diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2016-08-22 19:28:53 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2016-08-22 19:28:53 -0400 |
| commit | d944130d7f18157ffd062622fe16340d4f456677 (patch) | |
| tree | e7e1612f73b6b4ae78ed91ef65c4b94be7637616 | |
| parent | Linux patch 4.1.30 (diff) | |
| download | linux-patches-4.1-37.tar.gz linux-patches-4.1-37.tar.bz2 linux-patches-4.1-37.zip | |
Linux patch 4.1.314.1-37
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1030_linux-4.1.31.patch | 6882 |
2 files changed, 6886 insertions, 0 deletions
diff --git a/0000_README b/0000_README index f04d74d3..0ce7ab6a 100644 --- a/0000_README +++ b/0000_README @@ -163,6 +163,10 @@ Patch: 1029_linux-4.1.30.patch From: http://www.kernel.org Desc: Linux 4.1.30 +Patch: 1030_linux-4.1.31.patch +From: http://www.kernel.org +Desc: Linux 4.1.31 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1030_linux-4.1.31.patch b/1030_linux-4.1.31.patch new file mode 100644 index 00000000..c3197a68 --- /dev/null +++ b/1030_linux-4.1.31.patch @@ -0,0 +1,6882 @@ +diff --git a/.mailmap b/.mailmap +index 6287004040e7..d4b4748bab36 100644 +--- a/.mailmap ++++ b/.mailmap +@@ -80,6 +80,7 @@ Leonid I Ananiev <leonid.i.ananiev@intel.com> + Linas Vepstas <linas@austin.ibm.com> + Mark Brown <broonie@sirena.org.uk> + Matthieu CASTET <castet.matthieu@free.fr> ++Mauro Carvalho Chehab <mchehab@kernel.org> <maurochehab@gmail.com> <mchehab@infradead.org> <mchehab@redhat.com> <m.chehab@samsung.com> <mchehab@osg.samsung.com> <mchehab@s-opensource.com> + Mayuresh Janorkar <mayur@ti.com> + Michael Buesch <m@bues.ch> + Michel Dänzer <michel@tungstengraphics.com> +diff --git a/CREDITS b/CREDITS +index ec7e6c7fdd1b..a830a8622417 100644 +--- a/CREDITS ++++ b/CREDITS +@@ -644,6 +644,7 @@ D: Configure, Menuconfig, xconfig + + N: Mauro Carvalho Chehab + E: m.chehab@samsung.org ++E: mchehab@osg.samsung.com + E: mchehab@infradead.org + D: Media subsystem (V4L/DVB) drivers and core + D: EDAC drivers and EDAC 3.0 core rework +diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +index 6708c5e264aa..33e96f740639 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 ++++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +@@ -1,4 +1,4 @@ +-What /sys/bus/iio/devices/iio:deviceX/in_proximity_raw ++What /sys/bus/iio/devices/iio:deviceX/in_proximity_input + Date: March 2014 + KernelVersion: 3.15 + Contact: Matt Ranostay <mranostay@gmail.com> +diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt +index c72702ec1ded..aacf1ce73b8a 100644 +--- a/Documentation/module-signing.txt ++++ b/Documentation/module-signing.txt +@@ -239,3 +239,9 @@ Since the private key is used to sign modules, viruses and malware could use + the private key to sign modules and compromise the operating system. The + private key must be either destroyed or moved to a secure location and not kept + in the root node of the kernel source tree. ++ ++If you use the same private key to sign modules for multiple kernel ++configurations, you must ensure that the module version information is ++sufficient to prevent loading a module into a different kernel. Either ++set CONFIG_MODVERSIONS=y or ensure that each configuration has a different ++kernel release string by changing EXTRAVERSION or CONFIG_LOCALVERSION. +diff --git a/MAINTAINERS b/MAINTAINERS +index a1d127a83a48..ecd0eb88f51a 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -1913,7 +1913,8 @@ F: include/net/ax25.h + F: net/ax25/ + + AZ6007 DVB DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -2318,7 +2319,8 @@ F: Documentation/filesystems/btrfs.txt + F: fs/btrfs/ + + BTTV VIDEO4LINUX DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -2882,7 +2884,8 @@ F: drivers/media/common/cx2341x* + F: include/media/cx2341x* + + CX88 VIDEO4LINUX DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -3614,7 +3617,8 @@ F: fs/ecryptfs/ + EDAC-CORE + M: Doug Thompson <dougthompson@xmission.com> + M: Borislav Petkov <bp@alien8.de> +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + T: git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git#for-next +@@ -3665,7 +3669,8 @@ S: Maintained + F: drivers/edac/e7xxx_edac.c + + EDAC-GHES +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + S: Maintained +@@ -3693,21 +3698,24 @@ S: Maintained + F: drivers/edac/i5000_edac.c + + EDAC-I5400 +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + S: Maintained + F: drivers/edac/i5400_edac.c + + EDAC-I7300 +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + S: Maintained + F: drivers/edac/i7300_edac.c + + EDAC-I7CORE +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + S: Maintained +@@ -3750,7 +3758,8 @@ S: Maintained + F: drivers/edac/r82600_edac.c + + EDAC-SBRIDGE +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-edac@vger.kernel.org + W: bluesmoke.sourceforge.net + S: Maintained +@@ -3810,7 +3819,8 @@ S: Maintained + F: drivers/net/ethernet/ibm/ehea/ + + EM28XX VIDEO4LINUX DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -6345,7 +6355,8 @@ S: Maintained + F: drivers/media/radio/radio-maxiradio* + + MEDIA INPUT INFRASTRUCTURE (V4L/DVB) +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + P: LinuxTV.org Project + L: linux-media@vger.kernel.org + W: http://linuxtv.org +@@ -8502,7 +8513,8 @@ S: Odd Fixes + F: drivers/media/i2c/saa6588* + + SAA7134 VIDEO4LINUX DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -8947,7 +8959,8 @@ S: Maintained + F: drivers/media/radio/si4713/radio-usb-si4713.c + + SIANO DVB DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -9695,7 +9708,8 @@ S: Maintained + F: drivers/media/i2c/tda9840* + + TEA5761 TUNER DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -9703,7 +9717,8 @@ S: Odd fixes + F: drivers/media/tuners/tea5761.* + + TEA5767 TUNER DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -10042,7 +10057,8 @@ F: include/linux/shmem_fs.h + F: mm/shmem.c + + TM6000 VIDEO4LINUX DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +@@ -10900,7 +10916,8 @@ S: Maintained + F: arch/x86/vdso/ + + XC2028/3028 TUNER DRIVER +-M: Mauro Carvalho Chehab <mchehab@osg.samsung.com> ++M: Mauro Carvalho Chehab <mchehab@s-opensource.com> ++M: Mauro Carvalho Chehab <mchehab@kernel.org> + L: linux-media@vger.kernel.org + W: http://linuxtv.org + T: git git://linuxtv.org/media_tree.git +diff --git a/Makefile b/Makefile +index 137679c0cc49..bea5ca2ca2b0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 1 +-SUBLEVEL = 30 ++SUBLEVEL = 31 + EXTRAVERSION = + NAME = Series 4800 + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index 9615fe1701c6..09c549826c5f 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -96,7 +96,7 @@ + #define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE) + + /* Set of bits not changed in pte_modify */ +-#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED) ++#define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_SPECIAL) + + /* More Abbrevaited helpers */ + #define PAGE_U_NONE __pgprot(___DEF) +diff --git a/arch/arm/boot/dts/sun4i-a10-a1000.dts b/arch/arm/boot/dts/sun4i-a10-a1000.dts +index b67e5be618cf..28b6b0e46e63 100644 +--- a/arch/arm/boot/dts/sun4i-a10-a1000.dts ++++ b/arch/arm/boot/dts/sun4i-a10-a1000.dts +@@ -178,6 +178,7 @@ + regulator-name = "emac-3v3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ startup-delay-us = <20000>; + enable-active-high; + gpio = <&pio 7 15 GPIO_ACTIVE_HIGH>; + }; +diff --git a/arch/arm/boot/dts/sun4i-a10-hackberry.dts b/arch/arm/boot/dts/sun4i-a10-hackberry.dts +index d3f73ea25567..864acaa00c9e 100644 +--- a/arch/arm/boot/dts/sun4i-a10-hackberry.dts ++++ b/arch/arm/boot/dts/sun4i-a10-hackberry.dts +@@ -159,6 +159,7 @@ + regulator-name = "emac-3v3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; ++ startup-delay-us = <20000>; + enable-active-high; + gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>; + }; +diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h +index d4264bb0a409..7cc281d94769 100644 +--- a/arch/arm64/include/asm/ptrace.h ++++ b/arch/arm64/include/asm/ptrace.h +@@ -58,6 +58,7 @@ + #define COMPAT_PSR_Z_BIT 0x40000000 + #define COMPAT_PSR_N_BIT 0x80000000 + #define COMPAT_PSR_IT_MASK 0x0600fc00 /* If-Then execution state mask */ ++#define COMPAT_PSR_GE_MASK 0x000f0000 + + #ifdef CONFIG_CPU_BIG_ENDIAN + #define COMPAT_PSR_ENDSTATE COMPAT_PSR_E_BIT +@@ -116,6 +117,8 @@ struct pt_regs { + }; + u64 orig_x0; + u64 syscallno; ++ u64 orig_addr_limit; ++ u64 unused; // maintain 16 byte alignment + }; + + #define arch_has_single_step() (1) +@@ -151,35 +154,9 @@ static inline unsigned long regs_return_value(struct pt_regs *regs) + return regs->regs[0]; + } + +-/* +- * Are the current registers suitable for user mode? (used to maintain +- * security in signal handlers) +- */ +-static inline int valid_user_regs(struct user_pt_regs *regs) +-{ +- if (user_mode(regs) && (regs->pstate & PSR_I_BIT) == 0) { +- regs->pstate &= ~(PSR_F_BIT | PSR_A_BIT); +- +- /* The T bit is reserved for AArch64 */ +- if (!(regs->pstate & PSR_MODE32_BIT)) +- regs->pstate &= ~COMPAT_PSR_T_BIT; +- +- return 1; +- } +- +- /* +- * Force PSR to something logical... +- */ +- regs->pstate &= PSR_f | PSR_s | (PSR_x & ~PSR_A_BIT) | \ +- COMPAT_PSR_T_BIT | PSR_MODE32_BIT; +- +- if (!(regs->pstate & PSR_MODE32_BIT)) { +- regs->pstate &= ~COMPAT_PSR_T_BIT; +- regs->pstate |= PSR_MODE_EL0t; +- } +- +- return 0; +-} ++/* We must avoid circular header include via sched.h */ ++struct task_struct; ++int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task); + + #define instruction_pointer(regs) ((unsigned long)(regs)->pc) + +diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c +index da675cc5dfae..4106ac64f95e 100644 +--- a/arch/arm64/kernel/asm-offsets.c ++++ b/arch/arm64/kernel/asm-offsets.c +@@ -58,6 +58,7 @@ int main(void) + DEFINE(S_PC, offsetof(struct pt_regs, pc)); + DEFINE(S_ORIG_X0, offsetof(struct pt_regs, orig_x0)); + DEFINE(S_SYSCALLNO, offsetof(struct pt_regs, syscallno)); ++ DEFINE(S_ORIG_ADDR_LIMIT, offsetof(struct pt_regs, orig_addr_limit)); + DEFINE(S_FRAME_SIZE, sizeof(struct pt_regs)); + BLANK(); + DEFINE(MM_CONTEXT_ID, offsetof(struct mm_struct, context.id)); +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 0d1d675f2cce..00ced919fa5a 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -150,7 +150,6 @@ static int debug_monitors_init(void) + /* Clear the OS lock. */ + on_each_cpu(clear_os_lock, NULL, 1); + isb(); +- local_dbg_enable(); + + /* Register hotplug handler. */ + __register_cpu_notifier(&os_lock_nb); +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index bddd04d031db..05012cdb555f 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -27,6 +27,7 @@ + #include <asm/cpufeature.h> + #include <asm/errno.h> + #include <asm/esr.h> ++#include <asm/memory.h> + #include <asm/thread_info.h> + #include <asm/unistd.h> + +@@ -93,7 +94,13 @@ + disable_step_tsk x19, x20 // exceptions when scheduling. + .else + add x21, sp, #S_FRAME_SIZE +- .endif ++ get_thread_info tsk ++ /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */ ++ ldr x20, [tsk, #TI_ADDR_LIMIT] ++ str x20, [sp, #S_ORIG_ADDR_LIMIT] ++ mov x20, #TASK_SIZE_64 ++ str x20, [tsk, #TI_ADDR_LIMIT] ++ .endif /* \el == 0 */ + mrs x22, elr_el1 + mrs x23, spsr_el1 + stp lr, x21, [sp, #S_LR] +@@ -117,6 +124,12 @@ + .endm + + .macro kernel_exit, el, ret = 0 ++ .if \el != 0 ++ /* Restore the task's original addr_limit. */ ++ ldr x20, [sp, #S_ORIG_ADDR_LIMIT] ++ str x20, [tsk, #TI_ADDR_LIMIT] ++ .endif ++ + ldp x21, x22, [sp, #S_PC] // load ELR, SPSR + .if \el == 0 + ct_user_enter +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 608ac6aa497b..7038b9a3b42c 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -39,6 +39,7 @@ + #include <linux/elf.h> + + #include <asm/compat.h> ++#include <asm/cpufeature.h> + #include <asm/debug-monitors.h> + #include <asm/pgtable.h> + #include <asm/syscall.h> +@@ -500,7 +501,7 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset, + if (ret) + return ret; + +- if (!valid_user_regs(&newregs)) ++ if (!valid_user_regs(&newregs, target)) + return -EINVAL; + + task_pt_regs(target)->user_regs = newregs; +@@ -770,7 +771,7 @@ static int compat_gpr_set(struct task_struct *target, + + } + +- if (valid_user_regs(&newregs.user_regs)) ++ if (valid_user_regs(&newregs.user_regs, target)) + *task_pt_regs(target) = newregs; + else + ret = -EINVAL; +@@ -1182,3 +1183,79 @@ asmlinkage void syscall_trace_exit(struct pt_regs *regs) + if (test_thread_flag(TIF_SYSCALL_TRACE)) + tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT); + } ++ ++/* ++ * Bits which are always architecturally RES0 per ARM DDI 0487A.h ++ * Userspace cannot use these until they have an architectural meaning. ++ * We also reserve IL for the kernel; SS is handled dynamically. ++ */ ++#define SPSR_EL1_AARCH64_RES0_BITS \ ++ (GENMASK_ULL(63,32) | GENMASK_ULL(27, 22) | GENMASK_ULL(20, 10) | \ ++ GENMASK_ULL(5, 5)) ++#define SPSR_EL1_AARCH32_RES0_BITS \ ++ (GENMASK_ULL(63,32) | GENMASK_ULL(24, 22) | GENMASK_ULL(20,20)) ++ ++static int valid_compat_regs(struct user_pt_regs *regs) ++{ ++ regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS; ++ ++ if (!system_supports_mixed_endian_el0()) { ++ if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) ++ regs->pstate |= COMPAT_PSR_E_BIT; ++ else ++ regs->pstate &= ~COMPAT_PSR_E_BIT; ++ } ++ ++ if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) && ++ (regs->pstate & COMPAT_PSR_A_BIT) == 0 && ++ (regs->pstate & COMPAT_PSR_I_BIT) == 0 && ++ (regs->pstate & COMPAT_PSR_F_BIT) == 0) { ++ return 1; ++ } ++ ++ /* ++ * Force PSR to a valid 32-bit EL0t, preserving the same bits as ++ * arch/arm. ++ */ ++ regs->pstate &= COMPAT_PSR_N_BIT | COMPAT_PSR_Z_BIT | ++ COMPAT_PSR_C_BIT | COMPAT_PSR_V_BIT | ++ COMPAT_PSR_Q_BIT | COMPAT_PSR_IT_MASK | ++ COMPAT_PSR_GE_MASK | COMPAT_PSR_E_BIT | ++ COMPAT_PSR_T_BIT; ++ regs->pstate |= PSR_MODE32_BIT; ++ ++ return 0; ++} ++ ++static int valid_native_regs(struct user_pt_regs *regs) ++{ ++ regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS; ++ ++ if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) && ++ (regs->pstate & PSR_D_BIT) == 0 && ++ (regs->pstate & PSR_A_BIT) == 0 && ++ (regs->pstate & PSR_I_BIT) == 0 && ++ (regs->pstate & PSR_F_BIT) == 0) { ++ return 1; ++ } ++ ++ /* Force PSR to a valid 64-bit EL0t */ ++ regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT; ++ ++ return 0; ++} ++ ++/* ++ * Are the current registers suitable for user mode? (used to maintain ++ * security in signal handlers) ++ */ ++int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task) ++{ ++ if (!test_tsk_thread_flag(task, TIF_SINGLESTEP)) ++ regs->pstate &= ~DBG_SPSR_SS; ++ ++ if (is_compat_thread(task_thread_info(task))) ++ return valid_compat_regs(regs); ++ else ++ return valid_native_regs(regs); ++} +diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c +index e18c48cb6db1..a8eafdbc7cb8 100644 +--- a/arch/arm64/kernel/signal.c ++++ b/arch/arm64/kernel/signal.c +@@ -115,7 +115,7 @@ static int restore_sigframe(struct pt_regs *regs, + */ + regs->syscallno = ~0UL; + +- err |= !valid_user_regs(®s->user_regs); ++ err |= !valid_user_regs(®s->user_regs, current); + + if (err == 0) { + struct fpsimd_context *fpsimd_ctx = +@@ -307,7 +307,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs) + /* + * Check that the resulting registers are actually sane. + */ +- ret |= !valid_user_regs(®s->user_regs); ++ ret |= !valid_user_regs(®s->user_regs, current); + + /* + * Fast forward the stepping logic so we step into the signal +diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c +index c58aee062590..bb3ba4aab30a 100644 +--- a/arch/arm64/kernel/signal32.c ++++ b/arch/arm64/kernel/signal32.c +@@ -356,7 +356,7 @@ static int compat_restore_sigframe(struct pt_regs *regs, + */ + regs->syscallno = ~0UL; + +- err |= !valid_user_regs(®s->user_regs); ++ err |= !valid_user_regs(®s->user_regs, current); + + aux = (struct compat_aux_sigframe __user *) sf->uc.uc_regspace; + if (err == 0) +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index d3a202b85ba6..edf73a6e16a8 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -179,7 +179,6 @@ asmlinkage void secondary_start_kernel(void) + set_cpu_online(cpu, true); + complete(&cpu_running); + +- local_dbg_enable(); + local_irq_enable(); + local_async_enable(); + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index d253908a988d..262c8ec55790 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -205,6 +205,8 @@ ENTRY(__cpu_setup) + msr cpacr_el1, x0 // Enable FP/ASIMD + mov x0, #1 << 12 // Reset mdscr_el1 and disable + msr mdscr_el1, x0 // access to the DCC from EL0 ++ isb // Unmask debug exceptions now, ++ enable_dbg // since this is per-cpu + reset_pmuserenr_el0 x0 // Disable PMU access from EL0 + /* + * Memory region attributes for LPAE: +diff --git a/arch/metag/include/asm/cmpxchg_lnkget.h b/arch/metag/include/asm/cmpxchg_lnkget.h +index 0154e2807ebb..2369ad394876 100644 +--- a/arch/metag/include/asm/cmpxchg_lnkget.h ++++ b/arch/metag/include/asm/cmpxchg_lnkget.h +@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u32(volatile int *m, unsigned long old, + " DCACHE [%2], %0\n" + #endif + "2:\n" +- : "=&d" (temp), "=&da" (retval) ++ : "=&d" (temp), "=&d" (retval) + : "da" (m), "bd" (old), "da" (new) + : "cc" + ); +diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c +index e5ed7ada1433..3a317e1ede71 100644 +--- a/arch/mips/kernel/csrc-r4k.c ++++ b/arch/mips/kernel/csrc-r4k.c +@@ -23,7 +23,7 @@ static struct clocksource clocksource_mips = { + .flags = CLOCK_SOURCE_IS_CONTINUOUS, + }; + +-static u64 notrace r4k_read_sched_clock(void) ++static u64 __maybe_unused notrace r4k_read_sched_clock(void) + { + return read_c0_count(); + } +@@ -38,7 +38,9 @@ int __init init_r4k_clocksource(void) + + clocksource_register_hz(&clocksource_mips, mips_hpt_frequency); + ++#ifndef CONFIG_CPU_FREQ + sched_clock_register(r4k_read_sched_clock, 32, mips_hpt_frequency); ++#endif + + return 0; + } +diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S +index 4b2010654c46..97fa4c7b9a5e 100644 +--- a/arch/mips/kernel/scall64-n32.S ++++ b/arch/mips/kernel/scall64-n32.S +@@ -353,7 +353,7 @@ EXPORT(sysn32_call_table) + PTR sys_ni_syscall /* available, was setaltroot */ + PTR sys_add_key + PTR sys_request_key +- PTR sys_keyctl /* 6245 */ ++ PTR compat_sys_keyctl /* 6245 */ + PTR sys_set_thread_area + PTR sys_inotify_init + PTR sys_inotify_add_watch +diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S +index d07b210fbeff..80e39776e377 100644 +--- a/arch/mips/kernel/scall64-o32.S ++++ b/arch/mips/kernel/scall64-o32.S +@@ -492,7 +492,7 @@ EXPORT(sys32_call_table) + PTR sys_ni_syscall /* available, was setaltroot */ + PTR sys_add_key /* 4280 */ + PTR sys_request_key +- PTR sys_keyctl ++ PTR compat_sys_keyctl + PTR sys_set_thread_area + PTR sys_inotify_init + PTR sys_inotify_add_watch /* 4285 */ +diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c +index dc10c77b7500..d6476d11212e 100644 +--- a/arch/mips/kvm/emulate.c ++++ b/arch/mips/kvm/emulate.c +@@ -1629,8 +1629,14 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, + + preempt_disable(); + if (KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG0) { +- if (kvm_mips_host_tlb_lookup(vcpu, va) < 0) +- kvm_mips_handle_kseg0_tlb_fault(va, vcpu); ++ if (kvm_mips_host_tlb_lookup(vcpu, va) < 0 && ++ kvm_mips_handle_kseg0_tlb_fault(va, vcpu)) { ++ kvm_err("%s: handling mapped kseg0 tlb fault for %lx, vcpu: %p, ASID: %#lx\n", ++ __func__, va, vcpu, read_c0_entryhi()); ++ er = EMULATE_FAIL; ++ preempt_enable(); ++ goto done; ++ } + } else if ((KVM_GUEST_KSEGX(va) < KVM_GUEST_KSEG0) || + KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG23) { + int index; +@@ -1665,14 +1671,19 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, + run, vcpu); + preempt_enable(); + goto dont_update_pc; +- } else { +- /* +- * We fault an entry from the guest tlb to the +- * shadow host TLB +- */ +- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, +- NULL, +- NULL); ++ } ++ /* ++ * We fault an entry from the guest tlb to the ++ * shadow host TLB ++ */ ++ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, ++ NULL, NULL)) { ++ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n", ++ __func__, va, index, vcpu, ++ read_c0_entryhi()); ++ er = EMULATE_FAIL; ++ preempt_enable(); ++ goto done; + } + } + } else { +@@ -2633,8 +2644,13 @@ enum emulation_result kvm_mips_handle_tlbmiss(unsigned long cause, + * OK we have a Guest TLB entry, now inject it into the + * shadow host TLB + */ +- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, NULL, +- NULL); ++ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, ++ NULL, NULL)) { ++ kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n", ++ __func__, va, index, vcpu, ++ read_c0_entryhi()); ++ er = EMULATE_FAIL; ++ } + } + } + +diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c +index aed0ac2a4972..7a7ed9ca01bb 100644 +--- a/arch/mips/kvm/tlb.c ++++ b/arch/mips/kvm/tlb.c +@@ -276,7 +276,7 @@ int kvm_mips_handle_kseg0_tlb_fault(unsigned long badvaddr, + } + + gfn = (KVM_GUEST_CPHYSADDR(badvaddr) >> PAGE_SHIFT); +- if (gfn >= kvm->arch.guest_pmap_npages) { ++ if ((gfn | 1) >= kvm->arch.guest_pmap_npages) { + kvm_err("%s: Invalid gfn: %#llx, BadVaddr: %#lx\n", __func__, + gfn, badvaddr); + kvm_mips_dump_host_tlbs(); +@@ -361,25 +361,39 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu, + unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0; + struct kvm *kvm = vcpu->kvm; + pfn_t pfn0, pfn1; +- +- if ((tlb->tlb_hi & VPN2_MASK) == 0) { +- pfn0 = 0; +- pfn1 = 0; +- } else { +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0) +- >> PAGE_SHIFT) < 0) +- return -1; +- +- if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1) +- >> PAGE_SHIFT) < 0) +- return -1; +- +- pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0) +- >> PAGE_SHIFT]; +- pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1) +- >> PAGE_SHIFT]; ++ gfn_t gfn0, gfn1; ++ long tlb_lo[2]; ++ ++ tlb_lo[0] = tlb->tlb_lo0; ++ tlb_lo[1] = tlb->tlb_lo1; ++ ++ /* ++ * The commpage address must not be mapped to anything else if the guest ++ * TLB contains entries nearby, or commpage accesses will break. ++ */ ++ if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) & ++ VPN2_MASK & (PAGE_MASK << 1))) ++ tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0; ++ ++ gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT; ++ gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT; ++ if (gfn0 >= kvm->arch.guest_pmap_npages || ++ gfn1 >= kvm->arch.guest_pmap_npages) { ++ kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n", ++ __func__, gfn0, gfn1, tlb->tlb_hi); ++ kvm_mips_dump_guest_tlbs(vcpu); ++ return -1; + } + ++ if (kvm_mips_map_page(kvm, gfn0) < 0) ++ return -1; ++ ++ if (kvm_mips_map_page(kvm, gfn1) < 0) ++ return -1; ++ ++ pfn0 = kvm->arch.guest_pmap[gfn0]; ++ pfn1 = kvm->arch.guest_pmap[gfn1]; ++ + if (hpa0) + *hpa0 = pfn0 << PAGE_SHIFT; + +@@ -391,9 +405,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu, + kvm_mips_get_kernel_asid(vcpu) : + kvm_mips_get_user_asid(vcpu)); + entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V); ++ (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V); + entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) | +- (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V); ++ (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V); + + kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc, + tlb->tlb_lo0, tlb->tlb_lo1); +@@ -794,10 +808,16 @@ uint32_t kvm_get_inst(uint32_t *opc, struct kvm_vcpu *vcpu) + local_irq_restore(flags); + return KVM_INVALID_INST; + } +- kvm_mips_handle_mapped_seg_tlb_fault(vcpu, +- &vcpu->arch. +- guest_tlb[index], +- NULL, NULL); ++ if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, ++ &vcpu->arch.guest_tlb[index], ++ NULL, NULL)) { ++ kvm_err("%s: handling mapped seg tlb fault failed for %p, index: %u, vcpu: %p, ASID: %#lx\n", ++ __func__, opc, index, vcpu, ++ read_c0_entryhi()); ++ kvm_mips_dump_guest_tlbs(vcpu); ++ local_irq_restore(flags); ++ return KVM_INVALID_INST; ++ } + inst = *(opc); + } + local_irq_restore(flags); +diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c +index b4a837893562..5abe51cad899 100644 +--- a/arch/mips/mm/uasm-mips.c ++++ b/arch/mips/mm/uasm-mips.c +@@ -65,7 +65,7 @@ static struct insn insn_table[] = { + #ifndef CONFIG_CPU_MIPSR6 + { insn_cache, M(cache_op, 0, 0, 0, 0, 0), RS | RT | SIMM }, + #else +- { insn_cache, M6(cache_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 }, ++ { insn_cache, M6(spec3_op, 0, 0, 0, cache6_op), RS | RT | SIMM9 }, + #endif + { insn_daddiu, M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM }, + { insn_daddu, M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD }, +diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S +index 5754b226da7e..521aef95e6b7 100644 +--- a/arch/powerpc/kernel/tm.S ++++ b/arch/powerpc/kernel/tm.S +@@ -110,17 +110,11 @@ _GLOBAL(tm_reclaim) + std r3, STK_PARAM(R3)(r1) + SAVE_NVGPRS(r1) + +- /* We need to setup MSR for VSX register save instructions. Here we +- * also clear the MSR RI since when we do the treclaim, we won't have a +- * valid kernel pointer for a while. We clear RI here as it avoids +- * adding another mtmsr closer to the treclaim. This makes the region +- * maked as non-recoverable wider than it needs to be but it saves on +- * inserting another mtmsrd later. +- */ ++ /* We need to setup MSR for VSX register save instructions. */ + mfmsr r14 + mr r15, r14 + ori r15, r15, MSR_FP +- li r16, MSR_RI ++ li r16, 0 + ori r16, r16, MSR_EE /* IRQs hard off */ + andc r15, r15, r16 + oris r15, r15, MSR_VEC@h +@@ -176,7 +170,17 @@ dont_backup_fp: + 1: tdeqi r6, 0 + EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0 + +- /* The moment we treclaim, ALL of our GPRs will switch ++ /* Clear MSR RI since we are about to change r1, EE is already off. */ ++ li r4, 0 ++ mtmsrd r4, 1 ++ ++ /* ++ * BE CAREFUL HERE: ++ * At this point we can't take an SLB miss since we have MSR_RI ++ * off. Load only to/from the stack/paca which are in SLB bolted regions ++ * until we turn MSR RI back on. ++ * ++ * The moment we treclaim, ALL of our GPRs will switch + * to user register state. (FPRs, CCR etc. also!) + * Use an sprg and a tm_scratch in the PACA to shuffle. + */ +@@ -197,6 +201,11 @@ dont_backup_fp: + + /* Store the PPR in r11 and reset to decent value */ + std r11, GPR11(r1) /* Temporary stash */ ++ ++ /* Reset MSR RI so we can take SLB faults again */ ++ li r11, MSR_RI ++ mtmsrd r11, 1 ++ + mfspr r11, SPRN_PPR + HMT_MEDIUM + +@@ -329,8 +338,6 @@ _GLOBAL(__tm_recheckpoint) + */ + subi r7, r7, STACK_FRAME_OVERHEAD + +- SET_SCRATCH0(r1) +- + mfmsr r6 + /* R4 = original MSR to indicate whether thread used FP/Vector etc. */ + +@@ -397,11 +404,6 @@ restore_gprs: + ld r5, THREAD_TM_DSCR(r3) + ld r6, THREAD_TM_PPR(r3) + +- /* Clear the MSR RI since we are about to change R1. EE is already off +- */ +- li r4, 0 +- mtmsrd r4, 1 +- + REST_GPR(0, r7) /* GPR0 */ + REST_2GPRS(2, r7) /* GPR2-3 */ + REST_GPR(4, r7) /* GPR4 */ +@@ -439,10 +441,34 @@ restore_gprs: + ld r6, _CCR(r7) + mtcr r6 + +- REST_GPR(1, r7) /* GPR1 */ +- REST_GPR(5, r7) /* GPR5-7 */ + REST_GPR(6, r7) +- ld r7, GPR7(r7) ++ ++ /* ++ * Store r1 and r5 on the stack so that we can access them ++ * after we clear MSR RI. ++ */ ++ ++ REST_GPR(5, r7) ++ std r5, -8(r1) ++ ld r5, GPR1(r7) ++ std r5, -16(r1) ++ ++ REST_GPR(7, r7) ++ ++ /* Clear MSR RI since we are about to change r1. EE is already off */ ++ li r5, 0 ++ mtmsrd r5, 1 ++ ++ /* ++ * BE CAREFUL HERE: ++ * At this point we can't take an SLB miss since we have MSR_RI ++ * off. Load only to/from the stack/paca which are in SLB bolted regions ++ * until we turn MSR RI back on. ++ */ ++ ++ SET_SCRATCH0(r1) ++ ld r5, -8(r1) ++ ld r1, -16(r1) + + /* Commit register state as checkpointed state: */ + TRECHKPT +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index a34e43eec658..11d82b91aa4f 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -570,112 +570,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM + BEGIN_FTR_SECTION +- b skip_tm +-END_FTR_SECTION_IFCLR(CPU_FTR_TM) +- +- /* Turn on TM/FP/VSX/VMX so we can restore them. */ +- mfmsr r5 +- li r6, MSR_TM >> 32 +- sldi r6, r6, 32 +- or r5, r5, r6 +- ori r5, r5, MSR_FP +- oris r5, r5, (MSR_VEC | MSR_VSX)@h +- mtmsrd r5 +- +- /* +- * The user may change these outside of a transaction, so they must +- * always be context switched. +- */ +- ld r5, VCPU_TFHAR(r4) +- ld r6, VCPU_TFIAR(r4) +- ld r7, VCPU_TEXASR(r4) +- mtspr SPRN_TFHAR, r5 +- mtspr SPRN_TFIAR, r6 +- mtspr SPRN_TEXASR, r7 +- +- ld r5, VCPU_MSR(r4) +- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 +- beq skip_tm /* TM not active in guest */ +- +- /* Make sure the failure summary is set, otherwise we'll program check +- * when we trechkpt. It's possible that this might have been not set +- * on a kvmppc_set_one_reg() call but we shouldn't let this crash the +- * host. +- */ +- oris r7, r7, (TEXASR_FS)@h +- mtspr SPRN_TEXASR, r7 +- +- /* +- * We need to load up the checkpointed state for the guest. +- * We need to do this early as it will blow away any GPRs, VSRs and +- * some SPRs. +- */ +- +- mr r31, r4 +- addi r3, r31, VCPU_FPRS_TM +- bl load_fp_state +- addi r3, r31, VCPU_VRS_TM +- bl load_vr_state +- mr r4, r31 +- lwz r7, VCPU_VRSAVE_TM(r4) +- mtspr SPRN_VRSAVE, r7 +- +- ld r5, VCPU_LR_TM(r4) +- lwz r6, VCPU_CR_TM(r4) +- ld r7, VCPU_CTR_TM(r4) +- ld r8, VCPU_AMR_TM(r4) +- ld r9, VCPU_TAR_TM(r4) +- mtlr r5 +- mtcr r6 +- mtctr r7 +- mtspr SPRN_AMR, r8 +- mtspr SPRN_TAR, r9 +- +- /* +- * Load up PPR and DSCR values but don't put them in the actual SPRs +- * till the last moment to avoid running with userspace PPR and DSCR for +- * too long. +- */ +- ld r29, VCPU_DSCR_TM(r4) +- ld r30, VCPU_PPR_TM(r4) +- +- std r2, PACATMSCRATCH(r13) /* Save TOC */ +- +- /* Clear the MSR RI since r1, r13 are all going to be foobar. */ +- li r5, 0 +- mtmsrd r5, 1 +- +- /* Load GPRs r0-r28 */ +- reg = 0 +- .rept 29 +- ld reg, VCPU_GPRS_TM(reg)(r31) +- reg = reg + 1 +- .endr +- +- mtspr SPRN_DSCR, r29 +- mtspr SPRN_PPR, r30 +- +- /* Load final GPRs */ +- ld 29, VCPU_GPRS_TM(29)(r31) +- ld 30, VCPU_GPRS_TM(30)(r31) +- ld 31, VCPU_GPRS_TM(31)(r31) +- +- /* TM checkpointed state is now setup. All GPRs are now volatile. */ +- TRECHKPT +- +- /* Now let's get back the state we need. */ +- HMT_MEDIUM +- GET_PACA(r13) +- ld r29, HSTATE_DSCR(r13) +- mtspr SPRN_DSCR, r29 +- ld r4, HSTATE_KVM_VCPU(r13) +- ld r1, HSTATE_HOST_R1(r13) +- ld r2, PACATMSCRATCH(r13) +- +- /* Set the MSR RI since we have our registers back. */ +- li r5, MSR_RI +- mtmsrd r5, 1 +-skip_tm: ++ bl kvmppc_restore_tm ++END_FTR_SECTION_IFSET(CPU_FTR_TM) + #endif + + /* Load guest PMU registers */ +@@ -756,12 +652,6 @@ BEGIN_FTR_SECTION + /* Skip next section on POWER7 */ + b 8f + END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) +- /* Turn on TM so we can access TFHAR/TFIAR/TEXASR */ +- mfmsr r8 +- li r0, 1 +- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG +- mtmsrd r8 +- + /* Load up POWER8-specific registers */ + ld r5, VCPU_IAMR(r4) + lwz r6, VCPU_PSPB(r4) +@@ -1339,106 +1229,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) + + #ifdef CONFIG_PPC_TRANSACTIONAL_MEM + BEGIN_FTR_SECTION +- b 2f +-END_FTR_SECTION_IFCLR(CPU_FTR_TM) +- /* Turn on TM. */ +- mfmsr r8 +- li r0, 1 +- rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG +- mtmsrd r8 +- +- ld r5, VCPU_MSR(r9) +- rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 +- beq 1f /* TM not active in guest. */ +- +- li r3, TM_CAUSE_KVM_RESCHED +- +- /* Clear the MSR RI since r1, r13 are all going to be foobar. */ +- li r5, 0 +- mtmsrd r5, 1 +- +- /* All GPRs are volatile at this point. */ +- TRECLAIM(R3) +- +- /* Temporarily store r13 and r9 so we have some regs to play with */ +- SET_SCRATCH0(r13) +- GET_PACA(r13) +- std r9, PACATMSCRATCH(r13) +- ld r9, HSTATE_KVM_VCPU(r13) +- +- /* Get a few more GPRs free. */ +- std r29, VCPU_GPRS_TM(29)(r9) +- std r30, VCPU_GPRS_TM(30)(r9) +- std r31, VCPU_GPRS_TM(31)(r9) +- +- /* Save away PPR and DSCR soon so don't run with user values. */ +- mfspr r31, SPRN_PPR +- HMT_MEDIUM +- mfspr r30, SPRN_DSCR +- ld r29, HSTATE_DSCR(r13) +- mtspr SPRN_DSCR, r29 +- +- /* Save all but r9, r13 & r29-r31 */ +- reg = 0 +- .rept 29 +- .if (reg != 9) && (reg != 13) +- std reg, VCPU_GPRS_TM(reg)(r9) +- .endif +- reg = reg + 1 +- .endr +- /* ... now save r13 */ +- GET_SCRATCH0(r4) +- std r4, VCPU_GPRS_TM(13)(r9) +- /* ... and save r9 */ +- ld r4, PACATMSCRATCH(r13) +- std r4, VCPU_GPRS_TM(9)(r9) +- +- /* Reload stack pointer and TOC. */ +- ld r1, HSTATE_HOST_R1(r13) +- ld r2, PACATOC(r13) +- +- /* Set MSR RI now we have r1 and r13 back. */ +- li r5, MSR_RI +- mtmsrd r5, 1 +- +- /* Save away checkpinted SPRs. */ +- std r31, VCPU_PPR_TM(r9) +- std r30, VCPU_DSCR_TM(r9) +- mflr r5 +- mfcr r6 +- mfctr r7 +- mfspr r8, SPRN_AMR +- mfspr r10, SPRN_TAR +- std r5, VCPU_LR_TM(r9) +- stw r6, VCPU_CR_TM(r9) +- std r7, VCPU_CTR_TM(r9) +- std r8, VCPU_AMR_TM(r9) +- std r10, VCPU_TAR_TM(r9) +- +- /* Restore r12 as trap number. */ +- lwz r12, VCPU_TRAP(r9) +- +- /* Save FP/VSX. */ +- addi r3, r9, VCPU_FPRS_TM +- bl store_fp_state +- addi r3, r9, VCPU_VRS_TM +- bl store_vr_state +- mfspr r6, SPRN_VRSAVE +- stw r6, VCPU_VRSAVE_TM(r9) +-1: +- /* +- * We need to save these SPRs after the treclaim so that the software +- * error code is recorded correctly in the TEXASR. Also the user may +- * change these outside of a transaction, so they must always be +- * context switched. +- */ +- mfspr r5, SPRN_TFHAR +- mfspr r6, SPRN_TFIAR +- mfspr r7, SPRN_TEXASR +- std r5, VCPU_TFHAR(r9) +- std r6, VCPU_TFIAR(r9) +- std r7, VCPU_TEXASR(r9) +-2: ++ bl kvmppc_save_tm ++END_FTR_SECTION_IFSET(CPU_FTR_TM) + #endif + + /* Increment yield count if they have a VPA */ +@@ -2139,6 +1931,13 @@ _GLOBAL(kvmppc_h_cede) /* r3 = vcpu pointer, r11 = msr, r13 = paca */ + /* save FP state */ + bl kvmppc_save_fp + ++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM ++BEGIN_FTR_SECTION ++ ld r9, HSTATE_KVM_VCPU(r13) ++ bl kvmppc_save_tm ++END_FTR_SECTION_IFSET(CPU_FTR_TM) ++#endif ++ + /* + * Set DEC to the smaller of DEC and HDEC, so that we wake + * no later than the end of our timeslice (HDEC interrupts +@@ -2215,6 +2014,12 @@ kvm_end_cede: + bl kvmhv_accumulate_time + #endif + ++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM ++BEGIN_FTR_SECTION ++ bl kvmppc_restore_tm ++END_FTR_SECTION_IFSET(CPU_FTR_TM) ++#endif ++ + /* load up FP state */ + bl kvmppc_load_fp + +@@ -2514,6 +2319,239 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) + mr r4,r31 + blr + ++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM ++/* ++ * Save transactional state and TM-related registers. ++ * Called with r9 pointing to the vcpu struct. ++ * This can modify all checkpointed registers, but ++ * restores r1, r2 and r9 (vcpu pointer) before exit. ++ */ ++kvmppc_save_tm: ++ mflr r0 ++ std r0, PPC_LR_STKOFF(r1) ++ ++ /* Turn on TM. */ ++ mfmsr r8 ++ li r0, 1 ++ rldimi r8, r0, MSR_TM_LG, 63-MSR_TM_LG ++ mtmsrd r8 ++ ++ ld r5, VCPU_MSR(r9) ++ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 ++ beq 1f /* TM not active in guest. */ ++ ++ std r1, HSTATE_HOST_R1(r13) ++ li r3, TM_CAUSE_KVM_RESCHED ++ ++ /* Clear the MSR RI since r1, r13 are all going to be foobar. */ ++ li r5, 0 ++ mtmsrd r5, 1 ++ ++ /* All GPRs are volatile at this point. */ ++ TRECLAIM(R3) ++ ++ /* Temporarily store r13 and r9 so we have some regs to play with */ ++ SET_SCRATCH0(r13) ++ GET_PACA(r13) ++ std r9, PACATMSCRATCH(r13) ++ ld r9, HSTATE_KVM_VCPU(r13) ++ ++ /* Get a few more GPRs free. */ ++ std r29, VCPU_GPRS_TM(29)(r9) ++ std r30, VCPU_GPRS_TM(30)(r9) ++ std r31, VCPU_GPRS_TM(31)(r9) ++ ++ /* Save away PPR and DSCR soon so don't run with user values. */ ++ mfspr r31, SPRN_PPR ++ HMT_MEDIUM ++ mfspr r30, SPRN_DSCR ++ ld r29, HSTATE_DSCR(r13) ++ mtspr SPRN_DSCR, r29 ++ ++ /* Save all but r9, r13 & r29-r31 */ ++ reg = 0 ++ .rept 29 ++ .if (reg != 9) && (reg != 13) ++ std reg, VCPU_GPRS_TM(reg)(r9) ++ .endif ++ reg = reg + 1 ++ .endr ++ /* ... now save r13 */ ++ GET_SCRATCH0(r4) ++ std r4, VCPU_GPRS_TM(13)(r9) ++ /* ... and save r9 */ ++ ld r4, PACATMSCRATCH(r13) ++ std r4, VCPU_GPRS_TM(9)(r9) ++ ++ /* Reload stack pointer and TOC. */ ++ ld r1, HSTATE_HOST_R1(r13) ++ ld r2, PACATOC(r13) ++ ++ /* Set MSR RI now we have r1 and r13 back. */ ++ li r5, MSR_RI ++ mtmsrd r5, 1 ++ ++ /* Save away checkpinted SPRs. */ ++ std r31, VCPU_PPR_TM(r9) ++ std r30, VCPU_DSCR_TM(r9) ++ mflr r5 ++ mfcr r6 ++ mfctr r7 ++ mfspr r8, SPRN_AMR ++ mfspr r10, SPRN_TAR ++ std r5, VCPU_LR_TM(r9) ++ stw r6, VCPU_CR_TM(r9) ++ std r7, VCPU_CTR_TM(r9) ++ std r8, VCPU_AMR_TM(r9) ++ std r10, VCPU_TAR_TM(r9) ++ ++ /* Restore r12 as trap number. */ ++ lwz r12, VCPU_TRAP(r9) ++ ++ /* Save FP/VSX. */ ++ addi r3, r9, VCPU_FPRS_TM ++ bl store_fp_state ++ addi r3, r9, VCPU_VRS_TM ++ bl store_vr_state ++ mfspr r6, SPRN_VRSAVE ++ stw r6, VCPU_VRSAVE_TM(r9) ++1: ++ /* ++ * We need to save these SPRs after the treclaim so that the software ++ * error code is recorded correctly in the TEXASR. Also the user may ++ * change these outside of a transaction, so they must always be ++ * context switched. ++ */ ++ mfspr r5, SPRN_TFHAR ++ mfspr r6, SPRN_TFIAR ++ mfspr r7, SPRN_TEXASR ++ std r5, VCPU_TFHAR(r9) ++ std r6, VCPU_TFIAR(r9) ++ std r7, VCPU_TEXASR(r9) ++ ++ ld r0, PPC_LR_STKOFF(r1) ++ mtlr r0 ++ blr ++ ++/* ++ * Restore transactional state and TM-related registers. ++ * Called with r4 pointing to the vcpu struct. ++ * This potentially modifies all checkpointed registers. ++ * It restores r1, r2, r4 from the PACA. ++ */ ++kvmppc_restore_tm: ++ mflr r0 ++ std r0, PPC_LR_STKOFF(r1) ++ ++ /* Turn on TM/FP/VSX/VMX so we can restore them. */ ++ mfmsr r5 ++ li r6, MSR_TM >> 32 ++ sldi r6, r6, 32 ++ or r5, r5, r6 ++ ori r5, r5, MSR_FP ++ oris r5, r5, (MSR_VEC | MSR_VSX)@h ++ mtmsrd r5 ++ ++ /* ++ * The user may change these outside of a transaction, so they must ++ * always be context switched. ++ */ ++ ld r5, VCPU_TFHAR(r4) ++ ld r6, VCPU_TFIAR(r4) ++ ld r7, VCPU_TEXASR(r4) ++ mtspr SPRN_TFHAR, r5 ++ mtspr SPRN_TFIAR, r6 ++ mtspr SPRN_TEXASR, r7 ++ ++ ld r5, VCPU_MSR(r4) ++ rldicl. r5, r5, 64 - MSR_TS_S_LG, 62 ++ beqlr /* TM not active in guest */ ++ std r1, HSTATE_HOST_R1(r13) ++ ++ /* Make sure the failure summary is set, otherwise we'll program check ++ * when we trechkpt. It's possible that this might have been not set ++ * on a kvmppc_set_one_reg() call but we shouldn't let this crash the ++ * host. ++ */ ++ oris r7, r7, (TEXASR_FS)@h ++ mtspr SPRN_TEXASR, r7 ++ ++ /* ++ * We need to load up the checkpointed state for the guest. ++ * We need to do this early as it will blow away any GPRs, VSRs and ++ * some SPRs. ++ */ ++ ++ mr r31, r4 ++ addi r3, r31, VCPU_FPRS_TM ++ bl load_fp_state ++ addi r3, r31, VCPU_VRS_TM ++ bl load_vr_state ++ mr r4, r31 ++ lwz r7, VCPU_VRSAVE_TM(r4) ++ mtspr SPRN_VRSAVE, r7 ++ ++ ld r5, VCPU_LR_TM(r4) ++ lwz r6, VCPU_CR_TM(r4) ++ ld r7, VCPU_CTR_TM(r4) ++ ld r8, VCPU_AMR_TM(r4) ++ ld r9, VCPU_TAR_TM(r4) ++ mtlr r5 ++ mtcr r6 ++ mtctr r7 ++ mtspr SPRN_AMR, r8 ++ mtspr SPRN_TAR, r9 ++ ++ /* ++ * Load up PPR and DSCR values but don't put them in the actual SPRs ++ * till the last moment to avoid running with userspace PPR and DSCR for ++ * too long. ++ */ ++ ld r29, VCPU_DSCR_TM(r4) ++ ld r30, VCPU_PPR_TM(r4) ++ ++ std r2, PACATMSCRATCH(r13) /* Save TOC */ ++ ++ /* Clear the MSR RI since r1, r13 are all going to be foobar. */ ++ li r5, 0 ++ mtmsrd r5, 1 ++ ++ /* Load GPRs r0-r28 */ ++ reg = 0 ++ .rept 29 ++ ld reg, VCPU_GPRS_TM(reg)(r31) ++ reg = reg + 1 ++ .endr ++ ++ mtspr SPRN_DSCR, r29 ++ mtspr SPRN_PPR, r30 ++ ++ /* Load final GPRs */ ++ ld 29, VCPU_GPRS_TM(29)(r31) ++ ld 30, VCPU_GPRS_TM(30)(r31) ++ ld 31, VCPU_GPRS_TM(31)(r31) ++ ++ /* TM checkpointed state is now setup. All GPRs are now volatile. */ ++ TRECHKPT ++ ++ /* Now let's get back the state we need. */ ++ HMT_MEDIUM ++ GET_PACA(r13) ++ ld r29, HSTATE_DSCR(r13) ++ mtspr SPRN_DSCR, r29 ++ ld r4, HSTATE_KVM_VCPU(r13) ++ ld r1, HSTATE_HOST_R1(r13) ++ ld r2, PACATMSCRATCH(r13) ++ ++ /* Set the MSR RI since we have our registers back. */ ++ li r5, MSR_RI ++ mtmsrd r5, 1 ++ ++ ld r0, PPC_LR_STKOFF(r1) ++ mtlr r0 ++ blr ++#endif ++ + /* + * We come here if we get any exception or interrupt while we are + * executing host real mode code while in guest MMU context. +diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c +index 61d5a17f45c0..e8b05e635595 100644 +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -825,7 +825,8 @@ machine_arch_initcall(pseries, find_existing_ddw_windows); + static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail, + struct ddw_query_response *query) + { +- struct eeh_dev *edev; ++ struct device_node *dn; ++ struct pci_dn *pdn; + u32 cfg_addr; + u64 buid; + int ret; +@@ -836,11 +837,10 @@ static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail, + * Retrieve them from the pci device, not the node with the + * dma-window property + */ +- edev = pci_dev_to_eeh_dev(dev); +- cfg_addr = edev->config_addr; +- if (edev->pe_config_addr) +- cfg_addr = edev->pe_config_addr; +- buid = edev->phb->buid; ++ dn = pci_device_to_OF_node(dev); ++ pdn = PCI_DN(dn); ++ buid = pdn->phb->buid; ++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8)); + + ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query, + cfg_addr, BUID_HI(buid), BUID_LO(buid)); +@@ -854,7 +854,8 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail, + struct ddw_create_response *create, int page_shift, + int window_shift) + { +- struct eeh_dev *edev; ++ struct device_node *dn; ++ struct pci_dn *pdn; + u32 cfg_addr; + u64 buid; + int ret; +@@ -865,11 +866,10 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail, + * Retrieve them from the pci device, not the node with the + * dma-window property + */ +- edev = pci_dev_to_eeh_dev(dev); +- cfg_addr = edev->config_addr; +- if (edev->pe_config_addr) +- cfg_addr = edev->pe_config_addr; +- buid = edev->phb->buid; ++ dn = pci_device_to_OF_node(dev); ++ pdn = PCI_DN(dn); ++ buid = pdn->phb->buid; ++ cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8)); + + do { + /* extra outputs are LIOBN and dma-addr (hi, lo) */ +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index ebf82a99df45..9ac703cfdb21 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -173,7 +173,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc); + static void gmap_flush_tlb(struct gmap *gmap) + { + if (MACHINE_HAS_IDTE) +- __tlb_flush_asce(gmap->mm, gmap->asce); ++ __tlb_flush_idte(gmap->asce); + else + __tlb_flush_global(); + } +@@ -212,7 +212,7 @@ void gmap_free(struct gmap *gmap) + + /* Flush tlb. */ + if (MACHINE_HAS_IDTE) +- __tlb_flush_asce(gmap->mm, gmap->asce); ++ __tlb_flush_idte(gmap->asce); + else + __tlb_flush_global(); + +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index 22212615a137..185ebd2c0c3c 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -3332,7 +3332,7 @@ __init int intel_pmu_init(void) + c->idxmsk64 |= (1ULL << x86_pmu.num_counters) - 1; + } + c->idxmsk64 &= +- ~(~0UL << (INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed)); ++ ~(~0ULL << (INTEL_PMC_IDX_FIXED + x86_pmu.num_counters_fixed)); + c->weight = hweight64(c->idxmsk64); + } + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 1274fac7c28f..08f9d9230b94 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7770,6 +7770,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) + if ((vectoring_info & VECTORING_INFO_VALID_MASK) && + (exit_reason != EXIT_REASON_EXCEPTION_NMI && + exit_reason != EXIT_REASON_EPT_VIOLATION && ++ exit_reason != EXIT_REASON_PML_FULL && + exit_reason != EXIT_REASON_TASK_SWITCH)) { + vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; + vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV; +@@ -8377,6 +8378,22 @@ static void vmx_load_vmcs01(struct kvm_vcpu *vcpu) + put_cpu(); + } + ++/* ++ * Ensure that the current vmcs of the logical processor is the ++ * vmcs01 of the vcpu before calling free_nested(). ++ */ ++static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu) ++{ ++ struct vcpu_vmx *vmx = to_vmx(vcpu); ++ int r; ++ ++ r = vcpu_load(vcpu); ++ BUG_ON(r); ++ vmx_load_vmcs01(vcpu); ++ free_nested(vmx); ++ vcpu_put(vcpu); ++} ++ + static void vmx_free_vcpu(struct kvm_vcpu *vcpu) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); +@@ -8385,8 +8402,7 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu) + vmx_disable_pml(vmx); + free_vpid(vmx); + leave_guest_mode(vcpu); +- vmx_load_vmcs01(vcpu); +- free_nested(vmx); ++ vmx_free_vcpu_nested(vcpu); + free_loaded_vmcs(vmx->loaded_vmcs); + kfree(vmx->guest_msrs); + kvm_vcpu_uninit(vcpu); +diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl +index ef8187f9d28d..f3a443dad74c 100644 +--- a/arch/x86/syscalls/syscall_32.tbl ++++ b/arch/x86/syscalls/syscall_32.tbl +@@ -294,7 +294,7 @@ + # 285 sys_setaltroot + 286 i386 add_key sys_add_key + 287 i386 request_key sys_request_key +-288 i386 keyctl sys_keyctl ++288 i386 keyctl sys_keyctl compat_sys_keyctl + 289 i386 ioprio_set sys_ioprio_set + 290 i386 ioprio_get sys_ioprio_get + 291 i386 inotify_init sys_inotify_init +diff --git a/block/genhd.c b/block/genhd.c +index ea982eadaf63..f5d12185d631 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -828,6 +828,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v) + if (iter) { + class_dev_iter_exit(iter); + kfree(iter); ++ seqf->private = NULL; + } + } + +diff --git a/crypto/gcm.c b/crypto/gcm.c +index 2e403f6138c1..ee3c29bd7ddb 100644 +--- a/crypto/gcm.c ++++ b/crypto/gcm.c +@@ -716,7 +716,9 @@ static struct crypto_instance *crypto_gcm_alloc_common(struct rtattr **tb, + + ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type, + CRYPTO_ALG_TYPE_HASH, +- CRYPTO_ALG_TYPE_AHASH_MASK); ++ CRYPTO_ALG_TYPE_AHASH_MASK | ++ crypto_requires_sync(algt->type, ++ algt->mask)); + if (IS_ERR(ghash_alg)) + return ERR_CAST(ghash_alg); + +diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c +index 3bd749c7bb70..46dcbbc4f32e 100644 +--- a/crypto/scatterwalk.c ++++ b/crypto/scatterwalk.c +@@ -68,7 +68,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out, + + void scatterwalk_done(struct scatter_walk *walk, int out, int more) + { +- if (!(scatterwalk_pagelen(walk) & (PAGE_SIZE - 1)) || !more) ++ if (!more || walk->offset >= walk->sg->offset + walk->sg->length || ++ !(walk->offset & (PAGE_SIZE - 1))) + scatterwalk_pagedone(walk, out, more); + } + EXPORT_SYMBOL_GPL(scatterwalk_done); +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 0beaa52df66b..c31980079507 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -122,6 +122,8 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x13d3, 0x3432) }, + { USB_DEVICE(0x13d3, 0x3472) }, + { USB_DEVICE(0x13d3, 0x3474) }, ++ { USB_DEVICE(0x13d3, 0x3487) }, ++ { USB_DEVICE(0x13d3, 0x3490) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -188,6 +190,8 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index ac553f997a1c..81721ad6fcb0 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -224,6 +224,8 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, +diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c +index aa28c65eb6b4..14945fd9d5e1 100644 +--- a/drivers/gpio/gpio-intel-mid.c ++++ b/drivers/gpio/gpio-intel-mid.c +@@ -17,7 +17,6 @@ + * Moorestown platform Langwell chip. + * Medfield platform Penwell chip. + * Clovertrail platform Cloverview chip. +- * Merrifield platform Tangier chip. + */ + + #include <linux/module.h> +@@ -64,10 +63,6 @@ enum GPIO_REG { + /* intel_mid gpio driver data */ + struct intel_mid_gpio_ddata { + u16 ngpio; /* number of gpio pins */ +- u32 gplr_offset; /* offset of first GPLR register from base */ +- u32 flis_base; /* base address of FLIS registers */ +- u32 flis_len; /* length of FLIS registers */ +- u32 (*get_flis_offset)(int gpio); + u32 chip_irq_type; /* chip interrupt type */ + }; + +@@ -257,15 +252,6 @@ static const struct intel_mid_gpio_ddata gpio_cloverview_core = { + .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE, + }; + +-static const struct intel_mid_gpio_ddata gpio_tangier = { +- .ngpio = 192, +- .gplr_offset = 4, +- .flis_base = 0xff0c0000, +- .flis_len = 0x8000, +- .get_flis_offset = NULL, +- .chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE, +-}; +- + static const struct pci_device_id intel_gpio_ids[] = { + { + /* Lincroft */ +@@ -292,11 +278,6 @@ static const struct pci_device_id intel_gpio_ids[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x08f7), + .driver_data = (kernel_ulong_t)&gpio_cloverview_core, + }, +- { +- /* Tangier */ +- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1199), +- .driver_data = (kernel_ulong_t)&gpio_tangier, +- }, + { 0 } + }; + MODULE_DEVICE_TABLE(pci, intel_gpio_ids); +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 16f7c4f2d8c8..6e2720ea7d45 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -76,7 +76,7 @@ MODULE_DEVICE_TABLE(i2c, pca953x_id); + #define MAX_BANK 5 + #define BANK_SZ 8 + +-#define NBANK(chip) (chip->gpio_chip.ngpio / BANK_SZ) ++#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ) + + struct pca953x_chip { + unsigned gpio_start; +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 5250596a612e..56323732c748 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -7129,14 +7129,12 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + { + struct drm_i915_private *dev_priv = dev->dev_private; + struct intel_encoder *encoder; +- int i; + u32 val, final; + bool has_lvds = false; + bool has_cpu_edp = false; + bool has_panel = false; + bool has_ck505 = false; + bool can_ssc = false; +- bool using_ssc_source = false; + + /* We need to take the global config into account */ + for_each_intel_encoder(dev, encoder) { +@@ -7163,22 +7161,8 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + can_ssc = true; + } + +- /* Check if any DPLLs are using the SSC source */ +- for (i = 0; i < dev_priv->num_shared_dpll; i++) { +- u32 temp = I915_READ(PCH_DPLL(i)); +- +- if (!