Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.4 commit in: /
Date: Wed, 30 May 2018 11:38:20
Message-Id: 1527680285.83af8acee1b778f2ffff17695cff770dd1bb1667.mpagano@gentoo
1 commit: 83af8acee1b778f2ffff17695cff770dd1bb1667
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Wed May 30 11:38:05 2018 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Wed May 30 11:38:05 2018 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=83af8ace
7
8 Linux patch 4.4.134
9
10 0000_README | 4 +
11 1133_linux-4.4.134.patch | 7683 ++++++++++++++++++++++++++++++++++++++++++++++
12 2 files changed, 7687 insertions(+)
13
14 diff --git a/0000_README b/0000_README
15 index 2913d51..300dbde 100644
16 --- a/0000_README
17 +++ b/0000_README
18 @@ -575,6 +575,10 @@ Patch: 1132_linux-4.4.133.patch
19 From: http://www.kernel.org
20 Desc: Linux 4.4.133
21
22 +Patch: 1133_linux-4.4.134.patch
23 +From: http://www.kernel.org
24 +Desc: Linux 4.4.134
25 +
26 Patch: 1500_XATTR_USER_PREFIX.patch
27 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
28 Desc: Support for namespace user.pax.* on tmpfs.
29
30 diff --git a/1133_linux-4.4.134.patch b/1133_linux-4.4.134.patch
31 new file mode 100644
32 index 0000000..7024f15
33 --- /dev/null
34 +++ b/1133_linux-4.4.134.patch
35 @@ -0,0 +1,7683 @@
36 +diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
37 +index 1699a55b7b70..ef639960b272 100644
38 +--- a/Documentation/device-mapper/thin-provisioning.txt
39 ++++ b/Documentation/device-mapper/thin-provisioning.txt
40 +@@ -112,9 +112,11 @@ $low_water_mark is expressed in blocks of size $data_block_size. If
41 + free space on the data device drops below this level then a dm event
42 + will be triggered which a userspace daemon should catch allowing it to
43 + extend the pool device. Only one such event will be sent.
44 +-Resuming a device with a new table itself triggers an event so the
45 +-userspace daemon can use this to detect a situation where a new table
46 +-already exceeds the threshold.
47 ++
48 ++No special event is triggered if a just resumed device's free space is below
49 ++the low water mark. However, resuming a device always triggers an
50 ++event; a userspace daemon should verify that free space exceeds the low
51 ++water mark when handling this event.
52 +
53 + A low water mark for the metadata device is maintained in the kernel and
54 + will trigger a dm event if free space on the metadata device drops below
55 +diff --git a/Makefile b/Makefile
56 +index ac52ee65685b..119dbcb4f311 100644
57 +--- a/Makefile
58 ++++ b/Makefile
59 +@@ -1,6 +1,6 @@
60 + VERSION = 4
61 + PATCHLEVEL = 4
62 +-SUBLEVEL = 133
63 ++SUBLEVEL = 134
64 + EXTRAVERSION =
65 + NAME = Blurry Fish Butt
66 +
67 +diff --git a/arch/alpha/include/asm/xchg.h b/arch/alpha/include/asm/xchg.h
68 +index 0ca9724597c1..7081e52291d0 100644
69 +--- a/arch/alpha/include/asm/xchg.h
70 ++++ b/arch/alpha/include/asm/xchg.h
71 +@@ -11,6 +11,10 @@
72 + * Atomic exchange.
73 + * Since it can be used to implement critical sections
74 + * it must clobber "memory" (also for interrupts in UP).
75 ++ *
76 ++ * The leading and the trailing memory barriers guarantee that these
77 ++ * operations are fully ordered.
78 ++ *
79 + */
80 +
81 + static inline unsigned long
82 +@@ -18,6 +22,7 @@ ____xchg(_u8, volatile char *m, unsigned long val)
83 + {
84 + unsigned long ret, tmp, addr64;
85 +
86 ++ smp_mb();
87 + __asm__ __volatile__(
88 + " andnot %4,7,%3\n"
89 + " insbl %1,%4,%1\n"
90 +@@ -42,6 +47,7 @@ ____xchg(_u16, volatile short *m, unsigned long val)
91 + {
92 + unsigned long ret, tmp, addr64;
93 +
94 ++ smp_mb();
95 + __asm__ __volatile__(
96 + " andnot %4,7,%3\n"
97 + " inswl %1,%4,%1\n"
98 +@@ -66,6 +72,7 @@ ____xchg(_u32, volatile int *m, unsigned long val)
99 + {
100 + unsigned long dummy;
101 +
102 ++ smp_mb();
103 + __asm__ __volatile__(
104 + "1: ldl_l %0,%4\n"
105 + " bis $31,%3,%1\n"
106 +@@ -86,6 +93,7 @@ ____xchg(_u64, volatile long *m, unsigned long val)
107 + {
108 + unsigned long dummy;
109 +
110 ++ smp_mb();
111 + __asm__ __volatile__(
112 + "1: ldq_l %0,%4\n"
113 + " bis $31,%3,%1\n"
114 +@@ -127,10 +135,12 @@ ____xchg(, volatile void *ptr, unsigned long x, int size)
115 + * store NEW in MEM. Return the initial value in MEM. Success is
116 + * indicated by comparing RETURN with OLD.
117 + *
118 +- * The memory barrier should be placed in SMP only when we actually
119 +- * make the change. If we don't change anything (so if the returned
120 +- * prev is equal to old) then we aren't acquiring anything new and
121 +- * we don't need any memory barrier as far I can tell.
122 ++ * The leading and the trailing memory barriers guarantee that these
123 ++ * operations are fully ordered.
124 ++ *
125 ++ * The trailing memory barrier is placed in SMP unconditionally, in
126 ++ * order to guarantee that dependency ordering is preserved when a
127 ++ * dependency is headed by an unsuccessful operation.
128 + */
129 +
130 + static inline unsigned long
131 +@@ -138,6 +148,7 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
132 + {
133 + unsigned long prev, tmp, cmp, addr64;
134 +
135 ++ smp_mb();
136 + __asm__ __volatile__(
137 + " andnot %5,7,%4\n"
138 + " insbl %1,%5,%1\n"
139 +@@ -149,8 +160,8 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
140 + " or %1,%2,%2\n"
141 + " stq_c %2,0(%4)\n"
142 + " beq %2,3f\n"
143 +- __ASM__MB
144 + "2:\n"
145 ++ __ASM__MB
146 + ".subsection 2\n"
147 + "3: br 1b\n"
148 + ".previous"
149 +@@ -165,6 +176,7 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
150 + {
151 + unsigned long prev, tmp, cmp, addr64;
152 +
153 ++ smp_mb();
154 + __asm__ __volatile__(
155 + " andnot %5,7,%4\n"
156 + " inswl %1,%5,%1\n"
157 +@@ -176,8 +188,8 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
158 + " or %1,%2,%2\n"
159 + " stq_c %2,0(%4)\n"
160 + " beq %2,3f\n"
161 +- __ASM__MB
162 + "2:\n"
163 ++ __ASM__MB
164 + ".subsection 2\n"
165 + "3: br 1b\n"
166 + ".previous"
167 +@@ -192,6 +204,7 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
168 + {
169 + unsigned long prev, cmp;
170 +
171 ++ smp_mb();
172 + __asm__ __volatile__(
173 + "1: ldl_l %0,%5\n"
174 + " cmpeq %0,%3,%1\n"
175 +@@ -199,8 +212,8 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
176 + " mov %4,%1\n"
177 + " stl_c %1,%2\n"
178 + " beq %1,3f\n"
179 +- __ASM__MB
180 + "2:\n"
181 ++ __ASM__MB
182 + ".subsection 2\n"
183 + "3: br 1b\n"
184 + ".previous"
185 +@@ -215,6 +228,7 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
186 + {
187 + unsigned long prev, cmp;
188 +
189 ++ smp_mb();
190 + __asm__ __volatile__(
191 + "1: ldq_l %0,%5\n"
192 + " cmpeq %0,%3,%1\n"
193 +@@ -222,8 +236,8 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
194 + " mov %4,%1\n"
195 + " stq_c %1,%2\n"
196 + " beq %1,3f\n"
197 +- __ASM__MB
198 + "2:\n"
199 ++ __ASM__MB
200 + ".subsection 2\n"
201 + "3: br 1b\n"
202 + ".previous"
203 +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
204 +index 2d785f5a3041..c4ee25e88a7b 100644
205 +--- a/arch/arc/Kconfig
206 ++++ b/arch/arc/Kconfig
207 +@@ -479,7 +479,6 @@ config ARC_CURR_IN_REG
208 +
209 + config ARC_EMUL_UNALIGNED
210 + bool "Emulate unaligned memory access (userspace only)"
211 +- default N
212 + select SYSCTL_ARCH_UNALIGN_NO_WARN
213 + select SYSCTL_ARCH_UNALIGN_ALLOW
214 + depends on ISA_ARCOMPACT
215 +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
216 +index 39c470e291f9..69381deeb703 100644
217 +--- a/arch/arm/boot/dts/socfpga.dtsi
218 ++++ b/arch/arm/boot/dts/socfpga.dtsi
219 +@@ -738,7 +738,7 @@
220 + timer@fffec600 {
221 + compatible = "arm,cortex-a9-twd-timer";
222 + reg = <0xfffec600 0x100>;
223 +- interrupts = <1 13 0xf04>;
224 ++ interrupts = <1 13 0xf01>;
225 + clocks = <&mpu_periph_clk>;
226 + };
227 +
228 +diff --git a/arch/arm/include/asm/vdso.h b/arch/arm/include/asm/vdso.h
229 +index d0295f1dd1a3..ff65b6d96c7e 100644
230 +--- a/arch/arm/include/asm/vdso.h
231 ++++ b/arch/arm/include/asm/vdso.h
232 +@@ -11,8 +11,6 @@ struct mm_struct;
233 +
234 + void arm_install_vdso(struct mm_struct *mm, unsigned long addr);
235 +
236 +-extern char vdso_start, vdso_end;
237 +-
238 + extern unsigned int vdso_total_pages;
239 +
240 + #else /* CONFIG_VDSO */
241 +diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
242 +index 54a5aeab988d..2dee87273e51 100644
243 +--- a/arch/arm/kernel/vdso.c
244 ++++ b/arch/arm/kernel/vdso.c
245 +@@ -38,6 +38,8 @@
246 +
247 + static struct page **vdso_text_pagelist;
248 +
249 ++extern char vdso_start[], vdso_end[];
250 ++
251 + /* Total number of pages needed for the data and text portions of the VDSO. */
252 + unsigned int vdso_total_pages __read_mostly;
253 +
254 +@@ -178,13 +180,13 @@ static int __init vdso_init(void)
255 + unsigned int text_pages;
256 + int i;
257 +
258 +- if (memcmp(&vdso_start, "\177ELF", 4)) {
259 ++ if (memcmp(vdso_start, "\177ELF", 4)) {
260 + pr_err("VDSO is not a valid ELF object!\n");
261 + return -ENOEXEC;
262 + }
263 +
264 +- text_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT;
265 +- pr_debug("vdso: %i text pages at base %p\n", text_pages, &vdso_start);
266 ++ text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
267 ++ pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
268 +
269 + /* Allocate the VDSO text pagelist */
270 + vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
271 +@@ -199,7 +201,7 @@ static int __init vdso_init(void)
272 + for (i = 0; i < text_pages; i++) {
273 + struct page *page;
274 +
275 +- page = virt_to_page(&vdso_start + i * PAGE_SIZE);
276 ++ page = virt_to_page(vdso_start + i * PAGE_SIZE);
277 + vdso_text_pagelist[i] = page;
278 + }
279 +
280 +@@ -210,7 +212,7 @@ static int __init vdso_init(void)
281 +
282 + cntvct_ok = cntvct_functional();
283 +
284 +- patch_vdso(&vdso_start);
285 ++ patch_vdso(vdso_start);
286 +
287 + return 0;
288 + }
289 +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c
290 +index 4f5fd4a084c0..034b89499bd7 100644
291 +--- a/arch/arm/mach-omap1/clock.c
292 ++++ b/arch/arm/mach-omap1/clock.c
293 +@@ -1031,17 +1031,17 @@ static int clk_debugfs_register_one(struct clk *c)
294 + return -ENOMEM;
295 + c->dent = d;
296 +
297 +- d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)&c->usecount);
298 ++ d = debugfs_create_u8("usecount", S_IRUGO, c->dent, &c->usecount);
299 + if (!d) {
300 + err = -ENOMEM;
301 + goto err_out;
302 + }
303 +- d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)&c->rate);
304 ++ d = debugfs_create_ulong("rate", S_IRUGO, c->dent, &c->rate);
305 + if (!d) {
306 + err = -ENOMEM;
307 + goto err_out;
308 + }
309 +- d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)&c->flags);
310 ++ d = debugfs_create_x8("flags", S_IRUGO, c->dent, &c->flags);
311 + if (!d) {
312 + err = -ENOMEM;
313 + goto err_out;
314 +diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
315 +index 58920bc8807b..3d876bde8c85 100644
316 +--- a/arch/arm/mach-omap2/pm.c
317 ++++ b/arch/arm/mach-omap2/pm.c
318 +@@ -231,7 +231,7 @@ static void omap_pm_end(void)
319 + cpu_idle_poll_ctrl(false);
320 + }
321 +
322 +-static void omap_pm_finish(void)
323 ++static void omap_pm_wake(void)
324 + {
325 + if (cpu_is_omap34xx())
326 + omap_prcm_irq_complete();
327 +@@ -241,7 +241,7 @@ static const struct platform_suspend_ops omap_pm_ops = {
328 + .begin = omap_pm_begin,
329 + .end = omap_pm_end,
330 + .enter = omap_pm_enter,
331 +- .finish = omap_pm_finish,
332 ++ .wake = omap_pm_wake,
333 + .valid = suspend_valid_only_mem,
334 + };
335 +
336 +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
337 +index 83fc403aec3c..1f774ec4ab27 100644
338 +--- a/arch/arm/mach-omap2/timer.c
339 ++++ b/arch/arm/mach-omap2/timer.c
340 +@@ -136,12 +136,6 @@ static struct clock_event_device clockevent_gpt = {
341 + .tick_resume = omap2_gp_timer_shutdown,
342 + };
343 +
344 +-static struct property device_disabled = {
345 +- .name = "status",
346 +- .length = sizeof("disabled"),
347 +- .value = "disabled",
348 +-};
349 +-
350 + static const struct of_device_id omap_timer_match[] __initconst = {
351 + { .compatible = "ti,omap2420-timer", },
352 + { .compatible = "ti,omap3430-timer", },
353 +@@ -183,8 +177,17 @@ static struct device_node * __init omap_get_timer_dt(const struct of_device_id *
354 + of_get_property(np, "ti,timer-secure", NULL)))
355 + continue;
356 +
357 +- if (!of_device_is_compatible(np, "ti,omap-counter32k"))
358 +- of_add_property(np, &device_disabled);
359 ++ if (!of_device_is_compatible(np, "ti,omap-counter32k")) {
360 ++ struct property *prop;
361 ++
362 ++ prop = kzalloc(sizeof(*prop), GFP_KERNEL);
363 ++ if (!prop)
364 ++ return NULL;
365 ++ prop->name = "status";
366 ++ prop->value = "disabled";
367 ++ prop->length = strlen(prop->value);
368 ++ of_add_property(np, prop);
369 ++ }
370 + return np;
371 + }
372 +
373 +diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
374 +index 8ca94d379bc3..6f75c32dc3bf 100644
375 +--- a/arch/arm/plat-omap/dmtimer.c
376 ++++ b/arch/arm/plat-omap/dmtimer.c
377 +@@ -854,11 +854,8 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
