From 4af7efa56892f518edcb72c18d980586240f4da4 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 24 May 2018 14:18:01 +0200 Subject: [PATCH] Merge MVEBU to stable --- config/kernel/linux-mvebu-next.config | 41 +- .../mvebu-default/04-patch-4.4.119-120.patch | 1104 ++++ .../mvebu-default/04-patch-4.4.120-121.patch | 1085 ++++ .../mvebu-default/04-patch-4.4.121-122.patch | 2177 +++++++ .../mvebu-default/04-patch-4.4.122-123.patch | 3500 +++++++++++ .../mvebu-default/04-patch-4.4.123-124.patch | 3077 ++++++++++ .../mvebu-default/04-patch-4.4.124-125.patch | 1326 ++++ .../mvebu-default/04-patch-4.4.125-126.patch | 455 ++ .../mvebu-default/04-patch-4.4.126-127.patch | 2344 +++++++ .../mvebu-default/04-patch-4.4.127-128.patch | 5371 +++++++++++++++++ .../mvebu-next/102-revert_i2c_delay.patch | 15 + ...a388-clearfog-add-SFP-module-support.patch | 72 + .../mvebu-next/210-clearfog_switch_node.patch | 21 + .../300-mvneta-tx-queue-workaround.patch | 35 + ...-pci-mvebu-time-out-reset-on-link-up.patch | 60 + ...2-sfp-display-SFP-module-information.patch | 290 + .../403-net-mvneta-convert-to-phylink.patch | 979 +++ ...04-net-mvneta-hack-fix-phy_interface.patch | 28 + ...le-MVNETA_CAUSE_PSC_SYNC_CHANGE-inte.patch | 56 + ...ta-add-module-EEPROM-reading-support.patch | 44 + ...ed-phy-remove-fixed_phy_update_state.patch | 80 + ...eeprom-ethtool-access-into-netdev-co.patch | 181 + ...fp-use-netdev-sfp_bus-for-start-stop.patch | 34 + ...w-marvell-10G-phy-support-to-use-SFP.patch | 131 + .../411-sfp-add-sfp-compatible.patch | 24 + ...da388-clearfog-emmc-on-clearfog-base.patch | 87 + ...8-clearfog-increase-speed-of-i2c0-to.patch | 42 + ...rmada388-clearfog-document-MPP-usage.patch | 124 + .../mvebu-next/420-rtc-trimming-support.patch | 143 + .../mvebu-next/421-rtc-initialize.patch | 74 + ...ada-385-linksys-Disable-internal-RTC.patch | 28 + .../mvebu-next/450-reprobe_sfp_phy.patch | 94 + ...clk_mvebu_update_cpu_clock_frequency.patch | 18 - ...fi-0001-realtek-wifi-881xAU-605ecfa.patch} | 0 ...ltek-wifi-881xAU-adding-kernel-4.14.patch} | 0 ...3-realtek-wifi-881xAU-enable-8814au.patch} | 0 ...realtek-wifi-881xAU-update-to-5a5d0f.patch | 4586 ++++++++++++++ ...-2001-01-rtl8188eu-kconfig-makefile.patch} | 0 ...8eu.patch => wifi-2002-02-rtl8188eu.patch} | 0 39 files changed, 27696 insertions(+), 30 deletions(-) create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.119-120.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.120-121.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.121-122.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.122-123.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.123-124.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.124-125.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.125-126.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.126-127.patch create mode 100644 patch/kernel/mvebu-default/04-patch-4.4.127-128.patch create mode 100644 patch/kernel/mvebu-next/102-revert_i2c_delay.patch create mode 100644 patch/kernel/mvebu-next/2-2-ARM-dts-armada388-clearfog-add-SFP-module-support.patch create mode 100644 patch/kernel/mvebu-next/210-clearfog_switch_node.patch create mode 100644 patch/kernel/mvebu-next/300-mvneta-tx-queue-workaround.patch create mode 100644 patch/kernel/mvebu-next/401-pci-mvebu-time-out-reset-on-link-up.patch create mode 100644 patch/kernel/mvebu-next/402-sfp-display-SFP-module-information.patch create mode 100644 patch/kernel/mvebu-next/403-net-mvneta-convert-to-phylink.patch create mode 100644 patch/kernel/mvebu-next/404-net-mvneta-hack-fix-phy_interface.patch create mode 100644 patch/kernel/mvebu-next/405-net-mvneta-disable-MVNETA_CAUSE_PSC_SYNC_CHANGE-inte.patch create mode 100644 patch/kernel/mvebu-next/406-net-mvneta-add-module-EEPROM-reading-support.patch create mode 100644 patch/kernel/mvebu-next/407-phy-fixed-phy-remove-fixed_phy_update_state.patch create mode 100644 patch/kernel/mvebu-next/408-sfp-move-module-eeprom-ethtool-access-into-netdev-co.patch create mode 100644 patch/kernel/mvebu-next/409-sfp-use-netdev-sfp_bus-for-start-stop.patch create mode 100644 patch/kernel/mvebu-next/410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch create mode 100644 patch/kernel/mvebu-next/411-sfp-add-sfp-compatible.patch create mode 100644 patch/kernel/mvebu-next/412-ARM-dts-armada388-clearfog-emmc-on-clearfog-base.patch create mode 100644 patch/kernel/mvebu-next/413-ARM-dts-armada388-clearfog-increase-speed-of-i2c0-to.patch create mode 100644 patch/kernel/mvebu-next/415-ARM-dts-armada388-clearfog-document-MPP-usage.patch create mode 100644 patch/kernel/mvebu-next/420-rtc-trimming-support.patch create mode 100644 patch/kernel/mvebu-next/421-rtc-initialize.patch create mode 100644 patch/kernel/mvebu-next/423-ARM-dts-armada-385-linksys-Disable-internal-RTC.patch create mode 100644 patch/kernel/mvebu-next/450-reprobe_sfp_phy.patch delete mode 100644 patch/kernel/mvebu-next/805-clk_mvebu_update_cpu_clock_frequency.patch rename patch/kernel/mvebu-next/{0001-realtek-wifi-881xAU-605ecfa.patch => wifi-0001-realtek-wifi-881xAU-605ecfa.patch} (100%) rename patch/kernel/mvebu-next/{0002-realtek-wifi-881xAU-adding-kernel-4.14.patch => wifi-0002-realtek-wifi-881xAU-adding-kernel-4.14.patch} (100%) rename patch/kernel/mvebu-next/{0003-realtek-wifi-881xAU-enable-8814au.patch => wifi-0003-realtek-wifi-881xAU-enable-8814au.patch} (100%) create mode 100644 patch/kernel/mvebu-next/wifi-0005-realtek-wifi-881xAU-update-to-5a5d0f.patch rename patch/kernel/mvebu-next/{90-01-rtl8188eu-kconfig-makefile.patch => wifi-2001-01-rtl8188eu-kconfig-makefile.patch} (100%) rename patch/kernel/mvebu-next/{90-02-rtl8188eu.patch => wifi-2002-02-rtl8188eu.patch} (100%) diff --git a/config/kernel/linux-mvebu-next.config b/config/kernel/linux-mvebu-next.config index c59c73b56..9cb8aface 100644 --- a/config/kernel/linux-mvebu-next.config +++ b/config/kernel/linux-mvebu-next.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.20 Kernel Configuration +# Linux/arm 4.14.40 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -482,7 +482,7 @@ CONFIG_CACHE_L2X0=y # CONFIG_CACHE_L2X0_PMU is not set # CONFIG_PL310_ERRATA_588369 is not set # CONFIG_PL310_ERRATA_727915 is not set -# CONFIG_PL310_ERRATA_753970 is not set +CONFIG_PL310_ERRATA_753970=y # CONFIG_PL310_ERRATA_769419 is not set CONFIG_CACHE_TAUROS2=y CONFIG_ARM_L1_CACHE_SHIFT_6=y @@ -2165,7 +2165,14 @@ CONFIG_MVPP2=y # CONFIG_NET_PACKET_ENGINE is not set # CONFIG_NET_VENDOR_QLOGIC is not set # CONFIG_NET_VENDOR_QUALCOMM is not set -# CONFIG_NET_VENDOR_REALTEK is not set +CONFIG_NET_VENDOR_REALTEK=y +CONFIG_8139CP=m +CONFIG_8139TOO=m +CONFIG_8139TOO_PIO=y +CONFIG_8139TOO_TUNE_TWISTER=y +# CONFIG_8139TOO_8129 is not set +# CONFIG_8139_OLD_RX_RESET is not set +CONFIG_R8169=m # CONFIG_NET_VENDOR_RENESAS is not set # CONFIG_NET_VENDOR_RDC is not set # CONFIG_NET_VENDOR_ROCKER is not set @@ -2192,6 +2199,8 @@ CONFIG_MDIO_BUS=y # CONFIG_MDIO_BUS_MUX_GPIO is not set # CONFIG_MDIO_BUS_MUX_MMIOREG is not set # CONFIG_MDIO_HISI_FEMAC is not set +CONFIG_MDIO_I2C=m +CONFIG_PHYLINK=y CONFIG_PHYLIB=y CONFIG_SWPHY=y CONFIG_LED_TRIGGER_PHY=y @@ -2199,6 +2208,7 @@ CONFIG_LED_TRIGGER_PHY=y # # MII PHY device drivers # +CONFIG_SFP=m # CONFIG_AMD_PHY is not set # CONFIG_AQUANTIA_PHY is not set # CONFIG_AT803X_PHY is not set @@ -2240,16 +2250,19 @@ CONFIG_PPP_MULTILINK=y CONFIG_PPPOE=m CONFIG_PPTP=m CONFIG_PPPOL2TP=m -# CONFIG_PPP_ASYNC is not set -# CONFIG_PPP_SYNC_TTY is not set -# CONFIG_SLIP is not set +CONFIG_PPP_ASYNC=m +CONFIG_PPP_SYNC_TTY=m +CONFIG_SLIP=m CONFIG_SLHC=m +CONFIG_SLIP_COMPRESSED=y +CONFIG_SLIP_SMART=y +CONFIG_SLIP_MODE_SLIP6=y CONFIG_USB_NET_DRIVERS=m # CONFIG_USB_CATC is not set # CONFIG_USB_KAWETH is not set # CONFIG_USB_PEGASUS is not set -# CONFIG_USB_RTL8150 is not set -# CONFIG_USB_RTL8152 is not set +CONFIG_USB_RTL8150=m +CONFIG_USB_RTL8152=m # CONFIG_USB_LAN78XX is not set CONFIG_USB_USBNET=m CONFIG_USB_NET_AX8817X=m @@ -3426,7 +3439,7 @@ CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y CONFIG_USB_ARCH_HAS_HCD=y CONFIG_USB=y -# CONFIG_USB_PCI is not set +CONFIG_USB_PCI=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y # @@ -3445,19 +3458,22 @@ CONFIG_USB_LEDS_TRIGGER_USBPORT=y # # CONFIG_USB_C67X00_HCD is not set CONFIG_USB_XHCI_HCD=y +CONFIG_USB_XHCI_PCI=y CONFIG_USB_XHCI_PLATFORM=y CONFIG_USB_XHCI_MVEBU=y CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_ROOT_HUB_TT=y CONFIG_USB_EHCI_TT_NEWSCHED=y +CONFIG_USB_EHCI_PCI=y CONFIG_USB_EHCI_HCD_ORION=y -# CONFIG_USB_EHCI_HCD_PLATFORM is not set +CONFIG_USB_EHCI_HCD_PLATFORM=m # CONFIG_USB_OXU210HP_HCD is not set # CONFIG_USB_ISP116X_HCD is not set # CONFIG_USB_ISP1362_HCD is not set # CONFIG_USB_FOTG210_HCD is not set # CONFIG_USB_MAX3421_HCD is not set # CONFIG_USB_OHCI_HCD is not set +# CONFIG_USB_UHCI_HCD is not set # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set # CONFIG_USB_HCD_BCMA is not set @@ -3468,7 +3484,7 @@ CONFIG_USB_EHCI_HCD_ORION=y # USB Device Class drivers # CONFIG_USB_ACM=m -# CONFIG_USB_PRINTER is not set +CONFIG_USB_PRINTER=m CONFIG_USB_WDM=m # CONFIG_USB_TMC is not set @@ -3481,7 +3497,8 @@ CONFIG_USB_WDM=m # CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_DEBUG is not set -# CONFIG_USB_STORAGE_REALTEK is not set +CONFIG_USB_STORAGE_REALTEK=m +CONFIG_REALTEK_AUTOPM=y # CONFIG_USB_STORAGE_DATAFAB is not set # CONFIG_USB_STORAGE_FREECOM is not set # CONFIG_USB_STORAGE_ISD200 is not set diff --git a/patch/kernel/mvebu-default/04-patch-4.4.119-120.patch b/patch/kernel/mvebu-default/04-patch-4.4.119-120.patch new file mode 100644 index 000000000..c9ab6d4c3 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.119-120.patch @@ -0,0 +1,1104 @@ +diff --git a/Makefile b/Makefile +index 87f925192c77..d874d7de0cde 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 119 ++SUBLEVEL = 120 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/ls1021a-qds.dts b/arch/arm/boot/dts/ls1021a-qds.dts +index 0521e6864cb7..76fce89d4f69 100644 +--- a/arch/arm/boot/dts/ls1021a-qds.dts ++++ b/arch/arm/boot/dts/ls1021a-qds.dts +@@ -215,7 +215,7 @@ + reg = <0x2a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts +index fbb89d13401e..674df87629bd 100644 +--- a/arch/arm/boot/dts/ls1021a-twr.dts ++++ b/arch/arm/boot/dts/ls1021a-twr.dts +@@ -167,7 +167,7 @@ + reg = <0x0a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + +diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S +index 1712f132b80d..b83fdc06286a 100644 +--- a/arch/arm/lib/csumpartialcopyuser.S ++++ b/arch/arm/lib/csumpartialcopyuser.S +@@ -85,7 +85,11 @@ + .pushsection .text.fixup,"ax" + .align 4 + 9001: mov r4, #-EFAULT ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ ldr r5, [sp, #9*4] @ *err_ptr ++#else + ldr r5, [sp, #8*4] @ *err_ptr ++#endif + str r4, [r5] + ldmia sp, {r1, r2} @ retrieve dst, len + add r2, r2, r1 +diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile +index 0344e575f522..fba4ca56e46a 100644 +--- a/arch/mips/lib/Makefile ++++ b/arch/mips/lib/Makefile +@@ -15,4 +15,5 @@ obj-$(CONFIG_CPU_R3000) += r3k_dump_tlb.o + obj-$(CONFIG_CPU_TX39XX) += r3k_dump_tlb.o + + # libgcc-style stuff needed in the kernel +-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o ++obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \ ++ ucmpdi2.o +diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h +index 05909d58e2fe..56ea0df60a44 100644 +--- a/arch/mips/lib/libgcc.h ++++ b/arch/mips/lib/libgcc.h +@@ -9,10 +9,18 @@ typedef int word_type __attribute__ ((mode (__word__))); + struct DWstruct { + int high, low; + }; ++ ++struct TWstruct { ++ long long high, low; ++}; + #elif defined(__LITTLE_ENDIAN) + struct DWstruct { + int low, high; + }; ++ ++struct TWstruct { ++ long long low, high; ++}; + #else + #error I feel sick. + #endif +@@ -22,4 +30,13 @@ typedef union { + long long ll; + } DWunion; + ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) ++typedef int ti_type __attribute__((mode(TI))); ++ ++typedef union { ++ struct TWstruct s; ++ ti_type ti; ++} TWunion; ++#endif ++ + #endif /* __ASM_LIBGCC_H */ +diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c +new file mode 100644 +index 000000000000..111ad475aa0c +--- /dev/null ++++ b/arch/mips/lib/multi3.c +@@ -0,0 +1,54 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++ ++#include "libgcc.h" ++ ++/* ++ * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that ++ * specific case only we'll implement it here. ++ * ++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981 ++ */ ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7) ++ ++/* multiply 64-bit values, low 64-bits returned */ ++static inline long long notrace dmulu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmulu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 64-bit unsigned values, high 64-bits of 128-bit result returned */ ++static inline long long notrace dmuhu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmuhu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 128-bit values, low 128-bits returned */ ++ti_type notrace __multi3(ti_type a, ti_type b) ++{ ++ TWunion res, aa, bb; ++ ++ aa.ti = a; ++ bb.ti = b; ++ ++ /* ++ * a * b = (a.lo * b.lo) ++ * + 2^64 * (a.hi * b.lo + a.lo * b.hi) ++ * [+ 2^128 * (a.hi * b.hi)] ++ */ ++ res.s.low = dmulu(aa.s.low, bb.s.low); ++ res.s.high = dmuhu(aa.s.low, bb.s.low); ++ res.s.high += dmulu(aa.s.high, bb.s.low); ++ res.s.high += dmulu(aa.s.low, bb.s.high); ++ ++ return res.ti; ++} ++EXPORT_SYMBOL(__multi3); ++ ++#endif /* 64BIT && CPU_MIPSR6 && GCC7 */ +diff --git a/arch/sh/boards/mach-se/770x/setup.c b/arch/sh/boards/mach-se/770x/setup.c +index 658326f44df8..5e0267624d8d 100644 +--- a/arch/sh/boards/mach-se/770x/setup.c ++++ b/arch/sh/boards/mach-se/770x/setup.c +@@ -8,6 +8,7 @@ + */ + #include + #include ++#include + #include + #include + #include +@@ -114,6 +115,11 @@ static struct platform_device heartbeat_device = { + #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\ + defined(CONFIG_CPU_SUBTYPE_SH7712) + /* SH771X Ethernet driver */ ++static struct sh_eth_plat_data sh_eth_plat = { ++ .phy = PHY_ID, ++ .phy_interface = PHY_INTERFACE_MODE_MII, ++}; ++ + static struct resource sh_eth0_resources[] = { + [0] = { + .start = SH_ETH0_BASE, +@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_device = { + .name = "sh771x-ether", + .id = 0, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth0_resources), + .resource = sh_eth0_resources, +@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_device = { + .name = "sh771x-ether", + .id = 1, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth1_resources), + .resource = sh_eth1_resources, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +index 4896474da320..3021fcd0a3df 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +@@ -127,6 +127,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev) + return ret; + + pci->irq = pdev->irq; ++ ++ /* Ensure MSI interrupts are armed, for the case where there are ++ * already interrupts pending (for whatever reason) at load time. ++ */ ++ if (pci->msi) ++ pci->func->msi_rearm(pci); ++ + return ret; + } + +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c +index 5d8dfe027b30..75d51ec98e06 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages) + pr_info("Initializing pool allocator\n"); + + _manager = kzalloc(sizeof(*_manager), GFP_KERNEL); ++ if (!_manager) ++ return -ENOMEM; + + ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc"); + +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 4d1e1c632603..ce87e9cc7eff 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -424,7 +424,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + goto err_free_mr; + + mr->max_pages = max_num_sg; +- + err = mlx4_mr_enable(dev->dev, &mr->mmr); + if (err) + goto err_free_pl; +@@ -435,6 +434,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + return &mr->ibmr; + + err_free_pl: ++ mr->ibmr.device = pd->device; + mlx4_free_priv_pages(mr); + err_free_mr: + (void) mlx4_mr_free(dev->dev, &mr->mmr); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index bad76eed06b3..5c653669e736 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -844,8 +844,8 @@ static int path_rec_start(struct net_device *dev, + return 0; + } + +-static void neigh_add_path(struct sk_buff *skb, u8 *daddr, +- struct net_device *dev) ++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr, ++ struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + struct ipoib_path *path; +@@ -858,7 +858,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + spin_unlock_irqrestore(&priv->lock, flags); + ++dev->stats.tx_dropped; + dev_kfree_skb_any(skb); +- return; ++ return NULL; ++ } ++ ++ /* To avoid race condition, make sure that the ++ * neigh will be added only once. ++ */ ++ if (unlikely(!list_empty(&neigh->list))) { ++ spin_unlock_irqrestore(&priv->lock, flags); ++ return neigh; + } + + path = __path_find(dev, daddr + 4); +@@ -896,7 +904,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_send(dev, skb, path->ah, IPOIB_QPN(daddr)); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + } + } else { + neigh->ah = NULL; +@@ -913,7 +921,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + + err_path: + ipoib_neigh_free(neigh); +@@ -923,6 +931,8 @@ err_drop: + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); ++ ++ return NULL; + } + + static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, +@@ -1028,8 +1038,9 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev) + case htons(ETH_P_TIPC): + neigh = ipoib_neigh_get(dev, phdr->hwaddr); + if (unlikely(!neigh)) { +- neigh_add_path(skb, phdr->hwaddr, dev); +- return NETDEV_TX_OK; ++ neigh = neigh_add_path(skb, phdr->hwaddr, dev); ++ if (likely(!neigh)) ++ return NETDEV_TX_OK; + } + break; + case htons(ETH_P_ARP): +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 5580ab0b5781..8bf48165f32c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -775,7 +775,10 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb) + spin_lock_irqsave(&priv->lock, flags); + if (!neigh) { + neigh = ipoib_neigh_alloc(daddr, dev); +- if (neigh) { ++ /* Make sure that the neigh will be added only ++ * once to mcast list. ++ */ ++ if (neigh && list_empty(&neigh->list)) { + kref_get(&mcast->ah->ref); + neigh->ah = mcast->ah; + list_add_tail(&neigh->list, &mcast->neigh_list); +diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c +index c1c3af089634..92b6798ef5b3 100644 +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -149,7 +149,7 @@ void led_blink_set(struct led_classdev *led_cdev, + unsigned long *delay_on, + unsigned long *delay_off) + { +- del_timer_sync(&led_cdev->blink_timer); ++ led_stop_software_blink(led_cdev); + + led_cdev->flags &= ~LED_BLINK_ONESHOT; + led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP; +diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +index 2064adac1d17..e2a239c1f40b 100644 +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1029,9 +1029,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + return ret; + } + +- /* handle the block mark swapping */ +- block_mark_swapping(this, payload_virt, auxiliary_virt); +- + /* Loop over status bytes, accumulating ECC status. */ + status = auxiliary_virt + nfc_geo->auxiliary_status_offset; + +@@ -1047,6 +1044,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + max_bitflips = max_t(unsigned int, max_bitflips, *status); + } + ++ /* handle the block mark swapping */ ++ block_mark_swapping(this, buf, auxiliary_virt); ++ + if (oob_required) { + /* + * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob() +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 16f7cadda5c3..47f43bdecd51 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -493,7 +493,7 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + data = be32_to_cpup((__be32 *)&cf->data[0]); + flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[0]); + } +- if (cf->can_dlc > 3) { ++ if (cf->can_dlc > 4) { + data = be32_to_cpup((__be32 *)&cf->data[4]); + flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[1]); + } +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index abe1eabc0171..9cc5daed13ed 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -250,39 +250,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- pktlen = info & LEN_MASK; +- stats->rx_packets++; +- stats->rx_bytes += pktlen; +- skb = rx_buff->skb; +- skb_put(skb, pktlen); +- skb->dev = ndev; +- skb->protocol = eth_type_trans(skb, ndev); +- +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), +- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); +- +- /* Prepare the BD for next cycle */ +- rx_buff->skb = netdev_alloc_skb_ip_align(ndev, +- EMAC_BUFFER_SIZE); +- if (unlikely(!rx_buff->skb)) { ++ /* Prepare the BD for next cycle. netif_receive_skb() ++ * only if new skb was allocated and mapped to avoid holes ++ * in the RX fifo. ++ */ ++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE); ++ if (unlikely(!skb)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "cannot allocate skb\n"); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; +- /* Because receive_skb is below, increment rx_dropped */ + stats->rx_dropped++; + continue; + } + +- /* receive_skb only if new skb was allocated to avoid holes */ +- netif_receive_skb(skb); +- +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(&ndev->dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, addr)) { + if (net_ratelimit()) +- netdev_err(ndev, "cannot dma map\n"); +- dev_kfree_skb(rx_buff->skb); ++ netdev_err(ndev, "cannot map dma buffer\n"); ++ dev_kfree_skb(skb); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; ++ stats->rx_dropped++; + continue; + } ++ ++ /* unmap previosly mapped skb */ ++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); ++ ++ pktlen = info & LEN_MASK; ++ stats->rx_packets++; ++ stats->rx_bytes += pktlen; ++ skb_put(rx_buff->skb, pktlen); ++ rx_buff->skb->dev = ndev; ++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev); ++ ++ netif_receive_skb(rx_buff->skb); ++ ++ rx_buff->skb = skb; + dma_unmap_addr_set(rx_buff, addr, addr); + dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE); + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index e5911ccb2148..74bece5897c9 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3052,7 +3052,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + + del_timer_sync(&bp->timer); + +- if (IS_PF(bp)) { ++ if (IS_PF(bp) && !BP_NOMCP(bp)) { + /* Set ALWAYS_ALIVE bit in shmem */ + bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE; + bnx2x_drv_pulse(bp); +@@ -3134,7 +3134,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + bp->cnic_loaded = false; + + /* Clear driver version indication in shmem */ +- if (IS_PF(bp)) ++ if (IS_PF(bp) && !BP_NOMCP(bp)) + bnx2x_update_mng_version(bp); + + /* Check if there are pending parity attentions. If there are - set +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index abb3ff6498dc..8ddb68a3fdb6 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9570,6 +9570,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp) + + do { + bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR); ++ ++ /* If we read all 0xFFs, means we are in PCI error state and ++ * should bail out to avoid crashes on adapter's FW reads. ++ */ ++ if (bp->common.shmem_base == 0xFFFFFFFF) { ++ bp->flags |= NO_MCP_FLAG; ++ return -ENODEV; ++ } ++ + if (bp->common.shmem_base) { + val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]); + if (val & SHR_MEM_VALIDITY_MB) +@@ -14214,7 +14223,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) + BNX2X_ERR("IO slot reset --> driver unload\n"); + + /* MCP should have been reset; Need to wait for validity */ +- bnx2x_init_shmem(bp); ++ if (bnx2x_init_shmem(bp)) { ++ rtnl_unlock(); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } + + if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) { + u32 v; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index ea044bbcd384..3eebb57975e3 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -29,7 +29,7 @@ static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id) + netdev_err(bp->dev, "vf ndo called though sriov is disabled\n"); + return -EINVAL; + } +- if (vf_id >= bp->pf.max_vfs) { ++ if (vf_id >= bp->pf.active_vfs) { + netdev_err(bp->dev, "Invalid VF id %d\n", vf_id); + return -EINVAL; + } +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index ab53e0cfb4dc..3bba92fc9c1a 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -10051,6 +10051,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy) + + tw32(GRC_MODE, tp->grc_mode | val); + ++ /* On one of the AMD platform, MRRS is restricted to 4000 because of ++ * south bridge limitation. As a workaround, Driver is setting MRRS ++ * to 2048 instead of default 4096. ++ */ ++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && ++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { ++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; ++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); ++ } ++ + /* Setup the timer prescalar register. Clock is always 66Mhz. */ + val = tr32(GRC_MISC_CFG); + val &= ~0xff; +@@ -14230,7 +14240,8 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + */ + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || +- tg3_asic_rev(tp) == ASIC_REV_5719) ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); +diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h +index 31c9f8295953..19532961e173 100644 +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -95,6 +95,7 @@ + #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106 + #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109 + #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a ++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0 + #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a +@@ -280,6 +281,9 @@ + #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */ + #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */ + /* 0xa8 --> 0xb8 unused */ ++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4 ++#define MAX_READ_REQ_SIZE_2048 0x00004000 ++#define MAX_READ_REQ_MASK 0x00007000 + #define TG3PCI_DUAL_MAC_CTRL 0x000000b8 + #define DUAL_MAC_CTRL_CH_MASK 0x00000003 + #define DUAL_MAC_CTRL_ID 0x00000004 +diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c +index b40fba929d65..d540ee190038 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct ptp_clock_info *ptp, s64 delta) + now = tmr_cnt_read(etsects); + now += delta; + tmr_cnt_write(etsects, now); ++ set_fipers(etsects); + + spin_unlock_irqrestore(&etsects->lock, flags); + +- set_fipers(etsects); +- + return 0; + } + +diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h +index 98fe5a2cd6e3..481e994490ce 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000.h ++++ b/drivers/net/ethernet/intel/e1000/e1000.h +@@ -331,7 +331,8 @@ struct e1000_adapter { + enum e1000_state_t { + __E1000_TESTING, + __E1000_RESETTING, +- __E1000_DOWN ++ __E1000_DOWN, ++ __E1000_DISABLED + }; + + #undef pr_fmt +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 068023595d84..2a1d4a9d3c19 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e1000_adapter *adapter, + static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; +- struct e1000_adapter *adapter; ++ struct e1000_adapter *adapter = NULL; + struct e1000_hw *hw; + + static int cards_found = 0; +@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + u16 tmp = 0; + u16 eeprom_apme_mask = E1000_EEPROM_APME; + int bars, need_ioport; ++ bool disable_dev = false; + + /* do not allocate ioport bars when not needed */ + need_ioport = e1000_is_need_ioport(pdev); +@@ -1250,11 +1251,13 @@ err_mdio_ioremap: + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +- pci_disable_device(pdev); ++ if (!adapter || disable_dev) ++ pci_disable_device(pdev); + return err; + } + +@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev *pdev) + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ bool disable_dev; + + e1000_down_and_stop(adapter); + e1000_release_manageability(adapter); +@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev *pdev) + iounmap(hw->flash_address); + pci_release_selected_regions(pdev, adapter->bars); + ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + +- pci_disable_device(pdev); ++ if (disable_dev) ++ pci_disable_device(pdev); + } + + /** +@@ -5135,7 +5141,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake) + if (netif_running(netdev)) + e1000_free_irq(adapter); + +- pci_disable_device(pdev); ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + return 0; + } +@@ -5179,6 +5186,10 @@ static int e1000_resume(struct pci_dev *pdev) + pr_err("Cannot enable PCI device from suspend\n"); + return err; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +@@ -5253,7 +5264,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev, + + if (netif_running(netdev)) + e1000_down(adapter); +- pci_disable_device(pdev); ++ ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + /* Request a slot slot reset. */ + return PCI_ERS_RESULT_NEED_RESET; +@@ -5281,6 +5294,10 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev) + pr_err("Cannot re-enable PCI device after reset.\n"); + return PCI_ERS_RESULT_DISCONNECT; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c +index 15bc7f9ea224..afd76e07088b 100644 +--- a/drivers/net/phy/mdio-sun4i.c ++++ b/drivers/net/phy/mdio-sun4i.c +@@ -128,8 +128,10 @@ static int sun4i_mdio_probe(struct platform_device *pdev) + + data->regulator = devm_regulator_get(&pdev->dev, "phy"); + if (IS_ERR(data->regulator)) { +- if (PTR_ERR(data->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_out_free_mdiobus; ++ } + + dev_info(&pdev->dev, "no regulator found\n"); + } else { +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index eb7a9e62371c..0b8d2655985f 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1331,6 +1331,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + + netif_carrier_off(netdev); + ++ xenbus_switch_state(dev, XenbusStateInitialising); + return netdev; + + exit: +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index d26134713682..d05c553eb552 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2743,6 +2743,16 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr) + erp = dasd_3990_erp_handle_match_erp(cqr, erp); + } + ++ ++ /* ++ * For path verification work we need to stick with the path that was ++ * originally chosen so that the per path configuration data is ++ * assigned correctly. ++ */ ++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) { ++ erp->lpm = cqr->lpm; ++ } ++ + if (device->features & DASD_FEATURE_ERPLOG) { + /* print current erp_chain */ + dev_err(&device->cdev->dev, +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 5e4e1ba96f10..351d81dc2200 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -890,10 +890,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + case TEST_UNIT_READY: + break; + default: +- set_host_byte(scmnd, DID_TARGET_FAILURE); ++ set_host_byte(scmnd, DID_ERROR); + } + break; + case SRB_STATUS_INVALID_LUN: ++ set_host_byte(scmnd, DID_NO_CONNECT); + do_work = true; + process_err_fn = storvsc_remove_lun; + break; +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 8feac599e9ab..44be6b593b30 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1669,12 +1669,12 @@ static int atmel_spi_remove(struct platform_device *pdev) + pm_runtime_get_sync(&pdev->dev); + + /* reset the hardware and block queue progress */ +- spin_lock_irq(&as->lock); + if (as->use_dma) { + atmel_spi_stop_dma(as); + atmel_spi_release_dma(as); + } + ++ spin_lock_irq(&as->lock); + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ + spi_readl(as, SR); +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index a4d749665c9f..1865bcfa869b 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -378,10 +378,8 @@ static int unmap_grant_pages(struct grant_map *map, int offset, int pages) + } + range = 0; + while (range < pages) { +- if (map->unmap_ops[offset+range].handle == -1) { +- range--; ++ if (map->unmap_ops[offset+range].handle == -1) + break; +- } + range++; + } + err = __unmap_grant_pages(map, offset, range); +@@ -876,8 +874,10 @@ unlock_out: + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) ++ if (use_ptemod) { + map->vma = NULL; ++ unmap_grant_pages(map, 0, map->count); ++ } + gntdev_put_map(priv, map); + return err; + } +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index 7ddba812e11b..6827b9c942dc 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -172,7 +172,7 @@ void f2fs_drop_largest_extent(struct inode *inode, pgoff_t fofs) + __drop_largest_extent(inode, fofs, 1); + } + +-void f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) ++static void __f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et; +@@ -204,6 +204,14 @@ out: + write_unlock(&et->lock); + } + ++void f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) ++{ ++ __f2fs_init_extent_tree(inode, i_ext); ++ ++ if (!F2FS_I(inode)->extent_tree) ++ set_inode_flag(F2FS_I(inode), FI_NO_EXTENT); ++} ++ + static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs, + struct extent_info *ei) + { +diff --git a/fs/super.c b/fs/super.c +index d4d2591b77c8..09b526a50986 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -497,7 +497,11 @@ retry: + hlist_add_head(&s->s_instances, &type->fs_supers); + spin_unlock(&sb_lock); + get_filesystem(type); +- register_shrinker(&s->s_shrink); ++ err = register_shrinker(&s->s_shrink); ++ if (err) { ++ deactivate_locked_super(s); ++ s = ERR_PTR(err); ++ } + return s; + } + +diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c +index 572b64a135b3..b148aa0e10f7 100644 +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -47,7 +47,7 @@ + STATIC int xfs_qm_init_quotainos(xfs_mount_t *); + STATIC int xfs_qm_init_quotainfo(xfs_mount_t *); + +- ++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi); + STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp); + /* + * We use the batch lookup interface to iterate over the dquots as it +@@ -660,9 +660,17 @@ xfs_qm_init_quotainfo( + qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan; + qinf->qi_shrinker.seeks = DEFAULT_SEEKS; + qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE; +- register_shrinker(&qinf->qi_shrinker); ++ ++ error = register_shrinker(&qinf->qi_shrinker); ++ if (error) ++ goto out_free_inos; ++ + return 0; + ++out_free_inos: ++ mutex_destroy(&qinf->qi_quotaofflock); ++ mutex_destroy(&qinf->qi_tree_lock); ++ xfs_qm_destroy_quotainos(qinf); + out_free_lru: + list_lru_destroy(&qinf->qi_lru); + out_free_qinf: +@@ -671,7 +679,6 @@ out_free_qinf: + return error; + } + +- + /* + * Gets called when unmounting a filesystem or when all quotas get + * turned off. +@@ -688,19 +695,8 @@ xfs_qm_destroy_quotainfo( + + unregister_shrinker(&qi->qi_shrinker); + list_lru_destroy(&qi->qi_lru); +- +- if (qi->qi_uquotaip) { +- IRELE(qi->qi_uquotaip); +- qi->qi_uquotaip = NULL; /* paranoia */ +- } +- if (qi->qi_gquotaip) { +- IRELE(qi->qi_gquotaip); +- qi->qi_gquotaip = NULL; +- } +- if (qi->qi_pquotaip) { +- IRELE(qi->qi_pquotaip); +- qi->qi_pquotaip = NULL; +- } ++ xfs_qm_destroy_quotainos(qi); ++ mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); + mp->m_quotainfo = NULL; +@@ -1561,6 +1557,24 @@ error_rele: + return error; + } + ++STATIC void ++xfs_qm_destroy_quotainos( ++ xfs_quotainfo_t *qi) ++{ ++ if (qi->qi_uquotaip) { ++ IRELE(qi->qi_uquotaip); ++ qi->qi_uquotaip = NULL; /* paranoia */ ++ } ++ if (qi->qi_gquotaip) { ++ IRELE(qi->qi_gquotaip); ++ qi->qi_gquotaip = NULL; ++ } ++ if (qi->qi_pquotaip) { ++ IRELE(qi->qi_pquotaip); ++ qi->qi_pquotaip = NULL; ++ } ++} ++ + STATIC void + xfs_qm_dqfree_one( + struct xfs_dquot *dqp) +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 323282e63865..8c4e27cbfe7f 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1139,7 +1139,12 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id, + + cpu_base = raw_cpu_ptr(&hrtimer_bases); + +- if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS) ++ /* ++ * POSIX magic: Relative CLOCK_REALTIME timers are not affected by ++ * clock modifications, so they needs to become CLOCK_MONOTONIC to ++ * ensure POSIX compliance. ++ */ ++ if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL) + clock_id = CLOCK_MONOTONIC; + + base = hrtimer_clockid_to_base(clock_id); +diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h +index b90e255c2a68..d2ecf0a09180 100644 +--- a/lib/mpi/longlong.h ++++ b/lib/mpi/longlong.h +@@ -671,7 +671,23 @@ do { \ + ************** MIPS/64 ************** + ***************************************/ + #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64 +-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) ++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 ++/* ++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C ++ * code below, so we special case MIPS64r6 until the compiler can do better. ++ */ ++#define umul_ppmm(w1, w0, u, v) \ ++do { \ ++ __asm__ ("dmulu %0,%1,%2" \ ++ : "=d" ((UDItype)(w0)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++ __asm__ ("dmuhu %0,%1,%2" \ ++ : "=d" ((UDItype)(w1)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++} while (0) ++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) + #define umul_ppmm(w1, w0, u, v) \ + do { \ + typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \ +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 7336a7311038..48db6f5cec2c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1614,6 +1614,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, + } + + rt->dst.flags |= DST_HOST; ++ rt->dst.input = ip6_input; + rt->dst.output = ip6_output; + atomic_set(&rt->dst.__refcnt, 1); + rt->rt6i_gateway = fl6->daddr; +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 3bcabc2ba4a6..f8406c37fc1d 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3367,6 +3367,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + } + return true; + case NL80211_IFTYPE_MESH_POINT: ++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) ++ return false; + if (multicast) + return true; + return ether_addr_equal(sdata->vif.addr, hdr->addr1); +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index e9851198a850..df6a4b2d0728 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4445,7 +4445,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv + len = sizeof(int); + if (put_user(len, optlen)) + return -EFAULT; +- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) ++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) + return -EFAULT; + return 0; + } +@@ -5022,6 +5022,9 @@ copy_getaddrs: + err = -EFAULT; + goto out; + } ++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, ++ * but we can't change it anymore. ++ */ + if (put_user(bytes_copied, optlen)) + err = -EFAULT; + out: +@@ -5458,7 +5461,7 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len, + params.assoc_id = 0; + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); +- if (copy_from_user(¶ms, optval, sizeof(params))) ++ if (copy_from_user(¶ms, optval, len)) + return -EFAULT; + } else + return -EINVAL; +@@ -5627,7 +5630,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + + if (len < sizeof(struct sctp_authkeyid)) + return -EINVAL; +- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) ++ ++ len = sizeof(struct sctp_authkeyid); ++ if (copy_from_user(&val, optval, len)) + return -EFAULT; + + asoc = sctp_id2assoc(sk, val.scact_assoc_id); +@@ -5639,7 +5644,6 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + else + val.scact_keynumber = ep->active_key_id; + +- len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) + return -EFAULT; + if (copy_to_user(optval, &val, len)) +@@ -5665,7 +5669,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +@@ -5710,7 +5714,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.120-121.patch b/patch/kernel/mvebu-default/04-patch-4.4.120-121.patch new file mode 100644 index 000000000..74f4e5681 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.120-121.patch @@ -0,0 +1,1085 @@ +diff --git a/Makefile b/Makefile +index d874d7de0cde..0e22e4eb85cc 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 120 ++SUBLEVEL = 121 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 80f6c786a37e..5562c5feb0be 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -90,6 +90,8 @@ + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -146,6 +148,12 @@ + OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */ + >; + }; ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ >; ++ }; + }; + + #include "twl4030.dtsi" +diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig +index e20fc4178b15..1c8a6098a2ca 100644 +--- a/arch/arm/mach-mvebu/Kconfig ++++ b/arch/arm/mach-mvebu/Kconfig +@@ -37,7 +37,7 @@ config MACH_ARMADA_370 + config MACH_ARMADA_375 + bool "Marvell Armada 375 boards" if ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_375_CLK + select HAVE_ARM_SCU +@@ -52,7 +52,7 @@ config MACH_ARMADA_375 + config MACH_ARMADA_38X + bool "Marvell Armada 380/385 boards" if ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_38X_CLK + select HAVE_ARM_SCU +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index a03b22c615d9..59a4e1604a36 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -178,12 +178,14 @@ GLOBAL(entry_SYSCALL_64_after_swapgs) + jnz tracesys + entry_SYSCALL_64_fastpath: + #if __SYSCALL_MASK == ~0 +- cmpq $__NR_syscall_max, %rax ++ cmpq $NR_syscalls, %rax + #else + andl $__SYSCALL_MASK, %eax +- cmpl $__NR_syscall_max, %eax ++ cmpl $NR_syscalls, %eax + #endif +- ja 1f /* return -ENOSYS (already in pt_regs->ax) */ ++ jae 1f /* return -ENOSYS (already in pt_regs->ax) */ ++ sbb %rcx, %rcx /* array_index_mask_nospec() */ ++ and %rcx, %rax + movq %r10, %rcx + #ifdef CONFIG_RETPOLINE + movq sys_call_table(, %rax, 8), %rax +@@ -276,12 +278,14 @@ tracesys_phase2: + RESTORE_C_REGS_EXCEPT_RAX + RESTORE_EXTRA_REGS + #if __SYSCALL_MASK == ~0 +- cmpq $__NR_syscall_max, %rax ++ cmpq $NR_syscalls, %rax + #else + andl $__SYSCALL_MASK, %eax +- cmpl $__NR_syscall_max, %eax ++ cmpl $NR_syscalls, %eax + #endif +- ja 1f /* return -ENOSYS (already in pt_regs->ax) */ ++ jae 1f /* return -ENOSYS (already in pt_regs->ax) */ ++ sbb %rcx, %rcx /* array_index_mask_nospec() */ ++ and %rcx, %rax + movq %r10, %rcx /* fixup for C */ + #ifdef CONFIG_RETPOLINE + movq sys_call_table(, %rax, 8), %rax +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 66094a0473a8..249f1c769f21 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -195,4 +195,41 @@ static inline void vmexit_fill_RSB(void) + } + + #endif /* __ASSEMBLY__ */ ++ ++/* ++ * Below is used in the eBPF JIT compiler and emits the byte sequence ++ * for the following assembly: ++ * ++ * With retpolines configured: ++ * ++ * callq do_rop ++ * spec_trap: ++ * pause ++ * lfence ++ * jmp spec_trap ++ * do_rop: ++ * mov %rax,(%rsp) ++ * retq ++ * ++ * Without retpolines configured: ++ * ++ * jmp *%rax ++ */ ++#ifdef CONFIG_RETPOLINE ++# define RETPOLINE_RAX_BPF_JIT_SIZE 17 ++# define RETPOLINE_RAX_BPF_JIT() \ ++ EMIT1_off32(0xE8, 7); /* callq do_rop */ \ ++ /* spec_trap: */ \ ++ EMIT2(0xF3, 0x90); /* pause */ \ ++ EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \ ++ EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \ ++ /* do_rop: */ \ ++ EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \ ++ EMIT1(0xC3); /* retq */ ++#else ++# define RETPOLINE_RAX_BPF_JIT_SIZE 2 ++# define RETPOLINE_RAX_BPF_JIT() \ ++ EMIT2(0xFF, 0xE0); /* jmp *%rax */ ++#endif ++ + #endif /* _ASM_X86_NOSPEC_BRANCH_H_ */ +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index a41e523536a2..592e260ba05b 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -91,8 +91,12 @@ out_data: + return NULL; + } + +-static void free_apic_chip_data(struct apic_chip_data *data) ++static void free_apic_chip_data(unsigned int virq, struct apic_chip_data *data) + { ++#ifdef CONFIG_X86_IO_APIC ++ if (virq < nr_legacy_irqs()) ++ legacy_irq_data[virq] = NULL; ++#endif + if (data) { + free_cpumask_var(data->domain); + free_cpumask_var(data->old_domain); +@@ -316,11 +320,7 @@ static void x86_vector_free_irqs(struct irq_domain *domain, + apic_data = irq_data->chip_data; + irq_domain_reset_irq_data(irq_data); + raw_spin_unlock_irqrestore(&vector_lock, flags); +- free_apic_chip_data(apic_data); +-#ifdef CONFIG_X86_IO_APIC +- if (virq + i < nr_legacy_irqs()) +- legacy_irq_data[virq + i] = NULL; +-#endif ++ free_apic_chip_data(virq + i, apic_data); + } + } + } +@@ -361,7 +361,7 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, + err = assign_irq_vector_policy(virq + i, node, data, info); + if (err) { + irq_data->chip_data = NULL; +- free_apic_chip_data(data); ++ free_apic_chip_data(virq + i, data); + goto error; + } + } +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index ecaf7c9baf75..2bbc74f8a4a8 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -175,8 +175,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) + } + + if (i >= ARRAY_SIZE(mitigation_options)) { +- pr_err("unknown option (%s). Switching to AUTO select\n", +- mitigation_options[i].option); ++ pr_err("unknown option (%s). Switching to AUTO select\n", arg); + return SPECTRE_V2_CMD_AUTO; + } + } +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 33c42b826791..a889211e21c5 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + + int bpf_jit_enable __read_mostly; +@@ -269,7 +270,7 @@ static void emit_bpf_tail_call(u8 **pprog) + EMIT2(0x89, 0xD2); /* mov edx, edx */ + EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ + offsetof(struct bpf_array, map.max_entries)); +-#define OFFSET1 43 /* number of bytes to jump */ ++#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */ + EMIT2(X86_JBE, OFFSET1); /* jbe out */ + label1 = cnt; + +@@ -278,7 +279,7 @@ static void emit_bpf_tail_call(u8 **pprog) + */ + EMIT2_off32(0x8B, 0x85, -STACKSIZE + 36); /* mov eax, dword ptr [rbp - 516] */ + EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */ +-#define OFFSET2 32 ++#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE) + EMIT2(X86_JA, OFFSET2); /* ja out */ + label2 = cnt; + EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */ +@@ -292,7 +293,7 @@ static void emit_bpf_tail_call(u8 **pprog) + * goto out; + */ + EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */ +-#define OFFSET3 10 ++#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE) + EMIT2(X86_JE, OFFSET3); /* je out */ + label3 = cnt; + +@@ -305,7 +306,7 @@ static void emit_bpf_tail_call(u8 **pprog) + * rdi == ctx (1st arg) + * rax == prog->bpf_func + prologue_size + */ +- EMIT2(0xFF, 0xE0); /* jmp rax */ ++ RETPOLINE_RAX_BPF_JIT(); + + /* out: */ + BUILD_BUG_ON(cnt - label1 != OFFSET1); +diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c +index 8d626784cd8d..49e4040eeb55 100644 +--- a/drivers/char/tpm/st33zp24/st33zp24.c ++++ b/drivers/char/tpm/st33zp24/st33zp24.c +@@ -485,7 +485,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, + size_t count) + { + int size = 0; +- int expected; ++ u32 expected; + + if (!chip) + return -EBUSY; +@@ -502,7 +502,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, + } + + expected = be32_to_cpu(*(__be32 *)(buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < TPM_HEADER_SIZE) { + size = -EIO; + goto out; + } +diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c +index f2aa99e34b4b..9f12ad74a09b 100644 +--- a/drivers/char/tpm/tpm_i2c_infineon.c ++++ b/drivers/char/tpm/tpm_i2c_infineon.c +@@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) + static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + int size = 0; +- int expected, status; ++ int status; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + size = -EIO; +@@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + expected = be32_to_cpu(*(__be32 *)(buf + 2)); +- if ((size_t) expected > count) { ++ if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) { + size = -EIO; + goto out; + } +diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c +index a1e1474dda30..aedf726cbab6 100644 +--- a/drivers/char/tpm/tpm_i2c_nuvoton.c ++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c +@@ -267,7 +267,11 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) + struct device *dev = chip->dev.parent; + struct i2c_client *client = to_i2c_client(dev); + s32 rc; +- int expected, status, burst_count, retries, size = 0; ++ int status; ++ int burst_count; ++ int retries; ++ int size = 0; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + i2c_nuvoton_ready(chip); /* return to idle */ +@@ -309,7 +313,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) + * to machine native + */ + expected = be32_to_cpu(*(__be32 *) (buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < size) { + dev_err(dev, "%s() expected > count\n", __func__); + size = -EIO; + continue; +diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c +index 68ef8fd9482f..f5c4e009113c 100644 +--- a/drivers/cpufreq/s3c24xx-cpufreq.c ++++ b/drivers/cpufreq/s3c24xx-cpufreq.c +@@ -364,7 +364,13 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name) + static int s3c_cpufreq_init(struct cpufreq_policy *policy) + { + policy->clk = clk_arm; +- return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency); ++ ++ policy->cpuinfo.transition_latency = cpu_cur.info->latency; ++ ++ if (ftab) ++ return cpufreq_table_validate_and_show(policy, ftab); ++ ++ return 0; + } + + static int __init s3c_cpufreq_initclks(void) +diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c +index 92b6798ef5b3..c1c3af089634 100644 +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -149,7 +149,7 @@ void led_blink_set(struct led_classdev *led_cdev, + unsigned long *delay_on, + unsigned long *delay_off) + { +- led_stop_software_blink(led_cdev); ++ del_timer_sync(&led_cdev->blink_timer); + + led_cdev->flags &= ~LED_BLINK_ONESHOT; + led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP; +diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c +index e8b1120f486d..eef3e64ca0a8 100644 +--- a/drivers/leds/led-triggers.c ++++ b/drivers/leds/led-triggers.c +@@ -88,21 +88,23 @@ ssize_t led_trigger_show(struct device *dev, struct device_attribute *attr, + down_read(&led_cdev->trigger_lock); + + if (!led_cdev->trigger) +- len += sprintf(buf+len, "[none] "); ++ len += scnprintf(buf+len, PAGE_SIZE - len, "[none] "); + else +- len += sprintf(buf+len, "none "); ++ len += scnprintf(buf+len, PAGE_SIZE - len, "none "); + + list_for_each_entry(trig, &trigger_list, next_trig) { + if (led_cdev->trigger && !strcmp(led_cdev->trigger->name, + trig->name)) +- len += sprintf(buf+len, "[%s] ", trig->name); ++ len += scnprintf(buf+len, PAGE_SIZE - len, "[%s] ", ++ trig->name); + else +- len += sprintf(buf+len, "%s ", trig->name); ++ len += scnprintf(buf+len, PAGE_SIZE - len, "%s ", ++ trig->name); + } + up_read(&led_cdev->trigger_lock); + up_read(&triggers_list_lock); + +- len += sprintf(len+buf, "\n"); ++ len += scnprintf(len+buf, PAGE_SIZE - len, "\n"); + return len; + } + EXPORT_SYMBOL_GPL(led_trigger_show); +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index 81c5e1a1f363..1b84d2890fbf 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -300,6 +300,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where, + else if (rw & REQ_WRITE_SAME) + special_cmd_max_sectors = q->limits.max_write_same_sectors; + if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) { ++ atomic_inc(&io->count); + dec_count(io, region, -EOPNOTSUPP); + return; + } +diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c +index feeeb70d841e..d14d075ab1d6 100644 +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1281,11 +1281,12 @@ static int m88ds3103_select(struct i2c_adapter *adap, void *mux_priv, u32 chan) + * New users must use I2C client binding directly! + */ + struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, +- struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter) ++ struct i2c_adapter *i2c, ++ struct i2c_adapter **tuner_i2c_adapter) + { + struct i2c_client *client; + struct i2c_board_info board_info; +- struct m88ds3103_platform_data pdata; ++ struct m88ds3103_platform_data pdata = {}; + + pdata.clk = cfg->clock; + pdata.i2c_wr_max = cfg->i2c_wr_max; +@@ -1428,6 +1429,8 @@ static int m88ds3103_probe(struct i2c_client *client, + case M88DS3103_CHIP_ID: + break; + default: ++ ret = -ENODEV; ++ dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id); + goto err_kfree; + } + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index e2decf71c6d1..46448d7e3290 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2952,6 +2952,15 @@ ppp_connect_channel(struct channel *pch, int unit) + goto outl; + + ppp_lock(ppp); ++ spin_lock_bh(&pch->downl); ++ if (!pch->chan) { ++ /* Don't connect unregistered channels */ ++ spin_unlock_bh(&pch->downl); ++ ppp_unlock(ppp); ++ ret = -ENOTCONN; ++ goto outl; ++ } ++ spin_unlock_bh(&pch->downl); + if (pch->file.hdrlen > ppp->file.hdrlen) + ppp->file.hdrlen = pch->file.hdrlen; + hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */ +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index 0d7645581f91..4842344a96f1 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -574,7 +574,10 @@ static void ppp_timer(unsigned long arg) + ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, + 0, NULL); + proto->restart_counter--; +- } else ++ } else if (netif_carrier_ok(proto->dev)) ++ ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, ++ 0, NULL); ++ else + ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0, + 0, NULL); + break; +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 5006cb6ce62d..50030cdf91fb 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -591,6 +591,11 @@ struct qeth_cmd_buffer { + void (*callback) (struct qeth_channel *, struct qeth_cmd_buffer *); + }; + ++static inline struct qeth_ipa_cmd *__ipa_cmd(struct qeth_cmd_buffer *iob) ++{ ++ return (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE); ++} ++ + /** + * definition of a qeth channel, used for read and write + */ +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index e5b9506698b1..75d37148c8cd 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2054,7 +2054,7 @@ int qeth_send_control_data(struct qeth_card *card, int len, + unsigned long flags; + struct qeth_reply *reply = NULL; + unsigned long timeout, event_timeout; +- struct qeth_ipa_cmd *cmd; ++ struct qeth_ipa_cmd *cmd = NULL; + + QETH_CARD_TEXT(card, 2, "sendctl"); + +@@ -2068,23 +2068,27 @@ int qeth_send_control_data(struct qeth_card *card, int len, + } + reply->callback = reply_cb; + reply->param = reply_param; +- if (card->state == CARD_STATE_DOWN) +- reply->seqno = QETH_IDX_COMMAND_SEQNO; +- else +- reply->seqno = card->seqno.ipa++; ++ + init_waitqueue_head(&reply->wait_q); +- spin_lock_irqsave(&card->lock, flags); +- list_add_tail(&reply->list, &card->cmd_waiter_list); +- spin_unlock_irqrestore(&card->lock, flags); + QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN); + + while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ; +- qeth_prepare_control_data(card, len, iob); + +- if (IS_IPA(iob->data)) ++ if (IS_IPA(iob->data)) { ++ cmd = __ipa_cmd(iob); ++ cmd->hdr.seqno = card->seqno.ipa++; ++ reply->seqno = cmd->hdr.seqno; + event_timeout = QETH_IPA_TIMEOUT; +- else ++ } else { ++ reply->seqno = QETH_IDX_COMMAND_SEQNO; + event_timeout = QETH_TIMEOUT; ++ } ++ qeth_prepare_control_data(card, len, iob); ++ ++ spin_lock_irqsave(&card->lock, flags); ++ list_add_tail(&reply->list, &card->cmd_waiter_list); ++ spin_unlock_irqrestore(&card->lock, flags); ++ + timeout = jiffies + event_timeout; + + QETH_CARD_TEXT(card, 6, "noirqpnd"); +@@ -2109,9 +2113,8 @@ int qeth_send_control_data(struct qeth_card *card, int len, + + /* we have only one long running ipassist, since we can ensure + process context of this command we can sleep */ +- cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE); +- if ((cmd->hdr.command == IPA_CMD_SETIP) && +- (cmd->hdr.prot_version == QETH_PROT_IPV4)) { ++ if (cmd && cmd->hdr.command == IPA_CMD_SETIP && ++ cmd->hdr.prot_version == QETH_PROT_IPV4) { + if (!wait_event_timeout(reply->wait_q, + atomic_read(&reply->received), event_timeout)) + goto time_err; +@@ -2877,7 +2880,7 @@ static void qeth_fill_ipacmd_header(struct qeth_card *card, + memset(cmd, 0, sizeof(struct qeth_ipa_cmd)); + cmd->hdr.command = command; + cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST; +- cmd->hdr.seqno = card->seqno.ipa; ++ /* cmd->hdr.seqno is set by qeth_send_control_data() */ + cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type); + cmd->hdr.rel_adapter_no = (__u8) card->info.portno; + if (card->options.layer2) +diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c +index fb3e64d37cb4..6b16b8653d98 100644 +--- a/fs/btrfs/acl.c ++++ b/fs/btrfs/acl.c +@@ -82,12 +82,6 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans, + switch (type) { + case ACL_TYPE_ACCESS: + name = POSIX_ACL_XATTR_ACCESS; +- if (acl) { +- ret = posix_acl_update_mode(inode, &inode->i_mode, &acl); +- if (ret) +- return ret; +- } +- ret = 0; + break; + case ACL_TYPE_DEFAULT: + if (!S_ISDIR(inode->i_mode)) +@@ -123,7 +117,18 @@ out: + + int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type) + { +- return __btrfs_set_acl(NULL, inode, acl, type); ++ int ret; ++ umode_t old_mode = inode->i_mode; ++ ++ if (type == ACL_TYPE_ACCESS && acl) { ++ ret = posix_acl_update_mode(inode, &inode->i_mode, &acl); ++ if (ret) ++ return ret; ++ } ++ ret = __btrfs_set_acl(NULL, inode, acl, type); ++ if (ret) ++ inode->i_mode = old_mode; ++ return ret; + } + + /* +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index b99bced39ac2..4a040862f4bf 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -66,7 +66,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ + \ +- _i &= _mask; \ +- _i; \ ++ (typeof(_i)) (_i & _mask); \ + }) + #endif /* _LINUX_NOSPEC_H */ +diff --git a/include/net/udplite.h b/include/net/udplite.h +index 80761938b9a7..8228155b305e 100644 +--- a/include/net/udplite.h ++++ b/include/net/udplite.h +@@ -62,6 +62,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh) + UDP_SKB_CB(skb)->cscov = cscov; + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->ip_summed = CHECKSUM_NONE; ++ skb->csum_valid = 0; + } + + return 0; +diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c +index efe415ad842a..83bb695f9645 100644 +--- a/net/bridge/br_sysfs_if.c ++++ b/net/bridge/br_sysfs_if.c +@@ -229,6 +229,9 @@ static ssize_t brport_show(struct kobject *kobj, + struct brport_attribute *brport_attr = to_brport_attr(attr); + struct net_bridge_port *p = to_brport(kobj); + ++ if (!brport_attr->show) ++ return -EINVAL; ++ + return brport_attr->show(p, buf); + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index 389807c1c36f..b2f589012c6b 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2183,8 +2183,11 @@ EXPORT_SYMBOL(netif_set_xps_queue); + */ + int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) + { ++ bool disabling; + int rc; + ++ disabling = txq < dev->real_num_tx_queues; ++ + if (txq < 1 || txq > dev->num_tx_queues) + return -EINVAL; + +@@ -2200,15 +2203,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) + if (dev->num_tc) + netif_setup_tc(dev, txq); + +- if (txq < dev->real_num_tx_queues) { ++ dev->real_num_tx_queues = txq; ++ ++ if (disabling) { ++ synchronize_net(); + qdisc_reset_all_tx_gt(dev, txq); + #ifdef CONFIG_XPS + netif_reset_xps_queues_gt(dev, txq); + #endif + } ++ } else { ++ dev->real_num_tx_queues = txq; + } + +- dev->real_num_tx_queues = txq; + return 0; + } + EXPORT_SYMBOL(netif_set_real_num_tx_queues); +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 313e3c11a15a..44abc52bae13 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -640,6 +640,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi) + fi->fib_nh, cfg)) + return 1; + } ++#ifdef CONFIG_IP_ROUTE_CLASSID ++ if (cfg->fc_flow && ++ cfg->fc_flow != fi->fib_nh->nh_tclassid) ++ return 1; ++#endif + if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) && + (!cfg->fc_gw || cfg->fc_gw == fi->fib_nh->nh_gw)) + return 0; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 52d718e3f077..f0020260b0d4 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -126,10 +126,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1)); + static int ip_rt_error_cost __read_mostly = HZ; + static int ip_rt_error_burst __read_mostly = 5 * HZ; + static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ; +-static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; ++static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; + static int ip_rt_min_advmss __read_mostly = 256; + + static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; ++ ++static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; ++ + /* + * Interface to generic destination cache. + */ +@@ -2765,7 +2768,8 @@ static struct ctl_table ipv4_route_table[] = { + .data = &ip_rt_min_pmtu, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &ip_min_valid_pmtu, + }, + { + .procname = "min_adv_mss", +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 301e60829c7e..a98ae890adb9 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1744,6 +1744,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, + err = udplite_checksum_init(skb, uh); + if (err) + return err; ++ ++ if (UDP_SKB_CB(skb)->partial_cov) { ++ skb->csum = inet_compute_pseudo(skb, proto); ++ return 0; ++ } + } + + return skb_checksum_init_zero_check(skb, proto, uh->check, +diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c +index 9a4d7322fb22..391a8fedb27e 100644 +--- a/net/ipv6/ip6_checksum.c ++++ b/net/ipv6/ip6_checksum.c +@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto) + err = udplite_checksum_init(skb, uh); + if (err) + return err; ++ ++ if (UDP_SKB_CB(skb)->partial_cov) { ++ skb->csum = ip6_compute_pseudo(skb, proto); ++ return 0; ++ } + } + + /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels) +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index d17d64edb718..bbba435d0639 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -176,7 +176,7 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn) + #ifdef CONFIG_IPV6_SIT_6RD + struct ip_tunnel *t = netdev_priv(dev); + +- if (t->dev == sitn->fb_tunnel_dev) { ++ if (dev == sitn->fb_tunnel_dev) { + ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0); + t->ip6rd.relay_prefix = 0; + t->ip6rd.prefixlen = 16; +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index 52cfc4478511..c2ce7dec5198 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -714,6 +715,22 @@ errout: + return err; + } + ++static bool mpls_label_ok(struct net *net, unsigned int *index) ++{ ++ bool is_ok = true; ++ ++ /* Reserved labels may not be set */ ++ if (*index < MPLS_LABEL_FIRST_UNRESERVED) ++ is_ok = false; ++ ++ /* The full 20 bit range may not be supported. */ ++ if (is_ok && *index >= net->mpls.platform_labels) ++ is_ok = false; ++ ++ *index = array_index_nospec(*index, net->mpls.platform_labels); ++ return is_ok; ++} ++ + static int mpls_route_add(struct mpls_route_config *cfg) + { + struct mpls_route __rcu **platform_label; +@@ -732,12 +749,7 @@ static int mpls_route_add(struct mpls_route_config *cfg) + index = find_free_label(net); + } + +- /* Reserved labels may not be set */ +- if (index < MPLS_LABEL_FIRST_UNRESERVED) +- goto errout; +- +- /* The full 20 bit range may not be supported. */ +- if (index >= net->mpls.platform_labels) ++ if (!mpls_label_ok(net, &index)) + goto errout; + + /* Append makes no sense with mpls */ +@@ -798,12 +810,7 @@ static int mpls_route_del(struct mpls_route_config *cfg) + + index = cfg->rc_label; + +- /* Reserved labels may not be removed */ +- if (index < MPLS_LABEL_FIRST_UNRESERVED) +- goto errout; +- +- /* The full 20 bit range may not be supported */ +- if (index >= net->mpls.platform_labels) ++ if (!mpls_label_ok(net, &index)) + goto errout; + + mpls_route_update(net, index, NULL, &cfg->rc_nlinfo); +@@ -1162,10 +1169,9 @@ static int rtm_to_route_config(struct sk_buff *skb, struct nlmsghdr *nlh, + &cfg->rc_label)) + goto errout; + +- /* Reserved labels may not be set */ +- if (cfg->rc_label < MPLS_LABEL_FIRST_UNRESERVED) ++ if (!mpls_label_ok(cfg->rc_nlinfo.nl_net, ++ &cfg->rc_label)) + goto errout; +- + break; + } + case RTA_VIA: +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 8e63662c6fb0..30c46aaf4575 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1118,6 +1118,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + { + struct sk_buff *tmp; + struct net *net, *prev = NULL; ++ bool delivered = false; + int err; + + for_each_net_rcu(net) { +@@ -1129,14 +1130,21 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + } + err = nlmsg_multicast(prev->genl_sock, tmp, + portid, group, flags); +- if (err) ++ if (!err) ++ delivered = true; ++ else if (err != -ESRCH) + goto error; + } + + prev = net; + } + +- return nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); ++ err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); ++ if (!err) ++ delivered = true; ++ else if (err != -ESRCH) ++ goto error; ++ return delivered ? 0 : -ESRCH; + error: + kfree_skb(skb); + return err; +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 8a61ccc37e12..481806b43de8 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -323,8 +323,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); + bdst = ip6_dst_lookup_flow(sk, fl6, final_p); + +- if (!IS_ERR(bdst) && +- ipv6_chk_addr(dev_net(bdst->dev), ++ if (IS_ERR(bdst)) ++ continue; ++ ++ if (ipv6_chk_addr(dev_net(bdst->dev), + &laddr->a.v6.sin6_addr, bdst->dev, 1)) { + if (!IS_ERR_OR_NULL(dst)) + dst_release(dst); +@@ -333,8 +335,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + } + + bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); +- if (matchlen > bmatchlen) ++ if (matchlen > bmatchlen) { ++ dst_release(bdst); + continue; ++ } + + if (!IS_ERR_OR_NULL(dst)) + dst_release(dst); +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 8b4ff315695e..dc030efa4447 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -508,22 +508,20 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + if (IS_ERR(rt)) + continue; + +- if (!dst) +- dst = &rt->dst; +- + /* Ensure the src address belongs to the output + * interface. + */ + odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr, + false); + if (!odev || odev->ifindex != fl4->flowi4_oif) { +- if (&rt->dst != dst) ++ if (!dst) ++ dst = &rt->dst; ++ else + dst_release(&rt->dst); + continue; + } + +- if (dst != &rt->dst) +- dst_release(dst); ++ dst_release(dst); + dst = &rt->dst; + break; + } +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 5d6a03fad378..4ca31e052dd8 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1367,10 +1367,14 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, + sctp_chunkhdr_t *chunk_hdr; + struct sk_buff *skb; + struct sock *sk; ++ int chunklen; ++ ++ chunklen = sizeof(*chunk_hdr) + paylen; ++ if (chunklen > SCTP_MAX_CHUNK_LEN) ++ goto nodata; + + /* No need to allocate LL here, as this is only a chunk. */ +- skb = alloc_skb(WORD_ROUND(sizeof(sctp_chunkhdr_t) + paylen), +- GFP_ATOMIC); ++ skb = alloc_skb(chunklen, GFP_ATOMIC); + if (!skb) + goto nodata; + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 20512fe32a97..e2212830df0c 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -179,7 +179,7 @@ static const struct kernel_param_ops param_ops_xint = { + }; + #define param_check_xint param_check_int + +-static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; ++static int power_save = -1; + module_param(power_save, xint, 0644); + MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " + "(in second, 0 = disable)."); +@@ -2055,6 +2055,24 @@ out_free: + return err; + } + ++#ifdef CONFIG_PM ++/* On some boards setting power_save to a non 0 value leads to clicking / ++ * popping sounds when ever we enter/leave powersaving mode. Ideally we would ++ * figure out how to avoid these sounds, but that is not always feasible. ++ * So we keep a list of devices where we disable powersaving as its known ++ * to causes problems on these devices. ++ */ ++static struct snd_pci_quirk power_save_blacklist[] = { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ ++ SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ ++ SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ ++ SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), ++ {} ++}; ++#endif /* CONFIG_PM */ ++ + /* number of codec slots for each chipset: 0 = default slots (i.e. 4) */ + static unsigned int azx_max_codecs[AZX_NUM_DRIVERS] = { + [AZX_DRIVER_NVIDIA] = 8, +@@ -2067,6 +2085,7 @@ static int azx_probe_continue(struct azx *chip) + struct hdac_bus *bus = azx_bus(chip); + struct pci_dev *pci = chip->pci; + int dev = chip->dev_index; ++ int val; + int err; + + hda->probe_continued = 1; +@@ -2142,7 +2161,22 @@ static int azx_probe_continue(struct azx *chip) + + chip->running = 1; + azx_add_card_list(chip); +- snd_hda_set_power_save(&chip->bus, power_save * 1000); ++ ++ val = power_save; ++#ifdef CONFIG_PM ++ if (val == -1) { ++ const struct snd_pci_quirk *q; ++ ++ val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; ++ q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); ++ if (q && val) { ++ dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", ++ q->subvendor, q->subdevice); ++ val = 0; ++ } ++ } ++#endif /* CONFIG_PM */ ++ snd_hda_set_power_save(&chip->bus, val * 1000); + if (azx_has_pm_runtime(chip) || hda->use_vga_switcheroo) + pm_runtime_put_noidle(&pci->dev); + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 8a59d4782a0f..69bf5cf1e91e 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3277,4 +3277,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + }, + ++{ ++ /* ++ * Bower's & Wilkins PX headphones only support the 48 kHz sample rate ++ * even though it advertises more. The capture interface doesn't work ++ * even on windows. ++ */ ++ USB_DEVICE(0x19b5, 0x0021), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_MIXER, ++ }, ++ /* Capture */ ++ { ++ .ifnum = 1, ++ .type = QUIRK_IGNORE_INTERFACE, ++ }, ++ /* Playback */ ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S16_LE, ++ .channels = 2, ++ .iface = 2, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .attributes = UAC_EP_CS_ATTR_FILL_MAX | ++ UAC_EP_CS_ATTR_SAMPLE_RATE, ++ .endpoint = 0x03, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { ++ 48000 ++ } ++ } ++ }, ++ } ++ } ++}, ++ + #undef USB_DEVICE_VENDOR_SPEC +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index d080f06fd8d9..b814ae6822b6 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -902,8 +902,7 @@ int __kvm_set_memory_region(struct kvm *kvm, + /* Check for overlaps */ + r = -EEXIST; + kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) { +- if ((slot->id >= KVM_USER_MEM_SLOTS) || +- (slot->id == id)) ++ if (slot->id == id) + continue; + if (!((base_gfn + npages <= slot->base_gfn) || + (base_gfn >= slot->base_gfn + slot->npages))) diff --git a/patch/kernel/mvebu-default/04-patch-4.4.121-122.patch b/patch/kernel/mvebu-default/04-patch-4.4.121-122.patch new file mode 100644 index 000000000..1488cb1cb --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.121-122.patch @@ -0,0 +1,2177 @@ +diff --git a/Makefile b/Makefile +index 0e22e4eb85cc..3eb21d269b42 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 121 ++SUBLEVEL = 122 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 5562c5feb0be..80f6c786a37e 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -90,8 +90,6 @@ + }; + + &i2c1 { +- pinctrl-names = "default"; +- pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -148,12 +146,6 @@ + OMAP3630_CORE2_IOPAD(0x25da, PIN_INPUT_PULLUP | MUX_MODE2) /* etk_ctl.sdmmc3_cmd */ + >; + }; +- i2c1_pins: pinmux_i2c1_pins { +- pinctrl-single,pins = < +- OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ +- OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ +- >; +- }; + }; + + #include "twl4030.dtsi" +diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c +index 9ff92050053c..fa7f308c9027 100644 +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,7 @@ phys_addr_t omap_secure_ram_mempool_base(void) + return omap_secure_memblock_base; + } + ++#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM) + u32 omap3_save_secure_ram(void __iomem *addr, int size) + { + u32 ret; +@@ -91,6 +92,7 @@ u32 omap3_save_secure_ram(void __iomem *addr, int size) + + return ret; + } ++#endif + + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls +diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c +index 9ab48ff80c1c..6d11ae581ea7 100644 +--- a/arch/mips/ath25/board.c ++++ b/arch/mips/ath25/board.c +@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t base, unsigned long size) + } + + board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL); ++ if (!board_data) ++ goto error; + ath25_board.config = (struct ath25_boarddata *)board_data; + memcpy_fromio(board_data, bcfg, 0x100); + if (broken_boarddata) { +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index 4f9eb0576884..10d0b2140375 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -2246,6 +2246,8 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + } + + host_data = kzalloc(sizeof(*host_data), GFP_KERNEL); ++ if (!host_data) ++ return -ENOMEM; + raw_spin_lock_init(&host_data->lock); + + addr = of_get_address(ciu_node, 0, NULL, NULL); +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 78cf8c2f1de0..4874712b475e 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -166,11 +166,11 @@ static void bmips_prepare_cpus(unsigned int max_cpus) + return; + } + +- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi0", NULL)) ++ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL)) + panic("Can't request IPI0 interrupt"); +- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi1", NULL)) ++ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL)) + panic("Can't request IPI1 interrupt"); + } + +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 364fbad72e60..6edb9530d7e9 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -60,6 +60,9 @@ static DEFINE_MUTEX(mce_chrdev_read_mutex); + smp_load_acquire(&(p)); \ + }) + ++/* sysfs synchronization */ ++static DEFINE_MUTEX(mce_sysfs_mutex); ++ + #define CREATE_TRACE_POINTS + #include + +@@ -2220,6 +2223,7 @@ static ssize_t set_ignore_ce(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.ignore_ce ^ !!new) { + if (new) { + /* disable ce features */ +@@ -2232,6 +2236,8 @@ static ssize_t set_ignore_ce(struct device *s, + on_each_cpu(mce_enable_ce, (void *)1, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2244,6 +2250,7 @@ static ssize_t set_cmci_disabled(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.cmci_disabled ^ !!new) { + if (new) { + /* disable cmci */ +@@ -2255,6 +2262,8 @@ static ssize_t set_cmci_disabled(struct device *s, + on_each_cpu(mce_enable_ce, NULL, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2262,8 +2271,19 @@ static ssize_t store_int_with_restart(struct device *s, + struct device_attribute *attr, + const char *buf, size_t size) + { +- ssize_t ret = device_store_int(s, attr, buf, size); ++ unsigned long old_check_interval = check_interval; ++ ssize_t ret = device_store_ulong(s, attr, buf, size); ++ ++ if (check_interval == old_check_interval) ++ return ret; ++ ++ if (check_interval < 1) ++ check_interval = 1; ++ ++ mutex_lock(&mce_sysfs_mutex); + mce_restart(); ++ mutex_unlock(&mce_sysfs_mutex); ++ + return ret; + } + +diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c +index 819ab3f9c9c7..ca6e65250b1a 100644 +--- a/arch/x86/kernel/machine_kexec_64.c ++++ b/arch/x86/kernel/machine_kexec_64.c +@@ -519,6 +519,7 @@ int arch_kexec_apply_relocations_add(const Elf64_Ehdr *ehdr, + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + value -= (u64)address; + *(u32 *)location = value; + break; +diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c +index 005c03e93fc5..94779f66bf49 100644 +--- a/arch/x86/kernel/module.c ++++ b/arch/x86/kernel/module.c +@@ -170,19 +170,28 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + case R_X86_64_NONE: + break; + case R_X86_64_64: ++ if (*(u64 *)loc != 0) ++ goto invalid_relocation; + *(u64 *)loc = val; + break; + case R_X86_64_32: ++ if (*(u32 *)loc != 0) ++ goto invalid_relocation; + *(u32 *)loc = val; + if (val != *(u32 *)loc) + goto overflow; + break; + case R_X86_64_32S: ++ if (*(s32 *)loc != 0) ++ goto invalid_relocation; + *(s32 *)loc = val; + if ((s64)val != *(s32 *)loc) + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: ++ if (*(u32 *)loc != 0) ++ goto invalid_relocation; + val -= (u64)loc; + *(u32 *)loc = val; + #if 0 +@@ -198,6 +207,11 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + } + return 0; + ++invalid_relocation: ++ pr_err("x86/modules: Skipping invalid relocation target, existing value is nonzero for type %d, loc %p, val %Lx\n", ++ (int)ELF64_R_TYPE(rel[i].r_info), loc, val); ++ return -ENOEXEC; ++ + overflow: + pr_err("overflow in relocation type %d val %Lx\n", + (int)ELF64_R_TYPE(rel[i].r_info), val); +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index 73eb7fd4aec4..5b6c8486a0be 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -769,9 +769,12 @@ static int do_reloc64(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym, + break; + + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + /* + * PC relative relocations don't need to be adjusted unless + * referencing a percpu symbol. ++ * ++ * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32. + */ + if (is_percpu_sym(sym, symname)) + add_reloc(&relocs32neg, offset); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 1c36de9719e5..3e65ae144fde 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -263,7 +263,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos) + struct iov_iter i; + ssize_t bw; + +- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len); ++ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len); + + file_start_write(file); + bw = vfs_iter_write(file, &i, ppos); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index a142d5ae148d..5c40d6d710af 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -585,6 +585,9 @@ int amdgpu_acpi_pcie_performance_request(struct amdgpu_device *adev, + size_t size; + u32 retry = 3; + ++ if (amdgpu_acpi_pcie_notify_device_ready(adev)) ++ return -EINVAL; ++ + /* Get the device handle */ + handle = ACPI_HANDLE(&adev->pdev->dev); + if (!handle) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 930083336968..6470c9aa1351 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -739,9 +739,11 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder); +@@ -760,8 +762,12 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + amdgpu_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -862,9 +868,11 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = amdgpu_connector_best_single_encoder(connector); + if (!encoder) +@@ -918,8 +926,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + amdgpu_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -981,9 +991,11 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1108,8 +1120,10 @@ out: + amdgpu_connector_update_scratch_regs(connector, ret); + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1351,9 +1365,11 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector); + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1421,8 +1437,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + + amdgpu_connector_update_scratch_regs(connector, ret); + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index b57fffc2d4af..0a91261b6f5b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -2104,34 +2104,8 @@ static void gfx_v7_0_gpu_init(struct amdgpu_device *adev) + case CHIP_KAVERI: + adev->gfx.config.max_shader_engines = 1; + adev->gfx.config.max_tile_pipes = 4; +- if ((adev->pdev->device == 0x1304) || +- (adev->pdev->device == 0x1305) || +- (adev->pdev->device == 0x130C) || +- (adev->pdev->device == 0x130F) || +- (adev->pdev->device == 0x1310) || +- (adev->pdev->device == 0x1311) || +- (adev->pdev->device == 0x131C)) { +- adev->gfx.config.max_cu_per_sh = 8; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1309) || +- (adev->pdev->device == 0x130A) || +- (adev->pdev->device == 0x130D) || +- (adev->pdev->device == 0x1313) || +- (adev->pdev->device == 0x131D)) { +- adev->gfx.config.max_cu_per_sh = 6; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1306) || +- (adev->pdev->device == 0x1307) || +- (adev->pdev->device == 0x130B) || +- (adev->pdev->device == 0x130E) || +- (adev->pdev->device == 0x1315) || +- (adev->pdev->device == 0x131B)) { +- adev->gfx.config.max_cu_per_sh = 4; +- adev->gfx.config.max_backends_per_se = 1; +- } else { +- adev->gfx.config.max_cu_per_sh = 3; +- adev->gfx.config.max_backends_per_se = 1; +- } ++ adev->gfx.config.max_cu_per_sh = 8; ++ adev->gfx.config.max_backends_per_se = 2; + adev->gfx.config.max_sh_per_se = 1; + adev->gfx.config.max_texture_channel_caches = 4; + adev->gfx.config.max_gprs = 256; +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index f8b5fcfa91a2..1fe4b8e6596b 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -411,6 +411,26 @@ out: + schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD); + } + ++/** ++ * drm_kms_helper_is_poll_worker - is %current task an output poll worker? ++ * ++ * Determine if %current task is an output poll worker. This can be used ++ * to select distinct code paths for output polling versus other contexts. ++ * ++ * One use case is to avoid a deadlock between the output poll worker and ++ * the autosuspend worker wherein the latter waits for polling to finish ++ * upon calling drm_kms_helper_poll_disable(), while the former waits for ++ * runtime suspend to finish upon calling pm_runtime_get_sync() in a ++ * connector ->detect hook. ++ */ ++bool drm_kms_helper_is_poll_worker(void) ++{ ++ struct work_struct *work = current_work(); ++ ++ return work && work->func == output_poll_execute; ++} ++EXPORT_SYMBOL(drm_kms_helper_is_poll_worker); ++ + /** + * drm_kms_helper_poll_disable - disable output polling + * @dev: drm_device +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 2a5ed7460354..ababdaabe870 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -253,9 +253,15 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + nv_connector->edid = NULL; + } + +- ret = pm_runtime_get_sync(connector->dev->dev); +- if (ret < 0 && ret != -EACCES) +- return conn_status; ++ /* Outputs are only polled while runtime active, so acquiring a ++ * runtime PM ref here is unnecessary (and would deadlock upon ++ * runtime suspend because it waits for polling to finish). ++ */ ++ if (!drm_kms_helper_is_poll_worker()) { ++ ret = pm_runtime_get_sync(connector->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return conn_status; ++ } + + nv_encoder = nouveau_connector_ddc_detect(connector); + if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) { +@@ -323,8 +329,10 @@ detect_analog: + + out: + +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return conn_status; + } +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 134874cab4c7..80b6d6e4721a 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -3599,35 +3599,8 @@ static void cik_gpu_init(struct radeon_device *rdev) + case CHIP_KAVERI: + rdev->config.cik.max_shader_engines = 1; + rdev->config.cik.max_tile_pipes = 4; +- if ((rdev->pdev->device == 0x1304) || +- (rdev->pdev->device == 0x1305) || +- (rdev->pdev->device == 0x130C) || +- (rdev->pdev->device == 0x130F) || +- (rdev->pdev->device == 0x1310) || +- (rdev->pdev->device == 0x1311) || +- (rdev->pdev->device == 0x131C)) { +- rdev->config.cik.max_cu_per_sh = 8; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1309) || +- (rdev->pdev->device == 0x130A) || +- (rdev->pdev->device == 0x130D) || +- (rdev->pdev->device == 0x1313) || +- (rdev->pdev->device == 0x131D)) { +- rdev->config.cik.max_cu_per_sh = 6; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1306) || +- (rdev->pdev->device == 0x1307) || +- (rdev->pdev->device == 0x130B) || +- (rdev->pdev->device == 0x130E) || +- (rdev->pdev->device == 0x1315) || +- (rdev->pdev->device == 0x1318) || +- (rdev->pdev->device == 0x131B)) { +- rdev->config.cik.max_cu_per_sh = 4; +- rdev->config.cik.max_backends_per_se = 1; +- } else { +- rdev->config.cik.max_cu_per_sh = 3; +- rdev->config.cik.max_backends_per_se = 1; +- } ++ rdev->config.cik.max_cu_per_sh = 8; ++ rdev->config.cik.max_backends_per_se = 2; + rdev->config.cik.max_sh_per_se = 1; + rdev->config.cik.max_texture_channel_caches = 4; + rdev->config.cik.max_gprs = 256; +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 30f00748ed37..3feaab94f358 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -891,9 +891,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +@@ -916,8 +918,12 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1020,9 +1026,11 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1089,8 +1097,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + radeon_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1153,9 +1163,11 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (!radeon_connector->dac_load_detect) + return ret; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1167,8 +1179,12 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (ret == connector_status_connected) + ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false); + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1230,9 +1246,11 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (radeon_connector->detected_hpd_without_ddc) { + force = true; +@@ -1415,8 +1433,10 @@ out: + } + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1666,9 +1686,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + if (radeon_dig_connector->is_mst) + return connector_status_disconnected; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && radeon_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1755,8 +1777,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + } + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 886f61ea6cc7..cdac2c9421ab 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1138,6 +1138,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (cmd.qp_state > IB_QPS_ERR) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -1274,6 +1277,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) ++ return -EINVAL; ++ + optval = memdup_user((void __user *) (unsigned long) cmd.optval, + cmd.optlen); + if (IS_ERR(optval)) { +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 02c8deab1fff..4a4ab433062f 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -972,7 +972,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, + if (ucmd.reserved0 || ucmd.reserved1) + return -EINVAL; + +- umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size, ++ /* check multiplication overflow */ ++ if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1) ++ return -EINVAL; ++ ++ umem = ib_umem_get(context, ucmd.buf_addr, ++ (size_t)ucmd.cqe_size * entries, + IB_ACCESS_LOCAL_WRITE, 1); + if (IS_ERR(umem)) { + err = PTR_ERR(umem); +diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c +index 7f12b6579f82..795fa353de7c 100644 +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -216,8 +216,10 @@ static void matrix_keypad_stop(struct input_dev *dev) + { + struct matrix_keypad *keypad = input_get_drvdata(dev); + ++ spin_lock_irq(&keypad->lock); + keypad->stopped = true; +- mb(); ++ spin_unlock_irq(&keypad->lock); ++ + flush_work(&keypad->work.work); + /* + * matrix_keypad_scan() will leave IRQs enabled; +diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c +index 3048ef3e3e16..a5e8998047fe 100644 +--- a/drivers/input/keyboard/tca8418_keypad.c ++++ b/drivers/input/keyboard/tca8418_keypad.c +@@ -189,8 +189,6 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) + input_event(input, EV_MSC, MSC_SCAN, code); + input_report_key(input, keymap[code], state); + +- /* Read for next loop */ +- error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); + } while (1); + + input_sync(input); +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 8eaadd9869bc..be8307550bd7 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -935,6 +935,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; + char buf[BDEVNAME_SIZE]; ++ struct cached_dev *exist_dc, *t; + + bdevname(dc->bdev, buf); + +@@ -958,6 +959,16 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + return -EINVAL; + } + ++ /* Check whether already attached */ ++ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) { ++ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) { ++ pr_err("Tried to attach %s but duplicate UUID already attached", ++ buf); ++ ++ return -EINVAL; ++ } ++ } ++ + u = uuid_find(c, dc->sb.uuid); + + if (u && +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index ea2777e1ee10..bc630a719776 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -226,7 +226,7 @@ static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val) + static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg, + u8 mask, u8 val) + { +- i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); ++ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1); + } + + static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg) +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 3ea4c022cbb9..ccdb3dd74421 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -265,6 +265,12 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) + vol->last_eb_bytes = vol->usable_leb_size; + } + ++ /* Make volume "available" before it becomes accessible via sysfs */ ++ spin_lock(&ubi->volumes_lock); ++ ubi->volumes[vol_id] = vol; ++ ubi->vol_count += 1; ++ spin_unlock(&ubi->volumes_lock); ++ + /* Register character device for the volume */ + cdev_init(&vol->cdev, &ubi_vol_cdev_operations); + vol->cdev.owner = THIS_MODULE; +@@ -304,11 +310,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) + if (err) + goto out_sysfs; + +- spin_lock(&ubi->volumes_lock); +- ubi->volumes[vol_id] = vol; +- ubi->vol_count += 1; +- spin_unlock(&ubi->volumes_lock); +- + ubi_volume_notify(ubi, vol, UBI_VOLUME_ADDED); + self_check_volumes(ubi); + return err; +@@ -328,6 +329,10 @@ out_sysfs: + out_cdev: + cdev_del(&vol->cdev); + out_mapping: ++ spin_lock(&ubi->volumes_lock); ++ ubi->volumes[vol_id] = NULL; ++ ubi->vol_count -= 1; ++ spin_unlock(&ubi->volumes_lock); + if (do_free) + kfree(vol->eba_tbl); + out_acc: +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index e197c6f39de2..aa18c729d23a 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -365,6 +365,7 @@ qla24xx_abort_sp_done(void *data, void *ptr, int res) + srb_t *sp = (srb_t *)ptr; + struct srb_iocb *abt = &sp->u.iocb_cmd; + ++ del_timer(&sp->u.iocb_cmd.timer); + complete(&abt->u.abt.comp); + } + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index e6faa0b050d1..824e27eec7a1 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -5502,7 +5502,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha, + fc_port_t *fcport; + int rc; + +- fcport = kzalloc(sizeof(*fcport), GFP_KERNEL); ++ fcport = qla2x00_alloc_fcport(vha, GFP_KERNEL); + if (!fcport) { + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf06f, + "qla_target(%d): Allocation of tmp FC port failed", +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index ec31b53ae3a5..f5b5bec6f3c1 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -330,24 +330,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) + mutex_lock(&ashmem_mutex); + + if (asma->size == 0) { +- ret = -EINVAL; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EINVAL; + } + + if (!asma->file) { +- ret = -EBADF; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EBADF; + } + ++ mutex_unlock(&ashmem_mutex); ++ + ret = vfs_llseek(asma->file, offset, origin); + if (ret < 0) +- goto out; ++ return ret; + + /** Copy f_pos from backing file, since f_ops->llseek() sets it */ + file->f_pos = asma->file->f_pos; +- +-out: +- mutex_unlock(&ashmem_mutex); + return ret; + } + +diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c +index b63dd2ef78b5..1f398d06f4ee 100644 +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -484,8 +484,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s, + struct comedi_cmd *cmd = &async->cmd; + + if (cmd->stop_src == TRIG_COUNT) { +- unsigned int nscans = nsamples / cmd->scan_end_arg; +- unsigned int scans_left = __comedi_nscans_left(s, nscans); ++ unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg); + unsigned int scan_pos = + comedi_bytes_to_samples(s, async->scan_progress); + unsigned long long samples_left = 0; +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 7025f47fa284..746c76b358a0 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -5299,6 +5299,17 @@ static struct pci_device_id serial_pci_tbl[] = { + { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ + pbn_b2_4_115200 }, ++ /* ++ * BrainBoxes UC-260 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0D21, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0E34, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, + /* + * Perle PCI-RAS cards + */ +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 53e4d5056db7..e0277cf0bf58 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1783,6 +1783,7 @@ static void atmel_get_ip_name(struct uart_port *port) + switch (version) { + case 0x302: + case 0x10213: ++ case 0x10302: + dev_dbg(port->dev, "This version is usart\n"); + atmel_port->is_usart = true; + break; +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 80d0ffe7abc1..fc7711c75b01 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -847,6 +847,8 @@ static void sci_receive_chars(struct uart_port *port) + /* Tell the rest of the system the news. New characters! */ + tty_flip_buffer_push(tport); + } else { ++ /* TTY buffers full; read from RX reg to prevent lockup */ ++ serial_port_in(port, SCxRDR); + serial_port_in(port, SCxSR); /* dummy read */ + sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port)); + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 8e641b5893ed..29adabdb305f 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -147,6 +147,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, + + ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout); + ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); ++ + kfree(dr); + + return ret; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 774c97bb1c08..4f1c6f8d4352 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -229,7 +229,8 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Corsair Strafe RGB */ +- { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, + + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 51c2b05b5dd9..7deebd0b21ae 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1333,7 +1333,6 @@ ffs_fs_kill_sb(struct super_block *sb) + if (sb->s_fs_info) { + ffs_release_dev(sb->s_fs_info); + ffs_data_closed(sb->s_fs_info); +- ffs_data_put(sb->s_fs_info); + } + } + +diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c +index ad408251d955..108dcc5f5350 100644 +--- a/drivers/usb/mon/mon_text.c ++++ b/drivers/usb/mon/mon_text.c +@@ -82,6 +82,8 @@ struct mon_reader_text { + + wait_queue_head_t wait; + int printf_size; ++ size_t printf_offset; ++ size_t printf_togo; + char *printf_buf; + struct mutex printf_lock; + +@@ -373,73 +375,103 @@ err_alloc: + return rc; + } + +-/* +- * For simplicity, we read one record in one system call and throw out +- * what does not fit. This means that the following does not work: +- * dd if=/dbg/usbmon/0t bs=10 +- * Also, we do not allow seeks and do not bother advancing the offset. +- */ ++static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp, ++ char __user * const buf, const size_t nbytes) ++{ ++ const size_t togo = min(nbytes, rp->printf_togo); ++ ++ if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo)) ++ return -EFAULT; ++ rp->printf_togo -= togo; ++ rp->printf_offset += togo; ++ return togo; ++} ++ ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_t(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; +- +- mon_text_read_head_t(rp, &ptr, ep); +- mon_text_read_statset(rp, &ptr, ep); +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); +- +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_t(rp, &ptr, ep); ++ mon_text_read_statset(rp, &ptr, ep); ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); ++ } ++ ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_u(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- if (IS_ERR(ep = mon_text_read_wait(rp, file))) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; + +- mon_text_read_head_u(rp, &ptr, ep); +- if (ep->type == 'E') { +- mon_text_read_statset(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { +- mon_text_read_isostat(rp, &ptr, ep); +- mon_text_read_isodesc(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { +- mon_text_read_intstat(rp, &ptr, ep); +- } else { +- mon_text_read_statset(rp, &ptr, ep); ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_u(rp, &ptr, ep); ++ if (ep->type == 'E') { ++ mon_text_read_statset(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { ++ mon_text_read_isostat(rp, &ptr, ep); ++ mon_text_read_isodesc(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { ++ mon_text_read_intstat(rp, &ptr, ep); ++ } else { ++ mon_text_read_statset(rp, &ptr, ep); ++ } ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); + } +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); + +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + + static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp, +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index de7214ae4fed..6cac8f26b97a 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1052,7 +1052,7 @@ static int uas_post_reset(struct usb_interface *intf) + return 0; + + err = uas_configure_endpoints(devinfo); +- if (err && err != ENODEV) ++ if (err && err != -ENODEV) + shost_printk(KERN_ERR, shost, + "%s: alloc streams error %d after reset", + __func__, err); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index c10eceb76c39..1a34d2a89de6 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2142,6 +2142,13 @@ UNUSUAL_DEV( 0x22b8, 0x3010, 0x0001, 0x0001, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ), + ++/* Reported by Teijo Kinnunen */ ++UNUSUAL_DEV( 0x152d, 0x2567, 0x0117, 0x0117, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Reported-by George Cherian */ + UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, + "JMicron", +diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c +index 286369d4f0f5..be99112fad00 100644 +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -51,6 +51,7 @@ static char expect_release; + static unsigned long hpwdt_is_open; + + static void __iomem *pci_mem_addr; /* the PCI-memory address */ ++static unsigned long __iomem *hpwdt_nmistat; + static unsigned long __iomem *hpwdt_timer_reg; + static unsigned long __iomem *hpwdt_timer_con; + +@@ -474,6 +475,11 @@ static int hpwdt_time_left(void) + } + + #ifdef CONFIG_HPWDT_NMI_DECODING ++static int hpwdt_my_nmi(void) ++{ ++ return ioread8(hpwdt_nmistat) & 0x6; ++} ++ + /* + * NMI Handler + */ +@@ -485,6 +491,9 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs) + if (!hpwdt_nmi_decoding) + goto out; + ++ if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi()) ++ return NMI_DONE; ++ + spin_lock_irqsave(&rom_lock, rom_pl); + if (!die_nmi_called && !is_icru && !is_uefi) + asminline_call(&cmn_regs, cru_rom_addr); +@@ -700,7 +709,7 @@ static void dmi_find_icru(const struct dmi_header *dm, void *dummy) + smbios_proliant_ptr = (struct smbios_proliant_info *) dm; + if (smbios_proliant_ptr->misc_features & 0x01) + is_icru = 1; +- if (smbios_proliant_ptr->misc_features & 0x408) ++ if (smbios_proliant_ptr->misc_features & 0x1400) + is_uefi = 1; + } + } +@@ -840,6 +849,7 @@ static int hpwdt_init_one(struct pci_dev *dev, + retval = -ENOMEM; + goto error_pci_iomap; + } ++ hpwdt_nmistat = pci_mem_addr + 0x6e; + hpwdt_timer_reg = pci_mem_addr + 0x70; + hpwdt_timer_con = pci_mem_addr + 0x72; + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 7c23363ecf19..8d661b3c47b6 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -828,8 +828,6 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode, + if (!IS_LAST_ENTRY(s->first)) + ext4_xattr_rehash(header(s->base), + s->here); +- ext4_xattr_cache_insert(ext4_mb_cache, +- bs->bh); + } + unlock_buffer(bs->bh); + if (error == -EFSCORRUPTED) +@@ -918,6 +916,7 @@ inserted: + } else if (bs->bh && s->base == bs->bh->b_data) { + /* We were modifying this block in-place. */ + ea_bdebug(bs->bh, "keeping this block"); ++ ext4_xattr_cache_insert(ext4_mb_cache, bs->bh); + new_bh = bs->bh; + get_bh(new_bh); + } else { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 5fd3cf54b2b3..211440722e24 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -86,9 +86,9 @@ struct nfs_direct_req { + struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX]; + int mirror_count; + ++ loff_t io_start; /* Start offset for I/O */ + ssize_t count, /* bytes actually processed */ + bytes_left, /* bytes left to be sent */ +- io_start, /* start of IO */ + error; /* any reported error */ + struct completion completion; /* wait for i/o completion */ + +diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h +index 3febb4b9fce9..d842bec3d271 100644 +--- a/include/drm/drm_crtc_helper.h ++++ b/include/drm/drm_crtc_helper.h +@@ -241,5 +241,6 @@ extern void drm_kms_helper_hotplug_event(struct drm_device *dev); + extern void drm_kms_helper_poll_disable(struct drm_device *dev); + extern void drm_kms_helper_poll_enable(struct drm_device *dev); + extern void drm_kms_helper_poll_enable_locked(struct drm_device *dev); ++extern bool drm_kms_helper_is_poll_worker(void); + + #endif +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index d6c53fce006b..53e361a9af79 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -368,38 +368,14 @@ static inline unsigned long ifname_compare_aligned(const char *_a, + return ret; + } + ++struct xt_percpu_counter_alloc_state { ++ unsigned int off; ++ const char __percpu *mem; ++}; + +-/* On SMP, ip(6)t_entry->counters.pcnt holds address of the +- * real (percpu) counter. On !SMP, its just the packet count, +- * so nothing needs to be done there. +- * +- * xt_percpu_counter_alloc returns the address of the percpu +- * counter, or 0 on !SMP. We force an alignment of 16 bytes +- * so that bytes/packets share a common cache line. +- * +- * Hence caller must use IS_ERR_VALUE to check for error, this +- * allows us to return 0 for single core systems without forcing +- * callers to deal with SMP vs. NONSMP issues. +- */ +-static inline unsigned long xt_percpu_counter_alloc(void) +-{ +- if (nr_cpu_ids > 1) { +- void __percpu *res = __alloc_percpu(sizeof(struct xt_counters), +- sizeof(struct xt_counters)); +- +- if (res == NULL) +- return -ENOMEM; +- +- return (__force unsigned long) res; +- } +- +- return 0; +-} +-static inline void xt_percpu_counter_free(u64 pcnt) +-{ +- if (nr_cpu_ids > 1) +- free_percpu((void __percpu *) (unsigned long) pcnt); +-} ++bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state, ++ struct xt_counters *counter); ++void xt_percpu_counter_free(struct xt_counters *cnt); + + static inline struct xt_counters * + xt_get_this_cpu_counter(struct xt_counters *cnt) +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index 4a040862f4bf..115381228203 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -5,6 +5,7 @@ + + #ifndef _LINUX_NOSPEC_H + #define _LINUX_NOSPEC_H ++#include + + /** + * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index de2a722fe3cf..ea4f81c2a6d5 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -56,4 +56,7 @@ + */ + #define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) + ++/* Device needs a pause after every control message. */ ++#define USB_QUIRK_DELAY_CTRL_MSG BIT(13) ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 217abe56e711..f63ce973b27b 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -451,6 +451,7 @@ extern bool cancel_delayed_work_sync(struct delayed_work *dwork); + + extern void workqueue_set_max_active(struct workqueue_struct *wq, + int max_active); ++extern struct work_struct *current_work(void); + extern bool current_is_workqueue_rescuer(void); + extern bool workqueue_congested(int cpu, struct workqueue_struct *wq); + extern unsigned int work_busy(struct work_struct *work); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 85555eb4d3cb..8df77ed6aa99 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4047,6 +4047,22 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active) + } + EXPORT_SYMBOL_GPL(workqueue_set_max_active); + ++/** ++ * current_work - retrieve %current task's work struct ++ * ++ * Determine if %current task is a workqueue worker and what it's working on. ++ * Useful to find out the context that the %current task is running in. ++ * ++ * Return: work struct if %current task is a workqueue worker, %NULL otherwise. ++ */ ++struct work_struct *current_work(void) ++{ ++ struct worker *worker = current_wq_worker(); ++ ++ return worker ? worker->current_work : NULL; ++} ++EXPORT_SYMBOL(current_work); ++ + /** + * current_is_workqueue_rescuer - is %current workqueue rescuer? + * +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 9024283d2bca..9637a681bdda 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par) + return true; + } + ++static bool poolsize_invalid(const struct ebt_mac_wormhash *w) ++{ ++ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; + const struct ebt_entry_match *em = + container_of(par->matchinfo, const struct ebt_entry_match, data); +- int expected_length = sizeof(struct ebt_among_info); ++ unsigned int expected_length = sizeof(struct ebt_among_info); + const struct ebt_mac_wormhash *wh_dst, *wh_src; + int err; + ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); +- wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_dst)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_dst); ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ ++ wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_src)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index f46ca417bf2d..50b76011f470 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2021,7 +2021,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (match_kern) + match_kern->match_size = ret; + +- WARN_ON(type == EBT_COMPAT_TARGET && size_left); ++ if (WARN_ON(type == EBT_COMPAT_TARGET && size_left)) ++ return -EINVAL; ++ + match32 = (struct compat_ebt_entry_mwt *) buf; + } + +@@ -2078,6 +2080,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + * + * offsets are relative to beginning of struct ebt_entry (i.e., 0). + */ ++ for (i = 0; i < 4 ; ++i) { ++ if (offsets[i] >= *total) ++ return -EINVAL; ++ if (i == 0) ++ continue; ++ if (offsets[i-1] > offsets[i]) ++ return -EINVAL; ++ } ++ + for (i = 0, j = 1 ; j < 4 ; j++, i++) { + struct compat_ebt_entry_mwt *match32; + unsigned int size; +diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c +index c3776ff6749f..699f8a5457a3 100644 +--- a/net/ipv4/netfilter.c ++++ b/net/ipv4/netfilter.c +@@ -23,7 +23,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + struct rtable *rt; + struct flowi4 fl4 = {}; + __be32 saddr = iph->saddr; +- __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; ++ const struct sock *sk = skb_to_full_sk(skb); ++ __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0; + unsigned int hh_len; + + if (addr_type == RTN_UNSPEC) +@@ -39,7 +40,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + fl4.daddr = iph->daddr; + fl4.saddr = saddr; + fl4.flowi4_tos = RT_TOS(iph->tos); +- fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; ++ fl4.flowi4_oif = sk ? sk->sk_bound_dev_if : 0; + fl4.flowi4_mark = skb->mark; + fl4.flowi4_flags = flags; + rt = ip_route_output_key(net, &fl4); +@@ -58,7 +59,7 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t + xfrm_decode_session(skb, flowi4_to_flowi(&fl4), AF_INET) == 0) { + struct dst_entry *dst = skb_dst(skb); + skb_dst_set(skb, NULL); +- dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), skb->sk, 0); ++ dst = xfrm_lookup(net, dst, flowi4_to_flowi(&fl4), sk, 0); + if (IS_ERR(dst)) + return PTR_ERR(dst); + skb_dst_set(skb, dst); +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 4cfcc22f7430..f51b32ed353c 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -329,6 +329,10 @@ unsigned int arpt_do_table(struct sk_buff *skb, + } + if (table_base + v + != arpt_next_entry(e)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +@@ -507,17 +511,15 @@ static inline int check_target(struct arpt_entry *e, const char *name) + } + + static inline int +-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) ++find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +- unsigned long pcnt; + int ret; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + t = arpt_get_target(e); + target = xt_request_find_target(NFPROTO_ARP, t->u.user.name, +@@ -536,7 +538,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) + err: + module_put(t->u.kernel.target->me); + out: +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -624,7 +626,7 @@ static inline void cleanup_entry(struct arpt_entry *e) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -633,6 +635,7 @@ static inline void cleanup_entry(struct arpt_entry *e) + static int translate_table(struct xt_table_info *newinfo, void *entry0, + const struct arpt_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct arpt_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -706,7 +709,8 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, repl->name, repl->size); ++ ret = find_check_entry(iter, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index a98173d1ea97..dac62b5e7fe3 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -408,6 +408,10 @@ ipt_do_table(struct sk_buff *skb, + } + if (table_base + v != ipt_next_entry(e) && + !