diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2016-04-12 14:52:57 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2016-04-12 14:52:57 -0400 |
| commit | 2d1f73dbbb04d3586c686226598e8acadd11021f (patch) | |
| tree | 205723e64b09a1e9809d7c56d02a4b4813a9d403 | |
| parent | Update 1500_XATTR_USER_PREFIX.patch for the new struct syntax in 4.5 kernels (diff) | |
| download | linux-patches-4.5-3.tar.gz linux-patches-4.5-3.tar.bz2 linux-patches-4.5-3.zip | |
Linux patch 4.5.14.5-3
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1000_linux-4.5.1.patch | 9372 |
2 files changed, 9376 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 8e70e785..40d6c2bf 100644 --- a/0000_README +++ b/0000_README @@ -43,6 +43,10 @@ EXPERIMENTAL Individual Patch Descriptions: -------------------------------------------------------------------------- +Patch: 1000_linux-4.5.1.patch +From: http://www.kernel.org +Desc: Linux 4.5.1 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1000_linux-4.5.1.patch b/1000_linux-4.5.1.patch new file mode 100644 index 00000000..4b27f5d0 --- /dev/null +++ b/1000_linux-4.5.1.patch @@ -0,0 +1,9372 @@ +diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt +index ff49cf901148..81eb378210c6 100644 +--- a/Documentation/cgroup-v2.txt ++++ b/Documentation/cgroup-v2.txt +@@ -1368,6 +1368,12 @@ system than killing the group. Otherwise, memory.max is there to + limit this type of spillover and ultimately contain buggy or even + malicious applications. + ++Setting the original memory.limit_in_bytes below the current usage was ++subject to a race condition, where concurrent charges could cause the ++limit setting to fail. memory.max on the other hand will first set the ++limit to prevent new charges, and then reclaim and OOM kill until the ++new limit is met - or the task writing to memory.max is killed. ++ + The combined memory+swap accounting and limiting is replaced by real + control over swap space. + +diff --git a/MAINTAINERS b/MAINTAINERS +index 6ee06ea47be4..5a389bc68e0e 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -228,13 +228,13 @@ F: kernel/sys_ni.c + + ABIT UGURU 1,2 HARDWARE MONITOR DRIVER + M: Hans de Goede <hdegoede@redhat.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/abituguru.c + + ABIT UGURU 3 HARDWARE MONITOR DRIVER + M: Alistair John Strachan <alistair@devzero.co.uk> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/abituguru3.c + +@@ -386,14 +386,14 @@ F: Documentation/devicetree/bindings/net/ieee802154/adf7242.txt + + ADM1025 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/adm1025 + F: drivers/hwmon/adm1025.c + + ADM1029 HARDWARE MONITOR DRIVER + M: Corentin Labbe <clabbe.montjoie@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/adm1029.c + +@@ -438,7 +438,7 @@ F: drivers/video/backlight/adp8860_bl.c + + ADS1015 HARDWARE MONITOR DRIVER + M: Dirk Eibach <eibach@gdsys.de> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/ads1015 + F: drivers/hwmon/ads1015.c +@@ -451,7 +451,7 @@ F: drivers/macintosh/therm_adt746x.c + + ADT7475 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/adt7475 + F: drivers/hwmon/adt7475.c +@@ -628,7 +628,7 @@ F: include/linux/ccp.h + + AMD FAM15H PROCESSOR POWER MONITORING DRIVER + M: Huang Rui <ray.huang@amd.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Supported + F: Documentation/hwmon/fam15h_power + F: drivers/hwmon/fam15h_power.c +@@ -786,7 +786,7 @@ F: drivers/input/mouse/bcm5974.c + + APPLE SMC DRIVER + M: Henrik Rydberg <rydberg@bitmath.org> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Odd fixes + F: drivers/hwmon/applesmc.c + +@@ -1825,7 +1825,7 @@ F: include/media/i2c/as3645a.h + + ASC7621 HARDWARE MONITOR DRIVER + M: George Joseph <george.joseph@fairview5.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/asc7621 + F: drivers/hwmon/asc7621.c +@@ -1918,7 +1918,7 @@ F: drivers/net/wireless/ath/carl9170/ + + ATK0110 HWMON DRIVER + M: Luca Tettamanti <kronos.it@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/asus_atk0110.c + +@@ -3037,7 +3037,7 @@ F: mm/swap_cgroup.c + + CORETEMP HARDWARE MONITORING DRIVER + M: Fenghua Yu <fenghua.yu@intel.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/coretemp + F: drivers/hwmon/coretemp.c +@@ -3625,7 +3625,7 @@ T: git git://git.infradead.org/users/vkoul/slave-dma.git + + DME1737 HARDWARE MONITOR DRIVER + M: Juerg Haefliger <juergh@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/dme1737 + F: drivers/hwmon/dme1737.c +@@ -4322,7 +4322,7 @@ F: include/video/exynos_mipi* + + F71805F HARDWARE MONITORING DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/f71805f + F: drivers/hwmon/f71805f.c +@@ -4401,7 +4401,7 @@ F: fs/* + + FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER + M: Riku Voipio <riku.voipio@iki.fi> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/f75375s.c + F: include/linux/f75375s.h +@@ -4958,8 +4958,8 @@ F: drivers/media/usb/hackrf/ + HARDWARE MONITORING + M: Jean Delvare <jdelvare@suse.com> + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org +-W: http://www.lm-sensors.org/ ++L: linux-hwmon@vger.kernel.org ++W: http://hwmon.wiki.kernel.org/ + T: quilt http://jdelvare.nerim.net/devel/linux/jdelvare-hwmon/ + T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git + S: Maintained +@@ -5484,7 +5484,7 @@ F: drivers/usb/atm/ueagle-atm.c + + INA209 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/ina209 + F: Documentation/devicetree/bindings/i2c/ina209.txt +@@ -5492,7 +5492,7 @@ F: drivers/hwmon/ina209.c + + INA2XX HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/ina2xx + F: drivers/hwmon/ina2xx.c +@@ -5985,7 +5985,7 @@ F: drivers/isdn/hardware/eicon/ + + IT87 HARDWARE MONITORING DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/it87 + F: drivers/hwmon/it87.c +@@ -6021,7 +6021,7 @@ F: drivers/media/dvb-frontends/ix2505v* + + JC42.4 TEMPERATURE SENSOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/jc42.c + F: Documentation/hwmon/jc42 +@@ -6071,14 +6071,14 @@ F: drivers/tty/serial/jsm/ + + K10TEMP HARDWARE MONITORING DRIVER + M: Clemens Ladisch <clemens@ladisch.de> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/k10temp + F: drivers/hwmon/k10temp.c + + K8TEMP HARDWARE MONITORING DRIVER + M: Rudolf Marek <r.marek@assembler.cz> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/k8temp + F: drivers/hwmon/k8temp.c +@@ -6605,27 +6605,27 @@ F: net/llc/ + + LM73 HARDWARE MONITOR DRIVER + M: Guillaume Ligneul <guillaume.ligneul@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/lm73.c + + LM78 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/lm78 + F: drivers/hwmon/lm78.c + + LM83 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/lm83 + F: drivers/hwmon/lm83.c + + LM90 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/lm90 + F: Documentation/devicetree/bindings/hwmon/lm90.txt +@@ -6633,7 +6633,7 @@ F: drivers/hwmon/lm90.c + + LM95234 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/lm95234 + F: drivers/hwmon/lm95234.c +@@ -6700,7 +6700,7 @@ F: drivers/scsi/sym53c8xx_2/ + + LTC4261 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/ltc4261 + F: drivers/hwmon/ltc4261.c +@@ -6870,28 +6870,28 @@ F: include/uapi/linux/matroxfb.h + + MAX16065 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/max16065 + F: drivers/hwmon/max16065.c + + MAX20751 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/max20751 + F: drivers/hwmon/max20751.c + + MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER + M: "Hans J. Koch" <hjk@hansjkoch.de> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/max6650 + F: drivers/hwmon/max6650.c + + MAX6697 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/max6697 + F: Documentation/devicetree/bindings/i2c/max6697.txt +@@ -7455,7 +7455,7 @@ F: drivers/scsi/NCR_D700.* + + NCT6775 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/nct6775 + F: drivers/hwmon/nct6775.c +@@ -8235,7 +8235,7 @@ F: drivers/video/logo/logo_parisc* + + PC87360 HARDWARE MONITORING DRIVER + M: Jim Cromie <jim.cromie@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/pc87360 + F: drivers/hwmon/pc87360.c +@@ -8247,7 +8247,7 @@ F: drivers/char/pc8736x_gpio.c + + PC87427 HARDWARE MONITORING DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/pc87427 + F: drivers/hwmon/pc87427.c +@@ -8601,8 +8601,8 @@ F: drivers/rtc/rtc-puv3.c + + PMBUS HARDWARE MONITORING DRIVERS + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org +-W: http://www.lm-sensors.org/ ++L: linux-hwmon@vger.kernel.org ++W: http://hwmon.wiki.kernel.org/ + W: http://www.roeck-us.net/linux/drivers/ + T: git git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git + S: Maintained +@@ -8807,7 +8807,7 @@ F: drivers/media/usb/pwc/* + + PWM FAN DRIVER + M: Kamil Debski <k.debski@samsung.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Supported + F: Documentation/devicetree/bindings/hwmon/pwm-fan.txt + F: Documentation/hwmon/pwm-fan +@@ -10113,28 +10113,28 @@ F: Documentation/devicetree/bindings/media/i2c/nokia,smia.txt + + SMM665 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/smm665 + F: drivers/hwmon/smm665.c + + SMSC EMC2103 HARDWARE MONITOR DRIVER + M: Steve Glendinning <steve.glendinning@shawell.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/emc2103 + F: drivers/hwmon/emc2103.c + + SMSC SCH5627 HARDWARE MONITOR DRIVER + M: Hans de Goede <hdegoede@redhat.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Supported + F: Documentation/hwmon/sch5627 + F: drivers/hwmon/sch5627.c + + SMSC47B397 HARDWARE MONITOR DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/smsc47b397 + F: drivers/hwmon/smsc47b397.c +@@ -11067,7 +11067,7 @@ F: include/linux/mmc/sh_mobile_sdhi.h + + TMP401 HARDWARE MONITOR DRIVER + M: Guenter Roeck <linux@roeck-us.net> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/tmp401 + F: drivers/hwmon/tmp401.c +@@ -11812,14 +11812,14 @@ F: Documentation/networking/vrf.txt + + VT1211 HARDWARE MONITOR DRIVER + M: Juerg Haefliger <juergh@gmail.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/vt1211 + F: drivers/hwmon/vt1211.c + + VT8231 HARDWARE MONITOR DRIVER + M: Roger Lucas <vt8231@hiddenengine.co.uk> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/vt8231.c + +@@ -11838,21 +11838,21 @@ F: drivers/w1/ + + W83791D HARDWARE MONITORING DRIVER + M: Marc Hulsman <m.hulsman@tudelft.nl> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/w83791d + F: drivers/hwmon/w83791d.c + + W83793 HARDWARE MONITORING DRIVER + M: Rudolf Marek <r.marek@assembler.cz> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: Documentation/hwmon/w83793 + F: drivers/hwmon/w83793.c + + W83795 HARDWARE MONITORING DRIVER + M: Jean Delvare <jdelvare@suse.com> +-L: lm-sensors@lm-sensors.org ++L: linux-hwmon@vger.kernel.org + S: Maintained + F: drivers/hwmon/w83795.c + +diff --git a/Makefile b/Makefile +index 7b3ecdcdc6c1..c621889b8827 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 5 +-SUBLEVEL = 0 ++SUBLEVEL = 1 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi +index 44a578c10732..ab5d5701e11d 100644 +--- a/arch/arc/boot/dts/axs10x_mb.dtsi ++++ b/arch/arc/boot/dts/axs10x_mb.dtsi +@@ -47,6 +47,14 @@ + clocks = <&apbclk>; + clock-names = "stmmaceth"; + max-speed = <100>; ++ mdio0 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "snps,dwmac-mdio"; ++ phy1: ethernet-phy@1 { ++ reg = <1>; ++ }; ++ }; + }; + + ehci@0x40000 { +diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h +index 57c1f33844d4..0352fb8d21b9 100644 +--- a/arch/arc/include/asm/bitops.h ++++ b/arch/arc/include/asm/bitops.h +@@ -35,21 +35,6 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\ + \ + m += nr >> 5; \ + \ +- /* \ +- * ARC ISA micro-optimization: \ +- * \ +- * Instructions dealing with bitpos only consider lower 5 bits \ +- * e.g (x << 33) is handled like (x << 1) by ASL instruction \ +- * (mem pointer still needs adjustment to point to next word) \ +- * \ +- * Hence the masking to clamp @nr arg can be elided in general. \ +- * \ +- * However if @nr is a constant (above assumed in a register), \ +- * and greater than 31, gcc can optimize away (x << 33) to 0, \ +- * as overflow, given the 32-bit ISA. Thus masking needs to be \ +- * done for const @nr, but no code is generated due to gcc \ +- * const prop. \ +- */ \ + nr &= 0x1f; \ + \ + __asm__ __volatile__( \ +diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h +index 694ece8a0243..27b17adea50d 100644 +--- a/arch/arc/include/asm/io.h ++++ b/arch/arc/include/asm/io.h +@@ -129,15 +129,23 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) + #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); }) + + /* +- * Relaxed API for drivers which can handle any ordering themselves ++ * Relaxed API for drivers which can handle barrier ordering themselves ++ * ++ * Also these are defined to perform little endian accesses. ++ * To provide the typical device register semantics of fixed endian, ++ * swap the byte order for Big Endian ++ * ++ * http://lkml.kernel.org/r/201603100845.30602.arnd@arndb.de + */ + #define readb_relaxed(c) __raw_readb(c) +-#define readw_relaxed(c) __raw_readw(c) +-#define readl_relaxed(c) __raw_readl(c) ++#define readw_relaxed(c) ({ u16 __r = le16_to_cpu((__force __le16) \ ++ __raw_readw(c)); __r; }) ++#define readl_relaxed(c) ({ u32 __r = le32_to_cpu((__force __le32) \ ++ __raw_readl(c)); __r; }) + + #define writeb_relaxed(v,c) __raw_writeb(v,c) +-#define writew_relaxed(v,c) __raw_writew(v,c) +-#define writel_relaxed(v,c) __raw_writel(v,c) ++#define writew_relaxed(v,c) __raw_writew((__force u16) cpu_to_le16(v),c) ++#define writel_relaxed(v,c) __raw_writel((__force u32) cpu_to_le32(v),c) + + #include <asm-generic/io.h> + +diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +index ff888d21c786..f3e2b96c06a3 100644 +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -303,6 +303,7 @@ + regulator-name = "mmc0-card-supply"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ regulator-always-on; + }; + + gpio_keys { +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index 569026e8f96c..da84e65b56ef 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -268,5 +268,6 @@ + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc_3v3_reg>; ++ regulator-always-on; + }; + }; +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 819aff5d593f..7273210782d5 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -279,7 +279,7 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr); + static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, + pte_t *ptep, pte_t pte) + { +- if (pte_valid(pte)) { ++ if (pte_present(pte)) { + if (pte_sw_dirty(pte) && pte_write(pte)) + pte_val(pte) &= ~PTE_RDONLY; + else +@@ -649,6 +649,7 @@ extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; + * bits 0-1: present (must be zero) + * bits 2-7: swap type + * bits 8-57: swap offset ++ * bit 58: PTE_PROT_NONE (must be zero) + */ + #define __SWP_TYPE_SHIFT 2 + #define __SWP_TYPE_BITS 6 +diff --git a/arch/ia64/include/asm/io.h b/arch/ia64/include/asm/io.h +index a865d2a04f75..5de673ac9cb1 100644 +--- a/arch/ia64/include/asm/io.h ++++ b/arch/ia64/include/asm/io.h +@@ -433,6 +433,7 @@ static inline void __iomem * ioremap_cache (unsigned long phys_addr, unsigned lo + return ioremap(phys_addr, size); + } + #define ioremap_cache ioremap_cache ++#define ioremap_uc ioremap_nocache + + + /* +diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h +index c873e682b67f..2b2ced9dc00a 100644 +--- a/arch/s390/include/asm/pci.h ++++ b/arch/s390/include/asm/pci.h +@@ -45,7 +45,7 @@ struct zpci_fmb { + u64 rpcit_ops; + u64 dma_rbytes; + u64 dma_wbytes; +-} __packed __aligned(16); ++} __packed __aligned(64); + + enum zpci_state { + ZPCI_FN_STATE_RESERVED, +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index cd5a191381b9..c920b81be5bb 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -1199,114 +1199,12 @@ cleanup_critical: + .quad .Lpsw_idle_lpsw + + .Lcleanup_save_fpu_regs: +- TSTMSK __LC_CPU_FLAGS,_CIF_FPU +- bor %r14 +- clg %r9,BASED(.Lcleanup_save_fpu_regs_done) +- jhe 5f +- clg %r9,BASED(.Lcleanup_save_fpu_regs_fp) +- jhe 4f +- clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_high) +- jhe 3f +- clg %r9,BASED(.Lcleanup_save_fpu_regs_vx_low) +- jhe 2f +- clg %r9,BASED(.Lcleanup_save_fpu_fpc_end) +- jhe 1f +- lg %r2,__LC_CURRENT +- aghi %r2,__TASK_thread +-0: # Store floating-point controls +- stfpc __THREAD_FPU_fpc(%r2) +-1: # Load register save area and check if VX is active +- lg %r3,__THREAD_FPU_regs(%r2) +- TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX +- jz 4f # no VX -> store FP regs +-2: # Store vector registers (V0-V15) +- VSTM %v0,%v15,0,%r3 # vstm 0,15,0(3) +-3: # Store vector registers (V16-V31) +- VSTM %v16,%v31,256,%r3 # vstm 16,31,256(3) +- j 5f # -> done, set CIF_FPU flag +-4: # Store floating-point registers +- std 0,0(%r3) +- std 1,8(%r3) +- std 2,16(%r3) +- std 3,24(%r3) +- std 4,32(%r3) +- std 5,40(%r3) +- std 6,48(%r3) +- std 7,56(%r3) +- std 8,64(%r3) +- std 9,72(%r3) +- std 10,80(%r3) +- std 11,88(%r3) +- std 12,96(%r3) +- std 13,104(%r3) +- std 14,112(%r3) +- std 15,120(%r3) +-5: # Set CIF_FPU flag +- oi __LC_CPU_FLAGS+7,_CIF_FPU +- lg %r9,48(%r11) # return from save_fpu_regs ++ larl %r9,save_fpu_regs + br %r14 +-.Lcleanup_save_fpu_fpc_end: +- .quad .Lsave_fpu_regs_fpc_end +-.Lcleanup_save_fpu_regs_vx_low: +- .quad .Lsave_fpu_regs_vx_low +-.Lcleanup_save_fpu_regs_vx_high: +- .quad .Lsave_fpu_regs_vx_high +-.Lcleanup_save_fpu_regs_fp: +- .quad .Lsave_fpu_regs_fp +-.Lcleanup_save_fpu_regs_done: +- .quad .Lsave_fpu_regs_done + + .Lcleanup_load_fpu_regs: +- TSTMSK __LC_CPU_FLAGS,_CIF_FPU +- bnor %r14 +- clg %r9,BASED(.Lcleanup_load_fpu_regs_done) +- jhe 1f +- clg %r9,BASED(.Lcleanup_load_fpu_regs_fp) +- jhe 2f +- clg %r9,BASED(.Lcleanup_load_fpu_regs_vx_high) +- jhe 3f +- clg %r9,BASED(.Lcleanup_load_fpu_regs_vx) +- jhe 4f +- lg %r4,__LC_CURRENT +- aghi %r4,__TASK_thread +- lfpc __THREAD_FPU_fpc(%r4) +- TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX +- lg %r4,__THREAD_FPU_regs(%r4) # %r4 <- reg save area +- jz 2f # -> no VX, load FP regs +-4: # Load V0 ..V15 registers +- VLM %v0,%v15,0,%r4 +-3: # Load V16..V31 registers +- VLM %v16,%v31,256,%r4 +- j 1f +-2: # Load floating-point registers +- ld 0,0(%r4) +- ld 1,8(%r4) +- ld 2,16(%r4) +- ld 3,24(%r4) +- ld 4,32(%r4) +- ld 5,40(%r4) +- ld 6,48(%r4) +- ld 7,56(%r4) +- ld 8,64(%r4) +- ld 9,72(%r4) +- ld 10,80(%r4) +- ld 11,88(%r4) +- ld 12,96(%r4) +- ld 13,104(%r4) +- ld 14,112(%r4) +- ld 15,120(%r4) +-1: # Clear CIF_FPU bit +- ni __LC_CPU_FLAGS+7,255-_CIF_FPU +- lg %r9,48(%r11) # return from load_fpu_regs ++ larl %r9,load_fpu_regs + br %r14 +-.Lcleanup_load_fpu_regs_vx: +- .quad .Lload_fpu_regs_vx +-.Lcleanup_load_fpu_regs_vx_high: +- .quad .Lload_fpu_regs_vx_high +-.Lcleanup_load_fpu_regs_fp: +- .quad .Lload_fpu_regs_fp +-.Lcleanup_load_fpu_regs_done: +- .quad .Lload_fpu_regs_done + + /* + * Integer constants +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 9220db5c996a..93fc63ef6e95 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -327,6 +327,7 @@ static void __init setup_lowcore(void) + + PAGE_SIZE - STACK_FRAME_OVERHEAD - sizeof(struct pt_regs); + lc->current_task = (unsigned long) init_thread_union.thread_info.task; + lc->thread_info = (unsigned long) &init_thread_union; ++ lc->lpp = LPP_MAGIC; + lc->machine_flags = S390_lowcore.machine_flags; + lc->stfl_fac_list = S390_lowcore.stfl_fac_list; + memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list, +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index 8f19c8f9d660..8f75edc998ff 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -864,8 +864,11 @@ static inline int barsize(u8 size) + + static int zpci_mem_init(void) + { ++ BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) || ++ __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb)); ++ + zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct zpci_fmb), +- 16, 0, NULL); ++ __alignof__(struct zpci_fmb), 0, NULL); + if (!zdev_fmb_cache) + goto error_fmb; + +diff --git a/arch/sh/mm/kmap.c b/arch/sh/mm/kmap.c +index ec29e14ec5a8..bf25d7c79a2d 100644 +--- a/arch/sh/mm/kmap.c ++++ b/arch/sh/mm/kmap.c +@@ -36,6 +36,7 @@ void *kmap_coherent(struct page *page, unsigned long addr) + + BUG_ON(!test_bit(PG_dcache_clean, &page->flags)); + ++ preempt_disable(); + pagefault_disable(); + + idx = FIX_CMAP_END - +@@ -64,4 +65,5 @@ void kunmap_coherent(void *kvaddr) + } + + pagefault_enable(); ++ preempt_enable(); + } +diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c +index b821b13d343a..8a6b57108ac2 100644 +--- a/arch/um/drivers/mconsole_kern.c ++++ b/arch/um/drivers/mconsole_kern.c +@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req) + ptr += strlen("proc"); + ptr = skip_spaces(ptr); + +- file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY); ++ file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0); + if (IS_ERR(file)) { + mconsole_reply(req, "Failed to open file", 1, 0); + printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file)); +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index c46662f64c39..3bf45a0cd69e 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1160,22 +1160,23 @@ config MICROCODE + bool "CPU microcode loading support" + default y + depends on CPU_SUP_AMD || CPU_SUP_INTEL +- depends on BLK_DEV_INITRD + select FW_LOADER + ---help--- +- + If you say Y here, you will be able to update the microcode on +- certain Intel and AMD processors. The Intel support is for the +- IA32 family, e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, +- Xeon etc. The AMD support is for families 0x10 and later. You will +- obviously need the actual microcode binary data itself which is not +- shipped with the Linux kernel. +- +- This option selects the general module only, you need to select +- at least one vendor specific module as well. +- +- To compile this driver as a module, choose M here: the module +- will be called microcode. ++ Intel and AMD processors. The Intel support is for the IA32 family, ++ e.g. Pentium Pro, Pentium II, Pentium III, Pentium 4, Xeon etc. The ++ AMD support is for families 0x10 and later. You will obviously need ++ the actual microcode binary data itself which is not shipped with ++ the Linux kernel. ++ ++ The preferred method to load microcode from a detached initrd is described ++ in Documentation/x86/early-microcode.txt. For that you need to enable ++ CONFIG_BLK_DEV_INITRD in order for the loader to be able to scan the ++ initrd for microcode blobs. ++ ++ In addition, you can build-in the microcode into the kernel. For that you ++ need to enable FIRMWARE_IN_KERNEL and add the vendor-supplied microcode ++ to the CONFIG_EXTRA_FIRMWARE config option. + + config MICROCODE_INTEL + bool "Intel microcode loading support" +diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c +index 03663740c866..1a4477cedc49 100644 +--- a/arch/x86/entry/common.c ++++ b/arch/x86/entry/common.c +@@ -268,6 +268,7 @@ static void exit_to_usermode_loop(struct pt_regs *regs, u32 cached_flags) + /* Called with IRQs disabled. */ + __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) + { ++ struct thread_info *ti = pt_regs_to_thread_info(regs); + u32 cached_flags; + + if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled())) +@@ -275,12 +276,22 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) + + lockdep_sys_exit(); + +- cached_flags = +- READ_ONCE(pt_regs_to_thread_info(regs)->flags); ++ cached_flags = READ_ONCE(ti->flags); + + if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS)) + exit_to_usermode_loop(regs, cached_flags); + ++#ifdef CONFIG_COMPAT ++ /* ++ * Compat syscalls set TS_COMPAT. Make sure we clear it before ++ * returning to user mode. We need to clear it *after* signal ++ * handling, because syscall restart has a fixup for compat ++ * syscalls. The fixup is exercised by the ptrace_syscall_32 ++ * selftest. ++ */ ++ ti->status &= ~TS_COMPAT; ++#endif ++ + user_enter(); + } + +@@ -332,14 +343,6 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs) + if (unlikely(cached_flags & SYSCALL_EXIT_WORK_FLAGS)) + syscall_slow_exit_work(regs, cached_flags); + +-#ifdef CONFIG_COMPAT +- /* +- * Compat syscalls set TS_COMPAT. Make sure we clear it before +- * returning to user mode. +- */ +- ti->status &= ~TS_COMPAT; +-#endif +- + local_irq_disable(); + prepare_exit_to_usermode(regs); + } +diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h +index c80f6b6f3da2..e8c4fba52d3d 100644 +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -644,8 +644,8 @@ static inline void entering_irq(void) + + static inline void entering_ack_irq(void) + { +- ack_APIC_irq(); + entering_irq(); ++ ack_APIC_irq(); + } + + static inline void ipi_entering_ack_irq(void) +diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h +index 1815b736269d..84b3d194a958 100644 +--- a/arch/x86/include/asm/hw_irq.h ++++ b/arch/x86/include/asm/hw_irq.h +@@ -141,6 +141,7 @@ struct irq_alloc_info { + struct irq_cfg { + unsigned int dest_apicid; + u8 vector; ++ u8 old_vector; + }; + + extern struct irq_cfg *irq_cfg(unsigned int irq); +diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h +index 1e1b07a5a738..9d3a96c4da78 100644 +--- a/arch/x86/include/asm/microcode.h ++++ b/arch/x86/include/asm/microcode.h +@@ -3,6 +3,7 @@ + + #include <asm/cpu.h> + #include <linux/earlycpio.h> ++#include <linux/initrd.h> + + #define native_rdmsr(msr, val1, val2) \ + do { \ +@@ -143,4 +144,29 @@ static inline void reload_early_microcode(void) { } + static inline bool + get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; } + #endif ++ ++static inline unsigned long get_initrd_start(void) ++{ ++#ifdef CONFIG_BLK_DEV_INITRD ++ return initrd_start; ++#else ++ return 0; ++#endif ++} ++ ++static inline unsigned long get_initrd_start_addr(void) ++{ ++#ifdef CONFIG_BLK_DEV_INITRD ++#ifdef CONFIG_X86_32 ++ unsigned long *initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start); ++ ++ return (unsigned long)__pa_nodebug(*initrd_start_p); ++#else ++ return get_initrd_start(); ++#endif ++#else /* CONFIG_BLK_DEV_INITRD */ ++ return 0; ++#endif ++} ++ + #endif /* _ASM_X86_MICROCODE_H */ +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index 7bcb861a04e5..5a2ed3ed2f26 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -165,6 +165,7 @@ struct x86_pmu_capability { + #define GLOBAL_STATUS_ASIF BIT_ULL(60) + #define GLOBAL_STATUS_COUNTERS_FROZEN BIT_ULL(59) + #define GLOBAL_STATUS_LBRS_FROZEN BIT_ULL(58) ++#define GLOBAL_STATUS_TRACE_TOPAPMI BIT_ULL(55) + + /* + * IBS cpuid feature detection +diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h +index 8b2d4bea9962..39171b3646bb 100644 +--- a/arch/x86/include/asm/xen/hypervisor.h ++++ b/arch/x86/include/asm/xen/hypervisor.h +@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num); + void xen_arch_unregister_cpu(int num); + #endif + ++extern void xen_set_iopl_mask(unsigned mask); ++ + #endif /* _ASM_X86_XEN_HYPERVISOR_H */ +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 3b670df4ba7b..ad59d70bcb1a 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -213,6 +213,7 @@ update: + */ + cpumask_and(d->old_domain, d->old_domain, cpu_online_mask); + d->move_in_progress = !cpumask_empty(d->old_domain); ++ d->cfg.old_vector = d->move_in_progress ? d->cfg.vector : 0; + d->cfg.vector = vector; + cpumask_copy(d->domain, vector_cpumask); + success: +@@ -655,46 +656,97 @@ void irq_complete_move(struct irq_cfg *cfg) + } + + /* +- * Called with @desc->lock held and interrupts disabled. ++ * Called from fixup_irqs() with @desc->lock held and interrupts disabled. + */ + void irq_force_complete_move(struct irq_desc *desc) + { + struct irq_data *irqdata = irq_desc_get_irq_data(desc); + struct apic_chip_data *data = apic_chip_data(irqdata); + struct irq_cfg *cfg = data ? &data->cfg : NULL; ++ unsigned int cpu; + + if (!cfg) + return; + +- __irq_complete_move(cfg, cfg->vector); +- + /* + * This is tricky. If the cleanup of @data->old_domain has not been + * done yet, then the following setaffinity call will fail with + * -EBUSY. This can leave the interrupt in a stale state. + * +- * The cleanup cannot make progress because we hold @desc->lock. So in +- * case @data->old_domain is not yet cleaned up, we need to drop the +- * lock and acquire it again. @desc cannot go away, because the +- * hotplug code holds the sparse irq lock. ++ * All CPUs are stuck in stop machine with interrupts disabled so ++ * calling __irq_complete_move() would be completely pointless. + */ + raw_spin_lock(&vector_lock); +- /* Clean out all offline cpus (including ourself) first. */ ++ /* ++ * Clean out all offline cpus (including the outgoing one) from the ++ * old_domain mask. ++ */ + cpumask_and(data->old_domain, data->old_domain, cpu_online_mask); +- while (!cpumask_empty(data->old_domain)) { ++ ++ /* ++ * If move_in_progress is cleared and the old_domain mask is empty, ++ * then there is nothing to cleanup. fixup_irqs() will take care of ++ * the stale vectors on the outgoing cpu. ++ */ ++ if (!data->move_in_progress && cpumask_empty(data->old_domain)) { + raw_spin_unlock(&vector_lock); +- raw_spin_unlock(&desc->lock); +- cpu_relax(); +- raw_spin_lock(&desc->lock); ++ return; ++ } ++ ++ /* ++ * 1) The interrupt is in move_in_progress state. That means that we ++ * have not seen an interrupt since the io_apic was reprogrammed to ++ * the new vector. ++ * ++ * 2) The interrupt has fired on the new vector, but the cleanup IPIs ++ * have not been processed yet. ++ */ ++ if (data->move_in_progress) { + /* +- * Reevaluate apic_chip_data. It might have been cleared after +- * we dropped @desc->lock. ++ * In theory there is a race: ++ * ++ * set_ioapic(new_vector) <-- Interrupt is raised before update ++ * is effective, i.e. it's raised on ++ * the old vector. ++ * ++ * So if the target cpu cannot handle that interrupt before ++ * the old vector is cleaned up, we get a spurious interrupt ++ * and in the worst case the ioapic irq line becomes stale. ++ * ++ * But in case of cpu hotplug this should be a non issue ++ * because if the affinity update happens right before all ++ * cpus rendevouz in stop machine, there is no way that the ++ * interrupt can be blocked on the target cpu because all cpus ++ * loops first with interrupts enabled in stop machine, so the ++ * old vector is not yet cleaned up when the interrupt fires. ++ * ++ * So the only way to run into this issue is if the delivery ++ * of the interrupt on the apic/system bus would be delayed ++ * beyond the point where the target cpu disables interrupts ++ * in stop machine. I doubt that it can happen, but at least ++ * there is a theroretical chance. Virtualization might be ++ * able to expose this, but AFAICT the IOAPIC emulation is not ++ * as stupid as the real hardware. ++ * ++ * Anyway, there is nothing we can do about that at this point ++ * w/o refactoring the whole fixup_irq() business completely. ++ * We print at least the irq number and the old vector number, ++ * so we have the necessary information when a problem in that ++ * area arises. + */ +- data = apic_chip_data(irqdata); +- if (!data) +- return; +- raw_spin_lock(&vector_lock); ++ pr_warn("IRQ fixup: irq %d move in progress, old vector %d\n", ++ irqdata->irq, cfg->old_vector); + } ++ /* ++ * If old_domain is not empty, then other cpus still have the irq ++ * descriptor set in their vector array. Clean it up. ++ */ ++ for_each_cpu(cpu, data->old_domain) ++ per_cpu(vector_irq, cpu)[cfg->old_vector] = VECTOR_UNUSED; ++ ++ /* Cleanup the left overs of the (half finished) move */ ++ cpumask_clear(data->old_domain); ++ data->move_in_progress = 0; + raw_spin_unlock(&vector_lock); + } + #endif +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index ee81c544ee0d..4f4735bd8698 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -551,10 +551,14 @@ scan_microcode(struct mc_saved_data *mc_saved_data, unsigned long *initrd, + cd.data = NULL; + cd.size = 0; + +- cd = find_cpio_data(p, (void *)start, size, &offset); +- if (!cd.data) { ++ /* try built-in microcode if no initrd */ ++ if (!size) { + if (!load_builtin_intel_microcode(&cd)) + return UCODE_ERROR; ++ } else { ++ cd = find_cpio_data(p, (void *)start, size, &offset); ++ if (!cd.data) ++ return UCODE_ERROR; + } + + return get_matching_model_microcode(0, start, cd.data, cd.size, +@@ -690,7 +694,7 @@ int __init save_microcode_in_initrd_intel(void) + if (count == 0) + return ret; + +- copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, initrd_start, count); ++ copy_initrd_ptrs(mc_saved, mc_saved_in_initrd, get_initrd_start(), count); + ret = save_microcode(&mc_saved_data, mc_saved, count); + if (ret) + pr_err("Cannot save microcode patches from initrd.