378 + timer->irq = irq->start;
379 + timer->pdev = pdev;
380 +
381 +- /* Skip pm_runtime_enable for OMAP1 */
382 +- if (!(timer->capability & OMAP_TIMER_NEEDS_RESET)) {
383 +- pm_runtime_enable(dev);
384 +- pm_runtime_irq_safe(dev);
385 +- }
386 ++ pm_runtime_enable(dev);
387 ++ pm_runtime_irq_safe(dev);
388 +
389 + if (!timer->reserved) {
390 + ret = pm_runtime_get_sync(dev);
391 +diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
392 +index 499e8de33a00..fbbd7fb83fd6 100644
393 +--- a/arch/arm64/include/asm/spinlock.h
394 ++++ b/arch/arm64/include/asm/spinlock.h
395 +@@ -94,8 +94,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
396 + " cbnz %w1, 1f\n"
397 + " add %w1, %w0, %3\n"
398 + " casa %w0, %w1, %2\n"
399 +- " and %w1, %w1, #0xffff\n"
400 +- " eor %w1, %w1, %w0, lsr #16\n"
401 ++ " sub %w1, %w1, %3\n"
402 ++ " eor %w1, %w1, %w0\n"
403 + "1:")
404 + : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock)
405 + : "I" (1 << TICKET_SHIFT)
406 +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c
407 +index 71ea4c02795d..8a2dc0af4cad 100644
408 +--- a/arch/m68k/coldfire/device.c
409 ++++ b/arch/m68k/coldfire/device.c
410 +@@ -135,7 +135,11 @@ static struct platform_device mcf_fec0 = {
411 + .id = 0,
412 + .num_resources = ARRAY_SIZE(mcf_fec0_resources),
413 + .resource = mcf_fec0_resources,
414 +- .dev.platform_data = FEC_PDATA,
415 ++ .dev = {
416 ++ .dma_mask = &mcf_fec0.dev.coherent_dma_mask,
417 ++ .coherent_dma_mask = DMA_BIT_MASK(32),
418 ++ .platform_data = FEC_PDATA,
419 ++ }
420 + };
421 +
422 + #ifdef MCFFEC_BASE1
423 +@@ -167,7 +171,11 @@ static struct platform_device mcf_fec1 = {
424 + .id = 1,
425 + .num_resources = ARRAY_SIZE(mcf_fec1_resources),
426 + .resource = mcf_fec1_resources,
427 +- .dev.platform_data = FEC_PDATA,
428 ++ .dev = {
429 ++ .dma_mask = &mcf_fec1.dev.coherent_dma_mask,
430 ++ .coherent_dma_mask = DMA_BIT_MASK(32),
431 ++ .platform_data = FEC_PDATA,
432 ++ }
433 + };
434 + #endif /* MCFFEC_BASE1 */
435 + #endif /* CONFIG_FEC */
436 +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
437 +index 10d0b2140375..63d35076722d 100644
438 +--- a/arch/mips/cavium-octeon/octeon-irq.c
439 ++++ b/arch/mips/cavium-octeon/octeon-irq.c
440 +@@ -2240,7 +2240,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
441 +
442 + parent_irq = irq_of_parse_and_map(ciu_node, 0);
443 + if (!parent_irq) {
444 +- pr_err("ERROR: Couldn't acquire parent_irq for %s\n.",
445 ++ pr_err("ERROR: Couldn't acquire parent_irq for %s\n",
446 + ciu_node->name);
447 + return -EINVAL;
448 + }
449 +@@ -2252,7 +2252,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
450 +
451 + addr = of_get_address(ciu_node, 0, NULL, NULL);
452 + if (!addr) {
453 +- pr_err("ERROR: Couldn't acquire reg(0) %s\n.", ciu_node->name);
454 ++ pr_err("ERROR: Couldn't acquire reg(0) %s\n", ciu_node->name);
455 + return -EINVAL;
456 + }
457 + host_data->raw_reg = (u64)phys_to_virt(
458 +@@ -2260,7 +2260,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
459 +
460 + addr = of_get_address(ciu_node, 1, NULL, NULL);
461 + if (!addr) {
462 +- pr_err("ERROR: Couldn't acquire reg(1) %s\n.", ciu_node->name);
463 ++ pr_err("ERROR: Couldn't acquire reg(1) %s\n", ciu_node->name);
464 + return -EINVAL;
465 + }
466 + host_data->en_reg = (u64)phys_to_virt(
467 +@@ -2268,7 +2268,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
468 +
469 + r = of_property_read_u32(ciu_node, "cavium,max-bits", &val);
470 + if (r) {
471 +- pr_err("ERROR: Couldn't read cavium,max-bits from %s\n.",
472 ++ pr_err("ERROR: Couldn't read cavium,max-bits from %s\n",
473 + ciu_node->name);
474 + return r;
475 + }
476 +@@ -2278,7 +2278,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
477 + &octeon_irq_domain_cib_ops,
478 + host_data);
479 + if (!cib_domain) {
480 +- pr_err("ERROR: Couldn't irq_domain_add_linear()\n.");
481 ++ pr_err("ERROR: Couldn't irq_domain_add_linear()\n");
482 + return -ENOMEM;
483 + }
484 +
485 +diff --git a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
486 +index aa3800c82332..d99ca862dae3 100644
487 +--- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
488 ++++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
489 +@@ -167,7 +167,7 @@
490 + #define AR71XX_AHB_DIV_MASK 0x7
491 +
492 + #define AR724X_PLL_REG_CPU_CONFIG 0x00
493 +-#define AR724X_PLL_REG_PCIE_CONFIG 0x18
494 ++#define AR724X_PLL_REG_PCIE_CONFIG 0x10
495 +
496 + #define AR724X_PLL_FB_SHIFT 0
497 + #define AR724X_PLL_FB_MASK 0x3ff
498 +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
499 +index c3d2d2c05fdb..a9958b4d9194 100644
500 +--- a/arch/mips/kernel/ptrace.c
501 ++++ b/arch/mips/kernel/ptrace.c
502 +@@ -483,7 +483,7 @@ static int fpr_get_msa(struct task_struct *target,
503 + /*
504 + * Copy the floating-point context to the supplied NT_PRFPREG buffer.
505 + * Choose the appropriate helper for general registers, and then copy
506 +- * the FCSR register separately.
507 ++ * the FCSR and FIR registers separately.
508 + */
509 + static int fpr_get(struct task_struct *target,
510 + const struct user_regset *regset,
511 +@@ -491,6 +491,7 @@ static int fpr_get(struct task_struct *target,
512 + void *kbuf, void __user *ubuf)
513 + {
514 + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
515 ++ const int fir_pos = fcr31_pos + sizeof(u32);
516 + int err;
517 +
518 + if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
519 +@@ -503,6 +504,12 @@ static int fpr_get(struct task_struct *target,
520 + err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
521 + &target->thread.fpu.fcr31,
522 + fcr31_pos, fcr31_pos + sizeof(u32));
523 ++ if (err)
524 ++ return err;
525 ++
526 ++ err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
527 ++ &boot_cpu_data.fpu_id,
528 ++ fir_pos, fir_pos + sizeof(u32));
529 +
530 + return err;
531 + }
532 +@@ -551,7 +558,8 @@ static int fpr_set_msa(struct task_struct *target,
533 + /*
534 + * Copy the supplied NT_PRFPREG buffer to the floating-point context.
535 + * Choose the appropriate helper for general registers, and then copy
536 +- * the FCSR register separately.
537 ++ * the FCSR register separately. Ignore the incoming FIR register
538 ++ * contents though, as the register is read-only.
539 + *
540 + * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
541 + * which is supposed to have been guaranteed by the kernel before
542 +@@ -565,6 +573,7 @@ static int fpr_set(struct task_struct *target,
543 + const void *kbuf, const void __user *ubuf)
544 + {
545 + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
546 ++ const int fir_pos = fcr31_pos + sizeof(u32);
547 + u32 fcr31;
548 + int err;
549 +
550 +@@ -592,6 +601,11 @@ static int fpr_set(struct task_struct *target,
551 + ptrace_setfcr31(target, fcr31);
552 + }
553 +
554 ++ if (count > 0)
555 ++ err = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
556 ++ fir_pos,
557 ++ fir_pos + sizeof(u32));
558 ++
559 + return err;
560 + }
561 +
562 +@@ -816,7 +830,7 @@ long arch_ptrace(struct task_struct *child, long request,
563 + fregs = get_fpu_regs(child);
564 +
565 + #ifdef CONFIG_32BIT
566 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
567 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
568 + /*
569 + * The odd registers are actually the high
570 + * order bits of the values stored in the even
571 +@@ -905,7 +919,7 @@ long arch_ptrace(struct task_struct *child, long request,
572 +
573 + init_fp_ctx(child);
574 + #ifdef CONFIG_32BIT
575 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
576 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
577 + /*
578 + * The odd registers are actually the high
579 + * order bits of the values stored in the even
580 +diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
581 +index 283b5a1967d1..b4b7e02443e7 100644
582 +--- a/arch/mips/kernel/ptrace32.c
583 ++++ b/arch/mips/kernel/ptrace32.c
584 +@@ -97,7 +97,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
585 + break;
586 + }
587 + fregs = get_fpu_regs(child);
588 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
589 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
590 + /*
591 + * The odd registers are actually the high
592 + * order bits of the values stored in the even
593 +@@ -203,7 +203,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
594 + sizeof(child->thread.fpu));
595 + child->thread.fpu.fcr31 = 0;
596 + }
597 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
598 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
599 + /*
600 + * The odd registers are actually the high
601 + * order bits of the values stored in the even
602 +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
603 +index a017b23ee4aa..8a95c3d76a9a 100644
604 +--- a/arch/mips/kvm/mips.c
605 ++++ b/arch/mips/kvm/mips.c
606 +@@ -40,7 +40,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
607 + { "cache", VCPU_STAT(cache_exits), KVM_STAT_VCPU },
608 + { "signal", VCPU_STAT(signal_exits), KVM_STAT_VCPU },
609 + { "interrupt", VCPU_STAT(int_exits), KVM_STAT_VCPU },
610 +- { "cop_unsuable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
611 ++ { "cop_unusable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
612 + { "tlbmod", VCPU_STAT(tlbmod_exits), KVM_STAT_VCPU },
613 + { "tlbmiss_ld", VCPU_STAT(tlbmiss_ld_exits), KVM_STAT_VCPU },
614 + { "tlbmiss_st", VCPU_STAT(tlbmiss_st_exits), KVM_STAT_VCPU },
615 +diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
616 +index 37030409745c..586ca7ea3e7c 100644
617 +--- a/arch/mips/txx9/rbtx4939/setup.c
618 ++++ b/arch/mips/txx9/rbtx4939/setup.c
619 +@@ -186,7 +186,7 @@ static void __init rbtx4939_update_ioc_pen(void)
620 +
621 + #define RBTX4939_MAX_7SEGLEDS 8
622 +
623 +-#if IS_ENABLED(CONFIG_LEDS_CLASS)
624 ++#if IS_BUILTIN(CONFIG_LEDS_CLASS)
625 + static u8 led_val[RBTX4939_MAX_7SEGLEDS];
626 + struct rbtx4939_led_data {
627 + struct led_classdev cdev;
628 +@@ -261,7 +261,7 @@ static inline void rbtx4939_led_setup(void)
629 +
630 + static void __rbtx4939_7segled_putc(unsigned int pos, unsigned char val)
631 + {
632 +-#if IS_ENABLED(CONFIG_LEDS_CLASS)
633 ++#if IS_BUILTIN(CONFIG_LEDS_CLASS)
634 + unsigned long flags;
635 + local_irq_save(flags);
636 + /* bit7: reserved for LED class */
637 +diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
638 +index 744fd54de374..1bcc84903930 100644
639 +--- a/arch/powerpc/include/asm/irq_work.h
640 ++++ b/arch/powerpc/include/asm/irq_work.h
641 +@@ -5,5 +5,6 @@ static inline bool arch_irq_work_has_interrupt(void)
642 + {
643 + return true;
644 + }
645 ++extern void arch_irq_work_raise(void);
646 +
647 + #endif /* _ASM_POWERPC_IRQ_WORK_H */
648 +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
649 +index 428563b195c3..767ac1572c02 100644
650 +--- a/arch/powerpc/kvm/book3s_hv.c
651 ++++ b/arch/powerpc/kvm/book3s_hv.c
652 +@@ -3002,15 +3002,17 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
653 + goto up_out;
654 +
655 + psize = vma_kernel_pagesize(vma);
656 +- porder = __ilog2(psize);
657 +
658 + up_read(&current->mm->mmap_sem);
659 +
660 + /* We can handle 4k, 64k or 16M pages in the VRMA */
661 +- err = -EINVAL;
662 +- if (!(psize == 0x1000 || psize == 0x10000 ||
663 +- psize == 0x1000000))
664 +- goto out_srcu;
665 ++ if (psize >= 0x1000000)
666 ++ psize = 0x1000000;
667 ++ else if (psize >= 0x10000)
668 ++ psize = 0x10000;
669 ++ else
670 ++ psize = 0x1000;
671 ++ porder = __ilog2(psize);
672 +
673 + /* Update VRMASD field in the LPCR */
674 + senc = slb_pgsize_encoding(psize);
675 +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
676 +index 669a15e7fa76..3c4faa4c2742 100644
677 +--- a/arch/powerpc/mm/numa.c
678 ++++ b/arch/powerpc/mm/numa.c
679 +@@ -551,7 +551,7 @@ static int numa_setup_cpu(unsigned long lcpu)
680 + nid = of_node_to_nid_single(cpu);
681 +
682 + out_present:
683 +- if (nid < 0 || !node_online(nid))
684 ++ if (nid < 0 || !node_possible(nid))
685 + nid = first_online_node;
686 +
687 + map_cpu_to_node(lcpu, nid);
688 +@@ -951,6 +951,32 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
689 + NODE_DATA(nid)->node_spanned_pages = spanned_pages;
690 + }
691 +
692 ++static void __init find_possible_nodes(void)
693 ++{
694 ++ struct device_node *rtas;
695 ++ u32 numnodes, i;
696 ++
697 ++ if (min_common_depth <= 0)
698 ++ return;
699 ++
700 ++ rtas = of_find_node_by_path("/rtas");
701 ++ if (!rtas)
702 ++ return;
703 ++
704 ++ if (of_property_read_u32_index(rtas,
705 ++ "ibm,max-associativity-domains",
706 ++ min_common_depth, &numnodes))
707 ++ goto out;
708 ++
709 ++ for (i = 0; i < numnodes; i++) {
710 ++ if (!node_possible(i))
711 ++ node_set(i, node_possible_map);
712 ++ }
713 ++
714 ++out:
715 ++ of_node_put(rtas);
716 ++}
717 ++
718 + void __init initmem_init(void)
719 + {
720 + int nid, cpu;
721 +@@ -966,12 +992,15 @@ void __init initmem_init(void)
722 + memblock_dump_all();
723 +
724 + /*
725 +- * Reduce the possible NUMA nodes to the online NUMA nodes,
726 +- * since we do not support node hotplug. This ensures that we
727 +- * lower the maximum NUMA node ID to what is actually present.