(e->ip.flags & IPT_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + pr_debug("Pushed %p into pos %u\n", + e, stackidx - 1); +@@ -645,7 +649,8 @@ static int check_target(struct ipt_entry *e, struct net *net, const char *name) + + static int + find_check_entry(struct ipt_entry *e, struct net *net, const char *name, +- unsigned int size) ++ unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +@@ -653,12 +658,9 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, + unsigned int j; + struct xt_mtchk_param mtpar; + struct xt_entry_match *ematch; +- unsigned long pcnt; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + j = 0; + mtpar.net = net; +@@ -697,7 +699,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, + cleanup_match(ematch, net); + } + +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -793,7 +795,7 @@ cleanup_entry(struct ipt_entry *e, struct net *net) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -802,6 +804,7 @@ static int + translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + const struct ipt_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct ipt_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -871,7 +874,8 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, net, repl->name, repl->size); ++ ret = find_check_entry(iter, net, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index bb1b5453a7a1..795c343347ec 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -425,6 +425,10 @@ ip6t_do_table(struct sk_buff *skb, + } + if (table_base + v != ip6t_next_entry(e) && + !(e->ipv6.flags & IP6T_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +@@ -658,7 +662,8 @@ static int check_target(struct ip6t_entry *e, struct net *net, const char *name) + + static int + find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, +- unsigned int size) ++ unsigned int size, ++ struct xt_percpu_counter_alloc_state *alloc_state) + { + struct xt_entry_target *t; + struct xt_target *target; +@@ -666,12 +671,9 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, + unsigned int j; + struct xt_mtchk_param mtpar; + struct xt_entry_match *ematch; +- unsigned long pcnt; + +- pcnt = xt_percpu_counter_alloc(); +- if (IS_ERR_VALUE(pcnt)) ++ if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) + return -ENOMEM; +- e->counters.pcnt = pcnt; + + j = 0; + mtpar.net = net; +@@ -709,7 +711,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, + cleanup_match(ematch, net); + } + +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + + return ret; + } +@@ -804,8 +806,7 @@ static void cleanup_entry(struct ip6t_entry *e, struct net *net) + if (par.target->destroy != NULL) + par.target->destroy(&par); + module_put(par.target->me); +- +- xt_percpu_counter_free(e->counters.pcnt); ++ xt_percpu_counter_free(&e->counters); + } + + /* Checks and translates the user-supplied table segment (held in +@@ -814,6 +815,7 @@ static int + translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + const struct ip6t_replace *repl) + { ++ struct xt_percpu_counter_alloc_state alloc_state = { 0 }; + struct ip6t_entry *iter; + unsigned int *offsets; + unsigned int i; +@@ -883,7 +885,8 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, + /* Finally, each sanity check must pass */ + i = 0; + xt_entry_foreach(iter, entry0, newinfo->size) { +- ret = find_check_entry(iter, net, repl->name, repl->size); ++ ret = find_check_entry(iter, net, repl->name, repl->size, ++ &alloc_state); + if (ret != 0) + break; + ++i; +diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +index 238e70c3f7b7..7b9c2cabd495 100644 +--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, + !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff, + target, maniptype)) + return false; ++ ++ /* must reload, offset might have changed */ ++ ipv6h = (void *)skb->data + iphdroff; ++ + manip_addr: + if (maniptype == NF_NAT_MANIP_SRC) + ipv6h->saddr = target->src.u3.in6; +diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c +index fbce552a796e..7d7466dbf663 100644 +--- a/net/netfilter/nf_nat_proto_common.c ++++ b/net/netfilter/nf_nat_proto_common.c +@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + const struct nf_conn *ct, + u16 *rover) + { +- unsigned int range_size, min, i; ++ unsigned int range_size, min, max, i; + __be16 *portptr; + u_int16_t off; + +@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + } + } else { + min = ntohs(range->min_proto.all); +- range_size = ntohs(range->max_proto.all) - min + 1; ++ max = ntohs(range->max_proto.all); ++ if (unlikely(max < min)) ++ swap(max, min); ++ range_size = max - min + 1; + } + + if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) { +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index f853b55bf877..7edcfda288c4 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -501,7 +501,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + + if (entskb->tstamp.tv64) { + struct nfqnl_msg_packet_timestamp ts; +- struct timespec64 kts = ktime_to_timespec64(skb->tstamp); ++ struct timespec64 kts = ktime_to_timespec64(entskb->tstamp); + + ts.sec = cpu_to_be64(kts.tv_sec); + ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC); +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 5b52dd3feb7d..34ae20490c94 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -38,6 +38,8 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Harald Welte "); + MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); + ++#define XT_PCPU_BLOCK_SIZE 4096 ++ + struct compat_delta { + unsigned int offset; /* offset in kernel */ + int delta; /* delta in 32bit user land */ +@@ -1592,6 +1594,59 @@ void xt_proto_fini(struct net *net, u_int8_t af) + } + EXPORT_SYMBOL_GPL(xt_proto_fini); + ++/** ++ * xt_percpu_counter_alloc - allocate x_tables rule counter ++ * ++ * @state: pointer to xt_percpu allocation state ++ * @counter: pointer to counter struct inside the ip(6)/arpt_entry struct ++ * ++ * On SMP, the packet counter [ ip(6)t_entry->counters.pcnt ] will then ++ * contain the address of the real (percpu) counter. ++ * ++ * Rule evaluation needs to use xt_get_this_cpu_counter() helper ++ * to fetch the real percpu counter. ++ * ++ * To speed up allocation and improve data locality, a 4kb block is ++ * allocated. ++ * ++ * xt_percpu_counter_alloc_state contains the base address of the ++ * allocated page and the current sub-offset. ++ * ++ * returns false on error. ++ */ ++bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state, ++ struct xt_counters *counter) ++{ ++ BUILD_BUG_ON(XT_PCPU_BLOCK_SIZE < (sizeof(*counter) * 2)); ++ ++ if (nr_cpu_ids <= 1) ++ return true; ++ ++ if (!state->mem) { ++ state->mem = __alloc_percpu(XT_PCPU_BLOCK_SIZE, ++ XT_PCPU_BLOCK_SIZE); ++ if (!state->mem) ++ return false; ++ } ++ counter->pcnt = (__force unsigned long)(state->mem + state->off); ++ state->off += sizeof(*counter); ++ if (state->off > (XT_PCPU_BLOCK_SIZE - sizeof(*counter))) { ++ state->mem = NULL; ++ state->off = 0; ++ } ++ return true; ++} ++EXPORT_SYMBOL_GPL(xt_percpu_counter_alloc); ++ ++void xt_percpu_counter_free(struct xt_counters *counters) ++{ ++ unsigned long pcnt = counters->pcnt; ++ ++ if (nr_cpu_ids > 1 && (pcnt & (XT_PCPU_BLOCK_SIZE - 1)) == 0) ++ free_percpu((void __percpu *)pcnt); ++} ++EXPORT_SYMBOL_GPL(xt_percpu_counter_free); ++ + static int __net_init xt_net_init(struct net *net) + { + int i; +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index 29d2c31f406c..1718f536689f 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -147,11 +147,11 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) + (unsigned long) info->timer); + info->timer->refcnt = 1; + ++ INIT_WORK(&info->timer->work, idletimer_tg_work); ++ + mod_timer(&info->timer->timer, + msecs_to_jiffies(info->timeout * 1000) + jiffies); + +- INIT_WORK(&info->timer->work, idletimer_tg_work); +- + return 0; + + out_free_attr: +@@ -192,7 +192,10 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) + pr_debug("timeout value is zero\n"); + return -EINVAL; + } +- ++ if (info->timeout >= INT_MAX / 1000) { ++ pr_debug("timeout value is too big\n"); ++ return -EINVAL; ++ } + if (info->label[0] == '\0' || + strnlen(info->label, + MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 3ba31c194cce..0858fe17e14a 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -141,10 +141,11 @@ static int led_tg_check(const struct xt_tgchk_param *par) + goto exit_alloc; + } + +- /* See if we need to set up a timer */ +- if (ledinfo->delay > 0) +- setup_timer(&ledinternal->timer, led_timeout_callback, +- (unsigned long)ledinternal); ++ /* Since the letinternal timer can be shared between multiple targets, ++ * always set it up, even if the current target does not need it ++ */ ++ setup_timer(&ledinternal->timer, led_timeout_callback, ++ (unsigned long)ledinternal); + + list_add_tail(&ledinternal->list, &xt_led_triggers); + +@@ -181,8 +182,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par) + + list_del(&ledinternal->list); + +- if (ledinfo->delay > 0) +- del_timer_sync(&ledinternal->timer); ++ del_timer_sync(&ledinternal->timer); + + led_trigger_unregister(&ledinternal->netfilter_led_trigger); + +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 4ca31e052dd8..509e9426a056 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, + struct sock *sk; + int chunklen; + +- chunklen = sizeof(*chunk_hdr) + paylen; ++ chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen); + if (chunklen > SCTP_MAX_CHUNK_LEN) + goto nodata; + +diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib +index 79e86613712f..24914e7de944 100644 +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -270,11 +270,11 @@ cmd_dt_S_dtb= \ + echo '\#include '; \ + echo '.section .dtb.init.rodata,"a"'; \ + echo '.balign STRUCT_ALIGNMENT'; \ +- echo '.global __dtb_$(*F)_begin'; \ +- echo '__dtb_$(*F)_begin:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \ ++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \ + echo '.incbin "$<" '; \ +- echo '__dtb_$(*F)_end:'; \ +- echo '.global __dtb_$(*F)_end'; \ ++ echo '__dtb_$(subst -,_,$(*F))_end:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \ + echo '.balign STRUCT_ALIGNMENT'; \ + ) > $@ + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 167b943469ab..94fd3df2cf21 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -919,7 +919,8 @@ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop) + static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + struct snd_seq_event *event, + struct file *file, int blocking, +- int atomic, int hop) ++ int atomic, int hop, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + int err; +@@ -957,7 +958,8 @@ static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + return -ENXIO; /* queue is not allocated */ + + /* allocate an event cell */ +- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file); ++ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, ++ file, mutexp); + if (err < 0) + return err; + +@@ -1026,12 +1028,11 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + return -ENXIO; + + /* allocate the pool now if the pool is not allocated yet */ ++ mutex_lock(&client->ioctl_mutex); + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +- mutex_lock(&client->ioctl_mutex); + err = snd_seq_pool_init(client->pool); +- mutex_unlock(&client->ioctl_mutex); + if (err < 0) +- return -ENOMEM; ++ goto out; + } + + /* only process whole events */ +@@ -1082,7 +1083,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + /* ok, enqueue it */ + err = snd_seq_client_enqueue_event(client, &event, file, + !(file->f_flags & O_NONBLOCK), +- 0, 0); ++ 0, 0, &client->ioctl_mutex); + if (err < 0) + break; + +@@ -1093,6 +1094,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + written += len; + } + ++ out: ++ mutex_unlock(&client->ioctl_mutex); + return written ? written : err; + } + +@@ -1924,6 +1927,9 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client, + (! snd_seq_write_pool_allocated(client) || + info.output_pool != client->pool->size)) { + if (snd_seq_write_pool_allocated(client)) { ++ /* is the pool in use? */ ++ if (atomic_read(&client->pool->counter)) ++ return -EBUSY; + /* remove all existing cells */ + snd_seq_pool_mark_closing(client->pool); + snd_seq_queue_client_leave_cells(client->number); +@@ -2347,7 +2353,8 @@ static int kernel_client_enqueue(int client, struct snd_seq_event *ev, + if (! cptr->accept_output) + result = -EPERM; + else /* send it */ +- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop); ++ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, ++ atomic, hop, NULL); + + snd_seq_client_unlock(cptr); + return result; +diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c +index 3490d21ab9e7..9acbed1ac982 100644 +--- a/sound/core/seq/seq_fifo.c ++++ b/sound/core/seq/seq_fifo.c +@@ -123,7 +123,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, + return -EINVAL; + + snd_use_lock_use(&f->use_lock); +- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */ ++ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */ + if (err < 0) { + if ((err == -ENOMEM) || (err == -EAGAIN)) + atomic_inc(&f->overflow); +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index 5847c4475bf3..4c8cbcd89887 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -221,7 +221,8 @@ void snd_seq_cell_free(struct snd_seq_event_cell * cell) + */ + static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + struct snd_seq_event_cell **cellp, +- int nonblock, struct file *file) ++ int nonblock, struct file *file, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -245,7 +246,11 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + set_current_state(TASK_INTERRUPTIBLE); + add_wait_queue(&pool->output_sleep, &wait); + spin_unlock_irq(&pool->lock); ++ if (mutexp) ++ mutex_unlock(mutexp); + schedule(); ++ if (mutexp) ++ mutex_lock(mutexp); + spin_lock_irq(&pool->lock); + remove_wait_queue(&pool->output_sleep, &wait); + /* interrupted? */ +@@ -288,7 +293,7 @@ __error: + */ + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + struct snd_seq_event_cell **cellp, int nonblock, +- struct file *file) ++ struct file *file, struct mutex *mutexp) + { + int ncells, err; + unsigned int extlen; +@@ -305,7 +310,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + if (ncells >= pool->total_elements) + return -ENOMEM; + +- err = snd_seq_cell_alloc(pool, &cell, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp); + if (err < 0) + return err; + +@@ -331,7 +336,8 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + int size = sizeof(struct snd_seq_event); + if (len < size) + size = len; +- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file, ++ mutexp); + if (err < 0) + goto __error; + if (cell->event.data.ext.ptr == NULL) +diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h +index 32f959c17786..3abe306c394a 100644 +--- a/sound/core/seq/seq_memory.h ++++ b/sound/core/seq/seq_memory.h +@@ -66,7 +66,8 @@ struct snd_seq_pool { + void snd_seq_cell_free(struct snd_seq_event_cell *cell); + + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, +- struct snd_seq_event_cell **cellp, int nonblock, struct file *file); ++ struct snd_seq_event_cell **cellp, int nonblock, ++ struct file *file, struct mutex *mutexp); + + /* return number of unused (free) cells */ + static inline int snd_seq_unused_cells(struct snd_seq_pool *pool) +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index c92b7ba344ef..9fae1d248318 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -849,6 +849,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b302d056e5d3..11305a4baf7b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4722,6 +4722,16 @@ static void alc298_fixup_speaker_volume(struct hda_codec *codec, + } + } + ++/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */ ++static void alc295_fixup_disable_dac3(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[2] = { 0x02, 0x03 }; ++ snd_hda_override_conn_list(codec, 0x17, 2, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -4871,6 +4881,7 @@ enum { + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC295_FIXUP_DISABLE_DAC3, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -5560,6 +5571,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + }, ++ [ALC295_FIXUP_DISABLE_DAC3] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_disable_dac3, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -5617,6 +5632,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/patch/kernel/mvebu-default/04-patch-4.4.122-123.patch b/patch/kernel/mvebu-default/04-patch-4.4.122-123.patch new file mode 100644 index 000000000..6d1e7d8b3 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.122-123.patch @@ -0,0 +1,3500 @@ +diff --git a/Makefile b/Makefile +index 3eb21d269b42..cbcc04da790a 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 122 ++SUBLEVEL = 123 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 7106114c7464..2dbe13a3d89b 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts +index 40a474c4374b..4c52358734ef 100644 +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -359,7 +359,7 @@ + reg = <0>; + vdd3-supply = <&lcd_vdd3_reg>; + vci-supply = <&ldo25_reg>; +- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>; + power-on-delay= <50>; + reset-delay = <100>; + init-delay = <100>; +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 80f6c786a37e..e05670423d8b 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -90,6 +90,8 @@ + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -137,6 +139,12 @@ + OMAP3_CORE1_IOPAD(0x218e, PIN_OUTPUT | MUX_MODE4) /* mcbsp1_fsr.gpio_157 */ + >; + }; ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ >; ++ }; + }; + + &omap3_pmx_core2 { +diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts +index 10d088df0c35..4a962a26482d 100644 +--- a/arch/arm/boot/dts/moxart-uc7112lx.dts ++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts +@@ -6,7 +6,7 @@ + */ + + /dts-v1/; +-/include/ "moxart.dtsi" ++#include "moxart.dtsi" + + / { + model = "MOXA UC-7112-LX"; +diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi +index 1fd27ed65a01..64f2f44235d0 100644 +--- a/arch/arm/boot/dts/moxart.dtsi ++++ b/arch/arm/boot/dts/moxart.dtsi +@@ -6,6 +6,7 @@ + */ + + /include/ "skeleton.dtsi" ++#include + + / { + compatible = "moxa,moxart"; +@@ -36,8 +37,8 @@ + ranges; + + intc: interrupt-controller@98800000 { +- compatible = "moxa,moxart-ic"; +- reg = <0x98800000 0x38>; ++ compatible = "moxa,moxart-ic", "faraday,ftintc010"; ++ reg = <0x98800000 0x100>; + interrupt-controller; + #interrupt-cells = <2>; + interrupt-mask = <0x00080000>; +@@ -59,7 +60,7 @@ + timer: timer@98400000 { + compatible = "moxa,moxart-timer"; + reg = <0x98400000 0x42>; +- interrupts = <19 1>; ++ interrupts = <19 IRQ_TYPE_EDGE_FALLING>; + clocks = <&clk_apb>; + }; + +@@ -80,7 +81,7 @@ + dma: dma@90500000 { + compatible = "moxa,moxart-dma"; + reg = <0x90500080 0x40>; +- interrupts = <24 0>; ++ interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + }; + +@@ -93,7 +94,7 @@ + sdhci: sdhci@98e00000 { + compatible = "moxa,moxart-sdhci"; + reg = <0x98e00000 0x5C>; +- interrupts = <5 0>; ++ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk_apb>; + dmas = <&dma 5>, + <&dma 5>; +@@ -120,7 +121,7 @@ + mac0: mac@90900000 { + compatible = "moxa,moxart-mac"; + reg = <0x90900000 0x90>; +- interrupts = <25 0>; ++ interrupts = <25 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy0>; + phy-mode = "mii"; + status = "disabled"; +@@ -129,7 +130,7 @@ + mac1: mac@92000000 { + compatible = "moxa,moxart-mac"; + reg = <0x92000000 0x90>; +- interrupts = <27 0>; ++ interrupts = <27 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy1>; + phy-mode = "mii"; + status = "disabled"; +@@ -138,7 +139,7 @@ + uart0: uart@98200000 { + compatible = "ns16550a"; + reg = <0x98200000 0x20>; +- interrupts = <31 8>; ++ interrupts = <31 IRQ_TYPE_LEVEL_HIGH>; + reg-shift = <2>; + reg-io-width = <4>; + clock-frequency = <14745600>; +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 27cd4abfc74d..731860314ab5 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -488,7 +488,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -505,7 +505,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi +index 7b39d8fae61e..bd83a61f724f 100644 +--- a/arch/arm/boot/dts/r8a7790.dtsi ++++ b/arch/arm/boot/dts/r8a7790.dtsi +@@ -1360,8 +1360,11 @@ + compatible = "renesas,r8a7790-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, +diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts +index fc44ea361a4b..62eae315af1f 100644 +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -280,7 +280,7 @@ + x2_clk: x2-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <148500000>; ++ clock-frequency = <74250000>; + }; + + x13_clk: x13-clock { +diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi +index 328f48bd15e7..d2585a4c6098 100644 +--- a/arch/arm/boot/dts/r8a7791.dtsi ++++ b/arch/arm/boot/dts/r8a7791.dtsi +@@ -1374,8 +1374,11 @@ + compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, +diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c +index e3384065f5e7..cbe0f025856d 100644 +--- a/arch/mips/kernel/mips-r2-to-r6-emul.c ++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c +@@ -1097,10 +1097,20 @@ repeat: + } + break; + +- case beql_op: +- case bnel_op: + case blezl_op: + case bgtzl_op: ++ /* ++ * For BLEZL and BGTZL, rt field must be set to 0. If this ++ * is not the case, this may be an encoding of a MIPS R6 ++ * instruction, so return to CPU execution if this occurs ++ */ ++ if (MIPSInst_RT(inst)) { ++ err = SIGILL; ++ break; ++ } ++ /* fall through */ ++ case beql_op: ++ case bnel_op: + if (delay_slot(regs)) { + err = SIGILL; + break; +@@ -2330,6 +2340,8 @@ static int mipsr2_stats_clear_show(struct seq_file *s, void *unused) + __this_cpu_write((mipsr2bremustats).bgezl, 0); + __this_cpu_write((mipsr2bremustats).bltzll, 0); + __this_cpu_write((mipsr2bremustats).bgezll, 0); ++ __this_cpu_write((mipsr2bremustats).bltzall, 0); ++ __this_cpu_write((mipsr2bremustats).bgezall, 0); + __this_cpu_write((mipsr2bremustats).bltzal, 0); + __this_cpu_write((mipsr2bremustats).bgezal, 0); + __this_cpu_write((mipsr2bremustats).beql, 0); +diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c +index 1a8c96035716..c0c1e9529dbd 100644 +--- a/arch/mips/net/bpf_jit.c ++++ b/arch/mips/net/bpf_jit.c +@@ -527,7 +527,8 @@ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset) + u32 sflags, tmp_flags; + + /* Adjust the stack pointer */ +- emit_stack_offset(-align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(-align_sp(offset), ctx); + + tmp_flags = sflags = ctx->flags >> SEEN_SREG_SFT; + /* sflags is essentially a bitmap */ +@@ -579,7 +580,8 @@ static void restore_bpf_jit_regs(struct jit_ctx *ctx, + emit_load_stack_reg(r_ra, r_sp, real_off, ctx); + + /* Restore the sp and discard the scrach memory */ +- emit_stack_offset(align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(align_sp(offset), ctx); + } + + static unsigned int get_stack_depth(struct jit_ctx *ctx) +@@ -626,8 +628,14 @@ static void build_prologue(struct jit_ctx *ctx) + if (ctx->flags & SEEN_X) + emit_jit_reg_move(r_X, r_zero, ctx); + +- /* Do not leak kernel data to userspace */ +- if (bpf_needs_clear_a(&ctx->skf->insns[0])) ++ /* ++ * Do not leak kernel data to userspace, we only need to clear ++ * r_A if it is ever used. In fact if it is never used, we ++ * will not save/restore it, so clearing it in this case would ++ * corrupt the state of the caller. ++ */ ++ if (bpf_needs_clear_a(&ctx->skf->insns[0]) && ++ (ctx->flags & SEEN_A)) + emit_jit_reg_move(r_A, r_zero, ctx); + } + +diff --git a/arch/mips/net/bpf_jit_asm.S b/arch/mips/net/bpf_jit_asm.S +index 5d2e0c8d29c0..88a2075305d1 100644 +--- a/arch/mips/net/bpf_jit_asm.S ++++ b/arch/mips/net/bpf_jit_asm.S +@@ -90,18 +90,14 @@ FEXPORT(sk_load_half_positive) + is_offset_in_header(2, half) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- .set reorder +- lh $r_A, 0(t1) +- .set noreorder ++ lhu $r_A, 0(t1) + #ifdef CONFIG_CPU_LITTLE_ENDIAN + # if defined(__mips_isa_rev) && (__mips_isa_rev >= 2) +- wsbh t0, $r_A +- seh $r_A, t0 ++ wsbh $r_A, $r_A + # else +- sll t0, $r_A, 24 +- andi t1, $r_A, 0xff00 +- sra t0, t0, 16 +- srl t1, t1, 8 ++ sll t0, $r_A, 8 ++ srl t1, $r_A, 8 ++ andi t0, t0, 0xff00 + or $r_A, t0, t1 + # endif + #endif +@@ -115,7 +111,7 @@ FEXPORT(sk_load_byte_positive) + is_offset_in_header(1, byte) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- lb $r_A, 0(t1) ++ lbu $r_A, 0(t1) + jr $r_ra + move $r_ret, zero + END(sk_load_byte) +@@ -139,6 +135,11 @@ FEXPORT(sk_load_byte_positive) + * (void *to) is returned in r_s0 + * + */ ++#ifdef CONFIG_CPU_LITTLE_ENDIAN ++#define DS_OFFSET(SIZE) (4 * SZREG) ++#else ++#define DS_OFFSET(SIZE) ((4 * SZREG) + (4 - SIZE)) ++#endif + #define bpf_slow_path_common(SIZE) \ + /* Quick check. Are we within reasonable boundaries? */ \ + LONG_ADDIU $r_s1, $r_skb_len, -SIZE; \ +@@ -150,7 +151,7 @@ FEXPORT(sk_load_byte_positive) + PTR_LA t0, skb_copy_bits; \ + PTR_S $r_ra, (5 * SZREG)($r_sp); \ + /* Assign low slot to a2 */ \ +- move a2, $r_sp; \ ++ PTR_ADDIU a2, $r_sp, DS_OFFSET(SIZE); \ + jalr t0; \ + /* Reset our destination slot (DS but it's ok) */ \ + INT_S zero, (4 * SZREG)($r_sp); \ +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index a67c6d781c52..d154e333f76b 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -294,7 +294,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address, + * can result in fault, which will cause a deadlock when called with + * mmap_sem held + */ +- if (user_mode(regs)) ++ if (!is_exec && user_mode(regs)) + store_update_sp = store_updates_sp(regs); + + if (user_mode(regs)) +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 99d293ea2b49..565e24e9ddf2 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -196,6 +196,8 @@ retry: + return (opcode != 0x62 && opcode != 0x67); + case 0x70: + return 0; /* can't boost conditional jump */ ++ case 0x90: ++ return opcode != 0x9a; /* can't boost call far */ + case 0xc0: + /* can't boost software-interruptions */ + return (0xc1 < opcode && opcode < 0xcc) || opcode == 0xcf; +@@ -404,6 +406,8 @@ static int arch_copy_kprobe(struct kprobe *p) + { + int ret; + ++ set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Copy an instruction with recovering if other optprobe modifies it.*/ + ret = __copy_instruction(p->ainsn.insn, p->addr); + if (!ret) +@@ -418,6 +422,8 @@ static int arch_copy_kprobe(struct kprobe *p) + else + p->ainsn.boostable = -1; + ++ set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Check whether the instruction modifies Interrupt Flag or not */ + p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn); + +diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c +index ea8e2b846101..7aba9d6475a5 100644 +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -370,6 +370,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, + } + + buf = (u8 *)op->optinsn.insn; ++ set_memory_rw((unsigned long)buf & PAGE_MASK, 1); + + /* Copy instructions into the out-of-line buffer */ + ret = copy_optimized_instructions(buf + TMPL_END_IDX, op->kp.addr); +@@ -392,6 +393,8 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, + synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size, + (u8 *)op->kp.addr + op->optinsn.size); + ++ set_memory_ro((unsigned long)buf & PAGE_MASK, 1); ++ + flush_icache_range((unsigned long) buf, + (unsigned long) buf + TMPL_END_IDX + + op->optinsn.size + RELATIVEJUMP_SIZE); +diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c +index 510e80da7de4..af57736a0309 100644 +--- a/arch/x86/kernel/vm86_32.c ++++ b/arch/x86/kernel/vm86_32.c +@@ -715,7 +715,8 @@ void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code) + return; + + check_vip: +- if (VEFLAGS & X86_EFLAGS_VIP) { ++ if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) == ++ (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) { + save_v86_state(regs, VM86_STI); + return; + } +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e830c71a1323..e0a34b0d381e 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -287,7 +287,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (!pmd_k) + return -1; + +- if (pmd_huge(*pmd_k)) ++ if (pmd_large(*pmd_k)) + return 0; + + pte_k = pte_offset_kernel(pmd_k, address); +@@ -407,7 +407,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref)) + BUG(); + +- if (pud_huge(*pud)) ++ if (pud_large(*pud)) + return 0; + + pmd = pmd_offset(pud, address); +@@ -418,7 +418,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref)) + BUG(); + +- if (pmd_huge(*pmd)) ++ if (pmd_large(*pmd)) + return 0; + + pte_ref = pte_offset_kernel(pmd_ref, address); +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 8161090a1970..46ba2402c8f9 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1078,10 +1078,8 @@ int blkcg_init_queue(struct request_queue *q) + if (preloaded) + radix_tree_preload_end(); + +- if (IS_ERR(blkg)) { +- blkg_free(new_blkg); ++ if (IS_ERR(blkg)) + return PTR_ERR(blkg); +- } + + q->root_blkg = blkg; + q->root_rl.blkg = blkg; +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 2149a1ddbacf..17bdd6b55beb 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -505,6 +505,17 @@ static void throtl_dequeue_tg(struct throtl_grp *tg) + static void throtl_schedule_pending_timer(struct throtl_service_queue *sq, + unsigned long expires) + { ++ unsigned long max_expire = jiffies + 8 * throtl_slice; ++ ++ /* ++ * Since we are adjusting the throttle limit dynamically, the sleep ++ * time calculated according to previous limit might be invalid. It's ++ * possible the cgroup sleep time is very long and no other cgroups ++ * have IO running so notify the limit changes. Make sure the cgroup ++ * doesn't sleep too long to avoid the missed notification. ++ */ ++ if (time_after(expires, max_expire)) ++ expires = max_expire; + mod_timer(&sq->pending_timer, expires); + throtl_log(sq, "schedule timer. delay=%lu jiffies=%lu", + expires - jiffies, jiffies); +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 1341a94cc779..76afc841232c 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -859,6 +859,8 @@ void intel_gtt_insert_sg_entries(struct sg_table *st, + } + } + wmb(); ++ if (intel_private.driver->chipset_flush) ++ intel_private.driver->chipset_flush(); + } + EXPORT_SYMBOL(intel_gtt_insert_sg_entries); + +diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c +index 2e7f03d50f4e..95a4dd290f35 100644 +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -1437,6 +1437,7 @@ static const struct freq_tbl ftbl_codec_clk[] = { + + static struct clk_rcg2 codec_digcodec_clk_src = { + .cmd_rcgr = 0x1c09c, ++ .mnd_width = 8, + .hid_width = 5, + .parent_map = gcc_xo_gpll1_emclk_sleep_map, + .freq_tbl = ftbl_codec_clk, +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index ebed319657e7..c0fb6f12f547 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -551,6 +551,8 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } ++ if (t && !try_module_get(t->owner)) ++ t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -669,6 +671,10 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); ++ ++ if (new_policy.governor) ++ module_put(new_policy.governor->owner); ++ + return ret ? ret : count; + } + +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index 0f6fd42f55ca..f8d740a6740d 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -911,6 +911,21 @@ static int sdma_disable_channel(struct dma_chan *chan) + return 0; + } + ++static int sdma_disable_channel_with_delay(struct dma_chan *chan) ++{ ++ sdma_disable_channel(chan); ++ ++ /* ++ * According to NXP R&D team a delay of one BD SDMA cost time ++ * (maximum is 1ms) should be added after disable of the channel ++ * bit, to ensure SDMA core has really been stopped after SDMA ++ * clients call .device_terminate_all. ++ */ ++ mdelay(1); ++ ++ return 0; ++} ++ + static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac) + { + struct sdma_engine *sdma = sdmac->sdma; +@@ -1793,7 +1808,7 @@ static int sdma_probe(struct platform_device *pdev) + sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg; + sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic; + sdma->dma_device.device_config = sdma_config; +- sdma->dma_device.device_terminate_all = sdma_disable_channel; ++ sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay; + sdma->dma_device.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 6470c9aa1351..1f0e6ede120c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector) + /* don't do anything if sink is not display port, i.e., + * passive dp->(dvi|hdmi) adaptor + */ +- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { +- int saved_dpms = connector->dpms; +- /* Only turn off the display if it's physically disconnected */ +- if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) { +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { +- /* Don't try to start link training before we +- * have the dpcd */ +- if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) +- return; +- +- /* set it to OFF so that drm_helper_connector_dpms() +- * won't return immediately since the current state +- * is ON at this point. +- */ +- connector->dpms = DRM_MODE_DPMS_OFF; +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- } +- connector->dpms = saved_dpms; ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && ++ amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) && ++ amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { ++ /* Don't start link training before we have the DPCD */ ++ if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) ++ return; ++ ++ /* Turn the connector off and back on immediately, which ++ * will trigger link training ++ */ ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + } + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 82903ca78529..c555781685ea 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -560,6 +560,12 @@ amdgpu_user_framebuffer_create(struct drm_device *dev, + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL); + if (amdgpu_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 74909e72a009..2acbd43f9a53 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -519,11 +519,17 @@ static ssize_t sysprops_show(struct kobject *kobj, struct attribute *attr, + return ret; + } + ++static void kfd_topology_kobj_release(struct kobject *kobj) ++{ ++ kfree(kobj); ++} ++ + static const struct sysfs_ops sysprops_ops = { + .show = sysprops_show, + }; + + static struct kobj_type sysprops_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &sysprops_ops, + }; + +@@ -559,6 +565,7 @@ static const struct sysfs_ops iolink_ops = { + }; + + static struct kobj_type iolink_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &iolink_ops, + }; + +@@ -586,6 +593,7 @@ static const struct sysfs_ops mem_ops = { + }; + + static struct kobj_type mem_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &mem_ops, + }; + +@@ -625,6 +633,7 @@ static const struct sysfs_ops cache_ops = { + }; + + static struct kobj_type cache_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &cache_ops, + }; + +@@ -747,6 +756,7 @@ static const struct sysfs_ops node_ops = { + }; + + static struct kobj_type node_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &node_ops, + }; + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index c641ed9470e1..724f7cf52253 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3219,8 +3219,7 @@ monitor_name(struct detailed_timing *t, void *data) + * @edid: EDID to parse + * + * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The +- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to +- * fill in. ++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in. + */ + void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + { +@@ -3293,6 +3292,12 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + } + eld[5] |= sad_count << 4; + ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || ++ connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP; ++ else ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI; ++ + eld[DRM_ELD_BASELINE_ELD_LEN] = + DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4); + +diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c +index 8090989185b2..4ddbc49125cd 100644 +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -1271,9 +1271,9 @@ void drm_vblank_put(struct drm_device *dev, unsigned int pipe) + if (atomic_dec_and_test(&vblank->refcount)) { + if (drm_vblank_offdelay == 0) + return; +- else if (dev->vblank_disable_immediate || drm_vblank_offdelay < 0) ++ else if (drm_vblank_offdelay < 0) + vblank_disable_fn((unsigned long)vblank); +- else ++ else if (!dev->vblank_disable_immediate) + mod_timer(&vblank->disable_timer, + jiffies + ((drm_vblank_offdelay * HZ)/1000)); + } +@@ -1902,6 +1902,16 @@ bool drm_handle_vblank(struct drm_device *dev, unsigned int pipe) + wake_up(&vblank->queue); + drm_handle_vblank_events(dev, pipe); + ++ /* With instant-off, we defer disabling the interrupt until after ++ * we finish processing the following vblank. The disable has to ++ * be last (after drm_handle_vblank_events) so that the timestamp ++ * is always accurate. ++ */ ++ if (dev->vblank_disable_immediate && ++ drm_vblank_offdelay > 0 && ++ !atomic_read(&vblank->refcount)) ++ vblank_disable_fn((unsigned long)vblank); ++ + spin_unlock_irqrestore(&dev->event_lock, irqflags); + + return true; +diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c +index c4a552637c93..3ff7689835dc 100644 +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -494,9 +494,11 @@ static const struct drm_fb_helper_funcs qxl_fb_helper_funcs = { + + int qxl_fbdev_init(struct qxl_device *qdev) + { ++ int ret = 0; ++ ++#ifdef CONFIG_DRM_FBDEV_EMULATION + struct qxl_fbdev *qfbdev; + int bpp_sel = 32; /* TODO: parameter from somewhere? */ +- int ret; + + qfbdev = kzalloc(sizeof(struct qxl_fbdev), GFP_KERNEL); + if (!qfbdev) +@@ -531,6 +533,8 @@ fini: + drm_fb_helper_fini(&qfbdev->helper); + free: + kfree(qfbdev); ++#endif ++ + return ret; + } + +@@ -546,6 +550,9 @@ void qxl_fbdev_fini(struct qxl_device *qdev) + + void qxl_fbdev_set_suspend(struct qxl_device *qdev, int state) + { ++ if (!qdev->mode_info.qfbdev) ++ return; ++ + drm_fb_helper_set_suspend(&qdev->mode_info.qfbdev->helper, state); + } + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 3645b223aa37..446d99062306 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1374,6 +1374,12 @@ radeon_user_framebuffer_create(struct drm_device *dev, + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL); + if (radeon_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index d2d93959b119..aec6e9eef489 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -433,7 +433,7 @@ static int vmw_fb_kms_detach(struct vmw_fb_par *par, + set.y = 0; + set.mode = NULL; + set.fb = NULL; +- set.num_connectors = 1; ++ set.num_connectors = 0; + set.connectors = &par->con; + ret = drm_mode_set_config_internal(&set); + if (ret) { +@@ -821,7 +821,9 @@ int vmw_fb_off(struct vmw_private *vmw_priv) + flush_delayed_work(&par->local_work); + + mutex_lock(&par->bo_mutex); ++ drm_modeset_lock_all(vmw_priv->dev); + (void) vmw_fb_kms_detach(par, true, false); ++ drm_modeset_unlock_all(vmw_priv->dev); + mutex_unlock(&par->bo_mutex); + + return 0; +diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c +index 0cd4f7216239..5eea6fe0d7bd 100644 +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -42,6 +42,12 @@ static int elo_input_configured(struct hid_device *hdev, + { + struct input_dev *input = hidinput->input; + ++ /* ++ * ELO devices have one Button usage in GenDesk field, which makes ++ * hid-input map it to BTN_LEFT; that confuses userspace, which then ++ * considers the device to be a mouse/touchpad instead of touchscreen. ++ */ ++ clear_bit(BTN_LEFT, input->keybit); + set_bit(BTN_TOUCH, input->keybit); + set_bit(ABS_PRESSURE, input->absbit); + input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0); +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 2ba6bf69b7d0..53e54855c366 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1128,18 +1128,26 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct + + /* + * Ignore out-of-range values as per HID specification, +- * section 5.10 and 6.2.25. ++ * section 5.10 and 6.2.25, when NULL state bit is present. ++ * When it's not, clamp the value to match Microsoft's input ++ * driver as mentioned in "Required HID usages for digitizers": ++ * https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp + * + * The logical_minimum < logical_maximum check is done so that we + * don't unintentionally discard values sent by devices which + * don't specify logical min and max. + */ + if ((field->flags & HID_MAIN_ITEM_VARIABLE) && +- (field->logical_minimum < field->logical_maximum) && +- (value < field->logical_minimum || +- value > field->logical_maximum)) { +- dbg_hid("Ignoring out-of-range value %x\n", value); +- return; ++ (field->logical_minimum < field->logical_maximum)) { ++ if (field->flags & HID_MAIN_ITEM_NULL_STATE && ++ (value < field->logical_minimum || ++ value > field->logical_maximum)) { ++ dbg_hid("Ignoring out-of-range value %x\n", value); ++ return; ++ } ++ value = clamp(value, ++ field->logical_minimum, ++ field->logical_maximum); + } + + /* +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 188af4c89f40..18477dd1e243 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -95,8 +95,8 @@ static const struct coefficients adm1075_coefficients[] = { + [0] = { 27169, 0, -1 }, /* voltage */ + [1] = { 806, 20475, -1 }, /* current, irange25 */ + [2] = { 404, 20475, -1 }, /* current, irange50 */ +- [3] = { 0, -1, 8549 }, /* power, irange25 */ +- [4] = { 0, -1, 4279 }, /* power, irange50 */ ++ [3] = { 8549, 0, -1 }, /* power, irange25 */ ++ [4] = { 4279, 0, -1 }, /* power, irange50 */ + }; + + static const struct coefficients adm1275_coefficients[] = { +diff --git a/drivers/hwtracing/coresight/of_coresight.c b/drivers/hwtracing/coresight/of_coresight.c +index b0973617826f..7d2bb1549608 100644 +--- a/drivers/hwtracing/coresight/of_coresight.c ++++ b/drivers/hwtracing/coresight/of_coresight.c +@@ -150,7 +150,7 @@ struct coresight_platform_data *of_get_coresight_platform_data( + continue; + + /* The local out port number */ +- pdata->outports[i] = endpoint.id; ++ pdata->outports[i] = endpoint.port; + + /* + * Get a handle on the remote port and parent +diff --git a/drivers/input/keyboard/qt1070.c b/drivers/input/keyboard/qt1070.c +index 5a5778729e37..76bb51309a78 100644 +--- a/drivers/input/keyboard/qt1070.c ++++ b/drivers/input/keyboard/qt1070.c +@@ -274,9 +274,18 @@ static const struct i2c_device_id qt1070_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, qt1070_id); + ++#ifdef CONFIG_OF ++static const struct of_device_id qt1070_of_match[] = { ++ { .compatible = "qt1070", }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, qt1070_of_match); ++#endif ++ + static struct i2c_driver qt1070_driver = { + .driver = { + .name = "qt1070", ++ .of_match_table = of_match_ptr(qt1070_of_match), + .pm = &qt1070_pm_ops, + }, + .id_table = qt1070_id, +diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c +index 5d0cd51c6f41..a4b7b4c3d27b 100644 +--- a/drivers/input/touchscreen/tsc2007.c ++++ b/drivers/input/touchscreen/tsc2007.c +@@ -455,6 +455,14 @@ static int tsc2007_probe(struct i2c_client *client, + + tsc2007_stop(ts); + ++ /* power down the chip (TSC2007_SETUP does not ACK on I2C) */ ++ err = tsc2007_xfer(ts, PWRDOWN); ++ if (err < 0) { ++ dev_err(&client->dev, ++ "Failed to setup chip: %d\n", err); ++ return err; /* usually, chip does not respond */ ++ } ++ + err = input_register_device(input_dev); + if (err) { + dev_err(&client->dev, +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index fa0adef32bd6..62739766b60b 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -126,7 +126,7 @@ static int __alloc_and_insert_iova_range(struct iova_domain *iovad, + break; /* found a free slot */ + } + adjust_limit_pfn: +- limit_pfn = curr_iova->pfn_lo - 1; ++ limit_pfn = curr_iova->pfn_lo ? (curr_iova->pfn_lo - 1) : 0; + move_left: + prev = curr; + curr = rb_prev(curr); +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index c5f1757ac61d..82e00e3ad0e0 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -663,7 +663,7 @@ static struct irq_chip its_irq_chip = { + * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations. + */ + #define IRQS_PER_CHUNK_SHIFT 5 +-#define IRQS_PER_CHUNK (1 << IRQS_PER_CHUNK_SHIFT) ++#define IRQS_PER_CHUNK (1UL << IRQS_PER_CHUNK_SHIFT) + + static unsigned long *lpi_bitmap; + static u32 lpi_chunks; +@@ -1168,11 +1168,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + /* +- * At least one bit of EventID is being used, hence a minimum +- * of two entries. No, the architecture doesn't let you +- * express an ITT with a single entry. ++ * We allocate at least one chunk worth of LPIs bet device, ++ * and thus that many ITEs. The device may require less though. + */ +- nr_ites = max(2UL, roundup_pow_of_two(nvecs)); ++ nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs)); + sz = nr_ites * its->ite_size; + sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1; + itt = kzalloc(sz, GFP_KERNEL); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 86ab6d14d782..ca968c3f25c7 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3372,9 +3372,20 @@ static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s, + BUG_ON(test_bit(R5_Wantcompute, &dev->flags)); + BUG_ON(test_bit(R5_Wantread, &dev->flags)); + BUG_ON(sh->batch_head); ++ ++ /* ++ * In the raid6 case if the only non-uptodate disk is P ++ * then we already trusted P to compute the other failed ++ * drives. It is safe to compute rather than re-read P. ++ * In other cases we only compute blocks from failed ++ * devices, otherwise check/repair might fail to detect ++ * a real inconsistency. ++ */ ++ + if ((s->uptodate == disks - 1) && ++ ((sh->qd_idx >= 0 && sh->pd_idx == disk_idx) || + (s->failed && (disk_idx == s->failed_num[0] || +- disk_idx == s->failed_num[1]))) { ++ disk_idx == s->failed_num[1])))) { + /* have disk failed, and we're requested to fetch it; + * do compute it + */ +diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c +index 1f8af1ee8352..1e4783b51a35 100644 +--- a/drivers/media/i2c/soc_camera/ov6650.c ++++ b/drivers/media/i2c/soc_camera/ov6650.c +@@ -1033,7 +1033,7 @@ static int ov6650_probe(struct i2c_client *client, + priv->code = MEDIA_BUS_FMT_YUYV8_2X8; + priv->colorspace = V4L2_COLORSPACE_JPEG; + +- priv->clk = v4l2_clk_get(&client->dev, "mclk"); ++ priv->clk = v4l2_clk_get(&client->dev, NULL); + if (IS_ERR(priv->clk)) { + ret = PTR_ERR(priv->clk); + goto eclkget; +diff --git a/drivers/media/pci/solo6x10/solo6x10-v4l2.c b/drivers/media/pci/solo6x10/solo6x10-v4l2.c +index f7ce493b1fee..a0b61e88c838 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-v4l2.c ++++ b/drivers/media/pci/solo6x10/solo6x10-v4l2.c +@@ -342,6 +342,17 @@ static void solo_stop_streaming(struct vb2_queue *q) + struct solo_dev *solo_dev = vb2_get_drv_priv(q); + + solo_stop_thread(solo_dev); ++ ++ spin_lock(&solo_dev->slock); ++ while (!list_empty(&solo_dev->vidq_active)) { ++ struct solo_vb2_buf *buf = list_entry( ++ solo_dev->vidq_active.next, ++ struct solo_vb2_buf, list); ++ ++ list_del(&buf->list); ++ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ } ++ spin_unlock(&solo_dev->slock); + INIT_LIST_HEAD(&solo_dev->vidq_active); + } + +diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c +index 9caea8344547..d793c630f1dd 100644 +--- a/drivers/media/usb/cpia2/cpia2_v4l.c ++++ b/drivers/media/usb/cpia2/cpia2_v4l.c +@@ -812,7 +812,7 @@ static int cpia2_querybuf(struct file *file, void *fh, struct v4l2_buffer *buf) + struct camera_data *cam = video_drvdata(file); + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; +@@ -863,7 +863,7 @@ static int cpia2_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || + buf->memory != V4L2_MEMORY_MMAP || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + DBG("QBUF #%d\n", buf->index); +diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c +index cc91f7b3d90c..eb29113e0bac 100644 +--- a/drivers/misc/enclosure.c ++++ b/drivers/misc/enclosure.c +@@ -148,7 +148,7 @@ enclosure_register(struct device *dev, const char *name, int components, + for (i = 0; i < components; i++) { + edev->component[i].number = -1; + edev->component[i].slot = -1; +- edev->component[i].power_status = 1; ++ edev->component[i].power_status = -1; + } + + mutex_lock(&container_list_lock); +@@ -600,6 +600,11 @@ static ssize_t get_component_power_status(struct device *cdev, + + if (edev->cb->get_power_status) + edev->cb->get_power_status(edev, ecomp); ++ ++ /* If still uninitialized, the callback failed or does not exist. */ ++ if (ecomp->power_status == -1) ++ return (edev->cb->get_power_status) ? -EIO : -ENOTTY; ++ + return snprintf(buf, 40, "%s\n", ecomp->power_status ? "on" : "off"); + } + +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 27864c0863ef..8406f346b0be 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -626,7 +626,8 @@ static void nand_command(struct mtd_info *mtd, unsigned int command, + chip->cmd_ctrl(mtd, readcmd, ctrl); + ctrl &= ~NAND_CTRL_CHANGE; + } +- chip->cmd_ctrl(mtd, command, ctrl); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ctrl); + + /* Address cycle, when necessary */ + ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE; +@@ -655,6 +656,7 @@ static void nand_command(struct mtd_info *mtd, unsigned int command, + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: + case NAND_CMD_ERASE2: +@@ -717,7 +719,9 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command, + } + + /* Command latch cycle */ +- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); + + if (column != -1 || page_addr != -1) { + int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE; +@@ -750,6 +754,7 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command, + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_CACHEDPROG: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2cb34b0f3856..eadccf498589 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3276,12 +3276,17 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, + for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { + u64 nv = new[i]; + u64 ov = old[i]; ++ s64 delta = nv - ov; + + /* detects if this particular field is 32bit only */ + if (((nv | ov) >> 32) == 0) +- res[i] += (u32)nv - (u32)ov; +- else +- res[i] += nv - ov; ++ delta = (s64)(s32)((u32)nv - (u32)ov); ++ ++ /* filter anomalies, some drivers reset their stats ++ * at down/up events. ++ */ ++ if (delta > 0) ++ res[i] += delta; + } + } + +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +index c31e691d11fc..e8d31640058d 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +@@ -604,6 +604,7 @@ static void xgene_enet_cle_bypass(struct xgene_enet_pdata *pdata, + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG0_0_ADDR, &cb); + cb |= CFG_CLE_BYPASS_EN0; + CFG_CLE_IP_PROTOCOL0_SET(&cb, 3); ++ CFG_CLE_IP_HDR_LEN_SET(&cb, 0); + xgene_enet_wr_csr(pdata, CLE_BYPASS_REG0_0_ADDR, cb); + + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG1_0_ADDR, &cb); +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h +index c153a1dc5ff7..480312105964 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h +@@ -147,6 +147,7 @@ enum xgene_enet_rm { + #define CFG_RXCLK_MUXSEL0_SET(dst, val) xgene_set_bits(dst, val, 26, 3) + + #define CFG_CLE_IP_PROTOCOL0_SET(dst, val) xgene_set_bits(dst, val, 16, 2) ++#define CFG_CLE_IP_HDR_LEN_SET(dst, val) xgene_set_bits(dst, val, 8, 5) + #define CFG_CLE_DSTQID0_SET(dst, val) xgene_set_bits(dst, val, 0, 12) + #define CFG_CLE_FPSEL0_SET(dst, val) xgene_set_bits(dst, val, 16, 4) + #define CFG_MACMODE_SET(dst, val) xgene_set_bits(dst, val, 18, 2) +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 6d0c5d5eea6d..58c0fccdd8cb 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +index 2ce0eba5e040..38431b49020f 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +@@ -983,7 +983,7 @@ static void fm10k_self_test(struct net_device *dev, + + memset(data, 0, sizeof(*data) * FM10K_TEST_LEN); + +- if (FM10K_REMOVED(hw)) { ++ if (FM10K_REMOVED(hw->hw_addr)) { + netif_err(interface, drv, dev, + "Interface removed - test blocked\n"); + eth_test->flags |= ETH_TEST_FL_FAILED; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 488a50d59dca..3da1f206ff84 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1073,6 +1073,11 @@ static int i40e_get_eeprom_len(struct net_device *netdev) + struct i40e_hw *hw = &np->vsi->back->hw; + u32 val; + ++#define X722_EEPROM_SCOPE_LIMIT 0x5B9FFF ++ if (hw->mac.type == I40E_MAC_X722) { ++ val = X722_EEPROM_SCOPE_LIMIT + 1; ++ return val; ++ } + val = (rd32(hw, I40E_GLPCI_LBARCTRL) + & I40E_GLPCI_LBARCTRL_FL_SIZE_MASK) + >> I40E_GLPCI_LBARCTRL_FL_SIZE_SHIFT; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +index 6100cdd9ad13..dd4e6ea9e0e1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +@@ -292,14 +292,14 @@ i40e_status i40e_read_nvm_word(struct i40e_hw *hw, u16 offset, + { + enum i40e_status_code ret_code = 0; + +- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { +- ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); +- if (!ret_code) { ++ ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); ++ if (!ret_code) { ++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { + ret_code = i40e_read_nvm_word_aq(hw, offset, data); +- i40e_release_nvm(hw); ++ } else { ++ ret_code = i40e_read_nvm_word_srctl(hw, offset, data); + } +- } else { +- ret_code = i40e_read_nvm_word_srctl(hw, offset, data); ++ i40e_release_nvm(hw); + } + return ret_code; + } +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 8aecea0d5dbf..142015af43db 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -282,6 +282,10 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb, + if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS) + success = true; + } else { ++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest, ++ ipvlan->phy_dev->dev_addr)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + ret = RX_HANDLER_ANOTHER; + success = true; + } +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index ba21d072be31..6b4cc1c2e6b4 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -399,6 +399,9 @@ static int veth_newlink(struct net *src_net, struct net_device *dev, + if (ifmp && (dev->ifindex != 0)) + peer->ifindex = ifmp->ifi_index; + ++ peer->gso_max_size = dev->gso_max_size; ++ peer->gso_max_segs = dev->gso_max_segs; ++ + err = register_netdevice(peer); + put_net(net); + net = NULL; +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index dab3bf6649e6..e4ff1e45c02e 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2834,6 +2834,11 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev, + needed_headroom = lowerdev->hard_header_len; + } + ++ if (lowerdev) { ++ dev->gso_max_size = lowerdev->gso_max_size; ++ dev->gso_max_segs = lowerdev->gso_max_segs; ++ } ++ + if (conf->mtu) { + err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false); + if (err) +diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c +index 1a88a24ffeac..30c357567054 100644 +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -1892,6 +1892,15 @@ static ssize_t ath10k_write_simulate_radar(struct file *file, + size_t count, loff_t *ppos) + { + struct ath10k *ar = file->private_data; ++ struct ath10k_vif *arvif; ++ ++ /* Just check for for the first vif alone, as all the vifs will be ++ * sharing the same channel and if the channel is disabled, all the ++ * vifs will share the same 'is_started' state. ++ */ ++ arvif = list_first_entry(&ar->arvifs, typeof(*arvif), list); ++ if (!arvif->is_started) ++ return -EINVAL; + + ieee80211_radar_detected(ar->hw); + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index bed8d89fe3a0..09e14ce85dd0 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5497,6 +5497,16 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + "mac vdev %d peer delete %pM (sta gone)\n", + arvif->vdev_id, sta->addr); + ++ if (sta->tdls) { ++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, ++ sta, ++ WMI_TDLS_PEER_STATE_TEARDOWN); ++ if (ret) ++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n", ++ sta->addr, ++ WMI_TDLS_PEER_STATE_TEARDOWN, ret); ++ } ++ + ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + if (ret) + ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n", +@@ -6427,7 +6437,7 @@ ath10k_mac_update_rx_channel(struct ath10k *ar, + lockdep_assert_held(&ar->data_lock); + + WARN_ON(ctx && vifs); +- WARN_ON(vifs && n_vifs != 1); ++ WARN_ON(vifs && !n_vifs); + + /* FIXME: Sort of an optimization and a workaround. Peers and vifs are + * on a linked list now. Doing a lookup peer -> vif -> chanctx for each +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 72a4ef709577..a8b2553e8988 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -4826,7 +4826,8 @@ enum wmi_10_4_vdev_param { + #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3) + + #define WMI_TXBF_STS_CAP_OFFSET_LSB 4 +-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0 ++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70 ++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7) + #define WMI_BF_SOUND_DIM_OFFSET_LSB 8 + #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00 + +diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c +index 85bca557a339..f09fafaaaf1a 100644 +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -125,9 +125,15 @@ void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src, + u32 *d = dst; + const volatile u32 __iomem *s = src; + +- /* size_t is unsigned, if (count%4 != 0) it will wrap */ +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + *d++ = __raw_readl(s++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = __raw_readl(s); ++ ++ memcpy(d, &tmp, count); ++ } + } + + void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, +@@ -136,8 +142,16 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src, + volatile u32 __iomem *d = dst; + const u32 *s = src; + +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + __raw_writel(*s++, d++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = 0; ++ ++ memcpy(&tmp, s, count); ++ __raw_writel(tmp, d); ++ } + } + + static void wil_disconnect_cid(struct wil6210_priv *wil, int cid, +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index f877fbc7d7af..8a9164da6c50 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -699,16 +699,21 @@ static int hwsim_fops_ps_write(void *dat, u64 val) + val != PS_MANUAL_POLL) + return -EINVAL; + +- old_ps = data->ps; +- data->ps = val; +- +- local_bh_disable(); + if (val == PS_MANUAL_POLL) { ++ if (data->ps != PS_ENABLED) ++ return -EINVAL; ++ local_bh_disable(); + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_ps_poll, data); +- data->ps_poll_pending = true; +- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) { ++ local_bh_enable(); ++ return 0; ++ } ++ old_ps = data->ps; ++ data->ps = val; ++ ++ local_bh_disable(); ++ if (old_ps == PS_DISABLED && val != PS_DISABLED) { + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_nullfunc_ps, data); +diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c +index af62c4c854f3..b4f31dad40d6 100644 +--- a/drivers/nfc/nfcmrvl/fw_dnld.c ++++ b/drivers/nfc/nfcmrvl/fw_dnld.c +@@ -17,7 +17,7 @@ + */ + + #include +-#include ++#include + #include + #include + #include +diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c +index a7faa0bcc01e..fc8e78a29d77 100644 +--- a/drivers/nfc/nfcmrvl/spi.c ++++ b/drivers/nfc/nfcmrvl/spi.c +@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv, + /* Send the SPI packet */ + err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion, + skb); +- if (err != 0) { ++ if (err) + nfc_err(priv->dev, "spi_send failed %d", err); +- kfree_skb(skb); +- } ++ + return err; + } + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 97a280d50d6d..7c509bff9295 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -223,7 +223,7 @@ ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len) + str[i] = '_'; + } + +- return tsize; ++ return repend; + } + EXPORT_SYMBOL_GPL(of_device_get_modalias); + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 32bd8ab79d53..5e42b5f2f565 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -463,8 +463,6 @@ static void pci_device_shutdown(struct device *dev) + + if (drv && drv->shutdown) + drv->shutdown(pci_dev); +- pci_msi_shutdown(pci_dev); +- pci_msix_shutdown(pci_dev); + + #ifdef CONFIG_KEXEC_CORE + /* +diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c +index 8af1f900ea65..1ba58fb6f796 100644 +--- a/drivers/perf/arm_pmu.c ++++ b/drivers/perf/arm_pmu.c +@@ -321,10 +321,16 @@ validate_group(struct perf_event *event) + return 0; + } + ++static struct arm_pmu_platdata *armpmu_get_platdata(struct arm_pmu *armpmu) ++{ ++ struct platform_device *pdev = armpmu->plat_device; ++ ++ return pdev ? dev_get_platdata(&pdev->dev) : NULL; ++} ++ + static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + { + struct arm_pmu *armpmu; +- struct platform_device *plat_device; + struct arm_pmu_platdata *plat; + int ret; + u64 start_clock, finish_clock; +@@ -336,8 +342,8 @@ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + * dereference. + */ + armpmu = *(void **)dev; +- plat_device = armpmu->plat_device; +- plat = dev_get_platdata(&plat_device->dev); ++ ++ plat = armpmu_get_platdata(armpmu); + + start_clock = sched_clock(); + if (plat && plat->handle_irq) +diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c +index d4de0607b502..3039fb762893 100644 +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -69,6 +69,7 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip); + unsigned long long c; + unsigned long rate, hz; ++ unsigned long long ns100 = NSEC_PER_SEC; + u32 val = 0; + int err; + +@@ -87,9 +88,11 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + * cycles at the PWM clock rate will take period_ns nanoseconds. + */ + rate = clk_get_rate(pc->clk) >> PWM_DUTY_WIDTH; +- hz = NSEC_PER_SEC / period_ns; + +- rate = (rate + (hz / 2)) / hz; ++ /* Consider precision in PWM_SCALE_WIDTH rate calculation */ ++ ns100 *= 100; ++ hz = DIV_ROUND_CLOSEST_ULL(ns100, period_ns); ++ rate = DIV_ROUND_CLOSEST(rate * 100, hz); + + /* + * Since the actual PWM divider is the register's frequency divider +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 7a58128a0000..2f61d8cd5882 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -835,8 +835,10 @@ static void ipr_sata_eh_done(struct ipr_cmnd *ipr_cmd) + + qc->err_mask |= AC_ERR_OTHER; + sata_port->ioasa.status |= ATA_BUSY; +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + ata_qc_complete(qc); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -5864,8 +5866,10 @@ static void ipr_erp_done(struct ipr_cmnd *ipr_cmd) + res->in_erp = 0; + } + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6255,8 +6259,10 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg, + } + + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6282,8 +6288,10 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd) + scsi_dma_unmap(scsi_cmd); + + spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); + } else { + spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 60720e5b1ebc..6b61b09b3226 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -180,7 +180,7 @@ static struct { + {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */ +- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */ ++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */ + {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN}, + {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD}, + {"HP", "C1557A", NULL, BLIST_FORCELUN}, +@@ -589,17 +589,12 @@ int scsi_get_device_flags_keyed(struct scsi_device *sdev, + int key) + { + struct scsi_dev_info_list *devinfo; +- int err; + + devinfo = scsi_dev_info_list_find(vendor, model, key); + if (!IS_ERR(devinfo)) + return devinfo->flags; + +- err = PTR_ERR(devinfo); +- if (err != -ENOENT) +- return err; +- +- /* nothing found, return nothing */ ++ /* key or device not found: return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; + +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index 4d655b568269..5711d58f9e81 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { + {"IBM", "1815", "rdac", }, + {"IBM", "1818", "rdac", }, + {"IBM", "3526", "rdac", }, ++ {"IBM", "3542", "rdac", }, ++ {"IBM", "3552", "rdac", }, + {"SGI", "TP9", "rdac", }, + {"SGI", "IS", "rdac", }, +- {"STK", "OPENstorage D280", "rdac", }, ++ {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, ++ {"STK", "BladeCtlr", "rdac", }, + {"SUN", "CSM", "rdac", }, + {"SUN", "LCSM100", "rdac", }, + {"SUN", "STK6580_6780", "rdac", }, +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 044d06410d4c..01168acc864d 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -546,7 +546,6 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + ecomp = &edev->component[components++]; + + if (!IS_ERR(ecomp)) { +- ses_get_power_status(edev, ecomp); + if (addl_desc_ptr) + ses_process_descriptor( + ecomp, +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 0f0ff75755e0..4b43effbf4fc 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -535,6 +535,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + } else + count = (old_hdr->result == 0) ? 0 : -EIO; + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + retval = count; + free_old_hdr: + kfree(old_hdr); +@@ -575,6 +576,7 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp) + } + err_out: + err2 = sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return err ? : err2 ? : count; + } + +@@ -674,18 +676,14 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + * is a non-zero input_size, so emit a warning. + */ + if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) { +- static char cmd[TASK_COMM_LEN]; +- if (strcmp(current->comm, cmd)) { +- printk_ratelimited(KERN_WARNING +- "sg_write: data in/out %d/%d bytes " +- "for SCSI command 0x%x-- guessing " +- "data in;\n program %s not setting " +- "count and/or reply_len properly\n", +- old_hdr.reply_len - (int)SZ_SG_HEADER, +- input_size, (unsigned int) cmnd[0], +- current->comm); +- strcpy(cmd, current->comm); +- } ++ printk_ratelimited(KERN_WARNING ++ "sg_write: data in/out %d/%d bytes " ++ "for SCSI command 0x%x-- guessing " ++ "data in;\n program %s not setting " ++ "count and/or reply_len properly\n", ++ old_hdr.reply_len - (int)SZ_SG_HEADER, ++ input_size, (unsigned int) cmnd[0], ++ current->comm); + } + k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking); + return (k < 0) ? k : count; +@@ -784,11 +782,15 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, + "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", + (int) cmnd[0], (int) hp->cmd_len)); + ++ if (hp->dxfer_len >= SZ_256M) ++ return -EINVAL; ++ + k = sg_start_req(srp, cmnd); + if (k) { + SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp, + "sg_common_write: start_req err=%d\n", k)); + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return k; /* probably out of space --> ENOMEM */ + } + if (atomic_read(&sdp->detaching)) { +@@ -801,6 +803,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp, + } + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return -ENODEV; + } + +@@ -1290,6 +1293,7 @@ sg_rq_end_io_usercontext(struct work_struct *work) + struct sg_fd *sfp = srp->parentfp; + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + kref_put(&sfp->f_ref, sg_remove_sfp); + } + +@@ -1834,8 +1838,6 @@ sg_finish_rem_req(Sg_request *srp) + else + sg_remove_scat(sfp, req_schp); + +- sg_remove_request(sfp, srp); +- + return ret; + } + +@@ -2182,12 +2184,17 @@ sg_remove_sfp_usercontext(struct work_struct *work) + struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); + struct sg_device *sdp = sfp->parentdp; + Sg_request *srp; ++ unsigned long iflags; + + /* Cleanup any responses which were never read(). */ ++ write_lock_irqsave(&sfp->rq_list_lock, iflags); + while (!list_empty(&sfp->rq_list)) { + srp = list_first_entry(&sfp->rq_list, Sg_request, entry); + sg_finish_rem_req(srp); ++ list_del(&srp->entry); ++ srp->parentfp = NULL; + } ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + if (sfp->reserve.bufflen > 0) { + SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp, +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index ed8283e7397a..83b53cd956aa 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -457,6 +457,8 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + int elements = 0; + int word_len, element_count; + struct omap2_mcspi_cs *cs = spi->controller_state; ++ void __iomem *chstat_reg = cs->base + OMAP2_MCSPI_CHSTAT0; ++ + mcspi = spi_master_get_devdata(spi->master); + mcspi_dma = &mcspi->dma_channels[spi->chip_select]; + count = xfer->len; +@@ -517,8 +519,8 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + if (l & OMAP2_MCSPI_CHCONF_TURBO) { + elements--; + +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, ++ OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); +@@ -536,8 +538,7 @@ omap2_mcspi_rx_dma(struct spi_device *spi, struct spi_transfer *xfer, + return count; + } + } +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index e77add01b0e9..48888ab630c2 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -457,7 +457,7 @@ err_free_master: + + static int sun6i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } +diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c +index fdfeb42b2b8f..06ef26872462 100644 +--- a/drivers/staging/speakup/kobjects.c ++++ b/drivers/staging/speakup/kobjects.c +@@ -831,7 +831,9 @@ static ssize_t message_show(struct kobject *kobj, + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + unsigned long flags; + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + spin_lock_irqsave(&speakup_info.spinlock, flags); + retval = message_show_helper(buf, group->start, group->end); + spin_unlock_irqrestore(&speakup_info.spinlock, flags); +@@ -843,7 +845,9 @@ static ssize_t message_store(struct kobject *kobj, struct kobj_attribute *attr, + { + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + return message_store_helper(buf, count, group); + } + +diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c +index dbbe72c7e255..f78353ddeea5 100644 +--- a/drivers/staging/wilc1000/host_interface.c ++++ b/drivers/staging/wilc1000/host_interface.c +@@ -2179,6 +2179,8 @@ static s32 Handle_Get_InActiveTime(struct host_if_drv *hif_drv, + wid.type = WID_STR; + wid.size = ETH_ALEN; + wid.val = kmalloc(wid.size, GFP_KERNEL); ++ if (!wid.val) ++ return -ENOMEM; + + stamac = wid.val; + memcpy(stamac, strHostIfStaInactiveT->mac, ETH_ALEN); +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 571c21727ff9..88bd950665fa 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1385,6 +1385,7 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + dwc2_core_init(hsotg, false, -1); + dwc2_enable_global_interrupts(hsotg); + spin_lock_irqsave(&hsotg->lock, flags); ++ dwc2_hsotg_disconnect(hsotg); + dwc2_hsotg_core_init_disconnected(hsotg, false); + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_hsotg_core_connect(hsotg); +diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c +index ccb9c213cc9f..e9bd8d4abca0 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_core.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c +@@ -475,7 +475,7 @@ static int bdc_probe(struct platform_device *pdev) + bdc->dev = dev; + dev_dbg(bdc->dev, "bdc->regs: %p irq=%d\n", bdc->regs, bdc->irq); + +- temp = bdc_readl(bdc->regs, BDC_BDCSC); ++ temp = bdc_readl(bdc->regs, BDC_BDCCAP1); + if ((temp & BDC_P64) && + !dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64))) { + dev_dbg(bdc->dev, "Using 64-bit address\n"); +diff --git a/drivers/usb/gadget/udc/bdc/bdc_pci.c b/drivers/usb/gadget/udc/bdc/bdc_pci.c +index 02968842b359..708e36f530d8 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c +@@ -82,6 +82,7 @@ static int bdc_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + dev_err(&pci->dev, + "couldn't add resources to bdc device\n"); ++ platform_device_put(bdc); + return ret; + } + +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 8080a11947b7..eb876ed96861 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2105,16 +2105,13 @@ static int dummy_hub_control( + } + break; + case USB_PORT_FEAT_POWER: +- if (hcd->speed == HCD_USB3) { +- if (dum_hcd->port_status & USB_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- } else +- if (dum_hcd->port_status & +- USB_SS_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- /* FALLS THROUGH */ ++ dev_dbg(dummy_dev(dum_hcd), "power-off\n"); ++ if (hcd->speed == HCD_USB3) ++ dum_hcd->port_status &= ~USB_SS_PORT_STAT_POWER; ++ else ++ dum_hcd->port_status &= ~USB_PORT_STAT_POWER; ++ set_link_state(dum_hcd); ++ break; + default: + dum_hcd->port_status &= ~(1 << wValue); + set_link_state(dum_hcd); +@@ -2285,14 +2282,13 @@ static int dummy_hub_control( + if ((dum_hcd->port_status & + USB_SS_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } + } else + if ((dum_hcd->port_status & + USB_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } ++ set_link_state(dum_hcd); + } + break; + case GetPortErrorCount: +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 9362424c2340..924b3d6c3e9b 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -759,8 +759,8 @@ static int clcdfb_of_dma_setup(struct clcd_fb *fb) + if (err) + return err; + +- framesize = fb->panel->mode.xres * fb->panel->mode.yres * +- fb->panel->bpp / 8; ++ framesize = PAGE_ALIGN(fb->panel->mode.xres * fb->panel->mode.yres * ++ fb->panel->bpp / 8); + fb->fb.screen_base = dma_alloc_coherent(&fb->dev->dev, framesize, + &dma, GFP_KERNEL); + if (!fb->fb.screen_base) +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index 162689227a23..b73520aaf697 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hdmi_vendor_infoframe *frame) + } + EXPORT_SYMBOL(hdmi_vendor_infoframe_init); + ++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame) ++{ ++ /* for side by side (half) we also need to provide 3D_Ext_Data */ ++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) ++ return 6; ++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) ++ return 5; ++ else ++ return 4; ++} ++ + /** + * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer + * @frame: HDMI infoframe +@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + u8 *ptr = buffer; + size_t length; + +- /* empty info frame */ +- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID) +- return -EINVAL; +- + /* only one of those can be supplied */ + if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) + return -EINVAL; + +- /* for side by side (half) we also need to provide 3D_Ext_Data */ +- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) +- frame->length = 6; +- else +- frame->length = 5; ++ frame->length = hdmi_vendor_infoframe_length(frame); + + length = HDMI_INFOFRAME_HEADER_SIZE + frame->length; + +@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + ptr[5] = 0x0c; + ptr[6] = 0x00; + +- if (frame->vic) { +- ptr[7] = 0x1 << 5; /* video format */ +- ptr[8] = frame->vic; +- } else { ++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) { + ptr[7] = 0x2 << 5; /* video format */ + ptr[8] = (frame->s3d_struct & 0xf) << 4; + if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) + ptr[9] = (frame->s3d_ext_data & 0xf) << 4; ++ } else if (frame->vic) { ++ ptr[7] = 0x1 << 5; /* video format */ ++ ptr[8] = frame->vic; ++ } else { ++ ptr[7] = 0x0 << 5; /* video format */ + } + + hdmi_infoframe_set_checksum(buffer, length); +@@ -1161,7 +1166,7 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR || + ptr[1] != 1 || +- (ptr[2] != 5 && ptr[2] != 6)) ++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6)) + return -EINVAL; + + length = ptr[2]; +@@ -1189,16 +1194,22 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + hvf->length = length; + +- if (hdmi_video_format == 0x1) { +- hvf->vic = ptr[4]; +- } else if (hdmi_video_format == 0x2) { ++ if (hdmi_video_format == 0x2) { ++ if (length != 5 && length != 6) ++ return -EINVAL; + hvf->s3d_struct = ptr[4] >> 4; + if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) { +- if (length == 6) +- hvf->s3d_ext_data = ptr[5] >> 4; +- else ++ if (length != 6) + return -EINVAL; ++ hvf->s3d_ext_data = ptr[5] >> 4; + } ++ } else if (hdmi_video_format == 0x1) { ++ if (length != 5) ++ return -EINVAL; ++ hvf->vic = ptr[4]; ++ } else { ++ if (length != 4) ++ return -EINVAL; + } + + return 0; +diff --git a/fs/aio.c b/fs/aio.c +index fe4f49212b99..88ede4a84ce0 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -68,9 +68,9 @@ struct aio_ring { + #define AIO_RING_PAGES 8 + + struct kioctx_table { +- struct rcu_head rcu; +- unsigned nr; +- struct kioctx *table[]; ++ struct rcu_head rcu; ++ unsigned nr; ++ struct kioctx __rcu *table[]; + }; + + struct kioctx_cpu { +@@ -115,7 +115,8 @@ struct kioctx { + struct page **ring_pages; + long nr_pages; + +- struct work_struct free_work; ++ struct rcu_head free_rcu; ++ struct work_struct free_work; /* see free_ioctx() */ + + /* + * signals when all in-flight requests are done +@@ -326,7 +327,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma) + for (i = 0; i < table->nr; i++) { + struct kioctx *ctx; + +- ctx = table->table[i]; ++ ctx = rcu_dereference(table->table[i]); + if (ctx && ctx->aio_ring_file == file) { + if (!atomic_read(&ctx->dead)) { + ctx->user_id = ctx->mmap_base = vma->vm_start; +@@ -573,6 +574,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb) + return cancel(&kiocb->common); + } + ++/* ++ * free_ioctx() should be RCU delayed to synchronize against the RCU ++ * protected lookup_ioctx() and also needs process context to call ++ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and ++ * ->free_work. ++ */ + static void free_ioctx(struct work_struct *work) + { + struct kioctx *ctx = container_of(work, struct kioctx, free_work); +@@ -586,6 +593,14 @@ static void free_ioctx(struct work_struct *work) + kmem_cache_free(kioctx_cachep, ctx); + } + ++static void free_ioctx_rcufn(struct rcu_head *head) ++{ ++ struct kioctx *ctx = container_of(head, struct kioctx, free_rcu); ++ ++ INIT_WORK(&ctx->free_work, free_ioctx); ++ schedule_work(&ctx->free_work); ++} ++ + static void free_ioctx_reqs(struct percpu_ref *ref) + { + struct kioctx *ctx = container_of(ref, struct kioctx, reqs); +@@ -594,8 +609,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref) + if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count)) + complete(&ctx->rq_wait->comp); + +- INIT_WORK(&ctx->free_work, free_ioctx); +- schedule_work(&ctx->free_work); ++ /* Synchronize against RCU protected table->table[] dereferences */ ++ call_rcu(&ctx->free_rcu, free_ioctx_rcufn); + } + + /* +@@ -636,9 +651,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm) + while (1) { + if (table) + for (i = 0; i < table->nr; i++) +- if (!table->table[i]) { ++ if (!rcu_access_pointer(table->table[i])) { + ctx->id = i; +- table->table[i] = ctx; ++ rcu_assign_pointer(table->table[i], ctx); + spin_unlock(&mm->ioctx_lock); + + /* While kioctx setup is in progress, +@@ -813,11 +828,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx, + } + + table = rcu_dereference_raw(mm->ioctx_table); +- WARN_ON(ctx != table->table[ctx->id]); +- table->table[ctx->id] = NULL; ++ WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id])); ++ RCU_INIT_POINTER(table->table[ctx->id], NULL); + spin_unlock(&mm->ioctx_lock); + +- /* percpu_ref_kill() will do the necessary call_rcu() */ ++ /* free_ioctx_reqs() will do the necessary RCU synchronization */ + wake_up_all(&ctx->wait); + + /* +@@ -859,7 +874,8 @@ void exit_aio(struct mm_struct *mm) + + skipped = 0; + for (i = 0; i < table->nr; ++i) { +- struct kioctx *ctx = table->table[i]; ++ struct kioctx *ctx = ++ rcu_dereference_protected(table->table[i], true); + + if (!ctx) { + skipped++; +@@ -1048,7 +1064,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) + if (!table || id >= table->nr) + goto out; + +- ctx = table->table[id]; ++ ctx = rcu_dereference(table->table[id]); + if (ctx && ctx->user_id == ctx_id) { + percpu_ref_get(&ctx->users); + ret = ctx; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 600c67ef8a03..6d874b1cd53c 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -568,6 +568,7 @@ void btrfs_free_stale_device(struct btrfs_device *cur_dev) + btrfs_sysfs_remove_fsid(fs_devs); + list_del(&fs_devs->list); + free_fs_devices(fs_devs); ++ break; + } else { + fs_devs->num_devices--; + list_del(&dev->dev_list); +@@ -4638,10 +4639,13 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + if (devs_max && ndevs > devs_max) + ndevs = devs_max; + /* +- * the primary goal is to maximize the number of stripes, so use as many +- * devices as possible, even if the stripes are not maximum sized. ++ * The primary goal is to maximize the number of stripes, so use as ++ * many devices as possible, even if the stripes are not maximum sized. ++ * ++ * The DUP profile stores more than one stripe per device, the ++ * max_avail is the total size so we have to adjust. + */ +- stripe_size = devices_info[ndevs-1].max_avail; ++ stripe_size = div_u64(devices_info[ndevs - 1].max_avail, dev_stripes); + num_stripes = ndevs * dev_stripes; + + /* +@@ -4681,8 +4685,6 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + stripe_size = devices_info[ndevs-1].max_avail; + } + +- stripe_size = div_u64(stripe_size, dev_stripes); +- + /* align to BTRFS_STRIPE_LEN */ + stripe_size = div_u64(stripe_size, raid_stripe_len); + stripe_size *= raid_stripe_len; +diff --git a/fs/dcache.c b/fs/dcache.c +index 3ed642e0a0c2..751a0d88f049 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -634,11 +634,16 @@ again: + spin_unlock(&parent->d_lock); + goto again; + } +- rcu_read_unlock(); +- if (parent != dentry) ++ if (parent != dentry) { + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +- else ++ if (unlikely(dentry->d_lockref.count < 0)) { ++ spin_unlock(&parent->d_lock); ++ parent = NULL; ++ } ++ } else { + parent = NULL; ++ } ++ rcu_read_unlock(); + return parent; + } + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index fedbf67a0842..928b9e046d8a 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -522,8 +522,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + get_node_info(sbi, nid, dni); + + if (sum->version != dni->version) { +- f2fs_put_page(node_page, 1); +- return false; ++ f2fs_msg(sbi->sb, KERN_WARNING, ++ "%s: valid data with mismatched node version.", ++ __func__); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); + } + + *nofs = ofs_of_node(node_page); +diff --git a/fs/namei.c b/fs/namei.c +index 844da20232b9..0fcad42e4d3e 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -570,9 +570,10 @@ static int __nd_alloc_stack(struct nameidata *nd) + static bool path_connected(const struct path *path) + { + struct vfsmount *mnt = path->mnt; ++ struct super_block *sb = mnt->mnt_sb; + +- /* Only bind mounts can have disconnected paths */ +- if (mnt->mnt_root == mnt->mnt_sb->s_root) ++ /* Bind mounts and multi-root filesystems can have disconnected paths */ ++ if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root)) + return true; + + return is_subdir(path->dentry, mnt->mnt_root); +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index 3149f7e58d6f..62f358f67764 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2581,6 +2581,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server, + /* initial superblock/root creation */ + mount_info->fill_super(s, mount_info); + nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned); ++ if (!(server->flags & NFS_MOUNT_UNSHARED)) ++ s->s_iflags |= SB_I_MULTIROOT; + } + + mntroot = nfs_get_root(s, mount_info->mntfh, dev_name); +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 9d6486d416a3..a72097b625ef 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -1961,7 +1961,7 @@ static int do_journal_release(struct reiserfs_transaction_handle *th, + * will be requeued because superblock is being shutdown and doesn't + * have MS_ACTIVE set. + */ +- cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work); ++ reiserfs_cancel_old_flush(sb); + /* wait for all commits to finish */ + cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work); + +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index 5dcf3ab83886..6ca00471afbf 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -2948,6 +2948,7 @@ int reiserfs_allocate_list_bitmaps(struct super_block *s, + struct reiserfs_list_bitmap *, unsigned int); + + void reiserfs_schedule_old_flush(struct super_block *s); ++void reiserfs_cancel_old_flush(struct super_block *s); + void add_save_link(struct reiserfs_transaction_handle *th, + struct inode *inode, int truncate); + int remove_save_link(struct inode *inode, int truncate); +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index f9f3be50081a..ee095246da4e 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -90,7 +90,9 @@ static void flush_old_commits(struct work_struct *work) + s = sbi->s_journal->j_work_sb; + + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Avoid clobbering the cancel state... */ ++ if (sbi->work_queued == 1) ++ sbi->work_queued = 0; + spin_unlock(&sbi->old_work_lock); + + reiserfs_sync_fs(s, 1); +@@ -117,21 +119,22 @@ void reiserfs_schedule_old_flush(struct super_block *s) + spin_unlock(&sbi->old_work_lock); + } + +-static void cancel_old_flush(struct super_block *s) ++void reiserfs_cancel_old_flush(struct super_block *s) + { + struct reiserfs_sb_info *sbi = REISERFS_SB(s); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Make sure no new flushes will be queued */ ++ sbi->work_queued = 2; + spin_unlock(&sbi->old_work_lock); ++ cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + } + + static int reiserfs_freeze(struct super_block *s) + { + struct reiserfs_transaction_handle th; + +- cancel_old_flush(s); ++ reiserfs_cancel_old_flush(s); + + reiserfs_write_lock(s); + if (!(s->s_flags & MS_RDONLY)) { +@@ -152,7 +155,13 @@ static int reiserfs_freeze(struct super_block *s) + + static int reiserfs_unfreeze(struct super_block *s) + { ++ struct reiserfs_sb_info *sbi = REISERFS_SB(s); ++ + reiserfs_allow_writes(s); ++ spin_lock(&sbi->old_work_lock); ++ /* Allow old_work to run again */ ++ sbi->work_queued = 0; ++ spin_unlock(&sbi->old_work_lock); + return 0; + } + +@@ -2187,7 +2196,7 @@ error_unlocked: + if (sbi->commit_wq) + destroy_workqueue(sbi->commit_wq); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); ++ reiserfs_cancel_old_flush(s); + + reiserfs_free_bitmap_cache(s); + if (SB_BUFFER_WITH_SB(s)) +diff --git a/include/linux/fs.h b/include/linux/fs.h +index f746a59fcc88..da79e9d66e5b 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1295,6 +1295,7 @@ struct mm_struct; + /* sb->s_iflags */ + #define SB_I_CGROUPWB 0x00000001 /* cgroup-aware writeback enabled */ + #define SB_I_NOEXEC 0x00000002 /* Ignore executables on this fs */ ++#define SB_I_MULTIROOT 0x00000008 /* Multiple roots to the dentry tree */ + + /* Possible states of 'frozen' field */ + enum { +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index fbfadba81c5a..771774e13f10 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -153,7 +153,7 @@ static inline int page_cache_get_speculative(struct page *page) + + #ifdef CONFIG_TINY_RCU + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + /* + * Preempt must be disabled here - we rely on rcu_read_lock doing +@@ -191,7 +191,7 @@ static inline int page_cache_add_speculative(struct page *page, int count) + + #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU) + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + VM_BUG_ON_PAGE(page_count(page) == 0, page); + atomic_add(count, &page->_count); +diff --git a/include/linux/platform_data/isl9305.h b/include/linux/platform_data/isl9305.h +index 1419133fa69e..4ac1a070af0a 100644 +--- a/include/linux/platform_data/isl9305.h ++++ b/include/linux/platform_data/isl9305.h +@@ -24,7 +24,7 @@ + struct regulator_init_data; + + struct isl9305_pdata { +- struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR]; ++ struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR + 1]; + }; + + #endif +diff --git a/include/net/tcp.h b/include/net/tcp.h +index cecb0e0eff06..a3696b778757 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1199,9 +1199,11 @@ void tcp_select_initial_window(int __space, __u32 mss, __u32 *rcv_wnd, + + static inline int tcp_win_from_space(int space) + { +- return sysctl_tcp_adv_win_scale<=0 ? +- (space>>(-sysctl_tcp_adv_win_scale)) : +- space - (space>>sysctl_tcp_adv_win_scale); ++ int tcp_adv_win_scale = sysctl_tcp_adv_win_scale; ++ ++ return tcp_adv_win_scale <= 0 ? ++ (space>>(-tcp_adv_win_scale)) : ++ space - (space>>tcp_adv_win_scale); + } + + /* Note: caller must be prepared to deal with negative returns */ +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c14003840bc5..79e3c21a35d0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1135,7 +1135,8 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn) + regs[insn->dst_reg].type = UNKNOWN_VALUE; + regs[insn->dst_reg].map_ptr = NULL; + } +- } else { ++ } else if (BPF_CLASS(insn->code) == BPF_ALU64 || ++ insn->imm >= 0) { + /* case: R = imm + * remember the value we stored into this reg + */ +diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c +index d5760c42f042..61d41ca41844 100644 +--- a/kernel/printk/braille.c ++++ b/kernel/printk/braille.c +@@ -2,12 +2,13 @@ + + #include + #include ++#include + #include + + #include "console_cmdline.h" + #include "braille.h" + +-char *_braille_console_setup(char **str, char **brl_options) ++int _braille_console_setup(char **str, char **brl_options) + { + if (!strncmp(*str, "brl,", 4)) { + *brl_options = ""; +@@ -15,14 +16,14 @@ char *_braille_console_setup(char **str, char **brl_options) + } else if (!strncmp(*str, "brl=", 4)) { + *brl_options = *str + 4; + *str = strchr(*brl_options, ','); +- if (!*str) ++ if (!*str) { + pr_err("need port name after brl=\n"); +- else +- *((*str)++) = 0; +- } else +- return NULL; ++ return -EINVAL; ++ } ++ *((*str)++) = 0; ++ } + +- return *str; ++ return 0; + } + + int +diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h +index 769d771145c8..749a6756843a 100644 +--- a/kernel/printk/braille.h ++++ b/kernel/printk/braille.h +@@ -9,7 +9,14 @@ braille_set_options(struct console_cmdline *c, char *brl_options) + c->brl_options = brl_options; + } + +-char * ++/* ++ * Setup console according to braille options. ++ * Return -EINVAL on syntax error, 0 on success (or no braille option was ++ * actually given). ++ * Modifies str to point to the serial options ++ * Sets brl_options to the parsed braille options. ++ */ ++int + _braille_console_setup(char **str, char **brl_options); + + int +@@ -25,10 +32,10 @@ braille_set_options(struct console_cmdline *c, char *brl_options) + { + } + +-static inline char * ++static inline int + _braille_console_setup(char **str, char **brl_options) + { +- return NULL; ++ return 0; + } + + static inline int +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index c5b1c62623cf..65ed3501c2ca 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -601,7 +601,8 @@ void resched_cpu(int cpu) + unsigned long flags; + + raw_spin_lock_irqsave(&rq->lock, flags); +- resched_curr(rq); ++ if (cpu_online(cpu) || cpu == smp_processor_id()) ++ resched_curr(rq); + raw_spin_unlock_irqrestore(&rq->lock, flags); + } + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index e0b5169aeac4..2ef31c93e195 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2144,7 +2144,7 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p) + if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) + queue_push_tasks(rq); + #endif /* CONFIG_SMP */ +- if (p->prio < rq->curr->prio) ++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq))) + resched_curr(rq); + } + } +diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c +index a26036d37a38..382b159d8592 100644 +--- a/kernel/time/sched_clock.c ++++ b/kernel/time/sched_clock.c +@@ -205,6 +205,11 @@ sched_clock_register(u64 (*read)(void), int bits, unsigned long rate) + + update_clock_read_data(&rd); + ++ if (sched_clock_timer.function != NULL) { ++ /* update timeout for clock wrap */ ++ hrtimer_start(&sched_clock_timer, cd.wrap_kt, HRTIMER_MODE_REL); ++ } ++ + r = rate; + if (r >= 4000000) { + r /= 1000000; +diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c +index ba7d8b288bb3..ef4f16e81283 100644 +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + +@@ -96,6 +97,9 @@ print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base, + + next_one: + i = 0; ++ ++ touch_nmi_watchdog(); ++ + raw_spin_lock_irqsave(&base->cpu_base->lock, flags); + + curr = timerqueue_getnext(&base->active); +@@ -207,6 +211,8 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu) + { + struct clock_event_device *dev = td->evtdev; + ++ touch_nmi_watchdog(); ++ + SEQ_printf(m, "Tick Device: mode: %d\n", td->mode); + if (cpu < 0) + SEQ_printf(m, "Broadcast device\n"); +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index ca4dc9031073..89da689b6433 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -559,8 +559,7 @@ static int vlan_dev_init(struct net_device *dev) + NETIF_F_HIGHDMA | NETIF_F_SCTP_CSUM | + NETIF_F_ALL_FCOE; + +- dev->features |= real_dev->vlan_features | NETIF_F_LLTX | +- NETIF_F_GSO_SOFTWARE; ++ dev->features |= dev->hw_features | NETIF_F_LLTX; + dev->gso_max_size = real_dev->gso_max_size; + if (dev->features & NETIF_F_VLAN_FEATURES) + netdev_warn(real_dev, "VLAN features are set incorrectly. Q-in-Q configurations may not work correctly.\n"); +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index f5d2fe5e31cc..c5208136e3fc 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -1603,10 +1603,22 @@ int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb, + /* if yes, the client has roamed and we have + * to unclaim it. + */ +- batadv_handle_unclaim(bat_priv, primary_if, +- primary_if->net_dev->dev_addr, +- ethhdr->h_source, vid); +- goto allow; ++ if (batadv_has_timed_out(claim->lasttime, 100)) { ++ /* only unclaim if the last claim entry is ++ * older than 100 ms to make sure we really ++ * have a roaming client here. ++ */ ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Roaming client %pM detected. Unclaim it.\n", ++ ethhdr->h_source); ++ batadv_handle_unclaim(bat_priv, primary_if, ++ primary_if->net_dev->dev_addr, ++ ethhdr->h_source, vid); ++ goto allow; ++ } else { ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Race for claim %pM detected. Drop packet.\n", ++ ethhdr->h_source); ++ goto handled; ++ } + } + + /* check if it is a multicast/broadcast frame */ +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index bcb0a1b64556..58588a610b05 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1441,7 +1441,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata, + break; + case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: +- BUG(); ++ WARN_ON(1); + break; + } + +diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c +index eeb3eb3ea9eb..024d6cf342c5 100644 +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -175,6 +175,9 @@ static int tcf_csum_ipv4_tcp(struct sk_buff *skb, + struct tcphdr *tcph; + const struct iphdr *iph; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -196,6 +199,9 @@ static int tcf_csum_ipv6_tcp(struct sk_buff *skb, + struct tcphdr *tcph; + const struct ipv6hdr *ip6h; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -219,6 +225,9 @@ static int tcf_csum_ipv4_udp(struct sk_buff *skb, + const struct iphdr *iph; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, +@@ -272,6 +281,9 @@ static int tcf_csum_ipv6_udp(struct sk_buff *skb, + const struct ipv6hdr *ip6h; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 4b09a9eaa35f..d95cb69460f0 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1313,7 +1313,7 @@ EXPORT_SYMBOL(xfrm_policy_delete); + + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) + { +- struct net *net = xp_net(pol); ++ struct net *net = sock_net(sk); + struct xfrm_policy *old_pol; + + #ifdef CONFIG_XFRM_SUB_POLICY +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 9895a8c56d8c..96d664e198bf 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1845,6 +1845,13 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++ if (!optval && !optlen) { ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); ++ __sk_dst_reset(sk); ++ return 0; ++ } ++ + if (optlen <= 0 || optlen > PAGE_SIZE) + return -EMSGSIZE; + +diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c +index dec607c17b64..6dc4ce47580f 100644 +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -722,7 +722,7 @@ module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); + + /* Maximum pathname length before accesses will start getting rejected */ + unsigned int aa_g_path_max = 2 * PATH_MAX; +-module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR); ++module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); + + /* Determines how paranoid loading of policy is and how much verification + * on the loaded policy is done. +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 19014293f927..8da7c91b725d 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -206,7 +206,8 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, + if (opened & FILE_CREATED) + iint->flags |= IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && +- !(iint->flags & IMA_DIGSIG_REQUIRED)) ++ (!