diff --git a/config/kernel/linux-mvebu-default.config b/config/kernel/linux-mvebu-default.config index 315176640..464fe6ebc 100644 --- a/config/kernel/linux-mvebu-default.config +++ b/config/kernel/linux-mvebu-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.159 Kernel Configuration +# Linux/arm 4.4.162 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y diff --git a/patch/kernel/mvebu-default/04-patch-4.4.159-160.patch b/patch/kernel/mvebu-default/04-patch-4.4.159-160.patch new file mode 100644 index 000000000..61ba138a1 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.159-160.patch @@ -0,0 +1,3101 @@ +diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx +index cfd31d94c872..f8bf14055c2f 100644 +--- a/Documentation/hwmon/ina2xx ++++ b/Documentation/hwmon/ina2xx +@@ -32,7 +32,7 @@ Supported chips: + Datasheet: Publicly available at the Texas Instruments website + http://www.ti.com/ + +-Author: Lothar Felten ++Author: Lothar Felten + + Description + ----------- +diff --git a/Makefile b/Makefile +index 06d5c6a6a0f6..607394a56036 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 159 ++SUBLEVEL = 160 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 02bd6312d1d9..e6a3a94bac69 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -1549,7 +1549,7 @@ + }; + }; + +- dcan1: can@481cc000 { ++ dcan1: can@4ae3c000 { + compatible = "ti,dra7-d_can"; + ti,hwmods = "dcan1"; + reg = <0x4ae3c000 0x2000>; +@@ -1559,7 +1559,7 @@ + status = "disabled"; + }; + +- dcan2: can@481d0000 { ++ dcan2: can@48480000 { + compatible = "ti,dra7-d_can"; + ti,hwmods = "dcan2"; + reg = <0x48480000 0x2000>; +diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c +index ed8fda4cd055..45fd4b173dac 100644 +--- a/arch/arm/mach-mvebu/pmsu.c ++++ b/arch/arm/mach-mvebu/pmsu.c +@@ -117,8 +117,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr) + PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu)); + } + +-extern unsigned char mvebu_boot_wa_start; +-extern unsigned char mvebu_boot_wa_end; ++extern unsigned char mvebu_boot_wa_start[]; ++extern unsigned char mvebu_boot_wa_end[]; + + /* + * This function sets up the boot address workaround needed for SMP +@@ -131,7 +131,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target, + phys_addr_t resume_addr_reg) + { + void __iomem *sram_virt_base; +- u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start; ++ u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start; + + mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE); + mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute, +diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h +index 1b5e0e843c3a..7e2b3e360086 100644 +--- a/arch/arm64/include/asm/jump_label.h ++++ b/arch/arm64/include/asm/jump_label.h +@@ -28,7 +28,7 @@ + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm goto("1: nop\n\t" ++ asm_volatile_goto("1: nop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + ".align 3\n\t" + ".quad 1b, %l[l_yes], %c0\n\t" +@@ -42,7 +42,7 @@ l_yes: + + static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) + { +- asm goto("1: b %l[l_yes]\n\t" ++ asm_volatile_goto("1: b %l[l_yes]\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + ".align 3\n\t" + ".quad 1b, %l[l_yes], %c0\n\t" +diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h +index 25a40213bd9b..0729a2f94482 100644 +--- a/arch/arm64/include/asm/kvm_emulate.h ++++ b/arch/arm64/include/asm/kvm_emulate.h +@@ -41,6 +41,11 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu); + void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); + void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); + ++static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu) ++{ ++ return !(vcpu->arch.hcr_el2 & HCR_RW); ++} ++ + static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) + { + vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; +diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h +index d48ab5b41f52..50150320f80d 100644 +--- a/arch/arm64/include/asm/sysreg.h ++++ b/arch/arm64/include/asm/sysreg.h +@@ -109,6 +109,7 @@ + #define ID_AA64PFR0_ASIMD_SUPPORTED 0x0 + #define ID_AA64PFR0_EL1_64BIT_ONLY 0x1 + #define ID_AA64PFR0_EL0_64BIT_ONLY 0x1 ++#define ID_AA64PFR0_EL0_32BIT_64BIT 0x2 + + /* id_aa64mmfr0 */ + #define ID_AA64MMFR0_TGRAN4_SHIFT 28 +diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h +index 5e4a59b3ec1b..2691a1857d20 100644 +--- a/arch/hexagon/include/asm/bitops.h ++++ b/arch/hexagon/include/asm/bitops.h +@@ -211,7 +211,7 @@ static inline long ffz(int x) + * This is defined the same way as ffs. + * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + */ +-static inline long fls(int x) ++static inline int fls(int x) + { + int r; + +@@ -232,7 +232,7 @@ static inline long fls(int x) + * the libc and compiler builtin ffs routines, therefore + * differs in spirit from the above ffz (man ffs). + */ +-static inline long ffs(int x) ++static inline int ffs(int x) + { + int r; + +diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c +index 9e3ddf792bd3..2704e0b8de43 100644 +--- a/arch/hexagon/kernel/dma.c ++++ b/arch/hexagon/kernel/dma.c +@@ -68,7 +68,7 @@ static void *hexagon_dma_alloc_coherent(struct device *dev, size_t size, + panic("Can't create %s() memory pool!", __func__); + else + gen_pool_add(coherent_pool, +- pfn_to_virt(max_low_pfn), ++ (unsigned long)pfn_to_virt(max_low_pfn), + hexagon_coherent_pool_size, -1); + } + +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 015ae55c1868..8dff2b371219 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void) + (unsigned long)(crashk_res.start >> 20), + (unsigned long)(memblock_phys_mem_size() >> 20)); + +- memblock_reserve(crashk_res.start, crash_size); ++ if (!memblock_is_region_memory(crashk_res.start, crash_size) || ++ memblock_reserve(crashk_res.start, crash_size)) { ++ pr_err("Failed to reserve memory for crashkernel!\n"); ++ crashk_res.start = crashk_res.end = 0; ++ return; ++ } + } + + int overlaps_crashkernel(unsigned long start, unsigned long size) +diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c +index fb37290a57b4..366965ae37bd 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c +@@ -314,7 +314,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr, + unsigned long pp, key; + unsigned long v, gr; + __be64 *hptep; +- int index; ++ long int index; + int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR); + + /* Get SLB entry */ +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index eac3b7cc78c6..ab7b2594e0f6 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -2270,7 +2270,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, + level_shift = entries_shift + 3; + level_shift = max_t(unsigned, level_shift, PAGE_SHIFT); + +- if ((level_shift - 3) * levels + page_shift >= 60) ++ if ((level_shift - 3) * levels + page_shift >= 55) + return -EINVAL; + + /* Allocate TCE table */ +diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c +index 18fccc303db7..bfd75be6d415 100644 +--- a/arch/s390/mm/extmem.c ++++ b/arch/s390/mm/extmem.c +@@ -79,7 +79,7 @@ struct qin64 { + struct dcss_segment { + struct list_head list; + char dcss_name[8]; +- char res_name[15]; ++ char res_name[16]; + unsigned long start_addr; + unsigned long end; + atomic_t ref_count; +@@ -434,7 +434,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long + memcpy(&seg->res_name, seg->dcss_name, 8); + EBCASC(seg->res_name, 8); + seg->res_name[8] = '\0'; +- strncat(seg->res_name, " (DCSS)", 7); ++ strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); + seg->res->name = seg->res_name; + rc = seg->vm_segtype; + if (rc == SEG_TYPE_SC || +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 92b840c94f17..8be48b1d7596 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -90,7 +90,7 @@ ENDPROC(native_usergs_sysret64) + .endm + + .macro TRACE_IRQS_IRETQ_DEBUG +- bt $9, EFLAGS(%rsp) /* interrupts off? */ ++ btl $9, EFLAGS(%rsp) /* interrupts off? */ + jnc 1f + TRACE_IRQS_ON_DEBUG + 1: +@@ -620,7 +620,7 @@ retint_kernel: + #ifdef CONFIG_PREEMPT + /* Interrupts are off */ + /* Check if we need preemption */ +- bt $9, EFLAGS(%rsp) /* were interrupts off? */ ++ btl $9, EFLAGS(%rsp) /* were interrupts off? */ + jnc 1f + 0: cmpl $0, PER_CPU_VAR(__preempt_count) + jnz 1f +diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c +index 6aa0f4d9eea6..0e37e369b3a0 100644 +--- a/arch/x86/kernel/tsc_msr.c ++++ b/arch/x86/kernel/tsc_msr.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + /* CPU reference clock frequency: in KHz */ + #define FREQ_83 83200 +diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c +index a8f90ce3dedf..dc6d99017f3f 100644 +--- a/arch/x86/mm/numa_emulation.c ++++ b/arch/x86/mm/numa_emulation.c +@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei, + eb->nid = nid; + + if (emu_nid_to_phys[nid] == NUMA_NO_NODE) +- emu_nid_to_phys[nid] = nid; ++ emu_nid_to_phys[nid] = pb->nid; + + pb->start += size; + if (pb->start >= pb->end) { +diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c +index 149e7a7f04fe..b524f702e658 100644 +--- a/crypto/ablkcipher.c ++++ b/crypto/ablkcipher.c +@@ -384,6 +384,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; +@@ -465,6 +466,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; +diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c +index 2d08e59b3212..d524f838eb10 100644 +--- a/crypto/blkcipher.c ++++ b/crypto/blkcipher.c +@@ -515,6 +515,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize; +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 331363e7de0f..2daa5b84abbc 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int + (struct floppy_struct **)&outparam); + if (ret) + return ret; ++ memcpy(&inparam.g, outparam, ++ offsetof(struct floppy_struct, name)); ++ outparam = &inparam.g; + break; + case FDMSGON: + UDP->flags |= FTD_MSG; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 4a899b41145e..b0a12e6dae43 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -340,6 +340,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ ++ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8821AE Bluetooth devices */ +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 59ed54e464a9..fe8cfe24c518 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -63,7 +63,7 @@ struct dcp { + struct dcp_coherent_block *coh; + + struct completion completion[DCP_MAX_CHANS]; +- struct mutex mutex[DCP_MAX_CHANS]; ++ spinlock_t lock[DCP_MAX_CHANS]; + struct task_struct *thread[DCP_MAX_CHANS]; + struct crypto_queue queue[DCP_MAX_CHANS]; + }; +@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data) + + int ret; + +- do { +- __set_current_state(TASK_INTERRUPTIBLE); ++ while (!kthread_should_stop()) { ++ set_current_state(TASK_INTERRUPTIBLE); + +- mutex_lock(&sdcp->mutex[chan]); ++ spin_lock(&sdcp->lock[chan]); + backlog = crypto_get_backlog(&sdcp->queue[chan]); + arq = crypto_dequeue_request(&sdcp->queue[chan]); +- mutex_unlock(&sdcp->mutex[chan]); ++ spin_unlock(&sdcp->lock[chan]); ++ ++ if (!backlog && !arq) { ++ schedule(); ++ continue; ++ } ++ ++ set_current_state(TASK_RUNNING); + + if (backlog) + backlog->complete(backlog, -EINPROGRESS); +@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data) + if (arq) { + ret = mxs_dcp_aes_block_crypt(arq); + arq->complete(arq, ret); +- continue; + } +- +- schedule(); +- } while (!kthread_should_stop()); ++ } + + return 0; + } +@@ -407,9 +411,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb) + rctx->ecb = ecb; + actx->chan = DCP_CHAN_CRYPTO; + +- mutex_lock(&sdcp->mutex[actx->chan]); ++ spin_lock(&sdcp->lock[actx->chan]); + ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); +- mutex_unlock(&sdcp->mutex[actx->chan]); ++ spin_unlock(&sdcp->lock[actx->chan]); + + wake_up_process(sdcp->thread[actx->chan]); + +@@ -645,13 +649,20 @@ static int dcp_chan_thread_sha(void *data) + struct ahash_request *req; + int ret, fini; + +- do { +- __set_current_state(TASK_INTERRUPTIBLE); ++ while (!kthread_should_stop()) { ++ set_current_state(TASK_INTERRUPTIBLE); + +- mutex_lock(&sdcp->mutex[chan]); ++ spin_lock(&sdcp->lock[chan]); + backlog = crypto_get_backlog(&sdcp->queue[chan]); + arq = crypto_dequeue_request(&sdcp->queue[chan]); +- mutex_unlock(&sdcp->mutex[chan]); ++ spin_unlock(&sdcp->lock[chan]); ++ ++ if (!backlog && !arq) { ++ schedule(); ++ continue; ++ } ++ ++ set_current_state(TASK_RUNNING); + + if (backlog) + backlog->complete(backlog, -EINPROGRESS); +@@ -663,12 +674,8 @@ static int dcp_chan_thread_sha(void *data) + ret = dcp_sha_req_to_buf(arq); + fini = rctx->fini; + arq->complete(arq, ret); +- if (!fini) +- continue; + } +- +- schedule(); +- } while (!kthread_should_stop()); ++ } + + return 0; + } +@@ -726,9 +733,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini) + rctx->init = 1; + } + +- mutex_lock(&sdcp->mutex[actx->chan]); ++ spin_lock(&sdcp->lock[actx->chan]); + ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base); +- mutex_unlock(&sdcp->mutex[actx->chan]); ++ spin_unlock(&sdcp->lock[actx->chan]); + + wake_up_process(sdcp->thread[actx->chan]); + mutex_unlock(&actx->mutex); +@@ -984,7 +991,7 @@ static int mxs_dcp_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, sdcp); + + for (i = 0; i < DCP_MAX_CHANS; i++) { +- mutex_init(&sdcp->mutex[i]); ++ spin_lock_init(&sdcp->lock[i]); + init_completion(&sdcp->completion[i]); + crypto_init_queue(&sdcp->queue[i], 50); + } +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 792bdae2b91d..d14c8ffea910 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1187,15 +1187,14 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) + + rc = device_add(pvt->addrmatch_dev); + if (rc < 0) +- return rc; ++ goto err_put_addrmatch; + + if (!pvt->is_registered) { + pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev), + GFP_KERNEL); + if (!pvt->chancounts_dev) { +- put_device(pvt->addrmatch_dev); +- device_del(pvt->addrmatch_dev); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto err_del_addrmatch; + } + + pvt->chancounts_dev->type = &all_channel_counts_type; +@@ -1209,9 +1208,18 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) + + rc = device_add(pvt->chancounts_dev); + if (rc < 0) +- return rc; ++ goto err_put_chancounts; + } + return 0; ++ ++err_put_chancounts: ++ put_device(pvt->chancounts_dev); ++err_del_addrmatch: ++ device_del(pvt->addrmatch_dev); ++err_put_addrmatch: ++ put_device(pvt->addrmatch_dev); ++ ++ return rc; + } + + static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) +@@ -1221,11 +1229,11 @@ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) + edac_dbg(1, "\n"); + + if (!pvt->is_registered) { +- put_device(pvt->chancounts_dev); + device_del(pvt->chancounts_dev); ++ put_device(pvt->chancounts_dev); + } +- put_device(pvt->addrmatch_dev); + device_del(pvt->addrmatch_dev); ++ put_device(pvt->addrmatch_dev); + } + + /**************************************************************************** +diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c +index 984186ee58a0..f5f7b5368da6 100644 +--- a/drivers/gpio/gpio-adp5588.c ++++ b/drivers/gpio/gpio-adp5588.c +@@ -41,6 +41,8 @@ struct adp5588_gpio { + uint8_t int_en[3]; + uint8_t irq_mask[3]; + uint8_t irq_stat[3]; ++ uint8_t int_input_en[3]; ++ uint8_t int_lvl_cached[3]; + }; + + static int adp5588_gpio_read(struct i2c_client *client, u8 reg) +@@ -177,12 +179,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d) + struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d); + int i; + +- for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) ++ for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) { ++ if (dev->int_input_en[i]) { ++ mutex_lock(&dev->lock); ++ dev->dir[i] &= ~dev->int_input_en[i]; ++ dev->int_input_en[i] = 0; ++ adp5588_gpio_write(dev->client, GPIO_DIR1 + i, ++ dev->dir[i]); ++ mutex_unlock(&dev->lock); ++ } ++ ++ if (dev->int_lvl_cached[i] != dev->int_lvl[i]) { ++ dev->int_lvl_cached[i] = dev->int_lvl[i]; ++ adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i, ++ dev->int_lvl[i]); ++ } ++ + if (dev->int_en[i] ^ dev->irq_mask[i]) { + dev->int_en[i] = dev->irq_mask[i]; + adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i, + dev->int_en[i]); + } ++ } + + mutex_unlock(&dev->irq_lock); + } +@@ -225,9 +243,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type) + else + return -EINVAL; + +- adp5588_gpio_direction_input(&dev->gpio_chip, gpio); +- adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank, +- dev->int_lvl[bank]); ++ dev->int_input_en[bank] |= bit; + + return 0; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c +index 2b9c3f11b7a8..ba42ed86148a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm204.c +@@ -161,7 +161,8 @@ gm204_devinit_post(struct nvkm_devinit *base, bool post) + } + + /* load and execute some other ucode image (bios therm?) */ +- return pmu_load(init, 0x01, post, NULL, NULL); ++ pmu_load(init, 0x01, post, NULL, NULL); ++ return 0; + } + + static const struct nvkm_devinit_func +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index 756d1ef9bd99..6124fd6e04d1 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id) + + ret = sysfs_create_group(&hdev->dev.kobj, + &ntrig_attribute_group); ++ if (ret) ++ hid_err(hdev, "cannot create sysfs group\n"); + + return 0; + err_free: +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 3cefd1aeb24f..9c262d955331 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn) + return clamp_val(reg, 0, 1023) & (0xff << 2); + } + +-static u16 adt7475_read_word(struct i2c_client *client, int reg) ++static int adt7475_read_word(struct i2c_client *client, int reg) + { +- u16 val; ++ int val1, val2; + +- val = i2c_smbus_read_byte_data(client, reg); +- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8); ++ val1 = i2c_smbus_read_byte_data(client, reg); ++ if (val1 < 0) ++ return val1; ++ val2 = i2c_smbus_read_byte_data(client, reg + 1); ++ if (val2 < 0) ++ return val2; + +- return val; ++ return val1 | (val2 << 8); + } + + static void adt7475_write_word(struct i2c_client *client, int reg, u16 val) +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index ac63e562071f..9ac6e1673375 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -17,7 +17,7 @@ + * Bi-directional Current/Power Monitor with I2C Interface + * Datasheet: http://www.ti.com/product/ina230 + * +- * Copyright (C) 2012 Lothar Felten ++ * Copyright (C) 2012 Lothar Felten + * Thanks to Jan Volkering + * + * This program is free software; you can redistribute it and/or modify +@@ -328,6 +328,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val) + return 0; + } + ++static ssize_t ina2xx_show_shunt(struct device *dev, ++ struct device_attribute *da, ++ char *buf) ++{ ++ struct ina2xx_data *data = dev_get_drvdata(dev); ++ ++ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt); ++} ++ + static ssize_t ina2xx_store_shunt(struct device *dev, + struct device_attribute *da, + const char *buf, size_t count) +@@ -402,7 +411,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_store_shunt, ++ ina2xx_show_shunt, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 47581c32b1e1..f78069cd8d53 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1272,6 +1272,13 @@ static void i801_add_tco(struct i801_priv *priv) + } + + #ifdef CONFIG_ACPI ++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv, ++ acpi_physical_address address) ++{ ++ return address >= priv->smba && ++ address <= pci_resource_end(priv->pci_dev, SMBBAR); ++} ++ + static acpi_status + i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, + u64 *value, void *handler_context, void *region_context) +@@ -1287,7 +1294,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, + */ + mutex_lock(&priv->acpi_lock); + +- if (!priv->acpi_reserved) { ++ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) { + priv->acpi_reserved = true; + + dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n"); +diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c +index e8d03bcfe3e0..3f6b43fe4d5d 100644 +--- a/drivers/i2c/busses/i2c-uniphier-f.c ++++ b/drivers/i2c/busses/i2c-uniphier-f.c +@@ -394,11 +394,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap, + return ret; + + for (msg = msgs; msg < emsg; msg++) { +- /* If next message is read, skip the stop condition */ +- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); +- /* but, force it if I2C_M_STOP is set */ +- if (msg->flags & I2C_M_STOP) +- stop = true; ++ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ ++ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); + + ret = uniphier_fi2c_master_xfer_one(adap, msg, stop); + if (ret) +diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c +index e3c3861c3325..ad5eb8bacc6d 100644 +--- a/drivers/i2c/busses/i2c-uniphier.c ++++ b/drivers/i2c/busses/i2c-uniphier.c +@@ -247,11 +247,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap, + return ret; + + for (msg = msgs; msg < emsg; msg++) { +- /* If next message is read, skip the stop condition */ +- bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD); +- /* but, force it if I2C_M_STOP is set */ +- if (msg->flags & I2C_M_STOP) +- stop = true; ++ /* Emit STOP if it is the last message or I2C_M_STOP is set. */ ++ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP); + + ret = uniphier_i2c_master_xfer_one(adap, msg, stop); + if (ret) +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 55aa8d3d752f..9712a63957e1 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -123,6 +123,8 @@ static DEFINE_MUTEX(mut); + static DEFINE_IDR(ctx_idr); + static DEFINE_IDR(multicast_idr); + ++static const struct file_operations ucma_fops; ++ + static inline struct ucma_context *_ucma_find_context(int id, + struct ucma_file *file) + { +@@ -1535,6 +1537,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, + f = fdget(cmd.fd); + if (!f.file) + return -ENOENT; ++ if (f.file->f_op != &ucma_fops) { ++ ret = -EINVAL; ++ goto file_put; ++ } + + /* Validate current fd and prevent destruction of id. */ + ctx = ucma_get_ctx(f.file->private_data, cmd.id); +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 4fd2892613dd..1897c4080346 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2594,7 +2594,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + { + struct srp_target_port *target = host_to_target(scmnd->device->host); + struct srp_rdma_ch *ch; +- int i; ++ int i, j; + u8 status; + + shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); +@@ -2608,8 +2608,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + + for (i = 0; i < target->ch_count; i++) { + ch = &target->ch[i]; +- for (i = 0; i < target->req_ring_size; ++i) { +- struct srp_request *req = &ch->req_ring[i]; ++ for (j = 0; j < target->req_ring_size; ++j) { ++ struct srp_request *req = &ch->req_ring[j]; + + srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 174bb52c578b..84aead19622c 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1180,6 +1180,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = { + static const char * const middle_button_pnp_ids[] = { + "LEN2131", /* ThinkPad P52 w/ NFC */ + "LEN2132", /* ThinkPad P52 */ ++ "LEN2133", /* ThinkPad P72 w/ NFC */ ++ "LEN2134", /* ThinkPad P72 */ + NULL + }; + +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index e339f4288e8f..2711aa965445 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -189,6 +189,12 @@ struct dm_pool_metadata { + unsigned long flags; + sector_t data_block_size; + ++ /* ++ * We reserve a section of the metadata for commit overhead. ++ * All reported space does *not* include this. ++ */ ++ dm_block_t metadata_reserve; ++ + /* + * Set if a transaction has to be aborted but the attempt to roll back + * to the previous (good) transaction failed. The only pool metadata +@@ -827,6 +833,20 @@ static int __commit_transaction(struct dm_pool_metadata *pmd) + return dm_tm_commit(pmd->tm, sblock); + } + ++static void __set_metadata_reserve(struct dm_pool_metadata *pmd) ++{ ++ int r; ++ dm_block_t total; ++ dm_block_t max_blocks = 4096; /* 16M */ ++ ++ r = dm_sm_get_nr_blocks(pmd->metadata_sm, &total); ++ if (r) { ++ DMERR("could not get size of metadata device"); ++ pmd->metadata_reserve = max_blocks; ++ } else ++ pmd->metadata_reserve = min(max_blocks, div_u64(total, 10)); ++} ++ + struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + sector_t data_block_size, + bool format_device) +@@ -860,6 +880,8 @@ struct dm_pool_metadata *dm_pool_metadata_open(struct block_device *bdev, + return ERR_PTR(r); + } + ++ __set_metadata_reserve(pmd); ++ + return pmd; + } + +@@ -1763,6 +1785,13 @@ int dm_pool_get_free_metadata_block_count(struct dm_pool_metadata *pmd, + down_read(&pmd->root_lock); + if (!pmd->fail_io) + r = dm_sm_get_nr_free(pmd->metadata_sm, result); ++ ++ if (!r) { ++ if (*result < pmd->metadata_reserve) ++ *result = 0; ++ else ++ *result -= pmd->metadata_reserve; ++ } + up_read(&pmd->root_lock); + + return r; +@@ -1875,8 +1904,11 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_cou + int r = -EINVAL; + + down_write(&pmd->root_lock); +- if (!pmd->fail_io) ++ if (!pmd->fail_io) { + r = __resize_space_map(pmd->metadata_sm, new_count); ++ if (!r) ++ __set_metadata_reserve(pmd); ++ } + up_write(&pmd->root_lock); + + return r; +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 315767e8ae4d..bc4e6825ff62 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -200,7 +200,13 @@ struct dm_thin_new_mapping; + enum pool_mode { + PM_WRITE, /* metadata may be changed */ + PM_OUT_OF_DATA_SPACE, /* metadata may be changed, though data may not be allocated */ ++ ++ /* ++ * Like READ_ONLY, except may switch back to WRITE on metadata resize. Reported as READ_ONLY. ++ */ ++ PM_OUT_OF_METADATA_SPACE, + PM_READ_ONLY, /* metadata may not be changed */ ++ + PM_FAIL, /* all I/O fails */ + }; + +@@ -1301,7 +1307,35 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); + + static void requeue_bios(struct pool *pool); + +-static void check_for_space(struct pool *pool) ++static bool is_read_only_pool_mode(enum pool_mode mode) ++{ ++ return (mode == PM_OUT_OF_METADATA_SPACE || mode == PM_READ_ONLY); ++} ++ ++static bool is_read_only(struct pool *pool) ++{ ++ return is_read_only_pool_mode(get_pool_mode(pool)); ++} ++ ++static void check_for_metadata_space(struct pool *pool) ++{ ++ int r; ++ const char *ooms_reason = NULL; ++ dm_block_t nr_free; ++ ++ r = dm_pool_get_free_metadata_block_count(pool->pmd, &nr_free); ++ if (r) ++ ooms_reason = "Could not get free metadata blocks"; ++ else if (!nr_free) ++ ooms_reason = "No free metadata blocks"; ++ ++ if (ooms_reason && !is_read_only(pool)) { ++ DMERR("%s", ooms_reason); ++ set_pool_mode(pool, PM_OUT_OF_METADATA_SPACE); ++ } ++} ++ ++static void check_for_data_space(struct pool *pool) + { + int r; + dm_block_t nr_free; +@@ -1327,14 +1361,16 @@ static int commit(struct pool *pool) + { + int r; + +- if (get_pool_mode(pool) >= PM_READ_ONLY) ++ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) + return -EINVAL; + + r = dm_pool_commit_metadata(pool->pmd); + if (r) + metadata_operation_failed(pool, "dm_pool_commit_metadata", r); +- else +- check_for_space(pool); ++ else { ++ check_for_metadata_space(pool); ++ check_for_data_space(pool); ++ } + + return r; + } +@@ -1400,6 +1436,19 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result) + return r; + } + ++ r = dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks); ++ if (r) { ++ metadata_operation_failed(pool, "dm_pool_get_free_metadata_block_count", r); ++ return r; ++ } ++ ++ if (!free_blocks) { ++ /* Let's commit before we use up the metadata reserve. */ ++ r = commit(pool); ++ if (r) ++ return r; ++ } ++ + return 0; + } + +@@ -1431,6 +1480,7 @@ static int should_error_unserviceable_bio(struct pool *pool) + case PM_OUT_OF_DATA_SPACE: + return pool->pf.error_if_no_space ? -ENOSPC : 0; + ++ case PM_OUT_OF_METADATA_SPACE: + case PM_READ_ONLY: + case PM_FAIL: + return -EIO; +@@ -2401,8 +2451,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) + error_retry_list(pool); + break; + ++ case PM_OUT_OF_METADATA_SPACE: + case PM_READ_ONLY: +- if (old_mode != new_mode) ++ if (!is_read_only_pool_mode(old_mode)) + notify_of_pool_mode_change(pool, "read-only"); + dm_pool_metadata_read_only(pool->pmd); + pool->process_bio = process_bio_read_only; +@@ -3333,6 +3384,10 @@ static int maybe_resize_metadata_dev(struct dm_target *ti, bool *need_commit) + DMINFO("%s: growing the metadata device from %llu to %llu blocks", + dm_device_name(pool->pool_md), + sb_metadata_dev_size, metadata_dev_size); ++ ++ if (get_pool_mode(pool) == PM_OUT_OF_METADATA_SPACE) ++ set_pool_mode(pool, PM_WRITE); ++ + r = dm_pool_resize_metadata_dev(pool->pmd, metadata_dev_size); + if (r) { + metadata_operation_failed(pool, "dm_pool_resize_metadata_dev", r); +@@ -3636,7 +3691,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv) + struct pool_c *pt = ti->private; + struct pool *pool = pt->pool; + +- if (get_pool_mode(pool) >= PM_READ_ONLY) { ++ if (get_pool_mode(pool) >= PM_OUT_OF_METADATA_SPACE) { + DMERR("%s: unable to service pool target messages in READ_ONLY or FAIL mode", + dm_device_name(pool->pool_md)); + return -EOPNOTSUPP; +@@ -3710,6 +3765,7 @@ static void pool_status(struct dm_target *ti, status_type_t type, + dm_block_t nr_blocks_data; + dm_block_t nr_blocks_metadata; + dm_block_t held_root; ++ enum pool_mode mode; + char buf[BDEVNAME_SIZE]; + char buf2[BDEVNAME_SIZE]; + struct pool_c *pt = ti->private; +@@ -3780,9 +3836,10 @@ static void pool_status(struct dm_target *ti, status_type_t type, + else + DMEMIT("- "); + +- if (pool->pf.mode == PM_OUT_OF_DATA_SPACE) ++ mode = get_pool_mode(pool); ++ if (mode == PM_OUT_OF_DATA_SPACE) + DMEMIT("out_of_data_space "); +- else if (pool->pf.mode == PM_READ_ONLY) ++ else if (is_read_only_pool_mode(mode)) + DMEMIT("ro "); + else + DMEMIT("rw "); +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index a7a561af05c9..617a0aefc1c4 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -239,15 +239,6 @@ static void recover_bitmaps(struct md_thread *thread) + while (cinfo->recovery_map) { + slot = fls64((u64)cinfo->recovery_map) - 1; + +- /* Clear suspend_area associated with the bitmap */ +- spin_lock_irq(&cinfo->suspend_lock); +- list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) +- if (slot == s->slot) { +- list_del(&s->list); +- kfree(s); +- } +- spin_unlock_irq(&cinfo->suspend_lock); +- + snprintf(str, 64, "bitmap%04d", slot); + bm_lockres = lockres_init(mddev, str, NULL, 1); + if (!bm_lockres) { +@@ -266,6 +257,16 @@ static void recover_bitmaps(struct md_thread *thread) + pr_err("md-cluster: Could not copy data from bitmap %d\n", slot); + goto dlm_unlock; + } ++ ++ /* Clear suspend_area associated with the bitmap */ ++ spin_lock_irq(&cinfo->suspend_lock); ++ list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) ++ if (slot == s->slot) { ++ list_del(&s->list); ++ kfree(s); ++ } ++ spin_unlock_irq(&cinfo->suspend_lock); ++ + if (hi > 0) { + /* TODO:Wait for current resync to get over */ + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 8a731bdd268e..89111d455b71 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -4336,11 +4336,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr, + allow_barrier(conf); + } + ++ raise_barrier(conf, 0); + read_more: + /* Now schedule reads for blocks from sector_nr to last */ + r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO); + r10_bio->state = 0; +- raise_barrier(conf, sectors_done != 0); ++ raise_barrier(conf, 1); + atomic_set(&r10_bio->remaining, 0); + r10_bio->mddev = mddev; + r10_bio->sector = sector_nr; +@@ -4445,6 +4446,8 @@ bio_full: + if (sector_nr <= last) + goto read_more; + ++ lower_barrier(conf); ++ + /* Now that we have done the whole section we can + * update reshape_progress + */ +diff --git a/drivers/media/i2c/soc_camera/ov772x.c b/drivers/media/i2c/soc_camera/ov772x.c +index f150a8bd94dc..70f1a80d4e39 100644 +--- a/drivers/media/i2c/soc_camera/ov772x.c ++++ b/drivers/media/i2c/soc_camera/ov772x.c +@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov772x_priv *priv, + * set COM8 + */ + if (priv->band_filter) { +- ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1); ++ ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF); + if (!ret) + ret = ov772x_mask_set(client, BDBASE, + 0xff, 256 - priv->band_filter); +diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c +index 6e6648446f00..667d3720154a 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -391,12 +391,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp, + struct v4l2_pix_format_mplane *pixm, + const struct fimc_fmt **fmt) + { +- *fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); ++ const struct fimc_fmt *__fmt; ++ ++ __fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); ++ ++ if (fmt) ++ *fmt = __fmt; + + pixm->colorspace = V4L2_COLORSPACE_SRGB; + pixm->field = V4L2_FIELD_NONE; +- pixm->num_planes = (*fmt)->memplanes; +- pixm->pixelformat = (*fmt)->fourcc; ++ pixm->num_planes = __fmt->memplanes; ++ pixm->pixelformat = __fmt->fourcc; + /* + * TODO: double check with the docmentation these width/height + * constraints are correct. +diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c +index ae8c6b35a357..7f0ed5a26da9 100644 +--- a/drivers/media/platform/fsl-viu.c ++++ b/drivers/media/platform/fsl-viu.c +@@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op) + sizeof(struct viu_reg), DRV_NAME)) { + dev_err(&op->dev, "Error while requesting mem region\n"); + ret = -EBUSY; +- goto err; ++ goto err_irq; + } + + /* remap registers */ +@@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op) + if (!viu_regs) { + dev_err(&op->dev, "Can't map register set\n"); + ret = -ENOMEM; +- goto err; ++ goto err_irq; + } + + /* Prepare our private structure */ +@@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op) + if (!viu_dev) { + dev_err(&op->dev, "Can't allocate private structure\n"); + ret = -ENOMEM; +- goto err; ++ goto err_irq; + } + + viu_dev->vr = viu_regs; +@@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op) + ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev); + if (ret < 0) { + dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret); +- goto err; ++ goto err_irq; + } + + ad = i2c_get_adapter(0); ++ if (!ad) { ++ ret = -EFAULT; ++ dev_err(&op->dev, "couldn't get i2c adapter\n"); ++ goto err_v4l2; ++ } + + v4l2_ctrl_handler_init(&viu_dev->hdl, 5); + if (viu_dev->hdl.error) { + ret = viu_dev->hdl.error; + dev_err(&op->dev, "couldn't register control\n"); +- goto err_vdev; ++ goto err_i2c; + } + /* This control handler will inherit the control(s) from the + sub-device(s). */ +@@ -1476,7 +1481,7 @@ static int viu_of_probe(struct platform_device *op) + vdev = video_device_alloc(); + if (vdev == NULL) { + ret = -ENOMEM; +- goto err_vdev; ++ goto err_hdl; + } + + *vdev = viu_template; +@@ -1497,7 +1502,7 @@ static int viu_of_probe(struct platform_device *op) + ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1); + if (ret < 0) { + video_device_release(viu_dev->vdev); +- goto err_vdev; ++ goto err_unlock; + } + + /* enable VIU clock */ +@@ -1505,12 +1510,12 @@ static int viu_of_probe(struct platform_device *op) + if (IS_ERR(clk)) { + dev_err(&op->dev, "failed to lookup the clock!\n"); + ret = PTR_ERR(clk); +- goto err_clk; ++ goto err_vdev; + } + ret = clk_prepare_enable(clk); + if (ret) { + dev_err(&op->dev, "failed to enable the clock!\n"); +- goto err_clk; ++ goto err_vdev; + } + viu_dev->clk = clk; + +@@ -1521,7 +1526,7 @@ static int viu_of_probe(struct platform_device *op) + if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) { + dev_err(&op->dev, "Request VIU IRQ failed.\n"); + ret = -ENODEV; +- goto err_irq; ++ goto err_clk; + } + + mutex_unlock(&viu_dev->lock); +@@ -1529,16 +1534,19 @@ static int viu_of_probe(struct platform_device *op) + dev_info(&op->dev, "Freescale VIU Video Capture Board\n"); + return ret; + +-err_irq: +- clk_disable_unprepare(viu_dev->clk); + err_clk: +- video_unregister_device(viu_dev->vdev); ++ clk_disable_unprepare(viu_dev->clk); + err_vdev: +- v4l2_ctrl_handler_free(&viu_dev->hdl); ++ video_unregister_device(viu_dev->vdev); ++err_unlock: + mutex_unlock(&viu_dev->lock); ++err_hdl: ++ v4l2_ctrl_handler_free(&viu_dev->hdl); ++err_i2c: + i2c_put_adapter(ad); ++err_v4l2: + v4l2_device_unregister(&viu_dev->v4l2_dev); +-err: ++err_irq: + irq_dispose_mapping(viu_irq); + return ret; + } +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 91e02c1ff392..136ea1848701 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -303,7 +303,7 @@ static struct clk *isp_xclk_src_get(struct of_phandle_args *clkspec, void *data) + static int isp_xclk_init(struct isp_device *isp) + { + struct device_node *np = isp->dev->of_node; +- struct clk_init_data init; ++ struct clk_init_data init = { 0 }; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i) +diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c +index fa6af4a7dae1..f97f4bc22ced 100644 +--- a/drivers/media/platform/s3c-camif/camif-capture.c ++++ b/drivers/media/platform/s3c-camif/camif-capture.c +@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif_dev *camif, int on) + + if (camif->sensor.power_count == !on) + err = v4l2_subdev_call(sensor->sd, core, s_power, on); ++ if (err == -ENOIOCTLCMD) ++ err = 0; + if (!err) + sensor->power_count += on ? 1 : -1; + +diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c +index 095f5db1a790..4f317e2686e9 100644 +--- a/drivers/media/usb/tm6000/tm6000-dvb.c ++++ b/drivers/media/usb/tm6000/tm6000-dvb.c +@@ -275,6 +275,11 @@ static int register_dvb(struct tm6000_core *dev) + + ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T", + THIS_MODULE, &dev->udev->dev, adapter_nr); ++ if (ret < 0) { ++ pr_err("tm6000: couldn't register the adapter!\n"); ++ goto err; ++ } ++ + dvb->adapter.priv = dev; + + if (dvb->frontend) { +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index 2b276ab7764f..a4048a04d236 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, + } + } + ++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream) ++{ ++ /* ++ * Return the size of the video probe and commit controls, which depends ++ * on the protocol version. ++ */ ++ if (stream->dev->uvc_version < 0x0110) ++ return 26; ++ else if (stream->dev->uvc_version < 0x0150) ++ return 34; ++ else ++ return 48; ++} ++ + static int uvc_get_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe, __u8 query) + { ++ __u16 size = uvc_video_ctrl_size(stream); + __u8 *data; +- __u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) && + query == UVC_GET_DEF) + return -EIO; +@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream, + ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]); + ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]); + +- if (size == 34) { ++ if (size >= 34) { + ctrl->dwClockFrequency = get_unaligned_le32(&data[26]); + ctrl->bmFramingInfo = data[30]; + ctrl->bPreferedVersion = data[31]; +@@ -254,11 +267,10 @@ out: + static int uvc_set_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe) + { ++ __u16 size = uvc_video_ctrl_size(stream); + __u8 *data; +- __u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + data = kzalloc(size, GFP_KERNEL); + if (data == NULL) + return -ENOMEM; +@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream, + put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]); + put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]); + +- if (size == 34) { ++ if (size >= 34) { + put_unaligned_le32(ctrl->dwClockFrequency, &data[26]); + data[30] = ctrl->bmFramingInfo; + data[31] = ctrl->bPreferedVersion; +diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c +index 8d3171c6bee8..b47ac4e053d0 100644 +--- a/drivers/media/v4l2-core/v4l2-event.c ++++ b/drivers/media/v4l2-core/v4l2-event.c +@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e + if (sev == NULL) + return; + +- /* +- * If the event has been added to the fh->subscribed list, but its +- * add op has not completed yet elems will be 0, treat this as +- * not being subscribed. +- */ +- if (!sev->elems) +- return; +- + /* Increase event sequence number on fh. */ + fh->sequence++; + +@@ -212,6 +204,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, + struct v4l2_subscribed_event *sev, *found_ev; + unsigned long flags; + unsigned i; ++ int ret = 0; + + if (sub->type == V4L2_EVENT_ALL) + return -EINVAL; +@@ -229,31 +222,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, + sev->flags = sub->flags; + sev->fh = fh; + sev->ops = ops; ++ sev->elems = elems; ++ ++ mutex_lock(&fh->subscribe_lock); + + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); +- if (!found_ev) +- list_add(&sev->list, &fh->subscribed); + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + + if (found_ev) { ++ /* Already listening */ + kfree(sev); +- return 0; /* Already listening */ ++ goto out_unlock; + } + + if (sev->ops && sev->ops->add) { +- int ret = sev->ops->add(sev, elems); ++ ret = sev->ops->add(sev, elems); + if (ret) { +- sev->ops = NULL; +- v4l2_event_unsubscribe(fh, sub); +- return ret; ++ kfree(sev); ++ goto out_unlock; + } + } + +- /* Mark as ready for use */ +- sev->elems = elems; ++ spin_lock_irqsave(&fh->vdev->fh_lock, flags); ++ list_add(&sev->list, &fh->subscribed); ++ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + +- return 0; ++out_unlock: ++ mutex_unlock(&fh->subscribe_lock); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(v4l2_event_subscribe); + +@@ -292,6 +290,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + return 0; + } + ++ mutex_lock(&fh->subscribe_lock); ++ + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + + sev = v4l2_event_subscribed(fh, sub->type, sub->id); +@@ -310,6 +310,7 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + sev->ops->del(sev); + + kfree(sev); ++ mutex_unlock(&fh->subscribe_lock); + + return 0; + } +diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c +index c97067a25bd2..1d076deb05a9 100644 +--- a/drivers/media/v4l2-core/v4l2-fh.c ++++ b/drivers/media/v4l2-core/v4l2-fh.c +@@ -49,6 +49,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev) + INIT_LIST_HEAD(&fh->available); + INIT_LIST_HEAD(&fh->subscribed); + fh->sequence = -1; ++ mutex_init(&fh->subscribe_lock); + } + EXPORT_SYMBOL_GPL(v4l2_fh_init); + +@@ -93,6 +94,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh) + if (fh->vdev == NULL) + return; + v4l2_event_unsubscribe_all(fh); ++ mutex_destroy(&fh->subscribe_lock); + fh->vdev = NULL; + } + EXPORT_SYMBOL_GPL(v4l2_fh_exit); +diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c +index 87a13374fdc0..eb5761067310 100644 +--- a/drivers/misc/tsl2550.c ++++ b/drivers/misc/tsl2550.c +@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1) + } else + lux = 0; + else +- return -EAGAIN; ++ return 0; + + /* LUX range check */ + return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux; +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index cc277f7849b0..3877f534fd3f 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva, + retval = get_user_pages_fast((uintptr_t) produce_uva, + produce_q->kernel_if->num_pages, 1, + produce_q->kernel_if->u.h.header_page); +- if (retval < produce_q->kernel_if->num_pages) { ++ if (retval < (int)produce_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(produce) failed (retval=%d)", + retval); + qp_release_pages(produce_q->kernel_if->u.h.header_page, +@@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva, + retval = get_user_pages_fast((uintptr_t) consume_uva, + consume_q->kernel_if->num_pages, 1, + consume_q->kernel_if->u.h.header_page); +- if (retval < consume_q->kernel_if->num_pages) { ++ if (retval < (int)consume_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(consume) failed (retval=%d)", + retval); + qp_release_pages(consume_q->kernel_if->u.h.header_page, +diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c +index 8d54e7b41bbf..8c698d464716 100644 +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -523,7 +523,7 @@ static int macb_halt_tx(struct macb *bp) + if (!(status & MACB_BIT(TGO))) + return 0; + +- usleep_range(10, 250); ++ udelay(250); + } while (time_before(halt_time, timeout)); + + return -ETIMEDOUT; +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h +index cec95ac8687d..fe37fc7ec76e 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -171,10 +171,10 @@ struct hnae_desc_cb { + + /* priv data for the desc, e.g. skb when use with ip stack*/ + void *priv; +- u16 page_offset; +- u16 reuse_flag; ++ u32 page_offset; ++ u32 length; /* length of the buffer */ + +- u16 length; /* length of the buffer */ ++ u16 reuse_flag; + + /* desc type, used by the ring user to mark the type of the priv data */ + u16 type; +diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +index 83e557c7f279..5ae8874bbf72 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +@@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev, + adapter->tx_ring = tx_old; + e1000_free_all_rx_resources(adapter); + e1000_free_all_tx_resources(adapter); +- kfree(tx_old); +- kfree(rx_old); + adapter->rx_ring = rxdr; + adapter->tx_ring = txdr; + err = e1000_up(adapter); + if (err) + goto err_setup; + } ++ kfree(tx_old); ++ kfree(rx_old); + + clear_bit(__E1000_RESETTING, &adapter->flags); + return 0; +@@ -665,7 +665,8 @@ err_setup_rx: + err_alloc_rx: + kfree(txdr); + err_alloc_tx: +- e1000_up(adapter); ++ if (netif_running(adapter->netdev)) ++ e1000_up(adapter); + err_setup: + clear_bit(__E1000_RESETTING, &adapter->flags); + return err; +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 8b4069ea52ce..c6782ebd35e1 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -759,7 +759,7 @@ struct rtl8169_tc_offsets { + }; + + enum rtl_flag { +- RTL_FLAG_TASK_ENABLED, ++ RTL_FLAG_TASK_ENABLED = 0, + RTL_FLAG_TASK_SLOW_PENDING, + RTL_FLAG_TASK_RESET_PENDING, + RTL_FLAG_TASK_PHY_PENDING, +@@ -7618,7 +7618,8 @@ static int rtl8169_close(struct net_device *dev) + rtl8169_update_counters(dev); + + rtl_lock_work(tp); +- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); ++ /* Clear all task flags */ ++ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); + + rtl8169_down(dev); + rtl_unlock_work(tp); +@@ -7795,7 +7796,9 @@ static void rtl8169_net_suspend(struct net_device *dev) + + rtl_lock_work(tp); + napi_disable(&tp->napi); +- clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags); ++ /* Clear all task flags */ ++ bitmap_zero(tp->wk.flags, RTL_FLAG_MAX); ++ + rtl_unlock_work(tp); + + rtl_pll_power_down(tp); +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index b32c47fe926d..a65b5d7f59f4 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -212,11 +212,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar) + spin_lock_bh(&htt->rx_ring.lock); + ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level - + htt->rx_ring.fill_cnt)); +- spin_unlock_bh(&htt->rx_ring.lock); + + if (ret) + ath10k_htt_rx_ring_free(htt); + ++ spin_unlock_bh(&htt->rx_ring.lock); ++ + return ret; + } + +@@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt) + skb_queue_purge(&htt->rx_compl_q); + skb_queue_purge(&htt->rx_in_ord_compl_q); + ++ spin_lock_bh(&htt->rx_ring.lock); + ath10k_htt_rx_ring_free(htt); ++ spin_unlock_bh(&htt->rx_ring.lock); + + dma_free_coherent(htt->ar->dev, + (htt->rx_ring.size * +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index e8b770a95f7a..c98cb962b454 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2453,9 +2453,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, + IEEE80211_VHT_CAP_SHORT_GI_80 | + IEEE80211_VHT_CAP_SHORT_GI_160 | + IEEE80211_VHT_CAP_TXSTBC | +- IEEE80211_VHT_CAP_RXSTBC_1 | +- IEEE80211_VHT_CAP_RXSTBC_2 | +- IEEE80211_VHT_CAP_RXSTBC_3 | + IEEE80211_VHT_CAP_RXSTBC_4 | + IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK; + sband->vht_cap.vht_mcs.rx_mcs_map = +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index 259590013382..c76e0cfbb8b4 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -2919,6 +2919,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev, + + while (buflen >= sizeof(*auth_req)) { + auth_req = (void *)buf; ++ if (buflen < le32_to_cpu(auth_req->length)) ++ return; + type = "unknown"; + flags = le32_to_cpu(auth_req->flags); + pairwise_error = false; +diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c +index f01d24baff7c..15dc7a398b90 100644 +--- a/drivers/net/wireless/ti/wlcore/cmd.c ++++ b/drivers/net/wireless/ti/wlcore/cmd.c +@@ -35,6 +35,7 @@ + #include "wl12xx_80211.h" + #include "cmd.h" + #include "event.h" ++#include "ps.h" + #include "tx.h" + #include "hw_ops.h" + +@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + + timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT); + ++ ret = wl1271_ps_elp_wakeup(wl); ++ if (ret < 0) ++ return ret; ++ + do { + if (time_after(jiffies, timeout_time)) { + wl1271_debug(DEBUG_CMD, "timeout waiting for event %d", +@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + } while (!event); + + out: ++ wl1271_ps_elp_sleep(wl); + kfree(events_vector); + return ret; + } +diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c +index 6a9bf7089373..ccb619632e46 100644 +--- a/drivers/power/reset/vexpress-poweroff.c ++++ b/drivers/power/reset/vexpress-poweroff.c +@@ -35,6 +35,7 @@ static void vexpress_reset_do(struct device *dev, const char *what) + } + + static struct device *vexpress_power_off_device; ++static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0); + + static void vexpress_power_off(void) + { +@@ -99,10 +100,13 @@ static int _vexpress_register_restart_handler(struct device *dev) + int err; + + vexpress_restart_device = dev; +- err = register_restart_handler(&vexpress_restart_nb); +- if (err) { +- dev_err(dev, "cannot register restart handler (err=%d)\n", err); +- return err; ++ if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) { ++ err = register_restart_handler(&vexpress_restart_nb); ++ if (err) { ++ dev_err(dev, "cannot register restart handler (err=%d)\n", err); ++ atomic_dec(&vexpress_restart_nb_refcnt); ++ return err; ++ } + } + device_create_file(dev, &dev_attr_active); + +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index acdb5ccb0ab9..34d3b7aff513 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -523,7 +523,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card, + default: + dev_kfree_skb_any(skb); + QETH_CARD_TEXT(card, 3, "inbunkno"); +- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); ++ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); + continue; + } + work_done++; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index bbdb3b6c54bb..2cc9bc1ef1e3 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -1902,7 +1902,7 @@ static int qeth_l3_process_inbound_buffer(struct qeth_card *card, + default: + dev_kfree_skb_any(skb); + QETH_CARD_TEXT(card, 3, "inbunkno"); +- QETH_DBF_HEX(CTRL, 3, hdr, QETH_DBF_CTRL_LEN); ++ QETH_DBF_HEX(CTRL, 3, hdr, sizeof(*hdr)); + continue; + } + work_done++; +diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c +index fb072cc5e9fd..dada9ce4e702 100644 +--- a/drivers/scsi/bnx2i/bnx2i_hwi.c ++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c +@@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep) + BNX2X_DOORBELL_PCI_BAR); + reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF); + ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4); ++ if (!ep->qp.ctx_base) ++ return -ENOMEM; + goto arm_cq; + } + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index adfef9db6f1e..e26747a1b35a 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT; + static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2; + static int fast_fail = 1; + static int client_reserve = 1; +-static char partition_name[97] = "UNKNOWN"; ++static char partition_name[96] = "UNKNOWN"; + static unsigned int partition_number = -1; + + static struct scsi_transport_template *ibmvscsi_transport_template; +@@ -261,7 +261,7 @@ static void gather_partition_info(void) + + ppartition_name = of_get_property(rootdn, "ibm,partition-name", NULL); + if (ppartition_name) +- strncpy(partition_name, ppartition_name, ++ strlcpy(partition_name, ppartition_name, + sizeof(partition_name)); + p_number_ptr = of_get_property(rootdn, "ibm,partition-no", NULL); + if (p_number_ptr) +diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c +index 818843336932..9882d93e7566 100644 +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -587,11 +587,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx, + + ret = wait_event_interruptible_timeout(rspi->wait, + rspi->dma_callbacked, HZ); +- if (ret > 0 && rspi->dma_callbacked) ++ if (ret > 0 && rspi->dma_callbacked) { + ret = 0; +- else if (!ret) { +- dev_err(&rspi->master->dev, "DMA timeout\n"); +- ret = -ETIMEDOUT; ++ } else { ++ if (!ret) { ++ dev_err(&rspi->master->dev, "DMA timeout\n"); ++ ret = -ETIMEDOUT; ++ } + if (tx) + dmaengine_terminate_all(rspi->master->dma_tx); + if (rx) +@@ -1303,12 +1305,36 @@ static const struct platform_device_id spi_driver_ids[] = { + + MODULE_DEVICE_TABLE(platform, spi_driver_ids); + ++#ifdef CONFIG_PM_SLEEP ++static int rspi_suspend(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct rspi_data *rspi = platform_get_drvdata(pdev); ++ ++ return spi_master_suspend(rspi->master); ++} ++ ++static int rspi_resume(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct rspi_data *rspi = platform_get_drvdata(pdev); ++ ++ return spi_master_resume(rspi->master); ++} ++ ++static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume); ++#define DEV_PM_OPS &rspi_pm_ops ++#else ++#define DEV_PM_OPS NULL ++#endif /* CONFIG_PM_SLEEP */ ++ + static struct platform_driver rspi_driver = { + .probe = rspi_probe, + .remove = rspi_remove, + .id_table = spi_driver_ids, + .driver = { + .name = "renesas_spi", ++ .pm = DEV_PM_OPS, + .of_match_table = of_match_ptr(rspi_of_match), + }, + }; +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 3de39bd794b6..03b566848da6 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -374,7 +374,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p, + + static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p) + { +- sh_msiof_write(p, STR, sh_msiof_read(p, STR)); ++ sh_msiof_write(p, STR, ++ sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ)); + } + + static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p, +@@ -1275,12 +1276,37 @@ static const struct platform_device_id spi_driver_ids[] = { + }; + MODULE_DEVICE_TABLE(platform, spi_driver_ids); + ++#ifdef CONFIG_PM_SLEEP ++static int sh_msiof_spi_suspend(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); ++ ++ return spi_master_suspend(p->master); ++} ++ ++static int sh_msiof_spi_resume(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); ++ ++ return spi_master_resume(p->master); ++} ++ ++static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend, ++ sh_msiof_spi_resume); ++#define DEV_PM_OPS &sh_msiof_spi_pm_ops ++#else ++#define DEV_PM_OPS NULL ++#endif /* CONFIG_PM_SLEEP */ ++ + static struct platform_driver sh_msiof_spi_drv = { + .probe = sh_msiof_spi_probe, + .remove = sh_msiof_spi_remove, + .id_table = spi_driver_ids, + .driver = { + .name = "spi_sh_msiof", ++ .pm = DEV_PM_OPS, + .of_match_table = of_match_ptr(sh_msiof_match), + }, + }; +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 85c91f58b42f..af2880d0c112 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev) + goto exit_free_master; + } + ++ /* disabled clock may cause interrupt storm upon request */ ++ tspi->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(tspi->clk)) { ++ ret = PTR_ERR(tspi->clk); ++ dev_err(&pdev->dev, "Can not get clock %d\n", ret); ++ goto exit_free_master; ++ } ++ ret = clk_prepare(tspi->clk); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Clock prepare failed %d\n", ret); ++ goto exit_free_master; ++ } ++ ret = clk_enable(tspi->clk); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Clock enable failed %d\n", ret); ++ goto exit_free_master; ++ } ++ + spi_irq = platform_get_irq(pdev, 0); + tspi->irq = spi_irq; + ret = request_threaded_irq(tspi->irq, tegra_slink_isr, +@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n", + tspi->irq); +- goto exit_free_master; +- } +- +- tspi->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(tspi->clk)) { +- dev_err(&pdev->dev, "can not get clock\n"); +- ret = PTR_ERR(tspi->clk); +- goto exit_free_irq; ++ goto exit_clk_disable; + } + + tspi->rst = devm_reset_control_get(&pdev->dev, "spi"); +@@ -1138,6 +1149,8 @@ exit_rx_dma_free: + tegra_slink_deinit_dma_param(tspi, true); + exit_free_irq: + free_irq(spi_irq, tspi); ++exit_clk_disable: ++ clk_disable(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev) + + free_irq(tspi->irq, tspi); + ++ clk_disable(tspi->clk); ++ + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); + +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index 013b33760639..e9c74c41aece 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -370,6 +370,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) + goto out; + } + ++ /* requested mapping size larger than object size */ ++ if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + /* requested protection bits must match our allowed protection mask */ + if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) & + calc_vm_prot_bits(PROT_MASK))) { +diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c +index d6c498209b2c..9a876ce92dbd 100644 +--- a/drivers/staging/rts5208/sd.c ++++ b/drivers/staging/rts5208/sd.c +@@ -5031,7 +5031,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct rtsx_chip *chip) + goto SD_Execute_Write_Cmd_Failed; + } + +- rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); ++ retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); + if (retval != STATUS_SUCCESS) { + rtsx_trace(chip); + goto SD_Execute_Write_Cmd_Failed; +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index b380bc7ee10a..3184e023a052 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -26,15 +26,6 @@ + #include "iscsi_target_nego.h" + #include "iscsi_target_auth.h" + +-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) +-{ +- int i; +- +- for (i = 0; i < src_len; i++) { +- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); +- } +-} +- + static void chap_gen_challenge( + struct iscsi_conn *conn, + int caller, +@@ -47,7 +38,7 @@ static void chap_gen_challenge( + memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1); + + get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH); +- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, ++ bin2hex(challenge_asciihex, chap->challenge, + CHAP_CHALLENGE_LENGTH); + /* + * Set CHAP_C, and copy the generated challenge into c_str. +@@ -287,7 +278,7 @@ static int chap_server_compute_md5( + } + crypto_free_hash(tfm); + +- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); + pr_debug("[server] MD5 Server Digest: %s\n", response); + + if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { +@@ -431,7 +422,7 @@ static int chap_server_compute_md5( + /* + * Convert response from binary hex to ascii hext. + */ +- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, digest, MD5_SIGNATURE_SIZE); + *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", + response); + *nr_out_len += 1; +diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c +index 63e1dcc5914d..761b065a40bb 100644 +--- a/drivers/target/iscsi/iscsi_target_tpg.c ++++ b/drivers/target/iscsi/iscsi_target_tpg.c +@@ -637,8 +637,7 @@ int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication) + none = strstr(buf1, NONE); + if (none) + goto out; +- strncat(buf1, ",", strlen(",")); +- strncat(buf1, NONE, strlen(NONE)); ++ strlcat(buf1, "," NONE, sizeof(buf1)); + if (iscsi_update_param_value(param, buf1) < 0) + return -EINVAL; + } +diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c +index be4eedcb839a..236c4eb5cf78 100644 +--- a/drivers/thermal/of-thermal.c ++++ b/drivers/thermal/of-thermal.c +@@ -284,10 +284,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz, + + mutex_lock(&tz->lock); + +- if (mode == THERMAL_DEVICE_ENABLED) ++ if (mode == THERMAL_DEVICE_ENABLED) { + tz->polling_delay = data->polling_delay; +- else ++ tz->passive_delay = data->passive_delay; ++ } else { + tz->polling_delay = 0; ++ tz->passive_delay = 0; ++ } + + mutex_unlock(&tz->lock); + +diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c +index 4d180c9423ef..1a14948c86d6 100644 +--- a/drivers/tty/serial/8250/serial_cs.c ++++ b/drivers/tty/serial/8250/serial_cs.c +@@ -629,8 +629,10 @@ static int serial_config(struct pcmcia_device * link) + (link->has_func_id) && + (link->socket->pcmcia_pfc == 0) && + ((link->func_id == CISTPL_FUNCID_MULTI) || +- (link->func_id == CISTPL_FUNCID_SERIAL))) +- pcmcia_loop_config(link, serial_check_for_multi, info); ++ (link->func_id == CISTPL_FUNCID_SERIAL))) { ++ if (pcmcia_loop_config(link, serial_check_for_multi, info)) ++ goto failed; ++ } + + /* + * Apply any multi-port quirk. +diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +index d3e3d42c0c12..0040c29f651a 100644 +--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c ++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +@@ -1068,8 +1068,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo) + /* Get the address of the host memory buffer. + */ + bdp = pinfo->rx_cur; +- while (bdp->cbd_sc & BD_SC_EMPTY) +- ; ++ if (bdp->cbd_sc & BD_SC_EMPTY) ++ return NO_POLL_CHAR; + + /* If the buffer address is in the CPM DPRAM, don't + * convert it. +@@ -1104,7 +1104,11 @@ static int cpm_get_poll_char(struct uart_port *port) + poll_chars = 0; + } + if (poll_chars <= 0) { +- poll_chars = poll_wait_key(poll_buf, pinfo); ++ int ret = poll_wait_key(poll_buf, pinfo); ++ ++ if (ret == NO_POLL_CHAR) ++ return ret; ++ poll_chars = ret; + pollp = poll_buf; + } + poll_chars--; +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 07ede982b472..f5f46c121ee3 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1997,6 +1997,14 @@ static int serial_imx_probe(struct platform_device *pdev) + dev_name(&pdev->dev), sport); + if (ret) + return ret; ++ ++ ret = devm_request_irq(&pdev->dev, rtsirq, imx_rtsint, 0, ++ dev_name(&pdev->dev), sport); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to request rts irq: %d\n", ++ ret); ++ return ret; ++ } + } else { + ret = devm_request_irq(&pdev->dev, rxirq, imx_int, 0, + dev_name(&pdev->dev), sport); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 4380e4f600ab..61ea87917433 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_ATOMIC); ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index ad2e6d235c30..5e0af15aebc4 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1289,10 +1289,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + struct async *as = NULL; + struct usb_ctrlrequest *dr = NULL; + unsigned int u, totlen, isofrmlen; +- int i, ret, is_in, num_sgs = 0, ifnum = -1; ++ int i, ret, num_sgs = 0, ifnum = -1; + int number_of_packets = 0; + unsigned int stream_id = 0; + void *buf; ++ bool is_in; ++ bool allow_short = false; ++ bool allow_zero = false; + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | + USBDEVFS_URB_BULK_CONTINUATION | + USBDEVFS_URB_NO_FSBR | +@@ -1326,6 +1329,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + u = 0; + switch (uurb->type) { + case USBDEVFS_URB_TYPE_CONTROL: ++ if (is_in) ++ allow_short = true; + if (!usb_endpoint_xfer_control(&ep->desc)) + return -EINVAL; + /* min 8 byte setup packet */ +@@ -1366,6 +1371,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + break; + + case USBDEVFS_URB_TYPE_BULK: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + switch (usb_endpoint_type(&ep->desc)) { + case USB_ENDPOINT_XFER_CONTROL: + case USB_ENDPOINT_XFER_ISOC: +@@ -1386,6 +1395,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + if (!usb_endpoint_xfer_int(&ep->desc)) + return -EINVAL; + interrupt_urb: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + break; + + case USBDEVFS_URB_TYPE_ISO: +@@ -1512,16 +1525,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + u = (is_in ? URB_DIR_IN : URB_DIR_OUT); + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) + u |= URB_ISO_ASAP; +- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in) ++ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) + u |= URB_SHORT_NOT_OK; + if (uurb->flags & USBDEVFS_URB_NO_FSBR) + u |= URB_NO_FSBR; +- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) + u |= URB_ZERO_PACKET; + if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT) + u |= URB_NO_INTERRUPT; + as->urb->transfer_flags = u; + ++ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n"); ++ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n"); ++ + as->urb->transfer_buffer_length = uurb->buffer_length; + as->urb->setup_packet = (unsigned char *)dr; + dr = NULL; +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 0bb380a9fcf7..e9d6cf146fcc 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, + struct device *dev; + struct usb_device *udev; + int retval = 0; +- int lpm_disable_error = -ENODEV; + + if (!iface) + return -ENODEV; +@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, + + iface->condition = USB_INTERFACE_BOUND; + +- /* See the comment about disabling LPM in usb_probe_interface(). */ +- if (driver->disable_hub_initiated_lpm) { +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error) { +- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- return -ENOMEM; +- } +- } +- + /* Claimed interfaces are initially inactive (suspended) and + * runtime-PM-enabled, but only if the driver has autosuspend + * support. Otherwise they are marked active, to prevent the +@@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver, + if (device_is_registered(dev)) + retval = device_bind_driver(dev); + +- /* Attempt to re-enable USB3 LPM, if the disable was successful. */ +- if (!lpm_disable_error) +- usb_unlocked_enable_lpm(udev); ++ if (retval) { ++ dev->driver = NULL; ++ usb_set_intfdata(iface, NULL); ++ iface->needs_remote_wakeup = 0; ++ iface->condition = USB_INTERFACE_UNBOUND; ++ ++ /* ++ * Unbound interfaces are always runtime-PM-disabled ++ * and runtime-PM-suspended ++ */ ++ if (driver->supports_autosuspend) ++ pm_runtime_disable(dev); ++ pm_runtime_set_suspended(dev); ++ } + + return retval; + } +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index f8bbd0b6d9fe..ad308c8e9af5 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -95,6 +95,8 @@ struct usb_host_interface *usb_find_alt_setting( + struct usb_interface_cache *intf_cache = NULL; + int i; + ++ if (!config) ++ return NULL; + for (i = 0; i < config->desc.bNumInterfaces; i++) { + if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber + == iface_num) { +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 6ba122cc7490..95df2b3bb6a1 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gadget_ops = { + static int fotg210_udc_remove(struct platform_device *pdev) + { + struct fotg210_udc *fotg210 = platform_get_drvdata(pdev); ++ int i; + + usb_del_gadget_udc(&fotg210->gadget); + iounmap(fotg210->reg); + free_irq(platform_get_irq(pdev, 0), fotg210); + + fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); ++ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) ++ kfree(fotg210->ep[i]); + kfree(fotg210); + + return 0; +@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + /* initialize udc */ + fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); + if (fotg210 == NULL) +- goto err_alloc; ++ goto err; + + for (i = 0; i < FOTG210_MAX_NUM_EP; i++) { + _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); +@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + fotg210->reg = ioremap(res->start, resource_size(res)); + if (fotg210->reg == NULL) { + pr_err("ioremap error.\n"); +- goto err_map; ++ goto err_alloc; + } + + spin_lock_init(&fotg210->lock); +@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) + fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep, + GFP_KERNEL); + if (fotg210->ep0_req == NULL) +- goto err_req; ++ goto err_map; + + fotg210_init(fotg210); + +@@ -1190,12 +1193,14 @@ err_req: + fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); + + err_map: +- if (fotg210->reg) +- iounmap(fotg210->reg); ++ iounmap(fotg210->reg); + + err_alloc: ++ for (i = 0; i < FOTG210_MAX_NUM_EP; i++) ++ kfree(fotg210->ep[i]); + kfree(fotg210); + ++err: + return ret; + } + +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index e8e8702d5adf..5594a4a4a83f 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -431,6 +431,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, + spin_unlock_irqrestore(&dev->lock, flags); + mutex_unlock(&dev->io_mutex); + ++ if (WARN_ON_ONCE(len >= sizeof(in_buffer))) ++ return -EIO; ++ + return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); + } + +diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c +index 813035f51fe7..7d252678c55a 100644 +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty) + transfer_buffer_length, + KOBIL_TIMEOUT); + +- dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n", +- __func__, result, transfer_buffer[0]); ++ dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n", ++ result); ++ if (result < 1) { ++ if (result >= 0) ++ result = -EIO; ++ goto out_free; ++ } ++ ++ dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]); + + result = 0; + if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0) + result = TIOCM_DSR; ++out_free: + kfree(transfer_buffer); + return result; + } +diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c +index b66faaf3e842..4019c11f24e2 100644 +--- a/drivers/usb/wusbcore/security.c ++++ b/drivers/usb/wusbcore/security.c +@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc, + + result = usb_get_descriptor(usb_dev, USB_DT_SECURITY, + 0, secd, sizeof(*secd)); +- if (result < sizeof(*secd)) { ++ if (result < (int)sizeof(*secd)) { + dev_err(dev, "Can't read security descriptor or " + "not enough data: %d\n", result); + goto out; +diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c +index 1212b4b3c5a9..e9ff710a3d12 100644 +--- a/drivers/uwb/hwa-rc.c ++++ b/drivers/uwb/hwa-rc.c +@@ -875,6 +875,7 @@ error_get_version: + error_rc_add: + usb_put_intf(iface); + usb_put_dev(hwarc->usb_dev); ++ kfree(hwarc); + error_alloc: + uwb_rc_put(uwb_rc); + error_rc_alloc: +diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c +index 5676aefdf2bc..f4e59c445964 100644 +--- a/drivers/xen/cpu_hotplug.c ++++ b/drivers/xen/cpu_hotplug.c +@@ -18,15 +18,16 @@ static void enable_hotplug_cpu(int cpu) + + static void disable_hotplug_cpu(int cpu) + { +- if (cpu_online(cpu)) { +- lock_device_hotplug(); ++ if (!cpu_is_hotpluggable(cpu)) ++ return; ++ lock_device_hotplug(); ++ if (cpu_online(cpu)) + device_offline(get_cpu_device(cpu)); +- unlock_device_hotplug(); +- } +- if (cpu_present(cpu)) ++ if (!cpu_online(cpu) && cpu_present(cpu)) { + xen_arch_unregister_cpu(cpu); +- +- set_cpu_present(cpu, false); ++ set_cpu_present(cpu, false); ++ } ++ unlock_device_hotplug(); + } + + static int vcpu_online(unsigned int cpu) +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 21d679f88dfa..878a40950a3a 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -139,7 +139,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) + clear_evtchn_to_irq_row(row); + } + +- evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)] = irq; ++ evtchn_to_irq[row][col] = irq; + return 0; + } + +diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c +index 2dd285827169..f494126aaecd 100644 +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -280,9 +280,11 @@ static void sysrq_handler(struct xenbus_watch *watch, const char **vec, + /* + * The Xenstore watch fires directly after registering it and + * after a suspend/resume cycle. So ENOENT is no error but +- * might happen in those cases. ++ * might happen in those cases. ERANGE is observed when we get ++ * an empty value (''), this happens when we acknowledge the ++ * request by writing '\0' below. + */ +- if (err != -ENOENT) ++ if (err != -ENOENT && err != -ERANGE) + pr_err("Error %d reading sysrq code in control/sysrq\n", + err); + xenbus_transaction_end(xbt, 1); +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index a0b3e7d1be48..211ac472cb9d 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -101,9 +101,6 @@ convert_sfm_char(const __u16 src_char, char *target) + case SFM_LESSTHAN: + *target = '<'; + break; +- case SFM_SLASH: +- *target = '\\'; +- break; + case SFM_SPACE: + *target = ' '; + break; +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 63aea21e6298..b9b8f19dce0e 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -577,10 +577,15 @@ CIFSSMBNegotiate(const unsigned int xid, struct cifs_ses *ses) + } + + count = 0; ++ /* ++ * We know that all the name entries in the protocols array ++ * are short (< 16 bytes anyway) and are NUL terminated. ++ */ + for (i = 0; i < CIFS_NUM_PROT; i++) { +- strncpy(pSMB->DialectsArray+count, protocols[i].name, 16); +- count += strlen(protocols[i].name) + 1; +- /* null at end of source and target buffers anyway */ ++ size_t len = strlen(protocols[i].name) + 1; ++ ++ memcpy(pSMB->DialectsArray+count, protocols[i].name, len); ++ count += len; + } + inc_rfc1001_len(pSMB, count); + pSMB->ByteCount = cpu_to_le16(count); +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 0cc699d9b932..61a09ab2752e 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -406,9 +406,17 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv) + (struct smb_com_transaction_change_notify_rsp *)buf; + struct file_notify_information *pnotify; + __u32 data_offset = 0; ++ size_t len = srv->total_read - sizeof(pSMBr->hdr.smb_buf_length); ++ + if (get_bcc(buf) > sizeof(struct file_notify_information)) { + data_offset = le32_to_cpu(pSMBr->DataOffset); + ++ if (data_offset > ++ len - sizeof(struct file_notify_information)) { ++ cifs_dbg(FYI, "invalid data_offset %u\n", ++ data_offset); ++ return true; ++ } + pnotify = (struct file_notify_information *) + ((char *)&pSMBr->hdr.Protocol + data_offset); + cifs_dbg(FYI, "dnotify on %s Action: 0x%x\n", +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index e6b1795fbf2a..2725085a3f9f 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -914,7 +914,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, + } + + srch_inf->entries_in_buffer = 0; +- srch_inf->index_of_last_entry = 0; ++ srch_inf->index_of_last_entry = 2; + + rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, + fid->volatile_fid, 0, srch_inf); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 9fb2a751fce4..b51bb73b06a6 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1386,6 +1386,11 @@ retry: + /* Find the entry best suited to be pushed into EA block */ + entry = NULL; + for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { ++ /* never move system.data out of the inode */ ++ if ((last->e_name_len == 4) && ++ (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && ++ !memcmp(last->e_name, "data", 4)) ++ continue; + total_size = + EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + + EXT4_XATTR_LEN(last->e_name_len); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index bfbee8ddf978..c67064d94096 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1632,6 +1632,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + if (status) { + op = &args->ops[0]; + op->status = status; ++ resp->opcnt = 1; + goto encode_op; + } + +diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c +index 4e2162b355db..0cefb036a17e 100644 +--- a/fs/ocfs2/dlm/dlmmaster.c ++++ b/fs/ocfs2/dlm/dlmmaster.c +@@ -589,9 +589,9 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm, + + res->last_used = 0; + +- spin_lock(&dlm->spinlock); ++ spin_lock(&dlm->track_lock); + list_add_tail(&res->tracking, &dlm->tracking_list); +- spin_unlock(&dlm->spinlock); ++ spin_unlock(&dlm->track_lock); + + memset(res->lvb, 0, DLM_LVB_LEN); + memset(res->refmap, 0, sizeof(res->refmap)); +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 5f9cec2db6c3..4beed301e224 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -471,6 +471,20 @@ static int proc_pid_stack(struct seq_file *m, struct pid_namespace *ns, + int err; + int i; + ++ /* ++ * The ability to racily run the kernel stack unwinder on a running task ++ * and then observe the unwinder output is scary; while it is useful for ++ * debugging kernel issues, it can also allow an attacker to leak kernel ++ * stack contents. ++ * Doing this in a manner that is at least safe from races would require ++ * some work to ensure that the remote task can not be scheduled; and ++ * even then, this would still expose the unwinder as local attack ++ * surface. ++ * Therefore, this interface is restricted to root. ++ */ ++ if (!file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) ++ return -EACCES; ++ + entries = kmalloc(MAX_STACK_TRACE_DEPTH * sizeof(*entries), GFP_KERNEL); + if (!entries) + return -ENOMEM; +diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h +index 9abc0ca7259b..9f0aa1b48c78 