diff --git a/config/kernel/linux-mvebu-default.config b/config/kernel/linux-mvebu-default.config index 2a4e7a58f..34a1a8ae2 100644 --- a/config/kernel/linux-mvebu-default.config +++ b/config/kernel/linux-mvebu-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.153 Kernel Configuration +# Linux/arm 4.4.158 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -1447,7 +1447,6 @@ CONFIG_BT_HCIUART_H4=y CONFIG_BT_HCIUART_BCSP=y CONFIG_BT_HCIUART_ATH3K=y CONFIG_BT_HCIUART_LL=y -CONFIG_BT_HCIUART_3WIRE=y CONFIG_BT_HCIUART_INTEL=y CONFIG_BT_HCIUART_BCM=y CONFIG_BT_HCIUART_QCA=y diff --git a/config/kernel/linux-rockchip-default.config b/config/kernel/linux-rockchip-default.config index a47ec0382..ed0226419 100644 --- a/config/kernel/linux-rockchip-default.config +++ b/config/kernel/linux-rockchip-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.155 Kernel Configuration +# Linux/arm 4.4.158 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -1253,7 +1253,6 @@ CONFIG_BT_HCIUART_H4=y # CONFIG_BT_HCIUART_BCSP is not set CONFIG_BT_HCIUART_ATH3K=y CONFIG_BT_HCIUART_LL=y -CONFIG_BT_HCIUART_3WIRE=y # CONFIG_BT_HCIUART_INTEL is not set CONFIG_BT_HCIUART_BCM=y # CONFIG_BT_HCIUART_QCA is not set @@ -2891,6 +2890,10 @@ CONFIG_MEDIA_ATTACH=y # Video improvement chips # +# +# Camera lens devices +# + # # Audio/Video compression chips # @@ -3073,7 +3076,6 @@ CONFIG_DRM_ROCKCHIP=y # CONFIG_ROCKCHIP_CDN_DP is not set CONFIG_ROCKCHIP_DW_HDMI=y # CONFIG_ROCKCHIP_DW_MIPI_DSI is not set -CONFIG_ROCKCHIP_MIPI_CSI_TX=m CONFIG_ROCKCHIP_ANALOGIX_DP=y CONFIG_ROCKCHIP_INNO_HDMI=y CONFIG_ROCKCHIP_LVDS=y @@ -4264,7 +4266,6 @@ CONFIG_CPU_RK3288=y CONFIG_CPU_RK322X=y CONFIG_CPU_RV110X=y # CONFIG_CPU_PX30 is not set -# CONFIG_CPU_RK1808 is not set # CONFIG_CPU_RK3308 is not set # CONFIG_CPU_RK3328 is not set # CONFIG_CPU_RK3366 is not set diff --git a/config/kernel/linux-rockchip64-default.config b/config/kernel/linux-rockchip64-default.config index 2842e6495..87b924bc4 100644 --- a/config/kernel/linux-rockchip64-default.config +++ b/config/kernel/linux-rockchip64-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.4.155 Kernel Configuration +# Linux/arm64 4.4.158 Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y @@ -1182,7 +1182,6 @@ CONFIG_BT_HCIUART_H4=y # CONFIG_BT_HCIUART_BCSP is not set CONFIG_BT_HCIUART_ATH3K=y CONFIG_BT_HCIUART_LL=y -CONFIG_BT_HCIUART_3WIRE=y CONFIG_BT_HCIUART_INTEL=y CONFIG_BT_HCIUART_BCM=y CONFIG_BT_HCIUART_QCA=y diff --git a/lib/configuration.sh b/lib/configuration.sh index 59de515e4..321d543f1 100644 --- a/lib/configuration.sh +++ b/lib/configuration.sh @@ -10,7 +10,7 @@ # common options # daily beta build contains date in subrevision if [[ $BETA == yes && -z $SUBREVISION ]]; then SUBREVISION="."$(date --date="tomorrow" +"%y%m%d"); fi -REVISION="5.60$SUBREVISION" # all boards have same revision +REVISION="5.61$SUBREVISION" # all boards have same revision ROOTPWD="1234" # Must be changed @first login MAINTAINER="Igor Pecovnik" # deb signature MAINTAINERMAIL="igor.pecovnik@****l.com" # deb signature diff --git a/patch/kernel/mvebu-default/04-patch-4.4.153-154.patch b/patch/kernel/mvebu-default/04-patch-4.4.153-154.patch new file mode 100644 index 000000000..0cea34727 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.153-154.patch @@ -0,0 +1,2047 @@ +diff --git a/Makefile b/Makefile +index 208a813be615..b184286cf7e6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 153 ++SUBLEVEL = 154 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h +index d5da2115d78a..03d6bb0f4e13 100644 +--- a/arch/arc/include/asm/delay.h ++++ b/arch/arc/include/asm/delay.h +@@ -17,8 +17,11 @@ + #ifndef __ASM_ARC_UDELAY_H + #define __ASM_ARC_UDELAY_H + ++#include + #include /* HZ */ + ++extern unsigned long loops_per_jiffy; ++ + static inline void __delay(unsigned long loops) + { + __asm__ __volatile__( +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index 9a84cbdd44b0..017fb440bba4 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -821,7 +821,7 @@ void flush_cache_mm(struct mm_struct *mm) + void flush_cache_page(struct vm_area_struct *vma, unsigned long u_vaddr, + unsigned long pfn) + { +- unsigned int paddr = pfn << PAGE_SHIFT; ++ phys_addr_t paddr = pfn << PAGE_SHIFT; + + u_vaddr &= PAGE_MASK; + +@@ -841,8 +841,9 @@ void flush_anon_page(struct vm_area_struct *vma, struct page *page, + unsigned long u_vaddr) + { + /* TBD: do we really need to clear the kernel mapping */ +- __flush_dcache_page(page_address(page), u_vaddr); +- __flush_dcache_page(page_address(page), page_address(page)); ++ __flush_dcache_page((phys_addr_t)page_address(page), u_vaddr); ++ __flush_dcache_page((phys_addr_t)page_address(page), ++ (phys_addr_t)page_address(page)); + + } + +diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c +index e8835d4e173c..e0267532bd4e 100644 +--- a/arch/arm/kvm/mmu.c ++++ b/arch/arm/kvm/mmu.c +@@ -892,19 +892,35 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache + pmd = stage2_get_pmd(kvm, cache, addr); + VM_BUG_ON(!pmd); + +- /* +- * Mapping in huge pages should only happen through a fault. If a +- * page is merged into a transparent huge page, the individual +- * subpages of that huge page should be unmapped through MMU +- * notifiers before we get here. +- * +- * Merging of CompoundPages is not supported; they should become +- * splitting first, unmapped, merged, and mapped back in on-demand. +- */ +- VM_BUG_ON(pmd_present(*pmd) && pmd_pfn(*pmd) != pmd_pfn(*new_pmd)); +- + old_pmd = *pmd; + if (pmd_present(old_pmd)) { ++ /* ++ * Multiple vcpus faulting on the same PMD entry, can ++ * lead to them sequentially updating the PMD with the ++ * same value. Following the break-before-make ++ * (pmd_clear() followed by tlb_flush()) process can ++ * hinder forward progress due to refaults generated ++ * on missing translations. ++ * ++ * Skip updating the page table if the entry is ++ * unchanged. ++ */ ++ if (pmd_val(old_pmd) == pmd_val(*new_pmd)) ++ return 0; ++ ++ /* ++ * Mapping in huge pages should only happen through a ++ * fault. If a page is merged into a transparent huge ++ * page, the individual subpages of that huge page ++ * should be unmapped through MMU notifiers before we ++ * get here. ++ * ++ * Merging of CompoundPages is not supported; they ++ * should become splitting first, unmapped, merged, ++ * and mapped back in on-demand. ++ */ ++ VM_BUG_ON(pmd_pfn(old_pmd) != pmd_pfn(*new_pmd)); ++ + pmd_clear(pmd); + kvm_tlb_flush_vmid_ipa(kvm, addr); + } else { +@@ -961,6 +977,10 @@ static int stage2_set_pte(struct kvm *kvm, struct kvm_mmu_memory_cache *cache, + /* Create 2nd stage page table mapping - Level 3 */ + old_pte = *pte; + if (pte_present(old_pte)) { ++ /* Skip page table update if there is no change */ ++ if (pte_val(old_pte) == pte_val(*new_pte)) ++ return 0; ++ + kvm_set_pte(pte, __pte(0)); + kvm_tlb_flush_vmid_ipa(kvm, addr); + } else { +diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c +index 4ca33175ec05..6d38948f0f1e 100644 +--- a/arch/mips/bcm47xx/setup.c ++++ b/arch/mips/bcm47xx/setup.c +@@ -249,12 +249,6 @@ static int __init bcm47xx_cpu_fixes(void) + */ + if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706) + cpu_wait = NULL; +- +- /* +- * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail" +- * Enable ExternalSync for sync instruction to take effect +- */ +- set_c0_config7(MIPS_CONF7_ES); + break; + #endif + } +diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h +index 15c183ce9d4f..e43aca183c99 100644 +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -605,8 +605,6 @@ + #define MIPS_CONF7_WII (_ULCAST_(1) << 31) + + #define MIPS_CONF7_RPS (_ULCAST_(1) << 2) +-/* ExternalSync */ +-#define MIPS_CONF7_ES (_ULCAST_(1) << 8) + + #define MIPS_CONF7_IAR (_ULCAST_(1) << 10) + #define MIPS_CONF7_AR (_ULCAST_(1) << 16) +@@ -2014,7 +2012,6 @@ __BUILD_SET_C0(status) + __BUILD_SET_C0(cause) + __BUILD_SET_C0(config) + __BUILD_SET_C0(config5) +-__BUILD_SET_C0(config7) + __BUILD_SET_C0(intcontrol) + __BUILD_SET_C0(intctl) + __BUILD_SET_C0(srsmap) +diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h +index 041153f5cf93..41a8201d572e 100644 +--- a/arch/mips/include/asm/processor.h ++++ b/arch/mips/include/asm/processor.h +@@ -131,7 +131,7 @@ struct mips_fpu_struct { + + #define NUM_DSP_REGS 6 + +-typedef __u32 dspreg_t; ++typedef unsigned long dspreg_t; + + struct mips_dsp_state { + dspreg_t dspr[NUM_DSP_REGS]; +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index 32fa3ae1a0a6..5a869515b393 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -879,7 +879,7 @@ long arch_ptrace(struct task_struct *child, long request, + goto out; + } + dregs = __get_dsp_regs(child); +- tmp = (unsigned long) (dregs[addr - DSP_BASE]); ++ tmp = dregs[addr - DSP_BASE]; + break; + } + case DSP_CONTROL: +diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c +index d95117e71f69..286ec2d24d47 100644 +--- a/arch/mips/kernel/ptrace32.c ++++ b/arch/mips/kernel/ptrace32.c +@@ -140,7 +140,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + goto out; + } + dregs = __get_dsp_regs(child); +- tmp = (unsigned long) (dregs[addr - DSP_BASE]); ++ tmp = dregs[addr - DSP_BASE]; + break; + } + case DSP_CONTROL: +diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c +index 111ad475aa0c..4c2483f410c2 100644 +--- a/arch/mips/lib/multi3.c ++++ b/arch/mips/lib/multi3.c +@@ -4,12 +4,12 @@ + #include "libgcc.h" + + /* +- * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that +- * specific case only we'll implement it here. ++ * GCC 7 & older can suboptimally generate __multi3 calls for mips64r6, so for ++ * that specific case only we implement that intrinsic here. + * + * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981 + */ +-#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7) ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ < 8) + + /* multiply 64-bit values, low 64-bits returned */ + static inline long long notrace dmulu(long long a, long long b) +diff --git a/arch/s390/include/asm/qdio.h b/arch/s390/include/asm/qdio.h +index 998b61cd0e56..4b39ba700d32 100644 +--- a/arch/s390/include/asm/qdio.h ++++ b/arch/s390/include/asm/qdio.h +@@ -261,7 +261,6 @@ struct qdio_outbuf_state { + void *user; + }; + +-#define QDIO_OUTBUF_STATE_FLAG_NONE 0x00 + #define QDIO_OUTBUF_STATE_FLAG_PENDING 0x01 + + #define CHSC_AC1_INITIATE_INPUTQ 0x80 +diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c +index ec1a30d0d11a..7218689bd6ee 100644 +--- a/arch/s390/mm/fault.c ++++ b/arch/s390/mm/fault.c +@@ -459,6 +459,8 @@ retry: + /* No reason to continue if interrupted by SIGKILL. */ + if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) { + fault = VM_FAULT_SIGNAL; ++ if (flags & FAULT_FLAG_RETRY_NOWAIT) ++ goto out_up; + goto out; + } + if (unlikely(fault & VM_FAULT_ERROR)) +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index a26528afceb2..727693e283da 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -522,8 +522,6 @@ static void bpf_jit_epilogue(struct bpf_jit *jit) + /* br %r1 */ + _EMIT2(0x07f1); + } else { +- /* larl %r1,.+14 */ +- EMIT6_PCREL_RILB(0xc0000000, REG_1, jit->prg + 14); + /* ex 0,S390_lowcore.br_r1_tampoline */ + EMIT4_DISP(0x44000000, REG_0, REG_0, + offsetof(struct _lowcore, br_r1_trampoline)); +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index ef0499b76c50..9a5754d4ee87 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -412,6 +412,8 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) + hwirq = 0; + for_each_pci_msi_entry(msi, pdev) { + rc = -EIO; ++ if (hwirq >= msi_vecs) ++ break; + irq = irq_alloc_desc(0); /* Alloc irq on node 0 */ + if (irq < 0) + goto out_msi; +diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h +index cb7f04981c6b..8afbdcd3032b 100644 +--- a/arch/x86/include/asm/irqflags.h ++++ b/arch/x86/include/asm/irqflags.h +@@ -28,7 +28,8 @@ extern inline unsigned long native_save_fl(void) + return flags; + } + +-static inline void native_restore_fl(unsigned long flags) ++extern inline void native_restore_fl(unsigned long flags); ++extern inline void native_restore_fl(unsigned long flags) + { + asm volatile("push %0 ; popf" + : /* no output */ +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index a3a53955f01c..337c52192278 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -172,9 +172,9 @@ extern const struct seq_operations cpuinfo_op; + + extern void cpu_detect(struct cpuinfo_x86 *c); + +-static inline unsigned long l1tf_pfn_limit(void) ++static inline unsigned long long l1tf_pfn_limit(void) + { +- return BIT(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT) - 1; ++ return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); + } + + extern void early_cpu_init(void); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 34e4aaaf03d2..b9e6b60df148 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -654,6 +654,10 @@ static void __init l1tf_select_mitigation(void) + half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; + if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); ++ pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n", ++ half_pa); ++ pr_info("However, doing so will make a part of your RAM unusable.\n"); ++ pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html might help you decide.\n"); + return; + } + +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 4dce22d3cb06..b18fe3d245fe 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -74,6 +74,9 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c) + if (cpu_has(c, X86_FEATURE_HYPERVISOR)) + return false; + ++ if (c->x86 != 6) ++ return false; ++ + for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) { + if (c->x86_model == spectre_bad_microcodes[i].model && + c->x86_mask == spectre_bad_microcodes[i].stepping) +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 4cbb60fbff3e..c7cc81e9bb84 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -250,6 +250,7 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) + start_thread_common(regs, new_ip, new_sp, + __USER_CS, __USER_DS, 0); + } ++EXPORT_SYMBOL_GPL(start_thread); + + #ifdef CONFIG_COMPAT + void compat_start_thread(struct pt_regs *regs, u32 new_ip, u32 new_sp) +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 4954a6cef50a..f00eb52c16a6 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -779,7 +779,7 @@ unsigned long max_swapfile_size(void) + + if (boot_cpu_has_bug(X86_BUG_L1TF)) { + /* Limit the swap file size to MAX_PA/2 for L1TF workaround */ +- unsigned long l1tf_limit = l1tf_pfn_limit() + 1; ++ unsigned long long l1tf_limit = l1tf_pfn_limit(); + /* + * We encode swap offsets also with 3 bits below those for pfn + * which makes the usable limit higher. +@@ -787,7 +787,7 @@ unsigned long max_swapfile_size(void) + #if CONFIG_PGTABLE_LEVELS > 2 + l1tf_limit <<= PAGE_SHIFT - SWP_OFFSET_FIRST_BIT; + #endif +- pages = min_t(unsigned long, l1tf_limit, pages); ++ pages = min_t(unsigned long long, l1tf_limit, pages); + } + return pages; + } +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index 9a055ea279eb..528d71b50c3b 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -138,7 +138,7 @@ bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot) + /* If it's real memory always allow */ + if (pfn_valid(pfn)) + return true; +- if (pfn > l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN)) ++ if (pfn >= l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN)) + return false; + return true; + } +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 0151039bff05..1012b2cb6a16 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2526,7 +2526,7 @@ static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi, + if (!CDROM_CAN(CDC_SELECT_DISC) || + (arg == CDSL_CURRENT || arg == CDSL_NONE)) + return cdi->ops->drive_status(cdi, CDSL_CURRENT); +- if (((int)arg >= cdi->capacity)) ++ if (arg >= cdi->capacity) + return -EINVAL; + return cdrom_slot_status(cdi, arg); + } +diff --git a/drivers/gpu/drm/i2c/adv7511.c b/drivers/gpu/drm/i2c/adv7511.c +index dba5c0ea0827..c7c243e9b808 100644 +--- a/drivers/gpu/drm/i2c/adv7511.c ++++ b/drivers/gpu/drm/i2c/adv7511.c +@@ -450,6 +450,18 @@ static void adv7511_hpd_work(struct work_struct *work) + else + status = connector_status_disconnected; + ++ /* ++ * The bridge resets its registers on unplug. So when we get a plug ++ * event and we're already supposed to be powered, cycle the bridge to ++ * restore its state. ++ */ ++ if (status == connector_status_connected && ++ adv7511->connector.status == connector_status_disconnected && ++ adv7511->powered) { ++ regcache_mark_dirty(adv7511->regmap); ++ adv7511_power_on(adv7511); ++ } ++ + if (adv7511->connector.status != status) { + adv7511->connector.status = status; + drm_kms_helper_hotplug_event(adv7511->connector.dev); +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index abacc8f67469..31ca56e593f5 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -526,6 +526,9 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + return PTR_ERR(imx_ldb->regmap); + } + ++ /* disable LDB by resetting the control register to POR default */ ++ regmap_write(imx_ldb->regmap, IOMUXC_GPR2, 0); ++ + imx_ldb->dev = dev; + + if (of_id) +@@ -566,14 +569,14 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) + if (ret || i < 0 || i > 1) + return -EINVAL; + ++ if (!of_device_is_available(child)) ++ continue; ++ + if (dual && i > 0) { + dev_warn(dev, "dual-channel mode, ignoring second output\n"); + continue; + } + +- if (!of_device_is_available(child)) +- continue; +- + channel = &imx_ldb->channel[i]; + channel->ldb = imx_ldb; + channel->chno = i; +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index 29bd801f5dad..0c648efd9a58 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -341,7 +341,7 @@ static int udl_fb_open(struct fb_info *info, int user) + + struct fb_deferred_io *fbdefio; + +- fbdefio = kmalloc(sizeof(struct fb_deferred_io), GFP_KERNEL); ++ fbdefio = kzalloc(sizeof(struct fb_deferred_io), GFP_KERNEL); + + if (fbdefio) { + fbdefio->delay = DL_DEFIO_WRITE_DELAY; +diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c +index 33dbfb2c4748..30bfeb1b2512 100644 +--- a/drivers/gpu/drm/udl/udl_main.c ++++ b/drivers/gpu/drm/udl/udl_main.c +@@ -141,18 +141,13 @@ static void udl_free_urb_list(struct drm_device *dev) + struct list_head *node; + struct urb_node *unode; + struct urb *urb; +- int ret; + unsigned long flags; + + DRM_DEBUG("Waiting for completes and freeing all render urbs\n"); + + /* keep waiting and freeing, until we've got 'em all */ + while (count--) { +- +- /* Getting interrupted means a leak, but ok at shutdown*/ +- ret = down_interruptible(&udl->urbs.limit_sem); +- if (ret) +- break; ++ down(&udl->urbs.limit_sem); + + spin_lock_irqsave(&udl->urbs.lock, flags); + +@@ -176,17 +171,22 @@ static void udl_free_urb_list(struct drm_device *dev) + static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size) + { + struct udl_device *udl = dev->dev_private; +- int i = 0; + struct urb *urb; + struct urb_node *unode; + char *buf; ++ size_t wanted_size = count * size; + + spin_lock_init(&udl->urbs.lock); + ++retry: + udl->urbs.size = size; + INIT_LIST_HEAD(&udl->urbs.list); + +- while (i < count) { ++ sema_init(&udl->urbs.limit_sem, 0); ++ udl->urbs.count = 0; ++ udl->urbs.available = 0; ++ ++ while (udl->urbs.count * size < wanted_size) { + unode = kzalloc(sizeof(struct urb_node), GFP_KERNEL); + if (!unode) + break; +@@ -202,11 +202,16 @@ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size) + } + unode->urb = urb; + +- buf = usb_alloc_coherent(udl->udev, MAX_TRANSFER, GFP_KERNEL, ++ buf = usb_alloc_coherent(udl->udev, size, GFP_KERNEL, + &urb->transfer_dma); + if (!buf) { + kfree(unode); + usb_free_urb(urb); ++ if (size > PAGE_SIZE) { ++ size /= 2; ++ udl_free_urb_list(dev); ++ goto retry; ++ } + break; + } + +@@ -217,16 +222,14 @@ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size) + + list_add_tail(&unode->entry, &udl->urbs.list); + +- i++; ++ up(&udl->urbs.limit_sem); ++ udl->urbs.count++; ++ udl->urbs.available++; + } + +- sema_init(&udl->urbs.limit_sem, i); +- udl->urbs.count = i; +- udl->urbs.available = i; +- +- DRM_DEBUG("allocated %d %d byte urbs\n", i, (int) size); ++ DRM_DEBUG("allocated %d %d byte urbs\n", udl->urbs.count, (int) size); + +- return i; ++ return udl->urbs.count; + } + + struct urb *udl_get_urb(struct drm_device *dev) +diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c +index a8bdcb5292f5..57f6eb1427b4 100644 +--- a/drivers/i2c/busses/i2c-davinci.c ++++ b/drivers/i2c/busses/i2c-davinci.c +@@ -234,12 +234,16 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev) + /* + * It's not always possible to have 1 to 2 ratio when d=7, so fall back + * to minimal possible clkh in this case. ++ * ++ * Note: ++ * CLKH is not allowed to be 0, in this case I2C clock is not generated ++ * at all + */ +- if (clk >= clkl + d) { ++ if (clk > clkl + d) { + clkh = clk - clkl - d; + clkl -= d; + } else { +- clkh = 0; ++ clkh = 1; + clkl = clk - (d << 1); + } + +diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c +index c7427bdd3a4b..2949a381a94d 100644 +--- a/drivers/net/can/mscan/mpc5xxx_can.c ++++ b/drivers/net/can/mscan/mpc5xxx_can.c +@@ -86,6 +86,11 @@ static u32 mpc52xx_can_get_clock(struct platform_device *ofdev, + return 0; + } + cdm = of_iomap(np_cdm, 0); ++ if (!cdm) { ++ of_node_put(np_cdm); ++ dev_err(&ofdev->dev, "can't map clock node!\n"); ++ return 0; ++ } + + if (in_8(&cdm->ipb_clk_sel) & 0x1) + freq *= 2; +diff --git a/drivers/net/ethernet/3com/Kconfig b/drivers/net/ethernet/3com/Kconfig +index 5b7658bcf020..5c3ef9fc8207 100644 +--- a/drivers/net/ethernet/3com/Kconfig ++++ b/drivers/net/ethernet/3com/Kconfig +@@ -32,7 +32,7 @@ config EL3 + + config 3C515 + tristate "3c515 ISA \"Fast EtherLink\"" +- depends on ISA && ISA_DMA_API ++ depends on ISA && ISA_DMA_API && !PPC32 + ---help--- + If you have a 3Com ISA EtherLink XL "Corkscrew" 3c515 Fast Ethernet + network card, say Y here. +diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig +index 0038709fd317..ec59425fdbff 100644 +--- a/drivers/net/ethernet/amd/Kconfig ++++ b/drivers/net/ethernet/amd/Kconfig +@@ -44,7 +44,7 @@ config AMD8111_ETH + + config LANCE + tristate "AMD LANCE and PCnet (AT1500 and NE2100) support" +- depends on ISA && ISA_DMA_API && !ARM ++ depends on ISA && ISA_DMA_API && !ARM && !PPC32 + ---help--- + If you have a network (Ethernet) card of this type, say Y here. + Some LinkSys cards are of this type. +@@ -138,7 +138,7 @@ config PCMCIA_NMCLAN + + config NI65 + tristate "NI6510 support" +- depends on ISA && ISA_DMA_API && !ARM ++ depends on ISA && ISA_DMA_API && !ARM && !PPC32 + ---help--- + If you have a network (Ethernet) card of this type, say Y here. + +diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +index 8b5988e210d5..c08d34f618b9 100644 +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -1683,6 +1683,7 @@ static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter) + skb = build_skb(page_address(page) + adapter->rx_page_offset, + adapter->rx_frag_size); + if (likely(skb)) { ++ skb_reserve(skb, NET_SKB_PAD); + adapter->rx_page_offset += adapter->rx_frag_size; + if (adapter->rx_page_offset >= PAGE_SIZE) + adapter->rx_page = NULL; +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c +index d84efcd34fac..c56b61dce2d1 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c +@@ -3360,14 +3360,18 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info) + DP(BNX2X_MSG_ETHTOOL, + "rss re-configured, UDP 4-tupple %s\n", + udp_rss_requested ? "enabled" : "disabled"); +- return bnx2x_rss(bp, &bp->rss_conf_obj, false, true); ++ if (bp->state == BNX2X_STATE_OPEN) ++ return bnx2x_rss(bp, &bp->rss_conf_obj, false, ++ true); + } else if ((info->flow_type == UDP_V6_FLOW) && + (bp->rss_conf_obj.udp_rss_v6 != udp_rss_requested)) { + bp->rss_conf_obj.udp_rss_v6 = udp_rss_requested; + DP(BNX2X_MSG_ETHTOOL, + "rss re-configured, UDP 4-tupple %s\n", + udp_rss_requested ? "enabled" : "disabled"); +- return bnx2x_rss(bp, &bp->rss_conf_obj, false, true); ++ if (bp->state == BNX2X_STATE_OPEN) ++ return bnx2x_rss(bp, &bp->rss_conf_obj, false, ++ true); + } + return 0; + +@@ -3481,7 +3485,10 @@ static int bnx2x_set_rxfh(struct net_device *dev, const u32 *indir, + bp->rss_conf_obj.ind_table[i] = indir[i] + bp->fp->cl_id; + } + +- return bnx2x_config_rss_eth(bp, false); ++ if (bp->state == BNX2X_STATE_OPEN) ++ return bnx2x_config_rss_eth(bp, false); ++ ++ return 0; + } + + /** +diff --git a/drivers/net/ethernet/cirrus/Kconfig b/drivers/net/ethernet/cirrus/Kconfig +index 5ab912937aff..ec0b545197e2 100644 +--- a/drivers/net/ethernet/cirrus/Kconfig ++++ b/drivers/net/ethernet/cirrus/Kconfig +@@ -19,6 +19,7 @@ if NET_VENDOR_CIRRUS + config CS89x0 + tristate "CS89x0 support" + depends on ISA || EISA || ARM ++ depends on !PPC32 + ---help--- + Support for CS89x0 chipset based Ethernet cards. If you have a + network (Ethernet) card of this type, say Y and read the file +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index 8390597aecb8..b20bce2c7da1 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1842,10 +1842,32 @@ static int enic_stop(struct net_device *netdev) + return 0; + } + ++static int _enic_change_mtu(struct net_device *netdev, int new_mtu) ++{ ++ bool running = netif_running(netdev); ++ int err = 0; ++ ++ ASSERT_RTNL(); ++ if (running) { ++ err = enic_stop(netdev); ++ if (err) ++ return err; ++ } ++ ++ netdev->mtu = new_mtu; ++ ++ if (running) { ++ err = enic_open(netdev); ++ if (err) ++ return err; ++ } ++ ++ return 0; ++} ++ + static int enic_change_mtu(struct net_device *netdev, int new_mtu) + { + struct enic *enic = netdev_priv(netdev); +- int running = netif_running(netdev); + + if (new_mtu < ENIC_MIN_MTU || new_mtu > ENIC_MAX_MTU) + return -EINVAL; +@@ -1853,20 +1875,12 @@ static int enic_change_mtu(struct net_device *netdev, int new_mtu) + if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic)) + return -EOPNOTSUPP; + +- if (running) +- enic_stop(netdev); +- +- netdev->mtu = new_mtu; +- + if (netdev->mtu > enic->port_mtu) + netdev_warn(netdev, +- "interface MTU (%d) set higher than port MTU (%d)\n", +- netdev->mtu, enic->port_mtu); ++ "interface MTU (%d) set higher than port MTU (%d)\n", ++ netdev->mtu, enic->port_mtu); + +- if (running) +- enic_open(netdev); +- +- return 0; ++ return _enic_change_mtu(netdev, new_mtu); + } + + static void enic_change_mtu_work(struct work_struct *work) +@@ -1874,47 +1888,9 @@ static void enic_change_mtu_work(struct work_struct *work) + struct enic *enic = container_of(work, struct enic, change_mtu_work); + struct net_device *netdev = enic->netdev; + int new_mtu = vnic_dev_mtu(enic->vdev); +- int err; +- unsigned int i; +- +- new_mtu = max_t(int, ENIC_MIN_MTU, min_t(int, ENIC_MAX_MTU, new_mtu)); + + rtnl_lock(); +- +- /* Stop RQ */ +- del_timer_sync(&enic->notify_timer); +- +- for (i = 0; i < enic->rq_count; i++) +- napi_disable(&enic->napi[i]); +- +- vnic_intr_mask(&enic->intr[0]); +- enic_synchronize_irqs(enic); +- err = vnic_rq_disable(&enic->rq[0]); +- if (err) { +- rtnl_unlock(); +- netdev_err(netdev, "Unable to disable RQ.\n"); +- return; +- } +- vnic_rq_clean(&enic->rq[0], enic_free_rq_buf); +- vnic_cq_clean(&enic->cq[0]); +- vnic_intr_clean(&enic->intr[0]); +- +- /* Fill RQ with new_mtu-sized buffers */ +- netdev->mtu = new_mtu; +- vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf); +- /* Need at least one buffer on ring to get going */ +- if (vnic_rq_desc_used(&enic->rq[0]) == 0) { +- rtnl_unlock(); +- netdev_err(netdev, "Unable to alloc receive buffers.\n"); +- return; +- } +- +- /* Start RQ */ +- vnic_rq_enable(&enic->rq[0]); +- napi_enable(&enic->napi[0]); +- vnic_intr_unmask(&enic->intr[0]); +- enic_notify_timer_start(enic); +- ++ (void)_enic_change_mtu(netdev, new_mtu); + rtnl_unlock(); + + netdev_info(netdev, "interface MTU set as %d\n", netdev->mtu); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index 20d048cdcb88..c898006abb32 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -420,6 +420,7 @@ static void qed_mcp_handle_link_change(struct qed_hwfn *p_hwfn, + break; + default: + p_link->speed = 0; ++ p_link->link_up = 0; + } + + /* Correct speed according to bandwidth allocation */ +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c +index 507bbb0355c2..f6108413adba 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_mdio.c +@@ -218,6 +218,7 @@ issue: + ret = of_mdiobus_register(bus, np1); + if (ret) { + mdiobus_free(bus); ++ lp->mii_bus = NULL; + return ret; + } + return 0; +diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c +index 317bc79cc8b9..c178e1218347 100644 +--- a/drivers/net/wan/lmc/lmc_main.c ++++ b/drivers/net/wan/lmc/lmc_main.c +@@ -1385,7 +1385,7 @@ static irqreturn_t lmc_interrupt (int irq, void *dev_instance) /*fold00*/ + case 0x001: + printk(KERN_WARNING "%s: Master Abort (naughty)\n", dev->name); + break; +- case 0x010: ++ case 0x002: + printk(KERN_WARNING "%s: Target Abort (not so naughty)\n", dev->name); + break; + default: +diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c +index acaf84cadca3..6c9420ee9e03 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c +@@ -434,7 +434,7 @@ static void imx1_pinconf_group_dbg_show(struct pinctrl_dev *pctldev, + const char *name; + int i, ret; + +- if (group > info->ngroups) ++ if (group >= info->ngroups) + return; + + seq_puts(s, "\n"); +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index 742ca57ece8c..d64b401f3d05 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -640,21 +640,20 @@ static inline unsigned long qdio_aob_for_buffer(struct qdio_output_q *q, + unsigned long phys_aob = 0; + + if (!q->use_cq) +- goto out; ++ return 0; + + if (!q->aobs[bufnr]) { + struct qaob *aob = qdio_allocate_aob(); + q->aobs[bufnr] = aob; + } + if (q->aobs[bufnr]) { +- q->sbal_state[bufnr].flags = QDIO_OUTBUF_STATE_FLAG_NONE; + q->sbal_state[bufnr].aob = q->aobs[bufnr]; + q->aobs[bufnr]->user1 = (u64) q->sbal_state[bufnr].user; + phys_aob = virt_to_phys(q->aobs[bufnr]); + WARN_ON_ONCE(phys_aob & 0xFF); + } + +-out: ++ q->sbal_state[bufnr].flags = 0; + return phys_aob; + } + +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index 34a1b1f333b4..d5184aa1ace4 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -752,9 +752,9 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport, + case ELS_LOGO: + if (fip->mode == FIP_MODE_VN2VN) { + if (fip->state != FIP_ST_VNMP_UP) +- return -EINVAL; ++ goto drop; + if (ntoh24(fh->fh_d_id) == FC_FID_FLOGI) +- return -EINVAL; ++ goto drop; + } else { + if (fip->state != FIP_ST_ENABLED) + return 0; +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 9f0b00c38658..a74f8fbefd33 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -283,11 +283,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + */ + if (opcode != ISCSI_OP_SCSI_DATA_OUT) { + iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x/%x itt " ++ "task [op %x itt " + "0x%x/0x%x] " + "rejected.\n", +- task->hdr->opcode, opcode, +- task->itt, task->hdr_itt); ++ opcode, task->itt, ++ task->hdr_itt); + return -EACCES; + } + /* +@@ -296,10 +296,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + */ + if (conn->session->fast_abort) { + iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x/%x itt " ++ "task [op %x itt " + "0x%x/0x%x] fast abort.\n", +- task->hdr->opcode, opcode, +- task->itt, task->hdr_itt); ++ opcode, task->itt, ++ task->hdr_itt); + return -EACCES; + } + break; +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 4477e999ec70..8db0c48943d6 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -678,8 +678,24 @@ static ssize_t + sdev_store_delete(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { +- if (device_remove_file_self(dev, attr)) +- scsi_remove_device(to_scsi_device(dev)); ++ struct kernfs_node *kn; ++ ++ kn = sysfs_break_active_protection(&dev->kobj, &attr->attr); ++ WARN_ON_ONCE(!kn); ++ /* ++ * Concurrent writes into the "delete" sysfs attribute may trigger ++ * concurrent calls to device_remove_file() and scsi_remove_device(). ++ * device_remove_file() handles concurrent removal calls by ++ * serializing these and by ignoring the second and later removal ++ * attempts. Concurrent calls of scsi_remove_device() are ++ * serialized. The second and later calls of scsi_remove_device() are ++ * ignored because the first call of that function changes the device ++ * state into SDEV_DEL. ++ */ ++ device_remove_file(dev, attr); ++ scsi_remove_device(to_scsi_device(dev)); ++ if (kn) ++ sysfs_unbreak_active_protection(kn); + return count; + }; + static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete); +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 0f133c1817de..0de2f9069e23 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -545,9 +545,14 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + (btstat == BTSTAT_SUCCESS || + btstat == BTSTAT_LINKED_COMMAND_COMPLETED || + btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) { +- cmd->result = (DID_OK << 16) | sdstat; +- if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer) +- cmd->result |= (DRIVER_SENSE << 24); ++ if (sdstat == SAM_STAT_COMMAND_TERMINATED) { ++ cmd->result = (DID_RESET << 16); ++ } else { ++ cmd->result = (DID_OK << 16) | sdstat; ++ if (sdstat == SAM_STAT_CHECK_CONDITION && ++ cmd->sense_buffer) ++ cmd->result |= (DRIVER_SENSE << 24); ++ } + } else + switch (btstat) { + case BTSTAT_SUCCESS: +diff --git a/drivers/staging/media/omap4iss/iss_video.c b/drivers/staging/media/omap4iss/iss_video.c +index 2a0158bb4974..5a78ef057635 100644 +--- a/drivers/staging/media/omap4iss/iss_video.c ++++ b/drivers/staging/media/omap4iss/iss_video.c +@@ -11,7 +11,6 @@ + * (at your option) any later version. + */ + +-#include + #include + #include + #include +@@ -22,6 +21,8 @@ + #include + #include + ++#include ++ + #include "iss_video.h" + #include "iss.h" + +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index bc2cbffec27e..63e54beed196 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -323,8 +323,7 @@ static int iscsi_login_zero_tsih_s1( + pr_err("idr_alloc() for sess_idr failed\n"); + iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, + ISCSI_LOGIN_STATUS_NO_RESOURCES); +- kfree(sess); +- return -ENOMEM; ++ goto free_sess; + } + + sess->creation_time = get_jiffies_64(); +@@ -340,20 +339,28 @@ static int iscsi_login_zero_tsih_s1( + ISCSI_LOGIN_STATUS_NO_RESOURCES); + pr_err("Unable to allocate memory for" + " struct iscsi_sess_ops.\n"); +- kfree(sess); +- return -ENOMEM; ++ goto remove_idr; + } + + sess->se_sess = transport_init_session(TARGET_PROT_NORMAL); + if (IS_ERR(sess->se_sess)) { + iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, + ISCSI_LOGIN_STATUS_NO_RESOURCES); +- kfree(sess->sess_ops); +- kfree(sess); +- return -ENOMEM; ++ goto free_ops; + } + + return 0; ++ ++free_ops: ++ kfree(sess->sess_ops); ++remove_idr: ++ spin_lock_bh(&sess_idr_lock); ++ idr_remove(&sess_idr, sess->session_index); ++ spin_unlock_bh(&sess_idr_lock); ++free_sess: ++ kfree(sess); ++ conn->sess = NULL; ++ return -ENOMEM; + } + + static int iscsi_login_zero_tsih_s2( +@@ -1142,13 +1149,13 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn, + ISCSI_LOGIN_STATUS_INIT_ERR); + if (!zero_tsih || !conn->sess) + goto old_sess_out; +- if (conn->sess->se_sess) +- transport_free_session(conn->sess->se_sess); +- if (conn->sess->session_index != 0) { +- spin_lock_bh(&sess_idr_lock); +- idr_remove(&sess_idr, conn->sess->session_index); +- spin_unlock_bh(&sess_idr_lock); +- } ++ ++ transport_free_session(conn->sess->se_sess); ++ ++ spin_lock_bh(&sess_idr_lock); ++ idr_remove(&sess_idr, conn->sess->session_index); ++ spin_unlock_bh(&sess_idr_lock); ++ + kfree(conn->sess->sess_ops); + kfree(conn->sess); + conn->sess = NULL; +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index b5dab103be38..e931c3cb0840 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -941,14 +941,14 @@ static struct usb_descriptor_header *hs_audio_desc[] = { + }; + + struct cntrl_cur_lay3 { +- __u32 dCUR; ++ __le32 dCUR; + }; + + struct cntrl_range_lay3 { +- __u16 wNumSubRanges; +- __u32 dMIN; +- __u32 dMAX; +- __u32 dRES; ++ __le16 wNumSubRanges; ++ __le32 dMIN; ++ __le32 dMAX; ++ __le32 dRES; + } __packed; + + static inline void +@@ -1296,9 +1296,9 @@ in_rq_cur(struct usb_function *fn, const struct usb_ctrlrequest *cr) + memset(&c, 0, sizeof(struct cntrl_cur_lay3)); + + if (entity_id == USB_IN_CLK_ID) +- c.dCUR = p_srate; ++ c.dCUR = cpu_to_le32(p_srate); + else if (entity_id == USB_OUT_CLK_ID) +- c.dCUR = c_srate; ++ c.dCUR = cpu_to_le32(c_srate); + + value = min_t(unsigned, w_length, sizeof c); + memcpy(req->buf, &c, value); +@@ -1336,15 +1336,15 @@ in_rq_range(struct usb_function *fn, const struct usb_ctrlrequest *cr) + + if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) { + if (entity_id == USB_IN_CLK_ID) +- r.dMIN = p_srate; ++ r.dMIN = cpu_to_le32(p_srate); + else if (entity_id == USB_OUT_CLK_ID) +- r.dMIN = c_srate; ++ r.dMIN = cpu_to_le32(c_srate); + else + return -EOPNOTSUPP; + + r.dMAX = r.dMIN; + r.dRES = 0; +- r.wNumSubRanges = 1; ++ r.wNumSubRanges = cpu_to_le16(1); + + value = min_t(unsigned, w_length, sizeof r); + memcpy(req->buf, &r, value); +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index baa0609a429d..e34094647603 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -835,11 +835,11 @@ static void init_controller(struct r8a66597 *r8a66597) + + r8a66597_bset(r8a66597, XCKE, SYSCFG0); + +- msleep(3); ++ mdelay(3); + + r8a66597_bset(r8a66597, PLLC, SYSCFG0); + +- msleep(1); ++ mdelay(1); + + r8a66597_bset(r8a66597, SCKE, SYSCFG0); + +@@ -1193,7 +1193,7 @@ __acquires(r8a66597->lock) + r8a66597->ep0_req->length = 2; + /* AV: what happens if we get called again before that gets through? */ + spin_unlock(&r8a66597->lock); +- r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL); ++ r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC); + spin_lock(&r8a66597->lock); + } + +diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c +index 94eb2923afed..85d031ce85c1 100644 +--- a/drivers/usb/phy/phy-fsl-usb.c ++++ b/drivers/usb/phy/phy-fsl-usb.c +@@ -879,6 +879,7 @@ int usb_otg_start(struct platform_device *pdev) + if (pdata->init && pdata->init(pdev) != 0) + return -EINVAL; + ++#ifdef CONFIG_PPC32 + if (pdata->big_endian_mmio) { + _fsl_readl = _fsl_readl_be; + _fsl_writel = _fsl_writel_be; +@@ -886,6 +887,7 @@ int usb_otg_start(struct platform_device *pdev) + _fsl_readl = _fsl_readl_le; + _fsl_writel = _fsl_writel_le; + } ++#endif + + /* request irq */ + p_otg->irq = platform_get_irq(pdev, 0); +@@ -976,7 +978,7 @@ int usb_otg_start(struct platform_device *pdev) + /* + * state file in sysfs + */ +-static int show_fsl_usb2_otg_state(struct device *dev, ++static ssize_t show_fsl_usb2_otg_state(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct otg_fsm *fsm = &fsl_otg_dev->fsm; +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 982a9d509817..493c7354ec0b 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4128,7 +4128,7 @@ commit_trans: + data_sinfo->flags, bytes, 1); + spin_unlock(&data_sinfo->lock); + +- return ret; ++ return 0; + } + + /* +diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c +index c4b893453e0e..c43b4b08546b 100644 +--- a/fs/cachefiles/namei.c ++++ b/fs/cachefiles/namei.c +@@ -194,7 +194,6 @@ wait_for_old_object: + pr_err("\n"); + pr_err("Error: Unexpected object collision\n"); + cachefiles_printk_object(object, xobject); +- BUG(); + } + atomic_inc(&xobject->usage); + write_unlock(&cache->active_lock); +diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c +index c0f3da3926a0..5b68cf526887 100644 +--- a/fs/cachefiles/rdwr.c ++++ b/fs/cachefiles/rdwr.c +@@ -27,6 +27,7 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode, + struct cachefiles_one_read *monitor = + container_of(wait, struct cachefiles_one_read, monitor); + struct cachefiles_object *object; ++ struct fscache_retrieval *op = monitor->op; + struct wait_bit_key *key = _key; + struct page *page = wait->private; + +@@ -51,16 +52,22 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode, + list_del(&wait->task_list); + + /* move onto the action list and queue for FS-Cache thread pool */ +- ASSERT(monitor->op); ++ ASSERT(op); + +- object = container_of(monitor->op->op.object, +- struct cachefiles_object, fscache); ++ /* We need to temporarily bump the usage count as we don't own a ref ++ * here otherwise cachefiles_read_copier() may free the op between the ++ * monitor being enqueued on the op->to_do list and the op getting ++ * enqueued on the work queue. ++ */ ++ fscache_get_retrieval(op); + ++ object = container_of(op->op.object, struct cachefiles_object, fscache); + spin_lock(&object->work_lock); +- list_add_tail(&monitor->op_link, &monitor->op->to_do); ++ list_add_tail(&monitor->op_link, &op->to_do); + spin_unlock(&object->work_lock); + +- fscache_enqueue_retrieval(monitor->op); ++ fscache_enqueue_retrieval(op); ++ fscache_put_retrieval(op); + return 0; + } + +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index 0a3544fb50f9..bcbe42fb7e92 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -123,25 +123,41 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v) + seq_printf(m, "CIFS Version %s\n", CIFS_VERSION); + seq_printf(m, "Features:"); + #ifdef CONFIG_CIFS_DFS_UPCALL +- seq_printf(m, " dfs"); ++ seq_printf(m, " DFS"); + #endif + #ifdef CONFIG_CIFS_FSCACHE +- seq_printf(m, " fscache"); ++ seq_printf(m, ",FSCACHE"); ++#endif ++#ifdef CONFIG_CIFS_SMB_DIRECT ++ seq_printf(m, ",SMB_DIRECT"); ++#endif ++#ifdef CONFIG_CIFS_STATS2 ++ seq_printf(m, ",STATS2"); ++#elif defined(CONFIG_CIFS_STATS) ++ seq_printf(m, ",STATS"); ++#endif ++#ifdef CONFIG_CIFS_DEBUG2 ++ seq_printf(m, ",DEBUG2"); ++#elif defined(CONFIG_CIFS_DEBUG) ++ seq_printf(m, ",DEBUG"); ++#endif ++#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY ++ seq_printf(m, ",ALLOW_INSECURE_LEGACY"); + #endif + #ifdef CONFIG_CIFS_WEAK_PW_HASH +- seq_printf(m, " lanman"); ++ seq_printf(m, ",WEAK_PW_HASH"); + #endif + #ifdef CONFIG_CIFS_POSIX +- seq_printf(m, " posix"); ++ seq_printf(m, ",CIFS_POSIX"); + #endif + #ifdef CONFIG_CIFS_UPCALL +- seq_printf(m, " spnego"); ++ seq_printf(m, ",UPCALL(SPNEGO)"); + #endif + #ifdef CONFIG_CIFS_XATTR +- seq_printf(m, " xattr"); ++ seq_printf(m, ",XATTR"); + #endif + #ifdef CONFIG_CIFS_ACL +- seq_printf(m, " acl"); ++ seq_printf(m, ",ACL"); + #endif + seq_putc(m, '\n'); + seq_printf(m, "Active VFS Requests: %d\n", GlobalTotalActiveXid); +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 9cdeb0293267..36c8594bb147 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1063,6 +1063,8 @@ cifs_set_file_info(struct inode *inode, struct iattr *attrs, unsigned int xid, + if (!server->ops->set_file_info) + return -ENOSYS; + ++ info_buf.Pad = 0; ++ + if (attrs->ia_valid & ATTR_ATIME) { + set_time = true; + info_buf.LastAccessTime = +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index e3548f73bdea..728289c32b32 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -419,7 +419,7 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_io_parms io_parms; + int buf_type = CIFS_NO_BUFFER; + __le16 *utf16_path; +- __u8 oplock = SMB2_OPLOCK_LEVEL_II; ++ __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + struct smb2_file_all_info *pfile_info = NULL; + + oparms.tcon = tcon; +@@ -481,7 +481,7 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, + struct cifs_io_parms io_parms; + int create_options = CREATE_NOT_DIR; + __le16 *utf16_path; +- __u8 oplock = SMB2_OPLOCK_LEVEL_EXCLUSIVE; ++ __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; + struct kvec iov[2]; + + if (backup_cred(cifs_sb)) +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index a035d1a95882..9bc7a29f88d6 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -398,6 +398,12 @@ int build_ntlmssp_auth_blob(unsigned char **pbuffer, + goto setup_ntlmv2_ret; + } + *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL); ++ if (!