728 ++ * Modify the set of possible NUMA nodes to reflect information
729 ++ * available about the set of online nodes, and the set of nodes
730 ++ * that we expect to make use of for this platform's affinity
731 ++ * calculations.
732 + */
733 + nodes_and(node_possible_map, node_possible_map, node_online_map);
734 +
735 ++ find_possible_nodes();
736 ++
737 + for_each_online_node(nid) {
738 + unsigned long start_pfn, end_pfn;
739 +
740 +@@ -1304,6 +1333,40 @@ static long vphn_get_associativity(unsigned long cpu,
741 + return rc;
742 + }
743 +
744 ++static inline int find_and_online_cpu_nid(int cpu)
745 ++{
746 ++ __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
747 ++ int new_nid;
748 ++
749 ++ /* Use associativity from first thread for all siblings */
750 ++ vphn_get_associativity(cpu, associativity);
751 ++ new_nid = associativity_to_nid(associativity);
752 ++ if (new_nid < 0 || !node_possible(new_nid))
753 ++ new_nid = first_online_node;
754 ++
755 ++ if (NODE_DATA(new_nid) == NULL) {
756 ++#ifdef CONFIG_MEMORY_HOTPLUG
757 ++ /*
758 ++ * Need to ensure that NODE_DATA is initialized for a node from
759 ++ * available memory (see memblock_alloc_try_nid). If unable to
760 ++ * init the node, then default to nearest node that has memory
761 ++ * installed.
762 ++ */
763 ++ if (try_online_node(new_nid))
764 ++ new_nid = first_online_node;
765 ++#else
766 ++ /*
767 ++ * Default to using the nearest node that has memory installed.
768 ++ * Otherwise, it would be necessary to patch the kernel MM code
769 ++ * to deal with more memoryless-node error conditions.
770 ++ */
771 ++ new_nid = first_online_node;
772 ++#endif
773 ++ }
774 ++
775 ++ return new_nid;
776 ++}
777 ++
778 + /*
779 + * Update the CPU maps and sysfs entries for a single CPU when its NUMA
780 + * characteristics change. This function doesn't perform any locking and is
781 +@@ -1369,7 +1432,6 @@ int arch_update_cpu_topology(void)
782 + {
783 + unsigned int cpu, sibling, changed = 0;
784 + struct topology_update_data *updates, *ud;
785 +- __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
786 + cpumask_t updated_cpus;
787 + struct device *dev;
788 + int weight, new_nid, i = 0;
789 +@@ -1404,11 +1466,7 @@ int arch_update_cpu_topology(void)
790 + continue;
791 + }
792 +
793 +- /* Use associativity from first thread for all siblings */
794 +- vphn_get_associativity(cpu, associativity);
795 +- new_nid = associativity_to_nid(associativity);
796 +- if (new_nid < 0 || !node_online(new_nid))
797 +- new_nid = first_online_node;
798 ++ new_nid = find_and_online_cpu_nid(cpu);
799 +
800 + if (new_nid == numa_cpu_lookup_table[cpu]) {
801 + cpumask_andnot(&cpu_associativity_changes_mask,
802 +diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
803 +index 2d66a8446198..345e255c06a2 100644
804 +--- a/arch/powerpc/net/bpf_jit_comp.c
805 ++++ b/arch/powerpc/net/bpf_jit_comp.c
806 +@@ -329,6 +329,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
807 + BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
808 + PPC_LWZ_OFFS(r_A, r_skb, offsetof(struct sk_buff, len));
809 + break;
810 ++ case BPF_LDX | BPF_W | BPF_ABS: /* A = *((u32 *)(seccomp_data + K)); */
811 ++ PPC_LWZ_OFFS(r_A, r_skb, K);
812 ++ break;
813 + case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */
814 + PPC_LWZ_OFFS(r_X, r_skb, offsetof(struct sk_buff, len));
815 + break;
816 +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
817 +index 4eba7c00ea1f..30e2e8efbe6b 100644
818 +--- a/arch/powerpc/perf/core-book3s.c
819 ++++ b/arch/powerpc/perf/core-book3s.c
820 +@@ -448,6 +448,16 @@ static void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw)
821 + /* invalid entry */
822 + continue;
823 +
824 ++ /*
825 ++ * BHRB rolling buffer could very much contain the kernel
826 ++ * addresses at this point. Check the privileges before
827 ++ * exporting it to userspace (avoid exposure of regions
828 ++ * where we could have speculative execution)
829 ++ */
830 ++ if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) &&
831 ++ is_kernel_addr(addr))
832 ++ continue;
833 ++
834 + /* Branches are read most recent first (ie. mfbhrb 0 is
835 + * the most recent branch).
836 + * There are two types of valid entries:
837 +@@ -1188,6 +1198,7 @@ static void power_pmu_disable(struct pmu *pmu)
838 + */
839 + write_mmcr0(cpuhw, val);
840 + mb();
841 ++ isync();
842 +
843 + /*
844 + * Disable instruction sampling if it was enabled
845 +@@ -1196,12 +1207,26 @@ static void power_pmu_disable(struct pmu *pmu)
846 + mtspr(SPRN_MMCRA,
847 + cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
848 + mb();
849 ++ isync();
850 + }
851 +
852 + cpuhw->disabled = 1;
853 + cpuhw->n_added = 0;
854 +
855 + ebb_switch_out(mmcr0);
856 ++
857 ++#ifdef CONFIG_PPC64
858 ++ /*
859 ++ * These are readable by userspace, may contain kernel
860 ++ * addresses and are not switched by context switch, so clear
861 ++ * them now to avoid leaking anything to userspace in general
862 ++ * including to another process.
863 ++ */
864 ++ if (ppmu->flags & PPMU_ARCH_207S) {
865 ++ mtspr(SPRN_SDAR, 0);
866 ++ mtspr(SPRN_SIAR, 0);
867 ++ }
868 ++#endif
869 + }
870 +
871 + local_irq_restore(flags);
872 +diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
873 +index 2a0452e364ba..d11f931cac69 100644
874 +--- a/arch/powerpc/sysdev/mpic.c
875 ++++ b/arch/powerpc/sysdev/mpic.c
876 +@@ -626,7 +626,7 @@ static inline u32 mpic_physmask(u32 cpumask)
877 + int i;
878 + u32 mask = 0;
879 +
880 +- for (i = 0; i < min(32, NR_CPUS); ++i, cpumask >>= 1)
881 ++ for (i = 0; i < min(32, NR_CPUS) && cpu_possible(i); ++i, cpumask >>= 1)
882 + mask |= (cpumask & 1) << get_hard_smp_processor_id(i);
883 + return mask;
884 + }
885 +diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h
886 +index 087fc9b972c5..9a56e738d645 100644
887 +--- a/arch/s390/include/asm/nospec-insn.h
888 ++++ b/arch/s390/include/asm/nospec-insn.h
889 +@@ -2,10 +2,15 @@
890 + #ifndef _ASM_S390_NOSPEC_ASM_H
891 + #define _ASM_S390_NOSPEC_ASM_H
892 +
893 ++#include <asm/alternative-asm.h>
894 ++#include <asm/asm-offsets.h>
895 ++
896 + #ifdef __ASSEMBLY__
897 +
898 + #ifdef CONFIG_EXPOLINE
899 +
900 ++_LC_BR_R1 = __LC_BR_R1
901 ++
902 + /*
903 + * The expoline macros are used to create thunks in the same format
904 + * as gcc generates them. The 'comdat' section flag makes sure that
905 +@@ -101,13 +106,21 @@
906 + .endm
907 +
908 + .macro __THUNK_EX_BR reg,ruse
909 ++ # Be very careful when adding instructions to this macro!
910 ++ # The ALTERNATIVE replacement code has a .+10 which targets
911 ++ # the "br \reg" after the code has been patched.
912 + #ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
913 + exrl 0,555f
914 + j .
915 + #else
916 ++ .ifc \reg,%r1
917 ++ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35
918 ++ j .
919 ++ .else
920 + larl \ruse,555f
921 + ex 0,0(\ruse)
922 + j .
923 ++ .endif
924 + #endif
925 + 555: br \reg
926 + .endm
927 +diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
928 +index dc6c9c604543..39572281e213 100644
929 +--- a/arch/s390/kernel/asm-offsets.c
930 ++++ b/arch/s390/kernel/asm-offsets.c
931 +@@ -170,6 +170,7 @@ int main(void)
932 + OFFSET(__LC_MACHINE_FLAGS, _lowcore, machine_flags);
933 + OFFSET(__LC_GMAP, _lowcore, gmap);
934 + OFFSET(__LC_PASTE, _lowcore, paste);
935 ++ OFFSET(__LC_BR_R1, _lowcore, br_r1_trampoline);
936 + /* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */
937 + OFFSET(__LC_DUMP_REIPL, _lowcore, ipib);
938 + /* hardware defined lowcore locations 0x1000 - 0x18ff */
939 +diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
940 +index e499370fbccb..6c1c7d399bf9 100644
941 +--- a/arch/s390/kernel/mcount.S
942 ++++ b/arch/s390/kernel/mcount.S
943 +@@ -8,12 +8,16 @@
944 + #include <linux/linkage.h>
945 + #include <asm/asm-offsets.h>
946 + #include <asm/ftrace.h>
947 ++#include <asm/nospec-insn.h>
948 + #include <asm/ptrace.h>
949 +
950 ++ GEN_BR_THUNK %r1
951 ++ GEN_BR_THUNK %r14
952 ++
953 + .section .kprobes.text, "ax"
954 +
955 + ENTRY(ftrace_stub)
956 +- br %r14
957 ++ BR_EX %r14
958 +
959 + #define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE)
960 + #define STACK_PTREGS (STACK_FRAME_OVERHEAD)
961 +@@ -21,7 +25,7 @@ ENTRY(ftrace_stub)
962 + #define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
963 +
964 + ENTRY(_mcount)
965 +- br %r14
966 ++ BR_EX %r14
967 +
968 + ENTRY(ftrace_caller)
969 + .globl ftrace_regs_caller
970 +@@ -49,7 +53,7 @@ ENTRY(ftrace_caller)
971 + #endif
972 + lgr %r3,%r14
973 + la %r5,STACK_PTREGS(%r15)
974 +- basr %r14,%r1
975 ++ BASR_EX %r14,%r1
976 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER
977 + # The j instruction gets runtime patched to a nop instruction.
978 + # See ftrace_enable_ftrace_graph_caller.
