diff options
| -rw-r--r-- | 0000_README | 8 | ||||
| -rw-r--r-- | 1121_linux-4.4.122.patch | 2177 | ||||
| -rw-r--r-- | 1122_linux-4.4.123.patch | 3500 |
3 files changed, 5685 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 617be600..992f3531 100644 --- a/0000_README +++ b/0000_README @@ -527,6 +527,14 @@ Patch: 1120_linux-4.4.121.patch From: http://www.kernel.org Desc: Linux 4.4.121 +Patch: 1121_linux-4.4.122.patch +From: http://www.kernel.org +Desc: Linux 4.4.122 + +Patch: 1122_linux-4.4.123.patch +From: http://www.kernel.org +Desc: Linux 4.4.123 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1121_linux-4.4.122.patch b/1121_linux-4.4.122.patch new file mode 100644 index 00000000..1488cb1c --- /dev/null +++ b/1121_linux-4.4.122.patch @@ -0,0 +1,2177 @@ +diff --git a/Makefile b/Makefile +index 0e22e4eb85cc..3eb21d269b42 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 121 ++SUBLEVEL = 122 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 5562c5feb0be..80f6c786a37e 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -90,8 +90,6 @@ + }; + + &i2c1 { +- pinctrl-names = "default"; +- pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -148,12 +146,6 @@ + OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */ + >; + }; +- i2c1_pins: pinmux_i2c1_pins { +- pinctrl-single,pins = < +- OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ +- OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ +- >; +- }; + }; + + #include "twl4030.dtsi" +diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c +index 9ff92050053c..fa7f308c9027 100644 +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,7 @@ phys_addr_t omap_secure_ram_mempool_base(void) + return omap_secure_memblock_base; + } + ++#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM) + u32 omap3_save_secure_ram(void __iomem *addr, int size) + { + u32 ret; +@@ -91,6 +92,7 @@ u32 omap3_save_secure_ram(void __iomem *addr, int size) + + return ret; + } ++#endif + + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls +diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c +index 9ab48ff80c1c..6d11ae581ea7 100644 +--- a/arch/mips/ath25/board.c ++++ b/arch/mips/ath25/board.c +@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t base, unsigned long size) + } + + board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL); ++ if (!board_data) ++ goto error; + ath25_board.config = (struct ath25_boarddata *)board_data; + memcpy_fromio(board_data, bcfg, 0x100); + if (broken_boarddata) { +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index 4f9eb0576884..10d0b2140375 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -2246,6 +2246,8 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + } + + host_data = kzalloc(sizeof(*host_data), GFP_KERNEL); ++ if (!host_data) ++ return -ENOMEM; + raw_spin_lock_init(&host_data->lock); + + addr = of_get_address(ciu_node, 0, NULL, NULL); +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 78cf8c2f1de0..4874712b475e 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -166,11 +166,11 @@ static void bmips_prepare_cpus(unsigned int max_cpus) + return; + } + +- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi0", NULL)) ++ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL)) + panic("Can't request IPI0 interrupt"); +- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi1", NULL)) ++ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL)) + panic("Can't request IPI1 interrupt"); + } + +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 364fbad72e60..6edb9530d7e9 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -60,6 +60,9 @@ static DEFINE_MUTEX(mce_chrdev_read_mutex); + smp_load_acquire(&(p)); \ + }) + ++/* sysfs synchronization */ ++static DEFINE_MUTEX(mce_sysfs_mutex); ++ + #define CREATE_TRACE_POINTS + #include <trace/events/mce.h> + +@@ -2220,6 +2223,7 @@ static ssize_t set_ignore_ce(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.ignore_ce ^ !!new) { + if (new) { + /* disable ce features */ +@@ -2232,6 +2236,8 @@ static ssize_t set_ignore_ce(struct device *s, + on_each_cpu(mce_enable_ce, (void *)1, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2244,6 +2250,7 @@ static ssize_t set_cmci_disabled(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.cmci_disabled ^ !!new) { + if (new) { + /* disable cmci */ +@@ -2255,6 +2262,8 @@ static ssize_t set_cmci_disabled(struct device *s, + on_each_cpu(mce_enable_ce, NULL, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2262,8 +2271,19 @@ static ssize_t store_int_with_restart(struct device *s, + struct device_attribute *attr, + const char *buf, size_t size) + { +- ssize_t ret = device_store_int(s, attr, buf, size); ++ unsigned long old_check_interval = check_interval; ++ ssize_t ret = device_store_ulong(s, attr, buf, size); ++ ++ if (check_interval == old_check_interval) ++ return ret; ++ ++ if (check_interval < 1) ++ check_interval = 1; ++ ++ mutex_lock(&mce_sysfs_mutex); + mce_restart(); ++ mutex_unlock(&mce_sysfs_mutex); ++ + return ret; + } + +diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c +index 819ab3f9c9c7..ca6e65250b1a 100644 +--- a/arch/x86/kernel/machine_kexec_64.c ++++ b/arch/x86/kernel/machine_kexec_64.c +@@ -519,6 +519,7 @@ int arch_kexec_apply_relocations_add(const Elf64_Ehdr *ehdr, + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + value -= (u64)address; + *(u32 *)location = value; + break; +diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c +index 005c03e93fc5..94779f66bf49 100644 +--- a/arch/x86/kernel/module.c ++++ b/arch/x86/kernel/module.c +@@ -170,19 +170,28 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + case R_X86_64_NONE: + break; + case R_X86_64_64: ++ if (*(u64 *)loc != 0) ++ goto invalid_relocation; + *(u64 *)loc = val; + break; + case R_X86_64_32: ++ if (*(u32 *)loc != 0) ++ goto invalid_relocation; + *(u32 *)loc = val; + if (val != *(u32 *)loc) + goto overflow; + break; + case R_X86_64_32S: ++ if (*(s32 *)loc != 0) ++ goto invalid_relocation; + *(s32 *)loc = val; + if ((s64)val != *(s32 *)loc) + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: ++ if (*(u32 *)loc != 0) ++ goto invalid_relocation; + val -= (u64)loc; + *(u32 *)loc = val; + #if 0 +@@ -198,6 +207,11 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + } + return 0; + ++invalid_relocation: ++ pr_err("x86/modules: Skipping invalid relocation target, existing value is nonzero for type %d, loc %p, val %Lx\n", ++ (int)ELF64_R_TYPE(rel[i].r_info), loc, val); ++ return -ENOEXEC; ++ + overflow: + pr_err("overflow in relocation type %d val %Lx\n", + (int)ELF64_R_TYPE(rel[i].r_info), val); +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index 73eb7fd4aec4..5b6c8486a0be 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -769,9 +769,12 @@ static int do_reloc64(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym, + break; + + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + /* + * PC relative relocations don't need to be adjusted unless + * referencing a percpu symbol. ++ * ++ * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32. + */ + if (is_percpu_sym(sym, symname)) + add_reloc(&relocs32neg, offset); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 1c36de9719e5..3e65ae144fde 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -263,7 +263,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos) + struct iov_iter i; + ssize_t bw; + +- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len); ++ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len); + + file_start_write(file); + bw = vfs_iter_write(file, &i, ppos); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index a142d5ae148d..5c40d6d710af 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -585,6 +585,9 @@ int amdgpu_acpi_pcie_performance_request(struct amdgpu_device *adev, + size_t size; + u32 retry = 3; + ++ if (amdgpu_acpi_pcie_notify_device_ready(adev)) ++ return -EINVAL; ++ + /* Get the device handle */ + handle = ACPI_HANDLE(&adev->pdev->dev); + if (!handle) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 930083336968..6470c9aa1351 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -739,9 +739,11 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder); +@@ -760,8 +762,12 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + amdgpu_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -862,9 +868,11 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = amdgpu_connector_best_single_encoder(connector); + if (!encoder) +@@ -918,8 +926,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + amdgpu_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -981,9 +991,11 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1108,8 +1120,10 @@ out: + amdgpu_connector_update_scratch_regs(connector, ret); + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1351,9 +1365,11 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector); + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1421,8 +1437,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + + amdgpu_connector_update_scratch_regs(connector, ret); + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index b57fffc2d4af..0a91261b6f5b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -2104,34 +2104,8 @@ static void gfx_v7_0_gpu_init(struct amdgpu_device *adev) + case CHIP_KAVERI: + adev->gfx.config.max_shader_engines = 1; + adev->gfx.config.max_tile_pipes = 4; +- if ((adev->pdev->device == 0x1304) || +- (adev->pdev->device == 0x1305) || +- (adev->pdev->device == 0x130C) || +- (adev->pdev->device == 0x130F) || +- (adev->pdev->device == 0x1310) || +- (adev->pdev->device == 0x1311) || +- (adev->pdev->device == 0x131C)) { +- adev->gfx.config.max_cu_per_sh = 8; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1309) || +- (adev->pdev->device == 0x130A) || +- (adev->pdev->device == 0x130D) || +- (adev->pdev->device == 0x1313) || +- (adev->pdev->device == 0x131D)) { +- adev->gfx.config.max_cu_per_sh = 6; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1306) || +- (adev->pdev->device == 0x1307) || +- (adev->pdev->device == 0x130B) || +- (adev->pdev->device == 0x130E) || +- (adev->pdev->device == 0x1315) || +- (adev->pdev->device == 0x131B)) { +- adev->gfx.config.max_cu_per_sh = 4; +- adev->gfx.config.max_backends_per_se = 1; +- } else { +- adev->gfx.config.max_cu_per_sh = 3; +- adev->gfx.config.max_backends_per_se = 1; +- } ++ adev->gfx.config.max_cu_per_sh = 8; ++ adev->gfx.config.max_backends_per_se = 2; + adev->gfx.config.max_sh_per_se = 1; + adev->gfx.config.max_texture_channel_caches = 4; + adev->gfx.config.max_gprs = 256; +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index f8b5fcfa91a2..1fe4b8e6596b 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -411,6 +411,26 @@ out: + schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD); + } + ++/** ++ * drm_kms_helper_is_poll_worker - is %current task an output poll worker? ++ * ++ * Determine if %current task is an output poll worker. This can be used ++ * to select distinct code paths for output polling versus other contexts. ++ * ++ * One use case is to avoid a deadlock between the output poll worker and ++ * the autosuspend worker wherein the latter waits for polling to finish ++ * upon calling drm_kms_helper_poll_disable(), while the former waits for ++ * runtime suspend to finish upon calling pm_runtime_get_sync() in a ++ * connector ->detect hook. ++ */ ++bool drm_kms_helper_is_poll_worker(void) ++{ ++ struct work_struct *work = current_work(); ++ ++ return work && work->func == output_poll_execute; ++} ++EXPORT_SYMBOL(drm_kms_helper_is_poll_worker); ++ + /** + * drm_kms_helper_poll_disable - disable output polling + * @dev: drm_device +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 2a5ed7460354..ababdaabe870 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -253,9 +253,15 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + nv_connector->edid = NULL; + } + +- ret = pm_runtime_get_sync(connector->dev->dev); +- if (ret < 0 && ret != -EACCES) +- return conn_status; ++ /* Outputs are only polled while runtime active, so acquiring a ++ * runtime PM ref here is unnecessary (and would deadlock upon ++ * runtime suspend because it waits for polling to finish). ++ */ ++ if (!drm_kms_helper_is_poll_worker()) { ++ ret = pm_runtime_get_sync(connector->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return conn_status; ++ } + + nv_encoder = nouveau_connector_ddc_detect(connector); + if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) { +@@ -323,8 +329,10 @@ detect_analog: + + out: + +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return conn_status; + } +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 134874cab4c7..80b6d6e4721a 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -3599,35 +3599,8 @@ static void cik_gpu_init(struct radeon_device *rdev) + case CHIP_KAVERI: + rdev->config.cik.max_shader_engines = 1; + rdev->config.cik.max_tile_pipes = 4; +- if ((rdev->pdev->device == 0x1304) || +- (rdev->pdev->device == 0x1305) || +- (rdev->pdev->device == 0x130C) || +- (rdev->pdev->device == 0x130F) || +- (rdev->pdev->device == 0x1310) || +- (rdev->pdev->device == 0x1311) || +- (rdev->pdev->device == 0x131C)) { +- rdev->config.cik.max_cu_per_sh = 8; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1309) || +- (rdev->pdev->device == 0x130A) || +- (rdev->pdev->device == 0x130D) || +- (rdev->pdev->device == 0x1313) || +- (rdev->pdev->device == 0x131D)) { +- rdev->config.cik.max_cu_per_sh = 6; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1306) || +- (rdev->pdev->device == 0x1307) || +- (rdev->pdev->device == 0x130B) || +- (rdev->pdev->device == 0x130E) || +- (rdev->pdev->device == 0x1315) || +- (rdev->pdev->device == 0x1318) || +- (rdev->pdev->device == 0x131B)) { +- rdev->config.cik.max_cu_per_sh = 4; +- rdev->config.cik.max_backends_per_se = 1; +- } else { +- rdev->config.cik.max_cu_per_sh = 3; +- rdev->config.cik.max_backends_per_se = 1; +- } ++ rdev->config.cik.max_cu_per_sh = 8; ++ rdev->config.cik.max_backends_per_se = 2; + rdev->config.cik.max_sh_per_se = 1; + rdev->config.cik.max_texture_channel_caches = 4; + rdev->config.cik.max_gprs = 256; +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 30f00748ed37..3feaab94f358 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -891,9 +891,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +@@ -916,8 +918,12 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1020,9 +1026,11 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1089,8 +1097,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + radeon_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1153,9 +1163,11 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (!radeon_connector->dac_load_detect) + return ret; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1167,8 +1179,12 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (ret == connector_status_connected) + ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false); + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1230,9 +1246,11 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (radeon_connector->detected_hpd_without_ddc) { + force = true; +@@ -1415,8 +1433,10 @@ out: + } + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1666,9 +1686,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + if (radeon_dig_connector->is_mst) + return connector_status_disconnected; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && radeon_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1755,8 +1777,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + } + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 886f61ea6cc7..cdac2c9421ab 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1138,6 +1138,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (cmd.qp_state > IB_QPS_ERR) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -1274,6 +1277,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) ++ return -EINVAL; ++ + optval = memdup_user((void __user *) (unsigned long) cmd.optval, + cmd.optlen); + if (IS_ERR(optval)) { +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 02c8deab1fff..4a4ab433062f 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -972,7 +972,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, + if (ucmd.reserved0 || ucmd.reserved1) + return -EINVAL; + +- umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size, ++ /* check multiplication overflow */ ++ if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1) ++ return -EINVAL; ++ ++ umem = ib_umem_get(context, ucmd.buf_addr, ++ (size_t)ucmd.cqe_size * entries, + IB_ACCESS_LOCAL_WRITE, 1); + if (IS_ERR(umem)) { + err = PTR_ERR(umem); +diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c +index 7f12b6579f82..795fa353de7c 100644 +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -216,8 +216,10 @@ static void matrix_keypad_stop(struct input_dev *dev) + { + struct matrix_keypad *keypad = input_get_drvdata(dev); + ++ spin_lock_irq(&keypad->lock); + keypad->stopped = true; +- mb(); ++ spin_unlock_irq(&keypad->lock); ++ + flush_work(&keypad->work.work); + /* + * matrix_keypad_scan() will leave IRQs enabled; +diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c +index 3048ef3e3e16..a5e8998047fe 100644 +--- a/drivers/input/keyboard/tca8418_keypad.c ++++ b/drivers/input/keyboard/tca8418_keypad.c +@@ -189,8 +189,6 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) + input_event(input, EV_MSC, MSC_SCAN, code); + input_report_key(input, keymap[code], state); + +- /* Read for next loop */ +- error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); + } while (1); + + input_sync(input); +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 8eaadd9869bc..be8307550bd7 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -935,6 +935,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; + char buf[BDEVNAME_SIZE]; ++ struct cached_dev *exist_dc, *t; + + bdevname(dc->bdev, buf); + +@@ -958,6 +959,16 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + return -EINVAL; + } + ++ /* Check whether already attached */ ++ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) { ++ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) { ++ pr_err("Tried to attach %s but duplicate UUID already attached", ++ buf); ++ ++ return -EINVAL; ++ } ++ } ++ + u = uuid_find(c, dc->sb.uuid); + + if (u && +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index ea2777e1ee10..bc630a719776 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -226,7 +226,7 @@ static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val) + static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg, + u8 mask, u8 val) + { +- i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); ++ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1); + } + + static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg) +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 3ea4c022cbb9..ccdb3dd74421 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -265,6 +265,12 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) + vol->last_eb_bytes = vol->usable_leb_size; + } + ++ /* Make volume "available" before it becomes accessible via sysfs */ ++ spin_lock(&ubi->volumes_lock); ++ ubi->volumes[vol_id] = vol; ++ ubi->vol_count += 1; ++ spin_unlock(&ubi->volumes_lock); ++ + /* Register character device for the volume */ + cdev_init(&vol->cdev, &ubi_vol_cdev_operations); + vol->cdev.owner = THIS_MODULE; +@@ -304,11 +310,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) + if (err) + goto out_sysfs; + +- spin_lock(&ubi->volumes_lock); +- ubi->volumes[vol_id] = vol; +- ubi->vol_count += 1; +- spin_unlock(&ubi->volumes_lock); +- + ubi_volume_notify(ubi, vol, UBI_VOLUME_ADDED); + self_check_volumes(ubi); + return err; +@@ -328,6 +329,10 @@ out_sysfs: + out_cdev: + cdev_del(&vol->cdev); + out_mapping: ++ spin_lock(&ubi->volumes_lock); ++ ubi->volumes[vol_id] = NULL; ++ ubi->vol_count -= 1; ++ spin_unlock(&ubi->volumes_lock); + if (do_free) + kfree(vol->eba_tbl); + out_acc: +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index e197c6f39de2..aa18c729d23a 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -365,6 +365,7 @@ qla24xx_abort_sp_done(void *data, void *ptr, int res) + srb_t *sp = (srb_t *)ptr; + struct srb_iocb *abt = &sp->u.iocb_cmd; + ++ del_timer(&sp->u.iocb_cmd.timer); + complete(&abt->u.abt.comp); + } + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index e6faa0b050d1..824e27eec7a1 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -5502,7 +5502,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha, + fc_port_t *fcport; + int rc; + +- fcport = kzalloc(sizeof(*fcport), GFP_KERNEL); ++ fcport = qla2x00_alloc_fcport(vha, GFP_KERNEL); + if (!fcport) { + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf06f, + "qla_target(%d): Allocation of tmp FC port failed", +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index ec31b53ae3a5..f5b5bec6f3c1 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -330,24 +330,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) + mutex_lock(&ashmem_mutex); + + if (asma->size == 0) { +- ret = -EINVAL; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EINVAL; + } + + if (!asma->file) { +- ret = -EBADF; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EBADF; + } + ++ mutex_unlock(&ashmem_mutex); ++ + ret = vfs_llseek(asma->file, offset, origin); + if (ret < 0) +- goto out; ++ return ret; + + /** Copy f_pos from backing file, since f_ops->llseek() sets it */ + file->f_pos = asma->file->f_pos; +- +-out: +- mutex_unlock(&ashmem_mutex); + return ret; + } + +diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c +index b63dd2ef78b5..1f398d06f4ee 100644 +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -484,8 +484,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s, + struct comedi_cmd *cmd = &async->cmd; + + if (cmd->stop_src == TRIG_COUNT) { +- unsigned int nscans = nsamples / cmd->scan_end_arg; +- unsigned int scans_left = __comedi_nscans_left(s, nscans); ++ unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg); + unsigned int scan_pos = + comedi_bytes_to_samples(s, async->scan_progress); + unsigned long long samples_left = 0; +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 7025f47fa284..746c76b358a0 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -5299,6 +5299,17 @@ static struct pci_device_id serial_pci_tbl[] = { + { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ + pbn_b2_4_115200 }, ++ /* ++ * BrainBoxes UC-260 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0D21, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0E34, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, + /* + * Perle PCI-RAS cards + */ +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 53e4d5056db7..e0277cf0bf58 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1783,6 +1783,7 @@ static void atmel_get_ip_name(struct uart_port *port) + switch (version) { + case 0x302: + case 0x10213: ++ case 0x10302: + dev_dbg(port->dev, "This version is usart\n"); + atmel_port->is_usart = true; + break; +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 80d0ffe7abc1..fc7711c75b01 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -847,6 +847,8 @@ static void sci_receive_chars(struct uart_port *port) + /* Tell the rest of the system the news. New characters! */ + tty_flip_buffer_push(tport); + } else { ++ /* TTY buffers full; read from RX reg to prevent lockup */ ++ serial_port_in(port, SCxRDR); + serial_port_in(port, SCxSR); /* dummy read */ + sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port)); + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 8e641b5893ed..29adabdb305f 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -147,6 +147,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, + + ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout); + ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); ++ + kfree(dr); + + return ret; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 774c97bb1c08..4f1c6f8d4352 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -229,7 +229,8 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Corsair Strafe RGB */ +- { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, + + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 51c2b05b5dd9..7deebd0b21ae 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1333,7 +1333,6 @@ ffs_fs_kill_sb(struct super_block *sb) + if (sb->s_fs_info) { + ffs_release_dev(sb->s_fs_info); + ffs_data_closed(sb->s_fs_info); +- ffs_data_put(sb->s_fs_info); + } + } + +diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c +index ad408251d955..108dcc5f5350 100644 +--- a/drivers/usb/mon/mon_text.c ++++ b/drivers/usb/mon/mon_text.c +@@ -82,6 +82,8 @@ struct mon_reader_text { + + wait_queue_head_t wait; + int printf_size; ++ size_t printf_offset; ++ size_t printf_togo; + char *printf_buf; + struct mutex printf_lock; + +@@ -373,73 +375,103 @@ err_alloc: + return rc; + } + +-/* +- * For simplicity, we read one record in one system call and throw out +- * what does not fit. This means that the following does not work: +- * dd if=/dbg/usbmon/0t bs=10 +- * Also, we do not allow seeks and do not bother advancing the offset. +- */ ++static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp, ++ char __user * const buf, const size_t nbytes) ++{ ++ const size_t togo = min(nbytes, rp->printf_togo); ++ ++ if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo)) ++ return -EFAULT; ++ rp->printf_togo -= togo; ++ rp->printf_offset += togo; ++ return togo; ++} ++ ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_t(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; +- +- mon_text_read_head_t(rp, &ptr, ep); +- mon_text_read_statset(rp, &ptr, ep); +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); +- +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_t(rp, &ptr, ep); ++ mon_text_read_statset(rp, &ptr, ep); ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); ++ } ++ ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_u(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; + +- mon_text_read_head_u(rp, &ptr, ep); +- if (ep->type == 'E') { +- mon_text_read_statset(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { +- mon_text_read_isostat(rp, &ptr, ep); +- mon_text_read_isodesc(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { +- mon_text_read_intstat(rp, &ptr, ep); +- } else { +- mon_text_read_statset(rp, &ptr, ep); ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_u(rp, &ptr, ep); ++ if (ep->type == 'E') { ++ mon_text_read_statset(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { ++ mon_text_read_isostat(rp, &ptr, ep); ++ mon_text_read_isodesc(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { ++ mon_text_read_intstat(rp, &ptr, ep); ++ } else { ++ mon_text_read_statset(rp, &ptr, ep); ++ } ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); + } +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); + +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + + static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp, +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index de7214ae4fed..6cac8f26b97a 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1052,7 +1052,7 @@ static int uas_post_reset(struct usb_interface *intf) + return 0; + + err = uas_configure_endpoints(devinfo); +- if (err && err != ENODEV) ++ if (err && err != -ENODEV) + shost_printk(KERN_ERR, shost, + "%s: alloc streams error %d after reset", + __func__, err); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index c10eceb76c39..1a34d2a89de6 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2142,6 +2142,13 @@ UNUSUAL_DEV( 0x22b8, 0x3010, 0x0001, 0x0001, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ), + ++/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */ ++UNUSUAL_DEV( 0x152d, 0x2567, 0x0117, 0x0117, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Reported-by George Cherian <george.cherian@cavium.com> */ + UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, + "JMicron", +diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c +index 286369d4f0f5..be99112fad00 100644 +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -51,6 +51,7 @@ static char expect_release; + static unsigned long hpwdt_is_open; + + static void __iomem *pci_mem_addr; /* the PCI-memory address */ ++static unsigned long __iomem *hpwdt_nmistat; + static unsigned long __iomem *hpwdt_timer_reg; + static unsigned long __iomem *hpwdt_timer_con; + +@@ -474,6 +475,11 @@ static int hpwdt_time_left(void) + } + + #ifdef CONFIG_HPWDT_NMI_DECODING ++static int hpwdt_my_nmi(void) ++{ ++ return ioread8(hpwdt_nmistat) & 0x6; ++} ++ + /* + * NMI Handler + */ +@@ -485,6 +491,9 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs) + if (!hpwdt_nmi_decoding) + goto out; + ++ if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi()) ++ return NMI_DONE; ++ + spin_lock_irqsave(&rom_lock, rom_pl); + if (!die_nmi_called && !is_icru && !is_uefi) + asminline_call(&cmn_regs, cru_rom_addr); +@@ -700,7 +709,7 @@ static void dmi_find_icru(const struct dmi_header *dm, void *dummy) + smbios_proliant_ptr = (struct smbios_proliant_info *) dm; + if (smbios_proliant_ptr->misc_features & 0x01) + is_icru = 1; +- if (smbios_proliant_ptr->misc_features & 0x408) ++ if (smbios_proliant_ptr->misc_features & 0x1400) + is_uefi = 1; + } + } +@@ -840,6 +849,7 @@ static int hpwdt_init_one(struct pci_dev *dev, + retval = -ENOMEM; + goto error_pci_iomap; + } ++ hpwdt_nmistat = pci_mem_addr + 0x6e; + hpwdt_timer_reg = pci_mem_addr + 0x70; + hpwdt_timer_con = pci_mem_addr + 0x72; + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 7c23363ecf19..8d661b3c47b6 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -828,8 +828,6 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, + if (!IS_LAST_ENTRY(s->first)) + ext4_xattr_rehash(header(s->base), + s->here); +- ext4_xattr_cache_insert(ext4_mb_cache, +- bs->bh); + } + unlock_buffer(bs->bh); + if (error == -EFSCORRUPTED) +@@ -918,6 +916,7 @@ inserted: + } else if (bs->bh && s->base == bs->bh->b_data) { + /* We were modifying this block in-place. */ + ea_bdebug(bs->bh, "keeping this block"); ++ ext4_xattr_cache_insert(ext4_mb_cache, bs->bh); + new_bh = bs->bh; + get_bh(new_bh); + } else { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 5fd3cf54b2b3..211440722e24 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -86,9 +86,9 @@ struct nfs_direct_req { + struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX]; + int mirror_count; + ++ loff_t io_start; /* Start offset for I/O */ + ssize_t count, /* bytes actually processed */ + bytes_left, /* bytes left to be sent */ +- io_start, /* start of IO */ + error; /* any reported error */ + struct completion completion; /* wait for i/o completion */ + +diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h +index 3febb4b9fce9..d842bec3d271 100644 +--- a/include/drm/drm_crtc_helper.h ++++ b/include/drm/drm_crtc_helper.h +@@ -241,5 +241,6 @@ extern void drm_kms_helper_hotplug_event(struct drm_device *dev); + extern void drm_kms_helper_poll_disable(struct drm_device *dev); + extern void drm_kms_helper_poll_enable(struct drm_device *dev); + extern void drm_kms_helper_poll_enable_locked(struct drm_device *dev); ++extern bool drm_kms_helper_is_poll_worker(void); + + #endif +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index d6c53fce006b..53e361a9af79 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -368,38 +368,14 @@ static inline unsigned long ifname_compare_aligned(const char *_a, + return ret; + } + ++struct xt_percpu_counter_alloc_state { ++ unsigned int off; ++ const char __percpu *mem; ++}; + +-/* On SMP, ip(6)t_entry->counters.pcnt holds address of the +- * real (percpu) counter. On !SMP, its just the packet count, +- * so nothing needs to be done there. +- * +- * xt_percpu_counter_alloc returns the address of the percpu +- * counter, or 0 on !SMP. We force an alignment of 16 bytes +- * so that bytes/packets share a common cache line. +- * +- * Hence caller must use IS_ERR_VALUE to check for error, this +- * allows us to return 0 for single core systems without forcing +- * callers to deal with SMP vs. NONSMP issues. +- */ +-static inline unsigned long xt_percpu_counter_alloc(void) +-{ +- if (nr_cpu_ids > 1) { +- void __percpu *res = __alloc_percpu(sizeof(struct xt_counters), +- sizeof(struct xt_counters)); +- +- if (res == NULL) +- return -ENOMEM; +- +- return (__force unsigned long) res; +- } +- +- return 0; +-} +-static inline void xt_percpu_counter_free(u64 pcnt) +-{ +- if (nr_cpu_ids > 1) +- free_percpu((void __percpu *) (unsigned long) pcnt); +-} ++bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state, ++ struct xt_counters *counter); ++void xt_percpu_counter_free(struct xt_counters *cnt); + + static inline struct xt_counters * + xt_get_this_cpu_counter(struct xt_counters *cnt) +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index 4a040862f4bf..115381228203 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -5,6 +5,7 @@ + + #ifndef _LINUX_NOSPEC_H + #define _LINUX_NOSPEC_H ++#include <asm/barrier.h> + + /** + * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index de2a722fe3cf..ea4f81c2a6d5 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -56,4 +56,7 @@ + */ + #define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) + ++/* Device needs a pause after every control message. */ ++#define USB_QUIRK_DELAY_CTRL_MSG BIT(13) ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 217abe56e711..f63ce973b27b 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -451,6 +451,7 @@ extern bool cancel_delayed_work_sync(struct delayed_work *dwork); + + extern void workqueue_set_max_active(struct workqueue_struct *wq, + int max_active); ++extern struct work_struct *current_work(void); + extern bool current_is_workqueue_rescuer(void); + extern bool workqueue_congested(int cpu, struct workqueue_struct *wq); + extern unsigned int work_busy(struct work_struct *work); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 85555eb4d3cb..8df77ed6aa99 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4047,6 +4047,22 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active) + } + EXPORT_SYMBOL_GPL(workqueue_set_max_active); + ++/** ++ * current_work - retrieve %current task's work struct ++ * ++ * Determine if %current task is a workqueue worker and what it's working on. ++ * Useful to find out the context that the %current task is running in. ++ * ++ * Return: work struct if %current task is a workqueue worker, %NULL otherwise. ++ */ ++struct work_struct *current_work(void) ++{ ++ struct worker *worker = current_wq_worker(); ++ ++ return worker ? worker->current_work : NULL; ++} ++EXPORT_SYMBOL(current_work); ++ + /** + * current_is_workqueue_rescuer - is %current workqueue rescuer? + * +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 9024283d2bca..9637a681bdda 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par) + return true; + } + ++static bool poolsize_invalid(const struct ebt_mac_wormhash *w) ++{ ++ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; + const struct ebt_entry_match *em = + container_of(par->matchinfo, const struct ebt_entry_match, data); +- int expected_length = sizeof(struct ebt_among_info); ++ unsigned int expected_length = sizeof(struct ebt_among_info); + const struct ebt_mac_wormhash *wh_dst, *wh_src; + int err; + ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); +- wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_dst)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_dst); ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ ++ wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_src)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index f46ca417bf2d..50b76011f470 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2021,7 +2021,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (match_kern) + match_kern->match_size = ret; + +- WARN_ON(type == EBT_COMPAT_TARGET && size_left); ++ if (WARN_ON(type == EBT_COMPAT_TARGET && size_left)) ++ return -EINVAL; ++ + match32 = (struct compat_ebt_entry_mwt *) buf; + } + +@@ -2078,6 +2080,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + * + * offsets are relative to beginning of struct ebt_entry (i.e., 0). + */ ++ for (i = 0; i < 4 ; ++i) { ++ if (offsets[i] >= *total) ++ return -EINVAL; ++ if (i == 0) ++ continue; ++ if (offsets[i-1] > offsets[i]) ++ return -EINVAL; ++ } ++ + for (i = 0, j = 1 ; j < 4 ; j++, i++) { + struct compat_ebt_entry_mwt *match32; + unsigned int size; +diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c +index c3776ff6749f..699f8a5457a3 100644 +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -23,7 +23,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + struct rtable *rt; + struct flowi4 fl4 = {}; + __be32 saddr = iph->saddr; +- __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; ++ const struct sock *sk = skb_to_full_sk(skb); ++ __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0; + unsigned int hh_len; + + if (addr_type == RTN_UNSPEC) +@@ -39,7 +40,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + fl4.daddr = iph->daddr; + fl4.saddr = saddr; + fl4.flowi4_tos = RT_TOS(iph->tos); +- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; ++ fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0; + fl4.flowi4_mark = skb->mark; + fl4.flowi4_flags = flags; + rt = ip_route_output_key(net, &fl4); +@@ -58,7 +59,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) { + struct dst_entry *dst = skb_dst(skb); + skb_dst_set(skb, NULL); +- dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0); ++ dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0); + if (IS_ERR(dst)) + return PTR_ERR(dst); + skb_dst_set(skb, dst); +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 4cfcc22f7430..f51b32ed353c 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -329,6 +329,10 @@ unsigned int arpt_do_table(struct sk_buff *skb, + } + if (table_base + v + != arpt_next_entry(e)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +@@ -507,17 +511,15 @@ static inline int check_target(struct arpt_entry *e, const char *name) + } + + static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) ++find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +- unsigned long pcnt; + int ret; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + t = arpt_get_target(e); + target = xt_request_find_target(NFPROTO_ARP, t->u.user.name, +@@ -536,7 +538,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) + err: + module_put(t->u.kernel.target->me); + out: +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -624,7 +626,7 @@ static inline void cleanup_entry(struct arpt_entry *e) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -633,6 +635,7 @@ static inline void cleanup_entry(struct arpt_entry *e) + static int translate_table(struct xt_table_info *newinfo, void *entry0, + const struct arpt_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct arpt_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -706,7 +709,8 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size); ++ ret = find_check_entry(iter, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index a98173d1ea97..dac62b5e7fe3 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -408,6 +408,10 @@ ipt_do_table(struct sk_buff *skb, + } + if (table_base + v != ipt_next_entry(e) && + !