*pbuffer) { ++ rc = -ENOMEM; ++ cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc); ++ *buflen = 0; ++ goto setup_ntlmv2_ret; ++ } + sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer; + + memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 1238cd3552f9..0267d8cbc996 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -267,7 +267,7 @@ smb2_set_file_info(struct inode *inode, const char *full_path, + int rc; + + if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) && +- (buf->LastWriteTime == 0) && (buf->ChangeTime) && ++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) && + (buf->Attributes == 0)) + return 0; /* would be a no op, no sense sending this */ + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 97472088d65a..a1f1e53d0e25 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1401,6 +1401,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, + goto cleanup_and_exit; + dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, " + "falling back\n")); ++ ret = NULL; + } + nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb); + if (!nblocks) { +diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c +index c2ee23acf359..ae9929d678d6 100644 +--- a/fs/ext4/sysfs.c ++++ b/fs/ext4/sysfs.c +@@ -277,8 +277,12 @@ static ssize_t ext4_attr_show(struct kobject *kobj, + case attr_pointer_ui: + if (!ptr) + return 0; +- return snprintf(buf, PAGE_SIZE, "%u\n", +- *((unsigned int *) ptr)); ++ if (a->attr_ptr == ptr_ext4_super_block_offset) ++ return snprintf(buf, PAGE_SIZE, "%u\n", ++ le32_to_cpup(ptr)); ++ else ++ return snprintf(buf, PAGE_SIZE, "%u\n", ++ *((unsigned int *) ptr)); + case attr_pointer_atomic: + if (!ptr) + return 0; +@@ -311,7 +315,10 @@ static ssize_t ext4_attr_store(struct kobject *kobj, + ret = kstrtoul(skip_spaces(buf), 0, &t); + if (ret) + return ret; +- *((unsigned int *) ptr) = t; ++ if (a->attr_ptr == ptr_ext4_super_block_offset) ++ *((__le32 *) ptr) = cpu_to_le32(t); ++ else ++ *((unsigned int *) ptr) = t; + return len; + case attr_inode_readahead: + return inode_readahead_blks_store(a, sbi, buf, len); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index c7cad05aed27..9fb2a751fce4 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -197,6 +197,8 @@ ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end, + struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e); + if ((void *)next >= end) + return -EFSCORRUPTED; ++ if (strnlen(e->e_name, e->e_name_len) != e->e_name_len) ++ return -EFSCORRUPTED; + e = next; + } + +diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c +index de67745e1cd7..77946d6f617d 100644 +--- a/fs/fscache/operation.c ++++ b/fs/fscache/operation.c +@@ -66,7 +66,8 @@ void fscache_enqueue_operation(struct fscache_operation *op) + ASSERT(op->processor != NULL); + ASSERT(fscache_object_is_available(op->object)); + ASSERTCMP(atomic_read(&op->usage), >, 0); +- ASSERTCMP(op->state, ==, FSCACHE_OP_ST_IN_PROGRESS); ++ ASSERTIFCMP(op->state != FSCACHE_OP_ST_IN_PROGRESS, ++ op->state, ==, FSCACHE_OP_ST_CANCELLED); + + fscache_stat(&fscache_n_op_enqueue); + switch (op->flags & FSCACHE_OP_TYPE) { +@@ -481,7 +482,8 @@ void fscache_put_operation(struct fscache_operation *op) + struct fscache_cache *cache; + + _enter("{OBJ%x OP%x,%d}", +- op->object->debug_id, op->debug_id, atomic_read(&op->usage)); ++ op->object ? op->object->debug_id : 0, ++ op->debug_id, atomic_read(&op->usage)); + + ASSERTCMP(atomic_read(&op->usage), >, 0); + +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index d0cf1f010fbe..2671e922c720 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -143,6 +143,16 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background) + return !fc->initialized || (for_background && fc->blocked); + } + ++static void fuse_drop_waiting(struct fuse_conn *fc) ++{ ++ if (fc->connected) { ++ atomic_dec(&fc->num_waiting); ++ } else if (atomic_dec_and_test(&fc->num_waiting)) { ++ /* wake up aborters */ ++ wake_up_all(&fc->blocked_waitq); ++ } ++} ++ + static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages, + bool for_background) + { +@@ -189,7 +199,7 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages, + return req; + + out: +- atomic_dec(&fc->num_waiting); ++ fuse_drop_waiting(fc); + return ERR_PTR(err); + } + +@@ -296,7 +306,7 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req) + + if (test_bit(FR_WAITING, &req->flags)) { + __clear_bit(FR_WAITING, &req->flags); +- atomic_dec(&fc->num_waiting); ++ fuse_drop_waiting(fc); + } + + if (req->stolen_file) +@@ -382,7 +392,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + struct fuse_iqueue *fiq = &fc->iq; + + if (test_and_set_bit(FR_FINISHED, &req->flags)) +- return; ++ goto put_request; + + spin_lock(&fiq->waitq.lock); + list_del_init(&req->intr_entry); +@@ -412,6 +422,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + wake_up(&req->waitq); + if (req->end) + req->end(fc, req); ++put_request: + fuse_put_request(fc, req); + } + +@@ -1991,11 +2002,14 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, + if (!fud) + return -EPERM; + ++ pipe_lock(pipe); ++ + bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL); +- if (!bufs) ++ if (!bufs) { ++ pipe_unlock(pipe); + return -ENOMEM; ++ } + +- pipe_lock(pipe); + nbuf = 0; + rem = 0; + for (idx = 0; idx < pipe->nrbufs && rem < len; idx++) +@@ -2151,6 +2165,7 @@ void fuse_abort_conn(struct fuse_conn *fc) + set_bit(FR_ABORTED, &req->flags); + if (!test_bit(FR_LOCKED, &req->flags)) { + set_bit(FR_PRIVATE, &req->flags); ++ __fuse_get_request(req); + list_move(&req->list, &to_end1); + } + spin_unlock(&req->waitq.lock); +@@ -2177,7 +2192,6 @@ void fuse_abort_conn(struct fuse_conn *fc) + + while (!list_empty(&to_end1)) { + req = list_first_entry(&to_end1, struct fuse_req, list); +- __fuse_get_request(req); + list_del_init(&req->list); + request_end(fc, req); + } +@@ -2188,6 +2202,11 @@ void fuse_abort_conn(struct fuse_conn *fc) + } + EXPORT_SYMBOL_GPL(fuse_abort_conn); + ++void fuse_wait_aborted(struct fuse_conn *fc) ++{ ++ wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0); ++} ++ + int fuse_dev_release(struct inode *inode, struct file *file) + { + struct fuse_dev *fud = fuse_get_dev(file); +@@ -2195,9 +2214,15 @@ int fuse_dev_release(struct inode *inode, struct file *file) + if (fud) { + struct fuse_conn *fc = fud->fc; + struct fuse_pqueue *fpq = &fud->pq; ++ LIST_HEAD(to_end); + ++ spin_lock(&fpq->lock); + WARN_ON(!list_empty(&fpq->io)); +- end_requests(fc, &fpq->processing); ++ list_splice_init(&fpq->processing, &to_end); ++ spin_unlock(&fpq->lock); ++ ++ end_requests(fc, &to_end); ++ + /* Are we the last open device? */ + if (atomic_dec_and_test(&fc->dev_count)) { + WARN_ON(fc->iq.fasync != NULL); +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 1a063cbfe503..8577f3ba6dc6 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -879,6 +879,7 @@ static int fuse_readpages_fill(void *_data, struct page *page) + } + + if (WARN_ON(req->num_pages >= req->max_pages)) { ++ unlock_page(page); + fuse_put_request(fc, req); + return -EIO; + } +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 604cd42dafef..7aafe9acc6c0 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -842,6 +842,7 @@ void fuse_request_send_background_locked(struct fuse_conn *fc, + + /* Abort all requests */ + void fuse_abort_conn(struct fuse_conn *fc); ++void fuse_wait_aborted(struct fuse_conn *fc); + + /** + * Invalidate inode attributes +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index f0b73e0c6d48..4b2eb65be0d4 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -379,9 +379,6 @@ static void fuse_put_super(struct super_block *sb) + { + struct fuse_conn *fc = get_fuse_conn_super(sb); + +- fuse_send_destroy(fc); +- +- fuse_abort_conn(fc); + mutex_lock(&fuse_mutex); + list_del(&fc->entry); + fuse_ctl_remove_conn(fc); +@@ -1172,16 +1169,25 @@ static struct dentry *fuse_mount(struct file_system_type *fs_type, + return mount_nodev(fs_type, flags, raw_data, fuse_fill_super); + } + +-static void fuse_kill_sb_anon(struct super_block *sb) ++static void fuse_sb_destroy(struct super_block *sb) + { + struct fuse_conn *fc = get_fuse_conn_super(sb); + + if (fc) { ++ fuse_send_destroy(fc); ++ ++ fuse_abort_conn(fc); ++ fuse_wait_aborted(fc); ++ + down_write(&fc->killsb); + fc->sb = NULL; + up_write(&fc->killsb); + } ++} + ++static void fuse_kill_sb_anon(struct super_block *sb) ++{ ++ fuse_sb_destroy(sb); + kill_anon_super(sb); + } + +@@ -1204,14 +1210,7 @@ static struct dentry *fuse_mount_blk(struct file_system_type *fs_type, + + static void fuse_kill_sb_blk(struct super_block *sb) + { +- struct fuse_conn *fc = get_fuse_conn_super(sb); +- +- if (fc) { +- down_write(&fc->killsb); +- fc->sb = NULL; +- up_write(&fc->killsb); +- } +- ++ fuse_sb_destroy(sb); + kill_block_super(sb); + } + +diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c +index 39c75a86c67f..666986b95c5d 100644 +--- a/fs/sysfs/file.c ++++ b/fs/sysfs/file.c +@@ -407,6 +407,50 @@ int sysfs_chmod_file(struct kobject *kobj, const struct attribute *attr, + } + EXPORT_SYMBOL_GPL(sysfs_chmod_file); + ++/** ++ * sysfs_break_active_protection - break "active" protection ++ * @kobj: The kernel object @attr is associated with. ++ * @attr: The attribute to break the "active" protection for. ++ * ++ * With sysfs, just like kernfs, deletion of an attribute is postponed until ++ * all active .show() and .store() callbacks have finished unless this function ++ * is called. Hence this function is useful in methods that implement self ++ * deletion. ++ */ ++struct kernfs_node *sysfs_break_active_protection(struct kobject *kobj, ++ const struct attribute *attr) ++{ ++ struct kernfs_node *kn; ++ ++ kobject_get(kobj); ++ kn = kernfs_find_and_get(kobj->sd, attr->name); ++ if (kn) ++ kernfs_break_active_protection(kn); ++ return kn; ++} ++EXPORT_SYMBOL_GPL(sysfs_break_active_protection); ++ ++/** ++ * sysfs_unbreak_active_protection - restore "active" protection ++ * @kn: Pointer returned by sysfs_break_active_protection(). ++ * ++ * Undo the effects of sysfs_break_active_protection(). Since this function ++ * calls kernfs_put() on the kernfs node that corresponds to the 'attr' ++ * argument passed to sysfs_break_active_protection() that attribute may have ++ * been removed between the sysfs_break_active_protection() and ++ * sysfs_unbreak_active_protection() calls, it is not safe to access @kn after ++ * this function has returned. ++ */ ++void sysfs_unbreak_active_protection(struct kernfs_node *kn) ++{ ++ struct kobject *kobj = kn->parent->priv; ++ ++ kernfs_unbreak_active_protection(kn); ++ kernfs_put(kn); ++ kobject_put(kobj); ++} ++EXPORT_SYMBOL_GPL(sysfs_unbreak_active_protection); ++ + /** + * sysfs_remove_file_ns - remove an object attribute with a custom ns tag + * @kobj: object we're acting for +diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h +index 00a1f330f93a..d3c19f8c4564 100644 +--- a/include/linux/sysfs.h ++++ b/include/linux/sysfs.h +@@ -238,6 +238,9 @@ int __must_check sysfs_create_files(struct kobject *kobj, + const struct attribute **attr); + int __must_check sysfs_chmod_file(struct kobject *kobj, + const struct attribute *attr, umode_t mode); ++struct kernfs_node *sysfs_break_active_protection(struct kobject *kobj, ++ const struct attribute *attr); ++void sysfs_unbreak_active_protection(struct kernfs_node *kn); + void sysfs_remove_file_ns(struct kobject *kobj, const struct attribute *attr, + const void *ns); + bool sysfs_remove_file_self(struct kobject *kobj, const struct attribute *attr); +@@ -351,6 +354,17 @@ static inline int sysfs_chmod_file(struct kobject *kobj, + return 0; + } + ++static inline struct kernfs_node * ++sysfs_break_active_protection(struct kobject *kobj, ++ const struct attribute *attr) ++{ ++ return NULL; ++} ++ ++static inline void sysfs_unbreak_active_protection(struct kernfs_node *kn) ++{ ++} ++ + static inline void sysfs_remove_file_ns(struct kobject *kobj, + const struct attribute *attr, + const void *ns) +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index bbe9dd0886bd..388bcace62f8 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -2441,7 +2441,7 @@ static int __init debugfs_kprobe_init(void) + if (!dir) + return -ENOMEM; + +- file = debugfs_create_file("list", 0444, dir, NULL, ++ file = debugfs_create_file("list", 0400, dir, NULL, + &debugfs_kprobes_operations); + if (!file) + goto error; +@@ -2451,7 +2451,7 @@ static int __init debugfs_kprobe_init(void) + if (!file) + goto error; + +- file = debugfs_create_file("blacklist", 0444, dir, NULL, ++ file = debugfs_create_file("blacklist", 0400, dir, NULL, + &debugfs_kprobe_blacklist_ops); + if (!file) + goto error; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 17c59e78661b..66100d1bc3f7 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -342,7 +342,8 @@ static struct ctl_table kern_table[] = { + .data = &sysctl_sched_time_avg, + .maxlen = sizeof(unsigned int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &one, + }, + { + .procname = "sched_shares_window_ns", +diff --git a/mm/memory.c b/mm/memory.c +index d5bb1465d30c..42db644f5ec4 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -3701,6 +3701,9 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, + return -EINVAL; + + maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); ++ if (!maddr) ++ return -ENOMEM; ++ + if (write) + memcpy_toio(maddr + offset, buf, len); + else +diff --git a/mm/zswap.c b/mm/zswap.c +index 568015e2fe7a..87a8491909ee 100644 +--- a/mm/zswap.c ++++ b/mm/zswap.c +@@ -1018,6 +1018,15 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset, + ret = -ENOMEM; + goto reject; + } ++ ++ /* A second zswap_is_full() check after ++ * zswap_shrink() to make sure it's now ++ * under the max_pool_percent ++ */ ++ if (zswap_is_full()) { ++ ret = -ENOMEM; ++ goto reject; ++ } + } + + /* allocate entry */ +diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c +index d730a0f68f46..a0443d40d677 100644 +--- a/net/caif/caif_dev.c ++++ b/net/caif/caif_dev.c +@@ -131,8 +131,10 @@ static void caif_flow_cb(struct sk_buff *skb) + caifd = caif_get(skb->dev); + + WARN_ON(caifd == NULL); +- if (caifd == NULL) ++ if (!caifd) { ++ rcu_read_unlock(); + return; ++ } + + caifd_hold(caifd); + rcu_read_unlock(); +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 5f3b81941a6f..5169b9b36b6a 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1593,9 +1593,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb) + int taglen; + + for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) { +- if (optptr[0] == IPOPT_CIPSO) ++ switch (optptr[0]) { ++ case IPOPT_CIPSO: + return optptr; +- taglen = optptr[1]; ++ case IPOPT_END: ++ return NULL; ++ case IPOPT_NOOP: ++ taglen = 1; ++ break; ++ default: ++ taglen = optptr[1]; ++ } + optlen -= taglen; + optptr += taglen; + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 40bb7a5e6d47..6aca9a6b2303 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -469,10 +469,6 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + goto tx_err_dst_release; + } + +- skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev))); +- skb_dst_set(skb, dst); +- skb->dev = skb_dst(skb)->dev; +- + mtu = dst_mtu(dst); + if (!skb->ignore_df && skb->len > mtu) { + skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); +@@ -487,9 +483,14 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + htonl(mtu)); + } + +- return -EMSGSIZE; ++ err = -EMSGSIZE; ++ goto tx_err_dst_release; + } + ++ skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev))); ++ skb_dst_set(skb, dst); ++ skb->dev = skb_dst(skb)->dev; ++ + err = dst_output(t->net, skb->sk, skb); + if (net_xmit_eval(err) == 0) { + struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index ec26a84b00e2..2214c77d4172 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2006,7 +2006,8 @@ int ieee80211_reconfig(struct ieee80211_local *local) + if (!sta->uploaded) + continue; + +- if (sta->sdata->vif.type != NL80211_IFTYPE_AP) ++ if (sta->sdata->vif.type != NL80211_IFTYPE_AP && ++ sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN) + continue; + + for (state = IEEE80211_STA_NOTEXIST; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index b0b58d1565c2..b07fd8b8b50c 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3578,6 +3578,7 @@ static int parse_station_flags(struct genl_info *info, + params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | + BIT(NL80211_STA_FLAG_MFP) | + BIT(NL80211_STA_FLAG_AUTHORIZED); ++ break; + default: + return -EINVAL; + } +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index f9a13b67df5e..e9eecf6f0bff 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2326,6 +2326,9 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig, + if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE) + return make_blackhole(net, dst_orig->ops->family, dst_orig); + ++ if (IS_ERR(dst)) ++ dst_release(dst_orig); ++ + return dst; + } + EXPORT_SYMBOL(xfrm_lookup_route); +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 78c40bb681b9..a9b4491a3cc4 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -980,10 +980,12 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb, + { + struct sock *nlsk = rcu_dereference(net->xfrm.nlsk); + +- if (nlsk) +- return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); +- else +- return -1; ++ if (!nlsk) { ++ kfree_skb(skb); ++ return -EPIPE; ++ } ++ ++ return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); + } + + static inline size_t xfrm_spdinfo_msgsize(void) +diff --git a/sound/soc/sirf/sirf-usp.c b/sound/soc/sirf/sirf-usp.c +index 45fc06c0e0e5..6b504f407079 100644 +--- a/sound/soc/sirf/sirf-usp.c ++++ b/sound/soc/sirf/sirf-usp.c +@@ -367,10 +367,9 @@ static int sirf_usp_pcm_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, usp); + + mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- base = devm_ioremap(&pdev->dev, mem_res->start, +- resource_size(mem_res)); +- if (base == NULL) +- return -ENOMEM; ++ base = devm_ioremap_resource(&pdev->dev, mem_res); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + usp->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sirf_usp_regmap_config); + if (IS_ERR(usp->regmap)) +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 43b80db952d1..f99eb8f44282 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1570,6 +1570,14 @@ static u64 dpcm_runtime_base_format(struct snd_pcm_substream *substream) + int i; + + for (i = 0; i < be->num_codecs; i++) { ++ /* ++ * Skip CODECs which don't support the current stream ++ * type. See soc_pcm_init_runtime_hw() for more details ++ */ ++ if (!snd_soc_dai_stream_valid(be->codec_dais[i], ++ stream)) ++ continue; ++ + codec_dai_drv = be->codec_dais[i]->driver; + if (stream == SNDRV_PCM_STREAM_PLAYBACK) + codec_stream = &codec_dai_drv->playback; +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 0dac7e05a6ac..33c79e415075 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -663,9 +663,7 @@ void format_all_counters(struct thread_data *t, struct core_data *c, struct pkg_ + if (!printed || !summary_only) + print_header(); + +- if (topo.num_cpus > 1) +- format_counters(&average.threads, &average.cores, +- &average.packages); ++ format_counters(&average.threads, &average.cores, &average.packages); + + printed = 1; + +@@ -2693,7 +2691,9 @@ void process_cpuid() + family = (fms >> 8) & 0xf; + model = (fms >> 4) & 0xf; + stepping = fms & 0xf; +- if (family == 6 || family == 0xf) ++ if (family == 0xf) ++ family += (fms >> 20) & 0xff; ++ if (family >= 6) + model += ((fms >> 16) & 0xf) << 4; + + if (debug) +diff --git a/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc +new file mode 100644 +index 000000000000..3b1f45e13a2e +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc +@@ -0,0 +1,28 @@ ++#!/bin/sh ++# description: Snapshot and tracing setting ++# flags: instance ++ ++[ ! -f snapshot ] && exit_unsupported ++ ++echo "Set tracing off" ++echo 0 > tracing_on ++ ++echo "Allocate and take a snapshot" ++echo 1 > snapshot ++ ++# Since trace buffer is empty, snapshot is also empty, but allocated ++grep -q "Snapshot is allocated" snapshot ++ ++echo "Ensure keep tracing off" ++test `cat tracing_on` -eq 0 ++ ++echo "Set tracing on" ++echo 1 > tracing_on ++ ++echo "Take a snapshot again" ++echo 1 > snapshot ++ ++echo "Ensure keep tracing on" ++test `cat tracing_on` -eq 1 ++ ++exit 0 +diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c +index 88d5e71be044..47dfa0b0fcd7 100644 +--- a/tools/usb/ffs-test.c ++++ b/tools/usb/ffs-test.c +@@ -44,12 +44,25 @@ + + /******************** Little Endian Handling ********************************/ + +-#define cpu_to_le16(x) htole16(x) +-#define cpu_to_le32(x) htole32(x) ++/* ++ * cpu_to_le16/32 are used when initializing structures, a context where a ++ * function call is not allowed. To solve this, we code cpu_to_le16/32 in a way ++ * that allows them to be used when initializing structures. ++ */ ++ ++#if __BYTE_ORDER == __LITTLE_ENDIAN ++#define cpu_to_le16(x) (x) ++#define cpu_to_le32(x) (x) ++#else ++#define cpu_to_le16(x) ((((x) >> 8) & 0xffu) | (((x) & 0xffu) << 8)) ++#define cpu_to_le32(x) \ ++ ((((x) & 0xff000000u) >> 24) | (((x) & 0x00ff0000u) >> 8) | \ ++ (((x) & 0x0000ff00u) << 8) | (((x) & 0x000000ffu) << 24)) ++#endif ++ + #define le32_to_cpu(x) le32toh(x) + #define le16_to_cpu(x) le16toh(x) + +- + /******************** Messages and Errors ***********************************/ + + static const char argv0[] = "ffs-test"; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.154-155.patch b/patch/kernel/mvebu-default/04-patch-4.4.154-155.patch new file mode 100644 index 000000000..0e4fe2321 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.154-155.patch @@ -0,0 +1,1862 @@ +diff --git a/Makefile b/Makefile +index b184286cf7e6..2d9f89ec8397 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 154 ++SUBLEVEL = 155 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c +index 63f06a2b1f7f..bbc7cb9faa01 100644 +--- a/arch/alpha/kernel/osf_sys.c ++++ b/arch/alpha/kernel/osf_sys.c +@@ -526,24 +526,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path, + SYSCALL_DEFINE1(osf_utsname, char __user *, name) + { + int error; ++ char tmp[5 * 32]; + + down_read(&uts_sem); +- error = -EFAULT; +- if (copy_to_user(name + 0, utsname()->sysname, 32)) +- goto out; +- if (copy_to_user(name + 32, utsname()->nodename, 32)) +- goto out; +- if (copy_to_user(name + 64, utsname()->release, 32)) +- goto out; +- if (copy_to_user(name + 96, utsname()->version, 32)) +- goto out; +- if (copy_to_user(name + 128, utsname()->machine, 32)) +- goto out; ++ memcpy(tmp + 0 * 32, utsname()->sysname, 32); ++ memcpy(tmp + 1 * 32, utsname()->nodename, 32); ++ memcpy(tmp + 2 * 32, utsname()->release, 32); ++ memcpy(tmp + 3 * 32, utsname()->version, 32); ++ memcpy(tmp + 4 * 32, utsname()->machine, 32); ++ up_read(&uts_sem); + +- error = 0; +- out: +- up_read(&uts_sem); +- return error; ++ if (copy_to_user(name, tmp, sizeof(tmp))) ++ return -EFAULT; ++ return 0; + } + + SYSCALL_DEFINE0(getpagesize) +@@ -561,24 +556,22 @@ SYSCALL_DEFINE0(getdtablesize) + */ + SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) + { +- unsigned len; +- int i; ++ int len, err = 0; ++ char *kname; ++ char tmp[32]; + +- if (!access_ok(VERIFY_WRITE, name, namelen)) +- return -EFAULT; +- +- len = namelen; +- if (len > 32) +- len = 32; ++ if (namelen < 0 || namelen > 32) ++ namelen = 32; + + down_read(&uts_sem); +- for (i = 0; i < len; ++i) { +- __put_user(utsname()->domainname[i], name + i); +- if (utsname()->domainname[i] == '\0') +- break; +- } ++ kname = utsname()->domainname; ++ len = strnlen(kname, namelen); ++ len = min(len + 1, namelen); ++ memcpy(tmp, kname, len); + up_read(&uts_sem); + ++ if (copy_to_user(name, tmp, len)) ++ return -EFAULT; + return 0; + } + +@@ -741,13 +734,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) + }; + unsigned long offset; + const char *res; +- long len, err = -EINVAL; ++ long len; ++ char tmp[__NEW_UTS_LEN + 1]; + + offset = command-1; + if (offset >= ARRAY_SIZE(sysinfo_table)) { + /* Digital UNIX has a few unpublished interfaces here */ + printk("sysinfo(%d)", command); +- goto out; ++ return -EINVAL; + } + + down_read(&uts_sem); +@@ -755,13 +749,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) + len = strlen(res)+1; + if ((unsigned long)len > (unsigned long)count) + len = count; +- if (copy_to_user(buf, res, len)) +- err = -EFAULT; +- else +- err = 0; ++ memcpy(tmp, res, len); + up_read(&uts_sem); +- out: +- return err; ++ if (copy_to_user(buf, tmp, len)) ++ return -EFAULT; ++ return 0; + } + + SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer, +diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi +index bb1ca158273c..1922e7a93e40 100644 +--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi ++++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi +@@ -201,6 +201,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x70>; ++ reset-gpio = <&gpio TEGRA_GPIO(BB, 0) GPIO_ACTIVE_LOW>; + }; + }; + +diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h +index 493e72f64b35..5768ec3c1781 100644 +--- a/arch/powerpc/include/asm/fadump.h ++++ b/arch/powerpc/include/asm/fadump.h +@@ -194,9 +194,6 @@ struct fadump_crash_info_header { + struct cpumask cpu_online_mask; + }; + +-/* Crash memory ranges */ +-#define INIT_CRASHMEM_RANGES (INIT_MEMBLOCK_REGIONS + 2) +- + struct fad_crash_memory_ranges { + unsigned long long base; + unsigned long long size; +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 791d4c3329c3..c3c835290131 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -48,8 +49,10 @@ static struct fadump_mem_struct fdm; + static const struct fadump_mem_struct *fdm_active; + + static DEFINE_MUTEX(fadump_mutex); +-struct fad_crash_memory_ranges crash_memory_ranges[INIT_CRASHMEM_RANGES]; ++struct fad_crash_memory_ranges *crash_memory_ranges; ++int crash_memory_ranges_size; + int crash_mem_ranges; ++int max_crash_mem_ranges; + + /* Scan the Firmware Assisted dump configuration details. */ + int __init early_init_dt_scan_fw_dump(unsigned long node, +@@ -726,38 +729,88 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active) + return 0; + } + +-static inline void fadump_add_crash_memory(unsigned long long base, +- unsigned long long end) ++static void free_crash_memory_ranges(void) ++{ ++ kfree(crash_memory_ranges); ++ crash_memory_ranges = NULL; ++ crash_memory_ranges_size = 0; ++ max_crash_mem_ranges = 0; ++} ++ ++/* ++ * Allocate or reallocate crash memory ranges array in incremental units ++ * of PAGE_SIZE. ++ */ ++static int allocate_crash_memory_ranges(void) ++{ ++ struct fad_crash_memory_ranges *new_array; ++ u64 new_size; ++ ++ new_size = crash_memory_ranges_size + PAGE_SIZE; ++ pr_debug("Allocating %llu bytes of memory for crash memory ranges\n", ++ new_size); ++ ++ new_array = krealloc(crash_memory_ranges, new_size, GFP_KERNEL); ++ if (new_array == NULL) { ++ pr_err("Insufficient memory for setting up crash memory ranges\n"); ++ free_crash_memory_ranges(); ++ return -ENOMEM; ++ } ++ ++ crash_memory_ranges = new_array; ++ crash_memory_ranges_size = new_size; ++ max_crash_mem_ranges = (new_size / ++ sizeof(struct fad_crash_memory_ranges)); ++ return 0; ++} ++ ++static inline int fadump_add_crash_memory(unsigned long long base, ++ unsigned long long end) + { + if (base == end) +- return; ++ return 0; ++ ++ if (crash_mem_ranges == max_crash_mem_ranges) { ++ int ret; ++ ++ ret = allocate_crash_memory_ranges(); ++ if (ret) ++ return ret; ++ } + + pr_debug("crash_memory_range[%d] [%#016llx-%#016llx], %#llx bytes\n", + crash_mem_ranges, base, end - 1, (end - base)); + crash_memory_ranges[crash_mem_ranges].base = base; + crash_memory_ranges[crash_mem_ranges].size = end - base; + crash_mem_ranges++; ++ return 0; + } + +-static void fadump_exclude_reserved_area(unsigned long long start, ++static int fadump_exclude_reserved_area(unsigned long long start, + unsigned long long end) + { + unsigned long long ra_start, ra_end; ++ int ret = 0; + + ra_start = fw_dump.reserve_dump_area_start; + ra_end = ra_start + fw_dump.reserve_dump_area_size; + + if ((ra_start < end) && (ra_end > start)) { + if ((start < ra_start) && (end > ra_end)) { +- fadump_add_crash_memory(start, ra_start); +- fadump_add_crash_memory(ra_end, end); ++ ret = fadump_add_crash_memory(start, ra_start); ++ if (ret) ++ return ret; ++ ++ ret = fadump_add_crash_memory(ra_end, end); + } else if (start < ra_start) { +- fadump_add_crash_memory(start, ra_start); ++ ret = fadump_add_crash_memory(start, ra_start); + } else if (ra_end < end) { +- fadump_add_crash_memory(ra_end, end); ++ ret = fadump_add_crash_memory(ra_end, end); + } + } else +- fadump_add_crash_memory(start, end); ++ ret = fadump_add_crash_memory(start, end); ++ ++ return ret; + } + + static int fadump_init_elfcore_header(char *bufp) +@@ -793,10 +846,11 @@ static int fadump_init_elfcore_header(char *bufp) + * Traverse through memblock structure and setup crash memory ranges. These + * ranges will be used create PT_LOAD program headers in elfcore header. + */ +-static void fadump_setup_crash_memory_ranges(void) ++static int fadump_setup_crash_memory_ranges(void) + { + struct memblock_region *reg; + unsigned long long start, end; ++ int ret; + + pr_debug("Setup crash memory ranges.\n"); + crash_mem_ranges = 0; +@@ -807,7 +861,9 @@ static void fadump_setup_crash_memory_ranges(void) + * specified during fadump registration. We need to create a separate + * program header for this chunk with the correct offset. + */ +- fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); ++ ret = fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); ++ if (ret) ++ return ret; + + for_each_memblock(memory, reg) { + start = (unsigned long long)reg->base; +@@ -816,8 +872,12 @@ static void fadump_setup_crash_memory_ranges(void) + start = fw_dump.boot_memory_size; + + /* add this range excluding the reserved dump area. */ +- fadump_exclude_reserved_area(start, end); ++ ret = fadump_exclude_reserved_area(start, end); ++ if (ret) ++ return ret; + } ++ ++ return 0; + } + + /* +@@ -941,6 +1001,7 @@ static void register_fadump(void) + { + unsigned long addr; + void *vaddr; ++ int ret; + + /* + * If no memory is reserved then we can not register for firmware- +@@ -949,7 +1010,9 @@ static void register_fadump(void) + if (!fw_dump.reserve_dump_area_size) + return; + +- fadump_setup_crash_memory_ranges(); ++ ret = fadump_setup_crash_memory_ranges(); ++ if (ret) ++ return ret; + + addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len); + /* Initialize fadump crash info header. */ +@@ -1028,6 +1091,7 @@ void fadump_cleanup(void) + } else if (fw_dump.dump_registered) { + /* Un-register Firmware-assisted dump if it was registered. */ + fadump_unregister_dump(&fdm); ++ free_crash_memory_ranges(); + } + } + +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 3b6647e574b6..f5313a78e5d6 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -300,7 +300,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) + } + + savep = __va(regs->gpr[3]); +- regs->gpr[3] = savep[0]; /* restore original r3 */ ++ regs->gpr[3] = be64_to_cpu(savep[0]); /* restore original r3 */ + + /* If it isn't an extended log we can use the per cpu 64bit buffer */ + h = (struct rtas_error_log *)&savep[1]; +diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c +index 646988d4c1a3..740f43b9b541 100644 +--- a/arch/sparc/kernel/sys_sparc_32.c ++++ b/arch/sparc/kernel/sys_sparc_32.c +@@ -201,23 +201,27 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, + + asmlinkage long sys_getdomainname(char __user *name, int len) + { +- int nlen, err; +- ++ int nlen, err; ++ char tmp[__NEW_UTS_LEN + 1]; ++ + if (len < 0) + return -EINVAL; + +- down_read(&uts_sem); +- ++ down_read(&uts_sem); ++ + nlen = strlen(utsname()->domainname) + 1; + err = -EINVAL; + if (nlen > len) +- goto out; ++ goto out_unlock; ++ memcpy(tmp, utsname()->domainname, nlen); + +- err = -EFAULT; +- if (!copy_to_user(name, utsname()->domainname, nlen)) +- err = 0; ++ up_read(&uts_sem); + +-out: ++ if (copy_to_user(name, tmp, nlen)) ++ return -EFAULT; ++ return 0; ++ ++out_unlock: + up_read(&uts_sem); + return err; + } +diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c +index 7f0f7c01b297..f63cd2ea8470 100644 +--- a/arch/sparc/kernel/sys_sparc_64.c ++++ b/arch/sparc/kernel/sys_sparc_64.c +@@ -524,23 +524,27 @@ extern void check_pending(int signum); + + SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) + { +- int nlen, err; ++ int nlen, err; ++ char tmp[__NEW_UTS_LEN + 1]; + + if (len < 0) + return -EINVAL; + +- down_read(&uts_sem); +- ++ down_read(&uts_sem); ++ + nlen = strlen(utsname()->domainname) + 1; + err = -EINVAL; + if (nlen > len) +- goto out; ++ goto out_unlock; ++ memcpy(tmp, utsname()->domainname, nlen); ++ ++ up_read(&uts_sem); + +- err = -EFAULT; +- if (!copy_to_user(name, utsname()->domainname, nlen)) +- err = 0; ++ if (copy_to_user(name, tmp, nlen)) ++ return -EFAULT; ++ return 0; + +-out: ++out_unlock: + up_read(&uts_sem); + return err; + } +diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h +index 9016b4b70375..6c5020163db0 100644 +--- a/arch/x86/include/asm/io.h ++++ b/arch/x86/include/asm/io.h +@@ -351,4 +351,10 @@ extern void arch_phys_wc_del(int handle); + #define arch_phys_wc_add arch_phys_wc_add + #endif + ++#ifdef CONFIG_X86_PAT ++extern int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size); ++extern void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size); ++#define arch_io_reserve_memtype_wc arch_io_reserve_memtype_wc ++#endif ++ + #endif /* _ASM_X86_IO_H */ +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c +index 1007fa80f5a6..0e1dd7d47f05 100644 +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -1079,7 +1079,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, + * Map everything starting from the Gb boundary, possibly with 1G pages + */ + while (end - start >= PUD_SIZE) { +- set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn, ++ set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn >> PAGE_SHIFT, + canon_pgprot(pud_pgprot)))); + + start += PUD_SIZE; +diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c +index 3146b1da6d72..5ff0cb74de55 100644 +--- a/arch/x86/mm/pat.c ++++ b/arch/x86/mm/pat.c +@@ -726,6 +726,20 @@ void io_free_memtype(resource_size_t start, resource_size_t end) + free_memtype(start, end); + } + ++int arch_io_reserve_memtype_wc(resource_size_t start, resource_size_t size) ++{ ++ enum page_cache_mode type = _PAGE_CACHE_MODE_WC; ++ ++ return io_reserve_memtype(start, start + size, &type); ++} ++EXPORT_SYMBOL(arch_io_reserve_memtype_wc); ++ ++void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size) ++{ ++ io_free_memtype(start, start + size); ++} ++EXPORT_SYMBOL(arch_io_free_memtype_wc); ++ + pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, + unsigned long size, pgprot_t vma_prot) + { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 73628c7599e7..3aca9a9011fb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -492,6 +492,10 @@ void amdgpu_bo_force_delete(struct amdgpu_device *adev) + + int amdgpu_bo_init(struct amdgpu_device *adev) + { ++ /* reserve PAT memory space to WC for VRAM */ ++ arch_io_reserve_memtype_wc(adev->mc.aper_base, ++ adev->mc.aper_size); ++ + /* Add an MTRR for the VRAM */ + adev->mc.vram_mtrr = arch_phys_wc_add(adev->mc.aper_base, + adev->mc.aper_size); +@@ -507,6 +511,7 @@ void amdgpu_bo_fini(struct amdgpu_device *adev) + { + amdgpu_ttm_fini(adev); + arch_phys_wc_del(adev->mc.vram_mtrr); ++ arch_io_free_memtype_wc(adev->mc.aper_base, adev->mc.aper_size); + } + + int amdgpu_bo_fbdev_mmap(struct amdgpu_bo *bo, +diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c +index 08f82eae6939..ac12f74e6b32 100644 +--- a/drivers/gpu/drm/ast/ast_ttm.c ++++ b/drivers/gpu/drm/ast/ast_ttm.c +@@ -275,6 +275,8 @@ int ast_mm_init(struct ast_private *ast) + return ret; + } + ++ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); + ast->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), + pci_resource_len(dev->pdev, 0)); + +@@ -283,11 +285,15 @@ int ast_mm_init(struct ast_private *ast) + + void ast_mm_fini(struct ast_private *ast) + { ++ struct drm_device *dev = ast->dev; ++ + ttm_bo_device_release(&ast->ttm.bdev); + + ast_ttm_global_release(ast); + + arch_phys_wc_del(ast->fb_mtrr); ++ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); + } + + void ast_ttm_placement(struct ast_bo *bo, int domain) +diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c +index dfffd528517a..393967025043 100644 +--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c ++++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c +@@ -275,6 +275,9 @@ int cirrus_mm_init(struct cirrus_device *cirrus) + return ret; + } + ++ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); ++ + cirrus->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), + pci_resource_len(dev->pdev, 0)); + +@@ -284,6 +287,8 @@ int cirrus_mm_init(struct cirrus_device *cirrus) + + void cirrus_mm_fini(struct cirrus_device *cirrus) + { ++ struct drm_device *dev = cirrus->dev; ++ + if (!cirrus->mm_inited) + return; + +@@ -293,6 +298,8 @@ void cirrus_mm_fini(struct cirrus_device *cirrus) + + arch_phys_wc_del(cirrus->fb_mtrr); + cirrus->fb_mtrr = 0; ++ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); + } + + void cirrus_ttm_placement(struct cirrus_bo *bo, int domain) +diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c +index 19fb0bddc1cd..359fe2b8bb8a 100644 +--- a/drivers/gpu/drm/i915/i915_gem_userptr.c ++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c +@@ -842,6 +842,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev, void *data, struct drm_file *file + I915_USERPTR_UNSYNCHRONIZED)) + return -EINVAL; + ++ if (!args->user_size) ++ return -EINVAL; ++ + if (offset_in_page(args->user_ptr | args->user_size)) + return -EINVAL; + +diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c +index 05108b505fbf..d9df8d32fc35 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c ++++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c +@@ -274,6 +274,9 @@ int mgag200_mm_init(struct mga_device *mdev) + return ret; + } + ++ arch_io_reserve_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); ++ + mdev->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0), + pci_resource_len(dev->pdev, 0)); + +@@ -282,10 +285,14 @@ int mgag200_mm_init(struct mga_device *mdev) + + void mgag200_mm_fini(struct mga_device *mdev) + { ++ struct drm_device *dev = mdev->dev; ++ + ttm_bo_device_release(&mdev->ttm.bdev); + + mgag200_ttm_global_release(mdev); + ++ arch_io_free_memtype_wc(pci_resource_start(dev->pdev, 0), ++ pci_resource_len(dev->pdev, 0)); + arch_phys_wc_del(mdev->fb_mtrr); + mdev->fb_mtrr = 0; + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c +index d2e7d209f651..9835327a3214 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c +@@ -397,6 +397,9 @@ nouveau_ttm_init(struct nouveau_drm *drm) + /* VRAM init */ + drm->gem.vram_available = drm->device.info.ram_user; + ++ arch_io_reserve_memtype_wc(device->func->resource_addr(device, 1), ++ device->func->resource_size(device, 1)); ++ + ret = ttm_bo_init_mm(&drm->ttm.bdev, TTM_PL_VRAM, + drm->gem.vram_available >> PAGE_SHIFT); + if (ret) { +@@ -429,6 +432,8 @@ nouveau_ttm_init(struct nouveau_drm *drm) + void + nouveau_ttm_fini(struct nouveau_drm *drm) + { ++ struct nvkm_device *device = nvxx_device(&drm->device); ++ + ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_VRAM); + ttm_bo_clean_mm(&drm->ttm.bdev, TTM_PL_TT); + +@@ -438,4 +443,7 @@ nouveau_ttm_fini(struct nouveau_drm *drm) + + arch_phys_wc_del(drm->ttm.mtrr); + drm->ttm.mtrr = 0; ++ arch_io_free_memtype_wc(device->func->resource_addr(device, 1), ++ device->func->resource_size(device, 1)); ++ + } +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index 83aee9e814ba..18ec38d0d3f5 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -447,6 +447,10 @@ void radeon_bo_force_delete(struct radeon_device *rdev) + + int radeon_bo_init(struct radeon_device *rdev) + { ++ /* reserve PAT memory space to WC for VRAM */ ++ arch_io_reserve_memtype_wc(rdev->mc.aper_base, ++ rdev->mc.aper_size); ++ + /* Add an MTRR for the VRAM */ + if (!rdev->fastfb_working) { + rdev->mc.vram_mtrr = arch_phys_wc_add(rdev->mc.aper_base, +@@ -464,6 +468,7 @@ void radeon_bo_fini(struct radeon_device *rdev) + { + radeon_ttm_fini(rdev); + arch_phys_wc_del(rdev->mc.vram_mtrr); ++ arch_io_free_memtype_wc(rdev->mc.aper_base, rdev->mc.aper_size); + } + + /* Returns how many bytes TTM can move per IB. +diff --git a/drivers/iio/frequency/ad9523.c b/drivers/iio/frequency/ad9523.c +index 44a30f286de1..57b1812a5a18 100644 +--- a/drivers/iio/frequency/ad9523.c ++++ b/drivers/iio/frequency/ad9523.c +@@ -507,7 +507,7 @@ static ssize_t ad9523_store(struct device *dev, + return ret; + + if (!state) +- return 0; ++ return len; + + mutex_lock(&indio_dev->mlock); + switch ((u32)this_attr->address) { +@@ -641,7 +641,7 @@ static int ad9523_read_raw(struct iio_dev *indio_dev, + code = (AD9523_CLK_DIST_DIV_PHASE_REV(ret) * 3141592) / + AD9523_CLK_DIST_DIV_REV(ret); + *val = code / 1000000; +- *val2 = (code % 1000000) * 10; ++ *val2 = code % 1000000; + return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index e913a930ac80..5a63e32a4a6b 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1315,8 +1315,8 @@ void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, + qi_submit_sync(&desc, iommu); + } + +-void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, +- u64 addr, unsigned mask) ++void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, ++ u16 qdep, u64 addr, unsigned mask) + { + struct qi_desc desc; + +@@ -1331,7 +1331,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, + qdep = 0; + + desc.low = QI_DEV_IOTLB_SID(sid) | QI_DEV_IOTLB_QDEP(qdep) | +- QI_DIOTLB_TYPE; ++ QI_DIOTLB_TYPE | QI_DEV_IOTLB_PFSID(pfsid); + + qi_submit_sync(&desc, iommu); + } +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 4efec2db4ee2..49b266433f4c 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -419,6 +419,7 @@ struct device_domain_info { + struct list_head global; /* link to global list */ + u8 bus; /* PCI bus number */ + u8 devfn; /* PCI devfn number */ ++ u16 pfsid; /* SRIOV physical function source ID */ + u8 pasid_supported:3; + u8 pasid_enabled:1; + u8 pri_supported:1; +@@ -1479,6 +1480,20 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info) + return; + + pdev = to_pci_dev(info->dev); ++ /* For IOMMU that supports device IOTLB throttling (DIT), we assign ++ * PFSID to the invalidation desc of a VF such that IOMMU HW can gauge ++ * queue depth at PF level. If DIT is not set, PFSID will be treated as ++ * reserved, which should be set to 0. ++ */ ++ if (!ecap_dit(info->iommu->ecap)) ++ info->pfsid = 0; ++ else { ++ struct pci_dev *pf_pdev; ++ ++ /* pdev will be returned if device is not a vf */ ++ pf_pdev = pci_physfn(pdev); ++ info->pfsid = PCI_DEVID(pf_pdev->bus->number, pf_pdev->devfn); ++ } + + #ifdef CONFIG_INTEL_IOMMU_SVM + /* The PCIe spec, in its wisdom, declares that the behaviour of +@@ -1537,7 +1552,8 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain, + + sid = info->bus << 8 | info->devfn; + qdep = info->ats_qdep; +- qi_flush_dev_iotlb(info->iommu, sid, qdep, addr, mask); ++ qi_flush_dev_iotlb(info->iommu, sid, info->pfsid, ++ qdep, addr, mask); + } + spin_unlock_irqrestore(&device_domain_lock, flags); + } +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index f2c0000de613..95a6ae053714 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -462,8 +462,10 @@ static int bch_writeback_thread(void *arg) + * data on cache. BCACHE_DEV_DETACHING flag is set in + * bch_cached_dev_detach(). + */ +- if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) ++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { ++ up_write(&dc->writeback_lock); + break; ++ } + } + + up_write(&dc->writeback_lock); +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index d3c55d7754af..905badc6cb17 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -337,7 +337,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd) + disk_super->version = cpu_to_le32(MAX_CACHE_VERSION); + memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name)); + memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version)); +- disk_super->policy_hint_size = 0; ++ disk_super->policy_hint_size = cpu_to_le32(0); + + __copy_sm_root(cmd, disk_super); + +@@ -652,6 +652,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd, + disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]); + disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]); + disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]); ++ disk_super->policy_hint_size = cpu_to_le32(cmd->policy_hint_size); + + disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits); + disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses); +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 5e047bfc0cc4..518e2dec2aa2 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -341,7 +341,13 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps) + success = false; + } + +- if (b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) ++ /* ++ * 2MB pages are only supported with batching. If batching is for some ++ * reason disabled, do not use 2MB pages, since otherwise the legacy ++ * mechanism is used with 2MB pages, causing a failure. ++ */ ++ if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) && ++ (b->capabilities & VMW_BALLOON_BATCHED_CMDS)) + b->supported_page_sizes = 2; + else + b->supported_page_sizes = 1; +@@ -450,7 +456,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, + + pfn32 = (u32)pfn; + if (pfn32 != pfn) +- return -1; ++ return -EINVAL; + + STATS_INC(b->stats.lock[false]); + +@@ -460,7 +466,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, + + pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status); + STATS_INC(b->stats.lock_fail[false]); +- return 1; ++ return -EIO; + } + + static int vmballoon_send_batched_lock(struct vmballoon *b, +@@ -597,11 +603,12 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, + + locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status, + target); +- if (locked > 0) { ++ if (locked) { + STATS_INC(b->stats.refused_alloc[false]); + +- if (hv_status == VMW_BALLOON_ERROR_RESET || +- hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED) { ++ if (locked == -EIO && ++ (hv_status == VMW_BALLOON_ERROR_RESET || ++ hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) { + vmballoon_free_page(page, false); + return -EIO; + } +@@ -617,7 +624,7 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, + } else { + vmballoon_free_page(page, false); + } +- return -EIO; ++ return locked; + } + + /* track allocated page */ +@@ -1029,29 +1036,30 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b) + */ + static int vmballoon_vmci_init(struct vmballoon *b) + { +- int error = 0; ++ unsigned long error, dummy; + +- if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) != 0) { +- error = vmci_doorbell_create(&b->vmci_doorbell, +- VMCI_FLAG_DELAYED_CB, +- VMCI_PRIVILEGE_FLAG_RESTRICTED, +- vmballoon_doorbell, b); +- +- if (error == VMCI_SUCCESS) { +- VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, +- b->vmci_doorbell.context, +- b->vmci_doorbell.resource, error); +- STATS_INC(b->stats.doorbell_set); +- } +- } ++ if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0) ++ return 0; + +- if (error != 0) { +- vmballoon_vmci_cleanup(b); ++ error = vmci_doorbell_create(&b->vmci_doorbell, VMCI_FLAG_DELAYED_CB, ++ VMCI_PRIVILEGE_FLAG_RESTRICTED, ++ vmballoon_doorbell, b); + +- return -EIO; +- } ++ if (error != VMCI_SUCCESS) ++ goto fail; ++ ++ error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context, ++ b->vmci_doorbell.resource, dummy); ++ ++ STATS_INC(b->stats.doorbell_set); ++ ++ if (error != VMW_BALLOON_SUCCESS) ++ goto fail; + + return 0; ++fail: ++ vmballoon_vmci_cleanup(b); ++ return -EIO; + } + + /* +@@ -1289,7 +1297,14 @@ static int __init vmballoon_init(void) + + return 0; + } +-module_init(vmballoon_init); ++ ++/* ++ * Using late_initcall() instead of module_init() allows the balloon to use the ++ * VMCI doorbell even when the balloon is built into the kernel. Otherwise the ++ * VMCI is probed only after the balloon is initialized. If the balloon is used ++ * as a module, late_initcall() is equivalent to module_init(). ++ */ ++late_initcall(vmballoon_init); + + static void __exit vmballoon_exit(void) + { +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index acec4b565511..1aede726052c 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -902,6 +902,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + + ret = lan78xx_update_flowcontrol(dev, ecmd.duplex, ladv, radv); + netif_carrier_on(dev->net); ++ ++ tasklet_schedule(&dev->bh); + } + + return ret; +@@ -1361,8 +1363,6 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev) + netif_dbg(dev, ifup, dev->net, + "MAC address set to random addr"); + } +- +- tasklet_schedule(&dev->bh); + } + + ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo); +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 6a41e66015b6..062dff1c902d 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -384,6 +384,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + aqcsfrc_mask = AQCSFRC_CSFA_MASK; + } + ++ /* Update shadow register first before modifying active register */ ++ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); + /* + * Changes to immediate action on Action Qualifier. This puts + * Action Qualifier control on PWM output from next TBCLK +diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c +index c872a2e54c4b..2603bee2ce07 100644 +--- a/drivers/spi/spi-davinci.c ++++ b/drivers/spi/spi-davinci.c +@@ -220,7 +220,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value) + pdata = &dspi->pdata; + + /* program delay transfers if tx_delay is non zero */ +- if (spicfg->wdelay) ++ if (spicfg && spicfg->wdelay) + spidat1 |= SPIDAT1_WDEL; + + /* +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 0705d8883ede..8a29ec5992fd 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1687,12 +1687,12 @@ static int do_register_framebuffer(struct fb_info *fb_info) + return 0; + } + +-static int do_unregister_framebuffer(struct fb_info *fb_info) ++static int unbind_console(struct fb_info *fb_info) + { + struct fb_event event; +- int i, ret = 0; ++ int ret; ++ int i = fb_info->node; + +- i = fb_info->node; + if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info) + return -EINVAL; + +@@ -1707,17 +1707,29 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + unlock_fb_info(fb_info); + console_unlock(); + ++ return ret; ++} ++ ++static int __unlink_framebuffer(struct fb_info *fb_info); ++ ++static int do_unregister_framebuffer(struct fb_info *fb_info) ++{ ++ struct fb_event event; ++ int ret; ++ ++ ret = unbind_console(fb_info); ++ + if (ret) + return -EINVAL; + + pm_vt_switch_unregister(fb_info->dev); + +- unlink_framebuffer(fb_info); ++ __unlink_framebuffer(fb_info); + if (fb_info->pixmap.addr && + (fb_info->pixmap.flags & FB_PIXMAP_DEFAULT)) + kfree(fb_info->pixmap.addr); + fb_destroy_modelist(&fb_info->modelist); +- registered_fb[i] = NULL; ++ registered_fb[fb_info->node] = NULL; + num_registered_fb--; + fb_cleanup_device(fb_info); + event.info = fb_info; +@@ -1730,7 +1742,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + return 0; + } + +-int unlink_framebuffer(struct fb_info *fb_info) ++static int __unlink_framebuffer(struct fb_info *fb_info) + { + int i; + +@@ -1742,6 +1754,20 @@ int unlink_framebuffer(struct fb_info *fb_info) + device_destroy(fb_class, MKDEV(FB_MAJOR, i)); + fb_info->dev = NULL; + } ++ ++ return 0; ++} ++ ++int unlink_framebuffer(struct fb_info *fb_info) ++{ ++ int ret; ++ ++ ret = __unlink_framebuffer(fb_info); ++ if (ret) ++ return ret; ++ ++ unbind_console(fb_info); ++ + return 0; + } + EXPORT_SYMBOL(unlink_framebuffer); +diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c +index e3d026ac382e..f35168ce426b 100644 +--- a/fs/9p/xattr.c ++++ b/fs/9p/xattr.c +@@ -107,7 +107,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, + { + struct kvec kvec = {.iov_base = (void *)value, .iov_len = value_len}; + struct iov_iter from; +- int retval; ++ int retval, err; + + iov_iter_kvec(&from, WRITE | ITER_KVEC, &kvec, 1, value_len); + +@@ -128,7 +128,9 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, + retval); + else + p9_client_write(fid, 0, &from, &retval); +- p9_client_clunk(fid); ++ err = p9_client_clunk(fid); ++ if (!retval && err) ++ retval = err; + return retval; + } + +diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c +index a861bbdfe577..fa8b484d035d 100644 +--- a/fs/nfs/blocklayout/dev.c ++++ b/fs/nfs/blocklayout/dev.c +@@ -162,7 +162,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset, + chunk = div_u64(offset, dev->chunk_size); + div_u64_rem(chunk, dev->nr_children, &chunk_idx); + +- if (chunk_idx > dev->nr_children) { ++ if (chunk_idx >= dev->nr_children) { + dprintk("%s: invalid chunk idx %d (%lld/%lld)\n", + __func__, chunk_idx, offset, dev->chunk_size); + /* error, should not happen */ +diff --git a/fs/quota/quota.c b/fs/quota/quota.c +index 3746367098fd..bb0d643481c8 100644 +--- a/fs/quota/quota.c ++++ b/fs/quota/quota.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + static int check_quotactl_permission(struct super_block *sb, int type, int cmd, + qid_t id) +@@ -644,6 +645,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id, + + if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS)) + return -EINVAL; ++ type = array_index_nospec(type, MAXQUOTAS); + /* + * Quota not supported on this fs? Check this before s_quota_types + * since they needn't be set if quota is not supported at all. +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index 22dba8837a86..539fa934ed93 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -661,6 +661,11 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + spin_lock(&ui->ui_lock); + ui->synced_i_size = ui->ui_size; + spin_unlock(&ui->ui_lock); ++ if (xent) { ++ spin_lock(&host_ui->ui_lock); ++ host_ui->synced_i_size = host_ui->ui_size; ++ spin_unlock(&host_ui->ui_lock); ++ } + mark_inode_clean(c, ui); + mark_inode_clean(c, host_ui); + return 0; +@@ -1107,7 +1112,7 @@ static int recomp_data_node(const struct ubifs_info *c, + int err, len, compr_type, out_len; + + out_len = le32_to_cpu(dn->size); +- buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS); ++ buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS); + if (!buf) + return -ENOMEM; + +@@ -1186,7 +1191,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, + else if (err) + goto out_free; + else { +- if (le32_to_cpu(dn->size) <= dlen) ++ int dn_len = le32_to_cpu(dn->size); ++ ++ if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) { ++ ubifs_err(c, "bad data node (block %u, inode %lu)", ++ blk, inode->i_ino); ++ ubifs_dump_node(c, dn); ++ goto out_free; ++ } ++ ++ if (dn_len <= dlen) + dlen = 0; /* Nothing to do */ + else { + int compr_type = le16_to_cpu(dn->compr_type); +diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c +index a0011aa3a779..f43f162e36f4 100644 +--- a/fs/ubifs/lprops.c ++++ b/fs/ubifs/lprops.c +@@ -1091,10 +1091,6 @@ static int scan_check_cb(struct ubifs_info *c, + } + } + +- buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL); +- if (!buf) +- return -ENOMEM; +- + /* + * After an unclean unmount, empty and freeable LEBs + * may contain garbage - do not scan them. +@@ -1113,6 +1109,10 @@ static int scan_check_cb(struct ubifs_info *c, + return LPT_SCAN_CONTINUE; + } + ++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ + sleb = ubifs_scan(c, lnum, 0, buf, 0); + if (IS_ERR(sleb)) { + ret = PTR_ERR(sleb); +diff --git a/fs/xattr.c b/fs/xattr.c +index 76f01bf4b048..09441c396798 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -453,7 +453,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, + if (error > 0) { + if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || + (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) +- posix_acl_fix_xattr_to_user(kvalue, size); ++ posix_acl_fix_xattr_to_user(kvalue, error); + if (size && copy_to_user(value, kvalue, error)) + error = -EFAULT; + } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) { +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 23e129ef6726..e353f6600b0b 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -125,6 +125,7 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) + * Extended Capability Register + */ + ++#define ecap_dit(e) ((e >> 41) & 0x1) + #define ecap_pasid(e) ((e >> 40) & 0x1) + #define ecap_pss(e) ((e >> 35) & 0x1f) + #define ecap_eafs(e) ((e >> 34) & 0x1) +@@ -294,6 +295,7 @@ enum { + #define QI_DEV_IOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32) + #define QI_DEV_IOTLB_QDEP(qdep) (((qdep) & 0x1f) << 16) + #define QI_DEV_IOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK) ++#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52)) + #define QI_DEV_IOTLB_SIZE 1 + #define QI_DEV_IOTLB_MAX_INVS 32 + +@@ -318,6 +320,7 @@ enum { + #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) + #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) + #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) ++#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52)) + #define QI_DEV_EIOTLB_MAX_INVS 32 + + #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55) +@@ -463,9 +466,8 @@ extern void qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, + u8 fm, u64 type); + extern void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, + unsigned int size_order, u64 type); +-extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, +- u64 addr, unsigned mask); +- ++extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, ++ u16 qdep, u64 addr, unsigned mask); + extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu); + + extern int dmar_ir_support(void); +diff --git a/include/linux/io.h b/include/linux/io.h +index de64c1e53612..8ab45611fc35 100644 +--- a/include/linux/io.h ++++ b/include/linux/io.h +@@ -154,4 +154,26 @@ enum { + void *memremap(resource_size_t offset, size_t size, unsigned long flags); + void memunmap(void *addr); + ++/* ++ * On x86 PAT systems we have memory tracking that keeps track of ++ * the allowed mappings on memory ranges. This tracking works for ++ * all the in-kernel mapping APIs (ioremap*), but where the user ++ * wishes to map a range from a physical device into user memory ++ * the tracking won't be updated. This API is to be used by ++ * drivers which remap physical device pages into userspace, ++ * and wants to make sure they are mapped WC and not UC. ++ */ ++#ifndef arch_io_reserve_memtype_wc ++static inline int arch_io_reserve_memtype_wc(resource_size_t base, ++ resource_size_t size) ++{ ++ return 0; ++} ++ ++static inline void arch_io_free_memtype_wc(resource_size_t base, ++ resource_size_t size) ++{ ++} ++#endif ++ + #endif /* _LINUX_IO_H */ +diff --git a/include/video/udlfb.h b/include/video/udlfb.h +index f9466fa54ba4..2ad9a6d37ff4 100644 +--- a/include/video/udlfb.h ++++ b/include/video/udlfb.h +@@ -87,7 +87,7 @@ struct dlfb_data { + #define MIN_RAW_PIX_BYTES 2 + #define MIN_RAW_CMD_BYTES (RAW_HEADER_BYTES + MIN_RAW_PIX_BYTES) + +-#define DL_DEFIO_WRITE_DELAY 5 /* fb_deferred_io.delay in jiffies */ ++#define DL_DEFIO_WRITE_DELAY msecs_to_jiffies(HZ <= 300 ? 4 : 10) /* optimal value for 720p video */ + #define DL_DEFIO_WRITE_DISABLE (HZ*60) /* "disable" with long delay */ + + /* remove these once align.h patch is taken into kernel */ +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 850b255649a2..ac6849ee3057 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -313,10 +313,16 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data), + task = create->result; + if (!IS_ERR(task)) { + static const struct sched_param param = { .sched_priority = 0 }; ++ char name[TASK_COMM_LEN]; + va_list args; + + va_start(args, namefmt); +- vsnprintf(task->comm, sizeof(task->comm), namefmt, args); ++ /* ++ * task is already visible to other tasks, so updating ++ * COMM must be protected. ++ */ ++ vsnprintf(name, sizeof(name), namefmt, args); ++ set_task_comm(task, name); + va_end(args); + /* + * root may have changed our (kthreadd's) priority or CPU mask. +diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig +index 02e8dfaa1ce2..9d76184279fe 100644 +--- a/kernel/power/Kconfig ++++ b/kernel/power/Kconfig +@@ -105,6 +105,7 @@ config PM_SLEEP + def_bool y + depends on SUSPEND || HIBERNATE_CALLBACKS + select PM ++ select SRCU + + config PM_SLEEP_SMP + def_bool y +diff --git a/kernel/sys.c b/kernel/sys.c +index f718742e55e6..e2446ade79ba 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1142,18 +1142,19 @@ static int override_release(char __user *release, size_t len) + + SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) + { +- int errno = 0; ++ struct new_utsname tmp; + + down_read(&uts_sem); +- if (copy_to_user(name, utsname(), sizeof *name)) +- errno = -EFAULT; ++ memcpy(&tmp, utsname(), sizeof(tmp)); + up_read(&uts_sem); ++ if (copy_to_user(name, &tmp, sizeof(tmp))) ++ return -EFAULT; + +- if (!errno && override_release(name->release, sizeof(name->release))) +- errno = -EFAULT; +- if (!errno && override_architecture(name)) +- errno = -EFAULT; +- return errno; ++ if (override_release(name->release, sizeof(name->release))) ++ return -EFAULT; ++ if (override_architecture(name)) ++ return -EFAULT; ++ return 0; + } + + #ifdef __ARCH_WANT_SYS_OLD_UNAME +@@ -1162,55 +1163,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) + */ + SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) + { +- int error = 0; ++ struct old_utsname tmp; + + if (!name) + return -EFAULT; + + down_read(&uts_sem); +- if (copy_to_user(name, utsname(), sizeof(*name))) +- error = -EFAULT; ++ memcpy(&tmp, utsname(), sizeof(tmp)); + up_read(&uts_sem); ++ if (copy_to_user(name, &tmp, sizeof(tmp))) ++ return -EFAULT; + +- if (!error && override_release(name->release, sizeof(name->release))) +- error = -EFAULT; +- if (!error && override_architecture(name)) +- error = -EFAULT; +- return error; ++ if (override_release(name->release, sizeof(name->release))) ++ return -EFAULT; ++ if (override_architecture(name)) ++ return -EFAULT; ++ return 0; + } + + SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) + { +- int error; ++ struct oldold_utsname tmp = {}; + + if (!name) + return -EFAULT; +- if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname))) +- return -EFAULT; + + down_read(&uts_sem); +- error = __copy_to_user(&name->sysname, &utsname()->sysname, +- __OLD_UTS_LEN); +- error |= __put_user(0, name->sysname + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->nodename, &utsname()->nodename, +- __OLD_UTS_LEN); +- error |= __put_user(0, name->nodename + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->release, &utsname()->release, +- __OLD_UTS_LEN); +- error |= __put_user(0, name->release + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->version, &utsname()->version, +- __OLD_UTS_LEN); +- error |= __put_user(0, name->version + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->machine, &utsname()->machine, +- __OLD_UTS_LEN); +- error |= __put_user(0, name->machine + __OLD_UTS_LEN); ++ memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN); ++ memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN); ++ memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN); ++ memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN); ++ memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN); + up_read(&uts_sem); ++ if (copy_to_user(name, &tmp, sizeof(tmp))) ++ return -EFAULT; + +- if (!error && override_architecture(name)) +- error = -EFAULT; +- if (!error && override_release(name->release, sizeof(name->release))) +- error = -EFAULT; +- return error ? -EFAULT : 0; ++ if (override_architecture(name)) ++ return -EFAULT; ++ if (override_release(name->release, sizeof(name->release))) ++ return -EFAULT; ++ return 0; + } + #endif + +@@ -1224,17 +1216,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) + + if (len < 0 || len > __NEW_UTS_LEN) + return -EINVAL; +- down_write(&uts_sem); + errno = -EFAULT; + if (!copy_from_user(tmp, name, len)) { +- struct new_utsname *u = utsname(); ++ struct new_utsname *u; + ++ down_write(&uts_sem); ++ u = utsname(); + memcpy(u->nodename, tmp, len); + memset(u->nodename + len, 0, sizeof(u->nodename) - len); + errno = 0; + uts_proc_notify(UTS_PROC_HOSTNAME); ++ up_write(&uts_sem); + } +- up_write(&uts_sem); + return errno; + } + +@@ -1242,8 +1235,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) + + SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) + { +- int i, errno; ++ int i; + struct new_utsname *u; ++ char tmp[__NEW_UTS_LEN + 1]; + + if (len < 0) + return -EINVAL; +@@ -1252,11 +1246,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) + i = 1 + strlen(u->nodename); + if (i > len) + i = len; +- errno = 0; +- if (copy_to_user(name, u->nodename, i)) +- errno = -EFAULT; ++ memcpy(tmp, u->nodename, i); + up_read(&uts_sem); +- return errno; ++ if (copy_to_user(name, tmp, i)) ++ return -EFAULT; ++ return 0; + } + + #endif +@@ -1275,17 +1269,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len) + if (len < 0 || len > __NEW_UTS_LEN) + return -EINVAL; + +- down_write(&uts_sem); + errno = -EFAULT; + if (!copy_from_user(tmp, name, len)) { +- struct new_utsname *u = utsname(); ++ struct new_utsname *u; + ++ down_write(&uts_sem); ++ u = utsname(); + memcpy(u->domainname, tmp, len); + memset(u->domainname + len, 0, sizeof(u->domainname) - len); + errno = 0; + uts_proc_notify(UTS_PROC_DOMAINNAME); ++ up_write(&uts_sem); + } +- up_write(&uts_sem); + return errno; + } + +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 7ab5eafea8b2..210b8e726a97 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -1716,6 +1716,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev, + mutex_lock(&bdev->bd_mutex); + + if (attr == &dev_attr_enable) { ++ if (!!value == !!q->blk_trace) { ++ ret = 0; ++ goto out_unlock_bdev; ++ } + if (value) + ret = blk_trace_setup_queue(q, bdev); + else +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 11761b3dd7ba..e409ddce8754 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6496,7 +6496,9 @@ rb_simple_write(struct file *filp, const char __user *ubuf, + + if (buffer) { + mutex_lock(&trace_types_lock); +- if (val) { ++ if (!!val == tracer_tracing_is_on(tr)) { ++ val = 0; /* do nothing */ ++ } else if (val) { + tracer_tracing_on(tr); + if (tr->current_trace->start) + tr->current_trace->start(tr); +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 68bb89ad9d28..1dc887bab085 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -969,7 +969,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file) + + list_del_rcu(&link->list); + /* synchronize with u{,ret}probe_trace_func */ +- synchronize_sched(); ++ synchronize_rcu(); + kfree(link); + + if (!list_empty(&tu->tp.files)) +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 88fefa68c516..a965df4b54f5 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -602,9 +602,26 @@ static ssize_t map_write(struct file *file, const char __user *buf, + struct uid_gid_map new_map; + unsigned idx; + struct uid_gid_extent *extent = NULL; +- unsigned long page = 0; ++ unsigned long page; + char *kbuf, *pos, *next_line; +- ssize_t ret = -EINVAL; ++ ssize_t ret; ++ ++ /* Only allow < page size writes at the beginning of the file */ ++ if ((*ppos != 0) || (count >= PAGE_SIZE)) ++ return -EINVAL; ++ ++ /* Get a buffer */ ++ page = __get_free_page(GFP_TEMPORARY); ++ kbuf = (char *) page; ++ if (!page) ++ return -ENOMEM; ++ ++ /* Slurp in the user data */ ++ if (copy_from_user(kbuf, buf, count)) { ++ free_page(page); ++ return -EFAULT; ++ } ++ kbuf[count] = '\0'; + + /* + * The userns_state_mutex serializes all writes to any given map. +@@ -638,24 +655,6 @@ static ssize_t map_write(struct file *file, const char __user *buf, + if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN)) + goto out; + +- /* Get a buffer */ +- ret = -ENOMEM; +- page = __get_free_page(GFP_TEMPORARY); +- kbuf = (char *) page; +- if (!page) +- goto out; +- +- /* Only allow < page size writes at the beginning of the file */ +- ret = -EINVAL; +- if ((*ppos != 0) || (count >= PAGE_SIZE)) +- goto out; +- +- /* Slurp in the user data */ +- ret = -EFAULT; +- if (copy_from_user(kbuf, buf, count)) +- goto out; +- kbuf[count] = '\0'; +- + /* Parse the user data */ + ret = -EINVAL; + pos = kbuf; +diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c +index c8eac43267e9..d2b3b2973456 100644 +--- a/kernel/utsname_sysctl.c ++++ b/kernel/utsname_sysctl.c +@@ -17,7 +17,7 @@ + + #ifdef CONFIG_PROC_SYSCTL + +-static void *get_uts(struct ctl_table *table, int write) ++static void *get_uts(struct ctl_table *table) + { + char *which = table->data; + struct uts_namespace *uts_ns; +@@ -25,21 +25,9 @@ static void *get_uts(struct ctl_table *table, int write) + uts_ns = current->nsproxy->uts_ns; + which = (which - (char *)&init_uts_ns) + (char *)uts_ns; + +- if (!write) +- down_read(&uts_sem); +- else +- down_write(&uts_sem); + return which; + } + +-static void put_uts(struct ctl_table *table, int write, void *which) +-{ +- if (!write) +- up_read(&uts_sem); +- else +- up_write(&uts_sem); +-} +- + /* + * Special case of dostring for the UTS structure. This has locks + * to observe. Should this be in kernel/sys.c ???? +@@ -49,13 +37,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write, + { + struct ctl_table uts_table; + int r; ++ char tmp_data[__NEW_UTS_LEN + 1]; ++ + memcpy(&uts_table, table, sizeof(uts_table)); +- uts_table.data = get_uts(table, write); ++ uts_table.data = tmp_data; ++ ++ /* ++ * Buffer the value in tmp_data so that proc_dostring() can be called ++ * without holding any locks. ++ * We also need to read the original value in the write==1 case to ++ * support partial writes. ++ */ ++ down_read(&uts_sem); ++ memcpy(tmp_data, get_uts(table), sizeof(tmp_data)); ++ up_read(&uts_sem); + r = proc_dostring(&uts_table, write, buffer, lenp, ppos); +- put_uts(table, write, uts_table.data); + +- if (write) ++ if (write) { ++ /* ++ * Write back the new value. ++ * Note that, since we dropped uts_sem, the result can ++ * theoretically be incorrect if there are two parallel writes ++ * at non-zero offsets to the same sysctl. ++ */ ++ down_write(&uts_sem); ++ memcpy(get_uts(table), tmp_data, sizeof(tmp_data)); ++ up_write(&uts_sem); + proc_sys_poll_notify(table->poll); ++ } + + return r; + } +diff --git a/mm/memory.c b/mm/memory.c +index 42db644f5ec4..5aee9ec8b8c6 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -361,15 +361,6 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table) + { + struct mmu_table_batch **batch = &tlb->batch; + +- /* +- * When there's less then two users of this mm there cannot be a +- * concurrent page-table walk. +- */ +- if (atomic_read(&tlb->mm->mm_users) < 2) { +- __tlb_remove_table(table); +- return; +- } +- + if (*batch == NULL) { + *batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN); + if (*batch == NULL) { +diff --git a/net/9p/client.c b/net/9p/client.c +index 3ff26eb1ea20..ed8738c4dc09 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -931,7 +931,7 @@ static int p9_client_version(struct p9_client *c) + { + int err = 0; + struct p9_req_t *req; +- char *version; ++ char *version = NULL; + int msize; + + p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n", +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index bced8c074c12..2f68ffda3715 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m) + spin_lock_irqsave(&p9_poll_lock, flags); + list_del_init(&m->poll_pending_link); + spin_unlock_irqrestore(&p9_poll_lock, flags); ++ ++ flush_work(&p9_poll_work); + } + + /** +@@ -933,7 +935,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args) + if (err < 0) + return err; + +- if (valid_ipaddr4(addr) < 0) ++ if (addr == NULL || valid_ipaddr4(addr) < 0) + return -EINVAL; + + csocket = NULL; +@@ -981,6 +983,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) + + csocket = NULL; + ++ if (addr == NULL) ++ return -EINVAL; ++ + if (strlen(addr) >= UNIX_PATH_MAX) { + pr_err("%s (%d): address too long: %s\n", + __func__, task_pid_nr(current), addr); +diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c +index 52b4a2f993f2..f42550dd3560 100644 +--- a/net/9p/trans_rdma.c ++++ b/net/9p/trans_rdma.c +@@ -644,6 +644,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args) + struct ib_qp_init_attr qp_attr; + struct ib_cq_init_attr cq_attr = {}; + ++ if (addr == NULL) ++ return -EINVAL; ++ + /* Parse the transport specific mount options */ + err = parse_opts(args, &opts); + if (err < 0) +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 2ddeecca5b12..6018a1c0dc28 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -192,7 +192,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, + s = rest_of_page(data); + if (s > count) + s = count; +- BUG_ON(index > limit); ++ BUG_ON(index >= limit); + /* Make sure we don't terminate early. */ + sg_unmark_end(&sg[index]); + sg_set_buf(&sg[index++], data, s); +@@ -237,6 +237,7 @@ pack_sg_list_p(struct scatterlist *sg, int start, int limit, + s = PAGE_SIZE - data_off; + if (s > count) + s = count; ++ BUG_ON(index >= limit); + /* Make sure we don't terminate early. */ + sg_unmark_end(&sg[index]); + sg_set_page(&sg[index++], pdata[i++], s, data_off); +@@ -409,6 +410,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, + p9_debug(P9_DEBUG_TRANS, "virtio request\n"); + + if (uodata) { ++ __le32 sz; + int n = p9_get_mapped_pages(chan, &out_pages, uodata, + outlen, &offs, &need_drop); + if (n < 0) +@@ -419,6 +421,12 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, + memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4); + outlen = n; + } ++ /* The size field of the message must include the length of the ++ * header and the length of the data. We didn't actually know ++ * the length of the data until this point so add it in now. ++ */ ++ sz = cpu_to_le32(req->tc->size + outlen); ++ memcpy(&req->tc->sdata[0], &sz, sizeof(sz)); + } else if (uidata) { + int n = p9_get_mapped_pages(chan, &in_pages, uidata, + inlen, &offs, &need_drop); +@@ -646,6 +654,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args) + int ret = -ENOENT; + int found = 0; + ++ if (devname == NULL) ++ return -EINVAL; ++ + mutex_lock(&virtio_9p_lock); + list_for_each_entry(chan, &virtio_chan_list, chan_list) { + if (!strncmp(devname, chan->tag, chan->tag_len) && +diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c +index d4353faced35..a10db45b2e1e 100644 +--- a/net/ieee802154/6lowpan/tx.c ++++ b/net/ieee802154/6lowpan/tx.c +@@ -265,9 +265,24 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev) + /* We must take a copy of the skb before we modify/replace the ipv6 + * header as the header could be used elsewhere + */ +- skb = skb_unshare(skb, GFP_ATOMIC); +- if (!skb) +- return NET_XMIT_DROP; ++ if (unlikely(skb_headroom(skb) < ldev->needed_headroom || ++ skb_tailroom(skb) < ldev->needed_tailroom)) { ++ struct sk_buff *nskb; ++ ++ nskb = skb_copy_expand(skb, ldev->needed_headroom, ++ ldev->needed_tailroom, GFP_ATOMIC); ++ if (likely(nskb)) { ++ consume_skb(skb); ++ skb = nskb; ++ } else { ++ kfree_skb(skb); ++ return NET_XMIT_DROP; ++ } ++ } else { ++ skb = skb_unshare(skb, GFP_ATOMIC); ++ if (!skb) ++ return NET_XMIT_DROP; ++ } + + ret = lowpan_header(skb, ldev, &dgram_size, &dgram_offset); + if (ret < 0) { +diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c +index 3827f359b336..9e1ff9d4cf2d 100644 +--- a/net/mac802154/tx.c ++++ b/net/mac802154/tx.c +@@ -72,8 +72,21 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) + int ret; + + if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) { +- u16 crc = crc_ccitt(0, skb->data, skb->len); ++ struct sk_buff *nskb; ++ u16 crc; ++ ++ if (unlikely(skb_tailroom(skb) < IEEE802154_FCS_LEN)) { ++ nskb = skb_copy_expand(skb, 0, IEEE802154_FCS_LEN, ++ GFP_ATOMIC); ++ if (likely(nskb)) { ++ consume_skb(skb); ++ skb = nskb; ++ } else { ++ goto err_tx; ++ } ++ } + ++ crc = crc_ccitt(0, skb->data, skb->len); + put_unaligned_le16(crc, skb_put(skb, 2)); + } + +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index 7f10430af39c..58426e7d320d 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -186,6 +186,9 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues, + for (i = 0; i < queues->nr_queues; i++) { + list_splice_tail(&queues->queue_array[i].head, + &queue_array[i].head); ++ queue_array[i].tid = queues->queue_array[i].tid; ++ queue_array[i].cpu = queues->queue_array[i].cpu; ++ queue_array[i].set = queues->queue_array[i].set; + queue_array[i].priv = queues->queue_array[i].priv; + } + diff --git a/patch/kernel/mvebu-default/04-patch-4.4.156-157.patch b/patch/kernel/mvebu-default/04-patch-4.4.156-157.patch new file mode 100644 index 000000000..45066d89c --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.156-157.patch @@ -0,0 +1,1664 @@ +diff --git a/Makefile b/Makefile +index 6dd5924a7ea5..2d55f88e6a08 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 156 ++SUBLEVEL = 157 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index f1ac9818b751..dbee1934dfc6 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 323486d6ee83..561eac854cc3 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index 66191cd0447e..aa4f261b6508 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index d113c8ded6e2..6df3a4ea77fc 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -349,6 +349,7 @@ static int __init octeon_ehci_device_init(void) + return 0; + + pd = of_find_device_by_node(ehci_node); ++ of_node_put(ehci_node); + if (!pd) + return 0; + +@@ -411,6 +412,7 @@ static int __init octeon_ohci_device_init(void) + return 0; + + pd = of_find_device_by_node(ohci_node); ++ of_node_put(ohci_node); + if (!pd) + return 0; + +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 75fa296836fc..ab1df19b0957 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) + /* + * ISA I/O bus memory addresses are 1:1 with the physical address. + */ +-static inline unsigned long isa_virt_to_bus(volatile void * address) ++static inline unsigned long isa_virt_to_bus(volatile void *address) + { +- return (unsigned long)address - PAGE_OFFSET; ++ return virt_to_phys(address); + } + +-static inline void * isa_bus_to_virt(unsigned long address) ++static inline void *isa_bus_to_virt(unsigned long address) + { +- return (void *)(address + PAGE_OFFSET); ++ return phys_to_virt(address); + } + + #define isa_page_to_bus page_to_phys +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 354b99f56c1e..ed6cac4a4df0 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + struct thread_info *ti = task_thread_info(p); + struct pt_regs *childregs, *regs = current_pt_regs(); + unsigned long childksp; +- p->set_child_tid = p->clear_child_tid = NULL; + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 5d3a25e1cfae..52e8c2026853 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -712,7 +712,8 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end) + static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +@@ -745,7 +746,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index 7095dfe7666b..962372143fda 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + + top_of_kernel_stack = sp; + +- p->set_child_tid = p->clear_child_tid = NULL; +- + /* Locate userspace context on stack... */ + sp -= STACK_FRAME_OVERHEAD; /* redzone */ + sp -= sizeof(struct pt_regs); +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 337c52192278..440a948c4feb 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -104,6 +104,8 @@ struct cpuinfo_x86 { + __u8 x86_phys_bits; + /* CPUID returned core id bits: */ + __u8 x86_coreid_bits; ++ ++ __u8 x86_cache_bits; + /* Max extended CPUID function supported: */ + __u32 extended_cpuid_level; + /* Maximum supported CPUID level, -1=no CPUID: */ +@@ -174,7 +176,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c); + + static inline unsigned long long l1tf_pfn_limit(void) + { +- return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); ++ return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT); + } + + extern void early_cpu_init(void); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index b9e6b60df148..621bc6561189 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -634,6 +634,46 @@ void x86_spec_ctrl_setup_ap(void) + + #undef pr_fmt + #define pr_fmt(fmt) "L1TF: " fmt ++ ++/* ++ * These CPUs all support 44bits physical address space internally in the ++ * cache but CPUID can report a smaller number of physical address bits. ++ * ++ * The L1TF mitigation uses the top most address bit for the inversion of ++ * non present PTEs. When the installed memory reaches into the top most ++ * address bit due to memory holes, which has been observed on machines ++ * which report 36bits physical address bits and have 32G RAM installed, ++ * then the mitigation range check in l1tf_select_mitigation() triggers. ++ * This is a false positive because the mitigation is still possible due to ++ * the fact that the cache uses 44bit internally. Use the cache bits ++ * instead of the reported physical bits and adjust them on the affected ++ * machines to 44bit if the reported bits are less than 44. ++ */ ++static void override_cache_bits(struct cpuinfo_x86 *c) ++{ ++ if (c->x86 != 6) ++ return; ++ ++ switch (c->x86_model) { ++ case INTEL_FAM6_NEHALEM: ++ case INTEL_FAM6_WESTMERE: ++ case INTEL_FAM6_SANDYBRIDGE: ++ case INTEL_FAM6_IVYBRIDGE: ++ case INTEL_FAM6_HASWELL_CORE: ++ case INTEL_FAM6_HASWELL_ULT: ++ case INTEL_FAM6_HASWELL_GT3E: ++ case INTEL_FAM6_BROADWELL_CORE: ++ case INTEL_FAM6_BROADWELL_GT3E: ++ case INTEL_FAM6_SKYLAKE_MOBILE: ++ case INTEL_FAM6_SKYLAKE_DESKTOP: ++ case INTEL_FAM6_KABYLAKE_MOBILE: ++ case INTEL_FAM6_KABYLAKE_DESKTOP: ++ if (c->x86_cache_bits < 44) ++ c->x86_cache_bits = 44; ++ break; ++ } ++} ++ + static void __init l1tf_select_mitigation(void) + { + u64 half_pa; +@@ -641,16 +681,13 @@ static void __init l1tf_select_mitigation(void) + if (!boot_cpu_has_bug(X86_BUG_L1TF)) + return; + ++ override_cache_bits(&boot_cpu_data); ++ + #if CONFIG_PGTABLE_LEVELS == 2 + pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); + return; + #endif + +- /* +- * This is extremely unlikely to happen because almost all +- * systems have far more MAX_PA/2 than RAM can be fit into +- * DIMM slots. +- */ + half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; + if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 4d3fa79c0f09..b12c0287d6cf 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -798,6 +798,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + c->x86_phys_bits = 36; + #endif + ++ c->x86_cache_bits = c->x86_phys_bits; ++ + if (c->extended_cpuid_level >= 0x8000000a) + c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e0a34b0d381e..c4dffae5d939 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -273,8 +273,6 @@ static noinline int vmalloc_fault(unsigned long address) + if (!(address >= VMALLOC_START && address < VMALLOC_END)) + return -1; + +- WARN_ON_ONCE(in_nmi()); +- + /* + * Synchronize this task's top level page-table + * with the 'reference' page table. +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 46ba2402c8f9..987361113ecd 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + } + + wb_congested = wb_congested_get_create(&q->backing_dev_info, +- blkcg->css.id, GFP_NOWAIT); ++ blkcg->css.id, ++ GFP_NOWAIT | __GFP_NOWARN); + if (!wb_congested) { + ret = -ENOMEM; + goto err_put_css; +@@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + + /* allocate */ + if (!new_blkg) { +- new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT); ++ new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN); + if (unlikely(!new_blkg)) { + ret = -ENOMEM; + goto err_put_congested; +@@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + } + + spin_lock_init(&blkcg->lock); +- INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT); ++ INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN); + INIT_HLIST_HEAD(&blkcg->blkg_list); + #ifdef CONFIG_CGROUP_WRITEBACK + INIT_LIST_HEAD(&blkcg->cgwb_list); +@@ -1238,7 +1239,7 @@ pd_prealloc: + if (blkg->pd[pol->plid]) + continue; + +- pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node); ++ pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node); + if (!pd) + swap(pd, pd_prealloc); + if (!pd) { +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index e04a7b8492cf..4e1f49434bbe 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2905,7 +2905,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd) + * for devices that support queuing, otherwise we still have a problem + * with sync vs async workloads. + */ +- if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag) ++ if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag && ++ !cfqd->cfq_group_idle) + return; + + WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list)); +@@ -3810,7 +3811,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + goto out; + } + +- cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO, ++ cfqq = kmem_cache_alloc_node(cfq_pool, ++ GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN, + cfqd->queue->node); + if (!cfqq) { + cfqq = &cfqd->oom_cfqq; +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index f3ed7b2d89bf..8e7d358e0226 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) + u32 vgda_sector = 0; + u32 vgda_len = 0; + int numlvs = 0; +- struct pvd *pvd; ++ struct pvd *pvd = NULL; + struct lv_info { + unsigned short pps_per_lv; + unsigned short pps_found; +@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) + if (lvip[i].pps_per_lv) + foundlvs += 1; + } ++ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ ++ pvd = alloc_pvd(state, vgda_sector + 17); + } + put_dev_sector(sect); + } +- pvd = alloc_pvd(state, vgda_sector + 17); + if (pvd) { + int numpps = be16_to_cpu(pvd->pp_count); + int psn_part1 = be32_to_cpu(pvd->psn_part1); +@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state) + next_lp_ix += 1; + } + for (i = 0; i < state->limit; i += 1) +- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) ++ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { ++ char tmp[sizeof(n[i].name) + 1]; // null char ++ ++ snprintf(tmp, sizeof(tmp), "%s", n[i].name); + pr_warn("partition %s (%u pp's found) is " + "not contiguous\n", +- n[i].name, lvip[i].pps_found); ++ tmp, lvip[i].pps_found); ++ } + kfree(pvd); + } + kfree(n); +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 9628fa131757..8116cb2fef2d 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -2113,6 +2113,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + deto = 20; + } + ++ /* Make dito, mdat, deto bits to 0s */ ++ devslp &= ~GENMASK_ULL(24, 2); + devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | + (mdat << PORT_DEVSLP_MDAT_OFFSET) | + (deto << PORT_DEVSLP_DETO_OFFSET) | +diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig +index ec6af1595062..4685bd10c473 100644 +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -125,6 +125,7 @@ config BT_HCIUART_LL + config BT_HCIUART_3WIRE + bool "Three-wire UART (H5) protocol support" + depends on BT_HCIUART ++ depends on BT_HCIUART_SERDEV + help + The HCI Three-wire UART Transport Layer makes it possible to + user the Bluetooth HCI over a serial port interface. The HCI +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 9506e8693c81..d8ef1147b344 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -111,24 +111,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_encrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->enc_key, walk.iv, 1); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +@@ -152,24 +151,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_decrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->dec_key, walk.iv, 0); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index 5536108aa9db..fe21734bbe5c 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -495,9 +495,10 @@ err_irq_alloc_descs: + + chip = chip_save; + err_gpiochip_add: ++ chip = chip_save; + while (--i >= 0) { +- chip--; + gpiochip_remove(&chip->gpio); ++ chip++; + } + kfree(chip_save); + +diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c +index 896bf29776b0..fb2c1df4f588 100644 +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -591,4 +591,4 @@ static int __init tegra_gpio_init(void) + { + return platform_driver_register(&tegra_gpio_driver); + } +-postcore_initcall(tegra_gpio_init); ++subsys_initcall(tegra_gpio_init); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 85f39cc3e276..47581c32b1e1 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -128,6 +128,7 @@ + + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c ++#define SBREG_SMBCTRL_DNV 0xcf000c + + /* Host status bits for SMBPCISTS */ + #define SMBPCISTS_INTS 0x08 +@@ -1251,7 +1252,11 @@ static void i801_add_tco(struct i801_priv *priv) + spin_unlock(&p2sb_spinlock); + + res = &tco_res[ICH_RES_MEM_OFF]; +- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; ++ else ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ + res->end = res->start + 3; + res->flags = IORESOURCE_MEM; + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 0b20449e48cf..da9acec1a029 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -533,6 +533,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + { + u8 rx_watermark; + struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; ++ unsigned long flags; + + /* Clear and enable Rx full interrupt. */ + xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); +@@ -548,6 +549,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + rx_watermark = IIC_RX_FIFO_DEPTH; + xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); + ++ local_irq_save(flags); + if (!