(temp & DPLL_VCO_ENABLE)) +- continue; +- +- if ((temp & PLL_REF_INPUT_MASK) == +- PLLB_REF_INPUT_SPREADSPECTRUMIN) { +- using_ssc_source = true; +- break; +- } +- } +- +- DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d using_ssc_source %d\n", +- has_panel, has_lvds, has_ck505, using_ssc_source); ++ DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d\n", ++ has_panel, has_lvds, has_ck505); + + /* Ironlake: try to setup display ref clock before DPLL + * enabling. This is only under driver's control after +@@ -7215,9 +7199,9 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + final |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD; + } else + final |= DREF_CPU_SOURCE_OUTPUT_DISABLE; +- } else if (using_ssc_source) { +- final |= DREF_SSC_SOURCE_ENABLE; +- final |= DREF_SSC1_ENABLE; ++ } else { ++ final |= DREF_SSC_SOURCE_DISABLE; ++ final |= DREF_CPU_SOURCE_OUTPUT_DISABLE; + } + + if (final == val) +@@ -7263,7 +7247,7 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + POSTING_READ(PCH_DREF_CONTROL); + udelay(200); + } else { +- DRM_DEBUG_KMS("Disabling CPU source output\n"); ++ DRM_DEBUG_KMS("Disabling SSC entirely\n"); + + val &= ~DREF_CPU_SOURCE_OUTPUT_MASK; + +@@ -7274,20 +7258,16 @@ static void ironlake_init_pch_refclk(struct drm_device *dev) + POSTING_READ(PCH_DREF_CONTROL); + udelay(200); + +- if (!using_ssc_source) { +- DRM_DEBUG_KMS("Disabling SSC source\n"); +- +- /* Turn off the SSC source */ +- val &= ~DREF_SSC_SOURCE_MASK; +- val |= DREF_SSC_SOURCE_DISABLE; ++ /* Turn off the SSC source */ ++ val &= ~DREF_SSC_SOURCE_MASK; ++ val |= DREF_SSC_SOURCE_DISABLE; + +- /* Turn off SSC1 */ +- val &= ~DREF_SSC1_ENABLE; ++ /* Turn off SSC1 */ ++ val &= ~DREF_SSC1_ENABLE; + +- I915_WRITE(PCH_DREF_CONTROL, val); +- POSTING_READ(PCH_DREF_CONTROL); +- udelay(200); +- } ++ I915_WRITE(PCH_DREF_CONTROL, val); ++ POSTING_READ(PCH_DREF_CONTROL); ++ udelay(200); + } + + BUG_ON(val != final); +diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c +index 7a92d15d474e..1ff5ca37dd62 100644 +--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c +@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + ((image->dx + image->width) & 0xffff)); + OUT_RING(chan, bg); + OUT_RING(chan, fg); +- OUT_RING(chan, (image->height << 16) | image->width); ++ OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8)); + OUT_RING(chan, (image->height << 16) | image->width); + OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff)); + +- dsize = ALIGN(image->width * image->height, 32) >> 5; ++ dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; + while (dsize) { + int iter_len = dsize > 128 ? 128 : dsize; + +diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c +index cb2a71ada99e..8462f72e8819 100644 +--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c +@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + OUT_RING(chan, 0); + OUT_RING(chan, image->dy); + +- dwords = ALIGN(image->width * image->height, 32) >> 5; ++ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; + while (dwords) { + int push = dwords > 2047 ? 2047 : dwords; + +diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c +index 69f760e8c54f..90552420c217 100644 +--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c +@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) + OUT_RING (chan, 0); + OUT_RING (chan, image->dy); + +- dwords = ALIGN(image->width * image->height, 32) >> 5; ++ dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5; + while (dwords) { + int push = dwords > 2047 ? 2047 : dwords; + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c +index dcc84eb54fb6..183d1701ae94 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c +@@ -88,8 +88,8 @@ nv30_gr_context_ctor(struct nvkm_object *parent, struct nvkm_object *engine, + nv_wo32(chan, i, 0x00040004); + for (i = 0x1f18; i <= 0x3088 ; i += 16) { + nv_wo32(chan, i + 0, 0x10700ff9); +- nv_wo32(chan, i + 1, 0x0436086c); +- nv_wo32(chan, i + 2, 0x000c001b); ++ nv_wo32(chan, i + 4, 0x0436086c); ++ nv_wo32(chan, i + 8, 0x000c001b); + } + for (i = 0x30b8; i < 0x30c8; i += 4) + nv_wo32(chan, i, 0x0000ffff); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c +index 985b7f3306ae..720c97135e85 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c +@@ -86,8 +86,8 @@ nv34_gr_context_ctor(struct nvkm_object *parent, struct nvkm_object *engine, + nv_wo32(chan, i, 0x00040004); + for (i = 0x15ac; i <= 0x271c ; i += 16) { + nv_wo32(chan, i + 0, 0x10700ff9); +- nv_wo32(chan, i + 1, 0x0436086c); +- nv_wo32(chan, i + 2, 0x000c001b); ++ nv_wo32(chan, i + 4, 0x0436086c); ++ nv_wo32(chan, i + 8, 0x000c001b); + } + for (i = 0x274c; i < 0x275c; i += 4) + nv_wo32(chan, i, 0x0000ffff); +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 0b04b9282f56..d4ac8c837314 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -120,6 +120,7 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level) + case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1: + case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2: ++ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3: + if (dig->backlight_level == 0) + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0); + else { +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index de9a2ffcf5f7..0c5b3eeff82d 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -1155,7 +1155,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev) + le16_to_cpu(firmware_info->info.usReferenceClock); + p1pll->reference_div = 0; + +- if (crev < 2) ++ if ((frev < 2) && (crev < 2)) + p1pll->pll_out_min = + le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output); + else +@@ -1164,7 +1164,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev) + p1pll->pll_out_max = + le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output); + +- if (crev >= 4) { ++ if (((frev < 2) && (crev >= 4)) || (frev >= 2)) { + p1pll->lcd_pll_out_min = + le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100; + if (p1pll->lcd_pll_out_min == 0) +diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +index 8bc7d0bbd3c8..868247c22de4 100644 +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -10,6 +10,7 @@ + #include <linux/slab.h> + #include <linux/acpi.h> + #include <linux/pci.h> ++#include <linux/delay.h> + + #include "radeon_acpi.h" + +@@ -255,6 +256,10 @@ static int radeon_atpx_set_discrete_state(struct radeon_atpx *atpx, u8 state) + if (!info) + return -EIO; + kfree(info); ++ ++ /* 200ms delay is required after off */ ++ if (state == 0) ++ msleep(200); + } + return 0; + } +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index f5c96fb7e8d0..9f699e87320a 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -2039,7 +2039,6 @@ radeon_add_atom_connector(struct drm_device *dev, + RADEON_OUTPUT_CSC_BYPASS); + /* no HPD on analog connectors */ + radeon_connector->hpd.hpd = RADEON_HPD_NONE; +- connector->polled = DRM_CONNECTOR_POLL_CONNECT; + connector->interlace_allowed = true; + connector->doublescan_allowed = true; + break; +@@ -2289,8 +2288,10 @@ radeon_add_atom_connector(struct drm_device *dev, + } + + if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) { +- if (i2c_bus->valid) +- connector->polled = DRM_CONNECTOR_POLL_CONNECT; ++ if (i2c_bus->valid) { ++ connector->polled = DRM_CONNECTOR_POLL_CONNECT | ++ DRM_CONNECTOR_POLL_DISCONNECT; ++ } + } else + connector->polled = DRM_CONNECTOR_POLL_HPD; + +@@ -2366,7 +2367,6 @@ radeon_add_legacy_connector(struct drm_device *dev, + 1); + /* no HPD on analog connectors */ + radeon_connector->hpd.hpd = RADEON_HPD_NONE; +- connector->polled = DRM_CONNECTOR_POLL_CONNECT; + connector->interlace_allowed = true; + connector->doublescan_allowed = true; + break; +@@ -2451,10 +2451,13 @@ radeon_add_legacy_connector(struct drm_device *dev, + } + + if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) { +- if (i2c_bus->valid) +- connector->polled = DRM_CONNECTOR_POLL_CONNECT; ++ if (i2c_bus->valid) { ++ connector->polled = DRM_CONNECTOR_POLL_CONNECT | ++ DRM_CONNECTOR_POLL_DISCONNECT; ++ } + } else + connector->polled = DRM_CONNECTOR_POLL_HPD; ++ + connector->display_info.subpixel_order = subpixel_order; + drm_connector_register(connector); + } +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index e094c572b86e..1a2032c2c1fb 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -51,10 +51,26 @@ struct uhid_device { + u32 report_id; + u32 report_type; + struct uhid_event report_buf; ++ struct work_struct worker; + }; + + static struct miscdevice uhid_misc; + ++static void uhid_device_add_worker(struct work_struct *work) ++{ ++ struct uhid_device *uhid = container_of(work, struct uhid_device, worker); ++ int ret; ++ ++ ret = hid_add_device(uhid->hid); ++ if (ret) { ++ hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); ++ ++ hid_destroy_device(uhid->hid); ++ uhid->hid = NULL; ++ uhid->running = false; ++ } ++} ++ + static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev) + { + __u8 newhead; +@@ -498,18 +514,14 @@ static int uhid_dev_create2(struct uhid_device *uhid, + uhid->hid = hid; + uhid->running = true; + +- ret = hid_add_device(hid); +- if (ret) { +- hid_err(hid, "Cannot register HID device\n"); +- goto err_hid; +- } ++ /* Adding of a HID device is done through a worker, to allow HID drivers ++ * which use feature requests during .probe to work, without they would ++ * be blocked on devlock, which is held by uhid_char_write. ++ */ ++ schedule_work(&uhid->worker); + + return 0; + +-err_hid: +- hid_destroy_device(hid); +- uhid->hid = NULL; +- uhid->running = false; + err_free: + kfree(uhid->rd_data); + uhid->rd_data = NULL; +@@ -550,6 +562,8 @@ static int uhid_dev_destroy(struct uhid_device *uhid) + uhid->running = false; + wake_up_interruptible(&uhid->report_wait); + ++ cancel_work_sync(&uhid->worker); ++ + hid_destroy_device(uhid->hid); + kfree(uhid->rd_data); + +@@ -612,6 +626,7 @@ static int uhid_char_open(struct inode *inode, struct file *file) + init_waitqueue_head(&uhid->waitq); + init_waitqueue_head(&uhid->report_wait); + uhid->running = false; ++ INIT_WORK(&uhid->worker, uhid_device_add_worker); + + file->private_data = uhid; + nonseekable_open(inode, file); +diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c +index 98ba761cbb9c..d8738d4f8df3 100644 +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_dev *indio_dev, int micro) + + mutex_lock(&st->buf_lock); + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C); + st->tx[1] = (ret & ~KXSD9_FS_MASK) | i; +@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev, + break; + case IIO_CHAN_INFO_SCALE: + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK]; + ret = IIO_VAL_INT_PLUS_MICRO; +diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c +index 70f78c3062a7..8e2b9e70511d 100644 +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -396,8 +396,8 @@ static int ad7266_probe(struct spi_device *spi) + + st = iio_priv(indio_dev); + +- st->reg = devm_regulator_get(&spi->dev, "vref"); +- if (!IS_ERR_OR_NULL(st->reg)) { ++ st->reg = devm_regulator_get_optional(&spi->dev, "vref"); ++ if (!IS_ERR(st->reg)) { + ret = regulator_enable(st->reg); + if (ret) + return ret; +@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_device *spi) + + st->vref_mv = ret / 1000; + } else { ++ /* Any other error indicates that the regulator does exist */ ++ if (PTR_ERR(st->reg) != -ENODEV) ++ return PTR_ERR(st->reg); + /* Use internal reference */ + st->vref_mv = 2500; + } +diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c +index d31098e0c43f..ae824d40195a 100644 +--- a/drivers/iio/industrialio-trigger.c ++++ b/drivers/iio/industrialio-trigger.c +@@ -203,22 +203,35 @@ static int iio_trigger_attach_poll_func(struct iio_trigger *trig, + + /* Prevent the module from being removed whilst attached to a trigger */ + __module_get(pf->indio_dev->info->driver_module); ++ ++ /* Get irq number */ + pf->irq = iio_trigger_get_irq(trig); ++ if (pf->irq < 0) ++ goto out_put_module; ++ ++ /* Request irq */ + ret = request_threaded_irq(pf->irq, pf->h, pf->thread, + pf->type, pf->name, + pf); +- if (ret < 0) { +- module_put(pf->indio_dev->info->driver_module); +- return ret; +- } ++ if (ret < 0) ++ goto out_put_irq; + ++ /* Enable trigger in driver */ + if (trig->ops && trig->ops->set_trigger_state && notinuse) { + ret = trig->ops->set_trigger_state(trig, true); + if (ret < 0) +- module_put(pf->indio_dev->info->driver_module); ++ goto out_free_irq; + } + + return ret; ++ ++out_free_irq: ++ free_irq(pf->irq, pf); ++out_put_irq: ++ iio_trigger_put_irq(trig, pf->irq); ++out_put_module: ++ module_put(pf->indio_dev->info->driver_module); ++ return ret; + } + + static int iio_trigger_detach_poll_func(struct iio_trigger *trig, +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index e881fa6291e9..1f7f844bc0b8 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -28,15 +28,21 @@ + #include <linux/iio/common/st_sensors.h> + #include "st_pressure.h" + ++#define MCELSIUS_PER_CELSIUS 1000 ++ ++/* Default pressure sensitivity */ + #define ST_PRESS_LSB_PER_MBAR 4096UL + #define ST_PRESS_KPASCAL_NANO_SCALE (100000000UL / \ + ST_PRESS_LSB_PER_MBAR) ++ ++/* Default temperature sensitivity */ + #define ST_PRESS_LSB_PER_CELSIUS 480UL +-#define ST_PRESS_CELSIUS_NANO_SCALE (1000000000UL / \ +- ST_PRESS_LSB_PER_CELSIUS) ++#define ST_PRESS_MILLI_CELSIUS_OFFSET 42500UL ++ + #define ST_PRESS_NUMBER_DATA_CHANNELS 1 + + /* FULLSCALE */ ++#define ST_PRESS_FS_AVL_1100MB 1100 + #define ST_PRESS_FS_AVL_1260MB 1260 + + #define ST_PRESS_1_OUT_XL_ADDR 0x28 +@@ -54,18 +60,20 @@ + #define ST_PRESS_LPS331AP_PW_MASK 0x80 + #define ST_PRESS_LPS331AP_FS_ADDR 0x23 + #define ST_PRESS_LPS331AP_FS_MASK 0x30 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS331AP_BDU_ADDR 0x20 + #define ST_PRESS_LPS331AP_BDU_MASK 0x04 + #define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR 0x22 + #define ST_PRESS_LPS331AP_DRDY_IRQ_INT1_MASK 0x04 + #define ST_PRESS_LPS331AP_DRDY_IRQ_INT2_MASK 0x20 + #define ST_PRESS_LPS331AP_MULTIREAD_BIT true +-#define ST_PRESS_LPS331AP_TEMP_OFFSET 42500 + + /* CUSTOM VALUES FOR LPS001WP SENSOR */ ++ ++/* LPS001WP pressure resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_MBAR 16UL ++/* LPS001WP temperature resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS 64UL ++ + #define ST_PRESS_LPS001WP_WAI_EXP 0xba + #define ST_PRESS_LPS001WP_ODR_ADDR 0x20 + #define ST_PRESS_LPS001WP_ODR_MASK 0x30 +@@ -74,6 +82,8 @@ + #define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL 0x03 + #define ST_PRESS_LPS001WP_PW_ADDR 0x20 + #define ST_PRESS_LPS001WP_PW_MASK 0x40 ++#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \ ++ (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR) + #define ST_PRESS_LPS001WP_BDU_ADDR 0x20 + #define ST_PRESS_LPS001WP_BDU_MASK 0x04 + #define ST_PRESS_LPS001WP_MULTIREAD_BIT true +@@ -90,18 +100,12 @@ + #define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL 0x04 + #define ST_PRESS_LPS25H_PW_ADDR 0x20 + #define ST_PRESS_LPS25H_PW_MASK 0x80 +-#define ST_PRESS_LPS25H_FS_ADDR 0x00 +-#define ST_PRESS_LPS25H_FS_MASK 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS25H_BDU_ADDR 0x20 + #define ST_PRESS_LPS25H_BDU_MASK 0x04 + #define ST_PRESS_LPS25H_DRDY_IRQ_ADDR 0x23 + #define ST_PRESS_LPS25H_DRDY_IRQ_INT1_MASK 0x01 + #define ST_PRESS_LPS25H_DRDY_IRQ_INT2_MASK 0x10 + #define ST_PRESS_LPS25H_MULTIREAD_BIT true +-#define ST_PRESS_LPS25H_TEMP_OFFSET 42500 + #define ST_PRESS_LPS25H_OUT_XL_ADDR 0x28 + #define ST_TEMP_LPS25H_OUT_L_ADDR 0x2b + +@@ -153,7 +157,9 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { + .storagebits = 16, + .endianness = IIO_LE, + }, +- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), ++ .info_mask_separate = ++ BIT(IIO_CHAN_INFO_RAW) | ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + { +@@ -169,7 +175,7 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = { + }, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_OFFSET), ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + IIO_CHAN_SOFT_TIMESTAMP(1) +@@ -203,11 +209,14 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .addr = ST_PRESS_LPS331AP_FS_ADDR, + .mask = ST_PRESS_LPS331AP_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS331AP datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -246,7 +255,17 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = 0, ++ .fs_avl = { ++ /* ++ * Pressure and temperature resolution values ++ * as defined in table 3 of LPS001WP datasheet. ++ */ ++ [0] = { ++ .num = ST_PRESS_FS_AVL_1100MB, ++ .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN, ++ .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS, ++ }, ++ }, + }, + .bdu = { + .addr = ST_PRESS_LPS001WP_BDU_ADDR, +@@ -282,14 +301,15 @@ static const struct st_sensor_settings st_press_sensors_settings[] = { + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = ST_PRESS_LPS25H_FS_ADDR, +- .mask = ST_PRESS_LPS25H_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS25H datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -343,26 +363,26 @@ static int st_press_read_raw(struct iio_dev *indio_dev, + + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: +- *val = 0; +- + switch (ch->type) { + case IIO_PRESSURE: ++ *val = 0; + *val2 = press_data->current_fullscale->gain; +- break; ++ return IIO_VAL_INT_PLUS_NANO; + case IIO_TEMP: ++ *val = MCELSIUS_PER_CELSIUS; + *val2 = press_data->current_fullscale->gain2; +- break; ++ return IIO_VAL_FRACTIONAL; + default: + err = -EINVAL; + goto read_error; + } + +- return IIO_VAL_INT_PLUS_NANO; + case IIO_CHAN_INFO_OFFSET: + switch (ch->type) { + case IIO_TEMP: +- *val = 425; +- *val2 = 10; ++ *val = ST_PRESS_MILLI_CELSIUS_OFFSET * ++ press_data->current_fullscale->gain2; ++ *val2 = MCELSIUS_PER_CELSIUS; + break; + default: + err = -EINVAL; +diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c +index bc0d68efd455..c96ddaf00fa6 100644 +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -64,6 +64,7 @@ struct as3935_state { + struct delayed_work work; + + u32 tune_cap; ++ u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */ + u8 buf[2] ____cacheline_aligned; + }; + +@@ -72,7 +73,8 @@ static const struct iio_chan_spec as3935_channels[] = { + .type = IIO_PROXIMITY, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_PROCESSED), ++ BIT(IIO_CHAN_INFO_PROCESSED) | ++ BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { + .sign = 'u', +@@ -181,7 +183,12 @@ static int as3935_read_raw(struct iio_dev *indio_dev, + /* storm out of range */ + if (*val == AS3935_DATA_MASK) + return -EINVAL; +- *val *= 1000; ++ ++ if (m == IIO_CHAN_INFO_PROCESSED) ++ *val *= 1000; ++ break; ++ case IIO_CHAN_INFO_SCALE: ++ *val = 1000; + break; + default: + return -EINVAL; +@@ -206,10 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private) + ret = as3935_read(st, AS3935_DATA, &val); + if (ret) + goto err_read; +- val &= AS3935_DATA_MASK; +- val *= 1000; + +- iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp); ++ st->buffer[0] = val & AS3935_DATA_MASK; ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer, ++ pf->timestamp); + err_read: + iio_trigger_notify_done(indio_dev->trig); + +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index cb5ece77fd7d..e7d7230a7e31 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1249,6 +1249,7 @@ static int __init i8042_create_kbd_port(void) + serio->start = i8042_start; + serio->stop = i8042_stop; + serio->close = i8042_port_close; ++ serio->ps2_cmd_mutex = &i8042_mutex; + serio->port_data = port; + serio->dev.parent = &i8042_platform_device->dev; + strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name)); +@@ -1345,21 +1346,6 @@ static void i8042_unregister_ports(void) + } + } + +-/* +- * Checks whether port belongs to i8042 controller. +- */ +-bool i8042_check_port_owner(const struct serio *port) +-{ +- int i; +- +- for (i = 0; i < I8042_NUM_PORTS; i++) +- if (i8042_ports[i].serio == port) +- return true; +- +- return false; +-} +-EXPORT_SYMBOL(i8042_check_port_owner); +- + static void i8042_free_irqs(void) + { + if (i8042_aux_irq_registered) +diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c +index 75516996db20..ded0c6f65c9f 100644 +--- a/drivers/input/serio/libps2.c ++++ b/drivers/input/serio/libps2.c +@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte); + + void ps2_begin_command(struct ps2dev *ps2dev) + { +- mutex_lock(&ps2dev->cmd_mutex); ++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; + +- if (i8042_check_port_owner(ps2dev->serio)) +- i8042_lock_chip(); ++ mutex_lock(m); + } + EXPORT_SYMBOL(ps2_begin_command); + + void ps2_end_command(struct ps2dev *ps2dev) + { +- if (i8042_check_port_owner(ps2dev->serio)) +- i8042_unlock_chip(); ++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex; + +- mutex_unlock(&ps2dev->cmd_mutex); ++ mutex_unlock(m); + } + EXPORT_SYMBOL(ps2_end_command); + +diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c +index b257e46876d3..0f5e1820c92d 100644 +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -287,10 +287,16 @@ static int flakey_map(struct dm_target *ti, struct bio *bio) + pb->bio_submitted = true; + + /* +- * Map reads as normal. ++ * Map reads as normal only if corrupt_bio_byte set. + */ +- if (bio_data_dir(bio) == READ) +- goto map_bio; ++ if (bio_data_dir(bio) == READ) { ++ /* If flags were specified, only corrupt those that match. */ ++ if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && ++ all_corrupt_bio_flags_match(bio, fc)) ++ goto map_bio; ++ else ++ return -EIO; ++ } + + /* + * Drop writes? +@@ -328,12 +334,13 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error) + + /* + * Corrupt successful READs while in down state. +- * If flags were specified, only corrupt those that match. + */ +- if (fc->corrupt_bio_byte && !error && pb->bio_submitted && +- (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) && +- all_corrupt_bio_flags_match(bio, fc)) +- corrupt_bio_data(bio, fc); ++ if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { ++ if (fc->corrupt_bio_byte) ++ corrupt_bio_data(bio, fc); ++ else ++ return -EIO; ++ } + + return error; + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 1f37781f7765..87de9a0848b7 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1200,8 +1200,14 @@ static void stop_queue(struct request_queue *q) + { + if (!q->mq_ops) + old_stop_queue(q); +- else ++ else { ++ spin_lock_irq(q->queue_lock); ++ queue_flag_set(QUEUE_FLAG_STOPPED, q); ++ spin_unlock_irq(q->queue_lock); ++ ++ blk_mq_cancel_requeue_work(q); + blk_mq_stop_hw_queues(q); ++ } + } + + static void old_start_queue(struct request_queue *q) +@@ -1218,8 +1224,10 @@ static void start_queue(struct request_queue *q) + { + if (!q->mq_ops) + old_start_queue(q); +- else ++ else { ++ queue_flag_clear_unlocked(QUEUE_FLAG_STOPPED, q); + blk_mq_start_stopped_hw_queues(q, true); ++ } + } + + static void dm_done(struct request *clone, int error, bool mapped) +@@ -2139,7 +2147,7 @@ static void dm_request_fn(struct request_queue *q) + goto out; + + delay_and_out: +- blk_delay_queue(q, HZ / 100); ++ blk_delay_queue(q, 10); + out: + dm_put_live_table(md, srcu_idx); + } +@@ -2731,6 +2739,17 @@ static int dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + } + dm_put_live_table(md, srcu_idx); + ++ /* ++ * On suspend dm_stop_queue() handles stopping the blk-mq ++ * request_queue BUT: even though the hw_queues are marked ++ * BLK_MQ_S_STOPPED at that point there is still a race that ++ * is allowing block/blk-mq.c to call ->queue_rq against a ++ * hctx that it really shouldn't. The following check guards ++ * against this rarity (albeit _not_ race-free). ++ */ ++ if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state))) ++ return BLK_MQ_RQ_QUEUE_BUSY; ++ + if (ti->type->busy && ti->type->busy(ti)) + return BLK_MQ_RQ_QUEUE_BUSY; + +@@ -3130,7 +3149,8 @@ static void unlock_fs(struct mapped_device *md) + * Caller must hold md->suspend_lock + */ + static int __dm_suspend(struct mapped_device *md, struct dm_table *map, +- unsigned suspend_flags, int interruptible) ++ unsigned suspend_flags, int interruptible, ++ int dmf_suspended_flag) + { + bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG; + bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG; +@@ -3197,6 +3217,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map, + * to finish. + */ + r = dm_wait_for_completion(md, interruptible); ++ if (!r) ++ set_bit(dmf_suspended_flag, &md->flags); + + if (noflush) + clear_bit(DMF_NOFLUSH_SUSPENDING, &md->flags); +@@ -3258,12 +3280,10 @@ retry: + + map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock)); + +- r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE); ++ r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE, DMF_SUSPENDED); + if (r) + goto out_unlock; + +- set_bit(DMF_SUSPENDED, &md->flags); +- + dm_table_postsuspend_targets(map); + + out_unlock: +@@ -3357,9 +3377,8 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla + * would require changing .presuspend to return an error -- avoid this + * until there is a need for more elaborate variants of internal suspend. + */ +- (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE); +- +- set_bit(DMF_SUSPENDED_INTERNALLY, &md->flags); ++ (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE, ++ DMF_SUSPENDED_INTERNALLY); + + dm_table_postsuspend_targets(map); + } +diff --git a/drivers/media/dvb-core/dvb_ringbuffer.c b/drivers/media/dvb-core/dvb_ringbuffer.c +index 1100e98a7b1d..7df7fb3738a0 100644 +--- a/drivers/media/dvb-core/dvb_ringbuffer.c ++++ b/drivers/media/dvb-core/dvb_ringbuffer.c +@@ -55,7 +55,13 @@ void dvb_ringbuffer_init(struct dvb_ringbuffer *rbuf, void *data, size_t len) + + int dvb_ringbuffer_empty(struct dvb_ringbuffer *rbuf) + { +- return (rbuf->pread==rbuf->pwrite); ++ /* smp_load_acquire() to load write pointer on reader side ++ * this pairs with smp_store_release() in dvb_ringbuffer_write(), ++ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset() ++ * ++ * for memory barriers also see Documentation/circular-buffers.txt ++ */ ++ return (rbuf->pread == smp_load_acquire(&rbuf->pwrite)); + } + + +@@ -64,7 +70,12 @@ ssize_t dvb_ringbuffer_free(struct dvb_ringbuffer *rbuf) + { + ssize_t free; + +- free = rbuf->pread - rbuf->pwrite; ++ /* ACCESS_ONCE() to load read pointer on writer side ++ * this pairs with smp_store_release() in dvb_ringbuffer_read(), ++ * dvb_ringbuffer_read_user(), dvb_ringbuffer_flush(), ++ * or dvb_ringbuffer_reset() ++ */ ++ free = ACCESS_ONCE(rbuf->pread) - rbuf->pwrite; + if (free <= 0) + free += rbuf->size; + return free-1; +@@ -76,7 +87,11 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf) + { + ssize_t avail; + +- avail = rbuf->pwrite - rbuf->pread; ++ /* smp_load_acquire() to load write pointer on reader side ++ * this pairs with smp_store_release() in dvb_ringbuffer_write(), ++ * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset() ++ */ ++ avail = smp_load_acquire(&rbuf->pwrite) - rbuf->pread; + if (avail < 0) + avail += rbuf->size; + return avail; +@@ -86,14 +101,25 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf) + + void dvb_ringbuffer_flush(struct dvb_ringbuffer *rbuf) + { +- rbuf->pread = rbuf->pwrite; ++ /* dvb_ringbuffer_flush() counts as read operation ++ * smp_load_acquire() to load write pointer ++ * smp_store_release() to update read pointer, this ensures that the ++ * correct pointer is visible for subsequent dvb_ringbuffer_free() ++ * calls on other cpu cores ++ */ ++ smp_store_release(&rbuf->pread, smp_load_acquire(&rbuf->pwrite)); + rbuf->error = 0; + } + EXPORT_SYMBOL(dvb_ringbuffer_flush); + + void dvb_ringbuffer_reset(struct dvb_ringbuffer *rbuf) + { +- rbuf->pread = rbuf->pwrite = 0; ++ /* dvb_ringbuffer_reset() counts as read and write operation ++ * smp_store_release() to update read pointer ++ */ ++ smp_store_release(&rbuf->pread, 0); ++ /* smp_store_release() to update write pointer */ ++ smp_store_release(&rbuf->pwrite, 0); + rbuf->error = 0; + } + +@@ -119,12 +145,17 @@ ssize_t dvb_ringbuffer_read_user(struct dvb_ringbuffer *rbuf, u8 __user *buf, si + return -EFAULT; + buf += split; + todo -= split; +- rbuf->pread = 0; ++ /* smp_store_release() for read pointer update to ensure ++ * that buf is not overwritten until read is complete, ++ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free() ++ */ ++ smp_store_release(&rbuf->pread, 0); + } + if (copy_to_user(buf, rbuf->data+rbuf->pread, todo)) + return -EFAULT; + +- rbuf->pread = (rbuf->pread + todo) % rbuf->size; ++ /* smp_store_release() to update read pointer, see above */ ++ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size); + + return len; + } +@@ -139,11 +170,16 @@ void dvb_ringbuffer_read(struct dvb_ringbuffer *rbuf, u8 *buf, size_t len) + memcpy(buf, rbuf->data+rbuf->pread, split); + buf += split; + todo -= split; +- rbuf->pread = 0; ++ /* smp_store_release() for read pointer update to ensure ++ * that buf is not overwritten until read is complete, ++ * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free() ++ */ ++ smp_store_release(&rbuf->pread, 0); + } + memcpy(buf, rbuf->data+rbuf->pread, todo); + +- rbuf->pread = (rbuf->pread + todo) % rbuf->size; ++ /* smp_store_release() to update read pointer, see above */ ++ smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size); + } + + +@@ -158,10 +194,16 @@ ssize_t dvb_ringbuffer_write(struct dvb_ringbuffer *rbuf, const u8 *buf, size_t + memcpy(rbuf->data+rbuf->pwrite, buf, split); + buf += split; + todo -= split; +- rbuf->pwrite = 0; ++ /* smp_store_release() for write pointer update to ensure that ++ * written data is visible on other cpu cores before the pointer ++ * update, this pairs with smp_load_acquire() in ++ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail() ++ */ ++ smp_store_release(&rbuf->pwrite, 0); + } + memcpy(rbuf->data+rbuf->pwrite, buf, todo); +- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size; ++ /* smp_store_release() for write pointer update, see above */ ++ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size); + + return len; + } +@@ -181,12 +223,18 @@ ssize_t dvb_ringbuffer_write_user(struct dvb_ringbuffer *rbuf, + return len - todo; + buf += split; + todo -= split; +- rbuf->pwrite = 0; ++ /* smp_store_release() for write pointer update to ensure that ++ * written data is visible on other cpu cores before the pointer ++ * update, this pairs with smp_load_acquire() in ++ * dvb_ringbuffer_empty() or dvb_ringbuffer_avail() ++ */ ++ smp_store_release(&rbuf->pwrite, 0); + } + status = copy_from_user(rbuf->data+rbuf->pwrite, buf, todo); + if (status) + return len - todo; +- rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size; ++ /* smp_store_release() for write pointer update, see above */ ++ smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size); + + return len; + } +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index 8333fbc2fe96..835dbb8f5970 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1022,6 +1022,11 @@ static int match_child(struct device *dev, void *data) + return !strcmp(dev_name(dev), (char *)data); + } + ++static void s5p_mfc_memdev_release(struct device *dev) ++{ ++ dma_release_declared_memory(dev); ++} ++ + static void *mfc_get_drv_data(struct platform_device *pdev); + + static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) +@@ -1034,6 +1039,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) + mfc_err("Not enough memory\n"); + return -ENOMEM; + } ++ ++ dev_set_name(dev->mem_dev_l, "%s", "s5p-mfc-l"); ++ dev->mem_dev_l->release = s5p_mfc_memdev_release; + device_initialize(dev->mem_dev_l); + of_property_read_u32_array(dev->plat_dev->dev.of_node, + "samsung,mfc-l", mem_info, 2); +@@ -1051,6 +1059,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev) + mfc_err("Not enough memory\n"); + return -ENOMEM; + } ++ ++ dev_set_name(dev->mem_dev_r, "%s", "s5p-mfc-r"); ++ dev->mem_dev_r->release = s5p_mfc_memdev_release; + device_initialize(dev->mem_dev_r); + of_property_read_u32_array(dev->plat_dev->dev.of_node, + "samsung,mfc-r", mem_info, 2); +diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c +index 84fa6e9b59a1..67314c034cdb 100644 +--- a/drivers/media/rc/ir-rc5-decoder.c ++++ b/drivers/media/rc/ir-rc5-decoder.c +@@ -29,7 +29,7 @@ + #define RC5_BIT_START (1 * RC5_UNIT) + #define RC5_BIT_END (1 * RC5_UNIT) + #define RC5X_SPACE (4 * RC5_UNIT) +-#define RC5_TRAILER (10 * RC5_UNIT) /* In reality, approx 100 */ ++#define RC5_TRAILER (6 * RC5_UNIT) /* In reality, approx 100 */ + + enum rc5_state { + STATE_INACTIVE, +diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c +index 78c12d22dfbb..5dab02432e82 100644 +--- a/drivers/media/usb/usbtv/usbtv-audio.c ++++ b/drivers/media/usb/usbtv/usbtv-audio.c +@@ -278,6 +278,9 @@ static void snd_usbtv_trigger(struct work_struct *work) + { + struct usbtv *chip = container_of(work, struct usbtv, snd_trigger); + ++ if (!chip->snd) ++ return; ++ + if (atomic_read(&chip->snd_stream)) + usbtv_audio_start(chip); + else +@@ -378,6 +381,8 @@ err: + + void usbtv_audio_free(struct usbtv *usbtv) + { ++ cancel_work_sync(&usbtv->snd_trigger); ++ + if (usbtv->snd && usbtv->udev) { + snd_card_free(usbtv->snd); + usbtv->snd = NULL; +diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c +index 12e324319573..798761f2252f 100644 +--- a/drivers/mfd/qcom_rpm.c ++++ b/drivers/mfd/qcom_rpm.c +@@ -34,7 +34,13 @@ struct qcom_rpm_resource { + struct qcom_rpm_data { + u32 version; + const struct qcom_rpm_resource *resource_table; +- unsigned n_resources; ++ unsigned int n_resources; ++ unsigned int req_ctx_off; ++ unsigned int req_sel_off; ++ unsigned int ack_ctx_off; ++ unsigned int ack_sel_off; ++ unsigned int req_sel_size; ++ unsigned int ack_sel_size; + }; + + struct qcom_rpm { +@@ -61,11 +67,7 @@ struct qcom_rpm { + + #define RPM_REQUEST_TIMEOUT (5 * HZ) + +-#define RPM_REQUEST_CONTEXT 3 +-#define RPM_REQ_SELECT 11 +-#define RPM_ACK_CONTEXT 15 +-#define RPM_ACK_SELECTOR 23 +-#define RPM_SELECT_SIZE 7 ++#define RPM_MAX_SEL_SIZE 7 + + #define RPM_NOTIFICATION BIT(30) + #define RPM_REJECTED BIT(31) +@@ -156,6 +158,12 @@ static const struct qcom_rpm_data apq8064_template = { + .version = 3, + .resource_table = apq8064_rpm_resource_table, + .n_resources = ARRAY_SIZE(apq8064_rpm_resource_table), ++ .req_ctx_off = 3, ++ .req_sel_off = 11, ++ .ack_ctx_off = 15, ++ .ack_sel_off = 23, ++ .req_sel_size = 4, ++ .ack_sel_size = 7, + }; + + static const struct qcom_rpm_resource msm8660_rpm_resource_table[] = { +@@ -239,6 +247,12 @@ static const struct qcom_rpm_data msm8660_template = { + .version = 2, + .resource_table = msm8660_rpm_resource_table, + .n_resources = ARRAY_SIZE(msm8660_rpm_resource_table), ++ .req_ctx_off = 3, ++ .req_sel_off = 11, ++ .ack_ctx_off = 19, ++ .ack_sel_off = 27, ++ .req_sel_size = 7, ++ .ack_sel_size = 7, + }; + + static const struct qcom_rpm_resource msm8960_rpm_resource_table[] = { +@@ -321,6 +335,12 @@ static const struct qcom_rpm_data msm8960_template = { + .version = 3, + .resource_table = msm8960_rpm_resource_table, + .n_resources = ARRAY_SIZE(msm8960_rpm_resource_table), ++ .req_ctx_off = 3, ++ .req_sel_off = 11, ++ .ack_ctx_off = 15, ++ .ack_sel_off = 23, ++ .req_sel_size = 4, ++ .ack_sel_size = 7, + }; + + static const struct qcom_rpm_resource ipq806x_rpm_resource_table[] = { +@@ -361,6 +381,12 @@ static const struct qcom_rpm_data ipq806x_template = { + .version = 3, + .resource_table = ipq806x_rpm_resource_table, + .n_resources = ARRAY_SIZE(ipq806x_rpm_resource_table), ++ .req_ctx_off = 3, ++ .req_sel_off = 11, ++ .ack_ctx_off = 15, ++ .ack_sel_off = 23, ++ .req_sel_size = 4, ++ .ack_sel_size = 7, + }; + + static const struct of_device_id qcom_rpm_of_match[] = { +@@ -379,7 +405,7 @@ int qcom_rpm_write(struct qcom_rpm *rpm, + { + const struct qcom_rpm_resource *res; + const struct qcom_rpm_data *data = rpm->data; +- u32 sel_mask[RPM_SELECT_SIZE] = { 0 }; ++ u32 sel_mask[RPM_MAX_SEL_SIZE] = { 0 }; + int left; + int ret = 0; + int i; +@@ -397,12 +423,12 @@ int qcom_rpm_write(struct qcom_rpm *rpm, + writel_relaxed(buf[i], RPM_REQ_REG(rpm, res->target_id + i)); + + bitmap_set((unsigned long *)sel_mask, res->select_id, 1); +- for (i = 0; i < ARRAY_SIZE(sel_mask); i++) { ++ for (i = 0; i < rpm->data->req_sel_size; i++) { + writel_relaxed(sel_mask[i], +- RPM_CTRL_REG(rpm, RPM_REQ_SELECT + i)); ++ RPM_CTRL_REG(rpm, rpm->data->req_sel_off + i)); + } + +- writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, RPM_REQUEST_CONTEXT)); ++ writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, rpm->data->req_ctx_off)); + + reinit_completion(&rpm->ack); + regmap_write(rpm->ipc_regmap, rpm->ipc_offset, BIT(rpm->ipc_bit)); +@@ -425,10 +451,11 @@ static irqreturn_t qcom_rpm_ack_interrupt(int irq, void *dev) + u32 ack; + int i; + +- ack = readl_relaxed(RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT)); +- for (i = 0; i < RPM_SELECT_SIZE; i++) +- writel_relaxed(0, RPM_CTRL_REG(rpm, RPM_ACK_SELECTOR + i)); +- writel(0, RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT)); ++ ack = readl_relaxed(RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off)); ++ for (i = 0; i < rpm->data->ack_sel_size; i++) ++ writel_relaxed(0, ++ RPM_CTRL_REG(rpm, rpm->data->ack_sel_off + i)); ++ writel(0, RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off)); + + if (ack & RPM_NOTIFICATION) { + dev_warn(rpm->dev, "ignoring notification!\n"); +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index c2e1232cd45c..fa5cd51cba38 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -2441,7 +2441,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to, + int cached = writelen > bytes && page != blockmask; + uint8_t *wbuf = buf; + int use_bufpoi; +- int part_pagewr = (column || writelen < (mtd->writesize - 1)); ++ int part_pagewr = (column || writelen < mtd->writesize); + + if (part_pagewr) + use_bufpoi = 1; +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index b7f824d5ee88..9fd4f7838080 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -887,7 +887,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + for (i = 0; i < UBI_MAX_DEVICES; i++) { + ubi = ubi_devices[i]; + if (ubi && mtd->index == ubi->mtd->index) { +- ubi_err(ubi, "mtd%d is already attached to ubi%d", ++ pr_err("ubi: mtd%d is already attached to ubi%d", + mtd->index, i); + return -EEXIST; + } +@@ -902,7 +902,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + * no sense to attach emulated MTD devices, so we prohibit this. + */ + if (mtd->type == MTD_UBIVOLUME) { +- ubi_err(ubi, "refuse attaching mtd%d - it is already emulated on top of UBI", ++ pr_err("ubi: refuse attaching mtd%d - it is already emulated on top of UBI", + mtd->index); + return -EINVAL; + } +@@ -913,7 +913,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + if (!ubi_devices[ubi_num]) + break; + if (ubi_num == UBI_MAX_DEVICES) { +- ubi_err(ubi, "only %d UBI devices may be created", ++ pr_err("ubi: only %d UBI devices may be created", + UBI_MAX_DEVICES); + return -ENFILE; + } +@@ -923,7 +923,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + + /* Make sure ubi_num is not busy */ + if (ubi_devices[ubi_num]) { +- ubi_err(ubi, "already exists"); ++ pr_err("ubi: ubi%i already exists", ubi_num); + return -EEXIST; + } + } +@@ -1005,6 +1005,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + goto out_detach; + } + ++ /* Make device "available" before it becomes accessible via sysfs */ ++ ubi_devices[ubi_num] = ubi; ++ + err = uif_init(ubi, &ref); + if (err) + goto out_detach; +@@ -1049,7 +1052,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + wake_up_process(ubi->bgt_thread); + spin_unlock(&ubi->wl_lock); + +- ubi_devices[ubi_num] = ubi; + ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); + return ubi_num; + +@@ -1060,6 +1062,7 @@ out_uif: + ubi_assert(ref); + uif_close(ubi); + out_detach: ++ ubi_devices[ubi_num] = NULL; + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index ff4d97848d1c..812ecf2d253a 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -536,13 +536,6 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) + spin_unlock(&ubi->volumes_lock); + } + +- /* Change volume table record */ +- vtbl_rec = ubi->vtbl[vol_id]; +- vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs); +- err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); +- if (err) +- goto out_acc; +- + if (pebs < 0) { + for (i = 0; i < -pebs; i++) { + err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i); +@@ -560,6 +553,24 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) + spin_unlock(&ubi->volumes_lock); + } + ++ /* ++ * When we shrink a volume we have to flush all pending (erase) work. ++ * Otherwise it can happen that upon next attach UBI finds a LEB with ++ * lnum > highest_lnum and refuses to attach. ++ */ ++ if (pebs < 0) { ++ err = ubi_wl_flush(ubi, vol_id, UBI_ALL); ++ if (err) ++ goto out_acc; ++ } ++ ++ /* Change volume table record */ ++ vtbl_rec = ubi->vtbl[vol_id]; ++ vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs); ++ err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec); ++ if (err) ++ goto out_acc; ++ + vol->reserved_pebs = reserved_pebs; + if (vol->vol_type == UBI_DYNAMIC_VOLUME) { + vol->used_ebs = reserved_pebs; +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 5db25e46a962..5dbc1744eba5 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -858,6 +858,13 @@ advance: + if (cdc_ncm_init(dev)) + goto error2; + ++ /* Some firmwares need a pause here or they will silently fail ++ * to set up the interface properly. This value was decided ++ * empirically on a Sierra Wireless MC7455 running 02.08.02.00 ++ * firmware. ++ */ ++ usleep_range(10000, 20000); ++ + /* configure data interface */ + temp = usb_set_interface(dev->udev, iface_no, data_altsetting); + if (temp) { +diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c +index 9faf69875fab..2babc39f66a7 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c +@@ -422,6 +422,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + /* 8000 Series */ + {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x10B0, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, +@@ -444,6 +445,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x24F4, 0xD030, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0xD0B0, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0xB0B0, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 5ed97246c2e7..20f0b00dda05 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -112,6 +112,7 @@ static ssize_t of_node_property_read(struct file *filp, struct kobject *kobj, + return memory_read_from_buffer(buf, count, &offset, pp->value, pp->length); + } + ++/* always return newly allocated name, caller must free after use */ + static const char *safe_name(struct kobject *kobj, const char *orig_name) + { + const char *name = orig_name; +@@ -126,9 +127,12 @@ static const char *safe_name(struct kobject *kobj, const char *orig_name) + name = kasprintf(GFP_KERNEL, "%s#%i", orig_name, ++i); + } + +- if (name != orig_name) ++ if (name == orig_name) { ++ name = kstrdup(orig_name, GFP_KERNEL); ++ } else { + pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n", + kobject_name(kobj), name); ++ } + return name; + } + +@@ -159,6 +163,7 @@ int __of_add_property_sysfs(struct device_node *np, struct property *pp) + int __of_attach_node_sysfs(struct device_node *np) + { + const char *name; ++ struct kobject *parent; + struct property *pp; + int rc; + +@@ -171,15 +176,16 @@ int __of_attach_node_sysfs(struct device_node *np) + np->kobj.kset = of_kset; + if (!np->parent) { + /* Nodes without parents are new top level trees */ +- rc = kobject_add(&np->kobj, NULL, "%s", +- safe_name(&of_kset->kobj, "base")); ++ name = safe_name(&of_kset->kobj, "base"); ++ parent = NULL; + } else { + name = safe_name(&np->parent->kobj, kbasename(np->full_name)); +- if (!name || !name[0]) +- return -EINVAL; +- +- rc = kobject_add(&np->kobj, &np->parent->kobj, "%s", name); ++ parent = &np->parent->kobj; + } ++ if (!name) ++ return -ENOMEM; ++ rc = kobject_add(&np->kobj, parent, "%s", name); ++ kfree(name); + if (rc) + return rc; + +@@ -1756,6 +1762,12 @@ int __of_remove_property(struct device_node *np, struct property *prop) + return 0; + } + ++void __of_sysfs_remove_bin_file(struct device_node *np, struct property *prop) ++{ ++ sysfs_remove_bin_file(&np->kobj, &prop->attr); ++ kfree(prop->attr.attr.name); ++} ++ + void __of_remove_property_sysfs(struct device_node *np, struct property *prop) + { + if (!IS_ENABLED(CONFIG_SYSFS)) +@@ -1763,7 +1775,7 @@ void __of_remove_property_sysfs(struct device_node *np, struct property *prop) + + /* at early boot, bail here and defer setup to of_init() */ + if (of_kset && of_node_is_attached(np)) +- sysfs_remove_bin_file(&np->kobj, &prop->attr); ++ __of_sysfs_remove_bin_file(np, prop); + } + + /** +@@ -1833,7 +1845,7 @@ void __of_update_property_sysfs(struct device_node *np, struct property *newprop + return; + + if (oldprop) +- sysfs_remove_bin_file(&np->kobj, &oldprop->attr); ++ __of_sysfs_remove_bin_file(np, oldprop); + __of_add_property_sysfs(np, newprop); + } + +diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c +index 53826b84e0ec..2d72ddcf534f 100644 +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -55,7 +55,7 @@ void __of_detach_node_sysfs(struct device_node *np) + /* only remove properties if on sysfs */ + if (of_node_is_attached(np)) { + for_each_property_of_node(np, pp) +- sysfs_remove_bin_file(&np->kobj, &pp->attr); ++ __of_sysfs_remove_bin_file(np, pp); + kobject_del(&np->kobj); + } + +diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h +index 8e882e706cd8..46ddbee22ce3 100644 +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -81,6 +81,9 @@ extern int __of_attach_node_sysfs(struct device_node *np); + extern void __of_detach_node(struct device_node *np); + extern void __of_detach_node_sysfs(struct device_node *np); + ++extern void __of_sysfs_remove_bin_file(struct device_node *np, ++ struct property *prop); ++ + /* iterators for transactions, used for overlays */ + /* forward iterator */ + #define for_each_transaction_entry(_oft, _te) \ +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 4a6933f02cd0..ae12c0317645 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3108,13 +3108,15 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + } + + /* +- * Atheros AR93xx chips do not behave after a bus reset. The device will +- * throw a Link Down error on AER-capable systems and regardless of AER, +- * config space of the device is never accessible again and typically +- * causes the system to hang or reset when access is attempted. ++ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset. ++ * The device will throw a Link Down error on AER-capable systems and ++ * regardless of AER, config space of the device is never accessible again ++ * and typically causes the system to hang or reset when access is attempted. + * http://www.spinics.net/lists/linux-pci/msg34797.html + */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); + + static void quirk_no_pm_reset(struct pci_dev *dev) + { +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index 732ff757a95f..688f6b08c70f 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -160,7 +160,6 @@ struct chv_pin_context { + * @pctldev: Pointer to the pin controller device + * @chip: GPIO chip in this pin controller + * @regs: MMIO registers +- * @lock: Lock to serialize register accesses + * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO + * offset (in GPIO number space) + * @community: Community this pinctrl instance represents +@@ -174,7 +173,6 @@ struct chv_pinctrl { + struct pinctrl_dev *pctldev; + struct gpio_chip chip; + void __iomem *regs; +- spinlock_t lock; + unsigned intr_lines[16]; + const struct chv_community *community; + u32 saved_intmask; +@@ -659,6 +657,17 @@ static const struct chv_community *chv_communities[] = { + &southeast_community, + }; + ++/* ++ * Lock to serialize register accesses ++ * ++ * Due to a silicon issue, a shared lock must be used to prevent ++ * concurrent accesses across the 4 GPIO controllers. ++ * ++ * See Intel Atom Z8000 Processor Series Specification Update (Rev. 005), ++ * errata #CHT34, for further information. ++ */ ++static DEFINE_RAW_SPINLOCK(chv_lock); ++ + static void __iomem *chv_padreg(struct chv_pinctrl *pctrl, unsigned offset, + unsigned reg) + { +@@ -720,13 +729,13 @@ static void chv_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, + u32 ctrl0, ctrl1; + bool locked; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + ctrl0 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0)); + ctrl1 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL1)); + locked = chv_pad_locked(pctrl, offset); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + if (ctrl0 & CHV_PADCTRL0_GPIOEN) { + seq_puts(s, "GPIO "); +@@ -789,14 +798,14 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function, + + grp = &pctrl->community->groups[group]; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + /* Check first that the pad is not locked */ + for (i = 0; i < grp->npins; i++) { + if (chv_pad_locked(pctrl, grp->pins[i])) { + dev_warn(pctrl->dev, "unable to set mode for locked pin %u\n", + grp->pins[i]); +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + return -EBUSY; + } + } +@@ -839,7 +848,7 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function, + pin, altfunc->mode, altfunc->invert_oe ? "" : "not "); + } + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + return 0; + } +@@ -853,13 +862,13 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev, + void __iomem *reg; + u32 value; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + if (chv_pad_locked(pctrl, offset)) { + value = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0)); + if (!