(iint->flags & IMA_DIGSIG_REQUIRED) || ++ (inode->i_size == 0))) + status = INTEGRITY_PASS; + goto out; + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 3f370eb494d1..4c7db967b7bb 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4124,10 +4124,18 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in + u32 sid, node_perm; + + if (family == PF_INET) { ++ if (addrlen < sizeof(struct sockaddr_in)) { ++ err = -EINVAL; ++ goto out; ++ } + addr4 = (struct sockaddr_in *)address; + snum = ntohs(addr4->sin_port); + addrp = (char *)&addr4->sin_addr.s_addr; + } else { ++ if (addrlen < SIN6_LEN_RFC2133) { ++ err = -EINVAL; ++ goto out; ++ } + addr6 = (struct sockaddr_in6 *)address; + snum = ntohs(addr6->sin6_port); + addrp = (char *)&addr6->sin6_addr.s6_addr; +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 494b7b533366..daa1feac66bf 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1814,10 +1814,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + return -ENOMEM; + _snd_pcm_hw_params_any(params); + err = snd_pcm_hw_refine(substream, params); +- format_mask = *hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); +- kfree(params); + if (err < 0) +- return err; ++ goto error; ++ format_mask = *hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); + for (fmt = 0; fmt < 32; ++fmt) { + if (snd_mask_test(&format_mask, fmt)) { + int f = snd_pcm_oss_format_to(fmt); +@@ -1825,7 +1824,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + formats |= f; + } + } +- return formats; ++ ++ error: ++ kfree(params); ++ return err < 0 ? err : formats; + } + + static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format) +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 94fd3df2cf21..73ee8476584d 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -270,12 +270,12 @@ static int seq_free_client1(struct snd_seq_client *client) + + if (!client) + return 0; +- snd_seq_delete_all_ports(client); +- snd_seq_queue_client_leave(client->number); + spin_lock_irqsave(&clients_lock, flags); + clienttablock[client->number] = 1; + clienttab[client->number] = NULL; + spin_unlock_irqrestore(&clients_lock, flags); ++ snd_seq_delete_all_ports(client); ++ snd_seq_queue_client_leave(client->number); + snd_use_lock_sync(&client->use_lock); + snd_seq_queue_client_termination(client->number); + if (client->pool) +diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c +index bc1c8488fc2a..2bc6759e4adc 100644 +--- a/sound/core/seq/seq_prioq.c ++++ b/sound/core/seq/seq_prioq.c +@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo) + if (f->cells > 0) { + /* drain prioQ */ + while (f->cells > 0) +- snd_seq_cell_free(snd_seq_prioq_cell_out(f)); ++ snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL)); + } + + kfree(f); +@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, + return 0; + } + ++/* return 1 if the current time >= event timestamp */ ++static int event_is_ready(struct snd_seq_event *ev, void *current_time) ++{ ++ if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK) ++ return snd_seq_compare_tick_time(current_time, &ev->time.tick); ++ else ++ return snd_seq_compare_real_time(current_time, &ev->time.time); ++} ++ + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) + spin_lock_irqsave(&f->lock, flags); + + cell = f->head; ++ if (cell && current_time && !event_is_ready(&cell->event, current_time)) ++ cell = NULL; + if (cell) { + f->head = cell->next; + +@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f) + return f->cells; + } + +- +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f) +-{ +- if (f == NULL) { +- pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n"); +- return NULL; +- } +- return f->head; +-} +- +- + static inline int prioq_match(struct snd_seq_event_cell *cell, + int client, int timestamp) + { +diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h +index d38bb78d9345..2c315ca10fc4 100644 +--- a/sound/core/seq/seq_prioq.h ++++ b/sound/core/seq/seq_prioq.h +@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo); + int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell); + + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f); ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time); + + /* return number of events available in prioq */ + int snd_seq_prioq_avail(struct snd_seq_prioq *f); + +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f); +- + /* client left queue */ + void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp); + +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 79e0c5604ef8..1a6dc4ff44a6 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + + __again: + /* Process tick queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) { +- if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick, +- &cell->event.time.tick)) { +- cell = snd_seq_prioq_cell_out(q->tickq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->tickq, ++ &q->timer->tick.cur_tick); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + +- + /* Process time queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) { +- if (snd_seq_compare_real_time(&q->timer->cur_time, +- &cell->event.time.time)) { +- cell = snd_seq_prioq_cell_out(q->timeq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + + /* free lock */ +diff --git a/sound/firewire/digi00x/amdtp-dot.c b/sound/firewire/digi00x/amdtp-dot.c +index b02a5e8cad44..30e4925bf6b0 100644 +--- a/sound/firewire/digi00x/amdtp-dot.c ++++ b/sound/firewire/digi00x/amdtp-dot.c +@@ -28,6 +28,9 @@ + */ + #define MAX_MIDI_RX_BLOCKS 8 + ++/* 3 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) + 1. */ ++#define MAX_MIDI_PORTS 3 ++ + /* + * The double-oh-three algorithm was discovered by Robin Gareus and Damien + * Zammit in 2012, with reverse-engineering for Digi 003 Rack. +@@ -42,10 +45,8 @@ struct amdtp_dot { + unsigned int pcm_channels; + struct dot_state state; + +- unsigned int midi_ports; +- /* 2 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) */ +- struct snd_rawmidi_substream *midi[2]; +- int midi_fifo_used[2]; ++ struct snd_rawmidi_substream *midi[MAX_MIDI_PORTS]; ++ int midi_fifo_used[MAX_MIDI_PORTS]; + int midi_fifo_limit; + + void (*transfer_samples)(struct amdtp_stream *s, +@@ -124,8 +125,8 @@ int amdtp_dot_set_parameters(struct amdtp_stream *s, unsigned int rate, + return -EBUSY; + + /* +- * A first data channel is for MIDI conformant data channel, the rest is +- * Multi Bit Linear Audio data channel. ++ * A first data channel is for MIDI messages, the rest is Multi Bit ++ * Linear Audio data channel. + */ + err = amdtp_stream_set_parameters(s, rate, pcm_channels + 1); + if (err < 0) +@@ -135,11 +136,6 @@ int amdtp_dot_set_parameters(struct amdtp_stream *s, unsigned int rate, + + p->pcm_channels = pcm_channels; + +- if (s->direction == AMDTP_IN_STREAM) +- p->midi_ports = DOT_MIDI_IN_PORTS; +- else +- p->midi_ports = DOT_MIDI_OUT_PORTS; +- + /* + * We do not know the actual MIDI FIFO size of most devices. Just + * assume two bytes, i.e., one byte can be received over the bus while +@@ -281,13 +277,25 @@ static void write_midi_messages(struct amdtp_stream *s, __be32 *buffer, + b = (u8 *)&buffer[0]; + + len = 0; +- if (port < p->midi_ports && ++ if (port < MAX_MIDI_PORTS && + midi_ratelimit_per_packet(s, port) && + p->midi[port] != NULL) + len = snd_rawmidi_transmit(p->midi[port], b + 1, 2); + + if (len > 0) { +- b[3] = (0x10 << port) | len; ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. ++ * - 0010b: physical MIDI port 2. ++ * - 1110b: console MIDI port. ++ */ ++ if (port == 2) ++ b[3] = 0xe0; ++ else if (port == 1) ++ b[3] = 0x20; ++ else ++ b[3] = 0x00; ++ b[3] |= len; + midi_use_bytes(s, port, len); + } else { + b[1] = 0; +@@ -309,11 +317,22 @@ static void read_midi_messages(struct amdtp_stream *s, __be32 *buffer, + + for (f = 0; f < data_blocks; f++) { + b = (u8 *)&buffer[0]; +- port = b[3] >> 4; +- len = b[3] & 0x0f; + +- if (port < p->midi_ports && p->midi[port] && len > 0) +- snd_rawmidi_receive(p->midi[port], b + 1, len); ++ len = b[3] & 0x0f; ++ if (len > 0) { ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. Use port 0. ++ * - 1110b: console MIDI port. Use port 2. ++ */ ++ if (b[3] >> 4 > 0) ++ port = 2; ++ else ++ port = 0; ++ ++ if (port < MAX_MIDI_PORTS && p->midi[port]) ++ snd_rawmidi_receive(p->midi[port], b + 1, len); ++ } + + buffer += s->data_block_quadlets; + } +@@ -364,7 +383,7 @@ void amdtp_dot_midi_trigger(struct amdtp_stream *s, unsigned int port, + { + struct amdtp_dot *p = s->protocol; + +- if (port < p->midi_ports) ++ if (port < MAX_MIDI_PORTS) + ACCESS_ONCE(p->midi[port]) = midi; + } + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index e2212830df0c..fbd00821e326 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -179,11 +179,15 @@ static const struct kernel_param_ops param_ops_xint = { + }; + #define param_check_xint param_check_int + +-static int power_save = -1; ++static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + module_param(power_save, xint, 0644); + MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " + "(in second, 0 = disable)."); + ++static bool pm_blacklist = true; ++module_param(pm_blacklist, bool, 0644); ++MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist"); ++ + /* reset the HD-audio controller in power save mode. + * this may give more power-saving, but will take longer time to + * wake up. +@@ -2164,10 +2168,9 @@ static int azx_probe_continue(struct azx *chip) + + val = power_save; + #ifdef CONFIG_PM +- if (val == -1) { ++ if (pm_blacklist) { + const struct snd_pci_quirk *q; + +- val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); + if (q && val) { + dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", +diff --git a/sound/soc/nuc900/nuc900-ac97.c b/sound/soc/nuc900/nuc900-ac97.c +index b6615affe571..fde974d52bb2 100644 +--- a/sound/soc/nuc900/nuc900-ac97.c ++++ b/sound/soc/nuc900/nuc900-ac97.c +@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(struct snd_ac97 *ac97, + + /* polling the AC_R_FINISH */ + while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) { +@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd_ac97 *ac97, unsigned short reg, + + /* polling the AC_W_FINISH */ + while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 38aae96267c9..a001331a53c1 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -142,6 +142,15 @@ static int rsnd_ssi_master_clk_start(struct rsnd_ssi *ssi, + */ + for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) { + ++ /* ++ * It will set SSIWSR.CONT here, but SSICR.CKDV = 000 ++ * with it is not allowed. (SSIWSR.WS_MODE with ++ * SSICR.CKDV = 000 is not allowed either). ++ * Skip it. See SSICR.CKDV ++ */ ++ if (j == 0) ++ continue; ++ + /* + * this driver is assuming that + * system word is 64fs (= 2 x 32bit) +diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c +index 132afc97676c..9d4ac90ca87e 100644 +--- a/tools/perf/builtin-probe.c ++++ b/tools/perf/builtin-probe.c +@@ -405,9 +405,9 @@ static int perf_del_probe_events(struct strfilter *filter) + } + + if (ret == -ENOENT && ret2 == -ENOENT) +- pr_debug("\"%s\" does not hit any event.\n", str); +- /* Note that this is silently ignored */ +- ret = 0; ++ pr_warning("\"%s\" does not hit any event.\n", str); ++ else ++ ret = 0; + + error: + if (kfd >= 0) +diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c +index 26cba64345e3..46af9dde11e2 100644 +--- a/tools/perf/util/event.c ++++ b/tools/perf/util/event.c +@@ -234,8 +234,8 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool, + if (machine__is_default_guest(machine)) + return 0; + +- snprintf(filename, sizeof(filename), "%s/proc/%d/maps", +- machine->root_dir, pid); ++ snprintf(filename, sizeof(filename), "%s/proc/%d/task/%d/maps", ++ machine->root_dir, pid, pid); + + fp = fopen(filename, "r"); + if (fp == NULL) { +diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c +index b1b9e2385f4b..5e58149c4df2 100644 +--- a/tools/perf/util/ordered-events.c ++++ b/tools/perf/util/ordered-events.c +@@ -79,7 +79,7 @@ static union perf_event *dup_event(struct ordered_events *oe, + + static void free_dup_event(struct ordered_events *oe, union perf_event *event) + { +- if (oe->copy_on_queue) { ++ if (event && oe->copy_on_queue) { + oe->cur_alloc_size -= event->header.size; + free(event); + } +@@ -150,6 +150,7 @@ void ordered_events__delete(struct ordered_events *oe, struct ordered_event *eve + list_move(&event->list, &oe->cache); + oe->nr_events--; + free_dup_event(oe, event->event); ++ event->event = NULL; + } + + int ordered_events__queue(struct ordered_events *oe, union perf_event *event, +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 468de95bc8bb..0ae4f73dc8eb 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -135,8 +135,14 @@ struct perf_session *perf_session__new(struct perf_data_file *file, + if (perf_session__open(session) < 0) + goto out_close; + +- perf_session__set_id_hdr_size(session); +- perf_session__set_comm_exec(session); ++ /* ++ * set session attributes that are present in perf.data ++ * but not in pipe-mode. ++ */ ++ if (!file->is_pipe) { ++ perf_session__set_id_hdr_size(session); ++ perf_session__set_comm_exec(session); ++ } + } + } else { + session->machines.host.env = &perf_env; +@@ -151,7 +157,11 @@ struct perf_session *perf_session__new(struct perf_data_file *file, + pr_warning("Cannot read kernel map\n"); + } + +- if (tool && tool->ordering_requires_timestamps && ++ /* ++ * In pipe-mode, evlist is empty until PERF_RECORD_HEADER_ATTR is ++ * processed, so perf_evlist__sample_id_all is not meaningful here. ++ */ ++ if ((!file || !file->is_pipe) && tool && tool->ordering_requires_timestamps && + tool->ordered_events && !perf_evlist__sample_id_all(session->evlist)) { + dump_printf("WARNING: No sample_id_all support, falling back to unordered processing\n"); + tool->ordered_events = false; +@@ -1437,6 +1447,7 @@ static int __perf_session__process_pipe_events(struct perf_session *session) + buf = malloc(cur_size); + if (!buf) + return -errno; ++ ordered_events__set_copy_on_queue(oe, true); + more: + event = buf; + err = readn(fd, event, sizeof(struct perf_event_header)); +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index 2d8ccd4d9e1b..87312056f75d 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -604,6 +604,9 @@ static int hist_entry__mispredict_snprintf(struct hist_entry *he, char *bf, + static int64_t + sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right) + { ++ if (!left->branch_info || !right->branch_info) ++ return cmp_null(left->branch_info, right->branch_info); ++ + return left->branch_info->flags.cycles - + right->branch_info->flags.cycles; + } +@@ -611,6 +614,8 @@ sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right) + static int hist_entry__cycles_snprintf(struct hist_entry *he, char *bf, + size_t size, unsigned int width) + { ++ if (!he->branch_info) ++ return scnprintf(bf, size, "%-.*s", width, "N/A"); + if (he->branch_info->flags.cycles == 0) + return repsep_snprintf(bf, size, "%-*s", width, "-"); + return repsep_snprintf(bf, size, "%-*hd", width, +diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh +index 856a1f327b3f..61f9b1dbbd9b 100755 +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -28,7 +28,10 @@ test_finish() + if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout + fi +- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path ++ if [ "$OLD_FWPATH" = "" ]; then ++ OLD_FWPATH=" " ++ fi ++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + rm -f "$FW" + rmdir "$FWPATH" + } +diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh +index 3f81a1095206..50a6371b2b2e 100755 +--- a/tools/testing/selftests/rcutorture/bin/configinit.sh ++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh +@@ -51,7 +51,7 @@ then + mkdir $builddir + fi + else +- echo Bad build directory: \"$builddir\" ++ echo Bad build directory: \"$buildloc\" + exit 2 + fi + fi +diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c +index d075ea0e5ca1..ade443a88421 100644 +--- a/tools/testing/selftests/x86/entry_from_vm86.c ++++ b/tools/testing/selftests/x86/entry_from_vm86.c +@@ -95,6 +95,31 @@ asm ( + "int3\n\t" + "vmcode_int80:\n\t" + "int $0x80\n\t" ++ "vmcode_popf_hlt:\n\t" ++ "push %ax\n\t" ++ "popf\n\t" ++ "hlt\n\t" ++ "vmcode_umip:\n\t" ++ /* addressing via displacements */ ++ "smsw (2052)\n\t" ++ "sidt (2054)\n\t" ++ "sgdt (2060)\n\t" ++ /* addressing via registers */ ++ "mov $2066, %bx\n\t" ++ "smsw (%bx)\n\t" ++ "mov $2068, %bx\n\t" ++ "sidt (%bx)\n\t" ++ "mov $2074, %bx\n\t" ++ "sgdt (%bx)\n\t" ++ /* register operands, only for smsw */ ++ "smsw %ax\n\t" ++ "mov %ax, (2080)\n\t" ++ "int3\n\t" ++ "vmcode_umip_str:\n\t" ++ "str %eax\n\t" ++ "vmcode_umip_sldt:\n\t" ++ "sldt %eax\n\t" ++ "int3\n\t" + ".size vmcode, . - vmcode\n\t" + "end_vmcode:\n\t" + ".code32\n\t" +@@ -103,7 +128,8 @@ asm ( + + extern unsigned char vmcode[], end_vmcode[]; + extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[], +- vmcode_sti[], vmcode_int3[], vmcode_int80[]; ++ vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[], ++ vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[]; + + /* Returns false if the test was skipped. */ + static bool do_test(struct vm86plus_struct *v86, unsigned long eip, +@@ -153,13 +179,75 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip, + (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) { + printf("[OK]\tReturned correctly\n"); + } else { +- printf("[FAIL]\tIncorrect return reason\n"); ++ printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip); + nerrs++; + } + + return true; + } + ++void do_umip_tests(struct vm86plus_struct *vm86, unsigned char *test_mem) ++{ ++ struct table_desc { ++ unsigned short limit; ++ unsigned long base; ++ } __attribute__((packed)); ++ ++ /* Initialize variables with arbitrary values */ ++ struct table_desc gdt1 = { .base = 0x3c3c3c3c, .limit = 0x9999 }; ++ struct table_desc gdt2 = { .base = 0x1a1a1a1a, .limit = 0xaeae }; ++ struct table_desc idt1 = { .base = 0x7b7b7b7b, .limit = 0xf1f1 }; ++ struct table_desc idt2 = { .base = 0x89898989, .limit = 0x1313 }; ++ unsigned short msw1 = 0x1414, msw2 = 0x2525, msw3 = 3737; ++ ++ /* UMIP -- exit with INT3 unless kernel emulation did not trap #GP */ ++ do_test(vm86, vmcode_umip - vmcode, VM86_TRAP, 3, "UMIP tests"); ++ ++ /* Results from displacement-only addressing */ ++ msw1 = *(unsigned short *)(test_mem + 2052); ++ memcpy(&idt1, test_mem + 2054, sizeof(idt1)); ++ memcpy(&gdt1, test_mem + 2060, sizeof(gdt1)); ++ ++ /* Results from register-indirect addressing */ ++ msw2 = *(unsigned short *)(test_mem + 2066); ++ memcpy(&idt2, test_mem + 2068, sizeof(idt2)); ++ memcpy(&gdt2, test_mem + 2074, sizeof(gdt2)); ++ ++ /* Results when using register operands */ ++ msw3 = *(unsigned short *)(test_mem + 2080); ++ ++ printf("[INFO]\tResult from SMSW:[0x%04x]\n", msw1); ++ printf("[INFO]\tResult from SIDT: limit[0x%04x]base[0x%08lx]\n", ++ idt1.limit, idt1.base); ++ printf("[INFO]\tResult from SGDT: limit[0x%04x]base[0x%08lx]\n", ++ gdt1.limit, gdt1.base); ++ ++ if (msw1 != msw2 || msw1 != msw3) ++ printf("[FAIL]\tAll the results of SMSW should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SMSW are identical.\n"); ++ ++ if (memcmp(&gdt1, &gdt2, sizeof(gdt1))) ++ printf("[FAIL]\tAll the results of SGDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SGDT are identical.\n"); ++ ++ if (memcmp(&idt1, &idt2, sizeof(idt1))) ++ printf("[FAIL]\tAll the results of SIDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SIDT are identical.\n"); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_str - vmcode, VM86_SIGNAL, 0, ++ "STR instruction"); ++ clearhandler(SIGILL); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_sldt - vmcode, VM86_SIGNAL, 0, ++ "SLDT instruction"); ++ clearhandler(SIGILL); ++} ++ + int main(void) + { + struct vm86plus_struct v86; +@@ -180,6 +268,9 @@ int main(void) + v86.regs.ds = load_addr / 16; + v86.regs.es = load_addr / 16; + ++ /* Use the end of the page as our stack. */ ++ v86.regs.esp = 4096; ++ + assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */ + + /* #BR -- should deliver SIG??? */ +@@ -211,6 +302,23 @@ int main(void) + v86.regs.eflags &= ~X86_EFLAGS_IF; + do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set"); + ++ /* POPF with VIP set but IF clear: should not trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = 0; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear"); ++ ++ /* POPF with VIP set and IF set: should trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set"); ++ ++ /* POPF with VIP clear and IF set: should not trap */ ++ v86.regs.eflags = 0; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set"); ++ ++ v86.regs.eflags = 0; ++ + /* INT3 -- should cause #BP */ + do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3"); + +@@ -218,6 +326,9 @@ int main(void) + v86.regs.eax = (unsigned int)-1; + do_test(&v86, vmcode_int80 - vmcode, VM86_INTx, 0x80, "int80"); + ++ /* UMIP -- should exit with INTx 0x80 unless UMIP was not disabled */ ++ do_umip_tests(&v86, addr); ++ + /* Execute a null pointer */ + v86.regs.cs = 0; + v86.regs.ss = 0; +@@ -231,7 +342,7 @@ int main(void) + clearhandler(SIGSEGV); + + /* Make sure nothing explodes if we fork. */ +- if (fork() > 0) ++ if (fork() == 0) + return 0; + + return (nerrs == 0 ? 0 : 1); +diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c +index 2a7cd2b8d966..8c5b0faba229 100644 +--- a/tools/usb/usbip/src/usbipd.c ++++ b/tools/usb/usbip/src/usbipd.c +@@ -451,7 +451,7 @@ static void set_signal(void) + sigaction(SIGTERM, &act, NULL); + sigaction(SIGINT, &act, NULL); + act.sa_handler = SIG_IGN; +- sigaction(SIGCLD, &act, NULL); ++ sigaction(SIGCHLD, &act, NULL); + } + + static const char *pid_file; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.123-124.patch b/patch/kernel/mvebu-default/04-patch-4.4.123-124.patch new file mode 100644 index 000000000..c50c97476 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.123-124.patch @@ -0,0 +1,3077 @@ +diff --git a/Makefile b/Makefile +index cbcc04da790a..bbaf3fd0d1ef 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 123 ++SUBLEVEL = 124 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/alpha/kernel/console.c b/arch/alpha/kernel/console.c +index 6a61deed4a85..ab228ed45945 100644 +--- a/arch/alpha/kernel/console.c ++++ b/arch/alpha/kernel/console.c +@@ -20,6 +20,7 @@ + struct pci_controller *pci_vga_hose; + static struct resource alpha_vga = { + .name = "alpha-vga+", ++ .flags = IORESOURCE_IO, + .start = 0x3C0, + .end = 0x3DF + }; +diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c +index 709ee1d6d4df..faa9a905826e 100644 +--- a/arch/arm/kernel/ftrace.c ++++ b/arch/arm/kernel/ftrace.c +@@ -29,11 +29,6 @@ + #endif + + #ifdef CONFIG_DYNAMIC_FTRACE +-#ifdef CONFIG_OLD_MCOUNT +-#define OLD_MCOUNT_ADDR ((unsigned long) mcount) +-#define OLD_FTRACE_ADDR ((unsigned long) ftrace_caller_old) +- +-#define OLD_NOP 0xe1a00000 /* mov r0, r0 */ + + static int __ftrace_modify_code(void *data) + { +@@ -51,6 +46,12 @@ void arch_ftrace_update_code(int command) + stop_machine(__ftrace_modify_code, &command, NULL); + } + ++#ifdef CONFIG_OLD_MCOUNT ++#define OLD_MCOUNT_ADDR ((unsigned long) mcount) ++#define OLD_FTRACE_ADDR ((unsigned long) ftrace_caller_old) ++ ++#define OLD_NOP 0xe1a00000 /* mov r0, r0 */ ++ + static unsigned long ftrace_nop_replace(struct dyn_ftrace *rec) + { + return rec->arch.old_mcount ? OLD_NOP : NOP; +diff --git a/arch/arm/mach-omap2/clockdomains7xx_data.c b/arch/arm/mach-omap2/clockdomains7xx_data.c +index 7581e036bda6..70e3b711e79c 100644 +--- a/arch/arm/mach-omap2/clockdomains7xx_data.c ++++ b/arch/arm/mach-omap2/clockdomains7xx_data.c +@@ -524,7 +524,7 @@ static struct clockdomain pcie_7xx_clkdm = { + .dep_bit = DRA7XX_PCIE_STATDEP_SHIFT, + .wkdep_srcs = pcie_wkup_sleep_deps, + .sleepdep_srcs = pcie_wkup_sleep_deps, +- .flags = CLKDM_CAN_HWSUP_SWSUP, ++ .flags = CLKDM_CAN_SWSUP, + }; + + static struct clockdomain atl_7xx_clkdm = { +diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c +index b15933c31b2f..36b2c94a8eb5 100644 +--- a/arch/ia64/kernel/module.c ++++ b/arch/ia64/kernel/module.c +@@ -153,7 +153,7 @@ slot (const struct insn *insn) + static int + apply_imm64 (struct module *mod, struct insn *insn, uint64_t val) + { +- if (slot(insn) != 2) { ++ if (slot(insn) != 1 && slot(insn) != 2) { + printk(KERN_ERR "%s: invalid slot number %d for IMM64\n", + mod->name, slot(insn)); + return 0; +@@ -165,7 +165,7 @@ apply_imm64 (struct module *mod, struct insn *insn, uint64_t val) + static int + apply_imm60 (struct module *mod, struct insn *insn, uint64_t val) + { +- if (slot(insn) != 2) { ++ if (slot(insn) != 1 && slot(insn) != 2) { + printk(KERN_ERR "%s: invalid slot number %d for IMM60\n", + mod->name, slot(insn)); + return 0; +diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c +index 79ad35abd196..ddec22828673 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_host.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_host.c +@@ -177,12 +177,15 @@ map_again: + ret = ppc_md.hpte_insert(hpteg, vpn, hpaddr, rflags, vflags, + hpsize, hpsize, MMU_SEGSIZE_256M); + +- if (ret < 0) { ++ if (ret == -1) { + /* If we couldn't map a primary PTE, try a secondary */ + hash = ~hash; + vflags ^= HPTE_V_SECONDARY; + attempt++; + goto map_again; ++ } else if (ret < 0) { ++ r = -EIO; ++ goto out_unlock; + } else { + trace_kvm_book3s_64_mmu_map(rflags, hpteg, + vpn, hpaddr, orig_pte); +diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c +index 64891b081ad5..81313844d81c 100644 +--- a/arch/powerpc/kvm/book3s_pr.c ++++ b/arch/powerpc/kvm/book3s_pr.c +@@ -625,7 +625,11 @@ int kvmppc_handle_pagefault(struct kvm_run *run, struct kvm_vcpu *vcpu, + kvmppc_mmu_unmap_page(vcpu, &pte); + } + /* The guest's PTE is not mapped yet. Map on the host */ +- kvmppc_mmu_map_page(vcpu, &pte, iswrite); ++ if (kvmppc_mmu_map_page(vcpu, &pte, iswrite) == -EIO) { ++ /* Exit KVM if mapping failed */ ++ run->exit_reason = KVM_EXIT_INTERNAL_ERROR; ++ return RESUME_HOST; ++ } + if (data) + vcpu->stat.sp_storage++; + else if (vcpu->arch.mmu.is_dcbz32(vcpu) && +diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c +index be22f5a2192e..4e3b8a587c88 100644 +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -418,6 +418,7 @@ struct legacy_pic default_legacy_pic = { + }; + + struct legacy_pic *legacy_pic = &default_legacy_pic; ++EXPORT_SYMBOL(legacy_pic); + + static int __init i8259A_init_ops(void) + { +diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c +index 6a082d4de12c..24a793957bc0 100644 +--- a/drivers/acpi/pmic/intel_pmic_xpower.c ++++ b/drivers/acpi/pmic/intel_pmic_xpower.c +@@ -28,97 +28,97 @@ static struct pmic_table power_table[] = { + .address = 0x00, + .reg = 0x13, + .bit = 0x05, +- }, ++ }, /* ALD1 */ + { + .address = 0x04, + .reg = 0x13, + .bit = 0x06, +- }, ++ }, /* ALD2 */ + { + .address = 0x08, + .reg = 0x13, + .bit = 0x07, +- }, ++ }, /* ALD3 */ + { + .address = 0x0c, + .reg = 0x12, + .bit = 0x03, +- }, ++ }, /* DLD1 */ + { + .address = 0x10, + .reg = 0x12, + .bit = 0x04, +- }, ++ }, /* DLD2 */ + { + .address = 0x14, + .reg = 0x12, + .bit = 0x05, +- }, ++ }, /* DLD3 */ + { + .address = 0x18, + .reg = 0x12, + .bit = 0x06, +- }, ++ }, /* DLD4 */ + { + .address = 0x1c, + .reg = 0x12, + .bit = 0x00, +- }, ++ }, /* ELD1 */ + { + .address = 0x20, + .reg = 0x12, + .bit = 0x01, +- }, ++ }, /* ELD2 */ + { + .address = 0x24, + .reg = 0x12, + .bit = 0x02, +- }, ++ }, /* ELD3 */ + { + .address = 0x28, + .reg = 0x13, + .bit = 0x02, +- }, ++ }, /* FLD1 */ + { + .address = 0x2c, + .reg = 0x13, + .bit = 0x03, +- }, ++ }, /* FLD2 */ + { + .address = 0x30, + .reg = 0x13, + .bit = 0x04, +- }, ++ }, /* FLD3 */ + { +- .address = 0x38, ++ .address = 0x34, + .reg = 0x10, + .bit = 0x03, +- }, ++ }, /* BUC1 */ + { +- .address = 0x3c, ++ .address = 0x38, + .reg = 0x10, + .bit = 0x06, +- }, ++ }, /* BUC2 */ + { +- .address = 0x40, ++ .address = 0x3c, + .reg = 0x10, + .bit = 0x05, +- }, ++ }, /* BUC3 */ + { +- .address = 0x44, ++ .address = 0x40, + .reg = 0x10, + .bit = 0x04, +- }, ++ }, /* BUC4 */ + { +- .address = 0x48, ++ .address = 0x44, + .reg = 0x10, + .bit = 0x01, +- }, ++ }, /* BUC5 */ + { +- .address = 0x4c, ++ .address = 0x48, + .reg = 0x10, + .bit = 0x00 +- }, ++ }, /* BUC6 */ + }; + + /* TMP0 - TMP5 are the same, all from GPADC */ +diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c +index 11154a330f07..c9bf74982688 100644 +--- a/drivers/acpi/processor_driver.c ++++ b/drivers/acpi/processor_driver.c +@@ -259,6 +259,9 @@ static int __acpi_processor_start(struct acpi_device *device) + if (ACPI_SUCCESS(status)) + return 0; + ++ result = -ENODEV; ++ acpi_pss_perf_exit(pr, device); ++ + err_power_exit: + acpi_processor_power_exit(pr); + return result; +@@ -267,11 +270,16 @@ err_power_exit: + static int acpi_processor_start(struct device *dev) + { + struct acpi_device *device = ACPI_COMPANION(dev); ++ int ret; + + if (!device) + return -ENODEV; + +- return __acpi_processor_start(device); ++ /* Protect against concurrent CPU hotplug operations */ ++ get_online_cpus(); ++ ret = __acpi_processor_start(device); ++ put_online_cpus(); ++ return ret; + } + + static int acpi_processor_stop(struct device *dev) +diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c +index c72e64893d03..93d72413d844 100644 +--- a/drivers/acpi/processor_throttling.c ++++ b/drivers/acpi/processor_throttling.c +@@ -62,8 +62,8 @@ struct acpi_processor_throttling_arg { + #define THROTTLING_POSTCHANGE (2) + + static int acpi_processor_get_throttling(struct acpi_processor *pr); +-int acpi_processor_set_throttling(struct acpi_processor *pr, +- int state, bool force); ++static int __acpi_processor_set_throttling(struct acpi_processor *pr, ++ int state, bool force, bool direct); + + static int acpi_processor_update_tsd_coord(void) + { +@@ -891,7 +891,8 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr) + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "Invalid throttling state, reset\n")); + state = 0; +- ret = acpi_processor_set_throttling(pr, state, true); ++ ret = __acpi_processor_set_throttling(pr, state, true, ++ true); + if (ret) + return ret; + } +@@ -901,36 +902,31 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr) + return 0; + } + +-static int acpi_processor_get_throttling(struct acpi_processor *pr) ++static long __acpi_processor_get_throttling(void *data) + { +- cpumask_var_t saved_mask; +- int ret; ++ struct acpi_processor *pr = data; ++ ++ return pr->throttling.acpi_processor_get_throttling(pr); ++} + ++static int acpi_processor_get_throttling(struct acpi_processor *pr) ++{ + if (!pr) + return -EINVAL; + + if (!pr->flags.throttling) + return -ENODEV; + +- if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL)) +- return -ENOMEM; +- + /* +- * Migrate task to the cpu pointed by pr. ++ * This is either called from the CPU hotplug callback of ++ * processor_driver or via the ACPI probe function. In the latter ++ * case the CPU is not guaranteed to be online. Both call sites are ++ * protected against CPU hotplug. + */ +- cpumask_copy(saved_mask, ¤t->cpus_allowed); +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) { +- /* Can't migrate to the target pr->id CPU. Exit */ +- free_cpumask_var(saved_mask); ++ if (!cpu_online(pr->id)) + return -ENODEV; +- } +- ret = pr->throttling.acpi_processor_get_throttling(pr); +- /* restore the previous state */ +- set_cpus_allowed_ptr(current, saved_mask); +- free_cpumask_var(saved_mask); + +- return ret; ++ return work_on_cpu(pr->id, __acpi_processor_get_throttling, pr); + } + + static int acpi_processor_get_fadt_info(struct acpi_processor *pr) +@@ -1080,8 +1076,15 @@ static long acpi_processor_throttling_fn(void *data) + arg->target_state, arg->force); + } + +-int acpi_processor_set_throttling(struct acpi_processor *pr, +- int state, bool force) ++static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct) ++{ ++ if (direct) ++ return fn(arg); ++ return work_on_cpu(cpu, fn, arg); ++} ++ ++static int __acpi_processor_set_throttling(struct acpi_processor *pr, ++ int state, bool force, bool direct) + { + int ret = 0; + unsigned int i; +@@ -1130,7 +1133,8 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + arg.pr = pr; + arg.target_state = state; + arg.force = force; +- ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg); ++ ret = call_on_cpu(pr->id, acpi_processor_throttling_fn, &arg, ++ direct); + } else { + /* + * When the T-state coordination is SW_ALL or HW_ALL, +@@ -1163,8 +1167,8 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + arg.pr = match_pr; + arg.target_state = state; + arg.force = force; +- ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, +- &arg); ++ ret = call_on_cpu(pr->id, acpi_processor_throttling_fn, ++ &arg, direct); + } + } + /* +@@ -1182,6 +1186,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + return ret; + } + ++int acpi_processor_set_throttling(struct acpi_processor *pr, int state, ++ bool force) ++{ ++ return __acpi_processor_set_throttling(pr, state, force, false); ++} ++ + int acpi_processor_get_throttling_info(struct acpi_processor *pr) + { + int result = 0; +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 55d3d1da72de..9ba89315dae1 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -169,6 +169,25 @@ static bool mtip_check_surprise_removal(struct pci_dev *pdev) + return false; /* device present */ + } + ++/* we have to use runtime tag to setup command header */ ++static void mtip_init_cmd_header(struct request *rq) ++{ ++ struct driver_data *dd = rq->q->queuedata; ++ struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); ++ u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; ++ ++ /* Point the command headers at the command tables. */ ++ cmd->command_header = dd->port->command_list + ++ (sizeof(struct mtip_cmd_hdr) * rq->tag); ++ cmd->command_header_dma = dd->port->command_list_dma + ++ (sizeof(struct mtip_cmd_hdr) * rq->tag); ++ ++ if (host_cap_64) ++ cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); ++ ++ cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); ++} ++ + static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + { + struct request *rq; +@@ -180,6 +199,9 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + if (IS_ERR(rq)) + return NULL; + ++ /* Internal cmd isn't submitted via .queue_rq */ ++ mtip_init_cmd_header(rq); ++ + return blk_mq_rq_to_pdu(rq); + } + +@@ -3818,6 +3840,8 @@ static int mtip_queue_rq(struct blk_mq_hw_ctx *hctx, + struct request *rq = bd->rq; + int ret; + ++ mtip_init_cmd_header(rq); ++ + if (unlikely(mtip_check_unal_depth(hctx, rq))) + return BLK_MQ_RQ_QUEUE_BUSY; + +@@ -3849,7 +3873,6 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + { + struct driver_data *dd = data; + struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); +- u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; + + /* + * For flush requests, request_idx starts at the end of the +@@ -3866,17 +3889,6 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + + memset(cmd->command, 0, CMD_DMA_ALLOC_SZ); + +- /* Point the command headers at the command tables. */ +- cmd->command_header = dd->port->command_list + +- (sizeof(struct mtip_cmd_hdr) * request_idx); +- cmd->command_header_dma = dd->port->command_list_dma + +- (sizeof(struct mtip_cmd_hdr) * request_idx); +- +- if (host_cap_64) +- cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); +- +- cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); +- + sg_init_table(cmd->sg, MTIP_MAX_SG); + return 0; + } +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 71325e443e46..8a3bf0a8c31d 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -936,6 +936,9 @@ static int qca_setup(struct hci_uart *hu) + if (!ret) { + set_bit(STATE_IN_BAND_SLEEP_ENABLED, &qca->flags); + qca_debugfs_init(hdev); ++ } else if (ret == -ENOENT) { ++ /* No patch/nvm-config found, run with original fw/config */ ++ ret = 0; + } + + /* Setup bdaddr */ +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index 40d400fe5bb7..4ada103945f0 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -515,7 +515,7 @@ static void panic_halt_ipmi_heartbeat(void) + msg.cmd = IPMI_WDOG_RESET_TIMER; + msg.data = NULL; + msg.data_len = 0; +- atomic_add(2, &panic_done_count); ++ atomic_add(1, &panic_done_count); + rv = ipmi_request_supply_msgs(watchdog_user, + (struct ipmi_addr *) &addr, + 0, +@@ -525,7 +525,7 @@ static void panic_halt_ipmi_heartbeat(void) + &panic_halt_heartbeat_recv_msg, + 1); + if (rv) +- atomic_sub(2, &panic_done_count); ++ atomic_sub(1, &panic_done_count); + } + + static struct ipmi_smi_msg panic_halt_smi_msg = { +@@ -549,12 +549,12 @@ static void panic_halt_ipmi_set_timeout(void) + /* Wait for the messages to be free. */ + while (atomic_read(&panic_done_count) != 0) + ipmi_poll_interface(watchdog_user); +- atomic_add(2, &panic_done_count); ++ atomic_add(1, &panic_done_count); + rv = i_ipmi_set_timeout(&panic_halt_smi_msg, + &panic_halt_recv_msg, + &send_heartbeat_now); + if (rv) { +- atomic_sub(2, &panic_done_count); ++ atomic_sub(1, &panic_done_count); + printk(KERN_WARNING PFX + "Unable to extend the watchdog timeout."); + } else { +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index aaa5fa95dede..36afc1a21699 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -1040,6 +1040,11 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) + break; + + recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len); ++ if (recd > num_bytes) { ++ total = -EFAULT; ++ break; ++ } ++ + memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd); + + dest += recd; +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index 286bd090a488..389a009b83f2 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -622,6 +622,11 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + if (!rc) { + data_len = be16_to_cpup( + (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]); ++ if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE + 1) { ++ rc = -EFAULT; ++ goto out; ++ } ++ + data = &buf.data[TPM_HEADER_SIZE + 6]; + + memcpy(payload->key, data, data_len - 1); +@@ -629,6 +634,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + payload->migratable = data[data_len - 1]; + } + ++out: + tpm_buf_destroy(&buf); + return rc; + } +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 7f13221aeb30..9dd93a209ef2 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -283,7 +283,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) + static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + int size = 0; +- int expected, status; ++ int status; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + size = -EIO; +@@ -298,7 +299,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + expected = be32_to_cpu(*(__be32 *) (buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < TPM_HEADER_SIZE) { + size = -EIO; + goto out; + } +diff --git a/drivers/clk/bcm/clk-ns2.c b/drivers/clk/bcm/clk-ns2.c +index a564e9248814..adc14145861a 100644 +--- a/drivers/clk/bcm/clk-ns2.c ++++ b/drivers/clk/bcm/clk-ns2.c +@@ -103,7 +103,7 @@ CLK_OF_DECLARE(ns2_genpll_src_clk, "brcm,ns2-genpll-scr", + + static const struct iproc_pll_ctrl genpll_sw = { + .flags = IPROC_CLK_AON | IPROC_CLK_PLL_SPLIT_STAT_CTRL, +- .aon = AON_VAL(0x0, 2, 9, 8), ++ .aon = AON_VAL(0x0, 1, 11, 10), + .reset = RESET_VAL(0x4, 2, 1), + .dig_filter = DF_VAL(0x0, 9, 3, 5, 4, 2, 3), + .ndiv_int = REG_VAL(0x8, 4, 10), +diff --git a/drivers/clk/clk-si5351.c b/drivers/clk/clk-si5351.c +index e346b223199d..a01ee9a3ed6d 100644 +--- a/drivers/clk/clk-si5351.c ++++ b/drivers/clk/clk-si5351.c +@@ -72,7 +72,7 @@ static const char * const si5351_input_names[] = { + "xtal", "clkin" + }; + static const char * const si5351_pll_names[] = { +- "plla", "pllb", "vxco" ++ "si5351_plla", "si5351_pllb", "si5351_vxco" + }; + static const char * const si5351_msynth_names[] = { + "ms0", "ms1", "ms2", "ms3", "ms4", "ms5", "ms6", "ms7" +diff --git a/drivers/cpufreq/sh-cpufreq.c b/drivers/cpufreq/sh-cpufreq.c +index 86628e22b2a3..719c3d9f07fb 100644 +--- a/drivers/cpufreq/sh-cpufreq.c ++++ b/drivers/cpufreq/sh-cpufreq.c +@@ -30,54 +30,63 @@ + + static DEFINE_PER_CPU(struct clk, sh_cpuclk); + ++struct cpufreq_target { ++ struct cpufreq_policy *policy; ++ unsigned int freq; ++}; ++ + static unsigned int sh_cpufreq_get(unsigned int cpu) + { + return (clk_get_rate(&per_cpu(sh_cpuclk, cpu)) + 500) / 1000; + } + +-/* +- * Here we notify other drivers of the proposed change and the final change. +- */ +-static int sh_cpufreq_target(struct cpufreq_policy *policy, +- unsigned int target_freq, +- unsigned int relation) ++static long __sh_cpufreq_target(void *arg) + { +- unsigned int cpu = policy->cpu; ++ struct cpufreq_target *target = arg; ++ struct cpufreq_policy *policy = target->policy; ++ int cpu = policy->cpu; + struct clk *cpuclk = &per_cpu(sh_cpuclk, cpu); +- cpumask_t cpus_allowed; + struct cpufreq_freqs freqs; + struct device *dev; + long freq; + +- cpus_allowed = current->cpus_allowed; +- set_cpus_allowed_ptr(current, cpumask_of(cpu)); +- +- BUG_ON(smp_processor_id() != cpu); ++ if (smp_processor_id() != cpu) ++ return -ENODEV; + + dev = get_cpu_device(cpu); + + /* Convert target_freq from kHz to Hz */ +- freq = clk_round_rate(cpuclk, target_freq * 1000); ++ freq = clk_round_rate(cpuclk, target->freq * 1000); + + if (freq < (policy->min * 1000) || freq > (policy->max * 1000)) + return -EINVAL; + +- dev_dbg(dev, "requested frequency %u Hz\n", target_freq * 1000); ++ dev_dbg(dev, "requested frequency %u Hz\n", target->freq * 1000); + + freqs.old = sh_cpufreq_get(cpu); + freqs.new = (freq + 500) / 1000; + freqs.flags = 0; + +- cpufreq_freq_transition_begin(policy, &freqs); +- set_cpus_allowed_ptr(current, &cpus_allowed); ++ cpufreq_freq_transition_begin(target->policy, &freqs); + clk_set_rate(cpuclk, freq); +- cpufreq_freq_transition_end(policy, &freqs, 0); ++ cpufreq_freq_transition_end(target->policy, &freqs, 0); + + dev_dbg(dev, "set frequency %lu Hz\n", freq); +- + return 0; + } + ++/* ++ * Here we notify other drivers of the proposed change and the final change. ++ */ ++static int sh_cpufreq_target(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ unsigned int relation) ++{ ++ struct cpufreq_target data = { .policy = policy, .freq = target_freq }; ++ ++ return work_on_cpu(policy->cpu, __sh_cpufreq_target, &data); ++} ++ + static int sh_cpufreq_verify(struct cpufreq_policy *policy) + { + struct clk *cpuclk = &per_cpu(sh_cpuclk, policy->cpu); +diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c +index 8100ede095d5..c7bd1c5315f4 100644 +--- a/drivers/dma/ti-dma-crossbar.c ++++ b/drivers/dma/ti-dma-crossbar.c +@@ -51,7 +51,15 @@ struct ti_am335x_xbar_map { + + static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val) + { +- writeb_relaxed(val, iomem + event); ++ /* ++ * TPCC_EVT_MUX_60_63 register layout is different than the ++ * rest, in the sense, that event 63 is mapped to lowest byte ++ * and event 60 is mapped to highest, handle it separately. ++ */ ++ if (event >= 60 && event <= 63) ++ writeb_relaxed(val, iomem + (63 - event % 4)); ++ else ++ writeb_relaxed(val, iomem + event); + } + + static void ti_am335x_xbar_free(struct device *dev, void *route_data) +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index c76cc853b08a..644faf3ae93a 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -89,14 +89,17 @@ static struct page **get_pages(struct drm_gem_object *obj) + return p; + } + ++ msm_obj->pages = p; ++ + msm_obj->sgt = drm_prime_pages_to_sg(p, npages); + if (IS_ERR(msm_obj->sgt)) { ++ void *ptr = ERR_CAST(msm_obj->sgt); ++ + dev_err(dev->dev, "failed to allocate sgt\n"); +- return ERR_CAST(msm_obj->sgt); ++ msm_obj->sgt = NULL; ++ return ptr; + } + +- msm_obj->pages = p; +- + /* For non-cached buffers, ensure the new pages are clean + * because display controller, GPU, etc. are not coherent: + */ +@@ -119,7 +122,10 @@ static void put_pages(struct drm_gem_object *obj) + if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) + dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, DMA_BIDIRECTIONAL); +- sg_free_table(msm_obj->sgt); ++ ++ if (msm_obj->sgt) ++ sg_free_table(msm_obj->sgt); ++ + kfree(msm_obj->sgt); + + if (use_pages(obj)) +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c +index 00de1bf81519..9dfc2471ea09 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -104,7 +104,7 @@ nouveau_display_scanoutpos_head(struct drm_crtc *crtc, int *vpos, int *hpos, + }; + struct nouveau_display *disp = nouveau_display(crtc->dev); + struct drm_vblank_crtc *vblank = &crtc->dev->vblank[drm_crtc_index(crtc)]; +- int ret, retry = 1; ++ int ret, retry = 20; + + do { + ret = nvif_mthd(&disp->disp, 0, &args, sizeof(args)); +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index f516b5891932..083db3f5181f 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -288,7 +288,12 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + msecs_to_jiffies(100))) { + dev_err(dmm->dev, "timed out waiting for done\n"); + ret = -ETIMEDOUT; ++ goto cleanup; + } ++ ++ /* Check the engine status before continue */ ++ ret = wait_status(engine, DMM_PATSTATUS_READY | ++ DMM_PATSTATUS_VALID | DMM_PATSTATUS_DONE); + } + + cleanup: +diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c +index a38af68cf326..0a0628d11c0b 100644 +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -976,7 +976,7 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev) + goto drop; + /* Pad to 32-bits - FIXME: Revisit*/ + if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3))) +- goto drop; ++ goto inc_dropped; + + /* + * Modem sends Phonet messages over SSI with its own endianess... +@@ -1028,8 +1028,9 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev) + drop2: + hsi_free_msg(msg); + drop: +- dev->stats.tx_dropped++; + dev_kfree_skb(skb); ++inc_dropped: ++ dev->stats.tx_dropped++; + + return 0; + } +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 7214efd10db5..22e10b7d505d 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -45,8 +45,11 @@ + #define TPIU_ITATBCTR0 0xef8 + + /** register definition **/ ++/* FFSR - 0x300 */ ++#define FFSR_FT_STOPPED BIT(1) + /* FFCR - 0x304 */ + #define FFCR_FON_MAN BIT(6) ++#define FFCR_STOP_FI BIT(12) + + /** + * @base: memory mapped base address for this component. +@@ -85,10 +88,14 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + { + CS_UNLOCK(drvdata->base); + +- /* Clear formatter controle reg. */ +- writel_relaxed(0x0, drvdata->base + TPIU_FFCR); ++ /* Clear formatter and stop on flush */ ++ writel_relaxed(FFCR_STOP_FI, drvdata->base + TPIU_FFCR); + /* Generate manual flush */ +- writel_relaxed(FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ /* Wait for flush to complete */ ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ /* Wait for formatter to stop */ ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c +index dfc98df7b1b6..7aa7b9cb6203 100644 +--- a/drivers/i2c/busses/i2c-scmi.c ++++ b/drivers/i2c/busses/i2c-scmi.c +@@ -18,6 +18,9 @@ + #define ACPI_SMBUS_HC_CLASS "smbus" + #define ACPI_SMBUS_HC_DEVICE_NAME "cmi" + ++/* SMBUS HID definition as supported by Microsoft Windows */ ++#define ACPI_SMBUS_MS_HID "SMB0001" ++ + ACPI_MODULE_NAME("smbus_cmi"); + + struct smbus_methods_t { +@@ -51,6 +54,7 @@ static const struct smbus_methods_t ibm_smbus_methods = { + static const struct acpi_device_id acpi_smbus_cmi_ids[] = { + {"SMBUS01", (kernel_ulong_t)&smbus_methods}, + {ACPI_SMBUS_IBM_HID, (kernel_ulong_t)&ibm_smbus_methods}, ++ {ACPI_SMBUS_MS_HID, (kernel_ulong_t)&smbus_methods}, + {"", 0} + }; + MODULE_DEVICE_TABLE(acpi, acpi_smbus_cmi_ids); +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 197a08b4e2f3..84ab20c6b389 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -628,6 +628,8 @@ static const struct iio_trigger_ops st_accel_trigger_ops = { + int st_accel_common_probe(struct iio_dev *indio_dev) + { + struct st_sensor_data *adata = iio_priv(indio_dev); ++ struct st_sensors_platform_data *pdata = ++ (struct st_sensors_platform_data *)adata->dev->platform_data; + int irq = adata->get_irq_data_ready(indio_dev); + int err; + +@@ -652,9 +654,8 @@ int st_accel_common_probe(struct iio_dev *indio_dev) + &adata->sensor_settings->fs.fs_avl[0]; + adata->odr = adata->sensor_settings->odr.odr_avl[0].hz; + +- if (!adata->dev->platform_data) +- adata->dev->platform_data = +- (struct st_sensors_platform_data *)&default_accel_pdata; ++ if (!pdata) ++ pdata = (struct st_sensors_platform_data *)&default_accel_pdata; + + err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data); + if (err < 0) +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index 5056bd68573f..270eeac928bc 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -436,6 +436,8 @@ static const struct iio_trigger_ops st_press_trigger_ops = { + int st_press_common_probe(struct iio_dev *indio_dev) + { + struct st_sensor_data *press_data = iio_priv(indio_dev); ++ struct st_sensors_platform_data *pdata = ++ (struct st_sensors_platform_data *)press_data->dev->platform_data; + int irq = press_data->get_irq_data_ready(indio_dev); + int err; + +@@ -464,10 +466,8 @@ int st_press_common_probe(struct iio_dev *indio_dev) + press_data->odr = press_data->sensor_settings->odr.odr_avl[0].hz; + + /* Some devices don't support a data ready pin. */ +- if (!press_data->dev->platform_data && +- press_data->sensor_settings->drdy_irq.addr) +- press_data->dev->platform_data = +- (struct st_sensors_platform_data *)&default_press_pdata; ++ if (!pdata && press_data->sensor_settings->drdy_irq.addr) ++ pdata = (struct st_sensors_platform_data *)&default_press_pdata; + + err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data); + if (err < 0) +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index b6c9a370a38b..d57a78ec7425 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3743,6 +3743,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + struct cma_multicast *mc; + int ret; + ++ if (!id->device) ++ return -EINVAL; ++ + id_priv = container_of(id, struct rdma_id_private, id); + if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) && + !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED)) +@@ -4007,7 +4010,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb) + RDMA_NL_RDMA_CM_ATTR_SRC_ADDR)) + goto out; + if (ibnl_put_attr(skb, nlh, +- rdma_addr_size(cma_src_addr(id_priv)), ++ rdma_addr_size(cma_dst_addr(id_priv)), + cma_dst_addr(id_priv), + RDMA_NL_RDMA_CM_ATTR_DST_ADDR)) + goto out; +diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c +index fb43a242847b..8d7d110d0721 100644 +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -663,6 +663,7 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid) + } + skb_num++; + spin_lock_irqsave(&iwpm_mapinfo_lock, flags); ++ ret = -EINVAL; + for (i = 0; i < IWPM_MAPINFO_HASH_SIZE; i++) { + hlist_for_each_entry(map_info, &iwpm_hash_bucket[i], + hlist_node) { +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 0ae337bec4f2..6790ebb366dd 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -354,7 +354,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, + return -EINVAL; + } + +- ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->nmap, dst, length, ++ ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->npages, dst, length, + offset + ib_umem_offset(umem)); + + if (ret < 0) +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index b7a73f1a8beb..3eb967521917 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -2436,9 +2436,13 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file, + + static void *alloc_wr(size_t wr_size, __u32 num_sge) + { ++ if (num_sge >= (U32_MAX - ALIGN(wr_size, sizeof (struct ib_sge))) / ++ sizeof (struct ib_sge)) ++ return NULL; ++ + return kmalloc(ALIGN(wr_size, sizeof (struct ib_sge)) + + num_sge * sizeof (struct ib_sge), GFP_KERNEL); +-}; ++} + + ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file, + struct ib_device *ib_dev, +@@ -2665,6 +2669,13 @@ static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf, + goto err; + } + ++ if (user_wr->num_sge >= ++ (U32_MAX - ALIGN(sizeof *next, sizeof (struct ib_sge))) / ++ sizeof (struct ib_sge)) { ++ ret = -EINVAL; ++ goto err; ++ } ++ + next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) + + user_wr->num_sge * sizeof (struct ib_sge), + GFP_KERNEL); +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 5a2a0b5db938..67c4c73343d4 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -1041,7 +1041,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) + /* need to protect from a race on closing the vma as part of + * mlx4_ib_vma_close(). + */ +- down_read(&owning_mm->mmap_sem); ++ down_write(&owning_mm->mmap_sem); + for (i = 0; i < HW_BAR_COUNT; i++) { + vma = context->hw_bar_info[i].vma; + if (!vma) +@@ -1055,11 +1055,13 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) + BUG_ON(1); + } + ++ context->hw_bar_info[i].vma->vm_flags &= ++ ~(VM_SHARED | VM_MAYSHARE); + /* context going to be destroyed, should not access ops any more */ + context->hw_bar_info[i].vma->vm_ops = NULL; + } + +- up_read(&owning_mm->mmap_sem); ++ up_write(&owning_mm->mmap_sem); + mmput(owning_mm); + put_task_struct(owning_process); + } +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +index 86c303a620c1..748b63b86cbc 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +@@ -834,7 +834,7 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev) + + dev->reset_stats.type = OCRDMA_RESET_STATS; + dev->reset_stats.dev = dev; +- if (!debugfs_create_file("reset_stats", S_IRUSR, dev->dir, ++ if (!debugfs_create_file("reset_stats", 0200, dev->dir, + &dev->reset_stats, &ocrdma_dbg_ops)) + goto err; + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index d3f0a384faad..f6b06729f4ea 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -945,6 +945,19 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv) + */ + priv->dev->broadcast[8] = priv->pkey >> 8; + priv->dev->broadcast[9] = priv->pkey & 0xff; ++ ++ /* ++ * Update the broadcast address in the priv->broadcast object, ++ * in case it already exists, otherwise no one will do that. ++ */ ++ if (priv->broadcast) { ++ spin_lock_irq(&priv->lock); ++ memcpy(priv->broadcast->mcmember.mgid.raw, ++ priv->dev->broadcast + 4, ++ sizeof(union ib_gid)); ++ spin_unlock_irq(&priv->lock); ++ } ++ + return 0; + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 5c653669e736..37b42447045d 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -724,6 +724,22 @@ static void path_rec_completion(int status, + spin_lock_irqsave(&priv->lock, flags); + + if (!IS_ERR_OR_NULL(ah)) { ++ /* ++ * pathrec.dgid is used as the database key from the LLADDR, ++ * it must remain unchanged even if the SA returns a different ++ * GID to use in the AH. ++ */ ++ if (memcmp(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid))) { ++ ipoib_dbg( ++ priv, ++ "%s got PathRec for gid %pI6 while asked for %pI6\n", ++ dev->name, pathrec->dgid.raw, ++ path->pathrec.dgid.raw); ++ memcpy(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid)); ++ } ++ + path->pathrec = *pathrec; + + old_ah = path->ah; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 8bf48165f32c..21e688d55da6 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -473,6 +473,9 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast) + !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)) + return -EINVAL; + ++ init_completion(&mcast->done); ++ set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); ++ + ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw); + + rec.mgid = mcast->mcmember.mgid; +@@ -631,8 +634,6 @@ void ipoib_mcast_join_task(struct work_struct *work) + if (mcast->backoff == 1 || + time_after_eq(jiffies, mcast->delay_until)) { + /* Found the next unjoined group */ +- init_completion(&mcast->done); +- set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); + if (ipoib_mcast_join(dev, mcast)) { + spin_unlock_irq(&priv->lock); + return; +@@ -652,11 +653,9 @@ out: + queue_delayed_work(priv->wq, &priv->mcast_task, + delay_until - jiffies); + } +- if (mcast) { +- init_completion(&mcast->done); +- set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); ++ if (mcast) + ipoib_mcast_join(dev, mcast); +- } ++ + spin_unlock_irq(&priv->lock); + } + +diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c +index 603fc2fadf05..12b20840fb74 100644 +--- a/drivers/input/misc/twl4030-pwrbutton.c ++++ b/drivers/input/misc/twl4030-pwrbutton.c +@@ -70,7 +70,7 @@ static int twl4030_pwrbutton_probe(struct platform_device *pdev) + pwr->phys = "twl4030_pwrbutton/input0"; + pwr->dev.parent = &pdev->dev; + +- err = devm_request_threaded_irq(&pwr->dev, irq, NULL, powerbutton_irq, ++ err = devm_request_threaded_irq(&pdev->dev, irq, NULL, powerbutton_irq, + IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING | + IRQF_ONESHOT, + "twl4030_pwrbutton", pwr); +diff --git a/drivers/input/touchscreen/ar1021_i2c.c b/drivers/input/touchscreen/ar1021_i2c.c +index 71b5a634cf6d..e7bb155911d0 100644 +--- a/drivers/input/touchscreen/ar1021_i2c.c ++++ b/drivers/input/touchscreen/ar1021_i2c.c +@@ -152,7 +152,7 @@ static int __maybe_unused ar1021_i2c_resume(struct device *dev) + static SIMPLE_DEV_PM_OPS(ar1021_i2c_pm, ar1021_i2c_suspend, ar1021_i2c_resume); + + static const struct i2c_device_id ar1021_i2c_id[] = { +- { "MICROCHIP_AR1021_I2C", 0 }, ++ { "ar1021", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(i2c, ar1021_i2c_id); +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index f929879ecae6..a7d516f973dd 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -127,6 +127,7 @@ int intel_svm_enable_prq(struct intel_iommu *iommu) + pr_err("IOMMU: %s: Failed to request IRQ for page request queue\n", + iommu->name); + dmar_free_hwirq(irq); ++ iommu->pr_irq = 0; + goto err; + } + dmar_writeq(iommu->reg + DMAR_PQH_REG, 0ULL); +@@ -142,9 +143,11 @@ int intel_svm_finish_prq(struct intel_iommu *iommu) + dmar_writeq(iommu->reg + DMAR_PQT_REG, 0ULL); + dmar_writeq(iommu->reg + DMAR_PQA_REG, 0ULL); + +- free_irq(iommu->pr_irq, iommu); +- dmar_free_hwirq(iommu->pr_irq); +- iommu->pr_irq = 0; ++ if (iommu->pr_irq) { ++ free_irq(iommu->pr_irq, iommu); ++ dmar_free_hwirq(iommu->pr_irq); ++ iommu->pr_irq = 0; ++ } + + free_pages((unsigned long)iommu->prq, PRQ_ORDER); + iommu->prq = NULL; +diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c +index 3dc5b65f3990..b98d38f95237 100644 +--- a/drivers/iommu/omap-iommu.c ++++ b/drivers/iommu/omap-iommu.c +@@ -1295,6 +1295,7 @@ static int __init omap_iommu_init(void) + const unsigned long flags = SLAB_HWCACHE_ALIGN; + size_t align = 1 << 10; /* L2 pagetable alignement */ + struct device_node *np; ++ int ret; + + np = of_find_matching_node(NULL, omap_iommu_of_match); + if (!np) +@@ -1308,11 +1309,25 @@ static int __init omap_iommu_init(void) + return -ENOMEM; + iopte_cachep = p; + +- bus_set_iommu(&platform_bus_type, &omap_iommu_ops); +- + omap_iommu_debugfs_init(); + +- return platform_driver_register(&omap_iommu_driver); ++ ret = platform_driver_register(&omap_iommu_driver); ++ if (ret) { ++ pr_err("%s: failed to register driver\n", __func__); ++ goto fail_driver; ++ } ++ ++ ret = bus_set_iommu(&platform_bus_type, &omap_iommu_ops); ++ if (ret) ++ goto fail_bus; ++ ++ return 0; ++ ++fail_bus: ++ platform_driver_unregister(&omap_iommu_driver); ++fail_driver: ++ kmem_cache_destroy(iopte_cachep); ++ return ret; + } + subsys_initcall(omap_iommu_init); + /* must be ready before omap3isp is probed */ +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index a8a86d450d76..3a0d557146c7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2698,6 +2698,11 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) + list_add(&r10_bio->retry_list, &conf->bio_end_io_list); + conf->nr_queued++; + spin_unlock_irq(&conf->device_lock); ++ /* ++ * In case freeze_array() is waiting for condition ++ * nr_pending == nr_queued + extra to be true. ++ */ ++ wake_up(&conf->wait_barrier); + md_wakeup_thread(conf->mddev->thread); + } else { + if (test_bit(R10BIO_WriteError, +@@ -4039,6 +4044,7 @@ static int raid10_start_reshape(struct mddev *mddev) + diff = 0; + if (first || diff < min_offset_diff) + min_offset_diff = diff; ++ first = 0; + } + } + +diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c +index fb66184dc9b6..77cf211e842e 100644 +--- a/drivers/media/dvb-core/dvb_ca_en50221.c ++++ b/drivers/media/dvb-core/dvb_ca_en50221.c +@@ -750,6 +750,29 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * b + goto exit; + } + ++ /* ++ * It may need some time for the CAM to settle down, or there might ++ * be a race condition between the CAM, writing HC and our last ++ * check for DA. This happens, if the CAM asserts DA, just after ++ * checking DA before we are setting HC. In this case it might be ++ * a bug in the CAM to keep the FR bit, the lower layer/HW ++ * communication requires a longer timeout or the CAM needs more ++ * time internally. But this happens in reality! ++ * We need to read the status from the HW again and do the same ++ * we did for the previous check for DA ++ */ ++ status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS); ++ if (status < 0) ++ goto exit; ++ ++ if (status & (STATUSREG_DA | STATUSREG_RE)) { ++ if (status & STATUSREG_DA) ++ dvb_ca_en50221_thread_wakeup(ca); ++ ++ status = -EAGAIN; ++ goto exit; ++ } ++ + /* send the amount of data */ + if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_SIZE_HIGH, bytes_write >> 8)) != 0) + goto exit; +diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c +index 821a8f481507..9d6270591858 100644 +--- a/drivers/media/dvb-frontends/si2168.c ++++ b/drivers/media/dvb-frontends/si2168.c +@@ -14,6 +14,8 @@ + * GNU General Public License for more details. + */ + ++#include ++ + #include "si2168_priv.h" + + static const struct dvb_frontend_ops si2168_ops; +@@ -420,6 +422,7 @@ static int si2168_init(struct dvb_frontend *fe) + if (ret) + goto err; + ++ udelay(100); + memcpy(cmd.args, "\x85", 1); + cmd.wlen = 1; + cmd.rlen = 1; +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index 8aa726651630..90fcccc05b56 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -422,8 +422,7 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + bt878_num); + if (bt878_num >= BT878_MAX) { + printk(KERN_ERR "bt878: Too many devices inserted\n"); +- result = -ENOMEM; +- goto fail0; ++ return -ENOMEM; + } + if (pci_enable_device(dev)) + return -EIO; +diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +index 8490a65ae1c6..a43404cad3e3 100644 +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei) + static void channel_swdemux_tsklet(unsigned long data) + { + struct channel_info *channel = (struct channel_info *)data; +- struct c8sectpfei *fei = channel->fei; ++ struct c8sectpfei *fei; + unsigned long wp, rp; + int pos, num_packets, n, size; + u8 *buf; +@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data) + if (unlikely(!channel || !channel->irec)) + return; + ++ fei = channel->fei; ++ + wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0)); + rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0)); + +diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c +index 8f8bacb67a15..a6b5259ffbdd 100644 +--- a/drivers/mfd/palmas.c ++++ b/drivers/mfd/palmas.c +@@ -430,6 +430,20 @@ static void palmas_power_off(void) + { + unsigned int addr; + int ret, slave; ++ struct device_node *np = palmas_dev->dev->of_node; ++ ++ if (of_property_read_bool(np, "ti,palmas-override-powerhold")) { ++ addr = PALMAS_BASE_TO_REG(PALMAS_PU_PD_OD_BASE, ++ PALMAS_PRIMARY_SECONDARY_PAD2); ++ slave = PALMAS_BASE_TO_SLAVE(PALMAS_PU_PD_OD_BASE); ++ ++ ret = regmap_update_bits(palmas_dev->regmap[slave], addr, ++ PALMAS_PRIMARY_SECONDARY_PAD2_GPIO_7_MASK, 0); ++ if (ret) ++ dev_err(palmas_dev->dev, ++ "Unable to write PRIMARY_SECONDARY_PAD2 %d\n", ++ ret); ++ } + + if (!palmas_dev) + return; +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 5f7d10ba498a..299a83f1ad38 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2791,6 +2791,14 @@ int mmc_pm_notify(struct notifier_block *notify_block, + if (!err) + break; + ++ if (!mmc_card_is_removable(host)) { ++ dev_warn(mmc_dev(host), ++ "pre_suspend failed for non-removable host: " ++ "%d\n", err); ++ /* Avoid removing non-removable hosts */ ++ break; ++ } ++ + /* Calling bus_ops->remove() with a claimed host can deadlock */ + host->bus_ops->remove(host); + mmc_claim_host(host); +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index 7fb0753abe30..6b814d7d6560 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -1776,8 +1776,8 @@ static int omap_hsmmc_configure_wake_irq(struct omap_hsmmc_host *host) + */ + if (host->pdata->controller_flags & OMAP_HSMMC_SWAKEUP_MISSING) { + struct pinctrl *p = devm_pinctrl_get(host->dev); +- if (!p) { +- ret = -ENODEV; ++ if (IS_ERR(p)) { ++ ret = PTR_ERR(p); + goto err_free_irq; + } + if (IS_ERR(pinctrl_lookup_state(p, PINCTRL_STATE_DEFAULT))) { +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 83b1226471c1..ac66c61d9433 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -418,6 +418,20 @@ static void esdhc_of_set_clock(struct sdhci_host *host, unsigned int clock) + if (esdhc->vendor_ver < VENDOR_V_23) + pre_div = 2; + ++ /* ++ * Limit SD clock to 167MHz for ls1046a according to its datasheet ++ */ ++ if (clock > 167000000 && ++ of_find_compatible_node(NULL, NULL, "fsl,ls1046a-esdhc")) ++ clock = 167000000; ++ ++ /* ++ * Limit SD clock to 125MHz for ls1012a according to its datasheet ++ */ ++ if (clock > 125000000 && ++ of_find_compatible_node(NULL, NULL, "fsl,ls1012a-esdhc")) ++ clock = 125000000; ++ + /* Workaround to reduce the clock frequency for p1010 esdhc */ + if (of_find_compatible_node(NULL, NULL, "fsl,p1010-esdhc")) { + if (clock > 20000000) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 74bece5897c9..d1103d612d8b 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2044,6 +2044,7 @@ static void bnx2x_set_rx_buf_size(struct bnx2x *bp) + ETH_OVREHEAD + + mtu + + BNX2X_FW_RX_ALIGN_END; ++ fp->rx_buf_size = SKB_DATA_ALIGN(fp->rx_buf_size); + /* Note : rx_buf_size doesn't take into account NET_SKB_PAD */ + if (fp->rx_buf_size + NET_SKB_PAD <= PAGE_SIZE) + fp->rx_frag_size = fp->rx_buf_size + NET_SKB_PAD; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index b8517b00e706..a20bd8362712 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -648,7 +648,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data) + + static int hns_gmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ARRAY_SIZE(g_gmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index 67f33f185a44..6634aef0e841 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -384,7 +384,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) + + int hns_ppe_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ETH_PPE_STATIC_NUM; + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index 4db32c62f062..1d5b18d7a1d7 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -807,7 +807,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data) + */ + int hns_rcb_get_ring_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return HNS_RING_STATIC_REG_NUM; + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c +index 802d55457f19..b1a27aef4425 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c +@@ -776,7 +776,7 @@ static void hns_xgmac_get_strings(u32 stringset, u8 *data) + */ + static int hns_xgmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ARRAY_SIZE(g_xgmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 5205f1ebe381..e356e9187e84 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3526,6 +3526,12 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca) + + switch (hw->mac.type) { + case e1000_pch2lan: ++ /* Stable 96MHz frequency */ ++ incperiod = INCPERIOD_96MHz; ++ incvalue = INCVALUE_96MHz; ++ shift = INCVALUE_SHIFT_96MHz; ++ adapter->cc.shift = shift + INCPERIOD_SHIFT_96MHz; ++ break; + case e1000_pch_lpt: + if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { + /* Stable 96MHz frequency */ +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 7327b729ba2e..ffa6885acfc8 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -127,6 +127,8 @@ static int qlcnic_sriov_virtid_fn(struct qlcnic_adapter *adapter, int vf_id) + return 0; + + pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV); ++ if (!pos) ++ return 0; + pci_read_config_word(dev, pos + PCI_SRIOV_VF_OFFSET, &offset); + pci_read_config_word(dev, pos + PCI_SRIOV_VF_STRIDE, &stride); + +diff --git a/drivers/net/wan/pc300too.c b/drivers/net/wan/pc300too.c +index db363856e0b5..2b064998915f 100644 +--- a/drivers/net/wan/pc300too.c ++++ b/drivers/net/wan/pc300too.c +@@ -347,6 +347,7 @@ static int pc300_pci_init_one(struct pci_dev *pdev, + card->rambase == NULL) { + pr_err("ioremap() failed\n"); + pc300_pci_remove_one(pdev); ++ return -ENOMEM; + } + + /* PLX PCI 9050 workaround for local configuration register read bug */ +diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c +index fbb1986eda3c..686b1b5dd394 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c ++++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c +@@ -66,8 +66,10 @@ mt7601u_mcu_msg_alloc(struct mt7601u_dev *dev, const void *data, int len) + WARN_ON(len % 4); /* if length is not divisible by 4 we need to pad */ + + skb = alloc_skb(len + MT_DMA_HDR_LEN + 4, GFP_KERNEL); +- skb_reserve(skb, MT_DMA_HDR_LEN); +- memcpy(skb_put(skb, len), data, len); ++ if (skb) { ++ skb_reserve(skb, MT_DMA_HDR_LEN); ++ memcpy(skb_put(skb, len), data, len); ++ } + + return skb; + } +@@ -170,6 +172,8 @@ static int mt7601u_mcu_function_select(struct mt7601u_dev *dev, + }; + + skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); ++ if (!skb) ++ return -ENOMEM; + return mt7601u_mcu_msg_send(dev, skb, CMD_FUN_SET_OP, func == 5); + } + +@@ -205,6 +209,8 @@ mt7601u_mcu_calibrate(struct mt7601u_dev *dev, enum mcu_calibrate cal, u32 val) + }; + + skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); ++ if (!skb) ++ return -ENOMEM; + return mt7601u_mcu_msg_send(dev, skb, CMD_CALIBRATION_OP, true); + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index c48b7e8ee0d6..b51815eccdb3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1572,7 +1572,14 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw) + dev_kfree_skb_irq(skb); + ring->idx = (ring->idx + 1) % ring->entries; + } ++ ++ if (rtlpriv->use_new_trx_flow) { ++ rtlpci->tx_ring[i].cur_tx_rp = 0; ++ rtlpci->tx_ring[i].cur_tx_wp = 0; ++ } ++ + ring->idx = 0; ++ ring->entries = rtlpci->txringcount[i]; + } + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index a13d1f2b5912..259590013382 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -3425,6 +3425,10 @@ static int rndis_wlan_bind(struct usbnet *usbdev, struct usb_interface *intf) + + /* because rndis_command() sleeps we need to use workqueue */ + priv->workqueue = create_singlethread_workqueue("rndis_wlan"); ++ if (!priv->workqueue) { ++ wiphy_free(wiphy); ++ return -ENOMEM; ++ } + INIT_WORK(&priv->work, rndis_wlan_worker); + INIT_DELAYED_WORK(&priv->dev_poller_work, rndis_device_poller); + INIT_DELAYED_WORK(&priv->scan_work, rndis_get_scan_results); +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 2686a4450dfc..f4639a9f1e48 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -979,19 +979,16 @@ struct pinctrl_state *pinctrl_lookup_state(struct pinctrl *p, + EXPORT_SYMBOL_GPL(pinctrl_lookup_state); + + /** +- * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * pinctrl_commit_state() - select/activate/program a pinctrl state to HW + * @p: the pinctrl handle for the device that requests configuration + * @state: the state handle to select/activate/program + */ +-int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++static int pinctrl_commit_state(struct pinctrl *p, struct pinctrl_state *state) + { + struct pinctrl_setting *setting, *setting2; + struct pinctrl_state *old_state = p->state; + int ret; + +- if (p->state == state) +- return 0; +- + if (p->state) { + /* + * For each pinmux setting in the old state, forget SW's record +@@ -1055,6 +1052,19 @@ unapply_new_state: + + return ret; + } ++ ++/** ++ * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * @p: the pinctrl handle for the device that requests configuration ++ * @state: the state handle to select/activate/program ++ */ ++int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++{ ++ if (p->state == state) ++ return 0; ++ ++ return pinctrl_commit_state(p, state); ++} + EXPORT_SYMBOL_GPL(pinctrl_select_state); + + static void devm_pinctrl_release(struct device *dev, void *res) +@@ -1223,7 +1233,7 @@ void pinctrl_unregister_map(struct pinctrl_map const *map) + int pinctrl_force_sleep(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_sleep)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_sleep); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_sleep); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_sleep); +@@ -1235,7 +1245,7 @@ EXPORT_SYMBOL_GPL(pinctrl_force_sleep); + int pinctrl_force_default(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_default)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_default); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_default); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_default); +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index 92430f781eb7..a0b8c8a8c323 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -59,12 +59,14 @@ static int send_command(struct cros_ec_device *ec_dev, + struct cros_ec_command *msg) + { + int ret; ++ int (*xfer_fxn)(struct cros_ec_device *ec, struct cros_ec_command *msg); + + if (ec_dev->proto_version > 2) +- ret = ec_dev->pkt_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->pkt_xfer; + else +- ret = ec_dev->cmd_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->cmd_xfer; + ++ ret = (*xfer_fxn)(ec_dev, msg); + if (msg->result == EC_RES_IN_PROGRESS) { + int i; + struct cros_ec_command *status_msg; +@@ -87,7 +89,7 @@ static int send_command(struct cros_ec_device *ec_dev, + for (i = 0; i < EC_COMMAND_RETRIES; i++) { + usleep_range(10000, 11000); + +- ret = ec_dev->cmd_xfer(ec_dev, status_msg); ++ ret = (*xfer_fxn)(ec_dev, status_msg); + if (ret < 0) + break; + +diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c +index f3baf9973989..24f1630a8b3f 100644 +--- a/drivers/platform/chrome/cros_ec_sysfs.c ++++ b/drivers/platform/chrome/cros_ec_sysfs.c +@@ -187,7 +187,7 @@ static ssize_t show_ec_version(struct device *dev, + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: EC error %d\n", msg->result); + else { +- msg->data[sizeof(msg->data) - 1] = '\0'; ++ msg->data[EC_HOST_PARAM_SIZE - 1] = '\0'; + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: %s\n", msg->data); + } +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index a3661cc44f86..0e0403e024c5 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -99,6 +99,15 @@ static const struct dmi_system_id asus_quirks[] = { + */ + .driver_data = &quirk_asus_wapf4, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X302UA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X302UA"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, + { + .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X401U", +diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c +index dfe1ee89f7c7..922a86787c5c 100644 +--- a/drivers/power/pda_power.c ++++ b/drivers/power/pda_power.c +@@ -30,9 +30,9 @@ static inline unsigned int get_irq_flags(struct resource *res) + static struct device *dev; + static struct pda_power_pdata *pdata; + static struct resource *ac_irq, *usb_irq; +-static struct timer_list charger_timer; +-static struct timer_list supply_timer; +-static struct timer_list polling_timer; ++static struct delayed_work charger_work; ++static struct delayed_work polling_work; ++static struct delayed_work supply_work; + static int polling; + static struct power_supply *pda_psy_ac, *pda_psy_usb; + +@@ -140,7 +140,7 @@ static void update_charger(void) + } + } + +-static void supply_timer_func(unsigned long unused) ++static void supply_work_func(struct work_struct *work) + { + if (ac_status == PDA_PSY_TO_CHANGE) { + ac_status = new_ac_status; +@@ -161,11 +161,12 @@ static void psy_changed(void) + * Okay, charger set. Now wait a bit before notifying supplicants, + * charge power should stabilize. + */ +- mod_timer(&supply_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_charger)); ++ cancel_delayed_work(&supply_work); ++ schedule_delayed_work(&supply_work, ++ msecs_to_jiffies(pdata->wait_for_charger)); + } + +-static void charger_timer_func(unsigned long unused) ++static void charger_work_func(struct work_struct *work) + { + update_status(); + psy_changed(); +@@ -184,13 +185,14 @@ static irqreturn_t power_changed_isr(int irq, void *power_supply) + * Wait a bit before reading ac/usb line status and setting charger, + * because ac/usb status readings may lag from irq. + */ +- mod_timer(&charger_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_status)); ++ cancel_delayed_work(&charger_work); ++ schedule_delayed_work(&charger_work, ++ msecs_to_jiffies(pdata->wait_for_status)); + + return IRQ_HANDLED; + } + +-static void polling_timer_func(unsigned long unused) ++static void polling_work_func(struct work_struct *work) + { + int changed = 0; + +@@ -211,8 +213,9 @@ static void polling_timer_func(unsigned long unused) + if (changed) + psy_changed(); + +- mod_timer(&polling_timer, +- jiffies + msecs_to_jiffies(pdata->polling_interval)); ++ cancel_delayed_work(&polling_work); ++ schedule_delayed_work(&polling_work, ++ msecs_to_jiffies(pdata->polling_interval)); + } + + #if IS_ENABLED(CONFIG_USB_PHY) +@@ -250,8 +253,9 @@ static int otg_handle_notification(struct notifier_block *nb, + * Wait a bit before reading ac/usb line status and setting charger, + * because ac/usb status readings may lag from irq. + */ +- mod_timer(&charger_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_status)); ++ cancel_delayed_work(&charger_work); ++ schedule_delayed_work(&charger_work, ++ msecs_to_jiffies(pdata->wait_for_status)); + + return NOTIFY_OK; + } +@@ -300,8 +304,8 @@ static int pda_power_probe(struct platform_device *pdev) + if (!pdata->ac_max_uA) + pdata->ac_max_uA = 500000; + +- setup_timer(&charger_timer, charger_timer_func, 0); +- setup_timer(&supply_timer, supply_timer_func, 0); ++ INIT_DELAYED_WORK(&charger_work, charger_work_func); ++ INIT_DELAYED_WORK(&supply_work, supply_work_func); + + ac_irq = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "ac"); + usb_irq = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "usb"); +@@ -385,9 +389,10 @@ static int pda_power_probe(struct platform_device *pdev) + + if (polling) { + dev_dbg(dev, "will poll for status\n"); +- setup_timer(&polling_timer, polling_timer_func, 0); +- mod_timer(&polling_timer, +- jiffies + msecs_to_jiffies(pdata->polling_interval)); ++ INIT_DELAYED_WORK(&polling_work, polling_work_func); ++ cancel_delayed_work(&polling_work); ++ schedule_delayed_work(&polling_work, ++ msecs_to_jiffies(pdata->polling_interval)); + } + + if (ac_irq || usb_irq) +@@ -433,9 +438,9 @@ static int pda_power_remove(struct platform_device *pdev) + free_irq(ac_irq->start, pda_psy_ac); + + if (polling) +- del_timer_sync(&polling_timer); +- del_timer_sync(&charger_timer); +- del_timer_sync(&supply_timer); ++ cancel_delayed_work_sync(&polling_work); ++ cancel_delayed_work_sync(&charger_work); ++ cancel_delayed_work_sync(&supply_work); + + if (pdata->is_usb_online) + power_supply_unregister(pda_psy_usb); +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index 2e481b9e8ea5..60a5e0c63a13 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -97,30 +97,26 @@ static s32 scaled_ppm_to_ppb(long ppm) + + /* posix clock implementation */ + +-static int ptp_clock_getres(struct posix_clock *pc, struct timespec *tp) ++static int ptp_clock_getres(struct posix_clock *pc, struct timespec64 *tp) + { + tp->tv_sec = 0; + tp->tv_nsec = 1; + return 0; + } + +-static int ptp_clock_settime(struct posix_clock *pc, const struct timespec *tp) ++static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp) + { + struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +- struct timespec64 ts = timespec_to_timespec64(*tp); + +- return ptp->info->settime64(ptp->info, &ts); ++ return ptp->info->settime64(ptp->info, tp); + } + +-static int ptp_clock_gettime(struct posix_clock *pc, struct timespec *tp) ++static int ptp_clock_gettime(struct posix_clock *pc, struct timespec64 *tp) + { + struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +- struct timespec64 ts; + int err; + +- err = ptp->info->gettime64(ptp->info, &ts); +- if (!err) +- *tp = timespec64_to_timespec(ts); ++ err = ptp->info->gettime64(ptp->info, tp); + return err; + } + +@@ -133,7 +129,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx) + ops = ptp->info; + + if (tx->modes & ADJ_SETOFFSET) { +- struct timespec ts; ++ struct timespec64 ts; + ktime_t kt; + s64 delta; + +@@ -146,7 +142,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx) + if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC) + return -EINVAL; + +- kt = timespec_to_ktime(ts); ++ kt = timespec64_to_ktime(ts); + delta = ktime_to_ns(kt); + err = ops->adjtime(ops, delta); + } else if (tx->modes & ADJ_FREQUENCY) { +diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c +index 3a6d0290c54c..c5e272ea4372 100644 +--- a/drivers/regulator/anatop-regulator.c ++++ b/drivers/regulator/anatop-regulator.c +@@ -296,6 +296,11 @@ static int anatop_regulator_probe(struct platform_device *pdev) + if (!sreg->sel && !strcmp(sreg->name, "vddpu")) + sreg->sel = 22; + ++ /* set the default voltage of the pcie phy to be 1.100v */ ++ if (!sreg->sel && rdesc->name && ++ !strcmp(rdesc->name, "vddpcie")) ++ sreg->sel = 0x10; ++ + if (!sreg->bypass && !sreg->sel) { + dev_err(&pdev->dev, "Failed to read a valid default voltage selector.\n"); + return -EINVAL; +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 8f7034ba7d9e..86015b393dd5 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -41,6 +41,9 @@ + #include + #include + #include ++#ifdef CONFIG_X86 ++#include ++#endif + + /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */ + #include +@@ -1058,17 +1061,23 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { + cmos_wake_setup(&pnp->dev); + +- if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) ++ if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { ++ unsigned int irq = 0; ++#ifdef CONFIG_X86 + /* Some machines contain a PNP entry for the RTC, but + * don't define the IRQ. It should always be safe to +- * hardcode it in these cases ++ * hardcode it on systems with a legacy PIC. + */ ++ if (nr_legacy_irqs()) ++ irq = 8; ++#endif + return cmos_do_probe(&pnp->dev, +- pnp_get_resource(pnp, IORESOURCE_IO, 0), 8); +- else ++ pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); ++ } else { + return cmos_do_probe(&pnp->dev, + pnp_get_resource(pnp, IORESOURCE_IO, 0), + pnp_irq(pnp, 0)); ++ } + } + + static void __exit cmos_pnp_remove(struct pnp_dev *pnp) +diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c +index 3b3049c8c9e0..c0eb113588ff 100644 +--- a/drivers/rtc/rtc-ds1374.c ++++ b/drivers/rtc/rtc-ds1374.c +@@ -527,6 +527,10 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + if (get_user(new_margin, (int __user *)arg)) + return -EFAULT; + ++ /* the hardware's tick rate is 4096 Hz, so ++ * the counter value needs to be scaled accordingly ++ */ ++ new_margin <<= 12; + if (new_margin < 1 || new_margin > 16777216) + return -EINVAL; + +@@ -535,7 +539,8 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + ds1374_wdt_ping(); + /* fallthrough */ + case WDIOC_GETTIMEOUT: +- return put_user(wdt_margin, (int __user *)arg); ++ /* when returning ... inverse is true */ ++ return put_user((wdt_margin >> 12), (int __user *)arg); + case WDIOC_SETOPTIONS: + if (copy_from_user(&options, (int __user *)arg, sizeof(int))) + return -EFAULT; +@@ -543,14 +548,15 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + if (options & WDIOS_DISABLECARD) { + pr_info("disable watchdog\n"); + ds1374_wdt_disable(); ++ return 0; + } + + if (options & WDIOS_ENABLECARD) { + pr_info("enable watchdog\n"); + ds1374_wdt_settimeout(wdt_margin); + ds1374_wdt_ping(); ++ return 0; + } +- + return -EINVAL; + } + return -ENOTTY; +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 8379fbbc60db..ef43847153ea 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -13493,6 +13493,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + case LPFC_Q_CREATE_VERSION_1: + bf_set(lpfc_mbx_wq_create_wqe_count, &wq_create->u.request_1, + wq->entry_count); ++ bf_set(lpfc_mbox_hdr_version, &shdr->request, ++ LPFC_Q_CREATE_VERSION_1); ++ + switch (wq->entry_size) { + default: + case 64: +diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c +index 14c0334f41e4..26c67c42985c 100644 +--- a/drivers/scsi/mac_esp.c ++++ b/drivers/scsi/mac_esp.c +@@ -55,6 +55,7 @@ struct mac_esp_priv { + int error; + }; + static struct esp *esp_chips[2]; ++static DEFINE_SPINLOCK(esp_chips_lock); + + #define MAC_ESP_GET_PRIV(esp) ((struct mac_esp_priv *) \ + platform_get_drvdata((struct platform_device *) \ +@@ -562,15 +563,18 @@ static int esp_mac_probe(struct platform_device *dev) + } + + host->irq = IRQ_MAC_SCSI; +- esp_chips[dev->id] = esp; +- mb(); +- if (esp_chips[!dev->id] == NULL) { +- err = request_irq(host->irq, mac_scsi_esp_intr, 0, "ESP", NULL); +- if (err < 0) { +- esp_chips[dev->id] = NULL; +- goto fail_free_priv; +- } ++ ++ /* The request_irq() call is intended to succeed for the first device ++ * and fail for the second device. ++ */ ++ err = request_irq(host->irq, mac_scsi_esp_intr, 0, "ESP", NULL); ++ spin_lock(&esp_chips_lock); ++ if (err < 0 && esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); ++ goto fail_free_priv; + } ++ esp_chips[dev->id] = esp; ++ spin_unlock(&esp_chips_lock); + + err = scsi_esp_register(esp, &dev->dev); + if (err) +@@ -579,8 +583,13 @@ static int esp_mac_probe(struct platform_device *dev) + return 0; + + fail_free_irq: +- if (esp_chips[!dev->id] == NULL) ++ spin_lock(&esp_chips_lock); ++ esp_chips[dev->id] = NULL; ++ if (esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); + free_irq(host->irq, esp); ++ } else ++ spin_unlock(&esp_chips_lock); + fail_free_priv: + kfree(mep); + fail_free_command_block: +@@ -599,9 +608,13 @@ static int esp_mac_remove(struct platform_device *dev) + + scsi_esp_unregister(esp); + ++ spin_lock(&esp_chips_lock); + esp_chips[dev->id] = NULL; +- if (!(esp_chips[0] || esp_chips[1])) ++ if (esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); + free_irq(irq, NULL); ++ } else ++ spin_unlock(&esp_chips_lock); + + kfree(mep); + +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 03a2aadf0d3c..578fae4d474f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + #define VIRTIO_SCSI_MEMPOOL_SZ 64 +@@ -704,6 +705,28 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc) + return virtscsi_tmf(vscsi, cmd); + } + ++static int virtscsi_device_alloc(struct scsi_device *sdevice) ++{ ++ /* ++ * Passed through SCSI targets (e.g. with qemu's 'scsi-block') ++ * may have transfer limits which come from the host SCSI ++ * controller or something on the host side other than the ++ * target itself. ++ * ++ * To make this work properly, the hypervisor can adjust the ++ * target's VPD information to advertise these limits. But ++ * for that to work, the guest has to look at the VPD pages, ++ * which we won't do by default if it is an SPC-2 device, even ++ * if it does actually support it. ++ * ++ * So, set the blist to always try to read the VPD pages. ++ */ ++ sdevice->sdev_bflags = BLIST_TRY_VPD_PAGES; ++ ++ return 0; ++} ++ ++ + /** + * virtscsi_change_queue_depth() - Change a virtscsi target's queue depth + * @sdev: Virtscsi target whose queue depth to change +@@ -775,6 +798,7 @@ static struct scsi_host_template virtscsi_host_template_single = { + .change_queue_depth = virtscsi_change_queue_depth, + .eh_abort_handler = virtscsi_abort, + .eh_device_reset_handler = virtscsi_device_reset, ++ .slave_alloc = virtscsi_device_alloc, + + .can_queue = 1024, + .dma_boundary = UINT_MAX, +diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c +index a6d7029a85ac..581df3ebfc88 100644 +--- a/drivers/spi/spi-dw-mmio.c ++++ b/drivers/spi/spi-dw-mmio.c +@@ -120,8 +120,8 @@ static int dw_spi_mmio_remove(struct platform_device *pdev) + { + struct dw_spi_mmio *dwsmmio = platform_get_drvdata(pdev); + +- clk_disable_unprepare(dwsmmio->clk); + dw_spi_remove_host(&dwsmmio->dws); ++ clk_disable_unprepare(dwsmmio->clk); + + return 0; + } +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index f5b5bec6f3c1..013b33760639 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -703,16 +703,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + size_t pgstart, pgend; + int ret = -EINVAL; + ++ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) ++ return -EFAULT; ++ + mutex_lock(&ashmem_mutex); + + if (unlikely(!asma->file)) + goto out_unlock; + +- if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { +- ret = -EFAULT; +- goto out_unlock; +- } +- + /* per custom, you can pass zero for len to mean "everything onward" */ + if (!pin.len) + pin.len = PAGE_ALIGN(asma->size) - pin.offset; +diff --git a/drivers/staging/unisys/visorhba/visorhba_main.c b/drivers/staging/unisys/visorhba/visorhba_main.c +index c119f20dfd44..3f2ccf9d7358 100644 +--- a/drivers/staging/unisys/visorhba/visorhba_main.c ++++ b/drivers/staging/unisys/visorhba/visorhba_main.c +@@ -792,7 +792,7 @@ static void + do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + { + struct scsi_device *scsidev; +- unsigned char buf[36]; ++ unsigned char *buf; + struct scatterlist *sg; + unsigned int i; + char *this_page; +@@ -807,6 +807,10 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + if (cmdrsp->scsi.no_disk_result == 0) + return; + ++ buf = kzalloc(sizeof(char) * 36, GFP_KERNEL); ++ if (!buf) ++ return; ++ + /* Linux scsi code wants a device at Lun 0 + * to issue report luns, but we don't want + * a disk there so we'll present a processor +@@ -820,6 +824,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + if (scsi_sg_count(scsicmd) == 0) { + memcpy(scsi_sglist(scsicmd), buf, + cmdrsp->scsi.bufflen); ++ kfree(buf); + return; + } + +@@ -831,6 +836,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + memcpy(this_page, buf + bufind, sg[i].length); + kunmap_atomic(this_page_orig); + } ++ kfree(buf); + } else { + devdata = (struct visorhba_devdata *)scsidev->host->hostdata; + for_each_vdisk_match(vdisk, devdata, scsidev) { +diff --git a/drivers/staging/wilc1000/linux_mon.c b/drivers/staging/wilc1000/linux_mon.c +index 450af1b77f99..b2092c5ec7f3 100644 +--- a/drivers/staging/wilc1000/linux_mon.c ++++ b/drivers/staging/wilc1000/linux_mon.c +@@ -251,6 +251,8 @@ static netdev_tx_t WILC_WFI_mon_xmit(struct sk_buff *skb, + + if (skb->data[0] == 0xc0 && (!(memcmp(broadcast, &skb->data[4], 6)))) { + skb2 = dev_alloc_skb(skb->len + sizeof(struct wilc_wfi_radiotap_cb_hdr)); ++ if (!skb2) ++ return -ENOMEM; + + memcpy(skb_put(skb2, skb->len), skb->data, skb->len); + +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 2e35db7f4aac..c15af2fcf2ba 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -276,12 +276,11 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + else + ret = vfs_iter_read(fd, &iter, &pos); + +- kfree(bvec); +- + if (is_write) { + if (ret < 0 || ret != data_length) { + pr_err("%s() write returned %d\n", __func__, ret); +- return (ret < 0 ? ret : -EINVAL); ++ if (ret >= 0) ++ ret = -EINVAL; + } + } else { + /* +@@ -294,17 +293,29 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + pr_err("%s() returned %d, expecting %u for " + "S_ISBLK\n", __func__, ret, + data_length); +- return (ret < 0 ? ret : -EINVAL); ++ if (ret >= 0) ++ ret = -EINVAL; + } + } else { + if (ret < 0) { + pr_err("%s() returned %d for non S_ISBLK\n", + __func__, ret); +- return ret; ++ } else if (ret != data_length) { ++ /* ++ * Short read case: ++ * Probably some one truncate file under us. ++ * We must explicitly zero sg-pages to prevent ++ * expose uninizialized pages to userspace. ++ */ ++ if (ret < data_length) ++ ret += iov_iter_zero(data_length - ret, &iter); ++ else ++ ret = -EINVAL; + } + } + } +- return 1; ++ kfree(bvec); ++ return ret; + } + + static sense_reason_t +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 1bb629ab8ecc..a638c1738547 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1694,6 +1694,8 @@ static void release_tty(struct tty_struct *tty, int idx) + if (tty->link) + tty->link->port->itty = NULL; + tty_buffer_cancel_work(tty->port); ++ if (tty->link) ++ tty_buffer_cancel_work(tty->link->port); + + tty_kref_put(tty->link); + tty_kref_put(tty); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 517f565b65d7..598ec7545e84 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -409,7 +409,10 @@ static const char *vgacon_startup(void) + vga_video_port_val = VGA_CRT_DM; + if ((screen_info.orig_video_ega_bx & 0xff) != 0x10) { + static struct resource ega_console_resource = +- { .name = "ega", .start = 0x3B0, .end = 0x3BF }; ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_EGAM; + vga_vram_size = 0x8000; + display_desc = "EGA+"; +@@ -417,9 +420,15 @@ static const char *vgacon_startup(void) + &ega_console_resource); + } else { + static struct resource mda1_console_resource = +- { .name = "mda", .start = 0x3B0, .end = 0x3BB }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BB }; + static struct resource mda2_console_resource = +- { .name = "mda", .start = 0x3BF, .end = 0x3BF }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3BF, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_MDA; + vga_vram_size = 0x2000; + display_desc = "*MDA"; +@@ -441,15 +450,21 @@ static const char *vgacon_startup(void) + vga_vram_size = 0x8000; + + if (!screen_info.orig_video_isVGA) { +- static struct resource ega_console_resource +- = { .name = "ega", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource ega_console_resource = ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_EGAC; + display_desc = "EGA"; + request_resource(&ioport_resource, + &ega_console_resource); + } else { +- static struct resource vga_console_resource +- = { .name = "vga+", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource vga_console_resource = ++ { .name = "vga+", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_VGAC; + display_desc = "VGA+"; + request_resource(&ioport_resource, +@@ -493,7 +508,10 @@ static const char *vgacon_startup(void) + } + } else { + static struct resource cga_console_resource = +- { .name = "cga", .start = 0x3D4, .end = 0x3D5 }; ++ { .name = "cga", ++ .flags = IORESOURCE_IO, ++ .start = 0x3D4, ++ .end = 0x3D5 }; + vga_video_type = VIDEO_TYPE_CGA; + vga_vram_size = 0x2000; + display_desc = "*CGA"; +diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c +index d0a4e2f79a57..d215faacce04 100644 +--- a/drivers/video/fbdev/sm501fb.c ++++ b/drivers/video/fbdev/sm501fb.c +@@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info, + info->fbmem = ioremap(res->start, resource_size(res)); + if (info->fbmem == NULL) { + dev_err(dev, "cannot remap framebuffer\n"); ++ ret = -ENXIO; + goto err_mem_res; + } + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index 53326badfb61..2add8def83be 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1487,15 +1487,25 @@ static struct device_attribute fb_device_attrs[] = { + static int dlfb_select_std_channel(struct dlfb_data *dev) + { + int ret; +- u8 set_def_chn[] = { 0x57, 0xCD, 0xDC, 0xA7, ++ void *buf; ++ static const u8 set_def_chn[] = { ++ 0x57, 0xCD, 0xDC, 0xA7, + 0x1C, 0x88, 0x5E, 0x15, + 0x60, 0xFE, 0xC6, 0x97, + 0x16, 0x3D, 0x47, 0xF2 }; + ++ buf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL); ++ ++ if (!buf) ++ return -ENOMEM; ++ + ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), + NR_USB_REQUEST_CHANNEL, + (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0, +- set_def_chn, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); ++ buf, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); ++ ++ kfree(buf); ++ + return ret; + } + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index c5bbb5300658..19b56873b797 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5008,13 +5008,19 @@ static int is_extent_unchanged(struct send_ctx *sctx, + while (key.offset < ekey->offset + left_len) { + ei = btrfs_item_ptr(eb, slot, struct btrfs_file_extent_item); + right_type = btrfs_file_extent_type(eb, ei); +- if (right_type != BTRFS_FILE_EXTENT_REG) { ++ if (right_type != BTRFS_FILE_EXTENT_REG && ++ right_type != BTRFS_FILE_EXTENT_INLINE) { + ret = 0; + goto out; + } + + right_disknr = btrfs_file_extent_disk_bytenr(eb, ei); +- right_len = btrfs_file_extent_num_bytes(eb, ei); ++ if (right_type == BTRFS_FILE_EXTENT_INLINE) { ++ right_len = btrfs_file_extent_inline_len(eb, slot, ei); ++ right_len = PAGE_ALIGN(right_len); ++ } else { ++ right_len = btrfs_file_extent_num_bytes(eb, ei); ++ } + right_offset = btrfs_file_extent_offset(eb, ei); + right_gen = btrfs_file_extent_generation(eb, ei); + +@@ -5028,6 +5034,19 @@ static int is_extent_unchanged(struct send_ctx *sctx, + goto out; + } + ++ /* ++ * We just wanted to see if when we have an inline extent, what ++ * follows it is a regular extent (wanted to check the above ++ * condition for inline extents too). This should normally not ++ * happen but it's possible for example when we have an inline ++ * compressed extent representing data with a size matching ++ * the page size (currently the same as sector size). ++ */ ++ if (right_type == BTRFS_FILE_EXTENT_INLINE) { ++ ret = 0; ++ goto out; ++ } ++ + left_offset_fixed = left_offset; + if (key.offset < ekey->offset) { + /* Fix the right offset for 2a and 7. */ +diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c +index abae6dd2c6b9..cc88f4f0325e 100644 +--- a/fs/cifs/netmisc.c ++++ b/fs/cifs/netmisc.c +@@ -980,10 +980,10 @@ struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time, int offset) + cifs_dbg(VFS, "illegal hours %d\n", st->Hours); + days = sd->Day; + month = sd->Month; +- if ((days > 31) || (month > 12)) { ++ if (days < 1 || days > 31 || month < 1 || month > 12) { + cifs_dbg(VFS, "illegal date, month %d day: %d\n", month, days); +- if (month > 12) +- month = 12; ++ days = clamp(days, 1, 31); ++ month = clamp(month, 1, 12); + } + month -= 1; + days += total_days_of_prev_months[month]; +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index e88ffe1da045..a035d1a95882 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -344,13 +344,12 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, + /* BB is NTLMV2 session security format easier to use here? */ + flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | + NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | +- NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; +- if (ses->server->sign) { ++ NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | ++ NTLMSSP_NEGOTIATE_SEAL; ++ if (ses->server->sign) + flags |= NTLMSSP_NEGOTIATE_SIGN; +- if (!ses->server->session_estab || +- ses->ntlmssp->sesskey_per_smbsess) +- flags |= NTLMSSP_NEGOTIATE_KEY_XCH; +- } ++ if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) ++ flags |= NTLMSSP_NEGOTIATE_KEY_XCH; + + sec_blob->NegotiateFlags = cpu_to_le32(flags); + +@@ -407,13 +406,12 @@ int build_ntlmssp_auth_blob(unsigned char **pbuffer, + flags = NTLMSSP_NEGOTIATE_56 | + NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | + NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | +- NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; +- if (ses->server->sign) { ++ NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | ++ NTLMSSP_NEGOTIATE_SEAL; ++ if (ses->server->sign) + flags |= NTLMSSP_NEGOTIATE_SIGN; +- if (!ses->server->session_estab || +- ses->ntlmssp->sesskey_per_smbsess) +- flags |= NTLMSSP_NEGOTIATE_KEY_XCH; +- } ++ if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) ++ flags |= NTLMSSP_NEGOTIATE_KEY_XCH; + + tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); + sec_blob->NegotiateFlags = cpu_to_le32(flags); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 84614a5edb87..33b1bc21a120 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -832,10 +832,8 @@ ssetup_exit: + + if (!rc) { + mutex_lock(&server->srv_mutex); +- if (server->sign && server->ops->generate_signingkey) { ++ if (server->ops->generate_signingkey) { + rc = server->ops->generate_signingkey(ses); +- kfree(ses->auth_key.response); +- ses->auth_key.response = NULL; + if (rc) { + cifs_dbg(FYI, + "SMB3 session key generation failed\n"); +@@ -857,10 +855,6 @@ ssetup_exit: + } + + keygen_exit: +- if (!server->sign) { +- kfree(ses->auth_key.response); +- ses->auth_key.response = NULL; +- } + if (spnego_key) { + key_invalidate(spnego_key); + key_put(spnego_key); +@@ -1558,6 +1552,9 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + } else + iov[0].iov_len = get_rfc1002_length(req) + 4; + ++ /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ ++ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) ++ req->hdr.Flags |= SMB2_FLAGS_SIGNED; + + rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0); + rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base; +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 8ebfdd00044b..4bdc2fc86280 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -1273,8 +1273,10 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index) + mirror = &desc->pg_mirrors[midx]; + if (!list_empty(&mirror->pg_list)) { + prev = nfs_list_entry(mirror->pg_list.prev); +- if (index != prev->wb_index + 1) +- nfs_pageio_complete_mirror(desc, midx); ++ if (index != prev->wb_index + 1) { ++ nfs_pageio_complete(desc); ++ break; ++ } + } + } + } +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 209dbfc50cd4..bfbee8ddf978 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1245,14 +1245,14 @@ nfsd4_layoutget(struct svc_rqst *rqstp, + const struct nfsd4_layout_ops *ops; + struct nfs4_layout_stateid *ls; + __be32 nfserr; +- int accmode; ++ int accmode = NFSD_MAY_READ_IF_EXEC; + + switch (lgp->lg_seg.iomode) { + case IOMODE_READ: +- accmode = NFSD_MAY_READ; ++ accmode |= NFSD_MAY_READ; + break; + case IOMODE_RW: +- accmode = NFSD_MAY_READ | NFSD_MAY_WRITE; ++ accmode |= NFSD_MAY_READ | NFSD_MAY_WRITE; + break; + default: + dprintk("%s: invalid iomode %d\n", +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 91e0c5429b4d..17138a97f306 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -92,6 +92,12 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp, + err = follow_down(&path); + if (err < 0) + goto out; ++ if (path.mnt == exp->ex_path.mnt && path.dentry == dentry && ++ nfsd_mountpoint(dentry, exp) == 2) { ++ /* This is only a mountpoint in some other namespace */ ++ path_put(&path); ++ goto out; ++ } + + exp2 = rqst_exp_get_by_name(rqstp, &path); + if (IS_ERR(exp2)) { +@@ -165,16 +171,26 @@ static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, st + /* + * For nfsd purposes, we treat V4ROOT exports as though there was an + * export at *every* directory. ++ * We return: ++ * '1' if this dentry *must* be an export point, ++ * '2' if it might be, if there is really a mount here, and ++ * '0' if there is no chance of an export point here. + */ + int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp) + { +- if (d_mountpoint(dentry)) ++ if (!d_inode(dentry)) ++ return 0; ++ if (exp->ex_flags & NFSEXP_V4ROOT) + return 1; + if (nfsd4_is_junction(dentry)) + return 1; +- if (!(exp->ex_flags & NFSEXP_V4ROOT)) +- return 0; +- return d_inode(dentry) != NULL; ++ if (d_mountpoint(dentry)) ++ /* ++ * Might only be a mountpoint in a different namespace, ++ * but we need to check. ++ */ ++ return 2; ++ return 0; + } + + __be32 +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h +index 34c4498b800f..83b22ae9ae12 100644 +--- a/include/linux/posix-clock.h ++++ b/include/linux/posix-clock.h +@@ -59,23 +59,23 @@ struct posix_clock_operations { + + int (*clock_adjtime)(struct posix_clock *pc, struct timex *tx); + +- int (*clock_gettime)(struct posix_clock *pc, struct timespec *ts); ++ int (*clock_gettime)(struct posix_clock *pc, struct timespec64 *ts); + +- int (*clock_getres) (struct posix_clock *pc, struct timespec *ts); ++ int (*clock_getres) (struct posix_clock *pc, struct timespec64 *ts); + + int (*clock_settime)(struct posix_clock *pc, +- const struct timespec *ts); ++ const struct timespec64 *ts); + + int (*timer_create) (struct posix_clock *pc, struct k_itimer *kit); + + int (*timer_delete) (struct posix_clock *pc, struct k_itimer *kit); + + void (*timer_gettime)(struct posix_clock *pc, +- struct k_itimer *kit, struct itimerspec *tsp); ++ struct k_itimer *kit, struct itimerspec64 *tsp); + + int (*timer_settime)(struct posix_clock *pc, + struct k_itimer *kit, int flags, +- struct itimerspec *tsp, struct itimerspec *old); ++ struct itimerspec64 *tsp, struct itimerspec64 *old); + /* + * Optional character device methods: + */ +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index a079ed14f230..4889a8ab77ce 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1189,8 +1189,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) + * set the trigger type must match. Also all must + * agree on ONESHOT. + */ ++ unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data); ++ + if (!