100644 +--- a/include/linux/platform_data/ina2xx.h ++++ b/include/linux/platform_data/ina2xx.h +@@ -1,7 +1,7 @@ + /* + * Driver for Texas Instruments INA219, INA226 power monitor chips + * +- * Copyright (C) 2012 Lothar Felten ++ * Copyright (C) 2012 Lothar Felten + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h +index 33885118523c..9b681f21c2a9 100644 +--- a/include/linux/slub_def.h ++++ b/include/linux/slub_def.h +@@ -67,7 +67,8 @@ struct kmem_cache { + int size; /* The size of an object including meta data */ + int object_size; /* The size of an object without meta data */ + int offset; /* Free pointer offset. */ +- int cpu_partial; /* Number of per cpu partial objects to keep around */ ++ /* Number of per cpu partial objects to keep around */ ++ unsigned int cpu_partial; + struct kmem_cache_order_objects oo; + + /* Allocation and freeing of slabs */ +diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h +index 803516775162..4fdcd0d807d7 100644 +--- a/include/media/v4l2-fh.h ++++ b/include/media/v4l2-fh.h +@@ -43,6 +43,7 @@ struct v4l2_fh { + wait_queue_head_t wait; + struct list_head subscribed; /* Subscribed events */ + struct list_head available; /* Dequeueable event */ ++ struct mutex subscribe_lock; + unsigned int navailable; + u32 sequence; + +diff --git a/kernel/module.c b/kernel/module.c +index aa81f41f2b19..bcc78f4c15e9 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3860,7 +3860,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name) + + for (i = 0; i < kallsyms->num_symtab; i++) + if (strcmp(name, symname(kallsyms, i)) == 0 && +- kallsyms->symtab[i].st_info != 'U') ++ kallsyms->symtab[i].st_shndx != SHN_UNDEF) + return kallsyms->symtab[i].st_value; + return 0; + } +@@ -3906,6 +3906,10 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, + if (mod->state == MODULE_STATE_UNFORMED) + continue; + for (i = 0; i < kallsyms->num_symtab; i++) { ++ ++ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF) ++ continue; ++ + ret = fn(data, symname(kallsyms, i), + mod, kallsyms->symtab[i].st_value); + if (ret != 0) +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index 6fcc367ad531..e78480b81f8d 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -773,7 +773,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, + /* Convert (if necessary) to absolute time */ + if (flags != TIMER_ABSTIME) { + ktime_t now = alarm_bases[type].gettime(); +- exp = ktime_add(now, exp); ++ ++ exp = ktime_add_safe(now, exp); + } + + if (alarmtimer_do_nsleep(&alarm, exp)) +diff --git a/lib/klist.c b/lib/klist.c +index 0507fa5d84c5..f6b547812fe3 100644 +--- a/lib/klist.c ++++ b/lib/klist.c +@@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct klist_iter *i) + void (*put)(struct klist_node *) = i->i_klist->put; + struct klist_node *last = i->i_cur; + struct klist_node *prev; ++ unsigned long flags; + +- spin_lock(&i->i_klist->k_lock); ++ spin_lock_irqsave(&i->i_klist->k_lock, flags); + + if (last) { + prev = to_klist_node(last->n_node.prev); +@@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct klist_iter *i) + prev = to_klist_node(prev->n_node.prev); + } + +- spin_unlock(&i->i_klist->k_lock); ++ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); + + if (put && last) + put(last); +@@ -377,8 +378,9 @@ struct klist_node *klist_next(struct klist_iter *i) + void (*put)(struct klist_node *) = i->i_klist->put; + struct klist_node *last = i->i_cur; + struct klist_node *next; ++ unsigned long flags; + +- spin_lock(&i->i_klist->k_lock); ++ spin_lock_irqsave(&i->i_klist->k_lock, flags); + + if (last) { + next = to_klist_node(last->n_node.next); +@@ -397,7 +399,7 @@ struct klist_node *klist_next(struct klist_iter *i) + next = to_klist_node(next->n_node.next); + } + +- spin_unlock(&i->i_klist->k_lock); ++ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); + + if (put && last) + put(last); +diff --git a/mm/madvise.c b/mm/madvise.c +index 2a0f9a4504f1..f548c66154ee 100644 +--- a/mm/madvise.c ++++ b/mm/madvise.c +@@ -76,7 +76,7 @@ static long madvise_behavior(struct vm_area_struct *vma, + new_flags |= VM_DONTDUMP; + break; + case MADV_DODUMP: +- if (new_flags & VM_SPECIAL) { ++ if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) { + error = -EINVAL; + goto out; + } +diff --git a/mm/slub.c b/mm/slub.c +index 2284c4333857..c33b0e13cca7 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1661,7 +1661,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n, + { + struct page *page, *page2; + void *object = NULL; +- int available = 0; ++ unsigned int available = 0; + int objects; + + /* +@@ -4674,10 +4674,10 @@ static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf) + static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf, + size_t length) + { +- unsigned long objects; ++ unsigned int objects; + int err; + +- err = kstrtoul(buf, 10, &objects); ++ err = kstrtouint(buf, 10, &objects); + if (err) + return err; + if (objects && !kmem_cache_has_cpu_partial(s)) +diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c +index 346b5c1a9185..c40eb04dd856 100644 +--- a/net/6lowpan/iphc.c ++++ b/net/6lowpan/iphc.c +@@ -569,6 +569,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev, + hdr.hop_limit, &hdr.daddr); + + skb_push(skb, sizeof(hdr)); ++ skb_reset_mac_header(skb); + skb_reset_network_header(skb); + skb_copy_to_linear_data(skb, &hdr, sizeof(hdr)); + +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index 24ba31601fc9..f2af19673b26 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -948,8 +948,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata, + if (len < IEEE80211_DEAUTH_FRAME_LEN) + return; + +- ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, reason); ++ ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason); + sta_info_destroy_addr(sdata, mgmt->sa); + } + +@@ -967,9 +967,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata, + auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg); + auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction); + +- ibss_dbg(sdata, +- "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction); ++ ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n", ++ mgmt->bssid, auth_transaction); + + if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) + return; +@@ -1174,10 +1174,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata, + rx_timestamp = drv_get_tsf(local, sdata); + } + +- ibss_dbg(sdata, +- "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n", ++ ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n", + mgmt->sa, mgmt->bssid, +- (unsigned long long)rx_timestamp, ++ (unsigned long long)rx_timestamp); ++ ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n", + (unsigned long long)beacon_timestamp, + (unsigned long long)(rx_timestamp - beacon_timestamp), + jiffies); +@@ -1536,9 +1536,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata, + + tx_last_beacon = drv_tx_last_beacon(local); + +- ibss_dbg(sdata, +- "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n", +- mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon); ++ ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da); ++ ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n", ++ mgmt->bssid, tx_last_beacon); + + if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da)) + return; +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 2ee53dc1ddf7..15d23aeea634 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -253,8 +253,27 @@ static void ieee80211_restart_work(struct work_struct *work) + "%s called with hardware scan in progress\n", __func__); + + rtnl_lock(); +- list_for_each_entry(sdata, &local->interfaces, list) ++ list_for_each_entry(sdata, &local->interfaces, list) { ++ /* ++ * XXX: there may be more work for other vif types and even ++ * for station mode: a good thing would be to run most of ++ * the iface type's dependent _stop (ieee80211_mg_stop, ++ * ieee80211_ibss_stop) etc... ++ * For now, fix only the specific bug that was seen: race ++ * between csa_connection_drop_work and us. ++ */ ++ if (sdata->vif.type == NL80211_IFTYPE_STATION) { ++ /* ++ * This worker is scheduled from the iface worker that ++ * runs on mac80211's workqueue, so we can't be ++ * scheduling this worker after the cancel right here. ++ * The exception is ieee80211_chswitch_done. ++ * Then we can have a race... ++ */ ++ cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work); ++ } + flush_delayed_work(&sdata->dec_tailroom_needed_wk); ++ } + ieee80211_scan_cancel(local); + ieee80211_reconfig(local); + rtnl_unlock(); +@@ -460,10 +479,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = { + cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC | + IEEE80211_VHT_CAP_SHORT_GI_80 | + IEEE80211_VHT_CAP_SHORT_GI_160 | +- IEEE80211_VHT_CAP_RXSTBC_1 | +- IEEE80211_VHT_CAP_RXSTBC_2 | +- IEEE80211_VHT_CAP_RXSTBC_3 | +- IEEE80211_VHT_CAP_RXSTBC_4 | ++ IEEE80211_VHT_CAP_RXSTBC_MASK | + IEEE80211_VHT_CAP_TXSTBC | + IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE | + IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE | +diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c +index e68a409fc351..33d5271a9e32 100644 +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -552,6 +552,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata, + forward = false; + reply = true; + target_metric = 0; ++ ++ if (SN_GT(target_sn, ifmsh->sn)) ++ ifmsh->sn = target_sn; ++ + if (time_after(jiffies, ifmsh->last_sn_update + + net_traversal_jiffies(sdata)) || + time_before(jiffies, ifmsh->last_sn_update)) { +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 005cd8796505..a5e11280f405 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1021,6 +1021,10 @@ static void ieee80211_chswitch_work(struct work_struct *work) + */ + + if (sdata->reserved_chanctx) { ++ struct ieee80211_supported_band *sband = NULL; ++ struct sta_info *mgd_sta = NULL; ++ enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20; ++ + /* + * with multi-vif csa driver may call ieee80211_csa_finish() + * many times while waiting for other interfaces to use their +@@ -1029,6 +1033,48 @@ static void ieee80211_chswitch_work(struct work_struct *work) + if (sdata->reserved_ready) + goto out; + ++ if (sdata->vif.bss_conf.chandef.width != ++ sdata->csa_chandef.width) { ++ /* ++ * For managed interface, we need to also update the AP ++ * station bandwidth and align the rate scale algorithm ++ * on the bandwidth change. Here we only consider the ++ * bandwidth of the new channel definition (as channel ++ * switch flow does not have the full HT/VHT/HE ++ * information), assuming that if additional changes are ++ * required they would be done as part of the processing ++ * of the next beacon from the AP. ++ */ ++ switch (sdata->csa_chandef.width) { ++ case NL80211_CHAN_WIDTH_20_NOHT: ++ case NL80211_CHAN_WIDTH_20: ++ default: ++ bw = IEEE80211_STA_RX_BW_20; ++ break; ++ case NL80211_CHAN_WIDTH_40: ++ bw = IEEE80211_STA_RX_BW_40; ++ break; ++ case NL80211_CHAN_WIDTH_80: ++ bw = IEEE80211_STA_RX_BW_80; ++ break; ++ case NL80211_CHAN_WIDTH_80P80: ++ case NL80211_CHAN_WIDTH_160: ++ bw = IEEE80211_STA_RX_BW_160; ++ break; ++ } ++ ++ mgd_sta = sta_info_get(sdata, ifmgd->bssid); ++ sband = ++ local->hw.wiphy->bands[sdata->csa_chandef.chan->band]; ++ } ++ ++ if (sdata->vif.bss_conf.chandef.width > ++ sdata->csa_chandef.width) { ++ mgd_sta->sta.bandwidth = bw; ++ rate_control_rate_update(local, sband, mgd_sta, ++ IEEE80211_RC_BW_CHANGED); ++ } ++ + ret = ieee80211_vif_use_reserved_context(sdata); + if (ret) { + sdata_info(sdata, +@@ -1039,6 +1085,13 @@ static void ieee80211_chswitch_work(struct work_struct *work) + goto out; + } + ++ if (sdata->vif.bss_conf.chandef.width < ++ sdata->csa_chandef.width) { ++ mgd_sta->sta.bandwidth = bw; ++ rate_control_rate_update(local, sband, mgd_sta, ++ IEEE80211_RC_BW_CHANGED); ++ } ++ + goto out; + } + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index b07fd8b8b50c..642a78079ae1 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10014,6 +10014,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) + return -EOPNOTSUPP; + + if (!info->attrs[NL80211_ATTR_MDID] || ++ !info->attrs[NL80211_ATTR_IE] || + !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) + return -EINVAL; + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index baf7218cec15..1d239564baa3 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1360,7 +1360,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef, + u8 *op_class) + { + u8 vht_opclass; +- u16 freq = chandef->center_freq1; ++ u32 freq = chandef->center_freq1; + + if (freq >= 2412 && freq <= 2472) { + if (chandef->width > NL80211_CHAN_WIDTH_40) +diff --git a/sound/aoa/core/gpio-feature.c b/sound/aoa/core/gpio-feature.c +index f34153962d07..585b594bd838 100644 +--- a/sound/aoa/core/gpio-feature.c ++++ b/sound/aoa/core/gpio-feature.c +@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char *name, + } + + reg = of_get_property(np, "reg", NULL); +- if (!reg) ++ if (!reg) { ++ of_node_put(np); + return NULL; ++ } + + *gpioptr = *reg; + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index cabccb10210e..95a82e428f37 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2360,7 +2360,8 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), +- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, ++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | ++ AZX_DCAPS_PM_RUNTIME }, + /* ATI HDMI */ + { PCI_DEVICE(0x1002, 0x0002), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d706a416b587..0467e5ba82e0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5642,6 +5642,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 9e784cc3e5d2..0aefed8ab0cf 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3864,6 +3864,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card) + continue; + } + ++ /* let users know there is no DAI to link */ ++ if (!dai_w->priv) { ++ dev_dbg(card->dev, "dai widget %s has no DAI\n", ++ dai_w->name); ++ continue; ++ } ++ + dai = dai_w->priv; + + /* ...find all widgets with the same stream and link them */ +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index bbc1a50768dd..873f19f1a771 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -27,15 +27,16 @@ void arch__elf_sym_adjust(GElf_Sym *sym) + #endif + #endif + +-#if !defined(_CALL_ELF) || _CALL_ELF != 2 + int arch__choose_best_symbol(struct symbol *syma, + struct symbol *symb __maybe_unused) + { + char *sym = syma->name; + ++#if !defined(_CALL_ELF) || _CALL_ELF != 2 + /* Skip over any initial dot */ + if (*sym == '.') + sym++; ++#endif + + /* Avoid "SyS" kernel syscall aliases */ + if (strlen(sym) >= 3 && !strncmp(sym, "SyS", 3)) +@@ -46,6 +47,7 @@ int arch__choose_best_symbol(struct symbol *syma, + return SYMBOL_A; + } + ++#if !defined(_CALL_ELF) || _CALL_ELF != 2 + /* Allow matching against dot variants */ + int arch__compare_symbol_names(const char *namea, const char *nameb) + { +diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c +index 5a6016224bb9..c7fcc84fc0c0 100644 +--- a/tools/vm/page-types.c ++++ b/tools/vm/page-types.c +@@ -150,12 +150,6 @@ static const char * const page_flag_names[] = { + }; + + +-static const char * const debugfs_known_mountpoints[] = { +- "/sys/kernel/debug", +- "/debug", +- 0, +-}; +- + /* + * data structures + */ +diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c +index 499b8819d4c6..5173a191cd03 100644 +--- a/tools/vm/slabinfo.c ++++ b/tools/vm/slabinfo.c +@@ -29,8 +29,8 @@ struct slabinfo { + int alias; + int refs; + int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu; +- int hwcache_align, object_size, objs_per_slab; +- int sanity_checks, slab_size, store_user, trace; ++ unsigned int hwcache_align, object_size, objs_per_slab; ++ unsigned int sanity_checks, slab_size, store_user, trace; + int order, poison, reclaim_account, red_zone; + unsigned long partial, objects, slabs, objects_partial, objects_total; + unsigned long alloc_fastpath, alloc_slowpath; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.160-161.patch b/patch/kernel/mvebu-default/04-patch-4.4.160-161.patch new file mode 100644 index 000000000..4b0393795 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.160-161.patch @@ -0,0 +1,1458 @@ +diff --git a/Makefile b/Makefile +index 607394a56036..57e4ff1a8b96 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 160 ++SUBLEVEL = 161 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c +index a3f750e76b68..8f40c6c5d77e 100644 +--- a/arch/arc/kernel/process.c ++++ b/arch/arc/kernel/process.c +@@ -153,6 +153,26 @@ int copy_thread(unsigned long clone_flags, + task_thread_info(current)->thr_ptr; + } + ++ ++ /* ++ * setup usermode thread pointer #1: ++ * when child is picked by scheduler, __switch_to() uses @c_callee to ++ * populate usermode callee regs: this works (despite being in a kernel ++ * function) since special return path for child @ret_from_fork() ++ * ensures those regs are not clobbered all the way to RTIE to usermode ++ */ ++ c_callee->r25 = task_thread_info(p)->thr_ptr; ++ ++#ifdef CONFIG_ARC_CURR_IN_REG ++ /* ++ * setup usermode thread pointer #2: ++ * however for this special use of r25 in kernel, __switch_to() sets ++ * r25 for kernel needs and only in the final return path is usermode ++ * r25 setup, from pt_regs->user_r25. So set that up as well ++ */ ++ c_regs->user_r25 = c_callee->r25; ++#endif ++ + return 0; + } + +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index c3c835290131..ca3ad5ebcd41 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -360,9 +360,9 @@ static int __init early_fadump_reserve_mem(char *p) + } + early_param("fadump_reserve_mem", early_fadump_reserve_mem); + +-static void register_fw_dump(struct fadump_mem_struct *fdm) ++static int register_fw_dump(struct fadump_mem_struct *fdm) + { +- int rc; ++ int rc, err; + unsigned int wait_time; + + pr_debug("Registering for firmware-assisted kernel dump...\n"); +@@ -379,7 +379,11 @@ static void register_fw_dump(struct fadump_mem_struct *fdm) + + } while (wait_time); + ++ err = -EIO; + switch (rc) { ++ default: ++ pr_err("Failed to register. Unknown Error(%d).\n", rc); ++ break; + case -1: + printk(KERN_ERR "Failed to register firmware-assisted kernel" + " dump. Hardware Error(%d).\n", rc); +@@ -387,18 +391,22 @@ static void register_fw_dump(struct fadump_mem_struct *fdm) + case -3: + printk(KERN_ERR "Failed to register firmware-assisted kernel" + " dump. Parameter Error(%d).\n", rc); ++ err = -EINVAL; + break; + case -9: + printk(KERN_ERR "firmware-assisted kernel dump is already " + " registered."); + fw_dump.dump_registered = 1; ++ err = -EEXIST; + break; + case 0: + printk(KERN_INFO "firmware-assisted kernel dump registration" + " is successful\n"); + fw_dump.dump_registered = 1; ++ err = 0; + break; + } ++ return err; + } + + void crash_fadump(struct pt_regs *regs, const char *str) +@@ -997,7 +1005,7 @@ static unsigned long init_fadump_header(unsigned long addr) + return addr; + } + +-static void register_fadump(void) ++static int register_fadump(void) + { + unsigned long addr; + void *vaddr; +@@ -1008,7 +1016,7 @@ static void register_fadump(void) + * assisted dump. + */ + if (!fw_dump.reserve_dump_area_size) +- return; ++ return -ENODEV; + + ret = fadump_setup_crash_memory_ranges(); + if (ret) +@@ -1023,7 +1031,7 @@ static void register_fadump(void) + fadump_create_elfcore_headers(vaddr); + + /* register the future kernel dump with firmware. */ +- register_fw_dump(&fdm); ++ return register_fw_dump(&fdm); + } + + static int fadump_unregister_dump(struct fadump_mem_struct *fdm) +@@ -1208,7 +1216,6 @@ static ssize_t fadump_register_store(struct kobject *kobj, + switch (buf[0]) { + case '0': + if (fw_dump.dump_registered == 0) { +- ret = -EINVAL; + goto unlock_out; + } + /* Un-register Firmware-assisted dump */ +@@ -1216,11 +1223,11 @@ static ssize_t fadump_register_store(struct kobject *kobj, + break; + case '1': + if (fw_dump.dump_registered == 1) { +- ret = -EINVAL; ++ ret = -EEXIST; + goto unlock_out; + } + /* Register Firmware-assisted dump */ +- register_fadump(); ++ ret = register_fadump(); + break; + default: + ret = -EINVAL; +diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c +index 5dd363d54348..049327ee8868 100644 +--- a/arch/x86/entry/vdso/vclock_gettime.c ++++ b/arch/x86/entry/vdso/vclock_gettime.c +@@ -51,8 +51,9 @@ extern u8 pvclock_page + notrace static long vdso_fallback_gettime(long clock, struct timespec *ts) + { + long ret; +- asm("syscall" : "=a" (ret) : +- "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory"); ++ asm ("syscall" : "=a" (ret), "=m" (*ts) : ++ "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : ++ "memory", "rcx", "r11"); + return ret; + } + +@@ -60,8 +61,9 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz) + { + long ret; + +- asm("syscall" : "=a" (ret) : +- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory"); ++ asm ("syscall" : "=a" (ret), "=m" (*tv), "=m" (*tz) : ++ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : ++ "memory", "rcx", "r11"); + return ret; + } + +@@ -143,13 +145,13 @@ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts) + { + long ret; + +- asm( ++ asm ( + "mov %%ebx, %%edx \n" +- "mov %2, %%ebx \n" ++ "mov %[clock], %%ebx \n" + "call __kernel_vsyscall \n" + "mov %%edx, %%ebx \n" +- : "=a" (ret) +- : "0" (__NR_clock_gettime), "g" (clock), "c" (ts) ++ : "=a" (ret), "=m" (*ts) ++ : "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts) + : "memory", "edx"); + return ret; + } +@@ -158,13 +160,13 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz) + { + long ret; + +- asm( ++ asm ( + "mov %%ebx, %%edx \n" +- "mov %2, %%ebx \n" ++ "mov %[tv], %%ebx \n" + "call __kernel_vsyscall \n" + "mov %%edx, %%ebx \n" +- : "=a" (ret) +- : "0" (__NR_gettimeofday), "g" (tv), "c" (tz) ++ : "=a" (ret), "=m" (*tv), "=m" (*tz) ++ : "0" (__NR_gettimeofday), [tv] "g" (tv), "c" (tz) + : "memory", "edx"); + return ret; + } +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 9712a63957e1..7525e9f6949e 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1709,6 +1709,8 @@ static int ucma_close(struct inode *inode, struct file *filp) + mutex_lock(&mut); + if (!ctx->closing) { + mutex_unlock(&mut); ++ ucma_put_ctx(ctx); ++ wait_for_completion(&ctx->comp); + /* rdma_destroy_id ensures that no event handlers are + * inflight for that id before releasing it. + */ +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index b59615ddf6ba..531d6f3a786e 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -3391,8 +3391,13 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) + + static bool can_resize(struct cache *cache, dm_cblock_t new_size) + { +- if (from_cblock(new_size) > from_cblock(cache->cache_size)) +- return true; ++ if (from_cblock(new_size) > from_cblock(cache->cache_size)) { ++ if (cache->sized) { ++ DMERR("%s: unable to extend cache due to missing cache table reload", ++ cache_device_name(cache)); ++ return false; ++ } ++ } + + /* + * We can't drop a dirty block when shrinking the cache. +diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h +index 71bdb368813d..0194bebbdbf7 100644 +--- a/drivers/net/wireless/ath/ath10k/trace.h ++++ b/drivers/net/wireless/ath/ath10k/trace.h +@@ -152,10 +152,9 @@ TRACE_EVENT(ath10k_log_dbg_dump, + ); + + TRACE_EVENT(ath10k_wmi_cmd, +- TP_PROTO(struct ath10k *ar, int id, const void *buf, size_t buf_len, +- int ret), ++ TP_PROTO(struct ath10k *ar, int id, const void *buf, size_t buf_len), + +- TP_ARGS(ar, id, buf, buf_len, ret), ++ TP_ARGS(ar, id, buf, buf_len), + + TP_STRUCT__entry( + __string(device, dev_name(ar->dev)) +@@ -163,7 +162,6 @@ TRACE_EVENT(ath10k_wmi_cmd, + __field(unsigned int, id) + __field(size_t, buf_len) + __dynamic_array(u8, buf, buf_len) +- __field(int, ret) + ), + + TP_fast_assign( +@@ -171,17 +169,15 @@ TRACE_EVENT(ath10k_wmi_cmd, + __assign_str(driver, dev_driver_string(ar->dev)); + __entry->id = id; + __entry->buf_len = buf_len; +- __entry->ret = ret; + memcpy(__get_dynamic_array(buf), buf, buf_len); + ), + + TP_printk( +- "%s %s id %d len %zu ret %d", ++ "%s %s id %d len %zu", + __get_str(driver), + __get_str(device), + __entry->id, +- __entry->buf_len, +- __entry->ret ++ __entry->buf_len + ) + ); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index c72eb4464de9..c27fff39ddae 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1459,10 +1459,10 @@ ath10k_wmi_tlv_op_gen_start_scan(struct ath10k *ar, + bssid_len = arg->n_bssids * sizeof(struct wmi_mac_addr); + ie_len = roundup(arg->ie_len, 4); + len = (sizeof(*tlv) + sizeof(*cmd)) + +- (arg->n_channels ? sizeof(*tlv) + chan_len : 0) + +- (arg->n_ssids ? sizeof(*tlv) + ssid_len : 0) + +- (arg->n_bssids ? sizeof(*tlv) + bssid_len : 0) + +- (arg->ie_len ? sizeof(*tlv) + ie_len : 0); ++ sizeof(*tlv) + chan_len + ++ sizeof(*tlv) + ssid_len + ++ sizeof(*tlv) + bssid_len + ++ sizeof(*tlv) + ie_len; + + skb = ath10k_wmi_alloc_skb(ar, len); + if (!skb) +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 7569db0f69b5..5bb1be478954 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1642,8 +1642,8 @@ int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb, + cmd_hdr->cmd_id = __cpu_to_le32(cmd); + + memset(skb_cb, 0, sizeof(*skb_cb)); ++ trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len); + ret = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb); +- trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len, ret); + + if (ret) + goto err_pull; +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 2a547ca3d443..2eac3df7dd29 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -553,6 +553,9 @@ static void __init of_unittest_parse_interrupts(void) + struct of_phandle_args args; + int i, rc; + ++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC) ++ return; ++ + np = of_find_node_by_path("/testcase-data/interrupts/interrupts0"); + if (!np) { + pr_err("missing testcase data\n"); +@@ -627,6 +630,9 @@ static void __init of_unittest_parse_interrupts_extended(void) + struct of_phandle_args args; + int i, rc; + ++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC) ++ return; ++ + np = of_find_node_by_path("/testcase-data/interrupts/interrupts-extended0"); + if (!np) { + pr_err("missing testcase data\n"); +@@ -778,15 +784,19 @@ static void __init of_unittest_platform_populate(void) + pdev = of_find_device_by_node(np); + unittest(pdev, "device 1 creation failed\n"); + +- irq = platform_get_irq(pdev, 0); +- unittest(irq == -EPROBE_DEFER, "device deferred probe failed - %d\n", irq); +- +- /* Test that a parsing failure does not return -EPROBE_DEFER */ +- np = of_find_node_by_path("/testcase-data/testcase-device2"); +- pdev = of_find_device_by_node(np); +- unittest(pdev, "device 2 creation failed\n"); +- irq = platform_get_irq(pdev, 0); +- unittest(irq < 0 && irq != -EPROBE_DEFER, "device parsing error failed - %d\n", irq); ++ if (!