diff --git a/config/linux-udoo-next.config b/config/linux-udoo-next.config index 4ddcfdd26..da904dbd3 100644 --- a/config/linux-udoo-next.config +++ b/config/linux-udoo-next.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.4 Kernel Configuration +# Linux/arm 4.4.6 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -46,7 +46,8 @@ CONFIG_DEFAULT_HOSTNAME="(none)" CONFIG_SWAP=y CONFIG_SYSVIPC=y CONFIG_SYSVIPC_SYSCTL=y -# CONFIG_POSIX_MQUEUE is not set +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y CONFIG_CROSS_MEMORY_ATTACH=y CONFIG_FHANDLE=y CONFIG_USELIB=y @@ -101,24 +102,40 @@ CONFIG_SRCU=y CONFIG_RCU_STALL_COMMON=y # CONFIG_TREE_RCU_TRACE is not set # CONFIG_RCU_EXPEDITE_BOOT is not set -# CONFIG_BUILD_BIN2C is not set -# CONFIG_IKCONFIG is not set +CONFIG_BUILD_BIN2C=y +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y CONFIG_LOG_BUF_SHIFT=18 CONFIG_LOG_CPU_MAX_BUF_SHIFT=15 CONFIG_GENERIC_SCHED_CLOCK=y CONFIG_CGROUPS=y # CONFIG_CGROUP_DEBUG is not set -# CONFIG_CGROUP_FREEZER is not set -# CONFIG_CGROUP_PIDS is not set -# CONFIG_CGROUP_DEVICE is not set -# CONFIG_CPUSETS is not set -# CONFIG_CGROUP_CPUACCT is not set -# CONFIG_MEMCG is not set -# CONFIG_CGROUP_PERF is not set -# CONFIG_CGROUP_SCHED is not set -# CONFIG_BLK_CGROUP is not set +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CPUSETS=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_PAGE_COUNTER=y +CONFIG_MEMCG=y +CONFIG_MEMCG_SWAP=y +CONFIG_MEMCG_SWAP_ENABLED=y +CONFIG_MEMCG_KMEM=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_SCHED=y +CONFIG_FAIR_GROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_BLK_CGROUP=y +# CONFIG_DEBUG_BLK_CGROUP is not set +CONFIG_CGROUP_WRITEBACK=y # CONFIG_CHECKPOINT_RESTORE is not set -# CONFIG_NAMESPACES is not set +CONFIG_NAMESPACES=y +CONFIG_UTS_NS=y +CONFIG_IPC_NS=y +CONFIG_USER_NS=y +CONFIG_PID_NS=y +CONFIG_NET_NS=y # CONFIG_SCHED_AUTOGROUP is not set # CONFIG_SYSFS_DEPRECATED is not set CONFIG_RELAY=y @@ -200,6 +217,7 @@ CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y CONFIG_HAVE_CC_STACKPROTECTOR=y # CONFIG_CC_STACKPROTECTOR is not set CONFIG_CC_STACKPROTECTOR_NONE=y @@ -237,6 +255,7 @@ CONFIG_LBDAF=y CONFIG_BLK_DEV_BSG=y # CONFIG_BLK_DEV_BSGLIB is not set # CONFIG_BLK_DEV_INTEGRITY is not set +CONFIG_BLK_DEV_THROTTLING=y # CONFIG_BLK_CMDLINE_PARSER is not set # @@ -252,6 +271,7 @@ CONFIG_EFI_PARTITION=y CONFIG_IOSCHED_NOOP=y CONFIG_IOSCHED_DEADLINE=y CONFIG_IOSCHED_CFQ=y +# CONFIG_CFQ_GROUP_IOSCHED is not set # CONFIG_DEFAULT_DEADLINE is not set CONFIG_DEFAULT_CFQ=y # CONFIG_DEFAULT_NOOP is not set @@ -520,7 +540,7 @@ CONFIG_FRAME_VECTOR=y CONFIG_FORCE_MAX_ZONEORDER=11 CONFIG_ALIGNMENT_TRAP=y # CONFIG_UACCESS_WITH_MEMCPY is not set -# CONFIG_SECCOMP is not set +CONFIG_SECCOMP=y CONFIG_SWIOTLB=y CONFIG_IOMMU_HELPER=y # CONFIG_XEN is not set @@ -664,7 +684,7 @@ CONFIG_IP_PNP_DHCP=y # CONFIG_NET_IPIP is not set # CONFIG_NET_IPGRE_DEMUX is not set CONFIG_NET_IP_TUNNEL=y -# CONFIG_SYN_COOKIES is not set +CONFIG_SYN_COOKIES=y # CONFIG_NET_IPVTI is not set CONFIG_NET_UDP_TUNNEL=m # CONFIG_NET_FOU is not set @@ -761,9 +781,10 @@ CONFIG_NF_NAT_IRC=m CONFIG_NF_NAT_SIP=m CONFIG_NF_NAT_TFTP=m CONFIG_NF_NAT_REDIRECT=m +CONFIG_NETFILTER_SYNPROXY=m CONFIG_NF_TABLES=m CONFIG_NF_TABLES_INET=m -# CONFIG_NF_TABLES_NETDEV is not set +CONFIG_NF_TABLES_NETDEV=m CONFIG_NFT_EXTHDR=m CONFIG_NFT_META=m CONFIG_NFT_CT=m @@ -772,7 +793,7 @@ CONFIG_NFT_HASH=m CONFIG_NFT_COUNTER=m CONFIG_NFT_LOG=m CONFIG_NFT_LIMIT=m -# CONFIG_NFT_MASQ is not set +CONFIG_NFT_MASQ=m CONFIG_NFT_REDIR=m CONFIG_NFT_NAT=m CONFIG_NFT_QUEUE=m @@ -885,26 +906,41 @@ CONFIG_IP_SET_HASH_IPMARK=m # # IP: Netfilter Configuration # -CONFIG_NF_DEFRAG_IPV4=m -# CONFIG_NF_CONNTRACK_IPV4 is not set +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +CONFIG_NF_CONNTRACK_PROC_COMPAT=y CONFIG_NF_TABLES_IPV4=m -# CONFIG_NFT_CHAIN_ROUTE_IPV4 is not set +CONFIG_NFT_CHAIN_ROUTE_IPV4=m CONFIG_NFT_REJECT_IPV4=m -# CONFIG_NFT_DUP_IPV4 is not set -# CONFIG_NF_TABLES_ARP is not set +CONFIG_NFT_DUP_IPV4=m +CONFIG_NF_TABLES_ARP=m CONFIG_NF_DUP_IPV4=m CONFIG_NF_LOG_ARP=m CONFIG_NF_LOG_IPV4=m CONFIG_NF_REJECT_IPV4=m +CONFIG_NF_NAT_IPV4=m +CONFIG_NFT_CHAIN_NAT_IPV4=m +CONFIG_NF_NAT_MASQUERADE_IPV4=m +CONFIG_NFT_MASQ_IPV4=m +CONFIG_NFT_REDIR_IPV4=m +CONFIG_NF_NAT_SNMP_BASIC=m +CONFIG_NF_NAT_PROTO_GRE=m +CONFIG_NF_NAT_PPTP=m +CONFIG_NF_NAT_H323=m CONFIG_IP_NF_IPTABLES=m CONFIG_IP_NF_MATCH_AH=m CONFIG_IP_NF_MATCH_ECN=m -# CONFIG_IP_NF_MATCH_RPFILTER is not set +CONFIG_IP_NF_MATCH_RPFILTER=m CONFIG_IP_NF_MATCH_TTL=m CONFIG_IP_NF_FILTER=m CONFIG_IP_NF_TARGET_REJECT=m -# CONFIG_IP_NF_TARGET_SYNPROXY is not set +CONFIG_IP_NF_TARGET_SYNPROXY=m +CONFIG_IP_NF_NAT=m +CONFIG_IP_NF_TARGET_MASQUERADE=m +CONFIG_IP_NF_TARGET_NETMAP=m +CONFIG_IP_NF_TARGET_REDIRECT=m CONFIG_IP_NF_MANGLE=m +CONFIG_IP_NF_TARGET_CLUSTERIP=m CONFIG_IP_NF_TARGET_ECN=m CONFIG_IP_NF_TARGET_TTL=m CONFIG_IP_NF_RAW=m @@ -1057,7 +1093,7 @@ CONFIG_NET_MPLS_GSO=m CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_XPS=y -# CONFIG_CGROUP_NET_PRIO is not set +CONFIG_CGROUP_NET_PRIO=y CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y @@ -1454,7 +1490,7 @@ CONFIG_NETPOLL=y CONFIG_NET_POLL_CONTROLLER=y CONFIG_TUN=y # CONFIG_TUN_VNET_CROSS_LE is not set -# CONFIG_VETH is not set +CONFIG_VETH=y # CONFIG_VIRTIO_NET is not set # CONFIG_NLMON is not set @@ -1768,7 +1804,7 @@ CONFIG_VT_CONSOLE_SLEEP=y CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y -# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set +CONFIG_DEVPTS_MULTIPLE_INSTANCES=y CONFIG_LEGACY_PTYS=y CONFIG_LEGACY_PTY_COUNT=256 # CONFIG_SERIAL_NONSTANDARD is not set @@ -3805,7 +3841,7 @@ CONFIG_QUOTACTL=y CONFIG_AUTOFS4_FS=y CONFIG_FUSE_FS=y CONFIG_CUSE=y -# CONFIG_OVERLAY_FS is not set +CONFIG_OVERLAY_FS=y # # Caches diff --git a/patch/kernel/udoo-next/patch-4.4.4-5.patch b/patch/kernel/udoo-next/patch-4.4.4-5.patch new file mode 100644 index 000000000..039395396 --- /dev/null +++ b/patch/kernel/udoo-next/patch-4.4.4-5.patch @@ -0,0 +1,3396 @@ +diff --git a/Makefile b/Makefile +index 344bc6f27ea1..d13322ade3a0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c +index 96e935bbc38c..3705fc2921c2 100644 +--- a/arch/arm/kvm/guest.c ++++ b/arch/arm/kvm/guest.c +@@ -155,7 +155,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + u64 val; + + val = kvm_arm_timer_get_reg(vcpu, reg->id); +- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)); ++ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0; + } + + static unsigned long num_core_regs(void) +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 63f52b55defe..fc9f7ef2f4ab 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -34,13 +34,13 @@ + /* + * VMALLOC and SPARSEMEM_VMEMMAP ranges. + * +- * VMEMAP_SIZE: allows the whole VA space to be covered by a struct page array ++ * VMEMAP_SIZE: allows the whole linear region to be covered by a struct page array + * (rounded up to PUD_SIZE). + * VMALLOC_START: beginning of the kernel VA space + * VMALLOC_END: extends to the available space below vmmemmap, PCI I/O space, + * fixed mappings and modules + */ +-#define VMEMMAP_SIZE ALIGN((1UL << (VA_BITS - PAGE_SHIFT)) * sizeof(struct page), PUD_SIZE) ++#define VMEMMAP_SIZE ALIGN((1UL << (VA_BITS - PAGE_SHIFT - 1)) * sizeof(struct page), PUD_SIZE) + + #ifndef CONFIG_KASAN + #define VMALLOC_START (VA_START) +@@ -51,7 +51,8 @@ + + #define VMALLOC_END (PAGE_OFFSET - PUD_SIZE - VMEMMAP_SIZE - SZ_64K) + +-#define vmemmap ((struct page *)(VMALLOC_END + SZ_64K)) ++#define VMEMMAP_START (VMALLOC_END + SZ_64K) ++#define vmemmap ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT)) + + #define FIRST_USER_ADDRESS 0UL + +diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c +index d250160d32bc..3039f080e2d5 100644 +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -186,7 +186,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + u64 val; + + val = kvm_arm_timer_get_reg(vcpu, reg->id); +- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)); ++ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0; + } + + /** +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index 17bf39ac83ba..4cb98aa8c27b 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -319,8 +319,8 @@ void __init mem_init(void) + #endif + MLG(VMALLOC_START, VMALLOC_END), + #ifdef CONFIG_SPARSEMEM_VMEMMAP +- MLG((unsigned long)vmemmap, +- (unsigned long)vmemmap + VMEMMAP_SIZE), ++ MLG(VMEMMAP_START, ++ VMEMMAP_START + VMEMMAP_SIZE), + MLM((unsigned long)virt_to_page(PAGE_OFFSET), + (unsigned long)virt_to_page(high_memory)), + #endif +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 886cb1976e90..ca9a81007489 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -690,15 +690,15 @@ static int simulate_sync(struct pt_regs *regs, unsigned int opcode) + asmlinkage void do_ov(struct pt_regs *regs) + { + enum ctx_state prev_state; +- siginfo_t info; ++ siginfo_t info = { ++ .si_signo = SIGFPE, ++ .si_code = FPE_INTOVF, ++ .si_addr = (void __user *)regs->cp0_epc, ++ }; + + prev_state = exception_enter(); + die_if_kernel("Integer overflow", regs); + +- info.si_code = FPE_INTOVF; +- info.si_signo = SIGFPE; +- info.si_errno = 0; +- info.si_addr = (void __user *) regs->cp0_epc; + force_sig_info(SIGFPE, &info, current); + exception_exit(prev_state); + } +@@ -874,7 +874,7 @@ out: + void do_trap_or_bp(struct pt_regs *regs, unsigned int code, + const char *str) + { +- siginfo_t info; ++ siginfo_t info = { 0 }; + char b[40]; + + #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP +@@ -903,7 +903,6 @@ void do_trap_or_bp(struct pt_regs *regs, unsigned int code, + else + info.si_code = FPE_INTOVF; + info.si_signo = SIGFPE; +- info.si_errno = 0; + info.si_addr = (void __user *) regs->cp0_epc; + force_sig_info(SIGFPE, &info, current); + break; +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index b9b803facdbf..2683d04fdda5 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -702,7 +702,7 @@ static int kvm_mips_get_reg(struct kvm_vcpu *vcpu, + } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) { + void __user *uaddr = (void __user *)(long)reg->addr; + +- return copy_to_user(uaddr, vs, 16); ++ return copy_to_user(uaddr, vs, 16) ? -EFAULT : 0; + } else { + return -EINVAL; + } +@@ -732,7 +732,7 @@ static int kvm_mips_set_reg(struct kvm_vcpu *vcpu, + } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) { + void __user *uaddr = (void __user *)(long)reg->addr; + +- return copy_from_user(vs, uaddr, 16); ++ return copy_from_user(vs, uaddr, 16) ? -EFAULT : 0; + } else { + return -EINVAL; + } +diff --git a/arch/mips/mm/sc-mips.c b/arch/mips/mm/sc-mips.c +index 3bd0597d9c3d..ddb8154610cc 100644 +--- a/arch/mips/mm/sc-mips.c ++++ b/arch/mips/mm/sc-mips.c +@@ -164,11 +164,13 @@ static int __init mips_sc_probe_cm3(void) + + sets = cfg & CM_GCR_L2_CONFIG_SET_SIZE_MSK; + sets >>= CM_GCR_L2_CONFIG_SET_SIZE_SHF; +- c->scache.sets = 64 << sets; ++ if (sets) ++ c->scache.sets = 64 << sets; + + line_sz = cfg & CM_GCR_L2_CONFIG_LINE_SIZE_MSK; + line_sz >>= CM_GCR_L2_CONFIG_LINE_SIZE_SHF; +- c->scache.linesz = 2 << line_sz; ++ if (line_sz) ++ c->scache.linesz = 2 << line_sz; + + assoc = cfg & CM_GCR_L2_CONFIG_ASSOC_MSK; + assoc >>= CM_GCR_L2_CONFIG_ASSOC_SHF; +@@ -176,9 +178,12 @@ static int __init mips_sc_probe_cm3(void) + c->scache.waysize = c->scache.sets * c->scache.linesz; + c->scache.waybit = __ffs(c->scache.waysize); + +- c->scache.flags &= ~MIPS_CACHE_NOT_PRESENT; ++ if (c->scache.linesz) { ++ c->scache.flags &= ~MIPS_CACHE_NOT_PRESENT; ++ return 1; ++ } + +- return 1; ++ return 0; + } + + void __weak platform_early_l2_init(void) +diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c +index 9585c81f755f..ce0b2b4075c7 100644 +--- a/arch/parisc/kernel/ptrace.c ++++ b/arch/parisc/kernel/ptrace.c +@@ -269,14 +269,19 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + + long do_syscall_trace_enter(struct pt_regs *regs) + { +- long ret = 0; +- + /* Do the secure computing check first. */ + secure_computing_strict(regs->gr[20]); + + if (test_thread_flag(TIF_SYSCALL_TRACE) && +- tracehook_report_syscall_entry(regs)) +- ret = -1L; ++ tracehook_report_syscall_entry(regs)) { ++ /* ++ * Tracing decided this syscall should not happen or the ++ * debugger stored an invalid system call number. Skip ++ * the system call and the system call restart handling. ++ */ ++ regs->gr[20] = -1UL; ++ goto out; ++ } + + #ifdef CONFIG_64BIT + if (!is_compat_task()) +@@ -290,7 +295,8 @@ long do_syscall_trace_enter(struct pt_regs *regs) + regs->gr[24] & 0xffffffff, + regs->gr[23] & 0xffffffff); + +- return ret ? : regs->gr[20]; ++out: ++ return regs->gr[20]; + } + + void do_syscall_trace_exit(struct pt_regs *regs) +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index 3fbd7252a4b2..fbafa0d0e2bf 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -343,7 +343,7 @@ tracesys_next: + #endif + + comiclr,>>= __NR_Linux_syscalls, %r20, %r0 +- b,n .Lsyscall_nosys ++ b,n .Ltracesys_nosys + + LDREGX %r20(%r19), %r19 + +@@ -359,6 +359,9 @@ tracesys_next: + be 0(%sr7,%r19) + ldo R%tracesys_exit(%r2),%r2 + ++.Ltracesys_nosys: ++ ldo -ENOSYS(%r0),%r28 /* set errno */ ++ + /* Do *not* call this function on the gateway page, because it + makes a direct call to syscall_trace. */ + +diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c +index d1daead5fcdd..adb3eaf8fe2a 100644 +--- a/arch/x86/kernel/acpi/sleep.c ++++ b/arch/x86/kernel/acpi/sleep.c +@@ -16,6 +16,7 @@ + #include + #include + ++#include + #include "../../realmode/rm/wakeup.h" + #include "sleep.h" + +@@ -107,7 +108,13 @@ int x86_acpi_suspend_lowlevel(void) + saved_magic = 0x123456789abcdef0L; + #endif /* CONFIG_64BIT */ + ++ /* ++ * Pause/unpause graph tracing around do_suspend_lowlevel as it has ++ * inconsistent call/return info after it jumps to the wakeup vector. ++ */ ++ pause_graph_tracing(); + do_suspend_lowlevel(); ++ unpause_graph_tracing(); + return 0; + } + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 10e7693b3540..5fd846cd6e0e 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -595,6 +595,8 @@ struct vcpu_vmx { + /* Support for PML */ + #define PML_ENTITY_NUM 512 + struct page *pml_pg; ++ ++ u64 current_tsc_ratio; + }; + + enum segment_cache_field { +@@ -2062,14 +2064,16 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp); + vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */ + +- /* Setup TSC multiplier */ +- if (cpu_has_vmx_tsc_scaling()) +- vmcs_write64(TSC_MULTIPLIER, +- vcpu->arch.tsc_scaling_ratio); +- + vmx->loaded_vmcs->cpu = cpu; + } + ++ /* Setup TSC multiplier */ ++ if (kvm_has_tsc_control && ++ vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) { ++ vmx->current_tsc_ratio = vcpu->arch.tsc_scaling_ratio; ++ vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio); ++ } ++ + vmx_vcpu_pi_load(vcpu, cpu); + } + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 6ef3856aab4b..d2945024ed33 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2736,7 +2736,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + } + + kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); +- vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD; + } + + void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) +@@ -6545,12 +6544,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) + * KVM_DEBUGREG_WONT_EXIT again. + */ + if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) { +- int i; +- + WARN_ON(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP); + kvm_x86_ops->sync_dirty_debug_regs(vcpu); +- for (i = 0; i < KVM_NR_DB_REGS; i++) +- vcpu->arch.eff_db[i] = vcpu->arch.db[i]; ++ kvm_update_dr0123(vcpu); ++ kvm_update_dr6(vcpu); ++ kvm_update_dr7(vcpu); ++ vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD; + } + + /* +diff --git a/block/blk-settings.c b/block/blk-settings.c +index dd4973583978..c7bb666aafd1 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -91,8 +91,8 @@ void blk_set_default_limits(struct queue_limits *lim) + lim->seg_boundary_mask = BLK_SEG_BOUNDARY_MASK; + lim->virt_boundary_mask = 0; + lim->max_segment_size = BLK_MAX_SEGMENT_SIZE; +- lim->max_sectors = lim->max_dev_sectors = lim->max_hw_sectors = +- BLK_SAFE_MAX_SECTORS; ++ lim->max_sectors = lim->max_hw_sectors = BLK_SAFE_MAX_SECTORS; ++ lim->max_dev_sectors = 0; + lim->chunk_sectors = 0; + lim->max_write_same_sectors = 0; + lim->max_discard_sectors = 0; +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 99921aa0daca..60a15831c009 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -367,15 +367,21 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */ + { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */ + { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/ + { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/ + { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0xa1d2), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0xa1d6), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/ + { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 1f225cc1827f..998c6a85ad89 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1142,8 +1142,7 @@ static void ahci_port_init(struct device *dev, struct ata_port *ap, + + /* mark esata ports */ + tmp = readl(port_mmio + PORT_CMD); +- if ((tmp & PORT_CMD_HPCP) || +- ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS))) ++ if ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS)) + ap->pflags |= ATA_PFLAG_EXTERNAL; + } + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 7e959f90c020..e417e1a1d02c 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap) + int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev, + int cmd, void __user *arg) + { +- int val = -EINVAL, rc = -EINVAL; ++ unsigned long val; ++ int rc = -EINVAL; + unsigned long flags; + + switch (cmd) { +- case ATA_IOC_GET_IO32: ++ case HDIO_GET_32BIT: + spin_lock_irqsave(ap->lock, flags); + val = ata_ioc32(ap); + spin_unlock_irqrestore(ap->lock, flags); +- if (copy_to_user(arg, &val, 1)) +- return -EFAULT; +- return 0; ++ return put_user(val, (unsigned long __user *)arg); + +- case ATA_IOC_SET_IO32: ++ case HDIO_SET_32BIT: + val = (unsigned long) arg; + rc = 0; + spin_lock_irqsave(ap->lock, flags); +diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c +index 12fe0f3bb7e9..c8b6a780a290 100644 +--- a/drivers/ata/pata_rb532_cf.c ++++ b/drivers/ata/pata_rb532_cf.c +@@ -32,6 +32,8 @@ + #include + #include + ++#include ++ + #define DRV_NAME "pata-rb532-cf" + #define DRV_VERSION "0.1.0" + #define DRV_DESC "PATA driver for RouterBOARD 532 Compact Flash" +@@ -107,6 +109,7 @@ static int rb532_pata_driver_probe(struct platform_device *pdev) + int gpio; + struct resource *res; + struct ata_host *ah; ++ struct cf_device *pdata; + struct rb532_cf_info *info; + int ret; + +@@ -122,7 +125,13 @@ static int rb532_pata_driver_probe(struct platform_device *pdev) + return -ENOENT; + } + +- gpio = irq_to_gpio(irq); ++ pdata = dev_get_platdata(&pdev->dev); ++ if (!pdata) { ++ dev_err(&pdev->dev, "no platform data specified\n"); ++ return -EINVAL; ++ } ++ ++ gpio = pdata->gpio_pin; + if (gpio < 0) { + dev_err(&pdev->dev, "no GPIO found for irq%d\n", irq); + return -ENOENT; +diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c +index fc4156afa070..a59061e4221a 100644 +--- a/drivers/dma/pxa_dma.c ++++ b/drivers/dma/pxa_dma.c +@@ -583,6 +583,8 @@ static void set_updater_desc(struct pxad_desc_sw *sw_desc, + (PXA_DCMD_LENGTH & sizeof(u32)); + if (flags & DMA_PREP_INTERRUPT) + updater->dcmd |= PXA_DCMD_ENDIRQEN; ++ if (sw_desc->cyclic) ++ sw_desc->hw_desc[sw_desc->nb_desc - 2]->ddadr = sw_desc->first; + } + + static bool is_desc_completed(struct virt_dma_desc *vd) +@@ -673,6 +675,10 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id) + dev_dbg(&chan->vc.chan.dev->device, + "%s(): checking txd %p[%x]: completed=%d\n", + __func__, vd, vd->tx.cookie, is_desc_completed(vd)); ++ if (to_pxad_sw_desc(vd)->cyclic) { ++ vchan_cyclic_callback(vd); ++ break; ++ } + if (is_desc_completed(vd)) { + list_del(&vd->node); + vchan_cookie_complete(vd); +@@ -1080,7 +1086,7 @@ pxad_prep_dma_cyclic(struct dma_chan *dchan, + return NULL; + + pxad_get_config(chan, dir, &dcmd, &dsadr, &dtadr); +- dcmd |= PXA_DCMD_ENDIRQEN | (PXA_DCMD_LENGTH | period_len); ++ dcmd |= PXA_DCMD_ENDIRQEN | (PXA_DCMD_LENGTH & period_len); + dev_dbg(&chan->vc.chan.dev->device, + "%s(): buf_addr=0x%lx len=%zu period=%zu dir=%d flags=%lx\n", + __func__, (unsigned long)buf_addr, len, period_len, dir, flags); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 89c3dd62ba21..119cdc2c43e7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -77,7 +77,7 @@ void amdgpu_connector_hotplug(struct drm_connector *connector) + } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { + /* Don't try to start link training before we + * have the dpcd */ +- if (!amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) ++ if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) + return; + + /* set it to OFF so that drm_helper_connector_dpms() +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index a2a16acee34d..b8fbbd7699e4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + #include "amdgpu.h" + #include "amdgpu_trace.h" + +@@ -261,6 +262,13 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev, + AMDGPU_GEM_DOMAIN_OA); + + bo->flags = flags; ++ ++ /* For architectures that don't support WC memory, ++ * mask out the WC flag from the BO ++ */ ++ if (!drm_arch_can_wc_memory()) ++ bo->flags &= ~AMDGPU_GEM_CREATE_CPU_GTT_USWC; ++ + amdgpu_fill_placement_to_bo(bo, placement); + /* Kernel allocation are uninterruptible */ + r = ttm_bo_init(&adev->mman.bdev, &bo->tbo, size, type, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +index 03fe25142b78..7ae15fad16ed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -596,9 +596,6 @@ force: + /* update display watermarks based on new power state */ + amdgpu_display_bandwidth_update(adev); + +- adev->pm.dpm.current_active_crtcs = adev->pm.dpm.new_active_crtcs; +- adev->pm.dpm.current_active_crtc_count = adev->pm.dpm.new_active_crtc_count; +- + /* wait for the rings to drain */ + for (i = 0; i < AMDGPU_MAX_RINGS; i++) { + struct amdgpu_ring *ring = adev->rings[i]; +@@ -617,6 +614,9 @@ force: + /* update displays */ + amdgpu_dpm_display_configuration_changed(adev); + ++ adev->pm.dpm.current_active_crtcs = adev->pm.dpm.new_active_crtcs; ++ adev->pm.dpm.current_active_crtc_count = adev->pm.dpm.new_active_crtc_count; ++ + if (adev->pm.funcs->force_performance_level) { + if (adev->pm.dpm.thermal_active) { + enum amdgpu_dpm_forced_level level = adev->pm.dpm.forced_level; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 39adbb6470d1..8c5ec151ddac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1248,7 +1248,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm) + { + const unsigned align = min(AMDGPU_VM_PTB_ALIGN_SIZE, + AMDGPU_VM_PTE_COUNT * 8); +- unsigned pd_size, pd_entries, pts_size; ++ unsigned pd_size, pd_entries; + int i, r; + + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { +@@ -1266,8 +1266,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm) + pd_entries = amdgpu_vm_num_pdes(adev); + + /* allocate page table array */ +- pts_size = pd_entries * sizeof(struct amdgpu_vm_pt); +- vm->page_tables = kzalloc(pts_size, GFP_KERNEL); ++ vm->page_tables = drm_calloc_large(pd_entries, sizeof(struct amdgpu_vm_pt)); + if (vm->page_tables == NULL) { + DRM_ERROR("Cannot allocate memory for page table array\n"); + return -ENOMEM; +@@ -1327,7 +1326,7 @@ void amdgpu_vm_fini(struct amdgpu_device *adev, struct amdgpu_vm *vm) + + for (i = 0; i < amdgpu_vm_num_pdes(adev); i++) + amdgpu_bo_unref(&vm->page_tables[i].bo); +- kfree(vm->page_tables); ++ drm_free_large(vm->page_tables); + + amdgpu_bo_unref(&vm->page_directory); + fence_put(vm->page_directory_fence); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index 72793f93e2fc..aa491540ba85 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -3628,6 +3628,19 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring, + unsigned vm_id, uint64_t pd_addr) + { + int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX); ++ uint32_t seq = ring->fence_drv.sync_seq; ++ uint64_t addr = ring->fence_drv.gpu_addr; ++ ++ amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5)); ++ amdgpu_ring_write(ring, (WAIT_REG_MEM_MEM_SPACE(1) | /* memory */ ++ WAIT_REG_MEM_FUNCTION(3) | /* equal */ ++ WAIT_REG_MEM_ENGINE(usepfp))); /* pfp or me */ ++ amdgpu_ring_write(ring, addr & 0xfffffffc); ++ amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); ++ amdgpu_ring_write(ring, seq); ++ amdgpu_ring_write(ring, 0xffffffff); ++ amdgpu_ring_write(ring, 4); /* poll interval */ ++ + if (usepfp) { + /* synce CE with ME to prevent CE fetch CEIB before context switch done */ + amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0)); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 4cb45f4602aa..d1054034d14b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -4681,7 +4681,8 @@ static void gfx_v8_0_ring_emit_vm_flush(struct amdgpu_ring *ring, + + amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5)); + amdgpu_ring_write(ring, (WAIT_REG_MEM_MEM_SPACE(1) | /* memory */ +- WAIT_REG_MEM_FUNCTION(3))); /* equal */ ++ WAIT_REG_MEM_FUNCTION(3) | /* equal */ ++ WAIT_REG_MEM_ENGINE(usepfp))); /* pfp or me */ + amdgpu_ring_write(ring, addr & 0xfffffffc); + amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); + amdgpu_ring_write(ring, seq); +diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c +index 7628eb44cce2..3e9cbe398151 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -1082,10 +1082,10 @@ static const struct amdgpu_ip_block_version topaz_ip_blocks[] = + }, + { + .type = AMD_IP_BLOCK_TYPE_GMC, +- .major = 8, +- .minor = 0, ++ .major = 7, ++ .minor = 4, + .rev = 0, +- .funcs = &gmc_v8_0_ip_funcs, ++ .funcs = &gmc_v7_0_ip_funcs, + }, + { + .type = AMD_IP_BLOCK_TYPE_IH, +@@ -1129,10 +1129,10 @@ static const struct amdgpu_ip_block_version tonga_ip_blocks[] = + }, + { + .type = AMD_IP_BLOCK_TYPE_GMC, +- .major = 7, +- .minor = 4, ++ .major = 8, ++ .minor = 0, + .rev = 0, +- .funcs = &gmc_v7_0_ip_funcs, ++ .funcs = &gmc_v8_0_ip_funcs, + }, + { + .type = AMD_IP_BLOCK_TYPE_IH, +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 541a610667ad..e0b4586a26fd 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -227,7 +227,7 @@ static int ast_get_dram_info(struct drm_device *dev) + } while (ast_read32(ast, 0x10000) != 0x01); + data = ast_read32(ast, 0x10004); + +- if (data & 0x400) ++ if (data & 0x40) + ast->dram_bus_width = 16; + else + ast->dram_bus_width = 32; +diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c +index 760e0ce4aa26..a6ad938f44a6 100644 +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -531,7 +531,10 @@ void intel_detect_pch(struct drm_device *dev) + dev_priv->pch_type = PCH_SPT; + DRM_DEBUG_KMS("Found SunrisePoint LP PCH\n"); + WARN_ON(!IS_SKYLAKE(dev)); +- } else if (id == INTEL_PCH_P2X_DEVICE_ID_TYPE) { ++ } else if ((id == INTEL_PCH_P2X_DEVICE_ID_TYPE) || ++ ((id == INTEL_PCH_QEMU_DEVICE_ID_TYPE) && ++ pch->subsystem_vendor == 0x1af4 && ++ pch->subsystem_device == 0x1100)) { + dev_priv->pch_type = intel_virt_detect_pch(dev); + } else + continue; +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index f4af19a0d569..d3ce4da6a6ad 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2614,6 +2614,7 @@ struct drm_i915_cmd_table { + #define INTEL_PCH_SPT_DEVICE_ID_TYPE 0xA100 + #define INTEL_PCH_SPT_LP_DEVICE_ID_TYPE 0x9D00 + #define INTEL_PCH_P2X_DEVICE_ID_TYPE 0x7100 ++#define INTEL_PCH_QEMU_DEVICE_ID_TYPE 0x2900 /* qemu q35 has 2918 */ + + #define INTEL_PCH_TYPE(dev) (__I915__(dev)->pch_type) + #define HAS_PCH_SPT(dev) (INTEL_PCH_TYPE(dev) == PCH_SPT) +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index 2081a60d08fb..1fa81215cea1 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -1076,10 +1076,6 @@ force: + /* update display watermarks based on new power state */ + radeon_bandwidth_update(rdev); + +- rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs; +- rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count; +- rdev->pm.dpm.single_display = single_display; +- + /* wait for the rings to drain */ + for (i = 0; i < RADEON_NUM_RINGS; i++) { + struct radeon_ring *ring = &rdev->ring[i]; +@@ -1098,6 +1094,10 @@ force: + /* update displays */ + radeon_dpm_display_configuration_changed(rdev); + ++ rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs; ++ rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count; ++ rdev->pm.dpm.single_display = single_display; ++ + if (rdev->asic->dpm.force_performance_level) { + if (rdev->pm.dpm.thermal_active) { + enum radeon_dpm_forced_level level = rdev->pm.dpm.forced_level; +diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c +index 8e9637eea512..81115abf3c1f 100644 +--- a/drivers/i2c/busses/i2c-brcmstb.c ++++ b/drivers/i2c/busses/i2c-brcmstb.c +@@ -562,8 +562,7 @@ static int brcmstb_i2c_probe(struct platform_device *pdev) + if (!dev) + return -ENOMEM; + +- dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(struct bsc_regs *), +- GFP_KERNEL); ++ dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(*dev->bsc_regmap), GFP_KERNEL); + if (!dev->bsc_regmap) + return -ENOMEM; + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 013bdfff2d4d..bf4959f4225b 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -228,6 +228,10 @@ static int amd_iommu_enable_interrupts(void); + static int __init iommu_go_to_state(enum iommu_init_state state); + static void init_device_table_dma(void); + ++static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, ++ u8 bank, u8 cntr, u8 fxn, ++ u64 *value, bool is_write); ++ + static inline void update_last_devid(u16 devid) + { + if (devid > amd_iommu_last_bdf) +@@ -1016,6 +1020,34 @@ static void amd_iommu_erratum_746_workaround(struct amd_iommu *iommu) + } + + /* ++ * Family15h Model 30h-3fh (IOMMU Mishandles ATS Write Permission) ++ * Workaround: ++ * BIOS should enable ATS write permission check by setting ++ * L2_DEBUG_3[AtsIgnoreIWDis](D0F2xF4_x47[0]) = 1b ++ */ ++static void amd_iommu_ats_write_check_workaround(struct amd_iommu *iommu) ++{ ++ u32 value; ++ ++ if ((boot_cpu_data.x86 != 0x15) || ++ (boot_cpu_data.x86_model < 0x30) || ++ (boot_cpu_data.x86_model > 0x3f)) ++ return; ++ ++ /* Test L2_DEBUG_3[AtsIgnoreIWDis] == 1 */ ++ value = iommu_read_l2(iommu, 0x47); ++ ++ if (value & BIT(0)) ++ return; ++ ++ /* Set L2_DEBUG_3[AtsIgnoreIWDis] = 1 */ ++ iommu_write_l2(iommu, 0x47, value | BIT(0)); ++ ++ pr_info("AMD-Vi: Applying ATS write check workaround for IOMMU at %s\n", ++ dev_name(&iommu->dev->dev)); ++} ++ ++/* + * This function clues the initialization function for one IOMMU + * together and also allocates the command buffer and programs the + * hardware. It does NOT enable the IOMMU. This is done afterwards. +@@ -1142,8 +1174,8 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu) + amd_iommu_pc_present = true; + + /* Check if the performance counters can be written to */ +- if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) || +- (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) || ++ if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) || ++ (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) || + (val != val2)) { + pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n"); + amd_iommu_pc_present = false; +@@ -1284,6 +1316,7 @@ static int iommu_init_pci(struct amd_iommu *iommu) + } + + amd_iommu_erratum_746_workaround(iommu); ++ amd_iommu_ats_write_check_workaround(iommu); + + iommu->iommu_dev = iommu_device_create(&iommu->dev->dev, iommu, + amd_iommu_groups, "ivhd%d", +@@ -2283,22 +2316,15 @@ u8 amd_iommu_pc_get_max_counters(u16 devid) + } + EXPORT_SYMBOL(amd_iommu_pc_get_max_counters); + +-int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, ++static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, ++ u8 bank, u8 cntr, u8 fxn, + u64 *value, bool is_write) + { +- struct amd_iommu *iommu; + u32 offset; + u32 max_offset_lim; + +- /* Make sure the IOMMU PC resource is available */ +- if (!amd_iommu_pc_present) +- return -ENODEV; +- +- /* Locate the iommu associated with the device ID */ +- iommu = amd_iommu_rlookup_table[devid]; +- + /* Check for valid iommu and pc register indexing */ +- if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7))) ++ if (WARN_ON((fxn > 0x28) || (fxn & 7))) + return -ENODEV; + + offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn); +@@ -2322,3 +2348,16 @@ int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, + return 0; + } + EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val); ++ ++int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, ++ u64 *value, bool is_write) ++{ ++ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid]; ++ ++ /* Make sure the IOMMU PC resource is available */ ++ if (!amd_iommu_pc_present || iommu == NULL) ++ return -ENODEV; ++ ++ return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn, ++ value, is_write); ++} +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 55a19e49205b..3821c4786662 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -329,7 +329,8 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb, + /* Only care about add/remove events for physical functions */ + if (pdev->is_virtfn) + return NOTIFY_DONE; +- if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE) ++ if (action != BUS_NOTIFY_ADD_DEVICE && ++ action != BUS_NOTIFY_REMOVED_DEVICE) + return NOTIFY_DONE; + + info = dmar_alloc_pci_notify_info(pdev, action); +@@ -339,7 +340,7 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb, + down_write(&dmar_global_lock); + if (action == BUS_NOTIFY_ADD_DEVICE) + dmar_pci_bus_add_dev(info); +- else if (action == BUS_NOTIFY_DEL_DEVICE) ++ else if (action == BUS_NOTIFY_REMOVED_DEVICE) + dmar_pci_bus_del_dev(info); + up_write(&dmar_global_lock); + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 986a53e3eb96..a2e1b7f14df2 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -4367,7 +4367,7 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info) + rmrru->devices_cnt); + if(ret < 0) + return ret; +- } else if (info->event == BUS_NOTIFY_DEL_DEVICE) { ++ } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) { + dmar_remove_dev_scope(info, rmrr->segment, + rmrru->devices, rmrru->devices_cnt); + } +@@ -4387,7 +4387,7 @@ int dmar_iommu_notify_scope_dev(struct dmar_pci_notify_info *info) + break; + else if(ret < 0) + return ret; +- } else if (info->event == BUS_NOTIFY_DEL_DEVICE) { ++ } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) { + if (dmar_remove_dev_scope(info, atsr->segment, + atsru->devices, atsru->devices_cnt)) + break; +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 5631ec004eed..01adcdc52346 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -1960,10 +1960,9 @@ static int adv76xx_isr(struct v4l2_subdev *sd, u32 status, bool *handled) + } + + /* tx 5v detect */ +- tx_5v = io_read(sd, 0x70) & info->cable_det_mask; ++ tx_5v = irq_reg_0x70 & info->cable_det_mask; + if (tx_5v) { + v4l2_dbg(1, debug, sd, "%s: tx_5v: 0x%x\n", __func__, tx_5v); +- io_write(sd, 0x71, tx_5v); + adv76xx_s_detect_tx_5v_ctrl(sd); + if (handled) + *handled = true; +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index 85761d7eb333..be2c8e248e2e 100644 +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -414,7 +414,7 @@ static int cxl_setup_psl_timebase(struct cxl *adapter, struct pci_dev *dev) + delta = mftb() - psl_tb; + if (delta < 0) + delta = -delta; +- } while (cputime_to_usecs(delta) > 16); ++ } while (tb_to_ns(delta) > 16000); + + return 0; + } +diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c +index 2a1b6e037e1a..0134ba32a057 100644 +--- a/drivers/mtd/ubi/upd.c ++++ b/drivers/mtd/ubi/upd.c +@@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol, + vol->changing_leb = 1; + vol->ch_lnum = req->lnum; + +- vol->upd_buf = vmalloc(req->bytes); ++ vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size)); + if (!vol->upd_buf) + return -ENOMEM; + +diff --git a/drivers/pci/host/pci-keystone-dw.c b/drivers/pci/host/pci-keystone-dw.c +index ed34c9520a02..6153853ca9c3 100644 +--- a/drivers/pci/host/pci-keystone-dw.c ++++ b/drivers/pci/host/pci-keystone-dw.c +@@ -58,11 +58,6 @@ + + #define to_keystone_pcie(x) container_of(x, struct keystone_pcie, pp) + +-static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys) +-{ +- return sys->private_data; +-} +- + static inline void update_reg_offset_bit_pos(u32 offset, u32 *reg_offset, + u32 *bit_pos) + { +@@ -108,7 +103,7 @@ static void ks_dw_pcie_msi_irq_ack(struct irq_data *d) + struct pcie_port *pp; + + msi = irq_data_get_msi_desc(d); +- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); ++ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); + ks_pcie = to_keystone_pcie(pp); + offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); + update_reg_offset_bit_pos(offset, ®_offset, &bit_pos); +@@ -146,7 +141,7 @@ static void ks_dw_pcie_msi_irq_mask(struct irq_data *d) + u32 offset; + + msi = irq_data_get_msi_desc(d); +- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); ++ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); + ks_pcie = to_keystone_pcie(pp); + offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); + +@@ -167,7 +162,7 @@ static void ks_dw_pcie_msi_irq_unmask(struct irq_data *d) + u32 offset; + + msi = irq_data_get_msi_desc(d); +- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); ++ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); + ks_pcie = to_keystone_pcie(pp); + offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); + +diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c +index 91a003011acf..a9bac3bf20de 100644 +--- a/drivers/sh/pm_runtime.c ++++ b/drivers/sh/pm_runtime.c +@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block platform_bus_notifier = { + + static int __init sh_pm_runtime_init(void) + { +- if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) { ++ if (IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_ARCH_SHMOBILE)) { + if (!of_find_compatible_node(NULL, NULL, + "renesas,cpg-mstp-clocks")) + return 0; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 88ea4e4f124b..3436a83568ea 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -826,6 +826,49 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + return dev; + } + ++/* ++ * Check if the underlying struct block_device request_queue supports ++ * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM ++ * in ATA and we need to set TPE=1 ++ */ ++bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, ++ struct request_queue *q, int block_size) ++{ ++ if (!blk_queue_discard(q)) ++ return false; ++ ++ attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) / ++ block_size; ++ /* ++ * Currently hardcoded to 1 in Linux/SCSI code.. ++ */ ++ attrib->max_unmap_block_desc_count = 1; ++ attrib->unmap_granularity = q->limits.discard_granularity / block_size; ++ attrib->unmap_granularity_alignment = q->limits.discard_alignment / ++ block_size; ++ return true; ++} ++EXPORT_SYMBOL(target_configure_unmap_from_queue); ++ ++/* ++ * Convert from blocksize advertised to the initiator to the 512 byte ++ * units unconditionally used by the Linux block layer. ++ */ ++sector_t target_to_linux_sector(struct se_device *dev, sector_t lb) ++{ ++ switch (dev->dev_attrib.block_size) { ++ case 4096: ++ return lb << 3; ++ case 2048: ++ return lb << 2; ++ case 1024: ++ return lb << 1; ++ default: ++ return lb; ++ } ++} ++EXPORT_SYMBOL(target_to_linux_sector); ++ + int target_configure_device(struct se_device *dev) + { + struct se_hba *hba = dev->se_hba; +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index e3195700211a..75f0f08b2a34 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -160,25 +160,11 @@ static int fd_configure_device(struct se_device *dev) + " block_device blocks: %llu logical_block_size: %d\n", + dev_size, div_u64(dev_size, fd_dev->fd_block_size), + fd_dev->fd_block_size); +- /* +- * Check if the underlying struct block_device request_queue supports +- * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM +- * in ATA and we need to set TPE=1 +- */ +- if (blk_queue_discard(q)) { +- dev->dev_attrib.max_unmap_lba_count = +- q->limits.max_discard_sectors; +- /* +- * Currently hardcoded to 1 in Linux/SCSI code.. +- */ +- dev->dev_attrib.max_unmap_block_desc_count = 1; +- dev->dev_attrib.unmap_granularity = +- q->limits.discard_granularity >> 9; +- dev->dev_attrib.unmap_granularity_alignment = +- q->limits.discard_alignment; ++ ++ if (target_configure_unmap_from_queue(&dev->dev_attrib, q, ++ fd_dev->fd_block_size)) + pr_debug("IFILE: BLOCK Discard support available," +- " disabled by default\n"); +- } ++ " disabled by default\n"); + /* + * Enable write same emulation for IBLOCK and use 0xFFFF as + * the smaller WRITE_SAME(10) only has a two-byte block count. +@@ -490,9 +476,12 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb) + if (S_ISBLK(inode->i_mode)) { + /* The backend is block device, use discard */ + struct block_device *bdev = inode->i_bdev; ++ struct se_device *dev = cmd->se_dev; + +- ret = blkdev_issue_discard(bdev, lba, +- nolb, GFP_KERNEL, 0); ++ ret = blkdev_issue_discard(bdev, ++ target_to_linux_sector(dev, lba), ++ target_to_linux_sector(dev, nolb), ++ GFP_KERNEL, 0); + if (ret < 0) { + pr_warn("FILEIO: blkdev_issue_discard() failed: %d\n", + ret); +diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c +index f29c69120054..2c53dcefff3e 100644 +--- a/drivers/target/target_core_iblock.c ++++ b/drivers/target/target_core_iblock.c +@@ -121,27 +121,11 @@ static int iblock_configure_device(struct se_device *dev) + dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q); + dev->dev_attrib.hw_queue_depth = q->nr_requests; + +- /* +- * Check if the underlying struct block_device request_queue supports +- * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM +- * in ATA and we need to set TPE=1 +- */ +- if (blk_queue_discard(q)) { +- dev->dev_attrib.max_unmap_lba_count = +- q->limits.max_discard_sectors; +- +- /* +- * Currently hardcoded to 1 in Linux/SCSI code.. +- */ +- dev->dev_attrib.max_unmap_block_desc_count = 1; +- dev->dev_attrib.unmap_granularity = +- q->limits.discard_granularity >> 9; +- dev->dev_attrib.unmap_granularity_alignment = +- q->limits.discard_alignment; +- ++ if (target_configure_unmap_from_queue(&dev->dev_attrib, q, ++ dev->dev_attrib.hw_block_size)) + pr_debug("IBLOCK: BLOCK Discard support available," +- " disabled by default\n"); +- } ++ " disabled by default\n"); ++ + /* + * Enable write same emulation for IBLOCK and use 0xFFFF as + * the smaller WRITE_SAME(10) only has a two-byte block count. +@@ -413,9 +397,13 @@ static sense_reason_t + iblock_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb) + { + struct block_device *bdev = IBLOCK_DEV(cmd->se_dev)->ibd_bd; ++ struct se_device *dev = cmd->se_dev; + int ret; + +- ret = blkdev_issue_discard(bdev, lba, nolb, GFP_KERNEL, 0); ++ ret = blkdev_issue_discard(bdev, ++ target_to_linux_sector(dev, lba), ++ target_to_linux_sector(dev, nolb), ++ GFP_KERNEL, 0); + if (ret < 0) { + pr_err("blkdev_issue_discard() failed: %d\n", ret); + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; +@@ -431,8 +419,10 @@ iblock_execute_write_same(struct se_cmd *cmd) + struct scatterlist *sg; + struct bio *bio; + struct bio_list list; +- sector_t block_lba = cmd->t_task_lba; +- sector_t sectors = sbc_get_write_same_sectors(cmd); ++ struct se_device *dev = cmd->se_dev; ++ sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba); ++ sector_t sectors = target_to_linux_sector(dev, ++ sbc_get_write_same_sectors(cmd)); + + if (cmd->prot_op) { + pr_err("WRITE_SAME: Protection information with IBLOCK" +@@ -646,12 +636,12 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + enum dma_data_direction data_direction) + { + struct se_device *dev = cmd->se_dev; ++ sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba); + struct iblock_req *ibr; + struct bio *bio, *bio_start; + struct bio_list list; + struct scatterlist *sg; + u32 sg_num = sgl_nents; +- sector_t block_lba; + unsigned bio_cnt; + int rw = 0; + int i; +@@ -677,24 +667,6 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + rw = READ; + } + +- /* +- * Convert the blocksize advertised to the initiator to the 512 byte +- * units unconditionally used by the Linux block layer. +- */ +- if (dev->dev_attrib.block_size == 4096) +- block_lba = (cmd->t_task_lba << 3); +- else if (dev->dev_attrib.block_size == 2048) +- block_lba = (cmd->t_task_lba << 2); +- else if (dev->dev_attrib.block_size == 1024) +- block_lba = (cmd->t_task_lba << 1); +- else if (dev->dev_attrib.block_size == 512) +- block_lba = cmd->t_task_lba; +- else { +- pr_err("Unsupported SCSI -> BLOCK LBA conversion:" +- " %u\n", dev->dev_attrib.block_size); +- return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; +- } +- + ibr = kzalloc(sizeof(struct iblock_req), GFP_KERNEL); + if (!ibr) + goto fail; +diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c +index e3fbc5a5d88f..6ceac4f2d4b2 100644 +--- a/drivers/thermal/cpu_cooling.c ++++ b/drivers/thermal/cpu_cooling.c +@@ -377,26 +377,28 @@ static u32 cpu_power_to_freq(struct cpufreq_cooling_device *cpufreq_device, + * get_load() - get load for a cpu since last updated + * @cpufreq_device: &struct cpufreq_cooling_device for this cpu + * @cpu: cpu number ++ * @cpu_idx: index of the cpu in cpufreq_device->allowed_cpus + * + * Return: The average load of cpu @cpu in percentage since this + * function was last called. + */ +-static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu) ++static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu, ++ int cpu_idx) + { + u32 load; + u64 now, now_idle, delta_time, delta_idle; + + now_idle = get_cpu_idle_time(cpu, &now, 0); +- delta_idle = now_idle - cpufreq_device->time_in_idle[cpu]; +- delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu]; ++ delta_idle = now_idle - cpufreq_device->time_in_idle[cpu_idx]; ++ delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu_idx]; + + if (delta_time <= delta_idle) + load = 0; + else + load = div64_u64(100 * (delta_time - delta_idle), delta_time); + +- cpufreq_device->time_in_idle[cpu] = now_idle; +- cpufreq_device->time_in_idle_timestamp[cpu] = now; ++ cpufreq_device->time_in_idle[cpu_idx] = now_idle; ++ cpufreq_device->time_in_idle_timestamp[cpu_idx] = now; + + return load; + } +@@ -598,7 +600,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev, + u32 load; + + if (cpu_online(cpu)) +- load = get_load(cpufreq_device, cpu); ++ load = get_load(cpufreq_device, cpu, i); + else + load = 0; + +diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c +index 45f86da1d6d3..03b6743461d1 100644 +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -158,7 +158,7 @@ static void ci_otg_work(struct work_struct *work) + int ci_hdrc_otg_init(struct ci_hdrc *ci) + { + INIT_WORK(&ci->work, ci_otg_work); +- ci->wq = create_singlethread_workqueue("ci_otg"); ++ ci->wq = create_freezable_workqueue("ci_otg"); + if (!ci->wq) { + dev_err(ci->dev, "can't create workqueue\n"); + return -ENODEV; +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index a7caf53d8b5e..7a76fe4c2f9e 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -164,6 +164,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ + { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ + { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ ++ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 8849439a8f18..348e19834b83 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -270,6 +270,7 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_UE910_V2 0x1012 + #define TELIT_PRODUCT_LE922_USBCFG0 0x1042 + #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 ++#define TELIT_PRODUCT_LE922_USBCFG5 0x1045 + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + +@@ -1132,6 +1133,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), +@@ -1183,6 +1186,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 9919d2a9faf2..1bc6089b9008 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -157,14 +157,17 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ +- {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx/EM74xx */ +- {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx/EM74xx */ ++ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ ++ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ ++ {DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */ ++ {DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ ++ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ + + /* Huawei devices */ + {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */ +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 56bf6dbb93db..9982cb176ce8 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -446,7 +446,8 @@ static long vfio_pci_ioctl(void *device_data, + info.num_regions = VFIO_PCI_NUM_REGIONS; + info.num_irqs = VFIO_PCI_NUM_IRQS; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { + struct pci_dev *pdev = vdev->pdev; +@@ -520,7 +521,8 @@ static long vfio_pci_ioctl(void *device_data, + return -EINVAL; + } + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { + struct vfio_irq_info info; +@@ -555,7 +557,8 @@ static long vfio_pci_ioctl(void *device_data, + else + info.flags |= VFIO_IRQ_INFO_NORESIZE; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_SET_IRQS) { + struct vfio_irq_set hdr; +diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c +index 418cdd9ba3f4..e65b142d3422 100644 +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -219,7 +219,8 @@ static long vfio_platform_ioctl(void *device_data, + info.num_regions = vdev->num_regions; + info.num_irqs = vdev->num_irqs; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { + struct vfio_region_info info; +@@ -240,7 +241,8 @@ static long vfio_platform_ioctl(void *device_data, + info.size = vdev->regions[info.index].size; + info.flags = vdev->regions[info.index].flags; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { + struct vfio_irq_info info; +@@ -259,7 +261,8 @@ static long vfio_platform_ioctl(void *device_data, + info.flags = vdev->irqs[info.index].flags; + info.count = vdev->irqs[info.index].count; + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_DEVICE_SET_IRQS) { + struct vfio_irq_set hdr; +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 59d47cb638d5..ecb826eefe02 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -999,7 +999,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data, + + info.iova_pgsizes = vfio_pgsize_bitmap(iommu); + +- return copy_to_user((void __user *)arg, &info, minsz); ++ return copy_to_user((void __user *)arg, &info, minsz) ? ++ -EFAULT : 0; + + } else if (cmd == VFIO_IOMMU_MAP_DMA) { + struct vfio_iommu_type1_dma_map map; +@@ -1032,7 +1033,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data, + if (ret) + return ret; + +- return copy_to_user((void __user *)arg, &unmap, minsz); ++ return copy_to_user((void __user *)arg, &unmap, minsz) ? ++ -EFAULT : 0; + } + + return -ENOTTY; +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index 92f394927f24..6e92917ba77a 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -709,6 +709,7 @@ static int con2fb_acquire_newinfo(struct vc_data *vc, struct fb_info *info, + } + + if (!err) { ++ ops->cur_blink_jiffies = HZ / 5; + info->fbcon_par = ops; + + if (vc) +@@ -956,6 +957,7 @@ static const char *fbcon_startup(void) + ops->currcon = -1; + ops->graphics = 1; + ops->cur_rotate = -1; ++ ops->cur_blink_jiffies = HZ / 5; + info->fbcon_par = ops; + p->con_rotate = initial_rotation; + set_blitting_type(vc, info); +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 3e36e4adc4a3..9aba42b78253 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(struct __btrfs_workqueue *wq, + list_add_tail(&work->ordered_list, &wq->ordered_list); + spin_unlock_irqrestore(&wq->list_lock, flags); + } +- queue_work(wq->normal_wq, &work->normal_work); + trace_btrfs_work_queued(work); ++ queue_work(wq->normal_wq, &work->normal_work); + } + + void btrfs_queue_work(struct btrfs_workqueue *wq, +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 35489e7129a7..385b449fd7ed 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -1572,7 +1572,7 @@ struct btrfs_fs_info { + + spinlock_t delayed_iput_lock; + struct list_head delayed_iputs; +- struct rw_semaphore delayed_iput_sem; ++ struct mutex cleaner_delayed_iput_mutex; + + /* this protects tree_mod_seq_list */ + spinlock_t tree_mod_seq_lock; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 4958360a44f7..41fb43183406 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1796,7 +1796,10 @@ static int cleaner_kthread(void *arg) + goto sleep; + } + ++ mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex); + btrfs_run_delayed_iputs(root); ++ mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex); ++ + again = btrfs_clean_one_deleted_snapshot(root); + mutex_unlock(&root->fs_info->cleaner_mutex); + +@@ -2556,8 +2559,8 @@ int open_ctree(struct super_block *sb, + mutex_init(&fs_info->delete_unused_bgs_mutex); + mutex_init(&fs_info->reloc_mutex); + mutex_init(&fs_info->delalloc_root_mutex); ++ mutex_init(&fs_info->cleaner_delayed_iput_mutex); + seqlock_init(&fs_info->profiles_lock); +- init_rwsem(&fs_info->delayed_iput_sem); + + INIT_LIST_HEAD(&fs_info->dirty_cowonly_roots); + INIT_LIST_HEAD(&fs_info->space_info); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index c4661db2b72a..2368cac1115a 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4086,8 +4086,10 @@ commit_trans: + !atomic_read(&root->fs_info->open_ioctl_trans)) { + need_commit--; + +- if (need_commit > 0) ++ if (need_commit > 0) { ++ btrfs_start_delalloc_roots(fs_info, 0, -1); + btrfs_wait_ordered_roots(fs_info, -1); ++ } + + trans = btrfs_join_transaction(root); + if (IS_ERR(trans)) +@@ -4100,11 +4102,12 @@ commit_trans: + if (ret) + return ret; + /* +- * make sure that all running delayed iput are +- * done ++ * The cleaner kthread might still be doing iput ++ * operations. Wait for it to finish so that ++ * more space is released. + */ +- down_write(&root->fs_info->delayed_iput_sem); +- up_write(&root->fs_info->delayed_iput_sem); ++ mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex); ++ mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex); + goto again; + } else { + btrfs_end_transaction(trans, root); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 52fc1b5e9f03..4bc9dbf29a73 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3142,8 +3142,6 @@ void btrfs_run_delayed_iputs(struct btrfs_root *root) + if (empty) + return; + +- down_read(&fs_info->delayed_iput_sem); +- + spin_lock(&fs_info->delayed_iput_lock); + list_splice_init(&fs_info->delayed_iputs, &list); + spin_unlock(&fs_info->delayed_iput_lock); +@@ -3154,8 +3152,6 @@ void btrfs_run_delayed_iputs(struct btrfs_root *root) + iput(delayed->inode); + kfree(delayed); + } +- +- up_read(&root->fs_info->delayed_iput_sem); + } + + /* +diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c +index 7cf8509deda7..2c849b08a91b 100644 +--- a/fs/btrfs/root-tree.c ++++ b/fs/btrfs/root-tree.c +@@ -310,8 +310,16 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root) + set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state); + + err = btrfs_insert_fs_root(root->fs_info, root); ++ /* ++ * The root might have been inserted already, as before we look ++ * for orphan roots, log replay might have happened, which ++ * triggers a transaction commit and qgroup accounting, which ++ * in turn reads and inserts fs roots while doing backref ++ * walking. ++ */ ++ if (err == -EEXIST) ++ err = 0; + if (err) { +- BUG_ON(err == -EEXIST); + btrfs_free_fs_root(root); + break; + } +diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h +index c3cc1609025f..44b3d4280abb 100644 +--- a/fs/cifs/cifsfs.h ++++ b/fs/cifs/cifsfs.h +@@ -31,19 +31,15 @@ + * so that it will fit. We use hash_64 to convert the value to 31 bits, and + * then add 1, to ensure that we don't end up with a 0 as the value. + */ +-#if BITS_PER_LONG == 64 + static inline ino_t + cifs_uniqueid_to_ino_t(u64 fileid) + { ++ if ((sizeof(ino_t)) < (sizeof(u64))) ++ return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1; ++ + return (ino_t)fileid; ++ + } +-#else +-static inline ino_t +-cifs_uniqueid_to_ino_t(u64 fileid) +-{ +- return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1; +-} +-#endif + + extern struct file_system_type cifs_fs_type; + extern const struct address_space_operations cifs_addr_ops; +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 90b4f9f7de66..76fcb50295a3 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1396,11 +1396,10 @@ openRetry: + * current bigbuf. + */ + static int +-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) ++discard_remaining_data(struct TCP_Server_Info *server) + { + unsigned int rfclen = get_rfc1002_length(server->smallbuf); + int remaining = rfclen + 4 - server->total_read; +- struct cifs_readdata *rdata = mid->callback_data; + + while (remaining > 0) { + int length; +@@ -1414,10 +1413,20 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) + remaining -= length; + } + +- dequeue_mid(mid, rdata->result); + return 0; + } + ++static int ++cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) ++{ ++ int length; ++ struct cifs_readdata *rdata = mid->callback_data; ++ ++ length = discard_remaining_data(server); ++ dequeue_mid(mid, rdata->result); ++ return length; ++} ++ + int + cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) + { +@@ -1446,6 +1455,12 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) + return length; + server->total_read += length; + ++ if (server->ops->is_status_pending && ++ server->ops->is_status_pending(buf, server, 0)) { ++ discard_remaining_data(server); ++ return -1; ++ } ++ + /* Was the SMB read successful? */ + rdata->result = server->ops->map_error(buf, false); + if (rdata->result != 0) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 767555518d40..373b5cd1c913 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1109,21 +1109,25 @@ parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp, + { + char *data_offset; + struct create_context *cc; +- unsigned int next = 0; ++ unsigned int next; ++ unsigned int remaining; + char *name; + + data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset); ++ remaining = le32_to_cpu(rsp->CreateContextsLength); + cc = (struct create_context *)data_offset; +- do { +- cc = (struct create_context *)((char *)cc + next); ++ while (remaining >= sizeof(struct create_context)) { + name = le16_to_cpu(cc->NameOffset) + (char *)cc; +- if (le16_to_cpu(cc->NameLength) != 4 || +- strncmp(name, "RqLs", 4)) { +- next = le32_to_cpu(cc->Next); +- continue; +- } +- return server->ops->parse_lease_buf(cc, epoch); +- } while (next != 0); ++ if (le16_to_cpu(cc->NameLength) == 4 && ++ strncmp(name, "RqLs", 4) == 0) ++ return server->ops->parse_lease_buf(cc, epoch); ++ ++ next = le32_to_cpu(cc->Next); ++ if (!next) ++ break; ++ remaining -= next; ++ cc = (struct create_context *)((char *)cc + next); ++ } + + return 0; + } +diff --git a/fs/dcache.c b/fs/dcache.c +index 5c33aeb0f68f..877bcbbd03ff 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -269,9 +269,6 @@ static inline int dname_external(const struct dentry *dentry) + return dentry->d_name.name != dentry->d_iname; + } + +-/* +- * Make sure other CPUs see the inode attached before the type is set. +- */ + static inline void __d_set_inode_and_type(struct dentry *dentry, + struct inode *inode, + unsigned type_flags) +@@ -279,28 +276,18 @@ static inline void __d_set_inode_and_type(struct dentry *dentry, + unsigned flags; + + dentry->d_inode = inode; +- smp_wmb(); + flags = READ_ONCE(dentry->d_flags); + flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); + flags |= type_flags; + WRITE_ONCE(dentry->d_flags, flags); + } + +-/* +- * Ideally, we want to make sure that other CPUs see the flags cleared before +- * the inode is detached, but this is really a violation of RCU principles +- * since the ordering suggests we should always set inode before flags. +- * +- * We should instead replace or discard the entire dentry - but that sucks +- * performancewise on mass deletion/rename. +- */ + static inline void __d_clear_type_and_inode(struct dentry *dentry) + { + unsigned flags = READ_ONCE(dentry->d_flags); + + flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); + WRITE_ONCE(dentry->d_flags, flags); +- smp_wmb(); + dentry->d_inode = NULL; + } + +@@ -370,9 +357,11 @@ static void dentry_unlink_inode(struct dentry * dentry) + __releases(dentry->d_inode->i_lock) + { + struct inode *inode = dentry->d_inode; ++ ++ raw_write_seqcount_begin(&dentry->d_seq); + __d_clear_type_and_inode(dentry); + hlist_del_init(&dentry->d_u.d_alias); +- dentry_rcuwalk_invalidate(dentry); ++ raw_write_seqcount_end(&dentry->d_seq); + spin_unlock(&dentry->d_lock); + spin_unlock(&inode->i_lock); + if (!inode->i_nlink) +@@ -1757,8 +1746,9 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode) + spin_lock(&dentry->d_lock); + if (inode) + hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); ++ raw_write_seqcount_begin(&dentry->d_seq); + __d_set_inode_and_type(dentry, inode, add_flags); +- dentry_rcuwalk_invalidate(dentry); ++ raw_write_seqcount_end(&dentry->d_seq); + spin_unlock(&dentry->d_lock); + fsnotify_d_instantiate(dentry, inode); + } +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index e5232bbcbe3d..7a8ea1351584 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -223,6 +223,9 @@ static void wb_wait_for_completion(struct backing_dev_info *bdi, + #define WB_FRN_HIST_MAX_SLOTS (WB_FRN_HIST_THR_SLOTS / 2 + 1) + /* one round can affect upto 5 slots */ + ++static atomic_t isw_nr_in_flight = ATOMIC_INIT(0); ++static struct workqueue_struct *isw_wq; ++ + void __inode_attach_wb(struct inode *inode, struct page *page) + { + struct backing_dev_info *bdi = inode_to_bdi(inode); +@@ -317,7 +320,6 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + struct inode_switch_wbs_context *isw = + container_of(work, struct inode_switch_wbs_context, work); + struct inode *inode = isw->inode; +- struct super_block *sb = inode->i_sb; + struct address_space *mapping = inode->i_mapping; + struct bdi_writeback *old_wb = inode->i_wb; + struct bdi_writeback *new_wb = isw->new_wb; +@@ -424,8 +426,9 @@ skip_switch: + wb_put(new_wb); + + iput(inode); +- deactivate_super(sb); + kfree(isw); ++ ++ atomic_dec(&isw_nr_in_flight); + } + + static void inode_switch_wbs_rcu_fn(struct rcu_head *rcu_head) +@@ -435,7 +438,7 @@ static void inode_switch_wbs_rcu_fn(struct rcu_head *rcu_head) + + /* needs to grab bh-unsafe locks, bounce to work item */ + INIT_WORK(&isw->work, inode_switch_wbs_work_fn); +- schedule_work(&isw->work); ++ queue_work(isw_wq, &isw->work); + } + + /** +@@ -471,20 +474,20 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + + /* while holding I_WB_SWITCH, no one else can update the association */ + spin_lock(&inode->i_lock); +- +- if (inode->i_state & (I_WB_SWITCH | I_FREEING) || +- inode_to_wb(inode) == isw->new_wb) +- goto out_unlock; +- +- if (!atomic_inc_not_zero(&inode->i_sb->s_active)) +- goto out_unlock; +- ++ if (!