL;
-+ break;
-+ case AMDGPU_HPD_5:
-+ dc_hpd_int_cntl_reg = mmDC_HPD5_INT_CONTROL;
-+ break;
-+ case AMDGPU_HPD_6:
-+ dc_hpd_int_cntl_reg = mmDC_HPD6_INT_CONTROL;
-+ break;
-+ default:
-+ continue;
-+ }
-+
-+ dc_hpd_int_cntl = RREG32(dc_hpd_int_cntl_reg);
-+ dc_hpd_int_cntl &= ~DC_HPD1_INT_CONTROL__DC_HPD1_INT_EN_MASK;
-+ WREG32(dc_hpd_int_cntl_reg, dc_hpd_int_cntl);
-+ continue;
-+ }
-+
- dce_v8_0_hpd_set_polarity(adev, amdgpu_connector->hpd.hpd);
- amdgpu_irq_get(adev, &adev->hpd_irq, amdgpu_connector->hpd.hpd);
- }
-diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
-index 635fc4b..92b1178 100644
---- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
-+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventactionchains.c
-@@ -262,6 +262,8 @@ static const pem_event_action * const display_config_change_event[] = {
- unblock_adjust_power_state_tasks,
- set_cpu_power_state,
- notify_hw_power_source_tasks,
-+ get_2d_performance_state_tasks,
-+ set_performance_state_tasks,
- /* updateDALConfigurationTasks,
- variBrightDisplayConfigurationChangeTasks, */
- adjust_power_state_tasks,
-diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c b/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
-index a46225c..d6bee72 100644
---- a/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
-+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/psm.c
-@@ -100,11 +100,12 @@ int psm_adjust_power_state_dynamic(struct pp_eventmgr *eventmgr, bool skip)
- if (requested == NULL)
- return 0;
-
-+ phm_apply_state_adjust_rules(hwmgr, requested, pcurrent);
-+
- if (pcurrent == NULL || (0 != phm_check_states_equal(hwmgr, &pcurrent->hardware, &requested->hardware, &equal)))
- equal = false;
-
- if (!equal || phm_check_smc_update_required_for_display_configuration(hwmgr)) {
-- phm_apply_state_adjust_rules(hwmgr, requested, pcurrent);
- phm_set_power_state(hwmgr, &pcurrent->hardware, &requested->hardware);
- hwmgr->current_ps = requested;
- }
-diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
-index 780589b..9c4387d 100644
---- a/drivers/gpu/drm/drm_prime.c
-+++ b/drivers/gpu/drm/drm_prime.c
-@@ -335,14 +335,17 @@ static const struct dma_buf_ops drm_gem_prime_dmabuf_ops = {
- * using the PRIME helpers.
- */
- struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
-- struct drm_gem_object *obj, int flags)
-+ struct drm_gem_object *obj,
-+ int flags)
- {
-- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
--
-- exp_info.ops = &drm_gem_prime_dmabuf_ops;
-- exp_info.size = obj->size;
-- exp_info.flags = flags;
-- exp_info.priv = obj;
-+ struct dma_buf_export_info exp_info = {
-+ .exp_name = KBUILD_MODNAME, /* white lie for debug */
-+ .owner = dev->driver->fops->owner,
-+ .ops = &drm_gem_prime_dmabuf_ops,
-+ .size = obj->size,
-+ .flags = flags,
-+ .priv = obj,
-+ };
-
- if (dev->driver->gem_prime_res_obj)
- exp_info.resv = dev->driver->gem_prime_res_obj(obj);
-diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
-index 7882387..5fc8ebd 100644
---- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
-+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
-@@ -330,6 +330,7 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
- const char *pix_clk_in_name;
- const struct of_device_id *id;
- int ret;
-+ u8 div_ratio_shift = 0;
-
- fsl_dev = devm_kzalloc(dev, sizeof(*fsl_dev), GFP_KERNEL);
- if (!fsl_dev)
-@@ -382,11 +383,14 @@ static int fsl_dcu_drm_probe(struct platform_device *pdev)
- pix_clk_in = fsl_dev->clk;
- }
-
-+ if (of_property_read_bool(dev->of_node, "big-endian"))
-+ div_ratio_shift = 24;
-+
- pix_clk_in_name = __clk_get_name(pix_clk_in);
- snprintf(pix_clk_name, sizeof(pix_clk_name), "%s_pix", pix_clk_in_name);
- fsl_dev->pix_clk = clk_register_divider(dev, pix_clk_name,
- pix_clk_in_name, 0, base + DCU_DIV_RATIO,
-- 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL);
-+ div_ratio_shift, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL);
- if (IS_ERR(fsl_dev->pix_clk)) {
- dev_err(dev, "failed to register pix clk\n");
- ret = PTR_ERR(fsl_dev->pix_clk);
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index f68c789..84a0010 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -631,6 +631,8 @@ struct drm_i915_display_funcs {
- struct intel_crtc_state *crtc_state);
- void (*crtc_enable)(struct drm_crtc *crtc);
- void (*crtc_disable)(struct drm_crtc *crtc);
-+ void (*update_crtcs)(struct drm_atomic_state *state,
-+ unsigned int *crtc_vblank_mask);
- void (*audio_codec_enable)(struct drm_connector *connector,
- struct intel_encoder *encoder,
- const struct drm_display_mode *adjusted_mode);
-@@ -1965,11 +1967,11 @@ struct drm_i915_private {
- struct vlv_s0ix_state vlv_s0ix_state;
-
- enum {
-- I915_SKL_SAGV_UNKNOWN = 0,
-- I915_SKL_SAGV_DISABLED,
-- I915_SKL_SAGV_ENABLED,
-- I915_SKL_SAGV_NOT_CONTROLLED
-- } skl_sagv_status;
-+ I915_SAGV_UNKNOWN = 0,
-+ I915_SAGV_DISABLED,
-+ I915_SAGV_ENABLED,
-+ I915_SAGV_NOT_CONTROLLED
-+ } sagv_status;
-
- struct {
- /*
-@@ -2280,21 +2282,19 @@ struct drm_i915_gem_object {
- /** Record of address bit 17 of each page at last unbind. */
- unsigned long *bit_17;
-
-- union {
-- /** for phy allocated objects */
-- struct drm_dma_handle *phys_handle;
--
-- struct i915_gem_userptr {
-- uintptr_t ptr;
-- unsigned read_only :1;
-- unsigned workers :4;
-+ struct i915_gem_userptr {
-+ uintptr_t ptr;
-+ unsigned read_only :1;
-+ unsigned workers :4;
- #define I915_GEM_USERPTR_MAX_WORKERS 15
-
-- struct i915_mm_struct *mm;
-- struct i915_mmu_object *mmu_object;
-- struct work_struct *work;
-- } userptr;
-- };
-+ struct i915_mm_struct *mm;
-+ struct i915_mmu_object *mmu_object;
-+ struct work_struct *work;
-+ } userptr;
-+
-+ /** for phys allocated objects */
-+ struct drm_dma_handle *phys_handle;
- };
- #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
-
-diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
-index 66be299a1..2bb69f3 100644
---- a/drivers/gpu/drm/i915/i915_gem_stolen.c
-+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
-@@ -115,17 +115,28 @@ static unsigned long i915_stolen_to_physical(struct drm_device *dev)
-
- base = bsm & INTEL_BSM_MASK;
- } else if (IS_I865G(dev)) {
-+ u32 tseg_size = 0;
- u16 toud = 0;
-+ u8 tmp;
-+
-+ pci_bus_read_config_byte(dev->pdev->bus, PCI_DEVFN(0, 0),
-+ I845_ESMRAMC, &tmp);
-+
-+ if (tmp & TSEG_ENABLE) {
-+ switch (tmp & I845_TSEG_SIZE_MASK) {
-+ case I845_TSEG_SIZE_512K:
-+ tseg_size = KB(512);
-+ break;
-+ case I845_TSEG_SIZE_1M:
-+ tseg_size = MB(1);
-+ break;
-+ }
-+ }
-
-- /*
-- * FIXME is the graphics stolen memory region
-- * always at TOUD? Ie. is it always the last
-- * one to be allocated by the BIOS?
-- */
- pci_bus_read_config_word(dev->pdev->bus, PCI_DEVFN(0, 0),
- I865_TOUD, &toud);
-
-- base = toud << 16;
-+ base = (toud << 16) + tseg_size;
- } else if (IS_I85X(dev)) {
- u32 tseg_size = 0;
- u32 tom;
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 175595f..e9a64fb 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -2980,6 +2980,7 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
- struct intel_crtc *intel_crtc = to_intel_crtc(crtc_state->base.crtc);
- struct drm_framebuffer *fb = plane_state->base.fb;
- struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-+ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
- int pipe = intel_crtc->pipe;
- u32 plane_ctl, stride_div, stride;
- u32 tile_height, plane_offset, plane_size;
-@@ -3031,6 +3032,9 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
- intel_crtc->adjusted_x = x_offset;
- intel_crtc->adjusted_y = y_offset;
-
-+ if (wm->dirty_pipes & drm_crtc_mask(&intel_crtc->base))
-+ skl_write_plane_wm(intel_crtc, wm, 0);
-+
- I915_WRITE(PLANE_CTL(pipe, 0), plane_ctl);
- I915_WRITE(PLANE_OFFSET(pipe, 0), plane_offset);
- I915_WRITE(PLANE_SIZE(pipe, 0), plane_size);
-@@ -3061,7 +3065,15 @@ static void skylake_disable_primary_plane(struct drm_plane *primary,
- {
- struct drm_device *dev = crtc->dev;
- struct drm_i915_private *dev_priv = to_i915(dev);
-- int pipe = to_intel_crtc(crtc)->pipe;
-+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-+ int pipe = intel_crtc->pipe;
-+
-+ /*
-+ * We only populate skl_results on watermark updates, and if the
-+ * plane's visiblity isn't actually changing neither is its watermarks.
-+ */
-+ if (!to_intel_plane_state(crtc->primary->state)->visible)
-+ skl_write_plane_wm(intel_crtc, &dev_priv->wm.skl_results, 0);
-
- I915_WRITE(PLANE_CTL(pipe, 0), 0);
- I915_WRITE(PLANE_SURF(pipe, 0), 0);
-@@ -8995,6 +9007,24 @@ static void ironlake_compute_dpll(struct intel_crtc *intel_crtc,
- if (intel_crtc_has_dp_encoder(crtc_state))
- dpll |= DPLL_SDVO_HIGH_SPEED;
-
-+ /*
-+ * The high speed IO clock is only really required for
-+ * SDVO/HDMI/DP, but we also enable it for CRT to make it
-+ * possible to share the DPLL between CRT and HDMI. Enabling
-+ * the clock needlessly does no real harm, except use up a
-+ * bit of power potentially.
-+ *
-+ * We'll limit this to IVB with 3 pipes, since it has only two
-+ * DPLLs and so DPLL sharing is the only way to get three pipes
-+ * driving PCH ports at the same time. On SNB we could do this,
-+ * and potentially avoid enabling the second DPLL, but it's not
-+ * clear if it''s a win or loss power wise. No point in doing
-+ * this on ILK at all since it has a fixed DPLL<->pipe mapping.
-+ */
-+ if (INTEL_INFO(dev_priv)->num_pipes == 3 &&
-+ intel_crtc_has_type(crtc_state, INTEL_OUTPUT_ANALOG))
-+ dpll |= DPLL_SDVO_HIGH_SPEED;
-+
- /* compute bitmask from p1 value */
- dpll |= (1 << (crtc_state->dpll.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
- /* also FPA1 */
-@@ -10306,9 +10336,13 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base,
- struct drm_device *dev = crtc->dev;
- struct drm_i915_private *dev_priv = to_i915(dev);
- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-+ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
- int pipe = intel_crtc->pipe;
- uint32_t cntl = 0;
-
-+ if (INTEL_GEN(dev_priv) >= 9 && wm->dirty_pipes & drm_crtc_mask(crtc))
-+ skl_write_cursor_wm(intel_crtc, wm);
-+
- if (plane_state && plane_state->visible) {
- cntl = MCURSOR_GAMMA_ENABLE;
- switch (plane_state->base.crtc_w) {
-@@ -12956,16 +12990,23 @@ static void verify_wm_state(struct drm_crtc *crtc,
- hw_entry->start, hw_entry->end);
- }
-
-- /* cursor */
-- hw_entry = &hw_ddb.plane[pipe][PLANE_CURSOR];
-- sw_entry = &sw_ddb->plane[pipe][PLANE_CURSOR];
--
-- if (!skl_ddb_entry_equal(hw_entry, sw_entry)) {
-- DRM_ERROR("mismatch in DDB state pipe %c cursor "
-- "(expected (%u,%u), found (%u,%u))\n",
-- pipe_name(pipe),
-- sw_entry->start, sw_entry->end,
-- hw_entry->start, hw_entry->end);
-+ /*
-+ * cursor
-+ * If the cursor plane isn't active, we may not have updated it's ddb
-+ * allocation. In that case since the ddb allocation will be updated
-+ * once the plane becomes visible, we can skip this check
-+ */
-+ if (intel_crtc->cursor_addr) {
-+ hw_entry = &hw_ddb.plane[pipe][PLANE_CURSOR];
-+ sw_entry = &sw_ddb->plane[pipe][PLANE_CURSOR];
-+
-+ if (!skl_ddb_entry_equal(hw_entry, sw_entry)) {
-+ DRM_ERROR("mismatch in DDB state pipe %c cursor "
-+ "(expected (%u,%u), found (%u,%u))\n",
-+ pipe_name(pipe),
-+ sw_entry->start, sw_entry->end,
-+ hw_entry->start, hw_entry->end);
-+ }
- }
- }
-
-@@ -13671,6 +13712,111 @@ static bool needs_vblank_wait(struct intel_crtc_state *crtc_state)
- return false;
- }
-
-+static void intel_update_crtc(struct drm_crtc *crtc,
-+ struct drm_atomic_state *state,
-+ struct drm_crtc_state *old_crtc_state,
-+ unsigned int *crtc_vblank_mask)
-+{
-+ struct drm_device *dev = crtc->dev;
-+ struct drm_i915_private *dev_priv = to_i915(dev);
-+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-+ struct intel_crtc_state *pipe_config = to_intel_crtc_state(crtc->state);
-+ bool modeset = needs_modeset(crtc->state);
-+
-+ if (modeset) {
-+ update_scanline_offset(intel_crtc);
-+ dev_priv->display.crtc_enable(crtc);
-+ } else {
-+ intel_pre_plane_update(to_intel_crtc_state(old_crtc_state));
-+ }
-+
-+ if (drm_atomic_get_existing_plane_state(state, crtc->primary)) {
-+ intel_fbc_enable(
-+ intel_crtc, pipe_config,
-+ to_intel_plane_state(crtc->primary->state));
-+ }
-+
-+ drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);
-+
-+ if (needs_vblank_wait(pipe_config))
-+ *crtc_vblank_mask |= drm_crtc_mask(crtc);
-+}
-+
-+static void intel_update_crtcs(struct drm_atomic_state *state,
-+ unsigned int *crtc_vblank_mask)
-+{
-+ struct drm_crtc *crtc;
-+ struct drm_crtc_state *old_crtc_state;
-+ int i;
-+
-+ for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
-+ if (!crtc->state->active)
-+ continue;
-+
-+ intel_update_crtc(crtc, state, old_crtc_state,
-+ crtc_vblank_mask);
-+ }
-+}
-+
-+static void skl_update_crtcs(struct drm_atomic_state *state,
-+ unsigned int *crtc_vblank_mask)
-+{
-+ struct drm_device *dev = state->dev;
-+ struct drm_i915_private *dev_priv = to_i915(dev);
-+ struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
-+ struct drm_crtc *crtc;
-+ struct drm_crtc_state *old_crtc_state;
-+ struct skl_ddb_allocation *new_ddb = &intel_state->wm_results.ddb;
-+ struct skl_ddb_allocation *cur_ddb = &dev_priv->wm.skl_hw.ddb;
-+ unsigned int updated = 0;
-+ bool progress;
-+ enum pipe pipe;
-+
-+ /*
-+ * Whenever the number of active pipes changes, we need to make sure we
-+ * update the pipes in the right order so that their ddb allocations
-+ * never overlap with eachother inbetween CRTC updates. Otherwise we'll
-+ * cause pipe underruns and other bad stuff.
-+ */
-+ do {
-+ int i;
-+ progress = false;
-+
-+ for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
-+ bool vbl_wait = false;
-+ unsigned int cmask = drm_crtc_mask(crtc);
-+ pipe = to_intel_crtc(crtc)->pipe;
-+
-+ if (updated & cmask || !crtc->state->active)
-+ continue;
-+ if (skl_ddb_allocation_overlaps(state, cur_ddb, new_ddb,
-+ pipe))
-+ continue;
-+
-+ updated |= cmask;
-+
-+ /*
-+ * If this is an already active pipe, it's DDB changed,
-+ * and this isn't the last pipe that needs updating
-+ * then we need to wait for a vblank to pass for the
-+ * new ddb allocation to take effect.
-+ */
-+ if (!skl_ddb_allocation_equals(cur_ddb, new_ddb, pipe) &&
-+ !crtc->state->active_changed &&
-+ intel_state->wm_results.dirty_pipes != updated)
-+ vbl_wait = true;
-+
-+ intel_update_crtc(crtc, state, old_crtc_state,
-+ crtc_vblank_mask);
-+
-+ if (vbl_wait)
-+ intel_wait_for_vblank(dev, pipe);
-+
-+ progress = true;
-+ }
-+ } while (progress);
-+}
-+
- static void intel_atomic_commit_tail(struct drm_atomic_state *state)
- {
- struct drm_device *dev = state->dev;
-@@ -13763,23 +13909,15 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
- * SKL workaround: bspec recommends we disable the SAGV when we
- * have more then one pipe enabled
- */
-- if (IS_SKYLAKE(dev_priv) && !skl_can_enable_sagv(state))
-- skl_disable_sagv(dev_priv);
-+ if (!intel_can_enable_sagv(state))
-+ intel_disable_sagv(dev_priv);
-
- intel_modeset_verify_disabled(dev);
- }
-
-- /* Now enable the clocks, plane, pipe, and connectors that we set up. */
-+ /* Complete the events for pipes that have now been disabled */
- for_each_crtc_in_state(state, crtc, old_crtc_state, i) {
-- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- bool modeset = needs_modeset(crtc->state);
-- struct intel_crtc_state *pipe_config =
-- to_intel_crtc_state(crtc->state);
--
-- if (modeset && crtc->state->active) {
-- update_scanline_offset(to_intel_crtc(crtc));
-- dev_priv->display.crtc_enable(crtc);
-- }
-
- /* Complete events for now disable pipes here. */
- if (modeset && !crtc->state->active && crtc->state->event) {
-@@ -13789,21 +13927,11 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
-
- crtc->state->event = NULL;
- }
--
-- if (!modeset)
-- intel_pre_plane_update(to_intel_crtc_state(old_crtc_state));
--
-- if (crtc->state->active &&
-- drm_atomic_get_existing_plane_state(state, crtc->primary))
-- intel_fbc_enable(intel_crtc, pipe_config, to_intel_plane_state(crtc->primary->state));
--
-- if (crtc->state->active)
-- drm_atomic_helper_commit_planes_on_crtc(old_crtc_state);
--
-- if (pipe_config->base.active && needs_vblank_wait(pipe_config))
-- crtc_vblank_mask |= 1 << i;
- }
-
-+ /* Now enable the clocks, plane, pipe, and connectors that we set up. */
-+ dev_priv->display.update_crtcs(state, &crtc_vblank_mask);
-+
- /* FIXME: We should call drm_atomic_helper_commit_hw_done() here
- * already, but still need the state for the delayed optimization. To
- * fix this:
-@@ -13839,9 +13967,8 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
- intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
- }
-
-- if (IS_SKYLAKE(dev_priv) && intel_state->modeset &&
-- skl_can_enable_sagv(state))
-- skl_enable_sagv(dev_priv);
-+ if (intel_state->modeset && intel_can_enable_sagv(state))
-+ intel_enable_sagv(dev_priv);
-
- drm_atomic_helper_commit_hw_done(state);
-
-@@ -14221,10 +14348,12 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
- struct drm_crtc_state *old_crtc_state)
- {
- struct drm_device *dev = crtc->dev;
-+ struct drm_i915_private *dev_priv = to_i915(dev);
- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- struct intel_crtc_state *old_intel_state =
- to_intel_crtc_state(old_crtc_state);
- bool modeset = needs_modeset(crtc->state);
-+ enum pipe pipe = intel_crtc->pipe;
-
- /* Perform vblank evasion around commit operation */
- intel_pipe_update_start(intel_crtc);
-@@ -14239,8 +14368,12 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
-
- if (to_intel_crtc_state(crtc->state)->update_pipe)
- intel_update_pipe_config(intel_crtc, old_intel_state);
-- else if (INTEL_INFO(dev)->gen >= 9)
-+ else if (INTEL_GEN(dev_priv) >= 9) {
- skl_detach_scalers(intel_crtc);
-+
-+ I915_WRITE(PIPE_WM_LINETIME(pipe),
-+ dev_priv->wm.skl_hw.wm_linetime[pipe]);
-+ }
- }
-
- static void intel_finish_crtc_commit(struct drm_crtc *crtc,
-@@ -15347,6 +15480,11 @@ void intel_init_display_hooks(struct drm_i915_private *dev_priv)
- skl_modeset_calc_cdclk;
- }
-
-+ if (dev_priv->info.gen >= 9)
-+ dev_priv->display.update_crtcs = skl_update_crtcs;
-+ else
-+ dev_priv->display.update_crtcs = intel_update_crtcs;
-+
- switch (INTEL_INFO(dev_priv)->gen) {
- case 2:
- dev_priv->display.queue_flip = intel_gen2_queue_flip;
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index 21b04c3..1ca155f 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -4148,7 +4148,7 @@ static bool bxt_digital_port_connected(struct drm_i915_private *dev_priv,
- *
- * Return %true if @port is connected, %false otherwise.
- */
--bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
-+static bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
- struct intel_digital_port *port)
- {
- if (HAS_PCH_IBX(dev_priv))
-@@ -4207,7 +4207,7 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
- intel_dp->has_audio = false;
- }
-
--static void
-+static enum drm_connector_status
- intel_dp_long_pulse(struct intel_connector *intel_connector)
- {
- struct drm_connector *connector = &intel_connector->base;
-@@ -4232,7 +4232,7 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
- else
- status = connector_status_disconnected;
-
-- if (status != connector_status_connected) {
-+ if (status == connector_status_disconnected) {
- intel_dp->compliance_test_active = 0;
- intel_dp->compliance_test_type = 0;
- intel_dp->compliance_test_data = 0;
-@@ -4284,8 +4284,8 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
- intel_dp->aux.i2c_defer_count = 0;
-
- intel_dp_set_edid(intel_dp);
--
-- status = connector_status_connected;
-+ if (is_edp(intel_dp) || intel_connector->detect_edid)
-+ status = connector_status_connected;
- intel_dp->detect_done = true;
-
- /* Try to read the source of the interrupt */
-@@ -4303,12 +4303,11 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
- }
-
- out:
-- if ((status != connector_status_connected) &&
-- (intel_dp->is_mst == false))
-+ if (status != connector_status_connected && !intel_dp->is_mst)
- intel_dp_unset_edid(intel_dp);
-
- intel_display_power_put(to_i915(dev), power_domain);
-- return;
-+ return status;
- }
-
- static enum drm_connector_status
-@@ -4317,7 +4316,7 @@ intel_dp_detect(struct drm_connector *connector, bool force)
- struct intel_dp *intel_dp = intel_attached_dp(connector);
- struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
- struct intel_encoder *intel_encoder = &intel_dig_port->base;
-- struct intel_connector *intel_connector = to_intel_connector(connector);
-+ enum drm_connector_status status = connector->status;
-
- DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
- connector->base.id, connector->name);
-@@ -4332,14 +4331,11 @@ intel_dp_detect(struct drm_connector *connector, bool force)
-
- /* If full detect is not performed yet, do a full detect */
- if (!intel_dp->detect_done)
-- intel_dp_long_pulse(intel_dp->attached_connector);
-+ status = intel_dp_long_pulse(intel_dp->attached_connector);
-
- intel_dp->detect_done = false;
-
-- if (is_edp(intel_dp) || intel_connector->detect_edid)
-- return connector_status_connected;
-- else
-- return connector_status_disconnected;
-+ return status;
- }
-
- static void
-@@ -4696,36 +4692,34 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
- port_name(intel_dig_port->port),
- long_hpd ? "long" : "short");
-
-+ if (long_hpd) {
-+ intel_dp->detect_done = false;
-+ return IRQ_NONE;
-+ }
-+
- power_domain = intel_display_port_aux_power_domain(intel_encoder);
- intel_display_power_get(dev_priv, power_domain);
-
-- if (long_hpd) {
-- intel_dp_long_pulse(intel_dp->attached_connector);
-- if (intel_dp->is_mst)
-- ret = IRQ_HANDLED;
-- goto put_power;
--
-- } else {
-- if (intel_dp->is_mst) {
-- if (intel_dp_check_mst_status(intel_dp) == -EINVAL) {
-- /*
-- * If we were in MST mode, and device is not
-- * there, get out of MST mode
-- */
-- DRM_DEBUG_KMS("MST device may have disappeared %d vs %d\n",
-- intel_dp->is_mst, intel_dp->mst_mgr.mst_state);
-- intel_dp->is_mst = false;
-- drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr,
-- intel_dp->is_mst);
-- goto put_power;
-- }
-+ if (intel_dp->is_mst) {
-+ if (intel_dp_check_mst_status(intel_dp) == -EINVAL) {
-+ /*
-+ * If we were in MST mode, and device is not
-+ * there, get out of MST mode
-+ */
-+ DRM_DEBUG_KMS("MST device may have disappeared %d vs %d\n",
-+ intel_dp->is_mst, intel_dp->mst_mgr.mst_state);
-+ intel_dp->is_mst = false;
-+ drm_dp_mst_topology_mgr_set_mst(&intel_dp->mst_mgr,
-+ intel_dp->is_mst);
-+ intel_dp->detect_done = false;
-+ goto put_power;
- }
-+ }
-
-- if (!intel_dp->is_mst) {
-- if (!intel_dp_short_pulse(intel_dp)) {
-- intel_dp_long_pulse(intel_dp->attached_connector);
-- goto put_power;
-- }
-+ if (!intel_dp->is_mst) {
-+ if (!intel_dp_short_pulse(intel_dp)) {
-+ intel_dp->detect_done = false;
-+ goto put_power;
- }
- }
-
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index ff399b9..9a58800 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -236,6 +236,7 @@ struct intel_panel {
- bool enabled;
- bool combination_mode; /* gen 2/4 only */
- bool active_low_pwm;
-+ bool alternate_pwm_increment; /* lpt+ */
-
- /* PWM chip */
- bool util_pin_active_low; /* bxt+ */
-@@ -1387,8 +1388,6 @@ void intel_edp_drrs_disable(struct intel_dp *intel_dp);
- void intel_edp_drrs_invalidate(struct drm_device *dev,
- unsigned frontbuffer_bits);
- void intel_edp_drrs_flush(struct drm_device *dev, unsigned frontbuffer_bits);
--bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
-- struct intel_digital_port *port);
-
- void
- intel_dp_program_link_training_pattern(struct intel_dp *intel_dp,
-@@ -1716,9 +1715,21 @@ void ilk_wm_get_hw_state(struct drm_device *dev);
- void skl_wm_get_hw_state(struct drm_device *dev);
- void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv,
- struct skl_ddb_allocation *ddb /* out */);
--bool skl_can_enable_sagv(struct drm_atomic_state *state);
--int skl_enable_sagv(struct drm_i915_private *dev_priv);
--int skl_disable_sagv(struct drm_i915_private *dev_priv);
-+bool intel_can_enable_sagv(struct drm_atomic_state *state);
-+int intel_enable_sagv(struct drm_i915_private *dev_priv);
-+int intel_disable_sagv(struct drm_i915_private *dev_priv);
-+bool skl_ddb_allocation_equals(const struct skl_ddb_allocation *old,
-+ const struct skl_ddb_allocation *new,
-+ enum pipe pipe);
-+bool skl_ddb_allocation_overlaps(struct drm_atomic_state *state,
-+ const struct skl_ddb_allocation *old,
-+ const struct skl_ddb_allocation *new,
-+ enum pipe pipe);
-+void skl_write_cursor_wm(struct intel_crtc *intel_crtc,
-+ const struct skl_wm_values *wm);
-+void skl_write_plane_wm(struct intel_crtc *intel_crtc,
-+ const struct skl_wm_values *wm,
-+ int plane);
- uint32_t ilk_pipe_pixel_rate(const struct intel_crtc_state *pipe_config);
- bool ilk_disable_lp_wm(struct drm_device *dev);
- int sanitize_rc6_option(struct drm_i915_private *dev_priv, int enable_rc6);
-diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
-index 4df9f38..c3aa9e6 100644
---- a/drivers/gpu/drm/i915/intel_hdmi.c
-+++ b/drivers/gpu/drm/i915/intel_hdmi.c
-@@ -1422,24 +1422,22 @@ intel_hdmi_dp_dual_mode_detect(struct drm_connector *connector, bool has_edid)
- }
-
- static bool
--intel_hdmi_set_edid(struct drm_connector *connector, bool force)
-+intel_hdmi_set_edid(struct drm_connector *connector)
- {
- struct drm_i915_private *dev_priv = to_i915(connector->dev);
- struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
-- struct edid *edid = NULL;
-+ struct edid *edid;
- bool connected = false;
-
-- if (force) {
-- intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
-+ intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
-
-- edid = drm_get_edid(connector,
-- intel_gmbus_get_adapter(dev_priv,
-- intel_hdmi->ddc_bus));
-+ edid = drm_get_edid(connector,
-+ intel_gmbus_get_adapter(dev_priv,
-+ intel_hdmi->ddc_bus));
-
-- intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
-+ intel_hdmi_dp_dual_mode_detect(connector, edid != NULL);
-
-- intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
-- }
-+ intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
-
- to_intel_connector(connector)->detect_edid = edid;
- if (edid && edid->input & DRM_EDID_INPUT_DIGITAL) {
-@@ -1465,37 +1463,16 @@ static enum drm_connector_status
- intel_hdmi_detect(struct drm_connector *connector, bool force)
- {
- enum drm_connector_status status;
-- struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
- struct drm_i915_private *dev_priv = to_i915(connector->dev);
-- bool live_status = false;
-- unsigned int try;
-
- DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
- connector->base.id, connector->name);
-
- intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
-
-- for (try = 0; !live_status && try < 9; try++) {
-- if (try)
-- msleep(10);
-- live_status = intel_digital_port_connected(dev_priv,
-- hdmi_to_dig_port(intel_hdmi));
-- }
--
-- if (!live_status) {
-- DRM_DEBUG_KMS("HDMI live status down\n");
-- /*
-- * Live status register is not reliable on all intel platforms.
-- * So consider live_status only for certain platforms, for
-- * others, read EDID to determine presence of sink.
-- */
-- if (INTEL_INFO(dev_priv)->gen < 7 || IS_IVYBRIDGE(dev_priv))
-- live_status = true;
-- }
--
- intel_hdmi_unset_edid(connector);
-
-- if (intel_hdmi_set_edid(connector, live_status)) {
-+ if (intel_hdmi_set_edid(connector)) {
- struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
-
- hdmi_to_dig_port(intel_hdmi)->base.type = INTEL_OUTPUT_HDMI;
-@@ -1521,7 +1498,7 @@ intel_hdmi_force(struct drm_connector *connector)
- if (connector->status != connector_status_connected)
- return;
-
-- intel_hdmi_set_edid(connector, true);
-+ intel_hdmi_set_edid(connector);
- hdmi_to_dig_port(intel_hdmi)->base.type = INTEL_OUTPUT_HDMI;
- }
-
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index 96c65d7..9a2393a 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -841,7 +841,7 @@ static void lpt_enable_backlight(struct intel_connector *connector)
- {
- struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
- struct intel_panel *panel = &connector->panel;
-- u32 pch_ctl1, pch_ctl2;
-+ u32 pch_ctl1, pch_ctl2, schicken;
-
- pch_ctl1 = I915_READ(BLC_PWM_PCH_CTL1);
- if (pch_ctl1 & BLM_PCH_PWM_ENABLE) {
-@@ -850,6 +850,22 @@ static void lpt_enable_backlight(struct intel_connector *connector)
- I915_WRITE(BLC_PWM_PCH_CTL1, pch_ctl1);
- }
-
-+ if (HAS_PCH_LPT(dev_priv)) {
-+ schicken = I915_READ(SOUTH_CHICKEN2);
-+ if (panel->backlight.alternate_pwm_increment)
-+ schicken |= LPT_PWM_GRANULARITY;
-+ else
-+ schicken &= ~LPT_PWM_GRANULARITY;
-+ I915_WRITE(SOUTH_CHICKEN2, schicken);
-+ } else {
-+ schicken = I915_READ(SOUTH_CHICKEN1);
-+ if (panel->backlight.alternate_pwm_increment)
-+ schicken |= SPT_PWM_GRANULARITY;
-+ else
-+ schicken &= ~SPT_PWM_GRANULARITY;
-+ I915_WRITE(SOUTH_CHICKEN1, schicken);
-+ }
-+
- pch_ctl2 = panel->backlight.max << 16;
- I915_WRITE(BLC_PWM_PCH_CTL2, pch_ctl2);
-
-@@ -1242,10 +1258,10 @@ static u32 bxt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
- */
- static u32 spt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
- {
-- struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
-+ struct intel_panel *panel = &connector->panel;
- u32 mul;
-
-- if (I915_READ(SOUTH_CHICKEN1) & SPT_PWM_GRANULARITY)
-+ if (panel->backlight.alternate_pwm_increment)
- mul = 128;
- else
- mul = 16;
-@@ -1261,9 +1277,10 @@ static u32 spt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
- static u32 lpt_hz_to_pwm(struct intel_connector *connector, u32 pwm_freq_hz)
- {
- struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
-+ struct intel_panel *panel = &connector->panel;
- u32 mul, clock;
-
-- if (I915_READ(SOUTH_CHICKEN2) & LPT_PWM_GRANULARITY)
-+ if (panel->backlight.alternate_pwm_increment)
- mul = 16;
- else
- mul = 128;
-@@ -1414,6 +1431,13 @@ static int lpt_setup_backlight(struct intel_connector *connector, enum pipe unus
- struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
- struct intel_panel *panel = &connector->panel;
- u32 pch_ctl1, pch_ctl2, val;
-+ bool alt;
-+
-+ if (HAS_PCH_LPT(dev_priv))
-+ alt = I915_READ(SOUTH_CHICKEN2) & LPT_PWM_GRANULARITY;
-+ else
-+ alt = I915_READ(SOUTH_CHICKEN1) & SPT_PWM_GRANULARITY;
-+ panel->backlight.alternate_pwm_increment = alt;
-
- pch_ctl1 = I915_READ(BLC_PWM_PCH_CTL1);
- panel->backlight.active_low_pwm = pch_ctl1 & BLM_PCH_POLARITY;
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index 2d24813..e59a28c 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -2119,32 +2119,34 @@ static void intel_read_wm_latency(struct drm_device *dev, uint16_t wm[8])
- GEN9_MEM_LATENCY_LEVEL_MASK;
-
- /*
-+ * If a level n (n > 1) has a 0us latency, all levels m (m >= n)
-+ * need to be disabled. We make sure to sanitize the values out
-+ * of the punit to satisfy this requirement.
-+ */
-+ for (level = 1; level <= max_level; level++) {
-+ if (wm[level] == 0) {
-+ for (i = level + 1; i <= max_level; i++)
-+ wm[i] = 0;
-+ break;
-+ }
-+ }
-+
-+ /*
- * WaWmMemoryReadLatency:skl
- *
- * punit doesn't take into account the read latency so we need
-- * to add 2us to the various latency levels we retrieve from
-- * the punit.
-- * - W0 is a bit special in that it's the only level that
-- * can't be disabled if we want to have display working, so
-- * we always add 2us there.
-- * - For levels >=1, punit returns 0us latency when they are
-- * disabled, so we respect that and don't add 2us then
-- *
-- * Additionally, if a level n (n > 1) has a 0us latency, all
-- * levels m (m >= n) need to be disabled. We make sure to
-- * sanitize the values out of the punit to satisfy this
-- * requirement.
-+ * to add 2us to the various latency levels we retrieve from the
-+ * punit when level 0 response data us 0us.
- */
-- wm[0] += 2;
-- for (level = 1; level <= max_level; level++)
-- if (wm[level] != 0)
-+ if (wm[0] == 0) {
-+ wm[0] += 2;
-+ for (level = 1; level <= max_level; level++) {
-+ if (wm[level] == 0)
-+ break;
- wm[level] += 2;
-- else {
-- for (i = level + 1; i <= max_level; i++)
-- wm[i] = 0;
--
-- break;
- }
-+ }
-+
- } else if (IS_HASWELL(dev) || IS_BROADWELL(dev)) {
- uint64_t sskpd = I915_READ64(MCH_SSKPD);
-
-@@ -2876,6 +2878,19 @@ skl_wm_plane_id(const struct intel_plane *plane)
- }
- }
-
-+static bool
-+intel_has_sagv(struct drm_i915_private *dev_priv)
-+{
-+ if (IS_KABYLAKE(dev_priv))
-+ return true;
-+
-+ if (IS_SKYLAKE(dev_priv) &&
-+ dev_priv->sagv_status != I915_SAGV_NOT_CONTROLLED)
-+ return true;
-+
-+ return false;
-+}
-+
- /*
- * SAGV dynamically adjusts the system agent voltage and clock frequencies
- * depending on power and performance requirements. The display engine access
-@@ -2888,12 +2903,14 @@ skl_wm_plane_id(const struct intel_plane *plane)
- * - We're not using an interlaced display configuration
- */
- int
--skl_enable_sagv(struct drm_i915_private *dev_priv)
-+intel_enable_sagv(struct drm_i915_private *dev_priv)
- {
- int ret;
-
-- if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
-- dev_priv->skl_sagv_status == I915_SKL_SAGV_ENABLED)
-+ if (!intel_has_sagv(dev_priv))
-+ return 0;
-+
-+ if (dev_priv->sagv_status == I915_SAGV_ENABLED)
- return 0;
-
- DRM_DEBUG_KMS("Enabling the SAGV\n");
-@@ -2909,21 +2926,21 @@ skl_enable_sagv(struct drm_i915_private *dev_priv)
- * Some skl systems, pre-release machines in particular,
- * don't actually have an SAGV.
- */
-- if (ret == -ENXIO) {
-+ if (IS_SKYLAKE(dev_priv) && ret == -ENXIO) {
- DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
-- dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
-+ dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED;
- return 0;
- } else if (ret < 0) {
- DRM_ERROR("Failed to enable the SAGV\n");
- return ret;
- }
-
-- dev_priv->skl_sagv_status = I915_SKL_SAGV_ENABLED;
-+ dev_priv->sagv_status = I915_SAGV_ENABLED;
- return 0;
- }
-
- static int
--skl_do_sagv_disable(struct drm_i915_private *dev_priv)
-+intel_do_sagv_disable(struct drm_i915_private *dev_priv)
- {
- int ret;
- uint32_t temp = GEN9_SAGV_DISABLE;
-@@ -2937,19 +2954,21 @@ skl_do_sagv_disable(struct drm_i915_private *dev_priv)
- }
-
- int
--skl_disable_sagv(struct drm_i915_private *dev_priv)
-+intel_disable_sagv(struct drm_i915_private *dev_priv)
- {
- int ret, result;
-
-- if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
-- dev_priv->skl_sagv_status == I915_SKL_SAGV_DISABLED)
-+ if (!intel_has_sagv(dev_priv))
-+ return 0;
-+
-+ if (dev_priv->sagv_status == I915_SAGV_DISABLED)
- return 0;
-
- DRM_DEBUG_KMS("Disabling the SAGV\n");
- mutex_lock(&dev_priv->rps.hw_lock);
-
- /* bspec says to keep retrying for at least 1 ms */
-- ret = wait_for(result = skl_do_sagv_disable(dev_priv), 1);
-+ ret = wait_for(result = intel_do_sagv_disable(dev_priv), 1);
- mutex_unlock(&dev_priv->rps.hw_lock);
-
- if (ret == -ETIMEDOUT) {
-@@ -2961,20 +2980,20 @@ skl_disable_sagv(struct drm_i915_private *dev_priv)
- * Some skl systems, pre-release machines in particular,
- * don't actually have an SAGV.
- */
-- if (result == -ENXIO) {
-+ if (IS_SKYLAKE(dev_priv) && result == -ENXIO) {
- DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
-- dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
-+ dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED;
- return 0;
- } else if (result < 0) {
- DRM_ERROR("Failed to disable the SAGV\n");
- return result;
- }
-
-- dev_priv->skl_sagv_status = I915_SKL_SAGV_DISABLED;
-+ dev_priv->sagv_status = I915_SAGV_DISABLED;
- return 0;
- }
-
--bool skl_can_enable_sagv(struct drm_atomic_state *state)
-+bool intel_can_enable_sagv(struct drm_atomic_state *state)
- {
- struct drm_device *dev = state->dev;
- struct drm_i915_private *dev_priv = to_i915(dev);
-@@ -2983,6 +3002,9 @@ bool skl_can_enable_sagv(struct drm_atomic_state *state)
- enum pipe pipe;
- int level, plane;
-
-+ if (!intel_has_sagv(dev_priv))
-+ return false;
-+
- /*
- * SKL workaround: bspec recommends we disable the SAGV when we have
- * more then one pipe enabled
-@@ -3473,29 +3495,14 @@ static uint32_t skl_wm_method1(uint32_t pixel_rate, uint8_t cpp, uint32_t latenc
- }
-
- static uint32_t skl_wm_method2(uint32_t pixel_rate, uint32_t pipe_htotal,
-- uint32_t horiz_pixels, uint8_t cpp,
-- uint64_t tiling, uint32_t latency)
-+ uint32_t latency, uint32_t plane_blocks_per_line)
- {
- uint32_t ret;
-- uint32_t plane_bytes_per_line, plane_blocks_per_line;
- uint32_t wm_intermediate_val;
-
- if (latency == 0)
- return UINT_MAX;
-
-- plane_bytes_per_line = horiz_pixels * cpp;
--
-- if (tiling == I915_FORMAT_MOD_Y_TILED ||
-- tiling == I915_FORMAT_MOD_Yf_TILED) {
-- plane_bytes_per_line *= 4;
-- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
-- plane_blocks_per_line /= 4;
-- } else if (tiling == DRM_FORMAT_MOD_NONE) {
-- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512) + 1;
-- } else {
-- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
-- }
--
- wm_intermediate_val = latency * pixel_rate;
- ret = DIV_ROUND_UP(wm_intermediate_val, pipe_htotal * 1000) *
- plane_blocks_per_line;
-@@ -3546,6 +3553,7 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
- uint8_t cpp;
- uint32_t width = 0, height = 0;
- uint32_t plane_pixel_rate;
-+ uint32_t y_tile_minimum, y_min_scanlines;
-
- if (latency == 0 || !cstate->base.active || !intel_pstate->visible) {
- *enabled = false;
-@@ -3561,38 +3569,51 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
- cpp = drm_format_plane_cpp(fb->pixel_format, 0);
- plane_pixel_rate = skl_adjusted_plane_pixel_rate(cstate, intel_pstate);
-
-+ if (intel_rotation_90_or_270(pstate->rotation)) {
-+ int cpp = (fb->pixel_format == DRM_FORMAT_NV12) ?
-+ drm_format_plane_cpp(fb->pixel_format, 1) :
-+ drm_format_plane_cpp(fb->pixel_format, 0);
-+
-+ switch (cpp) {
-+ case 1:
-+ y_min_scanlines = 16;
-+ break;
-+ case 2:
-+ y_min_scanlines = 8;
-+ break;
-+ default:
-+ WARN(1, "Unsupported pixel depth for rotation");
-+ case 4:
-+ y_min_scanlines = 4;
-+ break;
-+ }
-+ } else {
-+ y_min_scanlines = 4;
-+ }
-+
-+ plane_bytes_per_line = width * cpp;
-+ if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
-+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
-+ plane_blocks_per_line =
-+ DIV_ROUND_UP(plane_bytes_per_line * y_min_scanlines, 512);
-+ plane_blocks_per_line /= y_min_scanlines;
-+ } else if (fb->modifier[0] == DRM_FORMAT_MOD_NONE) {
-+ plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512)
-+ + 1;
-+ } else {
-+ plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
-+ }
-+
- method1 = skl_wm_method1(plane_pixel_rate, cpp, latency);
- method2 = skl_wm_method2(plane_pixel_rate,
- cstate->base.adjusted_mode.crtc_htotal,
-- width,
-- cpp,
-- fb->modifier[0],
-- latency);
-+ latency,
-+ plane_blocks_per_line);
-
-- plane_bytes_per_line = width * cpp;
-- plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
-+ y_tile_minimum = plane_blocks_per_line * y_min_scanlines;
-
- if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
- fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
-- uint32_t min_scanlines = 4;
-- uint32_t y_tile_minimum;
-- if (intel_rotation_90_or_270(pstate->rotation)) {
-- int cpp = (fb->pixel_format == DRM_FORMAT_NV12) ?
-- drm_format_plane_cpp(fb->pixel_format, 1) :
-- drm_format_plane_cpp(fb->pixel_format, 0);
--
-- switch (cpp) {
-- case 1:
-- min_scanlines = 16;
-- break;
-- case 2:
-- min_scanlines = 8;
-- break;
-- case 8:
-- WARN(1, "Unsupported pixel depth for rotation");
-- }
-- }
-- y_tile_minimum = plane_blocks_per_line * min_scanlines;
- selected_result = max(method2, y_tile_minimum);
- } else {
- if ((ddb_allocation / plane_blocks_per_line) >= 1)
-@@ -3606,10 +3627,12 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
-
- if (level >= 1 && level <= 7) {
- if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
-- fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED)
-- res_lines += 4;
-- else
-+ fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
-+ res_blocks += y_tile_minimum;
-+ res_lines += y_min_scanlines;
-+ } else {
- res_blocks++;
-+ }
- }
-
- if (res_blocks >= ddb_allocation || res_lines > 31) {
-@@ -3828,183 +3851,82 @@ static void skl_ddb_entry_write(struct drm_i915_private *dev_priv,
- I915_WRITE(reg, 0);
- }
-
--static void skl_write_wm_values(struct drm_i915_private *dev_priv,
-- const struct skl_wm_values *new)
-+void skl_write_plane_wm(struct intel_crtc *intel_crtc,
-+ const struct skl_wm_values *wm,
-+ int plane)
- {
-- struct drm_device *dev = &dev_priv->drm;
-- struct intel_crtc *crtc;
--
-- for_each_intel_crtc(dev, crtc) {
-- int i, level, max_level = ilk_wm_max_level(dev);
-- enum pipe pipe = crtc->pipe;
--
-- if ((new->dirty_pipes & drm_crtc_mask(&crtc->base)) == 0)
-- continue;
-- if (!crtc->active)
-- continue;
--
-- I915_WRITE(PIPE_WM_LINETIME(pipe), new->wm_linetime[pipe]);
--
-- for (level = 0; level <= max_level; level++) {
-- for (i = 0; i < intel_num_planes(crtc); i++)
-- I915_WRITE(PLANE_WM(pipe, i, level),
-- new->plane[pipe][i][level]);
-- I915_WRITE(CUR_WM(pipe, level),
-- new->plane[pipe][PLANE_CURSOR][level]);
-- }
-- for (i = 0; i < intel_num_planes(crtc); i++)
-- I915_WRITE(PLANE_WM_TRANS(pipe, i),
-- new->plane_trans[pipe][i]);
-- I915_WRITE(CUR_WM_TRANS(pipe),
-- new->plane_trans[pipe][PLANE_CURSOR]);
--
-- for (i = 0; i < intel_num_planes(crtc); i++) {
-- skl_ddb_entry_write(dev_priv,
-- PLANE_BUF_CFG(pipe, i),
-- &new->ddb.plane[pipe][i]);
-- skl_ddb_entry_write(dev_priv,
-- PLANE_NV12_BUF_CFG(pipe, i),
-- &new->ddb.y_plane[pipe][i]);
-- }
-+ struct drm_crtc *crtc = &intel_crtc->base;
-+ struct drm_device *dev = crtc->dev;
-+ struct drm_i915_private *dev_priv = to_i915(dev);
-+ int level, max_level = ilk_wm_max_level(dev);
-+ enum pipe pipe = intel_crtc->pipe;
-
-- skl_ddb_entry_write(dev_priv, CUR_BUF_CFG(pipe),
-- &new->ddb.plane[pipe][PLANE_CURSOR]);
-+ for (level = 0; level <= max_level; level++) {
-+ I915_WRITE(PLANE_WM(pipe, plane, level),
-+ wm->plane[pipe][plane][level]);
- }
--}
-+ I915_WRITE(PLANE_WM_TRANS(pipe, plane), wm->plane_trans[pipe][plane]);
-
--/*
-- * When setting up a new DDB allocation arrangement, we need to correctly
-- * sequence the times at which the new allocations for the pipes are taken into
-- * account or we'll have pipes fetching from space previously allocated to
-- * another pipe.
-- *
-- * Roughly the sequence looks like:
-- * 1. re-allocate the pipe(s) with the allocation being reduced and not
-- * overlapping with a previous light-up pipe (another way to put it is:
-- * pipes with their new allocation strickly included into their old ones).
-- * 2. re-allocate the other pipes that get their allocation reduced
-- * 3. allocate the pipes having their allocation increased
-- *
-- * Steps 1. and 2. are here to take care of the following case:
-- * - Initially DDB looks like this:
-- * | B | C |
-- * - enable pipe A.
-- * - pipe B has a reduced DDB allocation that overlaps with the old pipe C
-- * allocation
-- * | A | B | C |
-- *
-- * We need to sequence the re-allocation: C, B, A (and not B, C, A).