(of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)) { ++ irq = platform_get_irq(pdev, 0); ++ unittest(irq == -EPROBE_DEFER, ++ "device deferred probe failed - %d\n", irq); ++ ++ /* Test that a parsing failure does not return -EPROBE_DEFER */ ++ np = of_find_node_by_path("/testcase-data/testcase-device2"); ++ pdev = of_find_device_by_node(np); ++ unittest(pdev, "device 2 creation failed\n"); ++ irq = platform_get_irq(pdev, 0); ++ unittest(irq < 0 && irq != -EPROBE_DEFER, ++ "device parsing error failed - %d\n", irq); ++ } + + np = of_find_node_by_path("/testcase-data/platform-tests"); + unittest(np, "No testcase data in device tree\n"); +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 295bf1472d02..5073ab023123 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1064,12 +1064,12 @@ int pci_save_state(struct pci_dev *dev) + EXPORT_SYMBOL(pci_save_state); + + static void pci_restore_config_dword(struct pci_dev *pdev, int offset, +- u32 saved_val, int retry) ++ u32 saved_val, int retry, bool force) + { + u32 val; + + pci_read_config_dword(pdev, offset, &val); +- if (val == saved_val) ++ if (!force && val == saved_val) + return; + + for (;;) { +@@ -1088,25 +1088,36 @@ static void pci_restore_config_dword(struct pci_dev *pdev, int offset, + } + + static void pci_restore_config_space_range(struct pci_dev *pdev, +- int start, int end, int retry) ++ int start, int end, int retry, ++ bool force) + { + int index; + + for (index = end; index >= start; index--) + pci_restore_config_dword(pdev, 4 * index, + pdev->saved_config_space[index], +- retry); ++ retry, force); + } + + static void pci_restore_config_space(struct pci_dev *pdev) + { + if (pdev->hdr_type == PCI_HEADER_TYPE_NORMAL) { +- pci_restore_config_space_range(pdev, 10, 15, 0); ++ pci_restore_config_space_range(pdev, 10, 15, 0, false); + /* Restore BARs before the command register. */ +- pci_restore_config_space_range(pdev, 4, 9, 10); +- pci_restore_config_space_range(pdev, 0, 3, 0); ++ pci_restore_config_space_range(pdev, 4, 9, 10, false); ++ pci_restore_config_space_range(pdev, 0, 3, 0, false); ++ } else if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE) { ++ pci_restore_config_space_range(pdev, 12, 15, 0, false); ++ ++ /* ++ * Force rewriting of prefetch registers to avoid S3 resume ++ * issues on Intel PCI bridges that occur when these ++ * registers are not explicitly written. ++ */ ++ pci_restore_config_space_range(pdev, 9, 11, 0, true); ++ pci_restore_config_space_range(pdev, 0, 8, 0, false); + } else { +- pci_restore_config_space_range(pdev, 0, 15, 0); ++ pci_restore_config_space_range(pdev, 0, 15, 0, false); + } + } + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index cbf3be66f89c..d6e2199bcfe5 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -174,6 +174,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + } + if (pdev->vendor == PCI_VENDOR_ID_INTEL && + (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) + xhci->quirks |= XHCI_MISSING_CAS; +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index 2674da40d9cd..6d6acf2c07c3 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -87,7 +87,8 @@ DEVICE(moto_modem, MOTO_IDS); + + /* Motorola Tetra driver */ + #define MOTOROLA_TETRA_IDS() \ +- { USB_DEVICE(0x0cad, 0x9011) } /* Motorola Solutions TETRA PEI */ ++ { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \ ++ { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + + /* Novatel Wireless GPS driver */ +diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +index 9ddfdd63b84c..34ab4f950f0a 100644 +--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c ++++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c +@@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_info *fbi, + if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) + return -EFAULT; + ++ if (mr->w > 4096 || mr->h > 4096) ++ return -EINVAL; ++ + if (mr->w * mr->h * 3 > mr->buffer_size) + return -EINVAL; + +@@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_info *fbi, + mr->x, mr->y, mr->w, mr->h); + + if (r > 0) { +- if (copy_to_user(mr->buffer, buf, mr->buffer_size)) ++ if (copy_to_user(mr->buffer, buf, r)) + r = -EFAULT; + } + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index b51bb73b06a6..d0aaf338fa9f 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -220,12 +220,12 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) + { + int error; + +- if (buffer_verified(bh)) +- return 0; +- + if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || + BHDR(bh)->h_blocks != cpu_to_le32(1)) + return -EFSCORRUPTED; ++ if (buffer_verified(bh)) ++ return 0; ++ + if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) + return -EFSBADCRC; + error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, +diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c +index 0bb6de356451..7968b7a5e787 100644 +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1918,6 +1918,9 @@ static struct ubi_volume_desc *open_ubi(const char *name, int mode) + int dev, vol; + char *endptr; + ++ if (!name || !*name) ++ return ERR_PTR(-EINVAL); ++ + /* First, try to open using the device node path method */ + ubi = ubi_open_volume_path(name, mode); + if (!IS_ERR(ubi)) +diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h +index 2ea517c7c6b9..bffd096fae3b 100644 +--- a/include/linux/netfilter_bridge/ebtables.h ++++ b/include/linux/netfilter_bridge/ebtables.h +@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb, + /* True if the target is not a standard target */ + #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0) + ++static inline bool ebt_invalid_target(int target) ++{ ++ return (target < -NUM_STANDARD_TARGETS || target >= 0); ++} ++ + #endif +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index c28bd8be290a..a490dd718654 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2273,6 +2273,8 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) + kfree_skb(skb); + } + ++void skb_rbtree_purge(struct rb_root *root); ++ + void *netdev_alloc_frag(unsigned int fragsz); + + struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int length, +@@ -2807,6 +2809,12 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) + return __pskb_trim(skb, len); + } + ++#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) ++#define skb_rb_first(root) rb_to_skb(rb_first(root)) ++#define skb_rb_last(root) rb_to_skb(rb_last(root)) ++#define skb_rb_next(skb) rb_to_skb(rb_next(&(skb)->rbnode)) ++#define skb_rb_prev(skb) rb_to_skb(rb_prev(&(skb)->rbnode)) ++ + #define skb_queue_walk(queue, skb) \ + for (skb = (queue)->next; \ + skb != (struct sk_buff *)(queue); \ +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index 5b6df1a8dc74..747404dbe506 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -279,10 +279,9 @@ struct tcp_sock { + struct sk_buff* lost_skb_hint; + struct sk_buff *retransmit_skb_hint; + +- /* OOO segments go in this list. Note that socket lock must be held, +- * as we do not use sk_buff_head lock. +- */ +- struct sk_buff_head out_of_order_queue; ++ /* OOO segments go in this rbtree. Socket lock must be held. */ ++ struct rb_root out_of_order_queue; ++ struct sk_buff *ooo_last_skb; /* cache rb_last(out_of_order_queue) */ + + /* SACKs data, these 2 need to be together (see tcp_options_write) */ + struct tcp_sack_block duplicate_sack[1]; /* D-SACK block */ +diff --git a/include/net/sock.h b/include/net/sock.h +index 3d5ff7436f41..577075713ad5 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2139,6 +2139,13 @@ sock_skb_set_dropcount(const struct sock *sk, struct sk_buff *skb) + SOCK_SKB_CB(skb)->dropcount = atomic_read(&sk->sk_drops); + } + ++static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb) ++{ ++ int segs = max_t(u16, 1, skb_shinfo(skb)->gso_segs); ++ ++ atomic_add(segs, &sk->sk_drops); ++} ++ + void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk, + struct sk_buff *skb); + void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk, +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 6c89238f192e..a99f75ef6a73 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -649,7 +649,7 @@ static inline void tcp_fast_path_check(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + +- if (skb_queue_empty(&tp->out_of_order_queue) && ++ if (RB_EMPTY_ROOT(&tp->out_of_order_queue) && + tp->rcv_wnd && + atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf && + !tp->urg_data) +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index 4cb94b678e9f..5299618d6308 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -4083,7 +4083,11 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) + */ + do { + css_task_iter_start(&from->self, &it); +- task = css_task_iter_next(&it); ++ ++ do { ++ task = css_task_iter_next(&it); ++ } while (task && (task->flags & PF_EXITING)); ++ + if (task) + get_task_struct(task); + css_task_iter_end(&it); +diff --git a/mm/vmstat.c b/mm/vmstat.c +index 5712cdaae964..8895eff2d735 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -858,6 +858,9 @@ const char * const vmstat_text[] = { + #ifdef CONFIG_SMP + "nr_tlb_remote_flush", + "nr_tlb_remote_flush_received", ++#else ++ "", /* nr_tlb_remote_flush */ ++ "", /* nr_tlb_remote_flush_received */ + #endif /* CONFIG_SMP */ + "nr_tlb_local_flush_all", + "nr_tlb_local_flush_one", +diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c +index 070cf134a22f..f2660c1b29e4 100644 +--- a/net/bridge/netfilter/ebt_arpreply.c ++++ b/net/bridge/netfilter/ebt_arpreply.c +@@ -67,6 +67,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par) + if (e->ethproto != htons(ETH_P_ARP) || + e->invflags & EBT_IPROTO) + return -EINVAL; ++ if (ebt_invalid_target(info->target)) ++ return -EINVAL; ++ + return 0; + } + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 55be076706e5..9703924ed071 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2377,6 +2377,25 @@ void skb_queue_purge(struct sk_buff_head *list) + } + EXPORT_SYMBOL(skb_queue_purge); + ++/** ++ * skb_rbtree_purge - empty a skb rbtree ++ * @root: root of the rbtree to empty ++ * ++ * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from ++ * the list and one reference dropped. This function does not take ++ * any lock. Synchronization should be handled by the caller (e.g., TCP ++ * out-of-order queue is protected by the socket lock). ++ */ ++void skb_rbtree_purge(struct rb_root *root) ++{ ++ struct sk_buff *skb, *next; ++ ++ rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) ++ kfree_skb(skb); ++ ++ *root = RB_ROOT; ++} ++ + /** + * skb_queue_head - queue a buffer at the list head + * @list: list to use +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 5e162b8ab184..b7492aabe710 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -382,7 +382,7 @@ void tcp_init_sock(struct sock *sk) + struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- __skb_queue_head_init(&tp->out_of_order_queue); ++ tp->out_of_order_queue = RB_ROOT; + tcp_init_xmit_timers(sk); + tcp_prequeue_init(tp); + INIT_LIST_HEAD(&tp->tsq_node); +@@ -2240,7 +2240,7 @@ int tcp_disconnect(struct sock *sk, int flags) + tcp_clear_xmit_timers(sk); + __skb_queue_purge(&sk->sk_receive_queue); + tcp_write_queue_purge(sk); +- __skb_queue_purge(&tp->out_of_order_queue); ++ skb_rbtree_purge(&tp->out_of_order_queue); + + inet->inet_dport = 0; + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 9c4c6cd0316e..1aff93d76f24 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4073,7 +4073,7 @@ static void tcp_fin(struct sock *sk) + /* It _is_ possible, that we have something out-of-order _after_ FIN. + * Probably, we should reset in this case. For now drop them. + */ +- __skb_queue_purge(&tp->out_of_order_queue); ++ skb_rbtree_purge(&tp->out_of_order_queue); + if (tcp_is_sack(tp)) + tcp_sack_reset(&tp->rx_opt); + sk_mem_reclaim(sk); +@@ -4233,7 +4233,7 @@ static void tcp_sack_remove(struct tcp_sock *tp) + int this_sack; + + /* Empty ofo queue, hence, all the SACKs are eaten. Clear. */ +- if (skb_queue_empty(&tp->out_of_order_queue)) { ++ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) { + tp->rx_opt.num_sacks = 0; + return; + } +@@ -4296,6 +4296,29 @@ static bool tcp_try_coalesce(struct sock *sk, + return true; + } + ++static bool tcp_ooo_try_coalesce(struct sock *sk, ++ struct sk_buff *to, ++ struct sk_buff *from, ++ bool *fragstolen) ++{ ++ bool res = tcp_try_coalesce(sk, to, from, fragstolen); ++ ++ /* In case tcp_drop() is called later, update to->gso_segs */ ++ if (res) { ++ u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) + ++ max_t(u16, 1, skb_shinfo(from)->gso_segs); ++ ++ skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF); ++ } ++ return res; ++} ++ ++static void tcp_drop(struct sock *sk, struct sk_buff *skb) ++{ ++ sk_drops_add(sk, skb); ++ __kfree_skb(skb); ++} ++ + /* This one checks to see if we can put data from the + * out_of_order queue into the receive_queue. + */ +@@ -4303,10 +4326,13 @@ static void tcp_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + __u32 dsack_high = tp->rcv_nxt; ++ bool fin, fragstolen, eaten; + struct sk_buff *skb, *tail; +- bool fragstolen, eaten; ++ struct rb_node *p; + +- while ((skb = skb_peek(&tp->out_of_order_queue)) != NULL) { ++ p = rb_first(&tp->out_of_order_queue); ++ while (p) { ++ skb = rb_entry(p, struct sk_buff, rbnode); + if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) + break; + +@@ -4316,11 +4342,12 @@ static void tcp_ofo_queue(struct sock *sk) + dsack_high = TCP_SKB_CB(skb)->end_seq; + tcp_dsack_extend(sk, TCP_SKB_CB(skb)->seq, dsack); + } ++ p = rb_next(p); ++ rb_erase(&skb->rbnode, &tp->out_of_order_queue); + +- __skb_unlink(skb, &tp->out_of_order_queue); +- if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) { ++ if (unlikely(!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))) { + SOCK_DEBUG(sk, "ofo packet was already received\n"); +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + continue; + } + SOCK_DEBUG(sk, "ofo requeuing : rcv_next %X seq %X - %X\n", +@@ -4330,12 +4357,19 @@ static void tcp_ofo_queue(struct sock *sk) + tail = skb_peek_tail(&sk->sk_receive_queue); + eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen); + tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq); ++ fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN; + if (!eaten) + __skb_queue_tail(&sk->sk_receive_queue, skb); +- if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) +- tcp_fin(sk); +- if (eaten) ++ else + kfree_skb_partial(skb, fragstolen); ++ ++ if (unlikely(fin)) { ++ tcp_fin(sk); ++ /* tcp_fin() purges tp->out_of_order_queue, ++ * so we must end this loop right now. ++ */ ++ break; ++ } + } + } + +@@ -4365,14 +4399,16 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb, + static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + { + struct tcp_sock *tp = tcp_sk(sk); ++ struct rb_node **p, *q, *parent; + struct sk_buff *skb1; + u32 seq, end_seq; ++ bool fragstolen; + + tcp_ecn_check_ce(sk, skb); + + if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFODROP); +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + return; + } + +@@ -4381,89 +4417,89 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + inet_csk_schedule_ack(sk); + + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOQUEUE); ++ seq = TCP_SKB_CB(skb)->seq; ++ end_seq = TCP_SKB_CB(skb)->end_seq; + SOCK_DEBUG(sk, "out of order segment: rcv_next %X seq %X - %X\n", +- tp->rcv_nxt, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq); ++ tp->rcv_nxt, seq, end_seq); + +- skb1 = skb_peek_tail(&tp->out_of_order_queue); +- if (!skb1) { ++ p = &tp->out_of_order_queue.rb_node; ++ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) { + /* Initial out of order segment, build 1 SACK. */ + if (tcp_is_sack(tp)) { + tp->rx_opt.num_sacks = 1; +- tp->selective_acks[0].start_seq = TCP_SKB_CB(skb)->seq; +- tp->selective_acks[0].end_seq = +- TCP_SKB_CB(skb)->end_seq; +- } +- __skb_queue_head(&tp->out_of_order_queue, skb); +- goto end; +- } +- +- seq = TCP_SKB_CB(skb)->seq; +- end_seq = TCP_SKB_CB(skb)->end_seq; +- +- if (seq == TCP_SKB_CB(skb1)->end_seq) { +- bool fragstolen; +- +- if (!tcp_try_coalesce(sk, skb1, skb, &fragstolen)) { +- __skb_queue_after(&tp->out_of_order_queue, skb1, skb); +- } else { +- tcp_grow_window(sk, skb); +- kfree_skb_partial(skb, fragstolen); +- skb = NULL; ++ tp->selective_acks[0].start_seq = seq; ++ tp->selective_acks[0].end_seq = end_seq; + } +- +- if (!tp->rx_opt.num_sacks || +- tp->selective_acks[0].end_seq != seq) +- goto add_sack; +- +- /* Common case: data arrive in order after hole. */ +- tp->selective_acks[0].end_seq = end_seq; ++ rb_link_node(&skb->rbnode, NULL, p); ++ rb_insert_color(&skb->rbnode, &tp->out_of_order_queue); ++ tp->ooo_last_skb = skb; + goto end; + } + +- /* Find place to insert this segment. */ +- while (1) { +- if (!after(TCP_SKB_CB(skb1)->seq, seq)) +- break; +- if (skb_queue_is_first(&tp->out_of_order_queue, skb1)) { +- skb1 = NULL; +- break; ++ /* In the typical case, we are adding an skb to the end of the list. ++ * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup. ++ */ ++ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, ++ skb, &fragstolen)) { ++coalesce_done: ++ tcp_grow_window(sk, skb); ++ kfree_skb_partial(skb, fragstolen); ++ skb = NULL; ++ goto add_sack; ++ } ++ ++ /* Find place to insert this segment. Handle overlaps on the way. */ ++ parent = NULL; ++ while (*p) { ++ parent = *p; ++ skb1 = rb_entry(parent, struct sk_buff, rbnode); ++ if (before(seq, TCP_SKB_CB(skb1)->seq)) { ++ p = &parent->rb_left; ++ continue; + } +- skb1 = skb_queue_prev(&tp->out_of_order_queue, skb1); +- } + +- /* Do skb overlap to previous one? */ +- if (skb1 && before(seq, TCP_SKB_CB(skb1)->end_seq)) { +- if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) { +- /* All the bits are present. Drop. */ +- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb); +- skb = NULL; +- tcp_dsack_set(sk, seq, end_seq); +- goto add_sack; +- } +- if (after(seq, TCP_SKB_CB(skb1)->seq)) { +- /* Partial overlap. */ +- tcp_dsack_set(sk, seq, +- TCP_SKB_CB(skb1)->end_seq); +- } else { +- if (skb_queue_is_first(&tp->out_of_order_queue, +- skb1)) +- skb1 = NULL; +- else +- skb1 = skb_queue_prev( +- &tp->out_of_order_queue, +- skb1); ++ if (before(seq, TCP_SKB_CB(skb1)->end_seq)) { ++ if (!after(end_seq, TCP_SKB_CB(skb1)->end_seq)) { ++ /* All the bits are present. Drop. */ ++ NET_INC_STATS(sock_net(sk), ++ LINUX_MIB_TCPOFOMERGE); ++ tcp_drop(sk, skb); ++ skb = NULL; ++ tcp_dsack_set(sk, seq, end_seq); ++ goto add_sack; ++ } ++ if (after(seq, TCP_SKB_CB(skb1)->seq)) { ++ /* Partial overlap. */ ++ tcp_dsack_set(sk, seq, TCP_SKB_CB(skb1)->end_seq); ++ } else { ++ /* skb's seq == skb1's seq and skb covers skb1. ++ * Replace skb1 with skb. ++ */ ++ rb_replace_node(&skb1->rbnode, &skb->rbnode, ++ &tp->out_of_order_queue); ++ tcp_dsack_extend(sk, ++ TCP_SKB_CB(skb1)->seq, ++ TCP_SKB_CB(skb1)->end_seq); ++ NET_INC_STATS(sock_net(sk), ++ LINUX_MIB_TCPOFOMERGE); ++ tcp_drop(sk, skb1); ++ goto merge_right; ++ } ++ } else if (tcp_ooo_try_coalesce(sk, skb1, ++ skb, &fragstolen)) { ++ goto coalesce_done; + } ++ p = &parent->rb_right; + } +- if (!skb1) +- __skb_queue_head(&tp->out_of_order_queue, skb); +- else +- __skb_queue_after(&tp->out_of_order_queue, skb1, skb); + +- /* And clean segments covered by new one as whole. */ +- while (!skb_queue_is_last(&tp->out_of_order_queue, skb)) { +- skb1 = skb_queue_next(&tp->out_of_order_queue, skb); ++ /* Insert segment into RB tree. */ ++ rb_link_node(&skb->rbnode, parent, p); ++ rb_insert_color(&skb->rbnode, &tp->out_of_order_queue); + ++merge_right: ++ /* Remove other segments covered by skb. */ ++ while ((q = rb_next(&skb->rbnode)) != NULL) { ++ skb1 = rb_entry(q, struct sk_buff, rbnode); + if (!after(end_seq, TCP_SKB_CB(skb1)->seq)) + break; + if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) { +@@ -4471,12 +4507,15 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + end_seq); + break; + } +- __skb_unlink(skb1, &tp->out_of_order_queue); ++ rb_erase(&skb1->rbnode, &tp->out_of_order_queue); + tcp_dsack_extend(sk, TCP_SKB_CB(skb1)->seq, + TCP_SKB_CB(skb1)->end_seq); + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb1); ++ tcp_drop(sk, skb1); + } ++ /* If there is no skb after us, we are the last_skb ! */ ++ if (!q) ++ tp->ooo_last_skb = skb; + + add_sack: + if (tcp_is_sack(tp)) +@@ -4558,12 +4597,13 @@ err: + static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) + { + struct tcp_sock *tp = tcp_sk(sk); +- int eaten = -1; + bool fragstolen = false; ++ int eaten = -1; + +- if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) +- goto drop; +- ++ if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) { ++ __kfree_skb(skb); ++ return; ++ } + skb_dst_drop(skb); + __skb_pull(skb, tcp_hdr(skb)->doff * 4); + +@@ -4614,13 +4654,13 @@ queue_and_out: + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) + tcp_fin(sk); + +- if (!skb_queue_empty(&tp->out_of_order_queue)) { ++ if (!RB_EMPTY_ROOT(&tp->out_of_order_queue)) { + tcp_ofo_queue(sk); + + /* RFC2581. 