\n"); +@@ -728,16 +732,20 @@ void __init load_ucode_intel_bsp(void) + struct boot_params *p; + + p = (struct boot_params *)__pa_nodebug(&boot_params); +- start = p->hdr.ramdisk_image; + size = p->hdr.ramdisk_size; + +- _load_ucode_intel_bsp( +- (struct mc_saved_data *)__pa_nodebug(&mc_saved_data), +- (unsigned long *)__pa_nodebug(&mc_saved_in_initrd), +- start, size); ++ /* ++ * Set start only if we have an initrd image. We cannot use initrd_start ++ * because it is not set that early yet. ++ */ ++ start = (size ? p->hdr.ramdisk_image : 0); ++ ++ _load_ucode_intel_bsp((struct mc_saved_data *)__pa_nodebug(&mc_saved_data), ++ (unsigned long *)__pa_nodebug(&mc_saved_in_initrd), ++ start, size); + #else +- start = boot_params.hdr.ramdisk_image + PAGE_OFFSET; + size = boot_params.hdr.ramdisk_size; ++ start = (size ? boot_params.hdr.ramdisk_image + PAGE_OFFSET : 0); + + _load_ucode_intel_bsp(&mc_saved_data, mc_saved_in_initrd, start, size); + #endif +@@ -748,20 +756,14 @@ void load_ucode_intel_ap(void) + struct mc_saved_data *mc_saved_data_p; + struct ucode_cpu_info uci; + unsigned long *mc_saved_in_initrd_p; +- unsigned long initrd_start_addr; + enum ucode_state ret; + #ifdef CONFIG_X86_32 +- unsigned long *initrd_start_p; + +- mc_saved_in_initrd_p = +- (unsigned long *)__pa_nodebug(mc_saved_in_initrd); ++ mc_saved_in_initrd_p = (unsigned long *)__pa_nodebug(mc_saved_in_initrd); + mc_saved_data_p = (struct mc_saved_data *)__pa_nodebug(&mc_saved_data); +- initrd_start_p = (unsigned long *)__pa_nodebug(&initrd_start); +- initrd_start_addr = (unsigned long)__pa_nodebug(*initrd_start_p); + #else +- mc_saved_data_p = &mc_saved_data; + mc_saved_in_initrd_p = mc_saved_in_initrd; +- initrd_start_addr = initrd_start; ++ mc_saved_data_p = &mc_saved_data; + #endif + + /* +@@ -773,7 +775,7 @@ void load_ucode_intel_ap(void) + + collect_cpu_info_early(&uci); + ret = load_microcode(mc_saved_data_p, mc_saved_in_initrd_p, +- initrd_start_addr, &uci); ++ get_initrd_start_addr(), &uci); + + if (ret != UCODE_OK) + return; +diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c +index 1b443db2db50..6532f5b40646 100644 +--- a/arch/x86/kernel/cpu/perf_event.c ++++ b/arch/x86/kernel/cpu/perf_event.c +@@ -596,6 +596,19 @@ void x86_pmu_disable_all(void) + } + } + ++/* ++ * There may be PMI landing after enabled=0. The PMI hitting could be before or ++ * after disable_all. ++ * ++ * If PMI hits before disable_all, the PMU will be disabled in the NMI handler. ++ * It will not be re-enabled in the NMI handler again, because enabled=0. After ++ * handling the NMI, disable_all will be called, which will not change the ++ * state either. If PMI hits after disable_all, the PMU is already disabled ++ * before entering NMI handler. The NMI handler will not change the state ++ * either. ++ * ++ * So either situation is harmless. ++ */ + static void x86_pmu_disable(struct pmu *pmu) + { + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); +diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h +index 7bb61e32fb29..98be6d6d32fa 100644 +--- a/arch/x86/kernel/cpu/perf_event.h ++++ b/arch/x86/kernel/cpu/perf_event.h +@@ -586,6 +586,7 @@ struct x86_pmu { + pebs_broken :1, + pebs_prec_dist :1; + int pebs_record_size; ++ int pebs_buffer_size; + void (*drain_pebs)(struct pt_regs *regs); + struct event_constraint *pebs_constraints; + void (*pebs_aliases)(struct perf_event *event); +@@ -904,6 +905,8 @@ void intel_pmu_lbr_init_skl(void); + + void intel_pmu_lbr_init_knl(void); + ++void intel_pmu_pebs_data_source_nhm(void); ++ + int intel_pmu_setup_lbr_filter(struct perf_event *event); + + void intel_pt_interrupt(void); +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index fed2ab1f1065..760aec1e8f82 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -1502,7 +1502,15 @@ static __initconst const u64 knl_hw_cache_extra_regs + }; + + /* +- * Use from PMIs where the LBRs are already disabled. ++ * Used from PMIs where the LBRs are already disabled. ++ * ++ * This function could be called consecutively. It is required to remain in ++ * disabled state if called consecutively. ++ * ++ * During consecutive calls, the same disable value will be written to related ++ * registers, so the PMU state remains unchanged. hw.state in ++ * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive ++ * calls. + */ + static void __intel_pmu_disable_all(void) + { +@@ -1884,6 +1892,16 @@ again: + if (__test_and_clear_bit(62, (unsigned long *)&status)) { + handled++; + x86_pmu.drain_pebs(regs); ++ /* ++ * There are cases where, even though, the PEBS ovfl bit is set ++ * in GLOBAL_OVF_STATUS, the PEBS events may also have their ++ * overflow bits set for their counters. We must clear them ++ * here because they have been processed as exact samples in ++ * the drain_pebs() routine. They must not be processed again ++ * in the for_each_bit_set() loop for regular samples below. ++ */ ++ status &= ~cpuc->pebs_enabled; ++ status &= x86_pmu.intel_ctrl | GLOBAL_STATUS_TRACE_TOPAPMI; + } + + /* +@@ -1929,7 +1947,10 @@ again: + goto again; + + done: +- __intel_pmu_enable_all(0, true); ++ /* Only restore PMU state when it's active. See x86_pmu_disable(). */ ++ if (cpuc->enabled) ++ __intel_pmu_enable_all(0, true); ++ + /* + * Only unmask the NMI after the overflow counters + * have been reset. This avoids spurious NMIs on +@@ -3396,6 +3417,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + x86_add_quirk(intel_nehalem_quirk); + + pr_cont("Nehalem events, "); +@@ -3459,6 +3481,7 @@ __init int intel_pmu_init(void) + intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = + X86_CONFIG(.event=0xb1, .umask=0x3f, .inv=1, .cmask=1); + ++ intel_pmu_pebs_data_source_nhm(); + pr_cont("Westmere events, "); + break; + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c +index 10602f0a438f..955140140fd4 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -51,7 +51,8 @@ union intel_x86_pebs_dse { + #define OP_LH (P(OP, LOAD) | P(LVL, HIT)) + #define SNOOP_NONE_MISS (P(SNOOP, NONE) | P(SNOOP, MISS)) + +-static const u64 pebs_data_source[] = { ++/* Version for Sandy Bridge and later */ ++static u64 pebs_data_source[] = { + P(OP, LOAD) | P(LVL, MISS) | P(LVL, L3) | P(SNOOP, NA),/* 0x00:ukn L3 */ + OP_LH | P(LVL, L1) | P(SNOOP, NONE), /* 0x01: L1 local */ + OP_LH | P(LVL, LFB) | P(SNOOP, NONE), /* 0x02: LFB hit */ +@@ -70,6 +71,14 @@ static const u64 pebs_data_source[] = { + OP_LH | P(LVL, UNC) | P(SNOOP, NONE), /* 0x0f: uncached */ + }; + ++/* Patch up minor differences in the bits */ ++void __init intel_pmu_pebs_data_source_nhm(void) ++{ ++ pebs_data_source[0x05] = OP_LH | P(LVL, L3) | P(SNOOP, HIT); ++ pebs_data_source[0x06] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++ pebs_data_source[0x07] = OP_LH | P(LVL, L3) | P(SNOOP, HITM); ++} ++ + static u64 precise_store_data(u64 status) + { + union intel_x86_pebs_dse dse; +@@ -269,7 +278,7 @@ static int alloc_pebs_buffer(int cpu) + if (!x86_pmu.pebs) + return 0; + +- buffer = kzalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL, node); ++ buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node); + if (unlikely(!buffer)) + return -ENOMEM; + +@@ -286,7 +295,7 @@ static int alloc_pebs_buffer(int cpu) + per_cpu(insn_buffer, cpu) = ibuffer; + } + +- max = PEBS_BUFFER_SIZE / x86_pmu.pebs_record_size; ++ max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size; + + ds->pebs_buffer_base = (u64)(unsigned long)buffer; + ds->pebs_index = ds->pebs_buffer_base; +@@ -1319,6 +1328,7 @@ void __init intel_ds_init(void) + + x86_pmu.bts = boot_cpu_has(X86_FEATURE_BTS); + x86_pmu.pebs = boot_cpu_has(X86_FEATURE_PEBS); ++ x86_pmu.pebs_buffer_size = PEBS_BUFFER_SIZE; + if (x86_pmu.pebs) { + char pebs_type = x86_pmu.intel_cap.pebs_trap ? '+' : '-'; + int format = x86_pmu.intel_cap.pebs_format; +@@ -1327,6 +1337,14 @@ void __init intel_ds_init(void) + case 0: + printk(KERN_CONT "PEBS fmt0%c, ", pebs_type); + x86_pmu.pebs_record_size = sizeof(struct pebs_record_core); ++ /* ++ * Using >PAGE_SIZE buffers makes the WRMSR to ++ * PERF_GLOBAL_CTRL in intel_pmu_enable_all() ++ * mysteriously hang on Core2. ++ * ++ * As a workaround, we don't do this. ++ */ ++ x86_pmu.pebs_buffer_size = PAGE_SIZE; + x86_pmu.drain_pebs = intel_pmu_drain_pebs_core; + break; + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c +index 33acb884ccf1..4547b2cca71b 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c +@@ -2875,11 +2875,13 @@ static struct intel_uncore_type bdx_uncore_sbox = { + .format_group = &hswep_uncore_sbox_format_group, + }; + ++#define BDX_MSR_UNCORE_SBOX 3 ++ + static struct intel_uncore_type *bdx_msr_uncores[] = { + &bdx_uncore_ubox, + &bdx_uncore_cbox, +- &bdx_uncore_sbox, + &hswep_uncore_pcu, ++ &bdx_uncore_sbox, + NULL, + }; + +@@ -2888,6 +2890,10 @@ void bdx_uncore_cpu_init(void) + if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores) + bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores; + uncore_msr_uncores = bdx_msr_uncores; ++ ++ /* BDX-DE doesn't have SBOX */ ++ if (boot_cpu_data.x86_model == 86) ++ uncore_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL; + } + + static struct intel_uncore_type bdx_uncore_ha = { +diff --git a/arch/x86/kernel/cpu/perf_event_knc.c b/arch/x86/kernel/cpu/perf_event_knc.c +index 5b0c232d1ee6..b931095e86d4 100644 +--- a/arch/x86/kernel/cpu/perf_event_knc.c ++++ b/arch/x86/kernel/cpu/perf_event_knc.c +@@ -263,7 +263,9 @@ again: + goto again; + + done: +- knc_pmu_enable_all(0); ++ /* Only restore PMU state when it's active. See x86_pmu_disable(). */ ++ if (cpuc->enabled) ++ knc_pmu_enable_all(0); + + return handled; + } +diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c +index 37dae792dbbe..589b3193f102 100644 +--- a/arch/x86/kernel/ioport.c ++++ b/arch/x86/kernel/ioport.c +@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) + SYSCALL_DEFINE1(iopl, unsigned int, level) + { + struct pt_regs *regs = current_pt_regs(); +- unsigned int old = (regs->flags >> 12) & 3; + struct thread_struct *t = ¤t->thread; + ++ /* ++ * Careful: the IOPL bits in regs->flags are undefined under Xen PV ++ * and changing them has no effect. ++ */ ++ unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT; ++ + if (level > 3) + return -EINVAL; + /* Trying to gain more privileges? */ +@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) + if (!capable(CAP_SYS_RAWIO)) + return -EPERM; + } +- regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12); +- t->iopl = level << 12; ++ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | ++ (level << X86_EFLAGS_IOPL_BIT); ++ t->iopl = level << X86_EFLAGS_IOPL_BIT; + set_iopl_mask(t->iopl); + + return 0; +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index b9d99e0f82c4..9f751876066f 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -48,6 +48,7 @@ + #include <asm/syscalls.h> + #include <asm/debugreg.h> + #include <asm/switch_to.h> ++#include <asm/xen/hypervisor.h> + + asmlinkage extern void ret_from_fork(void); + +@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV)) + __switch_to_xtra(prev_p, next_p, tss); + ++#ifdef CONFIG_XEN ++ /* ++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and ++ * current_pt_regs()->flags may not match the current task's ++ * intended IOPL. We need to switch it manually. ++ */ ++ if (unlikely(static_cpu_has(X86_FEATURE_XENPV) && ++ prev->iopl != next->iopl)) ++ xen_set_iopl_mask(next->iopl); ++#endif ++ + if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) { + /* + * AMD CPUs have a misfeature: SYSRET sets the SS selector but +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index b0ea42b78ccd..ab5318727579 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -245,7 +245,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian) + * PIC is being reset. Handle it gracefully here + */ + atomic_inc(&ps->pending); +- else if (value > 0) ++ else if (value > 0 && ps->reinject) + /* in this case, we had multiple outstanding pit interrupts + * that we needed to inject. Reinject + */ +@@ -288,7 +288,9 @@ static void pit_do_work(struct kthread_work *work) + * last one has been acked. + */ + spin_lock(&ps->inject_lock); +- if (ps->irq_ack) { ++ if (!ps->reinject) ++ inject = 1; ++ else if (ps->irq_ack) { + ps->irq_ack = 0; + inject = 1; + } +@@ -317,10 +319,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data) + struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer); + struct kvm_pit *pt = ps->kvm->arch.vpit; + +- if (ps->reinject || !atomic_read(&ps->pending)) { ++ if (ps->reinject) + atomic_inc(&ps->pending); +- queue_kthread_work(&pt->worker, &pt->expired); +- } ++ ++ queue_kthread_work(&pt->worker, &pt->expired); + + if (ps->is_periodic) { + hrtimer_add_expires_ns(&ps->timer, ps->period); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 9bd8f44baded..539062e24de1 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2702,8 +2702,15 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) + } else + vmx->nested.nested_vmx_ept_caps = 0; + ++ /* ++ * Old versions of KVM use the single-context version without ++ * checking for support, so declare that it is supported even ++ * though it is treated as global context. The alternative is ++ * not failing the single-context invvpid, and it is worse. ++ */ + if (enable_vpid) + vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT | ++ VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | + VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT; + else + vmx->nested.nested_vmx_vpid_caps = 0; +@@ -7398,6 +7405,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) + if (!(types & (1UL << type))) { + nested_vmx_failValid(vcpu, + VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); ++ skip_emulated_instruction(vcpu); + return 1; + } + +@@ -7456,6 +7464,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) + if (!(types & (1UL << type))) { + nested_vmx_failValid(vcpu, + VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); ++ skip_emulated_instruction(vcpu); + return 1; + } + +@@ -7472,12 +7481,17 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) + } + + switch (type) { ++ case VMX_VPID_EXTENT_SINGLE_CONTEXT: ++ /* ++ * Old versions of KVM use the single-context version so we ++ * have to support it; just treat it the same as all-context. ++ */ + case VMX_VPID_EXTENT_ALL_CONTEXT: + __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02); + nested_vmx_succeed(vcpu); + break; + default: +- /* Trap single context invalidation invvpid calls */ ++ /* Trap individual address invalidation invvpid calls */ + BUG_ON(1); + break; + } +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index eaf6ee8c28b8..d47d231e0d4b 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2752,6 +2752,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + } + + kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); ++ vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD; + } + + void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c +index 8f4cc3dfac32..5fb6adaaa796 100644 +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -106,8 +106,6 @@ static void flush_tlb_func(void *info) + + if (f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm)) + return; +- if (!f->flush_end) +- f->flush_end = f->flush_start + PAGE_SIZE; + + count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); + if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) { +@@ -135,12 +133,20 @@ void native_flush_tlb_others(const struct cpumask *cpumask, + unsigned long end) + { + struct flush_tlb_info info; ++ ++ if (end == 0) ++ end = start + PAGE_SIZE; + info.flush_mm = mm; + info.flush_start = start; + info.flush_end = end; + + count_vm_tlb_event(NR_TLB_REMOTE_FLUSH); +- trace_tlb_flush(TLB_REMOTE_SEND_IPI, end - start); ++ if (end == TLB_FLUSH_ALL) ++ trace_tlb_flush(TLB_REMOTE_SEND_IPI, TLB_FLUSH_ALL); ++ else ++ trace_tlb_flush(TLB_REMOTE_SEND_IPI, ++ (end - start) >> PAGE_SHIFT); ++ + if (is_uv_system()) { + unsigned int cpu; + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index e58565556703..0ae7e9fa348d 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -540,3 +540,10 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev) + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); ++ ++static void pci_bdwep_bar(struct pci_dev *dev) ++{ ++ dev->non_compliant_bars = 1; ++} ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar); +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index d09e4c9d7cc5..e3679db17545 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss, + tss->x86_tss.sp0 = thread->sp0; + } + +-static void xen_set_iopl_mask(unsigned mask) ++void xen_set_iopl_mask(unsigned mask) + { + struct physdev_set_iopl set_iopl; + +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 9ed55649ac8e..05e1df943856 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -128,7 +128,7 @@ ENTRY(_startup) + wsr a0, icountlevel + + .set _index, 0 +- .rept XCHAL_NUM_DBREAK - 1 ++ .rept XCHAL_NUM_DBREAK + wsr a0, SREG_DBREAKC + _index + .set _index, _index + 1 + .endr +diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c +index d75aa1476da7..1a804a2f9a5b 100644 +--- a/arch/xtensa/mm/cache.c ++++ b/arch/xtensa/mm/cache.c +@@ -97,11 +97,11 @@ void clear_user_highpage(struct page *page, unsigned long vaddr) + unsigned long paddr; + void *kvaddr = coherent_kvaddr(page, TLBTEMP_BASE_1, vaddr, &paddr); + +- pagefault_disable(); ++ preempt_disable(); + kmap_invalidate_coherent(page, vaddr); + set_bit(PG_arch_1, &page->flags); + clear_page_alias(kvaddr, paddr); +- pagefault_enable(); ++ preempt_enable(); + } + + void copy_user_highpage(struct page *dst, struct page *src, +@@ -113,11 +113,11 @@ void copy_user_highpage(struct page *dst, struct page *src, + void *src_vaddr = coherent_kvaddr(src, TLBTEMP_BASE_2, vaddr, + &src_paddr); + +- pagefault_disable(); ++ preempt_disable(); + kmap_invalidate_coherent(dst, vaddr); + set_bit(PG_arch_1, &dst->flags); + copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr); +- pagefault_enable(); ++ preempt_enable(); + } + + #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ +diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c +index 70cb408bc20d..92d785fefb6d 100644 +--- a/arch/xtensa/platforms/iss/console.c ++++ b/arch/xtensa/platforms/iss/console.c +@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv) + { + struct tty_port *port = (struct tty_port *)priv; + int i = 0; ++ int rd = 1; + unsigned char c; + + spin_lock(&timer_lock); + + while (simc_poll(0)) { +- simc_read(0, &c, 1); ++ rd = simc_read(0, &c, 1); ++ if (rd <= 0) ++ break; + tty_insert_flip_char(port, c, TTY_NORMAL); + i++; + } + + if (i) + tty_flip_buffer_push(port); +- +- +- mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); ++ if (rd) ++ mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); + spin_unlock(&timer_lock); + } + +diff --git a/block/blk-core.c b/block/blk-core.c +index b83d29755b5a..45f4d7efbf34 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -2198,7 +2198,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq) + if (q->mq_ops) { + if (blk_queue_io_stat(q)) + blk_account_io_start(rq, true); +- blk_mq_insert_request(rq, false, true, true); ++ blk_mq_insert_request(rq, false, true, false); + return 0; + } + +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 021d39c0ba75..13c4e5a5fe8c 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -494,7 +494,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen, + unsigned char tag, + const unsigned char *value, size_t vlen) + { +- static const unsigned char month_lengths[] = { 31, 29, 31, 30, 31, 30, ++ static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30, + 31, 31, 30, 31, 30, 31 }; + const unsigned char *p = value; + unsigned year, mon, day, hour, min, sec, mon_len; +@@ -540,9 +540,9 @@ int x509_decode_time(time64_t *_t, size_t hdrlen, + if (year % 4 == 0) { + mon_len = 29; + if (year % 100 == 0) { +- year /= 100; +- if (year % 4 != 0) +- mon_len = 28; ++ mon_len = 28; ++ if (year % 400 == 0) ++ mon_len = 29; + } + } + } +diff --git a/crypto/keywrap.c b/crypto/keywrap.c +index b1d106ce55f3..72014f963ba7 100644 +--- a/crypto/keywrap.c ++++ b/crypto/keywrap.c +@@ -212,7 +212,7 @@ static int crypto_kw_decrypt(struct blkcipher_desc *desc, + SEMIBSIZE)) + ret = -EBADMSG; + +- memzero_explicit(&block, sizeof(struct crypto_kw_block)); ++ memzero_explicit(block, sizeof(struct crypto_kw_block)); + + return ret; + } +@@ -297,7 +297,7 @@ static int crypto_kw_encrypt(struct blkcipher_desc *desc, + /* establish the IV for the caller to pick up */ + memcpy(desc->info, block->A, SEMIBSIZE); + +- memzero_explicit(&block, sizeof(struct crypto_kw_block)); ++ memzero_explicit(block, sizeof(struct crypto_kw_block)); + + return 0; + } +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index d02fd53042a5..56241eb341f4 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -27,8 +27,20 @@ + + #ifdef CONFIG_X86 + #define valid_IRQ(i) (((i) != 0) && ((i) != 2)) ++static inline bool acpi_iospace_resource_valid(struct resource *res) ++{ ++ /* On X86 IO space is limited to the [0 - 64K] IO port range */ ++ return res->end < 0x10003; ++} + #else + #define valid_IRQ(i) (true) ++/* ++ * ACPI IO descriptors on arches other than X86 contain MMIO CPU physical ++ * addresses mapping IO space in CPU physical address space, IO space ++ * resources can be placed anywhere in the 64-bit physical address space. ++ */ ++static inline bool ++acpi_iospace_resource_valid(struct resource *res) { return true; } + #endif + + static bool acpi_dev_resource_len_valid(u64 start, u64 end, u64 len, bool io) +@@ -127,7 +139,7 @@ static void acpi_dev_ioresource_flags(struct resource *res, u64 len, + if (!acpi_dev_resource_len_valid(res->start, res->end, len, true)) + res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET; + +- if (res->end >= 0x10003) ++ if (!acpi_iospace_resource_valid(res)) + res->flags |= IORESOURCE_DISABLED | IORESOURCE_UNSET; + + if (io_decode == ACPI_DECODE_16) +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 9cb975200cac..f054cadf30d8 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -714,6 +714,7 @@ static int acpi_hibernation_enter(void) + + static void acpi_hibernation_leave(void) + { ++ pm_set_resume_via_firmware(); + /* + * If ACPI is not enabled by the BIOS and the boot kernel, we need to + * enable it here. +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index cb27190e9f39..f7ecc287d733 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -341,7 +341,7 @@ static blk_qc_t brd_make_request(struct request_queue *q, struct bio *bio) + + if (unlikely(bio->bi_rw & REQ_DISCARD)) { + if (sector & ((PAGE_SIZE >> SECTOR_SHIFT) - 1) || +- bio->bi_iter.bi_size & PAGE_MASK) ++ bio->bi_iter.bi_size & ~PAGE_MASK) + goto io_error; + discard_from_brd(brd, sector, bio->bi_iter.bi_size); + goto out; +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 9b180dbbd03c..1c330b61f05d 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -173,7 +173,13 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + { + struct request *rq; + ++ if (mtip_check_surprise_removal(dd->pdev)) ++ return NULL; ++ + rq = blk_mq_alloc_request(dd->queue, 0, BLK_MQ_REQ_RESERVED); ++ if (IS_ERR(rq)) ++ return NULL; ++ + return blk_mq_rq_to_pdu(rq); + } + +@@ -233,15 +239,9 @@ static void mtip_async_complete(struct mtip_port *port, + "Command tag %d failed due to TFE\n", tag); + } + +- /* Unmap the DMA scatter list entries */ +- dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents, cmd->direction); +- + rq = mtip_rq_from_tag(dd, tag); + +- if (unlikely(cmd->unaligned)) +- up(&port->cmd_slot_unal); +- +- blk_mq_end_request(rq, status ? -EIO : 0); ++ blk_mq_complete_request(rq, status); + } + + /* +@@ -581,6 +581,8 @@ static void mtip_completion(struct mtip_port *port, + dev_warn(&port->dd->pdev->dev, + "Internal command %d completed with TFE\n", tag); + ++ command->comp_func = NULL; ++ command->comp_data = NULL; + complete(waiting); + } + +@@ -618,8 +620,6 @@ static void mtip_handle_tfe(struct driver_data *dd) + + port = dd->port; + +- set_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags); +- + if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) { + cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL); + dbg_printk(MTIP_DRV_NAME " TFE for the internal command\n"); +@@ -628,7 +628,7 @@ static void mtip_handle_tfe(struct driver_data *dd) + cmd->comp_func(port, MTIP_TAG_INTERNAL, + cmd, PORT_IRQ_TF_ERR); + } +- goto handle_tfe_exit; ++ return; + } + + /* clear the tag accumulator */ +@@ -701,7 +701,7 @@ static void mtip_handle_tfe(struct driver_data *dd) + fail_reason = "thermal shutdown"; + } + if (buf[288] == 0xBF) { +- set_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag); ++ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag); + dev_info(&dd->pdev->dev, + "Drive indicates rebuild has failed. Secure erase required.\n"); + fail_all_ncq_cmds = 1; +@@ -771,11 +771,6 @@ static void mtip_handle_tfe(struct driver_data *dd) + } + } + print_tags(dd, "reissued (TFE)", tagaccum, cmd_cnt); +- +-handle_tfe_exit: +- /* clear eh_active */ +- clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags); +- wake_up_interruptible(&port->svc_wait); + } + + /* +@@ -1007,6 +1002,7 @@ static bool mtip_pause_ncq(struct mtip_port *port, + (fis->features == 0x27 || fis->features == 0x72 || + fis->features == 0x62 || fis->features == 0x26))) { + clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag); ++ clear_bit(MTIP_DDF_REBUILD_FAILED_BIT, &port->dd->dd_flag); + /* Com reset after secure erase or lowlevel format */ + mtip_restart_port(port); + clear_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags); +@@ -1021,12 +1017,14 @@ static bool mtip_pause_ncq(struct mtip_port *port, + * + * @port Pointer to port data structure + * @timeout Max duration to wait (ms) ++ * @atomic gfp_t flag to indicate blockable context or not + * + * return value + * 0 Success + * -EBUSY Commands still active + */ +-static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout) ++static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout, ++ gfp_t atomic) + { + unsigned long to; + unsigned int n; +@@ -1037,16 +1035,21 @@ static int mtip_quiesce_io(struct mtip_port *port, unsigned long timeout) + to = jiffies + msecs_to_jiffies(timeout); + do { + if (test_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags) && +- test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) { ++ test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags) && ++ atomic == GFP_KERNEL) { + msleep(20); + continue; /* svc thd is actively issuing commands */ + } + +- msleep(100); ++ if (atomic == GFP_KERNEL) ++ msleep(100); ++ else { ++ cpu_relax(); ++ udelay(100); ++ } ++ + if (mtip_check_surprise_removal(port->dd->pdev)) + goto err_fault; +- if (test_bit(MTIP_DDF_REMOVE_PENDING_BIT, &port->dd->dd_flag)) +- goto err_fault; + + /* + * Ignore s_active bit 0 of array element 0. +@@ -1099,6 +1102,7 @@ static int mtip_exec_internal_command(struct mtip_port *port, + struct mtip_cmd *int_cmd; + struct driver_data *dd = port->dd; + int rv = 0; ++ unsigned long start; + + /* Make sure the buffer is 8 byte aligned. This is asic specific. */ + if (buffer & 0x00000007) { +@@ -1107,6 +1111,10 @@ static int mtip_exec_internal_command(struct mtip_port *port, + } + + int_cmd = mtip_get_int_command(dd); ++ if (!int_cmd) { ++ dbg_printk(MTIP_DRV_NAME "Unable to allocate tag for PIO cmd\n"); ++ return -EFAULT; ++ } + + set_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags); + +@@ -1119,7 +1127,7 @@ static int mtip_exec_internal_command(struct mtip_port *port, + if (fis->command != ATA_CMD_STANDBYNOW1) { + /* wait for io to complete if non atomic */ + if (mtip_quiesce_io(port, +- MTIP_QUIESCE_IO_TIMEOUT_MS) < 0) { ++ MTIP_QUIESCE_IO_TIMEOUT_MS, atomic) < 0) { + dev_warn(&dd->pdev->dev, + "Failed to quiesce IO\n"); + mtip_put_int_command(dd, int_cmd); +@@ -1162,6 +1170,8 @@ static int mtip_exec_internal_command(struct mtip_port *port, + /* Populate the command header */ + int_cmd->command_header->byte_count = 0; + ++ start = jiffies; ++ + /* Issue the command to the hardware */ + mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL); + +@@ -1170,10 +1180,12 @@ static int mtip_exec_internal_command(struct mtip_port *port, + if ((rv = wait_for_completion_interruptible_timeout( + &wait, + msecs_to_jiffies(timeout))) <= 0) { ++ + if (rv == -ERESTARTSYS) { /* interrupted */ + dev_err(&dd->pdev->dev, +- "Internal command [%02X] was interrupted after %lu ms\n", +- fis->command, timeout); ++ "Internal command [%02X] was interrupted after %u ms\n", ++ fis->command, ++ jiffies_to_msecs(jiffies - start)); + rv = -EINTR; + goto exec_ic_exit; + } else if (rv == 0) /* timeout */ +@@ -2890,6 +2902,42 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd) + return -EFAULT; + } + ++static void mtip_softirq_done_fn(struct request *rq) ++{ ++ struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); ++ struct driver_data *dd = rq->q->queuedata; ++ ++ /* Unmap the DMA scatter list entries */ ++ dma_unmap_sg(&dd->pdev->dev, cmd->sg, cmd->scatter_ents, ++ cmd->direction); ++ ++ if (unlikely(cmd->unaligned)) ++ up(&dd->port->cmd_slot_unal); ++ ++ blk_mq_end_request(rq, rq->errors); ++} ++ ++static void mtip_abort_cmd(struct request *req, void *data, ++ bool reserved) ++{ ++ struct driver_data *dd = data; ++ ++ dbg_printk(MTIP_DRV_NAME " Aborting request, tag = %d\n", req->tag); ++ ++ clear_bit(req->tag, dd->port->cmds_to_issue); ++ req->errors = -EIO; ++ mtip_softirq_done_fn(req); ++} ++ ++static void mtip_queue_cmd(struct request *req, void *data, ++ bool reserved) ++{ ++ struct driver_data *dd = data; ++ ++ set_bit(req->tag, dd->port->cmds_to_issue); ++ blk_abort_request(req); ++} ++ + /* + * service thread to issue queued commands + * +@@ -2902,7 +2950,7 @@ static int mtip_ftl_rebuild_poll(struct driver_data *dd) + static int mtip_service_thread(void *data) + { + struct driver_data *dd = (struct driver_data *)data; +- unsigned long slot, slot_start, slot_wrap; ++ unsigned long slot, slot_start, slot_wrap, to; + unsigned int num_cmd_slots = dd->slot_groups * 32; + struct mtip_port *port = dd->port; + +@@ -2917,9 +2965,7 @@ static int mtip_service_thread(void *data) + * is in progress nor error handling is active + */ + wait_event_interruptible(port->svc_wait, (port->flags) && +- !(port->flags & MTIP_PF_PAUSE_IO)); +- +- set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags); ++ (port->flags & MTIP_PF_SVC_THD_WORK)); + + if (kthread_should_stop() || + test_bit(MTIP_PF_SVC_THD_STOP_BIT, &port->flags)) +@@ -2929,6 +2975,8 @@ static int mtip_service_thread(void *data) + &dd->dd_flag))) + goto st_out; + ++ set_bit(MTIP_PF_SVC_THD_ACTIVE_BIT, &port->flags); ++ + restart_eh: + /* Demux bits: start with error handling */ + if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) { +@@ -2939,6 +2987,32 @@ restart_eh: + if (test_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags)) + goto restart_eh; + ++ if (test_bit(MTIP_PF_TO_ACTIVE_BIT, &port->flags)) { ++ to = jiffies + msecs_to_jiffies(5000); ++ ++ do { ++ mdelay(100); ++ } while (atomic_read(&dd->irq_workers_active) != 0 && ++ time_before(jiffies, to)); ++ ++ if (atomic_read(&dd->irq_workers_active) != 0) ++ dev_warn(&dd->pdev->dev, ++ "Completion workers still active!"); ++ ++ spin_lock(dd->queue->queue_lock); ++ blk_mq_all_tag_busy_iter(*dd->tags.tags, ++ mtip_queue_cmd, dd); ++ spin_unlock(dd->queue->queue_lock); ++ ++ set_bit(MTIP_PF_ISSUE_CMDS_BIT, &dd->port->flags); ++ ++ if (mtip_device_reset(dd)) ++ blk_mq_all_tag_busy_iter(*dd->tags.tags, ++ mtip_abort_cmd, dd); ++ ++ clear_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags); ++ } ++ + if (test_bit(MTIP_PF_ISSUE_CMDS_BIT, &port->flags)) { + slot = 1; + /* used to restrict the loop to one iteration */ +@@ -2971,10 +3045,8 @@ restart_eh: + } + + if (test_bit(MTIP_PF_REBUILD_BIT, &port->flags)) { +- if (mtip_ftl_rebuild_poll(dd) < 0) +- set_bit(MTIP_DDF_REBUILD_FAILED_BIT, +- &dd->dd_flag); +- clear_bit(MTIP_PF_REBUILD_BIT, &port->flags); ++ if (mtip_ftl_rebuild_poll(dd) == 0) ++ clear_bit(MTIP_PF_REBUILD_BIT, &port->flags); + } + } + +@@ -3089,7 +3161,7 @@ static int mtip_hw_get_identify(struct driver_data *dd) + if (buf[288] == 0xBF) { + dev_info(&dd->pdev->dev, + "Drive indicates rebuild has failed.\n"); +- /* TODO */ ++ set_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag); + } + } + +@@ -3263,20 +3335,25 @@ out1: + return rv; + } + +-static void mtip_standby_drive(struct driver_data *dd) ++static int mtip_standby_drive(struct driver_data *dd) + { +- if (dd->sr) +- return; ++ int rv = 0; + ++ if (dd->sr || !dd->port) ++ return -ENODEV; + /* + * Send standby immediate (E0h) to the drive so that it + * saves its state. + */ + if (!test_bit(MTIP_PF_REBUILD_BIT, &dd->port->flags) && +- !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) +- if (mtip_standby_immediate(dd->port)) ++ !test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag) && ++ !test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag)) { ++ rv = mtip_standby_immediate(dd->port); ++ if (rv) + dev_warn(&dd->pdev->dev, + "STANDBY IMMEDIATE failed\n"); ++ } ++ return rv; + } + + /* +@@ -3289,10 +3366,6 @@ static void mtip_standby_drive(struct driver_data *dd) + */ + static int mtip_hw_exit(struct driver_data *dd) + { +- /* +- * Send standby immediate (E0h) to the drive so that it +- * saves its state. +- */ + if (!dd->sr) { + /* de-initialize the port. */ + mtip_deinit_port(dd->port); +@@ -3334,8 +3407,7 @@ static int mtip_hw_shutdown(struct driver_data *dd) + * Send standby immediate (E0h) to the drive so that it + * saves its state. + */ +- if (!dd->sr && dd->port) +- mtip_standby_immediate(dd->port); ++ mtip_standby_drive(dd); + + return 0; + } +@@ -3358,7 +3430,7 @@ static int mtip_hw_suspend(struct driver_data *dd) + * Send standby immediate (E0h) to the drive + * so that it saves its state. + */ +- if (mtip_standby_immediate(dd->port) != 0) { ++ if (mtip_standby_drive(dd) != 0) { + dev_err(&dd->pdev->dev, + "Failed standby-immediate command\n"); + return -EFAULT; +@@ -3596,6 +3668,28 @@ static int mtip_block_getgeo(struct block_device *dev, + return 0; + } + ++static int mtip_block_open(struct block_device *dev, fmode_t mode) ++{ ++ struct driver_data *dd; ++ ++ if (dev && dev->bd_disk) { ++ dd = (struct driver_data *) dev->bd_disk->private_data; ++ ++ if (dd) { ++ if (test_bit(MTIP_DDF_REMOVAL_BIT, ++ &dd->dd_flag)) { ++ return -ENODEV; ++ } ++ return 0; ++ } ++ } ++ return -ENODEV; ++} ++ ++void mtip_block_release(struct gendisk *disk, fmode_t mode) ++{ ++} ++ + /* + * Block device operation function. + * +@@ -3603,6 +3697,8 @@ static int mtip_block_getgeo(struct block_device *dev, + * layer. + */ + static const struct block_device_operations mtip_block_ops = { ++ .open = mtip_block_open, ++ .release = mtip_block_release, + .ioctl = mtip_block_ioctl, + #ifdef CONFIG_COMPAT + .compat_ioctl = mtip_block_compat_ioctl, +@@ -3664,10 +3760,9 @@ static int mtip_submit_request(struct blk_mq_hw_ctx *hctx, struct request *rq) + rq_data_dir(rq))) { + return -ENODATA; + } +- if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))) ++ if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag) || ++ test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag))) + return -ENODATA; +- if (test_bit(MTIP_DDF_REBUILD_FAILED_BIT, &dd->dd_flag)) +- return -ENXIO; + } + + if (rq->cmd_flags & REQ_DISCARD) { +@@ -3779,11 +3874,33 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + return 0; + } + ++static enum blk_eh_timer_return mtip_cmd_timeout(struct request *req, ++ bool reserved) ++{ ++ struct driver_data *dd = req->q->queuedata; ++ int ret = BLK_EH_RESET_TIMER; ++ ++ if (reserved) ++ goto exit_handler; ++ ++ if (test_bit(req->tag, dd->port->cmds_to_issue)) ++ goto exit_handler; ++ ++ if (test_and_set_bit(MTIP_PF_TO_ACTIVE_BIT, &dd->port->flags)) ++ goto exit_handler; ++ ++ wake_up_interruptible(&dd->port->svc_wait); ++exit_handler: ++ return ret; ++} ++ + static struct blk_mq_ops mtip_mq_ops = { + .queue_rq = mtip_queue_rq, + .map_queue = blk_mq_map_queue, + .init_request = mtip_init_cmd, + .exit_request = mtip_free_cmd, ++ .complete = mtip_softirq_done_fn, ++ .timeout = mtip_cmd_timeout, + }; + + /* +@@ -3850,7 +3967,6 @@ static int mtip_block_initialize(struct driver_data *dd) + + mtip_hw_debugfs_init(dd); + +-skip_create_disk: + memset(&dd->tags, 0, sizeof(dd->tags)); + dd->tags.ops = &mtip_mq_ops; + dd->tags.nr_hw_queues = 1; +@@ -3860,12 +3976,13 @@ skip_create_disk: + dd->tags.numa_node = dd->numa_node; + dd->tags.flags = BLK_MQ_F_SHOULD_MERGE; + dd->tags.driver_data = dd; ++ dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS; + + rv = blk_mq_alloc_tag_set(&dd->tags); + if (rv) { + dev_err(&dd->pdev->dev, + "Unable to allocate request queue\n"); +- goto block_queue_alloc_init_error; ++ goto block_queue_alloc_tag_error; + } + + /* Allocate the request queue. */ +@@ -3880,6 +3997,7 @@ skip_create_disk: + dd->disk->queue = dd->queue; + dd->queue->queuedata = dd; + ++skip_create_disk: + /* Initialize the protocol layer. */ + wait_for_rebuild = mtip_hw_get_identify(dd); + if (wait_for_rebuild < 0) { +@@ -3976,8 +4094,9 @@ kthread_run_error: + read_capacity_error: + init_hw_cmds_error: + blk_cleanup_queue(dd->queue); +- blk_mq_free_tag_set(&dd->tags); + block_queue_alloc_init_error: ++ blk_mq_free_tag_set(&dd->tags); ++block_queue_alloc_tag_error: + mtip_hw_debugfs_exit(dd); + disk_index_error: + spin_lock(&rssd_index_lock); +@@ -3994,6 +4113,22 @@ protocol_init_error: + return rv; + } + ++static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv) ++{ ++ struct driver_data *dd = (struct driver_data *)data; ++ struct mtip_cmd *cmd; ++ ++ if (likely(!reserv)) ++ blk_mq_complete_request(rq, -ENODEV); ++ else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) { ++ ++ cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL); ++ if (cmd->comp_func) ++ cmd->comp_func(dd->port, MTIP_TAG_INTERNAL, ++ cmd, -ENODEV); ++ } ++} ++ + /* + * Block layer deinitialization function. + * +@@ -4025,12 +4160,23 @@ static int mtip_block_remove(struct driver_data *dd) + } + } + +- if (!dd->sr) +- mtip_standby_drive(dd); ++ if (!dd->sr) { ++ /* ++ * Explicitly wait here for IOs to quiesce, ++ * as mtip_standby_drive usually won't wait for IOs. ++ */ ++ if (!mtip_quiesce_io(dd->port, MTIP_QUIESCE_IO_TIMEOUT_MS, ++ GFP_KERNEL)) ++ mtip_standby_drive(dd); ++ } + else + dev_info(&dd->pdev->dev, "device %s surprise removal\n", + dd->disk->disk_name); + ++ blk_mq_freeze_queue_start(dd->queue); ++ blk_mq_stop_hw_queues(dd->queue); ++ blk_mq_all_tag_busy_iter(dd->tags.tags[0], mtip_no_dev_cleanup, dd); ++ + /* + * Delete our gendisk structure. This also removes the device + * from /dev +@@ -4040,7 +4186,8 @@ static int mtip_block_remove(struct driver_data *dd) + dd->bdev = NULL; + } + if (dd->disk) { +- del_gendisk(dd->disk); ++ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) ++ del_gendisk(dd->disk); + if (dd->disk->queue) { + blk_cleanup_queue(dd->queue); + blk_mq_free_tag_set(&dd->tags); +@@ -4081,7 +4228,8 @@ static int mtip_block_shutdown(struct driver_data *dd) + dev_info(&dd->pdev->dev, + "Shutting down %s ...