(msg->flags & I2C_M_NOSTART)) + /* write the address */ + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, +@@ -558,6 +560,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, + msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); ++ local_irq_restore(flags); ++ + if (i2c->nmsgs == 1) + /* very last, enable bus not busy as well */ + xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d57a78ec7425..0f42411d6a79 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1280,9 +1280,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, + (addr->src_addr.ss_family == AF_IB || + cma_protocol_roce_dev_port(id->device, port_num)); + +- return !addr->dev_addr.bound_dev_if || +- (net_eq(dev_net(net_dev), addr->dev_addr.net) && +- addr->dev_addr.bound_dev_if == net_dev->ifindex); ++ /* ++ * Net namespaces must match, and if the listner is listening ++ * on a specific netdevice than netdevice must match as well. ++ */ ++ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && ++ (!!addr->dev_addr.bound_dev_if == ++ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) ++ return true; ++ else ++ return false; + } + + static struct rdma_id_private *cma_find_listener( +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 88dfe3008cf4..be2f2521c1c5 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1593,10 +1593,11 @@ static int mxt_get_object_table(struct mxt_data *data) + break; + case MXT_TOUCH_MULTI_T9: + data->multitouch = MXT_TOUCH_MULTI_T9; ++ /* Only handle messages from first T9 instance */ + data->T9_reportid_min = min_id; +- data->T9_reportid_max = max_id; +- data->num_touchids = object->num_report_ids +- * mxt_obj_instances(object); ++ data->T9_reportid_max = min_id + ++ object->num_report_ids - 1; ++ data->num_touchids = object->num_report_ids; + break; + case MXT_SPT_MESSAGECOUNT_T44: + data->T44_address = object->start_address; +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index dfb868e2d129..624e7ff76166 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain { + struct io_pgtable_ops *iop; + + unsigned int context_id; +- spinlock_t lock; /* Protects mappings */ ++ struct mutex mutex; /* Protects mappings */ + }; + + struct ipmmu_vmsa_archdata { +@@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type) + if (!domain) + return NULL; + +- spin_lock_init(&domain->lock); ++ mutex_init(&domain->mutex); + + return &domain->io_domain; + } +@@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu; + struct ipmmu_vmsa_device *mmu = archdata->mmu; + struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); +- unsigned long flags; + unsigned int i; + int ret = 0; + +@@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + return -ENXIO; + } + +- spin_lock_irqsave(&domain->lock, flags); ++ mutex_lock(&domain->mutex); + + if (!domain->mmu) { + /* The domain hasn't been used yet, initialize it. */ +@@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + ret = -EINVAL; + } + +- spin_unlock_irqrestore(&domain->lock, flags); ++ mutex_unlock(&domain->mutex); + + if (ret < 0) + return ret; +diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c +index f9512bfa6c3c..0a41132ffba7 100644 +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -530,8 +530,9 @@ init_pmu(void) + int timeout; + struct adb_request req; + +- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ +- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ ++ /* Negate TREQ. Set TACK to input and TREQ to output. */ ++ out_8(&via[B], in_8(&via[B]) | TREQ); ++ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); + + pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); + timeout = 100000; +@@ -1453,8 +1454,8 @@ pmu_sr_intr(void) + struct adb_request *req; + int bite = 0; + +- if (via[B] & TREQ) { +- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); ++ if (in_8(&via[B]) & TREQ) { ++ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); + out_8(&via[IFR], SR_INT); + return NULL; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d59b861764a1..0841d8f10a58 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4190,6 +4190,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) + s->failed++; + if (rdev && !test_bit(Faulty, &rdev->flags)) + do_recovery = 1; ++ else if (!rdev) { ++ rdev = rcu_dereference( ++ conf->disks[i].replacement); ++ if (rdev && !test_bit(Faulty, &rdev->flags)) ++ do_recovery = 1; ++ } + } + } + if (test_bit(STRIPE_SYNCING, &sh->state)) { +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index e4e4b22eebc9..4a0f076c91ba 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -224,14 +224,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) + * The TSC_ADC_SS controller design assumes the OCP clock is + * at least 6x faster than the ADC clock. + */ +- clk = clk_get(&pdev->dev, "adc_tsc_fck"); ++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "failed to get TSC fck\n"); + err = PTR_ERR(clk); + goto err_disable_clk; + } + clock_rate = clk_get_rate(clk); +- clk_put(clk); + tscadc->clk_div = clock_rate / ADC_CLK; + + /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ +diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c +index ddc9e4b08b5c..56efa9d18a9a 100644 +--- a/drivers/misc/mic/scif/scif_api.c ++++ b/drivers/misc/mic/scif/scif_api.c +@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) + goto scif_bind_exit; + } + } else { +- pn = scif_get_new_port(); +- if (!pn) { +- ret = -ENOSPC; ++ ret = scif_get_new_port(); ++ if (ret < 0) + goto scif_bind_exit; +- } ++ pn = ret; + } + + ep->state = SCIFEP_BOUND; +@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) + err = -EISCONN; + break; + case SCIFEP_UNBOUND: +- ep->port.port = scif_get_new_port(); +- if (!ep->port.port) { +- err = -ENOSPC; +- } else { +- ep->port.node = scif_info.nodeid; +- ep->conn_async_state = ASYNC_CONN_IDLE; +- } ++ err = scif_get_new_port(); ++ if (err < 0) ++ break; ++ ep->port.port = err; ++ ep->port.node = scif_info.nodeid; ++ ep->conn_async_state = ASYNC_CONN_IDLE; + /* Fall through */ + case SCIFEP_BOUND: + /* +diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c +index 71b64550b591..a1bca836e506 100644 +--- a/drivers/misc/ti-st/st_kim.c ++++ b/drivers/misc/ti-st/st_kim.c +@@ -757,14 +757,14 @@ static int kim_probe(struct platform_device *pdev) + err = gpio_request(kim_gdata->nshutdown, "kim"); + if (unlikely(err)) { + pr_err(" gpio %d request failed ", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + + /* Configure nShutdown GPIO as output=0 */ + err = gpio_direction_output(kim_gdata->nshutdown, 0); + if (unlikely(err)) { + pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + /* get reference of pdev for request_firmware + */ +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 518e2dec2aa2..5e9122cd3898 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + + MODULE_AUTHOR("VMware, Inc."); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index b3c1b8106a68..f4b3ce2b2bc3 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1597,8 +1597,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +@@ -1617,8 +1619,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index ea693bbf56d8..1c300259d70a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2569,7 +2569,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + } + + mvneta_start_dev(pp); +- mvneta_port_up(pp); + + netdev_update_features(dev); + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c69b0bdd891d..c2e110b2549b 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -371,7 +371,6 @@ struct cpsw_priv { + spinlock_t lock; + struct platform_device *pdev; + struct net_device *ndev; +- struct device_node *phy_node; + struct napi_struct napi_rx; + struct napi_struct napi_tx; + struct device *dev; +@@ -1165,8 +1164,8 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (priv->phy_node) +- slave->phy = of_phy_connect(priv->ndev, priv->phy_node, ++ if (slave->data->phy_node) ++ slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); + else + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, +@@ -1957,12 +1956,11 @@ static void cpsw_slave_init(struct cpsw_slave *slave, struct cpsw_priv *priv, + slave->port_vlan = data->dual_emac_res_vlan; + } + +-static int cpsw_probe_dt(struct cpsw_priv *priv, ++static int cpsw_probe_dt(struct cpsw_platform_data *data, + struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; + struct device_node *slave_node; +- struct cpsw_platform_data *data = &priv->data; + int i = 0, ret; + u32 prop; + +@@ -2050,7 +2048,8 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + if (strcmp(slave_node->name, "slave")) + continue; + +- priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0); ++ slave_data->phy_node = of_parse_phandle(slave_node, ++ "phy-handle", 0); + parp = of_get_property(slave_node, "phy_id", &lenp); + if (of_phy_is_fixed_link(slave_node)) { + struct device_node *phy_node; +@@ -2087,6 +2086,7 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + } + snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), + PHY_ID_FMT, mdio->name, phyid); ++ put_device(&mdio->dev); + } else { + dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i); + goto no_phy_slave; +@@ -2291,7 +2291,7 @@ static int cpsw_probe(struct platform_device *pdev) + /* Select default pin state */ + pinctrl_pm_select_default_state(&pdev->dev); + +- if (cpsw_probe_dt(priv, pdev)) { ++ if (cpsw_probe_dt(&priv->data, pdev)) { + dev_err(&pdev->dev, "cpsw: platform data missing\n"); + ret = -ENODEV; + goto clean_runtime_disable_ret; +diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h +index 442a7038e660..e50afd1b2eda 100644 +--- a/drivers/net/ethernet/ti/cpsw.h ++++ b/drivers/net/ethernet/ti/cpsw.h +@@ -18,6 +18,7 @@ + #include + + struct cpsw_slave_data { ++ struct device_node *phy_node; + char phy_id[MII_BUS_ID_SIZE]; + int phy_if; + u8 mac_addr[ETH_ALEN]; +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 6be315303d61..8ecb24186b7f 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -2108,6 +2108,7 @@ static int davinci_emac_remove(struct platform_device *pdev) + cpdma_ctlr_destroy(priv->dma); + + unregister_netdev(ndev); ++ of_node_put(priv->phy_node); + free_netdev(ndev); + + return 0; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 916b9b12edd2..4644357d291a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2901,6 +2901,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) + passive = channel->flags & IEEE80211_CHAN_NO_IR; + ch->passive = passive; + ++ /* the firmware is ignoring the "radar" flag of the ++ * channel and is scanning actively using Probe Requests ++ * on "Radar detection"/DFS channels which are not ++ * marked as "available" ++ */ ++ ch->passive |= ch->chan_radar; ++ + ch->freq = channel->center_freq; + ch->band_center_freq1 = channel->center_freq; + ch->min_power = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 02eea3c3b5d3..c72eb4464de9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1424,6 +1424,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) + cfg->keep_alive_pattern_size = __cpu_to_le32(0); + cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); + cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); ++ cfg->wmi_send_separate = __cpu_to_le32(0); ++ cfg->num_ocb_vdevs = __cpu_to_le32(0); ++ cfg->num_ocb_channels = __cpu_to_le32(0); ++ cfg->num_ocb_schedules = __cpu_to_le32(0); ++ cfg->host_capab = __cpu_to_le32(0); + + ath10k_wmi_put_host_mem_chunks(ar, chunks); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +index ad655c44afdb..f5031f3965c5 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +@@ -1209,6 +1209,11 @@ struct wmi_tlv_resource_config { + __le32 keep_alive_pattern_size; + __le32 max_tdls_concurrent_sleep_sta; + __le32 max_tdls_concurrent_buffer_sta; ++ __le32 wmi_send_separate; ++ __le32 num_ocb_vdevs; ++ __le32 num_ocb_channels; ++ __le32 num_ocb_schedules; ++ __le32 host_capab; + } __packed; + + struct wmi_tlv_init_cmd { +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 5466246c69b4..b78a2f3745f2 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twa_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = ioremap(mem_addr, mem_len); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (twa_reset_sequence(tw_dev, 0)) ++ if (twa_reset_sequence(tw_dev, 0)) { ++ retval = -ENOMEM; + goto out_iounmap; ++ } + + /* Set host specific parameters */ + if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index f8374850f714..f0a5536a9ff5 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twl_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_iomap(pdev, 1, 0); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + /* Initialize the card */ + if (twl_reset_sequence(tw_dev, 0)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); ++ retval = -ENOMEM; + goto out_iounmap; + } + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 14af38036287..308a4206b636 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2278,6 +2278,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (tw_initialize_device_extension(tw_dev)) { + printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2292,6 +2293,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_resource_start(pdev, 0); + if (!tw_dev->base_addr) { + printk(KERN_WARNING "3w-xxxx: Failed to get io address."); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c +index 12a3893b98fd..ade29c4295b7 100644 +--- a/drivers/staging/rts5208/rtsx_scsi.c ++++ b/drivers/staging/rts5208/rtsx_scsi.c +@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) + + if (sendbytes > 8) { + memcpy(buf, inquiry_buf, 8); +- memcpy(buf + 8, inquiry_string, sendbytes - 8); ++ strncpy(buf + 8, inquiry_string, sendbytes - 8); + if (pro_formatter_flag) { + /* Additional Length */ + buf[4] = 0x33; +diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c +index 10fea7bb8f30..3db4a2570b19 100644 +--- a/drivers/staging/rts5208/xd.c ++++ b/drivers/staging/rts5208/xd.c +@@ -1252,7 +1252,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk, + reg = 0; + rtsx_read_register(chip, XD_CTL, ®); + if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) { +- wait_timeout(100); ++ mdelay(100); + + if (detect_card_cd(chip, + XD_CARD) != STATUS_SUCCESS) { +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 21f888ac550e..7199bac67333 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -306,6 +306,7 @@ void __transport_register_session( + { + const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; + unsigned char buf[PR_REG_ISID_LEN]; ++ unsigned long flags; + + se_sess->se_tpg = se_tpg; + se_sess->fabric_sess_ptr = fabric_sess_ptr; +@@ -342,7 +343,7 @@ void __transport_register_session( + se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); + } + +- spin_lock_irq(&se_nacl->nacl_sess_lock); ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); + /* + * The se_nacl->nacl_sess pointer will be set to the + * last active I_T Nexus for each struct se_node_acl. +@@ -351,7 +352,7 @@ void __transport_register_session( + + list_add_tail(&se_sess->sess_acl_list, + &se_nacl->acl_sess_list); +- spin_unlock_irq(&se_nacl->nacl_sess_lock); ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + } + list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); + +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 802eac7e561b..2b8f2e0a4224 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -1915,7 +1915,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) + ByteIO_t UPCIRingInd = 0; + + if (!dev || !pci_match_id(rocket_pci_ids, dev) || +- pci_enable_device(dev)) ++ pci_enable_device(dev) || i >= NUM_BOARDS) + return 0; + + rcktpt_io_addr[i] = pci_resource_start(dev, 0); +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index bcc1fc027311..b9823eb9c195 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -833,8 +833,6 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + +- info->uio_dev = idev; +- + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -850,6 +848,7 @@ int __uio_register_device(struct module *owner, + goto err_request_irq; + } + ++ info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 128a3c0a9286..9dbf1583bd7a 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3675,6 +3675,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + } + + spin_lock_irqsave(&xhci->lock, flags); ++ ++ virt_dev->udev = NULL; ++ + /* Don't disable the slot if the host controller is dead. */ + state = readl(&xhci->op_regs->status); + if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || +diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h +index 502d3892d8a4..d71e7ad4d382 100644 +--- a/fs/autofs4/autofs_i.h ++++ b/fs/autofs4/autofs_i.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + /* This is the range of ioctl() numbers we claim as ours */ + #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY +@@ -135,7 +136,8 @@ struct autofs_sb_info { + + static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) + { +- return (struct autofs_sb_info *)(sb->s_fs_info); ++ return sb->s_magic != AUTOFS_SUPER_MAGIC ? ++ NULL : (struct autofs_sb_info *)(sb->s_fs_info); + } + + static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) +diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c +index a3ae0b2aeb5a..1132fe71b312 100644 +--- a/fs/autofs4/inode.c ++++ b/fs/autofs4/inode.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include "autofs_i.h" + #include + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index ee44d346ea44..bfa1d31f79aa 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -381,6 +381,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + if (test_and_clear_bit(segno, free_i->free_segmap)) { + free_i->free_segments++; + ++ if (IS_CURSEC(sbi, secno)) ++ goto skip_free; + next = find_next_bit(free_i->free_segmap, + start_segno + sbi->segs_per_sec, start_segno); + if (next >= start_segno + sbi->segs_per_sec) { +@@ -388,6 +390,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + free_i->free_sections++; + } + } ++skip_free: + spin_unlock(&free_i->segmap_lock); + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 6cc67e1bbb41..2ffc53d0c9c7 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1079,12 +1079,17 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); + struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); + unsigned int main_segs, blocks_per_seg; ++ unsigned int sit_segs, nat_segs; ++ unsigned int sit_bitmap_size, nat_bitmap_size; ++ unsigned int log_blocks_per_seg; + int i; + + total = le32_to_cpu(raw_super->segment_count); + fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); +- fsmeta += le32_to_cpu(raw_super->segment_count_sit); +- fsmeta += le32_to_cpu(raw_super->segment_count_nat); ++ sit_segs = le32_to_cpu(raw_super->segment_count_sit); ++ fsmeta += sit_segs; ++ nat_segs = le32_to_cpu(raw_super->segment_count_nat); ++ fsmeta += nat_segs; + fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); + fsmeta += le32_to_cpu(raw_super->segment_count_ssa); + +@@ -1105,6 +1110,18 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + return 1; + } + ++ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); ++ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); ++ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); ++ ++ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || ++ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "Wrong bitmap size: sit: %u, nat:%u", ++ sit_bitmap_size, nat_bitmap_size); ++ return 1; ++ } ++ + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); + return 1; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index e2e857affbf2..0647cb1ede56 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -911,16 +911,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); +- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) ++ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + goto out_invalidcred; ++ } + } + + cps.minorversion = hdr_arg.minorversion; + hdr_res.taglen = hdr_arg.taglen; + hdr_res.tag = hdr_arg.tag; +- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) ++ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + return rpc_system_err; +- ++ } + while (status == 0 && nops != hdr_arg.nops) { + status = process_op(nops, rqstp, &xdr_in, + argp, &xdr_out, resp, &cps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 36f4695aa604..ad2a081bac66 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -392,7 +392,7 @@ struct kioctx_table; + struct mm_struct { + struct vm_area_struct *mmap; /* list of VMAs */ + struct rb_root mm_rb; +- u32 vmacache_seqnum; /* per-thread vmacache */ ++ u64 vmacache_seqnum; /* per-thread vmacache */ + #ifdef CONFIG_MMU + unsigned long (*get_unmapped_area) (struct file *filp, + unsigned long addr, unsigned long len, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 725498cc5d30..b30540d6d125 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1454,7 +1454,7 @@ struct task_struct { + + struct mm_struct *mm, *active_mm; + /* per-thread vma caching */ +- u32 vmacache_seqnum; ++ u64 vmacache_seqnum; + struct vm_area_struct *vmacache[VMACACHE_SIZE]; + #if defined(SPLIT_RSS_COUNTING) + struct task_rss_stat rss_stat; +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 8ef3a61fdc74..fdac5800872d 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -88,7 +88,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #ifdef CONFIG_DEBUG_VM_VMACACHE + VMACACHE_FIND_CALLS, + VMACACHE_FIND_HITS, +- VMACACHE_FULL_FLUSHES, + #endif + NR_VM_EVENT_ITEMS + }; +diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h +index c3fa0fd43949..4f58ff2dacd6 100644 +--- a/include/linux/vmacache.h ++++ b/include/linux/vmacache.h +@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk) + memset(tsk->vmacache, 0, sizeof(tsk->vmacache)); + } + +-extern void vmacache_flush_all(struct mm_struct *mm); + extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); + extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, + unsigned long addr); +@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, + static inline void vmacache_invalidate(struct mm_struct *mm) + { + mm->vmacache_seqnum++; +- +- /* deal with overflows */ +- if (unlikely(mm->vmacache_seqnum == 0)) +- vmacache_flush_all(mm); + } + + #endif /* __LINUX_VMACACHE_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index cd1629170103..08f47e0e9f8d 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -819,13 +819,13 @@ struct ethtool_rx_flow_spec { + static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) + { + return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; +-}; ++} + + static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) + { + return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> + ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; +-}; ++} + + /** + * struct ethtool_rxnfc - command to get or set RX flow classification rules +diff --git a/kernel/fork.c b/kernel/fork.c +index 37ec96fe739d..dd2f79ac0771 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1337,6 +1337,18 @@ static struct task_struct *copy_process(unsigned long clone_flags, + if (!p) + goto fork_out; + ++ /* ++ * This _must_ happen before we call free_task(), i.e. before we jump ++ * to any of the bad_fork_* labels. This is to avoid freeing ++ * p->set_child_tid which is (ab)used as a kthread's data pointer for ++ * kernel threads (PF_KTHREAD). ++ */ ++ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; ++ /* ++ * Clear TID on mm_release()? ++ */ ++ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; ++ + ftrace_graph_init_task(p); + + rt_mutex_init_task(p); +@@ -1498,11 +1510,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, + } + } + +- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; +- /* +- * Clear TID on mm_release()? +- */ +- p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; + #ifdef CONFIG_BLOCK + p->plug = NULL; + #endif +diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c +index 05a37857ab55..8d7047ecef4e 100644 +--- a/kernel/locking/osq_lock.c ++++ b/kernel/locking/osq_lock.c +@@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock) + + prev = decode_cpu(old); + node->prev = prev; ++ ++ /* ++ * osq_lock() unqueue ++ * ++ * node->prev = prev osq_wait_next() ++ * WMB MB ++ * prev->next = node next->prev = prev // unqueue-C ++ * ++ * Here 'node->prev' and 'next->prev' are the same variable and we need ++ * to ensure these stores happen in-order to avoid corrupting the list. ++ */ ++ smp_wmb(); ++ + WRITE_ONCE(prev->next, node); + + /* +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index a4d4de05b2d1..1be33caf157d 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -510,6 +510,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem) + { + unsigned long flags; + ++ /* ++ * __rwsem_down_write_failed_common(sem) ++ * rwsem_optimistic_spin(sem) ++ * osq_unlock(sem->osq) ++ * ... ++ * atomic_long_add_return(&sem->count) ++ * ++ * - VS - ++ * ++ * __up_write() ++ * if (atomic_long_sub_return_release(&sem->count) < 0) ++ * rwsem_wake(sem) ++ * osq_is_locked(&sem->osq) ++ * ++ * And __up_write() must observe !osq_is_locked() when it observes the ++ * atomic_long_add_return() in order to not miss a wakeup. ++ * ++ * This boils down to: ++ * ++ * [S.rel] X = 1 [RmW] r0 = (Y += 0) ++ * MB RMB ++ * [RmW] Y += 1 [L] r1 = X ++ * ++ * exists (r0=1 /\ r1=0) ++ */ ++ smp_rmb(); ++ + /* + * If a spinner is present, it is not necessary to do the wakeup. + * Try to do wakeup only if the trylock succeeds to minimize +diff --git a/mm/debug.c b/mm/debug.c +index 668aa35191ca..689b6e911cae 100644 +--- a/mm/debug.c ++++ b/mm/debug.c +@@ -168,7 +168,7 @@ EXPORT_SYMBOL(dump_vma); + + void dump_mm(const struct mm_struct *mm) + { +- pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" ++ pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" + #ifdef CONFIG_MMU + "get_unmapped_area %p\n" + #endif +@@ -198,7 +198,7 @@ void dump_mm(const struct mm_struct *mm) + #endif + "%s", /* This is here to hold the comma */ + +- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, ++ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, + #ifdef CONFIG_MMU + mm->get_unmapped_area, + #endif +diff --git a/mm/vmacache.c b/mm/vmacache.c +index fd09dc9c6812..9c8ff3d4eda9 100644 +--- a/mm/vmacache.c ++++ b/mm/vmacache.c +@@ -5,44 +5,6 @@ + #include + #include + +-/* +- * Flush vma caches for threads that share a given mm. +- * +- * The operation is safe because the caller holds the mmap_sem +- * exclusively and other threads accessing the vma cache will +- * have mmap_sem held at least for read, so no extra locking +- * is required to maintain the vma cache. +- */ +-void vmacache_flush_all(struct mm_struct *mm) +-{ +- struct task_struct *g, *p; +- +- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); +- +- /* +- * Single threaded tasks need not iterate the entire +- * list of process. We can avoid the flushing as well +- * since the mm's seqnum was increased and don't have +- * to worry about other threads' seqnum. Current's +- * flush will occur upon the next lookup. +- */ +- if (atomic_read(&mm->mm_users) == 1) +- return; +- +- rcu_read_lock(); +- for_each_process_thread(g, p) { +- /* +- * Only flush the vmacache pointers as the +- * mm seqnum is already set and curr's will +- * be set upon invalidation when the next +- * lookup is done. +- */ +- if (mm == p->mm) +- vmacache_flush(p); +- } +- rcu_read_unlock(); +-} +- + /* + * This task may be accessing a foreign mm via (for example) + * get_user_pages()->find_vma(). The vmacache is task-local and this +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 1811f8e7ddf4..552e00b07196 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session, + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, sizeof(req->name) - 1); ++ strncpy(hid->name, req->name, sizeof(hid->name)); + + snprintf(hid->phys, sizeof(hid->phys), "%pMR", + &l2cap_pi(session->ctrl_sock->sk)->chan->src); +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 4f6c1862dfd2..6fe2b615518c 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1763,7 +1763,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, + if (itr->app.selector == app->selector && + itr->app.protocol == app->protocol && + itr->ifindex == ifindex && +- (!prio || itr->app.priority == prio)) ++ ((prio == -1) || itr->app.priority == prio)) + return itr; + } + +@@ -1798,7 +1798,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio = itr->app.priority; + spin_unlock_bh(&dcb_lock); + +@@ -1826,7 +1827,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) + + spin_lock_bh(&dcb_lock); + /* Search for existing match and replace */ +- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { ++ itr = dcb_app_lookup(new, dev->ifindex, -1); ++ if (itr) { + if (new->priority) + itr->app.priority = new->priority; + else { +@@ -1859,7 +1861,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio |= 1 << itr->app.priority; + spin_unlock_bh(&dcb_lock); + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 1f3c305df45d..b6e72af15237 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -876,7 +876,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) + return ERR_PTR(-EFAULT); + +- strlcpy(info->name, compat_tmp.name, sizeof(info->name)); ++ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); + info->num_counters = compat_tmp.num_counters; + user += sizeof(compat_tmp); + } else +@@ -889,9 +889,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(info, user, sizeof(*info)) != 0) + return ERR_PTR(-EFAULT); + +- info->name[sizeof(info->name) - 1] = '\0'; + user += sizeof(*info); + } ++ info->name[sizeof(info->name) - 1] = '\0'; + + size = sizeof(struct xt_counters); + size *= info->num_counters; +diff --git a/security/selinux/avc.c b/security/selinux/avc.c +index e60c79de13e1..52f3c550abcc 100644 +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -348,27 +348,26 @@ static struct avc_xperms_decision_node + struct avc_xperms_decision_node *xpd_node; + struct extended_perms_decision *xpd; + +- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); + if (!xpd_node) + return NULL; + + xpd = &xpd_node->xpd; + if (which & XPERMS_ALLOWED) { + xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->allowed) + goto error; + } + if (which & XPERMS_AUDITALLOW) { + xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->auditallow) + goto error; + } + if (which & XPERMS_DONTAUDIT) { + xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->dontaudit) + goto error; + } +@@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) + { + struct avc_xperms_node *xp_node; + +- xp_node = kmem_cache_zalloc(avc_xperms_cachep, +- GFP_ATOMIC|__GFP_NOMEMALLOC); ++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); + if (!xp_node) + return xp_node; + INIT_LIST_HEAD(&xp_node->xpd_head); +@@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void) + { + struct avc_node *node; + +- node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); ++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); + if (!node) + goto out; + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 3324f98c35f6..f6d4a1046e54 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -4019,7 +4019,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) + + list_for_each_codec(codec, bus) { + /* FIXME: maybe a better way needed for forced reset */ +- cancel_delayed_work_sync(&codec->jackpoll_work); ++ if (current_work() != &codec->jackpoll_work.work) ++ cancel_delayed_work_sync(&codec->jackpoll_work); + #ifdef CONFIG_PM + if (hda_codec_is_power_on(codec)) { + hda_call_codec_suspend(codec); +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 90129accffbe..4341ed267d4e 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -29,7 +29,9 @@ static inline unsigned long long rdclock(void) + return ts.tv_sec * 1000000000ULL + ts.tv_nsec; + } + ++#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 1024 ++#endif + + extern const char *input_name; + extern bool perf_host, perf_guest; diff --git a/patch/kernel/mvebu-default/04-patch-4.4.157-158.patch b/patch/kernel/mvebu-default/04-patch-4.4.157-158.patch new file mode 100644 index 000000000..179c3e503 --- /dev/null +++ b/patch/kernel/mvebu-default/04-patch-4.4.157-158.patch @@ -0,0 +1,1640 @@ +diff --git a/Makefile b/Makefile +index 2d55f88e6a08..d07a6283b67e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 157 ++SUBLEVEL = 158 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index c169cc3049aa..e8adb428dddb 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -260,6 +260,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 6b8abbe68746..3011c88bd2f3 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -105,7 +105,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index 8755d618e116..961c393c0f55 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -44,6 +44,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 4eee221b0cf0..d2be8e4f7a35 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -133,6 +133,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 5649a9e429e0..aca06b18c43e 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -14,12 +14,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + + #include ++#include + #include + + /* Kernel-provided data used by the VDSO. */ +@@ -118,12 +120,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index e48826aa314c..b40606051efe 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -371,7 +371,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 01718d05e952..9e8f0e255de2 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index f68c24a98277..dedfc96acc66 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1363,7 +1363,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1379,7 +1379,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 8db791ef2027..95619ee33112 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2132,13 +2132,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 98ab08c0aa2d..07541c5670e6 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -30,7 +30,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_ACPI + void acpi_gpiochip_add(struct gpio_chip *chip); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index eb1da83c9902..8cdd505784ed 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index e7e581d6a8ff..1bfc4807ce5b 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 22e10b7d505d..fe3a2b19a5db 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 93738dfbf631..902ee6efd09c 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -86,7 +86,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev) +@@ -107,7 +107,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev) +@@ -155,6 +155,9 @@ static int coresight_enable_link(struct coresight_device *csdev) + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 0f42411d6a79..1454290078de 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -544,6 +544,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -567,18 +568,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index f74b11542603..a338e60836ee 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -992,12 +992,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 347aaaa5a7ea..fc6eb752ab35 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1219,6 +1219,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 0c1a42bf27fd..1c37d5a78822 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1366,6 +1366,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index 90520d76633f..9cde4c5bfba4 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index bdc7fcd80eca..9dcdc6f41ceb 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 6d19835b80a9..0d244dac1ccb 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 68d0a5c9d437..3270b4333668 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -86,8 +86,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1336,11 +1335,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1608,6 +1607,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); +@@ -1615,8 +1615,9 @@ static int xennet_init_queue(struct netfront_queue *queue) + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2023,15 +2024,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2047,12 +2047,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2160,14 +2158,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 6c42ca14d2fd..4ea810cafaac 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index f774cb576ffa..1ff95b5a429d 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.23" + #define PROC_INTERFACE_VERSION 1 + ++#include + #include + #include + #include +@@ -1472,7 +1473,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index bd170cb3361c..5747a54cbd42 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 95c631125a20..09ac56317f1b 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3505,13 +3505,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index fa844b0ff847..7bcf0dae3a65 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -419,6 +419,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 61ea87917433..4380e4f600ab 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 40378487e023..a5e3e410db4e 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -529,8 +529,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 29adabdb305f..08cba309eb78 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 99f67764765f..37a5e07b3488 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index a47de8c31ce9..8efeadf30b4d 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1542,11 +1542,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2425,8 +2428,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3272,6 +3278,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3312,12 +3320,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3336,6 +3346,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3346,6 +3357,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 692ccc69345e..d5434e7a3b2e 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2565,7 +2565,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 442b6631162e..3d750671b85a 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -388,7 +388,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -398,7 +398,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 512c84adcace..e8e8702d5adf 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -439,13 +439,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -464,6 +464,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index 1bd67b24f916..bc9ff5ebd67c 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -178,7 +178,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h +index 98f35c656c02..0cd247f75b8b 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -227,7 +227,7 @@ struct ti_interrupt { + } __attribute__((packed)); + + /* Interrupt codes */ +-#define TI_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TI_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TI_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TI_CODE_HARDWARE_ERROR 0xFF + #define TI_CODE_DATA_ERROR 0x03 +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index dba51362d2e2..6c186b4df94a 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1a34d2a89de6..898215cad351 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2213,6 +2213,13 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* Reported-by: Tim Anderson */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Nick Bowler + * SCSI stack spams (otherwise harmless) error messages. +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * x[M][R][-][@][i][m] or ++ * x[M][R][-][@][i][p][m] or + * [-][@] + * + * with , , and decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 7f6c9e6cfc6c..14a93cb21310 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 393ae1bc07e8..a8a6f072fb78 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -977,7 +977,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index badee04ef496..71b5dca95bdb 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include + #include + #include + #include +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index f44e93d2650d..62bc72001fce 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 97d1a15873c5..57b039ebfb1f 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -373,8 +373,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 52d79fb04115..f7111bb88ec1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2402,33 +2402,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 61296ecbd0e2..09476bb8f6cd 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 27300533c2dd..bd21795ce657 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -378,7 +378,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -397,6 +402,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -417,7 +427,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -464,7 +474,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index a162661c9d60..f45a9a5d3e47 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 00a8cc572a22..1f930032253a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -286,7 +286,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 4a72c0d1e56f..91a4e606edcd 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -647,11 +647,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -679,14 +683,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -874,7 +878,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -884,7 +889,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index e9eecf6f0bff..48080f89ed25 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1845,7 +1845,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 31a981d6229d..5897fc3857a0 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -359,3 +359,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 4c145d6bccd4..5bc7ddf8fc70 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index a31ea6c22d19..2d7379dec1f0 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 69bf5cf1e91e..15cbe2565703 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 60a94b3e532e..177480066816 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index bd630c222e65..9a53f6e9ef43 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_addr_location(thread, PERF_RECORD_MISC_USER, + MAP__FUNCTION, ip, &al); +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index 30906bfd9c1b..0ab937a17ebb 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } diff --git a/patch/kernel/rk3399-default/04-patch-4.4.156-157.patch b/patch/kernel/rk3399-default/04-patch-4.4.156-157.patch new file mode 100644 index 000000000..45066d89c --- /dev/null +++ b/patch/kernel/rk3399-default/04-patch-4.4.156-157.patch @@ -0,0 +1,1664 @@ +diff --git a/Makefile b/Makefile +index 6dd5924a7ea5..2d55f88e6a08 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 156 ++SUBLEVEL = 157 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index f1ac9818b751..dbee1934dfc6 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 323486d6ee83..561eac854cc3 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index 66191cd0447e..aa4f261b6508 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index d113c8ded6e2..6df3a4ea77fc 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -349,6 +349,7 @@ static int __init octeon_ehci_device_init(void) + return 0; + + pd = of_find_device_by_node(ehci_node); ++ of_node_put(ehci_node); + if (!pd) + return 0; + +@@ -411,6 +412,7 @@ static int __init octeon_ohci_device_init(void) + return 0; + + pd = of_find_device_by_node(ohci_node); ++ of_node_put(ohci_node); + if (!pd) + return 0; + +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 75fa296836fc..ab1df19b0957 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) + /* + * ISA I/O bus memory addresses are 1:1 with the physical address. + */ +-static inline unsigned long isa_virt_to_bus(volatile void * address) ++static inline unsigned long isa_virt_to_bus(volatile void *address) + { +- return (unsigned long)address - PAGE_OFFSET; ++ return virt_to_phys(address); + } + +-static inline void * isa_bus_to_virt(unsigned long address) ++static inline void *isa_bus_to_virt(unsigned long address) + { +- return (void *)(address + PAGE_OFFSET); ++ return phys_to_virt(address); + } + + #define isa_page_to_bus page_to_phys +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 354b99f56c1e..ed6cac4a4df0 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + struct thread_info *ti = task_thread_info(p); + struct pt_regs *childregs, *regs = current_pt_regs(); + unsigned long childksp; +- p->set_child_tid = p->clear_child_tid = NULL; + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 5d3a25e1cfae..52e8c2026853 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -712,7 +712,8 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end) + static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +@@ -745,7 +746,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index 7095dfe7666b..962372143fda 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + + top_of_kernel_stack = sp; + +- p->set_child_tid = p->clear_child_tid = NULL; +- + /* Locate userspace context on stack... */ + sp -= STACK_FRAME_OVERHEAD; /* redzone */ + sp -= sizeof(struct pt_regs); +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 337c52192278..440a948c4feb 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -104,6 +104,8 @@ struct cpuinfo_x86 { + __u8 x86_phys_bits; + /* CPUID returned core id bits: */ + __u8 x86_coreid_bits; ++ ++ __u8 x86_cache_bits; + /* Max extended CPUID function supported: */ + __u32 extended_cpuid_level; + /* Maximum supported CPUID level, -1=no CPUID: */ +@@ -174,7 +176,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c); + + static inline unsigned long long l1tf_pfn_limit(void) + { +- return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); ++ return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT); + } + + extern void early_cpu_init(void); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index b9e6b60df148..621bc6561189 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -634,6 +634,46 @@ void x86_spec_ctrl_setup_ap(void) + + #undef pr_fmt + #define pr_fmt(fmt) "L1TF: " fmt ++ ++/* ++ * These CPUs all support 44bits physical address space internally in the ++ * cache but CPUID can report a smaller number of physical address bits. ++ * ++ * The L1TF mitigation uses the top most address bit for the inversion of ++ * non present PTEs. When the installed memory reaches into the top most ++ * address bit due to memory holes, which has been observed on machines ++ * which report 36bits physical address bits and have 32G RAM installed, ++ * then the mitigation range check in l1tf_select_mitigation() triggers. ++ * This is a false positive because the mitigation is still possible due to ++ * the fact that the cache uses 44bit internally. Use the cache bits ++ * instead of the reported physical bits and adjust them on the affected ++ * machines to 44bit if the reported bits are less than 44. ++ */ ++static void override_cache_bits(struct cpuinfo_x86 *c) ++{ ++ if (c->x86 != 6) ++ return; ++ ++ switch (c->x86_model) { ++ case INTEL_FAM6_NEHALEM: ++ case INTEL_FAM6_WESTMERE: ++ case INTEL_FAM6_SANDYBRIDGE: ++ case INTEL_FAM6_IVYBRIDGE: ++ case INTEL_FAM6_HASWELL_CORE: ++ case INTEL_FAM6_HASWELL_ULT: ++ case INTEL_FAM6_HASWELL_GT3E: ++ case INTEL_FAM6_BROADWELL_CORE: ++ case INTEL_FAM6_BROADWELL_GT3E: ++ case INTEL_FAM6_SKYLAKE_MOBILE: ++ case INTEL_FAM6_SKYLAKE_DESKTOP: ++ case INTEL_FAM6_KABYLAKE_MOBILE: ++ case INTEL_FAM6_KABYLAKE_DESKTOP: ++ if (c->x86_cache_bits < 44) ++ c->x86_cache_bits = 44; ++ break; ++ } ++} ++ + static void __init l1tf_select_mitigation(void) + { + u64 half_pa; +@@ -641,16 +681,13 @@ static void __init l1tf_select_mitigation(void) + if (!boot_cpu_has_bug(X86_BUG_L1TF)) + return; + ++ override_cache_bits(&boot_cpu_data); ++ + #if CONFIG_PGTABLE_LEVELS == 2 + pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); + return; + #endif + +- /* +- * This is extremely unlikely to happen because almost all +- * systems have far more MAX_PA/2 than RAM can be fit into +- * DIMM slots. +- */ + half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; + if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 4d3fa79c0f09..b12c0287d6cf 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -798,6 +798,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + c->x86_phys_bits = 36; + #endif + ++ c->x86_cache_bits = c->x86_phys_bits; ++ + if (c->extended_cpuid_level >= 0x8000000a) + c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e0a34b0d381e..c4dffae5d939 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -273,8 +273,6 @@ static noinline int vmalloc_fault(unsigned long address) + if (!(address >= VMALLOC_START && address < VMALLOC_END)) + return -1; + +- WARN_ON_ONCE(in_nmi()); +- + /* + * Synchronize this task's top level page-table + * with the 'reference' page table. +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 46ba2402c8f9..987361113ecd 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + } + + wb_congested = wb_congested_get_create(&q->backing_dev_info, +- blkcg->css.id, GFP_NOWAIT); ++ blkcg->css.id, ++ GFP_NOWAIT | __GFP_NOWARN); + if (!wb_congested) { + ret = -ENOMEM; + goto err_put_css; +@@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + + /* allocate */ + if (!new_blkg) { +- new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT); ++ new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN); + if (unlikely(!new_blkg)) { + ret = -ENOMEM; + goto err_put_congested; +@@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + } + + spin_lock_init(&blkcg->lock); +- INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT); ++ INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN); + INIT_HLIST_HEAD(&blkcg->blkg_list); + #ifdef CONFIG_CGROUP_WRITEBACK + INIT_LIST_HEAD(&blkcg->cgwb_list); +@@ -1238,7 +1239,7 @@ pd_prealloc: + if (blkg->pd[pol->plid]) + continue; + +- pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node); ++ pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node); + if (!pd) + swap(pd, pd_prealloc); + if (!pd) { +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index e04a7b8492cf..4e1f49434bbe 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2905,7 +2905,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd) + * for devices that support queuing, otherwise we still have a problem + * with sync vs async workloads. + */ +- if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag) ++ if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag && ++ !cfqd->cfq_group_idle) + return; + + WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list)); +@@ -3810,7 +3811,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + goto out; + } + +- cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO, ++ cfqq = kmem_cache_alloc_node(cfq_pool, ++ GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN, + cfqd->queue->node); + if (!cfqq) { + cfqq = &cfqd->oom_cfqq; +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index f3ed7b2d89bf..8e7d358e0226 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) + u32 vgda_sector = 0; + u32 vgda_len = 0; + int numlvs = 0; +- struct pvd *pvd; ++ struct pvd *pvd = NULL; + struct lv_info { + unsigned short pps_per_lv; + unsigned short pps_found; +@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) + if (lvip[i].pps_per_lv) + foundlvs += 1; + } ++ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ ++ pvd = alloc_pvd(state, vgda_sector + 17); + } + put_dev_sector(sect); + } +- pvd = alloc_pvd(state, vgda_sector + 17); + if (pvd) { + int numpps = be16_to_cpu(pvd->pp_count); + int psn_part1 = be32_to_cpu(pvd->psn_part1); +@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state) + next_lp_ix += 1; + } + for (i = 0; i < state->limit; i += 1) +- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) ++ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { ++ char tmp[sizeof(n[i].name) + 1]; // null char ++ ++ snprintf(tmp, sizeof(tmp), "%s", n[i].name); + pr_warn("partition %s (%u pp's found) is " + "not contiguous\n", +- n[i].name, lvip[i].pps_found); ++ tmp, lvip[i].pps_found); ++ } + kfree(pvd); + } + kfree(n); +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 9628fa131757..8116cb2fef2d 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -2113,6 +2113,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + deto = 20; + } + ++ /* Make dito, mdat, deto bits to 0s */ ++ devslp &= ~GENMASK_ULL(24, 2); + devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | + (mdat << PORT_DEVSLP_MDAT_OFFSET) | + (deto << PORT_DEVSLP_DETO_OFFSET) | +diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig +index ec6af1595062..4685bd10c473 100644 +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -125,6 +125,7 @@ config BT_HCIUART_LL + config BT_HCIUART_3WIRE + bool "Three-wire UART (H5) protocol support" + depends on BT_HCIUART ++ depends on BT_HCIUART_SERDEV + help + The HCI Three-wire UART Transport Layer makes it possible to + user the Bluetooth HCI over a serial port interface. The HCI +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 9506e8693c81..d8ef1147b344 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -111,24 +111,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_encrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->enc_key, walk.iv, 1); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +@@ -152,24 +151,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_decrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->dec_key, walk.iv, 0); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index 5536108aa9db..fe21734bbe5c 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -495,9 +495,10 @@ err_irq_alloc_descs: + + chip = chip_save; + err_gpiochip_add: ++ chip = chip_save; + while (--i >= 0) { +- chip--; + gpiochip_remove(&chip->gpio); ++ chip++; + } + kfree(chip_save); + +diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c +index 896bf29776b0..fb2c1df4f588 100644 +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -591,4 +591,4 @@ static int __init tegra_gpio_init(void) + { + return platform_driver_register(&tegra_gpio_driver); + } +-postcore_initcall(tegra_gpio_init); ++subsys_initcall(tegra_gpio_init); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 85f39cc3e276..47581c32b1e1 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -128,6 +128,7 @@ + + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c ++#define SBREG_SMBCTRL_DNV 0xcf000c + + /* Host status bits for SMBPCISTS */ + #define SMBPCISTS_INTS 0x08 +@@ -1251,7 +1252,11 @@ static void i801_add_tco(struct i801_priv *priv) + spin_unlock(&p2sb_spinlock); + + res = &tco_res[ICH_RES_MEM_OFF]; +- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; ++ else ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ + res->end = res->start + 3; + res->flags = IORESOURCE_MEM; + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 0b20449e48cf..da9acec1a029 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -533,6 +533,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + { + u8 rx_watermark; + struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; ++ unsigned long flags; + + /* Clear and enable Rx full interrupt. */ + xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); +@@ -548,6 +549,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + rx_watermark = IIC_RX_FIFO_DEPTH; + xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); + ++ local_irq_save(flags); + if (!(msg->flags & I2C_M_NOSTART)) + /* write the address */ + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, +@@ -558,6 +560,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, + msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); ++ local_irq_restore(flags); ++ + if (i2c->nmsgs == 1) + /* very last, enable bus not busy as well */ + xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d57a78ec7425..0f42411d6a79 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1280,9 +1280,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, + (addr->src_addr.ss_family == AF_IB || + cma_protocol_roce_dev_port(id->device, port_num)); + +- return !addr->dev_addr.bound_dev_if || +- (net_eq(dev_net(net_dev), addr->dev_addr.net) && +- addr->dev_addr.bound_dev_if == net_dev->ifindex); ++ /* ++ * Net namespaces must match, and if the listner is listening ++ * on a specific netdevice than netdevice must match as well. ++ */ ++ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && ++ (!!addr->dev_addr.bound_dev_if == ++ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) ++ return true; ++ else ++ return false; + } + + static struct rdma_id_private *cma_find_listener( +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 88dfe3008cf4..be2f2521c1c5 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1593,10 +1593,11 @@ static int mxt_get_object_table(struct mxt_data *data) + break; + case MXT_TOUCH_MULTI_T9: + data->multitouch = MXT_TOUCH_MULTI_T9; ++ /* Only handle messages from first T9 instance */ + data->T9_reportid_min = min_id; +- data->T9_reportid_max = max_id; +- data->num_touchids = object->num_report_ids +- * mxt_obj_instances(object); ++ data->T9_reportid_max = min_id + ++ object->num_report_ids - 1; ++ data->num_touchids = object->num_report_ids; + break; + case MXT_SPT_MESSAGECOUNT_T44: + data->T44_address = object->start_address; +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index dfb868e2d129..624e7ff76166 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain { + struct io_pgtable_ops *iop; + + unsigned int context_id; +- spinlock_t lock; /* Protects mappings */ ++ struct mutex mutex; /* Protects mappings */ + }; + + struct ipmmu_vmsa_archdata { +@@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type) + if (!domain) + return NULL; + +- spin_lock_init(&domain->lock); ++ mutex_init(&domain->mutex); + + return &domain->io_domain; + } +@@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu; + struct ipmmu_vmsa_device *mmu = archdata->mmu; + struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); +- unsigned long flags; + unsigned int i; + int ret = 0; + +@@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + return -ENXIO; + } + +- spin_lock_irqsave(&domain->lock, flags); ++ mutex_lock(&domain->mutex); + + if (!domain->mmu) { + /* The domain hasn't been used yet, initialize it. */ +@@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + ret = -EINVAL; + } + +- spin_unlock_irqrestore(&domain->lock, flags); ++ mutex_unlock(&domain->mutex); + + if (ret < 0) + return ret; +diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c +index f9512bfa6c3c..0a41132ffba7 100644 +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -530,8 +530,9 @@ init_pmu(void) + int timeout; + struct adb_request req; + +- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ +- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ ++ /* Negate TREQ. Set TACK to input and TREQ to output. */ ++ out_8(&via[B], in_8(&via[B]) | TREQ); ++ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); + + pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); + timeout = 100000; +@@ -1453,8 +1454,8 @@ pmu_sr_intr(void) + struct adb_request *req; + int bite = 0; + +- if (via[B] & TREQ) { +- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); ++ if (in_8(&via[B]) & TREQ) { ++ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); + out_8(&via[IFR], SR_INT); + return NULL; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d59b861764a1..0841d8f10a58 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4190,6 +4190,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) + s->failed++; + if (rdev && !test_bit(Faulty, &rdev->flags)) + do_recovery = 1; ++ else if (!rdev) { ++ rdev = rcu_dereference( ++ conf->disks[i].replacement); ++ if (rdev && !test_bit(Faulty, &rdev->flags)) ++ do_recovery = 1; ++ } + } + } + if (test_bit(STRIPE_SYNCING, &sh->state)) { +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index e4e4b22eebc9..4a0f076c91ba 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -224,14 +224,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) + * The TSC_ADC_SS controller design assumes the OCP clock is + * at least 6x faster than the ADC clock. + */ +- clk = clk_get(&pdev->dev, "adc_tsc_fck"); ++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "failed to get TSC fck\n"); + err = PTR_ERR(clk); + goto err_disable_clk; + } + clock_rate = clk_get_rate(clk); +- clk_put(clk); + tscadc->clk_div = clock_rate / ADC_CLK; + + /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ +diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c +index ddc9e4b08b5c..56efa9d18a9a 100644 +--- a/drivers/misc/mic/scif/scif_api.c ++++ b/drivers/misc/mic/scif/scif_api.c +@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) + goto scif_bind_exit; + } + } else { +- pn = scif_get_new_port(); +- if (!pn) { +- ret = -ENOSPC; ++ ret = scif_get_new_port(); ++ if (ret < 0) + goto scif_bind_exit; +- } ++ pn = ret; + } + + ep->state = SCIFEP_BOUND; +@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) + err = -EISCONN; + break; + case SCIFEP_UNBOUND: +- ep->port.port = scif_get_new_port(); +- if (!ep->port.port) { +- err = -ENOSPC; +- } else { +- ep->port.node = scif_info.nodeid; +- ep->conn_async_state = ASYNC_CONN_IDLE; +- } ++ err = scif_get_new_port(); ++ if (err < 0) ++ break; ++ ep->port.port = err; ++ ep->port.node = scif_info.nodeid; ++ ep->conn_async_state = ASYNC_CONN_IDLE; + /* Fall through */ + case SCIFEP_BOUND: + /* +diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c +index 71b64550b591..a1bca836e506 100644 +--- a/drivers/misc/ti-st/st_kim.c ++++ b/drivers/misc/ti-st/st_kim.c +@@ -757,14 +757,14 @@ static int kim_probe(struct platform_device *pdev) + err = gpio_request(kim_gdata->nshutdown, "kim"); + if (unlikely(err)) { + pr_err(" gpio %d request failed ", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + + /* Configure nShutdown GPIO as output=0 */ + err = gpio_direction_output(kim_gdata->nshutdown, 0); + if (unlikely(err)) { + pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + /* get reference of pdev for request_firmware + */ +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 518e2dec2aa2..5e9122cd3898 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + + MODULE_AUTHOR("VMware, Inc."); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index b3c1b8106a68..f4b3ce2b2bc3 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1597,8 +1597,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +@@ -1617,8 +1619,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index ea693bbf56d8..1c300259d70a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2569,7 +2569,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + } + + mvneta_start_dev(pp); +- mvneta_port_up(pp); + + netdev_update_features(dev); + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c69b0bdd891d..c2e110b2549b 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -371,7 +371,6 @@ struct cpsw_priv { + spinlock_t lock; + struct platform_device *pdev; + struct net_device *ndev; +- struct device_node *phy_node; + struct napi_struct napi_rx; + struct napi_struct napi_tx; + struct device *dev; +@@ -1165,8 +1164,8 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (priv->phy_node) +- slave->phy = of_phy_connect(priv->ndev, priv->phy_node, ++ if (slave->data->phy_node) ++ slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); + else + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, +@@ -1957,12 +1956,11 @@ static void cpsw_slave_init(struct cpsw_slave *slave, struct cpsw_priv *priv, + slave->port_vlan = data->dual_emac_res_vlan; + } + +-static int cpsw_probe_dt(struct cpsw_priv *priv, ++static int cpsw_probe_dt(struct cpsw_platform_data *data, + struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; + struct device_node *slave_node; +- struct cpsw_platform_data *data = &priv->data; + int i = 0, ret; + u32 prop; + +@@ -2050,7 +2048,8 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + if (strcmp(slave_node->name, "slave")) + continue; + +- priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0); ++ slave_data->phy_node = of_parse_phandle(slave_node, ++ "phy-handle", 0); + parp = of_get_property(slave_node, "phy_id", &lenp); + if (of_phy_is_fixed_link(slave_node)) { + struct device_node *phy_node; +@@ -2087,6 +2086,7 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + } + snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), + PHY_ID_FMT, mdio->name, phyid); ++ put_device(&mdio->dev); + } else { + dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i); + goto no_phy_slave; +@@ -2291,7 +2291,7 @@ static int cpsw_probe(struct platform_device *pdev) + /* Select default pin state */ + pinctrl_pm_select_default_state(&pdev->dev); + +- if (cpsw_probe_dt(priv, pdev)) { ++ if (cpsw_probe_dt(&priv->data, pdev)) { + dev_err(&pdev->dev, "cpsw: platform data missing\n"); + ret = -ENODEV; + goto clean_runtime_disable_ret; +diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h +index 442a7038e660..e50afd1b2eda 100644 +--- a/drivers/net/ethernet/ti/cpsw.h ++++ b/drivers/net/ethernet/ti/cpsw.h +@@ -18,6 +18,7 @@ + #include + + struct cpsw_slave_data { ++ struct device_node *phy_node; + char phy_id[MII_BUS_ID_SIZE]; + int phy_if; + u8 mac_addr[ETH_ALEN]; +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 6be315303d61..8ecb24186b7f 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -2108,6 +2108,7 @@ static int davinci_emac_remove(struct platform_device *pdev) + cpdma_ctlr_destroy(priv->dma); + + unregister_netdev(ndev); ++ of_node_put(priv->phy_node); + free_netdev(ndev); + + return 0; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 916b9b12edd2..4644357d291a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2901,6 +2901,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) + passive = channel->flags & IEEE80211_CHAN_NO_IR; + ch->passive = passive; + ++ /* the firmware is ignoring the "radar" flag of the ++ * channel and is scanning actively using Probe Requests ++ * on "Radar detection"/DFS channels which are not ++ * marked as "available" ++ */ ++ ch->passive |= ch->chan_radar; ++ + ch->freq = channel->center_freq; + ch->band_center_freq1 = channel->center_freq; + ch->min_power = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 02eea3c3b5d3..c72eb4464de9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1424,6 +1424,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) + cfg->keep_alive_pattern_size = __cpu_to_le32(0); + cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); + cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); ++ cfg->wmi_send_separate = __cpu_to_le32(0); ++ cfg->num_ocb_vdevs = __cpu_to_le32(0); ++ cfg->num_ocb_channels = __cpu_to_le32(0); ++ cfg->num_ocb_schedules = __cpu_to_le32(0); ++ cfg->host_capab = __cpu_to_le32(0); + + ath10k_wmi_put_host_mem_chunks(ar, chunks); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +index ad655c44afdb..f5031f3965c5 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +@@ -1209,6 +1209,11 @@ struct wmi_tlv_resource_config { + __le32 keep_alive_pattern_size; + __le32 max_tdls_concurrent_sleep_sta; + __le32 max_tdls_concurrent_buffer_sta; ++ __le32 wmi_send_separate; ++ __le32 num_ocb_vdevs; ++ __le32 num_ocb_channels; ++ __le32 num_ocb_schedules; ++ __le32 host_capab; + } __packed; + + struct wmi_tlv_init_cmd { +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 5466246c69b4..b78a2f3745f2 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twa_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = ioremap(mem_addr, mem_len); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (twa_reset_sequence(tw_dev, 0)) ++ if (twa_reset_sequence(tw_dev, 0)) { ++ retval = -ENOMEM; + goto out_iounmap; ++ } + + /* Set host specific parameters */ + if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index f8374850f714..f0a5536a9ff5 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twl_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_iomap(pdev, 1, 0); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + /* Initialize the card */ + if (twl_reset_sequence(tw_dev, 0)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); ++ retval = -ENOMEM; + goto out_iounmap; + } + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 14af38036287..308a4206b636 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2278,6 +2278,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (tw_initialize_device_extension(tw_dev)) { + printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2292,6 +2293,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_resource_start(pdev, 0); + if (!tw_dev->base_addr) { + printk(KERN_WARNING "3w-xxxx: Failed to get io address."); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c +index 12a3893b98fd..ade29c4295b7 100644 +--- a/drivers/staging/rts5208/rtsx_scsi.c ++++ b/drivers/staging/rts5208/rtsx_scsi.c +@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) + + if (sendbytes > 8) { + memcpy(buf, inquiry_buf, 8); +- memcpy(buf + 8, inquiry_string, sendbytes - 8); ++ strncpy(buf + 8, inquiry_string, sendbytes - 8); + if (pro_formatter_flag) { + /* Additional Length */ + buf[4] = 0x33; +diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c +index 10fea7bb8f30..3db4a2570b19 100644 +--- a/drivers/staging/rts5208/xd.c ++++ b/drivers/staging/rts5208/xd.c +@@ -1252,7 +1252,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk, + reg = 0; + rtsx_read_register(chip, XD_CTL, ®); + if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) { +- wait_timeout(100); ++ mdelay(100); + + if (detect_card_cd(chip, + XD_CARD) != STATUS_SUCCESS) { +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 21f888ac550e..7199bac67333 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -306,6 +306,7 @@ void __transport_register_session( + { + const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; + unsigned char buf[PR_REG_ISID_LEN]; ++ unsigned long flags; + + se_sess->se_tpg = se_tpg; + se_sess->fabric_sess_ptr = fabric_sess_ptr; +@@ -342,7 +343,7 @@ void __transport_register_session( + se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); + } + +- spin_lock_irq(&se_nacl->nacl_sess_lock); ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); + /* + * The se_nacl->nacl_sess pointer will be set to the + * last active I_T Nexus for each struct se_node_acl. +@@ -351,7 +352,7 @@ void __transport_register_session( + + list_add_tail(&se_sess->sess_acl_list, + &se_nacl->acl_sess_list); +- spin_unlock_irq(&se_nacl->nacl_sess_lock); ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + } + list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); + +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 802eac7e561b..2b8f2e0a4224 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -1915,7 +1915,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) + ByteIO_t UPCIRingInd = 0; + + if (!dev || !pci_match_id(rocket_pci_ids, dev) || +- pci_enable_device(dev)) ++ pci_enable_device(dev) || i >= NUM_BOARDS) + return 0; + + rcktpt_io_addr[i] = pci_resource_start(dev, 0); +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index bcc1fc027311..b9823eb9c195 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -833,8 +833,6 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + +- info->uio_dev = idev; +- + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -850,6 +848,7 @@ int __uio_register_device(struct module *owner, + goto err_request_irq; + } + ++ info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 128a3c0a9286..9dbf1583bd7a 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3675,6 +3675,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + } + + spin_lock_irqsave(&xhci->lock, flags); ++ ++ virt_dev->udev = NULL; ++ + /* Don't disable the slot if the host controller is dead. */ + state = readl(&xhci->op_regs->status); + if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || +diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h +index 502d3892d8a4..d71e7ad4d382 100644 +--- a/fs/autofs4/autofs_i.h ++++ b/fs/autofs4/autofs_i.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + /* This is the range of ioctl() numbers we claim as ours */ + #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY +@@ -135,7 +136,8 @@ struct autofs_sb_info { + + static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) + { +- return (struct autofs_sb_info *)(sb->s_fs_info); ++ return sb->s_magic != AUTOFS_SUPER_MAGIC ? ++ NULL : (struct autofs_sb_info *)(sb->s_fs_info); + } + + static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) +diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c +index a3ae0b2aeb5a..1132fe71b312 100644 +--- a/fs/autofs4/inode.c ++++ b/fs/autofs4/inode.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include "autofs_i.h" + #include + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index ee44d346ea44..bfa1d31f79aa 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -381,6 +381,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + if (test_and_clear_bit(segno, free_i->free_segmap)) { + free_i->free_segments++; + ++ if (IS_CURSEC(sbi, secno)) ++ goto skip_free; + next = find_next_bit(free_i->free_segmap, + start_segno + sbi->segs_per_sec, start_segno); + if (next >= start_segno + sbi->segs_per_sec) { +@@ -388,6 +390,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + free_i->free_sections++; + } + } ++skip_free: + spin_unlock(&free_i->segmap_lock); + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 6cc67e1bbb41..2ffc53d0c9c7 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1079,12 +1079,17 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); + struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); + unsigned int main_segs, blocks_per_seg; ++ unsigned int sit_segs, nat_segs; ++ unsigned int sit_bitmap_size, nat_bitmap_size; ++ unsigned int log_blocks_per_seg; + int i; + + total = le32_to_cpu(raw_super->segment_count); + fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); +- fsmeta += le32_to_cpu(raw_super->segment_count_sit); +- fsmeta += le32_to_cpu(raw_super->segment_count_nat); ++ sit_segs = le32_to_cpu(raw_super->segment_count_sit); ++ fsmeta += sit_segs; ++ nat_segs = le32_to_cpu(raw_super->segment_count_nat); ++ fsmeta += nat_segs; + fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); + fsmeta += le32_to_cpu(raw_super->segment_count_ssa); + +@@ -1105,6 +1110,18 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + return 1; + } + ++ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); ++ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); ++ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); ++ ++ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || ++ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "Wrong bitmap size: sit: %u, nat:%u", ++ sit_bitmap_size, nat_bitmap_size); ++ return 1; ++ } ++ + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); + return 1; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index e2e857affbf2..0647cb1ede56 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -911,16 +911,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); +- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) ++ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + goto out_invalidcred; ++ } + } + + cps.minorversion = hdr_arg.minorversion; + hdr_res.taglen = hdr_arg.taglen; + hdr_res.tag = hdr_arg.tag; +- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) ++ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + return rpc_system_err; +- ++ } + while (status == 0 && nops != hdr_arg.nops) { + status = process_op(nops, rqstp, &xdr_in, + argp, &xdr_out, resp, &cps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 36f4695aa604..ad2a081bac66 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -392,7 +392,7 @@ struct kioctx_table; + struct mm_struct { + struct vm_area_struct *mmap; /* list of VMAs */ + struct rb_root mm_rb; +- u32 vmacache_seqnum; /* per-thread vmacache */ ++ u64 vmacache_seqnum; /* per-thread vmacache */ + #ifdef CONFIG_MMU + unsigned long (*get_unmapped_area) (struct file *filp, + unsigned long addr, unsigned long len, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 725498cc5d30..b30540d6d125 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1454,7 +1454,7 @@ struct task_struct { + + struct mm_struct *mm, *active_mm; + /* per-thread vma caching */ +- u32 vmacache_seqnum; ++ u64 vmacache_seqnum; + struct vm_area_struct *vmacache[VMACACHE_SIZE]; + #if defined(SPLIT_RSS_COUNTING) + struct task_rss_stat rss_stat; +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 8ef3a61fdc74..fdac5800872d 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -88,7 +88,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #ifdef CONFIG_DEBUG_VM_VMACACHE + VMACACHE_FIND_CALLS, + VMACACHE_FIND_HITS, +- VMACACHE_FULL_FLUSHES, + #endif + NR_VM_EVENT_ITEMS + }; +diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h +index c3fa0fd43949..4f58ff2dacd6 100644 +--- a/include/linux/vmacache.h ++++ b/include/linux/vmacache.h +@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk) + memset(tsk->vmacache, 0, sizeof(tsk->vmacache)); + } + +-extern void vmacache_flush_all(struct mm_struct *mm); + extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); + extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, + unsigned long addr); +@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, + static inline void vmacache_invalidate(struct mm_struct *mm) + { + mm->vmacache_seqnum++; +- +- /* deal with overflows */ +- if (unlikely(mm->vmacache_seqnum == 0)) +- vmacache_flush_all(mm); + } + + #endif /* __LINUX_VMACACHE_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index cd1629170103..08f47e0e9f8d 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -819,13 +819,13 @@ struct ethtool_rx_flow_spec { + static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) + { + return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; +-}; ++} + + static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) + { + return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> + ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; +-}; ++} + + /** + * struct ethtool_rxnfc - command to get or set RX flow classification rules +diff --git a/kernel/fork.c b/kernel/fork.c +index 37ec96fe739d..dd2f79ac0771 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1337,6 +1337,18 @@ static struct task_struct *copy_process(unsigned long clone_flags, + if (!p) + goto fork_out; + ++ /* ++ * This _must_ happen before we call free_task(), i.e. before we jump ++ * to any of the bad_fork_* labels. This is to avoid freeing ++ * p->set_child_tid which is (ab)used as a kthread's data pointer for ++ * kernel threads (PF_KTHREAD). ++ */ ++ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; ++ /* ++ * Clear TID on mm_release()? ++ */ ++ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; ++ + ftrace_graph_init_task(p); + + rt_mutex_init_task(p); +@@ -1498,11 +1510,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, + } + } + +- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; +- /* +- * Clear TID on mm_release()? +- */ +- p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; + #ifdef CONFIG_BLOCK + p->plug = NULL; + #endif +diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c +index 05a37857ab55..8d7047ecef4e 100644 +--- a/kernel/locking/osq_lock.c ++++ b/kernel/locking/osq_lock.c +@@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock) + + prev = decode_cpu(old); + node->prev = prev; ++ ++ /* ++ * osq_lock() unqueue ++ * ++ * node->prev = prev osq_wait_next() ++ * WMB MB ++ * prev->next = node next->prev = prev // unqueue-C ++ * ++ * Here 'node->prev' and 'next->prev' are the same variable and we need ++ * to ensure these stores happen in-order to avoid corrupting the list. ++ */ ++ smp_wmb(); ++ + WRITE_ONCE(prev->next, node); + + /* +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index a4d4de05b2d1..1be33caf157d 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -510,6 +510,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem) + { + unsigned long flags; + ++ /* ++ * __rwsem_down_write_failed_common(sem) ++ * rwsem_optimistic_spin(sem) ++ * osq_unlock(sem->osq) ++ * ... ++ * atomic_long_add_return(&sem->count) ++ * ++ * - VS - ++ * ++ * __up_write() ++ * if (atomic_long_sub_return_release(&sem->count) < 0) ++ * rwsem_wake(sem) ++ * osq_is_locked(&sem->osq) ++ * ++ * And __up_write() must observe !osq_is_locked() when it observes the ++ * atomic_long_add_return() in order to not miss a wakeup. ++ * ++ * This boils down to: ++ * ++ * [S.rel] X = 1 [RmW] r0 = (Y += 0) ++ * MB RMB ++ * [RmW] Y += 1 [L] r1 = X ++ * ++ * exists (r0=1 /\ r1=0) ++ */ ++ smp_rmb(); ++ + /* + * If a spinner is present, it is not necessary to do the wakeup. + * Try to do wakeup only if the trylock succeeds to minimize +diff --git a/mm/debug.c b/mm/debug.c +index 668aa35191ca..689b6e911cae 100644 +--- a/mm/debug.c ++++ b/mm/debug.c +@@ -168,7 +168,7 @@ EXPORT_SYMBOL(dump_vma); + + void dump_mm(const struct mm_struct *mm) + { +- pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" ++ pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" + #ifdef CONFIG_MMU + "get_unmapped_area %p\n" + #endif +@@ -198,7 +198,7 @@ void dump_mm(const struct mm_struct *mm) + #endif + "%s", /* This is here to hold the comma */ + +- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, ++ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, + #ifdef CONFIG_MMU + mm->get_unmapped_area, + #endif +diff --git a/mm/vmacache.c b/mm/vmacache.c +index fd09dc9c6812..9c8ff3d4eda9 100644 +--- a/mm/vmacache.c ++++ b/mm/vmacache.c +@@ -5,44 +5,6 @@ + #include + #include + +-/* +- * Flush vma caches for threads that share a given mm. +- * +- * The operation is safe because the caller holds the mmap_sem +- * exclusively and other threads accessing the vma cache will +- * have mmap_sem held at least for read, so no extra locking +- * is required to maintain the vma cache. +- */ +-void vmacache_flush_all(struct mm_struct *mm) +-{ +- struct task_struct *g, *p; +- +- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); +- +- /* +- * Single threaded tasks need not iterate the entire +- * list of process. We can avoid the flushing as well +- * since the mm's seqnum was increased and don't have +- * to worry about other threads' seqnum. Current's +- * flush will occur upon the next lookup. +- */ +- if (atomic_read(&mm->mm_users) == 1) +- return; +- +- rcu_read_lock(); +- for_each_process_thread(g, p) { +- /* +- * Only flush the vmacache pointers as the +- * mm seqnum is already set and curr's will +- * be set upon invalidation when the next +- * lookup is done. +- */ +- if (mm == p->mm) +- vmacache_flush(p); +- } +- rcu_read_unlock(); +-} +- + /* + * This task may be accessing a foreign mm via (for example) + * get_user_pages()->find_vma(). The vmacache is task-local and this +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 1811f8e7ddf4..552e00b07196 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session, + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, sizeof(req->name) - 1); ++ strncpy(hid->name, req->name, sizeof(hid->name)); + + snprintf(hid->phys, sizeof(hid->phys), "%pMR", + &l2cap_pi(session->ctrl_sock->sk)->chan->src); +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 4f6c1862dfd2..6fe2b615518c 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1763,7 +1763,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, + if (itr->app.selector == app->selector && + itr->app.protocol == app->protocol && + itr->ifindex == ifindex && +- (!prio || itr->app.priority == prio)) ++ ((prio == -1) || itr->app.priority == prio)) + return itr; + } + +@@ -1798,7 +1798,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio = itr->app.priority; + spin_unlock_bh(&dcb_lock); + +@@ -1826,7 +1827,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) + + spin_lock_bh(&dcb_lock); + /* Search for existing match and replace */ +- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { ++ itr = dcb_app_lookup(new, dev->ifindex, -1); ++ if (itr) { + if (new->priority) + itr->app.priority = new->priority; + else { +@@ -1859,7 +1861,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio |= 1 << itr->app.priority; + spin_unlock_bh(&dcb_lock); + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 1f3c305df45d..b6e72af15237 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -876,7 +876,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) + return ERR_PTR(-EFAULT); + +- strlcpy(info->name, compat_tmp.name, sizeof(info->name)); ++ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); + info->num_counters = compat_tmp.num_counters; + user += sizeof(compat_tmp); + } else +@@ -889,9 +889,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(info, user, sizeof(*info)) != 0) + return ERR_PTR(-EFAULT); + +- info->name[sizeof(info->name) - 1] = '\0'; + user += sizeof(*info); + } ++ info->name[sizeof(info->name) - 1] = '\0'; + + size = sizeof(struct xt_counters); + size *= info->num_counters; +diff --git a/security/selinux/avc.c b/security/selinux/avc.c +index e60c79de13e1..52f3c550abcc 100644 +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -348,27 +348,26 @@ static struct avc_xperms_decision_node + struct avc_xperms_decision_node *xpd_node; + struct extended_perms_decision *xpd; + +- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); + if (!xpd_node) + return NULL; + + xpd = &xpd_node->xpd; + if (which & XPERMS_ALLOWED) { + xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->allowed) + goto error; + } + if (which & XPERMS_AUDITALLOW) { + xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->auditallow) + goto error; + } + if (which & XPERMS_DONTAUDIT) { + xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->dontaudit) + goto error; + } +@@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) + { + struct avc_xperms_node *xp_node; + +- xp_node = kmem_cache_zalloc(avc_xperms_cachep, +- GFP_ATOMIC|__GFP_NOMEMALLOC); ++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); + if (!xp_node) + return xp_node; + INIT_LIST_HEAD(&xp_node->xpd_head); +@@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void) + { + struct avc_node *node; + +- node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); ++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); + if (!node) + goto out; + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 3324f98c35f6..f6d4a1046e54 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -4019,7 +4019,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) + + list_for_each_codec(codec, bus) { + /* FIXME: maybe a better way needed for forced reset */ +- cancel_delayed_work_sync(&codec->jackpoll_work); ++ if (current_work() != &codec->jackpoll_work.work) ++ cancel_delayed_work_sync(&codec->jackpoll_work); + #ifdef CONFIG_PM + if (hda_codec_is_power_on(codec)) { + hda_call_codec_suspend(codec); +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 90129accffbe..4341ed267d4e 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -29,7 +29,9 @@ static inline unsigned long long rdclock(void) + return ts.tv_sec * 1000000000ULL + ts.tv_nsec; + } + ++#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 1024 ++#endif + + extern const char *input_name; + extern bool perf_host, perf_guest; diff --git a/patch/kernel/rk3399-default/04-patch-4.4.157-158.patch b/patch/kernel/rk3399-default/04-patch-4.4.157-158.patch new file mode 100644 index 000000000..67b7dbbf2 --- /dev/null +++ b/patch/kernel/rk3399-default/04-patch-4.4.157-158.patch @@ -0,0 +1,1693 @@ +diff --git a/Makefile b/Makefile +index 2d55f88e6a08..d07a6283b67e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 157 ++SUBLEVEL = 158 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index c169cc3049aa..e8adb428dddb 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -260,6 +260,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 6b8abbe68746..3011c88bd2f3 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -105,7 +105,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index 8755d618e116..961c393c0f55 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -44,6 +44,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 4eee221b0cf0..d2be8e4f7a35 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -133,6 +133,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 5649a9e429e0..aca06b18c43e 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -14,12 +14,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + + #include ++#include + #include + + /* Kernel-provided data used by the VDSO. */ +@@ -118,12 +120,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index e48826aa314c..b40606051efe 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -371,7 +371,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 01718d05e952..9e8f0e255de2 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index f68c24a98277..dedfc96acc66 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1363,7 +1363,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1379,7 +1379,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 8db791ef2027..95619ee33112 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2132,13 +2132,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 98ab08c0aa2d..07541c5670e6 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -30,7 +30,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_ACPI + void acpi_gpiochip_add(struct gpio_chip *chip); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index eb1da83c9902..8cdd505784ed 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index e7e581d6a8ff..1bfc4807ce5b 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 22e10b7d505d..fe3a2b19a5db 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 93738dfbf631..902ee6efd09c 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -86,7 +86,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev) +@@ -107,7 +107,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev) +@@ -155,6 +155,9 @@ static int coresight_enable_link(struct coresight_device *csdev) + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 0f42411d6a79..1454290078de 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -544,6 +544,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -567,18 +568,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index f74b11542603..a338e60836ee 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -992,12 +992,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 347aaaa5a7ea..fc6eb752ab35 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1219,6 +1219,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 0c1a42bf27fd..1c37d5a78822 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1366,6 +1366,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index 90520d76633f..9cde4c5bfba4 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index bdc7fcd80eca..9dcdc6f41ceb 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 6d19835b80a9..0d244dac1ccb 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c2e110b2549b..c1217a87d535 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1164,25 +1164,34 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (slave->data->phy_node) ++ if (slave->data->phy_node) { + slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); +- else ++ if (!slave->phy) { ++ dev_err(priv->dev, "phy \"%s\" not found on slave %d\n", ++ slave->data->phy_node->full_name, ++ slave->slave_num); ++ return; ++ } ++ } else { + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, + &cpsw_adjust_link, slave->data->phy_if); +- if (IS_ERR(slave->phy)) { +- dev_err(priv->dev, "phy %s not found on slave %d\n", +- slave->data->phy_id, slave->slave_num); +- slave->phy = NULL; +- } else { +- dev_info(priv->dev, "phy found : id is : 0x%x\n", +- slave->phy->phy_id); +- phy_start(slave->phy); +- +- /* Configure GMII_SEL register */ +- cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, +- slave->slave_num); ++ if (IS_ERR(slave->phy)) { ++ dev_err(priv->dev, ++ "phy \"%s\" not found on slave %d, err %ld\n", ++ slave->data->phy_id, slave->slave_num, ++ PTR_ERR(slave->phy)); ++ slave->phy = NULL; ++ return; ++ } + } ++ ++ dev_info(priv->dev, "phy found : id is : 0x%x\n", slave->phy->phy_id); ++ ++ phy_start(slave->phy); ++ ++ /* Configure GMII_SEL register */ ++ cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, slave->slave_num); + } + + static inline void cpsw_add_default_vlan(struct cpsw_priv *priv) +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 68d0a5c9d437..3270b4333668 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -86,8 +86,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1336,11 +1335,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1608,6 +1607,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); +@@ -1615,8 +1615,9 @@ static int xennet_init_queue(struct netfront_queue *queue) + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2023,15 +2024,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2047,12 +2047,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2160,14 +2158,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 6c42ca14d2fd..4ea810cafaac 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index f774cb576ffa..1ff95b5a429d 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.23" + #define PROC_INTERFACE_VERSION 1 + ++#include + #include + #include + #include +@@ -1472,7 +1473,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index bd170cb3361c..5747a54cbd42 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 95c631125a20..09ac56317f1b 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3505,13 +3505,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index fa844b0ff847..7bcf0dae3a65 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -419,6 +419,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 61ea87917433..4380e4f600ab 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 40378487e023..a5e3e410db4e 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -529,8 +529,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 29adabdb305f..08cba309eb78 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 99f67764765f..37a5e07b3488 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index a47de8c31ce9..8efeadf30b4d 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1542,11 +1542,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2425,8 +2428,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3272,6 +3278,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3312,12 +3320,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3336,6 +3346,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3346,6 +3357,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 692ccc69345e..d5434e7a3b2e 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2565,7 +2565,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 442b6631162e..3d750671b85a 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -388,7 +388,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -398,7 +398,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 512c84adcace..e8e8702d5adf 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -439,13 +439,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -464,6 +464,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index 1bd67b24f916..bc9ff5ebd67c 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -178,7 +178,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h +index 98f35c656c02..0cd247f75b8b 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -227,7 +227,7 @@ struct ti_interrupt { + } __attribute__((packed)); + + /* Interrupt codes */ +-#define TI_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TI_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TI_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TI_CODE_HARDWARE_ERROR 0xFF + #define TI_CODE_DATA_ERROR 0x03 +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index dba51362d2e2..6c186b4df94a 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1a34d2a89de6..898215cad351 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2213,6 +2213,13 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* Reported-by: Tim Anderson */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Nick Bowler + * SCSI stack spams (otherwise harmless) error messages. +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * x[M][R][-][@][i][m] or ++ * x[M][R][-][@][i][p][m] or + * [-][@] + * + * with , , and decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 7f6c9e6cfc6c..14a93cb21310 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 393ae1bc07e8..a8a6f072fb78 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -977,7 +977,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index badee04ef496..71b5dca95bdb 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include + #include + #include + #include +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index f44e93d2650d..62bc72001fce 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 97d1a15873c5..57b039ebfb1f 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -373,8 +373,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 52d79fb04115..f7111bb88ec1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2402,33 +2402,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 61296ecbd0e2..09476bb8f6cd 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 27300533c2dd..bd21795ce657 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -378,7 +378,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -397,6 +402,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -417,7 +427,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -464,7 +474,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index a162661c9d60..f45a9a5d3e47 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 00a8cc572a22..1f930032253a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -286,7 +286,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 4a72c0d1e56f..91a4e606edcd 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -647,11 +647,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -679,14 +683,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -874,7 +878,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -884,7 +889,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index e9eecf6f0bff..48080f89ed25 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1845,7 +1845,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 31a981d6229d..5897fc3857a0 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -359,3 +359,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 4c145d6bccd4..5bc7ddf8fc70 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index a31ea6c22d19..2d7379dec1f0 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 69bf5cf1e91e..15cbe2565703 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 60a94b3e532e..177480066816 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index bd630c222e65..9a53f6e9ef43 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_addr_location(thread, PERF_RECORD_MISC_USER, + MAP__FUNCTION, ip, &al); +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index 30906bfd9c1b..0ab937a17ebb 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } diff --git a/patch/kernel/rockchip-default/04-patch-4.4.156-157.patch b/patch/kernel/rockchip-default/04-patch-4.4.156-157.patch new file mode 100644 index 000000000..45066d89c --- /dev/null +++ b/patch/kernel/rockchip-default/04-patch-4.4.156-157.patch @@ -0,0 +1,1664 @@ +diff --git a/Makefile b/Makefile +index 6dd5924a7ea5..2d55f88e6a08 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 156 ++SUBLEVEL = 157 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index f1ac9818b751..dbee1934dfc6 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 323486d6ee83..561eac854cc3 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index 66191cd0447e..aa4f261b6508 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index d113c8ded6e2..6df3a4ea77fc 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -349,6 +349,7 @@ static int __init octeon_ehci_device_init(void) + return 0; + + pd = of_find_device_by_node(ehci_node); ++ of_node_put(ehci_node); + if (!pd) + return 0; + +@@ -411,6 +412,7 @@ static int __init octeon_ohci_device_init(void) + return 0; + + pd = of_find_device_by_node(ohci_node); ++ of_node_put(ohci_node); + if (!pd) + return 0; + +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 75fa296836fc..ab1df19b0957 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) + /* + * ISA I/O bus memory addresses are 1:1 with the physical address. + */ +-static inline unsigned long isa_virt_to_bus(volatile void * address) ++static inline unsigned long isa_virt_to_bus(volatile void *address) + { +- return (unsigned long)address - PAGE_OFFSET; ++ return virt_to_phys(address); + } + +-static inline void * isa_bus_to_virt(unsigned long address) ++static inline void *isa_bus_to_virt(unsigned long address) + { +- return (void *)(address + PAGE_OFFSET); ++ return phys_to_virt(address); + } + + #define isa_page_to_bus page_to_phys +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 354b99f56c1e..ed6cac4a4df0 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + struct thread_info *ti = task_thread_info(p); + struct pt_regs *childregs, *regs = current_pt_regs(); + unsigned long childksp; +- p->set_child_tid = p->clear_child_tid = NULL; + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 5d3a25e1cfae..52e8c2026853 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -712,7 +712,8 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end) + static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +@@ -745,7 +746,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index 7095dfe7666b..962372143fda 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + + top_of_kernel_stack = sp; + +- p->set_child_tid = p->clear_child_tid = NULL; +- + /* Locate userspace context on stack... */ + sp -= STACK_FRAME_OVERHEAD; /* redzone */ + sp -= sizeof(struct pt_regs); +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 337c52192278..440a948c4feb 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -104,6 +104,8 @@ struct cpuinfo_x86 { + __u8 x86_phys_bits; + /* CPUID returned core id bits: */ + __u8 x86_coreid_bits; ++ ++ __u8 x86_cache_bits; + /* Max extended CPUID function supported: */ + __u32 extended_cpuid_level; + /* Maximum supported CPUID level, -1=no CPUID: */ +@@ -174,7 +176,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c); + + static inline unsigned long long l1tf_pfn_limit(void) + { +- return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); ++ return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT); + } + + extern void early_cpu_init(void); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index b9e6b60df148..621bc6561189 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -634,6 +634,46 @@ void x86_spec_ctrl_setup_ap(void) + + #undef pr_fmt + #define pr_fmt(fmt) "L1TF: " fmt ++ ++/* ++ * These CPUs all support 44bits physical address space internally in the ++ * cache but CPUID can report a smaller number of physical address bits. ++ * ++ * The L1TF mitigation uses the top most address bit for the inversion of ++ * non present PTEs. When the installed memory reaches into the top most ++ * address bit due to memory holes, which has been observed on machines ++ * which report 36bits physical address bits and have 32G RAM installed, ++ * then the mitigation range check in l1tf_select_mitigation() triggers. ++ * This is a false positive because the mitigation is still possible due to ++ * the fact that the cache uses 44bit internally. Use the cache bits ++ * instead of the reported physical bits and adjust them on the affected ++ * machines to 44bit if the reported bits are less than 44. ++ */ ++static void override_cache_bits(struct cpuinfo_x86 *c) ++{ ++ if (c->x86 != 6) ++ return; ++ ++ switch (c->x86_model) { ++ case INTEL_FAM6_NEHALEM: ++ case INTEL_FAM6_WESTMERE: ++ case INTEL_FAM6_SANDYBRIDGE: ++ case INTEL_FAM6_IVYBRIDGE: ++ case INTEL_FAM6_HASWELL_CORE: ++ case INTEL_FAM6_HASWELL_ULT: ++ case INTEL_FAM6_HASWELL_GT3E: ++ case INTEL_FAM6_BROADWELL_CORE: ++ case INTEL_FAM6_BROADWELL_GT3E: ++ case INTEL_FAM6_SKYLAKE_MOBILE: ++ case INTEL_FAM6_SKYLAKE_DESKTOP: ++ case INTEL_FAM6_KABYLAKE_MOBILE: ++ case INTEL_FAM6_KABYLAKE_DESKTOP: ++ if (c->x86_cache_bits < 44) ++ c->x86_cache_bits = 44; ++ break; ++ } ++} ++ + static void __init l1tf_select_mitigation(void) + { + u64 half_pa; +@@ -641,16 +681,13 @@ static void __init l1tf_select_mitigation(void) + if (!boot_cpu_has_bug(X86_BUG_L1TF)) + return; + ++ override_cache_bits(&boot_cpu_data); ++ + #if CONFIG_PGTABLE_LEVELS == 2 + pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); + return; + #endif + +- /* +- * This is extremely unlikely to happen because almost all +- * systems have far more MAX_PA/2 than RAM can be fit into +- * DIMM slots. +- */ + half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; + if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 4d3fa79c0f09..b12c0287d6cf 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -798,6 +798,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + c->x86_phys_bits = 36; + #endif + ++ c->x86_cache_bits = c->x86_phys_bits; ++ + if (c->extended_cpuid_level >= 0x8000000a) + c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e0a34b0d381e..c4dffae5d939 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -273,8 +273,6 @@ static noinline int vmalloc_fault(unsigned long address) + if (!(address >= VMALLOC_START && address < VMALLOC_END)) + return -1; + +- WARN_ON_ONCE(in_nmi()); +- + /* + * Synchronize this task's top level page-table + * with the 'reference' page table. +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 46ba2402c8f9..987361113ecd 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + } + + wb_congested = wb_congested_get_create(&q->backing_dev_info, +- blkcg->css.id, GFP_NOWAIT); ++ blkcg->css.id, ++ GFP_NOWAIT | __GFP_NOWARN); + if (!wb_congested) { + ret = -ENOMEM; + goto err_put_css; +@@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + + /* allocate */ + if (!new_blkg) { +- new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT); ++ new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN); + if (unlikely(!new_blkg)) { + ret = -ENOMEM; + goto err_put_congested; +@@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + } + + spin_lock_init(&blkcg->lock); +- INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT); ++ INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN); + INIT_HLIST_HEAD(&blkcg->blkg_list); + #ifdef CONFIG_CGROUP_WRITEBACK + INIT_LIST_HEAD(&blkcg->cgwb_list); +@@ -1238,7 +1239,7 @@ pd_prealloc: + if (blkg->pd[pol->plid]) + continue; + +- pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node); ++ pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node); + if (!pd) + swap(pd, pd_prealloc); + if (!pd) { +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index e04a7b8492cf..4e1f49434bbe 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2905,7 +2905,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd) + * for devices that support queuing, otherwise we still have a problem + * with sync vs async workloads. + */ +- if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag) ++ if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag && ++ !cfqd->cfq_group_idle) + return; + + WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list)); +@@ -3810,7 +3811,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + goto out; + } + +- cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO, ++ cfqq = kmem_cache_alloc_node(cfq_pool, ++ GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN, + cfqd->queue->node); + if (!cfqq) { + cfqq = &cfqd->oom_cfqq; +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index f3ed7b2d89bf..8e7d358e0226 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) + u32 vgda_sector = 0; + u32 vgda_len = 0; + int numlvs = 0; +- struct pvd *pvd; ++ struct pvd *pvd = NULL; + struct lv_info { + unsigned short pps_per_lv; + unsigned short pps_found; +@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) + if (lvip[i].pps_per_lv) + foundlvs += 1; + } ++ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ ++ pvd = alloc_pvd(state, vgda_sector + 17); + } + put_dev_sector(sect); + } +- pvd = alloc_pvd(state, vgda_sector + 17); + if (pvd) { + int numpps = be16_to_cpu(pvd->pp_count); + int psn_part1 = be32_to_cpu(pvd->psn_part1); +@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state) + next_lp_ix += 1; + } + for (i = 0; i < state->limit; i += 1) +- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) ++ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { ++ char tmp[sizeof(n[i].name) + 1]; // null char ++ ++ snprintf(tmp, sizeof(tmp), "%s", n[i].name); + pr_warn("partition %s (%u pp's found) is " + "not contiguous\n", +- n[i].name, lvip[i].pps_found); ++ tmp, lvip[i].pps_found); ++ } + kfree(pvd); + } + kfree(n); +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 9628fa131757..8116cb2fef2d 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -2113,6 +2113,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + deto = 20; + } + ++ /* Make dito, mdat, deto bits to 0s */ ++ devslp &= ~GENMASK_ULL(24, 2); + devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | + (mdat << PORT_DEVSLP_MDAT_OFFSET) | + (deto << PORT_DEVSLP_DETO_OFFSET) | +diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig +index ec6af1595062..4685bd10c473 100644 +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -125,6 +125,7 @@ config BT_HCIUART_LL + config BT_HCIUART_3WIRE + bool "Three-wire UART (H5) protocol support" + depends on BT_HCIUART ++ depends on BT_HCIUART_SERDEV + help + The HCI Three-wire UART Transport Layer makes it possible to + user the Bluetooth HCI over a serial port interface. The HCI +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 9506e8693c81..d8ef1147b344 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -111,24 +111,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_encrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->enc_key, walk.iv, 1); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +@@ -152,24 +151,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_decrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->dec_key, walk.iv, 0); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index 5536108aa9db..fe21734bbe5c 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -495,9 +495,10 @@ err_irq_alloc_descs: + + chip = chip_save; + err_gpiochip_add: ++ chip = chip_save; + while (--i >= 0) { +- chip--; + gpiochip_remove(&chip->gpio); ++ chip++; + } + kfree(chip_save); + +diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c +index 896bf29776b0..fb2c1df4f588 100644 +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -591,4 +591,4 @@ static int __init tegra_gpio_init(void) + { + return platform_driver_register(&tegra_gpio_driver); + } +-postcore_initcall(tegra_gpio_init); ++subsys_initcall(tegra_gpio_init); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 85f39cc3e276..47581c32b1e1 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -128,6 +128,7 @@ + + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c ++#define SBREG_SMBCTRL_DNV 0xcf000c + + /* Host status bits for SMBPCISTS */ + #define SMBPCISTS_INTS 0x08 +@@ -1251,7 +1252,11 @@ static void i801_add_tco(struct i801_priv *priv) + spin_unlock(&p2sb_spinlock); + + res = &tco_res[ICH_RES_MEM_OFF]; +- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; ++ else ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ + res->end = res->start + 3; + res->flags = IORESOURCE_MEM; + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 0b20449e48cf..da9acec1a029 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -533,6 +533,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + { + u8 rx_watermark; + struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; ++ unsigned long flags; + + /* Clear and enable Rx full interrupt. */ + xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); +@@ -548,6 +549,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + rx_watermark = IIC_RX_FIFO_DEPTH; + xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); + ++ local_irq_save(flags); + if (!(msg->flags & I2C_M_NOSTART)) + /* write the address */ + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, +@@ -558,6 +560,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, + msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); ++ local_irq_restore(flags); ++ + if (i2c->nmsgs == 1) + /* very last, enable bus not busy as well */ + xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d57a78ec7425..0f42411d6a79 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1280,9 +1280,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, + (addr->src_addr.ss_family == AF_IB || + cma_protocol_roce_dev_port(id->device, port_num)); + +- return !addr->dev_addr.bound_dev_if || +- (net_eq(dev_net(net_dev), addr->dev_addr.net) && +- addr->dev_addr.bound_dev_if == net_dev->ifindex); ++ /* ++ * Net namespaces must match, and if the listner is listening ++ * on a specific netdevice than netdevice must match as well. ++ */ ++ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && ++ (!!addr->dev_addr.bound_dev_if == ++ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) ++ return true; ++ else ++ return false; + } + + static struct rdma_id_private *cma_find_listener( +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 88dfe3008cf4..be2f2521c1c5 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1593,10 +1593,11 @@ static int mxt_get_object_table(struct mxt_data *data) + break; + case MXT_TOUCH_MULTI_T9: + data->multitouch = MXT_TOUCH_MULTI_T9; ++ /* Only handle messages from first T9 instance */ + data->T9_reportid_min = min_id; +- data->T9_reportid_max = max_id; +- data->num_touchids = object->num_report_ids +- * mxt_obj_instances(object); ++ data->T9_reportid_max = min_id + ++ object->num_report_ids - 1; ++ data->num_touchids = object->num_report_ids; + break; + case MXT_SPT_MESSAGECOUNT_T44: + data->T44_address = object->start_address; +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index dfb868e2d129..624e7ff76166 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain { + struct io_pgtable_ops *iop; + + unsigned int context_id; +- spinlock_t lock; /* Protects mappings */ ++ struct mutex mutex; /* Protects mappings */ + }; + + struct ipmmu_vmsa_archdata { +@@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type) + if (!domain) + return NULL; + +- spin_lock_init(&domain->lock); ++ mutex_init(&domain->mutex); + + return &domain->io_domain; + } +@@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu; + struct ipmmu_vmsa_device *mmu = archdata->mmu; + struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); +- unsigned long flags; + unsigned int i; + int ret = 0; + +@@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + return -ENXIO; + } + +- spin_lock_irqsave(&domain->lock, flags); ++ mutex_lock(&domain->mutex); + + if (!domain->mmu) { + /* The domain hasn't been used yet, initialize it. */ +@@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + ret = -EINVAL; + } + +- spin_unlock_irqrestore(&domain->lock, flags); ++ mutex_unlock(&domain->mutex); + + if (ret < 0) + return ret; +diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c +index f9512bfa6c3c..0a41132ffba7 100644 +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -530,8 +530,9 @@ init_pmu(void) + int timeout; + struct adb_request req; + +- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ +- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ ++ /* Negate TREQ. Set TACK to input and TREQ to output. */ ++ out_8(&via[B], in_8(&via[B]) | TREQ); ++ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); + + pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); + timeout = 100000; +@@ -1453,8 +1454,8 @@ pmu_sr_intr(void) + struct adb_request *req; + int bite = 0; + +- if (via[B] & TREQ) { +- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); ++ if (in_8(&via[B]) & TREQ) { ++ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); + out_8(&via[IFR], SR_INT); + return NULL; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d59b861764a1..0841d8f10a58 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4190,6 +4190,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) + s->failed++; + if (rdev && !test_bit(Faulty, &rdev->flags)) + do_recovery = 1; ++ else if (!rdev) { ++ rdev = rcu_dereference( ++ conf->disks[i].replacement); ++ if (rdev && !test_bit(Faulty, &rdev->flags)) ++ do_recovery = 1; ++ } + } + } + if (test_bit(STRIPE_SYNCING, &sh->state)) { +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index e4e4b22eebc9..4a0f076c91ba 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -224,14 +224,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) + * The TSC_ADC_SS controller design assumes the OCP clock is + * at least 6x faster than the ADC clock. + */ +- clk = clk_get(&pdev->dev, "adc_tsc_fck"); ++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "failed to get TSC fck\n"); + err = PTR_ERR(clk); + goto err_disable_clk; + } + clock_rate = clk_get_rate(clk); +- clk_put(clk); + tscadc->clk_div = clock_rate / ADC_CLK; + + /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ +diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c +index ddc9e4b08b5c..56efa9d18a9a 100644 +--- a/drivers/misc/mic/scif/scif_api.c ++++ b/drivers/misc/mic/scif/scif_api.c +@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) + goto scif_bind_exit; + } + } else { +- pn = scif_get_new_port(); +- if (!pn) { +- ret = -ENOSPC; ++ ret = scif_get_new_port(); ++ if (ret < 0) + goto scif_bind_exit; +- } ++ pn = ret; + } + + ep->state = SCIFEP_BOUND; +@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) + err = -EISCONN; + break; + case SCIFEP_UNBOUND: +- ep->port.port = scif_get_new_port(); +- if (!ep->port.port) { +- err = -ENOSPC; +- } else { +- ep->port.node = scif_info.nodeid; +- ep->conn_async_state = ASYNC_CONN_IDLE; +- } ++ err = scif_get_new_port(); ++ if (err < 0) ++ break; ++ ep->port.port = err; ++ ep->port.node = scif_info.nodeid; ++ ep->conn_async_state = ASYNC_CONN_IDLE; + /* Fall through */ + case SCIFEP_BOUND: + /* +diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c +index 71b64550b591..a1bca836e506 100644 +--- a/drivers/misc/ti-st/st_kim.c ++++ b/drivers/misc/ti-st/st_kim.c +@@ -757,14 +757,14 @@ static int kim_probe(struct platform_device *pdev) + err = gpio_request(kim_gdata->nshutdown, "kim"); + if (unlikely(err)) { + pr_err(" gpio %d request failed ", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + + /* Configure nShutdown GPIO as output=0 */ + err = gpio_direction_output(kim_gdata->nshutdown, 0); + if (unlikely(err)) { + pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + /* get reference of pdev for request_firmware + */ +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 518e2dec2aa2..5e9122cd3898 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + + MODULE_AUTHOR("VMware, Inc."); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index b3c1b8106a68..f4b3ce2b2bc3 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1597,8 +1597,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +@@ -1617,8 +1619,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index ea693bbf56d8..1c300259d70a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2569,7 +2569,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + } + + mvneta_start_dev(pp); +- mvneta_port_up(pp); + + netdev_update_features(dev); + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c69b0bdd891d..c2e110b2549b 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -371,7 +371,6 @@ struct cpsw_priv { + spinlock_t lock; + struct platform_device *pdev; + struct net_device *ndev; +- struct device_node *phy_node; + struct napi_struct napi_rx; + struct napi_struct napi_tx; + struct device *dev; +@@ -1165,8 +1164,8 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (priv->phy_node) +- slave->phy = of_phy_connect(priv->ndev, priv->phy_node, ++ if (slave->data->phy_node) ++ slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); + else + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, +@@ -1957,12 +1956,11 @@ static void cpsw_slave_init(struct cpsw_slave *slave, struct cpsw_priv *priv, + slave->port_vlan = data->dual_emac_res_vlan; + } + +-static int cpsw_probe_dt(struct cpsw_priv *priv, ++static int cpsw_probe_dt(struct cpsw_platform_data *data, + struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; + struct device_node *slave_node; +- struct cpsw_platform_data *data = &priv->data; + int i = 0, ret; + u32 prop; + +@@ -2050,7 +2048,8 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + if (strcmp(slave_node->name, "slave")) + continue; + +- priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0); ++ slave_data->phy_node = of_parse_phandle(slave_node, ++ "phy-handle", 0); + parp = of_get_property(slave_node, "phy_id", &lenp); + if (of_phy_is_fixed_link(slave_node)) { + struct device_node *phy_node; +@@ -2087,6 +2086,7 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + } + snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), + PHY_ID_FMT, mdio->name, phyid); ++ put_device(&mdio->dev); + } else { + dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i); + goto no_phy_slave; +@@ -2291,7 +2291,7 @@ static int cpsw_probe(struct platform_device *pdev) + /* Select default pin state */ + pinctrl_pm_select_default_state(&pdev->dev); + +- if (cpsw_probe_dt(priv, pdev)) { ++ if (cpsw_probe_dt(&priv->data, pdev)) { + dev_err(&pdev->dev, "cpsw: platform data missing\n"); + ret = -ENODEV; + goto clean_runtime_disable_ret; +diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h +index 442a7038e660..e50afd1b2eda 100644 +--- a/drivers/net/ethernet/ti/cpsw.h ++++ b/drivers/net/ethernet/ti/cpsw.h +@@ -18,6 +18,7 @@ + #include + + struct cpsw_slave_data { ++ struct device_node *phy_node; + char phy_id[MII_BUS_ID_SIZE]; + int phy_if; + u8 mac_addr[ETH_ALEN]; +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 6be315303d61..8ecb24186b7f 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -2108,6 +2108,7 @@ static int davinci_emac_remove(struct platform_device *pdev) + cpdma_ctlr_destroy(priv->dma); + + unregister_netdev(ndev); ++ of_node_put(priv->phy_node); + free_netdev(ndev); + + return 0; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 916b9b12edd2..4644357d291a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2901,6 +2901,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) + passive = channel->flags & IEEE80211_CHAN_NO_IR; + ch->passive = passive; + ++ /* the firmware is ignoring the "radar" flag of the ++ * channel and is scanning actively using Probe Requests ++ * on "Radar detection"/DFS channels which are not ++ * marked as "available" ++ */ ++ ch->passive |= ch->chan_radar; ++ + ch->freq = channel->center_freq; + ch->band_center_freq1 = channel->center_freq; + ch->min_power = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 02eea3c3b5d3..c72eb4464de9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1424,6 +1424,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) + cfg->keep_alive_pattern_size = __cpu_to_le32(0); + cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); + cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); ++ cfg->wmi_send_separate = __cpu_to_le32(0); ++ cfg->num_ocb_vdevs = __cpu_to_le32(0); ++ cfg->num_ocb_channels = __cpu_to_le32(0); ++ cfg->num_ocb_schedules = __cpu_to_le32(0); ++ cfg->host_capab = __cpu_to_le32(0); + + ath10k_wmi_put_host_mem_chunks(ar, chunks); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +index ad655c44afdb..f5031f3965c5 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +@@ -1209,6 +1209,11 @@ struct wmi_tlv_resource_config { + __le32 keep_alive_pattern_size; + __le32 max_tdls_concurrent_sleep_sta; + __le32 max_tdls_concurrent_buffer_sta; ++ __le32 wmi_send_separate; ++ __le32 num_ocb_vdevs; ++ __le32 num_ocb_channels; ++ __le32 num_ocb_schedules; ++ __le32 host_capab; + } __packed; + + struct wmi_tlv_init_cmd { +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 5466246c69b4..b78a2f3745f2 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twa_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = ioremap(mem_addr, mem_len); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (twa_reset_sequence(tw_dev, 0)) ++ if (twa_reset_sequence(tw_dev, 0)) { ++ retval = -ENOMEM; + goto out_iounmap; ++ } + + /* Set host specific parameters */ + if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index f8374850f714..f0a5536a9ff5 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twl_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_iomap(pdev, 1, 0); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + /* Initialize the card */ + if (twl_reset_sequence(tw_dev, 0)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); ++ retval = -ENOMEM; + goto out_iounmap; + } + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 14af38036287..308a4206b636 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2278,6 +2278,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (tw_initialize_device_extension(tw_dev)) { + printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2292,6 +2293,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_resource_start(pdev, 0); + if (!tw_dev->base_addr) { + printk(KERN_WARNING "3w-xxxx: Failed to get io address."); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c +index 12a3893b98fd..ade29c4295b7 100644 +--- a/drivers/staging/rts5208/rtsx_scsi.c ++++ b/drivers/staging/rts5208/rtsx_scsi.c +@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) + + if (sendbytes > 8) { + memcpy(buf, inquiry_buf, 8); +- memcpy(buf + 8, inquiry_string, sendbytes - 8); ++ strncpy(buf + 8, inquiry_string, sendbytes - 8); + if (pro_formatter_flag) { + /* Additional Length */ + buf[4] = 0x33; +diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c +index 10fea7bb8f30..3db4a2570b19 100644 +--- a/drivers/staging/rts5208/xd.c ++++ b/drivers/staging/rts5208/xd.c +@@ -1252,7 +1252,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk, + reg = 0; + rtsx_read_register(chip, XD_CTL, ®); + if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) { +- wait_timeout(100); ++ mdelay(100); + + if (detect_card_cd(chip, + XD_CARD) != STATUS_SUCCESS) { +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 21f888ac550e..7199bac67333 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -306,6 +306,7 @@ void __transport_register_session( + { + const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; + unsigned char buf[PR_REG_ISID_LEN]; ++ unsigned long flags; + + se_sess->se_tpg = se_tpg; + se_sess->fabric_sess_ptr = fabric_sess_ptr; +@@ -342,7 +343,7 @@ void __transport_register_session( + se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); + } + +- spin_lock_irq(&se_nacl->nacl_sess_lock); ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); + /* + * The se_nacl->nacl_sess pointer will be set to the + * last active I_T Nexus for each struct se_node_acl. +@@ -351,7 +352,7 @@ void __transport_register_session( + + list_add_tail(&se_sess->sess_acl_list, + &se_nacl->acl_sess_list); +- spin_unlock_irq(&se_nacl->nacl_sess_lock); ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + } + list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); + +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 802eac7e561b..2b8f2e0a4224 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -1915,7 +1915,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) + ByteIO_t UPCIRingInd = 0; + + if (!dev || !pci_match_id(rocket_pci_ids, dev) || +- pci_enable_device(dev)) ++ pci_enable_device(dev) || i >= NUM_BOARDS) + return 0; + + rcktpt_io_addr[i] = pci_resource_start(dev, 0); +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index bcc1fc027311..b9823eb9c195 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -833,8 +833,6 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + +- info->uio_dev = idev; +- + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -850,6 +848,7 @@ int __uio_register_device(struct module *owner, + goto err_request_irq; + } + ++ info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 128a3c0a9286..9dbf1583bd7a 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3675,6 +3675,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + } + + spin_lock_irqsave(&xhci->lock, flags); ++ ++ virt_dev->udev = NULL; ++ + /* Don't disable the slot if the host controller is dead. */ + state = readl(&xhci->op_regs->status); + if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || +diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h +index 502d3892d8a4..d71e7ad4d382 100644 +--- a/fs/autofs4/autofs_i.h ++++ b/fs/autofs4/autofs_i.