(inode->i_sb->s_flags & MS_ACTIVE) || ++ inode->i_state & (I_WB_SWITCH | I_FREEING) || ++ inode_to_wb(inode) == isw->new_wb) { ++ spin_unlock(&inode->i_lock); ++ goto out_free; ++ } + inode->i_state |= I_WB_SWITCH; + spin_unlock(&inode->i_lock); + + ihold(inode); + isw->inode = inode; + ++ atomic_inc(&isw_nr_in_flight); ++ + /* + * In addition to synchronizing among switchers, I_WB_SWITCH tells + * the RCU protected stat update paths to grab the mapping's +@@ -494,8 +497,6 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); + return; + +-out_unlock: +- spin_unlock(&inode->i_lock); + out_free: + if (isw->new_wb) + wb_put(isw->new_wb); +@@ -849,6 +850,33 @@ restart: + wb_put(last_wb); + } + ++/** ++ * cgroup_writeback_umount - flush inode wb switches for umount ++ * ++ * This function is called when a super_block is about to be destroyed and ++ * flushes in-flight inode wb switches. An inode wb switch goes through ++ * RCU and then workqueue, so the two need to be flushed in order to ensure ++ * that all previously scheduled switches are finished. As wb switches are ++ * rare occurrences and synchronize_rcu() can take a while, perform ++ * flushing iff wb switches are in flight. ++ */ ++void cgroup_writeback_umount(void) ++{ ++ if (atomic_read(&isw_nr_in_flight)) { ++ synchronize_rcu(); ++ flush_workqueue(isw_wq); ++ } ++} ++ ++static int __init cgroup_writeback_init(void) ++{ ++ isw_wq = alloc_workqueue("inode_switch_wbs", 0, 0); ++ if (!isw_wq) ++ return -ENOMEM; ++ return 0; ++} ++fs_initcall(cgroup_writeback_init); ++ + #else /* CONFIG_CGROUP_WRITEBACK */ + + static struct bdi_writeback * +diff --git a/fs/jffs2/README.Locking b/fs/jffs2/README.Locking +index 3ea36554107f..8918ac905a3b 100644 +--- a/fs/jffs2/README.Locking ++++ b/fs/jffs2/README.Locking +@@ -2,10 +2,6 @@ + JFFS2 LOCKING DOCUMENTATION + --------------------------- + +-At least theoretically, JFFS2 does not require the Big Kernel Lock +-(BKL), which was always helpfully obtained for it by Linux 2.4 VFS +-code. It has its own locking, as described below. +- + This document attempts to describe the existing locking rules for + JFFS2. It is not expected to remain perfectly up to date, but ought to + be fairly close. +@@ -69,6 +65,7 @@ Ordering constraints: + any f->sem held. + 2. Never attempt to lock two file mutexes in one thread. + No ordering rules have been made for doing so. ++ 3. Never lock a page cache page with f->sem held. + + + erase_completion_lock spinlock +diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c +index a3750f902adc..c1f04947d7dc 100644 +--- a/fs/jffs2/build.c ++++ b/fs/jffs2/build.c +@@ -49,7 +49,8 @@ next_inode(int *i, struct jffs2_inode_cache *ic, struct jffs2_sb_info *c) + + + static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, +- struct jffs2_inode_cache *ic) ++ struct jffs2_inode_cache *ic, ++ int *dir_hardlinks) + { + struct jffs2_full_dirent *fd; + +@@ -68,19 +69,21 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, + dbg_fsbuild("child \"%s\" (ino #%u) of dir ino #%u doesn't exist!\n", + fd->name, fd->ino, ic->ino); + jffs2_mark_node_obsolete(c, fd->raw); ++ /* Clear the ic/raw union so it doesn't cause problems later. */ ++ fd->ic = NULL; + continue; + } + ++ /* From this point, fd->raw is no longer used so we can set fd->ic */ ++ fd->ic = child_ic; ++ child_ic->pino_nlink++; ++ /* If we appear (at this stage) to have hard-linked directories, ++ * set a flag to trigger a scan later */ + if (fd->type == DT_DIR) { +- if (child_ic->pino_nlink) { +- JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u appears to be a hard link\n", +- fd->name, fd->ino, ic->ino); +- /* TODO: What do we do about it? */ +- } else { +- child_ic->pino_nlink = ic->ino; +- } +- } else +- child_ic->pino_nlink++; ++ child_ic->flags |= INO_FLAGS_IS_DIR; ++ if (child_ic->pino_nlink > 1) ++ *dir_hardlinks = 1; ++ } + + dbg_fsbuild("increased nlink for child \"%s\" (ino #%u)\n", fd->name, fd->ino); + /* Can't free scan_dents so far. We might need them in pass 2 */ +@@ -94,8 +97,7 @@ static void jffs2_build_inode_pass1(struct jffs2_sb_info *c, + */ + static int jffs2_build_filesystem(struct jffs2_sb_info *c) + { +- int ret; +- int i; ++ int ret, i, dir_hardlinks = 0; + struct jffs2_inode_cache *ic; + struct jffs2_full_dirent *fd; + struct jffs2_full_dirent *dead_fds = NULL; +@@ -119,7 +121,7 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) + /* Now scan the directory tree, increasing nlink according to every dirent found. */ + for_each_inode(i, c, ic) { + if (ic->scan_dents) { +- jffs2_build_inode_pass1(c, ic); ++ jffs2_build_inode_pass1(c, ic, &dir_hardlinks); + cond_resched(); + } + } +@@ -155,6 +157,20 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) + } + + dbg_fsbuild("pass 2a complete\n"); ++ ++ if (dir_hardlinks) { ++ /* If we detected directory hardlinks earlier, *hopefully* ++ * they are gone now because some of the links were from ++ * dead directories which still had some old dirents lying ++ * around and not yet garbage-collected, but which have ++ * been discarded above. So clear the pino_nlink field ++ * in each directory, so that the final scan below can ++ * print appropriate warnings. */ ++ for_each_inode(i, c, ic) { ++ if (ic->flags & INO_FLAGS_IS_DIR) ++ ic->pino_nlink = 0; ++ } ++ } + dbg_fsbuild("freeing temporary data structures\n"); + + /* Finally, we can scan again and free the dirent structs */ +@@ -162,6 +178,33 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c) + while(ic->scan_dents) { + fd = ic->scan_dents; + ic->scan_dents = fd->next; ++ /* We do use the pino_nlink field to count nlink of ++ * directories during fs build, so set it to the ++ * parent ino# now. Now that there's hopefully only ++ * one. */ ++ if (fd->type == DT_DIR) { ++ if (!fd->ic) { ++ /* We'll have complained about it and marked the coresponding ++ raw node obsolete already. Just skip it. */ ++ continue; ++ } ++ ++ /* We *have* to have set this in jffs2_build_inode_pass1() */ ++ BUG_ON(!(fd->ic->flags & INO_FLAGS_IS_DIR)); ++ ++ /* We clear ic->pino_nlink ∀ directories' ic *only* if dir_hardlinks ++ * is set. Otherwise, we know this should never trigger anyway, so ++ * we don't do the check. And ic->pino_nlink still contains the nlink ++ * value (which is 1). */ ++ if (dir_hardlinks && fd->ic->pino_nlink) { ++ JFFS2_ERROR("child dir \"%s\" (ino #%u) of dir ino #%u is also hard linked from dir ino #%u\n", ++ fd->name, fd->ino, ic->ino, fd->ic->pino_nlink); ++ /* Should we unlink it from its previous parent? */ ++ } ++ ++ /* For directories, ic->pino_nlink holds that parent inode # */ ++ fd->ic->pino_nlink = ic->ino; ++ } + jffs2_free_full_dirent(fd); + } + ic->scan_dents = NULL; +@@ -240,11 +283,7 @@ static void jffs2_build_remove_unlinked_inode(struct jffs2_sb_info *c, + + /* Reduce nlink of the child. If it's now zero, stick it on the + dead_fds list to be cleaned up later. Else just free the fd */ +- +- if (fd->type == DT_DIR) +- child_ic->pino_nlink = 0; +- else +- child_ic->pino_nlink--; ++ child_ic->pino_nlink--; + + if (!child_ic->pino_nlink) { + dbg_fsbuild("inode #%u (\"%s\") now has no links; adding to dead_fds list.\n", +diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c +index f509f62e12f6..3361979d728c 100644 +--- a/fs/jffs2/file.c ++++ b/fs/jffs2/file.c +@@ -137,39 +137,33 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + struct page *pg; + struct inode *inode = mapping->host; + struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); +- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); +- struct jffs2_raw_inode ri; +- uint32_t alloc_len = 0; + pgoff_t index = pos >> PAGE_CACHE_SHIFT; + uint32_t pageofs = index << PAGE_CACHE_SHIFT; + int ret = 0; + +- jffs2_dbg(1, "%s()\n", __func__); +- +- if (pageofs > inode->i_size) { +- ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, +- ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); +- if (ret) +- return ret; +- } +- +- mutex_lock(&f->sem); + pg = grab_cache_page_write_begin(mapping, index, flags); +- if (!pg) { +- if (alloc_len) +- jffs2_complete_reservation(c); +- mutex_unlock(&f->sem); ++ if (!pg) + return -ENOMEM; +- } + *pagep = pg; + +- if (alloc_len) { ++ jffs2_dbg(1, "%s()\n", __func__); ++ ++ if (pageofs > inode->i_size) { + /* Make new hole frag from old EOF to new page */ ++ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); ++ struct jffs2_raw_inode ri; + struct jffs2_full_dnode *fn; ++ uint32_t alloc_len; + + jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n", + (unsigned int)inode->i_size, pageofs); + ++ ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, ++ ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); ++ if (ret) ++ goto out_page; ++ ++ mutex_lock(&f->sem); + memset(&ri, 0, sizeof(ri)); + + ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK); +@@ -196,6 +190,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + if (IS_ERR(fn)) { + ret = PTR_ERR(fn); + jffs2_complete_reservation(c); ++ mutex_unlock(&f->sem); + goto out_page; + } + ret = jffs2_add_full_dnode_to_inode(c, f, fn); +@@ -210,10 +205,12 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + jffs2_mark_node_obsolete(c, fn->raw); + jffs2_free_full_dnode(fn); + jffs2_complete_reservation(c); ++ mutex_unlock(&f->sem); + goto out_page; + } + jffs2_complete_reservation(c); + inode->i_size = pageofs; ++ mutex_unlock(&f->sem); + } + + /* +@@ -222,18 +219,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + * case of a short-copy. + */ + if (!PageUptodate(pg)) { ++ mutex_lock(&f->sem); + ret = jffs2_do_readpage_nolock(inode, pg); ++ mutex_unlock(&f->sem); + if (ret) + goto out_page; + } +- mutex_unlock(&f->sem); + jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); + return ret; + + out_page: + unlock_page(pg); + page_cache_release(pg); +- mutex_unlock(&f->sem); + return ret; + } + +diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c +index 5a2dec2b064c..95d5880a63ee 100644 +--- a/fs/jffs2/gc.c ++++ b/fs/jffs2/gc.c +@@ -1296,14 +1296,17 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era + BUG_ON(start > orig_start); + } + +- /* First, use readpage() to read the appropriate page into the page cache */ +- /* Q: What happens if we actually try to GC the _same_ page for which commit_write() +- * triggered garbage collection in the first place? +- * A: I _think_ it's OK. read_cache_page shouldn't deadlock, we'll write out the +- * page OK. We'll actually write it out again in commit_write, which is a little +- * suboptimal, but at least we're correct. +- */ ++ /* The rules state that we must obtain the page lock *before* f->sem, so ++ * drop f->sem temporarily. Since we also hold c->alloc_sem, nothing's ++ * actually going to *change* so we're safe; we only allow reading. ++ * ++ * It is important to note that jffs2_write_begin() will ensure that its ++ * page is marked Uptodate before allocating space. That means that if we ++ * end up here trying to GC the *same* page that jffs2_write_begin() is ++ * trying to write out, read_cache_page() will not deadlock. */ ++ mutex_unlock(&f->sem); + pg_ptr = jffs2_gc_fetch_page(c, f, start, &pg); ++ mutex_lock(&f->sem); + + if (IS_ERR(pg_ptr)) { + pr_warn("read_cache_page() returned error: %ld\n", +diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h +index fa35ff79ab35..0637271f3770 100644 +--- a/fs/jffs2/nodelist.h ++++ b/fs/jffs2/nodelist.h +@@ -194,6 +194,7 @@ struct jffs2_inode_cache { + #define INO_STATE_CLEARING 6 /* In clear_inode() */ + + #define INO_FLAGS_XATTR_CHECKED 0x01 /* has no duplicate xattr_ref */ ++#define INO_FLAGS_IS_DIR 0x02 /* is a directory */ + + #define RAWNODE_CLASS_INODE_CACHE 0 + #define RAWNODE_CLASS_XATTR_DATUM 1 +@@ -249,7 +250,10 @@ struct jffs2_readinode_info + + struct jffs2_full_dirent + { +- struct jffs2_raw_node_ref *raw; ++ union { ++ struct jffs2_raw_node_ref *raw; ++ struct jffs2_inode_cache *ic; /* Just during part of build */ ++ }; + struct jffs2_full_dirent *next; + uint32_t version; + uint32_t ino; /* == zero for unlink */ +diff --git a/fs/super.c b/fs/super.c +index 954aeb80e202..f5f4b328f860 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -415,6 +415,7 @@ void generic_shutdown_super(struct super_block *sb) + sb->s_flags &= ~MS_ACTIVE; + + fsnotify_unmount_inodes(sb); ++ cgroup_writeback_umount(); + + evict_inodes(sb); + +diff --git a/include/linux/ata.h b/include/linux/ata.h +index d2992bfa1706..c1a2f345cbe6 100644 +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -487,8 +487,8 @@ enum ata_tf_protocols { + }; + + enum ata_ioctls { +- ATA_IOC_GET_IO32 = 0x309, +- ATA_IOC_SET_IO32 = 0x324, ++ ATA_IOC_GET_IO32 = 0x309, /* HDIO_GET_32BIT */ ++ ATA_IOC_SET_IO32 = 0x324, /* HDIO_SET_32BIT */ + }; + + /* core structures */ +diff --git a/include/linux/bio.h b/include/linux/bio.h +index b9b6e046b52e..79cfaeef1b0d 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -310,6 +310,43 @@ static inline void bio_clear_flag(struct bio *bio, unsigned int bit) + bio->bi_flags &= ~(1U << bit); + } + ++static inline void bio_get_first_bvec(struct bio *bio, struct bio_vec *bv) ++{ ++ *bv = bio_iovec(bio); ++} ++ ++static inline void bio_get_last_bvec(struct bio *bio, struct bio_vec *bv) ++{ ++ struct bvec_iter iter = bio->bi_iter; ++ int idx; ++ ++ if (!bio_flagged(bio, BIO_CLONED)) { ++ *bv = bio->bi_io_vec[bio->bi_vcnt - 1]; ++ return; ++ } ++ ++ if (unlikely(!bio_multiple_segments(bio))) { ++ *bv = bio_iovec(bio); ++ return; ++ } ++ ++ bio_advance_iter(bio, &iter, iter.bi_size); ++ ++ if (!iter.bi_bvec_done) ++ idx = iter.bi_idx - 1; ++ else /* in the middle of bvec */ ++ idx = iter.bi_idx; ++ ++ *bv = bio->bi_io_vec[idx]; ++ ++ /* ++ * iter.bi_bvec_done records actual length of the last bvec ++ * if this bio ends in the middle of one io vector ++ */ ++ if (iter.bi_bvec_done) ++ bv->bv_len = iter.bi_bvec_done; ++} ++ + enum bip_flags { + BIP_BLOCK_INTEGRITY = 1 << 0, /* block layer owns integrity data */ + BIP_MAPPED_INTEGRITY = 1 << 1, /* ref tag has been remapped */ +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index c70e3588a48c..168755791ec8 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1367,6 +1367,13 @@ static inline void put_dev_sector(Sector p) + page_cache_release(p.v); + } + ++static inline bool __bvec_gap_to_prev(struct request_queue *q, ++ struct bio_vec *bprv, unsigned int offset) ++{ ++ return offset || ++ ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q)); ++} ++ + /* + * Check if adding a bio_vec after bprv with offset would create a gap in + * the SG list. Most drivers don't care about this, but some do. +@@ -1376,18 +1383,22 @@ static inline bool bvec_gap_to_prev(struct request_queue *q, + { + if (!queue_virt_boundary(q)) + return false; +- return offset || +- ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q)); ++ return __bvec_gap_to_prev(q, bprv, offset); + } + + static inline bool bio_will_gap(struct request_queue *q, struct bio *prev, + struct bio *next) + { +- if (!bio_has_data(prev)) +- return false; ++ if (bio_has_data(prev) && queue_virt_boundary(q)) { ++ struct bio_vec pb, nb; ++ ++ bio_get_last_bvec(prev, &pb); ++ bio_get_first_bvec(next, &nb); + +- return bvec_gap_to_prev(q, &prev->bi_io_vec[prev->bi_vcnt - 1], +- next->bi_io_vec[0].bv_offset); ++ return __bvec_gap_to_prev(q, &pb, nb.bv_offset); ++ } ++ ++ return false; + } + + static inline bool req_gap_back_merge(struct request *req, struct bio *bio) +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index d67ae119cf4e..8a2e009c8a5a 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -409,9 +409,7 @@ static inline bool d_mountpoint(const struct dentry *dentry) + */ + static inline unsigned __d_entry_type(const struct dentry *dentry) + { +- unsigned type = READ_ONCE(dentry->d_flags); +- smp_rmb(); +- return type & DCACHE_ENTRY_TYPE; ++ return dentry->d_flags & DCACHE_ENTRY_TYPE; + } + + static inline bool d_is_miss(const struct dentry *dentry) +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 600c1e0626a5..b20a2752f934 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -718,7 +718,7 @@ struct ata_device { + union { + u16 id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */ + u32 gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */ +- }; ++ } ____cacheline_aligned; + + /* DEVSLP Timing Variables from Identify Device Data Log */ + u8 devslp_timing[ATA_LOG_DEVSLP_SIZE]; +diff --git a/include/linux/module.h b/include/linux/module.h +index 3a19c79918e0..b229a9961d02 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -302,6 +302,12 @@ struct mod_tree_node { + struct latch_tree_node node; + }; + ++struct mod_kallsyms { ++ Elf_Sym *symtab; ++ unsigned int num_symtab; ++ char *strtab; ++}; ++ + struct module { + enum module_state state; + +@@ -411,14 +417,9 @@ struct module { + #endif + + #ifdef CONFIG_KALLSYMS +- /* +- * We keep the symbol and string tables for kallsyms. +- * The core_* fields below are temporary, loader-only (they +- * could really be discarded after module init). +- */ +- Elf_Sym *symtab, *core_symtab; +- unsigned int num_symtab, core_num_syms; +- char *strtab, *core_strtab; ++ /* Protected by RCU and/or module_mutex: use rcu_dereference() */ ++ struct mod_kallsyms *kallsyms; ++ struct mod_kallsyms core_kallsyms; + + /* Section attributes */ + struct module_sect_attrs *sect_attrs; +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 429fdfc3baf5..925730bc9fc1 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -568,6 +568,8 @@ enum { + FILTER_DYN_STRING, + FILTER_PTR_STRING, + FILTER_TRACE_FN, ++ FILTER_COMM, ++ FILTER_CPU, + }; + + extern int trace_event_raw_init(struct trace_event_call *call); +diff --git a/include/linux/writeback.h b/include/linux/writeback.h +index b333c945e571..d0b5ca5d4e08 100644 +--- a/include/linux/writeback.h ++++ b/include/linux/writeback.h +@@ -198,6 +198,7 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc, + void wbc_detach_inode(struct writeback_control *wbc); + void wbc_account_io(struct writeback_control *wbc, struct page *page, + size_t bytes); ++void cgroup_writeback_umount(void); + + /** + * inode_attach_wb - associate an inode with its wb +@@ -301,6 +302,10 @@ static inline void wbc_account_io(struct writeback_control *wbc, + { + } + ++static inline void cgroup_writeback_umount(void) ++{ ++} ++ + #endif /* CONFIG_CGROUP_WRITEBACK */ + + /* +diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h +index 56cf8e485ef2..28ee5c2e6bcd 100644 +--- a/include/target/target_core_backend.h ++++ b/include/target/target_core_backend.h +@@ -94,5 +94,8 @@ sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd, + sense_reason_t (*exec_cmd)(struct se_cmd *cmd)); + + bool target_sense_desc_format(struct se_device *dev); ++sector_t target_to_linux_sector(struct se_device *dev, sector_t lb); ++bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib, ++ struct request_queue *q, int block_size); + + #endif /* TARGET_CORE_BACKEND_H */ +diff --git a/kernel/module.c b/kernel/module.c +index 14833e6d5e37..0e5c71195f18 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -327,6 +327,9 @@ struct load_info { + struct _ddebug *debug; + unsigned int num_debug; + bool sig_ok; ++#ifdef CONFIG_KALLSYMS ++ unsigned long mod_kallsyms_init_off; ++#endif + struct { + unsigned int sym, str, mod, vers, info, pcpu; + } index; +@@ -2492,10 +2495,21 @@ static void layout_symtab(struct module *mod, struct load_info *info) + strsect->sh_flags |= SHF_ALLOC; + strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect, + info->index.str) | INIT_OFFSET_MASK; +- mod->init_size = debug_align(mod->init_size); + pr_debug("\t%s\n", info->secstrings + strsect->sh_name); ++ ++ /* We'll tack temporary mod_kallsyms on the end. */ ++ mod->init_size = ALIGN(mod->init_size, ++ __alignof__(struct mod_kallsyms)); ++ info->mod_kallsyms_init_off = mod->init_size; ++ mod->init_size += sizeof(struct mod_kallsyms); ++ mod->init_size = debug_align(mod->init_size); + } + ++/* ++ * We use the full symtab and strtab which layout_symtab arranged to ++ * be appended to the init section. Later we switch to the cut-down ++ * core-only ones. ++ */ + static void add_kallsyms(struct module *mod, const struct load_info *info) + { + unsigned int i, ndst; +@@ -2504,28 +2518,33 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) + char *s; + Elf_Shdr *symsec = &info->sechdrs[info->index.sym]; + +- mod->symtab = (void *)symsec->sh_addr; +- mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym); ++ /* Set up to point into init section. */ ++ mod->kallsyms = mod->module_init + info->mod_kallsyms_init_off; ++ ++ mod->kallsyms->symtab = (void *)symsec->sh_addr; ++ mod->kallsyms->num_symtab = symsec->sh_size / sizeof(Elf_Sym); + /* Make sure we get permanent strtab: don't use info->strtab. */ +- mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; ++ mod->kallsyms->strtab = (void *)info->sechdrs[info->index.str].sh_addr; + + /* Set types up while we still have access to sections. */ +- for (i = 0; i < mod->num_symtab; i++) +- mod->symtab[i].st_info = elf_type(&mod->symtab[i], info); +- +- mod->core_symtab = dst = mod->module_core + info->symoffs; +- mod->core_strtab = s = mod->module_core + info->stroffs; +- src = mod->symtab; +- for (ndst = i = 0; i < mod->num_symtab; i++) { ++ for (i = 0; i < mod->kallsyms->num_symtab; i++) ++ mod->kallsyms->symtab[i].st_info ++ = elf_type(&mod->kallsyms->symtab[i], info); ++ ++ /* Now populate the cut down core kallsyms for after init. */ ++ mod->core_kallsyms.symtab = dst = mod->module_core + info->symoffs; ++ mod->core_kallsyms.strtab = s = mod->module_core + info->stroffs; ++ src = mod->kallsyms->symtab; ++ for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) { + if (i == 0 || + is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { + dst[ndst] = src[i]; +- dst[ndst++].st_name = s - mod->core_strtab; +- s += strlcpy(s, &mod->strtab[src[i].st_name], ++ dst[ndst++].st_name = s - mod->core_kallsyms.strtab; ++ s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name], + KSYM_NAME_LEN) + 1; + } + } +- mod->core_num_syms = ndst; ++ mod->core_kallsyms.num_symtab = ndst; + } + #else + static inline void layout_symtab(struct module *mod, struct load_info *info) +@@ -3274,9 +3293,8 @@ static noinline int do_init_module(struct module *mod) + module_put(mod); + trim_init_extable(mod); + #ifdef CONFIG_KALLSYMS +- mod->num_symtab = mod->core_num_syms; +- mod->symtab = mod->core_symtab; +- mod->strtab = mod->core_strtab; ++ /* Switch to core kallsyms now init is done: kallsyms may be walking! */ ++ rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms); + #endif + mod_tree_remove_init(mod); + unset_module_init_ro_nx(mod); +@@ -3646,9 +3664,9 @@ static inline int is_arm_mapping_symbol(const char *str) + && (str[2] == '\0' || str[2] == '.'); + } + +-static const char *symname(struct module *mod, unsigned int symnum) ++static const char *symname(struct mod_kallsyms *kallsyms, unsigned int symnum) + { +- return mod->strtab + mod->symtab[symnum].st_name; ++ return kallsyms->strtab + kallsyms->symtab[symnum].st_name; + } + + static const char *get_ksymbol(struct module *mod, +@@ -3658,6 +3676,7 @@ static const char *get_ksymbol(struct module *mod, + { + unsigned int i, best = 0; + unsigned long nextval; ++ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms); + + /* At worse, next value is at end of module */ + if (within_module_init(addr, mod)) +@@ -3667,32 +3686,32 @@ static const char *get_ksymbol(struct module *mod, + + /* Scan for closest preceding symbol, and next symbol. (ELF + starts real symbols at 1). */ +- for (i = 1; i < mod->num_symtab; i++) { +- if (mod->symtab[i].st_shndx == SHN_UNDEF) ++ for (i = 1; i < kallsyms->num_symtab; i++) { ++ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF) + continue; + + /* We ignore unnamed symbols: they're uninformative + * and inserted at a whim. */ +- if (*symname(mod, i) == '\0' +- || is_arm_mapping_symbol(symname(mod, i))) ++ if (*symname(kallsyms, i) == '\0' ++ || is_arm_mapping_symbol(symname(kallsyms, i))) + continue; + +- if (mod->symtab[i].st_value <= addr +- && mod->symtab[i].st_value > mod->symtab[best].st_value) ++ if (kallsyms->symtab[i].st_value <= addr ++ && kallsyms->symtab[i].st_value > kallsyms->symtab[best].st_value) + best = i; +- if (mod->symtab[i].st_value > addr +- && mod->symtab[i].st_value < nextval) +- nextval = mod->symtab[i].st_value; ++ if (kallsyms->symtab[i].st_value > addr ++ && kallsyms->symtab[i].st_value < nextval) ++ nextval = kallsyms->symtab[i].st_value; + } + + if (!best) + return NULL; + + if (size) +- *size = nextval - mod->symtab[best].st_value; ++ *size = nextval - kallsyms->symtab[best].st_value; + if (offset) +- *offset = addr - mod->symtab[best].st_value; +- return symname(mod, best); ++ *offset = addr - kallsyms->symtab[best].st_value; ++ return symname(kallsyms, best); + } + + /* For kallsyms to ask for address resolution. NULL means not found. Careful +@@ -3782,18 +3801,21 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type, + + preempt_disable(); + list_for_each_entry_rcu(mod, &modules, list) { ++ struct mod_kallsyms *kallsyms; ++ + if (mod->state == MODULE_STATE_UNFORMED) + continue; +- if (symnum < mod->num_symtab) { +- *value = mod->symtab[symnum].st_value; +- *type = mod->symtab[symnum].st_info; +- strlcpy(name, symname(mod, symnum), KSYM_NAME_LEN); ++ kallsyms = rcu_dereference_sched(mod->kallsyms); ++ if (symnum < kallsyms->num_symtab) { ++ *value = kallsyms->symtab[symnum].st_value; ++ *type = kallsyms->symtab[symnum].st_info; ++ strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN); + strlcpy(module_name, mod->name, MODULE_NAME_LEN); + *exported = is_exported(name, *value, mod); + preempt_enable(); + return 0; + } +- symnum -= mod->num_symtab; ++ symnum -= kallsyms->num_symtab; + } + preempt_enable(); + return -ERANGE; +@@ -3802,11 +3824,12 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type, + static unsigned long mod_find_symname(struct module *mod, const char *name) + { + unsigned int i; ++ struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms); + +- for (i = 0; i < mod->num_symtab; i++) +- if (strcmp(name, symname(mod, i)) == 0 && +- mod->symtab[i].st_info != 'U') +- return mod->symtab[i].st_value; ++ for (i = 0; i < kallsyms->num_symtab; i++) ++ if (strcmp(name, symname(kallsyms, i)) == 0 && ++ kallsyms->symtab[i].st_info != 'U') ++ return kallsyms->symtab[i].st_value; + return 0; + } + +@@ -3845,11 +3868,14 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, + module_assert_mutex(); + + list_for_each_entry(mod, &modules, list) { ++ /* We hold module_mutex: no need for rcu_dereference_sched */ ++ struct mod_kallsyms *kallsyms = mod->kallsyms; ++ + if (mod->state == MODULE_STATE_UNFORMED) + continue; +- for (i = 0; i < mod->num_symtab; i++) { +- ret = fn(data, symname(mod, i), +- mod, mod->symtab[i].st_value); ++ for (i = 0; i < kallsyms->num_symtab; i++) { ++ ret = fn(data, symname(kallsyms, i), ++ mod, kallsyms->symtab[i].st_value); + if (ret != 0) + return ret; + } +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index debf6e878076..d202d991edae 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -97,16 +97,16 @@ trace_find_event_field(struct trace_event_call *call, char *name) + struct ftrace_event_field *field; + struct list_head *head; + +- field = __find_event_field(&ftrace_generic_fields, name); ++ head = trace_get_fields(call); ++ field = __find_event_field(head, name); + if (field) + return field; + +- field = __find_event_field(&ftrace_common_fields, name); ++ field = __find_event_field(&ftrace_generic_fields, name); + if (field) + return field; + +- head = trace_get_fields(call); +- return __find_event_field(head, name); ++ return __find_event_field(&ftrace_common_fields, name); + } + + static int __trace_define_field(struct list_head *head, const char *type, +@@ -171,8 +171,10 @@ static int trace_define_generic_fields(void) + { + int ret; + +- __generic_field(int, cpu, FILTER_OTHER); +- __generic_field(char *, comm, FILTER_PTR_STRING); ++ __generic_field(int, CPU, FILTER_CPU); ++ __generic_field(int, cpu, FILTER_CPU); ++ __generic_field(char *, COMM, FILTER_COMM); ++ __generic_field(char *, comm, FILTER_COMM); + + return ret; + } +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index f93a219b18da..6816302542b2 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1043,13 +1043,14 @@ static int init_pred(struct filter_parse_state *ps, + return -EINVAL; + } + +- if (is_string_field(field)) { ++ if (field->filter_type == FILTER_COMM) { ++ filter_build_regex(pred); ++ fn = filter_pred_comm; ++ pred->regex.field_len = TASK_COMM_LEN; ++ } else if (is_string_field(field)) { + filter_build_regex(pred); + +- if (!strcmp(field->name, "comm")) { +- fn = filter_pred_comm; +- pred->regex.field_len = TASK_COMM_LEN; +- } else if (field->filter_type == FILTER_STATIC_STRING) { ++ if (field->filter_type == FILTER_STATIC_STRING) { + fn = filter_pred_string; + pred->regex.field_len = field->size; + } else if (field->filter_type == FILTER_DYN_STRING) +@@ -1072,7 +1073,7 @@ static int init_pred(struct filter_parse_state *ps, + } + pred->val = val; + +- if (!strcmp(field->name, "cpu")) ++ if (field->filter_type == FILTER_CPU) + fn = filter_pred_cpu; + else + fn = select_comparison_fn(pred->op, field->size, +diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c +index b9c0910fb8c4..0608f216f359 100644 +--- a/sound/core/control_compat.c ++++ b/sound/core/control_compat.c +@@ -170,6 +170,19 @@ struct snd_ctl_elem_value32 { + unsigned char reserved[128]; + }; + ++#ifdef CONFIG_X86_X32 ++/* x32 has a different alignment for 64bit values from ia32 */ ++struct snd_ctl_elem_value_x32 { ++ struct snd_ctl_elem_id id; ++ unsigned int indirect; /* bit-field causes misalignment */ ++ union { ++ s32 integer[128]; ++ unsigned char data[512]; ++ s64 integer64[64]; ++ } value; ++ unsigned char reserved[128]; ++}; ++#endif /* CONFIG_X86_X32 */ + + /* get the value type and count of the control */ + static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id, +@@ -219,9 +232,11 @@ static int get_elem_size(int type, int count) + + static int copy_ctl_value_from_user(struct snd_card *card, + struct snd_ctl_elem_value *data, +- struct snd_ctl_elem_value32 __user *data32, ++ void __user *userdata, ++ void __user *valuep, + int *typep, int *countp) + { ++ struct snd_ctl_elem_value32 __user *data32 = userdata; + int i, type, size; + int uninitialized_var(count); + unsigned int indirect; +@@ -239,8 +254,9 @@ static int copy_ctl_value_from_user(struct snd_card *card, + if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || + type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + for (i = 0; i < count; i++) { ++ s32 __user *intp = valuep; + int val; +- if (get_user(val, &data32->value.integer[i])) ++ if (get_user(val, &intp[i])) + return -EFAULT; + data->value.integer.value[i] = val; + } +@@ -250,8 +266,7 @@ static int copy_ctl_value_from_user(struct snd_card *card, + dev_err(card->dev, "snd_ioctl32_ctl_elem_value: unknown type %d\n", type); + return -EINVAL; + } +- if (copy_from_user(data->value.bytes.data, +- data32->value.data, size)) ++ if (copy_from_user(data->value.bytes.data, valuep, size)) + return -EFAULT; + } + +@@ -261,7 +276,8 @@ static int copy_ctl_value_from_user(struct snd_card *card, + } + + /* restore the value to 32bit */ +-static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32, ++static int copy_ctl_value_to_user(void __user *userdata, ++ void __user *valuep, + struct snd_ctl_elem_value *data, + int type, int count) + { +@@ -270,22 +286,22 @@ static int copy_ctl_value_to_user(struct snd_ctl_elem_value32 __user *data32, + if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || + type == SNDRV_CTL_ELEM_TYPE_INTEGER) { + for (i = 0; i < count; i++) { ++ s32 __user *intp = valuep; + int val; + val = data->value.integer.value[i]; +- if (put_user(val, &data32->value.integer[i])) ++ if (put_user(val, &intp[i])) + return -EFAULT; + } + } else { + size = get_elem_size(type, count); +- if (copy_to_user(data32->value.data, +- data->value.bytes.data, size)) ++ if (copy_to_user(valuep, data->value.bytes.data, size)) + return -EFAULT; + } + return 0; + } + +-static int snd_ctl_elem_read_user_compat(struct snd_card *card, +- struct snd_ctl_elem_value32 __user *data32) ++static int ctl_elem_read_user(struct snd_card *card, ++ void __user *userdata, void __user *valuep) + { + struct snd_ctl_elem_value *data; + int err, type, count; +@@ -294,7 +310,9 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card, + if (data == NULL) + return -ENOMEM; + +- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0) ++ err = copy_ctl_value_from_user(card, data, userdata, valuep, ++ &type, &count); ++ if (err < 0) + goto error; + + snd_power_lock(card); +@@ -303,14 +321,15 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card, + err = snd_ctl_elem_read(card, data); + snd_power_unlock(card); + if (err >= 0) +- err = copy_ctl_value_to_user(data32, data, type, count); ++ err = copy_ctl_value_to_user(userdata, valuep, data, ++ type, count); + error: + kfree(data); + return err; + } + +-static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, +- struct snd_ctl_elem_value32 __user *data32) ++static int ctl_elem_write_user(struct snd_ctl_file *file, ++ void __user *userdata, void __user *valuep) + { + struct snd_ctl_elem_value *data; + struct snd_card *card = file->card; +@@ -320,7 +339,9 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, + if (data == NULL) + return -ENOMEM; + +- if ((err = copy_ctl_value_from_user(card, data, data32, &type, &count)) < 0) ++ err = copy_ctl_value_from_user(card, data, userdata, valuep, ++ &type, &count); ++ if (err < 0) + goto error; + + snd_power_lock(card); +@@ -329,12 +350,39 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, + err = snd_ctl_elem_write(card, file, data); + snd_power_unlock(card); + if (err >= 0) +- err = copy_ctl_value_to_user(data32, data, type, count); ++ err = copy_ctl_value_to_user(userdata, valuep, data, ++ type, count); + error: + kfree(data); + return err; + } + ++static int snd_ctl_elem_read_user_compat(struct snd_card *card, ++ struct snd_ctl_elem_value32 __user *data32) ++{ ++ return ctl_elem_read_user(card, data32, &data32->value); ++} ++ ++static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file, ++ struct snd_ctl_elem_value32 __user *data32) ++{ ++ return ctl_elem_write_user(file, data32, &data32->value); ++} ++ ++#ifdef CONFIG_X86_X32 ++static int snd_ctl_elem_read_user_x32(struct snd_card *card, ++ struct snd_ctl_elem_value_x32 __user *data32) ++{ ++ return ctl_elem_read_user(card, data32, &data32->value); ++} ++ ++static int snd_ctl_elem_write_user_x32(struct snd_ctl_file *file, ++ struct snd_ctl_elem_value_x32 __user *data32) ++{ ++ return ctl_elem_write_user(file, data32, &data32->value); ++} ++#endif /* CONFIG_X86_X32 */ ++ + /* add or replace a user control */ + static int snd_ctl_elem_add_compat(struct snd_ctl_file *file, + struct snd_ctl_elem_info32 __user *data32, +@@ -393,6 +441,10 @@ enum { + SNDRV_CTL_IOCTL_ELEM_WRITE32 = _IOWR('U', 0x13, struct snd_ctl_elem_value32), + SNDRV_CTL_IOCTL_ELEM_ADD32 = _IOWR('U', 0x17, struct snd_ctl_elem_info32), + SNDRV_CTL_IOCTL_ELEM_REPLACE32 = _IOWR('U', 0x18, struct snd_ctl_elem_info32), ++#ifdef CONFIG_X86_X32 ++ SNDRV_CTL_IOCTL_ELEM_READ_X32 = _IOWR('U', 0x12, struct snd_ctl_elem_value_x32), ++ SNDRV_CTL_IOCTL_ELEM_WRITE_X32 = _IOWR('U', 0x13, struct snd_ctl_elem_value_x32), ++#endif /* CONFIG_X86_X32 */ + }; + + static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +@@ -431,6 +483,12 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns + return snd_ctl_elem_add_compat(ctl, argp, 0); + case SNDRV_CTL_IOCTL_ELEM_REPLACE32: + return snd_ctl_elem_add_compat(ctl, argp, 1); ++#ifdef CONFIG_X86_X32 ++ case SNDRV_CTL_IOCTL_ELEM_READ_X32: ++ return snd_ctl_elem_read_user_x32(ctl->card, argp); ++ case SNDRV_CTL_IOCTL_ELEM_WRITE_X32: ++ return snd_ctl_elem_write_user_x32(ctl, argp); ++#endif /* CONFIG_X86_X32 */ + } + + down_read(&snd_ioctl_rwsem); +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c +index 9630e9f72b7b..1f64ab0c2a95 100644 +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -183,6 +183,14 @@ static int snd_pcm_ioctl_channel_info_compat(struct snd_pcm_substream *substream + return err; + } + ++#ifdef CONFIG_X86_X32 ++/* X32 ABI has the same struct as x86-64 for snd_pcm_channel_info */ ++static int snd_pcm_channel_info_user(struct snd_pcm_substream *substream, ++ struct snd_pcm_channel_info __user *src); ++#define snd_pcm_ioctl_channel_info_x32(s, p) \ ++ snd_pcm_channel_info_user(s, p) ++#endif /* CONFIG_X86_X32 */ ++ + struct snd_pcm_status32 { + s32 state; + struct compat_timespec trigger_tstamp; +@@ -243,6 +251,71 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream, + return err; + } + ++#ifdef CONFIG_X86_X32 ++/* X32 ABI has 64bit timespec and 64bit alignment */ ++struct snd_pcm_status_x32 { ++ s32 state; ++ u32 rsvd; /* alignment */ ++ struct timespec trigger_tstamp; ++ struct timespec tstamp; ++ u32 appl_ptr; ++ u32 hw_ptr; ++ s32 delay; ++ u32 avail; ++ u32 avail_max; ++ u32 overrange; ++ s32 suspended_state; ++ u32 audio_tstamp_data; ++ struct timespec audio_tstamp; ++ struct timespec driver_tstamp; ++ u32 audio_tstamp_accuracy; ++ unsigned char reserved[52-2*sizeof(struct timespec)]; ++} __packed; ++ ++#define put_timespec(src, dst) copy_to_user(dst, src, sizeof(*dst)) ++ ++static int snd_pcm_status_user_x32(struct snd_pcm_substream *substream, ++ struct snd_pcm_status_x32 __user *src, ++ bool ext) ++{ ++ struct snd_pcm_status status; ++ int err; ++ ++ memset(&status, 0, sizeof(status)); ++ /* ++ * with extension, parameters are read/write, ++ * get audio_tstamp_data from user, ++ * ignore rest of status structure ++ */ ++ if (ext && get_user(status.audio_tstamp_data, ++ (u32 __user *)(&src->audio_tstamp_data))) ++ return -EFAULT; ++ err = snd_pcm_status(substream, &status); ++ if (err < 0) ++ return err; ++ ++ if (clear_user(src, sizeof(*src))) ++ return -EFAULT; ++ if (put_user(status.state, &src->state) || ++ put_timespec(&status.trigger_tstamp, &src->trigger_tstamp) || ++ put_timespec(&status.tstamp, &src->tstamp) || ++ put_user(status.appl_ptr, &src->appl_ptr) || ++ put_user(status.hw_ptr, &src->hw_ptr) || ++ put_user(status.delay, &src->delay) || ++ put_user(status.avail, &src->avail) || ++ put_user(status.avail_max, &src->avail_max) || ++ put_user(status.overrange, &src->overrange) || ++ put_user(status.suspended_state, &src->suspended_state) || ++ put_user(status.audio_tstamp_data, &src->audio_tstamp_data) || ++ put_timespec(&status.audio_tstamp, &src->audio_tstamp) || ++ put_timespec(&status.driver_tstamp, &src->driver_tstamp) || ++ put_user(status.audio_tstamp_accuracy, &src->audio_tstamp_accuracy)) ++ return -EFAULT; ++ ++ return err; ++} ++#endif /* CONFIG_X86_X32 */ ++ + /* both for HW_PARAMS and HW_REFINE */ + static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream, + int refine, +@@ -469,6 +542,93 @@ static int snd_pcm_ioctl_sync_ptr_compat(struct snd_pcm_substream *substream, + return 0; + } + ++#ifdef CONFIG_X86_X32 ++/* X32 ABI has 64bit timespec and 64bit alignment */ ++struct snd_pcm_mmap_status_x32 { ++ s32 state; ++ s32 pad1; ++ u32 hw_ptr; ++ u32 pad2; /* alignment */ ++ struct timespec tstamp; ++ s32 suspended_state; ++ struct timespec audio_tstamp; ++} __packed; ++ ++struct snd_pcm_mmap_control_x32 { ++ u32 appl_ptr; ++ u32 avail_min; ++}; ++ ++struct snd_pcm_sync_ptr_x32 { ++ u32 flags; ++ u32 rsvd; /* alignment */ ++ union { ++ struct snd_pcm_mmap_status_x32 status; ++ unsigned char reserved[64]; ++ } s; ++ union { ++ struct snd_pcm_mmap_control_x32 control; ++ unsigned char reserved[64]; ++ } c; ++} __packed; ++ ++static int snd_pcm_ioctl_sync_ptr_x32(struct snd_pcm_substream *substream, ++ struct snd_pcm_sync_ptr_x32 __user *src) ++{ ++ struct snd_pcm_runtime *runtime = substream->runtime; ++ volatile struct snd_pcm_mmap_status *status; ++ volatile struct snd_pcm_mmap_control *control; ++ u32 sflags; ++ struct snd_pcm_mmap_control scontrol; ++ struct snd_pcm_mmap_status sstatus; ++ snd_pcm_uframes_t boundary; ++ int err; ++ ++ if (snd_BUG_ON(!runtime)) ++ return -EINVAL; ++ ++ if (get_user(sflags, &src->flags) || ++ get_user(scontrol.appl_ptr, &src->c.control.appl_ptr) || ++ get_user(scontrol.avail_min, &src->c.control.avail_min)) ++ return -EFAULT; ++ if (sflags & SNDRV_PCM_SYNC_PTR_HWSYNC) { ++ err = snd_pcm_hwsync(substream); ++ if (err < 0) ++ return err; ++ } ++ status = runtime->status; ++ control = runtime->control; ++ boundary = recalculate_boundary(runtime); ++ if (!boundary) ++ boundary = 0x7fffffff; ++ snd_pcm_stream_lock_irq(substream); ++ /* FIXME: we should consider the boundary for the sync from app */ ++ if (!(sflags & SNDRV_PCM_SYNC_PTR_APPL)) ++ control->appl_ptr = scontrol.appl_ptr; ++ else ++ scontrol.appl_ptr = control->appl_ptr % boundary; ++ if (!(sflags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN)) ++ control->avail_min = scontrol.avail_min; ++ else ++ scontrol.avail_min = control->avail_min; ++ sstatus.state = status->state; ++ sstatus.hw_ptr = status->hw_ptr % boundary; ++ sstatus.tstamp = status->tstamp; ++ sstatus.suspended_state = status->suspended_state; ++ sstatus.audio_tstamp = status->audio_tstamp; ++ snd_pcm_stream_unlock_irq(substream); ++ if (put_user(sstatus.state, &src->s.status.state) || ++ put_user(sstatus.hw_ptr, &src->s.status.hw_ptr) || ++ put_timespec(&sstatus.tstamp, &src->s.status.tstamp) || ++ put_user(sstatus.suspended_state, &src->s.status.suspended_state) || ++ put_timespec(&sstatus.audio_tstamp, &src->s.status.audio_tstamp) || ++ put_user(scontrol.appl_ptr, &src->c.control.appl_ptr) || ++ put_user(scontrol.avail_min, &src->c.control.avail_min)) ++ return -EFAULT; ++ ++ return 0; ++} ++#endif /* CONFIG_X86_X32 */ + + /* + */ +@@ -487,7 +647,12 @@ enum { + SNDRV_PCM_IOCTL_WRITEN_FRAMES32 = _IOW('A', 0x52, struct snd_xfern32), + SNDRV_PCM_IOCTL_READN_FRAMES32 = _IOR('A', 0x53, struct snd_xfern32), + SNDRV_PCM_IOCTL_SYNC_PTR32 = _IOWR('A', 0x23, struct snd_pcm_sync_ptr32), +- ++#ifdef CONFIG_X86_X32 ++ SNDRV_PCM_IOCTL_CHANNEL_INFO_X32 = _IOR('A', 0x32, struct snd_pcm_channel_info), ++ SNDRV_PCM_IOCTL_STATUS_X32 = _IOR('A', 0x20, struct snd_pcm_status_x32), ++ SNDRV_PCM_IOCTL_STATUS_EXT_X32 = _IOWR('A', 0x24, struct snd_pcm_status_x32), ++ SNDRV_PCM_IOCTL_SYNC_PTR_X32 = _IOWR('A', 0x23, struct snd_pcm_sync_ptr_x32), ++#endif /* CONFIG_X86_X32 */ + }; + + static long snd_pcm_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +@@ -559,6 +724,16 @@ static long snd_pcm_ioctl_compat(struct file *file, unsigned int cmd, unsigned l + return snd_pcm_ioctl_rewind_compat(substream, argp); + case SNDRV_PCM_IOCTL_FORWARD32: + return snd_pcm_ioctl_forward_compat(substream, argp); ++#ifdef CONFIG_X86_X32 ++ case SNDRV_PCM_IOCTL_STATUS_X32: ++ return snd_pcm_status_user_x32(substream, argp, false); ++ case SNDRV_PCM_IOCTL_STATUS_EXT_X32: ++ return snd_pcm_status_user_x32(substream, argp, true); ++ case SNDRV_PCM_IOCTL_SYNC_PTR_X32: ++ return snd_pcm_ioctl_sync_ptr_x32(substream, argp); ++ case SNDRV_PCM_IOCTL_CHANNEL_INFO_X32: ++ return snd_pcm_ioctl_channel_info_x32(substream, argp); ++#endif /* CONFIG_X86_X32 */ + } + + return -ENOIOCTLCMD; +diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c +index 5268c1f58c25..09a89094dcf7 100644 +--- a/sound/core/rawmidi_compat.c ++++ b/sound/core/rawmidi_compat.c +@@ -94,9 +94,58 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile, + return 0; + } + ++#ifdef CONFIG_X86_X32 ++/* X32 ABI has 64bit timespec and 64bit alignment */ ++struct snd_rawmidi_status_x32 { ++ s32 stream; ++ u32 rsvd; /* alignment */ ++ struct timespec tstamp; ++ u32 avail; ++ u32 xruns; ++ unsigned char reserved[16]; ++} __attribute__((packed)); ++ ++#define put_timespec(src, dst) copy_to_user(dst, src, sizeof(*dst)) ++ ++static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile, ++ struct snd_rawmidi_status_x32 __user *src) ++{ ++ int err; ++ struct snd_rawmidi_status status; ++ ++ if (rfile->output == NULL) ++ return -EINVAL; ++ if (get_user(status.stream, &src->stream)) ++ return -EFAULT; ++ ++ switch (status.stream) { ++ case SNDRV_RAWMIDI_STREAM_OUTPUT: ++ err = snd_rawmidi_output_status(rfile->output, &status); ++ break; ++ case SNDRV_RAWMIDI_STREAM_INPUT: ++ err = snd_rawmidi_input_status(rfile->input, &status); ++ break; ++ default: ++ return -EINVAL; ++ } ++ if (err < 0) ++ return err; ++ ++ if (put_timespec(&status.tstamp, &src->tstamp) || ++ put_user(status.avail, &src->avail) || ++ put_user(status.xruns, &src->xruns)) ++ return -EFAULT; ++ ++ return 0; ++} ++#endif /* CONFIG_X86_X32 */ ++ + enum { + SNDRV_RAWMIDI_IOCTL_PARAMS32 = _IOWR('W', 0x10, struct snd_rawmidi_params32), + SNDRV_RAWMIDI_IOCTL_STATUS32 = _IOWR('W', 0x20, struct snd_rawmidi_status32), ++#ifdef CONFIG_X86_X32 ++ SNDRV_RAWMIDI_IOCTL_STATUS_X32 = _IOWR('W', 0x20, struct snd_rawmidi_status_x32), ++#endif /* CONFIG_X86_X32 */ + }; + + static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +@@ -115,6 +164,10 @@ static long snd_rawmidi_ioctl_compat(struct file *file, unsigned int cmd, unsign + return snd_rawmidi_ioctl_params_compat(rfile, argp); + case SNDRV_RAWMIDI_IOCTL_STATUS32: + return snd_rawmidi_ioctl_status_compat(rfile, argp); ++#ifdef CONFIG_X86_X32 ++ case SNDRV_RAWMIDI_IOCTL_STATUS_X32: ++ return snd_rawmidi_ioctl_status_x32(rfile, argp); ++#endif /* CONFIG_X86_X32 */ + } + return -ENOIOCTLCMD; + } +diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c +index 7354b8bed860..cb23899100ee 100644 +--- a/sound/core/seq/oss/seq_oss.c ++++ b/sound/core/seq/oss/seq_oss.c +@@ -148,8 +148,6 @@ odev_release(struct inode *inode, struct file *file) + if ((dp = file->private_data) == NULL) + return 0; + +- snd_seq_oss_drain_write(dp); +- + mutex_lock(®ister_mutex); + snd_seq_oss_release(dp); + mutex_unlock(®ister_mutex); +diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h +index b43924325249..d7b4d016b547 100644 +--- a/sound/core/seq/oss/seq_oss_device.h ++++ b/sound/core/seq/oss/seq_oss_device.h +@@ -127,7 +127,6 @@ int snd_seq_oss_write(struct seq_oss_devinfo *dp, const char __user *buf, int co + unsigned int snd_seq_oss_poll(struct seq_oss_devinfo *dp, struct file *file, poll_table * wait); + + void snd_seq_oss_reset(struct seq_oss_devinfo *dp); +-void snd_seq_oss_drain_write(struct seq_oss_devinfo *dp); + + /* */ + void snd_seq_oss_process_queue(struct seq_oss_devinfo *dp, abstime_t time); +diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c +index 6779e82b46dd..92c96a95a903 100644 +--- a/sound/core/seq/oss/seq_oss_init.c ++++ b/sound/core/seq/oss/seq_oss_init.c +@@ -436,22 +436,6 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp) + + + /* +- * Wait until the queue is empty (if we don't have nonblock) +- */ +-void +-snd_seq_oss_drain_write(struct seq_oss_devinfo *dp) +-{ +- if (! dp->timer->running) +- return; +- if (is_write_mode(dp->file_mode) && !is_nonblock_mode(dp->file_mode) && +- dp->writeq) { +- while (snd_seq_oss_writeq_sync(dp->writeq)) +- ; +- } +-} +- +- +-/* + * reset sequencer devices + */ + void +diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c +index e05802ae6e1b..2e908225d754 100644 +--- a/sound/core/timer_compat.c ++++ b/sound/core/timer_compat.c +@@ -70,13 +70,14 @@ static int snd_timer_user_status_compat(struct file *file, + struct snd_timer_status32 __user *_status) + { + struct snd_timer_user *tu; +- struct snd_timer_status status; ++ struct snd_timer_status32 status; + + tu = file->private_data; + if (snd_BUG_ON(!tu->timeri)) + return -ENXIO; + memset(&status, 0, sizeof(status)); +- status.tstamp = tu->tstamp; ++ status.tstamp.tv_sec = tu->tstamp.tv_sec; ++ status.tstamp.tv_nsec = tu->tstamp.tv_nsec; + status.resolution = snd_timer_resolution(tu->timeri); + status.lost = tu->timeri->lost; + status.overrun = tu->overrun; +@@ -88,12 +89,21 @@ static int snd_timer_user_status_compat(struct file *file, + return 0; + } + ++#ifdef CONFIG_X86_X32 ++/* X32 ABI has the same struct as x86-64 */ ++#define snd_timer_user_status_x32(file, s) \ ++ snd_timer_user_status(file, s) ++#endif /* CONFIG_X86_X32 */ ++ + /* + */ + + enum { + SNDRV_TIMER_IOCTL_INFO32 = _IOR('T', 0x11, struct snd_timer_info32), + SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32), ++#ifdef CONFIG_X86_X32 ++ SNDRV_TIMER_IOCTL_STATUS_X32 = _IOW('T', 0x14, struct snd_timer_status), ++#endif /* CONFIG_X86_X32 */ + }; + + static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +@@ -122,6 +132,10 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns + return snd_timer_user_info_compat(file, argp); + case SNDRV_TIMER_IOCTL_STATUS32: + return snd_timer_user_status_compat(file, argp); ++#ifdef CONFIG_X86_X32 ++ case SNDRV_TIMER_IOCTL_STATUS_X32: ++ return snd_timer_user_status_x32(file, argp); ++#endif /* CONFIG_X86_X32 */ + } + return -ENOIOCTLCMD; + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 72fa58dd7723..c2430b36e1ce 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5386,6 +5386,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK), + SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK), ++ SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), +diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c +index 2875b4f6d8c9..7c8941b8b2de 100644 +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -2879,7 +2879,7 @@ static int snd_hdsp_get_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl + { + struct hdsp *hdsp = snd_kcontrol_chip(kcontrol); + +- ucontrol->value.enumerated.item[0] = hdsp_dds_offset(hdsp); ++ ucontrol->value.integer.value[0] = hdsp_dds_offset(hdsp); + return 0; + } + +@@ -2891,7 +2891,7 @@ static int snd_hdsp_put_dds_offset(struct snd_kcontrol *kcontrol, struct snd_ctl + + if (!snd_hdsp_use_is_exclusive(hdsp)) + return -EBUSY; +- val = ucontrol->value.enumerated.item[0]; ++ val = ucontrol->value.integer.value[0]; + spin_lock_irq(&hdsp->lock); + if (val != hdsp_dds_offset(hdsp)) + change = (hdsp_set_dds_offset(hdsp, val) == 0) ? 1 : 0; +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index 8bc8016c173d..a4a999a0317e 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -1601,6 +1601,9 @@ static void hdspm_set_dds_value(struct hdspm *hdspm, int rate) + { + u64 n; + ++ if (snd_BUG_ON(rate <= 0)) ++ return; ++ + if (rate >= 112000) + rate /= 4; + else if (rate >= 56000) +@@ -2215,6 +2218,8 @@ static int hdspm_get_system_sample_rate(struct hdspm *hdspm) + } else { + /* slave mode, return external sample rate */ + rate = hdspm_external_sample_rate(hdspm); ++ if (!rate) ++ rate = hdspm->system_sample_rate; + } + } + +@@ -2260,8 +2265,11 @@ static int snd_hdspm_put_system_sample_rate(struct snd_kcontrol *kcontrol, + ucontrol) + { + struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); ++ int rate = ucontrol->value.integer.value[0]; + +- hdspm_set_dds_value(hdspm, ucontrol->value.enumerated.item[0]); ++ if (rate < 27000 || rate > 207000) ++ return -EINVAL; ++ hdspm_set_dds_value(hdspm, ucontrol->value.integer.value[0]); + return 0; + } + +@@ -4449,7 +4457,7 @@ static int snd_hdspm_get_tco_word_term(struct snd_kcontrol *kcontrol, + { + struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); + +- ucontrol->value.enumerated.item[0] = hdspm->tco->term; ++ ucontrol->value.integer.value[0] = hdspm->tco->term; + + return 0; + } +@@ -4460,8 +4468,8 @@ static int snd_hdspm_put_tco_word_term(struct snd_kcontrol *kcontrol, + { + struct hdspm *hdspm = snd_kcontrol_chip(kcontrol); + +- if (hdspm->tco->term != ucontrol->value.enumerated.item[0]) { +- hdspm->tco->term = ucontrol->value.enumerated.item[0]; ++ if (hdspm->tco->term != ucontrol->value.integer.value[0]) { ++ hdspm->tco->term = ucontrol->value.integer.value[0]; + + hdspm_tco_write(hdspm); + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 4f6ce1cac8e2..c458d60d5030 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1124,6 +1124,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ + case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ + case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ ++ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ + case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */ diff --git a/patch/kernel/udoo-next/patch-4.4.5-6.patch b/patch/kernel/udoo-next/patch-4.4.5-6.patch new file mode 100644 index 000000000..ea95a920e --- /dev/null +++ b/patch/kernel/udoo-next/patch-4.4.5-6.patch @@ -0,0 +1,1740 @@ +diff --git a/Documentation/devicetree/bindings/arm/omap/omap.txt b/Documentation/devicetree/bindings/arm/omap/omap.txt +index 9f4e5136e568..12af302bca6a 100644 +--- a/Documentation/devicetree/bindings/arm/omap/omap.txt ++++ b/Documentation/devicetree/bindings/arm/omap/omap.txt +@@ -23,6 +23,7 @@ Optional properties: + during suspend. + - ti,no-reset-on-init: When present, the module should not be reset at init + - ti,no-idle-on-init: When present, the module should not be idled at init ++- ti,no-idle: When present, the module is never allowed to idle. + + Example: + +diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt +index 3a4d681c3e98..b653641d4261 100644 +--- a/Documentation/virtual/kvm/mmu.txt ++++ b/Documentation/virtual/kvm/mmu.txt +@@ -358,7 +358,8 @@ In the first case there are two additional complications: + - if CR4.SMEP is enabled: since we've turned the page into a kernel page, + the kernel may now execute it. We handle this by also setting spte.nx. + If we get a user fetch or read fault, we'll change spte.u=1 and +- spte.nx=gpte.nx back. ++ spte.nx=gpte.nx back. For this to work, KVM forces EFER.NX to 1 when ++ shadow paging is in use. + - if CR4.SMAP is disabled: since the page has been changed to a kernel + page, it can not be reused when CR4.SMAP is enabled. We set + CR4.SMAP && !CR0.WP into shadow page's role to avoid this case. Note, +diff --git a/Makefile b/Makefile +index d13322ade3a0..87d12b44ab66 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 5 ++SUBLEVEL = 6 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/armada-xp-axpwifiap.dts b/arch/arm/boot/dts/armada-xp-axpwifiap.dts +index 23fc670c0427..5c21b236721f 100644 +--- a/arch/arm/boot/dts/armada-xp-axpwifiap.dts ++++ b/arch/arm/boot/dts/armada-xp-axpwifiap.dts +@@ -70,8 +70,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + pcie-controller { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts +index f774101416a5..ebe1d267406d 100644 +--- a/arch/arm/boot/dts/armada-xp-db.dts ++++ b/arch/arm/boot/dts/armada-xp-db.dts +@@ -76,8 +76,8 @@ + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + devbus-bootcs { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts +index 4878d7353069..5730b875c4f5 100644 +--- a/arch/arm/boot/dts/armada-xp-gp.dts ++++ b/arch/arm/boot/dts/armada-xp-gp.dts +@@ -95,8 +95,8 @@ + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + devbus-bootcs { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts +index 58b500873bfd..d960fef77ca1 100644 +--- a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts ++++ b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts +@@ -65,8 +65,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + pcie-controller { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-linksys-mamba.dts b/arch/arm/boot/dts/armada-xp-linksys-mamba.dts +index 6e9820e141f8..b89e6cf1271a 100644 +--- a/arch/arm/boot/dts/armada-xp-linksys-mamba.dts ++++ b/arch/arm/boot/dts/armada-xp-linksys-mamba.dts +@@ -70,8 +70,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + pcie-controller { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-matrix.dts b/arch/arm/boot/dts/armada-xp-matrix.dts +index 6ab33837a2b6..6522b04f4a8e 100644 +--- a/arch/arm/boot/dts/armada-xp-matrix.dts ++++ b/arch/arm/boot/dts/armada-xp-matrix.dts +@@ -68,8 +68,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + internal-regs { + serial@12000 { +diff --git a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts +index 6fe8972de0a2..db54c7158a36 100644 +--- a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts ++++ b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts +@@ -64,8 +64,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + pcie-controller { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +index a5db17782e08..853bd392a4fe 100644 +--- a/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts ++++ b/arch/arm/boot/dts/armada-xp-openblocks-ax3-4.dts +@@ -65,9 +65,9 @@ + soc { + ranges = ; ++ MBUS_ID(0x01, 0x2f) 0 0 0xe8000000 0x8000000 ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + devbus-bootcs { + status = "okay"; +diff --git a/arch/arm/boot/dts/armada-xp-synology-ds414.dts b/arch/arm/boot/dts/armada-xp-synology-ds414.dts +index 2391b11dc546..d17dab0a6f51 100644 +--- a/arch/arm/boot/dts/armada-xp-synology-ds414.dts ++++ b/arch/arm/boot/dts/armada-xp-synology-ds414.dts +@@ -78,8 +78,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x09) 0 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x05) 0 0 0xf1110000 0x10000>; + + pcie-controller { + status = "okay"; +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index fe99231cbde5..c2a03c740e79 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -1497,6 +1497,16 @@ + 0x48485200 0x2E00>; + #address-cells = <1>; + #size-cells = <1>; ++ ++ /* ++ * Do not allow gating of cpsw clock as workaround ++ * for errata i877. Keeping internal clock disabled ++ * causes the device switching characteristics ++ * to degrade over time and eventually fail to meet ++ * the data manual delay time/skew specs. ++ */ ++ ti,no-idle; ++ + /* + * rx_thresh_pend + * rx_pend +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index 48495ad82aba..8e0bd5939e5a 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2200,6 +2200,11 @@ static int _enable(struct omap_hwmod *oh) + */ + static int _idle(struct omap_hwmod *oh) + { ++ if (oh->flags & HWMOD_NO_IDLE) { ++ oh->_int_flags |= _HWMOD_SKIP_ENABLE; ++ return 0; ++ } ++ + pr_debug("omap_hwmod: %s: idling\n", oh->name); + + if (oh->_state != _HWMOD_STATE_ENABLED) { +@@ -2504,6 +2509,8 @@ static int __init _init(struct omap_hwmod *oh, void *data) + oh->flags |= HWMOD_INIT_NO_RESET; + if (of_find_property(np, "ti,no-idle-on-init", NULL)) + oh->flags |= HWMOD_INIT_NO_IDLE; ++ if (of_find_property(np, "ti,no-idle", NULL)) ++ oh->flags |= HWMOD_NO_IDLE; + } + + oh->_state = _HWMOD_STATE_INITIALIZED; +@@ -2630,7 +2637,7 @@ static void __init _setup_postsetup(struct omap_hwmod *oh) + * XXX HWMOD_INIT_NO_IDLE does not belong in hwmod data - + * it should be set by the core code as a runtime flag during startup + */ +- if ((oh->flags & HWMOD_INIT_NO_IDLE) && ++ if ((oh->flags & (HWMOD_INIT_NO_IDLE | HWMOD_NO_IDLE)) && + (postsetup_state == _HWMOD_STATE_IDLE)) { + oh->_int_flags |= _HWMOD_SKIP_ENABLE; + postsetup_state = _HWMOD_STATE_ENABLED; +diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h +index 76bce11c85a4..7c7a31169475 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.h ++++ b/arch/arm/mach-omap2/omap_hwmod.h +@@ -525,6 +525,8 @@ struct omap_hwmod_omap4_prcm { + * or idled. + * HWMOD_OPT_CLKS_NEEDED: The optional clocks are needed for the module to + * operate and they need to be handled at the same time as the main_clk. ++ * HWMOD_NO_IDLE: Do not idle the hwmod at all. Useful to handle certain ++ * IPs like CPSW on DRA7, where clocks to this module cannot be disabled. + */ + #define HWMOD_SWSUP_SIDLE (1 << 0) + #define HWMOD_SWSUP_MSTANDBY (1 << 1) +@@ -541,6 +543,7 @@ struct omap_hwmod_omap4_prcm { + #define HWMOD_SWSUP_SIDLE_ACT (1 << 12) + #define HWMOD_RECONFIG_IO_CHAIN (1 << 13) + #define HWMOD_OPT_CLKS_NEEDED (1 << 14) ++#define HWMOD_NO_IDLE (1 << 15) + + /* + * omap_hwmod._int_flags definitions +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index fc9f7ef2f4ab..eaa9cabf4066 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -40,7 +40,7 @@ + * VMALLOC_END: extends to the available space below vmmemmap, PCI I/O space, + * fixed mappings and modules + */ +-#define VMEMMAP_SIZE ALIGN((1UL << (VA_BITS - PAGE_SHIFT - 1)) * sizeof(struct page), PUD_SIZE) ++#define VMEMMAP_SIZE ALIGN((1UL << (VA_BITS - PAGE_SHIFT)) * sizeof(struct page), PUD_SIZE) + + #ifndef CONFIG_KASAN + #define VMALLOC_START (VA_START) +@@ -52,7 +52,8 @@ + #define VMALLOC_END (PAGE_OFFSET - PUD_SIZE - VMEMMAP_SIZE - SZ_64K) + + #define VMEMMAP_START (VMALLOC_END + SZ_64K) +-#define vmemmap ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT)) ++#define vmemmap ((struct page *)VMEMMAP_START - \ ++ SECTION_ALIGN_DOWN(memstart_addr >> PAGE_SHIFT)) + + #define FIRST_USER_ADDRESS 0UL + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 71683a853372..db459612de44 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -2155,7 +2155,7 @@ config MIPS_MT_SMP + select CPU_MIPSR2_IRQ_VI + select CPU_MIPSR2_IRQ_EI + select SYNC_R4K +- select MIPS_GIC_IPI ++ select MIPS_GIC_IPI if MIPS_GIC + select MIPS_MT + select SMP + select SMP_UP +@@ -2253,7 +2253,7 @@ config MIPS_VPE_APSP_API_MT + config MIPS_CMP + bool "MIPS CMP framework support (DEPRECATED)" + depends on SYS_SUPPORTS_MIPS_CMP && !CPU_MIPSR6 +- select MIPS_GIC_IPI ++ select MIPS_GIC_IPI if MIPS_GIC + select SMP + select SYNC_R4K + select SYS_SUPPORTS_SMP +@@ -2273,7 +2273,7 @@ config MIPS_CPS + select MIPS_CM + select MIPS_CPC + select MIPS_CPS_PM if HOTPLUG_CPU +- select MIPS_GIC_IPI ++ select MIPS_GIC_IPI if MIPS_GIC + select SMP + select SYNC_R4K if (CEVT_R4K || CSRC_R4K) + select SYS_SUPPORTS_HOTPLUG_CPU +@@ -2292,6 +2292,7 @@ config MIPS_CPS_PM + bool + + config MIPS_GIC_IPI ++ depends on MIPS_GIC + bool + + config MIPS_CM +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index bd4385a8e6e8..2b521e07b860 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -121,6 +121,7 @@ static inline void calculate_cpu_foreign_map(void) + cpumask_t temp_foreign_map; + + /* Re-calculate the mask */ ++ cpumask_clear(&temp_foreign_map); + for_each_online_cpu(i) { + core_present = 0; + for_each_cpu(k, &temp_foreign_map) +diff --git a/arch/powerpc/include/asm/opal-api.h b/arch/powerpc/include/asm/opal-api.h +index 8374afed9d0a..f8faaaeeca1e 100644 +--- a/arch/powerpc/include/asm/opal-api.h ++++ b/arch/powerpc/include/asm/opal-api.h +@@ -157,7 +157,8 @@ + #define OPAL_LEDS_GET_INDICATOR 114 + #define OPAL_LEDS_SET_INDICATOR 115 + #define OPAL_CEC_REBOOT2 116 +-#define OPAL_LAST 116 ++#define OPAL_CONSOLE_FLUSH 117 ++#define OPAL_LAST 117 + + /* Device tree flags */ + +diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h +index 800115910e43..07a99e638449 100644 +--- a/arch/powerpc/include/asm/opal.h ++++ b/arch/powerpc/include/asm/opal.h +@@ -35,6 +35,7 @@ int64_t opal_console_read(int64_t term_number, __be64 *length, + uint8_t *buffer); + int64_t opal_console_write_buffer_space(int64_t term_number, + __be64 *length); ++int64_t opal_console_flush(int64_t term_number); + int64_t opal_rtc_read(__be32 *year_month_day, + __be64 *hour_minute_second_millisecond); + int64_t opal_rtc_write(uint32_t year_month_day, +@@ -262,6 +263,8 @@ extern int opal_resync_timebase(void); + + extern void opal_lpc_init(void); + ++extern void opal_kmsg_init(void); ++ + extern int opal_event_request(unsigned int opal_event_nr); + + struct opal_sg_list *opal_vmalloc_to_sg_list(void *vmalloc_addr, +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 59663af9315f..e4f7d4eed20c 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -335,7 +335,7 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) + if (syms[i].st_shndx == SHN_UNDEF) { + char *name = strtab + syms[i].st_name; + if (name[0] == '.') +- memmove(name, name+1, strlen(name)); ++ syms[i].st_name++; + } + } + } +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index e57cc383e5da..463af88c95a2 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -1370,6 +1370,20 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + std r6, VCPU_ACOP(r9) + stw r7, VCPU_GUEST_PID(r9) + std r8, VCPU_WORT(r9) ++ /* ++ * Restore various registers to 0, where non-zero values ++ * set by the guest could disrupt the host. ++ */ ++ li r0, 0 ++ mtspr SPRN_IAMR, r0 ++ mtspr SPRN_CIABR, r0 ++ mtspr SPRN_DAWRX, r0 ++ mtspr SPRN_TCSCR, r0 ++ mtspr SPRN_WORT, r0 ++ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */ ++ li r0, 1 ++ sldi r0, r0, 31 ++ mtspr SPRN_MMCRS, r0 + 8: + + /* Save and reset AMR and UAMOR before turning on the MMU */ +diff --git a/arch/powerpc/platforms/powernv/Makefile b/arch/powerpc/platforms/powernv/Makefile +index 1c8cdb6250e7..b9de7ef48849 100644 +--- a/arch/powerpc/platforms/powernv/Makefile ++++ b/arch/powerpc/platforms/powernv/Makefile +@@ -2,6 +2,7 @@ obj-y += setup.o opal-wrappers.o opal.o opal-async.o idle.o + obj-y += opal-rtc.o opal-nvram.o opal-lpc.o opal-flash.o + obj-y += rng.o opal-elog.o opal-dump.o opal-sysparam.o opal-sensor.o + obj-y += opal-msglog.o opal-hmi.o opal-power.o opal-irqchip.o ++obj-y += opal-kmsg.o + + obj-$(CONFIG_SMP) += smp.o subcore.o subcore-asm.o + obj-$(CONFIG_PCI) += pci.o pci-p5ioc2.o pci-ioda.o +diff --git a/arch/powerpc/platforms/powernv/opal-kmsg.c b/arch/powerpc/platforms/powernv/opal-kmsg.c +new file mode 100644 +index 000000000000..6f1214d4de92 +--- /dev/null ++++ b/arch/powerpc/platforms/powernv/opal-kmsg.c +@@ -0,0 +1,75 @@ ++/* ++ * kmsg dumper that ensures the OPAL console fully flushes panic messages ++ * ++ * Author: Russell Currey ++ * ++ * Copyright 2015 IBM Corporation. ++ * ++ * This program is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License as published by the ++ * Free Software Foundation; either version 2 of the License, or (at your ++ * option) any later version. ++ */ ++ ++#include ++ ++#include ++#include ++ ++/* ++ * Console output is controlled by OPAL firmware. The kernel regularly calls ++ * OPAL_POLL_EVENTS, which flushes some console output. In a panic state, ++ * however, the kernel no longer calls OPAL_POLL_EVENTS and the panic message ++ * may not be completely printed. This function does not actually dump the ++ * message, it just ensures that OPAL completely flushes the console buffer. ++ */ ++static void force_opal_console_flush(struct kmsg_dumper *dumper, ++ enum kmsg_dump_reason reason) ++{ ++ int i; ++ int64_t ret; ++ ++ /* ++ * Outside of a panic context the pollers will continue to run, ++ * so we don't need to do any special flushing. ++ */ ++ if (reason != KMSG_DUMP_PANIC) ++ return; ++ ++ if (opal_check_token(OPAL_CONSOLE_FLUSH)) { ++ ret = opal_console_flush(0); ++ ++ if (ret == OPAL_UNSUPPORTED || ret == OPAL_PARAMETER) ++ return; ++ ++ /* Incrementally flush until there's nothing left */ ++ while (opal_console_flush(0) != OPAL_SUCCESS); ++ } else { ++ /* ++ * If OPAL_CONSOLE_FLUSH is not implemented in the firmware, ++ * the console can still be flushed by calling the polling ++ * function enough times to flush the buffer. We don't know ++ * how much output still needs to be flushed, but we can be ++ * generous since the kernel is in panic and doesn't need ++ * to do much else. ++ */ ++ printk(KERN_NOTICE "opal: OPAL_CONSOLE_FLUSH missing.