979 +@@ -64,7 +68,7 @@ ftrace_graph_caller_end:
980 + #endif
981 + lg %r1,(STACK_PTREGS_PSW+8)(%r15)
982 + lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15)
983 +- br %r1
984 ++ BR_EX %r1
985 +
986 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER
987 +
988 +@@ -77,6 +81,6 @@ ENTRY(return_to_handler)
989 + aghi %r15,STACK_FRAME_OVERHEAD
990 + lgr %r14,%r2
991 + lmg %r2,%r5,32(%r15)
992 +- br %r14
993 ++ BR_EX %r14
994 +
995 + #endif
996 +diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
997 +index 13047a4facd2..5a9017ba26ab 100644
998 +--- a/arch/sh/kernel/entry-common.S
999 ++++ b/arch/sh/kernel/entry-common.S
1000 +@@ -255,7 +255,7 @@ debug_trap:
1001 + mov.l @r8, r8
1002 + jsr @r8
1003 + nop
1004 +- bra __restore_all
1005 ++ bra ret_from_exception
1006 + nop
1007 + CFI_ENDPROC
1008 +
1009 +diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
1010 +index f2fbf9e16faf..29070c9a70f9 100644
1011 +--- a/arch/sparc/include/asm/atomic_64.h
1012 ++++ b/arch/sparc/include/asm/atomic_64.h
1013 +@@ -74,7 +74,11 @@ ATOMIC_OP(xor)
1014 + #define atomic64_add_negative(i, v) (atomic64_add_return(i, v) < 0)
1015 +
1016 + #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
1017 +-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
1018 ++
1019 ++static inline int atomic_xchg(atomic_t *v, int new)
1020 ++{
1021 ++ return xchg(&v->counter, new);
1022 ++}
1023 +
1024 + static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1025 + {
1026 +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
1027 +index a3e1f8497f8c..deddc9b93299 100644
1028 +--- a/arch/x86/kernel/apic/apic.c
1029 ++++ b/arch/x86/kernel/apic/apic.c
1030 +@@ -1368,7 +1368,7 @@ void setup_local_APIC(void)
1031 + * TODO: set up through-local-APIC from through-I/O-APIC? --macro
1032 + */
1033 + value = apic_read(APIC_LVT0) & APIC_LVT_MASKED;
1034 +- if (!cpu && (pic_mode || !value)) {
1035 ++ if (!cpu && (pic_mode || !value || skip_ioapic_setup)) {
1036 + value = APIC_DM_EXTINT;
1037 + apic_printk(APIC_VERBOSE, "enabled ExtINT on CPU#%d\n", cpu);
1038 + } else {
1039 +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
1040 +index 1f4acd68b98b..74b8dcd1bbdc 100644
1041 +--- a/arch/x86/kernel/devicetree.c
1042 ++++ b/arch/x86/kernel/devicetree.c
1043 +@@ -11,6 +11,7 @@
1044 + #include <linux/of_address.h>
1045 + #include <linux/of_platform.h>
1046 + #include <linux/of_irq.h>
1047 ++#include <linux/libfdt.h>
1048 + #include <linux/slab.h>
1049 + #include <linux/pci.h>
1050 + #include <linux/of_pci.h>
1051 +@@ -199,19 +200,22 @@ static struct of_ioapic_type of_ioapic_type[] =
1052 + static int dt_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,
1053 + unsigned int nr_irqs, void *arg)
1054 + {
1055 +- struct of_phandle_args *irq_data = (void *)arg;
1056 ++ struct irq_fwspec *fwspec = (struct irq_fwspec *)arg;
1057 + struct of_ioapic_type *it;
1058 + struct irq_alloc_info tmp;
1059 ++ int type_index;
1060 +
1061 +- if (WARN_ON(irq_data->args_count < 2))
1062 ++ if (WARN_ON(fwspec->param_count < 2))
1063 + return -EINVAL;
1064 +- if (irq_data->args[1] >= ARRAY_SIZE(of_ioapic_type))
1065 ++
1066 ++ type_index = fwspec->param[1];
1067 ++ if (type_index >= ARRAY_SIZE(of_ioapic_type))
1068 + return -EINVAL;
1069 +
1070 +- it = &of_ioapic_type[irq_data->args[1]];
1071 ++ it = &of_ioapic_type[type_index];
1072 + ioapic_set_alloc_attr(&tmp, NUMA_NO_NODE, it->trigger, it->polarity);
1073 + tmp.ioapic_id = mpc_ioapic_id(mp_irqdomain_ioapic_idx(domain));
1074 +- tmp.ioapic_pin = irq_data->args[0];
1075 ++ tmp.ioapic_pin = fwspec->param[0];
1076 +
1077 + return mp_irqdomain_alloc(domain, virq, nr_irqs, &tmp);
1078 + }
1079 +@@ -276,14 +280,15 @@ static void __init x86_flattree_get_config(void)
1080 +
1081 + map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
1082 +
1083 +- initial_boot_params = dt = early_memremap(initial_dtb, map_len);
1084 +- size = of_get_flat_dt_size();
1085 ++ dt = early_memremap(initial_dtb, map_len);
1086 ++ size = fdt_totalsize(dt);
1087 + if (map_len < size) {
1088 + early_memunmap(dt, map_len);
1089 +- initial_boot_params = dt = early_memremap(initial_dtb, size);
1090 ++ dt = early_memremap(initial_dtb, size);
1091 + map_len = size;
1092 + }
1093 +
1094 ++ early_init_dt_verify(dt);
1095 + unflatten_and_copy_device_tree();
1096 + early_memunmap(dt, map_len);
1097 + }
1098 +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
1099 +index 00c7878043ef..48ca93242bfd 100644
1100 +--- a/arch/x86/kernel/smpboot.c
1101 ++++ b/arch/x86/kernel/smpboot.c
1102 +@@ -1344,6 +1344,7 @@ static void remove_siblinginfo(int cpu)
1103 + cpumask_clear(topology_core_cpumask(cpu));
1104 + c->phys_proc_id = 0;
1105 + c->cpu_core_id = 0;
1106 ++ c->booted_cores = 0;
1107 + cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
1108 + }
1109 +
1110 +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
1111 +index 1c96f09367ae..a1afd80a68aa 100644
1112 +--- a/arch/x86/kvm/lapic.c
1113 ++++ b/arch/x86/kvm/lapic.c
1114 +@@ -288,8 +288,16 @@ void kvm_apic_set_version(struct kvm_vcpu *vcpu)
1115 + if (!kvm_vcpu_has_lapic(vcpu))
1116 + return;
1117 +
1118 ++ /*
1119 ++ * KVM emulates 82093AA datasheet (with in-kernel IOAPIC implementation)
1120 ++ * which doesn't have EOI register; Some buggy OSes (e.g. Windows with
1121 ++ * Hyper-V role) disable EOI broadcast in lapic not checking for IOAPIC
1122 ++ * version first and level-triggered interrupts never get EOIed in
1123 ++ * IOAPIC.
1124 ++ */
1125 + feat = kvm_find_cpuid_entry(apic->vcpu, 0x1, 0);
1126 +- if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31))))
1127 ++ if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31))) &&
1128 ++ !ioapic_in_kernel(vcpu->kvm))
1129 + v |= APIC_LVR_DIRECTED_EOI;
1130 + apic_set_reg(apic, APIC_LVR, v);
1131 + }
1132 +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
1133 +index 528b4352fa99..a750fc7c7458 100644
1134 +--- a/arch/x86/kvm/vmx.c
1135 ++++ b/arch/x86/kvm/vmx.c
1136 +@@ -2319,6 +2319,8 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
1137 + return;
1138 + }
1139 +
1140 ++ WARN_ON_ONCE(vmx->emulation_required);
1141 ++
1142 + if (kvm_exception_is_soft(nr)) {
1143 + vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
1144 + vmx->vcpu.arch.event_exit_inst_len);
1145 +@@ -6037,12 +6039,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
1146 + goto out;
1147 + }
1148 +
1149 +- if (err != EMULATE_DONE) {
1150 +- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
1151 +- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
1152 +- vcpu->run->internal.ndata = 0;
1153 +- return 0;
1154 +- }
1155 ++ if (err != EMULATE_DONE)
1156 ++ goto emulation_error;
1157 ++
1158 ++ if (vmx->emulation_required && !vmx->rmode.vm86_active &&
1159 ++ vcpu->arch.exception.pending)
1160 ++ goto emulation_error;
1161 +
1162 + if (vcpu->arch.halt_request) {
1163 + vcpu->arch.halt_request = 0;
1164 +@@ -6058,6 +6060,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
1165 +
1166 + out:
1167 + return ret;
1168 ++
1169 ++emulation_error:
1170 ++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
1171 ++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
1172 ++ vcpu->run->internal.ndata = 0;
1173 ++ return 0;
1174 + }
1175 +
1176 + static int __grow_ple_window(int val)
1177 +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
1178 +index f37f0c72b22a..9cea09597d66 100644
1179 +--- a/arch/x86/kvm/x86.c
1180 ++++ b/arch/x86/kvm/x86.c
1181 +@@ -3973,13 +3973,14 @@ long kvm_arch_vm_ioctl(struct file *filp,
1182 + mutex_unlock(&kvm->lock);
1183 + break;
1184 + case KVM_XEN_HVM_CONFIG: {
1185 ++ struct kvm_xen_hvm_config xhc;
1186 + r = -EFAULT;
1187 +- if (copy_from_user(&kvm->arch.xen_hvm_config, argp,
1188 +- sizeof(struct kvm_xen_hvm_config)))
1189 ++ if (copy_from_user(&xhc, argp, sizeof(xhc)))
1190 + goto out;
1191 + r = -EINVAL;
1192 +- if (kvm->arch.xen_hvm_config.flags)
1193 ++ if (xhc.flags)
1194 + goto out;
1195 ++ memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc));
1196 + r = 0;
1197 + break;
1198 + }
1199 +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
1200 +index c013326a0d7a..08e94b6139ab 100644
1201 +--- a/arch/x86/mm/pgtable.c
1202 ++++ b/arch/x86/mm/pgtable.c
1203 +@@ -1,5 +1,6 @@
1204 + #include <linux/mm.h>
1205 + #include <linux/gfp.h>
1206 ++#include <linux/hugetlb.h>
1207 + #include <asm/pgalloc.h>
1208 + #include <asm/pgtable.h>
1209 + #include <asm/tlb.h>
1210 +@@ -600,6 +601,10 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot)
1211 + (mtrr != MTRR_TYPE_WRBACK))
1212 + return 0;
1213 +
1214 ++ /* Bail out if we are we on a populated non-leaf entry: */
1215 ++ if (pud_present(*pud) && !pud_huge(*pud))
1216 ++ return 0;
1217 ++
1218 + prot = pgprot_4k_2_large(prot);
1219 +
1220 + set_pte((pte_t *)pud, pfn_pte(
1221 +@@ -628,6 +633,10 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
1222 + return 0;
1223 + }
1224 +
1225 ++ /* Bail out if we are we on a populated non-leaf entry: */
1226 ++ if (pmd_present(*pmd) && !pmd_huge(*pmd))
1227 ++ return 0;
1228 ++
1229 + prot = pgprot_4k_2_large(prot);
1230 +
1231 + set_pte((pte_t *)pmd, pfn_pte(
1232 +diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
1233 +index 291226b952a9..77ac4e4deb16 100644
1234 +--- a/arch/x86/power/hibernate_32.c
1235 ++++ b/arch/x86/power/hibernate_32.c
1236 +@@ -142,7 +142,7 @@ static inline void resume_init_first_level_page_table(pgd_t *pg_dir)
1237 + #endif
1238 + }
1239 +
1240 +-int swsusp_arch_resume(void)
1241 ++asmlinkage int swsusp_arch_resume(void)
1242 + {
1243 + int error;
1244 +
1245 +diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
1246 +index 009947d419a6..0e0c773edffc 100644
1247 +--- a/arch/x86/power/hibernate_64.c
1248 ++++ b/arch/x86/power/hibernate_64.c
1249 +@@ -78,7 +78,7 @@ static int set_up_temporary_mappings(void)
1250 + return 0;
1251 + }
1252 +
1253 +-int swsusp_arch_resume(void)
1254 ++asmlinkage int swsusp_arch_resume(void)
1255 + {
1256 + int error;
1257 +
1258 +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
1259 +index 8ea8211b2d58..f8bb0e4d035a 100644
1260 +--- a/drivers/acpi/acpi_pad.c
1261 ++++ b/drivers/acpi/acpi_pad.c
1262 +@@ -108,6 +108,7 @@ static void round_robin_cpu(unsigned int tsk_index)
1263 + cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus);
1264 + if (cpumask_empty(tmp)) {
1265 + mutex_unlock(&round_robin_lock);
1266 ++ free_cpumask_var(tmp);
1267 + return;
1268 + }
1269 + for_each_cpu(cpu, tmp) {
1270 +@@ -125,6 +126,8 @@ static void round_robin_cpu(unsigned int tsk_index)
1271 + mutex_unlock(&round_robin_lock);
1272 +
1273 + set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu));
1274 ++
1275 ++ free_cpumask_var(tmp);
1276 + }
1277 +
1278 + static void exit_round_robin(unsigned int tsk_index)
1279 +diff --git a/drivers/acpi/acpica/evevent.c b/drivers/acpi/acpica/evevent.c
1280 +index bf6873f95e72..0b5eedb60d04 100644
1281 +--- a/drivers/acpi/acpica/evevent.c
1282 ++++ b/drivers/acpi/acpica/evevent.c
1283 +@@ -204,6 +204,7 @@ u32 acpi_ev_fixed_event_detect(void)
1284 + u32 fixed_status;
1285 + u32 fixed_enable;
1286 + u32 i;
1287 ++ acpi_status status;
1288 +
1289 + ACPI_FUNCTION_NAME(ev_fixed_event_detect);
1290 +
1291 +@@ -211,8 +212,12 @@ u32 acpi_ev_fixed_event_detect(void)
1292 + * Read the fixed feature status and enable registers, as all the cases
1293 + * depend on their values. Ignore errors here.
1294 + */
1295 +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status);
1296 +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable);
1297 ++ status = acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status);
1298 ++ status |=
1299 ++ acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable);
1300 ++ if (ACPI_FAILURE(status)) {
1301 ++ return (int_status);
1302 ++ }
1303 +
1304 + ACPI_DEBUG_PRINT((ACPI_DB_INTERRUPTS,
1305 + "Fixed Event Block: Enable %08X Status %08X\n",
1306 +diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
1307 +index 7eba578d36f3..10262cae8a19 100644
1308 +--- a/drivers/acpi/acpica/nseval.c
1309 ++++ b/drivers/acpi/acpica/nseval.c
1310 +@@ -308,6 +308,14 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
1311 + /* Map AE_CTRL_RETURN_VALUE to AE_OK, we are done with it */
1312 +
1313 + status = AE_OK;
1314 ++ } else if (ACPI_FAILURE(status)) {
1315 ++
1316 ++ /* If return_object exists, delete it */
1317 ++
1318 ++ if (info->return_object) {
1319 ++ acpi_ut_remove_reference(info->return_object);
1320 ++ info->return_object = NULL;
1321 ++ }
1322 + }
1323 +
1324 + ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
1325 +diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
1326 +index bb01dea39fdc..9825780a1cd2 100644
1327 +--- a/drivers/acpi/processor_perflib.c
1328 ++++ b/drivers/acpi/processor_perflib.c
1329 +@@ -161,7 +161,7 @@ int acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag)
1330 + {
1331 + int ret;
1332 +
1333 +- if (ignore_ppc) {
1334 ++ if (ignore_ppc || !pr->performance) {
1335 + /*
1336 + * Only when it is notification event, the _OST object
1337 + * will be evaluated. Otherwise it is skipped.
