diff options
Diffstat (limited to '4.6.5/1004_linux-4.6.5.patch')
| -rw-r--r-- | 4.6.5/1004_linux-4.6.5.patch | 7262 |
1 files changed, 7262 insertions, 0 deletions
diff --git a/4.6.5/1004_linux-4.6.5.patch b/4.6.5/1004_linux-4.6.5.patch new file mode 100644 index 0000000..98b6b74 --- /dev/null +++ b/4.6.5/1004_linux-4.6.5.patch @@ -0,0 +1,7262 @@ +diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +index 6708c5e..33e96f7 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 ++++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +@@ -1,4 +1,4 @@ +-What /sys/bus/iio/devices/iio:deviceX/in_proximity_raw ++What /sys/bus/iio/devices/iio:deviceX/in_proximity_input + Date: March 2014 + KernelVersion: 3.15 + Contact: Matt Ranostay <mranostay@gmail.com> +diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt +index 8638f61..37eca00 100644 +--- a/Documentation/scsi/scsi_eh.txt ++++ b/Documentation/scsi/scsi_eh.txt +@@ -263,19 +263,23 @@ scmd->allowed. + + 3. scmd recovered + ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd +- - shost->host_failed-- + - clear scmd->eh_eflags + - scsi_setup_cmd_retry() + - move from local eh_work_q to local eh_done_q + LOCKING: none ++ CONCURRENCY: at most one thread per separate eh_work_q to ++ keep queue manipulation lockless + + 4. EH completes + ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper +- layer of failure. ++ layer of failure. May be called concurrently but must have ++ a no more than one thread per separate eh_work_q to ++ manipulate the queue locklessly + - scmd is removed from eh_done_q and scmd->eh_entry is cleared + - if retry is necessary, scmd is requeued using + scsi_queue_insert() + - otherwise, scsi_finish_command() is invoked for scmd ++ - zero shost->host_failed + LOCKING: queue or finish function performs appropriate locking + + +diff --git a/Makefile b/Makefile +index cd37442..7d693a8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 6 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Charred Weasel + +diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi +index 8450944..22f7a13 100644 +--- a/arch/arm/boot/dts/armada-385-linksys.dtsi ++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi +@@ -58,8 +58,8 @@ + soc { + ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000 + MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000 +- MBUS_ID(0x09, 0x09) 0 0xf1100000 0x10000 +- MBUS_ID(0x09, 0x05) 0 0xf1110000 0x10000>; ++ MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000>; + + internal-regs { + +diff --git a/arch/arm/boot/dts/sun5i-r8-chip.dts b/arch/arm/boot/dts/sun5i-r8-chip.dts +index f6898c6..c937c85 100644 +--- a/arch/arm/boot/dts/sun5i-r8-chip.dts ++++ b/arch/arm/boot/dts/sun5i-r8-chip.dts +@@ -52,7 +52,7 @@ + + / { + model = "NextThing C.H.I.P."; +- compatible = "nextthing,chip", "allwinner,sun5i-r8"; ++ compatible = "nextthing,chip", "allwinner,sun5i-r8", "allwinner,sun5i-a13"; + + aliases { + i2c0 = &i2c0; +diff --git a/arch/arm/boot/dts/sun6i-a31s-primo81.dts b/arch/arm/boot/dts/sun6i-a31s-primo81.dts +index 68b479b..73c133f 100644 +--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts +@@ -176,8 +176,6 @@ + }; + + ®_dc1sw { +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; + regulator-name = "vcc-lcd"; + }; + +diff --git a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts +index 360adfb..d6ad619 100644 +--- a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts +@@ -135,8 +135,6 @@ + + ®_dc1sw { + regulator-name = "vcc-lcd-usb2"; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; + }; + + ®_dc5ldo { +diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h +index aeddd28..92fd2c8 100644 +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr) + + #define pmd_large(pmd) (pmd_val(pmd) & 2) + #define pmd_bad(pmd) (pmd_val(pmd) & 2) ++#define pmd_present(pmd) (pmd_val(pmd)) + + #define copy_pmd(pmdpd,pmdps) \ + do { \ +diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h +index dc46398..7411466 100644 +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr) + : !!(pmd_val(pmd) & (val))) + #define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val))) + ++#define pmd_present(pmd) (pmd_isset((pmd), L_PMD_SECT_VALID)) + #define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF)) + #define pte_special(pte) (pte_isset((pte), L_PTE_SPECIAL)) + static inline pte_t pte_mkspecial(pte_t pte) +@@ -249,10 +250,10 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF); + #define pfn_pmd(pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))) + #define mk_pmd(page,prot) pfn_pmd(page_to_pfn(page),prot) + +-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */ ++/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */ + static inline pmd_t pmd_mknotpresent(pmd_t pmd) + { +- return __pmd(0); ++ return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID); + } + + static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) +diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h +index 348caab..d622040 100644 +--- a/arch/arm/include/asm/pgtable.h ++++ b/arch/arm/include/asm/pgtable.h +@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; + #define pgd_offset_k(addr) pgd_offset(&init_mm, addr) + + #define pmd_none(pmd) (!pmd_val(pmd)) +-#define pmd_present(pmd) (pmd_val(pmd)) + + static inline pte_t *pmd_page_vaddr(pmd_t pmd) + { +diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c +index dded1b7..72b11d9 100644 +--- a/arch/arm/kvm/arm.c ++++ b/arch/arm/kvm/arm.c +@@ -267,6 +267,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu) + kvm_timer_vcpu_terminate(vcpu); + kvm_vgic_vcpu_destroy(vcpu); + kvm_pmu_vcpu_destroy(vcpu); ++ kvm_vcpu_uninit(vcpu); + kmem_cache_free(kvm_vcpu_cache, vcpu); + } + +diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c +index a38b16b..b56de4b 100644 +--- a/arch/arm/mach-imx/mach-imx6ul.c ++++ b/arch/arm/mach-imx/mach-imx6ul.c +@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_device *dev) + static void __init imx6ul_enet_phy_init(void) + { + if (IS_BUILTIN(CONFIG_PHYLIB)) +- phy_register_fixup_for_uid(PHY_ID_KSZ8081, 0xffffffff, ++ phy_register_fixup_for_uid(PHY_ID_KSZ8081, MICREL_PHY_ID_MASK, + ksz8081_phy_fixup); + } + +diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c +index 7e989d6..474abff 100644 +--- a/arch/arm/mach-mvebu/coherency.c ++++ b/arch/arm/mach-mvebu/coherency.c +@@ -162,22 +162,16 @@ exit: + } + + /* +- * This ioremap hook is used on Armada 375/38x to ensure that PCIe +- * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This +- * is needed as a workaround for a deadlock issue between the PCIe +- * interface and the cache controller. ++ * This ioremap hook is used on Armada 375/38x to ensure that all MMIO ++ * areas are mapped as MT_UNCACHED instead of MT_DEVICE. This is ++ * needed for the HW I/O coherency mechanism to work properly without ++ * deadlock. + */ + static void __iomem * +-armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size, +- unsigned int mtype, void *caller) ++armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size, ++ unsigned int mtype, void *caller) + { +- struct resource pcie_mem; +- +- mvebu_mbus_get_pcie_mem_aperture(&pcie_mem); +- +- if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end) +- mtype = MT_UNCACHED; +- ++ mtype = MT_UNCACHED; + return __arm_ioremap_caller(phys_addr, size, mtype, caller); + } + +@@ -186,7 +180,7 @@ static void __init armada_375_380_coherency_init(struct device_node *np) + struct device_node *cache_dn; + + coherency_cpu_base = of_iomap(np, 0); +- arch_ioremap_caller = armada_pcie_wa_ioremap_caller; ++ arch_ioremap_caller = armada_wa_ioremap_caller; + + /* + * We should switch the PL310 to I/O coherency mode only if +diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h +index a307eb6..7f94755 100644 +--- a/arch/arm64/include/asm/ptrace.h ++++ b/arch/arm64/include/asm/ptrace.h +@@ -117,6 +117,8 @@ struct pt_regs { + }; + u64 orig_x0; + u64 syscallno; ++ u64 orig_addr_limit; ++ u64 unused; // maintain 16 byte alignment + }; + + #define arch_has_single_step() (1) +diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c +index 3ae6b31..1abcd88 100644 +--- a/arch/arm64/kernel/asm-offsets.c ++++ b/arch/arm64/kernel/asm-offsets.c +@@ -59,6 +59,7 @@ int main(void) + DEFINE(S_PC, offsetof(struct pt_regs, pc)); + DEFINE(S_ORIG_X0, offsetof(struct pt_regs, orig_x0)); + DEFINE(S_SYSCALLNO, offsetof(struct pt_regs, syscallno)); ++ DEFINE(S_ORIG_ADDR_LIMIT, offsetof(struct pt_regs, orig_addr_limit)); + DEFINE(S_FRAME_SIZE, sizeof(struct pt_regs)); + BLANK(); + DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id.counter)); +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 12e8d2b..6c3b734 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -28,6 +28,7 @@ + #include <asm/errno.h> + #include <asm/esr.h> + #include <asm/irq.h> ++#include <asm/memory.h> + #include <asm/thread_info.h> + #include <asm/unistd.h> + +@@ -97,7 +98,14 @@ + mov x29, xzr // fp pointed to user-space + .else + add x21, sp, #S_FRAME_SIZE +- .endif ++ get_thread_info tsk ++ /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */ ++ ldr x20, [tsk, #TI_ADDR_LIMIT] ++ str x20, [sp, #S_ORIG_ADDR_LIMIT] ++ mov x20, #TASK_SIZE_64 ++ str x20, [tsk, #TI_ADDR_LIMIT] ++ ALTERNATIVE(nop, SET_PSTATE_UAO(0), ARM64_HAS_UAO, CONFIG_ARM64_UAO) ++ .endif /* \el == 0 */ + mrs x22, elr_el1 + mrs x23, spsr_el1 + stp lr, x21, [sp, #S_LR] +@@ -128,6 +136,14 @@ + .endm + + .macro kernel_exit, el ++ .if \el != 0 ++ /* Restore the task's original addr_limit. */ ++ ldr x20, [sp, #S_ORIG_ADDR_LIMIT] ++ str x20, [tsk, #TI_ADDR_LIMIT] ++ ++ /* No need to restore UAO, it will be restored from SPSR_EL1 */ ++ .endif ++ + ldp x21, x22, [sp, #S_PC] // load ELR, SPSR + .if \el == 0 + ct_user_enter +@@ -406,7 +422,6 @@ el1_irq: + bl trace_hardirqs_off + #endif + +- get_thread_info tsk + irq_handler + + #ifdef CONFIG_PREEMPT +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c +index c539208..58651a9 100644 +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -64,8 +64,7 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom, + + /* + * We need to switch to kernel mode so that we can use __get_user +- * to safely read from kernel space. Note that we now dump the +- * code first, just in case the backtrace kills us. ++ * to safely read from kernel space. + */ + fs = get_fs(); + set_fs(KERNEL_DS); +@@ -111,21 +110,12 @@ static void dump_backtrace_entry(unsigned long where) + print_ip_sym(where); + } + +-static void dump_instr(const char *lvl, struct pt_regs *regs) ++static void __dump_instr(const char *lvl, struct pt_regs *regs) + { + unsigned long addr = instruction_pointer(regs); +- mm_segment_t fs; + char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; + int i; + +- /* +- * We need to switch to kernel mode so that we can use __get_user +- * to safely read from kernel space. Note that we now dump the +- * code first, just in case the backtrace kills us. +- */ +- fs = get_fs(); +- set_fs(KERNEL_DS); +- + for (i = -4; i < 1; i++) { + unsigned int val, bad; + +@@ -139,8 +129,18 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) + } + } + printk("%sCode: %s\n", lvl, str); ++} + +- set_fs(fs); ++static void dump_instr(const char *lvl, struct pt_regs *regs) ++{ ++ if (!user_mode(regs)) { ++ mm_segment_t fs = get_fs(); ++ set_fs(KERNEL_DS); ++ __dump_instr(lvl, regs); ++ set_fs(fs); ++ } else { ++ __dump_instr(lvl, regs); ++ } + } + + static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 10b79e9..e22849a9 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -284,7 +284,8 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, + } + + if (permission_fault(esr) && (addr < USER_DS)) { +- if (get_fs() == KERNEL_DS) ++ /* regs->orig_addr_limit may be 0 if we entered from EL0 */ ++ if (regs->orig_addr_limit == KERNEL_DS) + die("Accessing user space memory with fs=KERNEL_DS", regs, esr); + + if (!search_exception_tables(regs->pc)) +diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c +index dbd12ea..43a76b0 100644 +--- a/arch/arm64/mm/flush.c ++++ b/arch/arm64/mm/flush.c +@@ -71,10 +71,6 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr) + { + struct page *page = pte_page(pte); + +- /* no flushing needed for anonymous pages */ +- if (!page_mapping(page)) +- return; +- + if (!test_and_set_bit(PG_dcache_clean, &page->flags)) + sync_icache_aliases(page_address(page), + PAGE_SIZE << compound_order(page)); +diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h +index 942b8f6..1907ab3 100644 +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -336,6 +336,7 @@ struct kvm_mips_tlb { + #define KVM_MIPS_GUEST_TLB_SIZE 64 + struct kvm_vcpu_arch { + void *host_ebase, *guest_ebase; ++ int (*vcpu_run)(struct kvm_run *run, struct kvm_vcpu *vcpu); + unsigned long host_stack; + unsigned long host_gp; + +diff --git a/arch/mips/kvm/interrupt.h b/arch/mips/kvm/interrupt.h +index 4ab4bdf..2143884 100644 +--- a/arch/mips/kvm/interrupt.h ++++ b/arch/mips/kvm/interrupt.h +@@ -28,6 +28,7 @@ + #define MIPS_EXC_MAX 12 + /* XXXSL More to follow */ + ++extern char __kvm_mips_vcpu_run_end[]; + extern char mips32_exception[], mips32_exceptionEnd[]; + extern char mips32_GuestException[], mips32_GuestExceptionEnd[]; + +diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S +index 81687ab..fc93a08 100644 +--- a/arch/mips/kvm/locore.S ++++ b/arch/mips/kvm/locore.S +@@ -227,6 +227,7 @@ FEXPORT(__kvm_mips_load_k0k1) + + /* Jump to guest */ + eret ++EXPORT(__kvm_mips_vcpu_run_end) + + VECTOR(MIPSX(exception), unknown) + /* Find out what mode we came from and jump to the proper handler. */ +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index 70ef1a4..e223cb3 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -314,6 +314,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + memcpy(gebase + offset, mips32_GuestException, + mips32_GuestExceptionEnd - mips32_GuestException); + ++#ifdef MODULE ++ offset += mips32_GuestExceptionEnd - mips32_GuestException; ++ memcpy(gebase + offset, (char *)__kvm_mips_vcpu_run, ++ __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run); ++ vcpu->arch.vcpu_run = gebase + offset; ++#else ++ vcpu->arch.vcpu_run = __kvm_mips_vcpu_run; ++#endif ++ + /* Invalidate the icache for these ranges */ + local_flush_icache_range((unsigned long)gebase, + (unsigned long)gebase + ALIGN(size, PAGE_SIZE)); +@@ -403,7 +412,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run) + /* Disable hardware page table walking while in guest */ + htw_stop(); + +- r = __kvm_mips_vcpu_run(run, vcpu); ++ r = vcpu->arch.vcpu_run(run, vcpu); + + /* Re-enable HTW before enabling interrupts */ + htw_start(); +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index b8500b4..bec85055 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -1501,6 +1501,16 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp) + current->thread.regs = regs - 1; + } + ++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM ++ /* ++ * Clear any transactional state, we're exec()ing. The cause is ++ * not important as there will never be a recheckpoint so it's not ++ * user visible. ++ */ ++ if (MSR_TM_SUSPENDED(mfmsr())) ++ tm_reclaim_current(0); ++#endif ++ + memset(regs->gpr, 0, sizeof(regs->gpr)); + regs->ctr = 0; + regs->link = 0; +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index ccd2037..6ee4b72 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -719,7 +719,7 @@ unsigned char ibm_architecture_vec[] = { + * must match by the macro below. Update the definition if + * the structure layout changes. + */ +-#define IBM_ARCH_VEC_NRCORES_OFFSET 125 ++#define IBM_ARCH_VEC_NRCORES_OFFSET 133 + W(NR_CPUS), /* number of cores supported */ + 0, + 0, +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index bd98ce2..3e8865b 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -912,7 +912,8 @@ machine_arch_initcall(pseries, find_existing_ddw_windows); + static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail, + struct ddw_query_response *query) + { +- struct eeh_dev *edev; ++ struct device_node *dn; ++ struct pci_dn *pdn; + u32 cfg_addr; + u64 buid; + int ret; +@@ -923,11 +924,10 @@ static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail, + * Retrieve them from the pci device, not the node with the + * dma-window property + */ +- edev = pci_dev_to_eeh_dev(dev); +- cfg_addr = edev->config_addr; +- if (edev->pe_config_addr) +- cfg_addr = edev->pe_config_addr; +- buid = edev->phb->buid; ++ dn = pci_device_to_OF_node(dev); ++ pdn = PCI_DN(dn); ++ buid = pdn->phb->buid; ++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8)); + + ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query, + cfg_addr, BUID_HI(buid), BUID_LO(buid)); +@@ -941,7 +941,8 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail, + struct ddw_create_response *create, int page_shift, + int window_shift) + { +- struct eeh_dev *edev; ++ struct device_node *dn; ++ struct pci_dn *pdn; + u32 cfg_addr; + u64 buid; + int ret; +@@ -952,11 +953,10 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail, + * Retrieve them from the pci device, not the node with the + * dma-window property + */ +- edev = pci_dev_to_eeh_dev(dev); +- cfg_addr = edev->config_addr; +- if (edev->pe_config_addr) +- cfg_addr = edev->pe_config_addr; +- buid = edev->phb->buid; ++ dn = pci_device_to_OF_node(dev); ++ pdn = PCI_DN(dn); ++ buid = pdn->phb->buid; ++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8)); + + do { + /* extra outputs are LIOBN and dma-addr (hi, lo) */ +diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h +index 5e04f3c..8ae236b0 100644 +--- a/arch/s390/include/asm/fpu/api.h ++++ b/arch/s390/include/asm/fpu/api.h +@@ -22,7 +22,7 @@ static inline int test_fp_ctl(u32 fpc) + " la %0,0\n" + "1:\n" + EX_TABLE(0b,1b) +- : "=d" (rc), "=d" (orig_fpc) ++ : "=d" (rc), "=&d" (orig_fpc) + : "d" (fpc), "0" (-EINVAL)); + return rc; + } +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index f20abdb..d14069d 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -2064,12 +2064,5 @@ void s390_reset_system(void) + S390_lowcore.program_new_psw.addr = + (unsigned long) s390_base_pgm_handler; + +- /* +- * Clear subchannel ID and number to signal new kernel that no CCW or +- * SCSI IPL has been done (for kexec and kdump) +- */ +- S390_lowcore.subchannel_id = 0; +- S390_lowcore.subchannel_nr = 0; +- + do_reset_calls(); + } +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index 4324b87..9f0ce0e 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -437,7 +437,7 @@ void ptep_zap_unused(struct mm_struct *mm, unsigned long addr, + pgste = pgste_get_lock(ptep); + pgstev = pgste_val(pgste); + pte = *ptep; +- if (pte_swap(pte) && ++ if (!reset && pte_swap(pte) && + ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED || + (pgstev & _PGSTE_GPS_ZERO))) { + ptep_zap_swap_entry(mm, pte_to_swp_entry(pte)); +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index b1ef9e4..b67f9e8 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -171,6 +171,9 @@ isoimage: $(obj)/bzImage + for i in lib lib64 share end ; do \ + if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \ + cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \ ++ if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \ ++ cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \ ++ fi ; \ + break ; \ + fi ; \ + if [ $$i = end ] ; then exit 1 ; fi ; \ +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 041e442..7eb806c 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2313,7 +2313,7 @@ void + perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) + { + struct stack_frame frame; +- const void __user *fp; ++ const unsigned long __user *fp; + + if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) { + /* TODO: We don't support guest os callchain now */ +@@ -2326,7 +2326,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) + if (regs->flags & (X86_VM_MASK | PERF_EFLAGS_VM)) + return; + +- fp = (void __user *)regs->bp; ++ fp = (unsigned long __user *)regs->bp; + + perf_callchain_store(entry, regs->ip); + +@@ -2339,16 +2339,17 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) + pagefault_disable(); + while (entry->nr < PERF_MAX_STACK_DEPTH) { + unsigned long bytes; ++ + frame.next_frame = NULL; + frame.return_address = 0; + +- if (!access_ok(VERIFY_READ, fp, 16)) ++ if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2)) + break; + +- bytes = __copy_from_user_nmi(&frame.next_frame, fp, 8); ++ bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp)); + if (bytes != 0) + break; +- bytes = __copy_from_user_nmi(&frame.return_address, fp+8, 8); ++ bytes = __copy_from_user_nmi(&frame.return_address, fp + 1, sizeof(*fp)); + if (bytes != 0) + break; + +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c +index 1705c9d..78ee9eb 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/intel/rapl.c +@@ -665,7 +665,7 @@ static void __init cleanup_rapl_pmus(void) + int i; + + for (i = 0; i < rapl_pmus->maxpkg; i++) +- kfree(rapl_pmus->pmus + i); ++ kfree(rapl_pmus->pmus[i]); + kfree(rapl_pmus); + } + +diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h +index 7a79ee2..33c709c 100644 +--- a/arch/x86/include/asm/msr.h ++++ b/arch/x86/include/asm/msr.h +@@ -112,7 +112,7 @@ static inline void native_write_msr(unsigned int msr, + unsigned low, unsigned high) + { + asm volatile("wrmsr" : : "c" (msr), "a"(low), "d" (high) : "memory"); +- if (msr_tracepoint_active(__tracepoint_read_msr)) ++ if (msr_tracepoint_active(__tracepoint_write_msr)) + do_trace_write_msr(msr, ((u64)high << 32 | low), 0); + } + +@@ -131,7 +131,7 @@ notrace static inline int native_write_msr_safe(unsigned int msr, + : "c" (msr), "0" (low), "d" (high), + [fault] "i" (-EIO) + : "memory"); +- if (msr_tracepoint_active(__tracepoint_read_msr)) ++ if (msr_tracepoint_active(__tracepoint_write_msr)) + do_trace_write_msr(msr, ((u64)high << 32 | low), err); + return err; + } +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index a147e67..e991d5c 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -71,8 +71,8 @@ int amd_cache_northbridges(void) + while ((misc = next_northbridge(misc, amd_nb_misc_ids)) != NULL) + i++; + +- if (i == 0) +- return 0; ++ if (!i) ++ return -ENODEV; + + nb = kzalloc(i * sizeof(struct amd_northbridge), GFP_KERNEL); + if (!nb) +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index ae703ac..44bcd57 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -960,7 +960,19 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr) + * normal page fault. + */ + regs->ip = (unsigned long)cur->addr; ++ /* ++ * Trap flag (TF) has been set here because this fault ++ * happened where the single stepping will be done. ++ * So clear it by resetting the current kprobe: ++ */ ++ regs->flags &= ~X86_EFLAGS_TF; ++ ++ /* ++ * If the TF flag was set before the kprobe hit, ++ * don't touch it: ++ */ + regs->flags |= kcb->kprobe_old_flags; ++ + if (kcb->kprobe_status == KPROBE_REENTER) + restore_previous_kprobe(kcb); + else +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index faf52bac..c4217a2 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2072,7 +2072,8 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu) + unsigned int dest; + + if (!kvm_arch_has_assigned_device(vcpu->kvm) || +- !irq_remapping_cap(IRQ_POSTING_CAP)) ++ !irq_remapping_cap(IRQ_POSTING_CAP) || ++ !kvm_vcpu_apicv_active(vcpu)) + return; + + do { +@@ -2180,7 +2181,8 @@ static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu) + struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu); + + if (!kvm_arch_has_assigned_device(vcpu->kvm) || +- !irq_remapping_cap(IRQ_POSTING_CAP)) ++ !irq_remapping_cap(IRQ_POSTING_CAP) || ++ !kvm_vcpu_apicv_active(vcpu)) + return; + + /* Set SN when the vCPU is preempted */ +@@ -6657,7 +6659,13 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu, + + /* Checks for #GP/#SS exceptions. */ + exn = false; +- if (is_protmode(vcpu)) { ++ if (is_long_mode(vcpu)) { ++ /* Long mode: #GP(0)/#SS(0) if the memory address is in a ++ * non-canonical form. This is the only check on the memory ++ * destination for long mode! ++ */ ++ exn = is_noncanonical_address(*ret); ++ } else if (is_protmode(vcpu)) { + /* Protected mode: apply checks for segment validity in the + * following order: + * - segment type check (#GP(0) may be thrown) +@@ -6674,17 +6682,10 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu, + * execute-only code segment + */ + exn = ((s.type & 0xa) == 8); +- } +- if (exn) { +- kvm_queue_exception_e(vcpu, GP_VECTOR, 0); +- return 1; +- } +- if (is_long_mode(vcpu)) { +- /* Long mode: #GP(0)/#SS(0) if the memory address is in a +- * non-canonical form. This is an only check for long mode. +- */ +- exn = is_noncanonical_address(*ret); +- } else if (is_protmode(vcpu)) { ++ if (exn) { ++ kvm_queue_exception_e(vcpu, GP_VECTOR, 0); ++ return 1; ++ } + /* Protected mode: #GP(0)/#SS(0) if the segment is unusable. + */ + exn = (s.unusable != 0); +@@ -10702,7 +10703,8 @@ static int vmx_pre_block(struct kvm_vcpu *vcpu) + struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu); + + if (!kvm_arch_has_assigned_device(vcpu->kvm) || +- !irq_remapping_cap(IRQ_POSTING_CAP)) ++ !irq_remapping_cap(IRQ_POSTING_CAP) || ++ !kvm_vcpu_apicv_active(vcpu)) + return 0; + + vcpu->pre_pcpu = vcpu->cpu; +@@ -10768,7 +10770,8 @@ static void vmx_post_block(struct kvm_vcpu *vcpu) + unsigned long flags; + + if (!kvm_arch_has_assigned_device(vcpu->kvm) || +- !irq_remapping_cap(IRQ_POSTING_CAP)) ++ !irq_remapping_cap(IRQ_POSTING_CAP) || ++ !kvm_vcpu_apicv_active(vcpu)) + return; + + do { +@@ -10821,7 +10824,8 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, + int idx, ret = -EINVAL; + + if (!kvm_arch_has_assigned_device(kvm) || +- !irq_remapping_cap(IRQ_POSTING_CAP)) ++ !irq_remapping_cap(IRQ_POSTING_CAP) || ++ !kvm_vcpu_apicv_active(kvm->vcpus[0])) + return 0; + + idx = srcu_read_lock(&kvm->irq_srcu); +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index ead8dc0..8ba4266 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -102,10 +102,10 @@ struct pkcs1pad_inst_ctx { + }; + + struct pkcs1pad_request { +- struct akcipher_request child_req; +- + struct scatterlist in_sg[3], out_sg[2]; + uint8_t *in_buf, *out_buf; ++ ++ struct akcipher_request child_req; + }; + + static int pkcs1pad_set_pub_key(struct crypto_akcipher *tfm, const void *key, +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 961acc7..91a9e6a 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -606,7 +606,7 @@ void ata_scsi_error(struct Scsi_Host *host) + ata_scsi_port_error_handler(host, ap); + + /* finish or retry handled scmd's and clean up */ +- WARN_ON(host->host_failed || !list_empty(&eh_work_q)); ++ WARN_ON(!list_empty(&eh_work_q)); + + DPRINTK("EXIT\n"); + } +diff --git a/drivers/base/module.c b/drivers/base/module.c +index db930d3..2a21578 100644 +--- a/drivers/base/module.c ++++ b/drivers/base/module.c +@@ -24,10 +24,12 @@ static char *make_driver_name(struct device_driver *drv) + + static void module_create_drivers_dir(struct module_kobject *mk) + { +- if (!mk || mk->drivers_dir) +- return; ++ static DEFINE_MUTEX(drivers_dir_mutex); + +- mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj); ++ mutex_lock(&drivers_dir_mutex); ++ if (mk && !mk->drivers_dir) ++ mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj); ++ mutex_unlock(&drivers_dir_mutex); + } + + void module_add_driver(struct module *mod, struct device_driver *drv) +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 94fb407..44b1bd6 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3820,6 +3820,7 @@ static void handle_new_recv_msgs(ipmi_smi_t intf) + while (!list_empty(&intf->waiting_rcv_msgs)) { + smi_msg = list_entry(intf->waiting_rcv_msgs.next, + struct ipmi_smi_msg, link); ++ list_del(&smi_msg->link); + if (!run_to_completion) + spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, + flags); +@@ -3829,11 +3830,14 @@ static void handle_new_recv_msgs(ipmi_smi_t intf) + if (rv > 0) { + /* + * To preserve