4.2. SHOULD send immediate ACK, when + * gap in queue is filled. + */ +- if (skb_queue_empty(&tp->out_of_order_queue)) ++ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) + inet_csk(sk)->icsk_ack.pingpong = 0; + } + +@@ -4645,7 +4685,7 @@ out_of_window: + tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); + inet_csk_schedule_ack(sk); + drop: +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + return; + } + +@@ -4672,48 +4712,76 @@ drop: + tcp_data_queue_ofo(sk, skb); + } + ++static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *list) ++{ ++ if (list) ++ return !skb_queue_is_last(list, skb) ? skb->next : NULL; ++ ++ return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode); ++} ++ + static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, +- struct sk_buff_head *list) ++ struct sk_buff_head *list, ++ struct rb_root *root) + { +- struct sk_buff *next = NULL; ++ struct sk_buff *next = tcp_skb_next(skb, list); + +- if (!skb_queue_is_last(list, skb)) +- next = skb_queue_next(list, skb); ++ if (list) ++ __skb_unlink(skb, list); ++ else ++ rb_erase(&skb->rbnode, root); + +- __skb_unlink(skb, list); + __kfree_skb(skb); + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOLLAPSED); + + return next; + } + ++/* Insert skb into rb tree, ordered by TCP_SKB_CB(skb)->seq */ ++static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb) ++{ ++ struct rb_node **p = &root->rb_node; ++ struct rb_node *parent = NULL; ++ struct sk_buff *skb1; ++ ++ while (*p) { ++ parent = *p; ++ skb1 = rb_entry(parent, struct sk_buff, rbnode); ++ if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq)) ++ p = &parent->rb_left; ++ else ++ p = &parent->rb_right; ++ } ++ rb_link_node(&skb->rbnode, parent, p); ++ rb_insert_color(&skb->rbnode, root); ++} ++ + /* Collapse contiguous sequence of skbs head..tail with + * sequence numbers start..end. + * +- * If tail is NULL, this means until the end of the list. ++ * If tail is NULL, this means until the end of the queue. + * + * Segments with FIN/SYN are not collapsed (only because this + * simplifies code) + */ + static void +-tcp_collapse(struct sock *sk, struct sk_buff_head *list, +- struct sk_buff *head, struct sk_buff *tail, +- u32 start, u32 end) ++tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root, ++ struct sk_buff *head, struct sk_buff *tail, u32 start, u32 end) + { +- struct sk_buff *skb, *n; ++ struct sk_buff *skb = head, *n; ++ struct sk_buff_head tmp; + bool end_of_skbs; + + /* First, check that queue is collapsible and find +- * the point where collapsing can be useful. */ +- skb = head; ++ * the point where collapsing can be useful. ++ */ + restart: +- end_of_skbs = true; +- skb_queue_walk_from_safe(list, skb, n) { +- if (skb == tail) +- break; ++ for (end_of_skbs = true; skb != NULL && skb != tail; skb = n) { ++ n = tcp_skb_next(skb, list); ++ + /* No new bits? It is possible on ofo queue. */ + if (!before(start, TCP_SKB_CB(skb)->end_seq)) { +- skb = tcp_collapse_one(sk, skb, list); ++ skb = tcp_collapse_one(sk, skb, list, root); + if (!skb) + break; + goto restart; +@@ -4731,13 +4799,10 @@ restart: + break; + } + +- if (!skb_queue_is_last(list, skb)) { +- struct sk_buff *next = skb_queue_next(list, skb); +- if (next != tail && +- TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(next)->seq) { +- end_of_skbs = false; +- break; +- } ++ if (n && n != tail && ++ TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(n)->seq) { ++ end_of_skbs = false; ++ break; + } + + /* Decided to skip this, advance start seq. */ +@@ -4747,17 +4812,22 @@ restart: + (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN))) + return; + ++ __skb_queue_head_init(&tmp); ++ + while (before(start, end)) { + int copy = min_t(int, SKB_MAX_ORDER(0, 0), end - start); + struct sk_buff *nskb; + + nskb = alloc_skb(copy, GFP_ATOMIC); + if (!nskb) +- return; ++ break; + + memcpy(nskb->cb, skb->cb, sizeof(skb->cb)); + TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start; +- __skb_queue_before(list, skb, nskb); ++ if (list) ++ __skb_queue_before(list, skb, nskb); ++ else ++ __skb_queue_tail(&tmp, nskb); /* defer rbtree insertion */ + skb_set_owner_r(nskb, sk); + + /* Copy data, releasing collapsed skbs. */ +@@ -4775,14 +4845,17 @@ restart: + start += size; + } + if (!before(start, TCP_SKB_CB(skb)->end_seq)) { +- skb = tcp_collapse_one(sk, skb, list); ++ skb = tcp_collapse_one(sk, skb, list, root); + if (!skb || + skb == tail || + (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN))) +- return; ++ goto end; + } + } + } ++end: ++ skb_queue_walk_safe(&tmp, skb, n) ++ tcp_rbtree_insert(root, skb); + } + + /* Collapse ofo queue. Algorithm: select contiguous sequence of skbs +@@ -4792,34 +4865,39 @@ static void tcp_collapse_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + u32 range_truesize, sum_tiny = 0; +- struct sk_buff *skb = skb_peek(&tp->out_of_order_queue); +- struct sk_buff *head; ++ struct sk_buff *skb, *head; ++ struct rb_node *p; + u32 start, end; + +- if (!skb) ++ p = rb_first(&tp->out_of_order_queue); ++ skb = rb_entry_safe(p, struct sk_buff, rbnode); ++new_range: ++ if (!skb) { ++ p = rb_last(&tp->out_of_order_queue); ++ /* Note: This is possible p is NULL here. We do not ++ * use rb_entry_safe(), as ooo_last_skb is valid only ++ * if rbtree is not empty. ++ */ ++ tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode); + return; +- ++ } + start = TCP_SKB_CB(skb)->seq; + end = TCP_SKB_CB(skb)->end_seq; + range_truesize = skb->truesize; +- head = skb; + +- for (;;) { +- struct sk_buff *next = NULL; ++ for (head = skb;;) { ++ skb = tcp_skb_next(skb, NULL); + +- if (!skb_queue_is_last(&tp->out_of_order_queue, skb)) +- next = skb_queue_next(&tp->out_of_order_queue, skb); +- skb = next; +- +- /* Segment is terminated when we see gap or when +- * we are at the end of all the queue. */ ++ /* Range is terminated when we see a gap or when ++ * we are at the queue end. ++ */ + if (!skb || + after(TCP_SKB_CB(skb)->seq, end) || + before(TCP_SKB_CB(skb)->end_seq, start)) { + /* Do not attempt collapsing tiny skbs */ + if (range_truesize != head->truesize || + end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) { +- tcp_collapse(sk, &tp->out_of_order_queue, ++ tcp_collapse(sk, NULL, &tp->out_of_order_queue, + head, skb, start, end); + } else { + sum_tiny += range_truesize; +@@ -4827,47 +4905,60 @@ static void tcp_collapse_ofo_queue(struct sock *sk) + return; + } + +- head = skb; +- if (!skb) +- break; +- /* Start new segment */ ++ goto new_range; ++ } ++ ++ range_truesize += skb->truesize; ++ if (unlikely(before(TCP_SKB_CB(skb)->seq, start))) + start = TCP_SKB_CB(skb)->seq; ++ if (after(TCP_SKB_CB(skb)->end_seq, end)) + end = TCP_SKB_CB(skb)->end_seq; +- range_truesize = skb->truesize; +- } else { +- range_truesize += skb->truesize; +- if (before(TCP_SKB_CB(skb)->seq, start)) +- start = TCP_SKB_CB(skb)->seq; +- if (after(TCP_SKB_CB(skb)->end_seq, end)) +- end = TCP_SKB_CB(skb)->end_seq; +- } + } + } + + /* + * Purge the out-of-order queue. ++ * Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks. + * Return true if queue was pruned. + */ + static bool tcp_prune_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); +- bool res = false; ++ struct rb_node *node, *prev; ++ int goal; + +- if (!skb_queue_empty(&tp->out_of_order_queue)) { +- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_OFOPRUNED); +- __skb_queue_purge(&tp->out_of_order_queue); ++ if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) ++ return false; + +- /* Reset SACK state. A conforming SACK implementation will +- * do the same at a timeout based retransmit. When a connection +- * is in a sad state like this, we care only about integrity +- * of the connection not performance. +- */ +- if (tp->rx_opt.sack_ok) +- tcp_sack_reset(&tp->rx_opt); +- sk_mem_reclaim(sk); +- res = true; +- } +- return res; ++ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_OFOPRUNED); ++ goal = sk->sk_rcvbuf >> 3; ++ node = &tp->ooo_last_skb->rbnode; ++ do { ++ prev = rb_prev(node); ++ rb_erase(node, &tp->out_of_order_queue); ++ goal -= rb_to_skb(node)->truesize; ++ __kfree_skb(rb_to_skb(node)); ++ if (!prev || goal <= 0) { ++ sk_mem_reclaim(sk); ++ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && ++ !tcp_under_memory_pressure(sk)) ++ break; ++ goal = sk->sk_rcvbuf >> 3; ++ } ++ ++ node = prev; ++ } while (node); ++ tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); ++ ++ /* Reset SACK state. A conforming SACK implementation will ++ * do the same at a timeout based retransmit. When a connection ++ * is in a sad state like this, we care only about integrity ++ * of the connection not performance. ++ */ ++ if (tp->rx_opt.sack_ok) ++ tcp_sack_reset(&tp->rx_opt); ++ ++ return true; + } + + /* Reduce allocated memory if we can, trying to get +@@ -4895,7 +4986,7 @@ static int tcp_prune_queue(struct sock *sk) + + tcp_collapse_ofo_queue(sk); + if (!skb_queue_empty(&sk->sk_receive_queue)) +- tcp_collapse(sk, &sk->sk_receive_queue, ++ tcp_collapse(sk, &sk->sk_receive_queue, NULL, + skb_peek(&sk->sk_receive_queue), + NULL, + tp->copied_seq, tp->rcv_nxt); +@@ -5000,7 +5091,7 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible) + /* We ACK each frame or... */ + tcp_in_quickack_mode(sk) || + /* We have out of order data. */ +- (ofo_possible && skb_peek(&tp->out_of_order_queue))) { ++ (ofo_possible && !RB_EMPTY_ROOT(&tp->out_of_order_queue))) { + /* Then ack it now */ + tcp_send_ack(sk); + } else { +@@ -5236,7 +5327,7 @@ syn_challenge: + return true; + + discard: +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + return false; + } + +@@ -5454,7 +5545,7 @@ csum_error: + TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS); + + discard: +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + } + EXPORT_SYMBOL(tcp_rcv_established); + +@@ -5684,7 +5775,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + TCP_DELACK_MAX, TCP_RTO_MAX); + + discard: +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + return 0; + } else { + tcp_send_ack(sk); +@@ -6041,7 +6132,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + + if (!queued) { + discard: +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + } + return 0; + } +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index eeda67c3dd11..ee8399f11fd0 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1716,6 +1716,7 @@ discard_it: + return 0; + + discard_and_relse: ++ sk_drops_add(sk, skb); + sock_put(sk); + goto discard_it; + +@@ -1829,7 +1830,7 @@ void tcp_v4_destroy_sock(struct sock *sk) + tcp_write_queue_purge(sk); + + /* Cleans up our, hopefully empty, out_of_order_queue. */ +- __skb_queue_purge(&tp->out_of_order_queue); ++ skb_rbtree_purge(&tp->out_of_order_queue); + + #ifdef CONFIG_TCP_MD5SIG + /* Clean up the MD5 key list, if any */ +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index d270870bf492..a48846d81b41 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -496,7 +496,6 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + newtp->snd_cwnd_cnt = 0; + + tcp_init_xmit_timers(newsk); +- __skb_queue_head_init(&newtp->out_of_order_queue); + newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1; + + newtp->rx_opt.saw_tstamp = 0; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 90abe88e1b40..d6c191158e07 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1505,6 +1505,7 @@ discard_it: + return 0; + + discard_and_relse: ++ sk_drops_add(sk, skb); + sock_put(sk); + goto discard_it; + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 1f930032253a..67348d8ac35d 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -219,7 +219,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, + case NL80211_IFTYPE_AP: + case NL80211_IFTYPE_AP_VLAN: + /* Keys without a station are used for TX only */ +- if (key->sta && test_sta_flag(key->sta, WLAN_STA_MFP)) ++ if (sta && test_sta_flag(sta, WLAN_STA_MFP)) + key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT; + break; + case NL80211_IFTYPE_ADHOC: diff --git a/patch/kernel/mvebu-default/04-patch-4.4.161-162.patch b/patch/kernel/mvebu-default/04-patch-4.4.161-162.patch new file mode 100644 index 000000000..d8efae3e3 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.161-162.patch @@ -0,0 +1,2111 @@ +diff --git a/Documentation/devicetree/bindings/net/macb.txt b/Documentation/devicetree/bindings/net/macb.txt +index b5d79761ac97..410c044166e2 100644 +--- a/Documentation/devicetree/bindings/net/macb.txt ++++ b/Documentation/devicetree/bindings/net/macb.txt +@@ -8,6 +8,7 @@ Required properties: + Use "cdns,pc302-gem" for Picochip picoXcell pc302 and later devices based on + the Cadence GEM, or the generic form: "cdns,gem". + Use "atmel,sama5d2-gem" for the GEM IP (10/100) available on Atmel sama5d2 SoCs. ++ Use "atmel,sama5d3-macb" for the 10/100Mbit IP available on Atmel sama5d3 SoCs. + Use "atmel,sama5d3-gem" for the Gigabit IP available on Atmel sama5d3 SoCs. + Use "atmel,sama5d4-gem" for the GEM IP (10/100) available on Atmel sama5d4 SoCs. + Use "cdns,zynqmp-gem" for Zynq Ultrascale+ MPSoC. +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 3fd53e193b7f..da515c535e62 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -961,11 +961,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + See Documentation/x86/intel_mpx.txt for more + information about the feature. + +- eagerfpu= [X86] +- on enable eager fpu restore +- off disable eager fpu restore +- auto selects the default scheme, which automatically +- enables eagerfpu restore for xsaveopt. + + module.async_probe [KNL] + Enable asynchronous probe on this module. +diff --git a/Makefile b/Makefile +index 57e4ff1a8b96..00ff2dd68ff1 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 161 ++SUBLEVEL = 162 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/Makefile b/arch/arc/Makefile +index b9f7306412e5..9d64eacdd2aa 100644 +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -18,20 +18,6 @@ cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ + cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 + cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs + +-is_700 = $(shell $(CC) -dM -E - < /dev/null | grep -q "ARC700" && echo 1 || echo 0) +- +-ifdef CONFIG_ISA_ARCOMPACT +-ifeq ($(is_700), 0) +- $(error Toolchain not configured for ARCompact builds) +-endif +-endif +- +-ifdef CONFIG_ISA_ARCV2 +-ifeq ($(is_700), 1) +- $(error Toolchain not configured for ARCv2 builds) +-endif +-endif +- + ifdef CONFIG_ARC_CURR_IN_REG + # For a global register defintion, make sure it gets passed to every file + # We had a customer reported bug where some code built in kernel was NOT using +diff --git a/arch/arm/boot/dts/sama5d3_emac.dtsi b/arch/arm/boot/dts/sama5d3_emac.dtsi +index 7cb235ef0fb6..6e9e1c2f9def 100644 +--- a/arch/arm/boot/dts/sama5d3_emac.dtsi ++++ b/arch/arm/boot/dts/sama5d3_emac.dtsi +@@ -41,7 +41,7 @@ + }; + + macb1: ethernet@f802c000 { +- compatible = "cdns,at91sam9260-macb", "cdns,macb"; ++ compatible = "atmel,sama5d3-macb", "cdns,at91sam9260-macb", "cdns,macb"; + reg = <0xf802c000 0x100>; + interrupts = <35 IRQ_TYPE_LEVEL_HIGH 3>; + pinctrl-names = "default"; +diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S +index b7019b559ddb..2d2860711e07 100644 +--- a/arch/powerpc/kernel/tm.S ++++ b/arch/powerpc/kernel/tm.S +@@ -199,13 +199,27 @@ dont_backup_fp: + std r1, PACATMSCRATCH(r13) + ld r1, PACAR1(r13) + +- /* Store the PPR in r11 and reset to decent value */ + std r11, GPR11(r1) /* Temporary stash */ + ++ /* ++ * Move the saved user r1 to the kernel stack in case PACATMSCRATCH is ++ * clobbered by an exception once we turn on MSR_RI below. ++ */ ++ ld r11, PACATMSCRATCH(r13) ++ std r11, GPR1(r1) ++ ++ /* ++ * Store r13 away so we can free up the scratch SPR for the SLB fault ++ * handler (needed once we start accessing the thread_struct). ++ */ ++ GET_SCRATCH0(r11) ++ std r11, GPR13(r1) ++ + /* Reset MSR RI so we can take SLB faults again */ + li r11, MSR_RI + mtmsrd r11, 1 + ++ /* Store the PPR in r11 and reset to decent value */ + mfspr r11, SPRN_PPR + HMT_MEDIUM + +@@ -230,11 +244,11 @@ dont_backup_fp: + SAVE_GPR(8, r7) /* user r8 */ + SAVE_GPR(9, r7) /* user r9 */ + SAVE_GPR(10, r7) /* user r10 */ +- ld r3, PACATMSCRATCH(r13) /* user r1 */ ++ ld r3, GPR1(r1) /* user r1 */ + ld r4, GPR7(r1) /* user r7 */ + ld r5, GPR11(r1) /* user r11 */ + ld r6, GPR12(r1) /* user r12 */ +- GET_SCRATCH0(8) /* user r13 */ ++ ld r8, GPR13(r1) /* user r13 */ + std r3, GPR1(r7) + std r4, GPR7(r7) + std r5, GPR11(r7) +diff --git a/arch/x86/crypto/crc32c-intel_glue.c b/arch/x86/crypto/crc32c-intel_glue.c +index 715399b14ed7..c194d5717ae5 100644 +--- a/arch/x86/crypto/crc32c-intel_glue.c ++++ b/arch/x86/crypto/crc32c-intel_glue.c +@@ -48,21 +48,13 @@ + #ifdef CONFIG_X86_64 + /* + * use carryless multiply version of crc32c when buffer +- * size is >= 512 (when eager fpu is enabled) or +- * >= 1024 (when eager fpu is disabled) to account ++ * size is >= 512 to account + * for fpu state save/restore overhead. + */ +-#define CRC32C_PCL_BREAKEVEN_EAGERFPU 512 +-#define CRC32C_PCL_BREAKEVEN_NOEAGERFPU 1024 ++#define CRC32C_PCL_BREAKEVEN 512 + + asmlinkage unsigned int crc_pcl(const u8 *buffer, int len, + unsigned int crc_init); +-static int crc32c_pcl_breakeven = CRC32C_PCL_BREAKEVEN_EAGERFPU; +-#define set_pcl_breakeven_point() \ +-do { \ +- if (!use_eager_fpu()) \ +- crc32c_pcl_breakeven = CRC32C_PCL_BREAKEVEN_NOEAGERFPU; \ +-} while (0) + #endif /* CONFIG_X86_64 */ + + static u32 crc32c_intel_le_hw_byte(u32 crc, unsigned char const *data, size_t length) +@@ -185,7 +177,7 @@ static int crc32c_pcl_intel_update(struct shash_desc *desc, const u8 *data, + * use faster PCL version if datasize is large enough to + * overcome kernel fpu state save/restore overhead + */ +- if (len >= crc32c_pcl_breakeven && irq_fpu_usable()) { ++ if (len >= CRC32C_PCL_BREAKEVEN && irq_fpu_usable()) { + kernel_fpu_begin(); + *crcp = crc_pcl(data, len, *crcp); + kernel_fpu_end(); +@@ -197,7 +189,7 @@ static int crc32c_pcl_intel_update(struct shash_desc *desc, const u8 *data, + static int __crc32c_pcl_intel_finup(u32 *crcp, const u8 *data, unsigned int len, + u8 *out) + { +- if (len >= crc32c_pcl_breakeven && irq_fpu_usable()) { ++ if (len >= CRC32C_PCL_BREAKEVEN && irq_fpu_usable()) { + kernel_fpu_begin(); + *(__le32 *)out = ~cpu_to_le32(crc_pcl(data, len, *crcp)); + kernel_fpu_end(); +@@ -256,7 +248,6 @@ static int __init crc32c_intel_mod_init(void) + alg.update = crc32c_pcl_intel_update; + alg.finup = crc32c_pcl_intel_finup; + alg.digest = crc32c_pcl_intel_digest; +- set_pcl_breakeven_point(); + } + #endif + return crypto_register_shash(&alg); +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index dd2269dcbc47..a5fa3195a230 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -104,7 +104,6 @@ + #define X86_FEATURE_EXTD_APICID ( 3*32+26) /* has extended APICID (8 bits) */ + #define X86_FEATURE_AMD_DCM ( 3*32+27) /* multi-node processor */ + #define X86_FEATURE_APERFMPERF ( 3*32+28) /* APERFMPERF */ +-/* free, was #define X86_FEATURE_EAGER_FPU ( 3*32+29) * "eagerfpu" Non lazy FPU restore */ + #define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ + + /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index ec2aedb6f92a..16825dda18dc 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -57,11 +57,6 @@ extern u64 fpu__get_supported_xfeatures_mask(void); + /* + * FPU related CPU feature flag helper routines: + */ +-static __always_inline __pure bool use_eager_fpu(void) +-{ +- return true; +-} +- + static __always_inline __pure bool use_xsaveopt(void) + { + return static_cpu_has(X86_FEATURE_XSAVEOPT); +@@ -498,24 +493,6 @@ static inline int fpu_want_lazy_restore(struct fpu *fpu, unsigned int cpu) + } + + +-/* +- * Wrap lazy FPU TS handling in a 'hw fpregs activation/deactivation' +- * idiom, which is then paired with the sw-flag (fpregs_active) later on: +- */ +- +-static inline void __fpregs_activate_hw(void) +-{ +- if (!use_eager_fpu()) +- clts(); +-} +- +-static inline void __fpregs_deactivate_hw(void) +-{ +- if (!use_eager_fpu()) +- stts(); +-} +- +-/* Must be paired with an 'stts' (fpregs_deactivate_hw()) after! */ + static inline void __fpregs_deactivate(struct fpu *fpu) + { + WARN_ON_FPU(!fpu->fpregs_active); +@@ -524,7 +501,6 @@ static inline void __fpregs_deactivate(struct fpu *fpu) + this_cpu_write(fpu_fpregs_owner_ctx, NULL); + } + +-/* Must be paired with a 'clts' (fpregs_activate_hw()) before! */ + static inline void __fpregs_activate(struct fpu *fpu) + { + WARN_ON_FPU(fpu->fpregs_active); +@@ -549,22 +525,17 @@ static inline int fpregs_active(void) + } + + /* +- * Encapsulate the CR0.TS handling together with the +- * software flag. +- * + * These generally need preemption protection to work, + * do try to avoid using these on their own. + */ + static inline void fpregs_activate(struct fpu *fpu) + { +- __fpregs_activate_hw(); + __fpregs_activate(fpu); + } + + static inline void fpregs_deactivate(struct fpu *fpu) + { + __fpregs_deactivate(fpu); +- __fpregs_deactivate_hw(); + } + + /* +@@ -591,8 +562,7 @@ switch_fpu_prepare(struct fpu *old_fpu, struct fpu *new_fpu, int cpu) + * or if the past 5 consecutive context-switches used math. + */ + fpu.preload = static_cpu_has(X86_FEATURE_FPU) && +- new_fpu->fpstate_active && +- (use_eager_fpu() || new_fpu->counter > 5); ++ new_fpu->fpstate_active; + + if (old_fpu->fpregs_active) { + if (!copy_fpregs_to_fpstate(old_fpu)) +@@ -605,17 +575,12 @@ switch_fpu_prepare(struct fpu *old_fpu, struct fpu *new_fpu, int cpu) + + /* Don't change CR0.TS if we just switch! */ + if (fpu.preload) { +- new_fpu->counter++; + __fpregs_activate(new_fpu); + prefetch(&new_fpu->state); +- } else { +- __fpregs_deactivate_hw(); + } + } else { +- old_fpu->counter = 0; + old_fpu->last_cpu = -1; + if (fpu.preload) { +- new_fpu->counter++; + if (fpu_want_lazy_restore(new_fpu, cpu)) + fpu.preload = 0; + else +diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h +index 1c6f6ac52ad0..0d81c7d6fe96 100644 +--- a/arch/x86/include/asm/fpu/types.h ++++ b/arch/x86/include/asm/fpu/types.h +@@ -302,17 +302,6 @@ struct fpu { + */ + unsigned char fpregs_active; + +- /* +- * @counter: +- * +- * This counter contains the number of consecutive context switches +- * during which the FPU stays used. If this is over a threshold, the +- * lazy FPU restore logic becomes eager, to save the trap overhead. +- * This is an unsigned char so that after 256 iterations the counter +- * wraps and the context switch behavior turns lazy again; this is to +- * deal with bursty apps that only use the FPU for a short time: +- */ +- unsigned char counter; + /* + * @state: + * +@@ -321,29 +310,6 @@ struct fpu { + * the registers in the FPU are more recent than this state + * copy. If the task context-switches away then they get + * saved here and represent the FPU state. +- * +- * After context switches there may be a (short) time period +- * during which the in-FPU hardware registers are unchanged +- * and still perfectly match this state, if the tasks +- * scheduled afterwards are not using the FPU. +- * +- * This is the 'lazy restore' window of optimization, which +- * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'. +- * +- * We detect whether a subsequent task uses the FPU via setting +- * CR0::TS to 1, which causes any FPU use to raise a #NM fault. +- * +- * During this window, if the task gets scheduled again, we +- * might be able to skip having to do a restore from this +- * memory buffer to the hardware registers - at the cost of +- * incurring the overhead of #NM fault traps. +- * +- * Note that on modern CPUs that support the XSAVEOPT (or other +- * optimized XSAVE instructions), we don't use #NM traps anymore, +- * as the hardware can track whether FPU registers need saving +- * or not. On such CPUs we activate the non-lazy ('eagerfpu') +- * logic, which unconditionally saves/restores all FPU state +- * across context switches. (if FPU state exists.) + */ + union fpregs_state state; + /* +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 74fda1a453bd..3a37cdbdfbaa 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -439,7 +439,6 @@ struct kvm_vcpu_arch { + struct kvm_mmu_memory_cache mmu_page_header_cache; + + struct fpu guest_fpu; +- bool eager_fpu; + u64 xcr0; + u64 guest_supported_xcr0; + u32 guest_xstate_size; +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index 6aa0b519c851..b322325424bc 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -53,27 +53,9 @@ static bool kernel_fpu_disabled(void) + return this_cpu_read(in_kernel_fpu); + } + +-/* +- * Were we in an interrupt that interrupted kernel mode? +- * +- * On others, we can do a kernel_fpu_begin/end() pair *ONLY* if that +- * pair does nothing at all: the thread must not have fpu (so +- * that we don't try to save the FPU state), and TS must +- * be set (so that the clts/stts pair does nothing that is +- * visible in the interrupted kernel thread). +- * +- * Except for the eagerfpu case when we return true; in the likely case +- * the thread has FPU but we are not going to set/clear TS. +- */ + static bool interrupted_kernel_fpu_idle(void) + { +- if (kernel_fpu_disabled()) +- return false; +- +- if (use_eager_fpu()) +- return true; +- +- return !current->thread.fpu.fpregs_active && (read_cr0() & X86_CR0_TS); ++ return !kernel_fpu_disabled(); + } + + /* +@@ -121,7 +103,6 @@ void __kernel_fpu_begin(void) + copy_fpregs_to_fpstate(fpu); + } else { + this_cpu_write(fpu_fpregs_owner_ctx, NULL); +- __fpregs_activate_hw(); + } + } + EXPORT_SYMBOL(__kernel_fpu_begin); +@@ -132,8 +113,6 @@ void __kernel_fpu_end(void) + + if (fpu->fpregs_active) + copy_kernel_to_fpregs(&fpu->state); +- else +- __fpregs_deactivate_hw(); + + kernel_fpu_enable(); + } +@@ -194,10 +173,7 @@ void fpu__save(struct fpu *fpu) + preempt_disable(); + if (fpu->fpregs_active) { + if (!copy_fpregs_to_fpstate(fpu)) { +- if (use_eager_fpu()) +- copy_kernel_to_fpregs(&fpu->state); +- else +- fpregs_deactivate(fpu); ++ copy_kernel_to_fpregs(&fpu->state); + } + } + preempt_enable(); +@@ -245,8 +221,7 @@ static void fpu_copy(struct fpu *dst_fpu, struct fpu *src_fpu) + * Don't let 'init optimized' areas of the XSAVE area + * leak into the child task: + */ +- if (use_eager_fpu()) +- memset(&dst_fpu->state.xsave, 0, xstate_size); ++ memset(&dst_fpu->state.xsave, 0, xstate_size); + + /* + * Save current FPU registers directly into the child +@@ -268,17 +243,13 @@ static void fpu_copy(struct fpu *dst_fpu, struct fpu *src_fpu) + if (!copy_fpregs_to_fpstate(dst_fpu)) { + memcpy(&src_fpu->state, &dst_fpu->state, xstate_size); + +- if (use_eager_fpu()) +- copy_kernel_to_fpregs(&src_fpu->state); +- else +- fpregs_deactivate(src_fpu); ++ copy_kernel_to_fpregs(&src_fpu->state); + } + preempt_enable(); + } + + int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu) + { +- dst_fpu->counter = 0; + dst_fpu->fpregs_active = 0; + dst_fpu->last_cpu = -1; + +@@ -381,7 +352,6 @@ void fpu__restore(struct fpu *fpu) + kernel_fpu_disable(); + fpregs_activate(fpu); + copy_kernel_to_fpregs(&fpu->state); +- fpu->counter++; + kernel_fpu_enable(); + } + EXPORT_SYMBOL_GPL(fpu__restore); +@@ -398,7 +368,6 @@ EXPORT_SYMBOL_GPL(fpu__restore); + void fpu__drop(struct fpu *fpu) + { + preempt_disable(); +- fpu->counter = 0; + + if (fpu->fpregs_active) { + /* Ignore delayed exceptions from user space */ +@@ -437,7 +406,7 @@ void fpu__clear(struct fpu *fpu) + { + WARN_ON_FPU(fpu != ¤t->thread.fpu); /* Almost certainly an anomaly */ + +- if (!use_eager_fpu() || !static_cpu_has(X86_FEATURE_FPU)) { ++ if (!static_cpu_has(X86_FEATURE_FPU)) { + /* FPU state will be reallocated lazily at the first use. */ + fpu__drop(fpu); + } else { +diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c +index 3de077116218..9be3e79eb629 100644 +--- a/arch/x86/kernel/fpu/signal.c ++++ b/arch/x86/kernel/fpu/signal.c +@@ -319,11 +319,9 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) + } + + fpu->fpstate_active = 1; +- if (use_eager_fpu()) { +- preempt_disable(); +- fpu__restore(fpu); +- preempt_enable(); +- } ++ preempt_disable(); ++ fpu__restore(fpu); ++ preempt_enable(); + + return err; + } else { +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 83d6369c45f5..338d13d4fd2f 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include /* For use_eager_fpu. Ugh! */ + #include + #include + #include "cpuid.h" +@@ -104,9 +103,7 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu) + if (best && (best->eax & (F(XSAVES) | F(XSAVEC)))) + best->ebx = xstate_required_size(vcpu->arch.xcr0, true); + +- vcpu->arch.eager_fpu = use_eager_fpu(); +- if (vcpu->arch.eager_fpu) +- kvm_x86_ops->fpu_activate(vcpu); ++ kvm_x86_ops->fpu_activate(vcpu); + + /* + * The existing code assumes virtual address is 48-bit in the canonical +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 53d43d22a84b..e6ab034f0bc7 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7319,16 +7319,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) + copy_fpregs_to_fpstate(&vcpu->arch.guest_fpu); + __kernel_fpu_end(); + ++vcpu->stat.fpu_reload; +- /* +- * If using eager FPU mode, or if the guest is a frequent user +- * of the FPU, just leave the FPU active for next time. +- * Every 255 times fpu_counter rolls over to 0; a guest that uses +- * the FPU in bursts will revert to loading it on demand. +- */ +- if (!vcpu->arch.eager_fpu) { +- if (++vcpu->fpu_counter < 5) +- kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu); +- } + trace_kvm_fpu(0); + } + +diff --git a/drivers/clocksource/timer-ti-32k.c b/drivers/clocksource/timer-ti-32k.c +index 8518d9dfba5c..73c990867c01 100644 +--- a/drivers/clocksource/timer-ti-32k.c ++++ b/drivers/clocksource/timer-ti-32k.c +@@ -98,6 +98,9 @@ static void __init ti_32k_timer_init(struct device_node *np) + return; + } + ++ if (!of_machine_is_compatible("ti,am43")) ++ ti_32k_timer.cs.