1338 +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
1339 +index 60d6db82ce5a..f9b86a1d922d 100644
1340 +--- a/drivers/ata/libata-core.c
1341 ++++ b/drivers/ata/libata-core.c
1342 +@@ -4187,6 +4187,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
1343 + /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
1344 + { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
1345 +
1346 ++ /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on
1347 ++ SD7SN6S256G and SD8SN8U256G */
1348 ++ { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, },
1349 ++
1350 + /* devices which puke on READ_NATIVE_MAX */
1351 + { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
1352 + { "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },
1353 +@@ -4247,6 +4251,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
1354 + { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, },
1355 +
1356 + /* devices that don't properly handle queued TRIM commands */
1357 ++ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
1358 ++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
1359 + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
1360 + ATA_HORKAGE_ZERO_AFTER_TRIM, },
1361 + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
1362 +diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
1363 +index 93362362aa55..8474a1b0740f 100644
1364 +--- a/drivers/block/paride/pcd.c
1365 ++++ b/drivers/block/paride/pcd.c
1366 +@@ -230,6 +230,8 @@ static int pcd_block_open(struct block_device *bdev, fmode_t mode)
1367 + struct pcd_unit *cd = bdev->bd_disk->private_data;
1368 + int ret;
1369 +
1370 ++ check_disk_change(bdev);
1371 ++
1372 + mutex_lock(&pcd_mutex);
1373 + ret = cdrom_open(&cd->info, bdev, mode);
1374 + mutex_unlock(&pcd_mutex);
1375 +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
1376 +index 54cef3dc0beb..91676535a1a3 100644
1377 +--- a/drivers/bluetooth/btusb.c
1378 ++++ b/drivers/bluetooth/btusb.c
1379 +@@ -336,6 +336,9 @@ static const struct usb_device_id blacklist_table[] = {
1380 + { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
1381 + { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
1382 +
1383 ++ /* Additional Realtek 8723BU Bluetooth devices */
1384 ++ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
1385 ++
1386 + /* Additional Realtek 8821AE Bluetooth devices */
1387 + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
1388 + { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
1389 +@@ -343,6 +346,9 @@ static const struct usb_device_id blacklist_table[] = {
1390 + { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
1391 + { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
1392 +
1393 ++ /* Additional Realtek 8822BE Bluetooth devices */
1394 ++ { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
1395 ++
1396 + /* Silicon Wave based devices */
1397 + { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
1398 +
1399 +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
1400 +index b5f245d2875c..0151039bff05 100644
1401 +--- a/drivers/cdrom/cdrom.c
1402 ++++ b/drivers/cdrom/cdrom.c
1403 +@@ -1154,9 +1154,6 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev,
1404 +
1405 + cd_dbg(CD_OPEN, "entering cdrom_open\n");
1406 +
1407 +- /* open is event synchronization point, check events first */
1408 +- check_disk_change(bdev);
1409 +-
1410 + /* if this was a O_NONBLOCK open and we should honor the flags,
1411 + * do a quick open without drive/disc integrity checks. */
1412 + cdi->use_count++;
1413 +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
1414 +index 584bc3126403..e2808fefbb78 100644
1415 +--- a/drivers/cdrom/gdrom.c
1416 ++++ b/drivers/cdrom/gdrom.c
1417 +@@ -497,6 +497,9 @@ static struct cdrom_device_ops gdrom_ops = {
1418 + static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
1419 + {
1420 + int ret;
1421 ++
1422 ++ check_disk_change(bdev);
1423 ++
1424 + mutex_lock(&gdrom_mutex);
1425 + ret = cdrom_open(gd.cd_info, bdev, mode);
1426 + mutex_unlock(&gdrom_mutex);
1427 +diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c
1428 +index 92a810648bd0..530aacca3eb8 100644
1429 +--- a/drivers/char/hw_random/stm32-rng.c
1430 ++++ b/drivers/char/hw_random/stm32-rng.c
1431 +@@ -21,6 +21,7 @@
1432 + #include <linux/of_address.h>
1433 + #include <linux/of_platform.h>
1434 + #include <linux/pm_runtime.h>
1435 ++#include <linux/reset.h>
1436 + #include <linux/slab.h>
1437 +
1438 + #define RNG_CR 0x00
1439 +@@ -46,6 +47,7 @@ struct stm32_rng_private {
1440 + struct hwrng rng;
1441 + void __iomem *base;
1442 + struct clk *clk;
1443 ++ struct reset_control *rst;
1444 + };
1445 +
1446 + static int stm32_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
1447 +@@ -140,6 +142,13 @@ static int stm32_rng_probe(struct platform_device *ofdev)
1448 + if (IS_ERR(priv->clk))
1449 + return PTR_ERR(priv->clk);
1450 +
1451 ++ priv->rst = devm_reset_control_get(&ofdev->dev, NULL);
1452 ++ if (!IS_ERR(priv->rst)) {
1453 ++ reset_control_assert(priv->rst);
1454 ++ udelay(2);
1455 ++ reset_control_deassert(priv->rst);
1456 ++ }
1457 ++
1458 + dev_set_drvdata(dev, priv);
1459 +
1460 + priv->rng.name = dev_driver_string(dev),
1461 +diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c
1462 +index 6e658aa114f1..a70518a4fcec 100644
1463 +--- a/drivers/char/ipmi/ipmi_powernv.c
1464 ++++ b/drivers/char/ipmi/ipmi_powernv.c
1465 +@@ -251,8 +251,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev)
1466 + ipmi->irq = opal_event_request(prop);
1467 + }
1468 +
1469 +- if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
1470 +- "opal-ipmi", ipmi)) {
1471 ++ rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
1472 ++ "opal-ipmi", ipmi);
1473 ++ if (rc) {
1474 + dev_warn(dev, "Unable to request irq\n");
1475 + goto err_dispose;
1476 + }
1477 +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
1478 +index 83c206f0fc98..d6d166fe49a3 100644
1479 +--- a/drivers/char/ipmi/ipmi_ssif.c
1480 ++++ b/drivers/char/ipmi/ipmi_ssif.c
1481 +@@ -757,7 +757,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
1482 + ssif_info->ssif_state = SSIF_NORMAL;
1483 + ipmi_ssif_unlock_cond(ssif_info, flags);
1484 + pr_warn(PFX "Error getting flags: %d %d, %x\n",
1485 +- result, len, data[2]);
1486 ++ result, len, (len >= 3) ? data[2] : 0);
1487 + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
1488 + || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
1489 + /*
1490 +@@ -779,7 +779,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
1491 + if ((result < 0) || (len < 3) || (data[2] != 0)) {
1492 + /* Error clearing flags */
1493 + pr_warn(PFX "Error clearing flags: %d %d, %x\n",
1494 +- result, len, data[2]);
1495 ++ result, len, (len >= 3) ? data[2] : 0);
1496 + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
1497 + || data[1] != IPMI_CLEAR_MSG_FLAGS_CMD) {
1498 + pr_warn(PFX "Invalid response clearing flags: %x %x\n",
1499 +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
1500 +index f13c3f4228d4..53c068f90b37 100644
1501 +--- a/drivers/clk/clk.c
1502 ++++ b/drivers/clk/clk.c
1503 +@@ -1905,6 +1905,9 @@ static int clk_core_get_phase(struct clk_core *core)
1504 + int ret;
1505 +
1506 + clk_prepare_lock();
1507 ++ /* Always try to update cached phase if possible */
1508 ++ if (core->ops->get_phase)
1509 ++ core->phase = core->ops->get_phase(core->hw);
1510 + ret = core->phase;
1511 + clk_prepare_unlock();
1512 +
1513 +diff --git a/drivers/clk/rockchip/clk-mmc-phase.c b/drivers/clk/rockchip/clk-mmc-phase.c
1514 +index 33c20c6b45af..b840e4ace623 100644
1515 +--- a/drivers/clk/rockchip/clk-mmc-phase.c
1516 ++++ b/drivers/clk/rockchip/clk-mmc-phase.c
1517 +@@ -60,6 +60,12 @@ static int rockchip_mmc_get_phase(struct clk_hw *hw)
1518 + u16 degrees;
1519 + u32 delay_num = 0;
1520 +
1521 ++ /* See the comment for rockchip_mmc_set_phase below */
1522 ++ if (!rate) {
1523 ++ pr_err("%s: invalid clk rate\n", __func__);
1524 ++ return -EINVAL;
1525 ++ }
1526 ++
1527 + raw_value = readl(mmc_clock->reg) >> (mmc_clock->shift);
1528 +
1529 + degrees = (raw_value & ROCKCHIP_MMC_DEGREE_MASK) * 90;
1530 +@@ -86,6 +92,23 @@ static int rockchip_mmc_set_phase(struct clk_hw *hw, int degrees)
1531 + u32 raw_value;
1532 + u32 delay;
1533 +
1534 ++ /*
1535 ++ * The below calculation is based on the output clock from
1536 ++ * MMC host to the card, which expects the phase clock inherits
1537 ++ * the clock rate from its parent, namely the output clock
1538 ++ * provider of MMC host. However, things may go wrong if
1539 ++ * (1) It is orphan.
1540 ++ * (2) It is assigned to the wrong parent.
1541 ++ *
1542 ++ * This check help debug the case (1), which seems to be the
1543 ++ * most likely problem we often face and which makes it difficult
1544 ++ * for people to debug unstable mmc tuning results.
1545 ++ */
1546 ++ if (!rate) {
1547 ++ pr_err("%s: invalid clk rate\n", __func__);
1548 ++ return -EINVAL;
1549 ++ }
1550 ++
1551 + nineties = degrees / 90;
1552 + remainder = (degrees % 90);
1553 +
1554 +diff --git a/drivers/clk/samsung/clk-exynos3250.c b/drivers/clk/samsung/clk-exynos3250.c
1555 +index fdd41b17a24f..294efaef5b82 100644
1556 +--- a/drivers/clk/samsung/clk-exynos3250.c
1557 ++++ b/drivers/clk/samsung/clk-exynos3250.c
1558 +@@ -683,7 +683,7 @@ static struct samsung_pll_rate_table exynos3250_epll_rates[] = {
1559 + PLL_36XX_RATE(144000000, 96, 2, 3, 0),
1560 + PLL_36XX_RATE( 96000000, 128, 2, 4, 0),
1561 + PLL_36XX_RATE( 84000000, 112, 2, 4, 0),
1562 +- PLL_36XX_RATE( 80000004, 106, 2, 4, 43691),
1563 ++ PLL_36XX_RATE( 80000003, 106, 2, 4, 43691),
1564 + PLL_36XX_RATE( 73728000, 98, 2, 4, 19923),
1565 + PLL_36XX_RATE( 67737598, 270, 3, 5, 62285),
1566 + PLL_36XX_RATE( 65535999, 174, 2, 5, 49982),
1567 +@@ -719,7 +719,7 @@ static struct samsung_pll_rate_table exynos3250_vpll_rates[] = {
1568 + PLL_36XX_RATE(148352005, 98, 2, 3, 59070),
1569 + PLL_36XX_RATE(108000000, 144, 2, 4, 0),
1570 + PLL_36XX_RATE( 74250000, 99, 2, 4, 0),
1571 +- PLL_36XX_RATE( 74176002, 98, 3, 4, 59070),
1572 ++ PLL_36XX_RATE( 74176002, 98, 2, 4, 59070),
1573 + PLL_36XX_RATE( 54054000, 216, 3, 5, 14156),
1574 + PLL_36XX_RATE( 54000000, 144, 2, 5, 0),
1575 + { /* sentinel */ }
1576 +diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
1577 +index 5bebf8cb0d70..f0b564c7c9c1 100644
1578 +--- a/drivers/clk/samsung/clk-exynos5250.c
1579 ++++ b/drivers/clk/samsung/clk-exynos5250.c
1580 +@@ -711,13 +711,13 @@ static struct samsung_pll_rate_table epll_24mhz_tbl[] __initdata = {
1581 + /* sorted in descending order */
1582 + /* PLL_36XX_RATE(rate, m, p, s, k) */
1583 + PLL_36XX_RATE(192000000, 64, 2, 2, 0),
1584 +- PLL_36XX_RATE(180633600, 90, 3, 2, 20762),
1585 ++ PLL_36XX_RATE(180633605, 90, 3, 2, 20762),
1586 + PLL_36XX_RATE(180000000, 90, 3, 2, 0),
1587 + PLL_36XX_RATE(73728000, 98, 2, 4, 19923),
1588 +- PLL_36XX_RATE(67737600, 90, 2, 4, 20762),
1589 ++ PLL_36XX_RATE(67737602, 90, 2, 4, 20762),
1590 + PLL_36XX_RATE(49152000, 98, 3, 4, 19923),
1591 +- PLL_36XX_RATE(45158400, 90, 3, 4, 20762),
1592 +- PLL_36XX_RATE(32768000, 131, 3, 5, 4719),
1593 ++ PLL_36XX_RATE(45158401, 90, 3, 4, 20762),
1594 ++ PLL_36XX_RATE(32768001, 131, 3, 5, 4719),
1595 + { },
1596 + };
1597 +
1598 +diff --git a/drivers/clk/samsung/clk-exynos5260.c b/drivers/clk/samsung/clk-exynos5260.c
1599 +index d1a29f6c1084..7027e77bf859 100644
1600 +--- a/drivers/clk/samsung/clk-exynos5260.c
1601 ++++ b/drivers/clk/samsung/clk-exynos5260.c
1602 +@@ -65,7 +65,7 @@ static struct samsung_pll_rate_table pll2650_24mhz_tbl[] __initdata = {
1603 + PLL_36XX_RATE(480000000, 160, 2, 2, 0),
1604 + PLL_36XX_RATE(432000000, 144, 2, 2, 0),
1605 + PLL_36XX_RATE(400000000, 200, 3, 2, 0),