(value & CHV_PADCTRL0_GPIOEN)) { + /* Locked so cannot enable */ +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + return -EBUSY; + } + } else { +@@ -899,7 +908,7 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev, + chv_writel(value, reg); + } + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + return 0; + } +@@ -913,13 +922,13 @@ static void chv_gpio_disable_free(struct pinctrl_dev *pctldev, + void __iomem *reg; + u32 value; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + reg = chv_padreg(pctrl, offset, CHV_PADCTRL0); + value = readl(reg) & ~CHV_PADCTRL0_GPIOEN; + chv_writel(value, reg); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + } + + static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, +@@ -931,7 +940,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, + unsigned long flags; + u32 ctrl0; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + ctrl0 = readl(reg) & ~CHV_PADCTRL0_GPIOCFG_MASK; + if (input) +@@ -940,7 +949,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev, + ctrl0 |= CHV_PADCTRL0_GPIOCFG_GPO << CHV_PADCTRL0_GPIOCFG_SHIFT; + chv_writel(ctrl0, reg); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + return 0; + } +@@ -965,10 +974,10 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin, + u16 arg = 0; + u32 term; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); + ctrl1 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL1)); +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + term = (ctrl0 & CHV_PADCTRL0_TERM_MASK) >> CHV_PADCTRL0_TERM_SHIFT; + +@@ -1042,7 +1051,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, + unsigned long flags; + u32 ctrl0, pull; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + ctrl0 = readl(reg); + + switch (param) { +@@ -1065,7 +1074,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, + pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT; + break; + default: +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + return -EINVAL; + } + +@@ -1083,7 +1092,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, + pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT; + break; + default: +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + return -EINVAL; + } + +@@ -1091,12 +1100,12 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin, + break; + + default: +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + return -EINVAL; + } + + chv_writel(ctrl0, reg); +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + return 0; + } +@@ -1169,9 +1178,12 @@ static int chv_gpio_get(struct gpio_chip *chip, unsigned offset) + { + struct chv_pinctrl *pctrl = gpiochip_to_pinctrl(chip); + int pin = chv_gpio_offset_to_pin(pctrl, offset); ++ unsigned long flags; + u32 ctrl0, cfg; + ++ raw_spin_lock_irqsave(&chv_lock, flags); + ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + cfg = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK; + cfg >>= CHV_PADCTRL0_GPIOCFG_SHIFT; +@@ -1189,7 +1201,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value) + void __iomem *reg; + u32 ctrl0; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + reg = chv_padreg(pctrl, pin, CHV_PADCTRL0); + ctrl0 = readl(reg); +@@ -1201,7 +1213,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value) + + chv_writel(ctrl0, reg); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + } + + static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset) +@@ -1209,8 +1221,11 @@ static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset) + struct chv_pinctrl *pctrl = gpiochip_to_pinctrl(chip); + unsigned pin = chv_gpio_offset_to_pin(pctrl, offset); + u32 ctrl0, direction; ++ unsigned long flags; + ++ raw_spin_lock_irqsave(&chv_lock, flags); + ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + direction = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK; + direction >>= CHV_PADCTRL0_GPIOCFG_SHIFT; +@@ -1248,14 +1263,14 @@ static void chv_gpio_irq_ack(struct irq_data *d) + int pin = chv_gpio_offset_to_pin(pctrl, irqd_to_hwirq(d)); + u32 intr_line; + +- spin_lock(&pctrl->lock); ++ raw_spin_lock(&chv_lock); + + intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); + intr_line &= CHV_PADCTRL0_INTSEL_MASK; + intr_line >>= CHV_PADCTRL0_INTSEL_SHIFT; + chv_writel(BIT(intr_line), pctrl->regs + CHV_INTSTAT); + +- spin_unlock(&pctrl->lock); ++ raw_spin_unlock(&chv_lock); + } + + static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) +@@ -1266,7 +1281,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) + u32 value, intr_line; + unsigned long flags; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); + intr_line &= CHV_PADCTRL0_INTSEL_MASK; +@@ -1279,7 +1294,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask) + value |= BIT(intr_line); + chv_writel(value, pctrl->regs + CHV_INTMASK); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + } + + static void chv_gpio_irq_mask(struct irq_data *d) +@@ -1313,6 +1328,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d) + unsigned long flags; + u32 intsel, value; + ++ raw_spin_lock_irqsave(&chv_lock, flags); + intsel = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0)); + intsel &= CHV_PADCTRL0_INTSEL_MASK; + intsel >>= CHV_PADCTRL0_INTSEL_SHIFT; +@@ -1323,12 +1339,11 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d) + else + handler = handle_edge_irq; + +- spin_lock_irqsave(&pctrl->lock, flags); + if (!pctrl->intr_lines[intsel]) { + __irq_set_handler_locked(d->irq, handler); + pctrl->intr_lines[intsel] = offset; + } +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + } + + chv_gpio_irq_unmask(d); +@@ -1344,7 +1359,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type) + unsigned long flags; + u32 value; + +- spin_lock_irqsave(&pctrl->lock, flags); ++ raw_spin_lock_irqsave(&chv_lock, flags); + + /* + * Pins which can be used as shared interrupt are configured in +@@ -1393,7 +1408,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type) + else if (type & IRQ_TYPE_LEVEL_MASK) + __irq_set_handler_locked(d->irq, handle_level_irq); + +- spin_unlock_irqrestore(&pctrl->lock, flags); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); + + return 0; + } +@@ -1505,7 +1520,6 @@ static int chv_pinctrl_probe(struct platform_device *pdev) + if (i == ARRAY_SIZE(chv_communities)) + return -ENODEV; + +- spin_lock_init(&pctrl->lock); + pctrl->dev = &pdev->dev; + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index fb4dd7b3ee71..af2046c87806 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -723,6 +723,11 @@ static int __init hp_wmi_rfkill_setup(struct platform_device *device) + if (err) + return err; + ++ err = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, &wireless, ++ sizeof(wireless), 0); ++ if (err) ++ return err; ++ + if (wireless & 0x1) { + wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev, + RFKILL_TYPE_WLAN, +@@ -910,7 +915,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device) + gps_rfkill = NULL; + rfkill2_count = 0; + +- if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device)) ++ if (hp_wmi_rfkill_setup(device)) + hp_wmi_rfkill2_setup(device); + + err = device_create_file(&device->dev, &dev_attr_display); +diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c +index c5a2523b0185..463003d2529c 100644 +--- a/drivers/rtc/rtc-s3c.c ++++ b/drivers/rtc/rtc-s3c.c +@@ -149,12 +149,14 @@ static int s3c_rtc_setfreq(struct s3c_rtc *info, int freq) + if (!is_power_of_2(freq)) + return -EINVAL; + ++ s3c_rtc_enable_clk(info); + spin_lock_irq(&info->pie_lock); + + if (info->data->set_freq) + info->data->set_freq(info, freq); + + spin_unlock_irq(&info->pie_lock); ++ s3c_rtc_disable_clk(info); + + return 0; + } +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index f089082c00e1..e6b77049c756 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -477,7 +477,14 @@ static void reset_sccr1(struct driver_data *drv_data) + u32 sccr1_reg; + + sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1) & ~drv_data->int_cr1; +- sccr1_reg &= ~SSCR1_RFT; ++ switch (drv_data->ssp_type) { ++ case QUARK_X1000_SSP: ++ sccr1_reg &= ~QUARK_X1000_SSCR1_RFT; ++ break; ++ default: ++ sccr1_reg &= ~SSCR1_RFT; ++ break; ++ } + sccr1_reg |= chip->threshold; + pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg); + } +diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c +index b614f272b5f4..851fcfa98068 100644 +--- a/drivers/staging/iio/accel/sca3000_core.c ++++ b/drivers/staging/iio/accel/sca3000_core.c +@@ -595,7 +595,7 @@ static ssize_t sca3000_read_frequency(struct device *dev, + goto error_ret_mut; + ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL); + mutex_unlock(&st->lock); +- if (ret) ++ if (ret < 0) + goto error_ret; + val = ret; + if (base_freq > 0) +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 6f50e9d958de..6fad3e9fd389 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -500,7 +500,8 @@ static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd) + bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD); + + spin_lock_bh(&conn->cmd_lock); +- if (!list_empty(&cmd->i_conn_node)) ++ if (!list_empty(&cmd->i_conn_node) && ++ !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP)) + list_del_init(&cmd->i_conn_node); + spin_unlock_bh(&conn->cmd_lock); + +@@ -4215,6 +4216,7 @@ transport_err: + + static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + { ++ LIST_HEAD(tmp_list); + struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL; + struct iscsi_session *sess = conn->sess; + /* +@@ -4223,18 +4225,26 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + * has been reset -> returned sleeping pre-handler state. + */ + spin_lock_bh(&conn->cmd_lock); +- list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) { ++ list_splice_init(&conn->conn_cmd_list, &tmp_list); + ++ list_for_each_entry(cmd, &tmp_list, i_conn_node) { ++ struct se_cmd *se_cmd = &cmd->se_cmd; ++ ++ if (se_cmd->se_tfo != NULL) { ++ spin_lock(&se_cmd->t_state_lock); ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; ++ spin_unlock(&se_cmd->t_state_lock); ++ } ++ } ++ spin_unlock_bh(&conn->cmd_lock); ++ ++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + list_del_init(&cmd->i_conn_node); +- spin_unlock_bh(&conn->cmd_lock); + + iscsit_increment_maxcmdsn(cmd, sess); +- + iscsit_free_cmd(cmd, true); + +- spin_lock_bh(&conn->cmd_lock); + } +- spin_unlock_bh(&conn->cmd_lock); + } + + static void iscsit_stop_timers_for_cmds( +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index 39654e917cd8..e929205e28c6 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1415,8 +1415,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + } + login->zero_tsih = zero_tsih; + +- conn->sess->se_sess->sup_prot_ops = +- conn->conn_transport->iscsit_get_sup_prot_ops(conn); ++ if (conn->sess) ++ conn->sess->se_sess->sup_prot_ops = ++ conn->conn_transport->iscsit_get_sup_prot_ops(conn); + + tpg = conn->tpg; + if (!tpg) { +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index e8848e7fe5d4..7580abe7cb45 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2531,15 +2531,9 @@ static void target_release_cmd_kref(struct kref *kref) + struct se_session *se_sess = se_cmd->se_sess; + bool fabric_stop; + +- if (list_empty(&se_cmd->se_cmd_list)) { +- spin_unlock(&se_sess->sess_cmd_lock); +- target_free_cmd_mem(se_cmd); +- se_cmd->se_tfo->release_cmd(se_cmd); +- return; +- } +- + spin_lock(&se_cmd->t_state_lock); +- fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP); ++ fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP) && ++ (se_cmd->transport_state & CMD_T_ABORTED); + spin_unlock(&se_cmd->t_state_lock); + + if (se_cmd->cmd_wait_set || fabric_stop) { +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 85323ff75edf..baa888caa964 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -88,37 +88,6 @@ static void atmel_stop_rx(struct uart_port *port); + + #define ATMEL_ISR_PASS_LIMIT 256 + +-/* UART registers. CR is write-only, hence no GET macro */ +-#define UART_PUT_CR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_CR) +-#define UART_GET_MR(port) __raw_readl((port)->membase + ATMEL_US_MR) +-#define UART_PUT_MR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_MR) +-#define UART_PUT_IER(port,v) __raw_writel(v, (port)->membase + ATMEL_US_IER) +-#define UART_PUT_IDR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_IDR) +-#define UART_GET_IMR(port) __raw_readl((port)->membase + ATMEL_US_IMR) +-#define UART_GET_CSR(port) __raw_readl((port)->membase + ATMEL_US_CSR) +-#define UART_GET_CHAR(port) __raw_readl((port)->membase + ATMEL_US_RHR) +-#define UART_PUT_CHAR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_THR) +-#define UART_GET_BRGR(port) __raw_readl((port)->membase + ATMEL_US_BRGR) +-#define UART_PUT_BRGR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_BRGR) +-#define UART_PUT_RTOR(port,v) __raw_writel(v, (port)->membase + ATMEL_US_RTOR) +-#define UART_PUT_TTGR(port, v) __raw_writel(v, (port)->membase + ATMEL_US_TTGR) +-#define UART_GET_IP_NAME(port) __raw_readl((port)->membase + ATMEL_US_NAME) +-#define UART_GET_IP_VERSION(port) __raw_readl((port)->membase + ATMEL_US_VERSION) +- +- /* PDC registers */ +-#define UART_PUT_PTCR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_PTCR) +-#define UART_GET_PTSR(port) __raw_readl((port)->membase + ATMEL_PDC_PTSR) +- +-#define UART_PUT_RPR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_RPR) +-#define UART_GET_RPR(port) __raw_readl((port)->membase + ATMEL_PDC_RPR) +-#define UART_PUT_RCR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_RCR) +-#define UART_PUT_RNPR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_RNPR) +-#define UART_PUT_RNCR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_RNCR) +- +-#define UART_PUT_TPR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_TPR) +-#define UART_PUT_TCR(port,v) __raw_writel(v, (port)->membase + ATMEL_PDC_TCR) +-#define UART_GET_TCR(port) __raw_readl((port)->membase + ATMEL_PDC_TCR) +- + struct atmel_dma_buffer { + unsigned char *buf; + dma_addr_t dma_addr; +@@ -211,6 +180,16 @@ to_atmel_uart_port(struct uart_port *uart) + return container_of(uart, struct atmel_uart_port, uart); + } + ++static inline u32 atmel_uart_readl(struct uart_port *port, u32 reg) ++{ ++ return __raw_readl(port->membase + reg); ++} ++ ++static inline void atmel_uart_writel(struct uart_port *port, u32 reg, u32 value) ++{ ++ __raw_writel(value, port->membase + reg); ++} ++ + #ifdef CONFIG_SERIAL_ATMEL_PDC + static bool atmel_use_pdc_rx(struct uart_port *port) + { +@@ -256,7 +235,7 @@ static unsigned int atmel_get_lines_status(struct uart_port *port) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + unsigned int status, ret = 0; + +- status = UART_GET_CSR(port); ++ status = atmel_uart_readl(port, ATMEL_US_CSR); + + mctrl_gpio_get(atmel_port->gpios, &ret); + +@@ -303,9 +282,9 @@ static int atmel_config_rs485(struct uart_port *port, + unsigned int mode; + + /* Disable interrupts */ +- UART_PUT_IDR(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + +- mode = UART_GET_MR(port); ++ mode = atmel_uart_readl(port, ATMEL_US_MR); + + /* Resetting serial mode to RS232 (0x0) */ + mode &= ~ATMEL_US_USMODE; +@@ -315,7 +294,8 @@ static int atmel_config_rs485(struct uart_port *port, + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; +- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send); ++ atmel_uart_writel(port, ATMEL_US_TTGR, ++ rs485conf->delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -325,10 +305,10 @@ static int atmel_config_rs485(struct uart_port *port, + else + atmel_port->tx_done_mask = ATMEL_US_TXRDY; + } +- UART_PUT_MR(port, mode); ++ atmel_uart_writel(port, ATMEL_US_MR, mode); + + /* Enable interrupts */ +- UART_PUT_IER(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); + + return 0; + } +@@ -338,7 +318,9 @@ static int atmel_config_rs485(struct uart_port *port, + */ + static u_int atmel_tx_empty(struct uart_port *port) + { +- return (UART_GET_CSR(port) & ATMEL_US_TXEMPTY) ? TIOCSER_TEMT : 0; ++ return (atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXEMPTY) ? ++ TIOCSER_TEMT : ++ 0; + } + + /* +@@ -347,13 +329,14 @@ static u_int atmel_tx_empty(struct uart_port *port) + static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + { + unsigned int control = 0; +- unsigned int mode = UART_GET_MR(port); ++ unsigned int mode = atmel_uart_readl(port, ATMEL_US_MR); + unsigned int rts_paused, rts_ready; + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + /* override mode to RS485 if needed, otherwise keep the current mode */ + if (port->rs485.flags & SER_RS485_ENABLED) { +- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); ++ atmel_uart_writel(port, ATMEL_US_TTGR, ++ port->rs485.delay_rts_after_send); + mode &= ~ATMEL_US_USMODE; + mode |= ATMEL_US_USMODE_RS485; + } +@@ -383,7 +366,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + else + control |= ATMEL_US_DTRDIS; + +- UART_PUT_CR(port, control); ++ atmel_uart_writel(port, ATMEL_US_CR, control); + + mctrl_gpio_set(atmel_port->gpios, mctrl); + +@@ -394,7 +377,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl) + else + mode |= ATMEL_US_CHMODE_NORMAL; + +- UART_PUT_MR(port, mode); ++ atmel_uart_writel(port, ATMEL_US_MR, mode); + } + + /* +@@ -405,7 +388,7 @@ static u_int atmel_get_mctrl(struct uart_port *port) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + unsigned int ret = 0, status; + +- status = UART_GET_CSR(port); ++ status = atmel_uart_readl(port, ATMEL_US_CSR); + + /* + * The control signals are active low. +@@ -431,10 +414,10 @@ static void atmel_stop_tx(struct uart_port *port) + + if (atmel_use_pdc_tx(port)) { + /* disable PDC transmit */ +- UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS); + } + /* Disable interrupts */ +- UART_PUT_IDR(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + + if ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) +@@ -448,21 +431,23 @@ static void atmel_start_tx(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + +- if (atmel_use_pdc_tx(port)) { +- if (UART_GET_PTSR(port) & ATMEL_PDC_TXTEN) +- /* The transmitter is already running. Yes, we +- really need this.*/ +- return; ++ if (atmel_use_pdc_tx(port) && (atmel_uart_readl(port, ATMEL_PDC_PTSR) ++ & ATMEL_PDC_TXTEN)) ++ /* The transmitter is already running. Yes, we ++ really need this.*/ ++ return; + ++ if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) + if ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) + atmel_stop_rx(port); + ++ if (atmel_use_pdc_tx(port)) + /* re-enable PDC transmit */ +- UART_PUT_PTCR(port, ATMEL_PDC_TXTEN); +- } ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN); ++ + /* Enable interrupts */ +- UART_PUT_IER(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); + } + + /* +@@ -470,17 +455,19 @@ static void atmel_start_tx(struct uart_port *port) + */ + static void atmel_start_rx(struct uart_port *port) + { +- UART_PUT_CR(port, ATMEL_US_RSTSTA); /* reset status and receiver */ ++ /* reset status and receiver */ ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA); + +- UART_PUT_CR(port, ATMEL_US_RXEN); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RXEN); + + if (atmel_use_pdc_rx(port)) { + /* enable PDC controller */ +- UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT | +- port->read_status_mask); +- UART_PUT_PTCR(port, ATMEL_PDC_RXTEN); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ ATMEL_US_ENDRX | ATMEL_US_TIMEOUT | ++ port->read_status_mask); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_RXTEN); + } else { +- UART_PUT_IER(port, ATMEL_US_RXRDY); ++ atmel_uart_writel(port, ATMEL_US_IER, ATMEL_US_RXRDY); + } + } + +@@ -489,15 +476,16 @@ static void atmel_start_rx(struct uart_port *port) + */ + static void atmel_stop_rx(struct uart_port *port) + { +- UART_PUT_CR(port, ATMEL_US_RXDIS); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RXDIS); + + if (atmel_use_pdc_rx(port)) { + /* disable PDC receive */ +- UART_PUT_PTCR(port, ATMEL_PDC_RXTDIS); +- UART_PUT_IDR(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT | +- port->read_status_mask); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_RXTDIS); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ ATMEL_US_ENDRX | ATMEL_US_TIMEOUT | ++ port->read_status_mask); + } else { +- UART_PUT_IDR(port, ATMEL_US_RXRDY); ++ atmel_uart_writel(port, ATMEL_US_IDR, ATMEL_US_RXRDY); + } + } + +@@ -537,7 +525,7 @@ static void atmel_enable_ms(struct uart_port *port) + else + ier |= ATMEL_US_DCDIC; + +- UART_PUT_IER(port, ier); ++ atmel_uart_writel(port, ATMEL_US_IER, ier); + } + + /* +@@ -576,7 +564,7 @@ static void atmel_disable_ms(struct uart_port *port) + else + idr |= ATMEL_US_DCDIC; + +- UART_PUT_IDR(port, idr); ++ atmel_uart_writel(port, ATMEL_US_IDR, idr); + } + + /* +@@ -585,9 +573,11 @@ static void atmel_disable_ms(struct uart_port *port) + static void atmel_break_ctl(struct uart_port *port, int break_state) + { + if (break_state != 0) +- UART_PUT_CR(port, ATMEL_US_STTBRK); /* start break */ ++ /* start break */ ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STTBRK); + else +- UART_PUT_CR(port, ATMEL_US_STPBRK); /* stop break */ ++ /* stop break */ ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STPBRK); + } + + /* +@@ -621,7 +611,7 @@ atmel_buffer_rx_char(struct uart_port *port, unsigned int status, + static void atmel_pdc_rxerr(struct uart_port *port, unsigned int status) + { + /* clear error */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA); + + if (status & ATMEL_US_RXBRK) { + /* ignore side-effect */ +@@ -644,9 +634,9 @@ static void atmel_rx_chars(struct uart_port *port) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + unsigned int status, ch; + +- status = UART_GET_CSR(port); ++ status = atmel_uart_readl(port, ATMEL_US_CSR); + while (status & ATMEL_US_RXRDY) { +- ch = UART_GET_CHAR(port); ++ ch = atmel_uart_readl(port, ATMEL_US_RHR); + + /* + * note that the error handling code is +@@ -657,12 +647,13 @@ static void atmel_rx_chars(struct uart_port *port) + || atmel_port->break_active)) { + + /* clear error */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA); + + if (status & ATMEL_US_RXBRK + && !atmel_port->break_active) { + atmel_port->break_active = 1; +- UART_PUT_IER(port, ATMEL_US_RXBRK); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ ATMEL_US_RXBRK); + } else { + /* + * This is either the end-of-break +@@ -671,14 +662,15 @@ static void atmel_rx_chars(struct uart_port *port) + * being set. In both cases, the next + * RXBRK will indicate start-of-break. + */ +- UART_PUT_IDR(port, ATMEL_US_RXBRK); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ ATMEL_US_RXBRK); + status &= ~ATMEL_US_RXBRK; + atmel_port->break_active = 0; + } + } + + atmel_buffer_rx_char(port, status, ch); +- status = UART_GET_CSR(port); ++ status = atmel_uart_readl(port, ATMEL_US_CSR); + } + + tasklet_schedule(&atmel_port->tasklet); +@@ -693,16 +685,18 @@ static void atmel_tx_chars(struct uart_port *port) + struct circ_buf *xmit = &port->state->xmit; + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + +- if (port->x_char && UART_GET_CSR(port) & atmel_port->tx_done_mask) { +- UART_PUT_CHAR(port, port->x_char); ++ if (port->x_char && ++ (atmel_uart_readl(port, ATMEL_US_CSR) & atmel_port->tx_done_mask)) { ++ atmel_uart_writel(port, ATMEL_US_THR, port->x_char); + port->icount.tx++; + port->x_char = 0; + } + if (uart_circ_empty(xmit) || uart_tx_stopped(port)) + return; + +- while (UART_GET_CSR(port) & atmel_port->tx_done_mask) { +- UART_PUT_CHAR(port, xmit->buf[xmit->tail]); ++ while (atmel_uart_readl(port, ATMEL_US_CSR) & ++ atmel_port->tx_done_mask) { ++ atmel_uart_writel(port, ATMEL_US_THR, xmit->buf[xmit->tail]); + xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1); + port->icount.tx++; + if (uart_circ_empty(xmit)) +@@ -714,7 +708,8 @@ static void atmel_tx_chars(struct uart_port *port) + + if (!uart_circ_empty(xmit)) + /* Enable interrupts */ +- UART_PUT_IER(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ atmel_port->tx_done_mask); + } + + static void atmel_complete_tx_dma(void *arg) +@@ -934,14 +929,14 @@ static void atmel_rx_from_dma(struct uart_port *port) + + + /* Reset the UART timeout early so that we don't miss one */ +- UART_PUT_CR(port, ATMEL_US_STTTO); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STTTO); + dmastat = dmaengine_tx_status(chan, + atmel_port->cookie_rx, + &state); + /* Restart a new tasklet if DMA status is error */ + if (dmastat == DMA_ERROR) { + dev_dbg(port->dev, "Get residue error, restart tasklet\n"); +- UART_PUT_IER(port, ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IER, ATMEL_US_TIMEOUT); + tasklet_schedule(&atmel_port->tasklet); + return; + } +@@ -1007,7 +1002,7 @@ static void atmel_rx_from_dma(struct uart_port *port) + tty_flip_buffer_push(tport); + spin_lock(&port->lock); + +- UART_PUT_IER(port, ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IER, ATMEL_US_TIMEOUT); + } + + static int atmel_prepare_rx_dma(struct uart_port *port) +@@ -1117,8 +1112,8 @@ atmel_handle_receive(struct uart_port *port, unsigned int pending) + * the moment. + */ + if (pending & (ATMEL_US_ENDRX | ATMEL_US_TIMEOUT)) { +- UART_PUT_IDR(port, (ATMEL_US_ENDRX +- | ATMEL_US_TIMEOUT)); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ (ATMEL_US_ENDRX | ATMEL_US_TIMEOUT)); + tasklet_schedule(&atmel_port->tasklet); + } + +@@ -1129,7 +1124,8 @@ atmel_handle_receive(struct uart_port *port, unsigned int pending) + + if (atmel_use_dma_rx(port)) { + if (pending & ATMEL_US_TIMEOUT) { +- UART_PUT_IDR(port, ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ ATMEL_US_TIMEOUT); + tasklet_schedule(&atmel_port->tasklet); + } + } +@@ -1142,8 +1138,8 @@ atmel_handle_receive(struct uart_port *port, unsigned int pending) + * End of break detected. If it came along with a + * character, atmel_rx_chars will handle it. + */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA); +- UART_PUT_IDR(port, ATMEL_US_RXBRK); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA); ++ atmel_uart_writel(port, ATMEL_US_IDR, ATMEL_US_RXBRK); + atmel_port->break_active = 0; + } + } +@@ -1158,7 +1154,8 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending) + + if (pending & atmel_port->tx_done_mask) { + /* Either PDC or interrupt transmission */ +- UART_PUT_IDR(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ atmel_port->tx_done_mask); + tasklet_schedule(&atmel_port->tasklet); + } + } +@@ -1193,7 +1190,7 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id) + + do { + status = atmel_get_lines_status(port); +- mask = UART_GET_IMR(port); ++ mask = atmel_uart_readl(port, ATMEL_US_IMR); + pending = status & mask; + if (!gpio_handled) { + /* +@@ -1219,7 +1216,7 @@ static irqreturn_t atmel_interrupt(int irq, void *dev_id) + if (atmel_port->suspended) { + atmel_port->pending |= pending; + atmel_port->pending_status = status; +- UART_PUT_IDR(port, mask); ++ atmel_uart_writel(port, ATMEL_US_IDR, mask); + pm_system_wakeup(); + break; + } +@@ -1256,7 +1253,7 @@ static void atmel_tx_pdc(struct uart_port *port) + int count; + + /* nothing left to transmit? */ +- if (UART_GET_TCR(port)) ++ if (atmel_uart_readl(port, ATMEL_PDC_TCR)) + return; + + xmit->tail += pdc->ofs; +@@ -1268,7 +1265,7 @@ static void atmel_tx_pdc(struct uart_port *port) + /* more to transmit - setup next transfer */ + + /* disable PDC transmit */ +- UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS); + + if (!uart_circ_empty(xmit) && !uart_tx_stopped(port)) { + dma_sync_single_for_device(port->dev, +@@ -1279,12 +1276,14 @@ static void atmel_tx_pdc(struct uart_port *port) + count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE); + pdc->ofs = count; + +- UART_PUT_TPR(port, pdc->dma_addr + xmit->tail); +- UART_PUT_TCR(port, count); ++ atmel_uart_writel(port, ATMEL_PDC_TPR, ++ pdc->dma_addr + xmit->tail); ++ atmel_uart_writel(port, ATMEL_PDC_TCR, count); + /* re-enable PDC transmit */ +- UART_PUT_PTCR(port, ATMEL_PDC_TXTEN); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN); + /* Enable interrupts */ +- UART_PUT_IER(port, atmel_port->tx_done_mask); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ atmel_port->tx_done_mask); + } else { + if ((port->rs485.flags & SER_RS485_ENABLED) && + !