-- */
-+ skl_ddb_entry_write(dev_priv, PLANE_BUF_CFG(pipe, plane),
-+ &wm->ddb.plane[pipe][plane]);
-+ skl_ddb_entry_write(dev_priv, PLANE_NV12_BUF_CFG(pipe, plane),
-+ &wm->ddb.y_plane[pipe][plane]);
-+}
-
--static void
--skl_wm_flush_pipe(struct drm_i915_private *dev_priv, enum pipe pipe, int pass)
-+void skl_write_cursor_wm(struct intel_crtc *intel_crtc,
-+ const struct skl_wm_values *wm)
- {
-- int plane;
--
-- DRM_DEBUG_KMS("flush pipe %c (pass %d)\n", pipe_name(pipe), pass);
-+ struct drm_crtc *crtc = &intel_crtc->base;
-+ struct drm_device *dev = crtc->dev;
-+ struct drm_i915_private *dev_priv = to_i915(dev);
-+ int level, max_level = ilk_wm_max_level(dev);
-+ enum pipe pipe = intel_crtc->pipe;
-
-- for_each_plane(dev_priv, pipe, plane) {
-- I915_WRITE(PLANE_SURF(pipe, plane),
-- I915_READ(PLANE_SURF(pipe, plane)));
-+ for (level = 0; level <= max_level; level++) {
-+ I915_WRITE(CUR_WM(pipe, level),
-+ wm->plane[pipe][PLANE_CURSOR][level]);
- }
-- I915_WRITE(CURBASE(pipe), I915_READ(CURBASE(pipe)));
-+ I915_WRITE(CUR_WM_TRANS(pipe), wm->plane_trans[pipe][PLANE_CURSOR]);
-+
-+ skl_ddb_entry_write(dev_priv, CUR_BUF_CFG(pipe),
-+ &wm->ddb.plane[pipe][PLANE_CURSOR]);
- }
-
--static bool
--skl_ddb_allocation_included(const struct skl_ddb_allocation *old,
-- const struct skl_ddb_allocation *new,
-- enum pipe pipe)
-+bool skl_ddb_allocation_equals(const struct skl_ddb_allocation *old,
-+ const struct skl_ddb_allocation *new,
-+ enum pipe pipe)
- {
-- uint16_t old_size, new_size;
--
-- old_size = skl_ddb_entry_size(&old->pipe[pipe]);
-- new_size = skl_ddb_entry_size(&new->pipe[pipe]);
--
-- return old_size != new_size &&
-- new->pipe[pipe].start >= old->pipe[pipe].start &&
-- new->pipe[pipe].end <= old->pipe[pipe].end;
-+ return new->pipe[pipe].start == old->pipe[pipe].start &&
-+ new->pipe[pipe].end == old->pipe[pipe].end;
- }
-
--static void skl_flush_wm_values(struct drm_i915_private *dev_priv,
-- struct skl_wm_values *new_values)
-+static inline bool skl_ddb_entries_overlap(const struct skl_ddb_entry *a,
-+ const struct skl_ddb_entry *b)
- {
-- struct drm_device *dev = &dev_priv->drm;
-- struct skl_ddb_allocation *cur_ddb, *new_ddb;
-- bool reallocated[I915_MAX_PIPES] = {};
-- struct intel_crtc *crtc;
-- enum pipe pipe;
--
-- new_ddb = &new_values->ddb;
-- cur_ddb = &dev_priv->wm.skl_hw.ddb;
--
-- /*
-- * First pass: flush the pipes with the new allocation contained into
-- * the old space.
-- *
-- * We'll wait for the vblank on those pipes to ensure we can safely
-- * re-allocate the freed space without this pipe fetching from it.
-- */
-- for_each_intel_crtc(dev, crtc) {
-- if (!crtc->active)
-- continue;
--
-- pipe = crtc->pipe;
--
-- if (!skl_ddb_allocation_included(cur_ddb, new_ddb, pipe))
-- continue;
--
-- skl_wm_flush_pipe(dev_priv, pipe, 1);
-- intel_wait_for_vblank(dev, pipe);
--
-- reallocated[pipe] = true;
-- }
--
-+ return a->start < b->end && b->start < a->end;
-+}
-
-- /*
-- * Second pass: flush the pipes that are having their allocation
-- * reduced, but overlapping with a previous allocation.
-- *
-- * Here as well we need to wait for the vblank to make sure the freed
-- * space is not used anymore.
-- */
-- for_each_intel_crtc(dev, crtc) {
-- if (!crtc->active)
-- continue;
-+bool skl_ddb_allocation_overlaps(struct drm_atomic_state *state,
-+ const struct skl_ddb_allocation *old,
-+ const struct skl_ddb_allocation *new,
-+ enum pipe pipe)
-+{
-+ struct drm_device *dev = state->dev;
-+ struct intel_crtc *intel_crtc;
-+ enum pipe otherp;
-
-- pipe = crtc->pipe;
-+ for_each_intel_crtc(dev, intel_crtc) {
-+ otherp = intel_crtc->pipe;
-
-- if (reallocated[pipe])
-+ if (otherp == pipe)
- continue;
-
-- if (skl_ddb_entry_size(&new_ddb->pipe[pipe]) <
-- skl_ddb_entry_size(&cur_ddb->pipe[pipe])) {
-- skl_wm_flush_pipe(dev_priv, pipe, 2);
-- intel_wait_for_vblank(dev, pipe);
-- reallocated[pipe] = true;
-- }
-+ if (skl_ddb_entries_overlap(&new->pipe[pipe],
-+ &old->pipe[otherp]))
-+ return true;
- }
-
-- /*
-- * Third pass: flush the pipes that got more space allocated.
-- *
-- * We don't need to actively wait for the update here, next vblank
-- * will just get more DDB space with the correct WM values.
-- */
-- for_each_intel_crtc(dev, crtc) {
-- if (!crtc->active)
-- continue;
--
-- pipe = crtc->pipe;
--
-- /*
-- * At this point, only the pipes more space than before are
-- * left to re-allocate.
-- */
-- if (reallocated[pipe])
-- continue;
--
-- skl_wm_flush_pipe(dev_priv, pipe, 3);
-- }
-+ return false;
- }
-
- static int skl_update_pipe_wm(struct drm_crtc_state *cstate,
-@@ -4041,6 +3963,41 @@ pipes_modified(struct drm_atomic_state *state)
- return ret;
- }
-
-+int
-+skl_ddb_add_affected_planes(struct intel_crtc_state *cstate)
-+{
-+ struct drm_atomic_state *state = cstate->base.state;
-+ struct drm_device *dev = state->dev;
-+ struct drm_crtc *crtc = cstate->base.crtc;
-+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-+ struct drm_i915_private *dev_priv = to_i915(dev);
-+ struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
-+ struct skl_ddb_allocation *new_ddb = &intel_state->wm_results.ddb;
-+ struct skl_ddb_allocation *cur_ddb = &dev_priv->wm.skl_hw.ddb;
-+ struct drm_plane_state *plane_state;
-+ struct drm_plane *plane;
-+ enum pipe pipe = intel_crtc->pipe;
-+ int id;
-+
-+ WARN_ON(!drm_atomic_get_existing_crtc_state(state, crtc));
-+
-+ drm_for_each_plane_mask(plane, dev, crtc->state->plane_mask) {
-+ id = skl_wm_plane_id(to_intel_plane(plane));
-+
-+ if (skl_ddb_entry_equal(&cur_ddb->plane[pipe][id],
-+ &new_ddb->plane[pipe][id]) &&
-+ skl_ddb_entry_equal(&cur_ddb->y_plane[pipe][id],
-+ &new_ddb->y_plane[pipe][id]))
-+ continue;
-+
-+ plane_state = drm_atomic_get_plane_state(state, plane);
-+ if (IS_ERR(plane_state))
-+ return PTR_ERR(plane_state);
-+ }
-+
-+ return 0;
-+}
-+
- static int
- skl_compute_ddb(struct drm_atomic_state *state)
- {
-@@ -4105,6 +4062,10 @@ skl_compute_ddb(struct drm_atomic_state *state)
- if (ret)
- return ret;
-
-+ ret = skl_ddb_add_affected_planes(cstate);
-+ if (ret)
-+ return ret;
-+
- ret = drm_atomic_add_affected_planes(state, &intel_crtc->base);
- if (ret)
- return ret;
-@@ -4206,7 +4167,7 @@ static void skl_update_wm(struct drm_crtc *crtc)
- struct skl_wm_values *hw_vals = &dev_priv->wm.skl_hw;
- struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
- struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
-- int pipe;
-+ enum pipe pipe = intel_crtc->pipe;
-
- if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
- return;
-@@ -4215,15 +4176,22 @@ static void skl_update_wm(struct drm_crtc *crtc)
-
- mutex_lock(&dev_priv->wm.wm_mutex);
-
-- skl_write_wm_values(dev_priv, results);
-- skl_flush_wm_values(dev_priv, results);
--
- /*
-- * Store the new configuration (but only for the pipes that have
-- * changed; the other values weren't recomputed).
-+ * If this pipe isn't active already, we're going to be enabling it
-+ * very soon. Since it's safe to update a pipe's ddb allocation while
-+ * the pipe's shut off, just do so here. Already active pipes will have
-+ * their watermarks updated once we update their planes.
- */
-- for_each_pipe_masked(dev_priv, pipe, results->dirty_pipes)
-- skl_copy_wm_for_pipe(hw_vals, results, pipe);
-+ if (crtc->state->active_changed) {
-+ int plane;
-+
-+ for (plane = 0; plane < intel_num_planes(intel_crtc); plane++)
-+ skl_write_plane_wm(intel_crtc, results, plane);
-+
-+ skl_write_cursor_wm(intel_crtc, results);
-+ }
-+
-+ skl_copy_wm_for_pipe(hw_vals, results, pipe);
-
- mutex_unlock(&dev_priv->wm.wm_mutex);
- }
-diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
-index 7c08e4f..4178849 100644
---- a/drivers/gpu/drm/i915/intel_sprite.c
-+++ b/drivers/gpu/drm/i915/intel_sprite.c
-@@ -203,6 +203,9 @@ skl_update_plane(struct drm_plane *drm_plane,
- struct intel_plane *intel_plane = to_intel_plane(drm_plane);
- struct drm_framebuffer *fb = plane_state->base.fb;
- struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-+ const struct skl_wm_values *wm = &dev_priv->wm.skl_results;
-+ struct drm_crtc *crtc = crtc_state->base.crtc;
-+ struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- const int pipe = intel_plane->pipe;
- const int plane = intel_plane->plane + 1;
- u32 plane_ctl, stride_div, stride;
-@@ -238,6 +241,9 @@ skl_update_plane(struct drm_plane *drm_plane,
- crtc_w--;
- crtc_h--;
-
-+ if (wm->dirty_pipes & drm_crtc_mask(crtc))
-+ skl_write_plane_wm(intel_crtc, wm, plane);
-+
- if (key->flags) {
- I915_WRITE(PLANE_KEYVAL(pipe, plane), key->min_value);
- I915_WRITE(PLANE_KEYMAX(pipe, plane), key->max_value);
-@@ -308,6 +314,14 @@ skl_disable_plane(struct drm_plane *dplane, struct drm_crtc *crtc)
- const int pipe = intel_plane->pipe;
- const int plane = intel_plane->plane + 1;
-
-+ /*
-+ * We only populate skl_results on watermark updates, and if the
-+ * plane's visiblity isn't actually changing neither is its watermarks.
-+ */
-+ if (!to_intel_plane_state(dplane->state)->visible)
-+ skl_write_plane_wm(to_intel_crtc(crtc),
-+ &dev_priv->wm.skl_results, plane);
-+
- I915_WRITE(PLANE_CTL(pipe, plane), 0);
-
- I915_WRITE(PLANE_SURF(pipe, plane), 0);
-diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
-index ff80a81..ec28b15 100644
---- a/drivers/gpu/drm/i915/intel_uncore.c
-+++ b/drivers/gpu/drm/i915/intel_uncore.c
-@@ -796,10 +796,9 @@ __unclaimed_reg_debug(struct drm_i915_private *dev_priv,
- const bool read,
- const bool before)
- {
-- if (WARN(check_for_unclaimed_mmio(dev_priv),
-- "Unclaimed register detected %s %s register 0x%x\n",
-- before ? "before" : "after",
-- read ? "reading" : "writing to",
-+ if (WARN(check_for_unclaimed_mmio(dev_priv) && !before,
-+ "Unclaimed %s register 0x%x\n",
-+ read ? "read from" : "write to",
- i915_mmio_reg_offset(reg)))
- i915.mmio_debug--; /* Only report the first N failures */
- }
-diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
-index 6a4b020..5a26eb4 100644
---- a/drivers/gpu/drm/radeon/r600_dpm.c
-+++ b/drivers/gpu/drm/radeon/r600_dpm.c
-@@ -156,19 +156,20 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
- struct drm_device *dev = rdev->ddev;
- struct drm_crtc *crtc;
- struct radeon_crtc *radeon_crtc;
-- u32 line_time_us, vblank_lines;
-+ u32 vblank_in_pixels;
- u32 vblank_time_us = 0xffffffff; /* if the displays are off, vblank time is max */
-
- if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
- list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
- radeon_crtc = to_radeon_crtc(crtc);
- if (crtc->enabled && radeon_crtc->enabled && radeon_crtc->hw_mode.clock) {
-- line_time_us = (radeon_crtc->hw_mode.crtc_htotal * 1000) /
-- radeon_crtc->hw_mode.clock;
-- vblank_lines = radeon_crtc->hw_mode.crtc_vblank_end -
-- radeon_crtc->hw_mode.crtc_vdisplay +
-- (radeon_crtc->v_border * 2);
-- vblank_time_us = vblank_lines * line_time_us;
-+ vblank_in_pixels =
-+ radeon_crtc->hw_mode.crtc_htotal *
-+ (radeon_crtc->hw_mode.crtc_vblank_end -
-+ radeon_crtc->hw_mode.crtc_vdisplay +
-+ (radeon_crtc->v_border * 2));
-+
-+ vblank_time_us = vblank_in_pixels * 1000 / radeon_crtc->hw_mode.clock;
- break;
- }
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index a00dd2f..554ca71 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -661,8 +661,9 @@ bool radeon_card_posted(struct radeon_device *rdev)
- {
- uint32_t reg;
-
-- /* for pass through, always force asic_init */
-- if (radeon_device_is_virtual())
-+ /* for pass through, always force asic_init for CI */
-+ if (rdev->family >= CHIP_BONAIRE &&
-+ radeon_device_is_virtual())
- return false;
-
- /* required for EFI mode on macbook2,1 which uses an r5xx asic */
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 1f78ec2..89bdf20 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -4112,7 +4112,7 @@ static int si_populate_smc_voltage_tables(struct radeon_device *rdev,
- &rdev->pm.dpm.dyn_state.phase_shedding_limits_table)) {
- si_populate_smc_voltage_table(rdev, &si_pi->vddc_phase_shed_table, table);
-
-- table->phaseMaskTable.lowMask[SISLANDS_SMC_VOLTAGEMASK_VDDC] =
-+ table->phaseMaskTable.lowMask[SISLANDS_SMC_VOLTAGEMASK_VDDC_PHASE_SHEDDING] =
- cpu_to_be32(si_pi->vddc_phase_shed_table.mask_low);
-
- si_write_smc_soft_register(rdev, SI_SMC_SOFT_REGISTER_phase_shedding_delay,
-diff --git a/drivers/gpu/drm/radeon/sislands_smc.h b/drivers/gpu/drm/radeon/sislands_smc.h
-index 3c77983..966e3a5 100644
---- a/drivers/gpu/drm/radeon/sislands_smc.h
-+++ b/drivers/gpu/drm/radeon/sislands_smc.h
-@@ -194,6 +194,7 @@ typedef struct SISLANDS_SMC_SWSTATE SISLANDS_SMC_SWSTATE;
- #define SISLANDS_SMC_VOLTAGEMASK_VDDC 0
- #define SISLANDS_SMC_VOLTAGEMASK_MVDD 1
- #define SISLANDS_SMC_VOLTAGEMASK_VDDCI 2
-+#define SISLANDS_SMC_VOLTAGEMASK_VDDC_PHASE_SHEDDING 3
- #define SISLANDS_SMC_VOLTAGEMASK_MAX 4
-
- struct SISLANDS_SMC_VOLTAGEMASKTABLE
-diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
-index 428e249..f696b75 100644
---- a/drivers/gpu/drm/vc4/vc4_drv.h
-+++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -122,9 +122,16 @@ to_vc4_dev(struct drm_device *dev)
- struct vc4_bo {
- struct drm_gem_cma_object base;
-
-- /* seqno of the last job to render to this BO. */
-+ /* seqno of the last job to render using this BO. */
- uint64_t seqno;
-
-+ /* seqno of the last job to use the RCL to write to this BO.
-+ *
-+ * Note that this doesn't include binner overflow memory
-+ * writes.
-+ */
-+ uint64_t write_seqno;
-+
- /* List entry for the BO's position in either
- * vc4_exec_info->unref_list or vc4_dev->bo_cache.time_list
- */
-@@ -216,6 +223,9 @@ struct vc4_exec_info {
- /* Sequence number for this bin/render job. */
- uint64_t seqno;
-
-+ /* Latest write_seqno of any BO that binning depends on. */
-+ uint64_t bin_dep_seqno;
-+
- /* Last current addresses the hardware was processing when the
- * hangcheck timer checked on us.
- */
-@@ -230,6 +240,13 @@ struct vc4_exec_info {
- struct drm_gem_cma_object **bo;
- uint32_t bo_count;
-
-+ /* List of BOs that are being written by the RCL. Other than
-+ * the binner temporary storage, this is all the BOs written
-+ * by the job.
-+ */
-+ struct drm_gem_cma_object *rcl_write_bo[4];
-+ uint32_t rcl_write_bo_count;
-+
- /* Pointers for our position in vc4->job_list */
- struct list_head head;
-
-diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
-index b262c5c..ae1609e 100644
---- a/drivers/gpu/drm/vc4/vc4_gem.c
-+++ b/drivers/gpu/drm/vc4/vc4_gem.c
-@@ -471,6 +471,11 @@ vc4_update_bo_seqnos(struct vc4_exec_info *exec, uint64_t seqno)
- list_for_each_entry(bo, &exec->unref_list, unref_head) {
- bo->seqno = seqno;
- }
-+
-+ for (i = 0; i < exec->rcl_write_bo_count; i++) {
-+ bo = to_vc4_bo(&exec->rcl_write_bo[i]->base);
-+ bo->write_seqno = seqno;
-+ }
- }
-
- /* Queues a struct vc4_exec_info for execution. If no job is
-@@ -673,6 +678,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
- goto fail;
-
- ret = vc4_validate_shader_recs(dev, exec);
-+ if (ret)
-+ goto fail;
-+
-+ /* Block waiting on any previous rendering into the CS's VBO,
-+ * IB, or textures, so that pixels are actually written by the
-+ * time we try to read them.
-+ */
-+ ret = vc4_wait_for_seqno(dev, exec->bin_dep_seqno, ~0ull, true);
-
- fail:
- drm_free_large(temp);
-diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
-index 0f12418..08886a3 100644
---- a/drivers/gpu/drm/vc4/vc4_render_cl.c
-+++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
-@@ -45,6 +45,8 @@ struct vc4_rcl_setup {
-
- struct drm_gem_cma_object *rcl;
- u32 next_offset;
-+
-+ u32 next_write_bo_index;
- };
-
- static inline void rcl_u8(struct vc4_rcl_setup *setup, u8 val)
-@@ -407,6 +409,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
- if (!*obj)
- return -EINVAL;
-
-+ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- if (surf->offset & 0xf) {
- DRM_ERROR("MSAA write must be 16b aligned.\n");
- return -EINVAL;
-@@ -417,7 +421,8 @@ static int vc4_rcl_msaa_surface_setup(struct vc4_exec_info *exec,
-
- static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
- struct drm_gem_cma_object **obj,
-- struct drm_vc4_submit_rcl_surface *surf)
-+ struct drm_vc4_submit_rcl_surface *surf,
-+ bool is_write)
- {
- uint8_t tiling = VC4_GET_FIELD(surf->bits,
- VC4_LOADSTORE_TILE_BUFFER_TILING);
-@@ -440,6 +445,9 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
- if (!*obj)
- return -EINVAL;
-
-+ if (is_write)
-+ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- if (surf->flags & VC4_SUBMIT_RCL_SURFACE_READ_IS_FULL_RES) {
- if (surf == &exec->args->zs_write) {
- DRM_ERROR("general zs write may not be a full-res.\n");
-@@ -542,6 +550,8 @@ vc4_rcl_render_config_surface_setup(struct vc4_exec_info *exec,
- if (!*obj)
- return -EINVAL;
-
-+ exec->rcl_write_bo[exec->rcl_write_bo_count++] = *obj;
-+
- if (tiling > VC4_TILING_FORMAT_LT) {
- DRM_ERROR("Bad tiling format\n");
- return -EINVAL;
-@@ -599,15 +609,18 @@ int vc4_get_rcl(struct drm_device *dev, struct vc4_exec_info *exec)
- if (ret)
- return ret;
-
-- ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read);
-+ ret = vc4_rcl_surface_setup(exec, &setup.color_read, &args->color_read,
-+ false);
- if (ret)
- return ret;
-
-- ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read);
-+ ret = vc4_rcl_surface_setup(exec, &setup.zs_read, &args->zs_read,
-+ false);
- if (ret)
- return ret;
-
-- ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write);
-+ ret = vc4_rcl_surface_setup(exec, &setup.zs_write, &args->zs_write,
-+ true);
- if (ret)
- return ret;
-
-diff --git a/drivers/gpu/drm/vc4/vc4_validate.c b/drivers/gpu/drm/vc4/vc4_validate.c
-index 9ce1d0a..26503e3 100644
---- a/drivers/gpu/drm/vc4/vc4_validate.c
-+++ b/drivers/gpu/drm/vc4/vc4_validate.c
-@@ -267,6 +267,9 @@ validate_indexed_prim_list(VALIDATE_ARGS)
- if (!ib)
- return -EINVAL;
-
-+ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+ to_vc4_bo(&ib->base)->write_seqno);
-+
- if (offset > ib->base.size ||
- (ib->base.size - offset) / index_size < length) {
- DRM_ERROR("IB access overflow (%d + %d*%d > %zd)\n",
-@@ -555,8 +558,7 @@ static bool
- reloc_tex(struct vc4_exec_info *exec,
- void *uniform_data_u,
- struct vc4_texture_sample_info *sample,
-- uint32_t texture_handle_index)
--
-+ uint32_t texture_handle_index, bool is_cs)
- {
- struct drm_gem_cma_object *tex;
- uint32_t p0 = *(uint32_t *)(uniform_data_u + sample->p_offset[0]);
-@@ -714,6 +716,11 @@ reloc_tex(struct vc4_exec_info *exec,
-
- *validated_p0 = tex->paddr + p0;
-
-+ if (is_cs) {
-+ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+ to_vc4_bo(&tex->base)->write_seqno);
-+ }
-+
- return true;
- fail:
- DRM_INFO("Texture p0 at %d: 0x%08x\n", sample->p_offset[0], p0);
-@@ -835,7 +842,8 @@ validate_gl_shader_rec(struct drm_device *dev,
- if (!reloc_tex(exec,
- uniform_data_u,
- &validated_shader->texture_samples[tex],
-- texture_handles_u[tex])) {
-+ texture_handles_u[tex],
-+ i == 2)) {
- return -EINVAL;
- }
- }
-@@ -867,6 +875,9 @@ validate_gl_shader_rec(struct drm_device *dev,
- uint32_t stride = *(uint8_t *)(pkt_u + o + 5);
- uint32_t max_index;
-
-+ exec->bin_dep_seqno = max(exec->bin_dep_seqno,
-+ to_vc4_bo(&vbo->base)->write_seqno);
-+
- if (state->addr & 0x8)
- stride |= (*(uint32_t *)(pkt_u + 100 + i * 4)) & ~0xff;
-
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-index dc5beff..8a15c4a 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-@@ -34,6 +34,24 @@
-
- #define VMW_RES_HT_ORDER 12
-
-+ /**
-+ * enum vmw_resource_relocation_type - Relocation type for resources
-+ *
-+ * @vmw_res_rel_normal: Traditional relocation. The resource id in the
-+ * command stream is replaced with the actual id after validation.
-+ * @vmw_res_rel_nop: NOP relocation. The command is unconditionally replaced
-+ * with a NOP.
-+ * @vmw_res_rel_cond_nop: Conditional NOP relocation. If the resource id
-+ * after validation is -1, the command is replaced with a NOP. Otherwise no
-+ * action.
-+ */
-+enum vmw_resource_relocation_type {
-+ vmw_res_rel_normal,
-+ vmw_res_rel_nop,
-+ vmw_res_rel_cond_nop,
-+ vmw_res_rel_max
-+};
-+
- /**
- * struct vmw_resource_relocation - Relocation info for resources
- *
-@@ -41,11 +59,13 @@
- * @res: Non-ref-counted pointer to the resource.
- * @offset: Offset of 4 byte entries into the command buffer where the
- * id that needs fixup is located.
-+ * @rel_type: Type of relocation.
- */
- struct vmw_resource_relocation {
- struct list_head head;
- const struct vmw_resource *res;
-- unsigned long offset;
-+ u32 offset:29;
-+ enum vmw_resource_relocation_type rel_type:3;
- };
-
- /**
-@@ -410,10 +430,13 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv,
- * @res: The resource.
- * @offset: Offset into the command buffer currently being parsed where the
- * id that needs fixup is located. Granularity is 4 bytes.
-+ * @rel_type: Relocation type.
- */
- static int vmw_resource_relocation_add(struct list_head *list,
- const struct vmw_resource *res,
-- unsigned long offset)
-+ unsigned long offset,
-+ enum vmw_resource_relocation_type
-+ rel_type)
- {
- struct vmw_resource_relocation *rel;
-
-@@ -425,6 +448,7 @@ static int vmw_resource_relocation_add(struct list_head *list,
-
- rel->res = res;
- rel->offset = offset;
-+ rel->rel_type = rel_type;
- list_add_tail(&rel->head, list);
-
- return 0;
-@@ -459,11 +483,23 @@ static void vmw_resource_relocations_apply(uint32_t *cb,
- {
- struct vmw_resource_relocation *rel;
-
-+ /* Validate the struct vmw_resource_relocation member size */
-+ BUILD_BUG_ON(SVGA_CB_MAX_SIZE >= (1 << 29));
-+ BUILD_BUG_ON(vmw_res_rel_max >= (1 << 3));
-+
- list_for_each_entry(rel, list, head) {
-- if (likely(rel->res != NULL))
-+ switch (rel->rel_type) {
-+ case vmw_res_rel_normal:
- cb[rel->offset] = rel->res->id;
-- else
-+ break;
-+ case vmw_res_rel_nop:
- cb[rel->offset] = SVGA_3D_CMD_NOP;
-+ break;
-+ default:
-+ if (rel->res->id == -1)
-+ cb[rel->offset] = SVGA_3D_CMD_NOP;
-+ break;
-+ }
- }
- }
-
-@@ -655,7 +691,8 @@ static int vmw_cmd_res_reloc_add(struct vmw_private *dev_priv,
- *p_val = NULL;
- ret = vmw_resource_relocation_add(&sw_context->res_relocations,
- res,
-- id_loc - sw_context->buf_start);
-+ id_loc - sw_context->buf_start,
-+ vmw_res_rel_normal);
- if (unlikely(ret != 0))
- return ret;
-
-@@ -721,7 +758,8 @@ vmw_cmd_res_check(struct vmw_private *dev_priv,
-
- return vmw_resource_relocation_add
- (&sw_context->res_relocations, res,
-- id_loc - sw_context->buf_start);
-+ id_loc - sw_context->buf_start,
-+ vmw_res_rel_normal);
- }
-
- ret = vmw_user_resource_lookup_handle(dev_priv,
-@@ -2144,7 +2182,8 @@ static int vmw_cmd_shader_define(struct vmw_private *dev_priv,
-
- return vmw_resource_relocation_add(&sw_context->res_relocations,
- NULL, &cmd->header.id -
-- sw_context->buf_start);
-+ sw_context->buf_start,
-+ vmw_res_rel_nop);
-
- return 0;
- }
-@@ -2189,7 +2228,8 @@ static int vmw_cmd_shader_destroy(struct vmw_private *dev_priv,
-
- return vmw_resource_relocation_add(&sw_context->res_relocations,
- NULL, &cmd->header.id -
-- sw_context->buf_start);
-+ sw_context->buf_start,
-+ vmw_res_rel_nop);
-
- return 0;
- }
-@@ -2848,8 +2888,7 @@ static int vmw_cmd_dx_cid_check(struct vmw_private *dev_priv,
- * @header: Pointer to the command header in the command stream.
- *
- * Check that the view exists, and if it was not created using this
-- * command batch, make sure it's validated (present in the device) so that
-- * the remove command will not confuse the device.
-+ * command batch, conditionally make this command a NOP.
- */
- static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
- struct vmw_sw_context *sw_context,
-@@ -2877,10 +2916,15 @@ static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
- return ret;
-
- /*
-- * Add view to the validate list iff it was not created using this
-- * command batch.
-+ * If the view wasn't created during this command batch, it might
-+ * have been removed due to a context swapout, so add a
-+ * relocation to conditionally make this command a NOP to avoid
-+ * device errors.
- */
-- return vmw_view_res_val_add(sw_context, view);
-+ return vmw_resource_relocation_add(&sw_context->res_relocations,
-+ view,
-+ &cmd->header.id - sw_context->buf_start,
-+ vmw_res_rel_cond_nop);
- }
-
- /**
-@@ -3848,14 +3892,14 @@ static void *vmw_execbuf_cmdbuf(struct vmw_private *dev_priv,
- int ret;
-
- *header = NULL;
-- if (!dev_priv->cman || kernel_commands)
-- return kernel_commands;
--
- if (command_size > SVGA_CB_MAX_SIZE) {
- DRM_ERROR("Command buffer is too large.\n");
- return ERR_PTR(-EINVAL);
- }
-
-+ if (!dev_priv->cman || kernel_commands)
-+ return kernel_commands;
-+
- /* If possible, add a little space for fencing. */
- cmdbuf_size = command_size + 512;
- cmdbuf_size = min_t(size_t, cmdbuf_size, SVGA_CB_MAX_SIZE);
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index 4ed9a4f..e92b09d 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -64,6 +64,9 @@
- #define USB_VENDOR_ID_AKAI 0x2011
- #define USB_DEVICE_ID_AKAI_MPKMINI2 0x0715
-
-+#define USB_VENDOR_ID_AKAI_09E8 0x09E8
-+#define USB_DEVICE_ID_AKAI_09E8_MIDIMIX 0x0031
-+
- #define USB_VENDOR_ID_ALCOR 0x058f
- #define USB_DEVICE_ID_ALCOR_USBRS232 0x9720
-
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index b4b8c6a..bb40008 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -56,6 +56,7 @@ static const struct hid_blacklist {
-
- { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
-+ { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
-diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
-index 9e02ac9..3978cbb 100644
---- a/drivers/hwtracing/coresight/coresight-tmc.c
-+++ b/drivers/hwtracing/coresight/coresight-tmc.c
-@@ -388,9 +388,6 @@ static int tmc_probe(struct amba_device *adev, const struct amba_id *id)
- err_misc_register:
- coresight_unregister(drvdata->csdev);
- err_devm_kzalloc:
-- if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
-- dma_free_coherent(dev, drvdata->size,
-- drvdata->vaddr, drvdata->paddr);
- return ret;
- }
-
-diff --git a/drivers/iio/dac/ad5755.c b/drivers/iio/dac/ad5755.c
-index 0fde593..5f79682 100644
---- a/drivers/iio/dac/ad5755.c
-+++ b/drivers/iio/dac/ad5755.c
-@@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad5755_parse_dt(struct device *dev)
-
- devnr = 0;
- for_each_child_of_node(np, pp) {
-- if (devnr > AD5755_NUM_CHANNELS) {
-+ if (devnr >= AD5755_NUM_CHANNELS) {
- dev_err(dev,
- "There is to many channels defined in DT\n");
- goto error_out;
-diff --git a/drivers/iio/light/us5182d.c b/drivers/iio/light/us5182d.c
-index 20c40f7..18cf2e2 100644
---- a/drivers/iio/light/us5182d.c
-+++ b/drivers/iio/light/us5182d.c
-@@ -894,7 +894,7 @@ static int us5182d_probe(struct i2c_client *client,
- goto out_err;
-
- if (data->default_continuous) {
-- pm_runtime_set_active(&client->dev);
-+ ret = pm_runtime_set_active(&client->dev);
- if (ret < 0)
- goto out_err;
- }
-diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
-index 4e4d831..c17c9dd 100644
---- a/drivers/infiniband/hw/hfi1/qp.c
-+++ b/drivers/infiniband/hw/hfi1/qp.c
-@@ -808,6 +808,13 @@ void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp,
- kfree(priv);
- return ERR_PTR(-ENOMEM);
- }
-+ iowait_init(
-+ &priv->s_iowait,
-+ 1,
-+ _hfi1_do_send,
-+ iowait_sleep,
-+ iowait_wakeup,
-+ iowait_sdma_drained);
- setup_timer(&priv->s_rnr_timer, hfi1_rc_rnr_retry, (unsigned long)qp);
- qp->s_timer.function = hfi1_rc_timeout;
- return priv;
-@@ -873,13 +880,6 @@ void notify_qp_reset(struct rvt_qp *qp)
- {
- struct hfi1_qp_priv *priv = qp->priv;
-
-- iowait_init(
-- &priv->s_iowait,
-- 1,
-- _hfi1_do_send,
-- iowait_sleep,
-- iowait_wakeup,
-- iowait_sdma_drained);
- priv->r_adefered = 0;
- clear_ahg(qp);
- }
-diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
-index e19537c..bff8707a 100644
---- a/drivers/infiniband/hw/mlx5/main.c
-+++ b/drivers/infiniband/hw/mlx5/main.c
-@@ -1843,6 +1843,7 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de
- &leftovers_specs[LEFTOVERS_UC].flow_attr,
- dst);
- if (IS_ERR(handler_ucast)) {
-+ mlx5_del_flow_rule(handler->rule);
- kfree(handler);
- handler = handler_ucast;
- } else {
-diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
-index bbf0a16..54bb655f 100644
---- a/drivers/infiniband/hw/qib/qib.h
-+++ b/drivers/infiniband/hw/qib/qib.h
-@@ -1131,7 +1131,6 @@ extern spinlock_t qib_devs_lock;
- extern struct qib_devdata *qib_lookup(int unit);
- extern u32 qib_cpulist_count;
- extern unsigned long *qib_cpulist;
--extern u16 qpt_mask;
- extern unsigned qib_cc_table_size;
-
- int qib_init(struct qib_devdata *, int);
-diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
-index f9b8cd2..99d31ef 100644
---- a/drivers/infiniband/hw/qib/qib_qp.c
-+++ b/drivers/infiniband/hw/qib/qib_qp.c
-@@ -41,14 +41,6 @@
-
- #include "qib.h"
-
--/*
-- * mask field which was present in now deleted qib_qpn_table
-- * is not present in rvt_qpn_table. Defining the same field
-- * as qpt_mask here instead of adding the mask field to
-- * rvt_qpn_table.
-- */
--u16 qpt_mask;
--
- static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
- struct rvt_qpn_map *map, unsigned off)
- {
-@@ -57,7 +49,7 @@ static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
-
- static inline unsigned find_next_offset(struct rvt_qpn_table *qpt,
- struct rvt_qpn_map *map, unsigned off,
-- unsigned n)
-+ unsigned n, u16 qpt_mask)
- {
- if (qpt_mask) {
- off++;
-@@ -179,6 +171,7 @@ int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
- struct qib_ibdev *verbs_dev = container_of(rdi, struct qib_ibdev, rdi);
- struct qib_devdata *dd = container_of(verbs_dev, struct qib_devdata,
- verbs_dev);
-+ u16 qpt_mask = dd->qpn_mask;
-
- if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
- unsigned n;
-@@ -215,7 +208,7 @@ int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
- goto bail;
- }
- offset = find_next_offset(qpt, map, offset,
-- dd->n_krcv_queues);
-+ dd->n_krcv_queues, qpt_mask);
- qpn = mk_qpn(qpt, map, offset);
- /*
- * This test differs from alloc_pidmap().
-diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
-index fd1dfbc..b2b845f 100644
---- a/drivers/infiniband/hw/qib/qib_verbs.c
-+++ b/drivers/infiniband/hw/qib/qib_verbs.c
-@@ -1606,8 +1606,6 @@ int qib_register_ib_device(struct qib_devdata *dd)
- /* Only need to initialize non-zero fields. */
- setup_timer(&dev->mem_timer, mem_timer, (unsigned long)dev);
-
-- qpt_mask = dd->qpn_mask;
--
- INIT_LIST_HEAD(&dev->piowait);
- INIT_LIST_HEAD(&dev->dmawait);
- INIT_LIST_HEAD(&dev->txwait);
-diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
-index 870b4f2..5911c53 100644
---- a/drivers/infiniband/sw/rdmavt/qp.c
-+++ b/drivers/infiniband/sw/rdmavt/qp.c
-@@ -501,12 +501,9 @@ static void rvt_remove_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp)
- */
- static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
- enum ib_qp_type type)
-- __releases(&qp->s_lock)
-- __releases(&qp->s_hlock)
-- __releases(&qp->r_lock)
-- __acquires(&qp->r_lock)
-- __acquires(&qp->s_hlock)
-- __acquires(&qp->s_lock)
-+ __must_hold(&qp->r_lock)
-+ __must_hold(&qp->s_hlock)
-+ __must_hold(&qp->s_lock)
- {
- if (qp->state != IB_QPS_RESET) {
- qp->state = IB_QPS_RESET;
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
-index 618f184..c65e17f 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_client.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
-@@ -1009,7 +1009,6 @@ int i40e_unregister_client(struct i40e_client *client)
- if (!i40e_client_is_registered(client)) {
- pr_info("i40e: Client %s has not been registered\n",
- client->name);
-- mutex_unlock(&i40e_client_mutex);
- ret = -ENODEV;
- goto out;
- }
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
-index dad15b6..c74d164 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_main.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
-@@ -7990,45 +7990,34 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf)
- static int i40e_config_rss_aq(struct i40e_vsi *vsi, const u8 *seed,
- u8 *lut, u16 lut_size)
- {
-- struct i40e_aqc_get_set_rss_key_data rss_key;
- struct i40e_pf *pf = vsi->back;
- struct i40e_hw *hw = &pf->hw;
-- bool pf_lut = false;
-- u8 *rss_lut;
-- int ret, i;
--
-- memcpy(&rss_key, seed, sizeof(rss_key));
--
-- rss_lut = kzalloc(pf->rss_table_size, GFP_KERNEL);
-- if (!rss_lut)
-- return -ENOMEM;
--
-- /* Populate the LUT with max no. of queues in round robin fashion */
-- for (i = 0; i < vsi->rss_table_size; i++)
-- rss_lut[i] = i % vsi->rss_size;
-+ int ret = 0;
-
-- ret = i40e_aq_set_rss_key(hw, vsi->id, &rss_key);
-- if (ret) {
-- dev_info(&pf->pdev->dev,
-- "Cannot set RSS key, err %s aq_err %s\n",
-- i40e_stat_str(&pf->hw, ret),
-- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
-- goto config_rss_aq_out;
-+ if (seed) {
-+ struct i40e_aqc_get_set_rss_key_data *seed_dw =
-+ (struct i40e_aqc_get_set_rss_key_data *)seed;
-+ ret = i40e_aq_set_rss_key(hw, vsi->id, seed_dw);
-+ if (ret) {
-+ dev_info(&pf->pdev->dev,
-+ "Cannot set RSS key, err %s aq_err %s\n",
-+ i40e_stat_str(hw, ret),
-+ i40e_aq_str(hw, hw->aq.asq_last_status));
-+ return ret;
-+ }
- }
-+ if (lut) {
-+ bool pf_lut = vsi->type == I40E_VSI_MAIN ? true : false;
-
-- if (vsi->type == I40E_VSI_MAIN)
-- pf_lut = true;
--
-- ret = i40e_aq_set_rss_lut(hw, vsi->id, pf_lut, rss_lut,
-- vsi->rss_table_size);
-- if (ret)
-- dev_info(&pf->pdev->dev,
-- "Cannot set RSS lut, err %s aq_err %s\n",
-- i40e_stat_str(&pf->hw, ret),
-- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
--
--config_rss_aq_out:
-- kfree(rss_lut);
-+ ret = i40e_aq_set_rss_lut(hw, vsi->id, pf_lut, lut, lut_size);
-+ if (ret) {
-+ dev_info(&pf->pdev->dev,
-+ "Cannot set RSS lut, err %s aq_err %s\n",
-+ i40e_stat_str(hw, ret),
-+ i40e_aq_str(hw, hw->aq.asq_last_status));
-+ return ret;
-+ }
-+ }
- return ret;
- }
-
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 24c8d65..09ca634 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -2394,6 +2394,8 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr)
- skb_queue_splice_init(&htt->rx_in_ord_compl_q, &rx_ind_q);
- spin_unlock_irqrestore(&htt->rx_in_ord_compl_q.lock, flags);
-
-+ ath10k_mac_tx_push_pending(ar);
-+
- spin_lock_irqsave(&htt->tx_fetch_ind_q.lock, flags);
- skb_queue_splice_init(&htt->tx_fetch_ind_q, &tx_ind_q);
- spin_unlock_irqrestore(&htt->tx_fetch_ind_q.lock, flags);
-diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
-index 0bbd0a0..146365b 100644
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -3777,7 +3777,9 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
- enum ath10k_hw_txrx_mode txmode;
- enum ath10k_mac_tx_path txpath;
- struct sk_buff *skb;
-+ struct ieee80211_hdr *hdr;
- size_t skb_len;
-+ bool is_mgmt, is_presp;
- int ret;
-
- spin_lock_bh(&ar->htt.tx_lock);
-@@ -3801,6 +3803,22 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
- skb_len = skb->len;
- txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
- txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
-+ is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
-+
-+ if (is_mgmt) {
-+ hdr = (struct ieee80211_hdr *)skb->data;
-+ is_presp = ieee80211_is_probe_resp(hdr->frame_control);
-+
-+ spin_lock_bh(&ar->htt.tx_lock);
-+ ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
-+
-+ if (ret) {
-+ ath10k_htt_tx_dec_pending(htt);
-+ spin_unlock_bh(&ar->htt.tx_lock);
-+ return ret;
-+ }
-+ spin_unlock_bh(&ar->htt.tx_lock);
-+ }
-
- ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
- if (unlikely(ret)) {
-@@ -3808,6 +3826,8 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
-
- spin_lock_bh(&ar->htt.tx_lock);
- ath10k_htt_tx_dec_pending(htt);
-+ if (is_mgmt)
-+ ath10k_htt_tx_mgmt_dec_pending(htt);
- spin_unlock_bh(&ar->htt.tx_lock);
-
- return ret;
-@@ -6538,7 +6558,7 @@ static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
- goto exit;
- }
-
-- ath10k_mac_update_bss_chan_survey(ar, survey->channel);
-+ ath10k_mac_update_bss_chan_survey(ar, &sband->channels[idx]);
-
- spin_lock_bh(&ar->data_lock);
- memcpy(survey, ar_survey, sizeof(*survey));
-diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
-index b29a86a..28ff5cb 100644
---- a/drivers/net/wireless/ath/ath10k/txrx.c
-+++ b/drivers/net/wireless/ath/ath10k/txrx.c
-@@ -119,8 +119,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
- ieee80211_tx_status(htt->ar->hw, msdu);
- /* we do not own the msdu anymore */
-
-- ath10k_mac_tx_push_pending(ar);
--
- return 0;
- }
-
-diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
-index 3ef4688..f67cc19 100644
---- a/drivers/net/wireless/ath/ath10k/wmi.h
-+++ b/drivers/net/wireless/ath/ath10k/wmi.h
-@@ -180,6 +180,7 @@ enum wmi_service {
- WMI_SERVICE_MESH_NON_11S,
- WMI_SERVICE_PEER_STATS,
- WMI_SERVICE_RESTRT_CHNL_SUPPORT,
-+ WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
- WMI_SERVICE_TX_MODE_PUSH_ONLY,
- WMI_SERVICE_TX_MODE_PUSH_PULL,
- WMI_SERVICE_TX_MODE_DYNAMIC,
-@@ -305,6 +306,7 @@ enum wmi_10_4_service {
- WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
- WMI_10_4_SERVICE_PEER_STATS,
- WMI_10_4_SERVICE_MESH_11S,
-+ WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
- WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
- WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
- WMI_10_4_SERVICE_TX_MODE_DYNAMIC,
-@@ -402,6 +404,7 @@ static inline char *wmi_service_name(int service_id)
- SVCSTR(WMI_SERVICE_MESH_NON_11S);
- SVCSTR(WMI_SERVICE_PEER_STATS);
- SVCSTR(WMI_SERVICE_RESTRT_CHNL_SUPPORT);
-+ SVCSTR(WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT);
- SVCSTR(WMI_SERVICE_TX_MODE_PUSH_ONLY);
- SVCSTR(WMI_SERVICE_TX_MODE_PUSH_PULL);
- SVCSTR(WMI_SERVICE_TX_MODE_DYNAMIC);
-@@ -652,6 +655,8 @@ static inline void wmi_10_4_svc_map(const __le32 *in, unsigned long *out,
- WMI_SERVICE_PEER_STATS, len);
- SVCMAP(WMI_10_4_SERVICE_MESH_11S,
- WMI_SERVICE_MESH_11S, len);
-+ SVCMAP(WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
-+ WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT, len);
- SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
- WMI_SERVICE_TX_MODE_PUSH_ONLY, len);
- SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
-diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-index 43f8f7d..adba3b0 100644
---- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
-@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr(struct iwl_trans *trans,
- __le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP));
- __le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP));
-
-- /* If OEM did not fuse address - get it from OTP */
-- if (!mac_addr0 && !mac_addr1) {
-- mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
-- mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
-- }
-+ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
-+ /*
-+ * If the OEM fused a valid address, use it instead of the one in the
-+ * OTP
-+ */
-+ if (is_valid_ether_addr(data->hw_addr))
-+ return;
-+
-+ mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
-+ mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
-
- iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
- }
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-index 7e0cdbf..794c574 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-@@ -1214,9 +1214,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
- }
-
- /* TODO: read the budget from BIOS / Platform NVM */
-- if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0)
-+ if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0) {
- ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START,
- mvm->cooling_dev.cur_state);
-+ if (ret)
-+ goto error;
-+ }
- #else
- /* Initialize tx backoffs to the minimal possible */
- iwl_mvm_tt_tx_backoff(mvm, 0);
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
-index 69c42ce..d742d27 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
-@@ -539,6 +539,11 @@ void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
- iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE,
- IWL_MVM_OFFCHANNEL_QUEUE,
- IWL_MAX_TID_COUNT, 0);
-+ else
-+ iwl_mvm_disable_txq(mvm,
-+ IWL_MVM_DQA_P2P_DEVICE_QUEUE,
-+ vif->hw_queue[0], IWL_MAX_TID_COUNT,
-+ 0);
-
- break;
- case NL80211_IFTYPE_AP:
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
-index df6c32c..afb7eb6 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
-@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
-
- mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-
-- /* not a data packet */
-- if (!ieee80211_is_data_qos(hdr->frame_control) ||
-- is_multicast_ether_addr(hdr->addr1))
-+ /* not a data packet or a bar */
-+ if (!ieee80211_is_back_req(hdr->frame_control) &&
-+ (!ieee80211_is_data_qos(hdr->frame_control) ||
-+ is_multicast_ether_addr(hdr->addr1)))
- return false;
-
- if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
-@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
-
- spin_lock_bh(&buffer->lock);
-
-+ if (ieee80211_is_back_req(hdr->frame_control)) {
-+ iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn);
-+ goto drop;
-+ }
-+
- /*
- * If there was a significant jump in the nssn - adjust.