1606 +- PLL_36XX_RATE(394073130, 459, 7, 2, 49282),
1607 ++ PLL_36XX_RATE(394073128, 459, 7, 2, 49282),
1608 + PLL_36XX_RATE(333000000, 111, 2, 2, 0),
1609 + PLL_36XX_RATE(300000000, 100, 2, 2, 0),
1610 + PLL_36XX_RATE(266000000, 266, 3, 3, 0),
1611 +diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
1612 +index cee062c588de..91c89ac193b9 100644
1613 +--- a/drivers/clk/samsung/clk-exynos5433.c
1614 ++++ b/drivers/clk/samsung/clk-exynos5433.c
1615 +@@ -747,7 +747,7 @@ static struct samsung_pll_rate_table exynos5443_pll_rates[] = {
1616 + PLL_35XX_RATE(800000000U, 400, 6, 1),
1617 + PLL_35XX_RATE(733000000U, 733, 12, 1),
1618 + PLL_35XX_RATE(700000000U, 175, 3, 1),
1619 +- PLL_35XX_RATE(667000000U, 222, 4, 1),
1620 ++ PLL_35XX_RATE(666000000U, 222, 4, 1),
1621 + PLL_35XX_RATE(633000000U, 211, 4, 1),
1622 + PLL_35XX_RATE(600000000U, 500, 5, 2),
1623 + PLL_35XX_RATE(552000000U, 460, 5, 2),
1624 +@@ -773,12 +773,12 @@ static struct samsung_pll_rate_table exynos5443_pll_rates[] = {
1625 + /* AUD_PLL */
1626 + static struct samsung_pll_rate_table exynos5443_aud_pll_rates[] = {
1627 + PLL_36XX_RATE(400000000U, 200, 3, 2, 0),
1628 +- PLL_36XX_RATE(393216000U, 197, 3, 2, -25690),
1629 ++ PLL_36XX_RATE(393216003U, 197, 3, 2, -25690),
1630 + PLL_36XX_RATE(384000000U, 128, 2, 2, 0),
1631 +- PLL_36XX_RATE(368640000U, 246, 4, 2, -15729),
1632 +- PLL_36XX_RATE(361507200U, 181, 3, 2, -16148),
1633 +- PLL_36XX_RATE(338688000U, 113, 2, 2, -6816),
1634 +- PLL_36XX_RATE(294912000U, 98, 1, 3, 19923),
1635 ++ PLL_36XX_RATE(368639991U, 246, 4, 2, -15729),
1636 ++ PLL_36XX_RATE(361507202U, 181, 3, 2, -16148),
1637 ++ PLL_36XX_RATE(338687988U, 113, 2, 2, -6816),
1638 ++ PLL_36XX_RATE(294912002U, 98, 1, 3, 19923),
1639 + PLL_36XX_RATE(288000000U, 96, 1, 3, 0),
1640 + PLL_36XX_RATE(252000000U, 84, 1, 3, 0),
1641 + { /* sentinel */ }
1642 +diff --git a/drivers/clk/samsung/clk-s3c2410.c b/drivers/clk/samsung/clk-s3c2410.c
1643 +index 0945a8852299..69e3e848716a 100644
1644 +--- a/drivers/clk/samsung/clk-s3c2410.c
1645 ++++ b/drivers/clk/samsung/clk-s3c2410.c
1646 +@@ -168,7 +168,7 @@ static struct samsung_pll_rate_table pll_s3c2410_12mhz_tbl[] __initdata = {
1647 + PLL_35XX_RATE(226000000, 105, 1, 1),
1648 + PLL_35XX_RATE(210000000, 132, 2, 1),
1649 + /* 2410 common */
1650 +- PLL_35XX_RATE(203000000, 161, 3, 1),
1651 ++ PLL_35XX_RATE(202800000, 161, 3, 1),
1652 + PLL_35XX_RATE(192000000, 88, 1, 1),
1653 + PLL_35XX_RATE(186000000, 85, 1, 1),
1654 + PLL_35XX_RATE(180000000, 82, 1, 1),
1655 +@@ -178,18 +178,18 @@ static struct samsung_pll_rate_table pll_s3c2410_12mhz_tbl[] __initdata = {
1656 + PLL_35XX_RATE(147000000, 90, 2, 1),
1657 + PLL_35XX_RATE(135000000, 82, 2, 1),
1658 + PLL_35XX_RATE(124000000, 116, 1, 2),
1659 +- PLL_35XX_RATE(118000000, 150, 2, 2),
1660 ++ PLL_35XX_RATE(118500000, 150, 2, 2),
1661 + PLL_35XX_RATE(113000000, 105, 1, 2),
1662 +- PLL_35XX_RATE(101000000, 127, 2, 2),
1663 ++ PLL_35XX_RATE(101250000, 127, 2, 2),
1664 + PLL_35XX_RATE(90000000, 112, 2, 2),
1665 +- PLL_35XX_RATE(85000000, 105, 2, 2),
1666 ++ PLL_35XX_RATE(84750000, 105, 2, 2),
1667 + PLL_35XX_RATE(79000000, 71, 1, 2),
1668 +- PLL_35XX_RATE(68000000, 82, 2, 2),
1669 +- PLL_35XX_RATE(56000000, 142, 2, 3),
1670 ++ PLL_35XX_RATE(67500000, 82, 2, 2),
1671 ++ PLL_35XX_RATE(56250000, 142, 2, 3),
1672 + PLL_35XX_RATE(48000000, 120, 2, 3),
1673 +- PLL_35XX_RATE(51000000, 161, 3, 3),
1674 ++ PLL_35XX_RATE(50700000, 161, 3, 3),
1675 + PLL_35XX_RATE(45000000, 82, 1, 3),
1676 +- PLL_35XX_RATE(34000000, 82, 2, 3),
1677 ++ PLL_35XX_RATE(33750000, 82, 2, 3),
1678 + { /* sentinel */ },
1679 + };
1680 +
1681 +diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
1682 +index 517e1c7624d4..a00209702f39 100644
1683 +--- a/drivers/clocksource/fsl_ftm_timer.c
1684 ++++ b/drivers/clocksource/fsl_ftm_timer.c
1685 +@@ -281,7 +281,7 @@ static int __init __ftm_clk_init(struct device_node *np, char *cnt_name,
1686 +
1687 + static unsigned long __init ftm_clk_init(struct device_node *np)
1688 + {
1689 +- unsigned long freq;
1690 ++ long freq;
1691 +
1692 + freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt");
1693 + if (freq <= 0)
1694 +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
1695 +index 7c0bdfb1a2ca..0dcbf951ad1b 100644
1696 +--- a/drivers/cpufreq/cppc_cpufreq.c
1697 ++++ b/drivers/cpufreq/cppc_cpufreq.c
1698 +@@ -100,9 +100,19 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
1699 + policy->cpuinfo.max_freq = policy->max;
1700 + policy->shared_type = cpu->shared_type;
1701 +
1702 +- if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY)
1703 ++ if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
1704 ++ int i;
1705 ++
1706 + cpumask_copy(policy->cpus, cpu->shared_cpu_map);
1707 +- else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
1708 ++
1709 ++ for_each_cpu(i, policy->cpus) {
1710 ++ if (unlikely(i == policy->cpu))
1711 ++ continue;
1712 ++
1713 ++ memcpy(&all_cpu_data[i]->perf_caps, &cpu->perf_caps,
1714 ++ sizeof(cpu->perf_caps));
1715 ++ }
1716 ++ } else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
1717 + /* Support only SW_ANY for now. */
1718 + pr_debug("Unsupported CPU co-ord type\n");
1719 + return -EFAULT;
1720 +@@ -166,8 +176,13 @@ static int __init cppc_cpufreq_init(void)
1721 + return ret;
1722 +
1723 + out:
1724 +- for_each_possible_cpu(i)
1725 +- kfree(all_cpu_data[i]);
1726 ++ for_each_possible_cpu(i) {
1727 ++ cpu = all_cpu_data[i];
1728 ++ if (!cpu)
1729 ++ break;
1730 ++ free_cpumask_var(cpu->shared_cpu_map);
1731 ++ kfree(cpu);
1732 ++ }
1733 +
1734 + kfree(all_cpu_data);
1735 + return -ENODEV;
1736 +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-core.c b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
1737 +index 107cd2a41cae..24651d3217cd 100644
1738 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-core.c
1739 ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
1740 +@@ -422,6 +422,7 @@ static struct platform_driver sun4i_ss_driver = {
1741 +
1742 + module_platform_driver(sun4i_ss_driver);
1743 +
1744 ++MODULE_ALIAS("platform:sun4i-ss");
1745 + MODULE_DESCRIPTION("Allwinner Security System cryptographic accelerator");
1746 + MODULE_LICENSE("GPL");
1747 + MODULE_AUTHOR("Corentin LABBE <clabbe.montjoie@×××××.com>");
1748 +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
1749 +index 66d84bcf9bbf..8db791ef2027 100644
1750 +--- a/drivers/dma/pl330.c
1751 ++++ b/drivers/dma/pl330.c
1752 +@@ -1533,7 +1533,7 @@ static void pl330_dotask(unsigned long data)
1753 + /* Returns 1 if state was updated, 0 otherwise */
1754 + static int pl330_update(struct pl330_dmac *pl330)
1755 + {
1756 +- struct dma_pl330_desc *descdone, *tmp;
1757 ++ struct dma_pl330_desc *descdone;
1758 + unsigned long flags;
1759 + void __iomem *regs;
1760 + u32 val;
1761 +@@ -1611,7 +1611,9 @@ static int pl330_update(struct pl330_dmac *pl330)
1762 + }
1763 +
1764 + /* Now that we are in no hurry, do the callbacks */
1765 +- list_for_each_entry_safe(descdone, tmp, &pl330->req_done, rqd) {
1766 ++ while (!list_empty(&pl330->req_done)) {
1767 ++ descdone = list_first_entry(&pl330->req_done,
1768 ++ struct dma_pl330_desc, rqd);
1769 + list_del(&descdone->rqd);
1770 + spin_unlock_irqrestore(&pl330->lock, flags);
1771 + dma_pl330_rqcb(descdone, PL330_ERR_NONE);
1772 +diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
1773 +index 7820d07e7bee..2b36d1c63aa5 100644
1774 +--- a/drivers/dma/sh/rcar-dmac.c
1775 ++++ b/drivers/dma/sh/rcar-dmac.c
1776 +@@ -851,7 +851,7 @@ rcar_dmac_chan_prep_sg(struct rcar_dmac_chan *chan, struct scatterlist *sgl,
1777 +
1778 + rcar_dmac_chan_configure_desc(chan, desc);
1779 +
1780 +- max_chunk_size = (RCAR_DMATCR_MASK + 1) << desc->xfer_shift;
1781 ++ max_chunk_size = RCAR_DMATCR_MASK << desc->xfer_shift;
1782 +
1783 + /*
1784 + * Allocate and fill the transfer chunk descriptors. We own the only
1785 +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
1786 +index c2f5117fd8cb..5545a7f3a98f 100644
1787 +--- a/drivers/firewire/ohci.c
1788 ++++ b/drivers/firewire/ohci.c
1789 +@@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx)
1790 + return -ENOMEM;
1791 +
1792 + offset = (void *)&desc->buffer - (void *)desc;
1793 +- desc->buffer_size = PAGE_SIZE - offset;
1794 ++ /*
1795 ++ * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
1796 ++ * for descriptors, even 0x10-byte ones. This can cause page faults when
1797 ++ * an IOMMU is in use and the oversized read crosses a page boundary.
1798 ++ * Work around this by always leaving at least 0x10 bytes of padding.
1799 ++ */
1800 ++ desc->buffer_size = PAGE_SIZE - offset - 0x10;
1801 + desc->buffer_bus = bus_addr + offset;
1802 + desc->used = 0;
1803 +
1804 +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
1805 +index 0e08e665f715..053a23a7be94 100644
1806 +--- a/drivers/firmware/dmi_scan.c
1807 ++++ b/drivers/firmware/dmi_scan.c
1808 +@@ -18,7 +18,7 @@ EXPORT_SYMBOL_GPL(dmi_kobj);
1809 + * of and an antecedent to, SMBIOS, which stands for System
1810 + * Management BIOS. See further: http://www.dmtf.org/standards
1811 + */
1812 +-static const char dmi_empty_string[] = " ";
1813 ++static const char dmi_empty_string[] = "";
1814 +
1815 + static u32 dmi_ver __initdata;
1816 + static u32 dmi_len;
1817 +@@ -44,25 +44,21 @@ static int dmi_memdev_nr;
1818 + static const char * __init dmi_string_nosave(const struct dmi_header *dm, u8 s)
1819 + {
1820 + const u8 *bp = ((u8 *) dm) + dm->length;
1821 ++ const u8 *nsp;
1822 +
1823 + if (s) {
1824 +- s--;
1825 +- while (s > 0 && *bp) {
1826 ++ while (--s > 0 && *bp)
1827 + bp += strlen(bp) + 1;
1828 +- s--;
1829 +- }
1830 +-
1831 +- if (*bp != 0) {
1832 +- size_t len = strlen(bp)+1;
1833 +- size_t cmp_len = len > 8 ? 8 : len;
1834 +
1835 +- if (!memcmp(bp, dmi_empty_string, cmp_len))
1836 +- return dmi_empty_string;
1837 ++ /* Strings containing only spaces are considered empty */
1838 ++ nsp = bp;
1839 ++ while (*nsp == ' ')
1840 ++ nsp++;
1841 ++ if (*nsp != '\0')
1842 + return bp;
1843 +- }
1844 + }
1845 +
1846 +- return "";
1847 ++ return dmi_empty_string;
1848 + }
1849 +
1850 + static const char * __init dmi_string(const struct dmi_header *dm, u8 s)
1851 +diff --git a/drivers/gpu/drm/exynos/regs-fimc.h b/drivers/gpu/drm/exynos/regs-fimc.h
1852 +index 30496134a3d0..d7cbe53c4c01 100644
1853 +--- a/drivers/gpu/drm/exynos/regs-fimc.h
1854 ++++ b/drivers/gpu/drm/exynos/regs-fimc.h
1855 +@@ -569,7 +569,7 @@
1856 + #define EXYNOS_CIIMGEFF_FIN_EMBOSSING (4 << 26)
1857 + #define EXYNOS_CIIMGEFF_FIN_SILHOUETTE (5 << 26)
1858 + #define EXYNOS_CIIMGEFF_FIN_MASK (7 << 26)
1859 +-#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff < 13) | (0xff < 0))
1860 ++#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff << 13) | (0xff << 0))
1861 +
1862 + /* Real input DMA size register */
1863 + #define EXYNOS_CIREAL_ISIZE_AUTOLOAD_ENABLE (1 << 31)
1864 +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
1865 +index d908321b94ce..e6d07680eb05 100644
1866 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
1867 ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
1868 +@@ -67,7 +67,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
1869 + * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
1870 + */
1871 + vma->vm_flags &= ~VM_PFNMAP;
1872 +- vma->vm_pgoff = 0;
1873 +
1874 + ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
1875 + obj->size, &rk_obj->dma_attrs);
1876 +@@ -99,6 +98,12 @@ int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
1877 + if (ret)
1878 + return ret;
1879 +
1880 ++ /*
1881 ++ * Set vm_pgoff (used as a fake buffer offset by DRM) to 0 and map the
1882 ++ * whole buffer from the start.