((old->flags & new->flags) & IRQF_SHARED) || +- ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK) || ++ (oldtype != (new->flags & IRQF_TRIGGER_MASK)) || + ((old->flags ^ new->flags) & IRQF_ONESHOT)) + goto mismatch; + +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index 9cff0ab82b63..e24008c098c6 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -300,14 +300,17 @@ out: + static int pc_clock_gettime(clockid_t id, struct timespec *ts) + { + struct posix_clock_desc cd; ++ struct timespec64 ts64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.clock_gettime) +- err = cd.clk->ops.clock_gettime(cd.clk, ts); ++ if (cd.clk->ops.clock_gettime) { ++ err = cd.clk->ops.clock_gettime(cd.clk, &ts64); ++ *ts = timespec64_to_timespec(ts64); ++ } + else + err = -EOPNOTSUPP; + +@@ -319,14 +322,17 @@ static int pc_clock_gettime(clockid_t id, struct timespec *ts) + static int pc_clock_getres(clockid_t id, struct timespec *ts) + { + struct posix_clock_desc cd; ++ struct timespec64 ts64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.clock_getres) +- err = cd.clk->ops.clock_getres(cd.clk, ts); ++ if (cd.clk->ops.clock_getres) { ++ err = cd.clk->ops.clock_getres(cd.clk, &ts64); ++ *ts = timespec64_to_timespec(ts64); ++ } + else + err = -EOPNOTSUPP; + +@@ -337,6 +343,7 @@ static int pc_clock_getres(clockid_t id, struct timespec *ts) + + static int pc_clock_settime(clockid_t id, const struct timespec *ts) + { ++ struct timespec64 ts64 = timespec_to_timespec64(*ts); + struct posix_clock_desc cd; + int err; + +@@ -350,7 +357,7 @@ static int pc_clock_settime(clockid_t id, const struct timespec *ts) + } + + if (cd.clk->ops.clock_settime) +- err = cd.clk->ops.clock_settime(cd.clk, ts); ++ err = cd.clk->ops.clock_settime(cd.clk, &ts64); + else + err = -EOPNOTSUPP; + out: +@@ -403,29 +410,36 @@ static void pc_timer_gettime(struct k_itimer *kit, struct itimerspec *ts) + { + clockid_t id = kit->it_clock; + struct posix_clock_desc cd; ++ struct itimerspec64 ts64; + + if (get_clock_desc(id, &cd)) + return; + +- if (cd.clk->ops.timer_gettime) +- cd.clk->ops.timer_gettime(cd.clk, kit, ts); +- ++ if (cd.clk->ops.timer_gettime) { ++ cd.clk->ops.timer_gettime(cd.clk, kit, &ts64); ++ *ts = itimerspec64_to_itimerspec(&ts64); ++ } + put_clock_desc(&cd); + } + + static int pc_timer_settime(struct k_itimer *kit, int flags, + struct itimerspec *ts, struct itimerspec *old) + { ++ struct itimerspec64 ts64 = itimerspec_to_itimerspec64(ts); + clockid_t id = kit->it_clock; + struct posix_clock_desc cd; ++ struct itimerspec64 old64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.timer_settime) +- err = cd.clk->ops.timer_settime(cd.clk, kit, flags, ts, old); ++ if (cd.clk->ops.timer_settime) { ++ err = cd.clk->ops.timer_settime(cd.clk, kit, flags, &ts64, &old64); ++ if (old) ++ *old = itimerspec64_to_itimerspec(&old64); ++ } + else + err = -EOPNOTSUPP; + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 71290fb7d500..75433ed6714b 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5464,10 +5464,6 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb) + else + tp->pred_flags = 0; + +- if (!sock_flag(sk, SOCK_DEAD)) { +- sk->sk_state_change(sk); +- sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT); +- } + } + + static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, +@@ -5531,6 +5527,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_fastopen_cookie foc = { .len = -1 }; + int saved_clamp = tp->rx_opt.mss_clamp; ++ bool fastopen_fail; + + tcp_parse_options(skb, &tp->rx_opt, 0, &foc); + if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr) +@@ -5633,10 +5630,15 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + + tcp_finish_connect(sk, skb); + +- if ((tp->syn_fastopen || tp->syn_data) && +- tcp_rcv_fastopen_synack(sk, skb, &foc)) +- return -1; ++ fastopen_fail = (tp->syn_fastopen || tp->syn_data) && ++ tcp_rcv_fastopen_synack(sk, skb, &foc); + ++ if (!sock_flag(sk, SOCK_DEAD)) { ++ sk->sk_state_change(sk); ++ sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT); ++ } ++ if (fastopen_fail) ++ return -1; + if (sk->sk_write_pending || + icsk->icsk_accept_queue.rskq_defer_accept || + icsk->icsk_ack.pingpong) { +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index d7105422bc63..e4b0fb2f06a3 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -614,6 +614,7 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; ++ struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -626,6 +627,25 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; ++ ++ if (p->flags & IP6_TNL_F_CAP_XMIT) { ++ int strict = (ipv6_addr_type(&p->raddr) & ++ (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); ++ struct rt6_info *rt = rt6_lookup(t->net, ++ &p->raddr, &p->laddr, ++ p->link, strict); ++ ++ if (rt) ++ tdev = rt->dst.dev; ++ ip6_rt_put(rt); ++ } ++ ++ if (!tdev && p->link) ++ tdev = __dev_get_by_index(t->net, p->link); ++ ++ if (tdev) ++ dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, ++ IPV6_MIN_MTU); + } + + /** +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 84afb9a77278..55810e4899f1 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1686,6 +1686,8 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, + case NETDEV_CHANGEADDR: + neigh_changeaddr(&nd_tbl, dev); + fib6_run_gc(0, net, false); ++ /* fallthrough */ ++ case NETDEV_UP: + idev = in6_dev_get(dev); + if (!idev) + break; +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index 5bad05e9af90..45fb1abdb265 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -194,6 +194,7 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb) + } + + if (ieee80211_is_action(mgmt->frame_control) && ++ !ieee80211_has_protected(mgmt->frame_control) && + mgmt->u.action.category == WLAN_CATEGORY_HT && + mgmt->u.action.u.ht_smps.action == WLAN_HT_ACTION_SMPS && + ieee80211_sdata_running(sdata)) { +diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c +index e7ac07e53b59..febcfac7e3df 100644 +--- a/net/netfilter/xt_CT.c ++++ b/net/netfilter/xt_CT.c +@@ -168,8 +168,10 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, + goto err_put_timeout; + } + timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC); +- if (timeout_ext == NULL) ++ if (!timeout_ext) { + ret = -ENOMEM; ++ goto err_put_timeout; ++ } + + rcu_read_unlock(); + return ret; +@@ -201,6 +203,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, + struct xt_ct_target_info_v1 *info) + { + struct nf_conntrack_zone zone; ++ struct nf_conn_help *help; + struct nf_conn *ct; + int ret = -EOPNOTSUPP; + +@@ -249,7 +252,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, + if (info->timeout[0]) { + ret = xt_ct_set_timeout(ct, par, info->timeout); + if (ret < 0) +- goto err3; ++ goto err4; + } + __set_bit(IPS_CONFIRMED_BIT, &ct->status); + nf_conntrack_get(&ct->ct_general); +@@ -257,6 +260,10 @@ out: + info->ct = ct; + return 0; + ++err4: ++ help = nfct_help(ct); ++ if (help) ++ module_put(help->helper->me); + err3: + nf_ct_tmpl_free(ct); + err2: +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 6a2507f24b0f..1829adb23505 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -361,10 +361,38 @@ ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, + u16 proto, const struct sk_buff *skb) + { + struct nf_conntrack_tuple tuple; ++ struct nf_conntrack_expect *exp; + + if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) + return NULL; +- return __nf_ct_expect_find(net, zone, &tuple); ++ ++ exp = __nf_ct_expect_find(net, zone, &tuple); ++ if (exp) { ++ struct nf_conntrack_tuple_hash *h; ++ ++ /* Delete existing conntrack entry, if it clashes with the ++ * expectation. This can happen since conntrack ALGs do not ++ * check for clashes between (new) expectations and existing ++ * conntrack entries. nf_conntrack_in() will check the ++ * expectations only if a conntrack entry can not be found, ++ * which can lead to OVS finding the expectation (here) in the ++ * init direction, but which will not be removed by the ++ * nf_conntrack_in() call, if a matching conntrack entry is ++ * found instead. In this case all init direction packets ++ * would be reported as new related packets, while reply ++ * direction packets would be reported as un-related ++ * established packets. ++ */ ++ h = nf_conntrack_find_get(net, zone, &tuple); ++ if (h) { ++ struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); ++ ++ nf_ct_delete(ct, 0, 0); ++ nf_conntrack_put(&ct->ct_general); ++ } ++ } ++ ++ return exp; + } + + /* Determine whether skb->nfct is equal to the result of conntrack lookup. */ +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 11305a4baf7b..8e33360ae2e5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6717,6 +6717,7 @@ enum { + ALC668_FIXUP_DELL_DISABLE_AAMIX, + ALC668_FIXUP_DELL_XPS13, + ALC662_FIXUP_ASUS_Nx50, ++ ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE, + ALC668_FIXUP_ASUS_Nx51, + }; + +@@ -6964,14 +6965,21 @@ static const struct hda_fixup alc662_fixups[] = { + .chained = true, + .chain_id = ALC662_FIXUP_BASS_1A + }, ++ [ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_headset_mode_alc668, ++ .chain_id = ALC662_FIXUP_BASS_CHMAP ++ }, + [ALC668_FIXUP_ASUS_Nx51] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- {0x1a, 0x90170151}, /* bass speaker */ ++ { 0x19, 0x03a1913d }, /* use as headphone mic, without its own jack detect */ ++ { 0x1a, 0x90170151 }, /* bass speaker */ ++ { 0x1b, 0x03a1113c }, /* use as headset mic, without its own jack detect */ + {} + }, + .chained = true, +- .chain_id = ALC662_FIXUP_BASS_CHMAP, ++ .chain_id = ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE, + }, + }; + +diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c +index b4844f78266f..f6c3be192cc9 100644 +--- a/sound/soc/intel/skylake/skl.c ++++ b/sound/soc/intel/skylake/skl.c +@@ -280,7 +280,7 @@ static int probe_codec(struct hdac_ext_bus *ebus, int addr) + struct hdac_bus *bus = ebus_to_hbus(ebus); + unsigned int cmd = (addr << 28) | (AC_NODE_ROOT << 20) | + (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID; +- unsigned int res; ++ unsigned int res = -1; + + mutex_lock(&bus->cmd_mutex); + snd_hdac_bus_send_cmd(bus, cmd); +diff --git a/tools/perf/tests/kmod-path.c b/tools/perf/tests/kmod-path.c +index 08c433b4bf4f..25e80c02230b 100644 +--- a/tools/perf/tests/kmod-path.c ++++ b/tools/perf/tests/kmod-path.c +@@ -60,6 +60,7 @@ int test__kmod_path__parse(void) + M("/xxxx/xxxx/x-x.ko", PERF_RECORD_MISC_KERNEL, true); + M("/xxxx/xxxx/x-x.ko", PERF_RECORD_MISC_USER, false); + ++#ifdef HAVE_ZLIB_SUPPORT + /* path alloc_name alloc_ext kmod comp name ext */ + T("/xxxx/xxxx/x.ko.gz", true , true , true, true, "[x]", "gz"); + T("/xxxx/xxxx/x.ko.gz", false , true , true, true, NULL , "gz"); +@@ -95,6 +96,7 @@ int test__kmod_path__parse(void) + M("x.ko.gz", PERF_RECORD_MISC_CPUMODE_UNKNOWN, true); + M("x.ko.gz", PERF_RECORD_MISC_KERNEL, true); + M("x.ko.gz", PERF_RECORD_MISC_USER, false); ++#endif + + /* path alloc_name alloc_ext kmod comp name ext */ + T("[test_module]", true , true , true, false, "[test_module]", NULL); diff --git a/patch/kernel/mvebu-default/04-patch-4.4.124-125.patch b/patch/kernel/mvebu-default/04-patch-4.4.124-125.patch new file mode 100644 index 000000000..162b4b819 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.124-125.patch @@ -0,0 +1,1326 @@ +diff --git a/Makefile b/Makefile +index bbaf3fd0d1ef..7dcafa5dcd34 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 124 ++SUBLEVEL = 125 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -784,6 +784,15 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) + # disable invalid "can't wrap" optimizations for signed / pointers + KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) + ++# clang sets -fmerge-all-constants by default as optimization, but this ++# is non-conforming behavior for C and in fact breaks the kernel, so we ++# need to disable it here generally. ++KBUILD_CFLAGS += $(call cc-option,-fno-merge-all-constants) ++ ++# for gcc -fno-merge-all-constants disables everything, but it is fine ++# to have actual conforming behavior enabled. ++KBUILD_CFLAGS += $(call cc-option,-fmerge-constants) ++ + # Make sure -fstack-check isn't enabled (like gentoo apparently did) + KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 653735a8c58a..51ac84e0812d 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -697,3 +697,15 @@ void *__init fixmap_remap_fdt(phys_addr_t dt_phys) + + return dt_virt; + } ++ ++#ifdef CONFIG_HAVE_ARCH_HUGE_VMAP ++int pud_free_pmd_page(pud_t *pud) ++{ ++ return pud_none(*pud); ++} ++ ++int pmd_free_pte_page(pmd_t *pmd) ++{ ++ return pmd_none(*pmd); ++} ++#endif +diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c +index ee117c4bc4a3..8037a4bd84fd 100644 +--- a/arch/mips/ralink/reset.c ++++ b/arch/mips/ralink/reset.c +@@ -96,16 +96,9 @@ static void ralink_restart(char *command) + unreachable(); + } + +-static void ralink_halt(void) +-{ +- local_irq_disable(); +- unreachable(); +-} +- + static int __init mips_reboot_setup(void) + { + _machine_restart = ralink_restart; +- _machine_halt = ralink_halt; + + return 0; + } +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 1f9caa041bf7..d2c663aeccba 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -179,6 +179,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr) + + LDFLAGS := -m elf_$(UTS_MACHINE) + ++# ++# The 64-bit kernel must be aligned to 2MB. Pass -z max-page-size=0x200000 to ++# the linker to force 2MB page size regardless of the default page size used ++# by the linker. ++# ++ifdef CONFIG_X86_64 ++LDFLAGS += $(call ld-option, -z max-page-size=0x200000) ++endif ++ + # Speed up the build + KBUILD_CFLAGS += -pipe + # Workaround for a gcc prelease that unfortunately was shipped in a suse release +diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c +index 79dac1758e7c..16df89c30c20 100644 +--- a/arch/x86/boot/compressed/misc.c ++++ b/arch/x86/boot/compressed/misc.c +@@ -366,6 +366,10 @@ static void parse_elf(void *output) + + switch (phdr->p_type) { + case PT_LOAD: ++#ifdef CONFIG_X86_64 ++ if ((phdr->p_align % 0x200000) != 0) ++ error("Alignment of LOAD segment isn't multiple of 2MB"); ++#endif + #ifdef CONFIG_RELOCATABLE + dest = output; + dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR); +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 59a4e1604a36..92b840c94f17 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -1018,7 +1018,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \ + #endif /* CONFIG_HYPERV */ + + idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK +-idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK ++idtentry int3 do_int3 has_error_code=0 + idtentry stack_segment do_stack_segment has_error_code=1 + + #ifdef CONFIG_XEN +diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h +index 6b6e16d813b9..dd11f5cb4149 100644 +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -310,6 +310,7 @@ enum vmcs_field { + #define INTR_TYPE_NMI_INTR (2 << 8) /* NMI */ + #define INTR_TYPE_HARD_EXCEPTION (3 << 8) /* processor exception */ + #define INTR_TYPE_SOFT_INTR (4 << 8) /* software interrupt */ ++#define INTR_TYPE_PRIV_SW_EXCEPTION (5 << 8) /* ICE breakpoint - undocumented */ + #define INTR_TYPE_SOFT_EXCEPTION (6 << 8) /* software exception */ + + /* GUEST_INTERRUPTIBILITY_INFO flags. */ +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index 5cc2242d77c6..7b79c80ce029 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -2716,7 +2716,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left) + X86_CONFIG(.event=0xc0, .umask=0x01)) { + if (left < 128) + left = 128; +- left &= ~0x3fu; ++ left &= ~0x3fULL; + } + return left; + } +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index 22b81f35c500..1fbd2631be60 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -480,7 +480,6 @@ do_general_protection(struct pt_regs *regs, long error_code) + } + NOKPROBE_SYMBOL(do_general_protection); + +-/* May run on IST stack. */ + dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + { + #ifdef CONFIG_DYNAMIC_FTRACE +@@ -495,7 +494,15 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + if (poke_int3_handler(regs)) + return; + ++ /* ++ * Use ist_enter despite the fact that we don't use an IST stack. ++ * We can be called from a kprobe in non-CONTEXT_KERNEL kernel ++ * mode or even during context tracking state changes. ++ * ++ * This means that we can't schedule. That's okay. ++ */ + ist_enter(regs); ++ + RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU"); + #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP + if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP, +@@ -512,15 +519,9 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + SIGTRAP) == NOTIFY_STOP) + goto exit; + +- /* +- * Let others (NMI) know that the debug stack is in use +- * as we may switch to the interrupt stack. +- */ +- debug_stack_usage_inc(); + preempt_conditional_sti(regs); + do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL); + preempt_conditional_cli(regs); +- debug_stack_usage_dec(); + exit: + ist_exit(regs); + } +@@ -886,19 +887,16 @@ void __init trap_init(void) + cpu_init(); + + /* +- * X86_TRAP_DB and X86_TRAP_BP have been set +- * in early_trap_init(). However, ITS works only after +- * cpu_init() loads TSS. See comments in early_trap_init(). ++ * X86_TRAP_DB was installed in early_trap_init(). However, ++ * IST works only after cpu_init() loads TSS. See comments ++ * in early_trap_init(). + */ + set_intr_gate_ist(X86_TRAP_DB, &debug, DEBUG_STACK); +- /* int3 can be called from all */ +- set_system_intr_gate_ist(X86_TRAP_BP, &int3, DEBUG_STACK); + + x86_init.irqs.trap_init(); + + #ifdef CONFIG_X86_64 + memcpy(&debug_idt_table, &idt_table, IDT_ENTRIES * 16); + set_nmi_gate(X86_TRAP_DB, &debug); +- set_nmi_gate(X86_TRAP_BP, &int3); + #endif + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 849517805eef..46bbc69844bd 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1011,6 +1011,13 @@ static inline bool is_machine_check(u32 intr_info) + (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK); + } + ++/* Undocumented: icebp/int1 */ ++static inline bool is_icebp(u32 intr_info) ++{ ++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) ++ == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK); ++} ++ + static inline bool cpu_has_vmx_msr_bitmap(void) + { + return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS; +@@ -5333,7 +5340,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) { + vcpu->arch.dr6 &= ~15; + vcpu->arch.dr6 |= dr6 | DR6_RTM; +- if (!(dr6 & ~DR6_RESERVED)) /* icebp */ ++ if (is_icebp(intr_info)) + skip_emulated_instruction(vcpu); + + kvm_queue_exception(vcpu, DB_VECTOR); +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index dbc27a2b4ad5..c013326a0d7a 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -666,4 +666,52 @@ int pmd_clear_huge(pmd_t *pmd) + + return 0; + } ++ ++/** ++ * pud_free_pmd_page - Clear pud entry and free pmd page. ++ * @pud: Pointer to a PUD. ++ * ++ * Context: The pud range has been unmaped and TLB purged. ++ * Return: 1 if clearing the entry succeeded. 0 otherwise. ++ */ ++int pud_free_pmd_page(pud_t *pud) ++{ ++ pmd_t *pmd; ++ int i; ++ ++ if (pud_none(*pud)) ++ return 1; ++ ++ pmd = (pmd_t *)pud_page_vaddr(*pud); ++ ++ for (i = 0; i < PTRS_PER_PMD; i++) ++ if (!pmd_free_pte_page(&pmd[i])) ++ return 0; ++ ++ pud_clear(pud); ++ free_page((unsigned long)pmd); ++ ++ return 1; ++} ++ ++/** ++ * pmd_free_pte_page - Clear pmd entry and free pte page. ++ * @pmd: Pointer to a PMD. ++ * ++ * Context: The pmd range has been unmaped and TLB purged. ++ * Return: 1 if clearing the entry succeeded. 0 otherwise. ++ */ ++int pmd_free_pte_page(pmd_t *pmd) ++{ ++ pte_t *pte; ++ ++ if (pmd_none(*pmd)) ++ return 1; ++ ++ pte = (pte_t *)pmd_page_vaddr(*pmd); ++ pmd_clear(pmd); ++ free_page((unsigned long)pte); ++ ++ return 1; ++} + #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index a889211e21c5..dd9a861fd526 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1077,7 +1077,7 @@ void bpf_int_jit_compile(struct bpf_prog *prog) + * may converge on the last pass. In such case do one more + * pass to emit the final image + */ +- for (pass = 0; pass < 10 || image; pass++) { ++ for (pass = 0; pass < 20 || image; pass++) { + proglen = do_jit(prog, addrs, image, oldproglen, &ctx); + if (proglen <= 0) { + image = NULL; +@@ -1100,6 +1100,7 @@ void bpf_int_jit_compile(struct bpf_prog *prog) + goto out; + } + oldproglen = proglen; ++ cond_resched(); + } + + if (bpf_jit_enable > 1) +diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c +index d176e0ece470..2946e2846573 100644 +--- a/drivers/acpi/numa.c ++++ b/drivers/acpi/numa.c +@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm) + */ + int acpi_map_pxm_to_online_node(int pxm) + { +- int node, n, dist, min_dist; ++ int node, min_node; + + node = acpi_map_pxm_to_node(pxm); + + if (node == NUMA_NO_NODE) + node = 0; + ++ min_node = node; + if (!node_online(node)) { +- min_dist = INT_MAX; ++ int min_dist = INT_MAX, dist, n; ++ + for_each_online_node(n) { + dist = node_distance(node, n); + if (dist < min_dist) { + min_dist = dist; +- node = n; ++ min_node = n; + } + } + } + +- return node; ++ return min_node; + } + EXPORT_SYMBOL(acpi_map_pxm_to_online_node); + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 8ddf5d5c94fd..5a6a01135470 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -538,7 +538,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { + .driver_data = board_ahci_yes_fbs }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), + .driver_data = board_ahci_yes_fbs }, +- { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), ++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */ ++ .driver_data = board_ahci_yes_fbs }, ++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */ + .driver_data = board_ahci_yes_fbs }, + + /* Promise */ +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 69ec1c5d7152..2d677ba46d77 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4224,6 +4224,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + ++ /* Crucial BX100 SSD 500GB has broken LPM support */ ++ { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM }, ++ ++ /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */ ++ { "Crucial_CT512MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ /* 512GB MX100 with newer firmware has only LPM issues */ ++ { "Crucial_CT512MX100*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ ++ /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */ ++ { "Crucial_CT480M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +@@ -4235,7 +4254,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +- { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +@@ -5077,8 +5098,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. + */ +- if (WARN_ON_ONCE(ata_is_data(prot) && +- (!qc->sg || !qc->n_elem || !qc->nbytes))) ++ if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes)) + goto sys_err; + + if (ata_is_dma(prot) || (ata_is_pio(prot) && +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 5b2aee83d776..4a267347a6d9 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3472,7 +3472,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, + if (likely((scsi_op != ATA_16) || !atapi_passthru16)) { + /* relay SCSI command to ATAPI device */ + int len = COMMAND_SIZE(scsi_op); +- if (unlikely(len > scmd->cmd_len || len > dev->cdb_len)) ++ if (unlikely(len > scmd->cmd_len || ++ len > dev->cdb_len || ++ scmd->cmd_len > ATAPI_CDB_LEN)) + goto bad_cdb_len; + + xlat_func = atapi_xlat; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 54cef3dc0beb..7fca7cfd5b09 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -216,7 +216,6 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, +@@ -247,6 +246,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + + /* QCA ROME chipset */ ++ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 35ab89fe9d7b..7c4b1ffe874f 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -912,8 +912,10 @@ static int bcm2835_pll_on(struct clk_hw *hw) + ~A2W_PLL_CTRL_PWRDN); + + /* Take the PLL out of reset. */ ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, data->cm_ctrl_reg, + cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST); ++ spin_unlock(&cprman->regs_lock); + + /* Wait for the PLL to lock. */ + timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS); +@@ -997,9 +999,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + } + + /* Unmask the reference clock from the oscillator. */ ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, A2W_XOSC_CTRL, + cprman_read(cprman, A2W_XOSC_CTRL) | + data->reference_enable_mask); ++ spin_unlock(&cprman->regs_lock); + + if (do_ana_setup_first) + bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana); +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 3feaab94f358..1a2a7365d0b5 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -89,25 +89,18 @@ void radeon_connector_hotplug(struct drm_connector *connector) + /* don't do anything if sink is not display port, i.e., + * passive dp->(dvi|hdmi) adaptor + */ +- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { +- int saved_dpms = connector->dpms; +- /* Only turn off the display if it's physically disconnected */ +- if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- } else if (radeon_dp_needs_link_train(radeon_connector)) { +- /* Don't try to start link training before we +- * have the dpcd */ +- if (!radeon_dp_getdpcd(radeon_connector)) +- return; +- +- /* set it to OFF so that drm_helper_connector_dpms() +- * won't return immediately since the current state +- * is ON at this point. +- */ +- connector->dpms = DRM_MODE_DPMS_OFF; +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- } +- connector->dpms = saved_dpms; ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && ++ radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) && ++ radeon_dp_needs_link_train(radeon_connector)) { ++ /* Don't start link training before we have the DPCD */ ++ if (!radeon_dp_getdpcd(radeon_connector)) ++ return; ++ ++ /* Turn the connector off and back on immediately, which ++ * will trigger link training ++ */ ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + } + } + } +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index 73e41a8613da..29bd801f5dad 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -256,10 +256,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) + { + unsigned long start = vma->vm_start; + unsigned long size = vma->vm_end - vma->vm_start; +- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; ++ unsigned long offset; + unsigned long page, pos; + +- if (offset + size > info->fix.smem_len) ++ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) ++ return -EINVAL; ++ ++ offset = vma->vm_pgoff << PAGE_SHIFT; ++ ++ if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) + return -EINVAL; + + pos = (unsigned long)info->fix.smem_start + offset; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 060e5c6f4446..098e562bd579 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -27,7 +27,6 @@ + + #include "vmwgfx_kms.h" + +- + /* Might need a hrtimer here? */ + #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1) + +@@ -1910,9 +1909,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, + * Helper to be used if an error forces the caller to undo the actions of + * vmw_kms_helper_resource_prepare. + */ +-void vmw_kms_helper_resource_revert(struct vmw_resource *res) ++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx) + { +- vmw_kms_helper_buffer_revert(res->backup); ++ struct vmw_resource *res = ctx->res; ++ ++ vmw_kms_helper_buffer_revert(ctx->buf); ++ vmw_dmabuf_unreference(&ctx->buf); + vmw_resource_unreserve(res, false, NULL, 0); + mutex_unlock(&res->dev_priv->cmdbuf_mutex); + } +@@ -1929,10 +1931,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res) + * interrupted by a signal. + */ + int vmw_kms_helper_resource_prepare(struct vmw_resource *res, +- bool interruptible) ++ bool interruptible, ++ struct vmw_validation_ctx *ctx) + { + int ret = 0; + ++ ctx->buf = NULL; ++ ctx->res = res; ++ + if (interruptible) + ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex); + else +@@ -1951,6 +1957,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, + res->dev_priv->has_mob); + if (ret) + goto out_unreserve; ++ ++ ctx->buf = vmw_dmabuf_reference(res->backup); + } + ret = vmw_resource_validate(res); + if (ret) +@@ -1958,7 +1966,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, + return 0; + + out_revert: +- vmw_kms_helper_buffer_revert(res->backup); ++ vmw_kms_helper_buffer_revert(ctx->buf); + out_unreserve: + vmw_resource_unreserve(res, false, NULL, 0); + out_unlock: +@@ -1974,11 +1982,13 @@ out_unlock: + * @out_fence: Optional pointer to a fence pointer. If non-NULL, a + * ref-counted fence pointer is returned here. + */ +-void vmw_kms_helper_resource_finish(struct vmw_resource *res, +- struct vmw_fence_obj **out_fence) ++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, ++ struct vmw_fence_obj **out_fence) + { +- if (res->backup || out_fence) +- vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup, ++ struct vmw_resource *res = ctx->res; ++ ++ if (ctx->buf || out_fence) ++ vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf, + out_fence, NULL); + + vmw_resource_unreserve(res, false, NULL, 0); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +index edd81503516d..63b05d5ee50a 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +@@ -180,6 +180,11 @@ struct vmw_display_unit { + bool is_implicit; + }; + ++struct vmw_validation_ctx { ++ struct vmw_resource *res; ++ struct vmw_dma_buffer *buf; ++}; ++ + #define vmw_crtc_to_du(x) \ + container_of(x, struct vmw_display_unit, crtc) + #define vmw_connector_to_du(x) \ +@@ -230,9 +235,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, + struct drm_vmw_fence_rep __user * + user_fence_rep); + int vmw_kms_helper_resource_prepare(struct vmw_resource *res, +- bool interruptible); +-void vmw_kms_helper_resource_revert(struct vmw_resource *res); +-void vmw_kms_helper_resource_finish(struct vmw_resource *res, ++ bool interruptible, ++ struct vmw_validation_ctx *ctx); ++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx); ++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, + struct vmw_fence_obj **out_fence); + int vmw_kms_readback(struct vmw_private *dev_priv, + struct drm_file *file_priv, +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +index 13926ff192e3..f50fcd213413 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +@@ -841,12 +841,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, + struct vmw_framebuffer_surface *vfbs = + container_of(framebuffer, typeof(*vfbs), base); + struct vmw_kms_sou_surface_dirty sdirty; ++ struct vmw_validation_ctx ctx; + int ret; + + if (!srf) + srf = &vfbs->surface->res; + +- ret = vmw_kms_helper_resource_prepare(srf, true); ++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); + if (ret) + return ret; + +@@ -865,7 +866,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, + ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips, + dest_x, dest_y, num_clips, inc, + &sdirty.base); +- vmw_kms_helper_resource_finish(srf, out_fence); ++ vmw_kms_helper_resource_finish(&ctx, out_fence); + + return ret; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +index f823fc3efed7..3184a9ae22c1 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +@@ -1003,12 +1003,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, + struct vmw_framebuffer_surface *vfbs = + container_of(framebuffer, typeof(*vfbs), base); + struct vmw_stdu_dirty sdirty; ++ struct vmw_validation_ctx ctx; + int ret; + + if (!srf) + srf = &vfbs->surface->res; + +- ret = vmw_kms_helper_resource_prepare(srf, true); ++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); + if (ret) + return ret; + +@@ -1031,7 +1032,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, + dest_x, dest_y, num_clips, inc, + &sdirty.base); + out_finish: +- vmw_kms_helper_resource_finish(srf, out_fence); ++ vmw_kms_helper_resource_finish(&ctx, out_fence); + + return ret; + } +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 84ab20c6b389..b4136d3bf6b7 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -657,7 +657,7 @@ int st_accel_common_probe(struct iio_dev *indio_dev) + if (!pdata) + pdata = (struct st_sensors_platform_data *)&default_accel_pdata; + +- err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data); ++ err = st_sensors_init_sensor(indio_dev, pdata); + if (err < 0) + return err; + +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index 270eeac928bc..ba282ff3892d 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -469,7 +469,7 @@ int st_press_common_probe(struct iio_dev *indio_dev) + if (!pdata && press_data->sensor_settings->drdy_irq.addr) + pdata = (struct st_sensors_platform_data *)&default_press_pdata; + +- err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data); ++ err = st_sensors_init_sensor(indio_dev, pdata); + if (err < 0) + return err; + +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index fb204ee6ff89..581f5d0271f4 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -619,6 +619,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) + (sizeof(struct idmac_desc_64addr) * + (i + 1))) >> 32; + /* Initialize reserved and buffer size fields to "0" */ ++ p->des0 = 0; + p->des1 = 0; + p->des2 = 0; + p->des3 = 0; +@@ -640,6 +641,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) + i++, p++) { + p->des3 = cpu_to_le32(host->sg_dma + + (sizeof(struct idmac_desc) * (i + 1))); ++ p->des0 = 0; + p->des1 = 0; + } + +@@ -2807,8 +2809,8 @@ static bool dw_mci_reset(struct dw_mci *host) + } + + if (host->use_dma == TRANS_MODE_IDMAC) +- /* It is also recommended that we reset and reprogram idmac */ +- dw_mci_idmac_reset(host); ++ /* It is also required that we reinit idmac */ ++ dw_mci_idmac_init(host); + + ret = true; + +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index 7f4ac8c19001..5e3fa5861039 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -726,6 +726,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) + struct fsl_ifc_ctrl *ctrl = priv->ctrl; + struct fsl_ifc_regs __iomem *ifc = ctrl->regs; + u32 nand_fsr; ++ int status; + + /* Use READ_STATUS command, but wait for the device to be ready */ + ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | +@@ -740,12 +741,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) + fsl_ifc_run_command(mtd); + + nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr); +- ++ status = nand_fsr >> 24; + /* + * The chip always seems to report that it is + * write-protected, even when it is not. + */ +- return nand_fsr | NAND_STATUS_WP; ++ return status | NAND_STATUS_WP; + } + + static int fsl_ifc_read_page(struct mtd_info *mtd, struct nand_chip *chip, +diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c +index 1e37313054f3..6da69af103e6 100644 +--- a/drivers/net/can/cc770/cc770.c ++++ b/drivers/net/can/cc770/cc770.c +@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev, + return 0; + } + +-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static void cc770_tx(struct net_device *dev, int mo) + { + struct cc770_priv *priv = netdev_priv(dev); +- struct net_device_stats *stats = &dev->stats; +- struct can_frame *cf = (struct can_frame *)skb->data; +- unsigned int mo = obj2msgobj(CC770_OBJ_TX); ++ struct can_frame *cf = (struct can_frame *)priv->tx_skb->data; + u8 dlc, rtr; + u32 id; + int i; + +- if (can_dropped_invalid_skb(dev, skb)) +- return NETDEV_TX_OK; +- +- if ((cc770_read_reg(priv, +- msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { +- netdev_err(dev, "TX register is still occupied!\n"); +- return NETDEV_TX_BUSY; +- } +- +- netif_stop_queue(dev); +- + dlc = cf->can_dlc; + id = cf->can_id; +- if (cf->can_id & CAN_RTR_FLAG) +- rtr = 0; +- else +- rtr = MSGCFG_DIR; ++ rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR; ++ ++ cc770_write_reg(priv, msgobj[mo].ctrl0, ++ MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); + cc770_write_reg(priv, msgobj[mo].ctrl1, + RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES); +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES); ++ + if (id & CAN_EFF_FLAG) { + id &= CAN_EFF_MASK; + cc770_write_reg(priv, msgobj[mo].config, +@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) + for (i = 0; i < dlc; i++) + cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]); + +- /* Store echo skb before starting the transfer */ +- can_put_echo_skb(skb, dev, 0); +- + cc770_write_reg(priv, msgobj[mo].ctrl1, +- RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); ++ RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); ++ cc770_write_reg(priv, msgobj[mo].ctrl0, ++ MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC); ++} + +- stats->tx_bytes += dlc; ++static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ struct cc770_priv *priv = netdev_priv(dev); ++ unsigned int mo = obj2msgobj(CC770_OBJ_TX); + ++ if (can_dropped_invalid_skb(dev, skb)) ++ return NETDEV_TX_OK; + +- /* +- * HM: We had some cases of repeated IRQs so make sure the +- * INT is acknowledged I know it's already further up, but +- * doing again fixed the issue +- */ +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); ++ netif_stop_queue(dev); ++ ++ if ((cc770_read_reg(priv, ++ msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { ++ netdev_err(dev, "TX register is still occupied!\n"); ++ return NETDEV_TX_BUSY; ++ } ++ ++ priv->tx_skb = skb; ++ cc770_tx(dev, mo); + + return NETDEV_TX_OK; + } +@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o) + struct cc770_priv *priv = netdev_priv(dev); + struct net_device_stats *stats = &dev->stats; + unsigned int mo = obj2msgobj(o); ++ struct can_frame *cf; ++ u8 ctrl1; ++ ++ ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1); + +- /* Nothing more to send, switch off interrupts */ + cc770_write_reg(priv, msgobj[mo].ctrl0, + MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); +- /* +- * We had some cases of repeated IRQ so make sure the +- * INT is acknowledged ++ cc770_write_reg(priv, msgobj[mo].ctrl1, ++ RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES); ++ ++ if (unlikely(!priv->tx_skb)) { ++ netdev_err(dev, "missing tx skb in tx interrupt\n"); ++ return; ++ } ++ ++ if (unlikely(ctrl1 & MSGLST_SET)) { ++ stats->rx_over_errors++; ++ stats->rx_errors++; ++ } ++ ++ /* When the CC770 is sending an RTR message and it receives a regular ++ * message that matches the id of the RTR message, it will overwrite the ++ * outgoing message in the TX register. When this happens we must ++ * process the received message and try to transmit the outgoing skb ++ * again. + */ +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); ++ if (unlikely(ctrl1 & NEWDAT_SET)) { ++ cc770_rx(dev, mo, ctrl1); ++ cc770_tx(dev, mo); ++ return; ++ } + ++ cf = (struct can_frame *)priv->tx_skb->data; ++ stats->tx_bytes += cf->can_dlc; + stats->tx_packets++; ++ ++ can_put_echo_skb(priv->tx_skb, dev, 0); + can_get_echo_skb(dev, 0); ++ priv->tx_skb = NULL; ++ + netif_wake_queue(dev); + } + +@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv) + priv->can.do_set_bittiming = cc770_set_bittiming; + priv->can.do_set_mode = cc770_set_mode; + priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES; ++ priv->tx_skb = NULL; + + memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags)); + +diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h +index a1739db98d91..95752e1d1283 100644 +--- a/drivers/net/can/cc770/cc770.h ++++ b/drivers/net/can/cc770/cc770.h +@@ -193,6 +193,8 @@ struct cc770_priv { + u8 cpu_interface; /* CPU interface register */ + u8 clkout; /* Clock out register */ + u8 bus_config; /* Bus conffiguration register */ ++ ++ struct sk_buff *tx_skb; + }; + + struct net_device *alloc_cc770dev(int sizeof_priv); +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c +index d224b3dd72ed..3196245ab820 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c +@@ -461,25 +461,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac) + * @dev_addr: optional device address. + * + * P2P needs mac addresses for P2P device and interface. If no device +- * address it specified, these are derived from the primary net device, ie. +- * the permanent ethernet address of the device. ++ * address it specified, these are derived from a random ethernet ++ * address. + */ + static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr) + { +- struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp; +- bool local_admin = false; ++ bool random_addr = false; + +- if (!dev_addr || is_zero_ether_addr(dev_addr)) { +- dev_addr = pri_ifp->mac_addr; +- local_admin = true; +- } ++ if (!dev_addr || is_zero_ether_addr(dev_addr)) ++ random_addr = true; + +- /* Generate the P2P Device Address. This consists of the device's +- * primary MAC address with the locally administered bit set. ++ /* Generate the P2P Device Address obtaining a random ethernet ++ * address with the locally administered bit set. + */ +- memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); +- if (local_admin) +- p2p->dev_addr[0] |= 0x02; ++ if (random_addr) ++ eth_random_addr(p2p->dev_addr); ++ else ++ memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); + + /* Generate the P2P Interface Address. If the discovery and connection + * BSSCFGs need to simultaneously co-exist, then this address must be +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 5a3df9198ddf..89515f02c353 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -1123,7 +1123,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw) + + /* Configuration Space offset 0x70f BIT7 is used to control L0S */ + tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f); +- _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7)); ++ _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) | ++ ASPM_L1_LATENCY << 3); + + /* Configuration Space offset 0x719 Bit3 is for L1 + * BIT4 is for clock request +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 254192b5dad1..4eb1cf0ed00c 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3631,6 +3631,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230, + quirk_dma_func1_alias); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642, + quirk_dma_func1_alias); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645, ++ quirk_dma_func1_alias); + /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON, + PCI_DEVICE_ID_JMICRON_JMB388_ESD, +diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec.c b/drivers/staging/lustre/lustre/ptlrpc/sec.c +index 39f5261c9854..5cf5b7334089 100644 +--- a/drivers/staging/lustre/lustre/ptlrpc/sec.c ++++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c +@@ -824,7 +824,7 @@ void sptlrpc_request_out_callback(struct ptlrpc_request *req) + if (req->rq_pool || !req->rq_reqbuf) + return; + +- kfree(req->rq_reqbuf); ++ kvfree(req->rq_reqbuf); + req->rq_reqbuf = NULL; + req->rq_reqbuf_len = 0; + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index e4f69bddcfb1..251315c35747 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1725,7 +1725,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear) + default_attr(vc); + update_attr(vc); + +- vc->vc_tab_stop[0] = 0x01010100; ++ vc->vc_tab_stop[0] = + vc->vc_tab_stop[1] = + vc->vc_tab_stop[2] = + vc->vc_tab_stop[3] = +@@ -1769,7 +1769,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + vc->vc_pos -= (vc->vc_x << 1); + while (vc->vc_x < vc->vc_cols - 1) { + vc->vc_x++; +- if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) ++ if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31))) + break; + } + vc->vc_pos += (vc->vc_x << 1); +@@ -1829,7 +1829,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + lf(vc); + return; + case 'H': +- vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31)); ++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31)); + return; + case 'Z': + respond_ID(tty); +@@ -2022,7 +2022,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + return; + case 'g': + if (!vc->vc_par[0]) +- vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31)); ++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31)); + else if (vc->vc_par[0] == 3) { + vc->vc_tab_stop[0] = + vc->vc_tab_stop[1] = +diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c +index 88dbbc9fcf4d..f571570a2e72 100644 +--- a/fs/ncpfs/ncplib_kernel.c ++++ b/fs/ncpfs/ncplib_kernel.c +@@ -980,6 +980,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id, + goto out; + } + *bytes_read = ncp_reply_be16(server, 0); ++ if (*bytes_read > to_read) { ++ result = -EINVAL; ++ goto out; ++ } + source = ncp_reply_data(server, 2 + (offset & 1)); + + memcpy(target, source, *bytes_read); +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 14b0ff32fb9f..4814cf971048 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -755,6 +755,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot); + int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot); + int pud_clear_huge(pud_t *pud); + int pmd_clear_huge(pmd_t *pmd); ++int pud_free_pmd_page(pud_t *pud); ++int pmd_free_pte_page(pmd_t *pmd); + #else /* !CONFIG_HAVE_ARCH_HUGE_VMAP */ + static inline int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot) + { +@@ -772,6 +774,14 @@ static inline int pmd_clear_huge(pmd_t *pmd) + { + return 0; + } ++static inline int pud_free_pmd_page(pud_t *pud) ++{ ++ return 0; ++} ++static inline int pmd_free_pte_page(pmd_t *pmd) ++{ ++ return 0; ++} + #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ + + #endif /* !__ASSEMBLY__ */ +diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h +index d2314be4f0c0..19f9dc2c06f6 100644 +--- a/include/uapi/linux/usb/audio.h ++++ b/include/uapi/linux/usb/audio.h +@@ -369,7 +369,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d + { + return (protocol == UAC_VERSION_1) ? + desc->baSourceID[desc->bNrInPins + 4] : +- desc->baSourceID[desc->bNrInPins + 6]; ++ 2; /* in UAC2, this value is constant */ + } + + static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc, +@@ -377,7 +377,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de + { + return (protocol == UAC_VERSION_1) ? + &desc->baSourceID[desc->bNrInPins + 5] : +- &desc->baSourceID[desc->bNrInPins + 7]; ++ &desc->baSourceID[desc->bNrInPins + 6]; + } + + static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc, +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 424accd20c2d..dc19b6e210e6 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -673,7 +673,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz + union bpf_attr attr = {}; + int err; + +- if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled) ++ if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + if (!access_ok(VERIFY_READ, uattr, 1)) +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index e9092a0247bf..f2682799c215 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -599,7 +599,7 @@ static int create_trace_kprobe(int argc, char **argv) + bool is_return = false, is_delete = false; + char *symbol = NULL, *event = NULL, *group = NULL; + char *arg; +- unsigned long offset = 0; ++ long offset = 0; + void *addr = NULL; + char buf[MAX_EVENT_NAME_LEN]; + +@@ -667,7 +667,7 @@ static int create_trace_kprobe(int argc, char **argv) + symbol = argv[1]; + /* TODO: support .init module functions */ + ret = traceprobe_split_symbol_offset(symbol, &offset); +- if (ret) { ++ if (ret || offset < 0 || offset > UINT_MAX) { + pr_info("Failed to parse either an address or a symbol.\n"); + return ret; + } +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 1769a81da8a7..741c00b90fdc 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -293,7 +293,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type, + } + + /* Split symbol and offset. */ +-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) ++int traceprobe_split_symbol_offset(char *symbol, long *offset) + { + char *tmp; + int ret; +@@ -301,13 +301,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) + if (!offset) + return -EINVAL; + +- tmp = strchr(symbol, '+'); ++ tmp = strpbrk(symbol, "+-"); + if (tmp) { +- /* skip sign because kstrtoul doesn't accept '+' */ +- ret = kstrtoul(tmp + 1, 0, offset); ++ ret = kstrtol(tmp, 0, offset); + if (ret) + return ret; +- + *tmp = '\0'; + } else + *offset = 0; +diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h +index f6398db09114..0afe921df8c8 100644 +--- a/kernel/trace/trace_probe.h ++++ b/kernel/trace/trace_probe.h +@@ -335,7 +335,7 @@ extern int traceprobe_conflict_field_name(const char *name, + extern void traceprobe_update_arg(struct probe_arg *arg); + extern void traceprobe_free_probe_arg(struct probe_arg *arg); + +-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset); ++extern int traceprobe_split_symbol_offset(char *symbol, long *offset); + + extern ssize_t traceprobe_probes_write(struct file *file, + const char __user *buffer, size_t count, loff_t *ppos, +diff --git a/lib/ioremap.c b/lib/ioremap.c +index 86c8911b0e3a..5323b59ca393 100644 +--- a/lib/ioremap.c ++++ b/lib/ioremap.c +@@ -83,7 +83,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr, + + if (ioremap_pmd_enabled() && + ((next - addr) == PMD_SIZE) && +- IS_ALIGNED(phys_addr + addr, PMD_SIZE)) { ++ IS_ALIGNED(phys_addr + addr, PMD_SIZE) && ++ pmd_free_pte_page(pmd)) { + if (pmd_set_huge(pmd, phys_addr + addr, prot)) + continue; + } +@@ -109,7 +110,8 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr, + + if (ioremap_pud_enabled() && + ((next - addr) == PUD_SIZE) && +- IS_ALIGNED(phys_addr + addr, PUD_SIZE)) { ++ IS_ALIGNED(phys_addr + addr, PUD_SIZE) && ++ pud_free_pmd_page(pud)) { + if (pud_set_huge(pud, phys_addr + addr, prot)) + continue; + } +diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c +index cbd20cb8ca11..dc91002d1e0d 100644 +--- a/sound/drivers/aloop.c ++++ b/sound/drivers/aloop.c +@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm) + dpcm->timer.expires = 0; + } + ++static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm) ++{ ++ del_timer_sync(&dpcm->timer); ++} ++ + #define CABLE_VALID_PLAYBACK (1 << SNDRV_PCM_STREAM_PLAYBACK) + #define CABLE_VALID_CAPTURE (1 << SNDRV_PCM_STREAM_CAPTURE) + #define CABLE_VALID_BOTH (CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE) +@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream) + struct loopback_cable *cable = dpcm->cable; + int bps, salign; + ++ loopback_timer_stop_sync(dpcm); ++ + salign = (snd_pcm_format_width(runtime->format) * + runtime->channels) / 8; + bps = salign * runtime->rate; +@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream) + return; + if (cable->streams[!substream->stream]) { + /* other stream is still alive */ ++ spin_lock_irq(&cable->lock); + cable->streams[substream->stream] = NULL; ++ spin_unlock_irq(&cable->lock); + } else { + /* free the cable */ + loopback->cables[substream->number][dev] = NULL; +@@ -699,7 +708,6 @@ static int loopback_open(struct snd_pcm_substream *substream) + loopback->cables[substream->number][dev] = cable; + } + dpcm->cable = cable; +- cable->streams[substream->stream] = dpcm; + + snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); + +@@ -731,6 +739,11 @@ static int loopback_open(struct snd_pcm_substream *substream) + runtime->hw = loopback_pcm_hardware; + else + runtime->hw = cable->hw; ++ ++ spin_lock_irq(&cable->lock); ++ cable->streams[substream->stream] = dpcm; ++ spin_unlock_irq(&cable->lock); ++ + unlock: + if (err < 0) { + free_cable(substream); +@@ -745,7 +758,7 @@ static int loopback_close(struct snd_pcm_substream *substream) + struct loopback *loopback = substream->private_data; + struct loopback_pcm *dpcm = substream->runtime->private_data; + +- loopback_timer_stop(dpcm); ++ loopback_timer_stop_sync(dpcm); + mutex_lock(&loopback->cable_lock); + free_cable(substream); + mutex_unlock(&loopback->cable_lock); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 8e33360ae2e5..8cb14e27988b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3261,8 +3261,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled) + pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid); + pinval &= ~AC_PINCTL_VREFEN; + pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80; +- if (spec->mute_led_nid) ++ if (spec->mute_led_nid) { ++ /* temporarily power up/down for setting VREF */ ++ snd_hda_power_up_pm(codec); + snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval); ++ snd_hda_power_down_pm(codec); ++ } + } + + /* Make sure the led works even in runtime suspend */ diff --git a/patch/kernel/mvebu-default/04-patch-4.4.125-126.patch b/patch/kernel/mvebu-default/04-patch-4.4.125-126.patch new file mode 100644 index 000000000..caede2fee --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.125-126.patch @@ -0,0 +1,455 @@ +diff --git a/Makefile b/Makefile +index 7dcafa5dcd34..2b699c5f6de4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 125 ++SUBLEVEL = 126 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c +index c31c7407b753..425dae560322 100644 +--- a/drivers/net/ethernet/arc/emac_rockchip.c ++++ b/drivers/net/ethernet/arc/emac_rockchip.c +@@ -150,8 +150,10 @@ static int emac_rockchip_probe(struct platform_device *pdev) + /* Optional regulator for PHY */ + priv->regulator = devm_regulator_get_optional(dev, "phy"); + if (IS_ERR(priv->regulator)) { +- if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) { ++ err = -EPROBE_DEFER; ++ goto out_clk_disable; ++ } + dev_err(dev, "no regulator found\n"); + priv->regulator = NULL; + } +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 027705117086..af9ec57bbebf 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -729,37 +729,33 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, + struct bcm_sysport_tx_ring *ring) + { + struct net_device *ndev = priv->netdev; +- unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs; + unsigned int pkts_compl = 0, bytes_compl = 0; ++ unsigned int txbds_processed = 0; + struct bcm_sysport_cb *cb; ++ unsigned int txbds_ready; ++ unsigned int c_index; + u32 hw_ind; + + /* Compute how many descriptors have been processed since last call */ + hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index)); + c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK; +- ring->p_index = (hw_ind & RING_PROD_INDEX_MASK); +- +- last_c_index = ring->c_index; +- num_tx_cbs = ring->size; +- +- c_index &= (num_tx_cbs - 1); +- +- if (c_index >= last_c_index) +- last_tx_cn = c_index - last_c_index; +- else +- last_tx_cn = num_tx_cbs - last_c_index + c_index; ++ txbds_ready = (c_index - ring->c_index) & RING_CONS_INDEX_MASK; + + netif_dbg(priv, tx_done, ndev, +- "ring=%d c_index=%d last_tx_cn=%d last_c_index=%d\n", +- ring->index, c_index, last_tx_cn, last_c_index); ++ "ring=%d old_c_index=%u c_index=%u txbds_ready=%u\n", ++ ring->index, ring->c_index, c_index, txbds_ready); + +- while (last_tx_cn-- > 0) { +- cb = ring->cbs + last_c_index; ++ while (txbds_processed < txbds_ready) { ++ cb = &ring->cbs[ring->clean_index]; + bcm_sysport_tx_reclaim_one(priv, cb, &bytes_compl, &pkts_compl); + + ring->desc_count++; +- last_c_index++; +- last_c_index &= (num_tx_cbs - 1); ++ txbds_processed++; ++ ++ if (likely(ring->clean_index < ring->size - 1)) ++ ring->clean_index++; ++ else ++ ring->clean_index = 0; + } + + ring->c_index = c_index; +@@ -1229,6 +1225,7 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv, + netif_napi_add(priv->netdev, &ring->napi, bcm_sysport_tx_poll, 64); + ring->index = index; + ring->size = size; ++ ring->clean_index = 0; + ring->alloc_size = ring->size; + ring->desc_cpu = p; + ring->desc_count = ring->size; +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h +index f28bf545d7f4..8ace6ecb5f79 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.h ++++ b/drivers/net/ethernet/broadcom/bcmsysport.h +@@ -638,7 +638,7 @@ struct bcm_sysport_tx_ring { + unsigned int desc_count; /* Number of descriptors */ + unsigned int curr_desc; /* Current descriptor */ + unsigned int c_index; /* Last consumer index */ +- unsigned int p_index; /* Current producer index */ ++ unsigned int clean_index; /* Current clean index */ + struct bcm_sysport_cb *cbs; /* Transmit control blocks */ + struct dma_desc *desc_cpu; /* CPU view of the descriptor */ + struct bcm_sysport_priv *priv; /* private context backpointer */ +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 458e2d97d096..ae8e4fc22e7b 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3539,6 +3539,8 @@ fec_drv_remove(struct platform_device *pdev) + fec_enet_mii_remove(fep); + if (fep->reg_phy) + regulator_disable(fep->reg_phy); ++ pm_runtime_put(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); + of_node_put(fep->phy_node); + free_netdev(ndev); + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index fc958067d10a..435466c17852 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -878,7 +878,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave, + /* set speed_in input in case RMII mode is used in 100Mbps */ + if (phy->speed == 100) + mac_control |= BIT(15); +- else if (phy->speed == 10) ++ /* in band mode only works in 10Mbps RGMII mode */ ++ else if ((phy->speed == 10) && phy_interface_is_rgmii(phy)) + mac_control |= BIT(18); /* In Band mode */ + + if (priv->rx_pause) +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 61cd53838360..9bca36e1fefd 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2380,7 +2380,7 @@ send_done: + if (!nlh) { + err = __send_and_alloc_skb(&skb, team, portid, send_func); + if (err) +- goto errout; ++ return err; + goto send_done; + } + +@@ -2660,7 +2660,7 @@ send_done: + if (!nlh) { + err = __send_and_alloc_skb(&skb, team, portid, send_func); + if (err) +- goto errout; ++ return err; + goto send_done; + } + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 75d37148c8cd..95c631125a20 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -517,8 +517,7 @@ static inline int qeth_is_cq(struct qeth_card *card, unsigned int queue) + queue == card->qdio.no_in_queues - 1; + } + +- +-static int qeth_issue_next_read(struct qeth_card *card) ++static int __qeth_issue_next_read(struct qeth_card *card) + { + int rc; + struct qeth_cmd_buffer *iob; +@@ -549,6 +548,17 @@ static int qeth_issue_next_read(struct qeth_card *card) + return rc; + } + ++static int qeth_issue_next_read(struct qeth_card *card) ++{ ++ int ret; ++ ++ spin_lock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ ret = __qeth_issue_next_read(card); ++ spin_unlock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ ++ return ret; ++} ++ + static struct qeth_reply *qeth_alloc_reply(struct qeth_card *card) + { + struct qeth_reply *reply; +@@ -952,7 +962,7 @@ void qeth_clear_thread_running_bit(struct qeth_card *card, unsigned long thread) + spin_lock_irqsave(&card->thread_mask_lock, flags); + card->thread_running_mask &= ~thread; + spin_unlock_irqrestore(&card->thread_mask_lock, flags); +- wake_up(&card->wait_q); ++ wake_up_all(&card->wait_q); + } + EXPORT_SYMBOL_GPL(qeth_clear_thread_running_bit); + +@@ -1156,6 +1166,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + } + rc = qeth_get_problem(cdev, irb); + if (rc) { ++ card->read_or_write_problem = 1; + qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + goto out; +@@ -1174,7 +1185,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + return; + if (channel == &card->read && + channel->state == CH_STATE_UP) +- qeth_issue_next_read(card); ++ __qeth_issue_next_read(card); + + iob = channel->iob; + index = channel->buf_no; +@@ -4969,8 +4980,6 @@ static void qeth_core_free_card(struct qeth_card *card) + QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *)); + qeth_clean_channel(&card->read); + qeth_clean_channel(&card->write); +- if (card->dev) +- free_netdev(card->dev); + kfree(card->ip_tbd_list); + qeth_free_qdio_buffers(card); + unregister_service_level(&card->qeth_service_level); +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 58bcb3c9a86a..acdb5ccb0ab9 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1062,8 +1062,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) + qeth_l2_set_offline(cgdev); + + if (card->dev) { +- netif_napi_del(&card->napi); + unregister_netdev(card->dev); ++ free_netdev(card->dev); + card->dev = NULL; + } + return; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 0d6888cbd96e..bbdb3b6c54bb 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3243,8 +3243,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) + qeth_l3_set_offline(cgdev); + + if (card->dev) { +- netif_napi_del(&card->napi); + unregister_netdev(card->dev); ++ free_netdev(card->dev); + card->dev = NULL; + } + +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 4b43effbf4fc..cb19c9ad1b57 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id) + if ((1 == resp->done) && (!resp->sg_io_owned) && + ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { + resp->done = 2; /* guard against other readers */ +- break; ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); ++ return resp; + } + } + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); +- return resp; ++ return NULL; + } + + /* always adds to end of list */ +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 4889a8ab77ce..a079ed14f230 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1189,10 +1189,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) + * set the trigger type must match. Also all must + * agree on ONESHOT. + */ +- unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data); +- + if (!((old->flags & new->flags) & IRQF_SHARED) || +- (oldtype != (new->flags & IRQF_TRIGGER_MASK)) || ++ ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK) || + ((old->flags ^ new->flags) & IRQF_ONESHOT)) + goto mismatch; + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 86b619501350..284370b61b8c 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3571,7 +3571,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb) + + skb_queue_tail(&sk->sk_error_queue, skb); + if (!sock_flag(sk, SOCK_DEAD)) +- sk->sk_data_ready(sk); ++ sk->sk_error_report(sk); + return 0; + } + EXPORT_SYMBOL(sock_queue_err_skb); +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index 9d43c1f40274..ff3b058cf58c 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -789,6 +789,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_release; + ++ if (sk->sk_state == DCCP_CLOSED) { ++ rc = -ENOTCONN; ++ goto out_discard; ++ } ++ + skb_reserve(skb, sk->sk_prot->max_header); + rc = memcpy_from_msg(skb_put(skb, len), msg, len); + if (rc != 0) +diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c +index 20c49c724ba0..e8b279443d37 100644 +--- a/net/ieee802154/6lowpan/core.c ++++ b/net/ieee802154/6lowpan/core.c +@@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void) + static int lowpan_device_event(struct notifier_block *unused, + unsigned long event, void *ptr) + { +- struct net_device *wdev = netdev_notifier_info_to_dev(ptr); ++ struct net_device *ndev = netdev_notifier_info_to_dev(ptr); ++ struct wpan_dev *wpan_dev; + +- if (wdev->type != ARPHRD_IEEE802154) ++ if (ndev->type != ARPHRD_IEEE802154) ++ return NOTIFY_DONE; ++ wpan_dev = ndev->ieee802154_ptr; ++ if (!wpan_dev) + goto out; + + switch (event) { +@@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused, + * also delete possible lowpan interfaces which belongs + * to the wpan interface. + */ +- if (wdev->ieee802154_ptr->lowpan_dev) +- lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL); ++ if (wpan_dev->lowpan_dev) ++ lowpan_dellink(wpan_dev->lowpan_dev, NULL); + break; + default: + break; +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index c5fb2f694ed0..b34fa1bb278f 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -119,6 +119,9 @@ out: + + static bool inet_fragq_should_evict(const struct inet_frag_queue *q) + { ++ if (!hlist_unhashed(&q->list_evictor)) ++ return false; ++ + return q->net->low_thresh == 0 || + frag_mem_limit(q->net) >= q->net->low_thresh; + } +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index d35509212013..1b93ea766916 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -241,7 +241,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc, + src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg); + if (!ipv6_addr_v4mapped(&src_info->ipi6_addr)) + return -EINVAL; +- ipc->oif = src_info->ipi6_ifindex; ++ if (src_info->ipi6_ifindex) ++ ipc->oif = src_info->ipi6_ifindex; + ipc->addr = src_info->ipi6_addr.s6_addr32[3]; + continue; + } +@@ -264,7 +265,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc, + if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) + return -EINVAL; + info = (struct in_pktinfo *)CMSG_DATA(cmsg); +- ipc->oif = info->ipi_ifindex; ++ if (info->ipi_ifindex) ++ ipc->oif = info->ipi_ifindex; + ipc->addr = info->ipi_spec_dst.s_addr; + break; + } +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 55810e4899f1..3db8d7d1a986 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1478,7 +1478,8 @@ static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb, + *(opt++) = (rd_len >> 3); + opt += 6; + +- memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8); ++ skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt, ++ rd_len - 8); + } + + void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 20ab7b2ec463..aeffb65181f5 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -2381,9 +2381,11 @@ static int afiucv_iucv_init(void) + af_iucv_dev->driver = &af_iucv_driver; + err = device_register(af_iucv_dev); + if (err) +- goto out_driver; ++ goto out_iucv_dev; + return 0; + ++out_iucv_dev: ++ put_device(af_iucv_dev); + out_driver: + driver_unregister(&af_iucv_driver); + out_iucv: +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index ec8f6a6485e3..92df832a1896 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1518,9 +1518,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + encap = cfg->encap; + + /* Quick sanity checks */ ++ err = -EPROTONOSUPPORT; ++ if (sk->sk_type != SOCK_DGRAM) { ++ pr_debug("tunl %hu: fd %d wrong socket type\n", ++ tunnel_id, fd); ++ goto err; ++ } + switch (encap) { + case L2TP_ENCAPTYPE_UDP: +- err = -EPROTONOSUPPORT; + if (sk->sk_protocol != IPPROTO_UDP) { + pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", + tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP); +@@ -1528,7 +1533,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + } + break; + case L2TP_ENCAPTYPE_IP: +- err = -EPROTONOSUPPORT; + if (sk->sk_protocol != IPPROTO_L2TP) { + pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", + tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP); +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 30c46aaf4575..d681dbaf00c1 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1143,7 +1143,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + if (!err) + delivered = true; + else if (err != -ESRCH) +- goto error; ++ return err; + return delivered ? 0 : -ESRCH; + error: + kfree_skb(skb); diff --git a/patch/kernel/mvebu-default/04-patch-4.4.126-127.patch b/patch/kernel/mvebu-default/04-patch-4.4.126-127.patch new file mode 100644 index 000000000..8cd3c432e --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.126-127.patch @@ -0,0 +1,2344 @@ +diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-palmas.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-palmas.txt +index caf297bee1fb..c28d4eb83b76 100644 +--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-palmas.txt ++++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-palmas.txt +@@ -35,6 +35,15 @@ Optional properties: + - ti,palmas-enable-dvfs2: Enable DVFS2. Configure pins for DVFS2 mode. + Selection primary or secondary function associated to GPADC_START + and SYSEN2 pin/pad for DVFS2 interface ++- ti,palmas-override-powerhold: This is applicable for PMICs for which ++ GPIO7 is configured in POWERHOLD mode which has higher priority ++ over DEV_ON bit and keeps the PMIC supplies on even after the DEV_ON ++ bit is turned off. This property enables driver to over ride the ++ POWERHOLD value to GPIO7 so as to turn off the PMIC in power off ++ scenarios. So for GPIO7 if ti,palmas-override-powerhold is set ++ then the GPIO_7 field should never be muxed to anything else. ++ It should be set to POWERHOLD by default and only in case of ++ power off scenarios the driver will over ride the mux value. + + This binding uses the following generic properties as defined in + pinctrl-bindings.txt: +diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt +index 6716413c17ba..6d2689ebf824 100644 +--- a/Documentation/filesystems/proc.txt ++++ b/Documentation/filesystems/proc.txt +@@ -383,32 +383,6 @@ is not associated with a file: + + or if empty, the mapping is anonymous. + +-The /proc/PID/task/TID/maps is a view of the virtual memory from the viewpoint +-of the individual tasks of a process. In this file you will see a mapping marked +-as [stack] if that task sees it as a stack. Hence, for the example above, the +-task-level map, i.e. /proc/PID/task/TID/maps for thread 1001 will look like this: +- +-08048000-08049000 r-xp 00000000 03:00 8312 /opt/test +-08049000-0804a000 rw-p 00001000 03:00 8312 /opt/test +-0804a000-0806b000 rw-p 00000000 00:00 0 [heap] +-a7cb1000-a7cb2000 ---p 00000000 00:00 0 +-a7cb2000-a7eb2000 rw-p 00000000 00:00 0 +-a7eb2000-a7eb3000 ---p 00000000 00:00 0 +-a7eb3000-a7ed5000 rw-p 00000000 00:00 0 [stack] +-a7ed5000-a8008000 r-xp 00000000 03:00 4222 /lib/libc.so.6 +-a8008000-a800a000 r--p 00133000 03:00 4222 /lib/libc.so.6 +-a800a000-a800b000 rw-p 00135000 03:00 4222 /lib/libc.so.6 +-a800b000-a800e000 rw-p 00000000 00:00 0 +-a800e000-a8022000 r-xp 00000000 03:00 14462 /lib/libpthread.so.0 +-a8022000-a8023000 r--p 00013000 03:00 14462 /lib/libpthread.so.0 +-a8023000-a8024000 rw-p 00014000 03:00 14462 /lib/libpthread.so.0 +-a8024000-a8027000 rw-p 00000000 00:00 0 +-a8027000-a8043000 r-xp 00000000 03:00 8317 /lib/ld-linux.so.2 +-a8043000-a8044000 r--p 0001b000 03:00 8317 /lib/ld-linux.so.2 +-a8044000-a8045000 rw-p 0001c000 03:00 8317 /lib/ld-linux.so.2 +-aff35000-aff4a000 rw-p 00000000 00:00 0 +-ffffe000-fffff000 r-xp 00000000 00:00 0 [vdso] +- + The /proc/PID/smaps is an extension based on maps, showing the memory + consumption for each of the process's mappings. For each of mappings there + is a series of lines such as the following: +diff --git a/Makefile b/Makefile +index 2b699c5f6de4..58c0390573c1 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 126 ++SUBLEVEL = 127 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 2dbe13a3d89b..7106114c7464 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts +index 00352e761b8c..5c3bd34af9fd 100644 +--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts ++++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts +@@ -411,6 +411,7 @@ + interrupt-controller; + + ti,system-power-controller; ++ ti,palmas-override-powerhold; + + tps659038_pmic { + compatible = "ti,tps659038-pmic"; +diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts +index 864f60020124..0736d04f032e 100644 +--- a/arch/arm/boot/dts/dra7-evm.dts ++++ b/arch/arm/boot/dts/dra7-evm.dts +@@ -410,6 +410,8 @@ + tps659038: tps659038@58 { + compatible = "ti,tps659038"; + reg = <0x58>; ++ ti,palmas-override-powerhold; ++ ti,system-power-controller; + + tps659038_pmic { + compatible = "ti,tps659038-pmic"; +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 731860314ab5..27cd4abfc74d 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -488,7 +488,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -505,7 +505,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h +index 853953cd1f08..b42b930cc19a 100644 +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -49,8 +49,10 @@ + * and PAGE_OFFSET - it must be within 128MB of the kernel text. + */ + #define VA_BITS (CONFIG_ARM64_VA_BITS) +-#define VA_START (UL(0xffffffffffffffff) << VA_BITS) +-#define PAGE_OFFSET (UL(0xffffffffffffffff) << (VA_BITS - 1)) ++#define VA_START (UL(0xffffffffffffffff) - \ ++ (UL(1) << VA_BITS) + 1) ++#define PAGE_OFFSET (UL(0xffffffffffffffff) - \ ++ (UL(1) << (VA_BITS - 1)) + 1) + #define MODULES_END (PAGE_OFFSET) + #define MODULES_VADDR (MODULES_END - SZ_64M) + #define PCI_IO_END (MODULES_VADDR - SZ_2M) +diff --git a/arch/frv/include/asm/timex.h b/arch/frv/include/asm/timex.h +index a89bddefdacf..139093fab326 100644 +--- a/arch/frv/include/asm/timex.h ++++ b/arch/frv/include/asm/timex.h +@@ -16,5 +16,11 @@ static inline cycles_t get_cycles(void) + #define vxtime_lock() do {} while (0) + #define vxtime_unlock() do {} while (0) + ++/* This attribute is used in include/linux/jiffies.h alongside with ++ * __cacheline_aligned_in_smp. It is assumed that __cacheline_aligned_in_smp ++ * for frv does not contain another section specification. ++ */ ++#define __jiffy_arch_data __attribute__((__section__(".data"))) ++ + #endif + +diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c +index 8648158f3916..f8fe11d24cde 100644 +--- a/arch/x86/crypto/cast5_avx_glue.c ++++ b/arch/x86/crypto/cast5_avx_glue.c +@@ -66,8 +66,6 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + void (*fn)(struct cast5_ctx *ctx, u8 *dst, const u8 *src); + int err; + +- fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; +- + err = blkcipher_walk_virt(desc, walk); + desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; + +@@ -79,6 +77,7 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + + /* Process multi-block batch */ + if (nbytes >= bsize * CAST5_PARALLEL_BLOCKS) { ++ fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; + do { + fn(ctx, wdst, wsrc); + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 565e24e9ddf2..df9be5b91270 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -402,6 +403,14 @@ int __copy_instruction(u8 *dest, u8 *src) + return length; + } + ++/* Recover page to RW mode before releasing it */ ++void free_insn_page(void *page) ++{ ++ set_memory_nx((unsigned long)page & PAGE_MASK, 1); ++ set_memory_rw((unsigned long)page & PAGE_MASK, 1); ++ module_memfree(page); ++} ++ + static int arch_copy_kprobe(struct kprobe *p) + { + int ret; +diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c +index 5610cd537da7..7d8d50c11ce7 100644 +--- a/block/partitions/msdos.c ++++ b/block/partitions/msdos.c +@@ -300,7 +300,9 @@ static void parse_bsd(struct parsed_partitions *state, + continue; + bsd_start = le32_to_cpu(p->p_offset); + bsd_size = le32_to_cpu(p->p_size); +- if (memcmp(flavour, "bsd\0", 4) == 0) ++ /* FreeBSD has relative offset if C partition offset is zero */ ++ if (memcmp(flavour, "bsd\0", 4) == 0 && ++ le32_to_cpu(l->d_partitions[2].p_offset) == 0) + bsd_start += offset; + if (offset == bsd_start && size == bsd_size) + /* full parent partition, we have it already */ +diff --git a/crypto/ahash.c b/crypto/ahash.c +index 7006dbfd39bd..6978ad86e516 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -91,13 +91,14 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) + + if (nbytes && walk->offset & alignmask && !err) { + walk->offset = ALIGN(walk->offset, alignmask + 1); +- walk->data += walk->offset; +- + nbytes = min(nbytes, + ((unsigned int)(PAGE_SIZE)) - walk->offset); + walk->entrylen -= nbytes; + +- return nbytes; ++ if (nbytes) { ++ walk->data += walk->offset; ++ return nbytes; ++ } + } + + if (walk->flags & CRYPTO_ALG_ASYNC) +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c +index 8a10a7ae6a8a..c8e169e46673 100644 +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -131,9 +131,6 @@ static void do_prt_fixups(struct acpi_prt_entry *entry, + quirk = &prt_quirks[i]; + + /* All current quirks involve link devices, not GSIs */ +- if (!prt->source) +- continue; +- + if (dmi_check_system(quirk->system) && + entry->id.segment == quirk->segment && + entry->id.bus == quirk->bus && +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 9ba89315dae1..55d3d1da72de 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -169,25 +169,6 @@ static bool mtip_check_surprise_removal(struct pci_dev *pdev) + return false; /* device present */ + } + +-/* we have to use runtime tag to setup command header */ +-static void mtip_init_cmd_header(struct request *rq) +-{ +- struct driver_data *dd = rq->q->queuedata; +- struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); +- u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; +- +- /* Point the command headers at the command tables. */ +- cmd->command_header = dd->port->command_list + +- (sizeof(struct mtip_cmd_hdr) * rq->tag); +- cmd->command_header_dma = dd->port->command_list_dma + +- (sizeof(struct mtip_cmd_hdr) * rq->tag); +- +- if (host_cap_64) +- cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); +- +- cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); +-} +- + static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + { + struct request *rq; +@@ -199,9 +180,6 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + if (IS_ERR(rq)) + return NULL; + +- /* Internal cmd isn't submitted via .queue_rq */ +- mtip_init_cmd_header(rq); +- + return blk_mq_rq_to_pdu(rq); + } + +@@ -3840,8 +3818,6 @@ static int mtip_queue_rq(struct blk_mq_hw_ctx *hctx, + struct request *rq = bd->rq; + int ret; + +- mtip_init_cmd_header(rq); +- + if (unlikely(mtip_check_unal_depth(hctx, rq))) + return BLK_MQ_RQ_QUEUE_BUSY; + +@@ -3873,6 +3849,7 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + { + struct driver_data *dd = data; + struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); ++ u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; + + /* + * For flush requests, request_idx starts at the end of the +@@ -3889,6 +3866,17 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + + memset(cmd->command, 0, CMD_DMA_ALLOC_SZ); + ++ /* Point the command headers at the command tables. */ ++ cmd->command_header = dd->port->command_list + ++ (sizeof(struct mtip_cmd_hdr) * request_idx); ++ cmd->command_header_dma = dd->port->command_list_dma + ++ (sizeof(struct mtip_cmd_hdr) * request_idx); ++ ++ if (host_cap_64) ++ cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); ++ ++ cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); ++ + sg_init_table(cmd->sg, MTIP_MAX_SG); + return 0; + } +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index c0fb6f12f547..ebed319657e7 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -551,8 +551,6 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } +- if (t && !try_module_get(t->owner)) +- t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -671,10 +669,6 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); +- +- if (new_policy.governor) +- module_put(new_policy.governor->owner); +- + return ret ? ret : count; + } + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 6a8024d9d742..864a7c8d82d3 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -86,6 +86,22 @@ int rdma_addr_size(struct sockaddr *addr) + } + EXPORT_SYMBOL(rdma_addr_size); + ++int rdma_addr_size_in6(struct sockaddr_in6 *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_in6); ++ ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_kss); ++ + static struct rdma_addr_client self; + + void rdma_addr_register_client(struct rdma_addr_client *client) +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index cdac2c9421ab..960fcb613198 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -131,7 +131,7 @@ static inline struct ucma_context *_ucma_find_context(int id, + ctx = idr_find(&ctx_idr, id); + if (!ctx) + ctx = ERR_PTR(-ENOENT); +- else if (ctx->file != file) ++ else if (ctx->file != file || !ctx->cm_id) + ctx = ERR_PTR(-EINVAL); + return ctx; + } +@@ -453,6 +453,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + struct rdma_ucm_create_id cmd; + struct rdma_ucm_create_id_resp resp; + struct ucma_context *ctx; ++ struct rdma_cm_id *cm_id; + enum ib_qp_type qp_type; + int ret; + +@@ -473,10 +474,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + return -ENOMEM; + + ctx->uid = cmd.uid; +- ctx->cm_id = rdma_create_id(current->nsproxy->net_ns, +- ucma_event_handler, ctx, cmd.ps, qp_type); +- if (IS_ERR(ctx->cm_id)) { +- ret = PTR_ERR(ctx->cm_id); ++ cm_id = rdma_create_id(current->nsproxy->net_ns, ++ ucma_event_handler, ctx, cmd.ps, qp_type); ++ if (IS_ERR(cm_id)) { ++ ret = PTR_ERR(cm_id); + goto err1; + } + +@@ -486,14 +487,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + ret = -EFAULT; + goto err2; + } ++ ++ ctx->cm_id = cm_id; + return 0; + + err2: +- rdma_destroy_id(ctx->cm_id); ++ rdma_destroy_id(cm_id); + err1: + mutex_lock(&mut); + idr_remove(&ctx_idr, ctx->id); + mutex_unlock(&mut); ++ mutex_lock(&file->mut); ++ list_del(&ctx->list); ++ mutex_unlock(&file->mut); + kfree(ctx); + return ret; + } +@@ -623,6 +629,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -636,22 +645,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf, + int in_len, int out_len) + { + struct rdma_ucm_bind cmd; +- struct sockaddr *addr; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- addr = (struct sockaddr *) &cmd.addr; +- if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr))) ++ if (cmd.reserved || !cmd.addr_size || ++ cmd.addr_size != rdma_addr_size_kss(&cmd.addr)) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_bind_addr(ctx->cm_id, addr); ++ ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr); + ucma_put_ctx(ctx); + return ret; + } +@@ -667,13 +675,16 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.src_addr) || ++ !rdma_addr_size_in6(&cmd.dst_addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + + ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, +- (struct sockaddr *) &cmd.dst_addr, +- cmd.timeout_ms); ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -683,24 +694,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file, + int in_len, int out_len) + { + struct rdma_ucm_resolve_addr cmd; +- struct sockaddr *src, *dst; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- src = (struct sockaddr *) &cmd.src_addr; +- dst = (struct sockaddr *) &cmd.dst_addr; +- if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) || +- !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst))) ++ if (cmd.reserved || ++ (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) || ++ !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr))) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms); ++ ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -1145,6 +1155,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (!ctx->cm_id->device) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + resp.qp_attr_mask = 0; + memset(&qp_attr, 0, sizeof qp_attr); + qp_attr.qp_state = cmd.qp_state; +@@ -1301,7 +1316,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + { + struct rdma_ucm_notify cmd; + struct ucma_context *ctx; +- int ret; ++ int ret = -EINVAL; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; +@@ -1310,7 +1325,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event); ++ if (ctx->cm_id->device) ++ ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event); ++ + ucma_put_ctx(ctx); + return ret; + } +@@ -1328,7 +1345,7 @@ static ssize_t ucma_process_join(struct ucma_file *file, + return -ENOSPC; + + addr = (struct sockaddr *) &cmd->addr; +- if (cmd->reserved || !cmd->addr_size || (cmd->addr_size != rdma_addr_size(addr))) ++ if (cmd->reserved || (cmd->addr_size != rdma_addr_size(addr))) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd->id); +@@ -1387,7 +1404,10 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, + join_cmd.response = cmd.response; + join_cmd.uid = cmd.uid; + join_cmd.id = cmd.id; +- join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); ++ join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr); ++ if (!join_cmd.addr_size) ++ return -EINVAL; ++ + join_cmd.reserved = 0; + memcpy(&join_cmd.addr, &cmd.addr, join_cmd.addr_size); + +@@ -1403,6 +1423,9 @@ static ssize_t ucma_join_multicast(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_kss(&cmd.addr)) ++ return -EINVAL; ++ + return ucma_process_join(file, &cmd, out_len); + } + +diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c +index b604564dec5c..30328e57fdda 100644 +--- a/drivers/input/mousedev.c ++++ b/drivers/input/mousedev.c +@@ -15,6 +15,7 @@ + #define MOUSEDEV_MINORS 31 + #define MOUSEDEV_MIX 63 + ++#include + #include + #include + #include +@@ -103,7 +104,7 @@ struct mousedev_client { + spinlock_t packet_lock; + int pos_x, pos_y; + +- signed char ps2[6]; ++ u8 ps2[6]; + unsigned char ready, buffer, bufsiz; + unsigned char imexseq, impsseq; + enum mousedev_emul mode; +@@ -291,11 +292,10 @@ static void mousedev_notify_readers(struct mousedev *mousedev, + } + + client->pos_x += packet->dx; +- client->pos_x = client->pos_x < 0 ? +- 0 : (client->pos_x >= xres ? xres : client->pos_x); ++ client->pos_x = clamp_val(client->pos_x, 0, xres); ++ + client->pos_y += packet->dy; +- client->pos_y = client->pos_y < 0 ? +- 0 : (client->pos_y >= yres ? yres : client->pos_y); ++ client->pos_y = clamp_val(client->pos_y, 0, yres); + + p->dx += packet->dx; + p->dy += packet->dy; +@@ -571,44 +571,50 @@ static int mousedev_open(struct inode *inode, struct file *file) + return error; + } + +-static inline int mousedev_limit_delta(int delta, int limit) +-{ +- return delta > limit ? limit : (delta < -limit ? -limit : delta); +-} +- +-static void mousedev_packet(struct mousedev_client *client, +- signed char *ps2_data) ++static void mousedev_packet(struct mousedev_client *client, u8 *ps2_data) + { + struct mousedev_motion *p = &client->packets[client->tail]; ++ s8 dx, dy, dz; ++ ++ dx = clamp_val(p->dx, -127, 127); ++ p->dx -= dx; ++ ++ dy = clamp_val(p->dy, -127, 127); ++ p->dy -= dy; + +- ps2_data[0] = 0x08 | +- ((p->dx < 0) << 4) | ((p->dy < 0) << 5) | (p->buttons & 0x07); +- ps2_data[1] = mousedev_limit_delta(p->dx, 127); +- ps2_data[2] = mousedev_limit_delta(p->dy, 127); +- p->dx -= ps2_data[1]; +- p->dy -= ps2_data[2]; ++ ps2_data[0] = BIT(3); ++ ps2_data[0] |= ((dx & BIT(7)) >> 3) | ((dy & BIT(7)) >> 2); ++ ps2_data[0] |= p->buttons & 0x07; ++ ps2_data[1] = dx; ++ ps2_data[2] = dy; + + switch (client->mode) { + case MOUSEDEV_EMUL_EXPS: +- ps2_data[3] = mousedev_limit_delta(p->dz, 7); +- p->dz -= ps2_data[3]; +- ps2_data[3] = (ps2_data[3] & 0x0f) | ((p->buttons & 0x18) << 1); ++ dz = clamp_val(p->dz, -7, 7); ++ p->dz -= dz; ++ ++ ps2_data[3] = (dz & 0x0f) | ((p->buttons & 0x18) << 1); + client->bufsiz = 4; + break; + + case MOUSEDEV_EMUL_IMPS: +- ps2_data[0] |= +- ((p->buttons & 0x10) >> 3) | ((p->buttons & 0x08) >> 1); +- ps2_data[3] = mousedev_limit_delta(p->dz, 127); +- p->dz -= ps2_data[3]; ++ dz = clamp_val(p->dz, -127, 127); ++ p->dz -= dz; ++ ++ ps2_data[0] |= ((p->buttons & 0x10) >> 3) | ++ ((p->buttons & 0x08) >> 1); ++ ps2_data[3] = dz; ++ + client->bufsiz = 4; + break; + + case MOUSEDEV_EMUL_PS2: + default: +- ps2_data[0] |= +- ((p->buttons & 0x10) >> 3) | ((p->buttons & 0x08) >> 1); + p->dz = 0; ++ ++ ps2_data[0] |= ((p->buttons & 0x10) >> 3) | ++ ((p->buttons & 0x08) >> 1); ++ + client->bufsiz = 3; + break; + } +@@ -714,7 +720,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer, + { + struct mousedev_client *client = file->private_data; + struct mousedev *mousedev = client->mousedev; +- signed char data[sizeof(client->ps2)]; ++ u8 data[sizeof(client->ps2)]; + int retval = 0; + + if (!client->ready && !client->buffer && mousedev->exist && +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index d1051e3ce819..e484ea2dc787 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -530,6 +530,20 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + { } + }; + ++static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { ++ { ++ /* ++ * Sony Vaio VGN-CS series require MUX or the touch sensor ++ * buttons will disturb touchpad operation ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), ++ }, ++ }, ++ { } ++}; ++ + /* + * On some Asus laptops, just running self tests cause problems. + */ +@@ -692,6 +706,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "20046"), + }, + }, ++ { ++ /* Lenovo ThinkPad L460 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"), ++ }, ++ }, + { + /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ + .matches = { +@@ -1223,6 +1244,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_nomux_table)) + i8042_nomux = true; + ++ if (dmi_check_system(i8042_dmi_forcemux_table)) ++ i8042_nomux = false; ++ + if (dmi_check_system(i8042_dmi_notimeout_table)) + i8042_notimeout = true; + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index e503279c34fc..6865b186f749 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1773,12 +1773,12 @@ static int validate_params(uint cmd, struct dm_ioctl *param) + cmd == DM_LIST_VERSIONS_CMD) + return 0; + +- if ((cmd == DM_DEV_CREATE_CMD)) { ++ if (cmd == DM_DEV_CREATE_CMD) { + if (!*param->name) { + DMWARN("name not supplied when creating device"); + return -EINVAL; + } +- } else if ((*param->uuid && *param->name)) { ++ } else if (*param->uuid && *param->name) { + DMWARN("only supply one of name or uuid, cmd(%u)", cmd); + return -EINVAL; + } +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 3a0d557146c7..bf0410403a6f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3638,6 +3638,7 @@ static int run(struct mddev *mddev) + + if (blk_queue_discard(bdev_get_queue(rdev->bdev))) + discard_supported = true; ++ first = 0; + } + + if (mddev->queue) { +diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c +index 3bbc77aa6a33..483457d4904f 100644 +--- a/drivers/media/usb/usbtv/usbtv-core.c ++++ b/drivers/media/usb/usbtv/usbtv-core.c +@@ -95,6 +95,8 @@ static int usbtv_probe(struct usb_interface *intf, + return 0; + + usbtv_audio_fail: ++ /* we must not free at this point */ ++ usb_get_dev(usbtv->udev); + usbtv_video_free(usbtv); + + usbtv_video_fail: +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index 4ef189a7a2fb..8c04e342e30a 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -571,7 +571,6 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) + break; + + default: +- dev_err(dev->dev, ": unsupported ioctl %d.\n", cmd); + rets = -ENOIOCTLCMD; + } + +diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c +index 7c0b27d132b1..b479bd81120b 100644 +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base, + do { + uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi); + mask = (1 << (cfi->device_type * 8)) - 1; ++ if (ofs >= map->size) ++ return 0; + result = map_read(map, base + ofs); + bank++; + } while ((result.x[0] & mask) == CFI_MFR_CONTINUATION); +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index cc1725616f9d..50747573f42e 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -2823,7 +2823,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev) + if (!g) { + netif_info(lio, tx_err, lio->netdev, + "Transmit scatter gather: glist null!