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { +@@ -1410,10 +1409,10 @@ static void atmel_rx_from_pdc(struct uart_port *port) + + do { + /* Reset the UART timeout early so that we don't miss one */ +- UART_PUT_CR(port, ATMEL_US_STTTO); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STTTO); + + pdc = &atmel_port->pdc_rx[rx_idx]; +- head = UART_GET_RPR(port) - pdc->dma_addr; ++ head = atmel_uart_readl(port, ATMEL_PDC_RPR) - pdc->dma_addr; + tail = pdc->ofs; + + /* If the PDC has switched buffers, RPR won't contain +@@ -1456,8 +1455,8 @@ static void atmel_rx_from_pdc(struct uart_port *port) + */ + if (head >= pdc->dma_size) { + pdc->ofs = 0; +- UART_PUT_RNPR(port, pdc->dma_addr); +- UART_PUT_RNCR(port, pdc->dma_size); ++ atmel_uart_writel(port, ATMEL_PDC_RNPR, pdc->dma_addr); ++ atmel_uart_writel(port, ATMEL_PDC_RNCR, pdc->dma_size); + + rx_idx = !rx_idx; + atmel_port->pdc_rx_idx = rx_idx; +@@ -1472,7 +1471,8 @@ static void atmel_rx_from_pdc(struct uart_port *port) + tty_flip_buffer_push(tport); + spin_lock(&port->lock); + +- UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ ATMEL_US_ENDRX | ATMEL_US_TIMEOUT); + } + + static int atmel_prepare_rx_pdc(struct uart_port *port) +@@ -1505,11 +1505,12 @@ static int atmel_prepare_rx_pdc(struct uart_port *port) + + atmel_port->pdc_rx_idx = 0; + +- UART_PUT_RPR(port, atmel_port->pdc_rx[0].dma_addr); +- UART_PUT_RCR(port, PDC_BUFFER_SIZE); ++ atmel_uart_writel(port, ATMEL_PDC_RPR, atmel_port->pdc_rx[0].dma_addr); ++ atmel_uart_writel(port, ATMEL_PDC_RCR, PDC_BUFFER_SIZE); + +- UART_PUT_RNPR(port, atmel_port->pdc_rx[1].dma_addr); +- UART_PUT_RNCR(port, PDC_BUFFER_SIZE); ++ atmel_uart_writel(port, ATMEL_PDC_RNPR, ++ atmel_port->pdc_rx[1].dma_addr); ++ atmel_uart_writel(port, ATMEL_PDC_RNCR, PDC_BUFFER_SIZE); + + return 0; + } +@@ -1666,7 +1667,7 @@ static void atmel_set_ops(struct uart_port *port) + static void atmel_get_ip_name(struct uart_port *port) + { + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); +- int name = UART_GET_IP_NAME(port); ++ int name = atmel_uart_readl(port, ATMEL_US_NAME); + u32 version; + int usart, uart; + /* usart and uart ascii */ +@@ -1683,7 +1684,7 @@ static void atmel_get_ip_name(struct uart_port *port) + atmel_port->is_usart = false; + } else { + /* fallback for older SoCs: use version field */ +- version = UART_GET_IP_VERSION(port); ++ version = atmel_uart_readl(port, ATMEL_US_VERSION); + switch (version) { + case 0x302: + case 0x10213: +@@ -1755,7 +1756,7 @@ static int atmel_startup(struct uart_port *port) + * request_irq() is called we could get stuck trying to + * handle an unexpected interrupt + */ +- UART_PUT_IDR(port, -1); ++ atmel_uart_writel(port, ATMEL_US_IDR, -1); + atmel_port->ms_irq_enabled = false; + + /* +@@ -1803,9 +1804,9 @@ static int atmel_startup(struct uart_port *port) + /* + * Finally, enable the serial port + */ +- UART_PUT_CR(port, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); + /* enable xmit & rcvr */ +- UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); + + setup_timer(&atmel_port->uart_timer, + atmel_uart_timer_callback, +@@ -1818,13 +1819,14 @@ static int atmel_startup(struct uart_port *port) + jiffies + uart_poll_timeout(port)); + /* set USART timeout */ + } else { +- UART_PUT_RTOR(port, PDC_RX_TIMEOUT); +- UART_PUT_CR(port, ATMEL_US_STTTO); ++ atmel_uart_writel(port, ATMEL_US_RTOR, PDC_RX_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STTTO); + +- UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ ATMEL_US_ENDRX | ATMEL_US_TIMEOUT); + } + /* enable PDC controller */ +- UART_PUT_PTCR(port, ATMEL_PDC_RXTEN); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_RXTEN); + } else if (atmel_use_dma_rx(port)) { + /* set UART timeout */ + if (!atmel_port->is_usart) { +@@ -1832,14 +1834,15 @@ static int atmel_startup(struct uart_port *port) + jiffies + uart_poll_timeout(port)); + /* set USART timeout */ + } else { +- UART_PUT_RTOR(port, PDC_RX_TIMEOUT); +- UART_PUT_CR(port, ATMEL_US_STTTO); ++ atmel_uart_writel(port, ATMEL_US_RTOR, PDC_RX_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_STTTO); + +- UART_PUT_IER(port, ATMEL_US_TIMEOUT); ++ atmel_uart_writel(port, ATMEL_US_IER, ++ ATMEL_US_TIMEOUT); + } + } else { + /* enable receive only */ +- UART_PUT_IER(port, ATMEL_US_RXRDY); ++ atmel_uart_writel(port, ATMEL_US_IER, ATMEL_US_RXRDY); + } + + return 0; +@@ -1859,7 +1862,7 @@ static void atmel_flush_buffer(struct uart_port *port) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + if (atmel_use_pdc_tx(port)) { +- UART_PUT_TCR(port, 0); ++ atmel_uart_writel(port, ATMEL_PDC_TCR, 0); + atmel_port->pdc_tx.ofs = 0; + } + } +@@ -1891,8 +1894,8 @@ static void atmel_shutdown(struct uart_port *port) + atmel_stop_rx(port); + atmel_stop_tx(port); + +- UART_PUT_CR(port, ATMEL_US_RSTSTA); +- UART_PUT_IDR(port, -1); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA); ++ atmel_uart_writel(port, ATMEL_US_IDR, -1); + + + /* +@@ -1937,12 +1940,12 @@ static void atmel_serial_pm(struct uart_port *port, unsigned int state, + clk_prepare_enable(atmel_port->clk); + + /* re-enable interrupts if we disabled some on suspend */ +- UART_PUT_IER(port, atmel_port->backup_imr); ++ atmel_uart_writel(port, ATMEL_US_IER, atmel_port->backup_imr); + break; + case 3: + /* Back up the interrupt mask and disable all interrupts */ +- atmel_port->backup_imr = UART_GET_IMR(port); +- UART_PUT_IDR(port, -1); ++ atmel_port->backup_imr = atmel_uart_readl(port, ATMEL_US_IMR); ++ atmel_uart_writel(port, ATMEL_US_IDR, -1); + + /* + * Disable the peripheral clock for this serial port. +@@ -1965,7 +1968,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + unsigned int old_mode, mode, imr, quot, baud; + + /* save the current mode register */ +- mode = old_mode = UART_GET_MR(port); ++ mode = old_mode = atmel_uart_readl(port, ATMEL_US_MR); + + /* reset the mode, clock divisor, parity, stop bits and data size */ + mode &= ~(ATMEL_US_USCLKS | ATMEL_US_CHRL | ATMEL_US_NBSTOP | +@@ -2024,7 +2027,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + + if (atmel_use_pdc_rx(port)) + /* need to enable error interrupts */ +- UART_PUT_IER(port, port->read_status_mask); ++ atmel_uart_writel(port, ATMEL_US_IER, port->read_status_mask); + + /* + * Characters to ignore +@@ -2051,15 +2054,16 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + * transmitter is empty if requested by the caller, so there's + * no need to wait for it here. + */ +- imr = UART_GET_IMR(port); +- UART_PUT_IDR(port, -1); ++ imr = atmel_uart_readl(port, ATMEL_US_IMR); ++ atmel_uart_writel(port, ATMEL_US_IDR, -1); + + /* disable receiver and transmitter */ +- UART_PUT_CR(port, ATMEL_US_TXDIS | ATMEL_US_RXDIS); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXDIS | ATMEL_US_RXDIS); + + /* mode */ + if (port->rs485.flags & SER_RS485_ENABLED) { +- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send); ++ atmel_uart_writel(port, ATMEL_US_TTGR, ++ port->rs485.delay_rts_after_send); + mode |= ATMEL_US_USMODE_RS485; + } else if (termios->c_cflag & CRTSCTS) { + /* RS232 with hardware handshake (RTS/CTS) */ +@@ -2070,7 +2074,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + } + + /* set the mode, clock divisor, parity, stop bits and data size */ +- UART_PUT_MR(port, mode); ++ atmel_uart_writel(port, ATMEL_US_MR, mode); + + /* + * when switching the mode, set the RTS line state according to the +@@ -2087,16 +2091,16 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, + rts_state = ATMEL_US_RTSEN; + } + +- UART_PUT_CR(port, rts_state); ++ atmel_uart_writel(port, ATMEL_US_CR, rts_state); + } + + /* set the baud rate */ +- UART_PUT_BRGR(port, quot); +- UART_PUT_CR(port, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); +- UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN); ++ atmel_uart_writel(port, ATMEL_US_BRGR, quot); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); + + /* restore interrupts */ +- UART_PUT_IER(port, imr); ++ atmel_uart_writel(port, ATMEL_US_IER, imr); + + /* CTS flow-control and modem-status interrupts */ + if (UART_ENABLE_MS(port, termios->c_cflag)) +@@ -2207,18 +2211,18 @@ static int atmel_verify_port(struct uart_port *port, struct serial_struct *ser) + #ifdef CONFIG_CONSOLE_POLL + static int atmel_poll_get_char(struct uart_port *port) + { +- while (!(UART_GET_CSR(port) & ATMEL_US_RXRDY)) ++ while (!(atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_RXRDY)) + cpu_relax(); + +- return UART_GET_CHAR(port); ++ return atmel_uart_readl(port, ATMEL_US_RHR); + } + + static void atmel_poll_put_char(struct uart_port *port, unsigned char ch) + { +- while (!(UART_GET_CSR(port) & ATMEL_US_TXRDY)) ++ while (!(atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY)) + cpu_relax(); + +- UART_PUT_CHAR(port, ch); ++ atmel_uart_writel(port, ATMEL_US_THR, ch); + } + #endif + +@@ -2323,9 +2327,9 @@ struct platform_device *atmel_default_console_device; /* the serial console devi + #ifdef CONFIG_SERIAL_ATMEL_CONSOLE + static void atmel_console_putchar(struct uart_port *port, int ch) + { +- while (!(UART_GET_CSR(port) & ATMEL_US_TXRDY)) ++ while (!(atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY)) + cpu_relax(); +- UART_PUT_CHAR(port, ch); ++ atmel_uart_writel(port, ATMEL_US_THR, ch); + } + + /* +@@ -2341,12 +2345,13 @@ static void atmel_console_write(struct console *co, const char *s, u_int count) + /* + * First, save IMR and then disable interrupts + */ +- imr = UART_GET_IMR(port); +- UART_PUT_IDR(port, ATMEL_US_RXRDY | atmel_port->tx_done_mask); ++ imr = atmel_uart_readl(port, ATMEL_US_IMR); ++ atmel_uart_writel(port, ATMEL_US_IDR, ++ ATMEL_US_RXRDY | atmel_port->tx_done_mask); + + /* Store PDC transmit status and disable it */ +- pdc_tx = UART_GET_PTSR(port) & ATMEL_PDC_TXTEN; +- UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS); ++ pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN; ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS); + + uart_console_write(port, s, count, atmel_console_putchar); + +@@ -2355,15 +2360,15 @@ static void atmel_console_write(struct console *co, const char *s, u_int count) + * and restore IMR + */ + do { +- status = UART_GET_CSR(port); ++ status = atmel_uart_readl(port, ATMEL_US_CSR); + } while (!(status & ATMEL_US_TXRDY)); + + /* Restore PDC transmit status */ + if (pdc_tx) +- UART_PUT_PTCR(port, ATMEL_PDC_TXTEN); ++ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN); + + /* set interrupts back the way they were */ +- UART_PUT_IER(port, imr); ++ atmel_uart_writel(port, ATMEL_US_IER, imr); + } + + /* +@@ -2379,17 +2384,17 @@ static void __init atmel_console_get_options(struct uart_port *port, int *baud, + * If the baud rate generator isn't running, the port wasn't + * initialized by the boot loader. + */ +- quot = UART_GET_BRGR(port) & ATMEL_US_CD; ++ quot = atmel_uart_readl(port, ATMEL_US_BRGR) & ATMEL_US_CD; + if (!quot) + return; + +- mr = UART_GET_MR(port) & ATMEL_US_CHRL; ++ mr = atmel_uart_readl(port, ATMEL_US_MR) & ATMEL_US_CHRL; + if (mr == ATMEL_US_CHRL_8) + *bits = 8; + else + *bits = 7; + +- mr = UART_GET_MR(port) & ATMEL_US_PAR; ++ mr = atmel_uart_readl(port, ATMEL_US_MR) & ATMEL_US_PAR; + if (mr == ATMEL_US_PAR_EVEN) + *parity = 'e'; + else if (mr == ATMEL_US_PAR_ODD) +@@ -2422,9 +2427,9 @@ static int __init atmel_console_setup(struct console *co, char *options) + if (ret) + return ret; + +- UART_PUT_IDR(port, -1); +- UART_PUT_CR(port, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); +- UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN); ++ atmel_uart_writel(port, ATMEL_US_IDR, -1); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); + + if (options) + uart_parse_options(options, &baud, &parity, &bits, &flow); +@@ -2531,7 +2536,8 @@ static int atmel_serial_suspend(struct platform_device *pdev, + + if (atmel_is_console_port(port) && console_suspend_enabled) { + /* Drain the TX shifter */ +- while (!(UART_GET_CSR(port) & ATMEL_US_TXEMPTY)) ++ while (!(atmel_uart_readl(port, ATMEL_US_CSR) & ++ ATMEL_US_TXEMPTY)) + cpu_relax(); + } + +@@ -2683,8 +2689,9 @@ static int atmel_serial_probe(struct platform_device *pdev) + clk_prepare_enable(port->clk); + + if (rs485_enabled) { +- UART_PUT_MR(&port->uart, ATMEL_US_USMODE_NORMAL); +- UART_PUT_CR(&port->uart, ATMEL_US_RTSEN); ++ atmel_uart_writel(&port->uart, ATMEL_US_MR, ++ ATMEL_US_USMODE_NORMAL); ++ atmel_uart_writel(&port->uart, ATMEL_US_CR, ATMEL_US_RTSEN); + } + + /* +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index e42cb6bdd31d..10f83076826d 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1701,7 +1701,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, + return -ENODEV; + + if (port->mapbase != 0) +- return 0; ++ return -EINVAL; + + /* setup info for port */ + port->dev = &platdev->dev; +@@ -1755,22 +1755,25 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, + ourport->dma = devm_kzalloc(port->dev, + sizeof(*ourport->dma), + GFP_KERNEL); +- if (!ourport->dma) +- return -ENOMEM; ++ if (!ourport->dma) { ++ ret = -ENOMEM; ++ goto err; ++ } + } + + ourport->clk = clk_get(&platdev->dev, "uart"); + if (IS_ERR(ourport->clk)) { + pr_err("%s: Controller clock not found\n", + dev_name(&platdev->dev)); +- return PTR_ERR(ourport->clk); ++ ret = PTR_ERR(ourport->clk); ++ goto err; + } + + ret = clk_prepare_enable(ourport->clk); + if (ret) { + pr_err("uart: clock failed to prepare+enable: %d\n", ret); + clk_put(ourport->clk); +- return ret; ++ goto err; + } + + /* Keep all interrupts masked and cleared */ +@@ -1786,7 +1789,12 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, + + /* reset the fifos (and setup the uart) */ + s3c24xx_serial_resetport(port, cfg); ++ + return 0; ++ ++err: ++ port->mapbase = 0; ++ return ret; + } + + /* Device driver serial port probe */ +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index f28b5375e2c8..d2e50a27140c 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -128,6 +128,12 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x04f3, 0x016f), .driver_info = + USB_QUIRK_DEVICE_QUALIFIER }, + ++ { USB_DEVICE(0x04f3, 0x0381), .driver_info = ++ USB_QUIRK_NO_LPM }, ++ ++ { USB_DEVICE(0x04f3, 0x21b8), .driver_info = ++ USB_QUIRK_DEVICE_QUALIFIER }, ++ + /* Roland SC-8820 */ + { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index b886226be241..f4c6e81df034 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1939,6 +1939,10 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + return 1; + } + ++ if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) ++ if ((event->status & DEPEVT_STATUS_IOC) && ++ (trb->ctrl & DWC3_TRB_CTRL_IOC)) ++ return 0; + return 1; + } + +diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c +index fe1d5fc7da2d..47d2c09e4f35 100644 +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -183,7 +183,6 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed) + { + int branch; + +- ed->state = ED_OPER; + ed->ed_prev = NULL; + ed->ed_next = NULL; + ed->hwNextED = 0; +@@ -259,6 +258,8 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed) + /* the HC may not see the schedule updates yet, but if it does + * then they'll be properly ordered. + */ ++ ++ ed->state = ED_OPER; + return 0; + } + +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index f1893e08e51a..db565f620f82 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -808,20 +808,27 @@ static void xfer_work(struct work_struct *work) + { + struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work); + struct usbhs_pipe *pipe = pkt->pipe; +- struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe); ++ struct usbhs_fifo *fifo; + struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); + struct dma_async_tx_descriptor *desc; +- struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt); ++ struct dma_chan *chan; + struct device *dev = usbhs_priv_to_dev(priv); + enum dma_transfer_direction dir; ++ unsigned long flags; + ++ usbhs_lock(priv, flags); ++ fifo = usbhs_pipe_to_fifo(pipe); ++ if (!fifo) ++ goto xfer_work_end; ++ ++ chan = usbhsf_dma_chan_get(fifo, pkt); + dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV; + + desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual, + pkt->trans, dir, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc) +- return; ++ goto xfer_work_end; + + desc->callback = usbhsf_dma_complete; + desc->callback_param = pipe; +@@ -829,7 +836,7 @@ static void xfer_work(struct work_struct *work) + pkt->cookie = dmaengine_submit(desc); + if (pkt->cookie < 0) { + dev_err(dev, "Failed to submit dma descriptor\n"); +- return; ++ goto xfer_work_end; + } + + dev_dbg(dev, " %s %d (%d/ %d)\n", +@@ -840,6 +847,9 @@ static void xfer_work(struct work_struct *work) + usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans); + dma_async_issue_pending(chan); + usbhs_pipe_enable(pipe); ++ ++xfer_work_end: ++ usbhs_unlock(priv, flags); + } + + /* +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 046529656465..74af77a022a8 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -582,6 +582,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep, + struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv); + struct usbhs_pipe *pipe; + int ret = -EIO; ++ unsigned long flags; ++ ++ usbhs_lock(priv, flags); + + /* + * if it already have pipe, +@@ -590,7 +593,8 @@ static int usbhsg_ep_enable(struct usb_ep *ep, + if (uep->pipe) { + usbhs_pipe_clear(uep->pipe); + usbhs_pipe_sequence_data0(uep->pipe); +- return 0; ++ ret = 0; ++ goto usbhsg_ep_enable_end; + } + + pipe = usbhs_pipe_malloc(priv, +@@ -618,6 +622,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep, + ret = 0; + } + ++usbhsg_ep_enable_end: ++ usbhs_unlock(priv, flags); ++ + return ret; + } + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index f00919d579e0..2a7bf26c68e6 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -276,6 +276,7 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 ++#define TELIT_PRODUCT_LE910_USBCFG4 0x1206 + + /* ZTE PRODUCTS */ + #define ZTE_VENDOR_ID 0x19d2 +@@ -1210,6 +1211,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), ++ .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), + .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index 89bac470f04e..56f7e2521202 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -73,7 +73,7 @@ struct virtio_balloon { + + /* The array of pfns we tell the Host about. */ + unsigned int num_pfns; +- u32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX]; ++ __virtio32 pfns[VIRTIO_BALLOON_ARRAY_PFNS_MAX]; + + /* Memory statistics */ + int need_stats_update; +@@ -125,14 +125,16 @@ static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq) + wait_event(vb->acked, virtqueue_get_buf(vq, &len)); + } + +-static void set_page_pfns(u32 pfns[], struct page *page) ++static void set_page_pfns(struct virtio_balloon *vb, ++ __virtio32 pfns[], struct page *page) + { + unsigned int i; + + /* Set balloon pfns pointing at this page. + * Note that the first pfn points at start of the page. */ + for (i = 0; i < VIRTIO_BALLOON_PAGES_PER_PAGE; i++) +- pfns[i] = page_to_balloon_pfn(page) + i; ++ pfns[i] = cpu_to_virtio32(vb->vdev, ++ page_to_balloon_pfn(page) + i); + } + + static void fill_balloon(struct virtio_balloon *vb, size_t num) +@@ -155,9 +157,11 @@ static void fill_balloon(struct virtio_balloon *vb, size_t num) + msleep(200); + break; + } +- set_page_pfns(vb->pfns + vb->num_pfns, page); ++ set_page_pfns(vb, vb->pfns + vb->num_pfns, page); + vb->num_pages += VIRTIO_BALLOON_PAGES_PER_PAGE; +- adjust_managed_page_count(page, -1); ++ if (!virtio_has_feature(vb->vdev, ++ VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) ++ adjust_managed_page_count(page, -1); + } + + /* Did we get any? */ +@@ -169,11 +173,15 @@ static void fill_balloon(struct virtio_balloon *vb, size_t num) + static void release_pages_balloon(struct virtio_balloon *vb) + { + unsigned int i; ++ struct page *page; + + /* Find pfns pointing at start of each page, get pages and free them. */ + for (i = 0; i < vb->num_pfns; i += VIRTIO_BALLOON_PAGES_PER_PAGE) { +- struct page *page = balloon_pfn_to_page(vb->pfns[i]); +- adjust_managed_page_count(page, 1); ++ page = balloon_pfn_to_page(virtio32_to_cpu(vb->vdev, ++ vb->pfns[i])); ++ if (!virtio_has_feature(vb->vdev, ++ VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) ++ adjust_managed_page_count(page, 1); + put_page(page); /* balloon reference */ + } + } +@@ -188,12 +196,14 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num) + num = min(num, ARRAY_SIZE(vb->pfns)); + + mutex_lock(&vb->balloon_lock); ++ /* We can't release more pages than taken */ ++ num = min(num, (size_t)vb->num_pages); + for (vb->num_pfns = 0; vb->num_pfns < num; + vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) { + page = balloon_page_dequeue(vb_dev_info); + if (!page) + break; +- set_page_pfns(vb->pfns + vb->num_pfns, page); ++ set_page_pfns(vb, vb->pfns + vb->num_pfns, page); + vb->num_pages -= VIRTIO_BALLOON_PAGES_PER_PAGE; + } + +@@ -461,13 +471,13 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + __count_vm_event(BALLOON_MIGRATE); + spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); + vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; +- set_page_pfns(vb->pfns, newpage); ++ set_page_pfns(vb, vb->pfns, newpage); + tell_host(vb, vb->inflate_vq); + + /* balloon's page migration 2nd step -- deflate "page" */ + balloon_page_delete(page); + vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; +- set_page_pfns(vb->pfns, page); ++ set_page_pfns(vb, vb->pfns, page); + tell_host(vb, vb->deflate_vq); + + mutex_unlock(&vb->balloon_lock); +diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h +index 3182273a3407..1418daa03d95 100644 +--- a/fs/cifs/cifs_fs_sb.h ++++ b/fs/cifs/cifs_fs_sb.h +@@ -46,6 +46,9 @@ + #define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */ + #define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */ + #define CIFS_MOUNT_MAP_SFM_CHR 0x800000 /* SFM/MAC mapping for illegal chars */ ++#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible ++ * root mountable ++ */ + + struct cifs_sb_info { + struct rb_root tlink_tree; +@@ -67,5 +70,6 @@ struct cifs_sb_info { + struct backing_dev_info bdi; + struct delayed_work prune_tlinks; + struct rcu_head rcu; ++ char *prepath; + }; + #endif /* _CIFS_FS_SB_H */ +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index e682b36a210f..4acbc390a7d6 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -731,24 +731,26 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + + memcpy(ses->auth_key.response + baselen, tiblob, tilen); + ++ mutex_lock(&ses->server->srv_mutex); ++ + rc = crypto_hmacmd5_alloc(ses->server); + if (rc) { + cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + /* calculate ntlmv2_hash */ + rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp); + if (rc) { + cifs_dbg(VFS, "could not get v2 hash rc %d\n", rc); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + /* calculate first part of the client response (CR1) */ + rc = CalcNTLMv2_response(ses, ntlmv2_hash); + if (rc) { + cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + /* now calculate the session key for NTLMv2 */ +@@ -757,13 +759,13 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + if (rc) { + cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n", + __func__); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash); + if (rc) { + cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash, +@@ -771,7 +773,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + CIFS_HMAC_MD5_HASH_SIZE); + if (rc) { + cifs_dbg(VFS, "%s: Could not update with response\n", __func__); +- goto setup_ntlmv2_rsp_ret; ++ goto unlock; + } + + rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash, +@@ -779,6 +781,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + if (rc) + cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__); + ++unlock: ++ mutex_unlock(&ses->server->srv_mutex); + setup_ntlmv2_rsp_ret: + kfree(tiblob); + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index fe24e22fc154..9f205a6159d3 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -679,6 +679,14 @@ cifs_do_mount(struct file_system_type *fs_type, + goto out_cifs_sb; + } + ++ if (volume_info->prepath) { ++ cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL); ++ if (cifs_sb->prepath == NULL) { ++ root = ERR_PTR(-ENOMEM); ++ goto out_cifs_sb; ++ } ++ } ++ + cifs_setup_cifs_sb(volume_info, cifs_sb); + + rc = cifs_mount(cifs_sb, volume_info); +@@ -717,7 +725,11 @@ cifs_do_mount(struct file_system_type *fs_type, + sb->s_flags |= MS_ACTIVE; + } + +- root = cifs_get_root(volume_info, sb); ++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) ++ root = dget(sb->s_root); ++ else ++ root = cifs_get_root(volume_info, sb); ++ + if (IS_ERR(root)) + goto out_super; + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 17998d19b166..cd9d50e4f5f4 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3436,6 +3436,44 @@ cifs_get_volume_info(char *mount_data, const char *devname) + return volume_info; + } + ++static int ++cifs_are_all_path_components_accessible(struct TCP_Server_Info *server, ++ unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifs_sb_info *cifs_sb, ++ char *full_path) ++{ ++ int rc; ++ char *s; ++ char sep, tmp; ++ ++ sep = CIFS_DIR_SEP(cifs_sb); ++ s = full_path; ++ ++ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, ""); ++ while (rc == 0) { ++ /* skip separators */ ++ while (*s == sep) ++ s++; ++ if (!