1883 ++ */
1884 ++ vma->vm_pgoff = 0;
1885 ++
1886 + obj = vma->vm_private_data;
1887 +
1888 + return rockchip_drm_gem_object_mmap(obj, vma);
1889 +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
1890 +index b4de18e65db8..6296e9f270ca 100644
1891 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
1892 ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
1893 +@@ -208,6 +208,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
1894 + case VIRTGPU_PARAM_3D_FEATURES:
1895 + value = vgdev->has_virgl_3d == true ? 1 : 0;
1896 + break;
1897 ++ case VIRTGPU_PARAM_CAPSET_QUERY_FIX:
1898 ++ value = 1;
1899 ++ break;
1900 + default:
1901 + return -EINVAL;
1902 + }
1903 +@@ -483,7 +486,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
1904 + {
1905 + struct virtio_gpu_device *vgdev = dev->dev_private;
1906 + struct drm_virtgpu_get_caps *args = data;
1907 +- int size;
1908 ++ unsigned size, host_caps_size;
1909 + int i;
1910 + int found_valid = -1;
1911 + int ret;
1912 +@@ -492,6 +495,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
1913 + if (vgdev->num_capsets == 0)
1914 + return -ENOSYS;
1915 +
1916 ++ /* don't allow userspace to pass 0 */
1917 ++ if (args->size == 0)
1918 ++ return -EINVAL;
1919 ++
1920 + spin_lock(&vgdev->display_info_lock);
1921 + for (i = 0; i < vgdev->num_capsets; i++) {
1922 + if (vgdev->capsets[i].id == args->cap_set_id) {
1923 +@@ -507,11 +514,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
1924 + return -EINVAL;
1925 + }
1926 +
1927 +- size = vgdev->capsets[found_valid].max_size;
1928 +- if (args->size > size) {
1929 +- spin_unlock(&vgdev->display_info_lock);
1930 +- return -EINVAL;
1931 +- }
1932 ++ host_caps_size = vgdev->capsets[found_valid].max_size;
1933 ++ /* only copy to user the minimum of the host caps size or the guest caps size */
1934 ++ size = min(args->size, host_caps_size);
1935 +
1936 + list_for_each_entry(cache_ent, &vgdev->cap_cache, head) {
1937 + if (cache_ent->id == args->cap_set_id &&
1938 +diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
1939 +index 966047711fbf..1073c0d1fae5 100644
1940 +--- a/drivers/hid/hid-roccat-kovaplus.c
1941 ++++ b/drivers/hid/hid-roccat-kovaplus.c
1942 +@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(uint value)
1943 + static void kovaplus_profile_activated(struct kovaplus_device *kovaplus,
1944 + uint new_profile_index)
1945 + {
1946 ++ if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings))
1947 ++ return;
1948 + kovaplus->actual_profile = new_profile_index;
1949 + kovaplus->actual_cpi = kovaplus->profile_settings[new_profile_index].cpi_startup_level;
1950 + kovaplus->actual_x_sensitivity = kovaplus->profile_settings[new_profile_index].sensitivity_x;
1951 +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
1952 +index d7ebdf8651f5..d3c6115f16b9 100644
1953 +--- a/drivers/hwmon/nct6775.c
1954 ++++ b/drivers/hwmon/nct6775.c
1955 +@@ -1390,7 +1390,7 @@ static void nct6775_update_pwm(struct device *dev)
1956 + duty_is_dc = data->REG_PWM_MODE[i] &&
1957 + (nct6775_read_value(data, data->REG_PWM_MODE[i])
1958 + & data->PWM_MODE_MASK[i]);
1959 +- data->pwm_mode[i] = duty_is_dc;
1960 ++ data->pwm_mode[i] = !duty_is_dc;
1961 +
1962 + fanmodecfg = nct6775_read_value(data, data->REG_FAN_MODE[i]);
1963 + for (j = 0; j < ARRAY_SIZE(data->REG_PWM); j++) {
1964 +@@ -2267,7 +2267,7 @@ show_pwm_mode(struct device *dev, struct device_attribute *attr, char *buf)
1965 + struct nct6775_data *data = nct6775_update_device(dev);
1966 + struct sensor_device_attribute *sattr = to_sensor_dev_attr(attr);
1967 +
1968 +- return sprintf(buf, "%d\n", !data->pwm_mode[sattr->index]);
1969 ++ return sprintf(buf, "%d\n", data->pwm_mode[sattr->index]);
1970 + }
1971 +
1972 + static ssize_t
1973 +@@ -2288,9 +2288,9 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
1974 + if (val > 1)
1975 + return -EINVAL;
1976 +
1977 +- /* Setting DC mode is not supported for all chips/channels */
1978 ++ /* Setting DC mode (0) is not supported for all chips/channels */
1979 + if (data->REG_PWM_MODE[nr] == 0) {
1980 +- if (val)
1981 ++ if (!val)
1982 + return -EINVAL;
1983 + return count;
1984 + }
1985 +@@ -2299,7 +2299,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
1986 + data->pwm_mode[nr] = val;
1987 + reg = nct6775_read_value(data, data->REG_PWM_MODE[nr]);
1988 + reg &= ~data->PWM_MODE_MASK[nr];
1989 +- if (val)
1990 ++ if (!val)
1991 + reg |= data->PWM_MODE_MASK[nr];
1992 + nct6775_write_value(data, data->REG_PWM_MODE[nr], reg);
1993 + mutex_unlock(&data->update_lock);
1994 +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
1995 +index 18477dd1e243..c3f4c9ef6705 100644
1996 +--- a/drivers/hwmon/pmbus/adm1275.c
1997 ++++ b/drivers/hwmon/pmbus/adm1275.c
1998 +@@ -141,7 +141,7 @@ static int adm1275_read_word_data(struct i2c_client *client, int page, int reg)
1999 + const struct adm1275_data *data = to_adm1275_data(info);
2000 + int ret = 0;
2001 +
2002 +- if (page)
2003 ++ if (page > 0)
2004 + return -ENXIO;
2005 +
2006 + switch (reg) {
2007 +@@ -218,7 +218,7 @@ static int adm1275_write_word_data(struct i2c_client *client, int page, int reg,
2008 + const struct adm1275_data *data = to_adm1275_data(info);
2009 + int ret;
2010 +
2011 +- if (page)
2012 ++ if (page > 0)
2013 + return -ENXIO;
2014 +
2015 + switch (reg) {
2016 +diff --git a/drivers/hwmon/pmbus/max8688.c b/drivers/hwmon/pmbus/max8688.c
2017 +index dd4883a19045..e951f9b87abb 100644
2018 +--- a/drivers/hwmon/pmbus/max8688.c
2019 ++++ b/drivers/hwmon/pmbus/max8688.c
2020 +@@ -45,7 +45,7 @@ static int max8688_read_word_data(struct i2c_client *client, int page, int reg)
2021 + {
2022 + int ret;
2023 +
2024 +- if (page)
2025 ++ if (page > 0)
2026 + return -ENXIO;
2027 +
2028 + switch (reg) {
2029 +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
2030 +index 43207f52e5a3..332d32c53c41 100644
2031 +--- a/drivers/i2c/busses/i2c-mv64xxx.c
2032 ++++ b/drivers/i2c/busses/i2c-mv64xxx.c
2033 +@@ -856,12 +856,16 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
2034 + */
2035 + if (of_device_is_compatible(np, "marvell,mv78230-i2c")) {
2036 + drv_data->offload_enabled = true;
2037 +- drv_data->errata_delay = true;
2038 ++ /* The delay is only needed in standard mode (100kHz) */
2039 ++ if (bus_freq <= 100000)
2040 ++ drv_data->errata_delay = true;
2041 + }
2042 +
2043 + if (of_device_is_compatible(np, "marvell,mv78230-a0-i2c")) {
2044 + drv_data->offload_enabled = false;
2045 +- drv_data->errata_delay = true;
2046 ++ /* The delay is only needed in standard mode (100kHz) */
2047 ++ if (bus_freq <= 100000)
2048 ++ drv_data->errata_delay = true;
2049 + }
2050 +
2051 + if (of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
2052 +diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
2053 +index ef907fd5ba98..08a21d635d0d 100644
2054 +--- a/drivers/ide/ide-cd.c
2055 ++++ b/drivers/ide/ide-cd.c
2056 +@@ -1593,6 +1593,8 @@ static int idecd_open(struct block_device *bdev, fmode_t mode)
2057 + struct cdrom_info *info;
2058 + int rc = -ENXIO;
2059 +
2060 ++ check_disk_change(bdev);
2061 ++
2062 + mutex_lock(&ide_cd_mutex);
2063 + info = ide_cd_get(bdev->bd_disk);
2064 + if (!info)
2065 +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
2066 +index 2b9c00faca7d..795938edce3f 100644
2067 +--- a/drivers/infiniband/core/ucma.c
2068 ++++ b/drivers/infiniband/core/ucma.c
2069 +@@ -1295,7 +1295,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
2070 + if (IS_ERR(ctx))
2071 + return PTR_ERR(ctx);
2072 +
2073 +- if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
2074 ++ if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
2075 + return -EINVAL;
2076 +
2077 + optval = memdup_user((void __user *) (unsigned long) cmd.optval,
2078 +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
2079 +index c5390f6f94c5..43d277a931c2 100644
2080 +--- a/drivers/infiniband/hw/mlx5/qp.c
2081 ++++ b/drivers/infiniband/hw/mlx5/qp.c
2082 +@@ -3161,12 +3161,9 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd)
2083 + int err;
2084 +
2085 + err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
2086 +- if (err) {
2087 ++ if (err)
2088 + mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
2089 +- return err;
2090 +- }
2091 +
2092 + kfree(xrcd);
2093 +-
2094 + return 0;
2095 + }
2096 +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
2097 +index 37b42447045d..fcb18b11db75 100644
2098 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
2099 ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
2100 +@@ -1953,6 +1953,9 @@ static struct net_device *ipoib_add_port(const char *format,
2101 + goto event_failed;
2102 + }
2103 +
2104 ++ /* call event handler to ensure pkey in sync */
2105 ++ queue_work(ipoib_workqueue, &priv->flush_heavy);
2106 ++
2107 + result = register_netdev(priv->dev);
2108 + if (result) {
2109 + printk(KERN_WARNING "%s: couldn't register ipoib port %d; error %d\n",
2110 +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
2111 +index 3f1c4dea8866..9ab424b9b281 100644
2112 +--- a/drivers/irqchip/irq-gic-v3.c
2113 ++++ b/drivers/irqchip/irq-gic-v3.c
2114 +@@ -589,7 +589,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
2115 + MPIDR_TO_SGI_AFFINITY(cluster_id, 1) |
2116 + tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
2117 +
2118 +- pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
2119 ++ pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
2120 + gic_write_sgi1r(val);
2121 + }
2122 +
2123 +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
2124 +index aa84fcfd59fc..16c3390e5d9f 100644
2125 +--- a/drivers/md/bcache/alloc.c
2126 ++++ b/drivers/md/bcache/alloc.c
2127 +@@ -285,8 +285,10 @@ do { \
2128 + break; \
2129 + \
2130 + mutex_unlock(&(ca)->set->bucket_lock); \
2131 +- if (kthread_should_stop()) \
2132 ++ if (kthread_should_stop()) { \
2133 ++ set_current_state(TASK_RUNNING); \
2134 + return 0; \
2135 ++ } \
2136 + \
2137 + try_to_freeze(); \
2138 + schedule(); \
2139 +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
2140 +index 02619cabda8b..7fe7df56fa33 100644
2141 +--- a/drivers/md/bcache/bcache.h
2142 ++++ b/drivers/md/bcache/bcache.h
2143 +@@ -904,7 +904,7 @@ void bcache_write_super(struct cache_set *);
2144 +
2145 + int bch_flash_dev_create(struct cache_set *c, uint64_t size);
2146 +
2147 +-int bch_cached_dev_attach(struct cached_dev *, struct cache_set *);
2148 ++int bch_cached_dev_attach(struct cached_dev *, struct cache_set *, uint8_t *);
2149 + void bch_cached_dev_detach(struct cached_dev *);
2150 + void bch_cached_dev_run(struct cached_dev *);
2151 + void bcache_device_stop(struct bcache_device *);
2152 +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
2153 +index a5a6909280fe..4ed621ad27e4 100644
2154 +--- a/drivers/md/bcache/btree.c
2155 ++++ b/drivers/md/bcache/btree.c
2156 +@@ -1869,14 +1869,17 @@ void bch_initial_gc_finish(struct cache_set *c)
2157 + */
2158 + for_each_cache(ca, c, i) {
2159 + for_each_bucket(b, ca) {
2160 +- if (fifo_full(&ca->free[RESERVE_PRIO]))
2161 ++ if (fifo_full(&ca->free[RESERVE_PRIO]) &&
2162 ++ fifo_full(&ca->free[RESERVE_BTREE]))
2163 + break;
2164 +
2165 + if (bch_can_invalidate_bucket(ca, b) &&
2166 + !GC_MARK(b)) {
2167 + __bch_invalidate_one_bucket(ca, b);
2168 +- fifo_push(&ca->free[RESERVE_PRIO],
2169 +- b - ca->buckets);
2170 ++ if (!fifo_push(&ca->free[RESERVE_PRIO],
2171 ++ b - ca->buckets))
2172 ++ fifo_push(&ca->free[RESERVE_BTREE],
2173 ++ b - ca->buckets);
2174 + }
2175 + }
2176 + }
2177 +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
2178 +index e73aeb0e892c..e497bde96db3 100644
2179 +--- a/drivers/md/bcache/request.c
2180 ++++ b/drivers/md/bcache/request.c
2181 +@@ -633,11 +633,11 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
2182 + static void search_free(struct closure *cl)
2183 + {
2184 + struct search *s = container_of(cl, struct search, cl);
2185 +- bio_complete(s);
2186 +
2187 + if (s->iop.bio)
2188 + bio_put(s->iop.bio);
2189 +
2190 ++ bio_complete(s);
2191 + closure_debug_destroy(cl);
2192 + mempool_free(s, s->d->c->search);
2193 + }
2194 +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
2195 +index f636af441da6..ef28ddfff7c6 100644
2196 +--- a/drivers/md/bcache/super.c
2197 ++++ b/drivers/md/bcache/super.c
2198 +@@ -936,7 +936,8 @@ void bch_cached_dev_detach(struct cached_dev *dc)
2199 + cached_dev_put(dc);
2200 + }
2201 +
2202 +-int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
2203 ++int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
2204 ++ uint8_t *set_uuid)
2205 + {
2206 + uint32_t rtime = cpu_to_le32(get_seconds());
2207 + struct uuid_entry *u;
2208 +@@ -945,7 +946,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
2209 +
2210 + bdevname(dc->bdev, buf);
2211 +
2212 +- if (memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16))
2213 ++ if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
2214 ++ (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
2215 + return -ENOENT;
2216 +
2217 + if (dc->disk.c) {
2218 +@@ -1189,7 +1191,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
2219 +
2220 + list_add(&dc->list, &uncached_devices);
2221 + list_for_each_entry(c, &bch_cache_sets, list)
2222 +- bch_cached_dev_attach(dc, c);
2223 ++ bch_cached_dev_attach(dc, c, NULL);
2224 +
2225 + if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE ||
2226 + BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
2227 +@@ -1711,7 +1713,7 @@ static void run_cache_set(struct cache_set *c)
2228 + bcache_write_super(c);
2229 +
2230 + list_for_each_entry_safe(dc, t, &uncached_devices, list)
2231 +- bch_cached_dev_attach(dc, c);
2232 ++ bch_cached_dev_attach(dc, c, NULL);
2233 +
2234 + flash_devs_run(c);
2235 +
2236 +@@ -1828,6 +1830,7 @@ void bch_cache_release(struct kobject *kobj)
2237 + static int cache_alloc(struct cache_sb *sb, struct cache *ca)
2238 + {
2239 + size_t free;
2240 ++ size_t btree_buckets;
2241 + struct bucket *b;
2242 +
2243 + __module_get(THIS_MODULE);
2244 +@@ -1837,9 +1840,19 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
2245 + ca->journal.bio.bi_max_vecs = 8;
2246 + ca->journal.bio.bi_io_vec = ca->journal.bio.bi_inline_vecs;
2247 +
2248 ++ /*
2249 ++ * when ca->sb.njournal_buckets is not zero, journal exists,
2250 ++ * and in bch_journal_replay(), tree node may split,
2251 ++ * so bucket of RESERVE_BTREE type is needed,
2252 ++ * the worst situation is all journal buckets are valid journal,
2253 ++ * and all the keys need to replay,
2254 ++ * so the number of RESERVE_BTREE type buckets should be as much
2255 ++ * as journal buckets
2256 ++ */
2257 ++ btree_buckets = ca->sb.njournal_buckets ?: 8;
2258 + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
2259 +
2260 +- if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
2261 ++ if (!init_fifo(&ca->free[RESERVE_BTREE], btree_buckets, GFP_KERNEL) ||
2262 + !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
2263 + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
2264 + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
2265 +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
2266 +index 4fbb5532f24c..5a5c1f1bd8a5 100644
2267 +--- a/drivers/md/bcache/sysfs.c
2268 ++++ b/drivers/md/bcache/sysfs.c
2269 +@@ -191,7 +191,7 @@ STORE(__cached_dev)
2270 + {
2271 + struct cached_dev *dc = container_of(kobj, struct cached_dev,
2272 + disk.kobj);
2273 +- ssize_t v = size;
2274 ++ ssize_t v;
2275 + struct cache_set *c;
2276 + struct kobj_uevent_env *env;
2277 +
2278 +@@ -263,17 +263,20 @@ STORE(__cached_dev)
2279 + }
2280 +
2281 + if (attr == &sysfs_attach) {
2282 +- if (bch_parse_uuid(buf, dc->sb.set_uuid) < 16)
2283 ++ uint8_t set_uuid[16];
2284 ++
2285 ++ if (bch_parse_uuid(buf, set_uuid) < 16)
2286 + return -EINVAL;
2287 +
2288 ++ v = -ENOENT;
2289 + list_for_each_entry(c, &bch_cache_sets, list) {
2290 +- v = bch_cached_dev_attach(dc, c);
2291 ++ v = bch_cached_dev_attach(dc, c, set_uuid);
2292 + if (!v)
2293 + return size;
2294 + }
2295 +
2296 + pr_err("Can't attach %s: cache set not found", buf);
2297 +- size = v;
2298 ++ return v;
2299 + }
2300 +
2301 + if (attr == &sysfs_detach && dc->disk.c)
2302 +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
2303 +index bbb1dc9e1639..f2c0000de613 100644
2304 +--- a/drivers/md/bcache/writeback.c
2305 ++++ b/drivers/md/bcache/writeback.c
2306 +@@ -425,19 +425,28 @@ static int bch_writeback_thread(void *arg)
2307 +
2308 + while (!kthread_should_stop()) {
2309 + down_write(&dc->writeback_lock);
2310 +- if (!atomic_read(&dc->has_dirty) ||
2311 +- (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) &&
2312 +- !dc->writeback_running)) {
2313 ++ set_current_state(TASK_INTERRUPTIBLE);
2314 ++ /*
2315 ++ * If the bache device is detaching, skip here and continue
2316 ++ * to perform writeback. Otherwise, if no dirty data on cache,
2317 ++ * or there is dirty data on cache but writeback is disabled,
2318 ++ * the writeback thread should sleep here and wait for others
2319 ++ * to wake up it.