\n"); +- goto lio_xmit_dma_failed; ++ goto lio_xmit_failed; + } + + cmdsetup.s.gather = 1; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index a20bd8362712..b8517b00e706 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -648,7 +648,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data) + + static int hns_gmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ARRAY_SIZE(g_gmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index 6634aef0e841..67f33f185a44 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -384,7 +384,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) + + int hns_ppe_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ETH_PPE_STATIC_NUM; + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index 1d5b18d7a1d7..4db32c62f062 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -807,7 +807,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data) + */ + int hns_rcb_get_ring_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return HNS_RING_STATIC_REG_NUM; + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index a0332129970b..4b91eb70c683 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -1000,8 +1000,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset) + cnt--; + + return cnt; +- } else { ++ } else if (stringset == ETH_SS_STATS) { + return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset)); ++ } else { ++ return -EOPNOTSUPP; + } + } + +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index 78530d1714dc..bdce0679674c 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2646,6 +2646,7 @@ enum parport_pc_pci_cards { + netmos_9901, + netmos_9865, + quatech_sppxp100, ++ wch_ch382l, + }; + + +@@ -2708,6 +2709,7 @@ static struct parport_pc_pci { + /* netmos_9901 */ { 1, { { 0, -1 }, } }, + /* netmos_9865 */ { 1, { { 0, -1 }, } }, + /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, ++ /* wch_ch382l */ { 1, { { 2, -1 }, } }, + }; + + static const struct pci_device_id parport_pc_pci_tbl[] = { +@@ -2797,6 +2799,8 @@ static const struct pci_device_id parport_pc_pci_tbl[] = { + /* Quatech SPPXP-100 Parallel port PCI ExpressCard */ + { PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 }, ++ /* WCH CH382L PCI-E single parallel port card */ ++ { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l }, + { 0, } /* terminate list */ + }; + MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl); +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 5e42b5f2f565..32bd8ab79d53 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -463,6 +463,8 @@ static void pci_device_shutdown(struct device *dev) + + if (drv && drv->shutdown) + drv->shutdown(pci_dev); ++ pci_msi_shutdown(pci_dev); ++ pci_msix_shutdown(pci_dev); + + #ifdef CONFIG_KEXEC_CORE + /* +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 193ac13de49b..566897f24dee 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -230,7 +230,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + res->flags |= IORESOURCE_ROM_ENABLE; + l64 = l & PCI_ROM_ADDRESS_MASK; + sz64 = sz & PCI_ROM_ADDRESS_MASK; +- mask64 = (u32)PCI_ROM_ADDRESS_MASK; ++ mask64 = PCI_ROM_ADDRESS_MASK; + } + + if (res->flags & IORESOURCE_MEM_64) { +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index 25062966cbfa..8b2f8b2a574e 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -63,7 +63,7 @@ static void pci_std_update_resource(struct pci_dev *dev, int resno) + mask = (u32)PCI_BASE_ADDRESS_IO_MASK; + new |= res->flags & ~PCI_BASE_ADDRESS_IO_MASK; + } else if (resno == PCI_ROM_RESOURCE) { +- mask = (u32)PCI_ROM_ADDRESS_MASK; ++ mask = PCI_ROM_ADDRESS_MASK; + } else { + mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; + new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK; +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 578fae4d474f..8ef905cbfc9c 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -819,6 +819,7 @@ static struct scsi_host_template virtscsi_host_template_multi = { + .eh_abort_handler = virtscsi_abort, + .eh_device_reset_handler = virtscsi_device_reset, + ++ .slave_alloc = virtscsi_device_alloc, + .can_queue = 1024, + .dma_boundary = UINT_MAX, + .use_clustering = ENABLE_CLUSTERING, +diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c +index 1ddba9ae8c0f..c872a2e54c4b 100644 +--- a/drivers/spi/spi-davinci.c ++++ b/drivers/spi/spi-davinci.c +@@ -651,7 +651,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t) + buf = t->rx_buf; + t->rx_dma = dma_map_single(&spi->dev, buf, + t->len, DMA_FROM_DEVICE); +- if (dma_mapping_error(&spi->dev, !t->rx_dma)) { ++ if (dma_mapping_error(&spi->dev, t->rx_dma)) { + ret = -EFAULT; + goto err_rx_map; + } +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index c975f6e8be49..8f181caffca3 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -1348,6 +1348,8 @@ static void ack_a_interrupt(struct comedi_device *dev, unsigned short a_status) + ack |= NISTC_INTA_ACK_AI_START; + if (a_status & NISTC_AI_STATUS1_STOP) + ack |= NISTC_INTA_ACK_AI_STOP; ++ if (a_status & NISTC_AI_STATUS1_OVER) ++ ack |= NISTC_INTA_ACK_AI_ERR; + if (ack) + ni_stc_writew(dev, ack, NISTC_INTA_ACK_REG); + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 251315c35747..ff3286fc22d8 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1312,6 +1312,11 @@ static void csi_m(struct vc_data *vc) + case 3: + vc->vc_italic = 1; + break; ++ case 21: ++ /* ++ * No console drivers support double underline, so ++ * convert it to a single underline. ++ */ + case 4: + vc->vc_underline = 1; + break; +@@ -1348,7 +1353,6 @@ static void csi_m(struct vc_data *vc) + vc->vc_disp_ctrl = 1; + vc->vc_toggle_meta = 1; + break; +- case 21: + case 22: + vc->vc_intensity = 1; + break; +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 88bd950665fa..85fb6226770c 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -1385,7 +1385,6 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + dwc2_core_init(hsotg, false, -1); + dwc2_enable_global_interrupts(hsotg); + spin_lock_irqsave(&hsotg->lock, flags); +- dwc2_hsotg_disconnect(hsotg); + dwc2_hsotg_core_init_disconnected(hsotg, false); + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_hsotg_core_connect(hsotg); +@@ -1403,8 +1402,12 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + if (count > 250) + dev_err(hsotg->dev, + "Connection id status change timed out\n"); +- hsotg->op_state = OTG_STATE_A_HOST; + ++ spin_lock_irqsave(&hsotg->lock, flags); ++ dwc2_hsotg_disconnect(hsotg); ++ spin_unlock_irqrestore(&hsotg->lock, flags); ++ ++ hsotg->op_state = OTG_STATE_A_HOST; + /* Initialize the Core for Host mode */ + dwc2_core_init(hsotg, false, -1); + dwc2_enable_global_interrupts(hsotg); +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index ee579ba2b59e..a5dae5bb62ab 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -223,6 +223,13 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + /* pick the first one */ + list = list_first_entry(&hidg->completed_out_req, + struct f_hidg_req_list, list); ++ ++ /* ++ * Remove this from list to protect it from beign free() ++ * while host disables our function ++ */ ++ list_del(&list->list); ++ + req = list->req; + count = min_t(unsigned int, count, req->actual - list->pos); + spin_unlock_irqrestore(&hidg->spinlock, flags); +@@ -238,15 +245,20 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + * call, taking into account its current read position. + */ + if (list->pos == req->actual) { +- spin_lock_irqsave(&hidg->spinlock, flags); +- list_del(&list->list); + kfree(list); +- spin_unlock_irqrestore(&hidg->spinlock, flags); + + req->length = hidg->report_length; + ret = usb_ep_queue(hidg->out_ep, req, GFP_KERNEL); +- if (ret < 0) ++ if (ret < 0) { ++ free_ep_req(hidg->out_ep, req); + return ret; ++ } ++ } else { ++ spin_lock_irqsave(&hidg->spinlock, flags); ++ list_add(&list->list, &hidg->completed_out_req); ++ spin_unlock_irqrestore(&hidg->spinlock, flags); ++ ++ wake_up(&hidg->read_queue); + } + + return count; +@@ -490,14 +502,18 @@ static void hidg_disable(struct usb_function *f) + { + struct f_hidg *hidg = func_to_hidg(f); + struct f_hidg_req_list *list, *next; ++ unsigned long flags; + + usb_ep_disable(hidg->in_ep); + usb_ep_disable(hidg->out_ep); + ++ spin_lock_irqsave(&hidg->spinlock, flags); + list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { ++ free_ep_req(hidg->out_ep, list->req); + list_del(&list->list); + kfree(list); + } ++ spin_unlock_irqrestore(&hidg->spinlock, flags); + } + + static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) +diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c +index af60cc3714c1..5ead414586a1 100644 +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -201,12 +201,6 @@ static inline struct usb_request *midi_alloc_ep_req(struct usb_ep *ep, + return alloc_ep_req(ep, length, length); + } + +-static void free_ep_req(struct usb_ep *ep, struct usb_request *req) +-{ +- kfree(req->buf); +- usb_ep_free_request(ep, req); +-} +- + static const uint8_t f_midi_cin_length[] = { + 0, 0, 2, 3, 3, 1, 2, 3, 3, 3, 3, 3, 2, 2, 3, 1 + }; +diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c +index 9f3ced62d916..67b243989938 100644 +--- a/drivers/usb/gadget/function/f_sourcesink.c ++++ b/drivers/usb/gadget/function/f_sourcesink.c +@@ -303,12 +303,6 @@ static inline struct usb_request *ss_alloc_ep_req(struct usb_ep *ep, int len) + return alloc_ep_req(ep, len, ss->buflen); + } + +-void free_ep_req(struct usb_ep *ep, struct usb_request *req) +-{ +- kfree(req->buf); +- usb_ep_free_request(ep, req); +-} +- + static void disable_ep(struct usb_composite_dev *cdev, struct usb_ep *ep) + { + int value; +diff --git a/drivers/usb/gadget/function/g_zero.h b/drivers/usb/gadget/function/g_zero.h +index 15f180904f8a..5ed90b437f18 100644 +--- a/drivers/usb/gadget/function/g_zero.h ++++ b/drivers/usb/gadget/function/g_zero.h +@@ -59,7 +59,6 @@ void lb_modexit(void); + int lb_modinit(void); + + /* common utilities */ +-void free_ep_req(struct usb_ep *ep, struct usb_request *req); + void disable_endpoints(struct usb_composite_dev *cdev, + struct usb_ep *in, struct usb_ep *out, + struct usb_ep *iso_in, struct usb_ep *iso_out); +diff --git a/drivers/usb/gadget/u_f.c b/drivers/usb/gadget/u_f.c +index c6276f0268ae..907f8144813c 100644 +--- a/drivers/usb/gadget/u_f.c ++++ b/drivers/usb/gadget/u_f.c +@@ -11,16 +11,18 @@ + * published by the Free Software Foundation. + */ + +-#include + #include "u_f.h" ++#include + +-struct usb_request *alloc_ep_req(struct usb_ep *ep, int len, int default_len) ++struct usb_request *alloc_ep_req(struct usb_ep *ep, size_t len, int default_len) + { + struct usb_request *req; + + req = usb_ep_alloc_request(ep, GFP_ATOMIC); + if (req) { + req->length = len ?: default_len; ++ if (usb_endpoint_dir_out(ep->desc)) ++ req->length = usb_ep_align(ep, req->length); + req->buf = kmalloc(req->length, GFP_ATOMIC); + if (!req->buf) { + usb_ep_free_request(ep, req); +diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h +index 1d5f0eb68552..69a1d10df04f 100644 +--- a/drivers/usb/gadget/u_f.h ++++ b/drivers/usb/gadget/u_f.h +@@ -16,6 +16,8 @@ + #ifndef __U_F_H__ + #define __U_F_H__ + ++#include ++ + /* Variable Length Array Macros **********************************************/ + #define vla_group(groupname) size_t groupname##__next = 0 + #define vla_group_size(groupname) groupname##__next +@@ -45,8 +47,26 @@ + struct usb_ep; + struct usb_request; + +-struct usb_request *alloc_ep_req(struct usb_ep *ep, int len, int default_len); +- +-#endif /* __U_F_H__ */ ++/** ++ * alloc_ep_req - returns a usb_request allocated by the gadget driver and ++ * allocates the request's buffer. ++ * ++ * @ep: the endpoint to allocate a usb_request ++ * @len: usb_requests's buffer suggested size ++ * @default_len: used if @len is not provided, ie, is 0 ++ * ++ * In case @ep direction is OUT, the @len will be aligned to ep's ++ * wMaxPacketSize. In order to avoid memory leaks or drops, *always* use ++ * usb_requests's length (req->length) to refer to the allocated buffer size. ++ * Requests allocated via alloc_ep_req() *must* be freed by free_ep_req(). ++ */ ++struct usb_request *alloc_ep_req(struct usb_ep *ep, size_t len, int default_len); + ++/* Frees a usb_request previously allocated by alloc_ep_req() */ ++static inline void free_ep_req(struct usb_ep *ep, struct usb_request *req) ++{ ++ kfree(req->buf); ++ usb_ep_free_request(ep, req); ++} + ++#endif /* __U_F_H__ */ +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index a4ab4fdf5ba3..64a4427678b0 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -151,6 +151,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ ++ { USB_DEVICE(0x155A, 0x1006) }, /* ELDAT Easywave RX09 */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ + { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 64fe9dc25ed4..a224c7a3ce09 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -773,6 +773,7 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, ++ { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, +@@ -935,6 +936,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, + { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 543d2801632b..76a10b222ff9 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -922,6 +922,9 @@ + /* + * RT Systems programming cables for various ham radios + */ ++/* This device uses the VID of FTDI */ ++#define RTSYSTEMS_USB_VX8_PID 0x9e50 /* USB-VX8 USB to 7 pin modular plug for Yaesu VX-8 radio */ ++ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ + #define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */ + #define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */ +@@ -1440,6 +1443,12 @@ + */ + #define FTDI_CINTERION_MC55I_PID 0xA951 + ++/* ++ * Product: FirmwareHubEmulator ++ * Manufacturer: Harman Becker Automotive Systems ++ */ ++#define FTDI_FHE_PID 0xA9A0 ++ + /* + * Product: Comet Caller ID decoder + * Manufacturer: Crucible Technologies +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index dcf26537c935..a52ca5cba015 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -811,7 +811,7 @@ static int compat_ioctl_preallocate(struct file *file, + */ + #define XFORM(i) (((i) ^ ((i) << 27) ^ ((i) << 17)) & 0xffffffff) + +-#define COMPATIBLE_IOCTL(cmd) XFORM(cmd), ++#define COMPATIBLE_IOCTL(cmd) XFORM((u32)cmd), + /* ioctl should not be warned about even if it's not implemented. + Valid reasons to use this: + - It is implemented with ->compat_ioctl on some device, but programs +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 07ef85e19fbc..75691a20313c 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -253,24 +253,15 @@ static int do_maps_open(struct inode *inode, struct file *file, + * /proc/PID/maps that is the stack of the main task. + */ + static int is_stack(struct proc_maps_private *priv, +- struct vm_area_struct *vma, int is_pid) ++ struct vm_area_struct *vma) + { +- int stack = 0; +- +- if (is_pid) { +- stack = vma->vm_start <= vma->vm_mm->start_stack && +- vma->vm_end >= vma->vm_mm->start_stack; +- } else { +- struct inode *inode = priv->inode; +- struct task_struct *task; +- +- rcu_read_lock(); +- task = pid_task(proc_pid(inode), PIDTYPE_PID); +- if (task) +- stack = vma_is_stack_for_task(vma, task); +- rcu_read_unlock(); +- } +- return stack; ++ /* ++ * We make no effort to guess what a given thread considers to be ++ * its "stack". It's not even well-defined for programs written ++ * languages like Go. ++ */ ++ return vma->vm_start <= vma->vm_mm->start_stack && ++ vma->vm_end >= vma->vm_mm->start_stack; + } + + static void +@@ -337,7 +328,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) + goto done; + } + +- if (is_stack(priv, vma, is_pid)) ++ if (is_stack(priv, vma)) + name = "[stack]"; + } + +@@ -1560,7 +1551,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) + seq_file_path(m, file, "\n\t= "); + } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) { + seq_puts(m, " heap"); +- } else if (is_stack(proc_priv, vma, is_pid)) { ++ } else if (is_stack(proc_priv, vma)) { + seq_puts(m, " stack"); + } + +diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c +index faacb0c0d857..37175621e890 100644 +--- a/fs/proc/task_nommu.c ++++ b/fs/proc/task_nommu.c +@@ -124,25 +124,17 @@ unsigned long task_statm(struct mm_struct *mm, + } + + static int is_stack(struct proc_maps_private *priv, +- struct vm_area_struct *vma, int is_pid) ++ struct vm_area_struct *vma) + { + struct mm_struct *mm = vma->vm_mm; +- int stack = 0; +- +- if (is_pid) { +- stack = vma->vm_start <= mm->start_stack && +- vma->vm_end >= mm->start_stack; +- } else { +- struct inode *inode = priv->inode; +- struct task_struct *task; +- +- rcu_read_lock(); +- task = pid_task(proc_pid(inode), PIDTYPE_PID); +- if (task) +- stack = vma_is_stack_for_task(vma, task); +- rcu_read_unlock(); +- } +- return stack; ++ ++ /* ++ * We make no effort to guess what a given thread considers to be ++ * its "stack". It's not even well-defined for programs written ++ * languages like Go. ++ */ ++ return vma->vm_start <= mm->start_stack && ++ vma->vm_end >= mm->start_stack; + } + + /* +@@ -184,7 +176,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma, + if (file) { + seq_pad(m, ' '); + seq_file_path(m, file, ""); +- } else if (mm && is_stack(priv, vma, is_pid)) { ++ } else if (mm && is_stack(priv, vma)) { + seq_pad(m, ' '); + seq_printf(m, "[stack]"); + } +diff --git a/include/linux/audit.h b/include/linux/audit.h +index faac391badac..9b95bb222e73 100644 +--- a/include/linux/audit.h ++++ b/include/linux/audit.h +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #define AUDIT_INO_UNSET ((unsigned long)-1) + #define AUDIT_DEV_UNSET ((dev_t)-1) +@@ -239,6 +240,23 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk) + return tsk->sessionid; + } + ++static inline struct tty_struct *audit_get_tty(struct task_struct *tsk) ++{ ++ struct tty_struct *tty = NULL; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&tsk->sighand->siglock, flags); ++ if (tsk->signal) ++ tty = tty_kref_get(tsk->signal->tty); ++ spin_unlock_irqrestore(&tsk->sighand->siglock, flags); ++ return tty; ++} ++ ++static inline void audit_put_tty(struct tty_struct *tty) ++{ ++ tty_kref_put(tty); ++} ++ + extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp); + extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode); + extern void __audit_bprm(struct linux_binprm *bprm); +@@ -410,6 +428,12 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk) + { + return -1; + } ++static inline struct tty_struct *audit_get_tty(struct task_struct *tsk) ++{ ++ return NULL; ++} ++static inline void audit_put_tty(struct tty_struct *tty) ++{ } + static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) + { } + static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, +diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h +index a91b3b75da0f..bb3a4bb35183 100644 +--- a/include/linux/cpumask.h ++++ b/include/linux/cpumask.h +@@ -661,6 +661,11 @@ void alloc_bootmem_cpumask_var(cpumask_var_t *mask); + void free_cpumask_var(cpumask_var_t mask); + void free_bootmem_cpumask_var(cpumask_var_t mask); + ++static inline bool cpumask_available(cpumask_var_t mask) ++{ ++ return mask != NULL; ++} ++ + #else + typedef struct cpumask cpumask_var_t[1]; + +@@ -701,6 +706,11 @@ static inline void free_cpumask_var(cpumask_var_t mask) + static inline void free_bootmem_cpumask_var(cpumask_var_t mask) + { + } ++ ++static inline bool cpumask_available(cpumask_var_t mask) ++{ ++ return true; ++} + #endif /* CONFIG_CPUMASK_OFFSTACK */ + + /* It's common to want to use cpu_all_mask in struct member initializers, +diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h +index 5fdc55312334..2fb10601febe 100644 +--- a/include/linux/jiffies.h ++++ b/include/linux/jiffies.h +@@ -1,6 +1,7 @@ + #ifndef _LINUX_JIFFIES_H + #define _LINUX_JIFFIES_H + ++#include + #include + #include + #include +@@ -63,19 +64,17 @@ extern int register_refined_jiffies(long clock_tick_rate); + /* TICK_USEC is the time between ticks in usec assuming fake USER_HZ */ + #define TICK_USEC ((1000000UL + USER_HZ/2) / USER_HZ) + +-/* some arch's have a small-data section that can be accessed register-relative +- * but that can only take up to, say, 4-byte variables. jiffies being part of +- * an 8-byte variable may not be correctly accessed unless we force the issue +- */ +-#define __jiffy_data __attribute__((section(".data"))) ++#ifndef __jiffy_arch_data ++#define __jiffy_arch_data ++#endif + + /* + * The 64-bit value is not atomic - you MUST NOT read it + * without sampling the sequence number in jiffies_lock. + * get_jiffies_64() will do this for you as appropriate. + */ +-extern u64 __jiffy_data jiffies_64; +-extern unsigned long volatile __jiffy_data jiffies; ++extern u64 __cacheline_aligned_in_smp jiffies_64; ++extern unsigned long volatile __cacheline_aligned_in_smp __jiffy_arch_data jiffies; + + #if (BITS_PER_LONG < 64) + u64 get_jiffies_64(void); +diff --git a/include/linux/llist.h b/include/linux/llist.h +index fd4ca0b4fe0f..ac6796138ba0 100644 +--- a/include/linux/llist.h ++++ b/include/linux/llist.h +@@ -87,6 +87,23 @@ static inline void init_llist_head(struct llist_head *list) + #define llist_entry(ptr, type, member) \ + container_of(ptr, type, member) + ++/** ++ * member_address_is_nonnull - check whether the member address is not NULL ++ * @ptr: the object pointer (struct type * that contains the llist_node) ++ * @member: the name of the llist_node within the struct. ++ * ++ * This macro is conceptually the same as ++ * &ptr->member != NULL ++ * but it works around the fact that compilers can decide that taking a member ++ * address is never a NULL pointer. ++ * ++ * Real objects that start at a high address and have a member at NULL are ++ * unlikely to exist, but such pointers may be returned e.g. by the ++ * container_of() macro. ++ */ ++#define member_address_is_nonnull(ptr, member) \ ++ ((uintptr_t)(ptr) + offsetof(typeof(*(ptr)), member) != 0) ++ + /** + * llist_for_each - iterate over some deleted entries of a lock-less list + * @pos: the &struct llist_node to use as a loop cursor +@@ -121,7 +138,7 @@ static inline void init_llist_head(struct llist_head *list) + */ + #define llist_for_each_entry(pos, node, member) \ + for ((pos) = llist_entry((node), typeof(*(pos)), member); \ +- &(pos)->member != NULL; \ ++ member_address_is_nonnull(pos, member); \ + (pos) = llist_entry((pos)->member.next, typeof(*(pos)), member)) + + /** +@@ -143,7 +160,7 @@ static inline void init_llist_head(struct llist_head *list) + */ + #define llist_for_each_entry_safe(pos, n, node, member) \ + for (pos = llist_entry((node), typeof(*pos), member); \ +- &pos->member != NULL && \ ++ member_address_is_nonnull(pos, member) && \ + (n = llist_entry(pos->member.next, typeof(*n), member), true); \ + pos = n) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 53e361a9af79..6923e4049de3 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -247,6 +247,8 @@ unsigned int *xt_alloc_entry_offsets(unsigned int size); + bool xt_find_jump_offset(const unsigned int *offsets, + unsigned int target, unsigned int size); + ++int xt_check_proc_name(const char *name, unsigned int size); ++ + int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto, + bool inv_proto); + int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto, +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index 115381228203..e791ebc65c9c 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -20,20 +20,6 @@ + static inline unsigned long array_index_mask_nospec(unsigned long index, + unsigned long size) + { +- /* +- * Warn developers about inappropriate array_index_nospec() usage. +- * +- * Even if the CPU speculates past the WARN_ONCE branch, the +- * sign bit of @index is taken into account when generating the +- * mask. +- * +- * This warning is compiled out when the compiler can infer that +- * @index and @size are less than LONG_MAX. +- */ +- if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, +- "array_index_nospec() limited to range of [0, LONG_MAX]\n")) +- return 0; +- + /* + * Always calculate and emit the mask even if the compiler + * thinks the mask is not needed. The compiler does not take +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 83b264c52898..a1042afff99a 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -372,6 +372,7 @@ extern void proc_clear_tty(struct task_struct *p); + extern struct tty_struct *get_current_tty(void); + /* tty_io.c */ + extern int __init tty_init(void); ++extern const char *tty_name(const struct tty_struct *tty); + #else + static inline void console_init(void) + { } +@@ -392,6 +393,8 @@ static inline struct tty_struct *get_current_tty(void) + /* tty_io.c */ + static inline int __init tty_init(void) + { return 0; } ++static inline const char *tty_name(const struct tty_struct *tty) ++{ return "(none)"; } + #endif + + extern void tty_write_flush(struct tty_struct *); +@@ -420,7 +423,6 @@ static inline struct tty_struct *tty_kref_get(struct tty_struct *tty) + + extern int tty_paranoia_check(struct tty_struct *tty, struct inode *inode, + const char *routine); +-extern const char *tty_name(const struct tty_struct *tty); + extern void tty_wait_until_sent(struct tty_struct *tty, long timeout); + extern int __tty_check_change(struct tty_struct *tty, int sig); + extern int tty_check_change(struct tty_struct *tty); +diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h +index 3d583a10b926..7e84aac39ade 100644 +--- a/include/linux/usb/gadget.h ++++ b/include/linux/usb/gadget.h +@@ -662,9 +662,21 @@ static inline struct usb_gadget *dev_to_usb_gadget(struct device *dev) + #define gadget_for_each_ep(tmp, gadget) \ + list_for_each_entry(tmp, &(gadget)->ep_list, ep_list) + ++/** ++ * usb_ep_align - returns @len aligned to ep's maxpacketsize. ++ * @ep: the endpoint whose maxpacketsize is used to align @len ++ * @len: buffer size's length to align to @ep's maxpacketsize ++ * ++ * This helper is used to align buffer's size to an ep's maxpacketsize. ++ */ ++static inline size_t usb_ep_align(struct usb_ep *ep, size_t len) ++{ ++ return round_up(len, (size_t)le16_to_cpu(ep->desc->wMaxPacketSize)); ++} ++ + /** + * usb_ep_align_maybe - returns @len aligned to ep's maxpacketsize if gadget +- * requires quirk_ep_out_aligned_size, otherwise reguens len. ++ * requires quirk_ep_out_aligned_size, otherwise returns len. + * @g: controller to check for quirk + * @ep: the endpoint whose maxpacketsize is used to align @len + * @len: buffer size's length to align to @ep's maxpacketsize +@@ -675,8 +687,7 @@ static inline struct usb_gadget *dev_to_usb_gadget(struct device *dev) + static inline size_t + usb_ep_align_maybe(struct usb_gadget *g, struct usb_ep *ep, size_t len) + { +- return !g->quirk_ep_out_aligned_size ? len : +- round_up(len, (size_t)ep->desc->wMaxPacketSize); ++ return g->quirk_ep_out_aligned_size ? usb_ep_align(ep, len) : len; + } + + /** +diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h +index a78ff97eb249..d77416963f05 100644 +--- a/include/rdma/ib_addr.h ++++ b/include/rdma/ib_addr.h +@@ -123,6 +123,8 @@ int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev, + const unsigned char *dst_dev_addr); + + int rdma_addr_size(struct sockaddr *addr); ++int rdma_addr_size_in6(struct sockaddr_in6 *addr); ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr); + + int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id); + int rdma_addr_find_dmac_by_grh(const union ib_gid *sgid, const union ib_gid *dgid, +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index 1becea86c73c..eb3c786afa70 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -106,7 +106,7 @@ + #define PCI_SUBSYSTEM_ID 0x2e + #define PCI_ROM_ADDRESS 0x30 /* Bits 31..11 are address, 10..1 reserved */ + #define PCI_ROM_ADDRESS_ENABLE 0x01 +-#define PCI_ROM_ADDRESS_MASK (~0x7ffUL) ++#define PCI_ROM_ADDRESS_MASK (~0x7ffU) + + #define PCI_CAPABILITY_LIST 0x34 /* Offset of first capability list entry */ + +diff --git a/kernel/audit.c b/kernel/audit.c +index 41f9a38bb800..6881b485aa2a 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -64,7 +64,6 @@ + #include + #endif + #include +-#include + #include + #include + +@@ -1876,21 +1875,14 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) + { + const struct cred *cred; + char comm[sizeof(tsk->comm)]; +- char *tty; ++ struct tty_struct *tty; + + if (!ab) + return; + + /* tsk == current */ + cred = current_cred(); +- +- spin_lock_irq(&tsk->sighand->siglock); +- if (tsk->signal && tsk->signal->tty && tsk->signal->tty->name) +- tty = tsk->signal->tty->name; +- else +- tty = "(none)"; +- spin_unlock_irq(&tsk->sighand->siglock); +- ++ tty = audit_get_tty(tsk); + audit_log_format(ab, + " ppid=%d pid=%d auid=%u uid=%u gid=%u" + " euid=%u suid=%u fsuid=%u" +@@ -1906,11 +1898,11 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) + from_kgid(&init_user_ns, cred->egid), + from_kgid(&init_user_ns, cred->sgid), + from_kgid(&init_user_ns, cred->fsgid), +- tty, audit_get_sessionid(tsk)); +- ++ tty ? tty_name(tty) : "(none)", ++ audit_get_sessionid(tsk)); ++ audit_put_tty(tty); + audit_log_format(ab, " comm="); + audit_log_untrustedstring(ab, get_task_comm(comm, tsk)); +- + audit_log_d_path_exe(ab, tsk->mm); + audit_log_task_context(ab); + } +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 48f45987dc6c..4bdea31cf6ce 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1976,6 +1976,7 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid, + { + struct audit_buffer *ab; + uid_t uid, oldloginuid, loginuid; ++ struct tty_struct *tty; + + if (!audit_enabled) + return; +@@ -1983,14 +1984,17 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid, + uid = from_kuid(&init_user_ns, task_uid(current)); + oldloginuid = from_kuid(&init_user_ns, koldloginuid); + loginuid = from_kuid(&init_user_ns, kloginuid), ++ tty = audit_get_tty(current); + + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN); + if (!ab) + return; + audit_log_format(ab, "pid=%d uid=%u", task_pid_nr(current), uid); + audit_log_task_context(ab); +- audit_log_format(ab, " old-auid=%u auid=%u old-ses=%u ses=%u res=%d", +- oldloginuid, loginuid, oldsessionid, sessionid, !rc); ++ audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d", ++ oldloginuid, loginuid, tty ? tty_name(tty) : "(none)", ++ oldsessionid, sessionid, !rc); ++ audit_put_tty(tty); + audit_log_end(ab); + } + +diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c +index 92ce5f4ccc26..a27245fdcd81 100644 +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -427,16 +427,9 @@ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint); + * modify_user_hw_breakpoint - modify a user-space hardware breakpoint + * @bp: the breakpoint structure to modify + * @attr: new breakpoint attributes +- * @triggered: callback to trigger when we hit the breakpoint +- * @tsk: pointer to 'task_struct' of the process to which the address belongs + */ + int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr) + { +- u64 old_addr = bp->attr.bp_addr; +- u64 old_len = bp->attr.bp_len; +- int old_type = bp->attr.bp_type; +- int err = 0; +- + /* + * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it + * will not be possible to raise IPIs that invoke __perf_event_disable. +@@ -451,27 +444,18 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att + bp->attr.bp_addr = attr->bp_addr; + bp->attr.bp_type = attr->bp_type; + bp->attr.bp_len = attr->bp_len; ++ bp->attr.disabled = 1; + +- if (attr->disabled) +- goto end; +- +- err = validate_hw_breakpoint(bp); +- if (!err) +- perf_event_enable(bp); ++ if (!attr->disabled) { ++ int err = validate_hw_breakpoint(bp); + +- if (err) { +- bp->attr.bp_addr = old_addr; +- bp->attr.bp_type = old_type; +- bp->attr.bp_len = old_len; +- if (!bp->attr.disabled) +- perf_event_enable(bp); ++ if (err) ++ return err; + +- return err; ++ perf_event_enable(bp); ++ bp->attr.disabled = 0; + } + +-end: +- bp->attr.disabled = attr->disabled; +- + return 0; + } + EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint); +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index a079ed14f230..5f55a8bf5264 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -836,7 +836,7 @@ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action) + * This code is triggered unconditionally. Check the affinity + * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out. + */ +- if (desc->irq_common_data.affinity) ++ if (cpumask_available(desc->irq_common_data.affinity)) + cpumask_copy(mask, desc->irq_common_data.affinity); + else + valid = false; +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 695763516908..bbe9dd0886bd 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -125,7 +125,7 @@ static void *alloc_insn_page(void) + return module_alloc(PAGE_SIZE); + } + +-static void free_insn_page(void *page) ++void __weak free_insn_page(void *page) + { + module_memfree(page); + } +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index a988d4ef39da..7f80b1a1bc34 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -922,7 +922,7 @@ static atomic_t nr_wb_congested[2]; + void clear_wb_congested(struct bdi_writeback_congested *congested, int sync) + { + wait_queue_head_t *wqh = &congestion_wqh[sync]; +- enum wb_state bit; ++ enum wb_congested_state bit; + + bit = sync ? WB_sync_congested : WB_async_congested; + if (test_and_clear_bit(bit, &congested->state)) +@@ -935,7 +935,7 @@ EXPORT_SYMBOL(clear_wb_congested); + + void set_wb_congested(struct bdi_writeback_congested *congested, int sync) + { +- enum wb_state bit; ++ enum wb_congested_state bit; + + bit = sync ? WB_sync_congested : WB_async_congested; + if (!test_and_set_bit(bit, &congested->state)) +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 906f88550cd8..0dc27d2e8f18 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2251,8 +2251,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) + else + sec_level = authreq_to_seclevel(auth); + +- if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) ++ if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) { ++ /* If link is already encrypted with sufficient security we ++ * still need refresh encryption as per Core Spec 5.0 Vol 3, ++ * Part H 2.4.6 ++ */ ++ smp_ltk_encrypt(conn, hcon->sec_level); + return 0; ++ } + + if (sec_level > hcon->pending_sec_level) + hcon->pending_sec_level = sec_level; +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 9637a681bdda..9adf16258cab 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w) + return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); + } + ++static bool wormhash_offset_invalid(int off, unsigned int len) ++{ ++ if (off == 0) /* not present */ ++ return false; ++ ++ if (off < (int)sizeof(struct ebt_among_info) || ++ off % __alignof__(struct ebt_mac_wormhash)) ++ return true; ++ ++ off += sizeof(struct ebt_mac_wormhash); ++ ++ return off > len; ++} ++ ++static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b) ++{ ++ if (a == 0) ++ a = sizeof(struct ebt_among_info); ++ ++ return ebt_mac_wormhash_size(wh) + a == b; ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; +@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (expected_length > em->match_size) + return -EINVAL; + ++ if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) || ++ wormhash_offset_invalid(info->wh_src_ofs, em->match_size)) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); + if (poolsize_invalid(wh_dst)) + return -EINVAL; +@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (poolsize_invalid(wh_src)) + return -EINVAL; + ++ if (info->wh_src_ofs < info->wh_dst_ofs) { ++ if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs)) ++ return -EINVAL; ++ } else { ++ if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs)) ++ return -EINVAL; ++ } ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c +index 574f7ebba0b6..ac8342dcb55e 100644 +--- a/net/ipv4/netfilter/nf_nat_h323.c ++++ b/net/ipv4/netfilter/nf_nat_h323.c +@@ -252,16 +252,16 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct, + if (set_h245_addr(skb, protoff, data, dataoff, taddr, + &ct->tuplehash[!dir].tuple.dst.u3, + htons((port & htons(1)) ? nated_port + 1 : +- nated_port)) == 0) { +- /* Save ports */ +- info->rtp_port[i][dir] = rtp_port; +- info->rtp_port[i][!dir] = htons(nated_port); +- } else { ++ nated_port))) { + nf_ct_unexpect_related(rtp_exp); + nf_ct_unexpect_related(rtcp_exp); + return -1; + } + ++ /* Save ports */ ++ info->rtp_port[i][dir] = rtp_port; ++ info->rtp_port[i][!dir] = htons(nated_port); ++ + /* Success */ + pr_debug("nf_nat_h323: expect RTP %pI4:%hu->%pI4:%hu\n", + &rtp_exp->tuple.src.u3.ip, +@@ -370,15 +370,15 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct, + /* Modify signal */ + if (set_h225_addr(skb, protoff, data, dataoff, taddr, + &ct->tuplehash[!dir].tuple.dst.u3, +- htons(nated_port)) == 0) { +- /* Save ports */ +- info->sig_port[dir] = port; +- info->sig_port[!dir] = htons(nated_port); +- } else { ++ htons(nated_port))) { + nf_ct_unexpect_related(exp); + return -1; + } + ++ /* Save ports */ ++ info->sig_port[dir] = port; ++ info->sig_port[!dir] = htons(nated_port); ++ + pr_debug("nf_nat_q931: expect H.245 %pI4:%hu->%pI4:%hu\n", + &exp->tuple.src.u3.ip, + ntohs(exp->tuple.src.u.tcp.port), +@@ -462,24 +462,27 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct, + /* Modify signal */ + if (set_h225_addr(skb, protoff, data, 0, &taddr[idx], + &ct->tuplehash[!dir].tuple.dst.u3, +- htons(nated_port)) == 0) { +- /* Save ports */ +- info->sig_port[dir] = port; +- info->sig_port[!dir] = htons(nated_port); +- +- /* Fix for Gnomemeeting */ +- if (idx > 0 && +- get_h225_addr(ct, *data, &taddr[0], &addr, &port) && +- (ntohl(addr.ip) & 0xff000000) == 0x7f000000) { +- set_h225_addr(skb, protoff, data, 0, &taddr[0], +- &ct->tuplehash[!dir].tuple.dst.u3, +- info->sig_port[!dir]); +- } +- } else { ++ htons(nated_port))) { + nf_ct_unexpect_related(exp); + return -1; + } + ++ /* Save ports */ ++ info->sig_port[dir] = port; ++ info->sig_port[!dir] = htons(nated_port); ++ ++ /* Fix for Gnomemeeting */ ++ if (idx > 0 && ++ get_h225_addr(ct, *data, &taddr[0], &addr, &port) && ++ (ntohl(addr.ip) & 0xff000000) == 0x7f000000) { ++ if (set_h225_addr(skb, protoff, data, 0, &taddr[0], ++ &ct->tuplehash[!dir].tuple.dst.u3, ++ info->sig_port[!dir])) { ++ nf_ct_unexpect_related(exp); ++ return -1; ++ } ++ } ++ + /* Success */ + pr_debug("nf_nat_ras: expect Q.931 %pI4:%hu->%pI4:%hu\n", + &exp->tuple.src.u3.ip, +@@ -550,9 +553,9 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct, + } + + /* Modify signal */ +- if (!set_h225_addr(skb, protoff, data, dataoff, taddr, +- &ct->tuplehash[!dir].tuple.dst.u3, +- htons(nated_port)) == 0) { ++ if (set_h225_addr(skb, protoff, data, dataoff, taddr, ++ &ct->tuplehash[!dir].tuple.dst.u3, ++ htons(nated_port))) { + nf_ct_unexpect_related(exp); + return -1; + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index e4b0fb2f06a3..d7105422bc63 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -614,7 +614,6 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; +- struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -627,25 +626,6 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; +- +- if (p->flags & IP6_TNL_F_CAP_XMIT) { +- int strict = (ipv6_addr_type(&p->raddr) & +- (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); +- struct rt6_info *rt = rt6_lookup(t->net, +- &p->raddr, &p->laddr, +- p->link, strict); +- +- if (rt) +- tdev = rt->dst.dev; +- ip6_rt_put(rt); +- } +- +- if (!tdev && p->link) +- tdev = __dev_get_by_index(t->net, p->link); +- +- if (tdev) +- dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, +- IPV6_MIN_MTU); + } + + /** +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 660939df7c94..4ece07c68b3f 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -999,9 +999,8 @@ static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = { + + static int + ctnetlink_parse_tuple(const struct nlattr * const cda[], +- struct nf_conntrack_tuple *tuple, +- enum ctattr_type type, u_int8_t l3num, +- struct nf_conntrack_zone *zone) ++ struct nf_conntrack_tuple *tuple, u32 type, ++ u_int8_t l3num, struct nf_conntrack_zone *zone) + { + struct nlattr *tb[CTA_TUPLE_MAX+1]; + int err; +@@ -2416,7 +2415,7 @@ static struct nfnl_ct_hook ctnetlink_glue_hook = { + static inline int + ctnetlink_exp_dump_tuple(struct sk_buff *skb, + const struct nf_conntrack_tuple *tuple, +- enum ctattr_expect type) ++ u32 type) + { + struct nlattr *nest_parms; + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 34ae20490c94..1f3c305df45d 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -366,6 +366,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto) + return buf; + } + ++/** ++ * xt_check_proc_name - check that name is suitable for /proc file creation ++ * ++ * @name: file name candidate ++ * @size: length of buffer ++ * ++ * some x_tables modules wish to create a file in /proc. ++ * This function makes sure that the name is suitable for this ++ * purpose, it checks that name is NUL terminated and isn't a 'special' ++ * name, like "..". ++ * ++ * returns negative number on error or 0 if name is useable. ++ */ ++int xt_check_proc_name(const char *name, unsigned int size) ++{ ++ if (name[0] == '\0') ++ return -EINVAL; ++ ++ if (strnlen(name, size) == size) ++ return -ENAMETOOLONG; ++ ++ if (strcmp(name, ".") == 0 || ++ strcmp(name, "..") == 0 || ++ strchr(name, '/')) ++ return -EINVAL; ++ ++ return 0; ++} ++EXPORT_SYMBOL(xt_check_proc_name); ++ + int xt_check_match(struct xt_mtchk_param *par, + unsigned int size, u_int8_t proto, bool inv_proto) + { +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index 178696852bde..7381be0cdcdf 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -668,8 +668,9 @@ static int hashlimit_mt_check(const struct xt_mtchk_param *par) + + if (info->cfg.gc_interval == 0 || info->cfg.expire == 0) + return -EINVAL; +- if (info->name[sizeof(info->name)-1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + if (par->family == NFPROTO_IPV4) { + if (info->cfg.srcmask > 32 || info->cfg.dstmask > 32) + return -EINVAL; +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index d725a27743a1..cd53b861a15c 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -364,9 +364,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par, + info->hit_count, XT_RECENT_MAX_NSTAMPS - 1); + return -EINVAL; + } +- if (info->name[0] == '\0' || +- strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN) +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot) + nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1; +diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c +index ccfdc7115a83..a00ec715aa46 100644 +--- a/net/xfrm/xfrm_ipcomp.c ++++ b/net/xfrm/xfrm_ipcomp.c +@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name) + struct crypto_comp *tfm; + + /* This can be any valid CPU ID so we don't need locking. */ +- tfm = __this_cpu_read(*pos->tfms); ++ tfm = this_cpu_read(*pos->tfms); + + if (!strcmp(crypto_comp_name(tfm), alg_name)) { + pos->users++; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 96d664e198bf..34b5b4bcf5cb 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1845,6 +1845,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++#ifdef CONFIG_COMPAT ++ if (is_compat_task()) ++ return -EOPNOTSUPP; ++#endif ++ + if (!optval && !optlen) { + xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); + xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index fa856a07e40b..5d9f25cb6426 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p, + struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; + struct xfrm_replay_state_esn *rs; + +- if (p->flags & XFRM_STATE_ESN) { +- if (!rt) +- return -EINVAL; ++ if (!rt) ++ return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0; + +- rs = nla_data(rt); ++ rs = nla_data(rt); + +- if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) +- return -EINVAL; +- +- if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && +- nla_len(rt) != sizeof(*rs)) +- return -EINVAL; +- } ++ if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) ++ return -EINVAL; + +- if (!rt) +- return 0; ++ if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && ++ nla_len(rt) != sizeof(*rs)) ++ return -EINVAL; + + /* As only ESP and AH support ESN feature. */ + if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 4c7db967b7bb..4f690ab0feed 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -333,18 +333,6 @@ static void superblock_free_security(struct super_block *sb) + kfree(sbsec); + } + +-/* The file system's label must be initialized prior to use. */ +- +-static const char *labeling_behaviors[7] = { +- "uses xattr", +- "uses transition SIDs", +- "uses task SIDs", +- "uses genfs_contexts", +- "not configured for labeling", +- "uses mountpoint labeling", +- "uses native labeling", +-}; +- + static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry); + + static inline int inode_doinit(struct inode *inode) +@@ -456,10 +444,6 @@ static int sb_finish_set_opts(struct super_block *sb) + } + } + +- if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) +- printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n", +- sb->s_id, sb->s_type->name); +- + sbsec->flags |= SE_SBINITIALIZED; + if (selinux_is_sblabel_mnt(sb)) + sbsec->flags |= SBLABEL_MNT; +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index db7eff3573a9..23dca68ffe25 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -155,7 +155,7 @@ static int selinux_set_mapping(struct policydb *pol, + } + + k = 0; +- while (p_in->perms && p_in->perms[k]) { ++ while (p_in->perms[k]) { + /* An empty permission string skips ahead */ + if (!*p_in->perms[k]) { + k++; +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index daa1feac66bf..6cd8aec146f2 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1361,7 +1361,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha + static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +@@ -1468,7 +1468,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf, + static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 4ba64fd49759..ce2954a31238 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3408,7 +3408,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream, + area, + substream->runtime->dma_area, + substream->runtime->dma_addr, +- area->vm_end - area->vm_start); ++ substream->runtime->dma_bytes); + #endif /* CONFIG_X86 */ + /* mmap with fault handler */ + area->vm_ops = &snd_pcm_vm_ops_data_fault; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.127-128.patch b/patch/kernel/mvebu-default/04-patch-4.4.127-128.patch new file mode 100644 index 000000000..2a3959401 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.127-128.patch @@ -0,0 +1,5371 @@ +diff --git a/Makefile b/Makefile +index 58c0390573c1..575459bb47eb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 127 ++SUBLEVEL = 128 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts +index 96d7eede412e..036c9bd9bf75 100644 +--- a/arch/arm/boot/dts/imx53-qsrb.dts ++++ b/arch/arm/boot/dts/imx53-qsrb.dts +@@ -23,7 +23,7 @@ + imx53-qsrb { + pinctrl_pmic: pmicgrp { + fsl,pins = < +- MX53_PAD_CSI0_DAT5__GPIO5_23 0x1e4 /* IRQ */ ++ MX53_PAD_CSI0_DAT5__GPIO5_23 0x1c4 /* IRQ */ + >; + }; + }; +diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi +index 9e096d811bed..7a032dd84bb2 100644 +--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi +@@ -88,6 +88,7 @@ + clocks = <&clks 201>; + VDDA-supply = <®_2p5v>; + VDDIO-supply = <®_3p3v>; ++ lrclk-strength = <3>; + }; + }; + +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index 9430a9928199..00de37fe5f8a 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -132,7 +132,7 @@ + }; + + esdhc: esdhc@1560000 { +- compatible = "fsl,esdhc"; ++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc"; + reg = <0x0 0x1560000 0x0 0x10000>; + interrupts = ; + clock-frequency = <0>; +diff --git a/arch/arm/include/asm/xen/events.h b/arch/arm/include/asm/xen/events.h +index 71e473d05fcc..620dc75362e5 100644 +--- a/arch/arm/include/asm/xen/events.h ++++ b/arch/arm/include/asm/xen/events.h +@@ -16,7 +16,7 @@ static inline int xen_irqs_disabled(struct pt_regs *regs) + return raw_irqs_disabled_flags(regs->ARM_cpsr); + } + +-#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((ptr), \ ++#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((long long*)(ptr),\ + atomic64_t, \ + counter), (val)) + +diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c +index 28c90bc372bd..78d325f3245a 100644 +--- a/arch/arm/mach-davinci/devices-da8xx.c ++++ b/arch/arm/mach-davinci/devices-da8xx.c +@@ -795,6 +795,8 @@ static struct platform_device da8xx_dsp = { + .resource = da8xx_rproc_resources, + }; + ++static bool rproc_mem_inited __initdata; ++ + #if IS_ENABLED(CONFIG_DA8XX_REMOTEPROC) + + static phys_addr_t rproc_base __initdata; +@@ -833,6 +835,8 @@ void __init da8xx_rproc_reserve_cma(void) + ret = dma_declare_contiguous(&da8xx_dsp.dev, rproc_size, rproc_base, 0); + if (ret) + pr_err("%s: dma_declare_contiguous failed %d\n", __func__, ret); ++ else ++ rproc_mem_inited = true; + } + + #else +@@ -847,6 +851,12 @@ int __init da8xx_register_rproc(void) + { + int ret; + ++ if (!rproc_mem_inited) { ++ pr_warn("%s: memory not reserved for DSP, not registering DSP device\n", ++ __func__); ++ return -ENOMEM; ++ } ++ + ret = platform_device_register(&da8xx_dsp); + if (ret) + pr_err("%s: can't register DSP device: %d\n", __func__, ret); +diff --git a/arch/arm/mach-imx/cpu.c b/arch/arm/mach-imx/cpu.c +index 5b0f752d5507..24be631e487d 100644 +--- a/arch/arm/mach-imx/cpu.c ++++ b/arch/arm/mach-imx/cpu.c +@@ -133,6 +133,9 @@ struct device * __init imx_soc_device_init(void) + case MXC_CPU_IMX6UL: + soc_id = "i.MX6UL"; + break; ++ case MXC_CPU_IMX6ULL: ++ soc_id = "i.MX6ULL"; ++ break; + case MXC_CPU_IMX7D: + soc_id = "i.MX7D"; + break; +diff --git a/arch/arm/mach-imx/mxc.h b/arch/arm/mach-imx/mxc.h +index a5b1af6d7441..478cd91d0885 100644 +--- a/arch/arm/mach-imx/mxc.h ++++ b/arch/arm/mach-imx/mxc.h +@@ -39,6 +39,7 @@ + #define MXC_CPU_IMX6SX 0x62 + #define MXC_CPU_IMX6Q 0x63 + #define MXC_CPU_IMX6UL 0x64 ++#define MXC_CPU_IMX6ULL 0x65 + #define MXC_CPU_IMX7D 0x72 + + #define IMX_DDR_TYPE_LPDDR2 1 +@@ -171,6 +172,11 @@ static inline bool cpu_is_imx6ul(void) + return __mxc_cpu_type == MXC_CPU_IMX6UL; + } + ++static inline bool cpu_is_imx6ull(void) ++{ ++ return __mxc_cpu_type == MXC_CPU_IMX6ULL; ++} ++ + static inline bool cpu_is_imx6q(void) + { + return __mxc_cpu_type == MXC_CPU_IMX6Q; +diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h +index 5f3ab8c1db55..f50753573989 100644 +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -53,16 +53,16 @@ + : "memory") + + static inline int +-futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) ++futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr) + { + int op = (encoded_op >> 28) & 7; + int cmp = (encoded_op >> 24) & 15; +- int oparg = (encoded_op << 8) >> 20; +- int cmparg = (encoded_op << 20) >> 20; ++ int oparg = (int)(encoded_op << 8) >> 20; ++ int cmparg = (int)(encoded_op << 20) >> 20; + int oldval = 0, ret, tmp; + + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) +- oparg = 1 << oparg; ++ oparg = 1U << (oparg & 0x1f); + + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) + return -EFAULT; +diff --git a/arch/mips/include/asm/kprobes.h b/arch/mips/include/asm/kprobes.h +index daba1f9a4f79..174aedce3167 100644 +--- a/arch/mips/include/asm/kprobes.h ++++ b/arch/mips/include/asm/kprobes.h +@@ -40,7 +40,8 @@ typedef union mips_instruction kprobe_opcode_t; + + #define flush_insn_slot(p) \ + do { \ +- flush_icache_range((unsigned long)p->addr, \ ++ if (p->addr) \ ++ flush_icache_range((unsigned long)p->addr, \ + (unsigned long)p->addr + \ + (MAX_INSN_SIZE * sizeof(kprobe_opcode_t))); \ + } while (0) +diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h +index 832e2167d00f..ef7c02af7522 100644 +--- a/arch/mips/include/asm/pgtable-32.h ++++ b/arch/mips/include/asm/pgtable-32.h +@@ -18,6 +18,10 @@ + + #include + ++#ifdef CONFIG_HIGHMEM ++#include ++#endif ++ + extern int temp_tlb_entry; + + /* +@@ -61,7 +65,8 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1, + + #define VMALLOC_START MAP_BASE + +-#define PKMAP_BASE (0xfe000000UL) ++#define PKMAP_END ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1)) ++#define PKMAP_BASE (PKMAP_END - PAGE_SIZE * LAST_PKMAP) + + #ifdef CONFIG_HIGHMEM + # define VMALLOC_END (PKMAP_BASE-2*PAGE_SIZE) +diff --git a/arch/mips/mm/pgtable-32.c b/arch/mips/mm/pgtable-32.c +index adc6911ba748..b19a3c506b1e 100644 +--- a/arch/mips/mm/pgtable-32.c ++++ b/arch/mips/mm/pgtable-32.c +@@ -51,15 +51,15 @@ void __init pagetable_init(void) + /* + * Fixed mappings: + */ +- vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK; +- fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base); ++ vaddr = __fix_to_virt(__end_of_fixed_addresses - 1); ++ fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base); + + #ifdef CONFIG_HIGHMEM + /* + * Permanent kmaps: + */ + vaddr = PKMAP_BASE; +- fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base); ++ fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base); + + pgd = swapper_pg_dir + __pgd_offset(vaddr); + pud = pud_offset(pgd, vaddr); +diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h +index 3140c19c448c..70b379ee6b7e 100644 +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -132,7 +132,19 @@ extern long long virt_phys_offset; + #define virt_to_pfn(kaddr) (__pa(kaddr) >> PAGE_SHIFT) + #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr)) + #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT) ++ ++#ifdef CONFIG_PPC_BOOK3S_64 ++/* ++ * On hash the vmalloc and other regions alias to the kernel region when passed ++ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can ++ * return true for some vmalloc addresses, which is incorrect. So explicitly ++ * check that the address is in the kernel region. ++ */ ++#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \ ++ pfn_valid(virt_to_pfn(kaddr))) ++#else + #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) ++#endif + + /* + * On Book-E parts we need __va to parse the device tree and we can't +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 1be1092c7204..9baba9576e99 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -686,12 +686,20 @@ static int __init get_freq(char *name, int cells, unsigned long *val) + static void start_cpu_decrementer(void) + { + #if defined(CONFIG_BOOKE) || defined(CONFIG_40x) ++ unsigned int tcr; ++ + /* Clear any pending timer interrupts */ + mtspr(SPRN_TSR, TSR_ENW | TSR_WIS | TSR_DIS | TSR_FIS); + +- /* Enable decrementer interrupt */ +- mtspr(SPRN_TCR, TCR_DIE); +-#endif /* defined(CONFIG_BOOKE) || defined(CONFIG_40x) */ ++ tcr = mfspr(SPRN_TCR); ++ /* ++ * The watchdog may have already been enabled by u-boot. So leave ++ * TRC[WP] (Watchdog Period) alone. ++ */ ++ tcr &= TCR_WP_MASK; /* Clear all bits except for TCR[WP] */ ++ tcr |= TCR_DIE; /* Enable decrementer */ ++ mtspr(SPRN_TCR, tcr); ++#endif + } + + void __init generic_calibrate_decr(void) +diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c +index f2c75a1e0536..0d91baf63fed 100644 +--- a/arch/powerpc/kvm/book3s_pr_papr.c ++++ b/arch/powerpc/kvm/book3s_pr_papr.c +@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu) + pteg_addr = get_pteg_addr(vcpu, pte_index); + + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg))) ++ goto done; + hpte = pteg; + + ret = H_PTEG_FULL; +@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu) + hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6)); + hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7)); + pteg_addr += i * HPTE_SIZE; +- copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE)) ++ goto done; + kvmppc_set_gpr(vcpu, 4, pte_index | i); + ret = H_SUCCESS; + +@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu) + + pteg = get_pteg_addr(vcpu, pte_index); + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) ++ goto done; + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu) + ((flags & H_ANDCOND) && (pte[0] & avpn) != 0)) + goto done; + +- copy_to_user((void __user *)pteg, &v, sizeof(v)); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) ++ goto done; + + rb = compute_tlbie_rb(pte[0], pte[1], pte_index); + vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false); +@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu) + } + + pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) { ++ ret = H_FUNCTION; ++ break; ++ } + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu) + tsh |= H_BULK_REMOVE_NOT_FOUND; + } else { + /* Splat the pteg in (userland) hpt */ +- copy_to_user((void __user *)pteg, &v, sizeof(v)); ++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) { ++ ret = H_FUNCTION; ++ break; ++ } + + rb = compute_tlbie_rb(pte[0], pte[1], + tsh & H_BULK_REMOVE_PTEX); +@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu) + + pteg = get_pteg_addr(vcpu, pte_index); + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) ++ goto done; + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu) + vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false); + pte[0] = (__force u64)cpu_to_be64(pte[0]); + pte[1] = (__force u64)cpu_to_be64(pte[1]); +- copy_to_user((void __user *)pteg, pte, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg, pte, sizeof(pte))) ++ goto done; + ret = H_SUCCESS; + + done: +diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c +index be6212ddbf06..7e42e3ec2142 100644 +--- a/arch/powerpc/platforms/cell/spufs/coredump.c ++++ b/arch/powerpc/platforms/cell/spufs/coredump.c +@@ -174,6 +174,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i, + if (!dump_skip(cprm, + roundup(cprm->written - total + sz, 4) - cprm->written)) + goto Eio; ++ ++ rc = 0; + out: + free_page((unsigned long)buf); + return rc; +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 445657fe658c..6c553f6e791a 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -21,8 +21,14 @@ SECTIONS + { + . = 0x00000000; + .text : { +- _text = .; /* Text and read-only data */ ++ /* Text and read-only data */ + HEAD_TEXT ++ /* ++ * E.g. perf doesn't like symbols starting at address zero, ++ * therefore skip the initial PSW and channel program located ++ * at address zero and let _text start at 0x200. ++ */ ++ _text = 0x200; + TEXT_TEXT + SCHED_TEXT + LOCK_TEXT +diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c +index 59d503866431..9cc600b2d68c 100644 +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channel *lp, void *buf, unsigned int size) + + lp->rcv_nxt = p->seqid; + ++ /* ++ * If this is a control-only packet, there is nothing ++ * else to do but advance the rx queue since the packet ++ * was already processed above. ++ */ + if (!(p->type & LDC_DATA)) { + new = rx_advance(lp, new); +- goto no_data; ++ break; + } + if (p->stype & (LDC_ACK | LDC_NACK)) { + err = data_ack_nack(lp, p); +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index c7c4d9c51e99..eb02087650d2 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -365,6 +365,8 @@ static int __init tsc_setup(char *str) + tsc_clocksource_reliable = 1; + if (!strncmp(str, "noirqtime", 9)) + no_sched_irq_time = 1; ++ if (!strcmp(str, "unstable")) ++ mark_tsc_unstable("boot parameter"); + return 1; + } + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 2038e5bacce6..42654375b73f 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1386,6 +1386,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu, + */ + if (var->unusable) + var->db = 0; ++ /* This is symmetric with svm_set_segment() */ + var->dpl = to_svm(vcpu)->vmcb->save.cpl; + break; + } +@@ -1531,18 +1532,14 @@ static void svm_set_segment(struct kvm_vcpu *vcpu, + s->base = var->base; + s->limit = var->limit; + s->selector = var->selector; +- if (var->unusable) +- s->attrib = 0; +- else { +- s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK); +- s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT; +- s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT; +- s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT; +- s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT; +- s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT; +- s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT; +- s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT; +- } ++ s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK); ++ s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT; ++ s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT; ++ s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT; ++ s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT; ++ s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT; ++ s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT; ++ s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT; + + /* + * This is always accurate, except if SYSRET returned to a segment +@@ -1551,7 +1548,8 @@ static void svm_set_segment(struct kvm_vcpu *vcpu, + * would entail passing the CPL to userspace and back. + */ + if (seg == VCPU_SREG_SS) +- svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3; ++ /* This is symmetric with svm_get_segment() */ ++ svm->vmcb->save.cpl = (var->dpl & 3); + + mark_dirty(svm->vmcb, VMCB_SEG); + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 46bbc69844bd..528b4352fa99 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7657,11 +7657,13 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu, + { + unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION); + int cr = exit_qualification & 15; +- int reg = (exit_qualification >> 8) & 15; +- unsigned long val = kvm_register_readl(vcpu, reg); ++ int reg; ++ unsigned long val; + + switch ((exit_qualification >> 4) & 3) { + case 0: /* mov to cr */ ++ reg = (exit_qualification >> 8) & 15; ++ val = kvm_register_readl(vcpu, reg); + switch (cr) { + case 0: + if (vmcs12->cr0_guest_host_mask & +@@ -7716,6 +7718,7 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu, + * lmsw can change bits 1..3 of cr0, and only set bit 0 of + * cr0. Other attempted changes are ignored, with no exit. + */ ++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f; + if (vmcs12->cr0_guest_host_mask & 0xe & + (val ^ vmcs12->cr0_read_shadow)) + return true; +diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S +index 7e48807b2fa1..45a53dfe1859 100644 +--- a/arch/x86/lib/csum-copy_64.S ++++ b/arch/x86/lib/csum-copy_64.S +@@ -55,7 +55,7 @@ ENTRY(csum_partial_copy_generic) + movq %r12, 3*8(%rsp) + movq %r14, 4*8(%rsp) + movq %r13, 5*8(%rsp) +- movq %rbp, 6*8(%rsp) ++ movq %r15, 6*8(%rsp) + + movq %r8, (%rsp) + movq %r9, 1*8(%rsp) +@@ -74,7 +74,7 @@ ENTRY(csum_partial_copy_generic) + /* main loop. clear in 64 byte blocks */ + /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */ + /* r11: temp3, rdx: temp4, r12 loopcnt */ +- /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */ ++ /* r10: temp5, r15: temp6, r14 temp7, r13 temp8 */ + .p2align 4 + .Lloop: + source +@@ -89,7 +89,7 @@ ENTRY(csum_partial_copy_generic) + source + movq 32(%rdi), %r10 + source +- movq 40(%rdi), %rbp ++ movq 40(%rdi), %r15 + source + movq 48(%rdi), %r14 + source +@@ -103,7 +103,7 @@ ENTRY(csum_partial_copy_generic) + adcq %r11, %rax + adcq %rdx, %rax + adcq %r10, %rax +- adcq %rbp, %rax ++ adcq %r15, %rax + adcq %r14, %rax + adcq %r13, %rax + +@@ -121,7 +121,7 @@ ENTRY(csum_partial_copy_generic) + dest + movq %r10, 32(%rsi) + dest +- movq %rbp, 40(%rsi) ++ movq %r15, 40(%rsi) + dest + movq %r14, 48(%rsi) + dest +@@ -203,7 +203,7 @@ ENTRY(csum_partial_copy_generic) + movq 3*8(%rsp), %r12 + movq 4*8(%rsp), %r14 + movq 5*8(%rsp), %r13 +- movq 6*8(%rsp), %rbp ++ movq 6*8(%rsp), %r15 + addq $7*8, %rsp + ret + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index f6325d573c10..6e091ccadcd4 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio) + if (!bio_is_rw(bio)) + return false; + ++ if (!bio_sectors(bio)) ++ return false; ++ + /* Already protected? */ + if (bio_integrity(bio)) + return false; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 0d1af3e44efb..8649dbf06ce4 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1252,13 +1252,13 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + + blk_queue_bounce(q, &bio); + ++ blk_queue_split(q, &bio, q->bio_split); ++ + if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) { + bio_io_error(bio); + return BLK_QC_T_NONE; + } + +- blk_queue_split(q, &bio, q->bio_split); +- + if (!is_flush_fua && !blk_queue_nomerges(q) && + blk_attempt_plug_merge(q, bio, &request_count, &same_queue_rq)) + return BLK_QC_T_NONE; +@@ -1634,7 +1634,8 @@ static void blk_mq_exit_hctx(struct request_queue *q, + { + unsigned flush_start_tag = set->queue_depth; + +- blk_mq_tag_idle(hctx); ++ if (blk_mq_hw_queue_mapped(hctx)) ++ blk_mq_tag_idle(hctx); + + if (set->ops->exit_request) + set->ops->exit_request(set->driver_data, +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 3c062699f28b..29521753fb23 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -309,8 +309,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno, + + if (info) { + struct partition_meta_info *pinfo = alloc_part_info(disk); +- if (!pinfo) ++ if (!pinfo) { ++ err = -ENOMEM; + goto out_free_stats; ++ } + memcpy(pinfo, info, sizeof(*info)); + p->info = pinfo; + } +diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c +index 84f8d4d8b6bc..09f706b7b06e 100644 +--- a/crypto/async_tx/async_pq.c ++++ b/crypto/async_tx/async_pq.c +@@ -62,9 +62,6 @@ do_async_gen_syndrome(struct dma_chan *chan, + dma_addr_t dma_dest[2]; + int src_off = 0; + +- if (submit->flags & ASYNC_TX_FENCE) +- dma_flags |= DMA_PREP_FENCE; +- + while (src_cnt > 0) { + submit->flags = flags_orig; + pq_src_cnt = min(src_cnt, dma_maxpq(dma, dma_flags)); +@@ -83,6 +80,8 @@ do_async_gen_syndrome(struct dma_chan *chan, + if (cb_fn_orig) + dma_flags |= DMA_PREP_INTERRUPT; + } ++ if (submit->flags & ASYNC_TX_FENCE) ++ dma_flags |= DMA_PREP_FENCE; + + /* Drivers force forward progress in case they can not provide + * a descriptor +diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c +index 10ce48e16ebf..d830705f8a18 100644 +--- a/drivers/acpi/acpica/evxfevnt.c ++++ b/drivers/acpi/acpica/evxfevnt.c +@@ -180,6 +180,12 @@ acpi_status acpi_enable_event(u32 event, u32 flags) + + ACPI_FUNCTION_TRACE(acpi_enable_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { +@@ -237,6 +243,12 @@ acpi_status acpi_disable_event(u32 event, u32 flags) + + ACPI_FUNCTION_TRACE(acpi_disable_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { +@@ -290,6 +302,12 @@ acpi_status acpi_clear_event(u32 event) + + ACPI_FUNCTION_TRACE(acpi_clear_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { +diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c +index e54bc2aa7a88..a05b3b79b987 100644 +--- a/drivers/acpi/acpica/psobject.c ++++ b/drivers/acpi/acpica/psobject.c +@@ -121,6 +121,9 @@ static acpi_status acpi_ps_get_aml_opcode(struct acpi_walk_state *walk_state) + (u32)(aml_offset + + sizeof(struct acpi_table_header))); + ++ ACPI_ERROR((AE_INFO, ++ "Aborting disassembly, AML byte code is corrupt")); ++ + /* Dump the context surrounding the invalid opcode */ + + acpi_ut_dump_buffer(((u8 *)walk_state->parser_state. +@@ -129,6 +132,14 @@ static acpi_status acpi_ps_get_aml_opcode(struct acpi_walk_state *walk_state) + sizeof(struct acpi_table_header) - + 16)); + acpi_os_printf(" */\n"); ++ ++ /* ++ * Just abort the disassembly, cannot continue because the ++ * parser is essentially lost. The disassembler can then ++ * randomly fail because an ill-constructed parse tree ++ * can result. ++ */ ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + #endif + } + +@@ -293,6 +304,9 @@ acpi_ps_create_op(struct acpi_walk_state *walk_state, + if (status == AE_CTRL_PARSE_CONTINUE) { + return_ACPI_STATUS(AE_CTRL_PARSE_CONTINUE); + } ++ if (ACPI_FAILURE(status)) { ++ return_ACPI_STATUS(status); ++ } + + /* Create Op structure and append to parent's argument list */ + +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index aaa761b9081c..cd2eab6aa92e 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev, + + irq = platform_get_irq(pdev, 0); + if (irq <= 0) { +- dev_err(dev, "no irq\n"); +- return -EINVAL; ++ if (irq != -EPROBE_DEFER) ++ dev_err(dev, "no irq\n"); ++ return irq; + } + + hpriv->irq = irq; +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 3e65ae144fde..1dd16f26e77d 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -623,6 +623,9 @@ static int loop_switch(struct loop_device *lo, struct file *file) + */ + static int loop_flush(struct loop_device *lo) + { ++ /* loop not yet configured, no running thread, nothing to flush */ ++ if (lo->lo_state != Lo_bound) ++ return 0; + return loop_switch(lo, NULL); + } + +diff --git a/drivers/bus/brcmstb_gisb.c b/drivers/bus/brcmstb_gisb.c +index f364fa4d24eb..f59183018280 100644 +--- a/drivers/bus/brcmstb_gisb.c ++++ b/drivers/bus/brcmstb_gisb.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (C) 2014 Broadcom Corporation ++ * Copyright (C) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -33,8 +33,6 @@ + #define ARB_ERR_CAP_CLEAR (1 << 0) + #define ARB_ERR_CAP_STATUS_TIMEOUT (1 << 12) + #define ARB_ERR_CAP_STATUS_TEA (1 << 11) +-#define ARB_ERR_CAP_STATUS_BS_SHIFT (1 << 2) +-#define ARB_ERR_CAP_STATUS_BS_MASK 0x3c + #define ARB_ERR_CAP_STATUS_WRITE (1 << 1) + #define ARB_ERR_CAP_STATUS_VALID (1 << 0) + +@@ -43,7 +41,6 @@ enum { + ARB_ERR_CAP_CLR, + ARB_ERR_CAP_HI_ADDR, + ARB_ERR_CAP_ADDR, +- ARB_ERR_CAP_DATA, + ARB_ERR_CAP_STATUS, + ARB_ERR_CAP_MASTER, + }; +@@ -53,7 +50,6 @@ static const int gisb_offsets_bcm7038[] = { + [ARB_ERR_CAP_CLR] = 0x0c4, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x0c8, +- [ARB_ERR_CAP_DATA] = 0x0cc, + [ARB_ERR_CAP_STATUS] = 0x0d0, + [ARB_ERR_CAP_MASTER] = -1, + }; +@@ -63,7 +59,6 @@ static const int gisb_offsets_bcm7400[] = { + [ARB_ERR_CAP_CLR] = 0x0c8, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x0cc, +- [ARB_ERR_CAP_DATA] = 0x0d0, + [ARB_ERR_CAP_STATUS] = 0x0d4, + [ARB_ERR_CAP_MASTER] = 0x0d8, + }; +@@ -73,7 +68,6 @@ static const int gisb_offsets_bcm7435[] = { + [ARB_ERR_CAP_CLR] = 0x168, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x16c, +- [ARB_ERR_CAP_DATA] = 0x170, + [ARB_ERR_CAP_STATUS] = 0x174, + [ARB_ERR_CAP_MASTER] = 0x178, + }; +@@ -83,7 +77,6 @@ static const int gisb_offsets_bcm7445[] = { + [ARB_ERR_CAP_CLR] = 0x7e4, + [ARB_ERR_CAP_HI_ADDR] = 0x7e8, + [ARB_ERR_CAP_ADDR] = 0x7ec, +- [ARB_ERR_CAP_DATA] = 0x7f0, + [ARB_ERR_CAP_STATUS] = 0x7f4, + [ARB_ERR_CAP_MASTER] = 0x7f8, + }; +@@ -105,9 +98,13 @@ static u32 gisb_read(struct brcmstb_gisb_arb_device *gdev, int reg) + { + int offset = gdev->gisb_offsets[reg]; + +- /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */ +- if (offset == -1) +- return 1; ++ if (offset < 0) { ++ /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */ ++ if (reg == ARB_ERR_CAP_MASTER) ++ return 1; ++ else ++ return 0; ++ } + + if (gdev->big_endian) + return ioread32be(gdev->base + offset); +@@ -115,6 +112,16 @@ static u32 gisb_read(struct brcmstb_gisb_arb_device *gdev, int reg) + return ioread32(gdev->base + offset); + } + ++static u64 gisb_read_address(struct brcmstb_gisb_arb_device *gdev) ++{ ++ u64 value; ++ ++ value = gisb_read(gdev, ARB_ERR_CAP_ADDR); ++ value |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32; ++ ++ return value; ++} ++ + static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg) + { + int offset = gdev->gisb_offsets[reg]; +@@ -123,9 +130,9 @@ static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg) + return; + + if (gdev->big_endian) +- iowrite32be(val, gdev->base + reg); ++ iowrite32be(val, gdev->base + offset); + else +- iowrite32(val, gdev->base + reg); ++ iowrite32(val, gdev->base + offset); + } + + static ssize_t gisb_arb_get_timeout(struct device *dev, +@@ -181,7 +188,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev, + const char *reason) + { + u32 cap_status; +- unsigned long arb_addr; ++ u64 arb_addr; + u32 master; + const char *m_name; + char m_fmt[11]; +@@ -193,10 +200,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev, + return 1; + + /* Read the address and master */ +- arb_addr = gisb_read(gdev, ARB_ERR_CAP_ADDR) & 0xffffffff; +-#if (IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT)) +- arb_addr |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32; +-#endif ++ arb_addr = gisb_read_address(gdev); + master = gisb_read(gdev, ARB_ERR_CAP_MASTER); + + m_name = brcmstb_gisb_master_to_str(gdev, master); +@@ -205,7 +209,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev, + m_name = m_fmt; + } + +- pr_crit("%s: %s at 0x%lx [%c %s], core: %s\n", ++ pr_crit("%s: %s at 0x%llx [%c %s], core: %s\n", + __func__, reason, arb_addr, + cap_status & ARB_ERR_CAP_STATUS_WRITE ? 'W' : 'R', + cap_status & ARB_ERR_CAP_STATUS_TIMEOUT ? "timeout" : "", +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index f53e8ba2c718..83c206f0fc98 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -409,6 +409,7 @@ static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags) + msg = ipmi_alloc_smi_msg(); + if (!msg) { + ssif_info->ssif_state = SSIF_NORMAL; ++ ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } + +@@ -431,6 +432,7 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info, + msg = ipmi_alloc_smi_msg(); + if (!msg) { + ssif_info->ssif_state = SSIF_NORMAL; ++ ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } + +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 1822472dffab..bd9fc2baa6aa 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -886,12 +886,16 @@ static void add_interrupt_bench(cycles_t start) + static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs) + { + __u32 *ptr = (__u32 *) regs; ++ unsigned int idx; + + if (regs == NULL) + return 0; +- if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32)) +- f->reg_idx = 0; +- return *(ptr + f->reg_idx++); ++ idx = READ_ONCE(f->reg_idx); ++ if (idx >= sizeof(struct pt_regs) / sizeof(__u32)) ++ idx = 0; ++ ptr += idx++; ++ WRITE_ONCE(f->reg_idx, idx); ++ return *ptr; + } + + void add_interrupt_randomness(int irq, int irq_flags) +diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c +index 43a218f35b19..4ad32ce428cf 100644 +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -106,7 +106,7 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier) + + rc = clk_set_rate(clk, rate); + if (rc < 0) +- pr_err("clk: couldn't set %s clk rate to %d (%d), current rate: %ld\n", ++ pr_err("clk: couldn't set %s clk rate to %u (%d), current rate: %lu\n", + __clk_get_name(clk), rate, rc, + clk_get_rate(clk)); + clk_put(clk); +diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c +index cd0f2726f5e0..c40445488d3a 100644 +--- a/drivers/clk/clk-scpi.c ++++ b/drivers/clk/clk-scpi.c +@@ -71,15 +71,15 @@ static const struct clk_ops scpi_clk_ops = { + }; + + /* find closest match to given frequency in OPP table */ +-static int __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate) ++static long __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate) + { + int idx; +- u32 fmin = 0, fmax = ~0, ftmp; ++ unsigned long fmin = 0, fmax = ~0, ftmp; + const struct scpi_opp *opp = clk->info->opps; + + for (idx = 0; idx < clk->info->count; idx++, opp++) { + ftmp = opp->freq; +- if (ftmp >= (u32)rate) { ++ if (ftmp >= rate) { + if (ftmp <= fmax) + fmax = ftmp; + break; +diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c +index a5c111b67f37..ea11a33e7fff 100644 +--- a/drivers/cpuidle/dt_idle_states.c ++++ b/drivers/cpuidle/dt_idle_states.c +@@ -174,8 +174,10 @@ int dt_init_idle_driver(struct cpuidle_driver *drv, + if (!state_node) + break; + +- if (!of_device_is_available(state_node)) ++ if (!of_device_is_available(state_node)) { ++ of_node_put(state_node); + continue; ++ } + + if (!idle_state_valid(state_node, i, cpumask)) { + pr_warn("%s idle state not valid, bailing out\n", +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index f8d740a6740d..48d4dddf4941 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -1722,17 +1722,24 @@ static int sdma_probe(struct platform_device *pdev) + if (IS_ERR(sdma->clk_ahb)) + return PTR_ERR(sdma->clk_ahb); + +- clk_prepare(sdma->clk_ipg); +- clk_prepare(sdma->clk_ahb); ++ ret = clk_prepare(sdma->clk_ipg); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare(sdma->clk_ahb); ++ if (ret) ++ goto err_clk; + + ret = devm_request_irq(&pdev->dev, irq, sdma_int_handler, 0, "sdma", + sdma); + if (ret) +- return ret; ++ goto err_irq; + + sdma->script_addrs = kzalloc(sizeof(*sdma->script_addrs), GFP_KERNEL); +- if (!sdma->script_addrs) +- return -ENOMEM; ++ if (!sdma->script_addrs) { ++ ret = -ENOMEM; ++ goto err_irq; ++ } + + /* initially no scripts available */ + saddr_arr = (s32 *)sdma->script_addrs; +@@ -1847,6 +1854,10 @@ err_register: + dma_async_device_unregister(&sdma->dma_device); + err_init: + kfree(sdma->script_addrs); ++err_irq: ++ clk_unprepare(sdma->clk_ahb); ++err_clk: ++ clk_unprepare(sdma->clk_ipg); + return ret; + } + +@@ -1857,6 +1868,8 @@ static int sdma_remove(struct platform_device *pdev) + + dma_async_device_unregister(&sdma->dma_device); + kfree(sdma->script_addrs); ++ clk_unprepare(sdma->clk_ahb); ++ clk_unprepare(sdma->clk_ipg); + /* Kill the tasklet */ + for (i = 0; i < MAX_DMA_CHANNELS; i++) { + struct sdma_channel *sdmac = &sdma->channel[i]; +diff --git a/drivers/edac/mv64x60_edac.c b/drivers/edac/mv64x60_edac.c +index 0574e1bbe45c..3ce5609b4611 100644 +--- a/drivers/edac/mv64x60_edac.c ++++ b/drivers/edac/mv64x60_edac.c +@@ -763,7 +763,7 @@ static int mv64x60_mc_err_probe(struct platform_device *pdev) + /* Non-ECC RAM? */ + printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__); + res = -ENODEV; +- goto err2; ++ goto err; + } + + edac_dbg(3, "init mci\n"); +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 06d345b087f8..759a39906a52 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2145,7 +2145,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + return desc; + } + +- status = gpiod_request(desc, con_id); ++ /* If a connection label was passed use that, else use the device name as label */ ++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev)); + if (status < 0) + return ERR_PTR(status); + +diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c +index 7ed08fdc4c42..393e5335e33b 100644 +--- a/drivers/gpu/drm/omapdrm/omap_gem.c ++++ b/drivers/gpu/drm/omapdrm/omap_gem.c +@@ -158,7 +158,7 @@ static void evict_entry(struct drm_gem_object *obj, + size_t size = PAGE_SIZE * n; + loff_t off = mmap_offset(obj) + + (entry->obj_pgoff << PAGE_SHIFT); +- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE); ++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE); + + if (m > 1) { + int i; +@@ -415,7 +415,7 @@ static int fault_2d(struct drm_gem_object *obj, + * into account in some of the math, so figure out virtual stride + * in pages + */ +- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE); ++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE); + + /* We don't use vmf->pgoff since that has the fake offset: */ + pgoff = ((unsigned long)vmf->virtual_address - +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index b24f1d3045f0..a629f7c130f0 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -94,18 +94,20 @@ enum ina2xx_ids { ina219, ina226 }; + + struct ina2xx_config { + u16 config_default; +- int calibration_factor; ++ int calibration_value; + int registers; + int shunt_div; + int bus_voltage_shift; + int bus_voltage_lsb; /* uV */ +- int power_lsb; /* uW */ ++ int power_lsb_factor; + }; + + struct ina2xx_data { + const struct ina2xx_config *config; + + long rshunt; ++ long current_lsb_uA; ++ long power_lsb_uW; + struct mutex config_lock; + struct regmap *regmap; + +@@ -115,21 +117,21 @@ struct ina2xx_data { + static const struct ina2xx_config ina2xx_config[] = { + [ina219] = { + .config_default = INA219_CONFIG_DEFAULT, +- .calibration_factor = 40960000, ++ .calibration_value = 4096, + .registers = INA219_REGISTERS, + .shunt_div = 100, + .bus_voltage_shift = 3, + .bus_voltage_lsb = 4000, +- .power_lsb = 20000, ++ .power_lsb_factor = 20, + }, + [ina226] = { + .config_default = INA226_CONFIG_DEFAULT, +- .calibration_factor = 5120000, ++ .calibration_value = 2048, + .registers = INA226_REGISTERS, + .shunt_div = 400, + .bus_voltage_shift = 0, + .bus_voltage_lsb = 1250, +- .power_lsb = 25000, ++ .power_lsb_factor = 25, + }, + }; + +@@ -168,12 +170,16 @@ static u16 ina226_interval_to_reg(int interval) + return INA226_SHIFT_AVG(avg_bits); + } + ++/* ++ * Calibration register is set to the best value, which eliminates ++ * truncation errors on calculating current register in hardware. ++ * According to datasheet (eq. 3) the best values are 2048 for ++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value. ++ */ + static int ina2xx_calibrate(struct ina2xx_data *data) + { +- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- data->rshunt); +- +- return regmap_write(data->regmap, INA2XX_CALIBRATION, val); ++ return regmap_write(data->regmap, INA2XX_CALIBRATION, ++ data->config->calibration_value); + } + + /* +@@ -186,10 +192,6 @@ static int ina2xx_init(struct ina2xx_data *data) + if (ret < 0) + return ret; + +- /* +- * Set current LSB to 1mA, shunt is in uOhms +- * (equation 13 in datasheet). +- */ + return ina2xx_calibrate(data); + } + +@@ -267,15 +269,15 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg, + val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_POWER: +- val = regval * data->config->power_lsb; ++ val = regval * data->power_lsb_uW; + break; + case INA2XX_CURRENT: +- /* signed register, LSB=1mA (selected), in mA */ +- val = (s16)regval; ++ /* signed register, result in mA */ ++ val = regval * data->current_lsb_uA; ++ val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_CALIBRATION: +- val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- regval); ++ val = regval; + break; + default: + /* programmer goofed */ +@@ -303,9 +305,32 @@ static ssize_t ina2xx_show_value(struct device *dev, + ina2xx_get_value(data, attr->index, regval)); + } + +-static ssize_t ina2xx_set_shunt(struct device *dev, +- struct device_attribute *da, +- const char *buf, size_t count) ++/* ++ * In order to keep calibration register value fixed, the product ++ * of current_lsb and shunt_resistor should also be fixed and equal ++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order ++ * to keep the scale. ++ */ ++static int ina2xx_set_shunt(struct ina2xx_data *data, long val) ++{ ++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000, ++ data->config->shunt_div); ++ if (val <= 0 || val > dividend) ++ return -EINVAL; ++ ++ mutex_lock(&data->config_lock); ++ data->rshunt = val; ++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val); ++ data->power_lsb_uW = data->config->power_lsb_factor * ++ data->current_lsb_uA; ++ mutex_unlock(&data->config_lock); ++ ++ return 0; ++} ++ ++static ssize_t ina2xx_store_shunt(struct device *dev, ++ struct device_attribute *da, ++ const char *buf, size_t count) + { + unsigned long val; + int status; +@@ -315,18 +340,9 @@ static ssize_t ina2xx_set_shunt(struct device *dev, + if (status < 0) + return status; + +- if (val == 0 || +- /* Values greater than the calibration factor make no sense. */ +- val > data->config->calibration_factor) +- return -EINVAL; +- +- mutex_lock(&data->config_lock); +- data->rshunt = val; +- status = ina2xx_calibrate(data); +- mutex_unlock(&data->config_lock); ++ status = ina2xx_set_shunt(data, val); + if (status < 0) + return status; +- + return count; + } + +@@ -386,7 +402,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_set_shunt, ++ ina2xx_show_value, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +@@ -441,10 +457,7 @@ static int ina2xx_probe(struct i2c_client *client, + val = INA2XX_RSHUNT_DEFAULT; + } + +- if (val <= 0 || val > data->config->calibration_factor) +- return -ENODEV; +- +- data->rshunt = val; ++ ina2xx_set_shunt(data, val); + + ina2xx_regmap_config.max_register = data->config->registers; + +diff --git a/drivers/iio/adc/hi8435.c b/drivers/iio/adc/hi8435.c +index c73c6c62a6ac..7401f102dff4 100644 +--- a/drivers/iio/adc/hi8435.c ++++ b/drivers/iio/adc/hi8435.c +@@ -121,10 +121,21 @@ static int hi8435_write_event_config(struct iio_dev *idev, + enum iio_event_direction dir, int state) + { + struct hi8435_priv *priv = iio_priv(idev); ++ int ret; ++ u32 tmp; ++ ++ if (state) { ++ ret = hi8435_readl(priv, HI8435_SO31_0_REG, &tmp); ++ if (ret < 0) ++ return ret; ++ if (tmp & BIT(chan->channel)) ++ priv->event_prev_val |= BIT(chan->channel); ++ else ++ priv->event_prev_val &= ~BIT(chan->channel); + +- priv->event_scan_mask &= ~BIT(chan->channel); +- if (state) + priv->event_scan_mask |= BIT(chan->channel); ++ } else ++ priv->event_scan_mask &= ~BIT(chan->channel); + + return 0; + } +@@ -442,13 +453,15 @@ static int hi8435_probe(struct spi_device *spi) + priv->spi = spi; + + reset_gpio = devm_gpiod_get(&spi->dev, NULL, GPIOD_OUT_LOW); +- if (IS_ERR(reset_gpio)) { +- /* chip s/w reset if h/w reset failed */ ++ if (!IS_ERR(reset_gpio)) { ++ /* need >=100ns low pulse to reset chip */ ++ gpiod_set_raw_value_cansleep(reset_gpio, 0); ++ udelay(1); ++ gpiod_set_raw_value_cansleep(reset_gpio, 1); ++ } else { ++ /* s/w reset chip if h/w reset is not available */ + hi8435_writeb(priv, HI8435_CTRL_REG, HI8435_CTRL_SRST); + hi8435_writeb(priv, HI8435_CTRL_REG, 0); +- } else { +- udelay(5); +- gpiod_set_value(reset_gpio, 1); + } + + spi_set_drvdata(spi, idev); +diff --git a/drivers/iio/magnetometer/st_magn_spi.c b/drivers/iio/magnetometer/st_magn_spi.c +index 6325e7dc8e03..f3cb4dc05391 100644 +--- a/drivers/iio/magnetometer/st_magn_spi.c ++++ b/drivers/iio/magnetometer/st_magn_spi.c +@@ -48,8 +48,6 @@ static int st_magn_spi_remove(struct spi_device *spi) + } + + static const struct spi_device_id st_magn_id_table[] = { +- { LSM303DLHC_MAGN_DEV_NAME }, +- { LSM303DLM_MAGN_DEV_NAME }, + { LIS3MDL_MAGN_DEV_NAME }, + { LSM303AGR_MAGN_DEV_NAME }, + {}, +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index a73874508c3a..cb3a8623ff54 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2974,12 +2974,8 @@ static void srpt_queue_response(struct se_cmd *cmd) + } + spin_unlock_irqrestore(&ioctx->spinlock, flags); + +- if (unlikely(transport_check_aborted_status(&ioctx->cmd, false) +- || WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) { +- atomic_inc(&ch->req_lim_delta); +- srpt_abort_cmd(ioctx); ++ if (unlikely(WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) + return; +- } + + dir = ioctx->cmd.data_direction; + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index c9d491bc85e0..3851d5715772 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1082,6 +1082,13 @@ static int elan_probe(struct i2c_client *client, + return error; + } + ++ /* Make sure there is something at this address */ ++ error = i2c_smbus_read_byte(client); ++ if (error < 0) { ++ dev_dbg(&client->dev, "nothing at this address: %d\n", error); ++ return -ENXIO; ++ } ++ + /* Initialize the touchpad. */ + error = elan_initialize(data); + if (error) +diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c +index a679e56c44cd..765879dcaf85 100644 +--- a/drivers/input/mouse/elan_i2c_i2c.c ++++ b/drivers/input/mouse/elan_i2c_i2c.c +@@ -557,7 +557,14 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client, + long ret; + int error; + int len; +- u8 buffer[ETP_I2C_INF_LENGTH]; ++ u8 buffer[ETP_I2C_REPORT_LEN]; ++ ++ len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN); ++ if (len != ETP_I2C_REPORT_LEN) { ++ error = len < 0 ? len : -EIO; ++ dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n", ++ error, len); ++ } + + reinit_completion(completion); + enable_irq(client->irq); +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 51b96e9bf793..06ea28e5d7b4 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1715,6 +1715,17 @@ int elantech_init(struct psmouse *psmouse) + etd->samples[0], etd->samples[1], etd->samples[2]); + } + ++ if (etd->samples[1] == 0x74 && etd->hw_version == 0x03) { ++ /* ++ * This module has a bug which makes absolute mode ++ * unusable, so let's abort so we'll be using standard ++ * PS/2 protocol. ++ */ ++ psmouse_info(psmouse, ++ "absolute mode broken, forcing standard PS/2 protocol\n"); ++ goto init_fail; ++ } ++ + if (elantech_set_absolute_mode(psmouse)) { + psmouse_err(psmouse, + "failed to put touchpad into absolute mode.\n"); +diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c +index 9cb4b621fbc3..b92a19a594a1 100644 +--- a/drivers/isdn/mISDN/stack.c ++++ b/drivers/isdn/mISDN/stack.c +@@ -72,7 +72,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb) + if (sk->sk_state != MISDN_BOUND) + continue; + if (!cskb) +- cskb = skb_copy(skb, GFP_KERNEL); ++ cskb = skb_copy(skb, GFP_ATOMIC); + if (!cskb) { + printk(KERN_WARNING "%s no skb\n", __func__); + break; +diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c +index b775e1efecd3..b9f71a87b7e1 100644 +--- a/drivers/leds/leds-pca955x.c ++++ b/drivers/leds/leds-pca955x.c +@@ -281,7 +281,7 @@ static int pca955x_probe(struct i2c_client *client, + "slave address 0x%02x\n", + id->name, chip->bits, client->addr); + +- if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) ++ if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) + return -EIO; + + if (pdata) { +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 4d46f2ce606f..aa84fcfd59fc 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -514,15 +514,21 @@ struct open_bucket { + + /* + * We keep multiple buckets open for writes, and try to segregate different +- * write streams for better cache utilization: first we look for a bucket where +- * the last write to it was sequential with the current write, and failing that +- * we look for a bucket that was last used by the same task. ++ * write streams for better cache utilization: first we try to segregate flash ++ * only volume write streams from cached devices, secondly we look for a bucket ++ * where the last write to it was sequential with the current write, and ++ * failing that we look for a bucket that was last used by the same task. + * + * The ideas is if you've got multiple tasks pulling data into the cache at the + * same time, you'll get better cache utilization if you try to segregate their + * data and preserve locality. + * +- * For example, say you've starting Firefox at the same time you're copying a ++ * For example, dirty sectors of flash only volume is not reclaimable, if their ++ * dirty sectors mixed with dirty sectors of cached device, such buckets will ++ * be marked as dirty and won't be reclaimed, though the dirty data of cached ++ * device have been written back to backend device. ++ * ++ * And say you've starting Firefox at the same time you're copying a + * bunch of files. Firefox will likely end up being fairly hot and stay in the + * cache awhile, but the data you copied might not be; if you wrote all that + * data to the same buckets it'd get invalidated at the same time. +@@ -539,7 +545,10 @@ static struct open_bucket *pick_data_bucket(struct cache_set *c, + struct open_bucket *ret, *ret_task = NULL; + + list_for_each_entry_reverse(ret, &c->data_buckets, list) +- if (!bkey_cmp(&ret->key, search)) ++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) != ++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)])) ++ continue; ++ else if (!bkey_cmp(&ret->key, search)) + goto found; + else if (ret->last_write_point == write_point) + ret_task = ret; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index be8307550bd7..f636af441da6 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -890,6 +890,12 @@ static void cached_dev_detach_finish(struct work_struct *w) + + mutex_lock(&bch_register_lock); + ++ cancel_delayed_work_sync(&dc->writeback_rate_update); ++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) { ++ kthread_stop(dc->writeback_thread); ++ dc->writeback_thread = NULL; ++ } ++ + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 494d01d0e92a..a7a561af05c9 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -945,8 +945,10 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev) + cmsg.raid_slot = cpu_to_le32(rdev->desc_nr); + lock_comm(cinfo); + ret = __sendmsg(cinfo, &cmsg); +- if (ret) ++ if (ret) { ++ unlock_comm(cinfo); + return ret; ++ } + cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE; + ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX); + cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE; +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index ca968c3f25c7..e2130fb4597d 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -110,8 +110,7 @@ static inline void unlock_device_hash_lock(struct r5conf *conf, int hash) + static inline void lock_all_device_hash_locks_irq(struct r5conf *conf) + { + int i; +- local_irq_disable(); +- spin_lock(conf->hash_locks); ++ spin_lock_irq(conf->hash_locks); + for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++) + spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks); + spin_lock(&conf->device_lock); +@@ -121,9 +120,9 @@ static inline void unlock_all_device_hash_locks_irq(struct r5conf *conf) + { + int i; + spin_unlock(&conf->device_lock); +- for (i = NR_STRIPE_HASH_LOCKS; i; i--) +- spin_unlock(conf->hash_locks + i - 1); +- local_irq_enable(); ++ for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--) ++ spin_unlock(conf->hash_locks + i); ++ spin_unlock_irq(conf->hash_locks); + } + + /* bio's attached to a stripe+device for I/O are linked together in bi_sector +@@ -726,12 +725,11 @@ static bool is_full_stripe_write(struct stripe_head *sh) + + static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2) + { +- local_irq_disable(); + if (sh1 > sh2) { +- spin_lock(&sh2->stripe_lock); ++ spin_lock_irq(&sh2->stripe_lock); + spin_lock_nested(&sh1->stripe_lock, 1); + } else { +- spin_lock(&sh1->stripe_lock); ++ spin_lock_irq(&sh1->stripe_lock); + spin_lock_nested(&sh2->stripe_lock, 1); + } + } +@@ -739,8 +737,7 @@ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2) + static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2) + { + spin_unlock(&sh1->stripe_lock); +- spin_unlock(&sh2->stripe_lock); +- local_irq_enable(); ++ spin_unlock_irq(&sh2->stripe_lock); + } + + /* Only freshly new full stripe normal write stripe can be added to a batch list */ +diff --git a/drivers/media/i2c/cx25840/cx25840-core.c b/drivers/media/i2c/cx25840/cx25840-core.c +index fe6eb78b6914..a47ab1947cc4 100644 +--- a/drivers/media/i2c/cx25840/cx25840-core.c ++++ b/drivers/media/i2c/cx25840/cx25840-core.c +@@ -420,11 +420,13 @@ static void cx25840_initialize(struct i2c_client *client) + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + /* 6. */ + cx25840_write(client, 0x115, 0x8c); +@@ -631,11 +633,13 @@ static void cx23885_initialize(struct i2c_client *client) + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + /* Call the cx23888 specific std setup func, we no longer rely on + * the generic cx24840 func. +@@ -746,11 +750,13 @@ static void cx231xx_initialize(struct i2c_client *client) + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + cx25840_std_setup(client); + +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index f838d9c7ed12..0fba4a2c1602 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1370,8 +1370,13 @@ static int mceusb_dev_probe(struct usb_interface *intf, + goto rc_dev_fail; + + /* wire up inbound data handler */ +- usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, +- mceusb_dev_recv, ir, ep_in->bInterval); ++ if (usb_endpoint_xfer_int(ep_in)) ++ usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, ++ mceusb_dev_recv, ir, ep_in->bInterval); ++ else ++ usb_fill_bulk_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, ++ mceusb_dev_recv, ir); ++ + ir->urb_in->transfer_dma = ir->dma_in; + ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 3dc9ed2e0774..bb1e19f7ed5a 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -205,6 +205,10 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory, + struct vb2_buffer *vb; + int ret; + ++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ ++ num_buffers = min_t(unsigned int, num_buffers, ++ VB2_MAX_FRAME - q->num_buffers); ++ + for (buffer = 0; buffer < num_buffers; ++buffer) { + /* Allocate videobuf buffer structures */ + vb = kzalloc(q->buf_struct_size, GFP_KERNEL); +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index f42d9c4e4561..cc277f7849b0 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -298,8 +298,11 @@ static void *qp_alloc_queue(u64 size, u32 flags) + size_t pas_size; + size_t vas_size; + size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if); +- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; ++ u64 num_pages; + ++ if (size > SIZE_MAX - PAGE_SIZE) ++ return NULL; ++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; + if (num_pages > + (SIZE_MAX - queue_size) / + (sizeof(*queue->kernel_if->u.g.pas) + +@@ -624,9 +627,12 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size) + { + struct vmci_queue *queue; + size_t queue_page_size; +- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; ++ u64 num_pages; + const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if)); + ++ if (size > SIZE_MAX - PAGE_SIZE) ++ return NULL; ++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; + if (num_pages > (SIZE_MAX - queue_size) / + sizeof(*queue->kernel_if->u.h.page)) + return NULL; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index eadccf498589..278d12888cab 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1490,39 +1490,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_close; + } + +- /* If the mode uses primary, then the following is handled by +- * bond_change_active_slave(). +- */ +- if (!bond_uses_primary(bond)) { +- /* set promiscuity level to new slave */ +- if (bond_dev->flags & IFF_PROMISC) { +- res = dev_set_promiscuity(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- /* set allmulti level to new slave */ +- if (bond_dev->flags & IFF_ALLMULTI) { +- res = dev_set_allmulti(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- netif_addr_lock_bh(bond_dev); +- +- dev_mc_sync_multiple(slave_dev, bond_dev); +- dev_uc_sync_multiple(slave_dev, bond_dev); +- +- netif_addr_unlock_bh(bond_dev); +- } +- +- if (BOND_MODE(bond) == BOND_MODE_8023AD) { +- /* add lacpdu mc addr to mc list */ +- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +- +- dev_mc_add(slave_dev, lacpdu_multicast); +- } +- + res = vlan_vids_add_by_dev(slave_dev, bond_dev); + if (res) { + netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", +@@ -1679,6 +1646,40 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_upper_unlink; + } + ++ /* If the mode uses primary, then the following is handled by ++ * bond_change_active_slave(). ++ */ ++ if (!bond_uses_primary(bond)) { ++ /* set promiscuity level to new slave */ ++ if (bond_dev->flags & IFF_PROMISC) { ++ res = dev_set_promiscuity(slave_dev, 1); ++ if (res) ++ goto err_sysfs_del; ++ } ++ ++ /* set allmulti level to new slave */ ++ if (bond_dev->flags & IFF_ALLMULTI) { ++ res = dev_set_allmulti(slave_dev, 1); ++ if (res) { ++ if (bond_dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(slave_dev, -1); ++ goto err_sysfs_del; ++ } ++ } ++ ++ netif_addr_lock_bh(bond_dev); ++ dev_mc_sync_multiple(slave_dev, bond_dev); ++ dev_uc_sync_multiple(slave_dev, bond_dev); ++ netif_addr_unlock_bh(bond_dev); ++ ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) { ++ /* add lacpdu mc addr to mc list */ ++ u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; ++ ++ dev_mc_add(slave_dev, lacpdu_multicast); ++ } ++ } ++ + bond->slave_cnt++; + bond_compute_features(bond); + bond_set_carrier(bond); +@@ -1702,6 +1703,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + return 0; + + /* Undo stages on error */ ++err_sysfs_del: ++ bond_sysfs_slave_del(new_slave); ++ + err_upper_unlink: + bond_upper_dev_unlink(bond_dev, slave_dev); + +@@ -1709,9 +1713,6 @@ err_unregister: + netdev_rx_handler_unregister(slave_dev); + + err_detach: +- if (!bond_uses_primary(bond)) +- bond_hw_addr_flush(bond_dev, slave_dev); +- + vlan_vids_del_by_dev(slave_dev, bond_dev); + if (rcu_access_pointer(bond->primary_slave) == new_slave) + RCU_INIT_POINTER(bond->primary_slave, NULL); +@@ -2555,11 +2556,13 @@ static void bond_loadbalance_arp_mon(struct work_struct *work) + bond_for_each_slave_rcu(bond, slave, iter) { + unsigned long trans_start = dev_trans_start(slave->dev); + ++ slave->new_link = BOND_LINK_NOCHANGE; ++ + if (slave->link != BOND_LINK_UP) { + if (bond_time_in_interval(bond, trans_start, 1) && + bond_time_in_interval(bond, slave->last_rx, 1)) { + +- slave->link = BOND_LINK_UP; ++ slave->new_link = BOND_LINK_UP; + slave_state_changed = 1; + + /* primary_slave has no meaning in round-robin +@@ -2586,7 +2589,7 @@ static void bond_loadbalance_arp_mon(struct work_struct *work) + if (!bond_time_in_interval(bond, trans_start, 2) || + !bond_time_in_interval(bond, slave->last_rx, 2)) { + +- slave->link = BOND_LINK_DOWN; ++ slave->new_link = BOND_LINK_DOWN; + slave_state_changed = 1; + + if (slave->link_failure_count < UINT_MAX) +@@ -2617,6 +2620,11 @@ static void bond_loadbalance_arp_mon(struct work_struct *work) + if (!rtnl_trylock()) + goto re_arm; + ++ bond_for_each_slave(bond, slave, iter) { ++ if (slave->new_link != BOND_LINK_NOCHANGE) ++ slave->link = slave->new_link; ++ } ++ + if (slave_state_changed) { + bond_slave_state_change(bond); + if (BOND_MODE(bond) == BOND_MODE_XOR) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index d1103d612d8b..949a82458a29 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3943,15 +3943,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev) + /* when transmitting in a vf, start bd must hold the ethertype + * for fw to enforce it + */ ++ u16 vlan_tci = 0; + #ifndef BNX2X_STOP_ON_ERROR +- if (IS_VF(bp)) ++ if (IS_VF(bp)) { + #endif +- tx_start_bd->vlan_or_ethertype = +- cpu_to_le16(ntohs(eth->h_proto)); ++ /* Still need to consider inband vlan for enforced */ ++ if (__vlan_get_tag(skb, &vlan_tci)) { ++ tx_start_bd->vlan_or_ethertype = ++ cpu_to_le16(ntohs(eth->h_proto)); ++ } else { ++ tx_start_bd->bd_flags.as_bitfield |= ++ (X_ETH_INBAND_VLAN << ++ ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT); ++ tx_start_bd->vlan_or_ethertype = ++ cpu_to_le16(vlan_tci); ++ } + #ifndef BNX2X_STOP_ON_ERROR +- else ++ } else { + /* used by FW for packet accounting */ + tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod); ++ } + #endif + } + +diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c +index 0f6811860ad5..a36e38676640 100644 +--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c ++++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c +@@ -2845,7 +2845,7 @@ bfa_ioc_get_adapter_optrom_ver(struct bfa_ioc *ioc, char *optrom_ver) + static void + bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer) + { +- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); ++ strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); + } + + static void +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index cf61a5869c6e..de23f23b41de 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -6076,13 +6076,18 @@ int t4_fw_upgrade(struct adapter *adap, unsigned int mbox, + if (!t4_fw_matches_chip(adap, fw_hdr)) + return -EINVAL; + ++ /* Disable FW_OK flag so that mbox commands with FW_OK flag set ++ * wont be sent when we are flashing FW. ++ */ ++ adap->flags &= ~FW_OK; ++ + ret = t4_fw_halt(adap, mbox, force); + if (ret < 0 && !force) +- return ret; ++ goto out; + + ret = t4_load_fw(adap, fw_data, size); + if (ret < 0) +- return ret; ++ goto out; + + /* + * Older versions of the firmware don't understand the new +@@ -6093,7 +6098,17 @@ int t4_fw_upgrade(struct adapter *adap, unsigned int mbox, + * its header flags to see if it advertises the capability. + */ + reset = ((be32_to_cpu(fw_hdr->flags) & FW_HDR_FLAGS_RESET_HALT) == 0); +- return t4_fw_restart(adap, mbox, reset); ++ ret = t4_fw_restart(adap, mbox, reset); ++ ++ /* Grab potentially new Firmware Device Log parameters so we can see ++ * how healthy the new Firmware is. It's okay to contact the new ++ * Firmware for these parameters even though, as far as it's ++ * concerned, we've never said "HELLO" to it ... ++ */ ++ (void)t4_init_devlog_params(adap); ++out: ++ adap->flags |= FW_OK; ++ return ret; + } + + /** +@@ -7696,7 +7711,16 @@ int t4_cim_read_la(struct adapter *adap, u32 *la_buf, unsigned int *wrptr) + ret = t4_cim_read(adap, UP_UP_DBG_LA_DATA_A, 1, &la_buf[i]); + if (ret) + break; +- idx = (idx + 1) & UPDBGLARDPTR_M; ++ ++ /* Bits 0-3 of UpDbgLaRdPtr can be between 0000 to 1001 to ++ * identify the 32-bit portion of the full 312-bit data ++ */ ++ if (is_t6(adap->params.chip) && (idx & 0xf) >= 9) ++ idx = (idx & 0xff0) + 0x10; ++ else ++ idx++; ++ /* address can't exceed 0xfff */ ++ idx &= UPDBGLARDPTR_M; + } + restart: + if (cfg & UPDBGLAEN_F) { +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +index fa3786a9d30e..ec8ffd7eae33 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +@@ -2604,8 +2604,8 @@ void t4vf_sge_stop(struct adapter *adapter) + int t4vf_sge_init(struct adapter *adapter) + { + struct sge_params *sge_params = &adapter->params.sge; +- u32 fl0 = sge_params->sge_fl_buffer_size[0]; +- u32 fl1 = sge_params->sge_fl_buffer_size[1]; ++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0]; ++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1]; + struct sge *s = &adapter->sge; + unsigned int ingpadboundary, ingpackboundary; + +@@ -2614,9 +2614,20 @@ int t4vf_sge_init(struct adapter *adapter) + * the Physical Function Driver. Ideally we should be able to deal + * with _any_ configuration. Practice is different ... + */ +- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) { ++ ++ /* We only bother using the Large Page logic if the Large Page Buffer ++ * is larger than our Page Size Buffer. ++ */ ++ if (fl_large_pg <= fl_small_pg) ++ fl_large_pg = 0; ++ ++ /* The Page Size Buffer must be exactly equal to our Page Size and the ++ * Large Page Size Buffer should be 0 (per above) or a power of 2. ++ */ ++ if (fl_small_pg != PAGE_SIZE || ++ (fl_large_pg & (fl_large_pg - 1)) != 0) { + dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n", +- fl0, fl1); ++ fl_small_pg, fl_large_pg); + return -EINVAL; + } + if ((sge_params->sge_control & RXPKTCPLMODE_F) == 0) { +@@ -2627,8 +2638,8 @@ int t4vf_sge_init(struct adapter *adapter) + /* + * Now translate the adapter parameters into our internal forms. + */ +- if (fl1) +- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT; ++ if (fl_large_pg) ++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT; + s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F) + ? 128 : 64); + s->pktshift = PKTSHIFT_G(sge_params->sge_control); +diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +index 40071dad1c57..9c76f1a2f57b 100644 +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -382,7 +382,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + { + const struct of_device_id *id = + of_match_device(fsl_pq_mdio_match, &pdev->dev); +- const struct fsl_pq_mdio_data *data = id->data; ++ const struct fsl_pq_mdio_data *data; + struct device_node *np = pdev->dev.of_node; + struct resource res; + struct device_node *tbi; +@@ -390,6 +390,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev) + struct mii_bus *new_bus; + int err; + ++ if (!id) { ++ dev_err(&pdev->dev, "Failed to match device\n"); ++ return -ENODEV; ++ } ++ ++ data = id->data; ++ + dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible); + + new_bus = mdiobus_alloc_size(sizeof(*priv)); +diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c +index 5d7db6c01c46..f301c03c527b 100644 +--- a/drivers/net/ethernet/ibm/emac/core.c ++++ b/drivers/net/ethernet/ibm/emac/core.c +@@ -342,6 +342,7 @@ static int emac_reset(struct emac_instance *dev) + { + struct emac_regs __iomem *p = dev->emacp; + int n = 20; ++ bool __maybe_unused try_internal_clock = false; + + DBG(dev, "reset" NL); + +@@ -354,6 +355,7 @@ static int emac_reset(struct emac_instance *dev) + } + + #ifdef CONFIG_PPC_DCR_NATIVE ++do_retry: + /* + * PPC460EX/GT Embedded Processor Advanced User's Manual + * section 28.10.1 Mode Register 0 (EMACx_MR0) states: +@@ -361,10 +363,19 @@ static int emac_reset(struct emac_instance *dev) + * of the EMAC. If none is present, select the internal clock + * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1). + * After a soft reset, select the external clock. ++ * ++ * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the ++ * ethernet cable is not attached. This causes the reset to timeout ++ * and the PHY detection code in emac_init_phy() is unable to ++ * communicate and detect the AR8035-A PHY. As a result, the emac ++ * driver bails out early and the user has no ethernet. ++ * In order to stay compatible with existing configurations, the ++ * driver will temporarily switch to the internal clock, after ++ * the first reset fails. + */ + if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) { +- if (dev->phy_address == 0xffffffff && +- dev->phy_map == 0xffffffff) { ++ if (try_internal_clock || (dev->phy_address == 0xffffffff && ++ dev->phy_map == 0xffffffff)) { + /* No PHY: select internal loop clock before reset */ + dcri_clrset(SDR0, SDR0_ETH_CFG, + 0, SDR0_ETH_CFG_ECS << dev->cell_index); +@@ -382,8 +393,15 @@ static int emac_reset(struct emac_instance *dev) + + #ifdef CONFIG_PPC_DCR_NATIVE + if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) { +- if (dev->phy_address == 0xffffffff && +- dev->phy_map == 0xffffffff) { ++ if (!n && !try_internal_clock) { ++ /* first attempt has timed out. */ ++ n = 20; ++ try_internal_clock = true; ++ goto do_retry; ++ } ++ ++ if (try_internal_clock || (dev->phy_address == 0xffffffff && ++ dev->phy_map == 0xffffffff)) { + /* No PHY: restore external clock source after reset */ + dcri_clrset(SDR0, SDR0_ETH_CFG, + SDR0_ETH_CFG_ECS << dev->cell_index, 0); +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index e356e9187e84..20d8806d2bff 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -1182,6 +1182,7 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work) + struct e1000_hw *hw = &adapter->hw; + + if (er32(TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID) { ++ struct sk_buff *skb = adapter->tx_hwtstamp_skb; + struct skb_shared_hwtstamps shhwtstamps; + u64 txstmp; + +@@ -1190,9 +1191,14 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work) + + e1000e_systim_to_hwtstamp(adapter, &shhwtstamps, txstmp); + +- skb_tstamp_tx(adapter->tx_hwtstamp_skb, &shhwtstamps); +- dev_kfree_skb_any(adapter->tx_hwtstamp_skb); ++ /* Clear the global tx_hwtstamp_skb pointer and force writes ++ * prior to notifying the stack of a Tx timestamp. ++ */ + adapter->tx_hwtstamp_skb = NULL; ++ wmb(); /* force write prior to skb_tstamp_tx */ ++ ++ skb_tstamp_tx(skb, &shhwtstamps); ++ dev_kfree_skb_any(skb); + } else if (time_after(jiffies, adapter->tx_hwtstamp_start + + adapter->tx_timeout_factor * HZ)) { + dev_kfree_skb_any(adapter->tx_hwtstamp_skb); +@@ -6589,12 +6595,17 @@ static int e1000e_pm_thaw(struct device *dev) + static int e1000e_pm_suspend(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); ++ int rc; + + e1000e_flush_lpic(pdev); + + e1000e_pm_freeze(dev); + +- return __e1000_shutdown(pdev, false); ++ rc = __e1000_shutdown(pdev, false); ++ if (rc) ++ e1000e_pm_thaw(dev); ++ ++ return rc; + } + + static int e1000e_pm_resume(struct device *dev) +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index 4b62aa1f9ff8..6e5065f0907b 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -5079,7 +5079,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + INIT_WORK(&hw->restart_work, sky2_restart); + + pci_set_drvdata(pdev, hw); +- pdev->d3_delay = 150; ++ pdev->d3_delay = 200; + + return 0; + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c +index 1d4e2e054647..897d061e4f03 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c +@@ -35,6 +35,7 @@ + #include + + #include ++#include + #include + + #include "mlx4.h" +@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev, + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + ++ if (!mlx4_qp_lookup(dev, rule->qpn)) { ++ mlx4_err_rule(dev, "QP doesn't exist\n", rule); ++ ret = -EINVAL; ++ goto out; ++ } ++ + trans_rule_ctrl_to_hw(rule, mailbox->buf); + + size += sizeof(struct mlx4_net_trans_rule_hw_ctrl); + + list_for_each_entry(cur, &rule->list, list) { + ret = parse_trans_rule(dev, cur, mailbox->buf + size); +- if (ret < 0) { +- mlx4_free_cmd_mailbox(dev, mailbox); +- return ret; +- } ++ if (ret < 0) ++ goto out; ++ + size += ret; + } + +@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev, + } + } + ++out: + mlx4_free_cmd_mailbox(dev, mailbox); + + return ret; +diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c +index d8359ffba026..62f1a3433a62 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c +@@ -381,6 +381,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn) + __mlx4_qp_free_icm(dev, qpn); + } + ++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn) ++{ ++ struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table; ++ struct mlx4_qp *qp; ++ ++ spin_lock(&qp_table->lock); ++ ++ qp = __mlx4_qp_lookup(dev, qpn); ++ ++ spin_unlock(&qp_table->lock); ++ return qp; ++} ++ + int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp) + { + struct mlx4_priv *priv = mlx4_priv(dev); +@@ -468,6 +481,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn, + } + + if (attr & MLX4_UPDATE_QP_QOS_VPORT) { ++ if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) { ++ mlx4_warn(dev, "Granular QoS per VF is not enabled\n"); ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ + qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP; + cmd->qp_context.qos_vport = params->qos_vport; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index d1fc7fa87b05..e3080fbd9d00 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -5040,6 +5040,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave) + mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex); + } + ++static void update_qos_vpp(struct mlx4_update_qp_context *ctx, ++ struct mlx4_vf_immed_vlan_work *work) ++{ ++ ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP); ++ ctx->qp_context.qos_vport = work->qos_vport; ++} ++ + void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work) + { + struct mlx4_vf_immed_vlan_work *work = +@@ -5144,11 +5151,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work) + qp->sched_queue & 0xC7; + upd_context->qp_context.pri_path.sched_queue |= + ((work->qos & 0x7) << 3); +- upd_context->qp_mask |= +- cpu_to_be64(1ULL << +- MLX4_UPD_QP_MASK_QOS_VPP); +- upd_context->qp_context.qos_vport = +- work->qos_vport; ++ ++ if (dev->caps.flags2 & ++ MLX4_DEV_CAP_FLAG2_QOS_VPP) ++ update_qos_vpp(upd_context, work); + } + + err = mlx4_cmd(dev, mailbox->dma, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index f5c1f4acc57b..7c42be586be8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -513,7 +513,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i) + struct mlx5_priv *priv = &mdev->priv; + struct msix_entry *msix = priv->msix_arr; + int irq = msix[i + MLX5_EQ_VEC_COMP_BASE].vector; +- int err; + + if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) { + mlx5_core_warn(mdev, "zalloc_cpumask_var failed"); +@@ -523,18 +522,11 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i) + cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node), + priv->irq_info[i].mask); + +- err = irq_set_affinity_hint(irq, priv->irq_info[i].mask); +- if (err) { +- mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x", +- irq); +- goto err_clear_mask; +- } ++ if (IS_ENABLED(CONFIG_SMP) && ++ irq_set_affinity_hint(irq, priv->irq_info[i].mask)) ++ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq); + + return 0; +- +-err_clear_mask: +- free_cpumask_var(priv->irq_info[i].mask); +- return err; + } + + static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i) +diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c +index b8d5270359cd..e30676515529 100644 +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c +@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu) + cmd.req.arg3 = 0; + + if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE) +- netxen_issue_cmd(adapter, &cmd); ++ rcode = netxen_issue_cmd(adapter, &cmd); + + if (rcode != NX_RCODE_SUCCESS) + return -EIO; +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c +index 509b596cf1e8..bd1ec70fb736 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c +@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg) + } + return -EIO; + } +- usleep_range(1000, 1500); ++ udelay(1200); + } + + if (id_reg) +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c +index be258d90de9e..e3223f2fe2ff 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c +@@ -765,7 +765,7 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump) + sizeof(struct mpi_coredump_global_header); + mpi_coredump->mpi_global_header.imageSize = + sizeof(struct ql_mpi_coredump); +- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", ++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", + sizeof(mpi_coredump->mpi_global_header.idString)); + + /* Get generic NIC reg dump */ +@@ -1255,7 +1255,7 @@ static void ql_gen_reg_dump(struct ql_adapter *qdev, + sizeof(struct mpi_coredump_global_header); + mpi_coredump->mpi_global_header.imageSize = + sizeof(struct ql_reg_dump); +- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", ++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", + sizeof(mpi_coredump->mpi_global_header.idString)); + + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 1ef03939d25f..c90ae4d4be7d 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca) + + /* Allocate rx SKB if we don't have one available. */ + if (!qca->rx_skb) { +- qca->rx_skb = netdev_alloc_skb(net_dev, +- net_dev->mtu + VLAN_ETH_HLEN); ++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, ++ net_dev->mtu + ++ VLAN_ETH_HLEN); + if (!qca->rx_skb) { + netdev_dbg(net_dev, "out of RX resources\n"); + qca->stats.out_of_mem++; +@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca) + qca->rx_skb, qca->rx_skb->dev); + qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; + netif_rx_ni(qca->rx_skb); +- qca->rx_skb = netdev_alloc_skb(net_dev, ++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, + net_dev->mtu + VLAN_ETH_HLEN); + if (!qca->rx_skb) { + netdev_dbg(net_dev, "out of RX resources\n"); +@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *dev) + if (!qca->rx_buffer) + return -ENOBUFS; + +- qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN); ++ qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu + ++ VLAN_ETH_HLEN); + if (!qca->rx_skb) { + kfree(qca->rx_buffer); + netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n"); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 3783c40f568b..a82c89af7124 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8411,12 +8411,12 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_out_msi_4; + } + ++ pci_set_drvdata(pdev, dev); ++ + rc = register_netdev(dev); + if (rc < 0) + goto err_out_cnt_5; + +- pci_set_drvdata(pdev, dev); +- + netif_info(tp, probe, dev, "%s at 0x%p, %pM, XID %08x IRQ %d\n", + rtl_chip_infos[chipset].name, ioaddr, dev->dev_addr, + (u32)(RTL_R32(TxConfig) & 0x9cf0f8ff), pdev->irq); +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 424d1dee55c9..afaf79b8761f 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3222,7 +3222,7 @@ static int sh_eth_drv_probe(struct platform_device *pdev) + /* MDIO bus init */ + ret = sh_mdio_init(mdp, pd); + if (ret) { +- dev_err(&ndev->dev, "failed to initialise MDIO\n"); ++ dev_err(&pdev->dev, "failed to initialise MDIO\n"); + goto out_release; + } + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 435466c17852..c69b0bdd891d 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -280,6 +280,10 @@ struct cpsw_ss_regs { + /* Bit definitions for the CPSW1_TS_SEQ_LTYPE register */ + #define CPSW_V1_SEQ_ID_OFS_SHIFT 16 + ++#define CPSW_MAX_BLKS_TX 15 ++#define CPSW_MAX_BLKS_TX_SHIFT 4 ++#define CPSW_MAX_BLKS_RX 5 ++ + struct cpsw_host_regs { + u32 max_blks; + u32 blk_cnt; +@@ -1127,11 +1131,23 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + switch (priv->version) { + case CPSW_VERSION_1: + slave_write(slave, TX_PRIORITY_MAPPING, CPSW1_TX_PRI_MAP); ++ /* Increase RX FIFO size to 5 for supporting fullduplex ++ * flow control mode ++ */ ++ slave_write(slave, ++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) | ++ CPSW_MAX_BLKS_RX, CPSW1_MAX_BLKS); + break; + case CPSW_VERSION_2: + case CPSW_VERSION_3: + case CPSW_VERSION_4: + slave_write(slave, TX_PRIORITY_MAPPING, CPSW2_TX_PRI_MAP); ++ /* Increase RX FIFO size to 5 for supporting fullduplex ++ * flow control mode ++ */ ++ slave_write(slave, ++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) | ++ CPSW_MAX_BLKS_RX, CPSW2_MAX_BLKS); + break; + } + +diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c +index 49fe59b180a8..a75ce9051a7f 100644 +--- a/drivers/net/hamradio/hdlcdrv.c ++++ b/drivers/net/hamradio/hdlcdrv.c +@@ -574,6 +574,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + case HDLCDRVCTL_CALIBRATE: + if(!capable(CAP_SYS_RAWIO)) + return -EPERM; ++ if (s->par.bitrate <= 0) ++ return -EINVAL; + if (bi.data.calibrate > INT_MAX / s->par.bitrate) + return -EINVAL; + s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16; +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 7d0690433ee0..7d2cf015c5e7 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -148,6 +148,12 @@ static inline int phy_aneg_done(struct phy_device *phydev) + if (phydev->drv->aneg_done) + return phydev->drv->aneg_done(phydev); + ++ /* Avoid genphy_aneg_done() if the Clause 45 PHY does not ++ * implement Clause 22 registers ++ */ ++ if (phydev->is_c45 && !