- * If the SN is smaller than the NSSN it might need to first go into
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-index 3130b9c..e933c12 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(struct iwl_mvm *mvm, int queue, int tid,
- ret);
-
- /* Make sure the SCD wrptr is correctly set before reconfiguring */
-- iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac],
-- cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF,
-- ssn, wdg_timeout);
-+ iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
-
- /* TODO: Work-around SCD bug when moving back by multiples of 0x40 */
-
-@@ -1270,9 +1268,31 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
- ret = iwl_mvm_drain_sta(mvm, mvm_sta, false);
-
- /* If DQA is supported - the queues can be disabled now */
-- if (iwl_mvm_is_dqa_supported(mvm))
-+ if (iwl_mvm_is_dqa_supported(mvm)) {
-+ u8 reserved_txq = mvm_sta->reserved_queue;
-+ enum iwl_mvm_queue_status *status;
-+
- iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta);
-
-+ /*
-+ * If no traffic has gone through the reserved TXQ - it
-+ * is still marked as IWL_MVM_QUEUE_RESERVED, and
-+ * should be manually marked as free again
-+ */
-+ spin_lock_bh(&mvm->queue_info_lock);
-+ status = &mvm->queue_info[reserved_txq].status;
-+ if (WARN((*status != IWL_MVM_QUEUE_RESERVED) &&
-+ (*status != IWL_MVM_QUEUE_FREE),
-+ "sta_id %d reserved txq %d status %d",
-+ mvm_sta->sta_id, reserved_txq, *status)) {
-+ spin_unlock_bh(&mvm->queue_info_lock);
-+ return -EINVAL;
-+ }
-+
-+ *status = IWL_MVM_QUEUE_FREE;
-+ spin_unlock_bh(&mvm->queue_info_lock);
-+ }
-+
- if (vif->type == NL80211_IFTYPE_STATION &&
- mvmvif->ap_sta_id == mvm_sta->sta_id) {
- /* if associated - we can't remove the AP STA now */
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-index b3a87a3..a0c1e3d 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
- tid = IWL_MAX_TID_COUNT;
- }
-
-- if (iwl_mvm_is_dqa_supported(mvm))
-+ if (iwl_mvm_is_dqa_supported(mvm)) {
- txq_id = mvmsta->tid_data[tid].txq_id;
-
-+ if (ieee80211_is_mgmt(fc))
-+ tx_cmd->tid_tspec = IWL_TID_NON_QOS;
-+ }
-+
- /* Copy MAC header from skb into command buffer */
- memcpy(tx_cmd->hdr, hdr, hdrlen);
-
-diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
-index 1c7b006..b89596c 100644
---- a/drivers/net/wireless/marvell/mwifiex/join.c
-+++ b/drivers/net/wireless/marvell/mwifiex/join.c
-@@ -669,9 +669,8 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
- priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
- sizeof(priv->assoc_rsp_buf));
-
-- memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
--
- assoc_rsp->a_id = cpu_to_le16(aid);
-+ memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
-
- if (status_code) {
- priv->adapter->dbg.num_cmd_assoc_failure++;
-diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
-index a422f33..7e394d4 100644
---- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
-+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
-@@ -708,7 +708,11 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
-
- case EVENT_EXT_SCAN_REPORT:
- mwifiex_dbg(adapter, EVENT, "event: EXT_SCAN Report\n");
-- if (adapter->ext_scan && !priv->scan_aborting)
-+ /* We intend to skip this event during suspend, but handle
-+ * it in interface disabled case
-+ */
-+ if (adapter->ext_scan && (!priv->scan_aborting ||
-+ !netif_running(priv->netdev)))
- ret = mwifiex_handle_event_ext_scan_report(priv,
- adapter->event_skb->data);
-
-diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-index 7cf26c6..6005e14 100644
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-@@ -831,8 +831,10 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
- rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
- sizeof(struct usb_anchor),
- GFP_KERNEL);
-- if (!rt2x00dev->anchor)
-+ if (!rt2x00dev->anchor) {
-+ retval = -ENOMEM;
- goto exit_free_reg;
-+ }
-
- init_usb_anchor(rt2x00dev->anchor);
- return 0;
-diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
-index 935866f..a8b6949 100644
---- a/drivers/nvdimm/bus.c
-+++ b/drivers/nvdimm/bus.c
-@@ -217,6 +217,8 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
- return rc;
- if (cmd_rc < 0)
- return cmd_rc;
-+
-+ nvdimm_clear_from_poison_list(nvdimm_bus, phys, len);
- return clear_err.cleared;
- }
- EXPORT_SYMBOL_GPL(nvdimm_clear_poison);
-diff --git a/drivers/nvdimm/core.c b/drivers/nvdimm/core.c
-index 4d7bbd2..7ceba08 100644
---- a/drivers/nvdimm/core.c
-+++ b/drivers/nvdimm/core.c
-@@ -547,11 +547,12 @@ void nvdimm_badblocks_populate(struct nd_region *nd_region,
- }
- EXPORT_SYMBOL_GPL(nvdimm_badblocks_populate);
-
--static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
-+static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length,
-+ gfp_t flags)
- {
- struct nd_poison *pl;
-
-- pl = kzalloc(sizeof(*pl), GFP_KERNEL);
-+ pl = kzalloc(sizeof(*pl), flags);
- if (!pl)
- return -ENOMEM;
-
-@@ -567,7 +568,7 @@ static int bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
- struct nd_poison *pl;
-
- if (list_empty(&nvdimm_bus->poison_list))
-- return add_poison(nvdimm_bus, addr, length);
-+ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
-
- /*
- * There is a chance this is a duplicate, check for those first.
-@@ -587,7 +588,7 @@ static int bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
- * as any overlapping ranges will get resolved when the list is consumed
- * and converted to badblocks
- */
-- return add_poison(nvdimm_bus, addr, length);
-+ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
- }
-
- int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
-@@ -602,6 +603,70 @@ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
- }
- EXPORT_SYMBOL_GPL(nvdimm_bus_add_poison);
-
-+void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
-+ phys_addr_t start, unsigned int len)
-+{
-+ struct list_head *poison_list = &nvdimm_bus->poison_list;
-+ u64 clr_end = start + len - 1;
-+ struct nd_poison *pl, *next;
-+
-+ nvdimm_bus_lock(&nvdimm_bus->dev);
-+ WARN_ON_ONCE(list_empty(poison_list));
-+
-+ /*
-+ * [start, clr_end] is the poison interval being cleared.
-+ * [pl->start, pl_end] is the poison_list entry we're comparing
-+ * the above interval against. The poison list entry may need
-+ * to be modified (update either start or length), deleted, or
-+ * split into two based on the overlap characteristics
-+ */
-+
-+ list_for_each_entry_safe(pl, next, poison_list, list) {
-+ u64 pl_end = pl->start + pl->length - 1;
-+
-+ /* Skip intervals with no intersection */
-+ if (pl_end < start)
-+ continue;
-+ if (pl->start > clr_end)
-+ continue;
-+ /* Delete completely overlapped poison entries */
-+ if ((pl->start >= start) && (pl_end <= clr_end)) {
-+ list_del(&pl->list);
-+ kfree(pl);
-+ continue;
-+ }
-+ /* Adjust start point of partially cleared entries */
-+ if ((start <= pl->start) && (clr_end > pl->start)) {
-+ pl->length -= clr_end - pl->start + 1;
-+ pl->start = clr_end + 1;
-+ continue;
-+ }
-+ /* Adjust pl->length for partial clearing at the tail end */
-+ if ((pl->start < start) && (pl_end <= clr_end)) {
-+ /* pl->start remains the same */
-+ pl->length = start - pl->start;
-+ continue;
-+ }
-+ /*
-+ * If clearing in the middle of an entry, we split it into
-+ * two by modifying the current entry to represent one half of
-+ * the split, and adding a new entry for the second half.
-+ */
-+ if ((pl->start < start) && (pl_end > clr_end)) {
-+ u64 new_start = clr_end + 1;
-+ u64 new_len = pl_end - new_start + 1;
-+
-+ /* Add new entry covering the right half */
-+ add_poison(nvdimm_bus, new_start, new_len, GFP_NOIO);
-+ /* Adjust this entry to cover the left half */
-+ pl->length = start - pl->start;
-+ continue;
-+ }
-+ }
-+ nvdimm_bus_unlock(&nvdimm_bus->dev);
-+}
-+EXPORT_SYMBOL_GPL(nvdimm_clear_from_poison_list);
-+
- #ifdef CONFIG_BLK_DEV_INTEGRITY
- int nd_integrity_init(struct gendisk *disk, unsigned long meta_size)
- {
-diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
-index ef9893f..4f5e567 100644
---- a/drivers/pci/host/pci-aardvark.c
-+++ b/drivers/pci/host/pci-aardvark.c
-@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
- int err, res_valid = 0;
- struct device *dev = &pcie->pdev->dev;
- struct device_node *np = dev->of_node;
-- struct resource_entry *win;
-+ struct resource_entry *win, *tmp;
- resource_size_t iobase;
-
- INIT_LIST_HEAD(&pcie->resources);
-@@ -862,7 +862,7 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
- if (err)
- goto out_release_res;
-
-- resource_list_for_each_entry(win, &pcie->resources) {
-+ resource_list_for_each_entry_safe(win, tmp, &pcie->resources) {
- struct resource *res = win->res;
-
- switch (resource_type(res)) {
-@@ -874,9 +874,11 @@ static int advk_pcie_parse_request_of_pci_ranges(struct advk_pcie *pcie)
- lower_32_bits(res->start),
- OB_PCIE_IO);
- err = pci_remap_iospace(res, iobase);
-- if (err)
-+ if (err) {
- dev_warn(dev, "error %d: failed to map resource %pR\n",
- err, res);
-+ resource_list_destroy_entry(win);
-+ }
- break;
- case IORESOURCE_MEM:
- advk_pcie_set_ob_win(pcie, 0,
-diff --git a/drivers/pci/host/pci-host-common.c b/drivers/pci/host/pci-host-common.c
-index 9d9d34e..61eb4d4 100644
---- a/drivers/pci/host/pci-host-common.c
-+++ b/drivers/pci/host/pci-host-common.c
-@@ -29,7 +29,7 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev,
- int err, res_valid = 0;
- struct device_node *np = dev->of_node;
- resource_size_t iobase;
-- struct resource_entry *win;
-+ struct resource_entry *win, *tmp;
-
- err = of_pci_get_host_bridge_resources(np, 0, 0xff, resources, &iobase);
- if (err)
-@@ -39,15 +39,17 @@ static int gen_pci_parse_request_of_pci_ranges(struct device *dev,
- if (err)
- return err;
-
-- resource_list_for_each_entry(win, resources) {
-+ resource_list_for_each_entry_safe(win, tmp, resources) {
- struct resource *res = win->res;
-
- switch (resource_type(res)) {
- case IORESOURCE_IO:
- err = pci_remap_iospace(res, iobase);
-- if (err)
-+ if (err) {
- dev_warn(dev, "error %d: failed to map resource %pR\n",
- err, res);
-+ resource_list_destroy_entry(win);
-+ }
- break;
- case IORESOURCE_MEM:
- res_valid |= !(res->flags & IORESOURCE_PREFETCH);
-diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
-index 84d650d..7ec1e80 100644
---- a/drivers/pci/host/pci-tegra.c
-+++ b/drivers/pci/host/pci-tegra.c
-@@ -621,7 +621,11 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
- if (err < 0)
- return err;
-
-- pci_add_resource_offset(&sys->resources, &pcie->pio, sys->io_offset);
-+ err = pci_remap_iospace(&pcie->pio, pcie->io.start);
-+ if (!err)
-+ pci_add_resource_offset(&sys->resources, &pcie->pio,
-+ sys->io_offset);
-+
- pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset);
- pci_add_resource_offset(&sys->resources, &pcie->prefetch,
- sys->mem_offset);
-@@ -631,7 +635,6 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
- if (err < 0)
- return err;
-
-- pci_remap_iospace(&pcie->pio, pcie->io.start);
- return 1;
- }
-
-diff --git a/drivers/pci/host/pci-versatile.c b/drivers/pci/host/pci-versatile.c
-index f2344057..b7dc070 100644
---- a/drivers/pci/host/pci-versatile.c
-+++ b/drivers/pci/host/pci-versatile.c
-@@ -74,7 +74,7 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
- int err, mem = 1, res_valid = 0;
- struct device_node *np = dev->of_node;
- resource_size_t iobase;
-- struct resource_entry *win;
-+ struct resource_entry *win, *tmp;
-
- err = of_pci_get_host_bridge_resources(np, 0, 0xff, res, &iobase);
- if (err)
-@@ -84,15 +84,17 @@ static int versatile_pci_parse_request_of_pci_ranges(struct device *dev,
- if (err)
- goto out_release_res;
-
-- resource_list_for_each_entry(win, res) {
-+ resource_list_for_each_entry_safe(win, tmp, res) {
- struct resource *res = win->res;
-
- switch (resource_type(res)) {
- case IORESOURCE_IO:
- err = pci_remap_iospace(res, iobase);
-- if (err)
-+ if (err) {
- dev_warn(dev, "error %d: failed to map resource %pR\n",
- err, res);
-+ resource_list_destroy_entry(win);
-+ }
- break;
- case IORESOURCE_MEM:
- res_valid |= !(res->flags & IORESOURCE_PREFETCH);
-diff --git a/drivers/pci/host/pcie-designware.c b/drivers/pci/host/pcie-designware.c
-index 12afce1..2a500f2 100644
---- a/drivers/pci/host/pcie-designware.c
-+++ b/drivers/pci/host/pcie-designware.c
-@@ -436,7 +436,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
- struct resource *cfg_res;
- int i, ret;
- LIST_HEAD(res);
-- struct resource_entry *win;
-+ struct resource_entry *win, *tmp;
-
- cfg_res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "config");
- if (cfg_res) {
-@@ -457,17 +457,20 @@ int dw_pcie_host_init(struct pcie_port *pp)
- goto error;
-
- /* Get the I/O and memory ranges from DT */
-- resource_list_for_each_entry(win, &res) {
-+ resource_list_for_each_entry_safe(win, tmp, &res) {
- switch (resource_type(win->res)) {
- case IORESOURCE_IO:
-- pp->io = win->res;
-- pp->io->name = "I/O";
-- pp->io_size = resource_size(pp->io);
-- pp->io_bus_addr = pp->io->start - win->offset;
-- ret = pci_remap_iospace(pp->io, pp->io_base);
-- if (ret)
-+ ret = pci_remap_iospace(win->res, pp->io_base);
-+ if (ret) {
- dev_warn(pp->dev, "error %d: failed to map resource %pR\n",
-- ret, pp->io);
-+ ret, win->res);
-+ resource_list_destroy_entry(win);
-+ } else {
-+ pp->io = win->res;
-+ pp->io->name = "I/O";
-+ pp->io_size = resource_size(pp->io);
-+ pp->io_bus_addr = pp->io->start - win->offset;
-+ }
- break;
- case IORESOURCE_MEM:
- pp->mem = win->res;
-diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
-index 65db7a2..5f7fcc9 100644
---- a/drivers/pci/host/pcie-rcar.c
-+++ b/drivers/pci/host/pcie-rcar.c
-@@ -945,7 +945,7 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci)
- struct device *dev = pci->dev;
- struct device_node *np = dev->of_node;
- resource_size_t iobase;
-- struct resource_entry *win;
-+ struct resource_entry *win, *tmp;
-
- err = of_pci_get_host_bridge_resources(np, 0, 0xff, &pci->resources, &iobase);
- if (err)
-@@ -955,14 +955,17 @@ static int rcar_pcie_parse_request_of_pci_ranges(struct rcar_pcie *pci)
- if (err)
- goto out_release_res;
-
-- resource_list_for_each_entry(win, &pci->resources) {
-+ resource_list_for_each_entry_safe(win, tmp, &pci->resources) {
- struct resource *res = win->res;
-
- if (resource_type(res) == IORESOURCE_IO) {
- err = pci_remap_iospace(res, iobase);
-- if (err)
-+ if (err) {
- dev_warn(dev, "error %d: failed to map resource %pR\n",
- err, res);
-+
-+ resource_list_destroy_entry(win);
-+ }
- }
- }
-
-diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
-index 51c42d7..775c883 100644
---- a/drivers/pinctrl/qcom/pinctrl-msm.c
-+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
-@@ -156,7 +156,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
- spin_lock_irqsave(&pctrl->lock, flags);
-
- val = readl(pctrl->regs + g->ctl_reg);
-- val &= mask;
-+ val &= ~mask;
- val |= i << g->mux_bit;
- writel(val, pctrl->regs + g->ctl_reg);
-
-diff --git a/drivers/power/bq24257_charger.c b/drivers/power/bq24257_charger.c
-index 1fea2c7..6fc31bd 100644
---- a/drivers/power/bq24257_charger.c
-+++ b/drivers/power/bq24257_charger.c
-@@ -1068,6 +1068,12 @@ static int bq24257_probe(struct i2c_client *client,
- return ret;
- }
-
-+ ret = bq24257_power_supply_init(bq);
-+ if (ret < 0) {
-+ dev_err(dev, "Failed to register power supply\n");
-+ return ret;
-+ }
-+
- ret = devm_request_threaded_irq(dev, client->irq, NULL,
- bq24257_irq_handler_thread,
- IRQF_TRIGGER_FALLING |
-@@ -1078,12 +1084,6 @@ static int bq24257_probe(struct i2c_client *client,
- return ret;
- }
-
-- ret = bq24257_power_supply_init(bq);
-- if (ret < 0) {
-- dev_err(dev, "Failed to register power supply\n");
-- return ret;
-- }
--
- ret = sysfs_create_group(&bq->charger->dev.kobj, &bq24257_attr_group);
- if (ret < 0) {
- dev_err(dev, "Can't create sysfs entries\n");
-diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
-index 6b1577c..285b400 100644
---- a/drivers/s390/char/con3270.c
-+++ b/drivers/s390/char/con3270.c
-@@ -124,7 +124,12 @@ con3270_create_status(struct con3270 *cp)
- static void
- con3270_update_string(struct con3270 *cp, struct string *s, int nr)
- {
-- if (s->len >= cp->view.cols - 5)
-+ if (s->len < 4) {
-+ /* This indicates a bug, but printing a warning would
-+ * cause a deadlock. */
-+ return;
-+ }
-+ if (s->string[s->len - 4] != TO_RA)
- return;
- raw3270_buffer_address(cp->view.dev, s->string + s->len - 3,
- cp->view.cols * (nr + 1));
-@@ -460,11 +465,11 @@ con3270_cline_end(struct con3270 *cp)
- cp->cline->len + 4 : cp->view.cols;
- s = con3270_alloc_string(cp, size);
- memcpy(s->string, cp->cline->string, cp->cline->len);
-- if (s->len < cp->view.cols - 5) {
-+ if (cp->cline->len < cp->view.cols - 5) {
- s->string[s->len - 4] = TO_RA;
- s->string[s->len - 1] = 0;
- } else {
-- while (--size > cp->cline->len)
-+ while (--size >= cp->cline->len)
- s->string[size] = cp->view.ascebc[' '];
- }
- /* Replace cline with allocated line s and reset cline. */
-diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
-index 940e725..1167469 100644
---- a/drivers/s390/cio/chsc.c
-+++ b/drivers/s390/cio/chsc.c
-@@ -95,12 +95,13 @@ struct chsc_ssd_area {
- int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
- {
- struct chsc_ssd_area *ssd_area;
-+ unsigned long flags;
- int ccode;
- int ret;
- int i;
- int mask;
-
-- spin_lock_irq(&chsc_page_lock);
-+ spin_lock_irqsave(&chsc_page_lock, flags);
- memset(chsc_page, 0, PAGE_SIZE);
- ssd_area = chsc_page;
- ssd_area->request.length = 0x0010;
-@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
- ssd->fla[i] = ssd_area->fla[i];
- }
- out:
-- spin_unlock_irq(&chsc_page_lock);
-+ spin_unlock_irqrestore(&chsc_page_lock, flags);
- return ret;
- }
-
-@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsystem *css, int enable)
- u32 fmt : 4;
- u32 : 16;
- } __attribute__ ((packed)) *secm_area;
-+ unsigned long flags;
- int ret, ccode;
-
-- spin_lock_irq(&chsc_page_lock);
-+ spin_lock_irqsave(&chsc_page_lock, flags);
- memset(chsc_page, 0, PAGE_SIZE);
- secm_area = chsc_page;
- secm_area->request.length = 0x0050;
-@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsystem *css, int enable)
- CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n",
- secm_area->response.code);
- out:
-- spin_unlock_irq(&chsc_page_lock);
-+ spin_unlock_irqrestore(&chsc_page_lock, flags);
- return ret;
- }
-
-@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel_path *chp, u8 cmcv,
-
- int chsc_get_channel_measurement_chars(struct channel_path *chp)
- {
-+ unsigned long flags;
- int ccode, ret;
-
- struct {
-@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp)
- if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm)
- return -EINVAL;
-
-- spin_lock_irq(&chsc_page_lock);
-+ spin_lock_irqsave(&chsc_page_lock, flags);
- memset(chsc_page, 0, PAGE_SIZE);
- scmc_area = chsc_page;
- scmc_area->request.length = 0x0010;
-@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp)
- chsc_initialize_cmg_chars(chp, scmc_area->cmcv,
- (struct cmg_chars *) &scmc_area->data);
- out:
-- spin_unlock_irq(&chsc_page_lock);
-+ spin_unlock_irqrestore(&chsc_page_lock, flags);
- return ret;
- }
-
-@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteristics;
- int __init
- chsc_determine_css_characteristics(void)
- {
-+ unsigned long flags;
- int result;
- struct {
- struct chsc_header request;
-@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void)
- u32 chsc_char[508];
- } __attribute__ ((packed)) *scsc_area;
-
-- spin_lock_irq(&chsc_page_lock);
-+ spin_lock_irqsave(&chsc_page_lock, flags);
- memset(chsc_page, 0, PAGE_SIZE);
- scsc_area = chsc_page;
- scsc_area->request.length = 0x0010;
-@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void)
- CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n",
- scsc_area->response.code);
- exit:
-- spin_unlock_irq(&chsc_page_lock);
-+ spin_unlock_irqrestore(&chsc_page_lock, flags);
- return result;
- }
-
-diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
-index 661bb94..228b99e 100644
---- a/drivers/scsi/cxlflash/main.c
-+++ b/drivers/scsi/cxlflash/main.c
-@@ -823,17 +823,6 @@ static void notify_shutdown(struct cxlflash_cfg *cfg, bool wait)
- }
-
- /**
-- * cxlflash_shutdown() - shutdown handler
-- * @pdev: PCI device associated with the host.
-- */
--static void cxlflash_shutdown(struct pci_dev *pdev)
--{
-- struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
--
-- notify_shutdown(cfg, false);
--}
--
--/**
- * cxlflash_remove() - PCI entry point to tear down host
- * @pdev: PCI device associated with the host.
- *
-@@ -844,6 +833,11 @@ static void cxlflash_remove(struct pci_dev *pdev)
- struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
- ulong lock_flags;
-
-+ if (!pci_is_enabled(pdev)) {
-+ pr_debug("%s: Device is disabled\n", __func__);
-+ return;
-+ }
-+
- /* If a Task Management Function is active, wait for it to complete
- * before continuing with remove.
- */
-@@ -2685,7 +2679,7 @@ static struct pci_driver cxlflash_driver = {
- .id_table = cxlflash_pci_table,
- .probe = cxlflash_probe,
- .remove = cxlflash_remove,
-- .shutdown = cxlflash_shutdown,
-+ .shutdown = cxlflash_remove,
- .err_handler = &cxlflash_err_handler,
- };
-
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-index cd91a68..4cb7990 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-@@ -4701,7 +4701,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
- le16_to_cpu(mpi_reply->DevHandle));
- mpt3sas_trigger_scsi(ioc, data.skey, data.asc, data.ascq);
-
-- if (!(ioc->logging_level & MPT_DEBUG_REPLY) &&
-+ if ((ioc->logging_level & MPT_DEBUG_REPLY) &&
- ((scmd->sense_buffer[2] == UNIT_ATTENTION) ||
- (scmd->sense_buffer[2] == MEDIUM_ERROR) ||
- (scmd->sense_buffer[2] == HARDWARE_ERROR)))
-diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
-index 9e9dadb..eec5e3f 100644
---- a/drivers/spi/spi-fsl-dspi.c
-+++ b/drivers/spi/spi-fsl-dspi.c
-@@ -760,7 +760,6 @@ static int dspi_remove(struct platform_device *pdev)
- /* Disconnect from the SPI framework */
- clk_disable_unprepare(dspi->clk);
- spi_unregister_master(dspi->master);
-- spi_master_put(dspi->master);
-
- return 0;
- }
-diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig
-index 19c1572..800245e 100644
---- a/drivers/staging/android/ion/Kconfig
-+++ b/drivers/staging/android/ion/Kconfig
-@@ -36,6 +36,7 @@ config ION_TEGRA
- config ION_HISI
- tristate "Ion for Hisilicon"
- depends on ARCH_HISI && ION
-+ select ION_OF
- help
- Choose this option if you wish to use ion on Hisilicon Platform.
-
-diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
-index a8822fe..f4cee81 100644
---- a/drivers/staging/ks7010/ks_hostif.c
-+++ b/drivers/staging/ks7010/ks_hostif.c
-@@ -69,16 +69,20 @@ inline u32 get_DWORD(struct ks_wlan_private *priv)
- return data;
- }
-
--void ks_wlan_hw_wakeup_task(struct work_struct *work)
-+static void ks_wlan_hw_wakeup_task(struct work_struct *work)
- {
- struct ks_wlan_private *priv =
- container_of(work, struct ks_wlan_private, ks_wlan_wakeup_task);
- int ps_status = atomic_read(&priv->psstatus.status);
-+ long time_left;
-
- if (ps_status == PS_SNOOZE) {
- ks_wlan_hw_wakeup_request(priv);
-- if (!wait_for_completion_interruptible_timeout(&priv->psstatus.wakeup_wait, HZ / 50)) { /* 20ms timeout */
-- DPRINTK(1, "wake up timeout !!!\n");
-+ time_left = wait_for_completion_interruptible_timeout(
-+ &priv->psstatus.wakeup_wait,
-+ msecs_to_jiffies(20));
-+ if (time_left <= 0) {
-+ DPRINTK(1, "wake up timeout or interrupted !!!\n");
- schedule_work(&priv->ks_wlan_wakeup_task);
- return;
- }
-@@ -1505,7 +1509,7 @@ void hostif_infrastructure_set_request(struct ks_wlan_private *priv)
- ks_wlan_hw_tx(priv, pp, hif_align_size(sizeof(*pp)), NULL, NULL, NULL);
- }
-
--void hostif_infrastructure_set2_request(struct ks_wlan_private *priv)
-+static void hostif_infrastructure_set2_request(struct ks_wlan_private *priv)
- {
- struct hostif_infrastructure_set2_request_t *pp;
- uint16_t capability;
-diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c b/drivers/staging/rtl8188eu/core/rtw_cmd.c
-index 7748523..32d3a9c 100644
---- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
-+++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
-@@ -670,13 +670,13 @@ u8 rtw_addbareq_cmd(struct adapter *padapter, u8 tid, u8 *addr)
- u8 res = _SUCCESS;
-
-
-- ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
-+ ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
- if (!ph2c) {
- res = _FAIL;
- goto exit;
- }
-
-- paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_KERNEL);
-+ paddbareq_parm = kzalloc(sizeof(struct addBaReq_parm), GFP_ATOMIC);
- if (!paddbareq_parm) {
- kfree(ph2c);
- res = _FAIL;
-diff --git a/drivers/staging/sm750fb/ddk750_mode.c b/drivers/staging/sm750fb/ddk750_mode.c
-index ccb4e06..e29d4bd 100644
---- a/drivers/staging/sm750fb/ddk750_mode.c
-+++ b/drivers/staging/sm750fb/ddk750_mode.c
-@@ -63,7 +63,7 @@ static unsigned long displayControlAdjust_SM750LE(mode_parameter_t *pModeParam,
- dispControl |= (CRT_DISPLAY_CTRL_CRTSELECT | CRT_DISPLAY_CTRL_RGBBIT);
-
- /* Set bit 14 of display controller */
-- dispControl = DISPLAY_CTRL_CLOCK_PHASE;
-+ dispControl |= DISPLAY_CTRL_CLOCK_PHASE;
-
- POKE32(CRT_DISPLAY_CTRL, dispControl);
-
-diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
-index 915facb..e1134a4 100644
---- a/drivers/uio/uio_dmem_genirq.c
-+++ b/drivers/uio/uio_dmem_genirq.c
-@@ -229,7 +229,7 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev)
- ++uiomem;
- }
-
-- priv->dmem_region_start = i;
-+ priv->dmem_region_start = uiomem - &uioinfo->mem[0];
- priv->num_dmem_regions = pdata->num_dynamic_regions;
-
- for (i = 0; i < pdata->num_dynamic_regions; ++i) {
-diff --git a/fs/9p/acl.c b/fs/9p/acl.c
-index 5b6a174..b3c2cc7 100644
---- a/fs/9p/acl.c
-+++ b/fs/9p/acl.c
-@@ -276,32 +276,26 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler,
- switch (handler->flags) {
- case ACL_TYPE_ACCESS:
- if (acl) {
-- umode_t mode = inode->i_mode;
-- retval = posix_acl_equiv_mode(acl, &mode);
-- if (retval < 0)
-+ struct iattr iattr;
-+
-+ retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
-+ if (retval)
- goto err_out;
-- else {
-- struct iattr iattr;
-- if (retval == 0) {
-- /*
-- * ACL can be represented
-- * by the mode bits. So don't
-- * update ACL.
-- */
-- acl = NULL;
-- value = NULL;
-- size = 0;
-- }
-- /* Updte the mode bits */
-- iattr.ia_mode = ((mode & S_IALLUGO) |
-- (inode->i_mode & ~S_IALLUGO));
-- iattr.ia_valid = ATTR_MODE;
-- /* FIXME should we update ctime ?
-- * What is the following setxattr update the
-- * mode ?
-+ if (!acl) {
-+ /*
-+ * ACL can be represented
-+ * by the mode bits. So don't
-+ * update ACL.
- */
-- v9fs_vfs_setattr_dotl(dentry, &iattr);
-+ value = NULL;
-+ size = 0;
- }
-+ iattr.ia_valid = ATTR_MODE;
-+ /* FIXME should we update ctime ?
-+ * What is the following setxattr update the
-+ * mode ?
-+ */
-+ v9fs_vfs_setattr_dotl(dentry, &iattr);
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
-index 53bb7af..247b8df 100644
---- a/fs/btrfs/acl.c
-+++ b/fs/btrfs/acl.c
-@@ -79,11 +79,9 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
- case ACL_TYPE_ACCESS:
- name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- ret = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (ret < 0)
-+ ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (ret)
- return ret;
-- if (ret == 0)
-- acl = NULL;
- }
- ret = 0;
- break;
-diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
-index 4f67227..d0b6b342 100644
---- a/fs/ceph/acl.c
-+++ b/fs/ceph/acl.c
-@@ -95,11 +95,9 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- case ACL_TYPE_ACCESS:
- name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- ret = posix_acl_equiv_mode(acl, &new_mode);
-- if (ret < 0)
-+ ret = posix_acl_update_mode(inode, &new_mode, &acl);
-+ if (ret)
- goto out;
-- if (ret == 0)
-- acl = NULL;
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
-index 42f1d18..e725aa0 100644
---- a/fs/ext2/acl.c
-+++ b/fs/ext2/acl.c
-@@ -190,15 +190,11 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- case ACL_TYPE_ACCESS:
- name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
- if (acl) {
-- error = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (error < 0)
-+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (error)
- return error;
-- else {
-- inode->i_ctime = CURRENT_TIME_SEC;
-- mark_inode_dirty(inode);
-- if (error == 0)
-- acl = NULL;
-- }
-+ inode->i_ctime = CURRENT_TIME_SEC;
-+ mark_inode_dirty(inode);
- }
- break;
-
-diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
-index c6601a4..dfa5199 100644
---- a/fs/ext4/acl.c
-+++ b/fs/ext4/acl.c
-@@ -193,15 +193,11 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type,
- case ACL_TYPE_ACCESS:
- name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
- if (acl) {
-- error = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (error < 0)
-+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (error)
- return error;
-- else {
-- inode->i_ctime = ext4_current_time(inode);
-- ext4_mark_inode_dirty(handle, inode);
-- if (error == 0)
-- acl = NULL;
-- }
-+ inode->i_ctime = ext4_current_time(inode);
-+ ext4_mark_inode_dirty(handle, inode);
- }
- break;
-
-diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c
-index 4dcc9e2..3134424 100644
---- a/fs/f2fs/acl.c
-+++ b/fs/f2fs/acl.c
-@@ -210,12 +210,10 @@ static int __f2fs_set_acl(struct inode *inode, int type,
- case ACL_TYPE_ACCESS:
- name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
- if (acl) {
-- error = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (error < 0)
-+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (error)
- return error;
- set_acl_inode(inode, inode->i_mode);
-- if (error == 0)
-- acl = NULL;
- }
- break;
-
-diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c
-index 363ba9e..2524807 100644
---- a/fs/gfs2/acl.c
-+++ b/fs/gfs2/acl.c
-@@ -92,17 +92,11 @@ int __gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- if (type == ACL_TYPE_ACCESS) {
- umode_t mode = inode->i_mode;
-
-- error = posix_acl_equiv_mode(acl, &mode);
-- if (error < 0)
-+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (error)
- return error;
--
-- if (error == 0)
-- acl = NULL;
--
-- if (mode != inode->i_mode) {
-- inode->i_mode = mode;
-+ if (mode != inode->i_mode)
- mark_inode_dirty(inode);
-- }
- }
-
- if (acl) {
-diff --git a/fs/hfsplus/posix_acl.c b/fs/hfsplus/posix_acl.c
-index ab7ea25..9b92058 100644
---- a/fs/hfsplus/posix_acl.c
-+++ b/fs/hfsplus/posix_acl.c
-@@ -65,8 +65,8 @@ int hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl,
- case ACL_TYPE_ACCESS:
- xattr_name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- err = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (err < 0)
-+ err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (err)
- return err;
- }
- err = 0;
-diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
-index bc2693d..2a0f2a1 100644
---- a/fs/jffs2/acl.c
-+++ b/fs/jffs2/acl.c
-@@ -233,9 +233,10 @@ int jffs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- case ACL_TYPE_ACCESS:
- xprefix = JFFS2_XPREFIX_ACL_ACCESS;
- if (acl) {
-- umode_t mode = inode->i_mode;
-- rc = posix_acl_equiv_mode(acl, &mode);
-- if (rc < 0)
-+ umode_t mode;
-+
-+ rc = posix_acl_update_mode(inode, &mode, &acl);
-+ if (rc)
- return rc;
- if (inode->i_mode != mode) {
- struct iattr attr;
-@@ -247,8 +248,6 @@ int jffs2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- if (rc < 0)
- return rc;
- }
-- if (rc == 0)
-- acl = NULL;
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
-index 21fa92b..3a1e155 100644
---- a/fs/jfs/acl.c
-+++ b/fs/jfs/acl.c
-@@ -78,13 +78,11 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
- case ACL_TYPE_ACCESS:
- ea_name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- rc = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (rc < 0)
-+ rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (rc)
- return rc;
- inode->i_ctime = CURRENT_TIME;
- mark_inode_dirty(inode);
-- if (rc == 0)
-- acl = NULL;
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
-index 2162434..164307b 100644
---- a/fs/ocfs2/acl.c
-+++ b/fs/ocfs2/acl.c
-@@ -241,13 +241,11 @@ int ocfs2_set_acl(handle_t *handle,
- case ACL_TYPE_ACCESS:
- name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
- if (acl) {
-- umode_t mode = inode->i_mode;
-- ret = posix_acl_equiv_mode(acl, &mode);
-- if (ret < 0)
-- return ret;
-+ umode_t mode;
-
-- if (ret == 0)
-- acl = NULL;
-+ ret = posix_acl_update_mode(inode, &mode, &acl);
-+ if (ret)
-+ return ret;
-
- ret = ocfs2_acl_set_mode(inode, di_bh,
- handle, mode);
-diff --git a/fs/orangefs/acl.c b/fs/orangefs/acl.c
-index 28f2195..7a37544 100644
---- a/fs/orangefs/acl.c
-+++ b/fs/orangefs/acl.c
-@@ -73,14 +73,11 @@ int orangefs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- case ACL_TYPE_ACCESS:
- name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- umode_t mode = inode->i_mode;
-- /*
-- * can we represent this with the traditional file
-- * mode permission bits?
-- */
-- error = posix_acl_equiv_mode(acl, &mode);
-- if (error < 0) {
-- gossip_err("%s: posix_acl_equiv_mode err: %d\n",
-+ umode_t mode;
-+
-+ error = posix_acl_update_mode(inode, &mode, &acl);
-+ if (error) {
-+ gossip_err("%s: posix_acl_update_mode err: %d\n",
- __func__,
- error);
- return error;
-@@ -90,8 +87,6 @@ int orangefs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- SetModeFlag(orangefs_inode);
- inode->i_mode = mode;
- mark_inode_dirty_sync(inode);
-- if (error == 0)
-- acl = NULL;
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/posix_acl.c b/fs/posix_acl.c
-index 59d47ab0..bfc3ec3 100644
---- a/fs/posix_acl.c
-+++ b/fs/posix_acl.c
-@@ -626,6 +626,37 @@ posix_acl_create(struct inode *dir, umode_t *mode,
- }
- EXPORT_SYMBOL_GPL(posix_acl_create);
-
-+/**
-+ * posix_acl_update_mode - update mode in set_acl
-+ *
-+ * Update the file mode when setting an ACL: compute the new file permission
-+ * bits based on the ACL. In addition, if the ACL is equivalent to the new
-+ * file mode, set *acl to NULL to indicate that no ACL should be set.
-+ *
-+ * As with chmod, clear the setgit bit if the caller is not in the owning group
-+ * or capable of CAP_FSETID (see inode_change_ok).
-+ *
-+ * Called from set_acl inode operations.
-+ */
-+int posix_acl_update_mode(struct inode *inode, umode_t *mode_p,
-+ struct posix_acl **acl)
-+{
-+ umode_t mode = inode->i_mode;
-+ int error;
-+
-+ error = posix_acl_equiv_mode(*acl, &mode);
-+ if (error < 0)
-+ return error;
-+ if (error == 0)
-+ *acl = NULL;
-+ if (!in_group_p(inode->i_gid) &&
-+ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
-+ mode &= ~S_ISGID;
-+ *mode_p = mode;
-+ return 0;
-+}
-+EXPORT_SYMBOL(posix_acl_update_mode);
-+
- /*
- * Fix up the uids and gids in posix acl extended attributes in place.
- */
-diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
-index dbed42f..2737668 100644
---- a/fs/reiserfs/xattr_acl.c
-+++ b/fs/reiserfs/xattr_acl.c
-@@ -242,13 +242,9 @@ __reiserfs_set_acl(struct reiserfs_transaction_handle *th, struct inode *inode,
- case ACL_TYPE_ACCESS:
- name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
-- error = posix_acl_equiv_mode(acl, &inode->i_mode);
-- if (error < 0)
-+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-+ if (error)
- return error;
-- else {
-- if (error == 0)
-- acl = NULL;
-- }
- }
- break;
- case ACL_TYPE_DEFAULT:
-diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
-index b6e527b..8a0dec8 100644
---- a/fs/xfs/xfs_acl.c
-+++ b/fs/xfs/xfs_acl.c
-@@ -257,16 +257,11 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- return error;
-
- if (type == ACL_TYPE_ACCESS) {
-- umode_t mode = inode->i_mode;
-- error = posix_acl_equiv_mode(acl, &mode);
--
-- if (error <= 0) {
-- acl = NULL;
--
-- if (error < 0)
-- return error;
-- }
-+ umode_t mode;
-
-+ error = posix_acl_update_mode(inode, &mode, &acl);
-+ if (error)
-+ return error;
- error = xfs_set_mode(inode, mode);
- if (error)
- return error;
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index d377865..988903a 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -938,7 +938,8 @@ static inline int drm_debugfs_remove_files(const struct drm_info_list *files,
- #endif
-
- extern struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
-- struct drm_gem_object *obj, int flags);
-+ struct drm_gem_object *obj,
-+ int flags);
- extern int drm_gem_prime_handle_to_fd(struct drm_device *dev,
- struct drm_file *file_priv, uint32_t handle, uint32_t flags,
- int *prime_fd);
-diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
-index c26d463..fe99e6f 100644
---- a/include/linux/hugetlb.h
-+++ b/include/linux/hugetlb.h
-@@ -450,8 +450,8 @@ static inline pgoff_t basepage_index(struct page *page)
- return __basepage_index(page);
- }
-
--extern void dissolve_free_huge_pages(unsigned long start_pfn,
-- unsigned long end_pfn);
-+extern int dissolve_free_huge_pages(unsigned long start_pfn,
-+ unsigned long end_pfn);
- static inline bool hugepage_migration_supported(struct hstate *h)
- {
- #ifdef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
-@@ -518,7 +518,7 @@ static inline pgoff_t basepage_index(struct page *page)
- {
- return page->index;
- }
--#define dissolve_free_huge_pages(s, e) do {} while (0)
-+#define dissolve_free_huge_pages(s, e) 0
- #define hugepage_migration_supported(h) false
-
- static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
-diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
-index b519e13..bbfce62 100644
---- a/include/linux/libnvdimm.h
-+++ b/include/linux/libnvdimm.h
-@@ -129,6 +129,8 @@ static inline struct nd_blk_region_desc *to_blk_region_desc(
- }
-
- int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length);
-+void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
-+ phys_addr_t start, unsigned int len);
- struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
- struct nvdimm_bus_descriptor *nfit_desc);
- void nvdimm_bus_unregister(struct nvdimm_bus *nvdimm_bus);
-diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
-index d5d3d74..bf1046d 100644
---- a/include/linux/posix_acl.h
-+++ b/include/linux/posix_acl.h
-@@ -93,6 +93,7 @@ extern int set_posix_acl(struct inode *, int, struct posix_acl *);
- extern int posix_acl_chmod(struct inode *, umode_t);
- extern int posix_acl_create(struct inode *, umode_t *, struct posix_acl **,
- struct posix_acl **);
-+extern int posix_acl_update_mode(struct inode *, umode_t *, struct posix_acl **);
-
- extern int simple_set_acl(struct inode *, struct posix_acl *, int);
- extern int simple_acl_create(struct inode *, struct inode *);
-diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
-index abd286a..a4775f3 100644
---- a/kernel/irq/generic-chip.c
-+++ b/kernel/irq/generic-chip.c
-@@ -411,8 +411,29 @@ int irq_map_generic_chip(struct irq_domain *d, unsigned int virq,
- }
- EXPORT_SYMBOL_GPL(irq_map_generic_chip);
-
-+static void irq_unmap_generic_chip(struct irq_domain *d, unsigned int virq)
-+{
-+ struct irq_data *data = irq_domain_get_irq_data(d, virq);
-+ struct irq_domain_chip_generic *dgc = d->gc;
-+ unsigned int hw_irq = data->hwirq;
-+ struct irq_chip_generic *gc;
-+ int irq_idx;
-+
-+ gc = irq_get_domain_generic_chip(d, hw_irq);
-+ if (!gc)
-+ return;
-+
-+ irq_idx = hw_irq % dgc->irqs_per_chip;
-+
-+ clear_bit(irq_idx, &gc->installed);
-+ irq_domain_set_info(d, virq, hw_irq, &no_irq_chip, NULL, NULL, NULL,
-+ NULL);
-+
-+}
-+
- struct irq_domain_ops irq_generic_chip_ops = {
- .map = irq_map_generic_chip,
-+ .unmap = irq_unmap_generic_chip,
- .xlate = irq_domain_xlate_onetwocell,
- };
- EXPORT_SYMBOL_GPL(irq_generic_chip_ops);
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 603bdd0..770d83e 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -1437,22 +1437,32 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
-
- /*
- * Dissolve a given free hugepage into free buddy pages. This function does
-- * nothing for in-use (including surplus) hugepages.
-+ * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
-+ * number of free hugepages would be reduced below the number of reserved
-+ * hugepages.
- */
--static void dissolve_free_huge_page(struct page *page)
-+static int dissolve_free_huge_page(struct page *page)
- {
-+ int rc = 0;
-+
- spin_lock(&hugetlb_lock);
- if (PageHuge(page) && !page_count(page)) {
- struct page *head = compound_head(page);
- struct hstate *h = page_hstate(head);
- int nid = page_to_nid(head);
-+ if (h->free_huge_pages - h->resv_huge_pages == 0) {
-+ rc = -EBUSY;
-+ goto out;
-+ }
- list_del(&head->lru);
- h->free_huge_pages--;
- h->free_huge_pages_node[nid]--;
- h->max_huge_pages--;
- update_and_free_page(h, head);
- }
-+out:
- spin_unlock(&hugetlb_lock);
-+ return rc;
- }
-
- /*
-@@ -1460,16 +1470,28 @@ static void dissolve_free_huge_page(struct page *page)
- * make specified memory blocks removable from the system.
- * Note that this will dissolve a free gigantic hugepage completely, if any
- * part of it lies within the given range.
-+ * Also note that if dissolve_free_huge_page() returns with an error, all
-+ * free hugepages that were dissolved before that error are lost.
- */
--void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
-+int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
- {
- unsigned long pfn;
-+ struct page *page;
-+ int rc = 0;
-
- if (!hugepages_supported())
-- return;
-+ return rc;
-+
-+ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
-+ page = pfn_to_page(pfn);
-+ if (PageHuge(page) && !page_count(page)) {
-+ rc = dissolve_free_huge_page(page);
-+ if (rc)
-+ break;
-+ }
-+ }
-
-- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
-- dissolve_free_huge_page(pfn_to_page(pfn));
-+ return rc;
- }
-
- /*
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index 9d29ba0..9629273 100644
---- a/mm/memory_hotplug.c
-+++ b/mm/memory_hotplug.c
-@@ -1945,7 +1945,9 @@ static int __ref __offline_pages(unsigned long start_pfn,
- * dissolve free hugepages in the memory block before doing offlining
- * actually in order to make hugetlbfs's object counting consistent.
- */
-- dissolve_free_huge_pages(start_pfn, end_pfn);
-+ ret = dissolve_free_huge_pages(start_pfn, end_pfn);
-+ if (ret)
-+ goto failed_removal;
- /* check again */
- offlined_pages = check_pages_isolated(start_pfn, end_pfn);
- if (offlined_pages < 0) {
-diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
-index 3774b11..49b65d4 100644
---- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
-+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
-@@ -255,7 +255,7 @@ static struct snd_soc_ops broxton_da7219_ops = {
- /* broxton digital audio interface glue - connects codec <--> CPU */
- static struct snd_soc_dai_link broxton_dais[] = {
- /* Front End DAI links */
-- [BXT_DPCM_AUDIO_PB]
-+ [BXT_DPCM_AUDIO_PB] =
- {
- .name = "Bxt Audio Port",
- .stream_name = "Audio",
-@@ -271,7 +271,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
- .dpcm_playback = 1,
- .ops = &broxton_da7219_fe_ops,
- },
-- [BXT_DPCM_AUDIO_CP]
-+ [BXT_DPCM_AUDIO_CP] =
- {
- .name = "Bxt Audio Capture Port",
- .stream_name = "Audio Record",
-@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
- .dpcm_capture = 1,
- .ops = &broxton_da7219_fe_ops,
- },
-- [BXT_DPCM_AUDIO_REF_CP]
-+ [BXT_DPCM_AUDIO_REF_CP] =
- {
- .name = "Bxt Audio Reference cap",
- .stream_name = "Refcap",
-@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_HDMI1_PB]
-+ [BXT_DPCM_AUDIO_HDMI1_PB] =
- {
- .name = "Bxt HDMI Port1",
- .stream_name = "Hdmi1",
-@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_HDMI2_PB]
-+ [BXT_DPCM_AUDIO_HDMI2_PB] =
- {
- .name = "Bxt HDMI Port2",
- .stream_name = "Hdmi2",
-@@ -326,7 +326,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_HDMI3_PB]
-+ [BXT_DPCM_AUDIO_HDMI3_PB] =
- {
- .name = "Bxt HDMI Port3",
- .stream_name = "Hdmi3",
-diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
-index 253d7bf..d610bdca 100644
---- a/sound/soc/intel/boards/bxt_rt298.c
-+++ b/sound/soc/intel/boards/bxt_rt298.c
-@@ -271,7 +271,7 @@ static const struct snd_soc_ops broxton_rt286_fe_ops = {
- /* broxton digital audio interface glue - connects codec <--> CPU */
- static struct snd_soc_dai_link broxton_rt298_dais[] = {
- /* Front End DAI links */
-- [BXT_DPCM_AUDIO_PB]
-+ [BXT_DPCM_AUDIO_PB] =
- {
- .name = "Bxt Audio Port",
- .stream_name = "Audio",
-@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .dpcm_playback = 1,
- .ops = &broxton_rt286_fe_ops,
- },
-- [BXT_DPCM_AUDIO_CP]
-+ [BXT_DPCM_AUDIO_CP] =
- {
- .name = "Bxt Audio Capture Port",
- .stream_name = "Audio Record",
-@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .dpcm_capture = 1,
- .ops = &broxton_rt286_fe_ops,
- },
-- [BXT_DPCM_AUDIO_REF_CP]
-+ [BXT_DPCM_AUDIO_REF_CP] =
- {
- .name = "Bxt Audio Reference cap",
- .stream_name = "refcap",
-@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_DMIC_CP]
-+ [BXT_DPCM_AUDIO_DMIC_CP] =
- {
- .name = "Bxt Audio DMIC cap",
- .stream_name = "dmiccap",
-@@ -327,7 +327,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .dynamic = 1,
- .ops = &broxton_dmic_ops,
- },
-- [BXT_DPCM_AUDIO_HDMI1_PB]
-+ [BXT_DPCM_AUDIO_HDMI1_PB] =
- {
- .name = "Bxt HDMI Port1",
- .stream_name = "Hdmi1",
-@@ -340,7 +340,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_HDMI2_PB]
-+ [BXT_DPCM_AUDIO_HDMI2_PB] =
- {
- .name = "Bxt HDMI Port2",
- .stream_name = "Hdmi2",
-@@ -353,7 +353,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
- .nonatomic = 1,
- .dynamic = 1,
- },
-- [BXT_DPCM_AUDIO_HDMI3_PB]
-+ [BXT_DPCM_AUDIO_HDMI3_PB] =
- {
- .name = "Bxt HDMI Port3",
- .stream_name = "Hdmi3",
-diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
-index d908ff8..801082f 100644
---- a/sound/soc/soc-dapm.c
-+++ b/sound/soc/soc-dapm.c
-@@ -823,6 +823,7 @@ static int dapm_create_or_share_kcontrol(struct snd_soc_dapm_widget *w,
- case snd_soc_dapm_switch:
- case snd_soc_dapm_mixer:
- case snd_soc_dapm_pga:
-+ case snd_soc_dapm_out_drv:
- wname_in_long_name = true;
- kcname_in_long_name = true;
- break;
-@@ -3049,6 +3050,9 @@ int snd_soc_dapm_get_volsw(struct snd_kcontrol *kcontrol,
- }
- mutex_unlock(&card->dapm_mutex);
-
-+ if (ret)
-+ return ret;
-+
- if (invert)
- ucontrol->value.integer.value[0] = max - val;
- else
-@@ -3200,7 +3204,7 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol,
- if (e->shift_l != e->shift_r) {
- if (item[1] > e->items)
- return -EINVAL;
-- val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
-+ val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
- mask |= e->mask << e->shift_r;
- }
-
-diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
-index ee7f15a..3406907 100644
---- a/sound/soc/soc-topology.c
-+++ b/sound/soc/soc-topology.c
-@@ -1475,6 +1475,7 @@ static int soc_tplg_dapm_widget_create(struct soc_tplg *tplg,
- if (widget == NULL) {
- dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
- w->name);
-+ ret = -ENOMEM;
- goto hdr_err;
- }
-
-diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
-index 7ed72a4..e4b717e 100644
---- a/tools/perf/perf-sys.h
-+++ b/tools/perf/perf-sys.h
-@@ -20,7 +20,6 @@
- #endif
-
- #ifdef __powerpc__
--#include "../../arch/powerpc/include/uapi/asm/unistd.h"
- #define CPUINFO_PROC {"cpu"}
- #endif
-
-diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
-index 13d4143..7aee954 100644
---- a/tools/perf/ui/browsers/hists.c
-+++ b/tools/perf/ui/browsers/hists.c
-@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(struct perf_hpp *hpp, const char *fmt, ...)
- ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent);
- ui_browser__printf(arg->b, "%s", hpp->buf);
-
-- advance_hpp(hpp, ret);
- return ret;
- }
-
-@@ -2046,6 +2045,7 @@ void hist_browser__init(struct hist_browser *browser,
- struct hists *hists)
- {
- struct perf_hpp_fmt *fmt;
-+ struct perf_hpp_list_node *node;
-
- browser->hists = hists;
- browser->b.refresh = hist_browser__refresh;
-@@ -2058,6 +2058,11 @@ void hist_browser__init(struct hist_browser *browser,
- perf_hpp__reset_width(fmt, hists);
- ++browser->b.columns;
- }
-+ /* hierarchy entries have their own hpp list */
-+ list_for_each_entry(node, &hists->hpp_formats, list) {
-+ perf_hpp_list__for_each_format(&node->hpp, fmt)
-+ perf_hpp__reset_width(fmt, hists);
-+ }
- }
-
- struct hist_browser *hist_browser__new(struct hists *hists)
-diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
-index f04a631..d0cae75 100644
---- a/tools/perf/ui/stdio/hist.c
-+++ b/tools/perf/ui/stdio/hist.c
-@@ -628,14 +628,6 @@ hists__fprintf_hierarchy_headers(struct hists *hists,
- struct perf_hpp *hpp,
- FILE *fp)
- {
-- struct perf_hpp_list_node *fmt_node;
-- struct perf_hpp_fmt *fmt;
--
-- list_for_each_entry(fmt_node, &hists->hpp_formats, list) {
-- perf_hpp_list__for_each_format(&fmt_node->hpp, fmt)
-- perf_hpp__reset_width(fmt, hists);
-- }
--
- return print_hierarchy_header(hists, hpp, symbol_conf.field_sep, fp);
- }
-
-@@ -714,6 +706,7 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
- bool use_callchain)
- {
- struct perf_hpp_fmt *fmt;
-+ struct perf_hpp_list_node *node;
- struct rb_node *nd;
- size_t ret = 0;
- const char *sep = symbol_conf.field_sep;
-@@ -726,6 +719,11 @@ size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
-
- hists__for_each_format(hists, fmt)
- perf_hpp__reset_width(fmt, hists);
-+ /* hierarchy entries have their own hpp list */
-+ list_for_each_entry(node, &hists->hpp_formats, list) {
-+ perf_hpp_list__for_each_format(&node->hpp, fmt)
-+ perf_hpp__reset_width(fmt, hists);
-+ }
-
- if (symbol_conf.col_width_list_str)
- perf_hpp__set_user_width(symbol_conf.col_width_list_str);
-diff --git a/tools/perf/util/data-convert-bt.c b/tools/perf/util/data-convert-bt.c
-index 4f979bb..7123f4d 100644
---- a/tools/perf/util/data-convert-bt.c
-+++ b/tools/perf/util/data-convert-bt.c
-@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_event_class *event_class,
- int ret;
-
- if (nr_elements * sizeof(u32) != raw_size)
-- pr_warning("Incorrect raw_size (%u) in bpf output event, skip %lu bytes\n",
-+ pr_warning("Incorrect raw_size (%u) in bpf output event, skip %zu bytes\n",
- raw_size, nr_elements * sizeof(u32) - raw_size);
-
- len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len");
-diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
-index a811c13..f77b316 100644
---- a/tools/perf/util/symbol-elf.c
-+++ b/tools/perf/util/symbol-elf.c
-@@ -1113,9 +1113,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
- * For misannotated, zeroed, ASM function sizes.
- */
- if (nr > 0) {
-- if (!symbol_conf.allow_aliases)
-- symbols__fixup_duplicate(&dso->symbols[map->type]);
- symbols__fixup_end(&dso->symbols[map->type]);
-+ symbols__fixup_duplicate(&dso->symbols[map->type]);
- if (kmap) {
- /*
- * We need to fixup this here too because we create new
-diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
-index 37e8d20..f29f336 100644
---- a/tools/perf/util/symbol.c
-+++ b/tools/perf/util/symbol.c
-@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_root *symbols)
- struct rb_node *nd;
- struct symbol *curr, *next;
-
-+ if (symbol_conf.allow_aliases)
-+ return;
-+
- nd = rb_first(symbols);
-
- while (nd) {
-@@ -1234,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso, const char *filename,
- if (kallsyms__delta(map, filename, &delta))
- return -1;
-
-- symbols__fixup_duplicate(&dso->symbols[map->type]);
- symbols__fixup_end(&dso->symbols[map->type]);
-+ symbols__fixup_duplicate(&dso->symbols[map->type]);
-
- if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
- dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;
diff --git a/4.8.7/1006_linux-4.8.7.patch b/4.8.7/1006_linux-4.8.7.patch
deleted file mode 100644
index d96f1e2..0000000
--- a/4.8.7/1006_linux-4.8.7.patch
+++ /dev/null
@@ -1,4331 +0,0 @@
-diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
-index e5b6497..c75b64a 100644
---- a/Documentation/device-mapper/dm-raid.txt
-+++ b/Documentation/device-mapper/dm-raid.txt
-@@ -309,3 +309,4 @@ Version History
- with a reshape in progress.
- 1.9.0 Add support for RAID level takeover/reshape/region size
- and set size reduction.
-+1.9.1 Fix activation of existing RAID 4/10 mapped devices
-diff --git a/Makefile b/Makefile
-index b249529..4d0f28c 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 6
-+SUBLEVEL = 7
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
-
-diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
-index b3df1c6..386eee6 100644
---- a/arch/arm/boot/dts/ste-snowball.dts
-+++ b/arch/arm/boot/dts/ste-snowball.dts
-@@ -239,14 +239,25 @@
- arm,primecell-periphid = <0x10480180>;
- max-frequency = <100000000>;
- bus-width = <4>;
-+ cap-sd-highspeed;
- cap-mmc-highspeed;
-+ sd-uhs-sdr12;
-+ sd-uhs-sdr25;
-+ /* All direction control is used */
-+ st,sig-dir-cmd;
-+ st,sig-dir-dat0;
-+ st,sig-dir-dat2;
-+ st,sig-dir-dat31;
-+ st,sig-pin-fbclk;
-+ full-pwr-cycle;
- vmmc-supply = <&ab8500_ldo_aux3_reg>;
- vqmmc-supply = <&vmmci>;
- pinctrl-names = "default", "sleep";
- pinctrl-0 = <&sdi0_default_mode>;
- pinctrl-1 = <&sdi0_sleep_mode>;
-
-- cd-gpios = <&gpio6 26 GPIO_ACTIVE_LOW>; // 218
-+ /* GPIO218 MMC_CD */
-+ cd-gpios = <&gpio6 26 GPIO_ACTIVE_LOW>;
-
- status = "okay";
- };
-@@ -549,7 +560,7 @@
- /* VMMCI level-shifter enable */
- snowball_cfg3 {
- pins = "GPIO217_AH12";
-- ste,config = <&gpio_out_lo>;
-+ ste,config = <&gpio_out_hi>;
- };
- /* VMMCI level-shifter voltage select */
- snowball_cfg4 {
-diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
-index f9b6bd3..541647f 100644
---- a/arch/arm/mach-mvebu/Kconfig
-+++ b/arch/arm/mach-mvebu/Kconfig
-@@ -23,6 +23,7 @@ config MACH_MVEBU_V7
- select CACHE_L2X0
- select ARM_CPU_SUSPEND
- select MACH_MVEBU_ANY
-+ select MVEBU_CLK_COREDIV
-
- config MACH_ARMADA_370
- bool "Marvell Armada 370 boards"
-@@ -32,7 +33,6 @@ config MACH_ARMADA_370
- select CPU_PJ4B
- select MACH_MVEBU_V7
- select PINCTRL_ARMADA_370
-- select MVEBU_CLK_COREDIV
- help
- Say 'Y' here if you want your kernel to support boards based
- on the Marvell Armada 370 SoC with device tree.
-@@ -50,7 +50,6 @@ config MACH_ARMADA_375
- select HAVE_SMP
- select MACH_MVEBU_V7
- select PINCTRL_ARMADA_375
-- select MVEBU_CLK_COREDIV
- help
- Say 'Y' here if you want your kernel to support boards based
- on the Marvell Armada 375 SoC with device tree.
-@@ -68,7 +67,6 @@ config MACH_ARMADA_38X
- select HAVE_SMP
- select MACH_MVEBU_V7
- select PINCTRL_ARMADA_38X
-- select MVEBU_CLK_COREDIV
- help
- Say 'Y' here if you want your kernel to support boards based
- on the Marvell Armada 380/385 SoC with device tree.
-diff --git a/arch/arm/mm/abort-lv4t.S b/arch/arm/mm/abort-lv4t.S
-index 6d8e8e3..4cdfab3 100644
---- a/arch/arm/mm/abort-lv4t.S
-+++ b/arch/arm/mm/abort-lv4t.S
-@@ -7,7 +7,7 @@
- * : r4 = aborted context pc
- * : r5 = aborted context psr
- *
-- * Returns : r4-r5, r10-r11, r13 preserved
-+ * Returns : r4-r5, r9-r11, r13 preserved
- *
- * Purpose : obtain information about current aborted instruction.
- * Note: we read user space. This means we might cause a data
-@@ -48,7 +48,10 @@ ENTRY(v4t_late_abort)
- /* c */ b do_DataAbort @ ldc rd, [rn], #m @ Same as ldr rd, [rn], #m
- /* d */ b do_DataAbort @ ldc rd, [rn, #m]
- /* e */ b .data_unknown
--/* f */
-+/* f */ b .data_unknown
-+
-+.data_unknown_r9:
-+ ldr r9, [sp], #4
- .data_unknown: @ Part of jumptable
- mov r0, r4
- mov r1, r8
-@@ -57,6 +60,7 @@ ENTRY(v4t_late_abort)
- .data_arm_ldmstm:
- tst r8, #1 << 21 @ check writeback bit
- beq do_DataAbort @ no writeback -> no fixup
-+ str r9, [sp, #-4]!
- mov r7, #0x11
- orr r7, r7, #0x1100
- and r6, r8, r7
-@@ -75,12 +79,14 @@ ENTRY(v4t_late_abort)
- subne r7, r7, r6, lsl #2 @ Undo increment
- addeq r7, r7, r6, lsl #2 @ Undo decrement
- str r7, [r2, r9, lsr #14] @ Put register 'Rn'
-+ ldr r9, [sp], #4
- b do_DataAbort
-
- .data_arm_lateldrhpre:
- tst r8, #1 << 21 @ Check writeback bit
- beq do_DataAbort @ No writeback -> no fixup
- .data_arm_lateldrhpost:
-+ str r9, [sp, #-4]!
- and r9, r8, #0x00f @ get Rm / low nibble of immediate value
- tst r8, #1 << 22 @ if (immediate offset)
- andne r6, r8, #0xf00 @ { immediate high nibble
-@@ -93,6 +99,7 @@ ENTRY(v4t_late_abort)
- subne r7, r7, r6 @ Undo incrmenet
- addeq r7, r7, r6 @ Undo decrement
- str r7, [r2, r9, lsr #14] @ Put register 'Rn'
-+ ldr r9, [sp], #4
- b do_DataAbort
-
- .data_arm_lateldrpreconst:
-@@ -101,12 +108,14 @@ ENTRY(v4t_late_abort)
- .data_arm_lateldrpostconst:
- movs r6, r8, lsl #20 @ Get offset
- beq do_DataAbort @ zero -> no fixup
-+ str r9, [sp, #-4]!
- and r9, r8, #15 << 16 @ Extract 'n' from instruction
- ldr r7, [r2, r9, lsr #14] @ Get register 'Rn'
- tst r8, #1 << 23 @ Check U bit
- subne r7, r7, r6, lsr #20 @ Undo increment
- addeq r7, r7, r6, lsr #20 @ Undo decrement
- str r7, [r2, r9, lsr #14] @ Put register 'Rn'
-+ ldr r9, [sp], #4
- b do_DataAbort
-
- .data_arm_lateldrprereg:
-@@ -115,6 +124,7 @@ ENTRY(v4t_late_abort)
- .data_arm_lateldrpostreg:
- and r7, r8, #15 @ Extract 'm' from instruction
- ldr r6, [r2, r7, lsl #2] @ Get register 'Rm'
-+ str r9, [sp, #-4]!
- mov r9, r8, lsr #7 @ get shift count
- ands r9, r9, #31
- and r7, r8, #0x70 @ get shift type
-@@ -126,33 +136,33 @@ ENTRY(v4t_late_abort)
- b .data_arm_apply_r6_and_rn
- b .data_arm_apply_r6_and_rn @ 1: LSL #0
- nop
-- b .data_unknown @ 2: MUL?
-+ b .data_unknown_r9 @ 2: MUL?
- nop
-- b .data_unknown @ 3: MUL?
-+ b .data_unknown_r9 @ 3: MUL?
- nop
- mov r6, r6, lsr r9 @ 4: LSR #!0
- b .data_arm_apply_r6_and_rn
- mov r6, r6, lsr #32 @ 5: LSR #32
- b .data_arm_apply_r6_and_rn
-- b .data_unknown @ 6: MUL?
-+ b .data_unknown_r9 @ 6: MUL?
- nop
-- b .data_unknown @ 7: MUL?
-+ b .data_unknown_r9 @ 7: MUL?
- nop
- mov r6, r6, asr r9 @ 8: ASR #!0
- b .data_arm_apply_r6_and_rn
- mov r6, r6, asr #32 @ 9: ASR #32
- b .data_arm_apply_r6_and_rn
-- b .data_unknown @ A: MUL?
-+ b .data_unknown_r9 @ A: MUL?
- nop
-- b .data_unknown @ B: MUL?
-+ b .data_unknown_r9 @ B: MUL?
- nop
- mov r6, r6, ror r9 @ C: ROR #!0
- b .data_arm_apply_r6_and_rn
- mov r6, r6, rrx @ D: RRX
- b .data_arm_apply_r6_and_rn
-- b .data_unknown @ E: MUL?
-+ b .data_unknown_r9 @ E: MUL?
- nop
-- b .data_unknown @ F: MUL?
-+ b .data_unknown_r9 @ F: MUL?
-
- .data_thumb_abort:
- ldrh r8, [r4] @ read instruction
-@@ -190,6 +200,7 @@ ENTRY(v4t_late_abort)
- .data_thumb_pushpop:
- tst r8, #1 << 10
- beq .data_unknown
-+ str r9, [sp, #-4]!
- and r6, r8, #0x55 @ hweight8(r8) + R bit
- and r9, r8, #0xaa
- add r6, r6, r9, lsr #1
-@@ -204,9 +215,11 @@ ENTRY(v4t_late_abort)
- addeq r7, r7, r6, lsl #2 @ increment SP if PUSH
- subne r7, r7, r6, lsl #2 @ decrement SP if POP
- str r7, [r2, #13 << 2]
-+ ldr r9, [sp], #4
- b do_DataAbort
-
- .data_thumb_ldmstm:
-+ str r9, [sp, #-4]!
- and r6, r8, #0x55 @ hweight8(r8)
- and r9, r8, #0xaa
- add r6, r6, r9, lsr #1
-@@ -219,4 +232,5 @@ ENTRY(v4t_late_abort)
- and r6, r6, #15 @ number of regs to transfer
- sub r7, r7, r6, lsl #2 @ always decrement
- str r7, [r2, r9, lsr #6]
-+ ldr r9, [sp], #4
- b do_DataAbort
-diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
-index da31bbb..3992718 100644
---- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
-+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
-@@ -131,7 +131,7 @@
- #address-cells = <0x1>;
- #size-cells = <0x0>;
- cell-index = <1>;
-- clocks = <&cpm_syscon0 0 3>;
-+ clocks = <&cpm_syscon0 1 21>;
- status = "disabled";
- };
-
-diff --git a/arch/h8300/include/asm/thread_info.h b/arch/h8300/include/asm/thread_info.h
-index b408fe6..3cef068 100644
---- a/arch/h8300/include/asm/thread_info.h
-+++ b/arch/h8300/include/asm/thread_info.h
-@@ -31,7 +31,6 @@ struct thread_info {
- int cpu; /* cpu we're on */
- int preempt_count; /* 0 => preemptable, <0 => BUG */
- mm_segment_t addr_limit;
-- struct restart_block restart_block;
- };
-
- /*
-@@ -44,9 +43,6 @@ struct thread_info {
- .cpu = 0, \
- .preempt_count = INIT_PREEMPT_COUNT, \
- .addr_limit = KERNEL_DS, \
-- .restart_block = { \
-- .fn = do_no_restart_syscall, \
-- }, \
- }
-
- #define init_thread_info (init_thread_union.thread_info)
-diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c
-index ad1f81f..7138303 100644
---- a/arch/h8300/kernel/signal.c
-+++ b/arch/h8300/kernel/signal.c
-@@ -79,7 +79,7 @@ restore_sigcontext(struct sigcontext *usc, int *pd0)
- unsigned int er0;
-
- /* Always make any pending restarted system calls return -EINTR */
-- current_thread_info()->restart_block.fn = do_no_restart_syscall;
-+ current->restart_block.fn = do_no_restart_syscall;
-
- /* restore passed registers */
- #define COPY(r) do { err |= get_user(regs->r, &usc->sc_##r); } while (0)
-diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
-index b54bcad..45799ef 100644
---- a/arch/mips/include/asm/kvm_host.h
-+++ b/arch/mips/include/asm/kvm_host.h
-@@ -279,7 +279,10 @@ struct kvm_vcpu_arch {
- /* Host KSEG0 address of the EI/DI offset */
- void *kseg0_commpage;
-
-- u32 io_gpr; /* GPR used as IO source/target */
-+ /* Resume PC after MMIO completion */
-+ unsigned long io_pc;
-+ /* GPR used as IO source/target */
-+ u32 io_gpr;
-
- struct hrtimer comparecount_timer;
- /* Count timer control KVM register */
-@@ -301,8 +304,6 @@ struct kvm_vcpu_arch {
- /* Bitmask of pending exceptions to be cleared */
- unsigned long pending_exceptions_clr;
-
-- u32 pending_load_cause;
--
- /* Save/Restore the entryhi register when are are preempted/scheduled back in */
- unsigned long preempt_entryhi;
-
-diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
-index ca1cc30..1958910 100644
---- a/arch/mips/kernel/relocate.c
-+++ b/arch/mips/kernel/relocate.c
-@@ -200,7 +200,7 @@ static inline __init unsigned long get_random_boot(void)
-
- #if defined(CONFIG_USE_OF)
- /* Get any additional entropy passed in device tree */
-- {
-+ if (initial_boot_params) {
- int node, len;
- u64 *prop;
-
-diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
-index 43853ec..4d65285 100644
---- a/arch/mips/kvm/emulate.c
-+++ b/arch/mips/kvm/emulate.c
-@@ -791,15 +791,15 @@ enum emulation_result kvm_mips_emul_eret(struct kvm_vcpu *vcpu)
- struct mips_coproc *cop0 = vcpu->arch.cop0;
- enum emulation_result er = EMULATE_DONE;
-
-- if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
-+ if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
-+ kvm_clear_c0_guest_status(cop0, ST0_ERL);
-+ vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
-+ } else if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
- kvm_debug("[%#lx] ERET to %#lx\n", vcpu->arch.pc,
- kvm_read_c0_guest_epc(cop0));
- kvm_clear_c0_guest_status(cop0, ST0_EXL);
- vcpu->arch.pc = kvm_read_c0_guest_epc(cop0);
-
-- } else if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
-- kvm_clear_c0_guest_status(cop0, ST0_ERL);
-- vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
- } else {
- kvm_err("[%#lx] ERET when MIPS_SR_EXL|MIPS_SR_ERL == 0\n",
- vcpu->arch.pc);
-@@ -1522,13 +1522,25 @@ enum emulation_result kvm_mips_emulate_load(union mips_instruction inst,
- struct kvm_vcpu *vcpu)
- {
- enum emulation_result er = EMULATE_DO_MMIO;
-+ unsigned long curr_pc;
- u32 op, rt;
- u32 bytes;
-
- rt = inst.i_format.rt;
- op = inst.i_format.opcode;
-
-- vcpu->arch.pending_load_cause = cause;
-+ /*
-+ * Find the resume PC now while we have safe and easy access to the
-+ * prior branch instruction, and save it for
-+ * kvm_mips_complete_mmio_load() to restore later.
-+ */
-+ curr_pc = vcpu->arch.pc;
-+ er = update_pc(vcpu, cause);
-+ if (er == EMULATE_FAIL)
-+ return er;
-+ vcpu->arch.io_pc = vcpu->arch.pc;
-+ vcpu->arch.pc = curr_pc;
-+
- vcpu->arch.io_gpr = rt;
-
- switch (op) {
-@@ -2488,9 +2500,8 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
- goto done;
- }
-
-- er = update_pc(vcpu, vcpu->arch.pending_load_cause);
-- if (er == EMULATE_FAIL)
-- return er;
-+ /* Restore saved resume PC */
-+ vcpu->arch.pc = vcpu->arch.io_pc;
-
- switch (run->mmio.len) {
- case 4:
-@@ -2512,11 +2523,6 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu,
- break;
- }
-
-- if (vcpu->arch.pending_load_cause & CAUSEF_BD)
-- kvm_debug("[%#lx] Completing %d byte BD Load to gpr %d (0x%08lx) type %d\n",
-- vcpu->arch.pc, run->mmio.len, vcpu->arch.io_gpr, *gpr,
-- vcpu->mmio_needed);
--
- done:
- return er;
- }
-diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
-index d03422e..7ed036c 100644
---- a/arch/parisc/kernel/syscall.S
-+++ b/arch/parisc/kernel/syscall.S
-@@ -106,8 +106,6 @@ linux_gateway_entry:
- mtsp %r0,%sr4 /* get kernel space into sr4 */
- mtsp %r0,%sr5 /* get kernel space into sr5 */
- mtsp %r0,%sr6 /* get kernel space into sr6 */
-- mfsp %sr7,%r1 /* save user sr7 */
-- mtsp %r1,%sr3 /* and store it in sr3 */
-
- #ifdef CONFIG_64BIT
- /* for now we can *always* set the W bit on entry to the syscall
-@@ -133,6 +131,14 @@ linux_gateway_entry:
- depdi 0, 31, 32, %r21
- 1:
- #endif
-+
-+ /* We use a rsm/ssm pair to prevent sr3 from being clobbered
-+ * by external interrupts.
-+ */
-+ mfsp %sr7,%r1 /* save user sr7 */
-+ rsm PSW_SM_I, %r0 /* disable interrupts */
-+ mtsp %r1,%sr3 /* and store it in sr3 */
-+
- mfctl %cr30,%r1
- xor %r1,%r30,%r30 /* ye olde xor trick */
- xor %r1,%r30,%r1
-@@ -147,6 +153,7 @@ linux_gateway_entry:
- */
-
- mtsp %r0,%sr7 /* get kernel space into sr7 */
-+ ssm PSW_SM_I, %r0 /* enable interrupts */
- STREGM %r1,FRAME_SIZE(%r30) /* save r1 (usp) here for now */
- mfctl %cr30,%r1 /* get task ptr in %r1 */
- LDREG TI_TASK(%r1),%r1
-diff --git a/arch/powerpc/include/asm/cpuidle.h b/arch/powerpc/include/asm/cpuidle.h
-index 01b8a13..3919332 100644
---- a/arch/powerpc/include/asm/cpuidle.h
-+++ b/arch/powerpc/include/asm/cpuidle.h
-@@ -26,7 +26,7 @@ extern u64 pnv_first_deep_stop_state;
- std r0,0(r1); \
- ptesync; \
- ld r0,0(r1); \
--1: cmp cr0,r0,r0; \
-+1: cmpd cr0,r0,r0; \
- bne 1b; \
- IDLE_INST; \
- b .
-diff --git a/arch/powerpc/include/asm/tlb.h b/arch/powerpc/include/asm/tlb.h
-index f6f68f7..99e1397 100644
---- a/arch/powerpc/include/asm/tlb.h
-+++ b/arch/powerpc/include/asm/tlb.h
-@@ -52,11 +52,23 @@ static inline int mm_is_core_local(struct mm_struct *mm)
- return cpumask_subset(mm_cpumask(mm),
- topology_sibling_cpumask(smp_processor_id()));
- }
-+
-+static inline int mm_is_thread_local(struct mm_struct *mm)
-+{
-+ return cpumask_equal(mm_cpumask(mm),
-+ cpumask_of(smp_processor_id()));
-+}
-+
- #else
- static inline int mm_is_core_local(struct mm_struct *mm)
- {
- return 1;
- }
-+
-+static inline int mm_is_thread_local(struct mm_struct *mm)
-+{
-+ return 1;
-+}
- #endif
-
- #endif /* __KERNEL__ */
-diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
-index bd739fe..72dac0b 100644
---- a/arch/powerpc/kernel/idle_book3s.S
-+++ b/arch/powerpc/kernel/idle_book3s.S
-@@ -90,6 +90,7 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_300)
- * Threads will spin in HMT_LOW until the lock bit is cleared.
- * r14 - pointer to core_idle_state
- * r15 - used to load contents of core_idle_state
-+ * r9 - used as a temporary variable
- */
-
- core_idle_lock_held:
-@@ -99,6 +100,8 @@ core_idle_lock_held:
- bne 3b
- HMT_MEDIUM
- lwarx r15,0,r14
-+ andi. r9,r15,PNV_CORE_IDLE_LOCK_BIT
-+ bne core_idle_lock_held
- blr
-
- /*
-@@ -163,12 +166,6 @@ _GLOBAL(pnv_powersave_common)
- std r9,_MSR(r1)
- std r1,PACAR1(r13)
-
--#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
-- /* Tell KVM we're entering idle */
-- li r4,KVM_HWTHREAD_IN_IDLE
-- stb r4,HSTATE_HWTHREAD_STATE(r13)
--#endif
--
- /*
- * Go to real mode to do the nap, as required by the architecture.
- * Also, we need to be in real mode before setting hwthread_state,
-@@ -185,6 +182,26 @@ _GLOBAL(pnv_powersave_common)
-
- .globl pnv_enter_arch207_idle_mode
- pnv_enter_arch207_idle_mode:
-+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
-+ /* Tell KVM we're entering idle */
-+ li r4,KVM_HWTHREAD_IN_IDLE
-+ /******************************************************/
-+ /* N O T E W E L L ! ! ! N O T E W E L L */
-+ /* The following store to HSTATE_HWTHREAD_STATE(r13) */
-+ /* MUST occur in real mode, i.e. with the MMU off, */
-+ /* and the MMU must stay off until we clear this flag */
-+ /* and test HSTATE_HWTHREAD_REQ(r13) in the system */
-+ /* reset interrupt vector in exceptions-64s.S. */
-+ /* The reason is that another thread can switch the */
-+ /* MMU to a guest context whenever this flag is set */
-+ /* to KVM_HWTHREAD_IN_IDLE, and if the MMU was on, */
-+ /* that would potentially cause this thread to start */
-+ /* executing instructions from guest memory in */
-+ /* hypervisor mode, leading to a host crash or data */
-+ /* corruption, or worse. */
-+ /******************************************************/
-+ stb r4,HSTATE_HWTHREAD_STATE(r13)
-+#endif
- stb r3,PACA_THREAD_IDLE_STATE(r13)
- cmpwi cr3,r3,PNV_THREAD_SLEEP
- bge cr3,2f
-@@ -250,6 +267,12 @@ enter_winkle:
- * r3 - requested stop state
- */
- power_enter_stop:
-+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
-+ /* Tell KVM we're entering idle */
-+ li r4,KVM_HWTHREAD_IN_IDLE
-+ /* DO THIS IN REAL MODE! See comment above. */
-+ stb r4,HSTATE_HWTHREAD_STATE(r13)
-+#endif
- /*
- * Check if the requested state is a deep idle state.
- */
-diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
-index 48df05e..d696068 100644
---- a/arch/powerpc/mm/tlb-radix.c
-+++ b/arch/powerpc/mm/tlb-radix.c
-@@ -175,7 +175,7 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
- if (unlikely(pid == MMU_NO_CONTEXT))
- goto no_context;
-
-- if (!mm_is_core_local(mm)) {
-+ if (!mm_is_thread_local(mm)) {
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
-
- if (lock_tlbie)
-@@ -201,7 +201,7 @@ void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr)
- if (unlikely(pid == MMU_NO_CONTEXT))
- goto no_context;
-
-- if (!mm_is_core_local(mm)) {
-+ if (!mm_is_thread_local(mm)) {
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
-
- if (lock_tlbie)
-@@ -226,7 +226,7 @@ void radix__flush_tlb_page_psize(struct mm_struct *mm, unsigned long vmaddr,
- pid = mm ? mm->context.id : 0;
- if (unlikely(pid == MMU_NO_CONTEXT))
- goto bail;
-- if (!mm_is_core_local(mm)) {
-+ if (!mm_is_thread_local(mm)) {
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
-
- if (lock_tlbie)
-@@ -321,7 +321,7 @@ void radix__flush_tlb_range_psize(struct mm_struct *mm, unsigned long start,
- {
- unsigned long pid;
- unsigned long addr;
-- int local = mm_is_core_local(mm);
-+ int local = mm_is_thread_local(mm);
- unsigned long ap = mmu_get_ap(psize);
- int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
- unsigned long page_size = 1UL << mmu_psize_defs[psize].shift;
-diff --git a/arch/s390/kvm/sthyi.c b/arch/s390/kvm/sthyi.c
-index bd98b7d..05c98bb 100644
---- a/arch/s390/kvm/sthyi.c
-+++ b/arch/s390/kvm/sthyi.c
-@@ -315,7 +315,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
- if (r < 0)
- goto out;
-
-- diag224_buf = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
-+ diag224_buf = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
- if (!diag224_buf || diag224(diag224_buf))
- goto out;
-
-@@ -378,7 +378,7 @@ static void fill_diag(struct sthyi_sctns *sctns)
- sctns->par.infpval1 |= PAR_WGHT_VLD;
-
- out:
-- kfree(diag224_buf);
-+ free_page((unsigned long)diag224_buf);
- vfree(diag204_buf);
- }
-
-diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
-index 620ab06..017bda1 100644
---- a/arch/x86/kernel/cpu/microcode/amd.c
-+++ b/arch/x86/kernel/cpu/microcode/amd.c
-@@ -429,7 +429,7 @@ int __init save_microcode_in_initrd_amd(void)
- * We need the physical address of the container for both bitness since
- * boot_params.hdr.ramdisk_image is a physical address.
- */
-- cont = __pa(container);
-+ cont = __pa_nodebug(container);
- cont_va = container;
- #endif
-
-diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 98c9cd6..d5219b1 100644
---- a/arch/x86/kernel/setup.c
-+++ b/arch/x86/kernel/setup.c
-@@ -1222,11 +1222,16 @@ void __init setup_arch(char **cmdline_p)
- if (smp_found_config)
- get_smp_config();
-
-+ /*
-+ * Systems w/o ACPI and mptables might not have it mapped the local
-+ * APIC yet, but prefill_possible_map() might need to access it.
-+ */
-+ init_apic_mappings();
-+
- prefill_possible_map();
-
- init_cpu_to_node();
-
-- init_apic_mappings();
- io_apic_init_mappings();
-
- kvm_guest_init();
-diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 4e95d3e..cbd7b92 100644
---- a/arch/x86/kvm/emulate.c
-+++ b/arch/x86/kvm/emulate.c
-@@ -5045,7 +5045,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
- /* Decode and fetch the destination operand: register or memory. */
- rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
-
-- if (ctxt->rip_relative)
-+ if (ctxt->rip_relative && likely(ctxt->memopp))
- ctxt->memopp->addr.mem.ea = address_mask(ctxt,
- ctxt->memopp->addr.mem.ea + ctxt->_eip);
-
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 699f872..46f74d4 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -7372,10 +7372,12 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
-
- void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
- {
-+ void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
-+
- kvmclock_reset(vcpu);
-
-- free_cpumask_var(vcpu->arch.wbinvd_dirty_mask);
- kvm_x86_ops->vcpu_free(vcpu);
-+ free_cpumask_var(wbinvd_dirty_mask);
- }
-
- struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
-diff --git a/drivers/android/binder.c b/drivers/android/binder.c
-index 16288e7..4b1e4ea 100644
---- a/drivers/android/binder.c
-+++ b/drivers/android/binder.c
-@@ -1003,7 +1003,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
-
-
- static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-- uint32_t desc)
-+ u32 desc, bool need_strong_ref)
- {
- struct rb_node *n = proc->refs_by_desc.rb_node;
- struct binder_ref *ref;
-@@ -1011,12 +1011,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
- while (n) {
- ref = rb_entry(n, struct binder_ref, rb_node_desc);
-
-- if (desc < ref->desc)
-+ if (desc < ref->desc) {
- n = n->rb_left;
-- else if (desc > ref->desc)
-+ } else if (desc > ref->desc) {
- n = n->rb_right;
-- else
-+ } else if (need_strong_ref && !ref->strong) {
-+ binder_user_error("tried to use weak ref as strong ref\n");
-+ return NULL;
-+ } else {
- return ref;
-+ }
- }
- return NULL;
- }
-@@ -1286,7 +1290,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
- } break;
- case BINDER_TYPE_HANDLE:
- case BINDER_TYPE_WEAK_HANDLE: {
-- struct binder_ref *ref = binder_get_ref(proc, fp->handle);
-+ struct binder_ref *ref;
-+
-+ ref = binder_get_ref(proc, fp->handle,
-+ fp->type == BINDER_TYPE_HANDLE);
-
- if (ref == NULL) {
- pr_err("transaction release %d bad handle %d\n",
-@@ -1381,7 +1388,7 @@ static void binder_transaction(struct binder_proc *proc,
- if (tr->target.handle) {
- struct binder_ref *ref;
-
-- ref = binder_get_ref(proc, tr->target.handle);
-+ ref = binder_get_ref(proc, tr->target.handle, true);
- if (ref == NULL) {
- binder_user_error("%d:%d got transaction to invalid handle\n",
- proc->pid, thread->pid);
-@@ -1578,7 +1585,9 @@ static void binder_transaction(struct binder_proc *proc,
- fp->type = BINDER_TYPE_HANDLE;
- else
- fp->type = BINDER_TYPE_WEAK_HANDLE;
-+ fp->binder = 0;
- fp->handle = ref->desc;
-+ fp->cookie = 0;
- binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
- &thread->todo);
-
-@@ -1590,7 +1599,10 @@ static void binder_transaction(struct binder_proc *proc,
- } break;
- case BINDER_TYPE_HANDLE:
- case BINDER_TYPE_WEAK_HANDLE: {
-- struct binder_ref *ref = binder_get_ref(proc, fp->handle);
-+ struct binder_ref *ref;
-+
-+ ref = binder_get_ref(proc, fp->handle,
-+ fp->type == BINDER_TYPE_HANDLE);
-
- if (ref == NULL) {
- binder_user_error("%d:%d got transaction with invalid handle, %d\n",
-@@ -1625,7 +1637,9 @@ static void binder_transaction(struct binder_proc *proc,
- return_error = BR_FAILED_REPLY;
- goto err_binder_get_ref_for_node_failed;
- }
-+ fp->binder = 0;
- fp->handle = new_ref->desc;
-+ fp->cookie = 0;
- binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
- trace_binder_transaction_ref_to_ref(t, ref,
- new_ref);
-@@ -1679,6 +1693,7 @@ static void binder_transaction(struct binder_proc *proc,
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " fd %d -> %d\n", fp->handle, target_fd);
- /* TODO: fput? */
-+ fp->binder = 0;
- fp->handle = target_fd;
- } break;
-
-@@ -1801,7 +1816,9 @@ static int binder_thread_write(struct binder_proc *proc,
- ref->desc);
- }
- } else
-- ref = binder_get_ref(proc, target);
-+ ref = binder_get_ref(proc, target,
-+ cmd == BC_ACQUIRE ||
-+ cmd == BC_RELEASE);
- if (ref == NULL) {
- binder_user_error("%d:%d refcount change on invalid ref %d\n",
- proc->pid, thread->pid, target);
-@@ -1997,7 +2014,7 @@ static int binder_thread_write(struct binder_proc *proc,
- if (get_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
-- ref = binder_get_ref(proc, target);
-+ ref = binder_get_ref(proc, target, false);
- if (ref == NULL) {
- binder_user_error("%d:%d %s invalid ref %d\n",
- proc->pid, thread->pid,
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index 5da47e26..4aae0d2 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -1540,19 +1540,29 @@ static void remove_port_data(struct port *port)
- spin_lock_irq(&port->inbuf_lock);
- /* Remove unused data this port might have received. */
- discard_port_data(port);
-+ spin_unlock_irq(&port->inbuf_lock);
-
- /* Remove buffers we queued up for the Host to send us data in. */
-- while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
-- free_buf(buf, true);
-- spin_unlock_irq(&port->inbuf_lock);
-+ do {
-+ spin_lock_irq(&port->inbuf_lock);
-+ buf = virtqueue_detach_unused_buf(port->in_vq);
-+ spin_unlock_irq(&port->inbuf_lock);
-+ if (buf)
-+ free_buf(buf, true);
-+ } while (buf);
-
- spin_lock_irq(&port->outvq_lock);
- reclaim_consumed_buffers(port);
-+ spin_unlock_irq(&port->outvq_lock);
-
- /* Free pending buffers from the out-queue. */
-- while ((buf = virtqueue_detach_unused_buf(port->out_vq)))
-- free_buf(buf, true);
-- spin_unlock_irq(&port->outvq_lock);
-+ do {
-+ spin_lock_irq(&port->outvq_lock);
-+ buf = virtqueue_detach_unused_buf(port->out_vq);
-+ spin_unlock_irq(&port->outvq_lock);
-+ if (buf)
-+ free_buf(buf, true);
-+ } while (buf);
- }
-
- /*
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index b46547e..8c347f5 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -1133,10 +1133,8 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
- *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
- }
-
--static void intel_pstate_set_min_pstate(struct cpudata *cpu)
-+static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
- {
-- int pstate = cpu->pstate.min_pstate;
--
- trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
- cpu->pstate.current_pstate = pstate;
- /*
-@@ -1148,6 +1146,20 @@ static void intel_pstate_set_min_pstate(struct cpudata *cpu)
- pstate_funcs.get_val(cpu, pstate));
- }
-
-+static void intel_pstate_set_min_pstate(struct cpudata *cpu)
-+{
-+ intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
-+}
-+
-+static void intel_pstate_max_within_limits(struct cpudata *cpu)
-+{
-+ int min_pstate, max_pstate;
-+
-+ update_turbo_state();
-+ intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
-+ intel_pstate_set_pstate(cpu, max_pstate);
-+}
-+
- static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
- {
- cpu->pstate.min_pstate = pstate_funcs.get_min();
-@@ -1465,7 +1477,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
- pr_debug("set_policy cpuinfo.max %u policy->max %u\n",
- policy->cpuinfo.max_freq, policy->max);
-
-- cpu = all_cpu_data[0];
-+ cpu = all_cpu_data[policy->cpu];
- if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
- policy->max < policy->cpuinfo.max_freq &&
- policy->max > cpu->pstate.max_pstate * cpu->pstate.scaling) {
-@@ -1509,6 +1521,15 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
- limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
-
- out:
-+ if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
-+ /*
-+ * NOHZ_FULL CPUs need this as the governor callback may not
-+ * be invoked on them.
-+ */
-+ intel_pstate_clear_update_util_hook(policy->cpu);
-+ intel_pstate_max_within_limits(cpu);
-+ }
-+
- intel_pstate_set_update_util_hook(policy->cpu);
-
- intel_pstate_hwp_set_policy(policy);
-diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
-index 1f01e98..73ae849 100644
---- a/drivers/dax/pmem.c
-+++ b/drivers/dax/pmem.c
-@@ -44,7 +44,6 @@ static void dax_pmem_percpu_exit(void *data)
-
- dev_dbg(dax_pmem->dev, "%s\n", __func__);
- percpu_ref_exit(ref);
-- wait_for_completion(&dax_pmem->cmp);
- }
-
- static void dax_pmem_percpu_kill(void *data)
-@@ -54,6 +53,7 @@ static void dax_pmem_percpu_kill(void *data)
-
- dev_dbg(dax_pmem->dev, "%s\n", __func__);
- percpu_ref_kill(ref);
-+ wait_for_completion(&dax_pmem->cmp);
- }
-
- static int dax_pmem_probe(struct device *dev)
-diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
-index 309311b..1547589 100644
---- a/drivers/firewire/net.c
-+++ b/drivers/firewire/net.c
-@@ -73,13 +73,13 @@ struct rfc2734_header {
-
- #define fwnet_get_hdr_lf(h) (((h)->w0 & 0xc0000000) >> 30)
- #define fwnet_get_hdr_ether_type(h) (((h)->w0 & 0x0000ffff))
--#define fwnet_get_hdr_dg_size(h) (((h)->w0 & 0x0fff0000) >> 16)
-+#define fwnet_get_hdr_dg_size(h) ((((h)->w0 & 0x0fff0000) >> 16) + 1)
- #define fwnet_get_hdr_fg_off(h) (((h)->w0 & 0x00000fff))
- #define fwnet_get_hdr_dgl(h) (((h)->w1 & 0xffff0000) >> 16)
-
--#define fwnet_set_hdr_lf(lf) ((lf) << 30)
-+#define fwnet_set_hdr_lf(lf) ((lf) << 30)
- #define fwnet_set_hdr_ether_type(et) (et)
--#define fwnet_set_hdr_dg_size(dgs) ((dgs) << 16)
-+#define fwnet_set_hdr_dg_size(dgs) (((dgs) - 1) << 16)
- #define fwnet_set_hdr_fg_off(fgo) (fgo)
-
- #define fwnet_set_hdr_dgl(dgl) ((dgl) << 16)
-@@ -578,6 +578,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
- int retval;
- u16 ether_type;
-
-+ if (len <= RFC2374_UNFRAG_HDR_SIZE)
-+ return 0;
-+
- hdr.w0 = be32_to_cpu(buf[0]);
- lf = fwnet_get_hdr_lf(&hdr);
- if (lf == RFC2374_HDR_UNFRAG) {
-@@ -602,7 +605,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
- return fwnet_finish_incoming_packet(net, skb, source_node_id,
- is_broadcast, ether_type);
- }
-+
- /* A datagram fragment has been received, now the fun begins. */
-+
-+ if (len <= RFC2374_FRAG_HDR_SIZE)
-+ return 0;
-+
- hdr.w1 = ntohl(buf[1]);
- buf += 2;
- len -= RFC2374_FRAG_HDR_SIZE;
-@@ -614,7 +622,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
- fg_off = fwnet_get_hdr_fg_off(&hdr);
- }
- datagram_label = fwnet_get_hdr_dgl(&hdr);
-- dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */
-+ dg_size = fwnet_get_hdr_dg_size(&hdr);
-+
-+ if (fg_off + len > dg_size)
-+ return 0;
-
- spin_lock_irqsave(&dev->lock, flags);
-
-@@ -722,6 +733,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
- fw_send_response(card, r, rcode);
- }
-
-+static int gasp_source_id(__be32 *p)
-+{
-+ return be32_to_cpu(p[0]) >> 16;
-+}
-+
-+static u32 gasp_specifier_id(__be32 *p)
-+{
-+ return (be32_to_cpu(p[0]) & 0xffff) << 8 |
-+ (be32_to_cpu(p[1]) & 0xff000000) >> 24;
-+}
-+
-+static u32 gasp_version(__be32 *p)
-+{
-+ return be32_to_cpu(p[1]) & 0xffffff;
-+}
-+
- static void fwnet_receive_broadcast(struct fw_iso_context *context,
- u32 cycle, size_t header_length, void *header, void *data)
- {
-@@ -731,9 +758,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
- __be32 *buf_ptr;
- int retval;
- u32 length;
-- u16 source_node_id;
-- u32 specifier_id;
-- u32 ver;
- unsigned long offset;
- unsigned long flags;
-
-@@ -750,22 +774,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
-
- spin_unlock_irqrestore(&dev->lock, flags);
-
-- specifier_id = (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8
-- | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24;
-- ver = be32_to_cpu(buf_ptr[1]) & 0xffffff;
-- source_node_id = be32_to_cpu(buf_ptr[0]) >> 16;
--
-- if (specifier_id == IANA_SPECIFIER_ID &&
-- (ver == RFC2734_SW_VERSION
-+ if (length > IEEE1394_GASP_HDR_SIZE &&
-+ gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID &&
-+ (gasp_version(buf_ptr) == RFC2734_SW_VERSION
- #if IS_ENABLED(CONFIG_IPV6)
-- || ver == RFC3146_SW_VERSION
-+ || gasp_version(buf_ptr) == RFC3146_SW_VERSION
- #endif
-- )) {
-- buf_ptr += 2;
-- length -= IEEE1394_GASP_HDR_SIZE;
-- fwnet_incoming_packet(dev, buf_ptr, length, source_node_id,
-+ ))
-+ fwnet_incoming_packet(dev, buf_ptr + 2,
-+ length - IEEE1394_GASP_HDR_SIZE,
-+ gasp_source_id(buf_ptr),
- context->card->generation, true);
-- }
-
- packet.payload_length = dev->rcv_buffer_size;
- packet.interrupt = 1;
-diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
-index af51461..14f2d98 100644
---- a/drivers/gpio/gpiolib-acpi.c
-+++ b/drivers/gpio/gpiolib-acpi.c
-@@ -602,14 +602,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
- {
- int idx, i;
- unsigned int irq_flags;
-+ int ret = -ENOENT;
-
- for (i = 0, idx = 0; idx <= index; i++) {
- struct acpi_gpio_info info;
- struct gpio_desc *desc;
-
- desc = acpi_get_gpiod_by_index(adev, NULL, i, &info);
-- if (IS_ERR(desc))
-+ if (IS_ERR(desc)) {
-+ ret = PTR_ERR(desc);
- break;
-+ }
- if (info.gpioint && idx++ == index) {
- int irq = gpiod_to_irq(desc);
-
-@@ -628,7 +631,7 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
- }
-
- }
-- return -ENOENT;
-+ return ret;
- }
- EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get);
-
-diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
-index 53ff25a..b2dee10 100644
---- a/drivers/gpio/gpiolib.c
-+++ b/drivers/gpio/gpiolib.c
-@@ -21,6 +21,7 @@
- #include <linux/uaccess.h>
- #include <linux/compat.h>
- #include <linux/anon_inodes.h>
-+#include <linux/file.h>
- #include <linux/kfifo.h>
- #include <linux/poll.h>
- #include <linux/timekeeping.h>
-@@ -331,6 +332,13 @@ struct linehandle_state {
- u32 numdescs;
- };
-
-+#define GPIOHANDLE_REQUEST_VALID_FLAGS \
-+ (GPIOHANDLE_REQUEST_INPUT | \
-+ GPIOHANDLE_REQUEST_OUTPUT | \
-+ GPIOHANDLE_REQUEST_ACTIVE_LOW | \
-+ GPIOHANDLE_REQUEST_OPEN_DRAIN | \
-+ GPIOHANDLE_REQUEST_OPEN_SOURCE)
-+
- static long linehandle_ioctl(struct file *filep, unsigned int cmd,
- unsigned long arg)
- {
-@@ -342,6 +350,8 @@ static long linehandle_ioctl(struct file *filep, unsigned int cmd,
- if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
- int val;
-
-+ memset(&ghd, 0, sizeof(ghd));
-+
- /* TODO: check if descriptors are really input */
- for (i = 0; i < lh->numdescs; i++) {
- val = gpiod_get_value_cansleep(lh->descs[i]);
-@@ -412,6 +422,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
- {
- struct gpiohandle_request handlereq;
- struct linehandle_state *lh;
-+ struct file *file;
- int fd, i, ret;
-
- if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
-@@ -442,6 +453,17 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
- u32 lflags = handlereq.flags;
- struct gpio_desc *desc;
-
-+ if (offset >= gdev->ngpio) {
-+ ret = -EINVAL;
-+ goto out_free_descs;
-+ }
-+
-+ /* Return an error if a unknown flag is set */
-+ if (lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) {
-+ ret = -EINVAL;
-+ goto out_free_descs;
-+ }
-+
- desc = &gdev->descs[offset];
- ret = gpiod_request(desc, lh->label);
- if (ret)
-@@ -477,26 +499,41 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
- i--;
- lh->numdescs = handlereq.lines;
-
-- fd = anon_inode_getfd("gpio-linehandle",
-- &linehandle_fileops,
-- lh,
-- O_RDONLY | O_CLOEXEC);
-+ fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
- if (fd < 0) {
- ret = fd;
- goto out_free_descs;
- }
-
-+ file = anon_inode_getfile("gpio-linehandle",
-+ &linehandle_fileops,
-+ lh,
-+ O_RDONLY | O_CLOEXEC);
-+ if (IS_ERR(file)) {
-+ ret = PTR_ERR(file);
-+ goto out_put_unused_fd;
-+ }
-+
- handlereq.fd = fd;
- if (copy_to_user(ip, &handlereq, sizeof(handlereq))) {
-- ret = -EFAULT;
-- goto out_free_descs;
-+ /*
-+ * fput() will trigger the release() callback, so do not go onto
-+ * the regular error cleanup path here.