\n", dd->disk->disk_name); + +- del_gendisk(dd->disk); ++ if (test_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag)) ++ del_gendisk(dd->disk); + if (dd->disk->queue) { + blk_cleanup_queue(dd->queue); + blk_mq_free_tag_set(&dd->tags); +@@ -4426,7 +4574,7 @@ static void mtip_pci_remove(struct pci_dev *pdev) + struct driver_data *dd = pci_get_drvdata(pdev); + unsigned long flags, to; + +- set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag); ++ set_bit(MTIP_DDF_REMOVAL_BIT, &dd->dd_flag); + + spin_lock_irqsave(&dev_lock, flags); + list_del_init(&dd->online_list); +@@ -4443,12 +4591,17 @@ static void mtip_pci_remove(struct pci_dev *pdev) + } while (atomic_read(&dd->irq_workers_active) != 0 && + time_before(jiffies, to)); + ++ if (!dd->sr) ++ fsync_bdev(dd->bdev); ++ + if (atomic_read(&dd->irq_workers_active) != 0) { + dev_warn(&dd->pdev->dev, + "Completion workers still active!\n"); + } + +- blk_mq_stop_hw_queues(dd->queue); ++ blk_set_queue_dying(dd->queue); ++ set_bit(MTIP_DDF_REMOVE_PENDING_BIT, &dd->dd_flag); ++ + /* Clean up the block layer. */ + mtip_block_remove(dd); + +diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h +index 3274784008eb..7617888f7944 100644 +--- a/drivers/block/mtip32xx/mtip32xx.h ++++ b/drivers/block/mtip32xx/mtip32xx.h +@@ -134,16 +134,24 @@ enum { + MTIP_PF_EH_ACTIVE_BIT = 1, /* error handling */ + MTIP_PF_SE_ACTIVE_BIT = 2, /* secure erase */ + MTIP_PF_DM_ACTIVE_BIT = 3, /* download microcde */ ++ MTIP_PF_TO_ACTIVE_BIT = 9, /* timeout handling */ + MTIP_PF_PAUSE_IO = ((1 << MTIP_PF_IC_ACTIVE_BIT) | + (1 << MTIP_PF_EH_ACTIVE_BIT) | + (1 << MTIP_PF_SE_ACTIVE_BIT) | +- (1 << MTIP_PF_DM_ACTIVE_BIT)), ++ (1 << MTIP_PF_DM_ACTIVE_BIT) | ++ (1 << MTIP_PF_TO_ACTIVE_BIT)), + + MTIP_PF_SVC_THD_ACTIVE_BIT = 4, + MTIP_PF_ISSUE_CMDS_BIT = 5, + MTIP_PF_REBUILD_BIT = 6, + MTIP_PF_SVC_THD_STOP_BIT = 8, + ++ MTIP_PF_SVC_THD_WORK = ((1 << MTIP_PF_EH_ACTIVE_BIT) | ++ (1 << MTIP_PF_ISSUE_CMDS_BIT) | ++ (1 << MTIP_PF_REBUILD_BIT) | ++ (1 << MTIP_PF_SVC_THD_STOP_BIT) | ++ (1 << MTIP_PF_TO_ACTIVE_BIT)), ++ + /* below are bit numbers in 'dd_flag' defined in driver_data */ + MTIP_DDF_SEC_LOCK_BIT = 0, + MTIP_DDF_REMOVE_PENDING_BIT = 1, +@@ -153,6 +161,7 @@ enum { + MTIP_DDF_RESUME_BIT = 6, + MTIP_DDF_INIT_DONE_BIT = 7, + MTIP_DDF_REBUILD_FAILED_BIT = 8, ++ MTIP_DDF_REMOVAL_BIT = 9, + + MTIP_DDF_STOP_IO = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | + (1 << MTIP_DDF_SEC_LOCK_BIT) | +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index fa893c3ec408..0beaa52df66b 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x0489, 0xe05f) }, + { USB_DEVICE(0x0489, 0xe076) }, + { USB_DEVICE(0x0489, 0xe078) }, ++ { USB_DEVICE(0x0489, 0xe095) }, + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x04CA, 0x3004) }, + { USB_DEVICE(0x04CA, 0x3005) }, +@@ -92,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x04CA, 0x300d) }, + { USB_DEVICE(0x04CA, 0x300f) }, + { USB_DEVICE(0x04CA, 0x3010) }, ++ { USB_DEVICE(0x04CA, 0x3014) }, + { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x021c) }, + { USB_DEVICE(0x0930, 0x0220) }, +@@ -113,10 +115,12 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3362) }, + { USB_DEVICE(0x13d3, 0x3375) }, + { USB_DEVICE(0x13d3, 0x3393) }, ++ { USB_DEVICE(0x13d3, 0x3395) }, + { USB_DEVICE(0x13d3, 0x3402) }, + { USB_DEVICE(0x13d3, 0x3408) }, + { USB_DEVICE(0x13d3, 0x3423) }, + { USB_DEVICE(0x13d3, 0x3432) }, ++ { USB_DEVICE(0x13d3, 0x3472) }, + { USB_DEVICE(0x13d3, 0x3474) }, + + /* Atheros AR5BBU12 with sflash firmware */ +@@ -144,6 +148,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, +@@ -154,6 +159,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, +@@ -175,10 +181,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index a191e318fab8..0d4e372e426d 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -196,6 +196,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, +@@ -206,6 +207,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, +@@ -227,10 +229,12 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 45cc39aabeee..252142524ff2 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -136,11 +136,13 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, + chip->cdev.owner = chip->pdev->driver->owner; + chip->cdev.kobj.parent = &chip->dev.kobj; + ++ devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); ++ + return chip; + } + EXPORT_SYMBOL_GPL(tpmm_chip_alloc); + +-static int tpm_dev_add_device(struct tpm_chip *chip) ++static int tpm_add_char_device(struct tpm_chip *chip) + { + int rc; + +@@ -151,7 +153,6 @@ static int tpm_dev_add_device(struct tpm_chip *chip) + chip->devname, MAJOR(chip->dev.devt), + MINOR(chip->dev.devt), rc); + +- device_unregister(&chip->dev); + return rc; + } + +@@ -162,16 +163,17 @@ static int tpm_dev_add_device(struct tpm_chip *chip) + chip->devname, MAJOR(chip->dev.devt), + MINOR(chip->dev.devt), rc); + ++ cdev_del(&chip->cdev); + return rc; + } + + return rc; + } + +-static void tpm_dev_del_device(struct tpm_chip *chip) ++static void tpm_del_char_device(struct tpm_chip *chip) + { + cdev_del(&chip->cdev); +- device_unregister(&chip->dev); ++ device_del(&chip->dev); + } + + static int tpm1_chip_register(struct tpm_chip *chip) +@@ -222,7 +224,7 @@ int tpm_chip_register(struct tpm_chip *chip) + + tpm_add_ppi(chip); + +- rc = tpm_dev_add_device(chip); ++ rc = tpm_add_char_device(chip); + if (rc) + goto out_err; + +@@ -274,6 +276,6 @@ void tpm_chip_unregister(struct tpm_chip *chip) + sysfs_remove_link(&chip->pdev->kobj, "ppi"); + + tpm1_chip_unregister(chip); +- tpm_dev_del_device(chip); ++ tpm_del_char_device(chip); + } + EXPORT_SYMBOL_GPL(tpm_chip_unregister); +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index 8342cf51ffdc..26bab5a2959f 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -302,11 +302,11 @@ static int crb_acpi_remove(struct acpi_device *device) + struct device *dev = &device->dev; + struct tpm_chip *chip = dev_get_drvdata(dev); + +- tpm_chip_unregister(chip); +- + if (chip->flags & TPM_CHIP_FLAG_TPM2) + tpm2_shutdown(chip, TPM2_SU_CLEAR); + ++ tpm_chip_unregister(chip); ++ + return 0; + } + +diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c +index bd72fb04225e..4e6940acf639 100644 +--- a/drivers/char/tpm/tpm_eventlog.c ++++ b/drivers/char/tpm/tpm_eventlog.c +@@ -232,7 +232,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v) + { + struct tcpa_event *event = v; + struct tcpa_event temp_event; +- char *tempPtr; ++ char *temp_ptr; + int i; + + memcpy(&temp_event, event, sizeof(struct tcpa_event)); +@@ -242,10 +242,16 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v) + temp_event.event_type = do_endian_conversion(event->event_type); + temp_event.event_size = do_endian_conversion(event->event_size); + +- tempPtr = (char *)&temp_event; ++ temp_ptr = (char *) &temp_event; + +- for (i = 0; i < sizeof(struct tcpa_event) + temp_event.event_size; i++) +- seq_putc(m, tempPtr[i]); ++ for (i = 0; i < (sizeof(struct tcpa_event) - 1) ; i++) ++ seq_putc(m, temp_ptr[i]); ++ ++ temp_ptr = (char *) v; ++ ++ for (i = (sizeof(struct tcpa_event) - 1); ++ i < (sizeof(struct tcpa_event) + temp_event.event_size); i++) ++ seq_putc(m, temp_ptr[i]); + + return 0; + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 015e687ffabe..9f4df8f645f8 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1107,13 +1107,15 @@ static int bcm2835_pll_divider_set_rate(struct clk_hw *hw, + struct bcm2835_pll_divider *divider = bcm2835_pll_divider_from_hw(hw); + struct bcm2835_cprman *cprman = divider->cprman; + const struct bcm2835_pll_divider_data *data = divider->data; +- u32 cm; +- int ret; ++ u32 cm, div, max_div = 1 << A2W_PLL_DIV_BITS; + +- ret = clk_divider_ops.set_rate(hw, rate, parent_rate); +- if (ret) +- return ret; ++ div = DIV_ROUND_UP_ULL(parent_rate, rate); ++ ++ div = min(div, max_div); ++ if (div == max_div) ++ div = 0; + ++ cprman_write(cprman, data->a2w_reg, div); + cm = cprman_read(cprman, data->cm_reg); + cprman_write(cprman, data->cm_reg, cm | data->load_mask); + cprman_write(cprman, data->cm_reg, cm & ~data->load_mask); +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 7f7444cbf6fc..05263571c223 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -748,6 +748,7 @@ static const char *const rk3188_critical_clocks[] __initconst = { + "hclk_peri", + "pclk_cpu", + "pclk_peri", ++ "hclk_cpubus" + }; + + static void __init rk3188_common_clk_init(struct device_node *np) +diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c +index 21f3ea909fab..57acb625c8ff 100644 +--- a/drivers/clk/rockchip/clk-rk3368.c ++++ b/drivers/clk/rockchip/clk-rk3368.c +@@ -165,7 +165,7 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkb_data = { + .core_reg = RK3368_CLKSEL_CON(0), + .div_core_shift = 0, + .div_core_mask = 0x1f, +- .mux_core_shift = 15, ++ .mux_core_shift = 7, + }; + + static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = { +@@ -218,29 +218,29 @@ static const struct rockchip_cpuclk_reg_data rk3368_cpuclkl_data = { + } + + static struct rockchip_cpuclk_rate_table rk3368_cpuclkb_rates[] __initdata = { +- RK3368_CPUCLKB_RATE(1512000000, 2, 6, 6), +- RK3368_CPUCLKB_RATE(1488000000, 2, 5, 5), +- RK3368_CPUCLKB_RATE(1416000000, 2, 5, 5), +- RK3368_CPUCLKB_RATE(1200000000, 2, 4, 4), +- RK3368_CPUCLKB_RATE(1008000000, 2, 4, 4), +- RK3368_CPUCLKB_RATE( 816000000, 2, 3, 3), +- RK3368_CPUCLKB_RATE( 696000000, 2, 3, 3), +- RK3368_CPUCLKB_RATE( 600000000, 2, 2, 2), +- RK3368_CPUCLKB_RATE( 408000000, 2, 2, 2), +- RK3368_CPUCLKB_RATE( 312000000, 2, 2, 2), ++ RK3368_CPUCLKB_RATE(1512000000, 1, 5, 5), ++ RK3368_CPUCLKB_RATE(1488000000, 1, 4, 4), ++ RK3368_CPUCLKB_RATE(1416000000, 1, 4, 4), ++ RK3368_CPUCLKB_RATE(1200000000, 1, 3, 3), ++ RK3368_CPUCLKB_RATE(1008000000, 1, 3, 3), ++ RK3368_CPUCLKB_RATE( 816000000, 1, 2, 2), ++ RK3368_CPUCLKB_RATE( 696000000, 1, 2, 2), ++ RK3368_CPUCLKB_RATE( 600000000, 1, 1, 1), ++ RK3368_CPUCLKB_RATE( 408000000, 1, 1, 1), ++ RK3368_CPUCLKB_RATE( 312000000, 1, 1, 1), + }; + + static struct rockchip_cpuclk_rate_table rk3368_cpuclkl_rates[] __initdata = { +- RK3368_CPUCLKL_RATE(1512000000, 2, 7, 7), +- RK3368_CPUCLKL_RATE(1488000000, 2, 6, 6), +- RK3368_CPUCLKL_RATE(1416000000, 2, 6, 6), +- RK3368_CPUCLKL_RATE(1200000000, 2, 5, 5), +- RK3368_CPUCLKL_RATE(1008000000, 2, 5, 5), +- RK3368_CPUCLKL_RATE( 816000000, 2, 4, 4), +- RK3368_CPUCLKL_RATE( 696000000, 2, 3, 3), +- RK3368_CPUCLKL_RATE( 600000000, 2, 3, 3), +- RK3368_CPUCLKL_RATE( 408000000, 2, 2, 2), +- RK3368_CPUCLKL_RATE( 312000000, 2, 2, 2), ++ RK3368_CPUCLKL_RATE(1512000000, 1, 6, 6), ++ RK3368_CPUCLKL_RATE(1488000000, 1, 5, 5), ++ RK3368_CPUCLKL_RATE(1416000000, 1, 5, 5), ++ RK3368_CPUCLKL_RATE(1200000000, 1, 4, 4), ++ RK3368_CPUCLKL_RATE(1008000000, 1, 4, 4), ++ RK3368_CPUCLKL_RATE( 816000000, 1, 3, 3), ++ RK3368_CPUCLKL_RATE( 696000000, 1, 2, 2), ++ RK3368_CPUCLKL_RATE( 600000000, 1, 2, 2), ++ RK3368_CPUCLKL_RATE( 408000000, 1, 1, 1), ++ RK3368_CPUCLKL_RATE( 312000000, 1, 1, 1), + }; + + static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { +@@ -384,10 +384,10 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { + * Clock-Architecture Diagram 3 + */ + +- COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_usb_p, 0, ++ COMPOSITE(0, "aclk_vepu", mux_pll_src_cpll_gpll_npll_usb_p, 0, + RK3368_CLKSEL_CON(15), 6, 2, MFLAGS, 0, 5, DFLAGS, + RK3368_CLKGATE_CON(4), 6, GFLAGS), +- COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb_p, 0, ++ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_npll_usb_p, 0, + RK3368_CLKSEL_CON(15), 14, 2, MFLAGS, 8, 5, DFLAGS, + RK3368_CLKGATE_CON(4), 7, GFLAGS), + +@@ -442,7 +442,7 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = { + GATE(SCLK_HDMI_HDCP, "sclk_hdmi_hdcp", "xin24m", 0, + RK3368_CLKGATE_CON(4), 13, GFLAGS), + GATE(SCLK_HDMI_CEC, "sclk_hdmi_cec", "xin32k", 0, +- RK3368_CLKGATE_CON(5), 12, GFLAGS), ++ RK3368_CLKGATE_CON(4), 12, GFLAGS), + + COMPOSITE_NODIV(0, "vip_src", mux_pll_src_cpll_gpll_p, 0, + RK3368_CLKSEL_CON(21), 15, 1, MFLAGS, +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index 3eb3f1279fb7..7de007abe46e 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -2085,9 +2085,9 @@ static int atmel_aes_probe(struct platform_device *pdev) + } + + aes_dd->io_base = devm_ioremap_resource(&pdev->dev, aes_res); +- if (!aes_dd->io_base) { ++ if (IS_ERR(aes_dd->io_base)) { + dev_err(dev, "can't ioremap\n"); +- err = -ENOMEM; ++ err = PTR_ERR(aes_dd->io_base); + goto res_err; + } + +diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c +index 8bf9914d4d15..68d47a2da4a1 100644 +--- a/drivers/crypto/atmel-sha.c ++++ b/drivers/crypto/atmel-sha.c +@@ -1404,9 +1404,9 @@ static int atmel_sha_probe(struct platform_device *pdev) + } + + sha_dd->io_base = devm_ioremap_resource(&pdev->dev, sha_res); +- if (!sha_dd->io_base) { ++ if (IS_ERR(sha_dd->io_base)) { + dev_err(dev, "can't ioremap\n"); +- err = -ENOMEM; ++ err = PTR_ERR(sha_dd->io_base); + goto res_err; + } + +diff --git a/drivers/crypto/atmel-tdes.c b/drivers/crypto/atmel-tdes.c +index 2c7a628d0375..bf467d7be35c 100644 +--- a/drivers/crypto/atmel-tdes.c ++++ b/drivers/crypto/atmel-tdes.c +@@ -1417,9 +1417,9 @@ static int atmel_tdes_probe(struct platform_device *pdev) + } + + tdes_dd->io_base = devm_ioremap_resource(&pdev->dev, tdes_res); +- if (!tdes_dd->io_base) { ++ if (IS_ERR(tdes_dd->io_base)) { + dev_err(dev, "can't ioremap\n"); +- err = -ENOMEM; ++ err = PTR_ERR(tdes_dd->io_base); + goto res_err; + } + +diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +index d89f20c04266..3d9acc53d247 100644 +--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c ++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +@@ -220,6 +220,39 @@ static int ccp_aes_cmac_digest(struct ahash_request *req) + return ccp_aes_cmac_finup(req); + } + ++static int ccp_aes_cmac_export(struct ahash_request *req, void *out) ++{ ++ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); ++ struct ccp_aes_cmac_exp_ctx state; ++ ++ state.null_msg = rctx->null_msg; ++ memcpy(state.iv, rctx->iv, sizeof(state.iv)); ++ state.buf_count = rctx->buf_count; ++ memcpy(state.buf, rctx->buf, sizeof(state.buf)); ++ ++ /* 'out' may not be aligned so memcpy from local variable */ ++ memcpy(out, &state, sizeof(state)); ++ ++ return 0; ++} ++ ++static int ccp_aes_cmac_import(struct ahash_request *req, const void *in) ++{ ++ struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); ++ struct ccp_aes_cmac_exp_ctx state; ++ ++ /* 'in' may not be aligned so memcpy to local variable */ ++ memcpy(&state, in, sizeof(state)); ++ ++ memset(rctx, 0, sizeof(*rctx)); ++ rctx->null_msg = state.null_msg; ++ memcpy(rctx->iv, state.iv, sizeof(rctx->iv)); ++ rctx->buf_count = state.buf_count; ++ memcpy(rctx->buf, state.buf, sizeof(rctx->buf)); ++ ++ return 0; ++} ++ + static int ccp_aes_cmac_setkey(struct crypto_ahash *tfm, const u8 *key, + unsigned int key_len) + { +@@ -352,10 +385,13 @@ int ccp_register_aes_cmac_algs(struct list_head *head) + alg->final = ccp_aes_cmac_final; + alg->finup = ccp_aes_cmac_finup; + alg->digest = ccp_aes_cmac_digest; ++ alg->export = ccp_aes_cmac_export; ++ alg->import = ccp_aes_cmac_import; + alg->setkey = ccp_aes_cmac_setkey; + + halg = &alg->halg; + halg->digestsize = AES_BLOCK_SIZE; ++ halg->statesize = sizeof(struct ccp_aes_cmac_exp_ctx); + + base = &halg->base; + snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "cmac(aes)"); +diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c +index d14b3f28e010..8ef06fad8b14 100644 +--- a/drivers/crypto/ccp/ccp-crypto-sha.c ++++ b/drivers/crypto/ccp/ccp-crypto-sha.c +@@ -207,6 +207,43 @@ static int ccp_sha_digest(struct ahash_request *req) + return ccp_sha_finup(req); + } + ++static int ccp_sha_export(struct ahash_request *req, void *out) ++{ ++ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); ++ struct ccp_sha_exp_ctx state; ++ ++ state.type = rctx->type; ++ state.msg_bits = rctx->msg_bits; ++ state.first = rctx->first; ++ memcpy(state.ctx, rctx->ctx, sizeof(state.ctx)); ++ state.buf_count = rctx->buf_count; ++ memcpy(state.buf, rctx->buf, sizeof(state.buf)); ++ ++ /* 'out' may not be aligned so memcpy from local variable */ ++ memcpy(out, &state, sizeof(state)); ++ ++ return 0; ++} ++ ++static int ccp_sha_import(struct ahash_request *req, const void *in) ++{ ++ struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); ++ struct ccp_sha_exp_ctx state; ++ ++ /* 'in' may not be aligned so memcpy to local variable */ ++ memcpy(&state, in, sizeof(state)); ++ ++ memset(rctx, 0, sizeof(*rctx)); ++ rctx->type = state.type; ++ rctx->msg_bits = state.msg_bits; ++ rctx->first = state.first; ++ memcpy(rctx->ctx, state.ctx, sizeof(rctx->ctx)); ++ rctx->buf_count = state.buf_count; ++ memcpy(rctx->buf, state.buf, sizeof(rctx->buf)); ++ ++ return 0; ++} ++ + static int ccp_sha_setkey(struct crypto_ahash *tfm, const u8 *key, + unsigned int key_len) + { +@@ -403,9 +440,12 @@ static int ccp_register_sha_alg(struct list_head *head, + alg->final = ccp_sha_final; + alg->finup = ccp_sha_finup; + alg->digest = ccp_sha_digest; ++ alg->export = ccp_sha_export; ++ alg->import = ccp_sha_import; + + halg = &alg->halg; + halg->digestsize = def->digest_size; ++ halg->statesize = sizeof(struct ccp_sha_exp_ctx); + + base = &halg->base; + snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "%s", def->name); +diff --git a/drivers/crypto/ccp/ccp-crypto.h b/drivers/crypto/ccp/ccp-crypto.h +index 76a96f0f44c6..a326ec20bfa8 100644 +--- a/drivers/crypto/ccp/ccp-crypto.h ++++ b/drivers/crypto/ccp/ccp-crypto.h +@@ -129,6 +129,15 @@ struct ccp_aes_cmac_req_ctx { + struct ccp_cmd cmd; + }; + ++struct ccp_aes_cmac_exp_ctx { ++ unsigned int null_msg; ++ ++ u8 iv[AES_BLOCK_SIZE]; ++ ++ unsigned int buf_count; ++ u8 buf[AES_BLOCK_SIZE]; ++}; ++ + /***** SHA related defines *****/ + #define MAX_SHA_CONTEXT_SIZE SHA256_DIGEST_SIZE + #define MAX_SHA_BLOCK_SIZE SHA256_BLOCK_SIZE +@@ -171,6 +180,19 @@ struct ccp_sha_req_ctx { + struct ccp_cmd cmd; + }; + ++struct ccp_sha_exp_ctx { ++ enum ccp_sha_type type; ++ ++ u64 msg_bits; ++ ++ unsigned int first; ++ ++ u8 ctx[MAX_SHA_CONTEXT_SIZE]; ++ ++ unsigned int buf_count; ++ u8 buf[MAX_SHA_BLOCK_SIZE]; ++}; ++ + /***** Common Context Structure *****/ + struct ccp_ctx { + int (*complete)(struct crypto_async_request *req, int ret); +diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c +index c0656e7f37b5..80239ae69527 100644 +--- a/drivers/crypto/marvell/cesa.c ++++ b/drivers/crypto/marvell/cesa.c +@@ -420,7 +420,7 @@ static int mv_cesa_probe(struct platform_device *pdev) + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs"); + cesa->regs = devm_ioremap_resource(dev, res); + if (IS_ERR(cesa->regs)) +- return -ENOMEM; ++ return PTR_ERR(cesa->regs); + + ret = mv_cesa_dev_dma_init(cesa); + if (ret) +diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c +index 4c243c1ffc7f..790f7cadc1ed 100644 +--- a/drivers/crypto/ux500/cryp/cryp_core.c ++++ b/drivers/crypto/ux500/cryp/cryp_core.c +@@ -1440,9 +1440,9 @@ static int ux500_cryp_probe(struct platform_device *pdev) + + device_data->phybase = res->start; + device_data->base = devm_ioremap_resource(dev, res); +- if (!device_data->base) { ++ if (IS_ERR(device_data->base)) { + dev_err(dev, "[%s]: ioremap failed!", __func__); +- ret = -ENOMEM; ++ ret = PTR_ERR(device_data->base); + goto out; + } + +diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c +index d6fdc583ce5d..574e87c7f2b8 100644 +--- a/drivers/crypto/ux500/hash/hash_core.c ++++ b/drivers/crypto/ux500/hash/hash_core.c +@@ -1659,9 +1659,9 @@ static int ux500_hash_probe(struct platform_device *pdev) + + device_data->phybase = res->start; + device_data->base = devm_ioremap_resource(dev, res); +- if (!device_data->base) { ++ if (IS_ERR(device_data->base)) { + dev_err(dev, "%s: ioremap() failed!\n", __func__); +- ret = -ENOMEM; ++ ret = PTR_ERR(device_data->base); + goto out; + } + spin_lock_init(&device_data->ctx_lock); +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index 9eee13ef83a5..d87a47547ba5 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1452,7 +1452,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range, + u64 chan_off; + u64 dram_base = get_dram_base(pvt, range); + u64 hole_off = f10_dhar_offset(pvt); +- u64 dct_sel_base_off = (pvt->dct_sel_hi & 0xFFFFFC00) << 16; ++ u64 dct_sel_base_off = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16; + + if (hi_rng) { + /* +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index f5c6b97c8958..93f0d4120289 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1839,8 +1839,8 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + edac_dbg(0, "TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n", + n_tads, gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, +- (u32)TAD_SOCK(reg), +- (u32)TAD_CH(reg), ++ (u32)(1 << TAD_SOCK(reg)), ++ (u32)TAD_CH(reg) + 1, + (u32)TAD_TGT0(reg), + (u32)TAD_TGT1(reg), + (u32)TAD_TGT2(reg), +@@ -2118,7 +2118,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + } + + ch_way = TAD_CH(reg) + 1; +- sck_way = TAD_SOCK(reg) + 1; ++ sck_way = 1 << TAD_SOCK(reg); + + if (ch_way == 3) + idx = addr >> 6; +@@ -2175,7 +2175,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + n_tads, + addr, + limit, +- (u32)TAD_SOCK(reg), ++ sck_way, + ch_way, + offset, + idx, +@@ -2190,18 +2190,12 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + offset, addr); + return -EINVAL; + } +- addr -= offset; +- /* Store the low bits [0:6] of the addr */ +- ch_addr = addr & 0x7f; +- /* Remove socket wayness and remove 6 bits */ +- addr >>= 6; +- addr = div_u64(addr, sck_xch); +-#if 0 +- /* Divide by channel way */ +- addr = addr / ch_way; +-#endif +- /* Recover the last 6 bits */ +- ch_addr |= addr << 6; ++ ++ ch_addr = addr - offset; ++ ch_addr >>= (6 + shiftup); ++ ch_addr /= ch_way * sck_way; ++ ch_addr <<= (6 + shiftup); ++ ch_addr |= addr & ((1 << (6 + shiftup)) - 1); + + /* + * Step 3) Decode rank +diff --git a/drivers/firmware/broadcom/bcm47xx_nvram.c b/drivers/firmware/broadcom/bcm47xx_nvram.c +index 0c2f0a61b0ea..0b631e5b5b84 100644 +--- a/drivers/firmware/broadcom/bcm47xx_nvram.c ++++ b/drivers/firmware/broadcom/bcm47xx_nvram.c +@@ -94,15 +94,14 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim) + + found: + __ioread32_copy(nvram_buf, header, sizeof(*header) / 4); +- header = (struct nvram_header *)nvram_buf; +- nvram_len = header->len; ++ nvram_len = ((struct nvram_header *)(nvram_buf))->len; + if (nvram_len > size) { + pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n"); + nvram_len = size; + } + if (nvram_len >= NVRAM_SPACE) { + pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n", +- header->len, NVRAM_SPACE - 1); ++ nvram_len, NVRAM_SPACE - 1); + nvram_len = NVRAM_SPACE - 1; + } + /* proceed reading data after header */ +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 23196c5fc17c..99b375c95998 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -367,9 +367,11 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc, + memcpy(reg_val, chip->reg_output, NBANK(chip)); + mutex_lock(&chip->i2c_lock); + for(bank=0; bank<NBANK(chip); bank++) { +- unsigned bankmask = mask[bank/4] >> ((bank % 4) * 8); ++ unsigned bankmask = mask[bank / sizeof(*mask)] >> ++ ((bank % sizeof(*mask)) * 8); + if(bankmask) { +- unsigned bankval = bits[bank/4] >> ((bank % 4) * 8); ++ unsigned bankval = bits[bank / sizeof(*bits)] >> ++ ((bank % sizeof(*bits)) * 8); + reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval; + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +index 3c895863fcf5..81dc6b65436f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -63,6 +63,10 @@ bool amdgpu_has_atpx(void) { + return amdgpu_atpx_priv.atpx_detected; + } + ++bool amdgpu_has_atpx_dgpu_power_cntl(void) { ++ return amdgpu_atpx_priv.atpx.functions.power_cntl; ++} ++ + /** + * amdgpu_atpx_call - call an ATPX method + * +@@ -142,10 +146,6 @@ static void amdgpu_atpx_parse_functions(struct amdgpu_atpx_functions *f, u32 mas + */ + static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx) + { +- /* make sure required functions are enabled */ +- /* dGPU power control is required */ +- atpx->functions.power_cntl = true; +- + if (atpx->functions.px_params) { + union acpi_object *info; + struct atpx_px_params output; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 51bfc114584e..d6c68d00cbb0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -62,6 +62,12 @@ static const char *amdgpu_asic_name[] = { + "LAST", + }; + ++#if defined(CONFIG_VGA_SWITCHEROO) ++bool amdgpu_has_atpx_dgpu_power_cntl(void); ++#else ++static inline bool amdgpu_has_atpx_dgpu_power_cntl(void) { return false; } ++#endif ++ + bool amdgpu_device_is_px(struct drm_device *dev) + { + struct amdgpu_device *adev = dev->dev_private; +@@ -1511,7 +1517,7 @@ int amdgpu_device_init(struct amdgpu_device *adev, + + if (amdgpu_runtime_pm == 1) + runtime = true; +- if (amdgpu_device_is_px(ddev)) ++ if (amdgpu_device_is_px(ddev) && amdgpu_has_atpx_dgpu_power_cntl()) + runtime = true; + vga_switcheroo_register_client(adev->pdev, &amdgpu_switcheroo_ops, runtime); + if (runtime) +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c +index 2cf50180cc51..b1c7a9b3631b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c +@@ -32,8 +32,8 @@ + #include "oss/oss_2_4_d.h" + #include "oss/oss_2_4_sh_mask.h" + +-#include "gmc/gmc_8_1_d.h" +-#include "gmc/gmc_8_1_sh_mask.h" ++#include "gmc/gmc_7_1_d.h" ++#include "gmc/gmc_7_1_sh_mask.h" + + #include "gca/gfx_8_0_d.h" + #include "gca/gfx_8_0_enum.h" +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c +index cf01177ca3b5..2ea012e88991 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c +@@ -241,6 +241,11 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr) + phm_cap_set(hwmgr->platform_descriptor.platformCaps, + PHM_PlatformCaps_DynamicUVDState); + ++ phm_cap_set(hwmgr->platform_descriptor.platformCaps, ++ PHM_PlatformCaps_UVDDPM); ++ phm_cap_set(hwmgr->platform_descriptor.platformCaps, ++ PHM_PlatformCaps_VCEDPM); ++ + cz_hwmgr->cc6_settings.cpu_cc6_disable = false; + cz_hwmgr->cc6_settings.cpu_pstate_disable = false; + cz_hwmgr->cc6_settings.nb_pstate_switch_disable = false; +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 01b20e14a247..6104d7d7449e 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -892,8 +892,6 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m + else + args.v1.ucLaneNum = 4; + +- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) +- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; + switch (radeon_encoder->encoder_id) { + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY: + args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1; +@@ -910,6 +908,10 @@ atombios_dig_encoder_setup2(struct drm_encoder *encoder, int action, int panel_m + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB; + else + args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA; ++ ++ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000)) ++ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ; ++ + break; + case 2: + case 3: +diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +index c4b4f298a283..9bc408c9f9f6 100644 +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -62,6 +62,10 @@ bool radeon_has_atpx(void) { + return radeon_atpx_priv.atpx_detected; + } + ++bool radeon_has_atpx_dgpu_power_cntl(void) { ++ return radeon_atpx_priv.atpx.functions.power_cntl; ++} ++ + /** + * radeon_atpx_call - call an ATPX method + * +@@ -141,10 +145,6 @@ static void radeon_atpx_parse_functions(struct radeon_atpx_functions *f, u32 mas + */ + static int radeon_atpx_validate(struct radeon_atpx *atpx) + { +- /* make sure required functions are enabled */ +- /* dGPU power control is required */ +- atpx->functions.power_cntl = true; +- + if (atpx->functions.px_params) { + union acpi_object *info; + struct atpx_px_params output; +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 4197ca1bb1e4..e2396336f9e8 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -103,6 +103,12 @@ static const char radeon_family_name[][16] = { + "LAST", + }; + ++#if defined(CONFIG_VGA_SWITCHEROO) ++bool radeon_has_atpx_dgpu_power_cntl(void); ++#else ++static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; } ++#endif ++ + #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0) + #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1) + +@@ -1433,7 +1439,7 @@ int radeon_device_init(struct radeon_device *rdev, + * ignore it */ + vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode); + +- if (rdev->flags & RADEON_IS_PX) ++ if ((rdev->flags & RADEON_IS_PX) && radeon_has_atpx_dgpu_power_cntl()) + runtime = true; + vga_switcheroo_register_client(rdev->pdev, &radeon_switcheroo_ops, runtime); + if (runtime) +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 2d9196a447fd..bfcef4db8138 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1683,10 +1683,8 @@ int radeon_modeset_init(struct radeon_device *rdev) + /* setup afmt */ + radeon_afmt_init(rdev); + +- if (!list_empty(&rdev->ddev->mode_config.connector_list)) { +- radeon_fbdev_init(rdev); +- drm_kms_helper_poll_init(rdev->ddev); +- } ++ radeon_fbdev_init(rdev); ++ drm_kms_helper_poll_init(rdev->ddev); + + /* do pm late init */ + ret = radeon_pm_late_init(rdev); +diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c +index df7a1719c841..9d210bbcab50 100644 +--- a/drivers/gpu/drm/radeon/radeon_dp_mst.c ++++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c +@@ -525,17 +525,9 @@ static bool radeon_mst_mode_fixup(struct drm_encoder *encoder, + drm_mode_set_crtcinfo(adjusted_mode, 0); + { + struct radeon_connector_atom_dig *dig_connector; +- int ret; +- + dig_connector = mst_enc->connector->con_priv; +- ret = radeon_dp_get_dp_link_config(&mst_enc->connector->base, +- dig_connector->dpcd, adjusted_mode->clock, +- &dig_connector->dp_lane_count, +- &dig_connector->dp_clock); +- if (ret) { +- dig_connector->dp_lane_count = 0; +- dig_connector->dp_clock = 0; +- } ++ dig_connector->dp_lane_count = drm_dp_max_lane_count(dig_connector->dpcd); ++ dig_connector->dp_clock = drm_dp_max_link_rate(dig_connector->dpcd); + DRM_DEBUG_KMS("dig clock %p %d %d\n", dig_connector, + dig_connector->dp_lane_count, dig_connector->dp_clock); + } +diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c +index d2e628eea53d..d179596334a7 100644 +--- a/drivers/gpu/drm/radeon/radeon_fb.c ++++ b/drivers/gpu/drm/radeon/radeon_fb.c +@@ -292,7 +292,8 @@ out_unref: + + void radeon_fb_output_poll_changed(struct radeon_device *rdev) + { +- drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper); ++ if (rdev->mode_info.rfbdev) ++ drm_fb_helper_hotplug_event(&rdev->mode_info.rfbdev->helper); + } + + static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfbdev) +@@ -325,6 +326,10 @@ int radeon_fbdev_init(struct radeon_device *rdev) + int bpp_sel = 32; + int ret; + ++ /* don't enable fbdev if no connectors */ ++ if (list_empty(&rdev->ddev->mode_config.connector_list)) ++ return 0; ++ + /* select 8 bpp console on RN50 or 16MB cards */ + if (ASIC_IS_RN50(rdev) || rdev->mc.real_vram_size <= (32*1024*1024)) + bpp_sel = 8; +@@ -377,11 +382,15 @@ void radeon_fbdev_fini(struct radeon_device *rdev) + + void radeon_fbdev_set_suspend(struct radeon_device *rdev, int state) + { +- fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state); ++ if (rdev->mode_info.rfbdev) ++ fb_set_suspend(rdev->mode_info.rfbdev->helper.fbdev, state); + } + + bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj) + { ++ if (!rdev->mode_info.rfbdev) ++ return false; ++ + if (robj == gem_to_radeon_bo(rdev->mode_info.rfbdev->rfb.obj)) + return true; + return false; +@@ -389,12 +398,14 @@ bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj) + + void radeon_fb_add_connector(struct radeon_device *rdev, struct drm_connector *connector) + { +- drm_fb_helper_add_one_connector(&rdev->mode_info.rfbdev->helper, connector); ++ if (rdev->mode_info.rfbdev) ++ drm_fb_helper_add_one_connector(&rdev->mode_info.rfbdev->helper, connector); + } + + void radeon_fb_remove_connector(struct radeon_device *rdev, struct drm_connector *connector) + { +- drm_fb_helper_remove_one_connector(&rdev->mode_info.rfbdev->helper, connector); ++ if (rdev->mode_info.rfbdev) ++ drm_fb_helper_remove_one_connector(&rdev->mode_info.rfbdev->helper, connector); + } + + void radeon_fbdev_restore_mode(struct radeon_device *rdev) +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 22278bcfc60e..ac8eafea6361 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -499,11 +499,12 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data, + if (IS_ERR(bo)) + return PTR_ERR(bo); + +- ret = copy_from_user(bo->base.vaddr, ++ if (copy_from_user(bo->base.vaddr, + (void __user *)(uintptr_t)args->data, +- args->size); +- if (ret != 0) ++ args->size)) { ++ ret = -EFAULT; + goto fail; ++ } + /* Clear the rest of the memory from allocating from the BO + * cache. + */ +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 7e89288b1537..99446ffd71fb 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1891,6 +1891,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_ELITE_KBD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_EXTREME_3D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DUAL_ACTION) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WHEEL) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) }, +@@ -2615,9 +2616,10 @@ int hid_add_device(struct hid_device *hdev) + /* + * Scan generic devices for group information + */ +- if (hid_ignore_special_drivers || +- (!hdev->group && +- !hid_match_id(hdev, hid_have_special_driver))) { ++ if (hid_ignore_special_drivers) { ++ hdev->group = HID_GROUP_GENERIC; ++ } else if (!hdev->group && ++ !hid_match_id(hdev, hid_have_special_driver)) { + ret = hid_scan_report(hdev); + if (ret) + hid_warn(hdev, "bad device descriptor (%d)\n", ret); +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 296d4991560e..a20fc604ffd8 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -396,6 +396,11 @@ static void mt_feature_mapping(struct hid_device *hdev, + td->is_buttonpad = true; + + break; ++ case 0xff0000c5: ++ /* Retrieve the Win8 blob once to enable some devices */ ++ if (usage->usage_index == 0) ++ mt_get_feature(hdev, field->report); ++ break; + } + } + +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index b9216938a718..bb897497f008 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -283,17 +283,21 @@ static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType, + u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister); + u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister); + u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength); ++ u16 size; ++ int args_len; ++ int index = 0; ++ ++ i2c_hid_dbg(ihid, "%s\n", __func__); ++ ++ if (data_len > ihid->bufsize) ++ return -EINVAL; + +- /* hid_hw_* already checked that data_len < HID_MAX_BUFFER_SIZE */ +- u16 size = 2 /* size */ + ++ size = 2 /* size */ + + (reportID ? 