2320 ++ */
2321 ++ if (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) &&
2322 ++ (!atomic_read(&dc->has_dirty) || !dc->writeback_running)) {
2323 + up_write(&dc->writeback_lock);
2324 +- set_current_state(TASK_INTERRUPTIBLE);
2325 +
2326 +- if (kthread_should_stop())
2327 ++ if (kthread_should_stop()) {
2328 ++ set_current_state(TASK_RUNNING);
2329 + return 0;
2330 ++ }
2331 +
2332 + try_to_freeze();
2333 + schedule();
2334 + continue;
2335 + }
2336 ++ set_current_state(TASK_RUNNING);
2337 +
2338 + searched_full_index = refill_dirty(dc);
2339 +
2340 +@@ -447,6 +456,14 @@ static int bch_writeback_thread(void *arg)
2341 + cached_dev_put(dc);
2342 + SET_BDEV_STATE(&dc->sb, BDEV_STATE_CLEAN);
2343 + bch_write_bdev_super(dc, NULL);
2344 ++ /*
2345 ++ * If bcache device is detaching via sysfs interface,
2346 ++ * writeback thread should stop after there is no dirty
2347 ++ * data on cache. BCACHE_DEV_DETACHING flag is set in
2348 ++ * bch_cached_dev_detach().
2349 ++ */
2350 ++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
2351 ++ break;
2352 + }
2353 +
2354 + up_write(&dc->writeback_lock);
2355 +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
2356 +index f24a9e14021d..89dcbf2fa846 100644
2357 +--- a/drivers/md/raid1.c
2358 ++++ b/drivers/md/raid1.c
2359 +@@ -1686,6 +1686,17 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
2360 + struct md_rdev *repl =
2361 + conf->mirrors[conf->raid_disks + number].rdev;
2362 + freeze_array(conf, 0);
2363 ++ if (atomic_read(&repl->nr_pending)) {
2364 ++ /* It means that some queued IO of retry_list
2365 ++ * hold repl. Thus, we cannot set replacement
2366 ++ * as NULL, avoiding rdev NULL pointer
2367 ++ * dereference in sync_request_write and
2368 ++ * handle_write_finished.
2369 ++ */
2370 ++ err = -EBUSY;
2371 ++ unfreeze_array(conf);
2372 ++ goto abort;
2373 ++ }
2374 + clear_bit(Replacement, &repl->flags);
2375 + p->rdev = repl;
2376 + conf->mirrors[conf->raid_disks + number].rdev = NULL;
2377 +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
2378 +index bf0410403a6f..7b6acedc89c1 100644
2379 +--- a/drivers/md/raid10.c
2380 ++++ b/drivers/md/raid10.c
2381 +@@ -2630,7 +2630,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
2382 + for (m = 0; m < conf->copies; m++) {
2383 + int dev = r10_bio->devs[m].devnum;
2384 + rdev = conf->mirrors[dev].rdev;
2385 +- if (r10_bio->devs[m].bio == NULL)
2386 ++ if (r10_bio->devs[m].bio == NULL ||
2387 ++ r10_bio->devs[m].bio->bi_end_io == NULL)
2388 + continue;
2389 + if (!r10_bio->devs[m].bio->bi_error) {
2390 + rdev_clear_badblocks(
2391 +@@ -2645,7 +2646,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
2392 + md_error(conf->mddev, rdev);
2393 + }
2394 + rdev = conf->mirrors[dev].replacement;
2395 +- if (r10_bio->devs[m].repl_bio == NULL)
2396 ++ if (r10_bio->devs[m].repl_bio == NULL ||
2397 ++ r10_bio->devs[m].repl_bio->bi_end_io == NULL)
2398 + continue;
2399 +
2400 + if (!r10_bio->devs[m].repl_bio->bi_error) {
2401 +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
2402 +index e2130fb4597d..d59b861764a1 100644
2403 +--- a/drivers/md/raid5.c
2404 ++++ b/drivers/md/raid5.c
2405 +@@ -2028,15 +2028,16 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
2406 + static int grow_stripes(struct r5conf *conf, int num)
2407 + {
2408 + struct kmem_cache *sc;
2409 ++ size_t namelen = sizeof(conf->cache_name[0]);
2410 + int devs = max(conf->raid_disks, conf->previous_raid_disks);
2411 +
2412 + if (conf->mddev->gendisk)
2413 +- sprintf(conf->cache_name[0],
2414 ++ snprintf(conf->cache_name[0], namelen,
2415 + "raid%d-%s", conf->level, mdname(conf->mddev));
2416 + else
2417 +- sprintf(conf->cache_name[0],
2418 ++ snprintf(conf->cache_name[0], namelen,
2419 + "raid%d-%p", conf->level, conf->mddev);
2420 +- sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
2421 ++ snprintf(conf->cache_name[1], namelen, "%.27s-alt", conf->cache_name[0]);
2422 +
2423 + conf->active_name = 0;
2424 + sc = kmem_cache_create(conf->cache_name[conf->active_name],
2425 +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
2426 +index ea9abde902e9..209db65ab610 100644
2427 +--- a/drivers/media/dvb-core/dmxdev.c
2428 ++++ b/drivers/media/dvb-core/dmxdev.c
2429 +@@ -1071,7 +1071,7 @@ static int dvb_demux_do_ioctl(struct file *file,
2430 + break;
2431 +
2432 + default:
2433 +- ret = -EINVAL;
2434 ++ ret = -ENOTTY;
2435 + break;
2436 + }
2437 + mutex_unlock(&dmxdev->mutex);
2438 +diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
2439 +index f384f295676e..679d122af63c 100644
2440 +--- a/drivers/media/pci/cx23885/cx23885-cards.c
2441 ++++ b/drivers/media/pci/cx23885/cx23885-cards.c
2442 +@@ -2124,6 +2124,10 @@ void cx23885_card_setup(struct cx23885_dev *dev)
2443 + &dev->i2c_bus[2].i2c_adap,
2444 + "cx25840", 0x88 >> 1, NULL);
2445 + if (dev->sd_cx25840) {
2446 ++ /* set host data for clk_freq configuration */
2447 ++ v4l2_set_subdev_hostdata(dev->sd_cx25840,
2448 ++ &dev->clk_freq);
2449 ++
2450 + dev->sd_cx25840->grp_id = CX23885_HW_AV_CORE;
2451 + v4l2_subdev_call(dev->sd_cx25840, core, load_fw);
2452 + }
2453 +diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
2454 +index e8f847226a19..6eb3be13b430 100644
2455 +--- a/drivers/media/pci/cx23885/cx23885-core.c
2456 ++++ b/drivers/media/pci/cx23885/cx23885-core.c
2457 +@@ -872,6 +872,16 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
2458 + if (cx23885_boards[dev->board].clk_freq > 0)
2459 + dev->clk_freq = cx23885_boards[dev->board].clk_freq;
2460 +
2461 ++ if (dev->board == CX23885_BOARD_HAUPPAUGE_IMPACTVCBE &&
2462 ++ dev->pci->subsystem_device == 0x7137) {
2463 ++ /* Hauppauge ImpactVCBe device ID 0x7137 is populated
2464 ++ * with an 888, and a 25Mhz crystal, instead of the
2465 ++ * usual third overtone 50Mhz. The default clock rate must
2466 ++ * be overridden so the cx25840 is properly configured
2467 ++ */
2468 ++ dev->clk_freq = 25000000;
2469 ++ }
2470 ++
2471 + dev->pci_bus = dev->pci->bus->number;
2472 + dev->pci_slot = PCI_SLOT(dev->pci->devfn);
2473 + cx23885_irq_add(dev, 0x001f00);
2474 +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
2475 +index 0042803a9de7..54398d8a4696 100644
2476 +--- a/drivers/media/pci/cx25821/cx25821-core.c
2477 ++++ b/drivers/media/pci/cx25821/cx25821-core.c
2478 +@@ -871,6 +871,10 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
2479 + dev->nr = ++cx25821_devcount;
2480 + sprintf(dev->name, "cx25821[%d]", dev->nr);
2481 +
2482 ++ if (dev->nr >= ARRAY_SIZE(card)) {
2483 ++ CX25821_INFO("dev->nr >= %zd", ARRAY_SIZE(card));
2484 ++ return -ENODEV;
2485 ++ }
2486 + if (dev->pci->device != 0x8210) {
2487 + pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n",
2488 + __func__, dev->pci->device);
2489 +@@ -886,9 +890,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
2490 + dev->channels[i].sram_channels = &cx25821_sram_channels[i];
2491 + }
2492 +
2493 +- if (dev->nr > 1)
2494 +- CX25821_INFO("dev->nr > 1!");
2495 +-
2496 + /* board config */
2497 + dev->board = 1; /* card[dev->nr]; */
2498 + dev->_max_num_decoders = MAX_DECODERS;
2499 +diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
2500 +index 537b858cb94a..fa6af4a7dae1 100644
2501 +--- a/drivers/media/platform/s3c-camif/camif-capture.c
2502 ++++ b/drivers/media/platform/s3c-camif/camif-capture.c
2503 +@@ -1268,16 +1268,17 @@ static void __camif_subdev_try_format(struct camif_dev *camif,
2504 + {
2505 + const struct s3c_camif_variant *variant = camif->variant;
2506 + const struct vp_pix_limits *pix_lim;
2507 +- int i = ARRAY_SIZE(camif_mbus_formats);
2508 ++ unsigned int i;
2509 +
2510 + /* FIXME: constraints against codec or preview path ? */
2511 + pix_lim = &variant->vp_pix_limits[VP_CODEC];
2512 +
2513 +- while (i-- >= 0)
2514 ++ for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++)
2515 + if (camif_mbus_formats[i] == mf->code)
2516 + break;
2517 +
2518 +- mf->code = camif_mbus_formats[i];
2519 ++ if (i == ARRAY_SIZE(camif_mbus_formats))
2520 ++ mf->code = camif_mbus_formats[0];
2521 +
2522 + if (pad == CAMIF_SD_PAD_SINK) {
2523 + v4l_bound_align_image(&mf->width, 8, CAMIF_MAX_PIX_WIDTH,
2524 +diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
2525 +index 76bf8ba372b3..5b53e31ce262 100644
2526 +--- a/drivers/media/usb/em28xx/em28xx.h
2527 ++++ b/drivers/media/usb/em28xx/em28xx.h
2528 +@@ -187,7 +187,7 @@
2529 + USB 2.0 spec says bulk packet size is always 512 bytes
2530 + */
2531 + #define EM28XX_BULK_PACKET_MULTIPLIER 384
2532 +-#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 384
2533 ++#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 94
2534 +
2535 + #define EM28XX_INTERLACED_DEFAULT 1
2536 +
2537 +diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
2538 +index 02b5f69e1a42..14cf6dfc3b14 100644
2539 +--- a/drivers/message/fusion/mptctl.c
2540 ++++ b/drivers/message/fusion/mptctl.c
2541 +@@ -2698,6 +2698,8 @@ mptctl_hp_targetinfo(unsigned long arg)
2542 + __FILE__, __LINE__, iocnum);
2543 + return -ENODEV;
2544 + }