(phydev->c45_ids.devices_in_package & BIT(0))) ++ return -EINVAL; ++ + return genphy_aneg_done(phydev); + } + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index f7e8c79349ad..12a627fcc02c 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -501,7 +501,6 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.mtu = dst_mtu(&rt->dst); + if (!po->chan.mtu) + po->chan.mtu = PPP_MRU; +- ip_rt_put(rt); + po->chan.mtu -= PPTP_HEADER_OVERHEAD; + + po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header); +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 72cb30828a12..c8e98c8e29fa 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1069,6 +1069,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + u16 n = 0, index, ndplen; + u8 ready2send = 0; + u32 delayed_ndp_size; ++ size_t padding_count; + + /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated + * accordingly. Otherwise, we should check here. +@@ -1225,11 +1226,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + * a ZLP after full sized NTBs. + */ + if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && +- skb_out->len > ctx->min_tx_pkt) +- memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0, +- ctx->tx_max - skb_out->len); +- else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0) ++ skb_out->len > ctx->min_tx_pkt) { ++ padding_count = ctx->tx_max - skb_out->len; ++ memset(skb_put(skb_out, padding_count), 0, padding_count); ++ } else if (skb_out->len < ctx->tx_max && ++ (skb_out->len % dev->maxpacket) == 0) { + *skb_put(skb_out, 1) = 0; /* force short packet */ ++ } + + /* set final frame length */ + nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 8dfc75250583..d01285250204 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -556,7 +556,12 @@ static int add_recvbuf_small(struct virtnet_info *vi, struct receive_queue *rq, + hdr = skb_vnet_hdr(skb); + sg_init_table(rq->sg, 2); + sg_set_buf(rq->sg, hdr, vi->hdr_len); +- skb_to_sgvec(skb, rq->sg + 1, 0, skb->len); ++ ++ err = skb_to_sgvec(skb, rq->sg + 1, 0, skb->len); ++ if (unlikely(err < 0)) { ++ dev_kfree_skb(skb); ++ return err; ++ } + + err = virtqueue_add_inbuf(rq->vq, rq->sg, 2, skb, gfp); + if (err < 0) +@@ -858,7 +863,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) + struct virtio_net_hdr_mrg_rxbuf *hdr; + const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest; + struct virtnet_info *vi = sq->vq->vdev->priv; +- unsigned num_sg; ++ int num_sg; + unsigned hdr_len = vi->hdr_len; + bool can_push; + +@@ -911,11 +916,16 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) + if (can_push) { + __skb_push(skb, hdr_len); + num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len); ++ if (unlikely(num_sg < 0)) ++ return num_sg; + /* Pull header back to avoid skew in tx bytes calculations. */ + __skb_pull(skb, hdr_len); + } else { + sg_set_buf(sq->sg, hdr, hdr_len); +- num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len) + 1; ++ num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len); ++ if (unlikely(num_sg < 0)) ++ return num_sg; ++ num_sg++; + } + return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC); + } +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index 82bf85ae5d08..419c045d0752 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -2789,6 +2789,11 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter) + /* we need to enable NAPI, otherwise dev_close will deadlock */ + for (i = 0; i < adapter->num_rx_queues; i++) + napi_enable(&adapter->rx_queue[i].napi); ++ /* ++ * Need to clear the quiesce bit to ensure that vmxnet3_close ++ * can quiesce the device properly ++ */ ++ clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state); + dev_close(adapter->netdev); + } + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index ac945f8781ac..d3d59122a357 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -550,13 +550,15 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + neigh = __ipv4_neigh_lookup_noref(dev, nexthop); + if (unlikely(!neigh)) + neigh = __neigh_create(&arp_tbl, &nexthop, dev, false); +- if (!IS_ERR(neigh)) ++ if (!IS_ERR(neigh)) { + ret = dst_neigh_output(dst, neigh, skb); ++ rcu_read_unlock_bh(); ++ return ret; ++ } + + rcu_read_unlock_bh(); + err: +- if (unlikely(ret < 0)) +- vrf_tx_error(skb->dev, skb); ++ vrf_tx_error(skb->dev, skb); + return ret; + } + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index e4ff1e45c02e..c41378214ede 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -962,7 +962,7 @@ static bool vxlan_snoop(struct net_device *dev, + return false; + + /* Don't migrate static entries, drop packets */ +- if (f->state & NUD_NOARP) ++ if (f->state & (NUD_PERMANENT | NUD_NOARP)) + return true; + + if (net_ratelimit()) +diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c +index 654a1e33f827..7c5f189cace7 100644 +--- a/drivers/net/wireless/ath/ath5k/debug.c ++++ b/drivers/net/wireless/ath/ath5k/debug.c +@@ -939,7 +939,10 @@ static int open_file_eeprom(struct inode *inode, struct file *file) + } + + for (i = 0; i < eesize; ++i) { +- AR5K_EEPROM_READ(i, val); ++ if (!ath5k_hw_nvram_read(ah, i, &val)) { ++ ret = -EIO; ++ goto freebuf; ++ } + buf[i] = val; + } + +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index 0881ba8535f4..c78abfc7bd96 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_parms[] = { + 0x04, 0x08, /* Noise gain, limit offset */ + 0x28, 0x28, /* det rssi, med busy offsets */ + 7, /* det sync thresh */ +- 0, 2, 2 /* test mode, min, max */ ++ 0, 2, 2, /* test mode, min, max */ ++ 0, /* rx/tx delay */ ++ 0, 0, 0, 0, 0, 0, /* current BSS id */ ++ 0 /* hop set */ + }; + + /*===========================================================================*/ +@@ -598,7 +601,7 @@ static void init_startup_params(ray_dev_t *local) + * a_beacon_period = hops a_beacon_period = KuS + *//* 64ms = 010000 */ + if (local->fw_ver == 0x55) { +- memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms, ++ memcpy(&local->sparm.b4, b4_default_startup_parms, + sizeof(struct b4_startup_params)); + /* Translate sane kus input values to old build 4/5 format */ + /* i = hop time in uS truncated to 3 bytes */ +diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c +index 9bee3f11898a..869411f55d88 100644 +--- a/drivers/net/wireless/ti/wl1251/main.c ++++ b/drivers/net/wireless/ti/wl1251/main.c +@@ -1196,8 +1196,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw, + WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS); + + enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc; +- wl1251_acx_arp_ip_filter(wl, enable, addr); +- ++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr); + if (ret < 0) + goto out_sleep; + } +diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c +index 84419af16f77..fd12ccc11e26 100644 +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone( + + power_zone->id = result; + idr_init(&power_zone->idr); ++ result = -ENOMEM; + power_zone->name = kstrdup(name, GFP_KERNEL); + if (!power_zone->name) + goto err_name_alloc; +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index dcfd3655ef0a..c2cf9485fe32 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -217,6 +217,13 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + missing = year; + } + ++ /* Can't proceed if alarm is still invalid after replacing ++ * missing fields. ++ */ ++ err = rtc_valid_tm(&alarm->time); ++ if (err) ++ goto done; ++ + /* with luck, no rollover is needed */ + t_now = rtc_tm_to_time64(&now); + t_alm = rtc_tm_to_time64(&alarm->time); +@@ -268,9 +275,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + dev_warn(&rtc->dev, "alarm rollover not handled\n"); + } + +-done: + err = rtc_valid_tm(&alarm->time); + ++done: + if (err) { + dev_warn(&rtc->dev, "invalid alarm value: %d-%d-%d %d:%d:%d\n", + alarm->time.tm_year + 1900, alarm->time.tm_mon + 1, +diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c +index 229dd2fe8f45..c6b0c7ed7a30 100644 +--- a/drivers/rtc/rtc-opal.c ++++ b/drivers/rtc/rtc-opal.c +@@ -150,6 +150,16 @@ static int opal_get_tpo_time(struct device *dev, struct rtc_wkalrm *alarm) + + y_m_d = be32_to_cpu(__y_m_d); + h_m_s_ms = ((u64)be32_to_cpu(__h_m) << 32); ++ ++ /* check if no alarm is set */ ++ if (y_m_d == 0 && h_m_s_ms == 0) { ++ pr_debug("No alarm is set\n"); ++ rc = -ENOENT; ++ goto exit; ++ } else { ++ pr_debug("Alarm set to %x %llx\n", y_m_d, h_m_s_ms); ++ } ++ + opal_to_tm(y_m_d, h_m_s_ms, &alarm->time); + + exit: +diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c +index 950c5d0b6dca..afab89f5be48 100644 +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -257,7 +257,7 @@ static int snvs_rtc_probe(struct platform_device *pdev) + of_property_read_u32(pdev->dev.of_node, "offset", &data->offset); + } + +- if (!data->regmap) { ++ if (IS_ERR(data->regmap)) { + dev_err(&pdev->dev, "Can't find snvs syscon\n"); + return -ENODEV; + } +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index e7a6f1222642..b76a85d14ef0 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1881,8 +1881,12 @@ static int __dasd_device_is_unusable(struct dasd_device *device, + { + int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM); + +- if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) { +- /* dasd is being set offline. */ ++ if (test_bit(DASD_FLAG_OFFLINE, &device->flags) && ++ !test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) { ++ /* ++ * dasd is being set offline ++ * but it is no safe offline where we have to allow I/O ++ */ + return 1; + } + if (device->stopped) { +diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h +index 499e369eabf0..8bc1625337f6 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc.h ++++ b/drivers/scsi/bnx2fc/bnx2fc.h +@@ -191,6 +191,7 @@ struct bnx2fc_hba { + struct bnx2fc_cmd_mgr *cmd_mgr; + spinlock_t hba_lock; + struct mutex hba_mutex; ++ struct mutex hba_stats_mutex; + unsigned long adapter_state; + #define ADAPTER_STATE_UP 0 + #define ADAPTER_STATE_GOING_DOWN 1 +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 67405c628864..d0b227ffbd5f 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -641,15 +641,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost) + if (!fw_stats) + return NULL; + ++ mutex_lock(&hba->hba_stats_mutex); ++ + bnx2fc_stats = fc_get_host_stats(shost); + + init_completion(&hba->stat_req_done); + if (bnx2fc_send_stat_req(hba)) +- return bnx2fc_stats; ++ goto unlock_stats_mutex; + rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ)); + if (!rc) { + BNX2FC_HBA_DBG(lport, "FW stat req timed out\n"); +- return bnx2fc_stats; ++ goto unlock_stats_mutex; + } + BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt); + bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt; +@@ -671,6 +673,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost) + + memcpy(&hba->prev_stats, hba->stats_buffer, + sizeof(struct fcoe_statistics_params)); ++ ++unlock_stats_mutex: ++ mutex_unlock(&hba->hba_stats_mutex); + return bnx2fc_stats; + } + +@@ -1302,6 +1307,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic) + } + spin_lock_init(&hba->hba_lock); + mutex_init(&hba->hba_mutex); ++ mutex_init(&hba->hba_stats_mutex); + + hba->cnic = cnic; + +diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c +index 622bdabc8894..dab195f04da7 100644 +--- a/drivers/scsi/csiostor/csio_hw.c ++++ b/drivers/scsi/csiostor/csio_hw.c +@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param) + goto bye; + } + +- mempool_free(mbp, hw->mb_mempool); + if (finicsum != cfcsum) { + csio_warn(hw, + "Config File checksum mismatch: csum=%#x, computed=%#x\n", +@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param) + rv = csio_hw_validate_caps(hw, mbp); + if (rv != 0) + goto bye; ++ ++ mempool_free(mbp, hw->mb_mempool); ++ mbp = NULL; ++ + /* + * Note that we're operating with parameters + * not supplied by the driver, rather than from hard-wired +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index efce04df2109..9f0b00c38658 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1695,6 +1695,15 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) + */ + switch (session->state) { + case ISCSI_STATE_FAILED: ++ /* ++ * cmds should fail during shutdown, if the session ++ * state is bad, allowing completion to happen ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ reason = FAILURE_SESSION_FAILED; ++ sc->result = DID_NO_CONNECT << 16; ++ break; ++ } + case ISCSI_STATE_IN_RECOVERY: + reason = FAILURE_SESSION_IN_RECOVERY; + sc->result = DID_IMM_RETRY << 16; +@@ -1979,6 +1988,19 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + } + + if (session->state != ISCSI_STATE_LOGGED_IN) { ++ /* ++ * During shutdown, if session is prematurely disconnected, ++ * recovery won't happen and there will be hung cmds. Not ++ * handling cmds would trigger EH, also bad in this case. ++ * Instead, handle cmd, allow completion to happen and let ++ * upper layer to deal with the result. ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ sc->result = DID_NO_CONNECT << 16; ++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n"); ++ rc = BLK_EH_HANDLED; ++ goto done; ++ } + /* + * We are probably in the middle of iscsi recovery so let + * that complete and handle the error. +@@ -2083,7 +2105,7 @@ done: + task->last_timeout = jiffies; + spin_unlock(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? +- "timer reset" : "nh"); ++ "timer reset" : "shutdown or nh"); + return rc; + } + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 022bb6e10d98..12886f96b286 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -282,6 +282,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp) + phy->phy->minimum_linkrate = dr->pmin_linkrate; + phy->phy->maximum_linkrate = dr->pmax_linkrate; + phy->phy->negotiated_linkrate = phy->linkrate; ++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED); + + skip: + if (new_phy) +@@ -675,7 +676,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + res = smp_execute_task(dev, req, RPEL_REQ_SIZE, + resp, RPEL_RESP_SIZE); + +- if (!res) ++ if (res) + goto out; + + phy->invalid_dword_count = scsi_to_u32(&resp[12]); +@@ -684,6 +685,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + phy->phy_reset_problem_count = scsi_to_u32(&resp[24]); + + out: ++ kfree(req); + kfree(resp); + return res; + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index e111c3d8c5d6..b868ef3b2ca3 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -3886,19 +3886,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + return 0; + } + +- /* +- * Bug work around for firmware SATL handling. The loop +- * is based on atomic operations and ensures consistency +- * since we're lockless at this point +- */ +- do { +- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { +- scmd->result = SAM_STAT_BUSY; +- scmd->scsi_done(scmd); +- return 0; +- } +- } while (_scsih_set_satl_pending(scmd, true)); +- + sas_target_priv_data = sas_device_priv_data->sas_target; + + /* invalid device handle */ +@@ -3924,6 +3911,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + sas_device_priv_data->block) + return SCSI_MLQUEUE_DEVICE_BUSY; + ++ /* ++ * Bug work around for firmware SATL handling. The loop ++ * is based on atomic operations and ensures consistency ++ * since we're lockless at this point ++ */ ++ do { ++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { ++ scmd->result = SAM_STAT_BUSY; ++ scmd->scsi_done(scmd); ++ return 0; ++ } ++ } while (_scsih_set_satl_pending(scmd, true)); ++ + if (scmd->sc_data_direction == DMA_FROM_DEVICE) + mpi_control = MPI2_SCSIIO_CONTROL_READ; + else if (scmd->sc_data_direction == DMA_TO_DEVICE) +@@ -3945,6 +3945,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (!smid) { + pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", + ioc->name, __func__); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); +@@ -3975,6 +3976,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (mpi_request->DataLength) { + if (ioc->build_sg_scmd(ioc, scmd, smid)) { + mpt3sas_base_free_smid(ioc, smid); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + } else +diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c +index 013a6240f193..c1ad0aea23b9 100644 +--- a/drivers/staging/wlan-ng/prism2mgmt.c ++++ b/drivers/staging/wlan-ng/prism2mgmt.c +@@ -169,7 +169,7 @@ int prism2mgmt_scan(wlandevice_t *wlandev, void *msgp) + hw->ident_sta_fw.variant) > + HFA384x_FIRMWARE_VERSION(1, 5, 0)) { + if (msg->scantype.data != P80211ENUM_scantype_active) +- word = cpu_to_le16(msg->maxchanneltime.data); ++ word = msg->maxchanneltime.data; + else + word = 0; + +diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c +index 1246aa6fcab0..737635f0bec0 100644 +--- a/drivers/thermal/power_allocator.c ++++ b/drivers/thermal/power_allocator.c +@@ -523,6 +523,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + struct thermal_instance *instance; + struct power_allocator_params *params = tz->governor_data; + ++ mutex_lock(&tz->lock); + list_for_each_entry(instance, &tz->thermal_instances, tz_node) { + if ((instance->trip != params->trip_max_desired_temperature) || + (!cdev_is_power_actor(instance->cdev))) +@@ -532,6 +533,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + instance->cdev->updated = false; + thermal_cdev_update(instance->cdev); + } ++ mutex_unlock(&tz->lock); + } + + /** +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 9aff37186246..78bd121ecede 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1467,6 +1467,10 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + * in which case an opening port goes back to closed and a closing port + * is simply put into closed state (any further frames from the other + * end will get a DM response) ++ * ++ * Some control dlci can stay in ADM mode with other dlci working just ++ * fine. In that case we can just keep the control dlci open after the ++ * DLCI_OPENING retries time out. + */ + + static void gsm_dlci_t1(unsigned long data) +@@ -1480,8 +1484,15 @@ static void gsm_dlci_t1(unsigned long data) + if (dlci->retries) { + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); +- } else ++ } else if (!dlci->addr && gsm->control == (DM | PF)) { ++ if (debug & 8) ++ pr_info("DLCI %d opening in ADM mode.\n", ++ dlci->addr); ++ gsm_dlci_open(dlci); ++ } else { + gsm_dlci_close(dlci); ++ } ++ + break; + case DLCI_CLOSING: + dlci->retries--; +@@ -1499,8 +1510,8 @@ static void gsm_dlci_t1(unsigned long data) + * @dlci: DLCI to open + * + * Commence opening a DLCI from the Linux side. We issue SABM messages +- * to the modem which should then reply with a UA, at which point we +- * will move into open state. Opening is done asynchronously with retry ++ * to the modem which should then reply with a UA or ADM, at which point ++ * we will move into open state. Opening is done asynchronously with retry + * running off timers and the responses. + */ + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index e8dd296fb25b..c4383573cf66 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -608,6 +608,10 @@ static int omap_8250_startup(struct uart_port *port) + up->lsr_saved_flags = 0; + up->msr_saved_flags = 0; + ++ /* Disable DMA for console UART */ ++ if (uart_console(port)) ++ up->dma = NULL; ++ + if (up->dma) { + ret = serial8250_request_dma(up); + if (ret) { +diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c +index fcf803ffad19..cdd2f942317c 100644 +--- a/drivers/tty/serial/sccnxp.c ++++ b/drivers/tty/serial/sccnxp.c +@@ -884,14 +884,19 @@ static int sccnxp_probe(struct platform_device *pdev) + + clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(clk)) { +- if (PTR_ERR(clk) == -EPROBE_DEFER) { +- ret = -EPROBE_DEFER; ++ ret = PTR_ERR(clk); ++ if (ret == -EPROBE_DEFER) + goto err_out; +- } ++ uartclk = 0; ++ } else { ++ clk_prepare_enable(clk); ++ uartclk = clk_get_rate(clk); ++ } ++ ++ if (!uartclk) { + dev_notice(&pdev->dev, "Using default clock frequency\n"); + uartclk = s->chip->freq_std; +- } else +- uartclk = clk_get_rate(clk); ++ } + + /* Check input frequency */ + if ((uartclk < s->chip->freq_min) || (uartclk > s->chip->freq_max)) { +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index fc7711c75b01..8dd822feb972 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1457,7 +1457,16 @@ static void sci_free_dma(struct uart_port *port) + if (s->chan_rx) + sci_rx_dma_release(s, false); + } +-#else ++ ++static void sci_flush_buffer(struct uart_port *port) ++{ ++ /* ++ * In uart_flush_buffer(), the xmit circular buffer has just been ++ * cleared, so we have to reset tx_dma_len accordingly. ++ */ ++ to_sci_port(port)->tx_dma_len = 0; ++} ++#else /* !CONFIG_SERIAL_SH_SCI_DMA */ + static inline void sci_request_dma(struct uart_port *port) + { + } +@@ -1465,7 +1474,9 @@ static inline void sci_request_dma(struct uart_port *port) + static inline void sci_free_dma(struct uart_port *port) + { + } +-#endif ++ ++#define sci_flush_buffer NULL ++#endif /* !CONFIG_SERIAL_SH_SCI_DMA */ + + static irqreturn_t sci_rx_interrupt(int irq, void *ptr) + { +@@ -2205,6 +2216,7 @@ static struct uart_ops sci_uart_ops = { + .break_ctl = sci_break_ctl, + .startup = sci_startup, + .shutdown = sci_shutdown, ++ .flush_buffer = sci_flush_buffer, + .set_termios = sci_set_termios, + .pm = sci_pm, + .type = sci_type, +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 939c6ad71068..57ee43512992 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -851,7 +851,7 @@ static inline void ci_role_destroy(struct ci_hdrc *ci) + { + ci_hdrc_gadget_destroy(ci); + ci_hdrc_host_destroy(ci); +- if (ci->is_otg) ++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) + ci_hdrc_otg_destroy(ci); + } + +@@ -951,27 +951,35 @@ static int ci_hdrc_probe(struct platform_device *pdev) + /* initialize role(s) before the interrupt is requested */ + if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_HOST) { + ret = ci_hdrc_host_init(ci); +- if (ret) +- dev_info(dev, "doesn't support host\n"); ++ if (ret) { ++ if (ret == -ENXIO) ++ dev_info(dev, "doesn't support host\n"); ++ else ++ goto deinit_phy; ++ } + } + + if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_PERIPHERAL) { + ret = ci_hdrc_gadget_init(ci); +- if (ret) +- dev_info(dev, "doesn't support gadget\n"); ++ if (ret) { ++ if (ret == -ENXIO) ++ dev_info(dev, "doesn't support gadget\n"); ++ else ++ goto deinit_host; ++ } + } + + if (!ci->roles[CI_ROLE_HOST] && !ci->roles[CI_ROLE_GADGET]) { + dev_err(dev, "no supported roles\n"); + ret = -ENODEV; +- goto deinit_phy; ++ goto deinit_gadget; + } + + if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) { + ret = ci_hdrc_otg_init(ci); + if (ret) { + dev_err(dev, "init otg fails, ret = %d\n", ret); +- goto stop; ++ goto deinit_gadget; + } + } + +@@ -1036,7 +1044,12 @@ static int ci_hdrc_probe(struct platform_device *pdev) + + ci_extcon_unregister(ci); + stop: +- ci_role_destroy(ci); ++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) ++ ci_hdrc_otg_destroy(ci); ++deinit_gadget: ++ ci_hdrc_gadget_destroy(ci); ++deinit_host: ++ ci_hdrc_host_destroy(ci); + deinit_phy: + ci_usb_phy_exit(ci); + +diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c +index 2be268d2423d..03a926ebf34b 100644 +--- a/drivers/usb/dwc3/dwc3-keystone.c ++++ b/drivers/usb/dwc3/dwc3-keystone.c +@@ -112,6 +112,10 @@ static int kdwc3_probe(struct platform_device *pdev) + dev->dma_mask = &kdwc3_dma_mask; + + kdwc->clk = devm_clk_get(kdwc->dev, "usb"); ++ if (IS_ERR(kdwc->clk)) { ++ dev_err(kdwc->dev, "unable to get usb clock\n"); ++ return PTR_ERR(kdwc->clk); ++ } + + error = clk_prepare_enable(kdwc->clk); + if (error < 0) { +diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c +index 091e8ec7a6c0..962bb6376b0c 100644 +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -1953,6 +1953,8 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag) + bcb->CDB[0] = 0xEF; + + result = ene_send_scsi_cmd(us, FDIR_WRITE, buf, 0); ++ if (us->srb != NULL) ++ scsi_set_resid(us->srb, 0); + info->BIN_FLAG = flag; + kfree(buf); + +@@ -2306,21 +2308,22 @@ static int ms_scsi_irp(struct us_data *us, struct scsi_cmnd *srb) + + static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) + { +- int result = 0; ++ int result = USB_STOR_XFER_GOOD; + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) { ++ if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) + result = ene_init(us); +- } else { ++ if (result == USB_STOR_XFER_GOOD) { ++ result = USB_STOR_TRANSPORT_ERROR; + if (info->SD_Status.Ready) + result = sd_scsi_irp(us, srb); + + if (info->MS_Status.Ready) + result = ms_scsi_irp(us, srb); + } +- return 0; ++ return result; + } + + static struct scsi_host_template ene_ub6250_host_template; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index ad2146a9ab2d..675819a1af37 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -173,8 +173,7 @@ int vhost_poll_start(struct vhost_poll *poll, struct file *file) + if (mask) + vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); + if (mask & POLLERR) { +- if (poll->wqh) +- remove_wait_queue(poll->wqh, &poll->wait); ++ vhost_poll_stop(poll); + ret = -EINVAL; + } + +diff --git a/drivers/video/fbdev/vfb.c b/drivers/video/fbdev/vfb.c +index b9c2f81fb6b9..556c39997aab 100644 +--- a/drivers/video/fbdev/vfb.c ++++ b/drivers/video/fbdev/vfb.c +@@ -291,8 +291,23 @@ static int vfb_check_var(struct fb_var_screeninfo *var, + */ + static int vfb_set_par(struct fb_info *info) + { ++ switch (info->var.bits_per_pixel) { ++ case 1: ++ info->fix.visual = FB_VISUAL_MONO01; ++ break; ++ case 8: ++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR; ++ break; ++ case 16: ++ case 24: ++ case 32: ++ info->fix.visual = FB_VISUAL_TRUECOLOR; ++ break; ++ } ++ + info->fix.line_length = get_line_length(info->var.xres_virtual, + info->var.bits_per_pixel); ++ + return 0; + } + +@@ -525,6 +540,8 @@ static int vfb_probe(struct platform_device *dev) + goto err2; + platform_set_drvdata(dev, info); + ++ vfb_set_par(info); ++ + fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n", + videomemorysize >> 10); + return 0; +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index e767f347f2b1..88bee6703cc0 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -2534,7 +2534,7 @@ int end_extent_writepage(struct page *page, int err, u64 start, u64 end) + if (!uptodate) { + ClearPageUptodate(page); + SetPageError(page); +- ret = ret < 0 ? ret : -EIO; ++ ret = err < 0 ? err : -EIO; + mapping_set_error(page->mapping, ret); + } + return 0; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 744be3c146f5..0141aba9eca6 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -589,7 +589,7 @@ cifs_relock_file(struct cifsFileInfo *cfile) + struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); + int rc = 0; + +- down_read(&cinode->lock_sem); ++ down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING); + if (cinode->can_cache_brlcks) { + /* can cache locks - no need to relock */ + up_read(&cinode->lock_sem); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 33b1bc21a120..807e989f436a 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -999,15 +999,19 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + goto tcon_exit; + } + +- if (rsp->ShareType & SMB2_SHARE_TYPE_DISK) ++ switch (rsp->ShareType) { ++ case SMB2_SHARE_TYPE_DISK: + cifs_dbg(FYI, "connection to disk share\n"); +- else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) { ++ break; ++ case SMB2_SHARE_TYPE_PIPE: + tcon->ipc = true; + cifs_dbg(FYI, "connection to pipe share\n"); +- } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) { +- tcon->print = true; ++ break; ++ case SMB2_SHARE_TYPE_PRINT: ++ tcon->ipc = true; + cifs_dbg(FYI, "connection to printer\n"); +- } else { ++ break; ++ default: + cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType); + rc = -EOPNOTSUPP; + goto tcon_error_exit; +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index a8b1749d79a8..debf0707789d 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -460,7 +460,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, + int i, num; + unsigned long nr_pages; + +- num = min_t(pgoff_t, end - index, PAGEVEC_SIZE); ++ num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1; + nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index, + (pgoff_t)num); + if (nr_pages == 0) +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 1ba82dc5afa3..d98ff184d94a 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3874,7 +3874,8 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + + err = ext4_mb_load_buddy(sb, group, &e4b); + if (err) { +- ext4_error(sb, "Error loading buddy information for %u", group); ++ ext4_warning(sb, "Error %d loading buddy information for %u", ++ err, group); + put_bh(bitmap_bh); + return 0; + } +@@ -4031,10 +4032,11 @@ repeat: + BUG_ON(pa->pa_type != MB_INODE_PA); + group = ext4_get_group_number(sb, pa->pa_pstart); + +- err = ext4_mb_load_buddy(sb, group, &e4b); ++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b, ++ GFP_NOFS|__GFP_NOFAIL); + if (err) { +- ext4_error(sb, "Error loading buddy information for %u", +- group); ++ ext4_error(sb, "Error %d loading buddy information for %u", ++ err, group); + continue; + } + +@@ -4290,11 +4292,14 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb, + spin_unlock(&lg->lg_prealloc_lock); + + list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) { ++ int err; + + group = ext4_get_group_number(sb, pa->pa_pstart); +- if (ext4_mb_load_buddy(sb, group, &e4b)) { +- ext4_error(sb, "Error loading buddy information for %u", +- group); ++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b, ++ GFP_NOFS|__GFP_NOFAIL); ++ if (err) { ++ ext4_error(sb, "Error %d loading buddy information for %u", ++ err, group); + continue; + } + ext4_lock_group(sb, group); +@@ -5116,8 +5121,8 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group, + + ret = ext4_mb_load_buddy(sb, group, &e4b); + if (ret) { +- ext4_error(sb, "Error in loading buddy " +- "information for %u", group); ++ ext4_warning(sb, "Error %d loading buddy information for %u", ++ ret, group); + return ret; + } + bitmap = e4b.bd_bitmap; +diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c +index 5f31ebd96c06..a2edb0049eb5 100644 +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -129,6 +129,8 @@ lockd(void *vrqstp) + { + int err = 0; + struct svc_rqst *rqstp = vrqstp; ++ struct net *net = &init_net; ++ struct lockd_net *ln = net_generic(net, lockd_net_id); + + /* try_to_freeze() is called from svc_recv() */ + set_freezable(); +@@ -173,6 +175,8 @@ lockd(void *vrqstp) + if (nlmsvc_ops) + nlmsvc_invalidate_all(); + nlm_shutdown_hosts(); ++ cancel_delayed_work_sync(&ln->grace_period_end); ++ locks_end_grace(&ln->lockd_manager); + return 0; + } + +@@ -267,8 +271,6 @@ static void lockd_down_net(struct svc_serv *serv, struct net *net) + if (ln->nlmsvc_users) { + if (--ln->nlmsvc_users == 0) { + nlm_shutdown_hosts_net(net); +- cancel_delayed_work_sync(&ln->grace_period_end); +- locks_end_grace(&ln->lockd_manager); + svc_shutdown_net(serv, net); + dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net); + } +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 54313322ee5b..c8e90152b61b 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -461,6 +461,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh, + goto out_err_free; + + /* fh */ ++ rc = -EIO; + p = xdr_inline_decode(&stream, 4); + if (!p) + goto out_err_free; +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 8ef6f70c9e25..0f397e62de5a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3025,6 +3025,7 @@ static int _nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *f + .rpc_resp = &res, + }; + int status; ++ int i; + + bitmask[0] = FATTR4_WORD0_SUPPORTED_ATTRS | + FATTR4_WORD0_FH_EXPIRE_TYPE | +@@ -3090,8 +3091,13 @@ static int _nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *f + server->cache_consistency_bitmask[0] &= FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE; + server->cache_consistency_bitmask[1] &= FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY; + server->cache_consistency_bitmask[2] = 0; ++ ++ /* Avoid a regression due to buggy server */ ++ for (i = 0; i < ARRAY_SIZE(res.exclcreat_bitmask); i++) ++ res.exclcreat_bitmask[i] &= res.attr_bitmask[i]; + memcpy(server->exclcreat_bitmask, res.exclcreat_bitmask, + sizeof(server->exclcreat_bitmask)); ++ + server->acl_bitmask = res.acl_bitmask; + server->fh_expire_type = res.fh_expire_type; + } +@@ -7670,6 +7676,12 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf + /* fall through */ + case -NFS4ERR_RETRY_UNCACHED_REP: + return -EAGAIN; ++ case -NFS4ERR_BADSESSION: ++ case -NFS4ERR_DEADSESSION: ++ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: ++ nfs4_schedule_session_recovery(clp->cl_session, ++ task->tk_status); ++ break; + default: + nfs4_schedule_lease_recovery(clp); + } +@@ -7748,7 +7760,6 @@ static int nfs41_proc_reclaim_complete(struct nfs_client *clp, + if (status == 0) + status = task->tk_status; + rpc_put_task(task); +- return 0; + out: + dprintk("<-- %s status=%d\n", __func__, status); + return status; +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 9a0b219ff74d..83fba40396ae 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1593,13 +1593,14 @@ static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp) + nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot); + } + +-static void nfs4_reclaim_complete(struct nfs_client *clp, ++static int nfs4_reclaim_complete(struct nfs_client *clp, + const struct nfs4_state_recovery_ops *ops, + struct rpc_cred *cred) + { + /* Notify the server we're done reclaiming our state */ + if (ops->reclaim_complete) +- (void)ops->reclaim_complete(clp, cred); ++ return ops->reclaim_complete(clp, cred); ++ return 0; + } + + static void nfs4_clear_reclaim_server(struct nfs_server *server) +@@ -1646,13 +1647,16 @@ static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp) + { + const struct nfs4_state_recovery_ops *ops; + struct rpc_cred *cred; ++ int err; + + if (!nfs4_state_clear_reclaim_reboot(clp)) + return; + ops = clp->cl_mvops->reboot_recovery_ops; + cred = nfs4_get_clid_cred(clp); +- nfs4_reclaim_complete(clp, ops, cred); ++ err = nfs4_reclaim_complete(clp, ops, cred); + put_rpccred(cred); ++ if (err == -NFS4ERR_CONN_NOT_BOUND_TO_SESSION) ++ set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state); + } + + static void nfs_delegation_clear_all(struct nfs_client *clp) +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index 220b04f04523..985a4cdae06d 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -272,6 +272,16 @@ ssize_t ovl_getxattr(struct dentry *dentry, const char *name, + return vfs_getxattr(realpath.dentry, name, value, size); + } + ++static bool ovl_can_list(const char *s) ++{ ++ /* List all non-trusted xatts */ ++ if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0) ++ return true; ++ ++ /* Never list trusted.overlay, list other trusted for superuser only */ ++ return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN); ++} ++ + ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + { + struct path realpath; +@@ -296,7 +306,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + return -EIO; + + len -= slen; +- if (ovl_is_private_xattr(s)) { ++ if (!ovl_can_list(s)) { + res -= slen; + memmove(s, s + slen, len); + } else { +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index d1e49d52b640..de179993e039 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -10,3 +10,8 @@ + #undef uninitialized_var + #define uninitialized_var(x) x = *(&(x)) + #endif ++ ++/* same as gcc, this was present in clang-2.6 so we can assume it works ++ * with any version that can compile the kernel ++ */ ++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) +diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h +index fe052e234906..bb1018882199 100644 +--- a/include/linux/mlx4/qp.h ++++ b/include/linux/mlx4/qp.h +@@ -465,6 +465,7 @@ struct mlx4_update_qp_params { + u16 rate_val; + }; + ++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn); + int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn, + enum mlx4_update_qp_attr attr, + struct mlx4_update_qp_params *params); +diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h +index a91b67b18a73..5c93f4a89afa 100644 +--- a/include/linux/mlx5/device.h ++++ b/include/linux/mlx5/device.h +@@ -635,8 +635,14 @@ enum { + }; + + enum { +- CQE_RSS_HTYPE_IP = 0x3 << 6, +- CQE_RSS_HTYPE_L4 = 0x3 << 2, ++ CQE_RSS_HTYPE_IP = 0x3 << 2, ++ /* cqe->rss_hash_type[3:2] - IP destination selected for hash ++ * (00 = none, 01 = IPv4, 10 = IPv6, 11 = Reserved) ++ */ ++ CQE_RSS_HTYPE_L4 = 0x3 << 6, ++ /* cqe->rss_hash_type[7:6] - L4 destination selected for hash ++ * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI ++ */ + }; + + enum { +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index b5421f6f155a..a6da214d0584 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -879,10 +879,10 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, + unsigned int headroom); + struct sk_buff *skb_copy_expand(const struct sk_buff *skb, int newheadroom, + int newtailroom, gfp_t priority); +-int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, +- int offset, int len); +-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, +- int len); ++int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, ++ int offset, int len); ++int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, ++ int offset, int len); + int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer); + int skb_pad(struct sk_buff *skb, int pad); + #define dev_kfree_skb(a) consume_skb(a) +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index b5f3693fe5b6..c05748cc1b20 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -933,9 +933,9 @@ enum rate_info_flags { + * @RATE_INFO_BW_160: 160 MHz bandwidth + */ + enum rate_info_bw { ++ RATE_INFO_BW_20 = 0, + RATE_INFO_BW_5, + RATE_INFO_BW_10, +- RATE_INFO_BW_20, + RATE_INFO_BW_40, + RATE_INFO_BW_80, + RATE_INFO_BW_160, +diff --git a/include/net/x25.h b/include/net/x25.h +index c383aa4edbf0..6d30a01d281d 100644 +--- a/include/net/x25.h ++++ b/include/net/x25.h +@@ -298,10 +298,10 @@ void x25_check_rbuf(struct sock *); + + /* sysctl_net_x25.c */ + #ifdef CONFIG_SYSCTL +-void x25_register_sysctl(void); ++int x25_register_sysctl(void); + void x25_unregister_sysctl(void); + #else +-static inline void x25_register_sysctl(void) {}; ++static inline int x25_register_sysctl(void) { return 0; }; + static inline void x25_unregister_sysctl(void) {}; + #endif /* CONFIG_SYSCTL */ + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8f75386e61a7..835ac4d9f349 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5271,9 +5271,6 @@ static void perf_output_read_one(struct perf_output_handle *handle, + __output_copy(handle, values, n * sizeof(u64)); + } + +-/* +- * XXX PERF_FORMAT_GROUP vs inherited events seems difficult. +- */ + static void perf_output_read_group(struct perf_output_handle *handle, + struct perf_event *event, + u64 enabled, u64 running) +@@ -5318,6 +5315,13 @@ static void perf_output_read_group(struct perf_output_handle *handle, + #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\ + PERF_FORMAT_TOTAL_TIME_RUNNING) + ++/* ++ * XXX PERF_SAMPLE_READ vs inherited events seems difficult. ++ * ++ * The problem is that its both hard and excessively expensive to iterate the ++ * child list, not to mention that its impossible to IPI the children running ++ * on another CPU, from interrupt/NMI context. ++ */ + static void perf_output_read(struct perf_output_handle *handle, + struct perf_event *event) + { +@@ -7958,9 +7962,10 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + local64_set(&hwc->period_left, hwc->sample_period); + + /* +- * we currently do not support PERF_FORMAT_GROUP on inherited events ++ * We currently do not support PERF_SAMPLE_READ on inherited events. ++ * See perf_output_read(). + */ +- if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP)) ++ if (attr->inherit && (attr->sample_type & PERF_SAMPLE_READ)) + goto err_ns; + + if (!has_branch_stack(event)) +diff --git a/kernel/futex.c b/kernel/futex.c +index 1fce19fc824c..a12aa6785361 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -470,6 +470,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) + unsigned long address = (unsigned long)uaddr; + struct mm_struct *mm = current->mm; + struct page *page, *page_head; ++ struct address_space *mapping; + int err, ro = 0; + + /* +@@ -555,7 +556,19 @@ again: + } + #endif + +- lock_page(page_head); ++ /* ++ * The treatment of mapping from this point on is critical. The page ++ * lock protects many things but in this context the page lock ++ * stabilizes mapping, prevents inode freeing in the shared ++ * file-backed region case and guards against movement to swap cache. ++ * ++ * Strictly speaking the page lock is not needed in all cases being ++ * considered here and page lock forces unnecessarily serialization ++ * From this point on, mapping will be re-verified if necessary and ++ * page lock will be acquired only if it is unavoidable ++ */ ++ ++ mapping = READ_ONCE(page_head->mapping); + + /* + * If page_head->mapping is NULL, then it cannot be a PageAnon +@@ -572,18 +585,31 @@ again: + * shmem_writepage move it from filecache to swapcache beneath us: + * an unlikely race, but we do need to retry for page_head->mapping. + */ +- if (!page_head->mapping) { +- int shmem_swizzled = PageSwapCache(page_head); ++ if (unlikely(!mapping)) { ++ int shmem_swizzled; ++ ++ /* ++ * Page lock is required to identify which special case above ++ * applies. If this is really a shmem page then the page lock ++ * will prevent unexpected transitions. ++ */ ++ lock_page(page); ++ shmem_swizzled = PageSwapCache(page) || page->mapping; + unlock_page(page_head); + put_page(page_head); ++ + if (shmem_swizzled) + goto again; ++ + return -EFAULT; + } + + /* + * Private mappings are handled in a simple way. + * ++ * If the futex key is stored on an anonymous page, then the associated ++ * object is the mm which is implicitly pinned by the calling process. ++ * + * NOTE: When userspace waits on a MAP_SHARED mapping, even if + * it's a read-only handle, it's expected that futexes attach to + * the object not the particular process. +@@ -601,16 +627,74 @@ again: + key->both.offset |= FUT_OFF_MMSHARED; /* ref taken on mm */ + key->private.mm = mm; + key->private.address = address; ++ ++ get_futex_key_refs(key); /* implies smp_mb(); (B) */ ++ + } else { ++ struct inode *inode; ++ ++ /* ++ * The associated futex object in this case is the inode and ++ * the page->mapping must be traversed. Ordinarily this should ++ * be stabilised under page lock but it's not strictly ++ * necessary in this case as we just want to pin the inode, not ++ * update the radix tree or anything like that. ++ * ++ * The RCU read lock is taken as the inode is finally freed ++ * under RCU. If the mapping still matches expectations then the ++ * mapping->host can be safely accessed as being a valid inode. ++ */ ++ rcu_read_lock(); ++ ++ if (READ_ONCE(page_head->mapping) != mapping) { ++ rcu_read_unlock(); ++ put_page(page_head); ++ ++ goto again; ++ } ++ ++ inode = READ_ONCE(mapping->host); ++ if (!inode) { ++ rcu_read_unlock(); ++ put_page(page_head); ++ ++ goto again; ++ } ++ ++ /* ++ * Take a reference unless it is about to be freed. Previously ++ * this reference was taken by ihold under the page lock ++ * pinning the inode in place so i_lock was unnecessary. The ++ * only way for this check to fail is if the inode was ++ * truncated in parallel so warn for now if this happens. ++ * ++ * We are not calling into get_futex_key_refs() in file-backed ++ * cases, therefore a successful atomic_inc return below will ++ * guarantee that get_futex_key() will still imply smp_mb(); (B). ++ */ ++ if (WARN_ON_ONCE(!atomic_inc_not_zero(&inode->i_count))) { ++ rcu_read_unlock(); ++ put_page(page_head); ++ ++ goto again; ++ } ++ ++ /* Should be impossible but lets be paranoid for now */ ++ if (WARN_ON_ONCE(inode->i_mapping != mapping)) { ++ err = -EFAULT; ++ rcu_read_unlock(); ++ iput(inode); ++ ++ goto out; ++ } ++ + key->both.offset |= FUT_OFF_INODE; /* inode-based key */ +- key->shared.inode = page_head->mapping->host; ++ key->shared.inode = inode; + key->shared.pgoff = basepage_index(page); ++ rcu_read_unlock(); + } + +- get_futex_key_refs(key); /* implies MB (B) */ +- + out: +- unlock_page(page_head); + put_page(page_head); + return err; + } +diff --git a/kernel/pid.c b/kernel/pid.c +index b17263be9082..5fe7cdb6d05f 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -322,8 +322,10 @@ struct pid *alloc_pid(struct pid_namespace *ns) + } + + if (unlikely(is_child_reaper(pid))) { +- if (pid_ns_prepare_proc(ns)) ++ if (pid_ns_prepare_proc(ns)) { ++ disable_pid_allocation(ns); + goto out_free; ++ } + } + + get_pid_ns(ns); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 812069b66f47..3b136fb4422c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2223,7 +2223,8 @@ void task_numa_work(struct callback_head *work) + return; + + +- down_read(&mm->mmap_sem); ++ if (!down_read_trylock(&mm->mmap_sem)) ++ return; + vma = find_vma(mm, start); + if (!vma) { + reset_ptenuma_scan(p); +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 89da689b6433..ac9791dd4768 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + + #include "vlan.h" +@@ -654,8 +655,11 @@ static int vlan_ethtool_get_ts_info(struct net_device *dev, + { + const struct vlan_dev_priv *vlan = vlan_dev_priv(dev); + const struct ethtool_ops *ops = vlan->real_dev->ethtool_ops; ++ struct phy_device *phydev = vlan->real_dev->phydev; + +- if (ops->get_ts_info) { ++ if (phydev && phydev->drv && phydev->drv->ts_info) { ++ return phydev->drv->ts_info(phydev, info); ++ } else if (ops->get_ts_info) { + return ops->get_ts_info(vlan->real_dev, info); + } else { + info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE | +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 62edbf1b114e..5d0b1358c754 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -716,6 +716,7 @@ static void hci_set_event_mask_page_2(struct hci_request *req) + { + struct hci_dev *hdev = req->hdev; + u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; ++ bool changed = false; + + /* If Connectionless Slave Broadcast master role is supported + * enable all necessary events for it. +@@ -725,6 +726,7 @@ static void hci_set_event_mask_page_2(struct hci_request *req) + events[1] |= 0x80; /* Synchronization Train Complete */ + events[2] |= 0x10; /* Slave Page Response Timeout */ + events[2] |= 0x20; /* CSB Channel Map Change */ ++ changed = true; + } + + /* If Connectionless Slave Broadcast slave role is supported +@@ -735,13 +737,24 @@ static void hci_set_event_mask_page_2(struct hci_request *req) + events[2] |= 0x02; /* CSB Receive */ + events[2] |= 0x04; /* CSB Timeout */ + events[2] |= 0x08; /* Truncated Page Complete */ ++ changed = true; + } + + /* Enable Authenticated Payload Timeout Expired event if supported */ +- if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) ++ if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) { + events[2] |= 0x80; ++ changed = true; ++ } + +- hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events); ++ /* Some Broadcom based controllers indicate support for Set Event ++ * Mask Page 2 command, but then actually do not support it. Since ++ * the default value is all bits set to zero, the command is only ++ * required if the event mask has to be changed. In case no change ++ * to the event mask is needed, skip this command. ++ */ ++ if (changed) ++ hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, ++ sizeof(events), events); + } + + static void hci_init3_req(struct hci_request *req, unsigned long opt) +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index bc95e48d5cfb..378c9ed00d40 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -295,6 +295,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end) + u32 yes; + struct crush_rule *r; + ++ err = -EINVAL; + ceph_decode_32_safe(p, end, yes, bad); + if (!yes) { + dout("crush_decode NO rule %d off %x %p to %p\n", +diff --git a/net/core/dev.c b/net/core/dev.c +index b2f589012c6b..dc63c37d5301 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -989,7 +989,7 @@ bool dev_valid_name(const char *name) + { + if (*name == '\0') + return false; +- if (strlen(name) >= IFNAMSIZ) ++ if (strnlen(name, IFNAMSIZ) == IFNAMSIZ) + return false; + if (!strcmp(name, ".") || !strcmp(name, "..")) + return false; +@@ -2515,7 +2515,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth) + if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) + return 0; + +- eth = (struct ethhdr *)skb_mac_header(skb); ++ eth = (struct ethhdr *)skb->data; + type = eth->h_proto; + } + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 253c86b78ff0..33432e64804c 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + lladdr = neigh->ha; + } + +- if (new & NUD_CONNECTED) +- neigh->confirmed = jiffies; +- neigh->updated = jiffies; +- + /* If entry was valid and address is not changed, + do not change entry state, if new one is STALE. + */ +@@ -1159,6 +1155,16 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + } + } + ++ /* Update timestamps only once we know we will make a change to the ++ * neighbour entry. Otherwise we risk to move the locktime window with ++ * noop updates and ignore relevant ARP updates. ++ */ ++ if (new != old || lladdr != neigh->ha) { ++ if (new & NUD_CONNECTED) ++ neigh->confirmed = jiffies; ++ neigh->updated = jiffies; ++ } ++ + if (new != old) { + neigh_del_timer(neigh); + if (new & NUD_PROBE) +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index b5c351d2830b..ccd20669ac00 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -310,6 +310,25 @@ out_undo: + goto out; + } + ++static int __net_init net_defaults_init_net(struct net *net) ++{ ++ net->core.sysctl_somaxconn = SOMAXCONN; ++ return 0; ++} ++ ++static struct pernet_operations net_defaults_ops = { ++ .init = net_defaults_init_net, ++}; ++ ++static __init int net_defaults_init(void) ++{ ++ if (register_pernet_subsys(&net_defaults_ops)) ++ panic("Cannot initialize net default settings"); ++ ++ return 0; ++} ++ ++core_initcall(net_defaults_init); + + #ifdef CONFIG_NET_NS + static struct kmem_cache *net_cachep; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 284370b61b8c..7d3442594e0d 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2551,7 +2551,8 @@ void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len) + { + int pos = skb_headlen(skb); + +- skb_shinfo(skb1)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG; ++ skb_shinfo(skb1)->tx_flags |= skb_shinfo(skb)->tx_flags & ++ SKBTX_SHARED_FRAG; + if (len < pos) /* Split line is inside header. */ + skb_split_inside_header(skb, skb1, len, pos); + else /* Second chunk has no header, nothing to copy. */ +@@ -3115,8 +3116,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + skb_copy_from_linear_data_offset(head_skb, offset, + skb_put(nskb, hsize), hsize); + +- skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags & +- SKBTX_SHARED_FRAG; ++ skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags & ++ SKBTX_SHARED_FRAG; + + while (pos < offset + len) { + if (i >= nfrags) { +@@ -3329,24 +3330,18 @@ void __init skb_init(void) + NULL); + } + +-/** +- * skb_to_sgvec - Fill a scatter-gather list from a socket buffer +- * @skb: Socket buffer containing the buffers to be mapped +- * @sg: The scatter-gather list to map into +- * @offset: The offset into the buffer's contents to start mapping +- * @len: Length of buffer space to be mapped +- * +- * Fill the specified scatter-gather list with mappings/pointers into a +- * region of the buffer space attached to a socket buffer. +- */ + static int +-__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) ++__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len, ++ unsigned int recursion_level) + { + int start = skb_headlen(skb); + int i, copy = start - offset; + struct sk_buff *frag_iter; + int elt = 0; + ++ if (unlikely(recursion_level >= 24)) ++ return -EMSGSIZE; ++ + if (copy > 0) { + if (copy > len) + copy = len; +@@ -3365,6 +3360,8 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) + end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]); + if ((copy = end - offset) > 0) { + skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; ++ if (unlikely(elt && sg_is_last(&sg[elt - 1]))) ++ return -EMSGSIZE; + + if (copy > len) + copy = len; +@@ -3379,16 +3376,22 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) + } + + skb_walk_frags(skb, frag_iter) { +- int end; ++ int end, ret; + + WARN_ON(start > offset + len); + + end = start + frag_iter->len; + if ((copy = end - offset) > 0) { ++ if (unlikely(elt && sg_is_last(&sg[elt - 1]))) ++ return -EMSGSIZE; ++ + if (copy > len) + copy = len; +- elt += __skb_to_sgvec(frag_iter, sg+elt, offset - start, +- copy); ++ ret = __skb_to_sgvec(frag_iter, sg+elt, offset - start, ++ copy, recursion_level + 1); ++ if (unlikely(ret < 0)) ++ return ret; ++ elt += ret; + if ((len -= copy) == 0) + return elt; + offset += copy; +@@ -3399,6 +3402,31 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) + return elt; + } + ++/** ++ * skb_to_sgvec - Fill a scatter-gather list from a socket buffer ++ * @skb: Socket buffer containing the buffers to be mapped ++ * @sg: The scatter-gather list to map into ++ * @offset: The offset into the buffer's contents to start mapping ++ * @len: Length of buffer space to be mapped ++ * ++ * Fill the specified scatter-gather list with mappings/pointers into a ++ * region of the buffer space attached to a socket buffer. Returns either ++ * the number of scatterlist items used, or -EMSGSIZE if the contents ++ * could not fit. ++ */ ++int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) ++{ ++ int nsg = __skb_to_sgvec(skb, sg, offset, len, 0); ++ ++ if (nsg <= 0) ++ return nsg; ++ ++ sg_mark_end(&sg[nsg - 1]); ++ ++ return nsg; ++} ++EXPORT_SYMBOL_GPL(skb_to_sgvec); ++ + /* As compared with skb_to_sgvec, skb_to_sgvec_nomark only map skb to given + * sglist without mark the sg which contain last skb data as the end. + * So the caller can mannipulate sg list as will when padding new data after +@@ -3421,19 +3449,11 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) + int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, + int offset, int len) + { +- return __skb_to_sgvec(skb, sg, offset, len); ++ return __skb_to_sgvec(skb, sg, offset, len, 0); + } + EXPORT_SYMBOL_GPL(skb_to_sgvec_nomark); + +-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) +-{ +- int nsg = __skb_to_sgvec(skb, sg, offset, len); + +- sg_mark_end(&sg[nsg - 1]); +- +- return nsg; +-} +-EXPORT_SYMBOL_GPL(skb_to_sgvec); + + /** + * skb_cow_data - Check that a socket buffer's data buffers are writable +@@ -3715,7 +3735,8 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, + return; + + if (tsonly) { +- skb_shinfo(skb)->tx_flags = skb_shinfo(orig_skb)->tx_flags; ++ skb_shinfo(skb)->tx_flags |= skb_shinfo(orig_skb)->tx_flags & ++ SKBTX_ANY_TSTAMP; + skb_shinfo(skb)->tskey = skb_shinfo(orig_skb)->tskey; + } + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 6578a0a2f708..32898247d8bf 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -429,8 +429,6 @@ static __net_init int sysctl_core_net_init(struct net *net) + { + struct ctl_table *tbl; + +- net->core.sysctl_somaxconn = SOMAXCONN; +- + tbl = netns_core_table; + if (!net_eq(net, &init_net)) { + tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL); +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index a548be247e15..47b397264f24 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -302,12 +302,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + skb->sk = sk; + skb->protocol = htons(ETH_P_IEEE802154); + +- dev_put(dev); +- + err = dev_queue_xmit(skb); + if (err > 0) + err = net_xmit_errno(err); + ++ dev_put(dev); ++ + return err ?: size; + + out_skb: +@@ -689,12 +689,12 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + skb->sk = sk; + skb->protocol = htons(ETH_P_IEEE802154); + +- dev_put(dev); +- + err = dev_queue_xmit(skb); + if (err > 0) + err = net_xmit_errno(err); + ++ dev_put(dev); ++ + return err ?: size; + + out_skb: +diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c +index 22377c8ff14b..e8f862358518 100644 +--- a/net/ipv4/ah4.c ++++ b/net/ipv4/ah4.c +@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb) + ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) + skb_push(skb, ihl); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index cb5eb649ad5f..bfa79831873f 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev) + /*unsigned long now; */ + struct net *net = dev_net(dev); + +- rt = ip_route_output(net, sip, tip, 0, 0); ++ rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev)); + if (IS_ERR(rt)) + return 1; + if (rt->dst.dev != dev) { +@@ -658,6 +658,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb) + unsigned char *arp_ptr; + struct rtable *rt; + unsigned char *sha; ++ unsigned char *tha = NULL; + __be32 sip, tip; + u16 dev_type = dev->type; + int addr_type; +@@ -729,6 +730,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb) + break; + #endif + default: ++ tha = arp_ptr; + arp_ptr += dev->addr_len; + } + memcpy(&tip, arp_ptr, 4); +@@ -839,8 +841,18 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb) + It is possible, that this option should be enabled for some + devices (strip is candidate) + */ +- is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip && +- addr_type == RTN_UNICAST; ++ is_garp = tip == sip && addr_type == RTN_UNICAST; ++ ++ /* Unsolicited ARP _replies_ also require target hwaddr to be ++ * the same as source. ++ */ ++ if (is_garp && arp->ar_op == htons(ARPOP_REPLY)) ++ is_garp = ++ /* IPv4 over IEEE 1394 doesn't provide target ++ * hardware address field in its ARP payload. ++ */ ++ tha && ++ !memcmp(tha, sha, dev->addr_len); + + if (!n && + ((arp->ar_op == htons(ARPOP_REPLY) && +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 20fb25e3027b..3d8021d55336 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) + esph->spi = x->id.spi; + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, +- (unsigned char *)esph - skb->data, +- assoclen + ivlen + clen + alen); +- ++ err = skb_to_sgvec(skb, sg, ++ (unsigned char *)esph - skb->data, ++ assoclen + ivlen + clen + alen); ++ if (unlikely(err < 0)) ++ goto error; + aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); + aead_request_set_ad(req, assoclen); + +@@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) + } + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ err = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out; + + aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); + aead_request_set_ad(req, assoclen); +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 80e2d1b0c08c..3d62feb65932 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_create(struct net *net, + struct net_device *dev; + char name[IFNAMSIZ]; + +- if (parms->name[0]) ++ err = -E2BIG; ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else { +- if (strlen(ops->kind) > (IFNAMSIZ - 3)) { +- err = -E2BIG; ++ } else { ++ if (strlen(ops->kind) > (IFNAMSIZ - 3)) + goto failed; +- } + strlcpy(name, ops->kind, IFNAMSIZ); + strncat(name, "%d", 2); + } +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 75433ed6714b..96115d1e0d90 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -117,6 +117,7 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2; + #define FLAG_DSACKING_ACK 0x800 /* SACK blocks contained D-SACK info */ + #define FLAG_SACK_RENEGING 0x2000 /* snd_una advanced to a sacked seq */ + #define FLAG_UPDATE_TS_RECENT 0x4000 /* tcp_replace_ts_recent() */ ++#define FLAG_NO_CHALLENGE_ACK 0x8000 /* do not call tcp_send_challenge_ack() */ + + #define FLAG_ACKED (FLAG_DATA_ACKED|FLAG_SYN_ACKED) + #define FLAG_NOT_DUP (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED) +@@ -3543,7 +3544,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + if (before(ack, prior_snd_una)) { + /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ + if (before(ack, prior_snd_una - tp->max_window)) { +- tcp_send_challenge_ack(sk, skb); ++ if (!(flag & FLAG_NO_CHALLENGE_ACK)) ++ tcp_send_challenge_ack(sk, skb); + return -1; + } + goto old_ack; +@@ -5832,13 +5834,17 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + + /* step 5: check the ACK field */ + acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH | +- FLAG_UPDATE_TS_RECENT) > 0; ++ FLAG_UPDATE_TS_RECENT | ++ FLAG_NO_CHALLENGE_ACK) > 0; + ++ if (!acceptable) { ++ if (sk->sk_state == TCP_SYN_RECV) ++ return 1; /* send one RST */ ++ tcp_send_challenge_ack(sk, skb); ++ goto discard; ++ } + switch (sk->sk_state) { + case TCP_SYN_RECV: +- if (!acceptable) +- return 1; +- + if (!tp->srtt_us) + tcp_synack_rtt_meas(sk, req); + +@@ -5907,14 +5913,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) + * our SYNACK so stop the SYNACK timer. + */ + if (req) { +- /* Return RST if ack_seq is invalid. +- * Note that RFC793 only says to generate a +- * DUPACK for it but for TCP Fast Open it seems +- * better to treat this case like TCP_SYN_RECV +- * above. +- */ +- if (!acceptable) +- return 1; + /* We no longer need the request sock. */ + reqsk_fastopen_remove(sk, req, false); + tcp_rearm_rto(sk); +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 92174881844d..0613be57513e 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -957,7 +957,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, + INIT_HLIST_NODE(&ifa->addr_lst); + ifa->scope = scope; + ifa->prefix_len = pfxlen; +- ifa->flags = flags | IFA_F_TENTATIVE; ++ ifa->flags = flags; ++ /* No need to add the TENTATIVE flag for addresses with NODAD */ ++ if (!(flags & IFA_F_NODAD)) ++ ifa->flags |= IFA_F_TENTATIVE; + ifa->valid_lft = valid_lft; + ifa->prefered_lft = prefered_lft; + ifa->cstamp = ifa->tstamp = jiffies; +diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c +index 0630a4d5daaa..0edc44cb254e 100644 +--- a/net/ipv6/ah6.c ++++ b/net/ipv6/ah6.c +@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) + ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +@@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) + ip6h->hop_limit = 0; + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 111ba55fd512..6a924be66e37 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) + esph->spi = x->id.spi; + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, +- (unsigned char *)esph - skb->data, +- assoclen + ivlen + clen + alen); ++ err = skb_to_sgvec(skb, sg, ++ (unsigned char *)esph - skb->data, ++ assoclen + ivlen + clen + alen); ++ if (unlikely(err < 0)) ++ goto error; + + aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); + aead_request_set_ad(req, assoclen); +@@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) + } + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ ret = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(ret < 0)) ++ goto out; + + aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); + aead_request_set_ad(req, assoclen); +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 9ada1095c1cd..b25f4ad28b03 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -320,11 +320,13 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net, + if (t || !create) + return t; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ return NULL; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "ip6gre%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6gre_tunnel_setup); + if (!dev) +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 3ef81c387923..bfa710e8b615 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -340,6 +340,10 @@ static int ip6_forward_proxy_check(struct sk_buff *skb) + static inline int ip6_forward_finish(struct net *net, struct sock *sk, + struct sk_buff *skb) + { ++ struct dst_entry *dst = skb_dst(skb); ++ ++ IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); ++ IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); + skb_sender_cpu_clear(skb); + return dst_output(net, sk, skb); + } +@@ -534,8 +538,6 @@ int ip6_forward(struct sk_buff *skb) + + hdr->hop_limit--; + +- IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); +- IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); + return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, + net, NULL, skb, skb->dev, dst->dev, + ip6_forward_finish); +@@ -1276,7 +1278,7 @@ static int __ip6_append_data(struct sock *sk, + unsigned int flags, int dontfrag) + { + struct sk_buff *skb, *skb_prev = NULL; +- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu; ++ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu; + int exthdrlen = 0; + int dst_exthdrlen = 0; + int hh_len; +@@ -1312,6 +1314,12 @@ static int __ip6_append_data(struct sock *sk, + sizeof(struct frag_hdr) : 0) + + rt->rt6i_nfheader_len; + ++ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit ++ * the first fragment ++ */ ++ if (headersize + transhdrlen > mtu) ++ goto emsgsize; ++ + if (cork->length + length > mtu - headersize && dontfrag && + (sk->sk_protocol == IPPROTO_UDP || + sk->sk_protocol == IPPROTO_RAW)) { +@@ -1327,9 +1335,8 @@ static int __ip6_append_data(struct sock *sk, + + if (cork->length + length > maxnonfragsize - headersize) { + emsgsize: +- ipv6_local_error(sk, EMSGSIZE, fl6, +- mtu - headersize + +- sizeof(struct ipv6hdr)); ++ pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0); ++ ipv6_local_error(sk, EMSGSIZE, fl6, pmtu); + return -EMSGSIZE; + } + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 946c2d015b94..e8f21dd520b2 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -286,13 +286,16 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p) + struct net_device *dev; + struct ip6_tnl *t; + char name[IFNAMSIZ]; +- int err = -ENOMEM; ++ int err = -E2BIG; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6tnl%%d"); +- ++ } ++ err = -ENOMEM; + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6_tnl_dev_setup); + if (!dev) +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index d7105422bc63..40bb7a5e6d47 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -212,10 +212,13 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p + char name[IFNAMSIZ]; + int err; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6_vti%%d"); ++ } + + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, vti6_dev_setup); + if (!dev) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 48db6f5cec2c..99920fcea97c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -851,6 +851,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net, + struct fib6_node *fn; + struct rt6_info *rt; + ++ if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) ++ flags &= ~RT6_LOOKUP_F_IFACE; ++ + read_lock_bh(&table->tb6_lock); + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); + restart: +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index bbba435d0639..51f7c32f04d7 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -244,11 +244,13 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net, + if (!create) + goto failed; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "sit%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ipip6_tunnel_setup); + if (!dev) +@@ -690,6 +692,7 @@ static int ipip6_rcv(struct sk_buff *skb) + + if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6))) + goto out; ++ iph = ip_hdr(skb); + + err = IP_ECN_decapsulate(iph, skb); + if (unlikely(err)) { +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 6482b001f19a..15150b412930 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -3305,7 +3305,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, + p += pol->sadb_x_policy_len*8; + sec_ctx = (struct sadb_x_sec_ctx *)p; + if (len < pol->sadb_x_policy_len*8 + +- sec_ctx->sadb_x_sec_len) { ++ sec_ctx->sadb_x_sec_len*8) { + *dir = -EINVAL; + goto out; + } +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index fb3248ff8b48..ae3438685caa 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -732,6 +732,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || ++ (session->offset && ++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index bb8edb9ef506..1e698768aca8 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -309,6 +309,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + int rc = -EINVAL; + + dprintk("%s: binding %02X\n", __func__, addr->sllc_sap); ++ ++ lock_sock(sk); + if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) + goto out; + rc = -EAFNOSUPPORT; +@@ -380,6 +382,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + out_put: + llc_sap_put(sap); + out: ++ release_sock(sk); + return rc; + } + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 23095d5e0199..005cd8796505 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -4326,6 +4326,10 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, + if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) + return -EINVAL; + ++ /* If a reconfig is happening, bail out */ ++ if (local->in_reconfig) ++ return -EBUSY; ++ + if (assoc) { + rcu_read_lock(); + have_sta = sta_info_get(sdata, cbss->bssid); +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 4ece07c68b3f..c68e020427ab 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -887,8 +887,13 @@ restart: + } + out: + local_bh_enable(); +- if (last) ++ if (last) { ++ /* nf ct hash resize happened, now clear the leftover. */ ++ if ((struct nf_conn *)cb->args[1] == last) ++ cb->args[1] = 0; ++ + nf_ct_put(last); ++ } + + return skb->len; + } +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 48e1608414e6..98fe9691337c 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1054,6 +1054,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + if (addr->sa_family != AF_NETLINK) + return -EINVAL; + ++ if (alen < sizeof(struct sockaddr_nl)) ++ return -EINVAL; ++ + if ((nladdr->nl_groups || nladdr->nl_pid) && + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + return -EPERM; +diff --git a/net/rds/bind.c b/net/rds/bind.c +index b22ea956522b..e29b47193645 100644 +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -108,6 +108,7 @@ static int rds_add_bound(struct rds_sock *rs, __be32 addr, __be16 *port) + rs, &addr, (int)ntohs(*port)); + break; + } else { ++ rs->rs_bound_addr = 0; + rds_sock_put(rs); + ret = -ENOMEM; + break; +diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c +index d7a9ab5a9d9c..6c65fb229e50 100644 +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -209,7 +209,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, + struct sk_buff *trailer; + unsigned int len; + u16 check; +- int nsg; ++ int nsg, err; + + sp = rxrpc_skb(skb); + +@@ -240,7 +240,9 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call, + len &= ~(call->conn->size_align - 1); + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, len); ++ err = skb_to_sgvec(skb, sg, 0, len); ++ if (unlikely(err < 0)) ++ return err; + crypto_blkcipher_encrypt_iv(&desc, sg, sg, len); + + _leave(" = 0"); +@@ -336,7 +338,7 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call, + struct sk_buff *trailer; + u32 data_size, buf; + u16 check; +- int nsg; ++ int nsg, ret; + + _enter(""); + +@@ -348,7 +350,9 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call, + goto nomem; + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, 8); ++ ret = skb_to_sgvec(skb, sg, 0, 8); ++ if (unlikely(ret < 0)) ++ return ret; + + /* start the decryption afresh */ + memset(&iv, 0, sizeof(iv)); +@@ -411,7 +415,7 @@ static int rxkad_verify_packet_encrypt(const struct rxrpc_call *call, + struct sk_buff *trailer; + u32 data_size, buf; + u16 check; +- int nsg; ++ int nsg, ret; + + _enter(",{%d}", skb->len); + +@@ -430,7 +434,12 @@ static int rxkad_verify_packet_encrypt(const struct rxrpc_call *call, + } + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ ret = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(ret < 0)) { ++ if (sg != _sg) ++ kfree(sg); ++ return ret; ++ } + + /* decrypt from the session key */ + token = call->conn->key->payload.data[0]; +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index 694a06f1e0d5..f44fea22d69c 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -101,8 +101,10 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb, + a->order = n_i; + + nest = nla_nest_start(skb, a->order); +- if (nest == NULL) ++ if (nest == NULL) { ++ index--; + goto nla_put_failure; ++ } + err = tcf_action_dump_1(skb, a, 0, 0); + if (err < 0) { + index--; +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index 0bc6f912f870..bd155e59be1c 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -249,10 +249,14 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg) + + static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg) + { +- if (cfg->is_ebpf) +- bpf_prog_put(cfg->filter); +- else +- bpf_prog_destroy(cfg->filter); ++ struct bpf_prog *filter = cfg->filter; ++ ++ if (filter) { ++ if (cfg->is_ebpf) ++ bpf_prog_put(filter); ++ else ++ bpf_prog_destroy(filter); ++ } + + kfree(cfg->bpf_ops); + kfree(cfg->bpf_name); +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 481806b43de8..edb8514b4e00 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -723,8 +723,10 @@ static int sctp_v6_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr) + sctp_v6_map_v4(addr); + } + +- if (addr->sa.sa_family == AF_INET) ++ if (addr->sa.sa_family == AF_INET) { ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + return sizeof(struct sockaddr_in); ++ } + return sizeof(struct sockaddr_in6); + } + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index df6a4b2d0728..13c7f42b7040 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -335,11 +335,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, + if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + +- /* V4 mapped address are really of AF_INET family */ +- if (addr->sa.sa_family == AF_INET6 && +- ipv6_addr_v4mapped(&addr->v6.sin6_addr) && +- !opt->pf->af_supported(AF_INET, opt)) +- return NULL; ++ if (addr->sa.sa_family == AF_INET6) { ++ if (len < SIN6_LEN_RFC2133) ++ return NULL; ++ /* V4 mapped address are really of AF_INET family */ ++ if (ipv6_addr_v4mapped(&addr->v6.sin6_addr) && ++ !opt->pf->af_supported(AF_INET, opt)) ++ return NULL; ++ } + + /* If we get this far, af is valid. */ + af = sctp_get_af_specific(addr->sa.sa_family); +@@ -1518,7 +1521,7 @@ static void sctp_close(struct sock *sk, long timeout) + + pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout); + +- lock_sock(sk); ++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING); + sk->sk_shutdown = SHUTDOWN_MASK; + sk->sk_state = SCTP_SS_CLOSING; + +@@ -1569,7 +1572,7 @@ static void sctp_close(struct sock *sk, long timeout) + * held and that should be grabbed before socket lock. + */ + spin_lock_bh(&net->sctp.addr_wq_lock); +- bh_lock_sock(sk); ++ bh_lock_sock_nested(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() + * and we have just a little more cleanup. +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 728d65fbab0c..c9c0976d3bbb 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2363,7 +2363,12 @@ static void xs_tcp_setup_socket(struct work_struct *work) + case -EHOSTUNREACH: + case -EADDRINUSE: + case -ENOBUFS: +- /* retry with existing socket, after a delay */ ++ /* ++ * xs_tcp_force_close() wakes tasks with -EIO. ++ * We need to wake them first to ensure the ++ * correct error code. ++ */ ++ xprt_wake_pending_tasks(xprt, status); + xs_tcp_force_close(xprt); + goto out; + } +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index a750f330b8dd..c6ab4da4b8e2 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1794,32 +1794,40 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + static int __init x25_init(void) + { +- int rc = proto_register(&x25_proto, 0); ++ int rc; + +- if (rc != 0) ++ rc = proto_register(&x25_proto, 0); ++ if (rc) + goto out; + + rc = sock_register(&x25_family_ops); +- if (rc != 0) ++ if (rc) + goto out_proto; + + dev_add_pack(&x25_packet_type); + + rc = register_netdevice_notifier(&x25_dev_notifier); +- if (rc != 0) ++ if (rc) + goto out_sock; + +- pr_info("Linux Version 0.2\n"); ++ rc = x25_register_sysctl(); ++ if (rc) ++ goto out_dev; + +- x25_register_sysctl(); + rc = x25_proc_init(); +- if (rc != 0) +- goto out_dev; ++ if (rc) ++ goto out_sysctl; ++ ++ pr_info("Linux Version 0.2\n"); ++ + out: + return rc; ++out_sysctl: ++ x25_unregister_sysctl(); + out_dev: + unregister_netdevice_notifier(&x25_dev_notifier); + out_sock: ++ dev_remove_pack(&x25_packet_type); + sock_unregister(AF_X25); + out_proto: + proto_unregister(&x25_proto); +diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c +index 43239527a205..703d46aae7a2 100644 +--- a/net/x25/sysctl_net_x25.c ++++ b/net/x25/sysctl_net_x25.c +@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = { + { 0, }, + }; + +-void __init x25_register_sysctl(void) ++int __init x25_register_sysctl(void) + { + x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table); ++ if (!x25_table_header) ++ return -ENOMEM; ++ return 0; + } + + void x25_unregister_sysctl(void) +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 34b5b4bcf5cb..62d87f859566 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1208,6 +1208,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig) + x->curlft.add_time = orig->curlft.add_time; + x->km.state = orig->km.state; + x->km.seq = orig->km.seq; ++ x->replay = orig->replay; ++ x->preplay = orig->preplay; + + return x; + +diff --git a/scripts/tags.sh b/scripts/tags.sh +index 262889046703..45e246595d10 100755 +--- a/scripts/tags.sh ++++ b/scripts/tags.sh +@@ -106,6 +106,7 @@ all_compiled_sources() + case "$i" in + *.[cS]) + j=${i/\.[cS]/\.o} ++ j="${j#$tree}" + if [ -e $j ]; then + echo $i + fi +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 4f690ab0feed..99212ff6a568 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1942,8 +1942,9 @@ static inline u32 file_to_av(struct file *file) + static inline u32 open_file_to_av(struct file *file) + { + u32 av = file_to_av(file); ++ struct inode *inode = file_inode(file); + +- if (selinux_policycap_openperm) ++ if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC) + av |= FILE__OPEN; + + return av; +@@ -2912,6 +2913,7 @@ static int selinux_inode_permission(struct inode *inode, int mask) + static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) + { + const struct cred *cred = current_cred(); ++ struct inode *inode = d_backing_inode(dentry); + unsigned int ia_valid = iattr->ia_valid; + __u32 av = FILE__WRITE; + +@@ -2927,8 +2929,10 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) + ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) + return dentry_has_perm(cred, dentry, FILE__SETATTR); + +- if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE) +- && !(ia_valid & ATTR_FILE)) ++ if (selinux_policycap_openperm && ++ inode->i_sb->s_magic != SOCKFS_MAGIC && ++ (ia_valid & ATTR_SIZE) && ++ !(ia_valid & ATTR_FILE)) + av |= FILE__OPEN; + + return dentry_has_perm(cred, dentry, av); +diff --git a/sound/soc/intel/atom/sst/sst_stream.c b/sound/soc/intel/atom/sst/sst_stream.c +index a74c64c7053c..e83da42a8c03 100644 +--- a/sound/soc/intel/atom/sst/sst_stream.c ++++ b/sound/soc/intel/atom/sst/sst_stream.c +@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct intel_sst_drv *sst_drv_ctx, + sst_free_block(sst_drv_ctx, block); + out: + test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id); +- return 0; ++ return ret; + } + + /* +diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c +index 38d65a3529c4..44d560966e9c 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -96,6 +96,7 @@ static const struct snd_soc_dapm_widget cht_dapm_widgets[] = { + SND_SOC_DAPM_HP("Headphone", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_MIC("Int Mic", NULL), ++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL), + SND_SOC_DAPM_SPK("Ext Spk", NULL), + SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, + platform_clock_control, SND_SOC_DAPM_POST_PMD), +@@ -106,6 +107,8 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"IN1N", NULL, "Headset Mic"}, + {"DMIC L1", NULL, "Int Mic"}, + {"DMIC R1", NULL, "Int Mic"}, ++ {"IN2P", NULL, "Int Analog Mic"}, ++ {"IN2N", NULL, "Int Analog Mic"}, + {"Headphone", NULL, "HPOL"}, + {"Headphone", NULL, "HPOR"}, + {"Ext Spk", NULL, "SPOL"}, +@@ -119,6 +122,9 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"Headphone", NULL, "Platform Clock"}, + {"Headset Mic", NULL, "Platform Clock"}, + {"Int Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "micbias1"}, ++ {"Int Analog Mic", NULL, "micbias2"}, + {"Ext Spk", NULL, "Platform Clock"}, + }; + +@@ -147,6 +153,7 @@ static const struct snd_kcontrol_new cht_mc_controls[] = { + SOC_DAPM_PIN_SWITCH("Headphone"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Int Mic"), ++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"), + SOC_DAPM_PIN_SWITCH("Ext Spk"), + }; + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index a001331a53c1..df79d7c846ea 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -453,6 +453,13 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod, + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + u32 *buf = (u32 *)(runtime->dma_area + + rsnd_dai_pointer_offset(io, 0)); ++ int shift = 0; ++ ++ switch (runtime->sample_bits) { ++ case 32: ++ shift = 8; ++ break; ++ } + + /* + * 8/16/32 data can be assesse to TDR/RDR register +@@ -460,9 +467,9 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod, + * see rsnd_ssi_init() + */ + if (rsnd_io_is_play(io)) +- rsnd_mod_write(mod, SSITDR, *buf); ++ rsnd_mod_write(mod, SSITDR, (*buf) << shift); + else +- *buf = rsnd_mod_read(mod, SSIRDR); ++ *buf = (rsnd_mod_read(mod, SSIRDR) >> shift); + + elapsed = rsnd_dai_pointer_update(io, sizeof(*buf)); + } +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index ebe7115c751a..da8afc121118 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -1152,6 +1152,10 @@ static struct syscall_fmt { + { .name = "mlockall", .errmsg = true, + .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, }, + { .name = "mmap", .hexret = true, ++/* The standard mmap maps to old_mmap on s390x */ ++#if defined(__s390x__) ++ .alias = "old_mmap", ++#endif + .arg_scnprintf = { [0] = SCA_HEX, /* addr */ + [2] = SCA_MMAP_PROT, /* prot */ + [3] = SCA_MMAP_FLAGS, /* flags */ +diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c +index a767a6400c5c..6ea4fcfaab36 100644 +--- a/tools/perf/tests/code-reading.c ++++ b/tools/perf/tests/code-reading.c +@@ -182,6 +182,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode, + unsigned char buf2[BUFSZ]; + size_t ret_len; + u64 objdump_addr; ++ const char *objdump_name; ++ char decomp_name[KMOD_DECOMP_LEN]; + int ret; + + pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr); +@@ -242,9 +244,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode, + state->done[state->done_cnt++] = al.map->start; + } + ++ objdump_name = al.map->dso->long_name; ++ if (dso__needs_decompress(al.map->dso)) { ++ if (dso__decompress_kmodule_path(al.map->dso, objdump_name, ++ decomp_name, ++ sizeof(decomp_name)) < 0) { ++ pr_debug("decompression failed\n"); ++ return -1; ++ } ++ ++ objdump_name = decomp_name; ++ } ++ + /* Read the object code using objdump */ + objdump_addr = map__rip_2objdump(al.map, al.addr); +- ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len); ++ ret = read_via_objdump(objdump_name, objdump_addr, buf2, len); ++ ++ if (dso__needs_decompress(al.map->dso)) ++ unlink(objdump_name); ++ + if (ret > 0) { + /* + * The kernel maps are inaccurate - assume objdump is right in +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 43838003c1a1..304f5d710143 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -1258,8 +1258,16 @@ static int __event_process_build_id(struct build_id_event *bev, + + dso__set_build_id(dso, &bev->build_id); + +- if (!is_kernel_module(filename, cpumode)) +- dso->kernel = dso_type; ++ if (dso_type != DSO_TYPE_USER) { ++ struct kmod_path m = { .name = NULL, }; ++ ++ if (!kmod_path__parse_name(&m, filename) && m.kmod) ++ dso__set_short_name(dso, strdup(m.name), true); ++ else ++ dso->kernel = dso_type; ++ ++ free(m.name); ++ } + + build_id__sprintf(dso->build_id, sizeof(dso->build_id), + sbuild_id); +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index 03875f9154e7..0195b7e8c54a 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -2349,6 +2349,14 @@ static int get_new_event_name(char *buf, size_t len, const char *base, + + out: + free(nbase); ++ ++ /* Final validation */ ++ if (ret >= 0 && !is_c_func_name(buf)) { ++ pr_warning("Internal error: \"%s\" is an invalid event name.\n", ++ buf); ++ ret = -EINVAL; ++ } ++ + return ret; + } + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index 2dcfe9a7c8d0..60edec383281 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -37,6 +37,14 @@ static int __report_module(struct addr_location *al, u64 ip, + return 0; + + mod = dwfl_addrmodule(ui->dwfl, ip); ++ if (mod) { ++ Dwarf_Addr s; ++ ++ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); ++ if (s != al->map->start) ++ mod = 0; ++ } ++ + if (!mod) + mod = dwfl_report_elf(ui->dwfl, dso->short_name, + dso->long_name, -1, al->map->start, +diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c +index 47b1e36c7ea0..9adc9af8b048 100644 +--- a/tools/perf/util/util.c ++++ b/tools/perf/util/util.c +@@ -162,7 +162,7 @@ int copyfile_offset(int ifd, loff_t off_in, int ofd, loff_t off_out, u64 size) + + size -= ret; + off_in += ret; +- off_out -= ret; ++ off_out += ret; + } + munmap(ptr, off_in + size); + +diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c +index 42d4c8caad81..de8dc82e2567 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c ++++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c +@@ -45,12 +45,12 @@ int test_body(void) + printf("Check DSCR TM context switch: "); + fflush(stdout); + for (;;) { +- rv = 1; + asm __volatile__ ( + /* set a known value into the DSCR */ + "ld 3, %[dscr1];" + "mtspr %[sprn_dscr], 3;" + ++ "li %[rv], 1;" + /* start and suspend a transaction */ + TBEGIN + "beq 1f;" diff --git a/patch/kernel/mvebu-next/102-revert_i2c_delay.patch b/patch/kernel/mvebu-next/102-revert_i2c_delay.patch new file mode 100644 index 000000000..77583ac0b --- /dev/null +++ b/patch/kernel/mvebu-next/102-revert_i2c_delay.patch @@ -0,0 +1,15 @@ +--- a/arch/arm/boot/dts/armada-xp.dtsi ++++ b/arch/arm/boot/dts/armada-xp.dtsi +@@ -274,12 +274,10 @@ + }; + + &i2c0 { +- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c"; + reg = <0x11000 0x100>; + }; + + &i2c1 { +- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c"; + reg = <0x11100 0x100>; + }; + diff --git a/patch/kernel/mvebu-next/2-2-ARM-dts-armada388-clearfog-add-SFP-module-support.patch b/patch/kernel/mvebu-next/2-2-ARM-dts-armada388-clearfog-add-SFP-module-support.patch new file mode 100644 index 000000000..43dd7a68e --- /dev/null +++ b/patch/kernel/mvebu-next/2-2-ARM-dts-armada388-clearfog-add-SFP-module-support.patch @@ -0,0 +1,72 @@ +diff --git a/arch/arm/boot/dts/armada-388-clearfog.dtsi b/arch/arm/boot/dts/armada-388-clearfog.dtsi +index 0e3b1f140e6d..a44bf20ab7f8 100644 +--- a/arch/arm/boot/dts/armada-388-clearfog.dtsi ++++ b/arch/arm/boot/dts/armada-388-clearfog.dtsi +@@ -117,6 +117,16 @@ + }; + }; + }; ++ ++ sfp: sfp { ++ compatible = "sff,sfp"; ++ i2c-bus = <&i2c1>; ++ los-gpio = <&expander0 12 GPIO_ACTIVE_HIGH>; ++ mod-def0-gpio = <&expander0 15 GPIO_ACTIVE_LOW>; ++ tx-disable-gpio = <&expander0 14 GPIO_ACTIVE_HIGH>; ++ tx-fault-gpio = <&expander0 13 GPIO_ACTIVE_HIGH>; ++ maximum-power-milliwatt = <2000>; ++ }; + }; + + ð1 { +@@ -133,13 +143,10 @@ + bm,pool-long = <3>; + bm,pool-short = <1>; + buffer-manager = <&bm>; ++ managed = "in-band-status"; + phy-mode = "sgmii"; ++ sfp = <&sfp>; + status = "okay"; +- +- fixed-link { +- speed = <1000>; +- full-duplex; +- }; + }; + + &i2c0 { +@@ -208,34 +215,6 @@ + output-low; + line-name = "m.2 devslp"; + }; +- sfp_los { +- /* SFP loss of signal */ +- gpio-hog; +- gpios = <12 GPIO_ACTIVE_HIGH>; +- input; +- line-name = "sfp-los"; +- }; +- sfp_tx_fault { +- /* SFP laser fault */ +- gpio-hog; +- gpios = <13 GPIO_ACTIVE_HIGH>; +- input; +- line-name = "sfp-tx-fault"; +- }; +- sfp_tx_disable { +- /* SFP transmit disable */ +- gpio-hog; +- gpios = <14 GPIO_ACTIVE_HIGH>; +- output-low; +- line-name = "sfp-tx-disable"; +- }; +- sfp_mod_def0 { +- /* SFP module present */ +- gpio-hog; +- gpios = <15 GPIO_ACTIVE_LOW>; +- input; +- line-name = "sfp-mod-def0"; +- }; + }; + + /* The MCP3021 supports standard and fast modes */ diff --git a/patch/kernel/mvebu-next/210-clearfog_switch_node.patch b/patch/kernel/mvebu-next/210-clearfog_switch_node.patch new file mode 100644 index 000000000..e880cc13e --- /dev/null +++ b/patch/kernel/mvebu-next/210-clearfog_switch_node.patch @@ -0,0 +1,21 @@ +--- a/arch/arm/boot/dts/armada-388-clearfog.dts ++++ b/arch/arm/boot/dts/armada-388-clearfog.dts +@@ -129,6 +129,18 @@ + }; + }; + ++ mvsw61xx { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "marvell,88e6176"; ++ status = "okay"; ++ reg = <0x4>; ++ is-indirect; ++ ++ mii-bus = <&mdio>; ++ cpu-port-0 = <5>; ++ }; ++ + gpio-keys { + compatible = "gpio-keys"; + pinctrl-0 = <&rear_button_pins>; diff --git a/patch/kernel/mvebu-next/300-mvneta-tx-queue-workaround.patch b/patch/kernel/mvebu-next/300-mvneta-tx-queue-workaround.patch new file mode 100644 index 000000000..f21f8083e --- /dev/null +++ b/patch/kernel/mvebu-next/300-mvneta-tx-queue-workaround.patch @@ -0,0 +1,35 @@ +The hardware queue scheduling is apparently configured with fixed +priorities, which creates a nasty fairness issue where traffic from one +CPU can starve traffic from all other CPUs. + +Work around this issue by forcing all tx packets to go through one CPU, +until this issue is fixed properly. + +Signed-off-by: Felix Fietkau +--- +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3961,6 +3961,15 @@ static int mvneta_ethtool_set_wol(struct + return ret; + } + ++static u16 mvneta_select_queue(struct net_device *dev, struct sk_buff *skb, ++ void *accel_priv, ++ select_queue_fallback_t fallback) ++{ ++ /* XXX: hardware queue scheduling is broken, ++ * use only one queue until it is fixed */ ++ return 0; ++} ++ + static const struct net_device_ops mvneta_netdev_ops = { + .ndo_open = mvneta_open, + .ndo_stop = mvneta_stop, +@@ -3971,6 +3980,7 @@ static const struct net_device_ops mvnet + .ndo_fix_features = mvneta_fix_features, + .ndo_get_stats64 = mvneta_get_stats64, + .ndo_do_ioctl = mvneta_ioctl, ++ .ndo_select_queue = mvneta_select_queue, + }; + + static const struct ethtool_ops mvneta_eth_tool_ops = { diff --git a/patch/kernel/mvebu-next/401-pci-mvebu-time-out-reset-on-link-up.patch b/patch/kernel/mvebu-next/401-pci-mvebu-time-out-reset-on-link-up.patch new file mode 100644 index 000000000..504d11026 --- /dev/null +++ b/patch/kernel/mvebu-next/401-pci-mvebu-time-out-reset-on-link-up.patch @@ -0,0 +1,60 @@ +From 287b9df160b6159f8d385424904f8bac501280c1 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 9 Jul 2016 10:58:16 +0100 +Subject: pci: mvebu: time out reset on link up + +If the port reports that the link is up while we are resetting, there's +little point in waiting for the full duration. + +Signed-off-by: Russell King +--- + drivers/pci/host/pci-mvebu.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +--- a/drivers/pci/host/pci-mvebu.c ++++ b/drivers/pci/host/pci-mvebu.c +@@ -1167,6 +1167,7 @@ static int mvebu_pcie_powerup(struct mve + + if (port->reset_gpio) { + u32 reset_udelay = PCI_PM_D3COLD_WAIT * 1000; ++ unsigned int i; + + of_property_read_u32(port->dn, "reset-delay-us", + &reset_udelay); +@@ -1174,7 +1175,13 @@ static int mvebu_pcie_powerup(struct mve + udelay(100); + + gpiod_set_value_cansleep(port->reset_gpio, 0); +- msleep(reset_udelay / 1000); ++ for (i = 0; i < reset_udelay; i += 1000) { ++ if (mvebu_pcie_link_up(port)) ++ break; ++ msleep(1); ++ } ++ ++ printk("%s: reset completed in %dus\n", port->name, i); + } + + return 0; +@@ -1261,15 +1268,16 @@ static int mvebu_pcie_probe(struct platf + if (!child) + continue; + +- ret = mvebu_pcie_powerup(port); +- if (ret < 0) +- continue; +- + port->base = mvebu_pcie_map_registers(pdev, child, port); + if (IS_ERR(port->base)) { + dev_err(dev, "%s: cannot map registers\n", port->name); + port->base = NULL; +- mvebu_pcie_powerdown(port); ++ continue; ++ } ++ ++ ret = mvebu_pcie_powerup(port); ++ if (ret < 0) { ++ port->base = NULL; + continue; + } + diff --git a/patch/kernel/mvebu-next/402-sfp-display-SFP-module-information.patch b/patch/kernel/mvebu-next/402-sfp-display-SFP-module-information.patch new file mode 100644 index 000000000..4f9e2e29b --- /dev/null +++ b/patch/kernel/mvebu-next/402-sfp-display-SFP-module-information.patch @@ -0,0 +1,290 @@ +From e76632d118659347d9261a4470d9f60bfbe0044c Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sun, 13 Sep 2015 01:06:31 +0100 +Subject: sfp: display SFP module information + +Signed-off-by: Russell King +--- + drivers/net/phy/sfp.c | 254 +++++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 253 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -247,6 +247,184 @@ static unsigned int sfp_check(void *buf, + return check; + } + ++static const char *sfp_link_len(char *buf, size_t size, unsigned int length, ++ unsigned int multiplier) ++{ ++ if (length == 0) ++ return "unsupported/unspecified"; ++ ++ if (length == 255) { ++ *buf++ = '>'; ++ size -= 1; ++ length -= 1; ++ } ++ ++ length *= multiplier; ++ ++ if (length >= 1000) ++ snprintf(buf, size, "%u.%0*ukm", ++ length / 1000, ++ multiplier > 100 ? 1 : ++ multiplier > 10 ? 2 : 3, ++ length % 1000); ++ else ++ snprintf(buf, size, "%um", length); ++ ++ return buf; ++} ++ ++struct bitfield { ++ unsigned int mask; ++ unsigned int val; ++ const char *str; ++}; ++ ++static const struct bitfield sfp_options[] = { ++ { ++ .mask = SFP_OPTIONS_HIGH_POWER_LEVEL, ++ .val = SFP_OPTIONS_HIGH_POWER_LEVEL, ++ .str = "hpl", ++ }, { ++ .mask = SFP_OPTIONS_PAGING_A2, ++ .val = SFP_OPTIONS_PAGING_A2, ++ .str = "paginga2", ++ }, { ++ .mask = SFP_OPTIONS_RETIMER, ++ .val = SFP_OPTIONS_RETIMER, ++ .str = "retimer", ++ }, { ++ .mask = SFP_OPTIONS_COOLED_XCVR, ++ .val = SFP_OPTIONS_COOLED_XCVR, ++ .str = "cooled", ++ }, { ++ .mask = SFP_OPTIONS_POWER_DECL, ++ .val = SFP_OPTIONS_POWER_DECL, ++ .str = "powerdecl", ++ }, { ++ .mask = SFP_OPTIONS_RX_LINEAR_OUT, ++ .val = SFP_OPTIONS_RX_LINEAR_OUT, ++ .str = "rxlinear", ++ }, { ++ .mask = SFP_OPTIONS_RX_DECISION_THRESH, ++ .val = SFP_OPTIONS_RX_DECISION_THRESH, ++ .str = "rxthresh", ++ }, { ++ .mask = SFP_OPTIONS_TUNABLE_TX, ++ .val = SFP_OPTIONS_TUNABLE_TX, ++ .str = "tunabletx", ++ }, { ++ .mask = SFP_OPTIONS_RATE_SELECT, ++ .val = SFP_OPTIONS_RATE_SELECT, ++ .str = "ratesel", ++ }, { ++ .mask = SFP_OPTIONS_TX_DISABLE, ++ .val = SFP_OPTIONS_TX_DISABLE, ++ .str = "txdisable", ++ }, { ++ .mask = SFP_OPTIONS_TX_FAULT, ++ .val = SFP_OPTIONS_TX_FAULT, ++ .str = "txfault", ++ }, { ++ .mask = SFP_OPTIONS_LOS_INVERTED, ++ .val = SFP_OPTIONS_LOS_INVERTED, ++ .str = "los-", ++ }, { ++ .mask = SFP_OPTIONS_LOS_NORMAL, ++ .val = SFP_OPTIONS_LOS_NORMAL, ++ .str = "los+", ++ }, { } ++}; ++ ++static const struct bitfield diagmon[] = { ++ { ++ .mask = SFP_DIAGMON_DDM, ++ .val = SFP_DIAGMON_DDM, ++ .str = "ddm", ++ }, { ++ .mask = SFP_DIAGMON_INT_CAL, ++ .val = SFP_DIAGMON_INT_CAL, ++ .str = "intcal", ++ }, { ++ .mask = SFP_DIAGMON_EXT_CAL, ++ .val = SFP_DIAGMON_EXT_CAL, ++ .str = "extcal", ++ }, { ++ .mask = SFP_DIAGMON_RXPWR_AVG, ++ .val = SFP_DIAGMON_RXPWR_AVG, ++ .str = "rxpwravg", ++ }, { } ++}; ++ ++static const char *sfp_bitfield(char *out, size_t outsz, const struct bitfield *bits, unsigned int val) ++{ ++ char *p = out; ++ int n; ++ ++ *p = '\0'; ++ while (bits->mask) { ++ if ((val & bits->mask) == bits->val) { ++ n = snprintf(p, outsz, "%s%s", ++ out != p ? ", " : "", ++ bits->str); ++ if (n == outsz) ++ break; ++ p += n; ++ outsz -= n; ++ } ++ bits++; ++ } ++ ++ return out; ++} ++ ++static const char *sfp_connector(unsigned int connector) ++{ ++ switch (connector) { ++ case SFP_CONNECTOR_UNSPEC: ++ return "unknown/unspecified"; ++ case SFP_CONNECTOR_SC: ++ return "SC"; ++ case SFP_CONNECTOR_FIBERJACK: ++ return "Fiberjack"; ++ case SFP_CONNECTOR_LC: ++ return "LC"; ++ case SFP_CONNECTOR_MT_RJ: ++ return "MT-RJ"; ++ case SFP_CONNECTOR_MU: ++ return "MU"; ++ case SFP_CONNECTOR_SG: ++ return "SG"; ++ case SFP_CONNECTOR_OPTICAL_PIGTAIL: ++ return "Optical pigtail"; ++ case SFP_CONNECTOR_HSSDC_II: ++ return "HSSDC II"; ++ case SFP_CONNECTOR_COPPER_PIGTAIL: ++ return "Copper pigtail"; ++ default: ++ return "unknown"; ++ } ++} ++ ++static const char *sfp_encoding(unsigned int encoding) ++{ ++ switch (encoding) { ++ case SFP_ENCODING_UNSPEC: ++ return "unspecified"; ++ case SFP_ENCODING_8472_64B66B: ++ return "64b66b"; ++ case SFP_ENCODING_8B10B: ++ return "8b10b"; ++ case SFP_ENCODING_4B5B: ++ return "4b5b"; ++ case SFP_ENCODING_NRZ: ++ return "NRZ"; ++ case SFP_ENCODING_8472_MANCHESTER: ++ return "MANCHESTER"; ++ default: ++ return "unknown"; ++ } ++} ++ + /* Helpers */ + static void sfp_module_tx_disable(struct sfp *sfp) + { +@@ -415,6 +593,7 @@ static int sfp_sm_mod_probe(struct sfp * + char sn[17]; + char date[9]; + char rev[5]; ++ char options[80]; + u8 check; + int err; + +@@ -458,10 +637,83 @@ static int sfp_sm_mod_probe(struct sfp * + rev[4] = '\0'; + memcpy(sn, sfp->id.ext.vendor_sn, 16); + sn[16] = '\0'; +- memcpy(date, sfp->id.ext.datecode, 8); ++ date[0] = sfp->id.ext.datecode[4]; ++ date[1] = sfp->id.ext.datecode[5]; ++ date[2] = '-'; ++ date[3] = sfp->id.ext.datecode[2]; ++ date[4] = sfp->id.ext.datecode[3]; ++ date[5] = '-'; ++ date[6] = sfp->id.ext.datecode[0]; ++ date[7] = sfp->id.ext.datecode[1]; + date[8] = '\0'; + + dev_info(sfp->dev, "module %s %s rev %s sn %s dc %s\n", vendor, part, rev, sn, date); ++ dev_info(sfp->dev, " %s connector, encoding %s, nominal bitrate %u.