-+ */
-+ fput(file);
-+ put_unused_fd(fd);
-+ return -EFAULT;
- }
-
-+ fd_install(fd, file);
-+
- dev_dbg(&gdev->dev, "registered chardev handle for %d lines\n",
- lh->numdescs);
-
- return 0;
-
-+out_put_unused_fd:
-+ put_unused_fd(fd);
- out_free_descs:
- for (; i >= 0; i--)
- gpiod_free(lh->descs[i]);
-@@ -534,6 +571,10 @@ struct lineevent_state {
- struct mutex read_lock;
- };
-
-+#define GPIOEVENT_REQUEST_VALID_FLAGS \
-+ (GPIOEVENT_REQUEST_RISING_EDGE | \
-+ GPIOEVENT_REQUEST_FALLING_EDGE)
-+
- static unsigned int lineevent_poll(struct file *filep,
- struct poll_table_struct *wait)
- {
-@@ -621,6 +662,8 @@ static long lineevent_ioctl(struct file *filep, unsigned int cmd,
- if (cmd == GPIOHANDLE_GET_LINE_VALUES_IOCTL) {
- int val;
-
-+ memset(&ghd, 0, sizeof(ghd));
-+
- val = gpiod_get_value_cansleep(le->desc);
- if (val < 0)
- return val;
-@@ -693,6 +736,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
- struct gpioevent_request eventreq;
- struct lineevent_state *le;
- struct gpio_desc *desc;
-+ struct file *file;
- u32 offset;
- u32 lflags;
- u32 eflags;
-@@ -724,6 +768,18 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
- lflags = eventreq.handleflags;
- eflags = eventreq.eventflags;
-
-+ if (offset >= gdev->ngpio) {
-+ ret = -EINVAL;
-+ goto out_free_label;
-+ }
-+
-+ /* Return an error if a unknown flag is set */
-+ if ((lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) ||
-+ (eflags & ~GPIOEVENT_REQUEST_VALID_FLAGS)) {
-+ ret = -EINVAL;
-+ goto out_free_label;
-+ }
-+
- /* This is just wrong: we don't look for events on output lines */
- if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
- ret = -EINVAL;
-@@ -775,23 +831,38 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
- if (ret)
- goto out_free_desc;
-
-- fd = anon_inode_getfd("gpio-event",
-- &lineevent_fileops,
-- le,
-- O_RDONLY | O_CLOEXEC);
-+ fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
- if (fd < 0) {
- ret = fd;
- goto out_free_irq;
- }
-
-+ file = anon_inode_getfile("gpio-event",
-+ &lineevent_fileops,
-+ le,
-+ O_RDONLY | O_CLOEXEC);
-+ if (IS_ERR(file)) {
-+ ret = PTR_ERR(file);
-+ goto out_put_unused_fd;
-+ }
-+
- eventreq.fd = fd;
- if (copy_to_user(ip, &eventreq, sizeof(eventreq))) {
-- ret = -EFAULT;
-- goto out_free_irq;
-+ /*
-+ * fput() will trigger the release() callback, so do not go onto
-+ * the regular error cleanup path here.
-+ */
-+ fput(file);
-+ put_unused_fd(fd);
-+ return -EFAULT;
- }
-
-+ fd_install(fd, file);
-+
- return 0;
-
-+out_put_unused_fd:
-+ put_unused_fd(fd);
- out_free_irq:
- free_irq(le->irq, le);
- out_free_desc:
-@@ -821,6 +892,8 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- if (cmd == GPIO_GET_CHIPINFO_IOCTL) {
- struct gpiochip_info chipinfo;
-
-+ memset(&chipinfo, 0, sizeof(chipinfo));
-+
- strncpy(chipinfo.name, dev_name(&gdev->dev),
- sizeof(chipinfo.name));
- chipinfo.name[sizeof(chipinfo.name)-1] = '\0';
-@@ -837,7 +910,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-
- if (copy_from_user(&lineinfo, ip, sizeof(lineinfo)))
- return -EFAULT;
-- if (lineinfo.line_offset > gdev->ngpio)
-+ if (lineinfo.line_offset >= gdev->ngpio)
- return -EINVAL;
-
- desc = &gdev->descs[lineinfo.line_offset];
-diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
-index 2a3ded4..7c8c185 100644
---- a/drivers/gpu/drm/drm_atomic.c
-+++ b/drivers/gpu/drm/drm_atomic.c
-@@ -420,18 +420,21 @@ drm_atomic_replace_property_blob_from_id(struct drm_crtc *crtc,
- ssize_t expected_size,
- bool *replaced)
- {
-- struct drm_device *dev = crtc->dev;
- struct drm_property_blob *new_blob = NULL;
-
- if (blob_id != 0) {
-- new_blob = drm_property_lookup_blob(dev, blob_id);
-+ new_blob = drm_property_lookup_blob(crtc->dev, blob_id);
- if (new_blob == NULL)
- return -EINVAL;
-- if (expected_size > 0 && expected_size != new_blob->length)
-+
-+ if (expected_size > 0 && expected_size != new_blob->length) {
-+ drm_property_unreference_blob(new_blob);
- return -EINVAL;
-+ }
- }
-
- drm_atomic_replace_property_blob(blob, new_blob, replaced);
-+ drm_property_unreference_blob(new_blob);
-
- return 0;
- }
-diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
-index 04e4571..aa64448 100644
---- a/drivers/gpu/drm/drm_dp_mst_topology.c
-+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
-@@ -914,6 +914,7 @@ static void drm_dp_destroy_port(struct kref *kref)
- /* no need to clean up vcpi
- * as if we have no connector we never setup a vcpi */
- drm_dp_port_teardown_pdt(port, port->pdt);
-+ port->pdt = DP_PEER_DEVICE_NONE;
- }
- kfree(port);
- }
-@@ -1159,7 +1160,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
- drm_dp_put_port(port);
- goto out;
- }
-- if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
-+ if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV ||
-+ port->pdt == DP_PEER_DEVICE_SST_SINK) &&
-+ port->port_num >= DP_MST_LOGICAL_PORT_0) {
- port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
- drm_mode_connector_set_tile_property(port->connector);
- }
-@@ -2919,6 +2922,7 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
- mgr->cbs->destroy_connector(mgr, port->connector);
-
- drm_dp_port_teardown_pdt(port, port->pdt);
-+ port->pdt = DP_PEER_DEVICE_NONE;
-
- if (!port->input && port->vcpi.vcpi > 0) {
- drm_dp_mst_reset_vcpi_slots(mgr, port);
-diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
-index 0a06f91..337c555 100644
---- a/drivers/gpu/drm/drm_fb_helper.c
-+++ b/drivers/gpu/drm/drm_fb_helper.c
-@@ -129,7 +129,12 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
- return 0;
- fail:
- for (i = 0; i < fb_helper->connector_count; i++) {
-- kfree(fb_helper->connector_info[i]);
-+ struct drm_fb_helper_connector *fb_helper_connector =
-+ fb_helper->connector_info[i];
-+
-+ drm_connector_unreference(fb_helper_connector->connector);
-+
-+ kfree(fb_helper_connector);
- fb_helper->connector_info[i] = NULL;
- }
- fb_helper->connector_count = 0;
-@@ -601,6 +606,24 @@ int drm_fb_helper_blank(int blank, struct fb_info *info)
- }
- EXPORT_SYMBOL(drm_fb_helper_blank);
-
-+static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper,
-+ struct drm_mode_set *modeset)
-+{
-+ int i;
-+
-+ for (i = 0; i < modeset->num_connectors; i++) {
-+ drm_connector_unreference(modeset->connectors[i]);
-+ modeset->connectors[i] = NULL;
-+ }
-+ modeset->num_connectors = 0;
-+
-+ drm_mode_destroy(helper->dev, modeset->mode);
-+ modeset->mode = NULL;
-+
-+ /* FIXME should hold a ref? */
-+ modeset->fb = NULL;
-+}
-+
- static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
- {
- int i;
-@@ -610,10 +633,12 @@ static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
- kfree(helper->connector_info[i]);
- }
- kfree(helper->connector_info);
-+
- for (i = 0; i < helper->crtc_count; i++) {
-- kfree(helper->crtc_info[i].mode_set.connectors);
-- if (helper->crtc_info[i].mode_set.mode)
-- drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode);
-+ struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set;
-+
-+ drm_fb_helper_modeset_release(helper, modeset);
-+ kfree(modeset->connectors);
- }
- kfree(helper->crtc_info);
- }
-@@ -632,7 +657,9 @@ static void drm_fb_helper_dirty_work(struct work_struct *work)
- clip->x2 = clip->y2 = 0;
- spin_unlock_irqrestore(&helper->dirty_lock, flags);
-
-- helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
-+ /* call dirty callback only when it has been really touched */
-+ if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2)
-+ helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
- }
-
- /**
-@@ -2027,7 +2054,6 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
- struct drm_fb_helper_crtc **crtcs;
- struct drm_display_mode **modes;
- struct drm_fb_offset *offsets;
-- struct drm_mode_set *modeset;
- bool *enabled;
- int width, height;
- int i;
-@@ -2075,45 +2101,35 @@ static void drm_setup_crtcs(struct drm_fb_helper *fb_helper)
-
- /* need to set the modesets up here for use later */
- /* fill out the connector<->crtc mappings into the modesets */
-- for (i = 0; i < fb_helper->crtc_count; i++) {
-- modeset = &fb_helper->crtc_info[i].mode_set;
-- modeset->num_connectors = 0;
-- modeset->fb = NULL;
-- }
-+ for (i = 0; i < fb_helper->crtc_count; i++)
-+ drm_fb_helper_modeset_release(fb_helper,
-+ &fb_helper->crtc_info[i].mode_set);
-
- for (i = 0; i < fb_helper->connector_count; i++) {
- struct drm_display_mode *mode = modes[i];
- struct drm_fb_helper_crtc *fb_crtc = crtcs[i];
- struct drm_fb_offset *offset = &offsets[i];
-- modeset = &fb_crtc->mode_set;
-+ struct drm_mode_set *modeset = &fb_crtc->mode_set;
-
- if (mode && fb_crtc) {
-+ struct drm_connector *connector =
-+ fb_helper->connector_info[i]->connector;
-+
- DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n",
- mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y);
-+
- fb_crtc->desired_mode = mode;
- fb_crtc->x = offset->x;
- fb_crtc->y = offset->y;
-- if (modeset->mode)
-- drm_mode_destroy(dev, modeset->mode);
- modeset->mode = drm_mode_duplicate(dev,
- fb_crtc->desired_mode);
-- modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector;
-+ drm_connector_reference(connector);
-+ modeset->connectors[modeset->num_connectors++] = connector;
- modeset->fb = fb_helper->fb;
- modeset->x = offset->x;
- modeset->y = offset->y;
- }
- }
--
-- /* Clear out any old modes if there are no more connected outputs. */
-- for (i = 0; i < fb_helper->crtc_count; i++) {
-- modeset = &fb_helper->crtc_info[i].mode_set;
-- if (modeset->num_connectors == 0) {
-- BUG_ON(modeset->fb);
-- if (modeset->mode)
-- drm_mode_destroy(dev, modeset->mode);
-- modeset->mode = NULL;
-- }
-- }
- out:
- kfree(crtcs);
- kfree(modes);
-diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
-index c6e69e4..1f8af87 100644
---- a/drivers/gpu/drm/i915/intel_bios.c
-+++ b/drivers/gpu/drm/i915/intel_bios.c
-@@ -1031,6 +1031,77 @@ static u8 translate_iboost(u8 val)
- return mapping[val];
- }
-
-+static void sanitize_ddc_pin(struct drm_i915_private *dev_priv,
-+ enum port port)
-+{
-+ const struct ddi_vbt_port_info *info =
-+ &dev_priv->vbt.ddi_port_info[port];
-+ enum port p;
-+
-+ if (!info->alternate_ddc_pin)
-+ return;
-+
-+ for_each_port_masked(p, (1 << port) - 1) {
-+ struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
-+
-+ if (info->alternate_ddc_pin != i->alternate_ddc_pin)
-+ continue;
-+
-+ DRM_DEBUG_KMS("port %c trying to use the same DDC pin (0x%x) as port %c, "
-+ "disabling port %c DVI/HDMI support\n",
-+ port_name(p), i->alternate_ddc_pin,
-+ port_name(port), port_name(p));
-+
-+ /*
-+ * If we have multiple ports supposedly sharing the
-+ * pin, then dvi/hdmi couldn't exist on the shared
-+ * port. Otherwise they share the same ddc bin and
-+ * system couldn't communicate with them separately.
-+ *
-+ * Due to parsing the ports in alphabetical order,
-+ * a higher port will always clobber a lower one.
-+ */
-+ i->supports_dvi = false;
-+ i->supports_hdmi = false;
-+ i->alternate_ddc_pin = 0;
-+ }
-+}
-+
-+static void sanitize_aux_ch(struct drm_i915_private *dev_priv,
-+ enum port port)
-+{
-+ const struct ddi_vbt_port_info *info =
-+ &dev_priv->vbt.ddi_port_info[port];
-+ enum port p;
-+
-+ if (!info->alternate_aux_channel)
-+ return;
-+
-+ for_each_port_masked(p, (1 << port) - 1) {
-+ struct ddi_vbt_port_info *i = &dev_priv->vbt.ddi_port_info[p];
-+
-+ if (info->alternate_aux_channel != i->alternate_aux_channel)
-+ continue;
-+
-+ DRM_DEBUG_KMS("port %c trying to use the same AUX CH (0x%x) as port %c, "
-+ "disabling port %c DP support\n",
-+ port_name(p), i->alternate_aux_channel,
-+ port_name(port), port_name(p));
-+
-+ /*
-+ * If we have multiple ports supposedlt sharing the
-+ * aux channel, then DP couldn't exist on the shared
-+ * port. Otherwise they share the same aux channel
-+ * and system couldn't communicate with them separately.
-+ *
-+ * Due to parsing the ports in alphabetical order,
-+ * a higher port will always clobber a lower one.
-+ */
-+ i->supports_dp = false;
-+ i->alternate_aux_channel = 0;
-+ }
-+}
-+
- static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
- const struct bdb_header *bdb)
- {
-@@ -1105,54 +1176,15 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
- DRM_DEBUG_KMS("Port %c is internal DP\n", port_name(port));
-
- if (is_dvi) {
-- if (port == PORT_E) {
-- info->alternate_ddc_pin = ddc_pin;
-- /* if DDIE share ddc pin with other port, then
-- * dvi/hdmi couldn't exist on the shared port.
-- * Otherwise they share the same ddc bin and system
-- * couldn't communicate with them seperately. */
-- if (ddc_pin == DDC_PIN_B) {
-- dev_priv->vbt.ddi_port_info[PORT_B].supports_dvi = 0;
-- dev_priv->vbt.ddi_port_info[PORT_B].supports_hdmi = 0;
-- } else if (ddc_pin == DDC_PIN_C) {
-- dev_priv->vbt.ddi_port_info[PORT_C].supports_dvi = 0;
-- dev_priv->vbt.ddi_port_info[PORT_C].supports_hdmi = 0;
-- } else if (ddc_pin == DDC_PIN_D) {
-- dev_priv->vbt.ddi_port_info[PORT_D].supports_dvi = 0;
-- dev_priv->vbt.ddi_port_info[PORT_D].supports_hdmi = 0;
-- }
-- } else if (ddc_pin == DDC_PIN_B && port != PORT_B)
-- DRM_DEBUG_KMS("Unexpected DDC pin for port B\n");
-- else if (ddc_pin == DDC_PIN_C && port != PORT_C)
-- DRM_DEBUG_KMS("Unexpected DDC pin for port C\n");
-- else if (ddc_pin == DDC_PIN_D && port != PORT_D)
-- DRM_DEBUG_KMS("Unexpected DDC pin for port D\n");
-+ info->alternate_ddc_pin = ddc_pin;
-+
-+ sanitize_ddc_pin(dev_priv, port);
- }
-
- if (is_dp) {
-- if (port == PORT_E) {
-- info->alternate_aux_channel = aux_channel;
-- /* if DDIE share aux channel with other port, then
-- * DP couldn't exist on the shared port. Otherwise
-- * they share the same aux channel and system
-- * couldn't communicate with them seperately. */
-- if (aux_channel == DP_AUX_A)
-- dev_priv->vbt.ddi_port_info[PORT_A].supports_dp = 0;
-- else if (aux_channel == DP_AUX_B)
-- dev_priv->vbt.ddi_port_info[PORT_B].supports_dp = 0;
-- else if (aux_channel == DP_AUX_C)
-- dev_priv->vbt.ddi_port_info[PORT_C].supports_dp = 0;
-- else if (aux_channel == DP_AUX_D)
-- dev_priv->vbt.ddi_port_info[PORT_D].supports_dp = 0;
-- }
-- else if (aux_channel == DP_AUX_A && port != PORT_A)
-- DRM_DEBUG_KMS("Unexpected AUX channel for port A\n");
-- else if (aux_channel == DP_AUX_B && port != PORT_B)
-- DRM_DEBUG_KMS("Unexpected AUX channel for port B\n");
-- else if (aux_channel == DP_AUX_C && port != PORT_C)
-- DRM_DEBUG_KMS("Unexpected AUX channel for port C\n");
-- else if (aux_channel == DP_AUX_D && port != PORT_D)
-- DRM_DEBUG_KMS("Unexpected AUX channel for port D\n");
-+ info->alternate_aux_channel = aux_channel;
-+
-+ sanitize_aux_ch(dev_priv, port);
- }
-
- if (bdb->version >= 158) {
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e9a64fb..63462f2 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -13834,7 +13834,7 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
-
- for_each_plane_in_state(state, plane, plane_state, i) {
- struct intel_plane_state *intel_plane_state =
-- to_intel_plane_state(plane_state);
-+ to_intel_plane_state(plane->state);
-
- if (!intel_plane_state->wait_req)
- continue;
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index 1ca155f..3051182 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -1090,6 +1090,44 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
- return ret;
- }
-
-+static enum port intel_aux_port(struct drm_i915_private *dev_priv,
-+ enum port port)
-+{
-+ const struct ddi_vbt_port_info *info =
-+ &dev_priv->vbt.ddi_port_info[port];
-+ enum port aux_port;
-+
-+ if (!info->alternate_aux_channel) {
-+ DRM_DEBUG_KMS("using AUX %c for port %c (platform default)\n",
-+ port_name(port), port_name(port));
-+ return port;
-+ }
-+
-+ switch (info->alternate_aux_channel) {
-+ case DP_AUX_A:
-+ aux_port = PORT_A;
-+ break;
-+ case DP_AUX_B:
-+ aux_port = PORT_B;
-+ break;
-+ case DP_AUX_C:
-+ aux_port = PORT_C;
-+ break;
-+ case DP_AUX_D:
-+ aux_port = PORT_D;
-+ break;
-+ default:
-+ MISSING_CASE(info->alternate_aux_channel);
-+ aux_port = PORT_A;
-+ break;
-+ }
-+
-+ DRM_DEBUG_KMS("using AUX %c for port %c (VBT)\n",
-+ port_name(aux_port), port_name(port));
-+
-+ return aux_port;
-+}
-+
- static i915_reg_t g4x_aux_ctl_reg(struct drm_i915_private *dev_priv,
- enum port port)
- {
-@@ -1150,36 +1188,9 @@ static i915_reg_t ilk_aux_data_reg(struct drm_i915_private *dev_priv,
- }
- }
-
--/*
-- * On SKL we don't have Aux for port E so we rely
-- * on VBT to set a proper alternate aux channel.
-- */
--static enum port skl_porte_aux_port(struct drm_i915_private *dev_priv)
--{
-- const struct ddi_vbt_port_info *info =
-- &dev_priv->vbt.ddi_port_info[PORT_E];
--
-- switch (info->alternate_aux_channel) {
-- case DP_AUX_A:
-- return PORT_A;
-- case DP_AUX_B:
-- return PORT_B;
-- case DP_AUX_C:
-- return PORT_C;
-- case DP_AUX_D:
-- return PORT_D;
-- default:
-- MISSING_CASE(info->alternate_aux_channel);
-- return PORT_A;
-- }
--}
--
- static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
- enum port port)
- {
-- if (port == PORT_E)
-- port = skl_porte_aux_port(dev_priv);
--
- switch (port) {
- case PORT_A:
- case PORT_B:
-@@ -1195,9 +1206,6 @@ static i915_reg_t skl_aux_ctl_reg(struct drm_i915_private *dev_priv,
- static i915_reg_t skl_aux_data_reg(struct drm_i915_private *dev_priv,
- enum port port, int index)
- {
-- if (port == PORT_E)
-- port = skl_porte_aux_port(dev_priv);
--
- switch (port) {
- case PORT_A:
- case PORT_B:
-@@ -1235,7 +1243,8 @@ static i915_reg_t intel_aux_data_reg(struct drm_i915_private *dev_priv,
- static void intel_aux_reg_init(struct intel_dp *intel_dp)
- {
- struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
-- enum port port = dp_to_dig_port(intel_dp)->port;
-+ enum port port = intel_aux_port(dev_priv,
-+ dp_to_dig_port(intel_dp)->port);
- int i;
-
- intel_dp->aux_ch_ctl_reg = intel_aux_ctl_reg(dev_priv, port);
-diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
-index 3836a1c..ad483376 100644
---- a/drivers/gpu/drm/i915/intel_fbc.c
-+++ b/drivers/gpu/drm/i915/intel_fbc.c
-@@ -104,8 +104,10 @@ static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
- int lines;
-
- intel_fbc_get_plane_source_size(cache, NULL, &lines);
-- if (INTEL_INFO(dev_priv)->gen >= 7)
-+ if (INTEL_GEN(dev_priv) == 7)
- lines = min(lines, 2048);
-+ else if (INTEL_GEN(dev_priv) >= 8)
-+ lines = min(lines, 2560);
-
- /* Hardware needs the full buffer stride, not just the active area. */
- return lines * cache->fb.stride;
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index e59a28c..a691605 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -3363,13 +3363,15 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
- int num_active;
- int id, i;
-
-+ /* Clear the partitioning for disabled planes. */
-+ memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
-+ memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
-+
- if (WARN_ON(!state))
- return 0;
-
- if (!cstate->base.active) {
- ddb->pipe[pipe].start = ddb->pipe[pipe].end = 0;
-- memset(ddb->plane[pipe], 0, sizeof(ddb->plane[pipe]));
-- memset(ddb->y_plane[pipe], 0, sizeof(ddb->y_plane[pipe]));
- return 0;
- }
-
-@@ -3469,12 +3471,6 @@ skl_allocate_pipe_ddb(struct intel_crtc_state *cstate,
- return 0;
- }
-
--static uint32_t skl_pipe_pixel_rate(const struct intel_crtc_state *config)
--{
-- /* TODO: Take into account the scalers once we support them */
-- return config->base.adjusted_mode.crtc_clock;
--}
--
- /*
- * The max latency should be 257 (max the punit can code is 255 and we add 2us
- * for the read latency) and cpp should always be <= 8, so that
-@@ -3525,7 +3521,7 @@ static uint32_t skl_adjusted_plane_pixel_rate(const struct intel_crtc_state *cst
- * Adjusted plane pixel rate is just the pipe's adjusted pixel rate
- * with additional adjustments for plane-specific scaling.
- */
-- adjusted_pixel_rate = skl_pipe_pixel_rate(cstate);
-+ adjusted_pixel_rate = ilk_pipe_pixel_rate(cstate);
- downscale_amount = skl_plane_downscale_amount(pstate);
-
- pixel_rate = adjusted_pixel_rate * downscale_amount >> 16;
-@@ -3737,11 +3733,11 @@ skl_compute_linetime_wm(struct intel_crtc_state *cstate)
- if (!cstate->base.active)
- return 0;
-
-- if (WARN_ON(skl_pipe_pixel_rate(cstate) == 0))
-+ if (WARN_ON(ilk_pipe_pixel_rate(cstate) == 0))
- return 0;
-
- return DIV_ROUND_UP(8 * cstate->base.adjusted_mode.crtc_htotal * 1000,
-- skl_pipe_pixel_rate(cstate));
-+ ilk_pipe_pixel_rate(cstate));
- }
-
- static void skl_compute_transition_wm(struct intel_crtc_state *cstate,
-@@ -4051,6 +4047,12 @@ skl_compute_ddb(struct drm_atomic_state *state)
- intel_state->wm_results.dirty_pipes = ~0;
- }
-
-+ /*
-+ * We're not recomputing for the pipes not included in the commit, so
-+ * make sure we start with the current state.
-+ */
-+ memcpy(ddb, &dev_priv->wm.skl_hw.ddb, sizeof(*ddb));
-+
- for_each_intel_crtc_mask(dev, intel_crtc, realloc_pipes) {
- struct intel_crtc_state *cstate;
-
-diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
-index 29423e75..927c51e 100644
---- a/drivers/gpu/drm/imx/ipuv3-plane.c
-+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
-@@ -108,6 +108,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
- {
- struct drm_plane *plane = &ipu_plane->base;
- struct drm_plane_state *state = plane->state;
-+ struct drm_crtc_state *crtc_state = state->crtc->state;
- struct drm_framebuffer *fb = state->fb;
- unsigned long eba, ubo, vbo;
- int active;
-@@ -149,7 +150,7 @@ static void ipu_plane_atomic_set_base(struct ipu_plane *ipu_plane,
- break;
- }
-
-- if (old_state->fb) {
-+ if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
- active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch);
- ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba);
- ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active);
-@@ -359,7 +360,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
- if ((ubo > 0xfffff8) || (vbo > 0xfffff8))
- return -EINVAL;
-
-- if (old_fb) {
-+ if (old_fb &&
-+ (old_fb->pixel_format == DRM_FORMAT_YUV420 ||
-+ old_fb->pixel_format == DRM_FORMAT_YVU420)) {
- old_ubo = drm_plane_state_to_ubo(old_state);
- old_vbo = drm_plane_state_to_vbo(old_state);
- if (ubo != old_ubo || vbo != old_vbo)
-diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
-index dc57b62..193573d 100644
---- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
-@@ -240,7 +240,8 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
- if (!parent_adev)
- return false;
-
-- return acpi_has_method(parent_adev->handle, "_PR3");
-+ return parent_adev->power.flags.power_resources &&
-+ acpi_has_method(parent_adev->handle, "_PR3");
- }
-
- static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out,
-diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
-index 4a3d7ca..4b9c2d5 100644
---- a/drivers/gpu/drm/radeon/ni.c
-+++ b/drivers/gpu/drm/radeon/ni.c
-@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev)
- void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
- int ring, u32 cp_int_cntl)
- {
-- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
--
-- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
-+ WREG32(SRBM_GFX_CNTL, RINGID(ring));
- WREG32(CP_INT_CNTL, cp_int_cntl);
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
-index db64e00..3b0c229 100644
---- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
-+++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
-@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg
-
- tmp &= AUX_HPD_SEL(0x7);
- tmp |= AUX_HPD_SEL(chan->rec.hpd);
-- tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
-+ tmp |= AUX_EN | AUX_LS_READ_EN;
-
- WREG32(AUX_CONTROL + aux_offset[instance], tmp);
-
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 89bdf20..c4993452 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
- int i;
- struct si_dpm_quirk *p = si_dpm_quirk_list;
-
-+ /* limit all SI kickers */
-+ if (rdev->family == CHIP_PITCAIRN) {
-+ if ((rdev->pdev->revision == 0x81) ||
-+ (rdev->pdev->device == 0x6810) ||
-+ (rdev->pdev->device == 0x6811) ||
-+ (rdev->pdev->device == 0x6816) ||
-+ (rdev->pdev->device == 0x6817) ||
-+ (rdev->pdev->device == 0x6806))
-+ max_mclk = 120000;
-+ } else if (rdev->family == CHIP_VERDE) {
-+ if ((rdev->pdev->revision == 0x81) ||
-+ (rdev->pdev->revision == 0x83) ||
-+ (rdev->pdev->revision == 0x87) ||
-+ (rdev->pdev->device == 0x6820) ||
-+ (rdev->pdev->device == 0x6821) ||
-+ (rdev->pdev->device == 0x6822) ||
-+ (rdev->pdev->device == 0x6823) ||
-+ (rdev->pdev->device == 0x682A) ||
-+ (rdev->pdev->device == 0x682B)) {
-+ max_sclk = 75000;
-+ max_mclk = 80000;
-+ }
-+ } else if (rdev->family == CHIP_OLAND) {
-+ if ((rdev->pdev->revision == 0xC7) ||
-+ (rdev->pdev->revision == 0x80) ||
-+ (rdev->pdev->revision == 0x81) ||
-+ (rdev->pdev->revision == 0x83) ||
-+ (rdev->pdev->device == 0x6604) ||
-+ (rdev->pdev->device == 0x6605)) {
-+ max_sclk = 75000;
-+ max_mclk = 80000;
-+ }
-+ } else if (rdev->family == CHIP_HAINAN) {
-+ if ((rdev->pdev->revision == 0x81) ||
-+ (rdev->pdev->revision == 0x83) ||
-+ (rdev->pdev->revision == 0xC3) ||
-+ (rdev->pdev->device == 0x6664) ||
-+ (rdev->pdev->device == 0x6665) ||
-+ (rdev->pdev->device == 0x6667)) {
-+ max_sclk = 75000;
-+ max_mclk = 80000;
-+ }
-+ }
- /* Apply dpm quirks */
- while (p && p->chip_device != 0) {
- if (rdev->pdev->vendor == p->chip_vendor &&
-@@ -3011,16 +3054,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
- }
- ++p;
- }
-- /* limit mclk on all R7 370 parts for stability */
-- if (rdev->pdev->device == 0x6811 &&
-- rdev->pdev->revision == 0x81)
-- max_mclk = 120000;
-- /* limit sclk/mclk on Jet parts for stability */
-- if (rdev->pdev->device == 0x6665 &&
-- rdev->pdev->revision == 0xc3) {
-- max_sclk = 75000;
-- max_mclk = 80000;
-- }
-
- if (rps->vce_active) {
- rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index e92b09d..9ab703c 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -179,6 +179,7 @@
- #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
- #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
- #define USB_DEVICE_ID_ATEN_CS682 0x2213
-+#define USB_DEVICE_ID_ATEN_CS692 0x8021
-
- #define USB_VENDOR_ID_ATMEL 0x03eb
- #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index bb40008..85fcf60 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -63,6 +63,7 @@ static const struct hid_blacklist {
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
-+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
-diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
-index d5acaa2..9dc6372 100644
---- a/drivers/hv/hv_util.c
-+++ b/drivers/hv/hv_util.c
-@@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback(void *context)
- u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
- struct icmsg_negotiate *negop = NULL;
-
-- vmbus_recvpacket(channel, hbeat_txf_buf,
-- PAGE_SIZE, &recvlen, &requestid);
-+ while (1) {
-+
-+ vmbus_recvpacket(channel, hbeat_txf_buf,
-+ PAGE_SIZE, &recvlen, &requestid);
-+
-+ if (!recvlen)
-+ break;
-
-- if (recvlen > 0) {
- icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
- sizeof(struct vmbuspipe_hdr)];
-
-diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
-index 5c5b7ca..dfae435 100644
---- a/drivers/i2c/busses/i2c-rk3x.c
-+++ b/drivers/i2c/busses/i2c-rk3x.c
-@@ -694,6 +694,8 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate,
- t_calc->div_low--;
- t_calc->div_high--;
-
-+ /* Give the tuning value 0, that would not update con register */
-+ t_calc->tuning = 0;
- /* Maximum divider supported by hw is 0xffff */
- if (t_calc->div_low > 0xffff) {
- t_calc->div_low = 0xffff;
-diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
-index 4233f56..3c38029 100644
---- a/drivers/i2c/busses/i2c-xgene-slimpro.c
-+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
-@@ -105,7 +105,7 @@ struct slimpro_i2c_dev {
- struct mbox_chan *mbox_chan;
- struct mbox_client mbox_client;
- struct completion rd_complete;
-- u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];
-+ u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */
- u32 *resp_msg;
- };
-
-diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
-index da3a02e..a9a9f66 100644
---- a/drivers/i2c/i2c-core.c
-+++ b/drivers/i2c/i2c-core.c
-@@ -1592,6 +1592,7 @@ static struct i2c_client *of_i2c_register_device(struct i2c_adapter *adap,
- static void of_i2c_register_devices(struct i2c_adapter *adap)
- {
- struct device_node *node;
-+ struct i2c_client *client;
-
- /* Only register child devices if the adapter has a node pointer set */
- if (!adap->dev.of_node)
-@@ -1602,7 +1603,14 @@ static void of_i2c_register_devices(struct i2c_adapter *adap)
- for_each_available_child_of_node(adap->dev.of_node, node) {
- if (of_node_test_and_set_flag(node, OF_POPULATED))
- continue;
-- of_i2c_register_device(adap, node);
-+
-+ client = of_i2c_register_device(adap, node);
-+ if (IS_ERR(client)) {
-+ dev_warn(&adap->dev,
-+ "Failed to create I2C device for %s\n",
-+ node->full_name);
-+ of_node_clear_flag(node, OF_POPULATED);
-+ }
- }
- }
-
-@@ -2073,6 +2081,7 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
- /* add the driver to the list of i2c drivers in the driver core */
- driver->driver.owner = owner;
- driver->driver.bus = &i2c_bus_type;
-+ INIT_LIST_HEAD(&driver->clients);
-
- /* When registration returns, the driver core
- * will have called probe() for all matching-but-unbound devices.
-@@ -2083,7 +2092,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
-
- pr_debug("driver [%s] registered\n", driver->driver.name);
-
-- INIT_LIST_HEAD(&driver->clients);
- /* Walk the adapters that are already present */
- i2c_for_each_dev(driver, __process_new_driver);
-
-@@ -2201,6 +2209,7 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
- if (IS_ERR(client)) {
- dev_err(&adap->dev, "failed to create client for '%s'\n",
- rd->dn->full_name);
-+ of_node_clear_flag(rd->dn, OF_POPULATED);
- return notifier_from_errno(PTR_ERR(client));
- }
- break;
-diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
-index 407f141..a3fbdb7 100644
---- a/drivers/iio/chemical/atlas-ph-sensor.c
-+++ b/drivers/iio/chemical/atlas-ph-sensor.c
-@@ -207,13 +207,14 @@ static int atlas_check_ec_calibration(struct atlas_data *data)
- struct device *dev = &data->client->dev;
- int ret;
- unsigned int val;
-+ __be16 rval;
-
-- ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &val, 2);
-+ ret = regmap_bulk_read(data->regmap, ATLAS_REG_EC_PROBE, &rval, 2);
- if (ret)
- return ret;
-
-- dev_info(dev, "probe set to K = %d.%.2d", be16_to_cpu(val) / 100,
-- be16_to_cpu(val) % 100);
-+ val = be16_to_cpu(rval);
-+ dev_info(dev, "probe set to K = %d.%.2d", val / 100, val % 100);
-
- ret = regmap_read(data->regmap, ATLAS_REG_EC_CALIB_STATUS, &val);
- if (ret)
-diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
-index f4bfb4b..073246c 100644
---- a/drivers/input/serio/i8042-x86ia64io.h
-+++ b/drivers/input/serio/i8042-x86ia64io.h
-@@ -877,6 +877,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
- DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
- },
- },
-+ {
-+ /* Schenker XMG C504 - Elantech touchpad */
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
-+ DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
-+ },
-+ },
- { }
- };
-
-diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
-index 8abde6b..6d53810 100644
---- a/drivers/md/dm-raid.c
-+++ b/drivers/md/dm-raid.c
-@@ -266,7 +266,7 @@ static struct raid_type {
- {"raid10_offset", "raid10 offset (striped mirrors)", 0, 2, 10, ALGORITHM_RAID10_OFFSET},
- {"raid10_near", "raid10 near (striped mirrors)", 0, 2, 10, ALGORITHM_RAID10_NEAR},
- {"raid10", "raid10 (striped mirrors)", 0, 2, 10, ALGORITHM_RAID10_DEFAULT},
-- {"raid4", "raid4 (dedicated last parity disk)", 1, 2, 4, ALGORITHM_PARITY_N}, /* raid4 layout = raid5_n */
-+ {"raid4", "raid4 (dedicated first parity disk)", 1, 2, 5, ALGORITHM_PARITY_0}, /* raid4 layout = raid5_0 */
- {"raid5_n", "raid5 (dedicated last parity disk)", 1, 2, 5, ALGORITHM_PARITY_N},
- {"raid5_ls", "raid5 (left symmetric)", 1, 2, 5, ALGORITHM_LEFT_SYMMETRIC},
- {"raid5_rs", "raid5 (right symmetric)", 1, 2, 5, ALGORITHM_RIGHT_SYMMETRIC},
-@@ -2087,11 +2087,11 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
- /*
- * No takeover/reshaping, because we don't have the extended v1.9.0 metadata
- */
-- if (le32_to_cpu(sb->level) != mddev->level) {
-+ if (le32_to_cpu(sb->level) != mddev->new_level) {
- DMERR("Reshaping/takeover raid sets not yet supported. (raid level/stripes/size change)");
- return -EINVAL;
- }
-- if (le32_to_cpu(sb->layout) != mddev->layout) {
-+ if (le32_to_cpu(sb->layout) != mddev->new_layout) {
- DMERR("Reshaping raid sets not yet supported. (raid layout change)");
- DMERR(" 0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
- DMERR(" Old layout: %s w/ %d copies",
-@@ -2102,7 +2102,7 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
- raid10_md_layout_to_copies(mddev->layout));
- return -EINVAL;
- }
-- if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
-+ if (le32_to_cpu(sb->stripe_sectors) != mddev->new_chunk_sectors) {
- DMERR("Reshaping raid sets not yet supported. (stripe sectors change)");
- return -EINVAL;
- }
-@@ -2115,6 +2115,8 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
- return -EINVAL;
- }
-
-+ DMINFO("Discovered old metadata format; upgrading to extended metadata format");
-+
- /* Table line is checked vs. authoritative superblock */
- rs_set_new(rs);
- }
-@@ -2258,7 +2260,8 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
- if (!mddev->events && super_init_validation(rs, rdev))
- return -EINVAL;
-
-- if (le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
-+ if (le32_to_cpu(sb->compat_features) &&
-+ le32_to_cpu(sb->compat_features) != FEATURE_FLAG_SUPPORTS_V190) {
- rs->ti->error = "Unable to assemble array: Unknown flag(s) in compatible feature flags";
- return -EINVAL;
- }
-@@ -3646,7 +3649,7 @@ static void raid_resume(struct dm_target *ti)
-
- static struct target_type raid_target = {
- .name = "raid",
-- .version = {1, 9, 0},
-+ .version = {1, 9, 1},
- .module = THIS_MODULE,
- .ctr = raid_ctr,
- .dtr = raid_dtr,
-diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
-index bdf1606..7a6254d 100644
---- a/drivers/md/dm-raid1.c
-+++ b/drivers/md/dm-raid1.c
-@@ -1292,6 +1292,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
-
- dm_bio_restore(bd, bio);
- bio_record->details.bi_bdev = NULL;
-+ bio->bi_error = 0;
-
- queue_bio(ms, bio, rw);
- return DM_ENDIO_INCOMPLETE;
-diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
-index 5da86c8..2154596 100644
---- a/drivers/md/dm-rq.c
-+++ b/drivers/md/dm-rq.c
-@@ -835,8 +835,11 @@ int dm_old_init_request_queue(struct mapped_device *md)
- init_kthread_worker(&md->kworker);
- md->kworker_task = kthread_run(kthread_worker_fn, &md->kworker,
- "kdmwork-%s", dm_device_name(md));
-- if (IS_ERR(md->kworker_task))
-- return PTR_ERR(md->kworker_task);
-+ if (IS_ERR(md->kworker_task)) {
-+ int error = PTR_ERR(md->kworker_task);
-+ md->kworker_task = NULL;
-+ return error;
-+ }
-
- elv_register_queue(md->queue);
-
-diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 3e407a9..c4b53b3 100644
---- a/drivers/md/dm-table.c
-+++ b/drivers/md/dm-table.c
-@@ -695,37 +695,32 @@ int dm_table_add_target(struct dm_table *t, const char *type,
-
- tgt->type = dm_get_target_type(type);
- if (!tgt->type) {
-- DMERR("%s: %s: unknown target type", dm_device_name(t->md),
-- type);
-+ DMERR("%s: %s: unknown target type", dm_device_name(t->md), type);
- return -EINVAL;
- }
-
- if (dm_target_needs_singleton(tgt->type)) {
- if (t->num_targets) {
-- DMERR("%s: target type %s must appear alone in table",
-- dm_device_name(t->md), type);
-- return -EINVAL;
-+ tgt->error = "singleton target type must appear alone in table";
-+ goto bad;
- }
- t->singleton = true;
- }
-
- if (dm_target_always_writeable(tgt->type) && !(t->mode & FMODE_WRITE)) {
-- DMERR("%s: target type %s may not be included in read-only tables",
-- dm_device_name(t->md), type);
-- return -EINVAL;
-+ tgt->error = "target type may not be included in a read-only table";
-+ goto bad;
- }
-
- if (t->immutable_target_type) {
- if (t->immutable_target_type != tgt->type) {
-- DMERR("%s: immutable target type %s cannot be mixed with other target types",
-- dm_device_name(t->md), t->immutable_target_type->name);
-- return -EINVAL;
-+ tgt->error = "immutable target type cannot be mixed with other target types";
-+ goto bad;
- }
- } else if (dm_target_is_immutable(tgt->type)) {
- if (t->num_targets) {
-- DMERR("%s: immutable target type %s cannot be mixed with other target types",
-- dm_device_name(t->md), tgt->type->name);
-- return -EINVAL;
-+ tgt->error = "immutable target type cannot be mixed with other target types";
-+ goto bad;
- }
- t->immutable_target_type = tgt->type;
- }
-@@ -740,7 +735,6 @@ int dm_table_add_target(struct dm_table *t, const char *type,
- */
- if (!adjoin(t, tgt)) {
- tgt->error = "Gap in table";
-- r = -EINVAL;
- goto bad;
- }
-
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 0f2928b..eeef575 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct mapped_device *md)
- if (md->bs)
- bioset_free(md->bs);
-
-- cleanup_srcu_struct(&md->io_barrier);
--
- if (md->disk) {
- spin_lock(&_minor_lock);
- md->disk->private_data = NULL;
-@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
- if (md->queue)
- blk_cleanup_queue(md->queue);
-
-+ cleanup_srcu_struct(&md->io_barrier);
-+
- if (md->bdev) {
- bdput(md->bdev);
- md->bdev = NULL;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 915e84d..db0aa6c 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -8120,14 +8120,14 @@ void md_do_sync(struct md_thread *thread)
-
- if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
- !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
-- mddev->curr_resync > 2) {
-+ mddev->curr_resync > 3) {
- mddev->curr_resync_completed = mddev->curr_resync;
- sysfs_notify(&mddev->kobj, NULL, "sync_completed");
- }
- mddev->pers->sync_request(mddev, max_sectors, &skipped);
-
- if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
-- mddev->curr_resync > 2) {
-+ mddev->curr_resync > 3) {
- if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
- if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
- if (mddev->curr_resync >= mddev->recovery_cp) {
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 21dc00e..95bf4cd 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -407,11 +407,14 @@ static void raid1_end_write_request(struct bio *bio)
- struct bio *to_put = NULL;
- int mirror = find_bio_disk(r1_bio, bio);
- struct md_rdev *rdev = conf->mirrors[mirror].rdev;
-+ bool discard_error;
-+
-+ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
-
- /*
- * 'one mirror IO has finished' event handler:
- */
-- if (bio->bi_error) {
-+ if (bio->bi_error && !discard_error) {
- set_bit(WriteErrorSeen, &rdev->flags);
- if (!test_and_set_bit(WantReplacement, &rdev->flags))
- set_bit(MD_RECOVERY_NEEDED, &
-@@ -448,7 +451,7 @@ static void raid1_end_write_request(struct bio *bio)
-
- /* Maybe we can clear some bad blocks. */
- if (is_badblock(rdev, r1_bio->sector, r1_bio->sectors,
-- &first_bad, &bad_sectors)) {
-+ &first_bad, &bad_sectors) && !discard_error) {
- r1_bio->bios[mirror] = IO_MADE_GOOD;
- set_bit(R1BIO_MadeGood, &r1_bio->state);
- }
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index be1a9fc..39fddda 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -447,6 +447,9 @@ static void raid10_end_write_request(struct bio *bio)
- struct r10conf *conf = r10_bio->mddev->private;
- int slot, repl;
- struct md_rdev *rdev = NULL;
-+ bool discard_error;
-+
-+ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
-
- dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
-
-@@ -460,7 +463,7 @@ static void raid10_end_write_request(struct bio *bio)
- /*
- * this branch is our 'one mirror IO has finished' event handler:
- */
-- if (bio->bi_error) {
-+ if (bio->bi_error && !discard_error) {
- if (repl)
- /* Never record new bad blocks to replacement,
- * just fail it.
-@@ -503,7 +506,7 @@ static void raid10_end_write_request(struct bio *bio)
- if (is_badblock(rdev,
- r10_bio->devs[slot].addr,
- r10_bio->sectors,
-- &first_bad, &bad_sectors)) {
-+ &first_bad, &bad_sectors) && !discard_error) {
- bio_put(bio);
- if (repl)
- r10_bio->devs[slot].repl_bio = IO_MADE_GOOD;
-diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c
-index 9fb4fc2..ed9759e 100644
---- a/drivers/media/platform/vsp1/vsp1_video.c
-+++ b/drivers/media/platform/vsp1/vsp1_video.c
-@@ -675,6 +675,13 @@ static void vsp1_video_stop_streaming(struct vb2_queue *vq)
- unsigned long flags;
- int ret;
-
-+ /* Clear the buffers ready flag to make sure the device won't be started
-+ * by a QBUF on the video node on the other side of the pipeline.
-+ */
-+ spin_lock_irqsave(&video->irqlock, flags);
-+ pipe->buffers_ready &= ~(1 << video->pipe_index);
-+ spin_unlock_irqrestore(&video->irqlock, flags);
-+
- mutex_lock(&pipe->lock);
- if (--pipe->stream_count == pipe->num_inputs) {
- /* Stop the pipeline. */
-diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
-index af23d7d..2e5233b 100644
---- a/drivers/misc/cxl/api.c
-+++ b/drivers/misc/cxl/api.c
-@@ -247,7 +247,9 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
- cxl_ctx_get();
-
- if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
-+ put_pid(ctx->glpid);
- put_pid(ctx->pid);
-+ ctx->glpid = ctx->pid = NULL;
- cxl_adapter_context_put(ctx->afu->adapter);
- cxl_ctx_put();
- goto out;
-diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
-index d0b421f..77080cc 100644
---- a/drivers/misc/cxl/file.c
-+++ b/drivers/misc/cxl/file.c
-@@ -194,6 +194,16 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
- ctx->mmio_err_ff = !!(work.flags & CXL_START_WORK_ERR_FF);
-
- /*
-+ * Increment the mapped context count for adapter. This also checks
-+ * if adapter_context_lock is taken.
-+ */
-+ rc = cxl_adapter_context_get(ctx->afu->adapter);
-+ if (rc) {
-+ afu_release_irqs(ctx, ctx);
-+ goto out;
-+ }
-+
-+ /*
- * We grab the PID here and not in the file open to allow for the case
- * where a process (master, some daemon, etc) has opened the chardev on
- * behalf of another process, so the AFU's mm gets bound to the process
-@@ -205,15 +215,6 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
- ctx->pid = get_task_pid(current, PIDTYPE_PID);
- ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
-
-- /*
-- * Increment the mapped context count for adapter. This also checks
-- * if adapter_context_lock is taken.