\n"); ++ for (i = 0; i < 1024; i++) { ++ opal_poll_events(NULL); ++ } ++ } ++} ++ ++static struct kmsg_dumper opal_kmsg_dumper = { ++ .dump = force_opal_console_flush ++}; ++ ++void __init opal_kmsg_init(void) ++{ ++ int rc; ++ ++ /* Add our dumper to the list */ ++ rc = kmsg_dump_register(&opal_kmsg_dumper); ++ if (rc != 0) ++ pr_err("opal: kmsg_dump_register failed; returned %d\n", rc); ++} +diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S +index b7a464fef7a7..e45b88a5d7e0 100644 +--- a/arch/powerpc/platforms/powernv/opal-wrappers.S ++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S +@@ -301,3 +301,4 @@ OPAL_CALL(opal_flash_erase, OPAL_FLASH_ERASE); + OPAL_CALL(opal_prd_msg, OPAL_PRD_MSG); + OPAL_CALL(opal_leds_get_ind, OPAL_LEDS_GET_INDICATOR); + OPAL_CALL(opal_leds_set_ind, OPAL_LEDS_SET_INDICATOR); ++OPAL_CALL(opal_console_flush, OPAL_CONSOLE_FLUSH); +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index 57cffb80bc36..ae29eaf85e9e 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -758,6 +758,9 @@ static int __init opal_init(void) + opal_pdev_init(opal_node, "ibm,opal-flash"); + opal_pdev_init(opal_node, "ibm,opal-prd"); + ++ /* Initialise OPAL kmsg dumper for flushing console on panic */ ++ opal_kmsg_init(); ++ + return 0; + } + machine_subsys_initcall(powernv, opal_init); +diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h +index fb1b93ea3e3f..e485817f7b1a 100644 +--- a/arch/s390/include/asm/mmu_context.h ++++ b/arch/s390/include/asm/mmu_context.h +@@ -15,17 +15,25 @@ + static inline int init_new_context(struct task_struct *tsk, + struct mm_struct *mm) + { ++ spin_lock_init(&mm->context.list_lock); ++ INIT_LIST_HEAD(&mm->context.pgtable_list); ++ INIT_LIST_HEAD(&mm->context.gmap_list); + cpumask_clear(&mm->context.cpu_attach_mask); + atomic_set(&mm->context.attach_count, 0); + mm->context.flush_mm = 0; +- mm->context.asce_bits = _ASCE_TABLE_LENGTH | _ASCE_USER_BITS; +- mm->context.asce_bits |= _ASCE_TYPE_REGION3; + #ifdef CONFIG_PGSTE + mm->context.alloc_pgste = page_table_allocate_pgste; + mm->context.has_pgste = 0; + mm->context.use_skey = 0; + #endif +- mm->context.asce_limit = STACK_TOP_MAX; ++ if (mm->context.asce_limit == 0) { ++ /* context created by exec, set asce limit to 4TB */ ++ mm->context.asce_bits = _ASCE_TABLE_LENGTH | ++ _ASCE_USER_BITS | _ASCE_TYPE_REGION3; ++ mm->context.asce_limit = STACK_TOP_MAX; ++ } else if (mm->context.asce_limit == (1UL << 31)) { ++ mm_inc_nr_pmds(mm); ++ } + crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm)); + return 0; + } +@@ -111,8 +119,6 @@ static inline void activate_mm(struct mm_struct *prev, + static inline void arch_dup_mmap(struct mm_struct *oldmm, + struct mm_struct *mm) + { +- if (oldmm->context.asce_limit < mm->context.asce_limit) +- crst_table_downgrade(mm, oldmm->context.asce_limit); + } + + static inline void arch_exit_mmap(struct mm_struct *mm) +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index 7b7858f158b4..d7cc79fb6191 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -100,12 +100,26 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd) + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { +- spin_lock_init(&mm->context.list_lock); +- INIT_LIST_HEAD(&mm->context.pgtable_list); +- INIT_LIST_HEAD(&mm->context.gmap_list); +- return (pgd_t *) crst_table_alloc(mm); ++ unsigned long *table = crst_table_alloc(mm); ++ ++ if (!table) ++ return NULL; ++ if (mm->context.asce_limit == (1UL << 31)) { ++ /* Forking a compat process with 2 page table levels */ ++ if (!pgtable_pmd_page_ctor(virt_to_page(table))) { ++ crst_table_free(mm, table); ++ return NULL; ++ } ++ } ++ return (pgd_t *) table; ++} ++ ++static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) ++{ ++ if (mm->context.asce_limit == (1UL << 31)) ++ pgtable_pmd_page_dtor(virt_to_page(pgd)); ++ crst_table_free(mm, (unsigned long *) pgd); + } +-#define pgd_free(mm, pgd) crst_table_free(mm, (unsigned long *) pgd) + + static inline void pmd_populate(struct mm_struct *mm, + pmd_t *pmd, pgtable_t pte) +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index a08d0afd5ff6..575dc123bda2 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2249,7 +2249,7 @@ int kvm_s390_store_status_unloaded(struct kvm_vcpu *vcpu, unsigned long gpa) + + /* manually convert vector registers if necessary */ + if (MACHINE_HAS_VX) { +- convert_vx_to_fp(fprs, current->thread.fpu.vxrs); ++ convert_vx_to_fp(fprs, (__vector128 *) vcpu->run->s.regs.vrs); + rc = write_guest_abs(vcpu, gpa + __LC_FPREGS_SAVE_AREA, + fprs, 128); + } else { +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index e7c2c1428a69..8eb8a934b531 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3754,13 +3754,15 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, + void + reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) + { ++ bool uses_nx = context->nx || context->base_role.smep_andnot_wp; ++ + /* + * Passing "true" to the last argument is okay; it adds a check + * on bit 8 of the SPTEs which KVM doesn't use anyway. + */ + __reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check, + boot_cpu_data.x86_phys_bits, +- context->shadow_root_level, context->nx, ++ context->shadow_root_level, uses_nx, + guest_cpuid_has_gbpages(vcpu), is_pse(vcpu), + true); + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5fd846cd6e0e..0958fa2b7cb7 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1748,6 +1748,13 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr, + return; + } + break; ++ case MSR_IA32_PEBS_ENABLE: ++ /* PEBS needs a quiescent period after being disabled (to write ++ * a record). Disabling PEBS through VMX MSR swapping doesn't ++ * provide that period, so a CPU could write host's record into ++ * guest's memory. ++ */ ++ wrmsrl(MSR_IA32_PEBS_ENABLE, 0); + } + + for (i = 0; i < m->nr; ++i) +@@ -1785,26 +1792,31 @@ static void reload_tss(void) + + static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) + { +- u64 guest_efer; +- u64 ignore_bits; ++ u64 guest_efer = vmx->vcpu.arch.efer; ++ u64 ignore_bits = 0; + +- guest_efer = vmx->vcpu.arch.efer; ++ if (!enable_ept) { ++ /* ++ * NX is needed to handle CR0.WP=1, CR4.SMEP=1. Testing ++ * host CPUID is more efficient than testing guest CPUID ++ * or CR4. Host SMEP is anyway a requirement for guest SMEP. ++ */ ++ if (boot_cpu_has(X86_FEATURE_SMEP)) ++ guest_efer |= EFER_NX; ++ else if (!(guest_efer & EFER_NX)) ++ ignore_bits |= EFER_NX; ++ } + + /* +- * NX is emulated; LMA and LME handled by hardware; SCE meaningless +- * outside long mode ++ * LMA and LME handled by hardware; SCE meaningless outside long mode. + */ +- ignore_bits = EFER_NX | EFER_SCE; ++ ignore_bits |= EFER_SCE; + #ifdef CONFIG_X86_64 + ignore_bits |= EFER_LMA | EFER_LME; + /* SCE is meaningful only in long mode on Intel */ + if (guest_efer & EFER_LMA) + ignore_bits &= ~(u64)EFER_SCE; + #endif +- guest_efer &= ~ignore_bits; +- guest_efer |= host_efer & ignore_bits; +- vmx->guest_msrs[efer_offset].data = guest_efer; +- vmx->guest_msrs[efer_offset].mask = ~ignore_bits; + + clear_atomic_switch_msr(vmx, MSR_EFER); + +@@ -1815,16 +1827,21 @@ static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) + */ + if (cpu_has_load_ia32_efer || + (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) { +- guest_efer = vmx->vcpu.arch.efer; + if (!(guest_efer & EFER_LMA)) + guest_efer &= ~EFER_LME; + if (guest_efer != host_efer) + add_atomic_switch_msr(vmx, MSR_EFER, + guest_efer, host_efer); + return false; +- } ++ } else { ++ guest_efer &= ~ignore_bits; ++ guest_efer |= host_efer & ignore_bits; + +- return true; ++ vmx->guest_msrs[efer_offset].data = guest_efer; ++ vmx->guest_msrs[efer_offset].mask = ~ignore_bits; ++ ++ return true; ++ } + } + + static unsigned long segment_base(u16 selector) +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c +index db20ee9a413a..b599a780a5a9 100644 +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -414,24 +414,30 @@ pmd_t *lookup_pmd_address(unsigned long address) + phys_addr_t slow_virt_to_phys(void *__virt_addr) + { + unsigned long virt_addr = (unsigned long)__virt_addr; +- unsigned long phys_addr, offset; ++ phys_addr_t phys_addr; ++ unsigned long offset; + enum pg_level level; + pte_t *pte; + + pte = lookup_address(virt_addr, &level); + BUG_ON(!pte); + ++ /* ++ * pXX_pfn() returns unsigned long, which must be cast to phys_addr_t ++ * before being left-shifted PAGE_SHIFT bits -- this trick is to ++ * make 32-PAE kernel work correctly. ++ */ + switch (level) { + case PG_LEVEL_1G: +- phys_addr = pud_pfn(*(pud_t *)pte) << PAGE_SHIFT; ++ phys_addr = (phys_addr_t)pud_pfn(*(pud_t *)pte) << PAGE_SHIFT; + offset = virt_addr & ~PUD_PAGE_MASK; + break; + case PG_LEVEL_2M: +- phys_addr = pmd_pfn(*(pmd_t *)pte) << PAGE_SHIFT; ++ phys_addr = (phys_addr_t)pmd_pfn(*(pmd_t *)pte) << PAGE_SHIFT; + offset = virt_addr & ~PMD_PAGE_MASK; + break; + default: +- phys_addr = pte_pfn(*pte) << PAGE_SHIFT; ++ phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; + offset = virt_addr & ~PAGE_MASK; + } + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index fa00f3a186da..02f9aa4ebe05 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -176,6 +176,7 @@ + #define AT_XDMAC_MAX_CHAN 0x20 + #define AT_XDMAC_MAX_CSIZE 16 /* 16 data */ + #define AT_XDMAC_MAX_DWIDTH 8 /* 64 bits */ ++#define AT_XDMAC_RESIDUE_MAX_RETRIES 5 + + #define AT_XDMAC_DMA_BUSWIDTHS\ + (BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) |\ +@@ -1383,8 +1384,8 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + struct at_xdmac_desc *desc, *_desc; + struct list_head *descs_list; + enum dma_status ret; +- int residue; +- u32 cur_nda, mask, value; ++ int residue, retry; ++ u32 cur_nda, check_nda, cur_ubc, mask, value; + u8 dwidth = 0; + unsigned long flags; + +@@ -1421,7 +1422,42 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + cpu_relax(); + } + ++ /* ++ * When processing the residue, we need to read two registers but we ++ * can't do it in an atomic way. AT_XDMAC_CNDA is used to find where ++ * we stand in the descriptor list and AT_XDMAC_CUBC is used ++ * to know how many data are remaining for the current descriptor. ++ * Since the dma channel is not paused to not loose data, between the ++ * AT_XDMAC_CNDA and AT_XDMAC_CUBC read, we may have change of ++ * descriptor. ++ * For that reason, after reading AT_XDMAC_CUBC, we check if we are ++ * still using the same descriptor by reading a second time ++ * AT_XDMAC_CNDA. If AT_XDMAC_CNDA has changed, it means we have to ++ * read again AT_XDMAC_CUBC. ++ * Memory barriers are used to ensure the read order of the registers. ++ * A max number of retries is set because unlikely it can never ends if ++ * we are transferring a lot of data with small buffers. ++ */ + cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc; ++ rmb(); ++ cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC); ++ for (retry = 0; retry < AT_XDMAC_RESIDUE_MAX_RETRIES; retry++) { ++ rmb(); ++ check_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc; ++ ++ if (likely(cur_nda == check_nda)) ++ break; ++ ++ cur_nda = check_nda; ++ rmb(); ++ cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC); ++ } ++ ++ if (unlikely(retry >= AT_XDMAC_RESIDUE_MAX_RETRIES)) { ++ ret = DMA_ERROR; ++ goto spin_unlock; ++ } ++ + /* + * Remove size of all microblocks already transferred and the current + * one. Then add the remaining size to transfer of the current +@@ -1434,7 +1470,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda) + break; + } +- residue += at_xdmac_chan_read(atchan, AT_XDMAC_CUBC) << dwidth; ++ residue += cur_ubc << dwidth; + + dma_set_residue(txstate, residue); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 0c713a908304..82903ca78529 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -96,7 +96,7 @@ static void amdgpu_flip_work_func(struct work_struct *__work) + * In practice this won't execute very often unless on very fast + * machines because the time window for this to happen is very small. + */ +- while (amdgpuCrtc->enabled && repcnt--) { ++ while (amdgpuCrtc->enabled && --repcnt) { + /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank + * start in hpos, and to the "fudged earlier" vblank start in + * vpos. +@@ -112,13 +112,13 @@ static void amdgpu_flip_work_func(struct work_struct *__work) + break; + + /* Sleep at least until estimated real start of hw vblank */ +- spin_unlock_irqrestore(&crtc->dev->event_lock, flags); + min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5); + if (min_udelay > vblank->framedur_ns / 2000) { + /* Don't wait ridiculously long - something is wrong */ + repcnt = 0; + break; + } ++ spin_unlock_irqrestore(&crtc->dev->event_lock, flags); + usleep_range(min_udelay, 2 * min_udelay); + spin_lock_irqsave(&crtc->dev->event_lock, flags); + }; +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index d690df545b4d..c566993a2ec3 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1744,7 +1744,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon) + } + + drm_kms_helper_poll_enable(dev); +- drm_helper_hpd_irq_event(dev); + + /* set the power state here in case we are a PX system or headless */ + if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 13767d21835f..3645b223aa37 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -455,7 +455,7 @@ static void radeon_flip_work_func(struct work_struct *__work) + * In practice this won't execute very often unless on very fast + * machines because the time window for this to happen is very small. + */ +- while (radeon_crtc->enabled && repcnt--) { ++ while (radeon_crtc->enabled && --repcnt) { + /* GET_DISTANCE_TO_VBLANKSTART returns distance to real vblank + * start in hpos, and to the "fudged earlier" vblank start in + * vpos. +@@ -471,13 +471,13 @@ static void radeon_flip_work_func(struct work_struct *__work) + break; + + /* Sleep at least until estimated real start of hw vblank */ +- spin_unlock_irqrestore(&crtc->dev->event_lock, flags); + min_udelay = (-hpos + 1) * max(vblank->linedur_ns / 1000, 5); + if (min_udelay > vblank->framedur_ns / 2000) { + /* Don't wait ridiculously long - something is wrong */ + repcnt = 0; + break; + } ++ spin_unlock_irqrestore(&crtc->dev->event_lock, flags); + usleep_range(min_udelay, 2 * min_udelay); + spin_lock_irqsave(&crtc->dev->event_lock, flags); + }; +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index 1fa81215cea1..60ab31517153 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -1075,6 +1075,8 @@ force: + + /* update display watermarks based on new power state */ + radeon_bandwidth_update(rdev); ++ /* update displays */ ++ radeon_dpm_display_configuration_changed(rdev); + + /* wait for the rings to drain */ + for (i = 0; i < RADEON_NUM_RINGS; i++) { +@@ -1091,9 +1093,6 @@ force: + + radeon_dpm_post_set_power_state(rdev); + +- /* update displays */ +- radeon_dpm_display_configuration_changed(rdev); +- + rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs; + rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count; + rdev->pm.dpm.single_display = single_display; +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index f2e13eb8339f..a0e28f3a278d 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1050,6 +1050,17 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + for (i = 0; i < ARRAY_SIZE(client_reg); i++) { + const struct ipu_platform_reg *reg = &client_reg[i]; + struct platform_device *pdev; ++ struct device_node *of_node; ++ ++ /* Associate subdevice with the corresponding port node */ ++ of_node = of_graph_get_port_by_id(dev->of_node, i); ++ if (!of_node) { ++ dev_info(dev, ++ "no port@%d node in %s, not using %s%d\n", ++ i, dev->of_node->full_name, ++ (i / 2) ? "DI" : "CSI", i % 2); ++ continue; ++ } + + pdev = platform_device_alloc(reg->name, id++); + if (!pdev) { +@@ -1057,17 +1068,9 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + goto err_register; + } + ++ pdev->dev.of_node = of_node; + pdev->dev.parent = dev; + +- /* Associate subdevice with the corresponding port node */ +- pdev->dev.of_node = of_graph_get_port_by_id(dev->of_node, i); +- if (!pdev->dev.of_node) { +- dev_err(dev, "missing port@%d node in %s\n", i, +- dev->of_node->full_name); +- ret = -ENODEV; +- goto err_register; +- } +- + ret = platform_device_add_data(pdev, ®->pdata, + sizeof(reg->pdata)); + if (!ret) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 5eee62badf45..cbc99d5649af 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -826,9 +826,8 @@ static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface + static void gs_destroy_candev(struct gs_can *dev) + { + unregister_candev(dev->netdev); +- free_candev(dev->netdev); + usb_kill_anchored_urbs(&dev->tx_submitted); +- kfree(dev); ++ free_candev(dev->netdev); + } + + static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) +@@ -913,12 +912,15 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id * + for (i = 0; i < icount; i++) { + dev->canch[i] = gs_make_candev(i, intf); + if (IS_ERR_OR_NULL(dev->canch[i])) { ++ /* save error code to return later */ ++ rc = PTR_ERR(dev->canch[i]); ++ + /* on failure destroy previously created candevs */ + icount = i; +- for (i = 0; i < icount; i++) { ++ for (i = 0; i < icount; i++) + gs_destroy_candev(dev->canch[i]); +- dev->canch[i] = NULL; +- } ++ ++ usb_kill_anchored_urbs(&dev->rx_submitted); + kfree(dev); + return rc; + } +@@ -939,16 +941,12 @@ static void gs_usb_disconnect(struct usb_interface *intf) + return; + } + +- for (i = 0; i < GS_MAX_INTF; i++) { +- struct gs_can *can = dev->canch[i]; +- +- if (!can) +- continue; +- +- gs_destroy_candev(can); +- } ++ for (i = 0; i < GS_MAX_INTF; i++) ++ if (dev->canch[i]) ++ gs_destroy_candev(dev->canch[i]); + + usb_kill_anchored_urbs(&dev->rx_submitted); ++ kfree(dev); + } + + static const struct usb_device_id gs_usb_table[] = { +diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c +index c652a66be803..6743edf43aa8 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c +@@ -421,6 +421,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) + return -1; + } + ++ /* ++ * Increase the pending frames counter, so that later when a reply comes ++ * in and the counter is decreased - we don't start getting negative ++ * values. ++ * Note that we don't need to make sure it isn't agg'd, since we're ++ * TXing non-sta ++ */ ++ atomic_inc(&mvm->pending_frames[sta_id]); ++ + return 0; + } + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 314db8c1047a..42d8617352ae 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4772,8 +4772,10 @@ int pci_get_new_domain_nr(void) + void pci_bus_assign_domain_nr(struct pci_bus *bus, struct device *parent) + { + static int use_dt_domains = -1; +- int domain = of_get_pci_domain_nr(parent->of_node); ++ int domain = -1; + ++ if (parent) ++ domain = of_get_pci_domain_nr(parent->of_node); + /* + * Check DT domain and use_dt_domains values. + * +diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c +index cb61f300f8b5..277b5c8c825c 100644 +--- a/drivers/s390/block/dasd_diag.c ++++ b/drivers/s390/block/dasd_diag.c +@@ -67,7 +67,7 @@ static const u8 DASD_DIAG_CMS1[] = { 0xc3, 0xd4, 0xe2, 0xf1 };/* EBCDIC CMS1 */ + * and function code cmd. + * In case of an exception return 3. Otherwise return result of bitwise OR of + * resulting condition code and DIAG return code. */ +-static inline int dia250(void *iob, int cmd) ++static inline int __dia250(void *iob, int cmd) + { + register unsigned long reg2 asm ("2") = (unsigned long) iob; + typedef union { +@@ -77,7 +77,6 @@ static inline int dia250(void *iob, int cmd) + int rc; + + rc = 3; +- diag_stat_inc(DIAG_STAT_X250); + asm volatile( + " diag 2,%2,0x250\n" + "0: ipm %0\n" +@@ -91,6 +90,12 @@ static inline int dia250(void *iob, int cmd) + return rc; + } + ++static inline int dia250(void *iob, int cmd) ++{ ++ diag_stat_inc(DIAG_STAT_X250); ++ return __dia250(iob, cmd); ++} ++ + /* Initialize block I/O to DIAG device using the specified blocksize and + * block offset. On success, return zero and set end_block to contain the + * number of blocks on the device minus the specified offset. Return non-zero +diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c +index 88029cc6de5e..46b1991fbb50 100644 +--- a/drivers/target/target_core_tmr.c ++++ b/drivers/target/target_core_tmr.c +@@ -177,7 +177,6 @@ void core_tmr_abort_task( + + if (!