(e->ip.flags & IPT_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + pr_debug("Pushed %p into pos %u\n", + e, stackidx - 1); +@@ -645,7 +649,8 @@ static int check_target(struct ipt_entry *e, struct net *net, const char *name) + + static int + find_check_entry(struct ipt_entry *e, struct net *net, const char *name, +- unsigned int size) ++ unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +@@ -653,12 +658,9 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, + unsigned int j; + struct xt_mtchk_param mtpar; + struct xt_entry_match *ematch; +- unsigned long pcnt; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + j = 0; + mtpar.net = net; +@@ -697,7 +699,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, + cleanup_match(ematch, net); + } + +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -793,7 +795,7 @@ cleanup_entry(struct ipt_entry *e, struct net *net) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -802,6 +804,7 @@ static int + translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + const struct ipt_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct ipt_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -871,7 +874,8 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, net, repl->name, repl->size); ++ ret = find_check_entry(iter, net, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index bb1b5453a7a1..795c343347ec 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -425,6 +425,10 @@ ip6t_do_table(struct sk_buff *skb, + } + if (table_base + v != ip6t_next_entry(e) && + !(e->ipv6.flags & IP6T_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +@@ -658,7 +662,8 @@ static int check_target(struct ip6t_entry *e, struct net *net, const char *name) + + static int + find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, +- unsigned int size) ++ unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +@@ -666,12 +671,9 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, + unsigned int j; + struct xt_mtchk_param mtpar; + struct xt_entry_match *ematch; +- unsigned long pcnt; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + j = 0; + mtpar.net = net; +@@ -709,7 +711,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, + cleanup_match(ematch, net); + } + +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -804,8 +806,7 @@ static void cleanup_entry(struct ip6t_entry *e, struct net *net) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -814,6 +815,7 @@ static int + translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + const struct ip6t_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct ip6t_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -883,7 +885,8 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, net, repl->name, repl->size); ++ ret = find_check_entry(iter, net, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +index 238e70c3f7b7..7b9c2cabd495 100644 +--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, + !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff, + target, maniptype)) + return false; ++ ++ /* must reload, offset might have changed */ ++ ipv6h = (void *)skb->data + iphdroff; ++ + manip_addr: + if (maniptype == NF_NAT_MANIP_SRC) + ipv6h->saddr = target->src.u3.in6; +diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c +index fbce552a796e..7d7466dbf663 100644 +--- a/net/netfilter/nf_nat_proto_common.c ++++ b/net/netfilter/nf_nat_proto_common.c +@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + const struct nf_conn *ct, + u16 *rover) + { +- unsigned int range_size, min, i; ++ unsigned int range_size, min, max, i; + __be16 *portptr; + u_int16_t off; + +@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + } + } else { + min = ntohs(range->min_proto.all); +- range_size = ntohs(range->max_proto.all) - min + 1; ++ max = ntohs(range->max_proto.all); ++ if (unlikely(max < min)) ++ swap(max, min); ++ range_size = max - min + 1; + } + + if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) { +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index f853b55bf877..7edcfda288c4 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -501,7 +501,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + + if (entskb->tstamp.tv64) { + struct nfqnl_msg_packet_timestamp ts; +- struct timespec64 kts = ktime_to_timespec64(skb->tstamp); ++ struct timespec64 kts = ktime_to_timespec64(entskb->tstamp); + + ts.sec = cpu_to_be64(kts.tv_sec); + ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC); +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 5b52dd3feb7d..34ae20490c94 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -38,6 +38,8 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); + MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); + ++#define XT_PCPU_BLOCK_SIZE 4096 ++ + struct compat_delta { + unsigned int offset; /* offset in kernel */ + int delta; /* delta in 32bit user land */ +@@ -1592,6 +1594,59 @@ void xt_proto_fini(struct net *net, u_int8_t af) + } + EXPORT_SYMBOL_GPL(xt_proto_fini); + ++/** ++ * xt_percpu_counter_alloc - allocate x_tables rule counter ++ * ++ * @state: pointer to xt_percpu allocation state ++ * @counter: pointer to counter struct inside the ip(6)/arpt_entry struct ++ * ++ * On SMP, the packet counter [ ip(6)t_entry->counters.pcnt ] will then ++ * contain the address of the real (percpu) counter. ++ * ++ * Rule evaluation needs to use xt_get_this_cpu_counter() helper ++ * to fetch the real percpu counter. ++ * ++ * To speed up allocation and improve data locality, a 4kb block is ++ * allocated. ++ * ++ * xt_percpu_counter_alloc_state contains the base address of the ++ * allocated page and the current sub-offset. ++ * ++ * returns false on error. ++ */ ++bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state, ++ struct xt_counters *counter) ++{ ++ BUILD_BUG_ON(XT_PCPU_BLOCK_SIZE < (sizeof(*counter) * 2)); ++ ++ if (nr_cpu_ids <= 1) ++ return true; ++ ++ if (!state->mem) { ++ state->mem = __alloc_percpu(XT_PCPU_BLOCK_SIZE, ++ XT_PCPU_BLOCK_SIZE); ++ if (!state->mem) ++ return false; ++ } ++ counter->pcnt = (__force unsigned long)(state->mem + state->off); ++ state->off += sizeof(*counter); ++ if (state->off > (XT_PCPU_BLOCK_SIZE - sizeof(*counter))) { ++ state->mem = NULL; ++ state->off = 0; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(xt_percpu_counter_alloc); ++ ++void xt_percpu_counter_free(struct xt_counters *counters) ++{ ++ unsigned long pcnt = counters->pcnt; ++ ++ if (nr_cpu_ids > 1 && (pcnt & (XT_PCPU_BLOCK_SIZE - 1)) == 0) ++ free_percpu((void __percpu *)pcnt); ++} ++EXPORT_SYMBOL_GPL(xt_percpu_counter_free); ++ + static int __net_init xt_net_init(struct net *net) + { + int i; +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index 29d2c31f406c..1718f536689f 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -147,11 +147,11 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) + (unsigned long) info->timer); + info->timer->refcnt = 1; + ++ INIT_WORK(&info->timer->work, idletimer_tg_work); ++ + mod_timer(&info->timer->timer, + msecs_to_jiffies(info->timeout * 1000) + jiffies); + +- INIT_WORK(&info->timer->work, idletimer_tg_work); +- + return 0; + + out_free_attr: +@@ -192,7 +192,10 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) + pr_debug("timeout value is zero\n"); + return -EINVAL; + } +- ++ if (info->timeout >= INT_MAX / 1000) { ++ pr_debug("timeout value is too big\n"); ++ return -EINVAL; ++ } + if (info->label[0] == '\0' || + strnlen(info->label, + MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 3ba31c194cce..0858fe17e14a 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -141,10 +141,11 @@ static int led_tg_check(const struct xt_tgchk_param *par) + goto exit_alloc; + } + +- /* See if we need to set up a timer */ +- if (ledinfo->delay > 0) +- setup_timer(&ledinternal->timer, led_timeout_callback, +- (unsigned long)ledinternal); ++ /* Since the letinternal timer can be shared between multiple targets, ++ * always set it up, even if the current target does not need it ++ */ ++ setup_timer(&ledinternal->timer, led_timeout_callback, ++ (unsigned long)ledinternal); + + list_add_tail(&ledinternal->list, &xt_led_triggers); + +@@ -181,8 +182,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par) + + list_del(&ledinternal->list); + +- if (ledinfo->delay > 0) +- del_timer_sync(&ledinternal->timer); ++ del_timer_sync(&ledinternal->timer); + + led_trigger_unregister(&ledinternal->netfilter_led_trigger); + +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 4ca31e052dd8..509e9426a056 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, + struct sock *sk; + int chunklen; + +- chunklen = sizeof(*chunk_hdr) + paylen; ++ chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen); + if (chunklen > SCTP_MAX_CHUNK_LEN) + goto nodata; + +diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib +index 79e86613712f..24914e7de944 100644 +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -270,11 +270,11 @@ cmd_dt_S_dtb= \ + echo '\#include <asm-generic/vmlinux.lds.h>'; \ + echo '.section .dtb.init.rodata,"a"'; \ + echo '.balign STRUCT_ALIGNMENT'; \ +- echo '.global __dtb_$(*F)_begin'; \ +- echo '__dtb_$(*F)_begin:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \ ++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \ + echo '.incbin "$<" '; \ +- echo '__dtb_$(*F)_end:'; \ +- echo '.global __dtb_$(*F)_end'; \ ++ echo '__dtb_$(subst -,_,$(*F))_end:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \ + echo '.balign STRUCT_ALIGNMENT'; \ + ) > $@ + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 167b943469ab..94fd3df2cf21 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -919,7 +919,8 @@ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop) + static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + struct snd_seq_event *event, + struct file *file, int blocking, +- int atomic, int hop) ++ int atomic, int hop, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + int err; +@@ -957,7 +958,8 @@ static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + return -ENXIO; /* queue is not allocated */ + + /* allocate an event cell */ +- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file); ++ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, ++ file, mutexp); + if (err < 0) + return err; + +@@ -1026,12 +1028,11 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + return -ENXIO; + + /* allocate the pool now if the pool is not allocated yet */ ++ mutex_lock(&client->ioctl_mutex); + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +- mutex_lock(&client->ioctl_mutex); + err = snd_seq_pool_init(client->pool); +- mutex_unlock(&client->ioctl_mutex); + if (err < 0) +- return -ENOMEM; ++ goto out; + } + + /* only process whole events */ +@@ -1082,7 +1083,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + /* ok, enqueue it */ + err = snd_seq_client_enqueue_event(client, &event, file, + !(file->f_flags & O_NONBLOCK), +- 0, 0); ++ 0, 0, &client->ioctl_mutex); + if (err < 0) + break; + +@@ -1093,6 +1094,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + written += len; + } + ++ out: ++ mutex_unlock(&client->ioctl_mutex); + return written ? written : err; + } + +@@ -1924,6 +1927,9 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client, + (! snd_seq_write_pool_allocated(client) || + info.output_pool != client->pool->size)) { + if (snd_seq_write_pool_allocated(client)) { ++ /* is the pool in use? */ ++ if (atomic_read(&client->pool->counter)) ++ return -EBUSY; + /* remove all existing cells */ + snd_seq_pool_mark_closing(client->pool); + snd_seq_queue_client_leave_cells(client->number); +@@ -2347,7 +2353,8 @@ static int kernel_client_enqueue(int client, struct snd_seq_event *ev, + if (! cptr->accept_output) + result = -EPERM; + else /* send it */ +- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop); ++ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, ++ atomic, hop, NULL); + + snd_seq_client_unlock(cptr); + return result; +diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c +index 3490d21ab9e7..9acbed1ac982 100644 +--- a/sound/core/seq/seq_fifo.c ++++ b/sound/core/seq/seq_fifo.c +@@ -123,7 +123,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, + return -EINVAL; + + snd_use_lock_use(&f->use_lock); +- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */ ++ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */ + if (err < 0) { + if ((err == -ENOMEM) || (err == -EAGAIN)) + atomic_inc(&f->overflow); +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index 5847c4475bf3..4c8cbcd89887 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -221,7 +221,8 @@ void snd_seq_cell_free(struct snd_seq_event_cell * cell) + */ + static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + struct snd_seq_event_cell **cellp, +- int nonblock, struct file *file) ++ int nonblock, struct file *file, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -245,7 +246,11 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + set_current_state(TASK_INTERRUPTIBLE); + add_wait_queue(&pool->output_sleep, &wait); + spin_unlock_irq(&pool->lock); ++ if (mutexp) ++ mutex_unlock(mutexp); + schedule(); ++ if (mutexp) ++ mutex_lock(mutexp); + spin_lock_irq(&pool->lock); + remove_wait_queue(&pool->output_sleep, &wait); + /* interrupted? */ +@@ -288,7 +293,7 @@ __error: + */ + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + struct snd_seq_event_cell **cellp, int nonblock, +- struct file *file) ++ struct file *file, struct mutex *mutexp) + { + int ncells, err; + unsigned int extlen; +@@ -305,7 +310,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + if (ncells >= pool->total_elements) + return -ENOMEM; + +- err = snd_seq_cell_alloc(pool, &cell, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp); + if (err < 0) + return err; + +@@ -331,7 +336,8 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + int size = sizeof(struct snd_seq_event); + if (len < size) + size = len; +- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file, ++ mutexp); + if (err < 0) + goto __error; + if (cell->event.data.ext.ptr == NULL) +diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h +index 32f959c17786..3abe306c394a 100644 +--- a/sound/core/seq/seq_memory.h ++++ b/sound/core/seq/seq_memory.h +@@ -66,7 +66,8 @@ struct snd_seq_pool { + void snd_seq_cell_free(struct snd_seq_event_cell *cell); + + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, +- struct snd_seq_event_cell **cellp, int nonblock, struct file *file); ++ struct snd_seq_event_cell **cellp, int nonblock, ++ struct file *file, struct mutex *mutexp); + + /* return number of unused (free) cells */ + static inline int snd_seq_unused_cells(struct snd_seq_pool *pool) +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index c92b7ba344ef..9fae1d248318 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -849,6 +849,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b302d056e5d3..11305a4baf7b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4722,6 +4722,16 @@ static void alc298_fixup_speaker_volume(struct hda_codec *codec, + } + } + ++/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */ ++static void alc295_fixup_disable_dac3(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[2] = { 0x02, 0x03 }; ++ snd_hda_override_conn_list(codec, 0x17, 2, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -4871,6 +4881,7 @@ enum { + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC295_FIXUP_DISABLE_DAC3, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -5560,6 +5571,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + }, ++ [ALC295_FIXUP_DISABLE_DAC3] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_disable_dac3, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -5617,6 +5632,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/1122_linux-4.4.123.patch b/1122_linux-4.4.123.patch new file mode 100644 index 00000000..6d1e7d8b --- /dev/null +++ b/1122_linux-4.4.123.patch @@ -0,0 +1,3500 @@ +diff --git a/Makefile b/Makefile +index 3eb21d269b42..cbcc04da790a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 122 ++SUBLEVEL = 123 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 7106114c7464..2dbe13a3d89b 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts +index 40a474c4374b..4c52358734ef 100644 +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -359,7 +359,7 @@ + reg = <0>; + vdd3-supply = <&lcd_vdd3_reg>; + vci-supply = <&ldo25_reg>; +- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>; + power-on-delay= <50>; + reset-delay = <100>; + init-delay = <100>; +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 80f6c786a37e..e05670423d8b 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -90,6 +90,8 @@ + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -137,6 +139,12 @@ + OMAP3_CORE1_IOPAD(0x218e, PIN_OUTPUT | MUX_MODE4) /* mcbsp1_fsr.gpio_157 */ + >; + }; ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ >; ++ }; + }; + + &omap3_pmx_core2 { +diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts +index 10d088df0c35..4a962a26482d 100644 +--- a/arch/arm/boot/dts/moxart-uc7112lx.dts ++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts +@@ -6,7 +6,7 @@ + */ + + /dts-v1/; +-/include/ "moxart.dtsi" ++#include "moxart.dtsi" + + / { + model = "MOXA UC-7112-LX"; +diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi +index 1fd27ed65a01..64f2f44235d0 100644 +--- a/arch/arm/boot/dts/moxart.dtsi ++++ b/arch/arm/boot/dts/moxart.dtsi +@@ -6,6 +6,7 @@ + */ + + /include/ "skeleton.dtsi" ++#include <dt-bindings/interrupt-controller/irq.h> + + / { + compatible = "moxa,moxart"; +@@ -36,8 +37,8 @@ + ranges; + + intc: interrupt-controller@98800000 { +- compatible = "moxa,moxart-ic"; +- reg = <0x98800000 0x38>; ++ compatible = "moxa,moxart-ic", "faraday,ftintc010"; ++ reg = <0x98800000 0x100>; + interrupt-controller; + #interrupt-cells = <2>; + interrupt-mask = <0x00080000>; +@@ -59,7 +60,7 @@ + timer: timer@98400000 { + compatible = "moxa,moxart-timer"; + reg = <0x98400000 0x42>; +- interrupts = <19 1>; ++ interrupts = <19 IRQ_TYPE_EDGE_FALLING>; + clocks = <&clk_apb>; + }; + +@@ -80,7 +81,7 @@ + dma: dma@90500000 { + compatible = "moxa,moxart-dma"; + reg = <0x90500080 0x40>; +- interrupts = <24 0>; ++ interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + }; + +@@ -93,7 +94,7 @@ + sdhci: sdhci@98e00000 { + compatible = "moxa,moxart-sdhci"; + reg = <0x98e00000 0x5C>; +- interrupts = <5 0>; ++ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk_apb>; + dmas = <&dma 5>, + <&dma 5>; +@@ -120,7 +121,7 @@ + mac0: mac@90900000 { + compatible = "moxa,moxart-mac"; + reg = <0x90900000 0x90>; +- interrupts = <25 0>; ++ interrupts = <25 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy0>; + phy-mode = "mii"; + status = "disabled"; +@@ -129,7 +130,7 @@ + mac1: mac@92000000 { + compatible = "moxa,moxart-mac"; + reg = <0x92000000 0x90>; +- interrupts = <27 0>; ++ interrupts = <27 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy1>; + phy-mode = "mii"; + status = "disabled"; +@@ -138,7 +139,7 @@ + uart0: uart@98200000 { + compatible = "ns16550a"; + reg = <0x98200000 0x20>; +- interrupts = <31 8>; ++ interrupts = <31 IRQ_TYPE_LEVEL_HIGH>; + reg-shift = <2>; + reg-io-width = <4>; + clock-frequency = <14745600>; +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 27cd4abfc74d..731860314ab5 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -488,7 +488,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -505,7 +505,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi +index 7b39d8fae61e..bd83a61f724f 100644 +--- a/arch/arm/boot/dts/r8a7790.dtsi ++++ b/arch/arm/boot/dts/r8a7790.dtsi +@@ -1360,8 +1360,11 @@ + compatible = "renesas,r8a7790-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, +diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts +index fc44ea361a4b..62eae315af1f 100644 +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -280,7 +280,7 @@ + x2_clk: x2-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <148500000>; ++ clock-frequency = <74250000>; + }; + + x13_clk: x13-clock { +diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi +index 328f48bd15e7..d2585a4c6098 100644 +--- a/arch/arm/boot/dts/r8a7791.dtsi ++++ b/arch/arm/boot/dts/r8a7791.dtsi +@@ -1374,8 +1374,11 @@ + compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, +diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c +index e3384065f5e7..cbe0f025856d 100644 +--- a/arch/mips/kernel/mips-r2-to-r6-emul.c ++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c +@@ -1097,10 +1097,20 @@ repeat: + } + break; + +- case beql_op: +- case bnel_op: + case blezl_op: + case bgtzl_op: ++ /* ++ * For BLEZL and BGTZL, rt field must be set to 0. If this ++ * is not the case, this may be an encoding of a MIPS R6 ++ * instruction, so return to CPU execution if this occurs ++ */ ++ if (MIPSInst_RT(inst)) { ++ err = SIGILL; ++ break; ++ } ++ /* fall through */ ++ case beql_op: ++ case bnel_op: + if (delay_slot(regs)) { + err = SIGILL; + break; +@@ -2330,6 +2340,8 @@ static int mipsr2_stats_clear_show(struct seq_file *s, void *unused) + __this_cpu_write((mipsr2bremustats).bgezl, 0); + __this_cpu_write((mipsr2bremustats).bltzll, 0); + __this_cpu_write((mipsr2bremustats).bgezll, 0); ++ __this_cpu_write((mipsr2bremustats).bltzall, 0); ++ __this_cpu_write((mipsr2bremustats).bgezall, 0); + __this_cpu_write((mipsr2bremustats).bltzal, 0); + __this_cpu_write((mipsr2bremustats).bgezal, 0); + __this_cpu_write((mipsr2bremustats).beql, 0); +diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c +index 1a8c96035716..c0c1e9529dbd 100644 +--- a/arch/mips/net/bpf_jit.c ++++ b/arch/mips/net/bpf_jit.c +@@ -527,7 +527,8 @@ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset) + u32 sflags, tmp_flags; + + /* Adjust the stack pointer */ +- emit_stack_offset(-align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(-align_sp(offset), ctx); + + tmp_flags = sflags = ctx->flags >> SEEN_SREG_SFT; + /* sflags is essentially a bitmap */ +@@ -579,7 +580,8 @@ static void restore_bpf_jit_regs(struct jit_ctx *ctx, + emit_load_stack_reg(r_ra, r_sp, real_off, ctx); + + /* Restore the sp and discard the scrach memory */ +- emit_stack_offset(align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(align_sp(offset), ctx); + } + + static unsigned int get_stack_depth(struct jit_ctx *ctx) +@@ -626,8 +628,14 @@ static void build_prologue(struct jit_ctx *ctx) + if (ctx->flags & SEEN_X) + emit_jit_reg_move(r_X, r_zero, ctx); + +- /* Do not leak kernel data to userspace */ +- if (bpf_needs_clear_a(&ctx->skf->insns[0])) ++ /* ++ * Do not leak kernel data to userspace, we only need to clear ++ * r_A if it is ever used. In fact if it is never used, we ++ * will not save/restore it, so clearing it in this case would ++ * corrupt the state of the caller. ++ */ ++ if (bpf_needs_clear_a(&ctx->skf->insns[0]) && ++ (ctx->flags & SEEN_A)) + emit_jit_reg_move(r_A, r_zero, ctx); + } + +diff --git a/arch/mips/net/bpf_jit_asm.S b/arch/mips/net/bpf_jit_asm.S +index 5d2e0c8d29c0..88a2075305d1 100644 +--- a/arch/mips/net/bpf_jit_asm.S ++++ b/arch/mips/net/bpf_jit_asm.S +@@ -90,18 +90,14 @@ FEXPORT(sk_load_half_positive) + is_offset_in_header(2, half) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- .set reorder +- lh $r_A, 0(t1) +- .set noreorder ++ lhu $r_A, 0(t1) + #ifdef CONFIG_CPU_LITTLE_ENDIAN + # if defined(__mips_isa_rev) && (__mips_isa_rev >= 2) +- wsbh t0, $r_A +- seh $r_A, t0 ++ wsbh $r_A, $r_A + # else +- sll t0, $r_A, 24 +- andi t1, $r_A, 0xff00 +- sra t0, t0, 16 +- srl t1, t1, 8 ++ sll t0, $r_A, 8 ++ srl t1, $r_A, 8 ++ andi t0, t0, 0xff00 + or $r_A, t0, t1 + # endif + #endif +@@ -115,7 +111,7 @@ FEXPORT(sk_load_byte_positive) + is_offset_in_header(1, byte) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- lb $r_A, 0(t1) ++ lbu $r_A, 0(t1) + jr $r_ra + move $r_ret, zero + END(sk_load_byte) +@@ -139,6 +135,11 @@ FEXPORT(sk_load_byte_positive) + * (void *to) is returned in r_s0 + * + */ ++#ifdef CONFIG_CPU_LITTLE_ENDIAN ++#define DS_OFFSET(SIZE) (4 * SZREG) ++#else ++#define DS_OFFSET(SIZE) ((4 * SZREG) + (4 - SIZE)) ++#endif + #define bpf_slow_path_common(SIZE) \ + /* Quick check. Are we within reasonable boundaries? */ \ + LONG_ADDIU $r_s1, $r_skb_len, -SIZE; \ +@@ -150,7 +151,7 @@ FEXPORT(sk_load_byte_positive) + PTR_LA t0, skb_copy_bits; \ + PTR_S $r_ra, (5 * SZREG)($r_sp); \ + /* Assign low slot to a2 */ \ +- move a2, $r_sp; \ ++ PTR_ADDIU a2, $r_sp, DS_OFFSET(SIZE); \ + jalr t0; \ + /* Reset our destination slot (DS but it's ok) */ \ + INT_S zero, (4 * SZREG)($r_sp); \ +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index a67c6d781c52..d154e333f76b 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -294,7 +294,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address, + * can result in fault, which will cause a deadlock when called with + * mmap_sem held + */ +- if (user_mode(regs)) ++ if (!is_exec && user_mode(regs)) + store_update_sp = store_updates_sp(regs); + + if (user_mode(regs)) +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 99d293ea2b49..565e24e9ddf2 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -196,6 +196,8 @@ retry: + return (opcode != 0x62 && opcode != 0x67); + case 0x70: + return 0; /* can't boost conditional jump */ ++ case 0x90: ++ return opcode != 0x9a; /* can't boost call far */ + case 0xc0: + /* can't boost software-interruptions */ + return (0xc1 < opcode && opcode < 0xcc) || opcode == 0xcf; +@@ -404,6 +406,8 @@ static int arch_copy_kprobe(struct kprobe *p) + { + int ret; + ++ set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Copy an instruction with recovering if other optprobe modifies it.*/ + ret = __copy_instruction(p->ainsn.insn, p->addr); + if (!ret) +@@ -418,6 +422,8 @@ static int arch_copy_kprobe(struct kprobe *p) + else + p->ainsn.boostable = -1; + ++ set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Check whether the instruction modifies Interrupt Flag or not */ + p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn); + +diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c +index ea8e2b846101..7aba9d6475a5 100644 +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -370,6 +370,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, + } + + buf = (u8 *)op->optinsn.insn; ++ set_memory_rw((unsigned long)buf & PAGE_MASK, 1); + + /* Copy instructions into the out-of-line buffer */ + ret = copy_optimized_instructions(buf + TMPL_END_IDX, op->kp.addr); +@@ -392,6 +393,8 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, + synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size, + (u8 *)op->kp.addr + op->optinsn.size); + ++ set_memory_ro((unsigned long)buf & PAGE_MASK, 1); ++ + flush_icache_range((unsigned long) buf, + (unsigned long) buf + TMPL_END_IDX + + op->optinsn.size + RELATIVEJUMP_SIZE); +diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c +index 510e80da7de4..af57736a0309 100644 +--- a/arch/x86/kernel/vm86_32.c ++++ b/arch/x86/kernel/vm86_32.c +@@ -715,7 +715,8 @@ void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code) + return; + + check_vip: +- if (VEFLAGS & X86_EFLAGS_VIP) { ++ if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) == ++ (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) { + save_v86_state(regs, VM86_STI); + return; + } +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e830c71a1323..e0a34b0d381e 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -287,7 +287,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (!pmd_k) + return -1; + +- if (pmd_huge(*pmd_k)) ++ if (pmd_large(*pmd_k)) + return 0; + + pte_k = pte_offset_kernel(pmd_k, address); +@@ -407,7 +407,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref)) + BUG(); + +- if (pud_huge(*pud)) ++ if (pud_large(*pud)) + return 0; + + pmd = pmd_offset(pud, address); +@@ -418,7 +418,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref)) + BUG(); + +- if (pmd_huge(*pmd)) ++ if (pmd_large(*pmd)) + return 0; + + pte_ref = pte_offset_kernel(pmd_ref, address); +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 8161090a1970..46ba2402c8f9 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1078,10 +1078,8 @@ int blkcg_init_queue(struct request_queue *q) + if (preloaded) + radix_tree_preload_end(); + +- if (IS_ERR(blkg)) { +- blkg_free(new_blkg); ++ if (IS_ERR(blkg)) + return PTR_ERR(blkg); +- } + + q->root_blkg = blkg; + q->root_rl.blkg = blkg; +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 2149a1ddbacf..17bdd6b55beb 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -505,6 +505,17 @@ static void throtl_dequeue_tg(struct throtl_grp *tg) + static void throtl_schedule_pending_timer(struct throtl_service_queue *sq, + unsigned long expires) + { ++ unsigned long max_expire = jiffies + 8 * throtl_slice; ++ ++ /* ++ * Since we are adjusting the throttle limit dynamically, the sleep ++ * time calculated according to previous limit might be invalid. It's ++ * possible the cgroup sleep time is very long and no other cgroups ++ * have IO running so notify the limit changes. Make sure the cgroup ++ * doesn't sleep too long to avoid the missed notification. ++ */ ++ if (time_after(expires, max_expire)) ++ expires = max_expire; + mod_timer(&sq->pending_timer, expires); + throtl_log(sq, "schedule timer. delay=%lu jiffies=%lu", + expires - jiffies, jiffies); +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 1341a94cc779..76afc841232c 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -859,6 +859,8 @@ void intel_gtt_insert_sg_entries(struct sg_table *st, + } + } + wmb(); ++ if (intel_private.driver->chipset_flush) ++ intel_private.driver->chipset_flush(); + } + EXPORT_SYMBOL(intel_gtt_insert_sg_entries); + +diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c +index 2e7f03d50f4e..95a4dd290f35 100644 +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -1437,6 +1437,7 @@ static const struct freq_tbl ftbl_codec_clk[] = { + + static struct clk_rcg2 codec_digcodec_clk_src = { + .cmd_rcgr = 0x1c09c, ++ .mnd_width = 8, + .hid_width = 5, + .parent_map = gcc_xo_gpll1_emclk_sleep_map, + .freq_tbl = ftbl_codec_clk, +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index ebed319657e7..c0fb6f12f547 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -551,6 +551,8 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } ++ if (t && !try_module_get(t->owner)) ++ t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -669,6 +671,10 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); ++ ++ if (new_policy.governor) ++ module_put(new_policy.governor->owner); ++ + return ret ? ret : count; + } + +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index 0f6fd42f55ca..f8d740a6740d 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -911,6 +911,21 @@ static int sdma_disable_channel(struct dma_chan *chan) + return 0; + } + ++static int sdma_disable_channel_with_delay(struct dma_chan *chan) ++{ ++ sdma_disable_channel(chan); ++ ++ /* ++ * According to NXP R&D team a delay of one BD SDMA cost time ++ * (maximum is 1ms) should be added after disable of the channel ++ * bit, to ensure SDMA core has really been stopped after SDMA ++ * clients call .device_terminate_all. ++ */ ++ mdelay(1); ++ ++ return 0; ++} ++ + static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac) + { + struct sdma_engine *sdma = sdmac->sdma; +@@ -1793,7 +1808,7 @@ static int sdma_probe(struct platform_device *pdev) + sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg; + sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic; + sdma->dma_device.device_config = sdma_config; +- sdma->dma_device.device_terminate_all = sdma_disable_channel; ++ sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay; + sdma->dma_device.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 6470c9aa1351..1f0e6ede120c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector) + /* don't do anything if sink is not display port, i.e., + * passive dp->(dvi|hdmi) adaptor + */ +- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { +- int saved_dpms = connector->dpms; +- /* Only turn off the display if it's physically disconnected */ +- if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) { +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { +- /* Don't try to start link training before we +- * have the dpcd */ +- if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) +- return; +- +- /* set it to OFF so that drm_helper_connector_dpms() +- * won't return immediately since the current state +- * is ON at this point. +- */ +- connector->dpms = DRM_MODE_DPMS_OFF; +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- } +- connector->dpms = saved_dpms; ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && ++ amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) && ++ amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { ++ /* Don't start link training before we have the DPCD */ ++ if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) ++ return; ++ ++ /* Turn the connector off and back on immediately, which ++ * will trigger link training ++ */ ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + } + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 82903ca78529..c555781685ea 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -560,6 +560,12 @@ amdgpu_user_framebuffer_create(struct drm_device *dev, + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL); + if (amdgpu_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 74909e72a009..2acbd43f9a53 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -519,11 +519,17 @@ static ssize_t sysprops_show(struct kobject *kobj, struct attribute *attr, + return ret; + } + ++static void kfd_topology_kobj_release(struct kobject *kobj) ++{ ++ kfree(kobj); ++} ++ + static const struct sysfs_ops sysprops_ops = { + .show = sysprops_show, + }; + + static struct kobj_type sysprops_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &sysprops_ops, + }; + +@@ -559,6 +565,7 @@ static const struct sysfs_ops iolink_ops = { + }; + + static struct kobj_type iolink_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &iolink_ops, + }; + +@@ -586,6 +593,7 @@ static const struct sysfs_ops mem_ops = { + }; + + static struct kobj_type mem_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &mem_ops, + }; + +@@ -625,6 +633,7 @@ static const struct sysfs_ops cache_ops = { + }; + + static struct kobj_type cache_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &cache_ops, + }; + +@@ -747,6 +756,7 @@ static const struct sysfs_ops node_ops = { + }; + + static struct kobj_type node_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &node_ops, + }; + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index c641ed9470e1..724f7cf52253 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3219,8 +3219,7 @@ monitor_name(struct detailed_timing *t, void *data) + * @edid: EDID to parse + * + * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The +- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to +- * fill in. ++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in. + */ + void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + { +@@ -3293,6 +3292,12 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + } + eld[5] |= sad_count << 4; + ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || ++ connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP; ++ else ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI; ++ + eld[DRM_ELD_BASELINE_ELD_LEN] = + DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4); + +diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c +index 8090989185b2..4ddbc49125cd 100644 +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -1271,9 +1271,9 @@ void drm_vblank_put(struct drm_device *dev, unsigned int pipe) + if (atomic_dec_and_test(&vblank->refcount)) { + if (drm_vblank_offdelay == 0) + return; +- else if (dev->vblank_disable_immediate || drm_vblank_offdelay < 0) ++ else if (drm_vblank_offdelay < 0) + vblank_disable_fn((unsigned long)vblank); +- else ++ else if (!dev->vblank_disable_immediate) + mod_timer(&vblank->disable_timer, + jiffies + ((drm_vblank_offdelay * HZ)/1000)); + } +@@ -1902,6 +1902,16 @@ bool drm_handle_vblank(struct drm_device *dev, unsigned int pipe) + wake_up(&vblank->queue); + drm_handle_vblank_events(dev, pipe); + ++ /* With instant-off, we defer disabling the interrupt until after ++ * we finish processing the following vblank. The disable has to ++ * be last (after drm_handle_vblank_events) so that the timestamp ++ * is always accurate. ++ */ ++ if (dev->vblank_disable_immediate && ++ drm_vblank_offdelay > 0 && ++ !atomic_read(&vblank->refcount)) ++ vblank_disable_fn((unsigned long)vblank); ++ + spin_unlock_irqrestore(&dev->event_lock, irqflags); + + return true; +diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c +index c4a552637c93..3ff7689835dc 100644 +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -494,9 +494,11 @@ static const struct drm_fb_helper_funcs qxl_fb_helper_funcs = { + + int qxl_fbdev_init(struct qxl_device *qdev) + { ++ int ret = 0; ++ ++#ifdef CONFIG_DRM_FBDEV_EMULATION + struct qxl_fbdev *qfbdev; + int bpp_sel = 32; /* TODO: parameter from somewhere? */ +- int ret; + + qfbdev = kzalloc(sizeof(struct qxl_fbdev), GFP_KERNEL); + if (!qfbdev) +@@ -531,6 +533,8 @@ fini: + drm_fb_helper_fini(&qfbdev->helper); + free: + kfree(qfbdev); ++#endif ++ + return ret; + } + +@@ -546,6 +550,9 @@ void qxl_fbdev_fini(struct qxl_device *qdev) + + void qxl_fbdev_set_suspend(struct qxl_device *qdev, int state) + { ++ if (!qdev->mode_info.qfbdev) ++ return; ++ + drm_fb_helper_set_suspend(&qdev->mode_info.qfbdev->helper, state); + } + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 3645b223aa37..446d99062306 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1374,6 +1374,12 @@ radeon_user_framebuffer_create(struct drm_device *dev, + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL); + if (radeon_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index d2d93959b119..aec6e9eef489 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -433,7 +433,7 @@ static int vmw_fb_kms_detach(struct vmw_fb_par *par, + set.y = 0; + set.mode = NULL; + set.fb = NULL; +- set.num_connectors = 1; ++ set.num_connectors = 0; + set.connectors = &par->con; + ret = drm_mode_set_config_internal(&set); + if (ret) { +@@ -821,7 +821,9 @@ int vmw_fb_off(struct vmw_private *vmw_priv) + flush_delayed_work(&par->local_work); + + mutex_lock(&par->bo_mutex); ++ drm_modeset_lock_all(vmw_priv->dev); + (void) vmw_fb_kms_detach(par, true, false); ++ drm_modeset_unlock_all(vmw_priv->dev); + mutex_unlock(&par->bo_mutex); + + return 0; +diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c +index 0cd4f7216239..5eea6fe0d7bd 100644 +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -42,6 +42,12 @@ static int elo_input_configured(struct hid_device *hdev, + { + struct input_dev *input = hidinput->input; + ++ /* ++ * ELO devices have one Button usage in GenDesk field, which makes ++ * hid-input map it to BTN_LEFT; that confuses userspace, which then ++ * considers the device to be a mouse/touchpad instead of touchscreen. ++ */ ++ clear_bit(BTN_LEFT, input->keybit); + set_bit(BTN_TOUCH, input->keybit); + set_bit(ABS_PRESSURE, input->absbit); + input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0); +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 2ba6bf69b7d0..53e54855c366 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1128,18 +1128,26 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct + + /* + * Ignore out-of-range values as per HID specification, +- * section 5.10 and 6.2.25. ++ * section 5.10 and 6.2.25, when NULL state bit is present. ++ * When it's not, clamp the value to match Microsoft's input ++ * driver as mentioned in "Required HID usages for digitizers": ++ * https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp + * + * The logical_minimum < logical_maximum check is done so that we + * don't unintentionally discard values sent by devices which + * don't specify logical min and max. + */ + if ((field->flags & HID_MAIN_ITEM_VARIABLE) && +- (field->logical_minimum < field->logical_maximum) && +- (value < field->logical_minimum || +- value > field->logical_maximum)) { +- dbg_hid("Ignoring out-of-range value %x\n", value); +- return; ++ (field->logical_minimum < field->logical_maximum)) { ++ if (field->flags & HID_MAIN_ITEM_NULL_STATE && ++ (value < field->logical_minimum || ++ value > field->logical_maximum)) { ++ dbg_hid("Ignoring out-of-range value %x\n", value); ++ return; ++ } ++ value = clamp(value, ++ field->logical_minimum, ++ field->logical_maximum); + } + + /* +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 188af4c89f40..18477dd1e243 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -95,8 +95,8 @@ static const struct coefficients adm1075_coefficients[] = { + [0] = { 27169, 0, -1 }, /* voltage */ + [1] = { 806, 20475, -1 }, /* current, irange25 */ + [2] = { 404, 20475, -1 }, /* current, irange50 */ +- [3] = { 0, -1, 8549 }, /* power, irange25 */ +- [4] = { 0, -1, 4279 }, /* power, irange50 */ ++ [3] = { 8549, 0, -1 }, /* power, irange25 */ ++ [4] = { 4279, 0, -1 }, /* power, irange50 */ + }; + + static const struct coefficients adm1275_coefficients[] = { +diff --git a/drivers/hwtracing/coresight/of_coresight.c b/drivers/hwtracing/coresight/of_coresight.c +index b0973617826f..7d2bb1549608 100644 +--- a/drivers/hwtracing/coresight/of_coresight.c ++++ b/drivers/hwtracing/coresight/of_coresight.c +@@ -150,7 +150,7 @@ struct coresight_platform_data *of_get_coresight_platform_data( + continue; + + /* The local out port number */ +- pdata->outports[i] = endpoint.id; ++ pdata->outports[i] = endpoint.port; + + /* + * Get a handle on the remote port and parent +diff --git a/drivers/input/keyboard/qt1070.c b/drivers/input/keyboard/qt1070.c +index 5a5778729e37..76bb51309a78 100644 +--- a/drivers/input/keyboard/qt1070.c ++++ b/drivers/input/keyboard/qt1070.c +@@ -274,9 +274,18 @@ static const struct i2c_device_id qt1070_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, qt1070_id); + ++#ifdef CONFIG_OF ++static const struct of_device_id qt1070_of_match[] = { ++ { .compatible = "qt1070", }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, qt1070_of_match); ++#endif ++ + static struct i2c_driver qt1070_driver = { + .driver = { + .name = "qt1070", ++ .of_match_table = of_match_ptr(qt1070_of_match), + .pm = &qt1070_pm_ops, + }, + .id_table = qt1070_id, +diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c +index 5d0cd51c6f41..a4b7b4c3d27b 100644 +--- a/drivers/input/touchscreen/tsc2007.c ++++ b/drivers/input/touchscreen/tsc2007.c +@@ -455,6 +455,14 @@ static int tsc2007_probe(struct i2c_client *client, + + tsc2007_stop(ts); + ++ /* power down the chip (TSC2007_SETUP does not ACK on I2C) */ ++ err = tsc2007_xfer(ts, PWRDOWN); ++ if (err < 0) { ++ dev_err(&client->dev, ++ "Failed to setup chip: %d\n", err); ++ return err; /* usually, chip does not respond */ ++ } ++ + err = input_register_device(input_dev); + if (err) { + dev_err(&client->dev, +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index fa0adef32bd6..62739766b60b 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -126,7 +126,7 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad, + break; /* found a free slot */ + } + adjust_limit_pfn: +- limit_pfn = curr_iova->pfn_lo - 1; ++ limit_pfn = curr_iova->pfn_lo ? (curr_iova->pfn_lo - 1) : 0; + move_left: + prev = curr; + curr = rb_prev(curr); +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index c5f1757ac61d..82e00e3ad0e0 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -663,7 +663,7 @@ static struct irq_chip its_irq_chip = { + * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations. + */ + #define IRQS_PER_CHUNK_SHIFT 5 +-#define IRQS_PER_CHUNK (1 << IRQS_PER_CHUNK_SHIFT) ++#define IRQS_PER_CHUNK (1UL << IRQS_PER_CHUNK_SHIFT) + + static unsigned long *lpi_bitmap; + static u32 lpi_chunks; +@@ -1168,11 +1168,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + /* +- * At least one bit of EventID is being used, hence a minimum +- * of two entries. No, the architecture doesn't let you +- * express an ITT with a single entry. ++ * We allocate at least one chunk worth of LPIs bet device, ++ * and thus that many ITEs. The device may require less though. + */ +- nr_ites = max(2UL, roundup_pow_of_two(nvecs)); ++ nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs)); + sz = nr_ites * its->ite_size; + sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1; + itt = kzalloc(sz, GFP_KERNEL); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 86ab6d14d782..ca968c3f25c7 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3372,9 +3372,20 @@ static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s, + BUG_ON(test_bit(R5_Wantcompute, &dev->flags)); + BUG_ON(test_bit(R5_Wantread, &dev->flags)); + BUG_ON(sh->batch_head); ++ ++ /* ++ * In the raid6 case if the only non-uptodate disk is P ++ * then we already trusted P to compute the other failed ++ * drives. It is safe to compute rather than re-read P. ++ * In other cases we only compute blocks from failed ++ * devices, otherwise check/repair might fail to detect ++ * a real inconsistency. ++ */ ++ + if ((s->uptodate == disks - 1) && ++ ((sh->qd_idx >= 0 && sh->pd_idx == disk_idx) || + (s->failed && (disk_idx == s->failed_num[0] || +- disk_idx == s->failed_num[1]))) { ++ disk_idx == s->failed_num[1])))) { + /* have disk failed, and we're requested to fetch it; + * do compute it + */ +diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c +index 1f8af1ee8352..1e4783b51a35 100644 +--- a/drivers/media/i2c/soc_camera/ov6650.c ++++ b/drivers/media/i2c/soc_camera/ov6650.c +@@ -1033,7 +1033,7 @@ static int ov6650_probe(struct i2c_client *client, + priv->code = MEDIA_BUS_FMT_YUYV8_2X8; + priv->colorspace = V4L2_COLORSPACE_JPEG; + +- priv->clk = v4l2_clk_get(&client->dev, "mclk"); ++ priv->clk = v4l2_clk_get(&client->dev, NULL); + if (IS_ERR(priv->clk)) { + ret = PTR_ERR(priv->clk); + goto eclkget; +diff --git a/drivers/media/pci/solo6x10/solo6x10-v4l2.c b/drivers/media/pci/solo6x10/solo6x10-v4l2.c +index f7ce493b1fee..a0b61e88c838 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-v4l2.c ++++ b/drivers/media/pci/solo6x10/solo6x10-v4l2.c +@@ -342,6 +342,17 @@ static void solo_stop_streaming(struct vb2_queue *q) + struct solo_dev *solo_dev = vb2_get_drv_priv(q); + + solo_stop_thread(solo_dev); ++ ++ spin_lock(&solo_dev->slock); ++ while (!list_empty(&solo_dev->vidq_active)) { ++ struct solo_vb2_buf *buf = list_entry( ++ solo_dev->vidq_active.next, ++ struct solo_vb2_buf, list); ++ ++ list_del(&buf->list); ++ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ } ++ spin_unlock(&solo_dev->slock); + INIT_LIST_HEAD(&solo_dev->vidq_active); + } + +diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c +index 9caea8344547..d793c630f1dd 100644 +--- a/drivers/media/usb/cpia2/cpia2_v4l.c ++++ b/drivers/media/usb/cpia2/cpia2_v4l.c +@@ -812,7 +812,7 @@ static int cpia2_querybuf(struct file *file, void *fh, struct v4l2_buffer *buf) + struct camera_data *cam = video_drvdata(file); + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; +@@ -863,7 +863,7 @@ static int cpia2_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || + buf->memory != V4L2_MEMORY_MMAP || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + DBG("QBUF #%d\n", buf->index); +diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c +index cc91f7b3d90c..eb29113e0bac 100644 +--- a/drivers/misc/enclosure.c ++++ b/drivers/misc/enclosure.c +@@ -148,7 +148,7 @@ enclosure_register(struct device *dev, const char *name, int components, + for (i = 0; i < components; i++) { + edev->component[i].number = -1; + edev->component[i].slot = -1; +- edev->component[i].power_status = 1; ++ edev->component[i].power_status = -1; + } + + mutex_lock(&container_list_lock); +@@ -600,6 +600,11 @@ static ssize_t get_component_power_status(struct device *cdev, + + if (edev->cb->get_power_status) + edev->cb->get_power_status(edev, ecomp); ++ ++ /* If still uninitialized, the callback failed or does not exist. */ ++ if (ecomp->power_status == -1) ++ return (edev->cb->get_power_status) ? -EIO : -ENOTTY; ++ + return snprintf(buf, 40, "%s\n", ecomp->power_status ? "on" : "off"); + } + +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 27864c0863ef..8406f346b0be 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -626,7 +626,8 @@ static void nand_command(struct mtd_info *mtd, unsigned int command, + chip->cmd_ctrl(mtd, readcmd, ctrl); + ctrl &= ~NAND_CTRL_CHANGE; + } +- chip->cmd_ctrl(mtd, command, ctrl); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ctrl); + + /* Address cycle, when necessary */ + ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE; +@@ -655,6 +656,7 @@ static void nand_command(struct mtd_info *mtd, unsigned int command, + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: + case NAND_CMD_ERASE2: +@@ -717,7 +719,9 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command, + } + + /* Command latch cycle */ +- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); + + if (column != -1 || page_addr != -1) { + int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE; +@@ -750,6 +754,7 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command, + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_CACHEDPROG: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2cb34b0f3856..eadccf498589 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3276,12 +3276,17 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, + for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { + u64 nv = new[i]; + u64 ov = old[i]; ++ s64 delta = nv - ov; + + /* detects if this particular field is 32bit only */ + if (((nv | ov) >> 32) == 0) +- res[i] += (u32)nv - (u32)ov; +- else +- res[i] += nv - ov; ++ delta = (s64)(s32)((u32)nv - (u32)ov); ++ ++ /* filter anomalies, some drivers reset their stats ++ * at down/up events. ++ */ ++ if (delta > 0) ++ res[i] += delta; + } + } + +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +index c31e691d11fc..e8d31640058d 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +@@ -604,6 +604,7 @@ static void xgene_enet_cle_bypass(struct xgene_enet_pdata *pdata, + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG0_0_ADDR, &cb); + cb |= CFG_CLE_BYPASS_EN0; + CFG_CLE_IP_PROTOCOL0_SET(&cb, 3); ++ CFG_CLE_IP_HDR_LEN_SET(&cb, 0); + xgene_enet_wr_csr(pdata, CLE_BYPASS_REG0_0_ADDR, cb); + + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG1_0_ADDR, &cb); +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h +index c153a1dc5ff7..480312105964 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h +@@ -147,6 +147,7 @@ enum xgene_enet_rm { + #define CFG_RXCLK_MUXSEL0_SET(dst, val) xgene_set_bits(dst, val, 26, 3) + + #define CFG_CLE_IP_PROTOCOL0_SET(dst, val) xgene_set_bits(dst, val, 16, 2) ++#define CFG_CLE_IP_HDR_LEN_SET(dst, val) xgene_set_bits(dst, val, 8, 5) + #define CFG_CLE_DSTQID0_SET(dst, val) xgene_set_bits(dst, val, 0, 12) + #define CFG_CLE_FPSEL0_SET(dst, val) xgene_set_bits(dst, val, 16, 4) + #define CFG_MACMODE_SET(dst, val) xgene_set_bits(dst, val, 18, 2) +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 6d0c5d5eea6d..58c0fccdd8cb 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -28,6 +28,7 @@ + #include <linux/io.h> + #include <linux/module.h> + #include <linux/netdevice.h> ++#include <linux/of.h> + #include <linux/phy.h> + #include <linux/platform_device.h> + #include <net/ip.h> +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +index 2ce0eba5e040..38431b49020f 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +@@ -983,7 +983,7 @@ static void fm10k_self_test(struct net_device *dev, + + memset(data, 0, sizeof(*data) * FM10K_TEST_LEN); + +- if (FM10K_REMOVED(hw)) { ++ if (FM10K_REMOVED(hw->hw_addr)) { + netif_err(interface, drv, dev, + "Interface removed - test blocked\n"); + eth_test->flags |= ETH_TEST_FL_FAILED; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 488a50d59dca..3da1f206ff84 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1073,6 +1073,11 @@ static int i40e_get_eeprom_len(struct net_device *netdev) + struct i40e_hw *hw = &np->vsi->back->hw; + u32 val; + ++#define X722_EEPROM_SCOPE_LIMIT 0x5B9FFF ++ if (hw->mac.type == I40E_MAC_X722) { ++ val = X722_EEPROM_SCOPE_LIMIT + 1; ++ return val; ++ } + val = (rd32(hw, I40E_GLPCI_LBARCTRL) + & I40E_GLPCI_LBARCTRL_FL_SIZE_MASK) + >> I40E_GLPCI_LBARCTRL_FL_SIZE_SHIFT; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +index 6100cdd9ad13..dd4e6ea9e0e1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +@@ -292,14 +292,14 @@ i40e_status i40e_read_nvm_word(struct i40e_hw *hw, u16 offset, + { + enum i40e_status_code ret_code = 0; + +- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { +- ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); +- if (!ret_code) { ++ ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); ++ if (!ret_code) { ++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { + ret_code = i40e_read_nvm_word_aq(hw, offset, data); +- i40e_release_nvm(hw); ++ } else { ++ ret_code = i40e_read_nvm_word_srctl(hw, offset, data); + } +- } else { +- ret_code = i40e_read_nvm_word_srctl(hw, offset, data); ++ i40e_release_nvm(hw); + } + return ret_code; + } +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 8aecea0d5dbf..142015af43db 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -282,6 +282,10 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb, + if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS) + success = true; + } else { ++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest, ++ ipvlan->phy_dev->dev_addr)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + ret = RX_HANDLER_ANOTHER; + success = true; + } +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index ba21d072be31..6b4cc1c2e6b4 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -399,6 +399,9 @@ static int veth_newlink(struct net *src_net, struct net_device *dev, + if (ifmp && (dev->ifindex != 0)) + peer->ifindex = ifmp->ifi_index; + ++ peer->gso_max_size = dev->gso_max_size; ++ peer->gso_max_segs = dev->gso_max_segs; ++ + err = register_netdevice(peer); + put_net(net); + net = NULL; +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index dab3bf6649e6..e4ff1e45c02e 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2834,6 +2834,11 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev, + needed_headroom = lowerdev->hard_header_len; + } + ++ if (lowerdev) { ++ dev->gso_max_size = lowerdev->gso_max_size; ++ dev->gso_max_segs = lowerdev->gso_max_segs; ++ } ++ + if (conf->mtu) { + err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false); + if (err) +diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c +index 1a88a24ffeac..30c357567054 100644 +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -1892,6 +1892,15 @@ static ssize_t ath10k_write_simulate_radar(struct file *file, + size_t count, loff_t *ppos) + { + struct ath10k *ar = file->private_data; ++ struct ath10k_vif *arvif; ++ ++ /* Just check for for the first vif alone, as all the vifs will be ++ * sharing the same channel and if the channel is disabled, all the ++ * vifs will share the same 'is_started' state. ++ */ ++ arvif = list_first_entry(&ar->arvifs, typeof(*arvif), list); ++ if (!arvif->is_started) ++ return -EINVAL; + + ieee80211_radar_detected(ar->hw); + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index bed8d89fe3a0..09e14ce85dd0 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5497,6 +5497,16 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + "mac vdev %d peer delete %pM (sta gone)\n", + arvif->vdev_id, sta->addr); + ++ if (sta->tdls) { ++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, ++ sta, ++ WMI_TDLS_PEER_STATE_TEARDOWN); ++ if (ret) ++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n", ++ sta->addr, ++ WMI_TDLS_PEER_STATE_TEARDOWN, ret); ++ } ++ + ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + if (ret) + ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n", +@@ -6427,7 +6437,7 @@ ath10k_mac_update_rx_channel(struct ath10k *ar, + lockdep_assert_held(&ar->data_lock); + + WARN_ON(ctx && vifs); +- WARN_ON(vifs && n_vifs != 1); ++ WARN_ON(vifs && !n_vifs); + + /* FIXME: Sort of an optimization and a workaround. Peers and vifs are + * on a linked list now. Doing a lookup peer -> vif -> chanctx for each +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 72a4ef709577..a8b2553e8988 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -4826,7 +4826,8 @@ enum wmi_10_4_vdev_param { + #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3) + + #define WMI_TXBF_STS_CAP_OFFSET_LSB 4 +-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0 ++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70 ++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7) + #define WMI_BF_SOUND_DIM_OFFSET_LSB 8 + #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00 + +diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c +index 85bca557a339..f09fafaaaf1a 100644 +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -125,9 +125,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src, + u32 *d = dst; + const volatile u32 __iomem *s = src; + +- /* size_t is unsigned, if (count%4 != 0) it will wrap */ +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + *d++ = __raw_readl(s++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = __raw_readl(s); ++ ++ memcpy(d, &tmp, count); ++ } + } + + void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, +@@ -136,8 +142,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, + volatile u32 __iomem *d = dst; + const u32 *s = src; + +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + __raw_writel(*s++, d++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = 0; ++ ++ memcpy(&tmp, s, count); ++ __raw_writel(tmp, d); ++ } + } + + static void wil_disconnect_cid(struct wil6210_priv *wil, int cid, +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index f877fbc7d7af..8a9164da6c50 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -699,16 +699,21 @@ static int hwsim_fops_ps_write(void *dat, u64 val) + val != PS_MANUAL_POLL) + return -EINVAL; + +- old_ps = data->ps; +- data->ps = val; +- +- local_bh_disable(); + if (val == PS_MANUAL_POLL) { ++ if (data->ps != PS_ENABLED) ++ return -EINVAL; ++ local_bh_disable(); + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_ps_poll, data); +- data->ps_poll_pending = true; +- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) { ++ local_bh_enable(); ++ return 0; ++ } ++ old_ps = data->ps; ++ data->ps = val; ++ ++ local_bh_disable(); ++ if (old_ps == PS_DISABLED && val != PS_DISABLED) { + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_nullfunc_ps, data); +diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c +index af62c4c854f3..b4f31dad40d6 100644 +--- a/drivers/nfc/nfcmrvl/fw_dnld.c ++++ b/drivers/nfc/nfcmrvl/fw_dnld.c +@@ -17,7 +17,7 @@ + */ + + #include <linux/module.h> +-#include <linux/unaligned/access_ok.h> ++#include <asm/unaligned.h> + #include <linux/firmware.h> + #include <linux/nfc.h> + #include <net/nfc/nci.h> +diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c +index a7faa0bcc01e..fc8e78a29d77 100644 +--- a/drivers/nfc/nfcmrvl/spi.c ++++ b/drivers/nfc/nfcmrvl/spi.c +@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv, + /* Send the SPI packet */ + err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion, + skb); +- if (err != 0) { ++ if (err) + nfc_err(priv->dev, "spi_send failed %d", err); +- kfree_skb(skb); +- } ++ + return err; + } + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 97a280d50d6d..7c509bff9295 