-- */
-- rc = cxl_adapter_context_get(ctx->afu->adapter);
-- if (rc) {
-- afu_release_irqs(ctx, ctx);
-- goto out;
-- }
-
- trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
-
-@@ -221,6 +222,9 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
- amr))) {
- afu_release_irqs(ctx, ctx);
- cxl_adapter_context_put(ctx->afu->adapter);
-+ put_pid(ctx->glpid);
-+ put_pid(ctx->pid);
-+ ctx->glpid = ctx->pid = NULL;
- goto out;
- }
-
-diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
-index 222367c..524660510 100644
---- a/drivers/misc/genwqe/card_utils.c
-+++ b/drivers/misc/genwqe/card_utils.c
-@@ -352,17 +352,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
- if (copy_from_user(sgl->lpage, user_addr + user_size -
- sgl->lpage_size, sgl->lpage_size)) {
- rc = -EFAULT;
-- goto err_out1;
-+ goto err_out2;
- }
- }
- return 0;
-
-+ err_out2:
-+ __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
-+ sgl->lpage_dma_addr);
-+ sgl->lpage = NULL;
-+ sgl->lpage_dma_addr = 0;
- err_out1:
- __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
- sgl->fpage_dma_addr);
-+ sgl->fpage = NULL;
-+ sgl->fpage_dma_addr = 0;
- err_out:
- __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
- sgl->sgl_dma_addr);
-+ sgl->sgl = NULL;
-+ sgl->sgl_dma_addr = 0;
-+ sgl->sgl_size = 0;
- return -ENOMEM;
- }
-
-diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
-index 4a6c1b8..2d23cdf 100644
---- a/drivers/misc/mei/hw-txe.c
-+++ b/drivers/misc/mei/hw-txe.c
-@@ -978,11 +978,13 @@ static bool mei_txe_check_and_ack_intrs(struct mei_device *dev, bool do_ack)
- hisr = mei_txe_br_reg_read(hw, HISR_REG);
-
- aliveness = mei_txe_aliveness_get(dev);
-- if (hhisr & IPC_HHIER_SEC && aliveness)
-+ if (hhisr & IPC_HHIER_SEC && aliveness) {
- ipc_isr = mei_txe_sec_reg_read_silent(hw,
- SEC_IPC_HOST_INT_STATUS_REG);
-- else
-+ } else {
- ipc_isr = 0;
-+ hhisr &= ~IPC_HHIER_SEC;
-+ }
-
- generated = generated ||
- (hisr & HISR_INT_STS_MSK) ||
-diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
-index c0bb0c7..dbbc430 100644
---- a/drivers/mmc/host/dw_mmc-pltfm.c
-+++ b/drivers/mmc/host/dw_mmc-pltfm.c
-@@ -46,12 +46,13 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
- host->pdata = pdev->dev.platform_data;
-
- regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- /* Get registers' physical base address */
-- host->phy_regs = regs->start;
- host->regs = devm_ioremap_resource(&pdev->dev, regs);
- if (IS_ERR(host->regs))
- return PTR_ERR(host->regs);
-
-+ /* Get registers' physical base address */
-+ host->phy_regs = regs->start;
-+
- platform_set_drvdata(pdev, host);
- return dw_mci_probe(host);
- }
-diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
-index 48eb55f..a01a70a 100644
---- a/drivers/mtd/ubi/fastmap.c
-+++ b/drivers/mtd/ubi/fastmap.c
-@@ -515,10 +515,11 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
- unsigned long long ec = be64_to_cpu(ech->ec);
- unmap_peb(ai, pnum);
- dbg_bld("Adding PEB to free: %i", pnum);
-+
- if (err == UBI_IO_FF_BITFLIPS)
-- add_aeb(ai, free, pnum, ec, 1);
-- else
-- add_aeb(ai, free, pnum, ec, 0);
-+ scrub = 1;
-+
-+ add_aeb(ai, free, pnum, ec, scrub);
- continue;
- } else if (err == 0 || err == UBI_IO_BITFLIPS) {
- dbg_bld("Found non empty PEB:%i in pool", pnum);
-@@ -750,11 +751,11 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
- fmvhdr->vol_type,
- be32_to_cpu(fmvhdr->last_eb_bytes));
-
-- if (!av)
-- goto fail_bad;
-- if (PTR_ERR(av) == -EINVAL) {
-- ubi_err(ubi, "volume (ID %i) already exists",
-- fmvhdr->vol_id);
-+ if (IS_ERR(av)) {
-+ if (PTR_ERR(av) == -EEXIST)
-+ ubi_err(ubi, "volume (ID %i) already exists",
-+ fmvhdr->vol_id);
-+
- goto fail_bad;
- }
-
-diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
-index 30ae5bf..76ad825 100644
---- a/drivers/net/wireless/ath/ath10k/core.h
-+++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -445,6 +445,7 @@ struct ath10k_debug {
- u32 pktlog_filter;
- u32 reg_addr;
- u32 nf_cal_period;
-+ void *cal_data;
-
- struct ath10k_fw_crash_data *fw_crash_data;
- };
-diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
-index 8f0fd41..8c6a5dd 100644
---- a/drivers/net/wireless/ath/ath10k/debug.c
-+++ b/drivers/net/wireless/ath/ath10k/debug.c
-@@ -30,6 +30,8 @@
- /* ms */
- #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
-
-+#define ATH10K_DEBUG_CAL_DATA_LEN 12064
-+
- #define ATH10K_FW_CRASH_DUMP_VERSION 1
-
- /**
-@@ -1450,56 +1452,51 @@ static const struct file_operations fops_fw_dbglog = {
- .llseek = default_llseek,
- };
-
--static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
-+static int ath10k_debug_cal_data_fetch(struct ath10k *ar)
- {
-- struct ath10k *ar = inode->i_private;
-- void *buf;
- u32 hi_addr;
- __le32 addr;
- int ret;
-
-- mutex_lock(&ar->conf_mutex);
--
-- if (ar->state != ATH10K_STATE_ON &&
-- ar->state != ATH10K_STATE_UTF) {
-- ret = -ENETDOWN;
-- goto err;
-- }
-+ lockdep_assert_held(&ar->conf_mutex);
-
-- buf = vmalloc(ar->hw_params.cal_data_len);
-- if (!buf) {
-- ret = -ENOMEM;
-- goto err;
-- }
-+ if (WARN_ON(ar->hw_params.cal_data_len > ATH10K_DEBUG_CAL_DATA_LEN))
-+ return -EINVAL;
-
- hi_addr = host_interest_item_address(HI_ITEM(hi_board_data));
-
- ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr));
- if (ret) {
-- ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret);
-- goto err_vfree;
-+ ath10k_warn(ar, "failed to read hi_board_data address: %d\n",
-+ ret);
-+ return ret;
- }
-
-- ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf,
-+ ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), ar->debug.cal_data,
- ar->hw_params.cal_data_len);
- if (ret) {
- ath10k_warn(ar, "failed to read calibration data: %d\n", ret);
-- goto err_vfree;
-+ return ret;
- }
-
-- file->private_data = buf;
-+ return 0;
-+}
-
-- mutex_unlock(&ar->conf_mutex);
-+static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
-+{
-+ struct ath10k *ar = inode->i_private;
-
-- return 0;
-+ mutex_lock(&ar->conf_mutex);
-
--err_vfree:
-- vfree(buf);
-+ if (ar->state == ATH10K_STATE_ON ||
-+ ar->state == ATH10K_STATE_UTF) {
-+ ath10k_debug_cal_data_fetch(ar);
-+ }
-
--err:
-+ file->private_data = ar;
- mutex_unlock(&ar->conf_mutex);
-
-- return ret;
-+ return 0;
- }
-
- static ssize_t ath10k_debug_cal_data_read(struct file *file,
-@@ -1507,18 +1504,16 @@ static ssize_t ath10k_debug_cal_data_read(struct file *file,
- size_t count, loff_t *ppos)
- {
- struct ath10k *ar = file->private_data;
-- void *buf = file->private_data;
-
-- return simple_read_from_buffer(user_buf, count, ppos,
-- buf, ar->hw_params.cal_data_len);
--}
-+ mutex_lock(&ar->conf_mutex);
-
--static int ath10k_debug_cal_data_release(struct inode *inode,
-- struct file *file)
--{
-- vfree(file->private_data);
-+ count = simple_read_from_buffer(user_buf, count, ppos,
-+ ar->debug.cal_data,
-+ ar->hw_params.cal_data_len);
-
-- return 0;
-+ mutex_unlock(&ar->conf_mutex);
-+
-+ return count;
- }
-
- static ssize_t ath10k_write_ani_enable(struct file *file,
-@@ -1579,7 +1574,6 @@ static const struct file_operations fops_ani_enable = {
- static const struct file_operations fops_cal_data = {
- .open = ath10k_debug_cal_data_open,
- .read = ath10k_debug_cal_data_read,
-- .release = ath10k_debug_cal_data_release,
- .owner = THIS_MODULE,
- .llseek = default_llseek,
- };
-@@ -1931,6 +1925,8 @@ void ath10k_debug_stop(struct ath10k *ar)
- {
- lockdep_assert_held(&ar->conf_mutex);
-
-+ ath10k_debug_cal_data_fetch(ar);
-+
- /* Must not use _sync to avoid deadlock, we do that in
- * ath10k_debug_destroy(). The check for htt_stats_mask is to avoid
- * warning from del_timer(). */
-@@ -2343,6 +2339,10 @@ int ath10k_debug_create(struct ath10k *ar)
- if (!ar->debug.fw_crash_data)
- return -ENOMEM;
-
-+ ar->debug.cal_data = vzalloc(ATH10K_DEBUG_CAL_DATA_LEN);
-+ if (!ar->debug.cal_data)
-+ return -ENOMEM;
-+
- INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs);
- INIT_LIST_HEAD(&ar->debug.fw_stats.vdevs);
- INIT_LIST_HEAD(&ar->debug.fw_stats.peers);
-@@ -2356,6 +2356,9 @@ void ath10k_debug_destroy(struct ath10k *ar)
- vfree(ar->debug.fw_crash_data);
- ar->debug.fw_crash_data = NULL;
-
-+ vfree(ar->debug.cal_data);
-+ ar->debug.cal_data = NULL;
-+
- ath10k_debug_fw_stats_reset(ar);
-
- kfree(ar->debug.tpc_stats);
-diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-index b6f064a..7e27a06 100644
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -33,7 +33,6 @@ struct coeff {
-
- enum ar9003_cal_types {
- IQ_MISMATCH_CAL = BIT(0),
-- TEMP_COMP_CAL = BIT(1),
- };
-
- static void ar9003_hw_setup_calibration(struct ath_hw *ah,
-@@ -59,12 +58,6 @@ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
- /* Kick-off cal */
- REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
- break;
-- case TEMP_COMP_CAL:
-- ath_dbg(common, CALIBRATE,
-- "starting Temperature Compensation Calibration\n");
-- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_LOCAL);
-- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_START);
-- break;
- default:
- ath_err(common, "Invalid calibration type\n");
- break;
-@@ -93,8 +86,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
- /*
- * Accumulate cal measures for active chains
- */
-- if (cur_caldata->calCollect)
-- cur_caldata->calCollect(ah);
-+ cur_caldata->calCollect(ah);
- ah->cal_samples++;
-
- if (ah->cal_samples >= cur_caldata->calNumSamples) {
-@@ -107,8 +99,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
- /*
- * Process accumulated data
- */
-- if (cur_caldata->calPostProc)
-- cur_caldata->calPostProc(ah, numChains);
-+ cur_caldata->calPostProc(ah, numChains);
-
- /* Calibration has finished. */
- caldata->CalValid |= cur_caldata->calType;
-@@ -323,16 +314,9 @@ static const struct ath9k_percal_data iq_cal_single_sample = {
- ar9003_hw_iqcalibrate
- };
-
--static const struct ath9k_percal_data temp_cal_single_sample = {
-- TEMP_COMP_CAL,
-- MIN_CAL_SAMPLES,
-- PER_MAX_LOG_COUNT,
--};
--
- static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
- {
- ah->iq_caldata.calData = &iq_cal_single_sample;
-- ah->temp_caldata.calData = &temp_cal_single_sample;
-
- if (AR_SREV_9300_20_OR_LATER(ah)) {
- ah->enabled_cals |= TX_IQ_CAL;
-@@ -340,7 +324,7 @@ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
- ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
- }
-
-- ah->supp_cals = IQ_MISMATCH_CAL | TEMP_COMP_CAL;
-+ ah->supp_cals = IQ_MISMATCH_CAL;
- }
-
- #define OFF_UPPER_LT 24
-@@ -1399,9 +1383,6 @@ static void ar9003_hw_init_cal_common(struct ath_hw *ah)
- INIT_CAL(&ah->iq_caldata);
- INSERT_CAL(ah, &ah->iq_caldata);
-
-- INIT_CAL(&ah->temp_caldata);
-- INSERT_CAL(ah, &ah->temp_caldata);
--
- /* Initialize current pointer to first element in list */
- ah->cal_list_curr = ah->cal_list;
-
-diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
-index 2a5d3ad..9cbca12 100644
---- a/drivers/net/wireless/ath/ath9k/hw.h
-+++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -830,7 +830,6 @@ struct ath_hw {
- /* Calibration */
- u32 supp_cals;
- struct ath9k_cal_list iq_caldata;
-- struct ath9k_cal_list temp_caldata;
- struct ath9k_cal_list adcgain_caldata;
- struct ath9k_cal_list adcdc_caldata;
- struct ath9k_cal_list *cal_list;
-diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-index 4341d56..a280932 100644
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
-@@ -231,7 +231,7 @@ struct rtl8xxxu_rxdesc16 {
- u32 pattern1match:1;
- u32 pattern0match:1;
- #endif
-- __le32 tsfl;
-+ u32 tsfl;
- #if 0
- u32 bassn:12;
- u32 bavld:1;
-@@ -361,7 +361,7 @@ struct rtl8xxxu_rxdesc24 {
- u32 ldcp:1;
- u32 splcp:1;
- #endif
-- __le32 tsfl;
-+ u32 tsfl;
- };
-
- struct rtl8xxxu_txdesc32 {
-diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-index 9d45afb..c831a586 100644
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
-@@ -1498,6 +1498,10 @@ static void rtl8723b_enable_rf(struct rtl8xxxu_priv *priv)
- u32 val32;
- u8 val8;
-
-+ val32 = rtl8xxxu_read32(priv, REG_RX_WAIT_CCA);
-+ val32 |= (BIT(22) | BIT(23));
-+ rtl8xxxu_write32(priv, REG_RX_WAIT_CCA, val32);
-+
- /*
- * No indication anywhere as to what 0x0790 does. The 2 antenna
- * vendor code preserves bits 6-7 here.
-diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-index 77048db..c6b246a 100644
---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
-@@ -5201,7 +5201,12 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift +
- sizeof(struct rtl8xxxu_rxdesc16), 128);
-
-- if (pkt_cnt > 1)
-+ /*
-+ * Only clone the skb if there's enough data at the end to
-+ * at least cover the rx descriptor
-+ */
-+ if (pkt_cnt > 1 &&
-+ urb_len > (pkt_offset + sizeof(struct rtl8xxxu_rxdesc16)))
- next_skb = skb_clone(skb, GFP_ATOMIC);
-
- rx_status = IEEE80211_SKB_RXCB(skb);
-@@ -5219,7 +5224,7 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
- rx_desc->rxmcs);
-
-- rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
-+ rx_status->mactime = rx_desc->tsfl;
- rx_status->flag |= RX_FLAG_MACTIME_START;
-
- if (!rx_desc->swdec)
-@@ -5289,7 +5294,7 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
- rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
- rx_desc->rxmcs);
-
-- rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
-+ rx_status->mactime = rx_desc->tsfl;
- rx_status->flag |= RX_FLAG_MACTIME_START;
-
- if (!rx_desc->swdec)
-diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
-index 0dbd29e..172ef82 100644
---- a/drivers/pwm/core.c
-+++ b/drivers/pwm/core.c
-@@ -339,6 +339,8 @@ int pwmchip_remove(struct pwm_chip *chip)
- unsigned int i;
- int ret = 0;
-
-+ pwmchip_sysfs_unexport_children(chip);
-+
- mutex_lock(&pwm_lock);
-
- for (i = 0; i < chip->npwm; i++) {
-diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
-index 18ed725..0296d81 100644
---- a/drivers/pwm/sysfs.c
-+++ b/drivers/pwm/sysfs.c
-@@ -409,6 +409,24 @@ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
- }
- }
-
-+void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
-+{
-+ struct device *parent;
-+ unsigned int i;
-+
-+ parent = class_find_device(&pwm_class, NULL, chip,
-+ pwmchip_sysfs_match);
-+ if (!parent)
-+ return;
-+
-+ for (i = 0; i < chip->npwm; i++) {
-+ struct pwm_device *pwm = &chip->pwms[i];
-+
-+ if (test_bit(PWMF_EXPORTED, &pwm->flags))
-+ pwm_unexport_child(parent, pwm);
-+ }
-+}
-+
- static int __init pwm_sysfs_init(void)
- {
- return class_register(&pwm_class);
-diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
-index 3d53d63..f0cfb04 100644
---- a/drivers/scsi/arcmsr/arcmsr_hba.c
-+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
-@@ -2636,18 +2636,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
- struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
- struct CommandControlBlock *ccb;
- int target = cmd->device->id;
-- int lun = cmd->device->lun;
-- uint8_t scsicmd = cmd->cmnd[0];
- cmd->scsi_done = done;
- cmd->host_scribble = NULL;
- cmd->result = 0;
-- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
-- if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
-- cmd->result = (DID_NO_CONNECT << 16);
-- }
-- cmd->scsi_done(cmd);
-- return 0;
-- }
- if (target == 16) {
- /* virtual device for iop message transfer */
- arcmsr_handle_virtual_command(acb, cmd);
-diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
-index 6a219a0..05e892a 100644
---- a/drivers/scsi/scsi_debug.c
-+++ b/drivers/scsi/scsi_debug.c
-@@ -5134,6 +5134,7 @@ static void __exit scsi_debug_exit(void)
- bus_unregister(&pseudo_lld_bus);
- root_device_unregister(pseudo_primary);
-
-+ vfree(map_storep);
- vfree(dif_storep);
- vfree(fake_storep);
- kfree(sdebug_q_arr);
-diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
-index 8d85a3c..3f35613 100644
---- a/drivers/spi/spi-fsl-espi.c
-+++ b/drivers/spi/spi-fsl-espi.c
-@@ -581,7 +581,7 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
-
- mspi->len -= rx_nr_bytes;
-
-- if (mspi->rx)
-+ if (rx_nr_bytes && mspi->rx)
- mspi->get_rx(rx_data, mspi);
- }
-
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 200ca22..935f1a5 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -1607,9 +1607,11 @@ static void of_register_spi_devices(struct spi_master *master)
- if (of_node_test_and_set_flag(nc, OF_POPULATED))
- continue;
- spi = of_register_spi_device(master, nc);
-- if (IS_ERR(spi))
-+ if (IS_ERR(spi)) {
- dev_warn(&master->dev, "Failed to create SPI device for %s\n",
- nc->full_name);
-+ of_node_clear_flag(nc, OF_POPULATED);
-+ }
- }
- }
- #else
-@@ -3120,6 +3122,7 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
- if (IS_ERR(spi)) {
- pr_err("%s: failed to create for '%s'\n",
- __func__, rd->dn->full_name);
-+ of_node_clear_flag(rd->dn, OF_POPULATED);
- return notifier_from_errno(PTR_ERR(spi));
- }
- break;
-diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
-index 78f524f..f4dbcb1 100644
---- a/drivers/staging/wilc1000/host_interface.c
-+++ b/drivers/staging/wilc1000/host_interface.c
-@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
-
- clients_count++;
-
-- destroy_workqueue(hif_workqueue);
- _fail_:
- return result;
- }
-diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
-index 0e4dc0a..7a22307 100644
---- a/drivers/thermal/intel_powerclamp.c
-+++ b/drivers/thermal/intel_powerclamp.c
-@@ -669,20 +669,10 @@ static struct thermal_cooling_device_ops powerclamp_cooling_ops = {
- .set_cur_state = powerclamp_set_cur_state,
- };
-
--static const struct x86_cpu_id intel_powerclamp_ids[] __initconst = {
-- { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_MWAIT },
-- { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_ARAT },
-- { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_NONSTOP_TSC },
-- { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_CONSTANT_TSC},
-- {}
--};
--MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids);
--
- static int __init powerclamp_probe(void)
- {
-- if (!x86_match_cpu(intel_powerclamp_ids)) {
-- pr_err("Intel powerclamp does not run on family %d model %d\n",
-- boot_cpu_data.x86, boot_cpu_data.x86_model);
-+ if (!boot_cpu_has(X86_FEATURE_MWAIT)) {
-+ pr_err("CPU does not support MWAIT");
- return -ENODEV;
- }
-
-diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
-index 2705ca9..fd375f1 100644
---- a/drivers/tty/vt/vt.c
-+++ b/drivers/tty/vt/vt.c
-@@ -870,10 +870,15 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
- return 0;
-
-+ if (new_screen_size > (4 << 20))
-+ return -EINVAL;
- newscreen = kmalloc(new_screen_size, GFP_USER);
- if (!newscreen)
- return -ENOMEM;
-
-+ if (vc == sel_cons)
-+ clear_selection();
-+
- old_rows = vc->vc_rows;
- old_row_size = vc->vc_size_row;
-
-@@ -1176,7 +1181,7 @@ static void csi_J(struct vc_data *vc, int vpar)
- break;
- case 3: /* erase scroll-back buffer (and whole display) */
- scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
-- vc->vc_screenbuf_size >> 1);
-+ vc->vc_screenbuf_size);
- set_origin(vc);
- if (con_is_visible(vc))
- update_screen(vc);
-diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
-index 053bac9..887be34 100644
---- a/drivers/usb/chipidea/host.c
-+++ b/drivers/usb/chipidea/host.c
-@@ -185,6 +185,8 @@ static void host_stop(struct ci_hdrc *ci)
-
- if (hcd) {
- usb_remove_hcd(hcd);
-+ ci->role = CI_ROLE_END;
-+ synchronize_irq(ci->irq);
- usb_put_hcd(hcd);
- if (ci->platdata->reg_vbus && !ci_otg_is_fsm_mode(ci) &&
- (ci->platdata->flags & CI_HDRC_TURN_VBUS_EARLY_ON))
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 6854461..6443cfb 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -3055,7 +3055,7 @@ int dwc3_gadget_init(struct dwc3 *dwc)
- kfree(dwc->setup_buf);
-
- err2:
-- dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
-+ dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
- dwc->ep0_trb, dwc->ep0_trb_addr);
-
- err1:
-@@ -3080,7 +3080,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
- kfree(dwc->setup_buf);
- kfree(dwc->zlp_buf);
-
-- dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
-+ dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
- dwc->ep0_trb, dwc->ep0_trb_addr);
-
- dma_free_coherent(dwc->dev, sizeof(*dwc->ctrl_req),
-diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
-index 5f562c1..9b9e71f 100644
---- a/drivers/usb/gadget/function/u_ether.c
-+++ b/drivers/usb/gadget/function/u_ether.c
-@@ -587,8 +587,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
-
- /* throttle high/super speed IRQ rate back slightly */
- if (gadget_is_dualspeed(dev->gadget))
-- req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
-- dev->gadget->speed == USB_SPEED_SUPER)
-+ req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
-+ dev->gadget->speed == USB_SPEED_SUPER)) &&
-+ !list_empty(&dev->tx_reqs))
- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
- : 0;
-
-diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
-index bb1f6c8..45bc997 100644
---- a/drivers/usb/gadget/udc/atmel_usba_udc.c
-+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
-@@ -1978,7 +1978,7 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
- dev_err(&pdev->dev, "of_probe: name error(%d)\n", ret);
- goto err;
- }
-- ep->ep.name = name;
-+ ep->ep.name = kasprintf(GFP_KERNEL, "ep%d", ep->index);
-
- ep->ep_regs = udc->regs + USBA_EPT_BASE(i);
- ep->dma_regs = udc->regs + USBA_DMA_BASE(i);
-diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
-index 1700908..86612ac 100644
---- a/drivers/usb/host/ohci-hcd.c
-+++ b/drivers/usb/host/ohci-hcd.c
-@@ -72,7 +72,7 @@
- static const char hcd_name [] = "ohci_hcd";
-
- #define STATECHANGE_DELAY msecs_to_jiffies(300)
--#define IO_WATCHDOG_DELAY msecs_to_jiffies(250)
-+#define IO_WATCHDOG_DELAY msecs_to_jiffies(275)
-
- #include "ohci.h"
- #include "pci-quirks.h"
-diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
-index 730b9fd..0ef1690 100644
---- a/drivers/usb/host/xhci-hub.c
-+++ b/drivers/usb/host/xhci-hub.c
-@@ -1166,7 +1166,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
- xhci_set_link_state(xhci, port_array, wIndex,
- XDEV_RESUME);
- spin_unlock_irqrestore(&xhci->lock, flags);
-- msleep(20);
-+ msleep(USB_RESUME_TIMEOUT);
- spin_lock_irqsave(&xhci->lock, flags);
- xhci_set_link_state(xhci, port_array, wIndex,
- XDEV_U0);
-@@ -1355,6 +1355,35 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
- return 0;
- }
-
-+/*
-+ * Workaround for missing Cold Attach Status (CAS) if device re-plugged in S3.
-+ * warm reset a USB3 device stuck in polling or compliance mode after resume.
-+ * See Intel 100/c230 series PCH specification update Doc #332692-006 Errata #8
-+ */
-+static bool xhci_port_missing_cas_quirk(int port_index,
-+ __le32 __iomem **port_array)
-+{
-+ u32 portsc;
-+
-+ portsc = readl(port_array[port_index]);
-+
-+ /* if any of these are set we are not stuck */
-+ if (portsc & (PORT_CONNECT | PORT_CAS))
-+ return false;
-+
-+ if (((portsc & PORT_PLS_MASK) != XDEV_POLLING) &&
-+ ((portsc & PORT_PLS_MASK) != XDEV_COMP_MODE))
-+ return false;
-+
-+ /* clear wakeup/change bits, and do a warm port reset */
-+ portsc &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
-+ portsc |= PORT_WR;
-+ writel(portsc, port_array[port_index]);
-+ /* flush write */
-+ readl(port_array[port_index]);
-+ return true;
-+}
-+
- int xhci_bus_resume(struct usb_hcd *hcd)
- {
- struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-@@ -1392,6 +1421,14 @@ int xhci_bus_resume(struct usb_hcd *hcd)
- u32 temp;
-
- temp = readl(port_array[port_index]);
-+
-+ /* warm reset CAS limited ports stuck in polling/compliance */
-+ if ((xhci->quirks & XHCI_MISSING_CAS) &&
-+ (hcd->speed >= HCD_USB3) &&
-+ xhci_port_missing_cas_quirk(port_index, port_array)) {
-+ xhci_dbg(xhci, "reset stuck port %d\n", port_index);
-+ continue;
-+ }
- if (DEV_SUPERSPEED_ANY(temp))
- temp &= ~(PORT_RWC_BITS | PORT_CEC | PORT_WAKE_BITS);
- else
-@@ -1410,7 +1447,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
-
- if (need_usb2_u3_exit) {
- spin_unlock_irqrestore(&xhci->lock, flags);
-- msleep(20);
-+ msleep(USB_RESUME_TIMEOUT);
- spin_lock_irqsave(&xhci->lock, flags);
- }
-
-diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
-index d7b0f97..e96ae80 100644
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -45,11 +45,13 @@
-
- #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
- #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
-+#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1
- #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
- #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
- #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
- #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
- #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
-+#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
-
- static const char hcd_name[] = "xhci_hcd";
-
-@@ -153,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
- xhci->quirks |= XHCI_SPURIOUS_REBOOT;
- }
- if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
-+ (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
-+ pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
- xhci->quirks |= XHCI_SPURIOUS_REBOOT;
- xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
- }
-@@ -169,6 +172,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
- pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
- xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
- }
-+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-+ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
-+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
-+ xhci->quirks |= XHCI_MISSING_CAS;
-+
- if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
- pdev->device == PCI_DEVICE_ID_EJ168) {
- xhci->quirks |= XHCI_RESET_ON_RESUME;
-diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
-index b2c1dc5..f945380 100644
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -314,6 +314,8 @@ struct xhci_op_regs {
- #define XDEV_U2 (0x2 << 5)
- #define XDEV_U3 (0x3 << 5)
- #define XDEV_INACTIVE (0x6 << 5)
-+#define XDEV_POLLING (0x7 << 5)
-+#define XDEV_COMP_MODE (0xa << 5)
- #define XDEV_RESUME (0xf << 5)
- /* true: port has power (see HCC_PPC) */
- #define PORT_POWER (1 << 9)
-@@ -1653,6 +1655,7 @@ struct xhci_hcd {
- #define XHCI_MTK_HOST (1 << 21)
- #define XHCI_SSIC_PORT_UNUSED (1 << 22)
- #define XHCI_NO_64BIT_SUPPORT (1 << 23)
-+#define XHCI_MISSING_CAS (1 << 24)
- unsigned int num_active_eps;
- unsigned int limit_active_eps;
- /* There are two roothubs to keep track of bus suspend info for */
-diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
-index 0b4cec9..dae92de 100644
---- a/drivers/usb/musb/omap2430.c
-+++ b/drivers/usb/musb/omap2430.c
-@@ -337,6 +337,7 @@ static int omap2430_musb_init(struct musb *musb)
- }
- musb->isr = omap2430_musb_interrupt;
- phy_init(musb->phy);
-+ phy_power_on(musb->phy);
-
- l = musb_readl(musb->mregs, OTG_INTERFSEL);
-
-@@ -373,8 +374,6 @@ static void omap2430_musb_enable(struct musb *musb)
- struct musb_hdrc_platform_data *pdata = dev_get_platdata(dev);
- struct omap_musb_board_data *data = pdata->board_data;
-
-- if (!WARN_ON(!musb->phy))
-- phy_power_on(musb->phy);
-
- omap2430_set_power(musb, true, glue->cable_connected);
-
-@@ -413,9 +412,6 @@ static void omap2430_musb_disable(struct musb *musb)
- struct device *dev = musb->controller;
- struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
-
-- if (!WARN_ON(!musb->phy))
-- phy_power_off(musb->phy);
--
- if (glue->status != MUSB_UNKNOWN)
- omap_control_usb_set_mode(glue->control_otghs,
- USB_MODE_DISCONNECT);
-@@ -429,6 +425,7 @@ static int omap2430_musb_exit(struct musb *musb)
- struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
-
- omap2430_low_level_exit(musb);
-+ phy_power_off(musb->phy);
- phy_exit(musb->phy);
- musb->phy = NULL;
- cancel_work_sync(&glue->omap_musb_mailbox_work);
-diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
-index 1d70add..d544b33 100644
---- a/drivers/usb/renesas_usbhs/rcar3.c
-+++ b/drivers/usb/renesas_usbhs/rcar3.c
-@@ -9,6 +9,7 @@
- *
- */
-
-+#include <linux/delay.h>
- #include <linux/io.h>
- #include "common.h"
- #include "rcar3.h"
-@@ -35,10 +36,13 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
-
- usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
-
-- if (enable)
-+ if (enable) {
- usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
-- else
-+ /* The controller on R-Car Gen3 needs to wait up to 45 usec */
-+ udelay(45);
-+ } else {
- usbhs_bset(priv, LPSTS, LPSTS_SUSPM, 0);
-+ }
-
- return 0;
- }
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 54a4de0..f61477b 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -1077,7 +1077,9 @@ static int cp210x_tiocmget(struct tty_struct *tty)
- u8 control;
- int result;
-
-- cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
-+ result = cp210x_read_u8_reg(port, CP210X_GET_MDMSTS, &control);
-+ if (result)
-+ return result;
-
- result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0)
- |((control & CONTROL_RTS) ? TIOCM_RTS : 0)
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index b2d767e..0ff7f38 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = {
- /* ekey Devices */
- { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
- /* Infineon Devices */
-- { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
-+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) },
-+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) },
- /* GE Healthcare devices */
- { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
- /* Active Research (Actisense) devices */
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index f87a938..21011c0 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -626,8 +626,9 @@
- /*
- * Infineon Technologies
- */
--#define INFINEON_VID 0x058b
--#define INFINEON_TRIBOARD_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
-+#define INFINEON_VID 0x058b
-+#define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
-+#define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
-
- /*
- * Acton Research Corp.
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index d213cf4..4a037b4 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1078,7 +1078,8 @@ static int usb_serial_probe(struct usb_interface *interface,
-
- serial->disconnected = 0;
-
-- usb_serial_console_init(serial->port[0]->minor);
-+ if (num_ports > 0)
-+ usb_serial_console_init(serial->port[0]->minor);
- exit:
- module_put(type->driver.owner);
- return 0;
-diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
-index 9e4800a..951dd93 100644
---- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
-+++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
-@@ -5348,7 +5348,7 @@ static int dsi_bind(struct device *dev, struct device *master, void *data)
-
- dsi->phy_base = devm_ioremap(&dsidev->dev, res->start,
- resource_size(res));
-- if (!dsi->proto_base) {
-+ if (!dsi->phy_base) {
- DSSERR("can't ioremap DSI PHY\n");
- return -ENOMEM;
- }
-@@ -5368,7 +5368,7 @@ static int dsi_bind(struct device *dev, struct device *master, void *data)
-
- dsi->pll_base = devm_ioremap(&dsidev->dev, res->start,
- resource_size(res));
-- if (!dsi->proto_base) {
-+ if (!dsi->pll_base) {
- DSSERR("can't ioremap DSI PLL\n");
- return -ENOMEM;
- }
-diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
-index 2c0487f..ed41fdb 100644
---- a/drivers/video/fbdev/pxafb.c
-+++ b/drivers/video/fbdev/pxafb.c
-@@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
-
- timings = of_get_display_timings(disp);
- if (!timings)
-- goto out;
-+ return -EINVAL;
-
- ret = -ENOMEM;
- info->modes = kmalloc_array(timings->num_timings,
-diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
-index 8c4e617..6d9e517 100644
---- a/drivers/virtio/virtio_pci_legacy.c
-+++ b/drivers/virtio/virtio_pci_legacy.c
-@@ -212,10 +212,18 @@ int virtio_pci_legacy_probe(struct virtio_pci_device *vp_dev)
- return -ENODEV;
- }
-
-- rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(64));
-- if (rc)
-- rc = dma_set_mask_and_coherent(&pci_dev->dev,
-- DMA_BIT_MASK(32));
-+ rc = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(64));
-+ if (rc) {
-+ rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
-+ } else {
-+ /*
-+ * The virtio ring base address is expressed as a 32-bit PFN,
-+ * with a page size of 1 << VIRTIO_PCI_QUEUE_ADDR_SHIFT.
-+ */
-+ dma_set_coherent_mask(&pci_dev->dev,
-+ DMA_BIT_MASK(32 + VIRTIO_PCI_QUEUE_ADDR_SHIFT));
-+ }
-+
- if (rc)
- dev_warn(&pci_dev->dev, "Failed to enable 64-bit or 32-bit DMA. Trying to continue, but this might not work.\n");
-
-diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
-index ed9c9ee..6b2cd92 100644
---- a/drivers/virtio/virtio_ring.c
-+++ b/drivers/virtio/virtio_ring.c
-@@ -732,7 +732,8 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
-
- if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
- vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
-+ if (!vq->event)
-+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
- }
-
- }
-@@ -764,7 +765,8 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
- * entry. Always do both to keep code simple. */
- if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
- vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
-+ if (!vq->event)
-+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
- }
- vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
- END_USE(vq);
-@@ -832,10 +834,11 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
- * more to do. */
- /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
- * either clear the flags bit or point the event index at the next
-- * entry. Always do both to keep code simple. */
-+ * entry. Always update the event index to keep code simple. */
- if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
- vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
-- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
-+ if (!vq->event)
-+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
- }
- /* TODO: tune this threshold */
- bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
-@@ -953,7 +956,8 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
- /* No callback? Tell other side not to bother us. */
- if (!callback) {
- vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
-- vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
-+ if (!vq->event)
-+ vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
- }
-
- /* Put everything in free lists. */
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index e6811c4..bc1a004 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -8915,9 +8915,14 @@ static void btrfs_invalidatepage(struct page *page, unsigned int offset,
- * So even we call qgroup_free_data(), it won't decrease reserved
- * space.
- * 2) Not written to disk
-- * This means the reserved space should be freed here.
-+ * This means the reserved space should be freed here. However,
-+ * if a truncate invalidates the page (by clearing PageDirty)
-+ * and the page is accounted for while allocating extent
-+ * in btrfs_check_data_free_space() we let delayed_ref to
-+ * free the entire extent.
- */
-- btrfs_qgroup_free_data(inode, page_start, PAGE_SIZE);
-+ if (PageDirty(page))
-+ btrfs_qgroup_free_data(inode, page_start, PAGE_SIZE);
- if (!inode_evicting) {
- clear_extent_bit(tree, page_start, page_end,
- EXTENT_LOCKED | EXTENT_DIRTY |
-diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index ef9c55b..90e1198 100644
---- a/fs/btrfs/tree-log.c
-+++ b/fs/btrfs/tree-log.c
-@@ -2713,14 +2713,12 @@ static inline void btrfs_remove_all_log_ctxs(struct btrfs_root *root,
- int index, int error)
- {
- struct btrfs_log_ctx *ctx;
-+ struct btrfs_log_ctx *safe;
-
-- if (!error) {
-- INIT_LIST_HEAD(&root->log_ctxs[index]);
-- return;
-- }
--
-- list_for_each_entry(ctx, &root->log_ctxs[index], list)
-+ list_for_each_entry_safe(ctx, safe, &root->log_ctxs[index], list) {
-+ list_del_init(&ctx->list);
- ctx->log_ret = error;
-+ }
-
- INIT_LIST_HEAD(&root->log_ctxs[index]);
- }
-@@ -2961,13 +2959,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
- mutex_unlock(&root->log_mutex);
-
- out_wake_log_root:
-- /*
-- * We needn't get log_mutex here because we are sure all
-- * the other tasks are blocked.
-- */
-+ mutex_lock(&log_root_tree->log_mutex);
- btrfs_remove_all_log_ctxs(log_root_tree, index2, ret);
-
-- mutex_lock(&log_root_tree->log_mutex);
- log_root_tree->log_transid_committed++;
- atomic_set(&log_root_tree->log_commit[index2], 0);
- mutex_unlock(&log_root_tree->log_mutex);
-@@ -2978,10 +2972,8 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
- if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
- wake_up(&log_root_tree->log_commit_wait[index2]);
- out:
-- /* See above. */
-- btrfs_remove_all_log_ctxs(root, index1, ret);
--
- mutex_lock(&root->log_mutex);
-+ btrfs_remove_all_log_ctxs(root, index1, ret);
- root->log_transid_committed++;
- atomic_set(&root->log_commit[index1], 0);
- mutex_unlock(&root->log_mutex);
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index a204d7e..0fe31b4 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -1147,9 +1147,7 @@ static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
-
- static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
- {
-- struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
--
-- lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
-+ lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
-
- list_del_init(&stp->st_locks);
- nfs4_unhash_stid(&stp->st_stid);
-@@ -1158,12 +1156,12 @@ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
-
- static void release_lock_stateid(struct nfs4_ol_stateid *stp)
- {
-- struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
-+ struct nfs4_client *clp = stp->st_stid.sc_client;
- bool unhashed;
-
-- spin_lock(&oo->oo_owner.so_client->cl_lock);
-+ spin_lock(&clp->cl_lock);
- unhashed = unhash_lock_stateid(stp);
-- spin_unlock(&oo->oo_owner.so_client->cl_lock);
-+ spin_unlock(&clp->cl_lock);
- if (unhashed)
- nfs4_put_stid(&stp->st_stid);
- }
-diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
-index abadbc3..767377e 100644
---- a/fs/overlayfs/copy_up.c
-+++ b/fs/overlayfs/copy_up.c
-@@ -171,6 +171,8 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
- len -= bytes;
- }
-
-+ if (!error)
-+ error = vfs_fsync(new_file, 0);
- fput(new_file);
- out_fput:
- fput(old_file);
-diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index c75625c..cf2bfeb 100644
---- a/fs/overlayfs/inode.c
-+++ b/fs/overlayfs/inode.c
-@@ -294,9 +294,6 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type)
- if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !IS_POSIXACL(realinode))
- return NULL;
-
-- if (!realinode->i_op->get_acl)
-- return NULL;
--
- old_cred = ovl_override_creds(inode->i_sb);
- acl = get_acl(realinode, type);
- revert_creds(old_cred);
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index e2a94a2..a78415d 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -1026,6 +1026,21 @@ ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
-
- posix_acl_release(acl);
-
-+ /*
-+ * Check if sgid bit needs to be cleared (actual setacl operation will
-+ * be done with mounter's capabilities and so that won't do it for us).
-+ */
-+ if (unlikely(inode->i_mode & S_ISGID) &&
-+ handler->flags == ACL_TYPE_ACCESS &&
-+ !in_group_p(inode->i_gid) &&
-+ !capable_wrt_inode_uidgid(inode, CAP_FSETID)) {
-+ struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
-+
-+ err = ovl_setattr(dentry, &iattr);
-+ if (err)
-+ return err;
-+ }
-+
- err = ovl_xattr_set(dentry, handler->name, value, size, flags);
- if (!err)
- ovl_copyattr(ovl_inode_real(inode, NULL), inode);
-diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
-index 4b86d3a..3b27145 100644
---- a/fs/ubifs/dir.c
-+++ b/fs/ubifs/dir.c
-@@ -350,7 +350,7 @@ static unsigned int vfs_dent_type(uint8_t type)
- */
- static int ubifs_readdir(struct file *file, struct dir_context *ctx)
- {
-- int err;
-+ int err = 0;
- struct qstr nm;
- union ubifs_key key;
- struct ubifs_dent_node *dent;
-@@ -452,14 +452,20 @@ static int ubifs_readdir(struct file *file, struct dir_context *ctx)
- kfree(file->private_data);
- file->private_data = NULL;
-
-- if (err != -ENOENT) {
-+ if (err != -ENOENT)
- ubifs_err(c, "cannot find next direntry, error %d", err);
-- return err;
-- }
-+ else
-+ /*
-+ * -ENOENT is a non-fatal error in this context, the TNC uses
-+ * it to indicate that the cursor moved past the current directory
-+ * and readdir() has to stop.
-+ */
-+ err = 0;
-+
-
- /* 2 is a special value indicating that there are no more direntries */
- ctx->pos = 2;
-- return 0;
-+ return err;
- }
-
- /* Free saved readdir() state when the directory is closed */
-diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
-index 3cc3cf7..ac9a003 100644
---- a/fs/xfs/libxfs/xfs_dquot_buf.c
-+++ b/fs/xfs/libxfs/xfs_dquot_buf.c
-@@ -191,8 +191,7 @@ xfs_dquot_buf_verify_crc(
- if (mp->m_quotainfo)
- ndquots = mp->m_quotainfo->qi_dqperchunk;
- else
-- ndquots = xfs_calc_dquots_per_chunk(
-- XFS_BB_TO_FSB(mp, bp->b_length));
-+ ndquots = xfs_calc_dquots_per_chunk(bp->b_length);
-
- for (i = 0; i < ndquots; i++, d++) {
- if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk),
-diff --git a/include/linux/pwm.h b/include/linux/pwm.h
-index f1bbae0..2c6c511 100644
---- a/include/linux/pwm.h
-+++ b/include/linux/pwm.h
-@@ -641,6 +641,7 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
- #ifdef CONFIG_PWM_SYSFS
- void pwmchip_sysfs_export(struct pwm_chip *chip);
- void pwmchip_sysfs_unexport(struct pwm_chip *chip);
-+void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
- #else
- static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
- {
-@@ -649,6 +650,10 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
- static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
- {
- }
-+
-+static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
-+{
-+}
- #endif /* CONFIG_PWM_SYSFS */
-
- #endif /* __LINUX_PWM_H */
-diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
-index 185f8ea..407ca0d 100644
---- a/include/uapi/linux/Kbuild
-+++ b/include/uapi/linux/Kbuild
-@@ -396,6 +396,7 @@ header-y += string.h
- header-y += suspend_ioctls.h
- header-y += swab.h
- header-y += synclink.h
-+header-y += sync_file.h
- header-y += sysctl.h
- header-y += sysinfo.h
- header-y += target_core_user.h
-diff --git a/kernel/time/timer.c b/kernel/time/timer.c
-index 32bf6f7..96db64b 100644
---- a/kernel/time/timer.c
-+++ b/kernel/time/timer.c
-@@ -878,7 +878,7 @@ static inline struct timer_base *get_timer_base(u32 tflags)
-
- #ifdef CONFIG_NO_HZ_COMMON
- static inline struct timer_base *
--__get_target_base(struct timer_base *base, unsigned tflags)
-+get_target_base(struct timer_base *base, unsigned tflags)
- {
- #ifdef CONFIG_SMP
- if ((tflags & TIMER_PINNED) || !base->migration_enabled)
-@@ -891,25 +891,27 @@ __get_target_base(struct timer_base *base, unsigned tflags)
-
- static inline void forward_timer_base(struct timer_base *base)
- {
-+ unsigned long jnow = READ_ONCE(jiffies);
-+
- /*
- * We only forward the base when it's idle and we have a delta between
- * base clock and jiffies.
- */
-- if (!base->is_idle || (long) (jiffies - base->clk) < 2)
-+ if (!base->is_idle || (long) (jnow - base->clk) < 2)
- return;
-
- /*
- * If the next expiry value is > jiffies, then we fast forward to
- * jiffies otherwise we forward to the next expiry value.
- */
-- if (time_after(base->next_expiry, jiffies))
-- base->clk = jiffies;
-+ if (time_after(base->next_expiry, jnow))
-+ base->clk = jnow;
- else
- base->clk = base->next_expiry;
- }
- #else
- static inline struct timer_base *
--__get_target_base(struct timer_base *base, unsigned tflags)
-+get_target_base(struct timer_base *base, unsigned tflags)
- {
- return get_timer_this_cpu_base(tflags);
- }
-@@ -917,14 +919,6 @@ __get_target_base(struct timer_base *base, unsigned tflags)
- static inline void forward_timer_base(struct timer_base *base) { }
- #endif
-
--static inline struct timer_base *
--get_target_base(struct timer_base *base, unsigned tflags)
--{
-- struct timer_base *target = __get_target_base(base, tflags);
--
-- forward_timer_base(target);
-- return target;
--}
-
- /*
- * We are using hashed locking: Holding per_cpu(timer_bases[x]).lock means
-@@ -943,7 +937,14 @@ static struct timer_base *lock_timer_base(struct timer_list *timer,
- {
- for (;;) {
- struct timer_base *base;
-- u32 tf = timer->flags;
-+ u32 tf;
-+
-+ /*
-+ * We need to use READ_ONCE() here, otherwise the compiler
-+ * might re-read @tf between the check for TIMER_MIGRATING
-+ * and spin_lock().
-+ */
-+ tf = READ_ONCE(timer->flags);
-
- if (!(tf & TIMER_MIGRATING)) {
- base = get_timer_base(tf);
-@@ -964,6 +965,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
- unsigned long clk = 0, flags;
- int ret = 0;
-
-+ BUG_ON(!timer->function);
-+
- /*
- * This is a common optimization triggered by the networking code - if
- * the timer is re-modified to have the same timeout or ends up in the
-@@ -972,13 +975,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
- if (timer_pending(timer)) {
- if (timer->expires == expires)
- return 1;
-+
- /*
-- * Take the current timer_jiffies of base, but without holding
-- * the lock!
-+ * We lock timer base and calculate the bucket index right
-+ * here. If the timer ends up in the same bucket, then we
-+ * just update the expiry time and avoid the whole
-+ * dequeue/enqueue dance.
- */
-- base = get_timer_base(timer->flags);
-- clk = base->clk;
-+ base = lock_timer_base(timer, &flags);
-
-+ clk = base->clk;
- idx = calc_wheel_index(expires, clk);
-
- /*
-@@ -988,14 +994,14 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
- */
- if (idx == timer_get_idx(timer)) {
- timer->expires = expires;
-- return 1;
-+ ret = 1;
-+ goto out_unlock;
- }
-+ } else {
-+ base = lock_timer_base(timer, &flags);
- }
-
- timer_stats_timer_set_start_info(timer);
-- BUG_ON(!timer->function);
--
-- base = lock_timer_base(timer, &flags);
-
- ret = detach_if_pending(timer, base, false);
- if (!ret && pending_only)
-@@ -1025,12 +1031,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
- }
- }
-
-+ /* Try to forward a stale timer base clock */
-+ forward_timer_base(base);
-+
- timer->expires = expires;
- /*
- * If 'idx' was calculated above and the base time did not advance
-- * between calculating 'idx' and taking the lock, only enqueue_timer()
-- * and trigger_dyntick_cpu() is required. Otherwise we need to
-- * (re)calculate the wheel index via internal_add_timer().
-+ * between calculating 'idx' and possibly switching the base, only
-+ * enqueue_timer() and trigger_dyntick_cpu() is required. Otherwise
-+ * we need to (re)calculate the wheel index via
-+ * internal_add_timer().
- */
- if (idx != UINT_MAX && clk == base->clk) {
- enqueue_timer(base, timer, idx);
-@@ -1510,12 +1520,16 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
- is_max_delta = (nextevt == base->clk + NEXT_TIMER_MAX_DELTA);
- base->next_expiry = nextevt;
- /*
-- * We have a fresh next event. Check whether we can forward the base:
-+ * We have a fresh next event. Check whether we can forward the
-+ * base. We can only do that when @basej is past base->clk
-+ * otherwise we might rewind base->clk.
- */
-- if (time_after(nextevt, jiffies))
-- base->clk = jiffies;
-- else if (time_after(nextevt, base->clk))
-- base->clk = nextevt;
-+ if (time_after(basej, base->clk)) {
-+ if (time_after(nextevt, basej))
-+ base->clk = basej;
-+ else if (time_after(nextevt, base->clk))
-+ base->clk = nextevt;
-+ }
-
- if (time_before_eq(nextevt, basej)) {
- expires = basem;
-diff --git a/mm/list_lru.c b/mm/list_lru.c
-index 1d05cb9..234676e 100644
---- a/mm/list_lru.c
-+++ b/mm/list_lru.c
-@@ -554,6 +554,8 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware,
- err = memcg_init_list_lru(lru, memcg_aware);
- if (err) {
- kfree(lru->node);
-+ /* Do this so a list_lru_destroy() doesn't crash: */
-+ lru->node = NULL;
- goto out;
- }
-
-diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 4be518d..dddead1 100644
---- a/mm/memcontrol.c
-+++ b/mm/memcontrol.c
-@@ -1947,6 +1947,15 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
- current->flags & PF_EXITING))
- goto force;
-
-+ /*
-+ * Prevent unbounded recursion when reclaim operations need to
-+ * allocate memory. This might exceed the limits temporarily,
-+ * but we prefer facilitating memory reclaim and getting back
-+ * under the limit over triggering OOM kills in these cases.
-+ */
-+ if (unlikely(current->flags & PF_MEMALLOC))
-+ goto force;
-+
- if (unlikely(task_in_memcg_oom(current)))
- goto nomem;
-
-diff --git a/mm/slab.c b/mm/slab.c
-index b672710..525a911 100644
---- a/mm/slab.c
-+++ b/mm/slab.c
-@@ -964,7 +964,7 @@ static int setup_kmem_cache_node(struct kmem_cache *cachep,
- * guaranteed to be valid until irq is re-enabled, because it will be
- * freed after synchronize_sched().