__target_check_io_state(se_cmd, se_sess, 0)) { + spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); +- target_put_sess_cmd(se_cmd); + goto out; + } + list_del_init(&se_cmd->se_cmd_list); +diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c +index d211b8e18566..30c4c9ebb693 100644 +--- a/fs/jffs2/dir.c ++++ b/fs/jffs2/dir.c +@@ -843,9 +843,14 @@ static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry, + + pr_notice("%s(): Link succeeded, unlink failed (err %d). You now have a hard link\n", + __func__, ret); +- /* Might as well let the VFS know */ +- d_instantiate(new_dentry, d_inode(old_dentry)); +- ihold(d_inode(old_dentry)); ++ /* ++ * We can't keep the target in dcache after that. ++ * For one thing, we can't afford dentry aliases for directories. ++ * For another, if there was a victim, we _can't_ set new inode ++ * for that sucker and we have to trigger mount eviction - the ++ * caller won't do it on its own since we are returning an error. ++ */ ++ d_invalidate(new_dentry); + new_dir_i->i_mtime = new_dir_i->i_ctime = ITIME(now); + return ret; + } +diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c +index f0e3e9e747dd..03446c5a3ec1 100644 +--- a/fs/ncpfs/dir.c ++++ b/fs/ncpfs/dir.c +@@ -633,7 +633,7 @@ ncp_fill_cache(struct file *file, struct dir_context *ctx, + d_rehash(newdent); + } else { + spin_lock(&dentry->d_lock); +- NCP_FINFO(inode)->flags &= ~NCPI_DIR_CACHE; ++ NCP_FINFO(dir)->flags &= ~NCPI_DIR_CACHE; + spin_unlock(&dentry->d_lock); + } + } else { +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 692ceda3bc21..a2b1d7ce3e1a 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -618,7 +618,8 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir) + * sole user of this dentry. Too tricky... Just unhash for + * now. + */ +- d_drop(dentry); ++ if (!err) ++ d_drop(dentry); + mutex_unlock(&dir->i_mutex); + + return err; +@@ -903,6 +904,13 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, + if (!overwrite && new_is_dir && !old_opaque && new_opaque) + ovl_remove_opaque(newdentry); + ++ /* ++ * Old dentry now lives in different location. Dentries in ++ * lowerstack are stale. We cannot drop them here because ++ * access to them is lockless. This could be only pure upper ++ * or opaque directory - numlower is zero. Or upper non-dir ++ * entry - its pureness is tracked by flag opaque. ++ */ + if (old_opaque != new_opaque) { + ovl_dentry_set_opaque(old, new_opaque); + if (!overwrite) +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index b29036aa8d7c..05ac9a95e881 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -65,6 +65,8 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) + + mutex_lock(&upperdentry->d_inode->i_mutex); + err = notify_change(upperdentry, attr, NULL); ++ if (!err) ++ ovl_copyattr(upperdentry->d_inode, dentry->d_inode); + mutex_unlock(&upperdentry->d_inode->i_mutex); + } + ovl_drop_write(dentry); +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index f42c9407fbad..000b2ed05c29 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -76,12 +76,14 @@ enum ovl_path_type ovl_path_type(struct dentry *dentry) + if (oe->__upperdentry) { + type = __OVL_PATH_UPPER; + +- if (oe->numlower) { +- if (S_ISDIR(dentry->d_inode->i_mode)) +- type |= __OVL_PATH_MERGE; +- } else if (!oe->opaque) { ++ /* ++ * Non-dir dentry can hold lower dentry from previous ++ * location. Its purity depends only on opaque flag. ++ */ ++ if (oe->numlower && S_ISDIR(dentry->d_inode->i_mode)) ++ type |= __OVL_PATH_MERGE; ++ else if (!oe->opaque) + type |= __OVL_PATH_PURE; +- } + } else { + if (oe->numlower > 1) + type |= __OVL_PATH_MERGE; +@@ -322,6 +324,7 @@ static const struct dentry_operations ovl_dentry_operations = { + + static const struct dentry_operations ovl_reval_dentry_operations = { + .d_release = ovl_dentry_release, ++ .d_select_inode = ovl_d_select_inode, + .d_revalidate = ovl_dentry_revalidate, + .d_weak_revalidate = ovl_dentry_weak_revalidate, + }; +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index 50311703135b..66cdb44616d5 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -287,6 +287,12 @@ int handle_userfault(struct vm_area_struct *vma, unsigned long address, + goto out; + + /* ++ * We don't do userfault handling for the final child pid update. ++ */ ++ if (current->flags & PF_EXITING) ++ goto out; ++ ++ /* + * Check that we can return VM_FAULT_RETRY. + * + * NOTE: it should become possible to return VM_FAULT_RETRY +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 79cfaeef1b0d..fbe47bc700bd 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -320,11 +320,6 @@ static inline void bio_get_last_bvec(struct bio *bio, struct bio_vec *bv) + struct bvec_iter iter = bio->bi_iter; + int idx; + +- if (!bio_flagged(bio, BIO_CLONED)) { +- *bv = bio->bi_io_vec[bio->bi_vcnt - 1]; +- return; +- } +- + if (unlikely(!bio_multiple_segments(bio))) { + *bv = bio_iovec(bio); + return; +diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h +index 03c7efb60c91..27e32b2b602f 100644 +--- a/include/linux/tracepoint.h ++++ b/include/linux/tracepoint.h +@@ -148,9 +148,6 @@ extern void syscall_unregfunc(void); + void *it_func; \ + void *__data; \ + \ +- if (!cpu_online(raw_smp_processor_id())) \ +- return; \ +- \ + if (!(cond)) \ + return; \ + prercu; \ +@@ -357,15 +354,19 @@ extern void syscall_unregfunc(void); + * "void *__data, proto" as the callback prototype. + */ + #define DECLARE_TRACE_NOARGS(name) \ +- __DECLARE_TRACE(name, void, , 1, void *__data, __data) ++ __DECLARE_TRACE(name, void, , \ ++ cpu_online(raw_smp_processor_id()), \ ++ void *__data, __data) + + #define DECLARE_TRACE(name, proto, args) \ +- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), 1, \ +- PARAMS(void *__data, proto), \ +- PARAMS(__data, args)) ++ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ ++ cpu_online(raw_smp_processor_id()), \ ++ PARAMS(void *__data, proto), \ ++ PARAMS(__data, args)) + + #define DECLARE_TRACE_CONDITION(name, proto, args, cond) \ +- __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), PARAMS(cond), \ ++ __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ ++ cpu_online(raw_smp_processor_id()) && (PARAMS(cond)), \ + PARAMS(void *__data, proto), \ + PARAMS(__data, args)) + +diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h +index 8f81bbbc38fc..e0f4109e64c6 100644 +--- a/include/net/iw_handler.h ++++ b/include/net/iw_handler.h +@@ -439,6 +439,12 @@ int dev_get_wireless_info(char *buffer, char **start, off_t offset, int length); + /* Send a single event to user space */ + void wireless_send_event(struct net_device *dev, unsigned int cmd, + union iwreq_data *wrqu, const char *extra); ++#ifdef CONFIG_WEXT_CORE ++/* flush all previous wext events - if work is done from netdev notifiers */ ++void wireless_nlevent_flush(void); ++#else ++static inline void wireless_nlevent_flush(void) {} ++#endif + + /* We may need a function to send a stream of events to user space. + * More on that later... */ +diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c +index 10ad4ac1fa0b..367784be5df2 100644 +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -291,7 +291,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, + } + + /* prepare A-MPDU MLME for Rx aggregation */ +- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); ++ tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL); + if (!tid_agg_rx) + goto end; + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 5322b4c71630..6837a46ca4a2 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -92,7 +92,7 @@ struct ieee80211_fragment_entry { + u16 extra_len; + u16 last_frag; + u8 rx_queue; +- bool ccmp; /* Whether fragments were encrypted with CCMP */ ++ bool check_sequential_pn; /* needed for CCMP/GCMP */ + u8 last_pn[6]; /* PN of the last fragment if CCMP was used */ + }; + +diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c +index 3ece7d1034c8..b54f398cda5d 100644 +--- a/net/mac80211/rc80211_minstrel.c ++++ b/net/mac80211/rc80211_minstrel.c +@@ -711,7 +711,7 @@ static u32 minstrel_get_expected_throughput(void *priv_sta) + * computing cur_tp + */ + tmp_mrs = &mi->r[idx].stats; +- tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma); ++ tmp_cur_tp = minstrel_get_tp_avg(&mi->r[idx], tmp_mrs->prob_ewma) * 10; + tmp_cur_tp = tmp_cur_tp * 1200 * 8 / 1024; + + return tmp_cur_tp; +diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c +index 3928dbd24e25..239ed6e92b89 100644 +--- a/net/mac80211/rc80211_minstrel_ht.c ++++ b/net/mac80211/rc80211_minstrel_ht.c +@@ -691,7 +691,7 @@ minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb) + if (likely(sta->ampdu_mlme.tid_tx[tid])) + return; + +- ieee80211_start_tx_ba_session(pubsta, tid, 5000); ++ ieee80211_start_tx_ba_session(pubsta, tid, 0); + } + + static void +@@ -871,7 +871,7 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi, + * - if station is in dynamic SMPS (and streams > 1) + * - for fallback rates, to increase chances of getting through + */ +- if (offset > 0 && ++ if (offset > 0 || + (mi->sta->smps_mode == IEEE80211_SMPS_DYNAMIC && + group->streams > 1)) { + ratetbl->rate[offset].count = ratetbl->rate[offset].count_rts; +@@ -1334,7 +1334,8 @@ static u32 minstrel_ht_get_expected_throughput(void *priv_sta) + prob = mi->groups[i].rates[j].prob_ewma; + + /* convert tp_avg from pkt per second in kbps */ +- tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * AVG_PKT_SIZE * 8 / 1024; ++ tp_avg = minstrel_ht_get_tp_avg(mi, i, j, prob) * 10; ++ tp_avg = tp_avg * AVG_PKT_SIZE * 8 / 1024; + + return tp_avg; + } +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 82af407fea7a..4cbf36cae806 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1754,7 +1754,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, + entry->seq = seq; + entry->rx_queue = rx_queue; + entry->last_frag = frag; +- entry->ccmp = 0; ++ entry->check_sequential_pn = false; + entry->extra_len = 0; + + return entry; +@@ -1850,15 +1850,27 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + rx->seqno_idx, &(rx->skb)); + if (rx->key && + (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || +- rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256) && ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && + ieee80211_has_protected(fc)) { + int queue = rx->security_idx; +- /* Store CCMP PN so that we can verify that the next +- * fragment has a sequential PN value. */ +- entry->ccmp = 1; ++ ++ /* Store CCMP/GCMP PN so that we can verify that the ++ * next fragment has a sequential PN value. ++ */ ++ entry->check_sequential_pn = true; + memcpy(entry->last_pn, + rx->key->u.ccmp.rx_pn[queue], + IEEE80211_CCMP_PN_LEN); ++ BUILD_BUG_ON(offsetof(struct ieee80211_key, ++ u.ccmp.rx_pn) != ++ offsetof(struct ieee80211_key, ++ u.gcmp.rx_pn)); ++ BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != ++ sizeof(rx->key->u.gcmp.rx_pn[queue])); ++ BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != ++ IEEE80211_GCMP_PN_LEN); + } + return RX_QUEUED; + } +@@ -1873,15 +1885,21 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) + return RX_DROP_MONITOR; + } + +- /* Verify that MPDUs within one MSDU have sequential PN values. +- * (IEEE 802.11i, 8.3.3.4.5) */ +- if (entry->ccmp) { ++ /* "The receiver shall discard MSDUs and MMPDUs whose constituent ++ * MPDU PN values are not incrementing in steps of 1." ++ * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) ++ * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) ++ */ ++ if (entry->check_sequential_pn) { + int i; + u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; + int queue; ++ + if (!rx->key || + (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && +- rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256)) ++ rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && ++ rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && ++ rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) + return RX_DROP_UNUSABLE; + memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); + for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { +@@ -3367,6 +3385,7 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + return false; + /* ignore action frames to TDLS-peers */ + if (ieee80211_is_action(hdr->frame_control) && ++ !is_broadcast_ether_addr(bssid) && + !ether_addr_equal(bssid, hdr->addr1)) + return false; + } +diff --git a/net/wireless/core.c b/net/wireless/core.c +index b0915515640e..8f0bac7e03c4 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1147,6 +1147,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, + return NOTIFY_DONE; + } + ++ wireless_nlevent_flush(); ++ + return NOTIFY_OK; + } + +diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c +index c8717c1d082e..b50ee5d622e1 100644 +--- a/net/wireless/wext-core.c ++++ b/net/wireless/wext-core.c +@@ -342,6 +342,40 @@ static const int compat_event_type_size[] = { + + /* IW event code */ + ++void wireless_nlevent_flush(void) ++{ ++ struct sk_buff *skb; ++ struct net *net; ++ ++ ASSERT_RTNL(); ++ ++ for_each_net(net) { ++ while ((skb = skb_dequeue(&net->wext_nlevents))) ++ rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, ++ GFP_KERNEL); ++ } ++} ++EXPORT_SYMBOL_GPL(wireless_nlevent_flush); ++ ++static int wext_netdev_notifier_call(struct notifier_block *nb, ++ unsigned long state, void *ptr) ++{ ++ /* ++ * When a netdev changes state in any way, flush all pending messages ++ * to avoid them going out in a strange order, e.g. RTM_NEWLINK after ++ * RTM_DELLINK, or with IFF_UP after without IFF_UP during dev_close() ++ * or similar - all of which could otherwise happen due to delays from ++ * schedule_work(). ++ */ ++ wireless_nlevent_flush(); ++ ++ return NOTIFY_OK; ++} ++ ++static struct notifier_block wext_netdev_notifier = { ++ .notifier_call = wext_netdev_notifier_call, ++}; ++ + static int __net_init wext_pernet_init(struct net *net) + { + skb_queue_head_init(&net->wext_nlevents); +@@ -360,7 +394,12 @@ static struct pernet_operations wext_pernet_ops = { + + static int __init wireless_nlevent_init(void) + { +- return register_pernet_subsys(&wext_pernet_ops); ++ int err = register_pernet_subsys(&wext_pernet_ops); ++ ++ if (err) ++ return err; ++ ++ return register_netdevice_notifier(&wext_netdev_notifier); + } + + subsys_initcall(wireless_nlevent_init); +@@ -368,17 +407,8 @@ subsys_initcall(wireless_nlevent_init); + /* Process events generated by the wireless layer or the driver. */ + static void wireless_nlevent_process(struct work_struct *work) + { +- struct sk_buff *skb; +- struct net *net; +- + rtnl_lock(); +- +- for_each_net(net) { +- while ((skb = skb_dequeue(&net->wext_nlevents))) +- rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, +- GFP_KERNEL); +- } +- ++ wireless_nlevent_flush(); + rtnl_unlock(); + } + +diff --git a/scripts/ld-version.sh b/scripts/ld-version.sh +index 198580d245e0..1659b409ef10 100755 +--- a/scripts/ld-version.sh ++++ b/scripts/ld-version.sh +@@ -1,7 +1,7 @@ + #!/usr/bin/awk -f + # extract linker version number from stdin and turn into single number + { +- gsub(".*)", ""); ++ gsub(".*\\)", ""); + split($1,a, "."); + print a[1]*10000000 + a[2]*100000 + a[3]*10000 + a[4]*100 + a[5]; + exit +diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c +index c799cca5abeb..6b864c0fc2b6 100644 +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -459,7 +459,7 @@ static int wm8958_put_mbc_enum(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol); + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); + struct wm8994 *control = wm8994->wm8994; +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + int reg; + + /* Don't allow on the fly reconfiguration */ +@@ -549,7 +549,7 @@ static int wm8958_put_vss_enum(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol); + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); + struct wm8994 *control = wm8994->wm8994; +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + int reg; + + /* Don't allow on the fly reconfiguration */ +@@ -582,7 +582,7 @@ static int wm8958_put_vss_hpf_enum(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol); + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); + struct wm8994 *control = wm8994->wm8994; +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + int reg; + + /* Don't allow on the fly reconfiguration */ +@@ -749,7 +749,7 @@ static int wm8958_put_enh_eq_enum(struct snd_kcontrol *kcontrol, + struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol); + struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec); + struct wm8994 *control = wm8994->wm8994; +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + int reg; + + /* Don't allow on the fly reconfiguration */ +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index 2ccbb322df77..a18aecb49935 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -362,7 +362,7 @@ static int wm8994_put_drc_enum(struct snd_kcontrol *kcontrol, + struct wm8994 *control = wm8994->wm8994; + struct wm8994_pdata *pdata = &control->pdata; + int drc = wm8994_get_drc(kcontrol->id.name); +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + + if (drc < 0) + return drc; +@@ -469,7 +469,7 @@ static int wm8994_put_retune_mobile_enum(struct snd_kcontrol *kcontrol, + struct wm8994 *control = wm8994->wm8994; + struct wm8994_pdata *pdata = &control->pdata; + int block = wm8994_get_retune_mobile_block(kcontrol->id.name); +- int value = ucontrol->value.integer.value[0]; ++ int value = ucontrol->value.enumerated.item[0]; + + if (block < 0) + return block; +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index ea4ab374a223..7dbf899b2af2 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -480,10 +480,11 @@ static int i2s_set_sysclk(struct snd_soc_dai *dai, + unsigned int cdcon_mask = 1 << i2s_regs->cdclkcon_off; + unsigned int rsrc_mask = 1 << i2s_regs->rclksrc_off; + u32 mod, mask, val = 0; ++ unsigned long flags; + +- spin_lock(i2s->lock); ++ spin_lock_irqsave(i2s->lock, flags); + mod = readl(i2s->addr + I2SMOD); +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + + switch (clk_id) { + case SAMSUNG_I2S_OPCLK: +@@ -574,11 +575,11 @@ static int i2s_set_sysclk(struct snd_soc_dai *dai, + return -EINVAL; + } + +- spin_lock(i2s->lock); ++ spin_lock_irqsave(i2s->lock, flags); + mod = readl(i2s->addr + I2SMOD); + mod = (mod & ~mask) | val; + writel(mod, i2s->addr + I2SMOD); +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + + return 0; + } +@@ -589,6 +590,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai, + struct i2s_dai *i2s = to_info(dai); + int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave; + u32 mod, tmp = 0; ++ unsigned long flags; + + lrp_shift = i2s->variant_regs->lrp_off; + sdf_shift = i2s->variant_regs->sdf_off; +@@ -648,7 +650,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai, + return -EINVAL; + } + +- spin_lock(i2s->lock); ++ spin_lock_irqsave(i2s->lock, flags); + mod = readl(i2s->addr + I2SMOD); + /* + * Don't change the I2S mode if any controller is active on this +@@ -656,7 +658,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai, + */ + if (any_active(i2s) && + ((mod & (sdf_mask | lrp_rlow | mod_slave)) != tmp)) { +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + dev_err(&i2s->pdev->dev, + "%s:%d Other DAI busy\n", __func__, __LINE__); + return -EAGAIN; +@@ -665,7 +667,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai, + mod &= ~(sdf_mask | lrp_rlow | mod_slave); + mod |= tmp; + writel(mod, i2s->addr + I2SMOD); +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + + return 0; + } +@@ -675,6 +677,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, + { + struct i2s_dai *i2s = to_info(dai); + u32 mod, mask = 0, val = 0; ++ unsigned long flags; + + if (!is_secondary(i2s)) + mask |= (MOD_DC2_EN | MOD_DC1_EN); +@@ -743,11 +746,11 @@ static int i2s_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- spin_lock(i2s->lock); ++ spin_lock_irqsave(i2s->lock, flags); + mod = readl(i2s->addr + I2SMOD); + mod = (mod & ~mask) | val; + writel(mod, i2s->addr + I2SMOD); +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + + samsung_asoc_init_dma_data(dai, &i2s->dma_playback, &i2s->dma_capture); + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 7d009428934a..416514fe9e63 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3568,7 +3568,7 @@ static int snd_soc_dapm_dai_link_get(struct snd_kcontrol *kcontrol, + { + struct snd_soc_dapm_widget *w = snd_kcontrol_chip(kcontrol); + +- ucontrol->value.integer.value[0] = w->params_select; ++ ucontrol->value.enumerated.item[0] = w->params_select; + + return 0; + } +@@ -3582,13 +3582,13 @@ static int snd_soc_dapm_dai_link_put(struct snd_kcontrol *kcontrol, + if (w->power) + return -EBUSY; + +- if (ucontrol->value.integer.value[0] == w->params_select) ++ if (ucontrol->value.enumerated.item[0] == w->params_select) + return 0; + +- if (ucontrol->value.integer.value[0] >= w->num_params) ++ if (ucontrol->value.enumerated.item[0] >= w->num_params) + return -EINVAL; + +- w->params_select = ucontrol->value.integer.value[0]; ++ w->params_select = ucontrol->value.enumerated.item[0]; + + return 0; + } +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 484079efea5b..7338e30421d8 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1961,6 +1961,9 @@ static void grow_halt_poll_ns(struct kvm_vcpu *vcpu) + else + val *= halt_poll_ns_grow; + ++ if (val > halt_poll_ns) ++ val = halt_poll_ns; ++ + vcpu->halt_poll_ns = val; + trace_kvm_halt_poll_ns_grow(vcpu->vcpu_id, val, old); + }