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -223,7 +223,7 @@ ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len) + str[i] = '_'; + } + +- return tsize; ++ return repend; + } + EXPORT_SYMBOL_GPL(of_device_get_modalias); + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 32bd8ab79d53..5e42b5f2f565 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -463,8 +463,6 @@ static void pci_device_shutdown(struct device *dev) + + if (drv && drv->shutdown) + drv->shutdown(pci_dev); +- pci_msi_shutdown(pci_dev); +- pci_msix_shutdown(pci_dev); + + #ifdef CONFIG_KEXEC_CORE + /* +diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c +index 8af1f900ea65..1ba58fb6f796 100644 +--- a/drivers/perf/arm_pmu.c ++++ b/drivers/perf/arm_pmu.c +@@ -321,10 +321,16 @@ validate_group(struct perf_event *event) + return 0; + } + ++static struct arm_pmu_platdata *armpmu_get_platdata(struct arm_pmu *armpmu) ++{ ++ struct platform_device *pdev = armpmu->plat_device; ++ ++ return pdev ? dev_get_platdata(&pdev->dev) : NULL; ++} ++ + static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + { + struct arm_pmu *armpmu; +- struct platform_device *plat_device; + struct arm_pmu_platdata *plat; + int ret; + u64 start_clock, finish_clock; +@@ -336,8 +342,8 @@ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + * dereference. + */ + armpmu = *(void **)dev; +- plat_device = armpmu->plat_device; +- plat = dev_get_platdata(&plat_device->dev); ++ ++ plat = armpmu_get_platdata(armpmu); + + start_clock = sched_clock(); + if (plat && plat->handle_irq) +diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c +index d4de0607b502..3039fb762893 100644 +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -69,6 +69,7 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip); + unsigned long long c; + unsigned long rate, hz; ++ unsigned long long ns100 = NSEC_PER_SEC; + u32 val = 0; + int err; + +@@ -87,9 +88,11 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + * cycles at the PWM clock rate will take period_ns nanoseconds. + */ + rate = clk_get_rate(pc->clk) >> PWM_DUTY_WIDTH; +- hz = NSEC_PER_SEC / period_ns; + +- rate = (rate + (hz / 2)) / hz; ++ /* Consider precision in PWM_SCALE_WIDTH rate calculation */ ++ ns100 *= 100; ++ hz = DIV_ROUND_CLOSEST_ULL(ns100, period_ns); ++ rate = DIV_ROUND_CLOSEST(rate * 100, hz); + + /* + * Since the actual PWM divider is the register's frequency divider +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 7a58128a0000..2f61d8cd5882 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -835,8 +835,10 @@ static void ipr_sata_eh_done(struct ipr_cmnd *ipr_cmd) + + qc->err_mask |= AC_ERR_OTHER; + sata_port->ioasa.status |= ATA_BUSY; +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + ata_qc_complete(qc); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -5864,8 +5866,10 @@ static void ipr_erp_done(struct ipr_cmnd *ipr_cmd) + res->in_erp = 0; + } + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6255,8 +6259,10 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg, + } + + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6282,8 +6288,10 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd) + scsi_dma_unmap(scsi_cmd); + + spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); + } else { + spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 60720e5b1ebc..6b61b09b3226 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -180,7 +180,7 @@ static struct { + {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */ +- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */ ++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */ + {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN}, + {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD}, + {"HP", "C1557A", NULL, BLIST_FORCELUN}, +@@ -589,17 +589,12 @@ int scsi_get_device_flags_keyed(struct scsi_device *sdev, + int key) + { + struct scsi_dev_info_list *devinfo; +- int err; + + devinfo = scsi_dev_info_list_find(vendor, model, key); + if (!IS_ERR(devinfo)) + return devinfo->flags; + +- err = PTR_ERR(devinfo); +- if (err != -ENOENT) +- return err; +- +- /* nothing found, return nothing */ ++ /* key or device not found: return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; + +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index 4d655b568269..5711d58f9e81 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { + {"IBM", "1815", "rdac", }, + {"IBM", "1818", "rdac", }, + {"IBM", "3526", "rdac", }, ++ {"IBM", "3542", "rdac", }, ++ {"IBM", "3552", "rdac", }, + {"SGI", "TP9", "rdac", }, + {"SGI", "IS", "rdac", }, +- {"STK", "OPENstorage D280", "rdac", }, ++ {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, ++ {"STK", "BladeCtlr", "rdac", }, + {"SUN", "CSM", "rdac", }, + {"SUN", "LCSM100", "rdac", }, + {"SUN", "STK6580_6780", "rdac", }, +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 044d06410d4c..01168acc864d 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -546,7 +546,6 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + ecomp = &edev->component[components++]; + + if (!IS_ERR(ecomp)) { +- ses_get_power_status(edev, ecomp); + if (addl_desc_ptr) + ses_process_descriptor( + ecomp, +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 0f0ff75755e0..4b43effbf4fc 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -535,6 +535,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + } else + count = (old_hdr->result == 0) ? 0 : -EIO; + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + retval = count; + free_old_hdr: + kfree(old_hdr); +@@ -575,6 +576,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) + } + err_out: + err2 = sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return err ? : err2 ? : count; + } + +@@ -674,18 +676,14 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + * is a non-zero input_size, so emit a warning. + */ + if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) { +- static char cmd[TASK_COMM_LEN]; +- if (strcmp(current->comm, cmd)) { +- printk_ratelimited(KERN_WARNING +- "sg_write: data in/out %d/%d bytes " +- "for SCSI command 0x%x-- guessing " +- "data in;\n program %s not setting " +- "count and/or reply_len properly\n", +- old_hdr.reply_len - (int)SZ_SG_HEADER, +- input_size, (unsigned int) cmnd[0], +- current->comm); +- strcpy(cmd, current->comm); +- } ++ printk_ratelimited(KERN_WARNING ++ "sg_write: data in/out %d/%d bytes " ++ "for SCSI command 0x%x-- guessing " ++ "data in;\n program %s not setting " ++ "count and/or reply_len properly\n", ++ old_hdr.reply_len - (int)SZ_SG_HEADER, ++ input_size, (unsigned int) cmnd[0], ++ current->comm); + } + k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking); + return (k < 0) ? k : count; +@@ -784,11 +782,15 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, + "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", + (int) cmnd[0], (int) hp->cmd_len)); + ++ if (hp->dxfer_len >= SZ_256M) ++ return -EINVAL; ++ + k = sg_start_req(srp, cmnd); + if (k) { + SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp, + "sg_common_write: start_req err=%d\n", k)); + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return k; /* probably out of space --> ENOMEM */ + } + if (atomic_read(&sdp->detaching)) { +@@ -801,6 +803,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, + } + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return -ENODEV; + } + +@@ -1290,6 +1293,7 @@ sg_rq_end_io_usercontext(struct work_struct *work) + struct sg_fd *sfp = srp->parentfp; + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + kref_put(&sfp->f_ref, sg_remove_sfp); + } + +@@ -1834,8 +1838,6 @@ sg_finish_rem_req(Sg_request *srp) + else + sg_remove_scat(sfp, req_schp); + +- sg_remove_request(sfp, srp); +- + return ret; + } + +@@ -2182,12 +2184,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) + struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); + struct sg_device *sdp = sfp->parentdp; + Sg_request *srp; ++ unsigned long iflags; + + /* Cleanup any responses which were never read(). */ ++ write_lock_irqsave(&sfp->rq_list_lock, iflags); + while (!list_empty(&sfp->rq_list)) { + srp = list_first_entry(&sfp->rq_list, Sg_request, entry); + sg_finish_rem_req(srp); ++ list_del(&srp->entry); ++ srp->parentfp = NULL; + } ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + if (sfp->reserve.bufflen > 0) { + SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp, +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index ed8283e7397a..83b53cd956aa 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -457,6 +457,8 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + int elements = 0; + int word_len, element_count; + struct omap2_mcspi_cs *cs = spi->controller_state; ++ void __iomem *chstat_reg = cs->base + OMAP2_MCSPI_CHSTAT0; ++ + mcspi = spi_master_get_devdata(spi->master); + mcspi_dma = &mcspi->dma_channels[spi->chip_select]; + count = xfer->len; +@@ -517,8 +519,8 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + if (l & OMAP2_MCSPI_CHCONF_TURBO) { + elements--; + +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, ++ OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); +@@ -536,8 +538,7 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + return count; + } + } +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index e77add01b0e9..48888ab630c2 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -457,7 +457,7 @@ err_free_master: + + static int sun6i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } +diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c +index fdfeb42b2b8f..06ef26872462 100644 +--- a/drivers/staging/speakup/kobjects.c ++++ b/drivers/staging/speakup/kobjects.c +@@ -831,7 +831,9 @@ static ssize_t message_show(struct kobject *kobj, + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + unsigned long flags; + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + spin_lock_irqsave(&speakup_info.spinlock, flags); + retval = message_show_helper(buf, group->start, group->end); + spin_unlock_irqrestore(&speakup_info.spinlock, flags); +@@ -843,7 +845,9 @@ static ssize_t message_store(struct kobject *kobj, struct kobj_attribute *attr, + { + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + return message_store_helper(buf, count, group); + } + +diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c +index dbbe72c7e255..f78353ddeea5 100644 +--- a/drivers/staging/wilc1000/host_interface.c ++++ b/drivers/staging/wilc1000/host_interface.c +@@ -2179,6 +2179,8 @@ static s32 Handle_Get_InActiveTime(struct host_if_drv *hif_drv, + wid.type = WID_STR; + wid.size = ETH_ALEN; + wid.val = kmalloc(wid.size, GFP_KERNEL); ++ if (!wid.val) ++ return -ENOMEM; + + stamac = wid.val; + memcpy(stamac, strHostIfStaInactiveT->mac, ETH_ALEN); +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 571c21727ff9..88bd950665fa 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1385,6 +1385,7 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + dwc2_core_init(hsotg, false, -1); + dwc2_enable_global_interrupts(hsotg); + spin_lock_irqsave(&hsotg->lock, flags); ++ dwc2_hsotg_disconnect(hsotg); + dwc2_hsotg_core_init_disconnected(hsotg, false); + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_hsotg_core_connect(hsotg); +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index ccb9c213cc9f..e9bd8d4abca0 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -475,7 +475,7 @@ static int bdc_probe(struct platform_device *pdev) + bdc->dev = dev; + dev_dbg(bdc->dev, "bdc->regs: %p irq=%d\n", bdc->regs, bdc->irq); + +- temp = bdc_readl(bdc->regs, BDC_BDCSC); ++ temp = bdc_readl(bdc->regs, BDC_BDCCAP1); + if ((temp & BDC_P64) && + !dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64))) { + dev_dbg(bdc->dev, "Using 64-bit address\n"); +diff --git a/drivers/usb/gadget/udc/bdc/bdc_pci.c b/drivers/usb/gadget/udc/bdc/bdc_pci.c +index 02968842b359..708e36f530d8 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c +@@ -82,6 +82,7 @@ static int bdc_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + dev_err(&pci->dev, + "couldn't add resources to bdc device\n"); ++ platform_device_put(bdc); + return ret; + } + +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 8080a11947b7..eb876ed96861 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2105,16 +2105,13 @@ static int dummy_hub_control( + } + break; + case USB_PORT_FEAT_POWER: +- if (hcd->speed == HCD_USB3) { +- if (dum_hcd->port_status & USB_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- } else +- if (dum_hcd->port_status & +- USB_SS_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- /* FALLS THROUGH */ ++ dev_dbg(dummy_dev(dum_hcd), "power-off\n"); ++ if (hcd->speed == HCD_USB3) ++ dum_hcd->port_status &= ~USB_SS_PORT_STAT_POWER; ++ else ++ dum_hcd->port_status &= ~USB_PORT_STAT_POWER; ++ set_link_state(dum_hcd); ++ break; + default: + dum_hcd->port_status &= ~(1 << wValue); + set_link_state(dum_hcd); +@@ -2285,14 +2282,13 @@ static int dummy_hub_control( + if ((dum_hcd->port_status & + USB_SS_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } + } else + if ((dum_hcd->port_status & + USB_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } ++ set_link_state(dum_hcd); + } + break; + case GetPortErrorCount: +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 9362424c2340..924b3d6c3e9b 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -759,8 +759,8 @@ static int clcdfb_of_dma_setup(struct clcd_fb *fb) + if (err) + return err; + +- framesize = fb->panel->mode.xres * fb->panel->mode.yres * +- fb->panel->bpp / 8; ++ framesize = PAGE_ALIGN(fb->panel->mode.xres * fb->panel->mode.yres * ++ fb->panel->bpp / 8); + fb->fb.screen_base = dma_alloc_coherent(&fb->dev->dev, framesize, + &dma, GFP_KERNEL); + if (!fb->fb.screen_base) +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index 162689227a23..b73520aaf697 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hdmi_vendor_infoframe *frame) + } + EXPORT_SYMBOL(hdmi_vendor_infoframe_init); + ++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame) ++{ ++ /* for side by side (half) we also need to provide 3D_Ext_Data */ ++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) ++ return 6; ++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) ++ return 5; ++ else ++ return 4; ++} ++ + /** + * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer + * @frame: HDMI infoframe +@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + u8 *ptr = buffer; + size_t length; + +- /* empty info frame */ +- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID) +- return -EINVAL; +- + /* only one of those can be supplied */ + if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) + return -EINVAL; + +- /* for side by side (half) we also need to provide 3D_Ext_Data */ +- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) +- frame->length = 6; +- else +- frame->length = 5; ++ frame->length = hdmi_vendor_infoframe_length(frame); + + length = HDMI_INFOFRAME_HEADER_SIZE + frame->length; + +@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + ptr[5] = 0x0c; + ptr[6] = 0x00; + +- if (frame->vic) { +- ptr[7] = 0x1 << 5; /* video format */ +- ptr[8] = frame->vic; +- } else { ++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) { + ptr[7] = 0x2 << 5; /* video format */ + ptr[8] = (frame->s3d_struct & 0xf) << 4; + if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) + ptr[9] = (frame->s3d_ext_data & 0xf) << 4; ++ } else if (frame->vic) { ++ ptr[7] = 0x1 << 5; /* video format */ ++ ptr[8] = frame->vic; ++ } else { ++ ptr[7] = 0x0 << 5; /* video format */ + } + + hdmi_infoframe_set_checksum(buffer, length); +@@ -1161,7 +1166,7 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR || + ptr[1] != 1 || +- (ptr[2] != 5 && ptr[2] != 6)) ++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6)) + return -EINVAL; + + length = ptr[2]; +@@ -1189,16 +1194,22 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + hvf->length = length; + +- if (hdmi_video_format == 0x1) { +- hvf->vic = ptr[4]; +- } else if (hdmi_video_format == 0x2) { ++ if (hdmi_video_format == 0x2) { ++ if (length != 5 && length != 6) ++ return -EINVAL; + hvf->s3d_struct = ptr[4] >> 4; + if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) { +- if (length == 6) +- hvf->s3d_ext_data = ptr[5] >> 4; +- else ++ if (length != 6) + return -EINVAL; ++ hvf->s3d_ext_data = ptr[5] >> 4; + } ++ } else if (hdmi_video_format == 0x1) { ++ if (length != 5) ++ return -EINVAL; ++ hvf->vic = ptr[4]; ++ } else { ++ if (length != 4) ++ return -EINVAL; + } + + return 0; +diff --git a/fs/aio.c b/fs/aio.c +index fe4f49212b99..88ede4a84ce0 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -68,9 +68,9 @@ struct aio_ring { + #define AIO_RING_PAGES 8 + + struct kioctx_table { +- struct rcu_head rcu; +- unsigned nr; +- struct kioctx *table[]; ++ struct rcu_head rcu; ++ unsigned nr; ++ struct kioctx __rcu *table[]; + }; + + struct kioctx_cpu { +@@ -115,7 +115,8 @@ struct kioctx { + struct page **ring_pages; + long nr_pages; + +- struct work_struct free_work; ++ struct rcu_head free_rcu; ++ struct work_struct free_work; /* see free_ioctx() */ + + /* + * signals when all in-flight requests are done +@@ -326,7 +327,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma) + for (i = 0; i < table->nr; i++) { + struct kioctx *ctx; + +- ctx = table->table[i]; ++ ctx = rcu_dereference(table->table[i]); + if (ctx && ctx->aio_ring_file == file) { + if (!atomic_read(&ctx->dead)) { + ctx->user_id = ctx->mmap_base = vma->vm_start; +@@ -573,6 +574,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb) + return cancel(&kiocb->common); + } + ++/* ++ * free_ioctx() should be RCU delayed to synchronize against the RCU ++ * protected lookup_ioctx() and also needs process context to call ++ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and ++ * ->free_work. ++ */ + static void free_ioctx(struct work_struct *work) + { + struct kioctx *ctx = container_of(work, struct kioctx, free_work); +@@ -586,6 +593,14 @@ static void free_ioctx(struct work_struct *work) + kmem_cache_free(kioctx_cachep, ctx); + } + ++static void free_ioctx_rcufn(struct rcu_head *head) ++{ ++ struct kioctx *ctx = container_of(head, struct kioctx, free_rcu); ++ ++ INIT_WORK(&ctx->free_work, free_ioctx); ++ schedule_work(&ctx->free_work); ++} ++ + static void free_ioctx_reqs(struct percpu_ref *ref) + { + struct kioctx *ctx = container_of(ref, struct kioctx, reqs); +@@ -594,8 +609,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref) + if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count)) + complete(&ctx->rq_wait->comp); + +- INIT_WORK(&ctx->free_work, free_ioctx); +- schedule_work(&ctx->free_work); ++ /* Synchronize against RCU protected table->table[] dereferences */ ++ call_rcu(&ctx->free_rcu, free_ioctx_rcufn); + } + + /* +@@ -636,9 +651,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm) + while (1) { + if (table) + for (i = 0; i < table->nr; i++) +- if (!table->table[i]) { ++ if (!rcu_access_pointer(table->table[i])) { + ctx->id = i; +- table->table[i] = ctx; ++ rcu_assign_pointer(table->table[i], ctx); + spin_unlock(&mm->ioctx_lock); + + /* While kioctx setup is in progress, +@@ -813,11 +828,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx, + } + + table = rcu_dereference_raw(mm->ioctx_table); +- WARN_ON(ctx != table->table[ctx->id]); +- table->table[ctx->id] = NULL; ++ WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id])); ++ RCU_INIT_POINTER(table->table[ctx->id], NULL); + spin_unlock(&mm->ioctx_lock); + +- /* percpu_ref_kill() will do the necessary call_rcu() */ ++ /* free_ioctx_reqs() will do the necessary RCU synchronization */ + wake_up_all(&ctx->wait); + + /* +@@ -859,7 +874,8 @@ void exit_aio(struct mm_struct *mm) + + skipped = 0; + for (i = 0; i < table->nr; ++i) { +- struct kioctx *ctx = table->table[i]; ++ struct kioctx *ctx = ++ rcu_dereference_protected(table->table[i], true); + + if (!ctx) { + skipped++; +@@ -1048,7 +1064,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) + if (!table || id >= table->nr) + goto out; + +- ctx = table->table[id]; ++ ctx = rcu_dereference(table->table[id]); + if (ctx && ctx->user_id == ctx_id) { + percpu_ref_get(&ctx->users); + ret = ctx; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 600c67ef8a03..6d874b1cd53c 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -568,6 +568,7 @@ void btrfs_free_stale_device(struct btrfs_device *cur_dev) + btrfs_sysfs_remove_fsid(fs_devs); + list_del(&fs_devs->list); + free_fs_devices(fs_devs); ++ break; + } else { + fs_devs->num_devices--; + list_del(&dev->dev_list); +@@ -4638,10 +4639,13 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + if (devs_max && ndevs > devs_max) + ndevs = devs_max; + /* +- * the primary goal is to maximize the number of stripes, so use as many +- * devices as possible, even if the stripes are not maximum sized. ++ * The primary goal is to maximize the number of stripes, so use as ++ * many devices as possible, even if the stripes are not maximum sized. ++ * ++ * The DUP profile stores more than one stripe per device, the ++ * max_avail is the total size so we have to adjust. + */ +- stripe_size = devices_info[ndevs-1].max_avail; ++ stripe_size = div_u64(devices_info[ndevs - 1].max_avail, dev_stripes); + num_stripes = ndevs * dev_stripes; + + /* +@@ -4681,8 +4685,6 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + stripe_size = devices_info[ndevs-1].max_avail; + } + +- stripe_size = div_u64(stripe_size, dev_stripes); +- + /* align to BTRFS_STRIPE_LEN */ + stripe_size = div_u64(stripe_size, raid_stripe_len); + stripe_size *= raid_stripe_len; +diff --git a/fs/dcache.c b/fs/dcache.c +index 3ed642e0a0c2..751a0d88f049 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -634,11 +634,16 @@ again: + spin_unlock(&parent->d_lock); + goto again; + } +- rcu_read_unlock(); +- if (parent != dentry) ++ if (parent != dentry) { + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +- else ++ if (unlikely(dentry->d_lockref.count < 0)) { ++ spin_unlock(&parent->d_lock); ++ parent = NULL; ++ } ++ } else { + parent = NULL; ++ } ++ rcu_read_unlock(); + return parent; + } + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index fedbf67a0842..928b9e046d8a 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -522,8 +522,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + get_node_info(sbi, nid, dni); + + if (sum->version != dni->version) { +- f2fs_put_page(node_page, 1); +- return false; ++ f2fs_msg(sbi->sb, KERN_WARNING, ++ "%s: valid data with mismatched node version.", ++ __func__); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); + } + + *nofs = ofs_of_node(node_page); +diff --git a/fs/namei.c b/fs/namei.c +index 844da20232b9..0fcad42e4d3e 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -570,9 +570,10 @@ static int __nd_alloc_stack(struct nameidata *nd) + static bool path_connected(const struct path *path) + { + struct vfsmount *mnt = path->mnt; ++ struct super_block *sb = mnt->mnt_sb; + +- /* Only bind mounts can have disconnected paths */ +- if (mnt->mnt_root == mnt->mnt_sb->s_root) ++ /* Bind mounts and multi-root filesystems can have disconnected paths */ ++ if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root)) + return true; + + return is_subdir(path->dentry, mnt->mnt_root); +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index 3149f7e58d6f..62f358f67764 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2581,6 +2581,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server, + /* initial superblock/root creation */ + mount_info->fill_super(s, mount_info); + nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned); ++ if (!(server->flags & NFS_MOUNT_UNSHARED)) ++ s->s_iflags |= SB_I_MULTIROOT; + } + + mntroot = nfs_get_root(s, mount_info->mntfh, dev_name); +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 9d6486d416a3..a72097b625ef 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -1961,7 +1961,7 @@ static int do_journal_release(struct reiserfs_transaction_handle *th, + * will be requeued because superblock is being shutdown and doesn't + * have MS_ACTIVE set. + */ +- cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work); ++ reiserfs_cancel_old_flush(sb); + /* wait for all commits to finish */ + cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work); + +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index 5dcf3ab83886..6ca00471afbf 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -2948,6 +2948,7 @@ int reiserfs_allocate_list_bitmaps(struct super_block *s, + struct reiserfs_list_bitmap *, unsigned int); + + void reiserfs_schedule_old_flush(struct super_block *s); ++void reiserfs_cancel_old_flush(struct super_block *s); + void add_save_link(struct reiserfs_transaction_handle *th, + struct inode *inode, int truncate); + int remove_save_link(struct inode *inode, int truncate); +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index f9f3be50081a..ee095246da4e 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -90,7 +90,9 @@ static void flush_old_commits(struct work_struct *work) + s = sbi->s_journal->j_work_sb; + + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Avoid clobbering the cancel state... */ ++ if (sbi->work_queued == 1) ++ sbi->work_queued = 0; + spin_unlock(&sbi->old_work_lock); + + reiserfs_sync_fs(s, 1); +@@ -117,21 +119,22 @@ void reiserfs_schedule_old_flush(struct super_block *s) + spin_unlock(&sbi->old_work_lock); + } + +-static void cancel_old_flush(struct super_block *s) ++void reiserfs_cancel_old_flush(struct super_block *s) + { + struct reiserfs_sb_info *sbi = REISERFS_SB(s); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Make sure no new flushes will be queued */ ++ sbi->work_queued = 2; + spin_unlock(&sbi->old_work_lock); ++ cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + } + + static int reiserfs_freeze(struct super_block *s) + { + struct reiserfs_transaction_handle th; + +- cancel_old_flush(s); ++ reiserfs_cancel_old_flush(s); + + reiserfs_write_lock(s); + if (!(s->s_flags & MS_RDONLY)) { +@@ -152,7 +155,13 @@ static int reiserfs_freeze(struct super_block *s) + + static int reiserfs_unfreeze(struct super_block *s) + { ++ struct reiserfs_sb_info *sbi = REISERFS_SB(s); ++ + reiserfs_allow_writes(s); ++ spin_lock(&sbi->old_work_lock); ++ /* Allow old_work to run again */ ++ sbi->work_queued = 0; ++ spin_unlock(&sbi->old_work_lock); + return 0; + } + +@@ -2187,7 +2196,7 @@ error_unlocked: + if (sbi->commit_wq) + destroy_workqueue(sbi->commit_wq); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); ++ reiserfs_cancel_old_flush(s); + + reiserfs_free_bitmap_cache(s); + if (SB_BUFFER_WITH_SB(s)) +diff --git a/include/linux/fs.h b/include/linux/fs.h +index f746a59fcc88..da79e9d66e5b 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1295,6 +1295,7 @@ struct mm_struct; + /* sb->s_iflags */ + #define SB_I_CGROUPWB 0x00000001 /* cgroup-aware writeback enabled */ + #define SB_I_NOEXEC 0x00000002 /* Ignore executables on this fs */ ++#define SB_I_MULTIROOT 0x00000008 /* Multiple roots to the dentry tree */ + + /* Possible states of 'frozen' field */ + enum { +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index fbfadba81c5a..771774e13f10 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -153,7 +153,7 @@ static inline int page_cache_get_speculative(struct page *page) + + #ifdef CONFIG_TINY_RCU + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + /* + * Preempt must be disabled here - we rely on rcu_read_lock doing +@@ -191,7 +191,7 @@ static inline int page_cache_add_speculative(struct page *page, int count) + + #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU) + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + VM_BUG_ON_PAGE(page_count(page) == 0, page); + atomic_add(count, &page->_count); +diff --git a/include/linux/platform_data/isl9305.h b/include/linux/platform_data/isl9305.h +index 1419133fa69e..4ac1a070af0a 100644 +--- a/include/linux/platform_data/isl9305.h ++++ b/include/linux/platform_data/isl9305.h +@@ -24,7 +24,7 @@ + struct regulator_init_data; + + struct isl9305_pdata { +- struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR]; ++ struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR + 1]; + }; + + #endif +diff --git a/include/net/tcp.h b/include/net/tcp.h +index cecb0e0eff06..a3696b778757 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1199,9 +1199,11 @@ void tcp_select_initial_window(int __space, __u32 mss, __u32 *rcv_wnd, + + static inline int tcp_win_from_space(int space) + { +- return sysctl_tcp_adv_win_scale<=0 ? +- (space>>(-sysctl_tcp_adv_win_scale)) : +- space - (space>>sysctl_tcp_adv_win_scale); ++ int tcp_adv_win_scale = sysctl_tcp_adv_win_scale; ++ ++ return tcp_adv_win_scale <= 0 ? ++ (space>>(-tcp_adv_win_scale)) : ++ space - (space>>tcp_adv_win_scale); + } + + /* Note: caller must be prepared to deal with negative returns */ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c14003840bc5..79e3c21a35d0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1135,7 +1135,8 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn) + regs[insn->dst_reg].type = UNKNOWN_VALUE; + regs[insn->dst_reg].map_ptr = NULL; + } +- } else { ++ } else if (BPF_CLASS(insn->code) == BPF_ALU64 || ++ insn->imm >= 0) { + /* case: R = imm + * remember the value we stored into this reg + */ +diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c +index d5760c42f042..61d41ca41844 100644 +--- a/kernel/printk/braille.c ++++ b/kernel/printk/braille.c +@@ -2,12 +2,13 @@ + + #include <linux/kernel.h> + #include <linux/console.h> ++#include <linux/errno.h> + #include <linux/string.h> + + #include "console_cmdline.h" + #include "braille.h" + +-char *_braille_console_setup(char **str, char **brl_options) ++int _braille_console_setup(char **str, char **brl_options) + { + if (!strncmp(*str, "brl,", 4)) { + *brl_options = ""; +@@ -15,14 +16,14 @@ char *_braille_console_setup(char **str, char **brl_options) + } else if (!strncmp(*str, "brl=", 4)) { + *brl_options = *str + 4; + *str = strchr(*brl_options, ','); +- if (!*str) ++ if (!*str) { + pr_err("need port name after brl=\n"); +- else +- *((*str)++) = 0; +- } else +- return NULL; ++ return -EINVAL; ++ } ++ *((*str)++) = 0; ++ } + +- return *str; ++ return 0; + } + + int +diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h +index 769d771145c8..749a6756843a 100644 +--- a/kernel/printk/braille.h ++++ b/kernel/printk/braille.h +@@ -9,7 +9,14 @@ braille_set_options(struct console_cmdline *c, char *brl_options) + c->brl_options = brl_options; + } + +-char * ++/* ++ * Setup console according to braille options. ++ * Return -EINVAL on syntax error, 0 on success (or no braille option was ++ * actually given). ++ * Modifies str to point to the serial options ++ * Sets brl_options to the parsed braille options. ++ */ ++int + _braille_console_setup(char **str, char **brl_options); + + int +@@ -25,10 +32,10 @@ braille_set_options(struct console_cmdline *c, char *brl_options) + { + } + +-static inline char * ++static inline int + _braille_console_setup(char **str, char **brl_options) + { +- return NULL; ++ return 0; + } + + static inline int +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index c5b1c62623cf..65ed3501c2ca 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -601,7 +601,8 @@ void resched_cpu(int cpu) + unsigned long flags; + + raw_spin_lock_irqsave(&rq->lock, flags); +- resched_curr(rq); ++ if (cpu_online(cpu) || cpu == smp_processor_id()) ++ resched_curr(rq); + raw_spin_unlock_irqrestore(&rq->lock, flags); + } + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index e0b5169aeac4..2ef31c93e195 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2144,7 +2144,7 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p) + if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) + queue_push_tasks(rq); + #endif /* CONFIG_SMP */ +- if (p->prio < rq->curr->prio) ++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq))) + resched_curr(rq); + } + } +diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c +index a26036d37a38..382b159d8592 100644 +--- a/kernel/time/sched_clock.c ++++ b/kernel/time/sched_clock.c +@@ -205,6 +205,11 @@ sched_clock_register(u64 (*read)(void), int bits, unsigned long rate) + + update_clock_read_data(&rd); + ++ if (sched_clock_timer.function != NULL) { ++ /* update timeout for clock wrap */ ++ hrtimer_start(&sched_clock_timer, cd.wrap_kt, HRTIMER_MODE_REL); ++ } ++ + r = rate; + if (r >= 4000000) { + r /= 1000000; +diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c +index ba7d8b288bb3..ef4f16e81283 100644 +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -16,6 +16,7 @@ + #include <linux/sched.h> + #include <linux/seq_file.h> + #include <linux/kallsyms.h> ++#include <linux/nmi.h> + + #include <asm/uaccess.h> + +@@ -96,6 +97,9 @@ print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base, + + next_one: + i = 0; ++ ++ touch_nmi_watchdog(); ++ + raw_spin_lock_irqsave(&base->cpu_base->lock, flags); + + curr = timerqueue_getnext(&base->active); +@@ -207,6 +211,8 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu) + { + struct clock_event_device *dev = td->evtdev; + ++ touch_nmi_watchdog(); ++ + SEQ_printf(m, "Tick Device: mode: %d\n", td->mode); + if (cpu < 0) + SEQ_printf(m, "Broadcast device\n"); +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index ca4dc9031073..89da689b6433 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -559,8 +559,7 @@ static int vlan_dev_init(struct net_device *dev) + NETIF_F_HIGHDMA | NETIF_F_SCTP_CSUM | + NETIF_F_ALL_FCOE; + +- dev->features |= real_dev->vlan_features | NETIF_F_LLTX | +- NETIF_F_GSO_SOFTWARE; ++ dev->features |= dev->hw_features | NETIF_F_LLTX; + dev->gso_max_size = real_dev->gso_max_size; + if (dev->features & NETIF_F_VLAN_FEATURES) + netdev_warn(real_dev, "VLAN features are set incorrectly. Q-in-Q configurations may not work correctly.\n"); +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index f5d2fe5e31cc..c5208136e3fc 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -1603,10 +1603,22 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, + /* if yes, the client has roamed and we have + * to unclaim it. + */ +- batadv_handle_unclaim(bat_priv, primary_if, +- primary_if->net_dev->dev_addr, +- ethhdr->h_source, vid); +- goto allow; ++ if (batadv_has_timed_out(claim->lasttime, 100)) { ++ /* only unclaim if the last claim entry is ++ * older than 100 ms to make sure we really ++ * have a roaming client here. ++ */ ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Roaming client %pM detected. Unclaim it.\n", ++ ethhdr->h_source); ++ batadv_handle_unclaim(bat_priv, primary_if, ++ primary_if->net_dev->dev_addr, ++ ethhdr->h_source, vid); ++ goto allow; ++ } else { ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Race for claim %pM detected. Drop packet.\n", ++ ethhdr->h_source); ++ goto handled; ++ } + } + + /* check if it is a multicast/broadcast frame */ +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index bcb0a1b64556..58588a610b05 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1441,7 +1441,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata, + break; + case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: +- BUG(); ++ WARN_ON(1); + break; + } + +diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c +index eeb3eb3ea9eb..024d6cf342c5 100644 +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -175,6 +175,9 @@ static int tcf_csum_ipv4_tcp(struct sk_buff *skb, + struct tcphdr *tcph; + const struct iphdr *iph; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -196,6 +199,9 @@ static int tcf_csum_ipv6_tcp(struct sk_buff *skb, + struct tcphdr *tcph; + const struct ipv6hdr *ip6h; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -219,6 +225,9 @@ static int tcf_csum_ipv4_udp(struct sk_buff *skb, + const struct iphdr *iph; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, +@@ -272,6 +281,9 @@ static int tcf_csum_ipv6_udp(struct sk_buff *skb, + const struct ipv6hdr *ip6h; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 4b09a9eaa35f..d95cb69460f0 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1313,7 +1313,7 @@ EXPORT_SYMBOL(xfrm_policy_delete); + + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) + { +- struct net *net = xp_net(pol); ++ struct net *net = sock_net(sk); + struct xfrm_policy *old_pol; + + #ifdef CONFIG_XFRM_SUB_POLICY +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 9895a8c56d8c..96d664e198bf 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1845,6 +1845,13 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++ if (!optval && !optlen) { ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); ++ __sk_dst_reset(sk); ++ return 0; ++ } ++ + if (optlen <= 0 || optlen > PAGE_SIZE) + return -EMSGSIZE; + +diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c +index dec607c17b64..6dc4ce47580f 100644 +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -722,7 +722,7 @@ module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); + + /* Maximum pathname length before accesses will start getting rejected */ + unsigned int aa_g_path_max = 2 * PATH_MAX; +-module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR); ++module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); + + /* Determines how paranoid loading of policy is and how much verification + * on the loaded policy is done. +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 19014293f927..8da7c91b725d 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -206,7 +206,8 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, + if (opened & FILE_CREATED) + iint->flags |= IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && +- !(iint->flags & IMA_DIGSIG_REQUIRED)) ++ (!