- */
-- if (force_change)
-+ if (old_shared && force_change)
- synchronize_sched();
-
- fail:
-diff --git a/mm/vmscan.c b/mm/vmscan.c
-index 0fe8b71..ba0fad7 100644
---- a/mm/vmscan.c
-+++ b/mm/vmscan.c
-@@ -3048,7 +3048,9 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
- sc.gfp_mask,
- sc.reclaim_idx);
-
-+ current->flags |= PF_MEMALLOC;
- nr_reclaimed = do_try_to_free_pages(zonelist, &sc);
-+ current->flags &= ~PF_MEMALLOC;
-
- trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed);
-
-diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 9dce3b1..59a9603 100644
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2253,16 +2253,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
- if (!(status->rx_flags & IEEE80211_RX_AMSDU))
- return RX_CONTINUE;
-
-- if (ieee80211_has_a4(hdr->frame_control) &&
-- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-- !rx->sdata->u.vlan.sta)
-- return RX_DROP_UNUSABLE;
-+ if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
-+ switch (rx->sdata->vif.type) {
-+ case NL80211_IFTYPE_AP_VLAN:
-+ if (!rx->sdata->u.vlan.sta)
-+ return RX_DROP_UNUSABLE;
-+ break;
-+ case NL80211_IFTYPE_STATION:
-+ if (!rx->sdata->u.mgd.use_4addr)
-+ return RX_DROP_UNUSABLE;
-+ break;
-+ default:
-+ return RX_DROP_UNUSABLE;
-+ }
-+ }
-
-- if (is_multicast_ether_addr(hdr->addr1) &&
-- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-- rx->sdata->u.vlan.sta) ||
-- (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
-- rx->sdata->u.mgd.use_4addr)))
-+ if (is_multicast_ether_addr(hdr->addr1))
- return RX_DROP_UNUSABLE;
-
- skb->dev = dev;
-diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
-index 018eed7..8668a5c 100644
---- a/net/netfilter/xt_NFLOG.c
-+++ b/net/netfilter/xt_NFLOG.c
-@@ -32,6 +32,7 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
- li.u.ulog.copy_len = info->len;
- li.u.ulog.group = info->group;
- li.u.ulog.qthreshold = info->threshold;
-+ li.u.ulog.flags = 0;
-
- if (info->flags & XT_NFLOG_F_COPY_LEN)
- li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
-diff --git a/security/keys/Kconfig b/security/keys/Kconfig
-index f826e87..d942c7c 100644
---- a/security/keys/Kconfig
-+++ b/security/keys/Kconfig
-@@ -41,7 +41,7 @@ config BIG_KEYS
- bool "Large payload keys"
- depends on KEYS
- depends on TMPFS
-- select CRYPTO
-+ depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
- select CRYPTO_AES
- select CRYPTO_ECB
- select CRYPTO_RNG
-diff --git a/security/keys/big_key.c b/security/keys/big_key.c
-index c0b3030..835c1ab 100644
---- a/security/keys/big_key.c
-+++ b/security/keys/big_key.c
-@@ -9,6 +9,7 @@
- * 2 of the Licence, or (at your option) any later version.
- */
-
-+#define pr_fmt(fmt) "big_key: "fmt
- #include <linux/init.h>
- #include <linux/seq_file.h>
- #include <linux/file.h>
-@@ -341,44 +342,48 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
- */
- static int __init big_key_init(void)
- {
-- return register_key_type(&key_type_big_key);
--}
--
--/*
-- * Initialize big_key crypto and RNG algorithms
-- */
--static int __init big_key_crypto_init(void)
--{
-- int ret = -EINVAL;
-+ struct crypto_skcipher *cipher;
-+ struct crypto_rng *rng;
-+ int ret;
-
-- /* init RNG */
-- big_key_rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-- if (IS_ERR(big_key_rng)) {
-- big_key_rng = NULL;
-- return -EFAULT;
-+ rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-+ if (IS_ERR(rng)) {
-+ pr_err("Can't alloc rng: %ld\n", PTR_ERR(rng));
-+ return PTR_ERR(rng);
- }
-
-+ big_key_rng = rng;
-+
- /* seed RNG */
-- ret = crypto_rng_reset(big_key_rng, NULL, crypto_rng_seedsize(big_key_rng));
-- if (ret)
-- goto error;
-+ ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
-+ if (ret) {
-+ pr_err("Can't reset rng: %d\n", ret);
-+ goto error_rng;
-+ }
-
- /* init block cipher */
-- big_key_skcipher = crypto_alloc_skcipher(big_key_alg_name,
-- 0, CRYPTO_ALG_ASYNC);
-- if (IS_ERR(big_key_skcipher)) {
-- big_key_skcipher = NULL;
-- ret = -EFAULT;
-- goto error;
-+ cipher = crypto_alloc_skcipher(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
-+ if (IS_ERR(cipher)) {
-+ ret = PTR_ERR(cipher);
-+ pr_err("Can't alloc crypto: %d\n", ret);
-+ goto error_rng;
-+ }
-+
-+ big_key_skcipher = cipher;
-+
-+ ret = register_key_type(&key_type_big_key);
-+ if (ret < 0) {
-+ pr_err("Can't register type: %d\n", ret);
-+ goto error_cipher;
- }
-
- return 0;
-
--error:
-+error_cipher:
-+ crypto_free_skcipher(big_key_skcipher);
-+error_rng:
- crypto_free_rng(big_key_rng);
-- big_key_rng = NULL;
- return ret;
- }
-
--device_initcall(big_key_init);
--late_initcall(big_key_crypto_init);
-+late_initcall(big_key_init);
-diff --git a/security/keys/proc.c b/security/keys/proc.c
-index f0611a6..b9f531c 100644
---- a/security/keys/proc.c
-+++ b/security/keys/proc.c
-@@ -181,7 +181,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
- struct timespec now;
- unsigned long timo;
- key_ref_t key_ref, skey_ref;
-- char xbuf[12];
-+ char xbuf[16];
- int rc;
-
- struct keyring_search_context ctx = {
-diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
-index dcc1028..37d9cfb 100644
---- a/sound/core/seq/seq_timer.c
-+++ b/sound/core/seq/seq_timer.c
-@@ -448,8 +448,8 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
-
- ktime_get_ts64(&tm);
- tm = timespec64_sub(tm, tmr->last_update);
-- cur_time.tv_nsec = tm.tv_nsec;
-- cur_time.tv_sec = tm.tv_sec;
-+ cur_time.tv_nsec += tm.tv_nsec;
-+ cur_time.tv_sec += tm.tv_sec;
- snd_seq_sanity_real_time(&cur_time);
- }
- spin_unlock_irqrestore(&tmr->lock, flags);
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 160c7f7..487fcbf 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -340,8 +340,7 @@ enum {
-
- /* quirks for Nvidia */
- #define AZX_DCAPS_PRESET_NVIDIA \
-- (AZX_DCAPS_NO_MSI | /*AZX_DCAPS_ALIGN_BUFSIZE |*/ \
-- AZX_DCAPS_NO_64BIT | AZX_DCAPS_CORBRP_SELF_CLEAR |\
-+ (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
- AZX_DCAPS_SNOOP_TYPE(NVIDIA))
-
- #define AZX_DCAPS_PRESET_CTHDA \
-@@ -1699,6 +1698,10 @@ static int azx_first_init(struct azx *chip)
- }
- }
-
-+ /* NVidia hardware normally only supports up to 40 bits of DMA */
-+ if (chip->pci->vendor == PCI_VENDOR_ID_NVIDIA)
-+ dma_bits = 40;
-+
- /* disable 64bit DMA address on some devices */
- if (chip->driver_caps & AZX_DCAPS_NO_64BIT) {
- dev_dbg(card->dev, "Disabling 64bit DMA\n");
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index bd481ac..26e866f 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -5809,8 +5809,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
- #define ALC295_STANDARD_PINS \
- {0x12, 0xb7a60130}, \
- {0x14, 0x90170110}, \
-- {0x17, 0x21014020}, \
-- {0x18, 0x21a19030}, \
- {0x21, 0x04211020}
-
- #define ALC298_STANDARD_PINS \
-@@ -5857,11 +5855,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- {0x1b, 0x02011020},
- {0x21, 0x0221101f}),
- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ {0x14, 0x90170110},
-+ {0x1b, 0x01011020},
-+ {0x21, 0x0221101f}),
-+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- {0x14, 0x90170130},
- {0x1b, 0x01014020},
- {0x21, 0x0221103f}),
- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- {0x14, 0x90170130},
-+ {0x1b, 0x01011020},
-+ {0x21, 0x0221103f}),
-+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ {0x14, 0x90170130},
- {0x1b, 0x02011020},
- {0x21, 0x0221103f}),
- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-@@ -6037,7 +6043,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- ALC292_STANDARD_PINS,
- {0x13, 0x90a60140}),
- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-- ALC295_STANDARD_PINS),
-+ ALC295_STANDARD_PINS,
-+ {0x17, 0x21014020},
-+ {0x18, 0x21a19030}),
-+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-+ ALC295_STANDARD_PINS,
-+ {0x17, 0x21014040},
-+ {0x18, 0x21a19050}),
- SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
- ALC298_STANDARD_PINS,
- {0x17, 0x90170110}),
-@@ -6611,6 +6623,7 @@ enum {
- ALC891_FIXUP_HEADSET_MODE,
- ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
- ALC662_FIXUP_ACER_VERITON,
-+ ALC892_FIXUP_ASROCK_MOBO,
- };
-
- static const struct hda_fixup alc662_fixups[] = {
-@@ -6887,6 +6900,16 @@ static const struct hda_fixup alc662_fixups[] = {
- { }
- }
- },
-+ [ALC892_FIXUP_ASROCK_MOBO] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x15, 0x40f000f0 }, /* disabled */
-+ { 0x16, 0x40f000f0 }, /* disabled */
-+ { 0x18, 0x01014011 }, /* LO */
-+ { 0x1a, 0x01014012 }, /* LO */
-+ { }
-+ }
-+ },
- };
-
- static const struct snd_pci_quirk alc662_fixup_tbl[] = {
-@@ -6924,6 +6947,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
- SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
- SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
- SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
-+ SND_PCI_QUIRK(0x1849, 0x5892, "ASRock B150M", ALC892_FIXUP_ASROCK_MOBO),
- SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
- SND_PCI_QUIRK(0x1b0a, 0x01b8, "ACER Veriton", ALC662_FIXUP_ACER_VERITON),
- SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index c60a776..8a59d47 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -2907,6 +2907,23 @@ AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
- AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
- AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
-
-+/* Syntek STK1160 */
-+{
-+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
-+ USB_DEVICE_ID_MATCH_INT_CLASS |
-+ USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-+ .idVendor = 0x05e1,
-+ .idProduct = 0x0408,
-+ .bInterfaceClass = USB_CLASS_AUDIO,
-+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
-+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
-+ .vendor_name = "Syntek",
-+ .product_name = "STK1160",
-+ .ifnum = QUIRK_ANY_INTERFACE,
-+ .type = QUIRK_AUDIO_ALIGN_TRANSFER
-+ }
-+},
-+
- /* Digidesign Mbox */
- {
- /* Thanks to Clemens Ladisch <clemens@ladisch.de> */
diff --git a/4.8.7/0000_README b/4.8.8/0000_README
index 81b2200..59f6fd4 100644
--- a/4.8.7/0000_README
+++ b/4.8.8/0000_README
@@ -2,31 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1001_linux-4.8.2.patch
+Patch: 1007_linux-4.8.8.patch
From: http://www.kernel.org
-Desc: Linux 4.8.2
+Desc: Linux 4.8.8
-Patch: 1002_linux-4.8.3.patch
-From: http://www.kernel.org
-Desc: Linux 4.8.3
-
-Patch: 1003_linux-4.8.4.patch
-From: http://www.kernel.org
-Desc: Linux 4.8.4
-
-Patch: 1004_linux-4.8.5.patch
-From: http://www.kernel.org
-Desc: Linux 4.8.5
-
-Patch: 1005_linux-4.8.6.patch
-From: http://www.kernel.org
-Desc: Linux 4.8.6
-
-Patch: 1006_linux-4.8.7.patch
-From: http://www.kernel.org
-Desc: Linux 4.8.7
-
-Patch: 4420_grsecurity-3.1-4.8.7-201611102210.patch
+Patch: 4420_grsecurity-3.1-4.8.8-201611150756.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.8.8/1007_linux-4.8.8.patch b/4.8.8/1007_linux-4.8.8.patch
new file mode 100644
index 0000000..35fb91c
--- /dev/null
+++ b/4.8.8/1007_linux-4.8.8.patch
@@ -0,0 +1,1846 @@
+diff --git a/Makefile b/Makefile
+index 4d0f28c..8f18daa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 8
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+
+diff --git a/arch/powerpc/include/asm/checksum.h b/arch/powerpc/include/asm/checksum.h
+index ee655ed..1e8fceb 100644
+--- a/arch/powerpc/include/asm/checksum.h
++++ b/arch/powerpc/include/asm/checksum.h
+@@ -53,10 +53,8 @@ static inline __sum16 csum_fold(__wsum sum)
+ return (__force __sum16)(~((__force u32)sum + tmp) >> 16);
+ }
+
+-static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+- unsigned short len,
+- unsigned short proto,
+- __wsum sum)
++static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, __u32 len,
++ __u8 proto, __wsum sum)
+ {
+ #ifdef __powerpc64__
+ unsigned long s = (__force u32)sum;
+@@ -83,10 +81,8 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+ * computes the checksum of the TCP/UDP pseudo-header
+ * returns a 16-bit checksum, already complemented
+ */
+-static inline __sum16 csum_tcpudp_magic(__be32 saddr, __be32 daddr,
+- unsigned short len,
+- unsigned short proto,
+- __wsum sum)
++static inline __sum16 csum_tcpudp_magic(__be32 saddr, __be32 daddr, __u32 len,
++ __u8 proto, __wsum sum)
+ {
+ return csum_fold(csum_tcpudp_nofold(saddr, daddr, len, proto, sum));
+ }
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 9dbfcc0..5ff64af 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -63,6 +63,8 @@ enum ipoib_flush_level {
+
+ enum {
+ IPOIB_ENCAP_LEN = 4,
++ IPOIB_PSEUDO_LEN = 20,
++ IPOIB_HARD_LEN = IPOIB_ENCAP_LEN + IPOIB_PSEUDO_LEN,
+
+ IPOIB_UD_HEAD_SIZE = IB_GRH_BYTES + IPOIB_ENCAP_LEN,
+ IPOIB_UD_RX_SG = 2, /* max buffer needed for 4K mtu */
+@@ -134,15 +136,21 @@ struct ipoib_header {
+ u16 reserved;
+ };
+
+-struct ipoib_cb {
+- struct qdisc_skb_cb qdisc_cb;
+- u8 hwaddr[INFINIBAND_ALEN];
++struct ipoib_pseudo_header {
++ u8 hwaddr[INFINIBAND_ALEN];
+ };
+
+-static inline struct ipoib_cb *ipoib_skb_cb(const struct sk_buff *skb)
++static inline void skb_add_pseudo_hdr(struct sk_buff *skb)
+ {
+- BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct ipoib_cb));
+- return (struct ipoib_cb *)skb->cb;
++ char *data = skb_push(skb, IPOIB_PSEUDO_LEN);
++
++ /*
++ * only the ipoib header is present now, make room for a dummy
++ * pseudo header and set skb field accordingly
++ */
++ memset(data, 0, IPOIB_PSEUDO_LEN);
++ skb_reset_mac_header(skb);
++ skb_pull(skb, IPOIB_HARD_LEN);
+ }
+
+ /* Used for all multicast joins (broadcast, IPv4 mcast and IPv6 mcast) */
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 4ad297d..339a1ee 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -63,6 +63,8 @@ MODULE_PARM_DESC(cm_data_debug_level,
+ #define IPOIB_CM_RX_DELAY (3 * 256 * HZ)
+ #define IPOIB_CM_RX_UPDATE_MASK (0x3)
+
++#define IPOIB_CM_RX_RESERVE (ALIGN(IPOIB_HARD_LEN, 16) - IPOIB_ENCAP_LEN)
++
+ static struct ib_qp_attr ipoib_cm_err_attr = {
+ .qp_state = IB_QPS_ERR
+ };
+@@ -146,15 +148,15 @@ static struct sk_buff *ipoib_cm_alloc_rx_skb(struct net_device *dev,
+ struct sk_buff *skb;
+ int i;
+
+- skb = dev_alloc_skb(IPOIB_CM_HEAD_SIZE + 12);
++ skb = dev_alloc_skb(ALIGN(IPOIB_CM_HEAD_SIZE + IPOIB_PSEUDO_LEN, 16));
+ if (unlikely(!skb))
+ return NULL;
+
+ /*
+- * IPoIB adds a 4 byte header. So we need 12 more bytes to align the
++ * IPoIB adds a IPOIB_ENCAP_LEN byte header, this will align the
+ * IP header to a multiple of 16.
+ */
+- skb_reserve(skb, 12);
++ skb_reserve(skb, IPOIB_CM_RX_RESERVE);
+
+ mapping[0] = ib_dma_map_single(priv->ca, skb->data, IPOIB_CM_HEAD_SIZE,
+ DMA_FROM_DEVICE);
+@@ -624,9 +626,9 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
+ if (wc->byte_len < IPOIB_CM_COPYBREAK) {
+ int dlen = wc->byte_len;
+
+- small_skb = dev_alloc_skb(dlen + 12);
++ small_skb = dev_alloc_skb(dlen + IPOIB_CM_RX_RESERVE);
+ if (small_skb) {
+- skb_reserve(small_skb, 12);
++ skb_reserve(small_skb, IPOIB_CM_RX_RESERVE);
+ ib_dma_sync_single_for_cpu(priv->ca, rx_ring[wr_id].mapping[0],
+ dlen, DMA_FROM_DEVICE);
+ skb_copy_from_linear_data(skb, small_skb->data, dlen);
+@@ -663,8 +665,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
+
+ copied:
+ skb->protocol = ((struct ipoib_header *) skb->data)->proto;
+- skb_reset_mac_header(skb);
+- skb_pull(skb, IPOIB_ENCAP_LEN);
++ skb_add_pseudo_hdr(skb);
+
+ ++dev->stats.rx_packets;
+ dev->stats.rx_bytes += skb->len;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index be11d5d..830fecb 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -128,16 +128,15 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
+
+ buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
+
+- skb = dev_alloc_skb(buf_size + IPOIB_ENCAP_LEN);
++ skb = dev_alloc_skb(buf_size + IPOIB_HARD_LEN);
+ if (unlikely(!skb))
+ return NULL;
+
+ /*
+- * IB will leave a 40 byte gap for a GRH and IPoIB adds a 4 byte
+- * header. So we need 4 more bytes to get to 48 and align the
+- * IP header to a multiple of 16.
++ * the IP header will be at IPOIP_HARD_LEN + IB_GRH_BYTES, that is
++ * 64 bytes aligned
+ */
+- skb_reserve(skb, 4);
++ skb_reserve(skb, sizeof(struct ipoib_pseudo_header));
+
+ mapping = priv->rx_ring[id].mapping;
+ mapping[0] = ib_dma_map_single(priv->ca, skb->data, buf_size,
+@@ -253,8 +252,7 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
+ skb_pull(skb, IB_GRH_BYTES);
+
+ skb->protocol = ((struct ipoib_header *) skb->data)->proto;
+- skb_reset_mac_header(skb);
+- skb_pull(skb, IPOIB_ENCAP_LEN);
++ skb_add_pseudo_hdr(skb);
+
+ ++dev->stats.rx_packets;
+ dev->stats.rx_bytes += skb->len;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index cc1c1b0..823a528 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -925,9 +925,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ ipoib_neigh_free(neigh);
+ goto err_drop;
+ }
+- if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
++ if (skb_queue_len(&neigh->queue) <
++ IPOIB_MAX_PATH_REC_QUEUE) {
++ /* put pseudoheader back on for next time */
++ skb_push(skb, IPOIB_PSEUDO_LEN);
+ __skb_queue_tail(&neigh->queue, skb);
+- else {
++ } else {
+ ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
+ skb_queue_len(&neigh->queue));
+ goto err_drop;
+@@ -964,7 +967,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ }
+
+ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+- struct ipoib_cb *cb)
++ struct ipoib_pseudo_header *phdr)
+ {
+ struct ipoib_dev_priv *priv = netdev_priv(dev);
+ struct ipoib_path *path;
+@@ -972,16 +975,18 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+
+ spin_lock_irqsave(&priv->lock, flags);
+
+- path = __path_find(dev, cb->hwaddr + 4);
++ path = __path_find(dev, phdr->hwaddr + 4);
+ if (!path || !path->valid) {
+ int new_path = 0;
+
+ if (!path) {
+- path = path_rec_create(dev, cb->hwaddr + 4);
++ path = path_rec_create(dev, phdr->hwaddr + 4);
+ new_path = 1;
+ }
+ if (path) {
+ if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
++ /* put pseudoheader back on for next time */
++ skb_push(skb, IPOIB_PSEUDO_LEN);
+ __skb_queue_tail(&path->queue, skb);
+ } else {
+ ++dev->stats.tx_dropped;
+@@ -1009,10 +1014,12 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+ be16_to_cpu(path->pathrec.dlid));
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+- ipoib_send(dev, skb, path->ah, IPOIB_QPN(cb->hwaddr));
++ ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
+ return;
+ } else if ((path->query || !path_rec_start(dev, path)) &&
+ skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
++ /* put pseudoheader back on for next time */
++ skb_push(skb, IPOIB_PSEUDO_LEN);
+ __skb_queue_tail(&path->queue, skb);
+ } else {
+ ++dev->stats.tx_dropped;
+@@ -1026,13 +1033,15 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = netdev_priv(dev);
+ struct ipoib_neigh *neigh;
+- struct ipoib_cb *cb = ipoib_skb_cb(skb);
++ struct ipoib_pseudo_header *phdr;
+ struct ipoib_header *header;
+ unsigned long flags;
+
++ phdr = (struct ipoib_pseudo_header *) skb->data;
++ skb_pull(skb, sizeof(*phdr));
+ header = (struct ipoib_header *) skb->data;
+
+- if (unlikely(cb->hwaddr[4] == 0xff)) {
++ if (unlikely(phdr->hwaddr[4] == 0xff)) {
+ /* multicast, arrange "if" according to probability */
+ if ((header->proto != htons(ETH_P_IP)) &&
+ (header->proto != htons(ETH_P_IPV6)) &&
+@@ -1045,13 +1054,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_OK;
+ }
+ /* Add in the P_Key for multicast*/
+- cb->hwaddr[8] = (priv->pkey >> 8) & 0xff;
+- cb->hwaddr[9] = priv->pkey & 0xff;
++ phdr->hwaddr[8] = (priv->pkey >> 8) & 0xff;
++ phdr->hwaddr[9] = priv->pkey & 0xff;
+
+- neigh = ipoib_neigh_get(dev, cb->hwaddr);
++ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
+ if (likely(neigh))
+ goto send_using_neigh;
+- ipoib_mcast_send(dev, cb->hwaddr, skb);
++ ipoib_mcast_send(dev, phdr->hwaddr, skb);
+ return NETDEV_TX_OK;
+ }
+
+@@ -1060,16 +1069,16 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ case htons(ETH_P_IP):
+ case htons(ETH_P_IPV6):
+ case htons(ETH_P_TIPC):
+- neigh = ipoib_neigh_get(dev, cb->hwaddr);
++ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
+ if (unlikely(!neigh)) {
+- neigh_add_path(skb, cb->hwaddr, dev);
++ neigh_add_path(skb, phdr->hwaddr, dev);
+ return NETDEV_TX_OK;
+ }
+ break;
+ case htons(ETH_P_ARP):
+ case htons(ETH_P_RARP):
+ /* for unicast ARP and RARP should always perform path find */
+- unicast_arp_send(skb, dev, cb);
++ unicast_arp_send(skb, dev, phdr);
+ return NETDEV_TX_OK;
+ default:
+ /* ethertype not supported by IPoIB */
+@@ -1086,11 +1095,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto unref;
+ }
+ } else if (neigh->ah) {
+- ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(cb->hwaddr));
++ ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(phdr->hwaddr));
+ goto unref;
+ }
+
+ if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
++ /* put pseudoheader back on for next time */
++ skb_push(skb, sizeof(*phdr));
+ spin_lock_irqsave(&priv->lock, flags);
+ __skb_queue_tail(&neigh->queue, skb);
+ spin_unlock_irqrestore(&priv->lock, flags);
+@@ -1122,8 +1133,8 @@ static int ipoib_hard_header(struct sk_buff *skb,
+ unsigned short type,
+ const void *daddr, const void *saddr, unsigned len)
+ {
++ struct ipoib_pseudo_header *phdr;
+ struct ipoib_header *header;
+- struct ipoib_cb *cb = ipoib_skb_cb(skb);
+
+ header = (struct ipoib_header *) skb_push(skb, sizeof *header);
+
+@@ -1132,12 +1143,13 @@ static int ipoib_hard_header(struct sk_buff *skb,
+
+ /*
+ * we don't rely on dst_entry structure, always stuff the
+- * destination address into skb->cb so we can figure out where
++ * destination address into skb hard header so we can figure out where
+ * to send the packet later.
+ */
+- memcpy(cb->hwaddr, daddr, INFINIBAND_ALEN);
++ phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr));
++ memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
+
+- return sizeof *header;
++ return IPOIB_HARD_LEN;
+ }
+
+ static void ipoib_set_mcast_list(struct net_device *dev)
+@@ -1759,7 +1771,7 @@ void ipoib_setup(struct net_device *dev)
+
+ dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
+
+- dev->hard_header_len = IPOIB_ENCAP_LEN;
++ dev->hard_header_len = IPOIB_HARD_LEN;
+ dev->addr_len = INFINIBAND_ALEN;
+ dev->type = ARPHRD_INFINIBAND;
+ dev->tx_queue_len = ipoib_sendq_size * 2;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index d3394b6..1909dd2 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -796,9 +796,11 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
+ __ipoib_mcast_add(dev, mcast);
+ list_add_tail(&mcast->list, &priv->multicast_list);
+ }
+- if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE)
++ if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE) {
++ /* put pseudoheader back on for next time */
++ skb_push(skb, sizeof(struct ipoib_pseudo_header));
+ skb_queue_tail(&mcast->pkt_queue, skb);
+- else {
++ } else {
+ ++dev->stats.tx_dropped;
+ dev_kfree_skb_any(skb);
+ }
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 692ee24..3474de5 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -913,13 +913,11 @@ fec_restart(struct net_device *ndev)
+ * enet-mac reset will reset mac address registers too,
+ * so need to reconfigure it.
+ */
+- if (fep->quirks & FEC_QUIRK_ENET_MAC) {
+- memcpy(&temp_mac, ndev->dev_addr, ETH_ALEN);
+- writel((__force u32)cpu_to_be32(temp_mac[0]),
+- fep->hwp + FEC_ADDR_LOW);
+- writel((__force u32)cpu_to_be32(temp_mac[1]),
+- fep->hwp + FEC_ADDR_HIGH);
+- }
++ memcpy(&temp_mac, ndev->dev_addr, ETH_ALEN);
++ writel((__force u32)cpu_to_be32(temp_mac[0]),
++ fep->hwp + FEC_ADDR_LOW);
++ writel((__force u32)cpu_to_be32(temp_mac[1]),
++ fep->hwp + FEC_ADDR_HIGH);
+
+ /* Clear any outstanding interrupt. */
+ writel(0xffffffff, fep->hwp + FEC_IEVENT);
+@@ -1432,14 +1430,14 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
+ skb_put(skb, pkt_len - 4);
+ data = skb->data;
+
++ if (!is_copybreak && need_swap)
++ swap_buffer(data, pkt_len);
++
+ #if !defined(CONFIG_M5272)
+ if (fep->quirks & FEC_QUIRK_HAS_RACC)
+ data = skb_pull_inline(skb, 2);
+ #endif
+
+- if (!is_copybreak && need_swap)
+- swap_buffer(data, pkt_len);
+-
+ /* Extract the enhanced buffer descriptor */
+ ebdp = NULL;
+ if (fep->bufdesc_ex)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+index 132cea6..e3be7e4 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+@@ -127,7 +127,15 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
+ /* For TX we use the same irq per
+ ring we assigned for the RX */
+ struct mlx4_en_cq *rx_cq;
+-
++ int xdp_index;
++
++ /* The xdp tx irq must align with the rx ring that forwards to
++ * it, so reindex these from 0. This should only happen when
++ * tx_ring_num is not a multiple of rx_ring_num.
++ */
++ xdp_index = (priv->xdp_ring_num - priv->tx_ring_num) + cq_idx;
++ if (xdp_index >= 0)
++ cq_idx = xdp_index;
+ cq_idx = cq_idx % priv->rx_ring_num;
+ rx_cq = priv->rx_cq[cq_idx];
+ cq->vector = rx_cq->vector;
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 3c20e87..16af1ce 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -453,7 +453,7 @@ static struct sk_buff **geneve_gro_receive(struct sock *sk,
+
+ skb_gro_pull(skb, gh_len);
+ skb_gro_postpull_rcsum(skb, gh, gh_len);
+- pp = ptype->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
+ flush = 0;
+
+ out_unlock:
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 3ba29fc..c4d9653 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -624,15 +624,18 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ packet->total_data_buflen);
+
+ skb->protocol = eth_type_trans(skb, net);
+- if (csum_info) {
+- /* We only look at the IP checksum here.
+- * Should we be dropping the packet if checksum
+- * failed? How do we deal with other checksums - TCP/UDP?
+- */
+- if (csum_info->receive.ip_checksum_succeeded)
++
++ /* skb is already created with CHECKSUM_NONE */
++ skb_checksum_none_assert(skb);
++
++ /*
++ * In Linux, the IP checksum is always checked.
++ * Do L4 checksum offload if enabled and present.
++ */
++ if (csum_info && (net->features & NETIF_F_RXCSUM)) {
++ if (csum_info->receive.tcp_checksum_succeeded ||
++ csum_info->receive.udp_checksum_succeeded)
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+- else
+- skb->ip_summed = CHECKSUM_NONE;
+ }
+
+ if (vlan_tci & VLAN_TAG_PRESENT)
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 351e701..b72ddc6 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -397,6 +397,14 @@ static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
+ #define DEFAULT_ENCRYPT false
+ #define DEFAULT_ENCODING_SA 0
+
++static bool send_sci(const struct macsec_secy *secy)
++{
++ const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
++
++ return tx_sc->send_sci ||
++ (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
++}
++
+ static sci_t make_sci(u8 *addr, __be16 port)
+ {
+ sci_t sci;
+@@ -437,15 +445,15 @@ static unsigned int macsec_extra_len(bool sci_present)
+
+ /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
+ static void macsec_fill_sectag(struct macsec_eth_header *h,
+- const struct macsec_secy *secy, u32 pn)
++ const struct macsec_secy *secy, u32 pn,
++ bool sci_present)
+ {
+ const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
+
+- memset(&h->tci_an, 0, macsec_sectag_len(tx_sc->send_sci));
++ memset(&h->tci_an, 0, macsec_sectag_len(sci_present));
+ h->eth.h_proto = htons(ETH_P_MACSEC);
+
+- if (tx_sc->send_sci ||
+- (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb)) {
++ if (sci_present) {
+ h->tci_an |= MACSEC_TCI_SC;
+ memcpy(&h->secure_channel_id, &secy->sci,
+ sizeof(h->secure_channel_id));
+@@ -650,6 +658,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
+ struct macsec_tx_sc *tx_sc;
+ struct macsec_tx_sa *tx_sa;
+ struct macsec_dev *macsec = macsec_priv(dev);
++ bool sci_present;
+ u32 pn;
+
+ secy = &macsec->secy;
+@@ -687,7 +696,8 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
+
+ unprotected_len = skb->len;
+ eth = eth_hdr(skb);
+- hh = (struct macsec_eth_header *)skb_push(skb, macsec_extra_len(tx_sc->send_sci));
++ sci_present = send_sci(secy);
++ hh = (struct macsec_eth_header *)skb_push(skb, macsec_extra_len(sci_present));
+ memmove(hh, eth, 2 * ETH_ALEN);
+
+ pn = tx_sa_update_pn(tx_sa, secy);
+@@ -696,7 +706,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
+ kfree_skb(skb);
+ return ERR_PTR(-ENOLINK);
+ }
+- macsec_fill_sectag(hh, secy, pn);
++ macsec_fill_sectag(hh, secy, pn, sci_present);
+ macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
+
+ skb_put(skb, secy->icv_len);
+@@ -726,10 +736,10 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
+ skb_to_sgvec(skb, sg, 0, skb->len);
+
+ if (tx_sc->encrypt) {
+- int len = skb->len - macsec_hdr_len(tx_sc->send_sci) -
++ int len = skb->len - macsec_hdr_len(sci_present) -
+ secy->icv_len;
+ aead_request_set_crypt(req, sg, sg, len, iv);
+- aead_request_set_ad(req, macsec_hdr_len(tx_sc->send_sci));
++ aead_request_set_ad(req, macsec_hdr_len(sci_present));
+ } else {
+ aead_request_set_crypt(req, sg, sg, 0, iv);
+ aead_request_set_ad(req, skb->len - secy->icv_len);
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index c6f6683..f424b86 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -608,6 +608,21 @@ void phy_start_machine(struct phy_device *phydev)
+ }
+
+ /**
++ * phy_trigger_machine - trigger the state machine to run
++ *
++ * @phydev: the phy_device struct
++ *
++ * Description: There has been a change in state which requires that the
++ * state machine runs.
++ */
++
++static void phy_trigger_machine(struct phy_device *phydev)
++{
++ cancel_delayed_work_sync(&phydev->state_queue);
++ queue_delayed_work(system_power_efficient_wq, &phydev->state_queue, 0);
++}
++
++/**
+ * phy_stop_machine - stop the PHY state machine tracking
+ * @phydev: target phy_device struct
+ *
+@@ -639,6 +654,8 @@ static void phy_error(struct phy_device *phydev)
+ mutex_lock(&phydev->lock);
+ phydev->state = PHY_HALTED;
+ mutex_unlock(&phydev->lock);
++
++ phy_trigger_machine(phydev);
+ }
+
+ /**
+@@ -800,8 +817,7 @@ void phy_change(struct work_struct *work)
+ }
+
+ /* reschedule state queue work to run as soon as possible */
+- cancel_delayed_work_sync(&phydev->state_queue);
+- queue_delayed_work(system_power_efficient_wq, &phydev->state_queue, 0);
++ phy_trigger_machine(phydev);
+ return;
+
+ ignore:
+@@ -890,6 +906,8 @@ void phy_start(struct phy_device *phydev)
+ /* if phy was suspended, bring the physical link up again */
+ if (do_resume)
+ phy_resume(phydev);
++
++ phy_trigger_machine(phydev);
+ }
+ EXPORT_SYMBOL(phy_start);
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 6e65832..5ae664c 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -584,7 +584,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk,
+ }
+ }
+
+- pp = eth_gro_receive(head, skb);
++ pp = call_gro_receive(eth_gro_receive, head, skb);
+ flush = 0;
+
+ out:
+diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
+index d637c93..58a97d4 100644
+--- a/drivers/ptp/ptp_chardev.c
++++ b/drivers/ptp/ptp_chardev.c
+@@ -193,6 +193,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
+ if (err)
+ break;
+
++ memset(&precise_offset, 0, sizeof(precise_offset));
+ ts = ktime_to_timespec64(xtstamp.device);
+ precise_offset.device.sec = ts.tv_sec;
+ precise_offset.device.nsec = ts.tv_nsec;
+diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
+index ca86c88..3aaea71 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -2233,7 +2233,7 @@ struct megasas_instance_template {
+ };
+
+ #define MEGASAS_IS_LOGICAL(scp) \
+- (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
++ ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1)
+
+ #define MEGASAS_DEV_INDEX(scp) \
+ (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index c1ed25a..71e4899 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1713,16 +1713,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ goto out_done;
+ }
+
+- switch (scmd->cmnd[0]) {
+- case SYNCHRONIZE_CACHE:
+- /*
+- * FW takes care of flush cache on its own
+- * No need to send it down
+- */
++ /*
++ * FW takes care of flush cache on its own for Virtual Disk.
++ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
++ */
++ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
+ scmd->result = DID_OK << 16;
+ goto out_done;
+- default:
+- break;
+ }
+
+ return instance->instancet->build_and_issue_cmd(instance, scmd);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 6443cfb..dc3b596 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -789,6 +789,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
+ req->trb = trb;
+ req->trb_dma = dwc3_trb_dma_offset(dep, trb);
+ req->first_trb_index = dep->trb_enqueue;
++ dep->queued_requests++;
+ }
+
+ dwc3_ep_inc_enq(dep);
+@@ -841,8 +842,6 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
+
+ trb->ctrl |= DWC3_TRB_CTRL_HWO;
+
+- dep->queued_requests++;
+-
+ trace_dwc3_prepare_trb(dep, trb);
+ }
+
+@@ -1963,7 +1962,9 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
+ unsigned int s_pkt = 0;
+ unsigned int trb_status;
+
+- dep->queued_requests--;
++ if (req->trb == trb)
++ dep->queued_requests--;
++
+ trace_dwc3_complete_trb(dep, trb);
+
+ /*
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index e8d79d4..e942c67 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2154,7 +2154,10 @@ struct napi_gro_cb {
+ /* Used to determine if flush_id can be ignored */
+ u8 is_atomic:1;
+
+- /* 5 bit hole */
++ /* Number of gro_receive callbacks this packet already went through */
++ u8 recursion_counter:4;
++
++ /* 1 bit hole */
+
+ /* used to support CHECKSUM_COMPLETE for tunneling protocols */
+ __wsum csum;
+@@ -2165,6 +2168,40 @@ struct napi_gro_cb {
+
+ #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)
+
++#define GRO_RECURSION_LIMIT 15
++static inline int gro_recursion_inc_test(struct sk_buff *skb)
++{
++ return ++NAPI_GRO_CB(skb)->recursion_counter == GRO_RECURSION_LIMIT;
++}
++
++typedef struct sk_buff **(*gro_receive_t)(struct sk_buff **, struct sk_buff *);
++static inline struct sk_buff **call_gro_receive(gro_receive_t cb,
++ struct sk_buff **head,
++ struct sk_buff *skb)
++{
++ if (unlikely(gro_recursion_inc_test(skb))) {
++ NAPI_GRO_CB(skb)->flush |= 1;
++ return NULL;
++ }
++
++ return cb(head, skb);
++}
++
++typedef struct sk_buff **(*gro_receive_sk_t)(struct sock *, struct sk_buff **,
++ struct sk_buff *);
++static inline struct sk_buff **call_gro_receive_sk(gro_receive_sk_t cb,
++ struct sock *sk,
++ struct sk_buff **head,
++ struct sk_buff *skb)
++{
++ if (unlikely(gro_recursion_inc_test(skb))) {
++ NAPI_GRO_CB(skb)->flush |= 1;
++ return NULL;
++ }
++
++ return cb(sk, head, skb);
++}
++
+ struct packet_type {
+ __be16 type; /* This is really htons(ether_type). */
+ struct net_device *dev; /* NULL is wildcarded here */
+@@ -3862,7 +3899,7 @@ struct net_device *netdev_all_lower_get_next_rcu(struct net_device *dev,
+ ldev = netdev_all_lower_get_next(dev, &(iter)))
+
+ #define netdev_for_each_all_lower_dev_rcu(dev, ldev, iter) \
+- for (iter = (dev)->all_adj_list.lower.next, \
++ for (iter = &(dev)->all_adj_list.lower, \
+ ldev = netdev_all_lower_get_next_rcu(dev, &(iter)); \
+ ldev; \
+ ldev = netdev_all_lower_get_next_rcu(dev, &(iter)))
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 9742b92..156b0c1 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -549,7 +549,7 @@ int ip_options_rcv_srr(struct sk_buff *skb);
+ */
+
+ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
+-void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset);
++void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int tlen, int offset);
+ int ip_cmsg_send(struct sock *sk, struct msghdr *msg,
+ struct ipcm_cookie *ipc, bool allow_ipv6);
+ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
+@@ -571,7 +571,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
+
+ static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
+ {
+- ip_cmsg_recv_offset(msg, skb, 0);
++ ip_cmsg_recv_offset(msg, skb, 0, 0);
+ }
+
+ bool icmp_global_allow(void);
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index d97305d..0a2d270 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -32,6 +32,7 @@ struct route_info {
+ #define RT6_LOOKUP_F_SRCPREF_TMP 0x00000008
+ #define RT6_LOOKUP_F_SRCPREF_PUBLIC 0x00000010
+ #define RT6_LOOKUP_F_SRCPREF_COA 0x00000020
++#define RT6_LOOKUP_F_IGNORE_LINKSTATE 0x00000040
+
+ /* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
+ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
+diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
+index 262f037..5a78be5 100644
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -350,7 +350,7 @@ struct rtnexthop {
+ #define RTNH_F_OFFLOAD 8 /* offloaded route */
+ #define RTNH_F_LINKDOWN 16 /* carrier-down on nexthop */
+
+-#define RTNH_COMPARE_MASK (RTNH_F_DEAD | RTNH_F_LINKDOWN)
++#define RTNH_COMPARE_MASK (RTNH_F_DEAD | RTNH_F_LINKDOWN | RTNH_F_OFFLOAD)
+
+ /* Macros to handle hexthops */
+
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 8de138d..f2531ad 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -664,7 +664,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head,
+
+ skb_gro_pull(skb, sizeof(*vhdr));
+ skb_gro_postpull_rcsum(skb, vhdr, sizeof(*vhdr));
+- pp = ptype->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index c5fea93..2136e45 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,13 +972,12 @@ static void br_multicast_enable(struct bridge_mcast_own_query *query)
+ mod_timer(&query->timer, jiffies);
+ }
+
+-void br_multicast_enable_port(struct net_bridge_port *port)
++static void __br_multicast_enable_port(struct net_bridge_port *port)
+ {
+ struct net_bridge *br = port->br;
+
+- spin_lock(&br->multicast_lock);
+ if (br->multicast_disabled || !netif_running(br->dev))
+- goto out;
++ return;
+
+ br_multicast_enable(&port->ip4_own_query);
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -987,8 +986,14 @@ void br_multicast_enable_port(struct net_bridge_port *port)
+ if (port->multicast_router == MDB_RTR_TYPE_PERM &&
+ hlist_unhashed(&port->rlist))
+ br_multicast_add_router(br, port);
++}
+
+-out:
++void br_multicast_enable_port(struct net_bridge_port *port)
++{
++ struct net_bridge *br = port->br;
++
++ spin_lock(&br->multicast_lock);
++ __br_multicast_enable_port(port);
+ spin_unlock(&br->multicast_lock);
+ }
+
+@@ -1994,8 +1999,9 @@ static void br_multicast_start_querier(struct net_bridge *br,
+
+ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+ {
+- int err = 0;
+ struct net_bridge_mdb_htable *mdb;
++ struct net_bridge_port *port;
++ int err = 0;
+
+ spin_lock_bh(&br->multicast_lock);
+ if (br->multicast_disabled == !val)
+@@ -2023,10 +2029,9 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+ goto rollback;
+ }
+
+- br_multicast_start_querier(br, &br->ip4_own_query);
+-#if IS_ENABLED(CONFIG_IPV6)
+- br_multicast_start_querier(br, &br->ip6_own_query);
+-#endif
++ br_multicast_open(br);
++ list_for_each_entry(port, &br->port_list, list)
++ __br_multicast_enable_port(port);
+
+ unlock:
+ spin_unlock_bh(&br->multicast_lock);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index ea63120..44b3ba4 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3035,6 +3035,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
+ }
+ return head;
+ }
++EXPORT_SYMBOL_GPL(validate_xmit_skb_list);
+
+ static void qdisc_pkt_len_init(struct sk_buff *skb)
+ {
+@@ -4496,6 +4497,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
+ NAPI_GRO_CB(skb)->flush = 0;
+ NAPI_GRO_CB(skb)->free = 0;
+ NAPI_GRO_CB(skb)->encap_mark = 0;
++ NAPI_GRO_CB(skb)->recursion_counter = 0;
+ NAPI_GRO_CB(skb)->is_fou = 0;
+ NAPI_GRO_CB(skb)->is_atomic = 1;
+ NAPI_GRO_CB(skb)->gro_remcsum_start = 0;
+@@ -5500,10 +5502,14 @@ struct net_device *netdev_all_lower_get_next_rcu(struct net_device *dev,
+ {
+ struct netdev_adjacent *lower;
+
+- lower = list_first_or_null_rcu(&dev->all_adj_list.lower,
+- struct netdev_adjacent, list);
++ lower = list_entry_rcu((*iter)->next, struct netdev_adjacent, list);
++
++ if (&lower->list == &dev->all_adj_list.lower)
++ return NULL;
++
++ *iter = &lower->list;
+
+- return lower ? lower->dev : NULL;
++ return lower->dev;
+ }
+ EXPORT_SYMBOL(netdev_all_lower_get_next_rcu);
+
+@@ -5578,6 +5584,7 @@ static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev,
+
+ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+ struct net_device *adj_dev,
++ u16 ref_nr,
+ struct list_head *dev_list,
+ void *private, bool master)
+ {
+@@ -5587,7 +5594,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+ adj = __netdev_find_adj(adj_dev, dev_list);
+
+ if (adj) {
+- adj->ref_nr++;
++ adj->ref_nr += ref_nr;
+ return 0;
+ }
+
+@@ -5597,7 +5604,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+
+ adj->dev = adj_dev;
+ adj->master = master;
+- adj->ref_nr = 1;
++ adj->ref_nr = ref_nr;
+ adj->private = private;
+ dev_hold(adj_dev);
+
+@@ -5636,6 +5643,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
+
+ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+ struct net_device *adj_dev,
++ u16 ref_nr,
+ struct list_head *dev_list)
+ {
+ struct netdev_adjacent *adj;
+@@ -5648,10 +5656,10 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+ BUG();
+ }
+
+- if (adj->ref_nr > 1) {
+- pr_debug("%s to %s ref_nr-- = %d\n", dev->name, adj_dev->name,
+- adj->ref_nr-1);
+- adj->ref_nr--;
++ if (adj->ref_nr > ref_nr) {
++ pr_debug("%s to %s ref_nr-%d = %d\n", dev->name, adj_dev->name,
++ ref_nr, adj->ref_nr-ref_nr);
++ adj->ref_nr -= ref_nr;
+ return;
+ }
+
+@@ -5670,21 +5678,22 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev,
+
+ static int __netdev_adjacent_dev_link_lists(struct net_device *dev,
+ struct net_device *upper_dev,
++ u16 ref_nr,
+ struct list_head *up_list,
+ struct list_head *down_list,
+ void *private, bool master)
+ {
+ int ret;
+
+- ret = __netdev_adjacent_dev_insert(dev, upper_dev, up_list, private,
+- master);
++ ret = __netdev_adjacent_dev_insert(dev, upper_dev, ref_nr, up_list,
++ private, master);
+ if (ret)
+ return ret;
+
+- ret = __netdev_adjacent_dev_insert(upper_dev, dev, down_list, private,
+- false);
++ ret = __netdev_adjacent_dev_insert(upper_dev, dev, ref_nr, down_list,
++ private, false);
+ if (ret) {
+- __netdev_adjacent_dev_remove(dev, upper_dev, up_list);
++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list);
+ return ret;
+ }
+
+@@ -5692,9 +5701,10 @@ static int __netdev_adjacent_dev_link_lists(struct net_device *dev,
+ }
+
+ static int __netdev_adjacent_dev_link(struct net_device *dev,
+- struct net_device *upper_dev)
++ struct net_device *upper_dev,
++ u16 ref_nr)
+ {
+- return __netdev_adjacent_dev_link_lists(dev, upper_dev,
++ return __netdev_adjacent_dev_link_lists(dev, upper_dev, ref_nr,
+ &dev->all_adj_list.upper,
+ &upper_dev->all_adj_list.lower,
+ NULL, false);
+@@ -5702,17 +5712,19 @@ static int __netdev_adjacent_dev_link(struct net_device *dev,
+
+ static void __netdev_adjacent_dev_unlink_lists(struct net_device *dev,
+ struct net_device *upper_dev,
++ u16 ref_nr,
+ struct list_head *up_list,
+ struct list_head *down_list)
+ {
+- __netdev_adjacent_dev_remove(dev, upper_dev, up_list);
+- __netdev_adjacent_dev_remove(upper_dev, dev, down_list);
++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list);
++ __netdev_adjacent_dev_remove(upper_dev, dev, ref_nr, down_list);
+ }
+
+ static void __netdev_adjacent_dev_unlink(struct net_device *dev,
+- struct net_device *upper_dev)
++ struct net_device *upper_dev,
++ u16 ref_nr)
+ {
+- __netdev_adjacent_dev_unlink_lists(dev, upper_dev,
++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ref_nr,
+ &dev->all_adj_list.upper,
+ &upper_dev->all_adj_list.lower);
+ }
+@@ -5721,17 +5733,17 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev,
+ struct net_device *upper_dev,
+ void *private, bool master)
+ {
+- int ret = __netdev_adjacent_dev_link(dev, upper_dev);
++ int ret = __netdev_adjacent_dev_link(dev, upper_dev, 1);
+
+ if (ret)
+ return ret;
+
+- ret = __netdev_adjacent_dev_link_lists(dev, upper_dev,
++ ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, 1,
+ &dev->adj_list.upper,
+ &upper_dev->adj_list.lower,
+ private, master);
+ if (ret) {
+- __netdev_adjacent_dev_unlink(dev, upper_dev);
++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1);
+ return ret;
+ }
+
+@@ -5741,8 +5753,8 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev,
+ static void __netdev_adjacent_dev_unlink_neighbour(struct net_device *dev,
+ struct net_device *upper_dev)
+ {
+- __netdev_adjacent_dev_unlink(dev, upper_dev);
+- __netdev_adjacent_dev_unlink_lists(dev, upper_dev,
++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1);
++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, 1,
+ &dev->adj_list.upper,
+ &upper_dev->adj_list.lower);
+ }
+@@ -5795,7 +5807,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) {
+ pr_debug("Interlinking %s with %s, non-neighbour\n",
+ i->dev->name, j->dev->name);
+- ret = __netdev_adjacent_dev_link(i->dev, j->dev);
++ ret = __netdev_adjacent_dev_link(i->dev, j->dev, i->ref_nr);
+ if (ret)
+ goto rollback_mesh;
+ }
+@@ -5805,7 +5817,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) {
+ pr_debug("linking %s's upper device %s with %s\n",
+ upper_dev->name, i->dev->name, dev->name);
+- ret = __netdev_adjacent_dev_link(dev, i->dev);
++ ret = __netdev_adjacent_dev_link(dev, i->dev, i->ref_nr);
+ if (ret)
+ goto rollback_upper_mesh;
+ }
+@@ -5814,7 +5826,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &dev->all_adj_list.lower, list) {
+ pr_debug("linking %s's lower device %s with %s\n", dev->name,
+ i->dev->name, upper_dev->name);
+- ret = __netdev_adjacent_dev_link(i->dev, upper_dev);
++ ret = __netdev_adjacent_dev_link(i->dev, upper_dev, i->ref_nr);
+ if (ret)
+ goto rollback_lower_mesh;
+ }
+@@ -5832,7 +5844,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &dev->all_adj_list.lower, list) {
+ if (i == to_i)
+ break;
+- __netdev_adjacent_dev_unlink(i->dev, upper_dev);
++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr);
+ }
+
+ i = NULL;
+@@ -5842,7 +5854,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) {
+ if (i == to_i)
+ break;
+- __netdev_adjacent_dev_unlink(dev, i->dev);
++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
+ }
+
+ i = j = NULL;
+@@ -5854,7 +5866,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) {
+ if (i == to_i && j == to_j)
+ break;
+- __netdev_adjacent_dev_unlink(i->dev, j->dev);
++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr);
+ }
+ if (i == to_i)
+ break;
+@@ -5934,16 +5946,16 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+ */
+ list_for_each_entry(i, &dev->all_adj_list.lower, list)
+ list_for_each_entry(j, &upper_dev->all_adj_list.upper, list)
+- __netdev_adjacent_dev_unlink(i->dev, j->dev);
++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr);
+
+ /* remove also the devices itself from lower/upper device
+ * list
+ */
+ list_for_each_entry(i, &dev->all_adj_list.lower, list)
+- __netdev_adjacent_dev_unlink(i->dev, upper_dev);
++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr);
+
+ list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
+- __netdev_adjacent_dev_unlink(dev, i->dev);
++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
+
+ call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
+ &changeupper_info.info);
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index bbd118b..306b8f0 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -216,8 +216,8 @@
+ #define M_QUEUE_XMIT 2 /* Inject packet into qdisc */
+
+ /* If lock -- protects updating of if_list */
+-#define if_lock(t) spin_lock(&(t->if_lock));
+-#define if_unlock(t) spin_unlock(&(t->if_lock));
++#define if_lock(t) mutex_lock(&(t->if_lock));
++#define if_unlock(t) mutex_unlock(&(t->if_lock));
+
+ /* Used to help with determining the pkts on receive */
+ #define PKTGEN_MAGIC 0xbe9be955
+@@ -423,7 +423,7 @@ struct pktgen_net {
+ };
+
+ struct pktgen_thread {
+- spinlock_t if_lock; /* for list of devices */
++ struct mutex if_lock; /* for list of devices */
+ struct list_head if_list; /* All device here */
+ struct list_head th_list;
+ struct task_struct *tsk;
+@@ -2010,11 +2010,13 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d
+ {
+ struct pktgen_thread *t;
+
++ mutex_lock(&pktgen_thread_lock);
++
+ list_for_each_entry(t, &pn->pktgen_threads, th_list) {
+ struct pktgen_dev *pkt_dev;
+
+- rcu_read_lock();
+- list_for_each_entry_rcu(pkt_dev, &t->if_list, list) {
++ if_lock(t);
++ list_for_each_entry(pkt_dev, &t->if_list, list) {
+ if (pkt_dev->odev != dev)
+ continue;
+
+@@ -2029,8 +2031,9 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d
+ dev->name);
+ break;
+ }
+- rcu_read_unlock();
++ if_unlock(t);
+ }
++ mutex_unlock(&pktgen_thread_lock);
+ }
+
+ static int pktgen_device_event(struct notifier_block *unused,
+@@ -2286,7 +2289,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
+
+ static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
+ {
+- pkt_dev->pkt_overhead = LL_RESERVED_SPACE(pkt_dev->odev);
++ pkt_dev->pkt_overhead = 0;
+ pkt_dev->pkt_overhead += pkt_dev->nr_labels*sizeof(u32);
+ pkt_dev->pkt_overhead += VLAN_TAG_SIZE(pkt_dev);
+ pkt_dev->pkt_overhead += SVLAN_TAG_SIZE(pkt_dev);
+@@ -2777,13 +2780,13 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
+ }
+
+ static struct sk_buff *pktgen_alloc_skb(struct net_device *dev,
+- struct pktgen_dev *pkt_dev,
+- unsigned int extralen)
++ struct pktgen_dev *pkt_dev)
+ {
++ unsigned int extralen = LL_RESERVED_SPACE(dev);
+ struct sk_buff *skb = NULL;
+- unsigned int size = pkt_dev->cur_pkt_size + 64 + extralen +
+- pkt_dev->pkt_overhead;
++ unsigned int size;
+
++ size = pkt_dev->cur_pkt_size + 64 + extralen + pkt_dev->pkt_overhead;
+ if (pkt_dev->flags & F_NODE) {
+ int node = pkt_dev->node >= 0 ? pkt_dev->node : numa_node_id();
+
+@@ -2796,8 +2799,9 @@ static struct sk_buff *pktgen_alloc_skb(struct net_device *dev,
+ skb = __netdev_alloc_skb(dev, size, GFP_NOWAIT);
+ }
+
++ /* the caller pre-fetches from skb->data and reserves for the mac hdr */
+ if (likely(skb))
+- skb_reserve(skb, LL_RESERVED_SPACE(dev));
++ skb_reserve(skb, extralen - 16);
+
+ return skb;
+ }
+@@ -2830,16 +2834,14 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
+ mod_cur_headers(pkt_dev);
+ queue_map = pkt_dev->cur_queue_map;
+
+- datalen = (odev->hard_header_len + 16) & ~0xf;
+-
+- skb = pktgen_alloc_skb(odev, pkt_dev, datalen);
++ skb = pktgen_alloc_skb(odev, pkt_dev);
+ if (!skb) {
+ sprintf(pkt_dev->result, "No memory");
+ return NULL;
+ }
+
+ prefetchw(skb->data);
+- skb_reserve(skb, datalen);
++ skb_reserve(skb, 16);
+
+ /* Reserve for ethernet and IP header */
+ eth = (__u8 *) skb_push(skb, 14);
+@@ -2959,7 +2961,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
+ mod_cur_headers(pkt_dev);
+ queue_map = pkt_dev->cur_queue_map;
+
+- skb = pktgen_alloc_skb(odev, pkt_dev, 16);
++ skb = pktgen_alloc_skb(odev, pkt_dev);
+ if (!skb) {
+ sprintf(pkt_dev->result, "No memory");
+ return NULL;
+@@ -3763,7 +3765,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn)
+ return -ENOMEM;
+ }
+
+- spin_lock_init(&t->if_lock);
++ mutex_init(&t->if_lock);
+ t->cpu = cpu;
+
+ INIT_LIST_HEAD(&t->if_list);
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 66dff5e..02acfff 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -439,7 +439,7 @@ struct sk_buff **eth_gro_receive(struct sk_buff **head,
+
+ skb_gro_pull(skb, sizeof(*eh));
+ skb_gro_postpull_rcsum(skb, eh, sizeof(*eh));
+- pp = ptype->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 55513e6..eebbc0f 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1388,7 +1388,7 @@ struct sk_buff **inet_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+ skb_gro_pull(skb, sizeof(*iph));
+ skb_set_transport_header(skb, skb_gro_offset(skb));
+
+- pp = ops->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index 321d57f..5351b61 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -249,7 +249,7 @@ static struct sk_buff **fou_gro_receive(struct sock *sk,
+ if (!ops || !ops->callbacks.gro_receive)
+ goto out_unlock;
+
+- pp = ops->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+@@ -441,7 +441,7 @@ static struct sk_buff **gue_gro_receive(struct sock *sk,
+ if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive))
+ goto out_unlock;
+
+- pp = ops->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
+ flush = 0;
+
+ out_unlock:
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index ecd1e09..6871f59 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -227,7 +227,7 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head,
+ /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/
+ skb_gro_postpull_rcsum(skb, greh, grehlen);
+
+- pp = ptype->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
+ flush = 0;
+
+ out_unlock:
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 71a52f4d..11ef96e 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -98,7 +98,7 @@ static void ip_cmsg_recv_retopts(struct msghdr *msg, struct sk_buff *skb)
+ }
+
+ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,
+- int offset)
++ int tlen, int offset)
+ {
+ __wsum csum = skb->csum;
+
+@@ -106,8 +106,9 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,
+ return;
+
+ if (offset != 0)
+- csum = csum_sub(csum, csum_partial(skb_transport_header(skb),
+- offset, 0));
++ csum = csum_sub(csum,
++ csum_partial(skb_transport_header(skb) + tlen,
++ offset, 0));
+
+ put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum);
+ }
+@@ -153,7 +154,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
+ }
+
+ void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb,
+- int offset)
++ int tlen, int offset)
+ {
+ struct inet_sock *inet = inet_sk(skb->sk);
+ unsigned int flags = inet->cmsg_flags;
+@@ -216,7 +217,7 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb,
+ }
+
+ if (flags & IP_CMSG_CHECKSUM)
+- ip_cmsg_recv_checksum(msg, skb, offset);
++ ip_cmsg_recv_checksum(msg, skb, tlen, offset);
+ }
+ EXPORT_SYMBOL(ip_cmsg_recv_offset);
+
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 1cb67de..80bc36b 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -96,11 +96,11 @@ static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low
+ container_of(table->data, struct net, ipv4.ping_group_range.range);
+ unsigned int seq;
+ do {
+- seq = read_seqbegin(&net->ipv4.ip_local_ports.lock);
++ seq = read_seqbegin(&net->ipv4.ping_group_range.lock);
+
+ *low = data[0];
+ *high = data[1];
+- } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq));
++ } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq));
+ }
+
+ /* Update system visible IP port range */
+@@ -109,10 +109,10 @@ static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t hig
+ kgid_t *data = table->data;
+ struct net *net =
+ container_of(table->data, struct net, ipv4.ping_group_range.range);
+- write_seqlock(&net->ipv4.ip_local_ports.lock);
++ write_seqlock(&net->ipv4.ping_group_range.lock);
+ data[0] = low;
+ data[1] = high;
+- write_sequnlock(&net->ipv4.ip_local_ports.lock);
++ write_sequnlock(&net->ipv4.ping_group_range.lock);
+ }
+
+ /* Validate changes from /proc interface. */
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 5fdcb8d..c0d71e7 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1327,7 +1327,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
+ *addr_len = sizeof(*sin);
+ }
+ if (inet->cmsg_flags)
+- ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr) + off);
++ ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr), off);
+
+ err = copied;
+ if (flags & MSG_TRUNC)
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 81f253b..6de9f97 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -293,7 +293,7 @@ struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb,
+
+ skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */
+ skb_gro_postpull_rcsum(skb, uh, sizeof(struct udphdr));
+- pp = udp_sk(sk)->gro_receive(sk, head, skb);
++ pp = call_gro_receive_sk(udp_sk(sk)->gro_receive, sk, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 2f1f5d4..f5432d6 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2995,7 +2995,7 @@ static void init_loopback(struct net_device *dev)
+ * lo device down, release this obsolete dst and
+ * reallocate a new router for ifa.