%uGbps +%u%% -%u%%\n", ++ sfp_connector(sfp->id.base.connector), ++ sfp_encoding(sfp->id.base.encoding), ++ sfp->id.base.br_nominal / 10, ++ sfp->id.base.br_nominal % 10, ++ sfp->id.ext.br_max, sfp->id.ext.br_min); ++ dev_info(sfp->dev, " 1000BaseSX%c 1000BaseLX%c 1000BaseCX%c 1000BaseT%c 100BaseTLX%c 1000BaseFX%c BaseBX10%c BasePX%c\n", ++ sfp->id.base.e1000_base_sx ? '+' : '-', ++ sfp->id.base.e1000_base_lx ? '+' : '-', ++ sfp->id.base.e1000_base_cx ? '+' : '-', ++ sfp->id.base.e1000_base_t ? '+' : '-', ++ sfp->id.base.e100_base_lx ? '+' : '-', ++ sfp->id.base.e100_base_fx ? '+' : '-', ++ sfp->id.base.e_base_bx10 ? '+' : '-', ++ sfp->id.base.e_base_px ? '+' : '-'); ++ dev_info(sfp->dev, " 10GBaseSR%c 10GBaseLR%c 10GBaseLRM%c 10GBaseER%c\n", ++ sfp->id.base.e10g_base_sr ? '+' : '-', ++ sfp->id.base.e10g_base_lr ? '+' : '-', ++ sfp->id.base.e10g_base_lrm ? '+' : '-', ++ sfp->id.base.e10g_base_er ? '+' : '-'); ++ ++ if (!sfp->id.base.sfp_ct_passive && !sfp->id.base.sfp_ct_active && ++ !sfp->id.base.e1000_base_t) { ++ char len_9um[16], len_om[16]; ++ ++ dev_info(sfp->dev, " Wavelength %unm, fiber lengths:\n", ++ be16_to_cpup(&sfp->id.base.optical_wavelength)); ++ ++ if (sfp->id.base.link_len[0] == 255) ++ strcpy(len_9um, ">254km"); ++ else if (sfp->id.base.link_len[1] && sfp->id.base.link_len[1] != 255) ++ sprintf(len_9um, "%um", ++ sfp->id.base.link_len[1] * 100); ++ else if (sfp->id.base.link_len[0]) ++ sprintf(len_9um, "%ukm", sfp->id.base.link_len[0]); ++ else if (sfp->id.base.link_len[1] == 255) ++ strcpy(len_9um, ">25.4km"); ++ else ++ strcpy(len_9um, "unsupported"); ++ ++ dev_info(sfp->dev, " 9µm SM : %s\n", len_9um); ++ dev_info(sfp->dev, " 62.5µm MM OM1: %s\n", ++ sfp_link_len(len_om, sizeof(len_om), ++ sfp->id.base.link_len[3], 10)); ++ dev_info(sfp->dev, " 50µm MM OM2: %s\n", ++ sfp_link_len(len_om, sizeof(len_om), ++ sfp->id.base.link_len[2], 10)); ++ dev_info(sfp->dev, " 50µm MM OM3: %s\n", ++ sfp_link_len(len_om, sizeof(len_om), ++ sfp->id.base.link_len[5], 10)); ++ dev_info(sfp->dev, " 50µm MM OM4: %s\n", ++ sfp_link_len(len_om, sizeof(len_om), ++ sfp->id.base.link_len[4], 10)); ++ } else { ++ char len[16]; ++ dev_info(sfp->dev, " Copper length: %s\n", ++ sfp_link_len(len, sizeof(len), ++ sfp->id.base.link_len[4], 1)); ++ } ++ ++ dev_info(sfp->dev, " Options: %s\n", ++ sfp_bitfield(options, sizeof(options), sfp_options, ++ be16_to_cpu(sfp->id.ext.options))); ++ dev_info(sfp->dev, " Diagnostics: %s\n", ++ sfp_bitfield(options, sizeof(options), diagmon, ++ sfp->id.ext.diagmon)); + + /* We only support SFP modules, not the legacy GBIC modules. */ + if (sfp->id.base.phys_id != SFP_PHYS_ID_SFP || diff --git a/patch/kernel/mvebu-next/403-net-mvneta-convert-to-phylink.patch b/patch/kernel/mvebu-next/403-net-mvneta-convert-to-phylink.patch new file mode 100644 index 000000000..10f385461 --- /dev/null +++ b/patch/kernel/mvebu-next/403-net-mvneta-convert-to-phylink.patch @@ -0,0 +1,979 @@ +From 36f29e6cf8071fed3854d9825217ed2a3c83b990 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Wed, 16 Sep 2015 21:27:10 +0100 +Subject: net: mvneta: convert to phylink + +Convert mvneta to use phylink, which models the MAC to PHY link in +a generic, reusable form. + +Signed-off-by: Russell King + +- remove unused sync status +--- + drivers/net/ethernet/marvell/Kconfig | 2 +- + drivers/net/ethernet/marvell/mvneta.c | 594 ++++++++++++++++++++-------------- + 2 files changed, 349 insertions(+), 247 deletions(-) + +--- a/drivers/net/ethernet/marvell/Kconfig ++++ b/drivers/net/ethernet/marvell/Kconfig +@@ -60,7 +60,7 @@ config MVNETA + depends on ARCH_MVEBU || COMPILE_TEST + depends on HAS_DMA + select MVMDIO +- select FIXED_PHY ++ select PHYLINK + ---help--- + This driver supports the network interface units in the + Marvell ARMADA XP, ARMADA 370, ARMADA 38x and +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -28,7 +28,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -189,6 +189,7 @@ + #define MVNETA_GMAC_CTRL_0 0x2c00 + #define MVNETA_GMAC_MAX_RX_SIZE_SHIFT 2 + #define MVNETA_GMAC_MAX_RX_SIZE_MASK 0x7ffc ++#define MVNETA_GMAC0_PORT_1000BASE_X BIT(1) + #define MVNETA_GMAC0_PORT_ENABLE BIT(0) + #define MVNETA_GMAC_CTRL_2 0x2c08 + #define MVNETA_GMAC2_INBAND_AN_ENABLE BIT(0) +@@ -204,13 +205,19 @@ + #define MVNETA_GMAC_TX_FLOW_CTRL_ENABLE BIT(5) + #define MVNETA_GMAC_RX_FLOW_CTRL_ACTIVE BIT(6) + #define MVNETA_GMAC_TX_FLOW_CTRL_ACTIVE BIT(7) ++#define MVNETA_GMAC_AN_COMPLETE BIT(11) ++#define MVNETA_GMAC_SYNC_OK BIT(14) + #define MVNETA_GMAC_AUTONEG_CONFIG 0x2c0c + #define MVNETA_GMAC_FORCE_LINK_DOWN BIT(0) + #define MVNETA_GMAC_FORCE_LINK_PASS BIT(1) + #define MVNETA_GMAC_INBAND_AN_ENABLE BIT(2) ++#define MVNETA_GMAC_AN_BYPASS_ENABLE BIT(3) ++#define MVNETA_GMAC_INBAND_RESTART_AN BIT(4) + #define MVNETA_GMAC_CONFIG_MII_SPEED BIT(5) + #define MVNETA_GMAC_CONFIG_GMII_SPEED BIT(6) + #define MVNETA_GMAC_AN_SPEED_EN BIT(7) ++#define MVNETA_GMAC_CONFIG_FLOW_CTRL BIT(8) ++#define MVNETA_GMAC_ADVERT_SYM_FLOW_CTRL BIT(9) + #define MVNETA_GMAC_AN_FLOW_CTRL_EN BIT(11) + #define MVNETA_GMAC_CONFIG_FULL_DUPLEX BIT(12) + #define MVNETA_GMAC_AN_DUPLEX_EN BIT(13) +@@ -237,6 +244,12 @@ + #define MVNETA_TXQ_TOKEN_SIZE_REG(q) (0x3e40 + ((q) << 2)) + #define MVNETA_TXQ_TOKEN_SIZE_MAX 0x7fffffff + ++#define MVNETA_LPI_CTRL_0 0x2cc0 ++#define MVNETA_LPI_CTRL_1 0x2cc4 ++#define MVNETA_LPI_REQUEST_ENABLE BIT(0) ++#define MVNETA_LPI_CTRL_2 0x2cc8 ++#define MVNETA_LPI_STATUS 0x2ccc ++ + #define MVNETA_CAUSE_TXQ_SENT_DESC_ALL_MASK 0xff + + /* Descriptor ring Macros */ +@@ -313,6 +326,11 @@ + #define MVNETA_RX_GET_BM_POOL_ID(rxd) \ + (((rxd)->status & MVNETA_RXD_BM_POOL_MASK) >> MVNETA_RXD_BM_POOL_SHIFT) + ++enum { ++ ETHTOOL_STAT_EEE_WAKEUP, ++ ETHTOOL_MAX_STATS, ++}; ++ + struct mvneta_statistic { + unsigned short offset; + unsigned short type; +@@ -321,6 +339,7 @@ struct mvneta_statistic { + + #define T_REG_32 32 + #define T_REG_64 64 ++#define T_SW 1 + + static const struct mvneta_statistic mvneta_statistics[] = { + { 0x3000, T_REG_64, "good_octets_received", }, +@@ -355,6 +374,7 @@ static const struct mvneta_statistic mvn + { 0x304c, T_REG_32, "broadcast_frames_sent", }, + { 0x3054, T_REG_32, "fc_sent", }, + { 0x300c, T_REG_32, "internal_mac_transmit_err", }, ++ { ETHTOOL_STAT_EEE_WAKEUP, T_SW, "eee_wakeup_errors", }, + }; + + struct mvneta_pcpu_stats { +@@ -407,20 +427,19 @@ struct mvneta_port { + u16 tx_ring_size; + u16 rx_ring_size; + +- struct mii_bus *mii_bus; +- phy_interface_t phy_interface; +- struct device_node *phy_node; +- unsigned int link; +- unsigned int duplex; +- unsigned int speed; ++ struct device_node *dn; + unsigned int tx_csum_limit; +- unsigned int use_inband_status:1; ++ struct phylink *phylink; + + struct mvneta_bm *bm_priv; + struct mvneta_bm_pool *pool_long; + struct mvneta_bm_pool *pool_short; + int bm_win_id; + ++ bool eee_enabled; ++ bool eee_active; ++ bool tx_lpi_enabled; ++ + u64 ethtool_stats[ARRAY_SIZE(mvneta_statistics)]; + + u32 indir[MVNETA_RSS_LU_TABLE_SIZE]; +@@ -1214,10 +1233,6 @@ static void mvneta_port_disable(struct m + val &= ~MVNETA_GMAC0_PORT_ENABLE; + mvreg_write(pp, MVNETA_GMAC_CTRL_0, val); + +- pp->link = 0; +- pp->duplex = -1; +- pp->speed = 0; +- + udelay(200); + } + +@@ -1277,44 +1292,6 @@ static void mvneta_set_other_mcast_table + mvreg_write(pp, MVNETA_DA_FILT_OTH_MCAST + offset, val); + } + +-static void mvneta_set_autoneg(struct mvneta_port *pp, int enable) +-{ +- u32 val; +- +- if (enable) { +- val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~(MVNETA_GMAC_FORCE_LINK_PASS | +- MVNETA_GMAC_FORCE_LINK_DOWN | +- MVNETA_GMAC_AN_FLOW_CTRL_EN); +- val |= MVNETA_GMAC_INBAND_AN_ENABLE | +- MVNETA_GMAC_AN_SPEED_EN | +- MVNETA_GMAC_AN_DUPLEX_EN; +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); +- +- val = mvreg_read(pp, MVNETA_GMAC_CLOCK_DIVIDER); +- val |= MVNETA_GMAC_1MS_CLOCK_ENABLE; +- mvreg_write(pp, MVNETA_GMAC_CLOCK_DIVIDER, val); +- +- val = mvreg_read(pp, MVNETA_GMAC_CTRL_2); +- val |= MVNETA_GMAC2_INBAND_AN_ENABLE; +- mvreg_write(pp, MVNETA_GMAC_CTRL_2, val); +- } else { +- val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~(MVNETA_GMAC_INBAND_AN_ENABLE | +- MVNETA_GMAC_AN_SPEED_EN | +- MVNETA_GMAC_AN_DUPLEX_EN); +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); +- +- val = mvreg_read(pp, MVNETA_GMAC_CLOCK_DIVIDER); +- val &= ~MVNETA_GMAC_1MS_CLOCK_ENABLE; +- mvreg_write(pp, MVNETA_GMAC_CLOCK_DIVIDER, val); +- +- val = mvreg_read(pp, MVNETA_GMAC_CTRL_2); +- val &= ~MVNETA_GMAC2_INBAND_AN_ENABLE; +- mvreg_write(pp, MVNETA_GMAC_CTRL_2, val); +- } +-} +- + static void mvneta_percpu_unmask_interrupt(void *arg) + { + struct mvneta_port *pp = arg; +@@ -1467,7 +1444,6 @@ static void mvneta_defaults_set(struct m + val &= ~MVNETA_PHY_POLLING_ENABLE; + mvreg_write(pp, MVNETA_UNIT_CONTROL, val); + +- mvneta_set_autoneg(pp, pp->use_inband_status); + mvneta_set_ucast_table(pp, -1); + mvneta_set_special_mcast_table(pp, -1); + mvneta_set_other_mcast_table(pp, -1); +@@ -2692,26 +2668,11 @@ static irqreturn_t mvneta_percpu_isr(int + return IRQ_HANDLED; + } + +-static int mvneta_fixed_link_update(struct mvneta_port *pp, +- struct phy_device *phy) ++static void mvneta_link_change(struct mvneta_port *pp) + { +- struct fixed_phy_status status; +- struct fixed_phy_status changed = {}; + u32 gmac_stat = mvreg_read(pp, MVNETA_GMAC_STATUS); + +- status.link = !!(gmac_stat & MVNETA_GMAC_LINK_UP); +- if (gmac_stat & MVNETA_GMAC_SPEED_1000) +- status.speed = SPEED_1000; +- else if (gmac_stat & MVNETA_GMAC_SPEED_100) +- status.speed = SPEED_100; +- else +- status.speed = SPEED_10; +- status.duplex = !!(gmac_stat & MVNETA_GMAC_FULL_DUPLEX); +- changed.link = 1; +- changed.speed = 1; +- changed.duplex = 1; +- fixed_phy_update_state(phy, &status, &changed); +- return 0; ++ phylink_mac_change(pp->phylink, !!(gmac_stat & MVNETA_GMAC_LINK_UP)); + } + + /* NAPI handler +@@ -2727,7 +2688,6 @@ static int mvneta_poll(struct napi_struc + u32 cause_rx_tx; + int rx_queue; + struct mvneta_port *pp = netdev_priv(napi->dev); +- struct net_device *ndev = pp->dev; + struct mvneta_pcpu_port *port = this_cpu_ptr(pp->ports); + + if (!netif_running(pp->dev)) { +@@ -2741,12 +2701,11 @@ static int mvneta_poll(struct napi_struc + u32 cause_misc = mvreg_read(pp, MVNETA_INTR_MISC_CAUSE); + + mvreg_write(pp, MVNETA_INTR_MISC_CAUSE, 0); +- if (pp->use_inband_status && (cause_misc & +- (MVNETA_CAUSE_PHY_STATUS_CHANGE | +- MVNETA_CAUSE_LINK_CHANGE | +- MVNETA_CAUSE_PSC_SYNC_CHANGE))) { +- mvneta_fixed_link_update(pp, ndev->phydev); +- } ++ ++ if (cause_misc & (MVNETA_CAUSE_PHY_STATUS_CHANGE | ++ MVNETA_CAUSE_LINK_CHANGE | ++ MVNETA_CAUSE_PSC_SYNC_CHANGE)) ++ mvneta_link_change(pp); + } + + /* Release Tx descriptors */ +@@ -3060,7 +3019,6 @@ static int mvneta_setup_txqs(struct mvne + static void mvneta_start_dev(struct mvneta_port *pp) + { + int cpu; +- struct net_device *ndev = pp->dev; + + mvneta_max_rx_size_set(pp, pp->pkt_size); + mvneta_txq_max_tx_size_set(pp, pp->pkt_size); +@@ -3088,16 +3046,15 @@ static void mvneta_start_dev(struct mvne + MVNETA_CAUSE_LINK_CHANGE | + MVNETA_CAUSE_PSC_SYNC_CHANGE); + +- phy_start(ndev->phydev); ++ phylink_start(pp->phylink); + netif_tx_start_all_queues(pp->dev); + } + + static void mvneta_stop_dev(struct mvneta_port *pp) + { + unsigned int cpu; +- struct net_device *ndev = pp->dev; + +- phy_stop(ndev->phydev); ++ phylink_stop(pp->phylink); + + if (!pp->neta_armada3700) { + for_each_online_cpu(cpu) { +@@ -3251,103 +3208,232 @@ static int mvneta_set_mac_addr(struct ne + return 0; + } + +-static void mvneta_adjust_link(struct net_device *ndev) ++static void mvneta_validate(struct net_device *ndev, unsigned long *supported, ++ struct phylink_link_state *state) ++{ ++ __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; ++ ++ /* Allow all the expected bits */ ++ phylink_set(mask, Autoneg); ++ phylink_set_port_modes(mask); ++ ++ /* Asymmetric pause is unsupported */ ++ phylink_set(mask, Pause); ++ /* Half-duplex at speeds higher than 100Mbit is unsupported */ ++ phylink_set(mask, 1000baseT_Full); ++ phylink_set(mask, 1000baseX_Full); ++ ++ if (state->interface != PHY_INTERFACE_MODE_1000BASEX) { ++ /* 10M and 100M are only supported in non-802.3z mode */ ++ phylink_set(mask, 10baseT_Half); ++ phylink_set(mask, 10baseT_Full); ++ phylink_set(mask, 100baseT_Half); ++ phylink_set(mask, 100baseT_Full); ++ } ++ ++ bitmap_and(supported, supported, mask, ++ __ETHTOOL_LINK_MODE_MASK_NBITS); ++ bitmap_and(state->advertising, state->advertising, mask, ++ __ETHTOOL_LINK_MODE_MASK_NBITS); ++} ++ ++static int mvneta_mac_link_state(struct net_device *ndev, ++ struct phylink_link_state *state) + { + struct mvneta_port *pp = netdev_priv(ndev); +- struct phy_device *phydev = ndev->phydev; +- int status_change = 0; ++ u32 gmac_stat; + +- if (phydev->link) { +- if ((pp->speed != phydev->speed) || +- (pp->duplex != phydev->duplex)) { +- u32 val; +- +- val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED | +- MVNETA_GMAC_CONFIG_GMII_SPEED | +- MVNETA_GMAC_CONFIG_FULL_DUPLEX); +- +- if (phydev->duplex) +- val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX; +- +- if (phydev->speed == SPEED_1000) +- val |= MVNETA_GMAC_CONFIG_GMII_SPEED; +- else if (phydev->speed == SPEED_100) +- val |= MVNETA_GMAC_CONFIG_MII_SPEED; ++ gmac_stat = mvreg_read(pp, MVNETA_GMAC_STATUS); + +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); ++ if (gmac_stat & MVNETA_GMAC_SPEED_1000) ++ state->speed = SPEED_1000; ++ else if (gmac_stat & MVNETA_GMAC_SPEED_100) ++ state->speed = SPEED_100; ++ else ++ state->speed = SPEED_10; + +- pp->duplex = phydev->duplex; +- pp->speed = phydev->speed; +- } ++ state->an_complete = !!(gmac_stat & MVNETA_GMAC_AN_COMPLETE); ++ state->link = !!(gmac_stat & MVNETA_GMAC_LINK_UP); ++ state->duplex = !!(gmac_stat & MVNETA_GMAC_FULL_DUPLEX); ++ ++ state->pause = 0; ++ if (gmac_stat & MVNETA_GMAC_RX_FLOW_CTRL_ENABLE) ++ state->pause |= MLO_PAUSE_RX; ++ if (gmac_stat & MVNETA_GMAC_TX_FLOW_CTRL_ENABLE) ++ state->pause |= MLO_PAUSE_TX; ++ ++ return 1; ++} ++ ++static void mvneta_mac_an_restart(struct net_device *ndev) ++{ ++ struct mvneta_port *pp = netdev_priv(ndev); ++ u32 gmac_an = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); ++ ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, ++ gmac_an | MVNETA_GMAC_INBAND_RESTART_AN); ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, ++ gmac_an & ~MVNETA_GMAC_INBAND_RESTART_AN); ++} ++ ++static void mvneta_mac_config(struct net_device *ndev, unsigned int mode, ++ const struct phylink_link_state *state) ++{ ++ struct mvneta_port *pp = netdev_priv(ndev); ++ u32 new_ctrl0, gmac_ctrl0 = mvreg_read(pp, MVNETA_GMAC_CTRL_0); ++ u32 new_ctrl2, gmac_ctrl2 = mvreg_read(pp, MVNETA_GMAC_CTRL_2); ++ u32 new_clk, gmac_clk = mvreg_read(pp, MVNETA_GMAC_CLOCK_DIVIDER); ++ u32 new_an, gmac_an = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); ++ ++ new_ctrl0 = gmac_ctrl0 & ~MVNETA_GMAC0_PORT_1000BASE_X; ++ new_ctrl2 = gmac_ctrl2 & ~MVNETA_GMAC2_INBAND_AN_ENABLE; ++ new_clk = gmac_clk & ~MVNETA_GMAC_1MS_CLOCK_ENABLE; ++ new_an = gmac_an & ~(MVNETA_GMAC_INBAND_AN_ENABLE | ++ MVNETA_GMAC_INBAND_RESTART_AN | ++ MVNETA_GMAC_CONFIG_MII_SPEED | ++ MVNETA_GMAC_CONFIG_GMII_SPEED | ++ MVNETA_GMAC_AN_SPEED_EN | ++ MVNETA_GMAC_ADVERT_SYM_FLOW_CTRL | ++ MVNETA_GMAC_CONFIG_FLOW_CTRL | ++ MVNETA_GMAC_AN_FLOW_CTRL_EN | ++ MVNETA_GMAC_CONFIG_FULL_DUPLEX | ++ MVNETA_GMAC_AN_DUPLEX_EN); ++ ++ if (phylink_test(state->advertising, Pause)) ++ new_an |= MVNETA_GMAC_ADVERT_SYM_FLOW_CTRL; ++ if (state->pause & MLO_PAUSE_TXRX_MASK) ++ new_an |= MVNETA_GMAC_CONFIG_FLOW_CTRL; ++ ++ if (!phylink_autoneg_inband(mode)) { ++ /* Phy or fixed speed */ ++ if (state->duplex) ++ new_an |= MVNETA_GMAC_CONFIG_FULL_DUPLEX; ++ ++ if (state->speed == SPEED_1000) ++ new_an |= MVNETA_GMAC_CONFIG_GMII_SPEED; ++ else if (state->speed == SPEED_100) ++ new_an |= MVNETA_GMAC_CONFIG_MII_SPEED; ++ } else if (state->interface == PHY_INTERFACE_MODE_SGMII) { ++ /* SGMII mode receives the state from the PHY */ ++ new_ctrl2 |= MVNETA_GMAC2_INBAND_AN_ENABLE; ++ new_clk |= MVNETA_GMAC_1MS_CLOCK_ENABLE; ++ new_an = (new_an & ~(MVNETA_GMAC_FORCE_LINK_DOWN | ++ MVNETA_GMAC_FORCE_LINK_PASS)) | ++ MVNETA_GMAC_INBAND_AN_ENABLE | ++ MVNETA_GMAC_AN_SPEED_EN | ++ MVNETA_GMAC_AN_DUPLEX_EN; ++ } else { ++ /* 802.3z negotiation - only 1000base-X */ ++ new_ctrl0 |= MVNETA_GMAC0_PORT_1000BASE_X; ++ new_clk |= MVNETA_GMAC_1MS_CLOCK_ENABLE; ++ new_an = (new_an & ~(MVNETA_GMAC_FORCE_LINK_DOWN | ++ MVNETA_GMAC_FORCE_LINK_PASS)) | ++ MVNETA_GMAC_INBAND_AN_ENABLE | ++ MVNETA_GMAC_CONFIG_GMII_SPEED | ++ /* The MAC only supports FD mode */ ++ MVNETA_GMAC_CONFIG_FULL_DUPLEX; ++ ++ if (state->pause & MLO_PAUSE_AN && state->an_enabled) ++ new_an |= MVNETA_GMAC_AN_FLOW_CTRL_EN; ++ } ++ ++ /* Armada 370 documentation says we can only change the port mode ++ * and in-band enable when the link is down, so force it down ++ * while making these changes. We also do this for GMAC_CTRL2 */ ++ if ((new_ctrl0 ^ gmac_ctrl0) & MVNETA_GMAC0_PORT_1000BASE_X || ++ (new_ctrl2 ^ gmac_ctrl2) & MVNETA_GMAC2_INBAND_AN_ENABLE || ++ (new_an ^ gmac_an) & MVNETA_GMAC_INBAND_AN_ENABLE) { ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, ++ (gmac_an & ~MVNETA_GMAC_FORCE_LINK_PASS) | ++ MVNETA_GMAC_FORCE_LINK_DOWN); ++ } ++ ++ if (new_ctrl0 != gmac_ctrl0) ++ mvreg_write(pp, MVNETA_GMAC_CTRL_0, new_ctrl0); ++ if (new_ctrl2 != gmac_ctrl2) ++ mvreg_write(pp, MVNETA_GMAC_CTRL_2, new_ctrl2); ++ if (new_clk != gmac_clk) ++ mvreg_write(pp, MVNETA_GMAC_CLOCK_DIVIDER, new_clk); ++ if (new_an != gmac_an) ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, new_an); ++} ++ ++static void mvneta_set_eee(struct mvneta_port *pp, bool enable) ++{ ++ u32 lpi_ctl1; ++ ++ lpi_ctl1 = mvreg_read(pp, MVNETA_LPI_CTRL_1); ++ if (enable) ++ lpi_ctl1 |= MVNETA_LPI_REQUEST_ENABLE; ++ else ++ lpi_ctl1 &= ~MVNETA_LPI_REQUEST_ENABLE; ++ mvreg_write(pp, MVNETA_LPI_CTRL_1, lpi_ctl1); ++} ++ ++static void mvneta_mac_link_down(struct net_device *ndev, unsigned int mode) ++{ ++ struct mvneta_port *pp = netdev_priv(ndev); ++ u32 val; ++ ++ mvneta_port_down(pp); ++ ++ if (!phylink_autoneg_inband(mode)) { ++ val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); ++ val &= ~MVNETA_GMAC_FORCE_LINK_PASS; ++ val |= MVNETA_GMAC_FORCE_LINK_DOWN; ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); + } + +- if (phydev->link != pp->link) { +- if (!phydev->link) { +- pp->duplex = -1; +- pp->speed = 0; +- } ++ pp->eee_active = false; ++ mvneta_set_eee(pp, false); ++} ++ ++static void mvneta_mac_link_up(struct net_device *ndev, unsigned int mode, ++ struct phy_device *phy) ++{ ++ struct mvneta_port *pp = netdev_priv(ndev); ++ u32 val; + +- pp->link = phydev->link; +- status_change = 1; ++ if (!phylink_autoneg_inband(mode)) { ++ val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); ++ val &= ~MVNETA_GMAC_FORCE_LINK_DOWN; ++ val |= MVNETA_GMAC_FORCE_LINK_PASS; ++ mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); + } + +- if (status_change) { +- if (phydev->link) { +- if (!pp->use_inband_status) { +- u32 val = mvreg_read(pp, +- MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~MVNETA_GMAC_FORCE_LINK_DOWN; +- val |= MVNETA_GMAC_FORCE_LINK_PASS; +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, +- val); +- } +- mvneta_port_up(pp); +- } else { +- if (!pp->use_inband_status) { +- u32 val = mvreg_read(pp, +- MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~MVNETA_GMAC_FORCE_LINK_PASS; +- val |= MVNETA_GMAC_FORCE_LINK_DOWN; +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, +- val); +- } +- mvneta_port_down(pp); +- } +- phy_print_status(phydev); ++ mvneta_port_up(pp); ++ ++ if (phy && pp->eee_enabled) { ++ pp->eee_active = phy_init_eee(phy, 0) >= 0; ++ mvneta_set_eee(pp, pp->eee_active && pp->tx_lpi_enabled); + } + } + ++static const struct phylink_mac_ops mvneta_phylink_ops = { ++ .validate = mvneta_validate, ++ .mac_link_state = mvneta_mac_link_state, ++ .mac_an_restart = mvneta_mac_an_restart, ++ .mac_config = mvneta_mac_config, ++ .mac_link_down = mvneta_mac_link_down, ++ .mac_link_up = mvneta_mac_link_up, ++}; ++ + static int mvneta_mdio_probe(struct mvneta_port *pp) + { +- struct phy_device *phy_dev; + struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL }; ++ int err = phylink_of_phy_connect(pp->phylink, pp->dn); ++ if (err) ++ netdev_err(pp->dev, "could not attach PHY\n"); + +- phy_dev = of_phy_connect(pp->dev, pp->phy_node, mvneta_adjust_link, 0, +- pp->phy_interface); +- if (!phy_dev) { +- netdev_err(pp->dev, "could not find the PHY\n"); +- return -ENODEV; +- } +- +- phy_ethtool_get_wol(phy_dev, &wol); ++ phylink_ethtool_get_wol(pp->phylink, &wol); + device_set_wakeup_capable(&pp->dev->dev, !!wol.supported); + +- phy_dev->supported &= PHY_GBIT_FEATURES; +- phy_dev->advertising = phy_dev->supported; +- +- pp->link = 0; +- pp->duplex = 0; +- pp->speed = 0; +- +- return 0; ++ return err; + } + + static void mvneta_mdio_remove(struct mvneta_port *pp) + { +- struct net_device *ndev = pp->dev; +- +- phy_disconnect(ndev->phydev); ++ phylink_disconnect_phy(pp->phylink); + } + + /* Electing a CPU must be done in an atomic way: it should be done +@@ -3626,10 +3712,9 @@ static int mvneta_stop(struct net_device + + static int mvneta_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + { +- if (!dev->phydev) +- return -ENOTSUPP; ++ struct mvneta_port *pp = netdev_priv(dev); + +- return phy_mii_ioctl(dev->phydev, ifr, cmd); ++ return phylink_mii_ioctl(pp->phylink, ifr, cmd); + } + + /* Ethtool methods */ +@@ -3640,44 +3725,25 @@ mvneta_ethtool_set_link_ksettings(struct + const struct ethtool_link_ksettings *cmd) + { + struct mvneta_port *pp = netdev_priv(ndev); +- struct phy_device *phydev = ndev->phydev; + +- if (!phydev) +- return -ENODEV; +- +- if ((cmd->base.autoneg == AUTONEG_ENABLE) != pp->use_inband_status) { +- u32 val; +- +- mvneta_set_autoneg(pp, cmd->base.autoneg == AUTONEG_ENABLE); +- +- if (cmd->base.autoneg == AUTONEG_DISABLE) { +- val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG); +- val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED | +- MVNETA_GMAC_CONFIG_GMII_SPEED | +- MVNETA_GMAC_CONFIG_FULL_DUPLEX); +- +- if (phydev->duplex) +- val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX; ++ return phylink_ethtool_ksettings_set(pp->phylink, cmd); ++} + +- if (phydev->speed == SPEED_1000) +- val |= MVNETA_GMAC_CONFIG_GMII_SPEED; +- else if (phydev->speed == SPEED_100) +- val |= MVNETA_GMAC_CONFIG_MII_SPEED; ++/* Get link ksettings for ethtools */ ++static int ++mvneta_ethtool_get_link_ksettings(struct net_device *ndev, ++ struct ethtool_link_ksettings *cmd) ++{ ++ struct mvneta_port *pp = netdev_priv(ndev); + +- mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); +- } ++ return phylink_ethtool_ksettings_get(pp->phylink, cmd); ++} + +- pp->use_inband_status = (cmd->base.autoneg == AUTONEG_ENABLE); +- netdev_info(pp->dev, "autoneg status set to %i\n", +- pp->use_inband_status); +- +- if (netif_running(ndev)) { +- mvneta_port_down(pp); +- mvneta_port_up(pp); +- } +- } ++static int mvneta_ethtool_nway_reset(struct net_device *dev) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); + +- return phy_ethtool_ksettings_set(ndev->phydev, cmd); ++ return phylink_ethtool_nway_reset(pp->phylink); + } + + /* Set interrupt coalescing for ethtools */ +@@ -3769,6 +3835,22 @@ static int mvneta_ethtool_set_ringparam( + return 0; + } + ++static void mvneta_ethtool_get_pauseparam(struct net_device *dev, ++ struct ethtool_pauseparam *pause) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ ++ phylink_ethtool_get_pauseparam(pp->phylink, pause); ++} ++ ++static int mvneta_ethtool_set_pauseparam(struct net_device *dev, ++ struct ethtool_pauseparam *pause) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ ++ return phylink_ethtool_set_pauseparam(pp->phylink, pause); ++} ++ + static void mvneta_ethtool_get_strings(struct net_device *netdev, u32 sset, + u8 *data) + { +@@ -3785,26 +3867,35 @@ static void mvneta_ethtool_update_stats( + { + const struct mvneta_statistic *s; + void __iomem *base = pp->base; +- u32 high, low, val; +- u64 val64; ++ u32 high, low; ++ u64 val; + int i; + + for (i = 0, s = mvneta_statistics; + s < mvneta_statistics + ARRAY_SIZE(mvneta_statistics); + s++, i++) { ++ val = 0; ++ + switch (s->type) { + case T_REG_32: + val = readl_relaxed(base + s->offset); +- pp->ethtool_stats[i] += val; + break; + case T_REG_64: + /* Docs say to read low 32-bit then high */ + low = readl_relaxed(base + s->offset); + high = readl_relaxed(base + s->offset + 4); +- val64 = (u64)high << 32 | low; +- pp->ethtool_stats[i] += val64; ++ val = (u64)high << 32 | low; ++ break; ++ case T_SW: ++ switch (s->offset) { ++ case ETHTOOL_STAT_EEE_WAKEUP: ++ val = phylink_get_eee_err(pp->phylink); ++ break; ++ } + break; + } ++ ++ pp->ethtool_stats[i] += val; + } + } + +@@ -3939,28 +4030,65 @@ static int mvneta_ethtool_get_rxfh(struc + static void mvneta_ethtool_get_wol(struct net_device *dev, + struct ethtool_wolinfo *wol) + { +- wol->supported = 0; +- wol->wolopts = 0; ++ struct mvneta_port *pp = netdev_priv(dev); + +- if (dev->phydev) +- phy_ethtool_get_wol(dev->phydev, wol); ++ phylink_ethtool_get_wol(pp->phylink, wol); + } + + static int mvneta_ethtool_set_wol(struct net_device *dev, + struct ethtool_wolinfo *wol) + { ++ struct mvneta_port *pp = netdev_priv(dev); + int ret; + +- if (!dev->phydev) +- return -EOPNOTSUPP; +- +- ret = phy_ethtool_set_wol(dev->phydev, wol); ++ ret = phylink_ethtool_set_wol(pp->phylink, wol); + if (!ret) + device_set_wakeup_enable(&dev->dev, !!wol->wolopts); + + return ret; + } + ++static int mvneta_ethtool_get_eee(struct net_device *dev, ++ struct ethtool_eee *eee) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ u32 lpi_ctl0; ++ ++ lpi_ctl0 = mvreg_read(pp, MVNETA_LPI_CTRL_0); ++ ++ eee->eee_enabled = pp->eee_enabled; ++ eee->eee_active = pp->eee_active; ++ eee->tx_lpi_enabled = pp->tx_lpi_enabled; ++ eee->tx_lpi_timer = (lpi_ctl0) >> 8; // * scale; ++ ++ return phylink_ethtool_get_eee(pp->phylink, eee); ++} ++ ++static int mvneta_ethtool_set_eee(struct net_device *dev, ++ struct ethtool_eee *eee) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ u32 lpi_ctl0; ++ ++ /* The Armada 37x documents do not give limits for this other than ++ * it being an 8-bit register. */ ++ if (eee->tx_lpi_enabled && ++ (eee->tx_lpi_timer < 0 || eee->tx_lpi_timer > 255)) ++ return -EINVAL; ++ ++ lpi_ctl0 = mvreg_read(pp, MVNETA_LPI_CTRL_0); ++ lpi_ctl0 &= ~(0xff << 8); ++ lpi_ctl0 |= eee->tx_lpi_timer << 8; ++ mvreg_write(pp, MVNETA_LPI_CTRL_0, lpi_ctl0); ++ ++ pp->eee_enabled = eee->eee_enabled; ++ pp->tx_lpi_enabled = eee->tx_lpi_enabled; ++ ++ mvneta_set_eee(pp, eee->tx_lpi_enabled && eee->eee_enabled); ++ ++ return phylink_ethtool_set_eee(pp->phylink, eee); ++} ++ + static u16 mvneta_select_queue(struct net_device *dev, struct sk_buff *skb, + void *accel_priv, + select_queue_fallback_t fallback) +@@ -3984,13 +4112,15 @@ static const struct net_device_ops mvnet + }; + + static const struct ethtool_ops mvneta_eth_tool_ops = { +- .nway_reset = phy_ethtool_nway_reset, ++ .nway_reset = mvneta_ethtool_nway_reset, + .get_link = ethtool_op_get_link, + .set_coalesce = mvneta_ethtool_set_coalesce, + .get_coalesce = mvneta_ethtool_get_coalesce, + .get_drvinfo = mvneta_ethtool_get_drvinfo, + .get_ringparam = mvneta_ethtool_get_ringparam, + .set_ringparam = mvneta_ethtool_set_ringparam, ++ .get_pauseparam = mvneta_ethtool_get_pauseparam, ++ .set_pauseparam = mvneta_ethtool_set_pauseparam, + .get_strings = mvneta_ethtool_get_strings, + .get_ethtool_stats = mvneta_ethtool_get_stats, + .get_sset_count = mvneta_ethtool_get_sset_count, +@@ -3998,10 +4128,12 @@ static const struct ethtool_ops mvneta_e + .get_rxnfc = mvneta_ethtool_get_rxnfc, + .get_rxfh = mvneta_ethtool_get_rxfh, + .set_rxfh = mvneta_ethtool_set_rxfh, +- .get_link_ksettings = phy_ethtool_get_link_ksettings, ++ .get_link_ksettings = mvneta_ethtool_get_link_ksettings, + .set_link_ksettings = mvneta_ethtool_set_link_ksettings, + .get_wol = mvneta_ethtool_get_wol, + .set_wol = mvneta_ethtool_set_wol, ++ .get_eee = mvneta_ethtool_get_eee, ++ .set_eee = mvneta_ethtool_set_eee, + }; + + /* Initialize hw */ +@@ -4146,14 +4278,13 @@ static int mvneta_probe(struct platform_ + { + struct resource *res; + struct device_node *dn = pdev->dev.of_node; +- struct device_node *phy_node; + struct device_node *bm_node; + struct mvneta_port *pp; + struct net_device *dev; ++ struct phylink *phylink; + const char *dt_mac_addr; + char hw_mac_addr[ETH_ALEN]; + const char *mac_from; +- const char *managed; + int tx_csum_limit; + int phy_mode; + int err; +@@ -4169,31 +4300,11 @@ static int mvneta_probe(struct platform_ + goto err_free_netdev; + } + +- phy_node = of_parse_phandle(dn, "phy", 0); +- if (!phy_node) { +- if (!of_phy_is_fixed_link(dn)) { +- dev_err(&pdev->dev, "no PHY specified\n"); +- err = -ENODEV; +- goto err_free_irq; +- } +- +- err = of_phy_register_fixed_link(dn); +- if (err < 0) { +- dev_err(&pdev->dev, "cannot register fixed PHY\n"); +- goto err_free_irq; +- } +- +- /* In the case of a fixed PHY, the DT node associated +- * to the PHY is the Ethernet MAC DT node. +- */ +- phy_node = of_node_get(dn); +- } +- + phy_mode = of_get_phy_mode(dn); + if (phy_mode < 0) { + dev_err(&pdev->dev, "incorrect phy-mode\n"); + err = -EINVAL; +- goto err_put_phy_node; ++ goto err_free_irq; + } + + dev->tx_queue_len = MVNETA_MAX_TXD; +@@ -4204,12 +4315,7 @@ static int mvneta_probe(struct platform_ + + pp = netdev_priv(dev); + spin_lock_init(&pp->lock); +- pp->phy_node = phy_node; +- pp->phy_interface = phy_mode; +- +- err = of_property_read_string(dn, "managed", &managed); +- pp->use_inband_status = (err == 0 && +- strcmp(managed, "in-band-status") == 0); ++ pp->dn = dn; + + pp->rxq_def = rxq_def; + +@@ -4231,7 +4337,7 @@ static int mvneta_probe(struct platform_ + pp->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(pp->clk)) { + err = PTR_ERR(pp->clk); +- goto err_put_phy_node; ++ goto err_free_irq; + } + + clk_prepare_enable(pp->clk); +@@ -4357,6 +4463,14 @@ static int mvneta_probe(struct platform_ + /* 9676 == 9700 - 20 and rounding to 8 */ + dev->max_mtu = 9676; + ++ phylink = phylink_create(dev, dn, phy_mode, &mvneta_phylink_ops); ++ if (IS_ERR(phylink)) { ++ err = PTR_ERR(phylink); ++ goto err_free_stats; ++ } ++ ++ pp->phylink = phylink; ++ + err = register_netdev(dev); + if (err < 0) { + dev_err(&pdev->dev, "failed to register\n"); +@@ -4368,14 +4482,6 @@ static int mvneta_probe(struct platform_ + + platform_set_drvdata(pdev, pp->dev); + +- if (pp->use_inband_status) { +- struct phy_device *phy = of_phy_find_device(dn); +- +- mvneta_fixed_link_update(pp, phy); +- +- put_device(&phy->mdio.dev); +- } +- + return 0; + + err_netdev: +@@ -4386,16 +4492,14 @@ err_netdev: + 1 << pp->id); + } + err_free_stats: ++ if (pp->phylink) ++ phylink_destroy(pp->phylink); + free_percpu(pp->stats); + err_free_ports: + free_percpu(pp->ports); + err_clk: + clk_disable_unprepare(pp->clk_bus); + clk_disable_unprepare(pp->clk); +-err_put_phy_node: +- of_node_put(phy_node); +- if (of_phy_is_fixed_link(dn)) +- of_phy_deregister_fixed_link(dn); + err_free_irq: + irq_dispose_mapping(dev->irq); + err_free_netdev: +@@ -4407,7 +4511,6 @@ err_free_netdev: + static int mvneta_remove(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); +- struct device_node *dn = pdev->dev.of_node; + struct mvneta_port *pp = netdev_priv(dev); + + unregister_netdev(dev); +@@ -4415,10 +4518,8 @@ static int mvneta_remove(struct platform + clk_disable_unprepare(pp->clk); + free_percpu(pp->ports); + free_percpu(pp->stats); +- if (of_phy_is_fixed_link(dn)) +- of_phy_deregister_fixed_link(dn); + irq_dispose_mapping(dev->irq); +- of_node_put(pp->phy_node); ++ phylink_destroy(pp->phylink); + free_netdev(dev); + + if (pp->bm_priv) { +@@ -4470,9 +4571,6 @@ static int mvneta_resume(struct device * + return err; + } + +- if (pp->use_inband_status) +- mvneta_fixed_link_update(pp, dev->phydev); +- + netif_device_attach(dev); + if (netif_running(dev)) { + mvneta_open(dev); diff --git a/patch/kernel/mvebu-next/404-net-mvneta-hack-fix-phy_interface.patch b/patch/kernel/mvebu-next/404-net-mvneta-hack-fix-phy_interface.patch new file mode 100644 index 000000000..906c163ac --- /dev/null +++ b/patch/kernel/mvebu-next/404-net-mvneta-hack-fix-phy_interface.patch @@ -0,0 +1,28 @@ +From acdfcc7ef78c46baca1439a1cac5b73008abc672 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 16 May 2017 11:55:58 +0100 +Subject: net: mvneta: hack fix phy_interface + +Signed-off-by: Russell King +--- + drivers/net/ethernet/marvell/mvneta.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -427,6 +427,7 @@ struct mvneta_port { + u16 tx_ring_size; + u16 rx_ring_size; + ++ phy_interface_t phy_interface; + struct device_node *dn; + unsigned int tx_csum_limit; + struct phylink *phylink; +@@ -4315,6 +4316,7 @@ static int mvneta_probe(struct platform_ + + pp = netdev_priv(dev); + spin_lock_init(&pp->lock); ++ pp->phy_interface = phy_mode; + pp->dn = dn; + + pp->rxq_def = rxq_def; diff --git a/patch/kernel/mvebu-next/405-net-mvneta-disable-MVNETA_CAUSE_PSC_SYNC_CHANGE-inte.patch b/patch/kernel/mvebu-next/405-net-mvneta-disable-MVNETA_CAUSE_PSC_SYNC_CHANGE-inte.patch new file mode 100644 index 000000000..ddb0cc8a2 --- /dev/null +++ b/patch/kernel/mvebu-next/405-net-mvneta-disable-MVNETA_CAUSE_PSC_SYNC_CHANGE-inte.patch @@ -0,0 +1,56 @@ +From fde9e742a47606110232b7464608b6f9c0510938 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 24 Dec 2016 10:27:08 +0000 +Subject: net: mvneta: disable MVNETA_CAUSE_PSC_SYNC_CHANGE interrupt + +The PSC sync change interrupt can fire multiple times while the link is +down. As this isn't information we make use of, it's pointless having +the interrupt enabled, so let's disable this interrupt. + +Signed-off-by: Russell King +--- + drivers/net/ethernet/marvell/mvneta.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2704,8 +2704,7 @@ static int mvneta_poll(struct napi_struc + mvreg_write(pp, MVNETA_INTR_MISC_CAUSE, 0); + + if (cause_misc & (MVNETA_CAUSE_PHY_STATUS_CHANGE | +- MVNETA_CAUSE_LINK_CHANGE | +- MVNETA_CAUSE_PSC_SYNC_CHANGE)) ++ MVNETA_CAUSE_LINK_CHANGE)) + mvneta_link_change(pp); + } + +@@ -3044,8 +3043,7 @@ static void mvneta_start_dev(struct mvne + + mvreg_write(pp, MVNETA_INTR_MISC_MASK, + MVNETA_CAUSE_PHY_STATUS_CHANGE | +- MVNETA_CAUSE_LINK_CHANGE | +- MVNETA_CAUSE_PSC_SYNC_CHANGE); ++ MVNETA_CAUSE_LINK_CHANGE); + + phylink_start(pp->phylink); + netif_tx_start_all_queues(pp->dev); +@@ -3542,8 +3540,7 @@ static int mvneta_cpu_online(unsigned in + on_each_cpu(mvneta_percpu_unmask_interrupt, pp, true); + mvreg_write(pp, MVNETA_INTR_MISC_MASK, + MVNETA_CAUSE_PHY_STATUS_CHANGE | +- MVNETA_CAUSE_LINK_CHANGE | +- MVNETA_CAUSE_PSC_SYNC_CHANGE); ++ MVNETA_CAUSE_LINK_CHANGE); + netif_tx_start_all_queues(pp->dev); + spin_unlock(&pp->lock); + return 0; +@@ -3584,8 +3581,7 @@ static int mvneta_cpu_dead(unsigned int + on_each_cpu(mvneta_percpu_unmask_interrupt, pp, true); + mvreg_write(pp, MVNETA_INTR_MISC_MASK, + MVNETA_CAUSE_PHY_STATUS_CHANGE | +- MVNETA_CAUSE_LINK_CHANGE | +- MVNETA_CAUSE_PSC_SYNC_CHANGE); ++ MVNETA_CAUSE_LINK_CHANGE); + netif_tx_start_all_queues(pp->dev); + return 0; + } diff --git a/patch/kernel/mvebu-next/406-net-mvneta-add-module-EEPROM-reading-support.patch b/patch/kernel/mvebu-next/406-net-mvneta-add-module-EEPROM-reading-support.patch new file mode 100644 index 000000000..39eb33ac2 --- /dev/null +++ b/patch/kernel/mvebu-next/406-net-mvneta-add-module-EEPROM-reading-support.patch @@ -0,0 +1,44 @@ +From 2ff039aa4462c2104c210b7cf39691c612de8214 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 1 Oct 2015 23:32:39 +0100 +Subject: net: mvneta: add module EEPROM reading support + +Signed-off-by: Russell King +--- + drivers/net/ethernet/marvell/mvneta.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -4045,6 +4045,22 @@ static int mvneta_ethtool_set_wol(struct + return ret; + } + ++static int mvneta_ethtool_get_module_info(struct net_device *dev, ++ struct ethtool_modinfo *modinfo) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ ++ return phylink_ethtool_get_module_info(pp->phylink, modinfo); ++} ++ ++static int mvneta_ethtool_get_module_eeprom(struct net_device *dev, ++ struct ethtool_eeprom *ee, u8 *buf) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ ++ return phylink_ethtool_get_module_eeprom(pp->phylink, ee, buf); ++} ++ + static int mvneta_ethtool_get_eee(struct net_device *dev, + struct ethtool_eee *eee) + { +@@ -4129,6 +4145,8 @@ static const struct ethtool_ops mvneta_e + .set_link_ksettings = mvneta_ethtool_set_link_ksettings, + .get_wol = mvneta_ethtool_get_wol, + .set_wol = mvneta_ethtool_set_wol, ++ .get_module_info = mvneta_ethtool_get_module_info, ++ .get_module_eeprom = mvneta_ethtool_get_module_eeprom, + .get_eee = mvneta_ethtool_get_eee, + .set_eee = mvneta_ethtool_set_eee, + }; diff --git a/patch/kernel/mvebu-next/407-phy-fixed-phy-remove-fixed_phy_update_state.patch b/patch/kernel/mvebu-next/407-phy-fixed-phy-remove-fixed_phy_update_state.patch new file mode 100644 index 000000000..71c2f4555 --- /dev/null +++ b/patch/kernel/mvebu-next/407-phy-fixed-phy-remove-fixed_phy_update_state.patch @@ -0,0 +1,80 @@ +From 774ce2eda0a929f79ee398ba6d2d13fd406f31c4 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 2 Oct 2015 22:46:54 +0100 +Subject: phy: fixed-phy: remove fixed_phy_update_state() + +mvneta is the only user of fixed_phy_update_state(), which has been +converted to use phylink instead. Remove fixed_phy_update_state(). + +Reviewed-by: Florian Fainelli +Signed-off-by: Russell King +--- + drivers/net/phy/fixed_phy.c | 31 ------------------------------- + include/linux/phy_fixed.h | 9 --------- + 2 files changed, 40 deletions(-) + +--- a/drivers/net/phy/fixed_phy.c ++++ b/drivers/net/phy/fixed_phy.c +@@ -115,37 +115,6 @@ int fixed_phy_set_link_update(struct phy + } + EXPORT_SYMBOL_GPL(fixed_phy_set_link_update); + +-int fixed_phy_update_state(struct phy_device *phydev, +- const struct fixed_phy_status *status, +- const struct fixed_phy_status *changed) +-{ +- struct fixed_mdio_bus *fmb = &platform_fmb; +- struct fixed_phy *fp; +- +- if (!phydev || phydev->mdio.bus != fmb->mii_bus) +- return -EINVAL; +- +- list_for_each_entry(fp, &fmb->phys, node) { +- if (fp->addr == phydev->mdio.addr) { +- write_seqcount_begin(&fp->seqcount); +-#define _UPD(x) if (changed->x) \ +- fp->status.x = status->x +- _UPD(link); +- _UPD(speed); +- _UPD(duplex); +- _UPD(pause); +- _UPD(asym_pause); +-#undef _UPD +- fixed_phy_update(fp); +- write_seqcount_end(&fp->seqcount); +- return 0; +- } +- } +- +- return -ENOENT; +-} +-EXPORT_SYMBOL(fixed_phy_update_state); +- + int fixed_phy_add(unsigned int irq, int phy_addr, + struct fixed_phy_status *status, + int link_gpio) +--- a/include/linux/phy_fixed.h ++++ b/include/linux/phy_fixed.h +@@ -24,9 +24,6 @@ extern void fixed_phy_unregister(struct + extern int fixed_phy_set_link_update(struct phy_device *phydev, + int (*link_update)(struct net_device *, + struct fixed_phy_status *)); +-extern int fixed_phy_update_state(struct phy_device *phydev, +- const struct fixed_phy_status *status, +- const struct fixed_phy_status *changed); + #else + static inline int fixed_phy_add(unsigned int irq, int phy_id, + struct fixed_phy_status *status, +@@ -50,12 +47,6 @@ static inline int fixed_phy_set_link_upd + { + return -ENODEV; + } +-static inline int fixed_phy_update_state(struct phy_device *phydev, +- const struct fixed_phy_status *status, +- const struct fixed_phy_status *changed) +-{ +- return -ENODEV; +-} + #endif /* CONFIG_FIXED_PHY */ + + #endif /* __PHY_FIXED_H */ diff --git a/patch/kernel/mvebu-next/408-sfp-move-module-eeprom-ethtool-access-into-netdev-co.patch b/patch/kernel/mvebu-next/408-sfp-move-module-eeprom-ethtool-access-into-netdev-co.patch new file mode 100644 index 000000000..2e135e684 --- /dev/null +++ b/patch/kernel/mvebu-next/408-sfp-move-module-eeprom-ethtool-access-into-netdev-co.patch @@ -0,0 +1,181 @@ +From c47beb7e3f8575dfd7d58240a72c4e4e66ce5449 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 14 Apr 2017 15:26:32 +0100 +Subject: sfp: move module eeprom ethtool access into netdev core ethtool + +Signed-off-by: Russell King +--- + drivers/net/ethernet/marvell/mvneta.c | 18 ------------------ + drivers/net/phy/phylink.c | 28 ---------------------------- + drivers/net/phy/sfp-bus.c | 6 ++---- + include/linux/netdevice.h | 2 ++ + include/linux/phylink.h | 3 --- + net/core/ethtool.c | 7 +++++++ + 6 files changed, 11 insertions(+), 53 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -4045,22 +4045,6 @@ static int mvneta_ethtool_set_wol(struct + return ret; + } + +-static int mvneta_ethtool_get_module_info(struct net_device *dev, +- struct ethtool_modinfo *modinfo) +-{ +- struct mvneta_port *pp = netdev_priv(dev); +- +- return phylink_ethtool_get_module_info(pp->phylink, modinfo); +-} +- +-static int mvneta_ethtool_get_module_eeprom(struct net_device *dev, +- struct ethtool_eeprom *ee, u8 *buf) +-{ +- struct mvneta_port *pp = netdev_priv(dev); +- +- return phylink_ethtool_get_module_eeprom(pp->phylink, ee, buf); +-} +- + static int mvneta_ethtool_get_eee(struct net_device *dev, + struct ethtool_eee *eee) + { +@@ -4145,8 +4129,6 @@ static const struct ethtool_ops mvneta_e + .set_link_ksettings = mvneta_ethtool_set_link_ksettings, + .get_wol = mvneta_ethtool_get_wol, + .set_wol = mvneta_ethtool_set_wol, +- .get_module_info = mvneta_ethtool_get_module_info, +- .get_module_eeprom = mvneta_ethtool_get_module_eeprom, + .get_eee = mvneta_ethtool_get_eee, + .set_eee = mvneta_ethtool_set_eee, + }; +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -1040,34 +1040,6 @@ int phylink_ethtool_set_pauseparam(struc + } + EXPORT_SYMBOL_GPL(phylink_ethtool_set_pauseparam); + +-int phylink_ethtool_get_module_info(struct phylink *pl, +- struct ethtool_modinfo *modinfo) +-{ +- int ret = -EOPNOTSUPP; +- +- WARN_ON(!lockdep_rtnl_is_held()); +- +- if (pl->sfp_bus) +- ret = sfp_get_module_info(pl->sfp_bus, modinfo); +- +- return ret; +-} +-EXPORT_SYMBOL_GPL(phylink_ethtool_get_module_info); +- +-int phylink_ethtool_get_module_eeprom(struct phylink *pl, +- struct ethtool_eeprom *ee, u8 *buf) +-{ +- int ret = -EOPNOTSUPP; +- +- WARN_ON(!lockdep_rtnl_is_held()); +- +- if (pl->sfp_bus) +- ret = sfp_get_module_eeprom(pl->sfp_bus, ee, buf); +- +- return ret; +-} +-EXPORT_SYMBOL_GPL(phylink_ethtool_get_module_eeprom); +- + int phylink_init_eee(struct phylink *pl, bool clk_stop_enable) + { + int ret = -EPROTONOSUPPORT; +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -278,6 +278,7 @@ static int sfp_register_bus(struct sfp_b + } + if (bus->started) + bus->socket_ops->start(bus->sfp); ++ bus->netdev->sfp_bus = bus; + bus->registered = true; + return 0; + } +@@ -292,14 +293,13 @@ static void sfp_unregister_bus(struct sf + if (bus->phydev && ops && ops->disconnect_phy) + ops->disconnect_phy(bus->upstream); + } ++ bus->netdev->sfp_bus = NULL; + bus->registered = false; + } + + + int sfp_get_module_info(struct sfp_bus *bus, struct ethtool_modinfo *modinfo) + { +- if (!bus->registered) +- return -ENOIOCTLCMD; + return bus->socket_ops->module_info(bus->sfp, modinfo); + } + EXPORT_SYMBOL_GPL(sfp_get_module_info); +@@ -307,8 +307,6 @@ EXPORT_SYMBOL_GPL(sfp_get_module_info); + int sfp_get_module_eeprom(struct sfp_bus *bus, struct ethtool_eeprom *ee, + u8 *data) + { +- if (!bus->registered) +- return -ENOIOCTLCMD; + return bus->socket_ops->module_eeprom(bus->sfp, ee, data); + } + EXPORT_SYMBOL_GPL(sfp_get_module_eeprom); +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -57,6 +57,7 @@ struct device; + struct phy_device; + struct dsa_switch_tree; + ++struct sfp_bus; + /* 802.11 specific */ + struct wireless_dev; + /* 802.15.4 specific */ +@@ -1932,6 +1933,7 @@ struct net_device { + struct netprio_map __rcu *priomap; + #endif + struct phy_device *phydev; ++ struct sfp_bus *sfp_bus; + struct lock_class_key *qdisc_tx_busylock; + struct lock_class_key *qdisc_running_key; + bool proto_down; +--- a/include/linux/phylink.h ++++ b/include/linux/phylink.h +@@ -125,9 +125,6 @@ void phylink_ethtool_get_pauseparam(stru + struct ethtool_pauseparam *); + int phylink_ethtool_set_pauseparam(struct phylink *, + struct ethtool_pauseparam *); +-int phylink_ethtool_get_module_info(struct phylink *, struct ethtool_modinfo *); +-int phylink_ethtool_get_module_eeprom(struct phylink *, +- struct ethtool_eeprom *, u8 *); + int phylink_init_eee(struct phylink *, bool); + int phylink_get_eee_err(struct phylink *); + int phylink_ethtool_get_eee(struct phylink *, struct ethtool_eee *); +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2190,6 +2191,9 @@ static int __ethtool_get_module_info(str + const struct ethtool_ops *ops = dev->ethtool_ops; + struct phy_device *phydev = dev->phydev; + ++ if (dev->sfp_bus) ++ return sfp_get_module_info(dev->sfp_bus, modinfo); ++ + if (phydev && phydev->drv && phydev->drv->module_info) + return phydev->drv->module_info(phydev, modinfo); + +@@ -2224,6 +2228,9 @@ static int __ethtool_get_module_eeprom(s + const struct ethtool_ops *ops = dev->ethtool_ops; + struct phy_device *phydev = dev->phydev; + ++ if (dev->sfp_bus) ++ return sfp_get_module_eeprom(dev->sfp_bus, ee, data); ++ + if (phydev && phydev->drv && phydev->drv->module_eeprom) + return phydev->drv->module_eeprom(phydev, ee, data); + diff --git a/patch/kernel/mvebu-next/409-sfp-use-netdev-sfp_bus-for-start-stop.patch b/patch/kernel/mvebu-next/409-sfp-use-netdev-sfp_bus-for-start-stop.patch new file mode 100644 index 000000000..7023b57a5 --- /dev/null +++ b/patch/kernel/mvebu-next/409-sfp-use-netdev-sfp_bus-for-start-stop.patch @@ -0,0 +1,34 @@ +From 883dc66755313e133a787eba4dfde313fe33525b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 14 Apr 2017 16:41:55 +0100 +Subject: sfp: use netdev sfp_bus for start/stop + +Signed-off-by: Russell King +--- + drivers/net/phy/phylink.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -755,8 +755,8 @@ void phylink_start(struct phylink *pl) + clear_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state); + phylink_run_resolve(pl); + +- if (pl->sfp_bus) +- sfp_upstream_start(pl->sfp_bus); ++ if (pl->netdev->sfp_bus) ++ sfp_upstream_start(pl->netdev->sfp_bus); + if (pl->phydev) + phy_start(pl->phydev); + } +@@ -768,8 +768,8 @@ void phylink_stop(struct phylink *pl) + + if (pl->phydev) + phy_stop(pl->phydev); +- if (pl->sfp_bus) +- sfp_upstream_stop(pl->sfp_bus); ++ if (pl->netdev->sfp_bus) ++ sfp_upstream_stop(pl->netdev->sfp_bus); + + set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state); + queue_work(system_power_efficient_wq, &pl->resolve); diff --git a/patch/kernel/mvebu-next/410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch b/patch/kernel/mvebu-next/410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch new file mode 100644 index 000000000..6ca43043f --- /dev/null +++ b/patch/kernel/mvebu-next/410-sfp-hack-allow-marvell-10G-phy-support-to-use-SFP.patch @@ -0,0 +1,131 @@ +From 4a4aca08b11501cb1b2c509113bbb65eb66a1f45 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 14 Apr 2017 14:21:25 +0100 +Subject: sfp: hack: allow marvell 10G phy support to use SFP + +Allow the Marvell 10G PHY to register with the SFP bus, so that SFP+ +cages can work. This bypasses phylink, meaning that socket status +is not taken into account for the link state. Also, the tx-disable +signal must be commented out in DT for this to work... + +Signed-off-by: Russell King +--- + drivers/net/phy/marvell10g.c | 54 +++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 53 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -15,8 +15,10 @@ + * If both the fiber and copper ports are connected, the first to gain + * link takes priority and the other port is completely locked out. + */ ++#include + #include + #include ++#include + + enum { + MV_PCS_BASE_T = 0x0000, +@@ -38,6 +40,11 @@ enum { + MV_AN_RESULT_SPD_10000 = BIT(15), + }; + ++struct mv3310_priv { ++ struct device_node *sfp_node; ++ struct sfp_bus *sfp_bus; ++}; ++ + static int mv3310_modify(struct phy_device *phydev, int devad, u16 reg, + u16 mask, u16 bits) + { +@@ -56,17 +63,52 @@ static int mv3310_modify(struct phy_devi + return ret < 0 ? ret : 1; + } + ++static int mv3310_sfp_insert(void *upstream, const struct sfp_eeprom_id *id) ++{ ++ struct phy_device *phydev = upstream; ++ struct mv3310_priv *priv = dev_get_drvdata(&phydev->mdio.dev); ++ ++ if (sfp_parse_interface(priv->sfp_bus, id) != PHY_INTERFACE_MODE_10GKR) { ++ dev_err(&phydev->mdio.dev, "incompatible SFP module inserted\n"); ++ return -EINVAL; ++ } ++ return 0; ++} ++ ++static const struct sfp_upstream_ops mv3310_sfp_ops = { ++ .module_insert = mv3310_sfp_insert, ++}; ++ + static int mv3310_probe(struct phy_device *phydev) + { ++ struct mv3310_priv *priv; + u32 mmd_mask = MDIO_DEVS_PMAPMD | MDIO_DEVS_AN; + + if (!phydev->is_c45 || + (phydev->c45_ids.devices_in_package & mmd_mask) != mmd_mask) + return -ENODEV; + ++ priv = devm_kzalloc(&phydev->mdio.dev, sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ ++ dev_set_drvdata(&phydev->mdio.dev, priv); ++ ++ if (phydev->mdio.dev.of_node) ++ priv->sfp_node = of_parse_phandle(phydev->mdio.dev.of_node, ++ "sfp", 0); ++ + return 0; + } + ++static void mv3310_remove(struct phy_device *phydev) ++{ ++ struct mv3310_priv *priv = dev_get_drvdata(&phydev->mdio.dev); ++ ++ if (priv->sfp_bus) ++ sfp_unregister_upstream(priv->sfp_bus); ++} ++ + /* + * Resetting the MV88X3310 causes it to become non-responsive. Avoid + * setting the reset bit(s). +@@ -78,6 +120,7 @@ static int mv3310_soft_reset(struct phy_ + + static int mv3310_config_init(struct phy_device *phydev) + { ++ struct mv3310_priv *priv = dev_get_drvdata(&phydev->mdio.dev); + __ETHTOOL_DECLARE_LINK_MODE_MASK(supported) = { 0, }; + u32 mask; + int val; +@@ -166,6 +209,14 @@ static int mv3310_config_init(struct phy + phydev->supported &= mask; + phydev->advertising &= phydev->supported; + ++ /* Would be nice to do this in the probe function, but unfortunately, ++ * phylib doesn't have phydev->attached_dev set there. ++ */ ++ if (priv->sfp_node && !priv->sfp_bus) ++ priv->sfp_bus = sfp_register_upstream(priv->sfp_node, ++ phydev->attached_dev, ++ phydev, &mv3310_sfp_ops); ++ + return 0; + } + +@@ -349,12 +400,13 @@ static struct phy_driver mv3310_drivers[ + SUPPORTED_FIBRE | + SUPPORTED_10000baseT_Full | + SUPPORTED_Backplane, +- .probe = mv3310_probe, + .soft_reset = mv3310_soft_reset, + .config_init = mv3310_config_init, ++ .probe = mv3310_probe, + .config_aneg = mv3310_config_aneg, + .aneg_done = mv3310_aneg_done, + .read_status = mv3310_read_status, ++ .remove = mv3310_remove, + }, + }; + diff --git a/patch/kernel/mvebu-next/411-sfp-add-sfp-compatible.patch b/patch/kernel/mvebu-next/411-sfp-add-sfp-compatible.patch new file mode 100644 index 000000000..b775116cd --- /dev/null +++ b/patch/kernel/mvebu-next/411-sfp-add-sfp-compatible.patch @@ -0,0 +1,24 @@ +From 3344f73509a34d2124b716efc79cd9787773018b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 14 Apr 2017 20:17:13 +0100 +Subject: sfp: add sfp+ compatible + +Add a compatible for SFP+ cages. SFP+ cages are backwards compatible, +but the ethernet device behind them may not support the slower speeds +of SFP modules. + +Signed-off-by: Russell King +--- + drivers/net/phy/sfp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -1136,6 +1136,7 @@ static int sfp_remove(struct platform_de + + static const struct of_device_id sfp_of_match[] = { + { .compatible = "sff,sfp", }, ++ { .compatible = "sff,sfp+", }, + { }, + }; + MODULE_DEVICE_TABLE(of, sfp_of_match); diff --git a/patch/kernel/mvebu-next/412-ARM-dts-armada388-clearfog-emmc-on-clearfog-base.patch b/patch/kernel/mvebu-next/412-ARM-dts-armada388-clearfog-emmc-on-clearfog-base.patch new file mode 100644 index 000000000..222a32382 --- /dev/null +++ b/patch/kernel/mvebu-next/412-ARM-dts-armada388-clearfog-emmc-on-clearfog-base.patch @@ -0,0 +1,87 @@ +From 8137da20701c776ad3481115305a5e8e410871ba Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 29 Nov 2016 10:15:45 +0000 +Subject: ARM: dts: armada388-clearfog: emmc on clearfog base + +Signed-off-by: Russell King +--- + arch/arm/boot/dts/armada-388-clearfog-base.dts | 1 + + .../dts/armada-38x-solidrun-microsom-emmc.dtsi | 62 ++++++++++++++++++++++ + 2 files changed, 63 insertions(+) + create mode 100644 arch/arm/boot/dts/armada-38x-solidrun-microsom-emmc.dtsi + +--- a/arch/arm/boot/dts/armada-388-clearfog-base.dts ++++ b/arch/arm/boot/dts/armada-388-clearfog-base.dts +@@ -48,6 +48,7 @@ + + /dts-v1/; + #include "armada-388-clearfog.dtsi" ++#include "armada-38x-solidrun-microsom-emmc.dtsi" + + / { + model = "SolidRun Clearfog Base A1"; +--- /dev/null ++++ b/arch/arm/boot/dts/armada-38x-solidrun-microsom-emmc.dtsi +@@ -0,0 +1,62 @@ ++/* ++ * Device Tree file for SolidRun Armada 38x Microsom add-on for eMMC ++ * ++ * Copyright (C) 2015 Russell King ++ * ++ * This board is in development; the contents of this file work with ++ * the A1 rev 2.0 of the board, which does not represent final ++ * production board. Things will change, don't expect this file to ++ * remain compatible info the future. ++ * ++ * This file is dual-licensed: you can use it either under the terms ++ * of the GPL or the X11 license, at your option. Note that this dual ++ * licensing only applies to this file, and not this project as a ++ * whole. ++ * ++ * a) This file is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public License ++ * version 2 as published by the Free Software Foundation. ++ * ++ * This file is distributed in the hope that it will be useful ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * Or, alternatively ++ * ++ * b) Permission is hereby granted, free of charge, to any person ++ * obtaining a copy of this software and associated documentation ++ * files (the "Software"), to deal in the Software without ++ * restriction, including without limitation the rights to use ++ * copy, modify, merge, publish, distribute, sublicense, and/or ++ * sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following ++ * conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED , WITHOUT WARRANTY OF ANY KIND ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES ++ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT ++ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY ++ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING ++ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ */ ++/ { ++ soc { ++ internal-regs { ++ sdhci@d8000 { ++ bus-width = <4>; ++ no-1-8-v; ++ non-removable; ++ pinctrl-0 = <µsom_sdhci_pins>; ++ pinctrl-names = "default"; ++ status = "okay"; ++ wp-inverted; ++ }; ++ }; ++ }; ++}; diff --git a/patch/kernel/mvebu-next/413-ARM-dts-armada388-clearfog-increase-speed-of-i2c0-to.patch b/patch/kernel/mvebu-next/413-ARM-dts-armada388-clearfog-increase-speed-of-i2c0-to.patch new file mode 100644 index 000000000..4aedc82fe --- /dev/null +++ b/patch/kernel/mvebu-next/413-ARM-dts-armada388-clearfog-increase-speed-of-i2c0-to.patch @@ -0,0 +1,42 @@ +From 6e127081e669cf163a818dc04d590790e4ed9527 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 29 Nov 2016 20:06:44 +0000 +Subject: ARM: dts: armada388-clearfog: increase speed of i2c0 to 400kHz + +All the devices on I2C0 support fast mode, so increase the bus speed +to match. The Armada 388 is known to have a timing issue when in +standard mode, which we believe causes the ficticious device at 0x64 +to appear. + +Signed-off-by: Russell King +--- + arch/arm/boot/dts/armada-388-clearfog.dtsi | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/armada-388-clearfog.dtsi ++++ b/arch/arm/boot/dts/armada-388-clearfog.dtsi +@@ -143,8 +143,7 @@ + }; + + &i2c0 { +- /* Is there anything on this? */ +- clock-frequency = <100000>; ++ clock-frequency = <400000>; + pinctrl-0 = <&i2c0_pins>; + pinctrl-names = "default"; + status = "okay"; +@@ -239,13 +238,11 @@ + }; + }; + +- /* The MCP3021 is 100kHz clock only */ ++ /* The MCP3021 supports standard and fast modes */ + mikrobus_adc: mcp3021@4c { + compatible = "microchip,mcp3021"; + reg = <0x4c>; + }; +- +- /* Also something at 0x64 */ + }; + + &i2c1 { diff --git a/patch/kernel/mvebu-next/415-ARM-dts-armada388-clearfog-document-MPP-usage.patch b/patch/kernel/mvebu-next/415-ARM-dts-armada388-clearfog-document-MPP-usage.patch new file mode 100644 index 000000000..0e24d08c8 --- /dev/null +++ b/patch/kernel/mvebu-next/415-ARM-dts-armada388-clearfog-document-MPP-usage.patch @@ -0,0 +1,124 @@ +From 09a0122c74ec076e08512f1b00b7ccb8a450282f Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Tue, 29 Nov 2016 10:15:43 +0000 +Subject: ARM: dts: armada388-clearfog: document MPP usage + +Signed-off-by: Russell King +--- + arch/arm/boot/dts/armada-388-clearfog-base.dts | 51 ++++++++++++++++++++++++++ + arch/arm/boot/dts/armada-388-clearfog.dts | 50 +++++++++++++++++++++++++ + 2 files changed, 101 insertions(+) + +--- a/arch/arm/boot/dts/armada-388-clearfog-base.dts ++++ b/arch/arm/boot/dts/armada-388-clearfog-base.dts +@@ -108,3 +108,54 @@ + marvell,function = "gpio"; + }; + }; ++ ++/* ++MPP ++18: pu gpio pca9655 int ++19: gpio phy reset ++20: pu gpio sd0 detect ++21: sd0:cmd ++22: pd gpio mikro int ++23: ++ ++24: ua1:rxd mikro rx ++25: ua1:txd mikro tx ++26: pu i2c1:sck ++27: pu i2c1:sda ++28: sd0:clk ++29: pd gpio mikro rst ++30: ++31: ++ ++32: ++33: ++34: ++35: ++36: ++37: sd0:d3 ++38: sd0:d0 ++39: sd0:d1 ++ ++40: sd0:d2 ++41: ++42: ++43: spi1:cs2 mikro cs ++44: gpio rear button sw3 ++45: ref:clk_out0 phy#0 clock ++46: ref:clk_out1 phy#1 clock ++47: ++ ++48: gpio J18 spare gpio ++49: gpio U10 I2C_IRQ(GNSS) ++50: gpio board id? ++51: ++52: ++53: ++54: gpio mikro pwm ++55: ++ ++56: pu spi1:mosi mikro mosi ++57: pd spi1:sck mikro sck ++58: spi1:miso mikro miso ++59: ++*/ +--- a/arch/arm/boot/dts/armada-388-clearfog.dts ++++ b/arch/arm/boot/dts/armada-388-clearfog.dts +@@ -290,3 +290,53 @@ + */ + pinctrl-0 = <&spi1_pins &clearfog_spi1_cs_pins &mikro_spi_pins>; + }; ++/* +++#define A38x_CUSTOMER_BOARD_1_MPP16_23 0x00400011 ++MPP18: gpio ? (pca9655 int?) ++MPP19: gpio ? (clkreq?) ++MPP20: gpio ? (sd0 detect) ++MPP21: sd0:cmd x sd0 ++MPP22: gpio x mikro int ++MPP23: gpio x switch irq +++#define A38x_CUSTOMER_BOARD_1_MPP24_31 0x22043333 ++MPP24: ua1:rxd x mikro rx ++MPP25: ua1:txd x mikro tx ++MPP26: i2c1:sck x mikro sck ++MPP27: i2c1:sda x mikro sda ++MPP28: sd0:clk x sd0 ++MPP29: gpio x mikro rst ++MPP30: ge1:txd2 ? (config) ++MPP31: ge1:txd3 ? (config) +++#define A38x_CUSTOMER_BOARD_1_MPP32_39 0x44400002 ++MPP32: ge1:txctl ? (unused) ++MPP33: gpio ? (pic_com0) ++MPP34: gpio x rear button (pic_com1) ++MPP35: gpio ? (pic_com2) ++MPP36: gpio ? (unused) ++MPP37: sd0:d3 x sd0 ++MPP38: sd0:d0 x sd0 ++MPP39: sd0:d1 x sd0 +++#define A38x_CUSTOMER_BOARD_1_MPP40_47 0x41144004 ++MPP40: sd0:d2 x sd0 ++MPP41: gpio x switch reset ++MPP42: gpio ? sw1-1 ++MPP43: spi1:cs2 x mikro cs ++MPP44: sata3:prsnt ? (unused) ++MPP45: ref:clk_out0 ? ++MPP46: ref:clk_out1 x switch clk ++MPP47: 4 ? (unused) +++#define A38x_CUSTOMER_BOARD_1_MPP48_55 0x40333333 ++MPP48: tdm:pclk ++MPP49: tdm:fsync ++MPP50: tdm:drx ++MPP51: tdm:dtx ++MPP52: tdm:int ++MPP53: tdm:rst ++MPP54: gpio ? (pwm) ++MPP55: spi1:cs1 x slic +++#define A38x_CUSTOMER_BOARD_1_MPP56_63 0x00004444 ++MPP56: spi1:mosi x mikro mosi ++MPP57: spi1:sck x mikro sck ++MPP58: spi1:miso x mikro miso ++MPP59: spi1:cs0 x w25q32 ++*/ diff --git a/patch/kernel/mvebu-next/420-rtc-trimming-support.patch b/patch/kernel/mvebu-next/420-rtc-trimming-support.patch new file mode 100644 index 000000000..2974a6976 --- /dev/null +++ b/patch/kernel/mvebu-next/420-rtc-trimming-support.patch @@ -0,0 +1,143 @@ +commit f94ffbc2c2a4128c4412bb483d0807722dfb682b +Author: Russell King +Date: Fri Sep 29 11:23:31 2017 +0100 + + rtc: armada38x: add support for trimming the RTC + + Add support for trimming the RTC using the offset mechanism. This RTC + supports two modes: low update mode and high update mode. Low update + mode has finer precision than high update mode, so we use the low mode + where possible. + + Signed-off-by: Russell King + Signed-off-by: Alexandre Belloni + +--- a/drivers/rtc/rtc-armada38x.c ++++ b/drivers/rtc/rtc-armada38x.c +@@ -28,6 +28,8 @@ + #define RTC_IRQ_AL_EN BIT(0) + #define RTC_IRQ_FREQ_EN BIT(1) + #define RTC_IRQ_FREQ_1HZ BIT(2) ++#define RTC_CCR 0x18 ++#define RTC_CCR_MODE BIT(15) + + #define RTC_TIME 0xC + #define RTC_ALARM1 0x10 +@@ -343,18 +345,117 @@ static irqreturn_t armada38x_rtc_alarm_i + return IRQ_HANDLED; + } + ++/* ++ * The information given in the Armada 388 functional spec is complex. ++ * They give two different formulas for calculating the offset value, ++ * but when considering "Offset" as an 8-bit signed integer, they both ++ * reduce down to (we shall rename "Offset" as "val" here): ++ * ++ * val = (f_ideal / f_measured - 1) / resolution where f_ideal = 32768 ++ * ++ * Converting to time, f = 1/t: ++ * val = (t_measured / t_ideal - 1) / resolution where t_ideal = 1/32768 ++ * ++ * => t_measured / t_ideal = val * resolution + 1 ++ * ++ * "offset" in the RTC interface is defined as: ++ * t = t0 * (1 + offset * 1e-9) ++ * where t is the desired period, t0 is the measured period with a zero ++ * offset, which is t_measured above. With t0 = t_measured and t = t_ideal, ++ * offset = (t_ideal / t_measured - 1) / 1e-9 ++ * ++ * => t_ideal / t_measured = offset * 1e-9 + 1 ++ * ++ * so: ++ * ++ * offset * 1e-9 + 1 = 1 / (val * resolution + 1) ++ * ++ * We want "resolution" to be an integer, so resolution = R * 1e-9, giving ++ * offset = 1e18 / (val * R + 1e9) - 1e9 ++ * val = (1e18 / (offset + 1e9) - 1e9) / R ++ * with a common transformation: ++ * f(x) = 1e18 / (x + 1e9) - 1e9 ++ * offset = f(val * R) ++ * val = f(offset) / R ++ * ++ * Armada 38x supports two modes, fine mode (954ppb) and coarse mode (3815ppb). ++ */ ++static long armada38x_ppb_convert(long ppb) ++{ ++ long div = ppb + 1000000000L; ++ ++ return div_s64(1000000000000000000LL + div / 2, div) - 1000000000L; ++} ++ ++static int armada38x_rtc_read_offset(struct device *dev, long *offset) ++{ ++ struct armada38x_rtc *rtc = dev_get_drvdata(dev); ++ unsigned long ccr, flags; ++ long ppb_cor; ++ ++ spin_lock_irqsave(&rtc->lock, flags); ++ ccr = rtc->data->read_rtc_reg(rtc, RTC_CCR); ++ spin_unlock_irqrestore(&rtc->lock, flags); ++ ++ ppb_cor = (ccr & RTC_CCR_MODE ? 3815 : 954) * (s8)ccr; ++ /* ppb_cor + 1000000000L can never be zero */ ++ *offset = armada38x_ppb_convert(ppb_cor); ++ ++ return 0; ++} ++ ++static int armada38x_rtc_set_offset(struct device *dev, long offset) ++{ ++ struct armada38x_rtc *rtc = dev_get_drvdata(dev); ++ unsigned long ccr = 0; ++ long ppb_cor, off; ++ ++ /* ++ * The maximum ppb_cor is -128 * 3815 .. 127 * 3815, but we ++ * need to clamp the input. This equates to -484270 .. 488558. ++ * Not only is this to stop out of range "off" but also to ++ * avoid the division by zero in armada38x_ppb_convert(). ++ */ ++ offset = clamp(offset, -484270L, 488558L); ++ ++ ppb_cor = armada38x_ppb_convert(offset); ++ ++ /* ++ * Use low update mode where possible, which gives a better ++ * resolution of correction. ++ */ ++ off = DIV_ROUND_CLOSEST(ppb_cor, 954); ++ if (off > 127 || off < -128) { ++ ccr = RTC_CCR_MODE; ++ off = DIV_ROUND_CLOSEST(ppb_cor, 3815); ++ } ++ ++ /* ++ * Armada 388 requires a bit pattern in bits 14..8 depending on ++ * the sign bit: { 0, ~S, S, S, S, S, S } ++ */ ++ ccr |= (off & 0x3fff) ^ 0x2000; ++ rtc_delayed_write(ccr, rtc, RTC_CCR); ++ ++ return 0; ++} ++ + static const struct rtc_class_ops armada38x_rtc_ops = { + .read_time = armada38x_rtc_read_time, + .set_time = armada38x_rtc_set_time, + .read_alarm = armada38x_rtc_read_alarm, + .set_alarm = armada38x_rtc_set_alarm, + .alarm_irq_enable = armada38x_rtc_alarm_irq_enable, ++ .read_offset = armada38x_rtc_read_offset, ++ .set_offset = armada38x_rtc_set_offset, + }; + + static const struct rtc_class_ops armada38x_rtc_ops_noirq = { + .read_time = armada38x_rtc_read_time, + .set_time = armada38x_rtc_set_time, + .read_alarm = armada38x_rtc_read_alarm, ++ .read_offset = armada38x_rtc_read_offset, ++ .set_offset = armada38x_rtc_set_offset, + }; + + static const struct armada38x_rtc_data armada38x_data = { diff --git a/patch/kernel/mvebu-next/421-rtc-initialize.patch b/patch/kernel/mvebu-next/421-rtc-initialize.patch new file mode 100644 index 000000000..47a5acc70 --- /dev/null +++ b/patch/kernel/mvebu-next/421-rtc-initialize.patch @@ -0,0 +1,74 @@ +Some boards like the Turris Omnia have an RTC chip that does not get +initialized. Initializing the RTC at the driver level helps get rid of +bootloader hacks that write special register values. + +--- a/drivers/rtc/rtc-armada38x.c ++++ b/drivers/rtc/rtc-armada38x.c +@@ -30,6 +30,9 @@ + #define RTC_IRQ_FREQ_1HZ BIT(2) + #define RTC_CCR 0x18 + #define RTC_CCR_MODE BIT(15) ++#define RTC_CCR_NORMAL_PPB 0x2000 ++#define RTC_TEST_CONF 0x1c ++#define RTC_TEST_CONF_MASK 0xff + + #define RTC_TIME 0xC + #define RTC_ALARM1 0x10 +@@ -91,6 +94,7 @@ struct armada38x_rtc_data { + void (*clear_isr)(struct armada38x_rtc *rtc); + void (*unmask_interrupt)(struct armada38x_rtc *rtc); + u32 alarm; ++ void (*init_rtc)(struct armada38x_rtc *rtc); + }; + + /* +@@ -202,6 +206,23 @@ static void armada38x_unmask_interrupt(s + writel(val | SOC_RTC_ALARM1_MASK, rtc->regs_soc + SOC_RTC_INTERRUPT); + } + ++static void armada38x_rtc_init(struct armada38x_rtc *rtc) ++{ ++ u32 reg; ++ ++ /* Test RTC test configuration register bits [7:0] */ ++ reg = readl(rtc->regs + RTC_TEST_CONF); ++ /* If bits [7:0] are non-zero, assume RTC was uninitialized */ ++ if (reg & RTC_TEST_CONF_MASK) { ++ rtc_delayed_write(0, rtc, RTC_TEST_CONF); ++ rtc_delayed_write(0, rtc, RTC_TIME); ++ rtc_delayed_write((RTC_STATUS_ALARM1 | RTC_STATUS_ALARM2), ++ rtc, RTC_STATUS); ++ rtc_delayed_write(RTC_CCR_NORMAL_PPB, rtc, RTC_CCR); ++ } ++ return; ++} ++ + static void armada8k_clear_isr(struct armada38x_rtc *rtc) + { + writel(RTC_8K_ALARM2, rtc->regs_soc + RTC_8K_ISR); +@@ -464,6 +485,7 @@ static const struct armada38x_rtc_data a + .clear_isr = armada38x_clear_isr, + .unmask_interrupt = armada38x_unmask_interrupt, + .alarm = ALARM1, ++ .init_rtc = armada38x_rtc_init, + }; + + static const struct armada38x_rtc_data armada8k_data = { +@@ -558,6 +580,17 @@ static __init int armada38x_rtc_probe(st + dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret); + return ret; + } ++ ++ /* ++ * Try to detect if RTC is in uninitialized state. ++ * It is not definitive to know if the RTC is in an uninialized state or not, ++ * but the following call will read some bits in the RTC unit and guess if ++ * if it's in that state, and accordingly set it to sane default values. ++ */ ++ if (rtc->data->init_rtc) { ++ rtc->data->init_rtc(rtc); ++ } ++ + return 0; + } + diff --git a/patch/kernel/mvebu-next/423-ARM-dts-armada-385-linksys-Disable-internal-RTC.patch b/patch/kernel/mvebu-next/423-ARM-dts-armada-385-linksys-Disable-internal-RTC.patch new file mode 100644 index 000000000..040d6590b --- /dev/null +++ b/patch/kernel/mvebu-next/423-ARM-dts-armada-385-linksys-Disable-internal-RTC.patch @@ -0,0 +1,28 @@ +From e1cac198fea08c31ec204bed84c279ab05d20389 Mon Sep 17 00:00:00 2001 +From: Hauke Mehrtens +Date: Sat, 17 Mar 2018 15:22:25 +0100 +Subject: ARM: dts: armada-385-linksys: Disable internal RTC + +The internal RTC does not work correctly on these Linksys boards based +on Marvell SoCs. For me it only shows Wed Dec 31 23:59:59 1969 and for +others it is off by 3 minutes in 10 minutes running, this was reported +by multiple users. On the Linksys Mamba device the device tree comment +says that no crystal is connected to the internal RTC, this is probably +also true for the other devices. + +Signed-off-by: Hauke Mehrtens +--- + arch/arm/boot/dts/armada-385-linksys.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm/boot/dts/armada-385-linksys.dtsi ++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi +@@ -304,3 +304,8 @@ + status = "okay"; + usb-phy = <&usb3_1_phy>; + }; ++ ++&rtc { ++ /* No crystal connected to the internal RTC */ ++ status = "disabled"; ++}; diff --git a/patch/kernel/mvebu-next/450-reprobe_sfp_phy.patch b/patch/kernel/mvebu-next/450-reprobe_sfp_phy.patch new file mode 100644 index 000000000..e9a3d695d --- /dev/null +++ b/patch/kernel/mvebu-next/450-reprobe_sfp_phy.patch @@ -0,0 +1,94 @@ +From 28baa5e2635285b178326b301f534ed95c65dd01 Mon Sep 17 00:00:00 2001 +From: Jonas Gorski +Date: Thu, 29 Sep 2016 11:44:39 +0200 +Subject: [PATCH] sfp: retry phy probe if unsuccessful + +Some phys seem to take longer than 50 ms to come out of reset, so retry +until we find a phy. + +Signed-off-by: Jonas Gorski +--- + drivers/net/phy/sfp.c | 38 +++++++++++++++++++++++++------------- + 1 file changed, 25 insertions(+), 13 deletions(-) + +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -488,7 +488,7 @@ static void sfp_sm_phy_detach(struct sfp + sfp->mod_phy = NULL; + } + +-static void sfp_sm_probe_phy(struct sfp *sfp) ++static int sfp_sm_probe_phy(struct sfp *sfp) + { + struct phy_device *phy; + int err; +@@ -498,11 +498,11 @@ static void sfp_sm_probe_phy(struct sfp + phy = mdiobus_scan(sfp->i2c_mii, SFP_PHY_ADDR); + if (phy == ERR_PTR(-ENODEV)) { + dev_info(sfp->dev, "no PHY detected\n"); +- return; ++ return -EAGAIN; + } + if (IS_ERR(phy)) { + dev_err(sfp->dev, "mdiobus scan returned %ld\n", PTR_ERR(phy)); +- return; ++ return PTR_ERR(phy); + } + + err = sfp_add_phy(sfp->sfp_bus, phy); +@@ -510,11 +510,13 @@ static void sfp_sm_probe_phy(struct sfp + phy_device_remove(phy); + phy_device_free(phy); + dev_err(sfp->dev, "sfp_add_phy failed: %d\n", err); +- return; ++ return err; + } + + sfp->mod_phy = phy; + phy_start(phy); ++ ++ return 0; + } + + static void sfp_sm_link_up(struct sfp *sfp) +@@ -560,14 +562,9 @@ static void sfp_sm_fault(struct sfp *sfp + + static void sfp_sm_mod_init(struct sfp *sfp) + { +- sfp_module_tx_enable(sfp); ++ int ret = 0; + +- /* Wait t_init before indicating that the link is up, provided the +- * current state indicates no TX_FAULT. If TX_FAULT clears before +- * this time, that's fine too. +- */ +- sfp_sm_next(sfp, SFP_S_INIT, T_INIT_JIFFIES); +- sfp->sm_retries = 5; ++ sfp_module_tx_enable(sfp); + + /* Setting the serdes link mode is guesswork: there's no + * field in the EEPROM which indicates what mode should +@@ -581,7 +578,22 @@ static void sfp_sm_mod_init(struct sfp * + if (sfp->id.base.e1000_base_t || + sfp->id.base.e100_base_lx || + sfp->id.base.e100_base_fx) +- sfp_sm_probe_phy(sfp); ++ ret = sfp_sm_probe_phy(sfp); ++ ++ if (!ret) { ++ /* Wait t_init before indicating that the link is up, provided ++ * the current state indicates no TX_FAULT. If TX_FAULT clears ++ * this time, that's fine too. ++ */ ++ sfp_sm_next(sfp, SFP_S_INIT, T_INIT_JIFFIES); ++ sfp->sm_retries = 5; ++ return; ++ } ++ ++ if (ret == -EAGAIN) ++ sfp_sm_set_timer(sfp, T_PROBE_RETRY); ++ else ++ sfp_sm_next(sfp, SFP_S_TX_DISABLE, 0); + } + + static int sfp_sm_mod_probe(struct sfp *sfp) diff --git a/patch/kernel/mvebu-next/805-clk_mvebu_update_cpu_clock_frequency.patch b/patch/kernel/mvebu-next/805-clk_mvebu_update_cpu_clock_frequency.patch deleted file mode 100644 index 00d52bbdf..000000000 --- a/patch/kernel/mvebu-next/805-clk_mvebu_update_cpu_clock_frequency.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff --git a/drivers/clk/mvebu/armada-38x.c b/drivers/clk/mvebu/armada-38x.c -index 394aa6f0..3a5910b3 100644 ---- a/drivers/clk/mvebu/armada-38x.c -+++ b/drivers/clk/mvebu/armada-38x.c -@@ -47,10 +47,11 @@ static u32 __init armada_38x_get_tclk_freq(void __iomem *sar) - - static const u32 armada_38x_cpu_frequencies[] __initconst = { - 0, 0, 0, 0, -- 1066 * 1000 * 1000, 0, 0, 0, -+ 666 * 1000 * 1000, 0, 800 * 1000 * 1000, 0, -+ 1066 * 1000 * 1000, 0, 1200 * 1000 * 1000, 0, - 1332 * 1000 * 1000, 0, 0, 0, - 1600 * 1000 * 1000, 0, 0, 0, -- 1866 * 1000 * 1000, -+ 1866 * 1000 * 1000, 0, 0, 2000 * 1000 * 1000, - }; - - static u32 __init armada_38x_get_cpu_freq(void __iomem *sar) diff --git a/patch/kernel/mvebu-next/0001-realtek-wifi-881xAU-605ecfa.patch b/patch/kernel/mvebu-next/wifi-0001-realtek-wifi-881xAU-605ecfa.patch similarity index 100% rename from patch/kernel/mvebu-next/0001-realtek-wifi-881xAU-605ecfa.patch rename to patch/kernel/mvebu-next/wifi-0001-realtek-wifi-881xAU-605ecfa.patch diff --git a/patch/kernel/mvebu-next/0002-realtek-wifi-881xAU-adding-kernel-4.14.patch b/patch/kernel/mvebu-next/wifi-0002-realtek-wifi-881xAU-adding-kernel-4.14.patch similarity index 100% rename from patch/kernel/mvebu-next/0002-realtek-wifi-881xAU-adding-kernel-4.14.patch rename to patch/kernel/mvebu-next/wifi-0002-realtek-wifi-881xAU-adding-kernel-4.14.patch diff --git a/patch/kernel/mvebu-next/0003-realtek-wifi-881xAU-enable-8814au.patch b/patch/kernel/mvebu-next/wifi-0003-realtek-wifi-881xAU-enable-8814au.patch similarity index 100% rename from patch/kernel/mvebu-next/0003-realtek-wifi-881xAU-enable-8814au.patch rename to patch/kernel/mvebu-next/wifi-0003-realtek-wifi-881xAU-enable-8814au.patch diff --git a/patch/kernel/mvebu-next/wifi-0005-realtek-wifi-881xAU-update-to-5a5d0f.patch b/patch/kernel/mvebu-next/wifi-0005-realtek-wifi-881xAU-update-to-5a5d0f.patch new file mode 100644 index 000000000..908f3c45d --- /dev/null +++ b/patch/kernel/mvebu-next/wifi-0005-realtek-wifi-881xAU-update-to-5a5d0f.patch @@ -0,0 +1,4586 @@ +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_mlme_ext.c b/drivers/net/wireless/rtl8812au/core/rtw_mlme_ext.c +index cc65410..050bfa3 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_mlme_ext.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_mlme_ext.c +@@ -1420,10 +1420,11 @@ void mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame) + #ifdef CONFIG_AP_MODE + switch (GetFrameSubType(pframe)) { + case WIFI_AUTH: +- if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ++ if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) { + ptable->func = &OnAuth; +- else ++ } else + ptable->func = &OnAuthClient; ++ /* Intentional fallthrough */ + /* pass through */ + case WIFI_ASSOCREQ: + case WIFI_REASSOCREQ: +@@ -2201,14 +2202,15 @@ unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame) + if (rtw_is_list_empty(&pstat->asoc_list) == _FALSE) { + rtw_list_delete(&pstat->asoc_list); + pstapriv->asoc_list_cnt--; +- if (pstat->expire_to > 0) ++ if (pstat->expire_to > 0) { + ;/* TODO: STA re_auth within expire_to */ ++ } + } + _exit_critical_bh(&pstapriv->asoc_list_lock, &irqL); + +- if (seq == 1) ++ if (seq == 1) { + ; /* TODO: STA re_auth and auth timeout */ +- ++ } + } + } + +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_pwrctrl.c b/drivers/net/wireless/rtl8812au/core/rtw_pwrctrl.c +index d8b45f4..0a596db 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_pwrctrl.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_pwrctrl.c +@@ -219,6 +219,7 @@ bool rtw_pwr_unassociated_idle(_adapter *adapter) + || check_fwstate(pmlmepriv, WIFI_UNDER_LINKING | WIFI_UNDER_WPS) + || check_fwstate(pmlmepriv, WIFI_AP_STATE) + || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE) ++ || check_fwstate(pmlmepriv, WIFI_MONITOR_STATE) + #if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) + || pcfg80211_wdinfo->is_ro_ch + #elif defined(CONFIG_P2P) +@@ -618,6 +619,7 @@ u8 PS_RDY_CHECK(_adapter *padapter) + || check_fwstate(pmlmepriv, WIFI_UNDER_LINKING | WIFI_UNDER_WPS) + || check_fwstate(pmlmepriv, WIFI_AP_STATE) + || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE) ++ || check_fwstate(pmlmepriv, WIFI_MONITOR_STATE) + #if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) + || pcfg80211_wdinfo->is_ro_ch + #endif +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_recv.c b/drivers/net/wireless/rtl8812au/core/rtw_recv.c +index 83ed24e..8bb59ee 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_recv.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_recv.c +@@ -2125,7 +2125,7 @@ sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame) + if ((bDumpRxPkt == 4) && (eth_type == 0x888e)) + dump_rx_packet(ptr); + #endif +- } else ++ } else { + DBG_COUNTER(adapter->rx_logs.core_rx_pre_data_handled); + break; + default: +@@ -2136,6 +2136,7 @@ sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame) + retval = _FAIL; + break; + } ++} + + exit: + +@@ -3607,8 +3608,15 @@ static sint fill_radiotap_hdr(_adapter *padapter, union recv_frame *precvframe) + if (pattrib->mfrag) + hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FRAG; + +- /* always append FCS */ +- /* hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FCS; */ ++#ifdef CONFIG_RX_PACKET_APPEND_FCS ++ // Start by always indicating FCS is there: ++ hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FCS; ++ ++ // Next, test for prior conditions that will remove FCS, and update flag accordingly: ++ if(check_fwstate(&padapter->mlmepriv,WIFI_MONITOR_STATE) == _FALSE) ++ if((pattrib->pkt_rpt_type == NORMAL_RX) && (pHalData->ReceiveConfig & RCR_APPFCS)) ++ hdr_buf[rt_len] &= ~IEEE80211_RADIOTAP_F_FCS; ++#endif + + if (0) + hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_DATAPAD; +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_wlan_util.c b/drivers/net/wireless/rtl8812au/core/rtw_wlan_util.c +index 54c9a35..6de4e2e 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_wlan_util.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_wlan_util.c +@@ -2353,8 +2353,7 @@ int rtw_get_bcn_keys(ADAPTER *Adapter, u8 *pframe, u32 packet_len, + + _rtw_memcpy(recv_beacon->ssid, elems.ssid, elems.ssid_len); + recv_beacon->ssid_len = elems.ssid_len; +- } else +- ; /* means hidden ssid */ ++ } else { ; } /* means hidden ssid */ + + /* checking RSN first */ + if (elems.rsn_ie && elems.rsn_ie_len) { +diff --git a/drivers/net/wireless/rtl8812au/core/rtw_xmit.c b/drivers/net/wireless/rtl8812au/core/rtw_xmit.c +index 1620473..c1019bb 100644 +--- a/drivers/net/wireless/rtl8812au/core/rtw_xmit.c ++++ b/drivers/net/wireless/rtl8812au/core/rtw_xmit.c +@@ -1254,10 +1254,11 @@ static s32 update_attrib(_adapter *padapter, _pkt *pkt, struct pkt_attrib *pattr + _rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); + _rtw_memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN); + DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_ap); +- } else ++ } else { + DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_unknown); + + bmcast = IS_MCAST(pattrib->ra); ++ } + if (bmcast) { + psta = rtw_get_bcmc_stainfo(padapter); + if (psta == NULL) { /* if we cannot get psta => drop the pkt */ +@@ -3874,7 +3875,7 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + u32 len = skb->len; + u8 category, action; + int type = -1; +- ++ + //RTW_INFO(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev)); + + if (skb) +@@ -3922,17 +3923,17 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + fixed_rate = 0; + fixed_rate += MGN_MCS0; + } +- if ((mcs_have & 4) && ++ if ((mcs_have & 4) && + (iterator.this_arg[1] & 4)) + sgi = 1; +- if ((mcs_have & 1) && ++ if ((mcs_have & 1) && + (iterator.this_arg[1] & 1)) + bwidth = 1; +- if ((mcs_have & 0x10) && ++ if ((mcs_have & 0x10) && + (iterator.this_arg[1] & 0x10)) + ldpc = 1; + if ((mcs_have & 0x20)) +- stbc = (iterator.this_arg[1] >> 5) & 3; ++ stbc = (iterator.this_arg[1] >> 5) & 3; + } + break; + +@@ -3994,9 +3995,9 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + pattrib->ldpc = ldpc; + pattrib->stbc = stbc; + pattrib->retry_ctrl = (txflags & 0x08)?_FALSE:_TRUE; +- pattrib->sw_seq = (txflags & 0x10)?_TRUE:_FALSE; ++ // pattrib->sw_seq = (txflags & 0x10)?_TRUE:_FALSE; // Adds support for pre-configured SeqNum via RadioTap ++ + +- + pwlanhdr = (struct rtw_ieee80211_hdr *)pframe; + + pmlmeext->mgnt_seq = GetSequence(pwlanhdr); +diff --git a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c +index 22f793c..b7ff6f6 100644 +--- a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c ++++ b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + #include + +@@ -25,7 +25,7 @@ + * MPCIE.TXT + ******************************************************************************/ + +-u1Byte Array_MP_8814A_MPCIE[] = { ++u1Byte Array_MP_8814A_MPCIE[] = { + 0xFF, + 0xFF, + 0xFF, +diff --git a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h +index 8b51c1b..9b4d7c5 100644 +--- a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h ++++ b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + + +diff --git a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c +index cd80e92..d882d92 100644 +--- a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c ++++ b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + #include + +@@ -25,7 +25,7 @@ + * MUSB.TXT + ******************************************************************************/ + +-u1Byte Array_MP_8814A_MUSB[] = { ++u1Byte Array_MP_8814A_MUSB[] = { + 0xFF, + 0xFF, + 0xFF, +diff --git a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h +index 4262400..be33e37 100644 +--- a/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h ++++ b/drivers/net/wireless/rtl8812au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + + +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8812a/usb/rtl8812au_xmit.c b/drivers/net/wireless/rtl8812au/hal/rtl8812a/usb/rtl8812au_xmit.c +index 68ee167..bc5f941 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8812a/usb/rtl8812au_xmit.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8812a/usb/rtl8812au_xmit.c +@@ -112,7 +112,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz , u8 ba + + /* offset 12 */ + +- if (!pattrib->qos_en && pattrib->sw_seq == _FALSE) { ++ if (!pattrib->qos_en) { + SET_TX_DESC_HWSEQ_EN_8812(ptxdesc, 1); /* Hw set sequence number */ + } else + SET_TX_DESC_SEQ_8812(ptxdesc, pattrib->seqnum); +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_phycfg.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_phycfg.c +index 423ba9f..f0a247a 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_phycfg.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_phycfg.c +@@ -554,7 +554,6 @@ PHY_ConfigBB_8814A( + } + + +- + //2 3.3 RF Config + + s32 +@@ -1157,7 +1156,7 @@ PHY_GetTxPowerIndex_8814A( + tpt_offset = PHY_GetTxPowerTrackingOffset(pAdapter, RFPath, Rate); + + powerDiffByRate = powerDiffByRate > limit ? limit : powerDiffByRate; +- /*RTW_INFO("Rate-0x%x: (TxPower, PowerDiffByRate Path-%c) = (0x%X, %d)\n", Rate, ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), txPower, powerDiffByRate);*/ ++ RTW_INFO("Rate-0x%x: (TxPower, PowerDiffByRate Path-%c) = (0x%X, %d)\n", Rate, ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), txPower, powerDiffByRate); + + txPower += powerDiffByRate; + +@@ -1184,8 +1183,8 @@ PHY_GetTxPowerIndex_8814A( + //(pHalData->bautoload_fail_flag || pHalData->EfuseMap[EFUSE_INIT_MAP][EEPROM_TX_PWR_INX_JAGUAR] == 0xFF)) + //txPower = 0x12; + +- /*RTW_INFO("Final Tx Power(RF-%c, Channel: %d) = %d(0x%X)\n", ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), Channel, +- txPower, txPower);*/ ++ RTW_INFO("Final Tx Power(RF-%c, Channel: %d) = %d(0x%X)\n", ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), Channel, ++ txPower, txPower); + + return (u8) txPower; + } +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_sreset.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_sreset.c +index 4a7947e..b9e83fd 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_sreset.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_sreset.c +@@ -93,7 +93,7 @@ void rtl8814_sreset_linked_status_check(_adapter *padapter) + regc58 = rtw_read32(padapter,0xc58); + reg824 = rtw_read32(padapter,0x824); + reg800 = rtw_read32(padapter,0x800); +- if( ((regc50&0xFFFFFF00)!= 0x69543400)|| ++ if ( ((regc50&0xFFFFFF00)!= 0x69543400)|| + ((regc58&0xFFFFFF00)!= 0x69543400)|| + (((reg824&0xFFFFFF00)!= 0x00390000)&&(((reg824&0xFFFFFF00)!= 0x80390000)))|| + ( ((reg800&0xFFFFFF00)!= 0x03040000)&&((reg800&0xFFFFFF00)!= 0x83040000))) +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_xmit.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_xmit.c +index 43b8268..bb6cdd8 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_xmit.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/rtl8814a_xmit.c +@@ -172,7 +172,6 @@ InsertEMContent_8814( + } + + +- + void UpdateEarlyModeInfo8814(struct xmit_priv *pxmitpriv,struct xmit_buf *pxmitbuf ) + { + //_adapter *padapter, struct xmit_frame *pxmitframe,struct tx_servq *ptxservq +@@ -254,7 +253,6 @@ void rtl8814a_cal_txdesc_chksum(u8 *ptxdesc) + u32 index; + u16 checksum = 0; + +- + usPtr = (u16*)ptxdesc; + // checksume is always calculated by first 32 bytes, + // and it doesn't depend on TX DESC length. +@@ -439,7 +437,7 @@ BWMapping_8814( + else + BWSettingOfDesc = 0; + } +- else if(pHalData->CurrentChannelBW== CHANNEL_WIDTH_40) { ++ else if (pHalData->CurrentChannelBW== CHANNEL_WIDTH_40) { + if ((pattrib->bwmode == CHANNEL_WIDTH_40) || (pattrib->bwmode == CHANNEL_WIDTH_80)) + BWSettingOfDesc = 1; + else +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/rtl8814au_xmit.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/rtl8814au_xmit.c +index 8200263..0f4d3e1 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/rtl8814au_xmit.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/rtl8814au_xmit.c +@@ -61,7 +61,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + + #ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX + if (padapter->registrypriv.mp_mode == 0) { +- if((PACKET_OFFSET_SZ != 0) && (!bagg_pkt) &&(rtw_usb_bulk_size_boundary(padapter,TXDESC_SIZE+sz)==_FALSE)) { ++ if ((PACKET_OFFSET_SZ != 0) && (!bagg_pkt) &&(rtw_usb_bulk_size_boundary(padapter,TXDESC_SIZE+sz)==_FALSE)) { + ptxdesc = (pmem+PACKET_OFFSET_SZ); + //RTW_INFO("==> non-agg-pkt,shift pointer...\n"); + pull = 1; +@@ -94,10 +94,9 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + } + + #ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX +- if (padapter->registrypriv.mp_mode == 0) +- { +- if((PACKET_OFFSET_SZ != 0) && (!bagg_pkt)){ +- if((pull) && (pxmitframe->pkt_offset>0)) { ++ if (padapter->registrypriv.mp_mode == 0) { ++ if ((PACKET_OFFSET_SZ != 0) && (!bagg_pkt)) { ++ if ((pull) && (pxmitframe->pkt_offset>0)) { + pxmitframe->pkt_offset = pxmitframe->pkt_offset -1; + } + } +@@ -119,10 +118,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + + if (!pattrib->qos_en) { + /* HW sequence, to fix to use 0 queue. todo: 4AC packets to use auto queue select */ +- if (pattrib->sw_seq == _FALSE) +- SET_TX_DESC_HWSEQ_EN_8814A(ptxdesc, 1); // Hw set sequence number +- else +- SET_TX_DESC_SEQ_8814A(ptxdesc, pattrib->seqnum); ++ SET_TX_DESC_HWSEQ_EN_8814A(ptxdesc, 1); // Hw set sequence number + SET_TX_DESC_EN_HWEXSEQ_8814A(ptxdesc, 0); + SET_TX_DESC_DISQSELSEQ_8814A(ptxdesc, 1); + SET_TX_DESC_HW_SSN_SEL_8814A(ptxdesc, 0); +@@ -130,8 +126,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + SET_TX_DESC_SEQ_8814A(ptxdesc, pattrib->seqnum); + } + +- if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) +- { ++ if ((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) { + //RTW_INFO("pxmitframe->frame_tag == DATA_FRAMETAG\n"); + + rtl8814a_fill_txdesc_sectype(pattrib, ptxdesc); +@@ -189,7 +184,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + if (padapter->fix_rate != 0xFF) { // modify data rate by iwpriv + SET_TX_DESC_USE_RATE_8814A(ptxdesc, 1); + DriverFixedRate = 0x01; +- if(padapter->fix_rate & BIT(7)) ++ if (padapter->fix_rate & BIT(7)) + SET_TX_DESC_DATA_SHORT_8814A(ptxdesc, 1); + + SET_TX_DESC_TX_RATE_8814A(ptxdesc, (padapter->fix_rate & 0x7F)); +@@ -202,7 +197,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + if (pattrib->stbc) + SET_TX_DESC_DATA_STBC_8814A(ptxdesc, 1); + +- //work arond before fixing RA ++ //work around before fixing RA + //SET_TX_DESC_USE_RATE_8814A(ptxdesc, 1); + //SET_TX_DESC_TX_RATE_8814A(ptxdesc, 0x10); + } else { +@@ -253,7 +248,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + SET_TX_DESC_DATA_RETRY_LIMIT_8814A(ptxdesc, 5); + SET_TX_DESC_DISABLE_FB_8814A(ptxdesc, 1); + +- //if(pattrib->rts_cca) ++ //if (pattrib->rts_cca) + //{ + // SET_TX_DESC_NDPA_8812(ptxdesc, 2); + //} +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_halinit.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_halinit.c +index b134d5a..e9a5c68 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_halinit.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_halinit.c +@@ -1,7 +1,7 @@ + /****************************************************************************** + * + * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +- * ++ * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. +@@ -33,8 +33,7 @@ static void _dbg_dump_macreg(_adapter *padapter) + u32 offset = 0; + u32 val32 = 0; + u32 index =0 ; +- for(index=0;index<64;index++) +- { ++ for (index=0;index<64;index++) { + offset = index*4; + val32 = rtw_read32(padapter,offset); + RTW_INFO("offset : 0x%02x ,val:0x%08x\n",offset,val32); +@@ -52,11 +51,11 @@ _ConfigChipOutEP_8814( + pHalData->OutEpQueueSel = 0; + pHalData->OutEpNumber = 0; + +- switch(NumOutPipe){ ++ switch (NumOutPipe) { + case 4: + pHalData->OutEpQueueSel=TX_SELE_HQ| TX_SELE_LQ|TX_SELE_NQ; + pHalData->OutEpNumber=4; +- break; ++ break; + case 3: + pHalData->OutEpQueueSel=TX_SELE_HQ| TX_SELE_LQ|TX_SELE_NQ; + pHalData->OutEpNumber=3; +@@ -69,9 +68,9 @@ _ConfigChipOutEP_8814( + pHalData->OutEpQueueSel=TX_SELE_HQ; + pHalData->OutEpNumber=1; + break; +- default: ++ default: + break; +- ++ + } + RTW_INFO("%s OutEpQueueSel(0x%02x), OutEpNumber(%d) \n",__FUNCTION__,pHalData->OutEpQueueSel,pHalData->OutEpNumber ); + +@@ -87,10 +86,10 @@ static BOOLEAN HalUsbSetQueuePipeMapping8814AUsb( + BOOLEAN result = _FALSE; + + _ConfigChipOutEP_8814(pAdapter, NumOutPipe); +- ++ + // Normal chip with one IN and one OUT doesn't have interrupt IN EP. +- if(1 == pHalData->OutEpNumber){ +- if(1 != NumInPipe){ ++ if (1 == pHalData->OutEpNumber) { ++ if (1 != NumInPipe) { + return result; + } + } +@@ -101,7 +100,7 @@ static BOOLEAN HalUsbSetQueuePipeMapping8814AUsb( + //} + + result = Hal_MappingOutPipe(pAdapter, NumOutPipe); +- ++ + return result; + + } +@@ -173,55 +172,45 @@ _InitBurstPktLen(IN PADAPTER Adapter) + { + u8 u1bTmp; + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + //yx_qi 131128 move to 0x1448, 144c + rtw_write32(Adapter, REG_FAST_EDCA_VOVI_SETTING_8814A, 0x08070807); //yx_qi 131128 + rtw_write32(Adapter, REG_FAST_EDCA_BEBK_SETTING_8814A, 0x08070807); //yx_qi 131128 +- ++ + u1bTmp = rtw_read8(Adapter, 0xff); //check device operation speed: SS 0xff bit7 +- +- if(u1bTmp & BIT7) //USB2/1.1 Mode +- { ++ ++ if (u1bTmp & BIT7) { //USB2/1.1 Mode + pHalData->bSupportUSB3 = FALSE; +- } +- else //USB3 Mode +- { ++ } else { //USB3 Mode + pHalData->bSupportUSB3 = TRUE; + } +- +- if(pHalData->bSupportUSB3 == _FALSE) //USB2/1.1 Mode +- { +- if(pHalData->UsbBulkOutSize == 512) +- { ++ ++ if (pHalData->bSupportUSB3 == _FALSE) { //USB2/1.1 Mode ++ if (pHalData->UsbBulkOutSize == 512) { + //set burst pkt len=512B + rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x1e); +- } +- else +- { ++ } else { + //set burst pkt len=64B +- rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x2e); ++ rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x2e); + } + + rtw_write16(Adapter, REG_RXDMA_AGG_PG_TH_8814A,0x2005); //dmc agg th 20K +- } +- else //USB3 Mode +- { ++ } else { //USB3 Mode + //set burst pkt len=1k +- rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x0e); ++ rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x0e); + rtw_write16(Adapter, REG_RXDMA_AGG_PG_TH_8814A,0x0a05); //dmc agg th 20K +- ++ + // set Reg 0xf008[3:4] to 2'00 to disable U1/U2 Mode to avoid 2.5G spur in USB3.0. added by page, 20120712 + rtw_write8(Adapter, 0xf008, rtw_read8(Adapter, 0xf008)&0xE7); + //to avoid usb 3.0 H2C fail + rtw_write16(Adapter, 0xf002, 0); +- ++ + rtw_write8(Adapter, REG_SW_AMPDU_BURST_MODE_CTRL_8814A, rtw_read8(Adapter, REG_SW_AMPDU_BURST_MODE_CTRL_8814A) & ~BIT(6)); + RTW_INFO("turn off the LDPC pre-TX\n"); +- +- } + +- if(pHalData->AMPDUBurstMode) +- { ++ } ++ ++ if (pHalData->AMPDUBurstMode) { + rtw_write8(Adapter,REG_SW_AMPDU_BURST_MODE_CTRL_8814A, 0x5F); + } + } +@@ -232,7 +221,7 @@ _InitQueueReservedPage_8814AUsb( + ) + { + struct registry_priv *pregistrypriv = &Adapter->registrypriv; +- u16 txpktbuf_bndy; ++ u16 txpktbuf_bndy; + + RTW_INFO("===>_InitQueueReservedPage_8814AUsb()\n"); + +@@ -246,7 +235,7 @@ _InitQueueReservedPage_8814AUsb( + + rtw_write32(Adapter, REG_RQPN_CTRL_2_8814A, 0x80000000); + +- if(!pregistrypriv->wifi_spec) ++ if (!pregistrypriv->wifi_spec) + txpktbuf_bndy = TX_PAGE_BOUNDARY_8814A; + else // for WMM + txpktbuf_bndy = WMM_NORMAL_TX_PAGE_BOUNDARY_8814A; +@@ -260,7 +249,7 @@ _InitQueueReservedPage_8814AUsb( + rtw_write16(Adapter,REG_FIFOPAGE_CTRL_2_8814A, txpktbuf_bndy); + //The head page of packet of Bcnq1 + rtw_write16(Adapter,REG_FIFOPAGE_CTRL_2_8814A+2,txpktbuf_bndy); +- ++ + RTW_INFO("<===_InitQueueReservedPage_8814AUsb()\n"); + } + +@@ -273,7 +262,7 @@ static u32 _InitPowerOn_8814AU(_adapter *padapter) + u8 u1btmp = rtw_read8(padapter, 0x10C2); + rtw_write8(padapter, 0x10C2, (u1btmp | BIT1)); + +- if(!HalPwrSeqCmdParsing(padapter, ~PWR_CUT_TESTCHIP_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK, Rtl8814A_NIC_ENABLE_FLOW)) ++ if (!HalPwrSeqCmdParsing(padapter, ~PWR_CUT_TESTCHIP_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK, Rtl8814A_NIC_ENABLE_FLOW)) + return _FAIL; + + // Enable MAC DMA/WMAC/SCHEDULE/SEC block +@@ -320,9 +309,9 @@ _InitPageBoundary_8814AUsb( + { + //20130416 KaiYuan modified for 8814 + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + rtw_write16(Adapter, REG_RXFF_PTR_8814A, RX_DMA_BOUNDARY_8814A); //yx_qi 20140331 +- ++ + } + + static VOID +@@ -353,11 +342,11 @@ _InitNormalChipTwoOutEpPriority_8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct registry_priv *pregistrypriv = &Adapter->registrypriv; + u16 beQ,bkQ,viQ,voQ,mgtQ,hiQ; +- ++ + u16 valueHi = 0; + u16 valueLow = 0; +- +- switch(pHalData->OutEpQueueSel) ++ ++ switch (pHalData->OutEpQueueSel) + { + case (TX_SELE_HQ | TX_SELE_LQ): + valueHi = QUEUE_HIGH; +@@ -373,27 +362,27 @@ _InitNormalChipTwoOutEpPriority_8814AUsb( + break; + default: + valueHi = QUEUE_HIGH; +- valueLow = QUEUE_NORMAL; ++ valueLow = QUEUE_NORMAL; + break; + } + +- if(!pregistrypriv->wifi_spec){ ++ if (!pregistrypriv->wifi_spec) { + beQ = valueLow; + bkQ = valueLow; + viQ = valueHi; + voQ = valueHi; +- mgtQ = valueHi; +- hiQ = valueHi; ++ mgtQ = valueHi; ++ hiQ = valueHi; + } +- else{//for WMM ,CONFIG_OUT_EP_WIFI_MODE ++ else { //for WMM ,CONFIG_OUT_EP_WIFI_MODE + beQ = valueLow; + bkQ = valueHi; + viQ = valueHi; + voQ = valueLow; + mgtQ = valueHi; +- hiQ = valueHi; ++ hiQ = valueHi; + } +- ++ + _InitNormalChipRegPriority_8814AUsb(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ); + } + +@@ -405,21 +394,20 @@ _InitNormalChipThreeOutEpPriority_8814AUsb( + struct registry_priv *pregistrypriv = &Adapter->registrypriv; + u16 beQ,bkQ,viQ,voQ,mgtQ,hiQ; + +- if(!pregistrypriv->wifi_spec){// typical setting ++ if (!pregistrypriv->wifi_spec) { // typical setting + beQ = QUEUE_LOW; + bkQ = QUEUE_LOW; + viQ = QUEUE_NORMAL; + voQ = QUEUE_HIGH; + mgtQ = QUEUE_HIGH; +- hiQ = QUEUE_HIGH; +- } +- else{// for WMM ++ hiQ = QUEUE_HIGH; ++ } else { // for WMM + beQ = QUEUE_LOW; + bkQ = QUEUE_NORMAL; + viQ = QUEUE_NORMAL; + voQ = QUEUE_HIGH; + mgtQ = QUEUE_HIGH; +- hiQ = QUEUE_HIGH; ++ hiQ = QUEUE_HIGH; + } + _InitNormalChipRegPriority_8814AUsb(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ); + } +@@ -431,7 +419,7 @@ _InitQueuePriority_8814AUsb( + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- switch(pHalData->OutEpNumber) ++ switch (pHalData->OutEpNumber) + { + case 2: + _InitNormalChipTwoOutEpPriority_8814AUsb(Adapter); +@@ -499,8 +487,8 @@ _InitWMACSetting_8814A( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + + //pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | APP_FCS | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS; +- pHalData->ReceiveConfig = +- RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; ++ pHalData->ReceiveConfig = ++ RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; + + #if (1 == RTL8812A_RX_PACKET_INCLUDE_CRC) + pHalData->ReceiveConfig |= ACRC32; +@@ -539,7 +527,7 @@ _InitWMACSetting_8814A( + //rtw_write16(Adapter, REG_RXFLTMAP0, value16); + + //enable RX_SHIFT bits +- //rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1)); ++ //rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1)); + + } + */ +@@ -553,21 +541,21 @@ _InitMacConfigure_8814A( + u16 value16; + u32 regRRSR; + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + switch (Adapter->registrypriv.wireless_mode) + { + case WIRELESS_11B: + regRRSR = RATE_ALL_CCK; + break; +- ++ + case WIRELESS_11G: + case WIRELESS_11A: + case WIRELESS_11_5N: +- case WIRELESS_11A_5N://Todo: no basic rate for ofdm ? ++ case WIRELESS_11A_5N: //Todo: no basic rate for ofdm ? + case WIRELESS_11_5AC: + regRRSR = RATE_ALL_OFDM_AG; + break; +- ++ + case WIRELESS_11BG: + case WIRELESS_11G_24N: + case WIRELESS_11_24N: +@@ -575,7 +563,7 @@ _InitMacConfigure_8814A( + default: + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + break; +- ++ + } + + // Init value for RRSR. +@@ -584,7 +572,7 @@ _InitMacConfigure_8814A( + // Retry Limit + value16 = _LRL(0x30) | _SRL(0x30); + rtw_write16(Adapter, REG_RETRY_LIMIT_8814A, value16); +- ++ + pHalData->ReceiveConfig = RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; + pHalData->ReceiveConfig |= FORCEACK; + #if (1 == RTL8812A_RX_PACKET_INCLUDE_CRC) +@@ -608,8 +596,8 @@ _InitMacConfigure_8814A( + + // 201409/25 MH When RA is enabled, we need to reduce the value. + rtw_write8(Adapter, REG_MAX_AGGR_NUM_8814A, 0x36); +- rtw_write8(Adapter, REG_RTS_MAX_AGGR_NUM_8814A,0x36); +- ++ rtw_write8(Adapter, REG_RTS_MAX_AGGR_NUM_8814A,0x36); ++ + } + + /* +@@ -643,7 +631,7 @@ _InitAdaptiveCtrl_8812AUsb( + // Retry Limit + value16 = _LRL(0x30) | _SRL(0x30); + rtw_write16(Adapter, REG_RL, value16); +- ++ + }*/ + + static VOID +@@ -656,7 +644,7 @@ _InitEDCA_8814AUsb( + rtw_write16(Adapter,REG_MAC_SPEC_SIFS, 0x100a); + + // Set SIFS for CCK +- rtw_write16(Adapter,REG_SIFS_CTX, 0x100a); ++ rtw_write16(Adapter,REG_SIFS_CTX, 0x100a); + + // Set SIFS for OFDM + rtw_write16(Adapter,REG_SIFS_TRX, 0x100a); +@@ -679,9 +667,9 @@ _InitBeaconMaxError_8814A( + ) + { + #ifdef CONFIG_ADHOC_WORKAROUND_SETTING +- rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF); ++ rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF); + #else +- //rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10)); ++ //rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10)); + #endif + } + +@@ -689,12 +677,12 @@ _InitBeaconMaxError_8814A( + static void _InitHWLed(PADAPTER Adapter) + { + struct led_priv *pledpriv = &(Adapter->ledpriv); +- +- if( pledpriv->LedStrategy != HW_LED) ++ ++ if ( pledpriv->LedStrategy != HW_LED) + return; +- ++ + // HW led control +-// to do .... ++// to do .... + //must consider cases of antenna diversity/ commbo card/solo card/mini card + + } +@@ -717,7 +705,7 @@ _InitRetryFunction_8814A( + ) + { + u8 value8; +- ++ + value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL); + value8 |= EN_AMPDU_RTY_NEW; + rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8); +@@ -730,7 +718,7 @@ _InitRetryFunction_8814A( + /*----------------------------------------------------------------------------- + * Function: usb_AggSettingTxUpdate() + * +- * Overview: Seperate TX/RX parameters update independent for TP detection and ++ * Overview: Seperate TX/RX parameters update independent for TP detection and + * dynamic TX/RX aggreagtion parameters update. + * + * Input: PADAPTER +@@ -751,25 +739,25 @@ usb_AggSettingTxUpdate_8814A( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u32 value32; + +- if(Adapter->registrypriv.wifi_spec) ++ if (Adapter->registrypriv.wifi_spec) + pHalData->UsbTxAggDescNum = 1; + +- if(pHalData->UsbTxAggMode){ ++ if (pHalData->UsbTxAggMode){ + value32 = rtw_read32(Adapter, REG_TDECTRL); + value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT); + value32 |= ((pHalData->UsbTxAggDescNum & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT); +- ++ + rtw_write32(Adapter, REG_TDECTRL, value32); + rtw_write8(Adapter, REG_TDECTRL+3, pHalData->UsbTxAggDescNum<<1); + } +- ++ + #endif //CONFIG_USB_TX_AGGREGATION + } // usb_AggSettingTxUpdate + + /*----------------------------------------------------------------------------- + * Function: usb_AggSettingRxUpdate() + * +- * Overview: Seperate TX/RX parameters update independent for TP detection and ++ * Overview: Seperate TX/RX parameters update independent for TP detection and + * dynamic TX/RX aggreagtion parameters update. + * + * Input: PADAPTER +@@ -793,7 +781,7 @@ usb_AggSettingRxUpdate_8814A( + + valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL_8814A); + valueUSB = rtw_read8(Adapter, REG_RXDMA_AGG_PG_TH_8814A+3); +- switch(pHalData->rxagg_mode) ++ switch (pHalData->rxagg_mode) + { + case RX_AGG_DMA: + valueDMA |= RXDMA_AGG_EN; +@@ -853,7 +841,7 @@ init_UsbAggregationSetting_8814A( + * + * Revised History: + * When Who Remark +- * 12/10/2010 MHC Create Version 0. ++ * 12/10/2010 MHC Create Version 0. + * + *---------------------------------------------------------------------------*/ + VOID +@@ -866,37 +854,33 @@ USB_AggModeSwitch( + PMGNT_INFO pMgntInfo = &(Adapter->MgntInfo); + + //pHalData->UsbRxHighSpeedMode = _FALSE; +- // How to measure the RX speed? We assume that when traffic is more than ++ // How to measure the RX speed? We assume that when traffic is more than + if (pMgntInfo->bRegAggDMEnable == _FALSE) + { + return; // Inf not support. + } +- +- if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _TRUE && ++ ++ if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _TRUE && + pHalData->UsbRxHighSpeedMode == _FALSE) + { + pHalData->UsbRxHighSpeedMode = _TRUE; + RT_TRACE(COMP_INIT, DBG_LOUD, ("UsbAggModeSwitchCheck to HIGH\n")); + } +- else if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _FALSE && ++ else if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _FALSE && + pHalData->UsbRxHighSpeedMode == _TRUE) + { + pHalData->UsbRxHighSpeedMode = _FALSE; + RT_TRACE(COMP_INIT, DBG_LOUD, ("UsbAggModeSwitchCheck to LOW\n")); ++ } else { ++ return; + } +- else +- { +- return; +- } +- ++ + #if USB_RX_AGGREGATION_92C +- if (pHalData->UsbRxHighSpeedMode == _TRUE) +- { ++ if (pHalData->UsbRxHighSpeedMode == _TRUE) { + // 2010/12/10 MH The parameter is tested by SD1 engineer and SD3 channel emulator. + // USB mode + #if (RT_PLATFORM == PLATFORM_LINUX) +- if (pMgntInfo->LinkDetectInfo.bTxBusyTraffic) +- { ++ if (pMgntInfo->LinkDetectInfo.bTxBusyTraffic) { + pHalData->RxAggBlockCount = 16; + pHalData->RxAggBlockTimeout = 7; + } +@@ -908,23 +892,20 @@ USB_AggModeSwitch( + } + // Mix mode + pHalData->RxAggPageCount = 72; +- pHalData->RxAggPageTimeout = 6; +- } +- else +- { ++ pHalData->RxAggPageTimeout = 6; ++ } else { + // USB mode + pHalData->RxAggBlockCount = pMgntInfo->RegRxAggBlockCount; +- pHalData->RxAggBlockTimeout = pMgntInfo->RegRxAggBlockTimeout; ++ pHalData->RxAggBlockTimeout = pMgntInfo->RegRxAggBlockTimeout; + // Mix mode + pHalData->RxAggPageCount = pMgntInfo->RegRxAggPageCount; +- pHalData->RxAggPageTimeout = pMgntInfo->RegRxAggPageTimeout; ++ pHalData->RxAggPageTimeout = pMgntInfo->RegRxAggPageTimeout; + } + + if (pHalData->RxAggBlockCount > MAX_RX_AGG_BLKCNT) + pHalData->RxAggBlockCount = MAX_RX_AGG_BLKCNT; + #if (OS_WIN_FROM_VISTA(OS_VERSION)) || (RT_PLATFORM == PLATFORM_LINUX) // do not support WINXP to prevent usbehci.sys BSOD +- if (IS_WIRELESS_MODE_N_24G(Adapter) || IS_WIRELESS_MODE_N_5G(Adapter)) +- { ++ if (IS_WIRELESS_MODE_N_24G(Adapter) || IS_WIRELESS_MODE_N_5G(Adapter)) { + // + // 2010/12/24 MH According to V1012 QC IOT test, XP BSOD happen when running chariot test + // with the aggregation dynamic change!! We need to disable the function to prevent it is broken +@@ -933,12 +914,12 @@ USB_AggModeSwitch( + usb_AggSettingRxUpdate_8188E(Adapter); + + // 2010/12/27 MH According to designer's suggstion, we can only modify Timeout value. Otheriwse +- // there might many HW incorrect behavior, the XP BSOD at usbehci.sys may be relative to the ++ // there might many HW incorrect behavior, the XP BSOD at usbehci.sys may be relative to the + // issue. Base on the newest test, we can not enable block cnt > 30, otherwise XP usbehci.sys may + // BSOD. + } + #endif +- ++ + #endif + #endif + } // USB_AggModeSwitch +@@ -957,7 +938,7 @@ _InitOperationMode_8814A( + // + // Set RRSR, RATR, and REG_BWOPMODE registers + // +- switch(Adapter->RegWirelessMode) ++ switch (Adapter->RegWirelessMode) + { + case WIRELESS_MODE_B: + regBwOpMode = BW_OPMODE_20MHZ; +@@ -975,14 +956,11 @@ _InitOperationMode_8814A( + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + break; + case WIRELESS_MODE_AUTO: +- if (Adapter->bInHctTest) +- { ++ if (Adapter->bInHctTest) { + regBwOpMode = BW_OPMODE_20MHZ; + regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; +- } +- else +- { ++ } else { + regBwOpMode = BW_OPMODE_20MHZ; + regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS; + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; +@@ -1000,7 +978,7 @@ _InitOperationMode_8814A( + regRATR = RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS; + regRRSR = RATE_ALL_OFDM_AG; + break; +- ++ + default: //for MacOSX compiler warning. + break; + } +@@ -1039,20 +1017,19 @@ static VOID _RfPowerSave( + return; + #endif + +- if(pMgntInfo->RegRfOff == _TRUE){ // User disable RF via registry. ++ if (pMgntInfo->RegRfOff == _TRUE) { // User disable RF via registry. + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RegRfOff.\n")); + MgntActSet_RF_State(Adapter, eRfOff, RF_CHANGE_BY_SW); + // Those action will be discard in MgntActSet_RF_State because off the same state + for(eRFPath = 0; eRFPath NumTotalRFPath; eRFPath++) + PHY_SetRFReg(Adapter, eRFPath, 0x4, 0xC00, 0x0); + } +- else if(pMgntInfo->RfOffReason > RF_CHANGE_BY_PS){ // H/W or S/W RF OFF before sleep. ++ else if (pMgntInfo->RfOffReason > RF_CHANGE_BY_PS) { // H/W or S/W RF OFF before sleep. + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RfOffReason(%ld).\n", pMgntInfo->RfOffReason)); + MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason); +- } +- else{ ++ } else { + pHalData->eRFPowerState = eRfOn; +- pMgntInfo->RfOffReason = 0; ++ pMgntInfo->RfOffReason = 0; + if(Adapter->bInSetPower || Adapter->bResetInProgress) + PlatformUsbEnableInPipes(Adapter); + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): RF is on.\n")); +@@ -1062,7 +1039,7 @@ static VOID _RfPowerSave( + */ + enum { + Antenna_Lfet = 1, +- Antenna_Right = 2, ++ Antenna_Right = 2, + }; + + static VOID +@@ -1071,21 +1048,21 @@ _InitAntenna_Selection_8814A(IN PADAPTER Adapter) + + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- if(pHalData->AntDivCfg==0) ++ if (pHalData->AntDivCfg==0) + return; +-/* +- RTW_INFO("==> %s ....\n",__FUNCTION__); ++/* ++ RTW_INFO("==> %s ....