1 : 0) /* reportID */ + + data_len /* buf */; +- int args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + ++ args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ + + 2 /* dataRegister */ + + size /* args */; +- int index = 0; +- +- i2c_hid_dbg(ihid, "%s\n", __func__); + + if (!use_data && maxOutputLength == 0) + return -ENOSYS; +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index cd4510a63375..146eed70bdf4 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -65,7 +65,7 @@ + #include <asm/mwait.h> + #include <asm/msr.h> + +-#define INTEL_IDLE_VERSION "0.4" ++#define INTEL_IDLE_VERSION "0.4.1" + #define PREFIX "intel_idle: " + + static struct cpuidle_driver intel_idle_driver = { +@@ -994,36 +994,92 @@ static void intel_idle_cpuidle_devices_uninit(void) + } + + /* +- * intel_idle_state_table_update() +- * +- * Update the default state_table for this CPU-id ++ * ivt_idle_state_table_update(void) + * +- * Currently used to access tuned IVT multi-socket targets ++ * Tune IVT multi-socket targets + * Assumption: num_sockets == (max_package_num + 1) + */ +-void intel_idle_state_table_update(void) ++static void ivt_idle_state_table_update(void) + { + /* IVT uses a different table for 1-2, 3-4, and > 4 sockets */ +- if (boot_cpu_data.x86_model == 0x3e) { /* IVT */ +- int cpu, package_num, num_sockets = 1; +- +- for_each_online_cpu(cpu) { +- package_num = topology_physical_package_id(cpu); +- if (package_num + 1 > num_sockets) { +- num_sockets = package_num + 1; +- +- if (num_sockets > 4) { +- cpuidle_state_table = ivt_cstates_8s; +- return; +- } ++ int cpu, package_num, num_sockets = 1; ++ ++ for_each_online_cpu(cpu) { ++ package_num = topology_physical_package_id(cpu); ++ if (package_num + 1 > num_sockets) { ++ num_sockets = package_num + 1; ++ ++ if (num_sockets > 4) { ++ cpuidle_state_table = ivt_cstates_8s; ++ return; + } + } ++ } ++ ++ if (num_sockets > 2) ++ cpuidle_state_table = ivt_cstates_4s; ++ ++ /* else, 1 and 2 socket systems use default ivt_cstates */ ++} ++/* ++ * sklh_idle_state_table_update(void) ++ * ++ * On SKL-H (model 0x5e) disable C8 and C9 if: ++ * C10 is enabled and SGX disabled ++ */ ++static void sklh_idle_state_table_update(void) ++{ ++ unsigned long long msr; ++ unsigned int eax, ebx, ecx, edx; ++ ++ ++ /* if PC10 disabled via cmdline intel_idle.max_cstate=7 or shallower */ ++ if (max_cstate <= 7) ++ return; ++ ++ /* if PC10 not present in CPUID.MWAIT.EDX */ ++ if ((mwait_substates & (0xF << 28)) == 0) ++ return; ++ ++ rdmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr); ++ ++ /* PC10 is not enabled in PKG C-state limit */ ++ if ((msr & 0xF) != 8) ++ return; ++ ++ ecx = 0; ++ cpuid(7, &eax, &ebx, &ecx, &edx); ++ ++ /* if SGX is present */ ++ if (ebx & (1 << 2)) { + +- if (num_sockets > 2) +- cpuidle_state_table = ivt_cstates_4s; +- /* else, 1 and 2 socket systems use default ivt_cstates */ ++ rdmsrl(MSR_IA32_FEATURE_CONTROL, msr); ++ ++ /* if SGX is enabled */ ++ if (msr & (1 << 18)) ++ return; ++ } ++ ++ skl_cstates[5].disabled = 1; /* C8-SKL */ ++ skl_cstates[6].disabled = 1; /* C9-SKL */ ++} ++/* ++ * intel_idle_state_table_update() ++ * ++ * Update the default state_table for this CPU-id ++ */ ++ ++static void intel_idle_state_table_update(void) ++{ ++ switch (boot_cpu_data.x86_model) { ++ ++ case 0x3e: /* IVT */ ++ ivt_idle_state_table_update(); ++ break; ++ case 0x5e: /* SKL-H */ ++ sklh_idle_state_table_update(); ++ break; + } +- return; + } + + /* +@@ -1063,6 +1119,14 @@ static int __init intel_idle_cpuidle_driver_init(void) + if (num_substates == 0) + continue; + ++ /* if state marked as disabled, skip it */ ++ if (cpuidle_state_table[cstate].disabled != 0) { ++ pr_debug(PREFIX "state %s is disabled", ++ cpuidle_state_table[cstate].name); ++ continue; ++ } ++ ++ + if (((mwait_cstate + 1) > 2) && + !boot_cpu_has(X86_FEATURE_NONSTOP_TSC)) + mark_tsc_unstable("TSC halts in idle" +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index f121e6129339..0e1a802c3618 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -65,6 +65,7 @@ isert_rdma_accept(struct isert_conn *isert_conn); + struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np); + + static void isert_release_work(struct work_struct *work); ++static void isert_wait4flush(struct isert_conn *isert_conn); + + static inline bool + isert_prot_cmd(struct isert_conn *conn, struct se_cmd *cmd) +@@ -820,12 +821,31 @@ isert_put_conn(struct isert_conn *isert_conn) + kref_put(&isert_conn->kref, isert_release_kref); + } + ++static void ++isert_handle_unbound_conn(struct isert_conn *isert_conn) ++{ ++ struct isert_np *isert_np = isert_conn->cm_id->context; ++ ++ mutex_lock(&isert_np->mutex); ++ if (!list_empty(&isert_conn->node)) { ++ /* ++ * This means iscsi doesn't know this connection ++ * so schedule a cleanup ourselves ++ */ ++ list_del_init(&isert_conn->node); ++ isert_put_conn(isert_conn); ++ complete(&isert_conn->wait); ++ queue_work(isert_release_wq, &isert_conn->release_work); ++ } ++ mutex_unlock(&isert_np->mutex); ++} ++ + /** + * isert_conn_terminate() - Initiate connection termination + * @isert_conn: isert connection struct + * + * Notes: +- * In case the connection state is FULL_FEATURE, move state ++ * In case the connection state is BOUND, move state + * to TEMINATING and start teardown sequence (rdma_disconnect). + * In case the connection state is UP, complete flush as well. + * +@@ -837,23 +857,19 @@ isert_conn_terminate(struct isert_conn *isert_conn) + { + int err; + +- switch (isert_conn->state) { +- case ISER_CONN_TERMINATING: +- break; +- case ISER_CONN_UP: +- case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ +- isert_info("Terminating conn %p state %d\n", +- isert_conn, isert_conn->state); +- isert_conn->state = ISER_CONN_TERMINATING; +- err = rdma_disconnect(isert_conn->cm_id); +- if (err) +- isert_warn("Failed rdma_disconnect isert_conn %p\n", +- isert_conn); +- break; +- default: +- isert_warn("conn %p teminating in state %d\n", +- isert_conn, isert_conn->state); +- } ++ if (isert_conn->state >= ISER_CONN_TERMINATING) ++ return; ++ ++ isert_info("Terminating conn %p state %d\n", ++ isert_conn, isert_conn->state); ++ isert_conn->state = ISER_CONN_TERMINATING; ++ err = rdma_disconnect(isert_conn->cm_id); ++ if (err) ++ isert_warn("Failed rdma_disconnect isert_conn %p\n", ++ isert_conn); ++ ++ isert_info("conn %p completing wait\n", isert_conn); ++ complete(&isert_conn->wait); + } + + static int +@@ -887,35 +903,27 @@ static int + isert_disconnected_handler(struct rdma_cm_id *cma_id, + enum rdma_cm_event_type event) + { +- struct isert_np *isert_np = cma_id->context; +- struct isert_conn *isert_conn; +- bool terminating = false; +- +- if (isert_np->cm_id == cma_id) +- return isert_np_cma_handler(cma_id->context, event); +- +- isert_conn = cma_id->qp->qp_context; ++ struct isert_conn *isert_conn = cma_id->qp->qp_context; + + mutex_lock(&isert_conn->mutex); +- terminating = (isert_conn->state == ISER_CONN_TERMINATING); +- isert_conn_terminate(isert_conn); +- mutex_unlock(&isert_conn->mutex); +- +- isert_info("conn %p completing wait\n", isert_conn); +- complete(&isert_conn->wait); +- +- if (terminating) +- goto out; +- +- mutex_lock(&isert_np->mutex); +- if (!list_empty(&isert_conn->node)) { +- list_del_init(&isert_conn->node); +- isert_put_conn(isert_conn); +- queue_work(isert_release_wq, &isert_conn->release_work); ++ switch (isert_conn->state) { ++ case ISER_CONN_TERMINATING: ++ break; ++ case ISER_CONN_UP: ++ isert_conn_terminate(isert_conn); ++ isert_wait4flush(isert_conn); ++ isert_handle_unbound_conn(isert_conn); ++ break; ++ case ISER_CONN_BOUND: ++ case ISER_CONN_FULL_FEATURE: /* FALLTHRU */ ++ iscsit_cause_connection_reinstatement(isert_conn->conn, 0); ++ break; ++ default: ++ isert_warn("conn %p teminating in state %d\n", ++ isert_conn, isert_conn->state); + } +- mutex_unlock(&isert_np->mutex); ++ mutex_unlock(&isert_conn->mutex); + +-out: + return 0; + } + +@@ -934,12 +942,16 @@ isert_connect_error(struct rdma_cm_id *cma_id) + static int + isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) + { ++ struct isert_np *isert_np = cma_id->context; + int ret = 0; + + isert_info("%s (%d): status %d id %p np %p\n", + rdma_event_msg(event->event), event->event, + event->status, cma_id, cma_id->context); + ++ if (isert_np->cm_id == cma_id) ++ return isert_np_cma_handler(cma_id->context, event->event); ++ + switch (event->event) { + case RDMA_CM_EVENT_CONNECT_REQUEST: + ret = isert_connect_request(cma_id, event); +@@ -985,13 +997,10 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count) + rx_wr--; + rx_wr->next = NULL; /* mark end of work requests list */ + +- isert_conn->post_recv_buf_count += count; + ret = ib_post_recv(isert_conn->qp, isert_conn->rx_wr, + &rx_wr_failed); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed with ret: %d\n", ret); +- isert_conn->post_recv_buf_count -= count; +- } + + return ret; + } +@@ -1007,12 +1016,9 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc) + rx_wr.num_sge = 1; + rx_wr.next = NULL; + +- isert_conn->post_recv_buf_count++; + ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_failed); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed with ret: %d\n", ret); +- isert_conn->post_recv_buf_count--; +- } + + return ret; + } +@@ -1132,12 +1138,9 @@ isert_rdma_post_recvl(struct isert_conn *isert_conn) + rx_wr.sg_list = &sge; + rx_wr.num_sge = 1; + +- isert_conn->post_recv_buf_count++; + ret = ib_post_recv(isert_conn->qp, &rx_wr, &rx_wr_fail); +- if (ret) { ++ if (ret) + isert_err("ib_post_recv() failed: %d\n", ret); +- isert_conn->post_recv_buf_count--; +- } + + return ret; + } +@@ -1633,7 +1636,6 @@ isert_rcv_completion(struct iser_rx_desc *desc, + ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen, + DMA_FROM_DEVICE); + +- isert_conn->post_recv_buf_count--; + } + + static int +@@ -2048,7 +2050,8 @@ is_isert_tx_desc(struct isert_conn *isert_conn, void *wr_id) + void *start = isert_conn->rx_descs; + int len = ISERT_QP_MAX_RECV_DTOS * sizeof(*isert_conn->rx_descs); + +- if (wr_id >= start && wr_id < start + len) ++ if ((wr_id >= start && wr_id < start + len) || ++ (wr_id == isert_conn->login_req_buf)) + return false; + + return true; +@@ -2072,10 +2075,6 @@ isert_cq_comp_err(struct isert_conn *isert_conn, struct ib_wc *wc) + isert_unmap_tx_desc(desc, ib_dev); + else + isert_completion_put(desc, isert_cmd, ib_dev, true); +- } else { +- isert_conn->post_recv_buf_count--; +- if (!isert_conn->post_recv_buf_count) +- iscsit_cause_connection_reinstatement(isert_conn->conn, 0); + } + } + +@@ -3214,6 +3213,7 @@ accept_wait: + + conn->context = isert_conn; + isert_conn->conn = conn; ++ isert_conn->state = ISER_CONN_BOUND; + + isert_set_conn_info(np, conn, isert_conn); + +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index 8d50453eef66..1aa019ab9d78 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -84,6 +84,7 @@ enum iser_ib_op_code { + enum iser_conn_state { + ISER_CONN_INIT, + ISER_CONN_UP, ++ ISER_CONN_BOUND, + ISER_CONN_FULL_FEATURE, + ISER_CONN_TERMINATING, + ISER_CONN_DOWN, +@@ -179,7 +180,6 @@ struct isert_device; + + struct isert_conn { + enum iser_conn_state state; +- int post_recv_buf_count; + u32 responder_resources; + u32 initiator_depth; + bool pi_support; +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 0c37fee363b1..4328679a67a7 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1670,47 +1670,6 @@ send_sense: + return -1; + } + +-/** +- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag. +- * @ch: RDMA channel of the task management request. +- * @fn: Task management function to perform. +- * @req_tag: Tag of the SRP task management request. +- * @mgmt_ioctx: I/O context of the task management request. +- * +- * Returns zero if the target core will process the task management +- * request asynchronously. +- * +- * Note: It is assumed that the initiator serializes tag-based task management +- * requests. +- */ +-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag) +-{ +- struct srpt_device *sdev; +- struct srpt_rdma_ch *ch; +- struct srpt_send_ioctx *target; +- int ret, i; +- +- ret = -EINVAL; +- ch = ioctx->ch; +- BUG_ON(!ch); +- BUG_ON(!ch->sport); +- sdev = ch->sport->sdev; +- BUG_ON(!sdev); +- spin_lock_irq(&sdev->spinlock); +- for (i = 0; i < ch->rq_size; ++i) { +- target = ch->ioctx_ring[i]; +- if (target->cmd.se_lun == ioctx->cmd.se_lun && +- target->cmd.tag == tag && +- srpt_get_cmd_state(target) != SRPT_STATE_DONE) { +- ret = 0; +- /* now let the target core abort &target->cmd; */ +- break; +- } +- } +- spin_unlock_irq(&sdev->spinlock); +- return ret; +-} +- + static int srp_tmr_to_tcm(int fn) + { + switch (fn) { +@@ -1745,7 +1704,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch, + struct se_cmd *cmd; + struct se_session *sess = ch->sess; + uint64_t unpacked_lun; +- uint32_t tag = 0; + int tcm_tmr; + int rc; + +@@ -1761,25 +1719,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch, + srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT); + send_ioctx->cmd.tag = srp_tsk->tag; + tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func); +- if (tcm_tmr < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED; +- goto fail; +- } + unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun, + sizeof(srp_tsk->lun)); +- +- if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) { +- rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag); +- if (rc < 0) { +- send_ioctx->cmd.se_tmr_req->response = +- TMR_TASK_DOES_NOT_EXIST; +- goto fail; +- } +- tag = srp_tsk->task_tag; +- } + rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun, +- srp_tsk, tcm_tmr, GFP_KERNEL, tag, ++ srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag, + TARGET_SCF_ACK_KREF); + if (rc != 0) { + send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED; +diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c +index cfd58e87da26..1c5914cae853 100644 +--- a/drivers/input/misc/ati_remote2.c ++++ b/drivers/input/misc/ati_remote2.c +@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + ar2->udev = udev; + ++ /* Sanity check, first interface must have an endpoint */ ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 0 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail1; ++ } + ar2->intf[0] = interface; + ar2->ep[0] = &alt->endpoint[0].desc; + ++ /* Sanity check, the device must have two interfaces */ + ar2->intf[1] = usb_ifnum_to_if(udev, 1); ++ if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) { ++ dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n", ++ __func__, udev->actconfig->desc.bNumInterfaces); ++ r = -ENODEV; ++ goto fail1; ++ } ++ + r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2); + if (r) + goto fail1; ++ ++ /* Sanity check, second interface must have an endpoint */ + alt = ar2->intf[1]->cur_altsetting; ++ if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) { ++ dev_err(&interface->dev, ++ "%s(): interface 1 must have an endpoint\n", __func__); ++ r = -ENODEV; ++ goto fail2; ++ } + ar2->ep[1] = &alt->endpoint[0].desc; + + r = ati_remote2_urb_init(ar2); + if (r) +- goto fail2; ++ goto fail3; + + ar2->channel_mask = channel_mask; + ar2->mode_mask = mode_mask; + + r = ati_remote2_setup(ar2, ar2->channel_mask); + if (r) +- goto fail2; ++ goto fail3; + + usb_make_path(udev, ar2->phys, sizeof(ar2->phys)); + strlcat(ar2->phys, "/input0", sizeof(ar2->phys)); +@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group); + if (r) +- goto fail2; ++ goto fail3; + + r = ati_remote2_input_init(ar2); + if (r) +- goto fail3; ++ goto fail4; + + usb_set_intfdata(interface, ar2); + +@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d + + return 0; + +- fail3: ++ fail4: + sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group); +- fail2: ++ fail3: + ati_remote2_urb_cleanup(ar2); ++ fail2: + usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]); + fail1: + kfree(ar2); +diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c +index ac1fa5f44580..9c0ea36913b4 100644 +--- a/drivers/input/misc/ims-pcu.c ++++ b/drivers/input/misc/ims-pcu.c +@@ -1663,6 +1663,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bMasterInterface0); ++ if (!pcu->ctrl_intf) ++ return -EINVAL; + + alt = pcu->ctrl_intf->cur_altsetting; + pcu->ep_ctrl = &alt->endpoint[0].desc; +@@ -1670,6 +1672,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc + + pcu->data_intf = usb_ifnum_to_if(pcu->udev, + union_desc->bSlaveInterface0); ++ if (!pcu->data_intf) ++ return -EINVAL; + + alt = pcu->data_intf->cur_altsetting; + if (alt->desc.bNumEndpoints != 2) { +diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c +index 63b539d3daba..84909a12ff36 100644 +--- a/drivers/input/misc/powermate.c ++++ b/drivers/input/misc/powermate.c +@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i + int error = -ENOMEM; + + interface = intf->cur_altsetting; ++ if (interface->desc.bNumEndpoints < 1) ++ return -EINVAL; ++ + endpoint = &interface->endpoint[0].desc; + if (!usb_endpoint_is_int_in(endpoint)) + return -EIO; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 6025eb430c0a..a41d8328c064 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -862,8 +862,9 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse, + if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap)) + return; + +- /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */ +- if (SYN_ID_FULL(priv->identity) == 0x801 && ++ /* Bug in FW 8.1 & 8.2, buttons are reported only when ExtBit is 1 */ ++ if ((SYN_ID_FULL(priv->identity) == 0x801 || ++ SYN_ID_FULL(priv->identity) == 0x802) && + !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02)) + return; + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 8d0ead98eb6e..a296425a7270 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1015,8 +1015,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + */ + atomic_set(&dc->count, 1); + +- if (bch_cached_dev_writeback_start(dc)) ++ /* Block writeback thread, but spawn it */ ++ down_write(&dc->writeback_lock); ++ if (bch_cached_dev_writeback_start(dc)) { ++ up_write(&dc->writeback_lock); + return -ENOMEM; ++ } + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { + bch_sectors_dirty_init(dc); +@@ -1028,6 +1032,9 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + bch_cached_dev_run(dc); + bcache_device_link(&dc->disk, c, "bdev"); + ++ /* Allow the writeback thread to proceed */ ++ up_write(&dc->writeback_lock); ++ + pr_info("Caching %s as %s on set %pU", + bdevname(dc->bdev, buf), dc->disk.disk->disk_name, + dc->disk.c->sb.set_uuid); +@@ -1366,6 +1373,9 @@ static void cache_set_flush(struct closure *cl) + struct btree *b; + unsigned i; + ++ if (!c) ++ closure_return(cl); ++ + bch_cache_accounting_destroy(&c->accounting); + + kobject_put(&c->internal); +@@ -1828,11 +1838,12 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) + return 0; + } + +-static void register_cache(struct cache_sb *sb, struct page *sb_page, ++static int register_cache(struct cache_sb *sb, struct page *sb_page, + struct block_device *bdev, struct cache *ca) + { + char name[BDEVNAME_SIZE]; +- const char *err = "cannot allocate memory"; ++ const char *err = NULL; ++ int ret = 0; + + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); + ca->bdev = bdev; +@@ -1847,27 +1858,35 @@ static void register_cache(struct cache_sb *sb, struct page *sb_page, + if (blk_queue_discard(bdev_get_queue(ca->bdev))) + ca->discard = CACHE_DISCARD(&ca->sb); + +- if (cache_alloc(sb, ca) != 0) ++ ret = cache_alloc(sb, ca); ++ if (ret != 0) + goto err; + +- err = "error creating kobject"; +- if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) +- goto err; ++ if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) { ++ err = "error calling kobject_add"; ++ ret = -ENOMEM; ++ goto out; ++ } + + mutex_lock(&bch_register_lock); + err = register_cache_set(ca); + mutex_unlock(&bch_register_lock); + +- if (err) +- goto err; ++ if (err) { ++ ret = -ENODEV; ++ goto out; ++ } + + pr_info("registered cache device %s", bdevname(bdev, name)); ++ + out: + kobject_put(&ca->kobj); +- return; ++ + err: +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); +- goto out; ++ if (err) ++ pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ ++ return ret; + } + + /* Global interfaces/init */ +@@ -1965,7 +1984,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, + if (!ca) + goto err_close; + +- register_cache(sb, sb_page, bdev, ca); ++ if (register_cache(sb, sb_page, bdev, ca) != 0) ++ goto err_close; + } + out: + if (sb_page) +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index f6543f3a970f..27f2ef300f8b 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -867,19 +867,40 @@ static int blocks_are_unmapped_or_clean(struct dm_cache_metadata *cmd, + return 0; + } + +-#define WRITE_LOCK(cmd) \ +- if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ ++#define WRITE_LOCK(cmd) \ ++ down_write(&cmd->root_lock); \ ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ ++ up_write(&cmd->root_lock); \ + return -EINVAL; \ +- down_write(&cmd->root_lock) ++ } + + #define WRITE_LOCK_VOID(cmd) \ +- if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) \ ++ down_write(&cmd->root_lock); \ ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ ++ up_write(&cmd->root_lock); \ + return; \ +- down_write(&cmd->root_lock) ++ } + + #define WRITE_UNLOCK(cmd) \ + up_write(&cmd->root_lock) + ++#define READ_LOCK(cmd) \ ++ down_read(&cmd->root_lock); \ ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ ++ up_read(&cmd->root_lock); \ ++ return -EINVAL; \ ++ } ++ ++#define READ_LOCK_VOID(cmd) \ ++ down_read(&cmd->root_lock); \ ++ if (cmd->fail_io || dm_bm_is_read_only(cmd->bm)) { \ ++ up_read(&cmd->root_lock); \ ++ return; \ ++ } ++ ++#define READ_UNLOCK(cmd) \ ++ up_read(&cmd->root_lock) ++ + int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size) + { + int r; +@@ -1015,22 +1036,20 @@ int dm_cache_load_discards(struct dm_cache_metadata *cmd, + { + int r; + +- down_read(&cmd->root_lock); ++ READ_LOCK(cmd); + r = __load_discards(cmd, fn, context); +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + + return r; + } + +-dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd) ++int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result) + { +- dm_cblock_t r; ++ READ_LOCK(cmd); ++ *result = cmd->cache_blocks; ++ READ_UNLOCK(cmd); + +- down_read(&cmd->root_lock); +- r = cmd->cache_blocks; +- up_read(&cmd->root_lock); +- +- return r; ++ return 0; + } + + static int __remove(struct dm_cache_metadata *cmd, dm_cblock_t cblock) +@@ -1188,9 +1207,9 @@ int dm_cache_load_mappings(struct dm_cache_metadata *cmd, + { + int r; + +- down_read(&cmd->root_lock); ++ READ_LOCK(cmd); + r = __load_mappings(cmd, policy, fn, context); +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + + return r; + } +@@ -1215,18 +1234,18 @@ static int __dump_mappings(struct dm_cache_metadata *cmd) + + void dm_cache_dump(struct dm_cache_metadata *cmd) + { +- down_read(&cmd->root_lock); ++ READ_LOCK_VOID(cmd); + __dump_mappings(cmd); +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + } + + int dm_cache_changed_this_transaction(struct dm_cache_metadata *cmd) + { + int r; + +- down_read(&cmd->root_lock); ++ READ_LOCK(cmd); + r = cmd->changed; +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + + return r; + } +@@ -1276,9 +1295,9 @@ int dm_cache_set_dirty(struct dm_cache_metadata *cmd, + void dm_cache_metadata_get_stats(struct dm_cache_metadata *cmd, + struct dm_cache_statistics *stats) + { +- down_read(&cmd->root_lock); ++ READ_LOCK_VOID(cmd); + *stats = cmd->stats; +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + } + + void dm_cache_metadata_set_stats(struct dm_cache_metadata *cmd, +@@ -1312,9 +1331,9 @@ int dm_cache_get_free_metadata_block_count(struct dm_cache_metadata *cmd, + { + int r = -EINVAL; + +- down_read(&cmd->root_lock); ++ READ_LOCK(cmd); + r = dm_sm_get_nr_free(cmd->metadata_sm, result); +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + + return r; + } +@@ -1324,9 +1343,9 @@ int dm_cache_get_metadata_dev_size(struct dm_cache_metadata *cmd, + { + int r = -EINVAL; + +- down_read(&cmd->root_lock); ++ READ_LOCK(cmd); + r = dm_sm_get_nr_blocks(cmd->metadata_sm, result); +- up_read(&cmd->root_lock); ++ READ_UNLOCK(cmd); + + return r; + } +@@ -1417,7 +1436,13 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy * + + int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result) + { +- return blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result); ++ int r; ++ ++ READ_LOCK(cmd); ++ r = blocks_are_unmapped_or_clean(cmd, 0, cmd->cache_blocks, result); ++ READ_UNLOCK(cmd); ++ ++ return r; + } + + void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd) +@@ -1440,10 +1465,7 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd) + struct dm_block *sblock; + struct cache_disk_superblock *disk_super; + +- /* +- * We ignore fail_io for this function. +- */ +- down_write(&cmd->root_lock); ++ WRITE_LOCK(cmd); + set_bit(NEEDS_CHECK, &cmd->flags); + + r = superblock_lock(cmd, &sblock); +@@ -1458,19 +1480,17 @@ int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd) + dm_bm_unlock(sblock); + + out: +- up_write(&cmd->root_lock); ++ WRITE_UNLOCK(cmd); + return r; + } + +-bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd) ++int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result) + { +- bool needs_check; ++ READ_LOCK(cmd); ++ *result = !!test_bit(NEEDS_CHECK, &cmd->flags); ++ READ_UNLOCK(cmd); + +- down_read(&cmd->root_lock); +- needs_check = !!test_bit(NEEDS_CHECK, &cmd->flags); +- up_read(&cmd->root_lock); +- +- return needs_check; ++ return 0; + } + + int dm_cache_metadata_abort(struct dm_cache_metadata *cmd) +diff --git a/drivers/md/dm-cache-metadata.h b/drivers/md/dm-cache-metadata.h +index 2ffee21f318d..8528744195e5 100644 +--- a/drivers/md/dm-cache-metadata.h ++++ b/drivers/md/dm-cache-metadata.h +@@ -66,7 +66,7 @@ void dm_cache_metadata_close(struct dm_cache_metadata *cmd); + * origin blocks to map to. + */ + int dm_cache_resize(struct dm_cache_metadata *cmd, dm_cblock_t new_cache_size); +-dm_cblock_t dm_cache_size(struct dm_cache_metadata *cmd); ++int dm_cache_size(struct dm_cache_metadata *cmd, dm_cblock_t *result); + + int dm_cache_discard_bitset_resize(struct dm_cache_metadata *cmd, + sector_t discard_block_size, +@@ -137,7 +137,7 @@ int dm_cache_write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy * + */ + int dm_cache_metadata_all_clean(struct dm_cache_metadata *cmd, bool *result); + +-bool dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd); ++int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result); + int dm_cache_metadata_set_needs_check(struct dm_cache_metadata *cmd); + void dm_cache_metadata_set_read_only(struct dm_cache_metadata *cmd); + void dm_cache_metadata_set_read_write(struct dm_cache_metadata *cmd); +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 5780accffa30..bb9b92ebbf8e 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -984,9 +984,14 @@ static void notify_mode_switch(struct cache *cache, enum cache_metadata_mode mod + + static void set_cache_mode(struct cache *cache, enum cache_metadata_mode new_mode) + { +- bool needs_check = dm_cache_metadata_needs_check(cache->cmd); ++ bool needs_check; + enum cache_metadata_mode old_mode = get_cache_mode(cache); + ++ if (dm_cache_metadata_needs_check(cache->cmd, &needs_check)) { ++ DMERR("unable to read needs_check flag, setting failure mode"); ++ new_mode = CM_FAIL; ++ } ++ + if (new_mode == CM_WRITE && needs_check) { + DMERR("%s: unable to switch cache to write mode until repaired.", + cache_device_name(cache)); +@@ -3510,6 +3515,7 @@ static void cache_status(struct dm_target *ti, status_type_t type, + char buf[BDEVNAME_SIZE]; + struct cache *cache = ti->private; + dm_cblock_t residency; ++ bool needs_check; + + switch (type) { + case STATUSTYPE_INFO: +@@ -3583,7 +3589,9 @@ static void cache_status(struct dm_target *ti, status_type_t type, + else + DMEMIT("rw "); + +- if (dm_cache_metadata_needs_check(cache->cmd)) ++ r = dm_cache_metadata_needs_check(cache->cmd, &needs_check); ++ ++ if (r || needs_check) + DMEMIT("needs_check "); + else + DMEMIT("- "); +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 3766386080a4..e4d1bafe78c1 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1105,6 +1105,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + int i; + int r = -EINVAL; + char *origin_path, *cow_path; ++ dev_t origin_dev, cow_dev; + unsigned args_used, num_flush_bios = 1; + fmode_t origin_mode = FMODE_READ; + +@@ -1135,11 +1136,19 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + ti->error = "Cannot get origin device"; + goto bad_origin; + } ++ origin_dev = s->origin->bdev->bd_dev; + + cow_path = argv[0]; + argv++; + argc--; + ++ cow_dev = dm_get_dev_t(cow_path); ++ if (cow_dev && cow_dev == origin_dev) { ++ ti->error = "COW device cannot be the same as origin device"; ++ r = -EINVAL; ++ goto bad_cow; ++ } ++ + r = dm_get_device(ti, cow_path, dm_table_get_mode(ti->table), &s->cow); + if (r) { + ti->error = "Cannot get COW device"; +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 061152a43730..cb5d0daf53bb 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -365,6 +365,26 @@ static int upgrade_mode(struct dm_dev_internal *dd, fmode_t new_mode, + } + + /* ++ * Convert the path to a device ++ */ ++dev_t dm_get_dev_t(const char *path) ++{ ++ dev_t uninitialized_var(dev); ++ struct block_device *bdev; ++ ++ bdev = lookup_bdev(path); ++ if (IS_ERR(bdev)) ++ dev = name_to_dev_t(path); ++ else { ++ dev = bdev->bd_dev; ++ bdput(bdev); ++ } ++ ++ return dev; ++} ++EXPORT_SYMBOL_GPL(dm_get_dev_t); ++ ++/* + * Add a device to the list, or just increment the usage count if + * it's already present. + */ +@@ -372,23 +392,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, + struct dm_dev **result) + { + int r; +- dev_t uninitialized_var(dev); ++ dev_t dev; + struct dm_dev_internal *dd; + struct dm_table *t = ti->table; +- struct block_device *bdev; + + BUG_ON(!t); + +- /* convert the path to a device */ +- bdev = lookup_bdev(path); +- if (IS_ERR(bdev)) { +- dev = name_to_dev_t(path); +- if (!dev) +- return -ENODEV; +- } else { +- dev = bdev->bd_dev; +- bdput(bdev); +- } ++ dev = dm_get_dev_t(path); ++ if (!dev) ++ return -ENODEV; + + dd = find_device(&t->devices, dev); + if (!dd) { +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index f962d6453afd..185010d9cccc 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -1981,5 +1981,8 @@ bool dm_pool_metadata_needs_check(struct dm_pool_metadata *pmd) + + void dm_pool_issue_prefetches(struct dm_pool_metadata *pmd) + { +- dm_tm_issue_prefetches(pmd->tm); ++ down_read(&pmd->root_lock); ++ if (!pmd->fail_io) ++ dm_tm_issue_prefetches(pmd->tm); ++ up_read(&pmd->root_lock); + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index dd834927bc66..c338aebb4ccd 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1109,12 +1109,8 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue) + * back into ->request_fn() could deadlock attempting to grab the + * queue lock again. + */ +- if (run_queue) { +- if (md->queue->mq_ops) +- blk_mq_run_hw_queues(md->queue, true); +- else +- blk_run_queue_async(md->queue); +- } ++ if (!md->queue->mq_ops && run_queue) ++ blk_run_queue_async(md->queue); + + /* + * dm_put() must be at the end of this function. See the comment above +@@ -1214,9 +1210,9 @@ static void dm_requeue_original_request(struct mapped_device *md, + { + int rw = rq_data_dir(rq); + ++ rq_end_stats(md, rq); + dm_unprep_request(rq); + +- rq_end_stats(md, rq); + if (!rq->q->mq_ops) + old_requeue_request(rq); + else { +@@ -1336,7 +1332,10 @@ static void dm_complete_request(struct request *rq, int error) + struct dm_rq_target_io *tio = tio_from_request(rq); + + tio->error = error; +- blk_complete_request(rq); ++ if (!rq->q->mq_ops) ++ blk_complete_request(rq); ++ else ++ blk_mq_complete_request(rq, error); + } + + /* +diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c +index 0a72ab6e6c20..dd483bb2e111 100644 +--- a/drivers/md/multipath.c ++++ b/drivers/md/multipath.c +@@ -129,7 +129,9 @@ static void multipath_make_request(struct mddev *mddev, struct bio * bio) + } + multipath = conf->multipaths + mp_bh->path; + +- mp_bh->bio = *bio; ++ bio_init(&mp_bh->bio); ++ __bio_clone_fast(&mp_bh->bio, bio); ++ + mp_bh->bio.bi_iter.bi_sector += multipath->rdev->data_offset; + mp_bh->bio.bi_bdev = multipath->rdev->bdev; + mp_bh->bio.bi_rw |= REQ_FAILFAST_TRANSPORT; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 4e3843f7d245..bb5bce059eb4 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2274,6 +2274,7 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio) + if (fail) { + spin_lock_irq(&conf->device_lock); + list_add(&r1_bio->retry_list, &conf->bio_end_io_list); ++ conf->nr_queued++; + spin_unlock_irq(&conf->device_lock); + md_wakeup_thread(conf->mddev->thread); + } else { +@@ -2391,8 +2392,10 @@ static void raid1d(struct md_thread *thread) + LIST_HEAD(tmp); + spin_lock_irqsave(&conf->device_lock, flags); + if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) { +- list_add(&tmp, &conf->bio_end_io_list); +- list_del_init(&conf->bio_end_io_list); ++ while (!list_empty(&conf->bio_end_io_list)) { ++ list_move(conf->bio_end_io_list.prev, &tmp); ++ conf->nr_queued--; ++ } + } + spin_unlock_irqrestore(&conf->device_lock, flags); + while (!list_empty(&tmp)) { +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 1c1447dd3417..e3fd725d5c4d 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2664,6 +2664,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) + if (fail) { + spin_lock_irq(&conf->device_lock); + list_add(&r10_bio->retry_list, &conf->bio_end_io_list); ++ conf->nr_queued++; + spin_unlock_irq(&conf->device_lock); + md_wakeup_thread(conf->mddev->thread); + } else { +@@ -2691,8 +2692,10 @@ static void raid10d(struct md_thread *thread) + LIST_HEAD(tmp); + spin_lock_irqsave(&conf->device_lock, flags); + if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) { +- list_add(&tmp, &conf->bio_end_io_list); +- list_del_init(&conf->bio_end_io_list); ++ while (!list_empty(&conf->bio_end_io_list)) { ++ list_move(conf->bio_end_io_list.prev, &tmp); ++ conf->nr_queued--; ++ } + } + spin_unlock_irqrestore(&conf->device_lock, flags); + while (!list_empty(&tmp)) { +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index b4f02c9959f2..32d52878f182 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -340,8 +340,7 @@ static void release_inactive_stripe_list(struct r5conf *conf, + int hash) + { + int size; +- unsigned long do_wakeup = 0; +- int i = 0; ++ bool do_wakeup = false; + unsigned long flags; + + if (hash == NR_STRIPE_HASH_LOCKS) { +@@ -362,19 +361,15 @@ static void release_inactive_stripe_list(struct r5conf *conf, + !list_empty(list)) + atomic_dec(&conf->empty_inactive_list_nr); + list_splice_tail_init(list, conf->inactive_list + hash); +- do_wakeup |= 1 << hash; ++ do_wakeup = true; + spin_unlock_irqrestore(conf->hash_locks + hash, flags); + } + size--; + hash--; + } + +- for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) { +- if (do_wakeup & (1 << i)) +- wake_up(&conf->wait_for_stripe[i]); +- } +- + if (do_wakeup) { ++ wake_up(&conf->wait_for_stripe); + if (atomic_read(&conf->active_stripes) == 0) + wake_up(&conf->wait_for_quiescent); + if (conf->retry_read_aligned) +@@ -687,15 +682,14 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector, + if (!sh) { + set_bit(R5_INACTIVE_BLOCKED, + &conf->cache_state); +- wait_event_exclusive_cmd( +- conf->wait_for_stripe[hash], ++ wait_event_lock_irq( ++ conf->wait_for_stripe, + !list_empty(conf->inactive_list + hash) && + (atomic_read(&conf->active_stripes) + < (conf->max_nr_stripes * 3 / 4) + || !test_bit(R5_INACTIVE_BLOCKED, + &conf->cache_state)), +- spin_unlock_irq(conf->hash_locks + hash), +- spin_lock_irq(conf->hash_locks + hash)); ++ *(conf->hash_locks + hash)); + clear_bit(R5_INACTIVE_BLOCKED, + &conf->cache_state); + } else { +@@ -720,9 +714,6 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector, + } + } while (sh == NULL); + +- if (!list_empty(conf->inactive_list + hash)) +- wake_up(&conf->wait_for_stripe[hash]); +- + spin_unlock_irq(conf->hash_locks + hash); + return sh; + } +@@ -2089,6 +2080,14 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors) + unsigned long cpu; + int err = 0; + ++ /* ++ * Never shrink. And mddev_suspend() could deadlock if this is called ++ * from raid5d. In that case, scribble_disks and scribble_sectors ++ * should equal to new_disks and new_sectors ++ */ ++ if (conf->scribble_disks >= new_disks && ++ conf->scribble_sectors >= new_sectors) ++ return 0; + mddev_suspend(conf->mddev); + get_online_cpus(); + for_each_present_cpu(cpu) { +@@ -2110,6 +2109,10 @@ static int resize_chunks(struct r5conf *conf, int new_disks, int new_sectors) + } + put_online_cpus(); + mddev_resume(conf->mddev); ++ if (!err) { ++ conf->scribble_disks = new_disks; ++ conf->scribble_sectors = new_sectors; ++ } + return err; + } + +@@ -2190,7 +2193,7 @@ static int resize_stripes(struct r5conf *conf, int newsize) + cnt = 0; + list_for_each_entry(nsh, &newstripes, lru) { + lock_device_hash_lock(conf, hash); +- wait_event_exclusive_cmd(conf->wait_for_stripe[hash], ++ wait_event_cmd(conf->wait_for_stripe, + !list_empty(conf->inactive_list + hash), + unlock_device_hash_lock(conf, hash), + lock_device_hash_lock(conf, hash)); +@@ -4236,7 +4239,6 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, + WARN_ON_ONCE(sh->state & ((1 << STRIPE_ACTIVE) | + (1 << STRIPE_SYNCING) | + (1 << STRIPE_REPLACED) | +- (1 << STRIPE_PREREAD_ACTIVE) | + (1 << STRIPE_DELAYED) | + (1 << STRIPE_BIT_DELAY) | + (1 << STRIPE_FULL_WRITE) | +@@ -4251,6 +4253,7 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, + (1 << STRIPE_REPLACED))); + + set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS | ++ (1 << STRIPE_PREREAD_ACTIVE) | + (1 << STRIPE_DEGRADED)), + head_sh->state & (1 << STRIPE_INSYNC)); + +@@ -6413,6 +6416,12 @@ static int raid5_alloc_percpu(struct r5conf *conf) + } + put_online_cpus(); + ++ if (!err) { ++ conf->scribble_disks = max(conf->raid_disks, ++ conf->previous_raid_disks); ++ conf->scribble_sectors = max(conf->chunk_sectors, ++ conf->prev_chunk_sectors); ++ } + return err; + } + +@@ -6503,9 +6512,7 @@ static struct r5conf *setup_conf(struct mddev *mddev) + seqcount_init(&conf->gen_lock); + mutex_init(&conf->cache_size_mutex); + init_waitqueue_head(&conf->wait_for_quiescent); +- for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) { +- init_waitqueue_head(&conf->wait_for_stripe[i]); +- } ++ init_waitqueue_head(&conf->wait_for_stripe); + init_waitqueue_head(&conf->wait_for_overlap); + INIT_LIST_HEAD(&conf->handle_list); + INIT_LIST_HEAD(&conf->hold_list); +@@ -7014,8 +7021,8 @@ static int raid5_run(struct mddev *mddev) + } + + if (discard_supported && +- mddev->queue->limits.max_discard_sectors >= stripe && +- mddev->queue->limits.discard_granularity >= stripe) ++ mddev->queue->limits.max_discard_sectors >= (stripe >> 9) && ++ mddev->queue->limits.discard_granularity >= stripe) + queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, + mddev->queue); + else +diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h +index a415e1cd39b8..517d4b68a1be 100644 +--- a/drivers/md/raid5.h ++++ b/drivers/md/raid5.h +@@ -510,6 +510,8 @@ struct r5conf { + * conversions + */ + } __percpu *percpu; ++ int scribble_disks; ++ int scribble_sectors; + #ifdef CONFIG_HOTPLUG_CPU + struct notifier_block cpu_notify; + #endif +@@ -522,7 +524,7 @@ struct r5conf { + atomic_t empty_inactive_list_nr; + struct llist_head released_stripes; + wait_queue_head_t wait_for_quiescent; +- wait_queue_head_t wait_for_stripe[NR_STRIPE_HASH_LOCKS]; ++ wait_queue_head_t wait_for_stripe; + wait_queue_head_t wait_for_overlap; + unsigned long cache_state; + #define R5_INACTIVE_BLOCKED 1 /* release of inactive stripes blocked, +diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c +index 471fd23b5c5c..08d2c6bf7341 100644 +--- a/drivers/media/i2c/adv7511.c ++++ b/drivers/media/i2c/adv7511.c +@@ -1161,12 +1161,23 @@ static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, in + } + } + ++static void adv7511_notify_no_edid(struct v4l2_subdev *sd) ++{ ++ struct adv7511_state *state = get_adv7511_state(sd); ++ struct adv7511_edid_detect ed; ++ ++ /* We failed to read the EDID, so send an event for this. */ ++ ed.present = false; ++ ed.segment = adv7511_rd(sd, 0xc4); ++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); ++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0); ++} ++ + static void adv7511_edid_handler(struct work_struct *work) + { + struct delayed_work *dwork = to_delayed_work(work); + struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler); + struct v4l2_subdev *sd = &state->sd; +- struct adv7511_edid_detect ed; + + v4l2_dbg(1, debug, sd, "%s:\n", __func__); + +@@ -1191,9 +1202,7 @@ static void adv7511_edid_handler(struct work_struct *work) + } + + /* We failed to read the EDID, so send an event for this. */ +- ed.present = false; +- ed.segment = adv7511_rd(sd, 0xc4); +- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); ++ adv7511_notify_no_edid(sd); + v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__); + } + +@@ -1264,7 +1273,6 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) + /* update read only ctrls */ + v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0); + v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0); +- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); + + if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) { + v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__); +@@ -1294,6 +1302,7 @@ static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd) + } + adv7511_s_power(sd, false); + memset(&state->edid, 0, sizeof(struct adv7511_state_edid)); ++ adv7511_notify_no_edid(sd); + } + } + +@@ -1370,6 +1379,7 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd) + } + /* one more segment read ok */ + state->edid.segments = segment + 1; ++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1); + if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) { + /* Request next EDID segment */ + v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments); +@@ -1389,7 +1399,6 @@ static bool adv7511_check_edid_status(struct v4l2_subdev *sd) + ed.present = true; + ed.segment = 0; + state->edid_detect_counter++; +- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); + v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); + return ed.present; + } +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 9400e996087b..bedbd51fb77c 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -2334,6 +2334,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, void *priv, + return 0; + } + ++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt, ++ unsigned int *width_mask, ++ unsigned int *width_bias) ++{ ++ if (fmt->flags & FORMAT_FLAGS_PLANAR) { ++ *width_mask = ~15; /* width must be a multiple of 16 pixels */ ++ *width_bias = 8; /* nearest */ ++ } else { ++ *width_mask = ~3; /* width must be a multiple of 4 pixels */ ++ *width_bias = 2; /* nearest */ ++ } ++} ++ + static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + struct v4l2_format *f) + { +@@ -2343,6 +2356,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + enum v4l2_field field; + __s32 width, height; + __s32 height2; ++ unsigned int width_mask, width_bias; + int rc; + + fmt = format_by_fourcc(f->fmt.pix.pixelformat); +@@ -2375,9 +2389,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + width = f->fmt.pix.width; + height = f->fmt.pix.height; + ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + rc = limit_scaled_size_lock(fh, &width, &height, field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 0); + if (0 != rc) +@@ -2410,6 +2424,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + struct bttv_fh *fh = priv; + struct bttv *btv = fh->btv; + __s32 width, height; ++ unsigned int width_mask, width_bias; + enum v4l2_field field; + + retval = bttv_switch_type(fh, f->type); +@@ -2424,9 +2439,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + height = f->fmt.pix.height; + field = f->fmt.pix.field; + ++ fmt = format_by_fourcc(f->fmt.pix.pixelformat); ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 1); + if (0 != retval) +@@ -2434,8 +2450,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void *priv, + + f->fmt.pix.field = field; + +- fmt = format_by_fourcc(f->fmt.pix.pixelformat); +- + /* update our state informations */ + fh->fmt = fmt; + fh->cap.field = f->fmt.pix.field; +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index a63c1366a64e..1293563b7dce 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -1219,10 +1219,13 @@ static int saa7134_g_fmt_vid_cap(struct file *file, void *priv, + f->fmt.pix.height = dev->height; + f->fmt.pix.field = dev->field; + f->fmt.pix.pixelformat = dev->fmt->fourcc; +- f->fmt.pix.bytesperline = +- (f->fmt.pix.width * dev->fmt->depth) >> 3; ++ if (dev->fmt->planar) ++ f->fmt.pix.bytesperline = f->fmt.pix.width; ++ else ++ f->fmt.pix.bytesperline = ++ (f->fmt.pix.width * dev->fmt->depth) / 8; + f->fmt.pix.sizeimage = +- f->fmt.pix.height * f->fmt.pix.bytesperline; ++ (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8; + f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; + return 0; + } +@@ -1298,10 +1301,13 @@ static int saa7134_try_fmt_vid_cap(struct file *file, void *priv, + if (f->fmt.pix.height > maxh) + f->fmt.pix.height = maxh; + f->fmt.pix.width &= ~0x03; +- f->fmt.pix.bytesperline = +- (f->fmt.pix.width * fmt->depth) >> 3; ++ if (fmt->planar) ++ f->fmt.pix.bytesperline = f->fmt.pix.width; ++ else ++ f->fmt.pix.bytesperline = ++ (f->fmt.pix.width * fmt->depth) / 8; + f->fmt.pix.sizeimage = +- f->fmt.pix.height * f->fmt.pix.bytesperline; ++ (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8; + f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; + + return 0; +diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c +index 7d28899f89ce..6efe9d002961 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -1342,7 +1342,7 @@ static void coda_finish_encode(struct coda_ctx *ctx) + + /* Calculate bytesused field */ + if (dst_buf->sequence == 0) { +- vb2_set_plane_payload(&dst_buf->vb2_buf, 0, ++ vb2_set_plane_payload(&dst_buf->vb2_buf, 0, wr_ptr - start_ptr + + ctx->vpu_header_size[0] + + ctx->vpu_header_size[1] + + ctx->vpu_header_size[2]); +diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c +index 086cf1c7bd7d..18aed5dd325e 100644 +--- a/drivers/media/usb/pwc/pwc-if.c ++++ b/drivers/media/usb/pwc/pwc-if.c +@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = { + { USB_DEVICE(0x0471, 0x0312) }, + { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */ + { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */ ++ { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */ + { USB_DEVICE(0x069A, 0x0001) }, /* Askey */ + { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */ + { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */ +@@ -810,6 +811,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id + name = "Philips SPC 900NC webcam"; + type_id = 740; + break; ++ case 0x032C: ++ PWC_INFO("Philips SPC 880NC USB webcam detected.\n"); ++ name = "Philips SPC 880NC webcam"; ++ type_id = 740; ++ break; + default: + return -ENODEV; + break; +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 8fd84a67478a..019644ff627d 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -415,7 +415,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + get_user(kp->index, &up->index) || + get_user(kp->type, &up->type) || + get_user(kp->flags, &up->flags) || +- get_user(kp->memory, &up->memory)) ++ get_user(kp->memory, &up->memory) || ++ get_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_OUTPUT(kp->type)) +@@ -427,9 +428,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- if (get_user(kp->length, &up->length)) +- return -EFAULT; +- + num_planes = kp->length; + if (num_planes == 0) { + kp->m.planes = NULL; +@@ -462,16 +460,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (get_user(kp->length, &up->length) || +- get_user(kp->m.offset, &up->m.offset)) ++ if (get_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: + { + compat_long_t tmp; + +- if (get_user(kp->length, &up->length) || +- get_user(tmp, &up->m.userptr)) ++ if (get_user(tmp, &up->m.userptr)) + return -EFAULT; + + kp->m.userptr = (unsigned long)compat_ptr(tmp); +@@ -513,7 +509,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || + put_user(kp->sequence, &up->sequence) || + put_user(kp->reserved2, &up->reserved2) || +- put_user(kp->reserved, &up->reserved)) ++ put_user(kp->reserved, &up->reserved) || ++ put_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +@@ -536,13 +533,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.offset, &up->m.offset)) ++ if (put_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.userptr, &up->m.userptr)) ++ if (put_user(kp->m.userptr, &up->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_OVERLAY: +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index 0b05aa938799..1a173d0af694 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length, + bus = cl->dev; + + mutex_lock(&bus->device_lock); ++ if (bus->dev_state != MEI_DEV_ENABLED) { ++ rets = -ENODEV; ++ goto out; ++ } ++ + if (!mei_cl_is_connected(cl)) { + rets = -ENODEV; + goto out; +@@ -109,6 +114,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length) + bus = cl->dev; + + mutex_lock(&bus->device_lock); ++ if (bus->dev_state != MEI_DEV_ENABLED) { ++ rets = -ENODEV; ++ goto out; ++ } + + cb = mei_cl_read_cb(cl, NULL); + if (cb) +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index fe207e542032..5fbffdb6b854 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -589,6 +589,14 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev, + struct mmc_card *card; + int err = 0, ioc_err = 0; + ++ /* ++ * The caller must have CAP_SYS_RAWIO, and must be calling this on the ++ * whole block device, not on a partition. This prevents overspray ++ * between sibling partitions. ++ */ ++ if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) ++ return -EPERM; ++ + idata = mmc_blk_ioctl_copy_from_user(ic_ptr); + if (IS_ERR(idata)) + return PTR_ERR(idata); +@@ -631,6 +639,14 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev, + int i, err = 0, ioc_err = 0; + __u64 num_of_cmds; + ++ /* ++ * The caller must have CAP_SYS_RAWIO, and must be calling this on the ++ * whole block device, not on a partition. This prevents overspray ++ * between sibling partitions. ++ */ ++ if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) ++ return -EPERM; ++ + if (copy_from_user(&num_of_cmds, &user->num_of_cmds, + sizeof(num_of_cmds))) + return -EFAULT; +@@ -688,14 +704,6 @@ cmd_err: + static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode, + unsigned int cmd, unsigned long arg) + { +- /* +- * The caller must have CAP_SYS_RAWIO, and must be calling this on the +- * whole block device, not on a partition. This prevents overspray +- * between sibling partitions. +- */ +- if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains)) +- return -EPERM; +- + switch (cmd) { + case MMC_IOC_CMD: + return mmc_blk_ioctl_cmd(bdev, +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index 851ccd9ac868..25c179592125 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -2443,7 +2443,7 @@ static int atmci_configure_dma(struct atmel_mci *host) + struct mci_platform_data *pdata = host->pdev->dev.platform_data; + dma_cap_mask_t mask; + +- if (!pdata->dma_filter) ++ if (!pdata || !pdata->dma_filter) + return -ENODEV; + + dma_cap_zero(mask); +diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c +index 3446097a43c0..e77d79c8cd9f 100644 +--- a/drivers/mmc/host/mmc_spi.c ++++ b/drivers/mmc/host/mmc_spi.c +@@ -1442,6 +1442,12 @@ static int mmc_spi_probe(struct spi_device *spi) + host->pdata->cd_debounce); + if (status != 0) + goto fail_add_host; ++ ++ /* The platform has a CD GPIO signal that may support ++ * interrupts, so let mmc_gpiod_request_cd_irq() decide ++ * if polling is needed or not. ++ */ ++ mmc->caps &= ~MMC_CAP_NEEDS_POLL; + mmc_gpiod_request_cd_irq(mmc); + } + +diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c +index f5edf9d3a18a..c7f27fe4805a 100644 +--- a/drivers/mmc/host/sdhci-pxav3.c ++++ b/drivers/mmc/host/sdhci-pxav3.c +@@ -137,6 +137,10 @@ static int armada_38x_quirks(struct platform_device *pdev, + + host->quirks &= ~SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN; + host->quirks |= SDHCI_QUIRK_MISSING_CAPS; ++ ++ host->caps = sdhci_readl(host, SDHCI_CAPABILITIES); ++ host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); ++ + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "conf-sdio3"); + if (res) { +@@ -150,7 +154,6 @@ static int armada_38x_quirks(struct platform_device *pdev, + * Configuration register, if the adjustment is not done, + * remove them from the capabilities. + */ +- host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1); + host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50); + + dev_warn(&pdev->dev, "conf-sdio3 register not found: disabling SDR50 and DDR50 modes.\nConsider updating your dtb\n"); +@@ -161,7 +164,6 @@ static int armada_38x_quirks(struct platform_device *pdev, + * controller has different capabilities than the ones shown + * in its registers + */ +- host->caps = sdhci_readl(host, SDHCI_CAPABILITIES); + if (of_property_read_bool(np, "no-1-8-v")) { + host->caps &= ~SDHCI_CAN_VDD_180; + host->mmc->caps &= ~MMC_CAP_1_8V_DDR; +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index 83c4bf7bc16c..0004721cd213 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -147,10 +147,16 @@ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask) + /* Advertise UHS modes as supported by host */ + if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50) + misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50; ++ else ++ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR50; + if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50) + misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50; ++ else ++ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_DDR50; + if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104) + misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104; ++ else ++ misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR104; + sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL); + + clk_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_CLOCK_CTRL); +@@ -188,7 +194,7 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock) + unsigned long host_clk; + + if (!clock) +- return; ++ return sdhci_set_clock(host, clock); + + host_clk = tegra_host->ddr_signaling ? clock * 2 : clock; + clk_set_rate(pltfm_host->clk, host_clk); +@@ -335,6 +341,10 @@ static const struct sdhci_pltfm_data sdhci_tegra114_pdata = { + + static const struct sdhci_tegra_soc_data soc_data_tegra114 = { + .pdata = &sdhci_tegra114_pdata, ++}; ++ ++static const struct sdhci_tegra_soc_data soc_data_tegra124 = { ++ .pdata = &sdhci_tegra114_pdata, + .nvquirks = NVQUIRK_ENABLE_SDR50 | + NVQUIRK_ENABLE_DDR50 | + NVQUIRK_ENABLE_SDR104, +@@ -357,7 +367,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra210 = { + + static const struct of_device_id sdhci_tegra_dt_match[] = { + { .compatible = "nvidia,tegra210-sdhci", .data = &soc_data_tegra210 }, +- { .compatible = "nvidia,tegra124-sdhci", .data = &soc_data_tegra114 }, ++ { .compatible = "nvidia,tegra124-sdhci", .data = &soc_data_tegra124 }, + { .compatible = "nvidia,tegra114-sdhci", .data = &soc_data_tegra114 }, + { .compatible = "nvidia,tegra30-sdhci", .data = &soc_data_tegra30 }, + { .compatible = "nvidia,tegra20-sdhci", .data = &soc_data_tegra20 }, +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index add9fdfd1d8f..8059d7248fff 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -465,8 +465,6 @@ static void sdhci_adma_mark_end(void *desc) + static int sdhci_adma_table_pre(struct sdhci_host *host, + struct mmc_data *data) + { +- int direction; +- + void *desc; + void *align; + dma_addr_t addr; +@@ -483,20 +481,9 @@ static int sdhci_adma_table_pre(struct sdhci_host *host, + * We currently guess that it is LE. + */ + +- if (data->flags & MMC_DATA_READ) +- direction = DMA_FROM_DEVICE; +- else +- direction = DMA_TO_DEVICE; +- +- host->align_addr = dma_map_single(mmc_dev(host->mmc), +- host->align_buffer, host->align_buffer_sz, direction); +- if (dma_mapping_error(mmc_dev(host->mmc), host->align_addr)) +- goto fail; +- BUG_ON(host->align_addr & SDHCI_ADMA2_MASK); +- + host->sg_count = sdhci_pre_dma_transfer(host, data); + if (host->sg_count < 0) +- goto unmap_align; ++ return -EINVAL; + + desc = host->adma_table; + align = host->align_buffer; +@@ -570,22 +557,7 @@ static int sdhci_adma_table_pre(struct sdhci_host *host, + /* nop, end, valid */ + sdhci_adma_write_desc(host, desc, 0, 0, ADMA2_NOP_END_VALID); + } +- +- /* +- * Resync align buffer as we might have changed it. +- */ +- if (data->flags & MMC_DATA_WRITE) { +- dma_sync_single_for_device(mmc_dev(host->mmc), +- host->align_addr, host->align_buffer_sz, direction); +- } +- + return 0; +- +-unmap_align: +- dma_unmap_single(mmc_dev(host->mmc), host->align_addr, +- host->align_buffer_sz, direction); +-fail: +- return -EINVAL; + } + + static void sdhci_adma_table_post(struct sdhci_host *host, +@@ -605,9 +577,6 @@ static void sdhci_adma_table_post(struct sdhci_host *host, + else + direction = DMA_TO_DEVICE; + +- dma_unmap_single(mmc_dev(host->mmc), host->align_addr, +- host->align_buffer_sz, direction); +- + /* Do a quick scan of the SG list for any unaligned mappings */ + has_unaligned = false; + for_each_sg(data->sg, sg, host->sg_count, i) +@@ -666,9 +635,20 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd) + if (!data) + target_timeout = cmd->busy_timeout * 1000; + else { +- target_timeout = data->timeout_ns / 1000; +- if (host->clock) +- target_timeout += data->timeout_clks / host->clock; ++ target_timeout = DIV_ROUND_UP(data->timeout_ns, 1000); ++ if (host->clock && data->timeout_clks) { ++ unsigned long long val; ++ ++ /* ++ * data->timeout_clks is in units of clock cycles. ++ * host->clock is in Hz. target_timeout is in us. ++ * Hence, us = 1000000 * cycles / Hz. Round up. ++ */ ++ val = 1000000 * data->timeout_clks; ++ if (do_div(val, host->clock)) ++ target_timeout++; ++ target_timeout += val; ++ } + } + + /* +@@ -1003,6 +983,9 @@ void sdhci_send_command(struct sdhci_host *host, struct mmc_command *cmd) + + WARN_ON(host->cmd); + ++ /* Initially, a command has no error */ ++ cmd->error = 0; ++ + /* Wait max 10 ms */ + timeout = 10; + +@@ -1097,8 +1080,6 @@ static void sdhci_finish_command(struct sdhci_host *host) + } + } + +- host->cmd->error = 0; +- + /* Finished CMD23, now send actual command. */ + if (host->cmd == host->mrq->sbc) { + host->cmd = NULL; +@@ -2114,14 +2095,13 @@ static void sdhci_post_req(struct mmc_host *mmc, struct mmc_request *mrq, + struct sdhci_host *host = mmc_priv(mmc); + struct mmc_data *data = mrq->data; + +- if (host->flags & SDHCI_REQ_USE_DMA) { +- if (data->host_cookie == COOKIE_GIVEN || +- data->host_cookie == COOKIE_MAPPED) +- dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, +- data->flags & MMC_DATA_WRITE ? +- DMA_TO_DEVICE : DMA_FROM_DEVICE); +- data->host_cookie = COOKIE_UNMAPPED; +- } ++ if (data->host_cookie == COOKIE_GIVEN || ++ data->host_cookie == COOKIE_MAPPED) ++ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, ++ data->flags & MMC_DATA_WRITE ? ++ DMA_TO_DEVICE : DMA_FROM_DEVICE); ++ ++ data->host_cookie = COOKIE_UNMAPPED; + } + + static int sdhci_pre_dma_transfer(struct sdhci_host *host, +@@ -2238,6 +2218,22 @@ static void sdhci_tasklet_finish(unsigned long param) + mrq = host->mrq; + + /* ++ * Always unmap the data buffers if they were mapped by ++ * sdhci_prepare_data() whenever we finish with a request. ++ * This avoids leaking DMA mappings on error. ++ */ ++ if (host->flags & SDHCI_REQ_USE_DMA) { ++ struct mmc_data *data = mrq->data; ++ ++ if (data && data->host_cookie == COOKIE_MAPPED) { ++ dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len, ++ (data->flags & MMC_DATA_READ) ? ++ DMA_FROM_DEVICE : DMA_TO_DEVICE); ++ data->host_cookie = COOKIE_UNMAPPED; ++ } ++ } ++ ++ /* + * The controller needs a reset of internal state machines + * upon error conditions. + */ +@@ -2322,13 +2318,30 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *mask) + return; + } + +- if (intmask & SDHCI_INT_TIMEOUT) +- host->cmd->error = -ETIMEDOUT; +- else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT | +- SDHCI_INT_INDEX)) +- host->cmd->error = -EILSEQ; ++ if (intmask & (SDHCI_INT_TIMEOUT | SDHCI_INT_CRC | ++ SDHCI_INT_END_BIT | SDHCI_INT_INDEX)) { ++ if (intmask & SDHCI_INT_TIMEOUT) ++ host->cmd->error = -ETIMEDOUT; ++ else ++ host->cmd->error = -EILSEQ; ++ ++ /* ++ * If this command initiates a data phase and a response ++ * CRC error is signalled, the card can start transferring ++ * data - the card may have received the command without ++ * error. We must not terminate the mmc_request early. ++ * ++ * If the card did not receive the command or returned an ++ * error which prevented it sending data, the data phase ++ * will time out. ++ */ ++ if (host->cmd->data && ++ (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) == ++ SDHCI_INT_CRC) { ++ host->cmd = NULL; ++ return; ++ } + +- if (host->cmd->error) { + tasklet_schedule(&host->finish_tasklet); + return; + } +@@ -2967,14 +2980,21 @@ int sdhci_add_host(struct sdhci_host *host) + &host->adma_addr, + GFP_KERNEL); + host->align_buffer_sz = SDHCI_MAX_SEGS * SDHCI_ADMA2_ALIGN; +- host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL); ++ host->align_buffer = dma_alloc_coherent(mmc_dev(mmc), ++ host->align_buffer_sz, ++ &host->align_addr, ++ GFP_KERNEL); + if (!host->adma_table || !host->align_buffer) { + if (host->adma_table) + dma_free_coherent(mmc_dev(mmc), + host->adma_table_sz, + host->adma_table, + host->adma_addr); +- kfree(host->align_buffer); ++ if (host->align_buffer) ++ dma_free_coherent(mmc_dev(mmc), ++ host->align_buffer_sz, ++ host->align_buffer, ++ host->align_addr); + pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n", + mmc_hostname(mmc)); + host->flags &= ~SDHCI_USE_ADMA; +@@ -2986,10 +3006,14 @@ int sdhci_add_host(struct sdhci_host *host) + host->flags &= ~SDHCI_USE_ADMA; + dma_free_coherent(mmc_dev(mmc), host->adma_table_sz, + host->adma_table, host->adma_addr); +- kfree(host->align_buffer); ++ dma_free_coherent(mmc_dev(mmc), host->align_buffer_sz, ++ host->align_buffer, host->align_addr); + host->adma_table = NULL; + host->align_buffer = NULL; + } ++ ++ /* dma_alloc_coherent returns page aligned and sized buffers */ ++ BUG_ON(host->align_addr & SDHCI_ADMA2_MASK); + } + + /* +@@ -3072,14 +3096,14 @@ int sdhci_add_host(struct sdhci_host *host) + if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT) + host->timeout_clk *= 1000; + ++ if (override_timeout_clk) ++ host->timeout_clk = override_timeout_clk; ++ + mmc->max_busy_timeout = host->ops->get_max_timeout_count ? + host->ops->get_max_timeout_count(host) : 1 << 27; + mmc->max_busy_timeout /= host->timeout_clk; + } + +- if (override_timeout_clk) +- host->timeout_clk = override_timeout_clk; +- + mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23; + mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD; + +@@ -3452,7 +3476,9 @@ void sdhci_remove_host(struct sdhci_host *host, int dead) + if (host->adma_table) + dma_free_coherent(mmc_dev(mmc), host->adma_table_sz, + host->adma_table, host->adma_addr); +- kfree(host->align_buffer); ++ if (host->align_buffer) ++ dma_free_coherent(mmc_dev(mmc), host->align_buffer_sz, ++ host->align_buffer, host->align_addr); + + host->adma_table = NULL; + host->align_buffer = NULL; +diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c +index 43b3392ffee7..652d01832873 100644 +--- a/drivers/mtd/onenand/onenand_base.c ++++ b/drivers/mtd/onenand/onenand_base.c +@@ -2599,6 +2599,7 @@ static int onenand_default_block_markbad(struct mtd_info *mtd, loff_t ofs) + */ + static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + { ++ struct onenand_chip *this = mtd->priv; + int ret; + + ret = onenand_block_isbad(mtd, ofs); +@@ -2610,7 +2611,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs) + } + + onenand_get_device(mtd, FL_WRITING); +- ret = mtd_block_markbad(mtd, ofs); ++ ret = this->block_markbad(mtd, ofs); + onenand_release_device(mtd); + return ret; + } +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index b0ae69f84493..acb1c5b2bad3 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3720,7 +3720,7 @@ static int mvneta_probe(struct platform_device *pdev) + dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO; + dev->hw_features |= dev->features; + dev->vlan_features |= dev->features; +- dev->priv_flags |= IFF_UNICAST_FLT; ++ dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE; + dev->gso_max_segs = MVNETA_MAX_TSO_SEGS; + + err = register_netdev(dev); +diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c +index 696852eb23c3..7a3f990c1935 100644 +--- a/drivers/net/irda/irtty-sir.c ++++ b/drivers/net/irda/irtty-sir.c +@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty) + + /* Module stuff handled via irda_ldisc.owner - Jean II */ + +- /* First make sure we're not already connected. */ +- if (tty->disc_data != NULL) { +- priv = tty->disc_data; +- if (priv && priv->magic == IRTTY_MAGIC) { +- ret = -EEXIST; +- goto out; +- } +- tty->disc_data = NULL; /* ### */ +- } +- + /* stop the underlying driver */ + irtty_stop_receiver(tty, TRUE); + if (tty->ops->stop) +diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c +index 01f08a7751f7..e7034c55e796 100644 +--- a/drivers/net/rionet.c ++++ b/drivers/net/rionet.c +@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + struct net_device *ndev = dev_id; + struct rionet_private *rnet = netdev_priv(ndev); + +- spin_lock(&rnet->lock); ++ spin_lock(&rnet->tx_lock); + + if (netif_msg_intr(rnet)) + printk(KERN_INFO +@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, void *dev_id, int mbo + if (rnet->tx_cnt < RIONET_TX_RING_SIZE) + netif_wake_queue(ndev); + +- spin_unlock(&rnet->lock); ++ spin_unlock(&rnet->tx_lock); + } + + static int rionet_open(struct net_device *ndev) +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c +index 2ca783fa50cf..7e269f9aa607 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c +@@ -32,7 +32,7 @@ + #define BRCMF_FLOWRING_LOW (BRCMF_FLOWRING_HIGH - 256) + #define BRCMF_FLOWRING_INVALID_IFIDX 0xff + +-#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16) ++#define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] * 2 + fifo + ifidx * 16) + #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16) + + static const u8 brcmf_flowring_prio2fifo[] = { +@@ -68,7 +68,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + u8 prio, u8 ifidx) + { + struct brcmf_flowring_hash *hash; +- u8 hash_idx; ++ u16 hash_idx; + u32 i; + bool found; + bool sta; +@@ -88,6 +88,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + } + hash_idx = sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) : + BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx); ++ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); + found = false; + hash = flow->hash; + for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) { +@@ -98,6 +99,7 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + break; + } + hash_idx++; ++ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); + } + if (found) + return hash[hash_idx].flowid; +@@ -111,7 +113,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + { + struct brcmf_flowring_ring *ring; + struct brcmf_flowring_hash *hash; +- u8 hash_idx; ++ u16 hash_idx; + u32 i; + bool found; + u8 fifo; +@@ -131,6 +133,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + } + hash_idx = sta ? BRCMF_FLOWRING_HASH_STA(fifo, ifidx) : + BRCMF_FLOWRING_HASH_AP(mac, fifo, ifidx); ++ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); + found = false; + hash = flow->hash; + for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) { +@@ -140,6 +143,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + break; + } + hash_idx++; ++ hash_idx &= (BRCMF_FLOWRING_HASHSIZE - 1); + } + if (found) { + for (i = 0; i < flow->nrofrings; i++) { +@@ -169,7 +173,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + } + + +-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid) ++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; + +@@ -179,7 +183,7 @@ u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid) + } + + +-static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid, ++static void brcmf_flowring_block(struct brcmf_flowring *flow, u16 flowid, + bool blocked) + { + struct brcmf_flowring_ring *ring; +@@ -228,10 +232,10 @@ static void brcmf_flowring_block(struct brcmf_flowring *flow, u8 flowid, + } + + +-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid) ++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; +- u8 hash_idx; ++ u16 hash_idx; + struct sk_buff *skb; + + ring = flow->rings[flowid]; +@@ -253,7 +257,7 @@ void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid) + } + + +-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, ++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid, + struct sk_buff *skb) + { + struct brcmf_flowring_ring *ring; +@@ -279,7 +283,7 @@ u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, + } + + +-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid) ++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; + struct sk_buff *skb; +@@ -300,7 +304,7 @@ struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid) + } + + +-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, ++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid, + struct sk_buff *skb) + { + struct brcmf_flowring_ring *ring; +@@ -311,7 +315,7 @@ void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, + } + + +-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid) ++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; + +@@ -326,7 +330,7 @@ u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid) + } + + +-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid) ++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; + +@@ -340,10 +344,10 @@ void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid) + } + + +-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid) ++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid) + { + struct brcmf_flowring_ring *ring; +- u8 hash_idx; ++ u16 hash_idx; + + ring = flow->rings[flowid]; + hash_idx = ring->hash_id; +@@ -384,7 +388,7 @@ void brcmf_flowring_detach(struct brcmf_flowring *flow) + struct brcmf_pub *drvr = bus_if->drvr; + struct brcmf_flowring_tdls_entry *search; + struct brcmf_flowring_tdls_entry *remove; +- u8 flowid; ++ u16 flowid; + + for (flowid = 0; flowid < flow->nrofrings; flowid++) { + if (flow->rings[flowid]) +@@ -408,7 +412,7 @@ void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx, + struct brcmf_bus *bus_if = dev_get_drvdata(flow->dev); + struct brcmf_pub *drvr = bus_if->drvr; + u32 i; +- u8 flowid; ++ u16 flowid; + + if (flow->addr_mode[ifidx] != addr_mode) { + for (i = 0; i < ARRAY_SIZE(flow->hash); i++) { +@@ -434,7 +438,7 @@ void brcmf_flowring_delete_peer(struct brcmf_flowring *flow, int ifidx, + struct brcmf_flowring_tdls_entry *prev; + struct brcmf_flowring_tdls_entry *search; + u32 i; +- u8 flowid; ++ u16 flowid; + bool sta; + + sta = (flow->addr_mode[ifidx] == ADDR_INDIRECT); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h +index 95fd1c9675d1..068e68d94999 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.h +@@ -16,7 +16,7 @@ + #define BRCMFMAC_FLOWRING_H + + +-#define BRCMF_FLOWRING_HASHSIZE 256 ++#define BRCMF_FLOWRING_HASHSIZE 512 /* has to be 2^x */ + #define BRCMF_FLOWRING_INVALID_ID 0xFFFFFFFF + + +@@ -24,7 +24,7 @@ struct brcmf_flowring_hash { + u8 mac[ETH_ALEN]; + u8 fifo; + u8 ifidx; +- u8 flowid; ++ u16 flowid; + }; + + enum ring_status { +@@ -61,16 +61,16 @@ u32 brcmf_flowring_lookup(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + u8 prio, u8 ifidx); + u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN], + u8 prio, u8 ifidx); +-void brcmf_flowring_delete(struct brcmf_flowring *flow, u8 flowid); +-void brcmf_flowring_open(struct brcmf_flowring *flow, u8 flowid); +-u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u8 flowid); +-u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u8 flowid, ++void brcmf_flowring_delete(struct brcmf_flowring *flow, u16 flowid); ++void brcmf_flowring_open(struct brcmf_flowring *flow, u16 flowid); ++u8 brcmf_flowring_tid(struct brcmf_flowring *flow, u16 flowid); ++u32 brcmf_flowring_enqueue(struct brcmf_flowring *flow, u16 flowid, + struct sk_buff *skb); +-struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u8 flowid); +-void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u8 flowid, ++struct sk_buff *brcmf_flowring_dequeue(struct brcmf_flowring *flow, u16 flowid); ++void brcmf_flowring_reinsert(struct brcmf_flowring *flow, u16 flowid, + struct sk_buff *skb); +-u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u8 flowid); +-u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u8 flowid); ++u32 brcmf_flowring_qlen(struct brcmf_flowring *flow, u16 flowid); ++u8 brcmf_flowring_ifidx_get(struct brcmf_flowring *flow, u16 flowid); + struct brcmf_flowring *brcmf_flowring_attach(struct device *dev, u16 nrofrings); + void brcmf_flowring_detach(struct brcmf_flowring *flow); + void brcmf_flowring_configure_addr_mode(struct brcmf_flowring *flow, int ifidx, +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +index c2bdb91746cf..922966734a7f 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -677,7 +677,7 @@ static u32 brcmf_msgbuf_flowring_create(struct brcmf_msgbuf *msgbuf, int ifidx, + } + + +-static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid) ++static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u16 flowid) + { + struct brcmf_flowring *flow = msgbuf->flow; + struct brcmf_commonring *commonring; +@@ -1310,7 +1310,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev) + } + + +-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid) ++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid) + { + struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd; + struct msgbuf_tx_flowring_delete_req *delete; +@@ -1415,6 +1415,13 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr) + u32 count; + + if_msgbuf = drvr->bus_if->msgbuf; ++ ++ if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) { ++ brcmf_err("driver not configured for this many flowrings %d\n", ++ if_msgbuf->nrof_flowrings); ++ if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1; ++ } ++ + msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL); + if (!msgbuf) + goto fail; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h +index 3d513e407e3d..ee6906a3c3f6 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h +@@ -33,7 +33,7 @@ + + + int brcmf_proto_msgbuf_rx_trigger(struct device *dev); +-void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u8 flowid); ++void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid); + int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr); + void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr); + #else +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c +index bf9afbf46c1b..4b0bb6b4f6f1 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c +@@ -1026,6 +1026,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + { USB_DEVICE(0x0411, 0x01a2) }, + { USB_DEVICE(0x0411, 0x01ee) }, + { USB_DEVICE(0x0411, 0x01a8) }, ++ { USB_DEVICE(0x0411, 0x01fd) }, + /* Corega */ + { USB_DEVICE(0x07aa, 0x002f) }, + { USB_DEVICE(0x07aa, 0x003c) }, +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index 5d28e9405f32..576eb7013792 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -513,10 +513,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, + + /* fail write commands (when read-only) */ + if (read_only) +- switch (ioctl_cmd) { +- case ND_IOCTL_VENDOR: +- case ND_IOCTL_SET_CONFIG_DATA: +- case ND_IOCTL_ARS_START: ++ switch (cmd) { ++ case ND_CMD_VENDOR: ++ case ND_CMD_SET_CONFIG_DATA: ++ case ND_CMD_ARS_START: + dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n", + nvdimm ? nvdimm_cmd_name(cmd) + : nvdimm_bus_cmd_name(cmd)); +diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c +index 8d0b54670184..544b802a594c 100644 +--- a/drivers/nvdimm/pmem.c ++++ b/drivers/nvdimm/pmem.c +@@ -66,22 +66,25 @@ static int pmem_do_bvec(struct pmem_device *pmem, struct page *page, + unsigned int len, unsigned int off, int rw, + sector_t sector) + { ++ int rc = 0; + void *mem = kmap_atomic(page); + phys_addr_t pmem_off = sector * 512 + pmem->data_offset; + void __pmem *pmem_addr = pmem->virt_addr + pmem_off; + + if (rw == READ) { + if (unlikely(is_bad_pmem(&pmem->bb, sector, len))) +- return -EIO; +- memcpy_from_pmem(mem + off, pmem_addr, len); +- flush_dcache_page(page); ++ rc = -EIO; ++ else { ++ memcpy_from_pmem(mem + off, pmem_addr, len); ++ flush_dcache_page(page); ++ } + } else { + flush_dcache_page(page); + memcpy_to_pmem(pmem_addr, mem + off, len); + } + + kunmap_atomic(mem); +- return 0; ++ return rc; + } + + static blk_qc_t pmem_make_request(struct request_queue *q, struct bio *bio) +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index 1a3556a9e9ea..ed01c0172e4a 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -32,11 +32,13 @@ int __init __weak early_init_dt_alloc_reserved_memory_arch(phys_addr_t size, + phys_addr_t align, phys_addr_t start, phys_addr_t end, bool nomap, + phys_addr_t *res_base) + { ++ phys_addr_t base; + /* + * We use __memblock_alloc_base() because memblock_alloc_base() + * panic()s on allocation failure. + */ +- phys_addr_t base = __memblock_alloc_base(size, align, end); ++ end = !end ? MEMBLOCK_ALLOC_ANYWHERE : end; ++ base = __memblock_alloc_base(size, align, end); + if (!base) + return -ENOMEM; + +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 6d7ab9bb0d5a..6b0056e9c33e 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -179,6 +179,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + u16 orig_cmd; + struct pci_bus_region region, inverted_region; + ++ if (dev->non_compliant_bars) ++ return 0; ++ + mask = type ? PCI_ROM_ADDRESS_MASK : ~0; + + /* No printks while decoding is disabled! */ +@@ -1171,6 +1174,7 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) + int pci_setup_device(struct pci_dev *dev) + { + u32 class; ++ u16 cmd; + u8 hdr_type; + int pos = 0; + struct pci_bus_region region; +@@ -1214,6 +1218,16 @@ int pci_setup_device(struct pci_dev *dev) + /* device class may be changed after fixup */ + class = dev->class >> 8; + ++ if (dev->non_compliant_bars) { ++ pci_read_config_word(dev, PCI_COMMAND, &cmd); ++ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) { ++ dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n"); ++ cmd &= ~PCI_COMMAND_IO; ++ cmd &= ~PCI_COMMAND_MEMORY; ++ pci_write_config_word(dev, PCI_COMMAND, cmd); ++ } ++ } ++ + switch (dev->hdr_type) { /* header type */ + case PCI_HEADER_TYPE_NORMAL: /* standard header */ + if (class == PCI_CLASS_BRIDGE_PCI) +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index 0f5997ceb494..08b1d93da9fe 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev, + } + if (num_pulls) { + err = of_property_read_u32_index(np, "brcm,pull", +- (num_funcs > 1) ? i : 0, &pull); ++ (num_pulls > 1) ? i : 0, &pull); + if (err) + goto out; + err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin, +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index d78ee151c9e4..be3bc2f4edd4 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -865,6 +865,20 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + }, + }, + { ++ .ident = "Lenovo ideapad Y700-15ISK", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-15ISK"), ++ }, ++ }, ++ { ++ .ident = "Lenovo ideapad Y700 Touch-15ISK", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700 Touch-15ISK"), ++ }, ++ }, ++ { + .ident = "Lenovo ideapad Y700-17ISK", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index d72867257346..3eff2a69fe08 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -760,7 +760,7 @@ static struct scsi_cmnd *dequeue_next_cmd(struct Scsi_Host *instance) + struct NCR5380_cmd *ncmd; + struct scsi_cmnd *cmd; + +- if (list_empty(&hostdata->autosense)) { ++ if (hostdata->sensing || list_empty(&hostdata->autosense)) { + list_for_each_entry(ncmd, &hostdata->unissued, list) { + cmd = NCR5380_to_scmd(ncmd); + dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n", +@@ -793,7 +793,7 @@ static void requeue_cmd(struct Scsi_Host *instance, struct scsi_cmnd *cmd) + struct NCR5380_hostdata *hostdata = shost_priv(instance); + struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); + +- if (hostdata->sensing) { ++ if (hostdata->sensing == cmd) { + scsi_eh_restore_cmnd(cmd, &hostdata->ses); + list_add(&ncmd->list, &hostdata->autosense); + hostdata->sensing = NULL; +@@ -815,15 +815,17 @@ static void NCR5380_main(struct work_struct *work) + struct NCR5380_hostdata *hostdata = + container_of(work, struct NCR5380_hostdata, main_task); + struct Scsi_Host *instance = hostdata->host; +- struct scsi_cmnd *cmd; + int done; + + do { + done = 1; + + spin_lock_irq(&hostdata->lock); +- while (!hostdata->connected && +- (cmd = dequeue_next_cmd(instance))) { ++ while (!hostdata->connected && !hostdata->selecting) { ++ struct scsi_cmnd *cmd = dequeue_next_cmd(instance); ++ ++ if (!cmd) ++ break; + + dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd); + +@@ -840,8 +842,7 @@ static void NCR5380_main(struct work_struct *work) + * entire unit. + */ + +- cmd = NCR5380_select(instance, cmd); +- if (!cmd) { ++ if (!NCR5380_select(instance, cmd)) { + dsprintk(NDEBUG_MAIN, instance, "main: select complete\n"); + } else { + dsprintk(NDEBUG_MAIN | NDEBUG_QUEUES, instance, +@@ -1056,6 +1057,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance, + /* Reselection interrupt */ + goto out; + } ++ if (!hostdata->selecting) { ++ /* Command was aborted */ ++ NCR5380_write(MODE_REG, MR_BASE); ++ goto out; ++ } + if (err < 0) { + NCR5380_write(MODE_REG, MR_BASE); + shost_printk(KERN_ERR, instance, +@@ -1759,9 +1765,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + unsigned char msgout = NOP; + int sink = 0; + int len; +-#if defined(PSEUDO_DMA) || defined(REAL_DMA_POLL) + int transfersize; +-#endif + unsigned char *data; + unsigned char phase, tmp, extended_msg[10], old_phase = 0xff; + struct scsi_cmnd *cmd; +@@ -1798,6 +1802,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + do_abort(instance); + cmd->result = DID_ERROR << 16; + complete_cmd(instance, cmd); ++ hostdata->connected = NULL; + return; + #endif + case PHASE_DATAIN: +@@ -1847,20 +1852,23 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + sink = 1; + do_abort(instance); + cmd->result = DID_ERROR << 16; +- complete_cmd(instance, cmd); + /* XXX - need to source or sink data here, as appropriate */ + } else + cmd->SCp.this_residual -= transfersize - len; + } else + #endif /* defined(PSEUDO_DMA) || defined(REAL_DMA_POLL) */ + { +- spin_unlock_irq(&hostdata->lock); +- NCR5380_transfer_pio(instance, &phase, +- (int *)&cmd->SCp.this_residual, ++ /* Break up transfer into 3 ms chunks, ++ * presuming 6 accesses per handshake. ++ */ ++ transfersize = min((unsigned long)cmd->SCp.this_residual, ++ hostdata->accesses_per_ms / 2); ++ len = transfersize; ++ NCR5380_transfer_pio(instance, &phase, &len, + (unsigned char **)&cmd->SCp.ptr); +- spin_lock_irq(&hostdata->lock); ++ cmd->SCp.this_residual -= transfersize - len; + } +- break; ++ return; + case PHASE_MSGIN: + len = 1; + data = &tmp; +@@ -2292,14 +2300,17 @@ static bool list_del_cmd(struct list_head *haystack, + * [disconnected -> connected ->]... + * [autosense -> connected ->] done + * +- * If cmd is unissued then just remove it. +- * If cmd is disconnected, try to select the target. +- * If cmd is connected, try to send an abort message. +- * If cmd is waiting for autosense, give it a chance to complete but check +- * that it isn't left connected. + * If cmd was not found at all then presumably it has already been completed, + * in which case return SUCCESS to try to avoid further EH measures. ++ * + * If the command has not completed yet, we must not fail to find it. ++ * We have no option but to forget the aborted command (even if it still ++ * lacks sense data). The mid-layer may re-issue a command that is in error ++ * recovery (see scsi_send_eh_cmnd), but the logic and data structures in ++ * this driver are such that a command can appear on one queue only. ++ * ++ * The lock protects driver data structures, but EH handlers also use it ++ * to serialize their own execution and prevent their own re-entry. + */ + + static int NCR5380_abort(struct scsi_cmnd *cmd) +@@ -2322,6 +2333,7 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + "abort: removed %p from issue queue\n", cmd); + cmd->result = DID_ABORT << 16; + cmd->scsi_done(cmd); /* No tag or busy flag to worry about */ ++ goto out; + } + + if (hostdata->selecting == cmd) { +@@ -2336,58 +2348,21 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + if (list_del_cmd(&hostdata->disconnected, cmd)) { + dsprintk(NDEBUG_ABORT, instance, + "abort: removed %p from disconnected list\n", cmd); +- cmd->result = DID_ERROR << 16; +- if (!hostdata->connected) +- NCR5380_select(instance, cmd); +- if (hostdata->connected != cmd) { +- complete_cmd(instance, cmd); +- result = FAILED; +- goto out; +- } ++ /* Can't call NCR5380_select() and send ABORT because that ++ * means releasing the lock. Need a bus reset. ++ */ ++ set_host_byte(cmd, DID_ERROR); ++ complete_cmd(instance, cmd); ++ result = FAILED; ++ goto out; + } + + if (hostdata->connected == cmd) { + dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); + hostdata->connected = NULL; +- if (do_abort(instance)) { +- set_host_byte(cmd, DID_ERROR); +- complete_cmd(instance, cmd); +- result = FAILED; +- goto out; +- } +- set_host_byte(cmd, DID_ABORT); + #ifdef REAL_DMA + hostdata->dma_len = 0; + #endif +- if (cmd->cmnd[0] == REQUEST_SENSE) +- complete_cmd(instance, cmd); +- else { +- struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); +- +- /* Perform autosense for this command */ +- list_add(&ncmd->list, &hostdata->autosense); +- } +- } +- +- if (list_find_cmd(&hostdata->autosense, cmd)) { +- dsprintk(NDEBUG_ABORT, instance, +- "abort: found %p on sense queue\n", cmd); +- spin_unlock_irqrestore(&hostdata->lock, flags); +- queue_work(hostdata->work_q, &hostdata->main_task); +- msleep(1000); +- spin_lock_irqsave(&hostdata->lock, flags); +- if (list_del_cmd(&hostdata->autosense, cmd)) { +- dsprintk(NDEBUG_ABORT, instance, +- "abort: removed %p from sense queue\n", cmd); +- set_host_byte(cmd, DID_ABORT); +- complete_cmd(instance, cmd); +- goto out; +- } +- } +- +- if (hostdata->connected == cmd) { +- dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); +- hostdata->connected = NULL; + if (do_abort(instance)) { + set_host_byte(cmd, DID_ERROR); + complete_cmd(instance, cmd); +@@ -2395,9 +2370,14 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + goto out; + } + set_host_byte(cmd, DID_ABORT); +-#ifdef REAL_DMA +- hostdata->dma_len = 0; +-#endif ++ complete_cmd(instance, cmd); ++ goto out; ++ } ++ ++ if (list_del_cmd(&hostdata->autosense, cmd)) { ++ dsprintk(NDEBUG_ABORT, instance, ++ "abort: removed %p from sense queue\n", cmd); ++ set_host_byte(cmd, DID_ERROR); + complete_cmd(instance, cmd); + } + +@@ -2450,7 +2430,16 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + * commands! + */ + +- hostdata->selecting = NULL; ++ if (list_del_cmd(&hostdata->unissued, cmd)) { ++ cmd->result = DID_RESET << 16; ++ cmd->scsi_done(cmd); ++ } ++ ++ if (hostdata->selecting) { ++ hostdata->selecting->result = DID_RESET << 16; ++ complete_cmd(instance, hostdata->selecting); ++ hostdata->selecting = NULL; ++ } + + list_for_each_entry(ncmd, &hostdata->disconnected, list) { + struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); +@@ -2458,6 +2447,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + set_host_byte(cmd, DID_RESET); + cmd->scsi_done(cmd); + } ++ INIT_LIST_HEAD(&hostdata->disconnected); + + list_for_each_entry(ncmd, &hostdata->autosense, list) { + struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); +@@ -2465,6 +2455,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + set_host_byte(cmd, DID_RESET); + cmd->scsi_done(cmd); + } ++ INIT_LIST_HEAD(&hostdata->autosense); + + if (hostdata->connected) { + set_host_byte(hostdata->connected, DID_RESET); +@@ -2472,12 +2463,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + hostdata->connected = NULL; + } + +- if (hostdata->sensing) { +- set_host_byte(hostdata->connected, DID_RESET); +- complete_cmd(instance, hostdata->sensing); +- hostdata->sensing = NULL; +- } +- + for (i = 0; i < 8; ++i) + hostdata->busy[i] = 0; + #ifdef REAL_DMA +diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h +index 074878b55a0b..d044f3f273be 100644 +--- a/drivers/scsi/aacraid/aacraid.h ++++ b/drivers/scsi/aacraid/aacraid.h +@@ -944,6 +944,7 @@ struct fib { + */ + struct list_head fiblink; + void *data; ++ u32 vector_no; + struct hw_fib *hw_fib_va; /* Actual shared object */ + dma_addr_t hw_fib_pa; /* physical address of hw_fib*/ + }; +@@ -2113,6 +2114,7 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor) + int aac_acquire_irq(struct aac_dev *dev); + void aac_free_irq(struct aac_dev *dev); + const char *aac_driverinfo(struct Scsi_Host *); ++void aac_fib_vector_assign(struct aac_dev *dev); + struct fib *aac_fib_alloc(struct aac_dev *dev); + int aac_fib_setup(struct aac_dev *dev); + void aac_fib_map_free(struct aac_dev *dev); +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index a1f90fe849c9..4cbf54928640 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -83,13 +83,38 @@ static int fib_map_alloc(struct aac_dev *dev) + + void aac_fib_map_free(struct aac_dev *dev) + { +- pci_free_consistent(dev->pdev, +- dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB), +- dev->hw_fib_va, dev->hw_fib_pa); ++ if (dev->hw_fib_va && dev->max_fib_size) { ++ pci_free_consistent(dev->pdev, ++ (dev->max_fib_size * ++ (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)), ++ dev->hw_fib_va, dev->hw_fib_pa); ++ } + dev->hw_fib_va = NULL; + dev->hw_fib_pa = 0; + } + ++void aac_fib_vector_assign(struct aac_dev *dev) ++{ ++ u32 i = 0; ++ u32 vector = 1; ++ struct fib *fibptr = NULL; ++ ++ for (i = 0, fibptr = &dev->fibs[i]; ++ i < (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB); ++ i++, fibptr++) { ++ if ((dev->max_msix == 1) || ++ (i > ((dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB - 1) ++ - dev->vector_cap))) { ++ fibptr->vector_no = 0; ++ } else { ++ fibptr->vector_no = vector; ++ vector++; ++ if (vector == dev->max_msix) ++ vector = 1; ++ } ++ } ++} ++ + /** + * aac_fib_setup - setup the fibs + * @dev: Adapter to set up +@@ -151,6 +176,12 @@ int aac_fib_setup(struct aac_dev * dev) + hw_fib_pa = hw_fib_pa + + dev->max_fib_size + sizeof(struct aac_fib_xporthdr); + } ++ ++ /* ++ *Assign vector numbers to fibs ++ */ ++ aac_fib_vector_assign(dev); ++ + /* + * Add the fib chain to the free list + */ +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index 76eaa38ffd6e..8a8e84548d64 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -1404,8 +1404,18 @@ static int aac_acquire_resources(struct aac_dev *dev) + + aac_adapter_enable_int(dev); + +- if (!dev->sync_mode) ++ /*max msix may change after EEH ++ * Re-assign vectors to fibs ++ */ ++ aac_fib_vector_assign(dev); ++ ++ if (!dev->sync_mode) { ++ /* After EEH recovery or suspend resume, max_msix count ++ * may change, therfore updating in init as well. ++ */ + aac_adapter_start(dev); ++ dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix); ++ } + return 0; + + error_iounmap: +diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c +index 2aa34ea8ceb1..bc0203f3d243 100644 +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -156,8 +156,8 @@ static irqreturn_t aac_src_intr_message(int irq, void *dev_id) + break; + if (dev->msi_enabled && dev->max_msix > 1) + atomic_dec(&dev->rrq_outstanding[vector_no]); +- aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL); + dev->host_rrq[index++] = 0; ++ aac_intr_normal(dev, handle-1, 0, isFastResponse, NULL); + if (index == (vector_no + 1) * dev->vector_cap) + index = vector_no * dev->vector_cap; + dev->host_rrq_idx[vector_no] = index; +@@ -452,36 +452,20 @@ static int aac_src_deliver_message(struct fib *fib) + #endif + + u16 hdr_size = le16_to_cpu(fib->hw_fib_va->header.Size); ++ u16 vector_no; + + atomic_inc(&q->numpending); + + if (dev->msi_enabled && fib->hw_fib_va->header.Command != AifRequest && + dev->max_msix > 1) { +- u_int16_t vector_no, first_choice = 0xffff; +- +- vector_no = dev->fibs_pushed_no % dev->max_msix; +- do { +- vector_no += 1; +- if (vector_no == dev->max_msix) +- vector_no = 1; +- if (atomic_read(&dev->rrq_outstanding[vector_no]) < +- dev->vector_cap) +- break; +- if (0xffff == first_choice) +- first_choice = vector_no; +- else if (vector_no == first_choice) +- break; +- } while (1); +- if (vector_no == first_choice) +- vector_no = 0; +- atomic_inc(&dev->rrq_outstanding[vector_no]); +- if (dev->fibs_pushed_no == 0xffffffff) +- dev->fibs_pushed_no = 0; +- else +- dev->fibs_pushed_no++; ++ vector_no = fib->vector_no; + fib->hw_fib_va->header.Handle += (vector_no << 16); ++ } else { ++ vector_no = 0; + } + ++ atomic_inc(&dev->rrq_outstanding[vector_no]); ++ + if (dev->comm_interface == AAC_COMM_MESSAGE_TYPE2) { + /* Calculate the amount to the fibsize bits */ + fibsize = (hdr_size + 127) / 128 - 1; +diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c +index b846a4683562..fc6a83188c1e 100644 +--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c ++++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c +@@ -1336,6 +1336,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct scsi_device *sdev, + case AHC_DEV_Q_TAGGED: + scsi_change_queue_depth(sdev, + dev->openings + dev->active); ++ break; + default: + /* + * We allow the OS to queue 2 untagged transactions to +diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c +index e65478651ca9..389825ba5d96 100644 +--- a/drivers/scsi/atari_NCR5380.c ++++ b/drivers/scsi/atari_NCR5380.c +@@ -862,7 +862,7 @@ static struct scsi_cmnd *dequeue_next_cmd(struct Scsi_Host *instance) + struct NCR5380_cmd *ncmd; + struct scsi_cmnd *cmd; + +- if (list_empty(&hostdata->autosense)) { ++ if (hostdata->sensing || list_empty(&hostdata->autosense)) { + list_for_each_entry(ncmd, &hostdata->unissued, list) { + cmd = NCR5380_to_scmd(ncmd); + dsprintk(NDEBUG_QUEUES, instance, "dequeue: cmd=%p target=%d busy=0x%02x lun=%llu\n", +@@ -901,7 +901,7 @@ static void requeue_cmd(struct Scsi_Host *instance, struct scsi_cmnd *cmd) + struct NCR5380_hostdata *hostdata = shost_priv(instance); + struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); + +- if (hostdata->sensing) { ++ if (hostdata->sensing == cmd) { + scsi_eh_restore_cmnd(cmd, &hostdata->ses); + list_add(&ncmd->list, &hostdata->autosense); + hostdata->sensing = NULL; +@@ -923,7 +923,6 @@ static void NCR5380_main(struct work_struct *work) + struct NCR5380_hostdata *hostdata = + container_of(work, struct NCR5380_hostdata, main_task); + struct Scsi_Host *instance = hostdata->host; +- struct scsi_cmnd *cmd; + int done; + + /* +@@ -936,8 +935,11 @@ static void NCR5380_main(struct work_struct *work) + done = 1; + + spin_lock_irq(&hostdata->lock); +- while (!hostdata->connected && +- (cmd = dequeue_next_cmd(instance))) { ++ while (!hostdata->connected && !hostdata->selecting) { ++ struct scsi_cmnd *cmd = dequeue_next_cmd(instance); ++ ++ if (!cmd) ++ break; + + dsprintk(NDEBUG_MAIN, instance, "main: dequeued %p\n", cmd); + +@@ -960,8 +962,7 @@ static void NCR5380_main(struct work_struct *work) + #ifdef SUPPORT_TAGS + cmd_get_tag(cmd, cmd->cmnd[0] != REQUEST_SENSE); + #endif +- cmd = NCR5380_select(instance, cmd); +- if (!cmd) { ++ if (!NCR5380_select(instance, cmd)) { + dsprintk(NDEBUG_MAIN, instance, "main: select complete\n"); + maybe_release_dma_irq(instance); + } else { +@@ -1257,6 +1258,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance, + /* Reselection interrupt */ + goto out; + } ++ if (!hostdata->selecting) { ++ /* Command was aborted */ ++ NCR5380_write(MODE_REG, MR_BASE); ++ goto out; ++ } + if (err < 0) { + NCR5380_write(MODE_REG, MR_BASE); + shost_printk(KERN_ERR, instance, +@@ -1838,9 +1844,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + unsigned char msgout = NOP; + int sink = 0; + int len; +-#if defined(REAL_DMA) + int transfersize; +-#endif + unsigned char *data; + unsigned char phase, tmp, extended_msg[10], old_phase = 0xff; + struct scsi_cmnd *cmd; +@@ -1909,6 +1913,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + do_abort(instance); + cmd->result = DID_ERROR << 16; + complete_cmd(instance, cmd); ++ hostdata->connected = NULL; + return; + #endif + case PHASE_DATAIN: +@@ -1966,7 +1971,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + sink = 1; + do_abort(instance); + cmd->result = DID_ERROR << 16; +- complete_cmd(instance, cmd); + /* XXX - need to source or sink data here, as appropriate */ + } else { + #ifdef REAL_DMA +@@ -1983,18 +1987,22 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + } else + #endif /* defined(REAL_DMA) */ + { +- spin_unlock_irq(&hostdata->lock); +- NCR5380_transfer_pio(instance, &phase, +- (int *)&cmd->SCp.this_residual, ++ /* Break up transfer into 3 ms chunks, ++ * presuming 6 accesses per handshake. ++ */ ++ transfersize = min((unsigned long)cmd->SCp.this_residual, ++ hostdata->accesses_per_ms / 2); ++ len = transfersize; ++ NCR5380_transfer_pio(instance, &phase, &len, + (unsigned char **)&cmd->SCp.ptr); +- spin_lock_irq(&hostdata->lock); ++ cmd->SCp.this_residual -= transfersize - len; + } + #if defined(CONFIG_SUN3) && defined(REAL_DMA) + /* if we had intended to dma that command clear it */ + if (sun3_dma_setup_done == cmd) + sun3_dma_setup_done = NULL; + #endif +- break; ++ return; + case PHASE_MSGIN: + len = 1; + data = &tmp; +@@ -2487,14 +2495,17 @@ static bool list_del_cmd(struct list_head *haystack, + * [disconnected -> connected ->]... + * [autosense -> connected ->] done + * +- * If cmd is unissued then just remove it. +- * If cmd is disconnected, try to select the target. +- * If cmd is connected, try to send an abort message. +- * If cmd is waiting for autosense, give it a chance to complete but check +- * that it isn't left connected. + * If cmd was not found at all then presumably it has already been completed, + * in which case return SUCCESS to try to avoid further EH measures. ++ * + * If the command has not completed yet, we must not fail to find it. ++ * We have no option but to forget the aborted command (even if it still ++ * lacks sense data). The mid-layer may re-issue a command that is in error ++ * recovery (see scsi_send_eh_cmnd), but the logic and data structures in ++ * this driver are such that a command can appear on one queue only. ++ * ++ * The lock protects driver data structures, but EH handlers also use it ++ * to serialize their own execution and prevent their own re-entry. + */ + + static int NCR5380_abort(struct scsi_cmnd *cmd) +@@ -2517,6 +2528,7 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + "abort: removed %p from issue queue\n", cmd); + cmd->result = DID_ABORT << 16; + cmd->scsi_done(cmd); /* No tag or busy flag to worry about */ ++ goto out; + } + + if (hostdata->selecting == cmd) { +@@ -2531,58 +2543,21 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + if (list_del_cmd(&hostdata->disconnected, cmd)) { + dsprintk(NDEBUG_ABORT, instance, + "abort: removed %p from disconnected list\n", cmd); +- cmd->result = DID_ERROR << 16; +- if (!hostdata->connected) +- NCR5380_select(instance, cmd); +- if (hostdata->connected != cmd) { +- complete_cmd(instance, cmd); +- result = FAILED; +- goto out; +- } ++ /* Can't call NCR5380_select() and send ABORT because that ++ * means releasing the lock. Need a bus reset. ++ */ ++ set_host_byte(cmd, DID_ERROR); ++ complete_cmd(instance, cmd); ++ result = FAILED; ++ goto out; + } + + if (hostdata->connected == cmd) { + dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); + hostdata->connected = NULL; +- if (do_abort(instance)) { +- set_host_byte(cmd, DID_ERROR); +- complete_cmd(instance, cmd); +- result = FAILED; +- goto out; +- } +- set_host_byte(cmd, DID_ABORT); + #ifdef REAL_DMA + hostdata->dma_len = 0; + #endif +- if (cmd->cmnd[0] == REQUEST_SENSE) +- complete_cmd(instance, cmd); +- else { +- struct NCR5380_cmd *ncmd = scsi_cmd_priv(cmd); +- +- /* Perform autosense for this command */ +- list_add(&ncmd->list, &hostdata->autosense); +- } +- } +- +- if (list_find_cmd(&hostdata->autosense, cmd)) { +- dsprintk(NDEBUG_ABORT, instance, +- "abort: found %p on sense queue\n", cmd); +- spin_unlock_irqrestore(&hostdata->lock, flags); +- queue_work(hostdata->work_q, &hostdata->main_task); +- msleep(1000); +- spin_lock_irqsave(&hostdata->lock, flags); +- if (list_del_cmd(&hostdata->autosense, cmd)) { +- dsprintk(NDEBUG_ABORT, instance, +- "abort: removed %p from sense queue\n", cmd); +- set_host_byte(cmd, DID_ABORT); +- complete_cmd(instance, cmd); +- goto out; +- } +- } +- +- if (hostdata->connected == cmd) { +- dsprintk(NDEBUG_ABORT, instance, "abort: cmd %p is connected\n", cmd); +- hostdata->connected = NULL; + if (do_abort(instance)) { + set_host_byte(cmd, DID_ERROR); + complete_cmd(instance, cmd); +@@ -2590,9 +2565,14 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + goto out; + } + set_host_byte(cmd, DID_ABORT); +-#ifdef REAL_DMA +- hostdata->dma_len = 0; +-#endif ++ complete_cmd(instance, cmd); ++ goto out; ++ } ++ ++ if (list_del_cmd(&hostdata->autosense, cmd)) { ++ dsprintk(NDEBUG_ABORT, instance, ++ "abort: removed %p from sense queue\n", cmd); ++ set_host_byte(cmd, DID_ERROR); + complete_cmd(instance, cmd); + } + +@@ -2646,7 +2626,16 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + * commands! + */ + +- hostdata->selecting = NULL; ++ if (list_del_cmd(&hostdata->unissued, cmd)) { ++ cmd->result = DID_RESET << 16; ++ cmd->scsi_done(cmd); ++ } ++ ++ if (hostdata->selecting) { ++ hostdata->selecting->result = DID_RESET << 16; ++ complete_cmd(instance, hostdata->selecting); ++ hostdata->selecting = NULL; ++ } + + list_for_each_entry(ncmd, &hostdata->disconnected, list) { + struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); +@@ -2654,6 +2643,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + set_host_byte(cmd, DID_RESET); + cmd->scsi_done(cmd); + } ++ INIT_LIST_HEAD(&hostdata->disconnected); + + list_for_each_entry(ncmd, &hostdata->autosense, list) { + struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); +@@ -2661,6 +2651,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + set_host_byte(cmd, DID_RESET); + cmd->scsi_done(cmd); + } ++ INIT_LIST_HEAD(&hostdata->autosense); + + if (hostdata->connected) { + set_host_byte(hostdata->connected, DID_RESET); +@@ -2668,12 +2659,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + hostdata->connected = NULL; + } + +- if (hostdata->sensing) { +- set_host_byte(hostdata->connected, DID_RESET); +- complete_cmd(instance, hostdata->sensing); +- hostdata->sensing = NULL; +- } +- + #ifdef SUPPORT_TAGS + free_all_tags(hostdata); + #endif +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index cb9072a841be..069e5c50abd0 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -4468,6 +4468,7 @@ put_shost: + scsi_host_put(phba->shost); + free_kset: + iscsi_boot_destroy_kset(phba->boot_kset); ++ phba->boot_kset = NULL; + return -ENOMEM; + } + +diff --git a/drivers/scsi/scsi_common.c b/drivers/scsi/scsi_common.c +index c126966130ab..ce79de822e46 100644 +--- a/drivers/scsi/scsi_common.c ++++ b/drivers/scsi/scsi_common.c +@@ -278,8 +278,16 @@ int scsi_set_sense_information(u8 *buf, int buf_len, u64 info) + ucp[3] = 0; + put_unaligned_be64(info, &ucp[4]); + } else if ((buf[0] & 0x7f) == 0x70) { +- buf[0] |= 0x80; +- put_unaligned_be64(info, &buf[3]); ++ /* ++ * Only set the 'VALID' bit if we can represent the value ++ * correctly; otherwise just fill out the lower bytes and ++ * clear the 'VALID' flag. ++ */ ++ if (info <= 0xffffffffUL) ++ buf[0] |= 0x80; ++ else ++ buf[0] &= 0x7f; ++ put_unaligned_be32((u32)info, &buf[3]); + } + + return 0; +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index d749da765df1..5a5457ac9cdb 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -648,7 +648,7 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode) + */ + if (sdkp->lbprz) { + q->limits.discard_alignment = 0; +- q->limits.discard_granularity = 1; ++ q->limits.discard_granularity = logical_block_size; + } else { + q->limits.discard_alignment = sdkp->unmap_alignment * + logical_block_size; +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 5e820674432c..ae7d9bdf409c 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -652,7 +652,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + else + hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; + hp->dxfer_len = mxsize; +- if (hp->dxfer_direction == SG_DXFER_TO_DEV) ++ if ((hp->dxfer_direction == SG_DXFER_TO_DEV) || ++ (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV)) + hp->dxferp = (char __user *)buf + cmd_size; + else + hp->dxferp = NULL; +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 292c04eec9ad..3ddcabb790a8 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -914,8 +914,9 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + do_work = true; + process_err_fn = storvsc_remove_lun; + break; +- case (SRB_STATUS_ABORTED | SRB_STATUS_AUTOSENSE_VALID): +- if ((asc == 0x2a) && (ascq == 0x9)) { ++ case SRB_STATUS_ABORTED: ++ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID && ++ (asc == 0x2a) && (ascq == 0x9)) { + do_work = true; + process_err_fn = storvsc_device_scan; + /* +diff --git a/drivers/staging/android/ion/ion_test.c b/drivers/staging/android/ion/ion_test.c +index b8dcf5a26cc4..58d46893e5ff 100644 +--- a/drivers/staging/android/ion/ion_test.c ++++ b/drivers/staging/android/ion/ion_test.c +@@ -285,8 +285,8 @@ static int __init ion_test_init(void) + { + ion_test_pdev = platform_device_register_simple("ion-test", + -1, NULL, 0); +- if (!ion_test_pdev) +- return -ENODEV; ++ if (IS_ERR(ion_test_pdev)) ++ return PTR_ERR(ion_test_pdev); + + return platform_driver_probe(&ion_test_platform_driver, ion_test_probe); + } +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 5e8130a7d670..0e9f77924e26 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -246,24 +246,24 @@ static void ni_writel(struct comedi_device *dev, uint32_t data, int reg) + { + if (dev->mmio) + writel(data, dev->mmio + reg); +- +- outl(data, dev->iobase + reg); ++ else ++ outl(data, dev->iobase + reg); + } + + static void ni_writew(struct comedi_device *dev, uint16_t data, int reg) + { + if (dev->mmio) + writew(data, dev->mmio + reg); +- +- outw(data, dev->iobase + reg); ++ else ++ outw(data, dev->iobase + reg); + } + + static void ni_writeb(struct comedi_device *dev, uint8_t data, int reg) + { + if (dev->mmio) + writeb(data, dev->mmio + reg); +- +- outb(data, dev->iobase + reg); ++ else ++ outb(data, dev->iobase + reg); + } + + static uint32_t ni_readl(struct comedi_device *dev, int reg) +diff --git a/drivers/staging/comedi/drivers/ni_tiocmd.c b/drivers/staging/comedi/drivers/ni_tiocmd.c +index 437f723bb34d..823e47910004 100644 +--- a/drivers/staging/comedi/drivers/ni_tiocmd.c ++++ b/drivers/staging/comedi/drivers/ni_tiocmd.c +@@ -92,7 +92,7 @@ static int ni_tio_input_inttrig(struct comedi_device *dev, + unsigned long flags; + int ret = 0; + +- if (trig_num != cmd->start_src) ++ if (trig_num != cmd->start_arg) + return -EINVAL; + + spin_lock_irqsave(&counter->lock, flags); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 867bc6d0a68a..43d8b42c0f22 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2596,8 +2596,6 @@ void target_wait_for_sess_cmds(struct se_session *se_sess) + + list_for_each_entry_safe(se_cmd, tmp_cmd, + &se_sess->sess_wait_list, se_cmd_list) { +- list_del_init(&se_cmd->se_cmd_list); +- + pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:" + " %d\n", se_cmd, se_cmd->t_state, + se_cmd->se_tfo->get_cmd_state(se_cmd)); +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index a0a8fd1235e2..d4b54653ecf8 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip) + { + enum thermal_trip_type type; + ++ /* Ignore disabled trip points */ ++ if (test_bit(trip, &tz->trips_disabled)) ++ return; ++ + tz->ops->get_trip_type(tz, trip, &type); + + if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT) +@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, + { + struct thermal_zone_device *tz; + enum thermal_trip_type trip_type; ++ int trip_temp; + int result; + int count; + int passive = 0; +@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, + goto unregister; + + for (count = 0; count < trips; count++) { +- tz->ops->get_trip_type(tz, count, &trip_type); ++ if (tz->ops->get_trip_type(tz, count, &trip_type)) ++ set_bit(count, &tz->trips_disabled); + if (trip_type == THERMAL_TRIP_PASSIVE) + passive = 1; ++ if (tz->ops->get_trip_temp(tz, count, &trip_temp)) ++ set_bit(count, &tz->trips_disabled); ++ /* Check for bogus trip points */ ++ if (trip_temp == 0) ++ set_bit(count, &tz->trips_disabled); + } + + if (!passive) { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 8d262bce97e4..720b9465b12e 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -731,22 +731,16 @@ static int size_fifo(struct uart_8250_port *up) + */ + static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p) + { +- unsigned char old_dll, old_dlm, old_lcr; +- unsigned int id; ++ unsigned char old_lcr; ++ unsigned int id, old_dl; + + old_lcr = serial_in(p, UART_LCR); + serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A); ++ old_dl = serial_dl_read(p); ++ serial_dl_write(p, 0); ++ id = serial_dl_read(p); ++ serial_dl_write(p, old_dl); + +- old_dll = serial_in(p, UART_DLL); +- old_dlm = serial_in(p, UART_DLM); +- +- serial_out(p, UART_DLL, 0); +- serial_out(p, UART_DLM, 0); +- +- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8; +- +- serial_out(p, UART_DLL, old_dll); +- serial_out(p, UART_DLM, old_dlm); + serial_out(p, UART_LCR, old_lcr); + + return id; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index fa4e23930614..d37fdcc3143c 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1114,6 +1114,9 @@ static int acm_probe(struct usb_interface *intf, + if (quirks == NO_UNION_NORMAL) { + data_interface = usb_ifnum_to_if(usb_dev, 1); + control_interface = usb_ifnum_to_if(usb_dev, 0); ++ /* we would crash */ ++ if (!data_interface || !control_interface) ++ return -ENODEV; + goto skip_normal_probe; + } + +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 56593a9a8726..2057d91d8336 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -502,11 +502,15 @@ static int usb_unbind_interface(struct device *dev) + int usb_driver_claim_interface(struct usb_driver *driver, + struct usb_interface *iface, void *priv) + { +- struct device *dev = &iface->dev; ++ struct device *dev; + struct usb_device *udev; + int retval = 0; + int lpm_disable_error; + ++ if (!iface) ++ return -ENODEV; ++ ++ dev = &iface->dev; + if (dev->driver) + return -EBUSY; + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 51b436918f78..84f65743f29a 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4292,7 +4292,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + { + struct usb_device *hdev = hub->hdev; + struct usb_hcd *hcd = bus_to_hcd(hdev->bus); +- int i, j, retval; ++ int retries, operations, retval, i; + unsigned delay = HUB_SHORT_RESET_TIME; + enum usb_device_speed oldspeed = udev->speed; + const char *speed; +@@ -4394,7 +4394,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + * first 8 bytes of the device descriptor to get the ep0 maxpacket + * value. + */ +- for (i = 0; i < GET_DESCRIPTOR_TRIES; (++i, msleep(100))) { ++ for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) { + bool did_new_scheme = false; + + if (use_new_scheme(udev, retry_counter)) { +@@ -4421,7 +4421,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + * 255 is for WUSB devices, we actually need to use + * 512 (WUSB1.0[4.8.1]). + */ +- for (j = 0; j < 3; ++j) { ++ for (operations = 0; operations < 3; ++operations) { + buf->bMaxPacketSize0 = 0; + r = usb_control_msg(udev, usb_rcvaddr0pipe(), + USB_REQ_GET_DESCRIPTOR, USB_DIR_IN, +@@ -4441,7 +4441,13 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + r = -EPROTO; + break; + } +- if (r == 0) ++ /* ++ * Some devices time out if they are powered on ++ * when already connected. They need a second ++ * reset. But only on the first attempt, ++ * lest we get into a time out/reset loop ++ */ ++ if (r == 0 || (r == -ETIMEDOUT && retries == 0)) + break; + } + udev->descriptor.bMaxPacketSize0 = +@@ -4473,7 +4479,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + * authorization will assign the final address. + */ + if (udev->wusb == 0) { +- for (j = 0; j < SET_ADDRESS_TRIES; ++j) { ++ for (operations = 0; operations < SET_ADDRESS_TRIES; ++operations) { + retval = hub_set_address(udev, devnum); + if (retval >= 0) + break; +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index c6bfd13f6c92..1950e87b4219 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -787,6 +787,12 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + ++ if (iface_desc->desc.bNumEndpoints < 1) { ++ dev_err(&interface->dev, "Invalid number of endpoints\n"); ++ retval = -EINVAL; ++ goto error; ++ } ++ + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 73a366de5102..9bc0e090b881 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -165,6 +165,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ + { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ + { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ ++ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index 01bf53392819..244acb1299a9 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -447,6 +447,11 @@ static int cypress_generic_port_probe(struct usb_serial_port *port) + struct usb_serial *serial = port->serial; + struct cypress_private *priv; + ++ if (!port->interrupt_out_urb || !port->interrupt_in_urb) { ++ dev_err(&port->dev, "required endpoint is missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(struct cypress_private), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -606,12 +611,6 @@ static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port) + cypress_set_termios(tty, port, &priv->tmp_termios); + + /* setup the port and start reading from the device */ +- if (!port->interrupt_in_urb) { +- dev_err(&port->dev, "%s - interrupt_in_urb is empty!\n", +- __func__); +- return -1; +- } +- + usb_fill_int_urb(port->interrupt_in_urb, serial->dev, + usb_rcvintpipe(serial->dev, port->interrupt_in_endpointAddress), + port->interrupt_in_urb->transfer_buffer, +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 12b0e67473ba..3df7b7ec178e 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1251,8 +1251,27 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num) + + static int digi_startup(struct usb_serial *serial) + { ++ struct device *dev = &serial->interface->dev; + struct digi_serial *serial_priv; + int ret; ++ int i; ++ ++ /* check whether the device has the expected number of endpoints */ ++ if (serial->num_port_pointers < serial->type->num_ports + 1) { ++ dev_err(dev, "OOB endpoints missing\n"); ++ return -ENODEV; ++ } ++ ++ for (i = 0; i < serial->type->num_ports + 1 ; i++) { ++ if (!serial->port[i]->read_urb) { ++ dev_err(dev, "bulk-in endpoint missing\n"); ++ return -ENODEV; ++ } ++ if (!serial->port[i]->write_urb) { ++ dev_err(dev, "bulk-out endpoint missing\n"); ++ return -ENODEV; ++ } ++ } + + serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); + if (!serial_priv) +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 8c660ae401d8..b61f12160d37 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1004,6 +1004,10 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) }, ++ /* ICP DAS I-756xU devices */ ++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) }, ++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, ++ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index a84df2513994..c5d6c1e73e8e 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -872,6 +872,14 @@ + #define NOVITUS_BONO_E_PID 0x6010 + + /* ++ * ICPDAS I-756*U devices ++ */ ++#define ICPDAS_VID 0x1b5c ++#define ICPDAS_I7560U_PID 0x0103 ++#define ICPDAS_I7561U_PID 0x0104 ++#define ICPDAS_I7563U_PID 0x0105 ++ ++/* + * RT Systems programming cables for various ham radios + */ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index fd707d6a10e2..89726f702202 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -376,14 +376,21 @@ static void mct_u232_msr_to_state(struct usb_serial_port *port, + + static int mct_u232_port_probe(struct usb_serial_port *port) + { ++ struct usb_serial *serial = port->serial; + struct mct_u232_private *priv; + ++ /* check first to simplify error handling */ ++ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { ++ dev_err(&port->dev, "expected endpoint missing\n"); ++ return -ENODEV; ++ } ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + /* Use second interrupt-in endpoint for reading. */ +- priv->read_urb = port->serial->port[1]->interrupt_in_urb; ++ priv->read_urb = serial->port[1]->interrupt_in_urb; + priv->read_urb->context = port; + + spin_lock_init(&priv->lock); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 348e19834b83..c6f497f16526 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1818,6 +1818,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 9ff9404f99d7..c90a7e46cc7b 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -812,7 +812,7 @@ static struct scsi_host_template uas_host_template = { + .slave_configure = uas_slave_configure, + .eh_abort_handler = uas_eh_abort_handler, + .eh_bus_reset_handler = uas_eh_bus_reset_handler, +- .can_queue = 65536, /* Is there a limit on the _host_ ? */ ++ .can_queue = MAX_CMNDS, + .this_id = -1, + .sg_tablesize = SG_NONE, + .skip_settle_delay = 1, +diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c +index 71e78ef4b736..3a75f3b53452 100644 +--- a/drivers/watchdog/rc32434_wdt.c ++++ b/drivers/watchdog/rc32434_wdt.c +@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd, + return -EINVAL; + /* Fall through */ + case WDIOC_GETTIMEOUT: +- return copy_to_user(argp, &timeout, sizeof(int)); ++ return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0; + default: + return -ENOTTY; + } +diff --git a/fs/coredump.c b/fs/coredump.c +index 9ea87e9fdccf..47c32c3bfa1d 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -32,6 +32,9 @@ + #include <linux/pipe_fs_i.h> + #include <linux/oom.h> + #include <linux/compat.h> ++#include <linux/sched.h> ++#include <linux/fs.h> ++#include <linux/path.h> + #include <linux/timekeeping.h> + + #include <asm/uaccess.h> +@@ -649,6 +652,8 @@ void do_coredump(const siginfo_t *siginfo) + } + } else { + struct inode *inode; ++ int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW | ++ O_LARGEFILE | O_EXCL; + + if (cprm.limit < binfmt->min_coredump) + goto fail_unlock; +@@ -687,10 +692,27 @@ void do_coredump(const siginfo_t *siginfo) + * what matters is that at least one of the two processes + * writes its coredump successfully, not which one. + */ +- cprm.file = filp_open(cn.corename, +- O_CREAT | 2 | O_NOFOLLOW | +- O_LARGEFILE | O_EXCL, +- 0600); ++ if (need_suid_safe) { ++ /* ++ * Using user namespaces, normal user tasks can change ++ * their current->fs->root to point to arbitrary ++ * directories. Since the intention of the "only dump ++ * with a fully qualified path" rule is to control where ++ * coredumps may be placed using root privileges, ++ * current->fs->root must not be used. Instead, use the ++ * root directory of init_task. ++ */ ++ struct path root; ++ ++ task_lock(&init_task); ++ get_fs_root(init_task.fs, &root); ++ task_unlock(&init_task); ++ cprm.file = file_open_root(root.dentry, root.mnt, ++ cn.corename, open_flags, 0600); ++ path_put(&root); ++ } else { ++ cprm.file = filp_open(cn.corename, open_flags, 0600); ++ } + if (IS_ERR(cprm.file)) + goto fail_unlock; + +diff --git a/fs/fhandle.c b/fs/fhandle.c +index d59712dfa3e7..ca3c3dd01789 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd, + path_put(&path); + return fd; + } +- file = file_open_root(path.dentry, path.mnt, "", open_flag); ++ file = file_open_root(path.dentry, path.mnt, "", open_flag, 0); + if (IS_ERR(file)) { + put_unused_fd(fd); + retval = PTR_ERR(file); +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 5c46ed9f3e14..fee81e8768c9 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -281,13 +281,15 @@ locked_inode_to_wb_and_lock_list(struct inode *inode) + wb_get(wb); + spin_unlock(&inode->i_lock); + spin_lock(&wb->list_lock); +- wb_put(wb); /* not gonna deref it anymore */ + + /* i_wb may have changed inbetween, can't use inode_to_wb() */ +- if (likely(wb == inode->i_wb)) +- return wb; /* @inode already has ref */ ++ if (likely(wb == inode->i_wb)) { ++ wb_put(wb); /* @inode already has ref */ ++ return wb; ++ } + + spin_unlock(&wb->list_lock); ++ wb_put(wb); + cpu_relax(); + spin_lock(&inode->i_lock); + } +@@ -1337,10 +1339,10 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc) + * we go e.g. from filesystem. Flusher thread uses __writeback_single_inode() + * and does more profound writeback list handling in writeback_sb_inodes(). + */ +-static int +-writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, +- struct writeback_control *wbc) ++static int writeback_single_inode(struct inode *inode, ++ struct writeback_control *wbc) + { ++ struct bdi_writeback *wb; + int ret = 0; + + spin_lock(&inode->i_lock); +@@ -1378,7 +1380,8 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb, + ret = __writeback_single_inode(inode, wbc); + + wbc_detach_inode(wbc); +- spin_lock(&wb->list_lock); ++ ++ wb = inode_to_wb_and_lock_list(inode); + spin_lock(&inode->i_lock); + /* + * If inode is clean, remove it from writeback lists. Otherwise don't +@@ -1453,6 +1456,7 @@ static long writeback_sb_inodes(struct super_block *sb, + + while (!list_empty(&wb->b_io)) { + struct inode *inode = wb_inode(wb->b_io.prev); ++ struct bdi_writeback *tmp_wb; + + if (inode->i_sb != sb) { + if (work->sb) { +@@ -1543,15 +1547,23 @@ static long writeback_sb_inodes(struct super_block *sb, + cond_resched(); + } + +- +- spin_lock(&wb->list_lock); ++ /* ++ * Requeue @inode if still dirty. Be careful as @inode may ++ * have been switched to another wb in the meantime. ++ */ ++ tmp_wb = inode_to_wb_and_lock_list(inode); + spin_lock(&inode->i_lock); + if (!(inode->i_state & I_DIRTY_ALL)) + wrote++; +- requeue_inode(inode, wb, &wbc); ++ requeue_inode(inode, tmp_wb, &wbc); + inode_sync_complete(inode); + spin_unlock(&inode->i_lock); + ++ if (unlikely(tmp_wb != wb)) { ++ spin_unlock(&tmp_wb->list_lock); ++ spin_lock(&wb->list_lock); ++ } ++ + /* + * bail out to wb_writeback() often enough to check + * background threshold and other termination conditions. +@@ -2338,7 +2350,6 @@ EXPORT_SYMBOL(sync_inodes_sb); + */ + int write_inode_now(struct inode *inode, int sync) + { +- struct bdi_writeback *wb = &inode_to_bdi(inode)->wb; + struct writeback_control wbc = { + .nr_to_write = LONG_MAX, + .sync_mode = sync ? WB_SYNC_ALL : WB_SYNC_NONE, +@@ -2350,7 +2361,7 @@ int write_inode_now(struct inode *inode, int sync) + wbc.nr_to_write = 0; + + might_sleep(); +- return writeback_single_inode(inode, wb, &wbc); ++ return writeback_single_inode(inode, &wbc); + } + EXPORT_SYMBOL(write_inode_now); + +@@ -2367,7 +2378,7 @@ EXPORT_SYMBOL(write_inode_now); + */ + int sync_inode(struct inode *inode, struct writeback_control *wbc) + { +- return writeback_single_inode(inode, &inode_to_bdi(inode)->wb, wbc); ++ return writeback_single_inode(inode, wbc); + } + EXPORT_SYMBOL(sync_inode); + +diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c +index 8e3ee1936c7e..c5b6b7165489 100644 +--- a/fs/fuse/cuse.c ++++ b/fs/fuse/cuse.c +@@ -90,7 +90,7 @@ static struct list_head *cuse_conntbl_head(dev_t devt) + + static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to) + { +- struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp); + loff_t pos = 0; + + return fuse_direct_io(&io, to, &pos, FUSE_DIO_CUSE); +@@ -98,7 +98,7 @@ static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to) + + static ssize_t cuse_write_iter(struct kiocb *kiocb, struct iov_iter *from) + { +- struct fuse_io_priv io = { .async = 0, .file = kiocb->ki_filp }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb->ki_filp); + loff_t pos = 0; + /* + * No locking or generic_write_checks(), the server is +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index b03d253ece15..416108b42412 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -528,6 +528,11 @@ static void fuse_release_user_pages(struct fuse_req *req, int write) + } + } + ++static void fuse_io_release(struct kref *kref) ++{ ++ kfree(container_of(kref, struct fuse_io_priv, refcnt)); ++} ++ + static ssize_t fuse_get_res_by_io(struct fuse_io_priv *io) + { + if (io->err) +@@ -585,8 +590,9 @@ static void fuse_aio_complete(struct fuse_io_priv *io, int err, ssize_t pos) + } + + io->iocb->ki_complete(io->iocb, res, 0); +- kfree(io); + } ++ ++ kref_put(&io->refcnt, fuse_io_release); + } + + static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req) +@@ -613,6 +619,7 @@ static size_t fuse_async_req_send(struct fuse_conn *fc, struct fuse_req *req, + size_t num_bytes, struct fuse_io_priv *io) + { + spin_lock(&io->lock); ++ kref_get(&io->refcnt); + io->size += num_bytes; + io->reqs++; + spin_unlock(&io->lock); +@@ -691,7 +698,7 @@ static void fuse_short_read(struct fuse_req *req, struct inode *inode, + + static int fuse_do_readpage(struct file *file, struct page *page) + { +- struct fuse_io_priv io = { .async = 0, .file = file }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); + struct inode *inode = page->mapping->host; + struct fuse_conn *fc = get_fuse_conn(inode); + struct fuse_req *req; +@@ -984,7 +991,7 @@ static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file, + size_t res; + unsigned offset; + unsigned i; +- struct fuse_io_priv io = { .async = 0, .file = file }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); + + for (i = 0; i < req->num_pages; i++) + fuse_wait_on_page_writeback(inode, req->pages[i]->index); +@@ -1398,7 +1405,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io, + + static ssize_t fuse_direct_read_iter(struct kiocb *iocb, struct iov_iter *to) + { +- struct fuse_io_priv io = { .async = 0, .file = iocb->ki_filp }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(iocb->ki_filp); + return __fuse_direct_read(&io, to, &iocb->ki_pos); + } + +@@ -1406,7 +1413,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from) + { + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); +- struct fuse_io_priv io = { .async = 0, .file = file }; ++ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file); + ssize_t res; + + if (is_bad_inode(inode)) +@@ -2843,6 +2850,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) + loff_t i_size; + size_t count = iov_iter_count(iter); + struct fuse_io_priv *io; ++ bool is_sync = is_sync_kiocb(iocb); + + pos = offset; + inode = file->f_mapping->host; +@@ -2863,6 +2871,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) + if (!io) + return -ENOMEM; + spin_lock_init(&io->lock); ++ kref_init(&io->refcnt); + io->reqs = 1; + io->bytes = -1; + io->size = 0; +@@ -2882,12 +2891,18 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) + * to wait on real async I/O requests, so we must submit this request + * synchronously. + */ +- if (!is_sync_kiocb(iocb) && (offset + count > i_size) && ++ if (!is_sync && (offset + count > i_size) && + iov_iter_rw(iter) == WRITE) + io->async = false; + +- if (io->async && is_sync_kiocb(iocb)) ++ if (io->async && is_sync) { ++ /* ++ * Additional reference to keep io around after ++ * calling fuse_aio_complete() ++ */ ++ kref_get(&io->refcnt); + io->done = &wait; ++ } + + if (iov_iter_rw(iter) == WRITE) { + ret = fuse_direct_io(io, iter, &pos, FUSE_DIO_WRITE); +@@ -2900,14 +2915,14 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter, loff_t offset) + fuse_aio_complete(io, ret < 0 ? ret : 0, -1); + + /* we have a non-extending, async request, so return */ +- if (!is_sync_kiocb(iocb)) ++ if (!is_sync) + return -EIOCBQUEUED; + + wait_for_completion(&wait); + ret = fuse_get_res_by_io(io); + } + +- kfree(io); ++ kref_put(&io->refcnt, fuse_io_release); + + if (iov_iter_rw(iter) == WRITE) { + if (ret > 0) +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index ce394b5fe6b4..eddbe02c4028 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -22,6 +22,7 @@ + #include <linux/rbtree.h> + #include <linux/poll.h> + #include <linux/workqueue.h> ++#include <linux/kref.h> + + /** Max number of pages that can be used in a single read request */ + #define FUSE_MAX_PAGES_PER_REQ 32 +@@ -243,6 +244,7 @@ struct fuse_args { + + /** The request IO state (for asynchronous processing) */ + struct fuse_io_priv { ++ struct kref refcnt; + int async; + spinlock_t lock; + unsigned reqs; +@@ -256,6 +258,13 @@ struct fuse_io_priv { + struct completion *done; + }; + ++#define FUSE_IO_PRIV_SYNC(f) \ ++{ \ ++ .refcnt = { ATOMIC_INIT(1) }, \ ++ .async = 0, \ ++ .file = f, \ ++} ++ + /** + * Request flags + * +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 81e622681c82..624a57a9c4aa 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1408,11 +1408,12 @@ out: + /** + * jbd2_mark_journal_empty() - Mark on disk journal as empty. + * @journal: The journal to update. ++ * @write_op: With which operation should we write the journal sb + * + * Update a journal's dynamic superblock fields to show that journal is empty. + * Write updated superblock to disk waiting for IO to complete. + */ +-static void jbd2_mark_journal_empty(journal_t *journal) ++static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + { + journal_superblock_t *sb = journal->j_superblock; + +@@ -1430,7 +1431,7 @@ static void jbd2_mark_journal_empty(journal_t *journal) + sb->s_start = cpu_to_be32(0); + read_unlock(&journal->j_state_lock); + +- jbd2_write_superblock(journal, WRITE_FUA); ++ jbd2_write_superblock(journal, write_op); + + /* Log is no longer empty */ + write_lock(&journal->j_state_lock); +@@ -1716,7 +1717,13 @@ int jbd2_journal_destroy(journal_t *journal) + if (journal->j_sb_buffer) { + if (!is_journal_aborted(journal)) { + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ ++ write_lock(&journal->j_state_lock); ++ journal->j_tail_sequence = ++ ++journal->j_transaction_sequence; ++ write_unlock(&journal->j_state_lock); ++ ++ jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -1975,7 +1982,7 @@ int jbd2_journal_flush(journal_t *journal) + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + write_lock(&journal->j_state_lock); + J_ASSERT(!journal->j_running_transaction); +@@ -2021,7 +2028,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + if (write) { + /* Lock to make assertions happy... */ + mutex_lock(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal); ++ jbd2_mark_journal_empty(journal, WRITE_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 4cba7865f496..f8082c7cde8b 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -878,6 +878,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + &exp, &dentry); + if (err) + return err; ++ fh_unlock(&cstate->current_fh); + if (d_really_is_negative(dentry)) { + exp_put(exp); + err = nfserr_noent; +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index d6ef0955a979..1600ec470ce7 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1072,8 +1072,9 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename + + READ_BUF(4); + rename->rn_snamelen = be32_to_cpup(p++); +- READ_BUF(rename->rn_snamelen + 4); ++ READ_BUF(rename->rn_snamelen); + SAVEMEM(rename->rn_sname, rename->rn_snamelen); ++ READ_BUF(4); + rename->rn_tnamelen = be32_to_cpup(p++); + READ_BUF(rename->rn_tnamelen); + SAVEMEM(rename->rn_tname, rename->rn_tnamelen); +@@ -1155,13 +1156,14 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient + READ_BUF(8); + setclientid->se_callback_prog = be32_to_cpup(p++); + setclientid->se_callback_netid_len = be32_to_cpup(p++); +- +- READ_BUF(setclientid->se_callback_netid_len + 4); ++ READ_BUF(setclientid->se_callback_netid_len); + SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len); ++ READ_BUF(4); + setclientid->se_callback_addr_len = be32_to_cpup(p++); + +- READ_BUF(setclientid->se_callback_addr_len + 4); ++ READ_BUF(setclientid->se_callback_addr_len); + SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len); ++ READ_BUF(4); + setclientid->se_callback_ident = be32_to_cpup(p++); + + DECODE_TAIL; +@@ -1835,8 +1837,9 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp) + + READ_BUF(4); + argp->taglen = be32_to_cpup(p++); +- READ_BUF(argp->taglen + 8); ++ READ_BUF(argp->taglen); + SAVEMEM(argp->tag, argp->taglen); ++ READ_BUF(8); + argp->minorversion = be32_to_cpup(p++); + argp->opcnt = be32_to_cpup(p++); + max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2); +diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c +index a76b9ea7722e..a2370e2c7295 100644 +--- a/fs/ocfs2/cluster/heartbeat.c ++++ b/fs/ocfs2/cluster/heartbeat.c +@@ -1445,8 +1445,8 @@ static void o2hb_region_release(struct config_item *item) + debugfs_remove(reg->hr_debug_dir); + kfree(reg->hr_db_livenodes); + kfree(reg->hr_db_regnum); +- kfree(reg->hr_debug_elapsed_time); +- kfree(reg->hr_debug_pinned); ++ kfree(reg->hr_db_elapsed_time); ++ kfree(reg->hr_db_pinned); + + spin_lock(&o2hb_live_lock); + list_del(®->hr_all_item); +diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c +index e36d63ff1783..f90931335c6b 100644 +--- a/fs/ocfs2/dlm/dlmconvert.c ++++ b/fs/ocfs2/dlm/dlmconvert.c +@@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + struct dlm_lock *lock, int flags, int type) + { + enum dlm_status status; ++ u8 old_owner = res->owner; + + mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type, + lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS); +@@ -287,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + status = DLM_DENIED; + goto bail; + } ++ ++ if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) { ++ mlog(0, "last convert request returned DLM_RECOVERING, but " ++ "owner has already queued and sent ast to me. res %.*s, " ++ "(cookie=%u:%llu, type=%d, conv=%d)\n", ++ res->lockname.len, res->lockname.name, ++ dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)), ++ dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)), ++ lock->ml.type, lock->ml.convert_type); ++ status = DLM_NORMAL; ++ goto bail; ++ } ++ + res->state |= DLM_LOCK_RES_IN_PROGRESS; + /* move lock to local convert queue */ + /* do not alter lock refcount. switching lists. */ +@@ -316,11 +330,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + spin_lock(&res->spinlock); + res->state &= ~DLM_LOCK_RES_IN_PROGRESS; + lock->convert_pending = 0; +- /* if it failed, move it back to granted queue */ ++ /* if it failed, move it back to granted queue. ++ * if master returns DLM_NORMAL and then down before sending ast, ++ * it may have already been moved to granted queue, reset to ++ * DLM_RECOVERING and retry convert */ + if (status != DLM_NORMAL) { + if (status != DLM_NOTQUEUED) + dlm_error(status); + dlm_revert_pending_convert(res, lock); ++ } else if ((res->state & DLM_LOCK_RES_RECOVERING) || ++ (old_owner != res->owner)) { ++ mlog(0, "res %.*s is in recovering or has been recovered.\n", ++ res->lockname.len, res->lockname.name); ++ status = DLM_RECOVERING; + } + bail: + spin_unlock(&res->spinlock); +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index b94a425f0175..23d0ab881f6e 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -2071,7 +2071,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm, + dlm_lock_get(lock); + if (lock->convert_pending) { + /* move converting lock back to granted */ +- BUG_ON(i != DLM_CONVERTING_LIST); + mlog(0, "node died with convert pending " + "on %.*s. move back to granted list.\n", + res->lockname.len, res->lockname.name); +diff --git a/fs/open.c b/fs/open.c +index 55bdc75e2172..17cb6b1dab75 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -992,14 +992,12 @@ struct file *filp_open(const char *filename, int flags, umode_t mode) + EXPORT_SYMBOL(filp_open); + + struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt, +- const char *filename, int flags) ++ const char *filename, int flags, umode_t mode) + { + struct open_flags op; +- int err = build_open_flags(flags, 0, &op); ++ int err = build_open_flags(flags, mode, &op); + if (err) + return ERR_PTR(err); +- if (flags & O_CREAT) +- return ERR_PTR(-EINVAL); + return do_file_open_root(dentry, mnt, filename, &op); + } + EXPORT_SYMBOL(file_open_root); +diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c +index 2256e7e23e67..3f1190d18991 100644 +--- a/fs/proc_namespace.c ++++ b/fs/proc_namespace.c +@@ -199,6 +199,8 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt) + if (sb->s_op->show_devname) { + seq_puts(m, "device "); + err = sb->s_op->show_devname(m, mnt_path.dentry); ++ if (err) ++ goto out; + } else { + if (r->mnt_devname) { + seq_puts(m, "device "); +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 3c3b81bb6dfe..850d17fa0aa3 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -1398,7 +1398,7 @@ static int dquot_active(const struct inode *inode) + static int __dquot_initialize(struct inode *inode, int type) + { + int cnt, init_needed = 0; +- struct dquot **dquots, *got[MAXQUOTAS]; ++ struct dquot **dquots, *got[MAXQUOTAS] = {}; + struct super_block *sb = inode->i_sb; + qsize_t rsv; + int ret = 0; +@@ -1415,7 +1415,6 @@ static int __dquot_initialize(struct inode *inode, int type) + int rc; + struct dquot *dquot; + +- got[cnt] = NULL; + if (type != -1 && cnt != type) + continue; + /* +diff --git a/fs/splice.c b/fs/splice.c +index 82bc0d64fc38..19e0b103d253 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -185,6 +185,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, + unsigned int spd_pages = spd->nr_pages; + int ret, do_wakeup, page_nr; + ++ if (!spd_pages) ++ return 0; ++ + ret = 0; + do_wakeup = 0; + page_nr = 0; +diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c +index 0ef7c2ed3f8a..4fa14820e2e2 100644 +--- a/fs/xfs/xfs_attr_list.c ++++ b/fs/xfs/xfs_attr_list.c +@@ -202,8 +202,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context) + sbp->namelen, + sbp->valuelen, + &sbp->name[sbp->namelen]); +- if (error) ++ if (error) { ++ kmem_free(sbuf); + return error; ++ } + if (context->seen_enough) + break; + cursor->offset++; +@@ -454,14 +456,13 @@ xfs_attr3_leaf_list_int( + args.rmtblkcnt = xfs_attr3_rmt_blocks( + args.dp->i_mount, valuelen); + retval = xfs_attr_rmtval_get(&args); +- if (retval) +- return retval; +- retval = context->put_listent(context, +- entry->flags, +- name_rmt->name, +- (int)name_rmt->namelen, +- valuelen, +- args.value); ++ if (!retval) ++ retval = context->put_listent(context, ++ entry->flags, ++ name_rmt->name, ++ (int)name_rmt->namelen, ++ valuelen, ++ args.value); + kmem_free(args.value); + } else { + retval = context->put_listent(context, +diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h +index c30266e94806..8ef0ccbf8167 100644 +--- a/include/asm-generic/bitops/lock.h ++++ b/include/asm-generic/bitops/lock.h +@@ -29,16 +29,16 @@ do { \ + * @nr: the bit to set + * @addr: the address to start counting from + * +- * This operation is like clear_bit_unlock, however it is not atomic. +- * It does provide release barrier semantics so it can be used to unlock +- * a bit lock, however it would only be used if no other CPU can modify +- * any bits in the memory until the lock is released (a good example is +- * if the bit lock itself protects access to the other bits in the word). ++ * A weaker form of clear_bit_unlock() as used by __bit_lock_unlock(). If all ++ * the bits in the word are protected by this lock some archs can use weaker ++ * ops to safely unlock. ++ * ++ * See for example x86's implementation. + */ + #define __clear_bit_unlock(nr, addr) \ + do { \ +- smp_mb(); \ +- __clear_bit(nr, addr); \ ++ smp_mb__before_atomic(); \ ++ clear_bit(nr, addr); \ + } while (0) + + #endif /* _ASM_GENERIC_BITOPS_LOCK_H_ */ +diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h +index 789471dba6fb..89d944b25d87 100644 +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -210,6 +210,9 @@ struct css_set { + /* all css_task_iters currently walking this cset */ + struct list_head task_iters; + ++ /* dead and being drained, ignore for migration */ ++ bool dead; ++ + /* For RCU-protected deletion */ + struct rcu_head rcu_head; + }; +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index ec1c61c87d89..899ab9f8549e 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -124,6 +124,8 @@ struct dm_dev { + char name[16]; + }; + ++dev_t dm_get_dev_t(const char *path); ++ + /* + * Constructors should call these functions to ensure destination devices + * are opened/closed correctly. +diff --git a/include/linux/fs.h b/include/linux/fs.h +index ae681002100a..2c7f8d9c3c70 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -2259,7 +2259,7 @@ extern long do_sys_open(int dfd, const char __user *filename, int flags, + extern struct file *file_open_name(struct filename *, int, umode_t); + extern struct file *filp_open(const char *, int, umode_t); + extern struct file *file_open_root(struct dentry *, struct vfsmount *, +- const char *, int); ++ const char *, int, umode_t); + extern struct file * dentry_open(const struct path *, int, const struct cred *); + extern int filp_close(struct file *, fl_owner_t id); + +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index f31638c6e873..95452f72349a 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -635,7 +635,7 @@ do { \ + + #define do_trace_printk(fmt, args...) \ + do { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +@@ -679,7 +679,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...); + */ + + #define trace_puts(str) ({ \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(str) ? str : NULL; \ + \ +@@ -701,7 +701,7 @@ extern void trace_dump_stack(int skip); + #define ftrace_vprintk(fmt, vargs) \ + do { \ + if (__builtin_constant_p(fmt)) { \ +- static const char *trace_printk_fmt \ ++ static const char *trace_printk_fmt __used \ + __attribute__((section("__trace_printk_fmt"))) = \ + __builtin_constant_p(fmt) ? fmt : NULL; \ + \ +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 27716254dcc5..60042ab5d7bd 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -359,6 +359,7 @@ struct pci_dev { + unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */ + unsigned int irq_managed:1; + unsigned int has_secondary_link:1; ++ unsigned int non_compliant_bars:1; /* broken BARs; ignore them */ + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + +diff --git a/include/linux/thermal.h b/include/linux/thermal.h +index e13a1ace50e9..4a849f19e6c9 100644 +--- a/include/linux/thermal.h ++++ b/include/linux/thermal.h +@@ -156,6 +156,7 @@ struct thermal_attr { + * @trip_hyst_attrs: attributes for trip points for sysfs: trip hysteresis + * @devdata: private pointer for device private data + * @trips: number of trip points the thermal zone supports ++ * @trips_disabled; bitmap for disabled trips + * @passive_delay: number of milliseconds to wait between polls when + * performing passive cooling. + * @polling_delay: number of milliseconds to wait between polls when +@@ -191,6 +192,7 @@ struct thermal_zone_device { + struct thermal_attr *trip_hyst_attrs; + void *devdata; + int trips; ++ unsigned long trips_disabled; /* bitmap for disabled trips */ + int passive_delay; + int polling_delay; + int temperature; +diff --git a/include/linux/tty.h b/include/linux/tty.h +index d9fb4b043f56..19199c26783f 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -589,7 +589,7 @@ static inline int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p, + count = ld->ops->receive_buf2(ld->tty, p, f, count); + else { + count = min_t(int, count, ld->tty->receive_room); +- if (count) ++ if (count && ld->ops->receive_buf) + ld->ops->receive_buf(ld->tty, p, f, count); + } + return count; +diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h +index c21c38ce7450..93e63c56f48f 100644 +--- a/include/sound/hdaudio.h ++++ b/include/sound/hdaudio.h +@@ -168,11 +168,13 @@ int snd_hdac_power_up(struct hdac_device *codec); + int snd_hdac_power_down(struct hdac_device *codec); + int snd_hdac_power_up_pm(struct hdac_device *codec); + int snd_hdac_power_down_pm(struct hdac_device *codec); ++int snd_hdac_keep_power_up(struct hdac_device *codec); + #else + static inline int snd_hdac_power_up(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_down(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_up_pm(struct hdac_device *codec) { return 0; } + static inline int snd_hdac_power_down_pm(struct hdac_device *codec) { return 0; } ++static inline int snd_hdac_keep_power_up(struct hdac_device *codec) { return 0; } + #endif + + /* +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index d27904c193da..6a498daf2eec 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2474,6 +2474,14 @@ static void cgroup_migrate_add_src(struct css_set *src_cset, + lockdep_assert_held(&cgroup_mutex); + lockdep_assert_held(&css_set_lock); + ++ /* ++ * If ->dead, @src_set is associated with one or more dead cgroups ++ * and doesn't contain any migratable tasks. Ignore it early so ++ * that the rest of migration path doesn't get confused by it. ++ */ ++ if (src_cset->dead) ++ return; ++ + src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root); + + if (!list_empty(&src_cset->mg_preload_node)) +@@ -5114,6 +5122,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) + __releases(&cgroup_mutex) __acquires(&cgroup_mutex) + { + struct cgroup_subsys_state *css; ++ struct cgrp_cset_link *link; + int ssid; + + lockdep_assert_held(&cgroup_mutex); +@@ -5134,11 +5143,18 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) + return -EBUSY; + + /* +- * Mark @cgrp dead. This prevents further task migration and child +- * creation by disabling cgroup_lock_live_group(). ++ * Mark @cgrp and the associated csets dead. The former prevents ++ * further task migration and child creation by disabling ++ * cgroup_lock_live_group(). The latter makes the csets ignored by ++ * the migration path. + */ + cgrp->self.flags &= ~CSS_ONLINE; + ++ spin_lock_bh(&css_set_lock); ++ list_for_each_entry(link, &cgrp->cset_links, cset_link) ++ link->cset->dead = true; ++ spin_unlock_bh(&css_set_lock); ++ + /* initiate massacre of all css's */ + for_each_css(css, ssid, cgrp) + kill_css(css); +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 614614821f00..f0b4b328d8f5 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -8001,6 +8001,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + } + } + ++ /* symmetric to unaccount_event() in _free_event() */ ++ account_event(event); ++ + return event; + + err_per_task: +@@ -8364,8 +8367,6 @@ SYSCALL_DEFINE5(perf_event_open, + } + } + +- account_event(event); +- + /* + * Special case software events and allow them to be part of + * any hardware group. +@@ -8662,8 +8663,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu, + /* Mark owner so we could distinguish it from user events. */ + event->owner = TASK_TOMBSTONE; + +- account_event(event); +- + ctx = find_get_context(event->pmu, task, event); + if (IS_ERR(ctx)) { + err = PTR_ERR(ctx); +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index b7342a24f559..b7dd5718836e 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -339,6 +339,7 @@ int hibernation_snapshot(int platform_mode) + pm_message_t msg; + int error; + ++ pm_suspend_clear_flags(); + error = platform_begin(platform_mode); + if (error) + goto Close; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 41f6b2215aa8..a74073f8c08c 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5630,6 +5630,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu) + + case CPU_UP_PREPARE: + rq->calc_load_update = calc_load_update; ++ account_reset_rq(rq); + break; + + case CPU_ONLINE: +diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c +index b2ab2ffb1adc..ab2b5fb9821d 100644 +--- a/kernel/sched/cputime.c ++++ b/kernel/sched/cputime.c +@@ -262,21 +262,21 @@ static __always_inline bool steal_account_process_tick(void) + #ifdef CONFIG_PARAVIRT + if (static_key_false(¶virt_steal_enabled)) { + u64 steal; +- cputime_t steal_ct; ++ unsigned long steal_jiffies; + + steal = paravirt_steal_clock(smp_processor_id()); + steal -= this_rq()->prev_steal_time; + + /* +- * cputime_t may be less precise than nsecs (eg: if it's +- * based on jiffies). Lets cast the result to cputime ++ * steal is in nsecs but our caller is expecting steal ++ * time in jiffies. Lets cast the result to jiffies + * granularity and account the rest on the next rounds. + */ +- steal_ct = nsecs_to_cputime(steal); +- this_rq()->prev_steal_time += cputime_to_nsecs(steal_ct); ++ steal_jiffies = nsecs_to_jiffies(steal); ++ this_rq()->prev_steal_time += jiffies_to_nsecs(steal_jiffies); + +- account_steal_time(steal_ct); +- return steal_ct; ++ account_steal_time(jiffies_to_cputime(steal_jiffies)); ++ return steal_jiffies; + } + #endif + return false; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 56b7d4b83947..adff850e5d42 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4459,9 +4459,17 @@ static void __update_cpu_load(struct rq *this_rq, unsigned long this_load, + + /* scale is effectively 1 << i now, and >> i divides by scale */ + +- old_load = this_rq->cpu_load[i] - tickless_load; ++ old_load = this_rq->cpu_load[i]; + old_load = decay_load_missed(old_load, pending_updates - 1, i); +- old_load += tickless_load; ++ if (tickless_load) { ++ old_load -= decay_load_missed(tickless_load, pending_updates - 1, i); ++ /* ++ * old_load can never be a negative value because a ++ * decayed tickless_load cannot be greater than the ++ * original tickless_load. ++ */ ++ old_load += tickless_load; ++ } + new_load = this_load; + /* + * Round up the averaging division if load is increasing. This +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 10f16374df7f..ff87d887ff62 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1738,3 +1738,16 @@ static inline u64 irq_time_read(int cpu) + } + #endif /* CONFIG_64BIT */ + #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ ++ ++static inline void account_reset_rq(struct rq *rq) ++{ ++#ifdef CONFIG_IRQ_TIME_ACCOUNTING ++ rq->prev_irq_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT ++ rq->prev_steal_time = 0; ++#endif ++#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING ++ rq->prev_steal_time_rq = 0; ++#endif ++} +diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c +index 7e7746a42a62..10a1d7dc9313 100644 +--- a/kernel/sysctl_binary.c ++++ b/kernel/sysctl_binary.c +@@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int *name, int nlen, + } + + mnt = task_active_pid_ns(current)->proc_mnt; +- file = file_open_root(mnt->mnt_root, mnt, pathname, flags); ++ file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0); + result = PTR_ERR(file); + if (IS_ERR(file)) + goto out_putname; +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index d9293402ee68..8305cbb2d5a2 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4949,7 +4949,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, + + spd.nr_pages = i; + +- ret = splice_to_pipe(pipe, &spd); ++ if (i) ++ ret = splice_to_pipe(pipe, &spd); ++ else ++ ret = 0; + out: + splice_shrink_spd(&spd); + return ret; +diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c +index e4e56589ec1d..be3222b7d72e 100644 +--- a/kernel/trace/trace_irqsoff.c ++++ b/kernel/trace/trace_irqsoff.c +@@ -109,8 +109,12 @@ static int func_prolog_dec(struct trace_array *tr, + return 0; + + local_save_flags(*flags); +- /* slight chance to get a false positive on tracing_cpu */ +- if (!irqs_disabled_flags(*flags)) ++ /* ++ * Slight chance to get a false positive on tracing_cpu, ++ * although I'm starting to think there isn't a chance. ++ * Leave this for now just to be paranoid. ++ */ ++ if (!irqs_disabled_flags(*flags) && !preempt_count()) + return 0; + + *data = per_cpu_ptr(tr->trace_buffer.data, cpu); +diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c +index 060df67dbdd1..f96f0383f6c6 100644 +--- a/kernel/trace/trace_printk.c ++++ b/kernel/trace/trace_printk.c +@@ -296,6 +296,9 @@ static int t_show(struct seq_file *m, void *v) + const char *str = *fmt; + int i; + ++ if (!*fmt) ++ return 0; ++ + seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt); + + /* +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index b3ace6ebbba3..9acb29f280ec 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -923,6 +923,9 @@ static int proc_watchdog_common(int which, struct ctl_table *table, int write, + * both lockup detectors are disabled if proc_watchdog_update() + * returns an error. + */ ++ if (old == new) ++ goto out; ++ + err = proc_watchdog_update(); + } + out: +@@ -967,7 +970,7 @@ int proc_soft_watchdog(struct ctl_table *table, int write, + int proc_watchdog_thresh(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- int err, old; ++ int err, old, new; + + get_online_cpus(); + mutex_lock(&watchdog_proc_mutex); +@@ -987,6 +990,10 @@ int proc_watchdog_thresh(struct ctl_table *table, int write, + /* + * Update the sample period. Restore on failure. + */ ++ new = ACCESS_ONCE(watchdog_thresh); ++ if (old == new) ++ goto out; ++ + set_sample_period(); + err = proc_watchdog_update(); + if (err) { +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index d06cae2de783..caf3bf73b533 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1262,7 +1262,7 @@ static unsigned long mem_cgroup_get_limit(struct mem_cgroup *memcg) + return limit; + } + +-static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, ++static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, + int order) + { + struct oom_control oc = { +@@ -1340,6 +1340,7 @@ static void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask, + } + unlock: + mutex_unlock(&oom_lock); ++ return chosen; + } + + #if MAX_NUMNODES > 1 +@@ -5051,6 +5052,7 @@ static ssize_t memory_high_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned long nr_pages; + unsigned long high; + int err; + +@@ -5061,6 +5063,11 @@ static ssize_t memory_high_write(struct kernfs_open_file *of, + + memcg->high = high; + ++ nr_pages = page_counter_read(&memcg->memory); ++ if (nr_pages > high) ++ try_to_free_mem_cgroup_pages(memcg, nr_pages - high, ++ GFP_KERNEL, true); ++ + memcg_wb_domain_size_changed(memcg); + return nbytes; + } +@@ -5082,6 +5089,8 @@ static ssize_t memory_max_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { + struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); ++ unsigned int nr_reclaims = MEM_CGROUP_RECLAIM_RETRIES; ++ bool drained = false; + unsigned long max; + int err; + +@@ -5090,9 +5099,36 @@ static ssize_t memory_max_write(struct kernfs_open_file *of, + if (err) + return err; + +- err = mem_cgroup_resize_limit(memcg, max); +- if (err) +- return err; ++ xchg(&memcg->memory.limit, max); ++ ++ for (;;) { ++ unsigned long nr_pages = page_counter_read(&memcg->memory); ++ ++ if (nr_pages <= max) ++ break; ++ ++ if (signal_pending(current)) { ++ err = -EINTR; ++ break; ++ } ++ ++ if (!drained) { ++ drain_all_stock(memcg); ++ drained = true; ++ continue; ++ } ++ ++ if (nr_reclaims) { ++ if (!try_to_free_mem_cgroup_pages(memcg, nr_pages - max, ++ GFP_KERNEL, true)) ++ nr_reclaims--; ++ continue; ++ } ++ ++ mem_cgroup_events(memcg, MEMCG_OOM, 1); ++ if (!mem_cgroup_out_of_memory(memcg, GFP_KERNEL, 0)) ++ break; ++ } + + memcg_wb_domain_size_changed(memcg); + return nbytes; +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 838ca8bb64f7..9d9044e91ac5 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -660,34 +660,28 @@ static inline void __free_one_page(struct page *page, + unsigned long combined_idx; + unsigned long uninitialized_var(buddy_idx); + struct page *buddy; +- unsigned int max_order = MAX_ORDER; ++ unsigned int max_order; ++ ++ max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); + + VM_BUG_ON(!zone_is_initialized(zone)); + VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page); + + VM_BUG_ON(migratetype == -1); +- if (is_migrate_isolate(migratetype)) { +- /* +- * We restrict max order of merging to prevent merge +- * between freepages on isolate pageblock and normal +- * pageblock. Without this, pageblock isolation +- * could cause incorrect freepage accounting. +- */ +- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); +- } else { ++ if (likely(!is_migrate_isolate(migratetype))) + __mod_zone_freepage_state(zone, 1 << order, migratetype); +- } + +- page_idx = pfn & ((1 << max_order) - 1); ++ page_idx = pfn & ((1 << MAX_ORDER) - 1); + + VM_BUG_ON_PAGE(page_idx & ((1 << order) - 1), page); + VM_BUG_ON_PAGE(bad_range(zone, page), page); + ++continue_merging: + while (order < max_order - 1) { + buddy_idx = __find_buddy_index(page_idx, order); + buddy = page + (buddy_idx - page_idx); + if (!page_is_buddy(page, buddy, order)) +- break; ++ goto done_merging; + /* + * Our buddy is free or it is CONFIG_DEBUG_PAGEALLOC guard page, + * merge with it and move up one order. +@@ -704,6 +698,32 @@ static inline void __free_one_page(struct page *page, + page_idx = combined_idx; + order++; + } ++ if (max_order < MAX_ORDER) { ++ /* If we are here, it means order is >= pageblock_order. ++ * We want to prevent merge between freepages on isolate ++ * pageblock and normal pageblock. Without this, pageblock ++ * isolation could cause incorrect freepage or CMA accounting. ++ * ++ * We don't want to hit this code for the more frequent ++ * low-order merging. ++ */ ++ if (unlikely(has_isolate_pageblock(zone))) { ++ int buddy_mt; ++ ++ buddy_idx = __find_buddy_index(page_idx, order); ++ buddy = page + (buddy_idx - page_idx); ++ buddy_mt = get_pageblock_migratetype(buddy); ++ ++ if (migratetype != buddy_mt ++ && (is_migrate_isolate(migratetype) || ++ is_migrate_isolate(buddy_mt))) ++ goto done_merging; ++ } ++ max_order++; ++ goto continue_merging; ++ } ++ ++done_merging: + set_page_order(page, order); + + /* +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 5a5089cb6570..1363b8ffd89c 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -5979,6 +5979,10 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev, + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, + MGMT_STATUS_INVALID_PARAMS); + ++ if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, ++ MGMT_STATUS_INVALID_PARAMS); ++ + flags = __le32_to_cpu(cp->flags); + timeout = __le16_to_cpu(cp->timeout); + duration = __le16_to_cpu(cp->duration); +diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci b/scripts/coccinelle/iterators/use_after_iter.cocci +index f085f5968c52..ce8cc9c006e5 100644 +--- a/scripts/coccinelle/iterators/use_after_iter.cocci ++++ b/scripts/coccinelle/iterators/use_after_iter.cocci +@@ -123,7 +123,7 @@ list_remove_head(x,c,...) + | + sizeof(<+...c...+>) + | +-&c->member ++ &c->member + | + c = E + | +diff --git a/scripts/gdb/linux/modules.py b/scripts/gdb/linux/modules.py +index 25db8cff44a2..0a35d6dbfb80 100644 +--- a/scripts/gdb/linux/modules.py ++++ b/scripts/gdb/linux/modules.py +@@ -73,10 +73,11 @@ class LxLsmod(gdb.Command): + " " if utils.get_long_type().sizeof == 8 else "")) + + for module in module_list(): ++ layout = module['core_layout'] + gdb.write("{address} {name:<19} {size:>8} {ref}".format( +- address=str(module['module_core']).split()[0], ++ address=str(layout['base']).split()[0], + name=module['name'].string(), +- size=str(module['core_size']), ++ size=str(layout['size']), + ref=str(module['refcnt']['counter']))) + + source_list = module['source_list'] +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index 627750cb420d..9a0f8923f67c 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -108,7 +108,7 @@ lx-symbols command.""" + + def load_module_symbols(self, module): + module_name = module['name'].string() +- module_addr = str(module['module_core']).split()[0] ++ module_addr = str(module['core_layout']['base']).split()[0] + + module_file = self._get_module_file(module_name) + if not module_file and not self.module_files_updated: +diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile +index d79cba4ce3eb..ebced77deb9c 100644 +--- a/scripts/kconfig/Makefile ++++ b/scripts/kconfig/Makefile +@@ -96,13 +96,15 @@ savedefconfig: $(obj)/conf + defconfig: $(obj)/conf + ifeq ($(KBUILD_DEFCONFIG),) + $< $(silent) --defconfig $(Kconfig) +-else ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),) ++else ++ifneq ($(wildcard $(srctree)/arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG)),) + @$(kecho) "*** Default configuration is based on '$(KBUILD_DEFCONFIG)'" + $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$(KBUILD_DEFCONFIG) $(Kconfig) + else + @$(kecho) "*** Default configuration is based on target '$(KBUILD_DEFCONFIG)'" + $(Q)$(MAKE) -f $(srctree)/Makefile $(KBUILD_DEFCONFIG) + endif ++endif + + %_defconfig: $(obj)/conf + $(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$@ $(Kconfig) +diff --git a/scripts/package/mkspec b/scripts/package/mkspec +index 71004daefe31..fe44d68e9344 100755 +--- a/scripts/package/mkspec ++++ b/scripts/package/mkspec +@@ -131,11 +131,11 @@ echo 'rm -rf $RPM_BUILD_ROOT' + echo "" + echo "%post" + echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then" +-echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm" +-echo "cp /boot/System.map-$KERNELRELEASE /boot/System.map-$KERNELRELEASE-rpm" ++echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm" ++echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm" + echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE" +-echo "/sbin/installkernel $KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm" +-echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm" ++echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm" ++echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm /boot/.System.map-$KERNELRELEASE-rpm" + echo "fi" + echo "" + echo "%files" +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 6b5a811e01a5..3a9b66c6e09c 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -322,7 +322,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream, + char name[16]; + snd_pcm_debug_name(substream, name, sizeof(name)); + pcm_err(substream->pcm, +- "BUG: %s, pos = %ld, buffer size = %ld, period size = %ld\n", ++ "invalid position: %s, pos = %ld, buffer size = %ld, period size = %ld\n", + name, pos, runtime->buffer_size, + runtime->period_size); + } +diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c +index e361024eabb6..d1a4d6973330 100644 +--- a/sound/hda/hdac_device.c ++++ b/sound/hda/hdac_device.c +@@ -611,6 +611,22 @@ int snd_hdac_power_up_pm(struct hdac_device *codec) + } + EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm); + ++/* like snd_hdac_power_up_pm(), but only increment the pm count when ++ * already powered up. Returns -1 if not powered up, 1 if incremented ++ * or 0 if unchanged. Only used in hdac_regmap.c ++ */ ++int snd_hdac_keep_power_up(struct hdac_device *codec) ++{ ++ if (!atomic_inc_not_zero(&codec->in_pm)) { ++ int ret = pm_runtime_get_if_in_use(&codec->dev); ++ if (!ret) ++ return -1; ++ if (ret < 0) ++ return 0; ++ } ++ return 1; ++} ++ + /** + * snd_hdac_power_down_pm - power down the codec + * @codec: the codec object +diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c +index eb8f7c30cb09..bdbcd6b75ff6 100644 +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -21,13 +21,16 @@ + #include <sound/hdaudio.h> + #include <sound/hda_regmap.h> + +-#ifdef CONFIG_PM +-#define codec_is_running(codec) \ +- (atomic_read(&(codec)->in_pm) || \ +- !pm_runtime_suspended(&(codec)->dev)) +-#else +-#define codec_is_running(codec) true +-#endif ++static int codec_pm_lock(struct hdac_device *codec) ++{ ++ return snd_hdac_keep_power_up(codec); ++} ++ ++static void codec_pm_unlock(struct hdac_device *codec, int lock) ++{ ++ if (lock == 1) ++ snd_hdac_power_down_pm(codec); ++} + + #define get_verb(reg) (((reg) >> 8) & 0xfff) + +@@ -238,20 +241,28 @@ static int hda_reg_read(void *context, unsigned int reg, unsigned int *val) + struct hdac_device *codec = context; + int verb = get_verb(reg); + int err; ++ int pm_lock = 0; + +- if (!codec_is_running(codec) && verb != AC_VERB_GET_POWER_STATE) +- return -EAGAIN; ++ if (verb != AC_VERB_GET_POWER_STATE) { ++ pm_lock = codec_pm_lock(codec); ++ if (pm_lock < 0) ++ return -EAGAIN; ++ } + reg |= (codec->addr << 28); +- if (is_stereo_amp_verb(reg)) +- return hda_reg_read_stereo_amp(codec, reg, val); +- if (verb == AC_VERB_GET_PROC_COEF) +- return hda_reg_read_coef(codec, reg, val); ++ if (is_stereo_amp_verb(reg)) { ++ err = hda_reg_read_stereo_amp(codec, reg, val); ++ goto out; ++ } ++ if (verb == AC_VERB_GET_PROC_COEF) { ++ err = hda_reg_read_coef(codec, reg, val); ++ goto out; ++ } + if ((verb & 0x700) == AC_VERB_SET_AMP_GAIN_MUTE) + reg &= ~AC_AMP_FAKE_MUTE; + + err = snd_hdac_exec_verb(codec, reg, 0, val); + if (err < 0) +- return err; ++ goto out; + /* special handling for asymmetric reads */ + if (verb == AC_VERB_GET_POWER_STATE) { + if (*val & AC_PWRST_ERROR) +@@ -259,7 +270,9 @@ static int hda_reg_read(void *context, unsigned int reg, unsigned int *val) + else /* take only the actual state */ + *val = (*val >> 4) & 0x0f; + } +- return 0; ++ out: ++ codec_pm_unlock(codec, pm_lock); ++ return err; + } + + static int hda_reg_write(void *context, unsigned int reg, unsigned int val) +@@ -267,6 +280,7 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) + struct hdac_device *codec = context; + unsigned int verb; + int i, bytes, err; ++ int pm_lock = 0; + + if (codec->caps_overwriting) + return 0; +@@ -275,14 +289,21 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) + reg |= (codec->addr << 28); + verb = get_verb(reg); + +- if (!codec_is_running(codec) && verb != AC_VERB_SET_POWER_STATE) +- return codec->lazy_cache ? 0 : -EAGAIN; ++ if (verb != AC_VERB_SET_POWER_STATE) { ++ pm_lock = codec_pm_lock(codec); ++ if (pm_lock < 0) ++ return codec->lazy_cache ? 0 : -EAGAIN; ++ } + +- if (is_stereo_amp_verb(reg)) +- return hda_reg_write_stereo_amp(codec, reg, val); ++ if (is_stereo_amp_verb(reg)) { ++ err = hda_reg_write_stereo_amp(codec, reg, val); ++ goto out; ++ } + +- if (verb == AC_VERB_SET_PROC_COEF) +- return hda_reg_write_coef(codec, reg, val); ++ if (verb == AC_VERB_SET_PROC_COEF) { ++ err = hda_reg_write_coef(codec, reg, val); ++ goto out; ++ } + + switch (verb & 0xf00) { + case AC_VERB_SET_AMP_GAIN_MUTE: +@@ -319,10 +340,12 @@ static int hda_reg_write(void *context, unsigned int reg, unsigned int val) + reg |= (verb + i) << 8 | ((val >> (8 * i)) & 0xff); + err = snd_hdac_exec_verb(codec, reg, 0, NULL); + if (err < 0) +- return err; ++ goto out; + } + +- return 0; ++ out: ++ codec_pm_unlock(codec, pm_lock); ++ return err; + } + + static const struct regmap_config hda_regmap_cfg = { +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index c1c855a6c0af..a47e8ae0eb30 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -174,8 +174,12 @@ static void cs_automute(struct hda_codec *codec) + snd_hda_gen_update_outputs(codec); + + if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) { +- spec->gpio_data = spec->gen.hp_jack_present ? +- spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ if (spec->gen.automute_speaker) ++ spec->gpio_data = spec->gen.hp_jack_present ? ++ spec->gpio_eapd_hp : spec->gpio_eapd_speaker; ++ else ++ spec->gpio_data = ++ spec->gpio_eapd_hp | spec->gpio_eapd_speaker; + snd_hda_codec_write(codec, 0x01, 0, + AC_VERB_SET_GPIO_DATA, spec->gpio_data); + } +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 6122b8ca872f..56fefbd85782 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -204,8 +204,13 @@ static void cx_auto_reboot_notify(struct hda_codec *codec) + { + struct conexant_spec *spec = codec->spec; + +- if (codec->core.vendor_id != 0x14f150f2) ++ switch (codec->core.vendor_id) { ++ case 0x14f150f2: /* CX20722 */ ++ case 0x14f150f4: /* CX20724 */ ++ break; ++ default: + return; ++ } + + /* Turn the CX20722 codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index bcbc4ee10130..e68fa449ebef 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -152,13 +152,17 @@ struct hdmi_spec { + struct hda_pcm_stream pcm_playback; + + /* i915/powerwell (Haswell+/Valleyview+) specific */ ++ bool use_acomp_notifier; /* use i915 eld_notify callback for hotplug */ + struct i915_audio_component_audio_ops i915_audio_ops; + bool i915_bound; /* was i915 bound in this driver? */ + }; + + #ifdef CONFIG_SND_HDA_I915 +-#define codec_has_acomp(codec) \ +- ((codec)->bus->core.audio_component != NULL) ++static inline bool codec_has_acomp(struct hda_codec *codec) ++{ ++ struct hdmi_spec *spec = codec->spec; ++ return spec->use_acomp_notifier; ++} + #else + #define codec_has_acomp(codec) false + #endif +@@ -1562,6 +1566,7 @@ static void update_eld(struct hda_codec *codec, + eld->eld_size) != 0) + eld_changed = true; + ++ pin_eld->monitor_present = eld->monitor_present; + pin_eld->eld_valid = eld->eld_valid; + pin_eld->eld_size = eld->eld_size; + if (eld->eld_valid) +@@ -1665,11 +1670,10 @@ static void sync_eld_via_acomp(struct hda_codec *codec, + int size; + + mutex_lock(&per_pin->lock); ++ eld->monitor_present = false; + size = snd_hdac_acomp_get_eld(&codec->bus->core, per_pin->pin_nid, + &eld->monitor_present, eld->eld_buffer, + ELD_MAX_SIZE); +- if (size < 0) +- goto unlock; + if (size > 0) { + size = min(size, ELD_MAX_SIZE); + if (snd_hdmi_parse_eld(codec, &eld->info, +@@ -1873,7 +1877,8 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo, + + /* Call sync_audio_rate to set the N/CTS/M manually if necessary */ + /* Todo: add DP1.2 MST audio support later */ +- snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); ++ if (codec_has_acomp(codec)) ++ snd_hdac_sync_audio_rate(&codec->bus->core, pin_nid, runtime->rate); + + non_pcm = check_non_pcm_per_cvt(codec, cvt_nid); + mutex_lock(&per_pin->lock); +@@ -2432,6 +2437,10 @@ static void intel_pin_eld_notify(void *audio_ptr, int port) + struct hda_codec *codec = audio_ptr; + int pin_nid = port + 0x04; + ++ /* we assume only from port-B to port-D */ ++ if (port < 1 || port > 3) ++ return; ++ + /* skip notification during system suspend (but not in runtime PM); + * the state will be updated at resume + */ +@@ -2456,11 +2465,24 @@ static int patch_generic_hdmi(struct hda_codec *codec) + codec->spec = spec; + hdmi_array_init(spec, 4); + +- /* Try to bind with i915 for any Intel codecs (if not done yet) */ +- if (!codec_has_acomp(codec) && +- (codec->core.vendor_id >> 16) == 0x8086) +- if (!snd_hdac_i915_init(&codec->bus->core)) +- spec->i915_bound = true; ++#ifdef CONFIG_SND_HDA_I915 ++ /* Try to bind with i915 for Intel HSW+ codecs (if not done yet) */ ++ if ((codec->core.vendor_id >> 16) == 0x8086 && ++ is_haswell_plus(codec)) { ++#if 0 ++ /* on-demand binding leads to an unbalanced refcount when ++ * both i915 and hda drivers are probed concurrently; ++ * disabled temporarily for now ++ */ ++ if (!codec->bus->core.audio_component) ++ if (!snd_hdac_i915_init(&codec->bus->core)) ++ spec->i915_bound = true; ++#endif ++ /* use i915 audio component notifier for hotplug */ ++ if (codec->bus->core.audio_component) ++ spec->use_acomp_notifier = true; ++ } ++#endif + + if (is_haswell_plus(codec)) { + intel_haswell_enable_all_pins(codec, true); +@@ -3659,6 +3681,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 93d2156b6241..4f5ca0b9ce27 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5556,6 +5556,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index 42bcbac801a3..ccdab29a8b66 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -2879,6 +2879,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 *chip) + + static struct snd_pci_quirk intel8x0_clock_list[] = { + SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000), ++ SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000), + SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100), + SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000), + SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000), +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index 2ed260b10f6d..7ccbcaf6a147 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, + unsigned char data[3]; + int err, crate; + ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + /* if endpoint doesn't have sampling rate control, bail out */ +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 7b1cb365ffab..c07a7eda42a2 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -438,6 +438,9 @@ exit_clear: + * + * New endpoints will be added to chip->ep_list and must be freed by + * calling snd_usb_endpoint_free(). ++ * ++ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that ++ * bNumEndpoints > 1 beforehand. + */ + struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, + struct usb_host_interface *alts, +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 279025650568..f6c3bf79af9a 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -1519,7 +1519,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, + + /* use known values for that card: interface#1 altsetting#1 */ + iface = usb_ifnum_to_if(chip->dev, 1); ++ if (!iface || iface->num_altsetting < 2) ++ return -EINVAL; + alts = &iface->altsetting[1]; ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + err = snd_usb_ctl_msg(chip->dev, +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 9245f52d43bd..44d178ee9177 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, + unsigned char data[1]; + int err; + ++ if (get_iface_desc(alts)->bNumEndpoints < 1) ++ return -EINVAL; + ep = get_endpoint(alts, 0)->bEndpointAddress; + + data[0] = 1; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index c458d60d5030..cd7eac28edee 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, + usb_audio_err(chip, "cannot memdup\n"); + return -ENOMEM; + } ++ INIT_LIST_HEAD(&fp->list); + if (fp->nr_rates > MAX_NR_RATES) { + kfree(fp); + return -EINVAL; +@@ -167,19 +168,20 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, + stream = (fp->endpoint & USB_DIR_IN) + ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; + err = snd_usb_add_audio_stream(chip, stream, fp); +- if (err < 0) { +- kfree(fp); +- kfree(rate_table); +- return err; +- } ++ if (err < 0) ++ goto error; + if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber || + fp->altset_idx >= iface->num_altsetting) { +- kfree(fp); +- kfree(rate_table); +- return -EINVAL; ++ err = -EINVAL; ++ goto error; + } + alts = &iface->altsetting[fp->altset_idx]; + altsd = get_iface_desc(alts); ++ if (altsd->bNumEndpoints < 1) { ++ err = -EINVAL; ++ goto error; ++ } ++ + fp->protocol = altsd->bInterfaceProtocol; + + if (fp->datainterval == 0) +@@ -190,6 +192,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, + snd_usb_init_pitch(chip, fp->iface, alts, fp); + snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max); + return 0; ++ ++ error: ++ list_del(&fp->list); /* unlink for avoiding double-free */ ++ kfree(fp); ++ kfree(rate_table); ++ return err; + } + + static int create_auto_pcm_quirk(struct snd_usb_audio *chip, +@@ -462,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, + fp->ep_attr = get_endpoint(alts, 0)->bmAttributes; + fp->datainterval = 0; + fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize); ++ INIT_LIST_HEAD(&fp->list); + + switch (fp->maxpacksize) { + case 0x120: +@@ -485,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip, + ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK; + err = snd_usb_add_audio_stream(chip, stream, fp); + if (err < 0) { ++ list_del(&fp->list); /* unlink for avoiding double-free */ + kfree(fp); + return err; + } +@@ -1121,6 +1131,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + switch (chip->usb_id) { + case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */ + case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */ ++ case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */ + case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ + case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ + case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ +diff --git a/sound/usb/stream.c b/sound/usb/stream.c +index c4dc577ab1bd..8e9548bc1f1a 100644 +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -314,7 +314,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, + /* + * add this endpoint to the chip instance. + * if a stream with the same endpoint already exists, append to it. +- * if not, create a new pcm stream. ++ * if not, create a new pcm stream. note, fp is added to the substream ++ * fmt_list and will be freed on the chip instance release. do not free ++ * fp or do remove it from the substream fmt_list to avoid double-free. + */ + int snd_usb_add_audio_stream(struct snd_usb_audio *chip, + int stream, +@@ -675,6 +677,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) + * (fp->maxpacksize & 0x7ff); + fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no); + fp->clock = clock; ++ INIT_LIST_HEAD(&fp->list); + + /* some quirks for attributes here */ + +@@ -723,6 +726,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) + dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint); + err = snd_usb_add_audio_stream(chip, stream, fp); + if (err < 0) { ++ list_del(&fp->list); /* unlink for avoiding double-free */ + kfree(fp->rate_table); + kfree(fp->chmap); + kfree(fp); +diff --git a/tools/hv/Makefile b/tools/hv/Makefile +index a8ab79556926..a8c4644022a6 100644 +--- a/tools/hv/Makefile ++++ b/tools/hv/Makefile +@@ -5,6 +5,8 @@ PTHREAD_LIBS = -lpthread + WARNINGS = -Wall -Wextra + CFLAGS = $(WARNINGS) -g $(PTHREAD_LIBS) $(shell getconf LFS_CFLAGS) + ++CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include ++ + all: hv_kvp_daemon hv_vss_daemon hv_fcopy_daemon + %: %.c + $(CC) $(CFLAGS) -o $@ $^ +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 813d9b272c81..48a1c5e7dc0d 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -2101,11 +2101,11 @@ char *parse_events_formats_error_string(char *additional_terms) + + /* valid terms */ + if (additional_terms) { +- if (!asprintf(&str, "valid terms: %s,%s", +- additional_terms, static_terms)) ++ if (asprintf(&str, "valid terms: %s,%s", ++ additional_terms, static_terms) < 0) + goto fail; + } else { +- if (!asprintf(&str, "valid terms: %s", static_terms)) ++ if (asprintf(&str, "valid terms: %s", static_terms) < 0) + goto fail; + } + return str; +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index b597bcc8fc78..37b4f5070353 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -284,13 +284,12 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) + { + struct dirent *evt_ent; + DIR *event_dir; +- int ret = 0; + + event_dir = opendir(dir); + if (!event_dir) + return -EINVAL; + +- while (!ret && (evt_ent = readdir(event_dir))) { ++ while ((evt_ent = readdir(event_dir))) { + char path[PATH_MAX]; + char *name = evt_ent->d_name; + FILE *file; +@@ -306,17 +305,19 @@ static int pmu_aliases_parse(char *dir, struct list_head *head) + + snprintf(path, PATH_MAX, "%s/%s", dir, name); + +- ret = -EINVAL; + file = fopen(path, "r"); +- if (!file) +- break; ++ if (!file) { ++ pr_debug("Cannot open %s\n", path); ++ continue; ++ } + +- ret = perf_pmu__new_alias(head, dir, name, file); ++ if (perf_pmu__new_alias(head, dir, name, file) < 0) ++ pr_debug("Cannot set up %s\n", name); + fclose(file); + } + + closedir(event_dir); +- return ret; ++ return 0; + } + + /* +diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py +index 1833103768cb..c8680984d2d6 100644 +--- a/tools/perf/util/setup.py ++++ b/tools/perf/util/setup.py +@@ -22,6 +22,7 @@ cflags = getenv('CFLAGS', '').split() + # switch off several checks (need to be at the end of cflags list) + cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter' ] + ++src_perf = getenv('srctree') + '/tools/perf' + build_lib = getenv('PYTHON_EXTBUILD_LIB') + build_tmp = getenv('PYTHON_EXTBUILD_TMP') + libtraceevent = getenv('LIBTRACEEVENT') +@@ -30,6 +31,9 @@ libapikfs = getenv('LIBAPI') + ext_sources = [f.strip() for f in file('util/python-ext-sources') + if len(f.strip()) > 0 and f[0] != '#'] + ++# use full paths with source files ++ext_sources = map(lambda x: '%s/%s' % (src_perf, x) , ext_sources) ++ + perf = Extension('perf', + sources = ext_sources, + include_dirs = ['util/include'], +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 9102ae172d2a..298473707f17 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -537,6 +537,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + if (!kvm) + return ERR_PTR(-ENOMEM); + ++ spin_lock_init(&kvm->mmu_lock); ++ atomic_inc(¤t->mm->mm_count); ++ kvm->mm = current->mm; ++ kvm_eventfd_init(kvm); ++ mutex_init(&kvm->lock); ++ mutex_init(&kvm->irq_lock); ++ mutex_init(&kvm->slots_lock); ++ atomic_set(&kvm->users_count, 1); ++ INIT_LIST_HEAD(&kvm->devices); ++ + r = kvm_arch_init_vm(kvm, type); + if (r) + goto out_err_no_disable; +@@ -569,16 +579,6 @@ static struct kvm *kvm_create_vm(unsigned long type) + goto out_err; + } + +- spin_lock_init(&kvm->mmu_lock); +- kvm->mm = current->mm; +- atomic_inc(&kvm->mm->mm_count); +- kvm_eventfd_init(kvm); +- mutex_init(&kvm->lock); +- mutex_init(&kvm->irq_lock); +- mutex_init(&kvm->slots_lock); +- atomic_set(&kvm->users_count, 1); +- INIT_LIST_HEAD(&kvm->devices); +- + r = kvm_init_mmu_notifier(kvm); + if (r) + goto out_err; +@@ -603,6 +603,7 @@ out_err_no_disable: + for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) + kvm_free_memslots(kvm, kvm->memslots[i]); + kvm_arch_free_vm(kvm); ++ mmdrop(current->mm); + return ERR_PTR(r); + } + |