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP; ++ + ti_32k_timer.counter = ti_32k_timer.base; + + /* +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c +index b233cf8436b0..2e1e84c98034 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c +@@ -504,7 +504,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd, + + while (true) { + temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS); +- if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT) ++ if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK) + break; + if (timeout == 0) + return -ETIME; +diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c +index 12dcbd8226f2..2cce48d9e903 100644 +--- a/drivers/hv/hv_fcopy.c ++++ b/drivers/hv/hv_fcopy.c +@@ -256,7 +256,6 @@ void hv_fcopy_onchannelcallback(void *context) + */ + + fcopy_transaction.recv_len = recvlen; +- fcopy_transaction.recv_channel = channel; + fcopy_transaction.recv_req_id = requestid; + fcopy_transaction.fcopy_msg = fcopy_msg; + +@@ -323,6 +322,7 @@ static void fcopy_on_reset(void) + int hv_fcopy_init(struct hv_util_service *srv) + { + recv_buffer = srv->recv_buffer; ++ fcopy_transaction.recv_channel = srv->channel; + + init_completion(&release_event); + /* +diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c +index ce4d3a935491..1771a968c3f2 100644 +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -78,9 +78,11 @@ static void kvp_send_key(struct work_struct *dummy); + + static void kvp_respond_to_host(struct hv_kvp_msg *msg, int error); + static void kvp_timeout_func(struct work_struct *dummy); ++static void kvp_host_handshake_func(struct work_struct *dummy); + static void kvp_register(int); + + static DECLARE_DELAYED_WORK(kvp_timeout_work, kvp_timeout_func); ++static DECLARE_DELAYED_WORK(kvp_host_handshake_work, kvp_host_handshake_func); + static DECLARE_WORK(kvp_sendkey_work, kvp_send_key); + + static const char kvp_devname[] = "vmbus/hv_kvp"; +@@ -131,6 +133,11 @@ static void kvp_timeout_func(struct work_struct *dummy) + hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); + } + ++static void kvp_host_handshake_func(struct work_struct *dummy) ++{ ++ hv_poll_channel(kvp_transaction.recv_channel, hv_kvp_onchannelcallback); ++} ++ + static int kvp_handle_handshake(struct hv_kvp_msg *msg) + { + switch (msg->kvp_hdr.operation) { +@@ -155,7 +162,13 @@ static int kvp_handle_handshake(struct hv_kvp_msg *msg) + pr_debug("KVP: userspace daemon ver. %d registered\n", + KVP_OP_REGISTER); + kvp_register(dm_reg_value); +- kvp_transaction.state = HVUTIL_READY; ++ ++ /* ++ * If we're still negotiating with the host cancel the timeout ++ * work to not poll the channel twice. ++ */ ++ cancel_delayed_work_sync(&kvp_host_handshake_work); ++ hv_poll_channel(kvp_transaction.recv_channel, kvp_poll_wrapper); + + return 0; + } +@@ -595,10 +608,26 @@ void hv_kvp_onchannelcallback(void *context) + struct icmsg_negotiate *negop = NULL; + int util_fw_version; + int kvp_srv_version; ++ static enum {NEGO_NOT_STARTED, ++ NEGO_IN_PROGRESS, ++ NEGO_FINISHED} host_negotiatied = NEGO_NOT_STARTED; + ++ if (kvp_transaction.state < HVUTIL_READY) { ++ /* ++ * If userspace daemon is not connected and host is asking ++ * us to negotiate we need to delay to not lose messages. ++ * This is important for Failover IP setting. ++ */ ++ if (host_negotiatied == NEGO_NOT_STARTED) { ++ host_negotiatied = NEGO_IN_PROGRESS; ++ schedule_delayed_work(&kvp_host_handshake_work, ++ HV_UTIL_NEGO_TIMEOUT * HZ); ++ } ++ return; ++ } + if (kvp_transaction.state > HVUTIL_READY) + return; +- ++recheck: + vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, + &requestid); + +@@ -640,7 +669,6 @@ void hv_kvp_onchannelcallback(void *context) + */ + + kvp_transaction.recv_len = recvlen; +- kvp_transaction.recv_channel = channel; + kvp_transaction.recv_req_id = requestid; + kvp_transaction.kvp_msg = kvp_msg; + +@@ -674,6 +702,10 @@ void hv_kvp_onchannelcallback(void *context) + vmbus_sendpacket(channel, recv_buffer, + recvlen, requestid, + VM_PKT_DATA_INBAND, 0); ++ ++ host_negotiatied = NEGO_FINISHED; ++ ++ goto recheck; + } + + } +@@ -690,6 +722,7 @@ int + hv_kvp_init(struct hv_util_service *srv) + { + recv_buffer = srv->recv_buffer; ++ kvp_transaction.recv_channel = srv->channel; + + init_completion(&release_event); + /* +@@ -711,6 +744,7 @@ hv_kvp_init(struct hv_util_service *srv) + void hv_kvp_deinit(void) + { + kvp_transaction.state = HVUTIL_DEVICE_DYING; ++ cancel_delayed_work_sync(&kvp_host_handshake_work); + cancel_delayed_work_sync(&kvp_timeout_work); + cancel_work_sync(&kvp_sendkey_work); + hvutil_transport_destroy(hvt); +diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c +index faad79ae318a..b0feddb17170 100644 +--- a/drivers/hv/hv_snapshot.c ++++ b/drivers/hv/hv_snapshot.c +@@ -114,7 +114,7 @@ static int vss_handle_handshake(struct hv_vss_msg *vss_msg) + default: + return -EINVAL; + } +- vss_transaction.state = HVUTIL_READY; ++ hv_poll_channel(vss_transaction.recv_channel, vss_poll_wrapper); + pr_debug("VSS: userspace daemon ver. %d registered\n", dm_reg_value); + return 0; + } +@@ -264,7 +264,6 @@ void hv_vss_onchannelcallback(void *context) + */ + + vss_transaction.recv_len = recvlen; +- vss_transaction.recv_channel = channel; + vss_transaction.recv_req_id = requestid; + vss_transaction.msg = (struct hv_vss_msg *)vss_msg; + +@@ -340,6 +339,7 @@ hv_vss_init(struct hv_util_service *srv) + return -ENOTSUPP; + } + recv_buffer = srv->recv_buffer; ++ vss_transaction.recv_channel = srv->channel; + + /* + * When this driver loads, the user level daemon that +diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c +index 41f5896224bd..9dc63725363d 100644 +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -326,6 +326,7 @@ static int util_probe(struct hv_device *dev, + srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL); + if (!srv->recv_buffer) + return -ENOMEM; ++ srv->channel = dev->channel; + if (srv->util_init) { + ret = srv->util_init(srv); + if (ret) { +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 75e383e6d03d..15e06493c53a 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -35,6 +35,11 @@ + */ + #define HV_UTIL_TIMEOUT 30 + ++/* ++ * Timeout for guest-host handshake for services. ++ */ ++#define HV_UTIL_NEGO_TIMEOUT 60 ++ + /* + * The below CPUID leaves are present if VersionAndFeatures.HypervisorPresent + * is set by CPUID(HVCPUID_VERSION_FEATURES). +diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c +index 7aa7b9cb6203..efefcfa24a4c 100644 +--- a/drivers/i2c/busses/i2c-scmi.c ++++ b/drivers/i2c/busses/i2c-scmi.c +@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, + mt_params[3].type = ACPI_TYPE_INTEGER; + mt_params[3].integer.value = len; + mt_params[4].type = ACPI_TYPE_BUFFER; ++ mt_params[4].buffer.length = len; + mt_params[4].buffer.pointer = data->block + 1; + } + break; +diff --git a/drivers/input/keyboard/atakbd.c b/drivers/input/keyboard/atakbd.c +index f1235831283d..fdeda0b0fbd6 100644 +--- a/drivers/input/keyboard/atakbd.c ++++ b/drivers/input/keyboard/atakbd.c +@@ -79,8 +79,7 @@ MODULE_LICENSE("GPL"); + */ + + +-static unsigned char atakbd_keycode[0x72] = { /* American layout */ +- [0] = KEY_GRAVE, ++static unsigned char atakbd_keycode[0x73] = { /* American layout */ + [1] = KEY_ESC, + [2] = KEY_1, + [3] = KEY_2, +@@ -121,9 +120,9 @@ static unsigned char atakbd_keycode[0x72] = { /* American layout */ + [38] = KEY_L, + [39] = KEY_SEMICOLON, + [40] = KEY_APOSTROPHE, +- [41] = KEY_BACKSLASH, /* FIXME, '#' */ ++ [41] = KEY_GRAVE, + [42] = KEY_LEFTSHIFT, +- [43] = KEY_GRAVE, /* FIXME: '~' */ ++ [43] = KEY_BACKSLASH, + [44] = KEY_Z, + [45] = KEY_X, + [46] = KEY_C, +@@ -149,45 +148,34 @@ static unsigned char atakbd_keycode[0x72] = { /* American layout */ + [66] = KEY_F8, + [67] = KEY_F9, + [68] = KEY_F10, +- [69] = KEY_ESC, +- [70] = KEY_DELETE, +- [71] = KEY_KP7, +- [72] = KEY_KP8, +- [73] = KEY_KP9, ++ [71] = KEY_HOME, ++ [72] = KEY_UP, + [74] = KEY_KPMINUS, +- [75] = KEY_KP4, +- [76] = KEY_KP5, +- [77] = KEY_KP6, ++ [75] = KEY_LEFT, ++ [77] = KEY_RIGHT, + [78] = KEY_KPPLUS, +- [79] = KEY_KP1, +- [80] = KEY_KP2, +- [81] = KEY_KP3, +- [82] = KEY_KP0, +- [83] = KEY_KPDOT, +- [90] = KEY_KPLEFTPAREN, +- [91] = KEY_KPRIGHTPAREN, +- [92] = KEY_KPASTERISK, /* FIXME */ +- [93] = KEY_KPASTERISK, +- [94] = KEY_KPPLUS, +- [95] = KEY_HELP, ++ [80] = KEY_DOWN, ++ [82] = KEY_INSERT, ++ [83] = KEY_DELETE, + [96] = KEY_102ND, +- [97] = KEY_KPASTERISK, /* FIXME */ +- [98] = KEY_KPSLASH, ++ [97] = KEY_UNDO, ++ [98] = KEY_HELP, + [99] = KEY_KPLEFTPAREN, + [100] = KEY_KPRIGHTPAREN, + [101] = KEY_KPSLASH, + [102] = KEY_KPASTERISK, +- [103] = KEY_UP, +- [104] = KEY_KPASTERISK, /* FIXME */ +- [105] = KEY_LEFT, +- [106] = KEY_RIGHT, +- [107] = KEY_KPASTERISK, /* FIXME */ +- [108] = KEY_DOWN, +- [109] = KEY_KPASTERISK, /* FIXME */ +- [110] = KEY_KPASTERISK, /* FIXME */ +- [111] = KEY_KPASTERISK, /* FIXME */ +- [112] = KEY_KPASTERISK, /* FIXME */ +- [113] = KEY_KPASTERISK /* FIXME */ ++ [103] = KEY_KP7, ++ [104] = KEY_KP8, ++ [105] = KEY_KP9, ++ [106] = KEY_KP4, ++ [107] = KEY_KP5, ++ [108] = KEY_KP6, ++ [109] = KEY_KP1, ++ [110] = KEY_KP2, ++ [111] = KEY_KP3, ++ [112] = KEY_KP0, ++ [113] = KEY_KPDOT, ++ [114] = KEY_KPENTER, + }; + + static struct input_dev *atakbd_dev; +@@ -195,21 +183,15 @@ static struct input_dev *atakbd_dev; + static void atakbd_interrupt(unsigned char scancode, char down) + { + +- if (scancode < 0x72) { /* scancodes < 0xf2 are keys */ ++ if (scancode < 0x73) { /* scancodes < 0xf3 are keys */ + + // report raw events here? + + scancode = atakbd_keycode[scancode]; + +- if (scancode == KEY_CAPSLOCK) { /* CapsLock is a toggle switch key on Amiga */ +- input_report_key(atakbd_dev, scancode, 1); +- input_report_key(atakbd_dev, scancode, 0); +- input_sync(atakbd_dev); +- } else { +- input_report_key(atakbd_dev, scancode, down); +- input_sync(atakbd_dev); +- } +- } else /* scancodes >= 0xf2 are mouse data, most likely */ ++ input_report_key(atakbd_dev, scancode, down); ++ input_sync(atakbd_dev); ++ } else /* scancodes >= 0xf3 are mouse data, most likely */ + printk(KERN_INFO "atakbd: unhandled scancode %x\n", scancode); + + return; +diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c +index 6e02a15d39ce..abddb621d9e6 100644 +--- a/drivers/media/usb/dvb-usb-v2/af9035.c ++++ b/drivers/media/usb/dvb-usb-v2/af9035.c +@@ -389,8 +389,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, + msg[0].addr == (state->af9033_i2c_addr[1] >> 1)) + reg |= 0x100000; + +- ret = af9035_wr_regs(d, reg, &msg[0].buf[3], +- msg[0].len - 3); ++ ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg, ++ &msg[0].buf[3], ++ msg[0].len - 3) ++ : -EOPNOTSUPP; + } else { + /* I2C write */ + u8 buf[MAX_XFER_SIZE]; +diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c +index 1d924d1533c0..b9dc2fcd8f26 100644 +--- a/drivers/mfd/omap-usb-host.c ++++ b/drivers/mfd/omap-usb-host.c +@@ -548,8 +548,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev, + } + + static const struct of_device_id usbhs_child_match_table[] = { +- { .compatible = "ti,omap-ehci", }, +- { .compatible = "ti,omap-ohci", }, ++ { .compatible = "ti,ehci-omap", }, ++ { .compatible = "ti,ohci-omap3", }, + { } + }; + +@@ -875,6 +875,7 @@ static struct platform_driver usbhs_omap_driver = { + .pm = &usbhsomap_dev_pm_ops, + .of_match_table = usbhs_omap_dt_ids, + }, ++ .probe = usbhs_omap_probe, + .remove = usbhs_omap_remove, + }; + +@@ -884,9 +885,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI"); + +-static int __init omap_usbhs_drvinit(void) ++static int omap_usbhs_drvinit(void) + { +- return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe); ++ return platform_driver_register(&usbhs_omap_driver); + } + + /* +@@ -898,7 +899,7 @@ static int __init omap_usbhs_drvinit(void) + */ + fs_initcall_sync(omap_usbhs_drvinit); + +-static void __exit omap_usbhs_drvexit(void) ++static void omap_usbhs_drvexit(void) + { + platform_driver_unregister(&usbhs_omap_driver); + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 339118f3c718..78da1b7b4d86 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -216,6 +216,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, + static void bond_slave_arr_handler(struct work_struct *work); + static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act, + int mod); ++static void bond_netdev_notify_work(struct work_struct *work); + + /*---------------------------- General routines -----------------------------*/ + +@@ -1237,6 +1238,8 @@ static struct slave *bond_alloc_slave(struct bonding *bond) + return NULL; + } + } ++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); ++ + return slave; + } + +@@ -1244,6 +1247,7 @@ static void bond_free_slave(struct slave *slave) + { + struct bonding *bond = bond_get_bond_by_slave(slave); + ++ cancel_delayed_work_sync(&slave->notify_work); + if (BOND_MODE(bond) == BOND_MODE_8023AD) + kfree(SLAVE_AD_INFO(slave)); + +@@ -1265,39 +1269,26 @@ static void bond_fill_ifslave(struct slave *slave, struct ifslave *info) + info->link_failure_count = slave->link_failure_count; + } + +-static void bond_netdev_notify(struct net_device *dev, +- struct netdev_bonding_info *info) +-{ +- rtnl_lock(); +- netdev_bonding_info_change(dev, info); +- rtnl_unlock(); +-} +- + static void bond_netdev_notify_work(struct work_struct *_work) + { +- struct netdev_notify_work *w = +- container_of(_work, struct netdev_notify_work, work.work); ++ struct slave *slave = container_of(_work, struct slave, ++ notify_work.work); ++ ++ if (rtnl_trylock()) { ++ struct netdev_bonding_info binfo; + +- bond_netdev_notify(w->dev, &w->bonding_info); +- dev_put(w->dev); +- kfree(w); ++ bond_fill_ifslave(slave, &binfo.slave); ++ bond_fill_ifbond(slave->bond, &binfo.master); ++ netdev_bonding_info_change(slave->dev, &binfo); ++ rtnl_unlock(); ++ } else { ++ queue_delayed_work(slave->bond->wq, &slave->notify_work, 1); ++ } + } + + void bond_queue_slave_event(struct slave *slave) + { +- struct bonding *bond = slave->bond; +- struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC); +- +- if (!nnw) +- return; +- +- dev_hold(slave->dev); +- nnw->dev = slave->dev; +- bond_fill_ifslave(slave, &nnw->bonding_info.slave); +- bond_fill_ifbond(bond, &nnw->bonding_info.master); +- INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work); +- +- queue_delayed_work(slave->bond->wq, &nnw->work, 0); ++ queue_delayed_work(slave->bond->wq, &slave->notify_work, 0); + } + + /* enslave device to bond device */ +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index af9ec57bbebf..7a6dd5e5e498 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -850,14 +850,22 @@ static void bcm_sysport_resume_from_wol(struct bcm_sysport_priv *priv) + { + u32 reg; + +- /* Stop monitoring MPD interrupt */ +- intrl2_0_mask_set(priv, INTRL2_0_MPD); +- + /* Clear the MagicPacket detection logic */ + reg = umac_readl(priv, UMAC_MPD_CTRL); + reg &= ~MPD_EN; + umac_writel(priv, reg, UMAC_MPD_CTRL); + ++ reg = intrl2_0_readl(priv, INTRL2_CPU_STATUS); ++ if (reg & INTRL2_0_MPD) ++ netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n"); ++ ++ if (reg & INTRL2_0_BRCM_MATCH_TAG) { ++ reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) & ++ RXCHK_BRCM_TAG_MATCH_MASK; ++ netdev_info(priv->netdev, ++ "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg); ++ } ++ + netif_dbg(priv, wol, priv->netdev, "resumed from WOL\n"); + } + +@@ -890,11 +898,6 @@ static irqreturn_t bcm_sysport_rx_isr(int irq, void *dev_id) + if (priv->irq0_stat & INTRL2_0_TX_RING_FULL) + bcm_sysport_tx_reclaim_all(priv); + +- if (priv->irq0_stat & INTRL2_0_MPD) { +- netdev_info(priv->netdev, "Wake-on-LAN interrupt!\n"); +- bcm_sysport_resume_from_wol(priv); +- } +- + return IRQ_HANDLED; + } + +@@ -1915,9 +1918,6 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) + /* UniMAC receive needs to be turned on */ + umac_enable_set(priv, CMD_RX_EN, 1); + +- /* Enable the interrupt wake-up source */ +- intrl2_0_mask_clear(priv, INTRL2_0_MPD); +- + netif_dbg(priv, wol, ndev, "entered WOL mode\n"); + + return 0; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 4ffacafddacb..fea8116da06a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1343,8 +1343,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { + tx_pkts++; + /* return full budget so NAPI will complete. */ +- if (unlikely(tx_pkts > bp->tx_wake_thresh)) ++ if (unlikely(tx_pkts > bp->tx_wake_thresh)) { + rx_pkts = budget; ++ raw_cons = NEXT_RAW_CMP(raw_cons); ++ break; ++ } + } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { + rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &agg_event); + if (likely(rc >= 0)) +@@ -1362,7 +1365,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) + } + raw_cons = NEXT_RAW_CMP(raw_cons); + +- if (rx_pkts == budget) ++ if (rx_pkts && rx_pkts == budget) + break; + } + +@@ -1404,8 +1407,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget) + while (1) { + work_done += bnxt_poll_work(bp, bnapi, budget - work_done); + +- if (work_done >= budget) ++ if (work_done >= budget) { ++ if (!budget) ++ BNXT_CP_DB_REARM(cpr->cp_doorbell, ++ cpr->cp_raw_cons); + break; ++ } + + if (!bnxt_has_work(bp, cpr)) { + napi_complete(napi); +diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c +index 8c698d464716..085f77f273ba 100644 +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -2743,6 +2743,13 @@ static const struct macb_config at91sam9260_config = { + .init = macb_init, + }; + ++static const struct macb_config sama5d3macb_config = { ++ .caps = MACB_CAPS_SG_DISABLED ++ | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, ++ .clk_init = macb_clk_init, ++ .init = macb_init, ++}; ++ + static const struct macb_config pc302gem_config = { + .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE, + .dma_burst_length = 16, +@@ -2801,6 +2808,7 @@ static const struct of_device_id macb_dt_ids[] = { + { .compatible = "cdns,gem", .data = &pc302gem_config }, + { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config }, + { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config }, ++ { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config }, + { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config }, + { .compatible = "cdns,at91rm9200-emac", .data = &emac_config }, + { .compatible = "cdns,emac", .data = &emac_config }, +diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c +index ac92685dd4e5..42305f3234ff 100644 +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -4268,7 +4269,7 @@ static void mvpp2_txq_desc_put(struct mvpp2_tx_queue *txq) + } + + /* Set Tx descriptors fields relevant for CSUM calculation */ +-static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto, ++static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto, + int ip_hdr_len, int l4_proto) + { + u32 command; +@@ -5032,14 +5033,15 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) + if (skb->ip_summed == CHECKSUM_PARTIAL) { + int ip_hdr_len = 0; + u8 l4_proto; ++ __be16 l3_proto = vlan_get_protocol(skb); + +- if (skb->protocol == htons(ETH_P_IP)) { ++ if (l3_proto == htons(ETH_P_IP)) { + struct iphdr *ip4h = ip_hdr(skb); + + /* Calculate IPv4 checksum and L4 checksum */ + ip_hdr_len = ip4h->ihl; + l4_proto = ip4h->protocol; +- } else if (skb->protocol == htons(ETH_P_IPV6)) { ++ } else if (l3_proto == htons(ETH_P_IPV6)) { + struct ipv6hdr *ip6h = ipv6_hdr(skb); + + /* Read l4_protocol from one of IPv6 extra headers */ +@@ -5051,7 +5053,7 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) + } + + return mvpp2_txq_desc_csum(skb_network_offset(skb), +- skb->protocol, ip_hdr_len, l4_proto); ++ l3_proto, ip_hdr_len, l4_proto); + } + + return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE; +diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c +index ff77b8b608bd..7417605c3cf6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c +@@ -228,7 +228,8 @@ static void mlx4_set_eq_affinity_hint(struct mlx4_priv *priv, int vec) + struct mlx4_dev *dev = &priv->dev; + struct mlx4_eq *eq = &priv->eq_table.eq[vec]; + +- if (!eq->affinity_mask || cpumask_empty(eq->affinity_mask)) ++ if (!cpumask_available(eq->affinity_mask) || ++ cpumask_empty(eq->affinity_mask)) + return; + + hint_err = irq_set_affinity_hint(eq->irq, eq->affinity_mask); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +index 55007f1e6bbc..12cd8aef1881 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +@@ -1802,7 +1802,8 @@ struct qlcnic_hardware_ops { + int (*config_loopback) (struct qlcnic_adapter *, u8); + int (*clear_loopback) (struct qlcnic_adapter *, u8); + int (*config_promisc_mode) (struct qlcnic_adapter *, u32); +- void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16); ++ void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr, ++ u16 vlan, struct qlcnic_host_tx_ring *tx_ring); + int (*get_board_info) (struct qlcnic_adapter *); + void (*set_mac_filter_count) (struct qlcnic_adapter *); + void (*free_mac_list) (struct qlcnic_adapter *); +@@ -2044,9 +2045,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, + } + + static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter, +- u64 *addr, u16 id) ++ u64 *addr, u16 vlan, ++ struct qlcnic_host_tx_ring *tx_ring) + { +- adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id); ++ adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring); + } + + static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index b4f3cb55605e..7f7aea9758e7 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -2132,7 +2132,8 @@ out: + } + + void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, +- u16 vlan_id) ++ u16 vlan_id, ++ struct qlcnic_host_tx_ring *tx_ring) + { + u8 mac[ETH_ALEN]; + memcpy(&mac, addr, ETH_ALEN); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h +index 331ae2c20f40..c8e012b3f7e7 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h +@@ -550,7 +550,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32); + int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32); + int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int); + int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int); +-void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16); ++void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, ++ u16 vlan, struct qlcnic_host_tx_ring *ring); + int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *); + int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *); + void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h +index 4bb33af8e2b3..56a3bd9e37dc 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h +@@ -173,7 +173,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter, + struct net_device *netdev); + void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *); + void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, +- u64 *uaddr, u16 vlan_id); ++ u64 *uaddr, u16 vlan_id, ++ struct qlcnic_host_tx_ring *tx_ring); + int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *, + struct ethtool_coalesce *); + int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +index d4b5085a21fa..98042a3701b5 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +@@ -269,13 +269,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, + } + + void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, +- u16 vlan_id) ++ u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring) + { + struct cmd_desc_type0 *hwdesc; + struct qlcnic_nic_req *req; + struct qlcnic_mac_req *mac_req; + struct qlcnic_vlan_req *vlan_req; +- struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring; + u32 producer; + u64 word; + +@@ -302,7 +301,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, + + static void qlcnic_send_filter(struct qlcnic_adapter *adapter, + struct cmd_desc_type0 *first_desc, +- struct sk_buff *skb) ++ struct sk_buff *skb, ++ struct qlcnic_host_tx_ring *tx_ring) + { + struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data); + struct ethhdr *phdr = (struct ethhdr *)(skb->data); +@@ -336,7 +336,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, + tmp_fil->vlan_id == vlan_id) { + if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime)) + qlcnic_change_filter(adapter, &src_addr, +- vlan_id); ++ vlan_id, tx_ring); + tmp_fil->ftime = jiffies; + return; + } +@@ -351,7 +351,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, + if (!fil) + return; + +- qlcnic_change_filter(adapter, &src_addr, vlan_id); ++ qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring); + fil->ftime = jiffies; + fil->vlan_id = vlan_id; + memcpy(fil->faddr, &src_addr, ETH_ALEN); +@@ -767,7 +767,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) + } + + if (adapter->drv_mac_learn) +- qlcnic_send_filter(adapter, first_desc, skb); ++ qlcnic_send_filter(adapter, first_desc, skb, tx_ring); + + tx_ring->tx_stats.tx_bytes += skb->len; + tx_ring->tx_stats.xmit_called++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index d02691ba3d7f..20aa34f45f07 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -71,7 +71,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins) + * Description: + * This function validates the number of Unicast address entries supported + * by a particular Synopsys 10/100/1000 controller. The Synopsys controller +- * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter ++ * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter + * logic. This function validates a valid, supported configuration is + * selected, and defaults to 1 Unicast address if an unsupported + * configuration is selected. +@@ -81,8 +81,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries) + int x = ucast_entries; + + switch (x) { +- case 1: +- case 32: ++ case 1 ... 