+ */
+- if (sp_ifa->rt->dst.obsolete > 0) {
++ if (!atomic_read(&sp_ifa->rt->rt6i_ref)) {
+ ip6_rt_put(sp_ifa->rt);
+ sp_ifa->rt = NULL;
+ } else {
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index 22e90e5..a09418b 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -243,7 +243,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
+
+ skb_gro_postpull_rcsum(skb, iph, nlen);
+
+- pp = ops->callbacks.gro_receive(head, skb);
++ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
+
+ out_unlock:
+ rcu_read_unlock();
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 888543d..41489f3 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -155,6 +155,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
+ hash = HASH(&any, local);
+ for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ if (ipv6_addr_equal(local, &t->parms.laddr) &&
++ ipv6_addr_any(&t->parms.raddr) &&
+ (t->dev->flags & IFF_UP))
+ return t;
+ }
+@@ -162,6 +163,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
+ hash = HASH(remote, &any);
+ for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+ if (ipv6_addr_equal(remote, &t->parms.raddr) &&
++ ipv6_addr_any(&t->parms.laddr) &&
+ (t->dev->flags & IFF_UP))
+ return t;
+ }
+@@ -1132,6 +1134,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ if (err)
+ return err;
+
++ skb->protocol = htons(ETH_P_IPV6);
+ skb_push(skb, sizeof(struct ipv6hdr));
+ skb_reset_network_header(skb);
+ ipv6h = ipv6_hdr(skb);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 269218a..23153ac 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -656,7 +656,8 @@ static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+ struct net_device *dev = rt->dst.dev;
+
+ if (dev && !netif_carrier_ok(dev) &&
+- idev->cnf.ignore_routes_with_linkdown)
++ idev->cnf.ignore_routes_with_linkdown &&
++ !(strict & RT6_LOOKUP_F_IGNORE_LINKSTATE))
+ goto out;
+
+ if (rt6_check_expired(rt))
+@@ -1050,6 +1051,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
+ int strict = 0;
+
+ strict |= flags & RT6_LOOKUP_F_IFACE;
++ strict |= flags & RT6_LOOKUP_F_IGNORE_LINKSTATE;
+ if (net->ipv6.devconf_all->forwarding == 0)
+ strict |= RT6_LOOKUP_F_REACHABLE;
+
+@@ -1783,7 +1785,7 @@ static struct rt6_info *ip6_nh_lookup_table(struct net *net,
+ };
+ struct fib6_table *table;
+ struct rt6_info *rt;
+- int flags = RT6_LOOKUP_F_IFACE;
++ int flags = RT6_LOOKUP_F_IFACE | RT6_LOOKUP_F_IGNORE_LINKSTATE;
+
+ table = fib6_get_table(net, cfg->fc_table);
+ if (!table)
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 94f4f89..fc67822 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1193,6 +1193,16 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ return NULL;
+ }
+
++static void tcp_v6_restore_cb(struct sk_buff *skb)
++{
++ /* We need to move header back to the beginning if xfrm6_policy_check()
++ * and tcp_v6_fill_cb() are going to be called again.
++ * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
++ */
++ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
++ sizeof(struct inet6_skb_parm));
++}
++
+ /* The socket must have it's spinlock held when we get
+ * here, unless it is a TCP_LISTEN socket.
+ *
+@@ -1322,6 +1332,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
+ skb_set_owner_r(opt_skb, sk);
++ tcp_v6_restore_cb(opt_skb);
+ opt_skb = xchg(&np->pktoptions, opt_skb);
+ } else {
+ __kfree_skb(opt_skb);
+@@ -1355,15 +1366,6 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+ TCP_SKB_CB(skb)->sacked = 0;
+ }
+
+-static void tcp_v6_restore_cb(struct sk_buff *skb)
+-{
+- /* We need to move header back to the beginning if xfrm6_policy_check()
+- * and tcp_v6_fill_cb() are going to be called again.
+- */
+- memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+- sizeof(struct inet6_skb_parm));
+-}
+-
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ const struct tcphdr *th;
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 19ac3a1..c2a8656 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -427,7 +427,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+
+ if (is_udp4) {
+ if (inet->cmsg_flags)
+- ip_cmsg_recv(msg, skb);
++ ip_cmsg_recv_offset(msg, skb,
++ sizeof(struct udphdr), off);
+ } else {
+ if (np->rxopt.all)
+ ip6_datagram_recv_specific_ctl(sk, msg, skb);
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 627f898..62bea45 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1832,7 +1832,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ /* Record the max length of recvmsg() calls for future allocations */
+ nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len);
+ nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
+- 16384);
++ SKB_WITH_OVERHEAD(32768));
+
+ copied = data_skb->len;
+ if (len < copied) {
+@@ -2083,8 +2083,9 @@ static int netlink_dump(struct sock *sk)
+
+ if (alloc_min_size < nlk->max_recvmsg_len) {
+ alloc_size = nlk->max_recvmsg_len;
+- skb = alloc_skb(alloc_size, GFP_KERNEL |
+- __GFP_NOWARN | __GFP_NORETRY);
++ skb = alloc_skb(alloc_size,
++ (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) |
++ __GFP_NOWARN | __GFP_NORETRY);
+ }
+ if (!skb) {
+ alloc_size = alloc_min_size;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 33a4697..d2238b2 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -250,7 +250,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po);
+ static int packet_direct_xmit(struct sk_buff *skb)
+ {
+ struct net_device *dev = skb->dev;
+- netdev_features_t features;
++ struct sk_buff *orig_skb = skb;
+ struct netdev_queue *txq;
+ int ret = NETDEV_TX_BUSY;
+
+@@ -258,9 +258,8 @@ static int packet_direct_xmit(struct sk_buff *skb)
+ !netif_carrier_ok(dev)))
+ goto drop;
+
+- features = netif_skb_features(skb);
+- if (skb_needs_linearize(skb, features) &&
+- __skb_linearize(skb))
++ skb = validate_xmit_skb_list(skb, dev);
++ if (skb != orig_skb)
+ goto drop;
+
+ txq = skb_get_tx_queue(dev, skb);
+@@ -280,7 +279,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
+ return ret;
+ drop:
+ atomic_long_inc(&dev->tx_dropped);
+- kfree_skb(skb);
++ kfree_skb_list(skb);
+ return NET_XMIT_DROP;
+ }
+
+@@ -3952,6 +3951,7 @@ static int packet_notifier(struct notifier_block *this,
+ }
+ if (msg == NETDEV_UNREGISTER) {
+ packet_cached_dev_reset(po);
++ fanout_release(sk);
+ po->ifindex = -1;
+ if (po->prot_hook.dev)
+ dev_put(po->prot_hook.dev);
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index d09d068..027ddf4 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -341,22 +341,25 @@ int tcf_register_action(struct tc_action_ops *act,
+ if (!act->act || !act->dump || !act->init || !act->walk || !act->lookup)
+ return -EINVAL;
+
++ /* We have to register pernet ops before making the action ops visible,
++ * otherwise tcf_action_init_1() could get a partially initialized
++ * netns.
++ */
++ ret = register_pernet_subsys(ops);
++ if (ret)
++ return ret;
++
+ write_lock(&act_mod_lock);
+ list_for_each_entry(a, &act_base, head) {
+ if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
+ write_unlock(&act_mod_lock);
++ unregister_pernet_subsys(ops);
+ return -EEXIST;
+ }
+ }
+ list_add_tail(&act->head, &act_base);
+ write_unlock(&act_mod_lock);
+
+- ret = register_pernet_subsys(ops);
+- if (ret) {
+- tcf_unregister_action(act, ops);
+- return ret;
+- }
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(tcf_register_action);
+@@ -367,8 +370,6 @@ int tcf_unregister_action(struct tc_action_ops *act,
+ struct tc_action_ops *a;
+ int err = -ENOENT;
+
+- unregister_pernet_subsys(ops);
+-
+ write_lock(&act_mod_lock);
+ list_for_each_entry(a, &act_base, head) {
+ if (a == act) {
+@@ -378,6 +379,8 @@ int tcf_unregister_action(struct tc_action_ops *act,
+ }
+ }
+ write_unlock(&act_mod_lock);
++ if (!err)
++ unregister_pernet_subsys(ops);
+ return err;
+ }
+ EXPORT_SYMBOL(tcf_unregister_action);
+diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
+index 691409d..4ffc6c1 100644
+--- a/net/sched/act_vlan.c
++++ b/net/sched/act_vlan.c
+@@ -36,6 +36,12 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
+ bstats_update(&v->tcf_bstats, skb);
+ action = v->tcf_action;
+
++ /* Ensure 'data' points at mac_header prior calling vlan manipulating
++ * functions.
++ */
++ if (skb_at_tc_ingress(skb))
++ skb_push_rcsum(skb, skb->mac_len);
++
+ switch (v->tcfv_action) {
+ case TCA_VLAN_ACT_POP:
+ err = skb_vlan_pop(skb);
+@@ -57,6 +63,9 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a,
+ action = TC_ACT_SHOT;
+ v->tcf_qstats.drops++;
+ unlock:
++ if (skb_at_tc_ingress(skb))
++ skb_pull_rcsum(skb, skb->mac_len);
++
+ spin_unlock(&v->tcf_lock);
+ return action;
+ }
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index a7c5645..74bed5e 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -344,7 +344,8 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
+ if (err == 0) {
+ struct tcf_proto *next = rtnl_dereference(tp->next);
+
+- tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
++ tfilter_notify(net, skb, n, tp,
++ t->tcm_handle, RTM_DELTFILTER);
+ if (tcf_destroy(tp, false))
+ RCU_INIT_POINTER(*back, next);
+ }
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 31b7bc3..8192990 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -417,6 +417,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
+ __u8 has_data = 0;
+ int gso = 0;
+ int pktcount = 0;
++ int auth_len = 0;
+ struct dst_entry *dst;
+ unsigned char *auth = NULL; /* pointer to auth in skb data */
+
+@@ -505,7 +506,12 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
+ list_for_each_entry(chunk, &packet->chunk_list, list) {
+ int padded = WORD_ROUND(chunk->skb->len);
+
+- if (pkt_size + padded > tp->pathmtu)
++ if (chunk == packet->auth)
++ auth_len = padded;
++ else if (auth_len + padded + packet->overhead >
++ tp->pathmtu)
++ goto nomem;
++ else if (pkt_size + padded > tp->pathmtu)
+ break;
+ pkt_size += padded;
+ }
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index d88bb2b..920469e 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3422,6 +3422,12 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+ commands);
+
++ /* Report violation if chunk len overflows */
++ ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
++ if (ch_end > skb_tail_pointer(skb))
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
++ commands);
++
+ /* Now that we know we at least have a chunk header,
+ * do things that are type appropriate.
+ */
+@@ -3453,12 +3459,6 @@ sctp_disposition_t sctp_sf_ootb(struct net *net,
+ }
+ }
+
+- /* Report violation if chunk len overflows */
+- ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
+- if (ch_end > skb_tail_pointer(skb))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
+-
+ ch = (sctp_chunkhdr_t *) ch_end;
+ } while (ch_end < skb_tail_pointer(skb));
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 8ed2d99..baccbf3 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4683,7 +4683,7 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+ int __user *optlen)
+ {
+- if (len <= 0)
++ if (len == 0)
+ return -EINVAL;
+ if (len > sizeof(struct sctp_event_subscribe))
+ len = sizeof(struct sctp_event_subscribe);
+@@ -6426,6 +6426,9 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
+ if (get_user(len, optlen))
+ return -EFAULT;
+
++ if (len < 0)
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ switch (optname) {
+diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
+index a5fc9dd..a56c5e6 100644
+--- a/net/switchdev/switchdev.c
++++ b/net/switchdev/switchdev.c
+@@ -774,6 +774,9 @@ int switchdev_port_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
+ u32 mask = BR_LEARNING | BR_LEARNING_SYNC | BR_FLOOD;
+ int err;
+
++ if (!netif_is_bridge_port(dev))
++ return -EOPNOTSUPP;
++
+ err = switchdev_port_attr_get(dev, &attr);
+ if (err && err != -EOPNOTSUPP)
+ return err;
+@@ -929,6 +932,9 @@ int switchdev_port_bridge_setlink(struct net_device *dev,
+ struct nlattr *afspec;
+ int err = 0;
+
++ if (!netif_is_bridge_port(dev))
++ return -EOPNOTSUPP;
++
+ protinfo = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg),
+ IFLA_PROTINFO);
+ if (protinfo) {
+@@ -962,6 +968,9 @@ int switchdev_port_bridge_dellink(struct net_device *dev,
+ {
+ struct nlattr *afspec;
+
++ if (!netif_is_bridge_port(dev))
++ return -EOPNOTSUPP;
++
+ afspec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg),
+ IFLA_AF_SPEC);
+ if (afspec)
diff --git a/4.8.7/4420_grsecurity-3.1-4.8.7-201611102210.patch b/4.8.8/4420_grsecurity-3.1-4.8.8-201611150756.patch
index 76a16d1..e0579c2 100644
--- a/4.8.7/4420_grsecurity-3.1-4.8.7-201611102210.patch
+++ b/4.8.8/4420_grsecurity-3.1-4.8.8-201611150756.patch
@@ -407,7 +407,7 @@ index ffab8b5..b8fcd61 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 4d0f28c..1fee46b 100644
+index 8f18daa..a2e9eda 100644
--- a/Makefile
+++ b/Makefile
@@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -52853,10 +52853,10 @@ index cac1d52..29bb903 100644
int need_req_skb;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index cc1c1b0..fa712b0 100644
+index 823a528..c8171f7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-@@ -1022,7 +1022,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+@@ -1029,7 +1029,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
spin_unlock_irqrestore(&priv->lock, flags);
}
@@ -65237,7 +65237,7 @@ index 93dc10b..6598671 100644
struct net_local *lp = netdev_priv(dev);
struct sk_buff *new_skb;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
-index 3c20e87..5696f6f 100644
+index 16af1ce..deabcc5 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1450,7 +1450,7 @@ nla_put_failure:
@@ -65325,7 +65325,7 @@ index 591af71..a5bbc7a 100644
spinlock_t request_lock;
struct list_head req_list;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
-index 3ba29fc..793bdcf 100644
+index c4d9653..a4c9101 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -349,7 +349,7 @@ not_ip:
@@ -65528,10 +65528,10 @@ index 6255973..7ae59f5 100644
.init = loopback_net_init,
};
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
-index 351e701..8b7039d 100644
+index b72ddc6..7f75c10 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
-@@ -3378,7 +3378,7 @@ nla_put_failure:
+@@ -3388,7 +3388,7 @@ nla_put_failure:
return -EMSGSIZE;
}
@@ -66015,7 +66015,7 @@ index 1ce7420..8bef471 100644
};
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index 6e65832..def968c 100644
+index 5ae664c..65d0be53 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3169,7 +3169,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
@@ -75028,7 +75028,7 @@ index d197aa1..c1178a6 100644
/**
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
-index ca86c88..175be62 100644
+index 3aaea71..6cd098b 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -2048,7 +2048,7 @@ struct megasas_instance {
@@ -137208,7 +137208,7 @@ index b9f0ff4..fd3f501 100644
struct iovec;
struct kvec;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index e8d79d4..d9519a7 100644
+index e942c67..6133147 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1307,6 +1307,7 @@ struct net_device_ops {
@@ -137241,7 +137241,7 @@ index e8d79d4..d9519a7 100644
#ifdef CONFIG_WIRELESS_EXT
const struct iw_handler_def *wireless_handlers;
-@@ -4218,7 +4219,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
+@@ -4255,7 +4256,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
return dev->priv_flags & IFF_MACSEC;
}
@@ -140765,7 +140765,7 @@ index 235c781..160d4a3 100644
struct rcu_head rcu;
struct inet_peer *gc_next;
diff --git a/include/net/ip.h b/include/net/ip.h
-index 9742b92..f47d922 100644
+index 156b0c1..f921618 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -326,7 +326,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
@@ -146876,16 +146876,15 @@ index 8f27d5a..e7389a0 100644
if (pm_wakeup_pending()) {
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
-index b022284..b48c449 100644
+index b022284..48d5ea6 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
-@@ -1020,6 +1020,28 @@ static void swsusp_unset_page_forbidden(struct page *page)
+@@ -1020,6 +1020,26 @@ static void swsusp_unset_page_forbidden(struct page *page)
memory_bm_clear_bit(forbidden_pages_map, page_to_pfn(page));
}
+void clear_free_pages(void)
+{
-+#if defined(CONFIG_PAX_MEMORY_SANITIZE) || defined(CONFIG_PAGE_POISONING_ZERO)
+ struct memory_bitmap *bm = free_pages_map;
+ unsigned long pfn;
+
@@ -146902,39 +146901,11 @@ index b022284..b48c449 100644
+ }
+ memory_bm_position_reset(bm);
+ pr_info("PM: free pages cleared after restore\n");
-+#endif /* CONFIG_PAX_MEMORY_SANITIZE || PAGE_POISONING_ZERO */
+}
+
/**
* mark_nosave_pages - Mark pages that should not be saved.
* @bm: Memory bitmap.
-@@ -1132,6 +1154,26 @@ void free_basic_memory_bitmaps(void)
- pr_debug("PM: Basic memory bitmaps freed\n");
- }
-
-+void clear_free_pages(void)
-+{
-+ struct memory_bitmap *bm = free_pages_map;
-+ unsigned long pfn;
-+
-+ if (WARN_ON(!(free_pages_map)))
-+ return;
-+
-+ memory_bm_position_reset(bm);
-+ pfn = memory_bm_next_pfn(bm);
-+ while (pfn != BM_END_OF_MAP) {
-+ if (pfn_valid(pfn))
-+ clear_highpage(pfn_to_page(pfn));
-+
-+ pfn = memory_bm_next_pfn(bm);
-+ }
-+ memory_bm_position_reset(bm);
-+ pr_info("PM: free pages cleared after restore\n");
-+}
-+
- /**
- * snapshot_additional_pages - Estimate the number of extra pages needed.
- * @zone: Memory zone to carry out the computation for.
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index eea6dbc..075ab5e 100644
--- a/kernel/printk/printk.c
@@ -150712,6 +150683,18 @@ index cab7405..c65d473 100644
help
If you want to debug problems which hang or crash the kernel early
on boot and the crashing machine has a FireWire port, you can use
+diff --git a/lib/Kconfig.kmemcheck b/lib/Kconfig.kmemcheck
+index 846e039..63ef284 100644
+--- a/lib/Kconfig.kmemcheck
++++ b/lib/Kconfig.kmemcheck
+@@ -10,6 +10,7 @@ menuconfig KMEMCHECK
+ depends on SLUB || SLAB
+ depends on !CC_OPTIMIZE_FOR_SIZE
+ depends on !FUNCTION_TRACER
++ depends on !PAX_INITIFY
+ select FRAME_POINTER
+ select STACKTRACE
+ default n
diff --git a/lib/Makefile b/lib/Makefile
index 5dc77a8..8c18345 100644
--- a/lib/Makefile
@@ -157663,7 +157646,7 @@ index 89cec42..673413a 100644
return 0;
}
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index 8de138d..df7e387 100644
+index f2531ad..5792672 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -496,7 +496,7 @@ out:
@@ -158872,7 +158855,7 @@ index b7de71f..808387d 100644
return err;
diff --git a/net/core/dev.c b/net/core/dev.c
-index ea63120..7fbab94 100644
+index 44b3ba4..34822e6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1768,7 +1768,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -158893,7 +158876,7 @@ index ea63120..7fbab94 100644
return NULL;
}
-@@ -3425,7 +3425,7 @@ recursion_alert:
+@@ -3426,7 +3426,7 @@ recursion_alert:
rc = -ENETDOWN;
rcu_read_unlock_bh();
@@ -158902,7 +158885,7 @@ index ea63120..7fbab94 100644
kfree_skb_list(skb);
return rc;
out:
-@@ -3778,7 +3778,7 @@ drop:
+@@ -3779,7 +3779,7 @@ drop:
local_irq_restore(flags);
@@ -158911,7 +158894,7 @@ index ea63120..7fbab94 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -3855,7 +3855,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -3856,7 +3856,7 @@ int netif_rx_ni(struct sk_buff *skb)
}
EXPORT_SYMBOL(netif_rx_ni);
@@ -158920,7 +158903,7 @@ index ea63120..7fbab94 100644
{
struct softnet_data *sd = this_cpu_ptr(&softnet_data);
-@@ -4218,9 +4218,9 @@ ncls:
+@@ -4219,9 +4219,9 @@ ncls:
} else {
drop:
if (!deliver_exact)
@@ -158932,7 +158915,7 @@ index ea63120..7fbab94 100644
kfree_skb(skb);
/* Jamal, now you will not able to escape explaining
* me how you were going to use this. :-)
-@@ -5187,7 +5187,7 @@ out_unlock:
+@@ -5189,7 +5189,7 @@ out_unlock:
return work;
}
@@ -158941,7 +158924,7 @@ index ea63120..7fbab94 100644
{
struct softnet_data *sd = this_cpu_ptr(&softnet_data);
unsigned long time_limit = jiffies + 2;
-@@ -7520,9 +7520,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -7532,9 +7532,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
@@ -158954,7 +158937,7 @@ index ea63120..7fbab94 100644
return storage;
}
EXPORT_SYMBOL(dev_get_stats);
-@@ -8144,7 +8144,7 @@ static void __net_exit netdev_exit(struct net *net)
+@@ -8156,7 +8156,7 @@ static void __net_exit netdev_exit(struct net *net)
kfree(net->dev_index_head);
}
@@ -158963,7 +158946,7 @@ index ea63120..7fbab94 100644
.init = netdev_init,
.exit = netdev_exit,
};
-@@ -8244,7 +8244,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+@@ -8256,7 +8256,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
rtnl_unlock();
}
@@ -159305,10 +159288,10 @@ index 53599bd..cbd0b29 100644
iph->ttl = 64;
iph->protocol = IPPROTO_UDP;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
-index bbd118b..c1c33449 100644
+index 306b8f0..0214187 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
-@@ -3865,7 +3865,7 @@ static int __net_init pg_net_init(struct net *net)
+@@ -3867,7 +3867,7 @@ static int __net_init pg_net_init(struct net *net)
pn->net = net;
INIT_LIST_HEAD(&pn->pktgen_threads);
pn->pktgen_exiting = false;
@@ -160069,7 +160052,7 @@ index cb7176c..afd2c62 100644
return NULL;
}
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 55513e6..87546f8 100644
+index eebbc0f..59069ff 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1445,7 +1445,7 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
@@ -160469,10 +160452,10 @@ index d6feabb..9cb3988 100644
ICMP_PROT_UNREACH, 0);
}
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index 71a52f4d..2bab905 100644
+index 11ef96e..6901706 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
-@@ -1325,7 +1325,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+@@ -1326,7 +1326,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
len = min_t(unsigned int, len, opt->optlen);
if (put_user(len, optlen))
return -EFAULT;
@@ -160482,7 +160465,7 @@ index 71a52f4d..2bab905 100644
return -EFAULT;
return 0;
}
-@@ -1461,7 +1462,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+@@ -1462,7 +1463,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
if (sk->sk_type != SOCK_STREAM)
return -ENOPROTOOPT;
@@ -160997,7 +160980,7 @@ index 62c3ed0..a3694bf 100644
ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
if (!ip_tstamps)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
-index 1cb67de..2acf1f0 100644
+index 80bc36b..d70d622 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -66,7 +66,7 @@ static int ipv4_local_port_range(struct ctl_table *table, int write,
@@ -161312,7 +161295,7 @@ index f712b41..b651403 100644
syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
/* Has it gone just too far? */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 5fdcb8d..e9d917f 100644
+index c0d71e7..f4b404a3 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -87,6 +87,7 @@
@@ -161535,7 +161518,7 @@ index 542074c..648df74 100644
sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 2f1f5d4..b8eadc4 100644
+index f5432d6..42b4ef0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -179,7 +179,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
@@ -161807,7 +161790,7 @@ index edc3daa..c951634 100644
.maxtype = IFLA_GRE_MAX,
.policy = ip6gre_policy,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 888543d..bcc126c 100644
+index 41489f3..62a4ed4 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -80,7 +80,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
@@ -161819,7 +161802,7 @@ index 888543d..bcc126c 100644
static int ip6_tnl_net_id __read_mostly;
struct ip6_tnl_net {
-@@ -1994,7 +1994,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
+@@ -1997,7 +1997,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
[IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 },
};
@@ -162200,10 +162183,10 @@ index 2160d5d..6816c42 100644
return -ENOMEM;
}
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 269218a..3b9358f 100644
+index 23153ac..08b47f9 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
-@@ -3571,7 +3571,7 @@ struct ctl_table ipv6_route_table_template[] = {
+@@ -3573,7 +3573,7 @@ struct ctl_table ipv6_route_table_template[] = {
struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
{
@@ -162248,7 +162231,7 @@ index 69c50e7..ec875fa 100644
struct ctl_table *ipv6_icmp_table;
int err;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 94f4f89..74404a9 100644
+index fc67822..e20c9c3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -101,6 +101,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -162262,7 +162245,7 @@ index 94f4f89..74404a9 100644
static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
{
return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
-@@ -1289,6 +1293,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1299,6 +1303,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
return 0;
reset:
@@ -162272,7 +162255,7 @@ index 94f4f89..74404a9 100644
tcp_v6_send_reset(sk, skb);
discard:
if (opt_skb)
-@@ -1401,12 +1408,20 @@ lookup:
+@@ -1403,12 +1410,20 @@ lookup:
sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
th->source, th->dest, inet6_iif(skb),
&refcounted);
@@ -162295,7 +162278,7 @@ index 94f4f89..74404a9 100644
if (sk->sk_state == TCP_NEW_SYN_RECV) {
struct request_sock *req = inet_reqsk(sk);
-@@ -1496,6 +1511,10 @@ csum_error:
+@@ -1498,6 +1513,10 @@ csum_error:
bad_packet:
__TCP_INC_STATS(net, TCP_MIB_INERRS);
} else {
@@ -162307,7 +162290,7 @@ index 94f4f89..74404a9 100644
}
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 19ac3a1..6b586db 100644
+index c2a8656..cef76e9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -78,6 +78,10 @@ static u32 udp6_ehashfn(const struct net *net,
@@ -162330,7 +162313,7 @@ index 19ac3a1..6b586db 100644
if (is_udp4)
UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS,
is_udplite);
-@@ -646,7 +650,7 @@ csum_error:
+@@ -647,7 +651,7 @@ csum_error:
__UDP6_INC_STATS(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
drop:
__UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -162339,7 +162322,7 @@ index 19ac3a1..6b586db 100644
kfree_skb(skb);
return -1;
}
-@@ -727,7 +731,7 @@ start_lookup:
+@@ -728,7 +732,7 @@ start_lookup:
}
nskb = skb_clone(skb, GFP_ATOMIC);
if (unlikely(!nskb)) {
@@ -162348,7 +162331,7 @@ index 19ac3a1..6b586db 100644
__UDP6_INC_STATS(net, UDP_MIB_RCVBUFERRORS,
IS_UDPLITE(sk));
__UDP6_INC_STATS(net, UDP_MIB_INERRORS,
-@@ -845,6 +849,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -846,6 +850,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
goto csum_error;
__UDP6_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -164708,7 +164691,7 @@ index 11de55e..f25e448 100644
return 0;
}
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 627f898c..32d06cc 100644
+index 62bea45..94c8501 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -287,7 +287,7 @@ static void netlink_overrun(struct sock *sk)
@@ -164735,7 +164718,7 @@ index 627f898c..32d06cc 100644
}
static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
-@@ -2150,7 +2151,9 @@ errout_skb:
+@@ -2151,7 +2152,9 @@ errout_skb:
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
const struct nlmsghdr *nlh,
@@ -164746,7 +164729,7 @@ index 627f898c..32d06cc 100644
{
struct netlink_callback *cb;
struct sock *sk;
-@@ -2173,7 +2176,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
+@@ -2174,7 +2177,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
goto error_unlock;
}
/* add reference of module which cb->dump belongs to */
@@ -164755,7 +164738,7 @@ index 627f898c..32d06cc 100644
ret = -EPROTONOSUPPORT;
goto error_unlock;
}
-@@ -2184,8 +2187,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
+@@ -2185,8 +2188,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
cb->dump = control->dump;
cb->done = control->done;
cb->nlh = nlh;
@@ -164766,7 +164749,7 @@ index 627f898c..32d06cc 100644
cb->min_dump_alloc = control->min_dump_alloc;
cb->skb = skb;
-@@ -2452,7 +2455,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
+@@ -2453,7 +2456,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
sk_wmem_alloc_get(s),
nlk->cb_running,
atomic_read(&s->sk_refcnt),
@@ -164775,7 +164758,7 @@ index 627f898c..32d06cc 100644
sock_i_ino(s)
);
-@@ -2559,7 +2562,7 @@ static void __init netlink_add_usersock_entry(void)
+@@ -2560,7 +2563,7 @@ static void __init netlink_add_usersock_entry(void)
netlink_table_ungrab();
}
@@ -164948,19 +164931,19 @@ index 7eb955e..479c9a6 100644
static int __init ovs_vxlan_tnl_init(void)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 33a4697..c3f149fb 100644
+index d2238b2..7123b3f 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
-@@ -279,7 +279,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
+@@ -278,7 +278,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
return ret;
drop:
- atomic_long_inc(&dev->tx_dropped);
+ atomic_long_inc_unchecked(&dev->tx_dropped);
- kfree_skb(skb);
+ kfree_skb_list(skb);
return NET_XMIT_DROP;
}
-@@ -1392,9 +1392,9 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
+@@ -1391,9 +1391,9 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
packet_rcv_has_room(po_next, skb) == ROOM_NORMAL) {
if (i != j)
po->rollover->sock = i;
@@ -164972,7 +164955,7 @@ index 33a4697..c3f149fb 100644
return i;
}
-@@ -1402,7 +1402,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
+@@ -1401,7 +1401,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,
i = 0;
} while (i != j);
@@ -164981,7 +164964,7 @@ index 33a4697..c3f149fb 100644
return idx;
}
-@@ -1653,9 +1653,9 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+@@ -1652,9 +1652,9 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
po->rollover = kzalloc(sizeof(*po->rollover), GFP_KERNEL);
if (!po->rollover)
return -ENOMEM;
@@ -164994,7 +164977,7 @@ index 33a4697..c3f149fb 100644
}
mutex_lock(&fanout_mutex);
-@@ -2107,7 +2107,7 @@ drop_n_acct:
+@@ -2106,7 +2106,7 @@ drop_n_acct:
is_drop_n_account = true;
spin_lock(&sk->sk_receive_queue.lock);
po->stats.stats1.tp_drops++;
@@ -165003,7 +164986,7 @@ index 33a4697..c3f149fb 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -3842,7 +3842,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3841,7 +3841,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -165012,7 +164995,7 @@ index 33a4697..c3f149fb 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3877,9 +3877,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3876,9 +3876,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_ROLLOVER_STATS:
if (!po->rollover)
return -EINVAL;
@@ -165025,7 +165008,7 @@ index 33a4697..c3f149fb 100644
data = &rstats;
lv = sizeof(rstats);
break;
-@@ -3897,7 +3897,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3896,7 +3896,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
len = lv;
if (put_user(len, optlen))
return -EFAULT;
@@ -165675,7 +165658,7 @@ index 12d4519..367dae4 100644
NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
};
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 8ed2d99..ac059f5 100644
+index baccbf3..aed4ec2 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2199,11 +2199,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
@@ -165699,7 +165682,7 @@ index 8ed2d99..ac059f5 100644
{
+ struct sctp_event_subscribe subscribe;
+
- if (len <= 0)
+ if (len == 0)
return -EINVAL;
if (len > sizeof(struct sctp_event_subscribe))
len = sizeof(struct sctp_event_subscribe);
@@ -169524,10 +169507,10 @@ index 0000000..7514850
+fi
diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c
new file mode 100644
-index 0000000..0c0cf81
+index 0000000..bdd5d64
--- /dev/null
+++ b/scripts/gcc-plugins/initify_plugin.c
-@@ -0,0 +1,1804 @@
+@@ -0,0 +1,1811 @@
+/*
+ * Copyright 2015-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2
@@ -169577,7 +169560,7 @@ index 0000000..0c0cf81
+__visible int plugin_is_GPL_compatible;
+
+static struct plugin_info initify_plugin_info = {
-+ .version = "20160929",
++ .version = "20161115",
+ .help = "disable\tturn off the initify plugin\n"
+ "verbose\tprint all initified strings and all"
+ " functions which should be __init/__exit\n"
@@ -170474,7 +170457,7 @@ index 0000000..0c0cf81
+ if (is_gimple_debug(use_stmt))
+ continue;
+
-+ if (pointer_set_contains(visited_defs, use_stmt))
++ if (pointer_set_insert(visited_defs, use_stmt))
+ continue;
+
+ switch (gimple_code(use_stmt)) {
@@ -170499,9 +170482,12 @@ index 0000000..0c0cf81
+ gassign *assign = as_a_gassign(use_stmt);
+ const_tree rhs = gimple_assign_rhs1(assign);
+
++ if (TREE_CODE(rhs) == INDIRECT_REF)
++ return;
++#if BUILDING_GCC_VERSION >= 4006
+ if (TREE_CODE(rhs) == MEM_REF)
+ return;
-+
++#endif
+ if (is_cast_to_integer_type(assign))
+ return;
+
@@ -170586,8 +170572,12 @@ index 0000000..0c0cf81
+ tree lhs;
+ const_tree rhs = gimple_assign_rhs1(stmt);
+
++ if (TREE_CODE(rhs) == INDIRECT_REF)
++ break;
++#if BUILDING_GCC_VERSION >= 4006
+ if (TREE_CODE(rhs) == MEM_REF)
+ break;
++#endif
+
+ lhs = gimple_assign_lhs(stmt);
+ if (lhs_is_a_nocapture_parm_decl(lhs))
@@ -217288,10 +217278,10 @@ index b3775a9..be6b9f9 100755
# Find all available archs
find_all_archs()
diff --git a/security/Kconfig b/security/Kconfig
-index 118f454..d1818a1 100644
+index 118f454..5c61f40 100644
--- a/security/Kconfig
+++ b/security/Kconfig
-@@ -4,6 +4,1066 @@
+@@ -4,6 +4,1065 @@
menu "Security options"
@@ -218273,7 +218263,6 @@ index 118f454..d1818a1 100644
+config PAX_INITIFY
+ bool "Free more kernel memory after init"
+ depends on GCC_PLUGINS
-+ depends on BROKEN
+ help
+ The kernel has a mechanism to free up code and data memory that is
+ only used during kernel or module initialization. Enabling this
@@ -218358,7 +218347,7 @@ index 118f454..d1818a1 100644
source security/keys/Kconfig
config SECURITY_DMESG_RESTRICT
-@@ -104,7 +1164,7 @@ config INTEL_TXT
+@@ -104,7 +1163,7 @@ config INTEL_TXT
config LSM_MMAP_MIN_ADDR
int "Low address space for LSM to protect from user allocation"
depends on SECURITY && SECURITY_SELINUX
@@ -218367,7 +218356,7 @@ index 118f454..d1818a1 100644
default 65536
help
This is the portion of low virtual memory which should be protected
-@@ -118,13 +1178,6 @@ config LSM_MMAP_MIN_ADDR
+@@ -118,13 +1177,6 @@ config LSM_MMAP_MIN_ADDR
this low address space will need the permission specific to the
systems running LSM.
@@ -218381,7 +218370,7 @@ index 118f454..d1818a1 100644
config HAVE_ARCH_HARDENED_USERCOPY
bool
help
-@@ -134,23 +1187,14 @@ config HAVE_ARCH_HARDENED_USERCOPY
+@@ -134,23 +1186,14 @@ config HAVE_ARCH_HARDENED_USERCOPY
copy_to_user() and copy_from_user().
config HARDENED_USERCOPY
@@ -218408,7 +218397,7 @@ index 118f454..d1818a1 100644
help
When a multi-page allocation is done without __GFP_COMP,
hardened usercopy will reject attempts to copy it. There are,
-@@ -205,4 +1249,3 @@ config DEFAULT_SECURITY
+@@ -205,4 +1248,3 @@ config DEFAULT_SECURITY
default "" if DEFAULT_SECURITY_DAC
endmenu
diff --git a/4.8.7/4425_grsec_remove_EI_PAX.patch b/4.8.8/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.8.7/4425_grsec_remove_EI_PAX.patch
+++ b/4.8.8/4425_grsec_remove_EI_PAX.patch
diff --git a/4.8.7/4427_force_XATTR_PAX_tmpfs.patch b/4.8.8/4427_force_XATTR_PAX_tmpfs.patch
index 2562d2f..2562d2f 100644
--- a/4.8.7/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.8.8/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.8.7/4430_grsec-remove-localversion-grsec.patch b/4.8.8/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.8.7/4430_grsec-remove-localversion-grsec.patch
+++ b/4.8.8/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.8.7/4435_grsec-mute-warnings.patch b/4.8.8/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.8.7/4435_grsec-mute-warnings.patch
+++ b/4.8.8/4435_grsec-mute-warnings.patch
diff --git a/4.8.7/4440_grsec-remove-protected-paths.patch b/4.8.8/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.8.7/4440_grsec-remove-protected-paths.patch
+++ b/4.8.8/4440_grsec-remove-protected-paths.patch
diff --git a/4.8.7/4450_grsec-kconfig-default-gids.patch b/4.8.8/4450_grsec-kconfig-default-gids.patch
index 6fd0511..6fd0511 100644
--- a/4.8.7/4450_grsec-kconfig-default-gids.patch
+++ b/4.8.8/4450_grsec-kconfig-default-gids.patch
diff --git a/4.8.7/4465_selinux-avc_audit-log-curr_ip.patch b/4.8.8/4465_selinux-avc_audit-log-curr_ip.patch
index 7248385..7248385 100644
--- a/4.8.7/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.8.8/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.8.7/4470_disable-compat_vdso.patch b/4.8.8/4470_disable-compat_vdso.patch
index 1e4b84a..1e4b84a 100644
--- a/4.8.7/4470_disable-compat_vdso.patch
+++ b/4.8.8/4470_disable-compat_vdso.patch
diff --git a/4.8.7/4475_emutramp_default_on.patch b/4.8.8/4475_emutramp_default_on.patch
index 7b468ee..7b468ee 100644
--- a/4.8.7/4475_emutramp_default_on.patch
+++ b/4.8.8/4475_emutramp_default_on.patch