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + /* This is the range of ioctl() numbers we claim as ours */ + #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY +@@ -135,7 +136,8 @@ struct autofs_sb_info { + + static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) + { +- return (struct autofs_sb_info *)(sb->s_fs_info); ++ return sb->s_magic != AUTOFS_SUPER_MAGIC ? ++ NULL : (struct autofs_sb_info *)(sb->s_fs_info); + } + + static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) +diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c +index a3ae0b2aeb5a..1132fe71b312 100644 +--- a/fs/autofs4/inode.c ++++ b/fs/autofs4/inode.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include "autofs_i.h" + #include + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index ee44d346ea44..bfa1d31f79aa 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -381,6 +381,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + if (test_and_clear_bit(segno, free_i->free_segmap)) { + free_i->free_segments++; + ++ if (IS_CURSEC(sbi, secno)) ++ goto skip_free; + next = find_next_bit(free_i->free_segmap, + start_segno + sbi->segs_per_sec, start_segno); + if (next >= start_segno + sbi->segs_per_sec) { +@@ -388,6 +390,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + free_i->free_sections++; + } + } ++skip_free: + spin_unlock(&free_i->segmap_lock); + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 6cc67e1bbb41..2ffc53d0c9c7 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1079,12 +1079,17 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); + struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); + unsigned int main_segs, blocks_per_seg; ++ unsigned int sit_segs, nat_segs; ++ unsigned int sit_bitmap_size, nat_bitmap_size; ++ unsigned int log_blocks_per_seg; + int i; + + total = le32_to_cpu(raw_super->segment_count); + fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); +- fsmeta += le32_to_cpu(raw_super->segment_count_sit); +- fsmeta += le32_to_cpu(raw_super->segment_count_nat); ++ sit_segs = le32_to_cpu(raw_super->segment_count_sit); ++ fsmeta += sit_segs; ++ nat_segs = le32_to_cpu(raw_super->segment_count_nat); ++ fsmeta += nat_segs; + fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); + fsmeta += le32_to_cpu(raw_super->segment_count_ssa); + +@@ -1105,6 +1110,18 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + return 1; + } + ++ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); ++ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); ++ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); ++ ++ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || ++ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "Wrong bitmap size: sit: %u, nat:%u", ++ sit_bitmap_size, nat_bitmap_size); ++ return 1; ++ } ++ + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); + return 1; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index e2e857affbf2..0647cb1ede56 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -911,16 +911,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); +- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) ++ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + goto out_invalidcred; ++ } + } + + cps.minorversion = hdr_arg.minorversion; + hdr_res.taglen = hdr_arg.taglen; + hdr_res.tag = hdr_arg.tag; +- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) ++ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + return rpc_system_err; +- ++ } + while (status == 0 && nops != hdr_arg.nops) { + status = process_op(nops, rqstp, &xdr_in, + argp, &xdr_out, resp, &cps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 36f4695aa604..ad2a081bac66 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -392,7 +392,7 @@ struct kioctx_table; + struct mm_struct { + struct vm_area_struct *mmap; /* list of VMAs */ + struct rb_root mm_rb; +- u32 vmacache_seqnum; /* per-thread vmacache */ ++ u64 vmacache_seqnum; /* per-thread vmacache */ + #ifdef CONFIG_MMU + unsigned long (*get_unmapped_area) (struct file *filp, + unsigned long addr, unsigned long len, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 725498cc5d30..b30540d6d125 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1454,7 +1454,7 @@ struct task_struct { + + struct mm_struct *mm, *active_mm; + /* per-thread vma caching */ +- u32 vmacache_seqnum; ++ u64 vmacache_seqnum; + struct vm_area_struct *vmacache[VMACACHE_SIZE]; + #if defined(SPLIT_RSS_COUNTING) + struct task_rss_stat rss_stat; +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 8ef3a61fdc74..fdac5800872d 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -88,7 +88,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #ifdef CONFIG_DEBUG_VM_VMACACHE + VMACACHE_FIND_CALLS, + VMACACHE_FIND_HITS, +- VMACACHE_FULL_FLUSHES, + #endif + NR_VM_EVENT_ITEMS + }; +diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h +index c3fa0fd43949..4f58ff2dacd6 100644 +--- a/include/linux/vmacache.h ++++ b/include/linux/vmacache.h +@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk) + memset(tsk->vmacache, 0, sizeof(tsk->vmacache)); + } + +-extern void vmacache_flush_all(struct mm_struct *mm); + extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); + extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, + unsigned long addr); +@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, + static inline void vmacache_invalidate(struct mm_struct *mm) + { + mm->vmacache_seqnum++; +- +- /* deal with overflows */ +- if (unlikely(mm->vmacache_seqnum == 0)) +- vmacache_flush_all(mm); + } + + #endif /* __LINUX_VMACACHE_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index cd1629170103..08f47e0e9f8d 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -819,13 +819,13 @@ struct ethtool_rx_flow_spec { + static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) + { + return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; +-}; ++} + + static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) + { + return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> + ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; +-}; ++} + + /** + * struct ethtool_rxnfc - command to get or set RX flow classification rules +diff --git a/kernel/fork.c b/kernel/fork.c +index 37ec96fe739d..dd2f79ac0771 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1337,6 +1337,18 @@ static struct task_struct *copy_process(unsigned long clone_flags, + if (!p) + goto fork_out; + ++ /* ++ * This _must_ happen before we call free_task(), i.e. before we jump ++ * to any of the bad_fork_* labels. This is to avoid freeing ++ * p->set_child_tid which is (ab)used as a kthread's data pointer for ++ * kernel threads (PF_KTHREAD). ++ */ ++ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; ++ /* ++ * Clear TID on mm_release()? ++ */ ++ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; ++ + ftrace_graph_init_task(p); + + rt_mutex_init_task(p); +@@ -1498,11 +1510,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, + } + } + +- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; +- /* +- * Clear TID on mm_release()? +- */ +- p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; + #ifdef CONFIG_BLOCK + p->plug = NULL; + #endif +diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c +index 05a37857ab55..8d7047ecef4e 100644 +--- a/kernel/locking/osq_lock.c ++++ b/kernel/locking/osq_lock.c +@@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock) + + prev = decode_cpu(old); + node->prev = prev; ++ ++ /* ++ * osq_lock() unqueue ++ * ++ * node->prev = prev osq_wait_next() ++ * WMB MB ++ * prev->next = node next->prev = prev // unqueue-C ++ * ++ * Here 'node->prev' and 'next->prev' are the same variable and we need ++ * to ensure these stores happen in-order to avoid corrupting the list. ++ */ ++ smp_wmb(); ++ + WRITE_ONCE(prev->next, node); + + /* +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index a4d4de05b2d1..1be33caf157d 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -510,6 +510,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem) + { + unsigned long flags; + ++ /* ++ * __rwsem_down_write_failed_common(sem) ++ * rwsem_optimistic_spin(sem) ++ * osq_unlock(sem->osq) ++ * ... ++ * atomic_long_add_return(&sem->count) ++ * ++ * - VS - ++ * ++ * __up_write() ++ * if (atomic_long_sub_return_release(&sem->count) < 0) ++ * rwsem_wake(sem) ++ * osq_is_locked(&sem->osq) ++ * ++ * And __up_write() must observe !osq_is_locked() when it observes the ++ * atomic_long_add_return() in order to not miss a wakeup. ++ * ++ * This boils down to: ++ * ++ * [S.rel] X = 1 [RmW] r0 = (Y += 0) ++ * MB RMB ++ * [RmW] Y += 1 [L] r1 = X ++ * ++ * exists (r0=1 /\ r1=0) ++ */ ++ smp_rmb(); ++ + /* + * If a spinner is present, it is not necessary to do the wakeup. + * Try to do wakeup only if the trylock succeeds to minimize +diff --git a/mm/debug.c b/mm/debug.c +index 668aa35191ca..689b6e911cae 100644 +--- a/mm/debug.c ++++ b/mm/debug.c +@@ -168,7 +168,7 @@ EXPORT_SYMBOL(dump_vma); + + void dump_mm(const struct mm_struct *mm) + { +- pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" ++ pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" + #ifdef CONFIG_MMU + "get_unmapped_area %p\n" + #endif +@@ -198,7 +198,7 @@ void dump_mm(const struct mm_struct *mm) + #endif + "%s", /* This is here to hold the comma */ + +- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, ++ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, + #ifdef CONFIG_MMU + mm->get_unmapped_area, + #endif +diff --git a/mm/vmacache.c b/mm/vmacache.c +index fd09dc9c6812..9c8ff3d4eda9 100644 +--- a/mm/vmacache.c ++++ b/mm/vmacache.c +@@ -5,44 +5,6 @@ + #include + #include + +-/* +- * Flush vma caches for threads that share a given mm. +- * +- * The operation is safe because the caller holds the mmap_sem +- * exclusively and other threads accessing the vma cache will +- * have mmap_sem held at least for read, so no extra locking +- * is required to maintain the vma cache. +- */ +-void vmacache_flush_all(struct mm_struct *mm) +-{ +- struct task_struct *g, *p; +- +- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); +- +- /* +- * Single threaded tasks need not iterate the entire +- * list of process. We can avoid the flushing as well +- * since the mm's seqnum was increased and don't have +- * to worry about other threads' seqnum. Current's +- * flush will occur upon the next lookup. +- */ +- if (atomic_read(&mm->mm_users) == 1) +- return; +- +- rcu_read_lock(); +- for_each_process_thread(g, p) { +- /* +- * Only flush the vmacache pointers as the +- * mm seqnum is already set and curr's will +- * be set upon invalidation when the next +- * lookup is done. +- */ +- if (mm == p->mm) +- vmacache_flush(p); +- } +- rcu_read_unlock(); +-} +- + /* + * This task may be accessing a foreign mm via (for example) + * get_user_pages()->find_vma(). The vmacache is task-local and this +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 1811f8e7ddf4..552e00b07196 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session, + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, sizeof(req->name) - 1); ++ strncpy(hid->name, req->name, sizeof(hid->name)); + + snprintf(hid->phys, sizeof(hid->phys), "%pMR", + &l2cap_pi(session->ctrl_sock->sk)->chan->src); +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 4f6c1862dfd2..6fe2b615518c 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1763,7 +1763,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, + if (itr->app.selector == app->selector && + itr->app.protocol == app->protocol && + itr->ifindex == ifindex && +- (!prio || itr->app.priority == prio)) ++ ((prio == -1) || itr->app.priority == prio)) + return itr; + } + +@@ -1798,7 +1798,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio = itr->app.priority; + spin_unlock_bh(&dcb_lock); + +@@ -1826,7 +1827,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) + + spin_lock_bh(&dcb_lock); + /* Search for existing match and replace */ +- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { ++ itr = dcb_app_lookup(new, dev->ifindex, -1); ++ if (itr) { + if (new->priority) + itr->app.priority = new->priority; + else { +@@ -1859,7 +1861,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio |= 1 << itr->app.priority; + spin_unlock_bh(&dcb_lock); + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 1f3c305df45d..b6e72af15237 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -876,7 +876,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) + return ERR_PTR(-EFAULT); + +- strlcpy(info->name, compat_tmp.name, sizeof(info->name)); ++ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); + info->num_counters = compat_tmp.num_counters; + user += sizeof(compat_tmp); + } else +@@ -889,9 +889,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(info, user, sizeof(*info)) != 0) + return ERR_PTR(-EFAULT); + +- info->name[sizeof(info->name) - 1] = '\0'; + user += sizeof(*info); + } ++ info->name[sizeof(info->name) - 1] = '\0'; + + size = sizeof(struct xt_counters); + size *= info->num_counters; +diff --git a/security/selinux/avc.c b/security/selinux/avc.c +index e60c79de13e1..52f3c550abcc 100644 +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -348,27 +348,26 @@ static struct avc_xperms_decision_node + struct avc_xperms_decision_node *xpd_node; + struct extended_perms_decision *xpd; + +- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); + if (!xpd_node) + return NULL; + + xpd = &xpd_node->xpd; + if (which & XPERMS_ALLOWED) { + xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->allowed) + goto error; + } + if (which & XPERMS_AUDITALLOW) { + xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->auditallow) + goto error; + } + if (which & XPERMS_DONTAUDIT) { + xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->dontaudit) + goto error; + } +@@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) + { + struct avc_xperms_node *xp_node; + +- xp_node = kmem_cache_zalloc(avc_xperms_cachep, +- GFP_ATOMIC|__GFP_NOMEMALLOC); ++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); + if (!xp_node) + return xp_node; + INIT_LIST_HEAD(&xp_node->xpd_head); +@@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void) + { + struct avc_node *node; + +- node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); ++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); + if (!node) + goto out; + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 3324f98c35f6..f6d4a1046e54 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -4019,7 +4019,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) + + list_for_each_codec(codec, bus) { + /* FIXME: maybe a better way needed for forced reset */ +- cancel_delayed_work_sync(&codec->jackpoll_work); ++ if (current_work() != &codec->jackpoll_work.work) ++ cancel_delayed_work_sync(&codec->jackpoll_work); + #ifdef CONFIG_PM + if (hda_codec_is_power_on(codec)) { + hda_call_codec_suspend(codec); +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 90129accffbe..4341ed267d4e 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -29,7 +29,9 @@ static inline unsigned long long rdclock(void) + return ts.tv_sec * 1000000000ULL + ts.tv_nsec; + } + ++#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 1024 ++#endif + + extern const char *input_name; + extern bool perf_host, perf_guest; diff --git a/patch/kernel/rockchip-default/04-patch-4.4.157-158.patch b/patch/kernel/rockchip-default/04-patch-4.4.157-158.patch new file mode 100644 index 000000000..67b7dbbf2 --- /dev/null +++ b/patch/kernel/rockchip-default/04-patch-4.4.157-158.patch @@ -0,0 +1,1693 @@ +diff --git a/Makefile b/Makefile +index 2d55f88e6a08..d07a6283b67e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 157 ++SUBLEVEL = 158 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index c169cc3049aa..e8adb428dddb 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -260,6 +260,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 6b8abbe68746..3011c88bd2f3 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -105,7 +105,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index 8755d618e116..961c393c0f55 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -44,6 +44,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 4eee221b0cf0..d2be8e4f7a35 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -133,6 +133,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 5649a9e429e0..aca06b18c43e 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -14,12 +14,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + + #include ++#include + #include + + /* Kernel-provided data used by the VDSO. */ +@@ -118,12 +120,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index e48826aa314c..b40606051efe 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -371,7 +371,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 01718d05e952..9e8f0e255de2 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index f68c24a98277..dedfc96acc66 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1363,7 +1363,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1379,7 +1379,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 8db791ef2027..95619ee33112 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2132,13 +2132,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 98ab08c0aa2d..07541c5670e6 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -30,7 +30,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_ACPI + void acpi_gpiochip_add(struct gpio_chip *chip); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index eb1da83c9902..8cdd505784ed 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index e7e581d6a8ff..1bfc4807ce5b 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 22e10b7d505d..fe3a2b19a5db 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 93738dfbf631..902ee6efd09c 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -86,7 +86,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev) +@@ -107,7 +107,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev) +@@ -155,6 +155,9 @@ static int coresight_enable_link(struct coresight_device *csdev) + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 0f42411d6a79..1454290078de 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -544,6 +544,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -567,18 +568,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index f74b11542603..a338e60836ee 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -992,12 +992,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 347aaaa5a7ea..fc6eb752ab35 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1219,6 +1219,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 0c1a42bf27fd..1c37d5a78822 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1366,6 +1366,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index 90520d76633f..9cde4c5bfba4 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index bdc7fcd80eca..9dcdc6f41ceb 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 6d19835b80a9..0d244dac1ccb 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c2e110b2549b..c1217a87d535 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1164,25 +1164,34 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (slave->data->phy_node) ++ if (slave->data->phy_node) { + slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); +- else ++ if (!slave->phy) { ++ dev_err(priv->dev, "phy \"%s\" not found on slave %d\n", ++ slave->data->phy_node->full_name, ++ slave->slave_num); ++ return; ++ } ++ } else { + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, + &cpsw_adjust_link, slave->data->phy_if); +- if (IS_ERR(slave->phy)) { +- dev_err(priv->dev, "phy %s not found on slave %d\n", +- slave->data->phy_id, slave->slave_num); +- slave->phy = NULL; +- } else { +- dev_info(priv->dev, "phy found : id is : 0x%x\n", +- slave->phy->phy_id); +- phy_start(slave->phy); +- +- /* Configure GMII_SEL register */ +- cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, +- slave->slave_num); ++ if (IS_ERR(slave->phy)) { ++ dev_err(priv->dev, ++ "phy \"%s\" not found on slave %d, err %ld\n", ++ slave->data->phy_id, slave->slave_num, ++ PTR_ERR(slave->phy)); ++ slave->phy = NULL; ++ return; ++ } + } ++ ++ dev_info(priv->dev, "phy found : id is : 0x%x\n", slave->phy->phy_id); ++ ++ phy_start(slave->phy); ++ ++ /* Configure GMII_SEL register */ ++ cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, slave->slave_num); + } + + static inline void cpsw_add_default_vlan(struct cpsw_priv *priv) +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 68d0a5c9d437..3270b4333668 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -86,8 +86,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1336,11 +1335,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1608,6 +1607,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); +@@ -1615,8 +1615,9 @@ static int xennet_init_queue(struct netfront_queue *queue) + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2023,15 +2024,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2047,12 +2047,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2160,14 +2158,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 6c42ca14d2fd..4ea810cafaac 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index f774cb576ffa..1ff95b5a429d 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.23" + #define PROC_INTERFACE_VERSION 1 + ++#include + #include + #include + #include +@@ -1472,7 +1473,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index bd170cb3361c..5747a54cbd42 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 95c631125a20..09ac56317f1b 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3505,13 +3505,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index fa844b0ff847..7bcf0dae3a65 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -419,6 +419,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 61ea87917433..4380e4f600ab 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 40378487e023..a5e3e410db4e 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -529,8 +529,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 29adabdb305f..08cba309eb78 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 99f67764765f..37a5e07b3488 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index a47de8c31ce9..8efeadf30b4d 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1542,11 +1542,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2425,8 +2428,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3272,6 +3278,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3312,12 +3320,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3336,6 +3346,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3346,6 +3357,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 692ccc69345e..d5434e7a3b2e 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2565,7 +2565,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 442b6631162e..3d750671b85a 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -388,7 +388,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -398,7 +398,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 512c84adcace..e8e8702d5adf 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -439,13 +439,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -464,6 +464,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index 1bd67b24f916..bc9ff5ebd67c 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -178,7 +178,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h +index 98f35c656c02..0cd247f75b8b 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -227,7 +227,7 @@ struct ti_interrupt { + } __attribute__((packed)); + + /* Interrupt codes */ +-#define TI_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TI_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TI_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TI_CODE_HARDWARE_ERROR 0xFF + #define TI_CODE_DATA_ERROR 0x03 +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index dba51362d2e2..6c186b4df94a 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1a34d2a89de6..898215cad351 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2213,6 +2213,13 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* Reported-by: Tim Anderson */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Nick Bowler + * SCSI stack spams (otherwise harmless) error messages. +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * x[M][R][-][@][i][m] or ++ * x[M][R][-][@][i][p][m] or + * [-][@] + * + * with , , and decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 7f6c9e6cfc6c..14a93cb21310 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 393ae1bc07e8..a8a6f072fb78 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -977,7 +977,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index badee04ef496..71b5dca95bdb 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include + #include + #include + #include +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index f44e93d2650d..62bc72001fce 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 97d1a15873c5..57b039ebfb1f 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -373,8 +373,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 52d79fb04115..f7111bb88ec1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2402,33 +2402,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 61296ecbd0e2..09476bb8f6cd 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 27300533c2dd..bd21795ce657 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -378,7 +378,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -397,6 +402,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -417,7 +427,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -464,7 +474,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index a162661c9d60..f45a9a5d3e47 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 00a8cc572a22..1f930032253a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -286,7 +286,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 4a72c0d1e56f..91a4e606edcd 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -647,11 +647,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -679,14 +683,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -874,7 +878,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -884,7 +889,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index e9eecf6f0bff..48080f89ed25 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1845,7 +1845,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 31a981d6229d..5897fc3857a0 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -359,3 +359,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 4c145d6bccd4..5bc7ddf8fc70 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index a31ea6c22d19..2d7379dec1f0 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 69bf5cf1e91e..15cbe2565703 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 60a94b3e532e..177480066816 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index bd630c222e65..9a53f6e9ef43 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_addr_location(thread, PERF_RECORD_MISC_USER, + MAP__FUNCTION, ip, &al); +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index 30906bfd9c1b..0ab937a17ebb 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } diff --git a/patch/kernel/rockchip64-default/04-patch-4.4.156-157.patch b/patch/kernel/rockchip64-default/04-patch-4.4.156-157.patch new file mode 100644 index 000000000..45066d89c --- /dev/null +++ b/patch/kernel/rockchip64-default/04-patch-4.4.156-157.patch @@ -0,0 +1,1664 @@ +diff --git a/Makefile b/Makefile +index 6dd5924a7ea5..2d55f88e6a08 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 156 ++SUBLEVEL = 157 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index f1ac9818b751..dbee1934dfc6 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 323486d6ee83..561eac854cc3 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index 66191cd0447e..aa4f261b6508 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -1,6 +1,5 @@ + CONFIG_CROSS_COMPILE="arc-linux-" + CONFIG_DEFAULT_HOSTNAME="ARCLinux" +-# CONFIG_SWAP is not set + CONFIG_SYSVIPC=y + CONFIG_POSIX_MQUEUE=y + # CONFIG_CROSS_MEMORY_ATTACH is not set +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index d113c8ded6e2..6df3a4ea77fc 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -349,6 +349,7 @@ static int __init octeon_ehci_device_init(void) + return 0; + + pd = of_find_device_by_node(ehci_node); ++ of_node_put(ehci_node); + if (!pd) + return 0; + +@@ -411,6 +412,7 @@ static int __init octeon_ohci_device_init(void) + return 0; + + pd = of_find_device_by_node(ohci_node); ++ of_node_put(ohci_node); + if (!pd) + return 0; + +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 75fa296836fc..ab1df19b0957 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address) + /* + * ISA I/O bus memory addresses are 1:1 with the physical address. + */ +-static inline unsigned long isa_virt_to_bus(volatile void * address) ++static inline unsigned long isa_virt_to_bus(volatile void *address) + { +- return (unsigned long)address - PAGE_OFFSET; ++ return virt_to_phys(address); + } + +-static inline void * isa_bus_to_virt(unsigned long address) ++static inline void *isa_bus_to_virt(unsigned long address) + { +- return (void *)(address + PAGE_OFFSET); ++ return phys_to_virt(address); + } + + #define isa_page_to_bus page_to_phys +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 354b99f56c1e..ed6cac4a4df0 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, + struct thread_info *ti = task_thread_info(p); + struct pt_regs *childregs, *regs = current_pt_regs(); + unsigned long childksp; +- p->set_child_tid = p->clear_child_tid = NULL; + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 5d3a25e1cfae..52e8c2026853 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -712,7 +712,8 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end) + static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +@@ -745,7 +746,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + { + /* Catch bad driver code */ +- BUG_ON(size == 0); ++ if (WARN_ON(size == 0)) ++ return; + + preempt_disable(); + if (cpu_has_inclusive_pcaches) { +diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c +index 7095dfe7666b..962372143fda 100644 +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + + top_of_kernel_stack = sp; + +- p->set_child_tid = p->clear_child_tid = NULL; +- + /* Locate userspace context on stack... */ + sp -= STACK_FRAME_OVERHEAD; /* redzone */ + sp -= sizeof(struct pt_regs); +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 337c52192278..440a948c4feb 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -104,6 +104,8 @@ struct cpuinfo_x86 { + __u8 x86_phys_bits; + /* CPUID returned core id bits: */ + __u8 x86_coreid_bits; ++ ++ __u8 x86_cache_bits; + /* Max extended CPUID function supported: */ + __u32 extended_cpuid_level; + /* Maximum supported CPUID level, -1=no CPUID: */ +@@ -174,7 +176,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c); + + static inline unsigned long long l1tf_pfn_limit(void) + { +- return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT); ++ return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT); + } + + extern void early_cpu_init(void); +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index b9e6b60df148..621bc6561189 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -634,6 +634,46 @@ void x86_spec_ctrl_setup_ap(void) + + #undef pr_fmt + #define pr_fmt(fmt) "L1TF: " fmt ++ ++/* ++ * These CPUs all support 44bits physical address space internally in the ++ * cache but CPUID can report a smaller number of physical address bits. ++ * ++ * The L1TF mitigation uses the top most address bit for the inversion of ++ * non present PTEs. When the installed memory reaches into the top most ++ * address bit due to memory holes, which has been observed on machines ++ * which report 36bits physical address bits and have 32G RAM installed, ++ * then the mitigation range check in l1tf_select_mitigation() triggers. ++ * This is a false positive because the mitigation is still possible due to ++ * the fact that the cache uses 44bit internally. Use the cache bits ++ * instead of the reported physical bits and adjust them on the affected ++ * machines to 44bit if the reported bits are less than 44. ++ */ ++static void override_cache_bits(struct cpuinfo_x86 *c) ++{ ++ if (c->x86 != 6) ++ return; ++ ++ switch (c->x86_model) { ++ case INTEL_FAM6_NEHALEM: ++ case INTEL_FAM6_WESTMERE: ++ case INTEL_FAM6_SANDYBRIDGE: ++ case INTEL_FAM6_IVYBRIDGE: ++ case INTEL_FAM6_HASWELL_CORE: ++ case INTEL_FAM6_HASWELL_ULT: ++ case INTEL_FAM6_HASWELL_GT3E: ++ case INTEL_FAM6_BROADWELL_CORE: ++ case INTEL_FAM6_BROADWELL_GT3E: ++ case INTEL_FAM6_SKYLAKE_MOBILE: ++ case INTEL_FAM6_SKYLAKE_DESKTOP: ++ case INTEL_FAM6_KABYLAKE_MOBILE: ++ case INTEL_FAM6_KABYLAKE_DESKTOP: ++ if (c->x86_cache_bits < 44) ++ c->x86_cache_bits = 44; ++ break; ++ } ++} ++ + static void __init l1tf_select_mitigation(void) + { + u64 half_pa; +@@ -641,16 +681,13 @@ static void __init l1tf_select_mitigation(void) + if (!boot_cpu_has_bug(X86_BUG_L1TF)) + return; + ++ override_cache_bits(&boot_cpu_data); ++ + #if CONFIG_PGTABLE_LEVELS == 2 + pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); + return; + #endif + +- /* +- * This is extremely unlikely to happen because almost all +- * systems have far more MAX_PA/2 than RAM can be fit into +- * DIMM slots. +- */ + half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; + if (e820_any_mapped(half_pa, ULLONG_MAX - half_pa, E820_RAM)) { + pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 4d3fa79c0f09..b12c0287d6cf 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -798,6 +798,8 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + c->x86_phys_bits = 36; + #endif + ++ c->x86_cache_bits = c->x86_phys_bits; ++ + if (c->extended_cpuid_level >= 0x8000000a) + c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a); + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index e0a34b0d381e..c4dffae5d939 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -273,8 +273,6 @@ static noinline int vmalloc_fault(unsigned long address) + if (!(address >= VMALLOC_START && address < VMALLOC_END)) + return -1; + +- WARN_ON_ONCE(in_nmi()); +- + /* + * Synchronize this task's top level page-table + * with the 'reference' page table. +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 46ba2402c8f9..987361113ecd 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + } + + wb_congested = wb_congested_get_create(&q->backing_dev_info, +- blkcg->css.id, GFP_NOWAIT); ++ blkcg->css.id, ++ GFP_NOWAIT | __GFP_NOWARN); + if (!wb_congested) { + ret = -ENOMEM; + goto err_put_css; +@@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg, + + /* allocate */ + if (!new_blkg) { +- new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT); ++ new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN); + if (unlikely(!new_blkg)) { + ret = -ENOMEM; + goto err_put_congested; +@@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + } + + spin_lock_init(&blkcg->lock); +- INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT); ++ INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN); + INIT_HLIST_HEAD(&blkcg->blkg_list); + #ifdef CONFIG_CGROUP_WRITEBACK + INIT_LIST_HEAD(&blkcg->cgwb_list); +@@ -1238,7 +1239,7 @@ pd_prealloc: + if (blkg->pd[pol->plid]) + continue; + +- pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node); ++ pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node); + if (!pd) + swap(pd, pd_prealloc); + if (!pd) { +diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c +index e04a7b8492cf..4e1f49434bbe 100644 +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -2905,7 +2905,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd) + * for devices that support queuing, otherwise we still have a problem + * with sync vs async workloads. + */ +- if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag) ++ if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag && ++ !cfqd->cfq_group_idle) + return; + + WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list)); +@@ -3810,7 +3811,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic, + goto out; + } + +- cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO, ++ cfqq = kmem_cache_alloc_node(cfq_pool, ++ GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN, + cfqd->queue->node); + if (!cfqq) { + cfqq = &cfqd->oom_cfqq; +diff --git a/block/partitions/aix.c b/block/partitions/aix.c +index f3ed7b2d89bf..8e7d358e0226 100644 +--- a/block/partitions/aix.c ++++ b/block/partitions/aix.c +@@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state) + u32 vgda_sector = 0; + u32 vgda_len = 0; + int numlvs = 0; +- struct pvd *pvd; ++ struct pvd *pvd = NULL; + struct lv_info { + unsigned short pps_per_lv; + unsigned short pps_found; +@@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state) + if (lvip[i].pps_per_lv) + foundlvs += 1; + } ++ /* pvd loops depend on n[].name and lvip[].pps_per_lv */ ++ pvd = alloc_pvd(state, vgda_sector + 17); + } + put_dev_sector(sect); + } +- pvd = alloc_pvd(state, vgda_sector + 17); + if (pvd) { + int numpps = be16_to_cpu(pvd->pp_count); + int psn_part1 = be32_to_cpu(pvd->psn_part1); +@@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state) + next_lp_ix += 1; + } + for (i = 0; i < state->limit; i += 1) +- if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) ++ if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) { ++ char tmp[sizeof(n[i].name) + 1]; // null char ++ ++ snprintf(tmp, sizeof(tmp), "%s", n[i].name); + pr_warn("partition %s (%u pp's found) is " + "not contiguous\n", +- n[i].name, lvip[i].pps_found); ++ tmp, lvip[i].pps_found); ++ } + kfree(pvd); + } + kfree(n); +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 9628fa131757..8116cb2fef2d 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -2113,6 +2113,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + deto = 20; + } + ++ /* Make dito, mdat, deto bits to 0s */ ++ devslp &= ~GENMASK_ULL(24, 2); + devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) | + (mdat << PORT_DEVSLP_MDAT_OFFSET) | + (deto << PORT_DEVSLP_DETO_OFFSET) | +diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig +index ec6af1595062..4685bd10c473 100644 +--- a/drivers/bluetooth/Kconfig ++++ b/drivers/bluetooth/Kconfig +@@ -125,6 +125,7 @@ config BT_HCIUART_LL + config BT_HCIUART_3WIRE + bool "Three-wire UART (H5) protocol support" + depends on BT_HCIUART ++ depends on BT_HCIUART_SERDEV + help + The HCI Three-wire UART Transport Layer makes it possible to + user the Bluetooth HCI over a serial port interface. The HCI +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 9506e8693c81..d8ef1147b344 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -111,24 +111,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_encrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->enc_key, walk.iv, 1); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +@@ -152,24 +151,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, + ret = crypto_blkcipher_decrypt(&fallback_desc, dst, src, + nbytes); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_altivec(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); ++ enable_kernel_altivec(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->dec_key, walk.iv, 0); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c +index 5536108aa9db..fe21734bbe5c 100644 +--- a/drivers/gpio/gpio-ml-ioh.c ++++ b/drivers/gpio/gpio-ml-ioh.c +@@ -495,9 +495,10 @@ err_irq_alloc_descs: + + chip = chip_save; + err_gpiochip_add: ++ chip = chip_save; + while (--i >= 0) { +- chip--; + gpiochip_remove(&chip->gpio); ++ chip++; + } + kfree(chip_save); + +diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c +index 896bf29776b0..fb2c1df4f588 100644 +--- a/drivers/gpio/gpio-tegra.c ++++ b/drivers/gpio/gpio-tegra.c +@@ -591,4 +591,4 @@ static int __init tegra_gpio_init(void) + { + return platform_driver_register(&tegra_gpio_driver); + } +-postcore_initcall(tegra_gpio_init); ++subsys_initcall(tegra_gpio_init); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 85f39cc3e276..47581c32b1e1 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -128,6 +128,7 @@ + + #define SBREG_BAR 0x10 + #define SBREG_SMBCTRL 0xc6000c ++#define SBREG_SMBCTRL_DNV 0xcf000c + + /* Host status bits for SMBPCISTS */ + #define SMBPCISTS_INTS 0x08 +@@ -1251,7 +1252,11 @@ static void i801_add_tco(struct i801_priv *priv) + spin_unlock(&p2sb_spinlock); + + res = &tco_res[ICH_RES_MEM_OFF]; +- res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS) ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV; ++ else ++ res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL; ++ + res->end = res->start + 3; + res->flags = IORESOURCE_MEM; + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 0b20449e48cf..da9acec1a029 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -533,6 +533,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + { + u8 rx_watermark; + struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg; ++ unsigned long flags; + + /* Clear and enable Rx full interrupt. */ + xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK); +@@ -548,6 +549,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + rx_watermark = IIC_RX_FIFO_DEPTH; + xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1); + ++ local_irq_save(flags); + if (!