*s) ++ break; ++ /* next separator */ ++ while (*s && *s != sep) ++ s++; ++ ++ /* ++ * temporarily null-terminate the path at the end of ++ * the current component ++ */ ++ tmp = *s; ++ *s = 0; ++ rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, ++ full_path); ++ *s = tmp; ++ } ++ return rc; ++} ++ + int + cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info) + { +@@ -3562,6 +3600,16 @@ remote_path_check: + kfree(full_path); + goto mount_fail_check; + } ++ ++ rc = cifs_are_all_path_components_accessible(server, ++ xid, tcon, cifs_sb, ++ full_path); ++ if (rc != 0) { ++ cifs_dbg(VFS, "cannot query dirs between root and final path, " ++ "enabling CIFS_MOUNT_USE_PREFIX_PATH\n"); ++ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; ++ rc = 0; ++ } + kfree(full_path); + } + +@@ -3831,6 +3879,7 @@ cifs_umount(struct cifs_sb_info *cifs_sb) + + bdi_destroy(&cifs_sb->bdi); + kfree(cifs_sb->mountdata); ++ kfree(cifs_sb->prepath); + call_rcu(&cifs_sb->rcu, delayed_free); + } + +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index c3eb998a99bd..26a3b389a265 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -84,6 +84,7 @@ build_path_from_dentry(struct dentry *direntry) + struct dentry *temp; + int namelen; + int dfsplen; ++ int pplen = 0; + char *full_path; + char dirsep; + struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb); +@@ -95,8 +96,12 @@ build_path_from_dentry(struct dentry *direntry) + dfsplen = strnlen(tcon->treeName, MAX_TREE_SIZE + 1); + else + dfsplen = 0; ++ ++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) ++ pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0; ++ + cifs_bp_rename_retry: +- namelen = dfsplen; ++ namelen = dfsplen + pplen; + seq = read_seqbegin(&rename_lock); + rcu_read_lock(); + for (temp = direntry; !IS_ROOT(temp);) { +@@ -137,7 +142,7 @@ cifs_bp_rename_retry: + } + } + rcu_read_unlock(); +- if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) { ++ if (namelen != dfsplen + pplen || read_seqretry(&rename_lock, seq)) { + cifs_dbg(FYI, "did not end path lookup where expected. namelen=%ddfsplen=%d\n", + namelen, dfsplen); + /* presumably this is only possible if racing with a rename +@@ -153,6 +158,17 @@ cifs_bp_rename_retry: + those safely to '/' if any are found in the middle of the prepath */ + /* BB test paths to Windows with '/' in the midst of prepath */ + ++ if (pplen) { ++ int i; ++ ++ cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath); ++ memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1); ++ full_path[dfsplen] = '\\'; ++ for (i = 0; i < pplen-1; i++) ++ if (full_path[dfsplen+1+i] == '/') ++ full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb); ++ } ++ + if (dfsplen) { + strncpy(full_path, tcon->treeName, dfsplen); + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) { +@@ -229,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, + goto cifs_create_get_file_info; + } + ++ if (S_ISDIR(newinode->i_mode)) { ++ CIFSSMBClose(xid, tcon, fid->netfid); ++ iput(newinode); ++ rc = -EISDIR; ++ goto out; ++ } ++ + if (!S_ISREG(newinode->i_mode)) { + /* + * The server may allow us to open things like +@@ -399,10 +422,14 @@ cifs_create_set_dentry: + if (rc != 0) { + cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n", + rc); +- if (server->ops->close) +- server->ops->close(xid, tcon, fid); +- goto out; ++ goto out_err; + } ++ ++ if (S_ISDIR(newinode->i_mode)) { ++ rc = -EISDIR; ++ goto out_err; ++ } ++ + d_drop(direntry); + d_add(direntry, newinode); + +@@ -410,6 +437,13 @@ out: + kfree(buf); + kfree(full_path); + return rc; ++ ++out_err: ++ if (server->ops->close) ++ server->ops->close(xid, tcon, fid); ++ if (newinode) ++ iput(newinode); ++ goto out; + } + + int +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 6b66dd5d1540..9fb3bc26a2ab 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -982,10 +982,26 @@ struct inode *cifs_root_iget(struct super_block *sb) + struct inode *inode = NULL; + long rc; + struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb); ++ char *path = NULL; ++ int len; ++ ++ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) ++ && cifs_sb->prepath) { ++ len = strlen(cifs_sb->prepath); ++ path = kzalloc(len + 2 /* leading sep + null */, GFP_KERNEL); ++ if (path == NULL) ++ return ERR_PTR(-ENOMEM); ++ path[0] = '/'; ++ memcpy(path+1, cifs_sb->prepath, len); ++ } else { ++ path = kstrdup("", GFP_KERNEL); ++ if (path == NULL) ++ return ERR_PTR(-ENOMEM); ++ } + + xid = get_xid(); + if (tcon->unix_ext) { +- rc = cifs_get_inode_info_unix(&inode, "", sb, xid); ++ rc = cifs_get_inode_info_unix(&inode, path, sb, xid); + /* some servers mistakenly claim POSIX support */ + if (rc != -EOPNOTSUPP) + goto iget_no_retry; +@@ -993,7 +1009,8 @@ struct inode *cifs_root_iget(struct super_block *sb) + tcon->unix_ext = false; + } + +- rc = cifs_get_inode_info(&inode, "", NULL, sb, xid, NULL); ++ convert_delimiter(path, CIFS_DIR_SEP(cifs_sb)); ++ rc = cifs_get_inode_info(&inode, path, NULL, sb, xid, NULL); + + iget_no_retry: + if (!inode) { +@@ -1022,6 +1039,7 @@ iget_no_retry: + } + + out: ++ kfree(path); + /* can not call macro free_xid here since in a void func + * TODO: This is no longer true + */ +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 1678b9cb94c7..57aeae6116d6 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -973,6 +973,9 @@ smb2_new_lease_key(struct cifs_fid *fid) + get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE); + } + ++#define SMB2_SYMLINK_STRUCT_SIZE \ ++ (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) ++ + static int + smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + const char *full_path, char **target_path, +@@ -985,7 +988,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + struct cifs_fid fid; + struct smb2_err_rsp *err_buf = NULL; + struct smb2_symlink_err_rsp *symlink; +- unsigned int sub_len, sub_offset; ++ unsigned int sub_len; ++ unsigned int sub_offset; ++ unsigned int print_len; ++ unsigned int print_offset; + + cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path); + +@@ -1006,11 +1012,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, + kfree(utf16_path); + return -ENOENT; + } ++ ++ if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) || ++ get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) { ++ kfree(utf16_path); ++ return -ENOENT; ++ } ++ + /* open must fail on symlink - reset rc */ + rc = 0; + symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData; + sub_len = le16_to_cpu(symlink->SubstituteNameLength); + sub_offset = le16_to_cpu(symlink->SubstituteNameOffset); ++ print_len = le16_to_cpu(symlink->PrintNameLength); ++ print_offset = le16_to_cpu(symlink->PrintNameOffset); ++ ++ if (get_rfc1002_length(err_buf) + 4 < ++ SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) { ++ kfree(utf16_path); ++ return -ENOENT; ++ } ++ ++ if (get_rfc1002_length(err_buf) + 4 < ++ SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) { ++ kfree(utf16_path); ++ return -ENOENT; ++ } ++ + *target_path = cifs_strndup_from_utf16( + (char *)symlink->PathBuffer + sub_offset, + sub_len, true, cifs_sb->local_nls); +diff --git a/fs/dcache.c b/fs/dcache.c +index 2c75b393d31a..660857431b1c 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -578,7 +578,6 @@ static struct dentry *dentry_kill(struct dentry *dentry) + + failed: + spin_unlock(&dentry->d_lock); +- cpu_relax(); + return dentry; /* try again with same dentry */ + } + +@@ -752,6 +751,8 @@ void dput(struct dentry *dentry) + return; + + repeat: ++ might_sleep(); ++ + rcu_read_lock(); + if (likely(fast_dput(dentry))) { + rcu_read_unlock(); +@@ -783,8 +784,10 @@ repeat: + + kill_it: + dentry = dentry_kill(dentry); +- if (dentry) ++ if (dentry) { ++ cond_resched(); + goto repeat; ++ } + } + EXPORT_SYMBOL(dput); + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index 955bf49a7945..41117e51a2e9 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -208,6 +208,9 @@ static int ext4_init_block_bitmap(struct super_block *sb, + memset(bh->b_data, 0, sb->s_blocksize); + + bit_max = ext4_num_base_meta_clusters(sb, block_group); ++ if ((bit_max >> 3) >= bh->b_size) ++ return -EIO; ++ + for (bit = 0; bit < bit_max; bit++) + ext4_set_bit(bit, bh->b_data); + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index ea12f565be24..a3276bf9ac00 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -375,9 +375,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) + ext4_fsblk_t block = ext4_ext_pblock(ext); + int len = ext4_ext_get_actual_len(ext); + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); +- ext4_lblk_t last = lblock + len - 1; + +- if (len == 0 || lblock > last) ++ /* ++ * We allow neither: ++ * - zero length ++ * - overflow/wrap-around ++ */ ++ if (lblock + len <= lblock) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } +@@ -468,6 +472,10 @@ static int __ext4_ext_check(const char *function, unsigned int line, + error_msg = "invalid extent entries"; + goto corrupted; + } ++ if (unlikely(depth > 32)) { ++ error_msg = "too large eh_depth"; ++ goto corrupted; ++ } + /* Verify checksum on non-root extent tree nodes */ + if (ext_depth(inode) != depth && + !ext4_extent_block_csum_verify(inode, eh)) { +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index ba12e2953aec..9b55c6f71bf2 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -204,9 +204,9 @@ void ext4_evict_inode(struct inode *inode) + * Note that directories do not have this problem because they + * don't use page cache. + */ +- if (ext4_should_journal_data(inode) && +- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) && +- inode->i_ino != EXT4_JOURNAL_INO) { ++ if (inode->i_ino != EXT4_JOURNAL_INO && ++ ext4_should_journal_data(inode) && ++ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) { + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; + tid_t commit_tid = EXT4_I(inode)->i_datasync_tid; + +@@ -2557,13 +2557,36 @@ retry: + done = true; + } + } +- ext4_journal_stop(handle); ++ /* ++ * Caution: If the handle is synchronous, ++ * ext4_journal_stop() can wait for transaction commit ++ * to finish which may depend on writeback of pages to ++ * complete or on page lock to be released. In that ++ * case, we have to wait until after after we have ++ * submitted all the IO, released page locks we hold, ++ * and dropped io_end reference (for extent conversion ++ * to be able to complete) before stopping the handle. ++ */ ++ if (!ext4_handle_valid(handle) || handle->h_sync == 0) { ++ ext4_journal_stop(handle); ++ handle = NULL; ++ } + /* Submit prepared bio */ + ext4_io_submit(&mpd.io_submit); + /* Unlock pages we didn't use */ + mpage_release_unused_pages(&mpd, give_up_on_write); +- /* Drop our io_end reference we got from init */ +- ext4_put_io_end(mpd.io_submit.io_end); ++ /* ++ * Drop our io_end reference we got from init. We have ++ * to be careful and use deferred io_end finishing if ++ * we are still holding the transaction as we can ++ * release the last reference to io_end which may end ++ * up doing unwritten extent conversion. ++ */ ++ if (handle) { ++ ext4_put_io_end_defer(mpd.io_submit.io_end); ++ ext4_journal_stop(handle); ++ } else ++ ext4_put_io_end(mpd.io_submit.io_end); + + if (ret == -ENOSPC && sbi->s_journal) { + /* +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index aedff7963468..f01dd19adb7b 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2229,6 +2229,16 @@ static void ext4_orphan_cleanup(struct super_block *sb, + while (es->s_last_orphan) { + struct inode *inode; + ++ /* ++ * We may have encountered an error during cleanup; if ++ * so, skip the rest. ++ */ ++ if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) { ++ jbd_debug(1, "Skipping orphan recovery on fs with errors.\n"); ++ es->s_last_orphan = 0; ++ break; ++ } ++ + inode = ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan)); + if (IS_ERR(inode)) { + es->s_last_orphan = 0; +@@ -3711,6 +3721,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount; + } + ++ if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) { ++ ext4_msg(sb, KERN_ERR, ++ "Number of reserved GDT blocks insanely large: %d", ++ le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks)); ++ goto failed_mount; ++ } ++ + if (sbi->s_mount_opt & EXT4_MOUNT_DAX) { + if (blocksize != PAGE_SIZE) { + ext4_msg(sb, KERN_ERR, +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 3227091c2a64..5cae35490b37 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -417,6 +417,15 @@ static int fuse_flush(struct file *file, fl_owner_t id) + fuse_sync_writes(inode); + mutex_unlock(&inode->i_mutex); + ++ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) && ++ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags)) ++ err = -ENOSPC; ++ if (test_bit(AS_EIO, &file->f_mapping->flags) && ++ test_and_clear_bit(AS_EIO, &file->f_mapping->flags)) ++ err = -EIO; ++ if (err) ++ return err; ++ + req = fuse_get_req_nofail_nopages(fc, file); + memset(&inarg, 0, sizeof(inarg)); + inarg.fh = ff->fh; +@@ -462,6 +471,21 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end, + goto out; + + fuse_sync_writes(inode); ++ ++ /* ++ * Due to implementation of fuse writeback ++ * filemap_write_and_wait_range() does not catch errors. ++ * We have to do this directly after fuse_sync_writes() ++ */ ++ if (test_bit(AS_ENOSPC, &file->f_mapping->flags) && ++ test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags)) ++ err = -ENOSPC; ++ if (test_bit(AS_EIO, &file->f_mapping->flags) && ++ test_and_clear_bit(AS_EIO, &file->f_mapping->flags)) ++ err = -EIO; ++ if (err) ++ goto out; ++ + err = sync_inode_metadata(inode, 1); + if (err) + goto out; +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 708d697113fc..846bb19d605a 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -910,7 +910,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req) + arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC | + FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK | + FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ | +- FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA | ++ FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA | + FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO | + FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT; + req->in.h.opcode = FUSE_INIT; +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index f98cd9adbc0d..51af4fff890f 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1241,6 +1241,9 @@ int nfs_updatepage(struct file *file, struct page *page, + dprintk("NFS: nfs_updatepage(%pD2 %d@%lld)\n", + file, count, (long long)(page_file_offset(page) + offset)); + ++ if (!count) ++ goto out; ++ + if (nfs_can_extend_write(file, page, inode)) { + count = max(count + offset, nfs_page_length(page)); + offset = 0; +@@ -1251,7 +1254,7 @@ int nfs_updatepage(struct file *file, struct page *page, + nfs_set_pageerror(page); + else + __set_page_dirty_nobuffers(page); +- ++out: + dprintk("NFS: nfs_updatepage returns %d (isize %lld)\n", + status, (long long)i_size_read(inode)); + return status; +diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c +index d54701f6dc78..076a9c096a6c 100644 +--- a/fs/nfsd/nfs2acl.c ++++ b/fs/nfsd/nfs2acl.c +@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, + goto out; + + inode = d_inode(fh->fh_dentry); +- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { +- error = -EOPNOTSUPP; +- goto out_errno; +- } + + error = fh_want_write(fh); + if (error) + goto out_errno; + +- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); ++ fh_lock(fh); ++ ++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) +- goto out_drop_write; +- error = inode->i_op->set_acl(inode, argp->acl_default, +- ACL_TYPE_DEFAULT); ++ goto out_drop_lock; ++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + if (error) +- goto out_drop_write; ++ goto out_drop_lock; ++ ++ fh_unlock(fh); + + fh_drop_write(fh); + +@@ -131,7 +130,8 @@ out: + posix_acl_release(argp->acl_access); + posix_acl_release(argp->acl_default); + return nfserr; +-out_drop_write: ++out_drop_lock: ++ fh_unlock(fh); + fh_drop_write(fh); + out_errno: + nfserr = nfserrno(error); +diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c +index 882b1a14bc3e..3911aa07a95c 100644 +--- a/fs/nfsd/nfs3acl.c ++++ b/fs/nfsd/nfs3acl.c +@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp, + goto out; + + inode = d_inode(fh->fh_dentry); +- if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) { +- error = -EOPNOTSUPP; +- goto out_errno; +- } + + error = fh_want_write(fh); + if (error) + goto out_errno; + +- error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); ++ fh_lock(fh); ++ ++ error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) +- goto out_drop_write; +- error = inode->i_op->set_acl(inode, argp->acl_default, +- ACL_TYPE_DEFAULT); ++ goto out_drop_lock; ++ error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + +-out_drop_write: ++out_drop_lock: ++ fh_unlock(fh); + fh_drop_write(fh); + out_errno: + nfserr = nfserrno(error); +diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c +index 67242bf7c6cc..7de3b41b43b6 100644 +--- a/fs/nfsd/nfs4acl.c ++++ b/fs/nfsd/nfs4acl.c +@@ -782,9 +782,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, + dentry = fhp->fh_dentry; + inode = d_inode(dentry); + +- if (!inode->i_op->set_acl || !IS_POSIXACL(inode)) +- return nfserr_attrnotsupp; +- + if (S_ISDIR(inode->i_mode)) + flags = NFS4_ACL_DIR; + +@@ -794,16 +791,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, + if (host_error < 0) + goto out_nfserr; + +- host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS); ++ fh_lock(fhp); ++ ++ host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl); + if (host_error < 0) +- goto out_release; ++ goto out_drop_lock; + + if (S_ISDIR(inode->i_mode)) { +- host_error = inode->i_op->set_acl(inode, dpacl, +- ACL_TYPE_DEFAULT); ++ host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl); + } + +-out_release: ++out_drop_lock: ++ fh_unlock(fhp); ++ + posix_acl_release(pacl); + posix_acl_release(dpacl); + out_nfserr: +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 977236a46aa2..ba5ef733951f 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -590,21 +590,25 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir) + { + struct dentry *upperdir = ovl_dentry_upper(dentry->d_parent); + struct inode *dir = upperdir->d_inode; +- struct dentry *upper = ovl_dentry_upper(dentry); ++ struct dentry *upper; + int err; + + mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT); ++ upper = lookup_one_len(dentry->d_name.name, upperdir, ++ dentry->d_name.len); ++ err = PTR_ERR(upper); ++ if (IS_ERR(upper)) ++ goto out_unlock; ++ + err = -ESTALE; +- if (upper->d_parent == upperdir) { +- /* Don't let d_delete() think it can reset d_inode */ +- dget(upper); ++ if (upper == ovl_dentry_upper(dentry)) { + if (is_dir) + err = vfs_rmdir(dir, upper); + else + err = vfs_unlink(dir, upper, NULL); +- dput(upper); + ovl_dentry_version_inc(dentry->d_parent); + } ++ dput(upper); + + /* + * Keeping this dentry hashed would mean having to release +@@ -614,6 +618,7 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir) + */ + if (!err) + d_drop(dentry); ++out_unlock: + mutex_unlock(&dir->i_mutex); + + return err; +@@ -834,29 +839,39 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, + + trap = lock_rename(new_upperdir, old_upperdir); + +- olddentry = ovl_dentry_upper(old); +- newdentry = ovl_dentry_upper(new); +- if (newdentry) { ++ ++ olddentry = lookup_one_len(old->d_name.name, old_upperdir, ++ old->d_name.len); ++ err = PTR_ERR(olddentry); ++ if (IS_ERR(olddentry)) ++ goto out_unlock; ++ ++ err = -ESTALE; ++ if (olddentry != ovl_dentry_upper(old)) ++ goto out_dput_old; ++ ++ newdentry = lookup_one_len(new->d_name.name, new_upperdir, ++ new->d_name.len); ++ err = PTR_ERR(newdentry); ++ if (IS_ERR(newdentry)) ++ goto out_dput_old; ++ ++ err = -ESTALE; ++ if (ovl_dentry_upper(new)) { + if (opaquedir) { +- newdentry = opaquedir; +- opaquedir = NULL; ++ if (newdentry != opaquedir) ++ goto out_dput; + } else { +- dget(newdentry); ++ if (newdentry != ovl_dentry_upper(new)) ++ goto out_dput; + } + } else { + new_create = true; +- newdentry = lookup_one_len(new->d_name.name, new_upperdir, +- new->d_name.len); +- err = PTR_ERR(newdentry); +- if (IS_ERR(newdentry)) +- goto out_unlock; ++ if (!d_is_negative(newdentry) && ++ (!new_opaque || !ovl_is_whiteout(newdentry))) ++ goto out_dput; + } + +- err = -ESTALE; +- if (olddentry->d_parent != old_upperdir) +- goto out_dput; +- if (newdentry->d_parent != new_upperdir) +- goto out_dput; + if (olddentry == trap) + goto out_dput; + if (newdentry == trap) +@@ -919,6 +934,8 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, + + out_dput: + dput(newdentry); ++out_dput_old: ++ dput(olddentry); + out_unlock: + unlock_rename(new_upperdir, old_upperdir); + out_revert_creds: +diff --git a/fs/posix_acl.c b/fs/posix_acl.c +index 84bb65b83570..a9dafa83678c 100644 +--- a/fs/posix_acl.c ++++ b/fs/posix_acl.c +@@ -791,38 +791,42 @@ posix_acl_xattr_get(struct dentry *dentry, const char *name, + return error; + } + +-static int +-posix_acl_xattr_set(struct dentry *dentry, const char *name, +- const void *value, size_t size, int flags, int type) ++int ++set_posix_acl(struct inode *inode, int type, struct posix_acl *acl) + { +- struct inode *inode = d_backing_inode(dentry); +- struct posix_acl *acl = NULL; +- int ret; +- + if (!IS_POSIXACL(inode)) + return -EOPNOTSUPP; + if (!inode->i_op->set_acl) + return -EOPNOTSUPP; + + if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) +- return value ? -EACCES : 0; ++ return acl ? -EACCES : 0; + if (!inode_owner_or_capable(inode)) + return -EPERM; + ++ if (acl) { ++ int ret = posix_acl_valid(acl); ++ if (ret) ++ return ret; ++ } ++ return inode->i_op->set_acl(inode, acl, type); ++} ++EXPORT_SYMBOL(set_posix_acl); ++ ++static int ++posix_acl_xattr_set(struct dentry *dentry, const char *name, ++ const void *value, size_t size, int flags, int type) ++{ ++ struct inode *inode = d_backing_inode(dentry); ++ struct posix_acl *acl = NULL; ++ int ret; ++ + if (value) { + acl = posix_acl_from_xattr(&init_user_ns, value, size); + if (IS_ERR(acl)) + return PTR_ERR(acl); +- +- if (acl) { +- ret = posix_acl_valid(acl); +- if (ret) +- goto out; +- } + } +- +- ret = inode->i_op->set_acl(inode, acl, type); +-out: ++ ret = set_posix_acl(inode, type, acl); + posix_acl_release(acl); + return ret; + } +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 6dee68d013ff..32287fb146db 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1257,7 +1257,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, + if (!pm.buffer) + goto out_task; + +- mm = mm_access(task, PTRACE_MODE_READ); ++ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); + ret = PTR_ERR(mm); + if (!mm || IS_ERR(mm)) + goto out_free; +diff --git a/include/linux/i8042.h b/include/linux/i8042.h +index 0f9bafa17a02..d98780ca9604 100644 +--- a/include/linux/i8042.h ++++ b/include/linux/i8042.h +@@ -62,7 +62,6 @@ struct serio; + void i8042_lock_chip(void); + void i8042_unlock_chip(void); + int i8042_command(unsigned char *param, int command); +-bool i8042_check_port_owner(const struct serio *); + int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, + struct serio *serio)); + int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str, +@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned char *param, int command) + return -ENODEV; + } + +-static inline bool i8042_check_port_owner(const struct serio *serio) +-{ +- return false; +-} +- + static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str, + struct serio *serio)) + { +diff --git a/include/linux/serio.h b/include/linux/serio.h +index 9f779c7a2da4..27ae809edd70 100644 +--- a/include/linux/serio.h ++++ b/include/linux/serio.h +@@ -29,7 +29,8 @@ struct serio { + + struct serio_device_id id; + +- spinlock_t lock; /* protects critical sections from port's interrupt handler */ ++ /* Protects critical sections from port's interrupt handler */ ++ spinlock_t lock; + + int (*write)(struct serio *, unsigned char); + int (*open)(struct serio *); +@@ -38,16 +39,29 @@ struct serio { + void (*stop)(struct serio *); + + struct serio *parent; +- struct list_head child_node; /* Entry in parent->children list */ ++ /* Entry in parent->children list */ ++ struct list_head child_node; + struct list_head children; +- unsigned int depth; /* level of nesting in serio hierarchy */ ++ /* Level of nesting in serio hierarchy */ ++ unsigned int depth; + +- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */ +- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */ ++ /* ++ * serio->drv is accessed from interrupt handlers; when modifying ++ * caller should acquire serio->drv_mutex and serio->lock. ++ */ ++ struct serio_driver *drv; ++ /* Protects serio->drv so attributes can pin current driver */ ++ struct mutex drv_mutex; + + struct device dev; + + struct list_head node; ++ ++ /* ++ * For use by PS/2 layer when several ports share hardware and ++ * may get indigestion when exposed to concurrent access (i8042). ++ */ ++ struct mutex *ps2_cmd_mutex; + }; + #define to_serio_port(d) container_of(d, struct serio, dev) + +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 003dca933803..5664ca07c9c7 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -529,20 +529,27 @@ TRACE_EVENT(svc_xprt_do_enqueue, + + TP_STRUCT__entry( + __field(struct svc_xprt *, xprt) +- __field_struct(struct sockaddr_storage, ss) + __field(int, pid) + __field(unsigned long, flags) ++ __dynamic_array(unsigned char, addr, xprt != NULL ? ++ xprt->xpt_remotelen : 0) + ), + + TP_fast_assign( + __entry->xprt = xprt; +- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); + __entry->pid = rqst? rqst->rq_task->pid : 0; +- __entry->flags = xprt ? xprt->xpt_flags : 0; ++ if (xprt) { ++ memcpy(__get_dynamic_array(addr), ++ &xprt->xpt_remote, ++ xprt->xpt_remotelen); ++ __entry->flags = xprt->xpt_flags; ++ } else ++ __entry->flags = 0; + ), + + TP_printk("xprt=0x%p addr=%pIScp pid=%d flags=%s", __entry->xprt, +- (struct sockaddr *)&__entry->ss, ++ __get_dynamic_array_len(addr) != 0 ? ++ (struct sockaddr *)__get_dynamic_array(addr) : NULL, + __entry->pid, show_svc_xprt_flags(__entry->flags)) + ); + +@@ -553,18 +560,25 @@ TRACE_EVENT(svc_xprt_dequeue, + + TP_STRUCT__entry( + __field(struct svc_xprt *, xprt) +- __field_struct(struct sockaddr_storage, ss) + __field(unsigned long, flags) ++ __dynamic_array(unsigned char, addr, xprt != NULL ? ++ xprt->xpt_remotelen : 0) + ), + + TP_fast_assign( +- __entry->xprt = xprt, +- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); +- __entry->flags = xprt ? xprt->xpt_flags : 0; ++ __entry->xprt = xprt; ++ if (xprt) { ++ memcpy(__get_dynamic_array(addr), ++ &xprt->xpt_remote, ++ xprt->xpt_remotelen); ++ __entry->flags = xprt->xpt_flags; ++ } else ++ __entry->flags = 0; + ), + + TP_printk("xprt=0x%p addr=%pIScp flags=%s", __entry->xprt, +- (struct sockaddr *)&__entry->ss, ++ __get_dynamic_array_len(addr) != 0 ? ++ (struct sockaddr *)__get_dynamic_array(addr) : NULL, + show_svc_xprt_flags(__entry->flags)) + ); + +@@ -592,19 +606,26 @@ TRACE_EVENT(svc_handle_xprt, + TP_STRUCT__entry( + __field(struct svc_xprt *, xprt) + __field(int, len) +- __field_struct(struct sockaddr_storage, ss) + __field(unsigned long, flags) ++ __dynamic_array(unsigned char, addr, xprt != NULL ? ++ xprt->xpt_remotelen : 0) + ), + + TP_fast_assign( + __entry->xprt = xprt; +- xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss)); + __entry->len = len; +- __entry->flags = xprt ? xprt->xpt_flags : 0; ++ if (xprt) { ++ memcpy(__get_dynamic_array(addr), ++ &xprt->xpt_remote, ++ xprt->xpt_remotelen); ++ __entry->flags = xprt->xpt_flags; ++ } else ++ __entry->flags = 0; + ), + + TP_printk("xprt=0x%p addr=%pIScp len=%d flags=%s", __entry->xprt, +- (struct sockaddr *)&__entry->ss, ++ __get_dynamic_array_len(addr) != 0 ? ++ (struct sockaddr *)__get_dynamic_array(addr) : NULL, + __entry->len, show_svc_xprt_flags(__entry->flags)) + ); + #endif /* _TRACE_SUNRPC_H */ +diff --git a/ipc/msg.c b/ipc/msg.c +index 652540613d26..3b2b0f5149ab 100644 +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -678,7 +678,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, + rcu_read_lock(); + ipc_lock_object(&msq->q_perm); + +- ipc_rcu_putref(msq, ipc_rcu_free); ++ ipc_rcu_putref(msq, msg_rcu_free); + /* raced with RMID? */ + if (!ipc_valid_object(&msq->q_perm)) { + err = -EIDRM; +diff --git a/ipc/sem.c b/ipc/sem.c +index c50aa5755c62..534caee6bf33 100644 +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -442,7 +442,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns + static inline void sem_lock_and_putref(struct sem_array *sma) + { + sem_lock(sma, NULL, -1); +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + } + + static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s) +@@ -1385,7 +1385,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, + rcu_read_unlock(); + sem_io = ipc_alloc(sizeof(ushort)*nsems); + if (sem_io == NULL) { +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + return -ENOMEM; + } + +@@ -1419,20 +1419,20 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, + if (nsems > SEMMSL_FAST) { + sem_io = ipc_alloc(sizeof(ushort)*nsems); + if (sem_io == NULL) { +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + return -ENOMEM; + } + } + + if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) { +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + err = -EFAULT; + goto out_free; + } + + for (i = 0; i < nsems; i++) { + if (sem_io[i] > SEMVMX) { +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + err = -ERANGE; + goto out_free; + } +@@ -1722,7 +1722,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) + /* step 2: allocate new undo structure */ + new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL); + if (!new) { +- ipc_rcu_putref(sma, ipc_rcu_free); ++ ipc_rcu_putref(sma, sem_rcu_free); + return ERR_PTR(-ENOMEM); + } + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 9fb9d1cb83ce..b1943039aab6 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -73,6 +73,7 @@ + #include <linux/compat.h> + #include <linux/ctype.h> + #include <linux/string.h> ++#include <linux/uaccess.h> + #include <uapi/linux/limits.h> + + #include "audit.h" +@@ -82,7 +83,8 @@ + #define AUDITSC_SUCCESS 1 + #define AUDITSC_FAILURE 2 + +-/* no execve audit message should be longer than this (userspace limits) */ ++/* no execve audit message should be longer than this (userspace limits), ++ * see the note near the top of audit_log_execve_info() about this value */ + #define MAX_EXECVE_AUDIT_LEN 7500 + + /* max length to print of cmdline/proctitle value during audit */ +@@ -987,185 +989,178 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, + return rc; + } + +-/* +- * to_send and len_sent accounting are very loose estimates. We aren't +- * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being +- * within about 500 bytes (next page boundary) +- * +- * why snprintf? an int is up to 12 digits long. if we just assumed when +- * logging that a[%d]= was going to be 16 characters long we would be wasting +- * space in every audit message. In one 7500 byte message we can log up to +- * about 1000 min size arguments. That comes down to about 50% waste of space +- * if we didn't do the snprintf to find out how long arg_num_len was. +- */ +-static int audit_log_single_execve_arg(struct audit_context *context, +- struct audit_buffer **ab, +- int arg_num, +- size_t *len_sent, +- const char __user *p, +- char *buf) ++static void audit_log_execve_info(struct audit_context *context, ++ struct audit_buffer **ab) + { +- char arg_num_len_buf[12]; +- const char __user *tmp_p = p; +- /* how many digits are in arg_num? 5 is the length of ' a=""' */ +- size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5; +- size_t len, len_left, to_send; +- size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN; +- unsigned int i, has_cntl = 0, too_long = 0; +- int ret; +- +- /* strnlen_user includes the null we don't want to send */ +- len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1; +- +- /* +- * We just created this mm, if we can't find the strings +- * we just copied into it something is _very_ wrong. Similar +- * for strings that are too long, we should not have created +- * any. +- */ +- if (unlikely((len == -1) || len > MAX_ARG_STRLEN - 1)) { +- WARN_ON(1); +- send_sig(SIGKILL, current, 0); +- return -1; ++ long len_max; ++ long len_rem; ++ long len_full; ++ long len_buf; ++ long len_abuf; ++ long len_tmp; ++ bool require_data; ++ bool encode; ++ unsigned int iter; ++ unsigned int arg; ++ char *buf_head; ++ char *buf; ++ const char __user *p = (const char __user *)current->mm->arg_start; ++ ++ /* NOTE: this buffer needs to be large enough to hold all the non-arg ++ * data we put in the audit record for this argument (see the ++ * code below) ... at this point in time 96 is plenty */ ++ char abuf[96]; ++ ++ /* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the ++ * current value of 7500 is not as important as the fact that it ++ * is less than 8k, a setting of 7500 gives us plenty of wiggle ++ * room if we go over a little bit in the logging below */ ++ WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500); ++ len_max = MAX_EXECVE_AUDIT_LEN; ++ ++ /* scratch buffer to hold the userspace args */ ++ buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL); ++ if (!buf_head) { ++ audit_panic("out of memory for argv string"); ++ return; + } ++ buf = buf_head; + +- /* walk the whole argument looking for non-ascii chars */ ++ audit_log_format(*ab, "argc=%d", context->execve.argc); ++ ++ len_rem = len_max; ++ len_buf = 0; ++ len_full = 0; ++ require_data = true; ++ encode = false; ++ iter = 0; ++ arg = 0; + do { +- if (len_left > MAX_EXECVE_AUDIT_LEN) +- to_send = MAX_EXECVE_AUDIT_LEN; +- else +- to_send = len_left; +- ret = copy_from_user(buf, tmp_p, to_send); +- /* +- * There is no reason for this copy to be short. We just +- * copied them here, and the mm hasn't been exposed to user- +- * space yet. +- */ +- if (ret) { +- WARN_ON(1); +- send_sig(SIGKILL, current, 0); +- return -1; +- } +- buf[to_send] = '\0'; +- has_cntl = audit_string_contains_control(buf, to_send); +- if (has_cntl) { +- /* +- * hex messages get logged as 2 bytes, so we can only +- * send half as much in each message +- */ +- max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2; +- break; +- } +- len_left -= to_send; +- tmp_p += to_send; +- } while (len_left > 0); +- +- len_left = len; +- +- if (len > max_execve_audit_len) +- too_long = 1; +- +- /* rewalk the argument actually logging the message */ +- for (i = 0; len_left > 0; i++) { +- int room_left; +- +- if (len_left > max_execve_audit_len) +- to_send = max_execve_audit_len; +- else +- to_send = len_left; +- +- /* do we have space left to send this argument in this ab? */ +- room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent; +- if (has_cntl) +- room_left -= (to_send * 2); +- else +- room_left -= to_send; +- if (room_left < 0) { +- *len_sent = 0; +- audit_log_end(*ab); +- *ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE); +- if (!*ab) +- return 0; +- } ++ /* NOTE: we don't ever want to trust this value for anything ++ * serious, but the audit record format insists we ++ * provide an argument length for really long arguments, ++ * e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but ++ * to use strncpy_from_user() to obtain this value for ++ * recording in the log, although we don't use it ++ * anywhere here to avoid a double-fetch problem */ ++ if (len_full == 0) ++ len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1; ++ ++ /* read more data from userspace */ ++ if (require_data) { ++ /* can we make more room in the buffer? */ ++ if (buf != buf_head) { ++ memmove(buf_head, buf, len_buf); ++ buf = buf_head; ++ } ++ ++ /* fetch as much as we can of the argument */ ++ len_tmp = strncpy_from_user(&buf_head[len_buf], p, ++ len_max - len_buf); ++ if (len_tmp == -EFAULT) { ++ /* unable to copy from userspace */ ++ send_sig(SIGKILL, current, 0); ++ goto out; ++ } else if (len_tmp == (len_max - len_buf)) { ++ /* buffer is not large enough */ ++ require_data = true; ++ /* NOTE: if we are going to span multiple ++ * buffers force the encoding so we stand ++ * a chance at a sane len_full value and ++ * consistent record encoding */ ++ encode = true; ++ len_full = len_full * 2; ++ p += len_tmp; ++ } else { ++ require_data = false; ++ if (!encode) ++ encode = audit_string_contains_control( ++ buf, len_tmp); ++ /* try to use a trusted value for len_full */ ++ if (len_full < len_max) ++ len_full = (encode ? ++ len_tmp * 2 : len_tmp); ++ p += len_tmp + 1; ++ } ++ len_buf += len_tmp; ++ buf_head[len_buf] = '\0'; + +- /* +- * first record needs to say how long the original string was +- * so we can be sure nothing was lost. +- */ +- if ((i == 0) && (too_long)) +- audit_log_format(*ab, " a%d_len=%zu", arg_num, +- has_cntl ? 2*len : len); +- +- /* +- * normally arguments are small enough to fit and we already +- * filled buf above when we checked for control characters +- * so don't bother with another copy_from_user +- */ +- if (len >= max_execve_audit_len) +- ret = copy_from_user(buf, p, to_send); +- else +- ret = 0; +- if (ret) { +- WARN_ON(1); +- send_sig(SIGKILL, current, 0); +- return -1; ++ /* length of the buffer in the audit record? */ ++ len_abuf = (encode ? len_buf * 2 : len_buf + 2); + } +- buf[to_send] = '\0'; +- +- /* actually log it */ +- audit_log_format(*ab, " a%d", arg_num); +- if (too_long) +- audit_log_format(*ab, "[%d]", i); +- audit_log_format(*ab, "="); +- if (has_cntl) +- audit_log_n_hex(*ab, buf, to_send); +- else +- audit_log_string(*ab, buf); +- +- p += to_send; +- len_left -= to_send; +- *len_sent += arg_num_len; +- if (has_cntl) +- *len_sent += to_send * 2; +- else +- *len_sent += to_send; +- } +- /* include the null we didn't log */ +- return len + 1; +-} + +-static void audit_log_execve_info(struct audit_context *context, +- struct audit_buffer **ab) +-{ +- int i, len; +- size_t len_sent = 0; +- const char __user *p; +- char *buf; ++ /* write as much as we can to the audit log */ ++ if (len_buf > 0) { ++ /* NOTE: some magic numbers here - basically if we ++ * can't fit a reasonable amount of data into the ++ * existing audit buffer, flush it and start with ++ * a new buffer */ ++ if ((sizeof(abuf) + 8) > len_rem) { ++ len_rem = len_max; ++ audit_log_end(*ab); ++ *ab = audit_log_start(context, ++ GFP_KERNEL, AUDIT_EXECVE); ++ if (!*ab) ++ goto out; ++ } + +- p = (const char __user *)current->mm->arg_start; ++ /* create the non-arg portion of the arg record */ ++ len_tmp = 0; ++ if (require_data || (iter > 0) || ++ ((len_abuf + sizeof(abuf)) > len_rem)) { ++ if (iter == 0) { ++ len_tmp += snprintf(&abuf[len_tmp], ++ sizeof(abuf) - len_tmp, ++ " a%d_len=%lu", ++ arg, len_full); ++ } ++ len_tmp += snprintf(&abuf[len_tmp], ++ sizeof(abuf) - len_tmp, ++ " a%d[%d]=", arg, iter++); ++ } else ++ len_tmp += snprintf(&abuf[len_tmp], ++ sizeof(abuf) - len_tmp, ++ " a%d=", arg); ++ WARN_ON(len_tmp >= sizeof(abuf)); ++ abuf[sizeof(abuf) - 1] = '\0'; ++ ++ /* log the arg in the audit record */ ++ audit_log_format(*ab, "%s", abuf); ++ len_rem -= len_tmp; ++ len_tmp = len_buf; ++ if (encode) { ++ if (len_abuf > len_rem) ++ len_tmp = len_rem / 2; /* encoding */ ++ audit_log_n_hex(*ab, buf, len_tmp); ++ len_rem -= len_tmp * 2; ++ len_abuf -= len_tmp * 2; ++ } else { ++ if (len_abuf > len_rem) ++ len_tmp = len_rem - 2; /* quotes */ ++ audit_log_n_string(*ab, buf, len_tmp); ++ len_rem -= len_tmp + 2; ++ /* don't subtract the "2" because we still need ++ * to add quotes to the remaining string */ ++ len_abuf -= len_tmp; ++ } ++ len_buf -= len_tmp; ++ buf += len_tmp; ++ } + +- audit_log_format(*ab, "argc=%d", context->execve.argc); ++ /* ready to move to the next argument? */ ++ if ((len_buf == 0) && !require_data) { ++ arg++; ++ iter = 0; ++ len_full = 0; ++ require_data = true; ++ encode = false; ++ } ++ } while (arg < context->execve.argc); + +- /* +- * we need some kernel buffer to hold the userspace args. Just +- * allocate one big one rather than allocating one of the right size +- * for every single argument inside audit_log_single_execve_arg() +- * should be <8k allocation so should be pretty safe. +- */ +- buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL); +- if (!buf) { +- audit_panic("out of memory for argv string"); +- return; +- } ++ /* NOTE: the caller handles the final audit_log_end() call */ + +- for (i = 0; i < context->execve.argc; i++) { +- len = audit_log_single_execve_arg(context, ab, i, +- &len_sent, p, buf); +- if (len <= 0) +- break; +- p += len; +- } +- kfree(buf); ++out: ++ kfree(buf_head); + } + + static void show_special(struct audit_context *context, int *call_panic) +diff --git a/kernel/module.c b/kernel/module.c +index be8971d817ed..6920d1080cdd 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -2451,13 +2451,18 @@ static inline void kmemleak_load_module(const struct module *mod, + #endif + + #ifdef CONFIG_MODULE_SIG +-static int module_sig_check(struct load_info *info) ++static int module_sig_check(struct load_info *info, int flags) + { + int err = -ENOKEY; + const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1; + const void *mod = info->hdr; + +- if (info->len > markerlen && ++ /* ++ * Require flags == 0, as a module with version information ++ * removed is no longer the module that was signed ++ */ ++ if (flags == 0 && ++ info->len > markerlen && + memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) { + /* We truncate the module to discard the signature */ + info->len -= markerlen; +@@ -2476,7 +2481,7 @@ static int module_sig_check(struct load_info *info) + return err; + } + #else /* !CONFIG_MODULE_SIG */ +-static int module_sig_check(struct load_info *info) ++static int module_sig_check(struct load_info *info, int flags) + { + return 0; + } +@@ -3277,7 +3282,7 @@ static int load_module(struct load_info *info, const char __user *uargs, + long err; + char *after_dashes; + +- err = module_sig_check(info); ++ err = module_sig_check(info, flags); + if (err) + goto free_copy; + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 9d724c0383d2..88b472bec71d 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1756,6 +1756,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count, + * and reducing the surplus. + */ + spin_unlock(&hugetlb_lock); ++ ++ /* yield cpu to avoid soft lockup */ ++ cond_resched(); ++ + if (hstate_is_gigantic(h)) + ret = alloc_fresh_gigantic_page(h, nodes_allowed); + else +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index a7278f05eafb..289c96d3e47d 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -927,7 +927,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, + break; + } + +- if (get_user(opt, (u32 __user *) optval)) { ++ if (get_user(opt, (u16 __user *) optval)) { + err = -EFAULT; + break; + } +diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c +index 9a1edcde4ba5..eca46d3d3ff3 100644 +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -1024,8 +1024,11 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr, + } + + /* Check if we have opened a local TSAP */ +- if (!self->tsap) +- irda_open_tsap(self, LSAP_ANY, addr->sir_name); ++ if (!self->tsap) { ++ err = irda_open_tsap(self, LSAP_ANY, addr->sir_name); ++ if (err) ++ goto out; ++ } + + /* Move to connecting socket, start sending Connect Requests */ + sock->state = SS_CONNECTING; +diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c +index 97b75f9bfbcd..d43869879fcf 100644 +--- a/net/netfilter/nf_nat_redirect.c ++++ b/net/netfilter/nf_nat_redirect.c +@@ -55,7 +55,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb, + + rcu_read_lock(); + indev = __in_dev_get_rcu(skb->dev); +- if (indev != NULL) { ++ if (indev && indev->ifa_list) { + ifa = indev->ifa_list; + newdst = ifa->ifa_local; + } +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 28cddc85b700..bfa2b6d5b5cf 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -824,7 +824,11 @@ socket_setattr_return: + */ + void netlbl_sock_delattr(struct sock *sk) + { +- cipso_v4_sock_delattr(sk); ++ switch (sk->sk_family) { ++ case AF_INET: ++ cipso_v4_sock_delattr(sk); ++ break; ++ } + } + + /** +@@ -987,7 +991,11 @@ req_setattr_return: + */ + void netlbl_req_delattr(struct request_sock *req) + { +- cipso_v4_req_delattr(req); ++ switch (req->rsk_ops->family) { ++ case AF_INET: ++ cipso_v4_req_delattr(req); ++ break; ++ } + } + + /** +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index e00bcd129336..5dffe37f300e 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -33,10 +33,17 @@ + #include <string.h> + #include <unistd.h> + ++/* ++ * glibc synced up and added the metag number but didn't add the relocations. ++ * Work around this in a crude manner for now. ++ */ + #ifndef EM_METAG +-/* Remove this when these make it to the standard system elf.h. */ + #define EM_METAG 174 ++#endif ++#ifndef R_METAG_ADDR32 + #define R_METAG_ADDR32 2 ++#endif ++#ifndef R_METAG_NONE + #define R_METAG_NONE 3 + #endif + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 7e3020c1e9d3..43e785a79eb3 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1247,6 +1247,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + tu->tstamp = *tstamp; + if ((tu->filter & (1 << event)) == 0 || !tu->tread) + return; ++ memset(&r1, 0, sizeof(r1)); + r1.event = event; + r1.tstamp = *tstamp; + r1.val = resolution; +@@ -1281,6 +1282,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + } + if ((tu->filter & (1 << SNDRV_TIMER_EVENT_RESOLUTION)) && + tu->last_resolution != resolution) { ++ memset(&r1, 0, sizeof(r1)); + r1.event = SNDRV_TIMER_EVENT_RESOLUTION; + r1.tstamp = tstamp; + r1.val = resolution; +@@ -1746,6 +1748,7 @@ static int snd_timer_user_params(struct file *file, + if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) { + if (tu->tread) { + struct snd_timer_tread tread; ++ memset(&tread, 0, sizeof(tread)); + tread.event = SNDRV_TIMER_EVENT_EARLY; + tread.tstamp.tv_sec = 0; + tread.tstamp.tv_nsec = 0; +diff --git a/sound/hda/array.c b/sound/hda/array.c +index 516795baa7db..5dfa610e4471 100644 +--- a/sound/hda/array.c ++++ b/sound/hda/array.c +@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *array) + return NULL; + if (array->used >= array->alloced) { + int num = array->alloced + array->alloc_align; ++ int oldsize = array->alloced * array->elem_size; + int size = (num + 1) * array->elem_size; + void *nlist; + if (snd_BUG_ON(num >= 4096)) + return NULL; +- nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO); ++ nlist = krealloc(array->list, size, GFP_KERNEL); + if (!nlist) + return NULL; ++ memset(nlist + oldsize, 0, size - oldsize); + array->list = nlist; + array->alloced = num; + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index f24a69db0dd8..c8506496826a 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2114,6 +2114,8 @@ static const struct pci_device_id azx_ids[] = { + { PCI_DEVICE(0x1022, 0x780d), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, + /* ATI HDMI */ ++ { PCI_DEVICE(0x1002, 0x0002), ++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x1308), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x157a), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b3234321aa4b..429697a93a71 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4584,6 +4584,71 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec, + } + } + ++static void alc298_fixup_speaker_volume(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ /* The speaker is routed to the Node 0x06 by a mistake, as a result ++ we can't adjust the speaker's volume since this node does not has ++ Amp-out capability. we change the speaker's route to: ++ Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 ( ++ Pin Complex), since Node 0x02 has Amp-out caps, we can adjust ++ speaker's volume now. */ ++ ++ hda_nid_t conn1[1] = { 0x0c }; ++ snd_hda_override_conn_list(codec, 0x17, 1, conn1); ++ } ++} ++ ++/* Hook to update amp GPIO4 for automute */ ++static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, ++ struct hda_jack_callback *jack) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ snd_hda_gen_hp_automute(codec, jack); ++ /* mute_led_polarity is set to 0, so we pass inverted value here */ ++ alc_update_gpio_led(codec, 0x10, !spec->gen.hp_jack_present); ++} ++ ++/* Manage GPIOs for HP EliteBook Folio 9480m. ++ * ++ * GPIO4 is the headphone amplifier power control ++ * GPIO3 is the audio output mute indicator LED ++ */ ++ ++static void alc280_fixup_hp_9480m(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ static const struct hda_verb gpio_init[] = { ++ { 0x01, AC_VERB_SET_GPIO_MASK, 0x18 }, ++ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x18 }, ++ {} ++ }; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ /* Set the hooks to turn the headphone amp on/off ++ * as needed ++ */ ++ spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook; ++ spec->gen.hp_automute_hook = alc280_hp_gpio4_automute_hook; ++ ++ /* The GPIOs are currently off */ ++ spec->gpio_led = 0; ++ ++ /* GPIO3 is connected to the output mute LED, ++ * high is on, low is off ++ */ ++ spec->mute_led_polarity = 0; ++ spec->gpio_mute_led_mask = 0x08; ++ ++ /* Initialize GPIO configuration */ ++ snd_hda_add_verbs(codec, gpio_init); ++ } ++} ++ + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + +@@ -4665,6 +4730,7 @@ enum { + ALC286_FIXUP_HP_GPIO_LED, + ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY, + ALC280_FIXUP_HP_DOCK_PINS, ++ ALC280_FIXUP_HP_9480M, + ALC288_FIXUP_DELL_HEADSET_MODE, + ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC288_FIXUP_DELL_XPS_13_GPIO6, +@@ -4683,6 +4749,7 @@ enum { + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, ++ ALC298_FIXUP_SPK_VOLUME, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5199,6 +5266,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC280_FIXUP_HP_GPIO4 + }, ++ [ALC280_FIXUP_HP_9480M] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc280_fixup_hp_9480m, ++ }, + [ALC288_FIXUP_DELL_HEADSET_MODE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_headset_mode_dell_alc288, +@@ -5334,6 +5405,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, + }, ++ [ALC298_FIXUP_SPK_VOLUME] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc298_fixup_speaker_volume, ++ .chained = true, ++ .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5380,6 +5457,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), +@@ -5407,6 +5485,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M), + SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), + SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), + /* ALC290 */ +@@ -5700,6 +5779,32 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x1e, 0x411111f0}, + {0x21, 0x0221103f}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x40000000}, ++ {0x14, 0x90170130}, ++ {0x1b, 0x02011020}, ++ {0x21, 0x0221103f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x14, 0x90170150}, ++ {0x17, 0x411111f0}, ++ {0x18, 0x411111f0}, ++ {0x19, 0x411111f0}, ++ {0x1a, 0x411111f0}, ++ {0x1b, 0x02011020}, ++ {0x1d, 0x4054c029}, ++ {0x1e, 0x411111f0}, ++ {0x21, 0x0221105f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x40000000}, ++ {0x14, 0x90170110}, ++ {0x17, 0x411111f0}, ++ {0x18, 0x411111f0}, ++ {0x19, 0x411111f0}, ++ {0x1a, 0x411111f0}, ++ {0x1b, 0x01014020}, ++ {0x1d, 0x4054c029}, ++ {0x1e, 0x411111f0}, ++ {0x21, 0x0221101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60160}, + {0x14, 0x90170120}, + {0x17, 0x90170140}, +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index d93deb5ce4f2..f9746f29f870 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -134,6 +134,7 @@ int vcpu_load(struct kvm_vcpu *vcpu) + put_cpu(); + return 0; + } ++EXPORT_SYMBOL_GPL(vcpu_load); + + void vcpu_put(struct kvm_vcpu *vcpu) + { +@@ -143,6 +144,7 @@ void vcpu_put(struct kvm_vcpu *vcpu) + preempt_enable(); + mutex_unlock(&vcpu->mutex); + } ++EXPORT_SYMBOL_GPL(vcpu_put); + + static void ack_flush(void *_completed) + { |