message order, quit if we +- * can't handle a message. ++ * can't handle a message. Add the message ++ * back at the head, this is safe because this ++ * tasklet is the only thing that pulls the ++ * messages. + */ ++ list_add(&smi_msg->link, &intf->waiting_rcv_msgs); + break; + } else { +- list_del(&smi_msg->link); + if (rv == 0) + /* Message handled */ + ipmi_free_smi_msg(smi_msg); +diff --git a/drivers/crypto/qat/qat_common/Makefile b/drivers/crypto/qat/qat_common/Makefile +index 29c7c53..92561c8 100644 +--- a/drivers/crypto/qat/qat_common/Makefile ++++ b/drivers/crypto/qat/qat_common/Makefile +@@ -2,6 +2,7 @@ $(obj)/qat_rsapubkey-asn1.o: $(obj)/qat_rsapubkey-asn1.c \ + $(obj)/qat_rsapubkey-asn1.h + $(obj)/qat_rsaprivkey-asn1.o: $(obj)/qat_rsaprivkey-asn1.c \ + $(obj)/qat_rsaprivkey-asn1.h ++$(obj)/qat_asym_algs.o: $(obj)/qat_rsapubkey-asn1.h $(obj)/qat_rsaprivkey-asn1.h + + clean-files += qat_rsapubkey-asn1.c qat_rsapubkey-asn1.h + clean-files += qat_rsaprivkey-asn1.c qat_rsaprivkey-asn1.h +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index 1472f48..ff51b51 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -565,7 +565,8 @@ void edac_mc_reset_delay_period(unsigned long value) + list_for_each(item, &mc_devices) { + mci = list_entry(item, struct mem_ctl_info, link); + +- edac_mod_work(&mci->work, value); ++ if (mci->op_state == OP_RUNNING_POLL) ++ edac_mod_work(&mci->work, value); + } + mutex_unlock(&mem_ctls_mutex); + } +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 8bf745d..b274fa2 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -239,8 +239,11 @@ static const u32 rir_offset[MAX_RIR_RANGES][MAX_RIR_WAY] = { + { 0x1a0, 0x1a4, 0x1a8, 0x1ac, 0x1b0, 0x1b4, 0x1b8, 0x1bc }, + }; + +-#define RIR_RNK_TGT(reg) GET_BITFIELD(reg, 16, 19) +-#define RIR_OFFSET(reg) GET_BITFIELD(reg, 2, 14) ++#define RIR_RNK_TGT(type, reg) (((type) == BROADWELL) ? \ ++ GET_BITFIELD(reg, 20, 23) : GET_BITFIELD(reg, 16, 19)) ++ ++#define RIR_OFFSET(type, reg) (((type) == HASWELL || (type) == BROADWELL) ? \ ++ GET_BITFIELD(reg, 2, 15) : GET_BITFIELD(reg, 2, 14)) + + /* Device 16, functions 2-7 */ + +@@ -1916,14 +1919,14 @@ static void get_memory_layout(const struct mem_ctl_info *mci) + pci_read_config_dword(pvt->pci_tad[i], + rir_offset[j][k], + ®); +- tmp_mb = RIR_OFFSET(reg) << 6; ++ tmp_mb = RIR_OFFSET(pvt->info.type, reg) << 6; + + gb = div_u64_rem(tmp_mb, 1024, &mb); + edac_dbg(0, "CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n", + i, j, k, + gb, (mb*1000)/1024, + ((u64)tmp_mb) << 20L, +- (u32)RIR_RNK_TGT(reg), ++ (u32)RIR_RNK_TGT(pvt->info.type, reg), + reg); + } + } +@@ -2256,7 +2259,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci, + pci_read_config_dword(pvt->pci_tad[ch_add + base_ch], + rir_offset[n_rir][idx], + ®); +- *rank = RIR_RNK_TGT(reg); ++ *rank = RIR_RNK_TGT(pvt->info.type, reg); + + edac_dbg(0, "RIR#%d: channel address 0x%08Lx < 0x%08Lx, RIR interleave %d, index %d\n", + n_rir, +diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c +index 8b3226d..caff46c 100644 +--- a/drivers/extcon/extcon-palmas.c ++++ b/drivers/extcon/extcon-palmas.c +@@ -360,6 +360,8 @@ static int palmas_usb_probe(struct platform_device *pdev) + + palmas_enable_irq(palmas_usb); + /* perform initial detection */ ++ if (palmas_usb->enable_gpio_vbus_detection) ++ palmas_vbus_irq_handler(palmas_usb->gpio_vbus_irq, palmas_usb); + palmas_gpio_id_detect(&palmas_usb->wq_detectid.work); + device_set_wakeup_capable(&pdev->dev, true); + return 0; +diff --git a/drivers/gpio/gpio-sch.c b/drivers/gpio/gpio-sch.c +index e85e753..eb43ae4 100644 +--- a/drivers/gpio/gpio-sch.c ++++ b/drivers/gpio/gpio-sch.c +@@ -61,9 +61,8 @@ static unsigned sch_gpio_bit(struct sch_gpio *sch, unsigned gpio) + return gpio % 8; + } + +-static int sch_gpio_reg_get(struct gpio_chip *gc, unsigned gpio, unsigned reg) ++static int sch_gpio_reg_get(struct sch_gpio *sch, unsigned gpio, unsigned reg) + { +- struct sch_gpio *sch = gpiochip_get_data(gc); + unsigned short offset, bit; + u8 reg_val; + +@@ -75,10 +74,9 @@ static int sch_gpio_reg_get(struct gpio_chip *gc, unsigned gpio, unsigned reg) + return reg_val; + } + +-static void sch_gpio_reg_set(struct gpio_chip *gc, unsigned gpio, unsigned reg, ++static void sch_gpio_reg_set(struct sch_gpio *sch, unsigned gpio, unsigned reg, + int val) + { +- struct sch_gpio *sch = gpiochip_get_data(gc); + unsigned short offset, bit; + u8 reg_val; + +@@ -98,14 +96,15 @@ static int sch_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num) + struct sch_gpio *sch = gpiochip_get_data(gc); + + spin_lock(&sch->lock); +- sch_gpio_reg_set(gc, gpio_num, GIO, 1); ++ sch_gpio_reg_set(sch, gpio_num, GIO, 1); + spin_unlock(&sch->lock); + return 0; + } + + static int sch_gpio_get(struct gpio_chip *gc, unsigned gpio_num) + { +- return sch_gpio_reg_get(gc, gpio_num, GLV); ++ struct sch_gpio *sch = gpiochip_get_data(gc); ++ return sch_gpio_reg_get(sch, gpio_num, GLV); + } + + static void sch_gpio_set(struct gpio_chip *gc, unsigned gpio_num, int val) +@@ -113,7 +112,7 @@ static void sch_gpio_set(struct gpio_chip *gc, unsigned gpio_num, int val) + struct sch_gpio *sch = gpiochip_get_data(gc); + + spin_lock(&sch->lock); +- sch_gpio_reg_set(gc, gpio_num, GLV, val); ++ sch_gpio_reg_set(sch, gpio_num, GLV, val); + spin_unlock(&sch->lock); + } + +@@ -123,7 +122,7 @@ static int sch_gpio_direction_out(struct gpio_chip *gc, unsigned gpio_num, + struct sch_gpio *sch = gpiochip_get_data(gc); + + spin_lock(&sch->lock); +- sch_gpio_reg_set(gc, gpio_num, GIO, 0); ++ sch_gpio_reg_set(sch, gpio_num, GIO, 0); + spin_unlock(&sch->lock); + + /* +@@ -182,13 +181,13 @@ static int sch_gpio_probe(struct platform_device *pdev) + * GPIO7 is configured by the CMC as SLPIOVR + * Enable GPIO[9:8] core powered gpios explicitly + */ +- sch_gpio_reg_set(&sch->chip, 8, GEN, 1); +- sch_gpio_reg_set(&sch->chip, 9, GEN, 1); ++ sch_gpio_reg_set(sch, 8, GEN, 1); ++ sch_gpio_reg_set(sch, 9, GEN, 1); + /* + * SUS_GPIO[2:0] enabled by default + * Enable SUS_GPIO3 resume powered gpio explicitly + */ +- sch_gpio_reg_set(&sch->chip, 13, GEN, 1); ++ sch_gpio_reg_set(sch, 13, GEN, 1); + break; + + case PCI_DEVICE_ID_INTEL_ITC_LPC: +diff --git a/drivers/gpio/gpiolib-legacy.c b/drivers/gpio/gpiolib-legacy.c +index 3a5c701..8b83099 100644 +--- a/drivers/gpio/gpiolib-legacy.c ++++ b/drivers/gpio/gpiolib-legacy.c +@@ -28,6 +28,10 @@ int gpio_request_one(unsigned gpio, unsigned long flags, const char *label) + if (!desc && gpio_is_valid(gpio)) + return -EPROBE_DEFER; + ++ err = gpiod_request(desc, label); ++ if (err) ++ return err; ++ + if (flags & GPIOF_OPEN_DRAIN) + set_bit(FLAG_OPEN_DRAIN, &desc->flags); + +@@ -37,10 +41,6 @@ int gpio_request_one(unsigned gpio, unsigned long flags, const char *label) + if (flags & GPIOF_ACTIVE_LOW) + set_bit(FLAG_ACTIVE_LOW, &desc->flags); + +- err = gpiod_request(desc, label); +- if (err) +- return err; +- + if (flags & GPIOF_DIR_IN) + err = gpiod_direction_input(desc); + else +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index cf3e712..996a733 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -1324,14 +1324,6 @@ static int __gpiod_request(struct gpio_desc *desc, const char *label) + spin_lock_irqsave(&gpio_lock, flags); + } + done: +- if (status < 0) { +- /* Clear flags that might have been set by the caller before +- * requesting the GPIO. +- */ +- clear_bit(FLAG_ACTIVE_LOW, &desc->flags); +- clear_bit(FLAG_OPEN_DRAIN, &desc->flags); +- clear_bit(FLAG_OPEN_SOURCE, &desc->flags); +- } + spin_unlock_irqrestore(&gpio_lock, flags); + return status; + } +@@ -1345,8 +1337,12 @@ done: + #define VALIDATE_DESC(desc) do { \ + if (!desc) \ + return 0; \ ++ if (IS_ERR(desc)) { \ ++ pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \ ++ return PTR_ERR(desc); \ ++ } \ + if (!desc->gdev) { \ +- pr_warn("%s: invalid GPIO\n", __func__); \ ++ pr_warn("%s: invalid GPIO (no device)\n", __func__); \ + return -EINVAL; \ + } \ + if ( !desc->gdev->chip ) { \ +@@ -1358,8 +1354,12 @@ done: + #define VALIDATE_DESC_VOID(desc) do { \ + if (!desc) \ + return; \ ++ if (IS_ERR(desc)) { \ ++ pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \ ++ return; \ ++ } \ + if (!desc->gdev) { \ +- pr_warn("%s: invalid GPIO\n", __func__); \ ++ pr_warn("%s: invalid GPIO (no device)\n", __func__); \ + return; \ + } \ + if (!desc->gdev->chip) { \ +@@ -2011,7 +2011,7 @@ int gpiod_to_irq(const struct gpio_desc *desc) + * requires this function to not return zero on an invalid descriptor + * but rather a negative error number. + */ +- if (!desc || !desc->gdev || !desc->gdev->chip) ++ if (!desc || IS_ERR(desc) || !desc->gdev || !desc->gdev->chip) + return -EINVAL; + + chip = desc->gdev->chip; +@@ -2507,28 +2507,13 @@ struct gpio_desc *__must_check gpiod_get_optional(struct device *dev, + } + EXPORT_SYMBOL_GPL(gpiod_get_optional); + +-/** +- * gpiod_parse_flags - helper function to parse GPIO lookup flags +- * @desc: gpio to be setup +- * @lflags: gpio_lookup_flags - returned from of_find_gpio() or +- * of_get_gpio_hog() +- * +- * Set the GPIO descriptor flags based on the given GPIO lookup flags. +- */ +-static void gpiod_parse_flags(struct gpio_desc *desc, unsigned long lflags) +-{ +- if (lflags & GPIO_ACTIVE_LOW) +- set_bit(FLAG_ACTIVE_LOW, &desc->flags); +- if (lflags & GPIO_OPEN_DRAIN) +- set_bit(FLAG_OPEN_DRAIN, &desc->flags); +- if (lflags & GPIO_OPEN_SOURCE) +- set_bit(FLAG_OPEN_SOURCE, &desc->flags); +-} + + /** + * gpiod_configure_flags - helper function to configure a given GPIO + * @desc: gpio whose value will be assigned + * @con_id: function within the GPIO consumer ++ * @lflags: gpio_lookup_flags - returned from of_find_gpio() or ++ * of_get_gpio_hog() + * @dflags: gpiod_flags - optional GPIO initialization flags + * + * Return 0 on success, -ENOENT if no GPIO has been assigned to the +@@ -2536,10 +2521,17 @@ static void gpiod_parse_flags(struct gpio_desc *desc, unsigned long lflags) + * occurred while trying to acquire the GPIO. + */ + static int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id, +- enum gpiod_flags dflags) ++ unsigned long lflags, enum gpiod_flags dflags) + { + int status; + ++ if (lflags & GPIO_ACTIVE_LOW) ++ set_bit(FLAG_ACTIVE_LOW, &desc->flags); ++ if (lflags & GPIO_OPEN_DRAIN) ++ set_bit(FLAG_OPEN_DRAIN, &desc->flags); ++ if (lflags & GPIO_OPEN_SOURCE) ++ set_bit(FLAG_OPEN_SOURCE, &desc->flags); ++ + /* No particular flag request, return here... */ + if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) { + pr_debug("no flags found for %s\n", con_id); +@@ -2606,13 +2598,11 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + return desc; + } + +- gpiod_parse_flags(desc, lookupflags); +- + status = gpiod_request(desc, con_id); + if (status < 0) + return ERR_PTR(status); + +- status = gpiod_configure_flags(desc, con_id, flags); ++ status = gpiod_configure_flags(desc, con_id, lookupflags, flags); + if (status < 0) { + dev_dbg(dev, "setup of GPIO %s failed\n", con_id); + gpiod_put(desc); +@@ -2668,6 +2658,10 @@ struct gpio_desc *fwnode_get_named_gpiod(struct fwnode_handle *fwnode, + if (IS_ERR(desc)) + return desc; + ++ ret = gpiod_request(desc, NULL); ++ if (ret) ++ return ERR_PTR(ret); ++ + if (active_low) + set_bit(FLAG_ACTIVE_LOW, &desc->flags); + +@@ -2678,10 +2672,6 @@ struct gpio_desc *fwnode_get_named_gpiod(struct fwnode_handle *fwnode, + set_bit(FLAG_OPEN_SOURCE, &desc->flags); + } + +- ret = gpiod_request(desc, NULL); +- if (ret) +- return ERR_PTR(ret); +- + return desc; + } + EXPORT_SYMBOL_GPL(fwnode_get_named_gpiod); +@@ -2734,8 +2724,6 @@ int gpiod_hog(struct gpio_desc *desc, const char *name, + chip = gpiod_to_chip(desc); + hwnum = gpio_chip_hwgpio(desc); + +- gpiod_parse_flags(desc, lflags); +- + local_desc = gpiochip_request_own_desc(chip, hwnum, name); + if (IS_ERR(local_desc)) { + pr_err("requesting hog GPIO %s (chip %s, offset %d) failed\n", +@@ -2743,7 +2731,7 @@ int gpiod_hog(struct gpio_desc *desc, const char *name, + return PTR_ERR(local_desc); + } + +- status = gpiod_configure_flags(desc, name, dflags); ++ status = gpiod_configure_flags(desc, name, lflags, dflags); + if (status < 0) { + pr_err("setup of hog GPIO %s (chip %s, offset %d) failed\n", + name, chip->label, hwnum); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +index 6043dc7..3e21732 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +@@ -880,7 +880,7 @@ static int amdgpu_cgs_acpi_eval_object(void *cgs_device, + struct cgs_acpi_method_argument *argument = NULL; + uint32_t i, count; + acpi_status status; +- int result; ++ int result = 0; + uint32_t func_no = 0xFFFFFFFF; + + handle = ACPI_HANDLE(&adev->pdev->dev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index b04337d..d78739d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -448,7 +448,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + dev_info.max_memory_clock = adev->pm.default_mclk * 10; + } + dev_info.enabled_rb_pipes_mask = adev->gfx.config.backend_enable_mask; +- dev_info.num_rb_pipes = adev->gfx.config.num_rbs; ++ dev_info.num_rb_pipes = adev->gfx.config.max_backends_per_se * ++ adev->gfx.config.max_shader_engines; + dev_info.num_hw_gfx_contexts = adev->gfx.config.max_hw_contexts; + dev_info._pad = 0; + dev_info.ids_flags = 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index bb8709066..d2216f8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -5074,7 +5074,7 @@ static int gfx_v7_0_eop_irq(struct amdgpu_device *adev, + case 2: + for (i = 0; i < adev->gfx.num_compute_rings; i++) { + ring = &adev->gfx.compute_ring[i]; +- if ((ring->me == me_id) & (ring->pipe == pipe_id)) ++ if ((ring->me == me_id) && (ring->pipe == pipe_id)) + amdgpu_fence_process(ring); + } + break; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index ac00579..7708d90 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -242,13 +242,19 @@ static void kfd_process_notifier_release(struct mmu_notifier *mn, + pqm_uninit(&p->pqm); + + /* Iterate over all process device data structure and check +- * if we should reset all wavefronts */ +- list_for_each_entry(pdd, &p->per_device_data, per_device_list) ++ * if we should delete debug managers and reset all wavefronts ++ */ ++ list_for_each_entry(pdd, &p->per_device_data, per_device_list) { ++ if ((pdd->dev->dbgmgr) && ++ (pdd->dev->dbgmgr->pasid == p->pasid)) ++ kfd_dbgmgr_destroy(pdd->dev->dbgmgr); ++ + if (pdd->reset_wavefronts) { + pr_warn("amdkfd: Resetting all wave fronts\n"); + dbgdev_wave_reset_wavefronts(pdd->dev, p); + pdd->reset_wavefronts = false; + } ++ } + + mutex_unlock(&p->mutex); + +@@ -404,42 +410,52 @@ void kfd_unbind_process_from_device(struct kfd_dev *dev, unsigned int pasid) + + idx = srcu_read_lock(&kfd_processes_srcu); + ++ /* ++ * Look for the process that matches the pasid. If there is no such ++ * process, we either released it in amdkfd's own notifier, or there ++ * is a bug. Unfortunately, there is no way to tell... ++ */ + hash_for_each_rcu(kfd_processes_table, i, p, kfd_processes) +- if (p->pasid == pasid) +- break; ++ if (p->pasid == pasid) { + +- srcu_read_unlock(&kfd_processes_srcu, idx); ++ srcu_read_unlock(&kfd_processes_srcu, idx); + +- BUG_ON(p->pasid != pasid); ++ pr_debug("Unbinding process %d from IOMMU\n", pasid); + +- mutex_lock(&p->mutex); ++ mutex_lock(&p->mutex); + +- if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid)) +- kfd_dbgmgr_destroy(dev->dbgmgr); ++ if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid)) ++ kfd_dbgmgr_destroy(dev->dbgmgr); + +- pqm_uninit(&p->pqm); ++ pqm_uninit(&p->pqm); + +- pdd = kfd_get_process_device_data(dev, p); ++ pdd = kfd_get_process_device_data(dev, p); + +- if (!pdd) { +- mutex_unlock(&p->mutex); +- return; +- } ++ if (!pdd) { ++ mutex_unlock(&p->mutex); ++ return; ++ } + +- if (pdd->reset_wavefronts) { +- dbgdev_wave_reset_wavefronts(pdd->dev, p); +- pdd->reset_wavefronts = false; +- } ++ if (pdd->reset_wavefronts) { ++ dbgdev_wave_reset_wavefronts(pdd->dev, p); ++ pdd->reset_wavefronts = false; ++ } + +- /* +- * Just mark pdd as unbound, because we still need it to call +- * amd_iommu_unbind_pasid() in when the process exits. +- * We don't call amd_iommu_unbind_pasid() here +- * because the IOMMU called us. +- */ +- pdd->bound = false; ++ /* ++ * Just mark pdd as unbound, because we still need it ++ * to call amd_iommu_unbind_pasid() in when the ++ * process exits. ++ * We don't call amd_iommu_unbind_pasid() here ++ * because the IOMMU called us. ++ */ ++ pdd->bound = false; + +- mutex_unlock(&p->mutex); ++ mutex_unlock(&p->mutex); ++ ++ return; ++ } ++ ++ srcu_read_unlock(&kfd_processes_srcu, idx); + } + + struct kfd_process_device *kfd_get_first_process_device_data(struct kfd_process *p) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c +index fa208ad..efb77ed 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c +@@ -306,10 +306,14 @@ int phm_store_dal_configuration_data(struct pp_hwmgr *hwmgr, + { + PHM_FUNC_CHECK(hwmgr); + +- if (hwmgr->hwmgr_func->store_cc6_data == NULL) ++ if (display_config == NULL) + return -EINVAL; + + hwmgr->display_config = *display_config; ++ ++ if (hwmgr->hwmgr_func->store_cc6_data == NULL) ++ return -EINVAL; ++ + /* to do pass other display configuration in furture */ + + if (hwmgr->hwmgr_func->store_cc6_data) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c +index 7b2d500..7cce483 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c +@@ -21,6 +21,20 @@ bool acpi_atcs_functions_supported(void *device, uint32_t index) + return result == 0 ? (output_buf.function_bits & (1 << (index - 1))) != 0 : false; + } + ++bool acpi_atcs_notify_pcie_device_ready(void *device) ++{ ++ int32_t temp_buffer = 1; ++ ++ return cgs_call_acpi_method(device, CGS_ACPI_METHOD_ATCS, ++ ATCS_FUNCTION_PCIE_DEVICE_READY_NOTIFICATION, ++ &temp_buffer, ++ NULL, ++ 0, ++ sizeof(temp_buffer), ++ 0); ++} ++ ++ + int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise) + { + struct atcs_pref_req_input atcs_input; +@@ -29,7 +43,7 @@ int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise) + int result; + struct cgs_system_info info = {0}; + +- if (!acpi_atcs_functions_supported(device, ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST)) ++ if( 0 != acpi_atcs_notify_pcie_device_ready(device)) + return -EINVAL; + + info.size = sizeof(struct cgs_system_info); +@@ -54,7 +68,7 @@ int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise) + ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST, + &atcs_input, + &atcs_output, +- 0, ++ 1, + sizeof(atcs_input), + sizeof(atcs_output)); + if (result != 0) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c +index 0d5d837..aae2e8e 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c +@@ -1298,7 +1298,7 @@ static int tonga_populate_smc_mvdd_table(struct pp_hwmgr *hwmgr, + table->Smio[count] |= + data->mvdd_voltage_table.entries[count].smio_low; + } +- table->SmioMask2 = data->vddci_voltage_table.mask_low; ++ table->SmioMask2 = data->mvdd_voltage_table.mask_low; + + CONVERT_FROM_HOST_TO_SMC_UL(table->MvddLevelCount); + } +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c +index b156481..17766e8 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c +@@ -299,7 +299,7 @@ static int init_dpm_2_parameters( + (((unsigned long)powerplay_table) + le16_to_cpu(powerplay_table->usPPMTableOffset)); + + if (0 != powerplay_table->usPPMTableOffset) { +- if (1 == get_platform_power_management_table(hwmgr, atom_ppm_table)) { ++ if (get_platform_power_management_table(hwmgr, atom_ppm_table) == 0) { + phm_cap_set(hwmgr->platform_descriptor.platformCaps, + PHM_PlatformCaps_EnablePlatformPowerManagement); + } +diff --git a/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h b/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h +index 3bd5e69..3df5de2 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h +@@ -26,3 +26,4 @@ extern bool acpi_atcs_functions_supported(void *device, + extern int acpi_pcie_perf_request(void *device, + uint8_t perf_req, + bool advertise); ++extern bool acpi_atcs_notify_pcie_device_ready(void *device); +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index d65dcae..6d9c0f5 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -335,6 +335,8 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane, + + atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff, + factor_reg); ++ } else { ++ atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff, 0); + } + } + +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index d307d96..080a090 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -354,6 +354,8 @@ int drm_atomic_set_mode_prop_for_crtc(struct drm_crtc_state *state, + drm_property_unreference_blob(state->mode_blob); + state->mode_blob = NULL; + ++ memset(&state->mode, 0, sizeof(state->mode)); ++ + if (blob) { + if (blob->length != sizeof(struct drm_mode_modeinfo) || + drm_mode_convert_umode(&state->mode, +@@ -366,7 +368,6 @@ int drm_atomic_set_mode_prop_for_crtc(struct drm_crtc_state *state, + DRM_DEBUG_ATOMIC("Set [MODE:%s] for CRTC state %p\n", + state->mode.name, state); + } else { +- memset(&state->mode, 0, sizeof(state->mode)); + state->enable = false; + DRM_DEBUG_ATOMIC("Set [NOMODE] for CRTC state %p\n", + state); +@@ -1287,14 +1288,39 @@ EXPORT_SYMBOL(drm_atomic_add_affected_planes); + */ + void drm_atomic_legacy_backoff(struct drm_atomic_state *state) + { ++ struct drm_device *dev = state->dev; ++ unsigned crtc_mask = 0; ++ struct drm_crtc *crtc; + int ret; ++ bool global = false; ++ ++ drm_for_each_crtc(crtc, dev) { ++ if (crtc->acquire_ctx != state->acquire_ctx) ++ continue; ++ ++ crtc_mask |= drm_crtc_mask(crtc); ++ crtc->acquire_ctx = NULL; ++ } ++ ++ if (WARN_ON(dev->mode_config.acquire_ctx == state->acquire_ctx)) { ++ global = true; ++ ++ dev->mode_config.acquire_ctx = NULL; ++ } + + retry: + drm_modeset_backoff(state->acquire_ctx); + +- ret = drm_modeset_lock_all_ctx(state->dev, state->acquire_ctx); ++ ret = drm_modeset_lock_all_ctx(dev, state->acquire_ctx); + if (ret) + goto retry; ++ ++ drm_for_each_crtc(crtc, dev) ++ if (drm_crtc_mask(crtc) & crtc_mask) ++ crtc->acquire_ctx = state->acquire_ctx; ++ ++ if (global) ++ dev->mode_config.acquire_ctx = state->acquire_ctx; + } + EXPORT_SYMBOL(drm_atomic_legacy_backoff); + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index f30de80..691a1b9 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -2800,8 +2800,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + +- drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V); +- + /* + * Check whether the primary plane supports the fb pixel format. + * Drivers not implementing the universal planes API use a +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 71ea052..ccfe7e7 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2908,11 +2908,9 @@ static void drm_dp_destroy_connector_work(struct work_struct *work) + drm_dp_port_teardown_pdt(port, port->pdt); + + if (!port->input && port->vcpi.vcpi > 0) { +- if (mgr->mst_state) { +- drm_dp_mst_reset_vcpi_slots(mgr, port); +- drm_dp_update_payload_part1(mgr); +- drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi); +- } ++ drm_dp_mst_reset_vcpi_slots(mgr, port); ++ drm_dp_update_payload_part1(mgr); ++ drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi); + } + + kref_put(&port->kref, drm_dp_free_mst_port); +diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c +index bb88e3d..e619b00 100644 +--- a/drivers/gpu/drm/drm_fb_cma_helper.c ++++ b/drivers/gpu/drm/drm_fb_cma_helper.c +@@ -301,7 +301,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper, + err_fb_info_destroy: + drm_fb_helper_release_fbi(helper); + err_gem_free_object: +- dev->driver->gem_free_object(&obj->base); ++ drm_gem_object_unreference_unlocked(&obj->base); + return ret; + } + +diff --git a/drivers/gpu/drm/drm_gem_cma_helper.c b/drivers/gpu/drm/drm_gem_cma_helper.c +index 1f500a1..d988ca0 100644 +--- a/drivers/gpu/drm/drm_gem_cma_helper.c ++++ b/drivers/gpu/drm/drm_gem_cma_helper.c +@@ -121,7 +121,7 @@ struct drm_gem_cma_object *drm_gem_cma_create(struct drm_device *drm, + return cma_obj; + + error: +- drm->driver->gem_free_object(&cma_obj->base); ++ drm_gem_object_unreference_unlocked(&cma_obj->base); + return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(drm_gem_cma_create); +@@ -162,18 +162,12 @@ drm_gem_cma_create_with_handle(struct drm_file *file_priv, + * and handle has the id what user can see. + */ + ret = drm_gem_handle_create(file_priv, gem_obj, handle); +- if (ret) +- goto err_handle_create; +- + /* drop reference from allocate - handle holds it now. */ + drm_gem_object_unreference_unlocked(gem_obj); ++ if (ret) ++ return ERR_PTR(ret); + + return cma_obj; +- +-err_handle_create: +- drm->driver->gem_free_object(gem_obj); +- +- return ERR_PTR(ret); + } + + /** +diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c +index f7448a5..5d0fc26 100644 +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -1518,6 +1518,8 @@ int drm_mode_convert_umode(struct drm_display_mode *out, + if (out->status != MODE_OK) + goto out; + ++ drm_mode_set_crtcinfo(out, CRTC_INTERLACE_HALVE_V); ++ + ret = 0; + + out: +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +index e8d9337..77886f1 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +@@ -40,9 +40,10 @@ static const struct regmap_config fsl_dcu_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .cache_type = REGCACHE_RBTREE, ++ .cache_type = REGCACHE_FLAT, + + .volatile_reg = fsl_dcu_drm_is_volatile_reg, ++ .max_register = 0x11fc, + }; + + static int fsl_dcu_drm_irq_init(struct drm_device *dev) +diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c +index d3c473f..3af4061 100644 +--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c ++++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c +@@ -39,7 +39,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task) + if (!mutex_is_locked(mutex)) + return false; + +-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES) ++#if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_MUTEX_SPIN_ON_OWNER) + return mutex->owner == task; + #else + /* Since UP may be pre-empted, we cannot assume that we own the lock */ +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 7741efb..e5db9e1 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -8229,12 +8229,14 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + { + struct drm_i915_private *dev_priv = dev->dev_private; + struct intel_encoder *encoder; ++ int i; + u32 val, final; + bool has_lvds = false; + bool has_cpu_edp = false; + bool has_panel = false; + bool has_ck505 = false; + bool can_ssc = false; ++ bool using_ssc_source = false; + + /* We need to take the global config into account */ + for_each_intel_encoder(dev, encoder) { +@@ -8261,8 +8263,22 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + can_ssc = true; + } + +- DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d\n", +- has_panel, has_lvds, has_ck505); ++ /* Check if any DPLLs are using the SSC source */ ++ for (i = 0; i < dev_priv->num_shared_dpll; i++) { ++ u32 temp = I915_READ(PCH_DPLL(i)); ++ ++ if (!(temp & DPLL_VCO_ENABLE)) ++ continue; ++ ++ if ((temp & PLL_REF_INPUT_MASK) == ++ PLLB_REF_INPUT_SPREADSPECTRUMIN) { ++ using_ssc_source = true; ++ break; ++ } ++ } ++ ++ DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d using_ssc_source %d\n", ++ has_panel, has_lvds, has_ck505, using_ssc_source); + + /* Ironlake: try to setup display ref clock before DPLL + * enabling. This is only under driver's control after +@@ -8299,9 +8315,9 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + final |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD; + } else + final |= DREF_CPU_SOURCE_OUTPUT_DISABLE; +- } else { +- final |= DREF_SSC_SOURCE_DISABLE; +- final |= DREF_CPU_SOURCE_OUTPUT_DISABLE; ++ } else if (using_ssc_source) { ++ final |= DREF_SSC_SOURCE_ENABLE; ++ final |= DREF_SSC1_ENABLE; + } + + if (final == val) +@@ -8347,7 +8363,7 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + POSTING_READ(PCH_DREF_CONTROL); + udelay(200); + } else { +- DRM_DEBUG_KMS("Disabling SSC entirely\n"); ++ DRM_DEBUG_KMS("Disabling CPU source output\n"); + + val &= ~DREF_CPU_SOURCE_OUTPUT_MASK; + +@@ -8358,16 +8374,20 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + POSTING_READ(PCH_DREF_CONTROL); + udelay(200); + +- /* Turn off the SSC source */ +- val &= ~DREF_SSC_SOURCE_MASK; +- val |= DREF_SSC_SOURCE_DISABLE; ++ if (!using_ssc_source) { ++ DRM_DEBUG_KMS("Disabling SSC source\n"); + +- /* Turn off SSC1 */ +- val &= ~DREF_SSC1_ENABLE; ++ /* Turn off the SSC source */ ++ val &= ~DREF_SSC_SOURCE_MASK; ++ val |= DREF_SSC_SOURCE_DISABLE; + +- I915_WRITE(PCH_DREF_CONTROL, val); +- POSTING_READ(PCH_DREF_CONTROL); +- udelay(200); ++ /* Turn off SSC1 */ ++ val &= ~DREF_SSC1_ENABLE; ++ ++ I915_WRITE(PCH_DREF_CONTROL, val); ++ POSTING_READ(PCH_DREF_CONTROL); ++ udelay(200); ++ } + } + + BUG_ON(val != final); +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 412a34c..69054ef 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4942,13 +4942,15 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp) + + void intel_dp_encoder_reset(struct drm_encoder *encoder) + { +- struct intel_dp *intel_dp; ++ struct drm_i915_private *dev_priv = to_i915(encoder->dev); ++ struct intel_dp *intel_dp = enc_to_intel_dp(encoder); ++ ++ if (!HAS_DDI(dev_priv)) ++ intel_dp->DP = I915_READ(intel_dp->output_reg); + + if (to_intel_encoder(encoder)->type != INTEL_OUTPUT_EDP) + return; + +- intel_dp = enc_to_intel_dp(encoder); +- + pps_lock(intel_dp); + + /* +@@ -5020,9 +5022,6 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd) + intel_display_power_get(dev_priv, power_domain); + + if (long_hpd) { +- /* indicate that we need to restart link training */ +- intel_dp->train_set_valid = false; +- + if (!intel_digital_port_connected(dev_priv, intel_dig_port)) + goto mst_fail; + +diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c +index 0b8eefc..926a1e6 100644 +--- a/drivers/gpu/drm/i915/intel_dp_link_training.c ++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c +@@ -85,8 +85,7 @@ static bool + intel_dp_reset_link_train(struct intel_dp *intel_dp, + uint8_t dp_train_pat) + { +- if (!intel_dp->train_set_valid) +- memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set)); ++ memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set)); + intel_dp_set_signal_levels(intel_dp); + return intel_dp_set_link_train(intel_dp, dp_train_pat); + } +@@ -161,22 +160,6 @@ intel_dp_link_training_clock_recovery(struct intel_dp *intel_dp) + break; + } + +- /* +- * if we used previously trained voltage and pre-emphasis values +- * and we don't get clock recovery, reset link training values +- */ +- if (intel_dp->train_set_valid) { +- DRM_DEBUG_KMS("clock recovery not ok, reset"); +- /* clear the flag as we are not reusing train set */ +- intel_dp->train_set_valid = false; +- if (!intel_dp_reset_link_train(intel_dp, +- DP_TRAINING_PATTERN_1 | +- DP_LINK_SCRAMBLING_DISABLE)) { +- DRM_ERROR("failed to enable link training\n"); +- return; +- } +- continue; +- } + + /* Check to see if we've tried the max voltage */ + for (i = 0; i < intel_dp->lane_count; i++) +@@ -284,7 +267,6 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp) + /* Make sure clock is still ok */ + if (!drm_dp_clock_recovery_ok(link_status, + intel_dp->lane_count)) { +- intel_dp->train_set_valid = false; + intel_dp_link_training_clock_recovery(intel_dp); + intel_dp_set_link_train(intel_dp, + training_pattern | +@@ -301,7 +283,6 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp) + + /* Try 5 times, then try clock recovery if that fails */ + if (tries > 5) { +- intel_dp->train_set_valid = false; + intel_dp_link_training_clock_recovery(intel_dp); + intel_dp_set_link_train(intel_dp, + training_pattern | +@@ -322,10 +303,8 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp) + + intel_dp_set_idle_link_train(intel_dp); + +- if (channel_eq) { +- intel_dp->train_set_valid = true; ++ if (channel_eq) + DRM_DEBUG_KMS("Channel EQ done. DP Training successful\n"); +- } + } + + void intel_dp_stop_link_train(struct intel_dp *intel_dp) +diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h +index 3a30b37..8dd2cc5 100644 +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -811,8 +811,6 @@ struct intel_dp { + /* This is called before a link training is starterd */ + void (*prepare_link_retrain)(struct intel_dp *intel_dp); + +- bool train_set_valid; +- + /* Displayport compliance testing */ + unsigned long compliance_test_type; + unsigned long compliance_test_data; +diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c +index 0f0492f..28f4407 100644 +--- a/drivers/gpu/drm/i915/intel_fbc.c ++++ b/drivers/gpu/drm/i915/intel_fbc.c +@@ -823,8 +823,7 @@ static bool intel_fbc_can_choose(struct intel_crtc *crtc) + { + struct drm_i915_private *dev_priv = crtc->base.dev->dev_private; + struct intel_fbc *fbc = &dev_priv->fbc; +- bool enable_by_default = IS_HASWELL(dev_priv) || +- IS_BROADWELL(dev_priv); ++ bool enable_by_default = IS_BROADWELL(dev_priv); + + if (intel_vgpu_active(dev_priv->dev)) { + fbc->no_fbc_reason = "VGPU is active"; +diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c +index 14e64e0..d347dca 100644 +--- a/drivers/gpu/drm/mgag200/mgag200_mode.c ++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c +@@ -182,7 +182,7 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock) + } + } + +- fvv = pllreffreq * testn / testm; ++ fvv = pllreffreq * (n + 1) / (m + 1); + fvv = (fvv - 800000) / 50000; + + if (fvv > 15) +@@ -202,6 +202,14 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock) + WREG_DAC(MGA1064_PIX_PLLC_M, m); + WREG_DAC(MGA1064_PIX_PLLC_N, n); + WREG_DAC(MGA1064_PIX_PLLC_P, p); ++ ++ if (mdev->unique_rev_id >= 0x04) { ++ WREG_DAC(0x1a, 0x09); ++ msleep(20); ++ WREG_DAC(0x1a, 0x01); ++ ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h +index db10c11..c5a6ebd 100644 +--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h +@@ -25,7 +25,8 @@ u16 nvbios_outp_match(struct nvkm_bios *, u16 type, u16 mask, + u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_outp *); + + struct nvbios_ocfg { +- u16 match; ++ u8 proto; ++ u8 flags; + u16 clkcmp[2]; + }; + +@@ -33,7 +34,7 @@ u16 nvbios_ocfg_entry(struct nvkm_bios *, u16 outp, u8 idx, + u8 *ver, u8 *hdr, u8 *cnt, u8 *len); + u16 nvbios_ocfg_parse(struct nvkm_bios *, u16 outp, u8 idx, + u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *); +-u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u16 type, ++u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u8 proto, u8 flags, + u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *); + u16 nvbios_oclk_match(struct nvkm_bios *, u16 cmp, u32 khz); + #endif +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +index 59f27e7..e40a1b0 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -557,6 +557,8 @@ nouveau_fbcon_init(struct drm_device *dev) + if (ret) + goto fini; + ++ if (fbcon->helper.fbdev) ++ fbcon->helper.fbdev->pixmap.buf_align = 4; + return 0; + + fini: +diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c +index 789dc29..8f715fe 100644 +--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c +@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + uint32_t fg; + uint32_t bg; + uint32_t dsize; +- uint32_t width; + uint32_t *data = (uint32_t *)image->data; + int ret; + +@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + if (ret) + return ret; + +- width = ALIGN(image->width, 8); +- dsize = ALIGN(width * image->height, 32) >> 5; +- + if (info->fix.visual == FB_VISUAL_TRUECOLOR || + info->fix.visual == FB_VISUAL_DIRECTCOLOR) { + fg = ((uint32_t *) info->pseudo_palette)[image->fg_color]; +@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + ((image->dx + image->width) & 0xffff)); + OUT_RING(chan, bg); + OUT_RING(chan, fg); +- OUT_RING(chan, (image->height << 16) | width); ++ OUT_RING(chan, (image->height << 16) | image->width); + OUT_RING(chan, (image->height << 16) | image->width); + OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff)); + ++ dsize = ALIGN(image->width * image->height, 32) >> 5; + while (dsize) { + int iter_len = dsize > 128 ? 128 : dsize; + +diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c +index e05499d..a4e259a 100644 +--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c +@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + struct nouveau_fbdev *nfbdev = info->par; + struct nouveau_drm *drm = nouveau_drm(nfbdev->dev); + struct nouveau_channel *chan = drm->channel; +- uint32_t width, dwords, *data = (uint32_t *)image->data; ++ uint32_t dwords, *data = (uint32_t *)image->data; + uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel)); + uint32_t *palette = info->pseudo_palette; + int ret; +@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + if (ret) + return ret; + +- width = ALIGN(image->width, 32); +- dwords = (width * image->height) >> 5; +- + BEGIN_NV04(chan, NvSub2D, 0x0814, 2); + if (info->fix.visual == FB_VISUAL_TRUECOLOR || + info->fix.visual == FB_VISUAL_DIRECTCOLOR) { +@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + OUT_RING(chan, 0); + OUT_RING(chan, image->dy); + ++ dwords = ALIGN(image->width * image->height, 32) >> 5; + while (dwords) { + int push = dwords > 2047 ? 2047 : dwords; + +diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c +index c97395b..f28315e 100644 +--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c +@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + struct nouveau_fbdev *nfbdev = info->par; + struct nouveau_drm *drm = nouveau_drm(nfbdev->dev); + struct nouveau_channel *chan = drm->channel; +- uint32_t width, dwords, *data = (uint32_t *)image->data; ++ uint32_t dwords, *data = (uint32_t *)image->data; + uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel)); + uint32_t *palette = info->pseudo_palette; + int ret; +@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + if (ret) + return ret; + +- width = ALIGN(image->width, 32); +- dwords = (width * image->height) >> 5; +- + BEGIN_NVC0(chan, NvSub2D, 0x0814, 2); + if (info->fix.visual == FB_VISUAL_TRUECOLOR || + info->fix.visual == FB_VISUAL_DIRECTCOLOR) { +@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + OUT_RING (chan, 0); + OUT_RING (chan, image->dy); + ++ dwords = ALIGN(image->width * image->height, 32) >> 5; + while (dwords) { + int push = dwords > 2047 ? 2047 : dwords; + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c +index 18fab397..62ad030 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c +@@ -1614,7 +1614,7 @@ nvkm_device_pci_func = { + .fini = nvkm_device_pci_fini, + .resource_addr = nvkm_device_pci_resource_addr, + .resource_size = nvkm_device_pci_resource_size, +- .cpu_coherent = !IS_ENABLED(CONFIG_ARM) && !IS_ENABLED(CONFIG_ARM64), ++ .cpu_coherent = !IS_ENABLED(CONFIG_ARM), + }; + + int +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild +index a74c5dd..e2a64ed 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild +@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o + nvkm-y += nvkm/engine/disp/sornv50.o + nvkm-y += nvkm/engine/disp/sorg94.o + nvkm-y += nvkm/engine/disp/sorgf119.o ++nvkm-y += nvkm/engine/disp/sorgm107.o + nvkm-y += nvkm/engine/disp/sorgm200.o + nvkm-y += nvkm/engine/disp/dport.o + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c +index f031466..5dd3438 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c +@@ -76,6 +76,7 @@ exec_lookup(struct nv50_disp *disp, int head, int or, u32 ctrl, + mask |= 0x0001 << or; + mask |= 0x0100 << head; + ++ + list_for_each_entry(outp, &disp->base.outp, head) { + if ((outp->info.hasht & 0xff) == type && + (outp->info.hashm & mask) == mask) { +@@ -155,25 +156,21 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf) + if (!outp) + return NULL; + ++ *conf = (ctrl & 0x00000f00) >> 8; + switch (outp->info.type) { + case DCB_OUTPUT_TMDS: +- *conf = (ctrl & 0x00000f00) >> 8; + if (*conf == 5) + *conf |= 0x0100; + break; + case DCB_OUTPUT_LVDS: +- *conf = disp->sor.lvdsconf; +- break; +- case DCB_OUTPUT_DP: +- *conf = (ctrl & 0x00000f00) >> 8; ++ *conf |= disp->sor.lvdsconf; + break; +- case DCB_OUTPUT_ANALOG: + default: +- *conf = 0x00ff; + break; + } + +- data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2); ++ data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8, ++ &ver, &hdr, &cnt, &len, &info2); + if (data && id < 0xff) { + data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk); + if (data) { +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c +index b694414..f4b9cf8 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c +@@ -36,7 +36,7 @@ gm107_disp = { + .outp.internal.crt = nv50_dac_output_new, + .outp.internal.tmds = nv50_sor_output_new, + .outp.internal.lvds = nv50_sor_output_new, +- .outp.internal.dp = gf119_sor_dp_new, ++ .outp.internal.dp = gm107_sor_dp_new, + .dac.nr = 3, + .dac.power = nv50_dac_power, + .dac.sense = nv50_dac_sense, +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +index 4226d21..fcb1b0c 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +@@ -387,22 +387,17 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf) + if (!outp) + return NULL; + ++ *conf = (ctrl & 0x00000f00) >> 8; + if (outp->info.location == 0) { + switch (outp->info.type) { + case DCB_OUTPUT_TMDS: +- *conf = (ctrl & 0x00000f00) >> 8; + if (*conf == 5) + *conf |= 0x0100; + break; + case DCB_OUTPUT_LVDS: +- *conf = disp->sor.lvdsconf; ++ *conf |= disp->sor.lvdsconf; + break; +- case DCB_OUTPUT_DP: +- *conf = (ctrl & 0x00000f00) >> 8; +- break; +- case DCB_OUTPUT_ANALOG: + default: +- *conf = 0x00ff; + break; + } + } else { +@@ -410,7 +405,8 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf) + pclk = pclk / 2; + } + +- data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2); ++ data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8, ++ &ver, &hdr, &cnt, &len, &info2); + if (data && id < 0xff) { + data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk); + if (data) { +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h +index e9067ba..4e983f6 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h +@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_output_dp *, int); + int gf119_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, + struct nvkm_output **); + int gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *, int, int, bool); ++int gf119_sor_dp_drv_ctl(struct nvkm_output_dp *, int, int, int, int); + +-int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, +- struct nvkm_output **); ++int gm107_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, ++ struct nvkm_output **); ++int gm107_sor_dp_pattern(struct nvkm_output_dp *, int); ++ ++int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *, ++ struct nvkm_output **); + #endif +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c +index b4b41b1..49bd5da 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c +@@ -40,8 +40,8 @@ static int + gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) + { + struct nvkm_device *device = outp->base.disp->engine.subdev.device; +- const u32 loff = gf119_sor_loff(outp); +- nvkm_mask(device, 0x61c110 + loff, 0x0f0f0f0f, 0x01010101 * pattern); ++ const u32 soff = gf119_sor_soff(outp); ++ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, 0x01010101 * pattern); + return 0; + } + +@@ -64,7 +64,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *outp, int nr, int bw, bool ef) + return 0; + } + +-static int ++int + gf119_sor_dp_drv_ctl(struct nvkm_output_dp *outp, + int ln, int vs, int pe, int pc) + { +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c +new file mode 100644 +index 0000000..37790b2 +--- /dev/null ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c +@@ -0,0 +1,53 @@ ++/* ++ * Copyright 2016 Red Hat Inc. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR ++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR ++ * OTHER DEALINGS IN THE SOFTWARE. ++ * ++ * Authors: Ben Skeggs <bskeggs@redhat.com> ++ */ ++#include "nv50.h" ++#include "outpdp.h" ++ ++int ++gm107_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) ++{ ++ struct nvkm_device *device = outp->base.disp->engine.subdev.device; ++ const u32 soff = outp->base.or * 0x800; ++ const u32 data = 0x01010101 * pattern; ++ if (outp->base.info.sorconf.link & 1) ++ nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data); ++ else ++ nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data); ++ return 0; ++} ++ ++static const struct nvkm_output_dp_func ++gm107_sor_dp_func = { ++ .pattern = gm107_sor_dp_pattern, ++ .lnk_pwr = g94_sor_dp_lnk_pwr, ++ .lnk_ctl = gf119_sor_dp_lnk_ctl, ++ .drv_ctl = gf119_sor_dp_drv_ctl, ++}; ++ ++int ++gm107_sor_dp_new(struct nvkm_disp *disp, int index, ++ struct dcb_output *dcbE, struct nvkm_output **poutp) ++{ ++ return nvkm_output_dp_new_(&gm107_sor_dp_func, disp, index, dcbE, poutp); ++} +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c +index 2cfbef9..c44fa7e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c +@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device *device, u8 lane) + } + + static int +-gm200_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern) +-{ +- struct nvkm_device *device = outp->base.disp->engine.subdev.device; +- const u32 soff = gm200_sor_soff(outp); +- const u32 data = 0x01010101 * pattern; +- if (outp->base.info.sorconf.link & 1) +- nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data); +- else +- nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data); +- return 0; +-} +- +-static int + gm200_sor_dp_lnk_pwr(struct nvkm_output_dp *outp, int nr) + { + struct nvkm_device *device = outp->base.disp->engine.subdev.device; +@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_dp *outp, + + static const struct nvkm_output_dp_func + gm200_sor_dp_func = { +- .pattern = gm200_sor_dp_pattern, ++ .pattern = gm107_sor_dp_pattern, + .lnk_pwr = gm200_sor_dp_lnk_pwr, + .lnk_ctl = gf119_sor_dp_lnk_ctl, + .drv_ctl = gm200_sor_dp_drv_ctl, +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +index b2de290..b0c7216 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +@@ -942,22 +942,41 @@ gf100_gr_trap_gpc_rop(struct gf100_gr *gr, int gpc) + } + + static const struct nvkm_enum gf100_mp_warp_error[] = { +- { 0x00, "NO_ERROR" }, +- { 0x01, "STACK_MISMATCH" }, ++ { 0x01, "STACK_ERROR" }, ++ { 0x02, "API_STACK_ERROR" }, ++ { 0x03, "RET_EMPTY_STACK_ERROR" }, ++ { 0x04, "PC_WRAP" }, + { 0x05, "MISALIGNED_PC" }, +- { 0x08, "MISALIGNED_GPR" }, +- { 0x09, "INVALID_OPCODE" }, +- { 0x0d, "GPR_OUT_OF_BOUNDS" }, +- { 0x0e, "MEM_OUT_OF_BOUNDS" }, +- { 0x0f, "UNALIGNED_MEM_ACCESS" }, ++ { 0x06, "PC_OVERFLOW" }, ++ { 0x07, "MISALIGNED_IMMC_ADDR" }, ++ { 0x08, "MISALIGNED_REG" }, ++ { 0x09, "ILLEGAL_INSTR_ENCODING" }, ++ { 0x0a, "ILLEGAL_SPH_INSTR_COMBO" }, ++ { 0x0b, "ILLEGAL_INSTR_PARAM" }, ++ { 0x0c, "INVALID_CONST_ADDR" }, ++ { 0x0d, "OOR_REG" }, ++ { 0x0e, "OOR_ADDR" }, ++ { 0x0f, "MISALIGNED_ADDR" }, + { 0x10, "INVALID_ADDR_SPACE" }, +- { 0x11, "INVALID_PARAM" }, ++ { 0x11, "ILLEGAL_INSTR_PARAM2" }, ++ { 0x12, "INVALID_CONST_ADDR_LDC" }, ++ { 0x13, "GEOMETRY_SM_ERROR" }, ++ { 0x14, "DIVERGENT" }, ++ { 0x15, "WARP_EXIT" }, + {} + }; + + static const struct nvkm_bitfield gf100_mp_global_error[] = { ++ { 0x00000001, "SM_TO_SM_FAULT" }, ++ { 0x00000002, "L1_ERROR" }, + { 0x00000004, "MULTIPLE_WARP_ERRORS" }, +- { 0x00000008, "OUT_OF_STACK_SPACE" }, ++ { 0x00000008, "PHYSICAL_STACK_OVERFLOW" }, ++ { 0x00000010, "BPT_INT" }, ++ { 0x00000020, "BPT_PAUSE" }, ++ { 0x00000040, "SINGLE_STEP_COMPLETE" }, ++ { 0x20000000, "ECC_SEC_ERROR" }, ++ { 0x40000000, "ECC_DED_ERROR" }, ++ { 0x80000000, "TIMEOUT" }, + {} + }; + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c +index a5e9213..9efb1b4 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c +@@ -141,7 +141,8 @@ nvbios_ocfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx, + { + u16 data = nvbios_ocfg_entry(bios, outp, idx, ver, hdr, cnt, len); + if (data) { +- info->match = nvbios_rd16(bios, data + 0x00); ++ info->proto = nvbios_rd08(bios, data + 0x00); ++ info->flags = nvbios_rd16(bios, data + 0x01); + info->clkcmp[0] = nvbios_rd16(bios, data + 0x02); + info->clkcmp[1] = nvbios_rd16(bios, data + 0x04); + } +@@ -149,12 +150,13 @@ nvbios_ocfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx, + } + + u16 +-nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u16 type, ++nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u8 proto, u8 flags, + u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *info) + { + u16 data, idx = 0; + while ((data = nvbios_ocfg_parse(bios, outp, idx++, ver, hdr, cnt, len, info))) { +- if (info->match == type) ++ if ((info->proto == proto || info->proto == 0xff) && ++ (info->flags == flags)) + break; + } + return data; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c +index e292f56..389fb13 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c +@@ -69,11 +69,11 @@ gm107_ltc_zbc_clear_depth(struct nvkm_ltc *ltc, int i, const u32 depth) + } + + static void +-gm107_ltc_lts_isr(struct nvkm_ltc *ltc, int c, int s) ++gm107_ltc_intr_lts(struct nvkm_ltc *ltc, int c, int s) + { + struct nvkm_subdev *subdev = <c->subdev; + struct nvkm_device *device = subdev->device; +- u32 base = 0x140000 + (c * 0x2000) + (s * 0x200); ++ u32 base = 0x140400 + (c * 0x2000) + (s * 0x200); + u32 stat = nvkm_rd32(device, base + 0x00c); + + if (stat) { +@@ -92,7 +92,7 @@ gm107_ltc_intr(struct nvkm_ltc *ltc) + while (mask) { + u32 s, c = __ffs(mask); + for (s = 0; s < ltc->lts_nr; s++) +- gm107_ltc_lts_isr(ltc, c, s); ++ gm107_ltc_intr_lts(ltc, c, s); + mask &= ~(1 << c); + } + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c +index 2a29bfd..e18e0dc 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c +@@ -46,7 +46,7 @@ static const struct nvkm_ltc_func + gm200_ltc = { + .oneinit = gm200_ltc_oneinit, + .init = gm200_ltc_init, +- .intr = gm107_ltc_intr, /*XXX: not validated */ ++ .intr = gm107_ltc_intr, + .cbc_clear = gm107_ltc_cbc_clear, + .cbc_wait = gm107_ltc_cbc_wait, + .zbc = 16, +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index d0826fb..cb29868 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -630,6 +630,23 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc) + /* + * GPU helpers function. + */ ++ ++/** ++ * radeon_device_is_virtual - check if we are running is a virtual environment ++ * ++ * Check if the asic has been passed through to a VM (all asics). ++ * Used at driver startup. ++ * Returns true if virtual or false if not. ++ */ ++static bool radeon_device_is_virtual(void) ++{ ++#ifdef CONFIG_X86 ++ return boot_cpu_has(X86_FEATURE_HYPERVISOR); ++#else ++ return false; ++#endif ++} ++ + /** + * radeon_card_posted - check if the hw has already been initialized + * +@@ -643,6 +660,10 @@ bool radeon_card_posted(struct radeon_device *rdev) + { + uint32_t reg; + ++ /* for pass through, always force asic_init */ ++ if (radeon_device_is_virtual()) ++ return false; ++ + /* required for EFI mode on macbook2,1 which uses an r5xx asic */ + if (efi_enabled(EFI_BOOT) && + (rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) && +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index e3daafa..3e7c9ac 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -1016,9 +1016,9 @@ out_unlock: + return ret; + } + +-static bool ttm_bo_mem_compat(struct ttm_placement *placement, +- struct ttm_mem_reg *mem, +- uint32_t *new_flags) ++bool ttm_bo_mem_compat(struct ttm_placement *placement, ++ struct ttm_mem_reg *mem, ++ uint32_t *new_flags) + { + int i; + +@@ -1050,6 +1050,7 @@ static bool ttm_bo_mem_compat(struct ttm_placement *placement, + + return false; + } ++EXPORT_SYMBOL(ttm_bo_mem_compat); + + int ttm_bo_validate(struct ttm_buffer_object *bo, + struct ttm_placement *placement, +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c +index 299925a..eadc981 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c +@@ -49,6 +49,7 @@ int vmw_dmabuf_pin_in_placement(struct vmw_private *dev_priv, + { + struct ttm_buffer_object *bo = &buf->base; + int ret; ++ uint32_t new_flags; + + ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible); + if (unlikely(ret != 0)) +@@ -60,7 +61,12 @@ int vmw_dmabuf_pin_in_placement(struct vmw_private *dev_priv, + if (unlikely(ret != 0)) + goto err; + +- ret = ttm_bo_validate(bo, placement, interruptible, false); ++ if (buf->pin_count > 0) ++ ret = ttm_bo_mem_compat(placement, &bo->mem, ++ &new_flags) == true ? 0 : -EINVAL; ++ else ++ ret = ttm_bo_validate(bo, placement, interruptible, false); ++ + if (!ret) + vmw_bo_pin_reserved(buf, true); + +@@ -91,6 +97,7 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct vmw_private *dev_priv, + { + struct ttm_buffer_object *bo = &buf->base; + int ret; ++ uint32_t new_flags; + + ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible); + if (unlikely(ret != 0)) +@@ -102,6 +109,12 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct vmw_private *dev_priv, + if (unlikely(ret != 0)) + goto err; + ++ if (buf->pin_count > 0) { ++ ret = ttm_bo_mem_compat(&vmw_vram_gmr_placement, &bo->mem, ++ &new_flags) == true ? 0 : -EINVAL; ++ goto out_unreserve; ++ } ++ + ret = ttm_bo_validate(bo, &vmw_vram_gmr_placement, interruptible, + false); + if (likely(ret == 0) || ret == -ERESTARTSYS) +@@ -161,6 +174,7 @@ int vmw_dmabuf_pin_in_start_of_vram(struct vmw_private *dev_priv, + struct ttm_placement placement; + struct ttm_place place; + int ret = 0; ++ uint32_t new_flags; + + place = vmw_vram_placement.placement[0]; + place.lpfn = bo->num_pages; +@@ -185,10 +199,15 @@ int vmw_dmabuf_pin_in_start_of_vram(struct vmw_private *dev_priv, + */ + if (bo->mem.mem_type == TTM_PL_VRAM && + bo->mem.start < bo->num_pages && +- bo->mem.start > 0) ++ bo->mem.start > 0 && ++ buf->pin_count == 0) + (void) ttm_bo_validate(bo, &vmw_sys_placement, false, false); + +- ret = ttm_bo_validate(bo, &placement, interruptible, false); ++ if (buf->pin_count > 0) ++ ret = ttm_bo_mem_compat(&placement, &bo->mem, ++ &new_flags) == true ? 0 : -EINVAL; ++ else ++ ret = ttm_bo_validate(bo, &placement, interruptible, false); + + /* For some reason we didn't end up at the start of vram */ + WARN_ON(ret == 0 && bo->offset != 0); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +index f2cf923..2a50546 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -227,6 +227,7 @@ static int vmw_force_iommu; + static int vmw_restrict_iommu; + static int vmw_force_coherent; + static int vmw_restrict_dma_mask; ++static int vmw_assume_16bpp; + + static int vmw_probe(struct pci_dev *, const struct pci_device_id *); + static void vmw_master_init(struct vmw_master *); +@@ -243,6 +244,8 @@ MODULE_PARM_DESC(force_coherent, "Force coherent TTM pages"); + module_param_named(force_coherent, vmw_force_coherent, int, 0600); + MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU"); + module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600); ++MODULE_PARM_DESC(assume_16bpp, "Assume 16-bpp when filtering modes"); ++module_param_named(assume_16bpp, vmw_assume_16bpp, int, 0600); + + + static void vmw_print_capabilities(uint32_t capabilities) +@@ -653,6 +656,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + dev_priv->vram_start = pci_resource_start(dev->pdev, 1); + dev_priv->mmio_start = pci_resource_start(dev->pdev, 2); + ++ dev_priv->assume_16bpp = !!vmw_assume_16bpp; ++ + dev_priv->enable_fb = enable_fbdev; + + vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2); +@@ -699,6 +704,13 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) + vmw_read(dev_priv, + SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB); + ++ /* ++ * Workaround for low memory 2D VMs to compensate for the ++ * allocation taken by fbdev ++ */ ++ if (!(dev_priv->capabilities & SVGA_CAP_3D)) ++ mem_size *= 2; ++ + dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE; + dev_priv->prim_bb_mem = + vmw_read(dev_priv, +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +index 6db358a..cab0c54 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -386,6 +386,7 @@ struct vmw_private { + spinlock_t hw_lock; + spinlock_t cap_lock; + bool has_dx; ++ bool assume_16bpp; + + /* + * VGA registers. +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +index 679a4cb..d2d9395 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -517,28 +517,6 @@ static int vmw_fb_kms_framebuffer(struct fb_info *info) + + par->set_fb = &vfb->base; + +- if (!par->bo_ptr) { +- /* +- * Pin before mapping. Since we don't know in what placement +- * to pin, call into KMS to do it for us. +- */ +- ret = vfb->pin(vfb); +- if (ret) { +- DRM_ERROR("Could not pin the fbdev framebuffer.\n"); +- return ret; +- } +- +- ret = ttm_bo_kmap(&par->vmw_bo->base, 0, +- par->vmw_bo->base.num_pages, &par->map); +- if (ret) { +- vfb->unpin(vfb); +- DRM_ERROR("Could not map the fbdev framebuffer.\n"); +- return ret; +- } +- +- par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite); +- } +- + return 0; + } + +@@ -601,6 +579,31 @@ static int vmw_fb_set_par(struct fb_info *info) + if (ret) + goto out_unlock; + ++ if (!par->bo_ptr) { ++ struct vmw_framebuffer *vfb = vmw_framebuffer_to_vfb(set.fb); ++ ++ /* ++ * Pin before mapping. Since we don't know in what placement ++ * to pin, call into KMS to do it for us. ++ */ ++ ret = vfb->pin(vfb); ++ if (ret) { ++ DRM_ERROR("Could not pin the fbdev framebuffer.\n"); ++ goto out_unlock; ++ } ++ ++ ret = ttm_bo_kmap(&par->vmw_bo->base, 0, ++ par->vmw_bo->base.num_pages, &par->map); ++ if (ret) { ++ vfb->unpin(vfb); ++ DRM_ERROR("Could not map the fbdev framebuffer.\n"); ++ goto out_unlock; ++ } ++ ++ par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite); ++ } ++ ++ + vmw_fb_dirty_mark(par, par->fb_x, par->fb_y, + par->set_fb->width, par->set_fb->height); + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index b07543b..6ccd61d 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -1553,14 +1553,10 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; + int i; +- u32 assumed_bpp = 2; ++ u32 assumed_bpp = 4; + +- /* +- * If using screen objects, then assume 32-bpp because that's what the +- * SVGA device is assuming +- */ +- if (dev_priv->active_display_unit == vmw_du_screen_object) +- assumed_bpp = 4; ++ if (dev_priv->assume_16bpp) ++ assumed_bpp = 2; + + if (dev_priv->active_display_unit == vmw_du_screen_target) { + max_width = min(max_width, dev_priv->stdu_max_width); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +index 9ca818f..41932a7 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +@@ -399,8 +399,10 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv, + + WARN_ON_ONCE(!stdu->defined); + +- if (!vfb->dmabuf && new_fb->width == mode->hdisplay && +- new_fb->height == mode->vdisplay) ++ new_vfbs = (vfb->dmabuf) ? NULL : vmw_framebuffer_to_vfbs(new_fb); ++ ++ if (new_vfbs && new_vfbs->surface->base_size.width == mode->hdisplay && ++ new_vfbs->surface->base_size.height == mode->vdisplay) + new_content_type = SAME_AS_DISPLAY; + else if (vfb->dmabuf) + new_content_type = SEPARATE_DMA; +@@ -444,7 +446,6 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv, + content_srf.mip_levels[0] = 1; + content_srf.multisample_count = 0; + } else { +- new_vfbs = vmw_framebuffer_to_vfbs(new_fb); + content_srf = *new_vfbs->surface; + } + +@@ -464,7 +465,6 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv, + return ret; + } + } else if (new_content_type == SAME_AS_DISPLAY) { +- new_vfbs = vmw_framebuffer_to_vfbs(new_fb); + new_display_srf = vmw_surface_reference(new_vfbs->surface); + } + +diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c +index aad8c16..0cd4f72 100644 +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -261,7 +261,7 @@ static void elo_remove(struct hid_device *hdev) + struct elo_priv *priv = hid_get_drvdata(hdev); + + hid_hw_stop(hdev); +- flush_workqueue(wq); ++ cancel_delayed_work_sync(&priv->work); + kfree(priv); + } + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index c741f5e..0088979 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -61,6 +61,7 @@ MODULE_LICENSE("GPL"); + #define MT_QUIRK_ALWAYS_VALID (1 << 4) + #define MT_QUIRK_VALID_IS_INRANGE (1 << 5) + #define MT_QUIRK_VALID_IS_CONFIDENCE (1 << 6) ++#define MT_QUIRK_CONFIDENCE (1 << 7) + #define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE (1 << 8) + #define MT_QUIRK_NO_AREA (1 << 9) + #define MT_QUIRK_IGNORE_DUPLICATES (1 << 10) +@@ -78,6 +79,7 @@ struct mt_slot { + __s32 contactid; /* the device ContactID assigned to this slot */ + bool touch_state; /* is the touch valid? */ + bool inrange_state; /* is the finger in proximity of the sensor? */ ++ bool confidence_state; /* is the touch made by a finger? */ + }; + + struct mt_class { +@@ -503,10 +505,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + return 1; + case HID_DG_CONFIDENCE: + if (cls->name == MT_CLS_WIN_8 && +- field->application == HID_DG_TOUCHPAD) { +- cls->quirks &= ~MT_QUIRK_ALWAYS_VALID; +- cls->quirks |= MT_QUIRK_VALID_IS_CONFIDENCE; +- } ++ field->application == HID_DG_TOUCHPAD) ++ cls->quirks |= MT_QUIRK_CONFIDENCE; + mt_store_field(usage, td, hi); + return 1; + case HID_DG_TIPSWITCH: +@@ -619,6 +619,7 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input) + return; + + if (td->curvalid || (td->mtclass.quirks & MT_QUIRK_ALWAYS_VALID)) { ++ int active; + int slotnum = mt_compute_slot(td, input); + struct mt_slot *s = &td->curdata; + struct input_mt *mt = input->mt; +@@ -633,10 +634,14 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input) + return; + } + ++ if (!(td->mtclass.quirks & MT_QUIRK_CONFIDENCE)) ++ s->confidence_state = 1; ++ active = (s->touch_state || s->inrange_state) && ++ s->confidence_state; ++ + input_mt_slot(input, slotnum); +- input_mt_report_slot_state(input, MT_TOOL_FINGER, +- s->touch_state || s->inrange_state); +- if (s->touch_state || s->inrange_state) { ++ input_mt_report_slot_state(input, MT_TOOL_FINGER, active); ++ if (active) { + /* this finger is in proximity of the sensor */ + int wide = (s->w > s->h); + /* divided by two to match visual scale of touch */ +@@ -701,6 +706,8 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, + td->curdata.touch_state = value; + break; + case HID_DG_CONFIDENCE: ++ if (quirks & MT_QUIRK_CONFIDENCE) ++ td->curdata.confidence_state = value; + if (quirks & MT_QUIRK_VALID_IS_CONFIDENCE) + td->curvalid = value; + break; +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index 2f1ddca..700145b 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, + goto inval; + } else if (uref->usage_index >= field->report_count) + goto inval; +- +- else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && +- (uref_multi->num_values > HID_MAX_MULTI_USAGES || +- uref->usage_index + uref_multi->num_values > field->report_count)) +- goto inval; + } + ++ if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && ++ (uref_multi->num_values > HID_MAX_MULTI_USAGES || ++ uref->usage_index + uref_multi->num_values > field->report_count)) ++ goto inval; ++ + switch (cmd) { + case HIDIOCGUSAGE: + uref->value = field->value[uref->usage_index]; +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index c43318d..a9356a3 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -66,11 +66,13 @@ + + static DEFINE_MUTEX(i8k_mutex); + static char bios_version[4]; ++static char bios_machineid[16]; + static struct device *i8k_hwmon_dev; + static u32 i8k_hwmon_flags; + static uint i8k_fan_mult = I8K_FAN_MULT; + static uint i8k_pwm_mult; + static uint i8k_fan_max = I8K_FAN_HIGH; ++static bool disallow_fan_type_call; + + #define I8K_HWMON_HAVE_TEMP1 (1 << 0) + #define I8K_HWMON_HAVE_TEMP2 (1 << 1) +@@ -94,13 +96,13 @@ module_param(ignore_dmi, bool, 0); + MODULE_PARM_DESC(ignore_dmi, "Continue probing hardware even if DMI data does not match"); + + #if IS_ENABLED(CONFIG_I8K) +-static bool restricted; ++static bool restricted = true; + module_param(restricted, bool, 0); +-MODULE_PARM_DESC(restricted, "Allow fan control if SYS_ADMIN capability set"); ++MODULE_PARM_DESC(restricted, "Restrict fan control and serial number to CAP_SYS_ADMIN (default: 1)"); + + static bool power_status; + module_param(power_status, bool, 0600); +-MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k"); ++MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k (default: 0)"); + #endif + + static uint fan_mult; +@@ -235,14 +237,28 @@ static int i8k_get_fan_speed(int fan) + /* + * Read the fan type. + */ +-static int i8k_get_fan_type(int fan) ++static int _i8k_get_fan_type(int fan) + { + struct smm_regs regs = { .eax = I8K_SMM_GET_FAN_TYPE, }; + ++ if (disallow_fan_type_call) ++ return -EINVAL; ++ + regs.ebx = fan & 0xff; + return i8k_smm(®s) ? : regs.eax & 0xff; + } + ++static int i8k_get_fan_type(int fan) ++{ ++ /* I8K_SMM_GET_FAN_TYPE SMM call is expensive, so cache values */ ++ static int types[2] = { INT_MIN, INT_MIN }; ++ ++ if (types[fan] == INT_MIN) ++ types[fan] = _i8k_get_fan_type(fan); ++ ++ return types[fan]; ++} ++ + /* + * Read the fan nominal rpm for specific fan speed. + */ +@@ -392,9 +408,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg) + break; + + case I8K_MACHINE_ID: +- memset(buff, 0, 16); +- strlcpy(buff, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), +- sizeof(buff)); ++ if (restricted && !capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ memset(buff, 0, sizeof(buff)); ++ strlcpy(buff, bios_machineid, sizeof(buff)); + break; + + case I8K_FN_STATUS: +@@ -511,7 +529,7 @@ static int i8k_proc_show(struct seq_file *seq, void *offset) + seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n", + I8K_PROC_FMT, + bios_version, +- i8k_get_dmi_data(DMI_PRODUCT_SERIAL), ++ (restricted && !capable(CAP_SYS_ADMIN)) ? "-1" : bios_machineid, + cpu_temp, + left_fan, right_fan, left_speed, right_speed, + ac_power, fn_key); +@@ -718,6 +736,9 @@ static struct attribute *i8k_attrs[] = { + static umode_t i8k_is_visible(struct kobject *kobj, struct attribute *attr, + int index) + { ++ if (disallow_fan_type_call && ++ (index == 9 || index == 12)) ++ return 0; + if (index >= 0 && index <= 1 && + !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP1)) + return 0; +@@ -767,13 +788,17 @@ static int __init i8k_init_hwmon(void) + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP4; + +- /* First fan attributes, if fan type is OK */ +- err = i8k_get_fan_type(0); ++ /* First fan attributes, if fan status or type is OK */ ++ err = i8k_get_fan_status(0); ++ if (err < 0) ++ err = i8k_get_fan_type(0); + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN1; + +- /* Second fan attributes, if fan type is OK */ +- err = i8k_get_fan_type(1); ++ /* Second fan attributes, if fan status or type is OK */ ++ err = i8k_get_fan_status(1); ++ if (err < 0) ++ err = i8k_get_fan_type(1); + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN2; + +@@ -929,12 +954,14 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = { + + MODULE_DEVICE_TABLE(dmi, i8k_dmi_table); + +-static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = { ++/* ++ * On some machines once I8K_SMM_GET_FAN_TYPE is issued then CPU fan speed ++ * randomly going up and down due to bug in Dell SMM or BIOS. Here is blacklist ++ * of affected Dell machines for which we disallow I8K_SMM_GET_FAN_TYPE call. ++ * See bug: https://bugzilla.kernel.org/show_bug.cgi?id=100121 ++ */ ++static struct dmi_system_id i8k_blacklist_fan_type_dmi_table[] __initdata = { + { +- /* +- * CPU fan speed going up and down on Dell Studio XPS 8000 +- * for unknown reasons. +- */ + .ident = "Dell Studio XPS 8000", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +@@ -942,16 +969,19 @@ static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = { + }, + }, + { +- /* +- * CPU fan speed going up and down on Dell Studio XPS 8100 +- * for unknown reasons. +- */ + .ident = "Dell Studio XPS 8100", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"), + }, + }, ++ { ++ .ident = "Dell Inspiron 580", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Inspiron 580 "), ++ }, ++ }, + { } + }; + +@@ -966,8 +996,7 @@ static int __init i8k_probe(void) + /* + * Get DMI information + */ +- if (!dmi_check_system(i8k_dmi_table) || +- dmi_check_system(i8k_blacklist_dmi_table)) { ++ if (!dmi_check_system(i8k_dmi_table)) { + if (!ignore_dmi && !force) + return -ENODEV; + +@@ -978,8 +1007,13 @@ static int __init i8k_probe(void) + i8k_get_dmi_data(DMI_BIOS_VERSION)); + } + ++ if (dmi_check_system(i8k_blacklist_fan_type_dmi_table)) ++ disallow_fan_type_call = true; ++ + strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION), + sizeof(bios_version)); ++ strlcpy(bios_machineid, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), ++ sizeof(bios_machineid)); + + /* + * Get SMM Dell signature +diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c +index 923f565..3a9f106 100644 +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_dev *indio_dev, int micro) + + mutex_lock(&st->buf_lock); + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C); + st->tx[1] = (ret & ~KXSD9_FS_MASK) | i; +@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev, + break; + case IIO_CHAN_INFO_SCALE: + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK]; + ret = IIO_VAL_INT_PLUS_MICRO; +diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c +index 21e19b6..2123f0a 100644 +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -396,8 +396,8 @@ static int ad7266_probe(struct spi_device *spi) + + st = iio_priv(indio_dev); + +- st->reg = devm_regulator_get(&spi->dev, "vref"); +- if (!IS_ERR_OR_NULL(st->reg)) { ++ st->reg = devm_regulator_get_optional(&spi->dev, "vref"); ++ if (!IS_ERR(st->reg)) { + ret = regulator_enable(st->reg); + if (ret) + return ret; +@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_device *spi) + + st->vref_mv = ret / 1000; + } else { ++ /* Any other error indicates that the regulator does exist */ ++ if (PTR_ERR(st->reg) != -ENODEV) ++ return PTR_ERR(st->reg); + /* Use internal reference */ + st->vref_mv = 2500; + } +diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c +index fa47676..a03832a 100644 +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -55,7 +55,7 @@ static const struct { + }, + { /* IIO_HUMIDITYRELATIVE channel */ + .shift = 8, +- .mask = 2, ++ .mask = 3, + }, + }; + +@@ -164,14 +164,14 @@ static int hdc100x_get_measurement(struct hdc100x_data *data, + dev_err(&client->dev, "cannot read high byte measurement"); + return ret; + } +- val = ret << 6; ++ val = ret << 8; + + ret = i2c_smbus_read_byte(client); + if (ret < 0) { + dev_err(&client->dev, "cannot read low byte measurement"); + return ret; + } +- val |= ret >> 2; ++ val |= ret; + + return val; + } +@@ -211,18 +211,18 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev, + return IIO_VAL_INT_PLUS_MICRO; + case IIO_CHAN_INFO_SCALE: + if (chan->type == IIO_TEMP) { +- *val = 165; +- *val2 = 65536 >> 2; ++ *val = 165000; ++ *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 0; +- *val2 = 10000; +- return IIO_VAL_INT_PLUS_MICRO; ++ *val = 100; ++ *val2 = 65536; ++ return IIO_VAL_FRACTIONAL; + } + break; + case IIO_CHAN_INFO_OFFSET: +- *val = -3971; +- *val2 = 879096; ++ *val = -15887; ++ *val2 = 515151; + return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; +diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c +index ae2806a..0c52dfe 100644 +--- a/drivers/iio/industrialio-trigger.c ++++ b/drivers/iio/industrialio-trigger.c +@@ -210,22 +210,35 @@ static int iio_trigger_attach_poll_func(struct iio_trigger *trig, + + /* Prevent the module from being removed whilst attached to a trigger */ + __module_get(pf->indio_dev->info->driver_module); ++ ++ /* Get irq number */ + pf->irq = iio_trigger_get_irq(trig); ++ if (pf->irq < 0) ++ goto out_put_module; ++ ++ /* Request irq */ + ret = request_threaded_irq(pf->irq, pf->h, pf->thread, + pf->type, pf->name, + pf); +- if (ret < 0) { +- module_put(pf->indio_dev->info->driver_module); +- return ret; +- } ++ if (ret < 0) ++ goto out_put_irq; + ++ /* Enable trigger in driver */ + if (trig->ops && trig->ops->set_trigger_state && notinuse) { + ret = trig->ops->set_trigger_state(trig, true); + if (ret < 0) +- module_put(pf->indio_dev->info->driver_module); ++ goto out_free_irq; + } + + return ret; ++ ++out_free_irq: ++ free_irq(pf->irq, pf); ++out_put_irq: ++ iio_trigger_put_irq(trig, pf->irq); ++out_put_module: ++ module_put(pf->indio_dev->info->driver_module); ++ return ret; + } + + static int iio_trigger_detach_poll_func(struct iio_trigger *trig, +diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c +index a6af56a..6443aad 100644 +--- a/drivers/iio/light/apds9960.c ++++ b/drivers/iio/light/apds9960.c +@@ -1006,6 +1006,7 @@ static int apds9960_probe(struct i2c_client *client, + + iio_device_attach_buffer(indio_dev, buffer); + ++ indio_dev->dev.parent = &client->dev; + indio_dev->info = &apds9960_info; + indio_dev->name = APDS9960_DRV_NAME; + indio_dev->channels = apds9960_channels; +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index 172393a..d3ca320 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -28,15 +28,21 @@ + #include <linux/iio/common/st_sensors.h> + #include "st_pressure.h" + ++#define MCELSIUS_PER_CELSIUS 1000 ++ ++/* Default pressure sensitivity */ + #define ST_PRESS_LSB_PER_MBAR 4096UL + #define ST_PRESS_KPASCAL_NANO_SCALE (100000000UL / \ + ST_PRESS_LSB_PER_MBAR) ++ ++/* Default temperature sensitivity */ + #define ST_PRESS_LSB_PER_CELSIUS 480UL +-#define ST_PRESS_CELSIUS_NANO_SCALE (1000000000UL / \ +- ST_PRESS_LSB_PER_CELSIUS) ++#define ST_PRESS_MILLI_CELSIUS_OFFSET 42500UL ++ + #define ST_PRESS_NUMBER_DATA_CHANNELS 1 + + /* FULLSCALE */ ++#define ST_PRESS_FS_AVL_1100MB 1100 + #define ST_PRESS_FS_AVL_1260MB 1260 + + #define ST_PRESS_1_OUT_XL_ADDR 0x28 +@@ -54,9 +60,6 @@ + #define ST_PRESS_LPS331AP_PW_MASK 0x80 + #define ST_PRESS_LPS331AP_FS_ADDR 0x23 + #define ST_PRESS_LPS331AP_FS_MASK 0x30 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS331AP_BDU_ADDR 0x20 + #define ST_PRESS_LPS331AP_BDU_MASK 0x04 + #define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR 0x22 +@@ -65,9 +68,14 @@ + #define ST_PRESS_LPS331AP_IHL_IRQ_ADDR 0x22 + #define ST_PRESS_LPS331AP_IHL_IRQ_MASK 0x80 + #define ST_PRESS_LPS331AP_MULTIREAD_BIT true +-#define ST_PRESS_LPS331AP_TEMP_OFFSET 42500 + + /* CUSTOM VALUES FOR LPS001WP SENSOR */ ++ ++/* LPS001WP pressure resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_MBAR 16UL ++/* LPS001WP temperature resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS 64UL ++ + #define ST_PRESS_LPS001WP_WAI_EXP 0xba + #define ST_PRESS_LPS001WP_ODR_ADDR 0x20 + #define ST_PRESS_LPS001WP_ODR_MASK 0x30 +@@ -76,6 +84,8 @@ + #define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL 0x03 + #define ST_PRESS_LPS001WP_PW_ADDR 0x20 + #define ST_PRESS_LPS001WP_PW_MASK 0x40 ++#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \ ++ (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR) + #define ST_PRESS_LPS001WP_BDU_ADDR 0x20 + #define ST_PRESS_LPS001WP_BDU_MASK 0x04 + #define ST_PRESS_LPS001WP_MULTIREAD_BIT true +@@ -92,11 +102,6 @@ + #define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL 0x04 + #define ST_PRESS_LPS25H_PW_ADDR 0x20 + #define ST_PRESS_LPS25H_PW_MASK 0x80 +-#define ST_PRESS_LPS25H_FS_ADDR 0x00 +-#define ST_PRESS_LPS25H_FS_MASK 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS25H_BDU_ADDR 0x20 + #define ST_PRESS_LPS25H_BDU_MASK 0x04 + #define ST_PRESS_LPS25H_DRDY_IRQ_ADDR 0x23 +@@ -105,7 +110,6 @@ + #define ST_PRESS_LPS25H_IHL_IRQ_ADDR 0x22 + #define ST_PRESS_LPS25H_IHL_IRQ_MASK 0x80 + #define ST_PRESS_LPS25H_MULTIREAD_BIT true +-#define ST_PRESS_LPS25H_TEMP_OFFSET 42500 + #define ST_PRESS_LPS25H_OUT_XL_ADDR 0x28 + #define ST_TEMP_LPS25H_OUT_L_ADDR 0x2b + +@@ -157,7 +161,9 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { + .storagebits = 16, + .endianness = IIO_LE, + }, +- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), ++ .info_mask_separate = ++ BIT(IIO_CHAN_INFO_RAW) | ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + { +@@ -173,7 +179,7 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { + }, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_OFFSET), ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + IIO_CHAN_SOFT_TIMESTAMP(1) +@@ -208,11 +214,14 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .addr = ST_PRESS_LPS331AP_FS_ADDR, + .mask = ST_PRESS_LPS331AP_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS331AP datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -254,7 +263,17 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = 0, ++ .fs_avl = { ++ /* ++ * Pressure and temperature resolution values ++ * as defined in table 3 of LPS001WP datasheet. ++ */ ++ [0] = { ++ .num = ST_PRESS_FS_AVL_1100MB, ++ .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN, ++ .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS, ++ }, ++ }, + }, + .bdu = { + .addr = ST_PRESS_LPS001WP_BDU_ADDR, +@@ -291,14 +310,15 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = ST_PRESS_LPS25H_FS_ADDR, +- .mask = ST_PRESS_LPS25H_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS25H datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -354,26 +374,26 @@ static int st_press_read_raw(struct iio_dev *indio_dev, + + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: +- *val = 0; +- + switch (ch->type) { + case IIO_PRESSURE: ++ *val = 0; + *val2 = press_data->current_fullscale->gain; +- break; ++ return IIO_VAL_INT_PLUS_NANO; + case IIO_TEMP: ++ *val = MCELSIUS_PER_CELSIUS; + *val2 = press_data->current_fullscale->gain2; +- break; ++ return IIO_VAL_FRACTIONAL; + default: + err = -EINVAL; + goto read_error; + } + +- return IIO_VAL_INT_PLUS_NANO; + case IIO_CHAN_INFO_OFFSET: + switch (ch->type) { + case IIO_TEMP: +- *val = 425; +- *val2 = 10; ++ *val = ST_PRESS_MILLI_CELSIUS_OFFSET * ++ press_data->current_fullscale->gain2; ++ *val2 = MCELSIUS_PER_CELSIUS; + break; + default: + err = -EINVAL; +diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c +index f4d29d5..e2f926c 100644 +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -64,6 +64,7 @@ struct as3935_state { + struct delayed_work work; + + u32 tune_cap; ++ u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */ + u8 buf[2] ____cacheline_aligned; + }; + +@@ -72,7 +73,8 @@ static const struct iio_chan_spec as3935_channels[] = { + .type = IIO_PROXIMITY, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_PROCESSED), ++ BIT(IIO_CHAN_INFO_PROCESSED) | ++ BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { + .sign = 'u', +@@ -181,7 +183,12 @@ static int as3935_read_raw(struct iio_dev *indio_dev, + /* storm out of range */ + if (*val == AS3935_DATA_MASK) + return -EINVAL; +- *val *= 1000; ++ ++ if (m == IIO_CHAN_INFO_PROCESSED) ++ *val *= 1000; ++ break; ++ case IIO_CHAN_INFO_SCALE: ++ *val = 1000; + break; + default: + return -EINVAL; +@@ -206,10 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private) + ret = as3935_read(st, AS3935_DATA, &val); + if (ret) + goto err_read; +- val &= AS3935_DATA_MASK; +- val *= 1000; + +- iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp); ++ st->buffer[0] = val & AS3935_DATA_MASK; ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer, ++ pf->timestamp); + err_read: + iio_trigger_notify_done(indio_dev->trig); + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 1d92e09..c995255 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3452,14 +3452,14 @@ static int cm_establish(struct ib_cm_id *cm_id) + work->cm_event.event = IB_CM_USER_ESTABLISHED; + + /* Check if the device started its remove_one */ +- spin_lock_irq(&cm.lock); ++ spin_lock_irqsave(&cm.lock, flags); + if (!cm_dev->going_down) { + queue_delayed_work(cm.wq, &work->work, 0); + } else { + kfree(work); + ret = -ENODEV; + } +- spin_unlock_irq(&cm.lock); ++ spin_unlock_irqrestore(&cm.lock, flags); + + out: + return ret; +diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c +index 105246f..5fc6233 100644 +--- a/drivers/infiniband/hw/mlx4/ah.c ++++ b/drivers/infiniband/hw/mlx4/ah.c +@@ -47,6 +47,7 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr, + + ah->av.ib.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24)); + ah->av.ib.g_slid = ah_attr->src_path_bits; ++ ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28); + if (ah_attr->ah_flags & IB_AH_GRH) { + ah->av.ib.g_slid |= 0x80; + ah->av.ib.gid_index = ah_attr->grh.sgid_index; +@@ -64,7 +65,6 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr, + !(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support)) + --ah->av.ib.stat_rate; + } +- ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28); + + return &ah->ibah; + } +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index a9e3bcc..a0ecf08 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -683,8 +683,10 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd, + * initialization that is needed. + */ + priv = rdi->driver_f.qp_priv_alloc(rdi, qp, gfp); +- if (!priv) ++ if (IS_ERR(priv)) { ++ ret = priv; + goto bail_qp; ++ } + qp->priv = priv; + qp->timeout_jiffies = + usecs_to_jiffies((4096UL * (1UL << qp->timeout)) / +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index bf4959f..94f1bf7 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -1363,13 +1363,23 @@ static int __init amd_iommu_init_pci(void) + break; + } + ++ /* ++ * Order is important here to make sure any unity map requirements are ++ * fulfilled. The unity mappings are created and written to the device ++ * table during the amd_iommu_init_api() call. ++ * ++ * After that we call init_device_table_dma() to make sure any ++ * uninitialized DTE will block DMA, and in the end we flush the caches ++ * of all IOMMUs to make sure the changes to the device table are ++ * active. ++ */ ++ ret = amd_iommu_init_api(); ++ + init_device_table_dma(); + + for_each_iommu(iommu) + iommu_flush_all_caches(iommu); + +- ret = amd_iommu_init_api(); +- + if (!ret) + print_iommu_info(); + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 4ff73ff..3e20208 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1942,6 +1942,7 @@ static struct iommu_ops arm_smmu_ops = { + .attach_dev = arm_smmu_attach_dev, + .map = arm_smmu_map, + .unmap = arm_smmu_unmap, ++ .map_sg = default_iommu_map_sg, + .iova_to_phys = arm_smmu_iova_to_phys, + .add_device = arm_smmu_add_device, + .remove_device = arm_smmu_remove_device, +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index e1852e8..ae364e0 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3169,11 +3169,6 @@ static int __init init_dmars(void) + } + } + +- iommu_flush_write_buffer(iommu); +- iommu_set_root_entry(iommu); +- iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL); +- iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); +- + if (!ecap_pass_through(iommu->ecap)) + hw_pass_through = 0; + #ifdef CONFIG_INTEL_IOMMU_SVM +@@ -3182,6 +3177,18 @@ static int __init init_dmars(void) + #endif + } + ++ /* ++ * Now that qi is enabled on all iommus, set the root entry and flush ++ * caches. This is required on some Intel X58 chipsets, otherwise the ++ * flush_context function will loop forever and the boot hangs. ++ */ ++ for_each_active_iommu(iommu, drhd) { ++ iommu_flush_write_buffer(iommu); ++ iommu_set_root_entry(iommu); ++ iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL); ++ iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH); ++ } ++ + if (iommu_pass_through) + iommu_identity_mapping |= IDENTMAP_ALL; + +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index 5710a06..0ea8d9a 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -815,7 +815,7 @@ static int rk_iommu_attach_device(struct iommu_domain *domain, + dte_addr = virt_to_phys(rk_domain->dt); + for (i = 0; i < iommu->num_mmu; i++) { + rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, dte_addr); +- rk_iommu_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE); ++ rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE); + rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK); + } + +diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c +index 4dffccf..40fb120 100644 +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -734,6 +734,12 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq, + /* verify that it doesn't conflict with an IPI irq */ + if (test_bit(spec->hwirq, ipi_resrv)) + return -EBUSY; ++ ++ hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq); ++ ++ return irq_domain_set_hwirq_and_chip(d, virq, hwirq, ++ &gic_level_irq_controller, ++ NULL); + } else { + base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs); + if (base_hwirq == gic_shared_intrs) { +@@ -855,10 +861,14 @@ static int gic_dev_domain_alloc(struct irq_domain *d, unsigned int virq, + &gic_level_irq_controller, + NULL); + if (ret) +- return ret; ++ goto error; + } + + return 0; ++ ++error: ++ irq_domain_free_irqs_parent(d, virq, nr_irqs); ++ return ret; + } + + void gic_dev_domain_free(struct irq_domain *d, unsigned int virq, +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index d7723ce..12690c1 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1408,47 +1408,44 @@ static int uvc_v4l2_put_xu_query(const struct uvc_xu_control_query *kp, + static long uvc_v4l2_compat_ioctl32(struct file *file, + unsigned int cmd, unsigned long arg) + { ++ struct uvc_fh *handle = file->private_data; + union { + struct uvc_xu_control_mapping xmap; + struct uvc_xu_control_query xqry; + } karg; + void __user *up = compat_ptr(arg); +- mm_segment_t old_fs; + long ret; + + switch (cmd) { + case UVCIOC_CTRL_MAP32: +- cmd = UVCIOC_CTRL_MAP; + ret = uvc_v4l2_get_xu_mapping(&karg.xmap, up); ++ if (ret) ++ return ret; ++ ret = uvc_ioctl_ctrl_map(handle->chain, &karg.xmap); ++ if (ret) ++ return ret; ++ ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up); ++ if (ret) ++ return ret; ++ + break; + + case UVCIOC_CTRL_QUERY32: +- cmd = UVCIOC_CTRL_QUERY; + ret = uvc_v4l2_get_xu_query(&karg.xqry, up); ++ if (ret) ++ return ret; ++ ret = uvc_xu_ctrl_query(handle->chain, &karg.xqry); ++ if (ret) ++ return ret; ++ ret = uvc_v4l2_put_xu_query(&karg.xqry, up); ++ if (ret) ++ return ret; + break; + + default: + return -ENOIOCTLCMD; + } + +- old_fs = get_fs(); +- set_fs(KERNEL_DS); +- ret = video_ioctl2(file, cmd, (unsigned long)&karg); +- set_fs(old_fs); +- +- if (ret < 0) +- return ret; +- +- switch (cmd) { +- case UVCIOC_CTRL_MAP: +- ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up); +- break; +- +- case UVCIOC_CTRL_QUERY: +- ret = uvc_v4l2_put_xu_query(&karg.xqry, up); +- break; +- } +- + return ret; + } + #endif +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index 21825dd..859b4a1 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -394,7 +394,7 @@ static void gpmc_cs_bool_timings(int cs, const struct gpmc_bool_timings *p) + gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4, + GPMC_CONFIG4_OEEXTRADELAY, p->oe_extra_delay); + gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4, +- GPMC_CONFIG4_OEEXTRADELAY, p->we_extra_delay); ++ GPMC_CONFIG4_WEEXTRADELAY, p->we_extra_delay); + gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG6, + GPMC_CONFIG6_CYCLE2CYCLESAMECSEN, + p->cycle2cyclesamecsen); +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 96fddb0..4dd0391 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -575,6 +575,7 @@ static int recover_peb(struct ubi_device *ubi, int pnum, int vol_id, int lnum, + int err, idx = vol_id2idx(ubi, vol_id), new_pnum, data_size, tries = 0; + struct ubi_volume *vol = ubi->volumes[idx]; + struct ubi_vid_hdr *vid_hdr; ++ uint32_t crc; + + vid_hdr = ubi_zalloc_vid_hdr(ubi, GFP_NOFS); + if (!vid_hdr) +@@ -599,14 +600,8 @@ retry: + goto out_put; + } + +- vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi)); +- err = ubi_io_write_vid_hdr(ubi, new_pnum, vid_hdr); +- if (err) { +- up_read(&ubi->fm_eba_sem); +- goto write_error; +- } ++ ubi_assert(vid_hdr->vol_type == UBI_VID_DYNAMIC); + +- data_size = offset + len; + mutex_lock(&ubi->buf_mutex); + memset(ubi->peb_buf + offset, 0xFF, len); + +@@ -621,6 +616,19 @@ retry: + + memcpy(ubi->peb_buf + offset, buf, len); + ++ data_size = offset + len; ++ crc = crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size); ++ vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi)); ++ vid_hdr->copy_flag = 1; ++ vid_hdr->data_size = cpu_to_be32(data_size); ++ vid_hdr->data_crc = cpu_to_be32(crc); ++ err = ubi_io_write_vid_hdr(ubi, new_pnum, vid_hdr); ++ if (err) { ++ mutex_unlock(&ubi->buf_mutex); ++ up_read(&ubi->fm_eba_sem); ++ goto write_error; ++ } ++ + err = ubi_io_write_data(ubi, ubi->peb_buf, new_pnum, 0, data_size); + if (err) { + mutex_unlock(&ubi->buf_mutex); +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 9fcb489..c70e515 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -1092,12 +1092,17 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev) + + static int __geneve_change_mtu(struct net_device *dev, int new_mtu, bool strict) + { ++ struct geneve_dev *geneve = netdev_priv(dev); + /* The max_mtu calculation does not take account of GENEVE + * options, to avoid excluding potentially valid + * configurations. + */ +- int max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - sizeof(struct iphdr) +- - dev->hard_header_len; ++ int max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - dev->hard_header_len; ++ ++ if (geneve->remote.sa.sa_family == AF_INET6) ++ max_mtu -= sizeof(struct ipv6hdr); ++ else ++ max_mtu -= sizeof(struct iphdr); + + if (new_mtu < 68) + return -EINVAL; +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 9e803bb..8f3c55d 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -2564,6 +2564,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.OutPktsUntagged++; + u64_stats_update_end(&secy_stats->syncp); ++ skb->dev = macsec->real_dev; + len = skb->len; + ret = dev_queue_xmit(skb); + count_tx(dev, ret, len); +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 2fb31ed..d4425c56 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -852,6 +852,13 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + if (cdc_ncm_init(dev)) + goto error2; + ++ /* Some firmwares need a pause here or they will silently fail ++ * to set up the interface properly. This value was decided ++ * empirically on a Sierra Wireless MC7455 running 02.08.02.00 ++ * firmware. ++ */ ++ usleep_range(10000, 20000); ++ + /* configure data interface */ + temp = usb_set_interface(dev->udev, iface_no, data_altsetting); + if (temp) { +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index e85e073..06664ba 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2771,6 +2771,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2, + if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] || + !info->attrs[HWSIM_ATTR_FLAGS] || + !info->attrs[HWSIM_ATTR_COOKIE] || ++ !info->attrs[HWSIM_ATTR_SIGNAL] || + !info->attrs[HWSIM_ATTR_TX_INFO]) + goto out; + +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index 0f48048..3a0faa8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -54,7 +54,7 @@ EXPORT_SYMBOL(channel5g_80m); + void rtl_addr_delay(u32 addr) + { + if (addr == 0xfe) +- msleep(50); ++ mdelay(50); + else if (addr == 0xfd) + msleep(5); + else if (addr == 0xfc) +@@ -75,7 +75,7 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr, + rtl_addr_delay(addr); + } else { + rtl_set_rfreg(hw, rfpath, addr, mask, data); +- usleep_range(1, 2); ++ udelay(1); + } + } + EXPORT_SYMBOL(rtl_rfreg_delay); +@@ -86,7 +86,7 @@ void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data) + rtl_addr_delay(addr); + } else { + rtl_set_bbreg(hw, addr, MASKDWORD, data); +- usleep_range(1, 2); ++ udelay(1); + } + } + EXPORT_SYMBOL(rtl_bb_delay); +diff --git a/drivers/of/irq.c b/drivers/of/irq.c +index e7bfc17..6ec743f 100644 +--- a/drivers/of/irq.c ++++ b/drivers/of/irq.c +@@ -386,13 +386,13 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r) + EXPORT_SYMBOL_GPL(of_irq_to_resource); + + /** +- * of_irq_get - Decode a node's IRQ and return it as a Linux irq number ++ * of_irq_get - Decode a node's IRQ and return it as a Linux IRQ number + * @dev: pointer to device tree node +- * @index: zero-based index of the irq +- * +- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain +- * is not yet created. ++ * @index: zero-based index of the IRQ + * ++ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or ++ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case ++ * of any other failure. + */ + int of_irq_get(struct device_node *dev, int index) + { +@@ -413,12 +413,13 @@ int of_irq_get(struct device_node *dev, int index) + EXPORT_SYMBOL_GPL(of_irq_get); + + /** +- * of_irq_get_byname - Decode a node's IRQ and return it as a Linux irq number ++ * of_irq_get_byname - Decode a node's IRQ and return it as a Linux IRQ number + * @dev: pointer to device tree node +- * @name: irq name ++ * @name: IRQ name + * +- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain +- * is not yet created, or error code in case of any other failure. ++ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or ++ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case ++ * of any other failure. + */ + int of_irq_get_byname(struct device_node *dev, const char *name) + { +diff --git a/drivers/pci/vc.c b/drivers/pci/vc.c +index dfbab61..1fa3a32 100644 +--- a/drivers/pci/vc.c ++++ b/drivers/pci/vc.c +@@ -221,9 +221,9 @@ static int pci_vc_do_save_buffer(struct pci_dev *dev, int pos, + else + pci_write_config_word(dev, pos + PCI_VC_PORT_CTRL, + *(u16 *)buf); +- buf += 2; ++ buf += 4; + } +- len += 2; ++ len += 4; + + /* + * If we have any Low Priority VCs and a VC Arbitration Table Offset +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index 56a17ec..6c7fe477 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -140,6 +140,18 @@ static const struct regulator_ops rpm_smps_ldo_ops = { + .enable = rpm_reg_enable, + .disable = rpm_reg_disable, + .is_enabled = rpm_reg_is_enabled, ++ .list_voltage = regulator_list_voltage_linear_range, ++ ++ .get_voltage = rpm_reg_get_voltage, ++ .set_voltage = rpm_reg_set_voltage, ++ ++ .set_load = rpm_reg_set_load, ++}; ++ ++static const struct regulator_ops rpm_smps_ldo_ops_fixed = { ++ .enable = rpm_reg_enable, ++ .disable = rpm_reg_disable, ++ .is_enabled = rpm_reg_is_enabled, + + .get_voltage = rpm_reg_get_voltage, + .set_voltage = rpm_reg_set_voltage, +@@ -247,7 +259,7 @@ static const struct regulator_desc pm8941_nldo = { + static const struct regulator_desc pm8941_lnldo = { + .fixed_uV = 1740000, + .n_voltages = 1, +- .ops = &rpm_smps_ldo_ops, ++ .ops = &rpm_smps_ldo_ops_fixed, + }; + + static const struct regulator_desc pm8941_switch = { +diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c +index d4c2856..3ddc85e 100644 +--- a/drivers/scsi/53c700.c ++++ b/drivers/scsi/53c700.c +@@ -1122,7 +1122,7 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp, + } else { + struct scsi_cmnd *SCp; + +- SCp = scsi_host_find_tag(SDp->host, SCSI_NO_TAG); ++ SCp = SDp->current_cmnd; + if(unlikely(SCp == NULL)) { + sdev_printk(KERN_ERR, SDp, + "no saved request for untagged cmd\n"); +@@ -1826,7 +1826,7 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *) + slot->tag, slot); + } else { + slot->tag = SCSI_NO_TAG; +- /* must populate current_cmnd for scsi_host_find_tag to work */ ++ /* save current command for reselection */ + SCp->device->current_cmnd = SCp; + } + /* sanity check: some of the commands generated by the mid-layer +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index 984ddcb..1b9c049 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -1127,7 +1127,6 @@ static int scsi_eh_action(struct scsi_cmnd *scmd, int rtn) + */ + void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q) + { +- scmd->device->host->host_failed--; + scmd->eh_eflags = 0; + list_move_tail(&scmd->eh_entry, done_q); + } +@@ -2226,6 +2225,9 @@ int scsi_error_handler(void *data) + else + scsi_unjam_host(shost); + ++ /* All scmds have been handled */ ++ shost->host_failed = 0; ++ + /* + * Note - if the above fails completely, the action is to take + * individual devices offline and flush the queue of any +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index f52b74c..41c3a2c 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2862,10 +2862,10 @@ static int sd_revalidate_disk(struct gendisk *disk) + if (sdkp->opt_xfer_blocks && + sdkp->opt_xfer_blocks <= dev_max && + sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS && +- sdkp->opt_xfer_blocks * sdp->sector_size >= PAGE_SIZE) +- rw_max = q->limits.io_opt = +- sdkp->opt_xfer_blocks * sdp->sector_size; +- else ++ logical_to_bytes(sdp, sdkp->opt_xfer_blocks) >= PAGE_SIZE) { ++ q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks); ++ rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks); ++ } else + rw_max = BLK_DEF_MAX_SECTORS; + + /* Combine with controller limits */ +diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h +index 654630b..765a6f1 100644 +--- a/drivers/scsi/sd.h ++++ b/drivers/scsi/sd.h +@@ -151,6 +151,11 @@ static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blo + return blocks << (ilog2(sdev->sector_size) - 9); + } + ++static inline unsigned int logical_to_bytes(struct scsi_device *sdev, sector_t blocks) ++{ ++ return blocks * sdev->sector_size; ++} ++ + /* + * A DIF-capable target device can be formatted with different + * protection schemes. Currently 0 through 3 are defined: +diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c +index a8f533a..ec12181 100644 +--- a/drivers/staging/iio/accel/sca3000_core.c ++++ b/drivers/staging/iio/accel/sca3000_core.c +@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(struct device *dev, + goto error_ret_mut; + ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL); + mutex_unlock(&st->lock); +- if (ret) ++ if (ret < 0) + goto error_ret; + val = ret; + if (base_freq > 0) +diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c +index 6ceac4f..5b4b47e 100644 +--- a/drivers/thermal/cpu_cooling.c ++++ b/drivers/thermal/cpu_cooling.c +@@ -857,14 +857,6 @@ __cpufreq_cooling_register(struct device_node *np, + goto free_power_table; + } + +- snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d", +- cpufreq_dev->id); +- +- cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev, +- &cpufreq_cooling_ops); +- if (IS_ERR(cool_dev)) +- goto remove_idr; +- + /* Fill freq-table in descending order of frequencies */ + for (i = 0, freq = -1; i <= cpufreq_dev->max_level; i++) { + freq = find_next_max(table, freq); +@@ -877,6 +869,14 @@ __cpufreq_cooling_register(struct device_node *np, + pr_debug("%s: freq:%u KHz\n", __func__, freq); + } + ++ snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d", ++ cpufreq_dev->id); ++ ++ cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev, ++ &cpufreq_cooling_ops); ++ if (IS_ERR(cool_dev)) ++ goto remove_idr; ++ + cpufreq_dev->clipped_freq = cpufreq_dev->freq_table[0]; + cpufreq_dev->cool_dev = cool_dev; + +diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c +index f973bfc..1e93a37 100644 +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc, uint c) + + static void do_compute_shiftstate(void) + { +- unsigned int i, j, k, sym, val; ++ unsigned int k, sym, val; + + shift_state = 0; + memset(shift_down, 0, sizeof(shift_down)); + +- for (i = 0; i < ARRAY_SIZE(key_down); i++) { +- +- if (!key_down[i]) ++ for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) { ++ sym = U(key_maps[0][k]); ++ if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK) + continue; + +- k = i * BITS_PER_LONG; +- +- for (j = 0; j < BITS_PER_LONG; j++, k++) { +- +- if (!test_bit(k, key_down)) +- continue; ++ val = KVAL(sym); ++ if (val == KVAL(K_CAPSSHIFT)) ++ val = KVAL(K_SHIFT); + +- sym = U(key_maps[0][k]); +- if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK) +- continue; +- +- val = KVAL(sym); +- if (val == KVAL(K_CAPSSHIFT)) +- val = KVAL(K_SHIFT); +- +- shift_down[val]++; +- shift_state |= (1 << val); +- } ++ shift_down[val]++; ++ shift_state |= BIT(val); + } + } + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index bd523ad..e9e29de 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -750,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init) + vc->vc_complement_mask = 0; + vc->vc_can_do_color = 0; + vc->vc_panic_force_write = false; ++ vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS; + vc->vc_sw->con_init(vc, init); + if (!vc->vc_complement_mask) + vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800; +diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c +index 504708f..6c6040c 100644 +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -21,6 +21,7 @@ + * 675 Mass Ave, Cambridge, MA 02139, USA. + */ + ++#include <linux/module.h> + #include <linux/kernel.h> + #include <linux/types.h> + #include <linux/mutex.h> +@@ -452,3 +453,4 @@ int otg_statemachine(struct otg_fsm *fsm) + return state_changed; + } + EXPORT_SYMBOL_GPL(otg_statemachine); ++MODULE_LICENSE("GPL"); +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 980fc57..2d107d0 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2597,26 +2597,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd); + * Don't deallocate the bandwidth_mutex until the last shared usb_hcd is + * deallocated. + * +- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is +- * freed. When hcd_release() is called for either hcd in a peer set +- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to +- * block new peering attempts ++ * Make sure to deallocate the bandwidth_mutex only when the last HCD is ++ * freed. When hcd_release() is called for either hcd in a peer set, ++ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers. + */ + static void hcd_release(struct kref *kref) + { + struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref); + + mutex_lock(&usb_port_peer_mutex); +- if (usb_hcd_is_primary_hcd(hcd)) { +- kfree(hcd->address0_mutex); +- kfree(hcd->bandwidth_mutex); +- } + if (hcd->shared_hcd) { + struct usb_hcd *peer = hcd->shared_hcd; + + peer->shared_hcd = NULL; +- if (peer->primary_hcd == hcd) +- peer->primary_hcd = NULL; ++ peer->primary_hcd = NULL; ++ } else { ++ kfree(hcd->address0_mutex); ++ kfree(hcd->bandwidth_mutex); + } + mutex_unlock(&usb_port_peer_mutex); + kfree(hcd); +diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h +index 3c58d63..dec0b21 100644 +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -64,6 +64,17 @@ + DWC2_TRACE_SCHEDULER_VB(pr_fmt("%s: SCH: " fmt), \ + dev_name(hsotg->dev), ##__VA_ARGS__) + ++#ifdef CONFIG_MIPS ++/* ++ * There are some MIPS machines that can run in either big-endian ++ * or little-endian mode and that use the dwc2 register without ++ * a byteswap in both ways. ++ * Unlike other architectures, MIPS apparently does not require a ++ * barrier before the __raw_writel() to synchronize with DMA but does ++ * require the barrier after the __raw_writel() to serialize a set of ++ * writes. This set of operations was added specifically for MIPS and ++ * should only be used there. ++ */ + static inline u32 dwc2_readl(const void __iomem *addr) + { + u32 value = __raw_readl(addr); +@@ -90,6 +101,22 @@ static inline void dwc2_writel(u32 value, void __iomem *addr) + pr_info("INFO:: wrote %08x to %p\n", value, addr); + #endif + } ++#else ++/* Normal architectures just use readl/write */ ++static inline u32 dwc2_readl(const void __iomem *addr) ++{ ++ return readl(addr); ++} ++ ++static inline void dwc2_writel(u32 value, void __iomem *addr) ++{ ++ writel(value, addr); ++ ++#ifdef DWC2_LOG_WRITES ++ pr_info("info:: wrote %08x to %p\n", value, addr); ++#endif ++} ++#endif + + /* Maximum number of Endpoints/HostChannels */ + #define MAX_EPS_CHANNELS 16 +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index 7b6d74f..476c0e3 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -75,7 +75,7 @@ struct virtio_balloon { + + /* The array of pfns we tell the Host about. */ + unsigned int num_pfns; +- u32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX]; ++ __virtio32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX]; + + /* Memory statistics */ + struct virtio_balloon_stat stats[VIRTIO_BALLOON_S_NR]; +@@ -127,14 +127,16 @@ static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq) + + } + +-static void set_page_pfns(u32 pfns[], struct page *page) ++static void set_page_pfns(struct virtio_balloon *vb, ++ __virtio32 pfns[], struct page *page) + { + unsigned int i; + + /* Set balloon pfns pointing at this page. + * Note that the first pfn points at start of the page. */ + for (i = 0; i < VIRTIO_BALLOON_PAGES_PER_PAGE; i++) +- pfns[i] = page_to_balloon_pfn(page) + i; ++ pfns[i] = cpu_to_virtio32(vb->vdev, ++ page_to_balloon_pfn(page) + i); + } + + static unsigned fill_balloon(struct virtio_balloon *vb, size_t num) +@@ -158,7 +160,7 @@ static unsigned fill_balloon(struct virtio_balloon *vb, size_t num) + msleep(200); + break; + } +- set_page_pfns(vb->pfns + vb->num_pfns, page); ++ set_page_pfns(vb, vb->pfns + vb->num_pfns, page); + vb->num_pages += VIRTIO_BALLOON_PAGES_PER_PAGE; + if (!virtio_has_feature(vb->vdev, + VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) +@@ -177,10 +179,12 @@ static unsigned fill_balloon(struct virtio_balloon *vb, size_t num) + static void release_pages_balloon(struct virtio_balloon *vb) + { + unsigned int i; ++ struct page *page; + + /* Find pfns pointing at start of each page, get pages and free them. */ + for (i = 0; i < vb->num_pfns; i += VIRTIO_BALLOON_PAGES_PER_PAGE) { +- struct page *page = balloon_pfn_to_page(vb->pfns[i]); ++ page = balloon_pfn_to_page(virtio32_to_cpu(vb->vdev, ++ vb->pfns[i])); + if (!virtio_has_feature(vb->vdev, + VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) + adjust_managed_page_count(page, 1); +@@ -203,7 +207,7 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num) + page = balloon_page_dequeue(vb_dev_info); + if (!page) + break; +- set_page_pfns(vb->pfns + vb->num_pfns, page); ++ set_page_pfns(vb, vb->pfns + vb->num_pfns, page); + vb->num_pages -= VIRTIO_BALLOON_PAGES_PER_PAGE; + } + +@@ -471,13 +475,13 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + __count_vm_event(BALLOON_MIGRATE); + spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); + vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; +- set_page_pfns(vb->pfns, newpage); ++ set_page_pfns(vb, vb->pfns, newpage); + tell_host(vb, vb->inflate_vq); + + /* balloon's page migration 2nd step -- deflate "page" */ + balloon_page_delete(page); + vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; +- set_page_pfns(vb->pfns, page); ++ set_page_pfns(vb, vb->pfns, page); + tell_host(vb, vb->deflate_vq); + + mutex_unlock(&vb->balloon_lock); +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index d46839f..e4db19e 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -151,8 +151,6 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq); + static void balloon_process(struct work_struct *work); + static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); + +-static void release_memory_resource(struct resource *resource); +- + /* When ballooning out (allocating memory to return to Xen) we don't really + want the kernel to try too hard since that can trigger the oom killer. */ + #define GFP_BALLOON \ +@@ -248,6 +246,19 @@ static enum bp_state update_schedule(enum bp_state state) + } + + #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++static void release_memory_resource(struct resource *resource) ++{ ++ if (!resource) ++ return; ++ ++ /* ++ * No need to reset region to identity mapped since we now ++ * know that no I/O can be in this region ++ */ ++ release_resource(resource); ++ kfree(resource); ++} ++ + static struct resource *additional_memory_resource(phys_addr_t size) + { + struct resource *res; +@@ -286,19 +297,6 @@ static struct resource *additional_memory_resource(phys_addr_t size) + return res; + } + +-static void release_memory_resource(struct resource *resource) +-{ +- if (!resource) +- return; +- +- /* +- * No need to reset region to identity mapped since we now +- * know that no I/O can be in this region +- */ +- release_resource(resource); +- kfree(resource); +-} +- + static enum bp_state reserve_additional_memory(void) + { + long credit; +diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c +index 076970a..4ce10bc 100644 +--- a/drivers/xen/xen-acpi-processor.c ++++ b/drivers/xen/xen-acpi-processor.c +@@ -423,36 +423,7 @@ upload: + + return 0; + } +-static int __init check_prereq(void) +-{ +- struct cpuinfo_x86 *c = &cpu_data(0); +- +- if (!xen_initial_domain()) +- return -ENODEV; +- +- if (!acpi_gbl_FADT.smi_command) +- return -ENODEV; +- +- if (c->x86_vendor == X86_VENDOR_INTEL) { +- if (!cpu_has(c, X86_FEATURE_EST)) +- return -ENODEV; + +- return 0; +- } +- if (c->x86_vendor == X86_VENDOR_AMD) { +- /* Copied from powernow-k8.h, can't include ../cpufreq/powernow +- * as we get compile warnings for the static functions. +- */ +-#define CPUID_FREQ_VOLT_CAPABILITIES 0x80000007 +-#define USE_HW_PSTATE 0x00000080 +- u32 eax, ebx, ecx, edx; +- cpuid(CPUID_FREQ_VOLT_CAPABILITIES, &eax, &ebx, &ecx, &edx); +- if ((edx & USE_HW_PSTATE) != USE_HW_PSTATE) +- return -ENODEV; +- return 0; +- } +- return -ENODEV; +-} + /* acpi_perf_data is a pointer to percpu data. */ + static struct acpi_processor_performance __percpu *acpi_perf_data; + +@@ -509,10 +480,10 @@ struct notifier_block xen_acpi_processor_resume_nb = { + static int __init xen_acpi_processor_init(void) + { + unsigned int i; +- int rc = check_prereq(); ++ int rc; + +- if (rc) +- return rc; ++ if (!xen_initial_domain()) ++ return -ENODEV; + + nr_acpi_bits = get_max_acpi_id() + 1; + acpi_ids_done = kcalloc(BITS_TO_LONGS(nr_acpi_bits), sizeof(unsigned long), GFP_KERNEL); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index ec7928a..234707c 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1552,6 +1552,7 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, + trans->transid, root->fs_info->generation); + + if (!should_cow_block(trans, root, buf)) { ++ trans->dirty = true; + *cow_ret = buf; + return 0; + } +@@ -2773,8 +2774,10 @@ again: + * then we don't want to set the path blocking, + * so we test it here + */ +- if (!should_cow_block(trans, root, b)) ++ if (!should_cow_block(trans, root, b)) { ++ trans->dirty = true; + goto cow_done; ++ } + + /* + * must have write locks on this node and the +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 84e060e..78f1b57 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -7929,7 +7929,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root, + set_extent_dirty(&trans->transaction->dirty_pages, buf->start, + buf->start + buf->len - 1, GFP_NOFS); + } +- trans->blocks_used++; ++ trans->dirty = true; + /* this returns a buffer locked for blocking */ + return buf; + } +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 00b8f37..d7c138f 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -239,7 +239,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans, + trans->aborted = errno; + /* Nothing used. The other threads that have joined this + * transaction may be able to continue. */ +- if (!trans->blocks_used && list_empty(&trans->new_bgs)) { ++ if (!trans->dirty && list_empty(&trans->new_bgs)) { + const char *errstr; + + errstr = btrfs_decode_error(errno); +diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h +index 72be51f..c0b501a 100644 +--- a/fs/btrfs/transaction.h ++++ b/fs/btrfs/transaction.h +@@ -110,7 +110,6 @@ struct btrfs_trans_handle { + u64 chunk_bytes_reserved; + unsigned long use_count; + unsigned long blocks_reserved; +- unsigned long blocks_used; + unsigned long delayed_ref_updates; + struct btrfs_transaction *transaction; + struct btrfs_block_rsv *block_rsv; +@@ -121,6 +120,7 @@ struct btrfs_trans_handle { + bool can_flush_pending_bgs; + bool reloc_reserved; + bool sync; ++ bool dirty; + unsigned int type; + /* + * this root is only needed to validate that the root passed to +diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c +index 5a53ac6..02b071bf 100644 +--- a/fs/cifs/cifs_unicode.c ++++ b/fs/cifs/cifs_unicode.c +@@ -101,6 +101,12 @@ convert_sfm_char(const __u16 src_char, char *target) + case SFM_SLASH: + *target = '\\'; + break; ++ case SFM_SPACE: ++ *target = ' '; ++ break; ++ case SFM_PERIOD: ++ *target = '.'; ++ break; + default: + return false; + } +@@ -404,7 +410,7 @@ static __le16 convert_to_sfu_char(char src_char) + return dest_char; + } + +-static __le16 convert_to_sfm_char(char src_char) ++static __le16 convert_to_sfm_char(char src_char, bool end_of_string) + { + __le16 dest_char; + +@@ -427,6 +433,18 @@ static __le16 convert_to_sfm_char(char src_char) + case '|': + dest_char = cpu_to_le16(SFM_PIPE); + break; ++ case '.': ++ if (end_of_string) ++ dest_char = cpu_to_le16(SFM_PERIOD); ++ else ++ dest_char = 0; ++ break; ++ case ' ': ++ if (end_of_string) ++ dest_char = cpu_to_le16(SFM_SPACE); ++ else ++ dest_char = 0; ++ break; + default: + dest_char = 0; + } +@@ -469,9 +487,16 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, + /* see if we must remap this char */ + if (map_chars == SFU_MAP_UNI_RSVD) + dst_char = convert_to_sfu_char(src_char); +- else if (map_chars == SFM_MAP_UNI_RSVD) +- dst_char = convert_to_sfm_char(src_char); +- else ++ else if (map_chars == SFM_MAP_UNI_RSVD) { ++ bool end_of_string; ++ ++ if (i == srclen - 1) ++ end_of_string = true; ++ else ++ end_of_string = false; ++ ++ dst_char = convert_to_sfm_char(src_char, end_of_string); ++ } else + dst_char = 0; + /* + * FIXME: We can not handle remapping backslash (UNI_SLASH) +diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h +index bdc52cb..479bc0a 100644 +--- a/fs/cifs/cifs_unicode.h ++++ b/fs/cifs/cifs_unicode.h +@@ -64,6 +64,8 @@ + #define SFM_LESSTHAN ((__u16) 0xF023) + #define SFM_PIPE ((__u16) 0xF027) + #define SFM_SLASH ((__u16) 0xF026) ++#define SFM_PERIOD ((__u16) 0xF028) ++#define SFM_SPACE ((__u16) 0xF029) + + /* + * Mapping mechanism to use when one of the seven reserved characters is +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 6f62ac8..34cbc58 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -428,7 +428,9 @@ cifs_echo_request(struct work_struct *work) + * server->ops->need_neg() == true. Also, no need to ping if + * we got a response recently. + */ +- if (!server->ops->need_neg || server->ops->need_neg(server) || ++ ++ if (server->tcpStatus == CifsNeedReconnect || ++ server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew || + (server->ops->can_echo && !server->ops->can_echo(server)) || + time_before(jiffies, server->lstrp + echo_interval - HZ)) + goto requeue_echo; +diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h +index 848249f..3079b38 100644 +--- a/fs/cifs/ntlmssp.h ++++ b/fs/cifs/ntlmssp.h +@@ -133,6 +133,6 @@ typedef struct _AUTHENTICATE_MESSAGE { + + int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses); + void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, struct cifs_ses *ses); +-int build_ntlmssp_auth_blob(unsigned char *pbuffer, u16 *buflen, ++int build_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen, + struct cifs_ses *ses, + const struct nls_table *nls_cp); +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index af0ec2d..e88ffe1 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -364,19 +364,43 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, + sec_blob->DomainName.MaximumLength = 0; + } + +-/* We do not malloc the blob, it is passed in pbuffer, because its +- maximum possible size is fixed and small, making this approach cleaner. +- This function returns the length of the data in the blob */ +-int build_ntlmssp_auth_blob(unsigned char *pbuffer, ++static int size_of_ntlmssp_blob(struct cifs_ses *ses) ++{ ++ int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len ++ - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2; ++ ++ if (ses->domainName) ++ sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN); ++ else ++ sz += 2; ++ ++ if (ses->user_name) ++ sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN); ++ else ++ sz += 2; ++ ++ return sz; ++} ++ ++int build_ntlmssp_auth_blob(unsigned char **pbuffer, + u16 *buflen, + struct cifs_ses *ses, + const struct nls_table *nls_cp) + { + int rc; +- AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer; ++ AUTHENTICATE_MESSAGE *sec_blob; + __u32 flags; + unsigned char *tmp; + ++ rc = setup_ntlmv2_rsp(ses, nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); ++ *buflen = 0; ++ goto setup_ntlmv2_ret; ++ } ++ *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL); ++ sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer; ++ + memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8); + sec_blob->MessageType = NtLmAuthenticate; + +@@ -391,7 +415,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + flags |= NTLMSSP_NEGOTIATE_KEY_XCH; + } + +- tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE); ++ tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); + sec_blob->NegotiateFlags = cpu_to_le32(flags); + + sec_blob->LmChallengeResponse.BufferOffset = +@@ -399,13 +423,9 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + sec_blob->LmChallengeResponse.Length = 0; + sec_blob->LmChallengeResponse.MaximumLength = 0; + +- sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->NtChallengeResponse.BufferOffset = ++ cpu_to_le32(tmp - *pbuffer); + if (ses->user_name != NULL) { +- rc = setup_ntlmv2_rsp(ses, nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); +- goto setup_ntlmv2_ret; +- } + memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, + ses->auth_key.len - CIFS_SESS_KEY_SIZE); + tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; +@@ -423,7 +443,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + } + + if (ses->domainName == NULL) { +- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->DomainName.Length = 0; + sec_blob->DomainName.MaximumLength = 0; + tmp += 2; +@@ -432,14 +452,14 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName, + CIFS_MAX_USERNAME_LEN, nls_cp); + len *= 2; /* unicode is 2 bytes each */ +- sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->DomainName.Length = cpu_to_le16(len); + sec_blob->DomainName.MaximumLength = cpu_to_le16(len); + tmp += len; + } + + if (ses->user_name == NULL) { +- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->UserName.Length = 0; + sec_blob->UserName.MaximumLength = 0; + tmp += 2; +@@ -448,13 +468,13 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name, + CIFS_MAX_USERNAME_LEN, nls_cp); + len *= 2; /* unicode is 2 bytes each */ +- sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->UserName.Length = cpu_to_le16(len); + sec_blob->UserName.MaximumLength = cpu_to_le16(len); + tmp += len; + } + +- sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->WorkstationName.Length = 0; + sec_blob->WorkstationName.MaximumLength = 0; + tmp += 2; +@@ -463,19 +483,19 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) + && !calc_seckey(ses)) { + memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE); +- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE); + sec_blob->SessionKey.MaximumLength = + cpu_to_le16(CIFS_CPHTXT_SIZE); + tmp += CIFS_CPHTXT_SIZE; + } else { +- sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer); ++ sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer); + sec_blob->SessionKey.Length = 0; + sec_blob->SessionKey.MaximumLength = 0; + } + ++ *buflen = tmp - *pbuffer; + setup_ntlmv2_ret: +- *buflen = tmp - pbuffer; + return rc; + } + +@@ -1266,7 +1286,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data) + struct cifs_ses *ses = sess_data->ses; + __u16 bytes_remaining; + char *bcc_ptr; +- char *ntlmsspblob = NULL; ++ unsigned char *ntlmsspblob = NULL; + u16 blob_len; + + cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n"); +@@ -1279,19 +1299,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data) + /* Build security blob before we assemble the request */ + pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base; + smb_buf = (struct smb_hdr *)pSMB; +- /* +- * 5 is an empirical value, large enough to hold +- * authenticate message plus max 10 of av paris, +- * domain, user, workstation names, flags, etc. +- */ +- ntlmsspblob = kzalloc(5*sizeof(struct _AUTHENTICATE_MESSAGE), +- GFP_KERNEL); +- if (!ntlmsspblob) { +- rc = -ENOMEM; +- goto out; +- } +- +- rc = build_ntlmssp_auth_blob(ntlmsspblob, ++ rc = build_ntlmssp_auth_blob(&ntlmsspblob, + &blob_len, ses, sess_data->nls_cp); + if (rc) + goto out_free_ntlmsspblob; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 8f38e33..29e06db 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -588,7 +588,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, + u16 blob_length = 0; + struct key *spnego_key = NULL; + char *security_blob = NULL; +- char *ntlmssp_blob = NULL; ++ unsigned char *ntlmssp_blob = NULL; + bool use_spnego = false; /* else use raw ntlmssp */ + + cifs_dbg(FYI, "Session Setup\n"); +@@ -713,13 +713,7 @@ ssetup_ntlmssp_authenticate: + iov[1].iov_len = blob_length; + } else if (phase == NtLmAuthenticate) { + req->hdr.SessionId = ses->Suid; +- ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500, +- GFP_KERNEL); +- if (ntlmssp_blob == NULL) { +- rc = -ENOMEM; +- goto ssetup_exit; +- } +- rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses, ++ rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses, + nls_cp); + if (rc) { + cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", +@@ -1818,6 +1812,33 @@ SMB2_echo(struct TCP_Server_Info *server) + + cifs_dbg(FYI, "In echo request\n"); + ++ if (server->tcpStatus == CifsNeedNegotiate) { ++ struct list_head *tmp, *tmp2; ++ struct cifs_ses *ses; ++ struct cifs_tcon *tcon; ++ ++ cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); ++ spin_lock(&cifs_tcp_ses_lock); ++ list_for_each(tmp, &server->smb_ses_list) { ++ ses = list_entry(tmp, struct cifs_ses, smb_ses_list); ++ list_for_each(tmp2, &ses->tcon_list) { ++ tcon = list_entry(tmp2, struct cifs_tcon, ++ tcon_list); ++ /* add check for persistent handle reconnect */ ++ if (tcon && tcon->need_reconnect) { ++ spin_unlock(&cifs_tcp_ses_lock); ++ rc = smb2_reconnect(SMB2_ECHO, tcon); ++ spin_lock(&cifs_tcp_ses_lock); ++ } ++ } ++ } ++ spin_unlock(&cifs_tcp_ses_lock); ++ } ++ ++ /* if no session, renegotiate failed above */ ++ if (server->tcpStatus == CifsNeedNegotiate) ++ return -EIO; ++ + rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req); + if (rc) + return rc; +diff --git a/fs/namei.c b/fs/namei.c +index 30145f8..aaa3b69 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -3173,6 +3173,10 @@ retry_lookup: + got_write = false; + } + ++ error = follow_managed(&path, nd); ++ if (unlikely(error < 0)) ++ return error; ++ + if (unlikely(d_is_negative(path.dentry))) { + path_to_nameidata(&path, nd); + return -ENOENT; +@@ -3188,10 +3192,6 @@ retry_lookup: + return -EEXIST; + } + +- error = follow_managed(&path, nd); +- if (unlikely(error < 0)) +- return error; +- + seq = 0; /* out of RCU mode, so the value doesn't matter */ + inode = d_backing_inode(path.dentry); + finish_lookup: +diff --git a/fs/namespace.c b/fs/namespace.c +index 4fb1691..783004a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, + mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; + } + if (type->fs_flags & FS_USERNS_VISIBLE) { +- if (!fs_fully_visible(type, &mnt_flags)) ++ if (!fs_fully_visible(type, &mnt_flags)) { ++ put_filesystem(type); + return -EPERM; ++ } + } + } + +@@ -3245,6 +3247,10 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) + if (mnt->mnt.mnt_sb->s_iflags & SB_I_NOEXEC) + mnt_flags &= ~(MNT_LOCK_NOSUID | MNT_LOCK_NOEXEC); + ++ /* Don't miss readonly hidden in the superblock flags */ ++ if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY) ++ mnt_flags |= MNT_LOCK_READONLY; ++ + /* Verify the mount flags are equal to or more permissive + * than the proposed new mount. + */ +@@ -3271,7 +3277,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) + list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { + struct inode *inode = child->mnt_mountpoint->d_inode; + /* Only worry about locked mounts */ +- if (!(mnt_flags & MNT_LOCKED)) ++ if (!(child->mnt.mnt_flags & MNT_LOCKED)) + continue; + /* Is the directory permanetly empty? */ + if (!is_empty_dir_inode(inode)) +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 33eb817..a7dd1fe 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1527,9 +1527,9 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry, + err = PTR_ERR(inode); + trace_nfs_atomic_open_exit(dir, ctx, open_flags, err); + put_nfs_open_context(ctx); ++ d_drop(dentry); + switch (err) { + case -ENOENT: +- d_drop(dentry); + d_add(dentry, NULL); + nfs_set_verifier(dentry, nfs_save_change_attribute(dir)); + break; +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 327b8c3..de2523f 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2860,12 +2860,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data) + call_close |= is_wronly; + else if (is_wronly) + calldata->arg.fmode |= FMODE_WRITE; ++ if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE)) ++ call_close |= is_rdwr; + } else if (is_rdwr) + calldata->arg.fmode |= FMODE_READ|FMODE_WRITE; + +- if (calldata->arg.fmode == 0) +- call_close |= is_rdwr; +- + if (!nfs4_valid_open_stateid(state)) + call_close = 0; + spin_unlock(&state->owner->so_lock); +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 776dccb..dcb7000 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages, + } + + /* Helper function for pnfs_generic_commit_pagelist to catch an empty +- * page list. This can happen when two commits race. */ ++ * page list. This can happen when two commits race. ++ * ++ * This must be called instead of nfs_init_commit - call one or the other, but ++ * not both! ++ */ + static bool + pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages, + struct nfs_commit_data *data, +@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages, + if (list_empty(pages)) { + if (atomic_dec_and_test(&cinfo->mds->rpcs_out)) + wake_up_atomic_t(&cinfo->mds->rpcs_out); +- nfs_commitdata_release(data); ++ /* don't call nfs_commitdata_release - it tries to put ++ * the open_context which is not acquired until nfs_init_commit ++ * which has not been called on @data */ ++ WARN_ON_ONCE(data->context); ++ nfs_commit_free(data); + return true; + } + +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index 6776d7a..572e5b3 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -367,13 +367,13 @@ readpage_async_filler(void *data, struct page *page) + nfs_list_remove_request(new); + nfs_readpage_release(new); + error = desc->pgio->pg_error; +- goto out_unlock; ++ goto out; + } + return 0; + out_error: + error = PTR_ERR(new); +-out_unlock: + unlock_page(page); ++out: + return error; + } + +diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c +index 1580ea6..d08cd88 100644 +--- a/fs/nfsd/nfs2acl.c ++++ b/fs/nfsd/nfs2acl.c +@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, + goto out; + + inode = d_inode(fh->fh_dentry); +- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { +- error = -EOPNOTSUPP; +- goto out_errno; +- } + + error = fh_want_write(fh); + if (error) + goto out_errno; + +- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); ++ fh_lock(fh); ++ ++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) +- goto out_drop_write; +- error = inode->i_op->set_acl(inode, argp->acl_default, +- ACL_TYPE_DEFAULT); ++ goto out_drop_lock; ++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + if (error) +- goto out_drop_write; ++ goto out_drop_lock; ++ ++ fh_unlock(fh); + + fh_drop_write(fh); + +@@ -131,7 +130,8 @@ out: + posix_acl_release(argp->acl_access); + posix_acl_release(argp->acl_default); + return nfserr; +-out_drop_write: ++out_drop_lock: ++ fh_unlock(fh); + fh_drop_write(fh); + out_errno: + nfserr = nfserrno(error); +diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c +index 01df4cd..0c89034 100644 +--- a/fs/nfsd/nfs3acl.c ++++ b/fs/nfsd/nfs3acl.c +@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp, + goto out; + + inode = d_inode(fh->fh_dentry); +- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { +- error = -EOPNOTSUPP; +- goto out_errno; +- } + + error = fh_want_write(fh); + if (error) + goto out_errno; + +- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); ++ fh_lock(fh); ++ ++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) +- goto out_drop_write; +- error = inode->i_op->set_acl(inode, argp->acl_default, +- ACL_TYPE_DEFAULT); ++ goto out_drop_lock; ++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + +-out_drop_write: ++out_drop_lock: ++ fh_unlock(fh); + fh_drop_write(fh); + out_errno: + nfserr = nfserrno(error); +diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c +index 6adabd6..71292a0 100644 +--- a/fs/nfsd/nfs4acl.c ++++ b/fs/nfsd/nfs4acl.c +@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, + dentry = fhp->fh_dentry; + inode = d_inode(dentry); + +- if (!inode->i_op->set_acl || !IS_POSIXACL(inode)) +- return nfserr_attrnotsupp; +- + if (S_ISDIR(inode->i_mode)) + flags = NFS4_ACL_DIR; + +@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, + if (host_error < 0) + goto out_nfserr; + +- host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS); ++ fh_lock(fhp); ++ ++ host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl); + if (host_error < 0) +- goto out_release; ++ goto out_drop_lock; + + if (S_ISDIR(inode->i_mode)) { +- host_error = inode->i_op->set_acl(inode, dpacl, +- ACL_TYPE_DEFAULT); ++ host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl); + } + +-out_release: ++out_drop_lock: ++ fh_unlock(fhp); ++ + posix_acl_release(pacl); + posix_acl_release(dpacl); + out_nfserr: +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 7389cb1..04c68d9 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -710,22 +710,6 @@ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc + } + } + +-static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args) +-{ +- struct rpc_xprt *xprt; +- +- if (args->protocol != XPRT_TRANSPORT_BC_TCP) +- return rpc_create(args); +- +- xprt = args->bc_xprt->xpt_bc_xprt; +- if (xprt) { +- xprt_get(xprt); +- return rpc_create_xprt(args, xprt); +- } +- +- return rpc_create(args); +-} +- + static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses) + { + int maxtime = max_cb_time(clp->net); +@@ -768,7 +752,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c + args.authflavor = ses->se_cb_sec.flavor; + } + /* Create RPC client */ +- client = create_backchannel_client(&args); ++ client = rpc_create(&args); + if (IS_ERR(client)) { + dprintk("NFSD: couldn't create callback client: %ld\n", + PTR_ERR(client)); +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 0462eed..9e04e49 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3487,6 +3487,10 @@ init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, + struct nfs4_openowner *oo = open->op_openowner; + struct nfs4_ol_stateid *retstp = NULL; + ++ /* We are moving these outside of the spinlocks to avoid the warnings */ ++ mutex_init(&stp->st_mutex); ++ mutex_lock(&stp->st_mutex); ++ + spin_lock(&oo->oo_owner.so_client->cl_lock); + spin_lock(&fp->fi_lock); + +@@ -3502,13 +3506,17 @@ init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, + stp->st_access_bmap = 0; + stp->st_deny_bmap = 0; + stp->st_openstp = NULL; +- init_rwsem(&stp->st_rwsem); + list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids); + list_add(&stp->st_perfile, &fp->fi_stateids); + + out_unlock: + spin_unlock(&fp->fi_lock); + spin_unlock(&oo->oo_owner.so_client->cl_lock); ++ if (retstp) { ++ mutex_lock(&retstp->st_mutex); ++ /* Not that we need to, just for neatness */ ++ mutex_unlock(&stp->st_mutex); ++ } + return retstp; + } + +@@ -4335,32 +4343,34 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf + */ + if (stp) { + /* Stateid was found, this is an OPEN upgrade */ +- down_read(&stp->st_rwsem); ++ mutex_lock(&stp->st_mutex); + status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open); + if (status) { +- up_read(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + goto out; + } + } else { + stp = open->op_stp; + open->op_stp = NULL; ++ /* ++ * init_open_stateid() either returns a locked stateid ++ * it found, or initializes and locks the new one we passed in ++ */ + swapstp = init_open_stateid(stp, fp, open); + if (swapstp) { + nfs4_put_stid(&stp->st_stid); + stp = swapstp; +- down_read(&stp->st_rwsem); + status = nfs4_upgrade_open(rqstp, fp, current_fh, + stp, open); + if (status) { +- up_read(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + goto out; + } + goto upgrade_out; + } +- down_read(&stp->st_rwsem); + status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open); + if (status) { +- up_read(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + release_open_stateid(stp); + goto out; + } +@@ -4372,7 +4382,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf + } + upgrade_out: + nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid); +- up_read(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + + if (nfsd4_has_session(&resp->cstate)) { + if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) { +@@ -4983,12 +4993,12 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_ + * revoked delegations are kept only for free_stateid. + */ + return nfserr_bad_stateid; +- down_write(&stp->st_rwsem); ++ mutex_lock(&stp->st_mutex); + status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate)); + if (status == nfs_ok) + status = nfs4_check_fh(current_fh, &stp->st_stid); + if (status != nfs_ok) +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + return status; + } + +@@ -5036,7 +5046,7 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs + return status; + oo = openowner(stp->st_stateowner); + if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) { +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + nfs4_put_stid(&stp->st_stid); + return nfserr_bad_stateid; + } +@@ -5068,12 +5078,12 @@ nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + oo = openowner(stp->st_stateowner); + status = nfserr_bad_stateid; + if (oo->oo_flags & NFS4_OO_CONFIRMED) { +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + goto put_stateid; + } + oo->oo_flags |= NFS4_OO_CONFIRMED; + nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid); +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n", + __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid)); + +@@ -5149,7 +5159,7 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp, + nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid); + status = nfs_ok; + put_stateid: +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + nfs4_put_stid(&stp->st_stid); + out: + nfsd4_bump_seqid(cstate, status); +@@ -5202,7 +5212,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + if (status) + goto out; + nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid); +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + + nfsd4_close_open_stateid(stp); + +@@ -5428,7 +5438,7 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo, + stp->st_access_bmap = 0; + stp->st_deny_bmap = open_stp->st_deny_bmap; + stp->st_openstp = open_stp; +- init_rwsem(&stp->st_rwsem); ++ mutex_init(&stp->st_mutex); + list_add(&stp->st_locks, &open_stp->st_locks); + list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids); + spin_lock(&fp->fi_lock); +@@ -5597,7 +5607,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + &open_stp, nn); + if (status) + goto out; +- up_write(&open_stp->st_rwsem); ++ mutex_unlock(&open_stp->st_mutex); + open_sop = openowner(open_stp->st_stateowner); + status = nfserr_bad_stateid; + if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid, +@@ -5606,7 +5616,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + status = lookup_or_create_lock_state(cstate, open_stp, lock, + &lock_stp, &new); + if (status == nfs_ok) +- down_write(&lock_stp->st_rwsem); ++ mutex_lock(&lock_stp->st_mutex); + } else { + status = nfs4_preprocess_seqid_op(cstate, + lock->lk_old_lock_seqid, +@@ -5710,7 +5720,7 @@ out: + seqid_mutating_err(ntohl(status))) + lock_sop->lo_owner.so_seqid++; + +- up_write(&lock_stp->st_rwsem); ++ mutex_unlock(&lock_stp->st_mutex); + + /* + * If this is a new, never-before-used stateid, and we are +@@ -5880,7 +5890,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + fput: + fput(filp); + put_stateid: +- up_write(&stp->st_rwsem); ++ mutex_unlock(&stp->st_mutex); + nfs4_put_stid(&stp->st_stid); + out: + nfsd4_bump_seqid(cstate, status); +diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h +index c050c53..c89d7b5 100644 +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -535,7 +535,7 @@ struct nfs4_ol_stateid { + unsigned char st_access_bmap; + unsigned char st_deny_bmap; + struct nfs4_ol_stateid *st_openstp; +- struct rw_semaphore st_rwsem; ++ struct mutex st_mutex; + }; + + static inline struct nfs4_ol_stateid *openlockstateid(struct nfs4_stid *s) +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index b3fc0a3..fb35aa2 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -511,6 +511,7 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir) + struct dentry *upper; + struct dentry *opaquedir = NULL; + int err; ++ int flags = 0; + + if (WARN_ON(!workdir)) + return -EROFS; +@@ -540,46 +541,39 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir) + if (err) + goto out_dput; + +- whiteout = ovl_whiteout(workdir, dentry); +- err = PTR_ERR(whiteout); +- if (IS_ERR(whiteout)) ++ upper = lookup_one_len(dentry->d_name.name, upperdir, ++ dentry->d_name.len); ++ err = PTR_ERR(upper); ++ if (IS_ERR(upper)) + goto out_unlock; + +- upper = ovl_dentry_upper(dentry); +- if (!upper) { +- upper = lookup_one_len(dentry->d_name.name, upperdir, +- dentry->d_name.len); +- err = PTR_ERR(upper); +- if (IS_ERR(upper)) +- goto kill_whiteout; +- +- err = ovl_do_rename(wdir, whiteout, udir, upper, 0); +- dput(upper); +- if (err) +- goto kill_whiteout; +- } else { +- int flags = 0; ++ err = -ESTALE; ++ if ((opaquedir && upper != opaquedir) || ++ (!opaquedir && ovl_dentry_upper(dentry) && ++ upper != ovl_dentry_upper(dentry))) { ++ goto out_dput_upper; ++ } + +- if (opaquedir) +- upper = opaquedir; +- err = -ESTALE; +- if (upper->d_parent != upperdir) +- goto kill_whiteout; ++ whiteout = ovl_whiteout(workdir, dentry); ++ err = PTR_ERR(whiteout); ++ if (IS_ERR(whiteout)) ++ goto out_dput_upper; + +- if (is_dir) +- flags |= RENAME_EXCHANGE; ++ if (d_is_dir(upper)) ++ flags = RENAME_EXCHANGE; + +- err = ovl_do_rename(wdir, whiteout, udir, upper, flags); +- if (err) +- goto kill_whiteout; ++ err = ovl_do_rename(wdir, whiteout, udir, upper, flags); ++ if (err) ++ goto kill_whiteout; ++ if (flags) ++ ovl_cleanup(wdir, upper); + +- if (is_dir) +- ovl_cleanup(wdir, upper); +- } + ovl_dentry_version_inc(dentry->d_parent); + out_d_drop: + d_drop(dentry); + dput(whiteout); ++out_dput_upper: ++ dput(upper); + out_unlock: + unlock_rename(workdir, upperdir); + out_dput: +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index a4ff5d0..d46fa60 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -59,16 +59,40 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) + if (err) + goto out; + ++ if (attr->ia_valid & ATTR_SIZE) { ++ struct inode *realinode = d_inode(ovl_dentry_real(dentry)); ++ ++ err = -ETXTBSY; ++ if (atomic_read(&realinode->i_writecount) < 0) ++ goto out_drop_write; ++ } ++ + err = ovl_copy_up(dentry); + if (!err) { ++ struct inode *winode = NULL; ++ + upperdentry = ovl_dentry_upper(dentry); + ++ if (attr->ia_valid & ATTR_SIZE) { ++ winode = d_inode(upperdentry); ++ err = get_write_access(winode); ++ if (err) ++ goto out_drop_write; ++ } ++ ++ if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) ++ attr->ia_valid &= ~ATTR_MODE; ++ + inode_lock(upperdentry->d_inode); + err = notify_change(upperdentry, attr, NULL); + if (!err) + ovl_copyattr(upperdentry->d_inode, dentry->d_inode); + inode_unlock(upperdentry->d_inode); ++ ++ if (winode) ++ put_write_access(winode); + } ++out_drop_write: + ovl_drop_write(dentry); + out: + return err; +@@ -121,16 +145,18 @@ int ovl_permission(struct inode *inode, int mask) + + err = vfs_getattr(&realpath, &stat); + if (err) +- return err; ++ goto out_dput; + ++ err = -ESTALE; + if ((stat.mode ^ inode->i_mode) & S_IFMT) +- return -ESTALE; ++ goto out_dput; + + inode->i_mode = stat.mode; + inode->i_uid = stat.uid; + inode->i_gid = stat.gid; + +- return generic_permission(inode, mask); ++ err = generic_permission(inode, mask); ++ goto out_dput; + } + + /* Careful in RCU walk mode */ +@@ -400,12 +426,11 @@ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, + if (!inode) + return NULL; + +- mode &= S_IFMT; +- + inode->i_ino = get_next_ino(); + inode->i_mode = mode; + inode->i_flags |= S_NOATIME | S_NOCMTIME; + ++ mode &= S_IFMT; + switch (mode) { + case S_IFDIR: + inode->i_private = oe; +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index 6a7090f..294ccc0 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -185,6 +185,7 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to) + { + to->i_uid = from->i_uid; + to->i_gid = from->i_gid; ++ to->i_mode = from->i_mode; + } + + /* dir.c */ +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 791235e..7952a50f 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1064,16 +1064,21 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) + /* + * Upper should support d_type, else whiteouts are visible. + * Given workdir and upper are on same fs, we can do +- * iterate_dir() on workdir. ++ * iterate_dir() on workdir. This check requires successful ++ * creation of workdir in previous step. + */ +- err = ovl_check_d_type_supported(&workpath); +- if (err < 0) +- goto out_put_workdir; ++ if (ufs->workdir) { ++ err = ovl_check_d_type_supported(&workpath); ++ if (err < 0) ++ goto out_put_workdir; + +- if (!err) { +- pr_err("overlayfs: upper fs needs to support d_type.\n"); +- err = -EINVAL; +- goto out_put_workdir; ++ /* ++ * We allowed this configuration and don't want to ++ * break users over kernel upgrade. So warn instead ++ * of erroring out. ++ */ ++ if (!err) ++ pr_warn("overlayfs: upper fs needs to support d_type.\n"); + } + } + +diff --git a/fs/posix_acl.c b/fs/posix_acl.c +index 711dd51..e11ea5f 100644 +--- a/fs/posix_acl.c ++++ b/fs/posix_acl.c +@@ -786,39 +786,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler, + return error; + } + +-static int +-posix_acl_xattr_set(const struct xattr_handler *handler, +- struct dentry *dentry, const char *name, +- const void *value, size_t size, int flags) ++int ++set_posix_acl(struct inode *inode, int type, struct posix_acl *acl) + { +- struct inode *inode = d_backing_inode(dentry); +- struct posix_acl *acl = NULL; +- int ret; +- + if (!IS_POSIXACL(inode)) + return -EOPNOTSUPP; + if (!inode->i_op->set_acl) + return -EOPNOTSUPP; + +- if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) +- return value ? -EACCES : 0; ++ if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) ++ return acl ? -EACCES : 0; + if (!inode_owner_or_capable(inode)) + return -EPERM; + ++ if (acl) { ++ int ret = posix_acl_valid(acl); ++ if (ret) ++ return ret; ++ } ++ return inode->i_op->set_acl(inode, acl, type); ++} ++EXPORT_SYMBOL(set_posix_acl); ++ ++static int ++posix_acl_xattr_set(const struct xattr_handler *handler, ++ struct dentry *dentry, const char *name, ++ const void *value, size_t size, int flags) ++{ ++ struct inode *inode = d_backing_inode(dentry); ++ struct posix_acl *acl = NULL; ++ int ret; ++ + if (value) { + acl = posix_acl_from_xattr(&init_user_ns, value, size); + if (IS_ERR(acl)) + return PTR_ERR(acl); +- +- if (acl) { +- ret = posix_acl_valid(acl); +- if (ret) +- goto out; +- } + } +- +- ret = inode->i_op->set_acl(inode, acl, handler->flags); +-out: ++ ret = set_posix_acl(inode, handler->flags, acl); + posix_acl_release(acl); + return ret; + } +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 446753d..5b5ec8d 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -52,6 +52,7 @@ + #include "ubifs.h" + #include <linux/mount.h> + #include <linux/slab.h> ++#include <linux/migrate.h> + + static int read_block(struct inode *inode, void *addr, unsigned int block, + struct ubifs_data_node *dn) +@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct page *page) + return ret; + } + ++#ifdef CONFIG_MIGRATION ++static int ubifs_migrate_page(struct address_space *mapping, ++ struct page *newpage, struct page *page, enum migrate_mode mode) ++{ ++ int rc; ++ ++ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0); ++ if (rc != MIGRATEPAGE_SUCCESS) ++ return rc; ++ ++ if (PagePrivate(page)) { ++ ClearPagePrivate(page); ++ SetPagePrivate(newpage); ++ } ++ ++ migrate_page_copy(newpage, page); ++ return MIGRATEPAGE_SUCCESS; ++} ++#endif ++ + static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags) + { + /* +@@ -1591,6 +1612,9 @@ const struct address_space_operations ubifs_file_address_operations = { + .write_end = ubifs_write_end, + .invalidatepage = ubifs_invalidatepage, + .set_page_dirty = ubifs_set_page_dirty, ++#ifdef CONFIG_MIGRATION ++ .migratepage = ubifs_migrate_page, ++#endif + .releasepage = ubifs_releasepage, + }; + +diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h +index 6bd0570..05f05f1 100644 +--- a/include/asm-generic/qspinlock.h ++++ b/include/asm-generic/qspinlock.h +@@ -22,37 +22,33 @@ + #include <asm-generic/qspinlock_types.h> + + /** ++ * queued_spin_unlock_wait - wait until the _current_ lock holder releases the lock ++ * @lock : Pointer to queued spinlock structure ++ * ++ * There is a very slight possibility of live-lock if the lockers keep coming ++ * and the waiter is just unfortunate enough to not see any unlock state. ++ */ ++#ifndef queued_spin_unlock_wait ++extern void queued_spin_unlock_wait(struct qspinlock *lock); ++#endif ++ ++/** + * queued_spin_is_locked - is the spinlock locked? + * @lock: Pointer to queued spinlock structure + * Return: 1 if it is locked, 0 otherwise + */ ++#ifndef queued_spin_is_locked + static __always_inline int queued_spin_is_locked(struct qspinlock *lock) + { + /* +- * queued_spin_lock_slowpath() can ACQUIRE the lock before +- * issuing the unordered store that sets _Q_LOCKED_VAL. +- * +- * See both smp_cond_acquire() sites for more detail. +- * +- * This however means that in code like: +- * +- * spin_lock(A) spin_lock(B) +- * spin_unlock_wait(B) spin_is_locked(A) +- * do_something() do_something() +- * +- * Both CPUs can end up running do_something() because the store +- * setting _Q_LOCKED_VAL will pass through the loads in +- * spin_unlock_wait() and/or spin_is_locked(). ++ * See queued_spin_unlock_wait(). + * +- * Avoid this by issuing a full memory barrier between the spin_lock() +- * and the loads in spin_unlock_wait() and spin_is_locked(). +- * +- * Note that regular mutual exclusion doesn't care about this +- * delayed store. ++ * Any !0 state indicates it is locked, even if _Q_LOCKED_VAL ++ * isn't immediately observable. + */ +- smp_mb(); +- return atomic_read(&lock->val) & _Q_LOCKED_MASK; ++ return atomic_read(&lock->val); + } ++#endif + + /** + * queued_spin_value_unlocked - is the spinlock structure unlocked? +@@ -122,21 +118,6 @@ static __always_inline void queued_spin_unlock(struct qspinlock *lock) + } + #endif + +-/** +- * queued_spin_unlock_wait - wait until current lock holder releases the lock +- * @lock : Pointer to queued spinlock structure +- * +- * There is a very slight possibility of live-lock if the lockers keep coming +- * and the waiter is just unfortunate enough to not see any unlock state. +- */ +-static inline void queued_spin_unlock_wait(struct qspinlock *lock) +-{ +- /* See queued_spin_is_locked() */ +- smp_mb(); +- while (atomic_read(&lock->val) & _Q_LOCKED_MASK) +- cpu_relax(); +-} +- + #ifndef virt_spin_lock + static __always_inline bool virt_spin_lock(struct qspinlock *lock) + { +diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h +index 055a08d..a74c49d 100644 +--- a/include/drm/ttm/ttm_bo_api.h ++++ b/include/drm/ttm/ttm_bo_api.h +@@ -316,6 +316,20 @@ ttm_bo_reference(struct ttm_buffer_object *bo) + */ + extern int ttm_bo_wait(struct ttm_buffer_object *bo, bool lazy, + bool interruptible, bool no_wait); ++ ++/** ++ * ttm_bo_mem_compat - Check if proposed placement is compatible with a bo ++ * ++ * @placement: Return immediately if buffer is busy. ++ * @mem: The struct ttm_mem_reg indicating the region where the bo resides ++ * @new_flags: Describes compatible placement found ++ * ++ * Returns true if the placement is compatible ++ */ ++extern bool ttm_bo_mem_compat(struct ttm_placement *placement, ++ struct ttm_mem_reg *mem, ++ uint32_t *new_flags); ++ + /** + * ttm_bo_validate + * +diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h +index 786ad32..07b83d3 100644 +--- a/include/linux/cpuidle.h ++++ b/include/linux/cpuidle.h +@@ -152,6 +152,8 @@ extern void cpuidle_disable_device(struct cpuidle_device *dev); + extern int cpuidle_play_dead(void); + + extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev); ++static inline struct cpuidle_device *cpuidle_get_device(void) ++{return __this_cpu_read(cpuidle_devices); } + #else + static inline void disable_cpuidle(void) { } + static inline bool cpuidle_not_available(struct cpuidle_driver *drv, +@@ -187,6 +189,7 @@ static inline void cpuidle_disable_device(struct cpuidle_device *dev) { } + static inline int cpuidle_play_dead(void) {return -ENODEV; } + static inline struct cpuidle_driver *cpuidle_get_cpu_driver( + struct cpuidle_device *dev) {return NULL; } ++static inline struct cpuidle_device *cpuidle_get_device(void) {return NULL; } + #endif + + #if defined(CONFIG_CPU_IDLE) && defined(CONFIG_SUSPEND) +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index 7e9422c..ad5d582 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -576,5 +576,17 @@ static inline struct inode *vfs_select_inode(struct dentry *dentry, + return inode; + } + ++/** ++ * d_real_inode - Return the real inode ++ * @dentry: The dentry to query ++ * ++ * If dentry is on an union/overlay, then return the underlying, real inode. ++ * Otherwise return d_inode(). ++ */ ++static inline struct inode *d_real_inode(struct dentry *dentry) ++{ ++ return d_backing_inode(d_real(dentry)); ++} ++ + + #endif /* __LINUX_DCACHE_H */ +diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h +index 0536524..6890446 100644 +--- a/include/linux/jump_label.h ++++ b/include/linux/jump_label.h +@@ -117,13 +117,18 @@ struct module; + + #include <linux/atomic.h> + ++#ifdef HAVE_JUMP_LABEL ++ + static inline int static_key_count(struct static_key *key) + { +- return atomic_read(&key->enabled); ++ /* ++ * -1 means the first static_key_slow_inc() is in progress. ++ * static_key_enabled() must return true, so return 1 here. ++ */ ++ int n = atomic_read(&key->enabled); ++ return n >= 0 ? n : 1; + } + +-#ifdef HAVE_JUMP_LABEL +- + #define JUMP_TYPE_FALSE 0UL + #define JUMP_TYPE_TRUE 1UL + #define JUMP_TYPE_MASK 1UL +@@ -162,6 +167,11 @@ extern void jump_label_apply_nops(struct module *mod); + + #else /* !HAVE_JUMP_LABEL */ + ++static inline int static_key_count(struct static_key *key) ++{ ++ return atomic_read(&key->enabled); ++} ++ + static __always_inline void jump_label_init(void) + { + static_key_initialized = true; +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 15d0df9..794b924 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1062,6 +1062,7 @@ __skb_set_sw_hash(struct sk_buff *skb, __u32 hash, bool is_l4) + } + + void __skb_get_hash(struct sk_buff *skb); ++u32 __skb_get_hash_symmetric(struct sk_buff *skb); + u32 skb_get_poff(const struct sk_buff *skb); + u32 __skb_get_poff(const struct sk_buff *skb, void *data, + const struct flow_keys *keys, int hlen); +@@ -2860,6 +2861,25 @@ static inline void skb_postpush_rcsum(struct sk_buff *skb, + } + + /** ++ * skb_push_rcsum - push skb and update receive checksum ++ * @skb: buffer to update ++ * @len: length of data pulled ++ * ++ * This function performs an skb_push on the packet and updates ++ * the CHECKSUM_COMPLETE checksum. It should be used on ++ * receive path processing instead of skb_push unless you know ++ * that the checksum difference is zero (e.g., a valid IP header) ++ * or you are setting ip_summed to CHECKSUM_NONE. ++ */ ++static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, ++ unsigned int len) ++{ ++ skb_push(skb, len); ++ skb_postpush_rcsum(skb, skb->data, len); ++ return skb->data; ++} ++ ++/** + * pskb_trim_rcsum - trim received skb and update checksum + * @skb: buffer to trim + * @len: new length +diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h +index 9a7ddba..14d70f5 100644 +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -137,8 +137,6 @@ struct rpc_create_args { + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); +-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, +- struct rpc_xprt *xprt); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, + const struct rpc_program *, u32); + struct rpc_clnt *rpc_clone_client(struct rpc_clnt *); +diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h +index b7dabc4..79ba508 100644 +--- a/include/linux/sunrpc/svc_xprt.h ++++ b/include/linux/sunrpc/svc_xprt.h +@@ -84,6 +84,7 @@ struct svc_xprt { + + struct net *xpt_net; + struct rpc_xprt *xpt_bc_xprt; /* NFSv4.1 backchannel */ ++ struct rpc_xprt_switch *xpt_bc_xps; /* NFSv4.1 backchannel */ + }; + + static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u) +diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h +index fb0d212..9f51e1d 100644 +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -296,6 +296,7 @@ struct xprt_create { + size_t addrlen; + const char *servername; + struct svc_xprt *bc_xprt; /* NFSv4.1 backchannel */ ++ struct rpc_xprt_switch *bc_xps; + unsigned int flags; + }; + +diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h +index 966889a..e479033 100644 +--- a/include/linux/usb/ehci_def.h ++++ b/include/linux/usb/ehci_def.h +@@ -180,11 +180,11 @@ struct ehci_regs { + * PORTSCx + */ + /* HOSTPC: offset 0x84 */ +- u32 hostpc[1]; /* HOSTPC extension */ ++ u32 hostpc[0]; /* HOSTPC extension */ + #define HOSTPC_PHCD (1<<22) /* Phy clock disable */ + #define HOSTPC_PSPD (3<<25) /* Port speed detection */ + +- u32 reserved5[16]; ++ u32 reserved5[17]; + + /* USBMODE_EX: offset 0xc8 */ + u32 usbmode_ex; /* USB Device mode extension */ +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index fb2cef4..b8334a6 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -217,7 +217,7 @@ enum ib_device_cap_flags { + IB_DEVICE_CROSS_CHANNEL = (1 << 27), + IB_DEVICE_MANAGED_FLOW_STEERING = (1 << 29), + IB_DEVICE_SIGNATURE_HANDOVER = (1 << 30), +- IB_DEVICE_ON_DEMAND_PAGING = (1 << 31), ++ IB_DEVICE_ON_DEMAND_PAGING = (1ULL << 31), + IB_DEVICE_SG_GAPS_REG = (1ULL << 32), + IB_DEVICE_VIRTUAL_FUNCTION = ((u64)1 << 33), + }; +diff --git a/include/rdma/rdma_vt.h b/include/rdma/rdma_vt.h +index a869655..6ee9d97 100644 +--- a/include/rdma/rdma_vt.h ++++ b/include/rdma/rdma_vt.h +@@ -203,7 +203,9 @@ struct rvt_driver_provided { + + /* + * Allocate a private queue pair data structure for driver specific +- * information which is opaque to rdmavt. ++ * information which is opaque to rdmavt. Errors are returned via ++ * ERR_PTR(err). The driver is free to return NULL or a valid ++ * pointer. + */ + void * (*qp_priv_alloc)(struct rvt_dev_info *rdi, struct rvt_qp *qp, + gfp_t gfp); +diff --git a/kernel/futex.c b/kernel/futex.c +index c20f06f..6555d54 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) + { + unsigned long address = (unsigned long)uaddr; + struct mm_struct *mm = current->mm; +- struct page *page; ++ struct page *page, *tail; + struct address_space *mapping; + int err, ro = 0; + +@@ -530,7 +530,15 @@ again: + * considered here and page lock forces unnecessarily serialization + * From this point on, mapping will be re-verified if necessary and + * page lock will be acquired only if it is unavoidable +- */ ++ * ++ * Mapping checks require the head page for any compound page so the ++ * head page and mapping is looked up now. For anonymous pages, it ++ * does not matter if the page splits in the future as the key is ++ * based on the address. For filesystem-backed pages, the tail is ++ * required as the index of the page determines the key. For ++ * base pages, there is no tail page and tail == page. ++ */ ++ tail = page; + page = compound_head(page); + mapping = READ_ONCE(page->mapping); + +@@ -654,7 +662,7 @@ again: + + key->both.offset |= FUT_OFF_INODE; /* inode-based key */ + key->shared.inode = inode; +- key->shared.pgoff = basepage_index(page); ++ key->shared.pgoff = basepage_index(tail); + rcu_read_unlock(); + } + +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index 05254ee..4b353e0 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -58,13 +58,36 @@ static void jump_label_update(struct static_key *key); + + void static_key_slow_inc(struct static_key *key) + { ++ int v, v1; ++ + STATIC_KEY_CHECK_USE(); +- if (atomic_inc_not_zero(&key->enabled)) +- return; ++ ++ /* ++ * Careful if we get concurrent static_key_slow_inc() calls; ++ * later calls must wait for the first one to _finish_ the ++ * jump_label_update() process. At the same time, however, ++ * the jump_label_update() call below wants to see ++ * static_key_enabled(&key) for jumps to be updated properly. ++ * ++ * So give a special meaning to negative key->enabled: it sends ++ * static_key_slow_inc() down the slow path, and it is non-zero ++ * so it counts as "enabled" in jump_label_update(). Note that ++ * atomic_inc_unless_negative() checks >= 0, so roll our own. ++ */ ++ for (v = atomic_read(&key->enabled); v > 0; v = v1) { ++ v1 = atomic_cmpxchg(&key->enabled, v, v + 1); ++ if (likely(v1 == v)) ++ return; ++ } + + jump_label_lock(); +- if (atomic_inc_return(&key->enabled) == 1) ++ if (atomic_read(&key->enabled) == 0) { ++ atomic_set(&key->enabled, -1); + jump_label_update(key); ++ atomic_set(&key->enabled, 1); ++ } else { ++ atomic_inc(&key->enabled); ++ } + jump_label_unlock(); + } + EXPORT_SYMBOL_GPL(static_key_slow_inc); +@@ -72,6 +95,13 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc); + static void __static_key_slow_dec(struct static_key *key, + unsigned long rate_limit, struct delayed_work *work) + { ++ /* ++ * The negative count check is valid even when a negative ++ * key->enabled is in use by static_key_slow_inc(); a ++ * __static_key_slow_dec() before the first static_key_slow_inc() ++ * returns is unbalanced, because all other static_key_slow_inc() ++ * instances block while the update is in progress. ++ */ + if (!atomic_dec_and_mutex_lock(&key->enabled, &jump_label_mutex)) { + WARN(atomic_read(&key->enabled) < 0, + "jump label: negative count!\n"); +diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c +index e364b42..79d2d76 100644 +--- a/kernel/locking/mutex.c ++++ b/kernel/locking/mutex.c +@@ -486,9 +486,6 @@ __ww_mutex_lock_check_stamp(struct mutex *lock, struct ww_acquire_ctx *ctx) + if (!hold_ctx) + return 0; + +- if (unlikely(ctx == hold_ctx)) +- return -EALREADY; +- + if (ctx->stamp - hold_ctx->stamp <= LONG_MAX && + (ctx->stamp != hold_ctx->stamp || ctx > hold_ctx)) { + #ifdef CONFIG_DEBUG_MUTEXES +@@ -514,6 +511,12 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, + unsigned long flags; + int ret; + ++ if (use_ww_ctx) { ++ struct ww_mutex *ww = container_of(lock, struct ww_mutex, base); ++ if (unlikely(ww_ctx == READ_ONCE(ww->ctx))) ++ return -EALREADY; ++ } ++ + preempt_disable(); + mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip); + +diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c +index ce2f75e..5fc8c31 100644 +--- a/kernel/locking/qspinlock.c ++++ b/kernel/locking/qspinlock.c +@@ -267,6 +267,66 @@ static __always_inline u32 __pv_wait_head_or_lock(struct qspinlock *lock, + #define queued_spin_lock_slowpath native_queued_spin_lock_slowpath + #endif + ++/* ++ * queued_spin_lock_slowpath() can (load-)ACQUIRE the lock before ++ * issuing an _unordered_ store to set _Q_LOCKED_VAL. ++ * ++ * This means that the store can be delayed, but no later than the ++ * store-release from the unlock. This means that simply observing ++ * _Q_LOCKED_VAL is not sufficient to determine if the lock is acquired. ++ * ++ * There are two paths that can issue the unordered store: ++ * ++ * (1) clear_pending_set_locked(): *,1,0 -> *,0,1 ++ * ++ * (2) set_locked(): t,0,0 -> t,0,1 ; t != 0 ++ * atomic_cmpxchg_relaxed(): t,0,0 -> 0,0,1 ++ * ++ * However, in both cases we have other !0 state we've set before to queue ++ * ourseves: ++ * ++ * For (1) we have the atomic_cmpxchg_acquire() that set _Q_PENDING_VAL, our ++ * load is constrained by that ACQUIRE to not pass before that, and thus must ++ * observe the store. ++ * ++ * For (2) we have a more intersting scenario. We enqueue ourselves using ++ * xchg_tail(), which ends up being a RELEASE. This in itself is not ++ * sufficient, however that is followed by an smp_cond_acquire() on the same ++ * word, giving a RELEASE->ACQUIRE ordering. This again constrains our load and ++ * guarantees we must observe that store. ++ * ++ * Therefore both cases have other !0 state that is observable before the ++ * unordered locked byte store comes through. This means we can use that to ++ * wait for the lock store, and then wait for an unlock. ++ */ ++#ifndef queued_spin_unlock_wait ++void queued_spin_unlock_wait(struct qspinlock *lock) ++{ ++ u32 val; ++ ++ for (;;) { ++ val = atomic_read(&lock->val); ++ ++ if (!val) /* not locked, we're done */ ++ goto done; ++ ++ if (val & _Q_LOCKED_MASK) /* locked, go wait for unlock */ ++ break; ++ ++ /* not locked, but pending, wait until we observe the lock */ ++ cpu_relax(); ++ } ++ ++ /* any unlock is good */ ++ while (atomic_read(&lock->val) & _Q_LOCKED_MASK) ++ cpu_relax(); ++ ++done: ++ smp_rmb(); /* CTRL + RMB -> ACQUIRE */ ++} ++EXPORT_SYMBOL(queued_spin_unlock_wait); ++#endif ++ + #endif /* _GEN_PV_LOCK_SLOWPATH */ + + /** +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index e7dd0ec..eeaf920 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2821,6 +2821,23 @@ static inline void update_tg_load_avg(struct cfs_rq *cfs_rq, int force) {} + + static inline u64 cfs_rq_clock_task(struct cfs_rq *cfs_rq); + ++/* ++ * Unsigned subtract and clamp on underflow. ++ * ++ * Explicitly do a load-store to ensure the intermediate value never hits ++ * memory. This allows lockless observations without ever seeing the negative ++ * values. ++ */ ++#define sub_positive(_ptr, _val) do { \ ++ typeof(_ptr) ptr = (_ptr); \ ++ typeof(*ptr) val = (_val); \ ++ typeof(*ptr) res, var = READ_ONCE(*ptr); \ ++ res = var - val; \ ++ if (res > var) \ ++ res = 0; \ ++ WRITE_ONCE(*ptr, res); \ ++} while (0) ++ + /* Group cfs_rq's load_avg is used for task_h_load and update_cfs_share */ + static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq) + { +@@ -2829,15 +2846,15 @@ static inline int update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq) + + if (atomic_long_read(&cfs_rq->removed_load_avg)) { + s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0); +- sa->load_avg = max_t(long, sa->load_avg - r, 0); +- sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0); ++ sub_positive(&sa->load_avg, r); ++ sub_positive(&sa->load_sum, r * LOAD_AVG_MAX); + removed = 1; + } + + if (atomic_long_read(&cfs_rq->removed_util_avg)) { + long r = atomic_long_xchg(&cfs_rq->removed_util_avg, 0); +- sa->util_avg = max_t(long, sa->util_avg - r, 0); +- sa->util_sum = max_t(s32, sa->util_sum - r * LOAD_AVG_MAX, 0); ++ sub_positive(&sa->util_avg, r); ++ sub_positive(&sa->util_sum, r * LOAD_AVG_MAX); + } + + decayed = __update_load_avg(now, cpu_of(rq_of(cfs_rq)), sa, +@@ -2927,10 +2944,10 @@ static void detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *s + &se->avg, se->on_rq * scale_load_down(se->load.weight), + cfs_rq->curr == se, NULL); + +- cfs_rq->avg.load_avg = max_t(long, cfs_rq->avg.load_avg - se->avg.load_avg, 0); +- cfs_rq->avg.load_sum = max_t(s64, cfs_rq->avg.load_sum - se->avg.load_sum, 0); +- cfs_rq->avg.util_avg = max_t(long, cfs_rq->avg.util_avg - se->avg.util_avg, 0); +- cfs_rq->avg.util_sum = max_t(s32, cfs_rq->avg.util_sum - se->avg.util_sum, 0); ++ sub_positive(&cfs_rq->avg.load_avg, se->avg.load_avg); ++ sub_positive(&cfs_rq->avg.load_sum, se->avg.load_sum); ++ sub_positive(&cfs_rq->avg.util_avg, se->avg.util_avg); ++ sub_positive(&cfs_rq->avg.util_sum, se->avg.util_sum); + } + + /* Add the load generated by se into cfs_rq's load average */ +diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c +index bd12c6c..c5aeedf 100644 +--- a/kernel/sched/idle.c ++++ b/kernel/sched/idle.c +@@ -127,7 +127,7 @@ static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev, + */ + static void cpuidle_idle_call(void) + { +- struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices); ++ struct cpuidle_device *dev = cpuidle_get_device(); + struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev); + int next_state, entered_state; + +diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c +index f96f038..ad1d616 100644 +--- a/kernel/trace/trace_printk.c ++++ b/kernel/trace/trace_printk.c +@@ -36,6 +36,10 @@ struct trace_bprintk_fmt { + static inline struct trace_bprintk_fmt *lookup_format(const char *fmt) + { + struct trace_bprintk_fmt *pos; ++ ++ if (!fmt) ++ return ERR_PTR(-EINVAL); ++ + list_for_each_entry(pos, &trace_bprintk_fmt_list, list) { + if (!strcmp(pos->fmt, fmt)) + return pos; +@@ -57,7 +61,8 @@ void hold_module_trace_bprintk_format(const char **start, const char **end) + for (iter = start; iter < end; iter++) { + struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter); + if (tb_fmt) { +- *iter = tb_fmt->fmt; ++ if (!IS_ERR(tb_fmt)) ++ *iter = tb_fmt->fmt; + continue; + } + +diff --git a/mm/migrate.c b/mm/migrate.c +index f9dfb18..bdf3410 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -431,6 +431,7 @@ int migrate_page_move_mapping(struct address_space *mapping, + + return MIGRATEPAGE_SUCCESS; + } ++EXPORT_SYMBOL(migrate_page_move_mapping); + + /* + * The expected number of remaining references is the same as that +@@ -586,6 +587,7 @@ void migrate_page_copy(struct page *newpage, struct page *page) + + mem_cgroup_migrate(page, newpage); + } ++EXPORT_SYMBOL(migrate_page_copy); + + /************************************************************ + * Migration functions +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index bc5149d..e389f0a 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -369,8 +369,9 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc) + struct dirty_throttle_control *gdtc = mdtc_gdtc(dtc); + unsigned long bytes = vm_dirty_bytes; + unsigned long bg_bytes = dirty_background_bytes; +- unsigned long ratio = vm_dirty_ratio; +- unsigned long bg_ratio = dirty_background_ratio; ++ /* convert ratios to per-PAGE_SIZE for higher precision */ ++ unsigned long ratio = (vm_dirty_ratio * PAGE_SIZE) / 100; ++ unsigned long bg_ratio = (dirty_background_ratio * PAGE_SIZE) / 100; + unsigned long thresh; + unsigned long bg_thresh; + struct task_struct *tsk; +@@ -382,26 +383,28 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc) + /* + * The byte settings can't be applied directly to memcg + * domains. Convert them to ratios by scaling against +- * globally available memory. ++ * globally available memory. As the ratios are in ++ * per-PAGE_SIZE, they can be obtained by dividing bytes by ++ * number of pages. + */ + if (bytes) +- ratio = min(DIV_ROUND_UP(bytes, PAGE_SIZE) * 100 / +- global_avail, 100UL); ++ ratio = min(DIV_ROUND_UP(bytes, global_avail), ++ PAGE_SIZE); + if (bg_bytes) +- bg_ratio = min(DIV_ROUND_UP(bg_bytes, PAGE_SIZE) * 100 / +- global_avail, 100UL); ++ bg_ratio = min(DIV_ROUND_UP(bg_bytes, global_avail), ++ PAGE_SIZE); + bytes = bg_bytes = 0; + } + + if (bytes) + thresh = DIV_ROUND_UP(bytes, PAGE_SIZE); + else +- thresh = (ratio * available_memory) / 100; ++ thresh = (ratio * available_memory) / PAGE_SIZE; + + if (bg_bytes) + bg_thresh = DIV_ROUND_UP(bg_bytes, PAGE_SIZE); + else +- bg_thresh = (bg_ratio * available_memory) / 100; ++ bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE; + + if (bg_thresh >= thresh) + bg_thresh = thresh / 2; +diff --git a/mm/percpu.c b/mm/percpu.c +index 0c59684..9903830 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -112,7 +112,7 @@ struct pcpu_chunk { + int map_used; /* # of map entries used before the sentry */ + int map_alloc; /* # of map entries allocated */ + int *map; /* allocation map */ +- struct work_struct map_extend_work;/* async ->map[] extension */ ++ struct list_head map_extend_list;/* on pcpu_map_extend_chunks */ + + void *data; /* chunk data */ + int first_free; /* no free below this */ +@@ -162,10 +162,13 @@ static struct pcpu_chunk *pcpu_reserved_chunk; + static int pcpu_reserved_chunk_limit; + + static DEFINE_SPINLOCK(pcpu_lock); /* all internal data structures */ +-static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop */ ++static DEFINE_MUTEX(pcpu_alloc_mutex); /* chunk create/destroy, [de]pop, map ext */ + + static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */ + ++/* chunks which need their map areas extended, protected by pcpu_lock */ ++static LIST_HEAD(pcpu_map_extend_chunks); ++ + /* + * The number of empty populated pages, protected by pcpu_lock. The + * reserved chunk doesn't contribute to the count. +@@ -395,13 +398,19 @@ static int pcpu_need_to_extend(struct pcpu_chunk *chunk, bool is_atomic) + { + int margin, new_alloc; + ++ lockdep_assert_held(&pcpu_lock); ++ + if (is_atomic) { + margin = 3; + + if (chunk->map_alloc < +- chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW && +- pcpu_async_enabled) +- schedule_work(&chunk->map_extend_work); ++ chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW) { ++ if (list_empty(&chunk->map_extend_list)) { ++ list_add_tail(&chunk->map_extend_list, ++ &pcpu_map_extend_chunks); ++ pcpu_schedule_balance_work(); ++ } ++ } + } else { + margin = PCPU_ATOMIC_MAP_MARGIN_HIGH; + } +@@ -435,6 +444,8 @@ static int pcpu_extend_area_map(struct pcpu_chunk *chunk, int new_alloc) + size_t old_size = 0, new_size = new_alloc * sizeof(new[0]); + unsigned long flags; + ++ lockdep_assert_held(&pcpu_alloc_mutex); ++ + new = pcpu_mem_zalloc(new_size); + if (!new) + return -ENOMEM; +@@ -467,20 +478,6 @@ out_unlock: + return 0; + } + +-static void pcpu_map_extend_workfn(struct work_struct *work) +-{ +- struct pcpu_chunk *chunk = container_of(work, struct pcpu_chunk, +- map_extend_work); +- int new_alloc; +- +- spin_lock_irq(&pcpu_lock); +- new_alloc = pcpu_need_to_extend(chunk, false); +- spin_unlock_irq(&pcpu_lock); +- +- if (new_alloc) +- pcpu_extend_area_map(chunk, new_alloc); +-} +- + /** + * pcpu_fit_in_area - try to fit the requested allocation in a candidate area + * @chunk: chunk the candidate area belongs to +@@ -740,7 +737,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void) + chunk->map_used = 1; + + INIT_LIST_HEAD(&chunk->list); +- INIT_WORK(&chunk->map_extend_work, pcpu_map_extend_workfn); ++ INIT_LIST_HEAD(&chunk->map_extend_list); + chunk->free_size = pcpu_unit_size; + chunk->contig_hint = pcpu_unit_size; + +@@ -895,6 +892,9 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, + return NULL; + } + ++ if (!is_atomic) ++ mutex_lock(&pcpu_alloc_mutex); ++ + spin_lock_irqsave(&pcpu_lock, flags); + + /* serve reserved allocations from the reserved chunk if available */ +@@ -967,12 +967,9 @@ restart: + if (is_atomic) + goto fail; + +- mutex_lock(&pcpu_alloc_mutex); +- + if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) { + chunk = pcpu_create_chunk(); + if (!chunk) { +- mutex_unlock(&pcpu_alloc_mutex); + err = "failed to allocate new chunk"; + goto fail; + } +@@ -983,7 +980,6 @@ restart: + spin_lock_irqsave(&pcpu_lock, flags); + } + +- mutex_unlock(&pcpu_alloc_mutex); + goto restart; + + area_found: +@@ -993,8 +989,6 @@ area_found: + if (!is_atomic) { + int page_start, page_end, rs, re; + +- mutex_lock(&pcpu_alloc_mutex); +- + page_start = PFN_DOWN(off); + page_end = PFN_UP(off + size); + +@@ -1005,7 +999,6 @@ area_found: + + spin_lock_irqsave(&pcpu_lock, flags); + if (ret) { +- mutex_unlock(&pcpu_alloc_mutex); + pcpu_free_area(chunk, off, &occ_pages); + err = "failed to populate"; + goto fail_unlock; +@@ -1045,6 +1038,8 @@ fail: + /* see the flag handling in pcpu_blance_workfn() */ + pcpu_atomic_alloc_failed = true; + pcpu_schedule_balance_work(); ++ } else { ++ mutex_unlock(&pcpu_alloc_mutex); + } + return NULL; + } +@@ -1129,6 +1124,7 @@ static void pcpu_balance_workfn(struct work_struct *work) + if (chunk == list_first_entry(free_head, struct pcpu_chunk, list)) + continue; + ++ list_del_init(&chunk->map_extend_list); + list_move(&chunk->list, &to_free); + } + +@@ -1146,6 +1142,25 @@ static void pcpu_balance_workfn(struct work_struct *work) + pcpu_destroy_chunk(chunk); + } + ++ /* service chunks which requested async area map extension */ ++ do { ++ int new_alloc = 0; ++ ++ spin_lock_irq(&pcpu_lock); ++ ++ chunk = list_first_entry_or_null(&pcpu_map_extend_chunks, ++ struct pcpu_chunk, map_extend_list); ++ if (chunk) { ++ list_del_init(&chunk->map_extend_list); ++ new_alloc = pcpu_need_to_extend(chunk, false); ++ } ++ ++ spin_unlock_irq(&pcpu_lock); ++ ++ if (new_alloc) ++ pcpu_extend_area_map(chunk, new_alloc); ++ } while (chunk); ++ + /* + * Ensure there are certain number of free populated pages for + * atomic allocs. Fill up from the most packed so that atomic +@@ -1644,7 +1659,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai, + */ + schunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0); + INIT_LIST_HEAD(&schunk->list); +- INIT_WORK(&schunk->map_extend_work, pcpu_map_extend_workfn); ++ INIT_LIST_HEAD(&schunk->map_extend_list); + schunk->base_addr = base_addr; + schunk->map = smap; + schunk->map_alloc = ARRAY_SIZE(smap); +@@ -1673,7 +1688,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai, + if (dyn_size) { + dchunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0); + INIT_LIST_HEAD(&dchunk->list); +- INIT_WORK(&dchunk->map_extend_work, pcpu_map_extend_workfn); ++ INIT_LIST_HEAD(&dchunk->map_extend_list); + dchunk->base_addr = base_addr; + dchunk->map = dmap; + dchunk->map_alloc = ARRAY_SIZE(dmap); +diff --git a/mm/shmem.c b/mm/shmem.c +index 719bd6b..9ca09f5 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2236,9 +2236,11 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + NULL); + if (error) { + /* Remove the !PageUptodate pages we added */ +- shmem_undo_range(inode, +- (loff_t)start << PAGE_SHIFT, +- (loff_t)index << PAGE_SHIFT, true); ++ if (index > start) { ++ shmem_undo_range(inode, ++ (loff_t)start << PAGE_SHIFT, ++ ((loff_t)index << PAGE_SHIFT) - 1, true); ++ } + goto undone; + } + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index a669dea..61ad43f 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -651,6 +651,23 @@ void make_flow_keys_digest(struct flow_keys_digest *digest, + } + EXPORT_SYMBOL(make_flow_keys_digest); + ++static struct flow_dissector flow_keys_dissector_symmetric __read_mostly; ++ ++u32 __skb_get_hash_symmetric(struct sk_buff *skb) ++{ ++ struct flow_keys keys; ++ ++ __flow_hash_secret_init(); ++ ++ memset(&keys, 0, sizeof(keys)); ++ __skb_flow_dissect(skb, &flow_keys_dissector_symmetric, &keys, ++ NULL, 0, 0, 0, ++ FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL); ++ ++ return __flow_hash_from_keys(&keys, hashrnd); ++} ++EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric); ++ + /** + * __skb_get_hash: calculate a flow hash + * @skb: sk_buff to calculate flow hash from +@@ -868,6 +885,29 @@ static const struct flow_dissector_key flow_keys_dissector_keys[] = { + }, + }; + ++static const struct flow_dissector_key flow_keys_dissector_symmetric_keys[] = { ++ { ++ .key_id = FLOW_DISSECTOR_KEY_CONTROL, ++ .offset = offsetof(struct flow_keys, control), ++ }, ++ { ++ .key_id = FLOW_DISSECTOR_KEY_BASIC, ++ .offset = offsetof(struct flow_keys, basic), ++ }, ++ { ++ .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS, ++ .offset = offsetof(struct flow_keys, addrs.v4addrs), ++ }, ++ { ++ .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS, ++ .offset = offsetof(struct flow_keys, addrs.v6addrs), ++ }, ++ { ++ .key_id = FLOW_DISSECTOR_KEY_PORTS, ++ .offset = offsetof(struct flow_keys, ports), ++ }, ++}; ++ + static const struct flow_dissector_key flow_keys_buf_dissector_keys[] = { + { + .key_id = FLOW_DISSECTOR_KEY_CONTROL, +@@ -889,6 +929,9 @@ static int __init init_default_flow_dissectors(void) + skb_flow_dissector_init(&flow_keys_dissector, + flow_keys_dissector_keys, + ARRAY_SIZE(flow_keys_dissector_keys)); ++ skb_flow_dissector_init(&flow_keys_dissector_symmetric, ++ flow_keys_dissector_symmetric_keys, ++ ARRAY_SIZE(flow_keys_dissector_symmetric_keys)); + skb_flow_dissector_init(&flow_keys_buf_dissector, + flow_keys_buf_dissector_keys, + ARRAY_SIZE(flow_keys_buf_dissector_keys)); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index e561f9f..59bf4d7 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3016,24 +3016,6 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, + EXPORT_SYMBOL_GPL(skb_append_pagefrags); + + /** +- * skb_push_rcsum - push skb and update receive checksum +- * @skb: buffer to update +- * @len: length of data pulled +- * +- * This function performs an skb_push on the packet and updates +- * the CHECKSUM_COMPLETE checksum. It should be used on +- * receive path processing instead of skb_push unless you know +- * that the checksum difference is zero (e.g., a valid IP header) +- * or you are setting ip_summed to CHECKSUM_NONE. +- */ +-static unsigned char *skb_push_rcsum(struct sk_buff *skb, unsigned len) +-{ +- skb_push(skb, len); +- skb_postpush_rcsum(skb, skb->data, len); +- return skb->data; +-} +- +-/** + * skb_pull_rcsum - pull skb and update receive checksum + * @skb: buffer to update + * @len: length of data pulled +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index ea071fa..c26fac2 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -177,6 +177,7 @@ static void rt6_free_pcpu(struct rt6_info *non_pcpu_rt) + } + } + ++ free_percpu(non_pcpu_rt->rt6i_pcpu); + non_pcpu_rt->rt6i_pcpu = NULL; + } + +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index d32cefc..34a5712 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -150,19 +150,26 @@ u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata) + void mesh_sta_cleanup(struct sta_info *sta) + { + struct ieee80211_sub_if_data *sdata = sta->sdata; +- u32 changed; ++ u32 changed = 0; + + /* + * maybe userspace handles peer allocation and peering, but in either + * case the beacon is still generated by the kernel and we might need + * an update. + */ +- changed = mesh_accept_plinks_update(sdata); ++ if (sdata->u.mesh.user_mpm && ++ sta->mesh->plink_state == NL80211_PLINK_ESTAB) ++ changed |= mesh_plink_dec_estab_count(sdata); ++ changed |= mesh_accept_plinks_update(sdata); + if (!sdata->u.mesh.user_mpm) { + changed |= mesh_plink_deactivate(sta); + del_timer_sync(&sta->mesh->plink_timer); + } + ++ /* make sure no readers can access nexthop sta from here on */ ++ mesh_path_flush_by_nexthop(sta); ++ synchronize_net(); ++ + if (changed) + ieee80211_mbss_info_change_notify(sdata, changed); + } +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index 62193f4..ba7ce53 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -275,7 +275,7 @@ struct ieee80211_fast_tx { + u8 sa_offs, da_offs, pn_offs; + u8 band; + u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV + +- sizeof(rfc1042_header)]; ++ sizeof(rfc1042_header)] __aligned(2); + + struct rcu_head rcu_head; + }; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 18d0bec..8012f67 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1340,7 +1340,7 @@ static unsigned int fanout_demux_hash(struct packet_fanout *f, + struct sk_buff *skb, + unsigned int num) + { +- return reciprocal_scale(skb_get_hash(skb), num); ++ return reciprocal_scale(__skb_get_hash_symmetric(skb), num); + } + + static unsigned int fanout_demux_lb(struct packet_fanout *f, +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 8f3948d..934336e 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -180,7 +180,7 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a, + + if (!(at & AT_EGRESS)) { + if (m->tcfm_ok_push) +- skb_push(skb2, skb->mac_len); ++ skb_push_rcsum(skb2, skb->mac_len); + } + + /* mirror is always swallowed */ +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 7e0c9bf..837dd91 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -446,16 +446,27 @@ out_no_rpciod: + return ERR_PTR(err); + } + +-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, ++static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, + struct rpc_xprt *xprt) + { + struct rpc_clnt *clnt = NULL; + struct rpc_xprt_switch *xps; + +- xps = xprt_switch_alloc(xprt, GFP_KERNEL); +- if (xps == NULL) +- return ERR_PTR(-ENOMEM); +- ++ if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) { ++ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP); ++ xps = args->bc_xprt->xpt_bc_xps; ++ xprt_switch_get(xps); ++ } else { ++ xps = xprt_switch_alloc(xprt, GFP_KERNEL); ++ if (xps == NULL) { ++ xprt_put(xprt); ++ return ERR_PTR(-ENOMEM); ++ } ++ if (xprt->bc_xprt) { ++ xprt_switch_get(xps); ++ xprt->bc_xprt->xpt_bc_xps = xps; ++ } ++ } + clnt = rpc_new_client(args, xps, xprt, NULL); + if (IS_ERR(clnt)) + return clnt; +@@ -483,7 +494,6 @@ struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, + + return clnt; + } +-EXPORT_SYMBOL_GPL(rpc_create_xprt); + + /** + * rpc_create - create an RPC client and transport with one call +@@ -509,6 +519,15 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args) + }; + char servername[48]; + ++ if (args->bc_xprt) { ++ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP); ++ xprt = args->bc_xprt->xpt_bc_xprt; ++ if (xprt) { ++ xprt_get(xprt); ++ return rpc_create_xprt(args, xprt); ++ } ++ } ++ + if (args->flags & RPC_CLNT_CREATE_INFINITE_SLOTS) + xprtargs.flags |= XPRT_CREATE_INFINITE_SLOTS; + if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT) +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 7422f28..7231cb4 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *kref) + /* See comment on corresponding get in xs_setup_bc_tcp(): */ + if (xprt->xpt_bc_xprt) + xprt_put(xprt->xpt_bc_xprt); ++ if (xprt->xpt_bc_xps) ++ xprt_switch_put(xprt->xpt_bc_xps); + xprt->xpt_ops->xpo_free(xprt); + module_put(owner); + } +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 65e7595..e9e5dd0 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -3050,6 +3050,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args) + return xprt; + + args->bc_xprt->xpt_bc_xprt = NULL; ++ args->bc_xprt->xpt_bc_xps = NULL; + xprt_put(xprt); + ret = ERR_PTR(-EINVAL); + out_err: +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 8269da7..7748199 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -315,7 +315,7 @@ static struct sock *unix_find_socket_byinode(struct inode *i) + &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) { + struct dentry *dentry = unix_sk(s)->path.dentry; + +- if (dentry && d_backing_inode(dentry) == i) { ++ if (dentry && d_real_inode(dentry) == i) { + sock_hold(s); + goto found; + } +@@ -911,7 +911,7 @@ static struct sock *unix_find_other(struct net *net, + err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path); + if (err) + goto fail; +- inode = d_backing_inode(path.dentry); ++ inode = d_real_inode(path.dentry); + err = inode_permission(inode, MAY_WRITE); + if (err) + goto put_fail; +@@ -1048,7 +1048,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out_up; + } + addr->hash = UNIX_HASH_SIZE; +- hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1); ++ hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1); + spin_lock(&unix_table_lock); + u->path = u_path; + list = &unix_socket_table[hash]; +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 9f1c4aa..c878045 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -360,8 +360,6 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, + WARN_ON(ops->remain_on_channel && !ops->cancel_remain_on_channel); + WARN_ON(ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch); + WARN_ON(ops->add_tx_ts && !ops->del_tx_ts); +- WARN_ON(ops->set_tx_power && !ops->get_tx_power); +- WARN_ON(ops->set_antenna && !ops->get_antenna); + + alloc_size = sizeof(*rdev) + sizeof_priv; + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 9f440a9..47b9178 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr, + * replace EtherType */ + hdrlen += ETH_ALEN + 2; + else +- tmp.h_proto = htons(skb->len); ++ tmp.h_proto = htons(skb->len - hdrlen); + + pskb_pull(skb, hdrlen); + +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index a915507..fec7578 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -384,7 +384,7 @@ static void do_of_entry_multi(void *symval, struct module *mod) + len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*", + (*type)[0] ? *type : "*"); + +- if (compatible[0]) ++ if ((*compatible)[0]) + sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "", + *compatible); + +diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c +index dec607c..5ee8201 100644 +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -523,34 +523,34 @@ static int apparmor_setprocattr(struct task_struct *task, char *name, + { + struct common_audit_data sa; + struct apparmor_audit_data aad = {0,}; +- char *command, *args = value; ++ char *command, *largs = NULL, *args = value; + size_t arg_size; + int error; + + if (size == 0) + return -EINVAL; +- /* args points to a PAGE_SIZE buffer, AppArmor requires that +- * the buffer must be null terminated or have size <= PAGE_SIZE -1 +- * so that AppArmor can null terminate them +- */ +- if (args[size - 1] != '\0') { +- if (size == PAGE_SIZE) +- return -EINVAL; +- args[size] = '\0'; +- } +- + /* task can only write its own attributes */ + if (current != task) + return -EACCES; + +- args = value; ++ /* AppArmor requires that the buffer must be null terminated atm */ ++ if (args[size - 1] != '\0') { ++ /* null terminate */ ++ largs = args = kmalloc(size + 1, GFP_KERNEL); ++ if (!args) ++ return -ENOMEM; ++ memcpy(args, value, size); ++ args[size] = '\0'; ++ } ++ ++ error = -EINVAL; + args = strim(args); + command = strsep(&args, " "); + if (!args) +- return -EINVAL; ++ goto out; + args = skip_spaces(args); + if (!*args) +- return -EINVAL; ++ goto out; + + arg_size = size - (args - (char *) value); + if (strcmp(name, "current") == 0) { +@@ -576,10 +576,12 @@ static int apparmor_setprocattr(struct task_struct *task, char *name, + goto fail; + } else + /* only support the "current" and "exec" process attributes */ +- return -EINVAL; ++ goto fail; + + if (!error) + error = size; ++out: ++ kfree(largs); + return error; + + fail: +@@ -588,9 +590,9 @@ fail: + aad.profile = aa_current_profile(); + aad.op = OP_SETPROCATTR; + aad.info = name; +- aad.error = -EINVAL; ++ aad.error = error = -EINVAL; + aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); +- return -EINVAL; ++ goto out; + } + + static int apparmor_task_setrlimit(struct task_struct *task, +diff --git a/security/keys/key.c b/security/keys/key.c +index b287551..af7f682 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -584,7 +584,7 @@ int key_reject_and_link(struct key *key, + + mutex_unlock(&key_construction_mutex); + +- if (keyring) ++ if (keyring && link_ret == 0) + __key_link_end(keyring, &key->index_key, edit); + + /* wake up anyone waiting for a key to be constructed */ +diff --git a/sound/core/control.c b/sound/core/control.c +index a85d455..b4fe9b0 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask, + + if (snd_BUG_ON(!card || !id)) + return; ++ if (card->shutdown) ++ return; + read_lock(&card->ctl_files_rwlock); + #if IS_ENABLED(CONFIG_SND_MIXER_OSS) + card->mixer_oss_change_count++; +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index 308c9ec..8e980aa 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card *card, const char *id, int device, + } + EXPORT_SYMBOL(snd_pcm_new_internal); + ++static void free_chmap(struct snd_pcm_str *pstr) ++{ ++ if (pstr->chmap_kctl) { ++ snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); ++ pstr->chmap_kctl = NULL; ++ } ++} ++ + static void snd_pcm_free_stream(struct snd_pcm_str * pstr) + { + struct snd_pcm_substream *substream, *substream_next; +@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr) + kfree(setup); + } + #endif ++ free_chmap(pstr); + if (pstr->substream_count) + put_device(&pstr->dev); + } +@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(struct snd_device *device) + for (cidx = 0; cidx < 2; cidx++) { + if (!pcm->internal) + snd_unregister_device(&pcm->streams[cidx].dev); +- if (pcm->streams[cidx].chmap_kctl) { +- snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl); +- pcm->streams[cidx].chmap_kctl = NULL; +- } ++ free_chmap(&pcm->streams[cidx]); + } + mutex_unlock(&pcm->open_mutex); + mutex_unlock(®ister_mutex); +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 6469bed..23b73f6 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1954,6 +1954,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + + qhead = tu->qhead++; + tu->qhead %= tu->queue_size; ++ tu->qused--; + spin_unlock_irq(&tu->qlock); + + if (tu->tread) { +@@ -1967,7 +1968,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + } + + spin_lock_irq(&tu->qlock); +- tu->qused--; + if (err < 0) + goto _error; + result += unit; +diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c +index c0f8f61..172dacd 100644 +--- a/sound/drivers/dummy.c ++++ b/sound/drivers/dummy.c +@@ -420,6 +420,7 @@ static int dummy_hrtimer_stop(struct snd_pcm_substream *substream) + + static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm) + { ++ hrtimer_cancel(&dpcm->timer); + tasklet_kill(&dpcm->tasklet); + } + +diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c +index 87041dd..47a358f 100644 +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -444,7 +444,7 @@ int snd_hdac_regmap_write_raw(struct hdac_device *codec, unsigned int reg, + err = reg_raw_write(codec, reg, val); + if (err == -EAGAIN) { + err = snd_hdac_power_up_pm(codec); +- if (!err) ++ if (err >= 0) + err = reg_raw_write(codec, reg, val); + snd_hdac_power_down_pm(codec); + } +@@ -470,7 +470,7 @@ static int __snd_hdac_regmap_read_raw(struct hdac_device *codec, + err = reg_raw_read(codec, reg, val, uncached); + if (err == -EAGAIN) { + err = snd_hdac_power_up_pm(codec); +- if (!err) ++ if (err >= 0) + err = reg_raw_read(codec, reg, val, uncached); + snd_hdac_power_down_pm(codec); + } +diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c +index 4667c32..7417718 100644 +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -1444,9 +1444,8 @@ static int vortex_wtdma_bufshift(vortex_t * vortex, int wtdma) + int page, p, pp, delta, i; + + page = +- (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) & +- WT_SUBBUF_MASK) +- >> WT_SUBBUF_SHIFT; ++ (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) ++ >> WT_SUBBUF_SHIFT) & WT_SUBBUF_MASK; + if (dma->nr_periods >= 4) + delta = (page - dma->period_real) & 3; + else { +diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c +index 1cb85ae..286f5e3 100644 +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -2200,11 +2200,11 @@ static int snd_echo_resume(struct device *dev) + u32 pipe_alloc_mask; + int err; + +- commpage_bak = kmalloc(sizeof(struct echoaudio), GFP_KERNEL); ++ commpage_bak = kmalloc(sizeof(*commpage), GFP_KERNEL); + if (commpage_bak == NULL) + return -ENOMEM; + commpage = chip->comm_page; +- memcpy(commpage_bak, commpage, sizeof(struct comm_page)); ++ memcpy(commpage_bak, commpage, sizeof(*commpage)); + + err = init_hw(chip, chip->pci->device, chip->pci->subsystem_device); + if (err < 0) { +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index dfaf1a9..d77cc76 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -3977,6 +3977,8 @@ static hda_nid_t set_path_power(struct hda_codec *codec, hda_nid_t nid, + + for (n = 0; n < spec->paths.used; n++) { + path = snd_array_elem(&spec->paths, n); ++ if (!path->depth) ++ continue; + if (path->path[0] == nid || + path->path[path->depth - 1] == nid) { + bool pin_old = path->pin_enabled; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 94089fc..6f8ea13 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -367,9 +367,10 @@ enum { + #define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70) + #define IS_KBL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa171) + #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71) ++#define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0) + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) + #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \ +- IS_KBL(pci) || IS_KBL_LP(pci) ++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", +@@ -1217,8 +1218,10 @@ static int azx_free(struct azx *chip) + if (use_vga_switcheroo(hda)) { + if (chip->disabled && hda->probe_continued) + snd_hda_unlock_devices(&chip->bus); +- if (hda->vga_switcheroo_registered) ++ if (hda->vga_switcheroo_registered) { + vga_switcheroo_unregister_client(chip->pci); ++ vga_switcheroo_fini_domain_pm_ops(chip->card->dev); ++ } + } + + if (bus->chip_init) { +@@ -2190,6 +2193,9 @@ static const struct pci_device_id azx_ids[] = { + /* Kabylake-LP */ + { PCI_DEVICE(0x8086, 0x9d71), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, ++ /* Kabylake-H */ ++ { PCI_DEVICE(0x8086, 0xa2f0), ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, +@@ -2263,6 +2269,8 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x157a), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, ++ { PCI_DEVICE(0x1002, 0x15b3), ++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x793b), + .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI }, + { PCI_DEVICE(0x1002, 0x7919), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0fe18ed..abcb5a6 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5650,6 +5650,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), ++ SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460), ++ SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460), ++ SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), +@@ -5735,7 +5738,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {} + }; + #define ALC225_STANDARD_PINS \ +- {0x12, 0xb7a60130}, \ + {0x21, 0x04211020} + + #define ALC256_STANDARD_PINS \ +@@ -5760,10 +5762,24 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, + {0x14, 0x901701a0}), + SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, + {0x14, 0x901701b0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60150}, ++ {0x14, 0x901701a0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60150}, ++ {0x14, 0x901701b0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, ++ {0x1b, 0x90170110}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE, + {0x14, 0x90170110}, + {0x21, 0x02211020}), +@@ -5832,6 +5848,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x90a60170}, ++ {0x14, 0x90170120}, ++ {0x21, 0x02211030}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC256_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, + {0x12, 0x90a60130}, +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 3fc6358..2d49350 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -552,7 +552,6 @@ static int usb_audio_probe(struct usb_interface *intf, + goto __error; + } + chip = usb_chip[i]; +- dev_set_drvdata(&dev->dev, chip); + atomic_inc(&chip->active); /* avoid autopm */ + break; + } +@@ -578,6 +577,7 @@ static int usb_audio_probe(struct usb_interface *intf, + goto __error; + } + } ++ dev_set_drvdata(&dev->dev, chip); + + /* + * For devices with more than one control interface, we assume the +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 4fd482f..7cb1224 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2868,7 +2868,7 @@ static long kvm_vm_ioctl(struct file *filp, + if (copy_from_user(&routing, argp, sizeof(routing))) + goto out; + r = -EINVAL; +- if (routing.nr >= KVM_MAX_IRQ_ROUTES) ++ if (routing.nr > KVM_MAX_IRQ_ROUTES) + goto out; + if (routing.flags) + goto out; |