(msg->flags & I2C_M_NOSTART)) + /* write the address */ + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, +@@ -558,6 +560,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c) + + xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, + msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0)); ++ local_irq_restore(flags); ++ + if (i2c->nmsgs == 1) + /* very last, enable bus not busy as well */ + xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index d57a78ec7425..0f42411d6a79 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1280,9 +1280,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id, + (addr->src_addr.ss_family == AF_IB || + cma_protocol_roce_dev_port(id->device, port_num)); + +- return !addr->dev_addr.bound_dev_if || +- (net_eq(dev_net(net_dev), addr->dev_addr.net) && +- addr->dev_addr.bound_dev_if == net_dev->ifindex); ++ /* ++ * Net namespaces must match, and if the listner is listening ++ * on a specific netdevice than netdevice must match as well. ++ */ ++ if (net_eq(dev_net(net_dev), addr->dev_addr.net) && ++ (!!addr->dev_addr.bound_dev_if == ++ (addr->dev_addr.bound_dev_if == net_dev->ifindex))) ++ return true; ++ else ++ return false; + } + + static struct rdma_id_private *cma_find_listener( +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 88dfe3008cf4..be2f2521c1c5 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -1593,10 +1593,11 @@ static int mxt_get_object_table(struct mxt_data *data) + break; + case MXT_TOUCH_MULTI_T9: + data->multitouch = MXT_TOUCH_MULTI_T9; ++ /* Only handle messages from first T9 instance */ + data->T9_reportid_min = min_id; +- data->T9_reportid_max = max_id; +- data->num_touchids = object->num_report_ids +- * mxt_obj_instances(object); ++ data->T9_reportid_max = min_id + ++ object->num_report_ids - 1; ++ data->num_touchids = object->num_report_ids; + break; + case MXT_SPT_MESSAGECOUNT_T44: + data->T44_address = object->start_address; +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index dfb868e2d129..624e7ff76166 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain { + struct io_pgtable_ops *iop; + + unsigned int context_id; +- spinlock_t lock; /* Protects mappings */ ++ struct mutex mutex; /* Protects mappings */ + }; + + struct ipmmu_vmsa_archdata { +@@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type) + if (!domain) + return NULL; + +- spin_lock_init(&domain->lock); ++ mutex_init(&domain->mutex); + + return &domain->io_domain; + } +@@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu; + struct ipmmu_vmsa_device *mmu = archdata->mmu; + struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain); +- unsigned long flags; + unsigned int i; + int ret = 0; + +@@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + return -ENXIO; + } + +- spin_lock_irqsave(&domain->lock, flags); ++ mutex_lock(&domain->mutex); + + if (!domain->mmu) { + /* The domain hasn't been used yet, initialize it. */ +@@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain, + ret = -EINVAL; + } + +- spin_unlock_irqrestore(&domain->lock, flags); ++ mutex_unlock(&domain->mutex); + + if (ret < 0) + return ret; +diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c +index f9512bfa6c3c..0a41132ffba7 100644 +--- a/drivers/macintosh/via-pmu.c ++++ b/drivers/macintosh/via-pmu.c +@@ -530,8 +530,9 @@ init_pmu(void) + int timeout; + struct adb_request req; + +- out_8(&via[B], via[B] | TREQ); /* negate TREQ */ +- out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */ ++ /* Negate TREQ. Set TACK to input and TREQ to output. */ ++ out_8(&via[B], in_8(&via[B]) | TREQ); ++ out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK); + + pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask); + timeout = 100000; +@@ -1453,8 +1454,8 @@ pmu_sr_intr(void) + struct adb_request *req; + int bite = 0; + +- if (via[B] & TREQ) { +- printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]); ++ if (in_8(&via[B]) & TREQ) { ++ printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B])); + out_8(&via[IFR], SR_INT); + return NULL; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d59b861764a1..0841d8f10a58 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -4190,6 +4190,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s) + s->failed++; + if (rdev && !test_bit(Faulty, &rdev->flags)) + do_recovery = 1; ++ else if (!rdev) { ++ rdev = rcu_dereference( ++ conf->disks[i].replacement); ++ if (rdev && !test_bit(Faulty, &rdev->flags)) ++ do_recovery = 1; ++ } + } + } + if (test_bit(STRIPE_SYNCING, &sh->state)) { +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index e4e4b22eebc9..4a0f076c91ba 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -224,14 +224,13 @@ static int ti_tscadc_probe(struct platform_device *pdev) + * The TSC_ADC_SS controller design assumes the OCP clock is + * at least 6x faster than the ADC clock. + */ +- clk = clk_get(&pdev->dev, "adc_tsc_fck"); ++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "failed to get TSC fck\n"); + err = PTR_ERR(clk); + goto err_disable_clk; + } + clock_rate = clk_get_rate(clk); +- clk_put(clk); + tscadc->clk_div = clock_rate / ADC_CLK; + + /* TSCADC_CLKDIV needs to be configured to the value minus 1 */ +diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c +index ddc9e4b08b5c..56efa9d18a9a 100644 +--- a/drivers/misc/mic/scif/scif_api.c ++++ b/drivers/misc/mic/scif/scif_api.c +@@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn) + goto scif_bind_exit; + } + } else { +- pn = scif_get_new_port(); +- if (!pn) { +- ret = -ENOSPC; ++ ret = scif_get_new_port(); ++ if (ret < 0) + goto scif_bind_exit; +- } ++ pn = ret; + } + + ep->state = SCIFEP_BOUND; +@@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block) + err = -EISCONN; + break; + case SCIFEP_UNBOUND: +- ep->port.port = scif_get_new_port(); +- if (!ep->port.port) { +- err = -ENOSPC; +- } else { +- ep->port.node = scif_info.nodeid; +- ep->conn_async_state = ASYNC_CONN_IDLE; +- } ++ err = scif_get_new_port(); ++ if (err < 0) ++ break; ++ ep->port.port = err; ++ ep->port.node = scif_info.nodeid; ++ ep->conn_async_state = ASYNC_CONN_IDLE; + /* Fall through */ + case SCIFEP_BOUND: + /* +diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c +index 71b64550b591..a1bca836e506 100644 +--- a/drivers/misc/ti-st/st_kim.c ++++ b/drivers/misc/ti-st/st_kim.c +@@ -757,14 +757,14 @@ static int kim_probe(struct platform_device *pdev) + err = gpio_request(kim_gdata->nshutdown, "kim"); + if (unlikely(err)) { + pr_err(" gpio %d request failed ", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + + /* Configure nShutdown GPIO as output=0 */ + err = gpio_direction_output(kim_gdata->nshutdown, 0); + if (unlikely(err)) { + pr_err(" unable to configure gpio %d", kim_gdata->nshutdown); +- return err; ++ goto err_sysfs_group; + } + /* get reference of pdev for request_firmware + */ +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 518e2dec2aa2..5e9122cd3898 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + + MODULE_AUTHOR("VMware, Inc."); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index b3c1b8106a68..f4b3ce2b2bc3 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1597,8 +1597,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +@@ -1617,8 +1619,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai) + cond_resched(); + + e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL); +- if (!e) ++ if (!e) { ++ err = -ENOMEM; + goto out_free; ++ } + + e->pnum = aeb->pnum; + e->ec = aeb->ec; +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index ea693bbf56d8..1c300259d70a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2569,7 +2569,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + } + + mvneta_start_dev(pp); +- mvneta_port_up(pp); + + netdev_update_features(dev); + +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c69b0bdd891d..c2e110b2549b 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -371,7 +371,6 @@ struct cpsw_priv { + spinlock_t lock; + struct platform_device *pdev; + struct net_device *ndev; +- struct device_node *phy_node; + struct napi_struct napi_rx; + struct napi_struct napi_tx; + struct device *dev; +@@ -1165,8 +1164,8 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (priv->phy_node) +- slave->phy = of_phy_connect(priv->ndev, priv->phy_node, ++ if (slave->data->phy_node) ++ slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); + else + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, +@@ -1957,12 +1956,11 @@ static void cpsw_slave_init(struct cpsw_slave *slave, struct cpsw_priv *priv, + slave->port_vlan = data->dual_emac_res_vlan; + } + +-static int cpsw_probe_dt(struct cpsw_priv *priv, ++static int cpsw_probe_dt(struct cpsw_platform_data *data, + struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; + struct device_node *slave_node; +- struct cpsw_platform_data *data = &priv->data; + int i = 0, ret; + u32 prop; + +@@ -2050,7 +2048,8 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + if (strcmp(slave_node->name, "slave")) + continue; + +- priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0); ++ slave_data->phy_node = of_parse_phandle(slave_node, ++ "phy-handle", 0); + parp = of_get_property(slave_node, "phy_id", &lenp); + if (of_phy_is_fixed_link(slave_node)) { + struct device_node *phy_node; +@@ -2087,6 +2086,7 @@ static int cpsw_probe_dt(struct cpsw_priv *priv, + } + snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), + PHY_ID_FMT, mdio->name, phyid); ++ put_device(&mdio->dev); + } else { + dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i); + goto no_phy_slave; +@@ -2291,7 +2291,7 @@ static int cpsw_probe(struct platform_device *pdev) + /* Select default pin state */ + pinctrl_pm_select_default_state(&pdev->dev); + +- if (cpsw_probe_dt(priv, pdev)) { ++ if (cpsw_probe_dt(&priv->data, pdev)) { + dev_err(&pdev->dev, "cpsw: platform data missing\n"); + ret = -ENODEV; + goto clean_runtime_disable_ret; +diff --git a/drivers/net/ethernet/ti/cpsw.h b/drivers/net/ethernet/ti/cpsw.h +index 442a7038e660..e50afd1b2eda 100644 +--- a/drivers/net/ethernet/ti/cpsw.h ++++ b/drivers/net/ethernet/ti/cpsw.h +@@ -18,6 +18,7 @@ + #include + + struct cpsw_slave_data { ++ struct device_node *phy_node; + char phy_id[MII_BUS_ID_SIZE]; + int phy_if; + u8 mac_addr[ETH_ALEN]; +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 6be315303d61..8ecb24186b7f 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -2108,6 +2108,7 @@ static int davinci_emac_remove(struct platform_device *pdev) + cpdma_ctlr_destroy(priv->dma); + + unregister_netdev(ndev); ++ of_node_put(priv->phy_node); + free_netdev(ndev); + + return 0; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 916b9b12edd2..4644357d291a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2901,6 +2901,13 @@ static int ath10k_update_channel_list(struct ath10k *ar) + passive = channel->flags & IEEE80211_CHAN_NO_IR; + ch->passive = passive; + ++ /* the firmware is ignoring the "radar" flag of the ++ * channel and is scanning actively using Probe Requests ++ * on "Radar detection"/DFS channels which are not ++ * marked as "available" ++ */ ++ ch->passive |= ch->chan_radar; ++ + ch->freq = channel->center_freq; + ch->band_center_freq1 = channel->center_freq; + ch->min_power = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 02eea3c3b5d3..c72eb4464de9 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1424,6 +1424,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) + cfg->keep_alive_pattern_size = __cpu_to_le32(0); + cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1); + cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1); ++ cfg->wmi_send_separate = __cpu_to_le32(0); ++ cfg->num_ocb_vdevs = __cpu_to_le32(0); ++ cfg->num_ocb_channels = __cpu_to_le32(0); ++ cfg->num_ocb_schedules = __cpu_to_le32(0); ++ cfg->host_capab = __cpu_to_le32(0); + + ath10k_wmi_put_host_mem_chunks(ar, chunks); + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +index ad655c44afdb..f5031f3965c5 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h +@@ -1209,6 +1209,11 @@ struct wmi_tlv_resource_config { + __le32 keep_alive_pattern_size; + __le32 max_tdls_concurrent_sleep_sta; + __le32 max_tdls_concurrent_buffer_sta; ++ __le32 wmi_send_separate; ++ __le32 num_ocb_vdevs; ++ __le32 num_ocb_channels; ++ __le32 num_ocb_schedules; ++ __le32 host_capab; + } __packed; + + struct wmi_tlv_init_cmd { +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 5466246c69b4..b78a2f3745f2 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twa_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = ioremap(mem_addr, mem_len); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + TW_DISABLE_INTERRUPTS(tw_dev); + + /* Initialize the card */ +- if (twa_reset_sequence(tw_dev, 0)) ++ if (twa_reset_sequence(tw_dev, 0)) { ++ retval = -ENOMEM; + goto out_iounmap; ++ } + + /* Set host specific parameters */ + if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) || +diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c +index f8374850f714..f0a5536a9ff5 100644 +--- a/drivers/scsi/3w-sas.c ++++ b/drivers/scsi/3w-sas.c +@@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (twl_initialize_device_extension(tw_dev)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension"); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_iomap(pdev, 1, 0); + if (!tw_dev->base_addr) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap"); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +@@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + /* Initialize the card */ + if (twl_reset_sequence(tw_dev, 0)) { + TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe"); ++ retval = -ENOMEM; + goto out_iounmap; + } + +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 14af38036287..308a4206b636 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -2278,6 +2278,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + + if (tw_initialize_device_extension(tw_dev)) { + printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension."); ++ retval = -ENOMEM; + goto out_free_device_extension; + } + +@@ -2292,6 +2293,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id) + tw_dev->base_addr = pci_resource_start(pdev, 0); + if (!tw_dev->base_addr) { + printk(KERN_WARNING "3w-xxxx: Failed to get io address."); ++ retval = -ENOMEM; + goto out_release_mem_region; + } + +diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c +index 12a3893b98fd..ade29c4295b7 100644 +--- a/drivers/staging/rts5208/rtsx_scsi.c ++++ b/drivers/staging/rts5208/rtsx_scsi.c +@@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip) + + if (sendbytes > 8) { + memcpy(buf, inquiry_buf, 8); +- memcpy(buf + 8, inquiry_string, sendbytes - 8); ++ strncpy(buf + 8, inquiry_string, sendbytes - 8); + if (pro_formatter_flag) { + /* Additional Length */ + buf[4] = 0x33; +diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c +index 10fea7bb8f30..3db4a2570b19 100644 +--- a/drivers/staging/rts5208/xd.c ++++ b/drivers/staging/rts5208/xd.c +@@ -1252,7 +1252,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk, + reg = 0; + rtsx_read_register(chip, XD_CTL, ®); + if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) { +- wait_timeout(100); ++ mdelay(100); + + if (detect_card_cd(chip, + XD_CARD) != STATUS_SUCCESS) { +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 21f888ac550e..7199bac67333 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -306,6 +306,7 @@ void __transport_register_session( + { + const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo; + unsigned char buf[PR_REG_ISID_LEN]; ++ unsigned long flags; + + se_sess->se_tpg = se_tpg; + se_sess->fabric_sess_ptr = fabric_sess_ptr; +@@ -342,7 +343,7 @@ void __transport_register_session( + se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); + } + +- spin_lock_irq(&se_nacl->nacl_sess_lock); ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); + /* + * The se_nacl->nacl_sess pointer will be set to the + * last active I_T Nexus for each struct se_node_acl. +@@ -351,7 +352,7 @@ void __transport_register_session( + + list_add_tail(&se_sess->sess_acl_list, + &se_nacl->acl_sess_list); +- spin_unlock_irq(&se_nacl->nacl_sess_lock); ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + } + list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list); + +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 802eac7e561b..2b8f2e0a4224 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -1915,7 +1915,7 @@ static __init int register_PCI(int i, struct pci_dev *dev) + ByteIO_t UPCIRingInd = 0; + + if (!dev || !pci_match_id(rocket_pci_ids, dev) || +- pci_enable_device(dev)) ++ pci_enable_device(dev) || i >= NUM_BOARDS) + return 0; + + rcktpt_io_addr[i] = pci_resource_start(dev, 0); +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index bcc1fc027311..b9823eb9c195 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -833,8 +833,6 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_uio_dev_add_attributes; + +- info->uio_dev = idev; +- + if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) { + /* + * Note that we deliberately don't use devm_request_irq +@@ -850,6 +848,7 @@ int __uio_register_device(struct module *owner, + goto err_request_irq; + } + ++ info->uio_dev = idev; + return 0; + + err_request_irq: +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 128a3c0a9286..9dbf1583bd7a 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3675,6 +3675,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + } + + spin_lock_irqsave(&xhci->lock, flags); ++ ++ virt_dev->udev = NULL; ++ + /* Don't disable the slot if the host controller is dead. */ + state = readl(&xhci->op_regs->status); + if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) || +diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h +index 502d3892d8a4..d71e7ad4d382 100644 +--- a/fs/autofs4/autofs_i.h ++++ b/fs/autofs4/autofs_i.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + /* This is the range of ioctl() numbers we claim as ours */ + #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY +@@ -135,7 +136,8 @@ struct autofs_sb_info { + + static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb) + { +- return (struct autofs_sb_info *)(sb->s_fs_info); ++ return sb->s_magic != AUTOFS_SUPER_MAGIC ? ++ NULL : (struct autofs_sb_info *)(sb->s_fs_info); + } + + static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry) +diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c +index a3ae0b2aeb5a..1132fe71b312 100644 +--- a/fs/autofs4/inode.c ++++ b/fs/autofs4/inode.c +@@ -18,7 +18,6 @@ + #include + #include + #include +-#include + #include "autofs_i.h" + #include + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index ee44d346ea44..bfa1d31f79aa 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -381,6 +381,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + if (test_and_clear_bit(segno, free_i->free_segmap)) { + free_i->free_segments++; + ++ if (IS_CURSEC(sbi, secno)) ++ goto skip_free; + next = find_next_bit(free_i->free_segmap, + start_segno + sbi->segs_per_sec, start_segno); + if (next >= start_segno + sbi->segs_per_sec) { +@@ -388,6 +390,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi, + free_i->free_sections++; + } + } ++skip_free: + spin_unlock(&free_i->segmap_lock); + } + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 6cc67e1bbb41..2ffc53d0c9c7 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1079,12 +1079,17 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); + struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); + unsigned int main_segs, blocks_per_seg; ++ unsigned int sit_segs, nat_segs; ++ unsigned int sit_bitmap_size, nat_bitmap_size; ++ unsigned int log_blocks_per_seg; + int i; + + total = le32_to_cpu(raw_super->segment_count); + fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); +- fsmeta += le32_to_cpu(raw_super->segment_count_sit); +- fsmeta += le32_to_cpu(raw_super->segment_count_nat); ++ sit_segs = le32_to_cpu(raw_super->segment_count_sit); ++ fsmeta += sit_segs; ++ nat_segs = le32_to_cpu(raw_super->segment_count_nat); ++ fsmeta += nat_segs; + fsmeta += le32_to_cpu(ckpt->rsvd_segment_count); + fsmeta += le32_to_cpu(raw_super->segment_count_ssa); + +@@ -1105,6 +1110,18 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) + return 1; + } + ++ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize); ++ nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize); ++ log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); ++ ++ if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 || ++ nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) { ++ f2fs_msg(sbi->sb, KERN_ERR, ++ "Wrong bitmap size: sit: %u, nat:%u", ++ sit_bitmap_size, nat_bitmap_size); ++ return 1; ++ } ++ + if (unlikely(f2fs_cp_error(sbi))) { + f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); + return 1; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index e2e857affbf2..0647cb1ede56 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -911,16 +911,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); +- if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) ++ if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + goto out_invalidcred; ++ } + } + + cps.minorversion = hdr_arg.minorversion; + hdr_res.taglen = hdr_arg.taglen; + hdr_res.tag = hdr_arg.tag; +- if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) ++ if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { ++ if (cps.clp) ++ nfs_put_client(cps.clp); + return rpc_system_err; +- ++ } + while (status == 0 && nops != hdr_arg.nops) { + status = process_op(nops, rqstp, &xdr_in, + argp, &xdr_out, resp, &cps); +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 36f4695aa604..ad2a081bac66 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -392,7 +392,7 @@ struct kioctx_table; + struct mm_struct { + struct vm_area_struct *mmap; /* list of VMAs */ + struct rb_root mm_rb; +- u32 vmacache_seqnum; /* per-thread vmacache */ ++ u64 vmacache_seqnum; /* per-thread vmacache */ + #ifdef CONFIG_MMU + unsigned long (*get_unmapped_area) (struct file *filp, + unsigned long addr, unsigned long len, +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 725498cc5d30..b30540d6d125 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1454,7 +1454,7 @@ struct task_struct { + + struct mm_struct *mm, *active_mm; + /* per-thread vma caching */ +- u32 vmacache_seqnum; ++ u64 vmacache_seqnum; + struct vm_area_struct *vmacache[VMACACHE_SIZE]; + #if defined(SPLIT_RSS_COUNTING) + struct task_rss_stat rss_stat; +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 8ef3a61fdc74..fdac5800872d 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -88,7 +88,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #ifdef CONFIG_DEBUG_VM_VMACACHE + VMACACHE_FIND_CALLS, + VMACACHE_FIND_HITS, +- VMACACHE_FULL_FLUSHES, + #endif + NR_VM_EVENT_ITEMS + }; +diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h +index c3fa0fd43949..4f58ff2dacd6 100644 +--- a/include/linux/vmacache.h ++++ b/include/linux/vmacache.h +@@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk) + memset(tsk->vmacache, 0, sizeof(tsk->vmacache)); + } + +-extern void vmacache_flush_all(struct mm_struct *mm); + extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma); + extern struct vm_area_struct *vmacache_find(struct mm_struct *mm, + unsigned long addr); +@@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm, + static inline void vmacache_invalidate(struct mm_struct *mm) + { + mm->vmacache_seqnum++; +- +- /* deal with overflows */ +- if (unlikely(mm->vmacache_seqnum == 0)) +- vmacache_flush_all(mm); + } + + #endif /* __LINUX_VMACACHE_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index cd1629170103..08f47e0e9f8d 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -819,13 +819,13 @@ struct ethtool_rx_flow_spec { + static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie) + { + return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie; +-}; ++} + + static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie) + { + return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >> + ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF; +-}; ++} + + /** + * struct ethtool_rxnfc - command to get or set RX flow classification rules +diff --git a/kernel/fork.c b/kernel/fork.c +index 37ec96fe739d..dd2f79ac0771 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1337,6 +1337,18 @@ static struct task_struct *copy_process(unsigned long clone_flags, + if (!p) + goto fork_out; + ++ /* ++ * This _must_ happen before we call free_task(), i.e. before we jump ++ * to any of the bad_fork_* labels. This is to avoid freeing ++ * p->set_child_tid which is (ab)used as a kthread's data pointer for ++ * kernel threads (PF_KTHREAD). ++ */ ++ p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; ++ /* ++ * Clear TID on mm_release()? ++ */ ++ p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; ++ + ftrace_graph_init_task(p); + + rt_mutex_init_task(p); +@@ -1498,11 +1510,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, + } + } + +- p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; +- /* +- * Clear TID on mm_release()? +- */ +- p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL; + #ifdef CONFIG_BLOCK + p->plug = NULL; + #endif +diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c +index 05a37857ab55..8d7047ecef4e 100644 +--- a/kernel/locking/osq_lock.c ++++ b/kernel/locking/osq_lock.c +@@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock) + + prev = decode_cpu(old); + node->prev = prev; ++ ++ /* ++ * osq_lock() unqueue ++ * ++ * node->prev = prev osq_wait_next() ++ * WMB MB ++ * prev->next = node next->prev = prev // unqueue-C ++ * ++ * Here 'node->prev' and 'next->prev' are the same variable and we need ++ * to ensure these stores happen in-order to avoid corrupting the list. ++ */ ++ smp_wmb(); ++ + WRITE_ONCE(prev->next, node); + + /* +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index a4d4de05b2d1..1be33caf157d 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -510,6 +510,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem) + { + unsigned long flags; + ++ /* ++ * __rwsem_down_write_failed_common(sem) ++ * rwsem_optimistic_spin(sem) ++ * osq_unlock(sem->osq) ++ * ... ++ * atomic_long_add_return(&sem->count) ++ * ++ * - VS - ++ * ++ * __up_write() ++ * if (atomic_long_sub_return_release(&sem->count) < 0) ++ * rwsem_wake(sem) ++ * osq_is_locked(&sem->osq) ++ * ++ * And __up_write() must observe !osq_is_locked() when it observes the ++ * atomic_long_add_return() in order to not miss a wakeup. ++ * ++ * This boils down to: ++ * ++ * [S.rel] X = 1 [RmW] r0 = (Y += 0) ++ * MB RMB ++ * [RmW] Y += 1 [L] r1 = X ++ * ++ * exists (r0=1 /\ r1=0) ++ */ ++ smp_rmb(); ++ + /* + * If a spinner is present, it is not necessary to do the wakeup. + * Try to do wakeup only if the trylock succeeds to minimize +diff --git a/mm/debug.c b/mm/debug.c +index 668aa35191ca..689b6e911cae 100644 +--- a/mm/debug.c ++++ b/mm/debug.c +@@ -168,7 +168,7 @@ EXPORT_SYMBOL(dump_vma); + + void dump_mm(const struct mm_struct *mm) + { +- pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n" ++ pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n" + #ifdef CONFIG_MMU + "get_unmapped_area %p\n" + #endif +@@ -198,7 +198,7 @@ void dump_mm(const struct mm_struct *mm) + #endif + "%s", /* This is here to hold the comma */ + +- mm, mm->mmap, mm->vmacache_seqnum, mm->task_size, ++ mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size, + #ifdef CONFIG_MMU + mm->get_unmapped_area, + #endif +diff --git a/mm/vmacache.c b/mm/vmacache.c +index fd09dc9c6812..9c8ff3d4eda9 100644 +--- a/mm/vmacache.c ++++ b/mm/vmacache.c +@@ -5,44 +5,6 @@ + #include + #include + +-/* +- * Flush vma caches for threads that share a given mm. +- * +- * The operation is safe because the caller holds the mmap_sem +- * exclusively and other threads accessing the vma cache will +- * have mmap_sem held at least for read, so no extra locking +- * is required to maintain the vma cache. +- */ +-void vmacache_flush_all(struct mm_struct *mm) +-{ +- struct task_struct *g, *p; +- +- count_vm_vmacache_event(VMACACHE_FULL_FLUSHES); +- +- /* +- * Single threaded tasks need not iterate the entire +- * list of process. We can avoid the flushing as well +- * since the mm's seqnum was increased and don't have +- * to worry about other threads' seqnum. Current's +- * flush will occur upon the next lookup. +- */ +- if (atomic_read(&mm->mm_users) == 1) +- return; +- +- rcu_read_lock(); +- for_each_process_thread(g, p) { +- /* +- * Only flush the vmacache pointers as the +- * mm seqnum is already set and curr's will +- * be set upon invalidation when the next +- * lookup is done. +- */ +- if (mm == p->mm) +- vmacache_flush(p); +- } +- rcu_read_unlock(); +-} +- + /* + * This task may be accessing a foreign mm via (for example) + * get_user_pages()->find_vma(). The vmacache is task-local and this +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 1811f8e7ddf4..552e00b07196 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session, + hid->version = req->version; + hid->country = req->country; + +- strncpy(hid->name, req->name, sizeof(req->name) - 1); ++ strncpy(hid->name, req->name, sizeof(hid->name)); + + snprintf(hid->phys, sizeof(hid->phys), "%pMR", + &l2cap_pi(session->ctrl_sock->sk)->chan->src); +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 4f6c1862dfd2..6fe2b615518c 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1763,7 +1763,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app, + if (itr->app.selector == app->selector && + itr->app.protocol == app->protocol && + itr->ifindex == ifindex && +- (!prio || itr->app.priority == prio)) ++ ((prio == -1) || itr->app.priority == prio)) + return itr; + } + +@@ -1798,7 +1798,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio = itr->app.priority; + spin_unlock_bh(&dcb_lock); + +@@ -1826,7 +1827,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new) + + spin_lock_bh(&dcb_lock); + /* Search for existing match and replace */ +- if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) { ++ itr = dcb_app_lookup(new, dev->ifindex, -1); ++ if (itr) { + if (new->priority) + itr->app.priority = new->priority; + else { +@@ -1859,7 +1861,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app) + u8 prio = 0; + + spin_lock_bh(&dcb_lock); +- if ((itr = dcb_app_lookup(app, dev->ifindex, 0))) ++ itr = dcb_app_lookup(app, dev->ifindex, -1); ++ if (itr) + prio |= 1 << itr->app.priority; + spin_unlock_bh(&dcb_lock); + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 1f3c305df45d..b6e72af15237 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -876,7 +876,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) + return ERR_PTR(-EFAULT); + +- strlcpy(info->name, compat_tmp.name, sizeof(info->name)); ++ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); + info->num_counters = compat_tmp.num_counters; + user += sizeof(compat_tmp); + } else +@@ -889,9 +889,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + if (copy_from_user(info, user, sizeof(*info)) != 0) + return ERR_PTR(-EFAULT); + +- info->name[sizeof(info->name) - 1] = '\0'; + user += sizeof(*info); + } ++ info->name[sizeof(info->name) - 1] = '\0'; + + size = sizeof(struct xt_counters); + size *= info->num_counters; +diff --git a/security/selinux/avc.c b/security/selinux/avc.c +index e60c79de13e1..52f3c550abcc 100644 +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -348,27 +348,26 @@ static struct avc_xperms_decision_node + struct avc_xperms_decision_node *xpd_node; + struct extended_perms_decision *xpd; + +- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); + if (!xpd_node) + return NULL; + + xpd = &xpd_node->xpd; + if (which & XPERMS_ALLOWED) { + xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->allowed) + goto error; + } + if (which & XPERMS_AUDITALLOW) { + xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->auditallow) + goto error; + } + if (which & XPERMS_DONTAUDIT) { + xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, +- GFP_ATOMIC | __GFP_NOMEMALLOC); ++ GFP_NOWAIT); + if (!xpd->dontaudit) + goto error; + } +@@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) + { + struct avc_xperms_node *xp_node; + +- xp_node = kmem_cache_zalloc(avc_xperms_cachep, +- GFP_ATOMIC|__GFP_NOMEMALLOC); ++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); + if (!xp_node) + return xp_node; + INIT_LIST_HEAD(&xp_node->xpd_head); +@@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void) + { + struct avc_node *node; + +- node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC); ++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); + if (!node) + goto out; + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 3324f98c35f6..f6d4a1046e54 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -4019,7 +4019,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus) + + list_for_each_codec(codec, bus) { + /* FIXME: maybe a better way needed for forced reset */ +- cancel_delayed_work_sync(&codec->jackpoll_work); ++ if (current_work() != &codec->jackpoll_work.work) ++ cancel_delayed_work_sync(&codec->jackpoll_work); + #ifdef CONFIG_PM + if (hda_codec_is_power_on(codec)) { + hda_call_codec_suspend(codec); +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 90129accffbe..4341ed267d4e 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -29,7 +29,9 @@ static inline unsigned long long rdclock(void) + return ts.tv_sec * 1000000000ULL + ts.tv_nsec; + } + ++#ifndef MAX_NR_CPUS + #define MAX_NR_CPUS 1024 ++#endif + + extern const char *input_name; + extern bool perf_host, perf_guest; diff --git a/patch/kernel/rockchip64-default/04-patch-4.4.157-158.patch b/patch/kernel/rockchip64-default/04-patch-4.4.157-158.patch new file mode 100644 index 000000000..67b7dbbf2 --- /dev/null +++ b/patch/kernel/rockchip64-default/04-patch-4.4.157-158.patch @@ -0,0 +1,1693 @@ +diff --git a/Makefile b/Makefile +index 2d55f88e6a08..d07a6283b67e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 157 ++SUBLEVEL = 158 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index c169cc3049aa..e8adb428dddb 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -260,6 +260,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 6b8abbe68746..3011c88bd2f3 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -105,7 +105,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index 8755d618e116..961c393c0f55 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -44,6 +44,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 4eee221b0cf0..d2be8e4f7a35 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -133,6 +133,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 5649a9e429e0..aca06b18c43e 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -14,12 +14,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + + #include ++#include + #include + + /* Kernel-provided data used by the VDSO. */ +@@ -118,12 +120,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index e48826aa314c..b40606051efe 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -371,7 +371,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 01718d05e952..9e8f0e255de2 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index f68c24a98277..dedfc96acc66 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1363,7 +1363,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1379,7 +1379,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 8db791ef2027..95619ee33112 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2132,13 +2132,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 98ab08c0aa2d..07541c5670e6 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -30,7 +30,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_ACPI + void acpi_gpiochip_add(struct gpio_chip *chip); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index eb1da83c9902..8cdd505784ed 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index e7e581d6a8ff..1bfc4807ce5b 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 22e10b7d505d..fe3a2b19a5db 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 93738dfbf631..902ee6efd09c 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -86,7 +86,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev) +@@ -107,7 +107,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev) + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev) +@@ -155,6 +155,9 @@ static int coresight_enable_link(struct coresight_device *csdev) + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 0f42411d6a79..1454290078de 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -544,6 +544,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -567,18 +568,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index f74b11542603..a338e60836ee 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -992,12 +992,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 347aaaa5a7ea..fc6eb752ab35 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1219,6 +1219,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 0c1a42bf27fd..1c37d5a78822 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1366,6 +1366,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index 90520d76633f..9cde4c5bfba4 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index bdc7fcd80eca..9dcdc6f41ceb 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 6d19835b80a9..0d244dac1ccb 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index c2e110b2549b..c1217a87d535 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1164,25 +1164,34 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv) + cpsw_ale_add_mcast(priv->ale, priv->ndev->broadcast, + 1 << slave_port, 0, 0, ALE_MCAST_FWD_2); + +- if (slave->data->phy_node) ++ if (slave->data->phy_node) { + slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node, + &cpsw_adjust_link, 0, slave->data->phy_if); +- else ++ if (!slave->phy) { ++ dev_err(priv->dev, "phy \"%s\" not found on slave %d\n", ++ slave->data->phy_node->full_name, ++ slave->slave_num); ++ return; ++ } ++ } else { + slave->phy = phy_connect(priv->ndev, slave->data->phy_id, + &cpsw_adjust_link, slave->data->phy_if); +- if (IS_ERR(slave->phy)) { +- dev_err(priv->dev, "phy %s not found on slave %d\n", +- slave->data->phy_id, slave->slave_num); +- slave->phy = NULL; +- } else { +- dev_info(priv->dev, "phy found : id is : 0x%x\n", +- slave->phy->phy_id); +- phy_start(slave->phy); +- +- /* Configure GMII_SEL register */ +- cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, +- slave->slave_num); ++ if (IS_ERR(slave->phy)) { ++ dev_err(priv->dev, ++ "phy \"%s\" not found on slave %d, err %ld\n", ++ slave->data->phy_id, slave->slave_num, ++ PTR_ERR(slave->phy)); ++ slave->phy = NULL; ++ return; ++ } + } ++ ++ dev_info(priv->dev, "phy found : id is : 0x%x\n", slave->phy->phy_id); ++ ++ phy_start(slave->phy); ++ ++ /* Configure GMII_SEL register */ ++ cpsw_phy_sel(&priv->pdev->dev, slave->phy->interface, slave->slave_num); + } + + static inline void cpsw_add_default_vlan(struct cpsw_priv *priv) +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 68d0a5c9d437..3270b4333668 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -86,8 +86,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1336,11 +1335,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1608,6 +1607,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); +@@ -1615,8 +1615,9 @@ static int xennet_init_queue(struct netfront_queue *queue) + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2023,15 +2024,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2047,12 +2047,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2160,14 +2158,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 6c42ca14d2fd..4ea810cafaac 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index f774cb576ffa..1ff95b5a429d 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.23" + #define PROC_INTERFACE_VERSION 1 + ++#include + #include + #include + #include +@@ -1472,7 +1473,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index bd170cb3361c..5747a54cbd42 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 95c631125a20..09ac56317f1b 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3505,13 +3505,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index fa844b0ff847..7bcf0dae3a65 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -419,6 +419,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 61ea87917433..4380e4f600ab 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 40378487e023..a5e3e410db4e 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -529,8 +529,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 29adabdb305f..08cba309eb78 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1282,6 +1282,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1317,6 +1322,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 99f67764765f..37a5e07b3488 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index a47de8c31ce9..8efeadf30b4d 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1542,11 +1542,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2425,8 +2428,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3272,6 +3278,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3312,12 +3320,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3336,6 +3346,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3346,6 +3357,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 692ccc69345e..d5434e7a3b2e 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2565,7 +2565,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 442b6631162e..3d750671b85a 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -388,7 +388,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -398,7 +398,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 512c84adcace..e8e8702d5adf 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -439,13 +439,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -464,6 +464,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index 1bd67b24f916..bc9ff5ebd67c 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -178,7 +178,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h +index 98f35c656c02..0cd247f75b8b 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -227,7 +227,7 @@ struct ti_interrupt { + } __attribute__((packed)); + + /* Interrupt codes */ +-#define TI_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TI_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TI_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TI_CODE_HARDWARE_ERROR 0xFF + #define TI_CODE_DATA_ERROR 0x03 +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index dba51362d2e2..6c186b4df94a 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -341,6 +341,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 1a34d2a89de6..898215cad351 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2213,6 +2213,13 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* Reported-by: Tim Anderson */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Nick Bowler + * SCSI stack spams (otherwise harmless) error messages. +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * x[M][R][-][@][i][m] or ++ * x[M][R][-][@][i][p][m] or + * [-][@] + * + * with , , and decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 7f6c9e6cfc6c..14a93cb21310 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 393ae1bc07e8..a8a6f072fb78 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -977,7 +977,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index badee04ef496..71b5dca95bdb 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include + #include + #include + #include +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index f44e93d2650d..62bc72001fce 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index 97d1a15873c5..57b039ebfb1f 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -373,8 +373,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 52d79fb04115..f7111bb88ec1 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2402,33 +2402,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 61296ecbd0e2..09476bb8f6cd 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1476,7 +1476,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 27300533c2dd..bd21795ce657 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -378,7 +378,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -397,6 +402,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -417,7 +427,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -464,7 +474,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index a162661c9d60..f45a9a5d3e47 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 00a8cc572a22..1f930032253a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -286,7 +286,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 4a72c0d1e56f..91a4e606edcd 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -647,11 +647,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -679,14 +683,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -874,7 +878,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -884,7 +889,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index e9eecf6f0bff..48080f89ed25 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1845,7 +1845,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 31a981d6229d..5897fc3857a0 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -359,3 +359,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 4c145d6bccd4..5bc7ddf8fc70 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index a31ea6c22d19..2d7379dec1f0 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 69bf5cf1e91e..15cbe2565703 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 60a94b3e532e..177480066816 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index bd630c222e65..9a53f6e9ef43 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_addr_location(thread, PERF_RECORD_MISC_USER, + MAP__FUNCTION, ip, &al); +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index 30906bfd9c1b..0ab937a17ebb 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + }