diff --git a/config/kernel/linux-rockchip-default.config b/config/kernel/linux-rockchip-default.config index 967329542..f9ab64cea 100644 --- a/config/kernel/linux-rockchip-default.config +++ b/config/kernel/linux-rockchip-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.115 Kernel Configuration +# Linux/arm 4.4.119 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -1316,6 +1316,7 @@ CONFIG_RFKILL_LEDS=y # CONFIG_CEPH_LIB is not set # CONFIG_NFC is not set # CONFIG_LWTUNNEL is not set +CONFIG_DST_CACHE=y CONFIG_HAVE_BPF_JIT=y # @@ -1798,6 +1799,7 @@ CONFIG_ATH10K=m # CONFIG_ATH10K_TRACING is not set CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set +CONFIG_RTL8188EU=m # CONFIG_B43 is not set # CONFIG_B43LEGACY is not set # CONFIG_BRCMSMAC is not set @@ -1842,7 +1844,6 @@ CONFIG_WIFI_BUILD_MODULE=y # CONFIG_WIFI_LOAD_DRIVER_WHEN_KERNEL_BOOTUP is not set # CONFIG_AP6XXX is not set CONFIG_RTL_WIRELESS_SOLUTION=y -# CONFIG_RTL8188EU is not set # CONFIG_RTL8188FU is not set # CONFIG_RTL8189ES is not set # CONFIG_RTL8189FS is not set diff --git a/config/kernel/linux-rockchip-next.config b/config/kernel/linux-rockchip-next.config index 3ed036f3e..f4a3d788b 100644 --- a/config/kernel/linux-rockchip-next.config +++ b/config/kernel/linux-rockchip-next.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.14.15 Kernel Configuration +# Linux/arm 4.14.23 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -1902,6 +1902,8 @@ CONFIG_LIBERTAS_THINFIRM_USB=m CONFIG_MWIFIEX=y CONFIG_MWIFIEX_SDIO=y CONFIG_MWIFIEX_USB=m +CONFIG_RTL8812AU=m +CONFIG_RTL8814AU=m CONFIG_WLAN_VENDOR_MEDIATEK=y CONFIG_MT7601U=m CONFIG_WLAN_VENDOR_RALINK=y @@ -1948,8 +1950,6 @@ CONFIG_USB_ZD1201=m CONFIG_ZD1211RW=m # CONFIG_ZD1211RW_DEBUG is not set CONFIG_WLAN_VENDOR_QUANTENNA=y -CONFIG_RTL8812AU=m -CONFIG_RTL8814AU=m # CONFIG_MAC80211_HWSIM is not set CONFIG_USB_NET_RNDIS_WLAN=y @@ -5324,6 +5324,7 @@ CONFIG_CRYPTO_RNG_DEFAULT=y CONFIG_CRYPTO_AKCIPHER2=y CONFIG_CRYPTO_AKCIPHER=y CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_KPP=y CONFIG_CRYPTO_ACOMP2=y # CONFIG_CRYPTO_RSA is not set # CONFIG_CRYPTO_DH is not set diff --git a/patch/kernel/rockchip-default/04-patch-4.4.115-116.patch b/patch/kernel/rockchip-default/04-patch-4.4.115-116.patch new file mode 100644 index 000000000..7b8cc274d --- /dev/null +++ b/patch/kernel/rockchip-default/04-patch-4.4.115-116.patch @@ -0,0 +1,5309 @@ +diff --git a/Makefile b/Makefile +index 9c60120dd9fd..71acaecd7899 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 115 ++SUBLEVEL = 116 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/alpha/kernel/pci_impl.h b/arch/alpha/kernel/pci_impl.h +index 2b0ac429f5eb..412bb3c24f36 100644 +--- a/arch/alpha/kernel/pci_impl.h ++++ b/arch/alpha/kernel/pci_impl.h +@@ -143,7 +143,8 @@ struct pci_iommu_arena + }; + + #if defined(CONFIG_ALPHA_SRM) && \ +- (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA)) ++ (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA) || \ ++ defined(CONFIG_ALPHA_AVANTI)) + # define NEED_SRM_SAVE_RESTORE + #else + # undef NEED_SRM_SAVE_RESTORE +diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c +index 84d13263ce46..8095fb2c5c94 100644 +--- a/arch/alpha/kernel/process.c ++++ b/arch/alpha/kernel/process.c +@@ -273,12 +273,13 @@ copy_thread(unsigned long clone_flags, unsigned long usp, + application calling fork. */ + if (clone_flags & CLONE_SETTLS) + childti->pcb.unique = regs->r20; ++ else ++ regs->r20 = 0; /* OSF/1 has some strange fork() semantics. */ + childti->pcb.usp = usp ?: rdusp(); + *childregs = *regs; + childregs->r0 = 0; + childregs->r19 = 0; + childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */ +- regs->r20 = 0; + stack = ((struct switch_stack *) regs) - 1; + *childstack = *stack; + childstack->r26 = (unsigned long) ret_from_fork; +diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c +index f36b5b1acd1f..05b2f8294968 100644 +--- a/arch/arm/kvm/handle_exit.c ++++ b/arch/arm/kvm/handle_exit.c +@@ -45,7 +45,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) + + ret = kvm_psci_call(vcpu); + if (ret < 0) { +- kvm_inject_undefined(vcpu); ++ vcpu_set_reg(vcpu, 0, ~0UL); + return 1; + } + +@@ -54,7 +54,16 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) + + static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run) + { +- kvm_inject_undefined(vcpu); ++ /* ++ * "If an SMC instruction executed at Non-secure EL1 is ++ * trapped to EL2 because HCR_EL2.TSC is 1, the exception is a ++ * Trap exception, not a Secure Monitor Call exception [...]" ++ * ++ * We need to advance the PC after the trap, as it would ++ * otherwise return to the same address... ++ */ ++ vcpu_set_reg(vcpu, 0, ~0UL); ++ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); + return 1; + } + +diff --git a/arch/mn10300/mm/misalignment.c b/arch/mn10300/mm/misalignment.c +index b9920b1edd5a..70cef54dc40f 100644 +--- a/arch/mn10300/mm/misalignment.c ++++ b/arch/mn10300/mm/misalignment.c +@@ -437,7 +437,7 @@ transfer_failed: + + info.si_signo = SIGSEGV; + info.si_errno = 0; +- info.si_code = 0; ++ info.si_code = SEGV_MAPERR; + info.si_addr = (void *) regs->pc; + force_sig_info(SIGSEGV, &info, current); + return; +diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c +index 3d3f6062f49c..605a284922fb 100644 +--- a/arch/openrisc/kernel/traps.c ++++ b/arch/openrisc/kernel/traps.c +@@ -302,12 +302,12 @@ asmlinkage void do_unaligned_access(struct pt_regs *regs, unsigned long address) + siginfo_t info; + + if (user_mode(regs)) { +- /* Send a SIGSEGV */ +- info.si_signo = SIGSEGV; ++ /* Send a SIGBUS */ ++ info.si_signo = SIGBUS; + info.si_errno = 0; +- /* info.si_code has been set above */ +- info.si_addr = (void *)address; +- force_sig_info(SIGSEGV, &info, current); ++ info.si_code = BUS_ADRALN; ++ info.si_addr = (void __user *)address; ++ force_sig_info(SIGBUS, &info, current); + } else { + printk("KERNEL: Unaligned Access 0x%.8lx\n", address); + show_registers(regs); +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index dfb1ee8c3e06..58a1fa979655 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -129,13 +129,14 @@ config PPC + select IRQ_FORCED_THREADING + select HAVE_RCU_TABLE_FREE if SMP + select HAVE_SYSCALL_TRACEPOINTS +- select HAVE_BPF_JIT ++ select HAVE_BPF_JIT if CPU_BIG_ENDIAN + select HAVE_ARCH_JUMP_LABEL + select ARCH_HAVE_NMI_SAFE_CMPXCHG + select ARCH_HAS_GCOV_PROFILE_ALL + select GENERIC_SMP_IDLE_THREAD + select GENERIC_CMOS_UPDATE + select GENERIC_TIME_VSYSCALL_OLD ++ select GENERIC_CPU_VULNERABILITIES if PPC_BOOK3S_64 + select GENERIC_CLOCKEVENTS + select GENERIC_CLOCKEVENTS_BROADCAST if SMP + select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST +diff --git a/arch/powerpc/include/asm/exception-64e.h b/arch/powerpc/include/asm/exception-64e.h +index a703452d67b6..555e22d5e07f 100644 +--- a/arch/powerpc/include/asm/exception-64e.h ++++ b/arch/powerpc/include/asm/exception-64e.h +@@ -209,5 +209,11 @@ exc_##label##_book3e: + ori r3,r3,vector_offset@l; \ + mtspr SPRN_IVOR##vector_number,r3; + ++#define RFI_TO_KERNEL \ ++ rfi ++ ++#define RFI_TO_USER \ ++ rfi ++ + #endif /* _ASM_POWERPC_EXCEPTION_64E_H */ + +diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h +index 77f52b26dad6..9bddbec441b8 100644 +--- a/arch/powerpc/include/asm/exception-64s.h ++++ b/arch/powerpc/include/asm/exception-64s.h +@@ -50,6 +50,59 @@ + #define EX_PPR 88 /* SMT thread status register (priority) */ + #define EX_CTR 96 + ++/* ++ * Macros for annotating the expected destination of (h)rfid ++ * ++ * The nop instructions allow us to insert one or more instructions to flush the ++ * L1-D cache when returning to userspace or a guest. ++ */ ++#define RFI_FLUSH_SLOT \ ++ RFI_FLUSH_FIXUP_SECTION; \ ++ nop; \ ++ nop; \ ++ nop ++ ++#define RFI_TO_KERNEL \ ++ rfid ++ ++#define RFI_TO_USER \ ++ RFI_FLUSH_SLOT; \ ++ rfid; \ ++ b rfi_flush_fallback ++ ++#define RFI_TO_USER_OR_KERNEL \ ++ RFI_FLUSH_SLOT; \ ++ rfid; \ ++ b rfi_flush_fallback ++ ++#define RFI_TO_GUEST \ ++ RFI_FLUSH_SLOT; \ ++ rfid; \ ++ b rfi_flush_fallback ++ ++#define HRFI_TO_KERNEL \ ++ hrfid ++ ++#define HRFI_TO_USER \ ++ RFI_FLUSH_SLOT; \ ++ hrfid; \ ++ b hrfi_flush_fallback ++ ++#define HRFI_TO_USER_OR_KERNEL \ ++ RFI_FLUSH_SLOT; \ ++ hrfid; \ ++ b hrfi_flush_fallback ++ ++#define HRFI_TO_GUEST \ ++ RFI_FLUSH_SLOT; \ ++ hrfid; \ ++ b hrfi_flush_fallback ++ ++#define HRFI_TO_UNKNOWN \ ++ RFI_FLUSH_SLOT; \ ++ hrfid; \ ++ b hrfi_flush_fallback ++ + #ifdef CONFIG_RELOCATABLE + #define __EXCEPTION_RELON_PROLOG_PSERIES_1(label, h) \ + ld r12,PACAKBASE(r13); /* get high part of &label */ \ +@@ -191,7 +244,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943) + mtspr SPRN_##h##SRR0,r12; \ + mfspr r12,SPRN_##h##SRR1; /* and SRR1 */ \ + mtspr SPRN_##h##SRR1,r10; \ +- h##rfid; \ ++ h##RFI_TO_KERNEL; \ + b . /* prevent speculative execution */ + #define EXCEPTION_PROLOG_PSERIES_1(label, h) \ + __EXCEPTION_PROLOG_PSERIES_1(label, h) +diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h +index 9a67a38bf7b9..7068bafbb2d6 100644 +--- a/arch/powerpc/include/asm/feature-fixups.h ++++ b/arch/powerpc/include/asm/feature-fixups.h +@@ -184,4 +184,19 @@ label##3: \ + FTR_ENTRY_OFFSET label##1b-label##3b; \ + .popsection; + ++#define RFI_FLUSH_FIXUP_SECTION \ ++951: \ ++ .pushsection __rfi_flush_fixup,"a"; \ ++ .align 2; \ ++952: \ ++ FTR_ENTRY_OFFSET 951b-952b; \ ++ .popsection; ++ ++ ++#ifndef __ASSEMBLY__ ++ ++extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; ++ ++#endif ++ + #endif /* __ASM_POWERPC_FEATURE_FIXUPS_H */ +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index 85bc8c0d257b..449bbb87c257 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -239,6 +239,7 @@ + #define H_GET_HCA_INFO 0x1B8 + #define H_GET_PERF_COUNT 0x1BC + #define H_MANAGE_TRACE 0x1C0 ++#define H_GET_CPU_CHARACTERISTICS 0x1C8 + #define H_FREE_LOGICAL_LAN_BUFFER 0x1D4 + #define H_QUERY_INT_STATE 0x1E4 + #define H_POLL_PENDING 0x1D8 +@@ -285,7 +286,19 @@ + #define H_SET_MODE_RESOURCE_ADDR_TRANS_MODE 3 + #define H_SET_MODE_RESOURCE_LE 4 + ++/* H_GET_CPU_CHARACTERISTICS return values */ ++#define H_CPU_CHAR_SPEC_BAR_ORI31 (1ull << 63) // IBM bit 0 ++#define H_CPU_CHAR_BCCTRL_SERIALISED (1ull << 62) // IBM bit 1 ++#define H_CPU_CHAR_L1D_FLUSH_ORI30 (1ull << 61) // IBM bit 2 ++#define H_CPU_CHAR_L1D_FLUSH_TRIG2 (1ull << 60) // IBM bit 3 ++#define H_CPU_CHAR_L1D_THREAD_PRIV (1ull << 59) // IBM bit 4 ++ ++#define H_CPU_BEHAV_FAVOUR_SECURITY (1ull << 63) // IBM bit 0 ++#define H_CPU_BEHAV_L1D_FLUSH_PR (1ull << 62) // IBM bit 1 ++#define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR (1ull << 61) // IBM bit 2 ++ + #ifndef __ASSEMBLY__ ++#include + + /** + * plpar_hcall_norets: - Make a pseries hypervisor call with no return arguments +@@ -423,6 +436,11 @@ extern long pseries_big_endian_exceptions(void); + + #endif /* CONFIG_PPC_PSERIES */ + ++struct h_cpu_char_result { ++ u64 character; ++ u64 behaviour; ++}; ++ + #endif /* __ASSEMBLY__ */ + #endif /* __KERNEL__ */ + #endif /* _ASM_POWERPC_HVCALL_H */ +diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h +index 70bd4381f8e6..45e2aefece16 100644 +--- a/arch/powerpc/include/asm/paca.h ++++ b/arch/powerpc/include/asm/paca.h +@@ -192,6 +192,16 @@ struct paca_struct { + #endif + struct kvmppc_host_state kvm_hstate; + #endif ++#ifdef CONFIG_PPC_BOOK3S_64 ++ /* ++ * rfi fallback flush must be in its own cacheline to prevent ++ * other paca data leaking into the L1d ++ */ ++ u64 exrfi[13] __aligned(0x80); ++ void *rfi_flush_fallback_area; ++ u64 l1d_flush_congruence; ++ u64 l1d_flush_sets; ++#endif + }; + + extern struct paca_struct *paca; +diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h +index 67859edbf8fd..6e05cb397a5c 100644 +--- a/arch/powerpc/include/asm/plpar_wrappers.h ++++ b/arch/powerpc/include/asm/plpar_wrappers.h +@@ -323,4 +323,18 @@ static inline long plapr_set_watchpoint0(unsigned long dawr0, unsigned long dawr + return plpar_set_mode(0, H_SET_MODE_RESOURCE_SET_DAWR, dawr0, dawrx0); + } + ++static inline long plpar_get_cpu_characteristics(struct h_cpu_char_result *p) ++{ ++ unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; ++ long rc; ++ ++ rc = plpar_hcall(H_GET_CPU_CHARACTERISTICS, retbuf); ++ if (rc == H_SUCCESS) { ++ p->character = retbuf[0]; ++ p->behaviour = retbuf[1]; ++ } ++ ++ return rc; ++} ++ + #endif /* _ASM_POWERPC_PLPAR_WRAPPERS_H */ +diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h +index dd0fc18d8103..160bb2311bbb 100644 +--- a/arch/powerpc/include/asm/ppc_asm.h ++++ b/arch/powerpc/include/asm/ppc_asm.h +@@ -224,6 +224,16 @@ name: \ + .globl name; \ + name: + ++#define _KPROBE_TOC(name) \ ++ .section ".kprobes.text","a"; \ ++ .align 2 ; \ ++ .type name,@function; \ ++ .globl name; \ ++name: \ ++0: addis r2,r12,(.TOC.-0b)@ha; \ ++ addi r2,r2,(.TOC.-0b)@l; \ ++ .localentry name,.-name ++ + #define DOTSYM(a) a + + #else +@@ -261,6 +271,8 @@ name: \ + .type GLUE(.,name),@function; \ + GLUE(.,name): + ++#define _KPROBE_TOC(n) _KPROBE(n) ++ + #define DOTSYM(a) GLUE(.,a) + + #endif +diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h +index e9d384cbd021..7916b56f2e60 100644 +--- a/arch/powerpc/include/asm/setup.h ++++ b/arch/powerpc/include/asm/setup.h +@@ -26,6 +26,19 @@ void initmem_init(void); + void setup_panic(void); + #define ARCH_PANIC_TIMEOUT 180 + ++void rfi_flush_enable(bool enable); ++ ++/* These are bit flags */ ++enum l1d_flush_type { ++ L1D_FLUSH_NONE = 0x1, ++ L1D_FLUSH_FALLBACK = 0x2, ++ L1D_FLUSH_ORI = 0x4, ++ L1D_FLUSH_MTTRIG = 0x8, ++}; ++ ++void __init setup_rfi_flush(enum l1d_flush_type, bool enable); ++void do_rfi_flush_fixups(enum l1d_flush_type types); ++ + #endif /* !__ASSEMBLY__ */ + + #endif /* _ASM_POWERPC_SETUP_H */ +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 40da69163d51..d92705e3a0c1 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -243,6 +243,10 @@ int main(void) + #ifdef CONFIG_PPC_BOOK3S_64 + DEFINE(PACAMCEMERGSP, offsetof(struct paca_struct, mc_emergency_sp)); + DEFINE(PACA_IN_MCE, offsetof(struct paca_struct, in_mce)); ++ DEFINE(PACA_RFI_FLUSH_FALLBACK_AREA, offsetof(struct paca_struct, rfi_flush_fallback_area)); ++ DEFINE(PACA_EXRFI, offsetof(struct paca_struct, exrfi)); ++ DEFINE(PACA_L1D_FLUSH_CONGRUENCE, offsetof(struct paca_struct, l1d_flush_congruence)); ++ DEFINE(PACA_L1D_FLUSH_SETS, offsetof(struct paca_struct, l1d_flush_sets)); + #endif + DEFINE(PACAHWCPUID, offsetof(struct paca_struct, hw_cpu_id)); + DEFINE(PACAKEXECSTATE, offsetof(struct paca_struct, kexec_state)); +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index f6fd0332c3a2..2837232bbffb 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -36,6 +36,11 @@ + #include + #include + #include ++#ifdef CONFIG_PPC_BOOK3S ++#include ++#else ++#include ++#endif + + /* + * System calls. +@@ -225,13 +230,23 @@ END_FTR_SECTION_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) + ACCOUNT_CPU_USER_EXIT(r11, r12) + HMT_MEDIUM_LOW_HAS_PPR + ld r13,GPR13(r1) /* only restore r13 if returning to usermode */ ++ ld r2,GPR2(r1) ++ ld r1,GPR1(r1) ++ mtlr r4 ++ mtcr r5 ++ mtspr SPRN_SRR0,r7 ++ mtspr SPRN_SRR1,r8 ++ RFI_TO_USER ++ b . /* prevent speculative execution */ ++ ++ /* exit to kernel */ + 1: ld r2,GPR2(r1) + ld r1,GPR1(r1) + mtlr r4 + mtcr r5 + mtspr SPRN_SRR0,r7 + mtspr SPRN_SRR1,r8 +- RFI ++ RFI_TO_KERNEL + b . /* prevent speculative execution */ + + syscall_error: +@@ -353,8 +368,7 @@ tabort_syscall: + mtmsrd r10, 1 + mtspr SPRN_SRR0, r11 + mtspr SPRN_SRR1, r12 +- +- rfid ++ RFI_TO_USER + b . /* prevent speculative execution */ + #endif + +@@ -887,7 +901,7 @@ BEGIN_FTR_SECTION + END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + ACCOUNT_CPU_USER_EXIT(r2, r4) + REST_GPR(13, r1) +-1: ++ + mtspr SPRN_SRR1,r3 + + ld r2,_CCR(r1) +@@ -900,8 +914,22 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + ld r3,GPR3(r1) + ld r4,GPR4(r1) + ld r1,GPR1(r1) ++ RFI_TO_USER ++ b . /* prevent speculative execution */ + +- rfid ++1: mtspr SPRN_SRR1,r3 ++ ++ ld r2,_CCR(r1) ++ mtcrf 0xFF,r2 ++ ld r2,_NIP(r1) ++ mtspr SPRN_SRR0,r2 ++ ++ ld r0,GPR0(r1) ++ ld r2,GPR2(r1) ++ ld r3,GPR3(r1) ++ ld r4,GPR4(r1) ++ ld r1,GPR1(r1) ++ RFI_TO_KERNEL + b . /* prevent speculative execution */ + + #endif /* CONFIG_PPC_BOOK3E */ +@@ -1077,7 +1105,7 @@ _GLOBAL(enter_rtas) + + mtspr SPRN_SRR0,r5 + mtspr SPRN_SRR1,r6 +- rfid ++ RFI_TO_KERNEL + b . /* prevent speculative execution */ + + rtas_return_loc: +@@ -1102,7 +1130,7 @@ rtas_return_loc: + + mtspr SPRN_SRR0,r3 + mtspr SPRN_SRR1,r4 +- rfid ++ RFI_TO_KERNEL + b . /* prevent speculative execution */ + + .align 3 +@@ -1173,7 +1201,7 @@ _GLOBAL(enter_prom) + LOAD_REG_IMMEDIATE(r12, MSR_SF | MSR_ISF | MSR_LE) + andc r11,r11,r12 + mtsrr1 r11 +- rfid ++ RFI_TO_KERNEL + #endif /* CONFIG_PPC_BOOK3E */ + + 1: /* Return from OF */ +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index b81ccc5fb32d..938a30fef031 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -46,7 +46,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE) \ + mtspr SPRN_SRR0,r10 ; \ + ld r10,PACAKMSR(r13) ; \ + mtspr SPRN_SRR1,r10 ; \ +- rfid ; \ ++ RFI_TO_KERNEL ; \ + b . ; /* prevent speculative execution */ + + #define SYSCALL_PSERIES_3 \ +@@ -54,7 +54,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE) \ + 1: mfspr r12,SPRN_SRR1 ; \ + xori r12,r12,MSR_LE ; \ + mtspr SPRN_SRR1,r12 ; \ +- rfid ; /* return to userspace */ \ ++ RFI_TO_USER ; /* return to userspace */ \ + b . ; /* prevent speculative execution */ + + #if defined(CONFIG_RELOCATABLE) +@@ -507,7 +507,7 @@ BEGIN_FTR_SECTION + LOAD_HANDLER(r12, machine_check_handle_early) + 1: mtspr SPRN_SRR0,r12 + mtspr SPRN_SRR1,r11 +- rfid ++ RFI_TO_KERNEL + b . /* prevent speculative execution */ + 2: + /* Stack overflow. Stay on emergency stack and panic. +@@ -601,7 +601,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR) + ld r11,PACA_EXGEN+EX_R11(r13) + ld r12,PACA_EXGEN+EX_R12(r13) + ld r13,PACA_EXGEN+EX_R13(r13) +- HRFID ++ HRFI_TO_UNKNOWN + b . + #endif + +@@ -666,7 +666,7 @@ masked_##_H##interrupt: \ + ld r10,PACA_EXGEN+EX_R10(r13); \ + ld r11,PACA_EXGEN+EX_R11(r13); \ + GET_SCRATCH0(r13); \ +- ##_H##rfid; \ ++ ##_H##RFI_TO_KERNEL; \ + b . + + MASKED_INTERRUPT() +@@ -756,7 +756,7 @@ kvmppc_skip_interrupt: + addi r13, r13, 4 + mtspr SPRN_SRR0, r13 + GET_SCRATCH0(r13) +- rfid ++ RFI_TO_KERNEL + b . + + kvmppc_skip_Hinterrupt: +@@ -768,7 +768,7 @@ kvmppc_skip_Hinterrupt: + addi r13, r13, 4 + mtspr SPRN_HSRR0, r13 + GET_SCRATCH0(r13) +- hrfid ++ HRFI_TO_KERNEL + b . + #endif + +@@ -1439,7 +1439,7 @@ machine_check_handle_early: + li r3,MSR_ME + andc r10,r10,r3 /* Turn off MSR_ME */ + mtspr SPRN_SRR1,r10 +- rfid ++ RFI_TO_KERNEL + b . + 2: + /* +@@ -1457,7 +1457,7 @@ machine_check_handle_early: + */ + bl machine_check_queue_event + MACHINE_CHECK_HANDLER_WINDUP +- rfid ++ RFI_TO_USER_OR_KERNEL + 9: + /* Deliver the machine check to host kernel in V mode. */ + MACHINE_CHECK_HANDLER_WINDUP +@@ -1503,6 +1503,8 @@ slb_miss_realmode: + + andi. r10,r12,MSR_RI /* check for unrecoverable exception */ + beq- 2f ++ andi. r10,r12,MSR_PR /* check for user mode (PR != 0) */ ++ bne 1f + + .machine push + .machine "power4" +@@ -1516,7 +1518,23 @@ slb_miss_realmode: + ld r11,PACA_EXSLB+EX_R11(r13) + ld r12,PACA_EXSLB+EX_R12(r13) + ld r13,PACA_EXSLB+EX_R13(r13) +- rfid ++ RFI_TO_KERNEL ++ b . /* prevent speculative execution */ ++ ++1: ++.machine push ++.machine "power4" ++ mtcrf 0x80,r9 ++ mtcrf 0x01,r9 /* slb_allocate uses cr0 and cr7 */ ++.machine pop ++ ++ RESTORE_PPR_PACA(PACA_EXSLB, r9) ++ ld r9,PACA_EXSLB+EX_R9(r13) ++ ld r10,PACA_EXSLB+EX_R10(r13) ++ ld r11,PACA_EXSLB+EX_R11(r13) ++ ld r12,PACA_EXSLB+EX_R12(r13) ++ ld r13,PACA_EXSLB+EX_R13(r13) ++ RFI_TO_USER + b . /* prevent speculative execution */ + + 2: mfspr r11,SPRN_SRR0 +@@ -1525,7 +1543,7 @@ slb_miss_realmode: + mtspr SPRN_SRR0,r10 + ld r10,PACAKMSR(r13) + mtspr SPRN_SRR1,r10 +- rfid ++ RFI_TO_KERNEL + b . + + unrecov_slb: +@@ -1546,6 +1564,92 @@ power4_fixup_nap: + blr + #endif + ++ .globl rfi_flush_fallback ++rfi_flush_fallback: ++ SET_SCRATCH0(r13); ++ GET_PACA(r13); ++ std r9,PACA_EXRFI+EX_R9(r13) ++ std r10,PACA_EXRFI+EX_R10(r13) ++ std r11,PACA_EXRFI+EX_R11(r13) ++ std r12,PACA_EXRFI+EX_R12(r13) ++ std r8,PACA_EXRFI+EX_R13(r13) ++ mfctr r9 ++ ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) ++ ld r11,PACA_L1D_FLUSH_SETS(r13) ++ ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) ++ /* ++ * The load adresses are at staggered offsets within cachelines, ++ * which suits some pipelines better (on others it should not ++ * hurt). ++ */ ++ addi r12,r12,8 ++ mtctr r11 ++ DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ ++ ++ /* order ld/st prior to dcbt stop all streams with flushing */ ++ sync ++1: li r8,0 ++ .rept 8 /* 8-way set associative */ ++ ldx r11,r10,r8 ++ add r8,r8,r12 ++ xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not ++ add r8,r8,r11 // Add 0, this creates a dependency on the ldx ++ .endr ++ addi r10,r10,128 /* 128 byte cache line */ ++ bdnz 1b ++ ++ mtctr r9 ++ ld r9,PACA_EXRFI+EX_R9(r13) ++ ld r10,PACA_EXRFI+EX_R10(r13) ++ ld r11,PACA_EXRFI+EX_R11(r13) ++ ld r12,PACA_EXRFI+EX_R12(r13) ++ ld r8,PACA_EXRFI+EX_R13(r13) ++ GET_SCRATCH0(r13); ++ rfid ++ ++ .globl hrfi_flush_fallback ++hrfi_flush_fallback: ++ SET_SCRATCH0(r13); ++ GET_PACA(r13); ++ std r9,PACA_EXRFI+EX_R9(r13) ++ std r10,PACA_EXRFI+EX_R10(r13) ++ std r11,PACA_EXRFI+EX_R11(r13) ++ std r12,PACA_EXRFI+EX_R12(r13) ++ std r8,PACA_EXRFI+EX_R13(r13) ++ mfctr r9 ++ ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) ++ ld r11,PACA_L1D_FLUSH_SETS(r13) ++ ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) ++ /* ++ * The load adresses are at staggered offsets within cachelines, ++ * which suits some pipelines better (on others it should not ++ * hurt). ++ */ ++ addi r12,r12,8 ++ mtctr r11 ++ DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ ++ ++ /* order ld/st prior to dcbt stop all streams with flushing */ ++ sync ++1: li r8,0 ++ .rept 8 /* 8-way set associative */ ++ ldx r11,r10,r8 ++ add r8,r8,r12 ++ xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not ++ add r8,r8,r11 // Add 0, this creates a dependency on the ldx ++ .endr ++ addi r10,r10,128 /* 128 byte cache line */ ++ bdnz 1b ++ ++ mtctr r9 ++ ld r9,PACA_EXRFI+EX_R9(r13) ++ ld r10,PACA_EXRFI+EX_R10(r13) ++ ld r11,PACA_EXRFI+EX_R11(r13) ++ ld r12,PACA_EXRFI+EX_R12(r13) ++ ld r8,PACA_EXRFI+EX_R13(r13) ++ GET_SCRATCH0(r13); ++ hrfid ++ + /* + * Hash table stuff + */ +diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S +index db475d41b57a..107588295b39 100644 +--- a/arch/powerpc/kernel/misc_64.S ++++ b/arch/powerpc/kernel/misc_64.S +@@ -66,7 +66,7 @@ PPC64_CACHES: + * flush all bytes from start through stop-1 inclusive + */ + +-_KPROBE(flush_icache_range) ++_KPROBE_TOC(flush_icache_range) + BEGIN_FTR_SECTION + PURGE_PREFETCHED_INS + blr +@@ -117,7 +117,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) + * + * flush all bytes from start to stop-1 inclusive + */ +-_GLOBAL(flush_dcache_range) ++_GLOBAL_TOC(flush_dcache_range) + + /* + * Flush the data cache to memory +@@ -701,31 +701,3 @@ _GLOBAL(kexec_sequence) + li r5,0 + blr /* image->start(physid, image->start, 0); */ + #endif /* CONFIG_KEXEC */ +- +-#ifdef CONFIG_MODULES +-#if defined(_CALL_ELF) && _CALL_ELF == 2 +- +-#ifdef CONFIG_MODVERSIONS +-.weak __crc_TOC. +-.section "___kcrctab+TOC.","a" +-.globl __kcrctab_TOC. +-__kcrctab_TOC.: +- .llong __crc_TOC. +-#endif +- +-/* +- * Export a fake .TOC. since both modpost and depmod will complain otherwise. +- * Both modpost and depmod strip the leading . so we do the same here. +- */ +-.section "__ksymtab_strings","a" +-__kstrtab_TOC.: +- .asciz "TOC." +- +-.section "___ksymtab+TOC.","a" +-/* This symbol name is important: it's used by modpost to find exported syms */ +-.globl __ksymtab_TOC. +-__ksymtab_TOC.: +- .llong 0 /* .value */ +- .llong __kstrtab_TOC. +-#endif /* ELFv2 */ +-#endif /* MODULES */ +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index e4f7d4eed20c..08b7a40de5f8 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -326,7 +326,10 @@ static void dedotify_versions(struct modversion_info *vers, + } + } + +-/* Undefined symbols which refer to .funcname, hack to funcname (or .TOC.) */ ++/* ++ * Undefined symbols which refer to .funcname, hack to funcname. Make .TOC. ++ * seem to be defined (value set later). ++ */ + static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) + { + unsigned int i; +@@ -334,8 +337,11 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) + for (i = 1; i < numsyms; i++) { + if (syms[i].st_shndx == SHN_UNDEF) { + char *name = strtab + syms[i].st_name; +- if (name[0] == '.') ++ if (name[0] == '.') { ++ if (strcmp(name+1, "TOC.") == 0) ++ syms[i].st_shndx = SHN_ABS; + syms[i].st_name++; ++ } + } + } + } +@@ -351,7 +357,7 @@ static Elf64_Sym *find_dot_toc(Elf64_Shdr *sechdrs, + numsyms = sechdrs[symindex].sh_size / sizeof(Elf64_Sym); + + for (i = 1; i < numsyms; i++) { +- if (syms[i].st_shndx == SHN_UNDEF ++ if (syms[i].st_shndx == SHN_ABS + && strcmp(strtab + syms[i].st_name, "TOC.") == 0) + return &syms[i]; + } +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index cf788d7d7e56..a9b10812cbfd 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -209,7 +209,8 @@ void enable_kernel_vsx(void) + WARN_ON(preemptible()); + + #ifdef CONFIG_SMP +- if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) ++ if (current->thread.regs && ++ (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) + giveup_vsx(current); + else + giveup_vsx(NULL); /* just enable vsx for kernel - force */ +@@ -231,7 +232,7 @@ void flush_vsx_to_thread(struct task_struct *tsk) + { + if (tsk->thread.regs) { + preempt_disable(); +- if (tsk->thread.regs->msr & MSR_VSX) { ++ if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) { + #ifdef CONFIG_SMP + BUG_ON(tsk != current); + #endif +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index a20823210ac0..df4a87eb8da4 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -834,4 +835,142 @@ static int __init disable_hardlockup_detector(void) + return 0; + } + early_initcall(disable_hardlockup_detector); ++ ++#ifdef CONFIG_PPC_BOOK3S_64 ++static enum l1d_flush_type enabled_flush_types; ++static void *l1d_flush_fallback_area; ++static bool no_rfi_flush; ++bool rfi_flush; ++ ++static int __init handle_no_rfi_flush(char *p) ++{ ++ pr_info("rfi-flush: disabled on command line."); ++ no_rfi_flush = true; ++ return 0; ++} ++early_param("no_rfi_flush", handle_no_rfi_flush); ++ ++/* ++ * The RFI flush is not KPTI, but because users will see doco that says to use ++ * nopti we hijack that option here to also disable the RFI flush. ++ */ ++static int __init handle_no_pti(char *p) ++{ ++ pr_info("rfi-flush: disabling due to 'nopti' on command line.\n"); ++ handle_no_rfi_flush(NULL); ++ return 0; ++} ++early_param("nopti", handle_no_pti); ++ ++static void do_nothing(void *unused) ++{ ++ /* ++ * We don't need to do the flush explicitly, just enter+exit kernel is ++ * sufficient, the RFI exit handlers will do the right thing. ++ */ ++} ++ ++void rfi_flush_enable(bool enable) ++{ ++ if (rfi_flush == enable) ++ return; ++ ++ if (enable) { ++ do_rfi_flush_fixups(enabled_flush_types); ++ on_each_cpu(do_nothing, NULL, 1); ++ } else ++ do_rfi_flush_fixups(L1D_FLUSH_NONE); ++ ++ rfi_flush = enable; ++} ++ ++static void init_fallback_flush(void) ++{ ++ u64 l1d_size, limit; ++ int cpu; ++ ++ l1d_size = ppc64_caches.dsize; ++ limit = min(safe_stack_limit(), ppc64_rma_size); ++ ++ /* ++ * Align to L1d size, and size it at 2x L1d size, to catch possible ++ * hardware prefetch runoff. We don't have a recipe for load patterns to ++ * reliably avoid the prefetcher. ++ */ ++ l1d_flush_fallback_area = __va(memblock_alloc_base(l1d_size * 2, l1d_size, limit)); ++ memset(l1d_flush_fallback_area, 0, l1d_size * 2); ++ ++ for_each_possible_cpu(cpu) { ++ /* ++ * The fallback flush is currently coded for 8-way ++ * associativity. Different associativity is possible, but it ++ * will be treated as 8-way and may not evict the lines as ++ * effectively. ++ * ++ * 128 byte lines are mandatory. ++ */ ++ u64 c = l1d_size / 8; ++ ++ paca[cpu].rfi_flush_fallback_area = l1d_flush_fallback_area; ++ paca[cpu].l1d_flush_congruence = c; ++ paca[cpu].l1d_flush_sets = c / 128; ++ } ++} ++ ++void __init setup_rfi_flush(enum l1d_flush_type types, bool enable) ++{ ++ if (types & L1D_FLUSH_FALLBACK) { ++ pr_info("rfi-flush: Using fallback displacement flush\n"); ++ init_fallback_flush(); ++ } ++ ++ if (types & L1D_FLUSH_ORI) ++ pr_info("rfi-flush: Using ori type flush\n"); ++ ++ if (types & L1D_FLUSH_MTTRIG) ++ pr_info("rfi-flush: Using mttrig type flush\n"); ++ ++ enabled_flush_types = types; ++ ++ if (!no_rfi_flush) ++ rfi_flush_enable(enable); ++} ++ ++#ifdef CONFIG_DEBUG_FS ++static int rfi_flush_set(void *data, u64 val) ++{ ++ if (val == 1) ++ rfi_flush_enable(true); ++ else if (val == 0) ++ rfi_flush_enable(false); ++ else ++ return -EINVAL; ++ ++ return 0; ++} ++ ++static int rfi_flush_get(void *data, u64 *val) ++{ ++ *val = rfi_flush ? 1 : 0; ++ return 0; ++} ++ ++DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n"); ++ ++static __init int rfi_flush_debugfs_init(void) ++{ ++ debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush); ++ return 0; ++} ++device_initcall(rfi_flush_debugfs_init); ++#endif ++ ++ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ if (rfi_flush) ++ return sprintf(buf, "Mitigation: RFI Flush\n"); ++ ++ return sprintf(buf, "Vulnerable\n"); ++} ++#endif /* CONFIG_PPC_BOOK3S_64 */ + #endif +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index d41fd0af8980..072a23a17350 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -72,6 +72,15 @@ SECTIONS + /* Read-only data */ + RODATA + ++#ifdef CONFIG_PPC64 ++ . = ALIGN(8); ++ __rfi_flush_fixup : AT(ADDR(__rfi_flush_fixup) - LOAD_OFFSET) { ++ __start___rfi_flush_fixup = .; ++ *(__rfi_flush_fixup) ++ __stop___rfi_flush_fixup = .; ++ } ++#endif ++ + EXCEPTION_TABLE(0) + + NOTES :kernel :notes +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index ffab9269bfe4..4463718ae614 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -64,7 +64,7 @@ _GLOBAL_TOC(kvmppc_hv_entry_trampoline) + mtmsrd r0,1 /* clear RI in MSR */ + mtsrr0 r5 + mtsrr1 r6 +- RFI ++ RFI_TO_KERNEL + + kvmppc_call_hv_entry: + ld r4, HSTATE_KVM_VCPU(r13) +@@ -170,7 +170,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) + mtsrr0 r8 + mtsrr1 r7 + beq cr1, 13f /* machine check */ +- RFI ++ RFI_TO_KERNEL + + /* On POWER7, we have external interrupts set to use HSRR0/1 */ + 11: mtspr SPRN_HSRR0, r8 +@@ -965,8 +965,7 @@ BEGIN_FTR_SECTION + END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + ld r0, VCPU_GPR(R0)(r4) + ld r4, VCPU_GPR(R4)(r4) +- +- hrfid ++ HRFI_TO_GUEST + b . + + secondary_too_late: +diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S +index 16c4d88ba27d..a328f99a887c 100644 +--- a/arch/powerpc/kvm/book3s_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_rmhandlers.S +@@ -46,6 +46,9 @@ + + #define FUNC(name) name + ++#define RFI_TO_KERNEL RFI ++#define RFI_TO_GUEST RFI ++ + .macro INTERRUPT_TRAMPOLINE intno + + .global kvmppc_trampoline_\intno +@@ -141,7 +144,7 @@ kvmppc_handler_skip_ins: + GET_SCRATCH0(r13) + + /* And get back into the code */ +- RFI ++ RFI_TO_KERNEL + #endif + + /* +@@ -164,6 +167,6 @@ _GLOBAL_TOC(kvmppc_entry_trampoline) + ori r5, r5, MSR_EE + mtsrr0 r7 + mtsrr1 r6 +- RFI ++ RFI_TO_KERNEL + + #include "book3s_segment.S" +diff --git a/arch/powerpc/kvm/book3s_segment.S b/arch/powerpc/kvm/book3s_segment.S +index ca8f174289bb..7c982956d709 100644 +--- a/arch/powerpc/kvm/book3s_segment.S ++++ b/arch/powerpc/kvm/book3s_segment.S +@@ -156,7 +156,7 @@ no_dcbz32_on: + PPC_LL r9, SVCPU_R9(r3) + PPC_LL r3, (SVCPU_R3)(r3) + +- RFI ++ RFI_TO_GUEST + kvmppc_handler_trampoline_enter_end: + + +@@ -389,5 +389,5 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE) + cmpwi r12, BOOK3S_INTERRUPT_DOORBELL + beqa BOOK3S_INTERRUPT_DOORBELL + +- RFI ++ RFI_TO_KERNEL + kvmppc_handler_trampoline_exit_end: +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index 7ce3870d7ddd..a18d648d31a6 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + + struct fixup_entry { +@@ -113,6 +114,47 @@ void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end) + } + } + ++#ifdef CONFIG_PPC_BOOK3S_64 ++void do_rfi_flush_fixups(enum l1d_flush_type types) ++{ ++ unsigned int instrs[3], *dest; ++ long *start, *end; ++ int i; ++ ++ start = PTRRELOC(&__start___rfi_flush_fixup), ++ end = PTRRELOC(&__stop___rfi_flush_fixup); ++ ++ instrs[0] = 0x60000000; /* nop */ ++ instrs[1] = 0x60000000; /* nop */ ++ instrs[2] = 0x60000000; /* nop */ ++ ++ if (types & L1D_FLUSH_FALLBACK) ++ /* b .+16 to fallback flush */ ++ instrs[0] = 0x48000010; ++ ++ i = 0; ++ if (types & L1D_FLUSH_ORI) { ++ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ ++ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/ ++ } ++ ++ if (types & L1D_FLUSH_MTTRIG) ++ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */ ++ ++ for (i = 0; start < end; start++, i++) { ++ dest = (void *)start + *start; ++ ++ pr_devel("patching dest %lx\n", (unsigned long)dest); ++ ++ patch_instruction(dest, instrs[0]); ++ patch_instruction(dest + 1, instrs[1]); ++ patch_instruction(dest + 2, instrs[2]); ++ } ++ ++ printk(KERN_DEBUG "rfi-flush: patched %d locations\n", i); ++} ++#endif /* CONFIG_PPC_BOOK3S_64 */ ++ + void do_lwsync_fixups(unsigned long value, void *fixup_start, void *fixup_end) + { + long *start, *end; +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +index f48afc06ba14..30c6b3b7be90 100644 +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -35,13 +35,63 @@ + #include + #include + #include ++#include ++#include + + #include "powernv.h" + ++static void pnv_setup_rfi_flush(void) ++{ ++ struct device_node *np, *fw_features; ++ enum l1d_flush_type type; ++ int enable; ++ ++ /* Default to fallback in case fw-features are not available */ ++ type = L1D_FLUSH_FALLBACK; ++ enable = 1; ++ ++ np = of_find_node_by_name(NULL, "ibm,opal"); ++ fw_features = of_get_child_by_name(np, "fw-features"); ++ of_node_put(np); ++ ++ if (fw_features) { ++ np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2"); ++ if (np && of_property_read_bool(np, "enabled")) ++ type = L1D_FLUSH_MTTRIG; ++ ++ of_node_put(np); ++ ++ np = of_get_child_by_name(fw_features, "inst-l1d-flush-ori30,30,0"); ++ if (np && of_property_read_bool(np, "enabled")) ++ type = L1D_FLUSH_ORI; ++ ++ of_node_put(np); ++ ++ /* Enable unless firmware says NOT to */ ++ enable = 2; ++ np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-hv-1-to-0"); ++ if (np && of_property_read_bool(np, "disabled")) ++ enable--; ++ ++ of_node_put(np); ++ ++ np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-pr-0-to-1"); ++ if (np && of_property_read_bool(np, "disabled")) ++ enable--; ++ ++ of_node_put(np); ++ of_node_put(fw_features); ++ } ++ ++ setup_rfi_flush(type, enable > 0); ++} ++ + static void __init pnv_setup_arch(void) + { + set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT); + ++ pnv_setup_rfi_flush(); ++ + /* Initialize SMP */ + pnv_smp_init(); + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index 36df46eaba24..dd2545fc9947 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -499,6 +499,39 @@ static void __init find_and_init_phbs(void) + of_pci_check_probe_only(); + } + ++static void pseries_setup_rfi_flush(void) ++{ ++ struct h_cpu_char_result result; ++ enum l1d_flush_type types; ++ bool enable; ++ long rc; ++ ++ /* Enable by default */ ++ enable = true; ++ ++ rc = plpar_get_cpu_characteristics(&result); ++ if (rc == H_SUCCESS) { ++ types = L1D_FLUSH_NONE; ++ ++ if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2) ++ types |= L1D_FLUSH_MTTRIG; ++ if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30) ++ types |= L1D_FLUSH_ORI; ++ ++ /* Use fallback if nothing set in hcall */ ++ if (types == L1D_FLUSH_NONE) ++ types = L1D_FLUSH_FALLBACK; ++ ++ if (!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR)) ++ enable = false; ++ } else { ++ /* Default to fallback if case hcall is not available */ ++ types = L1D_FLUSH_FALLBACK; ++ } ++ ++ setup_rfi_flush(types, enable); ++} ++ + static void __init pSeries_setup_arch(void) + { + set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT); +@@ -515,7 +548,9 @@ static void __init pSeries_setup_arch(void) + + fwnmi_init(); + +- /* By default, only probe PCI (can be overriden by rtas_pci) */ ++ pseries_setup_rfi_flush(); ++ ++ /* By default, only probe PCI (can be overridden by rtas_pci) */ + pci_add_flags(PCI_PROBE_ONLY); + + /* Find and initialize PCI host bridges */ +diff --git a/arch/sh/kernel/traps_32.c b/arch/sh/kernel/traps_32.c +index ff639342a8be..c5b997757988 100644 +--- a/arch/sh/kernel/traps_32.c ++++ b/arch/sh/kernel/traps_32.c +@@ -607,7 +607,8 @@ asmlinkage void do_divide_error(unsigned long r4) + break; + } + +- force_sig_info(SIGFPE, &info, current); ++ info.si_signo = SIGFPE; ++ force_sig_info(info.si_signo, &info, current); + } + #endif + +diff --git a/arch/x86/crypto/poly1305_glue.c b/arch/x86/crypto/poly1305_glue.c +index 4264a3d59589..7c064887b783 100644 +--- a/arch/x86/crypto/poly1305_glue.c ++++ b/arch/x86/crypto/poly1305_glue.c +@@ -164,7 +164,6 @@ static struct shash_alg alg = { + .init = poly1305_simd_init, + .update = poly1305_simd_update, + .final = crypto_poly1305_final, +- .setkey = crypto_poly1305_setkey, + .descsize = sizeof(struct poly1305_simd_desc_ctx), + .base = { + .cra_name = "poly1305", +diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h +index b9c6c7a6f5a6..1c79c8add0eb 100644 +--- a/arch/x86/include/asm/asm.h ++++ b/arch/x86/include/asm/asm.h +@@ -11,10 +11,12 @@ + # define __ASM_FORM_COMMA(x) " " #x "," + #endif + +-#ifdef CONFIG_X86_32 ++#ifndef __x86_64__ ++/* 32 bit */ + # define __ASM_SEL(a,b) __ASM_FORM(a) + # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a) + #else ++/* 64 bit */ + # define __ASM_SEL(a,b) __ASM_FORM(b) + # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(b) + #endif +diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h +index 9ee85066f407..62210da19a92 100644 +--- a/arch/x86/include/asm/vsyscall.h ++++ b/arch/x86/include/asm/vsyscall.h +@@ -13,7 +13,6 @@ extern void map_vsyscall(void); + */ + extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address); + extern bool vsyscall_enabled(void); +-extern unsigned long vsyscall_pgprot; + #else + static inline void map_vsyscall(void) {} + static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) +@@ -22,5 +21,6 @@ static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) + } + static inline bool vsyscall_enabled(void) { return false; } + #endif ++extern unsigned long vsyscall_pgprot; + + #endif /* _ASM_X86_VSYSCALL_H */ +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index b3e94ef461fd..ce5f8a2e7ae6 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -44,7 +44,7 @@ + + static struct microcode_ops *microcode_ops; + +-static bool dis_ucode_ldr; ++static bool dis_ucode_ldr = true; + + static int __init disable_loader(char *str) + { +@@ -81,6 +81,7 @@ struct cpu_info_ctx { + + static bool __init check_loader_disabled_bsp(void) + { ++ u32 a, b, c, d; + #ifdef CONFIG_X86_32 + const char *cmdline = (const char *)__pa_nodebug(boot_command_line); + const char *opt = "dis_ucode_ldr"; +@@ -93,8 +94,20 @@ static bool __init check_loader_disabled_bsp(void) + bool *res = &dis_ucode_ldr; + #endif + +- if (cmdline_find_option_bool(cmdline, option)) +- *res = true; ++ a = 1; ++ c = 0; ++ native_cpuid(&a, &b, &c, &d); ++ ++ /* ++ * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not ++ * completely accurate as xen pv guests don't see that CPUID bit set but ++ * that's good enough as they don't land on the BSP path anyway. ++ */ ++ if (c & BIT(31)) ++ return *res; ++ ++ if (cmdline_find_option_bool(cmdline, option) <= 0) ++ *res = false; + + return *res; + } +@@ -122,9 +135,7 @@ void __init load_ucode_bsp(void) + { + int vendor; + unsigned int family; +- +- if (check_loader_disabled_bsp()) +- return; ++ bool intel = true; + + if (!have_cpuid_p()) + return; +@@ -134,16 +145,27 @@ void __init load_ucode_bsp(void) + + switch (vendor) { + case X86_VENDOR_INTEL: +- if (family >= 6) +- load_ucode_intel_bsp(); ++ if (family < 6) ++ return; + break; ++ + case X86_VENDOR_AMD: +- if (family >= 0x10) +- load_ucode_amd_bsp(family); ++ if (family < 0x10) ++ return; ++ intel = false; + break; ++ + default: +- break; ++ return; + } ++ ++ if (check_loader_disabled_bsp()) ++ return; ++ ++ if (intel) ++ load_ucode_intel_bsp(); ++ else ++ load_ucode_amd_bsp(family); + } + + static bool check_loader_disabled_ap(void) +@@ -162,9 +184,6 @@ void load_ucode_ap(void) + if (check_loader_disabled_ap()) + return; + +- if (!have_cpuid_p()) +- return; +- + vendor = x86_vendor(); + family = x86_family(); + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index f8d785aa2e96..2a1a8737015b 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -4595,14 +4595,15 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu, + + if (is_guest_mode(vcpu) && + vector == vmx->nested.posted_intr_nv) { +- /* the PIR and ON have been set by L1. */ +- kvm_vcpu_trigger_posted_interrupt(vcpu); + /* + * If a posted intr is not recognized by hardware, + * we will accomplish it in the next vmentry. + */ + vmx->nested.pi_pending = true; + kvm_make_request(KVM_REQ_EVENT, vcpu); ++ /* the PIR and ON have been set by L1. */ ++ if (!kvm_vcpu_trigger_posted_interrupt(vcpu)) ++ kvm_vcpu_kick(vcpu); + return 0; + } + return -1; +diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c +index 2298434f7bdb..7a72e32e4806 100644 +--- a/arch/x86/mm/kaiser.c ++++ b/arch/x86/mm/kaiser.c +@@ -363,7 +363,7 @@ void __init kaiser_init(void) + kaiser_add_user_map_ptrs_early(__entry_text_start, __entry_text_end, + __PAGE_KERNEL_RX); + +-#if defined(CONFIG_FUNCTION_GRAPH_TRACER) || defined(CONFIG_KASAN) ++#ifdef CONFIG_FUNCTION_GRAPH_TRACER + kaiser_add_user_map_ptrs_early(__irqentry_text_start, + __irqentry_text_end, + __PAGE_KERNEL_RX); +diff --git a/arch/xtensa/include/asm/futex.h b/arch/xtensa/include/asm/futex.h +index b39531babec0..72bfc1cbc2b5 100644 +--- a/arch/xtensa/include/asm/futex.h ++++ b/arch/xtensa/include/asm/futex.h +@@ -109,7 +109,6 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + u32 oldval, u32 newval) + { + int ret = 0; +- u32 prev; + + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) + return -EFAULT; +@@ -120,26 +119,24 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, + + __asm__ __volatile__ ( + " # futex_atomic_cmpxchg_inatomic\n" +- "1: l32i %1, %3, 0\n" +- " mov %0, %5\n" +- " wsr %1, scompare1\n" +- "2: s32c1i %0, %3, 0\n" +- "3:\n" ++ " wsr %5, scompare1\n" ++ "1: s32c1i %1, %4, 0\n" ++ " s32i %1, %6, 0\n" ++ "2:\n" + " .section .fixup,\"ax\"\n" + " .align 4\n" +- "4: .long 3b\n" +- "5: l32r %1, 4b\n" +- " movi %0, %6\n" ++ "3: .long 2b\n" ++ "4: l32r %1, 3b\n" ++ " movi %0, %7\n" + " jx %1\n" + " .previous\n" + " .section __ex_table,\"a\"\n" +- " .long 1b,5b,2b,5b\n" ++ " .long 1b,4b\n" + " .previous\n" +- : "+r" (ret), "=&r" (prev), "+m" (*uaddr) +- : "r" (uaddr), "r" (oldval), "r" (newval), "I" (-EFAULT) ++ : "+r" (ret), "+r" (newval), "+m" (*uaddr), "+m" (*uval) ++ : "r" (uaddr), "r" (oldval), "r" (uval), "I" (-EFAULT) + : "memory"); + +- *uval = prev; + return ret; + } + +diff --git a/crypto/ahash.c b/crypto/ahash.c +index f9caf0f74199..7006dbfd39bd 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -637,5 +637,16 @@ struct hash_alg_common *ahash_attr_alg(struct rtattr *rta, u32 type, u32 mask) + } + EXPORT_SYMBOL_GPL(ahash_attr_alg); + ++bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg) ++{ ++ struct crypto_alg *alg = &halg->base; ++ ++ if (alg->cra_type != &crypto_ahash_type) ++ return crypto_shash_alg_has_setkey(__crypto_shash_alg(alg)); ++ ++ return __crypto_ahash_alg(alg)->setkey != NULL; ++} ++EXPORT_SYMBOL_GPL(crypto_hash_alg_has_setkey); ++ + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Asynchronous cryptographic hash type"); +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index 26a504db3f53..10a5a3eb675a 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -654,7 +654,8 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, + inst->alg.finup = cryptd_hash_finup_enqueue; + inst->alg.export = cryptd_hash_export; + inst->alg.import = cryptd_hash_import; +- inst->alg.setkey = cryptd_hash_setkey; ++ if (crypto_shash_alg_has_setkey(salg)) ++ inst->alg.setkey = cryptd_hash_setkey; + inst->alg.digest = cryptd_hash_digest_enqueue; + + err = ahash_register_instance(tmpl, inst); +diff --git a/crypto/poly1305_generic.c b/crypto/poly1305_generic.c +index 2df9835dfbc0..bca99238948f 100644 +--- a/crypto/poly1305_generic.c ++++ b/crypto/poly1305_generic.c +@@ -51,17 +51,6 @@ int crypto_poly1305_init(struct shash_desc *desc) + } + EXPORT_SYMBOL_GPL(crypto_poly1305_init); + +-int crypto_poly1305_setkey(struct crypto_shash *tfm, +- const u8 *key, unsigned int keylen) +-{ +- /* Poly1305 requires a unique key for each tag, which implies that +- * we can't set it on the tfm that gets accessed by multiple users +- * simultaneously. Instead we expect the key as the first 32 bytes in +- * the update() call. */ +- return -ENOTSUPP; +-} +-EXPORT_SYMBOL_GPL(crypto_poly1305_setkey); +- + static void poly1305_setrkey(struct poly1305_desc_ctx *dctx, const u8 *key) + { + /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */ +@@ -80,6 +69,11 @@ static void poly1305_setskey(struct poly1305_desc_ctx *dctx, const u8 *key) + dctx->s[3] = le32_to_cpuvp(key + 12); + } + ++/* ++ * Poly1305 requires a unique key for each tag, which implies that we can't set ++ * it on the tfm that gets accessed by multiple users simultaneously. Instead we ++ * expect the key as the first 32 bytes in the update() call. ++ */ + unsigned int crypto_poly1305_setdesckey(struct poly1305_desc_ctx *dctx, + const u8 *src, unsigned int srclen) + { +@@ -285,7 +279,6 @@ static struct shash_alg poly1305_alg = { + .init = crypto_poly1305_init, + .update = crypto_poly1305_update, + .final = crypto_poly1305_final, +- .setkey = crypto_poly1305_setkey, + .descsize = sizeof(struct poly1305_desc_ctx), + .base = { + .cra_name = "poly1305", +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index f522828d45c9..1d92b5d2d6bd 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -291,11 +291,13 @@ static void sg_init_aead(struct scatterlist *sg, char *xbuf[XBUFSIZE], + } + + sg_init_table(sg, np + 1); +- np--; ++ if (rem) ++ np--; + for (k = 0; k < np; k++) + sg_set_buf(&sg[k + 1], xbuf[k], PAGE_SIZE); + +- sg_set_buf(&sg[k + 1], xbuf[k], rem); ++ if (rem) ++ sg_set_buf(&sg[k + 1], xbuf[k], rem); + } + + static void test_aead_speed(const char *algo, int enc, unsigned int secs, +diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c +index 2fa8304171e0..7a3431018e0a 100644 +--- a/drivers/acpi/sbshc.c ++++ b/drivers/acpi/sbshc.c +@@ -275,8 +275,8 @@ static int acpi_smbus_hc_add(struct acpi_device *device) + device->driver_data = hc; + + acpi_ec_add_query_handler(hc->ec, hc->query_bit, NULL, smbus_alarm, hc); +- printk(KERN_INFO PREFIX "SBS HC: EC = 0x%p, offset = 0x%0x, query_bit = 0x%0x\n", +- hc->ec, hc->offset, hc->query_bit); ++ dev_info(&device->dev, "SBS HC: offset = 0x%0x, query_bit = 0x%0x\n", ++ hc->offset, hc->query_bit); + + return 0; + } +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 60a15831c009..8ddf5d5c94fd 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -260,9 +260,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x3b23), board_ahci }, /* PCH AHCI */ + { PCI_VDEVICE(INTEL, 0x3b24), board_ahci }, /* PCH RAID */ + { PCI_VDEVICE(INTEL, 0x3b25), board_ahci }, /* PCH RAID */ +- { PCI_VDEVICE(INTEL, 0x3b29), board_ahci }, /* PCH AHCI */ ++ { PCI_VDEVICE(INTEL, 0x3b29), board_ahci }, /* PCH M AHCI */ + { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ +- { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ ++ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH M RAID */ + { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ + { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ +@@ -285,9 +285,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ + { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ +- { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT M AHCI */ + { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */ +- { PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT RAID */ ++ { PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT M RAID */ + { PCI_VDEVICE(INTEL, 0x1c06), board_ahci }, /* CPT RAID */ + { PCI_VDEVICE(INTEL, 0x1c07), board_ahci }, /* CPT RAID */ + { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */ +@@ -296,20 +296,20 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */ + { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */ + { PCI_VDEVICE(INTEL, 0x1e02), board_ahci }, /* Panther Point AHCI */ +- { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point AHCI */ ++ { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point M AHCI */ + { PCI_VDEVICE(INTEL, 0x1e04), board_ahci }, /* Panther Point RAID */ + { PCI_VDEVICE(INTEL, 0x1e05), board_ahci }, /* Panther Point RAID */ + { PCI_VDEVICE(INTEL, 0x1e06), board_ahci }, /* Panther Point RAID */ +- { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point RAID */ ++ { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point M RAID */ + { PCI_VDEVICE(INTEL, 0x1e0e), board_ahci }, /* Panther Point RAID */ + { PCI_VDEVICE(INTEL, 0x8c02), board_ahci }, /* Lynx Point AHCI */ +- { PCI_VDEVICE(INTEL, 0x8c03), board_ahci }, /* Lynx Point AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c03), board_ahci }, /* Lynx Point M AHCI */ + { PCI_VDEVICE(INTEL, 0x8c04), board_ahci }, /* Lynx Point RAID */ +- { PCI_VDEVICE(INTEL, 0x8c05), board_ahci }, /* Lynx Point RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c05), board_ahci }, /* Lynx Point M RAID */ + { PCI_VDEVICE(INTEL, 0x8c06), board_ahci }, /* Lynx Point RAID */ +- { PCI_VDEVICE(INTEL, 0x8c07), board_ahci }, /* Lynx Point RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c07), board_ahci }, /* Lynx Point M RAID */ + { PCI_VDEVICE(INTEL, 0x8c0e), board_ahci }, /* Lynx Point RAID */ +- { PCI_VDEVICE(INTEL, 0x8c0f), board_ahci }, /* Lynx Point RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c0f), board_ahci }, /* Lynx Point M RAID */ + { PCI_VDEVICE(INTEL, 0x9c02), board_ahci }, /* Lynx Point-LP AHCI */ + { PCI_VDEVICE(INTEL, 0x9c03), board_ahci }, /* Lynx Point-LP AHCI */ + { PCI_VDEVICE(INTEL, 0x9c04), board_ahci }, /* Lynx Point-LP RAID */ +@@ -350,21 +350,21 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ +- { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ ++ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series M AHCI */ + { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ +- { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series M RAID */ + { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ +- { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series M RAID */ + { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ +- { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ ++ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series M RAID */ + { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */ + { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */ + { PCI_VDEVICE(INTEL, 0xa102), board_ahci }, /* Sunrise Point-H AHCI */ +- { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ ++ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H M AHCI */ + { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ + { PCI_VDEVICE(INTEL, 0xa106), board_ahci }, /* Sunrise Point-H RAID */ +- { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */ ++ { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H M RAID */ + { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */ + { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/ +@@ -382,6 +382,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ + { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ ++ { PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */ ++ { PCI_VDEVICE(INTEL, 0x0f22), board_ahci }, /* Bay Trail AHCI */ ++ { PCI_VDEVICE(INTEL, 0x0f23), board_ahci }, /* Bay Trail AHCI */ ++ { PCI_VDEVICE(INTEL, 0x22a3), board_ahci }, /* Cherry Trail AHCI */ ++ { PCI_VDEVICE(INTEL, 0x5ae3), board_ahci }, /* Apollo Lake AHCI */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ + { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, +diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c +index d06c62eccdf0..156968a6655d 100644 +--- a/drivers/block/pktcdvd.c ++++ b/drivers/block/pktcdvd.c +@@ -2779,7 +2779,7 @@ static int pkt_setup_dev(dev_t dev, dev_t* pkt_dev) + pd->pkt_dev = MKDEV(pktdev_major, idx); + ret = pkt_new_dev(pd, dev); + if (ret) +- goto out_new_dev; ++ goto out_mem2; + + /* inherit events of the host device */ + disk->events = pd->bdev->bd_disk->events; +@@ -2797,8 +2797,6 @@ static int pkt_setup_dev(dev_t dev, dev_t* pkt_dev) + mutex_unlock(&ctl_mutex); + return 0; + +-out_new_dev: +- blk_cleanup_queue(disk->queue); + out_mem2: + put_disk(disk); + out_mem: +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 7b624423a7e8..89ccb604045c 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -31,6 +31,7 @@ + #include + #include + ++#include + #include + #include + +@@ -291,6 +292,14 @@ static int btsdio_probe(struct sdio_func *func, + tuple = tuple->next; + } + ++ /* BCM43341 devices soldered onto the PCB (non-removable) use an ++ * uart connection for bluetooth, ignore the BT SDIO interface. ++ */ ++ if (func->vendor == SDIO_VENDOR_ID_BROADCOM && ++ func->device == SDIO_DEVICE_ID_BROADCOM_43341 && ++ !mmc_card_is_removable(func->card->host)) ++ return -ENODEV; ++ + data = devm_kzalloc(&func->dev, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 1ccad79ce77c..54cef3dc0beb 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -23,6 +23,7 @@ + + #include + #include ++#include + #include + #include + +@@ -360,8 +361,8 @@ static const struct usb_device_id blacklist_table[] = { + #define BTUSB_FIRMWARE_LOADED 7 + #define BTUSB_FIRMWARE_FAILED 8 + #define BTUSB_BOOTING 9 +-#define BTUSB_RESET_RESUME 10 +-#define BTUSB_DIAG_RUNNING 11 ++#define BTUSB_DIAG_RUNNING 10 ++#define BTUSB_OOB_WAKE_ENABLED 11 + + struct btusb_data { + struct hci_dev *hdev; +@@ -2972,9 +2973,9 @@ static int btusb_probe(struct usb_interface *intf, + + /* QCA Rome devices lose their updated firmware over suspend, + * but the USB hub doesn't notice any status change. +- * Explicitly request a device reset on resume. ++ * explicitly request a device reset on resume. + */ +- set_bit(BTUSB_RESET_RESUME, &data->flags); ++ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; + } + + #ifdef CONFIG_BT_HCIBTUSB_RTL +@@ -2985,7 +2986,7 @@ static int btusb_probe(struct usb_interface *intf, + * but the USB hub doesn't notice any status change. + * Explicitly request a device reset on resume. + */ +- set_bit(BTUSB_RESET_RESUME, &data->flags); ++ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; + } + #endif + +@@ -3142,14 +3143,6 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message) + btusb_stop_traffic(data); + usb_kill_anchored_urbs(&data->tx_anchor); + +- /* Optionally request a device reset on resume, but only when +- * wakeups are disabled. If wakeups are enabled we assume the +- * device will stay powered up throughout suspend. +- */ +- if (test_bit(BTUSB_RESET_RESUME, &data->flags) && +- !device_may_wakeup(&data->udev->dev)) +- data->udev->reset_resume = 1; +- + return 0; + } + +diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c +index 53e61459c69f..ee87eb77095c 100644 +--- a/drivers/crypto/caam/ctrl.c ++++ b/drivers/crypto/caam/ctrl.c +@@ -224,12 +224,16 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, + * without any error (HW optimizations for later + * CAAM eras), then try again. + */ ++ if (ret) ++ break; ++ + rdsta_val = rd_reg32(&ctrl->r4tst[0].rdsta) & RDSTA_IFMASK; + if ((status && status != JRSTA_SSRC_JUMP_HALT_CC) || +- !(rdsta_val & (1 << sh_idx))) ++ !(rdsta_val & (1 << sh_idx))) { + ret = -EAGAIN; +- if (ret) + break; ++ } ++ + dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx); + /* Clear the contents before recreating the descriptor */ + memset(desc, 0x00, CAAM_CMD_SZ * 7); +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 7254c20007f8..6796eb1a8a4c 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -329,7 +329,7 @@ static void dmatest_callback(void *arg) + { + struct dmatest_done *done = arg; + struct dmatest_thread *thread = +- container_of(arg, struct dmatest_thread, done_wait); ++ container_of(done, struct dmatest_thread, test_done); + if (!thread->done) { + done->done = true; + wake_up_all(done->wait); +diff --git a/drivers/edac/octeon_edac-lmc.c b/drivers/edac/octeon_edac-lmc.c +index cda6dab5067a..6b65a102b49d 100644 +--- a/drivers/edac/octeon_edac-lmc.c ++++ b/drivers/edac/octeon_edac-lmc.c +@@ -79,6 +79,7 @@ static void octeon_lmc_edac_poll_o2(struct mem_ctl_info *mci) + if (!pvt->inject) + int_reg.u64 = cvmx_read_csr(CVMX_LMCX_INT(mci->mc_idx)); + else { ++ int_reg.u64 = 0; + if (pvt->error_type == 1) + int_reg.s.sec_err = 1; + if (pvt->error_type == 2) +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index 9befd624a5f0..6fab07935d16 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -371,6 +371,31 @@ static void rcar_du_crtc_start(struct rcar_du_crtc *rcrtc) + rcrtc->started = true; + } + ++static void rcar_du_crtc_disable_planes(struct rcar_du_crtc *rcrtc) ++{ ++ struct rcar_du_device *rcdu = rcrtc->group->dev; ++ struct drm_crtc *crtc = &rcrtc->crtc; ++ u32 status; ++ /* Make sure vblank interrupts are enabled. */ ++ drm_crtc_vblank_get(crtc); ++ /* ++ * Disable planes and calculate how many vertical blanking interrupts we ++ * have to wait for. If a vertical blanking interrupt has been triggered ++ * but not processed yet, we don't know whether it occurred before or ++ * after the planes got disabled. We thus have to wait for two vblank ++ * interrupts in that case. ++ */ ++ spin_lock_irq(&rcrtc->vblank_lock); ++ rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? DS2PR : DS1PR, 0); ++ status = rcar_du_crtc_read(rcrtc, DSSR); ++ rcrtc->vblank_count = status & DSSR_VBK ? 2 : 1; ++ spin_unlock_irq(&rcrtc->vblank_lock); ++ if (!wait_event_timeout(rcrtc->vblank_wait, rcrtc->vblank_count == 0, ++ msecs_to_jiffies(100))) ++ dev_warn(rcdu->dev, "vertical blanking timeout\n"); ++ drm_crtc_vblank_put(crtc); ++} ++ + static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc) + { + struct drm_crtc *crtc = &rcrtc->crtc; +@@ -379,17 +404,16 @@ static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc) + return; + + /* Disable all planes and wait for the change to take effect. This is +- * required as the DSnPR registers are updated on vblank, and no vblank +- * will occur once the CRTC is stopped. Disabling planes when starting +- * the CRTC thus wouldn't be enough as it would start scanning out +- * immediately from old frame buffers until the next vblank. ++ * required as the plane enable registers are updated on vblank, and no ++ * vblank will occur once the CRTC is stopped. Disabling planes when ++ * starting the CRTC thus wouldn't be enough as it would start scanning ++ * out immediately from old frame buffers until the next vblank. + * + * This increases the CRTC stop delay, especially when multiple CRTCs + * are stopped in one operation as we now wait for one vblank per CRTC. + * Whether this can be improved needs to be researched. + */ +- rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? DS2PR : DS1PR, 0); +- drm_crtc_wait_one_vblank(crtc); ++ rcar_du_crtc_disable_planes(rcrtc); + + /* Disable vertical blanking interrupt reporting. We first need to wait + * for page flip completion before stopping the CRTC as userspace +@@ -528,10 +552,26 @@ static irqreturn_t rcar_du_crtc_irq(int irq, void *arg) + irqreturn_t ret = IRQ_NONE; + u32 status; + ++ spin_lock(&rcrtc->vblank_lock); ++ + status = rcar_du_crtc_read(rcrtc, DSSR); + rcar_du_crtc_write(rcrtc, DSRCR, status & DSRCR_MASK); + +- if (status & DSSR_FRM) { ++ if (status & DSSR_VBK) { ++ /* ++ * Wake up the vblank wait if the counter reaches 0. This must ++ * be protected by the vblank_lock to avoid races in ++ * rcar_du_crtc_disable_planes(). ++ */ ++ if (rcrtc->vblank_count) { ++ if (--rcrtc->vblank_count == 0) ++ wake_up(&rcrtc->vblank_wait); ++ } ++ } ++ ++ spin_unlock(&rcrtc->vblank_lock); ++ ++ if (status & DSSR_VBK) { + drm_handle_vblank(rcrtc->crtc.dev, rcrtc->index); + rcar_du_crtc_finish_page_flip(rcrtc); + ret = IRQ_HANDLED; +@@ -585,6 +625,8 @@ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index) + } + + init_waitqueue_head(&rcrtc->flip_wait); ++ init_waitqueue_head(&rcrtc->vblank_wait); ++ spin_lock_init(&rcrtc->vblank_lock); + + rcrtc->group = rgrp; + rcrtc->mmio_offset = mmio_offsets[index]; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h +index 2bbe3f5aab65..be22ce33b70a 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h +@@ -15,6 +15,7 @@ + #define __RCAR_DU_CRTC_H__ + + #include ++#include + #include + + #include +@@ -32,6 +33,9 @@ struct rcar_du_group; + * @started: whether the CRTC has been started and is running + * @event: event to post when the pending page flip completes + * @flip_wait: wait queue used to signal page flip completion ++ * @vblank_lock: protects vblank_wait and vblank_count ++ * @vblank_wait: wait queue used to signal vertical blanking ++ * @vblank_count: number of vertical blanking interrupts to wait for + * @outputs: bitmask of the outputs (enum rcar_du_output) driven by this CRTC + * @enabled: whether the CRTC is enabled, used to control system resume + * @group: CRTC group this CRTC belongs to +@@ -48,6 +52,10 @@ struct rcar_du_crtc { + struct drm_pending_vblank_event *event; + wait_queue_head_t flip_wait; + ++ spinlock_t vblank_lock; ++ wait_queue_head_t vblank_wait; ++ unsigned int vblank_count; ++ + unsigned int outputs; + bool enabled; + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 3ba486d0ec6f..6861b74e2b61 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2308,7 +2308,6 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, 0x0004) }, + { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, 0x000a) }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) }, +- { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0401) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) }, +@@ -2578,6 +2577,17 @@ bool hid_ignore(struct hid_device *hdev) + strncmp(hdev->name, "www.masterkit.ru MA901", 22) == 0) + return true; + break; ++ case USB_VENDOR_ID_ELAN: ++ /* ++ * Many Elan devices have a product id of 0x0401 and are handled ++ * by the elan_i2c input driver. But the ACPI HID ELAN0800 dev ++ * is not (and cannot be) handled by that driver -> ++ * Ignore all 0x0401 devs except for the ELAN0800 dev. ++ */ ++ if (hdev->product == 0x0401 && ++ strncmp(hdev->name, "ELAN0800", 8) != 0) ++ return true; ++ break; + } + + if (hdev->type == HID_TYPE_USBMOUSE && +diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c +index 7979e5d6498b..7ca359391535 100644 +--- a/drivers/media/dvb-frontends/ts2020.c ++++ b/drivers/media/dvb-frontends/ts2020.c +@@ -369,7 +369,7 @@ static int ts2020_read_tuner_gain(struct dvb_frontend *fe, unsigned v_agc, + gain2 = clamp_t(long, gain2, 0, 13); + v_agc = clamp_t(long, v_agc, 400, 1100); + +- *_gain = -(gain1 * 2330 + ++ *_gain = -((__s64)gain1 * 2330 + + gain2 * 3500 + + v_agc * 24 / 10 * 10 + + 10000); +@@ -387,7 +387,7 @@ static int ts2020_read_tuner_gain(struct dvb_frontend *fe, unsigned v_agc, + gain3 = clamp_t(long, gain3, 0, 6); + v_agc = clamp_t(long, v_agc, 600, 1600); + +- *_gain = -(gain1 * 2650 + ++ *_gain = -((__s64)gain1 * 2650 + + gain2 * 3380 + + gain3 * 2850 + + v_agc * 176 / 100 * 10 - +diff --git a/drivers/media/platform/soc_camera/soc_scale_crop.c b/drivers/media/platform/soc_camera/soc_scale_crop.c +index bda29bc1b933..2f74a5ac0147 100644 +--- a/drivers/media/platform/soc_camera/soc_scale_crop.c ++++ b/drivers/media/platform/soc_camera/soc_scale_crop.c +@@ -405,3 +405,7 @@ void soc_camera_calc_client_output(struct soc_camera_device *icd, + mf->height = soc_camera_shift_scale(rect->height, shift, scale_v); + } + EXPORT_SYMBOL(soc_camera_calc_client_output); ++ ++MODULE_DESCRIPTION("soc-camera scaling-cropping functions"); ++MODULE_AUTHOR("Guennadi Liakhovetski "); ++MODULE_LICENSE("GPL"); +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index 3721ee63b8fb..09c97847bf95 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -503,18 +503,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid, + + static int lme2510_return_status(struct dvb_usb_device *d) + { +- int ret = 0; ++ int ret; + u8 *data; + +- data = kzalloc(10, GFP_KERNEL); ++ data = kzalloc(6, GFP_KERNEL); + if (!data) + return -ENOMEM; + +- ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), +- 0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200); +- info("Firmware Status: %x (%x)", ret , data[2]); ++ ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), ++ 0x06, 0x80, 0x0302, 0x00, ++ data, 0x6, 200); ++ if (ret != 6) ++ ret = -EINVAL; ++ else ++ ret = data[2]; ++ ++ info("Firmware Status: %6ph", data); + +- ret = (ret < 0) ? -ENODEV : data[2]; + kfree(data); + return ret; + } +@@ -1078,8 +1083,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap) + + if (adap->fe[0]) { + info("FE Found M88RS2000"); +- dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config, +- &d->i2c_adap); + st->i2c_tuner_gate_w = 5; + st->i2c_tuner_gate_r = 5; + st->i2c_tuner_addr = 0x60; +@@ -1145,17 +1148,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap) + ret = st->tuner_config; + break; + case TUNER_RS2000: +- ret = st->tuner_config; ++ if (dvb_attach(ts2020_attach, adap->fe[0], ++ &ts2020_config, &d->i2c_adap)) ++ ret = st->tuner_config; + break; + default: + break; + } + +- if (ret) ++ if (ret) { + info("TUN Found %s tuner", tun_msg[ret]); +- else { +- info("TUN No tuner found --- resetting device"); +- lme_coldreset(d); ++ } else { ++ info("TUN No tuner found"); + return -ENODEV; + } + +@@ -1199,6 +1203,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d) + static int lme2510_identify_state(struct dvb_usb_device *d, const char **name) + { + struct lme2510_state *st = d->priv; ++ int status; + + usb_reset_configuration(d->udev); + +@@ -1207,12 +1212,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name) + + st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware; + +- if (lme2510_return_status(d) == 0x44) { ++ status = lme2510_return_status(d); ++ if (status == 0x44) { + *name = lme_firmware_switch(d, 0); + return COLD; + } + +- return 0; ++ if (status != 0x47) ++ return -EINVAL; ++ ++ return WARM; + } + + static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type, +diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c +index ab7151181728..d00b27ed73a6 100644 +--- a/drivers/media/usb/dvb-usb/cxusb.c ++++ b/drivers/media/usb/dvb-usb/cxusb.c +@@ -818,6 +818,8 @@ static int dvico_bluebird_xc2028_callback(void *ptr, int component, + case XC2028_RESET_CLK: + deb_info("%s: XC2028_RESET_CLK %d\n", __func__, arg); + break; ++ case XC2028_I2C_FLUSH: ++ break; + default: + deb_info("%s: unknown command %d, arg %d\n", __func__, + command, arg); +diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c +index 7df0707a0455..38c03283a441 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_devices.c ++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c +@@ -431,6 +431,7 @@ static int stk7700ph_xc3028_callback(void *ptr, int component, + state->dib7000p_ops.set_gpio(adap->fe_adap[0].fe, 8, 0, 1); + break; + case XC2028_RESET_CLK: ++ case XC2028_I2C_FLUSH: + break; + default: + err("%s: unknown command %d, arg %d\n", __func__, +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 4379b949bb93..943f90e392a7 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -18,8 +18,18 @@ + #include + #include + #include ++#include ++#include + #include + ++/* Use the same argument order as copy_in_user */ ++#define assign_in_user(to, from) \ ++({ \ ++ typeof(*from) __assign_tmp; \ ++ \ ++ get_user(__assign_tmp, from) || put_user(__assign_tmp, to); \ ++}) ++ + static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { + long ret = -ENOIOCTLCMD; +@@ -33,131 +43,88 @@ static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + struct v4l2_clip32 { + struct v4l2_rect c; +- compat_caddr_t next; ++ compat_caddr_t next; + }; + + struct v4l2_window32 { + struct v4l2_rect w; +- __u32 field; /* enum v4l2_field */ ++ __u32 field; /* enum v4l2_field */ + __u32 chromakey; + compat_caddr_t clips; /* actually struct v4l2_clip32 * */ + __u32 clipcount; + compat_caddr_t bitmap; ++ __u8 global_alpha; + }; + +-static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) +-{ +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_window32)) || +- copy_from_user(&kp->w, &up->w, sizeof(up->w)) || +- get_user(kp->field, &up->field) || +- get_user(kp->chromakey, &up->chromakey) || +- get_user(kp->clipcount, &up->clipcount)) +- return -EFAULT; +- if (kp->clipcount > 2048) +- return -EINVAL; +- if (kp->clipcount) { +- struct v4l2_clip32 __user *uclips; +- struct v4l2_clip __user *kclips; +- int n = kp->clipcount; +- compat_caddr_t p; +- +- if (get_user(p, &up->clips)) +- return -EFAULT; +- uclips = compat_ptr(p); +- kclips = compat_alloc_user_space(n * sizeof(struct v4l2_clip)); +- kp->clips = kclips; +- while (--n >= 0) { +- if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) +- return -EFAULT; +- if (put_user(n ? kclips + 1 : NULL, &kclips->next)) +- return -EFAULT; +- uclips += 1; +- kclips += 1; +- } +- } else +- kp->clips = NULL; +- return 0; +-} +- +-static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) +-{ +- if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) || +- put_user(kp->field, &up->field) || +- put_user(kp->chromakey, &up->chromakey) || +- put_user(kp->clipcount, &up->clipcount)) +- return -EFAULT; +- return 0; +-} +- +-static inline int get_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up) +-{ +- if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format))) +- return -EFAULT; +- return 0; +-} +- +-static inline int get_v4l2_pix_format_mplane(struct v4l2_pix_format_mplane *kp, +- struct v4l2_pix_format_mplane __user *up) +-{ +- if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format_mplane))) +- return -EFAULT; +- return 0; +-} +- +-static inline int put_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up) +-{ +- if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format))) +- return -EFAULT; +- return 0; +-} +- +-static inline int put_v4l2_pix_format_mplane(struct v4l2_pix_format_mplane *kp, +- struct v4l2_pix_format_mplane __user *up) ++static int get_v4l2_window32(struct v4l2_window __user *kp, ++ struct v4l2_window32 __user *up, ++ void __user *aux_buf, u32 aux_space) + { +- if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format_mplane))) ++ struct v4l2_clip32 __user *uclips; ++ struct v4l2_clip __user *kclips; ++ compat_caddr_t p; ++ u32 clipcount; ++ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ copy_in_user(&kp->w, &up->w, sizeof(up->w)) || ++ assign_in_user(&kp->field, &up->field) || ++ assign_in_user(&kp->chromakey, &up->chromakey) || ++ assign_in_user(&kp->global_alpha, &up->global_alpha) || ++ get_user(clipcount, &up->clipcount) || ++ put_user(clipcount, &kp->clipcount)) + return -EFAULT; +- return 0; +-} ++ if (clipcount > 2048) ++ return -EINVAL; ++ if (!clipcount) ++ return put_user(NULL, &kp->clips); + +-static inline int get_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up) +-{ +- if (copy_from_user(kp, up, sizeof(struct v4l2_vbi_format))) ++ if (get_user(p, &up->clips)) + return -EFAULT; +- return 0; +-} +- +-static inline int put_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up) +-{ +- if (copy_to_user(up, kp, sizeof(struct v4l2_vbi_format))) ++ uclips = compat_ptr(p); ++ if (aux_space < clipcount * sizeof(*kclips)) + return -EFAULT; +- return 0; +-} +- +-static inline int get_v4l2_sliced_vbi_format(struct v4l2_sliced_vbi_format *kp, struct v4l2_sliced_vbi_format __user *up) +-{ +- if (copy_from_user(kp, up, sizeof(struct v4l2_sliced_vbi_format))) ++ kclips = aux_buf; ++ if (put_user(kclips, &kp->clips)) + return -EFAULT; +- return 0; +-} + +-static inline int put_v4l2_sliced_vbi_format(struct v4l2_sliced_vbi_format *kp, struct v4l2_sliced_vbi_format __user *up) +-{ +- if (copy_to_user(up, kp, sizeof(struct v4l2_sliced_vbi_format))) +- return -EFAULT; ++ while (clipcount--) { ++ if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) ++ return -EFAULT; ++ if (put_user(clipcount ? kclips + 1 : NULL, &kclips->next)) ++ return -EFAULT; ++ uclips++; ++ kclips++; ++ } + return 0; + } + +-static inline int get_v4l2_sdr_format(struct v4l2_sdr_format *kp, struct v4l2_sdr_format __user *up) ++static int put_v4l2_window32(struct v4l2_window __user *kp, ++ struct v4l2_window32 __user *up) + { +- if (copy_from_user(kp, up, sizeof(struct v4l2_sdr_format))) ++ struct v4l2_clip __user *kclips = kp->clips; ++ struct v4l2_clip32 __user *uclips; ++ compat_caddr_t p; ++ u32 clipcount; ++ ++ if (copy_in_user(&up->w, &kp->w, sizeof(kp->w)) || ++ assign_in_user(&up->field, &kp->field) || ++ assign_in_user(&up->chromakey, &kp->chromakey) || ++ assign_in_user(&up->global_alpha, &kp->global_alpha) || ++ get_user(clipcount, &kp->clipcount) || ++ put_user(clipcount, &up->clipcount)) + return -EFAULT; +- return 0; +-} ++ if (!clipcount) ++ return 0; + +-static inline int put_v4l2_sdr_format(struct v4l2_sdr_format *kp, struct v4l2_sdr_format __user *up) +-{ +- if (copy_to_user(up, kp, sizeof(struct v4l2_sdr_format))) ++ if (get_user(p, &up->clips)) + return -EFAULT; ++ uclips = compat_ptr(p); ++ while (clipcount--) { ++ if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c))) ++ return -EFAULT; ++ uclips++; ++ kclips++; ++ } + return 0; + } + +@@ -173,15 +173,52 @@ struct v4l2_create_buffers32 { + __u32 reserved[8]; + }; + +-static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) ++static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size) + { +- if (get_user(kp->type, &up->type)) ++ u32 type; ++ ++ if (get_user(type, &up->type)) ++ return -EFAULT; ++ ++ switch (type) { ++ case V4L2_BUF_TYPE_VIDEO_OVERLAY: ++ case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: { ++ u32 clipcount; ++ ++ if (get_user(clipcount, &up->fmt.win.clipcount)) ++ return -EFAULT; ++ if (clipcount > 2048) ++ return -EINVAL; ++ *size = clipcount * sizeof(struct v4l2_clip); ++ return 0; ++ } ++ default: ++ *size = 0; ++ return 0; ++ } ++} ++ ++static int bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size) ++{ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up))) ++ return -EFAULT; ++ return __bufsize_v4l2_format(up, size); ++} ++ ++static int __get_v4l2_format32(struct v4l2_format __user *kp, ++ struct v4l2_format32 __user *up, ++ void __user *aux_buf, u32 aux_space) ++{ ++ u32 type; ++ ++ if (get_user(type, &up->type) || put_user(type, &kp->type)) + return -EFAULT; + +- switch (kp->type) { ++ switch (type) { + case V4L2_BUF_TYPE_VIDEO_CAPTURE: + case V4L2_BUF_TYPE_VIDEO_OUTPUT: +- return get_v4l2_pix_format(&kp->fmt.pix, &up->fmt.pix); ++ return copy_in_user(&kp->fmt.pix, &up->fmt.pix, ++ sizeof(kp->fmt.pix)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE: + return get_v4l2_pix_format_mplane(&kp->fmt.pix_mp, +@@ -191,85 +228,107 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us + return get_v4l2_window32(&kp->fmt.win, &up->fmt.win); + case V4L2_BUF_TYPE_VBI_CAPTURE: + case V4L2_BUF_TYPE_VBI_OUTPUT: +- return get_v4l2_vbi_format(&kp->fmt.vbi, &up->fmt.vbi); ++ return copy_in_user(&kp->fmt.vbi, &up->fmt.vbi, ++ sizeof(kp->fmt.vbi)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE: + case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT: +- return get_v4l2_sliced_vbi_format(&kp->fmt.sliced, &up->fmt.sliced); ++ return copy_in_user(&kp->fmt.sliced, &up->fmt.sliced, ++ sizeof(kp->fmt.sliced)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_SDR_CAPTURE: + case V4L2_BUF_TYPE_SDR_OUTPUT: +- return get_v4l2_sdr_format(&kp->fmt.sdr, &up->fmt.sdr); ++ return copy_in_user(&kp->fmt.sdr, &up->fmt.sdr, ++ sizeof(kp->fmt.sdr)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_META_CAPTURE: + case V4L2_BUF_TYPE_META_OUTPUT: + return get_v4l2_meta_format(&kp->fmt.meta, &up->fmt.meta); + default: +- pr_info("compat_ioctl32: unexpected VIDIOC_FMT type %d\n", +- kp->type); + return -EINVAL; + } + } + +-static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) ++static int get_v4l2_format32(struct v4l2_format __user *kp, ++ struct v4l2_format32 __user *up, ++ void __user *aux_buf, u32 aux_space) ++{ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up))) ++ return -EFAULT; ++ return __get_v4l2_format32(kp, up, aux_buf, aux_space); ++} ++ ++static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *up, ++ u32 *size) + { +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32))) ++ if (!access_ok(VERIFY_READ, up, sizeof(*up))) + return -EFAULT; +- return __get_v4l2_format32(kp, up); ++ return __bufsize_v4l2_format(&up->format, size); + } + +-static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up) ++static int get_v4l2_create32(struct v4l2_create_buffers __user *kp, ++ struct v4l2_create_buffers32 __user *up, ++ void __user *aux_buf, u32 aux_space) + { +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) || +- copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format))) ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ copy_in_user(kp, up, ++ offsetof(struct v4l2_create_buffers32, format))) + return -EFAULT; +- return __get_v4l2_format32(&kp->format, &up->format); ++ return __get_v4l2_format32(&kp->format, &up->format, ++ aux_buf, aux_space); + } + +-static int __put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) ++static int __put_v4l2_format32(struct v4l2_format __user *kp, ++ struct v4l2_format32 __user *up) + { +- if (put_user(kp->type, &up->type)) ++ u32 type; ++ if (get_user(type, &kp->type)) + return -EFAULT; + +- switch (kp->type) { ++ switch (type) { + case V4L2_BUF_TYPE_VIDEO_CAPTURE: + case V4L2_BUF_TYPE_VIDEO_OUTPUT: +- return put_v4l2_pix_format(&kp->fmt.pix, &up->fmt.pix); ++ return copy_in_user(&up->fmt.pix, &kp->fmt.pix, ++ sizeof(kp->fmt.pix)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE: +- return put_v4l2_pix_format_mplane(&kp->fmt.pix_mp, +- &up->fmt.pix_mp); ++ return copy_in_user(&up->fmt.pix_mp, &kp->fmt.pix_mp, ++ sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_VIDEO_OVERLAY: + case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: + return put_v4l2_window32(&kp->fmt.win, &up->fmt.win); + case V4L2_BUF_TYPE_VBI_CAPTURE: + case V4L2_BUF_TYPE_VBI_OUTPUT: +- return put_v4l2_vbi_format(&kp->fmt.vbi, &up->fmt.vbi); ++ return copy_in_user(&up->fmt.vbi, &kp->fmt.vbi, ++ sizeof(kp->fmt.vbi)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE: + case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT: +- return put_v4l2_sliced_vbi_format(&kp->fmt.sliced, &up->fmt.sliced); ++ return copy_in_user(&up->fmt.sliced, &kp->fmt.sliced, ++ sizeof(kp->fmt.sliced)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_SDR_CAPTURE: + case V4L2_BUF_TYPE_SDR_OUTPUT: +- return put_v4l2_sdr_format(&kp->fmt.sdr, &up->fmt.sdr); ++ return copy_in_user(&up->fmt.sdr, &kp->fmt.sdr, ++ sizeof(kp->fmt.sdr)) ? -EFAULT : 0; + case V4L2_BUF_TYPE_META_CAPTURE: + case V4L2_BUF_TYPE_META_OUTPUT: + return put_v4l2_meta_format(&kp->fmt.meta, &up->fmt.meta); + default: +- pr_info("compat_ioctl32: unexpected VIDIOC_FMT type %d\n", +- kp->type); + return -EINVAL; + } + } + +-static int put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) ++static int put_v4l2_format32(struct v4l2_format __user *kp, ++ struct v4l2_format32 __user *up) + { +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_format32))) ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up))) + return -EFAULT; + return __put_v4l2_format32(kp, up); + } + +-static int put_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up) ++static int put_v4l2_create32(struct v4l2_create_buffers __user *kp, ++ struct v4l2_create_buffers32 __user *up) + { +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_create_buffers32)) || +- copy_to_user(up, kp, offsetof(struct v4l2_create_buffers32, format)) || +- copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved))) ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ copy_in_user(up, kp, ++ offsetof(struct v4l2_create_buffers32, format)) || ++ copy_in_user(up->reserved, kp->reserved, sizeof(kp->reserved))) + return -EFAULT; + return __put_v4l2_format32(&kp->format, &up->format); + } +@@ -295,25 +323,28 @@ struct v4l2_standard32 { + __u32 reserved[4]; + }; + +-static int get_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up) ++static int get_v4l2_standard32(struct v4l2_standard __user *kp, ++ struct v4l2_standard32 __user *up) + { + /* other fields are not set by the user, nor used by the driver */ +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_standard32)) || +- get_user(kp->index, &up->index)) ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ assign_in_user(&kp->index, &up->index)) + return -EFAULT; + return 0; + } + +-static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up) ++static int put_v4l2_standard32(struct v4l2_standard __user *kp, ++ struct v4l2_standard32 __user *up) + { +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) || +- put_user(kp->index, &up->index) || +- put_user(kp->id, &up->id) || +- copy_to_user(up->name, kp->name, 24) || +- copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) || +- put_user(kp->framelines, &up->framelines) || +- copy_to_user(up->reserved, kp->reserved, 4 * sizeof(__u32))) +- return -EFAULT; ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ assign_in_user(&up->index, &kp->index) || ++ assign_in_user(&up->id, &kp->id) || ++ copy_in_user(up->name, kp->name, sizeof(up->name)) || ++ copy_in_user(&up->frameperiod, &kp->frameperiod, ++ sizeof(up->frameperiod)) || ++ assign_in_user(&up->framelines, &kp->framelines) || ++ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) ++ return -EFAULT; + return 0; + } + +@@ -352,134 +383,186 @@ struct v4l2_buffer32 { + __u32 reserved; + }; + +-static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32, +- enum v4l2_memory memory) ++static int get_v4l2_plane32(struct v4l2_plane __user *up, ++ struct v4l2_plane32 __user *up32, ++ enum v4l2_memory memory) + { +- void __user *up_pln; +- compat_long_t p; ++ compat_ulong_t p; + + if (copy_in_user(up, up32, 2 * sizeof(__u32)) || +- copy_in_user(&up->data_offset, &up32->data_offset, +- sizeof(__u32))) ++ copy_in_user(&up->data_offset, &up32->data_offset, ++ sizeof(up->data_offset))) + return -EFAULT; + +- if (memory == V4L2_MEMORY_USERPTR) { +- if (get_user(p, &up32->m.userptr)) +- return -EFAULT; +- up_pln = compat_ptr(p); +- if (put_user((unsigned long)up_pln, &up->m.userptr)) ++ switch (memory) { ++ case V4L2_MEMORY_MMAP: ++ case V4L2_MEMORY_OVERLAY: ++ if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, ++ sizeof(up32->m.mem_offset))) + return -EFAULT; +- } else if (memory == V4L2_MEMORY_DMABUF) { +- if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(int))) ++ break; ++ case V4L2_MEMORY_USERPTR: ++ if (get_user(p, &up32->m.userptr) || ++ put_user((unsigned long)compat_ptr(p), &up->m.userptr)) + return -EFAULT; +- } else { +- if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, +- sizeof(__u32))) ++ break; ++ case V4L2_MEMORY_DMABUF: ++ if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd))) + return -EFAULT; ++ break; + } + + return 0; + } + +-static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32, +- enum v4l2_memory memory) ++static int put_v4l2_plane32(struct v4l2_plane __user *up, ++ struct v4l2_plane32 __user *up32, ++ enum v4l2_memory memory) + { ++ unsigned long p; ++ + if (copy_in_user(up32, up, 2 * sizeof(__u32)) || +- copy_in_user(&up32->data_offset, &up->data_offset, +- sizeof(__u32))) ++ copy_in_user(&up32->data_offset, &up->data_offset, ++ sizeof(up->data_offset))) + return -EFAULT; + +- /* For MMAP, driver might've set up the offset, so copy it back. +- * USERPTR stays the same (was userspace-provided), so no copying. */ +- if (memory == V4L2_MEMORY_MMAP) ++ switch (memory) { ++ case V4L2_MEMORY_MMAP: ++ case V4L2_MEMORY_OVERLAY: + if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset, +- sizeof(__u32))) ++ sizeof(up->m.mem_offset))) + return -EFAULT; +- /* For DMABUF, driver might've set up the fd, so copy it back. */ +- if (memory == V4L2_MEMORY_DMABUF) +- if (copy_in_user(&up32->m.fd, &up->m.fd, +- sizeof(int))) ++ break; ++ case V4L2_MEMORY_USERPTR: ++ if (get_user(p, &up->m.userptr) || ++ put_user((compat_ulong_t)ptr_to_compat((__force void *)p), ++ &up32->m.userptr)) ++ return -EFAULT; ++ break; ++ case V4L2_MEMORY_DMABUF: ++ if (copy_in_user(&up32->m.fd, &up->m.fd, sizeof(up->m.fd))) + return -EFAULT; ++ break; ++ } + + return 0; + } + +-static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user *up) ++static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size) + { ++ u32 type; ++ u32 length; ++ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ get_user(type, &up->type) || ++ get_user(length, &up->length)) ++ return -EFAULT; ++ ++ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { ++ if (length > VIDEO_MAX_PLANES) ++ return -EINVAL; ++ ++ /* ++ * We don't really care if userspace decides to kill itself ++ * by passing a very big length value ++ */ ++ *size = length * sizeof(struct v4l2_plane); ++ } else { ++ *size = 0; ++ } ++ return 0; ++} ++ ++static int get_v4l2_buffer32(struct v4l2_buffer __user *kp, ++ struct v4l2_buffer32 __user *up, ++ void __user *aux_buf, u32 aux_space) ++{ ++ u32 type; ++ u32 length; ++ enum v4l2_memory memory; + struct v4l2_plane32 __user *uplane32; + struct v4l2_plane __user *uplane; + compat_caddr_t p; +- int num_planes; + int ret; + +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_buffer32)) || +- get_user(kp->index, &up->index) || +- get_user(kp->type, &up->type) || +- get_user(kp->flags, &up->flags) || +- get_user(kp->memory, &up->memory) || +- get_user(kp->length, &up->length)) +- return -EFAULT; ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ assign_in_user(&kp->index, &up->index) || ++ get_user(type, &up->type) || ++ put_user(type, &kp->type) || ++ assign_in_user(&kp->flags, &up->flags) || ++ get_user(memory, &up->memory) || ++ put_user(memory, &kp->memory) || ++ get_user(length, &up->length) || ++ put_user(length, &kp->length)) ++ return -EFAULT; + +- if (V4L2_TYPE_IS_OUTPUT(kp->type)) +- if (get_user(kp->bytesused, &up->bytesused) || +- get_user(kp->field, &up->field) || +- get_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || +- get_user(kp->timestamp.tv_usec, +- &up->timestamp.tv_usec)) ++ if (V4L2_TYPE_IS_OUTPUT(type)) ++ if (assign_in_user(&kp->bytesused, &up->bytesused) || ++ assign_in_user(&kp->field, &up->field) || ++ assign_in_user(&kp->timestamp.tv_sec, ++ &up->timestamp.tv_sec) || ++ assign_in_user(&kp->timestamp.tv_usec, ++ &up->timestamp.tv_usec)) + return -EFAULT; + +- if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- num_planes = kp->length; ++ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { ++ u32 num_planes = length; ++ + if (num_planes == 0) { +- kp->m.planes = NULL; +- /* num_planes == 0 is legal, e.g. when userspace doesn't +- * need planes array on DQBUF*/ +- return 0; ++ /* ++ * num_planes == 0 is legal, e.g. when userspace doesn't ++ * need planes array on DQBUF ++ */ ++ return put_user(NULL, &kp->m.planes); + } ++ if (num_planes > VIDEO_MAX_PLANES) ++ return -EINVAL; + + if (get_user(p, &up->m.planes)) + return -EFAULT; + + uplane32 = compat_ptr(p); + if (!access_ok(VERIFY_READ, uplane32, +- num_planes * sizeof(struct v4l2_plane32))) ++ num_planes * sizeof(*uplane32))) + return -EFAULT; + +- /* We don't really care if userspace decides to kill itself +- * by passing a very big num_planes value */ +- uplane = compat_alloc_user_space(num_planes * +- sizeof(struct v4l2_plane)); +- kp->m.planes = (__force struct v4l2_plane *)uplane; ++ /* ++ * We don't really care if userspace decides to kill itself ++ * by passing a very big num_planes value ++ */ ++ if (aux_space < num_planes * sizeof(*uplane)) ++ return -EFAULT; ++ ++ uplane = aux_buf; ++ if (put_user((__force struct v4l2_plane *)uplane, ++ &kp->m.planes)) ++ return -EFAULT; + +- while (--num_planes >= 0) { +- ret = get_v4l2_plane32(uplane, uplane32, kp->memory); ++ while (num_planes--) { ++ ret = get_v4l2_plane32(uplane, uplane32, memory); + if (ret) + return ret; +- ++uplane; +- ++uplane32; ++ uplane++; ++ uplane32++; + } + } else { +- switch (kp->memory) { ++ switch (memory) { + case V4L2_MEMORY_MMAP: +- if (get_user(kp->m.offset, &up->m.offset)) ++ case V4L2_MEMORY_OVERLAY: ++ if (assign_in_user(&kp->m.offset, &up->m.offset)) + return -EFAULT; + break; +- case V4L2_MEMORY_USERPTR: +- { +- compat_long_t tmp; ++ case V4L2_MEMORY_USERPTR: { ++ compat_ulong_t userptr; + +- if (get_user(tmp, &up->m.userptr)) +- return -EFAULT; +- +- kp->m.userptr = (unsigned long)compat_ptr(tmp); +- } +- break; +- case V4L2_MEMORY_OVERLAY: +- if (get_user(kp->m.offset, &up->m.offset)) ++ if (get_user(userptr, &up->m.userptr) || ++ put_user((unsigned long)compat_ptr(userptr), ++ &kp->m.userptr)) + return -EFAULT; + break; ++ } + case V4L2_MEMORY_DMABUF: +- if (get_user(kp->m.fd, &up->m.fd)) ++ if (assign_in_user(&kp->m.fd, &up->m.fd)) + return -EFAULT; + break; + } +@@ -531,65 +590,69 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp, + return 0; + } + +-static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user *up) ++static int put_v4l2_buffer32(struct v4l2_buffer __user *kp, ++ struct v4l2_buffer32 __user *up) + { ++ u32 type; ++ u32 length; ++ enum v4l2_memory memory; + struct v4l2_plane32 __user *uplane32; + struct v4l2_plane __user *uplane; + compat_caddr_t p; +- int num_planes; + int ret; + +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_buffer32)) || +- put_user(kp->index, &up->index) || +- put_user(kp->type, &up->type) || +- put_user(kp->flags, &up->flags) || +- put_user(kp->memory, &up->memory)) +- return -EFAULT; ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ assign_in_user(&up->index, &kp->index) || ++ get_user(type, &kp->type) || ++ put_user(type, &up->type) || ++ assign_in_user(&up->flags, &kp->flags) || ++ get_user(memory, &kp->memory) || ++ put_user(memory, &up->memory)) ++ return -EFAULT; + +- if (put_user(kp->bytesused, &up->bytesused) || +- put_user(kp->field, &up->field) || +- put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || +- put_user(kp->timestamp.tv_usec, &up->timestamp.tv_usec) || +- copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || +- put_user(kp->sequence, &up->sequence) || +- put_user(kp->config_store, &up->config_store) || +- put_user(kp->reserved, &up->reserved) || +- put_user(kp->length, &up->length)) +- return -EFAULT; ++ if (assign_in_user(&up->bytesused, &kp->bytesused) || ++ assign_in_user(&up->field, &kp->field) || ++ assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) || ++ assign_in_user(&up->timestamp.tv_usec, &kp->timestamp.tv_usec) || ++ copy_in_user(&up->timecode, &kp->timecode, sizeof(kp->timecode)) || ++ assign_in_user(&up->sequence, &kp->sequence) || ++ assign_in_user(&up->reserved2, &kp->reserved2) || ++ assign_in_user(&up->reserved, &kp->reserved) || ++ get_user(length, &kp->length) || ++ put_user(length, &up->length)) ++ return -EFAULT; ++ ++ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { + +- if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- num_planes = kp->length; + if (num_planes == 0) + return 0; + +- uplane = (__force struct v4l2_plane __user *)kp->m.planes; ++ if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes))) ++ return -EFAULT; + if (get_user(p, &up->m.planes)) + return -EFAULT; + uplane32 = compat_ptr(p); + +- while (--num_planes >= 0) { +- ret = put_v4l2_plane32(uplane, uplane32, kp->memory); +++ while (num_planes--) { +++ ret = put_v4l2_plane32(uplane, uplane32, memory); + if (ret) + return ret; + ++uplane; + ++uplane32; + } + } else { +- switch (kp->memory) { ++ switch (memory) { + case V4L2_MEMORY_MMAP: +- if (put_user(kp->m.offset, &up->m.offset)) ++ case V4L2_MEMORY_OVERLAY: ++ if (assign_in_user(&up->m.offset, &kp->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: +- if (put_user(kp->m.userptr, &up->m.userptr)) +- return -EFAULT; +- break; +- case V4L2_MEMORY_OVERLAY: +- if (put_user(kp->m.offset, &up->m.offset)) ++ if (assign_in_user(&up->m.userptr, &kp->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_DMABUF: +- if (put_user(kp->m.fd, &up->m.fd)) ++ if (assign_in_user(&up->m.fd, &kp->m.fd)) + return -EFAULT; + break; + } +@@ -558,7 +646,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + struct v4l2_framebuffer32 { + __u32 capability; + __u32 flags; +- compat_caddr_t base; ++ compat_caddr_t base; + struct { + __u32 width; + __u32 height; +@@ -571,30 +659,33 @@ struct v4l2_framebuffer32 { + } fmt; + }; + +-static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_framebuffer32 __user *up) ++static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp, ++ struct v4l2_framebuffer32 __user *up) + { +- u32 tmp; +- +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_framebuffer32)) || +- get_user(tmp, &up->base) || +- get_user(kp->capability, &up->capability) || +- get_user(kp->flags, &up->flags) || +- copy_from_user(&kp->fmt, &up->fmt, sizeof(up->fmt))) +- return -EFAULT; +- kp->base = (__force void *)compat_ptr(tmp); ++ compat_caddr_t tmp; ++ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ get_user(tmp, &up->base) || ++ put_user((__force void *)compat_ptr(tmp), &kp->base) || ++ assign_in_user(&kp->capability, &up->capability) || ++ assign_in_user(&kp->flags, &up->flags) || ++ copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt))) ++ return -EFAULT; + return 0; + } + +-static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_framebuffer32 __user *up) ++static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp, ++ struct v4l2_framebuffer32 __user *up) + { +- u32 tmp = (u32)((unsigned long)kp->base); +- +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_framebuffer32)) || +- put_user(tmp, &up->base) || +- put_user(kp->capability, &up->capability) || +- put_user(kp->flags, &up->flags) || +- copy_to_user(&up->fmt, &kp->fmt, sizeof(up->fmt))) +- return -EFAULT; ++ void *base; ++ ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ get_user(base, &kp->base) || ++ put_user(ptr_to_compat(base), &up->base) || ++ assign_in_user(&up->capability, &kp->capability) || ++ assign_in_user(&up->flags, &kp->flags) || ++ copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt))) ++ return -EFAULT; + return 0; + } + +@@ -606,21 +697,26 @@ struct v4l2_input32 { + __u32 tuner; /* Associated tuner */ + compat_u64 std; + __u32 status; +- __u32 reserved[4]; ++ __u32 capabilities; ++ __u32 reserved[3]; + }; + +-/* The 64-bit v4l2_input struct has extra padding at the end of the struct. +- Otherwise it is identical to the 32-bit version. */ +-static inline int get_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up) ++/* ++ * The 64-bit v4l2_input struct has extra padding at the end of the struct. ++ * Otherwise it is identical to the 32-bit version. ++ */ ++static inline int get_v4l2_input32(struct v4l2_input __user *kp, ++ struct v4l2_input32 __user *up) + { +- if (copy_from_user(kp, up, sizeof(struct v4l2_input32))) ++ if (copy_in_user(kp, up, sizeof(*up))) + return -EFAULT; + return 0; + } + +-static inline int put_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up) ++static inline int put_v4l2_input32(struct v4l2_input __user *kp, ++ struct v4l2_input32 __user *up) + { +- if (copy_to_user(up, kp, sizeof(struct v4l2_input32))) ++ if (copy_in_user(up, kp, sizeof(*up))) + return -EFAULT; + return 0; + } +@@ -695,58 +758,95 @@ struct v4l2_ext_control32 { + }; + } __attribute__ ((packed)); + +-/* The following function really belong in v4l2-common, but that causes +- a circular dependency between modules. We need to think about this, but +- for now this will do. */ +- +-/* Return non-zero if this control is a pointer type. Currently only +- type STRING is a pointer type. */ +-static inline int ctrl_is_pointer(u32 id) +++/* Return true if this control is a pointer type. */ +++static inline bool ctrl_is_pointer(struct file *file, u32 id) + { +- switch (id) { +- case V4L2_CID_RDS_TX_PS_NAME: +- case V4L2_CID_RDS_TX_RADIO_TEXT: +- return 1; +- default: +- return 0; ++ struct video_device *vdev = video_devdata(file); ++ struct v4l2_fh *fh = NULL; ++ struct v4l2_ctrl_handler *hdl = NULL; ++ struct v4l2_query_ext_ctrl qec = { id }; ++ const struct v4l2_ioctl_ops *ops = vdev->ioctl_ops; ++ ++ if (test_bit(V4L2_FL_USES_V4L2_FH, &vdev->flags)) ++ fh = file->private_data; ++ ++ if (fh && fh->ctrl_handler) ++ hdl = fh->ctrl_handler; ++ else if (vdev->ctrl_handler) ++ hdl = vdev->ctrl_handler; ++ ++ if (hdl) { ++ struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, id); ++ ++ + } ++ ++ if (!ops || !ops->vidioc_query_ext_ctrl) ++ return false; ++ ++ return !ops->vidioc_query_ext_ctrl(file, fh, &qec) && ++ (qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD); ++} ++ ++static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up, ++ u32 *size) ++{ ++ u32 count; ++ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ get_user(count, &up->count)) ++ return -EFAULT; ++ if (count > V4L2_CID_MAX_CTRLS) ++ return -EINVAL; ++ *size = count * sizeof(struct v4l2_ext_control); ++ return 0; + } + +-static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) ++static int get_v4l2_ext_controls32(struct file *file, ++ struct v4l2_ext_controls __user *kp, ++ struct v4l2_ext_controls32 __user *up, ++ void __user *aux_buf, u32 aux_space) + { + struct v4l2_ext_control32 __user *ucontrols; + struct v4l2_ext_control __user *kcontrols; +- int n; ++ u32 count; ++ u32 n; + compat_caddr_t p; + +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_ext_controls32)) || +- get_user(kp->which, &up->which) || +- get_user(kp->count, &up->count) || +- get_user(kp->error_idx, &up->error_idx) || +- copy_from_user(kp->reserved, up->reserved, +- sizeof(kp->reserved))) +- return -EFAULT; +- n = kp->count; +- if (n == 0) { +- kp->controls = NULL; +- return 0; +- } ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ assign_in_user(&kp->ctrl_class, &up->ctrl_class) || ++ get_user(count, &up->count) || ++ put_user(count, &kp->count) || ++ assign_in_user(&kp->error_idx, &up->error_idx) || ++ copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved))) ++ return -EFAULT; ++ ++ if (count == 0) ++ return put_user(NULL, &kp->controls); ++ if (count > V4L2_CID_MAX_CTRLS) ++ return -EINVAL; + if (get_user(p, &up->controls)) + return -EFAULT; + ucontrols = compat_ptr(p); +- if (!access_ok(VERIFY_READ, ucontrols, +- n * sizeof(struct v4l2_ext_control32))) ++ if (!access_ok(VERIFY_READ, ucontrols, count * sizeof(*ucontrols))) + return -EFAULT; +- kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control)); +- kp->controls = (__force struct v4l2_ext_control *)kcontrols; +- while (--n >= 0) { ++ if (aux_space < count * sizeof(*kcontrols)) ++ return -EFAULT; ++ kcontrols = aux_buf; ++ if (put_user((__force struct v4l2_ext_control *)kcontrols, ++ &kp->controls)) ++ return -EFAULT; ++ ++ for (n = 0; n < count; n++) { + u32 id; + + if (copy_in_user(kcontrols, ucontrols, sizeof(*ucontrols))) + return -EFAULT; ++ + if (get_user(id, &kcontrols->id)) + return -EFAULT; +- if (ctrl_is_pointer(id)) { ++ ++ if (ctrl_is_pointer(file, id)) { + void __user *s; + + if (get_user(p, &ucontrols->string)) +@@ -761,43 +861,56 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext + return 0; + } + +-static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) ++static int put_v4l2_ext_controls32(struct file *file, ++ struct v4l2_ext_controls __user *kp, ++ struct v4l2_ext_controls32 __user *up) + { + struct v4l2_ext_control32 __user *ucontrols; +- struct v4l2_ext_control __user *kcontrols = +- (__force struct v4l2_ext_control __user *)kp->controls; +- int n = kp->count; ++ struct v4l2_ext_control __user *kcontrols; ++ u32 count; ++ u32 n; + compat_caddr_t p; + +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_ext_controls32)) || +- put_user(kp->which, &up->which) || +- put_user(kp->count, &up->count) || +- put_user(kp->error_idx, &up->error_idx) || +- copy_to_user(up->reserved, kp->reserved, sizeof(up->reserved))) +- return -EFAULT; +- if (!kp->count) +- return 0; +++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || +++ assign_in_user(&up->ctrl_class, &kp->ctrl_class) || +++ get_user(count, &kp->count) || +++ put_user(count, &up->count) || +++ assign_in_user(&up->error_idx, &kp->error_idx) || +++ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) || +++ get_user(kcontrols, &kp->controls)) +++ return -EFAULT; ++ +++ if (!count) +++ return 0; + + if (get_user(p, &up->controls)) + return -EFAULT; + ucontrols = compat_ptr(p); +- if (!access_ok(VERIFY_WRITE, ucontrols, +- n * sizeof(struct v4l2_ext_control32))) ++ if (!access_ok(VERIFY_WRITE, ucontrols, count * sizeof(*ucontrols))) + return -EFAULT; + +- while (--n >= 0) { +- unsigned size = sizeof(*ucontrols); ++ for (n = 0; n < count; n++) { ++ unsigned int size = sizeof(*ucontrols); + u32 id; + +- if (get_user(id, &kcontrols->id)) ++ if (get_user(id, &kcontrols->id) || ++ put_user(id, &ucontrols->id) || ++ assign_in_user(&ucontrols->size, &kcontrols->size) || ++ copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2, ++ sizeof(ucontrols->reserved2))) + return -EFAULT; +- /* Do not modify the pointer when copying a pointer control. +- The contents of the pointer was changed, not the pointer +- itself. */ +- if (ctrl_is_pointer(id)) ++ ++ /* ++ * Do not modify the pointer when copying a pointer control. ++ * The contents of the pointer was changed, not the pointer ++ * itself. ++ */ ++ if (ctrl_is_pointer(file, id)) + size -= sizeof(ucontrols->value64); ++ + if (copy_in_user(ucontrols, kcontrols, size)) + return -EFAULT; ++ + ucontrols++; + kcontrols++; + } +@@ -766,18 +911,19 @@ struct v4l2_event32 { + __u32 reserved[8]; + }; + +-static int put_v4l2_event32(struct v4l2_event *kp, struct v4l2_event32 __user *up) ++static int put_v4l2_event32(struct v4l2_event __user *kp, ++ struct v4l2_event32 __user *up) + { +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_event32)) || +- put_user(kp->type, &up->type) || +- copy_to_user(&up->u, &kp->u, sizeof(kp->u)) || +- put_user(kp->pending, &up->pending) || +- put_user(kp->sequence, &up->sequence) || +- put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || +- put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) || +- put_user(kp->id, &up->id) || +- copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32))) +- return -EFAULT; ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ assign_in_user(&up->type, &kp->type) || ++ copy_in_user(&up->u, &kp->u, sizeof(kp->u)) || ++ assign_in_user(&up->pending, &kp->pending) || ++ assign_in_user(&up->sequence, &kp->sequence) || ++ assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) || ++ assign_in_user(&up->timestamp.tv_nsec, &kp->timestamp.tv_nsec) || ++ assign_in_user(&up->id, &kp->id) || ++ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) ++ return -EFAULT; + return 0; + } + +@@ -789,32 +935,35 @@ struct v4l2_edid32 { + compat_caddr_t edid; + }; + +-static int get_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) ++static int get_v4l2_edid32(struct v4l2_edid __user *kp, ++ struct v4l2_edid32 __user *up) + { +- u32 tmp; +- +- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_edid32)) || +- get_user(kp->pad, &up->pad) || +- get_user(kp->start_block, &up->start_block) || +- get_user(kp->blocks, &up->blocks) || +- get_user(tmp, &up->edid) || +- copy_from_user(kp->reserved, up->reserved, sizeof(kp->reserved))) +- return -EFAULT; +- kp->edid = (__force u8 *)compat_ptr(tmp); ++ compat_uptr_t tmp; ++ ++ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || ++ assign_in_user(&kp->pad, &up->pad) || ++ assign_in_user(&kp->start_block, &up->start_block) || ++ assign_in_user(&kp->blocks, &up->blocks) || ++ get_user(tmp, &up->edid) || ++ put_user(compat_ptr(tmp), &kp->edid) || ++ copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved))) ++ return -EFAULT; + return 0; + } + +-static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) ++static int put_v4l2_edid32(struct v4l2_edid __user *kp, ++ struct v4l2_edid32 __user *up) + { +- u32 tmp = (u32)((unsigned long)kp->edid); +- +- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_edid32)) || +- put_user(kp->pad, &up->pad) || +- put_user(kp->start_block, &up->start_block) || +- put_user(kp->blocks, &up->blocks) || +- put_user(tmp, &up->edid) || +- copy_to_user(up->reserved, kp->reserved, sizeof(up->reserved))) +- return -EFAULT; ++ void *edid; ++ ++ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || ++ assign_in_user(&up->pad, &kp->pad) || ++ assign_in_user(&up->start_block, &kp->start_block) || ++ assign_in_user(&up->blocks, &kp->blocks) || ++ get_user(edid, &kp->edid) || ++ put_user(ptr_to_compat(edid), &up->edid) || ++ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) ++ return -EFAULT; + return 0; + } + +@@ -830,7 +979,7 @@ static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) + #define VIDIOC_ENUMINPUT32 _IOWR('V', 26, struct v4l2_input32) + #define VIDIOC_G_EDID32 _IOWR('V', 40, struct v4l2_edid32) + #define VIDIOC_S_EDID32 _IOWR('V', 41, struct v4l2_edid32) +-#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32) ++#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32) + #define VIDIOC_G_EXT_CTRLS32 _IOWR('V', 71, struct v4l2_ext_controls32) + #define VIDIOC_S_EXT_CTRLS32 _IOWR('V', 72, struct v4l2_ext_controls32) + #define VIDIOC_TRY_EXT_CTRLS32 _IOWR('V', 73, struct v4l2_ext_controls32) +@@ -846,22 +995,23 @@ static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) + #define VIDIOC_G_OUTPUT32 _IOR ('V', 46, s32) + #define VIDIOC_S_OUTPUT32 _IOWR('V', 47, s32) + ++static int alloc_userspace(unsigned int size, u32 aux_space, ++ void __user **up_native) ++{ ++ *up_native = compat_alloc_user_space(size + aux_space); ++ if (!*up_native) ++ return -ENOMEM; ++ if (clear_user(*up_native, size)) ++ return -EFAULT; ++ return 0; ++} ++ + static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { +- union { +- struct v4l2_format v2f; +- struct v4l2_buffer v2b; +- struct v4l2_framebuffer v2fb; +- struct v4l2_input v2i; +- struct v4l2_standard v2s; +- struct v4l2_ext_controls v2ecs; +- struct v4l2_event v2ev; +- struct v4l2_create_buffers v2crt; +- struct v4l2_edid v2edid; +- unsigned long vx; +- int vi; +- } karg; + void __user *up = compat_ptr(arg); ++ void __user *up_native = NULL; ++ void __user *aux_buf; ++ u32 aux_space; + int compatible_arg = 1; + long err = 0; + +@@ -900,30 +1050,52 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar + case VIDIOC_STREAMOFF: + case VIDIOC_S_INPUT: + case VIDIOC_S_OUTPUT: +- err = get_user(karg.vi, (s32 __user *)up); ++ err = alloc_userspace(sizeof(unsigned int), 0, &up_native); ++ if (!err && assign_in_user((unsigned int __user *)up_native, ++ (compat_uint_t __user *)up)) ++ err = -EFAULT; + compatible_arg = 0; + break; + + case VIDIOC_G_INPUT: + case VIDIOC_G_OUTPUT: ++ err = alloc_userspace(sizeof(unsigned int), 0, &up_native); + compatible_arg = 0; + break; + + case VIDIOC_G_EDID: + case VIDIOC_S_EDID: +- err = get_v4l2_edid32(&karg.v2edid, up); ++ err = alloc_userspace(sizeof(struct v4l2_edid), 0, &up_native); ++ if (!err) ++ err = get_v4l2_edid32(up_native, up); + compatible_arg = 0; + break; + + case VIDIOC_G_FMT: + case VIDIOC_S_FMT: + case VIDIOC_TRY_FMT: +- err = get_v4l2_format32(&karg.v2f, up); ++ err = bufsize_v4l2_format(up, &aux_space); ++ if (!err) ++ err = alloc_userspace(sizeof(struct v4l2_format), ++ aux_space, &up_native); ++ if (!err) { ++ aux_buf = up_native + sizeof(struct v4l2_format); ++ err = get_v4l2_format32(up_native, up, ++ aux_buf, aux_space); ++ } + compatible_arg = 0; + break; + + case VIDIOC_CREATE_BUFS: +- err = get_v4l2_create32(&karg.v2crt, up); ++ err = bufsize_v4l2_create(up, &aux_space); ++ if (!err) ++ err = alloc_userspace(sizeof(struct v4l2_create_buffers), ++ aux_space, &up_native); ++ if (!err) { ++ aux_buf = up_native + sizeof(struct v4l2_create_buffers); ++ err = get_v4l2_create32(up_native, up, ++ aux_buf, aux_space); ++ } + compatible_arg = 0; + break; + +@@ -931,36 +1103,63 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar + case VIDIOC_QUERYBUF: + case VIDIOC_QBUF: + case VIDIOC_DQBUF: +- err = get_v4l2_buffer32(&karg.v2b, up); ++ err = bufsize_v4l2_buffer(up, &aux_space); ++ if (!err) ++ err = alloc_userspace(sizeof(struct v4l2_buffer), ++ aux_space, &up_native); ++ if (!err) { ++ aux_buf = up_native + sizeof(struct v4l2_buffer); ++ err = get_v4l2_buffer32(up_native, up, ++ aux_buf, aux_space); ++ } + compatible_arg = 0; + break; + + case VIDIOC_S_FBUF: +- err = get_v4l2_framebuffer32(&karg.v2fb, up); ++ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0, ++ &up_native); ++ if (!err) ++ err = get_v4l2_framebuffer32(up_native, up); + compatible_arg = 0; + break; + + case VIDIOC_G_FBUF: ++ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0, ++ &up_native); + compatible_arg = 0; + break; + + case VIDIOC_ENUMSTD: +- err = get_v4l2_standard32(&karg.v2s, up); ++ err = alloc_userspace(sizeof(struct v4l2_standard), 0, ++ &up_native); ++ if (!err) ++ err = get_v4l2_standard32(up_native, up); + compatible_arg = 0; + break; + + case VIDIOC_ENUMINPUT: +- err = get_v4l2_input32(&karg.v2i, up); ++ err = alloc_userspace(sizeof(struct v4l2_input), 0, &up_native); ++ if (!err) ++ err = get_v4l2_input32(up_native, up); + compatible_arg = 0; + break; + + case VIDIOC_G_EXT_CTRLS: + case VIDIOC_S_EXT_CTRLS: + case VIDIOC_TRY_EXT_CTRLS: +- err = get_v4l2_ext_controls32(&karg.v2ecs, up); ++ err = bufsize_v4l2_ext_controls(up, &aux_space); ++ if (!err) ++ err = alloc_userspace(sizeof(struct v4l2_ext_controls), ++ aux_space, &up_native); ++ if (!err) { ++ aux_buf = up_native + sizeof(struct v4l2_ext_controls); ++ err = get_v4l2_ext_controls32(file, up_native, up, ++ aux_buf, aux_space); ++ } + compatible_arg = 0; + break; + case VIDIOC_DQEVENT: ++ err = alloc_userspace(sizeof(struct v4l2_event), 0, &up_native); + compatible_arg = 0; + break; + } +@@ -969,22 +1168,26 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar + + if (compatible_arg) + err = native_ioctl(file, cmd, (unsigned long)up); +- else { +- mm_segment_t old_fs = get_fs(); ++ else ++ err = native_ioctl(file, cmd, (unsigned long)up_native); + +- set_fs(KERNEL_DS); +- err = native_ioctl(file, cmd, (unsigned long)&karg); +- set_fs(old_fs); +- } ++ if (err == -ENOTTY) ++ return err; + +- /* Special case: even after an error we need to put the +- results back for these ioctls since the error_idx will +- contain information on which control failed. */ ++ /* ++ * Special case: even after an error we need to put the ++ * results back for these ioctls since the error_idx will ++ * contain information on which control failed. ++ */ + switch (cmd) { + case VIDIOC_G_EXT_CTRLS: + case VIDIOC_S_EXT_CTRLS: + case VIDIOC_TRY_EXT_CTRLS: +- if (put_v4l2_ext_controls32(&karg.v2ecs, up)) ++ if (put_v4l2_ext_controls32(file, up_native, up)) ++ err = -EFAULT; ++ break; ++ case VIDIOC_S_EDID: ++ if (put_v4l2_edid32(up_native, up)) + err = -EFAULT; + break; + } +@@ -996,44 +1199,46 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar + case VIDIOC_S_OUTPUT: + case VIDIOC_G_INPUT: + case VIDIOC_G_OUTPUT: +- err = put_user(((s32)karg.vi), (s32 __user *)up); ++ if (assign_in_user((compat_uint_t __user *)up, ++ ((unsigned int __user *)up_native))) ++ err = -EFAULT; + break; + + case VIDIOC_G_FBUF: +- err = put_v4l2_framebuffer32(&karg.v2fb, up); ++ err = put_v4l2_framebuffer32(up_native, up); + break; + + case VIDIOC_DQEVENT: +- err = put_v4l2_event32(&karg.v2ev, up); ++ err = put_v4l2_event32(up_native, up); + break; + + case VIDIOC_G_EDID: +- case VIDIOC_S_EDID: +- err = put_v4l2_edid32(&karg.v2edid, up); ++ err = put_v4l2_edid32(up_native, up); + break; + + case VIDIOC_G_FMT: + case VIDIOC_S_FMT: + case VIDIOC_TRY_FMT: +- err = put_v4l2_format32(&karg.v2f, up); ++ err = put_v4l2_format32(up_native, up); + break; + + case VIDIOC_CREATE_BUFS: +- err = put_v4l2_create32(&karg.v2crt, up); ++ err = put_v4l2_create32(up_native, up); + break; + ++ case VIDIOC_PREPARE_BUF: + case VIDIOC_QUERYBUF: + case VIDIOC_QBUF: + case VIDIOC_DQBUF: +- err = put_v4l2_buffer32(&karg.v2b, up); ++ err = put_v4l2_buffer32(up_native, up); + break; + + case VIDIOC_ENUMSTD: +- err = put_v4l2_standard32(&karg.v2s, up); ++ err = put_v4l2_standard32(up_native, up); + break; + + case VIDIOC_ENUMINPUT: +- err = put_v4l2_input32(&karg.v2i, up); ++ err = put_v4l2_input32(up_native, up); + break; + } + return err; +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index 7486af2c8ae4..5e2a7e59f578 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -2783,8 +2783,11 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg, + + /* Handles IOCTL */ + err = func(file, cmd, parg); +- if (err == -ENOIOCTLCMD) ++ if (err == -ENOTTY || err == -ENOIOCTLCMD) { + err = -ENOTTY; ++ goto out; ++ } ++ + if (err == 0) { + if (cmd == VIDIOC_DQBUF) + trace_v4l2_dqbuf(video_devdata(file)->minor, parg); +diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c +index 6c441be8f893..bf23234d957e 100644 +--- a/drivers/media/v4l2-core/videobuf2-v4l2.c ++++ b/drivers/media/v4l2-core/videobuf2-v4l2.c +@@ -593,6 +593,12 @@ static int vb2_internal_dqbuf(struct vb2_queue *q, struct v4l2_buffer *b, + b->flags & V4L2_BUF_FLAG_LAST) + q->last_buffer_dequeued = true; + ++ /* ++ * After calling the VIDIOC_DQBUF V4L2_BUF_FLAG_DONE must be ++ * cleared. ++ */ ++ b->flags &= ~V4L2_BUF_FLAG_DONE; ++ + return ret; + } + +diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c +index 4a07ba1195b5..d125d19a35e4 100644 +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -1922,16 +1922,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host) + tmp &= ~ACC_CONTROL_PARTIAL_PAGE; + tmp &= ~ACC_CONTROL_RD_ERASED; + tmp &= ~ACC_CONTROL_FAST_PGM_RDIN; +- if (ctrl->features & BRCMNAND_HAS_PREFETCH) { +- /* +- * FIXME: Flash DMA + prefetch may see spurious erased-page ECC +- * errors +- */ +- if (has_flash_dma(ctrl)) +- tmp &= ~ACC_CONTROL_PREFETCH; +- else +- tmp |= ACC_CONTROL_PREFETCH; +- } ++ if (ctrl->features & BRCMNAND_HAS_PREFETCH) ++ tmp &= ~ACC_CONTROL_PREFETCH; ++ + nand_writereg(ctrl, offs, tmp); + + return 0; +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 7ba109e8cf88..27864c0863ef 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -2023,6 +2023,7 @@ static int nand_write_oob_syndrome(struct mtd_info *mtd, + static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, + struct mtd_oob_ops *ops) + { ++ unsigned int max_bitflips = 0; + int page, realpage, chipnr; + struct nand_chip *chip = mtd->priv; + struct mtd_ecc_stats stats; +@@ -2083,6 +2084,8 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, + nand_wait_ready(mtd); + } + ++ max_bitflips = max_t(unsigned int, max_bitflips, ret); ++ + readlen -= len; + if (!readlen) + break; +@@ -2108,7 +2111,7 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, + if (mtd->ecc_stats.failed - stats.failed) + return -EBADMSG; + +- return mtd->ecc_stats.corrected - stats.corrected ? -EUCLEAN : 0; ++ return max_bitflips; + } + + /** +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index 824711845c44..3bb9b34d9e77 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -1046,8 +1046,14 @@ static int sunxi_nand_hw_common_ecc_ctrl_init(struct mtd_info *mtd, + + /* Add ECC info retrieval from DT */ + for (i = 0; i < ARRAY_SIZE(strengths); i++) { +- if (ecc->strength <= strengths[i]) ++ if (ecc->strength <= strengths[i]) { ++ /* ++ * Update ecc->strength value with the actual strength ++ * that will be used by the ECC engine. ++ */ ++ ecc->strength = strengths[i]; + break; ++ } + } + + if (i >= ARRAY_SIZE(strengths)) { +diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c +index ebf46ad2d513..b2fb0528c092 100644 +--- a/drivers/mtd/ubi/block.c ++++ b/drivers/mtd/ubi/block.c +@@ -99,6 +99,8 @@ struct ubiblock { + + /* Linked list of all ubiblock instances */ + static LIST_HEAD(ubiblock_devices); ++static DEFINE_IDR(ubiblock_minor_idr); ++/* Protects ubiblock_devices and ubiblock_minor_idr */ + static DEFINE_MUTEX(devices_mutex); + static int ubiblock_major; + +@@ -354,8 +356,6 @@ static struct blk_mq_ops ubiblock_mq_ops = { + .map_queue = blk_mq_map_queue, + }; + +-static DEFINE_IDR(ubiblock_minor_idr); +- + int ubiblock_create(struct ubi_volume_info *vi) + { + struct ubiblock *dev; +@@ -368,14 +368,15 @@ int ubiblock_create(struct ubi_volume_info *vi) + /* Check that the volume isn't already handled */ + mutex_lock(&devices_mutex); + if (find_dev_nolock(vi->ubi_num, vi->vol_id)) { +- mutex_unlock(&devices_mutex); +- return -EEXIST; ++ ret = -EEXIST; ++ goto out_unlock; + } +- mutex_unlock(&devices_mutex); + + dev = kzalloc(sizeof(struct ubiblock), GFP_KERNEL); +- if (!dev) +- return -ENOMEM; ++ if (!dev) { ++ ret = -ENOMEM; ++ goto out_unlock; ++ } + + mutex_init(&dev->dev_mutex); + +@@ -440,14 +441,13 @@ int ubiblock_create(struct ubi_volume_info *vi) + goto out_free_queue; + } + +- mutex_lock(&devices_mutex); + list_add_tail(&dev->list, &ubiblock_devices); +- mutex_unlock(&devices_mutex); + + /* Must be the last step: anyone can call file ops from now on */ + add_disk(dev->gd); + dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)", + dev->ubi_num, dev->vol_id, vi->name); ++ mutex_unlock(&devices_mutex); + return 0; + + out_free_queue: +@@ -460,6 +460,8 @@ out_put_disk: + put_disk(dev->gd); + out_free_dev: + kfree(dev); ++out_unlock: ++ mutex_unlock(&devices_mutex); + + return ret; + } +@@ -481,30 +483,36 @@ static void ubiblock_cleanup(struct ubiblock *dev) + int ubiblock_remove(struct ubi_volume_info *vi) + { + struct ubiblock *dev; ++ int ret; + + mutex_lock(&devices_mutex); + dev = find_dev_nolock(vi->ubi_num, vi->vol_id); + if (!dev) { +- mutex_unlock(&devices_mutex); +- return -ENODEV; ++ ret = -ENODEV; ++ goto out_unlock; + } + + /* Found a device, let's lock it so we can check if it's busy */ + mutex_lock(&dev->dev_mutex); + if (dev->refcnt > 0) { +- mutex_unlock(&dev->dev_mutex); +- mutex_unlock(&devices_mutex); +- return -EBUSY; ++ ret = -EBUSY; ++ goto out_unlock_dev; + } + + /* Remove from device list */ + list_del(&dev->list); +- mutex_unlock(&devices_mutex); +- + ubiblock_cleanup(dev); + mutex_unlock(&dev->dev_mutex); ++ mutex_unlock(&devices_mutex); ++ + kfree(dev); + return 0; ++ ++out_unlock_dev: ++ mutex_unlock(&dev->dev_mutex); ++out_unlock: ++ mutex_unlock(&devices_mutex); ++ return ret; + } + + static int ubiblock_resize(struct ubi_volume_info *vi) +@@ -633,6 +641,7 @@ static void ubiblock_remove_all(void) + struct ubiblock *next; + struct ubiblock *dev; + ++ mutex_lock(&devices_mutex); + list_for_each_entry_safe(dev, next, &ubiblock_devices, list) { + /* The module is being forcefully removed */ + WARN_ON(dev->desc); +@@ -641,6 +650,7 @@ static void ubiblock_remove_all(void) + ubiblock_cleanup(dev); + kfree(dev); + } ++ mutex_unlock(&devices_mutex); + } + + int __init ubiblock_init(void) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index f9640d5ce6ba..b4f3cb55605e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -3850,7 +3850,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) + struct list_head *head = &mbx->cmd_q; + struct qlcnic_cmd_args *cmd = NULL; + +- spin_lock(&mbx->queue_lock); ++ spin_lock_bh(&mbx->queue_lock); + + while (!list_empty(head)) { + cmd = list_entry(head->next, struct qlcnic_cmd_args, list); +@@ -3861,7 +3861,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) + qlcnic_83xx_notify_cmd_completion(adapter, cmd); + } + +- spin_unlock(&mbx->queue_lock); ++ spin_unlock_bh(&mbx->queue_lock); + } + + static int qlcnic_83xx_check_mbx_status(struct qlcnic_adapter *adapter) +@@ -3897,12 +3897,12 @@ static void qlcnic_83xx_dequeue_mbx_cmd(struct qlcnic_adapter *adapter, + { + struct qlcnic_mailbox *mbx = adapter->ahw->mailbox; + +- spin_lock(&mbx->queue_lock); ++ spin_lock_bh(&mbx->queue_lock); + + list_del(&cmd->list); + mbx->num_cmds--; + +- spin_unlock(&mbx->queue_lock); ++ spin_unlock_bh(&mbx->queue_lock); + + qlcnic_83xx_notify_cmd_completion(adapter, cmd); + } +@@ -3967,7 +3967,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, + init_completion(&cmd->completion); + cmd->rsp_opcode = QLC_83XX_MBX_RESPONSE_UNKNOWN; + +- spin_lock(&mbx->queue_lock); ++ spin_lock_bh(&mbx->queue_lock); + + list_add_tail(&cmd->list, &mbx->cmd_q); + mbx->num_cmds++; +@@ -3975,7 +3975,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, + *timeout = cmd->total_cmds * QLC_83XX_MBX_TIMEOUT; + queue_work(mbx->work_q, &mbx->work); + +- spin_unlock(&mbx->queue_lock); ++ spin_unlock_bh(&mbx->queue_lock); + + return 0; + } +@@ -4071,15 +4071,15 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) + mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; + spin_unlock_irqrestore(&mbx->aen_lock, flags); + +- spin_lock(&mbx->queue_lock); ++ spin_lock_bh(&mbx->queue_lock); + + if (list_empty(head)) { +- spin_unlock(&mbx->queue_lock); ++ spin_unlock_bh(&mbx->queue_lock); + return; + } + cmd = list_entry(head->next, struct qlcnic_cmd_args, list); + +- spin_unlock(&mbx->queue_lock); ++ spin_unlock_bh(&mbx->queue_lock); + + mbx_ops->encode_cmd(adapter, cmd); + mbx_ops->nofity_fw(adapter, QLC_83XX_MBX_REQUEST); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 24155380e43c..3783c40f568b 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -1387,7 +1387,7 @@ DECLARE_RTL_COND(rtl_ocp_tx_cond) + { + void __iomem *ioaddr = tp->mmio_addr; + +- return RTL_R8(IBISR0) & 0x02; ++ return RTL_R8(IBISR0) & 0x20; + } + + static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) +@@ -1395,7 +1395,7 @@ static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) + void __iomem *ioaddr = tp->mmio_addr; + + RTL_W8(IBCR2, RTL_R8(IBCR2) & ~0x01); +- rtl_msleep_loop_wait_low(tp, &rtl_ocp_tx_cond, 50, 2000); ++ rtl_msleep_loop_wait_high(tp, &rtl_ocp_tx_cond, 50, 2000); + RTL_W8(IBISR0, RTL_R8(IBISR0) | 0x20); + RTL_W8(IBCR0, RTL_R8(IBCR0) & ~0x01); + } +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 1228d0da4075..72cb30828a12 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -825,6 +825,9 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + goto error2; + } + ++ /* Device-specific flags */ ++ ctx->drvflags = drvflags; ++ + /* + * Some Huawei devices have been observed to come out of reset in NDP32 mode. + * Let's check if this is the case, and set the device to NDP16 mode again if +@@ -873,9 +876,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + /* finish setting up the device specific data */ + cdc_ncm_setup(dev); + +- /* Device-specific flags */ +- ctx->drvflags = drvflags; +- + /* Allocate the delayed NDP if needed. */ + if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) { + ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL); +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index d6ceb8b91cd6..1c8aedf21370 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2976,10 +2976,16 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) + mutex_unlock(&dev->shutdown_lock); + } + +-static void nvme_dev_remove(struct nvme_dev *dev) ++static void nvme_remove_namespaces(struct nvme_dev *dev) + { + struct nvme_ns *ns, *next; + ++ list_for_each_entry_safe(ns, next, &dev->namespaces, list) ++ nvme_ns_remove(ns); ++} ++ ++static void nvme_dev_remove(struct nvme_dev *dev) ++{ + if (nvme_io_incapable(dev)) { + /* + * If the device is not capable of IO (surprise hot-removal, +@@ -2989,8 +2995,7 @@ static void nvme_dev_remove(struct nvme_dev *dev) + */ + nvme_dev_shutdown(dev); + } +- list_for_each_entry_safe(ns, next, &dev->namespaces, list) +- nvme_ns_remove(ns); ++ nvme_remove_namespaces(dev); + } + + static int nvme_setup_prp_pools(struct nvme_dev *dev) +@@ -3174,7 +3179,7 @@ static void nvme_probe_work(struct work_struct *work) + */ + if (dev->online_queues < 2) { + dev_warn(dev->dev, "IO queues not created\n"); +- nvme_dev_remove(dev); ++ nvme_remove_namespaces(dev); + } else { + nvme_unfreeze_queues(dev); + nvme_dev_add(dev); +diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c +index ad8c9b05572d..01656f1c6d65 100644 +--- a/drivers/usb/gadget/function/uvc_configfs.c ++++ b/drivers/usb/gadget/function/uvc_configfs.c +@@ -2202,7 +2202,7 @@ static struct configfs_item_operations uvc_item_ops = { + .release = uvc_attr_release, + }; + +-#define UVCG_OPTS_ATTR(cname, conv, str2u, uxx, vnoc, limit) \ ++#define UVCG_OPTS_ATTR(cname, aname, conv, str2u, uxx, vnoc, limit) \ + static ssize_t f_uvc_opts_##cname##_show( \ + struct config_item *item, char *page) \ + { \ +@@ -2245,16 +2245,16 @@ end: \ + return ret; \ + } \ + \ +-UVC_ATTR(f_uvc_opts_, cname, aname) ++UVC_ATTR(f_uvc_opts_, cname, cname) + + #define identity_conv(x) (x) + +-UVCG_OPTS_ATTR(streaming_interval, identity_conv, kstrtou8, u8, identity_conv, +- 16); +-UVCG_OPTS_ATTR(streaming_maxpacket, le16_to_cpu, kstrtou16, u16, le16_to_cpu, +- 3072); +-UVCG_OPTS_ATTR(streaming_maxburst, identity_conv, kstrtou8, u8, identity_conv, +- 15); ++UVCG_OPTS_ATTR(streaming_interval, streaming_interval, identity_conv, ++ kstrtou8, u8, identity_conv, 16); ++UVCG_OPTS_ATTR(streaming_maxpacket, streaming_maxpacket, le16_to_cpu, ++ kstrtou16, u16, le16_to_cpu, 3072); ++UVCG_OPTS_ATTR(streaming_maxburst, streaming_maxburst, identity_conv, ++ kstrtou8, u8, identity_conv, 15); + + #undef identity_conv + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 00d68945548e..2d96bfd34138 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -285,7 +285,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + case USB_PORT_FEAT_POWER: + usbip_dbg_vhci_rh( + " ClearPortFeature: USB_PORT_FEAT_POWER\n"); +- dum->port_status[rhport] = 0; ++ dum->port_status[rhport] &= ~USB_PORT_STAT_POWER; + dum->resuming = 0; + break; + case USB_PORT_FEAT_C_RESET: +diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c +index 1c7f41a65565..b9432fdec775 100644 +--- a/drivers/usb/usbip/vhci_sysfs.c ++++ b/drivers/usb/usbip/vhci_sysfs.c +@@ -53,7 +53,7 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, + * a security hole, the change is made to use sockfd instead. + */ + out += sprintf(out, +- "prt sta spd bus dev sockfd local_busid\n"); ++ "prt sta spd dev sockfd local_busid\n"); + + for (i = 0; i < VHCI_NPORTS; i++) { + struct vhci_device *vdev = port_to_vdev(i); +@@ -64,12 +64,11 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, + if (vdev->ud.status == VDEV_ST_USED) { + out += sprintf(out, "%03u %08x ", + vdev->speed, vdev->devid); +- out += sprintf(out, "%16p ", vdev->ud.tcp_socket); +- out += sprintf(out, "%06u", vdev->ud.sockfd); ++ out += sprintf(out, "%06u ", vdev->ud.sockfd); + out += sprintf(out, "%s", dev_name(&vdev->udev->dev)); + + } else +- out += sprintf(out, "000 000 000 000000 0-0"); ++ out += sprintf(out, "000 00000000 000000 0-0"); + + out += sprintf(out, "\n"); + spin_unlock(&vdev->ud.lock); +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 9eda69e40678..44a5a8777053 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -981,6 +981,7 @@ static long vhost_net_reset_owner(struct vhost_net *n) + } + vhost_net_stop(n, &tx_sock, &rx_sock); + vhost_net_flush(n); ++ vhost_dev_stop(&n->dev); + vhost_dev_reset_owner(&n->dev, memory); + vhost_net_vq_reset(n); + done: +diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c +index 29ef719a6a3c..d69ab1e28d7d 100644 +--- a/drivers/watchdog/imx2_wdt.c ++++ b/drivers/watchdog/imx2_wdt.c +@@ -161,15 +161,21 @@ static void imx2_wdt_timer_ping(unsigned long arg) + mod_timer(&wdev->timer, jiffies + wdog->timeout * HZ / 2); + } + +-static int imx2_wdt_set_timeout(struct watchdog_device *wdog, +- unsigned int new_timeout) ++static void __imx2_wdt_set_timeout(struct watchdog_device *wdog, ++ unsigned int new_timeout) + { + struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog); + +- wdog->timeout = new_timeout; +- + regmap_update_bits(wdev->regmap, IMX2_WDT_WCR, IMX2_WDT_WCR_WT, + WDOG_SEC_TO_COUNT(new_timeout)); ++} ++ ++static int imx2_wdt_set_timeout(struct watchdog_device *wdog, ++ unsigned int new_timeout) ++{ ++ __imx2_wdt_set_timeout(wdog, new_timeout); ++ ++ wdog->timeout = new_timeout; + return 0; + } + +@@ -353,7 +359,11 @@ static int imx2_wdt_suspend(struct device *dev) + + /* The watchdog IP block is running */ + if (imx2_wdt_is_running(wdev)) { +- imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME); ++ /* ++ * Don't update wdog->timeout, we'll restore the current value ++ * during resume. ++ */ ++ __imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME); + imx2_wdt_ping(wdog); + + /* The watchdog is not active */ +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index af1da85da509..86d209fc4992 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2015,7 +2015,15 @@ again: + goto out; + } + +- btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state); ++ ret = btrfs_set_extent_delalloc(inode, page_start, page_end, ++ &cached_state); ++ if (ret) { ++ mapping_set_error(page->mapping, ret); ++ end_extent_writepage(page, ret, page_start, page_end); ++ ClearPageChecked(page); ++ goto out; ++ } ++ + ClearPageChecked(page); + set_page_dirty(page); + out: +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index 4acbc390a7d6..1d707a67f8ac 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -306,9 +306,8 @@ int calc_lanman_hash(const char *password, const char *cryptkey, bool encrypt, + { + int i; + int rc; +- char password_with_pad[CIFS_ENCPWD_SIZE]; ++ char password_with_pad[CIFS_ENCPWD_SIZE] = {0}; + +- memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); + if (password) + strncpy(password_with_pad, password, CIFS_ENCPWD_SIZE); + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 0a2bf9462637..077ad3a06c9a 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1695,7 +1695,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, + tmp_end++; + if (!(tmp_end < end && tmp_end[1] == delim)) { + /* No it is not. Set the password to NULL */ +- kfree(vol->password); ++ kzfree(vol->password); + vol->password = NULL; + break; + } +@@ -1733,7 +1733,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, + options = end; + } + +- kfree(vol->password); ++ kzfree(vol->password); + /* Now build new password string */ + temp_len = strlen(value); + vol->password = kzalloc(temp_len+1, GFP_KERNEL); +@@ -4148,7 +4148,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) + reset_cifs_unix_caps(0, tcon, NULL, vol_info); + out: + kfree(vol_info->username); +- kfree(vol_info->password); ++ kzfree(vol_info->password); + kfree(vol_info); + + return tcon; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index ec2d07bb9beb..744be3c146f5 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -3241,20 +3241,18 @@ static const struct vm_operations_struct cifs_file_vm_ops = { + + int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma) + { +- int rc, xid; ++ int xid, rc = 0; + struct inode *inode = file_inode(file); + + xid = get_xid(); + +- if (!CIFS_CACHE_READ(CIFS_I(inode))) { ++ if (!CIFS_CACHE_READ(CIFS_I(inode))) + rc = cifs_zap_mapping(inode); +- if (rc) +- return rc; +- } +- +- rc = generic_file_mmap(file, vma); +- if (rc == 0) ++ if (!rc) ++ rc = generic_file_mmap(file, vma); ++ if (!rc) + vma->vm_ops = &cifs_file_vm_ops; ++ + free_xid(xid); + return rc; + } +@@ -3264,16 +3262,16 @@ int cifs_file_mmap(struct file *file, struct vm_area_struct *vma) + int rc, xid; + + xid = get_xid(); ++ + rc = cifs_revalidate_file(file); +- if (rc) { ++ if (rc) + cifs_dbg(FYI, "Validation prior to mmap failed, error=%d\n", + rc); +- free_xid(xid); +- return rc; +- } +- rc = generic_file_mmap(file, vma); +- if (rc == 0) ++ if (!rc) ++ rc = generic_file_mmap(file, vma); ++ if (!rc) + vma->vm_ops = &cifs_file_vm_ops; ++ + free_xid(xid); + return rc; + } +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 2396ab099849..0cc699d9b932 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -99,14 +99,11 @@ sesInfoFree(struct cifs_ses *buf_to_free) + kfree(buf_to_free->serverOS); + kfree(buf_to_free->serverDomain); + kfree(buf_to_free->serverNOS); +- if (buf_to_free->password) { +- memset(buf_to_free->password, 0, strlen(buf_to_free->password)); +- kfree(buf_to_free->password); +- } ++ kzfree(buf_to_free->password); + kfree(buf_to_free->user_name); + kfree(buf_to_free->domainName); +- kfree(buf_to_free->auth_key.response); +- kfree(buf_to_free); ++ kzfree(buf_to_free->auth_key.response); ++ kzfree(buf_to_free); + } + + struct cifs_tcon * +@@ -137,10 +134,7 @@ tconInfoFree(struct cifs_tcon *buf_to_free) + } + atomic_dec(&tconInfoAllocCount); + kfree(buf_to_free->nativeFileSystem); +- if (buf_to_free->password) { +- memset(buf_to_free->password, 0, strlen(buf_to_free->password)); +- kfree(buf_to_free->password); +- } ++ kzfree(buf_to_free->password); + kfree(buf_to_free); + } + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index f2ff60e58ec8..84614a5edb87 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -580,8 +580,7 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) + } + + /* check validate negotiate info response matches what we got earlier */ +- if (pneg_rsp->Dialect != +- cpu_to_le16(tcon->ses->server->vals->protocol_id)) ++ if (pneg_rsp->Dialect != cpu_to_le16(tcon->ses->server->dialect)) + goto vneg_out; + + if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode)) +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 4df1cb19a243..f0cabc8c96cb 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4417,6 +4417,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + inode->i_op = &ext4_symlink_inode_operations; + ext4_set_aops(inode); + } ++ inode_nohighmem(inode); + } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || + S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { + inode->i_op = &ext4_special_inode_operations; +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 4c36dca486cc..32960b3ecd4f 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3151,6 +3151,7 @@ static int ext4_symlink(struct inode *dir, + if ((disk_link.len > EXT4_N_BLOCKS * 4)) { + if (!encryption_required) + inode->i_op = &ext4_symlink_inode_operations; ++ inode_nohighmem(inode); + ext4_set_aops(inode); + /* + * We cannot call page_symlink() with transaction started +diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c +index e8e7af62ac95..287c3980fa0b 100644 +--- a/fs/ext4/symlink.c ++++ b/fs/ext4/symlink.c +@@ -45,7 +45,7 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook + cpage = read_mapping_page(inode->i_mapping, 0, NULL); + if (IS_ERR(cpage)) + return ERR_CAST(cpage); +- caddr = kmap(cpage); ++ caddr = page_address(cpage); + caddr[size] = 0; + } + +@@ -75,16 +75,12 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook + /* Null-terminate the name */ + if (res <= plen) + paddr[res] = '\0'; +- if (cpage) { +- kunmap(cpage); ++ if (cpage) + page_cache_release(cpage); +- } + return *cookie = paddr; + errout: +- if (cpage) { +- kunmap(cpage); ++ if (cpage) + page_cache_release(cpage); +- } + kfree(paddr); + return ERR_PTR(res); + } +diff --git a/fs/inode.c b/fs/inode.c +index b0edef500590..b95615f3fc50 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -2028,3 +2028,9 @@ void inode_set_flags(struct inode *inode, unsigned int flags, + new_flags) != old_flags)); + } + EXPORT_SYMBOL(inode_set_flags); ++ ++void inode_nohighmem(struct inode *inode) ++{ ++ mapping_set_gfp_mask(inode->i_mapping, GFP_USER); ++} ++EXPORT_SYMBOL(inode_nohighmem); +diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c +index 6e9a912d394c..6875bd5d35f6 100644 +--- a/fs/kernfs/file.c ++++ b/fs/kernfs/file.c +@@ -272,7 +272,7 @@ static ssize_t kernfs_fop_write(struct file *file, const char __user *user_buf, + { + struct kernfs_open_file *of = kernfs_of(file); + const struct kernfs_ops *ops; +- size_t len; ++ ssize_t len; + char *buf; + + if (of->atomic_write_len) { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 4b1d08f56aba..5fd3cf54b2b3 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -787,10 +787,8 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) + + spin_lock(&dreq->lock); + +- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) { +- dreq->flags = 0; ++ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) + dreq->error = hdr->error; +- } + if (dreq->error == 0) { + nfs_direct_good_bytes(dreq, hdr); + if (nfs_write_need_commit(hdr)) { +diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c +index 5ba22c6b0ffa..1ee62e62ea76 100644 +--- a/fs/nfs/nfs4idmap.c ++++ b/fs/nfs/nfs4idmap.c +@@ -567,9 +567,13 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, + struct idmap_msg *im; + struct idmap *idmap = (struct idmap *)aux; + struct key *key = cons->key; +- int ret = -ENOMEM; ++ int ret = -ENOKEY; ++ ++ if (!aux) ++ goto out1; + + /* msg and im are freed in idmap_pipe_destroy_msg */ ++ ret = -ENOMEM; + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + goto out1; +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 7af7bedd7c02..c8e75e5e6a67 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1943,7 +1943,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc, + nfs_pageio_reset_write_mds(desc); + mirror->pg_recoalesce = 1; + } +- hdr->release(hdr); ++ hdr->completion_ops->completion(hdr); + } + + static enum pnfs_try_status +@@ -2058,7 +2058,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc, + nfs_pageio_reset_read_mds(desc); + mirror->pg_recoalesce = 1; + } +- hdr->release(hdr); ++ hdr->completion_ops->completion(hdr); + } + + /* +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 7a9b6e347249..6e81a5b5858e 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1746,6 +1746,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data) + set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags); + next: + nfs_unlock_and_release_request(req); ++ /* Latency breaker */ ++ cond_resched(); + } + nfss = NFS_SERVER(data->inode); + if (atomic_long_read(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH) +diff --git a/fs/nsfs.c b/fs/nsfs.c +index 8f20d6016e20..914ca6b2794d 100644 +--- a/fs/nsfs.c ++++ b/fs/nsfs.c +@@ -95,6 +95,7 @@ slow: + return ERR_PTR(-ENOMEM); + } + d_instantiate(dentry, inode); ++ dentry->d_flags |= DCACHE_RCUACCESS; + dentry->d_fsdata = (void *)ns_ops; + d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); + if (d) { +diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c +index adcb1398c481..299a6e1d6b77 100644 +--- a/fs/overlayfs/readdir.c ++++ b/fs/overlayfs/readdir.c +@@ -441,10 +441,14 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end, + struct dentry *dentry = file->f_path.dentry; + struct file *realfile = od->realfile; + ++ /* Nothing to sync for lower */ ++ if (!OVL_TYPE_UPPER(ovl_path_type(dentry))) ++ return 0; ++ + /* + * Need to check if we started out being a lower dir, but got copied up + */ +- if (!od->is_upper && OVL_TYPE_UPPER(ovl_path_type(dentry))) { ++ if (!od->is_upper) { + struct inode *inode = file_inode(file); + + realfile = lockless_dereference(od->upperfile); +diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h +index 9779c35f8454..dab9569f22bf 100644 +--- a/include/crypto/internal/hash.h ++++ b/include/crypto/internal/hash.h +@@ -91,6 +91,8 @@ static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) + return alg->setkey != shash_no_setkey; + } + ++bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg); ++ + int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn, + struct hash_alg_common *alg, + struct crypto_instance *inst); +diff --git a/include/crypto/poly1305.h b/include/crypto/poly1305.h +index 894df59b74e4..d586f741cab5 100644 +--- a/include/crypto/poly1305.h ++++ b/include/crypto/poly1305.h +@@ -30,8 +30,6 @@ struct poly1305_desc_ctx { + }; + + int crypto_poly1305_init(struct shash_desc *desc); +-int crypto_poly1305_setkey(struct crypto_shash *tfm, +- const u8 *key, unsigned int keylen); + unsigned int crypto_poly1305_setdesckey(struct poly1305_desc_ctx *dctx, + const u8 *src, unsigned int srclen); + int crypto_poly1305_update(struct shash_desc *desc, +diff --git a/include/linux/fs.h b/include/linux/fs.h +index c8decb7075d6..f746a59fcc88 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3066,5 +3066,6 @@ static inline bool dir_relax(struct inode *inode) + } + + extern bool path_noexec(const struct path *path); ++extern void inode_nohighmem(struct inode *inode); + + #endif /* _LINUX_FS_H */ +diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h +index 806d0ab845e0..676d3d2a1a0a 100644 +--- a/include/linux/mtd/map.h ++++ b/include/linux/mtd/map.h +@@ -265,75 +265,67 @@ void map_destroy(struct mtd_info *mtd); + #define INVALIDATE_CACHED_RANGE(map, from, size) \ + do { if (map->inval_cache) map->inval_cache(map, from, size); } while (0) + +- +-static inline int map_word_equal(struct map_info *map, map_word val1, map_word val2) +-{ +- int i; +- +- for (i = 0; i < map_words(map); i++) { +- if (val1.x[i] != val2.x[i]) +- return 0; +- } +- +- return 1; +-} +- +-static inline map_word map_word_and(struct map_info *map, map_word val1, map_word val2) +-{ +- map_word r; +- int i; +- +- for (i = 0; i < map_words(map); i++) +- r.x[i] = val1.x[i] & val2.x[i]; +- +- return r; +-} +- +-static inline map_word map_word_clr(struct map_info *map, map_word val1, map_word val2) +-{ +- map_word r; +- int i; +- +- for (i = 0; i < map_words(map); i++) +- r.x[i] = val1.x[i] & ~val2.x[i]; +- +- return r; +-} +- +-static inline map_word map_word_or(struct map_info *map, map_word val1, map_word val2) +-{ +- map_word r; +- int i; +- +- for (i = 0; i < map_words(map); i++) +- r.x[i] = val1.x[i] | val2.x[i]; +- +- return r; +-} +- +-static inline int map_word_andequal(struct map_info *map, map_word val1, map_word val2, map_word val3) +-{ +- int i; +- +- for (i = 0; i < map_words(map); i++) { +- if ((val1.x[i] & val2.x[i]) != val3.x[i]) +- return 0; +- } +- +- return 1; +-} +- +-static inline int map_word_bitsset(struct map_info *map, map_word val1, map_word val2) +-{ +- int i; +- +- for (i = 0; i < map_words(map); i++) { +- if (val1.x[i] & val2.x[i]) +- return 1; +- } +- +- return 0; +-} ++#define map_word_equal(map, val1, val2) \ ++({ \ ++ int i, ret = 1; \ ++ for (i = 0; i < map_words(map); i++) \ ++ if ((val1).x[i] != (val2).x[i]) { \ ++ ret = 0; \ ++ break; \ ++ } \ ++ ret; \ ++}) ++ ++#define map_word_and(map, val1, val2) \ ++({ \ ++ map_word r; \ ++ int i; \ ++ for (i = 0; i < map_words(map); i++) \ ++ r.x[i] = (val1).x[i] & (val2).x[i]; \ ++ r; \ ++}) ++ ++#define map_word_clr(map, val1, val2) \ ++({ \ ++ map_word r; \ ++ int i; \ ++ for (i = 0; i < map_words(map); i++) \ ++ r.x[i] = (val1).x[i] & ~(val2).x[i]; \ ++ r; \ ++}) ++ ++#define map_word_or(map, val1, val2) \ ++({ \ ++ map_word r; \ ++ int i; \ ++ for (i = 0; i < map_words(map); i++) \ ++ r.x[i] = (val1).x[i] | (val2).x[i]; \ ++ r; \ ++}) ++ ++#define map_word_andequal(map, val1, val2, val3) \ ++({ \ ++ int i, ret = 1; \ ++ for (i = 0; i < map_words(map); i++) { \ ++ if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) { \ ++ ret = 0; \ ++ break; \ ++ } \ ++ } \ ++ ret; \ ++}) ++ ++#define map_word_bitsset(map, val1, val2) \ ++({ \ ++ int i, ret = 0; \ ++ for (i = 0; i < map_words(map); i++) { \ ++ if ((val1).x[i] & (val2).x[i]) { \ ++ ret = 1; \ ++ break; \ ++ } \ ++ } \ ++ ret; \ ++}) + + static inline map_word map_word_load(struct map_info *map, const void *ptr) + { +diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h +index 9c5638ad872e..0dbce55437f2 100644 +--- a/include/net/netfilter/nf_queue.h ++++ b/include/net/netfilter/nf_queue.h +@@ -28,8 +28,8 @@ struct nf_queue_handler { + struct nf_hook_ops *ops); + }; + +-void nf_register_queue_handler(const struct nf_queue_handler *qh); +-void nf_unregister_queue_handler(void); ++void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh); ++void nf_unregister_queue_handler(struct net *net); + void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); + + void nf_queue_entry_get_refs(struct nf_queue_entry *entry); +diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h +index 38aa4983e2a9..36d723579af2 100644 +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -5,11 +5,13 @@ + + struct proc_dir_entry; + struct nf_logger; ++struct nf_queue_handler; + + struct netns_nf { + #if defined CONFIG_PROC_FS + struct proc_dir_entry *proc_netfilter; + #endif ++ const struct nf_queue_handler __rcu *queue_handler; + const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO]; + #ifdef CONFIG_SYSCTL + struct ctl_table_header *nf_log_dir_header; +diff --git a/kernel/async.c b/kernel/async.c +index 4c3773c0bf63..f1fd155abff6 100644 +--- a/kernel/async.c ++++ b/kernel/async.c +@@ -84,20 +84,24 @@ static atomic_t entry_count; + + static async_cookie_t lowest_in_progress(struct async_domain *domain) + { +- struct list_head *pending; ++ struct async_entry *first = NULL; + async_cookie_t ret = ASYNC_COOKIE_MAX; + unsigned long flags; + + spin_lock_irqsave(&async_lock, flags); + +- if (domain) +- pending = &domain->pending; +- else +- pending = &async_global_pending; ++ if (domain) { ++ if (!list_empty(&domain->pending)) ++ first = list_first_entry(&domain->pending, ++ struct async_entry, domain_list); ++ } else { ++ if (!list_empty(&async_global_pending)) ++ first = list_first_entry(&async_global_pending, ++ struct async_entry, global_list); ++ } + +- if (!list_empty(pending)) +- ret = list_first_entry(pending, struct async_entry, +- domain_list)->cookie; ++ if (first) ++ ret = first->cookie; + + spin_unlock_irqrestore(&async_lock, flags); + return ret; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index e6d1173a2046..c5b1c62623cf 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5896,6 +5896,19 @@ static void rq_attach_root(struct rq *rq, struct root_domain *rd) + call_rcu_sched(&old_rd->rcu, free_rootdomain); + } + ++void sched_get_rd(struct root_domain *rd) ++{ ++ atomic_inc(&rd->refcount); ++} ++ ++void sched_put_rd(struct root_domain *rd) ++{ ++ if (!atomic_dec_and_test(&rd->refcount)) ++ return; ++ ++ call_rcu_sched(&rd->rcu, free_rootdomain); ++} ++ + static int init_rootdomain(struct root_domain *rd) + { + memset(rd, 0, sizeof(*rd)); +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 95fefb364dab..e0b5169aeac4 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1833,9 +1833,8 @@ static void push_rt_tasks(struct rq *rq) + * the rt_loop_next will cause the iterator to perform another scan. + * + */ +-static int rto_next_cpu(struct rq *rq) ++static int rto_next_cpu(struct root_domain *rd) + { +- struct root_domain *rd = rq->rd; + int next; + int cpu; + +@@ -1911,19 +1910,24 @@ static void tell_cpu_to_push(struct rq *rq) + * Otherwise it is finishing up and an ipi needs to be sent. + */ + if (rq->rd->rto_cpu < 0) +- cpu = rto_next_cpu(rq); ++ cpu = rto_next_cpu(rq->rd); + + raw_spin_unlock(&rq->rd->rto_lock); + + rto_start_unlock(&rq->rd->rto_loop_start); + +- if (cpu >= 0) ++ if (cpu >= 0) { ++ /* Make sure the rd does not get freed while pushing */ ++ sched_get_rd(rq->rd); + irq_work_queue_on(&rq->rd->rto_push_work, cpu); ++ } + } + + /* Called from hardirq context */ + void rto_push_irq_work_func(struct irq_work *work) + { ++ struct root_domain *rd = ++ container_of(work, struct root_domain, rto_push_work); + struct rq *rq; + int cpu; + +@@ -1939,18 +1943,20 @@ void rto_push_irq_work_func(struct irq_work *work) + raw_spin_unlock(&rq->lock); + } + +- raw_spin_lock(&rq->rd->rto_lock); ++ raw_spin_lock(&rd->rto_lock); + + /* Pass the IPI to the next rt overloaded queue */ +- cpu = rto_next_cpu(rq); ++ cpu = rto_next_cpu(rd); + +- raw_spin_unlock(&rq->rd->rto_lock); ++ raw_spin_unlock(&rd->rto_lock); + +- if (cpu < 0) ++ if (cpu < 0) { ++ sched_put_rd(rd); + return; ++ } + + /* Try the next RT overloaded CPU */ +- irq_work_queue_on(&rq->rd->rto_push_work, cpu); ++ irq_work_queue_on(&rd->rto_push_work, cpu); + } + #endif /* HAVE_RT_PUSH_IPI */ + +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 448a8266ceea..0c9ebd82a684 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -553,6 +553,8 @@ struct root_domain { + }; + + extern struct root_domain def_root_domain; ++extern void sched_get_rd(struct root_domain *rd); ++extern void sched_put_rd(struct root_domain *rd); + + #ifdef HAVE_RT_PUSH_IPI + extern void rto_push_irq_work_func(struct irq_work *work); +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index f2826c35e918..fc7c37ad90a0 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -507,17 +507,22 @@ static struct pid *good_sigevent(sigevent_t * event) + { + struct task_struct *rtn = current->group_leader; + +- if ((event->sigev_notify & SIGEV_THREAD_ID ) && +- (!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) || +- !same_thread_group(rtn, current) || +- (event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL)) ++ switch (event->sigev_notify) { ++ case SIGEV_SIGNAL | SIGEV_THREAD_ID: ++ rtn = find_task_by_vpid(event->sigev_notify_thread_id); ++ if (!rtn || !same_thread_group(rtn, current)) ++ return NULL; ++ /* FALLTHRU */ ++ case SIGEV_SIGNAL: ++ case SIGEV_THREAD: ++ if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX) ++ return NULL; ++ /* FALLTHRU */ ++ case SIGEV_NONE: ++ return task_pid(rtn); ++ default: + return NULL; +- +- if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) && +- ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX))) +- return NULL; +- +- return task_pid(rtn); ++ } + } + + void posix_timers_register_clock(const clockid_t clock_id, +@@ -745,8 +750,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) + /* interval timer ? */ + if (iv.tv64) + cur_setting->it_interval = ktime_to_timespec(iv); +- else if (!hrtimer_active(timer) && +- (timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) ++ else if (!hrtimer_active(timer) && timr->it_sigev_notify != SIGEV_NONE) + return; + + now = timer->base->get_time(); +@@ -757,7 +761,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) + * expiry is > now. + */ + if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING || +- (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) ++ timr->it_sigev_notify == SIGEV_NONE)) + timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv); + + remaining = __hrtimer_expires_remaining_adjusted(timer, now); +@@ -767,7 +771,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) + * A single shot SIGEV_NONE timer must return 0, when + * it is expired ! + */ +- if ((timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) ++ if (timr->it_sigev_notify != SIGEV_NONE) + cur_setting->it_value.tv_nsec = 1; + } else + cur_setting->it_value = ktime_to_timespec(remaining); +@@ -865,7 +869,7 @@ common_timer_set(struct k_itimer *timr, int flags, + timr->it.real.interval = timespec_to_ktime(new_setting->it_interval); + + /* SIGEV_NONE timers are not queued ! See common_timer_get */ +- if (((timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) { ++ if (timr->it_sigev_notify == SIGEV_NONE) { + /* Setup correct expiry time for relative timers */ + if (mode == HRTIMER_MODE_REL) { + hrtimer_add_expires(timer, timer->base->get_time()); +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index fc0051fd672d..ac758a53fcea 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -3845,7 +3845,6 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, + func_g.type = filter_parse_regex(glob, strlen(glob), + &func_g.search, ¬); + func_g.len = strlen(func_g.search); +- func_g.search = glob; + + /* we do not support '!' for function probes */ + if (WARN_ON(not)) +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index b68168fcc06a..9d43c1f40274 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags) + { + struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet = inet_sk(sk); ++ struct dccp_sock *dp = dccp_sk(sk); + int err = 0; + const int old_state = sk->sk_state; + +@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags) + sk->sk_err = ECONNRESET; + + dccp_clear_xmit_timers(sk); ++ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); ++ dp->dccps_hc_rx_ccid = NULL; ++ dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 8212ed80da48..c67efa3e79dd 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -392,7 +392,11 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) + pip->frag_off = htons(IP_DF); + pip->ttl = 1; + pip->daddr = fl4.daddr; ++ ++ rcu_read_lock(); + pip->saddr = igmpv3_get_srcaddr(dev, &fl4); ++ rcu_read_unlock(); ++ + pip->protocol = IPPROTO_IGMP; + pip->tot_len = 0; /* filled in later */ + ip_select_ident(net, skb, NULL); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 37e8966a457b..23d77ff1da59 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2276,6 +2276,12 @@ int tcp_disconnect(struct sock *sk, int flags) + + WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); + ++ if (sk->sk_frag.page) { ++ put_page(sk->sk_frag.page); ++ sk->sk_frag.page = NULL; ++ sk->sk_frag.offset = 0; ++ } ++ + sk->sk_error_report(sk); + return err; + } +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 8361d73ab653..e5846d1f9b55 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -495,6 +495,7 @@ static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos) + return ERR_PTR(-ENOENT); + + it->mrt = mrt; ++ it->cache = NULL; + return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1) + : SEQ_START_TOKEN; + } +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c +index 5baa8e24e6ac..b19ad20a705c 100644 +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -26,23 +26,21 @@ + * Once the queue is registered it must reinject all packets it + * receives, no matter what. + */ +-static const struct nf_queue_handler __rcu *queue_handler __read_mostly; + + /* return EBUSY when somebody else is registered, return EEXIST if the + * same handler is registered, return 0 in case of success. */ +-void nf_register_queue_handler(const struct nf_queue_handler *qh) ++void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh) + { + /* should never happen, we only have one queueing backend in kernel */ +- WARN_ON(rcu_access_pointer(queue_handler)); +- rcu_assign_pointer(queue_handler, qh); ++ WARN_ON(rcu_access_pointer(net->nf.queue_handler)); ++ rcu_assign_pointer(net->nf.queue_handler, qh); + } + EXPORT_SYMBOL(nf_register_queue_handler); + + /* The caller must flush their queue before this */ +-void nf_unregister_queue_handler(void) ++void nf_unregister_queue_handler(struct net *net) + { +- RCU_INIT_POINTER(queue_handler, NULL); +- synchronize_rcu(); ++ RCU_INIT_POINTER(net->nf.queue_handler, NULL); + } + EXPORT_SYMBOL(nf_unregister_queue_handler); + +@@ -103,7 +101,7 @@ void nf_queue_nf_hook_drop(struct net *net, struct nf_hook_ops *ops) + const struct nf_queue_handler *qh; + + rcu_read_lock(); +- qh = rcu_dereference(queue_handler); ++ qh = rcu_dereference(net->nf.queue_handler); + if (qh) + qh->nf_hook_drop(net, ops); + rcu_read_unlock(); +@@ -122,9 +120,10 @@ int nf_queue(struct sk_buff *skb, + struct nf_queue_entry *entry = NULL; + const struct nf_afinfo *afinfo; + const struct nf_queue_handler *qh; ++ struct net *net = state->net; + + /* QUEUE == DROP if no one is waiting, to be safe. */ +- qh = rcu_dereference(queue_handler); ++ qh = rcu_dereference(net->nf.queue_handler); + if (!qh) { + status = -ESRCH; + goto err; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index c14d2e8eaec3..f853b55bf877 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -1382,21 +1382,29 @@ static int __net_init nfnl_queue_net_init(struct net *net) + net->nf.proc_netfilter, &nfqnl_file_ops)) + return -ENOMEM; + #endif ++ nf_register_queue_handler(net, &nfqh); + return 0; + } + + static void __net_exit nfnl_queue_net_exit(struct net *net) + { ++ nf_unregister_queue_handler(net); + #ifdef CONFIG_PROC_FS + remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); + #endif + } + ++static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list) ++{ ++ synchronize_rcu(); ++} ++ + static struct pernet_operations nfnl_queue_net_ops = { +- .init = nfnl_queue_net_init, +- .exit = nfnl_queue_net_exit, +- .id = &nfnl_queue_net_id, +- .size = sizeof(struct nfnl_queue_net), ++ .init = nfnl_queue_net_init, ++ .exit = nfnl_queue_net_exit, ++ .exit_batch = nfnl_queue_net_exit_batch, ++ .id = &nfnl_queue_net_id, ++ .size = sizeof(struct nfnl_queue_net), + }; + + static int __init nfnetlink_queue_init(void) +@@ -1417,7 +1425,6 @@ static int __init nfnetlink_queue_init(void) + } + + register_netdevice_notifier(&nfqnl_dev_notifier); +- nf_register_queue_handler(&nfqh); + return status; + + cleanup_netlink_notifier: +@@ -1429,7 +1436,6 @@ out: + + static void __exit nfnetlink_queue_fini(void) + { +- nf_unregister_queue_handler(); + unregister_netdevice_notifier(&nfqnl_dev_notifier); + nfnetlink_subsys_unregister(&nfqnl_subsys); + netlink_unregister_notifier(&nfqnl_rtnl_notifier); +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index e080746e1a6b..48958d3cec9e 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -594,7 +594,8 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) + if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 || + strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0 || + strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 || +- strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0) ++ strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0 || ++ strcmp(symname, ".TOC.") == 0) + return 1; + /* Do not ignore this symbol */ + return 0; +diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c +index ce295c0c1da0..e44e844c8ec4 100644 +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -141,23 +141,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc) + */ + static int valid_master_desc(const char *new_desc, const char *orig_desc) + { +- if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) { +- if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN) +- goto out; +- if (orig_desc) +- if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN)) +- goto out; +- } else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) { +- if (strlen(new_desc) == KEY_USER_PREFIX_LEN) +- goto out; +- if (orig_desc) +- if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN)) +- goto out; +- } else +- goto out; ++ int prefix_len; ++ ++ if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) ++ prefix_len = KEY_TRUSTED_PREFIX_LEN; ++ else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) ++ prefix_len = KEY_USER_PREFIX_LEN; ++ else ++ return -EINVAL; ++ ++ if (!new_desc[prefix_len]) ++ return -EINVAL; ++ ++ if (orig_desc && strncmp(new_desc, orig_desc, prefix_len)) ++ return -EINVAL; ++ + return 0; +-out: +- return -EINVAL; + } + + /* +diff --git a/sound/soc/codecs/pcm512x-spi.c b/sound/soc/codecs/pcm512x-spi.c +index 712ed6598c48..ebdf9bd5a64c 100644 +--- a/sound/soc/codecs/pcm512x-spi.c ++++ b/sound/soc/codecs/pcm512x-spi.c +@@ -70,3 +70,7 @@ static struct spi_driver pcm512x_spi_driver = { + }; + + module_spi_driver(pcm512x_spi_driver); ++ ++MODULE_DESCRIPTION("ASoC PCM512x codec driver - SPI"); ++MODULE_AUTHOR("Mark Brown "); ++MODULE_LICENSE("GPL v2"); +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index ff6fcd9f92f7..0b1b6fcb7500 