\n",__FUNCTION__); + + rtw_write8(Adapter, REG_LEDCFG2, 0x82); + + PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT13, 0x01); +- ++ + if(PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == MAIN_ANT) + pHalData->CurAntenna = MAIN_ANT; + else + pHalData->CurAntenna = AUX_ANT; + RTW_INFO("%s,Cur_ant:(%x)%s\n",__FUNCTION__,pHalData->CurAntenna,(pHalData->CurAntenna == MAIN_ANT)?"MAIN_ANT":"AUX_ANT"); +- ++ + */ + } + +@@ -1104,28 +1081,24 @@ HalDetectSelectiveSuspendMode( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct dvobj_priv *pdvobjpriv = adapter_to_dvobj(Adapter); + +- // If support HW radio detect, we need to enable WOL ability, otherwise, we ++ // If support HW radio detect, we need to enable WOL ability, otherwise, we + // can not use FW to notify host the power state switch. +- ++ + EFUSE_ShadowRead(Adapter, 1, EEPROM_USB_OPTIONAL1, (u32 *)&tmpvalue); + + DBG_8192C("HalDetectSelectiveSuspendMode(): SS "); +- if(tmpvalue & BIT1) +- { ++ if (tmpvalue & BIT1) { + DBG_8192C("Enable\n"); +- } +- else +- { ++ } else { + DBG_8192C("Disable\n"); + pdvobjpriv->RegUsbSS = _FALSE; + } + + // 2010/09/01 MH According to Dongle Selective Suspend INF. We can switch SS mode. +- if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData)) +- { ++ if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData)) { + //PMGNT_INFO pMgntInfo = &(Adapter->MgntInfo); + +- //if (!pMgntInfo->bRegDongleSS) ++ //if (!pMgntInfo->bRegDongleSS) + //{ + // RT_TRACE(COMP_INIT, DBG_LOUD, ("Dongle disable SS\n")); + pdvobjpriv->RegUsbSS = _FALSE; +@@ -1156,12 +1129,11 @@ static void rtl8814au_hw_reset(_adapter *Adapter) + { + #if 0 + u8 reg_val=0; +- if(rtw_read8(Adapter, REG_MCUFWDL)&BIT7) +- { +- _8051Reset8812(Adapter); ++ if (rtw_read8(Adapter, REG_MCUFWDL)&BIT7) { ++ _8051Reset8812(Adapter); + rtw_write8(Adapter, REG_MCUFWDL, 0x00); + //before BB reset should do clock gated +- rtw_write32(Adapter, rFPGA0_XCD_RFPara, ++ rtw_write32(Adapter, rFPGA0_XCD_RFPara, + rtw_read32(Adapter, rFPGA0_XCD_RFPara)|(BIT6)); + //reset BB + reg_val = rtw_read8(Adapter, REG_SYS_FUNC_EN); +@@ -1172,16 +1144,16 @@ static void rtl8814au_hw_reset(_adapter *Adapter) + //reset TRX path + rtw_write16(Adapter, REG_CR, 0); + //reset MAC +- reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); ++ reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); + reg_val |= BIT(1); + reg_val = rtw_write8(Adapter, REG_APS_FSMCO+1, reg_val); //reg0x5[1] ,auto FSM off + + reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); +- ++ + //check if reg0x5[1] auto cleared +- while(reg_val & BIT(1)){ ++ while (reg_val & BIT(1)) { + rtw_udelay_os(1); +- reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); ++ reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); + } + reg_val |= BIT(0); + reg_val = rtw_write8(Adapter, REG_APS_FSMCO+1, reg_val); //reg0x5[0] ,auto FSM on +@@ -1272,7 +1244,7 @@ u32 rtl8814au_hal_init(PADAPTER Adapter) + int hal_init_profiling_i; + u32 hal_init_stages_timestamp[HAL_INIT_STAGES_NUM]; //used to record the time of each stage's starting point + +- for(hal_init_profiling_i=0;hal_init_profiling_ibkeepfwalive) +- { ++ if (pwrctrlpriv->bkeepfwalive) { + _ps_open_RF(Adapter); + +- if(pHalData->bIQKInitialized){ ++ if (pHalData->bIQKInitialized) { + //PHY_IQCalibrate_8812A(Adapter,_TRUE); +- } +- else +- { ++ } else { + //PHY_IQCalibrate_8812A(Adapter,_FALSE); + //pHalData->bIQKInitialized = _TRUE; + } +@@ -1301,16 +1270,13 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + } + + // Check if MAC has already power on. by tynli. 2011.05.27. +- value8 = rtw_read8(Adapter, REG_SYS_CLKR+1); ++ value8 = rtw_read8(Adapter, REG_SYS_CLKR+1); + u1bRegCR = rtw_read8(Adapter, REG_CR); + RTW_INFO(" power-on :REG_SYS_CLKR 0x09=0x%02x. REG_CR 0x100=0x%02x.\n", value8, u1bRegCR); +- if((value8&BIT3) && (u1bRegCR != 0 && u1bRegCR != 0xEA)) +- { ++ if ((value8&BIT3) && (u1bRegCR != 0 && u1bRegCR != 0xEA)) { + //pHalData->bMACFuncEnable = _TRUE; + RTW_INFO(" MAC has already power on.\n"); +- } +- else +- { ++ } else { + //pHalData->bMACFuncEnable = _FALSE; + // Set FwPSState to ALL_ON mode to prevent from the I/O be return because of 32k + // state which is set before sleep under wowlan mode. 2012.01.04. by tynli. +@@ -1332,7 +1298,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + }*/ + + /* +- If HW didn't go through a complete de-initial procedure, ++ If HW didn't go through a complete de-initial procedure, + it probably occurs some problem for double initial procedure. + Like "CONFIG_DEINIT_BEFORE_INIT" in 92du chip + */ +@@ -1340,15 +1306,15 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PW_ON); + status = _InitPowerOn_8814AU(Adapter); +- if(status == _FAIL){ ++ if (status == _FAIL) { + RTW_INFO("Failed to init power on!\n"); + goto exit; + } + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_LLTT); +- ++ + status = InitLLTTable8814A(Adapter); +- if(status == _FAIL){ ++ if (status == _FAIL) { + RTW_INFO("Failed to init LLT table\n"); + goto exit; + } +@@ -1375,8 +1341,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW); + } + + InitializeFirmwareVars8814(Adapter); +- +- if(pwrctrlpriv->reg_rfoff == _TRUE){ ++ ++ if (pwrctrlpriv->reg_rfoff == _TRUE) { + pwrctrlpriv->rf_pwrstate = rf_off; + } + +@@ -1393,16 +1359,15 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MAC); + #if (HAL_MAC_ENABLE == 1) + status = PHY_MACConfig8814(Adapter); +- if(status == _FAIL) +- { ++ if (status == _FAIL) { + goto exit; + } + #endif //HAL_MAC_ENABLE +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC01); +- ++ + _InitQueuePriority_8814AUsb(Adapter); +- _InitPageBoundary_8814AUsb(Adapter); ++ _InitPageBoundary_8814AUsb(Adapter); + + _InitTransferPageSize_8814AUsb(Adapter); + +@@ -1411,8 +1376,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + _InitDriverInfoSize_8814A(Adapter, DRVINFO_SZ); + + _InitInterrupt_8814AU(Adapter); +- _InitID_8814A(Adapter);//set mac_address +- _InitNetworkType_8814A(Adapter);//set msr ++ _InitID_8814A(Adapter); //set mac_address ++ _InitNetworkType_8814A(Adapter); //set msr + _InitMacConfigure_8814A(Adapter); + //_InitWMACSetting_8814A(Adapter); + //_InitAdaptiveCtrl_8814AUsb(Adapter); +@@ -1428,7 +1393,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + + // + // Init CR MACTXEN, MACRXEN after setting RxFF boundary REG_TRXFF_BNDY to patch +- // Hw bug which Hw initials RxFF boundry size to a value which is larger than the real Rx buffer size in 88E. ++ // Hw bug which Hw initials RxFF boundry size to a value which is larger than the real Rx buffer size in 88E. + // 2011.08.05. by tynli. + // + value8 = rtw_read8(Adapter, REG_CR); +@@ -1449,7 +1414,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x3000); // unit: 256us. 3s + #endif // CONFIG_TX_MCAST2UNI + #endif // CONFIG_CONCURRENT_MODE || CONFIG_TX_MCAST2UNI +- ++ + #ifdef CONFIG_LED + _InitHWLed(Adapter); + #endif //CONFIG_LED +@@ -1461,8 +1426,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB); + #if (HAL_BB_ENABLE == 1) + status = PHY_BBConfig8814(Adapter); +- if(status == _FAIL) +- { ++ if (status == _FAIL) { + goto exit; + } + #endif //HAL_BB_ENABLE +@@ -1472,9 +1436,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF); + #if (HAL_RF_ENABLE == 1) +- status = PHY_RFConfig8814A(Adapter); +- if(status == _FAIL) +- { ++ status = PHY_RFConfig8814A(Adapter); ++ if (status == _FAIL) { + goto exit; + } + +@@ -1485,12 +1448,12 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF); + + PHY_ConfigBB_8814A(Adapter); + +- if(Adapter->registrypriv.channel <= 14) ++ if (Adapter->registrypriv.channel <= 14) + PHY_SwitchWirelessBand8814A(Adapter, BAND_ON_2_4G); + else + PHY_SwitchWirelessBand8814A(Adapter, BAND_ON_5G); + +- rtw_hal_set_chnl_bw(Adapter, Adapter->registrypriv.channel, ++ rtw_hal_set_chnl_bw(Adapter, Adapter->registrypriv.channel, + CHANNEL_WIDTH_20, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HAL_PRIME_CHNL_OFFSET_DONT_CARE); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_TURN_ON_BLOCK); +@@ -1503,9 +1466,9 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + // HW SEQ CTRL + //set 0x0 to 0xFF by tynli. Default enable HW SEQ NUM. +- rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF); +- +- // ++ rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF); ++ ++ // + // Disable BAR, suggested by Scott + // 2010.04.09 add by hpfan + // +@@ -1513,7 +1476,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + rtw_write8(Adapter,REG_SECONDARY_CCA_CTRL_8814A,0x03); + +- if(pregistrypriv->wifi_spec) ++ if (pregistrypriv->wifi_spec) + rtw_write16(Adapter,REG_FAST_EDCA_CTRL ,0); + //adjust EDCCA to avoid collision + /*if(pregistrypriv->wifi_spec) +@@ -1525,21 +1488,21 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM); + rtl8814_InitHalDm(Adapter); +- ++ + // + // 2010/08/11 MH Merge from 8192SE for Minicard init. We need to confirm current radio status +- // and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not ++ // and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not + // call init_adapter. May cause some problem?? + // +- // Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed +- // in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState ++ // Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed ++ // in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState + // is the same as eRfOff, we should change it to eRfOn after we config RF parameters. + // Added by tynli. 2010.03.30. + pwrctrlpriv->rf_pwrstate = rf_on; + + PHY_IQCalibrate_8814A_Init(&pHalData->odmpriv); + +-#if (HAL_BB_ENABLE == 1) ++#if (HAL_BB_ENABLE == 1) + PHY_SetRFEReg8814A(Adapter, _TRUE, pHalData->CurrentBandType); + #endif //HAL_BB_ENABLE + +@@ -1561,13 +1524,12 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM); + // Reset USB mode switch setting + rtw_write8(Adapter, REG_SDIO_CTRL_8814A, 0x0); + rtw_write8(Adapter, REG_ACLK_MON, 0x0); +- ++ + //RT_TRACE(COMP_INIT, DBG_TRACE, ("InitializeAdapter8188EUsb() <====\n")); +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK); + // 2010/08/26 MH Merge from 8192CE. +- if(pwrctrlpriv->rf_pwrstate == rf_on) +- { ++ if (pwrctrlpriv->rf_pwrstate == rf_on) { + /* if(IS_HARDWARE_TYPE_8812AU(Adapter)) + { + #if (RTL8812A_SUPPORT == 1) +@@ -1584,9 +1546,9 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK); + //this should be done by rf team using phydm code + //PHY_IQCalibrate_8814A(&pHalData->odmpriv, _FALSE); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_PW_TRACK); +- ++ + //ODM_TXPowerTrackingCheck(&pHalData->odmpriv ); +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_LCK); + //PHY_LCCalibrate_8812A(Adapter); + } +@@ -1596,8 +1558,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC21); + //HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PABIAS); + // _InitPABias(Adapter); + #if (MP_DRIVER == 1) +- if (Adapter->registrypriv.mp_mode == 1) +- { ++ if (Adapter->registrypriv.mp_mode == 1) { + Adapter->mppriv.channel = pHalData->CurrentChannel; + MPT_InitializeAdapter(Adapter, Adapter->mppriv.channel); + } +@@ -1610,13 +1571,10 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BT_COEXIST); + // suspend mode automatically. + //HwSuspendModeEnable92Cu(Adapter, _FALSE); + +- if ( _TRUE == pHalData->EEPROMBluetoothCoexist) +- { +- // Init BT hw config. +- rtw_btcoex_HAL_Initialize(Adapter, _FALSE); +- } +- else +- { ++ if ( _TRUE == pHalData->EEPROMBluetoothCoexist) { ++ // Init BT hw config. ++ rtw_btcoex_HAL_Initialize(Adapter, _FALSE); ++ } else { + // In combo card run wifi only , must setting some hardware reg. + rtl8812a_combo_card_WifiOnlyHwInit(Adapter); + } +@@ -1633,18 +1591,18 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC31); + + //misc + { +- int i; ++ int i; + u8 mac_addr[6]; +- for(i=0; i<6; i++) +- { ++ for (i=0; i<6; i++) ++ { + #ifdef CONFIG_CONCURRENT_MODE +- if(Adapter->iface_type == IFACE_PORT1) ++ if (Adapter->iface_type == IFACE_PORT1) + mac_addr[i] = rtw_read8(Adapter, REG_MACID1+i); + else + #endif +- mac_addr[i] = rtw_read8(Adapter, REG_MACID+i); ++ mac_addr[i] = rtw_read8(Adapter, REG_MACID+i); + } +- ++ + RTW_INFO("MAC Address from REG_MACID = "MAC_FMT"\n", MAC_ARG(mac_addr)); + } + +@@ -1656,14 +1614,14 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_END); + #ifdef DBG_HAL_INIT_PROFILING + hal_init_stages_timestamp[HAL_INIT_STAGES_END]=rtw_get_current_time(); + +- for(hal_init_profiling_i=0;hal_init_profiling_ibFWReady = _FALSE; +- ++ + } + + static void rtl8814au_hw_power_down(_adapter *padapter) + { + // 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c. + // Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1. +- ++ + // Enable register area 0x0-0xc. +- rtw_write8(padapter,REG_RSV_CTRL, 0x0); ++ rtw_write8(padapter,REG_RSV_CTRL, 0x0); + rtw_write16(padapter, REG_APS_FSMCO, 0x8812); + } + +@@ -1705,8 +1663,7 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + RTW_INFO("==> %s \n",__FUNCTION__); + + #ifdef CONFIG_BT_COEXIST +- if (hal_btcoex_IsBtExist(Adapter)) +- { ++ if (hal_btcoex_IsBtExist(Adapter)) { + RTW_INFO("BT module enable SIC\n"); + // Only under WIN7 we can support selective suspend and enter D3 state when system call halt adapter. + +@@ -1720,8 +1677,7 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + rtw_write16(Adapter, REG_GPIO_MUXCFG, rtw_read16(Adapter, REG_GPIO_MUXCFG)&(~BIT12)); + } + +- if(pHalData->bSupportUSB3 == _TRUE) +- { ++ if (pHalData->bSupportUSB3 == _TRUE) { + // set Reg 0xf008[3:4] to 2'11 to eable U1/U2 Mode in USB3.0. added by page, 20120712 + rtw_write8(Adapter, 0xf008, rtw_read8(Adapter, 0xf008)|0x18); + } +@@ -1733,33 +1689,32 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + + #ifdef SUPPORT_HW_RFOFF_DETECTED + RTW_INFO("bkeepfwalive(%x)\n", pwrctl->bkeepfwalive); +- if(pwrctl->bkeepfwalive) +- { +- _ps_close_RF(Adapter); +- if((pwrctl->bHWPwrPindetect) && (pwrctl->bHWPowerdown)) ++ if (pwrctl->bkeepfwalive) { ++ _ps_close_RF(Adapter); ++ if ((pwrctl->bHWPwrPindetect) && (pwrctl->bHWPowerdown)) + rtl8814au_hw_power_down(Adapter); + } + else + #endif +- { ++ { + if (rtw_is_hw_init_completed(Adapter)) { + hal_carddisable_8814(Adapter); + +- if((pwrctl->bHWPwrPindetect ) && (pwrctl->bHWPowerdown)) ++ if ((pwrctl->bHWPwrPindetect ) && (pwrctl->bHWPowerdown)) + rtl8814au_hw_power_down(Adapter); + } +- } ++ } + return _SUCCESS; + } + + unsigned int rtl8814au_inirp_init(PADAPTER Adapter) +-{ +- u8 i; ++{ ++ u8 i; + struct recv_buf *precvbuf; + uint status; + struct dvobj_priv *pdev= adapter_to_dvobj(Adapter); + struct intf_hdl * pintfhdl=&Adapter->iopriv.intf; +- struct recv_priv *precvpriv = &(Adapter->recvpriv); ++ struct recv_priv *precvpriv = &(Adapter->recvpriv); + u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem); + #ifdef CONFIG_USB_INTERRUPT_IN_PIPE + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +@@ -1770,22 +1725,20 @@ unsigned int rtl8814au_inirp_init(PADAPTER Adapter) + + status = _SUCCESS; + +- RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n")); +- ++ RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n")); ++ + precvpriv->ff_hwaddr = RECV_BULK_IN_ADDR; + +- //issue Rx irp to receive data +- precvbuf = (struct recv_buf *)precvpriv->precv_buf; +- for(i=0; iff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE ) +- { ++ //issue Rx irp to receive data ++ precvbuf = (struct recv_buf *)precvpriv->precv_buf; ++ for (i=0; iff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE ) { + RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_port error \n")); + status = _FAIL; + goto exit; + } +- +- precvbuf++; ++ ++ precvbuf++; + precvpriv->free_recv_buf_queue_cnt--; + } + +@@ -1794,17 +1747,16 @@ unsigned int rtl8814au_inirp_init(PADAPTER Adapter) + status = _FAIL; + RTW_INFO("%s =>Warning !! Have not USB Int-IN pipe, RtIntInPipe(%d)!!!\n", __func__, pdev->RtInPipe[REALTEK_USB_IN_INT_EP_IDX]); + goto exit; +- } ++ } + _read_interrupt = pintfhdl->io_ops._read_interrupt; +- if(_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE ) +- { ++ if (_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE ) { + RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_interrupt error \n")); + status = _FAIL; + } + #endif + + exit: +- ++ + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("<=== usb_inirp_init \n")); + + return status; +@@ -1812,9 +1764,9 @@ exit: + } + + unsigned int rtl8814au_inirp_deinit(PADAPTER Adapter) +-{ ++{ + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n ===> usb_rx_deinit \n")); +- ++ + rtw_read_port_cancel(Adapter); + + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n <=== usb_rx_deinit \n")); +@@ -1836,25 +1788,22 @@ hal_ReadIDs_8814AU( + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- if( !AutoloadFail ) +- { ++ if ( !AutoloadFail ) { + pHalData->EEPROMVID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_VID_8814AU] ); +- pHalData->EEPROMPID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_PID_8814AU] ); +- +- // Customer ID, 0x00 and 0xff are reserved for Realtek. ++ pHalData->EEPROMPID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_PID_8814AU] ); ++ ++ // Customer ID, 0x00 and 0xff are reserved for Realtek. + pHalData->EEPROMCustomerID = *(pu1Byte)&PROMContent[EEPROM_CustomID_8814]; + pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID; +- } +- else +- { ++ } else { + pHalData->EEPROMVID = EEPROM_Default_VID; + pHalData->EEPROMPID = EEPROM_Default_PID; + +- // Customer ID, 0x00 and 0xff are reserved for Realtek. ++ // Customer ID, 0x00 and 0xff are reserved for Realtek. + pHalData->EEPROMCustomerID = EEPROM_Default_CustomerID; + pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID; + } +- ++ + RTW_INFO("VID = 0x%04X, PID = 0x%04X\n", pHalData->EEPROMVID, pHalData->EEPROMPID); + RTW_INFO("Customer ID: 0x%02X, SubCustomer ID: 0x%02X\n", pHalData->EEPROMCustomerID, pHalData->EEPROMSubCustomerID); + } +@@ -1869,18 +1818,15 @@ hal_InitPGData_8814A( + u32 i; + u16 value16; + +- if(_FALSE == pHalData->bautoload_fail_flag) +- { // autoload OK. ++ if (_FALSE == pHalData->bautoload_fail_flag) { // autoload OK. + // hal_ReadeFuse_8814A is FW offload read efuse, todo + //#if ((DEV_BUS_TYPE==RT_USB_INTERFACE || DEV_BUS_TYPE==RT_SDIO_INTERFACE)) && (MP_DRIVER != 1) + //if(hal_ReadeFuse_8814A(pAdapter) == _FAIL) + //#endif +- ++ + // Read EFUSE real map to shadow. + EFUSE_ShadowMapUpdate(padapter, EFUSE_WIFI, _FALSE); +- } +- else +- {//autoload fail ++ } else { //autoload fail + RTW_INFO("AutoLoad Fail reported from CR9346!!\n"); + //update to default value 0xFF + EFUSE_ShadowMapUpdate(padapter, EFUSE_WIFI, _FALSE); +@@ -1899,11 +1845,11 @@ hal_CustomizedBehavior_8814AU( + IN PADAPTER Adapter + ) + { +- HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); ++ HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct led_priv *pledpriv = &(Adapter->ledpriv); +- ++ + // Led mode +- switch(pHalData->CustomerID) ++ switch (pHalData->CustomerID) + { + case RT_CID_DEFAULT: + pledpriv->LedStrategy = SW_LED_MODE9; +@@ -1922,48 +1868,48 @@ hal_CustomizeByCustomerID_8814AU( + ) + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter); +- ++ + RTW_INFO("PID= 0x%x, VID= %x\n",pHalData->EEPROMPID,pHalData->EEPROMVID); +- ++ + // Decide CustomerID according to VID/DID or EEPROM +- switch(pHalData->EEPROMCustomerID) ++ switch (pHalData->EEPROMCustomerID) + { + case EEPROM_CID_DEFAULT: +- if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308)) ++ if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309)) ++ else if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a)) ++ else if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x0BFF) && (pHalData->EEPROMPID == 0x8160)) ++ else if ((pHalData->EEPROMVID == 0x0BFF) && (pHalData->EEPROMPID == 0x8160)) + { + pHalData->CustomerID = RT_CID_CHINA_MOBILE; +- } +- else if((pHalData->EEPROMVID == 0x0BDA) && (pHalData->EEPROMPID == 0x5088)) ++ } ++ else if ((pHalData->EEPROMVID == 0x0BDA) && (pHalData->EEPROMPID == 0x5088)) + pHalData->CustomerID = RT_CID_CC_C; +- ++ + break; + case EEPROM_CID_WHQL: + //padapter->bInHctTest = _TRUE; +- ++ + //pMgntInfo->bSupportTurboMode = _FALSE; + //pMgntInfo->bAutoTurboBy8186 = _FALSE; +- ++ + //pMgntInfo->PowerSaveControl.bInactivePs = _FALSE; + //pMgntInfo->PowerSaveControl.bIPSModeBackup = _FALSE; + //pMgntInfo->PowerSaveControl.bLeisurePs = _FALSE; + //pMgntInfo->PowerSaveControl.bLeisurePsModeBackup = _FALSE; + //pMgntInfo->keepAliveLevel = 0; +- ++ + //padapter->bUnloadDriverwhenS3S4 = _FALSE; +- break; ++ break; + default: + pHalData->CustomerID = RT_CID_DEFAULT; + break; +- ++ + } + RTW_INFO("Customer ID: 0x%2x\n", pHalData->CustomerID); +- ++ + hal_CustomizedBehavior_8814AU(pAdapter); + } + +@@ -1975,7 +1921,7 @@ hal_ReadUsbModeSwitch_8814AU( + ) + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + if (AutoloadFail) + pHalData->EEPROMUsbSwitch = _FALSE; + else +@@ -1985,7 +1931,7 @@ hal_ReadUsbModeSwitch_8814AU( + + static VOID + ReadLEDSetting_8814AU( +- IN PADAPTER Adapter, ++ IN PADAPTER Adapter, + IN u8* PROMContent, + IN BOOLEAN AutoloadFail + ) +@@ -2015,19 +1961,19 @@ InitAdapterVariablesByPROM_8814AU( + hal_ReadTxPowerInfo8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadBoardType8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_Read_TRX_antenna_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + // + // Read Bluetooth co-exist and initialize + // + hal_EfuseParseBTCoexistInfo8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + hal_ReadChannelPlan8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_EfuseParseXtal_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadThermalMeter_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadRemoteWakeup_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadAntennaDiversity8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadRFEType_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + ReadLEDSetting_8814AU(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + + hal_ReadUsbModeSwitch_8814AU(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +@@ -2041,7 +1987,7 @@ InitAdapterVariablesByPROM_8814AU( + static void hal_ReadPROMContent_8814A( + IN PADAPTER Adapter + ) +-{ ++{ + PHAL_DATA_TYPE pHalData = GET_HAL_DATA(Adapter); + u8 eeValue; + +@@ -2064,7 +2010,7 @@ ReadAdapterInfo8814AU( + ) + { + Hal_InitEfuseVars_8814A(Adapter); +- ++ + // Read all content in Efuse/EEPROM. + hal_ReadPROMContent_8814A(Adapter); + +@@ -2079,21 +2025,21 @@ void UpdateInterruptMask8814AU(PADAPTER padapter,u8 bHIMR0 ,u32 AddMSR, u32 Remo + u32 *himr; + pHalData = GET_HAL_DATA(padapter); + +- if(bHIMR0) ++ if (bHIMR0) + himr = &(pHalData->IntrMask[0]); + else + himr = &(pHalData->IntrMask[1]); +- ++ + if (AddMSR) + *himr |= AddMSR; + + if (RemoveMSR) + *himr &= (~RemoveMSR); + +- if(bHIMR0) ++ if (bHIMR0) + rtw_write32(padapter, REG_HIMR0_8814A, *himr); + else +- rtw_write32(padapter, REG_HIMR1_8814A, *himr); ++ rtw_write32(padapter, REG_HIMR1_8814A, *himr); + + } + +@@ -2103,7 +2049,7 @@ void SetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + struct pwrctrl_priv *pwrctl = adapter_to_pwrctl(Adapter); + struct registry_priv *registry_par = &Adapter->registrypriv; + +- switch(variable) ++ switch (variable) + { + case HW_VAR_RXDMA_AGG_PG_TH: + #ifdef CONFIG_USB_RX_AGGREGATION +@@ -2185,9 +2131,9 @@ void SetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + + void GetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + { +- HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); ++ HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- switch(variable) ++ switch (variable) + { + default: + GetHwReg8814A(Adapter,variable,val); +@@ -2210,7 +2156,7 @@ SetHalDefVar8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u8 bResult = _SUCCESS; + +- switch(eVariable) ++ switch (eVariable) + { + default: + SetHalDefVar8814A(Adapter,eVariable,pValue); +@@ -2221,7 +2167,7 @@ SetHalDefVar8814AUsb( + } + + // +-// Description: ++// Description: + // Query setting of specified variable. + // + u8 +@@ -2234,7 +2180,7 @@ GetHalDefVar8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u8 bResult = _SUCCESS; + +- switch(eVariable) ++ switch (eVariable) + { + default: + GetHalDefVar8814A(Adapter,eVariable,pValue); +@@ -2302,9 +2248,9 @@ static void rtl8814au_init_default_value(_adapter * padapter) + } + + static u8 rtl8814au_ps_func(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8 *val) +-{ ++{ + u8 bResult = _TRUE; +- switch(efunc_id){ ++ switch (efunc_id) { + + #if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED) + case HAL_USB_SELECT_SUSPEND: +@@ -2327,7 +2273,7 @@ void rtl8814au_set_hal_ops(_adapter * padapter) + + pHalFunc->hal_power_on = _InitPowerOn_8814AU; + pHalFunc->hal_power_off = hal_carddisable_8814; +- ++ + pHalFunc->hal_init = &rtl8814au_hal_init; + pHalFunc->hal_deinit = &rtl8814au_hal_deinit; + +@@ -2345,12 +2291,12 @@ void rtl8814au_set_hal_ops(_adapter * padapter) + #else //case of hw led or no led + pHalFunc->InitSwLeds = NULL; + pHalFunc->DeInitSwLeds = NULL; +-#endif//CONFIG_SW_LED +- ++#endif //CONFIG_SW_LED ++ + pHalFunc->init_default_value = &rtl8814au_init_default_value; + pHalFunc->intf_chip_configure = &rtl8814au_interface_configure; + pHalFunc->read_adapter_info = &ReadAdapterInfo8814AU; +- ++ + pHalFunc->SetHwRegHandler = &SetHwReg8814AU; + pHalFunc->GetHwRegHandler = &GetHwReg8814AU; + pHalFunc->GetHalDefVarHandler = &GetHalDefVar8814AUsb; +diff --git a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_ops_linux.c b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_ops_linux.c +index 59281f9..d2fea87 100644 +--- a/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_ops_linux.c ++++ b/drivers/net/wireless/rtl8812au/hal/rtl8814a/usb/usb_ops_linux.c +@@ -1,7 +1,7 @@ + /****************************************************************************** + * + * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +- * ++ * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. +@@ -24,17 +24,16 @@ + + #ifdef CONFIG_SUPPORT_USB_INT + void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) +-{ ++{ + HAL_DATA_TYPE *pHalData=GET_HAL_DATA(padapter); + struct reportpwrstate_parm pwr_rpt; +- +- if ( pkt_len != INTERRUPT_MSG_FORMAT_LEN ) +- { ++ ++ if ( pkt_len != INTERRUPT_MSG_FORMAT_LEN ) { + RTW_INFO("%s Invalid interrupt content length (%d)!\n", __FUNCTION__, pkt_len); + return ; + } + +- // HISR ++ // HISR + _rtw_memcpy(&(pHalData->IntArray[0]), &(pbuf[USB_INTR_CONTENT_HISR_OFFSET]), 4); + _rtw_memcpy(&(pHalData->IntArray[1]), &(pbuf[USB_INTR_CONTENT_HISRE_OFFSET]), 4); + +@@ -42,25 +41,24 @@ void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) + { + u32 hisr=0 ,hisr_ex=0; + _rtw_memcpy(&hisr,&(pHalData->IntArray[0]),4); +- hisr = le32_to_cpu(hisr); +- ++ hisr = le32_to_cpu(hisr); ++ + _rtw_memcpy(&hisr_ex,&(pHalData->IntArray[1]),4); + hisr_ex = le32_to_cpu(hisr_ex); +- +- if((hisr != 0) || (hisr_ex!=0)) ++ ++ if ((hisr != 0) || (hisr_ex!=0)) + RTW_INFO("===> %s hisr:0x%08x ,hisr_ex:0x%08x \n",__FUNCTION__,hisr,hisr_ex); + } + #endif + + + #ifdef CONFIG_LPS_LCLK +- if( pHalData->IntArray[0] & IMR_CPWM_88E ) +- { ++ if ( pHalData->IntArray[0] & IMR_CPWM_88E ) { + _rtw_memcpy(&pwr_rpt.state, &(pbuf[USB_INTR_CONTENT_CPWM1_OFFSET]), 1); + //_rtw_memcpy(&pwr_rpt.state2, &(pbuf[USB_INTR_CONTENT_CPWM2_OFFSET]), 1); + +- //88e's cpwm value only change BIT0, so driver need to add PS_STATE_S2 for LPS flow. +- pwr_rpt.state |= PS_STATE_S2; ++ //88e's cpwm value only change BIT0, so driver need to add PS_STATE_S2 for LPS flow. ++ pwr_rpt.state |= PS_STATE_S2; + _set_workitem(&(adapter_to_pwrctl(padapter)->cpwm_event)); + } + #endif//CONFIG_LPS_LCLK +@@ -72,40 +70,38 @@ void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) + #endif + #ifdef CONFIG_INTERRUPT_BASED_TXBCN_BCN_OK_ERR + if (pHalData->IntArray[0] & (IMR_TBDER_88E|IMR_TBDOK_88E)) +- #endif +- { ++ #endif ++ { + struct mlme_priv *pmlmepriv = &padapter->mlmepriv; + #if 0 +- if(pHalData->IntArray[0] & IMR_BCNDMAINT0_88E) ++ if (pHalData->IntArray[0] & IMR_BCNDMAINT0_88E) + RTW_INFO("%s: HISR_BCNERLY_INT\n", __func__); +- if(pHalData->IntArray[0] & IMR_TBDOK_88E) ++ if (pHalData->IntArray[0] & IMR_TBDOK_88E) + RTW_INFO("%s: HISR_TXBCNOK\n", __func__); +- if(pHalData->IntArray[0] & IMR_TBDER_88E) ++ if (pHalData->IntArray[0] & IMR_TBDER_88E) + RTW_INFO("%s: HISR_TXBCNERR\n", __func__); + #endif +- + +- if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) +- { ++ ++ if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { + //send_beacon(padapter); +- if(pmlmepriv->update_bcn == _TRUE) ++ if (pmlmepriv->update_bcn == _TRUE) + { + //tx_beacon_hdl(padapter, NULL); + set_tx_beacon_cmd(padapter); + } + } + #ifdef CONFIG_CONCURRENT_MODE +- if(check_buddy_fwstate(padapter, WIFI_AP_STATE)) +- { ++ if (check_buddy_fwstate(padapter, WIFI_AP_STATE)) { + //send_beacon(padapter); +- if(padapter->pbuddy_adapter->mlmepriv.update_bcn == _TRUE) ++ if (padapter->pbuddy_adapter->mlmepriv.update_bcn == _TRUE) + { + //tx_beacon_hdl(padapter, NULL); + set_tx_beacon_cmd(padapter->pbuddy_adapter); + } + } + #endif +- ++ + } + #endif //CONFIG_INTERRUPT_BASED_TXBCN + +@@ -361,8 +357,9 @@ int recvbuf2recvframe(PADAPTER padapter, void *ptr) + } + + #ifdef CONFIG_RX_PACKET_APPEND_FCS +- if(pattrib->pkt_rpt_type == NORMAL_RX) +- pattrib->pkt_len -= IEEE80211_FCS_LEN; ++ if (check_fwstate(&padapter->mlmepriv, WIFI_MONITOR_STATE) == _FALSE) ++ if ((pattrib->pkt_rpt_type == NORMAL_RX) && (pHalData->ReceiveConfig & RCR_APPFCS)) ++ pattrib->pkt_len -= IEEE80211_FCS_LEN; + #endif + if(rtw_os_alloc_recvframe(padapter, precvframe, + (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), pskb) == _FAIL) +diff --git a/drivers/net/wireless/rtl8812au/include/autoconf.h b/drivers/net/wireless/rtl8812au/include/autoconf.h +index 2e1c614..3c1713f 100644 +--- a/drivers/net/wireless/rtl8812au/include/autoconf.h ++++ b/drivers/net/wireless/rtl8812au/include/autoconf.h +@@ -309,7 +309,6 @@ + #endif /* !CONFIG_BT_COEXIST */ + + +- + #ifdef CONFIG_USB_TX_AGGREGATION + /* #define CONFIG_TX_EARLY_MODE */ + #endif +@@ -347,12 +346,11 @@ + /* #define DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED "jeff-ap" */ + + +- + /* #define DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE */ + /* #define DBG_ROAMING_TEST */ + + /* #define DBG_HAL_INIT_PROFILING */ + +-/*#define DBG_MEMORY_LEAK*/ ++/* #define DBG_MEMORY_LEAK*/ + #define DBG_RX_DFRAME_RAW_DATA +-/*#define CONFIG_USE_EXTERNAL_POWER */ /* NOT USB2.0 power, so no 500mA power constraint, no limitation in Power by Rate*/ ++/* #define CONFIG_USE_EXTERNAL_POWER */ /* NOT USB2.0 power, so no 500mA power constraint, no limitation in Power by Rate */ +diff --git a/drivers/net/wireless/rtl8812au/include/rtw_wifi_regd.h b/drivers/net/wireless/rtl8812au/include/rtw_wifi_regd.h +index 69bd71d..7acbb95 100644 +--- a/drivers/net/wireless/rtl8812au/include/rtw_wifi_regd.h ++++ b/drivers/net/wireless/rtl8812au/include/rtw_wifi_regd.h +@@ -5,7 +5,7 @@ + *****************************************************************************/ + + #ifndef __RTW_WIFI_REGD_H__ +-#define __RTW_WIFI_REGD_H__ ++#define __RTW_WIFI_REGD_H__ + + int rtw_regd_init(_adapter *padapter); + void rtw_reg_notify_by_driver(_adapter *adapter); +diff --git a/drivers/net/wireless/rtl8812au/include/rtw_xmit.h b/drivers/net/wireless/rtl8812au/include/rtw_xmit.h +index d372338..6b5ea43 100644 +--- a/drivers/net/wireless/rtl8812au/include/rtw_xmit.h ++++ b/drivers/net/wireless/rtl8812au/include/rtw_xmit.h +@@ -421,7 +421,7 @@ struct pkt_attrib { + u8 rate; + u8 intel_proxim; + u8 retry_ctrl; +- u8 sw_seq; ++ //u8 sw_seq; // Add support for pre-configured SeqNum via RadioTap + u8 mbssid; + u8 ldpc; + u8 stbc; +diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_cfg80211.c +index 8a7e088..17937e7 100644 +--- a/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8812au/os_dep/linux/ioctl_cfg80211.c +@@ -1750,6 +1750,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, + + sinfo->filled |= STATION_INFO_BSS_PARAM; + ++#if defined (LINUX_VERSION_CODE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 20, 0)) + if (!psta->no_short_preamble_set) + sinfo->bss_param.flags |= STATION_INFO_BSS_PARAM_SHORT_PREAMBLE; + +@@ -1765,6 +1766,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, + sinfo->bss_param.dtim_period = pwrctl->dtim; + + sinfo->bss_param.beacon_interval = get_beacon_interval(&cur_network->network); ++#endif + + } + +diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/recv_linux.c b/drivers/net/wireless/rtl8812au/os_dep/linux/recv_linux.c +index 52fbba5..a802a9d 100644 +--- a/drivers/net/wireless/rtl8812au/os_dep/linux/recv_linux.c ++++ b/drivers/net/wireless/rtl8812au/os_dep/linux/recv_linux.c +@@ -445,10 +445,11 @@ void rtw_os_recv_indicate_pkt(_adapter *padapter, _pkt *pkt, struct rx_pkt_attri + #endif /* CONFIG_TCP_CSUM_OFFLOAD_RX */ + + ret = rtw_netif_rx(padapter->pnetdev, pkt); +- if (ret == NET_RX_SUCCESS) ++ if (ret == NET_RX_SUCCESS) { + DBG_COUNTER(padapter->rx_logs.os_netif_ok); +- else ++ } else { + DBG_COUNTER(padapter->rx_logs.os_netif_err); ++ } + } + } + +diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/usb_intf.c b/drivers/net/wireless/rtl8812au/os_dep/linux/usb_intf.c +index 6ed4e72..47b3435 100644 +--- a/drivers/net/wireless/rtl8812au/os_dep/linux/usb_intf.c ++++ b/drivers/net/wireless/rtl8812au/os_dep/linux/usb_intf.c +@@ -222,6 +222,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x331A), .driver_info = RTL8814A}, /* D-Link - D-Link */ + {USB_DEVICE(0x0B05, 0x1817), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ + {USB_DEVICE(0x0B05, 0x1852), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ ++ {USB_DEVICE(0x0B05, 0x1853), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ + {USB_DEVICE(0x056E, 0x400B), .driver_info = RTL8814A}, /* ELECOM - ELECOM */ + {USB_DEVICE(0x056E, 0x400D), .driver_info = RTL8814A}, /* ELECOM - ELECOM */ + {USB_DEVICE(0x7392, 0xA834), .driver_info = RTL8814A}, /* Edimax - Edimax */ +diff --git a/drivers/net/wireless/rtl8812au/os_dep/linux/wifi_regd.c b/drivers/net/wireless/rtl8812au/os_dep/linux/wifi_regd.c +index fa8ba7b..b0a4abd 100644 +--- a/drivers/net/wireless/rtl8812au/os_dep/linux/wifi_regd.c ++++ b/drivers/net/wireless/rtl8812au/os_dep/linux/wifi_regd.c +@@ -15,8 +15,8 @@ void rtw_reg_notify_by_driver(_adapter *adapter) + return; + } + +-int rtw_regd_init(_adapter *padapter) ++int rtw_regd_init(_adapter * padapter) + { + return 0; + } +-#endif /* CONFIG_IOCTL_CFG80211 */ ++#endif //CONFIG_IOCTL_CFG80211 +diff --git a/drivers/net/wireless/rtl8814au/core/rtw_mlme_ext.c b/drivers/net/wireless/rtl8814au/core/rtw_mlme_ext.c +index cc65410..050bfa3 100644 +--- a/drivers/net/wireless/rtl8814au/core/rtw_mlme_ext.c ++++ b/drivers/net/wireless/rtl8814au/core/rtw_mlme_ext.c +@@ -1420,10 +1420,11 @@ void mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame) + #ifdef CONFIG_AP_MODE + switch (GetFrameSubType(pframe)) { + case WIFI_AUTH: +- if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ++ if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) { + ptable->func = &OnAuth; +- else ++ } else + ptable->func = &OnAuthClient; ++ /* Intentional fallthrough */ + /* pass through */ + case WIFI_ASSOCREQ: + case WIFI_REASSOCREQ: +@@ -2201,14 +2202,15 @@ unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame) + if (rtw_is_list_empty(&pstat->asoc_list) == _FALSE) { + rtw_list_delete(&pstat->asoc_list); + pstapriv->asoc_list_cnt--; +- if (pstat->expire_to > 0) ++ if (pstat->expire_to > 0) { + ;/* TODO: STA re_auth within expire_to */ ++ } + } + _exit_critical_bh(&pstapriv->asoc_list_lock, &irqL); + +- if (seq == 1) ++ if (seq == 1) { + ; /* TODO: STA re_auth and auth timeout */ +- ++ } + } + } + +diff --git a/drivers/net/wireless/rtl8814au/core/rtw_pwrctrl.c b/drivers/net/wireless/rtl8814au/core/rtw_pwrctrl.c +index d8b45f4..0a596db 100644 +--- a/drivers/net/wireless/rtl8814au/core/rtw_pwrctrl.c ++++ b/drivers/net/wireless/rtl8814au/core/rtw_pwrctrl.c +@@ -219,6 +219,7 @@ bool rtw_pwr_unassociated_idle(_adapter *adapter) + || check_fwstate(pmlmepriv, WIFI_UNDER_LINKING | WIFI_UNDER_WPS) + || check_fwstate(pmlmepriv, WIFI_AP_STATE) + || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE) ++ || check_fwstate(pmlmepriv, WIFI_MONITOR_STATE) + #if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) + || pcfg80211_wdinfo->is_ro_ch + #elif defined(CONFIG_P2P) +@@ -618,6 +619,7 @@ u8 PS_RDY_CHECK(_adapter *padapter) + || check_fwstate(pmlmepriv, WIFI_UNDER_LINKING | WIFI_UNDER_WPS) + || check_fwstate(pmlmepriv, WIFI_AP_STATE) + || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE) ++ || check_fwstate(pmlmepriv, WIFI_MONITOR_STATE) + #if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) + || pcfg80211_wdinfo->is_ro_ch + #endif +diff --git a/drivers/net/wireless/rtl8814au/core/rtw_recv.c b/drivers/net/wireless/rtl8814au/core/rtw_recv.c +index 83ed24e..8bb59ee 100644 +--- a/drivers/net/wireless/rtl8814au/core/rtw_recv.c ++++ b/drivers/net/wireless/rtl8814au/core/rtw_recv.c +@@ -2125,7 +2125,7 @@ sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame) + if ((bDumpRxPkt == 4) && (eth_type == 0x888e)) + dump_rx_packet(ptr); + #endif +- } else ++ } else { + DBG_COUNTER(adapter->rx_logs.core_rx_pre_data_handled); + break; + default: +@@ -2136,6 +2136,7 @@ sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame) + retval = _FAIL; + break; + } ++} + + exit: + +@@ -3607,8 +3608,15 @@ static sint fill_radiotap_hdr(_adapter *padapter, union recv_frame *precvframe) + if (pattrib->mfrag) + hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FRAG; + +- /* always append FCS */ +- /* hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FCS; */ ++#ifdef CONFIG_RX_PACKET_APPEND_FCS ++ // Start by always indicating FCS is there: ++ hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_FCS; ++ ++ // Next, test for prior conditions that will remove FCS, and update flag accordingly: ++ if(check_fwstate(&padapter->mlmepriv,WIFI_MONITOR_STATE) == _FALSE) ++ if((pattrib->pkt_rpt_type == NORMAL_RX) && (pHalData->ReceiveConfig & RCR_APPFCS)) ++ hdr_buf[rt_len] &= ~IEEE80211_RADIOTAP_F_FCS; ++#endif + + if (0) + hdr_buf[rt_len] |= IEEE80211_RADIOTAP_F_DATAPAD; +diff --git a/drivers/net/wireless/rtl8814au/core/rtw_wlan_util.c b/drivers/net/wireless/rtl8814au/core/rtw_wlan_util.c +index 54c9a35..6de4e2e 100644 +--- a/drivers/net/wireless/rtl8814au/core/rtw_wlan_util.c ++++ b/drivers/net/wireless/rtl8814au/core/rtw_wlan_util.c +@@ -2353,8 +2353,7 @@ int rtw_get_bcn_keys(ADAPTER *Adapter, u8 *pframe, u32 packet_len, + + _rtw_memcpy(recv_beacon->ssid, elems.ssid, elems.ssid_len); + recv_beacon->ssid_len = elems.ssid_len; +- } else +- ; /* means hidden ssid */ ++ } else { ; } /* means hidden ssid */ + + /* checking RSN first */ + if (elems.rsn_ie && elems.rsn_ie_len) { +diff --git a/drivers/net/wireless/rtl8814au/core/rtw_xmit.c b/drivers/net/wireless/rtl8814au/core/rtw_xmit.c +index 1620473..c1019bb 100644 +--- a/drivers/net/wireless/rtl8814au/core/rtw_xmit.c ++++ b/drivers/net/wireless/rtl8814au/core/rtw_xmit.c +@@ -1254,10 +1254,11 @@ static s32 update_attrib(_adapter *padapter, _pkt *pkt, struct pkt_attrib *pattr + _rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN); + _rtw_memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN); + DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_ap); +- } else ++ } else { + DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_unknown); + + bmcast = IS_MCAST(pattrib->ra); ++ } + if (bmcast) { + psta = rtw_get_bcmc_stainfo(padapter); + if (psta == NULL) { /* if we cannot get psta => drop the pkt */ +@@ -3874,7 +3875,7 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + u32 len = skb->len; + u8 category, action; + int type = -1; +- ++ + //RTW_INFO(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev)); + + if (skb) +@@ -3922,17 +3923,17 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + fixed_rate = 0; + fixed_rate += MGN_MCS0; + } +- if ((mcs_have & 4) && ++ if ((mcs_have & 4) && + (iterator.this_arg[1] & 4)) + sgi = 1; +- if ((mcs_have & 1) && ++ if ((mcs_have & 1) && + (iterator.this_arg[1] & 1)) + bwidth = 1; +- if ((mcs_have & 0x10) && ++ if ((mcs_have & 0x10) && + (iterator.this_arg[1] & 0x10)) + ldpc = 1; + if ((mcs_have & 0x20)) +- stbc = (iterator.this_arg[1] >> 5) & 3; ++ stbc = (iterator.this_arg[1] >> 5) & 3; + } + break; + +@@ -3994,9 +3995,9 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev) + pattrib->ldpc = ldpc; + pattrib->stbc = stbc; + pattrib->retry_ctrl = (txflags & 0x08)?_FALSE:_TRUE; +- pattrib->sw_seq = (txflags & 0x10)?_TRUE:_FALSE; ++ // pattrib->sw_seq = (txflags & 0x10)?_TRUE:_FALSE; // Adds support for pre-configured SeqNum via RadioTap ++ + +- + pwlanhdr = (struct rtw_ieee80211_hdr *)pframe; + + pmlmeext->mgnt_seq = GetSequence(pwlanhdr); +diff --git a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c +index 22f793c..b7ff6f6 100644 +--- a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c ++++ b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.c +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + #include + +@@ -25,7 +25,7 @@ + * MPCIE.TXT + ******************************************************************************/ + +-u1Byte Array_MP_8814A_MPCIE[] = { ++u1Byte Array_MP_8814A_MPCIE[] = { + 0xFF, + 0xFF, + 0xFF, +diff --git a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h +index 8b51c1b..9b4d7c5 100644 +--- a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h ++++ b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_PCIE.h +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + + +diff --git a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c +index cd80e92..d882d92 100644 +--- a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c ++++ b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.c +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + #include + +@@ -25,7 +25,7 @@ + * MUSB.TXT + ******************************************************************************/ + +-u1Byte Array_MP_8814A_MUSB[] = { ++u1Byte Array_MP_8814A_MUSB[] = { + 0xFF, + 0xFF, + 0xFF, +diff --git a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h +index 4262400..be33e37 100644 +--- a/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h ++++ b/drivers/net/wireless/rtl8814au/hal/efuse/rtl8814a/HalEfuseMask8814A_USB.h +@@ -1,21 +1,21 @@ +-/****************************************************************************** +-* +-* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +-* +-* This program is free software; you can redistribute it and/or modify it +-* under the terms of version 2 of the GNU General Public License as +-* published by the Free Software Foundation. +-* +-* This program is distributed in the hope that it will be useful, but WITHOUT +-* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +-* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +-* more details. +-* +-* You should have received a copy of the GNU General Public License along with +-* this program; if not, write to the Free Software Foundation, Inc., +-* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +-* +-* ++/****************************************************************************** ++* ++* Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. ++* ++* This program is free software; you can redistribute it and/or modify it ++* under the terms of version 2 of the GNU General Public License as ++* published by the Free Software Foundation. ++* ++* This program is distributed in the hope that it will be useful, but WITHOUT ++* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for ++* more details. ++* ++* You should have received a copy of the GNU General Public License along with ++* this program; if not, write to the Free Software Foundation, Inc., ++* 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA ++* ++* + ******************************************************************************/ + + +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8812a/usb/rtl8812au_xmit.c b/drivers/net/wireless/rtl8814au/hal/rtl8812a/usb/rtl8812au_xmit.c +index 68ee167..bc5f941 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8812a/usb/rtl8812au_xmit.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8812a/usb/rtl8812au_xmit.c +@@ -112,7 +112,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz , u8 ba + + /* offset 12 */ + +- if (!pattrib->qos_en && pattrib->sw_seq == _FALSE) { ++ if (!pattrib->qos_en) { + SET_TX_DESC_HWSEQ_EN_8812(ptxdesc, 1); /* Hw set sequence number */ + } else + SET_TX_DESC_SEQ_8812(ptxdesc, pattrib->seqnum); +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_phycfg.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_phycfg.c +index 423ba9f..f0a247a 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_phycfg.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_phycfg.c +@@ -554,7 +554,6 @@ PHY_ConfigBB_8814A( + } + + +- + //2 3.3 RF Config + + s32 +@@ -1157,7 +1156,7 @@ PHY_GetTxPowerIndex_8814A( + tpt_offset = PHY_GetTxPowerTrackingOffset(pAdapter, RFPath, Rate); + + powerDiffByRate = powerDiffByRate > limit ? limit : powerDiffByRate; +- /*RTW_INFO("Rate-0x%x: (TxPower, PowerDiffByRate Path-%c) = (0x%X, %d)\n", Rate, ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), txPower, powerDiffByRate);*/ ++ RTW_INFO("Rate-0x%x: (TxPower, PowerDiffByRate Path-%c) = (0x%X, %d)\n", Rate, ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), txPower, powerDiffByRate); + + txPower += powerDiffByRate; + +@@ -1184,8 +1183,8 @@ PHY_GetTxPowerIndex_8814A( + //(pHalData->bautoload_fail_flag || pHalData->EfuseMap[EFUSE_INIT_MAP][EEPROM_TX_PWR_INX_JAGUAR] == 0xFF)) + //txPower = 0x12; + +- /*RTW_INFO("Final Tx Power(RF-%c, Channel: %d) = %d(0x%X)\n", ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), Channel, +- txPower, txPower);*/ ++ RTW_INFO("Final Tx Power(RF-%c, Channel: %d) = %d(0x%X)\n", ((RFPath==0)?'A':(RFPath==1)?'B':(RFPath==2)?'C':'D'), Channel, ++ txPower, txPower); + + return (u8) txPower; + } +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_sreset.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_sreset.c +index 4a7947e..b9e83fd 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_sreset.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_sreset.c +@@ -93,7 +93,7 @@ void rtl8814_sreset_linked_status_check(_adapter *padapter) + regc58 = rtw_read32(padapter,0xc58); + reg824 = rtw_read32(padapter,0x824); + reg800 = rtw_read32(padapter,0x800); +- if( ((regc50&0xFFFFFF00)!= 0x69543400)|| ++ if ( ((regc50&0xFFFFFF00)!= 0x69543400)|| + ((regc58&0xFFFFFF00)!= 0x69543400)|| + (((reg824&0xFFFFFF00)!= 0x00390000)&&(((reg824&0xFFFFFF00)!= 0x80390000)))|| + ( ((reg800&0xFFFFFF00)!= 0x03040000)&&((reg800&0xFFFFFF00)!= 0x83040000))) +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_xmit.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_xmit.c +index 43b8268..bb6cdd8 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_xmit.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/rtl8814a_xmit.c +@@ -172,7 +172,6 @@ InsertEMContent_8814( + } + + +- + void UpdateEarlyModeInfo8814(struct xmit_priv *pxmitpriv,struct xmit_buf *pxmitbuf ) + { + //_adapter *padapter, struct xmit_frame *pxmitframe,struct tx_servq *ptxservq +@@ -254,7 +253,6 @@ void rtl8814a_cal_txdesc_chksum(u8 *ptxdesc) + u32 index; + u16 checksum = 0; + +- + usPtr = (u16*)ptxdesc; + // checksume is always calculated by first 32 bytes, + // and it doesn't depend on TX DESC length. +@@ -439,7 +437,7 @@ BWMapping_8814( + else + BWSettingOfDesc = 0; + } +- else if(pHalData->CurrentChannelBW== CHANNEL_WIDTH_40) { ++ else if (pHalData->CurrentChannelBW== CHANNEL_WIDTH_40) { + if ((pattrib->bwmode == CHANNEL_WIDTH_40) || (pattrib->bwmode == CHANNEL_WIDTH_80)) + BWSettingOfDesc = 1; + else +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/rtl8814au_xmit.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/rtl8814au_xmit.c +index 8200263..0f4d3e1 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/rtl8814au_xmit.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/rtl8814au_xmit.c +@@ -61,7 +61,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + + #ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX + if (padapter->registrypriv.mp_mode == 0) { +- if((PACKET_OFFSET_SZ != 0) && (!bagg_pkt) &&(rtw_usb_bulk_size_boundary(padapter,TXDESC_SIZE+sz)==_FALSE)) { ++ if ((PACKET_OFFSET_SZ != 0) && (!bagg_pkt) &&(rtw_usb_bulk_size_boundary(padapter,TXDESC_SIZE+sz)==_FALSE)) { + ptxdesc = (pmem+PACKET_OFFSET_SZ); + //RTW_INFO("==> non-agg-pkt,shift pointer...\n"); + pull = 1; +@@ -94,10 +94,9 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + } + + #ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX +- if (padapter->registrypriv.mp_mode == 0) +- { +- if((PACKET_OFFSET_SZ != 0) && (!bagg_pkt)){ +- if((pull) && (pxmitframe->pkt_offset>0)) { ++ if (padapter->registrypriv.mp_mode == 0) { ++ if ((PACKET_OFFSET_SZ != 0) && (!bagg_pkt)) { ++ if ((pull) && (pxmitframe->pkt_offset>0)) { + pxmitframe->pkt_offset = pxmitframe->pkt_offset -1; + } + } +@@ -119,10 +118,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + + if (!pattrib->qos_en) { + /* HW sequence, to fix to use 0 queue. todo: 4AC packets to use auto queue select */ +- if (pattrib->sw_seq == _FALSE) +- SET_TX_DESC_HWSEQ_EN_8814A(ptxdesc, 1); // Hw set sequence number +- else +- SET_TX_DESC_SEQ_8814A(ptxdesc, pattrib->seqnum); ++ SET_TX_DESC_HWSEQ_EN_8814A(ptxdesc, 1); // Hw set sequence number + SET_TX_DESC_EN_HWEXSEQ_8814A(ptxdesc, 0); + SET_TX_DESC_DISQSELSEQ_8814A(ptxdesc, 1); + SET_TX_DESC_HW_SSN_SEL_8814A(ptxdesc, 0); +@@ -130,8 +126,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + SET_TX_DESC_SEQ_8814A(ptxdesc, pattrib->seqnum); + } + +- if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) +- { ++ if ((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) { + //RTW_INFO("pxmitframe->frame_tag == DATA_FRAMETAG\n"); + + rtl8814a_fill_txdesc_sectype(pattrib, ptxdesc); +@@ -189,7 +184,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + if (padapter->fix_rate != 0xFF) { // modify data rate by iwpriv + SET_TX_DESC_USE_RATE_8814A(ptxdesc, 1); + DriverFixedRate = 0x01; +- if(padapter->fix_rate & BIT(7)) ++ if (padapter->fix_rate & BIT(7)) + SET_TX_DESC_DATA_SHORT_8814A(ptxdesc, 1); + + SET_TX_DESC_TX_RATE_8814A(ptxdesc, (padapter->fix_rate & 0x7F)); +@@ -202,7 +197,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + if (pattrib->stbc) + SET_TX_DESC_DATA_STBC_8814A(ptxdesc, 1); + +- //work arond before fixing RA ++ //work around before fixing RA + //SET_TX_DESC_USE_RATE_8814A(ptxdesc, 1); + //SET_TX_DESC_TX_RATE_8814A(ptxdesc, 0x10); + } else { +@@ -253,7 +248,7 @@ static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz ,u8 bag + SET_TX_DESC_DATA_RETRY_LIMIT_8814A(ptxdesc, 5); + SET_TX_DESC_DISABLE_FB_8814A(ptxdesc, 1); + +- //if(pattrib->rts_cca) ++ //if (pattrib->rts_cca) + //{ + // SET_TX_DESC_NDPA_8812(ptxdesc, 2); + //} +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_halinit.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_halinit.c +index b134d5a..e9a5c68 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_halinit.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_halinit.c +@@ -1,7 +1,7 @@ + /****************************************************************************** + * + * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +- * ++ * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. +@@ -33,8 +33,7 @@ static void _dbg_dump_macreg(_adapter *padapter) + u32 offset = 0; + u32 val32 = 0; + u32 index =0 ; +- for(index=0;index<64;index++) +- { ++ for (index=0;index<64;index++) { + offset = index*4; + val32 = rtw_read32(padapter,offset); + RTW_INFO("offset : 0x%02x ,val:0x%08x\n",offset,val32); +@@ -52,11 +51,11 @@ _ConfigChipOutEP_8814( + pHalData->OutEpQueueSel = 0; + pHalData->OutEpNumber = 0; + +- switch(NumOutPipe){ ++ switch (NumOutPipe) { + case 4: + pHalData->OutEpQueueSel=TX_SELE_HQ| TX_SELE_LQ|TX_SELE_NQ; + pHalData->OutEpNumber=4; +- break; ++ break; + case 3: + pHalData->OutEpQueueSel=TX_SELE_HQ| TX_SELE_LQ|TX_SELE_NQ; + pHalData->OutEpNumber=3; +@@ -69,9 +68,9 @@ _ConfigChipOutEP_8814( + pHalData->OutEpQueueSel=TX_SELE_HQ; + pHalData->OutEpNumber=1; + break; +- default: ++ default: + break; +- ++ + } + RTW_INFO("%s OutEpQueueSel(0x%02x), OutEpNumber(%d) \n",__FUNCTION__,pHalData->OutEpQueueSel,pHalData->OutEpNumber ); + +@@ -87,10 +86,10 @@ static BOOLEAN HalUsbSetQueuePipeMapping8814AUsb( + BOOLEAN result = _FALSE; + + _ConfigChipOutEP_8814(pAdapter, NumOutPipe); +- ++ + // Normal chip with one IN and one OUT doesn't have interrupt IN EP. +- if(1 == pHalData->OutEpNumber){ +- if(1 != NumInPipe){ ++ if (1 == pHalData->OutEpNumber) { ++ if (1 != NumInPipe) { + return result; + } + } +@@ -101,7 +100,7 @@ static BOOLEAN HalUsbSetQueuePipeMapping8814AUsb( + //} + + result = Hal_MappingOutPipe(pAdapter, NumOutPipe); +- ++ + return result; + + } +@@ -173,55 +172,45 @@ _InitBurstPktLen(IN PADAPTER Adapter) + { + u8 u1bTmp; + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + //yx_qi 131128 move to 0x1448, 144c + rtw_write32(Adapter, REG_FAST_EDCA_VOVI_SETTING_8814A, 0x08070807); //yx_qi 131128 + rtw_write32(Adapter, REG_FAST_EDCA_BEBK_SETTING_8814A, 0x08070807); //yx_qi 131128 +- ++ + u1bTmp = rtw_read8(Adapter, 0xff); //check device operation speed: SS 0xff bit7 +- +- if(u1bTmp & BIT7) //USB2/1.1 Mode +- { ++ ++ if (u1bTmp & BIT7) { //USB2/1.1 Mode + pHalData->bSupportUSB3 = FALSE; +- } +- else //USB3 Mode +- { ++ } else { //USB3 Mode + pHalData->bSupportUSB3 = TRUE; + } +- +- if(pHalData->bSupportUSB3 == _FALSE) //USB2/1.1 Mode +- { +- if(pHalData->UsbBulkOutSize == 512) +- { ++ ++ if (pHalData->bSupportUSB3 == _FALSE) { //USB2/1.1 Mode ++ if (pHalData->UsbBulkOutSize == 512) { + //set burst pkt len=512B + rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x1e); +- } +- else +- { ++ } else { + //set burst pkt len=64B +- rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x2e); ++ rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x2e); + } + + rtw_write16(Adapter, REG_RXDMA_AGG_PG_TH_8814A,0x2005); //dmc agg th 20K +- } +- else //USB3 Mode +- { ++ } else { //USB3 Mode + //set burst pkt len=1k +- rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x0e); ++ rtw_write8(Adapter, REG_RXDMA_MODE_8814A, 0x0e); + rtw_write16(Adapter, REG_RXDMA_AGG_PG_TH_8814A,0x0a05); //dmc agg th 20K +- ++ + // set Reg 0xf008[3:4] to 2'00 to disable U1/U2 Mode to avoid 2.5G spur in USB3.0. added by page, 20120712 + rtw_write8(Adapter, 0xf008, rtw_read8(Adapter, 0xf008)&0xE7); + //to avoid usb 3.0 H2C fail + rtw_write16(Adapter, 0xf002, 0); +- ++ + rtw_write8(Adapter, REG_SW_AMPDU_BURST_MODE_CTRL_8814A, rtw_read8(Adapter, REG_SW_AMPDU_BURST_MODE_CTRL_8814A) & ~BIT(6)); + RTW_INFO("turn off the LDPC pre-TX\n"); +- +- } + +- if(pHalData->AMPDUBurstMode) +- { ++ } ++ ++ if (pHalData->AMPDUBurstMode) { + rtw_write8(Adapter,REG_SW_AMPDU_BURST_MODE_CTRL_8814A, 0x5F); + } + } +@@ -232,7 +221,7 @@ _InitQueueReservedPage_8814AUsb( + ) + { + struct registry_priv *pregistrypriv = &Adapter->registrypriv; +- u16 txpktbuf_bndy; ++ u16 txpktbuf_bndy; + + RTW_INFO("===>_InitQueueReservedPage_8814AUsb()\n"); + +@@ -246,7 +235,7 @@ _InitQueueReservedPage_8814AUsb( + + rtw_write32(Adapter, REG_RQPN_CTRL_2_8814A, 0x80000000); + +- if(!pregistrypriv->wifi_spec) ++ if (!pregistrypriv->wifi_spec) + txpktbuf_bndy = TX_PAGE_BOUNDARY_8814A; + else // for WMM + txpktbuf_bndy = WMM_NORMAL_TX_PAGE_BOUNDARY_8814A; +@@ -260,7 +249,7 @@ _InitQueueReservedPage_8814AUsb( + rtw_write16(Adapter,REG_FIFOPAGE_CTRL_2_8814A, txpktbuf_bndy); + //The head page of packet of Bcnq1 + rtw_write16(Adapter,REG_FIFOPAGE_CTRL_2_8814A+2,txpktbuf_bndy); +- ++ + RTW_INFO("<===_InitQueueReservedPage_8814AUsb()\n"); + } + +@@ -273,7 +262,7 @@ static u32 _InitPowerOn_8814AU(_adapter *padapter) + u8 u1btmp = rtw_read8(padapter, 0x10C2); + rtw_write8(padapter, 0x10C2, (u1btmp | BIT1)); + +- if(!HalPwrSeqCmdParsing(padapter, ~PWR_CUT_TESTCHIP_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK, Rtl8814A_NIC_ENABLE_FLOW)) ++ if (!HalPwrSeqCmdParsing(padapter, ~PWR_CUT_TESTCHIP_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK, Rtl8814A_NIC_ENABLE_FLOW)) + return _FAIL; + + // Enable MAC DMA/WMAC/SCHEDULE/SEC block +@@ -320,9 +309,9 @@ _InitPageBoundary_8814AUsb( + { + //20130416 KaiYuan modified for 8814 + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + rtw_write16(Adapter, REG_RXFF_PTR_8814A, RX_DMA_BOUNDARY_8814A); //yx_qi 20140331 +- ++ + } + + static VOID +@@ -353,11 +342,11 @@ _InitNormalChipTwoOutEpPriority_8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct registry_priv *pregistrypriv = &Adapter->registrypriv; + u16 beQ,bkQ,viQ,voQ,mgtQ,hiQ; +- ++ + u16 valueHi = 0; + u16 valueLow = 0; +- +- switch(pHalData->OutEpQueueSel) ++ ++ switch (pHalData->OutEpQueueSel) + { + case (TX_SELE_HQ | TX_SELE_LQ): + valueHi = QUEUE_HIGH; +@@ -373,27 +362,27 @@ _InitNormalChipTwoOutEpPriority_8814AUsb( + break; + default: + valueHi = QUEUE_HIGH; +- valueLow = QUEUE_NORMAL; ++ valueLow = QUEUE_NORMAL; + break; + } + +- if(!pregistrypriv->wifi_spec){ ++ if (!pregistrypriv->wifi_spec) { + beQ = valueLow; + bkQ = valueLow; + viQ = valueHi; + voQ = valueHi; +- mgtQ = valueHi; +- hiQ = valueHi; ++ mgtQ = valueHi; ++ hiQ = valueHi; + } +- else{//for WMM ,CONFIG_OUT_EP_WIFI_MODE ++ else { //for WMM ,CONFIG_OUT_EP_WIFI_MODE + beQ = valueLow; + bkQ = valueHi; + viQ = valueHi; + voQ = valueLow; + mgtQ = valueHi; +- hiQ = valueHi; ++ hiQ = valueHi; + } +- ++ + _InitNormalChipRegPriority_8814AUsb(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ); + } + +@@ -405,21 +394,20 @@ _InitNormalChipThreeOutEpPriority_8814AUsb( + struct registry_priv *pregistrypriv = &Adapter->registrypriv; + u16 beQ,bkQ,viQ,voQ,mgtQ,hiQ; + +- if(!pregistrypriv->wifi_spec){// typical setting ++ if (!pregistrypriv->wifi_spec) { // typical setting + beQ = QUEUE_LOW; + bkQ = QUEUE_LOW; + viQ = QUEUE_NORMAL; + voQ = QUEUE_HIGH; + mgtQ = QUEUE_HIGH; +- hiQ = QUEUE_HIGH; +- } +- else{// for WMM ++ hiQ = QUEUE_HIGH; ++ } else { // for WMM + beQ = QUEUE_LOW; + bkQ = QUEUE_NORMAL; + viQ = QUEUE_NORMAL; + voQ = QUEUE_HIGH; + mgtQ = QUEUE_HIGH; +- hiQ = QUEUE_HIGH; ++ hiQ = QUEUE_HIGH; + } + _InitNormalChipRegPriority_8814AUsb(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ); + } +@@ -431,7 +419,7 @@ _InitQueuePriority_8814AUsb( + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- switch(pHalData->OutEpNumber) ++ switch (pHalData->OutEpNumber) + { + case 2: + _InitNormalChipTwoOutEpPriority_8814AUsb(Adapter); +@@ -499,8 +487,8 @@ _InitWMACSetting_8814A( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + + //pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | APP_FCS | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS; +- pHalData->ReceiveConfig = +- RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; ++ pHalData->ReceiveConfig = ++ RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; + + #if (1 == RTL8812A_RX_PACKET_INCLUDE_CRC) + pHalData->ReceiveConfig |= ACRC32; +@@ -539,7 +527,7 @@ _InitWMACSetting_8814A( + //rtw_write16(Adapter, REG_RXFLTMAP0, value16); + + //enable RX_SHIFT bits +- //rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1)); ++ //rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1)); + + } + */ +@@ -553,21 +541,21 @@ _InitMacConfigure_8814A( + u16 value16; + u32 regRRSR; + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + switch (Adapter->registrypriv.wireless_mode) + { + case WIRELESS_11B: + regRRSR = RATE_ALL_CCK; + break; +- ++ + case WIRELESS_11G: + case WIRELESS_11A: + case WIRELESS_11_5N: +- case WIRELESS_11A_5N://Todo: no basic rate for ofdm ? ++ case WIRELESS_11A_5N: //Todo: no basic rate for ofdm ? + case WIRELESS_11_5AC: + regRRSR = RATE_ALL_OFDM_AG; + break; +- ++ + case WIRELESS_11BG: + case WIRELESS_11G_24N: + case WIRELESS_11_24N: +@@ -575,7 +563,7 @@ _InitMacConfigure_8814A( + default: + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + break; +- ++ + } + + // Init value for RRSR. +@@ -584,7 +572,7 @@ _InitMacConfigure_8814A( + // Retry Limit + value16 = _LRL(0x30) | _SRL(0x30); + rtw_write16(Adapter, REG_RETRY_LIMIT_8814A, value16); +- ++ + pHalData->ReceiveConfig = RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYST_RXFF; + pHalData->ReceiveConfig |= FORCEACK; + #if (1 == RTL8812A_RX_PACKET_INCLUDE_CRC) +@@ -608,8 +596,8 @@ _InitMacConfigure_8814A( + + // 201409/25 MH When RA is enabled, we need to reduce the value. + rtw_write8(Adapter, REG_MAX_AGGR_NUM_8814A, 0x36); +- rtw_write8(Adapter, REG_RTS_MAX_AGGR_NUM_8814A,0x36); +- ++ rtw_write8(Adapter, REG_RTS_MAX_AGGR_NUM_8814A,0x36); ++ + } + + /* +@@ -643,7 +631,7 @@ _InitAdaptiveCtrl_8812AUsb( + // Retry Limit + value16 = _LRL(0x30) | _SRL(0x30); + rtw_write16(Adapter, REG_RL, value16); +- ++ + }*/ + + static VOID +@@ -656,7 +644,7 @@ _InitEDCA_8814AUsb( + rtw_write16(Adapter,REG_MAC_SPEC_SIFS, 0x100a); + + // Set SIFS for CCK +- rtw_write16(Adapter,REG_SIFS_CTX, 0x100a); ++ rtw_write16(Adapter,REG_SIFS_CTX, 0x100a); + + // Set SIFS for OFDM + rtw_write16(Adapter,REG_SIFS_TRX, 0x100a); +@@ -679,9 +667,9 @@ _InitBeaconMaxError_8814A( + ) + { + #ifdef CONFIG_ADHOC_WORKAROUND_SETTING +- rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF); ++ rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF); + #else +- //rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10)); ++ //rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10)); + #endif + } + +@@ -689,12 +677,12 @@ _InitBeaconMaxError_8814A( + static void _InitHWLed(PADAPTER Adapter) + { + struct led_priv *pledpriv = &(Adapter->ledpriv); +- +- if( pledpriv->LedStrategy != HW_LED) ++ ++ if ( pledpriv->LedStrategy != HW_LED) + return; +- ++ + // HW led control +-// to do .... ++// to do .... + //must consider cases of antenna diversity/ commbo card/solo card/mini card + + } +@@ -717,7 +705,7 @@ _InitRetryFunction_8814A( + ) + { + u8 value8; +- ++ + value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL); + value8 |= EN_AMPDU_RTY_NEW; + rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8); +@@ -730,7 +718,7 @@ _InitRetryFunction_8814A( + /*----------------------------------------------------------------------------- + * Function: usb_AggSettingTxUpdate() + * +- * Overview: Seperate TX/RX parameters update independent for TP detection and ++ * Overview: Seperate TX/RX parameters update independent for TP detection and + * dynamic TX/RX aggreagtion parameters update. + * + * Input: PADAPTER +@@ -751,25 +739,25 @@ usb_AggSettingTxUpdate_8814A( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u32 value32; + +- if(Adapter->registrypriv.wifi_spec) ++ if (Adapter->registrypriv.wifi_spec) + pHalData->UsbTxAggDescNum = 1; + +- if(pHalData->UsbTxAggMode){ ++ if (pHalData->UsbTxAggMode){ + value32 = rtw_read32(Adapter, REG_TDECTRL); + value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT); + value32 |= ((pHalData->UsbTxAggDescNum & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT); +- ++ + rtw_write32(Adapter, REG_TDECTRL, value32); + rtw_write8(Adapter, REG_TDECTRL+3, pHalData->UsbTxAggDescNum<<1); + } +- ++ + #endif //CONFIG_USB_TX_AGGREGATION + } // usb_AggSettingTxUpdate + + /*----------------------------------------------------------------------------- + * Function: usb_AggSettingRxUpdate() + * +- * Overview: Seperate TX/RX parameters update independent for TP detection and ++ * Overview: Seperate TX/RX parameters update independent for TP detection and + * dynamic TX/RX aggreagtion parameters update. + * + * Input: PADAPTER +@@ -793,7 +781,7 @@ usb_AggSettingRxUpdate_8814A( + + valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL_8814A); + valueUSB = rtw_read8(Adapter, REG_RXDMA_AGG_PG_TH_8814A+3); +- switch(pHalData->rxagg_mode) ++ switch (pHalData->rxagg_mode) + { + case RX_AGG_DMA: + valueDMA |= RXDMA_AGG_EN; +@@ -853,7 +841,7 @@ init_UsbAggregationSetting_8814A( + * + * Revised History: + * When Who Remark +- * 12/10/2010 MHC Create Version 0. ++ * 12/10/2010 MHC Create Version 0. + * + *---------------------------------------------------------------------------*/ + VOID +@@ -866,37 +854,33 @@ USB_AggModeSwitch( + PMGNT_INFO pMgntInfo = &(Adapter->MgntInfo); + + //pHalData->UsbRxHighSpeedMode = _FALSE; +- // How to measure the RX speed? We assume that when traffic is more than ++ // How to measure the RX speed? We assume that when traffic is more than + if (pMgntInfo->bRegAggDMEnable == _FALSE) + { + return; // Inf not support. + } +- +- if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _TRUE && ++ ++ if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _TRUE && + pHalData->UsbRxHighSpeedMode == _FALSE) + { + pHalData->UsbRxHighSpeedMode = _TRUE; + RT_TRACE(COMP_INIT, DBG_LOUD, ("UsbAggModeSwitchCheck to HIGH\n")); + } +- else if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _FALSE && ++ else if (pMgntInfo->LinkDetectInfo.bHigherBusyRxTraffic == _FALSE && + pHalData->UsbRxHighSpeedMode == _TRUE) + { + pHalData->UsbRxHighSpeedMode = _FALSE; + RT_TRACE(COMP_INIT, DBG_LOUD, ("UsbAggModeSwitchCheck to LOW\n")); ++ } else { ++ return; + } +- else +- { +- return; +- } +- ++ + #if USB_RX_AGGREGATION_92C +- if (pHalData->UsbRxHighSpeedMode == _TRUE) +- { ++ if (pHalData->UsbRxHighSpeedMode == _TRUE) { + // 2010/12/10 MH The parameter is tested by SD1 engineer and SD3 channel emulator. + // USB mode + #if (RT_PLATFORM == PLATFORM_LINUX) +- if (pMgntInfo->LinkDetectInfo.bTxBusyTraffic) +- { ++ if (pMgntInfo->LinkDetectInfo.bTxBusyTraffic) { + pHalData->RxAggBlockCount = 16; + pHalData->RxAggBlockTimeout = 7; + } +@@ -908,23 +892,20 @@ USB_AggModeSwitch( + } + // Mix mode + pHalData->RxAggPageCount = 72; +- pHalData->RxAggPageTimeout = 6; +- } +- else +- { ++ pHalData->RxAggPageTimeout = 6; ++ } else { + // USB mode + pHalData->RxAggBlockCount = pMgntInfo->RegRxAggBlockCount; +- pHalData->RxAggBlockTimeout = pMgntInfo->RegRxAggBlockTimeout; ++ pHalData->RxAggBlockTimeout = pMgntInfo->RegRxAggBlockTimeout; + // Mix mode + pHalData->RxAggPageCount = pMgntInfo->RegRxAggPageCount; +- pHalData->RxAggPageTimeout = pMgntInfo->RegRxAggPageTimeout; ++ pHalData->RxAggPageTimeout = pMgntInfo->RegRxAggPageTimeout; + } + + if (pHalData->RxAggBlockCount > MAX_RX_AGG_BLKCNT) + pHalData->RxAggBlockCount = MAX_RX_AGG_BLKCNT; + #if (OS_WIN_FROM_VISTA(OS_VERSION)) || (RT_PLATFORM == PLATFORM_LINUX) // do not support WINXP to prevent usbehci.sys BSOD +- if (IS_WIRELESS_MODE_N_24G(Adapter) || IS_WIRELESS_MODE_N_5G(Adapter)) +- { ++ if (IS_WIRELESS_MODE_N_24G(Adapter) || IS_WIRELESS_MODE_N_5G(Adapter)) { + // + // 2010/12/24 MH According to V1012 QC IOT test, XP BSOD happen when running chariot test + // with the aggregation dynamic change!! We need to disable the function to prevent it is broken +@@ -933,12 +914,12 @@ USB_AggModeSwitch( + usb_AggSettingRxUpdate_8188E(Adapter); + + // 2010/12/27 MH According to designer's suggstion, we can only modify Timeout value. Otheriwse +- // there might many HW incorrect behavior, the XP BSOD at usbehci.sys may be relative to the ++ // there might many HW incorrect behavior, the XP BSOD at usbehci.sys may be relative to the + // issue. Base on the newest test, we can not enable block cnt > 30, otherwise XP usbehci.sys may + // BSOD. + } + #endif +- ++ + #endif + #endif + } // USB_AggModeSwitch +@@ -957,7 +938,7 @@ _InitOperationMode_8814A( + // + // Set RRSR, RATR, and REG_BWOPMODE registers + // +- switch(Adapter->RegWirelessMode) ++ switch (Adapter->RegWirelessMode) + { + case WIRELESS_MODE_B: + regBwOpMode = BW_OPMODE_20MHZ; +@@ -975,14 +956,11 @@ _InitOperationMode_8814A( + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + break; + case WIRELESS_MODE_AUTO: +- if (Adapter->bInHctTest) +- { ++ if (Adapter->bInHctTest) { + regBwOpMode = BW_OPMODE_20MHZ; + regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; +- } +- else +- { ++ } else { + regBwOpMode = BW_OPMODE_20MHZ; + regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS; + regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG; +@@ -1000,7 +978,7 @@ _InitOperationMode_8814A( + regRATR = RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS; + regRRSR = RATE_ALL_OFDM_AG; + break; +- ++ + default: //for MacOSX compiler warning. + break; + } +@@ -1039,20 +1017,19 @@ static VOID _RfPowerSave( + return; + #endif + +- if(pMgntInfo->RegRfOff == _TRUE){ // User disable RF via registry. ++ if (pMgntInfo->RegRfOff == _TRUE) { // User disable RF via registry. + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RegRfOff.\n")); + MgntActSet_RF_State(Adapter, eRfOff, RF_CHANGE_BY_SW); + // Those action will be discard in MgntActSet_RF_State because off the same state + for(eRFPath = 0; eRFPath NumTotalRFPath; eRFPath++) + PHY_SetRFReg(Adapter, eRFPath, 0x4, 0xC00, 0x0); + } +- else if(pMgntInfo->RfOffReason > RF_CHANGE_BY_PS){ // H/W or S/W RF OFF before sleep. ++ else if (pMgntInfo->RfOffReason > RF_CHANGE_BY_PS) { // H/W or S/W RF OFF before sleep. + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RfOffReason(%ld).\n", pMgntInfo->RfOffReason)); + MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason); +- } +- else{ ++ } else { + pHalData->eRFPowerState = eRfOn; +- pMgntInfo->RfOffReason = 0; ++ pMgntInfo->RfOffReason = 0; + if(Adapter->bInSetPower || Adapter->bResetInProgress) + PlatformUsbEnableInPipes(Adapter); + RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): RF is on.\n")); +@@ -1062,7 +1039,7 @@ static VOID _RfPowerSave( + */ + enum { + Antenna_Lfet = 1, +- Antenna_Right = 2, ++ Antenna_Right = 2, + }; + + static VOID +@@ -1071,21 +1048,21 @@ _InitAntenna_Selection_8814A(IN PADAPTER Adapter) + + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- if(pHalData->AntDivCfg==0) ++ if (pHalData->AntDivCfg==0) + return; +-/* +- RTW_INFO("==> %s ....\n",__FUNCTION__); ++/* ++ RTW_INFO("==> %s ....\n",__FUNCTION__); + + rtw_write8(Adapter, REG_LEDCFG2, 0x82); + + PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT13, 0x01); +- ++ + if(PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == MAIN_ANT) + pHalData->CurAntenna = MAIN_ANT; + else + pHalData->CurAntenna = AUX_ANT; + RTW_INFO("%s,Cur_ant:(%x)%s\n",__FUNCTION__,pHalData->CurAntenna,(pHalData->CurAntenna == MAIN_ANT)?"MAIN_ANT":"AUX_ANT"); +- ++ + */ + } + +@@ -1104,28 +1081,24 @@ HalDetectSelectiveSuspendMode( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct dvobj_priv *pdvobjpriv = adapter_to_dvobj(Adapter); + +- // If support HW radio detect, we need to enable WOL ability, otherwise, we ++ // If support HW radio detect, we need to enable WOL ability, otherwise, we + // can not use FW to notify host the power state switch. +- ++ + EFUSE_ShadowRead(Adapter, 1, EEPROM_USB_OPTIONAL1, (u32 *)&tmpvalue); + + DBG_8192C("HalDetectSelectiveSuspendMode(): SS "); +- if(tmpvalue & BIT1) +- { ++ if (tmpvalue & BIT1) { + DBG_8192C("Enable\n"); +- } +- else +- { ++ } else { + DBG_8192C("Disable\n"); + pdvobjpriv->RegUsbSS = _FALSE; + } + + // 2010/09/01 MH According to Dongle Selective Suspend INF. We can switch SS mode. +- if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData)) +- { ++ if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData)) { + //PMGNT_INFO pMgntInfo = &(Adapter->MgntInfo); + +- //if (!pMgntInfo->bRegDongleSS) ++ //if (!pMgntInfo->bRegDongleSS) + //{ + // RT_TRACE(COMP_INIT, DBG_LOUD, ("Dongle disable SS\n")); + pdvobjpriv->RegUsbSS = _FALSE; +@@ -1156,12 +1129,11 @@ static void rtl8814au_hw_reset(_adapter *Adapter) + { + #if 0 + u8 reg_val=0; +- if(rtw_read8(Adapter, REG_MCUFWDL)&BIT7) +- { +- _8051Reset8812(Adapter); ++ if (rtw_read8(Adapter, REG_MCUFWDL)&BIT7) { ++ _8051Reset8812(Adapter); + rtw_write8(Adapter, REG_MCUFWDL, 0x00); + //before BB reset should do clock gated +- rtw_write32(Adapter, rFPGA0_XCD_RFPara, ++ rtw_write32(Adapter, rFPGA0_XCD_RFPara, + rtw_read32(Adapter, rFPGA0_XCD_RFPara)|(BIT6)); + //reset BB + reg_val = rtw_read8(Adapter, REG_SYS_FUNC_EN); +@@ -1172,16 +1144,16 @@ static void rtl8814au_hw_reset(_adapter *Adapter) + //reset TRX path + rtw_write16(Adapter, REG_CR, 0); + //reset MAC +- reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); ++ reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); + reg_val |= BIT(1); + reg_val = rtw_write8(Adapter, REG_APS_FSMCO+1, reg_val); //reg0x5[1] ,auto FSM off + + reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); +- ++ + //check if reg0x5[1] auto cleared +- while(reg_val & BIT(1)){ ++ while (reg_val & BIT(1)) { + rtw_udelay_os(1); +- reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); ++ reg_val = rtw_read8(Adapter, REG_APS_FSMCO+1); + } + reg_val |= BIT(0); + reg_val = rtw_write8(Adapter, REG_APS_FSMCO+1, reg_val); //reg0x5[0] ,auto FSM on +@@ -1272,7 +1244,7 @@ u32 rtl8814au_hal_init(PADAPTER Adapter) + int hal_init_profiling_i; + u32 hal_init_stages_timestamp[HAL_INIT_STAGES_NUM]; //used to record the time of each stage's starting point + +- for(hal_init_profiling_i=0;hal_init_profiling_ibkeepfwalive) +- { ++ if (pwrctrlpriv->bkeepfwalive) { + _ps_open_RF(Adapter); + +- if(pHalData->bIQKInitialized){ ++ if (pHalData->bIQKInitialized) { + //PHY_IQCalibrate_8812A(Adapter,_TRUE); +- } +- else +- { ++ } else { + //PHY_IQCalibrate_8812A(Adapter,_FALSE); + //pHalData->bIQKInitialized = _TRUE; + } +@@ -1301,16 +1270,13 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + } + + // Check if MAC has already power on. by tynli. 2011.05.27. +- value8 = rtw_read8(Adapter, REG_SYS_CLKR+1); ++ value8 = rtw_read8(Adapter, REG_SYS_CLKR+1); + u1bRegCR = rtw_read8(Adapter, REG_CR); + RTW_INFO(" power-on :REG_SYS_CLKR 0x09=0x%02x. REG_CR 0x100=0x%02x.\n", value8, u1bRegCR); +- if((value8&BIT3) && (u1bRegCR != 0 && u1bRegCR != 0xEA)) +- { ++ if ((value8&BIT3) && (u1bRegCR != 0 && u1bRegCR != 0xEA)) { + //pHalData->bMACFuncEnable = _TRUE; + RTW_INFO(" MAC has already power on.\n"); +- } +- else +- { ++ } else { + //pHalData->bMACFuncEnable = _FALSE; + // Set FwPSState to ALL_ON mode to prevent from the I/O be return because of 32k + // state which is set before sleep under wowlan mode. 2012.01.04. by tynli. +@@ -1332,7 +1298,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + }*/ + + /* +- If HW didn't go through a complete de-initial procedure, ++ If HW didn't go through a complete de-initial procedure, + it probably occurs some problem for double initial procedure. + Like "CONFIG_DEINIT_BEFORE_INIT" in 92du chip + */ +@@ -1340,15 +1306,15 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PW_ON); + status = _InitPowerOn_8814AU(Adapter); +- if(status == _FAIL){ ++ if (status == _FAIL) { + RTW_INFO("Failed to init power on!\n"); + goto exit; + } + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_LLTT); +- ++ + status = InitLLTTable8814A(Adapter); +- if(status == _FAIL){ ++ if (status == _FAIL) { + RTW_INFO("Failed to init LLT table\n"); + goto exit; + } +@@ -1375,8 +1341,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW); + } + + InitializeFirmwareVars8814(Adapter); +- +- if(pwrctrlpriv->reg_rfoff == _TRUE){ ++ ++ if (pwrctrlpriv->reg_rfoff == _TRUE) { + pwrctrlpriv->rf_pwrstate = rf_off; + } + +@@ -1393,16 +1359,15 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MAC); + #if (HAL_MAC_ENABLE == 1) + status = PHY_MACConfig8814(Adapter); +- if(status == _FAIL) +- { ++ if (status == _FAIL) { + goto exit; + } + #endif //HAL_MAC_ENABLE +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC01); +- ++ + _InitQueuePriority_8814AUsb(Adapter); +- _InitPageBoundary_8814AUsb(Adapter); ++ _InitPageBoundary_8814AUsb(Adapter); + + _InitTransferPageSize_8814AUsb(Adapter); + +@@ -1411,8 +1376,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + _InitDriverInfoSize_8814A(Adapter, DRVINFO_SZ); + + _InitInterrupt_8814AU(Adapter); +- _InitID_8814A(Adapter);//set mac_address +- _InitNetworkType_8814A(Adapter);//set msr ++ _InitID_8814A(Adapter); //set mac_address ++ _InitNetworkType_8814A(Adapter); //set msr + _InitMacConfigure_8814A(Adapter); + //_InitWMACSetting_8814A(Adapter); + //_InitAdaptiveCtrl_8814AUsb(Adapter); +@@ -1428,7 +1393,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + + // + // Init CR MACTXEN, MACRXEN after setting RxFF boundary REG_TRXFF_BNDY to patch +- // Hw bug which Hw initials RxFF boundry size to a value which is larger than the real Rx buffer size in 88E. ++ // Hw bug which Hw initials RxFF boundry size to a value which is larger than the real Rx buffer size in 88E. + // 2011.08.05. by tynli. + // + value8 = rtw_read8(Adapter, REG_CR); +@@ -1449,7 +1414,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x3000); // unit: 256us. 3s + #endif // CONFIG_TX_MCAST2UNI + #endif // CONFIG_CONCURRENT_MODE || CONFIG_TX_MCAST2UNI +- ++ + #ifdef CONFIG_LED + _InitHWLed(Adapter); + #endif //CONFIG_LED +@@ -1461,8 +1426,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB); + #if (HAL_BB_ENABLE == 1) + status = PHY_BBConfig8814(Adapter); +- if(status == _FAIL) +- { ++ if (status == _FAIL) { + goto exit; + } + #endif //HAL_BB_ENABLE +@@ -1472,9 +1436,8 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF); + #if (HAL_RF_ENABLE == 1) +- status = PHY_RFConfig8814A(Adapter); +- if(status == _FAIL) +- { ++ status = PHY_RFConfig8814A(Adapter); ++ if (status == _FAIL) { + goto exit; + } + +@@ -1485,12 +1448,12 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF); + + PHY_ConfigBB_8814A(Adapter); + +- if(Adapter->registrypriv.channel <= 14) ++ if (Adapter->registrypriv.channel <= 14) + PHY_SwitchWirelessBand8814A(Adapter, BAND_ON_2_4G); + else + PHY_SwitchWirelessBand8814A(Adapter, BAND_ON_5G); + +- rtw_hal_set_chnl_bw(Adapter, Adapter->registrypriv.channel, ++ rtw_hal_set_chnl_bw(Adapter, Adapter->registrypriv.channel, + CHANNEL_WIDTH_20, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HAL_PRIME_CHNL_OFFSET_DONT_CARE); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_TURN_ON_BLOCK); +@@ -1503,9 +1466,9 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + // HW SEQ CTRL + //set 0x0 to 0xFF by tynli. Default enable HW SEQ NUM. +- rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF); +- +- // ++ rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF); ++ ++ // + // Disable BAR, suggested by Scott + // 2010.04.09 add by hpfan + // +@@ -1513,7 +1476,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + rtw_write8(Adapter,REG_SECONDARY_CCA_CTRL_8814A,0x03); + +- if(pregistrypriv->wifi_spec) ++ if (pregistrypriv->wifi_spec) + rtw_write16(Adapter,REG_FAST_EDCA_CTRL ,0); + //adjust EDCCA to avoid collision + /*if(pregistrypriv->wifi_spec) +@@ -1525,21 +1488,21 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11); + + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM); + rtl8814_InitHalDm(Adapter); +- ++ + // + // 2010/08/11 MH Merge from 8192SE for Minicard init. We need to confirm current radio status +- // and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not ++ // and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not + // call init_adapter. May cause some problem?? + // +- // Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed +- // in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState ++ // Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed ++ // in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState + // is the same as eRfOff, we should change it to eRfOn after we config RF parameters. + // Added by tynli. 2010.03.30. + pwrctrlpriv->rf_pwrstate = rf_on; + + PHY_IQCalibrate_8814A_Init(&pHalData->odmpriv); + +-#if (HAL_BB_ENABLE == 1) ++#if (HAL_BB_ENABLE == 1) + PHY_SetRFEReg8814A(Adapter, _TRUE, pHalData->CurrentBandType); + #endif //HAL_BB_ENABLE + +@@ -1561,13 +1524,12 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM); + // Reset USB mode switch setting + rtw_write8(Adapter, REG_SDIO_CTRL_8814A, 0x0); + rtw_write8(Adapter, REG_ACLK_MON, 0x0); +- ++ + //RT_TRACE(COMP_INIT, DBG_TRACE, ("InitializeAdapter8188EUsb() <====\n")); +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK); + // 2010/08/26 MH Merge from 8192CE. +- if(pwrctrlpriv->rf_pwrstate == rf_on) +- { ++ if (pwrctrlpriv->rf_pwrstate == rf_on) { + /* if(IS_HARDWARE_TYPE_8812AU(Adapter)) + { + #if (RTL8812A_SUPPORT == 1) +@@ -1584,9 +1546,9 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK); + //this should be done by rf team using phydm code + //PHY_IQCalibrate_8814A(&pHalData->odmpriv, _FALSE); + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_PW_TRACK); +- ++ + //ODM_TXPowerTrackingCheck(&pHalData->odmpriv ); +- ++ + HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_LCK); + //PHY_LCCalibrate_8812A(Adapter); + } +@@ -1596,8 +1558,7 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC21); + //HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PABIAS); + // _InitPABias(Adapter); + #if (MP_DRIVER == 1) +- if (Adapter->registrypriv.mp_mode == 1) +- { ++ if (Adapter->registrypriv.mp_mode == 1) { + Adapter->mppriv.channel = pHalData->CurrentChannel; + MPT_InitializeAdapter(Adapter, Adapter->mppriv.channel); + } +@@ -1610,13 +1571,10 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BT_COEXIST); + // suspend mode automatically. + //HwSuspendModeEnable92Cu(Adapter, _FALSE); + +- if ( _TRUE == pHalData->EEPROMBluetoothCoexist) +- { +- // Init BT hw config. +- rtw_btcoex_HAL_Initialize(Adapter, _FALSE); +- } +- else +- { ++ if ( _TRUE == pHalData->EEPROMBluetoothCoexist) { ++ // Init BT hw config. ++ rtw_btcoex_HAL_Initialize(Adapter, _FALSE); ++ } else { + // In combo card run wifi only , must setting some hardware reg. + rtl8812a_combo_card_WifiOnlyHwInit(Adapter); + } +@@ -1633,18 +1591,18 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC31); + + //misc + { +- int i; ++ int i; + u8 mac_addr[6]; +- for(i=0; i<6; i++) +- { ++ for (i=0; i<6; i++) ++ { + #ifdef CONFIG_CONCURRENT_MODE +- if(Adapter->iface_type == IFACE_PORT1) ++ if (Adapter->iface_type == IFACE_PORT1) + mac_addr[i] = rtw_read8(Adapter, REG_MACID1+i); + else + #endif +- mac_addr[i] = rtw_read8(Adapter, REG_MACID+i); ++ mac_addr[i] = rtw_read8(Adapter, REG_MACID+i); + } +- ++ + RTW_INFO("MAC Address from REG_MACID = "MAC_FMT"\n", MAC_ARG(mac_addr)); + } + +@@ -1656,14 +1614,14 @@ HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_END); + #ifdef DBG_HAL_INIT_PROFILING + hal_init_stages_timestamp[HAL_INIT_STAGES_END]=rtw_get_current_time(); + +- for(hal_init_profiling_i=0;hal_init_profiling_ibFWReady = _FALSE; +- ++ + } + + static void rtl8814au_hw_power_down(_adapter *padapter) + { + // 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c. + // Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1. +- ++ + // Enable register area 0x0-0xc. +- rtw_write8(padapter,REG_RSV_CTRL, 0x0); ++ rtw_write8(padapter,REG_RSV_CTRL, 0x0); + rtw_write16(padapter, REG_APS_FSMCO, 0x8812); + } + +@@ -1705,8 +1663,7 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + RTW_INFO("==> %s \n",__FUNCTION__); + + #ifdef CONFIG_BT_COEXIST +- if (hal_btcoex_IsBtExist(Adapter)) +- { ++ if (hal_btcoex_IsBtExist(Adapter)) { + RTW_INFO("BT module enable SIC\n"); + // Only under WIN7 we can support selective suspend and enter D3 state when system call halt adapter. + +@@ -1720,8 +1677,7 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + rtw_write16(Adapter, REG_GPIO_MUXCFG, rtw_read16(Adapter, REG_GPIO_MUXCFG)&(~BIT12)); + } + +- if(pHalData->bSupportUSB3 == _TRUE) +- { ++ if (pHalData->bSupportUSB3 == _TRUE) { + // set Reg 0xf008[3:4] to 2'11 to eable U1/U2 Mode in USB3.0. added by page, 20120712 + rtw_write8(Adapter, 0xf008, rtw_read8(Adapter, 0xf008)|0x18); + } +@@ -1733,33 +1689,32 @@ u32 rtl8814au_hal_deinit(PADAPTER Adapter) + + #ifdef SUPPORT_HW_RFOFF_DETECTED + RTW_INFO("bkeepfwalive(%x)\n", pwrctl->bkeepfwalive); +- if(pwrctl->bkeepfwalive) +- { +- _ps_close_RF(Adapter); +- if((pwrctl->bHWPwrPindetect) && (pwrctl->bHWPowerdown)) ++ if (pwrctl->bkeepfwalive) { ++ _ps_close_RF(Adapter); ++ if ((pwrctl->bHWPwrPindetect) && (pwrctl->bHWPowerdown)) + rtl8814au_hw_power_down(Adapter); + } + else + #endif +- { ++ { + if (rtw_is_hw_init_completed(Adapter)) { + hal_carddisable_8814(Adapter); + +- if((pwrctl->bHWPwrPindetect ) && (pwrctl->bHWPowerdown)) ++ if ((pwrctl->bHWPwrPindetect ) && (pwrctl->bHWPowerdown)) + rtl8814au_hw_power_down(Adapter); + } +- } ++ } + return _SUCCESS; + } + + unsigned int rtl8814au_inirp_init(PADAPTER Adapter) +-{ +- u8 i; ++{ ++ u8 i; + struct recv_buf *precvbuf; + uint status; + struct dvobj_priv *pdev= adapter_to_dvobj(Adapter); + struct intf_hdl * pintfhdl=&Adapter->iopriv.intf; +- struct recv_priv *precvpriv = &(Adapter->recvpriv); ++ struct recv_priv *precvpriv = &(Adapter->recvpriv); + u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem); + #ifdef CONFIG_USB_INTERRUPT_IN_PIPE + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +@@ -1770,22 +1725,20 @@ unsigned int rtl8814au_inirp_init(PADAPTER Adapter) + + status = _SUCCESS; + +- RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n")); +- ++ RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n")); ++ + precvpriv->ff_hwaddr = RECV_BULK_IN_ADDR; + +- //issue Rx irp to receive data +- precvbuf = (struct recv_buf *)precvpriv->precv_buf; +- for(i=0; iff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE ) +- { ++ //issue Rx irp to receive data ++ precvbuf = (struct recv_buf *)precvpriv->precv_buf; ++ for (i=0; iff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE ) { + RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_port error \n")); + status = _FAIL; + goto exit; + } +- +- precvbuf++; ++ ++ precvbuf++; + precvpriv->free_recv_buf_queue_cnt--; + } + +@@ -1794,17 +1747,16 @@ unsigned int rtl8814au_inirp_init(PADAPTER Adapter) + status = _FAIL; + RTW_INFO("%s =>Warning !! Have not USB Int-IN pipe, RtIntInPipe(%d)!!!\n", __func__, pdev->RtInPipe[REALTEK_USB_IN_INT_EP_IDX]); + goto exit; +- } ++ } + _read_interrupt = pintfhdl->io_ops._read_interrupt; +- if(_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE ) +- { ++ if (_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE ) { + RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_interrupt error \n")); + status = _FAIL; + } + #endif + + exit: +- ++ + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("<=== usb_inirp_init \n")); + + return status; +@@ -1812,9 +1764,9 @@ exit: + } + + unsigned int rtl8814au_inirp_deinit(PADAPTER Adapter) +-{ ++{ + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n ===> usb_rx_deinit \n")); +- ++ + rtw_read_port_cancel(Adapter); + + RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n <=== usb_rx_deinit \n")); +@@ -1836,25 +1788,22 @@ hal_ReadIDs_8814AU( + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- if( !AutoloadFail ) +- { ++ if ( !AutoloadFail ) { + pHalData->EEPROMVID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_VID_8814AU] ); +- pHalData->EEPROMPID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_PID_8814AU] ); +- +- // Customer ID, 0x00 and 0xff are reserved for Realtek. ++ pHalData->EEPROMPID = EF2Byte( *(pu2Byte)&PROMContent[EEPROM_PID_8814AU] ); ++ ++ // Customer ID, 0x00 and 0xff are reserved for Realtek. + pHalData->EEPROMCustomerID = *(pu1Byte)&PROMContent[EEPROM_CustomID_8814]; + pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID; +- } +- else +- { ++ } else { + pHalData->EEPROMVID = EEPROM_Default_VID; + pHalData->EEPROMPID = EEPROM_Default_PID; + +- // Customer ID, 0x00 and 0xff are reserved for Realtek. ++ // Customer ID, 0x00 and 0xff are reserved for Realtek. + pHalData->EEPROMCustomerID = EEPROM_Default_CustomerID; + pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID; + } +- ++ + RTW_INFO("VID = 0x%04X, PID = 0x%04X\n", pHalData->EEPROMVID, pHalData->EEPROMPID); + RTW_INFO("Customer ID: 0x%02X, SubCustomer ID: 0x%02X\n", pHalData->EEPROMCustomerID, pHalData->EEPROMSubCustomerID); + } +@@ -1869,18 +1818,15 @@ hal_InitPGData_8814A( + u32 i; + u16 value16; + +- if(_FALSE == pHalData->bautoload_fail_flag) +- { // autoload OK. ++ if (_FALSE == pHalData->bautoload_fail_flag) { // autoload OK. + // hal_ReadeFuse_8814A is FW offload read efuse, todo + //#if ((DEV_BUS_TYPE==RT_USB_INTERFACE || DEV_BUS_TYPE==RT_SDIO_INTERFACE)) && (MP_DRIVER != 1) + //if(hal_ReadeFuse_8814A(pAdapter) == _FAIL) + //#endif +- ++ + // Read EFUSE real map to shadow. + EFUSE_ShadowMapUpdate(padapter, EFUSE_WIFI, _FALSE); +- } +- else +- {//autoload fail ++ } else { //autoload fail + RTW_INFO("AutoLoad Fail reported from CR9346!!\n"); + //update to default value 0xFF + EFUSE_ShadowMapUpdate(padapter, EFUSE_WIFI, _FALSE); +@@ -1899,11 +1845,11 @@ hal_CustomizedBehavior_8814AU( + IN PADAPTER Adapter + ) + { +- HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); ++ HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + struct led_priv *pledpriv = &(Adapter->ledpriv); +- ++ + // Led mode +- switch(pHalData->CustomerID) ++ switch (pHalData->CustomerID) + { + case RT_CID_DEFAULT: + pledpriv->LedStrategy = SW_LED_MODE9; +@@ -1922,48 +1868,48 @@ hal_CustomizeByCustomerID_8814AU( + ) + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter); +- ++ + RTW_INFO("PID= 0x%x, VID= %x\n",pHalData->EEPROMPID,pHalData->EEPROMVID); +- ++ + // Decide CustomerID according to VID/DID or EEPROM +- switch(pHalData->EEPROMCustomerID) ++ switch (pHalData->EEPROMCustomerID) + { + case EEPROM_CID_DEFAULT: +- if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308)) ++ if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309)) ++ else if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a)) ++ else if ((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a)) + pHalData->CustomerID = RT_CID_DLINK; +- else if((pHalData->EEPROMVID == 0x0BFF) && (pHalData->EEPROMPID == 0x8160)) ++ else if ((pHalData->EEPROMVID == 0x0BFF) && (pHalData->EEPROMPID == 0x8160)) + { + pHalData->CustomerID = RT_CID_CHINA_MOBILE; +- } +- else if((pHalData->EEPROMVID == 0x0BDA) && (pHalData->EEPROMPID == 0x5088)) ++ } ++ else if ((pHalData->EEPROMVID == 0x0BDA) && (pHalData->EEPROMPID == 0x5088)) + pHalData->CustomerID = RT_CID_CC_C; +- ++ + break; + case EEPROM_CID_WHQL: + //padapter->bInHctTest = _TRUE; +- ++ + //pMgntInfo->bSupportTurboMode = _FALSE; + //pMgntInfo->bAutoTurboBy8186 = _FALSE; +- ++ + //pMgntInfo->PowerSaveControl.bInactivePs = _FALSE; + //pMgntInfo->PowerSaveControl.bIPSModeBackup = _FALSE; + //pMgntInfo->PowerSaveControl.bLeisurePs = _FALSE; + //pMgntInfo->PowerSaveControl.bLeisurePsModeBackup = _FALSE; + //pMgntInfo->keepAliveLevel = 0; +- ++ + //padapter->bUnloadDriverwhenS3S4 = _FALSE; +- break; ++ break; + default: + pHalData->CustomerID = RT_CID_DEFAULT; + break; +- ++ + } + RTW_INFO("Customer ID: 0x%2x\n", pHalData->CustomerID); +- ++ + hal_CustomizedBehavior_8814AU(pAdapter); + } + +@@ -1975,7 +1921,7 @@ hal_ReadUsbModeSwitch_8814AU( + ) + { + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); +- ++ + if (AutoloadFail) + pHalData->EEPROMUsbSwitch = _FALSE; + else +@@ -1985,7 +1931,7 @@ hal_ReadUsbModeSwitch_8814AU( + + static VOID + ReadLEDSetting_8814AU( +- IN PADAPTER Adapter, ++ IN PADAPTER Adapter, + IN u8* PROMContent, + IN BOOLEAN AutoloadFail + ) +@@ -2015,19 +1961,19 @@ InitAdapterVariablesByPROM_8814AU( + hal_ReadTxPowerInfo8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadBoardType8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_Read_TRX_antenna_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + // + // Read Bluetooth co-exist and initialize + // + hal_EfuseParseBTCoexistInfo8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + hal_ReadChannelPlan8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_EfuseParseXtal_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadThermalMeter_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadRemoteWakeup_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadAntennaDiversity8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + hal_ReadRFEType_8814A(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +- ++ + ReadLEDSetting_8814AU(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); + + hal_ReadUsbModeSwitch_8814AU(Adapter, pHalData->efuse_eeprom_data, pHalData->bautoload_fail_flag); +@@ -2041,7 +1987,7 @@ InitAdapterVariablesByPROM_8814AU( + static void hal_ReadPROMContent_8814A( + IN PADAPTER Adapter + ) +-{ ++{ + PHAL_DATA_TYPE pHalData = GET_HAL_DATA(Adapter); + u8 eeValue; + +@@ -2064,7 +2010,7 @@ ReadAdapterInfo8814AU( + ) + { + Hal_InitEfuseVars_8814A(Adapter); +- ++ + // Read all content in Efuse/EEPROM. + hal_ReadPROMContent_8814A(Adapter); + +@@ -2079,21 +2025,21 @@ void UpdateInterruptMask8814AU(PADAPTER padapter,u8 bHIMR0 ,u32 AddMSR, u32 Remo + u32 *himr; + pHalData = GET_HAL_DATA(padapter); + +- if(bHIMR0) ++ if (bHIMR0) + himr = &(pHalData->IntrMask[0]); + else + himr = &(pHalData->IntrMask[1]); +- ++ + if (AddMSR) + *himr |= AddMSR; + + if (RemoveMSR) + *himr &= (~RemoveMSR); + +- if(bHIMR0) ++ if (bHIMR0) + rtw_write32(padapter, REG_HIMR0_8814A, *himr); + else +- rtw_write32(padapter, REG_HIMR1_8814A, *himr); ++ rtw_write32(padapter, REG_HIMR1_8814A, *himr); + + } + +@@ -2103,7 +2049,7 @@ void SetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + struct pwrctrl_priv *pwrctl = adapter_to_pwrctl(Adapter); + struct registry_priv *registry_par = &Adapter->registrypriv; + +- switch(variable) ++ switch (variable) + { + case HW_VAR_RXDMA_AGG_PG_TH: + #ifdef CONFIG_USB_RX_AGGREGATION +@@ -2185,9 +2131,9 @@ void SetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + + void GetHwReg8814AU(PADAPTER Adapter, u8 variable, u8* val) + { +- HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); ++ HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + +- switch(variable) ++ switch (variable) + { + default: + GetHwReg8814A(Adapter,variable,val); +@@ -2210,7 +2156,7 @@ SetHalDefVar8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u8 bResult = _SUCCESS; + +- switch(eVariable) ++ switch (eVariable) + { + default: + SetHalDefVar8814A(Adapter,eVariable,pValue); +@@ -2221,7 +2167,7 @@ SetHalDefVar8814AUsb( + } + + // +-// Description: ++// Description: + // Query setting of specified variable. + // + u8 +@@ -2234,7 +2180,7 @@ GetHalDefVar8814AUsb( + HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter); + u8 bResult = _SUCCESS; + +- switch(eVariable) ++ switch (eVariable) + { + default: + GetHalDefVar8814A(Adapter,eVariable,pValue); +@@ -2302,9 +2248,9 @@ static void rtl8814au_init_default_value(_adapter * padapter) + } + + static u8 rtl8814au_ps_func(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8 *val) +-{ ++{ + u8 bResult = _TRUE; +- switch(efunc_id){ ++ switch (efunc_id) { + + #if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED) + case HAL_USB_SELECT_SUSPEND: +@@ -2327,7 +2273,7 @@ void rtl8814au_set_hal_ops(_adapter * padapter) + + pHalFunc->hal_power_on = _InitPowerOn_8814AU; + pHalFunc->hal_power_off = hal_carddisable_8814; +- ++ + pHalFunc->hal_init = &rtl8814au_hal_init; + pHalFunc->hal_deinit = &rtl8814au_hal_deinit; + +@@ -2345,12 +2291,12 @@ void rtl8814au_set_hal_ops(_adapter * padapter) + #else //case of hw led or no led + pHalFunc->InitSwLeds = NULL; + pHalFunc->DeInitSwLeds = NULL; +-#endif//CONFIG_SW_LED +- ++#endif //CONFIG_SW_LED ++ + pHalFunc->init_default_value = &rtl8814au_init_default_value; + pHalFunc->intf_chip_configure = &rtl8814au_interface_configure; + pHalFunc->read_adapter_info = &ReadAdapterInfo8814AU; +- ++ + pHalFunc->SetHwRegHandler = &SetHwReg8814AU; + pHalFunc->GetHwRegHandler = &GetHwReg8814AU; + pHalFunc->GetHalDefVarHandler = &GetHalDefVar8814AUsb; +diff --git a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_ops_linux.c b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_ops_linux.c +index 59281f9..d2fea87 100644 +--- a/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_ops_linux.c ++++ b/drivers/net/wireless/rtl8814au/hal/rtl8814a/usb/usb_ops_linux.c +@@ -1,7 +1,7 @@ + /****************************************************************************** + * + * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved. +- * ++ * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. +@@ -24,17 +24,16 @@ + + #ifdef CONFIG_SUPPORT_USB_INT + void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) +-{ ++{ + HAL_DATA_TYPE *pHalData=GET_HAL_DATA(padapter); + struct reportpwrstate_parm pwr_rpt; +- +- if ( pkt_len != INTERRUPT_MSG_FORMAT_LEN ) +- { ++ ++ if ( pkt_len != INTERRUPT_MSG_FORMAT_LEN ) { + RTW_INFO("%s Invalid interrupt content length (%d)!\n", __FUNCTION__, pkt_len); + return ; + } + +- // HISR ++ // HISR + _rtw_memcpy(&(pHalData->IntArray[0]), &(pbuf[USB_INTR_CONTENT_HISR_OFFSET]), 4); + _rtw_memcpy(&(pHalData->IntArray[1]), &(pbuf[USB_INTR_CONTENT_HISRE_OFFSET]), 4); + +@@ -42,25 +41,24 @@ void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) + { + u32 hisr=0 ,hisr_ex=0; + _rtw_memcpy(&hisr,&(pHalData->IntArray[0]),4); +- hisr = le32_to_cpu(hisr); +- ++ hisr = le32_to_cpu(hisr); ++ + _rtw_memcpy(&hisr_ex,&(pHalData->IntArray[1]),4); + hisr_ex = le32_to_cpu(hisr_ex); +- +- if((hisr != 0) || (hisr_ex!=0)) ++ ++ if ((hisr != 0) || (hisr_ex!=0)) + RTW_INFO("===> %s hisr:0x%08x ,hisr_ex:0x%08x \n",__FUNCTION__,hisr,hisr_ex); + } + #endif + + + #ifdef CONFIG_LPS_LCLK +- if( pHalData->IntArray[0] & IMR_CPWM_88E ) +- { ++ if ( pHalData->IntArray[0] & IMR_CPWM_88E ) { + _rtw_memcpy(&pwr_rpt.state, &(pbuf[USB_INTR_CONTENT_CPWM1_OFFSET]), 1); + //_rtw_memcpy(&pwr_rpt.state2, &(pbuf[USB_INTR_CONTENT_CPWM2_OFFSET]), 1); + +- //88e's cpwm value only change BIT0, so driver need to add PS_STATE_S2 for LPS flow. +- pwr_rpt.state |= PS_STATE_S2; ++ //88e's cpwm value only change BIT0, so driver need to add PS_STATE_S2 for LPS flow. ++ pwr_rpt.state |= PS_STATE_S2; + _set_workitem(&(adapter_to_pwrctl(padapter)->cpwm_event)); + } + #endif//CONFIG_LPS_LCLK +@@ -72,40 +70,38 @@ void interrupt_handler_8814au(_adapter *padapter,u16 pkt_len,u8 *pbuf) + #endif + #ifdef CONFIG_INTERRUPT_BASED_TXBCN_BCN_OK_ERR + if (pHalData->IntArray[0] & (IMR_TBDER_88E|IMR_TBDOK_88E)) +- #endif +- { ++ #endif ++ { + struct mlme_priv *pmlmepriv = &padapter->mlmepriv; + #if 0 +- if(pHalData->IntArray[0] & IMR_BCNDMAINT0_88E) ++ if (pHalData->IntArray[0] & IMR_BCNDMAINT0_88E) + RTW_INFO("%s: HISR_BCNERLY_INT\n", __func__); +- if(pHalData->IntArray[0] & IMR_TBDOK_88E) ++ if (pHalData->IntArray[0] & IMR_TBDOK_88E) + RTW_INFO("%s: HISR_TXBCNOK\n", __func__); +- if(pHalData->IntArray[0] & IMR_TBDER_88E) ++ if (pHalData->IntArray[0] & IMR_TBDER_88E) + RTW_INFO("%s: HISR_TXBCNERR\n", __func__); + #endif +- + +- if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) +- { ++ ++ if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) { + //send_beacon(padapter); +- if(pmlmepriv->update_bcn == _TRUE) ++ if (pmlmepriv->update_bcn == _TRUE) + { + //tx_beacon_hdl(padapter, NULL); + set_tx_beacon_cmd(padapter); + } + } + #ifdef CONFIG_CONCURRENT_MODE +- if(check_buddy_fwstate(padapter, WIFI_AP_STATE)) +- { ++ if (check_buddy_fwstate(padapter, WIFI_AP_STATE)) { + //send_beacon(padapter); +- if(padapter->pbuddy_adapter->mlmepriv.update_bcn == _TRUE) ++ if (padapter->pbuddy_adapter->mlmepriv.update_bcn == _TRUE) + { + //tx_beacon_hdl(padapter, NULL); + set_tx_beacon_cmd(padapter->pbuddy_adapter); + } + } + #endif +- ++ + } + #endif //CONFIG_INTERRUPT_BASED_TXBCN + +@@ -361,8 +357,9 @@ int recvbuf2recvframe(PADAPTER padapter, void *ptr) + } + + #ifdef CONFIG_RX_PACKET_APPEND_FCS +- if(pattrib->pkt_rpt_type == NORMAL_RX) +- pattrib->pkt_len -= IEEE80211_FCS_LEN; ++ if (check_fwstate(&padapter->mlmepriv, WIFI_MONITOR_STATE) == _FALSE) ++ if ((pattrib->pkt_rpt_type == NORMAL_RX) && (pHalData->ReceiveConfig & RCR_APPFCS)) ++ pattrib->pkt_len -= IEEE80211_FCS_LEN; + #endif + if(rtw_os_alloc_recvframe(padapter, precvframe, + (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), pskb) == _FAIL) +diff --git a/drivers/net/wireless/rtl8814au/include/autoconf.h b/drivers/net/wireless/rtl8814au/include/autoconf.h +index 2e1c614..3c1713f 100644 +--- a/drivers/net/wireless/rtl8814au/include/autoconf.h ++++ b/drivers/net/wireless/rtl8814au/include/autoconf.h +@@ -309,7 +309,6 @@ + #endif /* !CONFIG_BT_COEXIST */ + + +- + #ifdef CONFIG_USB_TX_AGGREGATION + /* #define CONFIG_TX_EARLY_MODE */ + #endif +@@ -347,12 +346,11 @@ + /* #define DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED "jeff-ap" */ + + +- + /* #define DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE */ + /* #define DBG_ROAMING_TEST */ + + /* #define DBG_HAL_INIT_PROFILING */ + +-/*#define DBG_MEMORY_LEAK*/ ++/* #define DBG_MEMORY_LEAK*/ + #define DBG_RX_DFRAME_RAW_DATA +-/*#define CONFIG_USE_EXTERNAL_POWER */ /* NOT USB2.0 power, so no 500mA power constraint, no limitation in Power by Rate*/ ++/* #define CONFIG_USE_EXTERNAL_POWER */ /* NOT USB2.0 power, so no 500mA power constraint, no limitation in Power by Rate */ +diff --git a/drivers/net/wireless/rtl8814au/include/rtw_wifi_regd.h b/drivers/net/wireless/rtl8814au/include/rtw_wifi_regd.h +index 69bd71d..7acbb95 100644 +--- a/drivers/net/wireless/rtl8814au/include/rtw_wifi_regd.h ++++ b/drivers/net/wireless/rtl8814au/include/rtw_wifi_regd.h +@@ -5,7 +5,7 @@ + *****************************************************************************/ + + #ifndef __RTW_WIFI_REGD_H__ +-#define __RTW_WIFI_REGD_H__ ++#define __RTW_WIFI_REGD_H__ + + int rtw_regd_init(_adapter *padapter); + void rtw_reg_notify_by_driver(_adapter *adapter); +diff --git a/drivers/net/wireless/rtl8814au/include/rtw_xmit.h b/drivers/net/wireless/rtl8814au/include/rtw_xmit.h +index d372338..6b5ea43 100644 +--- a/drivers/net/wireless/rtl8814au/include/rtw_xmit.h ++++ b/drivers/net/wireless/rtl8814au/include/rtw_xmit.h +@@ -421,7 +421,7 @@ struct pkt_attrib { + u8 rate; + u8 intel_proxim; + u8 retry_ctrl; +- u8 sw_seq; ++ //u8 sw_seq; // Add support for pre-configured SeqNum via RadioTap + u8 mbssid; + u8 ldpc; + u8 stbc; +diff --git a/drivers/net/wireless/rtl8814au/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/rtl8814au/os_dep/linux/ioctl_cfg80211.c +index 8a7e088..17937e7 100644 +--- a/drivers/net/wireless/rtl8814au/os_dep/linux/ioctl_cfg80211.c ++++ b/drivers/net/wireless/rtl8814au/os_dep/linux/ioctl_cfg80211.c +@@ -1750,6 +1750,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, + + sinfo->filled |= STATION_INFO_BSS_PARAM; + ++#if defined (LINUX_VERSION_CODE) && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 20, 0)) + if (!psta->no_short_preamble_set) + sinfo->bss_param.flags |= STATION_INFO_BSS_PARAM_SHORT_PREAMBLE; + +@@ -1765,6 +1766,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, + sinfo->bss_param.dtim_period = pwrctl->dtim; + + sinfo->bss_param.beacon_interval = get_beacon_interval(&cur_network->network); ++#endif + + } + +diff --git a/drivers/net/wireless/rtl8814au/os_dep/linux/recv_linux.c b/drivers/net/wireless/rtl8814au/os_dep/linux/recv_linux.c +index 52fbba5..a802a9d 100644 +--- a/drivers/net/wireless/rtl8814au/os_dep/linux/recv_linux.c ++++ b/drivers/net/wireless/rtl8814au/os_dep/linux/recv_linux.c +@@ -445,10 +445,11 @@ void rtw_os_recv_indicate_pkt(_adapter *padapter, _pkt *pkt, struct rx_pkt_attri + #endif /* CONFIG_TCP_CSUM_OFFLOAD_RX */ + + ret = rtw_netif_rx(padapter->pnetdev, pkt); +- if (ret == NET_RX_SUCCESS) ++ if (ret == NET_RX_SUCCESS) { + DBG_COUNTER(padapter->rx_logs.os_netif_ok); +- else ++ } else { + DBG_COUNTER(padapter->rx_logs.os_netif_err); ++ } + } + } + +diff --git a/drivers/net/wireless/rtl8814au/os_dep/linux/usb_intf.c b/drivers/net/wireless/rtl8814au/os_dep/linux/usb_intf.c +index 6ed4e72..47b3435 100644 +--- a/drivers/net/wireless/rtl8814au/os_dep/linux/usb_intf.c ++++ b/drivers/net/wireless/rtl8814au/os_dep/linux/usb_intf.c +@@ -222,6 +222,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x331A), .driver_info = RTL8814A}, /* D-Link - D-Link */ + {USB_DEVICE(0x0B05, 0x1817), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ + {USB_DEVICE(0x0B05, 0x1852), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ ++ {USB_DEVICE(0x0B05, 0x1853), .driver_info = RTL8814A}, /* ASUS - ASUSTeK */ + {USB_DEVICE(0x056E, 0x400B), .driver_info = RTL8814A}, /* ELECOM - ELECOM */ + {USB_DEVICE(0x056E, 0x400D), .driver_info = RTL8814A}, /* ELECOM - ELECOM */ + {USB_DEVICE(0x7392, 0xA834), .driver_info = RTL8814A}, /* Edimax - Edimax */ +diff --git a/drivers/net/wireless/rtl8814au/os_dep/linux/wifi_regd.c b/drivers/net/wireless/rtl8814au/os_dep/linux/wifi_regd.c +index fa8ba7b..b0a4abd 100644 +--- a/drivers/net/wireless/rtl8814au/os_dep/linux/wifi_regd.c ++++ b/drivers/net/wireless/rtl8814au/os_dep/linux/wifi_regd.c +@@ -15,8 +15,8 @@ void rtw_reg_notify_by_driver(_adapter *adapter) + return; + } + +-int rtw_regd_init(_adapter *padapter) ++int rtw_regd_init(_adapter * padapter) + { + return 0; + } +-#endif /* CONFIG_IOCTL_CFG80211 */ ++#endif //CONFIG_IOCTL_CFG80211 diff --git a/patch/kernel/mvebu-next/90-01-rtl8188eu-kconfig-makefile.patch b/patch/kernel/mvebu-next/wifi-2001-01-rtl8188eu-kconfig-makefile.patch similarity index 100% rename from patch/kernel/mvebu-next/90-01-rtl8188eu-kconfig-makefile.patch rename to patch/kernel/mvebu-next/wifi-2001-01-rtl8188eu-kconfig-makefile.patch diff --git a/patch/kernel/mvebu-next/90-02-rtl8188eu.patch b/patch/kernel/mvebu-next/wifi-2002-02-rtl8188eu.patch similarity index 100% rename from patch/kernel/mvebu-next/90-02-rtl8188eu.patch rename to patch/kernel/mvebu-next/wifi-2002-02-rtl8188eu.patch