(iint->flags & IMA_DIGSIG_REQUIRED) || ++ (inode->i_size == 0))) + status = INTEGRITY_PASS; + goto out; + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 3f370eb494d1..4c7db967b7bb 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4124,10 +4124,18 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in + u32 sid, node_perm; + + if (family == PF_INET) { ++ if (addrlen < sizeof(struct sockaddr_in)) { ++ err = -EINVAL; ++ goto out; ++ } + addr4 = (struct sockaddr_in *)address; + snum = ntohs(addr4->sin_port); + addrp = (char *)&addr4->sin_addr.s_addr; + } else { ++ if (addrlen < SIN6_LEN_RFC2133) { ++ err = -EINVAL; ++ goto out; ++ } + addr6 = (struct sockaddr_in6 *)address; + snum = ntohs(addr6->sin6_port); + addrp = (char *)&addr6->sin6_addr.s6_addr; +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 494b7b533366..daa1feac66bf 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1814,10 +1814,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + return -ENOMEM; + _snd_pcm_hw_params_any(params); + err = snd_pcm_hw_refine(substream, params); +- format_mask = *hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); +- kfree(params); + if (err < 0) +- return err; ++ goto error; ++ format_mask = *hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); + for (fmt = 0; fmt < 32; ++fmt) { + if (snd_mask_test(&format_mask, fmt)) { + int f = snd_pcm_oss_format_to(fmt); +@@ -1825,7 +1824,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + formats |= f; + } + } +- return formats; ++ ++ error: ++ kfree(params); ++ return err < 0 ? err : formats; + } + + static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format) +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 94fd3df2cf21..73ee8476584d 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -270,12 +270,12 @@ static int seq_free_client1(struct snd_seq_client *client) + + if (!client) + return 0; +- snd_seq_delete_all_ports(client); +- snd_seq_queue_client_leave(client->number); + spin_lock_irqsave(&clients_lock, flags); + clienttablock[client->number] = 1; + clienttab[client->number] = NULL; + spin_unlock_irqrestore(&clients_lock, flags); ++ snd_seq_delete_all_ports(client); ++ snd_seq_queue_client_leave(client->number); + snd_use_lock_sync(&client->use_lock); + snd_seq_queue_client_termination(client->number); + if (client->pool) +diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c +index bc1c8488fc2a..2bc6759e4adc 100644 +--- a/sound/core/seq/seq_prioq.c ++++ b/sound/core/seq/seq_prioq.c +@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo) + if (f->cells > 0) { + /* drain prioQ */ + while (f->cells > 0) +- snd_seq_cell_free(snd_seq_prioq_cell_out(f)); ++ snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL)); + } + + kfree(f); +@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, + return 0; + } + ++/* return 1 if the current time >= event timestamp */ ++static int event_is_ready(struct snd_seq_event *ev, void *current_time) ++{ ++ if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK) ++ return snd_seq_compare_tick_time(current_time, &ev->time.tick); ++ else ++ return snd_seq_compare_real_time(current_time, &ev->time.time); ++} ++ + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) + spin_lock_irqsave(&f->lock, flags); + + cell = f->head; ++ if (cell && current_time && !event_is_ready(&cell->event, current_time)) ++ cell = NULL; + if (cell) { + f->head = cell->next; + +@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f) + return f->cells; + } + +- +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f) +-{ +- if (f == NULL) { +- pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n"); +- return NULL; +- } +- return f->head; +-} +- +- + static inline int prioq_match(struct snd_seq_event_cell *cell, + int client, int timestamp) + { +diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h +index d38bb78d9345..2c315ca10fc4 100644 +--- a/sound/core/seq/seq_prioq.h ++++ b/sound/core/seq/seq_prioq.h +@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo); + int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell); + + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f); ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time); + + /* return number of events available in prioq */ + int snd_seq_prioq_avail(struct snd_seq_prioq *f); + +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f); +- + /* client left queue */ + void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp); + +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 79e0c5604ef8..1a6dc4ff44a6 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + + __again: + /* Process tick queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) { +- if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick, +- &cell->event.time.tick)) { +- cell = snd_seq_prioq_cell_out(q->tickq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->tickq, ++ &q->timer->tick.cur_tick); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + +- + /* Process time queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) { +- if (snd_seq_compare_real_time(&q->timer->cur_time, +- &cell->event.time.time)) { +- cell = snd_seq_prioq_cell_out(q->timeq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + + /* free lock */ +diff --git a/sound/firewire/digi00x/amdtp-dot.c b/sound/firewire/digi00x/amdtp-dot.c +index b02a5e8cad44..30e4925bf6b0 100644 +--- a/sound/firewire/digi00x/amdtp-dot.c ++++ b/sound/firewire/digi00x/amdtp-dot.c +@@ -28,6 +28,9 @@ + */ + #define MAX_MIDI_RX_BLOCKS 8 + ++/* 3 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) + 1. */ ++#define MAX_MIDI_PORTS 3 ++ + /* + * The double-oh-three algorithm was discovered by Robin Gareus and Damien + * Zammit in 2012, with reverse-engineering for Digi 003 Rack. +@@ -42,10 +45,8 @@ struct amdtp_dot { + unsigned int pcm_channels; + struct dot_state state; + +- unsigned int midi_ports; +- /* 2 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) */ +- struct snd_rawmidi_substream *midi[2]; +- int midi_fifo_used[2]; ++ struct snd_rawmidi_substream *midi[MAX_MIDI_PORTS]; ++ int midi_fifo_used[MAX_MIDI_PORTS]; + int midi_fifo_limit; + + void (*transfer_samples)(struct amdtp_stream *s, +@@ -124,8 +125,8 @@ int amdtp_dot_set_parameters(struct amdtp_stream *s, unsigned int rate, + return -EBUSY; + + /* +- * A first data channel is for MIDI conformant data channel, the rest is +- * Multi Bit Linear Audio data channel. ++ * A first data channel is for MIDI messages, the rest is Multi Bit ++ * Linear Audio data channel. + */ + err = amdtp_stream_set_parameters(s, rate, pcm_channels + 1); + if (err < 0) +@@ -135,11 +136,6 @@ int amdtp_dot_set_parameters(struct amdtp_stream *s, unsigned int rate, + + p->pcm_channels = pcm_channels; + +- if (s->direction == AMDTP_IN_STREAM) +- p->midi_ports = DOT_MIDI_IN_PORTS; +- else +- p->midi_ports = DOT_MIDI_OUT_PORTS; +- + /* + * We do not know the actual MIDI FIFO size of most devices. Just + * assume two bytes, i.e., one byte can be received over the bus while +@@ -281,13 +277,25 @@ static void write_midi_messages(struct amdtp_stream *s, __be32 *buffer, + b = (u8 *)&buffer[0]; + + len = 0; +- if (port < p->midi_ports && ++ if (port < MAX_MIDI_PORTS && + midi_ratelimit_per_packet(s, port) && + p->midi[port] != NULL) + len = snd_rawmidi_transmit(p->midi[port], b + 1, 2); + + if (len > 0) { +- b[3] = (0x10 << port) | len; ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. ++ * - 0010b: physical MIDI port 2. ++ * - 1110b: console MIDI port. ++ */ ++ if (port == 2) ++ b[3] = 0xe0; ++ else if (port == 1) ++ b[3] = 0x20; ++ else ++ b[3] = 0x00; ++ b[3] |= len; + midi_use_bytes(s, port, len); + } else { + b[1] = 0; +@@ -309,11 +317,22 @@ static void read_midi_messages(struct amdtp_stream *s, __be32 *buffer, + + for (f = 0; f < data_blocks; f++) { + b = (u8 *)&buffer[0]; +- port = b[3] >> 4; +- len = b[3] & 0x0f; + +- if (port < p->midi_ports && p->midi[port] && len > 0) +- snd_rawmidi_receive(p->midi[port], b + 1, len); ++ len = b[3] & 0x0f; ++ if (len > 0) { ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. Use port 0. ++ * - 1110b: console MIDI port. Use port 2. ++ */ ++ if (b[3] >> 4 > 0) ++ port = 2; ++ else ++ port = 0; ++ ++ if (port < MAX_MIDI_PORTS && p->midi[port]) ++ snd_rawmidi_receive(p->midi[port], b + 1, len); ++ } + + buffer += s->data_block_quadlets; + } +@@ -364,7 +383,7 @@ void amdtp_dot_midi_trigger(struct amdtp_stream *s, unsigned int port, + { + struct amdtp_dot *p = s->protocol; + +- if (port < p->midi_ports) ++ if (port < MAX_MIDI_PORTS) + ACCESS_ONCE(p->midi[port]) = midi; + } + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index e2212830df0c..fbd00821e326 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -179,11 +179,15 @@ static const struct kernel_param_ops param_ops_xint = { + }; + #define param_check_xint param_check_int + +-static int power_save = -1; ++static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + module_param(power_save, xint, 0644); + MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " + "(in second, 0 = disable)."); + ++static bool pm_blacklist = true; ++module_param(pm_blacklist, bool, 0644); ++MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist"); ++ + /* reset the HD-audio controller in power save mode. + * this may give more power-saving, but will take longer time to + * wake up. +@@ -2164,10 +2168,9 @@ static int azx_probe_continue(struct azx *chip) + + val = power_save; + #ifdef CONFIG_PM +- if (val == -1) { ++ if (pm_blacklist) { + const struct snd_pci_quirk *q; + +- val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); + if (q && val) { + dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", +diff --git a/sound/soc/nuc900/nuc900-ac97.c b/sound/soc/nuc900/nuc900-ac97.c +index b6615affe571..fde974d52bb2 100644 +--- a/sound/soc/nuc900/nuc900-ac97.c ++++ b/sound/soc/nuc900/nuc900-ac97.c +@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(struct snd_ac97 *ac97, + + /* polling the AC_R_FINISH */ + while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) { +@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd_ac97 *ac97, unsigned short reg, + + /* polling the AC_W_FINISH */ + while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 38aae96267c9..a001331a53c1 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -142,6 +142,15 @@ static int rsnd_ssi_master_clk_start(struct rsnd_ssi *ssi, + */ + for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) { + ++ /* ++ * It will set SSIWSR.CONT here, but SSICR.CKDV = 000 ++ * with it is not allowed. (SSIWSR.WS_MODE with ++ * SSICR.CKDV = 000 is not allowed either). ++ * Skip it. See SSICR.CKDV ++ */ ++ if (j == 0) ++ continue; ++ + /* + * this driver is assuming that + * system word is 64fs (= 2 x 32bit) +diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c +index 132afc97676c..9d4ac90ca87e 100644 +--- a/tools/perf/builtin-probe.c ++++ b/tools/perf/builtin-probe.c +@@ -405,9 +405,9 @@ static int perf_del_probe_events(struct strfilter *filter) + } + + if (ret == -ENOENT && ret2 == -ENOENT) +- pr_debug("\"%s\" does not hit any event.\n", str); +- /* Note that this is silently ignored */ +- ret = 0; ++ pr_warning("\"%s\" does not hit any event.\n", str); ++ else ++ ret = 0; + + error: + if (kfd >= 0) +diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c +index 26cba64345e3..46af9dde11e2 100644 +--- a/tools/perf/util/event.c ++++ b/tools/perf/util/event.c +@@ -234,8 +234,8 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, + if (machine__is_default_guest(machine)) + return 0; + +- snprintf(filename, sizeof(filename), "%s/proc/%d/maps", +- machine->root_dir, pid); ++ snprintf(filename, sizeof(filename), "%s/proc/%d/task/%d/maps", ++ machine->root_dir, pid, pid); + + fp = fopen(filename, "r"); + if (fp == NULL) { +diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c +index b1b9e2385f4b..5e58149c4df2 100644 +--- a/tools/perf/util/ordered-events.c ++++ b/tools/perf/util/ordered-events.c +@@ -79,7 +79,7 @@ static union perf_event *dup_event(struct ordered_events *oe, + + static void free_dup_event(struct ordered_events *oe, union perf_event *event) + { +- if (oe->copy_on_queue) { ++ if (event && oe->copy_on_queue) { + oe->cur_alloc_size -= event->header.size; + free(event); + } +@@ -150,6 +150,7 @@ void ordered_events__delete(struct ordered_events *oe, struct ordered_event *eve + list_move(&event->list, &oe->cache); + oe->nr_events--; + free_dup_event(oe, event->event); ++ event->event = NULL; + } + + int ordered_events__queue(struct ordered_events *oe, union perf_event *event, +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 468de95bc8bb..0ae4f73dc8eb 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -135,8 +135,14 @@ struct perf_session *perf_session__new(struct perf_data_file *file, + if (perf_session__open(session) < 0) + goto out_close; + +- perf_session__set_id_hdr_size(session); +- perf_session__set_comm_exec(session); ++ /* ++ * set session attributes that are present in perf.data ++ * but not in pipe-mode. ++ */ ++ if (!file->is_pipe) { ++ perf_session__set_id_hdr_size(session); ++ perf_session__set_comm_exec(session); ++ } + } + } else { + session->machines.host.env = &perf_env; +@@ -151,7 +157,11 @@ struct perf_session *perf_session__new(struct perf_data_file *file, + pr_warning("Cannot read kernel map\n"); + } + +- if (tool && tool->ordering_requires_timestamps && ++ /* ++ * In pipe-mode, evlist is empty until PERF_RECORD_HEADER_ATTR is ++ * processed, so perf_evlist__sample_id_all is not meaningful here. ++ */ ++ if ((!file || !file->is_pipe) && tool && tool->ordering_requires_timestamps && + tool->ordered_events && !perf_evlist__sample_id_all(session->evlist)) { + dump_printf("WARNING: No sample_id_all support, falling back to unordered processing\n"); + tool->ordered_events = false; +@@ -1437,6 +1447,7 @@ static int __perf_session__process_pipe_events(struct perf_session *session) + buf = malloc(cur_size); + if (!buf) + return -errno; ++ ordered_events__set_copy_on_queue(oe, true); + more: + event = buf; + err = readn(fd, event, sizeof(struct perf_event_header)); +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 2d8ccd4d9e1b..87312056f75d 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -604,6 +604,9 @@ static int hist_entry__mispredict_snprintf(struct hist_entry *he, char *bf, + static int64_t + sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right) + { ++ if (!left->branch_info || !right->branch_info) ++ return cmp_null(left->branch_info, right->branch_info); ++ + return left->branch_info->flags.cycles - + right->branch_info->flags.cycles; + } +@@ -611,6 +614,8 @@ sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right) + static int hist_entry__cycles_snprintf(struct hist_entry *he, char *bf, + size_t size, unsigned int width) + { ++ if (!he->branch_info) ++ return scnprintf(bf, size, "%-.*s", width, "N/A"); + if (he->branch_info->flags.cycles == 0) + return repsep_snprintf(bf, size, "%-*s", width, "-"); + return repsep_snprintf(bf, size, "%-*hd", width, +diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh +index 856a1f327b3f..61f9b1dbbd9b 100755 +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -28,7 +28,10 @@ test_finish() + if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout + fi +- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path ++ if [ "$OLD_FWPATH" = "" ]; then ++ OLD_FWPATH=" " ++ fi ++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + rm -f "$FW" + rmdir "$FWPATH" + } +diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh +index 3f81a1095206..50a6371b2b2e 100755 +--- a/tools/testing/selftests/rcutorture/bin/configinit.sh ++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh +@@ -51,7 +51,7 @@ then + mkdir $builddir + fi + else +- echo Bad build directory: \"$builddir\" ++ echo Bad build directory: \"$buildloc\" + exit 2 + fi + fi +diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c +index d075ea0e5ca1..ade443a88421 100644 +--- a/tools/testing/selftests/x86/entry_from_vm86.c ++++ b/tools/testing/selftests/x86/entry_from_vm86.c +@@ -95,6 +95,31 @@ asm ( + "int3\n\t" + "vmcode_int80:\n\t" + "int $0x80\n\t" ++ "vmcode_popf_hlt:\n\t" ++ "push %ax\n\t" ++ "popf\n\t" ++ "hlt\n\t" ++ "vmcode_umip:\n\t" ++ /* addressing via displacements */ ++ "smsw (2052)\n\t" ++ "sidt (2054)\n\t" ++ "sgdt (2060)\n\t" ++ /* addressing via registers */ ++ "mov $2066, %bx\n\t" ++ "smsw (%bx)\n\t" ++ "mov $2068, %bx\n\t" ++ "sidt (%bx)\n\t" ++ "mov $2074, %bx\n\t" ++ "sgdt (%bx)\n\t" ++ /* register operands, only for smsw */ ++ "smsw %ax\n\t" ++ "mov %ax, (2080)\n\t" ++ "int3\n\t" ++ "vmcode_umip_str:\n\t" ++ "str %eax\n\t" ++ "vmcode_umip_sldt:\n\t" ++ "sldt %eax\n\t" ++ "int3\n\t" + ".size vmcode, . - vmcode\n\t" + "end_vmcode:\n\t" + ".code32\n\t" +@@ -103,7 +128,8 @@ asm ( + + extern unsigned char vmcode[], end_vmcode[]; + extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[], +- vmcode_sti[], vmcode_int3[], vmcode_int80[]; ++ vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[], ++ vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[]; + + /* Returns false if the test was skipped. */ + static bool do_test(struct vm86plus_struct *v86, unsigned long eip, +@@ -153,13 +179,75 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip, + (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) { + printf("[OK]\tReturned correctly\n"); + } else { +- printf("[FAIL]\tIncorrect return reason\n"); ++ printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip); + nerrs++; + } + + return true; + } + ++void do_umip_tests(struct vm86plus_struct *vm86, unsigned char *test_mem) ++{ ++ struct table_desc { ++ unsigned short limit; ++ unsigned long base; ++ } __attribute__((packed)); ++ ++ /* Initialize variables with arbitrary values */ ++ struct table_desc gdt1 = { .base = 0x3c3c3c3c, .limit = 0x9999 }; ++ struct table_desc gdt2 = { .base = 0x1a1a1a1a, .limit = 0xaeae }; ++ struct table_desc idt1 = { .base = 0x7b7b7b7b, .limit = 0xf1f1 }; ++ struct table_desc idt2 = { .base = 0x89898989, .limit = 0x1313 }; ++ unsigned short msw1 = 0x1414, msw2 = 0x2525, msw3 = 3737; ++ ++ /* UMIP -- exit with INT3 unless kernel emulation did not trap #GP */ ++ do_test(vm86, vmcode_umip - vmcode, VM86_TRAP, 3, "UMIP tests"); ++ ++ /* Results from displacement-only addressing */ ++ msw1 = *(unsigned short *)(test_mem + 2052); ++ memcpy(&idt1, test_mem + 2054, sizeof(idt1)); ++ memcpy(&gdt1, test_mem + 2060, sizeof(gdt1)); ++ ++ /* Results from register-indirect addressing */ ++ msw2 = *(unsigned short *)(test_mem + 2066); ++ memcpy(&idt2, test_mem + 2068, sizeof(idt2)); ++ memcpy(&gdt2, test_mem + 2074, sizeof(gdt2)); ++ ++ /* Results when using register operands */ ++ msw3 = *(unsigned short *)(test_mem + 2080); ++ ++ printf("[INFO]\tResult from SMSW:[0x%04x]\n", msw1); ++ printf("[INFO]\tResult from SIDT: limit[0x%04x]base[0x%08lx]\n", ++ idt1.limit, idt1.base); ++ printf("[INFO]\tResult from SGDT: limit[0x%04x]base[0x%08lx]\n", ++ gdt1.limit, gdt1.base); ++ ++ if (msw1 != msw2 || msw1 != msw3) ++ printf("[FAIL]\tAll the results of SMSW should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SMSW are identical.\n"); ++ ++ if (memcmp(&gdt1, &gdt2, sizeof(gdt1))) ++ printf("[FAIL]\tAll the results of SGDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SGDT are identical.\n"); ++ ++ if (memcmp(&idt1, &idt2, sizeof(idt1))) ++ printf("[FAIL]\tAll the results of SIDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SIDT are identical.\n"); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_str - vmcode, VM86_SIGNAL, 0, ++ "STR instruction"); ++ clearhandler(SIGILL); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_sldt - vmcode, VM86_SIGNAL, 0, ++ "SLDT instruction"); ++ clearhandler(SIGILL); ++} ++ + int main(void) + { + struct vm86plus_struct v86; +@@ -180,6 +268,9 @@ int main(void) + v86.regs.ds = load_addr / 16; + v86.regs.es = load_addr / 16; + ++ /* Use the end of the page as our stack. */ ++ v86.regs.esp = 4096; ++ + assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */ + + /* #BR -- should deliver SIG??? */ +@@ -211,6 +302,23 @@ int main(void) + v86.regs.eflags &= ~X86_EFLAGS_IF; + do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set"); + ++ /* POPF with VIP set but IF clear: should not trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = 0; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear"); ++ ++ /* POPF with VIP set and IF set: should trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set"); ++ ++ /* POPF with VIP clear and IF set: should not trap */ ++ v86.regs.eflags = 0; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set"); ++ ++ v86.regs.eflags = 0; ++ + /* INT3 -- should cause #BP */ + do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3"); + +@@ -218,6 +326,9 @@ int main(void) + v86.regs.eax = (unsigned int)-1; + do_test(&v86, vmcode_int80 - vmcode, VM86_INTx, 0x80, "int80"); + ++ /* UMIP -- should exit with INTx 0x80 unless UMIP was not disabled */ ++ do_umip_tests(&v86, addr); ++ + /* Execute a null pointer */ + v86.regs.cs = 0; + v86.regs.ss = 0; +@@ -231,7 +342,7 @@ int main(void) + clearhandler(SIGSEGV); + + /* Make sure nothing explodes if we fork. */ +- if (fork() > 0) ++ if (fork() == 0) + return 0; + + return (nerrs == 0 ? 0 : 1); +diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c +index 2a7cd2b8d966..8c5b0faba229 100644 +--- a/tools/usb/usbip/src/usbipd.c ++++ b/tools/usb/usbip/src/usbipd.c +@@ -451,7 +451,7 @@ static void set_signal(void) + sigaction(SIGTERM, &act, NULL); + sigaction(SIGINT, &act, NULL); + act.sa_handler = SIG_IGN; +- sigaction(SIGCLD, &act, NULL); ++ sigaction(SIGCHLD, &act, NULL); + } + + static const char *pid_file; |