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -343,13 +343,19 @@ static int asoc_simple_card_dai_link_of(struct device_node *node, + snprintf(prop, sizeof(prop), "%scpu", prefix); + cpu = of_get_child_by_name(node, prop); + ++ if (!cpu) { ++ ret = -EINVAL; ++ dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop); ++ goto dai_link_of_err; ++ } ++ + snprintf(prop, sizeof(prop), "%splat", prefix); + plat = of_get_child_by_name(node, prop); + + snprintf(prop, sizeof(prop), "%scodec", prefix); + codec = of_get_child_by_name(node, prop); + +- if (!cpu || !codec) { ++ if (!codec) { + ret = -EINVAL; + dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop); + goto dai_link_of_err; +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index 085329878525..5976e3992dd1 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -235,6 +235,7 @@ enum rsnd_mod_type { + RSND_MOD_MIX, + RSND_MOD_CTU, + RSND_MOD_SRC, ++ RSND_MOD_SSIP, /* SSI parent */ + RSND_MOD_SSI, + RSND_MOD_MAX, + }; +@@ -365,6 +366,7 @@ struct rsnd_dai_stream { + }; + #define rsnd_io_to_mod(io, i) ((i) < RSND_MOD_MAX ? (io)->mod[(i)] : NULL) + #define rsnd_io_to_mod_ssi(io) rsnd_io_to_mod((io), RSND_MOD_SSI) ++#define rsnd_io_to_mod_ssip(io) rsnd_io_to_mod((io), RSND_MOD_SSIP) + #define rsnd_io_to_mod_src(io) rsnd_io_to_mod((io), RSND_MOD_SRC) + #define rsnd_io_to_mod_ctu(io) rsnd_io_to_mod((io), RSND_MOD_CTU) + #define rsnd_io_to_mod_mix(io) rsnd_io_to_mod((io), RSND_MOD_MIX) +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index c62a2947ac14..38aae96267c9 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -550,11 +550,16 @@ static int rsnd_ssi_dma_remove(struct rsnd_mod *mod, + struct rsnd_priv *priv) + { + struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); ++ struct rsnd_mod *pure_ssi_mod = rsnd_io_to_mod_ssi(io); + struct device *dev = rsnd_priv_to_dev(priv); + int irq = ssi->info->irq; + + rsnd_dma_quit(io, rsnd_mod_to_dma(mod)); + ++ /* Do nothing if non SSI (= SSI parent, multi SSI) mod */ ++ if (pure_ssi_mod != mod) ++ return 0; ++ + /* PIO will request IRQ again */ + devm_free_irq(dev, irq, mod); + diff --git a/patch/kernel/rockchip-default/04-patch-4.4.116-117.patch b/patch/kernel/rockchip-default/04-patch-4.4.116-117.patch new file mode 100644 index 000000000..a48cc7fc3 --- /dev/null +++ b/patch/kernel/rockchip-default/04-patch-4.4.116-117.patch @@ -0,0 +1,929 @@ +diff --git a/Documentation/devicetree/bindings/dma/snps-dma.txt b/Documentation/devicetree/bindings/dma/snps-dma.txt +index c261598164a7..17d43ca27f41 100644 +--- a/Documentation/devicetree/bindings/dma/snps-dma.txt ++++ b/Documentation/devicetree/bindings/dma/snps-dma.txt +@@ -58,6 +58,6 @@ Example: + interrupts = <0 35 0x4>; + status = "disabled"; + dmas = <&dmahost 12 0 1>, +- <&dmahost 13 0 1 0>; ++ <&dmahost 13 1 0>; + dma-names = "rx", "rx"; + }; +diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt +index 6c0108eb0137..2139ea253142 100644 +--- a/Documentation/filesystems/ext4.txt ++++ b/Documentation/filesystems/ext4.txt +@@ -233,7 +233,7 @@ data_err=ignore(*) Just print an error message if an error occurs + data_err=abort Abort the journal if an error occurs in a file + data buffer in ordered mode. + +-grpid Give objects the same group ID as their creator. ++grpid New objects have the group ID of their parent. + bsdgroups + + nogrpid (*) New objects have the group ID of their creator. +diff --git a/Makefile b/Makefile +index 71acaecd7899..9f53ba1835ad 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 116 ++SUBLEVEL = 117 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi +index 8344a0ee2b86..b03fe747b98c 100644 +--- a/arch/arm/boot/dts/s5pv210.dtsi ++++ b/arch/arm/boot/dts/s5pv210.dtsi +@@ -461,6 +461,7 @@ + compatible = "samsung,exynos4210-ohci"; + reg = <0xec300000 0x100>; + interrupts = <23>; ++ interrupt-parent = <&vic1>; + clocks = <&clocks CLK_USB_HOST>; + clock-names = "usbhost"; + #address-cells = <1>; +diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts +index e48857249ce7..3d83992efd90 100644 +--- a/arch/arm/boot/dts/spear1310-evb.dts ++++ b/arch/arm/boot/dts/spear1310-evb.dts +@@ -349,7 +349,7 @@ + spi0: spi@e0100000 { + status = "okay"; + num-cs = <3>; +- cs-gpios = <&gpio1 7 0>, <&spics 0>, <&spics 1>; ++ cs-gpios = <&gpio1 7 0>, <&spics 0 0>, <&spics 1 0>; + + stmpe610@0 { + compatible = "st,stmpe610"; +diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi +index df2232d767ed..6361cbfcbe5e 100644 +--- a/arch/arm/boot/dts/spear1340.dtsi ++++ b/arch/arm/boot/dts/spear1340.dtsi +@@ -141,8 +141,8 @@ + reg = <0xb4100000 0x1000>; + interrupts = <0 105 0x4>; + status = "disabled"; +- dmas = <&dwdma0 0x600 0 0 1>, /* 0xC << 11 */ +- <&dwdma0 0x680 0 1 0>; /* 0xD << 7 */ ++ dmas = <&dwdma0 12 0 1>, ++ <&dwdma0 13 1 0>; + dma-names = "tx", "rx"; + }; + +diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi +index 14594ce8c18a..8fd8a3328acb 100644 +--- a/arch/arm/boot/dts/spear13xx.dtsi ++++ b/arch/arm/boot/dts/spear13xx.dtsi +@@ -100,7 +100,7 @@ + reg = <0xb2800000 0x1000>; + interrupts = <0 29 0x4>; + status = "disabled"; +- dmas = <&dwdma0 0 0 0 0>; ++ dmas = <&dwdma0 0 0 0>; + dma-names = "data"; + }; + +@@ -288,8 +288,8 @@ + #size-cells = <0>; + interrupts = <0 31 0x4>; + status = "disabled"; +- dmas = <&dwdma0 0x2000 0 0 0>, /* 0x4 << 11 */ +- <&dwdma0 0x0280 0 0 0>; /* 0x5 << 7 */ ++ dmas = <&dwdma0 4 0 0>, ++ <&dwdma0 5 0 0>; + dma-names = "tx", "rx"; + }; + +diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi +index 9f60a7b6a42b..bd379034993c 100644 +--- a/arch/arm/boot/dts/spear600.dtsi ++++ b/arch/arm/boot/dts/spear600.dtsi +@@ -194,6 +194,7 @@ + rtc@fc900000 { + compatible = "st,spear600-rtc"; + reg = <0xfc900000 0x1000>; ++ interrupt-parent = <&vic0>; + interrupts = <10>; + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/stih407.dtsi b/arch/arm/boot/dts/stih407.dtsi +index d60f0d8add26..e4b508ce38a2 100644 +--- a/arch/arm/boot/dts/stih407.dtsi ++++ b/arch/arm/boot/dts/stih407.dtsi +@@ -8,6 +8,7 @@ + */ + #include "stih407-clock.dtsi" + #include "stih407-family.dtsi" ++#include + / { + soc { + sti-display-subsystem { +@@ -112,7 +113,7 @@ + <&clk_s_d2_quadfs 0>, + <&clk_s_d2_quadfs 1>; + +- hdmi,hpd-gpio = <&pio5 3>; ++ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>; + reset-names = "hdmi"; + resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>; + ddc = <&hdmiddc>; +diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi +index 40318869c733..3c32fb8cdcac 100644 +--- a/arch/arm/boot/dts/stih410.dtsi ++++ b/arch/arm/boot/dts/stih410.dtsi +@@ -9,6 +9,7 @@ + #include "stih410-clock.dtsi" + #include "stih407-family.dtsi" + #include "stih410-pinctrl.dtsi" ++#include + / { + aliases { + bdisp0 = &bdisp0; +@@ -203,7 +204,7 @@ + <&clk_s_d2_quadfs 0>, + <&clk_s_d2_quadfs 1>; + +- hdmi,hpd-gpio = <&pio5 3>; ++ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>; + reset-names = "hdmi"; + resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>; + ddc = <&hdmiddc>; +diff --git a/arch/arm/mach-pxa/tosa-bt.c b/arch/arm/mach-pxa/tosa-bt.c +index e0a53208880a..b59a7a2df4e3 100644 +--- a/arch/arm/mach-pxa/tosa-bt.c ++++ b/arch/arm/mach-pxa/tosa-bt.c +@@ -132,3 +132,7 @@ static struct platform_driver tosa_bt_driver = { + }, + }; + module_platform_driver(tosa_bt_driver); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Dmitry Baryshkov"); ++MODULE_DESCRIPTION("Bluetooth built-in chip control"); +diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c +index 0176ebc97bfd..86f934255eb6 100644 +--- a/arch/s390/kernel/compat_linux.c ++++ b/arch/s390/kernel/compat_linux.c +@@ -110,7 +110,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setregid16, u16, rgid, u16, egid) + + COMPAT_SYSCALL_DEFINE1(s390_setgid16, u16, gid) + { +- return sys_setgid((gid_t)gid); ++ return sys_setgid(low2highgid(gid)); + } + + COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid) +@@ -120,7 +120,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid) + + COMPAT_SYSCALL_DEFINE1(s390_setuid16, u16, uid) + { +- return sys_setuid((uid_t)uid); ++ return sys_setuid(low2highuid(uid)); + } + + COMPAT_SYSCALL_DEFINE3(s390_setresuid16, u16, ruid, u16, euid, u16, suid) +@@ -173,12 +173,12 @@ COMPAT_SYSCALL_DEFINE3(s390_getresgid16, u16 __user *, rgidp, + + COMPAT_SYSCALL_DEFINE1(s390_setfsuid16, u16, uid) + { +- return sys_setfsuid((uid_t)uid); ++ return sys_setfsuid(low2highuid(uid)); + } + + COMPAT_SYSCALL_DEFINE1(s390_setfsgid16, u16, gid) + { +- return sys_setfsgid((gid_t)gid); ++ return sys_setfsgid(low2highgid(gid)); + } + + static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info) +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 86bccb4bd4dc..9e77cea2a8ef 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -113,7 +113,7 @@ struct cpuinfo_x86 { + char x86_vendor_id[16]; + char x86_model_id[64]; + /* in KB - valid for CPUS which support this call: */ +- int x86_cache_size; ++ unsigned int x86_cache_size; + int x86_cache_alignment; /* In bytes */ + /* Cache QoS architectural values: */ + int x86_cache_max_rmid; /* max index */ +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index f7f2ad3687ee..8eabbafff213 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -955,7 +955,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) + int i; + + c->loops_per_jiffy = loops_per_jiffy; +- c->x86_cache_size = -1; ++ c->x86_cache_size = 0; + c->x86_vendor = X86_VENDOR_UNKNOWN; + c->x86_model = c->x86_mask = 0; /* So far unknown... */ + c->x86_vendor_id[0] = '\0'; /* Unset */ +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index 2c76a1801393..2f38a99cdb98 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -1075,7 +1075,7 @@ static struct microcode_ops microcode_intel_ops = { + + static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c) + { +- u64 llc_size = c->x86_cache_size * 1024; ++ u64 llc_size = c->x86_cache_size * 1024ULL; + + do_div(llc_size, c->x86_max_cores); + +diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c +index 18ca99f2798b..935225c0375f 100644 +--- a/arch/x86/kernel/cpu/proc.c ++++ b/arch/x86/kernel/cpu/proc.c +@@ -87,8 +87,8 @@ static int show_cpuinfo(struct seq_file *m, void *v) + } + + /* Cache size */ +- if (c->x86_cache_size >= 0) +- seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size); ++ if (c->x86_cache_size) ++ seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size); + + show_cpuinfo_core(m, c, cpu); + show_cpuinfo_misc(m, c); +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 1049c3c9b877..2b71f2c03b9e 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -4503,7 +4503,7 @@ void kvm_mmu_setup(struct kvm_vcpu *vcpu) + typedef bool (*slot_level_handler) (struct kvm *kvm, unsigned long *rmap); + + /* The caller should hold mmu-lock before calling this function. */ +-static bool ++static __always_inline bool + slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot, + slot_level_handler fn, int start_level, int end_level, + gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb) +@@ -4533,7 +4533,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot, + return flush; + } + +-static bool ++static __always_inline bool + slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + slot_level_handler fn, int start_level, int end_level, + bool lock_flush_tlb) +@@ -4544,7 +4544,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + lock_flush_tlb); + } + +-static bool ++static __always_inline bool + slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + slot_level_handler fn, bool lock_flush_tlb) + { +@@ -4552,7 +4552,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb); + } + +-static bool ++static __always_inline bool + slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + slot_level_handler fn, bool lock_flush_tlb) + { +@@ -4560,7 +4560,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot, + PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb); + } + +-static bool ++static __always_inline bool + slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot, + slot_level_handler fn, bool lock_flush_tlb) + { +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index ca848cc6a8fd..4f6fc1cfd7da 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -583,7 +583,7 @@ struct devfreq *devm_devfreq_add_device(struct device *dev, + devfreq = devfreq_add_device(dev, profile, governor_name, data); + if (IS_ERR(devfreq)) { + devres_free(ptr); +- return ERR_PTR(-ENOMEM); ++ return devfreq; + } + + *ptr = devfreq; +diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c +index 6edcb5485092..b35ebabd6a9f 100644 +--- a/drivers/gpu/drm/radeon/radeon_uvd.c ++++ b/drivers/gpu/drm/radeon/radeon_uvd.c +@@ -946,7 +946,7 @@ int radeon_uvd_calc_upll_dividers(struct radeon_device *rdev, + /* calc dclk divider with current vco freq */ + dclk_div = radeon_uvd_calc_upll_post_div(vco_freq, dclk, + pd_min, pd_even); +- if (vclk_div > pd_max) ++ if (dclk_div > pd_max) + break; /* vco is too big, it has to stop */ + + /* calc score with current vco freq */ +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 8763fb832b01..5a2a0b5db938 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -2483,9 +2483,8 @@ err_steer_free_bitmap: + kfree(ibdev->ib_uc_qpns_bitmap); + + err_steer_qp_release: +- if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) +- mlx4_qp_release_range(dev, ibdev->steer_qpn_base, +- ibdev->steer_qpn_count); ++ mlx4_qp_release_range(dev, ibdev->steer_qpn_base, ++ ibdev->steer_qpn_count); + err_counter: + for (i = 0; i < ibdev->num_ports; ++i) + mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]); +@@ -2586,11 +2585,9 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) + ibdev->iboe.nb.notifier_call = NULL; + } + +- if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) { +- mlx4_qp_release_range(dev, ibdev->steer_qpn_base, +- ibdev->steer_qpn_count); +- kfree(ibdev->ib_uc_qpns_bitmap); +- } ++ mlx4_qp_release_range(dev, ibdev->steer_qpn_base, ++ ibdev->steer_qpn_count); ++ kfree(ibdev->ib_uc_qpns_bitmap); + + iounmap(ibdev->uar_map); + for (p = 0; p < ibdev->num_ports; ++p) +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 9ec6948e3b8b..3d9a80759d95 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -974,7 +974,8 @@ static void dec_pending(struct dm_io *io, int error) + } else { + /* done with normal IO or empty flush */ + trace_block_bio_complete(md->queue, bio, io_error); +- bio->bi_error = io_error; ++ if (io_error) ++ bio->bi_error = io_error; + bio_endio(bio); + } + } +diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c +index a7a8452e99d2..c1ce8d3ce877 100644 +--- a/drivers/media/tuners/r820t.c ++++ b/drivers/media/tuners/r820t.c +@@ -410,9 +410,11 @@ static int r820t_write(struct r820t_priv *priv, u8 reg, const u8 *val, + return 0; + } + +-static int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val) ++static inline int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val) + { +- return r820t_write(priv, reg, &val, 1); ++ u8 tmp = val; /* work around GCC PR81715 with asan-stack=1 */ ++ ++ return r820t_write(priv, reg, &tmp, 1); + } + + static int r820t_read_cache_reg(struct r820t_priv *priv, int reg) +@@ -425,17 +427,18 @@ static int r820t_read_cache_reg(struct r820t_priv *priv, int reg) + return -EINVAL; + } + +-static int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val, ++static inline int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val, + u8 bit_mask) + { ++ u8 tmp = val; + int rc = r820t_read_cache_reg(priv, reg); + + if (rc < 0) + return rc; + +- val = (rc & ~bit_mask) | (val & bit_mask); ++ tmp = (rc & ~bit_mask) | (tmp & bit_mask); + +- return r820t_write(priv, reg, &val, 1); ++ return r820t_write(priv, reg, &tmp, 1); + } + + static int r820t_read(struct r820t_priv *priv, u8 reg, u8 *val, int len) +diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c +index 4f34e1b79705..ac92685dd4e5 100644 +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -5666,6 +5666,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev) + int id = port->id; + bool allmulti = dev->flags & IFF_ALLMULTI; + ++retry: + mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC); + mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti); + mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti); +@@ -5673,9 +5674,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev) + /* Remove all port->id's mcast enries */ + mvpp2_prs_mcast_del_all(priv, id); + +- if (allmulti && !netdev_mc_empty(dev)) { +- netdev_for_each_mc_addr(ha, dev) +- mvpp2_prs_mac_da_accept(priv, id, ha->addr, true); ++ if (!allmulti) { ++ netdev_for_each_mc_addr(ha, dev) { ++ if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) { ++ allmulti = true; ++ goto retry; ++ } ++ } + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c +index 168823dde79f..d8359ffba026 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c +@@ -280,6 +280,9 @@ void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt) + u64 in_param = 0; + int err; + ++ if (!cnt) ++ return; ++ + if (mlx4_is_mfunc(dev)) { + set_param_l(&in_param, base_qpn); + set_param_h(&in_param, cnt); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +index 738d541a2255..348ed1b0e58b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) + } + if (0 == tmp) { + read_addr = REG_DBI_RDATA + addr % 4; +- ret = rtl_read_word(rtlpriv, read_addr); ++ ret = rtl_read_byte(rtlpriv, read_addr); + } + return ret; + } +@@ -1169,7 +1169,8 @@ static void _rtl8821ae_enable_aspm_back_door(struct ieee80211_hw *hw) + } + + tmp = _rtl8821ae_dbi_read(rtlpriv, 0x70f); +- _rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7)); ++ _rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7) | ++ ASPM_L1_LATENCY << 3); + + tmp = _rtl8821ae_dbi_read(rtlpriv, 0x719); + _rtl8821ae_dbi_write(rtlpriv, 0x719, tmp | BIT(3) | BIT(4)); +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index b6faf624480e..d676d055feda 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -99,6 +99,7 @@ + #define RTL_USB_MAX_RX_COUNT 100 + #define QBSS_LOAD_SIZE 5 + #define MAX_WMMELE_LENGTH 64 ++#define ASPM_L1_LATENCY 7 + + #define TOTAL_CAM_ENTRY 32 + +diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c +index df39ce02a99d..229dd2fe8f45 100644 +--- a/drivers/rtc/rtc-opal.c ++++ b/drivers/rtc/rtc-opal.c +@@ -58,6 +58,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms) + static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + { + long rc = OPAL_BUSY; ++ int retries = 10; + u32 y_m_d; + u64 h_m_s_ms; + __be32 __y_m_d; +@@ -67,8 +68,11 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms); + if (rc == OPAL_BUSY_EVENT) + opal_poll_events(NULL); +- else ++ else if (retries-- && (rc == OPAL_HARDWARE ++ || rc == OPAL_INTERNAL_ERROR)) + msleep(10); ++ else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) ++ break; + } + + if (rc != OPAL_SUCCESS) +@@ -84,6 +88,7 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm) + { + long rc = OPAL_BUSY; ++ int retries = 10; + u32 y_m_d = 0; + u64 h_m_s_ms = 0; + +@@ -92,8 +97,11 @@ static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm) + rc = opal_rtc_write(y_m_d, h_m_s_ms); + if (rc == OPAL_BUSY_EVENT) + opal_poll_events(NULL); +- else ++ else if (retries-- && (rc == OPAL_HARDWARE ++ || rc == OPAL_INTERNAL_ERROR)) + msleep(10); ++ else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) ++ break; + } + + return rc == OPAL_SUCCESS ? 0 : -EIO; +diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c +index 0efc52f11ad0..b30e7d87804b 100644 +--- a/drivers/video/console/dummycon.c ++++ b/drivers/video/console/dummycon.c +@@ -68,7 +68,6 @@ const struct consw dummy_con = { + .con_switch = DUMMY, + .con_blank = DUMMY, + .con_font_set = DUMMY, +- .con_font_get = DUMMY, + .con_font_default = DUMMY, + .con_font_copy = DUMMY, + .con_set_palette = DUMMY, +diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c +index 19eb42b57d87..a6da82648c92 100644 +--- a/drivers/video/fbdev/atmel_lcdfb.c ++++ b/drivers/video/fbdev/atmel_lcdfb.c +@@ -1120,7 +1120,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo) + goto put_display_node; + } + +- timings_np = of_find_node_by_name(display_np, "display-timings"); ++ timings_np = of_get_child_by_name(display_np, "display-timings"); + if (!timings_np) { + dev_err(dev, "failed to find display-timings node\n"); + ret = -ENODEV; +@@ -1141,6 +1141,12 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo) + fb_add_videomode(&fb_vm, &info->modelist); + } + ++ /* ++ * FIXME: Make sure we are not referencing any fields in display_np ++ * and timings_np and drop our references to them before returning to ++ * avoid leaking the nodes on probe deferral and driver unbind. ++ */ ++ + return 0; + + put_timings_node: +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 86d209fc4992..81b5a461d94e 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1292,8 +1292,11 @@ next_slot: + leaf = path->nodes[0]; + if (path->slots[0] >= btrfs_header_nritems(leaf)) { + ret = btrfs_next_leaf(root, path); +- if (ret < 0) ++ if (ret < 0) { ++ if (cow_start != (u64)-1) ++ cur_offset = cow_start; + goto error; ++ } + if (ret > 0) + break; + leaf = path->nodes[0]; +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index ee7832e2d39d..d6359af9789d 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -26,6 +26,7 @@ + #include "print-tree.h" + #include "backref.h" + #include "hash.h" ++#include "inode-map.h" + + /* magic values for the inode_only field in btrfs_log_inode: + * +@@ -2445,6 +2446,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans, + next); + btrfs_wait_tree_block_writeback(next); + btrfs_tree_unlock(next); ++ } else { ++ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) ++ clear_extent_buffer_dirty(next); + } + + WARN_ON(root_owner != +@@ -2524,6 +2528,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans, + next); + btrfs_wait_tree_block_writeback(next); + btrfs_tree_unlock(next); ++ } else { ++ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) ++ clear_extent_buffer_dirty(next); + } + + WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID); +@@ -2600,6 +2607,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans, + clean_tree_block(trans, log->fs_info, next); + btrfs_wait_tree_block_writeback(next); + btrfs_tree_unlock(next); ++ } else { ++ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) ++ clear_extent_buffer_dirty(next); + } + + WARN_ON(log->root_key.objectid != +@@ -5514,6 +5524,23 @@ again: + path); + } + ++ if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) { ++ struct btrfs_root *root = wc.replay_dest; ++ ++ btrfs_release_path(path); ++ ++ /* ++ * We have just replayed everything, and the highest ++ * objectid of fs roots probably has changed in case ++ * some inode_item's got replayed. ++ * ++ * root->objectid_mutex is not acquired as log replay ++ * could only happen during mount. ++ */ ++ ret = btrfs_find_highest_objectid(root, ++ &root->highest_objectid); ++ } ++ + key.offset = found_key.offset - 1; + wc.replay_dest->log_root = NULL; + free_extent_buffer(log->node); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 8bdb0cc2722f..742455292dfe 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -688,6 +688,7 @@ __acquires(bitlock) + } + + ext4_unlock_group(sb, grp); ++ ext4_commit_super(sb, 1); + ext4_handle_error(sb); + /* + * We only get here in the ERRORS_RO case; relocking the group +diff --git a/fs/namei.c b/fs/namei.c +index 3f96ae087488..844da20232b9 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2000,6 +2000,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags) + int retval = 0; + const char *s = nd->name->name; + ++ if (!*s) ++ flags &= ~LOOKUP_RCU; ++ + nd->last_type = LAST_ROOT; /* if there are only slashes... */ + nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; + nd->depth = 0; +diff --git a/include/linux/kaiser.h b/include/linux/kaiser.h +index 58c55b1589d0..b56c19010480 100644 +--- a/include/linux/kaiser.h ++++ b/include/linux/kaiser.h +@@ -32,7 +32,7 @@ static inline void kaiser_init(void) + { + } + static inline int kaiser_add_mapping(unsigned long addr, +- unsigned long size, unsigned long flags) ++ unsigned long size, u64 flags) + { + return 0; + } +diff --git a/mm/memory.c b/mm/memory.c +index 9ac55172aa7b..31ca97f7ebbc 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -72,7 +72,7 @@ + + #include "internal.h" + +-#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS ++#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST) + #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid. + #endif + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 7bb9fe7a2c8e..167b943469ab 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1012,7 +1012,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + { + struct snd_seq_client *client = file->private_data; + int written = 0, len; +- int err = -EINVAL; ++ int err; + struct snd_seq_event event; + + if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT)) +@@ -1027,11 +1027,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + + /* allocate the pool now if the pool is not allocated yet */ + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +- if (snd_seq_pool_init(client->pool) < 0) ++ mutex_lock(&client->ioctl_mutex); ++ err = snd_seq_pool_init(client->pool); ++ mutex_unlock(&client->ioctl_mutex); ++ if (err < 0) + return -ENOMEM; + } + + /* only process whole events */ ++ err = -EINVAL; + while (count >= sizeof(struct snd_seq_event)) { + /* Read in the event header from the user */ + len = sizeof(event); +@@ -2196,7 +2200,6 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, + void __user *arg) + { + struct seq_ioctl_table *p; +- int ret; + + switch (cmd) { + case SNDRV_SEQ_IOCTL_PVERSION: +@@ -2210,12 +2213,8 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, + if (! arg) + return -EFAULT; + for (p = ioctl_tables; p->cmd; p++) { +- if (p->cmd == cmd) { +- mutex_lock(&client->ioctl_mutex); +- ret = p->func(client, arg); +- mutex_unlock(&client->ioctl_mutex); +- return ret; +- } ++ if (p->cmd == cmd) ++ return p->func(client, arg); + } + pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", + cmd, _IOC_TYPE(cmd), _IOC_NR(cmd)); +@@ -2226,11 +2225,15 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, + static long snd_seq_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { + struct snd_seq_client *client = file->private_data; ++ long ret; + + if (snd_BUG_ON(!client)) + return -ENXIO; + +- return snd_seq_do_ioctl(client, cmd, (void __user *) arg); ++ mutex_lock(&client->ioctl_mutex); ++ ret = snd_seq_do_ioctl(client, cmd, (void __user *) arg); ++ mutex_unlock(&client->ioctl_mutex); ++ return ret; + } + + #ifdef CONFIG_COMPAT +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f14c1f288443..b302d056e5d3 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3130,6 +3130,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec, + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; + } + ++static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21); ++ unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19); ++ ++ if (cfg_headphone && cfg_headset_mic == 0x411111f0) ++ snd_hda_codec_set_pincfg(codec, 0x19, ++ (cfg_headphone & ~AC_DEFCFG_DEVICE) | ++ (AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT)); ++} ++ + static void alc269_fixup_hweq(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -4782,6 +4795,7 @@ enum { + ALC269_FIXUP_LIFEBOOK_EXTMIC, + ALC269_FIXUP_LIFEBOOK_HP_PIN, + ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT, ++ ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC, + ALC269_FIXUP_AMIC, + ALC269_FIXUP_DMIC, + ALC269VB_FIXUP_AMIC, +@@ -4972,6 +4986,10 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_no_hp_to_lineout, + }, ++ [ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc269_fixup_pincfg_U7x7_headset_mic, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -5687,6 +5705,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), + SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), ++ SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC), +@@ -5975,6 +5994,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0xb7a60130}, + {0x14, 0x90170110}, + {0x21, 0x02211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x14, 0x01011020}, ++ {0x21, 0x0221101f}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC256_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, +@@ -6031,6 +6055,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60120}, + {0x14, 0x90170110}, + {0x21, 0x0321101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0xb7a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1, + ALC290_STANDARD_PINS, + {0x15, 0x04211040}, +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index c9ae29068c7c..c5447ff078b3 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -343,17 +343,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, + int validx, int *value_ret) + { + struct snd_usb_audio *chip = cval->head.mixer->chip; +- unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */ ++ /* enough space for one range */ ++ unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)]; + unsigned char *val; +- int idx = 0, ret, size; ++ int idx = 0, ret, val_size, size; + __u8 bRequest; + ++ val_size = uac2_ctl_value_size(cval->val_type); ++ + if (request == UAC_GET_CUR) { + bRequest = UAC2_CS_CUR; +- size = uac2_ctl_value_size(cval->val_type); ++ size = val_size; + } else { + bRequest = UAC2_CS_RANGE; +- size = sizeof(buf); ++ size = sizeof(__u16) + 3 * val_size; + } + + memset(buf, 0, sizeof(buf)); +@@ -386,16 +389,17 @@ error: + val = buf + sizeof(__u16); + break; + case UAC_GET_MAX: +- val = buf + sizeof(__u16) * 2; ++ val = buf + sizeof(__u16) + val_size; + break; + case UAC_GET_RES: +- val = buf + sizeof(__u16) * 3; ++ val = buf + sizeof(__u16) + val_size * 2; + break; + default: + return -EINVAL; + } + +- *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16))); ++ *value_ret = convert_signed_value(cval, ++ snd_usb_combine_bytes(val, val_size)); + + return 0; + } +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 48afae053c56..8e8db4ddf365 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -343,6 +343,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, + ep = 0x81; + iface = usb_ifnum_to_if(dev, 2); + ++ if (!iface || iface->num_altsetting == 0) ++ return -EINVAL; ++ ++ alts = &iface->altsetting[1]; ++ goto add_sync_ep; ++ case USB_ID(0x1397, 0x0002): ++ ep = 0x81; ++ iface = usb_ifnum_to_if(dev, 1); ++ + if (!iface || iface->num_altsetting == 0) + return -EINVAL; + diff --git a/patch/kernel/rockchip-default/04-patch-4.4.117-118.patch b/patch/kernel/rockchip-default/04-patch-4.4.117-118.patch new file mode 100644 index 000000000..64b52dda5 --- /dev/null +++ b/patch/kernel/rockchip-default/04-patch-4.4.117-118.patch @@ -0,0 +1,9558 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 22a4688dc0c8..f53ef1ac3122 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2565,8 +2565,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + norandmaps Don't use address space randomization. Equivalent to + echo 0 > /proc/sys/kernel/randomize_va_space + +- noreplace-paravirt [X86,IA-64,PV_OPS] Don't patch paravirt_ops +- + noreplace-smp [X86-32,SMP] Don't replace SMP instructions + with UP alternatives + +diff --git a/Documentation/speculation.txt b/Documentation/speculation.txt +new file mode 100644 +index 000000000000..e9e6cbae2841 +--- /dev/null ++++ b/Documentation/speculation.txt +@@ -0,0 +1,90 @@ ++This document explains potential effects of speculation, and how undesirable ++effects can be mitigated portably using common APIs. ++ ++=========== ++Speculation ++=========== ++ ++To improve performance and minimize average latencies, many contemporary CPUs ++employ speculative execution techniques such as branch prediction, performing ++work which may be discarded at a later stage. ++ ++Typically speculative execution cannot be observed from architectural state, ++such as the contents of registers. However, in some cases it is possible to ++observe its impact on microarchitectural state, such as the presence or ++absence of data in caches. Such state may form side-channels which can be ++observed to extract secret information. ++ ++For example, in the presence of branch prediction, it is possible for bounds ++checks to be ignored by code which is speculatively executed. Consider the ++following code: ++ ++ int load_array(int *array, unsigned int index) ++ { ++ if (index >= MAX_ARRAY_ELEMS) ++ return 0; ++ else ++ return array[index]; ++ } ++ ++Which, on arm64, may be compiled to an assembly sequence such as: ++ ++ CMP , #MAX_ARRAY_ELEMS ++ B.LT less ++ MOV , #0 ++ RET ++ less: ++ LDR , [, ] ++ RET ++ ++It is possible that a CPU mis-predicts the conditional branch, and ++speculatively loads array[index], even if index >= MAX_ARRAY_ELEMS. This ++value will subsequently be discarded, but the speculated load may affect ++microarchitectural state which can be subsequently measured. ++ ++More complex sequences involving multiple dependent memory accesses may ++result in sensitive information being leaked. Consider the following ++code, building on the prior example: ++ ++ int load_dependent_arrays(int *arr1, int *arr2, int index) ++ { ++ int val1, val2, ++ ++ val1 = load_array(arr1, index); ++ val2 = load_array(arr2, val1); ++ ++ return val2; ++ } ++ ++Under speculation, the first call to load_array() may return the value ++of an out-of-bounds address, while the second call will influence ++microarchitectural state dependent on this value. This may provide an ++arbitrary read primitive. ++ ++==================================== ++Mitigating speculation side-channels ++==================================== ++ ++The kernel provides a generic API to ensure that bounds checks are ++respected even under speculation. Architectures which are affected by ++speculation-based side-channels are expected to implement these ++primitives. ++ ++The array_index_nospec() helper in can be used to ++prevent information from being leaked via side-channels. ++ ++A call to array_index_nospec(index, size) returns a sanitized index ++value that is bounded to [0, size) even under cpu speculation ++conditions. ++ ++This can be used to protect the earlier load_array() example: ++ ++ int load_array(int *array, unsigned int index) ++ { ++ if (index >= MAX_ARRAY_ELEMS) ++ return 0; ++ else { ++ index = array_index_nospec(index, MAX_ARRAY_ELEMS); ++ return array[index]; ++ } ++ } +diff --git a/Makefile b/Makefile +index 9f53ba1835ad..1e01148744f3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 117 ++SUBLEVEL = 118 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -87,10 +87,12 @@ endif + ifneq ($(filter 4.%,$(MAKE_VERSION)),) # make-4 + ifneq ($(filter %s ,$(firstword x$(MAKEFLAGS))),) + quiet=silent_ ++ tools_silent=s + endif + else # make-3.8x + ifneq ($(filter s% -s%,$(MAKEFLAGS)),) + quiet=silent_ ++ tools_silent=-s + endif + endif + +@@ -1523,11 +1525,11 @@ image_name: + # Clear a bunch of variables before executing the submake + tools/: FORCE + $(Q)mkdir -p $(objtree)/tools +- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ ++ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ + + tools/%: FORCE + $(Q)mkdir -p $(objtree)/tools +- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ $* ++ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ $* + + # Single targets + # --------------------------------------------------------------------------- +diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi +index de8791a4d131..3ef1d5a26389 100644 +--- a/arch/arm/boot/dts/am4372.dtsi ++++ b/arch/arm/boot/dts/am4372.dtsi +@@ -807,7 +807,8 @@ + reg = <0x48038000 0x2000>, + <0x46000000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <80>, <81>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 8>, +@@ -821,7 +822,8 @@ + reg = <0x4803C000 0x2000>, + <0x46400000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <82>, <83>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 10>, +diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi +index 5a206c100ce2..8a5628c4b135 100644 +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -844,14 +844,12 @@ + usbhsohci: ohci@4a064800 { + compatible = "ti,ohci-omap3"; + reg = <0x4a064800 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + + usbhsehci: ehci@4a064c00 { + compatible = "ti,ehci-omap"; + reg = <0x4a064c00 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + }; +diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c +index 5ac122e88f67..9ff92050053c 100644 +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base(void) + return omap_secure_memblock_base; + } + ++u32 omap3_save_secure_ram(void __iomem *addr, int size) ++{ ++ u32 ret; ++ u32 param[5]; ++ ++ if (size != OMAP3_SAVE_SECURE_RAM_SZ) ++ return OMAP3_SAVE_SECURE_RAM_SZ; ++ ++ param[0] = 4; /* Number of arguments */ ++ param[1] = __pa(addr); /* Physical address for saving */ ++ param[2] = 0; ++ param[3] = 1; ++ param[4] = 1; ++ ++ ret = save_secure_ram_context(__pa(param)); ++ ++ return ret; ++} ++ + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls + * @idx: The PPA API index +diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h +index af2851fbcdf0..ab6ce2597a88 100644 +--- a/arch/arm/mach-omap2/omap-secure.h ++++ b/arch/arm/mach-omap2/omap-secure.h +@@ -31,6 +31,8 @@ + /* Maximum Secure memory storage size */ + #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K) + ++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F ++ + /* Secure low power HAL API index */ + #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a + #define OMAP4_HAL_SAVEHW_INDEX 0x1b +@@ -64,6 +66,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u32 pargs); + extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs); + extern phys_addr_t omap_secure_ram_mempool_base(void); + extern int omap_secure_ram_reserve_memblock(void); ++extern u32 save_secure_ram_context(u32 args_pa); ++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size); + + extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs, + u32 arg1, u32 arg2, u32 arg3, u32 arg4); +diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h +index b668719b9b25..8e30772cfe32 100644 +--- a/arch/arm/mach-omap2/pm.h ++++ b/arch/arm/mach-omap2/pm.h +@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz; + /* ... and its pointer from SRAM after copy */ + extern void (*omap3_do_wfi_sram)(void); + +-/* save_secure_ram_context function pointer and size, for copy to SRAM */ +-extern int save_secure_ram_context(u32 *addr); +-extern unsigned int save_secure_ram_context_sz; +- + extern void omap3_save_scratchpad_contents(void); + + #define PM_RTA_ERRATUM_i608 (1 << 0) +diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c +index 2dbd3785ee6f..181da202f981 100644 +--- a/arch/arm/mach-omap2/pm34xx.c ++++ b/arch/arm/mach-omap2/pm34xx.c +@@ -48,6 +48,7 @@ + #include "prm3xxx.h" + #include "pm.h" + #include "sdrc.h" ++#include "omap-secure.h" + #include "sram.h" + #include "control.h" + #include "vc.h" +@@ -66,7 +67,6 @@ struct power_state { + + static LIST_HEAD(pwrst_list); + +-static int (*_omap_save_secure_sram)(u32 *addr); + void (*omap3_do_wfi_sram)(void); + + static struct powerdomain *mpu_pwrdm, *neon_pwrdm; +@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_context(void) + * will hang the system. + */ + pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON); +- ret = _omap_save_secure_sram((u32 *)(unsigned long) +- __pa(omap3_secure_ram_storage)); ++ ret = omap3_save_secure_ram(omap3_secure_ram_storage, ++ OMAP3_SAVE_SECURE_RAM_SZ); + pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state); + /* Following is for error tracking, it should not happen */ + if (ret) { +@@ -431,15 +431,10 @@ static int __init pwrdms_setup(struct powerdomain *pwrdm, void *unused) + * + * The minimum set of functions is pushed to SRAM for execution: + * - omap3_do_wfi for erratum i581 WA, +- * - save_secure_ram_context for security extensions. + */ + void omap_push_sram_idle(void) + { + omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz); +- +- if (omap_type() != OMAP2_DEVICE_TYPE_GP) +- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context, +- save_secure_ram_context_sz); + } + + static void __init pm_errata_configure(void) +@@ -551,7 +546,7 @@ int __init omap3_pm_init(void) + clkdm_add_wkdep(neon_clkdm, mpu_clkdm); + if (omap_type() != OMAP2_DEVICE_TYPE_GP) { + omap3_secure_ram_storage = +- kmalloc(0x803F, GFP_KERNEL); ++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL); + if (!omap3_secure_ram_storage) + pr_err("Memory allocation failed when allocating for secure sram context\n"); + +diff --git a/arch/arm/mach-omap2/prm33xx.c b/arch/arm/mach-omap2/prm33xx.c +index dcb5001d77da..973bcd754e1c 100644 +--- a/arch/arm/mach-omap2/prm33xx.c ++++ b/arch/arm/mach-omap2/prm33xx.c +@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struct powerdomain *pwrdm) + return v; + } + +-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm) +-{ +- u32 v; +- +- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs); +- v &= AM33XX_LASTPOWERSTATEENTERED_MASK; +- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT; +- +- return v; +-} +- + static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm) + { + am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK, +@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations = { + .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst, + .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst, + .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst, +- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst, + .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst, + .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst, + .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst, +diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S +index 1b9f0520dea9..3e0d802c59da 100644 +--- a/arch/arm/mach-omap2/sleep34xx.S ++++ b/arch/arm/mach-omap2/sleep34xx.S +@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_restore) + ENDPROC(enable_omap3630_toggle_l2_on_restore) + + /* +- * Function to call rom code to save secure ram context. This gets +- * relocated to SRAM, so it can be all in .data section. Otherwise +- * we need to initialize api_params separately. ++ * Function to call rom code to save secure ram context. ++ * ++ * r0 = physical address of the parameters + */ +- .data +- .align 3 + ENTRY(save_secure_ram_context) + stmfd sp!, {r4 - r11, lr} @ save registers on stack +- adr r3, api_params @ r3 points to parameters +- str r0, [r3,#0x4] @ r0 has sdram address +- ldr r12, high_mask +- and r3, r3, r12 +- ldr r12, sram_phy_addr_mask +- orr r3, r3, r12 ++ mov r3, r0 @ physical address of parameters + mov r0, #25 @ set service ID for PPA + mov r12, r0 @ copy secure service ID in r12 + mov r1, #0 @ set task id for ROM code in r1 +@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context) + nop + nop + ldmfd sp!, {r4 - r11, pc} +- .align +-sram_phy_addr_mask: +- .word SRAM_BASE_P +-high_mask: +- .word 0xffff +-api_params: +- .word 0x4, 0x0, 0x0, 0x1, 0x1 + ENDPROC(save_secure_ram_context) +-ENTRY(save_secure_ram_context_sz) +- .word . - save_secure_ram_context +- +- .text + + /* + * ====================== +diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig +index 0fa4c5f8b1be..2d43357d4a0a 100644 +--- a/arch/arm/mach-tegra/Kconfig ++++ b/arch/arm/mach-tegra/Kconfig +@@ -12,8 +12,6 @@ menuconfig ARCH_TEGRA + select ARCH_HAS_RESET_CONTROLLER + select RESET_CONTROLLER + select SOC_BUS +- select USB_ULPI if USB_PHY +- select USB_ULPI_VIEWPORT if USB_PHY + help + This enables support for NVIDIA Tegra based systems. + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 83af36d9439f..02c08671553e 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -785,7 +785,7 @@ source "fs/Kconfig.binfmt" + config COMPAT + bool "Kernel support for 32-bit EL0" + depends on ARM64_4K_PAGES || EXPERT +- select COMPAT_BINFMT_ELF ++ select COMPAT_BINFMT_ELF if BINFMT_ELF + select HAVE_UID16 + select OLD_SIGSUSPEND3 + select COMPAT_OLD_SIGACTION +diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms +index 4043c35962cc..5edb50772c11 100644 +--- a/arch/arm64/Kconfig.platforms ++++ b/arch/arm64/Kconfig.platforms +@@ -90,8 +90,6 @@ config ARCH_TEGRA_132_SOC + bool "NVIDIA Tegra132 SoC" + depends on ARCH_TEGRA + select PINCTRL_TEGRA124 +- select USB_ULPI if USB_PHY +- select USB_ULPI_VIEWPORT if USB_PHY + help + Enable support for NVIDIA Tegra132 SoC, based on the Denver + ARMv8 CPU. The Tegra132 SoC is similar to the Tegra124 SoC, +diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +index 4dd5f93d0303..7f42b646d528 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +@@ -54,6 +54,7 @@ + reg = <0x000>; + enable-method = "psci"; + cpu-idle-states = <&CPU_SLEEP_0>; ++ #cooling-cells = <2>; + }; + + cpu1: cpu@1 { +@@ -70,6 +71,7 @@ + reg = <0x100>; + enable-method = "psci"; + cpu-idle-states = <&CPU_SLEEP_0>; ++ #cooling-cells = <2>; + }; + + cpu3: cpu@101 { +diff --git a/arch/arm64/include/asm/bug.h b/arch/arm64/include/asm/bug.h +index 4a748ce9ba1a..ac6382b25add 100644 +--- a/arch/arm64/include/asm/bug.h ++++ b/arch/arm64/include/asm/bug.h +@@ -20,9 +20,6 @@ + + #include + +-#ifdef CONFIG_GENERIC_BUG +-#define HAVE_ARCH_BUG +- + #ifdef CONFIG_DEBUG_BUGVERBOSE + #define _BUGVERBOSE_LOCATION(file, line) __BUGVERBOSE_LOCATION(file, line) + #define __BUGVERBOSE_LOCATION(file, line) \ +@@ -36,28 +33,36 @@ + #define _BUGVERBOSE_LOCATION(file, line) + #endif + +-#define _BUG_FLAGS(flags) __BUG_FLAGS(flags) ++#ifdef CONFIG_GENERIC_BUG + +-#define __BUG_FLAGS(flags) asm volatile ( \ ++#define __BUG_ENTRY(flags) \ + ".pushsection __bug_table,\"a\"\n\t" \ + ".align 2\n\t" \ + "0: .long 1f - 0b\n\t" \ + _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ + ".short " #flags "\n\t" \ + ".popsection\n" \ +- \ +- "1: brk %[imm]" \ +- :: [imm] "i" (BUG_BRK_IMM) \ +-) ++ "1: " ++#else ++#define __BUG_ENTRY(flags) "" ++#endif ++ ++#define __BUG_FLAGS(flags) \ ++ asm volatile ( \ ++ __BUG_ENTRY(flags) \ ++ "brk %[imm]" :: [imm] "i" (BUG_BRK_IMM) \ ++ ); + +-#define BUG() do { \ +- _BUG_FLAGS(0); \ +- unreachable(); \ ++ ++#define BUG() do { \ ++ __BUG_FLAGS(0); \ ++ unreachable(); \ + } while (0) + +-#define __WARN_TAINT(taint) _BUG_FLAGS(BUGFLAG_TAINT(taint)) ++#define __WARN_TAINT(taint) \ ++ __BUG_FLAGS(BUGFLAG_TAINT(taint)) + +-#endif /* ! CONFIG_GENERIC_BUG */ ++#define HAVE_ARCH_BUG + + #include + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index b2ab164a8094..4eba7c00ea1f 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -1381,7 +1381,7 @@ static int collect_events(struct perf_event *group, int max_count, + int n = 0; + struct perf_event *event; + +- if (!is_software_event(group)) { ++ if (group->pmu->task_ctx_nr == perf_hw_context) { + if (n >= max_count) + return -1; + ctrs[n] = group; +@@ -1389,7 +1389,7 @@ static int collect_events(struct perf_event *group, int max_count, + events[n++] = group->hw.config; + } + list_for_each_entry(event, &group->sibling_list, group_entry) { +- if (!is_software_event(event) && ++ if (event->pmu->task_ctx_nr == perf_hw_context && + event->state != PERF_EVENT_STATE_OFF) { + if (n >= max_count) + return -1; +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 2db93042f2f3..bb6aab2fa7f5 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1009,7 +1009,7 @@ config X86_MCE_THRESHOLD + def_bool y + + config X86_MCE_INJECT +- depends on X86_MCE ++ depends on X86_MCE && X86_LOCAL_APIC + tristate "Machine check injector support" + ---help--- + Provide support for injecting machine checks for testing purposes. +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug +index 137dfa96aa14..da00fe1f48f4 100644 +--- a/arch/x86/Kconfig.debug ++++ b/arch/x86/Kconfig.debug +@@ -391,6 +391,7 @@ config X86_DEBUG_FPU + + config PUNIT_ATOM_DEBUG + tristate "ATOM Punit debug driver" ++ depends on PCI + select DEBUG_FS + select IOSF_MBI + ---help--- +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index c0cc2a6be0bf..6da2cd0897f3 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -64,12 +64,13 @@ GCOV_PROFILE := n + $(obj)/bzImage: asflags-y := $(SVGA_MODE) + + quiet_cmd_image = BUILD $@ ++silent_redirect_image = >/dev/null + cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin \ +- $(obj)/zoffset.h $@ ++ $(obj)/zoffset.h $@ $($(quiet)redirect_image) + + $(obj)/bzImage: $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/tools/build FORCE + $(call if_changed,image) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' ++ @$(kecho) 'Kernel: $@ is ready' ' (#'`cat .version`')' + + OBJCOPYFLAGS_vmlinux.bin := -O binary -R .note -R .comment -S + $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE +diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S +index 1c3b7ceb36d2..e7273a606a07 100644 +--- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S ++++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S +@@ -55,29 +55,31 @@ + #define RAB1bl %bl + #define RAB2bl %cl + ++#define CD0 0x0(%rsp) ++#define CD1 0x8(%rsp) ++#define CD2 0x10(%rsp) ++ ++# used only before/after all rounds + #define RCD0 %r8 + #define RCD1 %r9 + #define RCD2 %r10 + +-#define RCD0d %r8d +-#define RCD1d %r9d +-#define RCD2d %r10d +- +-#define RX0 %rbp +-#define RX1 %r11 +-#define RX2 %r12 ++# used only during rounds ++#define RX0 %r8 ++#define RX1 %r9 ++#define RX2 %r10 + +-#define RX0d %ebp +-#define RX1d %r11d +-#define RX2d %r12d ++#define RX0d %r8d ++#define RX1d %r9d ++#define RX2d %r10d + +-#define RY0 %r13 +-#define RY1 %r14 +-#define RY2 %r15 ++#define RY0 %r11 ++#define RY1 %r12 ++#define RY2 %r13 + +-#define RY0d %r13d +-#define RY1d %r14d +-#define RY2d %r15d ++#define RY0d %r11d ++#define RY1d %r12d ++#define RY2d %r13d + + #define RT0 %rdx + #define RT1 %rsi +@@ -85,6 +87,8 @@ + #define RT0d %edx + #define RT1d %esi + ++#define RT1bl %sil ++ + #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \ + movzbl ab ## bl, tmp2 ## d; \ + movzbl ab ## bh, tmp1 ## d; \ +@@ -92,6 +96,11 @@ + op1##l T0(CTX, tmp2, 4), dst ## d; \ + op2##l T1(CTX, tmp1, 4), dst ## d; + ++#define swap_ab_with_cd(ab, cd, tmp) \ ++ movq cd, tmp; \ ++ movq ab, cd; \ ++ movq tmp, ab; ++ + /* + * Combined G1 & G2 function. Reordered with help of rotates to have moves + * at begining. +@@ -110,15 +119,15 @@ + /* G1,2 && G2,2 */ \ + do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \ + do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \ +- xchgq cd ## 0, ab ## 0; \ ++ swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \ + \ + do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \ + do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \ +- xchgq cd ## 1, ab ## 1; \ ++ swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \ + \ + do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \ + do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \ +- xchgq cd ## 2, ab ## 2; ++ swap_ab_with_cd(ab ## 2, cd ## 2, RT0); + + #define enc_round_end(ab, x, y, n) \ + addl y ## d, x ## d; \ +@@ -168,6 +177,16 @@ + decrypt_round3(ba, dc, (n*2)+1); \ + decrypt_round3(ba, dc, (n*2)); + ++#define push_cd() \ ++ pushq RCD2; \ ++ pushq RCD1; \ ++ pushq RCD0; ++ ++#define pop_cd() \ ++ popq RCD0; \ ++ popq RCD1; \ ++ popq RCD2; ++ + #define inpack3(in, n, xy, m) \ + movq 4*(n)(in), xy ## 0; \ + xorq w+4*m(CTX), xy ## 0; \ +@@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way) + * %rdx: src, RIO + * %rcx: bool, if true: xor output + */ +- pushq %r15; +- pushq %r14; + pushq %r13; + pushq %r12; +- pushq %rbp; + pushq %rbx; + + pushq %rcx; /* bool xor */ +@@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way) + + inpack_enc3(); + +- encrypt_cycle3(RAB, RCD, 0); +- encrypt_cycle3(RAB, RCD, 1); +- encrypt_cycle3(RAB, RCD, 2); +- encrypt_cycle3(RAB, RCD, 3); +- encrypt_cycle3(RAB, RCD, 4); +- encrypt_cycle3(RAB, RCD, 5); +- encrypt_cycle3(RAB, RCD, 6); +- encrypt_cycle3(RAB, RCD, 7); ++ push_cd(); ++ encrypt_cycle3(RAB, CD, 0); ++ encrypt_cycle3(RAB, CD, 1); ++ encrypt_cycle3(RAB, CD, 2); ++ encrypt_cycle3(RAB, CD, 3); ++ encrypt_cycle3(RAB, CD, 4); ++ encrypt_cycle3(RAB, CD, 5); ++ encrypt_cycle3(RAB, CD, 6); ++ encrypt_cycle3(RAB, CD, 7); ++ pop_cd(); + + popq RIO; /* dst */ +- popq %rbp; /* bool xor */ ++ popq RT1; /* bool xor */ + +- testb %bpl, %bpl; ++ testb RT1bl, RT1bl; + jnz .L__enc_xor3; + + outunpack_enc3(mov); + + popq %rbx; +- popq %rbp; + popq %r12; + popq %r13; +- popq %r14; +- popq %r15; + ret; + + .L__enc_xor3: + outunpack_enc3(xor); + + popq %rbx; +- popq %rbp; + popq %r12; + popq %r13; +- popq %r14; +- popq %r15; + ret; + ENDPROC(__twofish_enc_blk_3way) + +@@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way) + * %rsi: dst + * %rdx: src, RIO + */ +- pushq %r15; +- pushq %r14; + pushq %r13; + pushq %r12; +- pushq %rbp; + pushq %rbx; + + pushq %rsi; /* dst */ + + inpack_dec3(); + +- decrypt_cycle3(RAB, RCD, 7); +- decrypt_cycle3(RAB, RCD, 6); +- decrypt_cycle3(RAB, RCD, 5); +- decrypt_cycle3(RAB, RCD, 4); +- decrypt_cycle3(RAB, RCD, 3); +- decrypt_cycle3(RAB, RCD, 2); +- decrypt_cycle3(RAB, RCD, 1); +- decrypt_cycle3(RAB, RCD, 0); ++ push_cd(); ++ decrypt_cycle3(RAB, CD, 7); ++ decrypt_cycle3(RAB, CD, 6); ++ decrypt_cycle3(RAB, CD, 5); ++ decrypt_cycle3(RAB, CD, 4); ++ decrypt_cycle3(RAB, CD, 3); ++ decrypt_cycle3(RAB, CD, 2); ++ decrypt_cycle3(RAB, CD, 1); ++ decrypt_cycle3(RAB, CD, 0); ++ pop_cd(); + + popq RIO; /* dst */ + + outunpack_dec3(); + + popq %rbx; +- popq %rbp; + popq %r12; + popq %r13; +- popq %r14; +- popq %r15; + ret; + ENDPROC(twofish_dec_blk_3way) +diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c +index 1a4477cedc49..b5eb1cca70a0 100644 +--- a/arch/x86/entry/common.c ++++ b/arch/x86/entry/common.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -381,6 +382,7 @@ __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs) + } + + if (likely(nr < IA32_NR_syscalls)) { ++ nr = array_index_nospec(nr, IA32_NR_syscalls); + /* + * It's possible that a 32-bit syscall implementation + * takes a 64-bit parameter but nonetheless assumes that +diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h +index b15aa4083dfd..5a25ada75aeb 100644 +--- a/arch/x86/include/asm/asm-prototypes.h ++++ b/arch/x86/include/asm/asm-prototypes.h +@@ -37,5 +37,4 @@ INDIRECT_THUNK(dx) + INDIRECT_THUNK(si) + INDIRECT_THUNK(di) + INDIRECT_THUNK(bp) +-INDIRECT_THUNK(sp) + #endif /* CONFIG_RETPOLINE */ +diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h +index 0681d2532527..814ef83c6720 100644 +--- a/arch/x86/include/asm/barrier.h ++++ b/arch/x86/include/asm/barrier.h +@@ -24,6 +24,34 @@ + #define wmb() asm volatile("sfence" ::: "memory") + #endif + ++/** ++ * array_index_mask_nospec() - generate a mask that is ~0UL when the ++ * bounds check succeeds and 0 otherwise ++ * @index: array element index ++ * @size: number of elements in array ++ * ++ * Returns: ++ * 0 - (index < size) ++ */ ++static inline unsigned long array_index_mask_nospec(unsigned long index, ++ unsigned long size) ++{ ++ unsigned long mask; ++ ++ asm ("cmp %1,%2; sbb %0,%0;" ++ :"=r" (mask) ++ :"r"(size),"r" (index) ++ :"cc"); ++ return mask; ++} ++ ++/* Override the default implementation from linux/nospec.h. */ ++#define array_index_mask_nospec array_index_mask_nospec ++ ++/* Prevent speculative execution past this barrier. */ ++#define barrier_nospec() alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, \ ++ "lfence", X86_FEATURE_LFENCE_RDTSC) ++ + #ifdef CONFIG_X86_PPRO_FENCE + #define dma_rmb() rmb() + #else +diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h +index adfc847a395e..fb163f02ebb1 100644 +--- a/arch/x86/include/asm/microcode_amd.h ++++ b/arch/x86/include/asm/microcode_amd.h +@@ -59,7 +59,6 @@ static inline u16 find_equiv_id(struct equiv_cpu_entry *equiv_cpu_table, + + extern int __apply_microcode_amd(struct microcode_amd *mc_amd); + extern int apply_microcode_amd(int cpu); +-extern enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size); + + #define PATCH_MAX_SIZE PAGE_SIZE + extern u8 amd_ucode_patch[PATCH_MAX_SIZE]; +diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h +index 77d8b284e4a7..5a10ac8c131e 100644 +--- a/arch/x86/include/asm/msr.h ++++ b/arch/x86/include/asm/msr.h +@@ -147,8 +147,7 @@ static __always_inline unsigned long long rdtsc_ordered(void) + * that some other imaginary CPU is updating continuously with a + * time stamp. + */ +- alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, +- "lfence", X86_FEATURE_LFENCE_RDTSC); ++ barrier_nospec(); + return rdtsc(); + } + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 492370b9b35b..66094a0473a8 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + +-#ifndef __NOSPEC_BRANCH_H__ +-#define __NOSPEC_BRANCH_H__ ++#ifndef _ASM_X86_NOSPEC_BRANCH_H_ ++#define _ASM_X86_NOSPEC_BRANCH_H_ + + #include + #include +@@ -178,7 +178,7 @@ extern char __indirect_thunk_end[]; + * On VMEXIT we must ensure that no RSB predictions learned in the guest + * can be followed in the host, by overwriting the RSB completely. Both + * retpoline and IBRS mitigations for Spectre v2 need this; only on future +- * CPUs with IBRS_ATT *might* it be avoided. ++ * CPUs with IBRS_ALL *might* it be avoided. + */ + static inline void vmexit_fill_RSB(void) + { +@@ -195,4 +195,4 @@ static inline void vmexit_fill_RSB(void) + } + + #endif /* __ASSEMBLY__ */ +-#endif /* __NOSPEC_BRANCH_H__ */ ++#endif /* _ASM_X86_NOSPEC_BRANCH_H_ */ +diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h +index 14c63c7e8337..6b6e16d813b9 100644 +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -400,10 +400,11 @@ enum vmcs_field { + #define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT (KVM_USER_MEM_SLOTS + 2) + + #define VMX_NR_VPIDS (1 << 16) ++#define VMX_VPID_EXTENT_INDIVIDUAL_ADDR 0 + #define VMX_VPID_EXTENT_SINGLE_CONTEXT 1 + #define VMX_VPID_EXTENT_ALL_CONTEXT 2 ++#define VMX_VPID_EXTENT_SINGLE_NON_GLOBAL 3 + +-#define VMX_EPT_EXTENT_INDIVIDUAL_ADDR 0 + #define VMX_EPT_EXTENT_CONTEXT 1 + #define VMX_EPT_EXTENT_GLOBAL 2 + #define VMX_EPT_EXTENT_SHIFT 24 +@@ -420,8 +421,10 @@ enum vmcs_field { + #define VMX_EPT_EXTENT_GLOBAL_BIT (1ull << 26) + + #define VMX_VPID_INVVPID_BIT (1ull << 0) /* (32 - 32) */ ++#define VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT (1ull << 8) /* (40 - 32) */ + #define VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT (1ull << 9) /* (41 - 32) */ + #define VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT (1ull << 10) /* (42 - 32) */ ++#define VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT (1ull << 11) /* (43 - 32) */ + + #define VMX_EPT_DEFAULT_GAW 3 + #define VMX_EPT_MAX_GAW 0x4 +diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c +index d6f375f1b928..89829c3d5a74 100644 +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -45,17 +45,6 @@ static int __init setup_noreplace_smp(char *str) + } + __setup("noreplace-smp", setup_noreplace_smp); + +-#ifdef CONFIG_PARAVIRT +-static int __initdata_or_module noreplace_paravirt = 0; +- +-static int __init setup_noreplace_paravirt(char *str) +-{ +- noreplace_paravirt = 1; +- return 1; +-} +-__setup("noreplace-paravirt", setup_noreplace_paravirt); +-#endif +- + #define DPRINTK(fmt, args...) \ + do { \ + if (debug_alternative) \ +@@ -587,9 +576,6 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start, + struct paravirt_patch_site *p; + char insnbuf[MAX_PATCH_LEN]; + +- if (noreplace_paravirt) +- return; +- + for (p = start; p < end; p++) { + unsigned int used; + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 8cacf62ec458..ecaf7c9baf75 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -89,20 +90,42 @@ static const char *spectre_v2_strings[] = { + }; + + #undef pr_fmt +-#define pr_fmt(fmt) "Spectre V2 mitigation: " fmt ++#define pr_fmt(fmt) "Spectre V2 : " fmt + + static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; + ++ ++#ifdef RETPOLINE ++static bool spectre_v2_bad_module; ++ ++bool retpoline_module_ok(bool has_retpoline) ++{ ++ if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline) ++ return true; ++ ++ pr_err("System may be vulnerable to spectre v2\n"); ++ spectre_v2_bad_module = true; ++ return false; ++} ++ ++static inline const char *spectre_v2_module_string(void) ++{ ++ return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; ++} ++#else ++static inline const char *spectre_v2_module_string(void) { return ""; } ++#endif ++ + static void __init spec2_print_if_insecure(const char *reason) + { + if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) +- pr_info("%s\n", reason); ++ pr_info("%s selected on command line.\n", reason); + } + + static void __init spec2_print_if_secure(const char *reason) + { + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) +- pr_info("%s\n", reason); ++ pr_info("%s selected on command line.\n", reason); + } + + static inline bool retp_compiler(void) +@@ -117,42 +140,68 @@ static inline bool match_option(const char *arg, int arglen, const char *opt) + return len == arglen && !strncmp(arg, opt, len); + } + ++static const struct { ++ const char *option; ++ enum spectre_v2_mitigation_cmd cmd; ++ bool secure; ++} mitigation_options[] = { ++ { "off", SPECTRE_V2_CMD_NONE, false }, ++ { "on", SPECTRE_V2_CMD_FORCE, true }, ++ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false }, ++ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false }, ++ { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false }, ++ { "auto", SPECTRE_V2_CMD_AUTO, false }, ++}; ++ + static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) + { + char arg[20]; +- int ret; +- +- ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, +- sizeof(arg)); +- if (ret > 0) { +- if (match_option(arg, ret, "off")) { +- goto disable; +- } else if (match_option(arg, ret, "on")) { +- spec2_print_if_secure("force enabled on command line."); +- return SPECTRE_V2_CMD_FORCE; +- } else if (match_option(arg, ret, "retpoline")) { +- spec2_print_if_insecure("retpoline selected on command line."); +- return SPECTRE_V2_CMD_RETPOLINE; +- } else if (match_option(arg, ret, "retpoline,amd")) { +- if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { +- pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); +- return SPECTRE_V2_CMD_AUTO; +- } +- spec2_print_if_insecure("AMD retpoline selected on command line."); +- return SPECTRE_V2_CMD_RETPOLINE_AMD; +- } else if (match_option(arg, ret, "retpoline,generic")) { +- spec2_print_if_insecure("generic retpoline selected on command line."); +- return SPECTRE_V2_CMD_RETPOLINE_GENERIC; +- } else if (match_option(arg, ret, "auto")) { ++ int ret, i; ++ enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO; ++ ++ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2")) ++ return SPECTRE_V2_CMD_NONE; ++ else { ++ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, ++ sizeof(arg)); ++ if (ret < 0) ++ return SPECTRE_V2_CMD_AUTO; ++ ++ for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) { ++ if (!match_option(arg, ret, mitigation_options[i].option)) ++ continue; ++ cmd = mitigation_options[i].cmd; ++ break; ++ } ++ ++ if (i >= ARRAY_SIZE(mitigation_options)) { ++ pr_err("unknown option (%s). Switching to AUTO select\n", ++ mitigation_options[i].option); + return SPECTRE_V2_CMD_AUTO; + } + } + +- if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2")) ++ if ((cmd == SPECTRE_V2_CMD_RETPOLINE || ++ cmd == SPECTRE_V2_CMD_RETPOLINE_AMD || ++ cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) && ++ !IS_ENABLED(CONFIG_RETPOLINE)) { ++ pr_err("%s selected but not compiled in. Switching to AUTO select\n", ++ mitigation_options[i].option); + return SPECTRE_V2_CMD_AUTO; +-disable: +- spec2_print_if_insecure("disabled on command line."); +- return SPECTRE_V2_CMD_NONE; ++ } ++ ++ if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD && ++ boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { ++ pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); ++ return SPECTRE_V2_CMD_AUTO; ++ } ++ ++ if (mitigation_options[i].secure) ++ spec2_print_if_secure(mitigation_options[i].option); ++ else ++ spec2_print_if_insecure(mitigation_options[i].option); ++ ++ return cmd; + } + + /* Check for Skylake-like CPUs (for RSB handling) */ +@@ -190,10 +239,10 @@ static void __init spectre_v2_select_mitigation(void) + return; + + case SPECTRE_V2_CMD_FORCE: +- /* FALLTRHU */ + case SPECTRE_V2_CMD_AUTO: +- goto retpoline_auto; +- ++ if (IS_ENABLED(CONFIG_RETPOLINE)) ++ goto retpoline_auto; ++ break; + case SPECTRE_V2_CMD_RETPOLINE_AMD: + if (IS_ENABLED(CONFIG_RETPOLINE)) + goto retpoline_amd; +@@ -268,7 +317,7 @@ ssize_t cpu_show_spectre_v1(struct device *dev, + { + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1)) + return sprintf(buf, "Not affected\n"); +- return sprintf(buf, "Vulnerable\n"); ++ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); + } + + ssize_t cpu_show_spectre_v2(struct device *dev, +@@ -277,6 +326,7 @@ ssize_t cpu_show_spectre_v2(struct device *dev, + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) + return sprintf(buf, "Not affected\n"); + +- return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]); ++ return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled], ++ spectre_v2_module_string()); + } + #endif +diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c +index 4cfba4371a71..101bfae369e1 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c ++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c +@@ -152,7 +152,6 @@ static void raise_mce(struct mce *m) + if (context == MCJ_CTX_RANDOM) + return; + +-#ifdef CONFIG_X86_LOCAL_APIC + if (m->inject_flags & (MCJ_IRQ_BROADCAST | MCJ_NMI_BROADCAST)) { + unsigned long start; + int cpu; +@@ -193,9 +192,7 @@ static void raise_mce(struct mce *m) + raise_local(); + put_cpu(); + put_online_cpus(); +- } else +-#endif +- { ++ } else { + preempt_disable(); + raise_local(); + preempt_enable(); +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 2a0f44d225fe..6da6f9cd6d2d 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -131,6 +131,9 @@ static size_t compute_container_size(u8 *data, u32 total_size) + return size; + } + ++static enum ucode_state ++load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); ++ + /* + * Early load occurs before we can vmalloc(). So we look for the microcode + * patch container file in initrd, traverse equivalent cpu table, look for a +@@ -438,7 +441,7 @@ int __init save_microcode_in_initrd_amd(void) + eax = cpuid_eax(0x00000001); + eax = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff); + +- ret = load_microcode_amd(smp_processor_id(), eax, container, container_size); ++ ret = load_microcode_amd(true, eax, container, container_size); + if (ret != UCODE_OK) + retval = -EINVAL; + +@@ -854,7 +857,8 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, + return UCODE_OK; + } + +-enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size) ++static enum ucode_state ++load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + { + enum ucode_state ret; + +@@ -868,8 +872,8 @@ enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t s + + #ifdef CONFIG_X86_32 + /* save BSP's matching patch for early load */ +- if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) { +- struct ucode_patch *p = find_patch(cpu); ++ if (save) { ++ struct ucode_patch *p = find_patch(0); + if (p) { + memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); + memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), +@@ -901,11 +905,12 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device, + { + char fw_name[36] = "amd-ucode/microcode_amd.bin"; + struct cpuinfo_x86 *c = &cpu_data(cpu); ++ bool bsp = c->cpu_index == boot_cpu_data.cpu_index; + enum ucode_state ret = UCODE_NFOUND; + const struct firmware *fw; + + /* reload ucode container only on the boot cpu */ +- if (!refresh_fw || c->cpu_index != boot_cpu_data.cpu_index) ++ if (!refresh_fw || !bsp) + return UCODE_OK; + + if (c->x86 >= 0x15) +@@ -922,7 +927,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device, + goto fw_release; + } + +- ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size); ++ ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); + + fw_release: + release_firmware(fw); +diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c +index 5b2f2306fbcc..b52a8d08ab36 100644 +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -188,8 +188,8 @@ static void release_pmc_hardware(void) {} + + static bool check_hw_exists(void) + { +- u64 val, val_fail, val_new= ~0; +- int i, reg, reg_fail, ret = 0; ++ u64 val, val_fail = -1, val_new= ~0; ++ int i, reg, reg_fail = -1, ret = 0; + int bios_fail = 0; + int reg_safe = -1; + +diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S +index 8f1a3f443f7d..70284d38fdc2 100644 +--- a/arch/x86/kernel/head_32.S ++++ b/arch/x86/kernel/head_32.S +@@ -669,14 +669,17 @@ __PAGE_ALIGNED_BSS + initial_pg_pmd: + .fill 1024*KPMDS,4,0 + #else +-ENTRY(initial_page_table) ++.globl initial_page_table ++initial_page_table: + .fill 1024,4,0 + #endif + initial_pg_fixmap: + .fill 1024,4,0 +-ENTRY(empty_zero_page) ++.globl empty_zero_page ++empty_zero_page: + .fill 4096,1,0 +-ENTRY(swapper_pg_dir) ++.globl swapper_pg_dir ++swapper_pg_dir: + .fill 1024,4,0 + + /* +diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig +index 639a6e34500c..53b7f53f6207 100644 +--- a/arch/x86/kvm/Kconfig ++++ b/arch/x86/kvm/Kconfig +@@ -22,7 +22,8 @@ config KVM + depends on HAVE_KVM + depends on HIGH_RES_TIMERS + # for TASKSTATS/TASK_DELAY_ACCT: +- depends on NET ++ depends on NET && MULTIUSER ++ depends on X86_LOCAL_APIC + select PREEMPT_NOTIFIERS + select MMU_NOTIFIER + select ANON_INODES +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index e4eb1d2bf849..8864fec63a20 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include "x86.h" + #include "tss.h" +@@ -1000,8 +1001,8 @@ static u8 test_cc(unsigned int condition, unsigned long flags) + void (*fop)(void) = (void *)em_setcc + 4 * (condition & 0xf); + + flags = (flags & EFLAGS_MASK) | X86_EFLAGS_IF; +- asm("push %[flags]; popf; call *%[fastop]" +- : "=a"(rc) : [fastop]"r"(fop), [flags]"r"(flags)); ++ asm("push %[flags]; popf; " CALL_NOSPEC ++ : "=a"(rc) : [thunk_target]"r"(fop), [flags]"r"(flags)); + return rc; + } + +@@ -5297,9 +5298,9 @@ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *)) + ulong flags = (ctxt->eflags & EFLAGS_MASK) | X86_EFLAGS_IF; + if (!(ctxt->d & ByteOp)) + fop += __ffs(ctxt->dst.bytes) * FASTOP_SIZE; +- asm("push %[flags]; popf; call *%[fastop]; pushf; pop %[flags]\n" ++ asm("push %[flags]; popf; " CALL_NOSPEC "; pushf; pop %[flags]\n" + : "+a"(ctxt->dst.val), "+d"(ctxt->src.val), [flags]"+D"(flags), +- [fastop]"+S"(fop) ++ [thunk_target]"+S"(fop) + : "c"(ctxt->src2.val)); + ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); + if (!fop) /* exception is returned in fop variable */ +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 2a1a8737015b..849517805eef 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include "kvm_cache_regs.h" + #include "x86.h" + +@@ -125,6 +126,12 @@ module_param_named(pml, enable_pml, bool, S_IRUGO); + + #define VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE 5 + ++#define VMX_VPID_EXTENT_SUPPORTED_MASK \ ++ (VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT | \ ++ VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | \ ++ VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT | \ ++ VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT) ++ + /* + * These 2 parameters are used to config the controls for Pause-Loop Exiting: + * ple_gap: upper bound on the amount of time between two successive +@@ -827,21 +834,18 @@ static const unsigned short vmcs_field_to_offset_table[] = { + + static inline short vmcs_field_to_offset(unsigned long field) + { +- BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX); ++ const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table); ++ unsigned short offset; + +- if (field >= ARRAY_SIZE(vmcs_field_to_offset_table)) ++ BUILD_BUG_ON(size > SHRT_MAX); ++ if (field >= size) + return -ENOENT; + +- /* +- * FIXME: Mitigation for CVE-2017-5753. To be replaced with a +- * generic mechanism. +- */ +- asm("lfence"); +- +- if (vmcs_field_to_offset_table[field] == 0) ++ field = array_index_nospec(field, size); ++ offset = vmcs_field_to_offset_table[field]; ++ if (offset == 0) + return -ENOENT; +- +- return vmcs_field_to_offset_table[field]; ++ return offset; + } + + static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu) +@@ -2659,8 +2663,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) + */ + if (enable_vpid) + vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT | +- VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | +- VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT; ++ VMX_VPID_EXTENT_SUPPORTED_MASK; + else + vmx->nested.nested_vmx_vpid_caps = 0; + +@@ -4514,7 +4517,7 @@ static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu) + return enable_apicv && lapic_in_kernel(vcpu); + } + +-static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) ++static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); + int max_irr; +@@ -4525,19 +4528,15 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) + vmx->nested.pi_pending) { + vmx->nested.pi_pending = false; + if (!pi_test_and_clear_on(vmx->nested.pi_desc)) +- return 0; ++ return; + + max_irr = find_last_bit( + (unsigned long *)vmx->nested.pi_desc->pir, 256); + + if (max_irr == 256) +- return 0; ++ return; + + vapic_page = kmap(vmx->nested.virtual_apic_page); +- if (!vapic_page) { +- WARN_ON(1); +- return -ENOMEM; +- } + __kvm_apic_update_irr(vmx->nested.pi_desc->pir, vapic_page); + kunmap(vmx->nested.virtual_apic_page); + +@@ -4548,7 +4547,6 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) + vmcs_write16(GUEST_INTR_STATUS, status); + } + } +- return 0; + } + + static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu) +@@ -7368,7 +7366,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) + + types = (vmx->nested.nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6; + +- if (!(types & (1UL << type))) { ++ if (type >= 32 || !(types & (1 << type))) { + nested_vmx_failValid(vcpu, + VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); + skip_emulated_instruction(vcpu); +@@ -7425,9 +7423,10 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) + vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO); + type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf); + +- types = (vmx->nested.nested_vmx_vpid_caps >> 8) & 0x7; ++ types = (vmx->nested.nested_vmx_vpid_caps & ++ VMX_VPID_EXTENT_SUPPORTED_MASK) >> 8; + +- if (!(types & (1UL << type))) { ++ if (type >= 32 || !(types & (1 << type))) { + nested_vmx_failValid(vcpu, + VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); + skip_emulated_instruction(vcpu); +@@ -7447,21 +7446,27 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) + } + + switch (type) { ++ case VMX_VPID_EXTENT_INDIVIDUAL_ADDR: + case VMX_VPID_EXTENT_SINGLE_CONTEXT: +- /* +- * Old versions of KVM use the single-context version so we +- * have to support it; just treat it the same as all-context. +- */ ++ case VMX_VPID_EXTENT_SINGLE_NON_GLOBAL: ++ if (!vpid) { ++ nested_vmx_failValid(vcpu, ++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); ++ skip_emulated_instruction(vcpu); ++ return 1; ++ } ++ break; + case VMX_VPID_EXTENT_ALL_CONTEXT: +- __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02); +- nested_vmx_succeed(vcpu); + break; + default: +- /* Trap individual address invalidation invvpid calls */ +- BUG_ON(1); +- break; ++ WARN_ON_ONCE(1); ++ skip_emulated_instruction(vcpu); ++ return 1; + } + ++ __vmx_flush_tlb(vcpu, vmx->nested.vpid02); ++ nested_vmx_succeed(vcpu); ++ + skip_emulated_instruction(vcpu); + return 1; + } +@@ -8377,13 +8382,13 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) + "pushf\n\t" + "orl $0x200, (%%" _ASM_SP ")\n\t" + __ASM_SIZE(push) " $%c[cs]\n\t" +- "call *%[entry]\n\t" ++ CALL_NOSPEC + : + #ifdef CONFIG_X86_64 + [sp]"=&r"(tmp) + #endif + : +- [entry]"r"(entry), ++ THUNK_TARGET(entry), + [ss]"i"(__KERNEL_DS), + [cs]"i"(__KERNEL_CS) + ); +@@ -9240,11 +9245,6 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, + return false; + } + msr_bitmap = (unsigned long *)kmap(page); +- if (!msr_bitmap) { +- nested_release_page_clean(page); +- WARN_ON(1); +- return false; +- } + + if (nested_cpu_has_virt_x2apic_mode(vmcs12)) { + if (nested_cpu_has_apic_reg_virt(vmcs12)) +@@ -10166,7 +10166,8 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr) + return 0; + } + +- return vmx_complete_nested_posted_interrupt(vcpu); ++ vmx_complete_nested_posted_interrupt(vcpu); ++ return 0; + } + + static u32 vmx_get_preemption_timer_value(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 3900d34980de..f37f0c72b22a 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2755,6 +2755,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) + kvm_x86_ops->vcpu_put(vcpu); + kvm_put_guest_fpu(vcpu); + vcpu->arch.last_host_tsc = rdtsc(); ++ /* ++ * If userspace has set any breakpoints or watchpoints, dr6 is restored ++ * on every vmexit, but if not, we might have a stale dr6 from the ++ * guest. do_debug expects dr6 to be cleared after it runs, do the same. ++ */ ++ set_debugreg(0, 6); + } + + static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu, +@@ -8204,6 +8210,13 @@ static int apf_put_user(struct kvm_vcpu *vcpu, u32 val) + sizeof(val)); + } + ++static int apf_get_user(struct kvm_vcpu *vcpu, u32 *val) ++{ ++ ++ return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, val, ++ sizeof(u32)); ++} ++ + void kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu, + struct kvm_async_pf *work) + { +@@ -8230,6 +8243,7 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu, + struct kvm_async_pf *work) + { + struct x86_exception fault; ++ u32 val; + + if (work->wakeup_all) + work->arch.token = ~0; /* broadcast wakeup */ +@@ -8237,14 +8251,24 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu, + kvm_del_async_pf_gfn(vcpu, work->arch.gfn); + trace_kvm_async_pf_ready(work->arch.token, work->gva); + +- if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) && +- !