32: + case 64: + case 128: + break; +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 49174837c2ba..33ffb573fd67 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1142,6 +1142,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + return -EBUSY; + } + ++ if (dev == port_dev) { ++ netdev_err(dev, "Cannot enslave team device to itself\n"); ++ return -EINVAL; ++ } ++ + if (port_dev->features & NETIF_F_VLAN_CHALLENGED && + vlan_uses_dev(dev)) { + netdev_err(dev, "Device %s is VLAN challenged and team device has VLAN set up\n", +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 478937418a33..8dbe086e0a96 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1506,6 +1506,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) + { + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); + if (pdata) { ++ cancel_work_sync(&pdata->set_multicast); + netif_dbg(dev, ifdown, dev->net, "free pdata\n"); + kfree(pdata); + pdata = NULL; +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index f7771d86ad6c..4ea44f7122ee 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _port) + } + + /* push data to (open) tty */ +- if (req->actual) { ++ if (req->actual && tty) { + char *packet = req->buf; + unsigned size = req->actual; + unsigned n; +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 9df00101bfe1..f788f80fe1aa 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1048,17 +1048,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + temp = readl(port_array[wIndex]); + break; + } +- +- /* Software should not attempt to set +- * port link state above '3' (U3) and the port +- * must be enabled. +- */ +- if ((temp & PORT_PE) == 0 || +- (link_state > USB_SS_PORT_LS_U3)) { +- xhci_warn(xhci, "Cannot set link state.\n"); ++ /* Port must be enabled */ ++ if (!(temp & PORT_PE)) { ++ retval = -ENODEV; ++ break; ++ } ++ /* Can't set port link state above '3' (U3) */ ++ if (link_state > USB_SS_PORT_LS_U3) { ++ xhci_warn(xhci, "Cannot set port %d link state %d\n", ++ wIndex, link_state); + goto error; + } +- + if (link_state == USB_SS_PORT_LS_U3) { + slot_id = xhci_find_slot_id_by_port(hcd, xhci, + wIndex + 1); +diff --git a/drivers/video/fbdev/aty/atyfb.h b/drivers/video/fbdev/aty/atyfb.h +index 63c4842eb224..46e0e8b39b76 100644 +--- a/drivers/video/fbdev/aty/atyfb.h ++++ b/drivers/video/fbdev/aty/atyfb.h +@@ -332,6 +332,8 @@ extern const struct aty_pll_ops aty_pll_ct; /* Integrated */ + extern void aty_set_pll_ct(const struct fb_info *info, const union aty_pll *pll); + extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); + ++extern const u8 aty_postdividers[8]; ++ + + /* + * Hardware cursor support +@@ -358,7 +360,6 @@ static inline void wait_for_idle(struct atyfb_par *par) + + extern void aty_reset_engine(const struct atyfb_par *par); + extern void aty_init_engine(struct atyfb_par *par, struct fb_info *info); +-extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); + + void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area); + void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect); +diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c +index 7f658fa4d22a..9755a0ec6591 100644 +--- a/drivers/video/fbdev/aty/atyfb_base.c ++++ b/drivers/video/fbdev/aty/atyfb_base.c +@@ -3093,17 +3093,18 @@ static int atyfb_setup_sparc(struct pci_dev *pdev, struct fb_info *info, + /* + * PLL Reference Divider M: + */ +- M = pll_regs[2]; ++ M = pll_regs[PLL_REF_DIV]; + + /* + * PLL Feedback Divider N (Dependent on CLOCK_CNTL): + */ +- N = pll_regs[7 + (clock_cntl & 3)]; ++ N = pll_regs[VCLK0_FB_DIV + (clock_cntl & 3)]; + + /* + * PLL Post Divider P (Dependent on CLOCK_CNTL): + */ +- P = 1 << (pll_regs[6] >> ((clock_cntl & 3) << 1)); ++ P = aty_postdividers[((pll_regs[VCLK_POST_DIV] >> ((clock_cntl & 3) << 1)) & 3) | ++ ((pll_regs[PLL_EXT_CNTL] >> (2 + (clock_cntl & 3))) & 4)]; + + /* + * PLL Divider Q: +diff --git a/drivers/video/fbdev/aty/mach64_ct.c b/drivers/video/fbdev/aty/mach64_ct.c +index 51f29d627ceb..af54256a20a1 100644 +--- a/drivers/video/fbdev/aty/mach64_ct.c ++++ b/drivers/video/fbdev/aty/mach64_ct.c +@@ -114,7 +114,7 @@ static void aty_st_pll_ct(int offset, u8 val, const struct atyfb_par *par) + */ + + #define Maximum_DSP_PRECISION 7 +-static u8 postdividers[] = {1,2,4,8,3}; ++const u8 aty_postdividers[8] = {1,2,4,8,3,5,6,12}; + + static int aty_dsp_gt(const struct fb_info *info, u32 bpp, struct pll_ct *pll) + { +@@ -221,7 +221,7 @@ static int aty_valid_pll_ct(const struct fb_info *info, u32 vclk_per, struct pll + pll->vclk_post_div += (q < 64*8); + pll->vclk_post_div += (q < 32*8); + } +- pll->vclk_post_div_real = postdividers[pll->vclk_post_div]; ++ pll->vclk_post_div_real = aty_postdividers[pll->vclk_post_div]; + // pll->vclk_post_div <<= 6; + pll->vclk_fb_div = q * pll->vclk_post_div_real / 8; + pllvclk = (1000000 * 2 * pll->vclk_fb_div) / +@@ -512,7 +512,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) + u8 mclk_fb_div, pll_ext_cntl; + pll->ct.pll_ref_div = aty_ld_pll_ct(PLL_REF_DIV, par); + pll_ext_cntl = aty_ld_pll_ct(PLL_EXT_CNTL, par); +- pll->ct.xclk_post_div_real = postdividers[pll_ext_cntl & 0x07]; ++ pll->ct.xclk_post_div_real = aty_postdividers[pll_ext_cntl & 0x07]; + mclk_fb_div = aty_ld_pll_ct(MCLK_FB_DIV, par); + if (pll_ext_cntl & PLL_MFB_TIMES_4_2B) + mclk_fb_div <<= 1; +@@ -534,7 +534,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) + xpost_div += (q < 64*8); + xpost_div += (q < 32*8); + } +- pll->ct.xclk_post_div_real = postdividers[xpost_div]; ++ pll->ct.xclk_post_div_real = aty_postdividers[xpost_div]; + pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8; + + #ifdef CONFIG_PPC +@@ -583,7 +583,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) + mpost_div += (q < 64*8); + mpost_div += (q < 32*8); + } +- sclk_post_div_real = postdividers[mpost_div]; ++ sclk_post_div_real = aty_postdividers[mpost_div]; + pll->ct.sclk_fb_div = q * sclk_post_div_real / 8; + pll->ct.spll_cntl2 = mpost_div << 4; + #ifdef DEBUG +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index d0aaf338fa9f..d6bae37489af 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -638,14 +638,20 @@ static size_t ext4_xattr_free_space(struct ext4_xattr_entry *last, + } + + static int +-ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s) ++ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s, ++ struct inode *inode) + { +- struct ext4_xattr_entry *last; ++ struct ext4_xattr_entry *last, *next; + size_t free, min_offs = s->end - s->base, name_len = strlen(i->name); + + /* Compute min_offs and last. */ + last = s->first; +- for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { ++ for (; !IS_LAST_ENTRY(last); last = next) { ++ next = EXT4_XATTR_NEXT(last); ++ if ((void *)next >= s->end) { ++ EXT4_ERROR_INODE(inode, "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } + if (!last->e_value_block && last->e_value_size) { + size_t offs = le16_to_cpu(last->e_value_offs); + if (offs < min_offs) +@@ -825,7 +831,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, + ce = NULL; + } + ea_bdebug(bs->bh, "modifying in-place"); +- error = ext4_xattr_set_entry(i, s); ++ error = ext4_xattr_set_entry(i, s, inode); + if (!error) { + if (!IS_LAST_ENTRY(s->first)) + ext4_xattr_rehash(header(s->base), +@@ -875,7 +881,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, + s->end = s->base + sb->s_blocksize; + } + +- error = ext4_xattr_set_entry(i, s); ++ error = ext4_xattr_set_entry(i, s, inode); + if (error == -EFSCORRUPTED) + goto bad_block; + if (error) +@@ -1037,7 +1043,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, + + if (EXT4_I(inode)->i_extra_isize == 0) + return -ENOSPC; +- error = ext4_xattr_set_entry(i, s); ++ error = ext4_xattr_set_entry(i, s, inode); + if (error) { + if (error == -ENOSPC && + ext4_has_inline_data(inode)) { +@@ -1049,7 +1055,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, + error = ext4_xattr_ibody_find(inode, i, is); + if (error) + return error; +- error = ext4_xattr_set_entry(i, s); ++ error = ext4_xattr_set_entry(i, s, inode); + } + if (error) + return error; +@@ -1075,7 +1081,7 @@ static int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode, + + if (EXT4_I(inode)->i_extra_isize == 0) + return -ENOSPC; +- error = ext4_xattr_set_entry(i, s); ++ error = ext4_xattr_set_entry(i, s, inode); + if (error) + return error; + header = IHDR(inode, ext4_raw_inode(&is->iloc)); +diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c +index 4c2c03663533..8e1427762eeb 100644 +--- a/fs/jffs2/xattr.c ++++ b/fs/jffs2/xattr.c +@@ -1004,12 +1004,14 @@ ssize_t jffs2_listxattr(struct dentry *dentry, char *buffer, size_t size) + rc = xhandle->list(xhandle, dentry, buffer + len, + size - len, xd->xname, + xd->name_len); ++ if (rc > size - len) { ++ rc = -ERANGE; ++ goto out; ++ } + } else { + rc = xhandle->list(xhandle, dentry, NULL, 0, + xd->xname, xd->name_len); + } +- if (rc < 0) +- goto out; + len += rc; + } + rc = len; +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index ae6a711dcd1d..281bb007f725 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -1179,6 +1179,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, + + struct hv_util_service { + u8 *recv_buffer; ++ void *channel; + void (*util_cb)(void *); + int (*util_init)(struct hv_util_service *); + void (*util_deinit)(void); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index fc54049e8286..0b211d482c96 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2168,6 +2168,13 @@ struct netdev_notifier_info { + struct net_device *dev; + }; + ++struct netdev_notifier_info_ext { ++ struct netdev_notifier_info info; /* must be first */ ++ union { ++ u32 mtu; ++ } ext; ++}; ++ + struct netdev_notifier_change_info { + struct netdev_notifier_info info; /* must be first */ + unsigned int flags_changed; +diff --git a/include/net/bonding.h b/include/net/bonding.h +index 93abe5f6188d..d5abd3a80896 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -146,12 +146,6 @@ struct bond_parm_tbl { + int mode; + }; + +-struct netdev_notify_work { +- struct delayed_work work; +- struct net_device *dev; +- struct netdev_bonding_info bonding_info; +-}; +- + struct slave { + struct net_device *dev; /* first - useful for panic debug */ + struct bonding *bond; /* our master */ +@@ -177,6 +171,7 @@ struct slave { + #ifdef CONFIG_NET_POLL_CONTROLLER + struct netpoll *np; + #endif ++ struct delayed_work notify_work; + struct kobject kobj; + struct rtnl_link_stats64 slave_stats; + }; +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 3afb7c4c7098..2a25b53cd427 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -322,6 +322,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev); + int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); + int fib_sync_down_addr(struct net *net, __be32 local); + int fib_sync_up(struct net_device *dev, unsigned int nh_flags); ++void fib_sync_mtu(struct net_device *dev, u32 orig_mtu); + + extern u32 fib_multipath_secret __read_mostly; + +diff --git a/mm/vmstat.c b/mm/vmstat.c +index 8895eff2d735..a2d70ef74db7 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -869,7 +869,6 @@ const char * const vmstat_text[] = { + #ifdef CONFIG_DEBUG_VM_VMACACHE + "vmacache_find_calls", + "vmacache_find_hits", +- "vmacache_full_flushes", + #endif + #endif /* CONFIG_VM_EVENTS_COUNTERS */ + }; +diff --git a/net/core/dev.c b/net/core/dev.c +index 191cf880d805..7366feb8b5b3 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1660,6 +1660,28 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev) + } + EXPORT_SYMBOL(call_netdevice_notifiers); + ++/** ++ * call_netdevice_notifiers_mtu - call all network notifier blocks ++ * @val: value passed unmodified to notifier function ++ * @dev: net_device pointer passed unmodified to notifier function ++ * @arg: additional u32 argument passed to the notifier function ++ * ++ * Call all network notifier blocks. Parameters and return value ++ * are as for raw_notifier_call_chain(). ++ */ ++static int call_netdevice_notifiers_mtu(unsigned long val, ++ struct net_device *dev, u32 arg) ++{ ++ struct netdev_notifier_info_ext info = { ++ .info.dev = dev, ++ .ext.mtu = arg, ++ }; ++ ++ BUILD_BUG_ON(offsetof(struct netdev_notifier_info_ext, info) != 0); ++ ++ return call_netdevice_notifiers_info(val, dev, &info.info); ++} ++ + #ifdef CONFIG_NET_INGRESS + static struct static_key ingress_needed __read_mostly; + +@@ -6134,14 +6156,16 @@ int dev_set_mtu(struct net_device *dev, int new_mtu) + err = __dev_set_mtu(dev, new_mtu); + + if (!err) { +- err = call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); ++ err = call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, ++ orig_mtu); + err = notifier_to_errno(err); + if (err) { + /* setting mtu back and notifying everyone again, + * so that they have a chance to revert changes. + */ + __dev_set_mtu(dev, orig_mtu); +- call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); ++ call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, ++ new_mtu); + } + } + return err; +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 96c9c0f0905a..f1df04c7d395 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2116,6 +2116,12 @@ struct net_device *rtnl_create_link(struct net *net, + else if (ops->get_num_rx_queues) + num_rx_queues = ops->get_num_rx_queues(); + ++ if (num_tx_queues < 1 || num_tx_queues > 4096) ++ return ERR_PTR(-EINVAL); ++ ++ if (num_rx_queues < 1 || num_rx_queues > 4096) ++ return ERR_PTR(-EINVAL); ++ + err = -ENOMEM; + dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type, + ops->setup, num_tx_queues, num_rx_queues); +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 015c33712803..ce646572b912 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1170,7 +1170,8 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, + static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); +- struct netdev_notifier_changeupper_info *info; ++ struct netdev_notifier_changeupper_info *upper_info = ptr; ++ struct netdev_notifier_info_ext *info_ext = ptr; + struct in_device *in_dev; + struct net *net = dev_net(dev); + unsigned int flags; +@@ -1205,16 +1206,19 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo + fib_sync_up(dev, RTNH_F_LINKDOWN); + else + fib_sync_down_dev(dev, event, false); +- /* fall through */ ++ rt_cache_flush(net); ++ break; + case NETDEV_CHANGEMTU: ++ fib_sync_mtu(dev, info_ext->ext.mtu); + rt_cache_flush(net); + break; + case NETDEV_CHANGEUPPER: +- info = ptr; ++ upper_info = ptr; + /* flush all routes if dev is linked to or unlinked from + * an L3 master device (e.g., VRF) + */ +- if (info->upper_dev && netif_is_l3_master(info->upper_dev)) ++ if (upper_info->upper_dev && ++ netif_is_l3_master(upper_info->upper_dev)) + fib_disable_ip(dev, NETDEV_DOWN, true); + break; + } +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 03ebff3950d8..3109b9bb95d2 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1373,6 +1373,56 @@ int fib_sync_down_addr(struct net *net, __be32 local) + return ret; + } + ++/* Update the PMTU of exceptions when: ++ * - the new MTU of the first hop becomes smaller than the PMTU ++ * - the old MTU was the same as the PMTU, and it limited discovery of ++ * larger MTUs on the path. With that limit raised, we can now ++ * discover larger MTUs ++ * A special case is locked exceptions, for which the PMTU is smaller ++ * than the minimal accepted PMTU: ++ * - if the new MTU is greater than the PMTU, don't make any change ++ * - otherwise, unlock and set PMTU ++ */ ++static void nh_update_mtu(struct fib_nh *nh, u32 new, u32 orig) ++{ ++ struct fnhe_hash_bucket *bucket; ++ int i; ++ ++ bucket = rcu_dereference_protected(nh->nh_exceptions, 1); ++ if (!bucket) ++ return; ++ ++ for (i = 0; i < FNHE_HASH_SIZE; i++) { ++ struct fib_nh_exception *fnhe; ++ ++ for (fnhe = rcu_dereference_protected(bucket[i].chain, 1); ++ fnhe; ++ fnhe = rcu_dereference_protected(fnhe->fnhe_next, 1)) { ++ if (fnhe->fnhe_mtu_locked) { ++ if (new <= fnhe->fnhe_pmtu) { ++ fnhe->fnhe_pmtu = new; ++ fnhe->fnhe_mtu_locked = false; ++ } ++ } else if (new < fnhe->fnhe_pmtu || ++ orig == fnhe->fnhe_pmtu) { ++ fnhe->fnhe_pmtu = new; ++ } ++ } ++ } ++} ++ ++void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) ++{ ++ unsigned int hash = fib_devindex_hashfn(dev->ifindex); ++ struct hlist_head *head = &fib_info_devhash[hash]; ++ struct fib_nh *nh; ++ ++ hlist_for_each_entry(nh, head, nh_hash) { ++ if (nh->nh_dev == dev) ++ nh_update_mtu(nh, dev->mtu, orig_mtu); ++ } ++} ++ + /* Event force Flags Description + * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host + * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 88426a6a7a85..3f8caf7d19b8 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -134,7 +134,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) + static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) + { + struct sockaddr_in sin; +- const struct iphdr *iph = ip_hdr(skb); + __be16 *ports; + int end; + +@@ -149,7 +148,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) + ports = (__be16 *)skb_transport_header(skb); + + sin.sin_family = AF_INET; +- sin.sin_addr.s_addr = iph->daddr; ++ sin.sin_addr.s_addr = ip_hdr(skb)->daddr; + sin.sin_port = ports[1]; + memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 3d62feb65932..9d3176b080a4 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -597,6 +597,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + const struct iphdr *tnl_params, u8 protocol) + { + struct ip_tunnel *tunnel = netdev_priv(dev); ++ unsigned int inner_nhdr_len = 0; + const struct iphdr *inner_iph; + struct flowi4 fl4; + u8 tos, ttl; +@@ -607,6 +608,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + int err; + bool connected; + ++ /* ensure we can access the inner net header, for several users below */ ++ if (skb->protocol == htons(ETH_P_IP)) ++ inner_nhdr_len = sizeof(struct iphdr); ++ else if (skb->protocol == htons(ETH_P_IPV6)) ++ inner_nhdr_len = sizeof(struct ipv6hdr); ++ if (unlikely(!pskb_may_pull(skb, inner_nhdr_len))) ++ goto tx_error; ++ + inner_iph = (const struct iphdr *)skb_inner_network_header(skb); + connected = (tunnel->parms.iph.daddr != 0); + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 0613be57513e..582e757e5727 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3786,7 +3786,6 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos) + p++; + continue; + } +- state->offset++; + return ifa; + } + +@@ -3810,13 +3809,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq, + return ifa; + } + ++ state->offset = 0; + while (++state->bucket < IN6_ADDR_HSIZE) { +- state->offset = 0; + hlist_for_each_entry_rcu_bh(ifa, + &inet6_addr_lst[state->bucket], addr_lst) { + if (!net_eq(dev_net(ifa->idev->dev), net)) + continue; +- state->offset++; + return ifa; + } + } +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index e8f21dd520b2..7c7a74ea2b0d 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1096,7 +1096,7 @@ static inline int + ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ip6_tnl *t = netdev_priv(dev); +- const struct iphdr *iph = ip_hdr(skb); ++ const struct iphdr *iph; + int encap_limit = -1; + struct flowi6 fl6; + __u8 dsfield; +@@ -1104,6 +1104,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + u8 tproto; + int err; + ++ /* ensure we can access the full inner ip header */ ++ if (!pskb_may_pull(skb, sizeof(struct iphdr))) ++ return -1; ++ ++ iph = ip_hdr(skb); + memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); + + tproto = ACCESS_ONCE(t->parms.proto); +@@ -1140,7 +1145,7 @@ static inline int + ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ip6_tnl *t = netdev_priv(dev); +- struct ipv6hdr *ipv6h = ipv6_hdr(skb); ++ struct ipv6hdr *ipv6h; + int encap_limit = -1; + __u16 offset; + struct flowi6 fl6; +@@ -1149,6 +1154,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + u8 tproto; + int err; + ++ if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) ++ return -1; ++ ++ ipv6h = ipv6_hdr(skb); + tproto = ACCESS_ONCE(t->parms.proto); + if ((tproto != IPPROTO_IPV6 && tproto != 0) || + ip6_tnl_addr_conflict(t, ipv6h)) +diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c +index 3f33ec44bd28..9f4ec16abfcf 100644 +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -787,7 +787,8 @@ static int netlbl_unlabel_addrinfo_get(struct genl_info *info, + { + u32 addr_len; + +- if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { ++ if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && ++ info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { + addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); + if (addr_len != sizeof(struct in_addr) && + addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) +diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c +index b5a17cb510a0..4727f5b80e76 100644 +--- a/sound/hda/hdac_controller.c ++++ b/sound/hda/hdac_controller.c +@@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus) + */ + void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus) + { ++ WARN_ON_ONCE(!bus->rb.area); ++ + spin_lock_irq(&bus->reg_lock); + /* CORB set up */ + bus->corb.addr = bus->rb.addr; +@@ -377,13 +379,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset) + /* reset controller */ + azx_reset(bus, full_reset); + +- /* initialize interrupts */ ++ /* clear interrupts */ + azx_int_clear(bus); +- azx_int_enable(bus); + + /* initialize the codec command I/O */ + snd_hdac_bus_init_cmd_io(bus); + ++ /* enable interrupts after CORB/RIRB buffers are initialized above */ ++ azx_int_enable(bus); ++ + /* program the position buffer */ + if (bus->use_posbuf && bus->posbuf.addr) { + snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr); +diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c +index d53680ac78e4..6df158669420 100644 +--- a/sound/soc/codecs/sigmadsp.c ++++ b/sound/soc/codecs/sigmadsp.c +@@ -117,8 +117,7 @@ static int sigmadsp_ctrl_write(struct sigmadsp *sigmadsp, + struct sigmadsp_control *ctrl, void *data) + { + /* safeload loads up to 20 bytes in a atomic operation */ +- if (ctrl->num_bytes > 4 && ctrl->num_bytes <= 20 && sigmadsp->ops && +- sigmadsp->ops->safeload) ++ if (ctrl->num_bytes <= 20 && sigmadsp->ops && sigmadsp->ops->safeload) + return sigmadsp->ops->safeload(sigmadsp, ctrl->addr, data, + ctrl->num_bytes); + else +diff --git a/sound/soc/codecs/wm8804-i2c.c b/sound/soc/codecs/wm8804-i2c.c +index f27464c2c5ba..79541960f45d 100644 +--- a/sound/soc/codecs/wm8804-i2c.c ++++ b/sound/soc/codecs/wm8804-i2c.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include "wm8804.h" + +@@ -40,17 +41,29 @@ static const struct i2c_device_id wm8804_i2c_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wm8804_i2c_id); + ++#if defined(CONFIG_OF) + static const struct of_device_id wm8804_of_match[] = { + { .compatible = "wlf,wm8804", }, + { } + }; + MODULE_DEVICE_TABLE(of, wm8804_of_match); ++#endif ++ ++#ifdef CONFIG_ACPI ++static const struct acpi_device_id wm8804_acpi_match[] = { ++ { "1AEC8804", 0 }, /* Wolfson PCI ID + part ID */ ++ { "10138804", 0 }, /* Cirrus Logic PCI ID + part ID */ ++ { }, ++}; ++MODULE_DEVICE_TABLE(acpi, wm8804_acpi_match); ++#endif + + static struct i2c_driver wm8804_i2c_driver = { + .driver = { + .name = "wm8804", + .pm = &wm8804_pm, +- .of_match_table = wm8804_of_match, ++ .of_match_table = of_match_ptr(wm8804_of_match), ++ .acpi_match_table = ACPI_PTR(wm8804_acpi_match), + }, + .probe = wm8804_i2c_probe, + .remove = wm8804_i2c_remove, +diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py +index 1b02cdc0cab6..84cb5913b05a 100644 +--- a/tools/perf/scripts/python/export-to-postgresql.py ++++ b/tools/perf/scripts/python/export-to-postgresql.py +@@ -205,14 +205,23 @@ from ctypes import * + libpq = CDLL("libpq.so.5") + PQconnectdb = libpq.PQconnectdb + PQconnectdb.restype = c_void_p ++PQconnectdb.argtypes = [ c_char_p ] + PQfinish = libpq.PQfinish ++PQfinish.argtypes = [ c_void_p ] + PQstatus = libpq.PQstatus ++PQstatus.restype = c_int ++PQstatus.argtypes = [ c_void_p ] + PQexec = libpq.PQexec + PQexec.restype = c_void_p ++PQexec.argtypes = [ c_void_p, c_char_p ] + PQresultStatus = libpq.PQresultStatus ++PQresultStatus.restype = c_int ++PQresultStatus.argtypes = [ c_void_p ] + PQputCopyData = libpq.PQputCopyData ++PQputCopyData.restype = c_int + PQputCopyData.argtypes = [ c_void_p, c_void_p, c_int ] + PQputCopyEnd = libpq.PQputCopyEnd ++PQputCopyEnd.restype = c_int + PQputCopyEnd.argtypes = [ c_void_p, c_void_p ] + + sys.path.append(os.environ['PERF_EXEC_PATH'] + \ +diff --git a/tools/testing/selftests/efivarfs/config b/tools/testing/selftests/efivarfs/config +new file mode 100644 +index 000000000000..4e151f1005b2 +--- /dev/null ++++ b/tools/testing/selftests/efivarfs/config +@@ -0,0 +1 @@ ++CONFIG_EFIVAR_FS=y