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) { +- fault.vector = PF_VECTOR; +- fault.error_code_valid = true; +- fault.error_code = 0; +- fault.nested_page_fault = false; +- fault.address = work->arch.token; +- kvm_inject_page_fault(vcpu, &fault); ++ if (vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED && ++ !apf_get_user(vcpu, &val)) { ++ if (val == KVM_PV_REASON_PAGE_NOT_PRESENT && ++ vcpu->arch.exception.pending && ++ vcpu->arch.exception.nr == PF_VECTOR && ++ !apf_put_user(vcpu, 0)) { ++ vcpu->arch.exception.pending = false; ++ vcpu->arch.exception.nr = 0; ++ vcpu->arch.exception.has_error_code = false; ++ vcpu->arch.exception.error_code = 0; ++ } else if (!apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) { ++ fault.vector = PF_VECTOR; ++ fault.error_code_valid = true; ++ fault.error_code = 0; ++ fault.nested_page_fault = false; ++ fault.address = work->arch.token; ++ kvm_inject_page_fault(vcpu, &fault); ++ } + } + vcpu->arch.apf.halted = false; + vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE; +diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S +index 46668cda4ffd..490b2ee4e4bb 100644 +--- a/arch/x86/lib/getuser.S ++++ b/arch/x86/lib/getuser.S +@@ -38,6 +38,8 @@ ENTRY(__get_user_1) + GET_THREAD_INFO(%_ASM_DX) + cmp TI_addr_limit(%_ASM_DX),%_ASM_AX + jae bad_get_user ++ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ ++ and %_ASM_DX, %_ASM_AX + ASM_STAC + 1: movzbl (%_ASM_AX),%edx + xor %eax,%eax +@@ -51,6 +53,8 @@ ENTRY(__get_user_2) + GET_THREAD_INFO(%_ASM_DX) + cmp TI_addr_limit(%_ASM_DX),%_ASM_AX + jae bad_get_user ++ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ ++ and %_ASM_DX, %_ASM_AX + ASM_STAC + 2: movzwl -1(%_ASM_AX),%edx + xor %eax,%eax +@@ -64,6 +68,8 @@ ENTRY(__get_user_4) + GET_THREAD_INFO(%_ASM_DX) + cmp TI_addr_limit(%_ASM_DX),%_ASM_AX + jae bad_get_user ++ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ ++ and %_ASM_DX, %_ASM_AX + ASM_STAC + 3: movl -3(%_ASM_AX),%edx + xor %eax,%eax +@@ -78,6 +84,8 @@ ENTRY(__get_user_8) + GET_THREAD_INFO(%_ASM_DX) + cmp TI_addr_limit(%_ASM_DX),%_ASM_AX + jae bad_get_user ++ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ ++ and %_ASM_DX, %_ASM_AX + ASM_STAC + 4: movq -7(%_ASM_AX),%rdx + xor %eax,%eax +@@ -89,6 +97,8 @@ ENTRY(__get_user_8) + GET_THREAD_INFO(%_ASM_DX) + cmp TI_addr_limit(%_ASM_DX),%_ASM_AX + jae bad_get_user_8 ++ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ ++ and %_ASM_DX, %_ASM_AX + ASM_STAC + 4: movl -7(%_ASM_AX),%edx + 5: movl -3(%_ASM_AX),%ecx +diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S +index e611a124c442..3d06b482ebc7 100644 +--- a/arch/x86/lib/retpoline.S ++++ b/arch/x86/lib/retpoline.S +@@ -36,7 +36,6 @@ GENERATE_THUNK(_ASM_DX) + GENERATE_THUNK(_ASM_SI) + GENERATE_THUNK(_ASM_DI) + GENERATE_THUNK(_ASM_BP) +-GENERATE_THUNK(_ASM_SP) + #ifdef CONFIG_64BIT + GENERATE_THUNK(r8) + GENERATE_THUNK(r9) +diff --git a/arch/x86/math-emu/Makefile b/arch/x86/math-emu/Makefile +index 9b0c63b60302..1b2dac174321 100644 +--- a/arch/x86/math-emu/Makefile ++++ b/arch/x86/math-emu/Makefile +@@ -5,8 +5,8 @@ + #DEBUG = -DDEBUGGING + DEBUG = + PARANOID = -DPARANOID +-EXTRA_CFLAGS := $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION) +-EXTRA_AFLAGS := $(PARANOID) ++ccflags-y += $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION) ++asflags-y += $(PARANOID) + + # From 'C' language sources: + C_OBJS =fpu_entry.o errors.o \ +diff --git a/arch/x86/math-emu/reg_compare.c b/arch/x86/math-emu/reg_compare.c +index b77360fdbf4a..19b33b50adfa 100644 +--- a/arch/x86/math-emu/reg_compare.c ++++ b/arch/x86/math-emu/reg_compare.c +@@ -168,7 +168,7 @@ static int compare(FPU_REG const *b, int tagb) + /* This function requires that st(0) is not empty */ + int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) + { +- int f = 0, c; ++ int f, c; + + c = compare(loaded_data, loaded_tag); + +@@ -189,12 +189,12 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) + case COMP_No_Comp: + f = SW_C3 | SW_C2 | SW_C0; + break; +-#ifdef PARANOID + default: ++#ifdef PARANOID + EXCEPTION(EX_INTERNAL | 0x121); ++#endif /* PARANOID */ + f = SW_C3 | SW_C2 | SW_C0; + break; +-#endif /* PARANOID */ + } + setcc(f); + if (c & COMP_Denormal) { +@@ -205,7 +205,7 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) + + static int compare_st_st(int nr) + { +- int f = 0, c; ++ int f, c; + FPU_REG *st_ptr; + + if (!NOT_EMPTY(0) || !NOT_EMPTY(nr)) { +@@ -235,12 +235,12 @@ static int compare_st_st(int nr) + case COMP_No_Comp: + f = SW_C3 | SW_C2 | SW_C0; + break; +-#ifdef PARANOID + default: ++#ifdef PARANOID + EXCEPTION(EX_INTERNAL | 0x122); ++#endif /* PARANOID */ + f = SW_C3 | SW_C2 | SW_C0; + break; +-#endif /* PARANOID */ + } + setcc(f); + if (c & COMP_Denormal) { +@@ -283,12 +283,12 @@ static int compare_i_st_st(int nr) + case COMP_No_Comp: + f = X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF; + break; +-#ifdef PARANOID + default: ++#ifdef PARANOID + EXCEPTION(EX_INTERNAL | 0x122); ++#endif /* PARANOID */ + f = 0; + break; +-#endif /* PARANOID */ + } + FPU_EFLAGS = (FPU_EFLAGS & ~(X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF)) | f; + if (c & COMP_Denormal) { +diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c +index b9c78f3bcd67..53ab3f367472 100644 +--- a/arch/x86/mm/ioremap.c ++++ b/arch/x86/mm/ioremap.c +@@ -348,11 +348,11 @@ void iounmap(volatile void __iomem *addr) + (void __force *)addr < phys_to_virt(ISA_END_ADDRESS)) + return; + ++ mmiotrace_iounmap(addr); ++ + addr = (volatile void __iomem *) + (PAGE_MASK & (unsigned long __force)addr); + +- mmiotrace_iounmap(addr); +- + /* Use the vm area unlocked, assuming the caller + ensures there isn't another iounmap for the same address + in parallel. Reuse of the virtual address is prevented by +diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c +index ddb2244b06a1..76604c8a2a48 100644 +--- a/arch/x86/mm/kmmio.c ++++ b/arch/x86/mm/kmmio.c +@@ -434,17 +434,18 @@ int register_kmmio_probe(struct kmmio_probe *p) + unsigned long flags; + int ret = 0; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + unsigned int l; + pte_t *pte; + + spin_lock_irqsave(&kmmio_lock, flags); +- if (get_kmmio_probe(p->addr)) { ++ if (get_kmmio_probe(addr)) { + ret = -EEXIST; + goto out; + } + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) { + ret = -EINVAL; + goto out; +@@ -453,7 +454,7 @@ int register_kmmio_probe(struct kmmio_probe *p) + kmmio_count++; + list_add_rcu(&p->list, &kmmio_probes); + while (size < size_lim) { +- if (add_kmmio_fault_page(p->addr + size)) ++ if (add_kmmio_fault_page(addr + size)) + pr_err("Unable to set page fault.\n"); + size += page_level_size(l); + } +@@ -527,19 +528,20 @@ void unregister_kmmio_probe(struct kmmio_probe *p) + { + unsigned long flags; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + struct kmmio_fault_page *release_list = NULL; + struct kmmio_delayed_release *drelease; + unsigned int l; + pte_t *pte; + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) + return; + + spin_lock_irqsave(&kmmio_lock, flags); + while (size < size_lim) { +- release_kmmio_fault_page(p->addr + size, &release_list); ++ release_kmmio_fault_page(addr + size, &release_list); + size += page_level_size(l); + } + list_del_rcu(&p->list); +diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c +index 55130846ac87..c0533fbc39e3 100644 +--- a/arch/x86/platform/olpc/olpc-xo15-sci.c ++++ b/arch/x86/platform/olpc/olpc-xo15-sci.c +@@ -196,6 +196,7 @@ static int xo15_sci_remove(struct acpi_device *device) + return 0; + } + ++#ifdef CONFIG_PM_SLEEP + static int xo15_sci_resume(struct device *dev) + { + /* Enable all EC events */ +@@ -207,6 +208,7 @@ static int xo15_sci_resume(struct device *dev) + + return 0; + } ++#endif + + static SIMPLE_DEV_PM_OPS(xo15_sci_pm, NULL, xo15_sci_resume); + +diff --git a/certs/Makefile b/certs/Makefile +index 28ac694dd11a..2773c4afa24c 100644 +--- a/certs/Makefile ++++ b/certs/Makefile +@@ -36,29 +36,34 @@ ifndef CONFIG_MODULE_SIG_HASH + $(error Could not determine digest type to use from kernel config) + endif + ++redirect_openssl = 2>&1 ++quiet_redirect_openssl = 2>&1 ++silent_redirect_openssl = 2>/dev/null ++ + # We do it this way rather than having a boolean option for enabling an + # external private key, because 'make randconfig' might enable such a + # boolean option and we unfortunately can't make it depend on !RANDCONFIG. + ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") + $(obj)/signing_key.pem: $(obj)/x509.genkey +- @echo "###" +- @echo "### Now generating an X.509 key pair to be used for signing modules." +- @echo "###" +- @echo "### If this takes a long time, you might wish to run rngd in the" +- @echo "### background to keep the supply of entropy topped up. It" +- @echo "### needs to be run as root, and uses a hardware random" +- @echo "### number generator if one is available." +- @echo "###" +- openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ ++ @$(kecho) "###" ++ @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." ++ @$(kecho) "###" ++ @$(kecho) "### If this takes a long time, you might wish to run rngd in the" ++ @$(kecho) "### background to keep the supply of entropy topped up. It" ++ @$(kecho) "### needs to be run as root, and uses a hardware random" ++ @$(kecho) "### number generator if one is available." ++ @$(kecho) "###" ++ $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ + -batch -x509 -config $(obj)/x509.genkey \ + -outform PEM -out $(obj)/signing_key.pem \ +- -keyout $(obj)/signing_key.pem 2>&1 +- @echo "###" +- @echo "### Key pair generated." +- @echo "###" ++ -keyout $(obj)/signing_key.pem \ ++ $($(quiet)redirect_openssl) ++ @$(kecho) "###" ++ @$(kecho) "### Key pair generated." ++ @$(kecho) "###" + + $(obj)/x509.genkey: +- @echo Generating X.509 key generation config ++ @$(kecho) Generating X.509 key generation config + @echo >$@ "[ req ]" + @echo >>$@ "default_bits = 4096" + @echo >>$@ "distinguished_name = req_distinguished_name" +diff --git a/drivers/Makefile b/drivers/Makefile +index 098997f2cc3a..f42a74ebc1be 100644 +--- a/drivers/Makefile ++++ b/drivers/Makefile +@@ -96,6 +96,7 @@ obj-$(CONFIG_TC) += tc/ + obj-$(CONFIG_UWB) += uwb/ + obj-$(CONFIG_USB_PHY) += usb/ + obj-$(CONFIG_USB) += usb/ ++obj-$(CONFIG_USB_SUPPORT) += usb/ + obj-$(CONFIG_PCI) += usb/ + obj-$(CONFIG_USB_GADGET) += usb/ + obj-$(CONFIG_OF) += usb/ +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 5531f020e561..55613f6f7c0e 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2622,6 +2622,8 @@ static unsigned int binder_poll(struct file *filp, + binder_lock(__func__); + + thread = binder_get_thread(proc); ++ if (!thread) ++ return POLLERR; + + wait_for_proc_work = thread->transaction_stack == NULL && + list_empty(&thread->todo) && thread->return_error == BR_OK; +diff --git a/drivers/char/hw_random/exynos-rng.c b/drivers/char/hw_random/exynos-rng.c +index 7845a38b6604..7ba0ae060d61 100644 +--- a/drivers/char/hw_random/exynos-rng.c ++++ b/drivers/char/hw_random/exynos-rng.c +@@ -155,8 +155,7 @@ static int exynos_rng_probe(struct platform_device *pdev) + return ret; + } + +-#ifdef CONFIG_PM +-static int exynos_rng_runtime_suspend(struct device *dev) ++static int __maybe_unused exynos_rng_runtime_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); +@@ -166,7 +165,7 @@ static int exynos_rng_runtime_suspend(struct device *dev) + return 0; + } + +-static int exynos_rng_runtime_resume(struct device *dev) ++static int __maybe_unused exynos_rng_runtime_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); +@@ -174,12 +173,12 @@ static int exynos_rng_runtime_resume(struct device *dev) + return clk_prepare_enable(exynos_rng->clk); + } + +-static int exynos_rng_suspend(struct device *dev) ++static int __maybe_unused exynos_rng_suspend(struct device *dev) + { + return pm_runtime_force_suspend(dev); + } + +-static int exynos_rng_resume(struct device *dev) ++static int __maybe_unused exynos_rng_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); +@@ -191,7 +190,6 @@ static int exynos_rng_resume(struct device *dev) + + return exynos_rng_configure(exynos_rng); + } +-#endif + + static const struct dev_pm_ops exynos_rng_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(exynos_rng_suspend, exynos_rng_resume) +diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c +index fd39893079d5..45ea8957a73a 100644 +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -401,16 +401,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) + uint32_t aes_control; + int err; + unsigned long flags; ++ u8 *iv; + + aes_control = SSS_AES_KEY_CHANGE_MODE; + if (mode & FLAGS_AES_DECRYPT) + aes_control |= SSS_AES_MODE_DECRYPT; + +- if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) ++ if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) { + aes_control |= SSS_AES_CHAIN_MODE_CBC; +- else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) ++ iv = req->info; ++ } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) { + aes_control |= SSS_AES_CHAIN_MODE_CTR; +- ++ iv = req->info; ++ } else { ++ iv = NULL; /* AES_ECB */ ++ } + if (dev->ctx->keylen == AES_KEYSIZE_192) + aes_control |= SSS_AES_KEY_SIZE_192; + else if (dev->ctx->keylen == AES_KEYSIZE_256) +@@ -440,7 +445,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) + goto outdata_error; + + SSS_AES_WRITE(dev, AES_CONTROL, aes_control); +- s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen); ++ s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen); + + s5p_set_dma_indata(dev, req->src); + s5p_set_dma_outdata(dev, req->dst); +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index 53d22eb73b56..be26f625bb3e 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -716,7 +716,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan, + unsigned long flags) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); +- struct data_chunk *first = xt->sgl; ++ struct data_chunk *first; + struct at_desc *desc = NULL; + size_t xfer_count; + unsigned int dwidth; +@@ -728,6 +728,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan, + if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) + return NULL; + ++ first = xt->sgl; ++ + dev_info(chan2dev(chan), + "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", + __func__, &xt->src_start, &xt->dst_start, xt->numf, +diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c +index 7638b24ce8d0..35fc58f4bf4b 100644 +--- a/drivers/dma/dma-jz4740.c ++++ b/drivers/dma/dma-jz4740.c +@@ -557,7 +557,7 @@ static int jz4740_dma_probe(struct platform_device *pdev) + + ret = dma_async_device_register(dd); + if (ret) +- return ret; ++ goto err_clk; + + irq = platform_get_irq(pdev, 0); + ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev); +@@ -570,6 +570,8 @@ static int jz4740_dma_probe(struct platform_device *pdev) + + err_unregister: + dma_async_device_unregister(dd); ++err_clk: ++ clk_disable_unprepare(dmadev->clk); + return ret; + } + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index abb75ebd65ea..ac8c28968422 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -395,7 +395,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma) + if (memcmp(src, dest, IOAT_TEST_SIZE)) { + dev_err(dev, "Self-test copy failed compare, disabling\n"); + err = -ENODEV; +- goto free_resources; ++ goto unmap_dma; + } + + unmap_dma: +diff --git a/drivers/dma/zx296702_dma.c b/drivers/dma/zx296702_dma.c +index 6059d81e701a..8e55403847b2 100644 +--- a/drivers/dma/zx296702_dma.c ++++ b/drivers/dma/zx296702_dma.c +@@ -26,7 +26,7 @@ + + #define DRIVER_NAME "zx-dma" + #define DMA_ALIGN 4 +-#define DMA_MAX_SIZE (0x10000 - PAGE_SIZE) ++#define DMA_MAX_SIZE (0x10000 - 512) + #define LLI_BLOCK_SIZE (4 * PAGE_SIZE) + + #define REG_ZX_SRC_ADDR 0x00 +diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c +index c50e930d97d3..297121acc57d 100644 +--- a/drivers/gpio/gpio-intel-mid.c ++++ b/drivers/gpio/gpio-intel-mid.c +@@ -326,7 +326,7 @@ static void intel_mid_irq_init_hw(struct intel_mid_gpio *priv) + } + } + +-static int intel_gpio_runtime_idle(struct device *dev) ++static int __maybe_unused intel_gpio_runtime_idle(struct device *dev) + { + int err = pm_schedule_suspend(dev, 500); + return err ?: -EBUSY; +diff --git a/drivers/gpio/gpio-xgene.c b/drivers/gpio/gpio-xgene.c +index 18a8182d4fec..7f1f32324504 100644 +--- a/drivers/gpio/gpio-xgene.c ++++ b/drivers/gpio/gpio-xgene.c +@@ -42,9 +42,7 @@ struct xgene_gpio { + struct gpio_chip chip; + void __iomem *base; + spinlock_t lock; +-#ifdef CONFIG_PM + u32 set_dr_val[XGENE_MAX_GPIO_BANKS]; +-#endif + }; + + static inline struct xgene_gpio *to_xgene_gpio(struct gpio_chip *chip) +@@ -132,8 +130,7 @@ static int xgene_gpio_dir_out(struct gpio_chip *gc, + return 0; + } + +-#ifdef CONFIG_PM +-static int xgene_gpio_suspend(struct device *dev) ++static __maybe_unused int xgene_gpio_suspend(struct device *dev) + { + struct xgene_gpio *gpio = dev_get_drvdata(dev); + unsigned long bank_offset; +@@ -146,7 +143,7 @@ static int xgene_gpio_suspend(struct device *dev) + return 0; + } + +-static int xgene_gpio_resume(struct device *dev) ++static __maybe_unused int xgene_gpio_resume(struct device *dev) + { + struct xgene_gpio *gpio = dev_get_drvdata(dev); + unsigned long bank_offset; +@@ -160,10 +157,6 @@ static int xgene_gpio_resume(struct device *dev) + } + + static SIMPLE_DEV_PM_OPS(xgene_gpio_pm, xgene_gpio_suspend, xgene_gpio_resume); +-#define XGENE_GPIO_PM_OPS (&xgene_gpio_pm) +-#else +-#define XGENE_GPIO_PM_OPS NULL +-#endif + + static int xgene_gpio_probe(struct platform_device *pdev) + { +@@ -230,7 +223,7 @@ static struct platform_driver xgene_gpio_driver = { + .driver = { + .name = "xgene-gpio", + .of_match_table = xgene_gpio_of_match, +- .pm = XGENE_GPIO_PM_OPS, ++ .pm = &xgene_gpio_pm, + }, + .probe = xgene_gpio_probe, + .remove = xgene_gpio_remove, +diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c +index cebcab560626..5d68189176cc 100644 +--- a/drivers/gpu/drm/armada/armada_crtc.c ++++ b/drivers/gpu/drm/armada/armada_crtc.c +@@ -1182,17 +1182,13 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, + + ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", + dcrtc); +- if (ret < 0) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret < 0) ++ goto err_crtc; + + if (dcrtc->variant->init) { + ret = dcrtc->variant->init(dcrtc, dev); +- if (ret) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret) ++ goto err_crtc; + } + + /* Ensure AXI pipeline is enabled */ +@@ -1203,13 +1199,15 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, + dcrtc->crtc.port = port; + + primary = kzalloc(sizeof(*primary), GFP_KERNEL); +- if (!primary) +- return -ENOMEM; ++ if (!primary) { ++ ret = -ENOMEM; ++ goto err_crtc; ++ } + + ret = armada_drm_plane_init(primary); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_universal_plane_init(drm, &primary->base, 0, +@@ -1219,7 +1217,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, + DRM_PLANE_TYPE_PRIMARY); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL, +@@ -1238,6 +1236,9 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, + + err_crtc_init: + primary->base.funcs->destroy(&primary->base); ++err_crtc: ++ kfree(dcrtc); ++ + return ret; + } + +diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c +index 6675b1428410..c257de351cfa 100644 +--- a/drivers/gpu/drm/drm_modeset_lock.c ++++ b/drivers/gpu/drm/drm_modeset_lock.c +@@ -69,7 +69,7 @@ void drm_modeset_lock_all(struct drm_device *dev) + struct drm_modeset_acquire_ctx *ctx; + int ret; + +- ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL | __GFP_NOFAIL); + if (WARN_ON(!ctx)) + return; + +diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c +index d4813e03f5ee..00275c3856ce 100644 +--- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c ++++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c +@@ -821,14 +821,18 @@ void mdfld_dsi_dpi_mode_set(struct drm_encoder *encoder, + struct drm_device *dev = dsi_config->dev; + struct drm_psb_private *dev_priv = dev->dev_private; + int pipe = mdfld_dsi_encoder_get_pipe(dsi_encoder); +- + u32 pipeconf_reg = PIPEACONF; + u32 dspcntr_reg = DSPACNTR; ++ u32 pipeconf, dspcntr; + +- u32 pipeconf = dev_priv->pipeconf[pipe]; +- u32 dspcntr = dev_priv->dspcntr[pipe]; + u32 mipi = MIPI_PORT_EN | PASS_FROM_SPHY_TO_AFE | SEL_FLOPPED_HSTX; + ++ if (WARN_ON(pipe < 0)) ++ return; ++ ++ pipeconf = dev_priv->pipeconf[pipe]; ++ dspcntr = dev_priv->dspcntr[pipe]; ++ + if (pipe) { + pipeconf_reg = PIPECCONF; + dspcntr_reg = DSPCCNTR; +diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_output.c b/drivers/gpu/drm/gma500/mdfld_dsi_output.c +index 89f705c3a5eb..910a2f253990 100644 +--- a/drivers/gpu/drm/gma500/mdfld_dsi_output.c ++++ b/drivers/gpu/drm/gma500/mdfld_dsi_output.c +@@ -382,16 +382,6 @@ static int mdfld_dsi_connector_mode_valid(struct drm_connector *connector, + return MODE_OK; + } + +-static void mdfld_dsi_connector_dpms(struct drm_connector *connector, int mode) +-{ +- if (mode == connector->dpms) +- return; +- +- /*first, execute dpms*/ +- +- drm_helper_connector_dpms(connector, mode); +-} +- + static struct drm_encoder *mdfld_dsi_connector_best_encoder( + struct drm_connector *connector) + { +@@ -404,7 +394,7 @@ static struct drm_encoder *mdfld_dsi_connector_best_encoder( + + /*DSI connector funcs*/ + static const struct drm_connector_funcs mdfld_dsi_connector_funcs = { +- .dpms = /*drm_helper_connector_dpms*/mdfld_dsi_connector_dpms, ++ .dpms = drm_helper_connector_dpms, + .save = mdfld_dsi_connector_save, + .restore = mdfld_dsi_connector_restore, + .detect = mdfld_dsi_connector_detect, +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index a0865c49ec83..495c279da200 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -370,7 +370,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv, + struct nouveau_cli *cli = nouveau_cli(file_priv); + struct drm_device *dev = chan->drm->dev; + int trycnt = 0; +- int ret, i; ++ int ret = -EINVAL, i; + struct nouveau_bo *res_bo = NULL; + LIST_HEAD(gart_list); + LIST_HEAD(vram_list); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c +index 67cebb23c940..aa04fb0159a7 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c +@@ -293,13 +293,10 @@ static int vmw_cmdbuf_header_submit(struct vmw_cmdbuf_header *header) + struct vmw_cmdbuf_man *man = header->man; + u32 val; + +- if (sizeof(header->handle) > 4) +- val = (header->handle >> 32); +- else +- val = 0; ++ val = upper_32_bits(header->handle); + vmw_write(man->dev_priv, SVGA_REG_COMMAND_HIGH, val); + +- val = (header->handle & 0xFFFFFFFFULL); ++ val = lower_32_bits(header->handle); + val |= header->cb_context & SVGA_CB_CONTEXT_MASK; + vmw_write(man->dev_priv, SVGA_REG_COMMAND_LOW, val); + +diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c +index d415a804fd26..9a8976a79b29 100644 +--- a/drivers/hv/hv.c ++++ b/drivers/hv/hv.c +@@ -195,9 +195,7 @@ int hv_init(void) + { + int max_leaf; + union hv_x64_msr_hypercall_contents hypercall_msr; +- union hv_x64_msr_hypercall_contents tsc_msr; + void *virtaddr = NULL; +- void *va_tsc = NULL; + + memset(hv_context.synic_event_page, 0, sizeof(void *) * NR_CPUS); + memset(hv_context.synic_message_page, 0, +@@ -243,6 +241,9 @@ int hv_init(void) + + #ifdef CONFIG_X86_64 + if (ms_hyperv.features & HV_X64_MSR_REFERENCE_TSC_AVAILABLE) { ++ union hv_x64_msr_hypercall_contents tsc_msr; ++ void *va_tsc; ++ + va_tsc = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL); + if (!va_tsc) + goto cleanup; +diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c +index 90e322959303..42c25aed671d 100644 +--- a/drivers/i2c/i2c-boardinfo.c ++++ b/drivers/i2c/i2c-boardinfo.c +@@ -56,9 +56,7 @@ EXPORT_SYMBOL_GPL(__i2c_first_dynamic_bus_num); + * The board info passed can safely be __initdata, but be careful of embedded + * pointers (for platform_data, functions, etc) since that won't be copied. + */ +-int __init +-i2c_register_board_info(int busnum, +- struct i2c_board_info const *info, unsigned len) ++int i2c_register_board_info(int busnum, struct i2c_board_info const *info, unsigned len) + { + int status; + +diff --git a/drivers/idle/Kconfig b/drivers/idle/Kconfig +index 4732dfc15447..331adc509f3a 100644 +--- a/drivers/idle/Kconfig ++++ b/drivers/idle/Kconfig +@@ -17,6 +17,7 @@ config I7300_IDLE_IOAT_CHANNEL + + config I7300_IDLE + tristate "Intel chipset idle memory power saving driver" ++ depends on PCI + select I7300_IDLE_IOAT_CHANNEL + help + Enable memory power savings when idle with certain Intel server +diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c +index f684fe31f832..64799ad7ebad 100644 +--- a/drivers/iio/adc/axp288_adc.c ++++ b/drivers/iio/adc/axp288_adc.c +@@ -44,7 +44,7 @@ struct axp288_adc_info { + struct regmap *regmap; + }; + +-static const struct iio_chan_spec const axp288_adc_channels[] = { ++static const struct iio_chan_spec axp288_adc_channels[] = { + { + .indexed = 1, + .type = IIO_TEMP, +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index e354358db77b..b6c9a370a38b 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -626,6 +626,7 @@ struct rdma_cm_id *rdma_create_id(struct net *net, + INIT_LIST_HEAD(&id_priv->mc_list); + get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num); + id_priv->id.route.addr.dev_addr.net = get_net(net); ++ id_priv->seq_num &= 0x00ffffff; + + return &id_priv->id; + } +diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c +index 58fce1742b8d..337b1a5eb41c 100644 +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -809,10 +809,9 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev) + rdev->lldi.vr->qp.size, + rdev->lldi.vr->cq.start, + rdev->lldi.vr->cq.size); +- PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p " ++ PDBG("udb %pR db_reg %p gts_reg %p " + "qpmask 0x%x cqmask 0x%x\n", +- (unsigned)pci_resource_len(rdev->lldi.pdev, 2), +- (void *)pci_resource_start(rdev->lldi.pdev, 2), ++ &rdev->lldi.pdev->resource[2], + rdev->lldi.db_reg, rdev->lldi.gts_reg, + rdev->qpmask, rdev->cqmask); + +diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c +index 9002298698fc..3048ef3e3e16 100644 +--- a/drivers/input/keyboard/tca8418_keypad.c ++++ b/drivers/input/keyboard/tca8418_keypad.c +@@ -164,11 +164,18 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) + int error, col, row; + u8 reg, state, code; + +- /* Initial read of the key event FIFO */ +- error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); ++ do { ++ error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); ++ if (error < 0) { ++ dev_err(&keypad_data->client->dev, ++ "unable to read REG_KEY_EVENT_A\n"); ++ break; ++ } ++ ++ /* Assume that key code 0 signifies empty FIFO */ ++ if (reg <= 0) ++ break; + +- /* Assume that key code 0 signifies empty FIFO */ +- while (error >= 0 && reg > 0) { + state = reg & KEY_EVENT_VALUE; + code = reg & KEY_EVENT_CODE; + +@@ -184,11 +191,7 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) + + /* Read for next loop */ + error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); +- } +- +- if (error < 0) +- dev_err(&keypad_data->client->dev, +- "unable to read REG_KEY_EVENT_A\n"); ++ } while (1); + + input_sync(input); + } +diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c +index 7b4ddf0a39ec..2d28530b7e82 100644 +--- a/drivers/isdn/hardware/eicon/message.c ++++ b/drivers/isdn/hardware/eicon/message.c +@@ -147,7 +147,7 @@ static word plci_remove_check(PLCI *); + static void listen_check(DIVA_CAPI_ADAPTER *); + static byte AddInfo(byte **, byte **, byte *, byte *); + static byte getChannel(API_PARSE *); +-static void IndParse(PLCI *, word *, byte **, byte); ++static void IndParse(PLCI *, const word *, byte **, byte); + static byte ie_compare(byte *, byte *); + static word find_cip(DIVA_CAPI_ADAPTER *, byte *, byte *); + static word CPN_filter_ok(byte *cpn, DIVA_CAPI_ADAPTER *, word); +@@ -4860,7 +4860,7 @@ static void sig_ind(PLCI *plci) + /* included before the ESC_MSGTYPE and MAXPARMSIDS has to be incremented */ + /* SMSG is situated at the end because its 0 (for compatibility reasons */ + /* (see Info_Mask Bit 4, first IE. then the message type) */ +- word parms_id[] = ++ static const word parms_id[] = + {MAXPARMSIDS, CPN, 0xff, DSA, OSA, BC, LLC, HLC, ESC_CAUSE, DSP, DT, CHA, + UUI, CONG_RR, CONG_RNR, ESC_CHI, KEY, CHI, CAU, ESC_LAW, + RDN, RDX, CONN_NR, RIN, NI, CAI, ESC_CR, +@@ -4868,12 +4868,12 @@ static void sig_ind(PLCI *plci) + /* 14 FTY repl by ESC_CHI */ + /* 18 PI repl by ESC_LAW */ + /* removed OAD changed to 0xff for future use, OAD is multiIE now */ +- word multi_fac_id[] = {1, FTY}; +- word multi_pi_id[] = {1, PI}; +- word multi_CiPN_id[] = {1, OAD}; +- word multi_ssext_id[] = {1, ESC_SSEXT}; ++ static const word multi_fac_id[] = {1, FTY}; ++ static const word multi_pi_id[] = {1, PI}; ++ static const word multi_CiPN_id[] = {1, OAD}; ++ static const word multi_ssext_id[] = {1, ESC_SSEXT}; + +- word multi_vswitch_id[] = {1, ESC_VSWITCH}; ++ static const word multi_vswitch_id[] = {1, ESC_VSWITCH}; + + byte *cau; + word ncci; +@@ -8926,7 +8926,7 @@ static void listen_check(DIVA_CAPI_ADAPTER *a) + /* functions for all parameters sent in INDs */ + /*------------------------------------------------------------------*/ + +-static void IndParse(PLCI *plci, word *parms_id, byte **parms, byte multiIEsize) ++static void IndParse(PLCI *plci, const word *parms_id, byte **parms, byte multiIEsize) + { + word ploc; /* points to current location within packet */ + byte w; +diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c +index 358a574d9e8b..46d957c34be1 100644 +--- a/drivers/isdn/icn/icn.c ++++ b/drivers/isdn/icn/icn.c +@@ -718,7 +718,7 @@ icn_sendbuf(int channel, int ack, struct sk_buff *skb, icn_card *card) + return 0; + if (card->sndcount[channel] > ICN_MAX_SQUEUE) + return 0; +-#warning TODO test headroom or use skb->nb to flag ACK ++ /* TODO test headroom or use skb->nb to flag ACK */ + nskb = skb_clone(skb, GFP_ATOMIC); + if (nskb) { + /* Push ACK flag as one +diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c +index 3597ef47b28a..09fc129ef2fa 100644 +--- a/drivers/isdn/sc/init.c ++++ b/drivers/isdn/sc/init.c +@@ -441,6 +441,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) + RspMessage rcvmsg; + ReqMessage sndmsg; + HWConfig_pl hwci; ++ void __iomem *rambase_sig = (void __iomem *)rambase + SIG_OFFSET; + int x; + + pr_debug("Attempting to identify adapter @ 0x%lx io 0x%x\n", +@@ -481,7 +482,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) + */ + outb(PRI_BASEPG_VAL, pgport); + msleep_interruptible(1000); +- sig = readl(rambase + SIG_OFFSET); ++ sig = readl(rambase_sig); + pr_debug("Looking for a signature, got 0x%lx\n", sig); + if (sig == SIGNATURE) + return PRI_BOARD; +@@ -491,7 +492,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) + */ + outb(BRI_BASEPG_VAL, pgport); + msleep_interruptible(1000); +- sig = readl(rambase + SIG_OFFSET); ++ sig = readl(rambase_sig); + pr_debug("Looking for a signature, got 0x%lx\n", sig); + if (sig == SIGNATURE) + return BRI_BOARD; +@@ -501,7 +502,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) + /* + * Try to spot a card + */ +- sig = readl(rambase + SIG_OFFSET); ++ sig = readl(rambase_sig); + pr_debug("Looking for a signature, got 0x%lx\n", sig); + if (sig != SIGNATURE) + return -1; +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 0a856cb181e9..62c3328e2a1d 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1028,8 +1028,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor + * (not needed for Linear and RAID0 as metadata doesn't + * record this size) + */ +- if (rdev->sectors >= (2ULL << 32) && sb->level >= 1) +- rdev->sectors = (2ULL << 32) - 2; ++ if (IS_ENABLED(CONFIG_LBDAF) && (u64)rdev->sectors >= (2ULL << 32) && ++ sb->level >= 1) ++ rdev->sectors = (sector_t)(2ULL << 32) - 2; + + if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1) + /* "this cannot possibly happen" ... */ +@@ -1322,8 +1323,9 @@ super_90_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors) + /* Limit to 4TB as metadata cannot record more than that. + * 4TB == 2^32 KB, or 2*2^32 sectors. + */ +- if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1) +- num_sectors = (2ULL << 32) - 2; ++ if (IS_ENABLED(CONFIG_LBDAF) && (u64)num_sectors >= (2ULL << 32) && ++ rdev->mddev->level >= 1) ++ num_sectors = (sector_t)(2ULL << 32) - 2; + md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, + rdev->sb_page); + md_super_wait(rdev->mddev); +diff --git a/drivers/media/common/b2c2/flexcop-fe-tuner.c b/drivers/media/common/b2c2/flexcop-fe-tuner.c +index 9c59f4306883..f5956402fc69 100644 +--- a/drivers/media/common/b2c2/flexcop-fe-tuner.c ++++ b/drivers/media/common/b2c2/flexcop-fe-tuner.c +@@ -38,7 +38,7 @@ static int flexcop_fe_request_firmware(struct dvb_frontend *fe, + #endif + + /* lnb control */ +-#if FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299) ++#if (FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299)) && FE_SUPPORTED(PLL) + static int flexcop_set_voltage(struct dvb_frontend *fe, + enum fe_sec_voltage voltage) + { +@@ -68,7 +68,7 @@ static int flexcop_set_voltage(struct dvb_frontend *fe, + #endif + + #if FE_SUPPORTED(S5H1420) || FE_SUPPORTED(STV0299) || FE_SUPPORTED(MT312) +-static int flexcop_sleep(struct dvb_frontend* fe) ++static int __maybe_unused flexcop_sleep(struct dvb_frontend* fe) + { + struct flexcop_device *fc = fe->dvb->priv; + if (fc->fe_sleep) +diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c +index d0ad6a25bdab..5ac2babe123b 100644 +--- a/drivers/media/i2c/s5k6aa.c ++++ b/drivers/media/i2c/s5k6aa.c +@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct i2c_client *client) + + /** + * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * + * Configure the internal ISP PLL for the required output frequency. + * Locking: called with s5k6aa.lock mutex held. +@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struct s5k6aa *s5k6aa) + + /** + * s5k6aa_configure_video_bus - configure the video output interface ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * @bus_type: video bus type: parallel or MIPI-CSI + * @nlanes: number of MIPI lanes to be used (MIPI-CSI only) + * +@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct i2c_client *client, int timeout, + + /** + * s5k6aa_set_prev_config - write user preview register set ++ * @s5k6aa: pointer to &struct s5k6aa describing the device ++ * @preset: s5kaa preset to be applied + * + * Configure output resolution and color fromat, pixel clock + * frequency range, device frame rate type and frame period range. +@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct s5k6aa *s5k6aa, + + /** + * s5k6aa_initialize_isp - basic ISP MCU initialization ++ * @sd: pointer to V4L2 sub-device descriptor + * + * Configure AHB addresses for registers read/write; configure PLLs for + * required output pixel clock. The ISP power supply needs to be already +diff --git a/drivers/media/usb/em28xx/Kconfig b/drivers/media/usb/em28xx/Kconfig +index e382210c4ada..75323f5efd0f 100644 +--- a/drivers/media/usb/em28xx/Kconfig ++++ b/drivers/media/usb/em28xx/Kconfig +@@ -11,7 +11,7 @@ config VIDEO_EM28XX_V4L2 + select VIDEO_SAA711X if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_TVP5150 if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_MSP3400 if MEDIA_SUBDRV_AUTOSELECT +- select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT ++ select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT + + ---help--- + This is a video4linux driver for Empia 28xx based TV cards. +diff --git a/drivers/media/usb/go7007/Kconfig b/drivers/media/usb/go7007/Kconfig +index 95a3af644a92..af1d02430931 100644 +--- a/drivers/media/usb/go7007/Kconfig ++++ b/drivers/media/usb/go7007/Kconfig +@@ -11,7 +11,7 @@ config VIDEO_GO7007 + select VIDEO_TW2804 if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_TW9903 if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_TW9906 if MEDIA_SUBDRV_AUTOSELECT +- select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT ++ select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT + select VIDEO_UDA1342 if MEDIA_SUBDRV_AUTOSELECT + ---help--- + This is a video4linux driver for the WIS GO7007 MPEG +diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c +index 3fc64197b4e6..08f0ca7aa012 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-core.c ++++ b/drivers/media/usb/hdpvr/hdpvr-core.c +@@ -273,7 +273,9 @@ static int hdpvr_probe(struct usb_interface *interface, + struct hdpvr_device *dev; + struct usb_host_interface *iface_desc; + struct usb_endpoint_descriptor *endpoint; ++#if IS_ENABLED(CONFIG_I2C) + struct i2c_client *client; ++#endif + size_t buffer_size; + int i; + int retval = -ENOMEM; +diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c +index 58f23bcfe94e..299750e56916 100644 +--- a/drivers/media/usb/pwc/pwc-if.c ++++ b/drivers/media/usb/pwc/pwc-if.c +@@ -1119,8 +1119,10 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id + + return 0; + ++#ifdef CONFIG_USB_PWC_INPUT_EVDEV + err_video_unreg: + video_unregister_device(&pdev->vdev); ++#endif + err_unregister_v4l2_dev: + v4l2_device_unregister(&pdev->v4l2_dev); + err_free_controls: +diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig +index 9beece00869b..29b3436d0910 100644 +--- a/drivers/media/v4l2-core/Kconfig ++++ b/drivers/media/v4l2-core/Kconfig +@@ -37,7 +37,6 @@ config VIDEO_PCI_SKELETON + # Used by drivers that need tuner.ko + config VIDEO_TUNER + tristate +- depends on MEDIA_TUNER + + # Used by drivers that need v4l2-mem2mem.ko + config V4L2_MEM2MEM_DEV +diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c +index 5dcc0313c38a..207370d68c17 100644 +--- a/drivers/message/fusion/mptbase.c ++++ b/drivers/message/fusion/mptbase.c +@@ -6848,6 +6848,7 @@ mpt_print_ioc_summary(MPT_ADAPTER *ioc, char *buffer, int *size, int len, int sh + *size = y; + } + ++#ifdef CONFIG_PROC_FS + static void seq_mpt_print_ioc_summary(MPT_ADAPTER *ioc, struct seq_file *m, int showlan) + { + char expVer[32]; +@@ -6879,6 +6880,7 @@ static void seq_mpt_print_ioc_summary(MPT_ADAPTER *ioc, struct seq_file *m, int + + seq_putc(m, '\n'); + } ++#endif + + /** + * mpt_set_taskmgmt_in_progress_flag - set flags associated with task management +diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig +index 8a25adced79f..bbfa1f129266 100644 +--- a/drivers/mtd/chips/Kconfig ++++ b/drivers/mtd/chips/Kconfig +@@ -67,6 +67,10 @@ endchoice + config MTD_CFI_GEOMETRY + bool "Specific CFI Flash geometry selection" + depends on MTD_CFI_ADV_OPTIONS ++ select MTD_MAP_BANK_WIDTH_1 if !(MTD_MAP_BANK_WIDTH_2 || \ ++ MTD_MAP_BANK_WIDTH_4 || MTD_MAP_BANK_WIDTH_8 || \ ++ MTD_MAP_BANK_WIDTH_16 || MTD_MAP_BANK_WIDTH_32) ++ select MTD_CFI_I1 if !(MTD_CFI_I2 || MTD_CFI_I4 || MTD_CFI_I8) + help + This option does not affect the code directly, but will enable + some other configuration options which would allow you to reduce +diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c +index 0455166f05fa..4f206a99164c 100644 +--- a/drivers/mtd/maps/ck804xrom.c ++++ b/drivers/mtd/maps/ck804xrom.c +@@ -112,8 +112,8 @@ static void ck804xrom_cleanup(struct ck804xrom_window *window) + } + + +-static int ck804xrom_init_one(struct pci_dev *pdev, +- const struct pci_device_id *ent) ++static int __init ck804xrom_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) + { + static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; + u8 byte; +diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c +index 76ed651b515b..9646b0766ce0 100644 +--- a/drivers/mtd/maps/esb2rom.c ++++ b/drivers/mtd/maps/esb2rom.c +@@ -144,8 +144,8 @@ static void esb2rom_cleanup(struct esb2rom_window *window) + pci_dev_put(window->pdev); + } + +-static int esb2rom_init_one(struct pci_dev *pdev, +- const struct pci_device_id *ent) ++static int __init esb2rom_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) + { + static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; + struct esb2rom_window *window = &esb2rom_window; +diff --git a/drivers/mtd/maps/ichxrom.c b/drivers/mtd/maps/ichxrom.c +index 8636bba42200..976d42f63aef 100644 +--- a/drivers/mtd/maps/ichxrom.c ++++ b/drivers/mtd/maps/ichxrom.c +@@ -57,10 +57,12 @@ static void ichxrom_cleanup(struct ichxrom_window *window) + { + struct ichxrom_map_info *map, *scratch; + u16 word; ++ int ret; + + /* Disable writes through the rom window */ +- pci_read_config_word(window->pdev, BIOS_CNTL, &word); +- pci_write_config_word(window->pdev, BIOS_CNTL, word & ~1); ++ ret = pci_read_config_word(window->pdev, BIOS_CNTL, &word); ++ if (!ret) ++ pci_write_config_word(window->pdev, BIOS_CNTL, word & ~1); + pci_dev_put(window->pdev); + + /* Free all of the mtd devices */ +@@ -84,8 +86,8 @@ static void ichxrom_cleanup(struct ichxrom_window *window) + } + + +-static int ichxrom_init_one(struct pci_dev *pdev, +- const struct pci_device_id *ent) ++static int __init ichxrom_init_one(struct pci_dev *pdev, ++ const struct pci_device_id *ent) + { + static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; + struct ichxrom_window *window = &ichxrom_window; +diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c +index bcba1a924c75..1f2785ee909f 100644 +--- a/drivers/mtd/nand/sh_flctl.c ++++ b/drivers/mtd/nand/sh_flctl.c +@@ -160,7 +160,7 @@ static void flctl_setup_dma(struct sh_flctl *flctl) + + memset(&cfg, 0, sizeof(cfg)); + cfg.direction = DMA_MEM_TO_DEV; +- cfg.dst_addr = (dma_addr_t)FLDTFIFO(flctl); ++ cfg.dst_addr = flctl->fifo; + cfg.src_addr = 0; + ret = dmaengine_slave_config(flctl->chan_fifo0_tx, &cfg); + if (ret < 0) +@@ -176,7 +176,7 @@ static void flctl_setup_dma(struct sh_flctl *flctl) + + cfg.direction = DMA_DEV_TO_MEM; + cfg.dst_addr = 0; +- cfg.src_addr = (dma_addr_t)FLDTFIFO(flctl); ++ cfg.src_addr = flctl->fifo; + ret = dmaengine_slave_config(flctl->chan_fifo0_rx, &cfg); + if (ret < 0) + goto err; +@@ -1096,6 +1096,7 @@ static int flctl_probe(struct platform_device *pdev) + flctl->reg = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(flctl->reg)) + return PTR_ERR(flctl->reg); ++ flctl->fifo = res->start + 0x24; /* FLDTFIFO */ + + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig +index f184fb5bd110..5116aec3c174 100644 +--- a/drivers/net/Kconfig ++++ b/drivers/net/Kconfig +@@ -411,6 +411,9 @@ config XEN_NETDEV_BACKEND + config VMXNET3 + tristate "VMware VMXNET3 ethernet driver" + depends on PCI && INET ++ depends on !(PAGE_SIZE_64KB || ARM64_64K_PAGES || \ ++ IA64_PAGE_SIZE_64KB || MICROBLAZE_64K_PAGES || \ ++ PARISC_PAGE_SIZE_64KB || PPC_64K_PAGES) + help + This driver supports VMware's vmxnet3 virtual ethernet NIC. + To compile this driver as a module, choose M here: the +diff --git a/drivers/net/ethernet/3com/3c509.c b/drivers/net/ethernet/3com/3c509.c +index 4547a1b8b958..7677c745fb30 100644 +--- a/drivers/net/ethernet/3com/3c509.c ++++ b/drivers/net/ethernet/3com/3c509.c +@@ -562,7 +562,7 @@ static void el3_common_remove (struct net_device *dev) + } + + #ifdef CONFIG_EISA +-static int __init el3_eisa_probe (struct device *device) ++static int el3_eisa_probe(struct device *device) + { + short i; + int ioaddr, irq, if_port; +diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c +index 2839af00f20c..1c5f3b273e6a 100644 +--- a/drivers/net/ethernet/3com/3c59x.c ++++ b/drivers/net/ethernet/3com/3c59x.c +@@ -907,7 +907,7 @@ static struct eisa_device_id vortex_eisa_ids[] = { + }; + MODULE_DEVICE_TABLE(eisa, vortex_eisa_ids); + +-static int __init vortex_eisa_probe(struct device *device) ++static int vortex_eisa_probe(struct device *device) + { + void __iomem *ioaddr; + struct eisa_device *edev; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +index 618d952c2984..2ef4b4e884ae 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +@@ -829,7 +829,7 @@ static int xgbe_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM ++#ifdef CONFIG_PM_SLEEP + static int xgbe_suspend(struct device *dev) + { + struct net_device *netdev = dev_get_drvdata(dev); +@@ -868,7 +868,7 @@ static int xgbe_resume(struct device *dev) + + return ret; + } +-#endif /* CONFIG_PM */ ++#endif /* CONFIG_PM_SLEEP */ + + #ifdef CONFIG_ACPI + static const struct acpi_device_id xgbe_acpi_match[] = { +diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c +index 8966f3159bb2..3acde3b9b767 100644 +--- a/drivers/net/ethernet/dec/tulip/de4x5.c ++++ b/drivers/net/ethernet/dec/tulip/de4x5.c +@@ -1990,7 +1990,7 @@ SetMulticastFilter(struct net_device *dev) + + static u_char de4x5_irq[] = EISA_ALLOWED_IRQ_LIST; + +-static int __init de4x5_eisa_probe (struct device *gendev) ++static int de4x5_eisa_probe(struct device *gendev) + { + struct eisa_device *edev; + u_long iobase; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 7923bfdc9b30..901661149b44 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1375,9 +1375,11 @@ static int gfar_probe(struct platform_device *ofdev) + + gfar_init_addr_hash_table(priv); + +- /* Insert receive time stamps into padding alignment bytes */ ++ /* Insert receive time stamps into padding alignment bytes, and ++ * plus 2 bytes padding to ensure the cpu alignment. ++ */ + if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +- priv->padding = 8; ++ priv->padding = 8 + DEFAULT_PADDING; + + if (dev->features & NETIF_F_IP_CSUM || + priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c +index ae6e30d39f0f..3daf2d4a7ca0 100644 +--- a/drivers/net/ethernet/hp/hp100.c ++++ b/drivers/net/ethernet/hp/hp100.c +@@ -194,7 +194,6 @@ static const char *hp100_isa_tbl[] = { + }; + #endif + +-#ifdef CONFIG_EISA + static struct eisa_device_id hp100_eisa_tbl[] = { + { "HWPF180" }, /* HP J2577 rev A */ + { "HWP1920" }, /* HP 27248B */ +@@ -205,9 +204,7 @@ static struct eisa_device_id hp100_eisa_tbl[] = { + { "" } /* Mandatory final entry ! */ + }; + MODULE_DEVICE_TABLE(eisa, hp100_eisa_tbl); +-#endif + +-#ifdef CONFIG_PCI + static const struct pci_device_id hp100_pci_tbl[] = { + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_J2585A, PCI_ANY_ID, PCI_ANY_ID,}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_J2585B, PCI_ANY_ID, PCI_ANY_ID,}, +@@ -219,7 +216,6 @@ static const struct pci_device_id hp100_pci_tbl[] = { + {} /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(pci, hp100_pci_tbl); +-#endif + + static int hp100_rx_ratio = HP100_DEFAULT_RX_RATIO; + static int hp100_priority_tx = HP100_DEFAULT_PRIORITY_TX; +@@ -2842,8 +2838,7 @@ static void cleanup_dev(struct net_device *d) + free_netdev(d); + } + +-#ifdef CONFIG_EISA +-static int __init hp100_eisa_probe (struct device *gendev) ++static int hp100_eisa_probe(struct device *gendev) + { + struct net_device *dev = alloc_etherdev(sizeof(struct hp100_private)); + struct eisa_device *edev = to_eisa_device(gendev); +@@ -2884,9 +2879,7 @@ static struct eisa_driver hp100_eisa_driver = { + .remove = hp100_eisa_remove, + } + }; +-#endif + +-#ifdef CONFIG_PCI + static int hp100_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +@@ -2955,7 +2948,6 @@ static struct pci_driver hp100_pci_driver = { + .probe = hp100_pci_probe, + .remove = hp100_pci_remove, + }; +-#endif + + /* + * module section +@@ -3032,23 +3024,17 @@ static int __init hp100_module_init(void) + err = hp100_isa_init(); + if (err && err != -ENODEV) + goto out; +-#ifdef CONFIG_EISA + err = eisa_driver_register(&hp100_eisa_driver); + if (err && err != -ENODEV) + goto out2; +-#endif +-#ifdef CONFIG_PCI + err = pci_register_driver(&hp100_pci_driver); + if (err && err != -ENODEV) + goto out3; +-#endif + out: + return err; + out3: +-#ifdef CONFIG_EISA + eisa_driver_unregister (&hp100_eisa_driver); + out2: +-#endif + hp100_isa_cleanup(); + goto out; + } +@@ -3057,12 +3043,8 @@ static int __init hp100_module_init(void) + static void __exit hp100_module_exit(void) + { + hp100_isa_cleanup(); +-#ifdef CONFIG_EISA + eisa_driver_unregister (&hp100_eisa_driver); +-#endif +-#ifdef CONFIG_PCI + pci_unregister_driver (&hp100_pci_driver); +-#endif + } + + module_init(hp100_module_init) +diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c +index a274cd49afe9..399a89f30826 100644 +--- a/drivers/net/ethernet/ti/tlan.c ++++ b/drivers/net/ethernet/ti/tlan.c +@@ -610,8 +610,8 @@ err_out_regions: + #ifdef CONFIG_PCI + if (pdev) + pci_release_regions(pdev); +-#endif + err_out: ++#endif + if (pdev) + pci_disable_device(pdev); + return rc; +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 95c0b45a68fb..313e006f74fe 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *dev) + rrpriv->info_dma); + rrpriv->info = NULL; + +- free_irq(pdev->irq, dev); + spin_unlock_irqrestore(&rrpriv->lock, flags); ++ free_irq(pdev->irq, dev); + + return 0; + } +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index af827faec7fe..8aecea0d5dbf 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -353,6 +353,7 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) + .flowi4_oif = dev->ifindex, + .flowi4_tos = RT_TOS(ip4h->tos), + .flowi4_flags = FLOWI_FLAG_ANYSRC, ++ .flowi4_mark = skb->mark, + .daddr = ip4h->daddr, + .saddr = ip4h->saddr, + }; +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 1f6893ebce16..3a7286256db0 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -395,6 +395,10 @@ config USB_NET_RNDIS_HOST + The protocol specification is incomplete, and is controlled by + (and for) Microsoft; it isn't an "Open" ecosystem or market. + ++config USB_NET_CDC_SUBSET_ENABLE ++ tristate ++ depends on USB_NET_CDC_SUBSET ++ + config USB_NET_CDC_SUBSET + tristate "Simple USB Network Links (CDC Ethernet subset)" + depends on USB_USBNET +@@ -413,6 +417,7 @@ config USB_NET_CDC_SUBSET + config USB_ALI_M5632 + bool "ALi M5632 based 'USB 2.0 Data Link' cables" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + help + Choose this option if you're using a host-to-host cable + based on this design, which supports USB 2.0 high speed. +@@ -420,6 +425,7 @@ config USB_ALI_M5632 + config USB_AN2720 + bool "AnchorChips 2720 based cables (Xircom PGUNET, ...)" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + help + Choose this option if you're using a host-to-host cable + based on this design. Note that AnchorChips is now a +@@ -428,6 +434,7 @@ config USB_AN2720 + config USB_BELKIN + bool "eTEK based host-to-host cables (Advance, Belkin, ...)" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + default y + help + Choose this option if you're using a host-to-host cable +@@ -437,6 +444,7 @@ config USB_BELKIN + config USB_ARMLINUX + bool "Embedded ARM Linux links (iPaq, ...)" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + default y + help + Choose this option to support the "usb-eth" networking driver +@@ -454,6 +462,7 @@ config USB_ARMLINUX + config USB_EPSON2888 + bool "Epson 2888 based firmware (DEVELOPMENT)" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + help + Choose this option to support the usb networking links used + by some sample firmware from Epson. +@@ -461,6 +470,7 @@ config USB_EPSON2888 + config USB_KC2190 + bool "KT Technology KC2190 based cables (InstaNet)" + depends on USB_NET_CDC_SUBSET ++ select USB_NET_CDC_SUBSET_ENABLE + help + Choose this option if you're using a host-to-host cable + with one of these chips. +diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile +index b5f04068dbe4..37fb46aee341 100644 +--- a/drivers/net/usb/Makefile ++++ b/drivers/net/usb/Makefile +@@ -23,7 +23,7 @@ obj-$(CONFIG_USB_NET_GL620A) += gl620a.o + obj-$(CONFIG_USB_NET_NET1080) += net1080.o + obj-$(CONFIG_USB_NET_PLUSB) += plusb.o + obj-$(CONFIG_USB_NET_RNDIS_HOST) += rndis_host.o +-obj-$(CONFIG_USB_NET_CDC_SUBSET) += cdc_subset.o ++obj-$(CONFIG_USB_NET_CDC_SUBSET_ENABLE) += cdc_subset.o + obj-$(CONFIG_USB_NET_ZAURUS) += zaurus.o + obj-$(CONFIG_USB_NET_MCS7830) += mcs7830.o + obj-$(CONFIG_USB_USBNET) += usbnet.o +diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c +index a740083634d8..63f95e9c2992 100644 +--- a/drivers/net/wireless/cw1200/cw1200_spi.c ++++ b/drivers/net/wireless/cw1200/cw1200_spi.c +@@ -446,8 +446,7 @@ static int cw1200_spi_disconnect(struct spi_device *func) + return 0; + } + +-#ifdef CONFIG_PM +-static int cw1200_spi_suspend(struct device *dev) ++static int __maybe_unused cw1200_spi_suspend(struct device *dev) + { + struct hwbus_priv *self = spi_get_drvdata(to_spi_device(dev)); + +@@ -460,16 +459,12 @@ static int cw1200_spi_suspend(struct device *dev) + + static SIMPLE_DEV_PM_OPS(cw1200_pm_ops, cw1200_spi_suspend, NULL); + +-#endif +- + static struct spi_driver spi_driver = { + .probe = cw1200_spi_probe, + .remove = cw1200_spi_disconnect, + .driver = { + .name = "cw1200_wlan_spi", +-#ifdef CONFIG_PM +- .pm = &cw1200_pm_ops, +-#endif ++ .pm = IS_ENABLED(CONFIG_PM) ? &cw1200_pm_ops : NULL, + }, + }; + +diff --git a/drivers/net/wireless/cw1200/pm.h b/drivers/net/wireless/cw1200/pm.h +index 3ed90ff22bb8..534548470ebc 100644 +--- a/drivers/net/wireless/cw1200/pm.h ++++ b/drivers/net/wireless/cw1200/pm.h +@@ -31,13 +31,18 @@ int cw1200_pm_init(struct cw1200_pm_state *pm, + void cw1200_pm_deinit(struct cw1200_pm_state *pm); + int cw1200_wow_suspend(struct ieee80211_hw *hw, + struct cfg80211_wowlan *wowlan); +-int cw1200_wow_resume(struct ieee80211_hw *hw); + int cw1200_can_suspend(struct cw1200_common *priv); ++int cw1200_wow_resume(struct ieee80211_hw *hw); + void cw1200_pm_stay_awake(struct cw1200_pm_state *pm, + unsigned long tmo); + #else + static inline void cw1200_pm_stay_awake(struct cw1200_pm_state *pm, +- unsigned long tmo) { ++ unsigned long tmo) ++{ ++} ++static inline int cw1200_can_suspend(struct cw1200_common *priv) ++{ ++ return 0; + } + #endif + #endif +diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c +index 9e0ca3048657..3dd46c78c1cc 100644 +--- a/drivers/net/wireless/cw1200/wsm.c ++++ b/drivers/net/wireless/cw1200/wsm.c +@@ -379,7 +379,6 @@ static int wsm_multi_tx_confirm(struct cw1200_common *priv, + { + int ret; + int count; +- int i; + + count = WSM_GET32(buf); + if (WARN_ON(count <= 0)) +@@ -395,11 +394,10 @@ static int wsm_multi_tx_confirm(struct cw1200_common *priv, + } + + cw1200_debug_txed_multi(priv, count); +- for (i = 0; i < count; ++i) { ++ do { + ret = wsm_tx_confirm(priv, buf, link_id); +- if (ret) +- return ret; +- } ++ } while (!ret && --count); ++ + return ret; + + underflow: +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c +index b57cfd965196..7b13962ec9da 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c +@@ -2488,9 +2488,9 @@ void rtl8821ae_dm_txpower_tracking_callback_thermalmeter( + for (p = RF90_PATH_A; p < MAX_PATH_NUM_8821A; p++) + rtldm->swing_idx_ofdm_base[p] = rtldm->swing_idx_ofdm[p]; + +- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, +- "pDM_Odm->RFCalibrateInfo.ThermalValue = %d ThermalValue= %d\n", +- rtldm->thermalvalue, thermal_value); ++ RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, ++ "pDM_Odm->RFCalibrateInfo.ThermalValue = %d ThermalValue= %d\n", ++ rtldm->thermalvalue, thermal_value); + /*Record last Power Tracking Thermal Value*/ + rtldm->thermalvalue = thermal_value; + } +diff --git a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c +index 1b580ba76453..907d7db3fcee 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c +@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i_a80_pins[] = { + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */ + + /* Hole */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0), +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 1089eaa02b00..988ebe9a6b90 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -95,6 +95,7 @@ config DELL_LAPTOP + tristate "Dell Laptop Extras" + depends on X86 + depends on DCDBAS ++ depends on DMI + depends on BACKLIGHT_CLASS_DEVICE + depends on ACPI_VIDEO || ACPI_VIDEO = n + depends on RFKILL || RFKILL = n +@@ -110,6 +111,7 @@ config DELL_LAPTOP + config DELL_WMI + tristate "Dell WMI extras" + depends on ACPI_WMI ++ depends on DMI + depends on INPUT + depends on ACPI_VIDEO || ACPI_VIDEO = n + select INPUT_SPARSEKMAP +diff --git a/drivers/platform/x86/intel_mid_thermal.c b/drivers/platform/x86/intel_mid_thermal.c +index 5c768c4627d3..78e1bfee698a 100644 +--- a/drivers/platform/x86/intel_mid_thermal.c ++++ b/drivers/platform/x86/intel_mid_thermal.c +@@ -415,6 +415,7 @@ static struct thermal_device_info *initialize_sensor(int index) + return td_info; + } + ++#ifdef CONFIG_PM_SLEEP + /** + * mid_thermal_resume - resume routine + * @dev: device structure +@@ -442,6 +443,7 @@ static int mid_thermal_suspend(struct device *dev) + */ + return configure_adc(0); + } ++#endif + + static SIMPLE_DEV_PM_OPS(mid_thermal_pm, + mid_thermal_suspend, mid_thermal_resume); +diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c +index 89aa976f0ab2..65b0a4845ddd 100644 +--- a/drivers/platform/x86/tc1100-wmi.c ++++ b/drivers/platform/x86/tc1100-wmi.c +@@ -52,7 +52,9 @@ struct tc1100_data { + u32 jogdial; + }; + ++#ifdef CONFIG_PM + static struct tc1100_data suspend_data; ++#endif + + /* -------------------------------------------------------------------------- + Device Management +diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig +index 237d7aa73e8c..9f53fb74ae6f 100644 +--- a/drivers/power/Kconfig ++++ b/drivers/power/Kconfig +@@ -159,6 +159,7 @@ config BATTERY_SBS + + config BATTERY_BQ27XXX + tristate "BQ27xxx battery driver" ++ depends on I2C || I2C=n + help + Say Y here to enable support for batteries with BQ27xxx (I2C/HDQ) chips. + +diff --git a/drivers/power/bq27xxx_battery.c b/drivers/power/bq27xxx_battery.c +index 880233ce9343..6c3a447f378b 100644 +--- a/drivers/power/bq27xxx_battery.c ++++ b/drivers/power/bq27xxx_battery.c +@@ -285,7 +285,7 @@ static u8 bq27421_regs[] = { + 0x18, /* AP */ + }; + +-static u8 *bq27xxx_regs[] = { ++static u8 *bq27xxx_regs[] __maybe_unused = { + [BQ27000] = bq27000_regs, + [BQ27010] = bq27010_regs, + [BQ27500] = bq27500_regs, +@@ -991,7 +991,7 @@ static void bq27xxx_external_power_changed(struct power_supply *psy) + schedule_delayed_work(&di->work, 0); + } + +-static int bq27xxx_powersupply_init(struct bq27xxx_device_info *di, ++static int __maybe_unused bq27xxx_powersupply_init(struct bq27xxx_device_info *di, + const char *name) + { + int ret; +@@ -1026,7 +1026,7 @@ static int bq27xxx_powersupply_init(struct bq27xxx_device_info *di, + return 0; + } + +-static void bq27xxx_powersupply_unregister(struct bq27xxx_device_info *di) ++static void __maybe_unused bq27xxx_powersupply_unregister(struct bq27xxx_device_info *di) + { + /* + * power_supply_unregister call bq27xxx_battery_get_property which +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 9083247f55a8..21d174e9ebdb 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -518,10 +518,12 @@ static int prefix_LRE(struct ccw1 *ccw, struct PFX_eckd_data *pfxdata, + pfxdata->validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) + pfxdata->validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata->validity.hyper_pav = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { ++ pfxdata->validity.verify_base = 1; ++ pfxdata->validity.hyper_pav = 1; + } + + /* define extend data (mostly)*/ +@@ -3002,10 +3004,12 @@ static int prepare_itcw(struct itcw *itcw, + pfxdata.validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) ++ pfxdata.validity.verify_base = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { + pfxdata.validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata.validity.hyper_pav = 1; ++ pfxdata.validity.hyper_pav = 1; + } + + switch (cmd) { +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index febbd83e2ecd..24e57e770432 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -6291,18 +6291,17 @@ static uchar AscGetSynPeriodIndex(ASC_DVC_VAR *asc_dvc, uchar syn_time) + static uchar + AscMsgOutSDTR(ASC_DVC_VAR *asc_dvc, uchar sdtr_period, uchar sdtr_offset) + { +- EXT_MSG sdtr_buf; +- uchar sdtr_period_index; +- PortAddr iop_base; +- +- iop_base = asc_dvc->iop_base; +- sdtr_buf.msg_type = EXTENDED_MESSAGE; +- sdtr_buf.msg_len = MS_SDTR_LEN; +- sdtr_buf.msg_req = EXTENDED_SDTR; +- sdtr_buf.xfer_period = sdtr_period; ++ PortAddr iop_base = asc_dvc->iop_base; ++ uchar sdtr_period_index = AscGetSynPeriodIndex(asc_dvc, sdtr_period); ++ EXT_MSG sdtr_buf = { ++ .msg_type = EXTENDED_MESSAGE, ++ .msg_len = MS_SDTR_LEN, ++ .msg_req = EXTENDED_SDTR, ++ .xfer_period = sdtr_period, ++ .req_ack_offset = sdtr_offset, ++ }; + sdtr_offset &= ASC_SYN_MAX_OFFSET; +- sdtr_buf.req_ack_offset = sdtr_offset; +- sdtr_period_index = AscGetSynPeriodIndex(asc_dvc, sdtr_period); ++ + if (sdtr_period_index <= asc_dvc->max_sdtr_index) { + AscMemWordCopyPtrToLram(iop_base, ASCV_MSGOUT_BEG, + (uchar *)&sdtr_buf, +@@ -11030,6 +11029,9 @@ static int advansys_board_found(struct Scsi_Host *shost, unsigned int iop, + ASC_DBG(2, "AdvInitGetConfig()\n"); + + ret = AdvInitGetConfig(pdev, shost) ? -ENODEV : 0; ++#else ++ share_irq = 0; ++ ret = -ENODEV; + #endif /* CONFIG_PCI */ + } + +diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c +index d4cda5e9600e..21c8d210c456 100644 +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -180,11 +180,14 @@ static u8 adpt_read_blink_led(adpt_hba* host) + *============================================================================ + */ + ++#ifdef MODULE + static struct pci_device_id dptids[] = { + { PCI_DPT_VENDOR_ID, PCI_DPT_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,}, + { PCI_DPT_VENDOR_ID, PCI_DPT_RAPTOR_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,}, + { 0, } + }; ++#endif ++ + MODULE_DEVICE_TABLE(pci,dptids); + + static int adpt_detect(struct scsi_host_template* sht) +diff --git a/drivers/scsi/fdomain.c b/drivers/scsi/fdomain.c +index eefe14d453db..b87ab38a4530 100644 +--- a/drivers/scsi/fdomain.c ++++ b/drivers/scsi/fdomain.c +@@ -1768,7 +1768,7 @@ struct scsi_host_template fdomain_driver_template = { + }; + + #ifndef PCMCIA +-#ifdef CONFIG_PCI ++#if defined(CONFIG_PCI) && defined(MODULE) + + static struct pci_device_id fdomain_pci_tbl[] = { + { PCI_VENDOR_ID_FD, PCI_DEVICE_ID_FD_36C70, +diff --git a/drivers/scsi/g_NCR5380.c b/drivers/scsi/g_NCR5380.c +index f8d2478b11cc..87e081f8a386 100644 +--- a/drivers/scsi/g_NCR5380.c ++++ b/drivers/scsi/g_NCR5380.c +@@ -538,7 +538,10 @@ static inline int NCR5380_pread(struct Scsi_Host *instance, unsigned char *dst, + printk(KERN_ERR "53C400r: Got 53C80_IRQ start=%d, blocks=%d\n", start, blocks); + return -1; + } +- while (NCR5380_read(C400_CONTROL_STATUS_REG) & CSR_HOST_BUF_NOT_RDY); ++ while (NCR5380_read(C400_CONTROL_STATUS_REG) & CSR_HOST_BUF_NOT_RDY) ++ { ++ // FIXME - no timeout ++ } + + #ifndef SCSI_G_NCR5380_MEM + { +diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c +index 6a926bae76b2..7a91cf3ff173 100644 +--- a/drivers/scsi/initio.c ++++ b/drivers/scsi/initio.c +@@ -110,11 +110,6 @@ + #define i91u_MAXQUEUE 2 + #define i91u_REVID "Initio INI-9X00U/UW SCSI device driver; Revision: 1.04a" + +-#define I950_DEVICE_ID 0x9500 /* Initio's inic-950 product ID */ +-#define I940_DEVICE_ID 0x9400 /* Initio's inic-940 product ID */ +-#define I935_DEVICE_ID 0x9401 /* Initio's inic-935 product ID */ +-#define I920_DEVICE_ID 0x0002 /* Initio's other product ID */ +- + #ifdef DEBUG_i91u + static unsigned int i91u_debug = DEBUG_DEFAULT; + #endif +@@ -127,17 +122,6 @@ static int setup_debug = 0; + + static void i91uSCBPost(u8 * pHcb, u8 * pScb); + +-/* PCI Devices supported by this driver */ +-static struct pci_device_id i91u_pci_devices[] = { +- { PCI_VENDOR_ID_INIT, I950_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { PCI_VENDOR_ID_INIT, I940_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { PCI_VENDOR_ID_INIT, I935_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { PCI_VENDOR_ID_INIT, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { PCI_VENDOR_ID_DOMEX, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, +- { } +-}; +-MODULE_DEVICE_TABLE(pci, i91u_pci_devices); +- + #define DEBUG_INTERRUPT 0 + #define DEBUG_QUEUE 0 + #define DEBUG_STATE 0 +diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c +index 02360de6b7e0..39285070f3b5 100644 +--- a/drivers/scsi/mvumi.c ++++ b/drivers/scsi/mvumi.c +@@ -2629,7 +2629,7 @@ static void mvumi_shutdown(struct pci_dev *pdev) + mvumi_flush_cache(mhba); + } + +-static int mvumi_suspend(struct pci_dev *pdev, pm_message_t state) ++static int __maybe_unused mvumi_suspend(struct pci_dev *pdev, pm_message_t state) + { + struct mvumi_hba *mhba = NULL; + +@@ -2648,7 +2648,7 @@ static int mvumi_suspend(struct pci_dev *pdev, pm_message_t state) + return 0; + } + +-static int mvumi_resume(struct pci_dev *pdev) ++static int __maybe_unused mvumi_resume(struct pci_dev *pdev) + { + int ret; + struct mvumi_hba *mhba = NULL; +diff --git a/drivers/scsi/sim710.c b/drivers/scsi/sim710.c +index 3b3b56f4a830..82ed99848378 100644 +--- a/drivers/scsi/sim710.c ++++ b/drivers/scsi/sim710.c +@@ -176,8 +176,7 @@ static struct eisa_device_id sim710_eisa_ids[] = { + }; + MODULE_DEVICE_TABLE(eisa, sim710_eisa_ids); + +-static __init int +-sim710_eisa_probe(struct device *dev) ++static int sim710_eisa_probe(struct device *dev) + { + struct eisa_device *edev = to_eisa_device(dev); + unsigned long io_addr = edev->base_addr; +diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c +index 39d7c7c70112..2eea3de5a668 100644 +--- a/drivers/spi/spi-sun4i.c ++++ b/drivers/spi/spi-sun4i.c +@@ -458,7 +458,7 @@ err_free_master: + + static int sun4i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } +diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c +index 5d1e9a0fc389..e2ff6b5b2094 100644 +--- a/drivers/ssb/main.c ++++ b/drivers/ssb/main.c +@@ -613,9 +613,10 @@ out: + return err; + } + +-static int ssb_bus_register(struct ssb_bus *bus, +- ssb_invariants_func_t get_invariants, +- unsigned long baseaddr) ++static int __maybe_unused ++ssb_bus_register(struct ssb_bus *bus, ++ ssb_invariants_func_t get_invariants, ++ unsigned long baseaddr) + { + int err; + +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index b64327722660..ec31b53ae3a5 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -704,30 +704,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + size_t pgstart, pgend; + int ret = -EINVAL; + ++ mutex_lock(&ashmem_mutex); ++ + if (unlikely(!asma->file)) +- return -EINVAL; ++ goto out_unlock; + +- if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) +- return -EFAULT; ++ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { ++ ret = -EFAULT; ++ goto out_unlock; ++ } + + /* per custom, you can pass zero for len to mean "everything onward" */ + if (!pin.len) + pin.len = PAGE_ALIGN(asma->size) - pin.offset; + + if (unlikely((pin.offset | pin.len) & ~PAGE_MASK)) +- return -EINVAL; ++ goto out_unlock; + + if (unlikely(((__u32)-1) - pin.offset < pin.len)) +- return -EINVAL; ++ goto out_unlock; + + if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len)) +- return -EINVAL; ++ goto out_unlock; + + pgstart = pin.offset / PAGE_SIZE; + pgend = pgstart + (pin.len / PAGE_SIZE) - 1; + +- mutex_lock(&ashmem_mutex); +- + switch (cmd) { + case ASHMEM_PIN: + ret = ashmem_pin(asma, pgstart, pgend); +@@ -740,6 +742,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + break; + } + ++out_unlock: + mutex_unlock(&ashmem_mutex); + + return ret; +diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c +index abc66908681d..6f032009f93f 100644 +--- a/drivers/staging/iio/adc/ad7192.c ++++ b/drivers/staging/iio/adc/ad7192.c +@@ -124,6 +124,8 @@ + #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */ + #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */ + ++#define AD7192_EXT_FREQ_MHZ_MIN 2457600 ++#define AD7192_EXT_FREQ_MHZ_MAX 5120000 + #define AD7192_INT_FREQ_MHZ 4915200 + + /* NOTE: +@@ -199,6 +201,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st) + ARRAY_SIZE(ad7192_calib_arr)); + } + ++static inline bool ad7192_valid_external_frequency(u32 freq) ++{ ++ return (freq >= AD7192_EXT_FREQ_MHZ_MIN && ++ freq <= AD7192_EXT_FREQ_MHZ_MAX); ++} ++ + static int ad7192_setup(struct ad7192_state *st, + const struct ad7192_platform_data *pdata) + { +@@ -224,17 +232,20 @@ static int ad7192_setup(struct ad7192_state *st, + id); + + switch (pdata->clock_source_sel) { +- case AD7192_CLK_EXT_MCLK1_2: +- case AD7192_CLK_EXT_MCLK2: +- st->mclk = AD7192_INT_FREQ_MHZ; +- break; + case AD7192_CLK_INT: + case AD7192_CLK_INT_CO: +- if (pdata->ext_clk_hz) +- st->mclk = pdata->ext_clk_hz; +- else +- st->mclk = AD7192_INT_FREQ_MHZ; ++ st->mclk = AD7192_INT_FREQ_MHZ; + break; ++ case AD7192_CLK_EXT_MCLK1_2: ++ case AD7192_CLK_EXT_MCLK2: ++ if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) { ++ st->mclk = pdata->ext_clk_hz; ++ break; ++ } ++ dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n", ++ pdata->ext_clk_hz); ++ ret = -EINVAL; ++ goto out; + default: + ret = -EINVAL; + goto out; +diff --git a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c +index 824d460911ec..58ccafb97344 100644 +--- a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c ++++ b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c +@@ -1039,7 +1039,6 @@ static int synaptics_rmi4_remove(struct i2c_client *client) + return 0; + } + +-#ifdef CONFIG_PM + /** + * synaptics_rmi4_suspend() - suspend the touch screen controller + * @dev: pointer to device structure +@@ -1047,7 +1046,7 @@ static int synaptics_rmi4_remove(struct i2c_client *client) + * This function is used to suspend the + * touch panel controller and returns integer + */ +-static int synaptics_rmi4_suspend(struct device *dev) ++static int __maybe_unused synaptics_rmi4_suspend(struct device *dev) + { + /* Touch sleep mode */ + int retval; +@@ -1081,7 +1080,7 @@ static int synaptics_rmi4_suspend(struct device *dev) + * This function is used to resume the touch panel + * controller and returns integer. + */ +-static int synaptics_rmi4_resume(struct device *dev) ++static int __maybe_unused synaptics_rmi4_resume(struct device *dev) + { + int retval; + unsigned char intr_status; +@@ -1112,8 +1111,6 @@ static int synaptics_rmi4_resume(struct device *dev) + return 0; + } + +-#endif +- + static SIMPLE_DEV_PM_OPS(synaptics_rmi4_dev_pm_ops, synaptics_rmi4_suspend, + synaptics_rmi4_resume); + +diff --git a/drivers/staging/unisys/visorinput/Kconfig b/drivers/staging/unisys/visorinput/Kconfig +index d83deb4137e8..6baba2795ce7 100644 +--- a/drivers/staging/unisys/visorinput/Kconfig ++++ b/drivers/staging/unisys/visorinput/Kconfig +@@ -4,7 +4,7 @@ + + config UNISYS_VISORINPUT + tristate "Unisys visorinput driver" +- depends on UNISYSSPAR && UNISYS_VISORBUS && FB ++ depends on UNISYSSPAR && UNISYS_VISORBUS && FB && INPUT + ---help--- + If you say Y here, you will enable the Unisys visorinput driver. + +diff --git a/drivers/staging/wilc1000/wilc_wlan_if.h b/drivers/staging/wilc1000/wilc_wlan_if.h +index be972afe6e62..bfc3e96d8d25 100644 +--- a/drivers/staging/wilc1000/wilc_wlan_if.h ++++ b/drivers/staging/wilc1000/wilc_wlan_if.h +@@ -12,6 +12,7 @@ + + #include + #include "linux_wlan_common.h" ++#include + + /******************************************** + * +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index a7d30e894cab..c43c942e1f87 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -900,7 +900,7 @@ static int tcmu_configure_device(struct se_device *dev) + info->version = __stringify(TCMU_MAILBOX_VERSION); + + info->mem[0].name = "tcm-user command & data buffer"; +- info->mem[0].addr = (phys_addr_t) udev->mb_addr; ++ info->mem[0].addr = (phys_addr_t)(uintptr_t)udev->mb_addr; + info->mem[0].size = TCMU_RING_SIZE; + info->mem[0].memtype = UIO_MEM_VIRTUAL; + +diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig +index 8cc4ac64a91c..4b660b5beb98 100644 +--- a/drivers/thermal/Kconfig ++++ b/drivers/thermal/Kconfig +@@ -299,7 +299,7 @@ config X86_PKG_TEMP_THERMAL + + config INTEL_SOC_DTS_IOSF_CORE + tristate +- depends on X86 ++ depends on X86 && PCI + select IOSF_MBI + help + This is becoming a common feature for Intel SoCs to expose the additional +@@ -309,7 +309,7 @@ config INTEL_SOC_DTS_IOSF_CORE + + config INTEL_SOC_DTS_THERMAL + tristate "Intel SoCs DTS thermal driver" +- depends on X86 ++ depends on X86 && PCI + select INTEL_SOC_DTS_IOSF_CORE + select THERMAL_WRITABLE_TRIPS + help +diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c +index 534dd9136662..81b35aace9de 100644 +--- a/drivers/thermal/spear_thermal.c ++++ b/drivers/thermal/spear_thermal.c +@@ -54,8 +54,7 @@ static struct thermal_zone_device_ops ops = { + .get_temp = thermal_get_temp, + }; + +-#ifdef CONFIG_PM +-static int spear_thermal_suspend(struct device *dev) ++static int __maybe_unused spear_thermal_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev); +@@ -72,7 +71,7 @@ static int spear_thermal_suspend(struct device *dev) + return 0; + } + +-static int spear_thermal_resume(struct device *dev) ++static int __maybe_unused spear_thermal_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev); +@@ -94,7 +93,6 @@ static int spear_thermal_resume(struct device *dev) + + return 0; + } +-#endif + + static SIMPLE_DEV_PM_OPS(spear_thermal_pm_ops, spear_thermal_suspend, + spear_thermal_resume); +diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig +index c01f45095877..82c4d2e45319 100644 +--- a/drivers/tty/Kconfig ++++ b/drivers/tty/Kconfig +@@ -226,7 +226,7 @@ config CYCLADES + + config CYZ_INTR + bool "Cyclades-Z interrupt mode operation" +- depends on CYCLADES ++ depends on CYCLADES && PCI + help + The Cyclades-Z family of multiport cards allows 2 (two) driver op + modes: polling and interrupt. In polling mode, the driver will check +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index fa816b7193b6..11725422dacb 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -323,6 +323,7 @@ void xen_console_resume(void) + } + } + ++#ifdef CONFIG_HVC_XEN_FRONTEND + static void xencons_disconnect_backend(struct xencons_info *info) + { + if (info->irq > 0) +@@ -363,7 +364,6 @@ static int xen_console_remove(struct xencons_info *info) + return 0; + } + +-#ifdef CONFIG_HVC_XEN_FRONTEND + static int xencons_remove(struct xenbus_device *dev) + { + return xen_console_remove(dev_get_drvdata(&dev->dev)); +diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig +index 6412f1455beb..6f4c180aadc1 100644 +--- a/drivers/tty/serial/8250/Kconfig ++++ b/drivers/tty/serial/8250/Kconfig +@@ -372,7 +372,7 @@ config SERIAL_8250_MID + tristate "Support for serial ports on Intel MID platforms" + depends on SERIAL_8250 && PCI + select HSU_DMA if SERIAL_8250_DMA +- select HSU_DMA_PCI if X86_INTEL_MID ++ select HSU_DMA_PCI if (HSU_DMA && X86_INTEL_MID) + select RATIONAL + help + Selecting this option will enable handling of the extra features +diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig +index 3bb08870148f..95e72d75e0a0 100644 +--- a/drivers/usb/host/Kconfig ++++ b/drivers/usb/host/Kconfig +@@ -220,6 +220,8 @@ config USB_EHCI_TEGRA + depends on ARCH_TEGRA + select USB_EHCI_ROOT_HUB_TT + select USB_PHY ++ select USB_ULPI ++ select USB_ULPI_VIEWPORT + help + This driver enables support for the internal USB Host Controllers + found in NVIDIA Tegra SoCs. The controllers are EHCI compliant. +diff --git a/drivers/usb/musb/ux500_dma.c b/drivers/usb/musb/ux500_dma.c +index d0b6a1cd7f62..c92a295049ad 100644 +--- a/drivers/usb/musb/ux500_dma.c ++++ b/drivers/usb/musb/ux500_dma.c +@@ -207,9 +207,6 @@ static int ux500_dma_channel_program(struct dma_channel *channel, + BUG_ON(channel->status == MUSB_DMA_STATUS_UNKNOWN || + channel->status == MUSB_DMA_STATUS_BUSY); + +- if (!ux500_dma_is_compatible(channel, packet_sz, (void *)dma_addr, len)) +- return false; +- + channel->status = MUSB_DMA_STATUS_BUSY; + channel->actual_len = 0; + ret = ux500_configure_channel(channel, packet_sz, mode, dma_addr, len); +diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig +index 22e8ecb6bfbd..7a72bef35acf 100644 +--- a/drivers/usb/phy/Kconfig ++++ b/drivers/usb/phy/Kconfig +@@ -140,6 +140,7 @@ config USB_MSM_OTG + tristate "Qualcomm on-chip USB OTG controller support" + depends on (USB || USB_GADGET) && (ARCH_QCOM || COMPILE_TEST) + depends on RESET_CONTROLLER ++ depends on REGULATOR + depends on EXTCON + select USB_PHY + help +diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c +index ec38370ffcab..0931f3271119 100644 +--- a/drivers/usb/usbip/stub_dev.c ++++ b/drivers/usb/usbip/stub_dev.c +@@ -87,6 +87,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr, + goto err; + + sdev->ud.tcp_socket = socket; ++ sdev->ud.sockfd = sockfd; + + spin_unlock_irq(&sdev->ud.lock); + +@@ -186,6 +187,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) + if (ud->tcp_socket) { + sockfd_put(ud->tcp_socket); + ud->tcp_socket = NULL; ++ ud->sockfd = -1; + } + + /* 3. free used data */ +@@ -280,6 +282,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev) + sdev->ud.status = SDEV_ST_AVAILABLE; + spin_lock_init(&sdev->ud.lock); + sdev->ud.tcp_socket = NULL; ++ sdev->ud.sockfd = -1; + + INIT_LIST_HEAD(&sdev->priv_init); + INIT_LIST_HEAD(&sdev->priv_tx); +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 2d96bfd34138..4d68a1e9e878 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -797,6 +797,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) + if (vdev->ud.tcp_socket) { + sockfd_put(vdev->ud.tcp_socket); + vdev->ud.tcp_socket = NULL; ++ vdev->ud.sockfd = -1; + } + pr_info("release socket\n"); + +@@ -844,6 +845,7 @@ static void vhci_device_reset(struct usbip_device *ud) + if (ud->tcp_socket) { + sockfd_put(ud->tcp_socket); + ud->tcp_socket = NULL; ++ ud->sockfd = -1; + } + ud->status = VDEV_ST_NULL; + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +index f07a0974fda2..3543e3e4cfb5 100644 +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -1506,6 +1506,7 @@ config FB_SIS + select FB_CFB_COPYAREA + select FB_CFB_IMAGEBLIT + select FB_BOOT_VESA_SUPPORT if FB_SIS = y ++ select FB_SIS_300 if !FB_SIS_315 + help + This is the frame buffer device driver for the SiS 300, 315, 330 + and 340 series as well as XGI V3XT, V5, V8, Z7 graphics chipsets. +diff --git a/drivers/video/fbdev/auo_k190x.c b/drivers/video/fbdev/auo_k190x.c +index 8d2499d1cafb..9580374667ba 100644 +--- a/drivers/video/fbdev/auo_k190x.c ++++ b/drivers/video/fbdev/auo_k190x.c +@@ -773,9 +773,7 @@ static void auok190x_recover(struct auok190xfb_par *par) + /* + * Power-management + */ +- +-#ifdef CONFIG_PM +-static int auok190x_runtime_suspend(struct device *dev) ++static int __maybe_unused auok190x_runtime_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct fb_info *info = platform_get_drvdata(pdev); +@@ -822,7 +820,7 @@ finish: + return 0; + } + +-static int auok190x_runtime_resume(struct device *dev) ++static int __maybe_unused auok190x_runtime_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct fb_info *info = platform_get_drvdata(pdev); +@@ -856,7 +854,7 @@ static int auok190x_runtime_resume(struct device *dev) + return 0; + } + +-static int auok190x_suspend(struct device *dev) ++static int __maybe_unused auok190x_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct fb_info *info = platform_get_drvdata(pdev); +@@ -896,7 +894,7 @@ static int auok190x_suspend(struct device *dev) + return 0; + } + +-static int auok190x_resume(struct device *dev) ++static int __maybe_unused auok190x_resume(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct fb_info *info = platform_get_drvdata(pdev); +@@ -933,7 +931,6 @@ static int auok190x_resume(struct device *dev) + + return 0; + } +-#endif + + const struct dev_pm_ops auok190x_pm = { + SET_RUNTIME_PM_OPS(auok190x_runtime_suspend, auok190x_runtime_resume, +diff --git a/drivers/video/fbdev/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c +index 95873f26e39c..de2f3e793786 100644 +--- a/drivers/video/fbdev/exynos/s6e8ax0.c ++++ b/drivers/video/fbdev/exynos/s6e8ax0.c +@@ -829,8 +829,7 @@ static int s6e8ax0_probe(struct mipi_dsim_lcd_device *dsim_dev) + return 0; + } + +-#ifdef CONFIG_PM +-static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) ++static int __maybe_unused s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) + { + struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev); + +@@ -843,7 +842,7 @@ static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) + return 0; + } + +-static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) ++static int __maybe_unused s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) + { + struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev); + +@@ -855,10 +854,6 @@ static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) + + return 0; + } +-#else +-#define s6e8ax0_suspend NULL +-#define s6e8ax0_resume NULL +-#endif + + static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = { + .name = "s6e8ax0", +@@ -867,8 +862,8 @@ static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = { + .power_on = s6e8ax0_power_on, + .set_sequence = s6e8ax0_set_sequence, + .probe = s6e8ax0_probe, +- .suspend = s6e8ax0_suspend, +- .resume = s6e8ax0_resume, ++ .suspend = IS_ENABLED(CONFIG_PM) ? s6e8ax0_suspend : NULL, ++ .resume = IS_ENABLED(CONFIG_PM) ? s6e8ax0_resume : NULL, + }; + + static int s6e8ax0_init(void) +diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c +index bbec737eef30..bf207444ba0c 100644 +--- a/drivers/video/fbdev/intelfb/intelfbdrv.c ++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c +@@ -302,7 +302,7 @@ static __inline__ int get_opt_int(const char *this_opt, const char *name, + } + + static __inline__ int get_opt_bool(const char *this_opt, const char *name, +- int *ret) ++ bool *ret) + { + if (!ret) + return 0; +diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c +index a0f496049db7..3a6bb6561ba0 100644 +--- a/drivers/video/fbdev/mmp/core.c ++++ b/drivers/video/fbdev/mmp/core.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include